src/host_tracker/test/Makefile \
src/catch/Makefile \
src/time/Makefile \
-src/ppm/Makefile \
src/profiler/Makefile \
src/utils/Makefile \
src/utils/test/Makefile \
-- uncomment normalizer if you are inline or not --pedantic
--normalizer = { }
---ppm = { }
+--latency = { }
--profiler = { }
--perf_monitor = { }
detection
framework
time
- ppm
latency
profiler
ips_actions
add_subdirectory(packet_io)
add_subdirectory(parser)
add_subdirectory(ports)
-add_subdirectory(ppm)
add_subdirectory(protocols)
add_subdirectory(sfip)
add_subdirectory(sfrt)
detection/libdetection.a \
framework/libframework.a \
time/libtime.a \
-ppm/libppm.a \
latency/liblatency.a \
profiler/libprofiler.a \
actions/libips_actions.a \
packet_io \
parser \
ports \
-ppm \
protocols \
search_engines \
service_inspectors \
#include "latency/packet_latency.h"
#include "log/obfuscation.h"
#include "profiler/profiler.h"
-#include "ppm/ppm.h"
#include "stream/stream_api.h"
#include "packet_io/active.h"
#include "managers/inspector_manager.h"
#include "pattern_match_data.h"
#include "rules.h"
-#include "ppm/ppm.h"
#include "profiler/profiler.h"
#include "utils/util.h"
#include "hash/sfxhash.h"
// detection options only once per pattern match.
//
// These trees are instantiated at parse time, one per MPSE match state.
-// Eval, profiling, and ppm data are attached in an array sized per max
+// Eval, profiling, and latency data are attached in an array sized per max
// packet threads.
#ifdef HAVE_CONFIG_H
#include "stream/stream_api.h"
#include "utils/sflsq.h"
#include "utils/util.h"
-#include "ppm/ppm.h"
#include "profiler/profiler.h"
#include "actions/actions.h"
#include "sfip/sf_ip.h"
return 0;
}
-#define CHECK_PPM() \
- if ( PacketLatency::fastpath() ) \
- return 1;
-
#define SEARCH_DATA(buf, len, cnt) \
{ \
assert(so->get_pattern_count() > 0); \
stash.init(); \
so->search(buf, len, rule_tree_queue, omd, &start_state); \
stash.process(rule_tree_match, omd); \
- CHECK_PPM() \
+ if ( PacketLatency::fastpath() ) \
+ return 1; \
}
#define SEARCH_BUFFER(ibt, pmt, cnt) \
SEARCH_DATA(buf.data, buf.len, cnt) \
}
-#define SEARCH_PACKET(buf, len, cnt) \
- if ( len ) \
- SEARCH_DATA(buf, len, cnt)
-
static int fp_search(
PortGroup* port_group, Packet* p,
int check_ports, int type, OTNX_MATCH_DATA* omd)
if ( IsLimitedDetect(p) && (p->alt_dsize < p->dsize) )
pattern_match_size = p->alt_dsize;
- SEARCH_PACKET(p->data, pattern_match_size, pc.pkt_searches);
+ if ( pattern_match_size )
+ SEARCH_DATA(p->data, pattern_match_size, pc.pkt_searches);
if ( pattern_match_size )
p->is_cooked() ? pc.cooked_searches++ : pc.raw_searches++;
{
// FIXIT-M file data should be obtained from
// inspector gadget as is done with SEARCH_BUFFER
- SEARCH_PACKET(g_file_data.data, g_file_data.len, pc.file_searches);
+ if ( g_file_data.len )
+ SEARCH_DATA(g_file_data.data, g_file_data.len, pc.file_searches);
}
}
return 0;
#include "filters/sfrf.h"
#include "filters/rate_filter.h"
#include "codecs/codec_module.h"
-#include "ppm/ppm_module.h"
#include "latency/latency_module.h"
#include "profiler/profiler.h"
#include "target_based/sftarget_data.h"
ModuleManager::add_module(new ActiveModule);
ModuleManager::add_module(new FileIdModule);
- ModuleManager::add_module(new PpmModule);
ModuleManager::add_module(new LatencyModule);
// these modules should be in ips policy
#include "filters/rate_filter.h"
#include "filters/detection_filter.h"
#include "time/packet_time.h"
-#include "ppm/ppm.h"
#include "profiler/profiler.h"
#include "time/periodic.h"
#include "ips_options/ips_flowbits.h"
void Snort::thread_term()
{
- ppm_sum_stats();
-
if ( !snort_conf->dirty_pig )
InspectorManager::thread_stop(snort_conf);
#include "detection/fp_create.h"
#include "ips_options/ips_pcre.h"
#include "protocols/udp.h"
-#include "ppm/ppm.h"
#include "latency/latency_config.h"
#include "profiler/profiler.h"
#include "sfip/sf_ip.h"
profiler = new ProfilerConfig;
- ppm_cfg = (ppm_cfg_t*)SnortAlloc(sizeof(*ppm_cfg));
latency = new LatencyConfig();
memory = new MemoryConfig();
delete profiler;
- free(ppm_cfg);
delete latency;
delete memory;
return false;
}
- /* XXX XXX Not really sure we need to disallow this */
- if (snort_conf->ppm_cfg->rule_log != ppm_cfg->rule_log)
- {
- ErrorMessage("Snort Reload: Changing the ppm rule_log "
- "configuration requires a restart.\n");
- return false;
- }
-
if (snort_conf->group_id != group_id)
{
ErrorMessage("Snort Reload: Changing the group id "
struct VarNode* var_list = nullptr;
//------------------------------------------------------
- // deliberately not conditional
- // to avoid plugin compatibility issues
ProfilerConfig* profiler = nullptr;
- struct ppm_cfg_t* ppm_cfg = nullptr;
LatencyConfig* latency = nullptr;
struct _IntelPmHandles* ipm_handles = nullptr;
#define DEBUG_LOG 0x0000000000000200LL
#define DEBUG_FLOWBITS 0x0000000000000400LL
#define DEBUG_FILE 0x0000000000000800LL
-#define DEBUG_PPM 0x0000000000001000LL
+// FIXIT-L J latency doesn't use any debug messages
+#define DEBUG_LATENCY 0x0000000000001000LL
// this env var uses the upper 32 bits of the flags:
#define DEBUG_PLUGIN "SNORT_PP_DEBUG"
#include "log/obfuscation.h"
#include "log/messages.h"
#include "packet_io/active.h"
-#include "ppm/ppm.h"
#include "target_based/snort_protocols.h"
#include "binder/bind_module.h"
#include "utils/sflsq.h"
#include "utils/util.h"
#include "utils/snort_bounds.h"
-#include "ppm/ppm.h"
#include "filters/rate_filter.h"
#include "filters/detection_filter.h"
#include "packet_io/active.h"
#include "sfip/sf_vartable.h"
#include "sfip/sf_ip.h"
#include "sfip/sf_ipvar.h"
-#include "ppm/ppm.h"
#include "packet_io/active.h"
#include "file_api/file_config.h"
#include "actions/actions.h"
#include "sfip/sf_vartable.h"
#include "sfip/sf_ip.h"
#include "sfip/sf_ipvar.h"
-#include "ppm/ppm.h"
#include "packet_io/active.h"
#include "file_api/file_config.h"
#include "framework/ips_option.h"
+++ /dev/null
-set ( PPM_SOURCES ppm.cc ppm_module.cc )
-set ( PPM_INCLUDES ppm.h )
-
-add_library ( ppm STATIC
- ${PPM_SOURCES}
- ${PPM_INCLUDES}
-)
-
-install (FILES ${PPM_INCLUDES}
- DESTINATION "${INCLUDE_INSTALL_PATH}/ppm"
-)
+++ /dev/null
-noinst_LIBRARIES = libppm.a
-
-x_includedir = $(pkgincludedir)/ppm
-
-x_include_HEADERS = ppm.h
-
-libppm_a_SOURCES = \
-ppm.cc \
-ppm.h \
-ppm_module.cc \
-ppm_module.h
+++ /dev/null
-Packet Performance monitoring provides facilities for gathering
-statistics about the packet processing system as a whole. These
-statistics include timing information for rule evaluation, packet
-decoding and event processing, as well as counts for actions taken on
-packets before and during rule evaluation.
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2006-2013 Sourcefire, Inc.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-/*
-**
-** ppm.c
-**
-** Packet Performance Monitor
-**
-** Author: Marc Norton <mnorton@sourcefire.com>
-** Date: 10/2006
-**
-** Usage:
-*
-* config ppm: max-pkt-time usecs
-* config ppm: max-rule-time usecs
-* config ppm: max-suspend-time secs
-* config ppm: threshold count
-* config ppm: suspend-expensive-rules
-* config ppm: fastpath-expensive-packets
-* config ppm: pkt-events syslog|console
-* config ppm: rule-events alert|syslog|console
-*
-*/
-
-#include "ppm.h"
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "detection/fp_create.h"
-#include "detection/treenodes.h"
-#include "events/event_queue.h"
-#include "log/messages.h"
-#include "sfip/sf_ip.h"
-#include "utils/stats.h"
-#include "utils/util.h"
-
-#include "ppm_module.h"
-
-#define PPM_BASE_SUSPEND_RULE_GID 1000
-#define PPM_BASE_CLEAR_RULE_GID 2000
-
-#define PPM_DEFAULT_MAX_PKT_TICKS 0
-#define PPM_DEFAULT_MAX_RULE_TICKS 0
-#define PPM_DEFAULT_MAX_SUSP_SECS 60
-#define PPM_DEFAULT_RULE_THRESHOLD 5
-
-PPM_TICKS ppm_tpu = 1; /* ticks per usec */
-
-static ppm_stats_t g_ppm_stats;
-
-THREAD_LOCAL ppm_stats_t ppm_stats;
-THREAD_LOCAL ppm_pkt_timer_t ppm_pkt_times[PPM_MAX_TIMERS];
-THREAD_LOCAL ppm_pkt_timer_t* ppm_pt = NULL;
-THREAD_LOCAL unsigned int ppm_pkt_index = 0;
-THREAD_LOCAL ppm_rule_timer_t ppm_rule_times[PPM_MAX_TIMERS];
-THREAD_LOCAL ppm_rule_timer_t* ppm_rt = NULL;
-THREAD_LOCAL unsigned int ppm_rule_times_index = 0;
-THREAD_LOCAL uint64_t ppm_cur_time = 0;
-
-/* temporary flags */
-THREAD_LOCAL int ppm_abort_this_pkt = 0;
-THREAD_LOCAL int ppm_suspend_this_rule = 0;
-
-#define MAX_DP_NRULES 1000
-typedef struct
-{
- uint64_t pkt;
- detection_option_tree_root_t* tree;
- PPM_TICKS ticks;
-} ppm_rules_t;
-
-/* suspended rules */
-// FIXIT-L storing rule tree pointers is a bad idea
-// - no accommodation for reload
-// - really not used except to log
-// - should be deleted
-static THREAD_LOCAL ppm_rules_t ppm_rules[MAX_DP_NRULES];
-static THREAD_LOCAL int ppm_n_rules;
-
-/* cleared rules - re-enabled */
-// FIXIT-L see above re storing rule tree pointers
-static THREAD_LOCAL detection_option_tree_root_t* ppm_crules[MAX_DP_NRULES];
-static THREAD_LOCAL int ppm_n_crules;
-
-void ppm_init_rules(void)
-{
- ppm_n_rules = 0;
- ppm_n_crules = 0;
-}
-
-void ppm_set_rule(detection_option_tree_root_t* root,PPM_TICKS ticks)
-{
- if ( ppm_n_rules < MAX_DP_NRULES )
- {
- ppm_rules[ppm_n_rules].tree=root;
- ppm_rules[ppm_n_rules].ticks=ticks;
- ppm_n_rules++;
- }
-}
-
-void ppm_clear_rule(detection_option_tree_root_t* root)
-{
- if ( ppm_n_crules < MAX_DP_NRULES )
- {
- ppm_crules[ppm_n_crules++]=root;
- }
-}
-
-/*
- * calc ticks per micro-secs in integer units
- * use usecs instead of ticks for rule suspension during pcap playback
- */
-static PPM_TICKS ppm_calc_ticks(void)
-{
-#ifndef REG_TEST
- ppm_tpu = (PPM_TICKS)get_ticks_per_usec();
-
- if ( ppm_tpu == 0 )
-#endif
- ppm_tpu = 1;
-
- return ppm_tpu;
-}
-
-void ppm_print_cfg(ppm_cfg_t* ppm_cfg)
-{
- if (ppm_cfg == NULL)
- return;
-
- if (!ppm_cfg->enabled)
- return;
-
- if ( ppm_cfg->max_pkt_ticks )
- {
- LogMessage("\n");
- LogMessage("Packet Performance Monitor Config:\n");
- LogMessage(" ticks per usec : %lu ticks\n",(unsigned long)ppm_tpu);
-
- LogMessage(" max packet time : %lu usecs\n",
- (unsigned long)(ppm_cfg->max_pkt_ticks/ppm_tpu));
-
- LogMessage(" packet action : ");
-
- if ( ppm_cfg->pkt_action )
- LogMessage("fastpath-expensive-packets\n");
- else
- LogMessage("none\n");
-
- LogMessage(" packet logging : ");
-
- if (ppm_cfg->pkt_log&PPM_LOG_ALERT)
- LogMessage("alert ");
-
- if (ppm_cfg->pkt_log&PPM_LOG_MESSAGE)
- LogMessage("log ");
-
- if (!ppm_cfg->pkt_log)
- LogMessage("none ");
-
- LogMessage("\n");
- }
-
- if ( ppm_cfg->max_rule_ticks)
- {
- LogMessage("\n");
- LogMessage("Rule Performance Monitor Config:\n");
- LogMessage(" ticks per usec : %lu ticks\n",(unsigned long)ppm_tpu);
-
- LogMessage(" max rule time : %lu usecs\n",
- (unsigned long)(ppm_cfg->max_rule_ticks/ ppm_tpu));
-
- LogMessage(" rule action : ");
-
- if ( ppm_cfg->rule_action )
- {
- LogMessage("suspend-expensive-rules\n");
- LogMessage(" rule threshold : %u \n",(unsigned int)ppm_cfg->rule_threshold);
- }
- else
- LogMessage("none\n");
-
- LogMessage(" suspend timeout : %lu secs\n", (unsigned long)(ppm_cfg->max_suspend_ticks/
- ((uint64_t)ppm_tpu*1000000)) );
-
- LogMessage(" rule logging : ");
-
- if (ppm_cfg->rule_log&PPM_LOG_ALERT)
- LogMessage("alert ");
-
- if (ppm_cfg->rule_log&PPM_LOG_MESSAGE)
- LogMessage("log ");
-
- if (!ppm_cfg->rule_log)
- LogMessage("none ");
-
- LogMessage("\n");
- }
-}
-
-static int print_rule(int, RuleTreeNode*, OptTreeNode* o)
-{
- if ( !o->enabled )
- {
- //if( o->sigInfo.generator==1 || o->sigInfo.generator==3 )
- LogMessage(" disabled gid=%u, sid=%u\n",o->sigInfo.generator,o->sigInfo.id);
- }
-
- return 0;
-}
-
-// FIXIT-L ppm_stats should be rolled into ppm module
-// (not just peg counts; need module support)
-
-void ppm_sum_stats()
-{
- g_ppm_stats.pkt_event_cnt += ppm_stats.pkt_event_cnt;
- g_ppm_stats.rule_event_cnt += ppm_stats.rule_event_cnt;
- g_ppm_stats.tot_pkt_time += ppm_stats.tot_pkt_time;
- g_ppm_stats.tot_pkts += ppm_stats.tot_pkts;
- g_ppm_stats.tot_rule_time += ppm_stats.tot_rule_time;
- g_ppm_stats.tot_rules += ppm_stats.tot_pkts;
- g_ppm_stats.tot_nc_rule_time += ppm_stats.tot_nc_rule_time;
- g_ppm_stats.tot_nc_rules += ppm_stats.tot_nc_rules;
- g_ppm_stats.tot_pcre_rule_time += ppm_stats.tot_pcre_rule_time;
- g_ppm_stats.tot_pcre_rules += ppm_stats.tot_pcre_rules;
-}
-
-void ppm_print_summary(ppm_cfg_t* ppm_cfg)
-{
- if (ppm_cfg == NULL)
- return;
-
- if (!ppm_cfg->enabled)
- return;
-
- if (ppm_cfg->max_pkt_ticks)
- {
- LogLabel("packet performance");
-
- LogStat("max packet time (usecs)",
- ppm_ticks_to_usecs(ppm_cfg->max_pkt_ticks));
-
- LogCount("packet events",
- (unsigned int)g_ppm_stats.pkt_event_cnt);
-
- if ( g_ppm_stats.tot_pkts )
- LogStat("avg pkt time (usecs)",
- ppm_ticks_to_usecs((PPM_TICKS)(g_ppm_stats.tot_pkt_time/
- g_ppm_stats.tot_pkts)));
- }
-
- if (ppm_cfg->max_rule_ticks)
- {
- LogLabel("rule performance");
-
- LogCount("max rule time (usecs)",
- (unsigned long)(ppm_cfg->max_rule_ticks/ppm_tpu));
-
- LogCount("rule events",
- (unsigned int)g_ppm_stats.rule_event_cnt);
-
- if ( g_ppm_stats.tot_rules )
- LogStat("avg rule time (usecs)",
- ppm_ticks_to_usecs((PPM_TICKS)(g_ppm_stats.tot_rule_time/
- g_ppm_stats.tot_rules)));
-
- if ( g_ppm_stats.tot_nc_rules )
- LogStat("avg nc-rule time (usecs)",
- ppm_ticks_to_usecs((PPM_TICKS)(g_ppm_stats.tot_nc_rule_time/
- g_ppm_stats.tot_nc_rules)));
-
- if ( g_ppm_stats.tot_pcre_rules )
- LogStat("avg nc-pcre-rule time (usecs)",
- ppm_ticks_to_usecs((PPM_TICKS)(g_ppm_stats.tot_pcre_rule_time/
- g_ppm_stats.tot_pcre_rules)));
-
- fpWalkOtns(0, print_rule);
- }
-}
-
-double ppm_ticks_to_usecs(PPM_TICKS ticks)
-{
- return (double)ticks / ppm_tpu;
-}
-
-/*
- * Initialization
- */
-void ppm_init(ppm_cfg_t* ppm_cfg)
-{
- /* calc ticks per usec */
- ppm_calc_ticks();
-
- ppm_cfg->enabled = 1;
-
- ppm_cfg->max_pkt_ticks = PPM_DEFAULT_MAX_PKT_TICKS;
- ppm_cfg->max_rule_ticks = PPM_DEFAULT_MAX_RULE_TICKS;
-
- ppm_cfg->max_suspend_ticks = (uint64_t)PPM_DEFAULT_MAX_SUSP_SECS * 1000000 * ppm_tpu;
- ppm_cfg->rule_threshold = PPM_DEFAULT_RULE_THRESHOLD;
-}
-
-/*
- * Logging functions - syslog and/or events
- */
-#define PPM_FMT_FASTPATH \
- "PPM: Pkt-Event Pkt[" STDi64 \
- "] used=%g usecs, %u rules, %u nc-rules tested, packet fastpathed (%s:%d -> %s:%d).\n"
-#define PPM_FMT_PACKET \
- "PPM: Pkt-Event Pkt[" STDi64 \
- "] used=%g usecs, %u rules, %u nc-rules tested (%s:%d -> %s:%d).\n"
-
-void ppm_pkt_log(ppm_cfg_t* ppm_cfg, Packet* p)
-{
- if (!ppm_cfg->max_pkt_ticks)
- return;
-
- ppm_stats.pkt_event_cnt++;
-
- if (ppm_cfg->pkt_log & PPM_LOG_ALERT)
- SnortEventqAdd(GID_PPM, PPM_EVENT_PACKET_ABORTED);
-
- if (ppm_cfg->pkt_log & PPM_LOG_MESSAGE)
- {
- char src[INET6_ADDRSTRLEN];
- char dst[INET6_ADDRSTRLEN];
-
- const sfip_t* addr = p->ptrs.ip_api.get_src();
- sfip_ntop(addr, src, sizeof(src));
-
- addr = p->ptrs.ip_api.get_dst();
- sfip_ntop(addr, dst, sizeof(dst));
-
- if (ppm_abort_this_pkt)
- {
- LogMessage(PPM_FMT_FASTPATH,
- ppm_pt->pktcnt,
- ppm_ticks_to_usecs((PPM_TICKS)ppm_pt->tot),
- ppm_pt->rule_tests, ppm_pt->nc_rule_tests,
- src, p->ptrs.sp, dst, p->ptrs.dp);
- }
- else
- {
- LogMessage(PPM_FMT_PACKET,
- ppm_pt->pktcnt,
- ppm_ticks_to_usecs((PPM_TICKS)ppm_pt->tot),
- ppm_pt->rule_tests, ppm_pt->nc_rule_tests,
- src, p->ptrs.sp, dst, p->ptrs.dp);
- }
- }
-}
-
-#define PPM_FMT_SUS_PKT "PPM: Rule-Event Pkt[" STDi64 "] suspended (%s:%d -> %s:%d).\n"
-#define PPM_FMT_SUSPENDED \
- "PPM: Rule-Event Pkt[" STDi64 \
- "] address=0x%p used=%g usecs suspended %s\n"
-#define PPM_FMT_REENABLED "PPM: Rule-Event Pkt[" STDi64 "] address=0x%p re-enabled %s\n"
-
-void ppm_rule_log(ppm_cfg_t* ppm_cfg, uint64_t pktcnt, Packet* p)
-{
- detection_option_tree_root_t* proot;
- char timestamp[TIMEBUF_SIZE];
- *timestamp = '\0';
-
- if (!ppm_cfg->max_rule_ticks)
- return;
-
- if (ppm_n_crules)
- {
- if (ppm_cfg->rule_log & PPM_LOG_ALERT)
- SnortEventqAdd(GID_PPM, PPM_EVENT_RULE_TREE_ENABLED);
-
- if (ppm_cfg->rule_log & PPM_LOG_MESSAGE)
- {
- int i;
-
- if (!*timestamp)
- ts_print((struct timeval*)&p->pkth->ts, timestamp);
-
- for (i=0; i< ppm_n_crules; i++)
- {
- proot = ppm_crules[i];
-
- LogMessage(PPM_FMT_REENABLED,
- pktcnt, (void*)proot, timestamp);
- }
- }
-
- ppm_n_crules = 0;
- }
-
- if (ppm_n_rules)
- {
- if (ppm_cfg->rule_log & PPM_LOG_ALERT)
- SnortEventqAdd(GID_PPM, PPM_EVENT_RULE_TREE_DISABLED);
-
- if (ppm_cfg->rule_log & PPM_LOG_MESSAGE)
- {
- int i;
- char src[INET6_ADDRSTRLEN];
- char dst[INET6_ADDRSTRLEN];
-
- const sfip_t* addr = p->ptrs.ip_api.get_src();
- sfip_ntop(addr, src, sizeof(src));
-
- addr = p->ptrs.ip_api.get_dst();
- sfip_ntop(addr, dst, sizeof(dst));
-
- LogMessage(PPM_FMT_SUS_PKT, pktcnt, src, p->ptrs.sp, dst, p->ptrs.dp);
-
- if (!*timestamp)
- ts_print((struct timeval*)&p->pkth->ts, timestamp);
-
- for (i=0; i< ppm_n_rules; i++)
- {
- proot = ppm_rules[i].tree;
-
- LogMessage(PPM_FMT_SUSPENDED,
- pktcnt, (void*)proot,
- ppm_ticks_to_usecs((PPM_TICKS)ppm_rules[i].ticks),
- timestamp);
- }
- }
-
- ppm_n_rules = 0;
- }
-}
-
-void ppm_set_rule_event(ppm_cfg_t* ppm_cfg, detection_option_tree_root_t* root)
-{
- if (!ppm_cfg->max_rule_ticks)
- return;
-
- ppm_stats.rule_event_cnt++;
-
- if (ppm_cfg->rule_log && ppm_rt)
- ppm_set_rule(root, ppm_rt->tot);
-}
-
-void ppm_clear_rule_event(ppm_cfg_t* ppm_cfg, detection_option_tree_root_t* root)
-{
- if (!ppm_cfg->max_rule_ticks)
- return;
-
- ppm_stats.rule_event_cnt++;
-
- if (ppm_cfg->rule_log)
- ppm_clear_rule(root);
-}
-
-/*
- * Config functions
- */
-
-void ppm_set_pkt_action(ppm_cfg_t* ppm_cfg, int flag)
-{
- ppm_cfg->pkt_action = flag;
-}
-
-void ppm_set_pkt_log(ppm_cfg_t* ppm_cfg, int flag)
-{
- ppm_cfg->pkt_log |= flag;
-}
-
-void ppm_set_rule_action(ppm_cfg_t* ppm_cfg, int flag)
-{
- ppm_cfg->rule_action = flag;
-}
-
-void ppm_set_rule_log(ppm_cfg_t* ppm_cfg, int flag)
-{
- ppm_cfg->rule_log |= flag;
-}
-
-void ppm_set_max_pkt_time(ppm_cfg_t* ppm_cfg, PPM_USECS usecs)
-{
- ppm_cfg->max_pkt_ticks = usecs * ppm_tpu;
-}
-
-void ppm_set_max_rule_time(ppm_cfg_t* ppm_cfg, PPM_USECS usecs)
-{
- ppm_cfg->max_rule_ticks = usecs * ppm_tpu;
-}
-
-void ppm_set_max_suspend_time(ppm_cfg_t* ppm_cfg, PPM_SECS secs)
-{
- ppm_cfg->max_suspend_ticks = (uint64_t)secs * 1000000 * ppm_tpu;
- ppm_cfg->max_suspend_ticks *= ppm_tpu;
-}
-
-void ppm_set_rule_threshold(ppm_cfg_t* ppm_cfg, unsigned int cnt)
-{
- ppm_cfg->rule_threshold = cnt;
-}
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2006-2013 Sourcefire, Inc.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// ppm.h author Marc Norton <mnorton@sourcefire.com>
-
-#ifndef PPM_H
-#define PPM_H
-
-// Provide facilities for packet performance monitoring
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "main/thread.h"
-#include "detection/detection_options.h"
-#include "time/cpuclock.h"
-
-typedef uint64_t PPM_TICKS;
-typedef uint64_t PPM_USECS;
-typedef unsigned int PPM_SECS;
-
-struct ppm_cfg_t
-{
- // config section
- int enabled;
-
- PPM_TICKS max_pkt_ticks;
- int pkt_log; // alert,console,syslog
- int pkt_action; // suspend
-
- PPM_TICKS max_rule_ticks;
- uint64_t rule_threshold; // rules must fail this many times in a row to suspend
-
- int rule_log; // alert,console,syslog
- int rule_action; // suspend
-
- uint64_t max_suspend_ticks;
-};
-
-struct ppm_stats_t
-{
- // stats section
- unsigned int rule_event_cnt;
- unsigned int pkt_event_cnt;
-
- uint64_t tot_pkt_time; // ticks
- uint64_t tot_pkts;
-
- uint64_t tot_rule_time; // ticks
- uint64_t tot_rules;
-
- uint64_t tot_nc_rule_time; // ticks
- uint64_t tot_nc_rules;
-
- uint64_t tot_pcre_rule_time; // ticks
- uint64_t tot_pcre_rules;
-};
-
-extern THREAD_LOCAL ppm_stats_t ppm_stats;
-
-typedef struct
-{
- uint64_t pktcnt;
- uint64_t start, cur, tot;
- uint64_t subtract;
- PPM_TICKS max_pkt_ticks;
- unsigned int rule_tests;
- unsigned int pcre_rule_tests;
- unsigned int nc_rule_tests;
-} ppm_pkt_timer_t;
-
-typedef struct
-{
- uint64_t start, cur, tot;
- PPM_TICKS max_rule_ticks;
-} ppm_rule_timer_t;
-
-// global data
-#define PPM_MAX_TIMERS 10
-extern PPM_TICKS ppm_tpu;
-extern THREAD_LOCAL ppm_pkt_timer_t ppm_pkt_times[PPM_MAX_TIMERS];
-extern THREAD_LOCAL ppm_pkt_timer_t* ppm_pt;
-extern THREAD_LOCAL unsigned int ppm_pkt_index;
-extern THREAD_LOCAL ppm_rule_timer_t ppm_rule_times[PPM_MAX_TIMERS];
-extern THREAD_LOCAL ppm_rule_timer_t* ppm_rt;
-extern THREAD_LOCAL unsigned int ppm_rule_times_index;
-extern THREAD_LOCAL uint64_t ppm_cur_time;
-extern THREAD_LOCAL int ppm_abort_this_pkt;
-extern THREAD_LOCAL int ppm_suspend_this_rule;
-
-#define PPM_LOG_ALERT 1
-#define PPM_LOG_MESSAGE 2
-#define PPM_ACTION_SUSPEND 1
-
-// config flags
-#define PPM_ENABLED() (snort_conf->ppm_cfg->enabled > 0)
-#define PPM_PKTS_ENABLED() (snort_conf->ppm_cfg->max_pkt_ticks > 0)
-#define PPM_RULES_ENABLED() (snort_conf->ppm_cfg->max_rule_ticks > 0)
-
-// packet, rule event flags
-#define PPM_PACKET_ABORT_FLAG() ppm_abort_this_pkt
-#define PPM_RULE_SUSPEND_FLAG() ppm_suspend_this_rule
-
-#define PPM_INC_PKT_CNT() ppm_stats.tot_pkts++
-#define PPM_PKT_CNT() ppm_pt->pktcnt
-#define PPM_PKT_LOG(p) if (ppm_abort_this_pkt) ppm_pkt_log(snort_conf->ppm_cfg,p)
-#define PPM_RULE_LOG(cnt,p) ppm_rule_log(snort_conf->ppm_cfg,cnt,p)
-#define PPM_ACCUM_PKT_TIME() \
- if ( ppm_pt ) \
- { \
- ppm_stats.tot_pkt_time += ppm_pt->tot; \
- }
-#define PPM_ACCUM_RULE_TIME() \
- if ( ppm_rt ) \
- { \
- ppm_stats.tot_rule_time += ppm_rt->tot; \
- ppm_stats.tot_rules++; \
- }
-#define PPM_ACCUM_NC_RULE_TIME() \
- ppm_stats.tot_nc_rule_time += ppm_rt->tot; \
- ppm_stats.tot_nc_rules++;
-
-#define PPM_ACCUM_PCRE_RULE_TIME() \
- ppm_stats.tot_pcre_rule_time += ppm_rt->tot; \
- ppm_stats.tot_pcre_rules++;
-
-#define PPM_GET_TIME() get_clockticks(ppm_cur_time)
-
-#define PPM_PKT_RULE_TESTS() ppm_pt->rule_tests
-#define PPM_PKT_PCRE_RULE_TESTS() ppm_pt->pcre_rule_tests
-#define PPM_PKT_NC_RULE_TESTS() ppm_pt->nc_rule_tests
-#define PPM_INC_PKT_RULE_TESTS() if (ppm_pt) ppm_pt->rule_tests++
-#define PPM_INC_PKT_PCRE_RULE_TESTS() if (ppm_pt) ppm_pt->pcre_rule_tests++
-#define PPM_INC_PKT_NC_RULE_TESTS() if (ppm_pt) ppm_pt->nc_rule_tests++
-
-#define PPM_PRINT_PKT_TIME(a) LogMessage(a, ppm_ticks_to_usecs((PPM_TICKS)ppm_pt->tot) );
-
-#ifdef REG_TEST
-// use usecs instead of ticks for rule suspension during pcap playback
-#define PPM_RULE_TIME(p) ((p->pkth->ts.tv_sec * 1000000) + p->pkth->ts.tv_usec)
-#else
-#define PPM_RULE_TIME(p) ppm_cur_time
-#endif
-
-#define PPM_INIT_PKT_TIMER() \
- if (ppm_pkt_index < PPM_MAX_TIMERS) \
- { \
- ppm_pt = &ppm_pkt_times[ppm_pkt_index++]; \
- ppm_abort_this_pkt = 0; \
- ppm_pt->pktcnt = ppm_stats.tot_pkts; \
- ppm_pt->start = ppm_cur_time; \
- ppm_pt->subtract = 0; \
- ppm_pt->rule_tests = 0; \
- ppm_pt->pcre_rule_tests = 0; \
- ppm_pt->nc_rule_tests = 0; \
- ppm_pt->max_pkt_ticks = snort_conf->ppm_cfg->max_pkt_ticks; \
- ppm_init_rules(); \
- }
-
-#define PPM_TOTAL_PKT_TIME() \
- if ( ppm_pt) \
- { \
- ppm_pt->tot = ppm_cur_time - ppm_pt->start - ppm_pt->subtract; \
- }
-
-#define PPM_END_PKT_TIMER() \
- if ( (ppm_pkt_index > 0) && ppm_pt) \
- { \
- ppm_pkt_index--; \
- if ( ppm_pkt_index > 0 ) \
- ppm_pt = &ppm_pkt_times[ppm_pkt_index-1]; \
- else \
- ppm_pt=0; \
- }
-
-#define PPM_INIT_RULE_TIMER() \
- if (ppm_rule_times_index < PPM_MAX_TIMERS) \
- { \
- ppm_rt = &ppm_rule_times[ppm_rule_times_index++]; \
- ppm_suspend_this_rule = 0; \
- ppm_rt->start=ppm_cur_time; \
- ppm_rt->max_rule_ticks = snort_conf->ppm_cfg->max_rule_ticks; \
- }
-
-#define PPM_END_RULE_TIMER() \
- if (( ppm_rule_times_index > 0) && ppm_rt ) \
- { \
- ppm_rule_times_index--; \
- if (ppm_rule_times_index > 0) \
- { \
- ppm_rt=&ppm_rule_times[ppm_rule_times_index-1]; \
- } else { \
- ppm_rt=NULL; \
- } \
- }
-
-// use PPM_GET_TIME; first to get the current time
-#define PPM_PACKET_TEST() \
- if ( ppm_pt ) \
- { \
- ppm_pt->tot = ppm_cur_time - ppm_pt->start; \
- if (ppm_pt->tot > ppm_pt->max_pkt_ticks) \
- { \
- if ( snort_conf->ppm_cfg->pkt_action & PPM_ACTION_SUSPEND ) \
- ppm_abort_this_pkt = 1; \
- } \
- }
-
-// use PPM_GET_TIME; first to get the current time
-#define PPM_RULE_TEST(root,p) \
- if ( ppm_rt ) \
- { \
- ppm_rt->tot = ppm_cur_time - ppm_rt->start; \
- if (ppm_rt->tot > ppm_rt->max_rule_ticks) \
- { \
- ppm_dot_root_state_t* root_state = (root)->state + get_instance_id(); \
- if ( snort_conf->ppm_cfg->rule_action & PPM_ACTION_SUSPEND ) \
- { \
- int ii; \
- ppm_suspend_this_rule = 1; \
- (root_state)->ppm_disable_cnt++; \
- for ( ii = 0; ii< root->num_children; ii++) \
- { \
- dot_node_state_t* ns = \
- root->children[ii]->state + get_instance_id(); \
- ns->ppm_disable_cnt++; \
- } \
- if ( (root_state)->ppm_disable_cnt >= snort_conf->ppm_cfg->rule_threshold ) \
- { \
- ppm_set_rule_event(snort_conf->ppm_cfg, root); \
- (root_state)->enabled=false; \
- (root_state)->ppm_suspend_time=PPM_RULE_TIME(p); \
- } \
- else \
- { \
- (root_state)->ppm_suspend_time=0; \
- } \
- } \
- else \
- { \
- (root_state)->ppm_suspend_time=0; \
- if ( (root_state)->ppm_disable_cnt > 0 ) \
- (root_state)->ppm_disable_cnt--; \
- } \
- } \
- }
-
-#define PPM_REENABLE_TREE(root,p) \
- ppm_dot_root_state_t* root_state = (root)->state + get_instance_id(); \
- if ( (root_state)->ppm_suspend_time && snort_conf->ppm_cfg->max_suspend_ticks ) \
- { \
- PPM_TICKS now = PPM_RULE_TIME(p); \
- PPM_TICKS then = (root_state)->ppm_suspend_time + snort_conf->ppm_cfg->max_suspend_ticks; \
- if ( now > then ) \
- { \
- (root_state)->ppm_suspend_time=0; \
- (root_state)->enabled=true; \
- ppm_clear_rule_event(snort_conf->ppm_cfg, root); \
- } \
- }
-
-void ppm_init(ppm_cfg_t*);
-
-void ppm_set_pkt_action(ppm_cfg_t*, int);
-void ppm_set_pkt_log(ppm_cfg_t*, int);
-
-void ppm_set_rule_action(ppm_cfg_t*, int);
-void ppm_set_rule_threshold(ppm_cfg_t*, unsigned int);
-void ppm_set_rule_log(ppm_cfg_t*, int);
-
-void ppm_set_max_pkt_time(ppm_cfg_t*, PPM_USECS);
-void ppm_set_max_rule_time(ppm_cfg_t*, PPM_USECS);
-void ppm_set_max_suspend_time(ppm_cfg_t*, PPM_SECS);
-
-void ppm_print_cfg(ppm_cfg_t*);
-void ppm_print_summary(ppm_cfg_t*);
-void ppm_sum_stats();
-double ppm_ticks_to_usecs(PPM_TICKS);
-
-void ppm_pkt_log(ppm_cfg_t*, Packet*);
-void ppm_rule_log(ppm_cfg_t*, uint64_t, Packet*);
-
-void ppm_init_rules(void);
-void ppm_set_rule_event(ppm_cfg_t*, detection_option_tree_root_t*);
-void ppm_clear_rule_event(ppm_cfg_t*, detection_option_tree_root_t*);
-void ppm_set_rule(detection_option_tree_root_t*, PPM_TICKS);
-
-#define PPM_INIT(x) ppm_init(x)
-#define PPM_PRINT_CFG(x) ppm_print_cfg(x)
-#define PPM_PRINT_SUMMARY(x) ppm_print_summary(x)
-
-#else
-
-#define PPM_GET_TIME()
-#define PPM_SET_TIME()
-
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-// ppm_module.cc author Russ Combs <rucombs@cisco.com>
-
-#include "ppm_module.h"
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "ppm.h"
-#include "main/snort_config.h"
-
-//-------------------------------------------------------------------------
-// ppm attributes
-//-------------------------------------------------------------------------
-
-#define s_name "ppm"
-#define s_help \
- "packet and rule latency monitoring and control"
-
-static const Parameter s_params[] =
-{
- { "max_pkt_time", Parameter::PT_INT, "0:", "0",
- "enable packet latency thresholding (usec), 0 = off" },
-
- { "fastpath_expensive_packets", Parameter::PT_BOOL, nullptr, "false",
- "stop inspection if the max_pkt_time is exceeded" },
-
- { "pkt_log", Parameter::PT_ENUM, "none | log | alert | both", "none",
- "log event if max_pkt_time is exceeded" },
-
- { "max_rule_time", Parameter::PT_INT, "0:", "0",
- "enable rule latency thresholding (usec), 0 = off" },
-
- { "threshold", Parameter::PT_INT, "1:", "5",
- "number of times to exceed limit before disabling rule" },
-
- { "suspend_expensive_rules", Parameter::PT_BOOL, nullptr, "false",
- "temporarily disable rule if threshold is reached" },
-
- { "suspend_timeout", Parameter::PT_INT, "0:", "60",
- "seconds to suspend rule, 0 = permanent" },
-
- { "rule_log", Parameter::PT_ENUM, "none|log|alert|both", "none",
- "enable event logging for suspended rules" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-#define PPM_EVENT_RULE_TREE_DISABLED_STR "rule options disabled by rule latency"
-#define PPM_EVENT_RULE_TREE_ENABLED_STR "rule options re-enabled by rule latency"
-#define PPM_EVENT_PACKET_ABORTED_STR "packet aborted due to latency"
-
-static const RuleMap ppm_rules[] =
-{
- { PPM_EVENT_RULE_TREE_DISABLED, PPM_EVENT_RULE_TREE_DISABLED_STR },
- { PPM_EVENT_RULE_TREE_ENABLED, PPM_EVENT_RULE_TREE_ENABLED_STR },
- { PPM_EVENT_PACKET_ABORTED, PPM_EVENT_PACKET_ABORTED_STR },
-
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// ppm module
-//-------------------------------------------------------------------------
-
-PpmModule::PpmModule() : Module(s_name, s_help, s_params) { }
-
-const RuleMap* PpmModule::get_rules() const
-{ return ppm_rules; }
-
-bool PpmModule::begin(const char*, int, SnortConfig* sc)
-{
- if ( !PPM_ENABLED() )
- PPM_INIT(sc->ppm_cfg);
-
- return true;
-}
-
-bool PpmModule::set(const char*, Value& v, SnortConfig* sc)
-{
- if ( v.is("max_pkt_time") )
- ppm_set_max_pkt_time(sc->ppm_cfg, v.get_long());
-
- else if ( v.is("fastpath_expensive_packets") )
- {
- if (v.get_bool())
- ppm_set_pkt_action(sc->ppm_cfg, PPM_ACTION_SUSPEND);
- }
-
- else if ( v.is("pkt_log") )
- {
- unsigned u = v.get_long();
- if ( u & 0x1 )
- ppm_set_pkt_log(sc->ppm_cfg, PPM_LOG_MESSAGE);
- if ( u & 0x2 )
- ppm_set_pkt_log(sc->ppm_cfg, PPM_LOG_ALERT);
- }
- else if ( v.is("max_rule_time") )
- ppm_set_max_rule_time(sc->ppm_cfg, v.get_long());
-
- else if ( v.is("threshold") )
- ppm_set_rule_threshold(sc->ppm_cfg, v.get_long());
-
- else if ( v.is("suspend_expensive_rules") )
- ppm_set_rule_action(sc->ppm_cfg, PPM_ACTION_SUSPEND);
-
- else if ( v.is("suspend_timeout") )
- ppm_set_max_suspend_time(sc->ppm_cfg, v.get_long());
-
- else if ( v.is("rule_log") )
- {
- unsigned u = v.get_long();
- if ( u & 0x1 )
- ppm_set_rule_log(sc->ppm_cfg, PPM_LOG_MESSAGE);
- if ( u & 0x2 )
- ppm_set_rule_log(sc->ppm_cfg, PPM_LOG_ALERT);
- }
- else
- return false;
-
- return true;
-}
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// ppm_module.h author Russ Combs <rucombs@cisco.com>
-
-#ifndef PPM_MODULE_H
-#define PPM_MODULE_H
-
-// Configuration module for packet performance monitoring
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "framework/module.h"
-
-#define GID_PPM 134
-
-// SIDs
-#define PPM_EVENT_RULE_TREE_DISABLED 1
-#define PPM_EVENT_RULE_TREE_ENABLED 2
-#define PPM_EVENT_PACKET_ABORTED 3
-
-class PpmModule : public Module
-{
-public:
- PpmModule();
-
- bool begin(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
-
- const RuleMap* get_rules() const override;
-
- unsigned get_gid() const override
- { return GID_PPM; }
-};
-
-#endif
-
#include "protocols/packet_manager.h"
#include "detection/fp_create.h"
#include "filters/sfthreshold.h"
-#include "ppm/ppm.h"
#include "profiler/profiler.h"
#include "time/timersub.h"
#include "file_api/file_stats.h"
#include "packet_io/sfdaq.h"
#include "packet_io/active.h"
#include "ips_options/ips_pcre.h"
-#include "ppm/ppm.h"
#include "time/packet_time.h"
#include "time/timersub.h"
#include "stream/stream.h"
projects / thirdparty / snort3.git / commitdiff
