Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Flow bytes pkts syntax/v7 #12206

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
+345 −194
Open

Flow bytes pkts syntax/v7 #12206

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
eac315f
flow/pkts: make syntax cleaner and compact
inashivb Nov 29, 2024
f1e76fc
doc: update syntax for flow.pkts & flow.bytes
inashivb Oct 8, 2024
5320e79
flow/pkts: allow matching on either direction
inashivb Aug 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 28 additions & 57 deletions doc/userguide/rules/flow-keywords.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -318,90 +318,61 @@ Signature example::

In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.

flow.pkts_toclient
------------------
flow.pkts
---------

Flow number of packets to client (integer)
Flow number of packets (integer)
This keyword does not wait for the end of the flow, but will be checked at each packet.

flow.pkts_toclient uses an :ref:`unsigned 32-bit integer <rules-integer-keywords>`.
flow.pkts uses an :ref:`unsigned 32-bit integer <rules-integer-keywords>` and supports
following directions:

Syntax::

flow.pkts_toclient: [op]<number>

The number of packets can be matched exactly, or compared using the _op_ setting::

flow.pkts_toclient:3 # exactly 3
flow.pkts_toclient:<3 # smaller than 3
flow.pkts_toclient:>=2 # greater than or equal to 2
* toclient

Signature example::
* toserver

alert ip any any -> any any (msg:"Flow has 20 packets"; flow.pkts_toclient:20; sid:1;)

flow.pkts_toserver
------------------

Flow number of packets to server (integer)
This keyword does not wait for the end of the flow, but will be checked at each packet.

flow.pkts_toserver uses an :ref:`unsigned 32-bit integer <rules-integer-keywords>`.
* either

Syntax::

flow.pkts_toserver: [op]<number>
flow.pkts:<direction>,[op]<number>

The number of packets can be matched exactly, or compared using the _op_ setting::

flow.pkts_toserver:3 # exactly 3
flow.pkts_toserver:<3 # smaller than 3
flow.pkts_toserver:>=2 # greater than or equal to 2
flow.pkts:toclient,3 # exactly 3
flow.pkts:toserver,<3 # smaller than 3
flow.pkts:either,>=2 # greater than or equal to 2

Signature example::

alert ip any any -> any any (msg:"Flow has 20 packets"; flow.pkts_toserver:20; sid:1;)

flow.bytes_toclient
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess doc should not be removed if the keyword still exist

You can just have a quick mention of it saying it has the same behavior as flow.bytes: toclient,

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok. My idea of removing the doc for old syntax was to increase adaptation of the new syntax only. Old syntax is for backwards compatibility so the existing rulesets using it do not break and that's it. Lmk wdyt?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jufajardini thoughts ?

I see base64_decode doc has a sentence : We recommend using the base64 transform instead

-------------------
alert ip any any -> any any (msg:"Flow has 20 packets in toclient dir"; flow.pkts:toclient,20; sid:1;)

Flow number of bytes to client (integer)
This keyword does not wait for the end of the flow, but will be checked at each packet.

flow.bytes_toclient uses an :ref:`unsigned 64-bit integer <rules-integer-keywords>`.

Syntax::

flow.bytes_toclient: [op]<number>

The number of packets can be matched exactly, or compared using the _op_ setting::
flow.bytes
----------

flow.bytes_toclient:3 # exactly 3
flow.bytes_toclient:<3 # smaller than 3
flow.bytes_toclient:>=2 # greater than or equal to 2
Flow number of bytes (integer)
This keyword does not wait for the end of the flow, but will be checked at each packet.

Signature example::
flow.bytes uses an :ref:`unsigned 64-bit integer <rules-integer-keywords>` and supports
following directions:

alert ip any any -> any any (msg:"Flow has less than 2000 bytes"; flow.bytes_toclient:<2000; sid:1;)
* toclient

flow.bytes_toserver
-------------------
* toserver

Flow number of bytes to server (integer)
This keyword does not wait for the end of the flow, but will be checked at each packet.

flow.bytes_toserver uses an :ref:`unsigned 64-bit integer <rules-integer-keywords>`.
* either

Syntax::

flow.bytes_toserver: [op]<number>
flow.bytes:<direction>,[op]<number>

The number of packets can be matched exactly, or compared using the _op_ setting::
The number of bytes can be matched exactly, or compared using the _op_ setting::

flow.bytes_toserver:3 # exactly 3
flow.bytes_toserver:<3 # smaller than 3
flow.bytes_toserver:>=2 # greater than or equal to 2
flow.bytes:toclient,3 # exactly 3
flow.bytes:toserver,<3 # smaller than 3
flow.bytes:either,>=2 # greater than or equal to 2

Signature example::

alert ip any any -> any any (msg:"Flow has less than 2000 bytes"; flow.bytes_toserver:<2000; sid:1;)
alert ip any any -> any any (msg:"Flow has less than 2000 bytes in toserver dir"; flow.bytes:toserver,<2000; sid:1;)
6 changes: 4 additions & 2 deletions src/detect-engine-register.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -581,10 +581,12 @@ void SigTableSetup(void)
DetectReplaceRegister();
DetectFlowRegister();
DetectFlowAgeRegister();
DetectFlowPktsToClientRegister();
DetectFlowPktsRegister();
DetectFlowPktsToServerRegister();
DetectFlowBytesToClientRegister();
DetectFlowPktsToClientRegister();
DetectFlowBytesRegister();
DetectFlowBytesToServerRegister();
DetectFlowBytesToClientRegister();
DetectRequiresRegister();
DetectWindowRegister();
DetectRpcRegister();
Expand Down
6 changes: 4 additions & 2 deletions src/detect-engine-register.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,10 +127,12 @@ enum DetectKeywordId {
DETECT_FRAME,

DETECT_FLOW_AGE,
DETECT_FLOW_PKTS_TO_CLIENT,
DETECT_FLOW_PKTS,
DETECT_FLOW_PKTS_TO_SERVER,
DETECT_FLOW_BYTES_TO_CLIENT,
DETECT_FLOW_PKTS_TO_CLIENT,
DETECT_FLOW_BYTES,
DETECT_FLOW_BYTES_TO_SERVER,
DETECT_FLOW_BYTES_TO_CLIENT,

DETECT_REQUIRES,

Expand Down
Loading
Loading