Main Page | Modules | Class List | Directories | File List | Class Members | File Members | Related Pages
src

tag.c File Reference

#include <sys/types.h>
#include <stdlib.h>
#include <rpc/types.h>
#include <string.h>
#include <ctype.h>
#include "decode.h"
#include "rules.h"
#include "debug.h"
#include "util.h"
#include "generators.h"
#include "log.h"
#include "ubi_SplayTree.h"

Go to the source code of this file.

Defines

#define INLINE   inline
#define TAG_SESSION   1
#define TAG_HOST   2
#define TAG_HOST_SRC   3
#define TAG_HOST_DST   4
#define TAG_METRIC_SECONDS   1
#define TAG_METRIC_PACKETS   2
#define TAG_METRIC_BYTES   4
#define MAX_TAG_NODES   256
#define TAG_PRUNE_QUANTUM   300
#define TAG_MEMCAP   4194304

Typedefs

typedef _PruneData PruneData
typedef _TagNode TagNode

Functions

static void * TagAlloc (unsigned long)
static int PruneTagCache (u_int32_t, int)
static int PruneTime (ubi_trRootPtr, u_int32_t)
static void TagSession (Packet *, TagData *, u_int32_t, u_int16_t)
static void TagHost (Packet *, TagData *, u_int32_t, u_int16_t)
static void AddTagNode (Packet *, TagData *, int, u_int32_t, u_int16_t)
static INLINE void SwapTag (TagNode *)
static int TagCompareSession (ubi_trItemPtr ItemPtr, ubi_trNodePtr NodePtr)
static int TagCompareHost (ubi_trItemPtr ItemPtr, ubi_trNodePtr NodePtr)
void InitTag ()
int CheckTagList (Packet *p, Event *event)
void SetTags (Packet *p, OptTreeNode *otn, u_int16_t event_id)
void ParseTag (char *args, OptTreeNode *otn)

Variables

static ubi_trRoot host_tag_cache
static ubi_trRootPtr host_tag_cache_ptr = &host_tag_cache
static ubi_trRoot ssn_tag_cache
static ubi_trRootPtr ssn_tag_cache_ptr = &ssn_tag_cache
static u_int32_t last_prune_time
static u_int32_t tag_alloc_faults
static u_int32_t tag_memory_usage
char check_tags_flag
char * file_name
int file_line

Define Documentation

#define INLINE   inline
 

Definition at line 46 of file tag.c.

#define MAX_TAG_NODES   256
 

Definition at line 65 of file tag.c.

#define TAG_HOST   2
 

Definition at line 57 of file tag.c.

Referenced by ParseTag(), and SetTags().

#define TAG_HOST_DST   4
 

Definition at line 59 of file tag.c.

Referenced by AddTagNode(), ParseTag(), and TagHost().

#define TAG_HOST_SRC   3
 

Definition at line 58 of file tag.c.

Referenced by ParseTag(), and TagHost().

#define TAG_MEMCAP   4194304
 

Definition at line 72 of file tag.c.

Referenced by TagAlloc().

#define TAG_METRIC_BYTES   4
 

Definition at line 63 of file tag.c.

Referenced by AddTagNode(), CheckTagList(), and ParseTag().

#define TAG_METRIC_PACKETS   2
 

Definition at line 62 of file tag.c.

Referenced by AddTagNode(), CheckTagList(), and ParseTag().

#define TAG_METRIC_SECONDS   1
 

Definition at line 61 of file tag.c.

Referenced by AddTagNode(), CheckTagList(), and ParseTag().

#define TAG_PRUNE_QUANTUM   300
 

Definition at line 71 of file tag.c.

Referenced by CheckTagList(), and PruneTime().

#define TAG_SESSION   1
 

Definition at line 56 of file tag.c.

Referenced by AddTagNode(), ParseTag(), SetTags(), and TagSession().

Typedef Documentation

typedef struct _PruneData PruneData
 

typedef struct _TagNode TagNode
 

Function Documentation

static void AddTagNode (  Packet *  ,
TagData *  ,
int  ,
u_int32_t  ,
u_int16_t 
)  [static]
 

Definition at line 349 of file tag.c.

References _TagNode::bytes, DEBUG_FLOW, DEBUG_WRAP, _TagNode::dip, _Packet::dp, _TagNode::dp, _TagNode::event_id, _TagNode::event_time, FALSE, host_tag_cache_ptr, _IPHdr::ip_dst, _IPHdr::ip_proto, _IPHdr::ip_src, _Packet::iph, _TagNode::last_access, _TagNode::metric, _TagNode::mode, NULL, _TagNode::packets, _Packet::pkth, _TagNode::proto, _TagNode::seconds, _TagNode::sip, _Packet::sp, _TagNode::sp, ssn_tag_cache_ptr, SwapTag(), _TagData::tag_bytes, TAG_HOST_DST, tag_memory_usage, _TagData::tag_metric, TAG_METRIC_BYTES, TAG_METRIC_PACKETS, TAG_METRIC_SECONDS, _TagData::tag_packets, _TagData::tag_seconds, TAG_SESSION, TagAlloc(), pcap_pkthdr::ts, ubi_sptFind(), ubi_sptInsert(), and ubi_trRootPtr.

Referenced by TagHost(), and TagSession().

int CheckTagList (  Packet *  p,
Event *  event
) 
 

Definition at line 456 of file tag.c.

References _TagNode::bytes, DEBUG_FLOW, DEBUG_WRAP, _TagNode::dip, _TagNode::dp, _Packet::dp, _TagNode::event_id, _TagNode::event_time, GENERATOR_TAG, host_tag_cache_ptr, int(), _IPHdr::ip_dst, _IPHdr::ip_len, _IPHdr::ip_src, _Packet::iph, _TagNode::last_access, last_prune_time, _TagNode::metric, NULL, _TagNode::packets, _Packet::pkth, PruneTagCache(), _Event::ref_time, _TagNode::seconds, SetEvent(), _TagNode::sip, _TagNode::sp, _Packet::sp, ssn_tag_cache_ptr, TAG_LOG_PKT, tag_memory_usage, TAG_METRIC_BYTES, TAG_METRIC_PACKETS, TAG_METRIC_SECONDS, TAG_PRUNE_QUANTUM, pcap_pkthdr::ts, ubi_sptFind(), ubi_sptRemove(), ubi_trCount, and ubi_trRootPtr.

Referenced by CheckTagging().

void InitTag (   ) 
 

Definition at line 307 of file tag.c.

References host_tag_cache_ptr, ssn_tag_cache_ptr, TagCompareHost(), TagCompareSession(), and ubi_trInitTree.

Referenced by SnortMain().

void ParseTag (  char *  args,
OptTreeNode *  otn
) 
 

Definition at line 736 of file tag.c.

References DEBUG_FLOW, DEBUG_PLUGIN, DEBUG_RULES, DEBUG_WRAP, FatalError(), file_line, file_name, NULL, strncasecmp, _OptTreeNode::tag, _TagData::tag_bytes, _TagData::tag_direction, TAG_HOST, TAG_HOST_DST, TAG_HOST_SRC, _TagData::tag_metric, TAG_METRIC_BYTES, TAG_METRIC_PACKETS, TAG_METRIC_SECONDS, _TagData::tag_packets, _TagData::tag_seconds, TAG_SESSION, and _TagData::tag_type.

Referenced by ParseRuleOptions().

static int PruneTagCache (  u_int32_t  ,
int 
)  [static]
 

Definition at line 603 of file tag.c.

References host_tag_cache_ptr, PruneTime(), ssn_tag_cache_ptr, tag_memory_usage, ubi_btLeafNode(), and ubi_trCount.

Referenced by CheckTagList(), and TagAlloc().

static int PruneTime (  ubi_trRootPtr  ,
u_int32_t 
)  [static]
 

Definition at line 651 of file tag.c.

References _TagNode::last_access, NULL, tag_memory_usage, TAG_PRUNE_QUANTUM, ubi_btFirst(), ubi_btNext(), ubi_sptRemove(), and ubi_trCount.

Referenced by PruneTagCache().

void SetTags (  Packet *  p,
OptTreeNode *  otn,
u_int16_t  event_id
) 
 

Definition at line 694 of file tag.c.

References check_tags_flag, DEBUG_FLOW, DEBUG_WRAP, _Packet::dp, _IPHdr::ip_dst, _IPHdr::ip_src, _Packet::iph, LogMessage(), NULL, _Packet::pkth, _Packet::sp, _OptTreeNode::tag, TAG_HOST, TAG_SESSION, _TagData::tag_type, TagHost(), TagSession(), and pcap_pkthdr::ts.

Referenced by fpLogEvent().

static INLINE void SwapTag (  TagNode *  np  )  [static]
 

swap the sips and dips, dp's and sp's

Parameters:
np TagNode ptr

Definition at line 224 of file tag.c.

References _TagNode::dip, _TagNode::dp, _TagNode::sip, and _TagNode::sp.

Referenced by AddTagNode().

static void * TagAlloc (  unsigned  long  )  [static]
 

Definition at line 147 of file tag.c.

References FatalError(), gettimeofday(), NULL, PruneTagCache(), tag_alloc_faults, TAG_MEMCAP, and tag_memory_usage.

Referenced by AddTagNode().

static int TagCompareHost (  ubi_trItemPtr  ItemPtr,
ubi_trNodePtr  NodePtr
)  [static]
 

Definition at line 287 of file tag.c.

References _TagNode::sip.

Referenced by InitTag().

static int TagCompareSession (  ubi_trItemPtr  ItemPtr,
ubi_trNodePtr  NodePtr
)  [static]
 

Definition at line 239 of file tag.c.

References _TagNode::dip, _TagNode::dp, _TagNode::sip, and _TagNode::sp.

Referenced by InitTag().

static void TagHost (  Packet *  ,
TagData *  ,
u_int32_t  ,
u_int16_t 
)  [static]
 

Definition at line 327 of file tag.c.

References AddTagNode(), DEBUG_FLOW, DEBUG_WRAP, _TagData::tag_direction, TAG_HOST_DST, and TAG_HOST_SRC.

Referenced by SetTags().

static void TagSession (  Packet *  ,
TagData *  ,
u_int32_t  ,
u_int16_t 
)  [static]
 

Definition at line 319 of file tag.c.

References AddTagNode(), DEBUG_FLOW, DEBUG_WRAP, and TAG_SESSION.

Referenced by SetTags().

Variable Documentation

char check_tags_flag
 

Definition at line 100 of file detect.c.

Referenced by CheckTagging(), fpLogEvent(), Preprocess(), and SetTags().

int file_line
 

Definition at line 88 of file parser.c.

char* file_name
 

external globals from rules.c

Definition at line 87 of file parser.c.

ubi_trRoot host_tag_cache [static]
 

Definition at line 122 of file tag.c.

ubi_trRootPtr host_tag_cache_ptr = &host_tag_cache [static]
 

Definition at line 123 of file tag.c.

Referenced by AddTagNode(), CheckTagList(), InitTag(), and PruneTagCache().

u_int32_t last_prune_time [static]
 

Definition at line 128 of file tag.c.

Referenced by CheckTagList().

ubi_trRoot ssn_tag_cache [static]
 

Definition at line 125 of file tag.c.

ubi_trRootPtr ssn_tag_cache_ptr = &ssn_tag_cache [static]
 

Definition at line 126 of file tag.c.

Referenced by AddTagNode(), CheckTagList(), InitTag(), and PruneTagCache().

u_int32_t tag_alloc_faults [static]
 

Definition at line 129 of file tag.c.

Referenced by TagAlloc().

u_int32_t tag_memory_usage [static]
 

Definition at line 130 of file tag.c.

Referenced by AddTagNode(), CheckTagList(), PruneTagCache(), PruneTime(), and TagAlloc().

Generated on Sun May 14 14:51:27 2006 by  doxygen 1.4.2