suricata
reputation.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  * \author Victor Julien <victor@inliniac.net>
23  * Original Idea by Matt Jonkman
24  */
25 
26 #ifndef __REPUTATION_H__
27 #define __REPUTATION_H__
28 
29 #include "host.h"
30 
31 #define SREP_MAX_CATS 60
32 #define SREP_MAX_VAL 127
33 
34 typedef struct SRepCIDRTree_ {
37 } SRepCIDRTree;
38 
39 typedef struct SReputation_ {
40  uint32_t version;
41  uint8_t rep[SREP_MAX_CATS];
42 } SReputation;
43 
44 uint8_t SRepCatGetByShortname(char *shortname);
45 int SRepInit(struct DetectEngineCtx_ *de_ctx);
46 void SRepDestroy(struct DetectEngineCtx_ *de_ctx);
47 void SRepReloadComplete(void);
48 int SRepHostTimedOut(Host *);
49 
50 uint8_t SRepCIDRGetIPRepSrc(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version);
51 uint8_t SRepCIDRGetIPRepDst(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version);
52 void SRepResetVersion(void);
53 int SRepLoadCatFileFromFD(FILE *fp);
54 int SRepLoadFileFromFD(SRepCIDRTree *cidr_ctx, FILE *fp);
55 
56 void SCReputationRegisterTests(void);
57 
58 #endif /* __REPUTATION_H__ */
void SRepDestroy(struct DetectEngineCtx_ *de_ctx)
Definition: reputation.c:662
int SRepInit(struct DetectEngineCtx_ *de_ctx)
init reputation
Definition: reputation.c:579
uint8_t SRepCIDRGetIPRepSrc(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
Definition: reputation.c:146
void SRepReloadComplete(void)
Increment effective reputation version after a rule/reputatio reload is complete. ...
Definition: reputation.c:172
uint8_t SRepCatGetByShortname(char *shortname)
Definition: reputation.c:340
SCRadixTree * srepIPV4_tree[SREP_MAX_CATS]
Definition: reputation.h:35
#define SREP_MAX_CATS
Definition: reputation.h:31
uint8_t SRepCIDRGetIPRepDst(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
Definition: reputation.c:158
struct SReputation_ SReputation
void SCReputationRegisterTests(void)
Definition: reputation.c:147
main detection engine ctx
Definition: detect.h:761
int SRepLoadCatFileFromFD(FILE *fp)
Definition: reputation.c:368
SCRadixTree * srepIPV6_tree[SREP_MAX_CATS]
Definition: reputation.h:36
struct SRepCIDRTree_ SRepCIDRTree
uint32_t version
Definition: reputation.h:40
void SRepResetVersion(void)
Definition: reputation.c:60
int SRepHostTimedOut(Host *)
Check if a Host is timed out wrt ip rep, meaning a new version is in place.
Definition: reputation.c:196
int SRepLoadFileFromFD(SRepCIDRTree *cidr_ctx, FILE *fp)
Definition: reputation.c:435
uint8_t version
Definition: decode-gre.h:405
Definition: host.h:58
Structure for the radix tree.