Commit Graph

5918 Commits (cd9cc2559e33590033debdc09b45c83f433052ce)
 

Author SHA1 Message Date
Victor Julien 9bbef55c4d Fix harmless typo in IPOnlyCIDRItemNew's SCReturnPtr use 10 years ago
Victor Julien b293a4b7d0 counters: remove unused description 10 years ago
Victor Julien 711cd7b59b counters: merge counters from threads for output
Merge counters so the table contains combined values from counters
from each thread.

Use global counter id's, track them in a hash.

Rename SCPCAElem members

Fix and improve average counters
10 years ago
Victor Julien 7da657dc3d counters: remove unused public API calls and make them private 10 years ago
Victor Julien ac6e24c06a counters: make SCPerfSetupPrivate a function 10 years ago
Victor Julien 66635f0741 counters: minor cleanups 10 years ago
Victor Julien 74ab84c194 counters: introduce SCPerfSetupPrivate for thread setup 10 years ago
Victor Julien 799640f906 counters: make threadvars::perf_private_ctx static
Update SCPerfGetAllCountersArray and add a UT workaround.
10 years ago
Victor Julien 55cfab89e4 counters: SCPerfGetLocalCounterValue cleanup
Return u64, update arguments.
10 years ago
Victor Julien b34c6dc93a counters: remove references to SCPerfCounterAddDouble
They were all in comments anyway.
10 years ago
Victor Julien e9b067c1eb counters: make increment call take threadvars
This hides the implementation from the caller.
10 years ago
Victor Julien 9a8bff7d96 counters: threadvars s/sc_perf_pca/perf_private_ctx/g 10 years ago
Victor Julien 50bb995458 counters: rename threadvars public counters 10 years ago
Victor Julien 6ffbc3a362 counters: s/SCPerfContext/SCPerfPublicContext/g 10 years ago
Victor Julien 0a5ae1b403 counters: s/SCPerfCounterArray/SCPerfPrivateContext/g
Goal is to make it's purpose clear.
10 years ago
Victor Julien 9f584483be counters: minor cleanups 10 years ago
Eric Leblond 0e955ccf3a suri-graphite: add ouput to file option
The --ooutput option allows to write the stats to a file given as
argument the format used is JSON for easy parsing.
10 years ago
Eric Leblond a54cef31ea suri-graphite: add daemonization capability
You can now use -d or --daemon to daemonize the process.
10 years ago
Eric Leblond e2c557cfdb suri-graphite: fix port option
If port is specified on command line we need to convert it as an
integer before using it as argument to connect.
10 years ago
Victor Julien 1e8142c699 logfile: rename ALERT_ types to LOGFILE_TYPE_ 10 years ago
Eric Leblond 4c6a7bea30 output-json: suppress global variable
It uses the new type field in the LogFileCtx instead.

This fixes the problem of not being able to use two eve-json
instance with different logging methods.
10 years ago
Eric Leblond 636e3d93c0 log file: add type flag
It will be used to store if the file is syslog or a real file.
10 years ago
Eric Leblond 7d73db9b80 suricata.yaml: fix the name of EVE module
It is netflow and not newflow.
10 years ago
Eric Leblond 39d667ff56 output-json: fix type of data parameter
The cast of data to AlertJsonThread was not correct as the real
type of the void pointer is a OutputJsonCtx. This was working by
luck because they both have a file_ctx as first element.
10 years ago
Alexander Gozman f11e237d77 Feature #1440: support wildcards in rule filenames 10 years ago
David Cannings 4f8f53d080 Fix rcode parsing, as noticed by Coverity.
Without support for OPT RR from RFC6891 (Extension mechanisms for DNS)
values of RCODE above 15 are not possible.  Remove dead code which will
never match.
10 years ago
Jason Ish 9fdae82815 conf - process includes even if not at root node. 10 years ago
Jason Ish 56f6e37304 radix-tree - prevent out of bounds array access
An IPv6 entry specified before an IPv4 entry on the host-os-policy
table can cause the stream byte array to be access one byte after
the end of the allocated memory at util-radix-tree.c:578.
10 years ago
Jason Ish 3e5b8f48b1 Bug 1281 - Add tests for rule content of lengths > 255. 10 years ago
Jason Ish e2b04635a7 Bug 1281 - Accept rule content with lengths greater than 255. 10 years ago
Victor Julien 0e22e95e47 alert-json: fix stream logging for IPS mode
Switch direction in IPS mode.
10 years ago
Victor Julien 5037ea93f3 threads: add untimed control cond call
The control conditions so far could only do timed waits, not normal
waits.
10 years ago
Victor Julien c7bc9ae6a8 detect: minor cleanups 10 years ago
Victor Julien bc2b53f10b parsing: s/strtok/strtok_r/g
Remove all strtok uses and replace them by strtok_r.

Do the same for Windows builds. Cygwin builds fine with strtok_r.

Add strtok to banned function list.
10 years ago
Victor Julien fb479902e4 threading: explain purpose of threadvars mucond 10 years ago
Victor Julien 478719ee9d flow: don't hold tv_root_lock longer than needed
Don't hold it longer than needed in shutting down.
10 years ago
Victor Julien c96805e839 threading: remove unused cmd thread create func 10 years ago
Victor Julien df5e9d44ca unix-manager: convert to thread module
Sync command thread for unix manager with other managers and make
it a full thread module.
10 years ago
Victor Julien cc01b5f6b6 reference/classification: call global init for unittests 10 years ago
Victor Julien 34f2ff067b reference: update pcre globals use
Don't update globals each time we parse, but instead do it once at
startup.
10 years ago
Victor Julien 46d401e3bb classification: update pcre globals use
Don't update globals each time we parse, but instead do it once at
startup.
10 years ago
Victor Julien b2da57c827 reference: remove global 10 years ago
Victor Julien 393689ce44 classification: remove global from parsing
Parsing code used a 'fd' global. Remove this.
10 years ago
Victor Julien 9764a35604 stream: fix --disable-detection reassembly issue
Due to an error at initialization, the stream engine would not disable
'raw' reassembly automatically when --disable-detection was used.

This lead to segments not getting cleared from the segment lists.
10 years ago
Victor Julien c1558f5ac4 stream: remove FLOW_NO_APPLAYER_INSPECTION flag
Instead, intruduce StreamTcpDisableAppLayer to disable app layer
tracking and reassembly. StreamTcpAppLayerIsDisabled can be used
to check it.

Replace all uses of FlowSetSessionNoApplayerInspectionFlag and
the FLOW_NO_APPLAYER_INSPECTION.
10 years ago
Victor Julien b6798495c5 stream: remove FLOW_NO_APPLAYER_INSPECTION use from tests 10 years ago
Victor Julien b2e1854e2a stream: improve 'no app layer' handling
When the session/flow was flagged as 'no applayer inspect', which
could happen as a result various reasons, packets would still be
considered by the app layer reassembly.

When ACK'd, they would be removed again. Depending also on the raw
reassembly.

In very long sessions however, this meganism could fail leading to
virtually endlessly growing segment lists.

This patch makes sure that segments that come in on a 'no app layer'
session are tagged properly or even not added at all.

Use a new ssn flag instead of flow flag for no app tracking.
10 years ago
Victor Julien 22a810813c app-layer: add DisableAppLayer
Move various app layer related flag setting calls into a utility
function "DisableAppLayer"
10 years ago
Victor Julien f536099a67 app-layer: de_state optimization
Add API to bypass expensive TX list walks. This API call is optional.

Implement it for HTTP and DNS.
10 years ago
Victor Julien 5f0678120d detect-state: update test to check state storing 10 years ago