21 Commits (bc3311329cf880ec7524f81632ee9034bd3248a0)

Author	SHA1	Message	Date
Jeff Lucovsky	31793aface	time: Replace struct timeval with scalar value ... Issue: 5718 This commit switches the majority of time handling to a new type -- SCTime_t -- which is a 64 bit container for time: - 44 bits -- seconds - 20 bits -- useconds	4 years ago
Philippe Antoine	02f2602dde	src: rework includes as per cppclean	4 years ago
Jeff Lucovsky	e873632a28	detect/threshold: Function to deep-copy thresh obj ... This commit adds a function to make a deep copy of a DetectThresholdData object. The function is used when parsing threshold.config items to make a one-time object and then add copies as needed.	5 years ago
Victor Julien	6ab323d323	detect: hide RegisterTests behind ifdef UNITTESTS ... Update all callers to more aggressively use UNITTESTS guards as well.	6 years ago
Todd Mortimer	82dc61f4c3	detect/threshold: Refactor threshold calculation to handle by_rule and by_both. ... The only difference between threshold calculations for by_src/by_dst, by_rule or by_both is which table stores the DetectThresholdEntry. Refactor the ThresholdHandlePacket* functions to do table lookup and storage individually, but calculate thresholds in a common function.	6 years ago
Ruslan Usmanov	1090ee9d8d	rate_filter by_both through IPPair storage ... Ticket https://redmine.openinfosecfoundation.org/issues/2127	9 years ago
Victor Julien	ebb42f831c	suppress: add track by_either mode ... So far suppress rules would apply to src or dst addresses of a packet. This meant that if a ip would need to suppressed both as src and as dst, 2 suppress rules would be needed. This patch introduces track by_either, which means that the ip(s) in the suppress rule are tested against both the packets source and dest ip's. If either of them is on the suppress list, the alert is suppressed.	11 years ago
Victor Julien	e85a44c383	suppress: support ip-lists ... Ticket: 1137 Support supplying a list of IP's to the suppress keyword. Variables from the address-groups and negation is supported. The same logic (and code) is used that is also used in parting the IP portions of regular detection rules.	11 years ago
Ken Steele	a63b87df9e	Clean up function syntax ... Remove space before ( in function names. Put { on new line. Make tests static.	13 years ago
Anoop Saldanha	b48a686d65	considering the tenths of a seconds in a packet, when calculating thresholds	14 years ago
Victor Julien	c0a2cbd478	Move over src and dst thresholding to use host table. Fix a bug in threshold 'both' handling.	15 years ago
Eric Leblond	8787e6f6d0	suppress: use DetectAddress instead of DetectAddressHead	15 years ago
Eric Leblond	03c185a3ad	threshold: add suppress keyword ... This patch adds the suppress keyword to the threshold.config file. The alerts are suppressed but the other elements like flowbits are maintained.	15 years ago
Pablo Rincon	1ae36b9a6a	Adding rate_filter support for threshold.config, multiline support and unittests	16 years ago
Victor Julien	4c3e17d4ab	Fix thresholding issues.	16 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	16 years ago
Gerardo Iglesias Galvan	ef2ae76c42	Add support for detection_filter keyword	17 years ago
Victor Julien	aa736b01d6	Fix thresholding coding changing unlocked and supposed to be static memory areas.	17 years ago
Victor Julien	6ab64706b0	Improve threshold hash table handling.	17 years ago
Breno Silva	69eb869cc9	Threshold Rule	17 years ago
Victor Julien	bab4b62376	Initial add of the files.	17 years ago