57 if (host_tag_id.
id == -1) {
58 FatalError(
"Can't initiate host storage for tag");
61 if (flow_tag_id.
id == -1) {
62 FatalError(
"Can't initiate flow storage for tag");
118 uint16_t tag_cnt = 0;
127 for (; iter != NULL; iter = iter->
next) {
150 if (new_tde != NULL) {
158 SCLogDebug(
"Max tags for sessions reached (%"PRIu16
")", tag_cnt);
198 if (new_tde != NULL) {
210 for (iter =
tag; iter != NULL; iter = iter->
next) {
231 if (new_tde != NULL) {
238 SCLogDebug(
"Max tags for sessions reached (%"PRIu16
")", ntags);
246 static void TagHandlePacketFlow(
Flow *f,
Packet *p)
254 uint8_t flag_added = 0;
256 while (iter != NULL) {
278 SCLogDebug(
"flow tag expired: packets %u > %u",
296 }
else if (flag_added == 0) {
323 }
else if (flag_added == 0) {
335 SCLogDebug(
"flow tag expired: %" PRIu64
" - %" PRIu64
" = %" PRIu64
" > %u",
357 }
else if (flag_added == 0) {
373 static void TagHandlePacketHost(
Host *host,
Packet *p)
378 uint8_t flag_added = 0;
382 while (iter != NULL) {
420 }
else if (flag_added == 0) {
446 }
else if (flag_added == 0) {
457 SCLogDebug(
"host tag expired: %" PRIu64
" - %" PRIu64
" = %" PRIu64
" > %u",
479 }
else if (flag_added == 0) {
529 if (current_tags == 0)
533 if (p->
flow != NULL) {
534 TagHandlePacketFlow(p->
flow, p);
537 Host *
src = GetLockedSrcHost(p);
540 TagHandlePacketHost(
src, p);
545 Host *
dst = GetLockedDstHost(p);
548 TagHandlePacketHost(
dst, p);
577 while (tmp != NULL) {
614 static int DetectTagTestPacket01 (
void)
616 uint8_t *buf = (uint8_t *)
"Hi all!";
617 uint8_t *buf2 = (uint8_t *)
"lalala!";
618 uint16_t buf_len = strlen((
char *)buf);
619 uint16_t buf_len2 = strlen((
char *)buf2);
623 "192.168.1.5",
"192.168.1.1",
626 "192.168.1.5",
"192.168.1.1",
629 "192.168.1.5",
"192.168.1.9",
632 "192.168.1.5",
"192.168.1.9",
635 "192.168.1.1",
"192.168.1.9",
638 "192.168.1.1",
"192.168.1.11",
641 "192.168.1.5",
"192.168.1.11",
645 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,packets,src; sid:1;)";
646 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,4,packets,dst; sid:2;)";
647 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
648 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
649 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
652 uint32_t sid[5] = {1,2,3,4,5};
654 int32_t results[7][5] = {
704 static int DetectTagTestPacket02 (
void)
706 uint8_t *buf = (uint8_t *)
"Hi all!";
707 uint8_t *buf2 = (uint8_t *)
"lalala!";
708 uint16_t buf_len = strlen((
char *)buf);
709 uint16_t buf_len2 = strlen((
char *)buf2);
715 memset(&th_v, 0,
sizeof(th_v));
728 "192.168.1.5",
"192.168.1.1",
731 "192.168.1.5",
"192.168.1.1",
734 "192.168.1.5",
"192.168.1.9",
737 "192.168.1.5",
"192.168.1.9",
740 "192.168.1.1",
"192.168.1.9",
743 "192.168.1.1",
"192.168.1.11",
746 "192.168.1.5",
"192.168.1.11",
750 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,seconds,src; sid:1;)";
751 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,8,seconds,dst; sid:2;)";
752 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
753 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
754 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
757 uint32_t sid[5] = {1,2,3,4,5};
764 int32_t results[7][5] = {
779 for (; i < num_packets; i++) {
789 bool expect = (i == 1 || i == 4);
806 static int DetectTagTestPacket03 (
void)
808 uint8_t *buf = (uint8_t *)
"Hi all!";
809 uint8_t *buf2 = (uint8_t *)
"lalala!";
810 uint16_t buf_len = strlen((
char *)buf);
811 uint16_t buf_len2 = strlen((
char *)buf2);
817 memset(&th_v, 0,
sizeof(th_v));
831 "192.168.1.5",
"192.168.1.1",
834 "192.168.1.5",
"192.168.1.1",
837 "192.168.1.5",
"192.168.1.9",
840 "192.168.1.5",
"192.168.1.9",
843 "192.168.1.1",
"192.168.1.9",
846 "192.168.1.1",
"192.168.1.11",
849 "192.168.1.5",
"192.168.1.11",
853 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host, 150, bytes, src; sid:1;)";
854 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host, 150, bytes, dst; sid:2;)";
855 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
856 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
857 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
860 uint32_t sid[5] = {1,2,3,4,5};
865 int32_t results[7][5] = {
880 for (; i < num_packets; i++) {
888 bool expect = (i == 1 || i == 2 || i == 4);
905 static int DetectTagTestPacket04 (
void)
907 uint8_t *buf = (uint8_t *)
"Hi all!";
908 uint8_t *buf2 = (uint8_t *)
"lalala!";
909 uint16_t buf_len = strlen((
char *)buf);
910 uint16_t buf_len2 = strlen((
char *)buf2);
915 memset(&f, 0,
sizeof(f));
916 memset(&ssn, 0,
sizeof(ssn));
929 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
930 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
936 memset(&th_v, 0,
sizeof(th_v));
944 "192.168.1.5",
"192.168.1.1",
947 "192.168.1.5",
"192.168.1.1",
950 "192.168.1.5",
"192.168.1.1",
953 "192.168.1.5",
"192.168.1.1",
956 "192.168.1.1",
"192.168.1.5",
959 "192.168.1.1",
"192.168.1.5",
962 "192.168.1.5",
"192.168.1.1",
966 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,4,packets; sid:1;)";
967 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
968 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
969 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
970 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
973 uint32_t sid[5] = {1,2,3,4,5};
978 int32_t results[7][5] = {
993 for (; i < num_packets; i++) {
1002 bool expect = (i == 1 || i == 2 || i == 3);
1026 static int DetectTagTestPacket05 (
void)
1028 uint8_t *buf = (uint8_t *)
"Hi all!";
1029 uint8_t *buf2 = (uint8_t *)
"lalala!";
1030 uint16_t buf_len = strlen((
char *)buf);
1031 uint16_t buf_len2 = strlen((
char *)buf2);
1036 memset(&f, 0,
sizeof(f));
1037 memset(&ssn, 0,
sizeof(ssn));
1050 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1051 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1057 memset(&th_v, 0,
sizeof(th_v));
1065 "192.168.1.5",
"192.168.1.1",
1068 "192.168.1.5",
"192.168.1.1",
1071 "192.168.1.5",
"192.168.1.1",
1074 "192.168.1.5",
"192.168.1.1",
1077 "192.168.1.1",
"192.168.1.5",
1080 "192.168.1.1",
"192.168.1.5",
1083 "192.168.1.5",
"192.168.1.1",
1086 const char *sigs[5];
1087 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,8,seconds; sid:1;)";
1088 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1089 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1090 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1091 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1094 uint32_t sid[5] = {1,2,3,4,5};
1099 int32_t results[7][5] = {
1109 int num_packets = 7;
1114 for (; i < num_packets; i++) {
1128 bool expect = (i == 1 || i == 2 || i == 3 || i == 4);
1152 static int DetectTagTestPacket06 (
void)
1154 uint8_t *buf = (uint8_t *)
"Hi all!";
1155 uint8_t *buf2 = (uint8_t *)
"lalala!";
1156 uint16_t buf_len = strlen((
char *)buf);
1157 uint16_t buf_len2 = strlen((
char *)buf2);
1162 memset(&f, 0,
sizeof(f));
1163 memset(&ssn, 0,
sizeof(ssn));
1176 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1177 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1183 memset(&th_v, 0,
sizeof(th_v));
1191 "192.168.1.5",
"192.168.1.1",
1194 "192.168.1.5",
"192.168.1.1",
1197 "192.168.1.5",
"192.168.1.1",
1200 "192.168.1.5",
"192.168.1.1",
1203 "192.168.1.1",
"192.168.1.5",
1206 "192.168.1.1",
"192.168.1.5",
1209 "192.168.1.5",
"192.168.1.1",
1212 const char *sigs[5];
1213 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)";
1214 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1215 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1216 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1217 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1220 uint32_t sid[5] = {1,2,3,4,5};
1225 int32_t results[7][5] = {
1235 int num_packets = 7;
1240 for (; i < num_packets; i++) {
1250 bool expect = (i == 1 || i == 2);
1274 static int DetectTagTestPacket07 (
void)
1276 uint8_t *buf = (uint8_t *)
"Hi all!";
1277 uint8_t *buf2 = (uint8_t *)
"lalala!";
1278 uint16_t buf_len = strlen((
char *)buf);
1279 uint16_t buf_len2 = strlen((
char *)buf2);
1284 memset(&f, 0,
sizeof(f));
1285 memset(&ssn, 0,
sizeof(ssn));
1298 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1299 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1305 memset(&th_v, 0,
sizeof(th_v));
1313 "192.168.1.5",
"192.168.1.1",
1316 "192.168.1.5",
"192.168.1.1",
1319 "192.168.1.5",
"192.168.1.1",
1322 "192.168.1.5",
"192.168.1.1",
1325 "192.168.1.1",
"192.168.1.5",
1328 "192.168.1.1",
"192.168.1.5",
1331 "192.168.1.5",
"192.168.1.1",
1334 const char *sigs[5];
1335 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)";
1336 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1337 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1338 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1339 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1342 uint32_t sid[5] = {1,2,3,4,5};
1346 int32_t results[7][5] = {
1356 int num_packets = 7;
1361 for (; i < num_packets; i++) {
1371 bool expect = (i == 1 || i == 2 || i == 3 || i == 4 || i == 5);