aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: set new defaults for grouping

Browse Source
pull/1978/head
Victor Julien 10 years ago
parent 2ee9bf2aef
commit 10b049304f
1 changed files with 18 additions and 14 deletions
Show Stats Download Patch File Download Diff File

32
src/detect-engine.c
Unescape Escape View File

@ -1103,13 +1103,13 @@ static uint8_t DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
opt = NULL; opt = NULL;
switch (profile) { switch (profile) {
case ENGINE_PROFILE_LOW: case ENGINE_PROFILE_LOW:
de_ctx->max_uniq_toclient_groups = 3; de_ctx->max_uniq_toclient_groups = 15;
de_ctx->max_uniq_toserver_groups = 3; de_ctx->max_uniq_toserver_groups = 25;
break; break;
case ENGINE_PROFILE_HIGH: case ENGINE_PROFILE_HIGH:
de_ctx->max_uniq_toclient_groups = 20; de_ctx->max_uniq_toclient_groups = 75;
de_ctx->max_uniq_toserver_groups = 40; de_ctx->max_uniq_toserver_groups = 75;
break; break;
case ENGINE_PROFILE_CUSTOM: case ENGINE_PROFILE_CUSTOM:
@ -1124,28 +1124,32 @@ static uint8_t DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
if (max_uniq_toclient_groups_str != NULL) { if (max_uniq_toclient_groups_str != NULL) {
if (ByteExtractStringUint16(&de_ctx->max_uniq_toclient_groups, 10, if (ByteExtractStringUint16(&de_ctx->max_uniq_toclient_groups, 10,
strlen(max_uniq_toclient_groups_str), strlen(max_uniq_toclient_groups_str),
(const char *)max_uniq_toclient_groups_str) <= 0) { (const char *)max_uniq_toclient_groups_str) <= 0)
de_ctx->max_uniq_toclient_groups = 6; {
de_ctx->max_uniq_toclient_groups = 20;
SCLogWarning(SC_ERR_SIZE_PARSE, "parsing '%s' for " SCLogWarning(SC_ERR_SIZE_PARSE, "parsing '%s' for "
"toclient-groups failed, using %u", "toclient-groups failed, using %u",
max_uniq_toclient_groups_str, max_uniq_toclient_groups_str,
de_ctx->max_uniq_toclient_groups); de_ctx->max_uniq_toclient_groups);
} }
} else { } else {
de_ctx->max_uniq_toclient_groups = 6; de_ctx->max_uniq_toclient_groups = 20;
} }
if (max_uniq_toserver_groups_str != NULL) { if (max_uniq_toserver_groups_str != NULL) {
if (ByteExtractStringUint16(&de_ctx->max_uniq_toserver_groups, 10, if (ByteExtractStringUint16(&de_ctx->max_uniq_toserver_groups, 10,
strlen(max_uniq_toserver_groups_str), strlen(max_uniq_toserver_groups_str),
(const char *)max_uniq_toserver_groups_str) <= 0) { (const char *)max_uniq_toserver_groups_str) <= 0)
de_ctx->max_uniq_toserver_groups = 30; {
de_ctx->max_uniq_toserver_groups = 40;
SCLogWarning(SC_ERR_SIZE_PARSE, "parsing '%s' for " SCLogWarning(SC_ERR_SIZE_PARSE, "parsing '%s' for "
"toserver-groups failed, using %u", "toserver-groups failed, using %u",
max_uniq_toserver_groups_str, max_uniq_toserver_groups_str,
de_ctx->max_uniq_toserver_groups); de_ctx->max_uniq_toserver_groups);
} }
} else { } else {
de_ctx->max_uniq_toserver_groups = 30; de_ctx->max_uniq_toserver_groups = 40;
} }
break; break;
@ -1153,8 +1157,8 @@ static uint8_t DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
case ENGINE_PROFILE_MEDIUM: case ENGINE_PROFILE_MEDIUM:
case ENGINE_PROFILE_UNKNOWN: case ENGINE_PROFILE_UNKNOWN:
default: default:
de_ctx->max_uniq_toclient_groups = 6; de_ctx->max_uniq_toclient_groups = 20;
de_ctx->max_uniq_toserver_groups = 30; de_ctx->max_uniq_toserver_groups = 40;
break; break;
} }
@ -3183,8 +3187,8 @@ static int DetectEngineTest09(void)
if (de_ctx == NULL) if (de_ctx == NULL)
goto end; goto end;
if (de_ctx->max_uniq_toclient_groups == 6 && if (de_ctx->max_uniq_toclient_groups == 20 &&
de_ctx->max_uniq_toserver_groups == 30) de_ctx->max_uniq_toserver_groups == 40)
result = 1; result = 1;
end: end:

Write Preview
Loading…
Cancel
Save