23374838686

Committed 21 Mar 2026 07:29AM UTC coverage: 59.341% (-20.0%) from 79.315%

Build # 23374838686

Build Type

Pull #15075

github

Committed by

web-flow

Commit Message

Merge 90b4e834f into 6587e363a

Pull Request Pull Request #15075: Stack 8001 v16.4

Coverage Stats

38 of 70 new or added lines in 10 files covered. (54.29%)

34165 existing lines in 563 files now uncovered.

119621 of 201584 relevant lines covered (59.34%)

650666.92 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

63.16

/src/detect-threshold.h

/* Copyright (C) 2007-2024 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \file
 *
 * \author Breno Silva <breno.silva@gmail.com>
 */

#ifndef SURICATA_DETECT_THRESHOLD_H
#define SURICATA_DETECT_THRESHOLD_H

#define TYPE_LIMIT     1
#define TYPE_BOTH      2
#define TYPE_THRESHOLD 3
#define TYPE_DETECTION 4
#define TYPE_RATE      5
#define TYPE_SUPPRESS  6
#define TYPE_BACKOFF   7

#define TRACK_DST      1
#define TRACK_SRC      2
#define TRACK_RULE     3
#define TRACK_EITHER   4 /**< either src or dst: only used by suppress */
#define TRACK_BOTH     5 /* used by rate_filter to match detections by both src and dst addresses */
#define TRACK_FLOW     6 /**< track by flow */

/* Get the new action to take */
#define TH_ACTION_ALERT     0x01
#define TH_ACTION_DROP      0x02
#define TH_ACTION_PASS      0x04
#define TH_ACTION_LOG       0x08
#define TH_ACTION_SDROP     0x10
#define TH_ACTION_REJECT    0x20

/* distinct counting support (for detection_filter) */
enum DetectThresholdUniqueOn {
    DF_UNIQUE_NONE = 0,
    DF_UNIQUE_SRC_PORT,
    DF_UNIQUE_DST_PORT,
};

/**
 * \typedef DetectThresholdData
 * A typedef for DetectThresholdData_
 */

typedef struct DetectThresholdData_ {
    uint32_t count;     /**< Event count */
    uint32_t seconds;   /**< Event seconds */
    uint8_t type;       /**< Threshold type : limit , threshold, both, detection_filter */
    uint8_t track;      /**< Track type: by_src, by_dst */
    uint8_t new_action; /**< new_action alert|drop|pass|log|sdrop|reject */
    uint32_t timeout;   /**< timeout */
    uint32_t flags;     /**< flags used to set option */
    uint32_t multiplier; /**< backoff multiplier */
    enum DetectThresholdUniqueOn
            unique_on; /**< distinct counting on specific field (DF_UNIQUE_*) */
    DetectAddressHead addrs;
} DetectThresholdData;

/**
 * Registration function for threshold: keyword
 */

void DetectThresholdRegister(void);
DetectThresholdData *DetectThresholdDataCopy(DetectThresholdData *);

#endif /*SURICATA_DETECT_THRESHOLD_H */

1	/* Copyright (C) 2007-2024 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	/**
19	* \file
20	*
21	* \author Breno Silva <breno.silva@gmail.com>
22	*/
23
24	#ifndef SURICATA_DETECT_THRESHOLD_H
25	#define SURICATA_DETECT_THRESHOLD_H
26
27	#define TYPE_LIMIT 1	3,321✔
28	#define TYPE_BOTH 2	1,172✔
29	#define TYPE_THRESHOLD 3	306✔
30	#define TYPE_DETECTION 4	20✔
31	#define TYPE_RATE 5	3✔
32	#define TYPE_SUPPRESS 6	45✔
33	#define TYPE_BACKOFF 7	3,907✔
34
35	#define TRACK_DST 1	144✔
36	#define TRACK_SRC 2	910✔
37	#define TRACK_RULE 3	2,662✔
UNCOV 38	#define TRACK_EITHER 4 /*< either src or dst: only used by suppress /	×
39	#define TRACK_BOTH 5 /* used by rate_filter to match detections by both src and dst addresses */	65✔
40	#define TRACK_FLOW 6 /*< track by flow /	441✔
41
42	/* Get the new action to take */
UNCOV 43	#define TH_ACTION_ALERT 0x01	×
UNCOV 44	#define TH_ACTION_DROP 0x02	×
UNCOV 45	#define TH_ACTION_PASS 0x04	×
46	#define TH_ACTION_LOG 0x08	×
47	#define TH_ACTION_SDROP 0x10	×
UNCOV 48	#define TH_ACTION_REJECT 0x20	×
49
50	/* distinct counting support (for detection_filter) */
51	enum DetectThresholdUniqueOn {
52	DF_UNIQUE_NONE = 0,
53	DF_UNIQUE_SRC_PORT,
54	DF_UNIQUE_DST_PORT,
55	};
56
57	/**
58	* \typedef DetectThresholdData
59	* A typedef for DetectThresholdData_
60	*/
61
62	typedef struct DetectThresholdData_ {
63	uint32_t count; /*< Event count /
64	uint32_t seconds; /*< Event seconds /
65	uint8_t type; /*< Threshold type : limit , threshold, both, detection_filter /
66	uint8_t track; /*< Track type: by_src, by_dst /
67	uint8_t new_action; /*< new_action alert\|drop\|pass\|log\|sdrop\|reject /
68	uint32_t timeout; /*< timeout /
69	uint32_t flags; /*< flags used to set option /
70	uint32_t multiplier; /*< backoff multiplier /
71	enum DetectThresholdUniqueOn
72	unique_on; /*< distinct counting on specific field (DF_UNIQUE_) */
73	DetectAddressHead addrs;
74	} DetectThresholdData;
75
76	/**
77	* Registration function for threshold: keyword
78	*/
79
80	void DetectThresholdRegister(void);
81	DetectThresholdData DetectThresholdDataCopy(DetectThresholdData );
82
83	#endif /SURICATA_DETECT_THRESHOLD_H /

OISF / suricata / 23374838686

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous