suricata
detect-threshold.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  DetectThresholdData_
 

Macros

#define TYPE_LIMIT   1
 
#define TYPE_BOTH   2
 
#define TYPE_THRESHOLD   3
 
#define TYPE_DETECTION   4
 
#define TYPE_RATE   5
 
#define TYPE_SUPPRESS   6
 
#define TYPE_BACKOFF   7
 
#define TRACK_DST   1
 
#define TRACK_SRC   2
 
#define TRACK_RULE   3
 
#define TRACK_EITHER   4
 
#define TRACK_BOTH   5 /* used by rate_filter to match detections by both src and dst addresses */
 
#define TRACK_FLOW   6
 
#define TH_ACTION_ALERT   0x01
 
#define TH_ACTION_DROP   0x02
 
#define TH_ACTION_PASS   0x04
 
#define TH_ACTION_LOG   0x08
 
#define TH_ACTION_SDROP   0x10
 
#define TH_ACTION_REJECT   0x20
 

Typedefs

typedef struct DetectThresholdData_ DetectThresholdData
 

Functions

void DetectThresholdRegister (void)
 Registration function for threshold: keyword. More...
 
DetectThresholdDataDetectThresholdDataCopy (DetectThresholdData *)
 Make a deep-copy of an extant DetectTHresholdData object. More...
 

Detailed Description

Macro Definition Documentation

◆ TH_ACTION_ALERT

#define TH_ACTION_ALERT   0x01

Definition at line 44 of file detect-threshold.h.

◆ TH_ACTION_DROP

#define TH_ACTION_DROP   0x02

Definition at line 45 of file detect-threshold.h.

◆ TH_ACTION_LOG

#define TH_ACTION_LOG   0x08

Definition at line 47 of file detect-threshold.h.

◆ TH_ACTION_PASS

#define TH_ACTION_PASS   0x04

Definition at line 46 of file detect-threshold.h.

◆ TH_ACTION_REJECT

#define TH_ACTION_REJECT   0x20

Definition at line 49 of file detect-threshold.h.

◆ TH_ACTION_SDROP

#define TH_ACTION_SDROP   0x10

Definition at line 48 of file detect-threshold.h.

◆ TRACK_BOTH

#define TRACK_BOTH   5 /* used by rate_filter to match detections by both src and dst addresses */

Definition at line 40 of file detect-threshold.h.

◆ TRACK_DST

#define TRACK_DST   1

Definition at line 36 of file detect-threshold.h.

◆ TRACK_EITHER

#define TRACK_EITHER   4

either src or dst: only used by suppress

Definition at line 39 of file detect-threshold.h.

◆ TRACK_FLOW

#define TRACK_FLOW   6

track by flow

Definition at line 41 of file detect-threshold.h.

◆ TRACK_RULE

#define TRACK_RULE   3

Definition at line 38 of file detect-threshold.h.

◆ TRACK_SRC

#define TRACK_SRC   2

Definition at line 37 of file detect-threshold.h.

◆ TYPE_BACKOFF

#define TYPE_BACKOFF   7

Definition at line 34 of file detect-threshold.h.

◆ TYPE_BOTH

#define TYPE_BOTH   2

Definition at line 29 of file detect-threshold.h.

◆ TYPE_DETECTION

#define TYPE_DETECTION   4

Definition at line 31 of file detect-threshold.h.

◆ TYPE_LIMIT

#define TYPE_LIMIT   1

Definition at line 28 of file detect-threshold.h.

◆ TYPE_RATE

#define TYPE_RATE   5

Definition at line 32 of file detect-threshold.h.

◆ TYPE_SUPPRESS

#define TYPE_SUPPRESS   6

Definition at line 33 of file detect-threshold.h.

◆ TYPE_THRESHOLD

#define TYPE_THRESHOLD   3

Definition at line 30 of file detect-threshold.h.

Typedef Documentation

◆ DetectThresholdData

Function Documentation

◆ DetectThresholdDataCopy()

DetectThresholdData* DetectThresholdDataCopy ( DetectThresholdData de)

Make a deep-copy of an extant DetectTHresholdData object.

Parameters
depointer to DetectThresholdData

Definition at line 343 of file detect-threshold.c.

References DetectThresholdData_::addrs, de, DetectAddressCopy(), DetectAddressHead_::ipv4_head, DetectAddressHead_::ipv6_head, DetectAddress_::next, DetectAddress_::prev, SCCalloc, and unlikely.

Here is the call graph for this function:

◆ DetectThresholdRegister()

void DetectThresholdRegister ( void  )

Registration function for threshold: keyword.

Registration function for threshold: keyword

Definition at line 86 of file detect-threshold.c.

References SigTableElmt_::desc, DETECT_THRESHOLD, SigTableElmt_::Match, SigTableElmt_::name, sigmatch_table, and SigTableElmt_::url.

Referenced by SigTableSetup().

Here is the caller graph for this function: