detect-engine-tag.h File Reference

#include "host.h"
#include "detect.h"
#include "detect-tag.h"

Include dependency graph for detect-engine-tag.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros
#define	TAG_MAX_LAST_TIME_SEEN   600
#define	TAG_SIG_GEN   2
#define	TAG_SIG_ID   1

Functions
int	TagHashAddTag (DetectTagDataEntry *, Packet *)
	Add a tag entry for a host. If it already exist, update it.
int	TagFlowAdd (Packet *, DetectTagDataEntry *)
	This function is used to add a tag to a session (type session) or update it if it's already installed. The number of times to allow an update is limited by DETECT_TAG_MATCH_LIMIT. This way repetitive matches to the same rule are limited of setting tags, to avoid DOS attacks.
void	TagHandlePacket (const DetectEngineCtx *, DetectEngineThreadCtx *, Packet *)
	Search tags for src and dst. Update entries of the tag, remove if necessary.
void	TagInitCtx (void)
void	TagDestroyCtx (void)
	Destroy tag context hash tables.
int	TagTimeoutCheck (Host *, SCTime_t)
	Removes the entries exceeding the max timeout value.
int	TagHostHasTag (Host *host)
void	DetectEngineTagRegisterTests (void)
	this function registers unit tests for DetectTag

Detailed Description

Author

Pablo Rincon Crespo pablo.nosp@m..rin.nosp@m.con.c.nosp@m.resp.nosp@m.o@gma.nosp@m.il.c.nosp@m.om

Implements a global context to store data related to hosts flagged tag keyword

Definition in file detect-engine-tag.h.

Macro Definition Documentation

TAG_MAX_LAST_TIME_SEEN

#define TAG_MAX_LAST_TIME_SEEN   600

Definition at line 37 of file detect-engine-tag.h.

TAG_SIG_GEN

#define TAG_SIG_GEN   2

Definition at line 41 of file detect-engine-tag.h.

TAG_SIG_ID

#define TAG_SIG_ID   1

Definition at line 42 of file detect-engine-tag.h.

Function Documentation

DetectEngineTagRegisterTests()

void DetectEngineTagRegisterTests

(

void

)

this function registers unit tests for DetectTag

Definition at line 1397 of file detect-engine-tag.c.

References UtRegisterTest().

Here is the call graph for this function:

TagDestroyCtx()

void TagDestroyCtx

(

void

)

Destroy tag context hash tables.

Parameters

tag_ctx

Tag Context

Definition at line 72 of file detect-engine-tag.c.

References BUG_ON, and SC_ATOMIC_GET.

Referenced by GlobalsDestroy().

Here is the caller graph for this function:

TagFlowAdd()

int TagFlowAdd	(	Packet *	p,
		DetectTagDataEntry *	tde
	)

This function is used to add a tag to a session (type session) or update it if it's already installed. The number of times to allow an update is limited by DETECT_TAG_MATCH_LIMIT. This way repetitive matches to the same rule are limited of setting tags, to avoid DOS attacks.

Parameters

p	pointer to the current packet
tde	pointer to the new DetectTagDataEntry

Return values

0	if the tde was added successfully
1	if an entry of this sid/gid already exist and was updated

Definition at line 115 of file detect-engine-tag.c.

References DetectTagDataEntry_::bytes, DetectTagDataEntry_::cnt_match, DETECT_TAG_MATCH_LIMIT, DETECT_TAG_MAX_TAGS, DetectTagDataEntry_::first_ts, Packet_::flow, FlowGetStorageById(), FlowSetStorageById(), DetectTagDataEntry_::gid, DetectTagDataEntry_::last_ts, DetectTagDataEntry_::next, DetectTagDataEntry_::packets, SC_ATOMIC_ADD, SCLogDebug, SCTIME_SECS, and DetectTagDataEntry_::sid.

Here is the call graph for this function:

TagHandlePacket()

void TagHandlePacket	(	const DetectEngineCtx *	de_ctx,
		DetectEngineThreadCtx *	det_ctx,
		Packet *	p
	)

Search tags for src and dst. Update entries of the tag, remove if necessary.

Parameters

de_ctx	Detect context
det_ctx	Detect thread context
p	packet

Definition at line 523 of file detect-engine-tag.c.

References dst, Packet_::flow, HostUnlock(), SC_ATOMIC_GET, SCEnter, SCReturn, src, and TagHostHasTag().

Referenced by PacketAlertFinalize().

Here is the call graph for this function:

Here is the caller graph for this function:

TagHashAddTag()

int TagHashAddTag	(	DetectTagDataEntry *	tde,
		Packet *	p
	)

Add a tag entry for a host. If it already exist, update it.

Parameters

tag_ctx	Tag context for hosts
tde	Tag data
p	packet

Return values

0	if it was added, 1 if it was updated

Definition at line 173 of file detect-engine-tag.c.

References DetectTagDataEntry_::bytes, DetectTagDataEntry_::cnt_match, DETECT_TAG_MATCH_LIMIT, DETECT_TAG_MAX_TAGS, Packet_::dst, DetectTagDataEntry_::first_ts, DetectTagDataEntry_::flags, DetectTagDataEntry_::gid, HostGetHostFromHash(), HostGetStorageById(), HostRelease(), HostSetStorageById(), DetectTagDataEntry_::last_ts, DetectTagDataEntry_::next, DetectTagDataEntry_::packets, SC_ATOMIC_ADD, SCEnter, SCLogDebug, SCReturnInt, DetectTagDataEntry_::sid, Packet_::src, tag, TAG_ENTRY_FLAG_DIR_DST, and TAG_ENTRY_FLAG_DIR_SRC.

Here is the call graph for this function:

TagHostHasTag()

int TagHostHasTag

(

Host *

host

)

Definition at line 79 of file detect-engine-tag.c.

References HostGetStorageById().

Referenced by TagHandlePacket().

Here is the call graph for this function:

Here is the caller graph for this function:

TagInitCtx()

void TagInitCtx

(

void

)

Definition at line 52 of file detect-engine-tag.c.

References DetectTagDataListFree(), FatalError, FlowStorageRegister(), HostStorageRegister(), FlowStorageId::id, HostStorageId_::id, and SC_ATOMIC_INIT.

Referenced by PostConfLoadedSetup(), and RunUnittests().

Here is the call graph for this function:

Here is the caller graph for this function:

TagTimeoutCheck()

int TagTimeoutCheck	(	Host *	host,
		SCTime_t	ts
	)

Removes the entries exceeding the max timeout value.

Parameters

tag_ctx	Tag context
ts	the current time

Return values

1	no tags or tags removed – host is free to go (from tag perspective)
0	still active tags

Definition at line 565 of file detect-engine-tag.c.

References HostGetStorageById(), HostSetStorageById(), DetectTagDataEntry_::last_ts, DetectTagDataEntry_::next, SC_ATOMIC_SUB, SCFree, SCTIME_ADD_SECS, SCTIME_CMP_GTE, TAG_MAX_LAST_TIME_SEEN, and ts.

Here is the call graph for this function: