detect/profiling: track bytes scanned by prefilter engines

diff --git a/src/detect-dns-query.c b/src/detect-dns-query.c
index d6ae7caea74470a2358a92e0386c8e40724643f2..97b8ddc6685250a2f33a00ae3b72bc8ebbd32455 100644 (file)
--- a/src/detect-dns-query.c
+++ b/src/detect-dns-query.c
@@ -57,6 +57,7 @@
 #include "app-layer-parser.h"
 #include "detect-dns-query.h"
 
+#include "util-profiling.h"
 #include "util-unittest-helper.h"
 #include "rust.h"
 
@@ -169,6 +170,7 @@ static void PrefilterTxDnsQuery(DetectEngineThreadCtx *det_ctx,
             (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                     &det_ctx->mtcu, &det_ctx->pmq,
                     buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
 
         local_id++;

diff --git a/src/detect-engine-frame.c b/src/detect-engine-frame.c
index 7b81108f806b4bc41c32ff7e094c19f11a38b011..2eaae4267aa3f746a920d15afbd8368cd02be969 100644 (file)
--- a/src/detect-engine-frame.c
+++ b/src/detect-engine-frame.c
@@ -49,7 +49,7 @@ void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead
         BUG_ON(engine->alproto == ALPROTO_UNKNOWN);
         if (engine->alproto == alproto && engine->ctx.frame_type == frame->type) {
             SCLogDebug("frame %p engine %p", frame, engine);
-            PREFILTER_PROFILING_START;
+            PREFILTER_PROFILING_START(det_ctx);
             engine->cb.PrefilterFrame(det_ctx, engine->pectx, p, frames, frame, idx);
             PREFILTER_PROFILING_END(det_ctx, engine->gid);
         }
@@ -102,6 +102,7 @@ static void PrefilterMpmFrame(DetectEngineThreadCtx *det_ctx, const void *pectx,
         (void)mpm_table[mpm_ctx->mpm_type].Search(
                 mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
         SCLogDebug("det_ctx->pmq.rule_id_array_cnt %u", det_ctx->pmq.rule_id_array_cnt);
+        PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);
     }
 }
 

diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c
index a0d4aea981086d943308884b660b4ec697a1e1b5..2d136a8bfe2f92a324dbe95bfc93d4139813a53a 100644 (file)
--- a/src/detect-engine-payload.c
+++ b/src/detect-engine-payload.c
@@ -47,7 +47,7 @@
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-validate.h"
-
+#include "util-profiling.h"
 #include "util-mpm-ac.h"
 
 struct StreamMpmData {
@@ -67,6 +67,7 @@ static int StreamMpmFunc(
         (void)mpm_table[smd->mpm_ctx->mpm_type].Search(smd->mpm_ctx,
                 &smd->det_ctx->mtcs, &smd->det_ctx->pmq,
                 data, data_len);
+        PREFILTER_PROFILING_ADD_BYTES(smd->det_ctx, data_len);
     }
     return 0;
 }
@@ -101,6 +102,7 @@ static void PrefilterPktStream(DetectEngineThreadCtx *det_ctx,
             (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                     &det_ctx->mtc, &det_ctx->pmq,
                     p->payload, p->payload_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, p->payload_len);
         }
     }
 }
@@ -124,6 +126,8 @@ static void PrefilterPktPayload(DetectEngineThreadCtx *det_ctx,
     (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
             &det_ctx->mtc, &det_ctx->pmq,
             p->payload, p->payload_len);
+
+    PREFILTER_PROFILING_ADD_BYTES(det_ctx, p->payload_len);
 }
 
 int PrefilterPktPayloadRegister(DetectEngineCtx *de_ctx,

diff --git a/src/detect-engine-prefilter.c b/src/detect-engine-prefilter.c
index 54e2a241f850fa1b80eae21a61f93a0b9a14f504..034c16e1b7fcc6f776aa518926b7310bad39a737 100644 (file)
--- a/src/detect-engine-prefilter.c
+++ b/src/detect-engine-prefilter.c
@@ -117,7 +117,7 @@ void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx,
             }
         }
 
-        PREFILTER_PROFILING_START;
+        PREFILTER_PROFILING_START(det_ctx);
         engine->cb.PrefilterTx(det_ctx, engine->pectx,
                 p, p->flow, tx->tx_ptr, tx->tx_id, flow_flags);
         PREFILTER_PROFILING_END(det_ctx, engine->gid);
@@ -159,7 +159,7 @@ void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh,
         /* run packet engines */
         PrefilterEngine *engine = sgh->pkt_engines;
         do {
-            PREFILTER_PROFILING_START;
+            PREFILTER_PROFILING_START(det_ctx);
             engine->cb.Prefilter(det_ctx, p, engine->pectx);
             PREFILTER_PROFILING_END(det_ctx, engine->gid);
 
@@ -178,7 +178,7 @@ void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh,
         PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_PAYLOAD);
         PrefilterEngine *engine = sgh->payload_engines;
         while (1) {
-            PREFILTER_PROFILING_START;
+            PREFILTER_PROFILING_START(det_ctx);
             engine->cb.Prefilter(det_ctx, p, engine->pectx);
             PREFILTER_PROFILING_END(det_ctx, engine->gid);
 
@@ -743,6 +743,7 @@ static void PrefilterMpm(DetectEngineThreadCtx *det_ctx,
     if (data != NULL && data_len >= mpm_ctx->minlen) {
         (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                 &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
+        PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);
     }
 }
 
@@ -813,6 +814,7 @@ static void PrefilterMpmPkt(DetectEngineThreadCtx *det_ctx,
     if (data != NULL && data_len >= mpm_ctx->minlen) {
         (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                 &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
+        PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);
     }
 }
 

diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index 549a2a00372be894a7938563d9f34464f0eef659..de60a94ac3add108c317a1afcdafc2059f6236b8 100644 (file)
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -49,6 +49,7 @@
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 #include "util-file-decompression.h"
+#include "util-profiling.h"
 
 static int DetectFiledataSetup (DetectEngineCtx *, Signature *, const char *);
 #ifdef UNITTESTS
@@ -465,6 +466,7 @@ static void PrefilterTxHTTPFiledata(DetectEngineThreadCtx *det_ctx, const void *
     if (buffer->inspect_len >= mpm_ctx->minlen) {
         (void)mpm_table[mpm_ctx->mpm_type].Search(
                 mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer->inspect, buffer->inspect_len);
+        PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
     }
 }
 
@@ -681,6 +683,7 @@ static void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx,
                 (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                         &det_ctx->mtcu, &det_ctx->pmq,
                         buffer->inspect, buffer->inspect_len);
+                PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
             }
             local_file_id++;
         }

diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index 6dbd2ce4041f0d9eef20a2c1f5524abde50f823f..aa8a34135aa9ca4089ad7d3aacec3b46b2b76f96 100644 (file)
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -46,6 +46,7 @@
 
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
+#include "util-profiling.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
@@ -559,6 +560,7 @@ static void PrefilterTxFilemagic(DetectEngineThreadCtx *det_ctx,
                 (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                         &det_ctx->mtcu, &det_ctx->pmq,
                         buffer->inspect, buffer->inspect_len);
+                PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
             }
             local_file_id++;
         }

diff --git a/src/detect-filename.c b/src/detect-filename.c
index c7b95870fd73146e354937b6ab1a2de4c02ca957..0ee89636b808ab6dc75bc2b95d9ed001b6ff7e5c 100644 (file)
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -46,6 +46,7 @@
 #include "util-spm-bm.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
+#include "util-profiling.h"
 
 #include "app-layer.h"
 
@@ -455,6 +456,7 @@ static void PrefilterTxFilename(DetectEngineThreadCtx *det_ctx,
                 (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                         &det_ctx->mtcu, &det_ctx->pmq,
                         buffer->inspect, buffer->inspect_len);
+                PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
             }
             local_file_id++;
         }

diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c
index f4511957634eb135e37d4b63af7eb1ac8ad3406f..bfaa6e9255b9bd9ff81c692add47341c93ec27e8 100644 (file)
--- a/src/detect-http-client-body.c
+++ b/src/detect-http-client-body.c
@@ -58,6 +58,7 @@
 #include "app-layer-htp.h"
 #include "detect-http-client-body.h"
 #include "stream-tcp.h"
+#include "util-profiling.h"
 
 static int DetectHttpClientBodySetup(DetectEngineCtx *, Signature *, const char *);
 static int DetectHttpClientBodySetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str);
@@ -366,6 +367,7 @@ static void PrefilterTxHttpRequestBody(DetectEngineThreadCtx *det_ctx, const voi
     if (buffer->inspect_len >= mpm_ctx->minlen) {
         (void)mpm_table[mpm_ctx->mpm_type].Search(
                 mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer->inspect, buffer->inspect_len);
+        PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
     }
 }
 

diff --git a/src/detect-http-header.c b/src/detect-http-header.c
index ea692c604e2a5a59e67de6d679b34398dae1e9fd..2e55b4248272f24c77b54f991586d46ec1cf6afc 100644 (file)
--- a/src/detect-http-header.c
+++ b/src/detect-http-header.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2021 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -47,6 +47,7 @@
 #include "util-debug.h"
 #include "util-print.h"
 #include "util-memcmp.h"
+#include "util-profiling.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
@@ -271,6 +272,7 @@ static void PrefilterMpmHttpHeader(DetectEngineThreadCtx *det_ctx,
     if (data != NULL && data_len >= mpm_ctx->minlen) {
         (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                 &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
+        PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);
     }
 }
 

diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c
index 61604f0685a1de134cbfd12ed9f30aea23c20e25..36555b4c89eef06ecb6d71d819eeb8d4c36fc1f9 100644 (file)
--- a/src/detect-http-raw-header.c
+++ b/src/detect-http-raw-header.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2019 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -46,6 +46,7 @@
 #include "flow-util.h"
 
 #include "util-debug.h"
+#include "util-profiling.h"
 
 #include "app-layer.h"
 #include "app-layer-parser.h"
@@ -267,6 +268,7 @@ static void PrefilterMpmHttpHeaderRaw(DetectEngineThreadCtx *det_ctx,
     if (data != NULL && data_len >= mpm_ctx->minlen) {
         (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                 &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
+        PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);
     }
 }
 

diff --git a/src/detect-http2.c b/src/detect-http2.c
index 09657fa461a1a51418b01d8f96dfcf49f10bfcd0..e21cc7b14bfc93aa7c5981f1d8ef1b4ef77b8df9 100644 (file)
--- a/src/detect-http2.c
+++ b/src/detect-http2.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2020 Open Information Security Foundation
+/* Copyright (C) 2020-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -37,6 +37,7 @@
 #include "detect-http2.h"
 #include "util-byte.h"
 #include "rust.h"
+#include "util-profiling.h"
 
 #ifdef UNITTESTS
 void DetectHTTP2frameTypeRegisterTests (void);
@@ -727,6 +728,7 @@ static void PrefilterTxHttp2HName(DetectEngineThreadCtx *det_ctx,
             (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                     &det_ctx->mtcu, &det_ctx->pmq,
                     buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
 
         local_id++;
@@ -858,6 +860,7 @@ static void PrefilterTxHttp2Header(DetectEngineThreadCtx *det_ctx,
             (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                     &det_ctx->mtcu, &det_ctx->pmq,
                     buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
 
         local_id++;

diff --git a/src/detect-ike-vendor.c b/src/detect-ike-vendor.c
index 73c2c0a7bf7bce95985766d2f6767d2a1f5473be..5a5c8a66fe48cd9d36957585dd0a3e88fd89633c 100644 (file)
--- a/src/detect-ike-vendor.c
+++ b/src/detect-ike-vendor.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2020 Open Information Security Foundation
+/* Copyright (C) 2020-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -33,6 +33,7 @@
 #include "util-byte.h"
 
 #include "rust-bindings.h"
+#include "util-profiling.h"
 
 static int DetectIkeVendorSetup(DetectEngineCtx *, Signature *, const char *);
 
@@ -105,6 +106,7 @@ static void PrefilterTxIkeVendor(DetectEngineThreadCtx *det_ctx, const void *pec
         if (buffer->inspect_len >= mpm_ctx->minlen) {
             (void)mpm_table[mpm_ctx->mpm_type].Search(
                     mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
         local_id++;
     }

diff --git a/src/detect-krb5-cname.c b/src/detect-krb5-cname.c
index a7a2710178eb6bddffe7382ae69517e10b587c58..bb43056e9d430063180e3d3da279bec0176eb55f 100644 (file)
--- a/src/detect-krb5-cname.c
+++ b/src/detect-krb5-cname.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2018 Open Information Security Foundation
+/* Copyright (C) 2018-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -35,6 +35,7 @@
 
 #include "rust.h"
 #include "app-layer-krb5.h"
+#include "util-profiling.h"
 
 static int g_krb5_cname_buffer_id = 0;
 
@@ -159,6 +160,7 @@ static void PrefilterTxKrb5CName(DetectEngineThreadCtx *det_ctx,
             (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                     &det_ctx->mtcu, &det_ctx->pmq,
                     buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
 
         local_id++;

diff --git a/src/detect-krb5-sname.c b/src/detect-krb5-sname.c
index 318484b0861878cb0db5a59fc29b4b86037bba92..100c635e52ead4439b19fbc08071f7c724f9efef 100644 (file)
--- a/src/detect-krb5-sname.c
+++ b/src/detect-krb5-sname.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2018 Open Information Security Foundation
+/* Copyright (C) 2018-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -35,6 +35,7 @@
 
 #include "rust.h"
 #include "app-layer-krb5.h"
+#include "util-profiling.h"
 
 static int g_krb5_sname_buffer_id = 0;
 
@@ -159,6 +160,7 @@ static void PrefilterTxKrb5SName(DetectEngineThreadCtx *det_ctx,
             (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                     &det_ctx->mtcu, &det_ctx->pmq,
                     buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
 
         local_id++;

diff --git a/src/detect-mqtt-subscribe-topic.c b/src/detect-mqtt-subscribe-topic.c
index 996341b5f459035725df3af57a34c07c51c01852..c63c01919b0e0d63a10902c99beccb157623d761 100644 (file)
--- a/src/detect-mqtt-subscribe-topic.c
+++ b/src/detect-mqtt-subscribe-topic.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2020 Open Information Security Foundation
+/* Copyright (C) 2020-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -52,6 +52,7 @@
 #include "util-unittest.h"
 #include "util-spm.h"
 #include "util-print.h"
+#include "util-profiling.h"
 
 static int DetectMQTTSubscribeTopicSetup(DetectEngineCtx *, Signature *, const char *);
 
@@ -161,6 +162,7 @@ static void PrefilterTxMQTTSubscribeTopic(DetectEngineThreadCtx *det_ctx,
             (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                     &det_ctx->mtcu, &det_ctx->pmq,
                     buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
         local_id++;
     }

diff --git a/src/detect-mqtt-unsubscribe-topic.c b/src/detect-mqtt-unsubscribe-topic.c
index eb1343cbe6ce755c6c0d7a6b1b7e5b313e46005e..4249153a02dde442f142f064aee90f0a9c0e545f 100644 (file)
--- a/src/detect-mqtt-unsubscribe-topic.c
+++ b/src/detect-mqtt-unsubscribe-topic.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2020 Open Information Security Foundation
+/* Copyright (C) 2020-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -52,6 +52,7 @@
 #include "util-unittest.h"
 #include "util-spm.h"
 #include "util-print.h"
+#include "util-profiling.h"
 
 static int DetectMQTTUnsubscribeTopicSetup(DetectEngineCtx *, Signature *, const char *);
 
@@ -161,6 +162,7 @@ static void PrefilterTxMQTTUnsubscribeTopic(DetectEngineThreadCtx *det_ctx,
             (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                     &det_ctx->mtcu, &det_ctx->pmq,
                     buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
         local_id++;
     }

diff --git a/src/detect-quic-cyu-hash.c b/src/detect-quic-cyu-hash.c
index 095453037a604ddd17db443cc94bbe86f8e1a945..e76265de5bff97e50a05b949380d4f0bddb5b586 100644 (file)
--- a/src/detect-quic-cyu-hash.c
+++ b/src/detect-quic-cyu-hash.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2021 Open Information Security Foundation
+/* Copyright (C) 2021-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -32,6 +32,7 @@
 #include "detect-quic-cyu-hash.h"
 #include "detect-engine-build.h"
 #include "rust.h"
+#include "util-profiling.h"
 
 #ifdef UNITTESTS
 static void DetectQuicCyuHashRegisterTests(void);
@@ -155,6 +156,7 @@ static void PrefilterTxQuicHash(DetectEngineThreadCtx *det_ctx, const void *pect
         if (buffer->inspect_len >= mpm_ctx->minlen) {
             (void)mpm_table[mpm_ctx->mpm_type].Search(
                     mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
 
         local_id++;

diff --git a/src/detect-quic-cyu-string.c b/src/detect-quic-cyu-string.c
index 6a49f2667a20eda9e4d19aa16791629843fd801b..6ef0796874f50df17e7a436ce61874b778aa18d2 100644 (file)
--- a/src/detect-quic-cyu-string.c
+++ b/src/detect-quic-cyu-string.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2021 Open Information Security Foundation
+/* Copyright (C) 2021-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -30,6 +30,7 @@
 #include "detect-quic-cyu-string.h"
 #include "detect-engine-build.h"
 #include "rust.h"
+#include "util-profiling.h"
 
 #ifdef UNITTESTS
 static void DetectQuicCyuStringRegisterTests(void);
@@ -147,6 +148,7 @@ static void PrefilterTxQuicString(DetectEngineThreadCtx *det_ctx, const void *pe
         if (buffer->inspect_len >= mpm_ctx->minlen) {
             (void)mpm_table[mpm_ctx->mpm_type].Search(
                     mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
 
         local_id++;

diff --git a/src/detect-tls-certs.c b/src/detect-tls-certs.c
index 28b0f82ccab95329515640e8f54748a7cf5591ac..79fae74d4b796da5ab0650fe4ec9a707f7b28551 100644 (file)
--- a/src/detect-tls-certs.c
+++ b/src/detect-tls-certs.c
@@ -52,6 +52,7 @@
 #include "app-layer.h"
 #include "app-layer-ssl.h"
 
+#include "util-profiling.h"
 #include "util-unittest.h"
 #include "util-unittest-helper.h"
 
@@ -220,6 +221,7 @@ static void PrefilterTxTlsCerts(DetectEngineThreadCtx *det_ctx,
             (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                     &det_ctx->mtcu, &det_ctx->pmq,
                     buffer->inspect, buffer->inspect_len);
+            PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
         }
 
         cbdata.local_id++;

diff --git a/src/detect.h b/src/detect.h
index b483d48ba3ab779b5f71930272347ebb3d5a1f27..22211904f7d55f0c84fa1397a5640707f14bfac8 100644 (file)
--- a/src/detect.h
+++ b/src/detect.h
@@ -1199,6 +1199,10 @@ typedef struct DetectEngineThreadCtx_ {
 
     struct SCProfilePrefilterData_ *prefilter_perf_data;
     int prefilter_perf_size;
+    /** bytes inspected by current prefilter callback call */
+    uint64_t prefilter_bytes;
+    /** number of times we inspected a buffer */
+    uint64_t prefilter_bytes_called;
 #endif
 } DetectEngineThreadCtx;
 

diff --git a/src/util-profiling-prefilter.c b/src/util-profiling-prefilter.c
index 3005517ffa7bbb634c3992fbdc7e41c9711784fc..c5e0cfd104632430cd24e5d30859023a7426fc87 100644 (file)
--- a/src/util-profiling-prefilter.c
+++ b/src/util-profiling-prefilter.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2017 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -45,6 +45,11 @@ typedef struct SCProfilePrefilterData_ {
     uint64_t called;
     uint64_t total;
     uint64_t max;
+    uint64_t total_bytes;
+    uint64_t max_bytes;
+    uint64_t bytes_called; /**< number of times total_bytes was updated. Differs from `called` as a
+                              prefilter engine may skip mpm if the smallest pattern is bigger than
+                              the buffer to inspect. */
     const char *name;
 } SCProfilePrefilterData;
 
@@ -100,13 +105,20 @@ static void DoDump(SCProfilePrefilterDetectCtx *rules_ctx, FILE *fp, const char
     fprintf(fp, "  ----------------------------------------------"
             "------------------------------------------------------"
             "----------------------------\n");
-    fprintf(fp, "  %-32s %-15s %-15s %-15s %-15s\n", "Prefilter", "Ticks", "Called", "Max Ticks", "Avg");
+    fprintf(fp, "  %-32s %-15s %-15s %-15s %-15s %-15s %-15s %-15s %-15s %-15s\n", "Prefilter",
+            "Ticks", "Called", "Max Ticks", "Avg", "Bytes", "Called", "Max Bytes", "Avg Bytes",
+            "Ticks/Byte");
     fprintf(fp, "  -------------------------------- "
                 "--------------- "
                 "--------------- "
                 "--------------- "
                 "--------------- "
-        "\n");
+                "--------------- "
+                "--------------- "
+                "--------------- "
+                "--------------- "
+                "--------------- "
+                "\n");
     for (i = 0; i < (int)rules_ctx->size; i++) {
         SCProfilePrefilterData *d = &rules_ctx->data[i];
         if (d == NULL || d->called== 0)
@@ -117,14 +129,20 @@ static void DoDump(SCProfilePrefilterDetectCtx *rules_ctx, FILE *fp, const char
         if (ticks && d->called) {
             avgticks = (double)(ticks / d->called);
         }
+        double avgbytes = 0;
+        if (d->total_bytes && d->called) {
+            avgbytes = (double)(d->total_bytes / d->bytes_called);
+        }
+        double ticks_per_byte = 0;
+        if (ticks && d->total_bytes) {
+            ticks_per_byte = (double)(ticks / d->total_bytes);
+        }
 
         fprintf(fp,
-            "  %-32s %-15"PRIu64" %-15"PRIu64" %-15"PRIu64" %-15.2f\n",
-            d->name,
-            ticks,
-            d->called,
-            d->max,
-            avgticks);
+                "  %-32s %-15" PRIu64 " %-15" PRIu64 " %-15" PRIu64 " %-15.2f %-15" PRIu64
+                " %-15" PRIu64 " %-15" PRIu64 " %-15.2f %-15.2f\n",
+                d->name, ticks, d->called, d->max, avgticks, d->total_bytes, d->bytes_called,
+                d->max_bytes, avgbytes, ticks_per_byte);
     }
 }
 
@@ -180,8 +198,8 @@ SCProfilingPrefilterDump(DetectEngineCtx *de_ctx)
  * \param ticks Number of CPU ticks for this rule.
  * \param match Did the rule match?
  */
-void
-SCProfilingPrefilterUpdateCounter(DetectEngineThreadCtx *det_ctx, int id, uint64_t ticks)
+void SCProfilingPrefilterUpdateCounter(DetectEngineThreadCtx *det_ctx, int id, uint64_t ticks,
+        uint64_t bytes, uint64_t bytes_called)
 {
     if (det_ctx != NULL && det_ctx->prefilter_perf_data != NULL &&
             id < (int)det_ctx->de_ctx->prefilter_id)
@@ -192,6 +210,11 @@ SCProfilingPrefilterUpdateCounter(DetectEngineThreadCtx *det_ctx, int id, uint64
         if (ticks > p->max)
             p->max = ticks;
         p->total += ticks;
+
+        p->bytes_called += bytes_called;
+        if (bytes > p->max_bytes)
+            p->max_bytes = bytes;
+        p->total_bytes += bytes;
     }
 }
 
@@ -255,6 +278,14 @@ static void SCProfilingPrefilterThreadMerge(DetectEngineCtx *de_ctx, DetectEngin
         de_ctx->profile_prefilter_ctx->data[i].total += det_ctx->prefilter_perf_data[i].total;
         if (det_ctx->prefilter_perf_data[i].max > de_ctx->profile_prefilter_ctx->data[i].max)
             de_ctx->profile_prefilter_ctx->data[i].max = det_ctx->prefilter_perf_data[i].max;
+        de_ctx->profile_prefilter_ctx->data[i].total_bytes +=
+                det_ctx->prefilter_perf_data[i].total_bytes;
+        if (det_ctx->prefilter_perf_data[i].max_bytes >
+                de_ctx->profile_prefilter_ctx->data[i].max_bytes)
+            de_ctx->profile_prefilter_ctx->data[i].max_bytes =
+                    det_ctx->prefilter_perf_data[i].max_bytes;
+        de_ctx->profile_prefilter_ctx->data[i].bytes_called +=
+                det_ctx->prefilter_perf_data[i].bytes_called;
     }
 }
 

diff --git a/src/util-profiling.h b/src/util-profiling.h
index 3ef032d5d862869dd6e9ca822081f3c610163ace..ad7c710169a220c89b009a5318d5b55a795da019 100644 (file)
--- a/src/util-profiling.h
+++ b/src/util-profiling.h
@@ -275,28 +275,36 @@ PktProfiling *SCProfilePacketStart(void);
 extern int profiling_prefilter_enabled;
 extern thread_local int profiling_prefilter_entered;
 
-#define PREFILTER_PROFILING_START \
-    uint64_t profile_prefilter_start_ = 0; \
-    uint64_t profile_prefilter_end_ = 0; \
-    if (profiling_prefilter_enabled) { \
-        if (profiling_prefilter_entered > 0) { \
-            SCLogError(SC_ERR_FATAL, "Re-entered profiling, exiting."); \
-            abort(); \
-        } \
-        profiling_prefilter_entered++; \
-        profile_prefilter_start_ = UtilCpuGetTicks(); \
+#define PREFILTER_PROFILING_START(det_ctx)                                                         \
+    (det_ctx)->prefilter_bytes = 0;                                                                \
+    (det_ctx)->prefilter_bytes_called = 0;                                                         \
+    uint64_t profile_prefilter_start_ = 0;                                                         \
+    uint64_t profile_prefilter_end_ = 0;                                                           \
+    if (profiling_prefilter_enabled) {                                                             \
+        if (profiling_prefilter_entered > 0) {                                                     \
+            SCLogError(SC_ERR_FATAL, "Re-entered profiling, exiting.");                            \
+            abort();                                                                               \
+        }                                                                                          \
+        profiling_prefilter_entered++;                                                             \
+        profile_prefilter_start_ = UtilCpuGetTicks();                                              \
     }
 
 /* we allow this macro to be called if profiling_prefilter_entered == 0,
  * so that we don't have to refactor some of the detection code. */
-#define PREFILTER_PROFILING_END(ctx, profile_id) \
-    if (profiling_prefilter_enabled && profiling_prefilter_entered) { \
-        profile_prefilter_end_ = UtilCpuGetTicks(); \
-        if (profile_prefilter_end_ > profile_prefilter_start_) \
-            SCProfilingPrefilterUpdateCounter((ctx),(profile_id),(profile_prefilter_end_ - profile_prefilter_start_)); \
-        profiling_prefilter_entered--; \
+#define PREFILTER_PROFILING_END(ctx, profile_id)                                                   \
+    if (profiling_prefilter_enabled && profiling_prefilter_entered) {                              \
+        profile_prefilter_end_ = UtilCpuGetTicks();                                                \
+        if (profile_prefilter_end_ > profile_prefilter_start_)                                     \
+            SCProfilingPrefilterUpdateCounter((ctx), (profile_id),                                 \
+                    (profile_prefilter_end_ - profile_prefilter_start_), (ctx)->prefilter_bytes,   \
+                    (ctx)->prefilter_bytes_called);                                                \
+        profiling_prefilter_entered--;                                                             \
     }
 
+#define PREFILTER_PROFILING_ADD_BYTES(det_ctx, bytes)                                              \
+    (det_ctx)->prefilter_bytes += (bytes);                                                         \
+    (det_ctx)->prefilter_bytes_called++
+
 void SCProfilingRulesGlobalInit(void);
 void SCProfilingRuleDestroyCtx(struct SCProfileDetectCtx_ *);
 void SCProfilingRuleInitCounters(DetectEngineCtx *);
@@ -315,7 +323,8 @@ struct SCProfilePrefilterDetectCtx_;
 void SCProfilingPrefilterGlobalInit(void);
 void SCProfilingPrefilterDestroyCtx(DetectEngineCtx *);
 void SCProfilingPrefilterInitCounters(DetectEngineCtx *);
-void SCProfilingPrefilterUpdateCounter(DetectEngineThreadCtx *det_ctx, int id, uint64_t ticks);
+void SCProfilingPrefilterUpdateCounter(DetectEngineThreadCtx *det_ctx, int id, uint64_t ticks,
+        uint64_t bytes, uint64_t bytes_called);
 void SCProfilingPrefilterThreadSetup(struct SCProfilePrefilterDetectCtx_ *, DetectEngineThreadCtx *);
 void SCProfilingPrefilterThreadCleanup(DetectEngineThreadCtx *);
 
@@ -368,8 +377,9 @@ void SCProfilingDump(void);
 #define FLOWWORKER_PROFILING_START(p, id)
 #define FLOWWORKER_PROFILING_END(p, id)
 
-#define PREFILTER_PROFILING_START
+#define PREFILTER_PROFILING_START(ctx)
 #define PREFILTER_PROFILING_END(ctx, profile_id)
+#define PREFILTER_PROFILING_ADD_BYTES(det_ctx, bytes)
 
 #endif /* PROFILING */