snort_stream4_session.c

著名的入侵检测系统snort的最新版本的源码

/* $Id$ */

/*
** Copyright (C) 2005 Sourcefire, Inc.
** AUTHOR: Steven Sturges <[e-mail]>
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License Version 2 as
** published by the Free Software Foundation.  You may not use, modify or
** distribute this program under any other version of the GNU General
** Public License.
**
** This program is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
** GNU General Public License for more details.
**
** You should have received a copy of the GNU General Public License
** along with this program; if not, write to the Free Software
** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/

/* snort_stream4_session.c
 * 
 * Purpose: Hash Table implementation of session management functions for
 *          TCP stream preprocessor.
 *
 * Arguments:
 *   
 * Effect:
 *
 * Comments:
 *
 * Any comments?
 *
 */

#define _STREAM4_INTERNAL_USAGE_ONLY_

#include "sfxhash.h"
#include "decode.h"
#include "debug.h"
#include "stream.h"
#include "log.h"
#include "util.h"

/* Stuff defined in stream4.c that we use */
extern void DeleteSession(Session *, u_int32_t, char flags);
extern Stream4Data s4data;
extern u_int32_t stream4_memory_usage;

static SFXHASH *sessionHashTable = NULL;
static SFXHASH *udpSessionHashTable = NULL;

#include "snort.h"
#include "profiler.h"
#ifdef PERF_PROFILING
extern PreprocStats stream4LUSessPerfStats;
#endif

#ifndef WIN32
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#endif

int GetSessionCount(Packet *p)
{
    if (IPH_IS_VALID(p))
    {
        if (GET_IPH_PROTO(p) == IPPROTO_TCP)
        {
            if (sessionHashTable)
                return sessionHashTable->count;
            else
                return 0;
        }
        else
        {
            if (udpSessionHashTable)
                return udpSessionHashTable->count;
            else
                return 0;
        }
    }
    return 0;
}

int GetSessionKey(Packet *p, SessionHashKey *key)
{
    ip_p srcIp, dstIp;
    u_int16_t srcPort, dstPort;

    if (!key)
        return 0;

    memset(key, 0, sizeof(SessionHashKey));

    srcIp = GET_SRC_IP(p);
    dstIp = GET_DST_IP(p);
    if (p->tcph)
    {
        srcPort = p->tcph->th_sport;
        dstPort = p->tcph->th_dport;
    }
#ifdef STREAM4_UDP
    else if (p->udph)
    {
        srcPort = p->udph->uh_sport;
        dstPort = p->udph->uh_dport;
    }
#endif
    else
    {
        srcPort = 0;
        dstPort = 0;
    }
    
    if (IP_LESSER(srcIp, dstIp))
    {
        IP_COPY_VALUE(key->lowIP, srcIp);
        key->port = srcPort;
        IP_COPY_VALUE(key->highIP, dstIp);
        key->port2 = dstPort;
    }
    else if (IP_EQUALITY(srcIp, dstIp))
    {
        IP_COPY_VALUE(key->lowIP, srcIp);
        IP_COPY_VALUE(key->highIP, dstIp);
        if (srcPort < dstPort)
        {
            key->port = srcPort;
            key->port2 = dstPort;
        }
        else
        {
            key->port2 = srcPort;
            key->port = dstPort;
        }
    }
    else
    {
        IP_COPY_VALUE(key->lowIP, dstIp);
        key->port = dstPort;
        IP_COPY_VALUE(key->highIP, srcIp);
        key->port2 = srcPort;
    }

    key->proto = GET_IPH_PROTO(p);

#ifdef _LP64
    key->pad1 = key->pad2 = 0;
#endif

    return 1;
}

Session *GetSessionFromHashTable(Packet *p)
{
    Session *returned = NULL;
    SFXHASH_NODE *hnode;
    SessionHashKey sessionKey;
    SFXHASH *table;

    if (!GetSessionKey(p, &sessionKey))
        return NULL;

    if (sessionKey.proto == IPPROTO_TCP)
    {
        table = sessionHashTable;
    }
    else /* Implied IPPROTO_UDP */
    {
        table = udpSessionHashTable;
    }

    hnode = sfxhash_find_node(table, &sessionKey);

    if (hnode && hnode->data)
    {
        /* This is a unique hnode, since the sfxhash finds the
         * same key before returning this node.
         */
        returned = (Session *)hnode->data;
    }
    return returned;
}

int RemoveSessionFromHashTable(Session *ssn)
{
    SFXHASH *table;
    if (ssn->hashKey.proto == IPPROTO_TCP)
    {
        table = sessionHashTable;
    }
    else /* Implied IPPROTO_UDP */
    {
        table = udpSessionHashTable;
    }

    return sfxhash_remove(table, &(ssn->hashKey));
}

int CleanHashTable(SFXHASH *table, u_int32_t thetime, Session *save_me, int memCheck)
{
    Session *idx;
    u_int32_t pruned = 0;
    u_int32_t timeout = s4data.timeout;

    if (thetime != 0)
    {
        char got_one;
        idx = (Session *) sfxhash_lru(table);

        if(idx == NULL)
        {
            return 0;
        }

        do
        {
            got_one = 0;            
            if(idx == save_me)
            {
                SFXHASH_NODE *lastNode = sfxhash_lru_node(table);
                sfxhash_gmovetofront(table, lastNode);
                lastNode = sfxhash_lru_node(table);
                if ((lastNode) && (lastNode->data != idx))
                {
                    idx = (Session *)lastNode->data;
                    continue;
                }
                else
                {
                    return pruned;
                }
            }

            timeout = s4data.timeout;
            if(idx->drop_traffic)
            {
                /* If we're dropping traffic on the session, keep
                 * it around longer.  */
                timeout = s4data.timeout * 2;
            }

            if((idx->last_session_time+timeout) < thetime)
            {
                Session *savidx = idx;

                if(sfxhash_count(table) > 1)
                {
                    DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "pruning stale session\n"););
                    DeleteSession(savidx, thetime, SESSION_CLOSED_TIMEDOUT);
                    idx = (Session *) sfxhash_lru(table);
                    pruned++;
                    got_one = 1;
                }
                else
                {
                    DeleteSession(savidx, thetime, SESSION_CLOSED_TIMEDOUT);
                    pruned++;
                    return pruned;
                }
            }
            else
            {
                return pruned;
            }

            if (pruned > s4data.cache_clean_sessions)
            {
                /* Don't bother cleaning more than XXX at a time */
                break;
            }
        } while ((idx != NULL) && (got_one == 1));

        return pruned;
    }
    else
    {
        /* Free up xxx sessions at a time until we get under the
         * memcap or free enough sessions to be able to create
         * new ones.
         *
         * This loop repeats while we're over the memcap or we have
         * more sessions than the max less what we're supposed to
         * cleanup at a time.
         */
        while ((sfxhash_count(table) > 1) &&
                ((memCheck && (stream4_memory_usage > s4data.memcap)) ||
                 (table->count > (s4data.max_sessions - s4data.cache_clean_sessions)) ||
                 (pruned < s4data.cache_clean_sessions)))
        {
            u_int32_t i;
            idx = (Session *) sfxhash_lru(table);

            for (i=0;i<s4data.cache_clean_sessions && 
                     (sfxhash_count(table) > 1); i++)
            {
                if(idx != save_me)
                {
                    DeleteSession(idx, thetime, SESSION_CLOSED_PRUNED);
                    pruned++;
                    idx = (Session *) sfxhash_lru(table);
                }
                else
                {
                    SFXHASH_NODE *lastNode = sfxhash_lru_node(table);
                    sfxhash_gmovetofront(table, lastNode);
                    lastNode = sfxhash_lru_node(table);
                    if ((lastNode) && (lastNode->data == idx))
                    {
                        /* Okay, this session is the only one left */
                        break;
                    }
                    idx = (Session *) sfxhash_lru(table);
                    i--; /* Didn't clean this one */
                }
            }
        }
    }
    return pruned;
}

Session *GetNewSession(Packet *p)
{
    Session *retSsn = NULL;
    SessionHashKey sessionKey;
    SFXHASH_NODE *hnode = NULL;
    SFXHASH *table;

    if (!GetSessionKey(p, &sessionKey))
        return retSsn;

    if (sessionKey.proto == IPPROTO_TCP)
    {
        table = sessionHashTable;
    }
    else /* Implied IPPROTO_UDP */
    {
        table = udpSessionHashTable;
    }

    if (stream4_memory_usage < s4data.memcap)
    {
        hnode = sfxhash_get_node(table, &sessionKey);
    }

    if (!hnode)
    {
        DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "HashTable full, clean it\n"););
        s4data.last_prune_time = p->pkth->ts.tv_sec;
        if (!CleanHashTable(table, p->pkth->ts.tv_sec, NULL, 0))
        {
            DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "HashTable full, no timeouts, clean it\n"););

            CleanHashTable(table, 0, NULL, 0);
        }

        /* Should have some freed nodes now */
        hnode = sfxhash_get_node(table, &sessionKey);
        if (!hnode)
        {
            DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "Problem, no freed nodes\n"););
        }
    }
    if (hnode && hnode->data)
    {
        retSsn = hnode->data;

        /* Zero everything out */
        memset(retSsn, 0, sizeof(Session));

        /* Save the session key for future use */
        memcpy(&(retSsn->hashKey), &sessionKey,
                        sizeof(SessionHashKey));
    }

    return retSsn;
}

Session *RemoveSession(Session *ssn)
{
    if (!RemoveSessionFromHashTable(ssn) )
        return ssn;
    else
        return NULL;
}

Session *GetSession(Packet *p)
{
    Session *ssn;
    PROFILE_VARS;
    PREPROC_PROFILE_START(stream4LUSessPerfStats);
    ssn = GetSessionFromHashTable(p);
    PREPROC_PROFILE_END(stream4LUSessPerfStats);

    /* Handle a timeout of existing session */
    if(ssn)
    {
        int timeout = s4data.timeout;
        if(ssn->drop_traffic)
        {
            /* If we're dropping traffic on the session, keep
             * it around longer.  */
            timeout *= 2;
        }
        if ((ssn->last_session_time+timeout) < p->pkth->ts.tv_sec)
        {
            DeleteSession(ssn, p->pkth->ts.tv_sec, SESSION_CLOSED_TIMEDOUT);
            ssn = NULL;
        }
    }

    return ssn;
}

void InitSessionCache()
{
    if (!sessionHashTable)
    {
        /* Create the hash table --
         * SESSION_HASH_TABLE_SIZE hash buckets
         * keysize = 12 bytes (2x 32bit IP, 2x16bit port)
         * data size = sizeof(Session) object
         * no max mem
         * no automatic node recovery
         * NULL node recovery free function
         * NULL user data free function
         * recycle nodes
         */
        /* Rule of thumb, size should be 1.4 times max to avoid
         * collisions.
         */
        int hashTableSize = sfxhash_calcrows((int)(s4data.max_sessions * 1.4));
        //int maxSessionMem = s4data.max_sessions * (
        //                     sizeof(Session) +
        //                     sizeof(SFXHASH_NODE) +
        //                     sizeof(SessionHashKey) +
        //                     sizeof (SFXHASH_NODE *));
        //int tableMem = (hashTableSize +1) * sizeof(SFXHASH_NODE*);
        //int maxMem = maxSessionMem + tableMem;
        sessionHashTable = sfxhash_new(hashTableSize,
                        sizeof(SessionHashKey),
                        //sizeof(Session), maxMem, 0, NULL, NULL, 1);
                        sizeof(Session), 0, 0, NULL, NULL, 1);

        sfxhash_set_max_nodes(sessionHashTable, s4data.max_sessions);
#ifdef STREAM4_UDP
        /* And create the udp one */
        hashTableSize = sfxhash_calcrows((int)(s4data.max_udp_sessions * 1.4));
        //maxSessionMem = s4data.max_udp_sessions * (
        //                     sizeof(Session) +
        //                     sizeof(SFXHASH_NODE) +
        //                     sizeof(SessionHashKey) +
        //                     sizeof (SFXHASH_NODE *));
        //tableMem = (hashTableSize +1) * sizeof(SFXHASH_NODE*);
        //maxMem = maxSessionMem + tableMem;
        udpSessionHashTable = sfxhash_new(hashTableSize,
                        sizeof(SessionHashKey),
                        //sizeof(Session), maxMem, 0, NULL, NULL, 1);
                        sizeof(Session), 0, 0, NULL, NULL, 1);

        sfxhash_set_max_nodes(udpSessionHashTable, s4data.max_udp_sessions);
#endif
    }
}

void PurgeSessionCache()
{
    Session *ssn = NULL;
    ssn = (Session *)sfxhash_mru(sessionHashTable);
    while (ssn)
    {
        DeleteSession(ssn, 0, SESSION_CLOSED_PRUNED);
        ssn = (Session *)sfxhash_mru(sessionHashTable);
    }
}

void PrintSessionCache()
{
    DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "%lu streams active, %u bytes in use\n", 
                            sfxhash_count(sessionHashTable), stream4_memory_usage););
    return;
}

int PruneSessionCache(u_int8_t proto, u_int32_t thetime, int mustdie, Session *save_me)
{
    SFXHASH *table;
    if (proto == IPPROTO_TCP)
    {
        table = sessionHashTable;
    }
    else /* Implied IPPROTO_UDP */
    {
        table = udpSessionHashTable;
    }

    return CleanHashTable(table, thetime, save_me, 1);
}