SSADetector: Updated coding style, Removed unnamed constants

Author: hynekkar

process/ssadetector.cpp

@@ -52,56 +52,59 @@ int RecordExtSSADetector::REGISTERED_ID = -1;
 
 __attribute__((constructor)) static void register_this_plugin()
 {
-   static PluginRecord rec = PluginRecord("ssadetector", [](){return new SSADetectorPlugin();});
+   static PluginRecord rec = PluginRecord("ssadetector", []() { return new SSADetectorPlugin(); });
    register_plugin(&rec);
    RecordExtSSADetector::REGISTERED_ID = register_extension();
 }
 
-
 SSADetectorPlugin::SSADetectorPlugin()
 {
    close();
 }
 
-SSADetectorPlugin::~SSADetectorPlugin()
-{
-}
+SSADetectorPlugin::~SSADetectorPlugin() {}
 
-void SSADetectorPlugin::init(const char *params)
-{
-}
+void SSADetectorPlugin::init(const char* params) {}
 
-void SSADetectorPlugin::close()
-{
-}
+void SSADetectorPlugin::close() {}
 
-ProcessPlugin *SSADetectorPlugin::copy()
+ProcessPlugin* SSADetectorPlugin::copy()
 {
    return new SSADetectorPlugin(*this);
 }
 
-inline void transition_from_init(RecordExtSSADetector *record, uint16_t len, 
-                                 const timeval& ts, uint8_t dir)
+inline void SSADetectorPlugin::transition_from_init(
+    RecordExtSSADetector* record,
+    uint16_t len,
+    const timeval& ts,
+    uint8_t dir)
 {
    record->syn_table.update_entry(len, dir, ts);
 }
-inline void transition_from_syn(RecordExtSSADetector *record, uint16_t len, 
-                                const timeval& ts, uint8_t dir)
+
+inline void SSADetectorPlugin::transition_from_syn(
+    RecordExtSSADetector* record,
+    uint16_t len,
+    const timeval& ts,
+    uint8_t dir)
 {
-   bool can_transit = record->syn_table.check_range_for_presence(len, 10, !dir, ts);
+   bool can_transit = record->syn_table.check_range_for_presence(len, SYN_LOOKUP_WINDOW, !dir, ts);
    if (can_transit) {
       record->syn_ack_table.update_entry(len, dir, ts);
-   } 
+   }
 }
 
-inline bool transition_from_syn_ack(RecordExtSSADetector *record, 
-                                    uint16_t len, const timeval& ts, uint8_t dir)
+inline bool SSADetectorPlugin::transition_from_syn_ack(
+    RecordExtSSADetector* record,
+    uint16_t len,
+    const timeval& ts,
+    uint8_t dir)
 {
-   return record->syn_table.check_range_for_presence(len, 12, !dir, ts);
+   return record->syn_table.check_range_for_presence(len, SYN_ACK_LOOKUP_WINDOW, !dir, ts);
 }
 
-void SSADetectorPlugin::update_record(RecordExtSSADetector *record, const Packet &pkt)
-{ 
+void SSADetectorPlugin::update_record(RecordExtSSADetector* record, const Packet& pkt)
+{
    /**
     * 0 - client -> server
     * 1 - server -> client
@@ -110,7 +113,7 @@ void SSADetectorPlugin::update_record(RecordExtSSADetector *record, const Packet
    uint16_t len = pkt.payload_len;
    timeval ts = pkt.ts;
 
-   if ( !(MIN_PKT_SIZE <= len && len <= MAX_PKT_SIZE) ) {
+   if (!(MIN_PKT_SIZE <= len && len <= MAX_PKT_SIZE)) {
       return;
    }
 
@@ -130,18 +133,19 @@ void SSADetectorPlugin::update_record(RecordExtSSADetector *record, const Packet
    transition_from_init(record, len, ts, dir);
 }
 
-int SSADetectorPlugin::post_create(Flow &rec, const Packet &pkt)
+int SSADetectorPlugin::post_create(Flow& rec, const Packet& pkt)
 {
-   RecordExtSSADetector *record = new RecordExtSSADetector();
+   RecordExtSSADetector* record = new RecordExtSSADetector();
    rec.add_extension(record);
 
    update_record(record, pkt);
    return 0;
 }
 
-int SSADetectorPlugin::post_update(Flow &rec, const Packet &pkt)
+int SSADetectorPlugin::post_update(Flow& rec, const Packet& pkt)
 {
-   RecordExtSSADetector *record = (RecordExtSSADetector *) rec.get_extension(RecordExtSSADetector::REGISTERED_ID);
+   RecordExtSSADetector* record
+       = (RecordExtSSADetector*) rec.get_extension(RecordExtSSADetector::REGISTERED_ID);
    update_record(record, pkt);
    return 0;
 }
@@ -150,7 +154,8 @@ double classes_ratio(uint8_t* syn_pkts, uint8_t size)
 {
    uint8_t unique_members = 0;
    bool marked[size];
-   for (uint8_t i = 0; i < size; ++i) marked[i] = false;
+   for (uint8_t i = 0; i < size; ++i)
+      marked[i] = false;
    for (uint8_t i = 0; i < size; ++i) {
       if (marked[i]) {
          continue;
@@ -168,76 +173,56 @@ double classes_ratio(uint8_t* syn_pkts, uint8_t size)
       }
    }
 
-   return double(unique_members) / double(size); 
+   return double(unique_members) / double(size);
 }
 
-void SSADetectorPlugin::pre_export(Flow &rec)
+void SSADetectorPlugin::pre_export(Flow& rec)
 {
-      //do not export for small packets flows
+   // do not export for small packets flows
    uint32_t packets = rec.src_packets + rec.dst_packets;
-   if (packets <= 30) {
+   if (packets <= MIN_PKT_IN_FLOW) {
       rec.remove_extension(RecordExtSSADetector::REGISTERED_ID);
       return;
    }
 
-   RecordExtSSADetector *record = (RecordExtSSADetector *) rec.get_extension(RecordExtSSADetector::REGISTERED_ID);
-   const auto& suspects = record->suspects; 
-   if (suspects < 3) {
+   RecordExtSSADetector* record
+       = (RecordExtSSADetector*) rec.get_extension(RecordExtSSADetector::REGISTERED_ID);
+   const auto& suspects = record->suspects;
+   if (suspects < MIN_NUM_SUSPECTS) {
       return;
    }
-   if (double(packets)/double(suspects) > 2500) {
+   if (double(packets) / double(suspects) > MIN_SUSPECTS_RATIO) {
       return;
    }
-   if (suspects < 15) {
-      if (classes_ratio(record->syn_pkts, record->syn_pkts_idx) > 0.6) {
+   if (suspects < LOW_NUM_SUSPECTS_THRESHOLD) {
+      if (classes_ratio(record->syn_pkts, record->syn_pkts_idx) > LOW_NUM_SUSPECTS_MAX_RATIO) {
          return;
       }
-   } else if (suspects < 40) {
-      if (classes_ratio(record->syn_pkts, record->syn_pkts_idx) > 0.4) {
+   } else if (suspects < MID_NUM_SUSPECTS_THRESHOLD) {
+      if (classes_ratio(record->syn_pkts, record->syn_pkts_idx) > MID_NUM_SUSPECTS_MAX_RATIO) {
          return;
       }
    } else {
-      if (classes_ratio(record->syn_pkts, record->syn_pkts_idx) > 0.2) {
+      if (classes_ratio(record->syn_pkts, record->syn_pkts_idx) > HIGH_NUM_SUSPECTS_MAX_RATIO) {
          return;
       }
    }
 
    record->possible_vpn = 1;
 }
 
-void SSADetectorPlugin::transition_from_init(RecordExtSSADetector *record, 
-                                             uint16_t len, const timeval& ts, uint8_t dir)
-{
-   record->syn_table.update_entry(len, dir, ts);
-}
-
-void SSADetectorPlugin::transition_from_syn(RecordExtSSADetector *record, 
-                                            uint16_t len, const timeval& ts, uint8_t dir)
-{
-   bool can_transit = record->syn_table.check_range_for_presence(len, 10, !dir, ts);
-   if (can_transit) {
-      record->syn_ack_table.update_entry(len, dir, ts);
-   } 
-}
-
-bool SSADetectorPlugin::transition_from_syn_ack(RecordExtSSADetector *record, uint16_t len, 
-                                           const timeval& ts, uint8_t dir)
-{
-   return record->syn_table.check_range_for_presence(len, 12, !dir, ts);
-}
-
 //--------------------RecordExtSSADetector::pkt_entry-------------------------------
-void RecordExtSSADetector::pkt_entry::reset() 
+void RecordExtSSADetector::pkt_entry::reset()
 {
-      ts_dir1.tv_sec = 0;
-      ts_dir1.tv_usec = 0;
-      ts_dir2.tv_sec = 0;
-      ts_dir2.tv_usec = 0;
+   ts_dir1.tv_sec = 0;
+   ts_dir1.tv_usec = 0;
+   ts_dir2.tv_sec = 0;
+   ts_dir2.tv_usec = 0;
 }
 
 timeval& RecordExtSSADetector::pkt_entry::get_time(dir_t dir)
 {
-   return (dir == 1)? ts_dir1 : ts_dir2;
+   return (dir == 1) ? ts_dir1 : ts_dir2;
 }
 
 RecordExtSSADetector::pkt_entry::pkt_entry()
@@ -249,12 +234,15 @@ RecordExtSSADetector::pkt_entry::pkt_entry()
 void RecordExtSSADetector::pkt_table::reset()
 {
    for (int i = 0; i < PKT_TABLE_SIZE; ++i) {
-         table_[i].reset();
-      }
+      table_[i].reset();
+   }
 }
 
-bool RecordExtSSADetector::pkt_table::check_range_for_presence(uint16_t len, uint8_t down_by, 
-                                                               dir_t dir, const timeval& ts_to_compare)
+bool RecordExtSSADetector::pkt_table::check_range_for_presence(
+    uint16_t len,
+    uint8_t down_by,
+    dir_t dir,
+    const timeval& ts_to_compare)
 {
    int8_t idx = get_idx_from_len(len);
    for (int8_t i = std::max(idx - down_by, 0); i <= idx; ++i) {
@@ -270,7 +258,7 @@ void RecordExtSSADetector::pkt_table::update_entry(uint16_t len, dir_t dir, time
    int8_t idx = get_idx_from_len(len);
    if (dir == 1) {
       table_[idx].ts_dir1 = ts;
-   } else  {
+   } else {
       table_[idx].ts_dir2 = ts;
    }
 }
@@ -281,18 +269,21 @@ bool RecordExtSSADetector::pkt_table::time_in_window(const timeval& ts_now, cons
    long diff_micro_secs = ts_now.tv_usec - ts_old.tv_usec;
 
    diff_micro_secs += diff_secs * 1000000;
-   if (diff_micro_secs > MAX_TIME_WINDOW) { 
+   if (diff_micro_secs > MAX_TIME_WINDOW) {
       return false;
    }
    return true;
 }
 
-bool RecordExtSSADetector::pkt_table::entry_is_present(int8_t idx, dir_t dir, const timeval& ts_to_compare)
+bool RecordExtSSADetector::pkt_table::entry_is_present(
+    int8_t idx,
+    dir_t dir,
+    const timeval& ts_to_compare)
 {
    timeval& ts = table_[idx].get_time(dir);
    if (time_in_window(ts_to_compare, ts)) {
       return true;
-   } 
+   }
    return false;
 }
 
@@ -301,5 +292,4 @@ int8_t RecordExtSSADetector::pkt_table::get_idx_from_len(uint16_t len)
    return std::max(int(len) - MIN_PKT_SIZE, 0);
 }
 
-}
-
+} // namespace ipxp