78 return host_threshold_id;
84 if (host_threshold_id.
id == -1) {
85 FatalError(
"Can't initiate host storage for thresholding");
88 if (ippair_threshold_id.
id == -1) {
89 FatalError(
"Can't initiate IP pair storage for thresholding");
165 while (tmp != NULL) {
183 new_head = tmp->
next;
196 if (new_head !=
head) {
199 return new_head == NULL;
206 if (new_head !=
head) {
209 return new_head == NULL;
214 uint32_t sid, uint32_t gid)
232 uint32_t sid, uint32_t gid)
237 if (e->
sid == sid && e->
gid == gid)
245 uint32_t sid, uint32_t gid)
250 if (e->
sid == sid && e->
gid == gid)
257 static int ThresholdHandlePacketSuppress(
Packet *p,
292 static inline void RateFilterSetAction(
Packet *p,
PacketAlert *pa, uint8_t new_action)
294 switch (new_action) {
327 static int IsThresholdReached(
356 lookup_tsh->
tv1 = packet_time;
368 e->
tv1 = packet_time;
379 e->
tv1 = packet_time;
405 if (lookup_tsh != NULL) {
416 lookup_tsh->
tv1 = p->
ts;
422 *new_tsh = DetectThresholdEntryAlloc(td, p, sid, gid);
432 if (lookup_tsh != NULL) {
442 lookup_tsh->
tv1 = p->
ts;
446 if (td->
count == 1) {
449 *new_tsh = DetectThresholdEntryAlloc(td, p, sid, gid);
458 if (lookup_tsh != NULL) {
472 lookup_tsh->
tv1 = p->
ts;
481 *new_tsh = DetectThresholdEntryAlloc(td, p, sid, gid);
485 if (td->
count == 1) {
496 if (lookup_tsh != NULL) {
506 lookup_tsh->
tv1 = p->
ts;
510 *new_tsh = DetectThresholdEntryAlloc(td, p, sid, gid);
519 if (lookup_tsh && IsThresholdReached(lookup_tsh, td, p->
ts)) {
521 }
else if (!lookup_tsh) {
522 *new_tsh = DetectThresholdEntryAlloc(td, p, sid, gid);
539 SCLogDebug(
"ippair lookup_tsh %p sid %u gid %u", lookup_tsh, sid, gid);
542 ret = ThresholdHandlePacket(p, lookup_tsh, &new_tsh, td, sid, gid, pa);
543 if (new_tsh != NULL) {
544 AddEntryToIPPairStorage(pair, new_tsh, p->
ts);
560 SCLogDebug(
"lookup_tsh %p sid %u gid %u", lookup_tsh, sid, gid);
563 ret = ThresholdHandlePacket(p, lookup_tsh, &new_tsh, td, sid, gid, pa);
564 if (new_tsh != NULL) {
565 AddEntryToHostStorage(h, new_tsh, p->
ts);
576 SCLogDebug(
"by_rule lookup_tsh %p num %u", lookup_tsh, s->
num);
579 ret = ThresholdHandlePacket(p, lookup_tsh, &new_tsh, td, s->
id, s->
gid, pa);
580 if (new_tsh != NULL) {
581 new_tsh->
tv1 = p->
ts;
613 ret = ThresholdHandlePacketSuppress(p,td,s->
id,s->
gid);
617 ret = ThresholdHandlePacketHost(
src,p,td,s->
id,s->
gid,pa);
623 ret = ThresholdHandlePacketHost(
dst,p,td,s->
id,s->
gid,pa);
629 ret = ThresholdHandlePacketIPPair(pair, p, td, s->
id, s->
gid, pa);
634 ret = ThresholdHandlePacketRule(
de_ctx,p,td,s,pa);
650 FatalError(
"Threshold: Failed to initialize hash table mutex.");
662 bool has_by_rule_tracking =
false;
668 uint32_t highest_signum = 0;
680 if (s->
num >= highest_signum) {
681 highest_signum = s->
num;
682 has_by_rule_tracking =
true;
684 }
while (smd != NULL);
697 if (s->
num >= highest_signum) {
698 highest_signum = s->
num;
699 has_by_rule_tracking =
true;
701 }
while (smd != NULL);
708 if (has_by_rule_tracking ==
false) {
716 "failed to allocate memory for \"by_rule\" thresholding (tried to allocate %" PRIu32
752 while (entry != NULL) {