57 if (host_tag_id.
id == -1) {
58 FatalError(
"Can't initiate host storage for tag");
61 if (flow_tag_id.
id == -1) {
62 FatalError(
"Can't initiate flow storage for tag");
126 uint16_t tag_cnt = 0;
135 for (; iter != NULL; iter = iter->
next) {
158 if (new_tde != NULL) {
165 SCLogDebug(
"Max tags for sessions reached (%"PRIu16
")", tag_cnt);
205 if (new_tde != NULL) {
217 for (iter =
tag; iter != NULL; iter = iter->
next) {
238 if (new_tde != NULL) {
245 SCLogDebug(
"Max tags for sessions reached (%"PRIu16
")", ntags);
253 static void TagHandlePacketFlow(
Flow *f,
Packet *p)
261 uint8_t flag_added = 0;
263 while (iter != NULL) {
285 SCLogDebug(
"flow tag expired: packets %u > %u",
303 }
else if (flag_added == 0) {
330 }
else if (flag_added == 0) {
341 SCLogDebug(
"flow tag expired: %u - %u = %u > %u",
360 }
else if (flag_added == 0) {
376 static void TagHandlePacketHost(
Host *host,
Packet *p)
381 uint8_t flag_added = 0;
385 while (iter != NULL) {
423 }
else if (flag_added == 0) {
449 }
else if (flag_added == 0) {
460 SCLogDebug(
"host tag expired: %u - %u = %u > %u",
479 }
else if (flag_added == 0) {
530 if (current_tags == 0)
534 if (p->
flow != NULL) {
535 TagHandlePacketFlow(p->
flow, p);
538 Host *
src = GetLockedSrcHost(p);
541 TagHandlePacketHost(
src, p);
546 Host *
dst = GetLockedDstHost(p);
549 TagHandlePacketHost(
dst, p);
578 while (tmp != NULL) {
615 static int DetectTagTestPacket01 (
void)
617 uint8_t *buf = (uint8_t *)
"Hi all!";
618 uint8_t *buf2 = (uint8_t *)
"lalala!";
619 uint16_t buf_len = strlen((
char *)buf);
620 uint16_t buf_len2 = strlen((
char *)buf2);
624 "192.168.1.5",
"192.168.1.1",
627 "192.168.1.5",
"192.168.1.1",
630 "192.168.1.5",
"192.168.1.9",
633 "192.168.1.5",
"192.168.1.9",
636 "192.168.1.1",
"192.168.1.9",
639 "192.168.1.1",
"192.168.1.11",
642 "192.168.1.5",
"192.168.1.11",
646 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,packets,src; sid:1;)";
647 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,4,packets,dst; sid:2;)";
648 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
649 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
650 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
653 uint32_t sid[5] = {1,2,3,4,5};
705 static int DetectTagTestPacket02 (
void)
707 uint8_t *buf = (uint8_t *)
"Hi all!";
708 uint8_t *buf2 = (uint8_t *)
"lalala!";
709 uint16_t buf_len = strlen((
char *)buf);
710 uint16_t buf_len2 = strlen((
char *)buf2);
716 memset(&th_v, 0,
sizeof(th_v));
729 "192.168.1.5",
"192.168.1.1",
732 "192.168.1.5",
"192.168.1.1",
735 "192.168.1.5",
"192.168.1.9",
738 "192.168.1.5",
"192.168.1.9",
741 "192.168.1.1",
"192.168.1.9",
744 "192.168.1.1",
"192.168.1.11",
747 "192.168.1.5",
"192.168.1.11",
751 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,seconds,src; sid:1;)";
752 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,8,seconds,dst; sid:2;)";
753 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
754 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
755 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
758 uint32_t sid[5] = {1,2,3,4,5};
780 for (; i < num_packets; i++) {
790 bool expect = (i == 1 || i == 4);
807 static int DetectTagTestPacket03 (
void)
809 uint8_t *buf = (uint8_t *)
"Hi all!";
810 uint8_t *buf2 = (uint8_t *)
"lalala!";
811 uint16_t buf_len = strlen((
char *)buf);
812 uint16_t buf_len2 = strlen((
char *)buf2);
818 memset(&th_v, 0,
sizeof(th_v));
832 "192.168.1.5",
"192.168.1.1",
835 "192.168.1.5",
"192.168.1.1",
838 "192.168.1.5",
"192.168.1.9",
841 "192.168.1.5",
"192.168.1.9",
844 "192.168.1.1",
"192.168.1.9",
847 "192.168.1.1",
"192.168.1.11",
850 "192.168.1.5",
"192.168.1.11",
854 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host, 150, bytes, src; sid:1;)";
855 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host, 150, bytes, dst; sid:2;)";
856 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
857 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
858 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
861 uint32_t sid[5] = {1,2,3,4,5};
881 for (; i < num_packets; i++) {
889 bool expect = (i == 1 || i == 2 || i == 4);
906 static int DetectTagTestPacket04 (
void)
908 uint8_t *buf = (uint8_t *)
"Hi all!";
909 uint8_t *buf2 = (uint8_t *)
"lalala!";
910 uint16_t buf_len = strlen((
char *)buf);
911 uint16_t buf_len2 = strlen((
char *)buf2);
916 memset(&f, 0,
sizeof(f));
917 memset(&ssn, 0,
sizeof(ssn));
930 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
931 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
937 memset(&th_v, 0,
sizeof(th_v));
945 "192.168.1.5",
"192.168.1.1",
948 "192.168.1.5",
"192.168.1.1",
951 "192.168.1.5",
"192.168.1.1",
954 "192.168.1.5",
"192.168.1.1",
957 "192.168.1.1",
"192.168.1.5",
960 "192.168.1.1",
"192.168.1.5",
963 "192.168.1.5",
"192.168.1.1",
967 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,4,packets; sid:1;)";
968 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
969 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
970 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
971 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
974 uint32_t sid[5] = {1,2,3,4,5};
994 for (; i < num_packets; i++) {
1003 bool expect = (i == 1 || i == 2 || i == 3);
1027 static int DetectTagTestPacket05 (
void)
1029 uint8_t *buf = (uint8_t *)
"Hi all!";
1030 uint8_t *buf2 = (uint8_t *)
"lalala!";
1031 uint16_t buf_len = strlen((
char *)buf);
1032 uint16_t buf_len2 = strlen((
char *)buf2);
1037 memset(&f, 0,
sizeof(f));
1038 memset(&ssn, 0,
sizeof(ssn));
1051 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1052 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1058 memset(&th_v, 0,
sizeof(th_v));
1066 "192.168.1.5",
"192.168.1.1",
1069 "192.168.1.5",
"192.168.1.1",
1072 "192.168.1.5",
"192.168.1.1",
1075 "192.168.1.5",
"192.168.1.1",
1078 "192.168.1.1",
"192.168.1.5",
1081 "192.168.1.1",
"192.168.1.5",
1084 "192.168.1.5",
"192.168.1.1",
1087 const char *sigs[5];
1088 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,8,seconds; sid:1;)";
1089 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1090 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1091 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1092 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1095 uint32_t sid[5] = {1,2,3,4,5};
1110 int num_packets = 7;
1115 for (; i < num_packets; i++) {
1129 bool expect = (i == 1 || i == 2 || i == 3 || i == 4);
1153 static int DetectTagTestPacket06 (
void)
1155 uint8_t *buf = (uint8_t *)
"Hi all!";
1156 uint8_t *buf2 = (uint8_t *)
"lalala!";
1157 uint16_t buf_len = strlen((
char *)buf);
1158 uint16_t buf_len2 = strlen((
char *)buf2);
1163 memset(&f, 0,
sizeof(f));
1164 memset(&ssn, 0,
sizeof(ssn));
1177 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1178 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1184 memset(&th_v, 0,
sizeof(th_v));
1192 "192.168.1.5",
"192.168.1.1",
1195 "192.168.1.5",
"192.168.1.1",
1198 "192.168.1.5",
"192.168.1.1",
1201 "192.168.1.5",
"192.168.1.1",
1204 "192.168.1.1",
"192.168.1.5",
1207 "192.168.1.1",
"192.168.1.5",
1210 "192.168.1.5",
"192.168.1.1",
1213 const char *sigs[5];
1214 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)";
1215 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1216 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1217 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1218 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1221 uint32_t sid[5] = {1,2,3,4,5};
1236 int num_packets = 7;
1241 for (; i < num_packets; i++) {
1251 bool expect = (i == 1 || i == 2);
1275 static int DetectTagTestPacket07 (
void)
1277 uint8_t *buf = (uint8_t *)
"Hi all!";
1278 uint8_t *buf2 = (uint8_t *)
"lalala!";
1279 uint16_t buf_len = strlen((
char *)buf);
1280 uint16_t buf_len2 = strlen((
char *)buf2);
1285 memset(&f, 0,
sizeof(f));
1286 memset(&ssn, 0,
sizeof(ssn));
1299 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1300 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1306 memset(&th_v, 0,
sizeof(th_v));
1314 "192.168.1.5",
"192.168.1.1",
1317 "192.168.1.5",
"192.168.1.1",
1320 "192.168.1.5",
"192.168.1.1",
1323 "192.168.1.5",
"192.168.1.1",
1326 "192.168.1.1",
"192.168.1.5",
1329 "192.168.1.1",
"192.168.1.5",
1332 "192.168.1.5",
"192.168.1.1",
1335 const char *sigs[5];
1336 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)";
1337 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1338 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1339 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1340 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1343 uint32_t sid[5] = {1,2,3,4,5};
1357 int num_packets = 7;
1362 for (; i < num_packets; i++) {
1372 bool expect = (i == 1 || i == 2 || i == 3 || i == 4 || i == 5);