Mark flow elephant/v2 #12123
Mark flow elephant/v2 #12123
Conversation
1. Add user defined elephant flow definition based on rate of bytes easily configurable in suricata.yaml. 2. Add an elephant flow counter. Feature 5647
This is to allow a way to match on the rate of the flow through rule language. This serves as a trivial first step to a more elaborate path to defining and detecting elephant flows.
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #12123 +/- ##
===========================================
+ Coverage 62.68% 83.14% +20.46%
===========================================
Files 840 910 +70
Lines 153669 257927 +104258
===========================================
+ Hits 96323 214466 +118143
+ Misses 57346 43461 -13885
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Need to find a way to keep time blocked data structures for flow management so this can be done on any interval. Victor suggested we could start w this trivial keyword though. Interested in hearing if it makes sense to others too. |
|
|
||
| static int DetectFlowRateSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr) | ||
| { | ||
| uint64_t rate = atoll(rawstr); |
There was a problem hiding this comment.
will need to use the StringParseUint64 or StringParseU64RangeCheck
| @@ -499,6 +501,7 @@ typedef struct Flow_ | |||
| uint64_t todstbytecnt; | |||
| uint64_t tosrcbytecnt; | |||
|
|
|||
| bool elephant; | |||
There was a problem hiding this comment.
how does this affect the flow memory layout? (pahole)
| return rate == expected_rate; | ||
| } | ||
|
|
||
| static int DetectFlowRateSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr) |
There was a problem hiding this comment.
I think we need to think about how the arguments will express time later.
There was a problem hiding this comment.
ok that was a basic. idk why i don't have that 🤦🏽
| #include "detect-parse.h" | ||
|
|
||
| static int DetectFlowRateMatch( | ||
| DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx) |
There was a problem hiding this comment.
I would expect this to use the detect int handling code
| uint64_t rate = (p->flow->tosrcbytecnt + p->flow->todstbytecnt) / age; | ||
|
|
||
| uint64_t expected_rate = (uint64_t)ctx; | ||
| return rate == expected_rate; |
There was a problem hiding this comment.
incorrect. should'nt look for exact match but greater than equal to instead
|
Information: ERROR: QA failed on SURI_TLPR1_alerts_cmp.
Pipeline 23324 |
Link to ticket: https://redmine.openinfosecfoundation.org/issues/5647
SV_BRANCH=OISF/suricata-verify#2130
Previous PR: #11645
Changes since v1: