Merge pull request #1808 in SNORT/snort3 from ~SHRARANG/snort3:appid_inferred_svc_ver...

Squashed commit of the following:

commit ca9b2578a0e6377aa4a66edc1358f2652e88ae1d
Author: Shravan Rangaraju <shrarang@cisco.com>
Date:   Fri Oct 18 16:34:32 2019 -0400

    appid: check inferred services in host cache only if there were updates

diff --git a/src/host_tracker/host_tracker.cc b/src/host_tracker/host_tracker.cc
index c8ae5a7db360187a481db21a65306f56b4464c6c..ecf9d784389dcd217a749591a3b873047953d250 100644 (file)
--- a/src/host_tracker/host_tracker.cc
+++ b/src/host_tracker/host_tracker.cc
@@ -79,7 +79,7 @@ void HostTracker::copy_data(uint8_t& p_hops, uint32_t& p_last_seen, list<HostMac
         p_macs = new list<HostMac>(macs.begin(), macs.end());
 }
 
-bool HostTracker::add_service(Port port, IpProtocol proto, AppId appid, bool inferred_appid)
+bool HostTracker::add_service(Port port, IpProtocol proto, AppId appid, bool inferred_appid, bool* added)
 {
     host_tracker_stats.service_adds++;
     std::lock_guard<std::mutex> lck(host_tracker_lock);
@@ -92,12 +92,17 @@ bool HostTracker::add_service(Port port, IpProtocol proto, AppId appid, bool inf
             {
                 s.appid = appid;
                 s.inferred_appid = inferred_appid;
+                if (added)
+                    *added = true;
             }
             return true;
         }
     }
 
     services.emplace_back( HostApplication{port, proto, appid, inferred_appid} );
+    if (added)
+        *added = true;
+
     return true;
 }
 

diff --git a/src/host_tracker/host_tracker.h b/src/host_tracker/host_tracker.h
index 5d45a11acc3df11ae3e4f7e3bf875d0078a13d2d..60d6ce30984af30cf3e6775cf0899624be1008be 100644 (file)
--- a/src/host_tracker/host_tracker.h
+++ b/src/host_tracker/host_tracker.h
@@ -106,7 +106,7 @@ public:
     // Appid may not be identified always. Inferred means dynamic/runtime
     // appid detected from one flow to another flow such as BitTorrent.
     bool add_service(Port port, IpProtocol proto,
-        AppId appid = APP_ID_NONE, bool inferred_appid = false);
+        AppId appid = APP_ID_NONE, bool inferred_appid = false, bool* added = nullptr);
 
     AppId get_appid(Port port, IpProtocol proto, bool inferred_only = false, bool allow_port_wildcard = false);
 

diff --git a/src/network_inspectors/appid/appid_discovery.cc b/src/network_inspectors/appid/appid_discovery.cc
index 68d8802265e8f19c8dd80b6a8f19c0d54ddc0ce0..4f070ae505839d7de19bfea9a073fb985dd8af09 100644 (file)
--- a/src/network_inspectors/appid/appid_discovery.cc
+++ b/src/network_inspectors/appid/appid_discovery.cc
@@ -691,7 +691,7 @@ bool AppIdDiscovery::do_pre_discovery(Packet* p, AppIdSession** p_asd, AppIdInsp
         *p_asd = asd = AppIdSession::allocate_session(p, protocol, direction, &inspector);
         if (p->flow->get_session_flags() & SSNFLAG_MIDSTREAM)
         {
-            asd->set_session_flags(APPID_SESSION_MID);
+            flow_flags |= APPID_SESSION_MID;
             if (appidDebug->is_active())
                 LogMessage("AppIdDbg %s New AppId mid-stream session\n",
                     appidDebug->get_debug_session());
@@ -873,7 +873,7 @@ bool AppIdDiscovery::do_host_port_based_discovery(Packet* p, AppIdSession& asd,
     if(tun_dest)
     {
         ip = &(tun_dest->ip);
-        port = tun_dest->port; 
+        port = tun_dest->port;
     }
     else
     {
@@ -922,6 +922,10 @@ bool AppIdDiscovery::do_host_port_based_discovery(Packet* p, AppIdSession& asd,
 
     if (!hv and check_dynamic)
     {
+        std::lock_guard<std::mutex> lck(AppIdSession::inferred_svcs_lock);
+        if (!asd.is_inferred_svcs_ver_updated())
+            return false;
+
         auto ht = host_cache.find(*ip);
         if (ht)
         {

diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc
index 367c01458814d25d3bde4c1d5d3fd1eec72e1def..c410bb21252daab81fdab10eadc172bc8996d5f8 100644 (file)
--- a/src/network_inspectors/appid/appid_session.cc
+++ b/src/network_inspectors/appid/appid_session.cc
@@ -55,6 +55,8 @@ using namespace snort;
 
 unsigned AppIdSession::inspector_id = 0;
 THREAD_LOCAL uint32_t AppIdSession::appid_flow_data_id = 0;
+std::mutex AppIdSession::inferred_svcs_lock;
+uint16_t AppIdSession::inferred_svcs_ver = 0;
 
 const uint8_t* service_strstr(const uint8_t* haystack, unsigned haystack_len,
     const uint8_t* needle, unsigned needle_len)

diff --git a/src/network_inspectors/appid/appid_session.h b/src/network_inspectors/appid/appid_session.h
index 19e4bb451c2e090e1e3b7840fcf85baece30577f..aabc69439ca271fc42fe962fe8e113cc73517833 100644 (file)
--- a/src/network_inspectors/appid/appid_session.h
+++ b/src/network_inspectors/appid/appid_session.h
@@ -23,6 +23,7 @@
 #define APPID_SESSION_H
 
 #include <map>
+#include <mutex>
 #include <string>
 #include <unordered_map>
 
@@ -278,6 +279,8 @@ public:
     snort::SEARCH_SUPPORT_TYPE search_support_type = snort::UNKNOWN_SEARCH_ENGINE;
     bool in_expected_cache = false;
     static unsigned inspector_id;
+    static std::mutex inferred_svcs_lock;
+
     static void init() { inspector_id = FlowData::create_flow_data_id(); }
 
     void set_session_flags(uint64_t flags) { common.flags |= flags; }
@@ -364,6 +367,21 @@ public:
         return tp_payload_app_id;
     }
 
+    inline uint16_t is_inferred_svcs_ver_updated()
+    {
+        if (my_inferred_svcs_ver == inferred_svcs_ver)
+            return false;
+        my_inferred_svcs_ver = inferred_svcs_ver;
+        return true;
+    }
+
+    static inline void incr_inferred_svcs_ver()
+    {
+        inferred_svcs_ver++;
+        if (inferred_svcs_ver == 0)
+            inferred_svcs_ver++;
+    }
+
 private:
     AppIdHttpSession* hsession = nullptr;
     AppIdDnsSession* dsession = nullptr;
@@ -379,6 +397,9 @@ private:
     // appId determined by 3rd party library
     AppId tp_app_id = APP_ID_NONE;
     AppId tp_payload_app_id = APP_ID_NONE;
+
+    uint16_t my_inferred_svcs_ver = 0;
+    static uint16_t inferred_svcs_ver;
 };
 
 static inline bool is_svc_http_type(AppId serviceId)

diff --git a/src/network_inspectors/appid/lua_detector_api.cc b/src/network_inspectors/appid/lua_detector_api.cc
index b32bcd238d2759e27451dd5e060475eb4e1763b5..d0f8ecd78665affa7d84115884bbba1d94a08f0c 100644 (file)
--- a/src/network_inspectors/appid/lua_detector_api.cc
+++ b/src/network_inspectors/appid/lua_detector_api.cc
@@ -1190,8 +1190,12 @@ static int detector_add_host_port_dynamic(lua_State* L)
         return 0;
     }
 
-    if ( !host_cache[ip_addr]->add_service(port, proto, appid, true) )
+    bool added = false;
+    std::lock_guard<std::mutex> lck(AppIdSession::inferred_svcs_lock);
+    if ( !host_cache[ip_addr]->add_service(port, proto, appid, true, &added) )
         ErrorMessage("%s:Failed to add host tracker service\n",__func__);
+    if (added)
+        AppIdSession::incr_inferred_svcs_ver();
 
     return 0;
 }

diff --git a/src/network_inspectors/appid/test/appid_mock_session.h b/src/network_inspectors/appid/test/appid_mock_session.h
index 16d85b69d4dfb541269b3984198aa1890ca1bdbb..994f6e1cbce4d679e80a5c14862545f178f04f7b 100644 (file)
--- a/src/network_inspectors/appid/test/appid_mock_session.h
+++ b/src/network_inspectors/appid/test/appid_mock_session.h
@@ -54,6 +54,8 @@ AppIdServiceSubtype APPID_UT_SERVICE_SUBTYPE = { nullptr, APPID_UT_SERVICE,
                                                  APPID_UT_SERVICE_VERSION };
 
 unsigned AppIdSession::inspector_id = 0;
+std::mutex AppIdSession::inferred_svcs_lock;
+uint16_t AppIdSession::inferred_svcs_ver = 0;
 
 class MockAppIdDnsSession : public AppIdDnsSession
 {