tweaks for bogus idle processing

diff --git a/ChangeLog b/ChangeLog
index 96f9753ce64393c0220e9be7956b1fa80979e7d4..01e4fcf1c8bb01e423355b9f429207bc9b3839f3 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,7 @@
 -- more FIXIT-H fixed
 -- removed process.plugin_path and process.script_path since they are
    needed ahead of parsing
+-- added idle processing, though still as sketchy as Snort until alpha 2
 
 116
 -- fixed valgrind leak

diff --git a/src/main/analyzer.cc b/src/main/analyzer.cc
index dcc4f0cf814aafdd3c9008d0753daa4d4999cc07..0020245b2a8689e212bef3ed6f2524e729205125 100644 (file)
--- a/src/main/analyzer.cc
+++ b/src/main/analyzer.cc
@@ -130,6 +130,13 @@ void Analyzer::analyze()
         }
         if ( DAQ_Acquire(0, main_func, NULL) )
             break;
+
+        // FIXIT-M acquire(0) won't return until no packets, signal, etc.
+        // which makes this idle unlikely to execute under high traffic 
+        // conditions; that means the idle processing may not be useful
+        // or that we need a hook to do things periodically even when
+        // traffic is available
+        snort_idle();
     }
 }
 

diff --git a/src/main/snort.cc b/src/main/snort.cc
index bb7d820e30d83f5d2138d943acd86e6e055d9f52..8e1e1f0925b847b6aace8b8cb9ce31ed6df25a57 100644 (file)
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -712,7 +712,7 @@ void set_main_hook(MainHook_f f)
 Packet* get_current_packet()
 { return &s_packet; }
 
-// FIXIT-H for multiple packet threads
+// FIXIT-M for multiple packet threads
 // using thread locals for s_pkth and s_data won't work
 // will need array of s_packet, s_pkth, and s_data and 
 // capture all if it is not clear which thread crashed
@@ -937,14 +937,10 @@ DAQ_Verdict packet_callback(
     Active_Reset();
     PacketManager::encode_reset();
 
-    if ( flow_con )  // FIXIT-H always instantiate
-        flow_con->timeout_flows(4, pkthdr->ts.tv_sec);
-
-#if 0
-    // FIXIT-H do this when idle
     if ( flow_con ) // FIXIT-H always instantiate
-        flow_con->timeout_flows(16384, time(NULL));
-#endif
+    {
+        flow_con->timeout_flows(4, pkthdr->ts.tv_sec);
+    }
 
     s_packet.pkth = NULL;  // no longer avail on segv
 
@@ -955,9 +951,16 @@ DAQ_Verdict packet_callback(
     return verdict;
 }
 
+void snort_idle()
+{
+    if ( flow_con )
+        flow_con->timeout_flows(16384, time(NULL));
+    pc.idle++;
+}
+
 void snort_rotate()
 {
-        SetRotatePerfFileFlag();
+    SetRotatePerfFileFlag();
 }
 
 void snort_thread_init(const char* intf)

diff --git a/src/main/snort.h b/src/main/snort.h
index 05c61af62f7cd6961e9f7009d077cf6279c4797f..8ed131adec047c434eb06d991fce8a4f81c8a219 100644 (file)
--- a/src/main/snort.h
+++ b/src/main/snort.h
@@ -46,6 +46,7 @@ void snort_cleanup();
 void snort_thread_init(const char* intf);
 void snort_thread_term();
 
+void snort_idle();
 void snort_rotate();
 
 // FIXIT-L may be inlined at some point; on lockdown for now

diff --git a/src/utils/stats.cc b/src/utils/stats.cc
index 66339c47a4ad2be78857e4387a3104adef0d4c08..e19f3bd5b5eafacaf3d7f1025e3883e5422239b3 100644 (file)
--- a/src/utils/stats.cc
+++ b/src/utils/stats.cc
@@ -213,6 +213,7 @@ static const char* pc_names[] =
     "alert limit",
     "internal blacklist",
     "internal whitelist",
+    "idle"
 };
 
 static const char* proc_names[] =

diff --git a/src/utils/stats.h b/src/utils/stats.h
index 27decde79895365657fb8837a497722708dca656..0ea126bc91efd257e624196c18441b3b2c21b0a4 100644 (file)
--- a/src/utils/stats.h
+++ b/src/utils/stats.h
@@ -55,6 +55,7 @@ struct PacketCount
     PegCount alert_limit;
     PegCount internal_blacklist;
     PegCount internal_whitelist;
+    PegCount idle;
 };
 
 struct ProcessCount