Thresholding: move parsing code into separate func

pull/558/merge
Victor Julien 12 years ago
parent 8ce38ac8fe
commit 7f0cc97f5b

@ -672,16 +672,12 @@ error:
return -1;
}
/**
* \brief Parses a line from the threshold file and adds it to Thresholdtype
*
* \param rawstr Pointer to the string to be parsed.
* \param de_ctx Pointer to the Detection Engine Context.
*
* \retval 0 On success.
* \retval -1 On failure.
*/
int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
static int ParseThresholdRule(DetectEngineCtx *de_ctx, char *rawstr,
uint32_t *ret_id, uint32_t *ret_gid,
uint8_t *ret_parsed_type, uint8_t *ret_parsed_track,
uint32_t *ret_parsed_count, uint32_t *ret_parsed_seconds, uint32_t *ret_parsed_timeout,
uint8_t *ret_parsed_new_action,
const char **ret_th_ip)
{
const char *th_rule_type = NULL;
const char *th_gid = NULL;
@ -707,7 +703,6 @@ int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
int ov[MAX_SUBSTRINGS];
uint32_t id = 0, gid = 0;
ThresholdRuleType rule_type;
int fret = -1;
if (de_ctx == NULL)
return -1;
@ -968,21 +963,16 @@ int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
goto error;
}
int r = 0;
if (parsed_type == TYPE_SUPPRESS) {
r = SetupSuppressRule(de_ctx, id, gid, parsed_type, parsed_track,
parsed_count, parsed_seconds, parsed_timeout, parsed_new_action,
th_ip);
} else {
r = SetupThresholdRule(de_ctx, id, gid, parsed_type, parsed_track,
parsed_count, parsed_seconds, parsed_timeout, parsed_new_action,
th_ip);
}
if (r < 0) {
goto error;
}
fret = 0;
*ret_id = id;
*ret_gid = gid;
*ret_parsed_type = parsed_type;
*ret_parsed_track = parsed_track;
*ret_parsed_new_action = parsed_new_action;
*ret_parsed_count = parsed_count;
*ret_parsed_seconds = parsed_seconds;
*ret_parsed_timeout = parsed_timeout;
*ret_th_ip = th_ip;
return 0;
error:
if (th_rule_type != NULL)
SCFree((char *)th_rule_type);
@ -1002,7 +992,55 @@ error:
SCFree((char *)th_ip);
if (rule_extend != NULL)
SCFree((char *)rule_extend);
return fret;
return -1;
}
/**
* \brief Parses a line from the threshold file and applies it to the
* detection engine
*
* \param rawstr Pointer to the string to be parsed.
* \param de_ctx Pointer to the Detection Engine Context.
*
* \retval 0 On success.
* \retval -1 On failure.
*/
int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
{
uint8_t parsed_type = 0;
uint8_t parsed_track = 0;
uint8_t parsed_new_action = 0;
uint32_t parsed_count = 0;
uint32_t parsed_seconds = 0;
uint32_t parsed_timeout = 0;
const char *th_ip = NULL;
uint32_t id, gid;
int r = 0;
r = ParseThresholdRule(de_ctx, rawstr, &id, &gid, &parsed_type, &parsed_track,
&parsed_count, &parsed_seconds, &parsed_timeout, &parsed_new_action,
&th_ip);
if (r < 0)
goto error;
if (parsed_type == TYPE_SUPPRESS) {
r = SetupSuppressRule(de_ctx, id, gid, parsed_type, parsed_track,
parsed_count, parsed_seconds, parsed_timeout, parsed_new_action,
th_ip);
} else {
r = SetupThresholdRule(de_ctx, id, gid, parsed_type, parsed_track,
parsed_count, parsed_seconds, parsed_timeout, parsed_new_action,
th_ip);
}
if (r < 0) {
goto error;
}
return 0;
error:
if (th_ip != NULL)
SCFree((char *)th_ip);
return -1;
}
/**

Loading…
Cancel
Save