suricata
detect-engine-tag.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file detect-engine-tag.h
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  *
23  * Implements a global context to store data related to hosts flagged
24  * tag keyword
25  */
26 
27 #ifndef __DETECT_ENGINE_TAG_H__
28 #define __DETECT_ENGINE_TAG_H__
29 
30 #include "host.h"
31 #include "detect.h"
32 #include "detect-tag.h"
33 
34 /* This limit should be overwriten/predefined at the config file
35  * to limit the options to prevent possible DOS situations. We should also
36  * create a limit for bytes and a limit for number of packets */
37 #define TAG_MAX_LAST_TIME_SEEN 600
38 
39 #define TAG_TIMEOUT_CHECK_INTERVAL 60
40 
41 /* Used for tagged data (sid and gid of the packets that
42  * follow the one that triggered the rule with tag option) */
43 #define TAG_SIG_GEN 2
44 #define TAG_SIG_ID 1
45 
48 
49 void TagContextDestroy(void);
51 
52 void TagInitCtx(void);
53 void TagDestroyCtx(void);
54 void TagRestartCtx(void);
55 
56 int TagTimeoutCheck(Host *, struct timeval *);
57 
58 int TagHostHasTag(Host *host);
59 
61 
62 #endif /* __DETECT_ENGINE_TAG_H__ */
63 
64 
host.h
DetectTagDataEntry_
Definition: detect-tag.h:71
TagHostHasTag
int TagHostHasTag(Host *host)
Definition: detect-engine-tag.c:87
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:784
detect-tag.h
DetectEngineThreadCtx_
Definition: detect.h:1024
TagInitCtx
void TagInitCtx(void)
Definition: detect-engine-tag.c:52
TagHandlePacket
void TagHandlePacket(DetectEngineCtx *, DetectEngineThreadCtx *, Packet *)
Search tags for src and dst. Update entries of the tag, remove if necessary.
Definition: detect-engine-tag.c:504
detect.h
TagTimeoutCheck
int TagTimeoutCheck(Host *, struct timeval *)
Removes the entries exceding the max timeout value.
Definition: detect-engine-tag.c:545
Packet_
Definition: decode.h:425
TagFlowAdd
int TagFlowAdd(Packet *, DetectTagDataEntry *)
This function is used to add a tag to a session (type session) or update it if it's already installed...
Definition: detect-engine-tag.c:124
TagHashAddTag
int TagHashAddTag(DetectTagDataEntry *, Packet *)
Add a tag entry for a host. If it already exist, update it.
Definition: detect-engine-tag.c:181
DetectEngineTagRegisterTests
void DetectEngineTagRegisterTests(void)
this function registers unit tests for DetectTag
Definition: detect-engine-tag.c:1508
Host_
Definition: host.h:58
TagDestroyCtx
void TagDestroyCtx(void)
Destroy tag context hash tables.
Definition: detect-engine-tag.c:72
TagRestartCtx
void TagRestartCtx(void)
Reset the tagging engine context.
Definition: detect-engine-tag.c:81
TagContextDestroy
void TagContextDestroy(void)