aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

stream/midstream: add counter for exception policy

Browse Source 
Add stats counters for when there is an exception policy applied in case
of a session picked up midstream.

Task #5816

(cherry picked from commit caf590d51f)
pull/13732/head
Juliana Fajardini 3 years ago
parent 4aff7c44db
commit 29731bbf2b
3 changed files with 95 additions and 0 deletions
Show Stats Download Patch File Download Diff File

5
etc/schema.json
Unescape Escape View File

@ -5297,6 +5297,11 @@
"midstream_pickups": {
"type": "integer"
},
"midstream_exception_policy": {
"description":
"How many times midstream exception policy was applied, and which one",
"$ref": "#/$defs/exceptionPolicy"
},
"no_flow": {
"type": "integer"
},

88
src/stream-tcp.c
Unescape Escape View File

@ -142,6 +142,58 @@ ExceptionPolicyStatsSetts stream_reassembly_memcap_eps_stats = {
};
// clang-format on
/* Settings order as in the enum */
// clang-format off
ExceptionPolicyStatsSetts stream_midstream_enabled_eps_stats = {
.valid_settings_ids = {
/* EXCEPTION_POLICY_NOT_SET */ false,
/* EXCEPTION_POLICY_AUTO */ false,
/* EXCEPTION_POLICY_PASS_PACKET */ false,
/* EXCEPTION_POLICY_PASS_FLOW */ true,
/* EXCEPTION_POLICY_BYPASS_FLOW */ false,
/* EXCEPTION_POLICY_DROP_PACKET */ false,
/* EXCEPTION_POLICY_DROP_FLOW */ false,
/* EXCEPTION_POLICY_REJECT */ false,
},
.valid_settings_ips = {
/* EXCEPTION_POLICY_NOT_SET */ false,
/* EXCEPTION_POLICY_AUTO */ false,
/* EXCEPTION_POLICY_PASS_PACKET */ false,
/* EXCEPTION_POLICY_PASS_FLOW */ true,
/* EXCEPTION_POLICY_BYPASS_FLOW */ false,
/* EXCEPTION_POLICY_DROP_PACKET */ false,
/* EXCEPTION_POLICY_DROP_FLOW */ false,
/* EXCEPTION_POLICY_REJECT */ false,
},
};
// clang-format on
/* Settings order as in the enum */
// clang-format off
ExceptionPolicyStatsSetts stream_midstream_disabled_eps_stats = {
.valid_settings_ids = {
/* EXCEPTION_POLICY_NOT_SET */ false,
/* EXCEPTION_POLICY_AUTO */ false,
/* EXCEPTION_POLICY_PASS_PACKET */ false,
/* EXCEPTION_POLICY_PASS_FLOW */ true,
/* EXCEPTION_POLICY_BYPASS_FLOW */ true,
/* EXCEPTION_POLICY_DROP_PACKET */ false,
/* EXCEPTION_POLICY_DROP_FLOW */ false,
/* EXCEPTION_POLICY_REJECT */ true,
},
.valid_settings_ips = {
/* EXCEPTION_POLICY_NOT_SET */ false,
/* EXCEPTION_POLICY_AUTO */ false,
/* EXCEPTION_POLICY_PASS_PACKET */ false,
/* EXCEPTION_POLICY_PASS_FLOW */ true,
/* EXCEPTION_POLICY_BYPASS_FLOW */ true,
/* EXCEPTION_POLICY_DROP_PACKET */ false,
/* EXCEPTION_POLICY_DROP_FLOW */ true,
/* EXCEPTION_POLICY_REJECT */ true,
},
};
// clang-format on
static int StreamTcpHandleFin(ThreadVars *tv, StreamTcpThread *, TcpSession *, Packet *);
void StreamTcpReturnStreamSegments (TcpStream *);
void StreamTcpInitConfig(bool);
@ -1051,6 +1103,29 @@ static inline void StreamTcpCloseSsnWithReset(Packet *p, TcpSession *ssn)
"TCP_CLOSED", ssn, StreamTcpStateAsString(ssn->state));
}
static bool IsMidstreamExceptionPolicyStatsValid(enum ExceptionPolicy policy)
{
if (EngineModeIsIPS()) {
if (stream_config.midstream) {
return stream_midstream_enabled_eps_stats.valid_settings_ips[policy];
}
return stream_midstream_disabled_eps_stats.valid_settings_ips[policy];
}
if (stream_config.midstream) {
return stream_midstream_enabled_eps_stats.valid_settings_ids[policy];
}
return stream_midstream_disabled_eps_stats.valid_settings_ids[policy];
}
static void StreamTcpMidstreamExceptionPolicyStatsIncr(
ThreadVars *tv, StreamTcpThread *stt, enum ExceptionPolicy policy)
{
const uint16_t id = stt->counter_tcp_midstream_eps.eps_id[policy];
if (likely(tv && id > 0)) {
StatsIncr(tv, id);
}
}
static int StreamTcpPacketIsRetransmission(TcpStream *stream, Packet *p)
{
if (p->payload_len == 0)
@ -1104,6 +1179,7 @@ static int StreamTcpPacketStateNone(
} else if (p->tcph->th_flags & TH_FIN) {
/* Drop reason will only be used if midstream policy is set to fail closed */
ExceptionPolicyApply(p, stream_config.midstream_policy, PKT_DROP_REASON_STREAM_MIDSTREAM);
StreamTcpMidstreamExceptionPolicyStatsIncr(tv, stt, stream_config.midstream_policy);
if (!stream_config.midstream || p->payload_len == 0) {
StreamTcpSetEvent(p, STREAM_FIN_BUT_NO_SESSION);
@ -1200,6 +1276,7 @@ static int StreamTcpPacketStateNone(
} else if ((p->tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK)) {
/* Drop reason will only be used if midstream policy is set to fail closed */
ExceptionPolicyApply(p, stream_config.midstream_policy, PKT_DROP_REASON_STREAM_MIDSTREAM);
StreamTcpMidstreamExceptionPolicyStatsIncr(tv, stt, stream_config.midstream_policy);
if (!stream_config.midstream && !stream_config.async_oneside) {
SCLogDebug("Midstream not enabled, so won't pick up a session");
@ -1372,6 +1449,7 @@ static int StreamTcpPacketStateNone(
} else if (p->tcph->th_flags & TH_ACK) {
/* Drop reason will only be used if midstream policy is set to fail closed */
ExceptionPolicyApply(p, stream_config.midstream_policy, PKT_DROP_REASON_STREAM_MIDSTREAM);
StreamTcpMidstreamExceptionPolicyStatsIncr(tv, stt, stream_config.midstream_policy);
if (!stream_config.midstream) {
SCLogDebug("Midstream not enabled, so won't pick up a session");
@ -5895,6 +5973,16 @@ TmEcode StreamTcpThreadInit(ThreadVars *tv, void *initdata, void **data)
stt->counter_tcp_pseudo_failed = StatsRegisterCounter("tcp.pseudo_failed", tv);
stt->counter_tcp_invalid_checksum = StatsRegisterCounter("tcp.invalid_checksum", tv);
stt->counter_tcp_midstream_pickups = StatsRegisterCounter("tcp.midstream_pickups", tv);
if (stream_config.midstream) {
ExceptionPolicySetStatsCounters(tv, &stt->counter_tcp_midstream_eps,
&stream_midstream_enabled_eps_stats, stream_config.midstream_policy,
"tcp.midstream_exception_policy.", IsMidstreamExceptionPolicyStatsValid);
} else {
ExceptionPolicySetStatsCounters(tv, &stt->counter_tcp_midstream_eps,
&stream_midstream_disabled_eps_stats, stream_config.midstream_policy,
"tcp.midstream_exception_policy.", IsMidstreamExceptionPolicyStatsValid);
}
stt->counter_tcp_wrong_thread = StatsRegisterCounter("tcp.pkt_on_wrong_thread", tv);
stt->counter_tcp_ack_unseen_data = StatsRegisterCounter("tcp.ack_unseen_data", tv);

2
src/stream-tcp.h
Unescape Escape View File

@ -108,6 +108,8 @@ typedef struct StreamTcpThread_ {
uint16_t counter_tcp_invalid_checksum;
/** midstream pickups */
uint16_t counter_tcp_midstream_pickups;
/** exception policy stats */
ExceptionPolicyCounters counter_tcp_midstream_eps;
/** wrong thread */
uint16_t counter_tcp_wrong_thread;
/** ack for unseen data */

Write Preview
Loading…
Cancel
Save