flowps.c File Reference

#include "flowps.h"
#include "scoreboard.h"
#include "unique_tracker.h"
#include "server_stats.h"
#include "packet_time.h"
#include "util_net.h"

Go to the source code of this file.

Defines
#define	TH_FIN   0x01
#define	TH_SYN   0x02
#define	TH_RST   0x04
#define	TH_PUSH   0x08
#define	TH_ACK   0x10
#define	TH_URG   0x20
#define	TH_RES2   0x40
#define	TH_RES1   0x80
#define	FLOWPS_NC   1000000
Functions
int	flowps_mkthreshold (SCORE_THRESHOLD *thr, int fixed_size, u_int32_t fixed_limit, int sliding_size, u_int32_t sliding_limit, float window_scale)
int	flowps_mkconfig (PS_CONFIG *configp, int sb_memcap_talker, int sb_rows_talker, int sb_memcap_scanner, int sb_rows_scanner, int ut_memcap, int ut_rows, int server_memcap, int server_rows, int server_learning_time, int tcp_penalties, u_int32_t server_ignore_limit, u_int32_t server_scanner_limit, int base_score, int alert_once, FLOWPS_OUTPUT output_mode)
int	flowps_server_stats_enabled (PS_TRACKER *trackerp)
int	flowps_server_watch (PS_TRACKER *trackerp, u_int32_t address)
int	flowps_init (PS_TRACKER *trackerp, PS_CONFIG *configp)
int	flowps_destroy (PS_TRACKER *trackerp)
static INLINE void	flowps_reset_alert_flags (u_int32_t type, u_int32_t *alert_flags, u_int32_t *score)
int	flowps_score_entry (PS_TRACKER *pstp, SCORE_ENTRY *sep, int score, TRACKER_POSITION tr_pos, int alert_once, u_int32_t *alert_flags)
int	flowps_find_entry (PS_TRACKER *trackerp, u_int32_t *address, SCORE_ENTRY **sepp)
int	flowps_add_entry (PS_TRACKER *trackerp, TRACKER_POSITION position, u_int32_t *address, SCORE_ENTRY **sepp)
int	flowps_score_print (PS_SCORE *ps_score)
int	flowps_entry_print (SCORE_ENTRY *entry, u_int32_t *address)
void	flowps_stats (PS_TRACKER *pstp)
static INLINE void	flowps_tcp_penalty (u_int32_t flags, int base_score, int *score)
int	flowps_get_score (PS_TRACKER *pstp, FLOW *flowp, time_t cur, u_int32_t flags, int *score, TRACKER_POSITION *type)
int	flowps_fixed_winadj (PS_SCORE *pscp, time_t current_time, SCORE_THRESHOLD *threshold)
int	flowps_sliding_winadj (PS_SCORE *pscp, time_t current_time, SCORE_THRESHOLD *threshold)
int	flowps_set_last_address (SCORE_ENTRY *sep, FLOW *flowp, u_int8_t cflags)
int	flowps_enabled (void)
int	flowps_is_ignored_ipv4 (PS_TRACKER *pstp, u_int32_t *sip, u_int32_t *dip)
Variables
static int	s_debug = 0
static int	s_enabled = 0

---

Define Documentation

#define FLOWPS_NC   1000000

Definition at line 30 of file flowps.c.

#define TH_ACK   0x10

Definition at line 22 of file flowps.c.

#define TH_FIN   0x01

Definition at line 18 of file flowps.c.

#define TH_PUSH   0x08

Definition at line 21 of file flowps.c.

#define TH_RES1   0x80

Definition at line 25 of file flowps.c.

#define TH_RES2   0x40

Definition at line 24 of file flowps.c.

#define TH_RST   0x04

Definition at line 20 of file flowps.c.

#define TH_SYN   0x02

Definition at line 19 of file flowps.c.

#define TH_URG   0x20

Definition at line 23 of file flowps.c.

---

Function Documentation

int flowps_add_entry (  PS_TRACKER *  trackerp, TRACKER_POSITION  position, u_int32_t *  address, SCORE_ENTRY **  sepp )

Register a new node in the portscan tracker. This does not enforce that a node can only be in one table at a time to avoid the 2 extra searching operations. All uses of this should be done after performing a find to make sure the trackers do not already exist. Parameters: trackerp  portscan tracker position  where to place this node address  the address for the key sepp  score entry return information Returns: FLOW_SUCCESS on success Return values: FLOW_ENULL  null arguments passed FLOW_SUCESS  sucessfull added FLOW_EINVALID  already in table FLOW_ENOMEM  out of memory Definition at line 426 of file flowps.c. References FLOW_SUCCESS, scoreboard_add(), _PS_TRACKER::table_active, _PS_TRACKER::table_scanner, and TRACKER_ACTIVE. Referenced by flowps_newflow_callback().

int flowps_destroy (  PS_TRACKER *  trackerp  )

Definition at line 239 of file flowps.c. References FLOW_ENULL, FLOW_SUCCESS, scoreboard_destroy(), _PS_TRACKER::table_active, _PS_TRACKER::table_scanner, _PS_TRACKER::unique_tracker, and ut_destroy(). Referenced by FlowPSCleanExit().

int flowps_enabled (  void   )

see if flowps is turned on Returns: 1 if portscan is on Definition at line 871 of file flowps.c. References s_enabled. Referenced by flowps_newflow_callback().

int flowps_entry_print (  SCORE_ENTRY *  entry, u_int32_t *  address )

Definition at line 469 of file flowps.c. References ALERT_FIXED_SCANNER, ALERT_FIXED_TALKER, ALERT_SLIDING_SCANNER, ALERT_SLIDING_TALKER, _CONN_ENTRY::cflags, _PS_SCORE_ENTRY::connections_seen, _PS_SCORE_ENTRY::fixed_scanner, _PS_SCORE_ENTRY::fixed_talker, _PS_SCORE_ENTRY::flags, flow_printf(), FLOWPS_HOSTS_SIZE, flowps_score_print(), _CONN_ENTRY::ip, _PS_SCORE_ENTRY::last_hosts, mktcpflag_str(), _CONN_ENTRY::port, _PS_SCORE_ENTRY::position, _CONN_ENTRY::protocol, _PS_SCORE_ENTRY::sliding_scanner, _PS_SCORE_ENTRY::sliding_talker, and TRACKER_SCANNER. Referenced by flowps_newflow_callback(), and scoreboard_dump().

int flowps_find_entry (  PS_TRACKER *  trackerp, u_int32_t *  address, SCORE_ENTRY **  sepp )

find the trackers in the table Currently, it first looks it up in the active table and then the scanner table Parameters: trackerp  tracker to search address  key to search for sepp  where to place the results Returns: FLOW_SUCCESS on sucess and sets sepp Definition at line 382 of file flowps.c. References FLOW_ENULL, FLOW_NOTFOUND, scoreboard_find(), _PS_TRACKER::table_active, and _PS_TRACKER::table_scanner. Referenced by flowps_newflow_callback().

int flowps_fixed_winadj (  PS_SCORE *  pscp, time_t  current_time, SCORE_THRESHOLD *  threshold )

Expire a fixed scale PS_SCORE Parameters: pscp  score entry to expire current_time  now threshold  threshold to slide againt Returns: FLOW_SUCCESS Definition at line 729 of file flowps.c. References _PS_SCORE::ends, _SCORE_THRESHOLD::fixed_size, FLOW_SUCCESS, _PS_SCORE::score, and _PS_SCORE::start. Referenced by flowps_newflow_callback().

int flowps_get_score (  PS_TRACKER *  pstp, FLOW *  flowp, time_t  cur, u_int32_t  flags, int *  score, TRACKER_POSITION *  type )

Get the score and the type of connection this is If the score is 0, this is an already existing connection and can be successfully ignored. Parameters: pstp  portscan tracker flowp  flow to aquire a score for * cur  current time packet related flags that can be used to modify the score score  return value for the score type  return value for the type of connection Returns: FLOW_SUCCESS on success and sets the score and type Definition at line 600 of file flowps.c. References _PS_CONFIG::base_score, _PS_TRACKER::config, FLOW_ENULL, flow_printf(), FLOW_SUCCESS, flowps_server_watch(), flowps_tcp_penalty(), _FLOW::key, packet_first_time(), _FLOWKEY::protocol, _FLOWKEY::resp_address, _FLOWKEY::resp_port, s_debug, _PS_CONFIG::server_ignore_limit, _PS_CONFIG::server_learning_time, _PS_CONFIG::server_scanner_limit, _PS_TRACKER::server_stats, server_stats_add_ipv4(), server_stats_hitcount_ipv4(), _PS_CONFIG::tcp_penalties, TRACKER_SCANNER, _PS_TRACKER::unique_tracker, ut_check(), and UT_OLD. Referenced by flowps_newflow_callback().

int flowps_init (  PS_TRACKER *  trackerp, PS_CONFIG *  configp )

initialize the Portscan Tracker. This takes several arguments, all, on the PS_CONFIG structure. Parameters: trackerp  tracker object to initialize configp  well-formed configuration to initialize this object Returns: FLOW_SUCCESS on success Definition at line 174 of file flowps.c. References _PS_TRACKER::config, FLOW_ENULL, FLOW_SUCCESS, flowps_server_stats_enabled(), memcpy, s_enabled, _PS_CONFIG::sb_memcap_scanner, _PS_CONFIG::sb_memcap_talker, _PS_CONFIG::sb_rows_scanner, _PS_CONFIG::sb_rows_talker, scoreboard_destroy(), scoreboard_init(), _PS_CONFIG::server_memcap, _PS_CONFIG::server_rows, _PS_TRACKER::server_stats, server_stats_init(), _PS_CONFIG::server_watchnet_ipv4, _PS_TRACKER::table_active, _PS_TRACKER::table_scanner, TRACKER_ACTIVE, TRACKER_SCANNER, _PS_TRACKER::unique_tracker, ut_destroy(), ut_init(), _PS_CONFIG::ut_memcap, and _PS_CONFIG::ut_rows. Referenced by FlowPSInit().

int flowps_is_ignored_ipv4 (  PS_TRACKER *  pstp, u_int32_t *  sip, u_int32_t *  dip )

Check to see if this IPv4 Address should be ignored by the portscan tracker. This checks both the src and dst lists. Parameters: pstp  portscan tracker sip  pointer to the sip in NETWORK byte order dip  pointer to the dip in NETWORK byte order Returns: FLOW_SUCCESS if this ip should be ignored, else it should be used < host ordered addresses Definition at line 889 of file flowps.c. References _PS_TRACKER::config, _PS_CONFIG::dst_ignore_ipv4, FLOW_DISABLED, FLOW_ENULL, FLOW_SUCCESS, ipset_contains(), IPV4_FAMILY, and _PS_CONFIG::src_ignore_ipv4. Referenced by flowps_newflow_callback().

int flowps_mkconfig (  PS_CONFIG *  configp, int  sb_memcap_talker, int  sb_rows_talker, int  sb_memcap_scanner, int  sb_rows_scanner, int  ut_memcap, int  ut_rows, int  server_memcap, int  server_rows, int  server_learning_time, int  tcp_penalties, u_int32_t  server_ignore_limit, u_int32_t  server_scanner_limit, int  base_score, int  alert_once, FLOWPS_OUTPUT  output_mode )

Initialize the configuration structure and set everything to 0 Parameters: configp  config to set Returns: FLOW_SUCCESS on success Definition at line 80 of file flowps.c. References _PS_CONFIG::alert_once, _PS_CONFIG::base_score, _PS_CONFIG::dumpall, FLOW_ENULL, FLOW_SUCCESS, memset, _PS_CONFIG::output_mode, _PS_CONFIG::sb_memcap_scanner, _PS_CONFIG::sb_memcap_talker, _PS_CONFIG::sb_memcap_total, _PS_CONFIG::sb_rows_scanner, _PS_CONFIG::sb_rows_talker, _PS_CONFIG::server_ignore_limit, _PS_CONFIG::server_learning_time, _PS_CONFIG::server_memcap, _PS_CONFIG::server_rows, _PS_CONFIG::server_scanner_limit, _PS_CONFIG::tcp_penalties, _PS_CONFIG::ut_memcap, and _PS_CONFIG::ut_rows. Referenced by FlowPSSetDefaults().

int flowps_mkthreshold (  SCORE_THRESHOLD *  thr, int  fixed_size, u_int32_t  fixed_limit, int  sliding_size, u_int32_t  sliding_limit, float  window_scale )

Setup a SCORE_THRESHOLD object. This contains the limits and window sizes that will be used each time we evaluate a SCORE_ENTRY from one of the scoreboards. Parameters: thr  pointer to the threshold to initialize fixed_size  the time window for fixed scale fixed_limit  the score limit to alert on sliding_size  the sliding time window initial size sliding_limit  score limit to alert on window_scale  what to multiple the sliding size on each "hit" Returns: FLOW_SUCCESS on success Definition at line 50 of file flowps.c. References _SCORE_THRESHOLD::fixed, _SCORE_THRESHOLD::fixed_size, FLOW_ENULL, FLOW_SUCCESS, _SCORE_THRESHOLD::sliding, _SCORE_THRESHOLD::sliding_size, and _SCORE_THRESHOLD::window_scale. Referenced by FlowPSSetDefaults().

static INLINE void flowps_reset_alert_flags (  u_int32_t  type, u_int32_t *  alert_flags, u_int32_t *  score )  [static]

Reset a single flag in the alert_flags entry if the score is 0 Parameters: type  flag to reset alert_flags  flag entry score  score to reset Definition at line 258 of file flowps.c. Referenced by flowps_score_entry().

int flowps_score_entry (  PS_TRACKER *  pstp, SCORE_ENTRY *  sep, int  score, TRACKER_POSITION  tr_pos, int  alert_once, u_int32_t *  alert_flags )

Evaluate the score on an entry, generating alerts if needed. Parameters: pstp  portscan tracker sep  score entry score  score determined for this flow tr_pos  what type of connection the current one is alert_once  alert only on the first one we find alert_flags  what type of alerts should we generate Returns: FLOW_SUCCESS on success Definition at line 281 of file flowps.c. References ALERT_FIXED_SCANNER, ALERT_FIXED_TALKER, ALERT_SLIDING_SCANNER, ALERT_SLIDING_TALKER, _PS_TRACKER::config, _SCORE_THRESHOLD::fixed, _PS_SCORE_ENTRY::fixed_scanner, _PS_SCORE_ENTRY::fixed_talker, _PS_SCORE_ENTRY::flags, FLOW_ENULL, FLOW_SUCCESS, FLOWASSERT, flowps_reset_alert_flags(), _PS_CONFIG::limit_scanner, _PS_CONFIG::limit_talker, _PS_SCORE::score, _SCORE_THRESHOLD::sliding, _PS_SCORE_ENTRY::sliding_scanner, _PS_SCORE_ENTRY::sliding_talker, TRACKER_ACTIVE, and TRACKER_SCANNER. Referenced by flowps_newflow_callback().

int flowps_score_print (  PS_SCORE *  ps_score  )

Printout a score entry Parameters: ps_score  score entry to printf Returns: FLOW_SUCCESS on success Definition at line 458 of file flowps.c. References _PS_SCORE::ends, flow_printf(), FLOW_SUCCESS, _PS_SCORE::score, and _PS_SCORE::start. Referenced by flowps_entry_print().

int flowps_server_stats_enabled (  PS_TRACKER *  trackerp  )

Determine if the server stats feature is enabled Parameters: trackerp  portscan tracker Returns: FLOW_SUCCESS if server_stats is enabled Definition at line 134 of file flowps.c. References _PS_TRACKER::config, FLOW_DISABLED, FLOW_SUCCESS, and _PS_CONFIG::server_watchnet_ipv4. Referenced by flowps_init(), and FlowPSOutputConfig().

int flowps_server_watch (  PS_TRACKER *  trackerp, u_int32_t  address )

Determine if server stats is enabled for this particular IP address. Parameters: trackerp  portscan tracker to inquire Returns: FLOW_SUCCESS if the server watchnet stuff is enabled Definition at line 150 of file flowps.c. References _PS_TRACKER::config, FLOW_DISABLED, FLOW_SUCCESS, FLOWASSERT, NULL, _PS_TRACKER::server_stats, server_stats_contains(), and _PS_CONFIG::server_watchnet_ipv4. Referenced by flowps_get_score().

int flowps_set_last_address (  SCORE_ENTRY *  sep, FLOW *  flowp, u_int8_t  cflags )

Maintain the ring buffer of most recent connections Parameters: sep  score entry pointer flowp  flow pointer cflags  connection flags ( often just the th_flags ) Returns: FLOW_SUCCESS on sucess Definition at line 839 of file flowps.c. References _CONN_ENTRY::cflags, _PS_SCORE_ENTRY::connections_seen, FLOW_SUCCESS, FLOWPS_HOSTS_SIZE, _CONN_ENTRY::ip, _FLOW::key, _PS_SCORE_ENTRY::last_hosts, _PS_SCORE_ENTRY::last_idx, _CONN_ENTRY::port, _CONN_ENTRY::protocol, _FLOWKEY::protocol, _FLOWKEY::resp_address, and _FLOWKEY::resp_port. Referenced by flowps_newflow_callback().

int flowps_sliding_winadj (  PS_SCORE *  pscp, time_t  current_time, SCORE_THRESHOLD *  threshold )

Expire a sliding scale PS_SCORE considerably more complicated than the fixed time window stuff. This really should be simplified. Parameters: pscp  score entry to expire current_time  current_time threshold  threshold to slide againt Returns: FLOW_SUCCESS Definition at line 756 of file flowps.c. References _PS_SCORE::ends, FLOW_SUCCESS, _PS_SCORE::score, _SCORE_THRESHOLD::sliding_size, _PS_SCORE::start, and _SCORE_THRESHOLD::window_scale. Referenced by flowps_newflow_callback().

void flowps_stats (  PS_TRACKER *  pstp  )

Definition at line 531 of file flowps.c. References _PS_TRACKER::config, _PS_CONFIG::dumpall, flow_printf(), scoreboard_stats(), server_stats(), _PS_TRACKER::server_stats, _PS_TRACKER::table_active, _PS_TRACKER::table_scanner, _PS_TRACKER::unique_tracker, and ut_stats(). Referenced by FlowPSCleanExit().

static INLINE void flowps_tcp_penalty (  u_int32_t  flags, int  base_score, int *  score )  [static]

Assign TCP penalty points have an optional penalty for odd flags combinations on TCP -- this should probably promote people to the TRACKER_SCANNER table as well. Perhaps we should extend this to non-common ICMP errors as well. S,12 & SYN are the 1 ptrs. XMAS w/ ACK is a 5 ptr SF+ is a 3 ptr. Parameters: flags  th_flags base_score  base score value for normal initiations score  ptr for return value Definition at line 563 of file flowps.c. References TH_ACK, TH_FIN, TH_RES1, TH_RES2, and TH_SYN. Referenced by flowps_get_score().

---

Variable Documentation

int s_debug = 0 [static]

Definition at line 32 of file flowps.c.

int s_enabled = 0 [static]

Definition at line 33 of file flowps.c. Referenced by flowps_enabled(), flowps_init(), ParseThreshold2(), ProcessThresholdOptions(), sfthreshold_create(), sfthreshold_init(), and sfthreshold_test().

---