100 Commits (f55c94cb5423cbbd21434085af02b30e6594f147)

Author	SHA1	Message	Date
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Jason Ish	fc2014ab40	Unregister for file rotation notification when a context is ... de-initialized. Required for unix-socket mode where contexts come and go.	12 years ago
Jason Ish	e1b97fed70	Add signal based file rotation for: ... - alert debug log - fast log - stats log - dns log - drop log - file log - http log - tls log - eve/json log	12 years ago
Victor Julien	a3b0577a1f	output: add TM_FLAG_LOGAPI_TM thread module flag ... The TM_FLAG_LOGAPI_TM flag indicates that a module is run by the log api, not by the 'regular' thread module call functions. Set flag in all all Log API users' registration code. Purpose of this flag is in profiling. In profiling output it will be used to list log api thread modules separately.	12 years ago
Victor Julien	15eb4b292d	TX logging API: convert HTTP log ... Convert the HTTP log to the new TX logging API.	12 years ago
Duarte Silva	aa6b5b406d	Fix the segmentation fault while logging the host on the custom HTTP logger. ... - Seems to be a regression introduced in the commit 796bfab231 (fix was already done in commit ee0b21652b) - Doesn't happen with htplib v0.5.6, but it does in the latest, v0.5.9	12 years ago
Victor Julien	8527b8e08e	App Layer: cleanup state func naming ... Rename functions related to AppLayerState to be more consistent.	12 years ago
Anoop Saldanha	429c6388f6	App layer API rewritten. The main files in question are: ... app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch]. Things addressed in this commit: - Brings out a proper separation between protocol detection phase and the parser phase. - The dns app layer now is registered such that we don't use "dnstcp" and "dnsudp" in the rules. A user who previously wrote a rule like this - "alert dnstcp....." or "alert dnsudp....." would now have to use, alert dns (ipproto:tcp;) or alert udp (app-layer-protocol:dns;) or alert ip (ipproto:udp; app-layer-protocol:dns;) The same rules extend to other another such protocol, dcerpc. - The app layer parser api now takes in the ipproto while registering callbacks. - The app inspection/detection engine also takes an ipproto. - All app layer parser functions now take direction as STREAM_TOSERVER or STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the functions. - FlowInitialize() and FlowRecycle() now resets proto to 0. This is needed by unittests, which would try to clean the flow, and that would call the api, AppLayerParserCleanupParserState(), which would try to clean the app state, but the app layer now needs an ipproto to figure out which api to internally call to clean the state, and if the ipproto is 0, it would return without trying to clean the state. - A lot of unittests are now updated where if they are using a flow and they need to use the app layer, we would set a flow ipproto. - The "app-layer" section in the yaml conf has also been updated as well.	12 years ago
Victor Julien	6709fdd8cf	log-http: fix compiler warning ... log-httplog.c:180: warning: 'cvalue' may be used uninitialized in \ this function	12 years ago
Victor Julien	afb48cfcb5	log-http: fix error check leading to null-deref on malloc failure during setup	12 years ago
Victor Julien	4165bf8951	log-http: enforce hostname print limit	12 years ago
Victor Julien	36bc8d5cd0	http & tls: fix transaction handling ... When http and/or tls logging is disabled, the app layer would still be flagged as logging. This caused transactions not to be freed until the end of the flow as the logged tx id would never increment. This fix postpones the setting of the app layer parser "logger" flag to the point where we know the logger is enabled.	12 years ago
Ignacio Sanchez	1b2f251866	Various custom http logging improvements ... Cookie is parsed now using uint8_t pointers (inliniac PR comments) Changed buffer size to a power of 2 (8192) and cookie value extraction function to static (inliniac PR comments) Added %b for request size (vinfang patch) Writing "-" if an unknown % directive is used (vinfang patch) Fixed bug in cookie parser Fixed format string issue logging literal values Improve error handling (Victor Julien comments) (patchset rebased and reworded by Victor Julien)	12 years ago
Ignacio Sanchez	8051dc8a6a	Added modifications suggested by Charles Smutz (https://redmine.openinfosecfoundation.org/issues/602)	12 years ago
Ignacio Sanchez	796bfab231	Added support for %{cookiename}C ... Added support for the definition of maximun length. ie: %[50]{user-agent}i Some small bugfixes	12 years ago
Ken Steele	d4dd18eb85	Clean up SCLocalTime() usage ... Remove cast of return type from SCLocalTime() as it is not needed. Replace last use of localtime_r() with SCLocalTime().	12 years ago
Ken Steele	68d26dcec7	Merge multiple copies of CreateTimeString() to one copy. ... There were 8 identical copies of CreateTimeString() in 8 files. Most used SCLocalTime, to replace localtime_r(), but some did not. Created one copy in util-time.c.	12 years ago
Anoop Saldanha	ee0b21652b	fix bug where we were not printing http hostname(printing <unknown> ... previously) in httplog, filestore meta and file log.	12 years ago
Anoop Saldanha	48cf0585fb	Suricata upgrade to libhtp 0.5.x. ... Remove the support for now unsupported personalities from libhtp - TOMCAT_6_0, APACHE and APACHE_2_2. We instead use the APACHE_2 personality.	12 years ago
Anoop Saldanha	d4d18e3136	Transaction engine redesigned. ... Improved accuracy, improved performance. Performance improvement noticeable with http heavy traffic and ruleset. A lot of other cosmetic changes carried out as well. Wrappers introduced for a lot of app layer functions. Failing dce unittests disabled. Will be reintroduced in the updated dce engine. Cross transaction matching taken care of. FPs emanating from these matches have now disappeared. Double inspection of transactions taken care of as well.	13 years ago
Victor Julien	472e061c6d	build: more checking for includes	13 years ago
Victor Julien	d68fd54a76	Fix/suppress a couple of harmless compiler warnings.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	355e981775	Fix 'no effect' check in timestamp print logic. Coverity 717437.	13 years ago
Victor Julien	886a4f2850	Check response headers in custom http logging before using them. Coverity 717436.	13 years ago
Ignacio Sanchez	b057a20f10	Custom logging feature for log-httplog	13 years ago
Eric Leblond	a0e57f58e5	OpenBSD: introduce SCLocalTime function. ... This function is a wrapper to localtime_r. It is needed to avoid a compilation warning on OpenBSD. I'm forced to type the function to a non pointer first parameter. If not we will have to use two differents functions in OpenBSD where tv->tv_sec is a long (different from time_t).	14 years ago
Anoop Saldanha	61d5fe33c9	Free membuffer before clearing enclosing parent instance	14 years ago
Victor Julien	1d59324a68	Add missing space to http.log.	14 years ago
Victor Julien	b5a3995904	Fix minor memleak in an start up error condition.	14 years ago
Anoop Saldanha	69ed12fd28	Introduce new buffer API that lets you create and manage a buffer. Update http log to use this as well	14 years ago
Victor Julien	4df25ef499	Apply http.log formatting fix by Chris Wakelin.	14 years ago
Anoop Saldanha	090d098114	provide generic macro to buffer data using snprintf	14 years ago
Anoop Saldanha	23b64c5c08	restructure http logging to use fine grained locking	14 years ago
Victor Julien	19a7e7f395	flow: create a flow lock macro API, implement it for mutex and rwlocks. Mutex remains the default.	14 years ago
Victor Julien	9696902b68	Small http.log improvement: bail out early if there is nothing to log. Make output locking more fine grained.	14 years ago
Victor Julien	11bdf4838f	Various improvements to error handling found by Coverity.	14 years ago
Victor Julien	7066a79c10	Register HTTP logger at registration, not thread init.	14 years ago
Victor Julien	28e15be526	Clean up default output. Use simpler output format for releases.	14 years ago
Mike Pomraning	dfec9c0f6a	Switch 'fast', 'http-log', 'drop' and 'alert-debug' to SCConfLogOpenGeneric.	14 years ago
Victor Julien	5395071c11	Make http logging code more robust against cases where the htp state is incomplete (out of memory conditions).	14 years ago
Victor Julien	7eb83314b4	Fix compiler warning and fix using GET_IPV4_DST_ADDR_PTR macro to access IPv6 header.	14 years ago
Eric Leblond	1df183ac38	http log: factorize logging function. ... With the introduction of the PrintInet function there was almost no difference between IPv4 and IPv6 HTTP logging functions. This patch adds a wrapper that factorizes the code.	14 years ago
Eric Leblond	2a8ffe07ea	http log: factorize extended logging ... Extended logging is not dependant on IP protocol version.	14 years ago
Eric Leblond	a5b1de4f0d	http log: Add extended option ... This patch adds a extended option to log extended HTTP information when activated.	14 years ago
Chris Wakelin	8b81063fc2	http log: Add extended information	14 years ago
Anoop Saldanha	4e44073c79	http logging module should log all txs in the list and not just the last complete tx available on EOF	14 years ago
Anoop Saldanha	4307ea2348	Replace all frees with SCFrees	14 years ago
Eileen Donlon	89599d3b9b	fixed bug 288; corrected config boolean parsing problems	14 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	14 years ago