suricata
detect-engine-tag.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file detect-engine-tag.h
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  *
23  * Implements a global context to store data related to hosts flagged
24  * tag keyword
25  */
26 
27 #ifndef __DETECT_ENGINE_TAG_H__
28 #define __DETECT_ENGINE_TAG_H__
29 
30 #include "host.h"
31 #include "detect.h"
32 
33 /* This limit should be overwriten/predefined at the config file
34  * to limit the options to prevent possible DOS situations. We should also
35  * create a limit for bytes and a limit for number of packets */
36 #define TAG_MAX_LAST_TIME_SEEN 600
37 
38 #define TAG_TIMEOUT_CHECK_INTERVAL 60
39 
40 /* Used for tagged data (sid and gid of the packets that
41  * follow the one that triggered the rule with tag option) */
42 #define TAG_SIG_GEN 2
43 #define TAG_SIG_ID 1
44 
47 
48 void TagContextDestroy(void);
50 
51 void TagInitCtx(void);
52 void TagDestroyCtx(void);
53 void TagRestartCtx(void);
54 
55 int TagTimeoutCheck(Host *, struct timeval *);
56 
57 int TagHostHasTag(Host *host);
58 
60 
61 #endif /* __DETECT_ENGINE_TAG_H__ */
62 
63 
int TagHashAddTag(DetectTagDataEntry *, Packet *)
Add a tag entry for a host. If it already exist, update it.
void TagRestartCtx(void)
Reset the tagging engine context.
int TagHostHasTag(Host *host)
void TagHandlePacket(DetectEngineCtx *, DetectEngineThreadCtx *, Packet *)
Search tags for src and dst. Update entries of the tag, remove if necessary.
void TagDestroyCtx(void)
Destroy tag context hash tables.
main detection engine ctx
Definition: detect.h:756
int TagTimeoutCheck(Host *, struct timeval *)
Removes the entries exceding the max timeout value.
Definition: host.h:58
void TagContextDestroy(void)
int TagFlowAdd(Packet *, DetectTagDataEntry *)
This function is used to add a tag to a session (type session) or update it if it&#39;s already installed...
void DetectEngineTagRegisterTests(void)
this function registers unit tests for DetectTag
void TagInitCtx(void)