threshold: introduce SigGetThresholdTypeIter function

This patch introduces a function called SigGetThresholdTypeIter
which iterate on all Threshold for a given signature returning
the next DetectThresholdData.
remotes/origin/master-1.1.x
Eric Leblond 14 years ago committed by Victor Julien
parent ab28a6253f
commit e5b638e5e8

@ -64,24 +64,38 @@
#include "tm-threads.h" #include "tm-threads.h"
/** /**
* \brief Check if a certain signature has threshold option * \brief Return next DetectThresholdData for signature
* *
* \param sig Signature pointer * \param sig Signature pointer
* \param p Packet structure * \param p Packet structure
* \param sm Pointer to a Signature Match pointer
* *
* \retval tsh Return the threshold data from signature or NULL if not found * \retval tsh Return the threshold data from signature or NULL if not found
*
*
*/ */
DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p) DetectThresholdData *SigGetThresholdTypeIter(Signature *sig, Packet *p, SigMatch **psm)
{ {
SigMatch *sm = sig->sm_lists_tail[DETECT_SM_LIST_MATCH]; SigMatch *sm = NULL;
DetectThresholdData *tsh = NULL; DetectThresholdData *tsh = NULL;
if (sig == NULL)
return NULL;
if (*psm == NULL) {
sm = sig->sm_lists_tail[DETECT_SM_LIST_MATCH];
} else {
/* Iteration in progress, using provided value */
sm = *psm;
}
if (p == NULL) if (p == NULL)
return NULL; return NULL;
while (sm != NULL) { while (sm != NULL) {
if (sm->type == DETECT_THRESHOLD || sm->type == DETECT_DETECTION_FILTER) { if (sm->type == DETECT_THRESHOLD || sm->type == DETECT_DETECTION_FILTER) {
tsh = (DetectThresholdData *)sm->ctx; tsh = (DetectThresholdData *)sm->ctx;
*psm = sm->prev;
return tsh; return tsh;
} }
@ -91,6 +105,19 @@ DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p)
return NULL; return NULL;
} }
/**
* \brief Check if a certain signature has threshold option
*
* \param sig Signature pointer
* \param p Packet structure
*
* \retval tsh Return the threshold data from signature or NULL if not found
*/
DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p)
{
return SigGetThresholdTypeIter(sig, p, NULL);
}
/** /**
* \brief Search for a threshold data into threshold hash table * \brief Search for a threshold data into threshold hash table
* *

@ -30,6 +30,7 @@
#define THRESHOLD_HASH_SIZE 0xffff #define THRESHOLD_HASH_SIZE 0xffff
DetectThresholdData *SigGetThresholdType(Signature *, Packet *); DetectThresholdData *SigGetThresholdType(Signature *, Packet *);
DetectThresholdData *SigGetThresholdTypeIter(Signature *sig, Packet *p, SigMatch **psm);
int PacketAlertThreshold(DetectEngineCtx *, DetectEngineThreadCtx *, int PacketAlertThreshold(DetectEngineCtx *, DetectEngineThreadCtx *,
DetectThresholdData *, Packet *, Signature *); DetectThresholdData *, Packet *, Signature *);
void ThresholdFreeFunc(void *data); void ThresholdFreeFunc(void *data);

Loading…
Cancel
Save