57 if (host_tag_id.
id == -1) {
58 FatalError(
"Can't initiate host storage for tag");
61 if (flow_tag_id.
id == -1) {
62 FatalError(
"Can't initiate flow storage for tag");
127 uint16_t tag_cnt = 0;
136 for (; iter != NULL; iter = iter->
next) {
159 if (new_tde != NULL) {
166 SCLogDebug(
"Max tags for sessions reached (%"PRIu16
")", tag_cnt);
206 if (new_tde != NULL) {
218 for (iter =
tag; iter != NULL; iter = iter->
next) {
239 if (new_tde != NULL) {
246 SCLogDebug(
"Max tags for sessions reached (%"PRIu16
")", ntags);
254 static void TagHandlePacketFlow(
Flow *f,
Packet *p)
262 uint8_t flag_added = 0;
264 while (iter != NULL) {
286 SCLogDebug(
"flow tag expired: packets %u > %u",
304 }
else if (flag_added == 0) {
331 }
else if (flag_added == 0) {
342 SCLogDebug(
"flow tag expired: %u - %u = %u > %u",
361 }
else if (flag_added == 0) {
377 static void TagHandlePacketHost(
Host *host,
Packet *p)
382 uint8_t flag_added = 0;
386 while (iter != NULL) {
424 }
else if (flag_added == 0) {
450 }
else if (flag_added == 0) {
461 SCLogDebug(
"host tag expired: %u - %u = %u > %u",
480 }
else if (flag_added == 0) {
511 if (current_tags == 0)
515 if (p->
flow != NULL) {
516 TagHandlePacketFlow(p->
flow, p);
522 TagHandlePacketHost(
src,p);
529 TagHandlePacketHost(
dst,p);
557 while (tmp != NULL) {
594 static int DetectTagTestPacket01 (
void)
596 uint8_t *buf = (uint8_t *)
"Hi all!";
597 uint8_t *buf2 = (uint8_t *)
"lalala!";
598 uint16_t buf_len = strlen((
char *)buf);
599 uint16_t buf_len2 = strlen((
char *)buf2);
603 "192.168.1.5",
"192.168.1.1",
606 "192.168.1.5",
"192.168.1.1",
609 "192.168.1.5",
"192.168.1.9",
612 "192.168.1.5",
"192.168.1.9",
615 "192.168.1.1",
"192.168.1.9",
618 "192.168.1.1",
"192.168.1.11",
621 "192.168.1.5",
"192.168.1.11",
625 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,packets,src; sid:1;)";
626 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,4,packets,dst; sid:2;)";
627 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
628 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
629 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
632 uint32_t sid[5] = {1,2,3,4,5};
684 static int DetectTagTestPacket02 (
void)
686 uint8_t *buf = (uint8_t *)
"Hi all!";
687 uint8_t *buf2 = (uint8_t *)
"lalala!";
688 uint16_t buf_len = strlen((
char *)buf);
689 uint16_t buf_len2 = strlen((
char *)buf2);
695 memset(&th_v, 0,
sizeof(th_v));
708 "192.168.1.5",
"192.168.1.1",
711 "192.168.1.5",
"192.168.1.1",
714 "192.168.1.5",
"192.168.1.9",
717 "192.168.1.5",
"192.168.1.9",
720 "192.168.1.1",
"192.168.1.9",
723 "192.168.1.1",
"192.168.1.11",
726 "192.168.1.5",
"192.168.1.11",
730 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,seconds,src; sid:1;)";
731 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,8,seconds,dst; sid:2;)";
732 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
733 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
734 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
737 uint32_t sid[5] = {1,2,3,4,5};
759 for (; i < num_packets; i++) {
769 bool expect = (i == 1 || i == 4);
786 static int DetectTagTestPacket03 (
void)
788 uint8_t *buf = (uint8_t *)
"Hi all!";
789 uint8_t *buf2 = (uint8_t *)
"lalala!";
790 uint16_t buf_len = strlen((
char *)buf);
791 uint16_t buf_len2 = strlen((
char *)buf2);
797 memset(&th_v, 0,
sizeof(th_v));
811 "192.168.1.5",
"192.168.1.1",
814 "192.168.1.5",
"192.168.1.1",
817 "192.168.1.5",
"192.168.1.9",
820 "192.168.1.5",
"192.168.1.9",
823 "192.168.1.1",
"192.168.1.9",
826 "192.168.1.1",
"192.168.1.11",
829 "192.168.1.5",
"192.168.1.11",
833 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host, 150, bytes, src; sid:1;)";
834 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host, 150, bytes, dst; sid:2;)";
835 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
836 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
837 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
840 uint32_t sid[5] = {1,2,3,4,5};
860 for (; i < num_packets; i++) {
868 bool expect = (i == 1 || i == 2 || i == 4);
885 static int DetectTagTestPacket04 (
void)
887 uint8_t *buf = (uint8_t *)
"Hi all!";
888 uint8_t *buf2 = (uint8_t *)
"lalala!";
889 uint16_t buf_len = strlen((
char *)buf);
890 uint16_t buf_len2 = strlen((
char *)buf2);
895 memset(&f, 0,
sizeof(f));
896 memset(&ssn, 0,
sizeof(ssn));
909 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
910 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
916 memset(&th_v, 0,
sizeof(th_v));
924 "192.168.1.5",
"192.168.1.1",
927 "192.168.1.5",
"192.168.1.1",
930 "192.168.1.5",
"192.168.1.1",
933 "192.168.1.5",
"192.168.1.1",
936 "192.168.1.1",
"192.168.1.5",
939 "192.168.1.1",
"192.168.1.5",
942 "192.168.1.5",
"192.168.1.1",
946 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,4,packets; sid:1;)";
947 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
948 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
949 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
950 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
953 uint32_t sid[5] = {1,2,3,4,5};
973 for (; i < num_packets; i++) {
982 bool expect = (i == 1 || i == 2 || i == 3);
1006 static int DetectTagTestPacket05 (
void)
1008 uint8_t *buf = (uint8_t *)
"Hi all!";
1009 uint8_t *buf2 = (uint8_t *)
"lalala!";
1010 uint16_t buf_len = strlen((
char *)buf);
1011 uint16_t buf_len2 = strlen((
char *)buf2);
1016 memset(&f, 0,
sizeof(f));
1017 memset(&ssn, 0,
sizeof(ssn));
1030 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1031 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1037 memset(&th_v, 0,
sizeof(th_v));
1045 "192.168.1.5",
"192.168.1.1",
1048 "192.168.1.5",
"192.168.1.1",
1051 "192.168.1.5",
"192.168.1.1",
1054 "192.168.1.5",
"192.168.1.1",
1057 "192.168.1.1",
"192.168.1.5",
1060 "192.168.1.1",
"192.168.1.5",
1063 "192.168.1.5",
"192.168.1.1",
1066 const char *sigs[5];
1067 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,8,seconds; sid:1;)";
1068 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1069 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1070 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1071 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1074 uint32_t sid[5] = {1,2,3,4,5};
1089 int num_packets = 7;
1094 for (; i < num_packets; i++) {
1108 bool expect = (i == 1 || i == 2 || i == 3 || i == 4);
1132 static int DetectTagTestPacket06 (
void)
1134 uint8_t *buf = (uint8_t *)
"Hi all!";
1135 uint8_t *buf2 = (uint8_t *)
"lalala!";
1136 uint16_t buf_len = strlen((
char *)buf);
1137 uint16_t buf_len2 = strlen((
char *)buf2);
1142 memset(&f, 0,
sizeof(f));
1143 memset(&ssn, 0,
sizeof(ssn));
1156 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1157 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1163 memset(&th_v, 0,
sizeof(th_v));
1171 "192.168.1.5",
"192.168.1.1",
1174 "192.168.1.5",
"192.168.1.1",
1177 "192.168.1.5",
"192.168.1.1",
1180 "192.168.1.5",
"192.168.1.1",
1183 "192.168.1.1",
"192.168.1.5",
1186 "192.168.1.1",
"192.168.1.5",
1189 "192.168.1.5",
"192.168.1.1",
1192 const char *sigs[5];
1193 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)";
1194 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1195 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1196 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1197 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1200 uint32_t sid[5] = {1,2,3,4,5};
1215 int num_packets = 7;
1220 for (; i < num_packets; i++) {
1230 bool expect = (i == 1 || i == 2);
1254 static int DetectTagTestPacket07 (
void)
1256 uint8_t *buf = (uint8_t *)
"Hi all!";
1257 uint8_t *buf2 = (uint8_t *)
"lalala!";
1258 uint16_t buf_len = strlen((
char *)buf);
1259 uint16_t buf_len2 = strlen((
char *)buf2);
1264 memset(&f, 0,
sizeof(f));
1265 memset(&ssn, 0,
sizeof(ssn));
1278 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1279 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1285 memset(&th_v, 0,
sizeof(th_v));
1293 "192.168.1.5",
"192.168.1.1",
1296 "192.168.1.5",
"192.168.1.1",
1299 "192.168.1.5",
"192.168.1.1",
1302 "192.168.1.5",
"192.168.1.1",
1305 "192.168.1.1",
"192.168.1.5",
1308 "192.168.1.1",
"192.168.1.5",
1311 "192.168.1.5",
"192.168.1.1",
1314 const char *sigs[5];
1315 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)";
1316 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1317 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1318 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1319 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1322 uint32_t sid[5] = {1,2,3,4,5};
1336 int num_packets = 7;
1341 for (; i < num_packets; i++) {
1351 bool expect = (i == 1 || i == 2 || i == 3 || i == 4 || i == 5);