8571 Commits (c5e2af05459e809deba76547110248af8b73ced8)

Author	SHA1	Message	Date
Eric Leblond	c5e2af0545	util-ebpf: fix error reported by coccinelle check ... Some allocation errors were not checked during init phase.	7 years ago
Eric Leblond	c1fd0da550	af-packet: add vlan_id in bypass key ... Bypassing on vlan was not supported due to the missing key.	7 years ago
Eric Leblond	651a27e4fb	ebpf: fix percpu hash handling ... An alignement issue was preventing the code to work properly. We introduce macros taken from Linux source code sample to get something that should work on the long term.	7 years ago
Eric Leblond	142c69e1ef	flow-bypass: increase bypass timeout ... This is needed as we did switch from counter maintained in kernel to internal polling so we need a bigger value.	7 years ago
Eric Leblond	b8e184ceb5	flow-bypass: fix timeout of maps bypassed flows ... The time is taken from the parameter and is checked against real flow entries so we need a standard time.	7 years ago
Eric Leblond	07d0bd3a0f	util-ebpf: fix IPv6 deletion loop	7 years ago
Eric Leblond	b481f290e2	af-packet: fix bypass for IPv6	7 years ago
Eric Leblond	3bd8ba5d00	util-ebpf: add message if key deletion fails	7 years ago
Eric Leblond	269f601f8a	util-ebpf: can't delete in place so update algo	7 years ago
Eric Leblond	5b056c15bf	af-packet: fix default in pinned maps name	7 years ago
Eric Leblond	eff56acca5	af-packet: be sure to nullify option if not set	7 years ago
Eric Leblond	36c6a62954	util-ebpf: simplify function declarations	7 years ago
Eric Leblond	69630d7a17	util-ebpf: micro optimization	7 years ago
Eric Leblond	d21c3a6555	util-ebpf: create flow from bypassed flows	7 years ago
Eric Leblond	04c65a309e	flow-hash: new function to get flow from flowkey	7 years ago
Eric Leblond	885fc992de	ebpf: make table iterator generic ... Also adds a basic skeleton for flow creation loop.	7 years ago
Eric Leblond	880c42f11c	af-packet: bypass with init function	7 years ago
Eric Leblond	522e98d830	util-ebpf: fix iteration in flow timeout ... We were not setting the key using the correct item in map. Result was deletion of wrong flow.	7 years ago
Eric Leblond	0c3e1e8579	af-packet: correctly set up hardware offload	7 years ago
Eric Leblond	bd28f77a1e	af-packet: fix loading of ebpf filter	7 years ago
Eric Leblond	6fdcb127e9	af-packet: fix the start when XDP is pinned	7 years ago
Eric Leblond	7e0ef4cec8	util-ebpf: change return of pinned maps loading ... The calling function needs to be able to see when this is a success and XDP do not need to be reloaded.	7 years ago
Eric Leblond	d950a9f272	util-ebpf: conditional flow table loading	7 years ago
Eric Leblond	d25e8dbfc7	af-packet: implement pinned-maps-name	7 years ago
Eric Leblond	36838017fe	af-packet: fix build when eBPF not built-in	7 years ago
Eric Leblond	b1769d5f8f	util-ebpf: implement pinned maps loading ... Load flow tables at start if asked to.	7 years ago
Eric Leblond	96f1454ebf	util-ebpf: only unlink pinned maps in eBPF filter	7 years ago
Eric Leblond	4cf531008e	af-packet: conditionaly remove XDP filter ... Only remove the XDP filter if we are in XDP mode and not using the pinned maps.	7 years ago
Eric Leblond	4f48c45727	util-ebpf: conditional pinning of maps ... Only pin maps if `pinned-maps` is set in the configuration. This ensure backward compatibility.	7 years ago
Eric Leblond	73a928fa0b	util-ebpf: fix loop on maps ... We were missing the last element of the map by working on previous key instead of current key.	7 years ago
Eric Leblond	3ce69c446b	util-ebpf: suppress spaces at end of line	7 years ago
Eric Leblond	954762a429	ebpf: add filter by maps on example filter	7 years ago
Eric Leblond	5d8ac36a49	util-ebpf: pin the maps ... By pinning the maps we are creating a file in /sys/fs/bpf that can be used by external program to access the map. This has multiple benefits such as handling list from an external program. The pinned maps could be persistent accross Suricata reload but this can be complicated in term of handling everything in the life of Suricata.	7 years ago
Eric Leblond	bf4381b17b	ebpf: document XDP iface redirect	7 years ago
Eric Leblond	a37a7c4a21	ebpf: reduce counter size to allow netronome offload	7 years ago
Eric Leblond	315c29a8e6	ebpf: change the logic to avoid ktime usage ... Kernel time is not available (and/or costly) on NIC such as Netronome so we update the logic to detect dead flows based on a lack of update of packets counters. This way, the XDP filter will be usable by network card. This patch also updates the ebpf code to support per CPU and regular mapping. Netronome is not supporting it and the structure is using atomic for counter so the cost of simultaneous update is really low. This patch also updates the xdp_filter to be able to select if the flow table is per CPU on shared. Second option will be used for hardward offload. To deactivate the per cpu hash, you need to set USE_PERCPU_HASH to 0. This patch also adds an new option to af-packet named no-percpu-hash If this option is set to yes then the Flow bypassed manager thread will use one CPU instead of the number of cores. By doing that we are able to handle the case where USE_PERCPU_HASH is unset (so hardware offload for Netronome). This patch also remove aligment indications in the eBPF filter. This was not really needed and it seems it is causing problem with some recent version of LLVM toolchain.	7 years ago
Eric Leblond	1745408c13	flow-manager: no force reassembly on bypassed flow ... When a bypassed flow is created we are forcing the reassembly so we don't need to do it again when it timeout.	7 years ago
Shivani Bhardwaj	7c7e04487f	detect/content: Message for escaping backslash ... So far, if the rule loaded had a backslash character ("\") in its content field, the rule will fail to load but without giving a descriptive error message. This patch tells the user to escape the troubling character. Before ``` 9409] 7/6/2019 -- 16:12:22 - (detect-engine-loader.c:184) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Backslash needs escaping msg"; flow:established,to_server; content:"MyBackslash\here"; sid:86; rev:1; )" from file /var/lib/suricata/rules/myrule.rules at line 1 ``` After ``` [9409] 7/6/2019 -- 16:12:22 - (detect-content.c:155) <Error> (DetectContentDataParse) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - '\' has to be escaped [9409] 7/6/2019 -- 16:12:22 - (detect-engine-loader.c:184) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Backslash needs escaping msg"; flow:established,to_server; content:"MyBackslash\here"; sid:86; rev:1; )" from file /var/lib/suricata/rules/myrule.rules at line 1 ``` Closes redmine ticket #2626	7 years ago
Victor Julien	7513f6cae2	threads: minor code cleanups	7 years ago
Victor Julien	92d38683ce	threads: improve flow timeout loop ... Improve thread safety and remove BUG_ON	7 years ago
Victor Julien	e6b633cf95	stats: walk tv_root under lock	7 years ago
Victor Julien	9474b84683	stats: more accurate time handling for wakeup thread	7 years ago
Victor Julien	ab1268cfea	stats: minor code cleanups	7 years ago
Philippe Antoine	b5f3e03209	New app layer event for invalid http request line ... Handles logs from libhtp even if case of error	7 years ago
Philippe Antoine	4a74e9edcc	signature: error for rules with illegal port ... Fixes #2080	7 years ago
Philippe Antoine	248f9c66cf	warnings: fixes integer sizes in format strings ... Fixes #3009	7 years ago
Philippe Antoine	a3e38861b9	http: adds unit tests for HTPParseContentRange	7 years ago
Philippe Antoine	90ab0b0ec2	http: fix overflow in HTPParseContentRange	7 years ago
Victor Julien	39cf5b0c8b	snmp: fix 'defined but not used' warning ... Remove HAVE_RUST guards as well.	7 years ago
Pierre Chifflier	8c61cfdca5	snmp.version: move unittests to tests/	7 years ago