50 "^\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|" \
51 "by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*$"
55 static int DetectDetectionFilterMatch(
59 static void DetectDetectionFilterRegisterTests(
void);
70 "alert on every match after a threshold has been reached";
84 static int DetectDetectionFilterMatch(
103 int ret = 0, res = 0;
105 const char *str_ptr = NULL;
106 char *args[6] = { NULL, NULL, NULL, NULL, NULL, NULL };
107 char *copy_str = NULL, *df_opt = NULL;
108 int seconds_found = 0, count_found = 0, track_found = 0;
109 int seconds_pos = 0, count_pos = 0;
112 char *saveptr = NULL;
119 for (pos = 0, df_opt = strtok_r(copy_str,
",", &saveptr);
120 pos < strlen(copy_str) && df_opt != NULL;
121 pos++, df_opt = strtok_r(NULL,
",", &saveptr)) {
122 if (strstr(df_opt,
"count"))
124 if (strstr(df_opt,
"second"))
126 if (strstr(df_opt,
"track"))
132 if (count_found != 1 || seconds_found != 1 || track_found != 1)
137 SCLogError(
"pcre_exec parse error, ret %" PRId32
", string %s", ret, rawstr);
149 for (i = 0; i < (ret - 1); i++) {
150 res = pcre2_substring_get_bynumber(
151 parse_regex.
match, i + 1, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
153 SCLogError(
"pcre2_substring_get_bynumber failed");
157 args[i] = (
char *)str_ptr;
159 if (strncasecmp(args[i],
"by_dst", strlen(
"by_dst")) == 0)
161 if (strncasecmp(args[i],
"by_src", strlen(
"by_src")) == 0)
163 if (strncasecmp(args[i],
"count", strlen(
"count")) == 0)
165 if (strncasecmp(args[i],
"seconds", strlen(
"seconds")) == 0)
169 if (args[count_pos] == NULL || args[seconds_pos] == NULL) {
186 for (i = 0; i < 6; i++) {
188 pcre2_substring_free((PCRE2_UCHAR *)args[i]);
193 for (i = 0; i < 6; i++) {
195 pcre2_substring_free((PCRE2_UCHAR *)args[i]);
224 SCLogError(
"\"detection_filter\" and \"threshold\" are not allowed in the same rule");
230 SCLogError(
"At most one \"detection_filter\" is allowed per rule");
234 df = DetectDetectionFilterParse(rawstr);
287 static int DetectDetectionFilterTestParse01(
void)
294 DetectDetectionFilterFree(NULL, df);
303 static int DetectDetectionFilterTestParse02(
void)
316 static int DetectDetectionFilterTestParse03(
void)
318 DetectThresholdData *df = DetectDetectionFilterParse(
"track by_dst, seconds 60, count 10");
323 DetectDetectionFilterFree(NULL, df);
333 static int DetectDetectionFilterTestParse04(
void)
336 DetectDetectionFilterParse(
"count 10, track by_dst, seconds 60, count 10");
347 static int DetectDetectionFilterTestParse05(
void)
349 DetectThresholdData *df = DetectDetectionFilterParse(
"count 10, track by_dst, seconds 60");
354 DetectDetectionFilterFree(NULL, df);
363 static int DetectDetectionFilterTestParse06(
void)
377 static int DetectDetectionFilterTestSig1(
void)
384 memset(&th_v, 0,
sizeof(th_v));
394 "alert tcp any any -> any 80 (msg:\"detection_filter Test\"; detection_filter: "
395 "track by_dst, count 4, seconds 60; sid:1;)");
434 static int DetectDetectionFilterTestSig2(
void)
441 memset(&th_v, 0,
sizeof(th_v));
452 "alert tcp any any -> any 80 (msg:\"detection_filter Test 2\"; "
453 "detection_filter: track by_dst, count 4, seconds 60; sid:10;)");
492 static int DetectDetectionFilterTestSig3(
void)
499 memset(&th_v, 0,
sizeof(th_v));
509 "drop tcp any any -> any 80 (msg:\"detection_filter Test 2\"; "
510 "detection_filter: track by_dst, count 2, seconds 60; sid:10;)");
565 static void DetectDetectionFilterRegisterTests(
void)
567 UtRegisterTest(
"DetectDetectionFilterTestParse01", DetectDetectionFilterTestParse01);
568 UtRegisterTest(
"DetectDetectionFilterTestParse02", DetectDetectionFilterTestParse02);
569 UtRegisterTest(
"DetectDetectionFilterTestParse03", DetectDetectionFilterTestParse03);
570 UtRegisterTest(
"DetectDetectionFilterTestParse04", DetectDetectionFilterTestParse04);
571 UtRegisterTest(
"DetectDetectionFilterTestParse05", DetectDetectionFilterTestParse05);
572 UtRegisterTest(
"DetectDetectionFilterTestParse06", DetectDetectionFilterTestParse06);
573 UtRegisterTest(
"DetectDetectionFilterTestSig1", DetectDetectionFilterTestSig1);
574 UtRegisterTest(
"DetectDetectionFilterTestSig2", DetectDetectionFilterTestSig2);
575 UtRegisterTest(
"DetectDetectionFilterTestSig3", DetectDetectionFilterTestSig3);