|
|
|
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
|
|
|
*
|
|
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
|
|
* the GNU General Public License version 2 as published by the Free
|
|
|
|
* Software Foundation.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
|
|
* 02110-1301, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/**
|
|
|
|
* \file
|
|
|
|
*
|
|
|
|
* \author Victor Julien <victor@inliniac.net>
|
|
|
|
*
|
|
|
|
* Common includes, etc.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef __SURICATA_COMMON_H__
|
|
|
|
#define __SURICATA_COMMON_H__
|
|
|
|
|
|
|
|
#ifdef DEBUG
|
|
|
|
#define DBG_PERF
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#define TRUE 1
|
|
|
|
#define FALSE 0
|
|
|
|
|
|
|
|
#define _GNU_SOURCE
|
|
|
|
#define __USE_GNU
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdint.h>
|
|
|
|
#include <stdarg.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <errno.h>
|
|
|
|
#include <unistd.h>
|
|
|
|
#include <inttypes.h>
|
|
|
|
#include <limits.h>
|
|
|
|
#include <ctype.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <fcntl.h>
|
|
|
|
#include <time.h>
|
|
|
|
|
|
|
|
#if HAVE_SYS_SYSCALL_H
|
|
|
|
#include <sys/syscall.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#if HAVE_SYSCALL_H
|
|
|
|
#include <syscall.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <sys/types.h> /* for gettid(2) */
|
|
|
|
#include <sched.h> /* for sched_setaffinity(2) */
|
|
|
|
|
|
|
|
#include <pcre.h>
|
|
|
|
|
|
|
|
#if HAVE_CONFIG_H
|
|
|
|
#include <config.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef HAVE_SYSLOG_H
|
|
|
|
#include <syslog.h>
|
|
|
|
#else
|
|
|
|
#ifdef OS_WIN32
|
|
|
|
#include "win32-syslog.h"
|
|
|
|
#endif /* OS_WIN32 */
|
|
|
|
#endif /* HAVE_SYSLOG_H */
|
|
|
|
|
|
|
|
#ifdef OS_WIN32
|
|
|
|
#include "win32-misc.h"
|
|
|
|
#include "win32-service.h"
|
|
|
|
#endif /* OS_WIN32 */
|
|
|
|
|
|
|
|
#include <sys/time.h>
|
|
|
|
|
|
|
|
#if HAVE_POLL_H
|
|
|
|
#include <poll.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#if HAVE_SYS_SIGNAL_H
|
|
|
|
#include <sys/signal.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#if HAVE_SIGNAL_H
|
|
|
|
#include <signal.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <sys/types.h>
|
|
|
|
|
|
|
|
#if HAVE_SYS_SOCKET_H
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <sys/stat.h>
|
|
|
|
|
|
|
|
#if HAVE_NETINET_IN_H
|
|
|
|
#include <netinet/in.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#if HAVE_ARPA_INET_H
|
|
|
|
#include <arpa/inet.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#if HAVE_NETDB_H
|
|
|
|
#include <netdb.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef HAVE_WINDOWS_H
|
|
|
|
#ifndef _WIN32_WINNT
|
|
|
|
#define _WIN32_WINNT 0x0501
|
|
|
|
#endif
|
|
|
|
#include <windows.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef HAVE_WINSOCK2_H
|
|
|
|
#include <winsock2.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef HAVE_WS2TCPIP_H
|
|
|
|
#include <ws2tcpip.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <assert.h>
|
|
|
|
#define BUG_ON(x) assert(!(x))
|
|
|
|
|
|
|
|
/* we need this to stringify the defines which are supplied at compiletime see:
|
|
|
|
http://gcc.gnu.org/onlinedocs/gcc-3.4.1/cpp/Stringification.html#Stringification */
|
|
|
|
#define xstr(s) str(s)
|
|
|
|
#define str(s) #s
|
|
|
|
|
|
|
|
/** type for the internal signature id. Since it's used in the matching engine
|
|
|
|
* extensively keeping this as small as possible reduces the overall memory
|
|
|
|
* footprint of the engine. Set to uint32_t if the engine needs to support
|
|
|
|
* more than 64k sigs. */
|
|
|
|
#define SigIntId uint16_t
|
|
|
|
//#define SigIntId uint32_t
|
|
|
|
|
|
|
|
/** same for pattern id's */
|
|
|
|
#define PatIntId uint16_t
|
|
|
|
|
|
|
|
/** FreeBSD does not define __WORDSIZE, but it uses __LONG_BIT */
|
|
|
|
#ifndef __WORDSIZE
|
|
|
|
#ifdef __LONG_BIT
|
|
|
|
#define __WORDSIZE __LONG_BIT
|
|
|
|
#else
|
|
|
|
#ifdef LONG_BIT
|
|
|
|
#define __WORDSIZE LONG_BIT
|
|
|
|
#endif
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/** Windows does not define __WORDSIZE, but it uses __X86__ */
|
|
|
|
#if defined(__X86__) || defined(_X86_)
|
|
|
|
#define __WORDSIZE 32
|
|
|
|
#else
|
|
|
|
#if defined(__X86_64__) || defined(_X86_64_)
|
|
|
|
#define __WORDSIZE 64
|
|
|
|
#endif
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifndef __WORDSIZE
|
|
|
|
#warning Defaulting to __WORDSIZE 32
|
|
|
|
#define __WORDSIZE 32
|
|
|
|
#endif
|
|
|
|
#endif
|
|
|
|
|
|
|
|
typedef enum PacketProfileDetectId_ {
|
|
|
|
PROF_DETECT_MPM,
|
|
|
|
PROF_DETECT_MPM_PACKET, /* PKT MPM */
|
|
|
|
PROF_DETECT_MPM_PKT_STREAM, /* PKT inspected with stream MPM */
|
|
|
|
PROF_DETECT_MPM_STREAM, /* STREAM MPM */
|
|
|
|
PROF_DETECT_MPM_URI,
|
|
|
|
PROF_DETECT_MPM_HCBD,
|
|
|
|
PROF_DETECT_MPM_HSBD,
|
|
|
|
PROF_DETECT_MPM_HHD,
|
|
|
|
PROF_DETECT_MPM_HRHD,
|
|
|
|
PROF_DETECT_MPM_HMD,
|
|
|
|
PROF_DETECT_MPM_HCD,
|
|
|
|
PROF_DETECT_MPM_HRUD,
|
|
|
|
PROF_DETECT_IPONLY,
|
|
|
|
PROF_DETECT_RULES,
|
|
|
|
PROF_DETECT_STATEFUL,
|
|
|
|
PROF_DETECT_PREFILTER,
|
|
|
|
PROF_DETECT_ALERT,
|
|
|
|
PROF_DETECT_CLEANUP,
|
|
|
|
PROF_DETECT_GETSGH,
|
|
|
|
|
|
|
|
PROF_DETECT_SIZE,
|
|
|
|
} PacketProfileDetectId;
|
|
|
|
|
|
|
|
#include <htp/htp.h>
|
|
|
|
#include "threads.h"
|
Add per packet profiling.
Per packet profiling uses tick based accounting. It has 2 outputs, a summary
and a csv file that contains per packet stats.
Stats per packet include:
1) total ticks spent
2) ticks spent per individual thread module
3) "threading overhead" which is simply calculated by subtracting (2) of (1).
A number of changes were made to integrate the new code in a clean way:
a number of generic enums are now placed in tm-threads-common.h so we can
include them from any part of the engine.
Code depends on --enable-profiling just like the rule profiling code.
New yaml parameters:
profiling:
# packet profiling
packets:
# Profiling can be disabled here, but it will still have a
# performance impact if compiled in.
enabled: yes
filename: packet_stats.log
append: yes
# per packet csv output
csv:
# Output can be disabled here, but it will still have a
# performance impact if compiled in.
enabled: no
filename: packet_stats.csv
Example output of summary stats:
IP ver Proto cnt min max avg
------ ----- ------ ------ ---------- -------
IPv4 6 19436 11448 5404365 32993
IPv4 256 4 11511 49968 30575
Per Thread module stats:
Thread Module IP ver Proto cnt min max avg
------------------------ ------ ----- ------ ------ ---------- -------
TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770
TMM_DETECT IPv4 6 19436 1107 137241 1504
TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155
TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138
TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154
TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944
TMM_STREAMTCP IPv4 6 19434 828 1299159 19438
The proto 256 is a counter for handling of pseudo/tunnel packets.
Example output of csv:
pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading
1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337
First line of the file contains labels.
2 example gnuplot scripts added to plot the data.
14 years ago
|
|
|
#include "tm-threads-common.h"
|
|
|
|
#include "util-debug.h"
|
|
|
|
#include "util-error.h"
|
|
|
|
#include "util-mem.h"
|
|
|
|
#include "detect-engine-alert.h"
|
|
|
|
#include "util-optimize.h"
|
|
|
|
#include "util-path.h"
|
|
|
|
|
|
|
|
size_t strlcat(char *, const char *src, size_t siz);
|
|
|
|
size_t strlcpy(char *dst, const char *src, size_t siz);
|
|
|
|
|
|
|
|
#endif /* __SURICATA_COMMON_H__ */
|
|
|
|
|