From: Carter Waxman Date: Tue, 12 Apr 2016 18:45:45 +0000 (-0400) Subject: removed EventTracker in place of search_engine peg counts. Added unit tests to BaseTr... X-Git-Tag: 3.0.0-233~457^2~7 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4bc906e01de45506a2739009a2eef95a014bebd5;p=thirdparty%2Fsnort3.git removed EventTracker in place of search_engine peg counts. Added unit tests to BaseTracker. --- diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc index 9d3660b92..914ff8a0e 100644 --- a/src/detection/fp_detect.cc +++ b/src/detection/fp_detect.cc @@ -62,7 +62,6 @@ #include "framework/inspector.h" #include "framework/ips_action.h" #include "framework/mpse.h" -#include "perf_monitor/event_tracker.h" #include "filters/sfthreshold.h" #include "filters/rate_filter.h" #include "events/event_wrapper.h" @@ -473,13 +472,13 @@ static int rule_tree_match( { // We have a qualified event from this tree pomd->pg->event_count++; - perf_event->update_qualified_events(); + pmqs.qualified_events++; } else { // This means that the event is non-qualified. pomd->pg->match_count++; - perf_event->update_non_qualified_events(); + pmqs.non_qualified_events++; } } @@ -1089,13 +1088,13 @@ static inline int fpEvalHeaderSW(PortGroup* port_group, Packet* p, { // We have a qualified event from this tree port_group->event_count++; - perf_event->update_qualified_events(); + pmqs.qualified_events++; } else { // This means that the event is non-qualified. port_group->match_count++; - perf_event->update_non_qualified_events(); + pmqs.non_qualified_events++; } pc.slow_searches++; } diff --git a/src/main/modules.cc b/src/main/modules.cc index 06467d698..c09c47e43 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -246,6 +246,8 @@ const PegInfo mpse_pegs[] = { "total flushed", "fast pattern matches discarded due to overflow" }, { "total inserts", "total fast pattern hits" }, { "total unique", "total unique fast pattern hits" }, + { "non-qualified events", "total non-qualified events" }, + { "qualified events", "total qualified events" }, { nullptr, nullptr } }; diff --git a/src/network_inspectors/perf_monitor/CMakeLists.txt b/src/network_inspectors/perf_monitor/CMakeLists.txt index 8730050f3..af0ccbd60 100644 --- a/src/network_inspectors/perf_monitor/CMakeLists.txt +++ b/src/network_inspectors/perf_monitor/CMakeLists.txt @@ -5,8 +5,6 @@ add_library ( perf_monitor STATIC csv_formatter.h cpu_tracker.cc cpu_tracker.h - event_tracker.cc - event_tracker.h flow_tracker.cc flow_tracker.h flow_ip_tracker.cc diff --git a/src/network_inspectors/perf_monitor/Makefile.am b/src/network_inspectors/perf_monitor/Makefile.am index 73efbd19a..7bc2e2053 100644 --- a/src/network_inspectors/perf_monitor/Makefile.am +++ b/src/network_inspectors/perf_monitor/Makefile.am @@ -7,7 +7,6 @@ csv_formatter.cc csv_formatter.h \ cpu_tracker.cc cpu_tracker.h \ flow_tracker.cc flow_tracker.h \ flow_ip_tracker.cc flow_ip_tracker.h \ -event_tracker.cc event_tracker.h \ perf_formatter.cc perf_formatter.h \ perf_monitor.cc perf_monitor.h \ perf_module.cc perf_module.h \ diff --git a/src/network_inspectors/perf_monitor/base_tracker.cc b/src/network_inspectors/perf_monitor/base_tracker.cc index b77bf505b..eed5691c2 100644 --- a/src/network_inspectors/perf_monitor/base_tracker.cc +++ b/src/network_inspectors/perf_monitor/base_tracker.cc @@ -22,7 +22,10 @@ #include "perf_module.h" #include "framework/module.h" -#include "managers/module_manager.h" + +#ifdef UNIT_TEST +#include +#endif #define BASE_FILE (PERF_NAME ".csv") @@ -57,3 +60,78 @@ void BaseTracker::process(bool summary) config->modules.at(i)->sum_stats(); } +#ifdef UNIT_TEST + +class MockModule : public Module +{ +public: + MockModule() : Module("mockery", "mockery") + { + counts = (PegCount*)malloc(5 * sizeof(PegCount)); + for( unsigned i = 0; i < 5; i++ ) + counts[i] = i; + }; + + ~MockModule() { free(counts); }; + + const PegInfo* get_pegs() const override { return pegs; }; + + PegCount* get_counts() const override { return counts; }; + + void sum_stats() override {}; + + void real_sum_stats() { Module::sum_stats(); }; + +private: + PegCount* counts; + PegInfo pegs[5] = { + {"zero", ""}, + {"one", ""}, + {"two", ""}, + {"three", ""}, + {"four", ""}}; +}; + +class MockBaseTracker : public BaseTracker +{ +public: + PerfFormatter* output; + + MockBaseTracker(PerfConfig* config) : BaseTracker(config) + { output = formatter; }; +}; + +TEST_CASE("module stats", "[BaseTracker]") +{ + unsigned pass = 0; + PegCount expected[2][5] = { + {0, 2, 4}, + {0, 0, 0}}; + + PerfConfig config; + config.format = PERF_MOCK; + + MockModule mod; + config.modules.push_back(&mod); + config.mod_peg_idxs.push_back(IndexVec()); + config.mod_peg_idxs[0].push_back(0); + config.mod_peg_idxs[0].push_back(2); + config.mod_peg_idxs[0].push_back(4); + + MockBaseTracker tracker(&config); + MockFormatter *formatter = (MockFormatter*)tracker.output; + + tracker.reset(); + tracker.process(false); + CHECK(*formatter->public_values["mockery.zero"].pc == expected[pass][0]); + CHECK(*formatter->public_values["mockery.two"].pc == expected[pass][1]); + CHECK(*formatter->public_values["mockery.four"].pc == expected[pass++][2]); + mod.real_sum_stats(); + + tracker.process(false); + CHECK(*formatter->public_values["mockery.zero"].pc == expected[pass][0]); + CHECK(*formatter->public_values["mockery.two"].pc == expected[pass][1]); + CHECK(*formatter->public_values["mockery.four"].pc == expected[pass++][2]); + mod.real_sum_stats(); +} +#endif diff --git a/src/network_inspectors/perf_monitor/csv_formatter.cc b/src/network_inspectors/perf_monitor/csv_formatter.cc index f8818ca6f..ea843b4c6 100644 --- a/src/network_inspectors/perf_monitor/csv_formatter.cc +++ b/src/network_inspectors/perf_monitor/csv_formatter.cc @@ -21,10 +21,10 @@ #include "csv_formatter.h" #ifdef UNIT_TEST -#include "catch/catch.hpp" - #include #include + +#include "catch/catch.hpp" #endif using namespace std; diff --git a/src/network_inspectors/perf_monitor/event_tracker.cc b/src/network_inspectors/perf_monitor/event_tracker.cc deleted file mode 100644 index afdd13421..000000000 --- a/src/network_inspectors/perf_monitor/event_tracker.cc +++ /dev/null @@ -1,71 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2015-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -// event_tracker.cc author Carter Waxman - -#include "event_tracker.h" - -#include "utils/stats.h" -#include "utils/util.h" - -#define EVENT_FILE (PERF_NAME "_event.csv") - -THREAD_LOCAL EventTracker* perf_event; - -EventTracker::EventTracker(PerfConfig *perf) : - PerfTracker(perf, perf->output == PERF_FILE ? EVENT_FILE : nullptr) -{ - formatter->register_section("event_stats"); - formatter->register_field("qualified", &qualified_events); - formatter->register_field("non_qualified", &non_qualified_events); -} - -void EventTracker::reset() -{ - non_qualified_events = 0; - qualified_events = 0; - - formatter->finalize_fields(fh); -} - -void EventTracker::process(bool) -{ - formatter->write(fh, cur_time); - - non_qualified_events = 0; - qualified_events = 0; -} - -void EventTracker::update_non_qualified_events() -{ - if ((perfmon_config) && - (perfmon_config->perf_flags & PERF_EVENT)) - { - non_qualified_events++; - } -} - -void EventTracker::update_qualified_events() -{ - if ((perfmon_config) && - (perfmon_config->perf_flags & PERF_EVENT)) - { - qualified_events++; - } -} - diff --git a/src/network_inspectors/perf_monitor/event_tracker.h b/src/network_inspectors/perf_monitor/event_tracker.h deleted file mode 100644 index abe023196..000000000 --- a/src/network_inspectors/perf_monitor/event_tracker.h +++ /dev/null @@ -1,45 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2015-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -// event_tracker.h author Carter Waxman - -#ifndef EVENT_TRACKER_H -#define EVENT_TRACKER_H - -#include "perf_formatter.h" -#include "perf_module.h" -#include "perf_tracker.h" - -class EventTracker : public PerfTracker -{ -public: - EventTracker(PerfConfig*); - void reset() override; - void process(bool) override; - - void update_non_qualified_events(); - void update_qualified_events(); - -private: - uint64_t non_qualified_events; - uint64_t qualified_events; -}; - -extern THREAD_LOCAL EventTracker* perf_event; -#endif - diff --git a/src/network_inspectors/perf_monitor/flow_tracker.h b/src/network_inspectors/perf_monitor/flow_tracker.h index f5c5527cf..c74ea02c8 100644 --- a/src/network_inspectors/perf_monitor/flow_tracker.h +++ b/src/network_inspectors/perf_monitor/flow_tracker.h @@ -27,7 +27,7 @@ struct FlowProto { std::vector src; std::vector dst; - PegCount high; + PegCount high = 0; }; class FlowTracker : public PerfTracker diff --git a/src/network_inspectors/perf_monitor/perf_module.cc b/src/network_inspectors/perf_monitor/perf_module.cc index b806e0bcb..0553ef3ec 100644 --- a/src/network_inspectors/perf_monitor/perf_module.cc +++ b/src/network_inspectors/perf_monitor/perf_module.cc @@ -47,9 +47,6 @@ static const Parameter s_params[] = { "cpu", Parameter::PT_BOOL, "nullptr", "false", "enable cpu statistics" }, - { "events", Parameter::PT_BOOL, nullptr, "false", - "report on qualified vs non-qualified events" }, - { "flow", Parameter::PT_BOOL, nullptr, "false", "enable traffic statistics" }, @@ -112,11 +109,6 @@ bool PerfMonModule::set(const char*, Value& v, SnortConfig*) if ( v.get_bool() ) config.perf_flags |= PERF_CPU; } - else if ( v.is("events") ) - { - if ( v.get_bool() ) - config.perf_flags |= PERF_EVENT; - } else if ( v.is("flow") ) { if ( v.get_bool() ) diff --git a/src/network_inspectors/perf_monitor/perf_monitor.cc b/src/network_inspectors/perf_monitor/perf_monitor.cc index 3f301491e..4750175ce 100644 --- a/src/network_inspectors/perf_monitor/perf_monitor.cc +++ b/src/network_inspectors/perf_monitor/perf_monitor.cc @@ -53,7 +53,6 @@ #include "cpu_tracker.h" #include "flow_tracker.h" #include "flow_ip_tracker.h" -#include "event_tracker.h" #ifdef UNIT_TEST #include "catch/catch.hpp" @@ -134,10 +133,12 @@ void PerfMonitor::show(SnortConfig*) switch(config.format) { case PERF_TEXT: - LogMessage(" Output Location: text\n"); + LogMessage(" Output Format: text\n"); break; case PERF_CSV: - LogMessage(" Output Location: csv\n"); + LogMessage(" Output Format: csv\n"); + break; + case PERF_MOCK: break; } } @@ -163,9 +164,6 @@ void PerfMonitor::tinit() if (config.perf_flags & PERF_FLOWIP) trackers->push_back(perf_flow_ip = new FlowIPTracker(&config)); - if (config.perf_flags & PERF_EVENT) - trackers->push_back(perf_event = new EventTracker(&config)); - if (config.perf_flags & PERF_CPU ) trackers->push_back(new CPUTracker(&config)); @@ -181,7 +179,6 @@ void PerfMonitor::tinit() void PerfMonitor::tterm() { perf_flow_ip = nullptr; - perf_event = nullptr; while (!trackers->empty()) { diff --git a/src/network_inspectors/perf_monitor/text_formatter.cc b/src/network_inspectors/perf_monitor/text_formatter.cc index 219fd8833..cd2669cbd 100644 --- a/src/network_inspectors/perf_monitor/text_formatter.cc +++ b/src/network_inspectors/perf_monitor/text_formatter.cc @@ -23,10 +23,10 @@ #include "utils/stats.h" #ifdef UNIT_TEST -#include "catch/catch.hpp" - #include #include + +#include "catch/catch.hpp" #endif using namespace std; diff --git a/src/search_engines/pat_stats.h b/src/search_engines/pat_stats.h index 1c072bca5..3101e70a1 100644 --- a/src/search_engines/pat_stats.h +++ b/src/search_engines/pat_stats.h @@ -32,6 +32,8 @@ struct PatMatQStat PegCount tot_inq_flush; PegCount tot_inq_inserts; PegCount tot_inq_uinserts; + PegCount non_qualified_events; + PegCount qualified_events; }; SO_PUBLIC extern THREAD_LOCAL PatMatQStat pmqs; diff --git a/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc b/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc index 9e57bc684..7f0e83d85 100644 --- a/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc +++ b/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc @@ -82,7 +82,7 @@ bool PerfMonitor::convert(std::istringstream& data_stream) table_api.add_deleted_comment("max"); else if (!keyword.compare("events")) - tmpval = table_api.add_option("events", true); + table_api.add_deleted_comment("events"); else if (!keyword.compare("console")) {