suricata
detect-threshold.h File Reference
#include "decode-events.h"
#include "decode-ipv4.h"
#include "decode-tcp.h"
Include dependency graph for detect-threshold.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  DetectThresholdData_
 
struct  DetectThresholdEntry_
 

Macros

#define TYPE_LIMIT   1
 
#define TYPE_BOTH   2
 
#define TYPE_THRESHOLD   3
 
#define TYPE_DETECTION   4
 
#define TYPE_RATE   5
 
#define TYPE_SUPPRESS   6
 
#define TRACK_DST   1
 
#define TRACK_SRC   2
 
#define TRACK_RULE   3
 
#define TRACK_EITHER   4
 
#define TRACK_BOTH   5 /* used by rate_filter to match detections by both src and dst addresses */
 
#define TH_ACTION_ALERT   0x01
 
#define TH_ACTION_DROP   0x02
 
#define TH_ACTION_PASS   0x04
 
#define TH_ACTION_LOG   0x08
 
#define TH_ACTION_SDROP   0x10
 
#define TH_ACTION_REJECT   0x20
 

Typedefs

typedef struct DetectThresholdData_ DetectThresholdData
 
typedef struct DetectThresholdEntry_ DetectThresholdEntry
 

Functions

void DetectThresholdRegister (void)
 Registration function for threshold: keyword. More...
 
void ThresholdRegisterTests (void)
 

Detailed Description

Macro Definition Documentation

#define TH_ACTION_ALERT   0x01

Definition at line 45 of file detect-threshold.h.

Referenced by SCThresholdConfInitContext(), and ThresholdIPPairTimeoutCheck().

#define TH_ACTION_DROP   0x02

Definition at line 46 of file detect-threshold.h.

Referenced by SCThresholdConfInitContext(), and ThresholdIPPairTimeoutCheck().

#define TH_ACTION_LOG   0x08

Definition at line 48 of file detect-threshold.h.

Referenced by SCThresholdConfInitContext().

#define TH_ACTION_PASS   0x04

Definition at line 47 of file detect-threshold.h.

Referenced by SCThresholdConfInitContext(), and ThresholdIPPairTimeoutCheck().

#define TH_ACTION_REJECT   0x20

Definition at line 50 of file detect-threshold.h.

Referenced by SCThresholdConfInitContext(), and ThresholdIPPairTimeoutCheck().

#define TH_ACTION_SDROP   0x10

Definition at line 49 of file detect-threshold.h.

Referenced by SCThresholdConfInitContext().

#define TRACK_BOTH   5 /* used by rate_filter to match detections by both src and dst addresses */

Definition at line 42 of file detect-threshold.h.

Referenced by PacketAlertThreshold(), and SCThresholdConfInitContext().

#define TRACK_DST   1

Definition at line 38 of file detect-threshold.h.

#define TRACK_EITHER   4

either src or dst: only used by suppress

Definition at line 41 of file detect-threshold.h.

Referenced by SCThresholdConfInitContext(), and ThresholdIPPairTimeoutCheck().

#define TRACK_RULE   3
#define TRACK_SRC   2

Definition at line 39 of file detect-threshold.h.

#define TYPE_DETECTION   4
#define TYPE_RATE   5
#define TYPE_SUPPRESS   6
#define TYPE_THRESHOLD   3

Typedef Documentation

Function Documentation

void DetectThresholdRegister ( void  )

Registration function for threshold: keyword.

Registration function for threshold: keyword

Definition at line 76 of file detect-threshold.c.

References Packet_::action, ACTION_DROP, DetectThresholdData_::addrs, ByteExtractStringUint32(), DetectThresholdData_::count, SigMatch_::ctx, de, DE_QUIET, SigTableElmt_::desc, DETECT_DETECTION_FILTER, DETECT_SM_LIST_THRESHOLD, DETECT_THRESHOLD, DetectAddressHeadCleanup(), DetectEngineCtxFree(), DetectEngineCtxInit(), DetectEngineThreadCtxDeinit(), DetectEngineThreadCtxInit(), DetectGetLastSMFromLists(), DetectSetupParseRegexes(), DOC_URL, DOC_VERSION, Packet_::dst, Signature_::flags, DetectEngineCtx_::flags, SigTableElmt_::flags, SigTableElmt_::Free, HOST_QUIET, HostGetStorageById(), HostInitConfig(), HostLookupHostFromHash(), HostRelease(), HostShutdown(), SigTableElmt_::Match, MAX_SUBSTRINGS, SigTableElmt_::name, Signature_::next, PACKET_TEST_ACTION, PacketAlertCheck(), PARSE_REGEX, SigTableElmt_::RegisterTests, res, SC_ERR_INVALID_SIGNATURE, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_MATCH, SCFree, SCLogError, SCMalloc, SCReturnInt, SCStrdup, DetectThresholdData_::seconds, SigTableElmt_::Setup, SIG_FLAG_IPONLY, DetectEngineCtx_::sig_list, SigCleanSignatures(), SigGroupBuild(), SigGroupCleanup(), SigInit(), SIGMATCH_IPONLY_COMPAT, sigmatch_table, SigMatchAlloc(), SigMatchAppendSMToList(), SigMatchSignatures(), ThresholdHostHasThreshold(), ThresholdHostStorageId(), ThresholdRegisterTests(), TimeGet(), TimeSetIncrementTime(), DetectThresholdData_::track, TRACK_DST, TRACK_SRC, Packet_::ts, DetectThresholdData_::type, SigMatch_::type, TYPE_BOTH, TYPE_LIMIT, TYPE_THRESHOLD, unlikely, SigTableElmt_::url, UTHBuildPacketReal(), UTHFreePackets(), and UtilCpuGetTicks().

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

void ThresholdRegisterTests ( void  )

This function registers unit tests for Threshold

Definition at line 1478 of file detect-threshold.c.

References UtRegisterTest().

Referenced by DetectThresholdRegister().

Here is the call graph for this function:

Here is the caller graph for this function: