diff --git a/src/Makefile.am b/src/Makefile.am index b400b5438b..2efb0c91a2 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -237,7 +237,7 @@ counters.c counters.h \ app-layer.c app-layer.h \ app-layer-detect-proto.c app-layer-detect-proto.h \ app-layer-parser.c app-layer-parser.h \ -app-layer-protos.h \ +app-layer-protos.c app-layer-protos.h \ app-layer-htp.c app-layer-htp.h \ app-layer-smb.c app-layer-smb.h \ app-layer-smb2.c app-layer-smb2.h \ diff --git a/src/app-layer-protos.c b/src/app-layer-protos.c new file mode 100644 index 0000000000..e6a76cfdb6 --- /dev/null +++ b/src/app-layer-protos.c @@ -0,0 +1,56 @@ +/* Copyright (C) 2007-2011 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Victor Julien + */ + +#include "suricata-common.h" + +#define CASE_CODE(E) case E: return #E + +/** + * \brief Maps the ALPROTO_*, to its string equivalent + * + * \param proto app layer protocol id + * + * \retval string equivalent for the alproto + */ +const char *TmModuleAlprotoToString(int proto) +{ + switch (proto) { + CASE_CODE (ALPROTO_UNKNOWN); + CASE_CODE (ALPROTO_HTTP); + CASE_CODE (ALPROTO_FTP); + CASE_CODE (ALPROTO_SMTP); + CASE_CODE (ALPROTO_TLS); + CASE_CODE (ALPROTO_SSH); + CASE_CODE (ALPROTO_IMAP); + CASE_CODE (ALPROTO_MSN); + CASE_CODE (ALPROTO_JABBER); + CASE_CODE (ALPROTO_SMB); + CASE_CODE (ALPROTO_SMB2); + CASE_CODE (ALPROTO_DCERPC); + CASE_CODE (ALPROTO_DCERPC_UDP); + + default: + return "ALPROTO_UNDEFINED"; + } +} + diff --git a/src/app-layer-protos.h b/src/app-layer-protos.h index ae52c695f5..39826c3d5e 100644 --- a/src/app-layer-protos.h +++ b/src/app-layer-protos.h @@ -45,5 +45,7 @@ enum { ALPROTO_MAX, }; +const char *TmModuleAlprotoToString(int proto); + #endif /* __APP_LAYER_PROTOS_H__ */ diff --git a/src/app-layer.c b/src/app-layer.c index 44e78a786d..0f43795028 100644 --- a/src/app-layer.c +++ b/src/app-layer.c @@ -33,6 +33,7 @@ #include "util-debug.h" #include "util-print.h" +#include "util-profiling.h" //#define PRINT extern uint8_t engine_mode; @@ -161,7 +162,10 @@ int AppLayerHandleTCPData(AlpProtoDetectThreadCtx *dp_ctx, Flow *f, FlowL7DataPtrInit(f); f->alproto = alproto; ssn->flags |= STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED; + + PACKET_PROFILING_APP_START(dp_ctx, alproto); r = AppLayerParse(f, alproto, flags, data, data_len); + PACKET_PROFILING_APP_END(dp_ctx, alproto); } else { if (flags & STREAM_TOSERVER) { SCLogDebug("alp_proto_ctx.toserver.max_len %u", alp_proto_ctx.toserver.max_len); @@ -193,7 +197,9 @@ int AppLayerHandleTCPData(AlpProtoDetectThreadCtx *dp_ctx, Flow *f, /* if we don't have a data object here we are not getting it * a start msg should have gotten us one */ if (alproto != ALPROTO_UNKNOWN) { + PACKET_PROFILING_APP_START(dp_ctx, alproto); r = AppLayerParse(f, alproto, flags, data, data_len); + PACKET_PROFILING_APP_END(dp_ctx, alproto); } else { SCLogDebug(" smsg not start, but no l7 data? Weird"); } diff --git a/src/decode.h b/src/decode.h index 89faaa5bdf..2c3b193f36 100644 --- a/src/decode.h +++ b/src/decode.h @@ -53,6 +53,8 @@ #include "detect-reference.h" +#include "app-layer-protos.h" + #ifdef __SC_CUDA_SUPPORT__ #define CUDA_MAX_PAYLOAD_SIZE 1500 #endif @@ -272,12 +274,17 @@ typedef struct PktProfilingTmmData_ { uint64_t ticks_end; } PktProfilingTmmData; +typedef struct PktProfilingAppData_ { + uint64_t ticks_spent; +} PktProfilingAppData; + /** \brief Per pkt stats storage */ typedef struct PktProfiling_ { uint64_t ticks_start; uint64_t ticks_end; PktProfilingTmmData tmm[TMM_SIZE]; + PktProfilingAppData app[ALPROTO_MAX]; } PktProfiling; #endif /* PROFILING */ @@ -465,6 +472,13 @@ typedef struct AlpProtoDetectDirectionThread_ { typedef struct AlpProtoDetectThreadCtx_ { AlpProtoDetectDirectionThread toserver; AlpProtoDetectDirectionThread toclient; + +#ifdef PROFILING + uint64_t ticks_start; + uint64_t ticks_end; + uint32_t ticks_spent; + uint16_t alproto; +#endif } AlpProtoDetectThreadCtx; /** \brief Structure to hold thread specific data for all decode modules */ diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index ca6dccab68..800b036060 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -58,6 +58,8 @@ #include "detect-engine-state.h" +#include "util-profiling.h" + #define PSEUDO_PACKET_PAYLOAD_SIZE 65416 /* 64 Kb minus max IP and TCP header */ #ifdef DEBUG @@ -1853,6 +1855,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx, STREAM_SET_INLINE_FLAGS(ssn, stream, p, flags); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, NULL, 0, flags|STREAM_EOF); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); /* even if app layer detection failed, we will now move on to * release reassembly for both directions. */ @@ -1950,12 +1953,14 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); stream->tmp_ra_app_base_seq = ra_base_seq; } else { /* process what we have so far */ AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); stream->ra_app_base_seq = ra_base_seq; } @@ -1998,6 +2003,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx, STREAM_SET_INLINE_FLAGS(ssn, stream, p, flags); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, NULL, 0, flags|STREAM_GAP); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_len = 0; /* set a GAP flag and make sure not bothering this stream anymore */ @@ -2075,6 +2081,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_sent += data_len; data_len = 0; @@ -2085,6 +2092,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_sent += data_len; data_len = 0; @@ -2147,6 +2155,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_sent += data_len; data_len = 0; @@ -2157,6 +2166,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_sent += data_len; data_len = 0; @@ -2198,6 +2208,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_sent += data_len; stream->tmp_ra_app_base_seq = ra_base_seq; } else { @@ -2206,6 +2217,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_sent += data_len; stream->ra_app_base_seq = ra_base_seq; } @@ -2225,6 +2237,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx, STREAM_SET_INLINE_FLAGS(ssn, stream, p, flags); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, NULL, 0, flags|STREAM_EOF); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); /* even if app layer detection failed, we will now move on to * release reassembly for both directions. */ @@ -2607,6 +2620,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, STREAM_SET_FLAGS(ssn, stream, p, flags); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, NULL, 0, flags|STREAM_EOF); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); /* even if app layer detection failed, we will now move on to * release reassembly for both directions. */ @@ -2740,12 +2754,14 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); stream->tmp_ra_app_base_seq = ra_base_seq; } else { /* process what we have so far */ AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); stream->ra_app_base_seq = ra_base_seq; } @@ -2787,6 +2803,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, STREAM_SET_FLAGS(ssn, stream, p, flags); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, NULL, 0, flags|STREAM_GAP); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_len = 0; /* set a GAP flag and make sure not bothering this stream anymore */ @@ -2889,6 +2906,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_len = 0; stream->tmp_ra_app_base_seq = ra_base_seq; @@ -2898,6 +2916,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_len = 0; stream->ra_app_base_seq = ra_base_seq; @@ -2959,6 +2978,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_len = 0; stream->tmp_ra_app_base_seq = ra_base_seq; @@ -2968,6 +2988,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); data_len = 0; stream->ra_app_base_seq = ra_base_seq; @@ -3013,6 +3034,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); stream->tmp_ra_app_base_seq = ra_base_seq; } else { /* process what we have so far */ @@ -3020,6 +3042,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx, BUG_ON(data_len > sizeof(data)); AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, data, data_len, flags); + PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p); stream->ra_app_base_seq = ra_base_seq; } diff --git a/src/stream-tcp.c b/src/stream-tcp.c index bc0bc9fe22..f36f93b30f 100644 --- a/src/stream-tcp.c +++ b/src/stream-tcp.c @@ -63,6 +63,7 @@ #include "util-host-os-info.h" #include "util-privs.h" +#include "util-profiling.h" //#define DEBUG @@ -3765,6 +3766,8 @@ TmEcode StreamTcp (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, Packe return TM_ECODE_OK; } + PACKET_PROFILING_APP_RESET(&stt->ra_ctx->dp_ctx); + SCMutexLock(&p->flow->m); ret = StreamTcpPacket(tv, p, stt, pq); SCMutexUnlock(&p->flow->m); diff --git a/src/util-profiling.c b/src/util-profiling.c index b2c0cbd225..97e45676f8 100644 --- a/src/util-profiling.c +++ b/src/util-profiling.c @@ -95,6 +95,9 @@ SCProfilePacketData packet_profile_data6[257]; /**< all proto's + tunnel */ SCProfilePacketData packet_profile_tmm_data4[TMM_SIZE][257]; SCProfilePacketData packet_profile_tmm_data6[TMM_SIZE][257]; +SCProfilePacketData packet_profile_app_data4[TMM_SIZE][257]; +SCProfilePacketData packet_profile_app_data6[TMM_SIZE][257]; + /** * Used for generating the summary data to print. */ @@ -232,6 +235,8 @@ SCProfilingInit(void) memset(&packet_profile_data6, 0, sizeof(packet_profile_data6)); memset(&packet_profile_tmm_data4, 0, sizeof(packet_profile_tmm_data4)); memset(&packet_profile_tmm_data6, 0, sizeof(packet_profile_tmm_data6)); + memset(&packet_profile_app_data4, 0, sizeof(packet_profile_app_data4)); + memset(&packet_profile_app_data6, 0, sizeof(packet_profile_app_data6)); const char *filename = ConfNodeLookupChildValue(conf, "filename"); if (filename != NULL) { @@ -280,7 +285,11 @@ SCProfilingInit(void) for (i = 0; i < TMM_SIZE; i++) { fprintf(packet_profile_csv_fp, "%s,", TmModuleTmmIdToString(i)); } - fprintf(packet_profile_csv_fp, "threading\n"); + fprintf(packet_profile_csv_fp, "threading,"); + for (i = 0; i < ALPROTO_MAX; i++) { + fprintf(packet_profile_csv_fp, "%s,", TmModuleAlprotoToString(i)); + } + fprintf(packet_profile_csv_fp, "STREAM (no app)\n"); profiling_packets_csv_enabled = 1; } @@ -682,6 +691,7 @@ void SCProfilingDumpPacketStats(void) { fprintf(fp, " IPv6 %3d %8u %6u %10u %8"PRIu64"\n", i, pd->cnt, pd->min, pd->max, pd->tot / pd->cnt); } + fprintf(fp, "Note: Protocol 256 tracks pseudo/tunnel packets.\n"); fprintf(fp, "\nPer Thread module stats:\n"); @@ -713,8 +723,43 @@ void SCProfilingDumpPacketStats(void) { continue; } - fprintf(fp, "%3d IPv6 %3d %8u %6u %10u %8"PRIu64"\n", - m, p, pd->cnt, pd->min, pd->max, pd->tot / pd->cnt); + fprintf(fp, "%-24s IPv6 %3d %8u %6u %10u %8"PRIu64"\n", + TmModuleTmmIdToString(m), p, pd->cnt, pd->min, pd->max, pd->tot / pd->cnt); + } + } + fprintf(fp, "Note: TMM_STREAMTCP includes TCP app layer parsers, see below.\n"); + + fprintf(fp, "\nPer App layer parser stats:\n"); + + fprintf(fp, "\n%-20s %-6s %-5s %-8s %-6s %-10s %-8s\n", + "App Layer", "IP ver", "Proto", "cnt", "min", "max", "avg"); + fprintf(fp, "%-20s %-6s %-5s %-8s %-6s %-10s %-8s\n", + "--------------------", "------", "-----", "------", "------", "----------", "-------"); + for (m = 0; m < ALPROTO_MAX; m++) { + int p; + for (p = 0; p < 257; p++) { + SCProfilePacketData *pd = &packet_profile_app_data4[m][p]; + + if (pd->cnt == 0) { + continue; + } + + fprintf(fp, "%-20s IPv4 %3d %8u %6u %10u %8"PRIu64"\n", + TmModuleAlprotoToString(m), p, pd->cnt, pd->min, pd->max, pd->tot / pd->cnt); + } + } + + for (m = 0; m < ALPROTO_MAX; m++) { + int p; + for (p = 0; p < 257; p++) { + SCProfilePacketData *pd = &packet_profile_app_data6[m][p]; + + if (pd->cnt == 0) { + continue; + } + + fprintf(fp, "%-20s IPv6 %3d %8u %6u %10u %8"PRIu64"\n", + TmModuleAlprotoToString(m), p, pd->cnt, pd->min, pd->max, pd->tot / pd->cnt); } } @@ -734,15 +779,74 @@ void SCProfilingPrintPacketProfile(Packet *p) { int i; uint32_t tmm_total = 0; + uint32_t tmm_streamtcp_tcp = 0; + for (i = 0; i < TMM_SIZE; i++) { PktProfilingTmmData *pdt = &p->profile.tmm[i]; uint32_t tmm_delta = (uint32_t)(pdt->ticks_end - pdt->ticks_start); fprintf(packet_profile_csv_fp, "%u,", tmm_delta); tmm_total += tmm_delta; + + if (p->proto == IPPROTO_TCP && i == TMM_STREAMTCP) { + tmm_streamtcp_tcp = tmm_delta; + } } - fprintf(packet_profile_csv_fp, "%u\n", delta - tmm_total); + fprintf(packet_profile_csv_fp, "%u,", delta - tmm_total); + + uint32_t app_total = 0; + for (i = 0; i < ALPROTO_MAX; i++) { + PktProfilingAppData *pdt = &p->profile.app[i]; + + fprintf(packet_profile_csv_fp,"%"PRIu64",", pdt->ticks_spent); + + if (p->proto == IPPROTO_TCP) { + app_total += pdt->ticks_spent; + } + } + + fprintf(packet_profile_csv_fp, "%"PRIu32",", tmm_streamtcp_tcp - app_total); + fprintf(packet_profile_csv_fp,"\n"); +} + +void SCProfilingUpdatePacketAppRecord(int alproto, uint8_t ipproto, PktProfilingAppData *pdt, int ipver) { + if (pdt == NULL) { + return; + } + + SCProfilePacketData *pd; + if (ipver == 4) + pd = &packet_profile_app_data4[alproto][ipproto]; + else + pd = &packet_profile_app_data6[alproto][ipproto]; + + if (pd->min == 0 || pdt->ticks_spent < pd->min) { + pd->min = pdt->ticks_spent; + } + if (pd->max < pdt->ticks_spent) { + pd->max = pdt->ticks_spent; + } + + pd->tot += pdt->ticks_spent; + pd->cnt ++; +} + +void SCProfilingUpdatePacketAppRecords(Packet *p) { + int i; + for (i = 0; i < ALPROTO_MAX; i++) { + PktProfilingAppData *pdt = &p->profile.app[i]; + + if (pdt->ticks_spent == 0) { + continue; + } + + if (PKT_IS_IPV4(p)) { + SCProfilingUpdatePacketAppRecord(i, p->proto, pdt, 4); + } else { + SCProfilingUpdatePacketAppRecord(i, p->proto, pdt, 6); + } + } } void SCProfilingUpdatePacketTmmRecord(int module, uint8_t proto, PktProfilingTmmData *pdt, int ipver) { @@ -820,6 +924,8 @@ void SCProfilingAddPacket(Packet *p) { } SCProfilingUpdatePacketTmmRecords(p); + SCProfilingUpdatePacketAppRecords(p); + } else if (PKT_IS_IPV6(p)) { SCProfilePacketData *pd = &packet_profile_data6[p->proto]; @@ -849,6 +955,7 @@ void SCProfilingAddPacket(Packet *p) { } SCProfilingUpdatePacketTmmRecords(p); + SCProfilingUpdatePacketAppRecords(p); } } SCMutexUnlock(&packet_profile_lock); diff --git a/src/util-profiling.h b/src/util-profiling.h index 9f2f0d70ea..ad1067f50b 100644 --- a/src/util-profiling.h +++ b/src/util-profiling.h @@ -86,6 +86,35 @@ void SCProfilingAddPacket(Packet *); memset(&(p)->profile, 0x00, sizeof(PktProfiling)); \ } +#define PACKET_PROFILING_APP_START(dp, id) \ + if (profiling_packets_enabled) { \ + (dp)->ticks_start = UtilCpuGetTicks(); \ + (dp)->alproto = (id); \ + } + +#define PACKET_PROFILING_APP_END(dp, id) \ + if (profiling_packets_enabled) { \ + BUG_ON((id) != (dp)->alproto); \ + (dp)->ticks_end = UtilCpuGetTicks(); \ + (dp)->ticks_spent = ((dp)->ticks_end - (dp)->ticks_start); \ + } + +#define PACKET_PROFILING_APP_RESET(dp) \ + if (profiling_packets_enabled) { \ + (dp)->ticks_start = 0; \ + (dp)->ticks_end = 0; \ + (dp)->ticks_spent = 0; \ + (dp)->alproto = 0; \ + } + +#define PACKET_PROFILING_APP_STORE(dp, p) \ + if (profiling_packets_enabled) { \ + if ((dp)->alproto < ALPROTO_MAX) { \ + (p)->profile.app[(dp)->alproto].ticks_spent += (dp)->ticks_spent; \ + } \ + } + + void SCProfilingInit(void); void SCProfilingDestroy(void); void SCProfilingInitRuleCounters(DetectEngineCtx *); @@ -107,6 +136,11 @@ void SCProfilingUpdateRuleCounter(uint16_t, uint64_t, int); #define PACKET_PROFILING_RESET(p) +#define PACKET_PROFILING_APP_START(dp, id) +#define PACKET_PROFILING_APP_END(dp, id) +#define PACKET_PROFILING_APP_RESET(dp) +#define PACKET_PROFILING_APP_STORE(dp, p) + #endif /* PROFILING */ #endif /* ! __UTIL_PROFILE_H__ */