stream/events: log as stats

diff --git a/src/decode-events.c b/src/decode-events.c
index 34ef6fe1f4c6eb02a8f0ab4f6cc3651b718b9933..54d47f3d94c4c215dacbaa2fc966d67c5f6efa6e 100644 (file)
--- a/src/decode-events.c
+++ b/src/decode-events.c
@@ -188,7 +188,7 @@ const struct DecodeEvents_ DEvents[] = {
     { "stream.3whs_async_wrong_seq", STREAM_3WHS_ASYNC_WRONG_SEQ, },
     { "stream.3whs_right_seq_wrong_ack_evasion", STREAM_3WHS_RIGHT_SEQ_WRONG_ACK_EVASION, },
     { "stream.3whs_synack_in_wrong_direction", STREAM_3WHS_SYNACK_IN_WRONG_DIRECTION, },
-    { "stream.3whs_synack_resend_with_different_ack", STREAM_3WHS_SYNACK_RESEND_WITH_DIFFERENT_ACK, },
+    { "stream.3whs_synack_resend_with_diff_ack", STREAM_3WHS_SYNACK_RESEND_WITH_DIFFERENT_ACK, },
     { "stream.3whs_synack_resend_with_diff_seq", STREAM_3WHS_SYNACK_RESEND_WITH_DIFF_SEQ, },
     { "stream.3whs_synack_toserver_on_syn_recv", STREAM_3WHS_SYNACK_TOSERVER_ON_SYN_RECV, },
     { "stream.3whs_synack_with_wrong_ack", STREAM_3WHS_SYNACK_WITH_WRONG_ACK, },
@@ -210,7 +210,7 @@ const struct DecodeEvents_ DEvents[] = {
     { "stream.est_packet_out_of_window", STREAM_EST_PACKET_OUT_OF_WINDOW, },
     { "stream.est_pkt_before_last_ack", STREAM_EST_PKT_BEFORE_LAST_ACK, },
     { "stream.est_synack_resend", STREAM_EST_SYNACK_RESEND, },
-    { "stream.est_synack_resend_with_different_ack", STREAM_EST_SYNACK_RESEND_WITH_DIFFERENT_ACK, },
+    { "stream.est_synack_resend_with_diff_ack", STREAM_EST_SYNACK_RESEND_WITH_DIFFERENT_ACK, },
     { "stream.est_synack_resend_with_diff_seq", STREAM_EST_SYNACK_RESEND_WITH_DIFF_SEQ, },
     { "stream.est_synack_toserver", STREAM_EST_SYNACK_TOSERVER, },
     { "stream.est_syn_resend", STREAM_EST_SYN_RESEND, },
@@ -231,11 +231,11 @@ const struct DecodeEvents_ DEvents[] = {
     { "stream.rst_but_no_session", STREAM_RST_BUT_NO_SESSION, },
     { "stream.timewait_ack_wrong_seq", STREAM_TIMEWAIT_ACK_WRONG_SEQ, },
     { "stream.timewait_invalid_ack", STREAM_TIMEWAIT_INVALID_ACK, },
+    { "stream.shutdown_syn_resend", STREAM_SHUTDOWN_SYN_RESEND, },
     { "stream.pkt_invalid_timestamp", STREAM_PKT_INVALID_TIMESTAMP, },
     { "stream.pkt_invalid_ack", STREAM_PKT_INVALID_ACK, },
     { "stream.pkt_broken_ack", STREAM_PKT_BROKEN_ACK, },
     { "stream.rst_invalid_ack", STREAM_RST_INVALID_ACK, },
-    { "stream.shutdown_syn_resend", STREAM_SHUTDOWN_SYN_RESEND, },
     { "stream.pkt_retransmission", STREAM_PKT_RETRANSMISSION, },
     { "stream.pkt_bad_window_update", STREAM_PKT_BAD_WINDOW_UPDATE, },
 

diff --git a/src/decode-events.h b/src/decode-events.h
index 3d4178ca4efb763e291e678d1cb23805be4a3d20..59d125a377da99e8457bd77545a4e47b98e9c44e 100644 (file)
--- a/src/decode-events.h
+++ b/src/decode-events.h
@@ -190,9 +190,6 @@ enum {
     /* Cisco Fabric Path/DCE events. */
     DCE_PKT_TOO_SMALL,
 
-    /* END OF DECODE EVENTS ON SINGLE PACKET */
-    DECODE_EVENT_PACKET_MAX,
-
     /* STREAM EVENTS */
     STREAM_3WHS_ACK_IN_WRONG_DIR,
     STREAM_3WHS_ASYNC_WRONG_SEQ,
@@ -248,13 +245,12 @@ enum {
     STREAM_RST_INVALID_ACK,
     STREAM_PKT_RETRANSMISSION,
     STREAM_PKT_BAD_WINDOW_UPDATE,
+
     STREAM_SUSPECTED_RST_INJECT,
 
     STREAM_REASSEMBLY_SEGMENT_BEFORE_BASE_SEQ,
     STREAM_REASSEMBLY_NO_SEGMENT,
-
     STREAM_REASSEMBLY_SEQ_GAP,
-
     STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA,
 
     /* should always be last! */
@@ -270,6 +266,7 @@ struct DecodeEvents_ {
     const char *event_name;
     uint8_t code;
 };
-extern const struct DecodeEvents_ DEvents[DECODE_EVENT_MAX];
+/* +1 for the end of table marker */
+extern const struct DecodeEvents_ DEvents[DECODE_EVENT_MAX + 1];
 
 #endif /* __DECODE_EVENTS_H__ */

diff --git a/src/decode.c b/src/decode.c
index 3f89e6029067d8c88905c04741195fa0d7449701..c583d03fc0636d6d55054b51c9228e8bfb963a6f 100644 (file)
--- a/src/decode.c
+++ b/src/decode.c
@@ -106,18 +106,18 @@ void PacketFree(Packet *p)
  * functions when decoding has been succesful.
  *
  */
-
 void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
 {
-
     if (p->flags & PKT_IS_INVALID) {
         StatsIncr(tv, dtv->counter_invalid);
-        int i = 0;
-        for (i = 0; i < p->events.cnt; i++) {
-            if (EVENT_IS_DECODER_PACKET_ERROR(p->events.events[i])) {
-                StatsIncr(tv, dtv->counter_invalid_events[p->events.events[i]]);
-            }
-        }
+    }
+}
+
+void PacketUpdateEngineEventCounters(ThreadVars *tv,
+        DecodeThreadVars *dtv, Packet *p)
+{
+    for (uint8_t i = 0; i < p->events.cnt; i++) {
+        StatsIncr(tv, dtv->counter_engine_events[p->events.events[i]]);
     }
 }
 
@@ -451,10 +451,9 @@ void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
     dtv->counter_defrag_max_hit =
         StatsRegisterCounter("defrag.max_frag_hits", tv);
 
-    int i = 0;
-    for (i = 0; i < DECODE_EVENT_PACKET_MAX; i++) {
+    for (int i = 0; i < DECODE_EVENT_MAX; i++) {
         BUG_ON(i != (int)DEvents[i].code);
-        dtv->counter_invalid_events[i] = StatsRegisterCounter(
+        dtv->counter_engine_events[i] = StatsRegisterCounter(
                 DEvents[i].event_name, tv);
     }
 

diff --git a/src/decode.h b/src/decode.h
index 8f05fd23fa6ce69b2ddf5ab9c27aea8048cab20d..a19166c4f93119009f6f67bdff909a4d56244493 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -694,7 +694,8 @@ typedef struct DecodeThreadVars_
     uint16_t counter_flow_icmp4;
     uint16_t counter_flow_icmp6;
 
-     uint16_t counter_invalid_events[DECODE_EVENT_PACKET_MAX];
+    uint16_t counter_engine_events[DECODE_EVENT_MAX];
+
     /* thread data for flow logging api: only used at forced
      * flow recycle during lookups */
     void *output_flow_thread_data;
@@ -915,6 +916,8 @@ void DecodeRegisterPerfCounters(DecodeThreadVars *, ThreadVars *);
 Packet *PacketGetFromQueueOrAlloc(void);
 Packet *PacketGetFromAlloc(void);
 void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p);
+void PacketUpdateEngineEventCounters(ThreadVars *tv,
+        DecodeThreadVars *dtv, Packet *p);
 void PacketFree(Packet *p);
 void PacketFreeOrRelease(Packet *p);
 int PacketCallocExtPkt(Packet *p, int datalen);

diff --git a/src/detect-engine-event.c b/src/detect-engine-event.c
index 72722a2d29de03f999e2cf96844553602d755e3a..8665d731892d51bb0fce7155b23ae9055af98d96 100644 (file)
--- a/src/detect-engine-event.c
+++ b/src/detect-engine-event.c
@@ -242,6 +242,12 @@ static int DetectStreamEventSetup (DetectEngineCtx *de_ctx, Signature *s, const
 {
     char srawstr[64] = "stream.";
 
+    if (strcmp(rawstr, "est_synack_resend_with_different_ack") == 0) {
+        rawstr = "est_synack_resend_with_diff_ack";
+    } else if (strcmp(rawstr, "3whs_synack_resend_with_different_ack") == 0) {
+        rawstr = "3whs_synack_resend_with_diff_ack";
+    }
+
     /* stream:$EVENT alias command develop as decode-event:stream.$EVENT */
     strlcat(srawstr, rawstr, sizeof(srawstr));
 

diff --git a/src/flow-worker.c b/src/flow-worker.c
index 4f5c96a87a117712e67052dc9eed8706f5957de7..31de2d989d4ff53e490dace9345640a5e1f9cf52 100644 (file)
--- a/src/flow-worker.c
+++ b/src/flow-worker.c
@@ -249,6 +249,8 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data, PacketQueue *pr
         FLOWWORKER_PROFILING_END(p, PROFILE_FLOWWORKER_APPLAYERUDP);
     }
 
+    PacketUpdateEngineEventCounters(tv, fw->dtv, p);
+
     /* handle Detect */
     DEBUG_ASSERT_FLOW_LOCKED(p->flow);
     SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt);