6023 Commits (3054af7900788324d37fed9ee496ba1e15db2558)

 

All Branches   

Search

Author	SHA1	Message	Date
Eric Leblond	3054af7900	af-packet: don't activate rollover by default ... Rollover option is causing issue with TCP streaming code because packets from the same flow to be treated out of order. As long as the situation is not fixed in the streaming engine, it is a bad idea to enable it by default.	10 years ago
Victor Julien	6b2fb3fd5d	Fix minor format string issues	10 years ago
Victor Julien	ba81c4d290	autotools: cleanup ... Remove most of the CFLAGS updates from configure. Flags are now (mostly) set in AM_CLFLAGS. Update all -DBLAH additions to CFLAGS to use AC_DEFINE([BLAH], ...) Improve Lua vs LuaJIT checking. Improve the configure output a bit. Lots of smaller cleanups.	10 years ago
Antti Tönkyrä	63a47967d7	source-pfring: don't set cluster mode when using ZC and VLAN tracking is disabled	10 years ago
gureedo	c31660e5fd	netmap: enable zero-copy mode only when copy-mode is specified. ... Perform zero-copy checks only when copy-mode is specified.	10 years ago
gureedo	a7a902a071	netmap: extended comments for options in configuration file. ... Added extended description of the use of OS endpoint with copy mode.	10 years ago
Victor Julien	cbf46c44ec	transaction inspection: fix limit enforcement ... Make sure we're never wrapping around the size value.	10 years ago
Antti Tönkyrä	834c36659e	Allow colon in SSH version, at least some trojaned PuTTY clients have version like Putty-Local: Timestamp HH:MM:SS	10 years ago
Victor Julien	1235c578b2	xff: support ports and more ipv6 notations ... It's not uncommon to see an header like: X-Forwarded-For: 1.2.3.4:56789 This patch recognizes this case and ignores the port. It also supports this for IPv6 if the address has the following notation: X-Forwarded-For: [12::34]:1234 This patch also adds unittests.	10 years ago
Victor Julien	979bd35277	detect loader: move to own file	10 years ago
Victor Julien	cfeaf42cab	detect-loaders: configurable amount of loaders	10 years ago
Victor Julien	f871c0e1b8	debug: packet pool init/destroy validation ... Validate packet pool handling: - pools are initialized before use - pools are not used after destroy - pools are not double initialized/destroyed	10 years ago
Victor Julien	e44fd97d72	unittests: use a global packetpool	10 years ago
Victor Julien	99c0a7ad72	multi-detect: improve memory handling of setup code	10 years ago
Victor Julien	b7b27684c2	multi-detect: detect loader for unix socket ... Move the tenant load and reload commands to be executed by the detect loader thread(s). Limitation: no yaml parsing in parallel. The Conf API is currently not thread safe, so don't load the tenant config (yaml) in parallel.	10 years ago
Victor Julien	eb09118d64	detect: create loader threads ... To speed up startup with many tenants, tenant loading will be parallelized. As no tempary threads should be used for these memory allocation heavy tasks, this patch adds new type of 'command' thread that can be used to load and reload tenants. This patch hardcodes the number of loaders to 4. Future work will make it dynamic. The loader thread essentially sleeps constantly. When a tasks is sent to it, it will wake up and execute it.	10 years ago
Victor Julien	82aa419431	multi-detect: set tenant id on pseudo packets ... Store the tenant id in the flow and use the stored id when setting up pesudo packets. For tunnel and defrag packets, get tenant from parent. This will only pass tenant_id's set at capture time. For defrag packets, the tenant selector based on vlan id will still work as the vlan id(s) are stored in the defrag tracker before being passed on.	10 years ago
Victor Julien	e19c41a807	multi-detect: hash lookup for tenants ... Use hash for storing and looking up det_ctxs.	10 years ago
Victor Julien	722c56dbf3	detect: clean up thread free code ... Introduce DetectEngineThreadCtxFree that doesn't need a 'ThreadVars' pointer.	10 years ago
Victor Julien	4f77e8967b	multi-detect: make threshold prefix aware ... Make threshold loading prefix aware, so it can be part of tenant configuration. If the setting is missing from the tenant, the global setting is tried and if that too is missing, the global default is used. Note: currently per host thresholds are tracked globally and NOT per tenant.	10 years ago
Victor Julien	a6e3cec9e5	multi-detect: make reference prefix aware ... Make reference loading prefix aware, so it can be part of tenant configuration. If the setting is missing from the tenant, the global setting is tried and if that too is missing, the global default is used.	10 years ago
Victor Julien	5fff250749	multi-detect: make classification prefix aware ... Make classification loading prefix aware, so it can be part of tenant configuration. If the setting is missing from the tenant, the global setting is tried and if that too is missing, the global default is used.	10 years ago
Victor Julien	4d0975eeac	multi-detect: implement reload tenant in suricatasc	10 years ago
Victor Julien	d8181802d3	multi-detect: add reload-tenant command ... Allow for a tenant to be reloaded. The command is the same as the register-tenant command, so with a yaml and tenant-id as argument. However this replaces an existing tenant.	10 years ago
Victor Julien	8673801ea3	multi-detect: add tenant id to alert json output ... Add a integer field "tenant_id" to the JSON alert output.	10 years ago
Victor Julien	f4c9915066	multi-detect: store tenant id in packet ... Store tenant id in the packet so that the output API's can log it.	10 years ago
Victor Julien	642c267dc4	multi-detect: refuse to add duplicate tenant ... Generate error if tentant to be added is already loaded.	10 years ago
Victor Julien	4e0683c3f5	multi-detect: cleanup, reuse tenant loading code ... Reuse tenant loading from YAML code for Unix Socket.	10 years ago
Victor Julien	646eb4c2a8	multi-detect: load tenants from yaml file ... Load tenants and mappings from the suricata.yaml when available.	10 years ago
Victor Julien	a20e43f97c	suricatasc: add unregister-tenant-handler	10 years ago
Victor Julien	a21e88d955	suricatasc: add register-tenant-handler command ... Arguments: - tenant id (int) - name of handler (string) - traffic id related to handler (int, optional) Examples: - register-tenant-handler 1 vlan 1111 - register-tenant-handler 8 pcap	10 years ago
Victor Julien	216638c342	multi-detect: implement unregister-tenant-handler ... Remove a tenant handler from the list and apply it.	10 years ago
Victor Julien	93f856a1b3	detect: don't error out on no de_ctx ... This can happen on a multi-detect setup with no registered engines yet.	10 years ago
Victor Julien	b6f290fac7	multi-detect: set selector from yaml ... Yaml setting is: multi-detect.selector Implement 'vlan' and 'direct'.	10 years ago
Victor Julien	c72b7f83b8	multi-detect: error on start if no selector registered ... Force user to select the method at startup.	10 years ago
Victor Julien	1127ad66b4	multi-detect: register counters on 'master' det_ctx ... Otherwise counters are only registered after the stats api is already fixed.	10 years ago
Victor Julien	7c581c0ffc	multi-detect: allow start up with 0 tenants	10 years ago
Victor Julien	6d92e8d220	unix-socket: implement register-tenant-handler ... Register tenant handlers/selectors based on what the unix command "register-tenant-handler" tells. Check traffic id before adding it. No duplicated registrations for a traffic id are allowed.	10 years ago
Victor Julien	1893c5edb1	multi-detect: initial selectors for tenants ... The Detection Thread has the TenantGetId pointer which allows it to select a tenant id based on the packet.	10 years ago
Victor Julien	0ff6d3dcfd	detect: select detect engine at Detect entry ... Limited to Pcap only currently.	10 years ago
Victor Julien	bc7e9be5c6	unix-socket: allow tenant id with pcap-file ... Register the tenant id that the pcap-file optionally got.	10 years ago
Victor Julien	bea66156b9	pcap-file: set tenant-id if available ... Set the id to each packet's 'pcap_v' structure.	10 years ago
Victor Julien	127d8183d7	suricatasc: allow for tenant id in pcap-file ... Allow for an optional 'tenant id' argument to pcap-file. This will allow us to force the pcap to be inspected by this tenant. If ommited it's 0, which means it's disabled.	10 years ago
Victor Julien	98d265f40b	detect: use multi tenant thread init if MT enabled	10 years ago
Victor Julien	b653479815	detect: make multi tenancy a global switch ... At start up we will set this flag based on "multi-detect.enabled".	10 years ago
Victor Julien	3f12bdd4f8	tenants: apply added/removed tenant ... Apply to the engine.	10 years ago
Victor Julien	def2b58725	detect: initial MT lookup logic ... In the DetectEngineThreadCtx, store another DetectEngineThreadCtx per tenant. Currently it's just a simple array indexed by the tenant id.	10 years ago
Victor Julien	147a6d2bfd	multi-detect: (un)register-tenant unix socket commands ... Make available to live mode and unix socket mode. register-tenant: Loads a new YAML, does basic validation. Loads a new detection engine Loads rules Add new de_ctx to master store and stores tenant id in the de_ctx so we can look it up by tenant id later. unregister-tenant: Gets the de_ctx, moves it to the freelist Removes config Introduce DetectEngineGetByTenantId, which gets a reference to the detect engine by tenant id.	10 years ago
Victor Julien	3aa58f25ad	eve alert: fix stream payload printing	10 years ago
Victor Julien	2ef0ebb24b	detect: fix pass transaction handling ... If a flow was 'pass'd, it means that no packet of it will flow be handled by the detection engine. A side effect of this was that the per flow inspect_id would never be moved forward. This in turn lead to a situation where transactions wouldn't be freed. This patch addresses this case by incrementing the inspect_id anyway for the pass case.	10 years ago