Merge pull request #636 in SNORT/snort3 from crc_timeouts to master

Squashed commit of the following:

commit 2797249af796d70c7b0eb9759d056bca3572e229
Author: Russ Combs <rucombs@cisco.com>
Date:   Fri Sep 23 14:43:19 2016 -0400

    separate idle timeouts from session timeouts counts
    close tcp on rst in close wait, closing, fin wait 1, and fin wait 2

diff --git a/src/flow/flow_cache.cc b/src/flow/flow_cache.cc
index ea7af7add8295c1da1c900d8e0a3503749a4d9f6..4a636627ac6fc377cbb5fc7fdba330bd7d8f83a8 100644 (file)
--- a/src/flow/flow_cache.cc
+++ b/src/flow/flow_cache.cc
@@ -192,7 +192,7 @@ unsigned FlowCache::prune_stale(uint32_t thetime, const Flow* save_me)
 
         DebugMessage(DEBUG_STREAM, "pruning stale flow\n");
         flow->ssn_state.session_flags |= SSNFLAG_TIMEDOUT;
-        release(flow, PruneReason::TIMEOUT);
+        release(flow, PruneReason::IDLE);
         ++pruned;
 
         flow = static_cast<Flow*>(hash_table->first());
@@ -314,7 +314,7 @@ unsigned FlowCache::timeout(unsigned num_flows, time_t thetime)
 
         DebugMessage(DEBUG_STREAM, "retiring stale flow\n");
         flow->ssn_state.session_flags |= SSNFLAG_TIMEDOUT;
-        release(flow, PruneReason::TIMEOUT);
+        release(flow, PruneReason::IDLE);
 
         ++retired;
 
@@ -334,7 +334,7 @@ unsigned FlowCache::purge()
 
     while ( auto flow = static_cast<Flow*>(hash_table->first()) )
     {
-        release(flow, PruneReason::PURGE);
+        release(flow, PruneReason::NONE);
         ++retired;
     }
 

diff --git a/src/flow/flow_cache.h b/src/flow/flow_cache.h
index f62e69ae37c82b5ac3d7ffb51fab2c8008428bdb..5bd226730631bc7b9dad56ef740e1ad52af9c6df 100644 (file)
--- a/src/flow/flow_cache.h
+++ b/src/flow/flow_cache.h
@@ -46,7 +46,7 @@ public:
     Flow* find(const FlowKey*);
     Flow* get(const FlowKey*);
 
-    int release(Flow*, PruneReason = PruneReason::USER, bool do_cleanup = true);
+    int release(Flow*, PruneReason = PruneReason::NONE, bool do_cleanup = true);
 
     unsigned prune_unis();
     unsigned prune_stale(uint32_t thetime, const Flow* save_me);
@@ -61,7 +61,7 @@ public:
     { return config.max_sessions; }
 
     PegCount get_total_prunes() const
-    { return prune_stats.get_total() - prune_stats.get(PruneReason::PURGE); }
+    { return prune_stats.get_total(); }
 
     PegCount get_prunes(PruneReason reason) const
     { return prune_stats.get(reason); }

diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc
index 8fbfda84775ea7997c793906e066e2e6129f51af..504d8e8d3fe8bb58b9d90a0f520e92f8e5d82b7d 100644 (file)
--- a/src/flow/flow_control.cc
+++ b/src/flow/flow_control.cc
@@ -191,8 +191,7 @@ void FlowControl::delete_flow(const FlowKey* key)
     Flow* flow = cache->find(key);
 
     if ( flow )
-        // FIXIT-L prune reason was actually HA sync
-        cache->release(flow, PruneReason::USER);
+        cache->release(flow, PruneReason::HA);
 }
 
 void FlowControl::delete_flow(Flow* flow, PruneReason reason)

diff --git a/src/flow/prune_stats.h b/src/flow/prune_stats.h
index c190347b2413c0f86f56f28c0a76a66680d9aa3d..808e2ee2c3bb014b5c4bb8305b60a0ee6fd708fe 100644 (file)
--- a/src/flow/prune_stats.h
+++ b/src/flow/prune_stats.h
@@ -26,17 +26,15 @@
 
 #include "framework/counts.h"
 
-// FIXIT-L we can probably fiddle with these breakdowns
 enum class PruneReason : uint8_t
 {
-    // FIXIT-L do we want to count purges?  yes
-    PURGE = 0,
-    TIMEOUT,
+    IDLE,
     EXCESS,
     UNI,
     PREEMPTIVE,
     MEMCAP,
-    USER,
+    HA,
+    NONE,
     MAX
 };
 
@@ -61,7 +59,7 @@ struct PruneStats
 inline PegCount PruneStats::get_total() const
 {
     PegCount total = 0;
-    for ( reason_t i = 0; i < static_cast<reason_t>(PruneReason::MAX); ++i )
+    for ( reason_t i = 0; i < static_cast<reason_t>(PruneReason::NONE); ++i )
         total += prunes[i];
 
     return total;

diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc
index a4e9b4f47724b96d34da84dd2bf52b466d725ae4..0e45ded4ecdb8502f680f821a7ba2ad755b017af 100644 (file)
--- a/src/stream/base/stream_base.cc
+++ b/src/stream/base/stream_base.cc
@@ -45,18 +45,18 @@ THREAD_LOCAL BaseStats stream_base_stats;
 #define PROTO_PEGS(proto_str) \
     { proto_str " flows", "total " proto_str " sessions" }, \
     { proto_str " total prunes", "total " proto_str " sessions pruned" }, \
-    { proto_str " timeout prunes", proto_str " sessions pruned due to timeout" }, \
+    { proto_str " idle prunes", proto_str " sessions pruned due to timeout" }, \
     { proto_str " excess prunes", proto_str " sessions pruned due to excess" }, \
     { proto_str " uni prunes", proto_str " uni sessions pruned" }, \
     { proto_str " preemptive prunes", proto_str " sessions pruned during preemptive pruning" }, \
     { proto_str " memcap prunes", proto_str " sessions pruned due to memcap" }, \
-    { proto_str " user prunes", proto_str " sessions pruned for other reasons" }
+    { proto_str " ha prunes", proto_str " sessions pruned by high availability sync" }
 
 #define SET_PROTO_COUNTS(proto, pkttype) \
     stream_base_stats.proto ## _flows = flow_con->get_flows(PktType::pkttype); \
     stream_base_stats.proto ## _total_prunes = flow_con->get_total_prunes(PktType::pkttype), \
     stream_base_stats.proto ## _timeout_prunes = \
-        flow_con->get_prunes(PktType::pkttype, PruneReason::TIMEOUT), \
+        flow_con->get_prunes(PktType::pkttype, PruneReason::IDLE), \
     stream_base_stats.proto ## _excess_prunes = \
         flow_con->get_prunes(PktType::pkttype, PruneReason::EXCESS), \
     stream_base_stats.proto ## _uni_prunes = \
@@ -65,8 +65,8 @@ THREAD_LOCAL BaseStats stream_base_stats;
         flow_con->get_prunes(PktType::pkttype, PruneReason::PREEMPTIVE), \
     stream_base_stats.proto ## _memcap_prunes = \
         flow_con->get_prunes(PktType::pkttype, PruneReason::MEMCAP), \
-    stream_base_stats.proto ## _user_prunes = \
-        flow_con->get_prunes(PktType::pkttype, PruneReason::USER)
+    stream_base_stats.proto ## _ha_prunes = \
+        flow_con->get_prunes(PktType::pkttype, PruneReason::HA)
 
 // FIXIT-L dependency on stats define in another file
 const PegInfo base_pegs[] =

diff --git a/src/stream/base/stream_module.h b/src/stream/base/stream_module.h
index 4e4d28f0f1b62ff5e25e5b785fc2dfe6940a9b1a..0067be740a2e0544afd0003b49f4e2091f58e67d 100644 (file)
--- a/src/stream/base/stream_module.h
+++ b/src/stream/base/stream_module.h
@@ -43,7 +43,7 @@ struct SnortConfig;
     PegCount proto ## _uni_prunes; \
     PegCount proto ## _preemptive_prunes; \
     PegCount proto ## _memcap_prunes; \
-    PegCount proto ## _user_prunes
+    PegCount proto ## _ha_prunes
 
 struct BaseStats
 {

diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc
index 718eb3d32e9e3ad23bb5c46fb4e7ddf90bece58c..c0287345a01941fffe44c35d278f6aa23f474658 100644 (file)
--- a/src/stream/icmp/icmp_session.cc
+++ b/src/stream/icmp/icmp_session.cc
@@ -60,12 +60,6 @@ THREAD_LOCAL ProfileStats icmp_perf_stats;
 
 static void IcmpSessionCleanup(Flow* ssn)
 {
-    if (ssn->ssn_state.session_flags & SSNFLAG_PRUNED)
-        icmpStats.prunes++;
-
-    else if (ssn->ssn_state.session_flags & SSNFLAG_TIMEDOUT)
-        icmpStats.timeouts++;
-
     if ( ssn->ssn_state.session_flags & SSNFLAG_SEEN_SENDER )
         icmpStats.released++;
 

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index f115786a108cfa489a2e0398fcbb683ae0af313b..c96501cd6733a3f3cb3be2f8adc9e3df1db58ebd 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -1282,6 +1282,7 @@ void Defrag::process(Packet* p, FragTracker* ft)
         else
         {
             release_tracker(ft);
+            p->flow->session_state |= STREAM_STATE_CLOSED;
         }
     }
 }

diff --git a/src/stream/ip/ip_session.cc b/src/stream/ip/ip_session.cc
index abcb85e94a2b13d9bb93add66bef48925f0ea18d..776367a85fb383f85f9829b123d4a4fe4da3811b 100644 (file)
--- a/src/stream/ip/ip_session.cc
+++ b/src/stream/ip/ip_session.cc
@@ -34,8 +34,8 @@
 const PegInfo ip_pegs[] =
 {
     SESSION_PEGS("ip"),
-    { "total", "total fragments" },
-    { "current", "current fragments" },
+    { "total frags", "total fragments" },
+    { "current frags", "current fragments" },
     { "max frags", "max fragments" },
     { "reassembled", "reassembled datagrams" },
     { "discards", "fragments discarded" },
@@ -71,12 +71,6 @@ static void IpSessionCleanup(Flow* lws, FragTracker* tracker)
         d->cleanup(tracker);
     }
 
-    if ( lws->ssn_state.session_flags & SSNFLAG_TIMEDOUT )
-        ip_stats.timeouts++;
-
-    else if ( lws->ssn_state.session_flags & SSNFLAG_PRUNED )
-        ip_stats.prunes++;
-
     ip_stats.released++;
     lws->restart();
 }
@@ -166,6 +160,7 @@ int IpSession::process(Packet* p)
 
     if ( Stream::expired_flow(flow, p) )
     {
+        ip_stats.timeouts++;
         IpSessionCleanup(flow, &tracker);
 
 #ifdef ENABLE_EXPECTED_IP

diff --git a/src/stream/stream.cc b/src/stream/stream.cc
index 94b029c282ba26d58eca69e105e8836a7ce2eb45..05575244c44c8e14464a298510ab60fea12e7b08 100644 (file)
--- a/src/stream/stream.cc
+++ b/src/stream/stream.cc
@@ -172,8 +172,7 @@ void Stream::check_flow_closed(Packet* p)
     if (flow->session_state & STREAM_STATE_CLOSED)
     {
         assert(flow_con);
-        // FIXIT-L prune reason was actually 'closed'
-        flow_con->delete_flow(flow, PruneReason::USER);
+        flow_con->delete_flow(flow, PruneReason::NONE);
         p->flow = nullptr;
     }
 }

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 8d95c2ef376d53f8536aa8d0970682561c412bc2..91fe763d71e5e40f84cb0586522ab77fbf15bc50 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -56,6 +56,7 @@
 #include "detection/detection_util.h"
 #include "hash/sfxhash.h"
 #include "utils/util.h"
+#include "utils/util_net.h"
 #include "utils/sflsq.h"
 #include "time/packet_time.h"
 #include "perf_monitor/flow_ip_tracker.h"
@@ -177,12 +178,6 @@ void TcpSession::clear_session(bool free_flow_data, bool flush_segments, bool re
     else
         return;
 
-    if ( flow->get_session_flags() & SSNFLAG_PRUNED )
-        tcpStats.prunes++;
-
-    else if ( flow->get_session_flags() & SSNFLAG_TIMEDOUT )
-        tcpStats.timeouts++;
-
     update_perf_base_state(TcpStreamTracker::TCP_CLOSED);
 
     if ( restart )

diff --git a/src/stream/tcp/tcp_state_close_wait.cc b/src/stream/tcp/tcp_state_close_wait.cc
index 15d17df5d1e2c93f92263cc4c890350e80ca92b7..abace5fccb27ee246e975cd237f554995e38a2e9 100644 (file)
--- a/src/stream/tcp/tcp_state_close_wait.cc
+++ b/src/stream/tcp/tcp_state_close_wait.cc
@@ -139,6 +139,7 @@ bool TcpStateCloseWait::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tr
         trk.session->update_session_on_rst(tsd, true);
         trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
         trk.session->set_pkt_action_flag(ACTION_RST);
+        tsd.get_pkt()->flow->session_state |= STREAM_STATE_CLOSED;
     }
     else
     {

diff --git a/src/stream/tcp/tcp_state_closing.cc b/src/stream/tcp/tcp_state_closing.cc
index 9a86024cc91e10105d430e42986d33168d096258..80b6d948d8e9c1df98c32e45c8e380a37ad3e16e 100644 (file)
--- a/src/stream/tcp/tcp_state_closing.cc
+++ b/src/stream/tcp/tcp_state_closing.cc
@@ -141,6 +141,7 @@ bool TcpStateClosing::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
         trk.session->update_session_on_rst(tsd, true);
         trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
         trk.session->set_pkt_action_flag(ACTION_RST);
+        tsd.get_pkt()->flow->session_state |= STREAM_STATE_CLOSED;
     }
     else
     {

diff --git a/src/stream/tcp/tcp_state_fin_wait1.cc b/src/stream/tcp/tcp_state_fin_wait1.cc
index e40665e8ce6a59974c988857a95f66ef287decc9..20e177c5e117b84e11bd9528caf65fe5d913da9c 100644 (file)
--- a/src/stream/tcp/tcp_state_fin_wait1.cc
+++ b/src/stream/tcp/tcp_state_fin_wait1.cc
@@ -146,6 +146,7 @@ bool TcpStateFinWait1::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk
         trk.session->update_session_on_rst(tsd, true);
         trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
         trk.session->set_pkt_action_flag(ACTION_RST);
+        tsd.get_pkt()->flow->session_state |= STREAM_STATE_CLOSED;
     }
     else
     {

diff --git a/src/stream/tcp/tcp_state_fin_wait2.cc b/src/stream/tcp/tcp_state_fin_wait2.cc
index a9e4415a2723d3485d457c131eb784942af54e0a..3b79e1e53a0092ce8bd5880f289f3833085791cd 100644 (file)
--- a/src/stream/tcp/tcp_state_fin_wait2.cc
+++ b/src/stream/tcp/tcp_state_fin_wait2.cc
@@ -154,6 +154,7 @@ bool TcpStateFinWait2::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk
         trk.session->update_session_on_rst(tsd, true);
         trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
         trk.session->set_pkt_action_flag(ACTION_RST);
+        tsd.get_pkt()->flow->session_state |= STREAM_STATE_CLOSED;
     }
     else
     {

diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc
index cac2649a5d4e107570e776bf803136182e81a2a4..41bf4f1307615600dd00fc2f599ce91ff1a3cacc 100644 (file)
--- a/src/stream/udp/udp_session.cc
+++ b/src/stream/udp/udp_session.cc
@@ -59,12 +59,6 @@ THREAD_LOCAL ProfileStats udp_perf_stats;
 
 static void UdpSessionCleanup(Flow* lwssn)
 {
-    if (lwssn->ssn_state.session_flags & SSNFLAG_PRUNED)
-        udpStats.prunes++;
-
-    else if (lwssn->ssn_state.session_flags & SSNFLAG_TIMEDOUT)
-        udpStats.timeouts++;
-
     if ( lwssn->ssn_state.session_flags & SSNFLAG_SEEN_SENDER )
         udpStats.released++;
 }
@@ -196,6 +190,7 @@ int UdpSession::process(Packet* p)
     // Should be done before we do something with the packet...
     if ( Stream::expired_flow(flow, p) )
     {
+        udpStats.timeouts++;
         UdpSessionCleanup(flow);
         flow->restart();
         flow->ssn_state.session_flags |= SSNFLAG_SEEN_SENDER;