|
|
|
|
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
|
|
|
|
*
|
|
|
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
|
|
|
* the GNU General Public License version 2 as published by the Free
|
|
|
|
|
* Software Foundation.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
|
|
|
* 02110-1301, USA.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \file
|
|
|
|
|
*
|
|
|
|
|
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
|
|
|
|
|
*
|
|
|
|
|
* Error utility functions
|
|
|
|
|
*
|
|
|
|
|
* \todo Needs refining of the error codes. Renaming with a prefix of SC_ERR,
|
|
|
|
|
* removal of duplicates and entries have to be made in util-error.c
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include "util-error.h"
|
|
|
|
|
|
|
|
|
|
#define CASE_CODE(E) case E: return #E
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \brief Maps the error code, to its string equivalent
|
|
|
|
|
*
|
|
|
|
|
* \param The error code
|
|
|
|
|
*
|
|
|
|
|
* \retval The string equivalent for the error code
|
|
|
|
|
*/
|
|
|
|
|
const char * SCErrorToString(SCError err)
|
|
|
|
|
{
|
|
|
|
|
switch (err) {
|
|
|
|
|
CASE_CODE (SC_OK);
|
|
|
|
|
CASE_CODE (SC_ERR_MEM_ALLOC);
|
|
|
|
|
CASE_CODE (SC_ERR_ACTION_ORDER);
|
|
|
|
|
CASE_CODE (SC_ERR_PCRE_MATCH);
|
|
|
|
|
CASE_CODE (SC_ERR_PCRE_GET_SUBSTRING);
|
|
|
|
|
CASE_CODE (SC_ERR_PCRE_COMPILE);
|
|
|
|
|
CASE_CODE (SC_ERR_PCRE_STUDY);
|
|
|
|
|
CASE_CODE (SC_ERR_PCRE_PARSE);
|
|
|
|
|
CASE_CODE (SC_ERR_LOG_MODULE_NOT_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_LOG_FG_FILTER_MATCH);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_DISPATCH);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_CREATE);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_SET_SNAPLEN);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_SET_PROMISC);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_SET_TIMEOUT);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_OPEN_LIVE);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_OPEN_OFFLINE);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_ACTIVATE_HANDLE);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_SET_BUFF_SIZE);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_PCAP_SET_BUFFER_SIZE);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_PF_RING);
|
|
|
|
|
CASE_CODE (SC_ERR_PF_RING_RECV);
|
|
|
|
|
CASE_CODE (SC_ERR_PF_RING_GET_CLUSTERID_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_PF_RING_GET_INTERFACE_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_PF_RING_OPEN);
|
|
|
|
|
CASE_CODE (SC_ERR_GET_CLUSTER_TYPE_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_CLUSTER_TYPE);
|
|
|
|
|
CASE_CODE (SC_ERR_PF_RING_SET_CLUSTER_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_DATALINK_UNIMPLEMENTED);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_SIGNATURE);
|
|
|
|
|
CASE_CODE (SC_ERR_OPENING_FILE);
|
|
|
|
|
CASE_CODE (SC_ERR_OPENING_RULE_FILE);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_RULES);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_RULES_LOADED);
|
|
|
|
|
CASE_CODE (SC_ERR_COUNTER_EXCEEDED);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_CHECKSUM);
|
|
|
|
|
CASE_CODE (SC_ERR_SPRINTF);
|
|
|
|
|
CASE_CODE (SC_ERR_FATAL);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_ARGUMENT);
|
|
|
|
|
CASE_CODE (SC_ERR_SPINLOCK);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_ENUM_MAP);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_IP_NETBLOCK);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_IPV4_ADDR);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_IPV6_ADDR);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_RUNMODE);
|
|
|
|
|
CASE_CODE (SC_ERR_COMPLETE_PORT_SPACE_NEGATED);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_PORTS_LEFT_AFTER_MERGE);
|
|
|
|
|
CASE_CODE (SC_ERR_NEGATED_VALUE_IN_PORT_RANGE);
|
|
|
|
|
CASE_CODE (SC_ERR_PORT_PARSE_INSERT_STRING);
|
|
|
|
|
CASE_CODE (SC_ERR_UNREACHABLE_CODE_REACHED);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_NUMERIC_VALUE);
|
|
|
|
|
CASE_CODE (SC_ERR_NUMERIC_VALUE_ERANGE);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_NUM_BYTES);
|
|
|
|
|
CASE_CODE (SC_ERR_ARG_LEN_LONG);
|
|
|
|
|
CASE_CODE (SC_ERR_ALPARSER);
|
|
|
|
|
CASE_CODE (SC_ERR_POOL_EMPTY);
|
|
|
|
|
CASE_CODE (SC_ERR_REASSEMBLY);
|
|
|
|
|
CASE_CODE (SC_ERR_POOL_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_UNIMPLEMENTED);
|
|
|
|
|
CASE_CODE (SC_ERR_ADDRESS_ENGINE_GENERIC);
|
|
|
|
|
CASE_CODE (SC_ERR_PORT_ENGINE_GENERIC);
|
|
|
|
|
CASE_CODE (SC_ERR_FAST_LOG_GENERIC);
|
|
|
|
|
CASE_CODE (SC_ERR_IPONLY_RADIX);
|
|
|
|
|
CASE_CODE (SC_ERR_DEBUG_LOG_GENERIC);
|
|
|
|
|
CASE_CODE (SC_ERR_UNIFIED_LOG_GENERIC);
|
|
|
|
|
CASE_CODE (SC_ERR_HTTP_LOG_GENERIC);
|
|
|
|
|
CASE_CODE (SC_ERR_UNIFIED_ALERT_GENERIC);
|
|
|
|
|
CASE_CODE (SC_ERR_UNIFIED2_ALERT_GENERIC);
|
|
|
|
|
CASE_CODE (SC_ERR_FWRITE);
|
|
|
|
|
CASE_CODE (SC_ERR_FOPEN);
|
|
|
|
|
CASE_CODE (SC_ERR_THREAD_NICE_PRIO);
|
|
|
|
|
CASE_CODE (SC_ERR_THREAD_SPAWN);
|
|
|
|
|
CASE_CODE (SC_ERR_THREAD_CREATE);
|
|
|
|
|
CASE_CODE (SC_ERR_THREAD_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_THRESHOLD_HASH_ADD);
|
|
|
|
|
CASE_CODE (SC_ERR_UNDEFINED_VAR);
|
|
|
|
|
CASE_CODE (SC_ERR_RULE_KEYWORD_UNKNOWN);
|
|
|
|
|
CASE_CODE (SC_ERR_FLAGS_MODIFIER);
|
|
|
|
|
CASE_CODE (SC_ERR_DISTANCE_MISSING_CONTENT);
|
|
|
|
|
CASE_CODE (SC_ERR_BYTETEST_MISSING_CONTENT);
|
|
|
|
|
CASE_CODE (SC_ERR_BYTEJUMP_MISSING_CONTENT);
|
|
|
|
|
CASE_CODE (SC_ERR_WITHIN_MISSING_CONTENT);
|
|
|
|
|
CASE_CODE (SC_ERR_WITHIN_INVALID);
|
|
|
|
|
CASE_CODE (SC_ERR_DEPTH_MISSING_CONTENT);
|
|
|
|
|
CASE_CODE (SC_ERR_OFFSET_MISSING_CONTENT);
|
|
|
|
|
CASE_CODE (SC_ERR_NOCASE_MISSING_PATTERN);
|
|
|
|
|
CASE_CODE (SC_ERR_RAWBYTES_MISSING_CONTENT);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_URICONTENT_NEGATION);
|
|
|
|
|
CASE_CODE (SC_ERR_HASH_TABLE_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_STAT);
|
|
|
|
|
CASE_CODE (SC_ERR_LOGDIR_CONFIG);
|
|
|
|
|
CASE_CODE (SC_ERR_LOGDIR_CMDLINE);
|
|
|
|
|
CASE_CODE (SC_ERR_RADIX_TREE_GENERIC);
|
|
|
|
|
CASE_CODE (SC_ERR_MISSING_QUOTE);
|
|
|
|
|
CASE_CODE (SC_ERR_UNKNOWN_PROTOCOL);
|
|
|
|
|
CASE_CODE (SC_ERR_UNKNOWN_RUN_MODE);
|
|
|
|
|
CASE_CODE (SC_ERR_IPFW_NOSUPPORT);
|
|
|
|
|
CASE_CODE (SC_ERR_IPFW_BIND);
|
|
|
|
|
CASE_CODE (SC_ERR_IPFW_SOCK);
|
|
|
|
|
CASE_CODE (SC_ERR_IPFW_SETSOCKOPT);
|
|
|
|
|
CASE_CODE (SC_ERR_IPFW_NOPORT);
|
|
|
|
|
CASE_CODE (SC_WARN_IPFW_RECV);
|
|
|
|
|
CASE_CODE (SC_WARN_IPFW_XMIT);
|
|
|
|
|
CASE_CODE (SC_WARN_IPFW_SETSOCKOPT);
|
|
|
|
|
CASE_CODE (SC_WARN_IPFW_UNBIND);
|
|
|
|
|
CASE_CODE (SC_ERR_MULTIPLE_RUN_MODE);
|
|
|
|
|
CASE_CODE (SC_ERR_BPF);
|
|
|
|
|
CASE_CODE (SC_ERR_MISSING_CONFIG_PARAM);
|
|
|
|
|
CASE_CODE (SC_ERR_UNKNOWN_VALUE);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_VALUE);
|
|
|
|
|
CASE_CODE (SC_ERR_UNKNOWN_REGEX_MOD);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_OPERATOR);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_RECV_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_NOSUPPORT);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_UNBIND);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_BIND);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_HANDLE_PKT);
|
|
|
|
|
CASE_CODE (SC_ERR_NFLOG_NOSUPPORT);
|
|
|
|
|
CASE_CODE (SC_ERR_NFLOG_OPEN);
|
|
|
|
|
CASE_CODE (SC_ERR_NFLOG_BIND);
|
|
|
|
|
CASE_CODE (SC_ERR_NFLOG_UNBIND);
|
|
|
|
|
CASE_CODE (SC_ERR_NFLOG_MAX_BUFSIZ);
|
|
|
|
|
CASE_CODE (SC_ERR_NFLOG_SET_MODE);
|
|
|
|
|
CASE_CODE (SC_ERR_NFLOG_HANDLE_PKT);
|
|
|
|
|
CASE_CODE (SC_ERR_NFLOG_GROUP);
|
|
|
|
|
CASE_CODE (SC_ERR_NFLOG_FD);
|
|
|
|
|
CASE_CODE (SC_WARN_NFLOG_SETSOCKOPT);
|
|
|
|
|
CASE_CODE (SC_WARN_NFLOG_RECV);
|
|
|
|
|
CASE_CODE (SC_WARN_NFLOG_LOSING_EVENTS);
|
|
|
|
|
CASE_CODE (SC_WARN_NFLOG_MAXBUFSIZ_REACHED);
|
|
|
|
|
CASE_CODE (SC_ERR_CUDA_ERROR);
|
|
|
|
|
CASE_CODE (SC_ERR_CUDA_HANDLER_ERROR);
|
|
|
|
|
CASE_CODE (SC_ERR_TM_THREADS_ERROR);
|
|
|
|
|
CASE_CODE (SC_ERR_TM_MODULES_ERROR);
|
|
|
|
|
CASE_CODE (SC_ERR_AC_CUDA_ERROR);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_YAML_CONF_ENTRY);
|
|
|
|
|
CASE_CODE (SC_ERR_TMQ_ALREADY_REGISTERED);
|
|
|
|
|
CASE_CODE (SC_ERR_CONFLICTING_RULE_KEYWORDS);
|
|
|
|
|
CASE_CODE (SC_ERR_INITIALIZATION);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_ACTION);
|
|
|
|
|
CASE_CODE (SC_ERR_LIBNET_REQUIRED_FOR_ACTION);
|
|
|
|
|
CASE_CODE (SC_ERR_LIBNET_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_LIBNET_INVALID_DIR);
|
|
|
|
|
CASE_CODE (SC_ERR_LIBNET_BUILD_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_LIBNET_WRITE_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_LIBNET_NOT_ENABLED);
|
|
|
|
|
CASE_CODE (SC_ERR_UNIFIED_LOG_FILE_HEADER);
|
|
|
|
|
CASE_CODE (SC_ERR_REFERENCE_UNKNOWN);
|
|
|
|
|
CASE_CODE (SC_ERR_PIDFILE_SNPRINTF);
|
|
|
|
|
CASE_CODE (SC_ERR_PIDFILE_OPEN);
|
|
|
|
|
CASE_CODE (SC_ERR_PIDFILE_WRITE);
|
|
|
|
|
CASE_CODE (SC_ERR_PIDFILE_DAEMON);
|
|
|
|
|
CASE_CODE (SC_ERR_UID_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_GID_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_CHANGING_CAPS_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_LIBCAP_NG_REQUIRED);
|
|
|
|
|
CASE_CODE (SC_ERR_LIBNET11_INCOMPATIBLE_WITH_LIBCAP_NG);
|
|
|
|
|
CASE_CODE (SC_WARN_FLOW_EMERGENCY);
|
|
|
|
|
CASE_CODE (SC_ERR_SVC);
|
|
|
|
|
CASE_CODE (SC_ERR_ERF_DAG_OPEN_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_ERF_DAG_STREAM_OPEN_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_ERF_DAG_STREAM_START_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_ERF_DAG_STREAM_SET_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_ERF_DAG_STREAM_READ_FAILED);
|
|
|
|
|
CASE_CODE (SC_WARN_ERF_DAG_REC_LEN_CHANGED);
|
|
|
|
|
CASE_CODE (SC_ERR_NAPATECH_OPEN_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_NAPATECH_STREAM_NEXT_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_NAPATECH_NOSUPPORT);
|
|
|
|
|
CASE_CODE (SC_ERR_NAPATECH_REQUIRED);
|
|
|
|
|
CASE_CODE (SC_ERR_NAPATECH_TIMESTAMP_TYPE_NOT_SUPPORTED);
|
|
|
|
|
CASE_CODE (SC_ERR_NAPATECH_INIT_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_NAPATECH_CONFIG_STREAM);
|
|
|
|
|
CASE_CODE (SC_ERR_NAPATECH_STREAMS_REGISTER_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_NAPATECH_STAT_DROPS_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_NAPATECH_PARSE_CONFIG);
|
|
|
|
|
CASE_CODE (SC_WARN_COMPATIBILITY);
|
|
|
|
|
CASE_CODE (SC_ERR_DCERPC);
|
|
|
|
|
CASE_CODE (SC_ERR_DETECT_PREPARE);
|
|
|
|
|
CASE_CODE (SC_ERR_AHO_CORASICK);
|
|
|
|
|
CASE_CODE (SC_ERR_REFERENCE_CONFIG);
|
|
|
|
|
CASE_CODE (SC_ERR_DUPLICATE_SIG);
|
|
|
|
|
CASE_CODE (SC_WARN_PCAP_MULTI_DEV_EXPERIMENTAL);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_MULTI_DEV_NO_SUPPORT);
|
|
|
|
|
CASE_CODE (SC_ERR_HTTP_METHOD_NEEDS_PRECEEDING_CONTENT);
|
|
|
|
|
CASE_CODE (SC_ERR_HTTP_METHOD_INCOMPATIBLE_WITH_RAWBYTES);
|
|
|
|
|
CASE_CODE (SC_ERR_HTTP_METHOD_RELATIVE_MISSING);
|
|
|
|
|
CASE_CODE (SC_ERR_HTTP_COOKIE_NEEDS_PRECEEDING_CONTENT);
|
|
|
|
|
CASE_CODE (SC_ERR_HTTP_COOKIE_INCOMPATIBLE_WITH_RAWBYTES);
|
|
|
|
|
CASE_CODE (SC_ERR_HTTP_COOKIE_RELATIVE_MISSING);
|
|
|
|
|
CASE_CODE (SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING);
|
|
|
|
|
CASE_CODE (SC_ERR_UNKNOWN_DECODE_EVENT);
|
|
|
|
|
CASE_CODE (SC_ERR_RUNMODE);
|
|
|
|
|
CASE_CODE (SC_ERR_SHUTDOWN);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_DIRECTION);
|
|
|
|
|
CASE_CODE (SC_ERR_AFP_CREATE);
|
|
|
|
|
CASE_CODE (SC_ERR_AFP_READ);
|
|
|
|
|
CASE_CODE (SC_ERR_AFP_DISPATCH);
|
|
|
|
|
CASE_CODE (SC_ERR_CMD_LINE);
|
|
|
|
|
CASE_CODE (SC_ERR_SIZE_PARSE);
|
|
|
|
|
CASE_CODE (SC_ERR_RAWBYTES_FILE_DATA);
|
|
|
|
|
CASE_CODE (SC_ERR_SOCKET);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_TRANSLATE);
|
|
|
|
|
CASE_CODE (SC_WARN_OUTDATED_LIBHTP);
|
|
|
|
|
CASE_CODE (SC_WARN_DEPRECATED);
|
|
|
|
|
CASE_CODE (SC_WARN_PROFILE);
|
|
|
|
|
CASE_CODE (SC_ERR_FLOW_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_HOST_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_MEM_BUFFER_API);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_MD5);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_MD5_SUPPORT);
|
|
|
|
|
CASE_CODE (SC_ERR_EVENT_ENGINE);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_LUA_SUPPORT);
|
|
|
|
|
CASE_CODE (SC_ERR_LUA_ERROR);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_GEOIP_SUPPORT);
|
|
|
|
|
CASE_CODE (SC_ERR_GEOIP_ERROR);
|
|
|
|
|
CASE_CODE (SC_ERR_DEFRAG_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_REPUTATION);
|
|
|
|
|
CASE_CODE (SC_ERR_NOT_SUPPORTED);
|
|
|
|
|
CASE_CODE (SC_ERR_LIVE_RULE_SWAP);
|
|
|
|
|
CASE_CODE (SC_WARN_UNCOMMON);
|
|
|
|
|
CASE_CODE (SC_ERR_SYSCALL);
|
|
|
|
|
CASE_CODE (SC_ERR_SYSCONF);
|
|
|
|
|
CASE_CODE (SC_ERR_INVALID_ARGUMENTS);
|
|
|
|
|
CASE_CODE (SC_ERR_PERF_STATS_NOT_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_OPEN);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_MAXLEN);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_CREATE_QUEUE);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_SET_MODE);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_SETSOCKOPT);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_RECV);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_SET_VERDICT);
|
|
|
|
|
CASE_CODE (SC_ERR_NFQ_THREAD_INIT);
|
|
|
|
|
CASE_CODE (SC_ERR_DAEMON);
|
|
|
|
|
CASE_CODE (SC_ERR_TLS_LOG_GENERIC);
|
|
|
|
|
CASE_CODE (SC_ERR_MUTEX);
|
|
|
|
|
CASE_CODE (SC_ERR_REPUTATION_INVALID_OPERATION);
|
|
|
|
|
CASE_CODE (SC_ERR_REPUTATION_INVALID_TYPE);
|
|
|
|
|
CASE_CODE (SC_ERR_BYTE_EXTRACT_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_DAG_REQUIRED);
|
|
|
|
|
CASE_CODE (SC_ERR_DAG_NOSUPPORT);
|
|
|
|
|
CASE_CODE (SC_ERR_NO_AF_PACKET);
|
|
|
|
|
CASE_CODE (SC_ERR_PCAP_FILE_DELETE_FAILED);
|
|
|
|
|
CASE_CODE (SC_ERR_MAGIC_OPEN);
|
|
|
|
|
CASE_CODE (SC_ERR_MAGIC_LOAD);
|
|
|
|
|
CASE_CODE (SC_ERR_CUDA_BUFFER_ERROR);
|
|
|
|
|
CASE_CODE (SC_ERR_DNS_LOG_GENERIC);
|
|
|
|
|
CASE_CODE (SC_WARN_OPTION_OBSOLETE);
|
|
|
|
|
CASE_CODE (SC_WARN_NO_UNITTESTS);
|
|
|
|
|
CASE_CODE (SC_ERR_THREAD_QUEUE);
|
|
|
|
|
CASE_CODE (SC_WARN_XFF_INVALID_MODE);
|
|
|
|
|
CASE_CODE (SC_WARN_XFF_INVALID_HEADER);
|
|
|
|
|
CASE_CODE (SC_ERR_THRESHOLD_SETUP);
|
|
|
|
|
CASE_CODE (SC_ERR_DNS_CONFIG);
|
|
|
|
|
CASE_CODE (SC_ERR_CONF_YAML_ERROR);
|
|
|
|
|
CASE_CODE (SC_ERR_CONF_NAME_TOO_LONG);
|
App layer API rewritten. The main files in question are:
app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch].
Things addressed in this commit:
- Brings out a proper separation between protocol detection phase and the
parser phase.
- The dns app layer now is registered such that we don't use "dnstcp" and
"dnsudp" in the rules. A user who previously wrote a rule like this -
"alert dnstcp....." or
"alert dnsudp....."
would now have to use,
alert dns (ipproto:tcp;) or
alert udp (app-layer-protocol:dns;) or
alert ip (ipproto:udp; app-layer-protocol:dns;)
The same rules extend to other another such protocol, dcerpc.
- The app layer parser api now takes in the ipproto while registering
callbacks.
- The app inspection/detection engine also takes an ipproto.
- All app layer parser functions now take direction as STREAM_TOSERVER or
STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the
functions.
- FlowInitialize() and FlowRecycle() now resets proto to 0. This is
needed by unittests, which would try to clean the flow, and that would
call the api, AppLayerParserCleanupParserState(), which would try to
clean the app state, but the app layer now needs an ipproto to figure
out which api to internally call to clean the state, and if the ipproto
is 0, it would return without trying to clean the state.
- A lot of unittests are now updated where if they are using a flow and
they need to use the app layer, we would set a flow ipproto.
- The "app-layer" section in the yaml conf has also been updated as well.
12 years ago
|
|
|
CASE_CODE (SC_ERR_APP_LAYER_PROTOCOL_DETECTION);
|
Add option on Tile-Gx for logging for fast.log alerts over PCIe
When running on a TILEncore-Gx PCIe card, setting the filetype of fast.log
to pcie, will open a connection over PCIe to a host application caleld
tile-pcie-logd, that receives the alert strings and writes them to a file
on the host. The file name to open is also passed over the PCIe link.
This allows running Suricata on the TILEncore-Gx PCIe card, but have the
alerts logged to the host system's file system efficiently. The PCIe API that
is used is the Tilera Packet Queue (PQ) API which can access PCIe from User
Space, thus avoiding system calls.
Created util-logopenfile-tile.c and util-logopen-tile.h for the TILE
specific PCIe logging functionality.
Using Write() and Close() function pointers in LogFileCtx, which
default to standard write and close for files and sockets, but are
changed to PCIe write and close functions when a PCIe channel is
openned for logging.
Moved Logging contex out of tm-modules.h into util-logopenfile.h,
where it makes more sense. This required including util-logopenfile.h
into a couple of alert-*.c files, which previously were getting the
definitions from tm-modules.h.
The source and Makefile for tile-pcie-logd are added in contrib/tile-pcie-logd.
By default, the file name for fast.log specified in suricata.yaml is used as
the filename on the host. An optional argument to tile-pcie-logd, --prefix=,
can be added to prepend the supplied file path. For example, is the file
in suricata.yaml is specified as "/var/log/fast.log" and --prefix="/tmp",
then the file will be written to "/tmp/var/log/fast.log".
Check for TILERA_ROOT environment variable before building tile_pcie_logd
Building tile_pcie_logd on x86 requires the Tilera MDE for its PCIe libraries
and API header files. Configure now checs for TILERA_ROOT before enabling
builing tile_pcie_logd in contrib/tile_pcie_logd
12 years ago
|
|
|
CASE_CODE (SC_ERR_PCIE_INIT_FAILED);
|
|
|
|
|
CASE_CODE (SC_WARN_LUA_SCRIPT);
|
|
|
|
|
CASE_CODE (SC_ERR_LUA_SCRIPT);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return "UNKNOWN_ERROR";
|
|
|
|
|
}
|
