]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
defrag: add various counters
authorVictor Julien <vjulien@oisf.net>
Thu, 23 May 2024 18:46:22 +0000 (20:46 +0200)
committerVictor Julien <victor@inliniac.net>
Tue, 4 Jun 2024 04:28:26 +0000 (06:28 +0200)
etc/schema.json
src/decode.c
src/decode.h
src/defrag-hash.c
src/defrag.c

index 8bcd1b0d790a51e1c751005a43d755e7a127412a..7d3f92801e83be0036ed8a11ca34e371f78ed3b8 100644 (file)
                 "defrag": {
                     "type": "object",
                     "properties": {
-                        "max_frag_hits": {
-                            "type": "integer"
+                        "tracker_soft_reuse": {
+                            "type": "integer",
+                            "description":
+                                    "Finished tracker re-used from hash table before being moved to spare pool"
+                        },
+                        "tracker_hard_reuse": {
+                            "type": "integer",
+                            "description":
+                                    "Active tracker force closed before completion and reused for new tracker"
+                        },
+                        "max_trackers_reached": {
+                            "type": "integer",
+                            "description":
+                                    "How many times a packet wasn't reassembled due to max-trackers limit being reached"
+                        },
+                        "max_frags_reached": {
+                            "type": "integer",
+                            "description":
+                                    "How many times a fragment wasn't stored due to max-frags limit being reached"
                         },
                         "memcap_exception_policy": {
                             "description":
index 3eefbcbcb7db49dbb80c0fb401ece2cf5152031e..e0deafabc97d2302df6fd47025d33afcaf069684 100644 (file)
@@ -675,8 +675,10 @@ void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
     dtv->counter_defrag_ipv6_fragments =
         StatsRegisterCounter("defrag.ipv6.fragments", tv);
     dtv->counter_defrag_ipv6_reassembled = StatsRegisterCounter("defrag.ipv6.reassembled", tv);
-    dtv->counter_defrag_max_hit =
-        StatsRegisterCounter("defrag.max_frag_hits", tv);
+    dtv->counter_defrag_max_hit = StatsRegisterCounter("defrag.max_trackers_reached", tv);
+    dtv->counter_defrag_no_frags = StatsRegisterCounter("defrag.max_frags_reached", tv);
+    dtv->counter_defrag_tracker_soft_reuse = StatsRegisterCounter("defrag.tracker_soft_reuse", tv);
+    dtv->counter_defrag_tracker_hard_reuse = StatsRegisterCounter("defrag.tracker_hard_reuse", tv);
 
     ExceptionPolicySetStatsCounters(tv, &dtv->counter_defrag_memcap_eps, &defrag_memcap_eps_stats,
             DefragGetMemcapExceptionPolicy(), "defrag.memcap_exception_policy.",
index 4531a4faa8eb46c07e96eb42a4840305d34f388a..a2961f43b365ec3cd0c1977bff37a3f2b97ea40a 100644 (file)
@@ -999,6 +999,9 @@ typedef struct DecodeThreadVars_
     uint16_t counter_defrag_ipv6_fragments;
     uint16_t counter_defrag_ipv6_reassembled;
     uint16_t counter_defrag_max_hit;
+    uint16_t counter_defrag_no_frags;
+    uint16_t counter_defrag_tracker_soft_reuse;
+    uint16_t counter_defrag_tracker_hard_reuse;
     ExceptionPolicyCounters counter_defrag_memcap_eps;
 
     uint16_t counter_flow_memcap;
index 623fd28b7fbef9b5ce86eb66d524e2d9af043d0d..11fef806eaacd57f24a2021f7256c12f6312050c 100644 (file)
@@ -33,7 +33,8 @@ SC_ATOMIC_DECLARE(uint64_t,defrag_memuse);
 SC_ATOMIC_DECLARE(unsigned int,defragtracker_counter);
 SC_ATOMIC_DECLARE(unsigned int,defragtracker_prune_idx);
 
-static DefragTracker *DefragTrackerGetUsedDefragTracker(void);
+static DefragTracker *DefragTrackerGetUsedDefragTracker(
+        ThreadVars *tv, const DecodeThreadVars *dtv);
 
 /** queue with spare tracker */
 static DefragTrackerStack defragtracker_spare_q;
@@ -486,7 +487,7 @@ static DefragTracker *DefragTrackerGetNew(ThreadVars *tv, DecodeThreadVars *dtv,
     if (dt == NULL) {
         /* If we reached the max memcap, we get a used tracker */
         if (!(DEFRAG_CHECK_MEMCAP(sizeof(DefragTracker)))) {
-            dt = DefragTrackerGetUsedDefragTracker();
+            dt = DefragTrackerGetUsedDefragTracker(tv, dtv);
             if (dt == NULL) {
                 ExceptionPolicyApply(p, defrag_config.memcap_policy, PKT_DROP_REASON_DEFRAG_MEMCAP);
                 DefragExceptionPolicyStatsIncr(tv, dtv, defrag_config.memcap_policy);
@@ -646,7 +647,7 @@ DefragTracker *DefragLookupTrackerFromHash (Packet *p)
  *
  *  \retval dt tracker or NULL
  */
-static DefragTracker *DefragTrackerGetUsedDefragTracker(void)
+static DefragTracker *DefragTrackerGetUsedDefragTracker(ThreadVars *tv, const DecodeThreadVars *dtv)
 {
     uint32_t idx = SC_ATOMIC_GET(defragtracker_prune_idx) % defrag_config.hash_size;
     uint32_t cnt = defrag_config.hash_size;
@@ -679,6 +680,9 @@ static DefragTracker *DefragTrackerGetUsedDefragTracker(void)
             continue;
         }
 
+        /* only count "forced" reuse */
+        bool incr_reuse_cnt = !dt->remove;
+
         /* remove from the hash */
         hb->head = dt->hnext;
 
@@ -689,6 +693,12 @@ static DefragTracker *DefragTrackerGetUsedDefragTracker(void)
 
         SCMutexUnlock(&dt->lock);
 
+        if (incr_reuse_cnt) {
+            StatsIncr(tv, dtv->counter_defrag_tracker_hard_reuse);
+        } else {
+            StatsIncr(tv, dtv->counter_defrag_tracker_soft_reuse);
+        }
+
         (void) SC_ATOMIC_ADD(defragtracker_prune_idx, (defrag_config.hash_size - cnt));
         return dt;
     }
index 3802bba392c73608f81596ae5cf446734962546a..1d55d9a944cb82f253dc566ef3b742c5d15379b0 100644 (file)
@@ -872,6 +872,9 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker,
         } else {
             ENGINE_SET_EVENT(p, IPV6_FRAG_IGNORED);
         }
+        if (tv != NULL && dtv != NULL) {
+            StatsIncr(tv, dtv->counter_defrag_no_frags);
+        }
         goto error_remove_tracker;
     }
     new->pkt = SCMalloc(GET_PKT_LEN(p));