aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

host: implement hostbits/xbits expire

Browse Source
pull/1422/head
Victor Julien 11 years ago
parent ca1f3e68d4
commit 67dd5c0430
3 changed files with 71 additions and 62 deletions
Show Stats Download Patch File Download Diff File

16
src/detect-hostbits.c
Unescape Escape View File

@ -118,7 +118,7 @@ static int DetectHostbitMatchToggle (Packet *p, const DetectXbitsData *fd)
else else
HostLock(p->host_src); HostLock(p->host_src);
HostBitToggle(p->host_src,fd->idx); HostBitToggle(p->host_src,fd->idx,p->ts.tv_sec + fd->expire);
HostUnlock(p->host_src); HostUnlock(p->host_src);
break; break;
case DETECT_XBITS_TRACK_IPDST: case DETECT_XBITS_TRACK_IPDST:
@ -130,7 +130,7 @@ static int DetectHostbitMatchToggle (Packet *p, const DetectXbitsData *fd)
else else
HostLock(p->host_dst); HostLock(p->host_dst);
HostBitToggle(p->host_dst,fd->idx); HostBitToggle(p->host_dst,fd->idx,p->ts.tv_sec + fd->expire);
HostUnlock(p->host_dst); HostUnlock(p->host_dst);
break; break;
} }
@ -178,7 +178,7 @@ static int DetectHostbitMatchSet (Packet *p, const DetectXbitsData *fd)
} else } else
HostLock(p->host_src); HostLock(p->host_src);
HostBitSet(p->host_src,fd->idx); HostBitSet(p->host_src,fd->idx,p->ts.tv_sec + fd->expire);
HostUnlock(p->host_src); HostUnlock(p->host_src);
break; break;
case DETECT_XBITS_TRACK_IPDST: case DETECT_XBITS_TRACK_IPDST:
@ -189,7 +189,7 @@ static int DetectHostbitMatchSet (Packet *p, const DetectXbitsData *fd)
} else } else
HostLock(p->host_dst); HostLock(p->host_dst);
HostBitSet(p->host_dst,fd->idx); HostBitSet(p->host_dst,fd->idx, p->ts.tv_sec + fd->expire);
HostUnlock(p->host_dst); HostUnlock(p->host_dst);
break; break;
} }
@ -208,7 +208,7 @@ static int DetectHostbitMatchIsset (Packet *p, const DetectXbitsData *fd)
} else } else
HostLock(p->host_src); HostLock(p->host_src);
r = HostBitIsset(p->host_src,fd->idx); r = HostBitIsset(p->host_src,fd->idx, p->ts.tv_sec);
HostUnlock(p->host_src); HostUnlock(p->host_src);
return r; return r;
case DETECT_XBITS_TRACK_IPDST: case DETECT_XBITS_TRACK_IPDST:
@ -219,7 +219,7 @@ static int DetectHostbitMatchIsset (Packet *p, const DetectXbitsData *fd)
} else } else
HostLock(p->host_dst); HostLock(p->host_dst);
r = HostBitIsset(p->host_dst,fd->idx); r = HostBitIsset(p->host_dst,fd->idx, p->ts.tv_sec);
HostUnlock(p->host_dst); HostUnlock(p->host_dst);
return r; return r;
} }
@ -238,7 +238,7 @@ static int DetectHostbitMatchIsnotset (Packet *p, const DetectXbitsData *fd)
} else } else
HostLock(p->host_src); HostLock(p->host_src);
r = HostBitIsnotset(p->host_src,fd->idx); r = HostBitIsnotset(p->host_src,fd->idx, p->ts.tv_sec);
HostUnlock(p->host_src); HostUnlock(p->host_src);
return r; return r;
case DETECT_XBITS_TRACK_IPDST: case DETECT_XBITS_TRACK_IPDST:
@ -249,7 +249,7 @@ static int DetectHostbitMatchIsnotset (Packet *p, const DetectXbitsData *fd)
} else } else
HostLock(p->host_dst); HostLock(p->host_dst);
r = HostBitIsnotset(p->host_dst,fd->idx); r = HostBitIsnotset(p->host_dst,fd->idx, p->ts.tv_sec);
HostUnlock(p->host_dst); HostUnlock(p->host_dst);
return r; return r;
} }

107
src/host-bit.c
Unescape Escape View File

@ -76,7 +76,7 @@ static XBit *HostBitGet(Host *h, uint16_t idx)
} }
/* add a flowbit to the flow */ /* add a flowbit to the flow */
static void HostBitAdd(Host *h, uint16_t idx) static void HostBitAdd(Host *h, uint16_t idx, uint32_t expire)
{ {
XBit *fb = HostBitGet(h, idx); XBit *fb = HostBitGet(h, idx);
if (fb == NULL) { if (fb == NULL) {
@ -87,10 +87,15 @@ static void HostBitAdd(Host *h, uint16_t idx)
fb->type = DETECT_XBITS; fb->type = DETECT_XBITS;
fb->idx = idx; fb->idx = idx;
fb->next = NULL; fb->next = NULL;
fb->expire = expire;
GenericVar *gv = HostGetStorageById(h, host_bit_id); GenericVar *gv = HostGetStorageById(h, host_bit_id);
GenericVarAppend(&gv, (GenericVar *)fb); GenericVarAppend(&gv, (GenericVar *)fb);
HostSetStorageById(h, host_bit_id, gv); HostSetStorageById(h, host_bit_id, gv);
// bit already set, lets update it's time
} else {
fb->expire = expire;
} }
} }
@ -107,11 +112,11 @@ static void HostBitRemove(Host *h, uint16_t idx)
} }
} }
void HostBitSet(Host *h, uint16_t idx) void HostBitSet(Host *h, uint16_t idx, uint32_t expire)
{ {
XBit *fb = HostBitGet(h, idx); XBit *fb = HostBitGet(h, idx);
if (fb == NULL) { if (fb == NULL) {
HostBitAdd(h, idx); HostBitAdd(h, idx, expire);
} }
} }
@ -123,37 +128,41 @@ void HostBitUnset(Host *h, uint16_t idx)
} }
} }
void HostBitToggle(Host *h, uint16_t idx) void HostBitToggle(Host *h, uint16_t idx, uint32_t expire)
{ {
XBit *fb = HostBitGet(h, idx); XBit *fb = HostBitGet(h, idx);
if (fb != NULL) { if (fb != NULL) {
HostBitRemove(h, idx); HostBitRemove(h, idx);
} else { } else {
HostBitAdd(h, idx); HostBitAdd(h, idx, expire);
} }
} }
int HostBitIsset(Host *h, uint16_t idx) int HostBitIsset(Host *h, uint16_t idx, uint32_t ts)
{ {
int r = 0;
XBit *fb = HostBitGet(h, idx); XBit *fb = HostBitGet(h, idx);
if (fb != NULL) { if (fb != NULL) {
r = 1; if (fb->expire < ts) {
HostBitRemove(h,idx);
return 0;
} }
return r; return 1;
}
return 0;
} }
int HostBitIsnotset(Host *h, uint16_t idx) int HostBitIsnotset(Host *h, uint16_t idx, uint32_t ts)
{ {
int r = 0;
XBit *fb = HostBitGet(h, idx); XBit *fb = HostBitGet(h, idx);
if (fb == NULL) { if (fb == NULL) {
r = 1; return 1;
} }
return r; if (fb->expire < ts) {
HostBitRemove(h,idx);
return 1;
}
return 0;
} }
/* TESTS */ /* TESTS */
@ -167,7 +176,7 @@ static int HostBitTest01 (void)
if (h == NULL) if (h == NULL)
goto end; goto end;
HostBitAdd(h, 0); HostBitAdd(h, 0, 0);
XBit *fb = HostBitGet(h,0); XBit *fb = HostBitGet(h,0);
if (fb != NULL) if (fb != NULL)
@ -207,7 +216,7 @@ static int HostBitTest03 (void)
if (h == NULL) if (h == NULL)
goto end; goto end;
HostBitAdd(h, 0); HostBitAdd(h, 0, 30);
XBit *fb = HostBitGet(h,0); XBit *fb = HostBitGet(h,0);
if (fb == NULL) { if (fb == NULL) {
@ -240,10 +249,10 @@ static int HostBitTest04 (void)
if (h == NULL) if (h == NULL)
goto end; goto end;
HostBitAdd(h, 0); HostBitAdd(h, 0, 30);
HostBitAdd(h, 1); HostBitAdd(h, 1, 30);
HostBitAdd(h, 2); HostBitAdd(h, 2, 30);
HostBitAdd(h, 3); HostBitAdd(h, 3, 30);
XBit *fb = HostBitGet(h,0); XBit *fb = HostBitGet(h,0);
if (fb != NULL) if (fb != NULL)
@ -264,10 +273,10 @@ static int HostBitTest05 (void)
if (h == NULL) if (h == NULL)
goto end; goto end;
HostBitAdd(h, 0); HostBitAdd(h, 0, 30);
HostBitAdd(h, 1); HostBitAdd(h, 1, 30);
HostBitAdd(h, 2); HostBitAdd(h, 2, 30);
HostBitAdd(h, 3); HostBitAdd(h, 3, 30);
XBit *fb = HostBitGet(h,1); XBit *fb = HostBitGet(h,1);
if (fb != NULL) if (fb != NULL)
@ -288,10 +297,10 @@ static int HostBitTest06 (void)
if (h == NULL) if (h == NULL)
goto end; goto end;
HostBitAdd(h, 0); HostBitAdd(h, 0, 90);
HostBitAdd(h, 1); HostBitAdd(h, 1, 90);
HostBitAdd(h, 2); HostBitAdd(h, 2, 90);
HostBitAdd(h, 3); HostBitAdd(h, 3, 90);
XBit *fb = HostBitGet(h,2); XBit *fb = HostBitGet(h,2);
if (fb != NULL) if (fb != NULL)
@ -312,10 +321,10 @@ static int HostBitTest07 (void)
if (h == NULL) if (h == NULL)
goto end; goto end;
HostBitAdd(h, 0); HostBitAdd(h, 0, 90);
HostBitAdd(h, 1); HostBitAdd(h, 1, 90);
HostBitAdd(h, 2); HostBitAdd(h, 2, 90);
HostBitAdd(h, 3); HostBitAdd(h, 3, 90);
XBit *fb = HostBitGet(h,3); XBit *fb = HostBitGet(h,3);
if (fb != NULL) if (fb != NULL)
@ -336,10 +345,10 @@ static int HostBitTest08 (void)
if (h == NULL) if (h == NULL)
goto end; goto end;
HostBitAdd(h, 0); HostBitAdd(h, 0, 90);
HostBitAdd(h, 1); HostBitAdd(h, 1, 90);
HostBitAdd(h, 2); HostBitAdd(h, 2, 90);
HostBitAdd(h, 3); HostBitAdd(h, 3, 90);
XBit *fb = HostBitGet(h,0); XBit *fb = HostBitGet(h,0);
if (fb == NULL) if (fb == NULL)
@ -369,10 +378,10 @@ static int HostBitTest09 (void)
if (h == NULL) if (h == NULL)
goto end; goto end;
HostBitAdd(h, 0); HostBitAdd(h, 0, 90);
HostBitAdd(h, 1); HostBitAdd(h, 1, 90);
HostBitAdd(h, 2); HostBitAdd(h, 2, 90);
HostBitAdd(h, 3); HostBitAdd(h, 3, 90);
XBit *fb = HostBitGet(h,1); XBit *fb = HostBitGet(h,1);
if (fb == NULL) if (fb == NULL)
@ -402,10 +411,10 @@ static int HostBitTest10 (void)
if (h == NULL) if (h == NULL)
goto end; goto end;
HostBitAdd(h, 0); HostBitAdd(h, 0, 90);
HostBitAdd(h, 1); HostBitAdd(h, 1, 90);
HostBitAdd(h, 2); HostBitAdd(h, 2, 90);
HostBitAdd(h, 3); HostBitAdd(h, 3, 90);
XBit *fb = HostBitGet(h,2); XBit *fb = HostBitGet(h,2);
if (fb == NULL) if (fb == NULL)
@ -435,10 +444,10 @@ static int HostBitTest11 (void)
if (h == NULL) if (h == NULL)
goto end; goto end;
HostBitAdd(h, 0); HostBitAdd(h, 0, 90);
HostBitAdd(h, 1); HostBitAdd(h, 1, 90);
HostBitAdd(h, 2); HostBitAdd(h, 2, 90);
HostBitAdd(h, 3); HostBitAdd(h, 3, 90);
XBit *fb = HostBitGet(h,3); XBit *fb = HostBitGet(h,3);
if (fb == NULL) if (fb == NULL)

10
src/host-bit.h
Unescape Escape View File

@ -32,9 +32,9 @@ void HostBitRegisterTests(void);
int HostHasHostBits(Host *host); int HostHasHostBits(Host *host);
void HostBitSet(Host *, uint16_t); void HostBitSet(Host *, uint16_t, uint32_t);
void HostBitUnset(Host *, uint16_t); void HostBitUnset(Host *, uint16_t);
void HostBitToggle(Host *, uint16_t); void HostBitToggle(Host *, uint16_t, uint32_t);
int HostBitIsset(Host *, uint16_t); int HostBitIsset(Host *, uint16_t, uint32_t);
int HostBitIsnotset(Host *, uint16_t); int HostBitIsnotset(Host *, uint16_t, uint32_t);
#endif /* __FLOW_BIT_H__ */ #endif /* __HOST_BIT_H__ */

Write Preview
Loading…
Cancel
Save