From: Russ Combs <rucombs@cisco.com>
Date: Sun, 9 Nov 2014 12:02:58 +0000 (-0500)
Subject: fixed prune count capture
X-Git-Tag: 3.0.0-233~1249
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f5ec87dd6bdd16805b77f28babdeffdd4e8855a7;p=thirdparty%2Fsnort3.git

fixed prune count capture
---

diff --git a/ChangeLog b/ChangeLog
index d15a25dd0..ca0adf3eb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+128
+-- fixed RangeCheck
+-- doc tweaks, defined peg count
+-- ensure fp_length / fp_offset are applied correctly
+-- allow \a\b\f\n\r\t\v in content strings
+-- fixed capture for prune counts
+
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug
 -- tweaked S5_TRACE output for consistency
@@ -39,10 +46,6 @@
 -- added stream_tcp.segs_split peg
 -- snort2lua patch
 -- changed from 2.10 to 3.0
--- fixed RangeCheck
--- doc tweaks, defined peg count
--- ensure fp_length / fp_offset are applied correctly
--- allow \a\b\f\n\r\t\v in content strings
 
 126
 -- pulled latest from tom
diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc
index 05881f096..c8b453b61 100644
--- a/src/flow/flow_control.cc
+++ b/src/flow/flow_control.cc
@@ -70,10 +70,27 @@ static THREAD_LOCAL PegCount udp_count = 0;
 static THREAD_LOCAL PegCount icmp_count = 0;
 static THREAD_LOCAL PegCount ip_count = 0;
 
-PegCount FlowControl::get_flow_count(uint8_t proto)
+uint32_t FlowControl::max_flows(uint8_t proto)
+{
+    FlowCache* cache = get_cache(proto);
+
+    if ( cache )
+        return cache->get_max_flows();
+
+    return 0;
+}
+
+PegCount FlowControl::get_prunes (uint8_t proto)
+{
+    FlowCache* cache = get_cache(proto);
+    return cache ? cache->get_prunes() : 0;
+}
+
+PegCount FlowControl::get_flows(uint8_t proto)
 {
     switch ( proto )
     {
+    // FIXIT should be using an enum for these
     case IPPROTO_TCP:  return tcp_count;
     case IPPROTO_UDP:  return udp_count;
     case IPPROTO_ICMP: return icmp_count;
@@ -82,10 +99,24 @@ PegCount FlowControl::get_flow_count(uint8_t proto)
     }
 }
 
-void FlowControl::clear_flow_counts()
+void FlowControl::clear_counts()
 {
     tcp_count = udp_count = 0;
     icmp_count = ip_count = 0;
+
+    FlowCache* cache;
+
+    if ( (cache = get_cache(IPPROTO_IP)) )
+        cache->reset_prunes();
+
+    if ( (cache = get_cache(IPPROTO_ICMP)) )
+        cache->reset_prunes();
+
+    if ( (cache = get_cache(IPPROTO_TCP)) )
+        cache->reset_prunes();
+
+    if ( (cache = get_cache(IPPROTO_UDP)) )
+        cache->reset_prunes();
 }
 
 //-------------------------------------------------------------------------
@@ -189,32 +220,6 @@ void FlowControl::timeout_flows(uint32_t flowCount, time_t cur_time)
     Active_Resume();
 }
 
-uint32_t FlowControl::max_flows(uint8_t proto)
-{
-    FlowCache* cache = get_cache(proto);
-
-    if ( cache )
-        return cache->get_max_flows();
-
-    return 0;
-}
-
-void FlowControl::get_prunes (uint8_t proto, PegCount& prunes)
-{
-    FlowCache* cache = get_cache(proto);
-
-    if ( cache )
-        prunes = cache->get_prunes();
-}
-
-void FlowControl::reset_prunes (uint8_t proto)
-{
-    FlowCache* cache = get_cache(proto);
-
-    if ( cache )
-        cache->reset_prunes();
-}
-
 //-------------------------------------------------------------------------
 // packet foo
 //-------------------------------------------------------------------------
diff --git a/src/flow/flow_control.h b/src/flow/flow_control.h
index 20c5b91c5..8d6f29fd2 100644
--- a/src/flow/flow_control.h
+++ b/src/flow/flow_control.h
@@ -77,11 +77,10 @@ public:
         FlowData*);
 
     uint32_t max_flows(uint8_t proto);
-    void get_prunes(uint8_t proto, PegCount&);
-    void reset_prunes(uint8_t proto);
 
-    PegCount get_flow_count(uint8_t);
-    void clear_flow_counts();
+    PegCount get_prunes(uint8_t);
+    PegCount get_flows(uint8_t);
+    void clear_counts();
 
 private:
     class FlowCache* get_cache(uint8_t);
diff --git a/src/main/snort.cc b/src/main/snort.cc
index 63f3888df..04a8e6622 100644
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -983,8 +983,9 @@ void snort_thread_term()
 #ifdef PPM_MGR
     ppm_sum_stats();
 #endif
-    InspectorManager::thread_term(snort_conf);
+    InspectorManager::thread_stop(snort_conf);
     ModuleManager::accumulate(snort_conf);
+    InspectorManager::thread_term(snort_conf);
     ActionManager::thread_term(snort_conf);
 
     IpsManager::clear_options();
diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index d6ee0c51b..c79c9fcef 100644
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -484,7 +484,7 @@ void InspectorManager::thread_init(SnortConfig* sc)
     }
 }
 
-void InspectorManager::thread_term(SnortConfig* sc)
+void InspectorManager::thread_stop(SnortConfig*)
 {
     // pin->tterm() only called for default policy
     set_default_policy();
@@ -499,7 +499,10 @@ void InspectorManager::thread_term(SnortConfig* sc)
                 p->pp_class.init = true;
             }
     }
+}
 
+void InspectorManager::thread_term(SnortConfig* sc)
+{
     for ( auto* p : sc->framework_config->clist )
     {
         if ( p->api.tterm )
diff --git a/src/managers/inspector_manager.h b/src/managers/inspector_manager.h
index e5129488a..bbf5e18ea 100644
--- a/src/managers/inspector_manager.h
+++ b/src/managers/inspector_manager.h
@@ -62,6 +62,7 @@ public:
     static void print_config(SnortConfig*);
 
     static void thread_init(SnortConfig*);
+    static void thread_stop(SnortConfig*);
     static void thread_term(SnortConfig*);
 
     static void release_policy(FrameworkPolicy*);
diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc
index 5d719a4e0..363ac0062 100644
--- a/src/network_inspectors/port_scan/port_scan.cc
+++ b/src/network_inspectors/port_scan/port_scan.cc
@@ -1017,7 +1017,7 @@ static const InspectApi sp_api =
     sp_ctor,
     sp_dtor,
     nullptr, // ssn
-    sp_reset
+    sp_reset // FIXIT-L only inspector using this, eliminate?
 };
 
 #ifdef BUILDING_SO
diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc
index 7b44b325f..7e5e0776b 100644
--- a/src/stream/base/stream_base.cc
+++ b/src/stream/base/stream_base.cc
@@ -61,10 +61,17 @@ const unsigned session_peg_count = array_size(session_pegs);
 
 struct BaseStats
 {
-    PegCount tcp;
-    PegCount udp;
-    PegCount icmp;
-    PegCount ip;
+    PegCount tcp_flows;
+    PegCount tcp_prunes;
+
+    PegCount udp_flows;
+    PegCount udp_prunes;
+
+    PegCount icmp_flows;
+    PegCount icmp_prunes;
+
+    PegCount ip_flows;
+    PegCount ip_prunes;
 };
 
 static BaseStats g_stats;
@@ -73,17 +80,28 @@ static THREAD_LOCAL BaseStats t_stats;
 static const char* const base_pegs[] =
 {
     "tcp flows",
+    "tcp prunes",
     "udp flows",
+    "udp prunes",
     "icmp flows",
-    "ip flows"
+    "icmp prunes",
+    "ip flows",
+    "ip prunes"
 };
 
 void base_sum()
 {   
-    t_stats.tcp = flow_con->get_flow_count(IPPROTO_TCP);
-    t_stats.udp = flow_con->get_flow_count(IPPROTO_UDP);
-    t_stats.icmp = flow_con->get_flow_count(IPPROTO_ICMP);
-    t_stats.ip = flow_con->get_flow_count(IPPROTO_IP);
+    t_stats.tcp_flows = flow_con->get_flows(IPPROTO_TCP);
+    t_stats.tcp_prunes = flow_con->get_prunes(IPPROTO_TCP);
+
+    t_stats.udp_flows = flow_con->get_flows(IPPROTO_UDP);
+    t_stats.udp_prunes = flow_con->get_prunes(IPPROTO_UDP);
+
+    t_stats.icmp_flows = flow_con->get_flows(IPPROTO_ICMP);
+    t_stats.icmp_prunes = flow_con->get_prunes(IPPROTO_ICMP);
+
+    t_stats.ip_flows = flow_con->get_flows(IPPROTO_IP);
+    t_stats.ip_prunes = flow_con->get_prunes(IPPROTO_IP);
 
     sum_stats((PegCount*)&g_stats, (PegCount*)&t_stats,
         array_size(base_pegs));
@@ -97,7 +115,7 @@ void base_stats()
 
 void base_reset()
 {
-    flow_con->clear_flow_counts();
+    flow_con->clear_counts();
     memset(&t_stats, 0, sizeof(t_stats));
 }
 
@@ -188,9 +206,6 @@ void StreamBase::tterm()
     flow_con->purge_flows(IPPROTO_UDP);
     flow_con->purge_flows(IPPROTO_ICMP);
     flow_con->purge_flows(IPPROTO_IP);
-
-    delete flow_con;
-    flow_con = nullptr;
 }
 
 void StreamBase::show(SnortConfig*)
@@ -270,6 +285,12 @@ static void base_dtor(Inspector* p)
     delete p;
 }
 
+void base_tterm()
+{
+    delete flow_con;
+    flow_con = nullptr;
+}
+
 static const InspectApi base_api =
 {
     {
@@ -288,7 +309,7 @@ static const InspectApi base_api =
     nullptr, // init
     nullptr, // term
     nullptr, // tinit
-    nullptr, // tterm
+    base_tterm,
     base_ctor,
     base_dtor,
     nullptr, // ssn
diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc
index 9957e9e50..43af19929 100644
--- a/src/stream/icmp/icmp_session.cc
+++ b/src/stream/icmp/icmp_session.cc
@@ -259,22 +259,3 @@ void IcmpSession::update_direction(char dir, const sfip_t *ip, uint16_t)
     icmp_responder_ip = tmpIp;
 }
 
-//-------------------------------------------------------------------------
-// api related methods
-//-------------------------------------------------------------------------
-
-#if 0
-void icmp_stats()
-{
-    // FIXIT-L move these to the actual owner
-    // FIXIT-L need to get these before delete flow_con
-    //flow_con->get_prunes(IPPROTO_UDP, icmpStats.prunes);
-}
-#endif
-
-void icmp_reset()
-{
-    memset(&icmpStats, 0, sizeof(icmpStats));
-    flow_con->reset_prunes(IPPROTO_ICMP);
-}
-
diff --git a/src/stream/icmp/stream_icmp.cc b/src/stream/icmp/stream_icmp.cc
index cec590c8b..fc380af90 100644
--- a/src/stream/icmp/stream_icmp.cc
+++ b/src/stream/icmp/stream_icmp.cc
@@ -132,7 +132,7 @@ static const InspectApi icmp_api =
     icmp_ctor,
     icmp_dtor,
     icmp_ssn,
-    icmp_reset
+    nullptr, // reset
 };
 
 const BaseApi* nin_stream_icmp = &icmp_api.base;
diff --git a/src/stream/tcp/stream_tcp.cc b/src/stream/tcp/stream_tcp.cc
index 129e9d526..cb56868a4 100644
--- a/src/stream/tcp/stream_tcp.cc
+++ b/src/stream/tcp/stream_tcp.cc
@@ -150,7 +150,7 @@ static const InspectApi tcp_api =
     tcp_ctor,
     tcp_dtor,
     tcp_ssn,
-    tcp_reset
+    nullptr   // reset
 };
 
 const BaseApi* nin_stream_tcp = &tcp_api.base;
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 12ff0fb4a..be2e2d392 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -101,7 +101,6 @@ THREAD_LOCAL ProfileStats s5TcpProcessRebuiltPerfStats;
 struct TcpStats
 {
     PegCount sessions;
-    PegCount prunes;
     PegCount timeouts;
     PegCount resyns;
     PegCount discards;
@@ -130,7 +129,6 @@ struct TcpStats
 const char* tcp_pegs[] =
 {
     "sessions",
-    "prunes",
     "timeouts",
     "resyns",
     "discards",
@@ -6850,11 +6848,6 @@ midstream_pickup_allowed:
 // tcp module stuff
 //-------------------------------------------------------------------------
 
-void tcp_reset()
-{
-    flow_con->reset_prunes(IPPROTO_TCP);
-}
-
 void tcp_show(StreamTcpConfig* tcp_config)
 {
     Stream5PrintTcpConfig(tcp_config);
diff --git a/src/stream/udp/stream_udp.cc b/src/stream/udp/stream_udp.cc
index 1b4dd44e0..b22c3f880 100644
--- a/src/stream/udp/stream_udp.cc
+++ b/src/stream/udp/stream_udp.cc
@@ -147,7 +147,7 @@ static const InspectApi udp_api =
     udp_ctor,
     udp_dtor,
     udp_ssn,
-    udp_reset
+    nullptr  // reset
 };
 
 const BaseApi* nin_stream_udp = &udp_api.base;
diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc
index df8644005..076053a80 100644
--- a/src/stream/udp/udp_session.cc
+++ b/src/stream/udp/udp_session.cc
@@ -220,20 +220,3 @@ int UdpSession::process(Packet *p)
     return 0;
 }
 
-//-------------------------------------------------------------------------
-// api related methods
-//-------------------------------------------------------------------------
-
-#if 0
-void udp_stats()
-{
-    // FIXIT-L need to get these before delete flow_con
-    //flow_con->get_prunes(IPPROTO_UDP, udpStats.prunes);
-}
-#endif
-
-void udp_reset()
-{
-    flow_con->reset_prunes(IPPROTO_UDP);
-}
-