From: Russ Combs (rucombs) Date: Thu, 25 Feb 2016 22:46:19 +0000 (-0500) Subject: Merge pull request #298 in SNORT/snort3 from ~JOCORNET/snort3:latency to master X-Git-Tag: 3.0.0-233~578 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4ad46b8e0bb6a7fb9ef07f7b4e773d28fd35787a;p=thirdparty%2Fsnort3.git Merge pull request #298 in SNORT/snort3 from ~JOCORNET/snort3:latency to master Squashed commit of the following: commit e4efed21cf86f460ae8cf00791fb8186e1fbb878 Author: Joel Cornett Date: Thu Feb 25 16:23:36 2016 -0500 removed ppm from build --- diff --git a/configure.ac b/configure.ac index 35fa503fd..0f4fea844 100644 --- a/configure.ac +++ b/configure.ac @@ -1069,7 +1069,6 @@ src/host_tracker/Makefile \ src/host_tracker/test/Makefile \ src/catch/Makefile \ src/time/Makefile \ -src/ppm/Makefile \ src/profiler/Makefile \ src/utils/Makefile \ src/utils/test/Makefile \ diff --git a/lua/snort.lua b/lua/snort.lua index f5ecac5a9..da5fde528 100644 --- a/lua/snort.lua +++ b/lua/snort.lua @@ -52,7 +52,7 @@ dofile(conf_dir .. '/file_magic.lua') -- uncomment normalizer if you are inline or not --pedantic --normalizer = { } ---ppm = { } +--latency = { } --profiler = { } --perf_monitor = { } diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 28c70ae8f..8d71caa28 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -126,7 +126,6 @@ target_link_libraries( snort detection framework time - ppm latency profiler ips_actions @@ -164,7 +163,6 @@ add_subdirectory(mime) add_subdirectory(packet_io) add_subdirectory(parser) add_subdirectory(ports) -add_subdirectory(ppm) add_subdirectory(protocols) add_subdirectory(sfip) add_subdirectory(sfrt) diff --git a/src/Makefile.am b/src/Makefile.am index 1ce2fef91..83e7e68aa 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -90,7 +90,6 @@ filters/libfilter.a \ detection/libdetection.a \ framework/libframework.a \ time/libtime.a \ -ppm/libppm.a \ latency/liblatency.a \ profiler/libprofiler.a \ actions/libips_actions.a \ @@ -134,7 +133,6 @@ network_inspectors \ packet_io \ parser \ ports \ -ppm \ protocols \ search_engines \ service_inspectors \ diff --git a/src/detection/detect.cc b/src/detection/detect.cc index 1a17bfb11..144d724a4 100644 --- a/src/detection/detect.cc +++ b/src/detection/detect.cc @@ -55,7 +55,6 @@ #include "latency/packet_latency.h" #include "log/obfuscation.h" #include "profiler/profiler.h" -#include "ppm/ppm.h" #include "stream/stream_api.h" #include "packet_io/active.h" #include "managers/inspector_manager.h" diff --git a/src/detection/detection_options.cc b/src/detection/detection_options.cc index 8c7345a9e..b0e508e1b 100644 --- a/src/detection/detection_options.cc +++ b/src/detection/detection_options.cc @@ -40,7 +40,6 @@ #include "pattern_match_data.h" #include "rules.h" -#include "ppm/ppm.h" #include "profiler/profiler.h" #include "utils/util.h" #include "hash/sfxhash.h" diff --git a/src/detection/detection_options.h b/src/detection/detection_options.h index 75131175c..438099f63 100644 --- a/src/detection/detection_options.h +++ b/src/detection/detection_options.h @@ -28,7 +28,7 @@ // detection options only once per pattern match. // // These trees are instantiated at parse time, one per MPSE match state. -// Eval, profiling, and ppm data are attached in an array sized per max +// Eval, profiling, and latency data are attached in an array sized per max // packet threads. #ifdef HAVE_CONFIG_H diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc index ed30ab69a..f91e668a4 100644 --- a/src/detection/fp_detect.cc +++ b/src/detection/fp_detect.cc @@ -70,7 +70,6 @@ #include "stream/stream_api.h" #include "utils/sflsq.h" #include "utils/util.h" -#include "ppm/ppm.h" #include "profiler/profiler.h" #include "actions/actions.h" #include "sfip/sf_ip.h" @@ -920,10 +919,6 @@ static int rule_tree_queue( return 0; } -#define CHECK_PPM() \ - if ( PacketLatency::fastpath() ) \ - return 1; - #define SEARCH_DATA(buf, len, cnt) \ { \ assert(so->get_pattern_count() > 0); \ @@ -933,7 +928,8 @@ static int rule_tree_queue( stash.init(); \ so->search(buf, len, rule_tree_queue, omd, &start_state); \ stash.process(rule_tree_match, omd); \ - CHECK_PPM() \ + if ( PacketLatency::fastpath() ) \ + return 1; \ } #define SEARCH_BUFFER(ibt, pmt, cnt) \ @@ -943,10 +939,6 @@ static int rule_tree_queue( SEARCH_DATA(buf.data, buf.len, cnt) \ } -#define SEARCH_PACKET(buf, len, cnt) \ - if ( len ) \ - SEARCH_DATA(buf, len, cnt) - static int fp_search( PortGroup* port_group, Packet* p, int check_ports, int type, OTNX_MATCH_DATA* omd) @@ -970,7 +962,8 @@ static int fp_search( if ( IsLimitedDetect(p) && (p->alt_dsize < p->dsize) ) pattern_match_size = p->alt_dsize; - SEARCH_PACKET(p->data, pattern_match_size, pc.pkt_searches); + if ( pattern_match_size ) + SEARCH_DATA(p->data, pattern_match_size, pc.pkt_searches); if ( pattern_match_size ) p->is_cooked() ? pc.cooked_searches++ : pc.raw_searches++; @@ -997,7 +990,8 @@ static int fp_search( { // FIXIT-M file data should be obtained from // inspector gadget as is done with SEARCH_BUFFER - SEARCH_PACKET(g_file_data.data, g_file_data.len, pc.file_searches); + if ( g_file_data.len ) + SEARCH_DATA(g_file_data.data, g_file_data.len, pc.file_searches); } } return 0; diff --git a/src/main/modules.cc b/src/main/modules.cc index a76959e37..ab6fd6902 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -51,7 +51,6 @@ using namespace std; #include "filters/sfrf.h" #include "filters/rate_filter.h" #include "codecs/codec_module.h" -#include "ppm/ppm_module.h" #include "latency/latency_module.h" #include "profiler/profiler.h" #include "target_based/sftarget_data.h" @@ -2198,7 +2197,6 @@ void module_init() ModuleManager::add_module(new ActiveModule); ModuleManager::add_module(new FileIdModule); - ModuleManager::add_module(new PpmModule); ModuleManager::add_module(new LatencyModule); // these modules should be in ips policy diff --git a/src/main/snort.cc b/src/main/snort.cc index 9ad2eab71..4f597e370 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -81,7 +81,6 @@ using namespace std; #include "filters/rate_filter.h" #include "filters/detection_filter.h" #include "time/packet_time.h" -#include "ppm/ppm.h" #include "profiler/profiler.h" #include "time/periodic.h" #include "ips_options/ips_flowbits.h" @@ -648,8 +647,6 @@ void Snort::thread_init(const char* intf) void Snort::thread_term() { - ppm_sum_stats(); - if ( !snort_conf->dirty_pig ) InspectorManager::thread_stop(snort_conf); diff --git a/src/main/snort_config.cc b/src/main/snort_config.cc index 3d1f7d178..2d0c4fdb2 100644 --- a/src/main/snort_config.cc +++ b/src/main/snort_config.cc @@ -54,7 +54,6 @@ #include "detection/fp_create.h" #include "ips_options/ips_pcre.h" #include "protocols/udp.h" -#include "ppm/ppm.h" #include "latency/latency_config.h" #include "profiler/profiler.h" #include "sfip/sf_ip.h" @@ -178,7 +177,6 @@ SnortConfig::SnortConfig() profiler = new ProfilerConfig; - ppm_cfg = (ppm_cfg_t*)SnortAlloc(sizeof(*ppm_cfg)); latency = new LatencyConfig(); memory = new MemoryConfig(); @@ -260,7 +258,6 @@ SnortConfig::~SnortConfig() delete profiler; - free(ppm_cfg); delete latency; delete memory; @@ -519,14 +516,6 @@ bool SnortConfig::verify() return false; } - /* XXX XXX Not really sure we need to disallow this */ - if (snort_conf->ppm_cfg->rule_log != ppm_cfg->rule_log) - { - ErrorMessage("Snort Reload: Changing the ppm rule_log " - "configuration requires a restart.\n"); - return false; - } - if (snort_conf->group_id != group_id) { ErrorMessage("Snort Reload: Changing the group id " diff --git a/src/main/snort_config.h b/src/main/snort_config.h index 0bbf43bf0..1e688673a 100644 --- a/src/main/snort_config.h +++ b/src/main/snort_config.h @@ -324,11 +324,8 @@ public: struct VarNode* var_list = nullptr; //------------------------------------------------------ - // deliberately not conditional - // to avoid plugin compatibility issues ProfilerConfig* profiler = nullptr; - struct ppm_cfg_t* ppm_cfg = nullptr; LatencyConfig* latency = nullptr; struct _IntelPmHandles* ipm_handles = nullptr; diff --git a/src/main/snort_debug.h b/src/main/snort_debug.h index ba1f7f9e0..1f3b974e1 100644 --- a/src/main/snort_debug.h +++ b/src/main/snort_debug.h @@ -50,7 +50,8 @@ #define DEBUG_LOG 0x0000000000000200LL #define DEBUG_FLOWBITS 0x0000000000000400LL #define DEBUG_FILE 0x0000000000000800LL -#define DEBUG_PPM 0x0000000000001000LL +// FIXIT-L J latency doesn't use any debug messages +#define DEBUG_LATENCY 0x0000000000001000LL // this env var uses the upper 32 bits of the flags: #define DEBUG_PLUGIN "SNORT_PP_DEBUG" diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc index c2607562e..7e88a120a 100644 --- a/src/managers/inspector_manager.cc +++ b/src/managers/inspector_manager.cc @@ -33,7 +33,6 @@ #include "log/obfuscation.h" #include "log/messages.h" #include "packet_io/active.h" -#include "ppm/ppm.h" #include "target_based/snort_protocols.h" #include "binder/bind_module.h" diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc index cae4bfade..739125ea7 100644 --- a/src/parser/parse_rule.cc +++ b/src/parser/parse_rule.cc @@ -66,7 +66,6 @@ #include "utils/sflsq.h" #include "utils/util.h" #include "utils/snort_bounds.h" -#include "ppm/ppm.h" #include "filters/rate_filter.h" #include "filters/detection_filter.h" #include "packet_io/active.h" diff --git a/src/parser/parser.cc b/src/parser/parser.cc index b2a6af302..df33f2c70 100644 --- a/src/parser/parser.cc +++ b/src/parser/parser.cc @@ -74,7 +74,6 @@ #include "sfip/sf_vartable.h" #include "sfip/sf_ip.h" #include "sfip/sf_ipvar.h" -#include "ppm/ppm.h" #include "packet_io/active.h" #include "file_api/file_config.h" #include "actions/actions.h" diff --git a/src/parser/vars.cc b/src/parser/vars.cc index b710ae581..16dc26ef7 100644 --- a/src/parser/vars.cc +++ b/src/parser/vars.cc @@ -63,7 +63,6 @@ #include "sfip/sf_vartable.h" #include "sfip/sf_ip.h" #include "sfip/sf_ipvar.h" -#include "ppm/ppm.h" #include "packet_io/active.h" #include "file_api/file_config.h" #include "framework/ips_option.h" diff --git a/src/ppm/CMakeLists.txt b/src/ppm/CMakeLists.txt deleted file mode 100644 index 19b6e02a0..000000000 --- a/src/ppm/CMakeLists.txt +++ /dev/null @@ -1,11 +0,0 @@ -set ( PPM_SOURCES ppm.cc ppm_module.cc ) -set ( PPM_INCLUDES ppm.h ) - -add_library ( ppm STATIC - ${PPM_SOURCES} - ${PPM_INCLUDES} -) - -install (FILES ${PPM_INCLUDES} - DESTINATION "${INCLUDE_INSTALL_PATH}/ppm" -) diff --git a/src/ppm/Makefile.am b/src/ppm/Makefile.am deleted file mode 100644 index 53faefb68..000000000 --- a/src/ppm/Makefile.am +++ /dev/null @@ -1,11 +0,0 @@ -noinst_LIBRARIES = libppm.a - -x_includedir = $(pkgincludedir)/ppm - -x_include_HEADERS = ppm.h - -libppm_a_SOURCES = \ -ppm.cc \ -ppm.h \ -ppm_module.cc \ -ppm_module.h diff --git a/src/ppm/dev_notes.txt b/src/ppm/dev_notes.txt deleted file mode 100644 index fc3c40aba..000000000 --- a/src/ppm/dev_notes.txt +++ /dev/null @@ -1,5 +0,0 @@ -Packet Performance monitoring provides facilities for gathering -statistics about the packet processing system as a whole. These -statistics include timing information for rule evaluation, packet -decoding and event processing, as well as counts for actions taken on -packets before and during rule evaluation. diff --git a/src/ppm/ppm.cc b/src/ppm/ppm.cc deleted file mode 100644 index a375a34aa..000000000 --- a/src/ppm/ppm.cc +++ /dev/null @@ -1,513 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2006-2013 Sourcefire, Inc. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -/* -** -** ppm.c -** -** Packet Performance Monitor -** -** Author: Marc Norton -** Date: 10/2006 -** -** Usage: -* -* config ppm: max-pkt-time usecs -* config ppm: max-rule-time usecs -* config ppm: max-suspend-time secs -* config ppm: threshold count -* config ppm: suspend-expensive-rules -* config ppm: fastpath-expensive-packets -* config ppm: pkt-events syslog|console -* config ppm: rule-events alert|syslog|console -* -*/ - -#include "ppm.h" - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "detection/fp_create.h" -#include "detection/treenodes.h" -#include "events/event_queue.h" -#include "log/messages.h" -#include "sfip/sf_ip.h" -#include "utils/stats.h" -#include "utils/util.h" - -#include "ppm_module.h" - -#define PPM_BASE_SUSPEND_RULE_GID 1000 -#define PPM_BASE_CLEAR_RULE_GID 2000 - -#define PPM_DEFAULT_MAX_PKT_TICKS 0 -#define PPM_DEFAULT_MAX_RULE_TICKS 0 -#define PPM_DEFAULT_MAX_SUSP_SECS 60 -#define PPM_DEFAULT_RULE_THRESHOLD 5 - -PPM_TICKS ppm_tpu = 1; /* ticks per usec */ - -static ppm_stats_t g_ppm_stats; - -THREAD_LOCAL ppm_stats_t ppm_stats; -THREAD_LOCAL ppm_pkt_timer_t ppm_pkt_times[PPM_MAX_TIMERS]; -THREAD_LOCAL ppm_pkt_timer_t* ppm_pt = NULL; -THREAD_LOCAL unsigned int ppm_pkt_index = 0; -THREAD_LOCAL ppm_rule_timer_t ppm_rule_times[PPM_MAX_TIMERS]; -THREAD_LOCAL ppm_rule_timer_t* ppm_rt = NULL; -THREAD_LOCAL unsigned int ppm_rule_times_index = 0; -THREAD_LOCAL uint64_t ppm_cur_time = 0; - -/* temporary flags */ -THREAD_LOCAL int ppm_abort_this_pkt = 0; -THREAD_LOCAL int ppm_suspend_this_rule = 0; - -#define MAX_DP_NRULES 1000 -typedef struct -{ - uint64_t pkt; - detection_option_tree_root_t* tree; - PPM_TICKS ticks; -} ppm_rules_t; - -/* suspended rules */ -// FIXIT-L storing rule tree pointers is a bad idea -// - no accommodation for reload -// - really not used except to log -// - should be deleted -static THREAD_LOCAL ppm_rules_t ppm_rules[MAX_DP_NRULES]; -static THREAD_LOCAL int ppm_n_rules; - -/* cleared rules - re-enabled */ -// FIXIT-L see above re storing rule tree pointers -static THREAD_LOCAL detection_option_tree_root_t* ppm_crules[MAX_DP_NRULES]; -static THREAD_LOCAL int ppm_n_crules; - -void ppm_init_rules(void) -{ - ppm_n_rules = 0; - ppm_n_crules = 0; -} - -void ppm_set_rule(detection_option_tree_root_t* root,PPM_TICKS ticks) -{ - if ( ppm_n_rules < MAX_DP_NRULES ) - { - ppm_rules[ppm_n_rules].tree=root; - ppm_rules[ppm_n_rules].ticks=ticks; - ppm_n_rules++; - } -} - -void ppm_clear_rule(detection_option_tree_root_t* root) -{ - if ( ppm_n_crules < MAX_DP_NRULES ) - { - ppm_crules[ppm_n_crules++]=root; - } -} - -/* - * calc ticks per micro-secs in integer units - * use usecs instead of ticks for rule suspension during pcap playback - */ -static PPM_TICKS ppm_calc_ticks(void) -{ -#ifndef REG_TEST - ppm_tpu = (PPM_TICKS)get_ticks_per_usec(); - - if ( ppm_tpu == 0 ) -#endif - ppm_tpu = 1; - - return ppm_tpu; -} - -void ppm_print_cfg(ppm_cfg_t* ppm_cfg) -{ - if (ppm_cfg == NULL) - return; - - if (!ppm_cfg->enabled) - return; - - if ( ppm_cfg->max_pkt_ticks ) - { - LogMessage("\n"); - LogMessage("Packet Performance Monitor Config:\n"); - LogMessage(" ticks per usec : %lu ticks\n",(unsigned long)ppm_tpu); - - LogMessage(" max packet time : %lu usecs\n", - (unsigned long)(ppm_cfg->max_pkt_ticks/ppm_tpu)); - - LogMessage(" packet action : "); - - if ( ppm_cfg->pkt_action ) - LogMessage("fastpath-expensive-packets\n"); - else - LogMessage("none\n"); - - LogMessage(" packet logging : "); - - if (ppm_cfg->pkt_log&PPM_LOG_ALERT) - LogMessage("alert "); - - if (ppm_cfg->pkt_log&PPM_LOG_MESSAGE) - LogMessage("log "); - - if (!ppm_cfg->pkt_log) - LogMessage("none "); - - LogMessage("\n"); - } - - if ( ppm_cfg->max_rule_ticks) - { - LogMessage("\n"); - LogMessage("Rule Performance Monitor Config:\n"); - LogMessage(" ticks per usec : %lu ticks\n",(unsigned long)ppm_tpu); - - LogMessage(" max rule time : %lu usecs\n", - (unsigned long)(ppm_cfg->max_rule_ticks/ ppm_tpu)); - - LogMessage(" rule action : "); - - if ( ppm_cfg->rule_action ) - { - LogMessage("suspend-expensive-rules\n"); - LogMessage(" rule threshold : %u \n",(unsigned int)ppm_cfg->rule_threshold); - } - else - LogMessage("none\n"); - - LogMessage(" suspend timeout : %lu secs\n", (unsigned long)(ppm_cfg->max_suspend_ticks/ - ((uint64_t)ppm_tpu*1000000)) ); - - LogMessage(" rule logging : "); - - if (ppm_cfg->rule_log&PPM_LOG_ALERT) - LogMessage("alert "); - - if (ppm_cfg->rule_log&PPM_LOG_MESSAGE) - LogMessage("log "); - - if (!ppm_cfg->rule_log) - LogMessage("none "); - - LogMessage("\n"); - } -} - -static int print_rule(int, RuleTreeNode*, OptTreeNode* o) -{ - if ( !o->enabled ) - { - //if( o->sigInfo.generator==1 || o->sigInfo.generator==3 ) - LogMessage(" disabled gid=%u, sid=%u\n",o->sigInfo.generator,o->sigInfo.id); - } - - return 0; -} - -// FIXIT-L ppm_stats should be rolled into ppm module -// (not just peg counts; need module support) - -void ppm_sum_stats() -{ - g_ppm_stats.pkt_event_cnt += ppm_stats.pkt_event_cnt; - g_ppm_stats.rule_event_cnt += ppm_stats.rule_event_cnt; - g_ppm_stats.tot_pkt_time += ppm_stats.tot_pkt_time; - g_ppm_stats.tot_pkts += ppm_stats.tot_pkts; - g_ppm_stats.tot_rule_time += ppm_stats.tot_rule_time; - g_ppm_stats.tot_rules += ppm_stats.tot_pkts; - g_ppm_stats.tot_nc_rule_time += ppm_stats.tot_nc_rule_time; - g_ppm_stats.tot_nc_rules += ppm_stats.tot_nc_rules; - g_ppm_stats.tot_pcre_rule_time += ppm_stats.tot_pcre_rule_time; - g_ppm_stats.tot_pcre_rules += ppm_stats.tot_pcre_rules; -} - -void ppm_print_summary(ppm_cfg_t* ppm_cfg) -{ - if (ppm_cfg == NULL) - return; - - if (!ppm_cfg->enabled) - return; - - if (ppm_cfg->max_pkt_ticks) - { - LogLabel("packet performance"); - - LogStat("max packet time (usecs)", - ppm_ticks_to_usecs(ppm_cfg->max_pkt_ticks)); - - LogCount("packet events", - (unsigned int)g_ppm_stats.pkt_event_cnt); - - if ( g_ppm_stats.tot_pkts ) - LogStat("avg pkt time (usecs)", - ppm_ticks_to_usecs((PPM_TICKS)(g_ppm_stats.tot_pkt_time/ - g_ppm_stats.tot_pkts))); - } - - if (ppm_cfg->max_rule_ticks) - { - LogLabel("rule performance"); - - LogCount("max rule time (usecs)", - (unsigned long)(ppm_cfg->max_rule_ticks/ppm_tpu)); - - LogCount("rule events", - (unsigned int)g_ppm_stats.rule_event_cnt); - - if ( g_ppm_stats.tot_rules ) - LogStat("avg rule time (usecs)", - ppm_ticks_to_usecs((PPM_TICKS)(g_ppm_stats.tot_rule_time/ - g_ppm_stats.tot_rules))); - - if ( g_ppm_stats.tot_nc_rules ) - LogStat("avg nc-rule time (usecs)", - ppm_ticks_to_usecs((PPM_TICKS)(g_ppm_stats.tot_nc_rule_time/ - g_ppm_stats.tot_nc_rules))); - - if ( g_ppm_stats.tot_pcre_rules ) - LogStat("avg nc-pcre-rule time (usecs)", - ppm_ticks_to_usecs((PPM_TICKS)(g_ppm_stats.tot_pcre_rule_time/ - g_ppm_stats.tot_pcre_rules))); - - fpWalkOtns(0, print_rule); - } -} - -double ppm_ticks_to_usecs(PPM_TICKS ticks) -{ - return (double)ticks / ppm_tpu; -} - -/* - * Initialization - */ -void ppm_init(ppm_cfg_t* ppm_cfg) -{ - /* calc ticks per usec */ - ppm_calc_ticks(); - - ppm_cfg->enabled = 1; - - ppm_cfg->max_pkt_ticks = PPM_DEFAULT_MAX_PKT_TICKS; - ppm_cfg->max_rule_ticks = PPM_DEFAULT_MAX_RULE_TICKS; - - ppm_cfg->max_suspend_ticks = (uint64_t)PPM_DEFAULT_MAX_SUSP_SECS * 1000000 * ppm_tpu; - ppm_cfg->rule_threshold = PPM_DEFAULT_RULE_THRESHOLD; -} - -/* - * Logging functions - syslog and/or events - */ -#define PPM_FMT_FASTPATH \ - "PPM: Pkt-Event Pkt[" STDi64 \ - "] used=%g usecs, %u rules, %u nc-rules tested, packet fastpathed (%s:%d -> %s:%d).\n" -#define PPM_FMT_PACKET \ - "PPM: Pkt-Event Pkt[" STDi64 \ - "] used=%g usecs, %u rules, %u nc-rules tested (%s:%d -> %s:%d).\n" - -void ppm_pkt_log(ppm_cfg_t* ppm_cfg, Packet* p) -{ - if (!ppm_cfg->max_pkt_ticks) - return; - - ppm_stats.pkt_event_cnt++; - - if (ppm_cfg->pkt_log & PPM_LOG_ALERT) - SnortEventqAdd(GID_PPM, PPM_EVENT_PACKET_ABORTED); - - if (ppm_cfg->pkt_log & PPM_LOG_MESSAGE) - { - char src[INET6_ADDRSTRLEN]; - char dst[INET6_ADDRSTRLEN]; - - const sfip_t* addr = p->ptrs.ip_api.get_src(); - sfip_ntop(addr, src, sizeof(src)); - - addr = p->ptrs.ip_api.get_dst(); - sfip_ntop(addr, dst, sizeof(dst)); - - if (ppm_abort_this_pkt) - { - LogMessage(PPM_FMT_FASTPATH, - ppm_pt->pktcnt, - ppm_ticks_to_usecs((PPM_TICKS)ppm_pt->tot), - ppm_pt->rule_tests, ppm_pt->nc_rule_tests, - src, p->ptrs.sp, dst, p->ptrs.dp); - } - else - { - LogMessage(PPM_FMT_PACKET, - ppm_pt->pktcnt, - ppm_ticks_to_usecs((PPM_TICKS)ppm_pt->tot), - ppm_pt->rule_tests, ppm_pt->nc_rule_tests, - src, p->ptrs.sp, dst, p->ptrs.dp); - } - } -} - -#define PPM_FMT_SUS_PKT "PPM: Rule-Event Pkt[" STDi64 "] suspended (%s:%d -> %s:%d).\n" -#define PPM_FMT_SUSPENDED \ - "PPM: Rule-Event Pkt[" STDi64 \ - "] address=0x%p used=%g usecs suspended %s\n" -#define PPM_FMT_REENABLED "PPM: Rule-Event Pkt[" STDi64 "] address=0x%p re-enabled %s\n" - -void ppm_rule_log(ppm_cfg_t* ppm_cfg, uint64_t pktcnt, Packet* p) -{ - detection_option_tree_root_t* proot; - char timestamp[TIMEBUF_SIZE]; - *timestamp = '\0'; - - if (!ppm_cfg->max_rule_ticks) - return; - - if (ppm_n_crules) - { - if (ppm_cfg->rule_log & PPM_LOG_ALERT) - SnortEventqAdd(GID_PPM, PPM_EVENT_RULE_TREE_ENABLED); - - if (ppm_cfg->rule_log & PPM_LOG_MESSAGE) - { - int i; - - if (!*timestamp) - ts_print((struct timeval*)&p->pkth->ts, timestamp); - - for (i=0; i< ppm_n_crules; i++) - { - proot = ppm_crules[i]; - - LogMessage(PPM_FMT_REENABLED, - pktcnt, (void*)proot, timestamp); - } - } - - ppm_n_crules = 0; - } - - if (ppm_n_rules) - { - if (ppm_cfg->rule_log & PPM_LOG_ALERT) - SnortEventqAdd(GID_PPM, PPM_EVENT_RULE_TREE_DISABLED); - - if (ppm_cfg->rule_log & PPM_LOG_MESSAGE) - { - int i; - char src[INET6_ADDRSTRLEN]; - char dst[INET6_ADDRSTRLEN]; - - const sfip_t* addr = p->ptrs.ip_api.get_src(); - sfip_ntop(addr, src, sizeof(src)); - - addr = p->ptrs.ip_api.get_dst(); - sfip_ntop(addr, dst, sizeof(dst)); - - LogMessage(PPM_FMT_SUS_PKT, pktcnt, src, p->ptrs.sp, dst, p->ptrs.dp); - - if (!*timestamp) - ts_print((struct timeval*)&p->pkth->ts, timestamp); - - for (i=0; i< ppm_n_rules; i++) - { - proot = ppm_rules[i].tree; - - LogMessage(PPM_FMT_SUSPENDED, - pktcnt, (void*)proot, - ppm_ticks_to_usecs((PPM_TICKS)ppm_rules[i].ticks), - timestamp); - } - } - - ppm_n_rules = 0; - } -} - -void ppm_set_rule_event(ppm_cfg_t* ppm_cfg, detection_option_tree_root_t* root) -{ - if (!ppm_cfg->max_rule_ticks) - return; - - ppm_stats.rule_event_cnt++; - - if (ppm_cfg->rule_log && ppm_rt) - ppm_set_rule(root, ppm_rt->tot); -} - -void ppm_clear_rule_event(ppm_cfg_t* ppm_cfg, detection_option_tree_root_t* root) -{ - if (!ppm_cfg->max_rule_ticks) - return; - - ppm_stats.rule_event_cnt++; - - if (ppm_cfg->rule_log) - ppm_clear_rule(root); -} - -/* - * Config functions - */ - -void ppm_set_pkt_action(ppm_cfg_t* ppm_cfg, int flag) -{ - ppm_cfg->pkt_action = flag; -} - -void ppm_set_pkt_log(ppm_cfg_t* ppm_cfg, int flag) -{ - ppm_cfg->pkt_log |= flag; -} - -void ppm_set_rule_action(ppm_cfg_t* ppm_cfg, int flag) -{ - ppm_cfg->rule_action = flag; -} - -void ppm_set_rule_log(ppm_cfg_t* ppm_cfg, int flag) -{ - ppm_cfg->rule_log |= flag; -} - -void ppm_set_max_pkt_time(ppm_cfg_t* ppm_cfg, PPM_USECS usecs) -{ - ppm_cfg->max_pkt_ticks = usecs * ppm_tpu; -} - -void ppm_set_max_rule_time(ppm_cfg_t* ppm_cfg, PPM_USECS usecs) -{ - ppm_cfg->max_rule_ticks = usecs * ppm_tpu; -} - -void ppm_set_max_suspend_time(ppm_cfg_t* ppm_cfg, PPM_SECS secs) -{ - ppm_cfg->max_suspend_ticks = (uint64_t)secs * 1000000 * ppm_tpu; - ppm_cfg->max_suspend_ticks *= ppm_tpu; -} - -void ppm_set_rule_threshold(ppm_cfg_t* ppm_cfg, unsigned int cnt) -{ - ppm_cfg->rule_threshold = cnt; -} diff --git a/src/ppm/ppm.h b/src/ppm/ppm.h deleted file mode 100644 index 1f4833e07..000000000 --- a/src/ppm/ppm.h +++ /dev/null @@ -1,314 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2006-2013 Sourcefire, Inc. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// ppm.h author Marc Norton - -#ifndef PPM_H -#define PPM_H - -// Provide facilities for packet performance monitoring - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "main/thread.h" -#include "detection/detection_options.h" -#include "time/cpuclock.h" - -typedef uint64_t PPM_TICKS; -typedef uint64_t PPM_USECS; -typedef unsigned int PPM_SECS; - -struct ppm_cfg_t -{ - // config section - int enabled; - - PPM_TICKS max_pkt_ticks; - int pkt_log; // alert,console,syslog - int pkt_action; // suspend - - PPM_TICKS max_rule_ticks; - uint64_t rule_threshold; // rules must fail this many times in a row to suspend - - int rule_log; // alert,console,syslog - int rule_action; // suspend - - uint64_t max_suspend_ticks; -}; - -struct ppm_stats_t -{ - // stats section - unsigned int rule_event_cnt; - unsigned int pkt_event_cnt; - - uint64_t tot_pkt_time; // ticks - uint64_t tot_pkts; - - uint64_t tot_rule_time; // ticks - uint64_t tot_rules; - - uint64_t tot_nc_rule_time; // ticks - uint64_t tot_nc_rules; - - uint64_t tot_pcre_rule_time; // ticks - uint64_t tot_pcre_rules; -}; - -extern THREAD_LOCAL ppm_stats_t ppm_stats; - -typedef struct -{ - uint64_t pktcnt; - uint64_t start, cur, tot; - uint64_t subtract; - PPM_TICKS max_pkt_ticks; - unsigned int rule_tests; - unsigned int pcre_rule_tests; - unsigned int nc_rule_tests; -} ppm_pkt_timer_t; - -typedef struct -{ - uint64_t start, cur, tot; - PPM_TICKS max_rule_ticks; -} ppm_rule_timer_t; - -// global data -#define PPM_MAX_TIMERS 10 -extern PPM_TICKS ppm_tpu; -extern THREAD_LOCAL ppm_pkt_timer_t ppm_pkt_times[PPM_MAX_TIMERS]; -extern THREAD_LOCAL ppm_pkt_timer_t* ppm_pt; -extern THREAD_LOCAL unsigned int ppm_pkt_index; -extern THREAD_LOCAL ppm_rule_timer_t ppm_rule_times[PPM_MAX_TIMERS]; -extern THREAD_LOCAL ppm_rule_timer_t* ppm_rt; -extern THREAD_LOCAL unsigned int ppm_rule_times_index; -extern THREAD_LOCAL uint64_t ppm_cur_time; -extern THREAD_LOCAL int ppm_abort_this_pkt; -extern THREAD_LOCAL int ppm_suspend_this_rule; - -#define PPM_LOG_ALERT 1 -#define PPM_LOG_MESSAGE 2 -#define PPM_ACTION_SUSPEND 1 - -// config flags -#define PPM_ENABLED() (snort_conf->ppm_cfg->enabled > 0) -#define PPM_PKTS_ENABLED() (snort_conf->ppm_cfg->max_pkt_ticks > 0) -#define PPM_RULES_ENABLED() (snort_conf->ppm_cfg->max_rule_ticks > 0) - -// packet, rule event flags -#define PPM_PACKET_ABORT_FLAG() ppm_abort_this_pkt -#define PPM_RULE_SUSPEND_FLAG() ppm_suspend_this_rule - -#define PPM_INC_PKT_CNT() ppm_stats.tot_pkts++ -#define PPM_PKT_CNT() ppm_pt->pktcnt -#define PPM_PKT_LOG(p) if (ppm_abort_this_pkt) ppm_pkt_log(snort_conf->ppm_cfg,p) -#define PPM_RULE_LOG(cnt,p) ppm_rule_log(snort_conf->ppm_cfg,cnt,p) -#define PPM_ACCUM_PKT_TIME() \ - if ( ppm_pt ) \ - { \ - ppm_stats.tot_pkt_time += ppm_pt->tot; \ - } -#define PPM_ACCUM_RULE_TIME() \ - if ( ppm_rt ) \ - { \ - ppm_stats.tot_rule_time += ppm_rt->tot; \ - ppm_stats.tot_rules++; \ - } -#define PPM_ACCUM_NC_RULE_TIME() \ - ppm_stats.tot_nc_rule_time += ppm_rt->tot; \ - ppm_stats.tot_nc_rules++; - -#define PPM_ACCUM_PCRE_RULE_TIME() \ - ppm_stats.tot_pcre_rule_time += ppm_rt->tot; \ - ppm_stats.tot_pcre_rules++; - -#define PPM_GET_TIME() get_clockticks(ppm_cur_time) - -#define PPM_PKT_RULE_TESTS() ppm_pt->rule_tests -#define PPM_PKT_PCRE_RULE_TESTS() ppm_pt->pcre_rule_tests -#define PPM_PKT_NC_RULE_TESTS() ppm_pt->nc_rule_tests -#define PPM_INC_PKT_RULE_TESTS() if (ppm_pt) ppm_pt->rule_tests++ -#define PPM_INC_PKT_PCRE_RULE_TESTS() if (ppm_pt) ppm_pt->pcre_rule_tests++ -#define PPM_INC_PKT_NC_RULE_TESTS() if (ppm_pt) ppm_pt->nc_rule_tests++ - -#define PPM_PRINT_PKT_TIME(a) LogMessage(a, ppm_ticks_to_usecs((PPM_TICKS)ppm_pt->tot) ); - -#ifdef REG_TEST -// use usecs instead of ticks for rule suspension during pcap playback -#define PPM_RULE_TIME(p) ((p->pkth->ts.tv_sec * 1000000) + p->pkth->ts.tv_usec) -#else -#define PPM_RULE_TIME(p) ppm_cur_time -#endif - -#define PPM_INIT_PKT_TIMER() \ - if (ppm_pkt_index < PPM_MAX_TIMERS) \ - { \ - ppm_pt = &ppm_pkt_times[ppm_pkt_index++]; \ - ppm_abort_this_pkt = 0; \ - ppm_pt->pktcnt = ppm_stats.tot_pkts; \ - ppm_pt->start = ppm_cur_time; \ - ppm_pt->subtract = 0; \ - ppm_pt->rule_tests = 0; \ - ppm_pt->pcre_rule_tests = 0; \ - ppm_pt->nc_rule_tests = 0; \ - ppm_pt->max_pkt_ticks = snort_conf->ppm_cfg->max_pkt_ticks; \ - ppm_init_rules(); \ - } - -#define PPM_TOTAL_PKT_TIME() \ - if ( ppm_pt) \ - { \ - ppm_pt->tot = ppm_cur_time - ppm_pt->start - ppm_pt->subtract; \ - } - -#define PPM_END_PKT_TIMER() \ - if ( (ppm_pkt_index > 0) && ppm_pt) \ - { \ - ppm_pkt_index--; \ - if ( ppm_pkt_index > 0 ) \ - ppm_pt = &ppm_pkt_times[ppm_pkt_index-1]; \ - else \ - ppm_pt=0; \ - } - -#define PPM_INIT_RULE_TIMER() \ - if (ppm_rule_times_index < PPM_MAX_TIMERS) \ - { \ - ppm_rt = &ppm_rule_times[ppm_rule_times_index++]; \ - ppm_suspend_this_rule = 0; \ - ppm_rt->start=ppm_cur_time; \ - ppm_rt->max_rule_ticks = snort_conf->ppm_cfg->max_rule_ticks; \ - } - -#define PPM_END_RULE_TIMER() \ - if (( ppm_rule_times_index > 0) && ppm_rt ) \ - { \ - ppm_rule_times_index--; \ - if (ppm_rule_times_index > 0) \ - { \ - ppm_rt=&ppm_rule_times[ppm_rule_times_index-1]; \ - } else { \ - ppm_rt=NULL; \ - } \ - } - -// use PPM_GET_TIME; first to get the current time -#define PPM_PACKET_TEST() \ - if ( ppm_pt ) \ - { \ - ppm_pt->tot = ppm_cur_time - ppm_pt->start; \ - if (ppm_pt->tot > ppm_pt->max_pkt_ticks) \ - { \ - if ( snort_conf->ppm_cfg->pkt_action & PPM_ACTION_SUSPEND ) \ - ppm_abort_this_pkt = 1; \ - } \ - } - -// use PPM_GET_TIME; first to get the current time -#define PPM_RULE_TEST(root,p) \ - if ( ppm_rt ) \ - { \ - ppm_rt->tot = ppm_cur_time - ppm_rt->start; \ - if (ppm_rt->tot > ppm_rt->max_rule_ticks) \ - { \ - ppm_dot_root_state_t* root_state = (root)->state + get_instance_id(); \ - if ( snort_conf->ppm_cfg->rule_action & PPM_ACTION_SUSPEND ) \ - { \ - int ii; \ - ppm_suspend_this_rule = 1; \ - (root_state)->ppm_disable_cnt++; \ - for ( ii = 0; ii< root->num_children; ii++) \ - { \ - dot_node_state_t* ns = \ - root->children[ii]->state + get_instance_id(); \ - ns->ppm_disable_cnt++; \ - } \ - if ( (root_state)->ppm_disable_cnt >= snort_conf->ppm_cfg->rule_threshold ) \ - { \ - ppm_set_rule_event(snort_conf->ppm_cfg, root); \ - (root_state)->enabled=false; \ - (root_state)->ppm_suspend_time=PPM_RULE_TIME(p); \ - } \ - else \ - { \ - (root_state)->ppm_suspend_time=0; \ - } \ - } \ - else \ - { \ - (root_state)->ppm_suspend_time=0; \ - if ( (root_state)->ppm_disable_cnt > 0 ) \ - (root_state)->ppm_disable_cnt--; \ - } \ - } \ - } - -#define PPM_REENABLE_TREE(root,p) \ - ppm_dot_root_state_t* root_state = (root)->state + get_instance_id(); \ - if ( (root_state)->ppm_suspend_time && snort_conf->ppm_cfg->max_suspend_ticks ) \ - { \ - PPM_TICKS now = PPM_RULE_TIME(p); \ - PPM_TICKS then = (root_state)->ppm_suspend_time + snort_conf->ppm_cfg->max_suspend_ticks; \ - if ( now > then ) \ - { \ - (root_state)->ppm_suspend_time=0; \ - (root_state)->enabled=true; \ - ppm_clear_rule_event(snort_conf->ppm_cfg, root); \ - } \ - } - -void ppm_init(ppm_cfg_t*); - -void ppm_set_pkt_action(ppm_cfg_t*, int); -void ppm_set_pkt_log(ppm_cfg_t*, int); - -void ppm_set_rule_action(ppm_cfg_t*, int); -void ppm_set_rule_threshold(ppm_cfg_t*, unsigned int); -void ppm_set_rule_log(ppm_cfg_t*, int); - -void ppm_set_max_pkt_time(ppm_cfg_t*, PPM_USECS); -void ppm_set_max_rule_time(ppm_cfg_t*, PPM_USECS); -void ppm_set_max_suspend_time(ppm_cfg_t*, PPM_SECS); - -void ppm_print_cfg(ppm_cfg_t*); -void ppm_print_summary(ppm_cfg_t*); -void ppm_sum_stats(); -double ppm_ticks_to_usecs(PPM_TICKS); - -void ppm_pkt_log(ppm_cfg_t*, Packet*); -void ppm_rule_log(ppm_cfg_t*, uint64_t, Packet*); - -void ppm_init_rules(void); -void ppm_set_rule_event(ppm_cfg_t*, detection_option_tree_root_t*); -void ppm_clear_rule_event(ppm_cfg_t*, detection_option_tree_root_t*); -void ppm_set_rule(detection_option_tree_root_t*, PPM_TICKS); - -#define PPM_INIT(x) ppm_init(x) -#define PPM_PRINT_CFG(x) ppm_print_cfg(x) -#define PPM_PRINT_SUMMARY(x) ppm_print_summary(x) - -#else - -#define PPM_GET_TIME() -#define PPM_SET_TIME() - -#endif - diff --git a/src/ppm/ppm_module.cc b/src/ppm/ppm_module.cc deleted file mode 100644 index 838e0cfef..000000000 --- a/src/ppm/ppm_module.cc +++ /dev/null @@ -1,140 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -// ppm_module.cc author Russ Combs - -#include "ppm_module.h" - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "ppm.h" -#include "main/snort_config.h" - -//------------------------------------------------------------------------- -// ppm attributes -//------------------------------------------------------------------------- - -#define s_name "ppm" -#define s_help \ - "packet and rule latency monitoring and control" - -static const Parameter s_params[] = -{ - { "max_pkt_time", Parameter::PT_INT, "0:", "0", - "enable packet latency thresholding (usec), 0 = off" }, - - { "fastpath_expensive_packets", Parameter::PT_BOOL, nullptr, "false", - "stop inspection if the max_pkt_time is exceeded" }, - - { "pkt_log", Parameter::PT_ENUM, "none | log | alert | both", "none", - "log event if max_pkt_time is exceeded" }, - - { "max_rule_time", Parameter::PT_INT, "0:", "0", - "enable rule latency thresholding (usec), 0 = off" }, - - { "threshold", Parameter::PT_INT, "1:", "5", - "number of times to exceed limit before disabling rule" }, - - { "suspend_expensive_rules", Parameter::PT_BOOL, nullptr, "false", - "temporarily disable rule if threshold is reached" }, - - { "suspend_timeout", Parameter::PT_INT, "0:", "60", - "seconds to suspend rule, 0 = permanent" }, - - { "rule_log", Parameter::PT_ENUM, "none|log|alert|both", "none", - "enable event logging for suspended rules" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - -#define PPM_EVENT_RULE_TREE_DISABLED_STR "rule options disabled by rule latency" -#define PPM_EVENT_RULE_TREE_ENABLED_STR "rule options re-enabled by rule latency" -#define PPM_EVENT_PACKET_ABORTED_STR "packet aborted due to latency" - -static const RuleMap ppm_rules[] = -{ - { PPM_EVENT_RULE_TREE_DISABLED, PPM_EVENT_RULE_TREE_DISABLED_STR }, - { PPM_EVENT_RULE_TREE_ENABLED, PPM_EVENT_RULE_TREE_ENABLED_STR }, - { PPM_EVENT_PACKET_ABORTED, PPM_EVENT_PACKET_ABORTED_STR }, - - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// ppm module -//------------------------------------------------------------------------- - -PpmModule::PpmModule() : Module(s_name, s_help, s_params) { } - -const RuleMap* PpmModule::get_rules() const -{ return ppm_rules; } - -bool PpmModule::begin(const char*, int, SnortConfig* sc) -{ - if ( !PPM_ENABLED() ) - PPM_INIT(sc->ppm_cfg); - - return true; -} - -bool PpmModule::set(const char*, Value& v, SnortConfig* sc) -{ - if ( v.is("max_pkt_time") ) - ppm_set_max_pkt_time(sc->ppm_cfg, v.get_long()); - - else if ( v.is("fastpath_expensive_packets") ) - { - if (v.get_bool()) - ppm_set_pkt_action(sc->ppm_cfg, PPM_ACTION_SUSPEND); - } - - else if ( v.is("pkt_log") ) - { - unsigned u = v.get_long(); - if ( u & 0x1 ) - ppm_set_pkt_log(sc->ppm_cfg, PPM_LOG_MESSAGE); - if ( u & 0x2 ) - ppm_set_pkt_log(sc->ppm_cfg, PPM_LOG_ALERT); - } - else if ( v.is("max_rule_time") ) - ppm_set_max_rule_time(sc->ppm_cfg, v.get_long()); - - else if ( v.is("threshold") ) - ppm_set_rule_threshold(sc->ppm_cfg, v.get_long()); - - else if ( v.is("suspend_expensive_rules") ) - ppm_set_rule_action(sc->ppm_cfg, PPM_ACTION_SUSPEND); - - else if ( v.is("suspend_timeout") ) - ppm_set_max_suspend_time(sc->ppm_cfg, v.get_long()); - - else if ( v.is("rule_log") ) - { - unsigned u = v.get_long(); - if ( u & 0x1 ) - ppm_set_rule_log(sc->ppm_cfg, PPM_LOG_MESSAGE); - if ( u & 0x2 ) - ppm_set_rule_log(sc->ppm_cfg, PPM_LOG_ALERT); - } - else - return false; - - return true; -} diff --git a/src/ppm/ppm_module.h b/src/ppm/ppm_module.h deleted file mode 100644 index 886cebcd9..000000000 --- a/src/ppm/ppm_module.h +++ /dev/null @@ -1,53 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// ppm_module.h author Russ Combs - -#ifndef PPM_MODULE_H -#define PPM_MODULE_H - -// Configuration module for packet performance monitoring - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "framework/module.h" - -#define GID_PPM 134 - -// SIDs -#define PPM_EVENT_RULE_TREE_DISABLED 1 -#define PPM_EVENT_RULE_TREE_ENABLED 2 -#define PPM_EVENT_PACKET_ABORTED 3 - -class PpmModule : public Module -{ -public: - PpmModule(); - - bool begin(const char*, int, SnortConfig*) override; - bool set(const char*, Value&, SnortConfig*) override; - - const RuleMap* get_rules() const override; - - unsigned get_gid() const override - { return GID_PPM; } -}; - -#endif - diff --git a/src/utils/stats.cc b/src/utils/stats.cc index cc52a5090..a3541b456 100644 --- a/src/utils/stats.cc +++ b/src/utils/stats.cc @@ -35,7 +35,6 @@ #include "protocols/packet_manager.h" #include "detection/fp_create.h" #include "filters/sfthreshold.h" -#include "ppm/ppm.h" #include "profiler/profiler.h" #include "time/timersub.h" #include "file_api/file_stats.h" diff --git a/src/utils/util.cc b/src/utils/util.cc index 0f2abe164..97c6a45aa 100644 --- a/src/utils/util.cc +++ b/src/utils/util.cc @@ -69,7 +69,6 @@ #include "packet_io/sfdaq.h" #include "packet_io/active.h" #include "ips_options/ips_pcre.h" -#include "ppm/ppm.h" #include "time/packet_time.h" #include "time/timersub.h" #include "stream/stream.h"