Thresholding: move parsing code into separate func

pull/558/merge
Victor Julien 12 years ago
parent 8ce38ac8fe
commit 7f0cc97f5b

@ -672,16 +672,12 @@ error:
return -1; return -1;
} }
/** static int ParseThresholdRule(DetectEngineCtx *de_ctx, char *rawstr,
* \brief Parses a line from the threshold file and adds it to Thresholdtype uint32_t *ret_id, uint32_t *ret_gid,
* uint8_t *ret_parsed_type, uint8_t *ret_parsed_track,
* \param rawstr Pointer to the string to be parsed. uint32_t *ret_parsed_count, uint32_t *ret_parsed_seconds, uint32_t *ret_parsed_timeout,
* \param de_ctx Pointer to the Detection Engine Context. uint8_t *ret_parsed_new_action,
* const char **ret_th_ip)
* \retval 0 On success.
* \retval -1 On failure.
*/
int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
{ {
const char *th_rule_type = NULL; const char *th_rule_type = NULL;
const char *th_gid = NULL; const char *th_gid = NULL;
@ -707,7 +703,6 @@ int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
int ov[MAX_SUBSTRINGS]; int ov[MAX_SUBSTRINGS];
uint32_t id = 0, gid = 0; uint32_t id = 0, gid = 0;
ThresholdRuleType rule_type; ThresholdRuleType rule_type;
int fret = -1;
if (de_ctx == NULL) if (de_ctx == NULL)
return -1; return -1;
@ -968,21 +963,16 @@ int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
goto error; goto error;
} }
int r = 0; *ret_id = id;
if (parsed_type == TYPE_SUPPRESS) { *ret_gid = gid;
r = SetupSuppressRule(de_ctx, id, gid, parsed_type, parsed_track, *ret_parsed_type = parsed_type;
parsed_count, parsed_seconds, parsed_timeout, parsed_new_action, *ret_parsed_track = parsed_track;
th_ip); *ret_parsed_new_action = parsed_new_action;
} else { *ret_parsed_count = parsed_count;
r = SetupThresholdRule(de_ctx, id, gid, parsed_type, parsed_track, *ret_parsed_seconds = parsed_seconds;
parsed_count, parsed_seconds, parsed_timeout, parsed_new_action, *ret_parsed_timeout = parsed_timeout;
th_ip); *ret_th_ip = th_ip;
} return 0;
if (r < 0) {
goto error;
}
fret = 0;
error: error:
if (th_rule_type != NULL) if (th_rule_type != NULL)
SCFree((char *)th_rule_type); SCFree((char *)th_rule_type);
@ -1002,7 +992,55 @@ error:
SCFree((char *)th_ip); SCFree((char *)th_ip);
if (rule_extend != NULL) if (rule_extend != NULL)
SCFree((char *)rule_extend); SCFree((char *)rule_extend);
return fret; return -1;
}
/**
* \brief Parses a line from the threshold file and applies it to the
* detection engine
*
* \param rawstr Pointer to the string to be parsed.
* \param de_ctx Pointer to the Detection Engine Context.
*
* \retval 0 On success.
* \retval -1 On failure.
*/
int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
{
uint8_t parsed_type = 0;
uint8_t parsed_track = 0;
uint8_t parsed_new_action = 0;
uint32_t parsed_count = 0;
uint32_t parsed_seconds = 0;
uint32_t parsed_timeout = 0;
const char *th_ip = NULL;
uint32_t id, gid;
int r = 0;
r = ParseThresholdRule(de_ctx, rawstr, &id, &gid, &parsed_type, &parsed_track,
&parsed_count, &parsed_seconds, &parsed_timeout, &parsed_new_action,
&th_ip);
if (r < 0)
goto error;
if (parsed_type == TYPE_SUPPRESS) {
r = SetupSuppressRule(de_ctx, id, gid, parsed_type, parsed_track,
parsed_count, parsed_seconds, parsed_timeout, parsed_new_action,
th_ip);
} else {
r = SetupThresholdRule(de_ctx, id, gid, parsed_type, parsed_track,
parsed_count, parsed_seconds, parsed_timeout, parsed_new_action,
th_ip);
}
if (r < 0) {
goto error;
}
return 0;
error:
if (th_ip != NULL)
SCFree((char *)th_ip);
return -1;
} }
/** /**

Loading…
Cancel
Save