57 if (host_tag_id.
id == -1) {
58 FatalError(
"Can't initiate host storage for tag");
61 if (flow_tag_id.
id == -1) {
62 FatalError(
"Can't initiate flow storage for tag");
118 uint16_t tag_cnt = 0;
127 for (; iter != NULL; iter = iter->
next) {
150 if (new_tde != NULL) {
158 SCLogDebug(
"Max tags for sessions reached (%"PRIu16
")", tag_cnt);
198 if (new_tde != NULL) {
210 for (iter =
tag; iter != NULL; iter = iter->
next) {
231 if (new_tde != NULL) {
238 SCLogDebug(
"Max tags for sessions reached (%"PRIu16
")", ntags);
246static void TagHandlePacketFlow(
Flow *f,
Packet *p)
254 uint8_t flag_added = 0;
256 while (iter != NULL) {
278 SCLogDebug(
"flow tag expired: packets %u > %u",
296 }
else if (flag_added == 0) {
323 }
else if (flag_added == 0) {
335 SCLogDebug(
"flow tag expired: %" PRIu64
" - %" PRIu64
" = %" PRIu64
" > %u",
357 }
else if (flag_added == 0) {
373static void TagHandlePacketHost(
Host *host,
Packet *p)
378 uint8_t flag_added = 0;
382 while (iter != NULL) {
420 }
else if (flag_added == 0) {
446 }
else if (flag_added == 0) {
457 SCLogDebug(
"host tag expired: %" PRIu64
" - %" PRIu64
" = %" PRIu64
" > %u",
479 }
else if (flag_added == 0) {
529 if (current_tags == 0)
533 if (p->
flow != NULL) {
534 TagHandlePacketFlow(p->
flow, p);
537 Host *
src = GetLockedSrcHost(p);
540 TagHandlePacketHost(
src, p);
545 Host *
dst = GetLockedDstHost(p);
548 TagHandlePacketHost(
dst, p);
577 while (tmp != NULL) {
614static int DetectTagTestPacket01 (
void)
616 uint8_t *buf = (uint8_t *)
"Hi all!";
617 uint8_t *buf2 = (uint8_t *)
"lalala!";
618 uint16_t buf_len = strlen((
char *)buf);
619 uint16_t buf_len2 = strlen((
char *)buf2);
623 "192.168.1.5",
"192.168.1.1",
626 "192.168.1.5",
"192.168.1.1",
629 "192.168.1.5",
"192.168.1.9",
632 "192.168.1.5",
"192.168.1.9",
635 "192.168.1.1",
"192.168.1.9",
638 "192.168.1.1",
"192.168.1.11",
641 "192.168.1.5",
"192.168.1.11",
645 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,packets,src; sid:1;)";
646 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,4,packets,dst; sid:2;)";
647 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
648 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
649 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
652 uint32_t sid[5] = {1,2,3,4,5};
654 int32_t results[7][5] = {
704static int DetectTagTestPacket02 (
void)
706 uint8_t *buf = (uint8_t *)
"Hi all!";
707 uint8_t *buf2 = (uint8_t *)
"lalala!";
708 uint16_t buf_len = strlen((
char *)buf);
709 uint16_t buf_len2 = strlen((
char *)buf2);
715 memset(&th_v, 0,
sizeof(th_v));
728 "192.168.1.5",
"192.168.1.1",
731 "192.168.1.5",
"192.168.1.1",
734 "192.168.1.5",
"192.168.1.9",
737 "192.168.1.5",
"192.168.1.9",
740 "192.168.1.1",
"192.168.1.9",
743 "192.168.1.1",
"192.168.1.11",
746 "192.168.1.5",
"192.168.1.11",
750 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,seconds,src; sid:1;)";
751 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,8,seconds,dst; sid:2;)";
752 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
753 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
754 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
757 uint32_t sid[5] = {1,2,3,4,5};
764 int32_t results[7][5] = {
779 for (; i < num_packets; i++) {
789 bool expect = (i == 1 || i == 4);
806static int DetectTagTestPacket03 (
void)
808 uint8_t *buf = (uint8_t *)
"Hi all!";
809 uint8_t *buf2 = (uint8_t *)
"lalala!";
810 uint16_t buf_len = strlen((
char *)buf);
811 uint16_t buf_len2 = strlen((
char *)buf2);
817 memset(&th_v, 0,
sizeof(th_v));
831 "192.168.1.5",
"192.168.1.1",
834 "192.168.1.5",
"192.168.1.1",
837 "192.168.1.5",
"192.168.1.9",
840 "192.168.1.5",
"192.168.1.9",
843 "192.168.1.1",
"192.168.1.9",
846 "192.168.1.1",
"192.168.1.11",
849 "192.168.1.5",
"192.168.1.11",
853 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host, 150, bytes, src; sid:1;)";
854 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host, 150, bytes, dst; sid:2;)";
855 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
856 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
857 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
860 uint32_t sid[5] = {1,2,3,4,5};
865 int32_t results[7][5] = {
880 for (; i < num_packets; i++) {
888 bool expect = (i == 1 || i == 2 || i == 4);
905static int DetectTagTestPacket04 (
void)
907 uint8_t *buf = (uint8_t *)
"Hi all!";
908 uint8_t *buf2 = (uint8_t *)
"lalala!";
909 uint16_t buf_len = strlen((
char *)buf);
910 uint16_t buf_len2 = strlen((
char *)buf2);
915 memset(&f, 0,
sizeof(f));
916 memset(&ssn, 0,
sizeof(ssn));
929 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
930 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
936 memset(&th_v, 0,
sizeof(th_v));
944 "192.168.1.5",
"192.168.1.1",
947 "192.168.1.5",
"192.168.1.1",
950 "192.168.1.5",
"192.168.1.1",
953 "192.168.1.5",
"192.168.1.1",
956 "192.168.1.1",
"192.168.1.5",
959 "192.168.1.1",
"192.168.1.5",
962 "192.168.1.5",
"192.168.1.1",
966 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,4,packets; sid:1;)";
967 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
968 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
969 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
970 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
973 uint32_t sid[5] = {1,2,3,4,5};
978 int32_t results[7][5] = {
993 for (; i < num_packets; i++) {
1002 bool expect = (i == 1 || i == 2 || i == 3);
1026static int DetectTagTestPacket05 (
void)
1028 uint8_t *buf = (uint8_t *)
"Hi all!";
1029 uint8_t *buf2 = (uint8_t *)
"lalala!";
1030 uint16_t buf_len = strlen((
char *)buf);
1031 uint16_t buf_len2 = strlen((
char *)buf2);
1036 memset(&f, 0,
sizeof(f));
1037 memset(&ssn, 0,
sizeof(ssn));
1050 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1051 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1057 memset(&th_v, 0,
sizeof(th_v));
1065 "192.168.1.5",
"192.168.1.1",
1068 "192.168.1.5",
"192.168.1.1",
1071 "192.168.1.5",
"192.168.1.1",
1074 "192.168.1.5",
"192.168.1.1",
1077 "192.168.1.1",
"192.168.1.5",
1080 "192.168.1.1",
"192.168.1.5",
1083 "192.168.1.5",
"192.168.1.1",
1086 const char *sigs[5];
1087 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,8,seconds; sid:1;)";
1088 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1089 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1090 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1091 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1094 uint32_t sid[5] = {1,2,3,4,5};
1099 int32_t results[7][5] = {
1109 int num_packets = 7;
1114 for (; i < num_packets; i++) {
1128 bool expect = (i == 1 || i == 2 || i == 3 || i == 4);
1152static int DetectTagTestPacket06 (
void)
1154 uint8_t *buf = (uint8_t *)
"Hi all!";
1155 uint8_t *buf2 = (uint8_t *)
"lalala!";
1156 uint16_t buf_len = strlen((
char *)buf);
1157 uint16_t buf_len2 = strlen((
char *)buf2);
1162 memset(&f, 0,
sizeof(f));
1163 memset(&ssn, 0,
sizeof(ssn));
1176 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1177 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1183 memset(&th_v, 0,
sizeof(th_v));
1191 "192.168.1.5",
"192.168.1.1",
1194 "192.168.1.5",
"192.168.1.1",
1197 "192.168.1.5",
"192.168.1.1",
1200 "192.168.1.5",
"192.168.1.1",
1203 "192.168.1.1",
"192.168.1.5",
1206 "192.168.1.1",
"192.168.1.5",
1209 "192.168.1.5",
"192.168.1.1",
1212 const char *sigs[5];
1213 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)";
1214 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1215 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1216 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1217 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1220 uint32_t sid[5] = {1,2,3,4,5};
1225 int32_t results[7][5] = {
1235 int num_packets = 7;
1240 for (; i < num_packets; i++) {
1250 bool expect = (i == 1 || i == 2);
1274static int DetectTagTestPacket07 (
void)
1276 uint8_t *buf = (uint8_t *)
"Hi all!";
1277 uint8_t *buf2 = (uint8_t *)
"lalala!";
1278 uint16_t buf_len = strlen((
char *)buf);
1279 uint16_t buf_len2 = strlen((
char *)buf2);
1284 memset(&f, 0,
sizeof(f));
1285 memset(&ssn, 0,
sizeof(ssn));
1298 FAIL_IF(inet_pton(AF_INET,
"192.168.1.5", f->
src.addr_data32) != 1);
1299 FAIL_IF(inet_pton(AF_INET,
"192.168.1.1", f->
dst.addr_data32) != 1);
1305 memset(&th_v, 0,
sizeof(th_v));
1313 "192.168.1.5",
"192.168.1.1",
1316 "192.168.1.5",
"192.168.1.1",
1319 "192.168.1.5",
"192.168.1.1",
1322 "192.168.1.5",
"192.168.1.1",
1325 "192.168.1.1",
"192.168.1.5",
1328 "192.168.1.1",
"192.168.1.5",
1331 "192.168.1.5",
"192.168.1.1",
1334 const char *sigs[5];
1335 sigs[0]=
"alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)";
1336 sigs[1]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)";
1337 sigs[2]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)";
1338 sigs[3]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)";
1339 sigs[4]=
"alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)";
1342 uint32_t sid[5] = {1,2,3,4,5};
1346 int32_t results[7][5] = {
1356 int num_packets = 7;
1361 for (; i < num_packets; i++) {
1371 bool expect = (i == 1 || i == 2 || i == 3 || i == 4 || i == 5);
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
DetectEngineCtx * DetectEngineCtxInit(void)
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
int TagHashAddTag(DetectTagDataEntry *tde, Packet *p)
Add a tag entry for a host. If it already exist, update it.
int TagFlowAdd(Packet *p, DetectTagDataEntry *tde)
This function is used to add a tag to a session (type session) or update it if it's already installed...
void TagDestroyCtx(void)
Destroy tag context hash tables.
void DetectEngineTagRegisterTests(void)
this function registers unit tests for DetectTag
void TagHandlePacket(const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
Search tags for src and dst. Update entries of the tag, remove if necessary.
int TagTimeoutCheck(Host *host, SCTime_t ts)
Removes the entries exceeding the max timeout value.
int TagHostHasTag(Host *host)
#define TAG_MAX_LAST_TIME_SEEN
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
void DetectTagDataListFree(void *ptr)
this function will free all the entries of a list DetectTagDataEntry
#define TAG_ENTRY_FLAG_DIR_DST
@ DETECT_TAG_METRIC_PACKET
@ DETECT_TAG_METRIC_BYTES
@ DETECT_TAG_METRIC_SECONDS
#define DETECT_TAG_MAX_TAGS
#define TAG_ENTRY_FLAG_DIR_SRC
#define TAG_ENTRY_FLAG_SKIPPED_FIRST
#define DETECT_TAG_MATCH_LIMIT
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
int FlowSetStorageById(Flow *f, FlowStorageId id, void *ptr)
FlowStorageId FlowStorageRegister(const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void(*Free)(void *))
Flow * FlowAlloc(void)
allocate a flow
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
void FlowFree(Flow *f)
cleanup & free the memory of a flow
#define FLOW_INITIALIZE(f)
void FlowInitConfig(bool quiet)
initialize the configuration
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
void FlowShutdown(void)
shutdown the flow engine
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
#define PASS
Pass the test.
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
HostStorageId HostStorageRegister(const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void(*Free)(void *))
Register a Host storage.
int HostSetStorageById(Host *h, HostStorageId id, void *ptr)
Store a pointer in a given Host storage.
void * HostGetStorageById(Host *h, HostStorageId id)
Get a value from a given Host storage.
Host * HostLookupHostFromHash(Address *a)
look up a host in the hash
void HostShutdown(void)
shutdown the flow engine
void HostInitConfig(bool quiet)
initialize the configuration
Host * HostGetHostFromHash(Address *a)
void HostRelease(Host *h)
Structure to hold thread specific data for all decode modules.
main detection engine ctx
struct DetectTagDataEntry_ * next
Per thread variable structure.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
#define SC_ATOMIC_DECLARE(type, name)
wrapper for declaring atomic variables.
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
void StorageCleanup(void)
int StorageFinalize(void)
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
#define SCTIME_CMP_GTE(a, b)
#define SCTIME_ADD_SECS(ts, s)
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.
int UTHAppendSigs(DetectEngineCtx *de_ctx, const char *sigs[], int numsigs)
UTHAppendSigs: Add sigs to the detection_engine checking for errors.
Packet * UTHBuildPacketReal(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst, uint16_t sport, uint16_t dport)
UTHBuildPacketReal is a function that create tcp/udp packets for unittests specifying ip and port sou...
int UTHCheckPacketMatchResults(Packet *p, uint32_t sids[], uint32_t results[], int numsigs)
UTHCheckPacketMatches: function to check if a packet match some sids.
int UTHGenericTest(Packet **pkt, int numpkts, const char *sigs[], uint32_t sids[], uint32_t *results, int numsigs)
UTHGenericTest: function that perform a generic check taking care of as maximum common unittest eleme...