Pull request #4313: appid : disable appid cpu profiler

Merge in SNORT/snort3 from ~UMASHARM/snort3:appid_cpu_profiler_disable to master

Squashed commit of the following:

commit f523a8fc876ba154d0597274c76a132fd2514192
Author: Umang Sharma <umasharm@cisco.com>
Date:   Tue May 7 13:22:20 2024 -0400

    appid : disable appid cpu profiler

diff --git a/src/network_inspectors/appid/app_info_table.cc b/src/network_inspectors/appid/app_info_table.cc
index c87c70fcad0b5d0fe8cd8772fbbc8dc1ce3be981..1fd2c0e3a86606f4e0abb1d49b862a37ff5ed990 100644 (file)
--- a/src/network_inspectors/appid/app_info_table.cc
+++ b/src/network_inspectors/appid/app_info_table.cc
@@ -622,6 +622,10 @@ void AppInfoManager::load_odp_config(OdpContext& odp_ctxt, const char* path)
                 {
                     odp_ctxt.appid_cpu_profiler = false;
                 }
+                else if (!(strcasecmp(conf_val, "enabled")))
+                {
+                    odp_ctxt.appid_cpu_profiler = true;
+                }
             }
             else
                 ParseWarning(WARN_CONF, "appid: unsupported configuration: %s\n", conf_key);

diff --git a/src/network_inspectors/appid/appid_cip_event_handler.cc b/src/network_inspectors/appid/appid_cip_event_handler.cc
index 16e11e3f23c13b3c7ff826735ea416cfcccef61f..660651d92e68ff123610b67ef99e82755749f5b3 100644 (file)
--- a/src/network_inspectors/appid/appid_cip_event_handler.cc
+++ b/src/network_inspectors/appid/appid_cip_event_handler.cc
@@ -68,12 +68,6 @@ void CipEventHandler::handle(DataEvent& event, Flow* flow)
 
     if (!asd)
         return;
-    
-    bool is_appid_cpu_profiling_running = (asd->get_odp_ctxt().is_appid_cpu_profiler_running());
-    Stopwatch<SnortClock> per_appid_event_cpu_timer;
-
-    if (is_appid_cpu_profiling_running)
-        per_appid_event_cpu_timer.start();
 
     if (!pkt_thread_odp_ctxt or (asd->get_odp_ctxt_version() != pkt_thread_odp_ctxt->get_version()))
         return;
@@ -81,12 +75,18 @@ void CipEventHandler::handle(DataEvent& event, Flow* flow)
     if (!asd->get_session_flags(APPID_SESSION_DISCOVER_APP | APPID_SESSION_SPECIAL_MONITORED))
         return;
 
+    bool is_appid_cpu_profiling_running = (asd->get_odp_ctxt().is_appid_cpu_profiler_running());
+    Stopwatch<SnortClock> per_appid_event_cpu_timer;
+
+    if (is_appid_cpu_profiling_running)
+        per_appid_event_cpu_timer.start();
+
     CipEvent& cip_event = (CipEvent&)event;
     const CipEventData* event_data = cip_event.get_event_data();
 
     if (!event_data)
         return;
-
+        
     const Packet* p = cip_event.get_packet();
     assert(p);
 

diff --git a/src/network_inspectors/appid/appid_config.h b/src/network_inspectors/appid/appid_config.h
index d41566bda4691ef43e6e56773aa4ea01ba381032..8818e4cf6c564dedc3238c5eb13e37782628323b 100644 (file)
--- a/src/network_inspectors/appid/appid_config.h
+++ b/src/network_inspectors/appid/appid_config.h
@@ -144,7 +144,7 @@ public:
     uint16_t max_packet_service_fail_ignore_bytes = DEFAULT_MAX_PKT_BEFORE_SERVICE_FAIL_IGNORE_BYTES;
     FirstPktAppIdDiscovered first_pkt_appid_prefix = NO_APPID_FOUND;
     bool eve_http_client = true;
-    bool appid_cpu_profiler= true;
+    bool appid_cpu_profiler = false;
 
     OdpContext(const AppIdConfig&, snort::SnortConfig*);
     void initialize(AppIdInspector& inspector);

diff --git a/src/network_inspectors/appid/appid_http_event_handler.cc b/src/network_inspectors/appid/appid_http_event_handler.cc
index bab90299df5effa773203d1831e0eb601c5fcc95..32a5807076e65e28af72dd27e5155ab915c13da4 100644 (file)
--- a/src/network_inspectors/appid/appid_http_event_handler.cc
+++ b/src/network_inspectors/appid/appid_http_event_handler.cc
@@ -77,16 +77,16 @@ void HttpEventHandler::handle(DataEvent& event, Flow* flow)
     HttpEvent* http_event = (HttpEvent*)&event;
     AppidChangeBits change_bits;
 
+    if ((asd->get_tp_appid_ctxt() or ThirdPartyAppIdContext::get_tp_reload_in_progress()) and
+        !http_event->get_is_httpx())
+        return;
+
     bool is_appid_cpu_profiling_running = (asd->get_odp_ctxt().is_appid_cpu_profiler_running());
     Stopwatch<SnortClock> per_appid_event_cpu_timer;
 
     if (is_appid_cpu_profiling_running)
         per_appid_event_cpu_timer.start();
-
-    if ((asd->get_tp_appid_ctxt() or ThirdPartyAppIdContext::get_tp_reload_in_progress()) and
-        !http_event->get_is_httpx())
-        return;
-
+    
     if (appidDebug->is_enabled() and !is_debug_active)
         appidDebug->activate(flow, asd, inspector.get_ctxt().config.log_all_sessions);
 

diff --git a/src/network_inspectors/appid/appid_ssh_event_handler.cc b/src/network_inspectors/appid/appid_ssh_event_handler.cc
index 61e66a2a9801097f3c089ccdf40637556db8d372..d4a195a03c4c26a0b282a6ce69290dd88a4c97e9 100644 (file)
--- a/src/network_inspectors/appid/appid_ssh_event_handler.cc
+++ b/src/network_inspectors/appid/appid_ssh_event_handler.cc
@@ -158,17 +158,17 @@ void SshEventHandler::handle(DataEvent& event, Flow* flow)
     if (!asd)
         return;
 
-    bool is_appid_cpu_profiling_running = (asd->get_odp_ctxt().is_appid_cpu_profiler_running());
-    Stopwatch<SnortClock> per_appid_event_cpu_timer;
-
-    if (is_appid_cpu_profiling_running)
-        per_appid_event_cpu_timer.start();
-
     if (asd->get_odp_ctxt_version() != pkt_thread_odp_ctxt->get_version())
         return; // Skip detection for sessions using old odp context after odp reload
     if (!asd->get_session_flags(APPID_SESSION_DISCOVER_APP | APPID_SESSION_SPECIAL_MONITORED))
         return;
 
+    bool is_appid_cpu_profiling_running = (asd->get_odp_ctxt().is_appid_cpu_profiler_running());
+    Stopwatch<SnortClock> per_appid_event_cpu_timer;
+
+    if (is_appid_cpu_profiling_running)
+        per_appid_event_cpu_timer.start();
+    
     SshEventFlowData* data = (SshEventFlowData* )asd->get_flow_data(id);
     Packet* p = DetectionEngine::get_current_packet();