From 50a762bfd164e27c55624c7e4f7e3c2e064ca788 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 16 Jan 2018 11:54:39 +0100 Subject: [PATCH] thresholds: fix issues with host based thresholds The flow manager thread (that also runs the host cleanup code) would sometimes free a host before it's thresholds are timed out. This would lead to misdetection or too many alerts. This was mostly (only?) visible on slower systems. And was caused by a mismatch between time concepts of the async flow manager thread and the packet threads, resulting in the flow manager using a timestamp that was before the threshold entry creation ts. This would lead to an integer underflow in the timeout check, leading to a incorrect conclusion that the threshold entry was timed out. To address this, check if the 'check' timestamp is not before the creation timestamp. --- src/detect-engine-threshold.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/detect-engine-threshold.c b/src/detect-engine-threshold.c index 18f75fe672..efd9513897 100644 --- a/src/detect-engine-threshold.c +++ b/src/detect-engine-threshold.c @@ -171,7 +171,10 @@ static DetectThresholdEntry* ThresholdTimeoutCheck(DetectThresholdEntry *head, s DetectThresholdEntry *new_head = head; while (tmp != NULL) { - if ((tv->tv_sec - tmp->tv_sec1) <= tmp->seconds) { + /* check if the 'check' timestamp is not before the creation ts. + * This can happen due to the async nature of the host timeout + * code that also calls this code from a management thread. */ + if (((uint32_t)tv->tv_sec < tmp->tv_sec1) || (tv->tv_sec - tmp->tv_sec1) <= tmp->seconds) { prev = tmp; tmp = tmp->next; continue;