10137 Commits (7384744c3e52977b8db8a451df7f15a06cb8a2b8)

 

All Branches   

Search

Author	SHA1	Message	Date
Eric Leblond	aa989a7445	af-packet: some conditional fields	5 years ago
Eric Leblond	e3dccb2400	doc: update bypass stats doc	5 years ago
Eric Leblond	abbb066a96	bypass: bytes and pkts counters for local bypass	5 years ago
Eric Leblond	9206b30fe1	af-packet: better accounting and error handling ... This patch improves the bypass error handling add adds more counters to the interface so it is possible to get a view on success and failure of insertion in the eBPF maps via the `iface-bypassed-stat` command.	5 years ago
Eric Leblond	aeb2bd3aa1	util-ebpf: optimization on flow storage queries	5 years ago
Eric Leblond	288f335aa5	util-ebpf: simplify free function ... First key can't be null.	5 years ago
Eric Leblond	f4abe2f9c0	util-ebpf: set livedev in flow ... This will fix the accounting for pinned maps as the livedev field of Flow is used to do the accounting of bypass flows.	5 years ago
Eric Leblond	98e7d9d1c0	util-device: introduce bypassed stats sub function	5 years ago
Eric Leblond	f29a4b8bee	flow-manager: move bypass timeout to a inline func	5 years ago
Eric Leblond	89e8cb50ed	util-ebpf: case is not possible so remove warning	5 years ago
Eric Leblond	8c97998cb9	bypass: implement iface-bypassed-stat for callback	5 years ago
Eric Leblond	51ab06256a	bypass: account callback method in stats	5 years ago
Eric Leblond	f78e5ba1e1	bypass: restore interface counter	5 years ago
Eric Leblond	d119845d98	bypass: compress flow keys structure	5 years ago
Eric Leblond	69d2c8eb75	ebpf: get rid of hash in map value	5 years ago
Eric Leblond	b07bda7a7b	bypass: new callback stragegy ... This patch introduces and uses a new bypass strategy based on a callback. EBPF bypass implementation is updated to use this new strategy. Once the flow manager detect that a flow should be timeouted, it asks the capture method if it has seen packets in the interval. If it is the case the lastts of the flow is updated and the timeout is postponed.	5 years ago
Eric Leblond	fcae1c18de	af-packet: improve error handling for some hw ... Some cards seems to return EAGAIN when there is no more place in the hash table.	5 years ago
Eric Leblond	0bfbb4a889	bypass: fix accounting ... The flow bypass stats is computed at every pass so the accounting needs to be done at each pass. This patch fixes the accounting in the flow_bypassed counters.	5 years ago
Eric Leblond	44566e5a24	ebpf: only display that file is loaded if we do it	5 years ago
Eric Leblond	5e62ae6d28	af-packet: avoid error flooding when bypass fails	5 years ago
Eric Leblond	af6daceeda	util-ebpf: more useful error message ... At the time of the writing, libbpf output useful error message on strdout only and errno is not really interesting. So let's tell user to look at stdout.	5 years ago
Eric Leblond	833d9ef7e1	ebpf: don't use nexthdr to build hash ... As pointed by Victor Julien, it is not a good idea to use the nexthdr value, as init key for the hash as it could contain some other headers and can be changed for a session.	5 years ago
Eric Leblond	0f64c25b73	util-ebpf: improve code readability ... As pointed by Victor Julien, the pkts_cnt usage was quite confusing so functions are now returning a bool.	5 years ago
Eric Leblond	a8f35cc30e	util-ebpf: discard flow if no Flow storage	5 years ago
Eric Leblond	dbf3606169	doc: document flow event_type	5 years ago
Eric Leblond	efb648aa24	util-ebpf: fix ebpf bypass ... Fix endian order in eBPF bypass. It has to be updated after the bypassed flows handling change.	5 years ago
Eric Leblond	f8aa9ee986	bypass: fix wait time at exit ... The loop on bypassed flow maps can take a few seconds on heavily loaded system causing Suricata to not honor a stop before a few seconds. This patch adds the code needed to detect the need to exit from the check loop.	5 years ago
Eric Leblond	a277f2eb0c	af-packet: fix use after free on config ... ASAN did find that afp config was used after free. This was in fact done in the Flow bypass manager hence this patch.	5 years ago
Eric Leblond	fc2f2fa7d3	bypass: allow bypass for packet without flow ... For capture method that have their own flow structure (not maintained by Suricata), it can make sense to bypass a packet even if there is no Flow in Suricata. For AF_PACKET it does not make sense as the eBPF map entry will be destroyed as soon as it will be checked by the flow bypass manager. Thus we shortcut the bypass function if ever no Flow is attached to the packet. This path also removes reference to Flow in the bypass functions for AF_PACKET. It was not necessary and we possibly could benefit of it if ever we change the bypass algorithm.	5 years ago
Eric Leblond	285768c59e	ebpf: fix bypass filter vlan	5 years ago
Eric Leblond	8a11581ac8	doc: update ebpf doc following bypass_filter change	5 years ago
Eric Leblond	853d832de7	ebpf: complete vlan support for ebpf bypass filter	5 years ago
Eric Leblond	253c011c70	doc: update for latest xdp_filter.c change	5 years ago
Eric Leblond	6ab1cbcb8e	bypass: use flow storage for bypass counter ... There is a synchronization issue occuring when a flow is added to the eBPF bypass maps. The flow can have packets in the ring buffer that have already passed the eBPF stage. By consequences, they are not accounted in the eBPF counter but are accounted by Suricata flow engine. This was causing counters to be completely wrong. This code fixes the issue by avoiding the counter change in invalid case. To avoid adding 4 64bits integers to the Flow structure for the bypass accounting, we use instead a FlowStorage. This limits the memory usage to the size of a pointer.	5 years ago
Eric Leblond	640bc937b4	ebpf: add vlan tracking option to xdp_filter ... If vlan is not use for tracking in Suricata this result in vlan not being used in the flow key in Suricata and we need to adjust that in the XDP filter to avoid any problem.	5 years ago
Eric Leblond	34b8583f35	ebpf: tls encrypted bypass in xdp_filter ... Tests have shown that when we bypass encrypted traffic a non neglicteable amount of encrypted packets of the session are already in the capture ring buffer. Result is that Suricata is doing unnecessary work on these packets. These packets can be identified via the first bytes of their payloads so we can bypass them directly in the XDP code. This is done here for application data packets on port 443 and for TLS 1.2.	5 years ago
Eric Leblond	d2d3a5a92a	ebpf: fix UDP bypass in xdp_filter	5 years ago
Eric Leblond	98b68e87eb	ebpf: fix typo in xdp_filter.c comment	5 years ago
Eric Leblond	4e6add7faa	bypass: generalize iface bypass stats ... Introduce functions in util-device.c to be able to manage the flow bypassed count stats.	5 years ago
Eric Leblond	7e8f4b70f0	ebpf: add comment for some define in XDP filter	5 years ago
Eric Leblond	455d78728e	ebpf: remove useless var in xdp_filter	5 years ago
Eric Leblond	258e90be76	util-ebpf: change flow accounting logic ... Update the flow counters during the life of a bypassed flow instead of just accounting at the end of it.	5 years ago
Eric Leblond	3026e9a80d	util-ebpf: better error handling	5 years ago
Eric Leblond	2ffd3ad2b7	util-ebpf: better error handling of map unlink	5 years ago
Eric Leblond	b952b32a26	util-ebpf: rename field 'unlink' to avoid confusion	5 years ago
Eric Leblond	edf2db4e30	af-packet: improve warning message	5 years ago
Eric Leblond	567b5ee1bc	af-packet: rename option 'no-percpu-hash'	5 years ago
Eric Leblond	0f6b1297a9	af-packet: warn when XDP is not supported	5 years ago
Eric Leblond	b1c9b39435	af-packet: remove question from code	5 years ago
Eric Leblond	1992093c88	flow-bypass: rename variables	5 years ago