suricata
detect-engine-tag.h File Reference
#include "host.h"
#include "detect.h"
Include dependency graph for detect-engine-tag.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros

#define TAG_MAX_LAST_TIME_SEEN   600
 
#define TAG_TIMEOUT_CHECK_INTERVAL   60
 
#define TAG_SIG_GEN   2
 
#define TAG_SIG_ID   1
 

Functions

int TagHashAddTag (DetectTagDataEntry *, Packet *)
 Add a tag entry for a host. If it already exist, update it. More...
 
int TagFlowAdd (Packet *, DetectTagDataEntry *)
 This function is used to add a tag to a session (type session) or update it if it's already installed. The number of times to allow an update is limited by DETECT_TAG_MATCH_LIMIT. This way repetitive matches to the same rule are limited of setting tags, to avoid DOS attacks. More...
 
void TagContextDestroy (void)
 
void TagHandlePacket (DetectEngineCtx *, DetectEngineThreadCtx *, Packet *)
 Search tags for src and dst. Update entries of the tag, remove if necessary. More...
 
void TagInitCtx (void)
 
void TagDestroyCtx (void)
 Destroy tag context hash tables. More...
 
void TagRestartCtx (void)
 Reset the tagging engine context. More...
 
int TagTimeoutCheck (Host *, struct timeval *)
 Removes the entries exceding the max timeout value. More...
 
int TagHostHasTag (Host *host)
 
void DetectEngineTagRegisterTests (void)
 this function registers unit tests for DetectTag More...
 

Detailed Description

Author
Pablo Rincon Crespo pablo.nosp@m..rin.nosp@m.con.c.nosp@m.resp.nosp@m.o@gma.nosp@m.il.c.nosp@m.om

Implements a global context to store data related to hosts flagged tag keyword

Definition in file detect-engine-tag.h.

Macro Definition Documentation

#define TAG_MAX_LAST_TIME_SEEN   600

Definition at line 36 of file detect-engine-tag.h.

Referenced by TagTimeoutCheck().

#define TAG_SIG_GEN   2

Definition at line 42 of file detect-engine-tag.h.

Referenced by PacketAlertTagInit().

#define TAG_SIG_ID   1

Definition at line 43 of file detect-engine-tag.h.

Referenced by PacketAlertTagInit().

#define TAG_TIMEOUT_CHECK_INTERVAL   60

Definition at line 38 of file detect-engine-tag.h.

Function Documentation

void DetectEngineTagRegisterTests ( void  )

this function registers unit tests for DetectTag

Definition at line 1503 of file detect-engine-tag.c.

References UtRegisterTest().

Referenced by DetectTagRegisterTests().

Here is the call graph for this function:

Here is the caller graph for this function:

void TagContextDestroy ( void  )
void TagDestroyCtx ( void  )

Destroy tag context hash tables.

Parameters
tag_ctxTag Context

Definition at line 73 of file detect-engine-tag.c.

References BUG_ON, SC_ATOMIC_DESTROY, and SC_ATOMIC_GET.

Referenced by GlobalsInitPreConfig(), TagRestartCtx(), and TagTimeoutCheck().

Here is the caller graph for this function:

int TagFlowAdd ( Packet p,
DetectTagDataEntry tde 
)

This function is used to add a tag to a session (type session) or update it if it's already installed. The number of times to allow an update is limited by DETECT_TAG_MATCH_LIMIT. This way repetitive matches to the same rule are limited of setting tags, to avoid DOS attacks.

Parameters
ppointer to the current packet
tdepointer to the new DetectTagDataEntry
Return values
0if the tde was added succesfuly
1if an entry of this sid/gid already exist and was updated

Definition at line 126 of file detect-engine-tag.c.

References DetectTagDataEntry_::bytes, DetectTagDataEntry_::cnt_match, DETECT_TAG_MATCH_LIMIT, DETECT_TAG_MAX_TAGS, DetectTagDataEntry_::first_ts, Packet_::flow, FlowGetStorageById(), FlowSetStorageById(), DetectTagDataEntry_::gid, DetectTagDataEntry_::last_ts, DetectTagDataEntry_::next, DetectTagDataEntry_::packets, SC_ATOMIC_ADD, SCLogDebug, and DetectTagDataEntry_::sid.

Referenced by DetectTagRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void TagHandlePacket ( DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
Packet p 
)

Search tags for src and dst. Update entries of the tag, remove if necessary.

Parameters
de_ctxDetect context
det_ctxDetect thread context
ppacket

Definition at line 505 of file detect-engine-tag.c.

References Packet_::dst, dst, Packet_::flow, HostLookupHostFromHash(), HostRelease(), SC_ATOMIC_GET, SCEnter, SCReturn, Packet_::src, src, and TagHostHasTag().

Referenced by PacketAlertFinalize().

Here is the call graph for this function:

Here is the caller graph for this function:

int TagHostHasTag ( Host host)
void TagInitCtx ( void  )

Definition at line 51 of file detect-engine-tag.c.

References DetectTagDataListFree(), FlowStorageRegister(), HostStorageRegister(), SC_ATOMIC_INIT, SC_ERR_FLOW_INIT, SC_ERR_HOST_INIT, and SCLogError.

Referenced by PostRunDeinit(), RunUnittests(), TagRestartCtx(), and TagTimeoutCheck().

Here is the call graph for this function:

Here is the caller graph for this function:

void TagRestartCtx ( void  )

Reset the tagging engine context.

Definition at line 83 of file detect-engine-tag.c.

References TagDestroyCtx(), and TagInitCtx().

Here is the call graph for this function:

int TagTimeoutCheck ( Host host,
struct timeval *  tv 
)