diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c index 2b17ba2a1d..1cda1a87fb 100644 --- a/src/util-threshold-config.c +++ b/src/util-threshold-config.c @@ -672,16 +672,12 @@ error: return -1; } -/** - * \brief Parses a line from the threshold file and adds it to Thresholdtype - * - * \param rawstr Pointer to the string to be parsed. - * \param de_ctx Pointer to the Detection Engine Context. - * - * \retval 0 On success. - * \retval -1 On failure. - */ -int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx) +static int ParseThresholdRule(DetectEngineCtx *de_ctx, char *rawstr, + uint32_t *ret_id, uint32_t *ret_gid, + uint8_t *ret_parsed_type, uint8_t *ret_parsed_track, + uint32_t *ret_parsed_count, uint32_t *ret_parsed_seconds, uint32_t *ret_parsed_timeout, + uint8_t *ret_parsed_new_action, + const char **ret_th_ip) { const char *th_rule_type = NULL; const char *th_gid = NULL; @@ -707,7 +703,6 @@ int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx) int ov[MAX_SUBSTRINGS]; uint32_t id = 0, gid = 0; ThresholdRuleType rule_type; - int fret = -1; if (de_ctx == NULL) return -1; @@ -968,21 +963,16 @@ int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx) goto error; } - int r = 0; - if (parsed_type == TYPE_SUPPRESS) { - r = SetupSuppressRule(de_ctx, id, gid, parsed_type, parsed_track, - parsed_count, parsed_seconds, parsed_timeout, parsed_new_action, - th_ip); - } else { - r = SetupThresholdRule(de_ctx, id, gid, parsed_type, parsed_track, - parsed_count, parsed_seconds, parsed_timeout, parsed_new_action, - th_ip); - } - if (r < 0) { - goto error; - } - - fret = 0; + *ret_id = id; + *ret_gid = gid; + *ret_parsed_type = parsed_type; + *ret_parsed_track = parsed_track; + *ret_parsed_new_action = parsed_new_action; + *ret_parsed_count = parsed_count; + *ret_parsed_seconds = parsed_seconds; + *ret_parsed_timeout = parsed_timeout; + *ret_th_ip = th_ip; + return 0; error: if (th_rule_type != NULL) SCFree((char *)th_rule_type); @@ -1002,7 +992,55 @@ error: SCFree((char *)th_ip); if (rule_extend != NULL) SCFree((char *)rule_extend); - return fret; + return -1; +} + +/** + * \brief Parses a line from the threshold file and applies it to the + * detection engine + * + * \param rawstr Pointer to the string to be parsed. + * \param de_ctx Pointer to the Detection Engine Context. + * + * \retval 0 On success. + * \retval -1 On failure. + */ +int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx) +{ + uint8_t parsed_type = 0; + uint8_t parsed_track = 0; + uint8_t parsed_new_action = 0; + uint32_t parsed_count = 0; + uint32_t parsed_seconds = 0; + uint32_t parsed_timeout = 0; + const char *th_ip = NULL; + uint32_t id, gid; + + int r = 0; + r = ParseThresholdRule(de_ctx, rawstr, &id, &gid, &parsed_type, &parsed_track, + &parsed_count, &parsed_seconds, &parsed_timeout, &parsed_new_action, + &th_ip); + if (r < 0) + goto error; + + if (parsed_type == TYPE_SUPPRESS) { + r = SetupSuppressRule(de_ctx, id, gid, parsed_type, parsed_track, + parsed_count, parsed_seconds, parsed_timeout, parsed_new_action, + th_ip); + } else { + r = SetupThresholdRule(de_ctx, id, gid, parsed_type, parsed_track, + parsed_count, parsed_seconds, parsed_timeout, parsed_new_action, + th_ip); + } + if (r < 0) { + goto error; + } + + return 0; +error: + if (th_ip != NULL) + SCFree((char *)th_ip); + return -1; } /**