7327 Commits (92b393ee9ad9b73d46d5d59e66ab6cc0371b8d02)

 

All Branches   

Search

Author	SHA1	Message	Date
Eric Leblond	c19cd12620	flow: bypass encrypted and after stream depth flow ... This patch activates bypass for encrypted flow and for flow that have reached stream depth on both side. For encrypted flow , suricata is stopping the inspection so we can just get it out via bypass. The same logic apply for flow that have reached the stream depth. For a basic test of feature, use the following ruleset: ``` table ip filter { chain output { type filter hook output priority 0; policy accept; ct mark 0x1 counter accept oif lo counter queue num 0 } chain connmark_save { type filter hook output priority 1; policy accept; mark 0x1 ct mark set mark counter ct mark 0x1 counter } } ``` And use bypass mark and mask of 1 in nfq configuration. Then you can test the system by scp big file to 127.0.0.1. You can also use iperf to measure the performance on localhost. It is recommended to lower the MTU to 1500 to get something more realistic by increasing the number of packets..	10 years ago
Giuseppe Longo	177df305d4	stream-tcp: enable bypass setting ... This permits to enable/disable in suricata.yaml and the bypass function will be called when stream.depth is reached.	10 years ago
Giuseppe Longo	97783f8142	nfq: introduce bypass function	10 years ago
Eric Leblond	285b4dd981	decode: implement bypass function ... Call the packet bypass callback if necessary and update the flow state. In case of failure we switch to local bypassed state and set capture bypassed state if the callback is successful.	10 years ago
Eric Leblond	68d9677eea	flow: force reassembly for bypassed flows ... As capture method like nfq will cut both side of the flow instantly we will not get the hack for most data which have been received. So it is better to force reassembly to be sure to get the timeout of the entry.	10 years ago
Eric Leblond	39c8786a8e	flow: get bypass info in get used flow function	10 years ago
Eric Leblond	07ef451c2b	flow: add pruned bypassed flow counter	10 years ago
Eric Leblond	745dad9809	flow: display info about bypass in log	10 years ago
Eric Leblond	e88555caf9	flow: add bypassed states ... This patch adds two new states to the flow: * local bypass: for suricata only bypass, packets belonging to a flow in this state will be discard fast * capture bypass: capture method is handling the bypass and suricata will discard packets that are currently queued A bypassed state to flow that will be set on flow when a bypass decision is taken. In the case of capture bypass this will allow to remove faster the flow entry from the flow table instead of waiting for the "established" timeout.	10 years ago
Giuseppe Longo	616782aa98	packet: add API for bypass	10 years ago
Victor Julien	7011d8f34c	doc: remove/cleanup 'guides'	10 years ago
Victor Julien	73b355e24a	doc: fix lua keyword name	10 years ago
Victor Julien	43c2db0a55	doc: update what is suricata section	10 years ago
Victor Julien	1f2f1d7063	doc: commandline improvements	10 years ago
Victor Julien	879ab41ade	doc: move drop privs into configuration	10 years ago
Jason Ish	7fa390de39	doc: bundle pre-built man page in distribution	10 years ago
Victor Julien	f511f86398	doc: rename to 'Suricata User Guide'	10 years ago
Victor Julien	7ad667f282	doc: move snort compat to rule chapter	10 years ago
Jason Ish	614e2f1d43	doc: make target for pdf, and suricata.1 shortcut	10 years ago
Jason Ish	6149b014ec	doc: shorten some paths to satisfy distcheck ... Long paths were being dropped from the source package.	10 years ago
Jason Ish	2e78bf0ba8	doc: list files/directories in EXTRA_DIST ... So files get included in the distribution and pass make distcheck.	10 years ago
Jason Ish	b1ced40ee4	doc: get Suricata version from autoconf vars	10 years ago
Jason Ish	ab93eb97b9	doc: use - instead of _ in filenames for consistency	10 years ago
Jason Ish	b8521a52f3	doc: link up hyperscan and packet capture	10 years ago
Jason Ish	b9a7335ec4	doc: expose variables for substition in docs	10 years ago
Jason Ish	15d2a7a49d	doc: minimal man page: suricata.1	10 years ago
Jason Ish	6eedd0068b	doc: hook sphinx into build	10 years ago
Jason Ish	5e76a54714	doc: packet capture: sync up with wiki	10 years ago
Jason Ish	7f5ffeebad	doc: dns: sync up with wiki	10 years ago
Jason Ish	ba4931ddb6	doc: flow:not_established not supported	10 years ago
Andreas Herz	7806ae8f57	docs: sync up to recent redmine	10 years ago
Jason Ish	0e63c9ca41	doc: add GPL and CC licenses	10 years ago
brandonlattin	7e3591e3ce	doc: performance: Replace 'medium' with 'custom' ... I assume the intent was to use the custom-values that are being defined.	10 years ago
Andi	8e655cf107	eve-json-format: add newest version from the wiki ... This was added by pevma in the wiki, so should go into the sphinx doc as well.	10 years ago
Jason Ish	a96225527a	doc: update url to modbus paper as advised by David Diallo.	10 years ago
Jason Ish	2751baae46	doc: rename from "sphinx" to "userguide"	10 years ago
Jason Ish	16f6fab502	doc: user .. option:: for command line option formatting	10 years ago
Jason Ish	8d47c13d2a	doc: new global threshold examples from Peter Manev.	10 years ago
Jason Ish	11eb8640dd	doc: acknowledge doc/wiki authors	10 years ago
Andreas Herz	c0aacec9b7	doc: reorder duplicates	10 years ago
Andreas Herz	347e3b4972	doc: fixed remaining FIXME	10 years ago
Andreas Herz	715485a42b	doc: finished remaining conversion for output	10 years ago
Andreas Herz	5a542a9934	doc: minor fixes in configuration causing errors/warnings	10 years ago
Andreas Herz	398151ac76	doc: added output section (some fixes still to do)	10 years ago
Jason Ish	2fa4547197	doc: reference fixups	10 years ago
Jason Ish	4b306fed14	doc: fixup references	10 years ago
Jason Ish	b252b0d84c	doc: add configuration	10 years ago
Andreas Herz	253886b99f	doc: added file-extraction	10 years ago
Andreas Herz	1089ec1cd8	doc: added capture hardware except for napatech with file	10 years ago
Andreas Herz	7f1e0d82fc	doc: added public data sets with file	10 years ago