aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

new registration functions for the stats api, with local thread storage for counter ids

Browse Source
remotes/origin/master-1.0.x
Anoop Saldanha 17 years ago committed by Victor Julien
parent d67eec918f
commit 244f5d547a
22 changed files with 480 additions and 270 deletions
Show Stats Download Patch File Download Diff File

197
src/counters.c
Unescape Escape View File

@ -201,16 +201,16 @@ void * PerfWakeupThread(void *arg)
* *
* \param cname Counter name to be registered * \param cname Counter name to be registered
* \param tm_name Thread module name * \param tm_name Thread module name
* \param tid Thread id running this module instance
* \param type Datatype of this counter variable * \param type Datatype of this counter variable
* \param desc Description of this counter * \param desc Description of this counter
* \param pctx PerfContext for this tm-tv instance * \param pctx PerfContext for this tm-tv instance
* \param type_q Qualifier describing the counter to be registered
* *
* \retval the counter id * \retval the counter id
*/ */
uint32_t PerfRegisterCounter(char *cname, char *tm_name, int type, static u_int64_t PerfRegisterQualifiedCounter(char *cname, char *tm_name,
char *desc, PerfContext *pctx, int type_q, int type, char *desc,
int disp) PerfContext *pctx, int type_q)
{ {
PerfCounter **head = &pctx->head; PerfCounter **head = &pctx->head;
PerfCounter *temp = NULL; PerfCounter *temp = NULL;
@ -302,11 +302,91 @@ uint32_t PerfRegisterCounter(char *cname, char *tm_name, int type,
pc->type_q = type_q; pc->type_q = type_q;
pc->disp = disp; pc->disp = 1;
return pc->id; return pc->id;
} }
u_int64_t PerfTVRegisterCounter(char *cname, struct ThreadVars_ *tv, int type,
char *desc)
{
return PerfRegisterQualifiedCounter(cname, tv->name, type, desc,
&tv->pctx, TYPE_Q_NORMAL);
}
u_int64_t PerfTVRegisterAvgCounter(char *cname, struct ThreadVars_ *tv,
int type, char *desc)
{
return PerfRegisterQualifiedCounter(cname, tv->name, type, desc,
&tv->pctx, TYPE_Q_AVERAGE);
}
u_int64_t PerfTVRegisterMaxCounter(char *cname, struct ThreadVars_ *tv,
int type, char *desc)
{
return PerfRegisterQualifiedCounter(cname, tv->name, type, desc,
&tv->pctx, TYPE_Q_MAXIMUM);
}
u_int64_t PerfRegisterCounter(char *cname, char *tm_name, int type, char *desc,
PerfContext *pctx)
{
return PerfRegisterQualifiedCounter(cname, tm_name, type, desc,
pctx, TYPE_Q_NORMAL);
}
u_int64_t PerfRegisterAvgCounter(char *cname, char *tm_name, int type,
char *desc, PerfContext *pctx)
{
return PerfRegisterQualifiedCounter(cname, tm_name, type, desc,
pctx, TYPE_Q_AVERAGE);
}
u_int64_t PerfRegisterMaxCounter(char *cname, char *tm_name, int type,
char *desc, PerfContext *pctx)
{
return PerfRegisterQualifiedCounter(cname, tm_name, type, desc,
pctx, TYPE_Q_MAXIMUM);
}
/**
* \brief Allows the user the set whether the counter identified with the id
* should be displayed or not in the output
*
* \param id Id of the counter
* \param pctx Pointer to the PerfContext in which the counter exists
* \param disp Holds a 0 or a non-zero value, based on whether the counter
* should be displayed or not in the output
*
* \retval 1 on success, 0 on failure
*/
int PerfCounterDisplay(u_int64_t id, PerfContext *pctx, int disp)
{
PerfCounter *pc = NULL;
if (pctx == NULL) {
#ifdef DEBUG
printf("pctx null inside PerfCounterDisplay\n");
#endif
return 0;
}
if ( (id < 1) || (id > pctx->curr_id) ) {
#ifdef DEBUG
printf("counter with the id %d doesn't exist in this tm instance", id);
#endif
return 0;
}
pc = pctx->head;
while(pc->id != id)
pc = pc->next;
pc->disp = (disp != 0);
return 1;
}
/** /**
* \brief Increments the local counter * \brief Increments the local counter
* *
@ -457,14 +537,14 @@ inline void PerfCounterSetUI64(uint64_t id, PerfCounterArray *pca,
if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) { if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) {
if (x > pca->head[id].ui64_cnt) if (x > pca->head[id].ui64_cnt)
pca->head[id].ui64_cnt = x; pca->head[id].ui64_cnt = x;
} else if (pca->head[id].pc->type_q & TYPE_Q_NONE) } else if (pca->head[id].pc->type_q & TYPE_Q_NORMAL)
pca->head[id].ui64_cnt = x; pca->head[id].ui64_cnt = x;
break; break;
case TYPE_DOUBLE: case TYPE_DOUBLE:
if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) { if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) {
if (x > pca->head[id].d_cnt) if (x > pca->head[id].d_cnt)
pca->head[id].d_cnt = x; pca->head[id].d_cnt = x;
} else if (pca->head[id].pc->type_q & TYPE_Q_NONE) } else if (pca->head[id].pc->type_q & TYPE_Q_NORMAL)
pca->head[id].d_cnt = x; pca->head[id].d_cnt = x;
break; break;
} }
@ -507,14 +587,14 @@ inline void PerfCounterSetDouble(uint64_t id, PerfCounterArray *pca,
if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) { if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) {
if (x > pca->head[id].ui64_cnt) if (x > pca->head[id].ui64_cnt)
pca->head[id].ui64_cnt = x; pca->head[id].ui64_cnt = x;
} else if (pca->head[id].pc->type_q & TYPE_Q_NONE) } else if (pca->head[id].pc->type_q & TYPE_Q_NORMAL)
pca->head[id].ui64_cnt = x; pca->head[id].ui64_cnt = x;
break; break;
case TYPE_DOUBLE: case TYPE_DOUBLE:
if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) { if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) {
if (x > pca->head[id].d_cnt) if (x > pca->head[id].d_cnt)
pca->head[id].d_cnt = x; pca->head[id].d_cnt = x;
} else if (pca->head[id].pc->type_q & TYPE_Q_NONE) } else if (pca->head[id].pc->type_q & TYPE_Q_NORMAL)
pca->head[id].d_cnt = x; pca->head[id].d_cnt = x;
break; break;
} }
@ -534,8 +614,10 @@ inline void PerfCounterSetDouble(uint64_t id, PerfCounterArray *pca,
* *
* \param tm_name Name of the tm to be added to the table * \param tm_name Name of the tm to be added to the table
* \param pctx PerfContext associated with the TM tm_name * \param pctx PerfContext associated with the TM tm_name
*
* \retval 1 on success, 0 on failure
*/ */
void PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx) int PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
{ {
PerfClubTMInst *pctmi = NULL; PerfClubTMInst *pctmi = NULL;
PerfClubTMInst *prev = NULL; PerfClubTMInst *prev = NULL;
@ -543,6 +625,13 @@ void PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
PerfContext **hpctx; PerfContext **hpctx;
int i = 0; int i = 0;
if (tm_name == NULL || pctx == NULL) {
#ifdef DEBUG
printf("Supplied argument(s) to PerfAddToClubbedTMTable NULL\n");
#endif
return 0;
}
pthread_mutex_lock(&perf_op_ctx->pctmi_lock); pthread_mutex_lock(&perf_op_ctx->pctmi_lock);
pctmi = perf_op_ctx->pctmi; pctmi = perf_op_ctx->pctmi;
@ -575,7 +664,7 @@ void PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
prev->next = temp; prev->next = temp;
pthread_mutex_unlock(&perf_op_ctx->pctmi_lock); pthread_mutex_unlock(&perf_op_ctx->pctmi_lock);
return; return 1;
} }
hpctx = pctmi->head; hpctx = pctmi->head;
@ -584,7 +673,7 @@ void PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
continue; continue;
pthread_mutex_unlock(&perf_op_ctx->pctmi_lock); pthread_mutex_unlock(&perf_op_ctx->pctmi_lock);
return; return 1;
} }
pctmi->head = realloc(pctmi->head, (pctmi->size + 1) * pctmi->head = realloc(pctmi->head, (pctmi->size + 1) *
@ -604,7 +693,7 @@ void PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
pthread_mutex_unlock(&perf_op_ctx->pctmi_lock); pthread_mutex_unlock(&perf_op_ctx->pctmi_lock);
return; return 1;
} }
@ -705,7 +794,7 @@ PerfCounterArray * PerfGetAllCountersArray(PerfContext *pctx)
* *
* \retval 1 on success, 0 on failure * \retval 1 on success, 0 on failure
*/ */
int PerfUpdateCounter(char *cname, char *tm_name, uint32_t id, void *value, int PerfUpdateCounter(char *cname, char *tm_name, u_int64_t id, void *value,
PerfContext *pctx) PerfContext *pctx)
{ {
PerfCounter *pc = NULL; PerfCounter *pc = NULL;
@ -1101,7 +1190,7 @@ void PerfReleasePCA(PerfCounterArray *pca)
} }
//------------------------------------Unit_Tests------------------------------------ //------------------------------------Unit_Tests--------------------------------
static int PerfTestCounterReg01() static int PerfTestCounterReg01()
@ -1110,7 +1199,7 @@ static int PerfTestCounterReg01()
memset(&pctx, 0, sizeof(PerfContext)); memset(&pctx, 0, sizeof(PerfContext));
return PerfRegisterCounter("t1", "c1", 5, NULL, &pctx, TYPE_Q_NONE, 1); return PerfRegisterCounter("t1", "c1", 5, NULL, &pctx);
} }
static int PerfTestCounterReg02() static int PerfTestCounterReg02()
@ -1119,8 +1208,7 @@ static int PerfTestCounterReg02()
memset(&pctx, 0, sizeof(PerfContext)); memset(&pctx, 0, sizeof(PerfContext));
return PerfRegisterCounter(NULL, NULL, TYPE_UINT64, NULL, &pctx, return PerfRegisterCounter(NULL, NULL, TYPE_UINT64, NULL, &pctx);
TYPE_Q_NONE, 1);
} }
static int PerfTestCounterReg03() static int PerfTestCounterReg03()
@ -1130,8 +1218,7 @@ static int PerfTestCounterReg03()
memset(&pctx, 0, sizeof(PerfContext)); memset(&pctx, 0, sizeof(PerfContext));
result = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx, result = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx);
TYPE_Q_NONE, 1);
PerfReleasePerfCounterS(pctx.head); PerfReleasePerfCounterS(pctx.head);
@ -1145,12 +1232,11 @@ static int PerfTestCounterReg04()
memset(&pctx, 0, sizeof(PerfContext)); memset(&pctx, 0, sizeof(PerfContext));
PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx, TYPE_Q_NONE, 1); PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx);
PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &pctx, TYPE_Q_NONE, 1); PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &pctx);
PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &pctx, TYPE_Q_NONE, 1); PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &pctx);
result = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx, result = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx);
TYPE_Q_NONE, 1);
PerfReleasePerfCounterS(pctx.head); PerfReleasePerfCounterS(pctx.head);
@ -1164,8 +1250,7 @@ static int PerfTestGetCntArray05()
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx, id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
TYPE_Q_NONE, 1);
tv.pca = PerfGetAllCountersArray(NULL); tv.pca = PerfGetAllCountersArray(NULL);
@ -1180,8 +1265,7 @@ static int PerfTestGetCntArray06()
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx, id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
TYPE_Q_NONE, 1);
tv.pca = PerfGetAllCountersArray(&tv.pctx); tv.pca = PerfGetAllCountersArray(&tv.pctx);
@ -1203,10 +1287,8 @@ static int PerfTestCntArraySize07()
pca = (PerfCounterArray *)&tv.pca; pca = (PerfCounterArray *)&tv.pca;
PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx, TYPE_Q_NONE, PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
1); PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx);
PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx, TYPE_Q_NONE,
1);
pca = PerfGetAllCountersArray(&tv.pctx); pca = PerfGetAllCountersArray(&tv.pctx);
@ -1230,8 +1312,7 @@ static int PerfTestUpdateCounter08()
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx, id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
TYPE_Q_NONE, 1);
pca = PerfGetAllCountersArray(&tv.pctx); pca = PerfGetAllCountersArray(&tv.pctx);
@ -1255,16 +1336,11 @@ static int PerfTestUpdateCounter09()
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx, id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
TYPE_Q_NONE, 1); PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx);
PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx, PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx);
TYPE_Q_NONE, 1); PerfRegisterCounter("t4", "c4", TYPE_UINT64, NULL, &tv.pctx);
PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx, id2 = PerfRegisterCounter("t5", "c5", TYPE_UINT64, NULL, &tv.pctx);
TYPE_Q_NONE, 1);
PerfRegisterCounter("t4", "c4", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id2 = PerfRegisterCounter("t5", "c5", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
pca = PerfGetAllCountersArray(&tv.pctx); pca = PerfGetAllCountersArray(&tv.pctx);
@ -1290,12 +1366,10 @@ static int PerfTestUpdateGlobalCounter10()
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx, id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
TYPE_Q_NONE, 1); id2 = PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx);
id2 = PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx, id3 = PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx);
TYPE_Q_NONE, 1);
id3 = PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
pca = PerfGetAllCountersArray(&tv.pctx); pca = PerfGetAllCountersArray(&tv.pctx);
PerfCounterIncr(id1, pca); PerfCounterIncr(id1, pca);
@ -1331,14 +1405,10 @@ static int PerfTestCounterValues11()
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx, id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
TYPE_Q_NONE, 1); id2 = PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx);
id2 = PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx, id3 = PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx);
TYPE_Q_NONE, 1); id4 = PerfRegisterCounter("t4", "c4", TYPE_UINT64, NULL, &tv.pctx);
id3 = PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id4 = PerfRegisterCounter("t4", "c4", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
pca = PerfGetAllCountersArray(&tv.pctx); pca = PerfGetAllCountersArray(&tv.pctx);
@ -1391,10 +1461,8 @@ static int PerfTestAverageQual12()
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
id1 = PerfRegisterCounter("t1", "c1", TYPE_DOUBLE, NULL, &tv.pctx, id1 = PerfRegisterAvgCounter("t1", "c1", TYPE_DOUBLE, NULL, &tv.pctx);
TYPE_Q_AVERAGE, 1); id2 = PerfRegisterAvgCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx);
id2 = PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_AVERAGE, 1);
pca = PerfGetAllCountersArray(&tv.pctx); pca = PerfGetAllCountersArray(&tv.pctx);
@ -1442,8 +1510,7 @@ static int PerfTestMaxQual13()
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
id1 = PerfRegisterCounter("t1", "c1", TYPE_DOUBLE, NULL, &tv.pctx, id1 = PerfRegisterMaxCounter("t1", "c1", TYPE_DOUBLE, NULL, &tv.pctx);
TYPE_Q_MAXIMUM, 1);
p = tv.pctx.head->value->cvalue; p = tv.pctx.head->value->cvalue;

48
src/counters.h
Unescape Escape View File

@ -5,6 +5,8 @@
#ifndef __COUNTERS_H__ #ifndef __COUNTERS_H__
#define __COUNTERS_H__ #define __COUNTERS_H__
/* forward declaration of the ThreadVars structure */
struct ThreadVars_;
/* Time interval for syncing the local counters with the global ones */ /* Time interval for syncing the local counters with the global ones */
#define WUT_TTS 3 #define WUT_TTS 3
@ -21,7 +23,7 @@ enum {
/* Qualifier for the counter */ /* Qualifier for the counter */
enum { enum {
TYPE_Q_NONE = 0x01, TYPE_Q_NORMAL = 0x01,
TYPE_Q_AVERAGE = 0x02, TYPE_Q_AVERAGE = 0x02,
TYPE_Q_MAXIMUM = 0x04, TYPE_Q_MAXIMUM = 0x04,
TYPE_Q_TIMEBASED = 0x08, TYPE_Q_TIMEBASED = 0x08,
@ -36,20 +38,20 @@ enum {
IFACE_SYSLOG, IFACE_SYSLOG,
}; };
typedef struct _PerfCounterName { typedef struct PerfCounterName_ {
char *cname; char *cname;
char *tm_name; char *tm_name;
pthread_t tid; pthread_t tid;
} PerfCounterName; } PerfCounterName;
typedef struct _PerfCounterValue { typedef struct PerfCounterValue_ {
void *cvalue; void *cvalue;
uint32_t size; uint32_t size;
uint32_t type; uint32_t type;
} PerfCounterValue; } PerfCounterValue;
/* Container to hold the counter variable */ /* Container to hold the counter variable */
typedef struct _PerfCounter { typedef struct PerfCounter_ {
PerfCounterName *name; PerfCounterName *name;
PerfCounterValue *value; PerfCounterValue *value;
@ -68,11 +70,11 @@ typedef struct _PerfCounter {
int type_q; int type_q;
/* the next perfcounter for this tv's tm instance */ /* the next perfcounter for this tv's tm instance */
struct _PerfCounter *next; struct PerfCounter_ *next;
} PerfCounter; } PerfCounter;
/* Holds the Perf Context for a ThreadVars instance */ /* Holds the Perf Context for a ThreadVars instance */
typedef struct _PerfContext { typedef struct PerfContext_ {
PerfCounter *head; PerfCounter *head;
/* flag set by the wakeup thread, to inform the client threads to sync */ /* flag set by the wakeup thread, to inform the client threads to sync */
@ -84,7 +86,7 @@ typedef struct _PerfContext {
} PerfContext; } PerfContext;
/* PerfCounterArray(PCA) Node*/ /* PerfCounterArray(PCA) Node*/
typedef struct _PCAElem { typedef struct PCAElem_ {
PerfCounter *pc; PerfCounter *pc;
uint64_t id; uint64_t id;
union { union {
@ -100,7 +102,7 @@ typedef struct _PCAElem {
} PCAElem; } PCAElem;
/* The PerfCounterArray */ /* The PerfCounterArray */
typedef struct _PerfCounterArray { typedef struct PerfCounterArray_ {
/* points to the array holding PCAElems */ /* points to the array holding PCAElems */
PCAElem *head; PCAElem *head;
@ -110,17 +112,17 @@ typedef struct _PerfCounterArray {
/* Holds multiple instances of the same TM together, used when the stats /* Holds multiple instances of the same TM together, used when the stats
* have to be clubbed based on TM, before being sent out*/ * have to be clubbed based on TM, before being sent out*/
typedef struct _PerfClubTMInst { typedef struct PerfClubTMInst_ {
char *tm_name; char *tm_name;
PerfContext **head; PerfContext **head;
uint32_t size; uint32_t size;
struct _PerfClubTMInst *next; struct PerfClubTMInst_ *next;
} PerfClubTMInst; } PerfClubTMInst;
/* Holds the output interface context for the counter api */ /* Holds the output interface context for the counter api */
typedef struct _PerfOPIfaceContext { typedef struct PerfOPIfaceContext_ {
uint32_t iface; uint32_t iface;
char *file; char *file;
@ -143,8 +145,23 @@ void * PerfMgmtThread(void *);
void * PerfWakeupThread(void *); void * PerfWakeupThread(void *);
uint32_t PerfRegisterCounter(char *, char *, int, char *, PerfContext *, int, u_int64_t PerfTVRegisterCounter(char *, struct ThreadVars_ *, int, char *);
int);
u_int64_t PerfTVRegisterAvgCounter(char *, struct ThreadVars_ *, int, char *);
u_int64_t PerfTVRegisterMaxCounter(char *, struct ThreadVars_ *, int, char *);
u_int64_t PerfTVRegisterIntervalCounter(char *, struct ThreadVars_ *, int, char *);
u_int64_t PerfRegisterCounter(char *, char *, int, char *, PerfContext *);
u_int64_t PerfRegisterAvgCounter(char *, char *, int, char *, PerfContext *);
u_int64_t PerfRegisterMaxCounter(char *, char *, int, char *, PerfContext *);
u_int64_t PerfRegisterIntervalCounter(char *, char *, int, char *, PerfContext *);
int PerfCounterDisplay(u_int64_t, PerfContext *, int);
inline void PerfCounterIncr(uint64_t, PerfCounterArray *); inline void PerfCounterIncr(uint64_t, PerfCounterArray *);
@ -156,7 +173,7 @@ inline void PerfCounterSetUI64(uint64_t, PerfCounterArray *, uint64_t);
inline void PerfCounterSetDouble(uint64_t, PerfCounterArray *, double); inline void PerfCounterSetDouble(uint64_t, PerfCounterArray *, double);
void PerfAddToClubbedTMTable(char *, PerfContext *); int PerfAddToClubbedTMTable(char *, PerfContext *);
PerfCounterArray * PerfGetCounterArrayRange(uint32_t, uint32_t, PerfCounterArray * PerfGetCounterArrayRange(uint32_t, uint32_t,
PerfContext *); PerfContext *);
@ -164,8 +181,7 @@ PerfCounterArray * PerfGetCounterArrayRange(uint32_t, uint32_t,
PerfCounterArray * PerfGetAllCountersArray(PerfContext *); PerfCounterArray * PerfGetAllCountersArray(PerfContext *);
int PerfUpdateCounter(char *, char *, uint32_t, void *, int PerfUpdateCounter(char *, char *, uint64_t, void *, PerfContext *);
PerfContext *);
int PerfUpdateCounterArray(PerfCounterArray *, PerfContext *, int); int PerfUpdateCounterArray(PerfCounterArray *, PerfContext *, int);

17
src/decode-ethernet.c
Unescape Escape View File

@ -4,9 +4,12 @@
#include "decode-ethernet.h" #include "decode-ethernet.h"
#include "decode-events.h" #include "decode-events.h"
void DecodeEthernet(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) void DecodeEthernet(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
PacketQueue *pq, void *data)
{ {
PerfCounterIncr(COUNTER_DECODER_ETH, t->pca); DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_eth, t->pca);
if (len < ETHERNET_HEADER_LEN) { if (len < ETHERNET_HEADER_LEN) {
DECODER_SET_EVENT(p,ETHERNET_PKT_TOO_SMALL); DECODER_SET_EVENT(p,ETHERNET_PKT_TOO_SMALL);
@ -23,14 +26,16 @@ void DecodeEthernet(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, Packet
if (ntohs(ethh->eth_type) == ETHERNET_TYPE_IP) { if (ntohs(ethh->eth_type) == ETHERNET_TYPE_IP) {
//printf("DecodeEthernet ip4\n"); //printf("DecodeEthernet ip4\n");
DecodeIPV4(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq); DecodeIPV4(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN,
pq, data);
} else if(ntohs(ethh->eth_type) == ETHERNET_TYPE_IPV6) { } else if(ntohs(ethh->eth_type) == ETHERNET_TYPE_IPV6) {
//printf("DecodeEthernet ip6\n"); //printf("DecodeEthernet ip6\n");
DecodeIPV6(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN); DecodeIPV6(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN,
data);
} else if(ntohs(ethh->eth_type) == ETHERNET_TYPE_PPPoE_SESS) { } else if(ntohs(ethh->eth_type) == ETHERNET_TYPE_PPPoE_SESS) {
//printf("DecodeEthernet PPPoE\n"); //printf("DecodeEthernet PPPoE\n");
PerfCounterIncr(COUNTER_DECODER_PPPOE, t->pca); DecodePPPoE(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN,
DecodePPPoE(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq); pq, data);
} }
return; return;

25
src/decode-icmpv4.c
Unescape Escape View File

@ -8,11 +8,14 @@
/** DecodeICMPV4 /** DecodeICMPV4
* \brief Main ICMPv4 decoding function * \brief Main ICMPv4 decoding function
*/ */
void DecodeICMPV4(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len) void DecodeICMPV4(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{ {
p->icmpv4h = (ICMPV4Hdr *)pkt; DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_icmpv4, t->pca);
PerfCounterIncr(COUNTER_DECODER_ICMPV4, t->pca); p->icmpv4h = (ICMPV4Hdr *)pkt;
if (len < ICMPV4_HEADER_LEN) { if (len < ICMPV4_HEADER_LEN) {
return; return;
@ -43,11 +46,13 @@ static int DecodeICMPV4test01(void) {
0xab }; 0xab };
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet)); memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4)); DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4), &dtv);
return 0; return 0;
} }
@ -66,11 +71,13 @@ static int DecodeICMPV4test02(void) {
0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f }; 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f };
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet)); memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4)); DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4), &dtv);
return 0; return 0;
} }
@ -87,11 +94,13 @@ static int DecodeICMPV4test03(void) {
0x00, 0x28, 0x7c, 0xdd }; 0x00, 0x28, 0x7c, 0xdd };
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet)); memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4)); DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4), &dtv);
return 0; return 0;
} }
@ -110,11 +119,13 @@ static int DecodeICMPV4test04(void) {
0x02, 0x04, 0x05, 0x8a, 0x04, 0x02, 0x08, 0x0a }; 0x02, 0x04, 0x05, 0x8a, 0x04, 0x02, 0x08, 0x0a };
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet)); memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4)); DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4), &dtv);
return 0; return 0;
} }

9
src/decode-icmpv6.c
Unescape Escape View File

@ -4,11 +4,14 @@
#include "decode.h" #include "decode.h"
#include "decode-icmpv6.h" #include "decode-icmpv6.h"
void DecodeICMPV6(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len) void DecodeICMPV6(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{ {
p->icmpv6h = (ICMPV6Hdr *)pkt; DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_icmpv6, t->pca);
PerfCounterIncr(COUNTER_DECODER_ICMPV6, t->pca); p->icmpv6h = (ICMPV6Hdr *)pkt;
if (len < ICMPV6_HEADER_LEN) { if (len < ICMPV6_HEADER_LEN) {
return; return;

20
src/decode-ipv4.c
Unescape Escape View File

@ -54,11 +54,13 @@ static int DecodeIPV4Packet(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len
return 0; return 0;
} }
void DecodeIPV4(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) void DecodeIPV4(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
PacketQueue *pq, void *data)
{ {
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
int ret; int ret;
PerfCounterIncr(COUNTER_DECODER_IPV4, t->pca); PerfCounterIncr(dtv->counter_ipv4, t->pca);
/* reset the decoder cache flags */ /* reset the decoder cache flags */
IPV4_CACHE_INIT(p); IPV4_CACHE_INIT(p);
@ -93,19 +95,23 @@ void DecodeIPV4(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueu
case IPPROTO_IP: case IPPROTO_IP:
/* check PPP VJ uncompressed packets and decode tcp dummy */ /* check PPP VJ uncompressed packets and decode tcp dummy */
if(p->ppph != NULL && ntohs(p->ppph->protocol) == PPP_VJ_UCOMP) { if(p->ppph != NULL && ntohs(p->ppph->protocol) == PPP_VJ_UCOMP) {
return(DecodeTCP(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p))); return(DecodeTCP(t, p, pkt + IPV4_GET_HLEN(p),
IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), data));
} }
break; break;
case IPPROTO_TCP: case IPPROTO_TCP:
return(DecodeTCP(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p))); return(DecodeTCP(t, p, pkt + IPV4_GET_HLEN(p),
IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), data));
break; break;
case IPPROTO_UDP: case IPPROTO_UDP:
//printf("DecodeIPV4: next layer is UDP\n"); //printf("DecodeIPV4: next layer is UDP\n");
return(DecodeUDP(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p))); return(DecodeUDP(t, p, pkt + IPV4_GET_HLEN(p),
IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), data));
break; break;
case IPPROTO_ICMP: case IPPROTO_ICMP:
//printf("DecodeIPV4: next layer is ICMP\n"); //printf("DecodeIPV4: next layer is ICMP\n");
return(DecodeICMPV4(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p))); return(DecodeICMPV4(t, p, pkt + IPV4_GET_HLEN(p),
IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), data));
break; break;
case IPPROTO_IPV6: case IPPROTO_IPV6:
{ {
@ -118,7 +124,7 @@ void DecodeIPV4(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueu
//printf("DecodeIPV4: tunnel is tp %p\n", tp); //printf("DecodeIPV4: tunnel is tp %p\n", tp);
/* send that to the Tunnel decoder */ /* send that to the Tunnel decoder */
DecodeTunnel(t, tp, tp->pkt, tp->pktlen, pq); DecodeTunnel(t, tp, tp->pkt, tp->pktlen, pq, data);
/* add the tp to the packet queue. */ /* add the tp to the packet queue. */
PacketEnqueue(pq,tp); PacketEnqueue(pq,tp);

27
src/decode-ipv6.c
Unescape Escape View File

@ -10,7 +10,8 @@
#define IPV6_EH_CNT ip6eh.ip6_exthdrs_cnt #define IPV6_EH_CNT ip6eh.ip6_exthdrs_cnt
static void static void
DecodeIPV6ExtHdrs(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len) DecodeIPV6ExtHdrs(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{ {
uint8_t *orig_pkt = pkt; uint8_t *orig_pkt = pkt;
uint8_t nh; uint8_t nh;
@ -31,17 +32,17 @@ DecodeIPV6ExtHdrs(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
{ {
case IPPROTO_TCP: case IPPROTO_TCP:
IPV6_SET_L4PROTO(p,nh); IPV6_SET_L4PROTO(p,nh);
DecodeTCP(t, p, pkt, plen); DecodeTCP(t, p, pkt, plen, data);
return; return;
case IPPROTO_UDP: case IPPROTO_UDP:
IPV6_SET_L4PROTO(p,nh); IPV6_SET_L4PROTO(p,nh);
DecodeUDP(t, p, pkt, plen); DecodeUDP(t, p, pkt, plen, data);
return; return;
case IPPROTO_ICMPV6: case IPPROTO_ICMPV6:
IPV6_SET_L4PROTO(p,nh); IPV6_SET_L4PROTO(p,nh);
DecodeICMPV6(t, p, pkt, plen); DecodeICMPV6(t, p, pkt, plen, data);
return; return;
case IPPROTO_ROUTING: case IPPROTO_ROUTING:
@ -360,11 +361,13 @@ static int DecodeIPV6Packet (ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t le
return 0; return 0;
} }
void DecodeIPV6(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len) void DecodeIPV6(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{ {
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
int ret; int ret;
PerfCounterIncr(COUNTER_DECODER_IPV6, t->pca); PerfCounterIncr(dtv->counter_ipv6, t->pca);
IPV6_CACHE_INIT(p); IPV6_CACHE_INIT(p);
@ -386,13 +389,16 @@ void DecodeIPV6(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
/* now process the Ext headers and/or the L4 Layer */ /* now process the Ext headers and/or the L4 Layer */
switch(IPV6_GET_NH(p)) { switch(IPV6_GET_NH(p)) {
case IPPROTO_TCP: case IPPROTO_TCP:
return(DecodeTCP(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p))); return(DecodeTCP(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p),
data));
break; break;
case IPPROTO_UDP: case IPPROTO_UDP:
return(DecodeUDP(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p))); return(DecodeUDP(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p),
data));
break; break;
case IPPROTO_ICMPV6: case IPPROTO_ICMPV6:
return(DecodeICMPV6(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p))); return(DecodeICMPV6(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p),
data));
break; break;
case IPPROTO_FRAGMENT: case IPPROTO_FRAGMENT:
case IPPROTO_HOPOPTS: case IPPROTO_HOPOPTS:
@ -401,7 +407,8 @@ void DecodeIPV6(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
case IPPROTO_DSTOPTS: case IPPROTO_DSTOPTS:
case IPPROTO_AH: case IPPROTO_AH:
case IPPROTO_ESP: case IPPROTO_ESP:
DecodeIPV6ExtHdrs(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p)); DecodeIPV6ExtHdrs(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p),
data);
break; break;
} }

31
src/decode-ppp.c
Unescape Escape View File

@ -11,9 +11,12 @@
#include "util-unittest.h" #include "util-unittest.h"
void DecodePPP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) void DecodePPP(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
PacketQueue *pq, void *data)
{ {
PerfCounterIncr(COUNTER_DECODER_PPP, t->pca); DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_ppp, t->pca);
if(len < PPP_HEADER_LEN) { if(len < PPP_HEADER_LEN) {
DECODER_SET_EVENT(p,PPP_PKT_TOO_SMALL); DECODER_SET_EVENT(p,PPP_PKT_TOO_SMALL);
@ -69,7 +72,8 @@ void DecodePPP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue
} }
if(IPV4_GET_RAW_VER((IPV4Hdr *)(pkt + PPP_HEADER_LEN)) == 4) { if(IPV4_GET_RAW_VER((IPV4Hdr *)(pkt + PPP_HEADER_LEN)) == 4) {
DecodeIPV4(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq ); DecodeIPV4(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq,
data);
} }
break; break;
@ -79,7 +83,8 @@ void DecodePPP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue
return; return;
} }
DecodeIPV4(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq ); DecodeIPV4(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq,
data);
break; break;
/* PPP IPv6 was not tested */ /* PPP IPv6 was not tested */
@ -89,7 +94,7 @@ void DecodePPP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue
return; return;
} }
DecodeIPV6(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN); DecodeIPV6(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, data);
break; break;
default: default:
@ -113,11 +118,13 @@ static int DecodePPPtest01 (void) {
uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0x21, 0x45, 0xc0, 0x00 }; uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0x21, 0x45, 0xc0, 0x00 };
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet)); memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL); DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL, &dtv);
/* Function my returns here with expected value */ /* Function my returns here with expected value */
@ -140,11 +147,13 @@ static int DecodePPPtest02 (void) {
0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 }; 0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 };
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet)); memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL); DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL, &dtv);
/* Function must returns here */ /* Function must returns here */
@ -169,13 +178,15 @@ static int DecodePPPtest03 (void) {
0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 }; 0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 };
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet)); memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
FlowInitConfig(FLOW_QUIET); FlowInitConfig(FLOW_QUIET);
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL); DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL, &dtv);
FlowShutdown(); FlowShutdown();
@ -217,13 +228,15 @@ static int DecodePPPtest04 (void) {
0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 }; 0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 };
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet)); memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
FlowInitConfig(FLOW_QUIET); FlowInitConfig(FLOW_QUIET);
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL); DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL, &dtv);
FlowShutdown(); FlowShutdown();

19
src/decode-pppoe.c
Unescape Escape View File

@ -19,9 +19,12 @@
/** /**
* \brief Main decoding function for PPPoE packets * \brief Main decoding function for PPPoE packets
*/ */
void DecodePPPoE(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) void DecodePPPoE(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len,
PacketQueue *pq, void *data)
{ {
PerfCounterIncr(COUNTER_DECODER_PPPOE, t->pca); DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_pppoe, t->pca);
if (len < PPPOE_HEADER_LEN) { if (len < PPPOE_HEADER_LEN) {
DECODER_SET_EVENT(p, PPPOE_PKT_TOO_SMALL); DECODER_SET_EVENT(p, PPPOE_PKT_TOO_SMALL);
@ -39,8 +42,8 @@ void DecodePPPoE(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQue
if (ntohs(p->pppoeh->pppoe_length) > 0) { if (ntohs(p->pppoeh->pppoe_length) > 0) {
/* decode contained PPP packet */ /* decode contained PPP packet */
PerfCounterIncr(COUNTER_DECODER_PPP, t->pca); DecodePPP(t, p, pkt + PPPOE_HEADER_LEN, len - PPPOE_HEADER_LEN, pq,
DecodePPP(t, p, pkt + PPPOE_HEADER_LEN, len - PPPOE_HEADER_LEN, pq); data);
} }
} }
@ -57,11 +60,13 @@ static int DecodePPPoEtest01 (void) {
uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x00, 0x00 }; uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x00, 0x00 };
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet)); memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPPoE(&tv, &p, raw_pppoe, sizeof(raw_pppoe), NULL); DecodePPPoE(&tv, &p, raw_pppoe, sizeof(raw_pppoe), NULL, &dtv);
if(DECODER_ISSET_EVENT(&p,PPPOE_PKT_TOO_SMALL)) { if(DECODER_ISSET_EVENT(&p,PPPOE_PKT_TOO_SMALL)) {
return 1; return 1;
@ -95,11 +100,13 @@ static int DecodePPPoEtest02 (void) {
Packet p; Packet p;
ThreadVars tv; ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars)); memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet)); memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPPoE(&tv, &p, raw_pppoe, sizeof(raw_pppoe), NULL); DecodePPPoE(&tv, &p, raw_pppoe, sizeof(raw_pppoe), NULL, &dtv);
if(DECODER_ISSET_EVENT(&p,PPPOE_PKT_TOO_SMALL)) { if(DECODER_ISSET_EVENT(&p,PPPOE_PKT_TOO_SMALL)) {
return 1; return 1;

11
src/decode-sll.c
Unescape Escape View File

@ -4,9 +4,12 @@
#include "decode-sll.h" #include "decode-sll.h"
#include "decode-events.h" #include "decode-events.h"
void DecodeSll(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) void DecodeSll(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
PacketQueue *pq, void *data)
{ {
PerfCounterIncr(COUNTER_DECODER_SLL, t->pca); DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_sll, t->pca);
if (len < SLL_HEADER_LEN) { if (len < SLL_HEADER_LEN) {
DECODER_SET_EVENT(p,SLL_PKT_TOO_SMALL); DECODER_SET_EVENT(p,SLL_PKT_TOO_SMALL);
@ -23,10 +26,10 @@ void DecodeSll(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue
if (ntohs(sllh->sll_protocol) == ETHERNET_TYPE_IP) { if (ntohs(sllh->sll_protocol) == ETHERNET_TYPE_IP) {
//printf("DecodeSll ip4\n"); //printf("DecodeSll ip4\n");
DecodeIPV4(t, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN, pq); DecodeIPV4(t, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN, pq, data);
} else if(ntohs(sllh->sll_protocol) == ETHERNET_TYPE_IPV6) { } else if(ntohs(sllh->sll_protocol) == ETHERNET_TYPE_IPV6) {
//printf("DecodeSll ip6\n"); //printf("DecodeSll ip6\n");
DecodeIPV6(t, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN); DecodeIPV6(t, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN, data);
} }
} }

7
src/decode-tcp.c
Unescape Escape View File

@ -135,9 +135,12 @@ static int DecodeTCPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
return 0; return 0;
} }
void DecodeTCP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len) void DecodeTCP(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{ {
PerfCounterIncr(COUNTER_DECODER_TCP, t->pca); DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_tcp, t->pca);
if (DecodeTCPPacket(t, p,pkt,len) < 0) if (DecodeTCPPacket(t, p,pkt,len) < 0)
return; return;

7
src/decode-udp.c
Unescape Escape View File

@ -37,9 +37,12 @@ static int DecodeUDPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
return 0; return 0;
} }
void DecodeUDP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len) void DecodeUDP(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{ {
PerfCounterIncr(COUNTER_DECODER_UDP, t->pca); DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_udp, t->pca);
if (DecodeUDPPacket(t, p,pkt,len) < 0) if (DecodeUDPPacket(t, p,pkt,len) < 0)
return; return;

9
src/decode.c
Unescape Escape View File

@ -5,15 +5,18 @@
#include "eidps-common.h" #include "eidps-common.h"
#include "decode.h" #include "decode.h"
void DecodeTunnel(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) void DecodeTunnel(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
PacketQueue *pq, void *data)
{ {
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
switch (p->tunnel_proto) { switch (p->tunnel_proto) {
case IPPROTO_IP: case IPPROTO_IP:
return DecodeIPV4(t, p, pkt, len, pq); return DecodeIPV4(t, p, pkt, len, pq, data);
break; break;
case IPPROTO_IPV6: case IPPROTO_IPV6:
//printf("DecodeTunnel: IPv6 packet\n"); //printf("DecodeTunnel: IPv6 packet\n");
return DecodeIPV6(t, p, pkt, len); return DecodeIPV6(t, p, pkt, len, data);
break; break;
default: default:
printf("FIXME: DecodeTunnel: protocol %" PRIu32 " not supported.\n", p->tunnel_proto); printf("FIXME: DecodeTunnel: protocol %" PRIu32 " not supported.\n", p->tunnel_proto);

51
src/decode.h
Unescape Escape View File

@ -299,6 +299,27 @@ typedef struct PacketQueue_ {
#endif /* DBG_PERF */ #endif /* DBG_PERF */
} PacketQueue; } PacketQueue;
/* Generic structure to hold user data for all decode modules */
typedef struct DecodeThreadVars_
{
/* counters */
u_int64_t counter_pkts;
u_int64_t counter_bytes;
u_int64_t counter_ipv4;
u_int64_t counter_ipv6;
u_int64_t counter_eth;
u_int64_t counter_sll;
u_int64_t counter_tcp;
u_int64_t counter_udp;
u_int64_t counter_icmpv4;
u_int64_t counter_icmpv6;
u_int64_t counter_ppp;
u_int64_t counter_pppoe;
u_int64_t counter_avg_pkt_size;
u_int64_t counter_max_pkt_size;
ThreadVars *tv;
} DecodeThreadVars;
/* clear key vars so we don't need to call the expensive /* clear key vars so we don't need to call the expensive
* memset or bzero * memset or bzero
@ -376,18 +397,24 @@ typedef struct PacketQueue_ {
/* decoder functions */ /* decoder functions */
void DecodeEthernet(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); void DecodeEthernet(ThreadVars *, Packet *, u_int8_t *, u_int16_t,
void DecodeSll(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); PacketQueue *, void *);
void DecodePPP(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); void DecodeSll(ThreadVars *, Packet *, u_int8_t *, u_int16_t, PacketQueue *,
void DecodePPPoE(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); void *);
void DecodeTunnel(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); void DecodePPP(ThreadVars *, Packet *, u_int8_t *, u_int16_t, PacketQueue *,
void DecodeIPV4(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); void *);
void DecodeIPV6(ThreadVars *, Packet *, uint8_t *, uint16_t); void DecodePPPoE(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *,
void DecodeICMPV4(ThreadVars *, Packet *, uint8_t *, uint16_t); void *);
void DecodeICMPV6(ThreadVars *, Packet *, uint8_t *, uint16_t); void DecodeTunnel(ThreadVars *, Packet *, u_int8_t *, u_int16_t, PacketQueue *,
void DecodeTCP(ThreadVars *, Packet *, uint8_t *, uint16_t); void *);
void DecodeUDP(ThreadVars *, Packet *, uint8_t *, uint16_t); void DecodeIPV4(ThreadVars *, Packet *, u_int8_t *, u_int16_t, PacketQueue *,
void DecodeHTTP(ThreadVars *, Packet *, uint8_t *, uint16_t); void *);
void DecodeIPV6(ThreadVars *, Packet *, u_int8_t *, u_int16_t, void *);
void DecodeICMPV4(ThreadVars *, Packet *, u_int8_t *, u_int16_t, void *);
void DecodeICMPV6(ThreadVars *, Packet *, u_int8_t *, u_int16_t, void *);
void DecodeTCP(ThreadVars *, Packet *, u_int8_t *, u_int16_t, void *);
void DecodeUDP(ThreadVars *, Packet *, u_int8_t *, u_int16_t, void *);
void DecodeHTTP(ThreadVars *, Packet *, u_int8_t *, u_int16_t);
Packet *SetupPkt (void); Packet *SetupPkt (void);
Packet *TunnelPktSetup(ThreadVars *, Packet *, uint8_t *, uint16_t, uint8_t); Packet *TunnelPktSetup(ThreadVars *, Packet *, uint8_t *, uint16_t, uint8_t);

7
src/detect-engine-mpm.c
Unescape Escape View File

@ -839,6 +839,13 @@ int PatternMatcherThreadInit(ThreadVars *t, void *initdata, void **data) {
/* IP-ONLY */ /* IP-ONLY */
DetectEngineIPOnlyThreadInit(de_ctx,&pmt->io_ctx); DetectEngineIPOnlyThreadInit(de_ctx,&pmt->io_ctx);
pmt->counter_alerts = PerfTVRegisterCounter("detect.alert", t, TYPE_UINT64,
"NULL");
t->pca = PerfGetAllCountersArray(&t->pctx);
PerfAddToClubbedTMTable(t->name, &t->pctx);
*data = (void *)pmt; *data = (void *)pmt;
//printf("PatternMatcherThreadInit: data %p pmt %p\n", *data, pmt); //printf("PatternMatcherThreadInit: data %p pmt %p\n", *data, pmt);
return 0; return 0;

9
src/detect.c
Unescape Escape View File

@ -581,20 +581,13 @@ int Detect(ThreadVars *t, Packet *p, void *data, PacketQueue *pq) {
return 0; return 0;
} }
// PerfCounterIncr(COUNTER_DETECT_ALERTS, t->pca); // PerfCounterIncr(pmt->counter_alerts, t->pca);
return 1; return 1;
} }
int DetectThreadInit(ThreadVars *t, void *initdata, void **data) int DetectThreadInit(ThreadVars *t, void *initdata, void **data)
{ {
PerfRegisterCounter("detect.alert", "Detect", TYPE_UINT64, "NULL",
&t->pctx, TYPE_Q_NONE, 1);
t->pca = PerfGetAllCountersArray(&t->pctx);
PerfAddToClubbedTMTable("Detect", &t->pctx);
return PatternMatcherThreadInit(t,initdata,data); return PatternMatcherThreadInit(t,initdata,data);
} }

2
src/detect.h
Unescape Escape View File

@ -178,6 +178,8 @@ typedef struct PatternMatcherThread_ {
uint32_t pkts_uri_scanned4; uint32_t pkts_uri_scanned4;
uint32_t pkts_uri_searched4; uint32_t pkts_uri_searched4;
u_int64_t counter_alerts;
DetectEngineIPOnlyThreadCtx io_ctx; DetectEngineIPOnlyThreadCtx io_ctx;
} PatternMatcherThread; } PatternMatcherThread;

69
src/source-nfq.c
Unescape Escape View File

@ -455,6 +455,8 @@ int VerdictNFQ(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq) {
*/ */
int DecodeNFQ(ThreadVars *t, Packet *p, void *data, PacketQueue *pq) int DecodeNFQ(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
{ {
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
IPV4Hdr *ip4h = (IPV4Hdr *)p->pkt; IPV4Hdr *ip4h = (IPV4Hdr *)p->pkt;
IPV6Hdr *ip6h = (IPV6Hdr *)p->pkt; IPV6Hdr *ip6h = (IPV6Hdr *)p->pkt;
@ -462,15 +464,15 @@ int DecodeNFQ(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
printf("DecodeNFQ\n"); printf("DecodeNFQ\n");
#endif #endif
PerfCounterIncr(COUNTER_DECODER_PKTS, t->pca); PerfCounterIncr(dtv->counter_pkts, t->pca);
PerfCounterAddUI64(COUNTER_DECODER_BYTES, t->pca, p->pktlen); PerfCounterAddUI64(dtv->counter_bytes, t->pca, p->pktlen);
if (IPV4_GET_RAW_VER(ip4h) == 4) { if (IPV4_GET_RAW_VER(ip4h) == 4) {
printf("DecodeNFQ ip4\n"); printf("DecodeNFQ ip4\n");
DecodeIPV4(t, p, p->pkt, p->pktlen, pq); DecodeIPV4(t, p, p->pkt, p->pktlen, pq, data);
} else if(IPV6_GET_RAW_VER(ip6h) == 6) { } else if(IPV6_GET_RAW_VER(ip6h) == 6) {
printf("DecodeNFQ ip6\n"); printf("DecodeNFQ ip6\n");
DecodeIPV6(t, p, p->pkt, p->pktlen); DecodeIPV6(t, p, p->pkt, p->pktlen, data);
} else { } else {
printf("DecodeNFQ %02x\n", *p->pkt); printf("DecodeNFQ %02x\n", *p->pkt);
} }
@ -480,32 +482,45 @@ int DecodeNFQ(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
int DecodeNFQThreadInit(ThreadVars *tv, void *initdata, void **data) int DecodeNFQThreadInit(ThreadVars *tv, void *initdata, void **data)
{ {
PerfRegisterCounter("decoder.pkts", "DecodeNFQ", TYPE_UINT64, "NULL", DecodeThreadVars *dtv = NULL;
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.bytes", "DecodeNFQ", TYPE_UINT64, "NULL", if ( (dtv = malloc(sizeof(DecodeThreadVars))) == NULL) {
&tv->pctx, TYPE_Q_NONE, 1); printf("Error Allocating memory\n");
PerfRegisterCounter("decoder.ipv4", "DecodeNFQ", TYPE_UINT64, "NULL", return -1;
&tv->pctx, TYPE_Q_NONE, 1); }
PerfRegisterCounter("decoder.ipv6", "DecodeNFQ", TYPE_UINT64, "NULL", memset(dtv, 0, sizeof(DecodeThreadVars));
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ethernet", "DecodeNFQ", TYPE_UINT64, "NULL", dtv->tv = tv;
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.sll", "DecodeNFQ", TYPE_UINT64, "NULL", /* register counters */
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_pkts = PerfTVRegisterCounter("decoder.pkts", tv,
PerfRegisterCounter("decoder.tcp", "DecodeNFQ", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_bytes = PerfTVRegisterCounter("decoder.bytes", tv,
PerfRegisterCounter("decoder.udp", "DecodeNFQ", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_ipv4 = PerfTVRegisterCounter("decoder.ipv4", tv,
PerfRegisterCounter("decoder.icmpv4", "DecodeNFQ", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_ipv6 = PerfTVRegisterCounter("decoder.ipv6", tv,
PerfRegisterCounter("decoder.icmpv6", "DecodeNFQ", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_eth = PerfTVRegisterCounter("decoder.ethernet", tv,
PerfRegisterCounter("decoder.ppp", "DecodeNFQ", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_sll = PerfTVRegisterCounter("decoder.sll", tv,
TYPE_UINT64, "NULL");
dtv->counter_tcp = PerfTVRegisterCounter("decoder.tcp", tv,
TYPE_UINT64, "NULL");
dtv->counter_udp = PerfTVRegisterCounter("decoder.udp", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv4 = PerfTVRegisterCounter("decoder.icmpv4", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv6 = PerfTVRegisterCounter("decoder.icmpv6", tv,
TYPE_UINT64, "NULL");
dtv->counter_ppp = PerfTVRegisterCounter("decoder.ppp", tv,
TYPE_UINT64, "NULL");
tv->pca = PerfGetAllCountersArray(&tv->pctx); tv->pca = PerfGetAllCountersArray(&tv->pctx);
PerfAddToClubbedTMTable("DecodeNFQ", &tv->pctx); PerfAddToClubbedTMTable(tv->name, &tv->pctx);
*data = (void *)dtv;
return 0; return 0;
} }

71
src/source-pcap-file.c
Unescape Escape View File

@ -33,7 +33,8 @@
typedef struct PcapFileGlobalVars_ { typedef struct PcapFileGlobalVars_ {
pcap_t *pcap_handle; pcap_t *pcap_handle;
void (*Decoder)(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); void (*Decoder)(ThreadVars *, Packet *, u_int8_t *, u_int16_t,
PacketQueue *, void *);
} PcapFileGlobalVars; } PcapFileGlobalVars;
typedef struct PcapFileThreadVars_ typedef struct PcapFileThreadVars_
@ -171,42 +172,58 @@ int ReceivePcapFileThreadDeinit(ThreadVars *tv, void *data) {
int DecodePcapFile(ThreadVars *t, Packet *p, void *data, PacketQueue *pq) int DecodePcapFile(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
{ {
PerfCounterIncr(COUNTER_DECODER_PKTS, t->pca); DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterAddUI64(COUNTER_DECODER_BYTES, t->pca, p->pktlen);
PerfCounterIncr(dtv->counter_pkts, t->pca);
PerfCounterAddUI64(dtv->counter_bytes, t->pca, p->pktlen);
/* call the decoder */ /* call the decoder */
pcap_g.Decoder(t,p,p->pkt,p->pktlen,pq); pcap_g.Decoder(t, p, p->pkt, p->pktlen, pq, data);
return 0; return 0;
} }
int DecodePcapFileThreadInit(ThreadVars *tv, void *initdata, void **data) int DecodePcapFileThreadInit(ThreadVars *tv, void *initdata, void **data)
{ {
PerfRegisterCounter("decoder.pkts", "DecodePcapFile", TYPE_UINT64, "NULL", DecodeThreadVars *dtv = NULL;
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.bytes", "DecodePcapFile", TYPE_UINT64, "NULL", if ( (dtv = malloc(sizeof(DecodeThreadVars))) == NULL) {
&tv->pctx, TYPE_Q_NONE, 1); printf("Error Allocating memory\n");
PerfRegisterCounter("decoder.ipv4", "DecodePcapFile", TYPE_UINT64, "NULL", return -1;
&tv->pctx, TYPE_Q_NONE, 1); }
PerfRegisterCounter("decoder.ipv6", "DecodePcapFile", TYPE_UINT64, "NULL", memset(dtv, 0, sizeof(DecodeThreadVars));
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ethernet", "DecodePcapFile", TYPE_UINT64, dtv->tv = tv;
"NULL", &tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.sll", "DecodePcapFile", TYPE_UINT64, "NULL", /* register counters */
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_pkts = PerfTVRegisterCounter("decoder.pkts", tv,
PerfRegisterCounter("decoder.tcp", "DecodePcapFile", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_bytes = PerfTVRegisterCounter("decoder.bytes", tv,
PerfRegisterCounter("decoder.udp", "DecodePcapFile", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_ipv4 = PerfTVRegisterCounter("decoder.ipv4", tv,
PerfRegisterCounter("decoder.icmpv4", "DecodePcapFile", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_ipv6 = PerfTVRegisterCounter("decoder.ipv6", tv,
PerfRegisterCounter("decoder.icmpv6", "DecodePcapFile", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_eth = PerfTVRegisterCounter("decoder.ethernet", tv,
PerfRegisterCounter("decoder.ppp", "DecodePcapFile", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_sll = PerfTVRegisterCounter("decoder.sll", tv,
TYPE_UINT64, "NULL");
dtv->counter_tcp = PerfTVRegisterCounter("decoder.tcp", tv,
TYPE_UINT64, "NULL");
dtv->counter_udp = PerfTVRegisterCounter("decoder.udp", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv4 = PerfTVRegisterCounter("decoder.icmpv4", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv6 = PerfTVRegisterCounter("decoder.icmpv6", tv,
TYPE_UINT64, "NULL");
dtv->counter_ppp = PerfTVRegisterCounter("decoder.ppp", tv,
TYPE_UINT64, "NULL");
tv->pca = PerfGetAllCountersArray(&tv->pctx); tv->pca = PerfGetAllCountersArray(&tv->pctx);
PerfAddToClubbedTMTable("DecodePcapFile", &tv->pctx); PerfAddToClubbedTMTable(tv->name, &tv->pctx);
*data = (void *)dtv;
return 0; return 0;
} }

88
src/source-pcap.c
Unescape Escape View File

@ -291,21 +291,24 @@ int ReceivePcapThreadDeinit(ThreadVars *tv, void *data) {
*/ */
int DecodePcap(ThreadVars *t, Packet *p, void *data, PacketQueue *pq) int DecodePcap(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
{ {
PerfCounterIncr(COUNTER_DECODER_PKTS, t->pca); DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterAddUI64(COUNTER_DECODER_BYTES, t->pca, p->pktlen);
PerfCounterAddUI64(COUNTER_DECODER_AVG_PKT_SIZE, t->pca, p->pktlen); PerfCounterIncr(dtv->counter_pkts, t->pca);
PerfCounterSetUI64(COUNTER_DECODER_MAX_PKT_SIZE, t->pca, p->pktlen); PerfCounterAddUI64(dtv->counter_bytes, t->pca, p->pktlen);
PerfCounterAddUI64(dtv->counter_avg_pkt_size, t->pca, p->pktlen);
PerfCounterSetUI64(dtv->counter_max_pkt_size, t->pca, p->pktlen);
/* call the decoder */ /* call the decoder */
switch(p->pcap_v.datalink) { switch(p->pcap_v.datalink) {
case LINKTYPE_LINUX_SLL: case LINKTYPE_LINUX_SLL:
DecodeSll(t,p,p->pkt,p->pktlen,pq); DecodeSll(t, p, p->pkt, p->pktlen, pq, data);
break; break;
case LINKTYPE_ETHERNET: case LINKTYPE_ETHERNET:
DecodeEthernet(t,p,p->pkt,p->pktlen,pq); DecodeEthernet(t, p,p->pkt, p->pktlen, pq, data);
break; break;
case LINKTYPE_PPP: case LINKTYPE_PPP:
DecodePPP(t,p,p->pkt,p->pktlen,pq); DecodePPP(t, p, p->pkt, p->pktlen, pq, data);
break; break;
default: default:
printf("Error: datalink type %" PRId32 " not yet supported in module DecodePcap.\n", p->pcap_v.datalink); printf("Error: datalink type %" PRId32 " not yet supported in module DecodePcap.\n", p->pcap_v.datalink);
@ -317,38 +320,51 @@ int DecodePcap(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
int DecodePcapThreadInit(ThreadVars *tv, void *initdata, void **data) int DecodePcapThreadInit(ThreadVars *tv, void *initdata, void **data)
{ {
PerfRegisterCounter("decoder.pkts", "DecodePcap", TYPE_UINT64, "NULL", DecodeThreadVars *dtv = NULL;
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.bytes", "DecodePcap", TYPE_UINT64, "NULL", if ( (dtv = malloc(sizeof(DecodeThreadVars))) == NULL) {
&tv->pctx, TYPE_Q_NONE, 1); printf("Error Allocating memory\n");
PerfRegisterCounter("decoder.ipv4", "DecodePcap", TYPE_UINT64, "NULL", return -1;
&tv->pctx, TYPE_Q_NONE, 1); }
PerfRegisterCounter("decoder.ipv6", "DecodePcap", TYPE_UINT64, "NULL", memset(dtv, 0, sizeof(DecodeThreadVars));
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ethernet", "DecodePcap", TYPE_UINT64, "NULL", dtv->tv = tv;
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.sll", "DecodePcap", TYPE_UINT64, "NULL", /* register counters */
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_pkts = PerfTVRegisterCounter("decoder.pkts", tv,
PerfRegisterCounter("decoder.tcp", "DecodePcap", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_bytes = PerfTVRegisterCounter("decoder.bytes", tv,
PerfRegisterCounter("decoder.udp", "DecodePcap", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_ipv4 = PerfTVRegisterCounter("decoder.ipv4", tv,
PerfRegisterCounter("decoder.icmpv4", "DecodePcap", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_ipv6 = PerfTVRegisterCounter("decoder.ipv6", tv,
PerfRegisterCounter("decoder.icmpv6", "DecodePcap", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_eth = PerfTVRegisterCounter("decoder.ethernet", tv,
PerfRegisterCounter("decoder.ppp", "DecodePcap", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_sll = PerfTVRegisterCounter("decoder.sll", tv,
PerfRegisterCounter("decoder.avg_pkt_size", "DecodePcap", TYPE_DOUBLE, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_AVERAGE, 1); dtv->counter_tcp = PerfTVRegisterCounter("decoder.tcp", tv,
PerfRegisterCounter("decoder.max_pkt_size", "DecodePcap", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_MAXIMUM, 1); dtv->counter_udp = PerfTVRegisterCounter("decoder.udp", tv,
PerfRegisterCounter("decoder.pppoe", "DecodePcap", TYPE_UINT64, "NULL", TYPE_UINT64, "NULL");
&tv->pctx, TYPE_Q_NONE, 1); dtv->counter_icmpv4 = PerfTVRegisterCounter("decoder.icmpv4", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv6 = PerfTVRegisterCounter("decoder.icmpv6", tv,
TYPE_UINT64, "NULL");
dtv->counter_ppp = PerfTVRegisterCounter("decoder.ppp", tv,
TYPE_UINT64, "NULL");
dtv->counter_avg_pkt_size = PerfTVRegisterAvgCounter("decoder.avg_pkt_size", tv,
TYPE_DOUBLE, "NULL");
dtv->counter_max_pkt_size = PerfTVRegisterMaxCounter("decoder.max_pkt_size", tv,
TYPE_UINT64, "NULL");
dtv->counter_pppoe = PerfTVRegisterCounter("decoder.pppoe", tv, TYPE_UINT64,
"NULL");
tv->pca = PerfGetAllCountersArray(&tv->pctx); tv->pca = PerfGetAllCountersArray(&tv->pctx);
PerfAddToClubbedTMTable("DecodePcap", &tv->pctx); PerfAddToClubbedTMTable(tv->name, &tv->pctx);
*data = (void *)dtv;
return 0; return 0;
} }

16
src/source-pcap.h
Unescape Escape View File

@ -11,22 +11,6 @@ void TmModuleDecodePcapRegister (void);
#define LIBPCAP_COPYWAIT 500 #define LIBPCAP_COPYWAIT 500
#define LIBPCAP_PROMISC 1 #define LIBPCAP_PROMISC 1
// The counter ids. In case you can't recollect the ids, use the counter name
#define COUNTER_DECODER_PKTS 1
#define COUNTER_DECODER_BYTES 2
#define COUNTER_DECODER_IPV4 3
#define COUNTER_DECODER_IPV6 4
#define COUNTER_DECODER_ETH 5
#define COUNTER_DECODER_SLL 6
#define COUNTER_DECODER_TCP 7
#define COUNTER_DECODER_UDP 8
#define COUNTER_DECODER_ICMPV4 9
#define COUNTER_DECODER_ICMPV6 10
#define COUNTER_DECODER_PPP 11
#define COUNTER_DECODER_AVG_PKT_SIZE 12
#define COUNTER_DECODER_MAX_PKT_SIZE 13
#define COUNTER_DECODER_PPPOE 14
/* per packet Pcap vars */ /* per packet Pcap vars */
typedef struct PcapPacketVars_ typedef struct PcapPacketVars_
{ {

10
src/stream-tcp.c
Unescape Escape View File

@ -54,6 +54,8 @@ static pthread_mutex_t ssn_pool_mutex;
typedef struct StreamTcpThread_ { typedef struct StreamTcpThread_ {
u_int64_t pkts; u_int64_t pkts;
u_int64_t counter_tcp_streams;
} StreamTcpThread; } StreamTcpThread;
void TmModuleStreamTcpRegister (void) { void TmModuleStreamTcpRegister (void) {
@ -1205,7 +1207,7 @@ int StreamTcp (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq)
{ {
StreamTcpThread *stt = (StreamTcpThread *)data; StreamTcpThread *stt = (StreamTcpThread *)data;
//PerfCounterAddUI64(COUNTER_STREAMTCP_STREAMS, tv->pca, a); // PerfCounterAddUI64(stt->counter_tcp_streams, tv->pca, a);
if (!(PKT_IS_TCP(p))) if (!(PKT_IS_TCP(p)))
return 0; return 0;
@ -1245,12 +1247,12 @@ int StreamTcpThreadInit(ThreadVars *t, void *initdata, void **data)
*data = (void *)stt; *data = (void *)stt;
PerfRegisterCounter("streamTcp.tcp_streams", "StreamTcp", TYPE_DOUBLE, "NULL", stt->counter_tcp_streams = PerfTVRegisterAvgCounter("streamTcp.tcp_streams",
&t->pctx, TYPE_Q_AVERAGE, 1); t, TYPE_DOUBLE, "NULL");
t->pca = PerfGetAllCountersArray(&t->pctx); t->pca = PerfGetAllCountersArray(&t->pctx);
PerfAddToClubbedTMTable("StreamTcp", &t->pctx); PerfAddToClubbedTMTable(t->name, &t->pctx);
return 0; return 0;
} }

Write Preview
Loading…
Cancel
Save