Pull request #3249: stream: setting the max number of flows pruned while idle to 400

Merge in SNORT/snort3 from ~ALLEWI/snort3:idle_prune_to_400 to master

Squashed commit of the following:

commit b32b0648b79a9b8045ad4916c6a1995a1f3920e4
Author: allewi@cisco.com <allewi@cisco.com>
Date:   Thu Jan 27 10:52:44 2022 -0500

    stream: setting the max number of flows pruned while idle to 400

diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc
index 783996935761e2bd27fcc2ed6a1c2877ee7a50a8..611f5c9a91691a4e6f08fc1097d72402e735449d 100644 (file)
--- a/src/flow/flow_control.cc
+++ b/src/flow/flow_control.cc
@@ -117,9 +117,9 @@ unsigned FlowControl::delete_flows(unsigned num_to_delete)
 bool FlowControl::prune_one(PruneReason reason, bool do_cleanup)
 { return cache->prune_one(reason, do_cleanup); }
 
-void FlowControl::timeout_flows(time_t cur_time)
+void FlowControl::timeout_flows(unsigned max, time_t cur_time)
 {
-    cache->timeout(1, cur_time);
+    cache->timeout(max, cur_time);
 }
 
 Flow* FlowControl::stale_flow_cleanup(FlowCache* cache, Flow* flow, Packet* p)

diff --git a/src/flow/flow_control.h b/src/flow/flow_control.h
index cc2eec4c64d77f030f2f816d61ac1d1d110f93b0..fd87d67fcb7f29c28396131673c5e10ede07827d 100644 (file)
--- a/src/flow/flow_control.h
+++ b/src/flow/flow_control.h
@@ -67,7 +67,7 @@ public:
     unsigned delete_flows(unsigned num_to_delete);
     bool prune_one(PruneReason, bool do_cleanup);
     snort::Flow* stale_flow_cleanup(FlowCache*, snort::Flow*, snort::Packet*);
-    void timeout_flows(time_t cur_time);
+    void timeout_flows(unsigned int, time_t cur_time);
     void check_expected_flow(snort::Flow*, snort::Packet*);
     bool is_expected(snort::Packet*);
 

diff --git a/src/stream/stream.cc b/src/stream/stream.cc
index 0d177aa5796ecd7b08691ca3fbc65b4d7d79306b..1799d927f6dc47dd769b49095625857cb9a196fa 100644 (file)
--- a/src/stream/stream.cc
+++ b/src/stream/stream.cc
@@ -49,6 +49,8 @@
 
 using namespace snort;
 
+#define IDLE_PRUNE_MAX 400
+
 // this should not be publicly accessible
 extern THREAD_LOCAL class FlowControl* flow_con;
 
@@ -366,8 +368,13 @@ void Stream::handle_timeouts(bool idle)
     packet_gettimeofday(&cur_time);
 
     // FIXIT-M batch here or loop vs looping over idle?
-    if ( flow_con )
-        flow_con->timeout_flows(cur_time.tv_sec);
+    if (flow_con)
+    {
+        if (idle)
+            flow_con->timeout_flows(IDLE_PRUNE_MAX, cur_time.tv_sec);
+        else
+            flow_con->timeout_flows(1, cur_time.tv_sec);
+    }
 
     int max_remove = idle ? -1 : 1;       // -1 = all eligible
     TcpStreamTracker::release_held_packets(cur_time, max_remove);