From 50e5b80463deed2d67cbcd373136b9bde68032ec Mon Sep 17 00:00:00 2001 From: Todd Mortimer Date: Mon, 30 Mar 2020 23:47:47 +0000 Subject: [PATCH] detect/threshold: Add a common function to (re)allocate the by_rule threshold table. Ensure that the by_rule threshold table is initialized if a rule is thresholded by_rule. Replace manual table reallocaton with calls to the common function. --- src/detect-engine-threshold.c | 25 +++++++++++++++++++++++ src/detect-engine-threshold.h | 1 + src/detect-threshold.c | 3 +++ src/util-threshold-config.c | 38 ++++------------------------------- 4 files changed, 33 insertions(+), 34 deletions(-) diff --git a/src/detect-engine-threshold.c b/src/detect-engine-threshold.c index 95f50463e1..0701403fd4 100644 --- a/src/detect-engine-threshold.c +++ b/src/detect-engine-threshold.c @@ -658,6 +658,31 @@ void ThresholdHashInit(DetectEngineCtx *de_ctx) } } +/** + * \brief Realloc threshold context hash tables + * + * \param de_ctx Detection Context + */ +void ThresholdHashRealloc(DetectEngineCtx *de_ctx) +{ + /* Return if we are already big enough */ + uint32_t num = de_ctx->signum + 1; + if (num <= de_ctx->ths_ctx.th_size) + return; + + void *ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, num * sizeof(DetectThresholdEntry *)); + if (ptmp == NULL) { + SCLogWarning(SC_ERR_MEM_ALLOC, "Error allocating memory for rule thresholds" + " (tried to allocate %"PRIu32" th_entrys for rule tracking)", num); + } else { + de_ctx->ths_ctx.th_entry = ptmp; + for (uint32_t i = de_ctx->ths_ctx.th_size; i < num; ++i) { + de_ctx->ths_ctx.th_entry[i] = NULL; + } + de_ctx->ths_ctx.th_size = num; + } +} + /** * \brief Destroy threshold context hash tables * diff --git a/src/detect-engine-threshold.h b/src/detect-engine-threshold.h index 93f83f039c..9bab025de7 100644 --- a/src/detect-engine-threshold.h +++ b/src/detect-engine-threshold.h @@ -43,6 +43,7 @@ int PacketAlertThreshold(DetectEngineCtx *, DetectEngineThreadCtx *, const Signature *, PacketAlert *); void ThresholdHashInit(DetectEngineCtx *); +void ThresholdHashRealloc(DetectEngineCtx *); void ThresholdContextDestroy(DetectEngineCtx *); int ThresholdHostTimeoutCheck(Host *, struct timeval *); diff --git a/src/detect-threshold.c b/src/detect-threshold.c index 23902fc714..55ccf3c6a4 100644 --- a/src/detect-threshold.c +++ b/src/detect-threshold.c @@ -246,6 +246,9 @@ static int DetectThresholdSetup(DetectEngineCtx *de_ctx, Signature *s, const cha if (de == NULL) goto error; + if (de->track == TRACK_RULE) + ThresholdHashRealloc(de_ctx); + sm = SigMatchAlloc(); if (sm == NULL) goto error; diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c index 23f870438b..f379119de1 100644 --- a/src/util-threshold-config.c +++ b/src/util-threshold-config.c @@ -38,6 +38,7 @@ #include "detect.h" #include "detect-engine.h" #include "detect-engine-address.h" +#include "detect-engine-threshold.h" #include "detect-threshold.h" #include "detect-parse.h" @@ -453,7 +454,6 @@ static int SetupThresholdRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid Signature *s = NULL; SigMatch *sm = NULL; DetectThresholdData *de = NULL; - void *ptmp; BUG_ON(parsed_type == TYPE_SUPPRESS); @@ -505,17 +505,7 @@ static int SetupThresholdRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid sm->ctx = (void *)de; if (parsed_track == TRACK_RULE) { - ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, (de_ctx->ths_ctx.th_size + 1) * sizeof(DetectThresholdEntry *)); - if (ptmp == NULL) { - SCFree(de_ctx->ths_ctx.th_entry); - de_ctx->ths_ctx.th_entry = NULL; - SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for threshold config" - " (tried to allocate %"PRIu32"th_entrys for rule tracking with rate_filter)", de_ctx->ths_ctx.th_size + 1); - } else { - de_ctx->ths_ctx.th_entry = ptmp; - de_ctx->ths_ctx.th_entry[de_ctx->ths_ctx.th_size] = NULL; - de_ctx->ths_ctx.th_size++; - } + ThresholdHashRealloc(de_ctx); } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD); } @@ -558,17 +548,7 @@ static int SetupThresholdRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid sm->ctx = (void *)de; if (parsed_track == TRACK_RULE) { - ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, (de_ctx->ths_ctx.th_size + 1) * sizeof(DetectThresholdEntry *)); - if (ptmp == NULL) { - SCFree(de_ctx->ths_ctx.th_entry); - de_ctx->ths_ctx.th_entry = NULL; - SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for threshold config" - " (tried to allocate %"PRIu32"th_entrys for rule tracking with rate_filter)", de_ctx->ths_ctx.th_size + 1); - } else { - de_ctx->ths_ctx.th_entry = ptmp; - de_ctx->ths_ctx.th_entry[de_ctx->ths_ctx.th_size] = NULL; - de_ctx->ths_ctx.th_size++; - } + ThresholdHashRealloc(de_ctx); } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD); } @@ -642,17 +622,7 @@ static int SetupThresholdRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid sm->ctx = (void *)de; if (parsed_track == TRACK_RULE) { - ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, (de_ctx->ths_ctx.th_size + 1) * sizeof(DetectThresholdEntry *)); - if (ptmp == NULL) { - SCFree(de_ctx->ths_ctx.th_entry); - de_ctx->ths_ctx.th_entry = NULL; - SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for threshold config" - " (tried to allocate %"PRIu32"th_entrys for rule tracking with rate_filter)", de_ctx->ths_ctx.th_size + 1); - } else { - de_ctx->ths_ctx.th_entry = ptmp; - de_ctx->ths_ctx.th_entry[de_ctx->ths_ctx.th_size] = NULL; - de_ctx->ths_ctx.th_size++; - } + ThresholdHashRealloc(de_ctx); } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD);