From a1d157487cc5584cde2467722b83662e50d3327f Mon Sep 17 00:00:00 2001 From: BlackLight Date: Mon, 16 Aug 2010 22:09:34 +0200 Subject: [PATCH] 16 ago 2010 commit --- ChangeLog | 6 + TODO | 4 + alert_parser.c | 54 ++- cluster.c | 469 +++++++++++++++---- doc/html/alert__parser_8c.html | 229 +++++++++ doc/html/annotated.html | 8 +- doc/html/classes.html | 11 +- doc/html/cluster_8c.html | 509 +++++++++++++++++++++ doc/html/files.html | 5 +- doc/html/functions.html | 213 ++++++++- doc/html/functions_vars.html | 213 ++++++++- doc/html/globals.html | 163 +++++-- doc/html/globals_defs.html | 29 +- doc/html/globals_enum.html | 5 +- doc/html/globals_eval.html | 20 +- doc/html/globals_func.html | 105 ++++- doc/html/globals_type.html | 12 +- doc/html/globals_vars.html | 26 +- doc/html/group__sfPolicyConfig.html | 2 +- doc/html/index.html | 2 +- doc/html/modules.html | 2 +- doc/html/regex_8c.html | 137 ++++++ doc/html/search/all_5f.html | 83 +++- doc/html/search/all_61.html | 138 +++++- doc/html/search/all_63.html | 61 +++ doc/html/search/all_64.html | 69 ++- doc/html/search/all_67.html | 12 +- doc/html/search/all_68.html | 31 +- doc/html/search/all_69.html | 20 +- doc/html/search/all_6b.html | 7 +- doc/html/search/all_6c.html | 8 +- doc/html/search/all_6d.html | 26 +- doc/html/search/all_6e.html | 19 +- doc/html/search/all_6f.html | 26 ++ doc/html/search/all_70.html | 37 +- doc/html/search/all_72.html | 13 +- doc/html/search/all_73.html | 70 ++- doc/html/search/all_74.html | 42 +- doc/html/search/all_75.html | 6 + doc/html/search/all_77.html | 26 ++ doc/html/search/classes_5f.html | 9 +- doc/html/search/classes_61.html | 35 ++ doc/html/search/defines_64.html | 32 +- doc/html/search/defines_70.html | 6 + doc/html/search/enums_63.html | 26 ++ doc/html/search/enumvalues_63.html | 26 ++ doc/html/search/enumvalues_64.html | 32 ++ doc/html/search/enumvalues_6e.html | 26 ++ doc/html/search/enumvalues_73.html | 32 ++ doc/html/search/files_61.html | 25 + doc/html/search/files_63.html | 25 + doc/html/search/files_72.html | 25 + doc/html/search/functions_5f.html | 62 ++- doc/html/search/functions_61.html | 78 +++- doc/html/search/functions_70.html | 29 ++ doc/html/search/search.js | 18 +- doc/html/search/typedefs_61.html | 4 +- doc/html/search/typedefs_68.html | 26 ++ doc/html/search/typedefs_75.html | 6 + doc/html/search/variables_5f.html | 12 +- doc/html/search/variables_61.html | 56 +++ doc/html/search/variables_63.html | 44 ++ doc/html/search/variables_64.html | 19 +- doc/html/search/variables_67.html | 32 ++ doc/html/search/variables_68.html | 25 +- doc/html/search/variables_69.html | 38 ++ doc/html/search/variables_6b.html | 7 +- doc/html/search/variables_6c.html | 26 ++ doc/html/search/variables_6d.html | 44 ++ doc/html/search/variables_6e.html | 13 +- doc/html/search/variables_6f.html | 26 ++ doc/html/search/variables_70.html | 16 +- doc/html/search/variables_72.html | 8 +- doc/html/search/variables_73.html | 42 +- doc/html/search/variables_74.html | 40 +- doc/html/search/variables_77.html | 26 ++ doc/html/sfPolicyUserData_8c.html | 2 +- doc/html/sf__dynamic__preproc__lib_8c.html | 4 +- doc/html/sf__preproc__info_8h.html | 2 +- doc/html/sf__preproc__info_8h_source.html | 2 +- doc/html/spp__ai_8c.html | 105 +---- doc/html/spp__ai_8h.html | 442 +++++++++++++++++- doc/html/spp__ai_8h_source.html | 151 +++++- doc/html/stream_8c.html | 103 ++++- doc/html/structAI__config.html | 155 +++++++ doc/html/struct__AI__snort__alert.html | 435 ++++++++++++++++++ doc/html/struct__hierarchy__node.html | 183 ++++++++ doc/html/structattribute__key.html | 111 +++++ doc/html/structattribute__value.html | 139 ++++++ doc/html/structpkt__info.html | 22 +- doc/html/structpkt__key.html | 8 +- doc/latex/alert__parser_8c.tex | 111 +++++ doc/latex/annotated.tex | 6 +- doc/latex/cluster_8c.tex | 253 ++++++++++ doc/latex/doxygen.sty | 4 +- doc/latex/files.tex | 3 + doc/latex/refman.tex | 11 +- doc/latex/regex_8c.tex | 38 ++ doc/latex/spp__ai_8c.tex | 61 +-- doc/latex/spp__ai_8h.tex | 289 +++++++++++- doc/latex/stream_8c.tex | 78 +++- doc/latex/structAI__config.tex | 54 +++ doc/latex/struct__AI__snort__alert.tex | 194 ++++++++ doc/latex/struct__hierarchy__node.tex | 68 +++ doc/latex/structattribute__key.tex | 29 ++ doc/latex/structattribute__value.tex | 43 ++ doc/latex/structpkt__info.tex | 13 +- doc/latex/structpkt__key.tex | 6 +- spp_ai.c | 31 +- spp_ai.h | 15 +- tags | 108 +++-- 111 files changed, 6555 insertions(+), 638 deletions(-) create mode 100644 ChangeLog create mode 100644 doc/html/alert__parser_8c.html create mode 100644 doc/html/cluster_8c.html create mode 100644 doc/html/regex_8c.html create mode 100644 doc/html/search/all_63.html create mode 100644 doc/html/search/all_6f.html create mode 100644 doc/html/search/all_77.html create mode 100644 doc/html/search/classes_61.html create mode 100644 doc/html/search/enums_63.html create mode 100644 doc/html/search/enumvalues_63.html create mode 100644 doc/html/search/enumvalues_64.html create mode 100644 doc/html/search/enumvalues_6e.html create mode 100644 doc/html/search/enumvalues_73.html create mode 100644 doc/html/search/files_61.html create mode 100644 doc/html/search/files_63.html create mode 100644 doc/html/search/files_72.html create mode 100644 doc/html/search/functions_70.html create mode 100644 doc/html/search/typedefs_68.html create mode 100644 doc/html/search/variables_61.html create mode 100644 doc/html/search/variables_63.html create mode 100644 doc/html/search/variables_67.html create mode 100644 doc/html/search/variables_69.html create mode 100644 doc/html/search/variables_6c.html create mode 100644 doc/html/search/variables_6d.html create mode 100644 doc/html/search/variables_6f.html create mode 100644 doc/html/search/variables_77.html create mode 100644 doc/html/structAI__config.html create mode 100644 doc/html/struct__AI__snort__alert.html create mode 100644 doc/html/struct__hierarchy__node.html create mode 100644 doc/html/structattribute__key.html create mode 100644 doc/html/structattribute__value.html create mode 100644 doc/latex/alert__parser_8c.tex create mode 100644 doc/latex/cluster_8c.tex create mode 100644 doc/latex/regex_8c.tex create mode 100644 doc/latex/structAI__config.tex create mode 100644 doc/latex/struct__AI__snort__alert.tex create mode 100644 doc/latex/struct__hierarchy__node.tex create mode 100644 doc/latex/structattribute__key.tex create mode 100644 doc/latex/structattribute__value.tex diff --git a/ChangeLog b/ChangeLog new file mode 100644 index 0000000..25c0345 --- /dev/null +++ b/ChangeLog @@ -0,0 +1,6 @@ +2010-16-08 Fabio "BlackLight" Manganiello + * cluster.c: Finished clustering algorithm and clustering log management + +2010-26-07 Fabio "BlackLight" Manganiello + * all: First version + diff --git a/TODO b/TODO index 6a622b7..536f6bd 100644 --- a/TODO +++ b/TODO @@ -1,2 +1,6 @@ +- Check cluster ranges are NEVER on the same ranges - Managing clusters for addresses, timestamps (and more?) +- MySQL alert log parsing +- Dynamic cluster_min_size algorithm +- Alerts for port scan, grouped alerts, UDP and ICMP too diff --git a/alert_parser.c b/alert_parser.c index 17f2240..25304d1 100644 --- a/alert_parser.c +++ b/alert_parser.c @@ -302,6 +302,39 @@ AI_alertparser_thread ( void* arg ) } /* ----- end of function AI_alertparser_thread ----- */ + +/** + * FUNCTION: _AI_copy_alerts + * \brief Create a copy of the alert log struct (this is done for leaving the alert log structure in this file as read-only) + * \param node Starting node (used for the recursion) + * \return A copy of the alert log linked list + */ +PRIVATE AI_snort_alert* +_AI_copy_alerts ( AI_snort_alert *node ) +{ + AI_snort_alert *current = NULL, *next = NULL; + + if ( !node ) + { + return NULL; + } + + if ( node->next ) + { + next = _AI_copy_alerts ( node->next ); + } + + if ( !( current = ( AI_snort_alert* ) malloc ( sizeof ( AI_snort_alert )) )) + { + _dpd.fatalMsg ( "Fatal dynamic memory allocation failure at %s:%d\n", __FILE__, __LINE__ ); + } + + memcpy ( current, node, sizeof ( AI_snort_alert )); + current->next = next; + return current; +} /* ----- end of function _AI_copy_alerts ----- */ + + /** * FUNCTION: AI_get_alerts * \brief Return the alerts parsed so far as a linked list @@ -310,6 +343,25 @@ AI_alertparser_thread ( void* arg ) AI_snort_alert* AI_get_alerts () { - return alerts; + return _AI_copy_alerts ( alerts ); } /* ----- end of function AI_get_alerts ----- */ + +/** + * FUNCTION: AI_free_alerts + * \brief Deallocate the memory of a log alert linked list + * \param node Linked list to be freed + */ +void +AI_free_alerts ( AI_snort_alert *node ) +{ + if ( !node ) + return; + + if ( node->next ) + AI_free_alerts ( node->next ); + + free ( node ); + node = NULL; +} /* ----- end of function AI_free_alerts ----- */ + diff --git a/cluster.c b/cluster.c index b17f04b..f853be3 100644 --- a/cluster.c +++ b/cluster.c @@ -18,17 +18,99 @@ */ #include "spp_ai.h" + #include #include +#include #include -PRIVATE hierarchy_node *src_port_root = NULL; -PRIVATE hierarchy_node *src_addr_root = NULL; -PRIVATE hierarchy_node *dst_port_root = NULL; -PRIVATE hierarchy_node *dst_addr_root = NULL; -PRIVATE AI_config *_config = NULL; -PRIVATE AI_snort_alert *alert_log = NULL; +/* Identifier key for a cluster attribute value */ +typedef struct { + int min; + int max; +} attribute_key; +/* Representation of a cluster attribute value */ +typedef struct { + attribute_key key; + cluster_type type; + unsigned int count; + UT_hash_handle hh; +} attribute_value; + + +PRIVATE hierarchy_node *h_root[CLUSTER_TYPES] = { NULL }; +PRIVATE AI_config *_config = NULL; +PRIVATE AI_snort_alert *alert_log = NULL; + + +/** + * FUNCTION: _heuristic_func + * \brief Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124) + * \param type Attribute type + * \return The heuristic coefficient for that attribute, -1 if no clustering information is available for that attribute + */ + +PRIVATE int +_heuristic_func ( cluster_type type ) +{ + AI_snort_alert *alert_iterator; + attribute_key key; + attribute_value *values = NULL; + attribute_value *value = NULL; + attribute_value *found = NULL; + int max = 0; + + if ( type == none || !alert_log || !h_root[type] ) + return -1; + + for ( alert_iterator = alert_log; alert_iterator; alert_iterator = alert_iterator->next ) + { + if ( !alert_iterator->h_node[type] ) + continue; + + key.min = alert_iterator->h_node[type]->min_val; + key.max = alert_iterator->h_node[type]->max_val; + + if ( values ) + { + HASH_FIND ( hh, values, &key, sizeof ( attribute_key ), found ); + } + + if ( !found ) + { + if ( !( value = ( attribute_value* ) malloc ( sizeof ( attribute_value )) )) + { + _dpd.fatalMsg ( "Fatal dynamic memory allocation failure at %s:%d\n", __FILE__, __LINE__ ); + } + + memset ( value, 0, sizeof ( attribute_value )); + value->key = key; + value->type = type; + value->count = 1; + HASH_ADD ( hh, values, key, sizeof ( attribute_key ), value ); + } else { + found->count++; + } + } + + for ( value = values; value; value = ( attribute_value* ) value->hh.next ) + { + if ( value->count > max ) + { + max = value->count; + } + } + + while ( values ) + { + value = values; + HASH_DEL ( values, value ); + free ( value ); + } + + return max; +} /* ----- end of function _heuristic_func ----- */ /** * FUNCTION: _hierarchy_node_new @@ -136,6 +218,158 @@ _AI_get_min_hierarchy_node ( int val, hierarchy_node *root ) return _AI_get_min_hierarchy_node ( val, next ); } /* ----- end of function _AI_get_min_hierarchy_node ----- */ +/** + * FUNCTION: _AI_equal_alarms + * \brief Check if two alerts are semantically equal + * \param a1 First alert + * \param a2 Second alert + * \return True if they are equal, false otherwise + */ + +PRIVATE BOOL +_AI_equal_alarms ( AI_snort_alert *a1, AI_snort_alert *a2 ) +{ + if ( a1->gid != a2->gid || a1->sid != a2->sid || a1->rev != a2->rev ) + { + return false; + } + + if ( a1->h_node[src_addr] && a2->h_node[src_addr] ) + { + if ( a1->h_node[src_addr]->min_val != a2->h_node[src_addr]->min_val || + a1->h_node[src_addr]->max_val != a2->h_node[src_addr]->max_val ) + return false; + } + + if ( a1->h_node[dst_addr] && a2->h_node[dst_addr] ) + { + if ( a1->h_node[dst_addr]->min_val != a2->h_node[dst_addr]->min_val || + a1->h_node[dst_addr]->max_val != a2->h_node[dst_addr]->max_val ) + return false; + } + + if ( a1->h_node[src_port] && a2->h_node[src_port] ) + { + if ( a1->h_node[src_port]->min_val != a2->h_node[src_port]->min_val || + a1->h_node[src_port]->max_val != a2->h_node[src_port]->max_val ) + return false; + } + + if ( a1->h_node[dst_port] && a2->h_node[dst_port] ) + { + if ( a1->h_node[dst_port]->min_val != a2->h_node[dst_port]->min_val || + a1->h_node[dst_port]->max_val != a2->h_node[dst_port]->max_val ) + return false; + } + + return true; +} /* ----- end of function _AI_equal_alarms ----- */ + + +/** + * FUNCTION: _AI_merge_alerts + * \brief Merge the alerts marked as equal in the log + * \param log Alert log reference + * \return The number of merged couples + */ + +PRIVATE int +_AI_merge_alerts ( AI_snort_alert **log ) +{ + AI_snort_alert *tmp, *tmp2, *tmp3; + int count = 0; + + for ( tmp = *log; tmp; tmp = tmp->next ) + { + for ( tmp2 = *log; tmp2; ) + { + if ( tmp2->next ) + { + if ( tmp != tmp2->next ) + { + if ( _AI_equal_alarms ( tmp, tmp2->next )) + { + tmp3 = tmp2->next->next; + free ( tmp2->next ); + tmp2->next = tmp3; + + tmp->grouped_alarms_count++; + count++; + } + } + + tmp2 = tmp2->next; + } else + break; + } + } + + return count; +} /* ----- end of function _AI_merge_alerts ----- */ + + +/** + * FUNCTION: _AI_print_clustered_alerts + * \brief Print the clustered alerts to a log file + * \param log Log containing the alerts + * \param fp File pointer where the alerts will be printed + */ + +PRIVATE void +_AI_print_clustered_alerts ( AI_snort_alert *log, FILE *fp ) +{ + AI_snort_alert *tmp; + char ip[INET_ADDRSTRLEN]; + char *timestamp; + + for ( tmp = log; tmp; tmp = tmp->next ) + { + fprintf ( fp, "[**] [%d:%d:%d] %s [**]\n", tmp->gid, tmp->sid, tmp->rev, tmp->desc ); + + if ( tmp->classification ) + fprintf ( fp, "[Classification: %s] ", tmp->classification ); + + fprintf ( fp, "[Priority: %d]\n", tmp->priority ); + + timestamp = ctime ( &tmp->timestamp ); + timestamp[ strlen(timestamp)-1 ] = 0; + fprintf ( fp, "[Grouped alerts: %d] [Starting from: %s]\n", tmp->grouped_alarms_count, timestamp ); + + if ( h_root[src_addr] ) + { + fprintf ( fp, "[%s]:", tmp->h_node[src_addr]->label ); + } else { + inet_ntop ( AF_INET, &(tmp->src_addr), ip, INET_ADDRSTRLEN ); + fprintf ( fp, "%s:", ip ); + } + + if ( h_root[src_port] ) + { + fprintf ( fp, "[%s] -> ", tmp->h_node[src_port]->label ); + } else { + fprintf ( fp, "%d -> ", htons ( tmp->src_port )); + } + + if ( h_root[dst_addr] ) + { + fprintf ( fp, "[%s]:", tmp->h_node[dst_addr]->label ); + } else { + inet_ntop ( AF_INET, &(tmp->dst_addr), ip, INET_ADDRSTRLEN ); + fprintf ( fp, "%s:", ip ); + } + + if ( h_root[dst_port] ) + { + fprintf ( fp, "[%s]\n", tmp->h_node[dst_port]->label ); + } else { + fprintf ( fp, "%d\n", htons ( tmp->dst_port )); + } + + fprintf ( fp, "\n" ); + } +} /* ----- end of function _AI_print_clustered_alerts ----- */ + + /** * FUNCTION: _AI_cluster_thread * \brief Thread for periodically clustering the log information @@ -145,11 +379,26 @@ _AI_cluster_thread ( void* arg ) { AI_snort_alert *tmp; hierarchy_node *node, *child; + cluster_type type; + cluster_type best_type; + BOOL has_small_clusters = true; + FILE *cluster_fp; char label[256]; + int hostval; + int netval; + int minval; + int heuristic_val; + int cluster_min_size = 2; + int alert_count = 0; + int old_alert_count = 0; while ( 1 ) { + /* Between an execution of the thread and the next one, sleep for alert_clustering_interval seconds */ sleep ( _config->alertClusteringInterval ); + + /* Free the current alert log and get the latest one */ + AI_free_alerts ( alert_log ); if ( !( alert_log = AI_get_alerts() )) { @@ -157,86 +406,109 @@ _AI_cluster_thread ( void* arg ) } FILE *fp = fopen ( "/home/blacklight/LOG", "a" ); + has_small_clusters = true; - for ( tmp = alert_log; tmp; tmp = tmp->next ) + for ( tmp = alert_log, alert_count=0; tmp; tmp = tmp->next, alert_count++ ) { - if ( src_addr_root && !tmp->src_addr_node ) + /* If an alert has an unitialized "grouped alarms count", set its counter to 1 (it only groupes the current alert) */ + if ( tmp->grouped_alarms_count == 0 ) { - node = _AI_get_min_hierarchy_node ( ntohl ( tmp->src_addr ), src_addr_root ); - - if ( node ) - { - if ( node->min_val < node->max_val ) - { - inet_ntop ( AF_INET, &(tmp->src_addr), label, INET_ADDRSTRLEN ); - child = _hierarchy_node_new ( label, ntohl ( tmp->src_addr ), ntohl ( tmp->src_addr )); - _hierarchy_node_append ( node, child ); - node = child; - } - - tmp->src_addr_node = node; - fprintf ( fp, "minimum range holding %s: %s (prev: %s)\n", label, tmp->src_addr_node->label, tmp->src_addr_node->parent->label ); - } + tmp->grouped_alarms_count = 1; } - if ( dst_addr_root && !tmp->dst_addr_node ) + /* If the current alarm already group at least min_size alarms, then no need to do further clusterization */ + if ( tmp->grouped_alarms_count >= cluster_min_size ) { - node = _AI_get_min_hierarchy_node ( ntohl ( tmp->dst_addr ), dst_addr_root ); - - if ( node ) - { - if ( node->min_val < node->max_val ) - { - /* snprintf ( label, sizeof(label), "%d", ntohl ( tmp->dst_addr )); */ - inet_ntop ( AF_INET, &(tmp->src_addr), label, INET_ADDRSTRLEN ); - child = _hierarchy_node_new ( label, ntohl ( tmp->dst_addr ), ntohl ( tmp->dst_addr )); - _hierarchy_node_append ( node, child ); - node = child; - } - - tmp->dst_addr_node = node; - } + has_small_clusters = false; } - if ( src_port_root && !tmp->src_port_node ) + /* Initialize the clustering hierarchies in the current alert */ + for ( type=0; type < CLUSTER_TYPES; type++ ) { - node = _AI_get_min_hierarchy_node ( ntohs ( tmp->src_port ), src_port_root ); - - if ( node ) + /* If "type" is a valid clustering hierarchy but the corresponding node in the alert is not initialized, initialize it */ + if ( h_root[type] && !tmp->h_node[type] ) { - if ( node->min_val < node->max_val ) + switch ( type ) { - snprintf ( label, sizeof(label), "%d", ntohs ( tmp->src_port )); - child = _hierarchy_node_new ( label, ntohs ( tmp->src_port ), ntohs ( tmp->src_port )); - _hierarchy_node_append ( node, child ); - node = child; + case src_addr: + case dst_addr: + netval = ( type == src_addr ) ? tmp->src_addr : tmp->dst_addr; + hostval = ntohl ( netval ); + inet_ntop ( AF_INET, &(netval), label, INET_ADDRSTRLEN ); + break; + + case src_port: + case dst_port: + netval = ( type == src_port ) ? tmp->src_port : tmp->dst_port; + hostval = ntohs ( netval ); + snprintf ( label, sizeof(label), "%d", hostval ); + break; + + default: + return (void*) 0; } - tmp->src_port_node = node; - fprintf ( fp, "minimum range holding %d: %s (prev: %s)\n", ntohs(tmp->src_port), tmp->src_port_node->label, tmp->src_port_node->parent->label ); - } - } + node = _AI_get_min_hierarchy_node ( hostval, h_root[type] ); - if ( dst_port_root && !tmp->dst_port_node ) - { - node = _AI_get_min_hierarchy_node ( ntohs ( tmp->dst_port ), dst_port_root ); - - if ( node ) - { - if ( node->min_val < node->max_val ) + if ( node ) { - snprintf ( label, sizeof(label), "%d", ntohs ( tmp->dst_port )); - child = _hierarchy_node_new ( label, ntohs ( tmp->dst_port ), ntohs ( tmp->dst_port )); - _hierarchy_node_append ( node, child ); - node = child; - } + if ( node->min_val < node->max_val ) + { + child = _hierarchy_node_new ( label, hostval, hostval); + _hierarchy_node_append ( node, child ); + node = child; + } - tmp->dst_port_node = node; - fprintf ( fp, "minimum range holding %d: %s (prev: %s)\n", ntohs(tmp->dst_port), tmp->dst_port_node->label, tmp->dst_port_node->parent->label ); + tmp->h_node[type] = node; + } } } } + alert_count -= _AI_merge_alerts ( &alert_log ); + + while ( has_small_clusters && alert_count > cluster_min_size ) + { + old_alert_count = alert_count; + minval = INT_MAX; + best_type = none; + + /* Choose the best attribute to cluster using the heuristic function */ + for ( type = 0; type < CLUSTER_TYPES; type++ ) + { + if ( type != none && h_root[type] ) + { + if (( heuristic_val = _heuristic_func ( type )) > 0 && heuristic_val < minval ) + { + minval = heuristic_val; + best_type = type; + } + } + } + + /* For all the alerts, the corresponing clustering value is the parent of the current one in the hierarchy */ + for ( tmp = alert_log; tmp; tmp = tmp->next ) + { + if ( tmp->h_node[best_type]->parent ) + { + tmp->h_node[best_type] = tmp->h_node[best_type]->parent; + } + } + + alert_count -= _AI_merge_alerts ( &alert_log ); + + if ( old_alert_count == alert_count ) + break; + } + + if ( !( cluster_fp = fopen ( _config->clusterfile, "w" )) ) + { + return (void*) 0; + } + + _AI_print_clustered_alerts ( alert_log, cluster_fp ); + fclose ( cluster_fp ); + fclose ( fp ); } @@ -244,6 +516,33 @@ _AI_cluster_thread ( void* arg ) } /* ----- end of function AI_cluster_thread ----- */ +/** + * FUNCTION: _AI_check_duplicate + * \brief Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy + * \param node Node to be checked + * \param root Clustering hierarchy + * \return True if 'node' is already in 'root', false otherwise + */ +PRIVATE BOOL +_AI_check_duplicate ( hierarchy_node *node, hierarchy_node *root ) +{ + int i; + + if ( !node || !root ) + return false; + + if ( root->min_val == node->min_val && root->max_val == node->max_val ) + return true; + + for ( i=0; i < root->nchildren; i++ ) + { + if ( _AI_check_duplicate ( node, root->children[i] )) + return true; + } + + return false; +} /* ----- end of function _AI_check_duplicate ----- */ + /** * FUNCTION: AI_hierarchies_build * \brief Build the clustering hierarchy trees @@ -267,46 +566,34 @@ AI_hierarchies_build ( AI_config *conf, hierarchy_node **nodes, int n_nodes ) switch ( nodes[i]->type ) { case src_port: - if ( !src_port_root ) - src_port_root = _hierarchy_node_new ( "1-65535", 1, 65535 ); - - root = src_port_root; - min_range = 65534; - break; - case dst_port: - if ( !dst_port_root ) - dst_port_root = _hierarchy_node_new ( "1-65535", 1, 65535 ); + if ( !h_root[ nodes[i]->type ] ) + h_root[ nodes[i]->type ] = _hierarchy_node_new ( "1-65535", 1, 65535 ); - root = dst_port_root; min_range = 65534; break; case src_addr: - if ( !src_addr_root ) - src_addr_root = _hierarchy_node_new ( "0.0.0.0/0", - 0x0, 0xffffffff ); - - root = src_addr_root; - min_range = 0xffffffff; - break; - case dst_addr: - if ( !dst_addr_root ) - dst_addr_root = _hierarchy_node_new ( "0.0.0.0/0", - 0x0, 0xffffffff ); - - root = dst_addr_root; + if ( !h_root[ nodes[i]->type ] ) + h_root[ nodes[i]->type ] = _hierarchy_node_new ( "0.0.0.0/0", 0x0, 0xffffffff ); + min_range = 0xffffffff; break; - /* TODO Manage range for timestamps (and something more?) */ + /* TODO Manage ranges for timestamps (and something more?) */ default: - break; + return; } + root = h_root[ nodes[i]->type ]; cover = NULL; + if ( _AI_check_duplicate ( nodes[i], root )) + { + _dpd.fatalMsg ( "AIPreproc: Parse error: duplicate cluster range '%d-%d' in configuration\n", nodes[i]->min_val, nodes[i]->max_val ); + } + for ( j=0; j < n_nodes; j++ ) { if ( i != j ) diff --git a/doc/html/alert__parser_8c.html b/doc/html/alert__parser_8c.html new file mode 100644 index 0000000..143afee --- /dev/null +++ b/doc/html/alert__parser_8c.html @@ -0,0 +1,229 @@ + + + + +Snort AI preprocessor module: alert_parser.c File Reference + + + + + + + + + +
+
+Functions | +Variables
+
+

alert_parser.c File Reference

+
+
+#include "spp_ai.h"
+#include <stdio.h>
+#include <unistd.h>
+#include <time.h>
+#include <sys/inotify.h>
+#include <sys/stat.h>
+ + + + + + + + + + + + + +

+Functions

void * AI_alertparser_thread (void *arg)
 Thread for parsing Snort's alert file.
PRIVATE AI_snort_alert * _AI_copy_alerts (AI_snort_alert *node)
 Create a copy of the alert log struct (this is done for leaving the alert log structure in this file as read-only).
AI_snort_alert * AI_get_alerts ()
 Return the alerts parsed so far as a linked list.
void AI_free_alerts (AI_snort_alert *node)
 Deallocate the memory of a log alert linked list.

+Variables

PRIVATE AI_snort_alert * alerts = NULL
PRIVATE FILE * alert_fp = NULL
+

Function Documentation

+ +
+
+ + + + + + + + + +
PRIVATE AI_snort_alert* _AI_copy_alerts (AI_snort_alert *  node ) 
+
+
+ +

Create a copy of the alert log struct (this is done for leaving the alert log structure in this file as read-only).

+

FUNCTION: _AI_copy_alerts

+
Parameters:
+ + +
node Starting node (used for the recursion)
+
+
+
Returns:
A copy of the alert log linked list
+ +
+
+ +
+
+ + + + + + + + + +
void* AI_alertparser_thread (void *  arg ) 
+
+
+ +

Thread for parsing Snort's alert file.

+

FUNCTION: AI_alertparser_thread

+
Parameters:
+ + +
arg void* pointer to module's configuration
+
+
+ +
+
+ +
+
+ + + + + + + + + +
void AI_free_alerts (AI_snort_alert *  node ) 
+
+
+ +

Deallocate the memory of a log alert linked list.

+

FUNCTION: AI_free_alerts

+
Parameters:
+ + +
node Linked list to be freed
+
+
+ +
+
+ +
+
+ + + + + + + + + +
AI_snort_alert* AI_get_alerts (void  ) 
+
+
+ +

Return the alerts parsed so far as a linked list.

+

FUNCTION: AI_get_alerts

+
Returns:
An AI_snort_alert pointer identifying the list of alerts
+ +
+
+

Variable Documentation

+ +
+
+ + + + +
PRIVATE FILE* alert_fp = NULL
+
+
+ +
+
+ +
+
+ + + + +
PRIVATE AI_snort_alert* alerts = NULL
+
+
+ +
+
+
+ + + + +
+ +
+ +
Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  + +doxygen 1.7.1
+ + diff --git a/doc/html/annotated.html b/doc/html/annotated.html index c082cfd..0f7d8f6 100644 --- a/doc/html/annotated.html +++ b/doc/html/annotated.html @@ -52,7 +52,11 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
Here are the data structures with brief descriptions: - + + + + +
_AI_config
_AI_snort_alert
_hierarchy_node
AI_config
attribute_key
attribute_value
pkt_info
pkt_key
@@ -71,7 +75,7 @@ Here are the data structures with brief descriptions: -
Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/classes.html b/doc/html/classes.html index ed906f1..d938728 100644 --- a/doc/html/classes.html +++ b/doc/html/classes.html @@ -51,11 +51,12 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');

Data Structure Index

-
P | _
+
A | P | _
-
  P  
-		pkt_info   pkt_key   
  _  
-		_AI_config   
P | _
+
  A  
+attribute_key   
  P  
+pkt_key   _AI_snort_alert   AI_config   attribute_value   pkt_info   
  _  
+_hierarchy_node   
A | P | _
-
Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/cluster_8c.html b/doc/html/cluster_8c.html new file mode 100644 index 0000000..fcae483 --- /dev/null +++ b/doc/html/cluster_8c.html @@ -0,0 +1,509 @@ + + + + +Snort AI preprocessor module: cluster.c File Reference + + + + + + + + + +
+
+Data Structures | +Functions | +Variables
+
+

cluster.c File Reference

+
+
+#include "spp_ai.h"
+#include <stdio.h>
+#include <unistd.h>
+#include <limits.h>
+#include <pthread.h>
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

+Data Structures

struct  attribute_key
struct  attribute_value

+Functions

PRIVATE int _heuristic_func (cluster_type type)
 Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124).
PRIVATE hierarchy_node * _hierarchy_node_new (char *label, int min_val, int max_val)
 Create a new clustering hierarchy node.
PRIVATE void _hierarchy_node_append (hierarchy_node *parent, hierarchy_node *child)
 Append a node to a clustering hierarchy node.
PRIVATE hierarchy_node * _AI_get_min_hierarchy_node (int val, hierarchy_node *root)
 Get the minimum node in a hierarchy tree that matches a certain value.
PRIVATE BOOL _AI_equal_alarms (AI_snort_alert *a1, AI_snort_alert *a2)
 Check if two alerts are semantically equal.
PRIVATE int _AI_merge_alerts (AI_snort_alert **log)
 Merge the alerts marked as equal in the log.
PRIVATE void _AI_print_clustered_alerts (AI_snort_alert *log, FILE *fp)
 Print the clustered alerts to a log file.
PRIVATE void * _AI_cluster_thread (void *arg)
 Thread for periodically clustering the log information.
PRIVATE BOOL _AI_check_duplicate (hierarchy_node *node, hierarchy_node *root)
 Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy.
void AI_hierarchies_build (AI_config *conf, hierarchy_node **nodes, int n_nodes)
 Build the clustering hierarchy trees.

+Variables

PRIVATE hierarchy_node * h_root [CLUSTER_TYPES] = { NULL }
PRIVATE AI_config * _config = NULL
PRIVATE AI_snort_alert * alert_log = NULL
+

Function Documentation

+ +
+
+ + + + + + + + + + + + + + + + + + +
PRIVATE BOOL _AI_check_duplicate (hierarchy_node *  node,
hierarchy_node *  root 
)
+
+
+ +

Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy.

+

FUNCTION: _AI_check_duplicate

+
Parameters:
+ + + +
node Node to be checked
root Clustering hierarchy
+
+
+
Returns:
True if 'node' is already in 'root', false otherwise
+ +
+
+ +
+
+ + + + + + + + + +
PRIVATE void* _AI_cluster_thread (void *  arg ) 
+
+
+ +

Thread for periodically clustering the log information.

+

FUNCTION: _AI_cluster_thread

+ +
+
+ +
+
+ + + + + + + + + + + + + + + + + + +
PRIVATE BOOL _AI_equal_alarms (AI_snort_alert *  a1,
AI_snort_alert *  a2 
)
+
+
+ +

Check if two alerts are semantically equal.

+

FUNCTION: _AI_equal_alarms

+
Parameters:
+ + + +
a1 First alert
a2 Second alert
+
+
+
Returns:
True if they are equal, false otherwise
+ +
+
+ +
+
+ + + + + + + + + + + + + + + + + + +
PRIVATE hierarchy_node* _AI_get_min_hierarchy_node (int  val,
hierarchy_node *  root 
)
+
+
+ +

Get the minimum node in a hierarchy tree that matches a certain value.

+

FUNCTION: _AI_get_min_hierarchy_node

+
Parameters:
+ + + +
val Value to be matched in the range
root Root of the hierarchy
+
+
+
Returns:
The minimum node that matches the value if any, NULL otherwise
+ +
+
+ +
+
+ + + + + + + + + +
PRIVATE int _AI_merge_alerts (AI_snort_alert **  log ) 
+
+
+ +

Merge the alerts marked as equal in the log.

+

FUNCTION: _AI_merge_alerts

+
Parameters:
+ + +
log Alert log reference
+
+
+
Returns:
The number of merged couples
+ +
+
+ +
+
+ + + + + + + + + + + + + + + + + + +
PRIVATE void _AI_print_clustered_alerts (AI_snort_alert *  log,
FILE *  fp 
)
+
+
+ +

Print the clustered alerts to a log file.

+

FUNCTION: _AI_print_clustered_alerts

+
Parameters:
+ + + +
log Log containing the alerts
fp File pointer where the alerts will be printed
+
+
+ +
+
+ +
+
+ + + + + + + + + +
PRIVATE int _heuristic_func (cluster_type  type ) 
+
+
+ +

Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124).

+

FUNCTION: _heuristic_func

+
Parameters:
+ + +
type Attribute type
+
+
+
Returns:
The heuristic coefficient for that attribute, -1 if no clustering information is available for that attribute
+ +
+
+ +
+
+ + + + + + + + + + + + + + + + + + +
PRIVATE void _hierarchy_node_append (hierarchy_node *  parent,
hierarchy_node *  child 
)
+
+
+ +

Append a node to a clustering hierarchy node.

+

FUNCTION: _hierarchy_node_append

+
Parameters:
+ + + +
parent Parent node
child Child node
+
+
+ +
+
+ +
+
+ + + + + + + + + + + + + + + + + + + + + + + + +
PRIVATE hierarchy_node* _hierarchy_node_new (char *  label,
int  min_val,
int  max_val 
)
+
+
+ +

Create a new clustering hierarchy node.

+

FUNCTION: _hierarchy_node_new

+
Parameters:
+ + + + +
label Label for the node
min_val Minimum value for the range represented by the node
max_val Maximum value for the range represented by the node
+
+
+
Returns:
The brand new node if the allocation was ok, otherwise abort the application
+ +
+
+ +
+
+ + + + + + + + + + + + + + + + + + + + + + + + +
void AI_hierarchies_build (AI_config *  conf,
hierarchy_node **  nodes,
int  n_nodes 
)
+
+
+ +

Build the clustering hierarchy trees.

+

FUNCTION: AI_hierarchies_build

+
Parameters:
+ + + + +
conf Reference to the configuration of the module
nodes Nodes containing the information about the clustering ranges
n_nodes Number of nodes
+
+
+ +
+
+

Variable Documentation

+ +
+
+ + + + +
PRIVATE AI_config* _config = NULL
+
+
+ +
+
+ +
+
+ + + + +
PRIVATE AI_snort_alert* alert_log = NULL
+
+
+ +
+
+ +
+
+ + + + +
PRIVATE hierarchy_node* h_root[CLUSTER_TYPES] = { NULL }
+
+
+ +
+
+
+ + + + +
+ +
+ +
Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  + +doxygen 1.7.1
+ + diff --git a/doc/html/files.html b/doc/html/files.html index fecb8d8..49092e7 100644 --- a/doc/html/files.html +++ b/doc/html/files.html @@ -51,6 +51,9 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
Here is a list of all files with brief descriptions: + + + @@ -73,7 +76,7 @@ Here is a list of all files with brief descriptions:
alert_parser.c
cluster.c
regex.c
sf_dynamic_preproc_lib.c
sf_preproc_info.h [code]
sfPolicyUserData.c
-
Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/functions.html b/doc/html/functions.html index 119b287..b42b19f 100644 --- a/doc/html/functions.html +++ b/doc/html/functions.html @@ -51,38 +51,231 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
  • Variables
    • +
    + +
    -Here is a list of all struct and union fields with links to the structures/unions they belong to:
    @@ -100,7 +293,7 @@ Here is a list of all struct and union fields with links to the structures/union -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/functions_vars.html b/doc/html/functions_vars.html index c2988a4..3caa8e1 100644 --- a/doc/html/functions_vars.html +++ b/doc/html/functions_vars.html @@ -51,38 +51,231 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
  • Variables
    • +
    + +
    - 
    @@ -100,7 +293,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/globals.html b/doc/html/globals.html index a55e9a8..7afa922 100644 --- a/doc/html/globals.html +++ b/doc/html/globals.html @@ -60,14 +60,15 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
  • _
  • a
  • b
    • +
  • c
  • d
  • e
  • f
    • -
  • g
  • h
  • i
  • l
  • m
    • +
  • n
  • p
  • r
  • s
    • @@ -80,24 +81,74 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); Here is a list of all functions, variables, defines, enums, and typedefs with links to the files they belong to:

    - _ -

    - a -

    @@ -128,12 +195,37 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li -

    - d -

      -
    • DST_PORT_MATCH -: spp_ai.c +

      - c -

      + + +

      - d -

        +
      • DEFAULT_ALERT_CLUSTERING_INTERVAL +: spp_ai.h +
        • +
      • DEFAULT_ALERT_LOG_FILE +: spp_ai.h +
        • +
      • DEFAULT_CLUSTER_LOG_FILE +: spp_ai.h +
        • +
      • DEFAULT_HASH_CLEANUP_INTERVAL +: spp_ai.h +
        • +
      • DEFAULT_STREAM_EXPIRE_INTERVAL +: spp_ai.h +
        • +
      • dst_addr +: spp_ai.h +
        • +
      • dst_port +: spp_ai.h
      • DYNAMIC_PREPROC_SETUP : sf_preproc_info.h @@ -158,16 +250,15 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li
      -

      - g -

      - -

      - h -

      @@ -196,13 +287,27 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li
    +

    - n -

    + +

    - p -

    @@ -229,11 +334,14 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li
  • sfPolicyUserDataSet() : sfPolicyUserData.c
    • -
  • SRC_PORT_MATCH -: spp_ai.c +
  • src_addr +: spp_ai.h
    • -
  • SRC_PORT_MATCH_STR -: spp_ai.c +
  • src_port +: spp_ai.h +
    • +
  • start_time +: stream.c
    • @@ -252,6 +360,9 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li
  • uint32_t : spp_ai.h
    • +
  • uint8_t +: spp_ai.h +
    • @@ -268,7 +379,7 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/globals_defs.html b/doc/html/globals_defs.html index 8d4bdf9..75c70fc 100644 --- a/doc/html/globals_defs.html +++ b/doc/html/globals_defs.html @@ -61,18 +61,24 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
  • BUILD_VERSION : sf_preproc_info.h
    • -
  • DST_PORT_MATCH -: spp_ai.c +
  • DEFAULT_ALERT_CLUSTERING_INTERVAL +: spp_ai.h
    • -
  • DST_PORT_MATCH_STR -: spp_ai.c +
  • DEFAULT_ALERT_LOG_FILE +: spp_ai.h +
    • +
  • DEFAULT_CLUSTER_LOG_FILE +: spp_ai.h +
    • +
  • DEFAULT_HASH_CLEANUP_INTERVAL +: spp_ai.h +
    • +
  • DEFAULT_STREAM_EXPIRE_INTERVAL +: spp_ai.h
  • DYNAMIC_PREPROC_SETUP : sf_preproc_info.h
    • -
  • GENERATOR_EXAMPLE -: spp_ai.c -
  • MAJOR_VERSION : sf_preproc_info.h
    • @@ -82,11 +88,8 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
  • PREPROC_NAME : sf_preproc_info.h
    • -
  • SRC_PORT_MATCH -: spp_ai.c -
    • -
  • SRC_PORT_MATCH_STR -: spp_ai.c +
  • PRIVATE +: spp_ai.h
    • @@ -104,7 +107,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/globals_enum.html b/doc/html/globals_enum.html index d58719c..d89a918 100644 --- a/doc/html/globals_enum.html +++ b/doc/html/globals_enum.html @@ -61,6 +61,9 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
  • BOOL : spp_ai.h
    • +
  • cluster_type +: spp_ai.h +
    • @@ -77,7 +80,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/globals_eval.html b/doc/html/globals_eval.html index 411e132..2583ce3 100644 --- a/doc/html/globals_eval.html +++ b/doc/html/globals_eval.html @@ -58,9 +58,27 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
     
    -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/globals_func.html b/doc/html/globals_func.html index c534670..e311b0a 100644 --- a/doc/html/globals_func.html +++ b/doc/html/globals_func.html @@ -55,16 +55,83 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
  • Defines
    • +
    + +
    - 
    -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/globals_type.html b/doc/html/globals_type.html index 177e922..1ea1518 100644 --- a/doc/html/globals_type.html +++ b/doc/html/globals_type.html @@ -58,8 +58,11 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
     
    @@ -83,7 +89,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/globals_vars.html b/doc/html/globals_vars.html index dda05d3..c216cf0 100644 --- a/doc/html/globals_vars.html +++ b/doc/html/globals_vars.html @@ -58,15 +58,30 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
     
    @@ -90,7 +108,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/group__sfPolicyConfig.html b/doc/html/group__sfPolicyConfig.html index d768f02..6967d09 100644 --- a/doc/html/group__sfPolicyConfig.html +++ b/doc/html/group__sfPolicyConfig.html @@ -216,7 +216,7 @@ Functions -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/index.html b/doc/html/index.html index 2bd2436..896c9d0 100644 --- a/doc/html/index.html +++ b/doc/html/index.html @@ -59,7 +59,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/modules.html b/doc/html/modules.html index b099071..fb4f7d9 100644 --- a/doc/html/modules.html +++ b/doc/html/modules.html @@ -62,7 +62,7 @@ Here is a list of all modules:
      -
      Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
      Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/regex_8c.html b/doc/html/regex_8c.html new file mode 100644 index 0000000..412b743 --- /dev/null +++ b/doc/html/regex_8c.html @@ -0,0 +1,137 @@ + + + + +Snort AI preprocessor module: regex.c File Reference + + + + + + + + + +
      +
      +Functions
      +
      +

      regex.c File Reference

      +
      +
      +#include <stdio.h>
      +#include <stdlib.h>
      +#include <string.h>
      +#include <regex.h>
      +
    + + + +

    +Functions

    int preg_match (const char *expr, char *str, char ***matches, int *nmatches)
     Check if a string matches a regular expression.
    +

    Function Documentation

    + +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    int preg_match (const char *  expr,
    char *  str,
    char ***  matches,
    int *  nmatches 
    )
    +
    +
    + +

    Check if a string matches a regular expression.

    +

    FUNCTION: preg_match

    +
    Parameters:
    + + + + + +
    expr Regular expression to be matched
    str String to be checked
    matches Reference to a char** that will contain the submatches (NULL if you don't need it)
    nmatches Reference to a int containing the number of submatches found (NULL if you don't need it)
    +
    +
    +
    Returns:
    -1 if the regex is wrong, 0 if no match was found, 1 otherwise
    + +
    +
    +
    + + + + +
    + +
    + +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  + +doxygen 1.7.1
    + + diff --git a/doc/html/search/all_5f.html b/doc/html/search/all_5f.html index 3524402..d115b18 100644 --- a/doc/html/search/all_5f.html +++ b/doc/html/search/all_5f.html @@ -7,26 +7,97 @@
    Loading...
    -
    +
    - _AI_config + _AI_check_duplicate + cluster.c +
    +
    +
    +
    + _AI_cluster_thread + cluster.c +
    +
    +
    +
    + _AI_copy_alerts + alert_parser.c +
    +
    +
    +
    + _AI_equal_alarms + cluster.c +
    +
    +
    +
    + _AI_get_min_hierarchy_node + cluster.c +
    +
    +
    +
    + _AI_merge_alerts + cluster.c +
    +
    +
    +
    + _AI_print_clustered_alerts + cluster.c +
    +
    +
    +
    + _AI_snort_alert
    - _AI_stream_free + _AI_stream_free stream.c
    +
    +
    + _config + cluster.c +
    +
    - _dpd + _dpd
    - _dpd(): sf_dynamic_preproc_lib.c - _dpd(): sf_dynamic_preproc_lib.c + _dpd(): sf_dynamic_preproc_lib.c + _dpd(): sf_dynamic_preproc_lib.c
    +
    +
    + _heuristic_func + cluster.c +
    +
    +
    +
    + _hierarchy_node +
    +
    +
    +
    + _hierarchy_node_append + cluster.c +
    +
    +
    +
    + _hierarchy_node_new + cluster.c +
    +
    Searching...
    No Matches
    +
    + + diff --git a/doc/html/search/all_64.html b/doc/html/search/all_64.html index a2a37bd..b4d6b24 100644 --- a/doc/html/search/all_64.html +++ b/doc/html/search/all_64.html @@ -7,33 +7,70 @@
    Loading...
    + +
    +
    + DEFAULT_ALERT_LOG_FILE + spp_ai.h +
    +
    +
    +
    + DEFAULT_CLUSTER_LOG_FILE + spp_ai.h +
    +
    +
    +
    + DEFAULT_HASH_CLEANUP_INTERVAL + spp_ai.h +
    +
    +
    +
    + DEFAULT_STREAM_EXPIRE_INTERVAL + spp_ai.h +
    +
    +
    +
    + desc + _AI_snort_alert +
    +
    +
    - dst_port - pkt_key -
    -
    -
    -
    - DST_PORT_MATCH - spp_ai.c -
    -
    - diff --git a/doc/html/search/all_67.html b/doc/html/search/all_67.html index 5804711..acc0a17 100644 --- a/doc/html/search/all_67.html +++ b/doc/html/search/all_67.html @@ -7,10 +7,16 @@
    Loading...
    -
    +
    - GENERATOR_EXAMPLE - spp_ai.c + gid + _AI_snort_alert +
    +
    +
    +
    + grouped_alarms_count + _AI_snort_alert
    Searching...
    diff --git a/doc/html/search/all_68.html b/doc/html/search/all_68.html index 46500ff..1f440a1 100644 --- a/doc/html/search/all_68.html +++ b/doc/html/search/all_68.html @@ -7,22 +7,43 @@
    Loading...
    +
    +
    + h_node + _AI_snort_alert +
    +
    +
    +
    + h_root + cluster.c +
    +
    - hash + hash stream.c
    - hashCleanupInterval - _AI_config + hashCleanupInterval + AI_config
    - hh - pkt_info + hh +
    + attribute_value::hh() + pkt_info::hh() +
    +
    +
    +
    +
    + hierarchy_node + spp_ai.h
    Searching...
    diff --git a/doc/html/search/all_69.html b/doc/html/search/all_69.html index 129334f..8b31f3e 100644 --- a/doc/html/search/all_69.html +++ b/doc/html/search/all_69.html @@ -7,12 +7,30 @@
    Loading...
    +
    +
    + id + _AI_snort_alert +
    +
    - InitializePreprocessor + InitializePreprocessor sf_dynamic_preproc_lib.c
    +
    +
    + iplen + _AI_snort_alert +
    +
    +
    +
    + ipproto + _AI_snort_alert +
    +
    Searching...
    No Matches
    +
    + + diff --git a/doc/html/search/all_70.html b/doc/html/search/all_70.html index 9688127..f5e7c02 100644 --- a/doc/html/search/all_70.html +++ b/doc/html/search/all_70.html @@ -7,40 +7,61 @@
    Loading...
    +
    +
    + parent + _hierarchy_node +
    +
    - parserPolicyId + parserPolicyId sfPolicyUserData.c
    - pkt + pkt pkt_info
    -
    +
    - PREPROC_NAME + PREPROC_NAME sf_preproc_info.h
    +
    +
    + priority + _AI_snort_alert +
    +
    +
    +
    + PRIVATE + spp_ai.h +
    +
    Searching...
    No Matches
    +
    + + diff --git a/doc/html/search/classes_5f.html b/doc/html/search/classes_5f.html index e707a94..7f9da45 100644 --- a/doc/html/search/classes_5f.html +++ b/doc/html/search/classes_5f.html @@ -7,9 +7,14 @@
    Loading...
    -
    +
    - _AI_config + _AI_snort_alert +
    +
    +
    +
    + _hierarchy_node
    Searching...
    diff --git a/doc/html/search/classes_61.html b/doc/html/search/classes_61.html new file mode 100644 index 0000000..0dbeae5 --- /dev/null +++ b/doc/html/search/classes_61.html @@ -0,0 +1,35 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + AI_config +
    +
    +
    +
    + attribute_key +
    +
    + +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/defines_64.html b/doc/html/search/defines_64.html index 79d2e40..830b87e 100644 --- a/doc/html/search/defines_64.html +++ b/doc/html/search/defines_64.html @@ -7,21 +7,39 @@
    Loading...
    -
    + -
    +
    - DST_PORT_MATCH_STR - spp_ai.c + DEFAULT_ALERT_LOG_FILE + spp_ai.h +
    +
    +
    +
    + DEFAULT_CLUSTER_LOG_FILE + spp_ai.h +
    +
    +
    +
    + DEFAULT_HASH_CLEANUP_INTERVAL + spp_ai.h +
    +
    + diff --git a/doc/html/search/defines_70.html b/doc/html/search/defines_70.html index 0e1d892..92aa16c 100644 --- a/doc/html/search/defines_70.html +++ b/doc/html/search/defines_70.html @@ -13,6 +13,12 @@ sf_preproc_info.h
    +
    +
    + PRIVATE + spp_ai.h +
    +
    Searching...
    No Matches
    +
    + + diff --git a/doc/html/search/enumvalues_63.html b/doc/html/search/enumvalues_63.html new file mode 100644 index 0000000..d80b16c --- /dev/null +++ b/doc/html/search/enumvalues_63.html @@ -0,0 +1,26 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + CLUSTER_TYPES + spp_ai.h +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/enumvalues_64.html b/doc/html/search/enumvalues_64.html new file mode 100644 index 0000000..24209c6 --- /dev/null +++ b/doc/html/search/enumvalues_64.html @@ -0,0 +1,32 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + dst_addr + spp_ai.h +
    +
    +
    +
    + dst_port + spp_ai.h +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/enumvalues_6e.html b/doc/html/search/enumvalues_6e.html new file mode 100644 index 0000000..ad4bf43 --- /dev/null +++ b/doc/html/search/enumvalues_6e.html @@ -0,0 +1,26 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + none + spp_ai.h +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/enumvalues_73.html b/doc/html/search/enumvalues_73.html new file mode 100644 index 0000000..e0535b0 --- /dev/null +++ b/doc/html/search/enumvalues_73.html @@ -0,0 +1,32 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + src_addr + spp_ai.h +
    +
    +
    +
    + src_port + spp_ai.h +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/files_61.html b/doc/html/search/files_61.html new file mode 100644 index 0000000..fb5d262 --- /dev/null +++ b/doc/html/search/files_61.html @@ -0,0 +1,25 @@ + + + + + + + +
    +
    Loading...
    + +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/files_63.html b/doc/html/search/files_63.html new file mode 100644 index 0000000..5fa7a6c --- /dev/null +++ b/doc/html/search/files_63.html @@ -0,0 +1,25 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + cluster.c +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/files_72.html b/doc/html/search/files_72.html new file mode 100644 index 0000000..820c4ff --- /dev/null +++ b/doc/html/search/files_72.html @@ -0,0 +1,25 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + regex.c +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/functions_5f.html b/doc/html/search/functions_5f.html index 3071030..cb1c0b7 100644 --- a/doc/html/search/functions_5f.html +++ b/doc/html/search/functions_5f.html @@ -7,12 +7,72 @@
    Loading...
    +
    +
    + _AI_check_duplicate + cluster.c +
    +
    +
    +
    + _AI_cluster_thread + cluster.c +
    +
    +
    +
    + _AI_copy_alerts + alert_parser.c +
    +
    +
    +
    + _AI_equal_alarms + cluster.c +
    +
    +
    +
    + _AI_get_min_hierarchy_node + cluster.c +
    +
    +
    +
    + _AI_merge_alerts + cluster.c +
    +
    +
    +
    + _AI_print_clustered_alerts + cluster.c +
    +
    - _AI_stream_free + _AI_stream_free stream.c
    +
    +
    + _heuristic_func + cluster.c +
    +
    +
    +
    + _hierarchy_node_append + cluster.c +
    +
    +
    +
    + _hierarchy_node_new + cluster.c +
    +
    Searching...
    No Matches
    +
    + + diff --git a/doc/html/search/search.js b/doc/html/search/search.js index 7d8a494..ccaefd5 100644 --- a/doc/html/search/search.js +++ b/doc/html/search/search.js @@ -7,15 +7,15 @@ var indexSectionsWithContent = { - 0: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010110111111011110101111000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", - 1: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", - 2: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", - 3: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010100100001001000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", - 4: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000110010010010101110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", - 5: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", - 6: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", - 7: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", - 8: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010100100000100100100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" + 0: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010111111111011111101111010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + 1: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010100000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + 2: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000101000000000000001100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + 3: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010100100001001000100100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + 4: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010101110111011111101110010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + 5: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000010000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + 6: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + 7: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001101000000010000110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + 8: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010100000000100100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }; var indexSectionNames = diff --git a/doc/html/search/typedefs_61.html b/doc/html/search/typedefs_61.html index 8093bed..e2b3ced 100644 --- a/doc/html/search/typedefs_61.html +++ b/doc/html/search/typedefs_61.html @@ -7,9 +7,9 @@
    Loading...
    -
    +
    - AI_config + AI_snort_alert spp_ai.h
    diff --git a/doc/html/search/typedefs_68.html b/doc/html/search/typedefs_68.html new file mode 100644 index 0000000..738dd5f --- /dev/null +++ b/doc/html/search/typedefs_68.html @@ -0,0 +1,26 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + hierarchy_node + spp_ai.h +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/typedefs_75.html b/doc/html/search/typedefs_75.html index aa48425..f53a1f4 100644 --- a/doc/html/search/typedefs_75.html +++ b/doc/html/search/typedefs_75.html @@ -19,6 +19,12 @@ spp_ai.h
    +
    +
    + uint8_t + spp_ai.h +
    +
    Searching...
    No Matches
    +
    + + diff --git a/doc/html/search/variables_63.html b/doc/html/search/variables_63.html new file mode 100644 index 0000000..4fa83be --- /dev/null +++ b/doc/html/search/variables_63.html @@ -0,0 +1,44 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + children + _hierarchy_node +
    +
    +
    +
    + classification + _AI_snort_alert +
    +
    +
    +
    + clusterfile + AI_config +
    +
    +
    +
    + count + attribute_value +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/variables_64.html b/doc/html/search/variables_64.html index 9b77f00..91d2f90 100644 --- a/doc/html/search/variables_64.html +++ b/doc/html/search/variables_64.html @@ -7,10 +7,25 @@
    Loading...
    +
    +
    + desc + _AI_snort_alert +
    +
    +
    +
    + dst_addr + _AI_snort_alert +
    +
    Searching...
    diff --git a/doc/html/search/variables_67.html b/doc/html/search/variables_67.html new file mode 100644 index 0000000..acc0a17 --- /dev/null +++ b/doc/html/search/variables_67.html @@ -0,0 +1,32 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + gid + _AI_snort_alert +
    +
    +
    +
    + grouped_alarms_count + _AI_snort_alert +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/variables_68.html b/doc/html/search/variables_68.html index 46500ff..61fd90a 100644 --- a/doc/html/search/variables_68.html +++ b/doc/html/search/variables_68.html @@ -7,22 +7,37 @@
    Loading...
    +
    +
    + h_node + _AI_snort_alert +
    +
    +
    +
    + h_root + cluster.c +
    +
    - hash + hash stream.c
    - hashCleanupInterval - _AI_config + hashCleanupInterval + AI_config
    - hh - pkt_info + hh +
    + attribute_value::hh() + pkt_info::hh() +
    Searching...
    diff --git a/doc/html/search/variables_69.html b/doc/html/search/variables_69.html new file mode 100644 index 0000000..ec04f4b --- /dev/null +++ b/doc/html/search/variables_69.html @@ -0,0 +1,38 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + id + _AI_snort_alert +
    +
    +
    +
    + iplen + _AI_snort_alert +
    +
    +
    +
    + ipproto + _AI_snort_alert +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/variables_6b.html b/doc/html/search/variables_6b.html index 765184f..2fda50e 100644 --- a/doc/html/search/variables_6b.html +++ b/doc/html/search/variables_6b.html @@ -9,8 +9,11 @@
    Loading...
    Searching...
    diff --git a/doc/html/search/variables_6c.html b/doc/html/search/variables_6c.html new file mode 100644 index 0000000..1eab44a --- /dev/null +++ b/doc/html/search/variables_6c.html @@ -0,0 +1,26 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + label + _hierarchy_node +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/variables_6d.html b/doc/html/search/variables_6d.html new file mode 100644 index 0000000..88c2635 --- /dev/null +++ b/doc/html/search/variables_6d.html @@ -0,0 +1,44 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + max + attribute_key +
    +
    +
    +
    + max_val + _hierarchy_node +
    +
    +
    +
    + min + attribute_key +
    +
    +
    +
    + min_val + _hierarchy_node +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/variables_6e.html b/doc/html/search/variables_6e.html index 7db4670..8998883 100644 --- a/doc/html/search/variables_6e.html +++ b/doc/html/search/variables_6e.html @@ -7,10 +7,19 @@
    Loading...
    +
    +
    + nchildren + _hierarchy_node +
    +
    Searching...
    diff --git a/doc/html/search/variables_6f.html b/doc/html/search/variables_6f.html new file mode 100644 index 0000000..16cdef2 --- /dev/null +++ b/doc/html/search/variables_6f.html @@ -0,0 +1,26 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + observed + pkt_info +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/search/variables_70.html b/doc/html/search/variables_70.html index bffc90b..954887c 100644 --- a/doc/html/search/variables_70.html +++ b/doc/html/search/variables_70.html @@ -7,22 +7,28 @@
    Loading...
    +
    +
    + parent + _hierarchy_node +
    +
    - parserPolicyId + parserPolicyId sfPolicyUserData.c
    - pkt + pkt pkt_info
    -
    +
    - portToCheck - _AI_config + priority + _AI_snort_alert
    Searching...
    diff --git a/doc/html/search/variables_72.html b/doc/html/search/variables_72.html index 02e5703..6545c2c 100644 --- a/doc/html/search/variables_72.html +++ b/doc/html/search/variables_72.html @@ -7,9 +7,15 @@
    Loading...
    +
    +
    + rev + _AI_snort_alert +
    +
    - runtimePolicyId + runtimePolicyId sfPolicyUserData.c
    diff --git a/doc/html/search/variables_73.html b/doc/html/search/variables_73.html index 6ce91b2..2b8daa9 100644 --- a/doc/html/search/variables_73.html +++ b/doc/html/search/variables_73.html @@ -7,16 +7,52 @@
    Loading...
    +
    +
    + sequence + _AI_snort_alert +
    +
    +
    +
    + sid + _AI_snort_alert +
    +
    +
    +
    + src_addr + _AI_snort_alert +
    +
    - src_ip + src_ip pkt_key
    +
    +
    + src_port + _AI_snort_alert +
    +
    +
    +
    + start_time + stream.c +
    +
    +
    +
    + stream + _AI_snort_alert +
    +
    - streamExpireInterval - _AI_config + streamExpireInterval + AI_config
    Searching...
    diff --git a/doc/html/search/variables_74.html b/doc/html/search/variables_74.html index 08f5c5a..9c5fdbe 100644 --- a/doc/html/search/variables_74.html +++ b/doc/html/search/variables_74.html @@ -7,10 +7,46 @@
    Loading...
    +
    +
    + tcp_flags + _AI_snort_alert +
    +
    +
    +
    + tcplen + _AI_snort_alert +
    +
    +
    +
    + tos + _AI_snort_alert +
    +
    +
    +
    + ttl + _AI_snort_alert +
    +
    +
    Searching...
    diff --git a/doc/html/search/variables_77.html b/doc/html/search/variables_77.html new file mode 100644 index 0000000..4410960 --- /dev/null +++ b/doc/html/search/variables_77.html @@ -0,0 +1,26 @@ + + + + + + + +
    +
    Loading...
    +
    +
    + window + _AI_snort_alert +
    +
    +
    Searching...
    +
    No Matches
    + +
    + + diff --git a/doc/html/sfPolicyUserData_8c.html b/doc/html/sfPolicyUserData_8c.html index dcd82e5..2e2e07f 100644 --- a/doc/html/sfPolicyUserData_8c.html +++ b/doc/html/sfPolicyUserData_8c.html @@ -112,7 +112,7 @@ Variables
    -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/sf__dynamic__preproc__lib_8c.html b/doc/html/sf__dynamic__preproc__lib_8c.html index 70a8444..edcaac5 100644 --- a/doc/html/sf__dynamic__preproc__lib_8c.html +++ b/doc/html/sf__dynamic__preproc__lib_8c.html @@ -145,7 +145,7 @@ Variables
    - +
    DynamicPreprocessorData _dpdDynamicPreprocessorData _dpd
    @@ -168,7 +168,7 @@ Variables
    -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/sf__preproc__info_8h.html b/doc/html/sf__preproc__info_8h.html index a9ccc96..6d147e2 100644 --- a/doc/html/sf__preproc__info_8h.html +++ b/doc/html/sf__preproc__info_8h.html @@ -171,7 +171,7 @@ Functions
    -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/sf__preproc__info_8h_source.html b/doc/html/sf__preproc__info_8h_source.html index f8ff46b..af69ed8 100644 --- a/doc/html/sf__preproc__info_8h_source.html +++ b/doc/html/sf__preproc__info_8h_source.html @@ -78,7 +78,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
    -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/spp__ai_8c.html b/doc/html/spp__ai_8c.html index d53f048..6c3e505 100644 --- a/doc/html/spp__ai_8c.html +++ b/doc/html/spp__ai_8c.html @@ -47,7 +47,6 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
    -Defines | Functions | Variables
    @@ -55,106 +54,25 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
    #include "spp_ai.h"
    -#include "preprocids.h"
    -#include "sf_dynamic_preproc_lib.h"
    -#include "sf_dynamic_preprocessor.h"
    -#include "debug.h"
    -#include "sfPolicy.h"
    #include "sfPolicyUserData.h"
    -#include <sys/types.h>
    #include <stdlib.h>
    -#include <ctype.h>
    #include <string.h>
    #include <pthread.h>
    - - - - - - - + -

    -Defines

    #define GENERATOR_EXAMPLE   256
    #define SRC_PORT_MATCH   1
    #define SRC_PORT_MATCH_STR   "example_preprocessor: src port match"
    #define DST_PORT_MATCH   2
    #define DST_PORT_MATCH_STR   "example_preprocessor: dest port match"

    Functions

    static void AI_init (char *args)
     Initialize the preprocessor module.
    static void AI_process (void *pkt, void *context)
     Function executed every time the module receives a packet to be processed.
    static AI_config * AI_parse (char *args)
    static AI_config * AI_parse (char *args)
     Parse the arguments passed to the module saving them to a valid configuration struct.
    void AI_setup (void)
     Set up the preprocessor module.

    Variables

    tSfPolicyUserContextId ex_config = NULL
    DynamicPreprocessorData _dpd
    -

    Define Documentation

    - -
    -
    - - - - -
    #define DST_PORT_MATCH   2
    -
    -
    - -
    -
    - -
    -
    - - - - -
    #define DST_PORT_MATCH_STR   "example_preprocessor: dest port match"
    -
    -
    - -
    -
    - -
    -
    - - - - -
    #define GENERATOR_EXAMPLE   256
    -
    -
    - -
    -
    - -
    -
    - - - - -
    #define SRC_PORT_MATCH   1
    -
    -
    - -
    -
    - -
    -
    - - - - -
    #define SRC_PORT_MATCH_STR   "example_preprocessor: src port match"
    -
    -
    - -
    -

    Function Documentation

    @@ -188,7 +106,7 @@ Variables
    - + @@ -200,14 +118,14 @@ Variables

    Parse the arguments passed to the module saving them to a valid configuration struct.

    -

    FUNCTION: AI_config

    +

    FUNCTION: AI_config

    Parameters:
    static AI_config * AI_parse static AI_config * AI_parse ( char *  args
    args Arguments passed to the module
    -
    Returns:
    Pointer to AI_config keeping the configuration for the module
    +
    Returns:
    Pointer to AI_config keeping the configuration for the module
    @@ -270,19 +188,6 @@ Variables

    Variable Documentation

    - -
    -
    - - - - -
    DynamicPreprocessorData _dpd
    -
    -
    - -
    -
    @@ -311,7 +216,7 @@ Variables
    -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/spp__ai_8h.html b/doc/html/spp__ai_8h.html index ecbf4f0..edccb45 100644 --- a/doc/html/spp__ai_8h.html +++ b/doc/html/spp__ai_8h.html @@ -48,44 +48,181 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
    Data Structures | +Defines | Typedefs | Enumerations | -Functions
    +Functions | +Variables

    spp_ai.h File Reference

    #include "sf_snort_packet.h"
    +#include "sf_dynamic_preprocessor.h"
    +#include "uthash.h"

    Go to the source code of this file.

    - + + + + + + + + + + + + - + - + + + + - - + + + + + + + + + + + + + + + + + +

    Data Structures

    struct  _AI_config
    struct  pkt_key
    struct  pkt_info
    struct  AI_config
    struct  _hierarchy_node
    struct  _AI_snort_alert

    +Defines

    #define PRIVATE   static
    #define DEFAULT_HASH_CLEANUP_INTERVAL   300
    #define DEFAULT_STREAM_EXPIRE_INTERVAL   300
    #define DEFAULT_ALERT_CLUSTERING_INTERVAL   3600
    #define DEFAULT_ALERT_LOG_FILE   "/var/log/snort/alert"
    #define DEFAULT_CLUSTER_LOG_FILE   "/var/log/snort/cluster_alert"

    Typedefs

    typedef unsigned int uint32_t
    typedef unsigned char uint8_t
    typedef unsigned short uint16_t
    typedef struct _AI_config AI_config
    typedef unsigned int uint32_t
    typedef struct _hierarchy_node hierarchy_node
    typedef struct _AI_snort_alert AI_snort_alert

    Enumerations

    enum  BOOL { false, true }
    enum  cluster_type {
    +  none, +src_addr, +dst_addr, +src_port, +
    +  dst_port, +CLUSTER_TYPES +
    + }

    Functions

    void AI_pkt_enqueue (SFSnortPacket *)
     Function called for appending a new packet to the hash table, creating a new stream or appending it to an existing stream.
    int preg_match (const char *, char *, char ***, int *)
     Check if a string matches a regular expression.
    void * AI_hashcleanup_thread (void *)
     Thread called for cleaning up the hash table from the traffic streams older than a certain threshold.
    void * AI_alertparser_thread (void *)
     Thread for parsing Snort's alert file.
    void AI_pkt_enqueue (SFSnortPacket *)
     Function called for appending a new packet to the hash table, creating a new stream or appending it to an existing stream.
    void AI_set_stream_observed (struct pkt_key key)
     Set the flag "observed" on a stream associated to a security alert, so that it won't be removed from the hash table.
    void AI_hierarchies_build (AI_config *, hierarchy_node **, int)
     Build the clustering hierarchy trees.
    struct pkt_info * AI_get_stream_by_key (struct pkt_key)
     Get a TCP stream by key.
    AI_snort_alert * AI_get_alerts (void)
     Return the alerts parsed so far as a linked list.
    void AI_free_alerts (AI_snort_alert *node)
     Deallocate the memory of a log alert linked list.

    +Variables

    DynamicPreprocessorData _dpd
    -

    Typedef Documentation

    - +

    Define Documentation

    +
    - + + +
    typedef struct _AI_config AI_config#define DEFAULT_ALERT_CLUSTERING_INTERVAL   3600
    +
    +
    + +
    +
    + +
    +
    + + + + +
    #define DEFAULT_ALERT_LOG_FILE   "/var/log/snort/alert"
    +
    +
    + +
    +
    + +
    +
    + + + + +
    #define DEFAULT_CLUSTER_LOG_FILE   "/var/log/snort/cluster_alert"
    +
    +
    + +
    +
    + +
    +
    + + + + +
    #define DEFAULT_HASH_CLEANUP_INTERVAL   300
    +
    +
    + +
    +
    + +
    +
    + + + + +
    #define DEFAULT_STREAM_EXPIRE_INTERVAL   300
    +
    +
    + +
    +
    + +
    +
    + + + + +
    #define PRIVATE   static
    +
    +
    + +
    +
    +

    Typedef Documentation

    + +
    +
    + + + + +
    typedef struct _AI_snort_alert AI_snort_alert
    +
    +
    + +
    +
    + +
    +
    + + +
    typedef struct _hierarchy_node hierarchy_node
    @@ -117,6 +254,19 @@ Functions
    +
    +
    + +
    +
    + + + + +
    typedef unsigned char uint8_t
    +
    +
    +

    Enumeration Type Documentation

    @@ -139,9 +289,142 @@ Functions +
    +
    + +
    +
    + + + + +
    enum cluster_type
    +
    +
    +
    Enumerator:
    + + + + + + +
    none  +
    src_addr  +
    dst_addr  +
    src_port  +
    dst_port  +
    CLUSTER_TYPES  +
    +
    +
    +

    Function Documentation

    + +
    +
    + + + + + + + + + +
    void* AI_alertparser_thread (void *  arg ) 
    +
    +
    + +

    Thread for parsing Snort's alert file.

    +

    FUNCTION: AI_alertparser_thread

    +
    Parameters:
    + + +
    arg void* pointer to module's configuration
    +
    +
    + +
    +
    + +
    +
    + + + + + + + + + +
    void AI_free_alerts (AI_snort_alert *  node ) 
    +
    +
    + +

    Deallocate the memory of a log alert linked list.

    +

    FUNCTION: AI_free_alerts

    +
    Parameters:
    + + +
    node Linked list to be freed
    +
    +
    + +
    +
    + +
    +
    + + + + + + + + + +
    AI_snort_alert* AI_get_alerts (void  ) 
    +
    +
    + +

    Return the alerts parsed so far as a linked list.

    +

    FUNCTION: AI_get_alerts

    +
    Returns:
    An AI_snort_alert pointer identifying the list of alerts
    + +
    +
    + +
    +
    + + + + + + + + + +
    struct pkt_info* AI_get_stream_by_key (struct pkt_key  key )  [read]
    +
    +
    + +

    Get a TCP stream by key.

    +

    FUNCTION: AI_get_stream_by_key

    +
    Parameters:
    + + +
    key Key of the stream to be picked up (struct pkt_key)
    +
    +
    +
    Returns:
    A pkt_info pointer to the stream if found, NULL otherwise
    + +
    +
    @@ -162,7 +445,51 @@ Functions

    FUNCTION: AI_hashcleanup_thread

    Parameters:
    - + +
    arg Pointer to the AI_config struct
    arg Pointer to the AI_config struct
    +
    +
    + +
    +
    + +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + +
    void AI_hierarchies_build (AI_config *  conf,
    hierarchy_node **  nodes,
    int  n_nodes 
    )
    +
    +
    + +

    Build the clustering hierarchy trees.

    +

    FUNCTION: AI_hierarchies_build

    +
    Parameters:
    + + + +
    conf Reference to the configuration of the module
    nodes Nodes containing the information about the clustering ranges
    n_nodes Number of nodes
    @@ -194,6 +521,99 @@ Functions +
    +
    + +
    +
    + + + + + + + + + +
    void AI_set_stream_observed (struct pkt_key  key ) 
    +
    +
    + +

    Set the flag "observed" on a stream associated to a security alert, so that it won't be removed from the hash table.

    +

    FUNCTION: AI_set_stream_observed

    +
    Parameters:
    + + +
    key Key of the stream to be set as "observed"
    +
    +
    + +
    +
    + +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    int preg_match (const char *  expr,
    char *  str,
    char ***  matches,
    int *  nmatches 
    )
    +
    +
    + +

    Check if a string matches a regular expression.

    +

    FUNCTION: preg_match

    +
    Parameters:
    + + + + + +
    expr Regular expression to be matched
    str String to be checked
    matches Reference to a char** that will contain the submatches (NULL if you don't need it)
    nmatches Reference to a int containing the number of submatches found (NULL if you don't need it)
    +
    +
    +
    Returns:
    -1 if the regex is wrong, 0 if no match was found, 1 otherwise
    + +
    +
    +

    Variable Documentation

    + +
    +
    + + + + +
    DynamicPreprocessorData _dpd
    +
    +
    +
    @@ -211,7 +631,7 @@ Functions
    -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/spp__ai_8h_source.html b/doc/html/spp__ai_8h_source.html index ba2d92c..339d40d 100644 --- a/doc/html/spp__ai_8h_source.html +++ b/doc/html/spp__ai_8h_source.html @@ -71,26 +71,135 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); 00020 #ifndef _SPP_AI_H 00021 #define _SPP_AI_H 00022 -00023 #include "sf_snort_packet.h" -00024 -00025 typedef unsigned int uint32_t; -00026 typedef unsigned short uint16_t; -00027 -00028 typedef enum { false, true } BOOL; -00029 -00030 typedef struct _AI_config -00031 { -00032 uint16_t portToCheck; -00033 unsigned long hashCleanupInterval; -00034 unsigned long streamExpireInterval; -00035 -00036 } AI_config; -00037 -00038 void AI_pkt_enqueue ( SFSnortPacket* ); -00039 void* AI_hashcleanup_thread ( void* ); -00040 -00041 #endif /* _SPP_AI_H */ -00042 +00023 #include "sf_snort_packet.h" +00024 #include "sf_dynamic_preprocessor.h" +00025 #include "uthash.h" +00026 +00027 #define PRIVATE static +00028 +00029 #define DEFAULT_HASH_CLEANUP_INTERVAL 300 +00030 #define DEFAULT_STREAM_EXPIRE_INTERVAL 300 +00031 #define DEFAULT_ALERT_CLUSTERING_INTERVAL 3600 +00032 #define DEFAULT_ALERT_LOG_FILE "/var/log/snort/alert" +00033 #define DEFAULT_CLUSTER_LOG_FILE "/var/log/snort/cluster_alert" +00034 +00035 extern DynamicPreprocessorData _dpd; +00036 typedef unsigned char uint8_t; +00037 typedef unsigned short uint16_t; +00038 typedef unsigned int uint32_t; +00039 +00040 typedef enum { false, true } BOOL; +00041 +00042 typedef enum { +00043 none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES +00044 } cluster_type; +00045 +00046 /* Each stream in the hash table is identified by the couple (src_ip, dst_port) */ +00047 struct pkt_key +00048 { +00049 uint32_t src_ip; +00050 uint16_t dst_port; +00051 }; +00052 +00053 /* Identifier of a packet in a stream */ +00054 struct pkt_info +00055 { +00056 struct pkt_key key; /* Key of the packet (src_ip, dst_port) */ +00057 time_t timestamp; /* Timestamp */ +00058 SFSnortPacket* pkt; /* Reference to SFSnortPacket containing packet's information */ +00059 struct pkt_info* next; /* Pointer to the next packet in the stream */ +00060 BOOL observed; /* Flag set if the packet is observed, i.e. associated to a security alert */ +00061 UT_hash_handle hh; /* Make the struct 'hashable' */ +00062 }; +00063 +00064 /* Data type containing the configuration of the module */ +00065 typedef struct +00066 { +00067 unsigned long hashCleanupInterval; +00068 unsigned long streamExpireInterval; +00069 unsigned long alertClusteringInterval; +00070 char alertfile[1024]; +00071 char clusterfile[1024]; +00072 } AI_config; +00073 +00074 /* Data type for hierarchies used for clustering */ +00075 typedef struct _hierarchy_node +00076 { +00077 cluster_type type; +00078 char label[256]; +00079 int min_val; +00080 int max_val; +00081 int nchildren; +00082 struct _hierarchy_node *parent; +00083 struct _hierarchy_node **children; +00084 } hierarchy_node; +00085 +00086 /* Data type for Snort alerts */ +00087 typedef struct _AI_snort_alert { +00088 /* Identifiers of the alert */ +00089 unsigned int gid; +00090 unsigned int sid; +00091 unsigned int rev; +00092 +00093 /* Snort priority, description, +00094 * classification and timestamp +00095 * of the alert */ +00096 unsigned short priority; +00097 char *desc; +00098 char *classification; +00099 time_t timestamp; +00100 +00101 /* IP header information */ +00102 uint8_t tos; +00103 uint16_t iplen; +00104 uint16_t id; +00105 uint8_t ttl; +00106 uint8_t ipproto; +00107 uint32_t src_addr; +00108 uint32_t dst_addr; +00109 +00110 /* TCP header information */ +00111 uint16_t src_port; +00112 uint16_t dst_port; +00113 uint32_t sequence; +00114 uint32_t ack; +00115 uint8_t tcp_flags; +00116 uint16_t window; +00117 uint16_t tcplen; +00118 +00119 /* Reference to the TCP stream +00120 * associated to the alert, if any */ +00121 struct pkt_info *stream; +00122 +00123 /* Pointer to the next alert in +00124 * the log, if any*/ +00125 struct _AI_snort_alert *next; +00126 +00127 /* Hierarchies for addresses and ports, +00128 * if the clustering algorithm is used */ +00129 hierarchy_node *h_node[CLUSTER_TYPES]; +00130 +00131 /* If the clustering algorithm is used, +00132 * we also count how many alerts this +00133 * single alert groups */ +00134 unsigned int grouped_alarms_count; +00135 } AI_snort_alert; +00136 +00137 int preg_match ( const char*, char*, char***, int* ); +00138 +00139 void* AI_hashcleanup_thread ( void* ); +00140 void* AI_alertparser_thread ( void* ); +00141 +00142 void AI_pkt_enqueue ( SFSnortPacket* ); +00143 void AI_set_stream_observed ( struct pkt_key key ); +00144 void AI_hierarchies_build ( AI_config*, hierarchy_node**, int ); +00145 +00146 struct pkt_info* AI_get_stream_by_key ( struct pkt_key ); +00147 AI_snort_alert* AI_get_alerts ( void ); +00148 void AI_free_alerts ( AI_snort_alert *node ); +00149 +00150 #endif /* _SPP_AI_H */ +00151
    @@ -107,7 +216,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
    -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/stream_8c.html b/doc/html/stream_8c.html index ad4c66a..7330351 100644 --- a/doc/html/stream_8c.html +++ b/doc/html/stream_8c.html @@ -47,7 +47,6 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
    -Data Structures | Functions | Variables
    @@ -55,42 +54,40 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
    #include "spp_ai.h"
    -#include "uthash.h"
    #include <stdio.h>
    #include <stdlib.h>
    -#include <string.h>
    #include <time.h>
    #include <unistd.h>
    -#include <arpa/inet.h>
    - - - - - + + + + + + - + +

    -Data Structures

    struct  pkt_key
    struct  pkt_info

    Functions

    static void _AI_stream_free (struct pkt_info *stream)
     Remove a stream from the hash table (private function).
    PRIVATE void _AI_stream_free (struct pkt_info *stream)
     Remove a stream from the hash table (private function).
    void * AI_hashcleanup_thread (void *arg)
     Thread called for cleaning up the hash table from the traffic streams older than a certain threshold.
    void AI_pkt_enqueue (SFSnortPacket *pkt)
     Function called for appending a new packet to the hash table, creating a new stream or appending it to an existing stream.
    struct pkt_info * AI_get_stream_by_key (struct pkt_key key)
     Get a TCP stream by key.
    void AI_set_stream_observed (struct pkt_key key)
     Set the flag "observed" on a stream associated to a security alert, so that it won't be removed from the hash table.

    Variables

    static struct pkt_info * hash = NULL
    PRIVATE struct pkt_info * hash = NULL
    PRIVATE time_t start_time = 0

    Function Documentation

    - +
    - + - +
    static void _AI_stream_free PRIVATE void _AI_stream_free ( struct pkt_info *  stream  )  [static]
    @@ -105,6 +102,34 @@ Variables +
    +
    + +
    +
    + + + + + + + + + +
    struct pkt_info* AI_get_stream_by_key (struct pkt_key  key )  [read]
    +
    +
    + +

    Get a TCP stream by key.

    +

    FUNCTION: AI_get_stream_by_key

    +
    Parameters:
    + + +
    key Key of the stream to be picked up (struct pkt_key)
    +
    +
    +
    Returns:
    A pkt_info pointer to the stream if found, NULL otherwise
    +
    @@ -127,7 +152,7 @@ Variables

    FUNCTION: AI_hashcleanup_thread

    Parameters:
    - +
    arg Pointer to the AI_config struct
    arg Pointer to the AI_config struct
    @@ -161,13 +186,53 @@ Variables
    -

    Variable Documentation

    - +
    - + + + + + + + +
    struct pkt_info* hash = NULL [static]void AI_set_stream_observed (struct pkt_key  key ) 
    +
    +
    + +

    Set the flag "observed" on a stream associated to a security alert, so that it won't be removed from the hash table.

    +

    FUNCTION: AI_set_stream_observed

    +
    Parameters:
    + + +
    key Key of the stream to be set as "observed"
    +
    +
    + +
    +
    +

    Variable Documentation

    + +
    +
    + + + + +
    PRIVATE struct pkt_info* hash = NULL
    +
    +
    + +
    +
    + +
    +
    + + +
    PRIVATE time_t start_time = 0
    @@ -190,7 +255,7 @@ Variables
    -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/structAI__config.html b/doc/html/structAI__config.html new file mode 100644 index 0000000..5eff9d3 --- /dev/null +++ b/doc/html/structAI__config.html @@ -0,0 +1,155 @@ + + + + +Snort AI preprocessor module: AI_config Struct Reference + + + + + + + + + +
    +
    +Data Fields
    +
    +

    AI_config Struct Reference

    +
    +
    + +

    #include <spp_ai.h>

    + + + + + + + +

    +Data Fields

    unsigned long hashCleanupInterval
    unsigned long streamExpireInterval
    unsigned long alertClusteringInterval
    char alertfile [1024]
    char clusterfile [1024]
    +

    Field Documentation

    + +
    +
    + + + + +
    unsigned long AI_config::alertClusteringInterval
    +
    +
    + +
    +
    + +
    +
    + + + + +
    char AI_config::alertfile[1024]
    +
    +
    + +
    +
    + +
    +
    + + + + +
    char AI_config::clusterfile[1024]
    +
    +
    + +
    +
    + +
    +
    + + + + +
    unsigned long AI_config::hashCleanupInterval
    +
    +
    + +
    +
    + +
    +
    + + + + +
    unsigned long AI_config::streamExpireInterval
    +
    +
    + +
    +
    +
    The documentation for this struct was generated from the following file: +
    + + + + +
    + +
    + +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  + +doxygen 1.7.1
    + + diff --git a/doc/html/struct__AI__snort__alert.html b/doc/html/struct__AI__snort__alert.html new file mode 100644 index 0000000..e8d179e --- /dev/null +++ b/doc/html/struct__AI__snort__alert.html @@ -0,0 +1,435 @@ + + + + +Snort AI preprocessor module: _AI_snort_alert Struct Reference + + + + + + + + + +
    +
    +Data Fields
    +
    +

    _AI_snort_alert Struct Reference

    +
    +
    + +

    #include <spp_ai.h>

    + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    +Data Fields

    unsigned int gid
    unsigned int sid
    unsigned int rev
    unsigned short priority
    char * desc
    char * classification
    time_t timestamp
    uint8_t tos
    uint16_t iplen
    uint16_t id
    uint8_t ttl
    uint8_t ipproto
    uint32_t src_addr
    uint32_t dst_addr
    uint16_t src_port
    uint16_t dst_port
    uint32_t sequence
    uint32_t ack
    uint8_t tcp_flags
    uint16_t window
    uint16_t tcplen
    struct pkt_info * stream
    struct _AI_snort_alert * next
    hierarchy_node * h_node [CLUSTER_TYPES]
    unsigned int grouped_alarms_count
    +

    Field Documentation

    + +
    +
    + + + + +
    uint32_t _AI_snort_alert::ack
    +
    +
    + +
    +
    + +
    +
    + + + + +
    char* _AI_snort_alert::classification
    +
    +
    + +
    +
    + +
    +
    + + + + +
    char* _AI_snort_alert::desc
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint32_t _AI_snort_alert::dst_addr
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint16_t _AI_snort_alert::dst_port
    +
    +
    + +
    +
    + +
    +
    + + + + +
    unsigned int _AI_snort_alert::gid
    +
    +
    + +
    +
    + +
    +
    + + + + +
    unsigned int _AI_snort_alert::grouped_alarms_count
    +
    +
    + +
    +
    + +
    +
    + + + + +
    hierarchy_node* _AI_snort_alert::h_node[CLUSTER_TYPES]
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint16_t _AI_snort_alert::id
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint16_t _AI_snort_alert::iplen
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint8_t _AI_snort_alert::ipproto
    +
    +
    + +
    +
    + +
    +
    + + + + +
    struct _AI_snort_alert* _AI_snort_alert::next
    +
    +
    + +
    +
    + +
    +
    + + + + +
    unsigned short _AI_snort_alert::priority
    +
    +
    + +
    +
    + +
    +
    + + + + +
    unsigned int _AI_snort_alert::rev
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint32_t _AI_snort_alert::sequence
    +
    +
    + +
    +
    + +
    +
    + + + + +
    unsigned int _AI_snort_alert::sid
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint32_t _AI_snort_alert::src_addr
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint16_t _AI_snort_alert::src_port
    +
    +
    + +
    +
    + +
    +
    + + + + +
    struct pkt_info* _AI_snort_alert::stream
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint8_t _AI_snort_alert::tcp_flags
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint16_t _AI_snort_alert::tcplen
    +
    +
    + +
    +
    + +
    +
    + + + + +
    time_t _AI_snort_alert::timestamp
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint8_t _AI_snort_alert::tos
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint8_t _AI_snort_alert::ttl
    +
    +
    + +
    +
    + +
    +
    + + + + +
    uint16_t _AI_snort_alert::window
    +
    +
    + +
    +
    +
    The documentation for this struct was generated from the following file: +
    + + + + +
    + +
    + +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  + +doxygen 1.7.1
    + + diff --git a/doc/html/struct__hierarchy__node.html b/doc/html/struct__hierarchy__node.html new file mode 100644 index 0000000..12a2179 --- /dev/null +++ b/doc/html/struct__hierarchy__node.html @@ -0,0 +1,183 @@ + + + + +Snort AI preprocessor module: _hierarchy_node Struct Reference + + + + + + + + + +
    +
    +Data Fields
    +
    +

    _hierarchy_node Struct Reference

    +
    +
    + +

    #include <spp_ai.h>

    + + + + + + + + + +

    +Data Fields

    cluster_type type
    char label [256]
    int min_val
    int max_val
    int nchildren
    struct _hierarchy_node * parent
    struct _hierarchy_node ** children
    +

    Field Documentation

    + +
    +
    + + + + +
    struct _hierarchy_node** _hierarchy_node::children
    +
    +
    + +
    +
    + +
    +
    + + + + +
    char _hierarchy_node::label[256]
    +
    +
    + +
    +
    + +
    +
    + + + + +
    int _hierarchy_node::max_val
    +
    +
    + +
    +
    + +
    +
    + + + + +
    int _hierarchy_node::min_val
    +
    +
    + +
    +
    + +
    +
    + + + + +
    int _hierarchy_node::nchildren
    +
    +
    + +
    +
    + +
    +
    + + + + +
    struct _hierarchy_node* _hierarchy_node::parent
    +
    +
    + +
    +
    + +
    +
    + + + + +
    cluster_type _hierarchy_node::type
    +
    +
    + +
    +
    +
    The documentation for this struct was generated from the following file: +
    + + + + +
    + +
    + +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  + +doxygen 1.7.1
    + + diff --git a/doc/html/structattribute__key.html b/doc/html/structattribute__key.html new file mode 100644 index 0000000..bcc2315 --- /dev/null +++ b/doc/html/structattribute__key.html @@ -0,0 +1,111 @@ + + + + +Snort AI preprocessor module: attribute_key Struct Reference + + + + + + + + + +
    +
    +Data Fields
    +
    +

    attribute_key Struct Reference

    +
    +
    + + + + +

    +Data Fields

    int min
    int max
    +

    Field Documentation

    + +
    +
    + + + + +
    int attribute_key::max
    +
    +
    + +
    +
    + +
    +
    + + + + +
    int attribute_key::min
    +
    +
    + +
    +
    +
    The documentation for this struct was generated from the following file: +
    + + + + +
    + +
    + +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  + +doxygen 1.7.1
    + + diff --git a/doc/html/structattribute__value.html b/doc/html/structattribute__value.html new file mode 100644 index 0000000..b773606 --- /dev/null +++ b/doc/html/structattribute__value.html @@ -0,0 +1,139 @@ + + + + +Snort AI preprocessor module: attribute_value Struct Reference + + + + + + + + + +
    +
    +Data Fields
    +
    +

    attribute_value Struct Reference

    +
    +
    + + + + + + +

    +Data Fields

    attribute_key key
    cluster_type type
    unsigned int count
    UT_hash_handle hh
    +

    Field Documentation

    + +
    +
    + + + + +
    unsigned int attribute_value::count
    +
    +
    + +
    +
    + +
    +
    + + + + +
    UT_hash_handle attribute_value::hh
    +
    +
    + +
    +
    + +
    +
    + + + + +
    attribute_key attribute_value::key
    +
    +
    + +
    +
    + +
    +
    + + + + +
    cluster_type attribute_value::type
    +
    +
    + +
    +
    +
    The documentation for this struct was generated from the following file: +
    + + + + +
    + +
    + +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  + +doxygen 1.7.1
    + + diff --git a/doc/html/structpkt__info.html b/doc/html/structpkt__info.html index 5ff74e3..ba6f4d0 100644 --- a/doc/html/structpkt__info.html +++ b/doc/html/structpkt__info.html @@ -53,13 +53,16 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');

    pkt_info Struct Reference

    - + +

    #include <spp_ai.h>

    +
    +

    Data Fields

    struct pkt_key key
    time_t timestamp
    SFSnortPacket * pkt
    struct pkt_info * next
    BOOL observed
    UT_hash_handle hh

    Field Documentation

    @@ -100,6 +103,19 @@ Data Fields
    +
    + + +
    +
    + + + + +
    BOOL pkt_info::observed
    +
    +
    +
    @@ -129,7 +145,7 @@ Data Fields
    The documentation for this struct was generated from the following file: @@ -146,7 +162,7 @@ Data Fields -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/structpkt__key.html b/doc/html/structpkt__key.html index c785c5c..37cf8e5 100644 --- a/doc/html/structpkt__key.html +++ b/doc/html/structpkt__key.html @@ -53,7 +53,9 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');

    pkt_key Struct Reference

    - + +

    #include <spp_ai.h>

    +
    @@ -87,7 +89,7 @@ Data Fields
    The documentation for this struct was generated from the following file: @@ -104,7 +106,7 @@ Data Fields -
    Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by  +
    Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/latex/alert__parser_8c.tex b/doc/latex/alert__parser_8c.tex new file mode 100644 index 0000000..cef2ab4 --- /dev/null +++ b/doc/latex/alert__parser_8c.tex @@ -0,0 +1,111 @@ +\hypertarget{alert__parser_8c}{ +\section{alert\_\-parser.c File Reference} +\label{alert__parser_8c}\index{alert\_\-parser.c@{alert\_\-parser.c}} +} +{\ttfamily \#include \char`\"{}spp\_\-ai.h\char`\"{}}\par +{\ttfamily \#include $<$stdio.h$>$}\par +{\ttfamily \#include $<$unistd.h$>$}\par +{\ttfamily \#include $<$time.h$>$}\par +{\ttfamily \#include $<$sys/inotify.h$>$}\par +{\ttfamily \#include $<$sys/stat.h$>$}\par +\subsection*{Functions} +\begin{DoxyCompactItemize} +\item +void $\ast$ \hyperlink{alert__parser_8c_ad68c45b5846743a54ad3fa92c8e48f8a}{AI\_\-alertparser\_\-thread} (void $\ast$arg) +\begin{DoxyCompactList}\small\item\em Thread for parsing Snort's alert file. \item\end{DoxyCompactList}\item +PRIVATE \hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$ \hyperlink{alert__parser_8c_a6c5014cae9155379fdc4db649b2c862d}{\_\-AI\_\-copy\_\-alerts} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$node) +\begin{DoxyCompactList}\small\item\em Create a copy of the alert log struct (this is done for leaving the alert log structure in this file as read-\/only). \item\end{DoxyCompactList}\item +\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$ \hyperlink{alert__parser_8c_a99474495643197b3075ac22ec6f6c70f}{AI\_\-get\_\-alerts} () +\begin{DoxyCompactList}\small\item\em Return the alerts parsed so far as a linked list. \item\end{DoxyCompactList}\item +void \hyperlink{alert__parser_8c_a270e86669a0aa64a8da37bc16cda645b}{AI\_\-free\_\-alerts} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$node) +\begin{DoxyCompactList}\small\item\em Deallocate the memory of a log alert linked list. \item\end{DoxyCompactList}\end{DoxyCompactItemize} +\subsection*{Variables} +\begin{DoxyCompactItemize} +\item +PRIVATE \hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$ \hyperlink{alert__parser_8c_ae837fc04e61c0eb052f997c54b4fd9fe}{alerts} = NULL +\item +PRIVATE FILE $\ast$ \hyperlink{alert__parser_8c_abee2a33368912d9288c76b51160a9ed6}{alert\_\-fp} = NULL +\end{DoxyCompactItemize} + + +\subsection{Function Documentation} +\hypertarget{alert__parser_8c_a6c5014cae9155379fdc4db649b2c862d}{ +\index{alert\_\-parser.c@{alert\_\-parser.c}!\_\-AI\_\-copy\_\-alerts@{\_\-AI\_\-copy\_\-alerts}} +\index{\_\-AI\_\-copy\_\-alerts@{\_\-AI\_\-copy\_\-alerts}!alert_parser.c@{alert\_\-parser.c}} +\subsubsection[{\_\-AI\_\-copy\_\-alerts}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE {\bf AI\_\-snort\_\-alert}$\ast$ \_\-AI\_\-copy\_\-alerts ( +\begin{DoxyParamCaption} +\item[{{\bf AI\_\-snort\_\-alert} $\ast$}]{ node} +\end{DoxyParamCaption} +)}} +\label{alert__parser_8c_a6c5014cae9155379fdc4db649b2c862d} + + +Create a copy of the alert log struct (this is done for leaving the alert log structure in this file as read-\/only). + +FUNCTION: \_\-AI\_\-copy\_\-alerts +\begin{DoxyParams}{Parameters} +\item[{\em node}]Starting node (used for the recursion) \end{DoxyParams} +\begin{DoxyReturn}{Returns} +A copy of the alert log linked list +\end{DoxyReturn} +\hypertarget{alert__parser_8c_ad68c45b5846743a54ad3fa92c8e48f8a}{ +\index{alert\_\-parser.c@{alert\_\-parser.c}!AI\_\-alertparser\_\-thread@{AI\_\-alertparser\_\-thread}} +\index{AI\_\-alertparser\_\-thread@{AI\_\-alertparser\_\-thread}!alert_parser.c@{alert\_\-parser.c}} +\subsubsection[{AI\_\-alertparser\_\-thread}]{\setlength{\rightskip}{0pt plus 5cm}void$\ast$ AI\_\-alertparser\_\-thread ( +\begin{DoxyParamCaption} +\item[{void $\ast$}]{ arg} +\end{DoxyParamCaption} +)}} +\label{alert__parser_8c_ad68c45b5846743a54ad3fa92c8e48f8a} + + +Thread for parsing Snort's alert file. + +FUNCTION: AI\_\-alertparser\_\-thread +\begin{DoxyParams}{Parameters} +\item[{\em arg}]void$\ast$ pointer to module's configuration \end{DoxyParams} +\hypertarget{alert__parser_8c_a270e86669a0aa64a8da37bc16cda645b}{ +\index{alert\_\-parser.c@{alert\_\-parser.c}!AI\_\-free\_\-alerts@{AI\_\-free\_\-alerts}} +\index{AI\_\-free\_\-alerts@{AI\_\-free\_\-alerts}!alert_parser.c@{alert\_\-parser.c}} +\subsubsection[{AI\_\-free\_\-alerts}]{\setlength{\rightskip}{0pt plus 5cm}void AI\_\-free\_\-alerts ( +\begin{DoxyParamCaption} +\item[{{\bf AI\_\-snort\_\-alert} $\ast$}]{ node} +\end{DoxyParamCaption} +)}} +\label{alert__parser_8c_a270e86669a0aa64a8da37bc16cda645b} + + +Deallocate the memory of a log alert linked list. + +FUNCTION: AI\_\-free\_\-alerts +\begin{DoxyParams}{Parameters} +\item[{\em node}]Linked list to be freed \end{DoxyParams} +\hypertarget{alert__parser_8c_a99474495643197b3075ac22ec6f6c70f}{ +\index{alert\_\-parser.c@{alert\_\-parser.c}!AI\_\-get\_\-alerts@{AI\_\-get\_\-alerts}} +\index{AI\_\-get\_\-alerts@{AI\_\-get\_\-alerts}!alert_parser.c@{alert\_\-parser.c}} +\subsubsection[{AI\_\-get\_\-alerts}]{\setlength{\rightskip}{0pt plus 5cm}{\bf AI\_\-snort\_\-alert}$\ast$ AI\_\-get\_\-alerts ( +\begin{DoxyParamCaption} +\item[{void}]{} +\end{DoxyParamCaption} +)}} +\label{alert__parser_8c_a99474495643197b3075ac22ec6f6c70f} + + +Return the alerts parsed so far as a linked list. + +FUNCTION: AI\_\-get\_\-alerts \begin{DoxyReturn}{Returns} +An AI\_\-snort\_\-alert pointer identifying the list of alerts +\end{DoxyReturn} + + +\subsection{Variable Documentation} +\hypertarget{alert__parser_8c_abee2a33368912d9288c76b51160a9ed6}{ +\index{alert\_\-parser.c@{alert\_\-parser.c}!alert\_\-fp@{alert\_\-fp}} +\index{alert\_\-fp@{alert\_\-fp}!alert_parser.c@{alert\_\-parser.c}} +\subsubsection[{alert\_\-fp}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE FILE$\ast$ {\bf alert\_\-fp} = NULL}} +\label{alert__parser_8c_abee2a33368912d9288c76b51160a9ed6} +\hypertarget{alert__parser_8c_ae837fc04e61c0eb052f997c54b4fd9fe}{ +\index{alert\_\-parser.c@{alert\_\-parser.c}!alerts@{alerts}} +\index{alerts@{alerts}!alert_parser.c@{alert\_\-parser.c}} +\subsubsection[{alerts}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE {\bf AI\_\-snort\_\-alert}$\ast$ {\bf alerts} = NULL}} +\label{alert__parser_8c_ae837fc04e61c0eb052f997c54b4fd9fe} diff --git a/doc/latex/annotated.tex b/doc/latex/annotated.tex index a4eb945..a6b0571 100644 --- a/doc/latex/annotated.tex +++ b/doc/latex/annotated.tex @@ -1,6 +1,10 @@ \section{Data Structures} Here are the data structures with brief descriptions:\begin{DoxyCompactList} -\item\contentsline{section}{\hyperlink{struct__AI__config}{\_\-AI\_\-config} }{\pageref{struct__AI__config}}{} +\item\contentsline{section}{\hyperlink{struct__AI__snort__alert}{\_\-AI\_\-snort\_\-alert} }{\pageref{struct__AI__snort__alert}}{} +\item\contentsline{section}{\hyperlink{struct__hierarchy__node}{\_\-hierarchy\_\-node} }{\pageref{struct__hierarchy__node}}{} +\item\contentsline{section}{\hyperlink{structAI__config}{AI\_\-config} }{\pageref{structAI__config}}{} +\item\contentsline{section}{\hyperlink{structattribute__key}{attribute\_\-key} }{\pageref{structattribute__key}}{} +\item\contentsline{section}{\hyperlink{structattribute__value}{attribute\_\-value} }{\pageref{structattribute__value}}{} \item\contentsline{section}{\hyperlink{structpkt__info}{pkt\_\-info} }{\pageref{structpkt__info}}{} \item\contentsline{section}{\hyperlink{structpkt__key}{pkt\_\-key} }{\pageref{structpkt__key}}{} \end{DoxyCompactList} diff --git a/doc/latex/cluster_8c.tex b/doc/latex/cluster_8c.tex new file mode 100644 index 0000000..b545c8e --- /dev/null +++ b/doc/latex/cluster_8c.tex @@ -0,0 +1,253 @@ +\hypertarget{cluster_8c}{ +\section{cluster.c File Reference} +\label{cluster_8c}\index{cluster.c@{cluster.c}} +} +{\ttfamily \#include \char`\"{}spp\_\-ai.h\char`\"{}}\par +{\ttfamily \#include $<$stdio.h$>$}\par +{\ttfamily \#include $<$unistd.h$>$}\par +{\ttfamily \#include $<$limits.h$>$}\par +{\ttfamily \#include $<$pthread.h$>$}\par +\subsection*{Data Structures} +\begin{DoxyCompactItemize} +\item +struct \hyperlink{structattribute__key}{attribute\_\-key} +\item +struct \hyperlink{structattribute__value}{attribute\_\-value} +\end{DoxyCompactItemize} +\subsection*{Functions} +\begin{DoxyCompactItemize} +\item +PRIVATE int \hyperlink{cluster_8c_a81f5fa721719fdb281595a568eef2101}{\_\-heuristic\_\-func} (\hyperlink{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640}{cluster\_\-type} type) +\begin{DoxyCompactList}\small\item\em Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124). \item\end{DoxyCompactList}\item +PRIVATE \hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$ \hyperlink{cluster_8c_a2f1a22cfea64e4669da0467620c3e3b3}{\_\-hierarchy\_\-node\_\-new} (char $\ast$label, int min\_\-val, int max\_\-val) +\begin{DoxyCompactList}\small\item\em Create a new clustering hierarchy node. \item\end{DoxyCompactList}\item +PRIVATE void \hyperlink{cluster_8c_a5601a1f603d9c870ef6e2df192e30c30}{\_\-hierarchy\_\-node\_\-append} (\hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$parent, \hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$child) +\begin{DoxyCompactList}\small\item\em Append a node to a clustering hierarchy node. \item\end{DoxyCompactList}\item +PRIVATE \hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$ \hyperlink{cluster_8c_a6ddddcd505b1f763c339e81fc143e079}{\_\-AI\_\-get\_\-min\_\-hierarchy\_\-node} (int val, \hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$root) +\begin{DoxyCompactList}\small\item\em Get the minimum node in a hierarchy tree that matches a certain value. \item\end{DoxyCompactList}\item +PRIVATE \hyperlink{spp__ai_8h_a3e5b8192e7d9ffaf3542f1210aec18dd}{BOOL} \hyperlink{cluster_8c_a0f91c8bfc37a3975f5c26b19fd6c5cba}{\_\-AI\_\-equal\_\-alarms} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$a1, \hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$a2) +\begin{DoxyCompactList}\small\item\em Check if two alerts are semantically equal. \item\end{DoxyCompactList}\item +PRIVATE int \hyperlink{cluster_8c_a8ce8e5a5d8954672297fa2dedb380dcd}{\_\-AI\_\-merge\_\-alerts} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$$\ast$log) +\begin{DoxyCompactList}\small\item\em Merge the alerts marked as equal in the log. \item\end{DoxyCompactList}\item +PRIVATE void \hyperlink{cluster_8c_a7d151880080470b542e99643dc0426a7}{\_\-AI\_\-print\_\-clustered\_\-alerts} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$log, FILE $\ast$fp) +\begin{DoxyCompactList}\small\item\em Print the clustered alerts to a log file. \item\end{DoxyCompactList}\item +PRIVATE void $\ast$ \hyperlink{cluster_8c_a8a5eae61dc9fd0f13e0acdfa5f4478e2}{\_\-AI\_\-cluster\_\-thread} (void $\ast$arg) +\begin{DoxyCompactList}\small\item\em Thread for periodically clustering the log information. \item\end{DoxyCompactList}\item +PRIVATE \hyperlink{spp__ai_8h_a3e5b8192e7d9ffaf3542f1210aec18dd}{BOOL} \hyperlink{cluster_8c_a29c35cd6c56f54e27b5b190c6d6c487a}{\_\-AI\_\-check\_\-duplicate} (\hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$node, \hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$root) +\begin{DoxyCompactList}\small\item\em Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy. \item\end{DoxyCompactList}\item +void \hyperlink{cluster_8c_a1445818b37483f78cc3fb2890155842c}{AI\_\-hierarchies\_\-build} (\hyperlink{structAI__config}{AI\_\-config} $\ast$conf, \hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$$\ast$nodes, int n\_\-nodes) +\begin{DoxyCompactList}\small\item\em Build the clustering hierarchy trees. \item\end{DoxyCompactList}\end{DoxyCompactItemize} +\subsection*{Variables} +\begin{DoxyCompactItemize} +\item +PRIVATE \hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$ \hyperlink{cluster_8c_a97d35425cf5a0207fb50b64ee8cdda82}{h\_\-root} \mbox{[}CLUSTER\_\-TYPES\mbox{]} = \{ NULL \} +\item +PRIVATE \hyperlink{structAI__config}{AI\_\-config} $\ast$ \hyperlink{cluster_8c_a91458e2d34595688e39fcb63ba418849}{\_\-config} = NULL +\item +PRIVATE \hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$ \hyperlink{cluster_8c_aaf4c19f60f48741b0890c6114dcff7d9}{alert\_\-log} = NULL +\end{DoxyCompactItemize} + + +\subsection{Function Documentation} +\hypertarget{cluster_8c_a29c35cd6c56f54e27b5b190c6d6c487a}{ +\index{cluster.c@{cluster.c}!\_\-AI\_\-check\_\-duplicate@{\_\-AI\_\-check\_\-duplicate}} +\index{\_\-AI\_\-check\_\-duplicate@{\_\-AI\_\-check\_\-duplicate}!cluster.c@{cluster.c}} +\subsubsection[{\_\-AI\_\-check\_\-duplicate}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE {\bf BOOL} \_\-AI\_\-check\_\-duplicate ( +\begin{DoxyParamCaption} +\item[{{\bf hierarchy\_\-node} $\ast$}]{ node, } +\item[{{\bf hierarchy\_\-node} $\ast$}]{ root} +\end{DoxyParamCaption} +)}} +\label{cluster_8c_a29c35cd6c56f54e27b5b190c6d6c487a} + + +Check if a certain node's range (minimum and maximum value) are already present in a clustering hierarchy. + +FUNCTION: \_\-AI\_\-check\_\-duplicate +\begin{DoxyParams}{Parameters} +\item[{\em node}]Node to be checked \item[{\em root}]Clustering hierarchy \end{DoxyParams} +\begin{DoxyReturn}{Returns} +True if 'node' is already in 'root', false otherwise +\end{DoxyReturn} +\hypertarget{cluster_8c_a8a5eae61dc9fd0f13e0acdfa5f4478e2}{ +\index{cluster.c@{cluster.c}!\_\-AI\_\-cluster\_\-thread@{\_\-AI\_\-cluster\_\-thread}} +\index{\_\-AI\_\-cluster\_\-thread@{\_\-AI\_\-cluster\_\-thread}!cluster.c@{cluster.c}} +\subsubsection[{\_\-AI\_\-cluster\_\-thread}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE void$\ast$ \_\-AI\_\-cluster\_\-thread ( +\begin{DoxyParamCaption} +\item[{void $\ast$}]{ arg} +\end{DoxyParamCaption} +)}} +\label{cluster_8c_a8a5eae61dc9fd0f13e0acdfa5f4478e2} + + +Thread for periodically clustering the log information. + +FUNCTION: \_\-AI\_\-cluster\_\-thread \hypertarget{cluster_8c_a0f91c8bfc37a3975f5c26b19fd6c5cba}{ +\index{cluster.c@{cluster.c}!\_\-AI\_\-equal\_\-alarms@{\_\-AI\_\-equal\_\-alarms}} +\index{\_\-AI\_\-equal\_\-alarms@{\_\-AI\_\-equal\_\-alarms}!cluster.c@{cluster.c}} +\subsubsection[{\_\-AI\_\-equal\_\-alarms}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE {\bf BOOL} \_\-AI\_\-equal\_\-alarms ( +\begin{DoxyParamCaption} +\item[{{\bf AI\_\-snort\_\-alert} $\ast$}]{ a1, } +\item[{{\bf AI\_\-snort\_\-alert} $\ast$}]{ a2} +\end{DoxyParamCaption} +)}} +\label{cluster_8c_a0f91c8bfc37a3975f5c26b19fd6c5cba} + + +Check if two alerts are semantically equal. + +FUNCTION: \_\-AI\_\-equal\_\-alarms +\begin{DoxyParams}{Parameters} +\item[{\em a1}]First alert \item[{\em a2}]Second alert \end{DoxyParams} +\begin{DoxyReturn}{Returns} +True if they are equal, false otherwise +\end{DoxyReturn} +\hypertarget{cluster_8c_a6ddddcd505b1f763c339e81fc143e079}{ +\index{cluster.c@{cluster.c}!\_\-AI\_\-get\_\-min\_\-hierarchy\_\-node@{\_\-AI\_\-get\_\-min\_\-hierarchy\_\-node}} +\index{\_\-AI\_\-get\_\-min\_\-hierarchy\_\-node@{\_\-AI\_\-get\_\-min\_\-hierarchy\_\-node}!cluster.c@{cluster.c}} +\subsubsection[{\_\-AI\_\-get\_\-min\_\-hierarchy\_\-node}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE {\bf hierarchy\_\-node}$\ast$ \_\-AI\_\-get\_\-min\_\-hierarchy\_\-node ( +\begin{DoxyParamCaption} +\item[{int}]{ val, } +\item[{{\bf hierarchy\_\-node} $\ast$}]{ root} +\end{DoxyParamCaption} +)}} +\label{cluster_8c_a6ddddcd505b1f763c339e81fc143e079} + + +Get the minimum node in a hierarchy tree that matches a certain value. + +FUNCTION: \_\-AI\_\-get\_\-min\_\-hierarchy\_\-node +\begin{DoxyParams}{Parameters} +\item[{\em val}]Value to be matched in the range \item[{\em root}]Root of the hierarchy \end{DoxyParams} +\begin{DoxyReturn}{Returns} +The minimum node that matches the value if any, NULL otherwise +\end{DoxyReturn} +\hypertarget{cluster_8c_a8ce8e5a5d8954672297fa2dedb380dcd}{ +\index{cluster.c@{cluster.c}!\_\-AI\_\-merge\_\-alerts@{\_\-AI\_\-merge\_\-alerts}} +\index{\_\-AI\_\-merge\_\-alerts@{\_\-AI\_\-merge\_\-alerts}!cluster.c@{cluster.c}} +\subsubsection[{\_\-AI\_\-merge\_\-alerts}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE int \_\-AI\_\-merge\_\-alerts ( +\begin{DoxyParamCaption} +\item[{{\bf AI\_\-snort\_\-alert} $\ast$$\ast$}]{ log} +\end{DoxyParamCaption} +)}} +\label{cluster_8c_a8ce8e5a5d8954672297fa2dedb380dcd} + + +Merge the alerts marked as equal in the log. + +FUNCTION: \_\-AI\_\-merge\_\-alerts +\begin{DoxyParams}{Parameters} +\item[{\em log}]Alert log reference \end{DoxyParams} +\begin{DoxyReturn}{Returns} +The number of merged couples +\end{DoxyReturn} +\hypertarget{cluster_8c_a7d151880080470b542e99643dc0426a7}{ +\index{cluster.c@{cluster.c}!\_\-AI\_\-print\_\-clustered\_\-alerts@{\_\-AI\_\-print\_\-clustered\_\-alerts}} +\index{\_\-AI\_\-print\_\-clustered\_\-alerts@{\_\-AI\_\-print\_\-clustered\_\-alerts}!cluster.c@{cluster.c}} +\subsubsection[{\_\-AI\_\-print\_\-clustered\_\-alerts}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE void \_\-AI\_\-print\_\-clustered\_\-alerts ( +\begin{DoxyParamCaption} +\item[{{\bf AI\_\-snort\_\-alert} $\ast$}]{ log, } +\item[{FILE $\ast$}]{ fp} +\end{DoxyParamCaption} +)}} +\label{cluster_8c_a7d151880080470b542e99643dc0426a7} + + +Print the clustered alerts to a log file. + +FUNCTION: \_\-AI\_\-print\_\-clustered\_\-alerts +\begin{DoxyParams}{Parameters} +\item[{\em log}]Log containing the alerts \item[{\em fp}]File pointer where the alerts will be printed \end{DoxyParams} +\hypertarget{cluster_8c_a81f5fa721719fdb281595a568eef2101}{ +\index{cluster.c@{cluster.c}!\_\-heuristic\_\-func@{\_\-heuristic\_\-func}} +\index{\_\-heuristic\_\-func@{\_\-heuristic\_\-func}!cluster.c@{cluster.c}} +\subsubsection[{\_\-heuristic\_\-func}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE int \_\-heuristic\_\-func ( +\begin{DoxyParamCaption} +\item[{{\bf cluster\_\-type}}]{ type} +\end{DoxyParamCaption} +)}} +\label{cluster_8c_a81f5fa721719fdb281595a568eef2101} + + +Function that picks up the heuristic value for a clustering attribute in according to Julisch's heuristic (ACM, Vol.2, No.3, 09 2002, pag.124). + +FUNCTION: \_\-heuristic\_\-func +\begin{DoxyParams}{Parameters} +\item[{\em type}]Attribute type \end{DoxyParams} +\begin{DoxyReturn}{Returns} +The heuristic coefficient for that attribute, -\/1 if no clustering information is available for that attribute +\end{DoxyReturn} +\hypertarget{cluster_8c_a5601a1f603d9c870ef6e2df192e30c30}{ +\index{cluster.c@{cluster.c}!\_\-hierarchy\_\-node\_\-append@{\_\-hierarchy\_\-node\_\-append}} +\index{\_\-hierarchy\_\-node\_\-append@{\_\-hierarchy\_\-node\_\-append}!cluster.c@{cluster.c}} +\subsubsection[{\_\-hierarchy\_\-node\_\-append}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE void \_\-hierarchy\_\-node\_\-append ( +\begin{DoxyParamCaption} +\item[{{\bf hierarchy\_\-node} $\ast$}]{ parent, } +\item[{{\bf hierarchy\_\-node} $\ast$}]{ child} +\end{DoxyParamCaption} +)}} +\label{cluster_8c_a5601a1f603d9c870ef6e2df192e30c30} + + +Append a node to a clustering hierarchy node. + +FUNCTION: \_\-hierarchy\_\-node\_\-append +\begin{DoxyParams}{Parameters} +\item[{\em parent}]Parent node \item[{\em child}]Child node \end{DoxyParams} +\hypertarget{cluster_8c_a2f1a22cfea64e4669da0467620c3e3b3}{ +\index{cluster.c@{cluster.c}!\_\-hierarchy\_\-node\_\-new@{\_\-hierarchy\_\-node\_\-new}} +\index{\_\-hierarchy\_\-node\_\-new@{\_\-hierarchy\_\-node\_\-new}!cluster.c@{cluster.c}} +\subsubsection[{\_\-hierarchy\_\-node\_\-new}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE {\bf hierarchy\_\-node}$\ast$ \_\-hierarchy\_\-node\_\-new ( +\begin{DoxyParamCaption} +\item[{char $\ast$}]{ label, } +\item[{int}]{ min\_\-val, } +\item[{int}]{ max\_\-val} +\end{DoxyParamCaption} +)}} +\label{cluster_8c_a2f1a22cfea64e4669da0467620c3e3b3} + + +Create a new clustering hierarchy node. + +FUNCTION: \_\-hierarchy\_\-node\_\-new +\begin{DoxyParams}{Parameters} +\item[{\em label}]Label for the node \item[{\em min\_\-val}]Minimum value for the range represented by the node \item[{\em max\_\-val}]Maximum value for the range represented by the node \end{DoxyParams} +\begin{DoxyReturn}{Returns} +The brand new node if the allocation was ok, otherwise abort the application +\end{DoxyReturn} +\hypertarget{cluster_8c_a1445818b37483f78cc3fb2890155842c}{ +\index{cluster.c@{cluster.c}!AI\_\-hierarchies\_\-build@{AI\_\-hierarchies\_\-build}} +\index{AI\_\-hierarchies\_\-build@{AI\_\-hierarchies\_\-build}!cluster.c@{cluster.c}} +\subsubsection[{AI\_\-hierarchies\_\-build}]{\setlength{\rightskip}{0pt plus 5cm}void AI\_\-hierarchies\_\-build ( +\begin{DoxyParamCaption} +\item[{{\bf AI\_\-config} $\ast$}]{ conf, } +\item[{{\bf hierarchy\_\-node} $\ast$$\ast$}]{ nodes, } +\item[{int}]{ n\_\-nodes} +\end{DoxyParamCaption} +)}} +\label{cluster_8c_a1445818b37483f78cc3fb2890155842c} + + +Build the clustering hierarchy trees. + +FUNCTION: AI\_\-hierarchies\_\-build +\begin{DoxyParams}{Parameters} +\item[{\em conf}]Reference to the configuration of the module \item[{\em nodes}]Nodes containing the information about the clustering ranges \item[{\em n\_\-nodes}]Number of nodes \end{DoxyParams} + + +\subsection{Variable Documentation} +\hypertarget{cluster_8c_a91458e2d34595688e39fcb63ba418849}{ +\index{cluster.c@{cluster.c}!\_\-config@{\_\-config}} +\index{\_\-config@{\_\-config}!cluster.c@{cluster.c}} +\subsubsection[{\_\-config}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE {\bf AI\_\-config}$\ast$ {\bf \_\-config} = NULL}} +\label{cluster_8c_a91458e2d34595688e39fcb63ba418849} +\hypertarget{cluster_8c_aaf4c19f60f48741b0890c6114dcff7d9}{ +\index{cluster.c@{cluster.c}!alert\_\-log@{alert\_\-log}} +\index{alert\_\-log@{alert\_\-log}!cluster.c@{cluster.c}} +\subsubsection[{alert\_\-log}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE {\bf AI\_\-snort\_\-alert}$\ast$ {\bf alert\_\-log} = NULL}} +\label{cluster_8c_aaf4c19f60f48741b0890c6114dcff7d9} +\hypertarget{cluster_8c_a97d35425cf5a0207fb50b64ee8cdda82}{ +\index{cluster.c@{cluster.c}!h\_\-root@{h\_\-root}} +\index{h\_\-root@{h\_\-root}!cluster.c@{cluster.c}} +\subsubsection[{h\_\-root}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE {\bf hierarchy\_\-node}$\ast$ {\bf h\_\-root}\mbox{[}CLUSTER\_\-TYPES\mbox{]} = \{ NULL \}}} +\label{cluster_8c_a97d35425cf5a0207fb50b64ee8cdda82} diff --git a/doc/latex/doxygen.sty b/doc/latex/doxygen.sty index e048d39..6b2aae6 100644 --- a/doc/latex/doxygen.sty +++ b/doc/latex/doxygen.sty @@ -27,9 +27,9 @@ \fancyplain{}{\bfseries\thepage}% } \rfoot[\fancyplain{}{\bfseries\scriptsize% - Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by Doxygen }]{} + Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by Doxygen }]{} \lfoot[]{\fancyplain{}{\bfseries\scriptsize% - Generated on Wed Aug 4 2010 11:30:57 for Snort AI preprocessor module by Doxygen }} + Generated on Mon Aug 16 2010 22:05:38 for Snort AI preprocessor module by Doxygen }} \cfoot{} %---------- Internal commands used in this style file ---------------- diff --git a/doc/latex/files.tex b/doc/latex/files.tex index 704242b..1801958 100644 --- a/doc/latex/files.tex +++ b/doc/latex/files.tex @@ -1,5 +1,8 @@ \section{File List} Here is a list of all files with brief descriptions:\begin{DoxyCompactList} +\item\contentsline{section}{\hyperlink{alert__parser_8c}{alert\_\-parser.c} }{\pageref{alert__parser_8c}}{} +\item\contentsline{section}{\hyperlink{cluster_8c}{cluster.c} }{\pageref{cluster_8c}}{} +\item\contentsline{section}{\hyperlink{regex_8c}{regex.c} }{\pageref{regex_8c}}{} \item\contentsline{section}{\hyperlink{sf__dynamic__preproc__lib_8c}{sf\_\-dynamic\_\-preproc\_\-lib.c} }{\pageref{sf__dynamic__preproc__lib_8c}}{} \item\contentsline{section}{\hyperlink{sf__preproc__info_8h}{sf\_\-preproc\_\-info.h} }{\pageref{sf__preproc__info_8h}}{} \item\contentsline{section}{\hyperlink{sfPolicyUserData_8c}{sfPolicyUserData.c} }{\pageref{sfPolicyUserData_8c}}{} diff --git a/doc/latex/refman.tex b/doc/latex/refman.tex index 51d4829..d84eff3 100644 --- a/doc/latex/refman.tex +++ b/doc/latex/refman.tex @@ -41,7 +41,7 @@ \vspace*{1cm} {\large Generated by Doxygen 1.7.1}\\ \vspace*{0.5cm} -{\small Wed Aug 4 2010 11:30:57}\\ +{\small Mon Aug 16 2010 22:05:38}\\ \end{center} \end{titlepage} \clearemptydoublepage @@ -59,10 +59,17 @@ \chapter{Module Documentation} \input{group__sfPolicyConfig} \chapter{Data Structure Documentation} -\input{struct__AI__config} +\input{struct__AI__snort__alert} +\input{struct__hierarchy__node} +\input{structAI__config} +\input{structattribute__key} +\input{structattribute__value} \input{structpkt__info} \input{structpkt__key} \chapter{File Documentation} +\input{alert__parser_8c} +\input{cluster_8c} +\input{regex_8c} \input{sf__dynamic__preproc__lib_8c} \input{sf__preproc__info_8h} \input{sfPolicyUserData_8c} diff --git a/doc/latex/regex_8c.tex b/doc/latex/regex_8c.tex new file mode 100644 index 0000000..3fe7d92 --- /dev/null +++ b/doc/latex/regex_8c.tex @@ -0,0 +1,38 @@ +\hypertarget{regex_8c}{ +\section{regex.c File Reference} +\label{regex_8c}\index{regex.c@{regex.c}} +} +{\ttfamily \#include $<$stdio.h$>$}\par +{\ttfamily \#include $<$stdlib.h$>$}\par +{\ttfamily \#include $<$string.h$>$}\par +{\ttfamily \#include $<$regex.h$>$}\par +\subsection*{Functions} +\begin{DoxyCompactItemize} +\item +int \hyperlink{regex_8c_a35f57c052a7de1ded54b67a1f7819791}{preg\_\-match} (const char $\ast$expr, char $\ast$str, char $\ast$$\ast$$\ast$matches, int $\ast$nmatches) +\begin{DoxyCompactList}\small\item\em Check if a string matches a regular expression. \item\end{DoxyCompactList}\end{DoxyCompactItemize} + + +\subsection{Function Documentation} +\hypertarget{regex_8c_a35f57c052a7de1ded54b67a1f7819791}{ +\index{regex.c@{regex.c}!preg\_\-match@{preg\_\-match}} +\index{preg\_\-match@{preg\_\-match}!regex.c@{regex.c}} +\subsubsection[{preg\_\-match}]{\setlength{\rightskip}{0pt plus 5cm}int preg\_\-match ( +\begin{DoxyParamCaption} +\item[{const char $\ast$}]{ expr, } +\item[{char $\ast$}]{ str, } +\item[{char $\ast$$\ast$$\ast$}]{ matches, } +\item[{int $\ast$}]{ nmatches} +\end{DoxyParamCaption} +)}} +\label{regex_8c_a35f57c052a7de1ded54b67a1f7819791} + + +Check if a string matches a regular expression. + +FUNCTION: preg\_\-match +\begin{DoxyParams}{Parameters} +\item[{\em expr}]Regular expression to be matched \item[{\em str}]String to be checked \item[{\em matches}]Reference to a char$\ast$$\ast$ that will contain the submatches (NULL if you don't need it) \item[{\em nmatches}]Reference to a int containing the number of submatches found (NULL if you don't need it) \end{DoxyParams} +\begin{DoxyReturn}{Returns} +-\/1 if the regex is wrong, 0 if no match was found, 1 otherwise +\end{DoxyReturn} diff --git a/doc/latex/spp__ai_8c.tex b/doc/latex/spp__ai_8c.tex index 21baed3..8d64916 100644 --- a/doc/latex/spp__ai_8c.tex +++ b/doc/latex/spp__ai_8c.tex @@ -3,30 +3,10 @@ \label{spp__ai_8c}\index{spp\_\-ai.c@{spp\_\-ai.c}} } {\ttfamily \#include \char`\"{}spp\_\-ai.h\char`\"{}}\par -{\ttfamily \#include \char`\"{}preprocids.h\char`\"{}}\par -{\ttfamily \#include \char`\"{}sf\_\-dynamic\_\-preproc\_\-lib.h\char`\"{}}\par -{\ttfamily \#include \char`\"{}sf\_\-dynamic\_\-preprocessor.h\char`\"{}}\par -{\ttfamily \#include \char`\"{}debug.h\char`\"{}}\par -{\ttfamily \#include \char`\"{}sfPolicy.h\char`\"{}}\par {\ttfamily \#include \char`\"{}sfPolicyUserData.h\char`\"{}}\par -{\ttfamily \#include $<$sys/types.h$>$}\par {\ttfamily \#include $<$stdlib.h$>$}\par -{\ttfamily \#include $<$ctype.h$>$}\par {\ttfamily \#include $<$string.h$>$}\par {\ttfamily \#include $<$pthread.h$>$}\par -\subsection*{Defines} -\begin{DoxyCompactItemize} -\item -\#define \hyperlink{spp__ai_8c_a9e7d446fc8b40be2cfbb5c69c3e132ca}{GENERATOR\_\-EXAMPLE}~256 -\item -\#define \hyperlink{spp__ai_8c_af4c767ae0346026264c851108f42be63}{SRC\_\-PORT\_\-MATCH}~1 -\item -\#define \hyperlink{spp__ai_8c_a3ec4dd8f1ebed73c13175d9b9c820e2e}{SRC\_\-PORT\_\-MATCH\_\-STR}~\char`\"{}example\_\-preprocessor: src port match\char`\"{} -\item -\#define \hyperlink{spp__ai_8c_a8ab13e8ad1dfd19b9237a99ae6130146}{DST\_\-PORT\_\-MATCH}~2 -\item -\#define \hyperlink{spp__ai_8c_a1f3521b9bcf5daf99190be58473a4110}{DST\_\-PORT\_\-MATCH\_\-STR}~\char`\"{}example\_\-preprocessor: dest port match\char`\"{} -\end{DoxyCompactItemize} \subsection*{Functions} \begin{DoxyCompactItemize} \item @@ -34,7 +14,7 @@ static void \hyperlink{spp__ai_8c_a3524cbdf8fddbcf38c4ed55241002242}{AI\_\-init} \begin{DoxyCompactList}\small\item\em Initialize the preprocessor module. \item\end{DoxyCompactList}\item static void \hyperlink{spp__ai_8c_a57c05cda012c443cb4c358dc327cd3d1}{AI\_\-process} (void $\ast$pkt, void $\ast$context) \begin{DoxyCompactList}\small\item\em Function executed every time the module receives a packet to be processed. \item\end{DoxyCompactList}\item -static \hyperlink{struct__AI__config}{AI\_\-config} $\ast$ \hyperlink{spp__ai_8c_ae1c5c4b38ee2819d427848eb3046373e}{AI\_\-parse} (char $\ast$args) +static \hyperlink{structAI__config}{AI\_\-config} $\ast$ \hyperlink{spp__ai_8c_ae1c5c4b38ee2819d427848eb3046373e}{AI\_\-parse} (char $\ast$args) \begin{DoxyCompactList}\small\item\em Parse the arguments passed to the module saving them to a valid configuration struct. \item\end{DoxyCompactList}\item void \hyperlink{spp__ai_8c_a1b9ebb5c719c7d9426ddfc1f3da36570}{AI\_\-setup} (void) \begin{DoxyCompactList}\small\item\em Set up the preprocessor module. \item\end{DoxyCompactList}\end{DoxyCompactItemize} @@ -42,39 +22,9 @@ void \hyperlink{spp__ai_8c_a1b9ebb5c719c7d9426ddfc1f3da36570}{AI\_\-setup} (void \begin{DoxyCompactItemize} \item tSfPolicyUserContextId \hyperlink{spp__ai_8c_a3dd75596c540d148643fe6d1fdc02628}{ex\_\-config} = NULL -\item -DynamicPreprocessorData \hyperlink{spp__ai_8c_ab46420126c43c1aac5eabc5db266a71c}{\_\-dpd} \end{DoxyCompactItemize} -\subsection{Define Documentation} -\hypertarget{spp__ai_8c_a8ab13e8ad1dfd19b9237a99ae6130146}{ -\index{spp\_\-ai.c@{spp\_\-ai.c}!DST\_\-PORT\_\-MATCH@{DST\_\-PORT\_\-MATCH}} -\index{DST\_\-PORT\_\-MATCH@{DST\_\-PORT\_\-MATCH}!spp_ai.c@{spp\_\-ai.c}} -\subsubsection[{DST\_\-PORT\_\-MATCH}]{\setlength{\rightskip}{0pt plus 5cm}\#define DST\_\-PORT\_\-MATCH~2}} -\label{spp__ai_8c_a8ab13e8ad1dfd19b9237a99ae6130146} -\hypertarget{spp__ai_8c_a1f3521b9bcf5daf99190be58473a4110}{ -\index{spp\_\-ai.c@{spp\_\-ai.c}!DST\_\-PORT\_\-MATCH\_\-STR@{DST\_\-PORT\_\-MATCH\_\-STR}} -\index{DST\_\-PORT\_\-MATCH\_\-STR@{DST\_\-PORT\_\-MATCH\_\-STR}!spp_ai.c@{spp\_\-ai.c}} -\subsubsection[{DST\_\-PORT\_\-MATCH\_\-STR}]{\setlength{\rightskip}{0pt plus 5cm}\#define DST\_\-PORT\_\-MATCH\_\-STR~\char`\"{}example\_\-preprocessor: dest port match\char`\"{}}} -\label{spp__ai_8c_a1f3521b9bcf5daf99190be58473a4110} -\hypertarget{spp__ai_8c_a9e7d446fc8b40be2cfbb5c69c3e132ca}{ -\index{spp\_\-ai.c@{spp\_\-ai.c}!GENERATOR\_\-EXAMPLE@{GENERATOR\_\-EXAMPLE}} -\index{GENERATOR\_\-EXAMPLE@{GENERATOR\_\-EXAMPLE}!spp_ai.c@{spp\_\-ai.c}} -\subsubsection[{GENERATOR\_\-EXAMPLE}]{\setlength{\rightskip}{0pt plus 5cm}\#define GENERATOR\_\-EXAMPLE~256}} -\label{spp__ai_8c_a9e7d446fc8b40be2cfbb5c69c3e132ca} -\hypertarget{spp__ai_8c_af4c767ae0346026264c851108f42be63}{ -\index{spp\_\-ai.c@{spp\_\-ai.c}!SRC\_\-PORT\_\-MATCH@{SRC\_\-PORT\_\-MATCH}} -\index{SRC\_\-PORT\_\-MATCH@{SRC\_\-PORT\_\-MATCH}!spp_ai.c@{spp\_\-ai.c}} -\subsubsection[{SRC\_\-PORT\_\-MATCH}]{\setlength{\rightskip}{0pt plus 5cm}\#define SRC\_\-PORT\_\-MATCH~1}} -\label{spp__ai_8c_af4c767ae0346026264c851108f42be63} -\hypertarget{spp__ai_8c_a3ec4dd8f1ebed73c13175d9b9c820e2e}{ -\index{spp\_\-ai.c@{spp\_\-ai.c}!SRC\_\-PORT\_\-MATCH\_\-STR@{SRC\_\-PORT\_\-MATCH\_\-STR}} -\index{SRC\_\-PORT\_\-MATCH\_\-STR@{SRC\_\-PORT\_\-MATCH\_\-STR}!spp_ai.c@{spp\_\-ai.c}} -\subsubsection[{SRC\_\-PORT\_\-MATCH\_\-STR}]{\setlength{\rightskip}{0pt plus 5cm}\#define SRC\_\-PORT\_\-MATCH\_\-STR~\char`\"{}example\_\-preprocessor: src port match\char`\"{}}} -\label{spp__ai_8c_a3ec4dd8f1ebed73c13175d9b9c820e2e} - - \subsection{Function Documentation} \hypertarget{spp__ai_8c_a3524cbdf8fddbcf38c4ed55241002242}{ \index{spp\_\-ai.c@{spp\_\-ai.c}!AI\_\-init@{AI\_\-init}} @@ -105,11 +55,11 @@ FUNCTION: AI\_\-init Parse the arguments passed to the module saving them to a valid configuration struct. -FUNCTION: AI\_\-config +FUNCTION: \hyperlink{structAI__config}{AI\_\-config} \begin{DoxyParams}{Parameters} \item[{\em args}]Arguments passed to the module \end{DoxyParams} \begin{DoxyReturn}{Returns} -Pointer to AI\_\-config keeping the configuration for the module +Pointer to \hyperlink{structAI__config}{AI\_\-config} keeping the configuration for the module \end{DoxyReturn} \hypertarget{spp__ai_8c_a57c05cda012c443cb4c358dc327cd3d1}{ \index{spp\_\-ai.c@{spp\_\-ai.c}!AI\_\-process@{AI\_\-process}} @@ -144,11 +94,6 @@ Set up the preprocessor module. FUNCTION: AI\_\-setup \subsection{Variable Documentation} -\hypertarget{spp__ai_8c_ab46420126c43c1aac5eabc5db266a71c}{ -\index{spp\_\-ai.c@{spp\_\-ai.c}!\_\-dpd@{\_\-dpd}} -\index{\_\-dpd@{\_\-dpd}!spp_ai.c@{spp\_\-ai.c}} -\subsubsection[{\_\-dpd}]{\setlength{\rightskip}{0pt plus 5cm}DynamicPreprocessorData {\bf \_\-dpd}}} -\label{spp__ai_8c_ab46420126c43c1aac5eabc5db266a71c} \hypertarget{spp__ai_8c_a3dd75596c540d148643fe6d1fdc02628}{ \index{spp\_\-ai.c@{spp\_\-ai.c}!ex\_\-config@{ex\_\-config}} \index{ex\_\-config@{ex\_\-config}!spp_ai.c@{spp\_\-ai.c}} diff --git a/doc/latex/spp__ai_8h.tex b/doc/latex/spp__ai_8h.tex index 0430843..3cf1235 100644 --- a/doc/latex/spp__ai_8h.tex +++ b/doc/latex/spp__ai_8h.tex @@ -3,19 +3,48 @@ \label{spp__ai_8h}\index{spp\_\-ai.h@{spp\_\-ai.h}} } {\ttfamily \#include \char`\"{}sf\_\-snort\_\-packet.h\char`\"{}}\par +{\ttfamily \#include \char`\"{}sf\_\-dynamic\_\-preprocessor.h\char`\"{}}\par +{\ttfamily \#include \char`\"{}uthash.h\char`\"{}}\par \subsection*{Data Structures} \begin{DoxyCompactItemize} \item -struct \hyperlink{struct__AI__config}{\_\-AI\_\-config} +struct \hyperlink{structpkt__key}{pkt\_\-key} +\item +struct \hyperlink{structpkt__info}{pkt\_\-info} +\item +struct \hyperlink{structAI__config}{AI\_\-config} +\item +struct \hyperlink{struct__hierarchy__node}{\_\-hierarchy\_\-node} +\item +struct \hyperlink{struct__AI__snort__alert}{\_\-AI\_\-snort\_\-alert} +\end{DoxyCompactItemize} +\subsection*{Defines} +\begin{DoxyCompactItemize} +\item +\#define \hyperlink{spp__ai_8h_a5e151c615eda34903514212f05a5ccf8}{PRIVATE}~static +\item +\#define \hyperlink{spp__ai_8h_a5f555c0ebd29ce2771a3e2dd4f526746}{DEFAULT\_\-HASH\_\-CLEANUP\_\-INTERVAL}~300 +\item +\#define \hyperlink{spp__ai_8h_a0f6a189af15ef783fb46ed37c144e031}{DEFAULT\_\-STREAM\_\-EXPIRE\_\-INTERVAL}~300 +\item +\#define \hyperlink{spp__ai_8h_a0c4b6fce670e46083e33b9f53b78f39e}{DEFAULT\_\-ALERT\_\-CLUSTERING\_\-INTERVAL}~3600 +\item +\#define \hyperlink{spp__ai_8h_a6d9bf552c32371e0144dc6a6209c7e4a}{DEFAULT\_\-ALERT\_\-LOG\_\-FILE}~\char`\"{}/var/log/snort/alert\char`\"{} +\item +\#define \hyperlink{spp__ai_8h_a803dc913297ccdace9e604dbfecda97d}{DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE}~\char`\"{}/var/log/snort/cluster\_\-alert\char`\"{} \end{DoxyCompactItemize} \subsection*{Typedefs} \begin{DoxyCompactItemize} \item -typedef unsigned int \hyperlink{spp__ai_8h_a435d1572bf3f880d55459d9805097f62}{uint32\_\-t} +typedef unsigned char \hyperlink{spp__ai_8h_aba7bc1797add20fe3efdf37ced1182c5}{uint8\_\-t} \item typedef unsigned short \hyperlink{spp__ai_8h_a273cf69d639a59973b6019625df33e30}{uint16\_\-t} \item -typedef struct \hyperlink{struct__AI__config}{\_\-AI\_\-config} \hyperlink{spp__ai_8h_a3fc526e5a55f5d137402b1bbd1b6072c}{AI\_\-config} +typedef unsigned int \hyperlink{spp__ai_8h_a435d1572bf3f880d55459d9805097f62}{uint32\_\-t} +\item +typedef struct \hyperlink{struct__hierarchy__node}{\_\-hierarchy\_\-node} \hyperlink{spp__ai_8h_a466391129919ef12366d311d501552fa}{hierarchy\_\-node} +\item +typedef struct \hyperlink{struct__AI__snort__alert}{\_\-AI\_\-snort\_\-alert} \hyperlink{spp__ai_8h_a982be90e72362e88d09f28336c9a1897}{AI\_\-snort\_\-alert} \end{DoxyCompactItemize} \subsection*{Enumerations} \begin{DoxyCompactItemize} @@ -23,22 +52,89 @@ typedef struct \hyperlink{struct__AI__config}{\_\-AI\_\-config} \hyperlink{spp__ enum \hyperlink{spp__ai_8h_a3e5b8192e7d9ffaf3542f1210aec18dd}{BOOL} \{ \hyperlink{spp__ai_8h_a3e5b8192e7d9ffaf3542f1210aec18ddae9de385ef6fe9bf3360d1038396b884c}{false}, \hyperlink{spp__ai_8h_a3e5b8192e7d9ffaf3542f1210aec18dda08f175a5505a10b9ed657defeb050e4b}{true} \} +\item +enum \hyperlink{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640}{cluster\_\-type} \{ \par +\hyperlink{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640ab7e4e0120a041dbe6528b050c04269e0}{none}, +\hyperlink{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640abc900639df18f0f5f2f63a1f033fe42f}{src\_\-addr}, +\hyperlink{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640aa000f955ef1374c60cdb16bf43a1593c}{dst\_\-addr}, +\hyperlink{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640ac1335c508143eb06843af2ce5ff3027b}{src\_\-port}, +\par +\hyperlink{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640abc4f89a184ada44073bd6f54d7fc11c9}{dst\_\-port}, +\hyperlink{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640ab16bb5c4b330d5db02e2d852cd2ba451}{CLUSTER\_\-TYPES} + \} \end{DoxyCompactItemize} \subsection*{Functions} \begin{DoxyCompactItemize} \item +int \hyperlink{spp__ai_8h_a85c0852b05b60cbfe0130534160c9876}{preg\_\-match} (const char $\ast$, char $\ast$, char $\ast$$\ast$$\ast$, int $\ast$) +\begin{DoxyCompactList}\small\item\em Check if a string matches a regular expression. \item\end{DoxyCompactList}\item +void $\ast$ \hyperlink{spp__ai_8h_ad56f71be823eead743972274b99c82ff}{AI\_\-hashcleanup\_\-thread} (void $\ast$) +\begin{DoxyCompactList}\small\item\em Thread called for cleaning up the hash table from the traffic streams older than a certain threshold. \item\end{DoxyCompactList}\item +void $\ast$ \hyperlink{spp__ai_8h_a842a3204c6e067a9920990b573757181}{AI\_\-alertparser\_\-thread} (void $\ast$) +\begin{DoxyCompactList}\small\item\em Thread for parsing Snort's alert file. \item\end{DoxyCompactList}\item void \hyperlink{spp__ai_8h_af6f7d167c3623bbc669e8d31c2719b29}{AI\_\-pkt\_\-enqueue} (SFSnortPacket $\ast$) \begin{DoxyCompactList}\small\item\em Function called for appending a new packet to the hash table, creating a new stream or appending it to an existing stream. \item\end{DoxyCompactList}\item -void $\ast$ \hyperlink{spp__ai_8h_ad56f71be823eead743972274b99c82ff}{AI\_\-hashcleanup\_\-thread} (void $\ast$) -\begin{DoxyCompactList}\small\item\em Thread called for cleaning up the hash table from the traffic streams older than a certain threshold. \item\end{DoxyCompactList}\end{DoxyCompactItemize} +void \hyperlink{spp__ai_8h_a8749989cee2ac05a7de058faac280c02}{AI\_\-set\_\-stream\_\-observed} (struct \hyperlink{structpkt__key}{pkt\_\-key} key) +\begin{DoxyCompactList}\small\item\em Set the flag \char`\"{}observed\char`\"{} on a stream associated to a security alert, so that it won't be removed from the hash table. \item\end{DoxyCompactList}\item +void \hyperlink{spp__ai_8h_a857348424b9db45c90f95631eb96fd7c}{AI\_\-hierarchies\_\-build} (\hyperlink{structAI__config}{AI\_\-config} $\ast$, \hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$$\ast$, int) +\begin{DoxyCompactList}\small\item\em Build the clustering hierarchy trees. \item\end{DoxyCompactList}\item +struct \hyperlink{structpkt__info}{pkt\_\-info} $\ast$ \hyperlink{spp__ai_8h_a3054f06297a9caefd4d9b1283bb8b69a}{AI\_\-get\_\-stream\_\-by\_\-key} (struct \hyperlink{structpkt__key}{pkt\_\-key}) +\begin{DoxyCompactList}\small\item\em Get a TCP stream by key. \item\end{DoxyCompactList}\item +\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$ \hyperlink{spp__ai_8h_af19a28f7cbcdfeb2b66fb3b625b75076}{AI\_\-get\_\-alerts} (void) +\begin{DoxyCompactList}\small\item\em Return the alerts parsed so far as a linked list. \item\end{DoxyCompactList}\item +void \hyperlink{spp__ai_8h_a270e86669a0aa64a8da37bc16cda645b}{AI\_\-free\_\-alerts} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$node) +\begin{DoxyCompactList}\small\item\em Deallocate the memory of a log alert linked list. \item\end{DoxyCompactList}\end{DoxyCompactItemize} +\subsection*{Variables} +\begin{DoxyCompactItemize} +\item +DynamicPreprocessorData \hyperlink{spp__ai_8h_ab46420126c43c1aac5eabc5db266a71c}{\_\-dpd} +\end{DoxyCompactItemize} + + +\subsection{Define Documentation} +\hypertarget{spp__ai_8h_a0c4b6fce670e46083e33b9f53b78f39e}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!DEFAULT\_\-ALERT\_\-CLUSTERING\_\-INTERVAL@{DEFAULT\_\-ALERT\_\-CLUSTERING\_\-INTERVAL}} +\index{DEFAULT\_\-ALERT\_\-CLUSTERING\_\-INTERVAL@{DEFAULT\_\-ALERT\_\-CLUSTERING\_\-INTERVAL}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{DEFAULT\_\-ALERT\_\-CLUSTERING\_\-INTERVAL}]{\setlength{\rightskip}{0pt plus 5cm}\#define DEFAULT\_\-ALERT\_\-CLUSTERING\_\-INTERVAL~3600}} +\label{spp__ai_8h_a0c4b6fce670e46083e33b9f53b78f39e} +\hypertarget{spp__ai_8h_a6d9bf552c32371e0144dc6a6209c7e4a}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!DEFAULT\_\-ALERT\_\-LOG\_\-FILE@{DEFAULT\_\-ALERT\_\-LOG\_\-FILE}} +\index{DEFAULT\_\-ALERT\_\-LOG\_\-FILE@{DEFAULT\_\-ALERT\_\-LOG\_\-FILE}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{DEFAULT\_\-ALERT\_\-LOG\_\-FILE}]{\setlength{\rightskip}{0pt plus 5cm}\#define DEFAULT\_\-ALERT\_\-LOG\_\-FILE~\char`\"{}/var/log/snort/alert\char`\"{}}} +\label{spp__ai_8h_a6d9bf552c32371e0144dc6a6209c7e4a} +\hypertarget{spp__ai_8h_a803dc913297ccdace9e604dbfecda97d}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE@{DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE}} +\index{DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE@{DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE}]{\setlength{\rightskip}{0pt plus 5cm}\#define DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE~\char`\"{}/var/log/snort/cluster\_\-alert\char`\"{}}} +\label{spp__ai_8h_a803dc913297ccdace9e604dbfecda97d} +\hypertarget{spp__ai_8h_a5f555c0ebd29ce2771a3e2dd4f526746}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!DEFAULT\_\-HASH\_\-CLEANUP\_\-INTERVAL@{DEFAULT\_\-HASH\_\-CLEANUP\_\-INTERVAL}} +\index{DEFAULT\_\-HASH\_\-CLEANUP\_\-INTERVAL@{DEFAULT\_\-HASH\_\-CLEANUP\_\-INTERVAL}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{DEFAULT\_\-HASH\_\-CLEANUP\_\-INTERVAL}]{\setlength{\rightskip}{0pt plus 5cm}\#define DEFAULT\_\-HASH\_\-CLEANUP\_\-INTERVAL~300}} +\label{spp__ai_8h_a5f555c0ebd29ce2771a3e2dd4f526746} +\hypertarget{spp__ai_8h_a0f6a189af15ef783fb46ed37c144e031}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!DEFAULT\_\-STREAM\_\-EXPIRE\_\-INTERVAL@{DEFAULT\_\-STREAM\_\-EXPIRE\_\-INTERVAL}} +\index{DEFAULT\_\-STREAM\_\-EXPIRE\_\-INTERVAL@{DEFAULT\_\-STREAM\_\-EXPIRE\_\-INTERVAL}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{DEFAULT\_\-STREAM\_\-EXPIRE\_\-INTERVAL}]{\setlength{\rightskip}{0pt plus 5cm}\#define DEFAULT\_\-STREAM\_\-EXPIRE\_\-INTERVAL~300}} +\label{spp__ai_8h_a0f6a189af15ef783fb46ed37c144e031} +\hypertarget{spp__ai_8h_a5e151c615eda34903514212f05a5ccf8}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!PRIVATE@{PRIVATE}} +\index{PRIVATE@{PRIVATE}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{PRIVATE}]{\setlength{\rightskip}{0pt plus 5cm}\#define PRIVATE~static}} +\label{spp__ai_8h_a5e151c615eda34903514212f05a5ccf8} \subsection{Typedef Documentation} -\hypertarget{spp__ai_8h_a3fc526e5a55f5d137402b1bbd1b6072c}{ -\index{spp\_\-ai.h@{spp\_\-ai.h}!AI\_\-config@{AI\_\-config}} -\index{AI\_\-config@{AI\_\-config}!spp_ai.h@{spp\_\-ai.h}} -\subsubsection[{AI\_\-config}]{\setlength{\rightskip}{0pt plus 5cm}typedef struct {\bf \_\-AI\_\-config} {\bf AI\_\-config}}} -\label{spp__ai_8h_a3fc526e5a55f5d137402b1bbd1b6072c} +\hypertarget{spp__ai_8h_a982be90e72362e88d09f28336c9a1897}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!AI\_\-snort\_\-alert@{AI\_\-snort\_\-alert}} +\index{AI\_\-snort\_\-alert@{AI\_\-snort\_\-alert}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{AI\_\-snort\_\-alert}]{\setlength{\rightskip}{0pt plus 5cm}typedef struct {\bf \_\-AI\_\-snort\_\-alert} {\bf AI\_\-snort\_\-alert}}} +\label{spp__ai_8h_a982be90e72362e88d09f28336c9a1897} +\hypertarget{spp__ai_8h_a466391129919ef12366d311d501552fa}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!hierarchy\_\-node@{hierarchy\_\-node}} +\index{hierarchy\_\-node@{hierarchy\_\-node}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{hierarchy\_\-node}]{\setlength{\rightskip}{0pt plus 5cm}typedef struct {\bf \_\-hierarchy\_\-node} {\bf hierarchy\_\-node}}} +\label{spp__ai_8h_a466391129919ef12366d311d501552fa} \hypertarget{spp__ai_8h_a273cf69d639a59973b6019625df33e30}{ \index{spp\_\-ai.h@{spp\_\-ai.h}!uint16\_\-t@{uint16\_\-t}} \index{uint16\_\-t@{uint16\_\-t}!spp_ai.h@{spp\_\-ai.h}} @@ -49,6 +145,11 @@ void $\ast$ \hyperlink{spp__ai_8h_ad56f71be823eead743972274b99c82ff}{AI\_\-hashc \index{uint32\_\-t@{uint32\_\-t}!spp_ai.h@{spp\_\-ai.h}} \subsubsection[{uint32\_\-t}]{\setlength{\rightskip}{0pt plus 5cm}typedef unsigned int {\bf uint32\_\-t}}} \label{spp__ai_8h_a435d1572bf3f880d55459d9805097f62} +\hypertarget{spp__ai_8h_aba7bc1797add20fe3efdf37ced1182c5}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!uint8\_\-t@{uint8\_\-t}} +\index{uint8\_\-t@{uint8\_\-t}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{uint8\_\-t}]{\setlength{\rightskip}{0pt plus 5cm}typedef unsigned char {\bf uint8\_\-t}}} +\label{spp__ai_8h_aba7bc1797add20fe3efdf37ced1182c5} \subsection{Enumeration Type Documentation} @@ -71,9 +172,111 @@ true} }]\end{description} \end{Desc} +\hypertarget{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!cluster\_\-type@{cluster\_\-type}} +\index{cluster\_\-type@{cluster\_\-type}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{cluster\_\-type}]{\setlength{\rightskip}{0pt plus 5cm}enum {\bf cluster\_\-type}}} +\label{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640} +\begin{Desc} +\item[Enumerator: ]\par +\begin{description} +\index{none@{none}!spp\_\-ai.h@{spp\_\-ai.h}}\index{spp\_\-ai.h@{spp\_\-ai.h}!none@{none}}\item[{\em +\hypertarget{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640ab7e4e0120a041dbe6528b050c04269e0}{ +none} +\label{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640ab7e4e0120a041dbe6528b050c04269e0} +}]\index{src\_\-addr@{src\_\-addr}!spp\_\-ai.h@{spp\_\-ai.h}}\index{spp\_\-ai.h@{spp\_\-ai.h}!src\_\-addr@{src\_\-addr}}\item[{\em +\hypertarget{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640abc900639df18f0f5f2f63a1f033fe42f}{ +src\_\-addr} +\label{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640abc900639df18f0f5f2f63a1f033fe42f} +}]\index{dst\_\-addr@{dst\_\-addr}!spp\_\-ai.h@{spp\_\-ai.h}}\index{spp\_\-ai.h@{spp\_\-ai.h}!dst\_\-addr@{dst\_\-addr}}\item[{\em +\hypertarget{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640aa000f955ef1374c60cdb16bf43a1593c}{ +dst\_\-addr} +\label{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640aa000f955ef1374c60cdb16bf43a1593c} +}]\index{src\_\-port@{src\_\-port}!spp\_\-ai.h@{spp\_\-ai.h}}\index{spp\_\-ai.h@{spp\_\-ai.h}!src\_\-port@{src\_\-port}}\item[{\em +\hypertarget{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640ac1335c508143eb06843af2ce5ff3027b}{ +src\_\-port} +\label{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640ac1335c508143eb06843af2ce5ff3027b} +}]\index{dst\_\-port@{dst\_\-port}!spp\_\-ai.h@{spp\_\-ai.h}}\index{spp\_\-ai.h@{spp\_\-ai.h}!dst\_\-port@{dst\_\-port}}\item[{\em +\hypertarget{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640abc4f89a184ada44073bd6f54d7fc11c9}{ +dst\_\-port} +\label{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640abc4f89a184ada44073bd6f54d7fc11c9} +}]\index{CLUSTER\_\-TYPES@{CLUSTER\_\-TYPES}!spp\_\-ai.h@{spp\_\-ai.h}}\index{spp\_\-ai.h@{spp\_\-ai.h}!CLUSTER\_\-TYPES@{CLUSTER\_\-TYPES}}\item[{\em +\hypertarget{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640ab16bb5c4b330d5db02e2d852cd2ba451}{ +CLUSTER\_\-TYPES} +\label{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640ab16bb5c4b330d5db02e2d852cd2ba451} +}]\end{description} +\end{Desc} + \subsection{Function Documentation} +\hypertarget{spp__ai_8h_a842a3204c6e067a9920990b573757181}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!AI\_\-alertparser\_\-thread@{AI\_\-alertparser\_\-thread}} +\index{AI\_\-alertparser\_\-thread@{AI\_\-alertparser\_\-thread}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{AI\_\-alertparser\_\-thread}]{\setlength{\rightskip}{0pt plus 5cm}void$\ast$ AI\_\-alertparser\_\-thread ( +\begin{DoxyParamCaption} +\item[{void $\ast$}]{ arg} +\end{DoxyParamCaption} +)}} +\label{spp__ai_8h_a842a3204c6e067a9920990b573757181} + + +Thread for parsing Snort's alert file. + +FUNCTION: AI\_\-alertparser\_\-thread +\begin{DoxyParams}{Parameters} +\item[{\em arg}]void$\ast$ pointer to module's configuration \end{DoxyParams} +\hypertarget{spp__ai_8h_a270e86669a0aa64a8da37bc16cda645b}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!AI\_\-free\_\-alerts@{AI\_\-free\_\-alerts}} +\index{AI\_\-free\_\-alerts@{AI\_\-free\_\-alerts}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{AI\_\-free\_\-alerts}]{\setlength{\rightskip}{0pt plus 5cm}void AI\_\-free\_\-alerts ( +\begin{DoxyParamCaption} +\item[{{\bf AI\_\-snort\_\-alert} $\ast$}]{ node} +\end{DoxyParamCaption} +)}} +\label{spp__ai_8h_a270e86669a0aa64a8da37bc16cda645b} + + +Deallocate the memory of a log alert linked list. + +FUNCTION: AI\_\-free\_\-alerts +\begin{DoxyParams}{Parameters} +\item[{\em node}]Linked list to be freed \end{DoxyParams} +\hypertarget{spp__ai_8h_af19a28f7cbcdfeb2b66fb3b625b75076}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!AI\_\-get\_\-alerts@{AI\_\-get\_\-alerts}} +\index{AI\_\-get\_\-alerts@{AI\_\-get\_\-alerts}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{AI\_\-get\_\-alerts}]{\setlength{\rightskip}{0pt plus 5cm}{\bf AI\_\-snort\_\-alert}$\ast$ AI\_\-get\_\-alerts ( +\begin{DoxyParamCaption} +\item[{void}]{} +\end{DoxyParamCaption} +)}} +\label{spp__ai_8h_af19a28f7cbcdfeb2b66fb3b625b75076} + + +Return the alerts parsed so far as a linked list. + +FUNCTION: AI\_\-get\_\-alerts \begin{DoxyReturn}{Returns} +An AI\_\-snort\_\-alert pointer identifying the list of alerts +\end{DoxyReturn} +\hypertarget{spp__ai_8h_a3054f06297a9caefd4d9b1283bb8b69a}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!AI\_\-get\_\-stream\_\-by\_\-key@{AI\_\-get\_\-stream\_\-by\_\-key}} +\index{AI\_\-get\_\-stream\_\-by\_\-key@{AI\_\-get\_\-stream\_\-by\_\-key}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{AI\_\-get\_\-stream\_\-by\_\-key}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf pkt\_\-info}$\ast$ AI\_\-get\_\-stream\_\-by\_\-key ( +\begin{DoxyParamCaption} +\item[{struct {\bf pkt\_\-key}}]{ key} +\end{DoxyParamCaption} +)\hspace{0.3cm}{\ttfamily \mbox{[}read\mbox{]}}}} +\label{spp__ai_8h_a3054f06297a9caefd4d9b1283bb8b69a} + + +Get a TCP stream by key. + +FUNCTION: AI\_\-get\_\-stream\_\-by\_\-key +\begin{DoxyParams}{Parameters} +\item[{\em key}]Key of the stream to be picked up (struct \hyperlink{structpkt__key}{pkt\_\-key}) \end{DoxyParams} +\begin{DoxyReturn}{Returns} +A \hyperlink{structpkt__info}{pkt\_\-info} pointer to the stream if found, NULL otherwise +\end{DoxyReturn} \hypertarget{spp__ai_8h_ad56f71be823eead743972274b99c82ff}{ \index{spp\_\-ai.h@{spp\_\-ai.h}!AI\_\-hashcleanup\_\-thread@{AI\_\-hashcleanup\_\-thread}} \index{AI\_\-hashcleanup\_\-thread@{AI\_\-hashcleanup\_\-thread}!spp_ai.h@{spp\_\-ai.h}} @@ -89,7 +292,25 @@ Thread called for cleaning up the hash table from the traffic streams older than FUNCTION: AI\_\-hashcleanup\_\-thread \begin{DoxyParams}{Parameters} -\item[{\em arg}]Pointer to the AI\_\-config struct \end{DoxyParams} +\item[{\em arg}]Pointer to the \hyperlink{structAI__config}{AI\_\-config} struct \end{DoxyParams} +\hypertarget{spp__ai_8h_a857348424b9db45c90f95631eb96fd7c}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!AI\_\-hierarchies\_\-build@{AI\_\-hierarchies\_\-build}} +\index{AI\_\-hierarchies\_\-build@{AI\_\-hierarchies\_\-build}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{AI\_\-hierarchies\_\-build}]{\setlength{\rightskip}{0pt plus 5cm}void AI\_\-hierarchies\_\-build ( +\begin{DoxyParamCaption} +\item[{{\bf AI\_\-config} $\ast$}]{ conf, } +\item[{{\bf hierarchy\_\-node} $\ast$$\ast$}]{ nodes, } +\item[{int}]{ n\_\-nodes} +\end{DoxyParamCaption} +)}} +\label{spp__ai_8h_a857348424b9db45c90f95631eb96fd7c} + + +Build the clustering hierarchy trees. + +FUNCTION: AI\_\-hierarchies\_\-build +\begin{DoxyParams}{Parameters} +\item[{\em conf}]Reference to the configuration of the module \item[{\em nodes}]Nodes containing the information about the clustering ranges \item[{\em n\_\-nodes}]Number of nodes \end{DoxyParams} \hypertarget{spp__ai_8h_af6f7d167c3623bbc669e8d31c2719b29}{ \index{spp\_\-ai.h@{spp\_\-ai.h}!AI\_\-pkt\_\-enqueue@{AI\_\-pkt\_\-enqueue}} \index{AI\_\-pkt\_\-enqueue@{AI\_\-pkt\_\-enqueue}!spp_ai.h@{spp\_\-ai.h}} @@ -106,3 +327,49 @@ Function called for appending a new packet to the hash table, creating a new str FUNCTION: AI\_\-pkt\_\-enqueue \begin{DoxyParams}{Parameters} \item[{\em pkt}]Packet to be appended \end{DoxyParams} +\hypertarget{spp__ai_8h_a8749989cee2ac05a7de058faac280c02}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!AI\_\-set\_\-stream\_\-observed@{AI\_\-set\_\-stream\_\-observed}} +\index{AI\_\-set\_\-stream\_\-observed@{AI\_\-set\_\-stream\_\-observed}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{AI\_\-set\_\-stream\_\-observed}]{\setlength{\rightskip}{0pt plus 5cm}void AI\_\-set\_\-stream\_\-observed ( +\begin{DoxyParamCaption} +\item[{struct {\bf pkt\_\-key}}]{ key} +\end{DoxyParamCaption} +)}} +\label{spp__ai_8h_a8749989cee2ac05a7de058faac280c02} + + +Set the flag \char`\"{}observed\char`\"{} on a stream associated to a security alert, so that it won't be removed from the hash table. + +FUNCTION: AI\_\-set\_\-stream\_\-observed +\begin{DoxyParams}{Parameters} +\item[{\em key}]Key of the stream to be set as \char`\"{}observed\char`\"{} \end{DoxyParams} +\hypertarget{spp__ai_8h_a85c0852b05b60cbfe0130534160c9876}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!preg\_\-match@{preg\_\-match}} +\index{preg\_\-match@{preg\_\-match}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{preg\_\-match}]{\setlength{\rightskip}{0pt plus 5cm}int preg\_\-match ( +\begin{DoxyParamCaption} +\item[{const char $\ast$}]{ expr, } +\item[{char $\ast$}]{ str, } +\item[{char $\ast$$\ast$$\ast$}]{ matches, } +\item[{int $\ast$}]{ nmatches} +\end{DoxyParamCaption} +)}} +\label{spp__ai_8h_a85c0852b05b60cbfe0130534160c9876} + + +Check if a string matches a regular expression. + +FUNCTION: preg\_\-match +\begin{DoxyParams}{Parameters} +\item[{\em expr}]Regular expression to be matched \item[{\em str}]String to be checked \item[{\em matches}]Reference to a char$\ast$$\ast$ that will contain the submatches (NULL if you don't need it) \item[{\em nmatches}]Reference to a int containing the number of submatches found (NULL if you don't need it) \end{DoxyParams} +\begin{DoxyReturn}{Returns} +-\/1 if the regex is wrong, 0 if no match was found, 1 otherwise +\end{DoxyReturn} + + +\subsection{Variable Documentation} +\hypertarget{spp__ai_8h_ab46420126c43c1aac5eabc5db266a71c}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!\_\-dpd@{\_\-dpd}} +\index{\_\-dpd@{\_\-dpd}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{\_\-dpd}]{\setlength{\rightskip}{0pt plus 5cm}DynamicPreprocessorData {\bf \_\-dpd}}} +\label{spp__ai_8h_ab46420126c43c1aac5eabc5db266a71c} diff --git a/doc/latex/stream_8c.tex b/doc/latex/stream_8c.tex index eeb2e72..d2d4947 100644 --- a/doc/latex/stream_8c.tex +++ b/doc/latex/stream_8c.tex @@ -3,46 +3,42 @@ \label{stream_8c}\index{stream.c@{stream.c}} } {\ttfamily \#include \char`\"{}spp\_\-ai.h\char`\"{}}\par -{\ttfamily \#include \char`\"{}uthash.h\char`\"{}}\par {\ttfamily \#include $<$stdio.h$>$}\par {\ttfamily \#include $<$stdlib.h$>$}\par -{\ttfamily \#include $<$string.h$>$}\par {\ttfamily \#include $<$time.h$>$}\par {\ttfamily \#include $<$unistd.h$>$}\par -{\ttfamily \#include $<$arpa/inet.h$>$}\par -\subsection*{Data Structures} -\begin{DoxyCompactItemize} -\item -struct \hyperlink{structpkt__key}{pkt\_\-key} -\item -struct \hyperlink{structpkt__info}{pkt\_\-info} -\end{DoxyCompactItemize} \subsection*{Functions} \begin{DoxyCompactItemize} \item -static void \hyperlink{stream_8c_a2a0c295a6828df716311977538cabd4a}{\_\-AI\_\-stream\_\-free} (struct \hyperlink{structpkt__info}{pkt\_\-info} $\ast$stream) +PRIVATE void \hyperlink{stream_8c_a80016adf701c717a6ebfb5b15b8a5749}{\_\-AI\_\-stream\_\-free} (struct \hyperlink{structpkt__info}{pkt\_\-info} $\ast$stream) \begin{DoxyCompactList}\small\item\em Remove a stream from the hash table (private function). \item\end{DoxyCompactList}\item void $\ast$ \hyperlink{stream_8c_a24b1131374e5059564b8a12380c4eb75}{AI\_\-hashcleanup\_\-thread} (void $\ast$arg) \begin{DoxyCompactList}\small\item\em Thread called for cleaning up the hash table from the traffic streams older than a certain threshold. \item\end{DoxyCompactList}\item void \hyperlink{stream_8c_a7d71c5645b9baff7b6c4b9a181bf80c5}{AI\_\-pkt\_\-enqueue} (SFSnortPacket $\ast$pkt) -\begin{DoxyCompactList}\small\item\em Function called for appending a new packet to the hash table, creating a new stream or appending it to an existing stream. \item\end{DoxyCompactList}\end{DoxyCompactItemize} +\begin{DoxyCompactList}\small\item\em Function called for appending a new packet to the hash table, creating a new stream or appending it to an existing stream. \item\end{DoxyCompactList}\item +struct \hyperlink{structpkt__info}{pkt\_\-info} $\ast$ \hyperlink{stream_8c_a2efedcabbfd12c5345f0c93a3dd4735c}{AI\_\-get\_\-stream\_\-by\_\-key} (struct \hyperlink{structpkt__key}{pkt\_\-key} key) +\begin{DoxyCompactList}\small\item\em Get a TCP stream by key. \item\end{DoxyCompactList}\item +void \hyperlink{stream_8c_a8749989cee2ac05a7de058faac280c02}{AI\_\-set\_\-stream\_\-observed} (struct \hyperlink{structpkt__key}{pkt\_\-key} key) +\begin{DoxyCompactList}\small\item\em Set the flag \char`\"{}observed\char`\"{} on a stream associated to a security alert, so that it won't be removed from the hash table. \item\end{DoxyCompactList}\end{DoxyCompactItemize} \subsection*{Variables} \begin{DoxyCompactItemize} \item -static struct \hyperlink{structpkt__info}{pkt\_\-info} $\ast$ \hyperlink{stream_8c_a96fbc549c67e0d852ced3cb72980e923}{hash} = NULL +PRIVATE struct \hyperlink{structpkt__info}{pkt\_\-info} $\ast$ \hyperlink{stream_8c_a57e23cda853e9d11c37723a962ef2f68}{hash} = NULL +\item +PRIVATE time\_\-t \hyperlink{stream_8c_a0597864b078ff448f28432db86950309}{start\_\-time} = 0 \end{DoxyCompactItemize} \subsection{Function Documentation} -\hypertarget{stream_8c_a2a0c295a6828df716311977538cabd4a}{ +\hypertarget{stream_8c_a80016adf701c717a6ebfb5b15b8a5749}{ \index{stream.c@{stream.c}!\_\-AI\_\-stream\_\-free@{\_\-AI\_\-stream\_\-free}} \index{\_\-AI\_\-stream\_\-free@{\_\-AI\_\-stream\_\-free}!stream.c@{stream.c}} -\subsubsection[{\_\-AI\_\-stream\_\-free}]{\setlength{\rightskip}{0pt plus 5cm}static void \_\-AI\_\-stream\_\-free ( +\subsubsection[{\_\-AI\_\-stream\_\-free}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE void \_\-AI\_\-stream\_\-free ( \begin{DoxyParamCaption} \item[{struct {\bf pkt\_\-info} $\ast$}]{ stream} \end{DoxyParamCaption} -)\hspace{0.3cm}{\ttfamily \mbox{[}static\mbox{]}}}} -\label{stream_8c_a2a0c295a6828df716311977538cabd4a} +)}} +\label{stream_8c_a80016adf701c717a6ebfb5b15b8a5749} Remove a stream from the hash table (private function). @@ -50,6 +46,25 @@ Remove a stream from the hash table (private function). FUNCTION: \_\-AI\_\-stream\_\-free \begin{DoxyParams}{Parameters} \item[{\em stream}]Stream to be removed \end{DoxyParams} +\hypertarget{stream_8c_a2efedcabbfd12c5345f0c93a3dd4735c}{ +\index{stream.c@{stream.c}!AI\_\-get\_\-stream\_\-by\_\-key@{AI\_\-get\_\-stream\_\-by\_\-key}} +\index{AI\_\-get\_\-stream\_\-by\_\-key@{AI\_\-get\_\-stream\_\-by\_\-key}!stream.c@{stream.c}} +\subsubsection[{AI\_\-get\_\-stream\_\-by\_\-key}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf pkt\_\-info}$\ast$ AI\_\-get\_\-stream\_\-by\_\-key ( +\begin{DoxyParamCaption} +\item[{struct {\bf pkt\_\-key}}]{ key} +\end{DoxyParamCaption} +)\hspace{0.3cm}{\ttfamily \mbox{[}read\mbox{]}}}} +\label{stream_8c_a2efedcabbfd12c5345f0c93a3dd4735c} + + +Get a TCP stream by key. + +FUNCTION: AI\_\-get\_\-stream\_\-by\_\-key +\begin{DoxyParams}{Parameters} +\item[{\em key}]Key of the stream to be picked up (struct \hyperlink{structpkt__key}{pkt\_\-key}) \end{DoxyParams} +\begin{DoxyReturn}{Returns} +A \hyperlink{structpkt__info}{pkt\_\-info} pointer to the stream if found, NULL otherwise +\end{DoxyReturn} \hypertarget{stream_8c_a24b1131374e5059564b8a12380c4eb75}{ \index{stream.c@{stream.c}!AI\_\-hashcleanup\_\-thread@{AI\_\-hashcleanup\_\-thread}} \index{AI\_\-hashcleanup\_\-thread@{AI\_\-hashcleanup\_\-thread}!stream.c@{stream.c}} @@ -65,7 +80,7 @@ Thread called for cleaning up the hash table from the traffic streams older than FUNCTION: AI\_\-hashcleanup\_\-thread \begin{DoxyParams}{Parameters} -\item[{\em arg}]Pointer to the AI\_\-config struct \end{DoxyParams} +\item[{\em arg}]Pointer to the \hyperlink{structAI__config}{AI\_\-config} struct \end{DoxyParams} \hypertarget{stream_8c_a7d71c5645b9baff7b6c4b9a181bf80c5}{ \index{stream.c@{stream.c}!AI\_\-pkt\_\-enqueue@{AI\_\-pkt\_\-enqueue}} \index{AI\_\-pkt\_\-enqueue@{AI\_\-pkt\_\-enqueue}!stream.c@{stream.c}} @@ -82,11 +97,32 @@ Function called for appending a new packet to the hash table, creating a new str FUNCTION: AI\_\-pkt\_\-enqueue \begin{DoxyParams}{Parameters} \item[{\em pkt}]Packet to be appended \end{DoxyParams} +\hypertarget{stream_8c_a8749989cee2ac05a7de058faac280c02}{ +\index{stream.c@{stream.c}!AI\_\-set\_\-stream\_\-observed@{AI\_\-set\_\-stream\_\-observed}} +\index{AI\_\-set\_\-stream\_\-observed@{AI\_\-set\_\-stream\_\-observed}!stream.c@{stream.c}} +\subsubsection[{AI\_\-set\_\-stream\_\-observed}]{\setlength{\rightskip}{0pt plus 5cm}void AI\_\-set\_\-stream\_\-observed ( +\begin{DoxyParamCaption} +\item[{struct {\bf pkt\_\-key}}]{ key} +\end{DoxyParamCaption} +)}} +\label{stream_8c_a8749989cee2ac05a7de058faac280c02} + + +Set the flag \char`\"{}observed\char`\"{} on a stream associated to a security alert, so that it won't be removed from the hash table. + +FUNCTION: AI\_\-set\_\-stream\_\-observed +\begin{DoxyParams}{Parameters} +\item[{\em key}]Key of the stream to be set as \char`\"{}observed\char`\"{} \end{DoxyParams} \subsection{Variable Documentation} -\hypertarget{stream_8c_a96fbc549c67e0d852ced3cb72980e923}{ +\hypertarget{stream_8c_a57e23cda853e9d11c37723a962ef2f68}{ \index{stream.c@{stream.c}!hash@{hash}} \index{hash@{hash}!stream.c@{stream.c}} -\subsubsection[{hash}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf pkt\_\-info}$\ast$ {\bf hash} = NULL\hspace{0.3cm}{\ttfamily \mbox{[}static\mbox{]}}}} -\label{stream_8c_a96fbc549c67e0d852ced3cb72980e923} +\subsubsection[{hash}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE struct {\bf pkt\_\-info}$\ast$ {\bf hash} = NULL}} +\label{stream_8c_a57e23cda853e9d11c37723a962ef2f68} +\hypertarget{stream_8c_a0597864b078ff448f28432db86950309}{ +\index{stream.c@{stream.c}!start\_\-time@{start\_\-time}} +\index{start\_\-time@{start\_\-time}!stream.c@{stream.c}} +\subsubsection[{start\_\-time}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE time\_\-t {\bf start\_\-time} = 0}} +\label{stream_8c_a0597864b078ff448f28432db86950309} diff --git a/doc/latex/structAI__config.tex b/doc/latex/structAI__config.tex new file mode 100644 index 0000000..d7dead8 --- /dev/null +++ b/doc/latex/structAI__config.tex @@ -0,0 +1,54 @@ +\hypertarget{structAI__config}{ +\section{AI\_\-config Struct Reference} +\label{structAI__config}\index{AI\_\-config@{AI\_\-config}} +} + + +{\ttfamily \#include $<$spp\_\-ai.h$>$} + +\subsection*{Data Fields} +\begin{DoxyCompactItemize} +\item +unsigned long \hyperlink{structAI__config_a9f7680615027d4fb74b4aa144a7028a4}{hashCleanupInterval} +\item +unsigned long \hyperlink{structAI__config_abbe77d5f94b8c5164bea47acba09c98b}{streamExpireInterval} +\item +unsigned long \hyperlink{structAI__config_a7d0d098b8263aa3d8415b11d1ec7f93d}{alertClusteringInterval} +\item +char \hyperlink{structAI__config_a2efa9590d7eea6dce8b5dd9aa76ed8ca}{alertfile} \mbox{[}1024\mbox{]} +\item +char \hyperlink{structAI__config_a6da02a3f7116fd3810a41b738e8883a3}{clusterfile} \mbox{[}1024\mbox{]} +\end{DoxyCompactItemize} + + +\subsection{Field Documentation} +\hypertarget{structAI__config_a7d0d098b8263aa3d8415b11d1ec7f93d}{ +\index{AI\_\-config@{AI\_\-config}!alertClusteringInterval@{alertClusteringInterval}} +\index{alertClusteringInterval@{alertClusteringInterval}!AI_config@{AI\_\-config}} +\subsubsection[{alertClusteringInterval}]{\setlength{\rightskip}{0pt plus 5cm}unsigned long {\bf AI\_\-config::alertClusteringInterval}}} +\label{structAI__config_a7d0d098b8263aa3d8415b11d1ec7f93d} +\hypertarget{structAI__config_a2efa9590d7eea6dce8b5dd9aa76ed8ca}{ +\index{AI\_\-config@{AI\_\-config}!alertfile@{alertfile}} +\index{alertfile@{alertfile}!AI_config@{AI\_\-config}} +\subsubsection[{alertfile}]{\setlength{\rightskip}{0pt plus 5cm}char {\bf AI\_\-config::alertfile}\mbox{[}1024\mbox{]}}} +\label{structAI__config_a2efa9590d7eea6dce8b5dd9aa76ed8ca} +\hypertarget{structAI__config_a6da02a3f7116fd3810a41b738e8883a3}{ +\index{AI\_\-config@{AI\_\-config}!clusterfile@{clusterfile}} +\index{clusterfile@{clusterfile}!AI_config@{AI\_\-config}} +\subsubsection[{clusterfile}]{\setlength{\rightskip}{0pt plus 5cm}char {\bf AI\_\-config::clusterfile}\mbox{[}1024\mbox{]}}} +\label{structAI__config_a6da02a3f7116fd3810a41b738e8883a3} +\hypertarget{structAI__config_a9f7680615027d4fb74b4aa144a7028a4}{ +\index{AI\_\-config@{AI\_\-config}!hashCleanupInterval@{hashCleanupInterval}} +\index{hashCleanupInterval@{hashCleanupInterval}!AI_config@{AI\_\-config}} +\subsubsection[{hashCleanupInterval}]{\setlength{\rightskip}{0pt plus 5cm}unsigned long {\bf AI\_\-config::hashCleanupInterval}}} +\label{structAI__config_a9f7680615027d4fb74b4aa144a7028a4} +\hypertarget{structAI__config_abbe77d5f94b8c5164bea47acba09c98b}{ +\index{AI\_\-config@{AI\_\-config}!streamExpireInterval@{streamExpireInterval}} +\index{streamExpireInterval@{streamExpireInterval}!AI_config@{AI\_\-config}} +\subsubsection[{streamExpireInterval}]{\setlength{\rightskip}{0pt plus 5cm}unsigned long {\bf AI\_\-config::streamExpireInterval}}} +\label{structAI__config_abbe77d5f94b8c5164bea47acba09c98b} + + +The documentation for this struct was generated from the following file:\begin{DoxyCompactItemize} +\item +\hyperlink{spp__ai_8h}{spp\_\-ai.h}\end{DoxyCompactItemize} diff --git a/doc/latex/struct__AI__snort__alert.tex b/doc/latex/struct__AI__snort__alert.tex new file mode 100644 index 0000000..9aba4dc --- /dev/null +++ b/doc/latex/struct__AI__snort__alert.tex @@ -0,0 +1,194 @@ +\hypertarget{struct__AI__snort__alert}{ +\section{\_\-AI\_\-snort\_\-alert Struct Reference} +\label{struct__AI__snort__alert}\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}} +} + + +{\ttfamily \#include $<$spp\_\-ai.h$>$} + +\subsection*{Data Fields} +\begin{DoxyCompactItemize} +\item +unsigned int \hyperlink{struct__AI__snort__alert_af8408be5da59cda853442dd13465c0f6}{gid} +\item +unsigned int \hyperlink{struct__AI__snort__alert_a3349aa68d2234f8ffd897367c3a8a137}{sid} +\item +unsigned int \hyperlink{struct__AI__snort__alert_a864d3baa48586d6a31639f4cd27d9d37}{rev} +\item +unsigned short \hyperlink{struct__AI__snort__alert_a25661fa4e212c5e30af5e6a892985ec9}{priority} +\item +char $\ast$ \hyperlink{struct__AI__snort__alert_ac0902d7c756ec675fb06347ce4706135}{desc} +\item +char $\ast$ \hyperlink{struct__AI__snort__alert_aa89585e14acb2c4e684a1552d322632f}{classification} +\item +time\_\-t \hyperlink{struct__AI__snort__alert_a10a67f60ca3da339a2104849a0b2ac19}{timestamp} +\item +\hyperlink{spp__ai_8h_aba7bc1797add20fe3efdf37ced1182c5}{uint8\_\-t} \hyperlink{struct__AI__snort__alert_a882ae6db43dc0fe08071947ccb044b93}{tos} +\item +\hyperlink{spp__ai_8h_a273cf69d639a59973b6019625df33e30}{uint16\_\-t} \hyperlink{struct__AI__snort__alert_a523ef8842d01a1bc4ea3c0bf27518e78}{iplen} +\item +\hyperlink{spp__ai_8h_a273cf69d639a59973b6019625df33e30}{uint16\_\-t} \hyperlink{struct__AI__snort__alert_a45e4acf90450a5f9efd4e0c290f84bcf}{id} +\item +\hyperlink{spp__ai_8h_aba7bc1797add20fe3efdf37ced1182c5}{uint8\_\-t} \hyperlink{struct__AI__snort__alert_ab9b1ce8ee440a324af116403ac9c51a2}{ttl} +\item +\hyperlink{spp__ai_8h_aba7bc1797add20fe3efdf37ced1182c5}{uint8\_\-t} \hyperlink{struct__AI__snort__alert_a2a5f2741918c3c13890f2b617a7f23a4}{ipproto} +\item +\hyperlink{spp__ai_8h_a435d1572bf3f880d55459d9805097f62}{uint32\_\-t} \hyperlink{struct__AI__snort__alert_ab16a24f368020e4b40e65b53cae33b48}{src\_\-addr} +\item +\hyperlink{spp__ai_8h_a435d1572bf3f880d55459d9805097f62}{uint32\_\-t} \hyperlink{struct__AI__snort__alert_a69cc2ba171c8c808a0b45caa9426cd8c}{dst\_\-addr} +\item +\hyperlink{spp__ai_8h_a273cf69d639a59973b6019625df33e30}{uint16\_\-t} \hyperlink{struct__AI__snort__alert_a856cccd3eaabd38aa9974f26d3edc5e3}{src\_\-port} +\item +\hyperlink{spp__ai_8h_a273cf69d639a59973b6019625df33e30}{uint16\_\-t} \hyperlink{struct__AI__snort__alert_a6b323c07ae501d221e330e13646a96a3}{dst\_\-port} +\item +\hyperlink{spp__ai_8h_a435d1572bf3f880d55459d9805097f62}{uint32\_\-t} \hyperlink{struct__AI__snort__alert_acb20c4c55149d5806d7523720786ab77}{sequence} +\item +\hyperlink{spp__ai_8h_a435d1572bf3f880d55459d9805097f62}{uint32\_\-t} \hyperlink{struct__AI__snort__alert_a2b185c678d3a7f1207b2119b0b567c37}{ack} +\item +\hyperlink{spp__ai_8h_aba7bc1797add20fe3efdf37ced1182c5}{uint8\_\-t} \hyperlink{struct__AI__snort__alert_aa643f11db93b70242b57f0a04775e507}{tcp\_\-flags} +\item +\hyperlink{spp__ai_8h_a273cf69d639a59973b6019625df33e30}{uint16\_\-t} \hyperlink{struct__AI__snort__alert_a63e94be3d248cf4beb0d4d5ab75331b1}{window} +\item +\hyperlink{spp__ai_8h_a273cf69d639a59973b6019625df33e30}{uint16\_\-t} \hyperlink{struct__AI__snort__alert_a519a103f5e8f1cb006c0c137b7c6a1c0}{tcplen} +\item +struct \hyperlink{structpkt__info}{pkt\_\-info} $\ast$ \hyperlink{struct__AI__snort__alert_a09dfe0a841fd3912ec78060d4547cb31}{stream} +\item +struct \hyperlink{struct__AI__snort__alert}{\_\-AI\_\-snort\_\-alert} $\ast$ \hyperlink{struct__AI__snort__alert_aa8336d4b3359015ed8ea312ca1fd1173}{next} +\item +\hyperlink{struct__hierarchy__node}{hierarchy\_\-node} $\ast$ \hyperlink{struct__AI__snort__alert_ac53765584296ead1328eabfaba8a3aed}{h\_\-node} \mbox{[}CLUSTER\_\-TYPES\mbox{]} +\item +unsigned int \hyperlink{struct__AI__snort__alert_a285aff12d6bac03c316ccc5305d28e53}{grouped\_\-alarms\_\-count} +\end{DoxyCompactItemize} + + +\subsection{Field Documentation} +\hypertarget{struct__AI__snort__alert_a2b185c678d3a7f1207b2119b0b567c37}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!ack@{ack}} +\index{ack@{ack}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{ack}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint32\_\-t} {\bf \_\-AI\_\-snort\_\-alert::ack}}} +\label{struct__AI__snort__alert_a2b185c678d3a7f1207b2119b0b567c37} +\hypertarget{struct__AI__snort__alert_aa89585e14acb2c4e684a1552d322632f}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!classification@{classification}} +\index{classification@{classification}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{classification}]{\setlength{\rightskip}{0pt plus 5cm}char$\ast$ {\bf \_\-AI\_\-snort\_\-alert::classification}}} +\label{struct__AI__snort__alert_aa89585e14acb2c4e684a1552d322632f} +\hypertarget{struct__AI__snort__alert_ac0902d7c756ec675fb06347ce4706135}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!desc@{desc}} +\index{desc@{desc}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{desc}]{\setlength{\rightskip}{0pt plus 5cm}char$\ast$ {\bf \_\-AI\_\-snort\_\-alert::desc}}} +\label{struct__AI__snort__alert_ac0902d7c756ec675fb06347ce4706135} +\hypertarget{struct__AI__snort__alert_a69cc2ba171c8c808a0b45caa9426cd8c}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!dst\_\-addr@{dst\_\-addr}} +\index{dst\_\-addr@{dst\_\-addr}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{dst\_\-addr}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint32\_\-t} {\bf \_\-AI\_\-snort\_\-alert::dst\_\-addr}}} +\label{struct__AI__snort__alert_a69cc2ba171c8c808a0b45caa9426cd8c} +\hypertarget{struct__AI__snort__alert_a6b323c07ae501d221e330e13646a96a3}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!dst\_\-port@{dst\_\-port}} +\index{dst\_\-port@{dst\_\-port}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{dst\_\-port}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint16\_\-t} {\bf \_\-AI\_\-snort\_\-alert::dst\_\-port}}} +\label{struct__AI__snort__alert_a6b323c07ae501d221e330e13646a96a3} +\hypertarget{struct__AI__snort__alert_af8408be5da59cda853442dd13465c0f6}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!gid@{gid}} +\index{gid@{gid}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{gid}]{\setlength{\rightskip}{0pt plus 5cm}unsigned int {\bf \_\-AI\_\-snort\_\-alert::gid}}} +\label{struct__AI__snort__alert_af8408be5da59cda853442dd13465c0f6} +\hypertarget{struct__AI__snort__alert_a285aff12d6bac03c316ccc5305d28e53}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!grouped\_\-alarms\_\-count@{grouped\_\-alarms\_\-count}} +\index{grouped\_\-alarms\_\-count@{grouped\_\-alarms\_\-count}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{grouped\_\-alarms\_\-count}]{\setlength{\rightskip}{0pt plus 5cm}unsigned int {\bf \_\-AI\_\-snort\_\-alert::grouped\_\-alarms\_\-count}}} +\label{struct__AI__snort__alert_a285aff12d6bac03c316ccc5305d28e53} +\hypertarget{struct__AI__snort__alert_ac53765584296ead1328eabfaba8a3aed}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!h\_\-node@{h\_\-node}} +\index{h\_\-node@{h\_\-node}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{h\_\-node}]{\setlength{\rightskip}{0pt plus 5cm}{\bf hierarchy\_\-node}$\ast$ {\bf \_\-AI\_\-snort\_\-alert::h\_\-node}\mbox{[}CLUSTER\_\-TYPES\mbox{]}}} +\label{struct__AI__snort__alert_ac53765584296ead1328eabfaba8a3aed} +\hypertarget{struct__AI__snort__alert_a45e4acf90450a5f9efd4e0c290f84bcf}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!id@{id}} +\index{id@{id}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{id}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint16\_\-t} {\bf \_\-AI\_\-snort\_\-alert::id}}} +\label{struct__AI__snort__alert_a45e4acf90450a5f9efd4e0c290f84bcf} +\hypertarget{struct__AI__snort__alert_a523ef8842d01a1bc4ea3c0bf27518e78}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!iplen@{iplen}} +\index{iplen@{iplen}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{iplen}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint16\_\-t} {\bf \_\-AI\_\-snort\_\-alert::iplen}}} +\label{struct__AI__snort__alert_a523ef8842d01a1bc4ea3c0bf27518e78} +\hypertarget{struct__AI__snort__alert_a2a5f2741918c3c13890f2b617a7f23a4}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!ipproto@{ipproto}} +\index{ipproto@{ipproto}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{ipproto}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint8\_\-t} {\bf \_\-AI\_\-snort\_\-alert::ipproto}}} +\label{struct__AI__snort__alert_a2a5f2741918c3c13890f2b617a7f23a4} +\hypertarget{struct__AI__snort__alert_aa8336d4b3359015ed8ea312ca1fd1173}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!next@{next}} +\index{next@{next}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{next}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf \_\-AI\_\-snort\_\-alert}$\ast$ {\bf \_\-AI\_\-snort\_\-alert::next}}} +\label{struct__AI__snort__alert_aa8336d4b3359015ed8ea312ca1fd1173} +\hypertarget{struct__AI__snort__alert_a25661fa4e212c5e30af5e6a892985ec9}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!priority@{priority}} +\index{priority@{priority}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{priority}]{\setlength{\rightskip}{0pt plus 5cm}unsigned short {\bf \_\-AI\_\-snort\_\-alert::priority}}} +\label{struct__AI__snort__alert_a25661fa4e212c5e30af5e6a892985ec9} +\hypertarget{struct__AI__snort__alert_a864d3baa48586d6a31639f4cd27d9d37}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!rev@{rev}} +\index{rev@{rev}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{rev}]{\setlength{\rightskip}{0pt plus 5cm}unsigned int {\bf \_\-AI\_\-snort\_\-alert::rev}}} +\label{struct__AI__snort__alert_a864d3baa48586d6a31639f4cd27d9d37} +\hypertarget{struct__AI__snort__alert_acb20c4c55149d5806d7523720786ab77}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!sequence@{sequence}} +\index{sequence@{sequence}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{sequence}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint32\_\-t} {\bf \_\-AI\_\-snort\_\-alert::sequence}}} +\label{struct__AI__snort__alert_acb20c4c55149d5806d7523720786ab77} +\hypertarget{struct__AI__snort__alert_a3349aa68d2234f8ffd897367c3a8a137}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!sid@{sid}} +\index{sid@{sid}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{sid}]{\setlength{\rightskip}{0pt plus 5cm}unsigned int {\bf \_\-AI\_\-snort\_\-alert::sid}}} +\label{struct__AI__snort__alert_a3349aa68d2234f8ffd897367c3a8a137} +\hypertarget{struct__AI__snort__alert_ab16a24f368020e4b40e65b53cae33b48}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!src\_\-addr@{src\_\-addr}} +\index{src\_\-addr@{src\_\-addr}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{src\_\-addr}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint32\_\-t} {\bf \_\-AI\_\-snort\_\-alert::src\_\-addr}}} +\label{struct__AI__snort__alert_ab16a24f368020e4b40e65b53cae33b48} +\hypertarget{struct__AI__snort__alert_a856cccd3eaabd38aa9974f26d3edc5e3}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!src\_\-port@{src\_\-port}} +\index{src\_\-port@{src\_\-port}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{src\_\-port}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint16\_\-t} {\bf \_\-AI\_\-snort\_\-alert::src\_\-port}}} +\label{struct__AI__snort__alert_a856cccd3eaabd38aa9974f26d3edc5e3} +\hypertarget{struct__AI__snort__alert_a09dfe0a841fd3912ec78060d4547cb31}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!stream@{stream}} +\index{stream@{stream}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{stream}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf pkt\_\-info}$\ast$ {\bf \_\-AI\_\-snort\_\-alert::stream}}} +\label{struct__AI__snort__alert_a09dfe0a841fd3912ec78060d4547cb31} +\hypertarget{struct__AI__snort__alert_aa643f11db93b70242b57f0a04775e507}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!tcp\_\-flags@{tcp\_\-flags}} +\index{tcp\_\-flags@{tcp\_\-flags}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{tcp\_\-flags}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint8\_\-t} {\bf \_\-AI\_\-snort\_\-alert::tcp\_\-flags}}} +\label{struct__AI__snort__alert_aa643f11db93b70242b57f0a04775e507} +\hypertarget{struct__AI__snort__alert_a519a103f5e8f1cb006c0c137b7c6a1c0}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!tcplen@{tcplen}} +\index{tcplen@{tcplen}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{tcplen}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint16\_\-t} {\bf \_\-AI\_\-snort\_\-alert::tcplen}}} +\label{struct__AI__snort__alert_a519a103f5e8f1cb006c0c137b7c6a1c0} +\hypertarget{struct__AI__snort__alert_a10a67f60ca3da339a2104849a0b2ac19}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!timestamp@{timestamp}} +\index{timestamp@{timestamp}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{timestamp}]{\setlength{\rightskip}{0pt plus 5cm}time\_\-t {\bf \_\-AI\_\-snort\_\-alert::timestamp}}} +\label{struct__AI__snort__alert_a10a67f60ca3da339a2104849a0b2ac19} +\hypertarget{struct__AI__snort__alert_a882ae6db43dc0fe08071947ccb044b93}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!tos@{tos}} +\index{tos@{tos}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{tos}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint8\_\-t} {\bf \_\-AI\_\-snort\_\-alert::tos}}} +\label{struct__AI__snort__alert_a882ae6db43dc0fe08071947ccb044b93} +\hypertarget{struct__AI__snort__alert_ab9b1ce8ee440a324af116403ac9c51a2}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!ttl@{ttl}} +\index{ttl@{ttl}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{ttl}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint8\_\-t} {\bf \_\-AI\_\-snort\_\-alert::ttl}}} +\label{struct__AI__snort__alert_ab9b1ce8ee440a324af116403ac9c51a2} +\hypertarget{struct__AI__snort__alert_a63e94be3d248cf4beb0d4d5ab75331b1}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!window@{window}} +\index{window@{window}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{window}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint16\_\-t} {\bf \_\-AI\_\-snort\_\-alert::window}}} +\label{struct__AI__snort__alert_a63e94be3d248cf4beb0d4d5ab75331b1} + + +The documentation for this struct was generated from the following file:\begin{DoxyCompactItemize} +\item +\hyperlink{spp__ai_8h}{spp\_\-ai.h}\end{DoxyCompactItemize} diff --git a/doc/latex/struct__hierarchy__node.tex b/doc/latex/struct__hierarchy__node.tex new file mode 100644 index 0000000..d49d5b3 --- /dev/null +++ b/doc/latex/struct__hierarchy__node.tex @@ -0,0 +1,68 @@ +\hypertarget{struct__hierarchy__node}{ +\section{\_\-hierarchy\_\-node Struct Reference} +\label{struct__hierarchy__node}\index{\_\-hierarchy\_\-node@{\_\-hierarchy\_\-node}} +} + + +{\ttfamily \#include $<$spp\_\-ai.h$>$} + +\subsection*{Data Fields} +\begin{DoxyCompactItemize} +\item +\hyperlink{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640}{cluster\_\-type} \hyperlink{struct__hierarchy__node_a3b18e3ddfa2212c5e4ff9c0b4bde4296}{type} +\item +char \hyperlink{struct__hierarchy__node_ae498f6fd14ca058a3ae0a95d5425451a}{label} \mbox{[}256\mbox{]} +\item +int \hyperlink{struct__hierarchy__node_a13ceebd7b435b9ef347fb90d9e6bbfe4}{min\_\-val} +\item +int \hyperlink{struct__hierarchy__node_a79ea88029938dc30ab8f159405d12c87}{max\_\-val} +\item +int \hyperlink{struct__hierarchy__node_a849256ce1039e2cefaaf64d91171be0a}{nchildren} +\item +struct \hyperlink{struct__hierarchy__node}{\_\-hierarchy\_\-node} $\ast$ \hyperlink{struct__hierarchy__node_a5c94c89d7e2aea393f1c550afb766bbe}{parent} +\item +struct \hyperlink{struct__hierarchy__node}{\_\-hierarchy\_\-node} $\ast$$\ast$ \hyperlink{struct__hierarchy__node_afc23d4fe6426873164cdaab2f3d4f0cd}{children} +\end{DoxyCompactItemize} + + +\subsection{Field Documentation} +\hypertarget{struct__hierarchy__node_afc23d4fe6426873164cdaab2f3d4f0cd}{ +\index{\_\-hierarchy\_\-node@{\_\-hierarchy\_\-node}!children@{children}} +\index{children@{children}!_hierarchy_node@{\_\-hierarchy\_\-node}} +\subsubsection[{children}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf \_\-hierarchy\_\-node}$\ast$$\ast$ {\bf \_\-hierarchy\_\-node::children}}} +\label{struct__hierarchy__node_afc23d4fe6426873164cdaab2f3d4f0cd} +\hypertarget{struct__hierarchy__node_ae498f6fd14ca058a3ae0a95d5425451a}{ +\index{\_\-hierarchy\_\-node@{\_\-hierarchy\_\-node}!label@{label}} +\index{label@{label}!_hierarchy_node@{\_\-hierarchy\_\-node}} +\subsubsection[{label}]{\setlength{\rightskip}{0pt plus 5cm}char {\bf \_\-hierarchy\_\-node::label}\mbox{[}256\mbox{]}}} +\label{struct__hierarchy__node_ae498f6fd14ca058a3ae0a95d5425451a} +\hypertarget{struct__hierarchy__node_a79ea88029938dc30ab8f159405d12c87}{ +\index{\_\-hierarchy\_\-node@{\_\-hierarchy\_\-node}!max\_\-val@{max\_\-val}} +\index{max\_\-val@{max\_\-val}!_hierarchy_node@{\_\-hierarchy\_\-node}} +\subsubsection[{max\_\-val}]{\setlength{\rightskip}{0pt plus 5cm}int {\bf \_\-hierarchy\_\-node::max\_\-val}}} +\label{struct__hierarchy__node_a79ea88029938dc30ab8f159405d12c87} +\hypertarget{struct__hierarchy__node_a13ceebd7b435b9ef347fb90d9e6bbfe4}{ +\index{\_\-hierarchy\_\-node@{\_\-hierarchy\_\-node}!min\_\-val@{min\_\-val}} +\index{min\_\-val@{min\_\-val}!_hierarchy_node@{\_\-hierarchy\_\-node}} +\subsubsection[{min\_\-val}]{\setlength{\rightskip}{0pt plus 5cm}int {\bf \_\-hierarchy\_\-node::min\_\-val}}} +\label{struct__hierarchy__node_a13ceebd7b435b9ef347fb90d9e6bbfe4} +\hypertarget{struct__hierarchy__node_a849256ce1039e2cefaaf64d91171be0a}{ +\index{\_\-hierarchy\_\-node@{\_\-hierarchy\_\-node}!nchildren@{nchildren}} +\index{nchildren@{nchildren}!_hierarchy_node@{\_\-hierarchy\_\-node}} +\subsubsection[{nchildren}]{\setlength{\rightskip}{0pt plus 5cm}int {\bf \_\-hierarchy\_\-node::nchildren}}} +\label{struct__hierarchy__node_a849256ce1039e2cefaaf64d91171be0a} +\hypertarget{struct__hierarchy__node_a5c94c89d7e2aea393f1c550afb766bbe}{ +\index{\_\-hierarchy\_\-node@{\_\-hierarchy\_\-node}!parent@{parent}} +\index{parent@{parent}!_hierarchy_node@{\_\-hierarchy\_\-node}} +\subsubsection[{parent}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf \_\-hierarchy\_\-node}$\ast$ {\bf \_\-hierarchy\_\-node::parent}}} +\label{struct__hierarchy__node_a5c94c89d7e2aea393f1c550afb766bbe} +\hypertarget{struct__hierarchy__node_a3b18e3ddfa2212c5e4ff9c0b4bde4296}{ +\index{\_\-hierarchy\_\-node@{\_\-hierarchy\_\-node}!type@{type}} +\index{type@{type}!_hierarchy_node@{\_\-hierarchy\_\-node}} +\subsubsection[{type}]{\setlength{\rightskip}{0pt plus 5cm}{\bf cluster\_\-type} {\bf \_\-hierarchy\_\-node::type}}} +\label{struct__hierarchy__node_a3b18e3ddfa2212c5e4ff9c0b4bde4296} + + +The documentation for this struct was generated from the following file:\begin{DoxyCompactItemize} +\item +\hyperlink{spp__ai_8h}{spp\_\-ai.h}\end{DoxyCompactItemize} diff --git a/doc/latex/structattribute__key.tex b/doc/latex/structattribute__key.tex new file mode 100644 index 0000000..94a2bac --- /dev/null +++ b/doc/latex/structattribute__key.tex @@ -0,0 +1,29 @@ +\hypertarget{structattribute__key}{ +\section{attribute\_\-key Struct Reference} +\label{structattribute__key}\index{attribute\_\-key@{attribute\_\-key}} +} +\subsection*{Data Fields} +\begin{DoxyCompactItemize} +\item +int \hyperlink{structattribute__key_a4fdb3d7aabeac6b1052b59e05e3d8842}{min} +\item +int \hyperlink{structattribute__key_a82b7e5ac49820b816871a4ddf30c462d}{max} +\end{DoxyCompactItemize} + + +\subsection{Field Documentation} +\hypertarget{structattribute__key_a82b7e5ac49820b816871a4ddf30c462d}{ +\index{attribute\_\-key@{attribute\_\-key}!max@{max}} +\index{max@{max}!attribute_key@{attribute\_\-key}} +\subsubsection[{max}]{\setlength{\rightskip}{0pt plus 5cm}int {\bf attribute\_\-key::max}}} +\label{structattribute__key_a82b7e5ac49820b816871a4ddf30c462d} +\hypertarget{structattribute__key_a4fdb3d7aabeac6b1052b59e05e3d8842}{ +\index{attribute\_\-key@{attribute\_\-key}!min@{min}} +\index{min@{min}!attribute_key@{attribute\_\-key}} +\subsubsection[{min}]{\setlength{\rightskip}{0pt plus 5cm}int {\bf attribute\_\-key::min}}} +\label{structattribute__key_a4fdb3d7aabeac6b1052b59e05e3d8842} + + +The documentation for this struct was generated from the following file:\begin{DoxyCompactItemize} +\item +\hyperlink{cluster_8c}{cluster.c}\end{DoxyCompactItemize} diff --git a/doc/latex/structattribute__value.tex b/doc/latex/structattribute__value.tex new file mode 100644 index 0000000..35b6929 --- /dev/null +++ b/doc/latex/structattribute__value.tex @@ -0,0 +1,43 @@ +\hypertarget{structattribute__value}{ +\section{attribute\_\-value Struct Reference} +\label{structattribute__value}\index{attribute\_\-value@{attribute\_\-value}} +} +\subsection*{Data Fields} +\begin{DoxyCompactItemize} +\item +\hyperlink{structattribute__key}{attribute\_\-key} \hyperlink{structattribute__value_aa8b5ae41c150e4fefb800d3b1924278d}{key} +\item +\hyperlink{spp__ai_8h_ae2ff3c6586aa2ab211a102abfde86640}{cluster\_\-type} \hyperlink{structattribute__value_a5322c4edde771a7ee0d9fc5f5e45484c}{type} +\item +unsigned int \hyperlink{structattribute__value_a5579c0304c2e9ab488ac94905b385045}{count} +\item +UT\_\-hash\_\-handle \hyperlink{structattribute__value_a9abf5d1758ee0cc4803e3b40fc4481cc}{hh} +\end{DoxyCompactItemize} + + +\subsection{Field Documentation} +\hypertarget{structattribute__value_a5579c0304c2e9ab488ac94905b385045}{ +\index{attribute\_\-value@{attribute\_\-value}!count@{count}} +\index{count@{count}!attribute_value@{attribute\_\-value}} +\subsubsection[{count}]{\setlength{\rightskip}{0pt plus 5cm}unsigned int {\bf attribute\_\-value::count}}} +\label{structattribute__value_a5579c0304c2e9ab488ac94905b385045} +\hypertarget{structattribute__value_a9abf5d1758ee0cc4803e3b40fc4481cc}{ +\index{attribute\_\-value@{attribute\_\-value}!hh@{hh}} +\index{hh@{hh}!attribute_value@{attribute\_\-value}} +\subsubsection[{hh}]{\setlength{\rightskip}{0pt plus 5cm}UT\_\-hash\_\-handle {\bf attribute\_\-value::hh}}} +\label{structattribute__value_a9abf5d1758ee0cc4803e3b40fc4481cc} +\hypertarget{structattribute__value_aa8b5ae41c150e4fefb800d3b1924278d}{ +\index{attribute\_\-value@{attribute\_\-value}!key@{key}} +\index{key@{key}!attribute_value@{attribute\_\-value}} +\subsubsection[{key}]{\setlength{\rightskip}{0pt plus 5cm}{\bf attribute\_\-key} {\bf attribute\_\-value::key}}} +\label{structattribute__value_aa8b5ae41c150e4fefb800d3b1924278d} +\hypertarget{structattribute__value_a5322c4edde771a7ee0d9fc5f5e45484c}{ +\index{attribute\_\-value@{attribute\_\-value}!type@{type}} +\index{type@{type}!attribute_value@{attribute\_\-value}} +\subsubsection[{type}]{\setlength{\rightskip}{0pt plus 5cm}{\bf cluster\_\-type} {\bf attribute\_\-value::type}}} +\label{structattribute__value_a5322c4edde771a7ee0d9fc5f5e45484c} + + +The documentation for this struct was generated from the following file:\begin{DoxyCompactItemize} +\item +\hyperlink{cluster_8c}{cluster.c}\end{DoxyCompactItemize} diff --git a/doc/latex/structpkt__info.tex b/doc/latex/structpkt__info.tex index 668d3cb..ab65ae8 100644 --- a/doc/latex/structpkt__info.tex +++ b/doc/latex/structpkt__info.tex @@ -2,6 +2,10 @@ \section{pkt\_\-info Struct Reference} \label{structpkt__info}\index{pkt\_\-info@{pkt\_\-info}} } + + +{\ttfamily \#include $<$spp\_\-ai.h$>$} + \subsection*{Data Fields} \begin{DoxyCompactItemize} \item @@ -13,6 +17,8 @@ SFSnortPacket $\ast$ \hyperlink{structpkt__info_a8d5ebd04a32067b05387e5c5056fe16 \item struct \hyperlink{structpkt__info}{pkt\_\-info} $\ast$ \hyperlink{structpkt__info_a5ee3c51f2ca5768b94819182641ef168}{next} \item +\hyperlink{spp__ai_8h_a3e5b8192e7d9ffaf3542f1210aec18dd}{BOOL} \hyperlink{structpkt__info_ac7ff78ea5faf333fc91f92e3085ea7c9}{observed} +\item UT\_\-hash\_\-handle \hyperlink{structpkt__info_a264e90d4b5d490de040f38c1072e142f}{hh} \end{DoxyCompactItemize} @@ -33,6 +39,11 @@ UT\_\-hash\_\-handle \hyperlink{structpkt__info_a264e90d4b5d490de040f38c1072e142 \index{next@{next}!pkt_info@{pkt\_\-info}} \subsubsection[{next}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf pkt\_\-info}$\ast$ {\bf pkt\_\-info::next}}} \label{structpkt__info_a5ee3c51f2ca5768b94819182641ef168} +\hypertarget{structpkt__info_ac7ff78ea5faf333fc91f92e3085ea7c9}{ +\index{pkt\_\-info@{pkt\_\-info}!observed@{observed}} +\index{observed@{observed}!pkt_info@{pkt\_\-info}} +\subsubsection[{observed}]{\setlength{\rightskip}{0pt plus 5cm}{\bf BOOL} {\bf pkt\_\-info::observed}}} +\label{structpkt__info_ac7ff78ea5faf333fc91f92e3085ea7c9} \hypertarget{structpkt__info_a8d5ebd04a32067b05387e5c5056fe168}{ \index{pkt\_\-info@{pkt\_\-info}!pkt@{pkt}} \index{pkt@{pkt}!pkt_info@{pkt\_\-info}} @@ -47,4 +58,4 @@ UT\_\-hash\_\-handle \hyperlink{structpkt__info_a264e90d4b5d490de040f38c1072e142 The documentation for this struct was generated from the following file:\begin{DoxyCompactItemize} \item -\hyperlink{stream_8c}{stream.c}\end{DoxyCompactItemize} +\hyperlink{spp__ai_8h}{spp\_\-ai.h}\end{DoxyCompactItemize} diff --git a/doc/latex/structpkt__key.tex b/doc/latex/structpkt__key.tex index c0db4da..53a7baf 100644 --- a/doc/latex/structpkt__key.tex +++ b/doc/latex/structpkt__key.tex @@ -2,6 +2,10 @@ \section{pkt\_\-key Struct Reference} \label{structpkt__key}\index{pkt\_\-key@{pkt\_\-key}} } + + +{\ttfamily \#include $<$spp\_\-ai.h$>$} + \subsection*{Data Fields} \begin{DoxyCompactItemize} \item @@ -26,4 +30,4 @@ The documentation for this struct was generated from the following file:\begin{DoxyCompactItemize} \item -\hyperlink{stream_8c}{stream.c}\end{DoxyCompactItemize} +\hyperlink{spp__ai_8h}{spp\_\-ai.h}\end{DoxyCompactItemize} diff --git a/spp_ai.c b/spp_ai.c index 3a2cc5a..c712909 100644 --- a/spp_ai.c +++ b/spp_ai.c @@ -149,7 +149,8 @@ static AI_config * AI_parse(char *args) BOOL has_cleanup_interval = false, has_stream_expire_interval = false, has_alertfile = false, - has_clusterfile = false; + has_clusterfile = false, + has_clustering = false; AI_config *config = NULL; @@ -282,10 +283,8 @@ static AI_config * AI_parse(char *args) /* Parsing cluster options */ while ( preg_match ( "\\s*(cluster\\s*\\(\\s*)([^\\)]+)\\)", args, &matches, &nmatches ) > 0 ) { - if ( !has_clusterfile ) - { - _dpd.fatalMsg ( "AIPreproc: cluster option specified in configuration: '%s'\nBut no 'clusterfile' option was specified", matches[1] ); - } + if ( ! has_clustering ) + has_clustering = true; memset ( label, 0, sizeof(label) ); min_val = -1; @@ -312,8 +311,6 @@ static AI_config * AI_parse(char *args) type = src_addr; else if ( !strcasecmp ( matches[0], "dst_addr" )) type = dst_addr; - else if ( !strcasecmp ( matches[0], "time" )) - type = timestamp; else _dpd.fatalMsg ( "AIPreproc: Unknown class type in configuration: '%s'\n", matches[0] ); @@ -358,6 +355,11 @@ static AI_config * AI_parse(char *args) min_val = strtoul ( matches[0], NULL, 10 ); max_val = strtoul ( matches[1], NULL, 10 ); + if ( min_val > max_val ) + { + _dpd.fatalMsg ( "AIPreproc: Parse error in configuration: '%s', minval > maxval\n", arg ); + } + for ( i=0; i < nmatches; i++ ) free ( matches[i] ); @@ -497,29 +499,34 @@ static AI_config * AI_parse(char *args) if ( ! has_cleanup_interval ) { - config->hashCleanupInterval = 60; + config->hashCleanupInterval = DEFAULT_HASH_CLEANUP_INTERVAL; } if ( ! has_stream_expire_interval ) { - config->streamExpireInterval = 600; + config->streamExpireInterval = DEFAULT_STREAM_EXPIRE_INTERVAL; } if ( ! has_alertfile ) { - strcpy ( config->alertfile, "/var/log/snort/alert" ); + strncpy ( config->alertfile, DEFAULT_ALERT_LOG_FILE, sizeof ( config->alertfile )); } - if ( has_clusterfile ) + if ( has_clustering ) { if ( ! hierarchy_nodes ) { _dpd.fatalMsg ( "AIPreproc: cluster file specified in the configuration but no clusters were specified\n" ); } + if ( ! has_clusterfile ) + { + strncpy ( config->clusterfile, DEFAULT_CLUSTER_LOG_FILE, sizeof ( config->clusterfile )); + } + if ( ! alert_clustering_interval ) { - config->alertClusteringInterval = 600; + config->alertClusteringInterval = DEFAULT_ALERT_CLUSTERING_INTERVAL; } AI_hierarchies_build ( config, hierarchy_nodes, n_hierarchy_nodes ); diff --git a/spp_ai.h b/spp_ai.h index 416451e..075e47e 100644 --- a/spp_ai.h +++ b/spp_ai.h @@ -26,6 +26,12 @@ #define PRIVATE static +#define DEFAULT_HASH_CLEANUP_INTERVAL 300 +#define DEFAULT_STREAM_EXPIRE_INTERVAL 300 +#define DEFAULT_ALERT_CLUSTERING_INTERVAL 3600 +#define DEFAULT_ALERT_LOG_FILE "/var/log/snort/alert" +#define DEFAULT_CLUSTER_LOG_FILE "/var/log/snort/cluster_alert" + extern DynamicPreprocessorData _dpd; typedef unsigned char uint8_t; typedef unsigned short uint16_t; @@ -34,7 +40,7 @@ typedef unsigned int uint32_t; typedef enum { false, true } BOOL; typedef enum { - none, src_port, dst_port, src_addr, dst_addr, timestamp + none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES } cluster_type; /* Each stream in the hash table is identified by the couple (src_ip, dst_port) */ @@ -120,10 +126,7 @@ typedef struct _AI_snort_alert { /* Hierarchies for addresses and ports, * if the clustering algorithm is used */ - hierarchy_node *src_addr_node; - hierarchy_node *dst_addr_node; - hierarchy_node *src_port_node; - hierarchy_node *dst_port_node; + hierarchy_node *h_node[CLUSTER_TYPES]; /* If the clustering algorithm is used, * we also count how many alerts this @@ -139,8 +142,10 @@ void* AI_alertparser_thread ( void* ); void AI_pkt_enqueue ( SFSnortPacket* ); void AI_set_stream_observed ( struct pkt_key key ); void AI_hierarchies_build ( AI_config*, hierarchy_node**, int ); + struct pkt_info* AI_get_stream_by_key ( struct pkt_key ); AI_snort_alert* AI_get_alerts ( void ); +void AI_free_alerts ( AI_snort_alert *node ); #endif /* _SPP_AI_H */ diff --git a/tags b/tags index b4461c4..9ee1a01 100644 --- a/tags +++ b/tags @@ -7,6 +7,8 @@ AI_alertparser_thread alert_parser.c /^AI_alertparser_thread ( void* arg )$/;" f signature:( void* arg ) AI_alertparser_thread spp_ai.h /^void* AI_alertparser_thread ( void* );$/;" p signature:( void* ) AI_config spp_ai.h /^} AI_config;$/;" t typeref:struct:__anon3 +AI_free_alerts alert_parser.c /^AI_free_alerts ( AI_snort_alert *node )$/;" f signature:( AI_snort_alert *node ) +AI_free_alerts spp_ai.h /^void AI_free_alerts ( AI_snort_alert *node );$/;" p signature:( AI_snort_alert *node ) AI_get_alerts alert_parser.c /^AI_get_alerts ()$/;" f AI_get_alerts spp_ai.h /^AI_snort_alert* AI_get_alerts ( void );$/;" p signature:( void ) AI_get_stream_by_key spp_ai.h /^struct pkt_info* AI_get_stream_by_key ( struct pkt_key );$/;" p signature:( struct pkt_key ) @@ -45,12 +47,18 @@ CDL_PREPEND uthash/utlist.h 442;" d CDL_SEARCH uthash/utlist.h 482;" d CDL_SEARCH_SCALAR uthash/utlist.h 475;" d CDL_SORT uthash/utlist.h 214;" d +CLUSTER_TYPES spp_ai.h /^ none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES$/;" e enum:__anon2 CMDLINE Makefile /^CMDLINE=-g -O2 -fvisibility=hidden -fno-strict-aliasing -Wall -fstack-protector$/;" m DECLTYPE uthash/uthash.h 36;" d DECLTYPE uthash/uthash.h 39;" d DECLTYPE uthash/uthash.h 42;" d DECLTYPE_ASSIGN uthash/uthash.h 46;" d DECLTYPE_ASSIGN uthash/uthash.h 52;" d +DEFAULT_ALERT_CLUSTERING_INTERVAL spp_ai.h 31;" d +DEFAULT_ALERT_LOG_FILE spp_ai.h 32;" d +DEFAULT_CLUSTER_LOG_FILE spp_ai.h 33;" d +DEFAULT_HASH_CLEANUP_INTERVAL spp_ai.h 29;" d +DEFAULT_STREAM_EXPIRE_INTERVAL spp_ai.h 30;" d DEFINES Makefile /^DEFINES=-D_GNU_SOURCE -D_XOPEN_SOURCE -DDYNAMIC_PLUGIN -DSUP_IP6 -DENABLE_MYSQL -DHAVE_CONFIG_H$/;" m DL_APPEND uthash/utlist.h 396;" d DL_DELETE uthash/utlist.h 410;" d @@ -213,7 +221,7 @@ UTLIST_H uthash/utlist.h 25;" d UTLIST_VERSION uthash/utlist.h 27;" d UTSTRING_H uthash/utstring.h 28;" d UTSTRING_VERSION uthash/utstring.h 30;" d -UT_array uthash/utarray.h /^} UT_array;$/;" t typeref:struct:__anon6 +UT_array uthash/utarray.h /^} UT_array;$/;" t typeref:struct:__anon8 UT_hash_bucket uthash/uthash.h /^typedef struct UT_hash_bucket {$/;" s UT_hash_bucket uthash/uthash.h /^} UT_hash_bucket;$/;" t typeref:struct:UT_hash_bucket UT_hash_bucket::count uthash/uthash.h /^ unsigned count;$/;" m struct:UT_hash_bucket access:public @@ -245,20 +253,24 @@ UT_hash_table::num_buckets uthash/uthash.h /^ unsigned num_buckets, log2_num_b UT_hash_table::num_items uthash/uthash.h /^ unsigned num_items;$/;" m struct:UT_hash_table access:public UT_hash_table::signature uthash/uthash.h /^ uint32_t signature; \/* used only to find hash tables in external analysis *\/$/;" m struct:UT_hash_table access:public UT_hash_table::tail uthash/uthash.h /^ struct UT_hash_handle *tail; \/* tail hh in app order, for fast append *\/$/;" m struct:UT_hash_table typeref:struct:UT_hash_table::UT_hash_handle access:public -UT_icd uthash/utarray.h /^} UT_icd;$/;" t typeref:struct:__anon5 -UT_string uthash/utstring.h /^} UT_string;$/;" t typeref:struct:__anon4 +UT_icd uthash/utarray.h /^} UT_icd;$/;" t typeref:struct:__anon7 +UT_string uthash/utstring.h /^} UT_string;$/;" t typeref:struct:__anon6 _ AI _ config Struct Reference doc/latex/struct__AI__config.tex /^\\section{\\_\\-AI\\_\\-config Struct Reference}$/;" s _AI_cluster_thread cluster.c /^_AI_cluster_thread ( void* arg )$/;" f signature:( void* arg ) +_AI_copy_alerts alert_parser.c /^_AI_copy_alerts ( AI_snort_alert *node )$/;" f signature:( AI_snort_alert *node ) +_AI_equal_alarms cluster.c /^_AI_equal_alarms ( AI_snort_alert *a1, AI_snort_alert *a2 )$/;" f signature:( AI_snort_alert *a1, AI_snort_alert *a2 ) +_AI_get_min_hierarchy_node cluster.c /^_AI_get_min_hierarchy_node ( int val, hierarchy_node *root )$/;" f signature:( int val, hierarchy_node *root ) +_AI_merge_alerts cluster.c /^_AI_merge_alerts ( AI_snort_alert **log )$/;" f signature:( AI_snort_alert **log ) +_AI_print_clustered_alerts cluster.c /^_AI_print_clustered_alerts ( AI_snort_alert *log, FILE *fp )$/;" f signature:( AI_snort_alert *log, FILE *fp ) _AI_snort_alert spp_ai.h /^typedef struct _AI_snort_alert {$/;" s _AI_snort_alert::ack spp_ai.h /^ uint32_t ack;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::classification spp_ai.h /^ char *classification;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::desc spp_ai.h /^ char *desc;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::dst_addr spp_ai.h /^ uint32_t dst_addr;$/;" m struct:_AI_snort_alert access:public -_AI_snort_alert::dst_addr_node spp_ai.h /^ hierarchy_node *dst_addr_node;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::dst_port spp_ai.h /^ uint16_t dst_port;$/;" m struct:_AI_snort_alert access:public -_AI_snort_alert::dst_port_node spp_ai.h /^ hierarchy_node *dst_port_node;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::gid spp_ai.h /^ unsigned int gid;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::grouped_alarms_count spp_ai.h /^ unsigned int grouped_alarms_count;$/;" m struct:_AI_snort_alert access:public +_AI_snort_alert::h_node spp_ai.h /^ hierarchy_node *h_node[CLUSTER_TYPES];$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::id spp_ai.h /^ uint16_t id;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::iplen spp_ai.h /^ uint16_t iplen;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::ipproto spp_ai.h /^ uint8_t ipproto;$/;" m struct:_AI_snort_alert access:public @@ -268,9 +280,7 @@ _AI_snort_alert::rev spp_ai.h /^ unsigned int rev;$/;" m struct:_AI_snort_ale _AI_snort_alert::sequence spp_ai.h /^ uint32_t sequence;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::sid spp_ai.h /^ unsigned int sid;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::src_addr spp_ai.h /^ uint32_t src_addr;$/;" m struct:_AI_snort_alert access:public -_AI_snort_alert::src_addr_node spp_ai.h /^ hierarchy_node *src_addr_node;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::src_port spp_ai.h /^ uint16_t src_port;$/;" m struct:_AI_snort_alert access:public -_AI_snort_alert::src_port_node spp_ai.h /^ hierarchy_node *src_port_node;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::stream spp_ai.h /^ struct pkt_info *stream;$/;" m struct:_AI_snort_alert typeref:struct:_AI_snort_alert::pkt_info access:public _AI_snort_alert::tcp_flags spp_ai.h /^ uint8_t tcp_flags;$/;" m struct:_AI_snort_alert access:public _AI_snort_alert::tcplen spp_ai.h /^ uint16_t tcplen;$/;" m struct:_AI_snort_alert access:public @@ -305,20 +315,27 @@ __anon3::alertfile spp_ai.h /^ char alertfile[1024];$/;" m struct:__ano __anon3::clusterfile spp_ai.h /^ char clusterfile[1024];$/;" m struct:__anon3 access:public __anon3::hashCleanupInterval spp_ai.h /^ unsigned long hashCleanupInterval;$/;" m struct:__anon3 access:public __anon3::streamExpireInterval spp_ai.h /^ unsigned long streamExpireInterval;$/;" m struct:__anon3 access:public -__anon4::d uthash/utstring.h /^ char *d;$/;" m struct:__anon4 access:public -__anon4::i uthash/utstring.h /^ size_t i; \/* index of first unused byte *\/$/;" m struct:__anon4 access:public -__anon4::n uthash/utstring.h /^ size_t n; \/* allocd size *\/$/;" m struct:__anon4 access:public -__anon5::copy uthash/utarray.h /^ ctor_f *copy;$/;" m struct:__anon5 access:public -__anon5::dtor uthash/utarray.h /^ dtor_f *dtor;$/;" m struct:__anon5 access:public -__anon5::init uthash/utarray.h /^ init_f *init;$/;" m struct:__anon5 access:public -__anon5::sz uthash/utarray.h /^ size_t sz;$/;" m struct:__anon5 access:public -__anon6::d uthash/utarray.h /^ char *d; \/* n slots of size icd->sz*\/$/;" m struct:__anon6 access:public -__anon6::i uthash/utarray.h /^ unsigned i,n;\/* i: index of next available slot, n: num slots *\/$/;" m struct:__anon6 access:public -__anon6::icd uthash/utarray.h /^ const UT_icd *icd; \/* initializer, copy and destructor functions *\/$/;" m struct:__anon6 access:public -__anon6::n uthash/utarray.h /^ unsigned i,n;\/* i: index of next available slot, n: num slots *\/$/;" m struct:__anon6 access:public -_config cluster.c /^PRIVATE AI_config *_config = NULL;$/;" v +__anon4::max cluster.c /^ int max;$/;" m struct:__anon4 file: access:public +__anon4::min cluster.c /^ int min;$/;" m struct:__anon4 file: access:public +__anon5::count cluster.c /^ unsigned int count;$/;" m struct:__anon5 file: access:public +__anon5::hh cluster.c /^ UT_hash_handle hh;$/;" m struct:__anon5 file: access:public +__anon5::key cluster.c /^ attribute_key key;$/;" m struct:__anon5 file: access:public +__anon5::type cluster.c /^ cluster_type type;$/;" m struct:__anon5 file: access:public +__anon6::d uthash/utstring.h /^ char *d;$/;" m struct:__anon6 access:public +__anon6::i uthash/utstring.h /^ size_t i; \/* index of first unused byte *\/$/;" m struct:__anon6 access:public +__anon6::n uthash/utstring.h /^ size_t n; \/* allocd size *\/$/;" m struct:__anon6 access:public +__anon7::copy uthash/utarray.h /^ ctor_f *copy;$/;" m struct:__anon7 access:public +__anon7::dtor uthash/utarray.h /^ dtor_f *dtor;$/;" m struct:__anon7 access:public +__anon7::init uthash/utarray.h /^ init_f *init;$/;" m struct:__anon7 access:public +__anon7::sz uthash/utarray.h /^ size_t sz;$/;" m struct:__anon7 access:public +__anon8::d uthash/utarray.h /^ char *d; \/* n slots of size icd->sz*\/$/;" m struct:__anon8 access:public +__anon8::i uthash/utarray.h /^ unsigned i,n;\/* i: index of next available slot, n: num slots *\/$/;" m struct:__anon8 access:public +__anon8::icd uthash/utarray.h /^ const UT_icd *icd; \/* initializer, copy and destructor functions *\/$/;" m struct:__anon8 access:public +__anon8::n uthash/utarray.h /^ unsigned i,n;\/* i: index of next available slot, n: num slots *\/$/;" m struct:__anon8 access:public +_config cluster.c /^PRIVATE AI_config *_config = NULL;$/;" v _details doc/html/group__sfPolicyConfig.html /^<\/a>

    Detailed Description<\/h2>$/;" a _dpd sf_dynamic_preproc_lib.c /^DynamicPreprocessorData _dpd;$/;" v +_heuristic_func cluster.c /^_heuristic_func ( cluster_type type )$/;" f signature:( cluster_type type ) _hierarchy_node spp_ai.h /^typedef struct _hierarchy_node$/;" s _hierarchy_node::children spp_ai.h /^ struct _hierarchy_node **children;$/;" m struct:_hierarchy_node typeref:struct:_hierarchy_node::_hierarchy_node access:public _hierarchy_node::label spp_ai.h /^ char label[256];$/;" m struct:_hierarchy_node access:public @@ -333,9 +350,11 @@ _utarray_eltptr uthash/utarray.h 116;" d ack spp_ai.h /^ uint32_t ack;$/;" m struct:_AI_snort_alert access:public alertClusteringInterval spp_ai.h /^ unsigned long alertClusteringInterval;$/;" m struct:__anon3 access:public alert_fp alert_parser.c /^PRIVATE FILE *alert_fp = NULL;$/;" v -alert_log cluster.c /^PRIVATE AI_snort_alert *alert_log = NULL;$/;" v +alert_log cluster.c /^PRIVATE AI_snort_alert *alert_log = NULL;$/;" v alertfile spp_ai.h /^ char alertfile[1024];$/;" m struct:__anon3 access:public alerts alert_parser.c /^PRIVATE AI_snort_alert *alerts = NULL;$/;" v +attribute_key cluster.c /^} attribute_key;$/;" t typeref:struct:__anon4 file: +attribute_value cluster.c /^} attribute_value;$/;" t typeref:struct:__anon5 file: bloom_bv uthash/uthash.h /^ uint8_t *bloom_bv;$/;" m struct:UT_hash_table access:public bloom_nbits uthash/uthash.h /^ char bloom_nbits;$/;" m struct:UT_hash_table access:public bloom_sig uthash/uthash.h /^ uint32_t bloom_sig; \/* used only to test bloom exists in external analysis *\/$/;" m struct:UT_hash_table access:public @@ -345,25 +364,22 @@ classification spp_ai.h /^ char *classification;$/;" m struct:_AI_sno cluster_type spp_ai.h /^} cluster_type;$/;" t typeref:enum:__anon2 clusterfile spp_ai.h /^ char clusterfile[1024];$/;" m struct:__anon3 access:public convertToId doc/html/search/search.js /^function convertToId(search)$/;" f -copy uthash/utarray.h /^ ctor_f *copy;$/;" m struct:__anon5 access:public +copy uthash/utarray.h /^ ctor_f *copy;$/;" m struct:__anon7 access:public +count cluster.c /^ unsigned int count;$/;" m struct:__anon5 file: access:public count uthash/uthash.h /^ unsigned count;$/;" m struct:UT_hash_bucket access:public ctor_f uthash/utarray.h /^typedef void (ctor_f)(void *dst, const void *src);$/;" t -d uthash/utarray.h /^ char *d; \/* n slots of size icd->sz*\/$/;" m struct:__anon6 access:public -d uthash/utstring.h /^ char *d;$/;" m struct:__anon4 access:public +d uthash/utarray.h /^ char *d; \/* n slots of size icd->sz*\/$/;" m struct:__anon8 access:public +d uthash/utstring.h /^ char *d;$/;" m struct:__anon6 access:public define-members doc/html/sf__preproc__info_8h.html /^

    Data Fields

    uint32_t src_ip

    <\/a>$/;" a define-members doc/html/spp__ai_8c.html /^

    <\/a>$/;" a desc spp_ai.h /^ char *desc;$/;" m struct:_AI_snort_alert access:public dst _ port doc/latex/structpkt__key.tex /^\\subsubsection[{dst\\_\\-port}]{\\setlength{\\rightskip}{0pt plus 5cm}{\\bf uint16\\_\\-t} {\\bf pkt\\_\\-key::dst\\_\\-port}}}$/;" b -dst_addr spp_ai.h /^ none, src_port, dst_port, src_addr, dst_addr, timestamp$/;" e enum:__anon2 +dst_addr spp_ai.h /^ none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES$/;" e enum:__anon2 dst_addr spp_ai.h /^ uint32_t dst_addr;$/;" m struct:_AI_snort_alert access:public -dst_addr_node spp_ai.h /^ hierarchy_node *dst_addr_node;$/;" m struct:_AI_snort_alert access:public -dst_addr_root cluster.c /^PRIVATE hierarchy_node *dst_addr_root = NULL;$/;" v -dst_port spp_ai.h /^ none, src_port, dst_port, src_addr, dst_addr, timestamp$/;" e enum:__anon2 +dst_port spp_ai.h /^ none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES$/;" e enum:__anon2 dst_port spp_ai.h /^ uint16_t dst_port;$/;" m struct:_AI_snort_alert access:public dst_port spp_ai.h /^ uint16_t dst_port;$/;" m struct:pkt_key access:public -dst_port_node spp_ai.h /^ hierarchy_node *dst_port_node;$/;" m struct:_AI_snort_alert access:public -dst_port_root cluster.c /^PRIVATE hierarchy_node *dst_port_root = NULL;$/;" v -dtor uthash/utarray.h /^ dtor_f *dtor;$/;" m struct:__anon5 access:public +dtor uthash/utarray.h /^ dtor_f *dtor;$/;" m struct:__anon7 access:public dtor_f uthash/utarray.h /^typedef void (dtor_f)(void *elt);$/;" t enum-members doc/html/spp__ai_8h.html /^

    <\/a>$/;" a ex_config spp_ai.c /^tSfPolicyUserContextId ex_config = NULL;$/;" v @@ -443,10 +459,13 @@ getXPos doc/html/search/search.js /^function getXPos(item)$/;" f getYPos doc/html/search/search.js /^function getYPos(item)$/;" f gid spp_ai.h /^ unsigned int gid;$/;" m struct:_AI_snort_alert access:public grouped_alarms_count spp_ai.h /^ unsigned int grouped_alarms_count;$/;" m struct:_AI_snort_alert access:public +h_node spp_ai.h /^ hierarchy_node *h_node[CLUSTER_TYPES];$/;" m struct:_AI_snort_alert access:public +h_root cluster.c /^PRIVATE hierarchy_node *h_root[CLUSTER_TYPES] = { NULL };$/;" v hash stream.c /^PRIVATE struct pkt_info *hash = NULL;$/;" v typeref:struct:pkt_info hashCleanupInterval doc/latex/struct__AI__config.tex /^\\subsubsection[{hashCleanupInterval}]{\\setlength{\\rightskip}{0pt plus 5cm}unsigned long {\\bf \\_\\-AI\\_\\-config::hashCleanupInterval}}}$/;" b hashCleanupInterval spp_ai.h /^ unsigned long hashCleanupInterval;$/;" m struct:__anon3 access:public hashv uthash/uthash.h /^ unsigned hashv; \/* result of hash-fcn(key) *\/$/;" m struct:UT_hash_handle access:public +hh cluster.c /^ UT_hash_handle hh;$/;" m struct:__anon5 file: access:public hh doc/latex/structpkt__info.tex /^\\subsubsection[{hh}]{\\setlength{\\rightskip}{0pt plus 5cm}UT\\_\\-hash\\_\\-handle {\\bf pkt\\_\\-info::hh}}}$/;" b hh spp_ai.h /^ UT_hash_handle hh; \/* Make the struct 'hashable' *\/$/;" m struct:pkt_info access:public hh_head uthash/uthash.h /^ struct UT_hash_handle *hh_head;$/;" m struct:UT_hash_bucket typeref:struct:UT_hash_bucket::UT_hash_handle access:public @@ -454,9 +473,9 @@ hh_next uthash/uthash.h /^ struct UT_hash_handle *hh_next; \/* next hh in bu hh_prev uthash/uthash.h /^ struct UT_hash_handle *hh_prev; \/* previous hh in bucket order *\/$/;" m struct:UT_hash_handle typeref:struct:UT_hash_handle::UT_hash_handle access:public hho uthash/uthash.h /^ ptrdiff_t hho; \/* hash handle offset (byte pos of hash handle in element *\/$/;" m struct:UT_hash_table access:public hierarchy_node spp_ai.h /^} hierarchy_node;$/;" t typeref:struct:_hierarchy_node -i uthash/utarray.h /^ unsigned i,n;\/* i: index of next available slot, n: num slots *\/$/;" m struct:__anon6 access:public -i uthash/utstring.h /^ size_t i; \/* index of first unused byte *\/$/;" m struct:__anon4 access:public -icd uthash/utarray.h /^ const UT_icd *icd; \/* initializer, copy and destructor functions *\/$/;" m struct:__anon6 access:public +i uthash/utarray.h /^ unsigned i,n;\/* i: index of next available slot, n: num slots *\/$/;" m struct:__anon8 access:public +i uthash/utstring.h /^ size_t i; \/* index of first unused byte *\/$/;" m struct:__anon6 access:public +icd uthash/utarray.h /^ const UT_icd *icd; \/* initializer, copy and destructor functions *\/$/;" m struct:__anon8 access:public id spp_ai.h /^ uint16_t id;$/;" m struct:_AI_snort_alert access:public ideal_chain_maxlen uthash/uthash.h /^ unsigned ideal_chain_maxlen;$/;" m struct:UT_hash_table access:public indexSectionNames.0 doc/html/search/search.js /^ 0: "all",$/;" p @@ -478,10 +497,11 @@ indexSectionsWithContent.6 doc/html/search/search.js /^ 6: "0000000000000000000 indexSectionsWithContent.7 doc/html/search/search.js /^ 7: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",$/;" p indexSectionsWithContent.8 doc/html/search/search.js /^ 8: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010100100000100100100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"$/;" p ineff_expands uthash/uthash.h /^ unsigned ineff_expands, noexpand;$/;" m struct:UT_hash_table access:public -init uthash/utarray.h /^ init_f *init;$/;" m struct:__anon5 access:public +init uthash/utarray.h /^ init_f *init;$/;" m struct:__anon7 access:public init_f uthash/utarray.h /^typedef void (init_f)(void *elt);$/;" t iplen spp_ai.h /^ uint16_t iplen;$/;" m struct:_AI_snort_alert access:public ipproto spp_ai.h /^ uint8_t ipproto;$/;" m struct:_AI_snort_alert access:public +key cluster.c /^ attribute_key key;$/;" m struct:__anon5 file: access:public key doc/latex/structpkt__info.tex /^\\subsubsection[{key}]{\\setlength{\\rightskip}{0pt plus 5cm}struct {\\bf pkt\\_\\-key} {\\bf pkt\\_\\-info::key}}}$/;" b key spp_ai.h /^ struct pkt_key key; \/* Key of the packet (src_ip, dst_port) *\/$/;" m struct:pkt_info typeref:struct:pkt_info::pkt_key access:public key uthash/uthash.h /^ void *key; \/* ptr to enclosing struct's key *\/$/;" m struct:UT_hash_handle access:public @@ -546,10 +566,12 @@ latex_count doc/latex/Makefile /^ latex_count=5 ; \\$/;" m letter_P doc/html/classes.html /^

    <\/a>
      P  <\/div><\/td><\/tr><\/table>$/;" a letter__ doc/html/classes.html /^<\/td>
    		pkt_info<\/a>   <\/td>pkt_key<\/a>   <\/td><\/a>
      _  <\/div><\/td><\/tr><\/table>$/;" a log2_num_buckets uthash/uthash.h /^ unsigned num_buckets, log2_num_buckets;$/;" m struct:UT_hash_table access:public +max cluster.c /^ int max;$/;" m struct:__anon4 file: access:public max_val spp_ai.h /^ int max_val;$/;" m struct:_hierarchy_node access:public +min cluster.c /^ int min;$/;" m struct:__anon4 file: access:public min_val spp_ai.h /^ int min_val;$/;" m struct:_hierarchy_node access:public -n uthash/utarray.h /^ unsigned i,n;\/* i: index of next available slot, n: num slots *\/$/;" m struct:__anon6 access:public -n uthash/utstring.h /^ size_t n; \/* allocd size *\/$/;" m struct:__anon4 access:public +n uthash/utarray.h /^ unsigned i,n;\/* i: index of next available slot, n: num slots *\/$/;" m struct:__anon8 access:public +n uthash/utstring.h /^ size_t n; \/* allocd size *\/$/;" m struct:__anon6 access:public nchildren spp_ai.h /^ int nchildren;$/;" m struct:_hierarchy_node access:public nested-classes doc/html/spp__ai_8h.html /^

    <\/a>$/;" a nested-classes doc/html/stream_8c.html /^

    <\/a>$/;" a @@ -558,7 +580,7 @@ next spp_ai.h /^ struct _AI_snort_alert *next;$/;" m struct:_AI_snort_alert type next spp_ai.h /^ struct pkt_info* next; \/* Pointer to the next packet in the stream *\/$/;" m struct:pkt_info typeref:struct:pkt_info::pkt_info access:public next uthash/uthash.h /^ void *next; \/* next element in app order *\/$/;" m struct:UT_hash_handle access:public noexpand uthash/uthash.h /^ unsigned ineff_expands, noexpand;$/;" m struct:UT_hash_table access:public -none spp_ai.h /^ none, src_port, dst_port, src_addr, dst_addr, timestamp$/;" e enum:__anon2 +none spp_ai.h /^ none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES$/;" e enum:__anon2 nonideal_items uthash/uthash.h /^ unsigned nonideal_items;$/;" m struct:UT_hash_table access:public num_buckets uthash/uthash.h /^ unsigned num_buckets, log2_num_buckets;$/;" m struct:UT_hash_table access:public num_items uthash/uthash.h /^ unsigned num_items;$/;" m struct:UT_hash_table access:public @@ -610,32 +632,28 @@ signature uthash/uthash.h /^ uint32_t signature; \/* used only to find hash ta spp _ ai c File Reference doc/latex/spp__ai_8c.tex /^\\section{spp\\_\\-ai.c File Reference}$/;" s spp _ ai h File Reference doc/latex/spp__ai_8h.tex /^\\section{spp\\_\\-ai.h File Reference}$/;" s src _ ip doc/latex/structpkt__key.tex /^\\subsubsection[{src\\_\\-ip}]{\\setlength{\\rightskip}{0pt plus 5cm}{\\bf uint32\\_\\-t} {\\bf pkt\\_\\-key::src\\_\\-ip}}}$/;" b -src_addr spp_ai.h /^ none, src_port, dst_port, src_addr, dst_addr, timestamp$/;" e enum:__anon2 +src_addr spp_ai.h /^ none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES$/;" e enum:__anon2 src_addr spp_ai.h /^ uint32_t src_addr;$/;" m struct:_AI_snort_alert access:public -src_addr_node spp_ai.h /^ hierarchy_node *src_addr_node;$/;" m struct:_AI_snort_alert access:public -src_addr_root cluster.c /^PRIVATE hierarchy_node *src_addr_root = NULL;$/;" v src_ip spp_ai.h /^ uint32_t src_ip;$/;" m struct:pkt_key access:public -src_port spp_ai.h /^ none, src_port, dst_port, src_addr, dst_addr, timestamp$/;" e enum:__anon2 +src_port spp_ai.h /^ none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES$/;" e enum:__anon2 src_port spp_ai.h /^ uint16_t src_port;$/;" m struct:_AI_snort_alert access:public -src_port_node spp_ai.h /^ hierarchy_node *src_port_node;$/;" m struct:_AI_snort_alert access:public -src_port_root cluster.c /^PRIVATE hierarchy_node *src_port_root = NULL;$/;" v start_time stream.c /^PRIVATE time_t start_time = 0;$/;" v stream spp_ai.h /^ struct pkt_info *stream;$/;" m struct:_AI_snort_alert typeref:struct:_AI_snort_alert::pkt_info access:public stream c File Reference doc/latex/stream_8c.tex /^\\section{stream.c File Reference}$/;" s streamExpireInterval doc/latex/struct__AI__config.tex /^\\subsubsection[{streamExpireInterval}]{\\setlength{\\rightskip}{0pt plus 5cm}unsigned long {\\bf \\_\\-AI\\_\\-config::streamExpireInterval}}}$/;" b streamExpireInterval spp_ai.h /^ unsigned long streamExpireInterval;$/;" m struct:__anon3 access:public -sz uthash/utarray.h /^ size_t sz;$/;" m struct:__anon5 access:public +sz uthash/utarray.h /^ size_t sz;$/;" m struct:__anon7 access:public tail uthash/uthash.h /^ struct UT_hash_handle *tail; \/* tail hh in app order, for fast append *\/$/;" m struct:UT_hash_table typeref:struct:UT_hash_table::UT_hash_handle access:public tbl uthash/uthash.h /^ struct UT_hash_table *tbl;$/;" m struct:UT_hash_handle typeref:struct:UT_hash_handle::UT_hash_table access:public tcp_flags spp_ai.h /^ uint8_t tcp_flags;$/;" m struct:_AI_snort_alert access:public tcplen spp_ai.h /^ uint16_t tcplen;$/;" m struct:_AI_snort_alert access:public timestamp doc/latex/structpkt__info.tex /^\\subsubsection[{timestamp}]{\\setlength{\\rightskip}{0pt plus 5cm}time\\_\\-t {\\bf pkt\\_\\-info::timestamp}}}$/;" b -timestamp spp_ai.h /^ none, src_port, dst_port, src_addr, dst_addr, timestamp$/;" e enum:__anon2 timestamp spp_ai.h /^ time_t timestamp; \/* Timestamp *\/$/;" m struct:pkt_info access:public timestamp spp_ai.h /^ time_t timestamp;$/;" m struct:_AI_snort_alert access:public tos spp_ai.h /^ uint8_t tos;$/;" m struct:_AI_snort_alert access:public true spp_ai.h /^typedef enum { false, true } BOOL;$/;" e enum:__anon1 ttl spp_ai.h /^ uint8_t ttl;$/;" m struct:_AI_snort_alert access:public +type cluster.c /^ cluster_type type;$/;" m struct:__anon5 file: access:public type spp_ai.h /^ cluster_type type;$/;" m struct:_hierarchy_node access:public typedef-members doc/html/spp__ai_8h.html /^

    <\/a>$/;" a uint16_t spp_ai.h /^typedef unsigned short uint16_t;$/;" t