suricata

Commit Graph

Author	SHA1	Message	Date
Victor Julien	e583de0582	Minor unittest cleanups	10 years ago
Victor Julien	393689ce44	classification: remove global from parsing Parsing code used a 'fd' global. Remove this.	10 years ago
Ken Steele	8f1d75039a	Enforce function coding standard Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Victor Julien	2c20c9d409	Fix Coverity 1220098 and 1220099 *** CID 1220098: Missing unlock (LOCK) /src/log-droplog.c: 195 in LogDropLogNetFilter() 189 SCMutexLock(&dlt->file_ctx->fp_mutex); 190 191 if (dlt->file_ctx->rotation_flag) { 192 dlt->file_ctx->rotation_flag = 0; 193 if (SCConfLogReopen(dlt->file_ctx) != 0) { 194 /* Rotation failed, error already logged. / >>> CID 1220098: Missing unlock (LOCK) >>> Returning without unlocking "dlt->file_ctx->fp_mutex". 195 return TM_ECODE_FAILED; 196 } 197 } 198 199 if (dlt->file_ctx == NULL) { 200 return TM_ECODE_FAILED; ** CID 1220099: Dereference before null check (REVERSE_INULL) /src/log-droplog.c: 199 in LogDropLogNetFilter() 193 if (SCConfLogReopen(dlt->file_ctx) != 0) { 194 /* Rotation failed, error already logged. */ 195 return TM_ECODE_FAILED; 196 } 197 } 198 >>> CID 1220099: Dereference before null check (REVERSE_INULL) >>> Null-checking "dlt->file_ctx" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 199 if (dlt->file_ctx == NULL) { 200 return TM_ECODE_FAILED; 201 } 202 203 char srcip[46] = ""; 204 char dstip[46] = "";	11 years ago
Jason Ish	fc2014ab40	Unregister for file rotation notification when a context is de-initialized. Required for unix-socket mode where contexts come and go.	11 years ago
Jason Ish	e1b97fed70	Add signal based file rotation for: - alert debug log - fast log - stats log - dns log - drop log - file log - http log - tls log - eve/json log	11 years ago
Victor Julien	96adcf6829	refactor IDS/IPS engine mode logic Instead of error phrone externs with macro's, use functions with a local static enum var instead. - EngineModeIsIPS(): in IPS mode - EngineModeIsIDS(): in IDS mode To set the modes: - EngineModeSetIDS(): IDS mode (default) - EngineModeSetIPS(): IPS mode Bug #1177.	12 years ago
Victor Julien	f96a54535c	drop loggers: call disable func Call OutputDropLoggerDisable() on cleanup.	12 years ago
Victor Julien	a3b0577a1f	output: add TM_FLAG_LOGAPI_TM thread module flag The TM_FLAG_LOGAPI_TM flag indicates that a module is run by the log api, not by the 'regular' thread module call functions. Set flag in all all Log API users' registration code. Purpose of this flag is in profiling. In profiling output it will be used to list log api thread modules separately.	12 years ago
Victor Julien	9950427466	output: check for multiple instances of drop and tls Both the drop and tls logs are currently not designed to have multiple instances running. So until that is changed, error out if more than one instance is started.	12 years ago
Victor Julien	35aa6c1e66	Convert log-drop to packet logger api.	12 years ago
Ken Steele	68d26dcec7	Merge multiple copies of CreateTimeString() to one copy. There were 8 identical copies of CreateTimeString() in 8 files. Most used SCLocalTime, to replace localtime_r(), but some did not. Created one copy in util-time.c.	12 years ago
Eric Leblond	3f107fa130	decode: Packet action start with PACKET Rename all Packet action macro to have them prefixed by PACKET.	12 years ago
Anoop Saldanha	b787da5643	Remove all cuda related code in the engine except for the cuda api wrappers	12 years ago
Eric Leblond	a35c367942	action handling: use macro for test. Use test macro instead of direct access to action field. This patch has been obtained by using the following spatch file: @@ Packet *p; expression E; @@ - p->action & E + TEST_PACKET_ACTION(p, E)	12 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc\|SCStrdup\|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Eric Leblond	a0e57f58e5	OpenBSD: introduce SCLocalTime function. This function is a wrapper to localtime_r. It is needed to avoid a compilation warning on OpenBSD. I'm forced to type the function to a non pointer first parameter. If not we will have to use two differents functions in OpenBSD where tv->tv_sec is a long (different from time_t).	13 years ago
Mike Pomraning	dfec9c0f6a	Switch 'fast', 'http-log', 'drop' and 'alert-debug' to SCConfLogOpenGeneric.	14 years ago
Anoop Saldanha	7433d92dd2	undo this commit - commit `eff08f93d8` Author: Anoop Saldanha <poonaatsoc@gmail.com> Date: Thu Nov 3 14:31:24 2011 +0530 update failing unittest to reflect the mpm design update Fixed a bug in the mpm code that would make all the changes in the commit just undone wrong.	14 years ago
Anoop Saldanha	eff08f93d8	update failing unittest to reflect the mpm design update	14 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	14 years ago
Anoop Saldanha	4307ea2348	Replace all frees with SCFrees	14 years ago
Eileen Donlon	89599d3b9b	fixed bug 288; corrected config boolean parsing problems	14 years ago
Victor Julien	820b0ded82	Add per packet profiling. Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	14 years ago
Eric Leblond	6b9d1012ff	Transform inet_ntop call into PrintInet one.	14 years ago
Victor Julien	75439863ed	Shrink PacketAlerts structure so that Packet structure is a lot smaller. Reduce max events per packet from 256 to 15.	14 years ago
Victor Julien	cec7ece697	Don't print drop log on pseudo packet.	15 years ago
Victor Julien	1ace091bd4	Minor drop log cleanups.	15 years ago
Gurvinder Singh	7d0781b349	added support to log dropped packet as netfilter logs while in inline mode	15 years ago

29 Commits (14981cb2a84951ff1ce4e8d911ebc7cdd9b22755)