Merge pull request #535 in SNORT/snort3 from sdf-pegs to master

Squashed commit of the following:

commit f13df8d70300e1d09d501f41736d73cee2f117bb
Merge: 131823a 9ca3fe1
Author: Victor Roemer <viroemer@cisco.com>
Date:   Mon Jun 20 13:46:58 2016 -0400

    Merge branch 'master' into sdf-pegs

commit 131823a75e89d2e13afb64b4364e1425a9a2fe07
Merge: a6c55e8 bd5d03a
Author: Victor Roemer <viroemer@cisco.com>
Date:   Fri Jun 17 16:27:53 2016 -0400

    Merge branch 'master' into sdf-pegs

commit a6c55e80d9f82ff5a35d57dbbfce59689d4eb515
Merge: 68f8389 df81d32
Author: Victor Roemer <viroemer@cisco.com>
Date:   Wed Jun 15 17:34:16 2016 -0400

    Merge branch 'master' into sdf-pegs

commit 68f838922f0da119fa0e08b0bbb5ce920a35ed6f
Merge: 6ce2f1b 35da82b
Author: Victor Roemer <viroemer@cisco.com>
Date:   Tue Jun 14 16:39:12 2016 -0400

    Merge branch 'master' into sdf-pegs

commit 6ce2f1b6ade46a0e292aa67b70fa000e384f9599
Author: Victor Roemer <viroemer@Mac.local>
Date:   Fri Jun 10 14:28:37 2016 -0400

    Add perfmon counters for the "sd_pattern" rule opt

diff --git a/src/ips_options/ips_sd_pattern.cc b/src/ips_options/ips_sd_pattern.cc
index 8e06a897042721e4cbea0978d885bdbbe6d51fb6..fc5be6af8ca23d5f047d4f34cf6054ef5f231759 100644 (file)
--- a/src/ips_options/ips_sd_pattern.cc
+++ b/src/ips_options/ips_sd_pattern.cc
@@ -40,6 +40,21 @@
 #define s_name "sd_pattern"
 #define s_help "rule option for detecting sensitive data"
 
+struct SdStats
+{
+    PegCount nomatch_notfound;
+    PegCount nomatch_threshold;
+};
+
+const PegInfo sd_pegs[] =
+{
+    { "below threshold", "sd_pattern matched but missed threshold" },
+    { "pattern not found", "sd_pattern did not not match" },
+    { nullptr, nullptr }
+};
+
+static THREAD_LOCAL SdStats s_stats;
+
 struct SdPatternConfig
 {
     std::string pii;
@@ -147,8 +162,13 @@ int SdPatternOption::eval(Cursor& c, Packet* p)
     Profile profile(sd_pattern_perf_stats);
 
     unsigned matches = SdSearch(c, p);
+
     if ( matches >= config.threshold )
         return DETECTION_OPTION_MATCH;
+    else if ( matches == 0 )
+        ++s_stats.nomatch_notfound;
+    else if ( matches > 0 && matches < config.threshold )
+        ++s_stats.nomatch_threshold;
 
     return DETECTION_OPTION_NO_MATCH;
 }
@@ -176,13 +196,17 @@ public:
     bool begin(const char*, int, SnortConfig*) override;
     bool set(const char*, Value& v, SnortConfig*) override;
 
+    const PegInfo* get_pegs() const override
+    { return sd_pegs; }
+
+    PegCount* get_counts() const override
+    { return (PegCount*)&s_stats; }
+
     ProfileStats* get_profile() const override
     { return &sd_pattern_perf_stats; }
 
     void get_data(SdPatternConfig& c)
-    {
-        c = config;
-    }
+    { c = config; }
 
 private:
     SdPatternConfig config;