Merge pull request #114 in SNORT/snort3 from dnsstats to master

Squashed commit of the following:

commit 1b1feefb1888411a32344ceb4d73173d9b5138ef
Author: Bhagyashree Bantwal <bbantwal@cisco.com>
Date:   Tue Nov 3 09:43:05 2015 -0500

    Add DNS shutdown stats

commit 3fa2887834c652df99c6bcf04a80905385b20303
Merge: 80b5183 1b5e401
Author: Bhagyashree Bantwal <bbantwal@cisco.com>
Date:   Mon Nov 2 16:02:26 2015 -0500

    Merge branch 'master' of ssh://stash-eng-rtp1.cisco.com:7999/snort/snort3

commit 80b5183135af600acd08616f512579405f8cefa2
Author: Bhagyashree Bantwal <bbantwal@cisco.com>
Date:   Mon Nov 2 16:02:15 2015 -0500

    Add DNS shutdown stats

commit bb7c5f178487029534107ec4c689e7e09d2c3554
Merge: b167456 52a9ccf
Author: Bhagyashree Bantwal <bbantwal@cisco.com>
Date:   Wed Oct 21 22:30:01 2015 -0400

    Merge branch 'master' of ssh://stash-eng-rtp1.cisco.com:7999/snort/snort3

commit b16745640b5214d4bbdc7a20e642e074df90de3a
Merge: 6b9e324 08e3998
Author: Bhagyashree Bantwal <bbantwal@cisco.com>
Date:   Wed Oct 21 10:39:09 2015 -0400

    Merge branch 'master' of ssh://stash-eng-rtp1.cisco.com:7999/snort/snort3

commit 6b9e3240b7ae3dd805be2d325223d19dc90d622c
Author: Bhagyashree Bantwal <bbantwal@cisco.com>
Date:   Fri Oct 9 14:26:23 2015 -0400

    Remove global stats init function

commit 2c5cdb4d749e5ed6c34e931400c8ff52820f430e
Merge: b7c468e f05d70a
Author: Bhagyashree Bantwal <bbantwal@cisco.com>
Date:   Fri Oct 9 13:21:07 2015 -0400

    Merge branch 'master' of ssh://stash-eng-rtp1.cisco.com:7999/snort/snort3

commit b7c468e8692ea68cda91f5278a7209a3b0d2f48b
Author: Bhagyashree Bantwal <bbantwal@cisco.com>
Date:   Wed Sep 30 16:57:36 2015 -0400

    Check for bool value before setting fastpath config option in PPM

commit 803dc5453c703ee48697cb24d7de886b1b01b79b
Author: Bhagyashree Bantwal <bbantwal@cisco.com>
Date:   Wed Sep 30 08:10:48 2015 -0400

    SSL stats changes

diff --git a/src/service_inspectors/dns/dns.cc b/src/service_inspectors/dns/dns.cc
index ffbbe5ec4e693108c899912393ad19c5e2bfb7d1..3f129bb66c37998a8fe840d37f01527cdd51c442 100644 (file)
--- a/src/service_inspectors/dns/dns.cc
+++ b/src/service_inspectors/dns/dns.cc
@@ -43,11 +43,22 @@
 
 #include "dns_module.h"
 
+#define MAX_UDP_PAYLOAD 0x1FFF
+#define DNS_RR_PTR 0xC0
+
 THREAD_LOCAL ProfileStats dnsPerfStats;
-THREAD_LOCAL SimpleStats dnsstats;
+THREAD_LOCAL DNSStats dnsstats;
+
+const PegInfo dns_peg_names[] =
+{
+    { "packets", "total packets processed" },
+    { "requests", "total dns requests" },
+    { "responses", "total dns responses" },
+
+    { nullptr, nullptr }
+};
+
 
-#define MIN_UDP_PAYLOAD 0x1FFF
-#define DNS_RR_PTR 0xC0
 
 /*
  * Function prototype(s)
@@ -71,15 +82,26 @@ DNSData* SetNewDNSData(Packet* p)
     return &fd->session;
 }
 
-static DNSData* get_dns_session_data(Packet* p)
+static DNSData* get_dns_session_data(Packet* p, bool from_server)
 {
     DnsFlowData* fd;
 
     if (p->is_udp())
     {
-        if (p->dsize < (sizeof(DNSHdr) + sizeof(DNSRR) + MIN_UDP_PAYLOAD))
+        if(p->dsize > MAX_UDP_PAYLOAD)
             return NULL;
 
+        if(!from_server)
+        {
+            if (p->dsize < (sizeof(DNSHdr) + sizeof(DNSQuestion) + 2))
+                return NULL;
+        }
+        else
+        {
+            if (p->dsize < (sizeof(DNSHdr)))
+                return NULL;
+        }
+
         memset(&udpSessionData, 0, sizeof(udpSessionData));
         return &udpSessionData;
     }
@@ -767,6 +789,8 @@ void ParseDNSResponseMessage(Packet* p, DNSData* dnsSessionData)
             }
             else
             {
+                if (dnsSessionData->hdr.flags & DNS_HDR_FLAG_RESPONSE)
+                    dnsstats.responses++;
                 /* No more data */
                 return;
             }
@@ -794,6 +818,8 @@ void ParseDNSResponseMessage(Packet* p, DNSData* dnsSessionData)
             /* Not a response */
             return;
         }
+        else
+            dnsstats.responses++;
 
         /* Handle the DNS Queries */
         if (dnsSessionData->state == DNS_RESP_STATE_QUESTION)
@@ -1022,12 +1048,11 @@ static void snort_dns(Packet* p)
     }
 
     // Get the direction of the packet.
-    uint8_t direction = ( (p->packet_flags & PKT_FROM_SERVER ) ?
-        DNS_DIR_FROM_SERVER : DNS_DIR_FROM_CLIENT );
+    bool from_server = ( (p->packet_flags & PKT_FROM_SERVER ) ? true : false );
 
 
     // Attempt to get a previously allocated DNS block.
-    DNSData* dnsSessionData = get_dns_session_data(p);
+    DNSData* dnsSessionData = get_dns_session_data(p, from_server);
 
     if (dnsSessionData == NULL)
     {
@@ -1043,10 +1068,14 @@ static void snort_dns(Packet* p)
     if (dnsSessionData->flags & DNS_FLAG_NOT_DNS)
         return;
 
-    if (direction == DNS_DIR_FROM_SERVER)
+    if ( from_server )
     {
         ParseDNSResponseMessage(p, dnsSessionData);
     }
+    else
+    {
+        dnsstats.requests++;
+    }
 }
 
 //-------------------------------------------------------------------------
@@ -1076,7 +1105,7 @@ void Dns::eval(Packet* p)
     assert((p->is_udp() and p->dsize and p->data) or p->has_tcp_data());
     assert(p->flow);
 
-    ++dnsstats.total_packets;
+    ++dnsstats.packets;
     snort_dns(p);
 }
 

diff --git a/src/service_inspectors/dns/dns_module.cc b/src/service_inspectors/dns/dns_module.cc
index 52c92fc9b57667c36b82fe22e99b55adb340fef0..fd8dc4b864ec52a7d939bc0174d0575cf4c29168 100644 (file)
--- a/src/service_inspectors/dns/dns_module.cc
+++ b/src/service_inspectors/dns/dns_module.cc
@@ -56,7 +56,7 @@ const RuleMap* DnsModule::get_rules() const
 { return dns_rules; }
 
 const PegInfo* DnsModule::get_pegs() const
-{ return simple_pegs; }
+{ return dns_peg_names; }
 
 PegCount* DnsModule::get_counts() const
 { return (PegCount*)&dnsstats; }

diff --git a/src/service_inspectors/dns/dns_module.h b/src/service_inspectors/dns/dns_module.h
index 387c9ebe417ccd97d197f1b097abe17efa652cc5..6b49fbe7397ff7c2660bebfd77f9e3e7dd2bf8ad 100644 (file)
--- a/src/service_inspectors/dns/dns_module.h
+++ b/src/service_inspectors/dns/dns_module.h
@@ -37,7 +37,15 @@
 
 struct SnortConfig;
 
-extern THREAD_LOCAL SimpleStats dnsstats;
+struct DNSStats
+{
+    PegCount packets;
+    PegCount requests;
+    PegCount responses;
+};
+
+extern const PegInfo dns_peg_names[];
+extern THREAD_LOCAL DNSStats dnsstats;
 extern THREAD_LOCAL ProfileStats dnsPerfStats;
 
 class DnsModule : public Module