56 if (host_tag_id.
id == -1) {
60 if (flow_tag_id.
id == -1) {
126 uint16_t tag_cnt = 0;
135 for (; iter != NULL; iter = iter->
next) {
158 if (new_tde != NULL) {
165 SCLogDebug(
"Max tags for sessions reached (%"PRIu16
")", tag_cnt);
205 if (new_tde != NULL) {
217 for (iter =
tag; iter != NULL; iter = iter->
next) {
238 if (new_tde != NULL) {
245 SCLogDebug(
"Max tags for sessions reached (%"PRIu16
")", ntags);
253 static void TagHandlePacketFlow(
Flow *f,
Packet *p)
261 uint8_t flag_added = 0;
263 while (iter != NULL) {
284 SCLogDebug(
"flow tag expired: packets %u > %u",
302 }
else if (flag_added == 0) {
329 }
else if (flag_added == 0) {
340 SCLogDebug(
"flow tag expired: %u - %u = %u > %u",
359 }
else if (flag_added == 0) {
375 static void TagHandlePacketHost(
Host *host,
Packet *p)
380 uint8_t flag_added = 0;
384 while (iter != NULL) {
422 }
else if (flag_added == 0) {
448 }
else if (flag_added == 0) {
459 SCLogDebug(
"host tag expired: %u - %u = %u > %u",
478 }
else if (flag_added == 0) {
509 if (current_tags == 0)
513 if (p->
flow != NULL) {
514 TagHandlePacketFlow(p->
flow, p);
520 TagHandlePacketHost(
src,p);
527 TagHandlePacketHost(
dst,p);
555 while (tmp != NULL) {
591 static int DetectTagTestPacket01 (
void)
594 uint8_t *buf = (uint8_t *)
"Hi all!";
595 uint8_t *buf2 = (uint8_t *)
"lalala!";
596 uint16_t buf_len = strlen((
char *)buf);
597 uint16_t buf_len2 = strlen((
char *)buf2);
601 "192.168.1.5",
"192.168.1.1",
604 "192.168.1.5",
"192.168.1.1",
607 "192.168.1.5",
"192.168.1.9",
610 "192.168.1.5",
"192.168.1.9",
613 "192.168.1.1",
"192.168.1.9",
616 "192.168.1.1",
"192.168.1.11",
619 "192.168.1.5",
"192.168.1.11",
623 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,packets,src; sid:1;)";
624 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,4,packets,dst; sid:2;)";
625 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
626 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
627 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
630 uint32_t sid[5] = {1,2,3,4,5};
654 printf(
"tag should have been expired: ");
669 printf(
"gid %u sid %u packets %u count %u: ", iter->
gid, iter->
sid, iter->
packets, iter->
count);
688 static int DetectTagTestPacket02 (
void)
691 uint8_t *buf = (uint8_t *)
"Hi all!";
692 uint8_t *buf2 = (uint8_t *)
"lalala!";
693 uint16_t buf_len = strlen((
char *)buf);
694 uint16_t buf_len2 = strlen((
char *)buf2);
700 memset(&th_v, 0,
sizeof(th_v));
715 "192.168.1.5",
"192.168.1.1",
718 "192.168.1.5",
"192.168.1.1",
721 "192.168.1.5",
"192.168.1.9",
724 "192.168.1.5",
"192.168.1.9",
727 "192.168.1.1",
"192.168.1.9",
730 "192.168.1.1",
"192.168.1.11",
733 "192.168.1.5",
"192.168.1.11",
737 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,seconds,src; sid:1;)";
738 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,8,seconds,dst; sid:2;)";
739 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
740 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
741 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
744 uint32_t sid[5] = {1,2,3,4,5};
767 for (; i < num_packets; i++) {
779 if (i == 0 || i == 2 || i == 3 || i == 5 || i == 6)
809 static int DetectTagTestPacket03 (
void)
812 uint8_t *buf = (uint8_t *)
"Hi all!";
813 uint8_t *buf2 = (uint8_t *)
"lalala!";
814 uint16_t buf_len = strlen((
char *)buf);
815 uint16_t buf_len2 = strlen((
char *)buf2);
821 memset(&th_v, 0,
sizeof(th_v));
836 "192.168.1.5",
"192.168.1.1",
839 "192.168.1.5",
"192.168.1.1",
842 "192.168.1.5",
"192.168.1.9",
845 "192.168.1.5",
"192.168.1.9",
848 "192.168.1.1",
"192.168.1.9",
851 "192.168.1.1",
"192.168.1.11",
854 "192.168.1.5",
"192.168.1.11",
858 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host, 150, bytes, src; sid:1;)";
859 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host, 150, bytes, dst; sid:2;)";
860 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
861 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
862 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
865 uint32_t sid[5] = {1,2,3,4,5};
886 for (; i < num_packets; i++) {
896 if (i == 0 || i == 3 || i == 5 || i == 6)
926 static int DetectTagTestPacket04 (
void)
929 uint8_t *buf = (uint8_t *)
"Hi all!";
930 uint8_t *buf2 = (uint8_t *)
"lalala!";
931 uint16_t buf_len = strlen((
char *)buf);
932 uint16_t buf_len2 = strlen((
char *)buf2);
937 memset(&f, 0,
sizeof(f));
938 memset(&ssn, 0,
sizeof(ssn));
951 if (inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1)
953 if (inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1)
960 memset(&th_v, 0,
sizeof(th_v));
970 "192.168.1.5",
"192.168.1.1",
973 "192.168.1.5",
"192.168.1.1",
976 "192.168.1.5",
"192.168.1.1",
979 "192.168.1.5",
"192.168.1.1",
982 "192.168.1.1",
"192.168.1.5",
985 "192.168.1.1",
"192.168.1.5",
988 "192.168.1.5",
"192.168.1.1",
992 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,4,packets; sid:1;)";
993 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
994 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
995 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
996 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
999 uint32_t sid[5] = {1,2,3,4,5};
1015 int num_packets = 7;
1020 for (; i < num_packets; i++) {
1031 if (i == 0 || i == 4 || i == 5 || i == 6)
1043 if (det_ctx != NULL)
1068 static int DetectTagTestPacket05 (
void)
1071 uint8_t *buf = (uint8_t *)
"Hi all!";
1072 uint8_t *buf2 = (uint8_t *)
"lalala!";
1073 uint16_t buf_len = strlen((
char *)buf);
1074 uint16_t buf_len2 = strlen((
char *)buf2);
1079 memset(&f, 0,
sizeof(f));
1080 memset(&ssn, 0,
sizeof(ssn));
1093 if (inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1)
1095 if (inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1)
1102 memset(&th_v, 0,
sizeof(th_v));
1112 "192.168.1.5",
"192.168.1.1",
1115 "192.168.1.5",
"192.168.1.1",
1118 "192.168.1.5",
"192.168.1.1",
1121 "192.168.1.5",
"192.168.1.1",
1124 "192.168.1.1",
"192.168.1.5",
1127 "192.168.1.1",
"192.168.1.5",
1130 "192.168.1.5",
"192.168.1.1",
1133 const char *sigs[5];
1134 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,8,seconds; sid:1;)";
1135 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1136 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1137 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1138 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1141 uint32_t sid[5] = {1,2,3,4,5};
1157 int num_packets = 7;
1162 for (; i < num_packets; i++) {
1178 if (i == 0 || i == 5 || i == 6)
1190 if (det_ctx != NULL)
1215 static int DetectTagTestPacket06 (
void)
1218 uint8_t *buf = (uint8_t *)
"Hi all!";
1219 uint8_t *buf2 = (uint8_t *)
"lalala!";
1220 uint16_t buf_len = strlen((
char *)buf);
1221 uint16_t buf_len2 = strlen((
char *)buf2);
1226 memset(&f, 0,
sizeof(f));
1227 memset(&ssn, 0,
sizeof(ssn));
1240 if (inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1)
1242 if (inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1)
1249 memset(&th_v, 0,
sizeof(th_v));
1259 "192.168.1.5",
"192.168.1.1",
1262 "192.168.1.5",
"192.168.1.1",
1265 "192.168.1.5",
"192.168.1.1",
1268 "192.168.1.5",
"192.168.1.1",
1271 "192.168.1.1",
"192.168.1.5",
1274 "192.168.1.1",
"192.168.1.5",
1277 "192.168.1.5",
"192.168.1.1",
1280 const char *sigs[5];
1281 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)";
1282 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1283 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1284 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1285 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1288 uint32_t sid[5] = {1,2,3,4,5};
1304 int num_packets = 7;
1309 for (; i < num_packets; i++) {
1321 if (i == 0 || i == 3 || i == 4 || i == 5 || i == 6)
1333 if (det_ctx != NULL)
1358 static int DetectTagTestPacket07 (
void)
1361 uint8_t *buf = (uint8_t *)
"Hi all!";
1362 uint8_t *buf2 = (uint8_t *)
"lalala!";
1363 uint16_t buf_len = strlen((
char *)buf);
1364 uint16_t buf_len2 = strlen((
char *)buf2);
1369 memset(&f, 0,
sizeof(f));
1370 memset(&ssn, 0,
sizeof(ssn));
1383 if (inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1)
1385 if (inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1)
1392 memset(&th_v, 0,
sizeof(th_v));
1402 "192.168.1.5",
"192.168.1.1",
1405 "192.168.1.5",
"192.168.1.1",
1408 "192.168.1.5",
"192.168.1.1",
1411 "192.168.1.5",
"192.168.1.1",
1414 "192.168.1.1",
"192.168.1.5",
1417 "192.168.1.1",
"192.168.1.5",
1420 "192.168.1.5",
"192.168.1.1",
1423 const char *sigs[5];
1424 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)";
1425 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1426 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1427 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1428 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1431 uint32_t sid[5] = {1,2,3,4,5};
1447 int num_packets = 7;
1452 for (; i < num_packets; i++) {
1464 if (i == 0 || i == 6)
1477 if (det_ctx != NULL)