From 4f77e8967bb0baab3b8791b8d3a977cf20c5dac1 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 8 Apr 2015 15:59:46 +0200 Subject: [PATCH] multi-detect: make threshold prefix aware Make threshold loading prefix aware, so it can be part of tenant configuration. If the setting is missing from the tenant, the global setting is tried and if that too is missing, the global default is used. Note: currently per host thresholds are tracked globally and NOT per tenant. --- src/util-threshold-config.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c index 9f107a1e0f..6698b16fa6 100644 --- a/src/util-threshold-config.c +++ b/src/util-threshold-config.c @@ -103,14 +103,27 @@ static pcre_extra *regex_suppress_study = NULL; * \retval log_filename Pointer to a string containing the path for the * Threshold Config file. */ -char *SCThresholdConfGetConfFilename(void) +static char *SCThresholdConfGetConfFilename(const DetectEngineCtx *de_ctx) { char *log_filename = NULL; + char config_value[256] = ""; - if (ConfGet("threshold-file", &log_filename) != 1) { - log_filename = (char *)THRESHOLD_CONF_DEF_CONF_FILEPATH; - } + if (de_ctx != NULL && strlen(de_ctx->config_prefix) > 0) { + snprintf(config_value, sizeof(config_value), + "%s.threshold-file", de_ctx->config_prefix); + /* try loading prefix setting, fall back to global if that + * fails. */ + if (ConfGet(config_value, &log_filename) != 1) { + if (ConfGet("threshold-file", &log_filename) != 1) { + log_filename = (char *)THRESHOLD_CONF_DEF_CONF_FILEPATH; + } + } + } else { + if (ConfGet("threshold-file", &log_filename) != 1) { + log_filename = (char *)THRESHOLD_CONF_DEF_CONF_FILEPATH; + } + } return log_filename; } @@ -138,7 +151,7 @@ int SCThresholdConfInitContext(DetectEngineCtx *de_ctx, FILE *utfd) int opts = 0; if (fd == NULL) { - filename = SCThresholdConfGetConfFilename(); + filename = SCThresholdConfGetConfFilename(de_ctx); if ( (fd = fopen(filename, "r")) == NULL) { SCLogWarning(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", filename, strerror(errno)); goto error; @@ -212,7 +225,6 @@ error: */ void SCThresholdConfDeInitContext(DetectEngineCtx *de_ctx, FILE *fd) { - if (fd != NULL) fclose(fd); -- 2.47.2