hosts: consider hostbits/xbits status in timeout

Consider the host's xbits expiry status when checking the host for
timeout. If a single active non-expired bit is found, the host won't
be timeout just yet.

diff --git a/src/host-bit.c b/src/host-bit.c
index 4210c0ca02bb536595829b620855613256b2ffa8..7f33f3bca9ee81fa22f96d3abc19cd0da6fd5325 100644 (file)
--- a/src/host-bit.c
+++ b/src/host-bit.c
@@ -62,6 +62,21 @@ int HostHasHostBits(Host *host)
     return HostGetStorageById(host, host_bit_id) ? 1 : 0;
 }
 
+/** \retval 1 host timed out wrt xbits
+  * \retval 0 host still has active (non-expired) xbits */
+int HostBitsTimedoutCheck(Host *h, struct timeval *ts)
+{
+    GenericVar *gv = HostGetStorageById(h, host_bit_id);
+    for ( ; gv != NULL; gv = gv->next) {
+        if (gv->type == DETECT_XBITS) {
+            XBit *xb = (XBit *)gv;
+            if (xb->expire > (uint32_t)ts->tv_sec)
+                return 0;
+        }
+    }
+    return 1;
+}
+
 /* get the bit with idx from the host */
 static XBit *HostBitGet(Host *h, uint16_t idx)
 {

diff --git a/src/host-bit.h b/src/host-bit.h
index 574ae9b2694679526160b9bbfc9abeb1f4d752ba..d4bba11abf5bc96630f359e9a1084dedc826cd49 100644 (file)
--- a/src/host-bit.h
+++ b/src/host-bit.h
@@ -31,6 +31,7 @@ void HostBitInitCtx(void);
 void HostBitRegisterTests(void);
 
 int HostHasHostBits(Host *host);
+int HostBitsTimedoutCheck(Host *h, struct timeval *ts);
 
 void HostBitSet(Host *, uint16_t, uint32_t);
 void HostBitUnset(Host *, uint16_t);

diff --git a/src/host-timeout.c b/src/host-timeout.c
index a8b08b8d8591718ea599fea2987b3dca3f502c53..c8be4e05a75e93a0186ea92211e2e7c806a6c523 100644 (file)
--- a/src/host-timeout.c
+++ b/src/host-timeout.c
@@ -26,6 +26,9 @@
 
 #include "detect-engine-tag.h"
 #include "detect-engine-threshold.h"
+
+#include "host-bit.h"
+
 #include "reputation.h"
 
 uint32_t HostGetSpareCount(void)
@@ -51,6 +54,7 @@ static int HostHostTimedOut(Host *h, struct timeval *ts)
 {
     int tags = 0;
     int thresholds = 0;
+    int vars = 0;
 
     /** never prune a host that is used by a packet
      *  we are currently processing in one of the threads */
@@ -71,8 +75,11 @@ static int HostHostTimedOut(Host *h, struct timeval *ts)
     if (ThresholdHostHasThreshold(h) && ThresholdTimeoutCheck(h, ts) == 0) {
         thresholds = 1;
     }
+    if (HostHasHostBits(h) && HostBitsTimedoutCheck(h, ts) == 0) {
+        vars = 1;
+    }
 
-    if (tags || thresholds)
+    if (tags || thresholds || vars)
         return 0;
 
     SCLogDebug("host %p timed out", h);