77 return host_threshold_id;
83 if (host_threshold_id.
id == -1) {
85 "Can't initiate host storage for thresholding");
88 if (ippair_threshold_id.
id == -1) {
90 "Can't initiate IP pair storage for thresholding");
166 while (tmp != NULL) {
183 new_head = tmp->
next;
196 if (new_head !=
head) {
199 return new_head == NULL;
207 if (new_head !=
head) {
210 return new_head == NULL;
215 uint32_t sid, uint32_t gid)
233 uint32_t sid, uint32_t gid)
238 if (e->
sid == sid && e->
gid == gid)
246 uint32_t sid, uint32_t gid)
251 if (e->
sid == sid && e->
gid == gid)
258 static int ThresholdHandlePacketSuppress(
Packet *p,
283 "track mode %d is not supported", td->
track);
294 static inline void RateFilterSetAction(
Packet *p,
PacketAlert *pa, uint8_t new_action)
296 switch (new_action) {
358 lookup_tsh->
tv1 = packet_time;
370 e->
tv1 = packet_time;
381 e->
tv1 = packet_time;
407 if (lookup_tsh != NULL) {
417 lookup_tsh->
tv1 = p->
ts;
423 *new_tsh = DetectThresholdEntryAlloc(td, p, sid, gid);
433 if (lookup_tsh != NULL) {
442 lookup_tsh->
tv1 = p->
ts;
446 if (td->
count == 1) {
449 *new_tsh = DetectThresholdEntryAlloc(td, p, sid, gid);
458 if (lookup_tsh != NULL) {
471 lookup_tsh->
tv1 = p->
ts;
480 *new_tsh = DetectThresholdEntryAlloc(td, p, sid, gid);
484 if (td->
count == 1) {
495 if (lookup_tsh != NULL) {
504 lookup_tsh->
tv1 = p->
ts;
508 *new_tsh = DetectThresholdEntryAlloc(td, p, sid, gid);
517 if (lookup_tsh && IsThresholdReached(lookup_tsh, td, p->
ts)) {
519 }
else if (!lookup_tsh) {
520 *new_tsh = DetectThresholdEntryAlloc(td, p, sid, gid);
537 SCLogDebug(
"ippair lookup_tsh %p sid %u gid %u", lookup_tsh, sid, gid);
540 ret = ThresholdHandlePacket(p, lookup_tsh, &new_tsh, td, sid, gid, pa);
541 if (new_tsh != NULL) {
542 AddEntryToIPPairStorage(pair, new_tsh, p->
ts);
558 SCLogDebug(
"lookup_tsh %p sid %u gid %u", lookup_tsh, sid, gid);
561 ret = ThresholdHandlePacket(p, lookup_tsh, &new_tsh, td, sid, gid, pa);
562 if (new_tsh != NULL) {
563 AddEntryToHostStorage(h, new_tsh, p->
ts);
574 SCLogDebug(
"by_rule lookup_tsh %p num %u", lookup_tsh, s->
num);
577 ret = ThresholdHandlePacket(p, lookup_tsh, &new_tsh, td, s->
id, s->
gid, pa);
578 if (new_tsh != NULL) {
579 new_tsh->
tv1 = p->
ts;
611 ret = ThresholdHandlePacketSuppress(p,td,s->
id,s->
gid);
615 ret = ThresholdHandlePacketHost(
src,p,td,s->
id,s->
gid,pa);
621 ret = ThresholdHandlePacketHost(
dst,p,td,s->
id,s->
gid,pa);
627 ret = ThresholdHandlePacketIPPair(pair, p, td, s->
id, s->
gid, pa);
632 ret = ThresholdHandlePacketRule(
de_ctx,p,td,s,pa);
649 "Threshold: Failed to initialize hash table mutex.");
661 bool has_by_rule_tracking =
false;
667 uint32_t highest_signum = 0;
679 if (s->
num >= highest_signum) {
680 highest_signum = s->
num;
681 has_by_rule_tracking =
true;
683 }
while (smd != NULL);
696 if (s->
num >= highest_signum) {
697 highest_signum = s->
num;
698 has_by_rule_tracking =
true;
700 }
while (smd != NULL);
707 if (has_by_rule_tracking ==
false) {
715 "Error allocating memory for rule "
716 "thresholds (tried to allocate %" PRIu32
" th_entrys for "
752 while (entry != NULL) {