Merge pull request #1225 in SNORT/snort3 from perf3_edm to master

Squashed commit of the following:

commit aa397e563a5b295d13dd6066f5b3ad77c356ad5b
Author: davis mcpherson <davmcphe.cisco.com>
Date:   Tue May 15 14:30:53 2018 -0400

    build: add cmake configure switches for NO_PROFILER, NO_MEM_MGR and DEEP_PROFILING

commit ddd1d15bee1d9b8f3365b21a441a99384f37a612
Author: davis mcpherson <davmcphe.cisco.com>
Date:   Fri May 11 16:07:45 2018 -0400

    time: initialize Stopwatch::start_time member variable to 0 ticks when TSC clock is enabled

commit c5ba39de5479567d034491625bfd5223d7cd7744
Author: davis mcpherson <davmcphe.cisco.com>
Date:   Thu May 10 16:24:51 2018 -0400

    build: propogate snort3 tsc build option to the extra build system

commit 9998d4b5c89c152600e9604e65948fbe0bc872aa
Author: Russ Combs (rucombs) <rucombs@cisco.com>
Date:   Mon May 7 09:23:36 2018 -0400

    codecs: add config option to detection to enable check and alert for address anomalies

commit bf4f53352cfce206bf684c94f58bbe4f5d3de25b
Author: davis mcpherson <davmcphe.cisco.com>
Date:   Wed May 9 16:27:31 2018 -0400

    profiler: add deep profiler option

commit 8181046b436d9a5fd53c460d712a2c012cca9a40
Author: Russ Combs (rucombs) <rucombs@cisco.com>
Date:   Mon May 7 19:45:18 2018 -0400

    clock: use uint64_t with tsc clock instead of std::chrono for performance

diff --git a/cmake/configure_options.cmake b/cmake/configure_options.cmake
index 135d1cf89278c659cc8f7b2bd20d1fd090b2846c..ca2b3e3a030f52f506a7b3b1d2fb450f9cdb5535 100644 (file)
--- a/cmake/configure_options.cmake
+++ b/cmake/configure_options.cmake
@@ -14,6 +14,9 @@ endif ( NOT ENABLE_COREFILES )
 set ( _LARGEFILE_SOURCE ${ENABLE_LARGE_PCAP} )
 set ( USE_STDLOG ${ENABLE_STDLOG} )
 set ( USE_TSC_CLOCK ${ENABLE_TSC_CLOCK} )
+set ( NO_PROFILER ${DISABLE_SNORT_PROFILER} )
+set ( DEEP_PROFILING ${ENABLE_DEEP_PROFILING} )
+set ( NO_MEM_MGR ${DISABLE_MEMORY_MANAGER} )
 
 if ( ENABLE_LARGE_PCAP )
     set ( _FILE_OFFSET_BITS 64 )

diff --git a/cmake/create_options.cmake b/cmake/create_options.cmake
index 71368516f583d38b0627d67ec8b4a365b3d856dc..9f0a83c981f29227e689021980cbce6d9a6cfb06 100644 (file)
--- a/cmake/create_options.cmake
+++ b/cmake/create_options.cmake
@@ -41,6 +41,9 @@ option ( ENABLE_DEBUG_MSGS "Enable debug printing options (bugreports and develo
 option ( ENABLE_DEBUG "Enable debugging options (bugreports and developers only)" OFF )
 option ( ENABLE_GDB "Enable gdb debugging information" ON )
 option ( ENABLE_PROFILE "Enable profiling options (developers only)" OFF )
+option ( DISABLE_SNORT_PROFILER "Disable snort Profiler (developers only)" OFF )
+option ( ENABLE_DEEP_PROFILING "Enable deep profiling of snort functions (developers only)" OFF )
+option ( DISABLE_MEMORY_MANAGER "Disable snort memory manager (developers only)" OFF )
 option ( ENABLE_ADDRESS_SANITIZER "enable address sanitizer support" OFF )
 option ( ENABLE_THREAD_SANITIZER "enable thread sanitizer support" OFF )
 option ( ENABLE_UB_SANITIZER "enable undefined behavior sanitizer support" OFF )

diff --git a/cmake/create_pkg_config.cmake b/cmake/create_pkg_config.cmake
index 7550dbaec6bb7e9d966cd54080633755aeb55333..2faf7b9655fdb2d235f7702b4e99cee3934334e8 100644 (file)
--- a/cmake/create_pkg_config.cmake
+++ b/cmake/create_pkg_config.cmake
@@ -16,10 +16,30 @@ if(DAQ_INCLUDE_DIR)
     set(DAQ_CPPFLAGS "-I${DAQ_INCLUDE_DIR}")
 endif()
 
+if(DISABLE_MEMORY_MANAGER)
+    set(NO_MEM_MGR_CPPFLAGS "-DNO_MEM_MGR")
+endif()
+
+if(DISABLE_SNORT_PROFILER)
+    set(NO_PROFILER_CPPFLAGS "-DNO_PROFILER")
+endif()
+
 if(DNET_INCLUDE_DIR)
     set(DNET_CPPFLAGS "-I${DNET_INCLUDE_DIR}")
 endif()
 
+if(ENABLE_APPID_THIRD_PARTY)
+    set(TP_APPID_CPPFLAGS "-DENABLE_APPID_THIRD_PARTY")
+endif()
+
+if(ENABLE_DEEP_PROFILING)
+    set(DEEP_PROFILING_CPPFLAGS "-DDEEP_PROFILING")
+endif()
+
+if(ENABLE_TSC_CLOCK)
+    set(TSC_CPPFLAGS "-DUSE_TSC_CLOCK")
+endif()
+
 if(FLATBUFFERS_INCLUDE_DIR)
     set(FLATBUFFERS_CPPFLAGS "-I${FLATBUFFERS_INCLUDE_DIR}")
 endif()
@@ -60,9 +80,6 @@ if(UUID_INCLUDE_DIR)
     set(UUID_CPPFLAGS "-I${UUID_INCLUDE_DIR}")
 endif()
 
-if(ENABLE_APPID_THIRD_PARTY)
-    set(TP_APPID_CPPFLAGS "-DENABLE_APPID_THIRD_PARTY")
-endif()
 # create & install pkgconfig file
 
 configure_file(

diff --git a/config.cmake.h.in b/config.cmake.h.in
index cb7f2333a24fe635df8e036ec28e8502f4425114..7ac063abe413bbc78e3f07b9dacc94962186522e 100644 (file)
--- a/config.cmake.h.in
+++ b/config.cmake.h.in
@@ -73,6 +73,15 @@
 /* enable tsc clock */
 #cmakedefine USE_TSC_CLOCK 1
 
+/* disable snort profiler */
+#cmakedefine NO_PROFILER 1
+
+/* disable snort memory manager */
+#cmakedefine NO_MEM_MGR 1
+
+/* enable deep profiling */
+#cmakedefine DEEP_PROFILING 1
+
 /* signal to dump stats  */
 #cmakedefine SIGNAL_SNORT_DUMP_STATS @SIGNAL_SNORT_DUMP_STATS@
 

diff --git a/configure_cmake.sh b/configure_cmake.sh
index bfa535c3e13e5653bec2e5b143470779575bb228..8a593f3914e9ef7ccae57798ac94abe0cdfecc13 100755 (executable)
--- a/configure_cmake.sh
+++ b/configure_cmake.sh
@@ -49,6 +49,12 @@ Optional Features:
                             only)
     --disable-gdb           disable gdb debugging information
     --enable-gprof-profile  enable gprof profiling options (developers only)
+    --disable-snort-profiler
+                            disable snort performance profiling (cpu and memory) (developers only)
+    --enable-deep-profiling
+                            enabled detailed snort performance profiling (developers only)
+    --disable-memory-manager
+                            disable snort memory manager (developers only)
     --disable-corefiles     prevent Snort from generating core files
     --enable-address-sanitizer
                             enable address sanitizer support
@@ -233,6 +239,15 @@ while [ $# -ne 0 ]; do
         --enable-tsc-clock)
             append_cache_entry ENABLE_TSC_CLOCK         BOOL true
             ;;
+        --disable-snort-profiler)
+            append_cache_entry DISABLE_SNORT_PROFILER   BOOL true
+            ;;
+        --enable-deep-profiling)
+            append_cache_entry ENABLE_DEEP_PROFILING    BOOL true
+            ;;
+        --disable-memory-manager)
+            append_cache_entry DISABLE_MEMORY_MANAGER   BOOL true
+            ;;
         --disable-large-pcap)
             append_cache_entry ENABLE_LARGE_PCAP        BOOL false
             ;;

diff --git a/snort.pc.in b/snort.pc.in
index 08972e438e5b0c9b859c4939434ede552ae7d39b..8f7817c51eb7299311811e16a678bf668e44e49a 100644 (file)
--- a/snort.pc.in
+++ b/snort.pc.in
@@ -9,9 +9,8 @@ mandir=@mandir@
 infodir=@infodir@
 
 cpp_opts=DAQ LUAJIT
-cpp_opts_other=DNET FLATBUFFERS HWLOC HYPERSCAN LZMA OPENSSL PCAP PCRE UUID TP_APPID
+cpp_opts_other=DNET FLATBUFFERS HWLOC HYPERSCAN LZMA OPENSSL PCAP PCRE UUID
 
-TP_APPID_CPPFLAGS=@TP_APPID_CPPFLAGS@
 PCAP_CPPFLAGS=@PCAP_CPPFLAGS@
 LUAJIT_CPPFLAGS=@LUAJIT_CPPFLAGS@
 DNET_CPPFLAGS=@DNET_CPPFLAGS@
@@ -29,5 +28,5 @@ Description: Snort 3.0 Project
 URL: www.snort.org
 Version: @VERSION@
 Libs: -L${libdir}/snort
-Cflags: -I${includedir}/snort
+Cflags: -I${includedir}/snort @DEEP_PROFILING_CPPFLAGS@ @NO_MEM_MGR_CPPFLAGS@ @NO_PROFILER_CPPFLAGS@ @TP_APPID_CPPFLAGS@ @TSC_CPPFLAGS@
 

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index b650ed3d9dda64cf35903ba5249cc8dae40ceca9..50b3dd857260013db23f99baa1cc1a6965bd9bf7 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -374,11 +374,14 @@ void Ipv4Codec::IP4AddrTests(
     if ( msb_src == ip::IP4_MULTICAST )
         codec_event(codec, DECODE_IP4_SRC_MULTICAST);
 
-    if ( msb_src == ip::IP4_RESERVED || sfvar_ip_in(MulticastReservedIp, snort.ip_api.get_src()) )
-        codec_event(codec, DECODE_IP4_SRC_RESERVED);
+    if ( SnortConfig::is_address_anomaly_check_enabled() )
+    {
+        if ( msb_src == ip::IP4_RESERVED || sfvar_ip_in(MulticastReservedIp, snort.ip_api.get_src()) )
+            codec_event(codec, DECODE_IP4_SRC_RESERVED);
 
-    if ( msb_dst == ip::IP4_RESERVED || sfvar_ip_in(MulticastReservedIp, snort.ip_api.get_dst()) )
-        codec_event(codec, DECODE_IP4_DST_RESERVED);
+        if ( msb_dst == ip::IP4_RESERVED || sfvar_ip_in(MulticastReservedIp, snort.ip_api.get_dst()) )
+            codec_event(codec, DECODE_IP4_DST_RESERVED);
+    }
 }
 
 /* IPv4-layer decoder rules */

diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index 36338402844a66d82025cb49d371a3ddea2b5a23..edc1e6ac85ea1ebf75bcb13cc2affd7496d37d36 100644 (file)
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -242,8 +242,11 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
             }
         }
 
-        if ( sfvar_ip_in(SynToMulticastDstIp, snort.ip_api.get_dst()) )
-            codec_event(codec, DECODE_SYN_TO_MULTICAST);
+        if ( SnortConfig::is_address_anomaly_check_enabled() )
+        {
+            if ( sfvar_ip_in(SynToMulticastDstIp, snort.ip_api.get_dst()) )
+                codec_event(codec, DECODE_SYN_TO_MULTICAST);
+        }
 
         if ( (tcph->th_flags & TH_RST) )
             codec_event(codec, DECODE_TCP_SYN_RST);

diff --git a/src/latency/latency_module.cc b/src/latency/latency_module.cc
index b5050ed63807d340704925949f26e2718bd1a725..482c9eb3efa6e7731883094ece6c6498485c41c2 100644 (file)
--- a/src/latency/latency_module.cc
+++ b/src/latency/latency_module.cc
@@ -118,22 +118,17 @@ static const PegInfo latency_pegs[] =
 
 static inline bool latency_set(Value& v, PacketLatencyConfig& config)
 {
-    using std::chrono::duration_cast;
-    using std::chrono::microseconds;
-
     if ( v.is("max_time") )
     {
         long t = clock_ticks(v.get_long());
-        config.max_time = duration_cast<decltype(config.max_time)>(microseconds(t));
+        config.max_time = TO_DURATION(config.max_time, t);
     }
-
     else if ( v.is("fastpath") )
         config.fastpath = v.get_bool();
 
     else if ( v.is("action") )
         config.action =
             static_cast<decltype(config.action)>(v.get_long());
-
     else
         return false;
 
@@ -142,14 +137,10 @@ static inline bool latency_set(Value& v, PacketLatencyConfig& config)
 
 static inline bool latency_set(Value& v, RuleLatencyConfig& config)
 {
-    using std::chrono::duration_cast;
-    using std::chrono::microseconds;
-    using std::chrono::milliseconds;
-
     if ( v.is("max_time") )
     {
         long t = clock_ticks(v.get_long());
-        config.max_time = duration_cast<decltype(config.max_time)>(microseconds(t));
+        config.max_time = TO_DURATION(config.max_time, t);
     }
     else if ( v.is("suspend") )
         config.suspend = v.get_bool();
@@ -160,12 +151,11 @@ static inline bool latency_set(Value& v, RuleLatencyConfig& config)
     else if ( v.is("max_suspend_time") )
     {
         long t = clock_ticks(v.get_long());
-        config.max_suspend_time = duration_cast<decltype(config.max_time)>(milliseconds(t));
+        config.max_suspend_time = TO_DURATION(config.max_time, t);
     }
     else if ( v.is("action") )
         config.action =
             static_cast<decltype(config.action)>(v.get_long());
-
     else
         return false;
 

diff --git a/src/latency/packet_latency.cc b/src/latency/packet_latency.cc
index a4bf991ed4e6279040f974007ec97ad87461d094..cd568afd3531273e5c6e50287bc1c03fd6fffab0 100644 (file)
--- a/src/latency/packet_latency.cc
+++ b/src/latency/packet_latency.cc
@@ -72,9 +72,6 @@ using EventHandler = EventingWrapper<Event>;
 
 static inline std::ostream& operator<<(std::ostream& os, const Event& e)
 {
-    using std::chrono::duration_cast;
-    using std::chrono::microseconds;
-
     os << "latency: " << pc.total_from_daq << " packet";
 
     if ( e.fastpathed )
@@ -82,7 +79,7 @@ static inline std::ostream& operator<<(std::ostream& os, const Event& e)
     else
         os << " timed out: ";
 
-    os << clock_usecs(duration_cast<microseconds>(e.elapsed).count()) << " usec, ";
+    os << clock_usecs(TO_USECS(e.elapsed)) << " usec, ";
 
     if ( e.packet->is_cooked() )
         os << e.packet->get_pseudo_type();
@@ -128,9 +125,7 @@ inline Impl<Clock>::Impl(const ConfigWrapper& cfg, EventHandler& eh, EventHandle
 template<typename Clock>
 inline void Impl<Clock>::push()
 {
-    using std::chrono::duration_cast;
-    auto max_time = duration_cast<typename Clock::duration>(config->max_time);
-    timers.emplace_back(max_time);
+    timers.emplace_back(config->max_time);
 }
 
 template<typename Clock>
@@ -155,10 +150,7 @@ inline bool Impl<Clock>::pop(const Packet* p)
             event_handler.handle(e);
     }
 
-    // FIXIT-H this is fugly and inefficient
-    using std::chrono::duration_cast;
-    using std::chrono::microseconds;
-    elapsed = clock_usecs(duration_cast<microseconds>(timer.elapsed()).count());
+    elapsed = clock_usecs(TO_USECS(timer.elapsed()));
 
     timers.pop_back();
     return timed_out;

diff --git a/src/latency/packet_latency_config.h b/src/latency/packet_latency_config.h
index 1373bf755f8267ab00cca5bdcfa0c607daba1e16..2dc07923a9f3e504947c656b51eea9fc1ed4361a 100644 (file)
--- a/src/latency/packet_latency_config.h
+++ b/src/latency/packet_latency_config.h
@@ -33,11 +33,11 @@ struct PacketLatencyConfig
         ALERT_AND_LOG = ALERT | LOG
     };
 
-    hr_duration max_time = 0_ticks;
+    hr_duration max_time = CLOCK_ZERO;
     bool fastpath = false;
     Action action = NONE;
 
-    bool enabled() const { return max_time > 0_ticks; }
+    bool enabled() const { return max_time > CLOCK_ZERO; }
 };
 
 #endif

diff --git a/src/latency/rule_latency.cc b/src/latency/rule_latency.cc
index bece983c1f4271bb1a2df0ed44c6b7e558420e90..e92b9e1fee60ed2bd5d4d383fb85fd26e36d18bd 100644 (file)
--- a/src/latency/rule_latency.cc
+++ b/src/latency/rule_latency.cc
@@ -103,7 +103,7 @@ static inline std::ostream& operator<<(std::ostream& os, const Event& e)
         break;
     }
 
-    os << clock_usecs(duration_cast<microseconds>(e.elapsed).count()) << " usec, ";
+    os << clock_usecs(TO_USECS(e.elapsed)) << " usec, ";
     os << e.root->otn->sigInfo.gid << ":" << e.root->otn->sigInfo.sid << ":"
         << e.root->otn->sigInfo.rev;
 

diff --git a/src/main/modules.cc b/src/main/modules.cc
index 5374d076bcda2d1442dca5c7bae404c8d887edc3..3b8fce357027c1f6a69ed5d73bdb174a6ffecb1d 100644 (file)
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -86,6 +86,9 @@ static const Parameter detection_params[] =
     { "pcre_match_limit_recursion", Parameter::PT_INT, "-1:10000", "1500",
       "limit pcre stack consumption, -1 = max, 0 = off" },
 
+    { "enable_address_anomaly_checks", Parameter::PT_BOOL, nullptr, "false",
+      "enable check and alerting of address anomalies" },
+
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
 /* *INDENT-ON* */
@@ -130,6 +133,9 @@ bool DetectionModule::set(const char* fqn, Value& v, SnortConfig* sc)
     else if ( v.is("pcre_match_limit_recursion") )
         sc->pcre_match_limit_recursion = v.get_long();
 
+    else if ( v.is("enable_address_anomaly_checks") )
+        sc->address_anomaly_check_enabled = v.get_bool();
+
     else
         return Module::set(fqn, v, sc);
 

diff --git a/src/main/snort_config.h b/src/main/snort_config.h
index 3d9ce8602bfa090f757141829b6e70e3a02e999d..164ce91b27ea66d2a1cde0746237de0906aacff4 100644 (file)
--- a/src/main/snort_config.h
+++ b/src/main/snort_config.h
@@ -252,6 +252,7 @@ public:
     uint8_t num_layers = 0;
     uint8_t max_ip6_extensions = 0;
     uint8_t max_ip_layers = 0;
+    bool address_anomaly_check_enabled = false;
 
     //------------------------------------------------------
     // active stuff
@@ -455,6 +456,9 @@ public:
     static bool esp_decoding()
     { return get_conf()->enable_esp; }
 
+    static bool is_address_anomaly_check_enabled()
+    { return get_conf()->address_anomaly_check_enabled; }
+
     // mode related
     static bool test_mode()
     { return get_conf()->run_flags & RUN_FLAG__TEST; }

diff --git a/src/profiler/profiler_defs.h b/src/profiler/profiler_defs.h
index d84db1742d3bd2875ef2add5b9396a7fed6a5477..b3fd4f45a99d81e06ad9bec34559ffb323fe81d8 100644 (file)
--- a/src/profiler/profiler_defs.h
+++ b/src/profiler/profiler_defs.h
@@ -124,14 +124,25 @@ public:
 
 #ifdef NO_PROFILER
 using Profile = ProfileDisabled;
+using DeepProfile = ProfileDisabled;
 using NoProfile = ProfileDisabled;
 #else
 #ifdef NO_MEM_MGR
 using Profile = NoMemContext;
 using NoProfile = NoMemExclude;
+#ifdef DEEP_PROFILING
+using DeepProfile = NoMemContext;
+#else
+using DeepProfile = ProfileDisabled;
+#endif
 #else
 using Profile = ProfileContext;
 using NoProfile = ProfileExclude;
+#ifdef DEEP_PROFILING
+using DeepProfile = ProfileContext;
+#else
+using DeepProfile = ProfileDisabled;
+#endif
 #endif
 #endif
 

diff --git a/src/profiler/rule_profiler.cc b/src/profiler/rule_profiler.cc
index 3415dda0ef4a00ae29072c42c2cd75f81f23dc43..4ce3a7e12d0cb94bdab4090b2a5b3cea577c2fbd 100644 (file)
--- a/src/profiler/rule_profiler.cc
+++ b/src/profiler/rule_profiler.cc
@@ -121,9 +121,9 @@ struct View
     hr_duration time_per(hr_duration d, uint64_t v) const
     {
         if ( v  == 0 )
-            return 0_ticks;
+            return CLOCK_ZERO;
 
-        return hr_duration(d.count() / v);
+        return hr_duration(d / v);
     }
 
     hr_duration avg_match() const
@@ -160,7 +160,7 @@ static const ProfilerSorter<View> sorters[] =
     {
         "total_time",
         [](const View& lhs, const View& rhs)
-        { return lhs.elapsed().count() >= rhs.elapsed().count(); }
+        { return TO_TICKS(lhs.elapsed()) >= TO_TICKS(rhs.elapsed()); }
     },
     {
         "matches",
@@ -242,10 +242,10 @@ static void print_single_entry(const View& v, unsigned n)
         table << v.matches();
         table << v.alerts();
 
-        table << clock_usecs(duration_cast<microseconds>(v.elapsed()).count());
-        table << clock_usecs(duration_cast<microseconds>(v.avg_check()).count());
-        table << clock_usecs(duration_cast<microseconds>(v.avg_match()).count());
-        table << clock_usecs(duration_cast<microseconds>(v.avg_no_match()).count());
+        table << clock_usecs(TO_USECS(v.elapsed()));
+        table << clock_usecs(TO_USECS(v.avg_check()));
+        table << clock_usecs(TO_USECS(v.avg_match()));
+        table << clock_usecs(TO_USECS(v.avg_no_match()));
 
         table << v.timeouts();
         table << v.suspends();

diff --git a/src/profiler/time_profiler.cc b/src/profiler/time_profiler.cc
index 77ba6866c8d7362e1c09225fb3e97383c94dc61b..7d267e2bffdef5440696b1ce05a7571f79f66233 100644 (file)
--- a/src/profiler/time_profiler.cc
+++ b/src/profiler/time_profiler.cc
@@ -67,14 +67,14 @@ struct View
     { return stats.checks; }
 
     hr_duration avg_check() const
-    { return checks() ? hr_duration(elapsed().count() / checks()) : 0_ticks; }
+    { return checks() ? hr_duration(TO_TICKS(elapsed()) / checks()) : 0_ticks; }
 
     double pct_of(const TimeProfilerStats& o) const
     {
         if ( o.elapsed <= 0_ticks )
             return 0.0;
 
-        return double(elapsed().count()) / double(o.elapsed.count()) * 100.0;
+        return double(TO_TICKS(elapsed())) / double(TO_TICKS(o.elapsed)) * 100.0;
     }
 
     double pct_caller() const
@@ -129,10 +129,10 @@ static void print_fn(StatsTable& t, const View& v)
     t << v.checks();
 
     // total time
-    t << clock_usecs(duration_cast<microseconds>(v.elapsed()).count());
+    t << clock_usecs(TO_USECS(v.elapsed()));
 
     // avg/check
-    t << clock_usecs(duration_cast<microseconds>(v.avg_check()).count());
+    t << clock_usecs(TO_USECS(v.avg_check()));
 }
 
 } // namespace time_stats

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index 2cdfdcf6e45a39f5a07ecef09be7271133c4a4a2..0c2e421667a59a8d4a4ddc1e428e1858eff4cf9e 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -602,7 +602,7 @@ static inline int FragIsComplete(FragTracker* ft)
  */
 static void FragRebuild(FragTracker* ft, Packet* p)
 {
-    Profile profile(fragRebuildPerfStats);
+    DeepProfile profile(fragRebuildPerfStats);
     size_t offset = 0;
 
     Packet* dpkt = DetectionEngine::set_next_packet();

diff --git a/src/stream/libtcp/tcp_stream_tracker.cc b/src/stream/libtcp/tcp_stream_tracker.cc
index 36831c545ed48b1fc069fd9d46dca132413ae716..adc1a4dd026d18ea111c752afa63b32b67ff4181 100644 (file)
--- a/src/stream/libtcp/tcp_stream_tracker.cc
+++ b/src/stream/libtcp/tcp_stream_tracker.cc
@@ -248,7 +248,7 @@ void TcpStreamTracker::reset_splitter( )
 
 void TcpStreamTracker::init_on_syn_sent(TcpSegmentDescriptor& tsd)
 {
-    Profile profile(s5TcpNewSessPerfStats);
+    DeepProfile profile(s5TcpNewSessPerfStats);
 
     tsd.get_flow()->set_session_flags(SSNFLAG_SEEN_CLIENT);
     if ( tsd.get_tcph()->are_flags_set(TH_CWR | TH_ECE) )
@@ -274,7 +274,7 @@ void TcpStreamTracker::init_on_syn_sent(TcpSegmentDescriptor& tsd)
 
 void TcpStreamTracker::init_on_syn_recv(TcpSegmentDescriptor& tsd)
 {
-    Profile profile(s5TcpNewSessPerfStats);
+    DeepProfile profile(s5TcpNewSessPerfStats);
 
     irs = tsd.get_seg_seq();
     // FIXIT-H can we really set the vars below now?
@@ -288,7 +288,7 @@ void TcpStreamTracker::init_on_syn_recv(TcpSegmentDescriptor& tsd)
 
 void TcpStreamTracker::init_on_synack_sent(TcpSegmentDescriptor& tsd)
 {
-    Profile profile(s5TcpNewSessPerfStats);
+    DeepProfile profile(s5TcpNewSessPerfStats);
 
     tsd.get_flow()->set_session_flags(SSNFLAG_SEEN_SERVER);
     if (tsd.get_tcph()->are_flags_set(TH_CWR | TH_ECE))
@@ -319,7 +319,7 @@ void TcpStreamTracker::init_on_synack_sent(TcpSegmentDescriptor& tsd)
 
 void TcpStreamTracker::init_on_synack_recv(TcpSegmentDescriptor& tsd)
 {
-    Profile profile(s5TcpNewSessPerfStats);
+    DeepProfile profile(s5TcpNewSessPerfStats);
 
     iss = tsd.get_seg_ack() - 1;
     irs = tsd.get_seg_seq();
@@ -336,7 +336,7 @@ void TcpStreamTracker::init_on_synack_recv(TcpSegmentDescriptor& tsd)
 
 void TcpStreamTracker::init_on_3whs_ack_sent(TcpSegmentDescriptor& tsd)
 {
-    Profile profile(s5TcpNewSessPerfStats);
+    DeepProfile profile(s5TcpNewSessPerfStats);
 
     tsd.get_flow()->set_session_flags(SSNFLAG_SEEN_CLIENT);
 
@@ -365,7 +365,7 @@ void TcpStreamTracker::init_on_3whs_ack_sent(TcpSegmentDescriptor& tsd)
 
 void TcpStreamTracker::init_on_3whs_ack_recv(TcpSegmentDescriptor& tsd)
 {
-    Profile profile(s5TcpNewSessPerfStats);
+    DeepProfile profile(s5TcpNewSessPerfStats);
 
     iss = tsd.get_seg_ack() - 1;
     irs = tsd.get_seg_seq();
@@ -383,7 +383,7 @@ void TcpStreamTracker::init_on_3whs_ack_recv(TcpSegmentDescriptor& tsd)
 
 void TcpStreamTracker::init_on_data_seg_sent(TcpSegmentDescriptor& tsd)
 {
-    Profile profile(s5TcpNewSessPerfStats);
+    DeepProfile profile(s5TcpNewSessPerfStats);
 
     Flow* flow = tsd.get_flow();
 
@@ -416,7 +416,7 @@ void TcpStreamTracker::init_on_data_seg_sent(TcpSegmentDescriptor& tsd)
 
 void TcpStreamTracker::init_on_data_seg_recv(TcpSegmentDescriptor& tsd)
 {
-    Profile profile(s5TcpNewSessPerfStats);
+    DeepProfile profile(s5TcpNewSessPerfStats);
 
     iss = tsd.get_seg_ack();
     irs = tsd.get_seg_seq();

diff --git a/src/stream/tcp/ips_stream_reassemble.cc b/src/stream/tcp/ips_stream_reassemble.cc
index 1b3fb6d8b63dc8041bc01d32bcd4c83b8f5210b5..8993bf5b42d8fcb8bc3acc9b90a3f9e2dd3ca25b 100644 (file)
--- a/src/stream/tcp/ips_stream_reassemble.cc
+++ b/src/stream/tcp/ips_stream_reassemble.cc
@@ -114,7 +114,7 @@ IpsOption::EvalStatus ReassembleOption::eval(Cursor&, Packet* pkt)
         return NO_MATCH;
 
     {
-        Profile profile(streamReassembleRuleOptionPerfStats);
+        DeepProfile profile(streamReassembleRuleOptionPerfStats);
         Flow* lwssn = (Flow*)pkt->flow;
         TcpSession* tcpssn = (TcpSession*)lwssn->session;
 

diff --git a/src/stream/tcp/ips_stream_size.cc b/src/stream/tcp/ips_stream_size.cc
index 96b2d843b006a95a210b95032257dc509677a52a..1def6ebade19b938b535e8f9173d429d86ba56e9 100644 (file)
--- a/src/stream/tcp/ips_stream_size.cc
+++ b/src/stream/tcp/ips_stream_size.cc
@@ -95,7 +95,7 @@ bool SizeOption::operator==(const IpsOption& ips) const
 
 IpsOption::EvalStatus SizeOption::eval(Cursor&, Packet* pkt)
 {
-    Profile profile(streamSizePerfStats);
+    DeepProfile profile(streamSizePerfStats);
 
     if ( !pkt->flow || pkt->flow->pkt_type != PktType::TCP )
         return NO_MATCH;

diff --git a/src/stream/tcp/tcp_reassembler.cc b/src/stream/tcp/tcp_reassembler.cc
index 2d4089b0c0e08e88b5b3d71b9cc8e44c0061d627..69a916e078c08b8a8f089ca7924298eda4c3d3c5 100644 (file)
--- a/src/stream/tcp/tcp_reassembler.cc
+++ b/src/stream/tcp/tcp_reassembler.cc
@@ -401,7 +401,7 @@ int TcpReassembler::flush_data_segments(
     uint32_t flags = PKT_PDU_HEAD;
 
     assert(trs.sos.seglist.next);
-    Profile profile(s5TcpBuildPacketPerfStats);
+    DeepProfile profile(s5TcpBuildPacketPerfStats);
 
     uint32_t to_seq = trs.sos.seglist.next->seq + total;
 
@@ -553,7 +553,7 @@ Packet* TcpReassembler::initialize_pdu(
 int TcpReassembler::_flush_to_seq(
     TcpReassemblerState& trs, uint32_t bytes, Packet* p, uint32_t pkt_flags)
 {
-    Profile profile(s5TcpFlushPerfStats);
+    DeepProfile profile(s5TcpFlushPerfStats);
 
     DetectionEngine::onload(trs.sos.session->flow);
     Packet* pdu = DetectionEngine::set_next_packet();
@@ -895,7 +895,7 @@ uint32_t TcpReassembler::get_forward_packet_dir(TcpReassemblerState&, const Pack
 // because we don't wait until it is acknowledged
 int32_t TcpReassembler::flush_pdu_ips(TcpReassemblerState& trs, uint32_t* flags)
 {
-    Profile profile(s5TcpPAFPerfStats);
+    DeepProfile profile(s5TcpPAFPerfStats);
     DetectionEngine::onload(trs.sos.session->flow);
 
     uint32_t total = 0, avail;
@@ -969,7 +969,7 @@ void TcpReassembler::fallback(TcpReassemblerState& trs)
 
 int32_t TcpReassembler::flush_pdu_ackd(TcpReassemblerState& trs, uint32_t* flags)
 {
-    Profile profile(s5TcpPAFPerfStats);
+    DeepProfile profile(s5TcpPAFPerfStats);
     DetectionEngine::onload(trs.sos.session->flow);
 
     uint32_t total = 0;
@@ -1287,7 +1287,7 @@ int TcpReassembler::insert_segment_in_seglist(
 int TcpReassembler::queue_packet_for_reassembly(
     TcpReassemblerState& trs, TcpSegmentDescriptor& tsd)
 {
-    Profile profile(s5TcpInsertPerfStats);
+    DeepProfile profile(s5TcpInsertPerfStats);
 
     int rc = STREAM_INSERT_OK;
 

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 47a71b91a2b736637c09b4f876f2f16f971b74d3..389fe507bacfa54b3c5b755bf3349fa7eb3ceee1 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -349,7 +349,7 @@ void TcpSession::check_fin_transition_status(TcpSegmentDescriptor& tsd)
 
 int TcpSession::process_tcp_data(TcpSegmentDescriptor& tsd)
 {
-    Profile profile(s5TcpDataPerfStats);
+    DeepProfile profile(s5TcpDataPerfStats);
 
     const tcp::TCPHdr* tcph = tsd.get_tcph();
     uint32_t seq = tsd.get_seg_seq();
@@ -999,7 +999,8 @@ bool TcpSession::do_packet_analysis_pre_checks(Packet* p, TcpSegmentDescriptor&
 
     update_ignored_session(tsd);
     set_window_scale(*talker, *listener, tsd);
-    check_for_session_hijack(tsd);
+    if ( SnortConfig::is_address_anomaly_check_enabled() )
+        check_for_session_hijack(tsd);
 
     return true;
 }
@@ -1040,7 +1041,7 @@ int TcpSession::process(Packet* p)
         return ACTION_NOTHING;
     else
     {
-        Profile profile(s5TcpStatePerfStats);
+        DeepProfile profile(s5TcpStatePerfStats);
 
         if ( tsm->eval(tsd, *talker, *listener) )
         {

diff --git a/src/time/clock_defs.h b/src/time/clock_defs.h
index 2a2d12c80b987cb2de31e27722e1c07a5ade0f21..75cdfa3490fb65ac537b3cf9db094513c9618be9 100644 (file)
--- a/src/time/clock_defs.h
+++ b/src/time/clock_defs.h
@@ -23,12 +23,22 @@
 #ifdef USE_TSC_CLOCK
 #include "time/tsc_clock.h"
 using SnortClock = TscClock;
+#define CLOCK_ZERO 0
+#define DURA_ZERO 0
+#define TO_TICKS(t) (t)
+#define TO_USECS(t) (t)
+#define TO_DURATION(v, t) (t)
 
 #else
 #include <chrono>
 using hr_clock = std::chrono::high_resolution_clock;
 using SnortClock = hr_clock;
 inline long clock_scale() { return 1; }
+#define CLOCK_ZERO 0_ticks
+#define DURA_ZERO Clock::duration::zero()
+#define TO_TICKS(t) (t.count())
+#define TO_USECS(t) (std::chrono::duration_cast<std::chrono::microseconds>(t).count())
+#define TO_DURATION(v, t) (std::chrono::duration_cast<decltype(v)>(std::chrono::microseconds(t)))
 #endif
 
 using hr_duration = SnortClock::duration;

diff --git a/src/time/stopwatch.h b/src/time/stopwatch.h
index 3c937b6f09dcf26cc12d577591195d1eb913b65a..bf736268e77f54ff97b2d8f00be95225486af83b 100644 (file)
--- a/src/time/stopwatch.h
+++ b/src/time/stopwatch.h
@@ -28,7 +28,7 @@ public:
     using time_point = typename Clock::time_point;
 
     Stopwatch() :
-        elapsed { duration::zero() }, running { false } { }
+        elapsed { DURA_ZERO }, running { false } { }
 
     void start()
     {
@@ -60,7 +60,7 @@ public:
     { return running; }
 
     void reset()
-    { running = false; elapsed = duration::zero(); }
+    { running = false; elapsed = DURA_ZERO; }
 
     void cancel()
     { running = false; }
@@ -71,7 +71,12 @@ private:
 
     duration elapsed;
     bool running;
+
+#ifdef USE_TSC_CLOCK
+    time_point start_time = CLOCK_ZERO;
+#else
     time_point start_time;
+#endif
 };
 
 #endif

diff --git a/src/time/tsc_clock.h b/src/time/tsc_clock.h
index c7729808abdb5c1bbfa55d2a955631ab561ad8b9..4ca20efaf021c928d17ae9525d0ba1f5df993711 100644 (file)
--- a/src/time/tsc_clock.h
+++ b/src/time/tsc_clock.h
@@ -37,12 +37,8 @@
 
 struct TscClock
 {
-    // this has to be const so we use a nice round number and scale it later
-    typedef std::ratio<1, 1000000> period;
-
-    typedef uint64_t rep;
-    typedef std::chrono::duration<rep, period> duration;
-    typedef std::chrono::time_point<TscClock> time_point;
+    typedef uint64_t duration;
+    typedef uint64_t time_point;
 
     static const bool is_steady = true;