50 "^\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|" \
51 "by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*$"
55 static int DetectDetectionFilterMatch(
59 static void DetectDetectionFilterRegisterTests(
void);
70 "alert on every match after a threshold has been reached";
84 static int DetectDetectionFilterMatch(
105 const char *str_ptr = NULL;
106 char *args[6] = { NULL, NULL, NULL, NULL, NULL, NULL };
107 char *copy_str = NULL, *df_opt = NULL;
108 int seconds_found = 0, count_found = 0, track_found = 0;
109 int seconds_pos = 0, count_pos = 0;
112 char *saveptr = NULL;
113 pcre2_match_data *match = NULL;
120 for (pos = 0, df_opt = strtok_r(copy_str,
",", &saveptr);
121 pos < strlen(copy_str) && df_opt != NULL;
122 pos++, df_opt = strtok_r(NULL,
",", &saveptr)) {
123 if (strstr(df_opt,
"count"))
125 if (strstr(df_opt,
"second"))
127 if (strstr(df_opt,
"track"))
133 if (count_found != 1 || seconds_found != 1 || track_found != 1)
138 SCLogError(
"pcre_exec parse error, ret %" PRId32
", string %s", ret, rawstr);
148 for (i = 0; i < (ret - 1); i++) {
149 res = pcre2_substring_get_bynumber(match, i + 1, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
151 SCLogError(
"pcre2_substring_get_bynumber failed");
155 args[i] = (
char *)str_ptr;
157 if (strncasecmp(args[i],
"by_dst", strlen(
"by_dst")) == 0)
159 if (strncasecmp(args[i],
"by_src", strlen(
"by_src")) == 0)
161 if (strncasecmp(args[i],
"count", strlen(
"count")) == 0)
163 if (strncasecmp(args[i],
"seconds", strlen(
"seconds")) == 0)
167 if (args[count_pos] == NULL || args[seconds_pos] == NULL) {
184 for (i = 0; i < 6; i++) {
186 pcre2_substring_free((PCRE2_UCHAR *)args[i]);
189 pcre2_match_data_free(match);
193 for (i = 0; i < 6; i++) {
195 pcre2_substring_free((PCRE2_UCHAR *)args[i]);
200 pcre2_match_data_free(match);
226 SCLogError(
"\"detection_filter\" and \"threshold\" are not allowed in the same rule");
232 SCLogError(
"At most one \"detection_filter\" is allowed per rule");
236 df = DetectDetectionFilterParse(rawstr);
283 static int DetectDetectionFilterTestParse01(
void)
290 DetectDetectionFilterFree(NULL, df);
299 static int DetectDetectionFilterTestParse02(
void)
312 static int DetectDetectionFilterTestParse03(
void)
314 DetectThresholdData *df = DetectDetectionFilterParse(
"track by_dst, seconds 60, count 10");
319 DetectDetectionFilterFree(NULL, df);
329 static int DetectDetectionFilterTestParse04(
void)
332 DetectDetectionFilterParse(
"count 10, track by_dst, seconds 60, count 10");
343 static int DetectDetectionFilterTestParse05(
void)
345 DetectThresholdData *df = DetectDetectionFilterParse(
"count 10, track by_dst, seconds 60");
350 DetectDetectionFilterFree(NULL, df);
359 static int DetectDetectionFilterTestParse06(
void)
373 static int DetectDetectionFilterTestSig1(
void)
380 memset(&th_v, 0,
sizeof(th_v));
390 "alert tcp any any -> any 80 (msg:\"detection_filter Test\"; detection_filter: "
391 "track by_dst, count 4, seconds 60; sid:1;)");
430 static int DetectDetectionFilterTestSig2(
void)
437 memset(&th_v, 0,
sizeof(th_v));
448 "alert tcp any any -> any 80 (msg:\"detection_filter Test 2\"; "
449 "detection_filter: track by_dst, count 4, seconds 60; sid:10;)");
488 static int DetectDetectionFilterTestSig3(
void)
495 memset(&th_v, 0,
sizeof(th_v));
505 "drop tcp any any -> any 80 (msg:\"detection_filter Test 2\"; "
506 "detection_filter: track by_dst, count 2, seconds 60; sid:10;)");
561 static void DetectDetectionFilterRegisterTests(
void)
563 UtRegisterTest(
"DetectDetectionFilterTestParse01", DetectDetectionFilterTestParse01);
564 UtRegisterTest(
"DetectDetectionFilterTestParse02", DetectDetectionFilterTestParse02);
565 UtRegisterTest(
"DetectDetectionFilterTestParse03", DetectDetectionFilterTestParse03);
566 UtRegisterTest(
"DetectDetectionFilterTestParse04", DetectDetectionFilterTestParse04);
567 UtRegisterTest(
"DetectDetectionFilterTestParse05", DetectDetectionFilterTestParse05);
568 UtRegisterTest(
"DetectDetectionFilterTestParse06", DetectDetectionFilterTestParse06);
569 UtRegisterTest(
"DetectDetectionFilterTestSig1", DetectDetectionFilterTestSig1);
570 UtRegisterTest(
"DetectDetectionFilterTestSig2", DetectDetectionFilterTestSig2);
571 UtRegisterTest(
"DetectDetectionFilterTestSig3", DetectDetectionFilterTestSig3);