stream inspection: add debug counters

diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c
index 08db3f1b267e5dfe422d96b2bb411c48a06180cf..e3994afe8f241840cc30e2130de25ec68e3d6bb5 100644 (file)
--- a/src/detect-engine-payload.c
+++ b/src/detect-engine-payload.c
@@ -55,6 +55,10 @@ static int StreamMpmFunc(void *cb_data, const uint8_t *data, const uint32_t data
 {
     struct StreamMpmData *smd = cb_data;
     if (data_len >= smd->mpm_ctx->minlen) {
+#ifdef DEBUG
+        smd->det_ctx->stream_mpm_cnt++;
+        smd->det_ctx->stream_mpm_size += data_len;
+#endif
         (void)mpm_table[smd->mpm_ctx->mpm_type].Search(smd->mpm_ctx,
                 &smd->det_ctx->mtcs, &smd->det_ctx->pmq,
                 data, data_len);
@@ -86,6 +90,10 @@ static void PrefilterPktStream(DetectEngineThreadCtx *det_ctx,
     if ((p->flags & (PKT_NOPAYLOAD_INSPECTION|PKT_STREAM_ADD)) == 0)
     {
         if (p->payload_len >= mpm_ctx->minlen) {
+#ifdef DEBUG
+            det_ctx->payload_mpm_cnt++;
+            det_ctx->payload_mpm_size += p->payload_len;
+#endif
             (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
                     &det_ctx->mtc, &det_ctx->pmq,
                     p->payload, p->payload_len);
@@ -149,7 +157,10 @@ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx,
     if (s->sm_arrays[DETECT_SM_LIST_PMATCH] == NULL) {
         SCReturnInt(0);
     }
-
+#ifdef DEBUG
+    det_ctx->payload_persig_cnt++;
+    det_ctx->payload_persig_size += p->payload_len;
+#endif
     det_ctx->buffer_offset = 0;
     det_ctx->discontinue_matching = 0;
     det_ctx->inspection_recursion_counter = 0;
@@ -176,7 +187,10 @@ static int StreamContentInspectFunc(void *cb_data, const uint8_t *data, const ui
     SCEnter();
     int r = 0;
     struct StreamContentInspectData *smd = cb_data;
-
+#ifdef DEBUG
+    smd->det_ctx->stream_persig_cnt++;
+    smd->det_ctx->stream_persig_size += data_len;
+#endif
     smd->det_ctx->buffer_offset = 0;
     smd->det_ctx->discontinue_matching = 0;
     smd->det_ctx->inspection_recursion_counter = 0;

diff --git a/src/detect-engine.c b/src/detect-engine.c
index 0df068c52107b329e984506dc22864a8b988be09..c1fc09800aae4a45c545be5136cb64b930504517 100644 (file)
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -1808,6 +1808,16 @@ static DetectEngineThreadCtx *DetectEngineThreadCtxInitForReload(
 
 void DetectEngineThreadCtxFree(DetectEngineThreadCtx *det_ctx)
 {
+#ifdef DEBUG
+    SCLogInfo("PACKET PKT_STREAM_ADD: %"PRIu64, det_ctx->pkt_stream_add_cnt);
+
+    SCLogInfo("PAYLOAD MPM %"PRIu64"/%"PRIu64, det_ctx->payload_mpm_cnt, det_ctx->payload_mpm_size);
+    SCLogInfo("STREAM  MPM %"PRIu64"/%"PRIu64, det_ctx->stream_mpm_cnt, det_ctx->stream_mpm_size);
+
+    SCLogInfo("PAYLOAD SIG %"PRIu64"/%"PRIu64, det_ctx->payload_persig_cnt, det_ctx->payload_persig_size);
+    SCLogInfo("STREAM  SIG %"PRIu64"/%"PRIu64, det_ctx->stream_persig_cnt, det_ctx->stream_persig_size);
+#endif
+
     if (det_ctx->tenant_array != NULL) {
         SCFree(det_ctx->tenant_array);
         det_ctx->tenant_array = NULL;

diff --git a/src/detect.c b/src/detect.c
index edce8a1a1bcf509b4bcc36e5b29892625ea1b447..f73157d7faed7b6971e8325776e2ea4a64c6f592 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -914,6 +914,12 @@ void SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineT
     det_ctx->base64_decoded_len = 0;
     det_ctx->raw_stream_progress = 0;
 
+#ifdef DEBUG
+    if (p->flags & PKT_STREAM_ADD) {
+        det_ctx->pkt_stream_add_cnt++;
+    }
+#endif
+
     /* No need to perform any detection on this packet, if the the given flag is set.*/
     if (p->flags & PKT_NOPACKET_INSPECTION) {
         SCReturn;

diff --git a/src/detect.h b/src/detect.h
index 7bb68a55bc2007703b96978e8e759651c689376d..85f5f241bb8bf2735f75582be9afecdcfbb5e841 100644 (file)
--- a/src/detect.h
+++ b/src/detect.h
@@ -900,7 +900,17 @@ typedef struct DetectEngineThreadCtx_ {
     uint8_t *base64_decoded;
     int base64_decoded_len;
     int base64_decoded_len_max;
-
+#ifdef DEBUG
+    uint64_t pkt_stream_add_cnt;
+    uint64_t payload_mpm_cnt;
+    uint64_t payload_mpm_size;
+    uint64_t stream_mpm_cnt;
+    uint64_t stream_mpm_size;
+    uint64_t payload_persig_cnt;
+    uint64_t payload_persig_size;
+    uint64_t stream_persig_cnt;
+    uint64_t stream_persig_size;
+#endif
 #ifdef PROFILING
     struct SCProfileData_ *rule_perf_data;
     int rule_perf_data_size;