71 Commits (0bb07b550c1f00a95e6803aba7cdeb22d637fbc2)

Author	SHA1	Message	Date
Maurizio Abba	55b14f3721	decode: set pktlen of decode handler to uint32 ... Change the decode handler signature to increase the size of its decode handler, from uint16 to uint32. This is necessary to let suricata use interfaces with mtu > 65535 (ex: lo interface has default size 65536). It's necessary to change several primitive for Packet manipulation, to unify the parameter "packet length" whenever we are before IP decoding. Add tests before calling DecodeIPVX function to avoid a possible integer overflow over the len parameter.	8 years ago
Eric Leblond	4474889667	util-device: change logic of registration ... Device storage requires the devices to be created after storage is finalized so we need to first get the list of devices then create them when the storage is finalized. This patch introduces the LiveDeviceName structure that is a list of device name used during registration. Code uses LiveRegisterDeviceName for pre registration and keep using the LiveRegisterDevice function for part of the code that create the interface during the runmode creation.	8 years ago
Victor Julien	d61fa0c43c	tunnel: refactor tunnel verdict handling ... Observed: STARTTLS creates 2 pseudo packets which are tied to a real packet. TPR (tunnel packet ref) counter increased to 2. Pseudo 1: goes through 'verdict', increments 'ready to verdict' to 1. Packet pool return code frees this packet and decrements TPR in root to 1. RTV counter not changed. So both are now 1. Pseudo 2: verdict code sees RTV == TPR, so verdict is set based on pseudo packet. This is too soon. Packet pool return code frees this packet and decrements TPR in root to 0. Real packet: TRP is 0 so set verdict on this packet. As verdict was already set, NFQ reports an issue. The decrementing of TPR doesn't seem to make sense as RTV is not updated. Solution: This patch refactors the ref count and verdict count logic. The beef is now handled in the generic function TmqhOutputPacketpool(). NFQ and IPFW call a utility function VerdictTunnelPacket to see if they need to verdict a packet. Remove some unused macro's for managing these counters.	9 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	9 years ago
Jason Ish	d5eca41a71	ipfw: disable more code to suppress compiler warnings ... Disabled code lead to unused variable warnings, so disable the variable code as well.	9 years ago
Jason Ish	2b874abada	compiler warnings: fix compiler warnings in format strings	9 years ago
cardigliano	57e0bd39e9	pkt acq: introduce break loop API ... This patch adds a new callback PktAcqBreakLoop() in TmModule to let packet acquisition modules define "break-loop" functions to terminate the capture loop. This is useful in case of blocking functions that need special actions to take place in order to stop the execution. Implement this for PF_RING	10 years ago
Victor Julien	14466a803d	decode: create util function for basic counter updates	11 years ago
Victor Julien	752f03e7a4	counters: remaining s/SCPerf/Stats/g	11 years ago
Victor Julien	30cce2bd29	counters: s/SCPerfCounterSetUI64/StatsSetUI64/g	11 years ago
Victor Julien	1c0b4ee0ae	counters: s/SCPerfCounterIncr/StatsIncr/g	11 years ago
Victor Julien	8992275b0c	counters: s/SCPerfCounterAddUI64/StatsAddUI64/g	11 years ago
Victor Julien	e9b067c1eb	counters: make increment call take threadvars ... This hides the implementation from the caller.	11 years ago
Victor Julien	9a8bff7d96	counters: threadvars s/sc_perf_pca/perf_private_ctx/g	11 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Victor Julien	98c88d5170	decode: pass ThreadVars to DecodeThreadVarsFree ... Flow output thread data deinit function which will be called from DecodeThreadVarsFree will need it.	12 years ago
Victor Julien	c4a8e2cd14	Remove unused variables	12 years ago
Ken Steele	28ccea51d3	Add error checking for pthread_setspecific() and pthread_key_create().	12 years ago
Ken Steele	3c6e01f653	Replace ringbuffer in Packet Pool with a stack for better cache locality ... Using a stack for free Packet storage causes recently freed Packets to be reused quickly, while there is more likelihood of the data still being in cache. The new structure has a per-thread private stack for allocating Packets which does not need any locking. Since Packets can be freed by any thread, there is a second stack (return stack) for freeing packets by other threads. The return stack is protected by a mutex. Packets are moved from the return stack to the private stack when the private stack is empty. Returning packets back to their "home" stack keeps the stacks from getting out of balance. The PacketPoolInit() function is now called by each thread that will be allocating packets. Each thread allocates max_pending_packets, which is a change from before, where that was the total number of packets across all threads.	12 years ago
Victor Julien	8c16fede08	ipfw: clean up decode thread local storage ... Clean up the thread local data the decode portion of ipfw uses. Bug #978	12 years ago
Eric Leblond	941cfe1641	ipfw: fix operator error in test ... Fix warning spotted by clang on FreeBSD: source-ipfw.c:241:49: warning: use of logical '||' with constant operand [-Wconstant-logical-operand] if (suricata_ctl_flags & (SURICATA_STOP || SURICATA_KILL)) { ^ ~~~~~~~~~~~~~ source-ipfw.c:241:49: note: use '|' for a bitwise operation if (suricata_ctl_flags & (SURICATA_STOP || SURICATA_KILL)) { ^~ | Use same logic as the one used in other capture mode.	12 years ago
Eric Leblond	9f6527dc16	ipfw: improve exit message ... This patch synchronizes the exit message with what is done in NFQ capture mode.	12 years ago
Victor Julien	f7b1aefaf4	Bug 1107: decoders: bail out on pseudo packets ... Flow-timeout code injects pseudo packets into the decoders, leading to various issues. For a full explanation, see: https://redmine.openinfosecfoundation.org/issues/1107 This patch works around the issues with a hack. It adds a check to each of the decoder entry points to bail out as soon as a pseudo packet from the flow timeout is encountered. Ticket #1107.	12 years ago
Victor Julien	5f307acace	Pass ThreadVars ptr to various thread init funcs ... To be able to register counters from AppLayerGetCtxThread, the ThreadVars pointer needs to be available in it and thus in it's callers: - AppLayerGetCtxThread - DecodeThreadVarsAlloc - StreamTcpReassembleInitThreadCtx	12 years ago
Eric Leblond	afbb2eb32b	capture: display exit stats at default verbosity ... This patch updates capture modes not using LiveDecice counters to display per-thread exit statistics with default verbosity.	12 years ago
Eric Leblond	3088b6ac34	Add invalid pkt counter. ... This patch adds and increments a invalid packet counter. It does this by introducing PacketDecodeFinalize function This function is incrementing the invalid counter and is also signalling the packet to CUDA.	12 years ago
Victor Julien	677cd03e52	Counters: more unused code removal	12 years ago
Victor Julien	3f8b9dde04	Dead code removal	12 years ago
Eric Leblond	3f107fa130	decode: Packet action start with PACKET ... Rename all Packet action macro to have them prefixed by PACKET.	13 years ago
Eric Leblond	a35c367942	action handling: use macro for test. ... Use test macro instead of direct access to action field. This patch has been obtained by using the following spatch file: @@ Packet *p; expression E; @@ - p->action & E + TEST_PACKET_ACTION(p, E)	13 years ago
Nikolay Denev	894ad21be5	setsockopt() failures are already fatal, ... so treat them as such and print error instead of warning.	13 years ago
Nikolay Denev	29b69fb026	set SO_BROADCAST on the divert socket so that broadcast ... packets can be reinjected.	13 years ago
Eric Leblond	4542cd0eec	ipfw: suppress non loop receive function	13 years ago
Anoop Saldanha	b33986c887	Add a packet src for every packet generated inside suricata.	14 years ago
Eric Leblond	6d55446655	ipfw: avoid critical error for broadcast ... In some setup, suricata may receive broadcast packets and the call to sendto may fail if the wrong interface is choosen by kernel. This patch change the error treatment to avoid to leave when this problem occurs.	14 years ago
Eric Leblond	41cb365a39	ipfw: add missing include	14 years ago
Eric Leblond	e168824d80	freebsd: fix function usage. ... The unlock function was not correctly used in error treatment.	14 years ago
Anoop Saldanha	34581ce902	rx TMs shouldn't return TM_ECODE_FAILED if engine is in shutdown mode + minor cleanup	14 years ago
Eric Leblond	a3465fb971	Rename 'worker' running mode to 'workers' ... This patch renamed the 'worker' running mode into 'workers'. Thus, there is only one name in Suricata for the same thing. Backward compatibility is ensured by replacing "worker" by "workers" when the old name is used. A warning is printed in the log when the old name is used.	14 years ago
Anoop Saldanha	bc6cf43840	#482 - use decode_flag for all decode TMs. Use the flag as a way to retrieve decode TMs from ThreadVars	14 years ago
Anoop Saldanha	cd4705e699	flag recieve acq tms that previously missed the receive_tm flag	14 years ago
Eric Leblond	9545a56426	ipfw: suppress poll before sendto ... Calling poll before using sendto seems a bit overkill.	14 years ago
Eric Leblond	6f1b40dd4b	ipfw: don't use socket lock in 'worker' mode ... This patch is the IPFW version of NFQ latest patch.	14 years ago
Eric Leblond	6e7a8f38bf	ipfw: Add support for autofp and worker runmode ... This patch convert ipfw code to the PcktAcqLoop API and rework the running mode to use the running mode wrapper already used by NFQ.	14 years ago
Eric Leblond	c1ad64b333	ips: update copyright date and author list.	14 years ago
Eric Leblond	d4cbc7c38c	ipfw: funnier to manage capability in running code.	14 years ago
Eric Leblond	f1cb4da442	ipfw: fix indentation of the file. ... I will have to work a lot on this one. It will be easier with a correct indentation.	14 years ago
Anoop Saldanha	3f1c4efceb	Add new flags var to tm module. TMs can now set flags to identify special properties. Also use these to identify receive TMs	15 years ago
Victor Julien	c590bba4a4	Undo tunnel reference counting using atomic operations. Revert to mutex based code.	15 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	15 years ago