util-threshold-config.c File Reference

#include "suricata-common.h"
#include "host.h"
#include "ippair.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-engine-address.h"
#include "detect-engine-threshold.h"
#include "detect-threshold.h"
#include "detect-parse.h"
#include "detect-engine-build.h"
#include "conf.h"
#include "util-threshold-config.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-byte.h"
#include "util-time.h"
#include "util-error.h"
#include "util-debug.h"
#include "util-fmemopen.h"
#include "detect-engine-alert.h"
#include "packet.h"
#include "action-globals.h"

Include dependency graph for util-threshold-config.c:

Go to the source code of this file.

#define	DETECT_BASE_REGEX   "^\\s*(event_filter|threshold|rate_filter|suppress)\\s*gen_id\\s*(\\d+)\\s*,\\s*sig_id\\s*(\\d+)\\s*(.*)\\s*$"
#define	DETECT_THRESHOLD_REGEX
#define	DETECT_RATE_REGEX   "^,\\s*track\\s*(by_dst|by_src|by_both|by_rule)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*,\\s*new_action\\s*(alert|drop|pass|log|sdrop|reject)\\s*,\\s*timeout\\s*(\\d+)\\s*$"
#define	DETECT_SUPPRESS_REGEX   "^,\\s*track\\s*(by_dst|by_src|by_either)\\s*,\\s*ip\\s*([\\[\\],\\$\\s\\da-zA-Z.:/_]+)*\\s*$"
#define	THRESHOLD_CONF_DEF_CONF_FILEPATH   CONFIG_DIR "/threshold.config"
enum	ThresholdRuleType { THRESHOLD_TYPE_EVENT_FILTER, THRESHOLD_TYPE_THRESHOLD, THRESHOLD_TYPE_RATE, THRESHOLD_TYPE_SUPPRESS }
typedef enum ThresholdRuleType	ThresholdRuleType
void	SCThresholdConfGlobalInit (void)
void	SCThresholdConfGlobalFree (void)
int	SCThresholdConfInitContext (DetectEngineCtx *de_ctx)
	Inits the context to be used by the Threshold Config parsing API. More...
int	SCThresholdConfParseFile (DetectEngineCtx *de_ctx, FILE *fp)
	Parses the Threshold Config file. More...
void	SCThresholdConfRegisterTests (void)
	This function registers unit tests for Classification Config API. More...

Detailed Description

Author

Breno Silva Pinto breno.nosp@m..sil.nosp@m.va@gm.nosp@m.ail..nosp@m.com

Todo:

Need to support suppress

Implements Threshold support

Definition in file util-threshold-config.c.

Macro Definition Documentation

DETECT_BASE_REGEX

#define DETECT_BASE_REGEX   "^\\s*(event_filter|threshold|rate_filter|suppress)\\s*gen_id\\s*(\\d+)\\s*,\\s*sig_id\\s*(\\d+)\\s*(.*)\\s*$"

Definition at line 70 of file util-threshold-config.c.

DETECT_RATE_REGEX

#define DETECT_RATE_REGEX   "^,\\s*track\\s*(by_dst|by_src|by_both|by_rule)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*,\\s*new_action\\s*(alert|drop|pass|log|sdrop|reject)\\s*,\\s*timeout\\s*(\\d+)\\s*$"

Definition at line 77 of file util-threshold-config.c.

DETECT_SUPPRESS_REGEX

#define DETECT_SUPPRESS_REGEX   "^,\\s*track\\s*(by_dst|by_src|by_either)\\s*,\\s*ip\\s*([\\[\\],\\$\\s\\da-zA-Z.:/_]+)*\\s*$"

Definition at line 85 of file util-threshold-config.c.

DETECT_THRESHOLD_REGEX

#define DETECT_THRESHOLD_REGEX

Value:

    "^,\\s*type\\s*(limit|both|threshold)\\s*,\\s*track\\s*(by_dst|by_src|by_both|by_rule)\\s*,"   \
    "\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*$"

Definition at line 72 of file util-threshold-config.c.

THRESHOLD_CONF_DEF_CONF_FILEPATH

#define THRESHOLD_CONF_DEF_CONF_FILEPATH   CONFIG_DIR "/threshold.config"

Definition at line 91 of file util-threshold-config.c.

Typedef Documentation

ThresholdRuleType

typedef enum ThresholdRuleType ThresholdRuleType

Enumeration Type Documentation

ThresholdRuleType

enum ThresholdRuleType

Enumerator
THRESHOLD_TYPE_EVENT_FILTER
THRESHOLD_TYPE_THRESHOLD
THRESHOLD_TYPE_RATE
THRESHOLD_TYPE_SUPPRESS

Definition at line 56 of file util-threshold-config.c.

Function Documentation

SCThresholdConfGlobalFree()

void SCThresholdConfGlobalFree

(

void

)

Definition at line 155 of file util-threshold-config.c.

SCThresholdConfGlobalInit()

void SCThresholdConfGlobalInit

(

void

)

Definition at line 107 of file util-threshold-config.c.

Referenced by GlobalsInitPreConfig().

Here is the caller graph for this function:

SCThresholdConfInitContext()

int SCThresholdConfInitContext

(

DetectEngineCtx *

de_ctx

)

Inits the context to be used by the Threshold Config parsing API.

   This function initializes the hash table to be used by the Detection
   Engine Context to hold the data from the threshold.config file,
   obtains the file desc to parse the threshold.config file, and
   inits the regex used to parse the lines from threshold.config
   file.

Parameters

de_ctx

Pointer to the Detection Engine Context.

Return values

0	On success.
-1	On failure.

Definition at line 241 of file util-threshold-config.c.

SCThresholdConfParseFile()

int SCThresholdConfParseFile	(	DetectEngineCtx *	de_ctx,
		FILE *	fp
	)

Parses the Threshold Config file.

Parameters

de_ctx	Pointer to the Detection Engine Context.
fd	Pointer to file descriptor.

Definition at line 1084 of file util-threshold-config.c.

SCThresholdConfRegisterTests()

void SCThresholdConfRegisterTests

(

void

)

This function registers unit tests for Classification Config API.

Definition at line 2678 of file util-threshold-config.c.

References UtRegisterTest().

Here is the call graph for this function: