Merge pull request #1137 in SNORT/snort3 from flow_ip_dbus to master

Squashed commit of the following:

commit b5e1c30b818ac76d56f7242cb908d844b33d3feb
Author: Carter Waxman <cwaxman@cisco.com>
Date:   Wed Mar 14 13:21:00 2018 -0400

    PerfMonitor: fixed subscribing to flow events multiple times

diff --git a/src/network_inspectors/perf_monitor/flow_ip_tracker.cc b/src/network_inspectors/perf_monitor/flow_ip_tracker.cc
index b61cec4dc0d75f7a21a49c052ad6929e763b2a6c..2ea4ff8e5bb8a4c45039ca41daa98805d671fce3 100644 (file)
--- a/src/network_inspectors/perf_monitor/flow_ip_tracker.cc
+++ b/src/network_inspectors/perf_monitor/flow_ip_tracker.cc
@@ -24,7 +24,6 @@
 
 #include "flow_ip_tracker.h"
 
-#include "framework/data_bus.h"
 #include "log/messages.h"
 #include "protocols/packet.h"
 
@@ -38,38 +37,6 @@ struct FlowStateKey
     SfIp ipB;
 };
 
-class FlowIPDataHandler : public DataHandler
-{
-public:
-    FlowIPDataHandler(FlowIPTracker& t) : tracker(t)
-    { DataBus::subscribe_default(FLOW_STATE_EVENT, this); }
-    
-    virtual void handle(DataEvent&, Flow* flow) override
-    {
-        FlowState state = SFS_STATE_MAX;
-
-        if ( flow->pkt_type == PktType::UDP )
-            state = SFS_STATE_UDP_CREATED;
-
-        if ( flow->pkt_type == PktType::TCP )
-        {
-            if ( flow->get_session_flags() & SSNFLAG_COUNTED_ESTABLISH )
-                state = SFS_STATE_TCP_ESTABLISHED;
-
-            if ( flow->get_session_flags() & SSNFLAG_COUNTED_CLOSED )
-                state = SFS_STATE_TCP_CLOSED;
-        }
-        
-        if ( state == SFS_STATE_MAX )
-            return;
-
-        tracker.update_state(&flow->client_ip, &flow->server_ip, state);
-    }
-
-private:
-    FlowIPTracker& tracker;
-};
-
 FlowStateValue* FlowIPTracker::find_stats(const SfIp* src_addr, const SfIp* dst_addr,
     int* swapped)
 {
@@ -110,8 +77,6 @@ FlowStateValue* FlowIPTracker::find_stats(const SfIp* src_addr, const SfIp* dst_
 
 FlowIPTracker::FlowIPTracker(PerfConfig* perf) : PerfTracker(perf, TRACKER_NAME)
 {
-    handler = new FlowIPDataHandler(*this);
-
     formatter->register_section("flow_ip");
     formatter->register_field("ip_a", ip_a);
     formatter->register_field("ip_b", ip_b);
@@ -156,9 +121,6 @@ FlowIPTracker::FlowIPTracker(PerfConfig* perf) : PerfTracker(perf, TRACKER_NAME)
 
 FlowIPTracker::~FlowIPTracker()
 {
-    DataBus::unsubscribe_default(FLOW_STATE_EVENT, handler);
-    delete handler;
-
     if ( ip_map )
         xhash_delete(ip_map);
 }

diff --git a/src/network_inspectors/perf_monitor/flow_ip_tracker.h b/src/network_inspectors/perf_monitor/flow_ip_tracker.h
index 707cd79caab459a797363d16c091c86ac702f54f..5e6e546724b51948bd50f72d57f9e59d0866a20e 100644 (file)
--- a/src/network_inspectors/perf_monitor/flow_ip_tracker.h
+++ b/src/network_inspectors/perf_monitor/flow_ip_tracker.h
@@ -57,7 +57,6 @@ struct FlowStateValue
     PegCount state_changes[SFS_STATE_MAX];
 };
 
-class FlowIPDataHandler;
 class FlowIPTracker : public PerfTracker
 {
 public:
@@ -71,7 +70,6 @@ public:
     int update_state(const snort::SfIp* src_addr, const snort::SfIp* dst_addr, FlowState);
 
 private:
-    FlowIPDataHandler* handler;
     FlowStateValue stats;
     XHash* ip_map;
     char ip_a[41], ip_b[41];

diff --git a/src/network_inspectors/perf_monitor/perf_monitor.cc b/src/network_inspectors/perf_monitor/perf_monitor.cc
index a7ce724f86f12b92072201910f484443188a9f5d..ce7e80c192c889e9857039b4344d18387b30d079 100644 (file)
--- a/src/network_inspectors/perf_monitor/perf_monitor.cc
+++ b/src/network_inspectors/perf_monitor/perf_monitor.cc
@@ -55,8 +55,7 @@ static THREAD_LOCAL std::vector<PerfTracker*>* trackers;
 // class stuff
 //-------------------------------------------------------------------------
 
-class PerfIdleHandler;
-class PerfRotateHandler;
+class FlowIPDataHandler;
 class PerfMonitor : public Inspector
 {
 public:
@@ -72,10 +71,15 @@ public:
     void tterm() override;
 
     void rotate();
+
+    FlowIPTracker* get_flow_ip();
+
 private:
     PerfConfig& config;
-    PerfIdleHandler* idle_handler = nullptr;
-    PerfRotateHandler* rotate_handler = nullptr;
+    FlowIPTracker* flow_ip_tracker = nullptr;
+    FlowIPDataHandler* flow_ip_handler = nullptr;
+
+    void disable_tracker(size_t);
 };
 
 class PerfIdleHandler : public DataHandler
@@ -104,11 +108,41 @@ private:
     PerfMonitor& perf_monitor;
 };
 
-PerfMonitor::PerfMonitor(PerfMonModule* mod) : config(mod->get_config())
+class FlowIPDataHandler : public DataHandler
 {
-    idle_handler = new PerfIdleHandler(*this);
-    rotate_handler = new PerfRotateHandler(*this);
-}
+public:
+    FlowIPDataHandler(PerfMonitor& p) : perf_monitor(p)
+    { DataBus::subscribe_default(FLOW_STATE_EVENT, this); }
+
+    virtual void handle(DataEvent&, Flow* flow) override
+    {
+        FlowState state = SFS_STATE_MAX;
+
+        if ( flow->pkt_type == PktType::UDP )
+            state = SFS_STATE_UDP_CREATED;
+
+        if ( flow->pkt_type == PktType::TCP )
+        {
+            if ( flow->get_session_flags() & SSNFLAG_COUNTED_ESTABLISH )
+                state = SFS_STATE_TCP_ESTABLISHED;
+
+            if ( flow->get_session_flags() & SSNFLAG_COUNTED_CLOSED )
+                state = SFS_STATE_TCP_CLOSED;
+        }
+
+        if ( state == SFS_STATE_MAX )
+            return;
+
+        FlowIPTracker* tracker = perf_monitor.get_flow_ip();
+        tracker->update_state(&flow->client_ip, &flow->server_ip, state);
+    }
+
+private:
+    PerfMonitor& perf_monitor;
+};
+
+PerfMonitor::PerfMonitor(PerfMonModule* mod) : config(mod->get_config())
+{ }
 
 void PerfMonitor::show(SnortConfig*)
 {
@@ -165,10 +199,17 @@ void PerfMonitor::show(SnortConfig*)
     }
 }
 
-static void disable_tracker(size_t i)
+void PerfMonitor::disable_tracker(size_t i)
 {
     WarningMessage("Disabling %s\n", (*trackers)[i]->get_name().c_str());
     auto tracker = trackers->at(i);
+
+    if ( tracker == flow_ip_tracker )
+    {
+        DataBus::unsubscribe_default(FLOW_STATE_EVENT, flow_ip_handler);
+        flow_ip_tracker = nullptr;
+    }
+
     (*trackers)[i] = (*trackers)[trackers->size() - 1];
     trackers->pop_back();
     delete tracker;
@@ -180,8 +221,12 @@ static void disable_tracker(size_t i)
 
 bool PerfMonitor::configure(SnortConfig*)
 {
-    idle_handler = new PerfIdleHandler(*this);
-    rotate_handler = new PerfRotateHandler(*this);
+    // DataBus deletes these when it destructs
+    new PerfIdleHandler(*this);
+    new PerfRotateHandler(*this);
+
+    if ( config.perf_flags & PERF_FLOWIP )
+        flow_ip_handler = new FlowIPDataHandler(*this);
 
     return config.resolve();
 }
@@ -197,7 +242,10 @@ void PerfMonitor::tinit()
         trackers->push_back(new FlowTracker(&config));
 
     if (config.perf_flags & PERF_FLOWIP)
-        trackers->push_back(new FlowIPTracker(&config));
+    {
+        flow_ip_tracker = new FlowIPTracker(&config);
+        trackers->push_back(flow_ip_tracker);
+    }
 
     if (config.perf_flags & PERF_CPU )
         trackers->push_back(new CPUTracker(&config));
@@ -299,6 +347,9 @@ bool PerfMonitor::ready_to_process(Packet* p)
     return false;
 }
 
+FlowIPTracker* PerfMonitor::get_flow_ip()
+{ return flow_ip_tracker; }
+
 //-------------------------------------------------------------------------
 // api stuff
 //-------------------------------------------------------------------------

diff --git a/src/network_inspectors/perf_monitor/perf_tracker.h b/src/network_inspectors/perf_monitor/perf_tracker.h
index b92a8dbdaa4f4357f4be62c0206791e4a3d0cd75..1162eee777ce3cc495f3fc589b61a75703aaa10d 100644 (file)
--- a/src/network_inspectors/perf_monitor/perf_tracker.h
+++ b/src/network_inspectors/perf_monitor/perf_tracker.h
@@ -45,8 +45,9 @@
 
 namespace snort
 {
-    class Packet;
+struct Packet;
 }
+
 class PerfTracker
 {
 public: