网络入侵检测系统之 Suricata(八)--Option 实现详解

2022 年 9 月 17 日
江苏
本文字数：1024 字
阅读完需：约 3 分钟

本文详解介绍了 suricata oprion 相关的源码实现，并以 tcp.flags 与 threshold 关键字进行举例说明。

全局变量

sigmatch_tabletypedef struct SigTableElmt_ {/** Packet match function pointer */int (*Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *);/** InspectionBuffer transformation callback */void (*Transform)(InspectionBuffer *, void *context);bool (*TransformValidate)(const uint8_t *content, uint16_t content_len, void *context);
/** keyword setup function pointer */int (*Setup)(DetectEngineCtx *, Signature *, const char *);
void (*Free)(DetectEngineCtx *, void *);uint16_t flags;/* coccinelle: SigTableElmt:flags:SIGMATCH_ */
const char *name;     /**< keyword name alias */const char *alias;    /**< name alias */const char *desc;const char *url;} SigTableElmt;

复制代码

规则包含的 option 双向链表

enum DetectSigmatchListEnum {DETECT_SM_LIST_MATCH = 0,DETECT_SM_LIST_PMATCH,/* base64_data keyword uses some hardcoded logic so consider * built-in * TODO convert to inspect engine */DETECT_SM_LIST_BASE64_DATA,
/* list for post match actions: flowbit set, flowint increment, etc */DETECT_SM_LIST_POSTMATCH,
DETECT_SM_LIST_TMATCH, /**< post-detection tagging */
/* lists for alert thresholding and suppression */DETECT_SM_LIST_SUPPRESS,DETECT_SM_LIST_THRESHOLD,DETECT_SM_LIST_MAX,/* start of dynamically registered lists */DETECT_SM_LIST_DYNAMIC_START = DETECT_SM_LIST_MAX,};

复制代码

Option 通用流程

Tcp.Flags

规则举例：

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL SCAN nmap fingerprint attempt"; flags:SFPU; flow:stateless; reference:arachnids,05; classtype:attempted-recon; sid:2100629; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;)

复制代码

实现流程图：

Threshold

规则举例：

alert tcp $EXTERNAL_NET 10000: -> $HOME_NET 0:1023 (msg:"ET DOS Potential Tsunami SYN Flood Denial Of Service Attempt"; flags:S; flow:to_server; dsize:>900; threshold: type limit, count 20, seconds 120, track by_src; classtype:attempted-dos; sid:2019404; rev:3; metadata:created_at 2014_10_15, updated_at 2014_10_15;)

复制代码

实现流程图：