<?xml version="1.0" encoding="utf-8" ?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
    <xs:annotation>
<!-- From: http://translator.b59.net/docs/cidss.xsd -->
        <xs:appinfo>
              This schema is a piece of Translator application
        </xs:appinfo>
        <xs:documentation>
              This is common language definition
        </xs:documentation>
    </xs:annotation>

	<xs:attribute name="ID" type="xs:int" />

	<!-- Begin of element:  Signatures -->
    <xs:element name="Signatures">
        <xs:complexType>
            <xs:sequence>
                <xs:element name="Signature" type="typeSignature" minOccurs="0" maxOccurs="unbounded" />
            </xs:sequence>
		<!-- To identify if XML and XSD come from the same version, in future will be added attribute with version of CIDSS -->
      	<!--	<xs:attribute name="CIDSS_Version" fixed="2.0" /> -->
        </xs:complexType>
        <xs:unique name="uniqueSignatureID">
            <xs:selector xpath="Signature" />
            <xs:field xpath="@ID" />
        </xs:unique>
        <xs:unique name="uniqueSourcesID">
            <xs:selector xpath="Sources" />
            <xs:field xpath="@ID" />
        </xs:unique>
        <xs:unique name="uniqueDestinationsID">
            <xs:selector xpath="Destinations" />
            <xs:field xpath="@ID" />
        </xs:unique>
        <xs:unique name="uniqueProtocolsID">
            <xs:selector xpath="Protocols" />
            <xs:field xpath="@ID" />
        </xs:unique>
        <xs:unique name="uniquePatternsID">
            <xs:selector xpath="Patterns" />
            <xs:field xpath="@ID" />
        </xs:unique>
    </xs:element>
	<!-- End of element:  Signatures -->

	<!-- Begin of element:  Signature -->
    <xs:complexType name="typeSignature">
        <xs:sequence>
            <xs:element name="Enabled" type="xs:boolean" minOccurs="1" maxOccurs="1" default="true" />
            <xs:element name="Sig_Source" type="xs:string" minOccurs="0" maxOccurs="1" />
            <xs:element name="Action" type="xs:string" minOccurs="0"  maxOccurs="1" />
            <xs:element name="Description" type="xs:string" minOccurs="0" />
            <xs:element name="Message" type="xs:string" minOccurs="0" />
            <xs:element name="Comment" type="xs:string" minOccurs="0" />
            <xs:element name="Logged_Packets" type="xs:int" minOccurs="0" maxOccurs="1" />
			
			<!-- Begin of element:  Sources -->
            <xs:element name="Sources" minOccurs="1"  maxOccurs="1">
				<xs:complexType>
					<xs:sequence>
					<!-- Begin of element:  Source -->
						<xs:element name="Source" minOccurs="1" maxOccurs="unbounded">
							<xs:complexType>
								<xs:sequence>
									<xs:element name="Source_IP" minOccurs="1" maxOccurs="1" >
										<xs:complexType>
											<xs:simpleContent>
												<xs:extension base="xs:string">
													<xs:attribute name="Neg" type="xs:boolean" default="false" />
													<xs:attribute name="Mask" type="xs:int" default="0" />
												</xs:extension>
											</xs:simpleContent>
										</xs:complexType>
									</xs:element>
									<xs:element name="Source_Port" type="xs:string" minOccurs="1" maxOccurs="1" />
								</xs:sequence>
								<xs:attribute name="Src_ID" use="required" >
									<xs:simpleType>
										<xs:restriction base="xs:string">
											<xs:pattern value="SRC_[0-9]+" />
										</xs:restriction>
									</xs:simpleType>
								</xs:attribute>
							</xs:complexType>
							<xs:unique name="uniqueSourceSrc_ID">
								<xs:selector xpath="Source" />
								<xs:field xpath="@Src_ID" />
							</xs:unique>
						</xs:element>
					<!-- End of element:  Source -->
						<xs:element name="Src_Logic" type="xs:string" minOccurs="0" maxOccurs="1" />
					</xs:sequence>
					<xs:attribute ref="ID" use="required" />
				</xs:complexType>
			</xs:element>
			<!-- End of element:  Sources -->

			<!-- Begin of element:  Destinations -->
            <xs:element name="Destinations" minOccurs="1"  maxOccurs="1">
				<xs:complexType>
					<xs:sequence>
					<!-- Begin of element:  Destination -->
						<xs:element name="Destination" minOccurs="1" maxOccurs="unbounded">
							<xs:complexType>
								<xs:sequence>
									<xs:element name="Destination_IP" minOccurs="1">
										<xs:complexType>
											<xs:simpleContent>
												<xs:extension base="xs:string">
													<xs:attribute name="Neg" type="xs:boolean" default="false" />
													<xs:attribute name="Mask" type="xs:int" default="0" />
												</xs:extension>
											</xs:simpleContent>
										</xs:complexType>
									</xs:element>
									<xs:element name="Destination_Port" type="xs:string" minOccurs="1" maxOccurs="1" />
								</xs:sequence>
								<xs:attribute name="Dst_ID" use="required" >
									<xs:simpleType>
										<xs:restriction base="xs:string">
											<xs:pattern value="DST_[0-9]+" />
										</xs:restriction>
									</xs:simpleType>
								</xs:attribute>
							</xs:complexType>
							<xs:unique name="uniqueDestinationDst_ID">
								<xs:selector xpath="Destination" />
								<xs:field xpath="@Dst_ID" />
							</xs:unique>
						</xs:element>
					<!-- End of element:  Destination -->
						<xs:element name="Dst_Logic" type="xs:string" minOccurs="0" maxOccurs="1" />
					</xs:sequence>
					<xs:attribute ref="ID" use="required" />
				</xs:complexType>
			</xs:element>
			<!-- End of element:  Destinations -->

			<!-- Begin of element:  Protocols -->
            <xs:element name="Protocols" minOccurs="1"  maxOccurs="1">
				<xs:complexType>
					<xs:sequence>
					<!-- Begin of element:  Protocol -->
						<xs:element name="Protocol" minOccurs="1" maxOccurs="unbounded">
							<xs:complexType>
								<xs:sequence>
									<xs:element name="TCP_Ack" type="xs:int" minOccurs="0" maxOccurs="1" />
									<xs:element name="TCP_State" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="TCP_Dsize" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="TCP_Flags" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="TCP_Seq" type="xs:int" minOccurs="0" maxOccurs="1" />
									<xs:element name="TCP_Window" type="xs:int" minOccurs="0" maxOccurs="1" />
									<xs:element name="UDP_Dsize" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="ICMP_Dsize" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="ICMP_Icmp_Id" type="xs:int" minOccurs="0" maxOccurs="1" />
									<xs:element name="ICMP_Icmp_Seq" type="xs:int" minOccurs="0" maxOccurs="1" />
									<xs:element name="ICMP_Icode" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="ICMP_Itype" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="IP_Id" type="xs:int" minOccurs="0" maxOccurs="1" />
									<xs:element name="IP_Ttl" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="IP_Ipopts" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="IP_Fragbits" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="IP_Ip_Proto" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="IP_Tos" type="xs:int" minOccurs="0" maxOccurs="1" />
									<xs:element name="IP_Dsize" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="Isdataat" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="Rpc" type="xs:string" minOccurs="0" maxOccurs="1" />
								</xs:sequence>
								<xs:attribute name="Proto_ID" use="required" >
									<xs:simpleType>
										<xs:restriction base="xs:string">
											<xs:pattern value="PROTO_[0-9]+" />
										</xs:restriction>
									</xs:simpleType>
								</xs:attribute>
								<xs:attribute name="Type" use="required">
									<xs:simpleType>
										<xs:restriction base="xs:string">
											<xs:enumeration value="tcp" />
											<xs:enumeration value="udp" />
											<xs:enumeration value="ip" />
											<xs:enumeration value="icmp" />
											<xs:enumeration value="application" />
										</xs:restriction>
									</xs:simpleType>
								</xs:attribute>
							</xs:complexType>
							<xs:unique name="uniqueProtocolProto_ID">
								<xs:selector xpath="Protocol" />
								<xs:field xpath="@Proto_ID" />
							</xs:unique>
						</xs:element>
					<!-- End of element:  Protocol -->
						<xs:element name="Proto_Logic" type="xs:string" minOccurs="0" maxOccurs="1" />
					</xs:sequence>
					<xs:attribute name="ID" type="xs:int" use="required" />
				</xs:complexType>
			</xs:element>
			<!-- End of element:  Protocols -->

			<!-- Begin of element:  Patterns -->
            <xs:element name="Patterns" minOccurs="0"  maxOccurs="1">
				<xs:complexType>
					<xs:sequence>
					<!-- Begin of element:  Pattern -->
						<xs:element name="Pattern" minOccurs="1" maxOccurs="unbounded">
							<xs:complexType>
								<xs:sequence>
									<xs:element name="Pattern_Type" minOccurs="1" default="string" >
										<xs:simpleType>
											<xs:restriction base="xs:string">
												<xs:enumeration value="string" />
												<xs:enumeration value="hex" />
												<xs:enumeration value="dec" />
												<xs:enumeration value="pcre" />
											</xs:restriction>
										</xs:simpleType>
									</xs:element>
									<xs:element name="Pattern_Content" minOccurs="1" >
										<xs:complexType>
											<xs:simpleContent>
												<xs:extension base="xs:string">
													<xs:attribute name="CaseSensitive" type="xs:boolean" default="true" />
													<xs:attribute name="RawBytes" type="xs:boolean" default="false" />
												</xs:extension>
											</xs:simpleContent>
										</xs:complexType>
									</xs:element>
									<xs:element name="Pattern_Depth" type="xs:int" minOccurs="0" maxOccurs="1" />
									<xs:element name="Pattern_Uricontent" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="Pattern_Offset" type="xs:int" minOccurs="0" maxOccurs="1" />
									<xs:element name="Pattern_Within" type="xs:int" minOccurs="0" maxOccurs="1" />
									<xs:element name="Pattern_Distance" type="xs:int" minOccurs="0" maxOccurs="1" />
								</xs:sequence>
								<xs:attribute name="Pat_ID" use="required" >
									<xs:simpleType>
										<xs:restriction base="xs:string">
											<xs:pattern value="PAT_[0-9]+" />
										</xs:restriction>
									</xs:simpleType>
								</xs:attribute>
							</xs:complexType>
							<xs:unique name="uniquePatternPat_ID">
								<xs:selector xpath="Pattern" />
								<xs:field xpath="@Pat_ID" />
							</xs:unique>
						</xs:element>
					<!-- End of element:  Pattern -->
						<xs:element name="Pat_Logic" type="xs:string" minOccurs="0" maxOccurs="1" />
					</xs:sequence>
					<xs:attribute name="ID" type="xs:int" use="required" />
				</xs:complexType>
			</xs:element>
			<!-- End of element:  Patterns -->

			<!-- Begin of element:  Session -->
            <xs:element name="Session" minOccurs="1" maxOccurs="1">
				<xs:complexType>
					<xs:sequence>
						<xs:element name="Session_Filter" type="xs:string" minOccurs="0" maxOccurs="1" />
						<xs:element name="Session_Start" type="xs:string" minOccurs="0" maxOccurs="1" />
						<xs:element name="Session_End" minOccurs="0" maxOccurs="1" >
							<xs:complexType>
								<xs:sequence>
									<xs:element name="Session_Timeout" type="xs:string" minOccurs="0" maxOccurs="1" />
									<xs:element name="Session_Pckt_Count" type="xs:int" minOccurs="0" maxOccurs="1" />
								</xs:sequence>
							</xs:complexType>
						</xs:element>
						<xs:element name="Session_Identification" minOccurs="0" maxOccurs="1" >
							<xs:complexType>
								<xs:sequence>
									<xs:element name="Same_Source_IP" minOccurs="0" maxOccurs="1" />
									<xs:element name="Same_Source_Port" minOccurs="0" maxOccurs="1" />
									<xs:element name="Same_Destination_IP" minOccurs="0" maxOccurs="1" />
									<xs:element name="Same_Destination_Port" minOccurs="0" maxOccurs="1" />
									<xs:element name="Same_Protocol" minOccurs="0" maxOccurs="1" />
									<xs:element name="Same_Direction" minOccurs="0" maxOccurs="1" />
								</xs:sequence>
							</xs:complexType>
						</xs:element>
						<xs:element name="Session_Instructions" minOccurs="0" maxOccurs="1" >
							<xs:complexType>
								<xs:sequence>
									<xs:element name="Session_Case" minOccurs="0" maxOccurs="unbounded" >
										<xs:complexType>
											<xs:sequence>
												<xs:element name="Case_Filter" type="xs:string" minOccurs="0" maxOccurs="1" />
												<xs:element name="Direction" minOccurs="0" maxOccurs="1" default="sd" >
													<xs:simpleType>
														<xs:restriction base="xs:string">
															<xs:enumeration value="sd" />
															<xs:enumeration value="ds" />
														</xs:restriction>
													</xs:simpleType>
												</xs:element>
												<xs:element name="Case_State_Condition" minOccurs="0" maxOccurs="1" >
													<xs:complexType>
														<xs:sequence>
															<xs:element name="Isset_Var" minOccurs="0" maxOccurs="unbounded" >
																<xs:complexType>
																	<xs:simpleContent>
																		<xs:extension base="xs:string">
																			<xs:attribute name="Var" type="xs:string" use="required" />
																		</xs:extension>
																	</xs:simpleContent>
																</xs:complexType>
															</xs:element>
															<xs:element name="Compare_Var" minOccurs="0" maxOccurs="unbounded" >
																<xs:complexType>
																	<xs:simpleContent>
																		<xs:extension base="xs:string">
																			<xs:attribute name="Var" type="xs:string" use="required" />
																			<xs:attribute name="Value" type="xs:string" use="required" />
																		</xs:extension>
																	</xs:simpleContent>
																</xs:complexType>
															</xs:element>
															<xs:element name="Set_Var" minOccurs="0" maxOccurs="unbounded" >
																<xs:complexType>
																	<xs:simpleContent>
																		<xs:extension base="xs:string">
																			<xs:attribute name="Var" type="xs:string" use="required" />
																			<xs:attribute name="Value" type="xs:string" use="required" />
																		</xs:extension>
																	</xs:simpleContent>
																</xs:complexType>
															</xs:element>
															<xs:element name="Unset_Var" minOccurs="0" maxOccurs="unbounded" >
																<xs:complexType>
																	<xs:simpleContent>
																		<xs:extension base="xs:string">
																			<xs:attribute name="Var" type="xs:string" use="required" />
																		</xs:extension>
																	</xs:simpleContent>
																</xs:complexType>
															</xs:element>
														</xs:sequence>
													</xs:complexType>
												</xs:element>
												<xs:element name="Case_State_Instructions" type="xs:string" minOccurs="0" maxOccurs="1" />
											</xs:sequence>
										</xs:complexType>
									</xs:element>
								</xs:sequence>
							</xs:complexType>
						</xs:element>
					</xs:sequence>
				</xs:complexType>
			</xs:element>
			<!-- End of element:  Pattern -->
        </xs:sequence>
        <xs:attribute name="SID" type="xs:int" use="required" />
    </xs:complexType>
	<!-- End of element:  Signature -->

</xs:schema>

