From: Russ Combs (rucombs) Date: Fri, 23 Sep 2016 21:35:57 +0000 (-0400) Subject: Merge pull request #636 in SNORT/snort3 from crc_timeouts to master X-Git-Tag: 3.0.0-233~260 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e019a0c420c44a09c3ff38b2a0e84c8d1db250dc;p=thirdparty%2Fsnort3.git Merge pull request #636 in SNORT/snort3 from crc_timeouts to master Squashed commit of the following: commit 2797249af796d70c7b0eb9759d056bca3572e229 Author: Russ Combs Date: Fri Sep 23 14:43:19 2016 -0400 separate idle timeouts from session timeouts counts close tcp on rst in close wait, closing, fin wait 1, and fin wait 2 --- diff --git a/src/flow/flow_cache.cc b/src/flow/flow_cache.cc index ea7af7add..4a636627a 100644 --- a/src/flow/flow_cache.cc +++ b/src/flow/flow_cache.cc @@ -192,7 +192,7 @@ unsigned FlowCache::prune_stale(uint32_t thetime, const Flow* save_me) DebugMessage(DEBUG_STREAM, "pruning stale flow\n"); flow->ssn_state.session_flags |= SSNFLAG_TIMEDOUT; - release(flow, PruneReason::TIMEOUT); + release(flow, PruneReason::IDLE); ++pruned; flow = static_cast(hash_table->first()); @@ -314,7 +314,7 @@ unsigned FlowCache::timeout(unsigned num_flows, time_t thetime) DebugMessage(DEBUG_STREAM, "retiring stale flow\n"); flow->ssn_state.session_flags |= SSNFLAG_TIMEDOUT; - release(flow, PruneReason::TIMEOUT); + release(flow, PruneReason::IDLE); ++retired; @@ -334,7 +334,7 @@ unsigned FlowCache::purge() while ( auto flow = static_cast(hash_table->first()) ) { - release(flow, PruneReason::PURGE); + release(flow, PruneReason::NONE); ++retired; } diff --git a/src/flow/flow_cache.h b/src/flow/flow_cache.h index f62e69ae3..5bd226730 100644 --- a/src/flow/flow_cache.h +++ b/src/flow/flow_cache.h @@ -46,7 +46,7 @@ public: Flow* find(const FlowKey*); Flow* get(const FlowKey*); - int release(Flow*, PruneReason = PruneReason::USER, bool do_cleanup = true); + int release(Flow*, PruneReason = PruneReason::NONE, bool do_cleanup = true); unsigned prune_unis(); unsigned prune_stale(uint32_t thetime, const Flow* save_me); @@ -61,7 +61,7 @@ public: { return config.max_sessions; } PegCount get_total_prunes() const - { return prune_stats.get_total() - prune_stats.get(PruneReason::PURGE); } + { return prune_stats.get_total(); } PegCount get_prunes(PruneReason reason) const { return prune_stats.get(reason); } diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc index 8fbfda847..504d8e8d3 100644 --- a/src/flow/flow_control.cc +++ b/src/flow/flow_control.cc @@ -191,8 +191,7 @@ void FlowControl::delete_flow(const FlowKey* key) Flow* flow = cache->find(key); if ( flow ) - // FIXIT-L prune reason was actually HA sync - cache->release(flow, PruneReason::USER); + cache->release(flow, PruneReason::HA); } void FlowControl::delete_flow(Flow* flow, PruneReason reason) diff --git a/src/flow/prune_stats.h b/src/flow/prune_stats.h index c190347b2..808e2ee2c 100644 --- a/src/flow/prune_stats.h +++ b/src/flow/prune_stats.h @@ -26,17 +26,15 @@ #include "framework/counts.h" -// FIXIT-L we can probably fiddle with these breakdowns enum class PruneReason : uint8_t { - // FIXIT-L do we want to count purges? yes - PURGE = 0, - TIMEOUT, + IDLE, EXCESS, UNI, PREEMPTIVE, MEMCAP, - USER, + HA, + NONE, MAX }; @@ -61,7 +59,7 @@ struct PruneStats inline PegCount PruneStats::get_total() const { PegCount total = 0; - for ( reason_t i = 0; i < static_cast(PruneReason::MAX); ++i ) + for ( reason_t i = 0; i < static_cast(PruneReason::NONE); ++i ) total += prunes[i]; return total; diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc index a4e9b4f47..0e45ded4e 100644 --- a/src/stream/base/stream_base.cc +++ b/src/stream/base/stream_base.cc @@ -45,18 +45,18 @@ THREAD_LOCAL BaseStats stream_base_stats; #define PROTO_PEGS(proto_str) \ { proto_str " flows", "total " proto_str " sessions" }, \ { proto_str " total prunes", "total " proto_str " sessions pruned" }, \ - { proto_str " timeout prunes", proto_str " sessions pruned due to timeout" }, \ + { proto_str " idle prunes", proto_str " sessions pruned due to timeout" }, \ { proto_str " excess prunes", proto_str " sessions pruned due to excess" }, \ { proto_str " uni prunes", proto_str " uni sessions pruned" }, \ { proto_str " preemptive prunes", proto_str " sessions pruned during preemptive pruning" }, \ { proto_str " memcap prunes", proto_str " sessions pruned due to memcap" }, \ - { proto_str " user prunes", proto_str " sessions pruned for other reasons" } + { proto_str " ha prunes", proto_str " sessions pruned by high availability sync" } #define SET_PROTO_COUNTS(proto, pkttype) \ stream_base_stats.proto ## _flows = flow_con->get_flows(PktType::pkttype); \ stream_base_stats.proto ## _total_prunes = flow_con->get_total_prunes(PktType::pkttype), \ stream_base_stats.proto ## _timeout_prunes = \ - flow_con->get_prunes(PktType::pkttype, PruneReason::TIMEOUT), \ + flow_con->get_prunes(PktType::pkttype, PruneReason::IDLE), \ stream_base_stats.proto ## _excess_prunes = \ flow_con->get_prunes(PktType::pkttype, PruneReason::EXCESS), \ stream_base_stats.proto ## _uni_prunes = \ @@ -65,8 +65,8 @@ THREAD_LOCAL BaseStats stream_base_stats; flow_con->get_prunes(PktType::pkttype, PruneReason::PREEMPTIVE), \ stream_base_stats.proto ## _memcap_prunes = \ flow_con->get_prunes(PktType::pkttype, PruneReason::MEMCAP), \ - stream_base_stats.proto ## _user_prunes = \ - flow_con->get_prunes(PktType::pkttype, PruneReason::USER) + stream_base_stats.proto ## _ha_prunes = \ + flow_con->get_prunes(PktType::pkttype, PruneReason::HA) // FIXIT-L dependency on stats define in another file const PegInfo base_pegs[] = diff --git a/src/stream/base/stream_module.h b/src/stream/base/stream_module.h index 4e4d28f0f..0067be740 100644 --- a/src/stream/base/stream_module.h +++ b/src/stream/base/stream_module.h @@ -43,7 +43,7 @@ struct SnortConfig; PegCount proto ## _uni_prunes; \ PegCount proto ## _preemptive_prunes; \ PegCount proto ## _memcap_prunes; \ - PegCount proto ## _user_prunes + PegCount proto ## _ha_prunes struct BaseStats { diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc index 718eb3d32..c0287345a 100644 --- a/src/stream/icmp/icmp_session.cc +++ b/src/stream/icmp/icmp_session.cc @@ -60,12 +60,6 @@ THREAD_LOCAL ProfileStats icmp_perf_stats; static void IcmpSessionCleanup(Flow* ssn) { - if (ssn->ssn_state.session_flags & SSNFLAG_PRUNED) - icmpStats.prunes++; - - else if (ssn->ssn_state.session_flags & SSNFLAG_TIMEDOUT) - icmpStats.timeouts++; - if ( ssn->ssn_state.session_flags & SSNFLAG_SEEN_SENDER ) icmpStats.released++; diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc index f115786a1..c96501cd6 100644 --- a/src/stream/ip/ip_defrag.cc +++ b/src/stream/ip/ip_defrag.cc @@ -1282,6 +1282,7 @@ void Defrag::process(Packet* p, FragTracker* ft) else { release_tracker(ft); + p->flow->session_state |= STREAM_STATE_CLOSED; } } } diff --git a/src/stream/ip/ip_session.cc b/src/stream/ip/ip_session.cc index abcb85e94..776367a85 100644 --- a/src/stream/ip/ip_session.cc +++ b/src/stream/ip/ip_session.cc @@ -34,8 +34,8 @@ const PegInfo ip_pegs[] = { SESSION_PEGS("ip"), - { "total", "total fragments" }, - { "current", "current fragments" }, + { "total frags", "total fragments" }, + { "current frags", "current fragments" }, { "max frags", "max fragments" }, { "reassembled", "reassembled datagrams" }, { "discards", "fragments discarded" }, @@ -71,12 +71,6 @@ static void IpSessionCleanup(Flow* lws, FragTracker* tracker) d->cleanup(tracker); } - if ( lws->ssn_state.session_flags & SSNFLAG_TIMEDOUT ) - ip_stats.timeouts++; - - else if ( lws->ssn_state.session_flags & SSNFLAG_PRUNED ) - ip_stats.prunes++; - ip_stats.released++; lws->restart(); } @@ -166,6 +160,7 @@ int IpSession::process(Packet* p) if ( Stream::expired_flow(flow, p) ) { + ip_stats.timeouts++; IpSessionCleanup(flow, &tracker); #ifdef ENABLE_EXPECTED_IP diff --git a/src/stream/stream.cc b/src/stream/stream.cc index 94b029c28..05575244c 100644 --- a/src/stream/stream.cc +++ b/src/stream/stream.cc @@ -172,8 +172,7 @@ void Stream::check_flow_closed(Packet* p) if (flow->session_state & STREAM_STATE_CLOSED) { assert(flow_con); - // FIXIT-L prune reason was actually 'closed' - flow_con->delete_flow(flow, PruneReason::USER); + flow_con->delete_flow(flow, PruneReason::NONE); p->flow = nullptr; } } diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index 8d95c2ef3..91fe763d7 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -56,6 +56,7 @@ #include "detection/detection_util.h" #include "hash/sfxhash.h" #include "utils/util.h" +#include "utils/util_net.h" #include "utils/sflsq.h" #include "time/packet_time.h" #include "perf_monitor/flow_ip_tracker.h" @@ -177,12 +178,6 @@ void TcpSession::clear_session(bool free_flow_data, bool flush_segments, bool re else return; - if ( flow->get_session_flags() & SSNFLAG_PRUNED ) - tcpStats.prunes++; - - else if ( flow->get_session_flags() & SSNFLAG_TIMEDOUT ) - tcpStats.timeouts++; - update_perf_base_state(TcpStreamTracker::TCP_CLOSED); if ( restart ) diff --git a/src/stream/tcp/tcp_state_close_wait.cc b/src/stream/tcp/tcp_state_close_wait.cc index 15d17df5d..abace5fcc 100644 --- a/src/stream/tcp/tcp_state_close_wait.cc +++ b/src/stream/tcp/tcp_state_close_wait.cc @@ -139,6 +139,7 @@ bool TcpStateCloseWait::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tr trk.session->update_session_on_rst(tsd, true); trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING); trk.session->set_pkt_action_flag(ACTION_RST); + tsd.get_pkt()->flow->session_state |= STREAM_STATE_CLOSED; } else { diff --git a/src/stream/tcp/tcp_state_closing.cc b/src/stream/tcp/tcp_state_closing.cc index 9a86024cc..80b6d948d 100644 --- a/src/stream/tcp/tcp_state_closing.cc +++ b/src/stream/tcp/tcp_state_closing.cc @@ -141,6 +141,7 @@ bool TcpStateClosing::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk) trk.session->update_session_on_rst(tsd, true); trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING); trk.session->set_pkt_action_flag(ACTION_RST); + tsd.get_pkt()->flow->session_state |= STREAM_STATE_CLOSED; } else { diff --git a/src/stream/tcp/tcp_state_fin_wait1.cc b/src/stream/tcp/tcp_state_fin_wait1.cc index e40665e8c..20e177c5e 100644 --- a/src/stream/tcp/tcp_state_fin_wait1.cc +++ b/src/stream/tcp/tcp_state_fin_wait1.cc @@ -146,6 +146,7 @@ bool TcpStateFinWait1::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk trk.session->update_session_on_rst(tsd, true); trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING); trk.session->set_pkt_action_flag(ACTION_RST); + tsd.get_pkt()->flow->session_state |= STREAM_STATE_CLOSED; } else { diff --git a/src/stream/tcp/tcp_state_fin_wait2.cc b/src/stream/tcp/tcp_state_fin_wait2.cc index a9e4415a2..3b79e1e53 100644 --- a/src/stream/tcp/tcp_state_fin_wait2.cc +++ b/src/stream/tcp/tcp_state_fin_wait2.cc @@ -154,6 +154,7 @@ bool TcpStateFinWait2::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk trk.session->update_session_on_rst(tsd, true); trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING); trk.session->set_pkt_action_flag(ACTION_RST); + tsd.get_pkt()->flow->session_state |= STREAM_STATE_CLOSED; } else { diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc index cac2649a5..41bf4f130 100644 --- a/src/stream/udp/udp_session.cc +++ b/src/stream/udp/udp_session.cc @@ -59,12 +59,6 @@ THREAD_LOCAL ProfileStats udp_perf_stats; static void UdpSessionCleanup(Flow* lwssn) { - if (lwssn->ssn_state.session_flags & SSNFLAG_PRUNED) - udpStats.prunes++; - - else if (lwssn->ssn_state.session_flags & SSNFLAG_TIMEDOUT) - udpStats.timeouts++; - if ( lwssn->ssn_state.session_flags & SSNFLAG_SEEN_SENDER ) udpStats.released++; } @@ -196,6 +190,7 @@ int UdpSession::process(Packet* p) // Should be done before we do something with the packet... if ( Stream::expired_flow(flow, p) ) { + udpStats.timeouts++; UdpSessionCleanup(flow); flow->restart(); flow->ssn_state.session_flags |= SSNFLAG_SEEN_SENDER;