aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
6,836 Commits
7 Branches
155 Tags
192 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'b5633b9bfd'
${ noResults }
Commit Graph

6836 Commits (b5633b9bfdd87413dc22bd6ff97c631e3d08b4d4)
 

Author SHA1 Message Date
Victor Julien a9cea53e62 yaml: move vars to the top 9 years ago
Victor Julien 093ecf4798 logging: clean up at shutdown 9 years ago
Victor Julien c1f679d3f3 flow worker: move UDP app-layer into main function 
This way it's more clean what happens and we can profile it.
 9 years ago
Victor Julien e09643c396 flow worker: profiling 
Previously the detect and stream code lived in their own thread
modules. This meant profiling showed their cost as part of the
thread module profiling logic. Now that only the flow worker is
a thread module this no longer works.

This patch introduces profiling for the 3 current flow worker
steps: flow, stream, detect.
 9 years ago
Victor Julien 48771c1acf debug: fix compiler warnings 9 years ago
Victor Julien 7dfdcdc770 thread modules: remove unused id's 9 years ago
Victor Julien a8f257e05f detect: no longer a thread module 
Like stream, detect is now invoked directly by the FlowWorker.
 9 years ago
Victor Julien 4a96820320 stream-tcp: more cleanups 9 years ago
Victor Julien 8b06badbcf stream-tcp: no longer register as a thread module 
Now that the FlowWorker handles the TCP Stream directly, having
the TCP engine as a thread module is no longer needed.

This patch removes the registration.
 9 years ago
Victor Julien 333f2cb310 drmemory: broader suppressions for hyperscan 9 years ago
Victor Julien eec66c7b4f smtp: improve thread data use 
The SMTP app layer used a thread local data structure for the mpm in
reply parsing, but it only used a pmq. The MpmThreadCtx was actually
global. Until now this wasn't really noticed because non of the mpm's
used the thread ctx.

Hyperscan does use it however.

This patch creates a new structure SMTPThreadCtx, which contains both
the pmq and the mpm thread ctx. It's passed directly to the reply
parsing function instead of storing a pointer to it in the SMTPState.

Additionally fix a small memory leak warning wrt the smtp global mpm
state.
 9 years ago
Justin Viiret 7a0dbc6f9f app-layer-smtp: free mpm contexts on shutdown 
Adds a cleanup function for the SMTP parser that destroys the MPM
context and MPM thread context it uses.

Also marks smtp_mpm_thread_ctx static.
 9 years ago
Justin Viiret d807bf4e8a detect-engine: log MPM/SPM matchers being used 9 years ago
Justin Viiret c9d0d6f698 mpm: add "auto" default for mpm-algo 
Setting mpm-algo to "auto" will use "hs" if Suricata was built against
Hyperscan, and "ac" otherwise (or "ac-tile" on Tilera platforms).
 9 years ago
Justin Viiret 8c6deecc55 app-layer-detect-proto: use mpm-algo 
Use the matcher configured by the user rather than hard-coding MPM_AC.
 9 years ago
Justin Viiret 88b50d2c34 app-layer-detect-proto: pass mpm_ctx to DestroyCtx 
The MPM DestroyCtx function accepts the MpmCtx, not the ctx pointer
inside it.
 9 years ago
Justin Viiret 31d8d4b0a1 detect-engine: adjust unit tests for hs mpm 
The Hyperscan MPM does match deduplication internally (using
HS_FLAG_SINGLEMATCH) and only returns the number of unique matches,
unlike AC.
 9 years ago
Justin Viiret 68ddcdccde app-layer-smtp: init mpm thread ctx after prepare 
This allows the Hyperscan MPM to correctly allocate scratch.
 9 years ago
Justin Viiret 24a1488591 mpm-hs: make errors from hs_scan() fatal 
Hyperscan will only return an error at scan time if the database or
scratch region are corrupted, which should provoke a fatal error.
 9 years ago
Justin Viiret a765cfde19 mpm-hs,spm-hs: don't call hs_scan() for zero bytes 9 years ago
Aleksey Katargin 2a5f487a16 netmap: close sw ring before hw rings 
Fix issue #1714
 9 years ago
Jason Ish b23d74ac88 tls-json-log: register module as tls-json-log, not dns-json-log 
Fixes issue:
https://redmine.openinfosecfoundation.org/issues/1792
where dns-json-log would not log any data.
 9 years ago
Eric Leblond bfa90a64d5 prscript: fix error handling 
Last result was used as global result.
 9 years ago
Victor Julien 5e7f617b7b isdataat: remove unused code 9 years ago
Arturo Borrero Gonzalez 221cb93024 src/: fix typo: receieved vs received 
Reported by Debian's lintian tool.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
 9 years ago
Victor Julien ea23b85776 flow worker: set up decoder thread vars 9 years ago
Victor Julien 6286e70555 ac: allow use of 31bits of pid space instead of 16 9 years ago
Victor Julien 1334859379 dns: add support for sshfp records 
Update parser to process the records.

Update json output to log it.
 9 years ago
Victor Julien 1df5acb001 coverity: CID 1362011: Control flow issues (DEADCODE) 9 years ago
Victor Julien 213f041c97 coverity: CID 1362012: Incorrect expression (EVALUATION_ORDER) 9 years ago
Victor Julien 3ffd19bdf5 coverity CID 1362013: Control flow issues (NESTING_INDENT_MISMATCH) 9 years ago
Victor Julien f947539d79 af-packet: CentOS6 build fixes 9 years ago
Eric Leblond 49612128f3 af-packet: use time() instead of GetTime() 
As we only use the second we don't need GetTime() which is slower
and get us milliseconds.
 9 years ago
Eric Leblond 88f5d7d166 af-packet: print errno on mmap error 9 years ago
Eric Leblond ff05fb760b af-packet: fix some typos in yaml 9 years ago
Eric Leblond a40f08a213 af-packet: ask for hardware timestamp 9 years ago
Eric Leblond 8035d83467 af-packet: make mmap options parsing conditional 
Only parse them if mmap is activated.
 9 years ago
Eric Leblond 7fea0ec6f9 af-packet: reset stats at start of capture 
We can loose packets during setup because we are reading nothing.
So it is logical to discard the counter at start of capture to
start from a clean state. This means we don't need to account the
drop at start. But the stats call that will reset the drop counts
will also return and reset the packets count. So we need to know
how many packets we really have. This is in fact the number of
packets coming from the stats call minus the number of discarded
packets and the drop count. All the other packets will have to be
read.
 9 years ago
Eric Leblond 876b356bbe af-packet: use mmap capture by default 
Update the code to use mmap capture by default even in unset in
configuration file. mmap capture is now be turned off by using
explicitely 'use-mmap: no' in configuration.
 9 years ago
Eric Leblond c2d0d93806 af-packet: detect availability of tpacket_v3 
If TPACKET_V3 is not defined then it is not available and we should
not build anything related to tpacket_v3. This will allow us to
activate it dy default and fallback to v2 if not available.
 9 years ago
Eric Leblond f5c2019167 af-packet: add option to use memory locked mmap 9 years ago
Eric Leblond 234aefdff9 af-packet: configurable tpacket_v3 block timeout 
Block timeout defines the maximum filling duration of a block.
 9 years ago
Eric Leblond fa902abedf af-packet: configurable tpacket_v3 block size 
It is used to set the block size in tpacket_v3. It will allow user
to tune the capture depending on his bandwidth.

Default block size value has been updated to a bigger value to
allow more efficient wlak on block.
 9 years ago
Eric Leblond c7bde9dff6 af-packet: put ring setup in a separate function 9 years ago
Eric Leblond 7fa963718f af-packet: pack AFPPeer structure 9 years ago
Eric Leblond 5f84b55d98 af-packet: AFPWalkBlock error handling 
Error handling was not done. The implementation is making the
choice to consider we must detroy the socket in case of parsing
error. The same was done for tpacket_v2.
 9 years ago
Eric Leblond b797fd926c af-packet: continuing cleaning and hole hunting 
Suppress useless fields in AFPThreadVars. This patch also get rid
of bytes counter as it was only used to display a message at exit.
Information on livedev and on packet counters are enough.
 9 years ago
Eric Leblond 9500d12c9f af-packet: cleaning and hole hunting 
Reorder fields in AFPThreadVars and suppress some that were not
used elsewhere than in the initialization.
 9 years ago
Eric Leblond bae1b03cf5 af-packet: tpacket_v3 implementation 
This patch adds a basic implementation of AF_PACKET tpacket v3. It
is basic in the way it is only working for 'workers' runnning mode.
If not in 'workers' mode there is a fallback to tpacket_v2. Feature
is activated via tpacket-v3 option in the af-packet section of
Suricata YAML.
 9 years ago
Eric Leblond d094039600 af-packet: remove useless code 
No need for cooked header in the case of mmap capture.
 9 years ago