+102
+-- moved stats (peg counts) to module
+-- removed sum() and stats() from InspectApi
+-- tweaked --help-module
+
101
-- tweaked startup output
-- fixed pattern matcher
# initialization
#--------------------------------------------------------------------------
-AC_INIT([snort], [2.10.101])
+AC_INIT([snort], [2.10.102])
AC_PREREQ([2.68])
AC_CONFIG_SRCDIR([src/main.h])
write, easier to read, and overall better code.
* Use consistent spacing and linebreaks. Always indent 4 spaces from the
- breaking line. Try to keep lines less than 80 chars; it greatly helps
+ breaking line. Keep lines less than 100 chars; it greatly helps
readability.
No:
PegCount total_packets;
};
+extern const char* simple_pegs[];
+
#define array_size(a) (sizeof(a)/sizeof(a[0]))
#endif
InspectFunc pinit; // plugin thread local allocation
InspectFunc pterm; // plugin thread local cleanup
InspectSsnFunc ssn; // purge caches
- InspectFunc sum; // accumulate stats
- InspectFunc stats; // output stats
InspectFunc reset; // clear stats
};
#include "module.h"
#include "parameter.h"
+#include "utils/stats.h"
static const Parameter null_params[] =
{
list = false;
cmds = nullptr;
rules = nullptr;
+ num_counts = -1;
}
Module::Module(const char* s)
list = is_list;
}
+void Module::sum_stats()
+{
+ if ( num_counts < 0 )
+ reset_stats();
+
+ PegCount* p = get_counts();
+
+ if ( !p )
+ return;
+
+ for ( int i = 0; i < num_counts; i++ )
+ {
+ counts[i] += p[i];
+ p[i] = 0;
+ }
+}
+
+void Module::show_stats()
+{
+ if ( num_counts > 0 )
+ ::show_stats(get_counts(), get_pegs(), num_counts, get_name());
+}
+
+void Module::reset_stats()
+{
+ num_counts = 0;
+ const char** pegs = get_pegs();
+
+ if ( !pegs )
+ return;
+
+ while ( pegs[num_counts] )
+ ++num_counts;
+
+ counts.resize(num_counts);
+
+ for ( int i = 0; i < num_counts; i++ )
+ counts[i] = 0;
+}
+
+const char* simple_pegs[] =
+{
+ "packets",
+ nullptr
+};
+
#ifndef MODULE_H
#define MODULE_H
+#include <vector>
#include <lua.hpp>
#include "framework/value.h"
virtual const RuleMap* get_rules() const
{ return nullptr; };
- virtual const char* get_pegs() const
+ virtual const char** get_pegs() const
{ return nullptr; };
// counts and profile are thread local
- virtual const PegCount* get_counts() const
+ virtual PegCount* get_counts() const
{ return nullptr; };
virtual ProfileStats* get_profile() const
unsigned /*index*/, const char*& /*name*/, const char*& /*parent*/) const
{ return nullptr; };
+ virtual void sum_stats();
+ virtual void show_stats();
+ virtual void reset_stats();
+
protected:
Module(const char* s);
Module(const char* s, const Parameter* p, bool is_list = false);
const Parameter* params;
const Command* cmds;
const RuleMap* rules;
+ std::vector<PegCount> counts;
+ int num_counts;
};
#endif
void snort_thread_term()
{
+ ModuleManager::accumulate(snort_conf);
InspectorManager::thread_term(snort_conf);
IpsManager::clear_options();
EventManager::close_outputs();
return NULL;
}
-void InspectorManager::dump_stats (SnortConfig* sc)
-{
- for ( auto* p : sc->framework_config->clist )
- if ( p->api.stats )
- p->api.stats();
-}
-
-void InspectorManager::accumulate (SnortConfig* sc)
-{
- static mutex stats_mutex;
- stats_mutex.lock();
-
- for ( auto* p : sc->framework_config->clist )
- if ( p->api.sum )
- p->api.sum();
-
- pc_sum();
- stats_mutex.unlock();
-}
-
-void InspectorManager::reset_stats (SnortConfig* sc)
-{
- for ( auto* p : sc->framework_config->clist )
- if ( p->api.reset )
- p->api.reset();
-}
-
// this is per thread
void InspectorManager::thread_init(SnortConfig* sc)
{
for ( auto* p : sc->framework_config->clist )
if ( p->api.pterm )
p->api.pterm();
-
- accumulate(sc);
}
//-------------------------------------------------------------------------
static void new_config(SnortConfig*);
static void delete_config(SnortConfig*);
- static void dump_stats(SnortConfig*);
- static void accumulate(SnortConfig*);
- static void reset_stats(SnortConfig*);
-
static void instantiate(const InspectApi*, Module*, SnortConfig*);
static Inspector* get_inspector(const char* key);
static void free_inspector(Inspector*);
#include <iostream>
#include <list>
+#include <mutex>
#include <string>
#include <sstream>
#include <lua.hpp>
d.dump(p->mod->get_name());
}
+void ModuleManager::show_module(bool markup, const char* name)
+{
+ s_modules.sort(comp_gids);
+ s_markup = markup;
+
+ for ( auto p : s_modules )
+ {
+ const Module* m = p->mod;
+ assert(m);
+
+ if ( strcmp(m->get_name(), name) )
+ continue;
+
+ LogMessage("\nModule: %s\n", name);
+
+ if ( const Parameter* p = m->get_parameters() )
+ {
+ if ( p->type < Parameter::PT_MAX )
+ {
+ LogMessage("\nConfiguration:\n");
+ show_configs(markup, name);
+ }
+ }
+
+ if ( m->get_commands() )
+ {
+ LogMessage("\nCommands:\n");
+ show_commands(markup, name);
+ }
+
+ if ( m->get_rules() )
+ {
+ LogMessage("\nRules:\n");
+ show_rules(markup, name);
+ }
+
+ if ( m->get_pegs() )
+ {
+ LogMessage("\nPeg counts:\n");
+ show_pegs(markup, name);
+ }
+ }
+}
+
void ModuleManager::show_configs(bool markup, const char* pfx)
{
s_modules.sort(comp_mods);
}
}
+void ModuleManager::show_pegs(bool markup, const char* pfx)
+{
+ s_modules.sort(comp_gids);
+ s_markup = markup;
+ unsigned len = pfx ? strlen(pfx) : 0;
+
+ for ( auto p : s_modules )
+ {
+ const Module* m = p->mod;
+ assert(m);
+
+ if ( pfx && strncmp(m->get_name(), pfx, len) )
+ continue;
+
+ const char** pegs = m->get_pegs();
+
+ if ( !pegs )
+ continue;
+
+ while ( *pegs )
+ {
+ cout << item();
+ cout << emphasis_on();
+ cout << *pegs;
+ cout << emphasis_off();
+ cout << endl;
+ ++pegs;
+ }
+ }
+}
+
void ModuleManager::show_rules(bool markup, const char* pfx)
{
s_modules.sort(comp_gids);
pop_parse_location();
}
+void ModuleManager::dump_stats (SnortConfig*)
+{
+ for ( auto p : s_modules )
+ p->mod->show_stats();
+}
+
+void ModuleManager::accumulate (SnortConfig*)
+{
+ static mutex stats_mutex;
+ stats_mutex.lock();
+
+ for ( auto p : s_modules )
+ p->mod->sum_stats();
+
+ pc_sum();
+ stats_mutex.unlock();
+}
+
+void ModuleManager::reset_stats (SnortConfig*)
+{
+ for ( auto p : s_modules )
+ p->mod->reset_stats();
+}
+
static Module* get_module(const char*);
static void dump_modules();
+ static void show_module(bool markup, const char*);
static void show_configs(bool markup, const char* = nullptr);
static void show_commands(bool markup, const char* = nullptr);
static void show_gids(bool markup, const char* = nullptr);
+ static void show_pegs(bool markup, const char* = nullptr);
static void show_rules(bool markup, const char* = nullptr);
static void load_rules(SnortConfig*);
static void set_config(SnortConfig*);
static unsigned get_errors();
+
+ static void dump_stats(SnortConfig*);
+ static void accumulate(SnortConfig*);
+ static void reset_stats(SnortConfig*);
};
#endif
#define ARPSPOOF_ARP_CACHE_OVERWRITE_ATTACK_STR \
"(arp_spoof) Attempted ARP cache overwrite attack"
+THREAD_LOCAL SimpleStats asstats;
+
//-------------------------------------------------------------------------
// arp_spoof stuff
//-------------------------------------------------------------------------
return true;
}
+const char** ArpSpoofModule::get_pegs() const
+{ return simple_pegs; }
+
+PegCount* ArpSpoofModule::get_counts() const
+{ return (PegCount*)&asstats; }
+
+
#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_DST 3
#define ARPSPOOF_ARP_CACHE_OVERWRITE_ATTACK 4
+extern THREAD_LOCAL SimpleStats asstats;
extern THREAD_LOCAL ProfileStats arpPerfStats;
struct IPMacEntry
return temp;
};
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
+
unsigned get_gid() const
{ return GID_ARP_SPOOF; };
THREAD_LOCAL ProfileStats arpPerfStats;
-static THREAD_LOCAL SimpleStats asstats;
-static SimpleStats gasstats;
-
//-------------------------------------------------------------------------
// implementation stuff
//-------------------------------------------------------------------------
static void as_dtor(Inspector* p)
{ delete p; }
-static void as_sum()
-{ sum_stats(&gasstats, &asstats); }
-
-static void as_stats()
-{ show_stats(&gasstats, MOD_NAME); }
-
-static void as_reset()
-{ memset(&gasstats, 0, sizeof(gasstats)); }
-
static const InspectApi as_api =
{
{
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- as_sum,
- as_stats,
- as_reset
+ nullptr, // reset
};
#ifdef BUILDING_SO
#include "binder.h"
+THREAD_LOCAL SimpleStats bstats;
+
//-------------------------------------------------------------------------
// binder module
//-------------------------------------------------------------------------
return bindings; // move semantics
}
+const char** BinderModule::get_pegs() const
+{ return simple_pegs; }
+
+PegCount* BinderModule::get_counts() const
+{ return (PegCount*)&bstats; }
+
#include "framework/module.h"
#include "main/thread.h"
+extern THREAD_LOCAL SimpleStats bstats;
extern THREAD_LOCAL ProfileStats bindPerfStats;
struct Binding;
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
ProfileStats* get_profile() const;
std::vector<Binding*> get_data();
static const char* mod_name = "binder";
THREAD_LOCAL ProfileStats bindPerfStats;
-static THREAD_LOCAL SimpleStats tstats;
-static SimpleStats gstats;
//-------------------------------------------------------------------------
// helpers
{
Flow* flow = p->flow;
flow->flow_state = check_rules(flow, p);
- ++tstats.total_packets;
+ ++bstats.total_packets;
}
// FIXIT implement inspector lookup from policy / bindings
delete p;
}
-static void bind_sum()
-{
- sum_stats(&gstats, &tstats);
-}
-
-static void bind_stats()
-{
- show_stats(&gstats, mod_name);
-}
-
-static void bind_reset()
-{
- memset(&gstats, 0, sizeof(gstats));
-}
-
static const InspectApi bind_api =
{
{
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- bind_sum,
- bind_stats,
- bind_reset
+ nullptr // reset
};
const BaseApi* nin_binder = &bind_api.base;
#include "packet_io/sfdaq.h"
#include "protocols/ipv4.h"
#include "protocols/tcp.h"
+#include "stream/stream.h"
typedef enum {
PC_IP4_TRIM,
} PegCounts;
static const char* pegName[PC_MAX] = {
- "ip4::trim",
- "ip4::tos",
- "ip4::df",
- "ip4::rf",
- "ip4::ttl",
- "ip4::opts",
- "icmp4::echo",
- "ip6::ttl",
- "ip6::opts",
- "icmp6::echo",
- "tcp::syn_opt",
- "tcp::ts_ecr",
- "tcp::opt",
- "tcp::pad",
- "tcp::rsv",
- "tcp::ecn_pkt",
- "tcp::ns",
- "tcp::urg",
- "tcp::urp"
+ "ip4.trim",
+ "ip4.tos",
+ "ip4.df",
+ "ip4.rf",
+ "ip4.ttl",
+ "ip4.opts",
+ "icmp4.echo",
+ "ip6.ttl",
+ "ip6.opts",
+ "icmp6.echo",
+ "tcp.syn_opt",
+ "tcp.ts_ecr",
+ "tcp.opt",
+ "tcp.pad",
+ "tcp.rsv",
+ "tcp.ecn_pkt",
+ "tcp.ns",
+ "tcp.urg",
+ "tcp.urp"
};
static THREAD_LOCAL PegCount normStats[PC_MAX];
void Norm_SumStats (void)
{
sum_stats((PegCount*)&gnormStats, (PegCount*)&normStats, array_size(pegName));
+ Stream_SumNormalizationStats();
}
void Norm_PrintStats (const char* name)
{
show_stats((PegCount*)&gnormStats, pegName, array_size(pegName), name);
+ Stream_PrintNormalizationStats();
}
void Norm_ResetStats (void)
{
memset(gnormStats, 0, sizeof(gnormStats));
+ Stream_ResetNormalizationStats();
}
//-----------------------------------------------------------------------
/****************************************************************************
*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
* Copyright (C) 2005-2013 Sourcefire, Inc.
*
* This program is free software; you can redistribute it and/or modify
return true;
}
+void NormalizeModule::sum_stats()
+{ Norm_SumStats(); }
+
+void NormalizeModule::show_stats()
+{ Norm_PrintStats(get_name()); }
+
+void NormalizeModule::reset_stats()
+{ Norm_ResetStats(); }
+
const NormalizerConfig* get_config()
{ return &config; };
+ void sum_stats();
+ void show_stats();
+ void reset_stats();
+
private:
bool set_ip4(const char*, Value&, SnortConfig*);
bool set_tcp(const char*, Value&, SnortConfig*);
#include "profiler.h"
#include "snort_types.h"
#include "snort.h"
-#include "stream/stream.h"
#include "framework/inspector.h"
-THREAD_LOCAL ProfileStats norm_perf_stats;
-
#define PROTO_BITS (PROTO_BIT__IP|PROTO_BIT__ICMP|PROTO_BIT__TCP)
+static const char* name = "normalize";
+
+THREAD_LOCAL ProfileStats norm_perf_stats;
+
//-------------------------------------------------------------------------
// printing stuff
//-------------------------------------------------------------------------
static void mod_dtor(Module* m)
{ delete m; }
-static const char* name = "normalize";
-
-static void no_sum()
-{
- Norm_SumStats();
- Stream_SumNormalizationStats();
-}
-
-static void no_stats()
-{
- Norm_PrintStats(name);
- Stream_PrintNormalizationStats();
-}
-
-static void no_reset()
-{
- Norm_ResetStats();
- Stream_ResetNormalizationStats();
-}
-
static Inspector* no_ctor(Module* m)
{
return new Normalizer((NormalizeModule*)m);
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- no_sum,
- no_stats,
- no_reset
+ nullptr // reset
};
const BaseApi* nin_normalize = &no_api.base;
memset(&config, 0, sizeof(config));
}
+const char** PerfMonModule::get_pegs() const
+{ return simple_pegs; }
+
+PegCount* PerfMonModule::get_counts() const
+{ return (PegCount*)&pmstats; }
+
#include "perf.h"
#include "framework/module.h"
+extern THREAD_LOCAL SimpleStats pmstats;
extern THREAD_LOCAL ProfileStats perfmonStats;
class PerfMonModule : public Module
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
ProfileStats* get_profile() const;
void get_config(SFPERF&);
static const char* mod_name = "perf_monitor";
+THREAD_LOCAL SimpleStats pmstats;
THREAD_LOCAL ProfileStats perfmonStats;
-static THREAD_LOCAL SimpleStats pmstats;
-static SimpleStats gpmstats;
-
/* This function changes the perfmon log files permission if exists.
It is done in the PerfMonitorInit() before Snort changed its user & group.
*/
return new PerfMonitor((PerfMonModule*)m);
}
-static void pm_sum()
-{
- sum_stats(&gpmstats, &pmstats);
-}
-
-static void pm_stats()
-{
- show_stats(&gpmstats, mod_name);
-}
-
-static void pm_reset()
-{
- memset(&gpmstats, 0, sizeof(gpmstats));
-}
-
static void pm_dtor(Inspector* p)
{
delete p;
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- pm_sum,
- pm_stats,
- pm_reset
+ nullptr // reset
};
const BaseApi* nin_perf_monitor = &pm_api.base;
static THREAD_LOCAL Packet* g_tmp_pkt = NULL;
static THREAD_LOCAL FILE* g_logfile = NULL;
+THREAD_LOCAL SimpleStats spstats;
THREAD_LOCAL ProfileStats psPerfStats;
-static THREAD_LOCAL SimpleStats spstats;
-static SimpleStats gspstats;
-
/*
** NAME
** MakeProtoInfo::
delete p;
}
-static void sp_sum()
-{
- sum_stats(&gspstats, &spstats);
-}
-
-static void sp_stats()
-{
- show_stats(&gspstats, PS_MODULE);
-}
-
static void sp_reset()
{
ps_reset();
- memset(&gspstats, 0, sizeof(gspstats));
}
static const InspectApi sp_api =
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- sp_sum,
- sp_stats,
sp_reset
};
return tmp;
}
+const char** PortScanGlobalModule::get_pegs() const
+{ return simple_pegs; }
+
+PegCount* PortScanGlobalModule::get_counts() const
+{ return (PegCount*)&spstats; }
+
#define PS_MODULE "port_scan"
#define PS_GLOBAL "port_scan_global"
+extern THREAD_LOCAL SimpleStats spstats;
extern THREAD_LOCAL ProfileStats psPerfStats;
//-------------------------------------------------------------------------
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
ProfileStats* get_profile() const;
PsCommon* get_data();
ModuleManager::show_rules(s_markup, val);
break;
case HT_MOD:
- ModuleManager::show_configs(s_markup, val);
- ModuleManager::show_commands(s_markup, val);
- ModuleManager::show_rules(s_markup, val);
+ ModuleManager::show_module(s_markup, val);
break;
case HT_BUF:
InspectorManager::dump_buffers();
"<module prefix> output matching generators" },
{ "help-module", config_help_module,
- "output config, commands, and builtin rules for given module" },
+ "output description of given module" },
{ "help-options", config_help_options,
"<option prefix> (same as --help)" },
static uint16_t lookup2[65536];
static THREAD_LOCAL ProfileStats boPerfStats;
-
static THREAD_LOCAL SimpleStats bostats;
-static SimpleStats gbostats;
//-------------------------------------------------------------------------
// bo module
unsigned get_gid() const
{ return GID_BO; };
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
ProfileStats* get_profile() const;
};
+const char** BoModule::get_pegs() const
+{ return simple_pegs; }
+
+PegCount* BoModule::get_counts() const
+{ return (PegCount*)&bostats; }
+
ProfileStats* BoModule::get_profile() const
{ return &boPerfStats; }
delete p;
}
-static void bo_sum()
-{
- sum_stats(&gbostats, &bostats);
-}
-
-static void bo_stats()
-{
- show_stats(&gbostats, mod_name);
-}
-
-static void bo_reset()
-{
- memset(&gbostats, 0, sizeof(gbostats));
-}
-
static const InspectApi bo_api =
{
{
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- bo_sum,
- bo_stats,
- bo_reset
+ nullptr // reset
};
#ifdef BUILDING_SO
static const char* server_key = "ftp_server";
THREAD_LOCAL ProfileStats ftpPerfStats;
-
-static THREAD_LOCAL SimpleStats ftstats;
-static SimpleStats gftstats;
+THREAD_LOCAL SimpleStats ftstats;
static FTP_CLIENT_PROTO_CONF* bind_client = nullptr;
static FTP_SERVER_PROTO_CONF* bind_server = nullptr;
delete p;
}
-static void fs_sum()
-{
- sum_stats(&gftstats, &ftstats);
-}
-
-static void fs_stats()
-{
- show_stats(&gftstats, server_key);
-}
-
-static void fs_reset()
-{
- memset(&gftstats, 0, sizeof(gftstats));
-}
-
static const InspectApi fs_api =
{
{
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- fs_sum,
- fs_stats,
- fs_reset
+ nullptr // reset
};
#ifdef BUILDING_SO
static const char* data_key = "ftp_data";
static THREAD_LOCAL ProfileStats ftpdataPerfStats;
-
static THREAD_LOCAL SimpleStats fdstats;
-static SimpleStats gfdstats;
//-------------------------------------------------------------------------
// implementation stuff
public:
FtpDataModule() : Module(data_key, fd_params) { };
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
ProfileStats* get_profile() const;
bool set(const char*, Value&, SnortConfig*)
{ return false; };
};
+const char** FtpDataModule::get_pegs() const
+{ return simple_pegs; }
+
+PegCount* FtpDataModule::get_counts() const
+{ return (PegCount*)&fdstats; }
+
ProfileStats* FtpDataModule::get_profile() const
{ return &ftpdataPerfStats; }
// api stuff
//-------------------------------------------------------------------------
-static void mod_dtor(Module* m)
-{ delete m; }
-
static Module* mod_ctor()
{ return new FtpDataModule; }
+static void mod_dtor(Module* m)
+{ delete m; }
+
static void fd_init()
{
FtpDataFlowData::init();
delete p;
}
-static void fd_sum()
-{
- sum_stats(&gfdstats, &fdstats);
-}
-
-static void fd_stats()
-{
- show_stats(&gfdstats, data_key);
-}
-
-static void fd_reset()
-{
- memset(&gfdstats, 0, sizeof(gfdstats));
-}
-
// exported in ftp.cc
const InspectApi fd_api =
{
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- fd_sum,
- fd_stats,
- fd_reset
+ nullptr // reset
};
return true;
}
+const char** FtpServerModule::get_pegs() const
+{ return simple_pegs; }
+
+PegCount* FtpServerModule::get_counts() const
+{ return (PegCount*)&ftstats; }
+
struct SnortConfig;
+extern THREAD_LOCAL SimpleStats ftstats;
extern THREAD_LOCAL ProfileStats ftpPerfStats;
//-------------------------------------------------------------------------
{ return GID_FTP; };
const RuleMap* get_rules() const;
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
ProfileStats* get_profile() const;
FTP_SERVER_PROTO_CONF* get_data();
static const char* tn_name = "telnet";
THREAD_LOCAL ProfileStats telnetPerfStats;
-
-static THREAD_LOCAL SimpleStats tnstats;
-static SimpleStats gtnstats;
+THREAD_LOCAL SimpleStats tnstats;
//-------------------------------------------------------------------------
// implementation
delete p;
}
-static void tn_sum()
-{
- sum_stats(>nstats, &tnstats);
-}
-
-static void tn_stats()
-{
- show_stats(>nstats, tn_name);
-}
-
-static void tn_reset()
-{
- memset(>nstats, 0, sizeof(gtnstats));
-}
-
// exported in ftp.cc
const InspectApi tn_api =
{
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- tn_sum,
- tn_stats,
- tn_reset,
+ nullptr // reset
};
return true;
}
+const char** TelnetModule::get_pegs() const
+{ return simple_pegs; }
+
+PegCount* TelnetModule::get_counts() const
+{ return (PegCount*)&tnstats; }
+
struct SnortConfig;
+extern THREAD_LOCAL SimpleStats tnstats;
extern THREAD_LOCAL ProfileStats telnetPerfStats;
class TelnetModule : public Module
{ return GID_TELNET; };
const RuleMap* get_rules() const;
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
ProfileStats* get_profile() const;
TELNET_PROTO_CONF* get_data();
} HIStats;
extern THREAD_LOCAL HIStats hi_stats;
+extern const char* peg_names[];
#endif
ProfileStats* HttpInspectModule::get_profile() const
{ return &hiPerfStats; }
+const char** HttpInspectModule::get_pegs() const
+{ return peg_names; }
+
+PegCount* HttpInspectModule::get_counts() const
+{ return (PegCount*)&hi_stats; }
+
HTTPINSPECT_GLOBAL_CONF* HttpInspectModule::get_data()
{
HTTPINSPECT_GLOBAL_CONF* tmp = config;
{ return GID_HTTP_CLIENT; };
const RuleMap* get_rules() const;
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
ProfileStats* get_profile() const;
HTTPINSPECT_GLOBAL_CONF* get_data();
THREAD_LOCAL ProfileStats hiPerfStats;
THREAD_LOCAL ProfileStats hiDetectPerfStats;
-static HIStats ghi_stats;
-
-static const char* peg_names[] =
+const char* peg_names[] =
{
"packets",
"gets",
delete p;
}
-static void hs_sum()
-{
- sum_stats((PegCount*)&ghi_stats, (PegCount*)&hi_stats, array_size(peg_names));
-}
-
-static void hs_stats()
-{
- show_stats((PegCount*)&ghi_stats, peg_names, array_size(peg_names),
- SERVER_KEYWORD);
-}
-
-static void hs_reset()
-{
- memset(&ghi_stats, 0, sizeof(ghi_stats));
-}
-
//-------------------------------------------------------------------------
static const char* buffers[] =
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- hs_sum,
- hs_stats,
- hs_reset
+ nullptr // reset
};
#ifdef BUILDING_SO
NHttpApi::nhttp_dtor,
NHttpApi::nhttp_pinit,
NHttpApi::nhttp_pterm,
- nullptr,
- NHttpApi::nhttp_sum,
- NHttpApi::nhttp_stats,
- NHttpApi::nhttp_reset
+ nullptr, // ssn
+ nullptr // reset
};
#ifdef BUILDING_SO
static void nhttp_dtor(Inspector* p) { delete p; };
static void nhttp_pinit() {};
static void nhttp_pterm() {};
- static void nhttp_sum() {};
- static void nhttp_stats() {};
- static void nhttp_reset() {};
};
#endif
static const char* mod_name = "rpc_decode";
THREAD_LOCAL ProfileStats rpcdecodePerfStats;
-
-static THREAD_LOCAL SimpleStats rdstats;
-static SimpleStats grdstats;
+THREAD_LOCAL SimpleStats rdstats;
static int ConvertRPC(RpcDecodeConfig *, RpcSsnData *, Packet *);
delete p;
}
-static void rd_sum()
-{
- sum_stats(&grdstats, &rdstats);
-}
-
-static void rd_stats()
-{
- show_stats(&grdstats, mod_name);
-}
-
-static void rd_reset()
-{
- memset(&grdstats, 0, sizeof(grdstats));
-}
-
static const InspectApi rd_api =
{
{
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- rd_sum,
- rd_stats,
- rd_reset
+ nullptr // reset
};
#ifdef BUILDING_SO
const RuleMap* RpcModule::get_rules() const
{ return rpc_rules; }
+const char** RpcModule::get_pegs() const
+{ return simple_pegs; }
+
+PegCount* RpcModule::get_counts() const
+{ return (PegCount*)&rdstats; }
+
ProfileStats* RpcModule::get_profile() const
{ return &rpcdecodePerfStats; }
#define RPC_INCOMPLETE_SEGMENT 4
#define RPC_ZERO_LENGTH_FRAGMENT 5
+extern THREAD_LOCAL SimpleStats rdstats;
extern THREAD_LOCAL ProfileStats rpcdecodePerfStats;
class RpcModule : public Module
{ return GID_RPC_DECODE; };
const RuleMap* get_rules() const;
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
ProfileStats* get_profile() const;
};
return hex ? s2c_hexes : s2c_spells;
}
+const char** WizardModule::get_pegs() const
+{ return wiz_pegs; }
+
+PegCount* WizardModule::get_counts() const
+{ return (PegCount*)&tstats; }
+
#include "framework/module.h"
#include "main/thread.h"
+extern const char* wiz_pegs[];
+extern THREAD_LOCAL struct WizStats tstats;
extern THREAD_LOCAL ProfileStats wizPerfStats;
class MagicBook;
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
ProfileStats* get_profile() const;
MagicBook* get_book(bool c2s, bool hex);
PegCount udp_hits;
};
-static const char* wiz_pegs[] =
+const char* wiz_pegs[] =
{
"tcp scans",
"tcp hits",
"udp scans",
- "udp hits"
+ "udp hits",
+ nullptr
};
-static THREAD_LOCAL WizStats tstats;
-static WizStats gstats;
+THREAD_LOCAL WizStats tstats;
//-------------------------------------------------------------------------
// configuration
delete p;
}
-static void wiz_sum()
-{
- sum_stats((PegCount*)&gstats, (PegCount*)&tstats, array_size(wiz_pegs));
-}
-
-static void wiz_stats()
-{
- show_stats((PegCount*)&gstats, wiz_pegs, array_size(wiz_pegs), mod_name);
-}
-
-static void wiz_reset()
-{
- memset(&gstats, 0, sizeof(gstats));
-}
-
static const InspectApi wiz_api =
{
{
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- wiz_sum,
- wiz_stats,
- wiz_reset
+ nullptr // reset
};
#ifdef BUILDING_SO
#include "profiler.h"
//-------------------------------------------------------------------------
-// globals
+// stats
//-------------------------------------------------------------------------
THREAD_LOCAL ProfileStats s5PerfStats;
"created",
"released",
"discards",
- "events"
+ "events",
+ nullptr
};
const unsigned session_peg_count = array_size(session_pegs);
"ip flows"
};
+void base_sum()
+{
+ t_stats.tcp = flow_con->get_flow_count(IPPROTO_TCP);
+ t_stats.udp = flow_con->get_flow_count(IPPROTO_UDP);
+ t_stats.icmp = flow_con->get_flow_count(IPPROTO_ICMP);
+ t_stats.ip = flow_con->get_flow_count(IPPROTO_IP);
+
+ sum_stats((PegCount*)&g_stats, (PegCount*)&t_stats,
+ array_size(base_pegs));
+}
+
+void base_stats()
+{
+ show_stats((PegCount*)&g_stats, base_pegs, array_size(base_pegs),
+ MOD_NAME);
+}
+
+void base_reset()
+{
+ flow_con->clear_flow_counts();
+ memset(&t_stats, 0, sizeof(t_stats));
+}
+
//-------------------------------------------------------------------------
// runtime support
//-------------------------------------------------------------------------
delete p;
}
-void base_sum()
-{
- t_stats.tcp = flow_con->get_flow_count(IPPROTO_TCP);
- t_stats.udp = flow_con->get_flow_count(IPPROTO_UDP);
- t_stats.icmp = flow_con->get_flow_count(IPPROTO_ICMP);
- t_stats.ip = flow_con->get_flow_count(IPPROTO_IP);
-
- sum_stats((PegCount*)&g_stats, (PegCount*)&t_stats,
- array_size(base_pegs));
-}
-
-void base_stats()
-{
- show_stats((PegCount*)&g_stats, base_pegs, array_size(base_pegs),
- MOD_NAME);
-}
-
-void base_reset()
-{
- flow_con->clear_flow_counts();
- memset(&t_stats, 0, sizeof(t_stats));
-}
-
static const InspectApi base_api =
{
{
nullptr, // pinit
nullptr, // pterm
nullptr, // ssn
- base_sum,
- base_stats,
- base_reset
+ nullptr // reset
};
const BaseApi* nin_stream_base = &base_api.base;
return true;
}
+void StreamModule::sum_stats()
+{ base_sum(); }
+
+void StreamModule::show_stats()
+{ base_stats(); }
+
+void StreamModule::reset_stats()
+{ base_reset(); }
+
ProfileStats* get_profile() const;
const StreamConfig* get_data();
+ void sum_stats();
+ void show_stats();
+ void reset_stats();
+
private:
FlowConfig* proto;
};
+extern void base_sum();
+extern void base_stats();
+extern void base_reset();
+
#endif
return true;
}
+const char** StreamIcmpModule::get_pegs() const
+{ return session_pegs; }
+
+PegCount* StreamIcmpModule::get_counts() const
+{ return (PegCount*)&icmpStats; }
+
#include "snort_types.h"
#include "framework/module.h"
#include "main/thread.h"
+#include "stream/stream.h"
+extern THREAD_LOCAL SessionStats icmpStats;
extern THREAD_LOCAL ProfileStats icmp_perf_stats;
+
struct SnortConfig;
//-------------------------------------------------------------------------
bool end(const char*, int, SnortConfig*);
ProfileStats* get_profile() const;
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
StreamIcmpConfig* get_data();
private:
#include "protocols/layer.h"
#include "protocols/vlan.h"
-static SessionStats gicmpStats;
-static THREAD_LOCAL SessionStats icmpStats;
-
+THREAD_LOCAL SessionStats icmpStats;
THREAD_LOCAL ProfileStats icmp_perf_stats;
//------------------------------------------------------------------------
// api related methods
//-------------------------------------------------------------------------
-void icmp_sum()
-{
- sum_stats((PegCount*)&gicmpStats, (PegCount*)&icmpStats,
- session_peg_count);
-}
-
+#if 0
void icmp_stats()
{
+ // FIXIT move these to the actual owner
// FIXIT need to get these before delete flow_con
//flow_con->get_prunes(IPPROTO_UDP, icmpStats.prunes);
-
- show_stats((PegCount*)&gicmpStats, session_pegs, session_peg_count,
- MOD_NAME);
}
+#endif
void icmp_reset()
{
struct timeval ssn_time;
};
-void icmp_sum();
void icmp_stats();
void icmp_reset();
nullptr, // pinit
nullptr, // pterm
icmp_ssn,
- icmp_sum,
- icmp_stats,
icmp_reset
};
using namespace std;
#include "stream_ip.h"
+#include "ip_defrag.h"
#include "main/snort_config.h"
#include "stream/stream.h"
return true;
}
+const char** StreamIpModule::get_pegs() const
+{ return session_pegs; }
+
+PegCount* StreamIpModule::get_counts() const
+{ return (PegCount*)&ipStats; }
+
+void StreamIpModule::sum_stats()
+{ Defrag::sum(); }
+
+void StreamIpModule::show_stats()
+{ Defrag::stats(); }
+
+void StreamIpModule::reset_stats()
+{ Defrag::reset(); }
+
#include "snort_types.h"
#include "framework/module.h"
#include "main/thread.h"
+#include "stream/stream.h"
struct SnortConfig;
#define DEFRAG_EXCESSIVE_OVERLAP 12
#define DEFRAG_TINY_FRAGMENT 13
+extern THREAD_LOCAL SessionStats ipStats;
extern THREAD_LOCAL ProfileStats ip_perf_stats;
extern THREAD_LOCAL ProfileStats fragPerfStats;
extern THREAD_LOCAL ProfileStats fragInsertPerfStats;
const RuleMap* get_rules() const;
ProfileStats* get_profile(unsigned, const char*&, const char*&) const;
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
StreamIpConfig* get_data();
+ unsigned get_gid() const
+ { return GID_DEFRAG; };
+
+ void sum_stats();
+ void show_stats();
+ void reset_stats();
+
private:
StreamIpConfig* config;
};
#include "perf_monitor/perf.h"
#include "flow/flow_control.h"
-static SessionStats gipStats;
-static THREAD_LOCAL SessionStats ipStats;
-
+THREAD_LOCAL SessionStats ipStats;
THREAD_LOCAL ProfileStats ip_perf_stats;
//-------------------------------------------------------------------------
return 0;
}
-//-------------------------------------------------------------------------
-// api related methods
-//-------------------------------------------------------------------------
-
-void ip_sum()
-{
- sum_stats((PegCount*)&gipStats, (PegCount*)&ipStats, session_peg_count);
- Defrag::sum();
-}
-
-void ip_stats()
-{
- // FIXIT need to get these before delete flow_con
- //flow_con->get_prunes(IPPROTO_UDP, ipStats.prunes);
-
- show_stats((PegCount*)&gipStats, session_pegs, session_peg_count, MOD_NAME);
- Defrag::stats();
-}
-
-void ip_reset()
-{
- memset(&ipStats, 0, sizeof(ipStats));
- flow_con->reset_prunes(IPPROTO_IP);
- Defrag::reset();
-}
-
nullptr, // pinit
nullptr, // pterm
ip_ssn,
- ip_sum,
- ip_stats,
- ip_reset
+ nullptr // reset
};
const BaseApi* nin_stream_ip = &ip_api.base;
StreamIpConfig();
};
-void ip_sum();
-void ip_stats();
-void ip_reset();
-
StreamIpConfig* get_ip_cfg(Inspector*);
class Defrag* get_defrag(Inspector*);
tcp_pinit,
tcp_pterm,
tcp_ssn,
- tcp_sum,
- tcp_stats,
tcp_reset
};
return true;
}
+const char** StreamTcpModule::get_pegs() const
+{ return tcp_pegs; }
+
+PegCount* StreamTcpModule::get_counts() const
+{ return (PegCount*)&tcpStats; }
+
#include "snort_types.h"
#include "framework/module.h"
#include "main/thread.h"
+#include "stream/stream.h"
#define GID_STREAM_TCP 129
#define STREAM_TCP_WINDOW_SLAM 19
#define STREAM_TCP_NO_3WHS 20
+extern const char* tcp_pegs[];
+extern THREAD_LOCAL struct TcpStats tcpStats;
extern THREAD_LOCAL ProfileStats s5TcpPerfStats;
extern THREAD_LOCAL ProfileStats s5TcpNewSessPerfStats;
extern THREAD_LOCAL ProfileStats s5TcpStatePerfStats;
const ServiceReassembly* get_proto(unsigned);
ProfileStats* get_profile(unsigned, const char*&, const char*&) const;
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
private:
void add_protos(Value&, bool, bool);
struct TcpStats
{
+ PegCount sessions;
+ PegCount prunes;
+ PegCount timeouts;
+ PegCount created;
+ PegCount released;
+ PegCount discards;
+ PegCount events;
PegCount trackers_created;
PegCount trackers_released;
PegCount segs_created;
PegCount s5tcp2;
};
-static const char* tcp_pegs[] =
+const char* tcp_pegs[] =
{
+ "sessions",
+ "prunes",
+ "timeouts",
+ "created",
+ "released",
+ "discards",
+ "events",
"trackers created",
"trackers released",
"segs created",
"server cleanup flushes"
};
-static SessionStats gssnStats;
-static TcpStats gtcpStats;
-
-static THREAD_LOCAL SessionStats ssnStats;
-static THREAD_LOCAL TcpStats tcpStats;
-
+THREAD_LOCAL TcpStats tcpStats;
THREAD_LOCAL Memcap* tcp_memcap = nullptr;
/* M A C R O S **************************************************/
static inline void Discard ()
{
- ssnStats.discards++;
+ tcpStats.discards++;
}
static inline void EventSynOnEst()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_SYN_ON_EST);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventExcessiveOverlap()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_EXCESSIVE_TCP_OVERLAPS);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventBadTimestamp()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_BAD_TIMESTAMP);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventWindowTooLarge()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_WINDOW_TOO_LARGE);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventDataOnSyn()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_DATA_ON_SYN);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventDataOnClosed()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_DATA_ON_CLOSED);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventDataAfterReset()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_DATA_AFTER_RESET);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventBadSegment()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_BAD_SEGMENT);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventSessionHijackedClient()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_SESSION_HIJACKED_CLIENT);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventSessionHijackedServer()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_SESSION_HIJACKED_SERVER);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventDataWithoutFlags()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_DATA_WITHOUT_FLAGS);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventMaxSmallSegsExceeded()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_SMALL_SEGMENT);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void Event4whs()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_4WAY_HANDSHAKE);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventNoTimestamp()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_NO_TIMESTAMP);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventBadReset()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_BAD_RST);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventBadFin()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_BAD_FIN);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventBadAck()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_BAD_ACK);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventDataAfterRstRcvd()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_DATA_AFTER_RST_RCVD);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventInternal (uint32_t eventSid)
static inline void EventWindowSlam ()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_WINDOW_SLAM);
- ssnStats.events++;
+ tcpStats.events++;
}
static inline void EventNo3whs()
{
SnortEventqAdd(GID_STREAM_TCP, STREAM_TCP_NO_3WHS);
- ssnStats.events++;
+ tcpStats.events++;
}
/*
stream.set_splitter(flow, true, ins->get_splitter(true));
stream.set_splitter(flow, false, ins->get_splitter(false));
- ssnStats.sessions++;
+ tcpStats.sessions++;
return true;
}
/* Not reset, simply time'd out. Clean it up */
TcpSessionCleanup(flow, 1);
}
- ssnStats.timeouts++;
+ tcpStats.timeouts++;
}
status = ProcessTcp(flow, p, &tdb, config);
#endif
}
-void tcp_sum()
-{
- sum_stats((PegCount*)&gssnStats, (PegCount*)&ssnStats,
- session_peg_count);
-
- sum_stats((PegCount*)>cpStats, (PegCount*)&tcpStats,
- array_size(tcp_pegs));
-}
-
-void tcp_stats()
-{
- // FIXIT need to get these before delete flow_con
- //flow_con->get_prunes(IPPROTO_TCP, ssnStats.prunes);
-
- show_stats((PegCount*)&gssnStats, session_pegs, session_peg_count,
- MOD_NAME);
-
- show_stats((PegCount*)>cpStats, tcp_pegs, array_size(tcp_pegs));
-}
-
void tcp_reset()
{
- memset(&gssnStats, 0, sizeof(gssnStats));
- memset(>cpStats, 0, sizeof(gtcpStats));
-
flow_con->reset_prunes(IPPROTO_TCP);
}
nullptr, // pinit
nullptr, // pterm
udp_ssn,
- udp_sum,
- udp_stats,
udp_reset
};
return true;
}
+const char** StreamUdpModule::get_pegs() const
+{ return session_pegs; }
+
+PegCount* StreamUdpModule::get_counts() const
+{ return (PegCount*)&udpStats; }
+
#include "snort_types.h"
#include "framework/module.h"
#include "main/thread.h"
-
+#include "stream/stream.h"
+
struct SnortConfig;
+extern THREAD_LOCAL SessionStats udpStats;
extern THREAD_LOCAL ProfileStats udp_perf_stats;
//-------------------------------------------------------------------------
bool end(const char*, int, SnortConfig*);
ProfileStats* get_profile() const;
+ const char** get_pegs() const;
+ PegCount* get_counts() const;
StreamUdpConfig* get_data();
private:
#define udp_responder_ip flow->server_ip
#define udp_responder_port flow->server_port
-static SessionStats gudpStats;
-static THREAD_LOCAL SessionStats udpStats;
-
+THREAD_LOCAL SessionStats udpStats;
THREAD_LOCAL ProfileStats udp_perf_stats;
//-------------------------------------------------------------------------
// api related methods
//-------------------------------------------------------------------------
-void udp_sum()
-{
- sum_stats((PegCount*)&gudpStats, (PegCount*)&udpStats,
- session_peg_count);
-}
-
+#if 0
void udp_stats()
{
// FIXIT need to get these before delete flow_con
//flow_con->get_prunes(IPPROTO_UDP, udpStats.prunes);
-
- show_stats((PegCount*)&gudpStats, session_pegs, session_peg_count,
- MOD_NAME);
}
+#endif
void udp_reset()
{
- memset(&udpStats, 0, sizeof(udpStats));
flow_con->reset_prunes(IPPROTO_UDP);
}
struct timeval ssn_time;
};
-void udp_sum();
void udp_stats();
void udp_reset();
#include "packet_io/active.h"
#include "packet_io/trough.h"
#include "target_based/sftarget_reader.h"
-#include "managers/inspector_manager.h"
+#include "managers/module_manager.h"
#include "managers/packet_manager.h"
#define STATS_SEPARATOR \
PacketManager::dump_stats();
//mpse_print_qinfo();
- InspectorManager::dump_stats(snort_conf);
+ ModuleManager::dump_stats(snort_conf);
// ensure proper counting of log_limit
SnortEventqResetCounts();