1 //-------------------------------------------------------------------------- 2 // Copyright (C) 2014-2021 Cisco and/or its affiliates. All rights reserved. 3 // 4 // This program is free software; you can redistribute it and/or modify it 5 // under the terms of the GNU General Public License Version 2 as published 6 // by the Free Software Foundation. You may not use, modify or distribute 7 // this program under any other version of the GNU General Public License. 8 // 9 // This program is distributed in the hope that it will be useful, but 10 // WITHOUT ANY WARRANTY; without even the implied warranty of 11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 // General Public License for more details. 13 // 14 // You should have received a copy of the GNU General Public License along 15 // with this program; if not, write to the Free Software Foundation, Inc., 16 // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 17 //-------------------------------------------------------------------------- 18 19 // perf_module.h author Russ Combs <rucombs@cisco.com> 20 21 #ifndef PERF_MODULE_H 22 #define PERF_MODULE_H 23 24 #include <unordered_map> 25 26 #include "framework/module.h" 27 28 #include "perf_pegs.h" 29 #include "perf_reload_tuner.h" 30 31 #define PERF_NAME "perf_monitor" 32 #define PERF_HELP "performance monitoring and flow statistics collection" 33 34 // Perf Flags 35 #define PERF_BASE 0x00000001 36 #define PERF_CPU 0x00000002 37 #define PERF_FLOW 0x00000004 38 #define PERF_FLOWIP 0x00000008 39 #define PERF_SUMMARY 0x00000010 40 41 #define ROLLOVER_THRESH 512 42 #define MAX_PERF_FILE_SIZE UINT64_MAX 43 #define MIN_PERF_FILE_SIZE 4096 44 45 enum class PerfFormat 46 { 47 CSV, 48 TEXT, 49 JSON, 50 FBS, 51 MOCK 52 }; 53 54 enum class PerfOutput 55 { 56 TO_FILE, 57 TO_CONSOLE 58 }; 59 60 struct ModuleConfig 61 { 62 // state optimized for run time using indices 63 // can't be determined until all modules have loaded (PerfMonitor::configure) 64 snort::Module* ptr; 65 IndexVec pegs; 66 67 void set_name(const std::string& name); 68 void set_peg_names(snort::Value& peg_names); 69 bool confirm_parse(); 70 bool resolve(); 71 72 private: 73 std::string name; 74 std::unordered_map<std::string, bool> peg_names; 75 }; 76 77 struct PerfConstraints 78 { 79 bool flow_ip_enabled = false; 80 unsigned sample_interval = 0; 81 uint32_t pkt_cnt = 0; 82 83 PerfConstraints() = default; PerfConstraintsPerfConstraints84 PerfConstraints(bool en, unsigned interval, uint32_t cnt) : 85 flow_ip_enabled(en), sample_interval(interval), pkt_cnt(cnt) { } 86 }; 87 88 struct PerfConfig 89 { 90 int perf_flags = 0; 91 uint32_t pkt_cnt = 0; 92 unsigned sample_interval = 0; 93 uint64_t max_file_size = 0; 94 int flow_max_port_to_track = 0; 95 size_t flowip_memcap = 0; 96 PerfFormat format = PerfFormat::CSV; 97 PerfOutput output = PerfOutput::TO_FILE; 98 std::vector<ModuleConfig> modules; 99 std::vector<snort::Module*> mods_to_prep; 100 PerfConstraints* constraints; 101 PerfConfigPerfConfig102 PerfConfig() { constraints = new PerfConstraints; } ~PerfConfigPerfConfig103 ~PerfConfig() { delete constraints; } 104 105 bool resolve(); 106 }; 107 108 /* The Module Class for incorporation into Snort++ */ 109 class PerfMonModule : public snort::Module 110 { 111 public: 112 PerfMonModule(); 113 ~PerfMonModule() override; 114 115 const snort::Command* get_commands() const override; 116 bool set(const char*, snort::Value&, snort::SnortConfig*) override; 117 bool begin(const char*, int, snort::SnortConfig*) override; 118 bool end(const char*, int, snort::SnortConfig*) override; 119 120 const PegInfo* get_pegs() const override; 121 PegCount* get_counts() const override; 122 snort::ProfileStats* get_profile() const override; 123 124 PerfConfig* get_config(); 125 #ifdef UNIT_TEST set_config(PerfConfig * ptr)126 void set_config(PerfConfig* ptr) { config = ptr; } 127 #endif 128 get_usage()129 Usage get_usage() const override 130 { return GLOBAL; } 131 132 private: 133 PerfConfig* config = nullptr; 134 }; 135 136 extern THREAD_LOCAL PerfPegStats pmstats; 137 extern THREAD_LOCAL snort::ProfileStats perfmonStats; 138 139 #endif 140 141