suricata
|
#include "suricata-common.h"
#include "host.h"
#include "ippair.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-engine-address.h"
#include "detect-engine-threshold.h"
#include "detect-threshold.h"
#include "detect-parse.h"
#include "conf.h"
#include "util-threshold-config.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-byte.h"
#include "util-time.h"
#include "util-error.h"
#include "util-debug.h"
#include "util-fmemopen.h"
Go to the source code of this file.
#define | DETECT_BASE_REGEX "^\\s*(event_filter|threshold|rate_filter|suppress)\\s*gen_id\\s*(\\d+)\\s*,\\s*sig_id\\s*(\\d+)\\s*(.*)\\s*$" |
#define | DETECT_THRESHOLD_REGEX "^,\\s*type\\s*(limit|both|threshold)\\s*,\\s*track\\s*(by_dst|by_src)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*$" |
#define | DETECT_RATE_REGEX "^,\\s*track\\s*(by_dst|by_src|by_both|by_rule)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*,\\s*new_action\\s*(alert|drop|pass|log|sdrop|reject)\\s*,\\s*timeout\\s*(\\d+)\\s*$" |
#define | DETECT_SUPPRESS_REGEX "^,\\s*track\\s*(by_dst|by_src|by_either)\\s*,\\s*ip\\s*([\\[\\],\\$\\s\\da-zA-Z.:/_]+)*\\s*$" |
#define | THRESHOLD_CONF_DEF_CONF_FILEPATH CONFIG_DIR "/threshold.config" |
enum | ThresholdRuleType { THRESHOLD_TYPE_EVENT_FILTER, THRESHOLD_TYPE_THRESHOLD, THRESHOLD_TYPE_RATE, THRESHOLD_TYPE_SUPPRESS } |
typedef enum ThresholdRuleType | ThresholdRuleType |
void | SCThresholdConfGlobalInit (void) |
void | SCThresholdConfGlobalFree (void) |
int | SCThresholdConfInitContext (DetectEngineCtx *de_ctx) |
Inits the context to be used by the Threshold Config parsing API. More... | |
void | SCThresholdConfParseFile (DetectEngineCtx *de_ctx, FILE *fp) |
Parses the Threshold Config file. More... | |
void | SCThresholdConfRegisterTests (void) |
This function registers unit tests for Classification Config API. More... | |
Implements Threshold support
Definition in file util-threshold-config.c.
#define DETECT_BASE_REGEX "^\\s*(event_filter|threshold|rate_filter|suppress)\\s*gen_id\\s*(\\d+)\\s*,\\s*sig_id\\s*(\\d+)\\s*(.*)\\s*$" |
Definition at line 69 of file util-threshold-config.c.
#define DETECT_RATE_REGEX "^,\\s*track\\s*(by_dst|by_src|by_both|by_rule)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*,\\s*new_action\\s*(alert|drop|pass|log|sdrop|reject)\\s*,\\s*timeout\\s*(\\d+)\\s*$" |
Definition at line 74 of file util-threshold-config.c.
#define DETECT_SUPPRESS_REGEX "^,\\s*track\\s*(by_dst|by_src|by_either)\\s*,\\s*ip\\s*([\\[\\],\\$\\s\\da-zA-Z.:/_]+)*\\s*$" |
Definition at line 82 of file util-threshold-config.c.
#define DETECT_THRESHOLD_REGEX "^,\\s*type\\s*(limit|both|threshold)\\s*,\\s*track\\s*(by_dst|by_src)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*$" |
Definition at line 71 of file util-threshold-config.c.
#define THRESHOLD_CONF_DEF_CONF_FILEPATH CONFIG_DIR "/threshold.config" |
Definition at line 88 of file util-threshold-config.c.
typedef enum ThresholdRuleType ThresholdRuleType |
enum ThresholdRuleType |
Enumerator | |
---|---|
THRESHOLD_TYPE_EVENT_FILTER | |
THRESHOLD_TYPE_THRESHOLD | |
THRESHOLD_TYPE_RATE | |
THRESHOLD_TYPE_SUPPRESS |
Definition at line 55 of file util-threshold-config.c.
void SCThresholdConfGlobalFree | ( | void | ) |
Definition at line 152 of file util-threshold-config.c.
void SCThresholdConfGlobalInit | ( | void | ) |
Definition at line 104 of file util-threshold-config.c.
Referenced by GlobalsInitPreConfig().
int SCThresholdConfInitContext | ( | DetectEngineCtx * | de_ctx | ) |
Inits the context to be used by the Threshold Config parsing API.
This function initializes the hash table to be used by the Detection Engine Context to hold the data from the threshold.config file, obtains the file desc to parse the threshold.config file, and inits the regex used to parse the lines from threshold.config file.
de_ctx | Pointer to the Detection Engine Context. |
0 | On success. |
-1 | On failure. |
Definition at line 238 of file util-threshold-config.c.
void SCThresholdConfParseFile | ( | DetectEngineCtx * | de_ctx, |
FILE * | fp | ||
) |
Parses the Threshold Config file.
de_ctx | Pointer to the Detection Engine Context. |
fd | Pointer to file descriptor. |
Definition at line 1067 of file util-threshold-config.c.
void SCThresholdConfRegisterTests | ( | void | ) |
This function registers unit tests for Classification Config API.
Definition at line 2694 of file util-threshold-config.c.
References UtRegisterTest().