detect/threshold: Add a common function to (re)allocate the by_rule threshold table.

Ensure that the by_rule threshold table is initialized if a rule
is thresholded by_rule. Replace manual table reallocaton with calls
to the common function.
pull/4785/head
Todd Mortimer 5 years ago committed by Victor Julien
parent 82dc61f4c3
commit 50e5b80463

@ -658,6 +658,31 @@ void ThresholdHashInit(DetectEngineCtx *de_ctx)
}
}
/**
* \brief Realloc threshold context hash tables
*
* \param de_ctx Detection Context
*/
void ThresholdHashRealloc(DetectEngineCtx *de_ctx)
{
/* Return if we are already big enough */
uint32_t num = de_ctx->signum + 1;
if (num <= de_ctx->ths_ctx.th_size)
return;
void *ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, num * sizeof(DetectThresholdEntry *));
if (ptmp == NULL) {
SCLogWarning(SC_ERR_MEM_ALLOC, "Error allocating memory for rule thresholds"
" (tried to allocate %"PRIu32" th_entrys for rule tracking)", num);
} else {
de_ctx->ths_ctx.th_entry = ptmp;
for (uint32_t i = de_ctx->ths_ctx.th_size; i < num; ++i) {
de_ctx->ths_ctx.th_entry[i] = NULL;
}
de_ctx->ths_ctx.th_size = num;
}
}
/**
* \brief Destroy threshold context hash tables
*

@ -43,6 +43,7 @@ int PacketAlertThreshold(DetectEngineCtx *, DetectEngineThreadCtx *,
const Signature *, PacketAlert *);
void ThresholdHashInit(DetectEngineCtx *);
void ThresholdHashRealloc(DetectEngineCtx *);
void ThresholdContextDestroy(DetectEngineCtx *);
int ThresholdHostTimeoutCheck(Host *, struct timeval *);

@ -246,6 +246,9 @@ static int DetectThresholdSetup(DetectEngineCtx *de_ctx, Signature *s, const cha
if (de == NULL)
goto error;
if (de->track == TRACK_RULE)
ThresholdHashRealloc(de_ctx);
sm = SigMatchAlloc();
if (sm == NULL)
goto error;

@ -38,6 +38,7 @@
#include "detect.h"
#include "detect-engine.h"
#include "detect-engine-address.h"
#include "detect-engine-threshold.h"
#include "detect-threshold.h"
#include "detect-parse.h"
@ -453,7 +454,6 @@ static int SetupThresholdRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid
Signature *s = NULL;
SigMatch *sm = NULL;
DetectThresholdData *de = NULL;
void *ptmp;
BUG_ON(parsed_type == TYPE_SUPPRESS);
@ -505,17 +505,7 @@ static int SetupThresholdRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid
sm->ctx = (void *)de;
if (parsed_track == TRACK_RULE) {
ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, (de_ctx->ths_ctx.th_size + 1) * sizeof(DetectThresholdEntry *));
if (ptmp == NULL) {
SCFree(de_ctx->ths_ctx.th_entry);
de_ctx->ths_ctx.th_entry = NULL;
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for threshold config"
" (tried to allocate %"PRIu32"th_entrys for rule tracking with rate_filter)", de_ctx->ths_ctx.th_size + 1);
} else {
de_ctx->ths_ctx.th_entry = ptmp;
de_ctx->ths_ctx.th_entry[de_ctx->ths_ctx.th_size] = NULL;
de_ctx->ths_ctx.th_size++;
}
ThresholdHashRealloc(de_ctx);
}
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD);
}
@ -558,17 +548,7 @@ static int SetupThresholdRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid
sm->ctx = (void *)de;
if (parsed_track == TRACK_RULE) {
ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, (de_ctx->ths_ctx.th_size + 1) * sizeof(DetectThresholdEntry *));
if (ptmp == NULL) {
SCFree(de_ctx->ths_ctx.th_entry);
de_ctx->ths_ctx.th_entry = NULL;
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for threshold config"
" (tried to allocate %"PRIu32"th_entrys for rule tracking with rate_filter)", de_ctx->ths_ctx.th_size + 1);
} else {
de_ctx->ths_ctx.th_entry = ptmp;
de_ctx->ths_ctx.th_entry[de_ctx->ths_ctx.th_size] = NULL;
de_ctx->ths_ctx.th_size++;
}
ThresholdHashRealloc(de_ctx);
}
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD);
}
@ -642,17 +622,7 @@ static int SetupThresholdRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid
sm->ctx = (void *)de;
if (parsed_track == TRACK_RULE) {
ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, (de_ctx->ths_ctx.th_size + 1) * sizeof(DetectThresholdEntry *));
if (ptmp == NULL) {
SCFree(de_ctx->ths_ctx.th_entry);
de_ctx->ths_ctx.th_entry = NULL;
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for threshold config"
" (tried to allocate %"PRIu32"th_entrys for rule tracking with rate_filter)", de_ctx->ths_ctx.th_size + 1);
} else {
de_ctx->ths_ctx.th_entry = ptmp;
de_ctx->ths_ctx.th_entry[de_ctx->ths_ctx.th_size] = NULL;
de_ctx->ths_ctx.th_size++;
}
ThresholdHashRealloc(de_ctx);
}
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD);

Loading…
Cancel
Save