From: Russ Combs <rucombs@cisco.com>
Date: Wed, 27 Aug 2014 20:30:22 +0000 (-0400)
Subject: tweaks for bogus idle processing
X-Git-Tag: 3.0.0-233~1417^2~12^2~6
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=76b0cf4556f6f0bc41f045fea0a438017422cf1f;p=thirdparty%2Fsnort3.git

tweaks for bogus idle processing
---

diff --git a/ChangeLog b/ChangeLog
index 96f9753ce..01e4fcf1c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,7 @@
 -- more FIXIT-H fixed
 -- removed process.plugin_path and process.script_path since they are
    needed ahead of parsing
+-- added idle processing, though still as sketchy as Snort until alpha 2
 
 116
 -- fixed valgrind leak
diff --git a/src/main/analyzer.cc b/src/main/analyzer.cc
index dcc4f0cf8..0020245b2 100644
--- a/src/main/analyzer.cc
+++ b/src/main/analyzer.cc
@@ -130,6 +130,13 @@ void Analyzer::analyze()
         }
         if ( DAQ_Acquire(0, main_func, NULL) )
             break;
+
+        // FIXIT-M acquire(0) won't return until no packets, signal, etc.
+        // which makes this idle unlikely to execute under high traffic 
+        // conditions; that means the idle processing may not be useful
+        // or that we need a hook to do things periodically even when
+        // traffic is available
+        snort_idle();
     }
 }
 
diff --git a/src/main/snort.cc b/src/main/snort.cc
index bb7d820e3..8e1e1f092 100644
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -712,7 +712,7 @@ void set_main_hook(MainHook_f f)
 Packet* get_current_packet()
 { return &s_packet; }
 
-// FIXIT-H for multiple packet threads
+// FIXIT-M for multiple packet threads
 // using thread locals for s_pkth and s_data won't work
 // will need array of s_packet, s_pkth, and s_data and 
 // capture all if it is not clear which thread crashed
@@ -937,14 +937,10 @@ DAQ_Verdict packet_callback(
     Active_Reset();
     PacketManager::encode_reset();
 
-    if ( flow_con )  // FIXIT-H always instantiate
-        flow_con->timeout_flows(4, pkthdr->ts.tv_sec);
-
-#if 0
-    // FIXIT-H do this when idle
     if ( flow_con ) // FIXIT-H always instantiate
-        flow_con->timeout_flows(16384, time(NULL));
-#endif
+    {
+        flow_con->timeout_flows(4, pkthdr->ts.tv_sec);
+    }
 
     s_packet.pkth = NULL;  // no longer avail on segv
 
@@ -955,9 +951,16 @@ DAQ_Verdict packet_callback(
     return verdict;
 }
 
+void snort_idle()
+{
+    if ( flow_con )
+        flow_con->timeout_flows(16384, time(NULL));
+    pc.idle++;
+}
+
 void snort_rotate()
 {
-        SetRotatePerfFileFlag();
+    SetRotatePerfFileFlag();
 }
 
 void snort_thread_init(const char* intf)
diff --git a/src/main/snort.h b/src/main/snort.h
index 05c61af62..8ed131ade 100644
--- a/src/main/snort.h
+++ b/src/main/snort.h
@@ -46,6 +46,7 @@ void snort_cleanup();
 void snort_thread_init(const char* intf);
 void snort_thread_term();
 
+void snort_idle();
 void snort_rotate();
 
 // FIXIT-L may be inlined at some point; on lockdown for now
diff --git a/src/utils/stats.cc b/src/utils/stats.cc
index 66339c47a..e19f3bd5b 100644
--- a/src/utils/stats.cc
+++ b/src/utils/stats.cc
@@ -213,6 +213,7 @@ static const char* pc_names[] =
     "alert limit",
     "internal blacklist",
     "internal whitelist",
+    "idle"
 };
 
 static const char* proc_names[] =
diff --git a/src/utils/stats.h b/src/utils/stats.h
index 27decde79..0ea126bc9 100644
--- a/src/utils/stats.h
+++ b/src/utils/stats.h
@@ -55,6 +55,7 @@ struct PacketCount
     PegCount alert_limit;
     PegCount internal_blacklist;
     PegCount internal_whitelist;
+    PegCount idle;
 };
 
 struct ProcessCount