From e8b6b4fb40c1721a408dbfc1b829a0d0570bd760 Mon Sep 17 00:00:00 2001
From: Eric Leblond <eric@regit.org>
Date: Wed, 2 Nov 2011 15:17:44 +0100
Subject: [PATCH 1/2] threshold: introduce SigGetThresholdTypeIter function

This patch introduces a function called SigGetThresholdTypeIter
which iterate on all Threshold for a given signature returning
the next DetectThresholdData.
---
 src/detect-engine-threshold.c |   33 ++++++++++++++++++++++++++++++---
 src/detect-engine-threshold.h |    1 +
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/src/detect-engine-threshold.c b/src/detect-engine-threshold.c
index 71790c8..b0b25be 100644
--- a/src/detect-engine-threshold.c
+++ b/src/detect-engine-threshold.c
@@ -64,24 +64,38 @@
 #include "tm-threads.h"
 
 /**
- * \brief Check if a certain signature has threshold option
+ * \brief Return next DetectThresholdData for signature
  *
  * \param sig Signature pointer
  * \param p Packet structure
+ * \param sm Pointer to a Signature Match pointer
  *
  * \retval tsh Return the threshold data from signature or NULL if not found
+ *
+ *
  */
-DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p)
+DetectThresholdData *SigGetThresholdTypeIter(Signature *sig, Packet *p, SigMatch **psm)
 {
-    SigMatch *sm = sig->sm_lists_tail[DETECT_SM_LIST_MATCH];
+    SigMatch *sm = NULL;
     DetectThresholdData *tsh = NULL;
 
+    if (sig == NULL)
+        return NULL;
+
+    if (*psm == NULL) {
+        sm = sig->sm_lists_tail[DETECT_SM_LIST_MATCH];
+    } else {
+        /* Iteration in progress, using provided value */
+        sm = *psm;
+    }
+
     if (p == NULL)
         return NULL;
 
     while (sm != NULL) {
         if (sm->type == DETECT_THRESHOLD || sm->type == DETECT_DETECTION_FILTER) {
             tsh = (DetectThresholdData *)sm->ctx;
+            *psm = sm->prev;
             return tsh;
         }
 
@@ -92,6 +106,19 @@ DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p)
 }
 
 /**
+ * \brief Check if a certain signature has threshold option
+ *
+ * \param sig Signature pointer
+ * \param p Packet structure
+ *
+ * \retval tsh Return the threshold data from signature or NULL if not found
+ */
+DetectThresholdData *SigGetThresholdType(Signature *sig, Packet *p)
+{
+    return SigGetThresholdTypeIter(sig, p, NULL);
+}
+
+/**
  * \brief Search for a threshold data into threshold hash table
  *
  * \param de_ctx Dectection Context
diff --git a/src/detect-engine-threshold.h b/src/detect-engine-threshold.h
index 679f8b9..b547a63 100644
--- a/src/detect-engine-threshold.h
+++ b/src/detect-engine-threshold.h
@@ -30,6 +30,7 @@
 #define THRESHOLD_HASH_SIZE 0xffff
 
 DetectThresholdData *SigGetThresholdType(Signature *, Packet *);
+DetectThresholdData *SigGetThresholdTypeIter(Signature *sig, Packet *p, SigMatch **psm);
 int PacketAlertThreshold(DetectEngineCtx *, DetectEngineThreadCtx *,
                           DetectThresholdData *, Packet *, Signature *);
 void ThresholdFreeFunc(void *data);
-- 
1.7.7.1