1 //--------------------------------------------------------------------------
2 // Copyright (C) 2014-2021 Cisco and/or its affiliates. All rights reserved.
3 //
4 // This program is free software; you can redistribute it and/or modify it
5 // under the terms of the GNU General Public License Version 2 as published
6 // by the Free Software Foundation.  You may not use, modify or distribute
7 // this program under any other version of the GNU General Public License.
8 //
9 // This program is distributed in the hope that it will be useful, but
10 // WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
12 // General Public License for more details.
13 //
14 // You should have received a copy of the GNU General Public License along
15 // with this program; if not, write to the Free Software Foundation, Inc.,
16 // 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
17 //--------------------------------------------------------------------------
18 
19 // perf_module.h author Russ Combs <rucombs@cisco.com>
20 
21 #ifndef PERF_MODULE_H
22 #define PERF_MODULE_H
23 
24 #include <unordered_map>
25 
26 #include "framework/module.h"
27 
28 #include "perf_pegs.h"
29 #include "perf_reload_tuner.h"
30 
31 #define PERF_NAME "perf_monitor"
32 #define PERF_HELP "performance monitoring and flow statistics collection"
33 
34 // Perf Flags
35 #define PERF_BASE       0x00000001
36 #define PERF_CPU        0x00000002
37 #define PERF_FLOW       0x00000004
38 #define PERF_FLOWIP     0x00000008
39 #define PERF_SUMMARY    0x00000010
40 
41 #define ROLLOVER_THRESH     512
42 #define MAX_PERF_FILE_SIZE  UINT64_MAX
43 #define MIN_PERF_FILE_SIZE  4096
44 
45 enum class PerfFormat
46 {
47     CSV,
48     TEXT,
49     JSON,
50     FBS,
51     MOCK
52 };
53 
54 enum class PerfOutput
55 {
56     TO_FILE,
57     TO_CONSOLE
58 };
59 
60 struct ModuleConfig
61 {
62     // state optimized for run time using indices
63     // can't be determined until all modules have loaded (PerfMonitor::configure)
64     snort::Module* ptr;
65     IndexVec pegs;
66 
67     void set_name(const std::string& name);
68     void set_peg_names(snort::Value& peg_names);
69     bool confirm_parse();
70     bool resolve();
71 
72 private:
73     std::string name;
74     std::unordered_map<std::string, bool> peg_names;
75 };
76 
77 struct PerfConstraints
78 {
79     bool flow_ip_enabled = false;
80     unsigned sample_interval = 0;
81     uint32_t pkt_cnt = 0;
82 
83     PerfConstraints() = default;
PerfConstraintsPerfConstraints84     PerfConstraints(bool en, unsigned interval, uint32_t cnt) :
85         flow_ip_enabled(en), sample_interval(interval), pkt_cnt(cnt) { }
86 };
87 
88 struct PerfConfig
89 {
90     int perf_flags = 0;
91     uint32_t pkt_cnt = 0;
92     unsigned sample_interval = 0;
93     uint64_t max_file_size = 0;
94     int flow_max_port_to_track = 0;
95     size_t flowip_memcap = 0;
96     PerfFormat format = PerfFormat::CSV;
97     PerfOutput output = PerfOutput::TO_FILE;
98     std::vector<ModuleConfig> modules;
99     std::vector<snort::Module*> mods_to_prep;
100     PerfConstraints* constraints;
101 
PerfConfigPerfConfig102     PerfConfig() { constraints = new PerfConstraints; }
~PerfConfigPerfConfig103     ~PerfConfig() { delete constraints; }
104 
105     bool resolve();
106 };
107 
108 /* The Module Class for incorporation into Snort++ */
109 class PerfMonModule : public snort::Module
110 {
111 public:
112     PerfMonModule();
113     ~PerfMonModule() override;
114 
115     const snort::Command* get_commands() const override;
116     bool set(const char*, snort::Value&, snort::SnortConfig*) override;
117     bool begin(const char*, int, snort::SnortConfig*) override;
118     bool end(const char*, int, snort::SnortConfig*) override;
119 
120     const PegInfo* get_pegs() const override;
121     PegCount* get_counts() const override;
122     snort::ProfileStats* get_profile() const override;
123 
124     PerfConfig* get_config();
125 #ifdef UNIT_TEST
set_config(PerfConfig * ptr)126     void set_config(PerfConfig* ptr) { config = ptr; }
127 #endif
128 
get_usage()129     Usage get_usage() const override
130     { return GLOBAL; }
131 
132 private:
133     PerfConfig* config = nullptr;
134 };
135 
136 extern THREAD_LOCAL PerfPegStats pmstats;
137 extern THREAD_LOCAL snort::ProfileStats perfmonStats;
138 
139 #endif
140 
141