From 2b9d24203373ceb13331b74255f6297334914fac Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 16 Jan 2018 11:54:39 +0100 Subject: [PATCH] thresholds: fix issues with host based thresholds The flow manager thread (that also runs the host cleanup code) would sometimes free a host before it's thresholds are timed out. This would lead to misdetection or too many alerts. This was mostly (only?) visible on slower systems. And was caused by a mismatch between time concepts of the async flow manager thread and the packet threads, resulting in the flow manager using a timestamp that was before the threshold entry creation ts. This would lead to an integer underflow in the timeout check, leading to a incorrect conclusion that the threshold entry was timed out. To address this, check if the 'check' timestamp is not before the creation timestamp. --- src/detect-engine-threshold.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/detect-engine-threshold.c b/src/detect-engine-threshold.c index e639332bb1..8075af19ae 100644 --- a/src/detect-engine-threshold.c +++ b/src/detect-engine-threshold.c @@ -160,7 +160,10 @@ int ThresholdTimeoutCheck(Host *host, struct timeval *tv) prev = NULL; while (tmp != NULL) { - if ((tv->tv_sec - tmp->tv_sec1) <= tmp->seconds) { + /* check if the 'check' timestamp is not before the creation ts. + * This can happen due to the async nature of the host timeout + * code that also calls this code from a management thread. */ + if (((uint32_t)tv->tv_sec < tmp->tv_sec1) || (tv->tv_sec - tmp->tv_sec1) <= tmp->seconds) { prev = tmp; tmp = tmp->next; retval = 0;