spp_ai.h

Go to the documentation of this file.

/*
 * =====================================================================================
 *
 *       Filename:  spp_ai.h
 *
 *    Description:  Header file for the preprocessor
 *
 *        Version:  1.0
 *        Created:  30/07/2010 15:47:12
 *       Revision:  none
 *       Compiler:  gcc
 *
 *         Author:  BlackLight (http://0x00.ath.cx), <blacklight@autistici.org>
 *        Licence:  GNU GPL v.3
 *        Company:  DO WHAT YOU WANT CAUSE A PIRATE IS FREE, YOU ARE A PIRATE!
 *
 * =====================================================================================
 */

#ifndef _SPP_AI_H
#define _SPP_AI_H

#ifdef  HAVE_CONFIG_H
#include        "config.h"
#endif

#include        "sf_snort_packet.h"
#include        "sf_dynamic_preprocessor.h"
#include        "uthash.h"

#define         PRIVATE                 static

#define         DEFAULT_HASH_CLEANUP_INTERVAL           300

#define         DEFAULT_STREAM_EXPIRE_INTERVAL          300

#define         DEFAULT_DATABASE_INTERVAL                       30

#define         DEFAULT_ALERT_CLUSTERING_INTERVAL               3600

#define         DEFAULT_ALERT_CORRELATION_INTERVAL      300

#define         DEFAULT_ALERT_LOG_FILE                          "/var/log/snort/alert"

#define         DEFAULT_CLUSTER_LOG_FILE                        "/var/log/snort/cluster_alert"

#define         DEFAULT_CORR_RULES_DIR                          "/etc/snort/corr_rules"

#define         DEFAULT_CORR_ALERTS_DIR                                 "/var/log/snort/correlated_alerts"

#define         DEFAULT_CORR_THRESHOLD                          0.5

extern DynamicPreprocessorData _dpd;
typedef unsigned char   uint8_t;
typedef unsigned short  uint16_t;
typedef unsigned int    uint32_t;

typedef enum { false, true } BOOL;

/*****************************************************************/
typedef enum {
        none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES
} cluster_type;
/*****************************************************************/
struct pkt_key
{
        uint32_t src_ip;
        uint16_t dst_port;
};
/*****************************************************************/
struct pkt_info
{
        struct pkt_key    key;

        time_t            timestamp;

        SFSnortPacket*    pkt;

        struct pkt_info*  next;

        BOOL              observed;

        UT_hash_handle    hh;
};
/*****************************************************************/
/* Data type containing the configuration of the module */
typedef struct
{
        unsigned long hashCleanupInterval;

        unsigned long streamExpireInterval;

        unsigned long alertClusteringInterval;

        unsigned long databaseParsingInterval;

        unsigned long correlationGraphInterval;

        double        correlationThresholdCoefficient;

        char          alertfile[1024];

        char          clusterfile[1024];

        char          corr_rules_dir[1024];

        char          corr_alerts_dir[1024];

        char          dbname[256];

        char          dbuser[256];

        char          dbpass[256];

        char          dbhost[256];
} AI_config;
/*****************************************************************/
typedef struct _hierarchy_node
{
        cluster_type            type;
        char                    label[256];
        int                     min_val;
        int                     max_val;
        int                     nchildren;
        struct _hierarchy_node  *parent;
        struct _hierarchy_node  **children;
} hierarchy_node;
/*****************************************************************/
typedef struct
{
        unsigned int gid;
        unsigned int sid;
        unsigned int rev;
} AI_hyperalert_key;
/*****************************************************************/
typedef struct
{
        AI_hyperalert_key  key;

        char               **preconds;

        unsigned int       n_preconds;

        char               **postconds;

        unsigned int       n_postconds;

        UT_hash_handle     hh;
} AI_hyperalert_info;
/*****************************************************************/
typedef struct _AI_snort_alert  {
        /* Identifiers of the alert */
        unsigned int    gid;
        unsigned int    sid;
        unsigned int    rev;

        /* Snort priority, description,
         * classification and timestamp
         * of the alert */
        unsigned short  priority;
        char            *desc;
        char            *classification;
        time_t          timestamp;

        /* IP header information */
        uint8_t         ip_tos;
        uint16_t        ip_len;
        uint16_t        ip_id;
        uint8_t         ip_ttl;
        uint8_t         ip_proto;
        uint32_t        ip_src_addr;
        uint32_t        ip_dst_addr;

        /* TCP header information */
        uint16_t        tcp_src_port;
        uint16_t        tcp_dst_port;
        uint32_t        tcp_seq;
        uint32_t        tcp_ack;
        uint8_t         tcp_flags;
        uint16_t        tcp_window;
        uint16_t        tcp_len;

        struct pkt_info *stream;

        struct _AI_snort_alert *next;

        hierarchy_node  *h_node[CLUSTER_TYPES];

        unsigned int    grouped_alarms_count;

        AI_hyperalert_info  *hyperalert;

        /* 'Parent' correlated alert in the chain,
         * if any*/
        struct _AI_snort_alert  *previous_correlated;

        struct _AI_snort_alert  **derived_alerts;

        unsigned int        n_derived_alerts;
} AI_snort_alert;
/*****************************************************************/

int                preg_match ( const char*, char*, char***, int* );
char*              str_replace ( char *str, char *orig, char *rep );
char*              str_replace_all ( char *str, char *orig, char *rep );

void*              AI_hashcleanup_thread ( void* );
void*              AI_file_alertparser_thread ( void* );
void*              AI_alert_correlation_thread ( void* );

#ifdef  HAVE_LIBMYSQLCLIENT
AI_snort_alert*    AI_db_get_alerts ( void );
void               AI_db_free_alerts ( AI_snort_alert *node );
void*              AI_db_alertparser_thread ( void* );
#endif

void               AI_pkt_enqueue ( SFSnortPacket* );
void               AI_set_stream_observed ( struct pkt_key key );
void               AI_hierarchies_build ( AI_config*, hierarchy_node**, int );
void               AI_free_alerts ( AI_snort_alert *node );

struct pkt_info*   AI_get_stream_by_key ( struct pkt_key );
AI_snort_alert*    AI_get_alerts ( void );
AI_snort_alert*    AI_get_clustered_alerts ( void );

AI_snort_alert* (*get_alerts)(void);

#endif  /* _SPP_AI_H */