Changeset 144 for trunk/src/dataFlowSet.c

Timestamp:

12/21/10 16:01:36 (12 years ago)

Author:

andreu

Message:

DoS detection - detection in core (todo: email notification with renetcolSEC module)

Files:

• trunk/src/dataFlowSet.c (modified) (8 diffs)

trunk/src/dataFlowSet.c

@@ -58 +58 @@
   int j = 0;
   int pos = 0;
+        int jdos = 0;
+        int posdos = 0;
   unsigned char buffer1;  
   unsigned char buffer2[2];
@@ -75 +77 @@
 #endif
   struct AggCache agCache;
+        struct DoSCache dosCache;
   int bool = 0; /* in IPV4 Agg mode enabled, we need to now if it's an IPv4 */
   int isIPv6 = 0;
@@ -330 +333 @@
                 agCache.bytes = *((unsigned long*)&buffer4);
                 if (
-                    ((unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) + ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)*10/100))
+                    ((unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) + ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)/5))
                      >= (*((unsigned long*)&buffer4)))
                     &&
-                    ( (unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) - ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)*10/100))
+                    ( (unsigned long)((((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue) - ( (((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->value->stor.lvalue)/5))
                       <= (*((unsigned long*)&buffer4)) )
                     )
@@ -339 +342 @@
                     ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+pos)))->check = 1;
                   }
-              }
+                                }
 #if defined(IPV4AGGIDR) || defined(IPV4AGGIDSNMP)
               if (pftmp->fieldType==10){
@@ -369 +372 @@
               }
 #endif
+              if (pftmp->fieldType==1){
+                      dosCache.bytes = *((unsigned long*)&buffer4);
+                                        dosCache.sampling = *myPtrs->currentRouterPtr->sampled;
+              }
+              if (pftmp->fieldType==2){
+                      dosCache.pkts = *((unsigned long*)&buffer4);
+                                }
               break;
             case 16:
@@ -633 +643 @@
           }
 #endif
+                if (pftmp->fieldType==1){
+            dosCache.bytes = *((unsigned long*)&buffer4);
+                        dosCache.sampling = *myPtrs->currentRouterPtr->sampled;
+          } 
+                if (pftmp->fieldType==2){
+            dosCache.pkts = *((unsigned long*)&buffer4);
+          }
           break;
         case 16:
@@ -1426 +1443 @@
         }
         isMplsFlow = 0;
+
+        /* DoS DETECTION */
+        if ( ( dosCache.packets*dosCache.sampling > MAX_PKTS_DOS )  
+                  && ((dosCache.packets)/(dosCache.bytes) < RATIO_DOS ) ) {
+                                jdos = 0;
+        posdos = 69*MAX_RULES_PER_FIELD+jdos;
+        while ( ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+jdos))) != NULL ) {
+                                        ((RuleDefPtr)(*(myPtrs->rulesAddressPtr+posdos)))->check = 1;
+                                        jdos++;
+                                }
+        }
+
         /* 
          *
@@ -1465 +1494 @@
                                                    &tmp->sourceId, 
                                                    sizeof(unsigned long) 
-                                                   ), 
-                                           &tmp->templateFlowSetId, 
-                                           sizeof(tmp->templateFlowSetId) 
-                                           ), 
-                                   myPtrs->ptr_buffer+secondOffset, 
+                                                   ),
+                                           &tmp->templateFlowSetId,
+                                           sizeof(tmp->templateFlowSetId)
+                                           ),
+                                   myPtrs->ptr_buffer+secondOffset,
                                    flow_size
                                    );