aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix thresholding coding changing unlocked and supposed to be static memory areas.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 16 years ago
parent c969294fef
commit aa736b01d6
3 changed files with 203 additions and 111 deletions
Show Stats Download Patch File Download Diff File

260
src/detect-engine-threshold.c
Unescape Escape View File

@ -2,6 +2,7 @@
/** \file /** \file
* \author Breno Silva <breno.silva@gmail.com> * \author Breno Silva <breno.silva@gmail.com>
* \author Victor Julien <victor@inliniac.net>
*/ */
@ -45,14 +46,16 @@ void PacketAlertHandle(DetectEngineCtx *de_ctx, Signature *sig, Packet *p)
{ {
SCEnter(); SCEnter();
DetectThresholdData *tsh = NULL; /* retrieve the sig match data */
DetectThresholdData *td = SigGetThresholdType(sig,p);
tsh = SigGetThresholdType(sig,p); SCLogDebug("td %p", td);
if (tsh == NULL) { /* if have none just alert, otherwise handle thresholding */
if (td == NULL) {
PacketAlertAppend(p, sig->gid, sig->id, sig->rev, sig->prio, sig->msg); PacketAlertAppend(p, sig->gid, sig->id, sig->rev, sig->prio, sig->msg);
} else { } else {
PacketAlertThreshold(de_ctx,tsh,p,sig); PacketAlertThreshold(de_ctx, td, p, sig);
} }
SCReturn; SCReturn;
@ -64,7 +67,7 @@ void PacketAlertHandle(DetectEngineCtx *de_ctx, Signature *sig, Packet *p)
* \param sig Signature pointer * \param sig Signature pointer
* \param p Packet structure * \param p Packet structure
* *
* \retval tsh Return the threshold options from signature or NULL if not found * \retval tsh Return the threshold data from signature or NULL if not found
*/ */
DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p) DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p)
{ {
@ -77,18 +80,6 @@ DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p)
while (sm != NULL) { while (sm != NULL) {
if (sm->type == DETECT_THRESHOLD) { if (sm->type == DETECT_THRESHOLD) {
tsh = (DetectThresholdData *)sm->ctx; tsh = (DetectThresholdData *)sm->ctx;
if (tsh != NULL) {
if (PKT_IS_IPV4(p))
tsh->ipv = 4;
else if (PKT_IS_IPV6(p))
tsh->ipv = 6;
tsh->sid = sig->id;
tsh->gid = sig->gid;
if (tsh->track == TRACK_DST )
tsh->addr = p->dst;
else if (tsh->track == TRACK_SRC )
tsh->addr = p->src;
}
return tsh; return tsh;
} }
@ -98,7 +89,6 @@ DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p)
return NULL; return NULL;
} }
/** /**
* \brief Search for a threshold data into threshold hash table * \brief Search for a threshold data into threshold hash table
* *
@ -108,23 +98,32 @@ DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p)
* *
* \retval lookup_tsh Return the threshold element * \retval lookup_tsh Return the threshold element
*/ */
DetectThresholdData *ThresholdHashSearch(DetectEngineCtx *de_ctx, DetectThresholdData *tsh_ptr, Packet *p) DetectThresholdEntry *ThresholdHashSearch(DetectEngineCtx *de_ctx, DetectThresholdEntry *tsh_ptr, Packet *p)
{ {
DetectThresholdData *lookup_tsh = NULL; SCEnter();
DetectThresholdEntry *lookup_tsh = NULL;
SCLogDebug("tsh_ptr->track %u", tsh_ptr->track);
if (tsh_ptr->track == TRACK_DST) { if (tsh_ptr->track == TRACK_DST) {
if (PKT_IS_IPV4(p)) if (PKT_IS_IPV4(p)) {
lookup_tsh = HashListTableLookup(de_ctx->ths_ctx.threshold_hash_table_dst, tsh_ptr, sizeof(DetectThresholdData)); SCLogDebug("ipv4 dst");
else if (PKT_IS_IPV6(p)) lookup_tsh = HashListTableLookup(de_ctx->ths_ctx.threshold_hash_table_dst, tsh_ptr, sizeof(DetectThresholdEntry));
lookup_tsh = HashListTableLookup(de_ctx->ths_ctx.threshold_hash_table_dst_ipv6, tsh_ptr, sizeof(DetectThresholdData)); } else if (PKT_IS_IPV6(p)) {
lookup_tsh = HashListTableLookup(de_ctx->ths_ctx.threshold_hash_table_dst_ipv6, tsh_ptr, sizeof(DetectThresholdEntry));
}
} else if (tsh_ptr->track == TRACK_SRC) { } else if (tsh_ptr->track == TRACK_SRC) {
if (PKT_IS_IPV4(p)) if (PKT_IS_IPV4(p)) {
lookup_tsh = HashListTableLookup(de_ctx->ths_ctx.threshold_hash_table_src, tsh_ptr, sizeof(DetectThresholdData)); SCLogDebug("ipv4 src");
else if (PKT_IS_IPV6(p)) lookup_tsh = HashListTableLookup(de_ctx->ths_ctx.threshold_hash_table_src, tsh_ptr, sizeof(DetectThresholdEntry));
lookup_tsh = HashListTableLookup(de_ctx->ths_ctx.threshold_hash_table_src_ipv6, tsh_ptr, sizeof(DetectThresholdData)); } else if (PKT_IS_IPV6(p))
lookup_tsh = HashListTableLookup(de_ctx->ths_ctx.threshold_hash_table_src_ipv6, tsh_ptr, sizeof(DetectThresholdEntry));
} else {
SCLogDebug("no track, weird");
} }
return lookup_tsh; SCReturnPtr(lookup_tsh, "DetectThresholdEntry");
} }
/** /**
@ -141,7 +140,7 @@ DetectThresholdData *ThresholdHashSearch(DetectEngineCtx *de_ctx, DetectThreshol
void ThresholdTimeoutRemove(DetectEngineCtx *de_ctx) void ThresholdTimeoutRemove(DetectEngineCtx *de_ctx)
{ {
struct timeval tv; struct timeval tv;
DetectThresholdData *tsh = NULL; DetectThresholdEntry *tsh = NULL;
HashListTableBucket *next = NULL; HashListTableBucket *next = NULL;
memset(&tv, 0x00, sizeof(tv)); memset(&tv, 0x00, sizeof(tv));
@ -153,18 +152,18 @@ void ThresholdTimeoutRemove(DetectEngineCtx *de_ctx)
while (next != NULL) { while (next != NULL) {
tsh = HashListTableGetListData(next); tsh = HashListTableGetListData(next);
if (tsh && ((tv.tv_sec - tsh->tv_sec1) > tsh->seconds)) { if (tsh && ((tv.tv_sec - tsh->tv_sec1) > tsh->seconds)) {
if (tsh->ipv == 4) { if (tsh->ipv == 4) {
if (tsh->type == TRACK_SRC) { if (tsh->type == TRACK_SRC) {
HashListTableRemove(de_ctx->ths_ctx.threshold_hash_table_src, tsh, sizeof(DetectThresholdData)); HashListTableRemove(de_ctx->ths_ctx.threshold_hash_table_src, tsh, sizeof(DetectThresholdEntry));
} else if (tsh->type == TRACK_DST) { } else if (tsh->type == TRACK_DST) {
HashListTableRemove(de_ctx->ths_ctx.threshold_hash_table_dst, tsh, sizeof(DetectThresholdData)); HashListTableRemove(de_ctx->ths_ctx.threshold_hash_table_dst, tsh, sizeof(DetectThresholdEntry));
} }
} else if (tsh->ipv == 6) { } else if (tsh->ipv == 6) {
if (tsh->type == TRACK_SRC) { if (tsh->type == TRACK_SRC) {
HashListTableRemove(de_ctx->ths_ctx.threshold_hash_table_src_ipv6, tsh, sizeof(DetectThresholdData)); HashListTableRemove(de_ctx->ths_ctx.threshold_hash_table_src_ipv6, tsh, sizeof(DetectThresholdEntry));
} else if (tsh->type == TRACK_DST) { } else if (tsh->type == TRACK_DST) {
HashListTableRemove(de_ctx->ths_ctx.threshold_hash_table_dst_ipv6, tsh, sizeof(DetectThresholdData)); HashListTableRemove(de_ctx->ths_ctx.threshold_hash_table_dst_ipv6, tsh, sizeof(DetectThresholdEntry));
} }
} }
} }
@ -185,20 +184,26 @@ void ThresholdTimeoutRemove(DetectEngineCtx *de_ctx)
* \param p Packet structure * \param p Packet structure
* *
*/ */
void ThresholdHashAdd(DetectEngineCtx *de_ctx, DetectThresholdData *tsh_ptr, Packet *p) void ThresholdHashAdd(DetectEngineCtx *de_ctx, DetectThresholdEntry *tsh_ptr, Packet *p)
{ {
SCEnter();
int ret = 0; int ret = 0;
if (PKT_IS_IPV4(p)) { if (tsh_ptr->ipv == 4) {
if (tsh_ptr->track == TRACK_DST) SCLogDebug("ipv4");
ret = HashListTableAdd(de_ctx->ths_ctx.threshold_hash_table_dst, tsh_ptr, sizeof(DetectThresholdData)); if (tsh_ptr->track == TRACK_DST) {
else if (tsh_ptr->track == TRACK_SRC) SCLogDebug("dst");
ret = HashListTableAdd(de_ctx->ths_ctx.threshold_hash_table_src, tsh_ptr, sizeof(DetectThresholdData)); ret = HashListTableAdd(de_ctx->ths_ctx.threshold_hash_table_dst, tsh_ptr, sizeof(DetectThresholdEntry));
} else if (PKT_IS_IPV6(p)) { } else if (tsh_ptr->track == TRACK_SRC) {
SCLogDebug("src");
ret = HashListTableAdd(de_ctx->ths_ctx.threshold_hash_table_src, tsh_ptr, sizeof(DetectThresholdEntry));
}
} else if (tsh_ptr->ipv == 6) {
if (tsh_ptr->track == TRACK_DST) if (tsh_ptr->track == TRACK_DST)
ret = HashListTableAdd(de_ctx->ths_ctx.threshold_hash_table_dst_ipv6, tsh_ptr, sizeof(DetectThresholdData)); ret = HashListTableAdd(de_ctx->ths_ctx.threshold_hash_table_dst_ipv6, tsh_ptr, sizeof(DetectThresholdEntry));
else if (tsh_ptr->track == TRACK_SRC) else if (tsh_ptr->track == TRACK_SRC)
ret = HashListTableAdd(de_ctx->ths_ctx.threshold_hash_table_src_ipv6, tsh_ptr, sizeof(DetectThresholdData)); ret = HashListTableAdd(de_ctx->ths_ctx.threshold_hash_table_src_ipv6, tsh_ptr, sizeof(DetectThresholdEntry));
} }
if(ret == -1) { if(ret == -1) {
@ -206,6 +211,7 @@ void ThresholdHashAdd(DetectEngineCtx *de_ctx, DetectThresholdData *tsh_ptr, Pac
"failed to add element into the hash table"); "failed to add element into the hash table");
} }
SCReturn;
return; return;
} }
@ -218,116 +224,153 @@ void ThresholdHashAdd(DetectEngineCtx *de_ctx, DetectThresholdData *tsh_ptr, Pac
* \param s Signature structure * \param s Signature structure
* *
*/ */
void PacketAlertThreshold(DetectEngineCtx *de_ctx, DetectThresholdData *tsh_ptr, Packet *p, Signature *s) void PacketAlertThreshold(DetectEngineCtx *de_ctx, DetectThresholdData *td, Packet *p, Signature *s)
{ {
SCEnter();
struct timeval ts; struct timeval ts;
DetectThresholdData *lookup_tsh = NULL; DetectThresholdEntry *lookup_tsh = NULL;
DetectThresholdEntry *ste = NULL;
if (td == NULL)
SCReturn;
/* setup the Entry we use to search our hash with */
ste = malloc(sizeof(DetectThresholdEntry));
if (ste == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "malloc failed: %s", strerror(errno));
SCReturn;
}
memset(ste, 0x00, sizeof(ste));
if (PKT_IS_IPV4(p))
ste->ipv = 4;
else if (PKT_IS_IPV6(p))
ste->ipv = 6;
ste->sid = s->id;
ste->gid = s->gid;
if (td->track == TRACK_DST) {
COPY_ADDRESS(&p->dst, &ste->addr);
} else if (td->track == TRACK_SRC) {
COPY_ADDRESS(&p->src, &ste->addr);
}
ste->track = td->track;
ste->seconds = td->seconds;
if (tsh_ptr == NULL) SCLogDebug("ste %p", ste);
return;
memset(&ts, 0x00, sizeof(ts)); memset(&ts, 0x00, sizeof(ts));
TimeGet(&ts); TimeGet(&ts);
SCMutexLock(&de_ctx->ths_ctx.threshold_table_lock); SCMutexLock(&de_ctx->ths_ctx.threshold_table_lock);
switch(tsh_ptr->type) { switch(td->type) {
case TYPE_LIMIT: case TYPE_LIMIT:
{
SCLogDebug("limit");
lookup_tsh = ThresholdHashSearch(de_ctx,tsh_ptr,p); lookup_tsh = ThresholdHashSearch(de_ctx, ste, p);
SCLogDebug("lookup_tsh %p", lookup_tsh);
if (lookup_tsh != NULL) { if (lookup_tsh != NULL) {
if ((ts.tv_sec - lookup_tsh->tv_sec1) < lookup_tsh->seconds) { if ((ts.tv_sec - lookup_tsh->tv_sec1) < td->seconds) {
if (lookup_tsh->current_count < td->count) {
if (lookup_tsh->current_count < lookup_tsh->count) {
PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg); PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg);
} }
lookup_tsh->current_count++; lookup_tsh->current_count++;
} else { } else {
lookup_tsh->tv_sec1 = ts.tv_sec; lookup_tsh->tv_sec1 = ts.tv_sec;
lookup_tsh->current_count = 1; lookup_tsh->current_count = 1;
PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg); PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg);
} }
} else { } else {
tsh_ptr->tv_sec1 = ts.tv_sec; ste->tv_sec1 = ts.tv_sec;
tsh_ptr->current_count = 1; ste->current_count = 1;
PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg); PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg);
if (tsh_ptr->count == 1) { ThresholdHashAdd(de_ctx, ste, p);
tsh_ptr->current_count = 0; ste = NULL;
} else {
ThresholdHashAdd(de_ctx,tsh_ptr,p);
}
} }
break; break;
}
case TYPE_THRESHOLD: case TYPE_THRESHOLD:
{
SCLogDebug("threshold");
lookup_tsh = ThresholdHashSearch(de_ctx,tsh_ptr,p); lookup_tsh = ThresholdHashSearch(de_ctx, ste, p);
if (lookup_tsh != NULL) { if (lookup_tsh != NULL) {
if ((ts.tv_sec - lookup_tsh->tv_sec1) < lookup_tsh->seconds) { if ((ts.tv_sec - lookup_tsh->tv_sec1) < td->seconds) {
lookup_tsh->current_count++; lookup_tsh->current_count++;
if (lookup_tsh->current_count >= lookup_tsh->count) { if (lookup_tsh->current_count >= td->count) {
PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg); PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg);
lookup_tsh->current_count = 0; lookup_tsh->current_count = 0;
} }
} else { } else {
lookup_tsh->tv_sec1 = ts.tv_sec; lookup_tsh->tv_sec1 = ts.tv_sec;
lookup_tsh->current_count = 1; lookup_tsh->current_count = 1;
} }
} else { } else {
tsh_ptr->current_count = 1; ste->current_count = 1;
tsh_ptr->tv_sec1 = ts.tv_sec; ste->tv_sec1 = ts.tv_sec;
if (tsh_ptr->count == 1) { if (td->count == 1) {
PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg); PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg);
tsh_ptr->current_count = 0; ste->current_count = 0;
} else { } else {
ThresholdHashAdd(de_ctx,tsh_ptr,p); ThresholdHashAdd(de_ctx,ste,p);
ste = NULL;
} }
} }
break; break;
}
case TYPE_BOTH: case TYPE_BOTH:
{
SCLogDebug("both");
lookup_tsh = ThresholdHashSearch(de_ctx,tsh_ptr,p); lookup_tsh = ThresholdHashSearch(de_ctx,ste,p);
if (lookup_tsh != NULL) {
if (lookup_tsh != NULL) { if ((ts.tv_sec - lookup_tsh->tv_sec1) < td->seconds) {
if ((ts.tv_sec - lookup_tsh->tv_sec1) < lookup_tsh->seconds) {
lookup_tsh->current_count++; lookup_tsh->current_count++;
if (lookup_tsh->current_count == lookup_tsh->count) { if (lookup_tsh->current_count == td->count) {
PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg); PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg);
} }
} else { } else {
lookup_tsh->tv_sec1 = ts.tv_sec; lookup_tsh->tv_sec1 = ts.tv_sec;
lookup_tsh->current_count = 1; lookup_tsh->current_count = 1;
} }
} else { } else {
tsh_ptr->current_count = 1; ste->current_count = 1;
tsh_ptr->tv_sec1 = ts.tv_sec; ste->tv_sec1 = ts.tv_sec;
if (tsh_ptr->count == 1) { if (td->count == 1) {
PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg); PacketAlertAppend(p, s->gid, s->id, s->rev, s->prio, s->msg);
tsh_ptr->current_count = 0; ste->current_count = 0;
} else { } else {
ThresholdHashAdd(de_ctx,tsh_ptr,p); ThresholdHashAdd(de_ctx,ste,p);
ste = NULL;
} }
} }
break; break;
}
} }
SCMutexUnlock(&de_ctx->ths_ctx.threshold_table_lock); SCMutexUnlock(&de_ctx->ths_ctx.threshold_table_lock);
if (ste != NULL)
free(ste);
ThresholdTimeoutRemove(de_ctx); ThresholdTimeoutRemove(de_ctx);
SCReturn;
} }
void ThresholdFreeFunc(void *data) void ThresholdFreeFunc(void *data)
{ {
if (data != NULL)
free(data);
return; return;
} }
@ -343,13 +386,16 @@ void ThresholdFreeFunc(void *data)
*/ */
char ThresholdCompareFunc(void *data1, uint16_t len1, void *data2,uint16_t len2) char ThresholdCompareFunc(void *data1, uint16_t len1, void *data2,uint16_t len2)
{ {
DetectThresholdData *a = (DetectThresholdData *)data1; SCEnter();
DetectThresholdData *b = (DetectThresholdData *)data2;
if ((a->sid == b->sid) && (a->gid == b->gid) && (CMP_ADDR(&a->addr,&b->addr))) DetectThresholdEntry *a = (DetectThresholdEntry *)data1;
return 1; DetectThresholdEntry *b = (DetectThresholdEntry *)data2;
return 0; if ((a->sid == b->sid) && (a->gid == b->gid) && (CMP_ADDR(&a->addr,&b->addr))) {
SCReturnInt(1);
}
SCReturnInt(0);
} }
/** /**
@ -363,15 +409,20 @@ char ThresholdCompareFunc(void *data1, uint16_t len1, void *data2,uint16_t len2)
*/ */
uint32_t ThresholdHashFunc(HashListTable *ht, void *data, uint16_t datalen) uint32_t ThresholdHashFunc(HashListTable *ht, void *data, uint16_t datalen)
{ {
DetectThresholdData *dt = (DetectThresholdData *)data; SCEnter();
DetectThresholdEntry *dt = (DetectThresholdEntry *)data;
uint32_t hash = 0; uint32_t hash = 0;
if (dt->ipv == 4) if (dt->ipv == 4)
hash = (dt->sid + dt->gid + dt->addr.addr_data32[0]) % THRESHOLD_HASH_SIZE; hash = (dt->sid + dt->gid + dt->addr.addr_data32[0]);
else if (dt->ipv == 6) else if (dt->ipv == 6)
hash = (dt->sid + dt->gid + dt->addr.addr_data32[0] + dt->addr.addr_data32[1] + dt->addr.addr_data32[2] + dt->addr.addr_data32[3]) % THRESHOLD_HASH_SIZE; hash = (dt->sid + dt->gid + dt->addr.addr_data32[0] + dt->addr.addr_data32[1] + dt->addr.addr_data32[2] + dt->addr.addr_data32[3]);
else {
SCLogDebug("no dt->ipv");
}
return hash; SCReturnInt(hash % THRESHOLD_HASH_SIZE);
} }
/** /**
@ -382,9 +433,12 @@ uint32_t ThresholdHashFunc(HashListTable *ht, void *data, uint16_t datalen)
*/ */
void ThresholdHashInit(DetectEngineCtx *de_ctx) void ThresholdHashInit(DetectEngineCtx *de_ctx)
{ {
if (de_ctx->ths_ctx.threshold_hash_table_dst == NULL || de_ctx->ths_ctx.threshold_hash_table_src == NULL || de_ctx->ths_ctx.threshold_hash_table_src_ipv6 == NULL || de_ctx->ths_ctx.threshold_hash_table_dst_ipv6 == NULL) { if (de_ctx->ths_ctx.threshold_hash_table_dst == NULL ||
de_ctx->ths_ctx.threshold_hash_table_dst = HashListTableInit(THRESHOLD_HASH_SIZE, ThresholdHashFunc, ThresholdCompareFunc, ThresholdFreeFunc); de_ctx->ths_ctx.threshold_hash_table_src == NULL ||
de_ctx->ths_ctx.threshold_hash_table_src_ipv6 == NULL ||
de_ctx->ths_ctx.threshold_hash_table_dst_ipv6 == NULL) {
de_ctx->ths_ctx.threshold_hash_table_dst = HashListTableInit(THRESHOLD_HASH_SIZE, ThresholdHashFunc, ThresholdCompareFunc, ThresholdFreeFunc);
if(de_ctx->ths_ctx.threshold_hash_table_dst == NULL) { if(de_ctx->ths_ctx.threshold_hash_table_dst == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, SCLogError(SC_ERR_MEM_ALLOC,
"Threshold: Failed to initialize ipv4 dst hash table."); "Threshold: Failed to initialize ipv4 dst hash table.");
@ -392,7 +446,6 @@ void ThresholdHashInit(DetectEngineCtx *de_ctx)
} }
de_ctx->ths_ctx.threshold_hash_table_src = HashListTableInit(THRESHOLD_HASH_SIZE, ThresholdHashFunc, ThresholdCompareFunc, ThresholdFreeFunc); de_ctx->ths_ctx.threshold_hash_table_src = HashListTableInit(THRESHOLD_HASH_SIZE, ThresholdHashFunc, ThresholdCompareFunc, ThresholdFreeFunc);
if(de_ctx->ths_ctx.threshold_hash_table_dst == NULL) { if(de_ctx->ths_ctx.threshold_hash_table_dst == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, SCLogError(SC_ERR_MEM_ALLOC,
"Threshold: Failed to initialize ipv4 src hash table."); "Threshold: Failed to initialize ipv4 src hash table.");
@ -400,7 +453,6 @@ void ThresholdHashInit(DetectEngineCtx *de_ctx)
} }
de_ctx->ths_ctx.threshold_hash_table_src_ipv6 = HashListTableInit(THRESHOLD_HASH_SIZE, ThresholdHashFunc, ThresholdCompareFunc, ThresholdFreeFunc); de_ctx->ths_ctx.threshold_hash_table_src_ipv6 = HashListTableInit(THRESHOLD_HASH_SIZE, ThresholdHashFunc, ThresholdCompareFunc, ThresholdFreeFunc);
if(de_ctx->ths_ctx.threshold_hash_table_dst == NULL) { if(de_ctx->ths_ctx.threshold_hash_table_dst == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, SCLogError(SC_ERR_MEM_ALLOC,
"Threshold: Failed to initialize ipv6 src hash table."); "Threshold: Failed to initialize ipv6 src hash table.");
@ -408,7 +460,6 @@ void ThresholdHashInit(DetectEngineCtx *de_ctx)
} }
de_ctx->ths_ctx.threshold_hash_table_dst_ipv6 = HashListTableInit(THRESHOLD_HASH_SIZE, ThresholdHashFunc, ThresholdCompareFunc, ThresholdFreeFunc); de_ctx->ths_ctx.threshold_hash_table_dst_ipv6 = HashListTableInit(THRESHOLD_HASH_SIZE, ThresholdHashFunc, ThresholdCompareFunc, ThresholdFreeFunc);
if(de_ctx->ths_ctx.threshold_hash_table_dst == NULL) { if(de_ctx->ths_ctx.threshold_hash_table_dst == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, SCLogError(SC_ERR_MEM_ALLOC,
"Threshold: Failed to initialize ipv6 dst hash table."); "Threshold: Failed to initialize ipv6 dst hash table.");
@ -420,7 +471,6 @@ void ThresholdHashInit(DetectEngineCtx *de_ctx)
"Threshold: Failed to initialize hash table mutex."); "Threshold: Failed to initialize hash table mutex.");
exit(EXIT_FAILURE); exit(EXIT_FAILURE);
} }
} }
} }

43
src/detect-threshold.c
Unescape Escape View File

@ -13,8 +13,10 @@
#include "stream-tcp.h" #include "stream-tcp.h"
#include "detect-threshold.h" #include "detect-threshold.h"
#include "util-unittest.h" #include "util-unittest.h"
#include "util-byte.h" #include "util-byte.h"
#include "util-debug.h"
#define PARSE_REGEX "^\\s*type\\s+(limit|both|threshold)\\s*,\\s*track\\s+(by_src|by_dst)\\s*,\\s*count\\s+(\\d+)\\s*,\\s*seconds\\s+(\\d+)\\s*" #define PARSE_REGEX "^\\s*type\\s+(limit|both|threshold)\\s*,\\s*track\\s+(by_src|by_dst)\\s*,\\s*count\\s+(\\d+)\\s*,\\s*seconds\\s+(\\d+)\\s*"
@ -398,8 +400,9 @@ static int DetectThresholdTestSig3(void) {
int alerts = 0; int alerts = 0;
IPV4Hdr ip4h; IPV4Hdr ip4h;
struct timeval ts; struct timeval ts;
DetectThresholdData *tsh = NULL; DetectThresholdData *td = NULL;
DetectThresholdData *lookup_tsh = NULL; DetectThresholdEntry *lookup_tsh = NULL;
DetectThresholdEntry *ste = NULL;
memset (&ts, 0, sizeof(struct timeval)); memset (&ts, 0, sizeof(struct timeval));
TimeGet(&ts); TimeGet(&ts);
@ -430,13 +433,41 @@ static int DetectThresholdTestSig3(void) {
SigGroupBuild(de_ctx); SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
tsh = SigGetThresholdType(s,&p); td = SigGetThresholdType(s,&p);
/* setup the Entry we use to search our hash with */
ste = malloc(sizeof(DetectThresholdEntry));
if (ste == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "malloc failed: %s", strerror(errno));
goto end;
}
memset(ste, 0x00, sizeof(ste));
if (PKT_IS_IPV4(&p))
ste->ipv = 4;
else if (PKT_IS_IPV6(&p))
ste->ipv = 6;
ste->sid = s->id;
ste->gid = s->gid;
if (td->track == TRACK_DST) {
COPY_ADDRESS(&p.dst, &ste->addr);
} else if (td->track == TRACK_SRC) {
COPY_ADDRESS(&p.src, &ste->addr);
}
ste->track = td->track;
SigMatchSignatures(&th_v, de_ctx, det_ctx, &p); SigMatchSignatures(&th_v, de_ctx, det_ctx, &p);
SigMatchSignatures(&th_v, de_ctx, det_ctx, &p); SigMatchSignatures(&th_v, de_ctx, det_ctx, &p);
SigMatchSignatures(&th_v, de_ctx, det_ctx, &p); SigMatchSignatures(&th_v, de_ctx, det_ctx, &p);
lookup_tsh = (DetectThresholdData *)HashListTableLookup(de_ctx->ths_ctx.threshold_hash_table_dst, tsh, sizeof(DetectThresholdData)); lookup_tsh = (DetectThresholdEntry *)HashListTableLookup(de_ctx->ths_ctx.threshold_hash_table_dst, ste, sizeof(DetectThresholdEntry));
if (lookup_tsh == NULL) {
printf("lookup_tsh is NULL: ");
goto cleanup;
}
TimeSetIncrementTime(200); TimeSetIncrementTime(200);
@ -449,8 +480,10 @@ static int DetectThresholdTestSig3(void) {
if (alerts == 3) if (alerts == 3)
result = 1; result = 1;
else else {
printf("alerts %u != 3: ", alerts);
goto cleanup; goto cleanup;
}
cleanup: cleanup:
SigGroupCleanup(de_ctx); SigGroupCleanup(de_ctx);

11
src/detect-threshold.h
Unescape Escape View File

@ -31,12 +31,21 @@ typedef struct DetectThresholdData_ {
uint32_t sid; /**< Signature id */ uint32_t sid; /**< Signature id */
uint8_t gid; /**< Signature group id */ uint8_t gid; /**< Signature group id */
uint8_t ipv; /**< Packet ip version */ uint8_t ipv; /**< Packet ip version */
} DetectThresholdData;
typedef struct DetectThresholdEntry_ {
uint8_t type; /**< Threshold type : limit , threshold, both */
uint8_t track; /**< Track type: by_src, by_src */
uint32_t seconds; /**< Event seconds */
uint32_t sid; /**< Signature id */
uint8_t gid; /**< Signature group id */
uint8_t ipv; /**< Packet ip version */
Address addr; /**< Var used to store dst or src addr */ Address addr; /**< Var used to store dst or src addr */
uint32_t tv_sec1; /**< Var for time control */ uint32_t tv_sec1; /**< Var for time control */
uint32_t current_count; /**< Var for count control */ uint32_t current_count; /**< Var for count control */
} DetectThresholdData; } DetectThresholdEntry;
/** /**

Write Preview
Loading…
Cancel
Save