suricata
detect-threshold.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "host.h"
#include "host-storage.h"
#include "detect.h"
#include "detect-parse.h"
#include "flow-var.h"
#include "decode-events.h"
#include "stream-tcp.h"
#include "detect-threshold.h"
#include "detect-engine-threshold.h"
#include "detect-engine-address.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-byte.h"
#include "util-debug.h"
#include "util-cpu.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "util-time.h"
#include "util-hashlist.h"
Include dependency graph for detect-threshold.c:

Go to the source code of this file.

Macros

#define MAX_SUBSTRINGS   30
 
#define PARSE_REGEX   "^\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*,\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*,\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*,\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*"
 
void DetectThresholdRegister (void)
 Registration function for threshold: keyword. More...
 
void ThresholdRegisterTests (void)
 

Detailed Description

Author
Breno Silva breno.nosp@m..sil.nosp@m.va@gm.nosp@m.ail..nosp@m.com
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Implements the threshold keyword.

The feature depends on what is provided by detect-engine-threshold.c and util-threshold-config.c

Definition in file detect-threshold.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Referenced by DetectThresholdRegister().

#define PARSE_REGEX   "^\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*,\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*,\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*,\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*"

Definition at line 62 of file detect-threshold.c.

Referenced by DetectThresholdRegister().

Function Documentation

void DetectThresholdRegister ( void  )

Registration function for threshold: keyword.

Registration function for threshold: keyword

Definition at line 76 of file detect-threshold.c.

References Packet_::action, ACTION_DROP, DetectThresholdData_::addrs, ByteExtractStringUint32(), DetectThresholdData_::count, SigMatch_::ctx, de, DE_QUIET, SigTableElmt_::desc, DETECT_DETECTION_FILTER, DETECT_SM_LIST_THRESHOLD, DETECT_THRESHOLD, DetectAddressHeadCleanup(), DetectEngineCtxFree(), DetectEngineCtxInit(), DetectEngineThreadCtxDeinit(), DetectEngineThreadCtxInit(), DetectGetLastSMFromLists(), DetectSetupParseRegexes(), DOC_URL, DOC_VERSION, Packet_::dst, Signature_::flags, DetectEngineCtx_::flags, SigTableElmt_::flags, SigTableElmt_::Free, HOST_QUIET, HostGetStorageById(), HostInitConfig(), HostLookupHostFromHash(), HostRelease(), HostShutdown(), SigTableElmt_::Match, MAX_SUBSTRINGS, SigTableElmt_::name, Signature_::next, PACKET_TEST_ACTION, PacketAlertCheck(), PARSE_REGEX, SigTableElmt_::RegisterTests, res, SC_ERR_INVALID_SIGNATURE, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SCFree, SCLogError, SCMalloc, SCReturnInt, SCStrdup, DetectThresholdData_::seconds, SigTableElmt_::Setup, SIG_FLAG_IPONLY, DetectEngineCtx_::sig_list, SigCleanSignatures(), SigGroupBuild(), SigGroupCleanup(), SigInit(), SIGMATCH_IPONLY_COMPAT, sigmatch_table, SigMatchAlloc(), SigMatchAppendSMToList(), SigMatchSignatures(), ThresholdHostHasThreshold(), ThresholdHostStorageId(), ThresholdRegisterTests(), TimeGet(), TimeSetIncrementTime(), DetectThresholdData_::track, TRACK_DST, TRACK_SRC, Packet_::ts, DetectThresholdData_::type, SigMatch_::type, TYPE_BOTH, TYPE_LIMIT, TYPE_THRESHOLD, unlikely, SigTableElmt_::url, UTHBuildPacketReal(), UTHFreePackets(), and UtilCpuGetTicks().

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

void ThresholdRegisterTests ( void  )

This function registers unit tests for Threshold

Definition at line 1478 of file detect-threshold.c.

References UtRegisterTest().

Referenced by DetectThresholdRegister().

Here is the call graph for this function:

Here is the caller graph for this function: