suricata
reputation.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  * \author Victor Julien <victor@inliniac.net>
23  * Original Idea by Matt Jonkman
24  */
25 
26 #ifndef SURICATA_REPUTATION_H
27 #define SURICATA_REPUTATION_H
28 
29 #include "host.h"
30 #include "util-radix4-tree.h"
31 #include "util-radix6-tree.h"
32 
33 #define SREP_MAX_CATS 60
34 #define SREP_MAX_VAL 127
35 
36 typedef struct SRepCIDRTree_ {
40 
41 typedef struct SReputation_ {
42  uint32_t version;
43  uint8_t rep[SREP_MAX_CATS];
45 
46 void SRepFreeHostData(Host *h);
47 uint8_t SRepCatGetByShortname(char *shortname);
48 int SRepInit(struct DetectEngineCtx_ *de_ctx);
49 void SRepDestroy(struct DetectEngineCtx_ *de_ctx);
50 void SRepReloadComplete(void);
51 int SRepHostTimedOut(Host *);
52 
53 int8_t SRepCIDRGetIPRepSrc(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version);
54 int8_t SRepCIDRGetIPRepDst(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version);
55 void SRepResetVersion(void);
56 int SRepLoadCatFileFromFD(FILE *fp);
57 int SRepLoadFileFromFD(SRepCIDRTree *cidr_ctx, FILE *fp);
58 
59 void SCReputationRegisterTests(void);
60 
61 #endif /* SURICATA_REPUTATION_H */
host.h
SReputation_
Definition: reputation.h:41
SREP_MAX_CATS
#define SREP_MAX_CATS
Definition: reputation.h:33
SReputation_::rep
uint8_t rep[SREP_MAX_CATS]
Definition: reputation.h:43
SRepLoadCatFileFromFD
int SRepLoadCatFileFromFD(FILE *fp)
Definition: reputation.c:357
SRepCIDRGetIPRepDst
int8_t SRepCIDRGetIPRepDst(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
Definition: reputation.c:147
SRepCIDRTree_::srep_ipv6_tree
SCRadix6Tree srep_ipv6_tree[SREP_MAX_CATS]
Definition: reputation.h:38
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:843
SRepCIDRGetIPRepSrc
int8_t SRepCIDRGetIPRepSrc(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
Definition: reputation.c:135
SRepResetVersion
void SRepResetVersion(void)
Definition: reputation.c:64
SCRadix4Tree_
Structure for the radix tree.
Definition: util-radix4-tree.h:66
SRepCIDRTree_
Definition: reputation.h:36
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
SRepFreeHostData
void SRepFreeHostData(Host *h)
Definition: reputation.c:167
SRepCIDRTree
struct SRepCIDRTree_ SRepCIDRTree
Packet_
Definition: decode.h:476
SRepCIDRTree_::srep_ipv4_tree
SCRadix4Tree srep_ipv4_tree[SREP_MAX_CATS]
Definition: reputation.h:37
SRepInit
int SRepInit(struct DetectEngineCtx_ *de_ctx)
init reputation
Definition: reputation.c:566
SRepCatGetByShortname
uint8_t SRepCatGetByShortname(char *shortname)
Definition: reputation.c:329
SRepDestroy
void SRepDestroy(struct DetectEngineCtx_ *de_ctx)
Definition: reputation.c:649
SRepReloadComplete
void SRepReloadComplete(void)
Increment effective reputation version after a rule/reputation reload is complete.
Definition: reputation.c:161
version
uint8_t version
Definition: decode-gre.h:1
util-radix4-tree.h
util-radix6-tree.h
SReputation
struct SReputation_ SReputation
SReputation_::version
uint32_t version
Definition: reputation.h:42
SCRadix6Tree_
Structure for the radix tree.
Definition: util-radix6-tree.h:64
SCReputationRegisterTests
void SCReputationRegisterTests(void)
Definition: reputation.c:174
SRepHostTimedOut
int SRepHostTimedOut(Host *)
Check if a Host is timed out wrt ip rep, meaning a new version is in place.
Definition: reputation.c:193
SRepLoadFileFromFD
int SRepLoadFileFromFD(SRepCIDRTree *cidr_ctx, FILE *fp)
Definition: reputation.c:423
Host_
Definition: host.h:58