9884 Commits (5d8ac36a49197bc071338bf4b5ca74f1f5590d9d)

 

All Branches   

Search

Author	SHA1	Message	Date
Eric Leblond	5d8ac36a49	util-ebpf: pin the maps ... By pinning the maps we are creating a file in /sys/fs/bpf that can be used by external program to access the map. This has multiple benefits such as handling list from an external program. The pinned maps could be persistent accross Suricata reload but this can be complicated in term of handling everything in the life of Suricata.	5 years ago
Eric Leblond	bf4381b17b	ebpf: document XDP iface redirect	5 years ago
Eric Leblond	a37a7c4a21	ebpf: reduce counter size to allow netronome offload	5 years ago
Eric Leblond	2f579e6a4c	ebpf: add VLAN support to loadbalancing ... This patchs adds VLAN support to eBPF load balancing by doing a parsing of VLAN headers.	5 years ago
Eric Leblond	315c29a8e6	ebpf: change the logic to avoid ktime usage ... Kernel time is not available (and/or costly) on NIC such as Netronome so we update the logic to detect dead flows based on a lack of update of packets counters. This way, the XDP filter will be usable by network card. This patch also updates the ebpf code to support per CPU and regular mapping. Netronome is not supporting it and the structure is using atomic for counter so the cost of simultaneous update is really low. This patch also updates the xdp_filter to be able to select if the flow table is per CPU on shared. Second option will be used for hardward offload. To deactivate the per cpu hash, you need to set USE_PERCPU_HASH to 0. This patch also adds an new option to af-packet named no-percpu-hash If this option is set to yes then the Flow bypassed manager thread will use one CPU instead of the number of cores. By doing that we are able to handle the case where USE_PERCPU_HASH is unset (so hardware offload for Netronome). This patch also remove aligment indications in the eBPF filter. This was not really needed and it seems it is causing problem with some recent version of LLVM toolchain.	5 years ago
Eric Leblond	1745408c13	flow-manager: no force reassembly on bypassed flow ... When a bypassed flow is created we are forcing the reassembly so we don't need to do it again when it timeout.	5 years ago
Eric Leblond	4e94c2b8c2	suricata.yaml: fix path to ebpf and xdp doc	5 years ago
Shivani Bhardwaj	7c7e04487f	detect/content: Message for escaping backslash ... So far, if the rule loaded had a backslash character ("\") in its content field, the rule will fail to load but without giving a descriptive error message. This patch tells the user to escape the troubling character. Before ``` 9409] 7/6/2019 -- 16:12:22 - (detect-engine-loader.c:184) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Backslash needs escaping msg"; flow:established,to_server; content:"MyBackslash\here"; sid:86; rev:1; )" from file /var/lib/suricata/rules/myrule.rules at line 1 ``` After ``` [9409] 7/6/2019 -- 16:12:22 - (detect-content.c:155) <Error> (DetectContentDataParse) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - '\' has to be escaped [9409] 7/6/2019 -- 16:12:22 - (detect-engine-loader.c:184) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Backslash needs escaping msg"; flow:established,to_server; content:"MyBackslash\here"; sid:86; rev:1; )" from file /var/lib/suricata/rules/myrule.rules at line 1 ``` Closes redmine ticket #2626	5 years ago
Andreas Herz	30fd80b0ef	doc: convert fancy quotes to straight quotes	5 years ago
Victor Julien	7513f6cae2	threads: minor code cleanups	5 years ago
Victor Julien	92d38683ce	threads: improve flow timeout loop ... Improve thread safety and remove BUG_ON	5 years ago
Victor Julien	e6b633cf95	stats: walk tv_root under lock	5 years ago
Victor Julien	9474b84683	stats: more accurate time handling for wakeup thread	5 years ago
Victor Julien	ab1268cfea	stats: minor code cleanups	5 years ago
Jeff Lucovsky	1a1d32c6b2	make: Remove rust generated headers during clean	5 years ago
Philippe Antoine	b5f3e03209	New app layer event for invalid http request line ... Handles logs from libhtp even if case of error	5 years ago
Philippe Antoine	4a74e9edcc	signature: error for rules with illegal port ... Fixes #2080	5 years ago
Philippe Antoine	248f9c66cf	warnings: fixes integer sizes in format strings ... Fixes #3009	5 years ago
Philippe Antoine	a3e38861b9	http: adds unit tests for HTPParseContentRange	5 years ago
Philippe Antoine	90ab0b0ec2	http: fix overflow in HTPParseContentRange	5 years ago
Pierre Chifflier	c1b30fe9fd	rust/snmp: fix libc deprecation warnings for int types	5 years ago
Pierre Chifflier	bc07656ce7	rust/snmp: use snake_case when logging PDU types	5 years ago
Victor Julien	39cf5b0c8b	snmp: fix 'defined but not used' warning ... Remove HAVE_RUST guards as well.	5 years ago
Pierre Chifflier	8c61cfdca5	snmp.version: move unittests to tests/	5 years ago
Pierre Chifflier	58d85b1460	snmp.pdu_type: move unittests to tests/	5 years ago
Pierre Chifflier	ff0ff6344f	snmp.community: move unittests to tests/	5 years ago
Pierre Chifflier	509a54281f	detect/snmp: convert snmp.community keyword to v2, and MPM	5 years ago
Pierre Chifflier	c60f2028e5	rust/snmp: fix missing IPPROTO_* declarations (use core)	5 years ago
Pierre Chifflier	c67a53773b	detect/snmp: rename keywords to snmp.<name>, and make rust mandatory	5 years ago
Pierre Chifflier	031cbbe868	rust/snmp: fix selection of v1/v2c parser	5 years ago
Pierre Chifflier	9dfec7e734	SNMP: add the "snmp.pdu_type" detection keyword	5 years ago
Pierre Chifflier	e1dd19a0eb	SNMP: add the "snmp.community" detection keyword	5 years ago
Pierre Chifflier	aa608e0ca2	SNMP: add the "snmp.version" detection keyword	5 years ago
Pierre Chifflier	ed4823bbe8	SNMP: add missing case for profiling enum	5 years ago
Pierre Chifflier	60324740e6	SNMP: use explicit references to support build with old rust compiler	5 years ago
Pierre Chifflier	57b233f462	SNMP: start looking for transactions from end of list	5 years ago
Pierre Chifflier	6fc7fc74cb	SNMP: add logger	5 years ago
Pierre Chifflier	2df840a8b8	Add SNMP (v1/v2c/v3) application layer	5 years ago
Pierre Chifflier	b65896c0de	Rust: expose function AppLayerParserRegisterGetTxIterator	5 years ago
Victor Julien	b1d4931842	rust: fix warnings about wrong type of comments ... "rustdoc does not generate documentation for macro expansions"	5 years ago
Victor Julien	bf1bd407dd	rust: fix libc deprecation warnings for int types	5 years ago
Victor Julien	cdd061ba37	ikev2: clean up c glue code	5 years ago
Victor Julien	3f36a6ce59	tftp: c glue code cleanup	5 years ago
Victor Julien	723f1586ca	ikev2: remove excess new lines	5 years ago
Victor Julien	adcbac1c77	tftp: properly implement tx handling	5 years ago
Victor Julien	ade2b1e6cf	output: get rid of BUG_ONs	5 years ago
Victor Julien	9ea6db3889	pool: don't call Cleanup after failed Init ... Stream reassembly memcap is regulated by the Init and Cleanup callbacks. If Init fails due to memcap reached, Cleanup had no way of knowing and it would decrease the memcap even if it hadn't been increased by Init. This could lead to too much memory use and memcap counter underflow. This patch fixes the issue by not calling Cleanup in this case. It's fair to see a failed Init the responsibility of Init.	5 years ago
Victor Julien	597ff3c8e3	pool/thread: clean up tests	5 years ago
Victor Julien	025cc64f55	pool/thread: remove old grow function	5 years ago
Victor Julien	67ba132c10	stream: simplify segment and ssn pool inits	5 years ago