/* Copyright (C) 2007-2023 Open Information Security Foundation

 *

 * You can copy, redistribute or modify this Program under the terms of

 * the GNU General Public License version 2 as published by the Free

 * Software Foundation.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * version 2 along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

 * 02110-1301, USA.

 */

/**

 * \ingroup threshold

 * @{

 */

/**

 * \file

 *

 * \author Breno Silva Pinto <breno.silva@gmail.com>

 *

 * Implements Threshold support

 */

#include "suricata-common.h"

#include "action-globals.h"

#include "host.h"

#include "ippair.h"

#include "detect.h"

#include "detect-engine.h"

#include "detect-engine-address.h"

#include "detect-engine-threshold.h"

#include "detect-threshold.h"

#include "detect-parse.h"

#include "detect-engine-build.h"

#include "conf.h"

#include "util-threshold-config.h"

#include "util-unittest.h"

#include "util-unittest-helper.h"

#include "util-byte.h"

#include "util-time.h"

#include "util-error.h"

#include "util-debug.h"

#include "util-fmemopen.h"

typedef enum ThresholdRuleType {

    THRESHOLD_TYPE_EVENT_FILTER,

    THRESHOLD_TYPE_THRESHOLD,

    THRESHOLD_TYPE_RATE,

    THRESHOLD_TYPE_SUPPRESS,

} ThresholdRuleType;

#ifdef UNITTESTS

/* File descriptor for unittests */

static FILE *g_ut_threshold_fp = NULL;

#endif

/* common base for all options */

#define DETECT_BASE_REGEX "^\\s*(event_filter|threshold|rate_filter|suppress)\\s*gen_id\\s*(\\d+)\\s*,\\s*sig_id\\s*(\\d+)\\s*(.*)\\s*$"

#define DETECT_THRESHOLD_REGEX                                                                     \

    "^,\\s*type\\s*(limit|both|threshold)\\s*,\\s*track\\s*(by_dst|by_src|by_both|by_rule)\\s*,"   \

    "\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*$"

/* TODO: "apply_to" */

#define DETECT_RATE_REGEX "^,\\s*track\\s*(by_dst|by_src|by_both|by_rule)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*,\\s*new_action\\s*(alert|drop|pass|log|sdrop|reject)\\s*,\\s*timeout\\s*(\\d+)\\s*$"

/*

 * suppress has two form:

 *  suppress gen_id 0, sig_id 0, track by_dst, ip 10.88.0.14

 *  suppress gen_id 1, sig_id 2000328

 *  suppress gen_id 1, sig_id 2000328, track by_src, ip fe80::/10

*/

#define DETECT_SUPPRESS_REGEX "^,\\s*track\\s*(by_dst|by_src|by_either)\\s*,\\s*ip\\s*([\\[\\],\\$\\s\\da-zA-Z.:/_]+)*\\s*$"

/* Default path for the threshold.config file */

#if defined OS_WIN32 || defined __CYGWIN__

#define THRESHOLD_CONF_DEF_CONF_FILEPATH CONFIG_DIR "\\\\threshold.config"

#else

#define THRESHOLD_CONF_DEF_CONF_FILEPATH CONFIG_DIR "/threshold.config"

#endif

static DetectParseRegex *regex_base = NULL;

static DetectParseRegex *regex_threshold = NULL;

static DetectParseRegex *regex_rate = NULL;

static DetectParseRegex *regex_suppress = NULL;

static void SCThresholdConfDeInitContext(DetectEngineCtx *de_ctx, FILE *fd);

void SCThresholdConfGlobalInit(void)

{

    regex_base = DetectSetupPCRE2(DETECT_BASE_REGEX, 0);

    if (regex_base == NULL) {

        FatalError("classification base regex setup failed");

    }

    regex_threshold = DetectSetupPCRE2(DETECT_THRESHOLD_REGEX, 0);

    if (regex_threshold == NULL) {

        FatalError("classification threshold regex setup failed");

    }

    regex_rate = DetectSetupPCRE2(DETECT_RATE_REGEX, 0);

    if (regex_rate == NULL) {

        FatalError("classification rate_filter regex setup failed");

    }

    regex_suppress = DetectSetupPCRE2(DETECT_SUPPRESS_REGEX, 0);

    if (regex_suppress == NULL) {

        FatalError("classification suppress regex setup failed");

    }

}

/**

 * \brief Returns the path for the Threshold Config file.  We check if we

 *        can retrieve the path from the yaml conf file.  If it is not present,

 *        return the default path for the threshold file which is

 *        "./threshold.config".

 *

 * \retval log_filename Pointer to a string containing the path for the

 *                      Threshold Config file.

 */

static const char *SCThresholdConfGetConfFilename(const DetectEngineCtx *de_ctx)

{

    const char *log_filename = NULL;

    if (de_ctx != NULL && strlen(de_ctx->config_prefix) > 0) {

        char config_value[256];

        snprintf(config_value, sizeof(config_value),

                 "%s.threshold-file", de_ctx->config_prefix);

        /* try loading prefix setting, fall back to global if that

         * fails. */

        if (ConfGet(config_value, &log_filename) != 1) {

            if (ConfGet("threshold-file", &log_filename) != 1) {

                log_filename = (char *)THRESHOLD_CONF_DEF_CONF_FILEPATH;

            }

        }

    } else {

        if (ConfGet("threshold-file", &log_filename) != 1) {

            log_filename = (char *)THRESHOLD_CONF_DEF_CONF_FILEPATH;

        }

    }

    return log_filename;

}

/**

 * \brief Inits the context to be used by the Threshold Config parsing API.

 *

 *        This function initializes the hash table to be used by the Detection

 *        Engine Context to hold the data from the threshold.config file,

 *        obtains the file desc to parse the threshold.config file, and

 *        inits the regex used to parse the lines from threshold.config

 *        file.

 *

 * \param de_ctx Pointer to the Detection Engine Context.

 *

 * \retval  0 On success.

 * \retval -1 On failure.

 */

int SCThresholdConfInitContext(DetectEngineCtx *de_ctx)

{

    const char *filename = NULL;

    int ret = 0;

#ifndef UNITTESTS

    FILE *fd = NULL;

#else

    FILE *fd = g_ut_threshold_fp;

    if (fd == NULL) {

#endif

        filename = SCThresholdConfGetConfFilename(de_ctx);

        if ( (fd = fopen(filename, "r")) == NULL) {

            SCLogWarning("Error opening file: \"%s\": %s", filename, strerror(errno));

            SCThresholdConfDeInitContext(de_ctx, fd);

            return 0;

        }

#ifdef UNITTESTS

    }

#endif

    if (SCThresholdConfParseFile(de_ctx, fd) < 0) {

        SCLogWarning("Error loading threshold configuration from %s", filename);

        SCThresholdConfDeInitContext(de_ctx, fd);

        /* maintain legacy behavior so no errors unless config testing */

        if (RunmodeGetCurrent() == RUNMODE_CONF_TEST) {

            ret = -1;

        }

        return ret;

    }

    SCThresholdConfDeInitContext(de_ctx, fd);

#ifdef UNITTESTS

    g_ut_threshold_fp = NULL;

#endif

    SCLogDebug("Global thresholding options defined");

    return 0;

}

/**

 * \brief Releases resources used by the Threshold Config API.

 *

 * \param de_ctx Pointer to the Detection Engine Context.

 * \param fd Pointer to file descriptor.

 */

static void SCThresholdConfDeInitContext(DetectEngineCtx *de_ctx, FILE *fd)

{

    if (fd != NULL)

        fclose(fd);

    return;

}

/** \internal

 *  \brief setup suppress rules

 *  \retval 0 ok

 *  \retval -1 error

 */

static int SetupSuppressRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid,

        uint8_t parsed_type, uint8_t parsed_track, uint32_t parsed_count,

        uint32_t parsed_seconds, uint32_t parsed_timeout, uint8_t parsed_new_action,

        const char *th_ip)

{

    Signature *s = NULL;

    SigMatch *sm = NULL;

    DetectThresholdData *de = NULL;

    BUG_ON(parsed_type != TYPE_SUPPRESS);

    DetectThresholdData *orig_de = NULL;

    if (parsed_track != TRACK_RULE) {

        orig_de = SCCalloc(1, sizeof(DetectThresholdData));

        if (unlikely(orig_de == NULL))

            goto error;

        orig_de->type = TYPE_SUPPRESS;

        orig_de->track = parsed_track;

        orig_de->count = parsed_count;

        orig_de->seconds = parsed_seconds;

        orig_de->new_action = parsed_new_action;

        orig_de->timeout = parsed_timeout;

        if (DetectAddressParse((const DetectEngineCtx *)de_ctx, &orig_de->addrs, (char *)th_ip) <

                0) {

            SCLogError("failed to parse %s", th_ip);

            goto error;

        }

    }

    /* Install it */

    if (id == 0 && gid == 0) {

        if (parsed_track == TRACK_RULE) {

            SCLogWarning("suppressing all rules");

        }

        /* update each sig with our suppress info */

        for (s = de_ctx->sig_list; s != NULL; s = s->next) {

            /* tag the rule as noalert */

            if (parsed_track == TRACK_RULE) {

                s->action &= ~ACTION_ALERT;

                continue;

            }

            de = DetectThresholdDataCopy(orig_de);

            if (unlikely(de == NULL))

                goto error;

            sm = SigMatchAlloc();

            if (sm == NULL) {

                SCLogError("Error allocating SigMatch");

                goto error;

            }

            sm->type = DETECT_THRESHOLD;

            sm->ctx = (void *)de;

            SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_SUPPRESS);

        }

    } else if (id == 0 && gid > 0)    {

        if (parsed_track == TRACK_RULE) {

            SCLogWarning("suppressing all rules with gid %" PRIu32, gid);

        }

        /* set up suppression for each signature with a matching gid */

        for (s = de_ctx->sig_list; s != NULL; s = s->next) {

            if (s->gid != gid)

                continue;

            /* tag the rule as noalert */

            if (parsed_track == TRACK_RULE) {

                s->action &= ~ACTION_ALERT;

                continue;

            }

            de = DetectThresholdDataCopy(orig_de);

            if (unlikely(de == NULL))

                goto error;

            sm = SigMatchAlloc();

            if (sm == NULL) {

                SCLogError("Error allocating SigMatch");

                goto error;

            }

            sm->type = DETECT_THRESHOLD;

            sm->ctx = (void *)de;

            SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_SUPPRESS);

        }

    } else if (id > 0 && gid == 0) {

        SCLogError("Can't use a event config that has "

                   "sid > 0 and gid == 0. Please fix this "

                   "in your threshold.config file");

        goto error;

    } else {

        s = SigFindSignatureBySidGid(de_ctx, id, gid);

        if (s == NULL) {

            SCLogWarning("can't suppress sid "

                         "%" PRIu32 ", gid %" PRIu32 ": unknown rule",

                    id, gid);

        } else {

            if (parsed_track == TRACK_RULE) {

                s->action &= ~ACTION_ALERT;

                goto end;

            }

            de = DetectThresholdDataCopy(orig_de);

            if (unlikely(de == NULL))

                goto error;

            sm = SigMatchAlloc();

            if (sm == NULL) {

                SCLogError("Error allocating SigMatch");

                goto error;

            }

            sm->type = DETECT_THRESHOLD;

            sm->ctx = (void *)de;

            SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_SUPPRESS);

        }

    }

end:

    if (orig_de != NULL) {

        DetectAddressHeadCleanup(&orig_de->addrs);

        SCFree(orig_de);

    }

    return 0;

error:

    if (orig_de != NULL) {

        DetectAddressHeadCleanup(&orig_de->addrs);

        SCFree(orig_de);

    }

    if (de != NULL) {

        DetectAddressHeadCleanup(&de->addrs);

        SCFree(de);

    }

    return -1;

}

/** \internal

 *  \brief setup suppress rules

 *  \retval 0 ok

 *  \retval -1 error

 */

static int SetupThresholdRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid,

        uint8_t parsed_type, uint8_t parsed_track, uint32_t parsed_count,

        uint32_t parsed_seconds, uint32_t parsed_timeout, uint8_t parsed_new_action,

        const char *th_ip)

{

    Signature *s = NULL;

    SigMatch *sm = NULL;

    DetectThresholdData *de = NULL;

    BUG_ON(parsed_type == TYPE_SUPPRESS);

    /* Install it */

    if (id == 0 && gid == 0) {

        for (s = de_ctx->sig_list; s != NULL; s = s->next) {

            sm = DetectGetLastSMByListId(s,

                    DETECT_SM_LIST_THRESHOLD, DETECT_THRESHOLD, -1);

            if (sm != NULL) {

                SCLogWarning("signature sid:%" PRIu32 " has "

                             "an event var set.  The signature event var is "

                             "given precedence over the threshold.conf one.  "

                             "We'll change this in the future though.",

                        s->id);

                continue;

            }

            sm = DetectGetLastSMByListId(s,

                    DETECT_SM_LIST_THRESHOLD, DETECT_DETECTION_FILTER, -1);

            if (sm != NULL) {

                SCLogWarning("signature sid:%" PRIu32 " has "

                             "an event var set.  The signature event var is "

                             "given precedence over the threshold.conf one.  "

                             "We'll change this in the future though.",

                        s->id);

                continue;

            }

            de = SCMalloc(sizeof(DetectThresholdData));

            if (unlikely(de == NULL))

                goto error;

            memset(de,0,sizeof(DetectThresholdData));

            de->type = parsed_type;

            de->track = parsed_track;

            de->count = parsed_count;

            de->seconds = parsed_seconds;

            de->new_action = parsed_new_action;

            de->timeout = parsed_timeout;

            sm = SigMatchAlloc();

            if (sm == NULL) {

                SCLogError("Error allocating SigMatch");

                goto error;

            }

            if (parsed_type == TYPE_RATE)

                sm->type = DETECT_DETECTION_FILTER;

            else

                sm->type = DETECT_THRESHOLD;

            sm->ctx = (void *)de;

            SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD);

        }

    } else if (id == 0 && gid > 0) {

        for (s = de_ctx->sig_list; s != NULL; s = s->next) {

            if (s->gid == gid) {

                sm = DetectGetLastSMByListId(s, DETECT_SM_LIST_THRESHOLD,

                        DETECT_THRESHOLD, DETECT_DETECTION_FILTER, -1);

                if (sm != NULL) {

                    SCLogWarning("signature sid:%" PRIu32 " has "

                                 "an event var set.  The signature event var is "

                                 "given precedence over the threshold.conf one.  "

                                 "We'll change this in the future though.",

                            id);

                    continue;

                }

                de = SCMalloc(sizeof(DetectThresholdData));

                if (unlikely(de == NULL))

                    goto error;

                memset(de,0,sizeof(DetectThresholdData));

                de->type = parsed_type;

                de->track = parsed_track;

                de->count = parsed_count;

                de->seconds = parsed_seconds;

                de->new_action = parsed_new_action;

                de->timeout = parsed_timeout;

                sm = SigMatchAlloc();

                if (sm == NULL) {

                    SCLogError("Error allocating SigMatch");

                    goto error;

                }

                if (parsed_type == TYPE_RATE)

                    sm->type = DETECT_DETECTION_FILTER;

                else

                    sm->type = DETECT_THRESHOLD;

                sm->ctx = (void *)de;

                SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD);

            }

        }

    } else if (id > 0 && gid == 0) {

        SCLogError("Can't use a event config that has "

                   "sid > 0 and gid == 0. Please fix this "

                   "in your threshold.conf file");

    } else {

        s = SigFindSignatureBySidGid(de_ctx, id, gid);

        if (s == NULL) {

            SCLogWarning("can't suppress sid "

                         "%" PRIu32 ", gid %" PRIu32 ": unknown rule",

                    id, gid);

        } else {

            if (parsed_type != TYPE_SUPPRESS && parsed_type != TYPE_THRESHOLD &&

                parsed_type != TYPE_BOTH && parsed_type != TYPE_LIMIT)

            {

                sm = DetectGetLastSMByListId(s,

                        DETECT_SM_LIST_THRESHOLD, DETECT_THRESHOLD, -1);

                if (sm != NULL) {

                    SCLogWarning("signature sid:%" PRIu32 " has "

                                 "a threshold set. The signature event var is "

                                 "given precedence over the threshold.conf one. "

                                 "Bug #425.",

                            s->id);

                    goto end;

                }

                sm = DetectGetLastSMByListId(s, DETECT_SM_LIST_THRESHOLD,

                        DETECT_DETECTION_FILTER, -1);

                if (sm != NULL) {

                    SCLogWarning("signature sid:%" PRIu32 " has "

                                 "a detection_filter set. The signature event var is "

                                 "given precedence over the threshold.conf one. "

                                 "Bug #425.",

                            s->id);

                    goto end;

                }

            /* replace threshold on sig if we have a global override for it */

            } else if (parsed_type == TYPE_THRESHOLD || parsed_type == TYPE_BOTH || parsed_type == TYPE_LIMIT) {

                sm = DetectGetLastSMByListId(s, DETECT_SM_LIST_THRESHOLD,

                        DETECT_THRESHOLD, DETECT_DETECTION_FILTER, -1);

                if (sm != NULL) {

                    SigMatchRemoveSMFromList(s, sm, DETECT_SM_LIST_THRESHOLD);

                    SigMatchFree(de_ctx, sm);

                }

            }

            de = SCMalloc(sizeof(DetectThresholdData));

            if (unlikely(de == NULL))

                goto error;

            memset(de,0,sizeof(DetectThresholdData));

            de->type = parsed_type;

            de->track = parsed_track;

            de->count = parsed_count;

            de->seconds = parsed_seconds;

            de->new_action = parsed_new_action;

            de->timeout = parsed_timeout;

            sm = SigMatchAlloc();

            if (sm == NULL) {

                SCLogError("Error allocating SigMatch");

                goto error;

            }

            if (parsed_type == TYPE_RATE)

                sm->type = DETECT_DETECTION_FILTER;

            else

                sm->type = DETECT_THRESHOLD;

            sm->ctx = (void *)de;

            SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD);

        }

    }

end:

    return 0;

error:

    if (de != NULL) {

        DetectAddressHeadCleanup(&de->addrs);

        SCFree(de);

    }

    return -1;

}

static int ParseThresholdRule(const DetectEngineCtx *de_ctx, char *rawstr, uint32_t *ret_id,

        uint32_t *ret_gid, uint8_t *ret_parsed_type, uint8_t *ret_parsed_track,

        uint32_t *ret_parsed_count, uint32_t *ret_parsed_seconds, uint32_t *ret_parsed_timeout,

        uint8_t *ret_parsed_new_action, char **ret_th_ip)

{

    char th_rule_type[32];

    char th_gid[16];

    char th_sid[16];

    const char *rule_extend = NULL;

    char th_type[16] = "";

    char th_track[16] = "";

    char th_count[16] = "";

    char th_seconds[16] = "";

    char th_new_action[16] = "";

    char th_timeout[16] = "";

    const char *th_ip = NULL;

    uint8_t parsed_type = 0;

    uint8_t parsed_track = 0;

    uint8_t parsed_new_action = 0;

    uint32_t parsed_count = 0;

    uint32_t parsed_seconds = 0;

    uint32_t parsed_timeout = 0;

    int ret = 0;

    uint32_t id = 0, gid = 0;

    ThresholdRuleType rule_type;

    if (de_ctx == NULL)

        return -1;

    pcre2_match_data *regex_base_match = NULL;

    ret = DetectParsePcreExec(regex_base, &regex_base_match, rawstr, 0, 0);

    if (ret < 4) {

        SCLogError("pcre2_match parse error, ret %" PRId32 ", string %s", ret, rawstr);

        pcre2_match_data_free(regex_base_match);

        goto error;

    }

    /* retrieve the classtype name */

    size_t copylen = sizeof(th_rule_type);

    ret = pcre2_substring_copy_bynumber(

            regex_base_match, 1, (PCRE2_UCHAR8 *)th_rule_type, &copylen);

    if (ret < 0) {

        SCLogError("pcre2_substring_copy_bynumber failed");

        pcre2_match_data_free(regex_base_match);

        goto error;

    }

    /* retrieve the classtype name */

    copylen = sizeof(th_gid);

    ret = pcre2_substring_copy_bynumber(regex_base_match, 2, (PCRE2_UCHAR8 *)th_gid, &copylen);

    if (ret < 0) {

        SCLogError("pcre2_substring_copy_bynumber failed");

        pcre2_match_data_free(regex_base_match);

        goto error;

    }

    copylen = sizeof(th_sid);

    ret = pcre2_substring_copy_bynumber(regex_base_match, 3, (PCRE2_UCHAR8 *)th_sid, &copylen);

    if (ret < 0) {

        SCLogError("pcre2_substring_copy_bynumber failed");

        pcre2_match_data_free(regex_base_match);

        goto error;

    }

    /* Use "get" for heap allocation */

    ret = pcre2_substring_get_bynumber(

            regex_base_match, 4, (PCRE2_UCHAR8 **)&rule_extend, &copylen);

    if (ret < 0) {

        SCLogError("pcre2_substring_get_bynumber failed");

        pcre2_match_data_free(regex_base_match);

        goto error;

    }

    pcre2_match_data_free(regex_base_match);

    regex_base_match = NULL;

    /* get type of rule */

    if (strcasecmp(th_rule_type,"event_filter") == 0) {

        rule_type = THRESHOLD_TYPE_EVENT_FILTER;

    } else if (strcasecmp(th_rule_type,"threshold") == 0) {

        rule_type = THRESHOLD_TYPE_THRESHOLD;

    } else if (strcasecmp(th_rule_type,"rate_filter") == 0) {

        rule_type = THRESHOLD_TYPE_RATE;

    } else if (strcasecmp(th_rule_type,"suppress") == 0) {

        rule_type = THRESHOLD_TYPE_SUPPRESS;

    } else {

        SCLogError("rule type %s is unknown", th_rule_type);

        goto error;

    }

    /* get end of rule */

    switch(rule_type) {

        case THRESHOLD_TYPE_EVENT_FILTER:

        case THRESHOLD_TYPE_THRESHOLD:

            if (strlen(rule_extend) > 0) {

                pcre2_match_data *match = NULL;

                ret = DetectParsePcreExec(regex_threshold, &match, rule_extend, 0, 0);

                if (ret < 4) {

                    SCLogError("pcre2_match parse error, ret %" PRId32 ", string %s", ret,

                            rule_extend);

                    pcre2_match_data_free(match);

                    goto error;

                }

                copylen = sizeof(th_type);

                ret = pcre2_substring_copy_bynumber(match, 1, (PCRE2_UCHAR8 *)th_type, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_copy_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                copylen = sizeof(th_track);

                ret = pcre2_substring_copy_bynumber(match, 2, (PCRE2_UCHAR8 *)th_track, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_copy_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                copylen = sizeof(th_count);

                ret = pcre2_substring_copy_bynumber(match, 3, (PCRE2_UCHAR8 *)th_count, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_copy_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                copylen = sizeof(th_seconds);

                ret = pcre2_substring_copy_bynumber(match, 4, (PCRE2_UCHAR8 *)th_seconds, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_copy_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                pcre2_match_data_free(match);

                if (strcasecmp(th_type,"limit") == 0)

                    parsed_type = TYPE_LIMIT;

                else if (strcasecmp(th_type,"both") == 0)

                    parsed_type = TYPE_BOTH;

                else if (strcasecmp(th_type,"threshold") == 0)

                    parsed_type = TYPE_THRESHOLD;

                else {

                    SCLogError("limit type not supported: %s", th_type);

                    goto error;

                }

            } else {

                SCLogError("rule invalid: %s", rawstr);

                goto error;

            }

            break;

        case THRESHOLD_TYPE_SUPPRESS:

            if (strlen(rule_extend) > 0) {

                pcre2_match_data *match = NULL;

                ret = DetectParsePcreExec(regex_suppress, &match, rule_extend, 0, 0);

                if (ret < 2) {

                    SCLogError("pcre2_match parse error, ret %" PRId32 ", string %s", ret,

                            rule_extend);

                    pcre2_match_data_free(match);

                    goto error;

                }

                /* retrieve the track mode */

                copylen = sizeof(th_seconds);

                ret = pcre2_substring_copy_bynumber(match, 1, (PCRE2_UCHAR8 *)th_track, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_copy_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                /* retrieve the IP; use "get" for heap allocation */

                ret = pcre2_substring_get_bynumber(match, 2, (PCRE2_UCHAR8 **)&th_ip, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_get_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                pcre2_match_data_free(match);

            } else {

                parsed_track = TRACK_RULE;

            }

            parsed_type = TYPE_SUPPRESS;

            break;

        case THRESHOLD_TYPE_RATE:

            if (strlen(rule_extend) > 0) {

                pcre2_match_data *match = NULL;

                ret = DetectParsePcreExec(regex_rate, &match, rule_extend, 0, 0);

                if (ret < 5) {

                    SCLogError("pcre2_match parse error, ret %" PRId32 ", string %s", ret,

                            rule_extend);

                    pcre2_match_data_free(match);

                    goto error;

                }

                copylen = sizeof(th_track);

                ret = pcre2_substring_copy_bynumber(match, 1, (PCRE2_UCHAR8 *)th_track, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_copy_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                copylen = sizeof(th_count);

                ret = pcre2_substring_copy_bynumber(match, 2, (PCRE2_UCHAR8 *)th_count, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_copy_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                copylen = sizeof(th_seconds);

                ret = pcre2_substring_copy_bynumber(match, 3, (PCRE2_UCHAR8 *)th_seconds, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_copy_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                copylen = sizeof(th_new_action);

                ret = pcre2_substring_copy_bynumber(

                        match, 4, (PCRE2_UCHAR8 *)th_new_action, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_copy_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                copylen = sizeof(th_timeout);

                ret = pcre2_substring_copy_bynumber(match, 5, (PCRE2_UCHAR8 *)th_timeout, &copylen);

                if (ret < 0) {

                    SCLogError("pcre2_substring_copy_bynumber failed");

                    pcre2_match_data_free(match);

                    goto error;

                }

                pcre2_match_data_free(match);

                /* TODO: implement option "apply_to" */

                if (StringParseUint32(&parsed_timeout, 10, sizeof(th_timeout), th_timeout) <= 0) {

                    goto error;

                }

                /* Get the new action to take */

                if (strcasecmp(th_new_action, "alert") == 0)

                    parsed_new_action = TH_ACTION_ALERT;

                if (strcasecmp(th_new_action, "drop") == 0)

                    parsed_new_action = TH_ACTION_DROP;

                if (strcasecmp(th_new_action, "pass") == 0)

                    parsed_new_action = TH_ACTION_PASS;

                if (strcasecmp(th_new_action, "reject") == 0)

                    parsed_new_action = TH_ACTION_REJECT;

                if (strcasecmp(th_new_action, "log") == 0) {

                    SCLogInfo("log action for rate_filter not supported yet");

                    parsed_new_action = TH_ACTION_LOG;

                }

                if (strcasecmp(th_new_action, "sdrop") == 0) {

                    SCLogInfo("sdrop action for rate_filter not supported yet");

                    parsed_new_action = TH_ACTION_SDROP;

                }

                parsed_type = TYPE_RATE;

            } else {

                SCLogError("rule invalid: %s", rawstr);

                goto error;

            }

            break;

    }

    switch (rule_type) {

        /* This part is common to threshold/event_filter/rate_filter */

        case THRESHOLD_TYPE_EVENT_FILTER:

        case THRESHOLD_TYPE_THRESHOLD:

        case THRESHOLD_TYPE_RATE:

            if (strcasecmp(th_track,"by_dst") == 0)

                parsed_track = TRACK_DST;

            else if (strcasecmp(th_track,"by_src") == 0)

                parsed_track = TRACK_SRC;

            else if (strcasecmp(th_track, "by_both") == 0) {

                parsed_track = TRACK_BOTH;

            }

            else if (strcasecmp(th_track,"by_rule") == 0)

                parsed_track = TRACK_RULE;

            else {

                SCLogError("Invalid track parameter %s in %s", th_track, rawstr);

                goto error;

            }

            if (StringParseUint32(&parsed_count, 10, sizeof(th_count), th_count) <= 0) {

                goto error;

            }

            if (parsed_count == 0) {

                SCLogError("rate filter count should be > 0");

                goto error;

            }

            if (StringParseUint32(&parsed_seconds, 10, sizeof(th_seconds), th_seconds) <= 0) {

                goto error;

            }

           break;

        case THRESHOLD_TYPE_SUPPRESS:

            /* need to get IP if extension is provided */

            if (strcmp("", th_track) != 0) {

                if (strcasecmp(th_track,"by_dst") == 0)

                    parsed_track = TRACK_DST;

                else if (strcasecmp(th_track,"by_src") == 0)

                    parsed_track = TRACK_SRC;

                else if (strcasecmp(th_track,"by_either") == 0) {

                    parsed_track = TRACK_EITHER;

                }

                else {

                    SCLogError("Invalid track parameter %s in %s", th_track, rule_extend);

                    goto error;