Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Defrag engine modifications #8

Closed
wants to merge 7 commits into from
Closed

Defrag engine modifications #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7988399
defrag: really use 'max-frags' variable.
regit Jul 24, 2012
f13e56a
defrag: fix some integer type warning.
regit Jul 26, 2012
bf85ae1
defrag: link hash size with number of frags.
regit Jul 26, 2012
f80daa1
defrag: be hash generous
regit Jul 26, 2012
d3c918e
Add some events relative to defragmentation
regit Jul 26, 2012
17c442a
defrag: Fix description of params
regit Jul 27, 2012
d8ae111
defrag: prealloc more frags.
regit Jul 27, 2012
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/decode-events.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,6 +191,11 @@ enum {
IPV4_FRAG_OVERLAP,
IPV6_FRAG_PKT_TOO_LARGE,
IPV6_FRAG_OVERLAP,
IPV4_FRAG_TOO_LARGE,
IPV6_FRAG_TOO_LARGE,
/* Fragment ignored due to internal error */
IPV4_FRAG_IGNORED,
IPV6_FRAG_IGNORED,

/* should always be last! */
DECODE_EVENT_MAX,
Expand Down
52 changes: 38 additions & 14 deletions src/defrag.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@
#endif

#define DEFAULT_DEFRAG_HASH_SIZE 0xffff
#define DEFAULT_DEFRAG_POOL_SIZE 0xffff

/**
* Default timeout (in seconds) before a defragmentation tracker will
Expand Down Expand Up @@ -416,14 +417,6 @@ DefragContextNew(void)
if (dc == NULL)
return NULL;

/* Initialize the hash table. */
dc->frag_table = HashListTableInit(DEFAULT_DEFRAG_HASH_SIZE, DefragHashFunc,
DefragHashCompare, DefragHashFree);
if (dc->frag_table == NULL) {
SCLogError(SC_ERR_MEM_ALLOC,
"Defrag: Failed to initialize hash table.");
exit(EXIT_FAILURE);
}
if (SCMutexInit(&dc->frag_table_lock, NULL) != 0) {
SCLogError(SC_ERR_MEM_ALLOC,
"Defrag: Failed to initialize hash table mutex.");
Expand All @@ -448,9 +441,21 @@ DefragContextNew(void)
exit(EXIT_FAILURE);
}

/* Initialize the hash table. */
dc->frag_table = HashListTableInit(tracker_pool_size, DefragHashFunc,
DefragHashCompare, DefragHashFree);
if (dc->frag_table == NULL) {
SCLogError(SC_ERR_MEM_ALLOC,
"Defrag: Failed to initialize hash table.");
exit(EXIT_FAILURE);
}

/* Initialize the pool of frags. */
int frag_pool_size = 0xffff;
int frag_pool_prealloc = frag_pool_size / 4;
intmax_t frag_pool_size;
if (!ConfGetInt("defrag.max-frags", &frag_pool_size)) {
frag_pool_size = DEFAULT_DEFRAG_POOL_SIZE;
}
intmax_t frag_pool_prealloc = frag_pool_size / 2;
dc->frag_pool = PoolInit(frag_pool_size, frag_pool_prealloc,
DefragFragNew, dc, DefragFragFree);
if (dc->frag_pool == NULL) {
Expand Down Expand Up @@ -487,8 +492,8 @@ DefragContextNew(void)
SCLogDebug("\tTimeout: %"PRIuMAX, (uintmax_t)dc->timeout);
SCLogDebug("\tMaximum defrag trackers: %"PRIuMAX, tracker_pool_size);
SCLogDebug("\tPreallocated defrag trackers: %"PRIuMAX, tracker_pool_size);
SCLogDebug("\tMaximum fragments: %d", frag_pool_size);
SCLogDebug("\tPreallocated fragments: %d", frag_pool_prealloc);
SCLogDebug("\tMaximum fragments: %ld", frag_pool_size);
SCLogDebug("\tPreallocated fragments: %ld", frag_pool_prealloc);

return dc;
}
Expand Down Expand Up @@ -928,6 +933,11 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragContext *dc,

insert:
if (data_len - ltrim <= 0) {
if (af == AF_INET) {
ENGINE_SET_EVENT(p, IPV4_FRAG_TOO_LARGE);
} else {
ENGINE_SET_EVENT(p, IPV6_FRAG_TOO_LARGE);
}
goto done;
}

Expand All @@ -936,13 +946,23 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragContext *dc,
Frag *new = PoolGet(dc->frag_pool);
SCMutexUnlock(&dc->frag_pool_lock);
if (new == NULL) {
if (af == AF_INET) {
ENGINE_SET_EVENT(p, IPV4_FRAG_IGNORED);
} else {
ENGINE_SET_EVENT(p, IPV6_FRAG_IGNORED);
}
goto done;
}
new->pkt = SCMalloc(GET_PKT_LEN(p));
if (new->pkt == NULL) {
SCMutexLock(&dc->frag_pool_lock);
PoolReturn(dc->frag_pool, new);
SCMutexUnlock(&dc->frag_pool_lock);
if (af == AF_INET) {
ENGINE_SET_EVENT(p, IPV4_FRAG_IGNORED);
} else {
ENGINE_SET_EVENT(p, IPV6_FRAG_IGNORED);
}
goto done;
}
memcpy(new->pkt, GET_PKT_DATA(p) + ltrim, GET_PKT_LEN(p) - ltrim);
Expand Down Expand Up @@ -1235,9 +1255,13 @@ DefragInit(void)
/* Initialize random value for hashing and hash table size. */
unsigned int seed = RandomTimePreseed();
/* set defaults */
defrag_hash_rand = (int)( DEFAULT_DEFRAG_HASH_SIZE * (rand_r(&seed) / RAND_MAX + 1.0));
intmax_t tracker_pool_size;
if (!ConfGetInt("defrag.trackers", &tracker_pool_size)) {
tracker_pool_size = DEFAULT_DEFRAG_HASH_SIZE;
}

defrag_hash_size = DEFAULT_DEFRAG_HASH_SIZE;
defrag_hash_rand = (int)( tracker_pool_size * (rand_r(&seed) / RAND_MAX + 1.0));
defrag_hash_size = tracker_pool_size;

/* Allocate the DefragContext. */
defrag_context = DefragContextNew();
Expand Down
3 changes: 2 additions & 1 deletion suricata.yaml.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -427,7 +427,8 @@ pattern-matcher:
# Defrag settings:

defrag:
max-frags: 65535
trackers: 65535 # number of defragmented flows to follow
max-frags: 65535 # number of fragments to keep (higher than trackers)
prealloc: yes
timeout: 60

Expand Down