From 152849082952d93d7af1e2369b70a8e3d685c4d7 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Wed, 2 Nov 2011 15:18:49 +0100 Subject: [PATCH 2/2] threshold: fix thresholding on signature with multiple threshold. This patch uses the newly introduced SigGetThresholdTypeIter function to try all threshold for a signature. This should fix issue #366. --- src/detect-engine-alert.c | 17 +++++++---------- 1 files changed, 7 insertions(+), 10 deletions(-) diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c index 1466694..aee5bbf 100644 --- a/src/detect-engine-alert.c +++ b/src/detect-engine-alert.c @@ -66,23 +66,20 @@ static int PacketAlertHandle(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det SCEnter(); int ret = 0; DetectThresholdData *td = NULL; + SigMatch *sm = NULL; - /* retrieve the sig match data */ - if (PKT_IS_IPV4(p) || PKT_IS_IPV6(p)) { - td = SigGetThresholdType(s,p); + if (!(PKT_IS_IPV4(p) || PKT_IS_IPV6(p))) { + SCReturnInt(1); } - SCLogDebug("td %p", td); - - /* if have none just alert, otherwise handle thresholding */ - if (td == NULL) { - /* Already inserted so get out */ - ret = 1; - } else { + while ((td = SigGetThresholdTypeIter(s, p, &sm))) { + SCLogDebug("td %p", td); ret = PacketAlertThreshold(de_ctx, det_ctx, td, p, s); if (ret == 0) { /* It doesn't match threshold, remove it */ PacketAlertRemove(p, pos); + /* no need to iterate */ + break; } } -- 1.7.7.1