169 Commits (1c371da46dcd64a41ffc320a893066e3ba15922c)

Author	SHA1	Message	Date
Eric Leblond	c0c59fbd17	decode: factorize macro code ... PACKET_* are now wrapper to the newly introduced PACKET_SET_ACTION macro.	12 years ago
Eric Leblond	3f107fa130	decode: Packet action start with PACKET ... Rename all Packet action macro to have them prefixed by PACKET.	12 years ago
Anoop Saldanha	602c91ed41	Minor cosmetic changes to the cuda code. ... Moved a couple of functions to more cuda relevant files; Re-structured some data types.	12 years ago
Anoop Saldanha	17c763f855	Version 1 of AC Cuda.	12 years ago
Anoop Saldanha	b787da5643	Remove all cuda related code in the engine except for the cuda api wrappers	12 years ago
Eric Leblond	efaa9a7302	action handling: define and use macros ... The action field in Packet structure should not be accessed directly as the tunneled packet needs to update the root packet and not the initial packet. This patch is fixing issue #819 where suricata was not able to drop fragmented packets in AF_PACKET IPS mode. It also fixes drop capability for tunneled packets.	12 years ago
Ken Steele	93e7304117	Preserve PKT_ALLOC flag inside PACKET_RECYCLE(). ... The PKT_ALLOC flag was being cleared by PACKET_RECYCLE(), which could then result in a packet being pushed back to the Packet ring buffer incorrectly.	12 years ago
Ken Steele	699d9e01f1	Move memset() out of PACKET_INITIALIZE() ... The memset() inside PACKET_INITIALIZE() is redundant in some cases and it is cleaner to do as part of the memory allocation. This simplifies changes for integrating Tilera mPIPE support because the size of memory cleared in that case is different from SIZE_OF_PACKET. For the cases where Packets are directly allocated and then call PACKET_INITIALIZE() without memset() first, this patch adds memset() calls. A further change would use GetPacketFromAlloc() directly.	12 years ago
Victor Julien	f5cd7c6a92	decode events: add debug statement	13 years ago
Victor Julien	e30b1bfe64	Simple IP reputation implementation	13 years ago
Anoop Saldanha	f08497d1e4	Move Flow Reference/Dereferene api from flow-util.h to flow.h. ... Remove duplicate FlowDeReference from decode.h	13 years ago
Anoop Saldanha	67981d1c5c	Update suricata to use FlowReference/FlowDeReference for the ones left out ... from last update.	13 years ago
Victor Julien	a01130d2ed	packet src: move pkt_src field up in the structure to fix in an existing hole (found with pahole -C Packet_ src/.libs/suricata).	13 years ago
Anoop Saldanha	b33986c887	Add a packet src for every packet generated inside suricata.	13 years ago
Eric Leblond	775f379e2b	decode: clean release function	13 years ago
Eric Leblond	f241312a36	defrag: don't use message for repetitive error ... When nothing can be fetch from the pool, this can repeat frequently. Thus displaying a message in the log will not help. This patch uses a counter instead of a log message. As this is a sort of memcap this is conformed to what is done for other issues of the same type.	13 years ago
Eric Leblond	2011a3f87e	capture: add data release mechanism ... This patch adds a data release mechanism. If the capture module has a call to indicate that userland has finished with the data, it is possible to use this system. The data will then be released when the treatment of the packet is finished. To do so the Packet structure has been modified: + TmEcode (*ReleaseData)(ThreadVars *, struct Packet_ *); If ReleaseData is null, the function is called when the treatment of the Packet is finished. Thus it is sufficient for the capture module to code a function wrapping the data release mechanism and to assign it to ReleaseData field. This patch also includes an implementation of this mechanism for AF_PACKET.	13 years ago
Eric Leblond	e6e339aacf	Add counters for IPv4 in IPv6 and IPv6 in IPv6	13 years ago
Eric Leblond	f9046d8284	Add teredo counter.	13 years ago
Anoop Saldanha	32183faa82	free flowvar entries in flow after live rule swap. Sync flowbits entries into packet struct to be used by alert debuglog when alert debuglog is enabled	13 years ago
Victor Julien	ea0d172693	No longer pass StreamMsg to output for alert logging, instead use the same callback code as is used for state alerts.	13 years ago
Victor Julien	98c30be2db	ipv6: improve handling of packets with duplicate (or more) ipv6 extension headers.	13 years ago
Victor Julien	79691f675a	defrag: don't increment recursion level for reassembled packets. Fixes defragged packets not seeing the same flow.	14 years ago
Victor Julien	92e7a7d254	ipv6: fix detection engine using the originals IPv6 header's nxt hdr value instead of the upper layer one.	14 years ago
Victor Julien	d908e707d7	profiling: add per lock location profiling ... Add profiling per lock location in the code. Accounts how often a lock is requested, how often it was contended, the max number of ticks spent waiting for it, avg number of ticks waiting for it and the total ticks for that location. Added a new configure flag --enable-profiling-locks to enable this feature.	14 years ago
Victor Julien	979edf0b97	Add way to profile mutex/spin locks per thread module.	14 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	14 years ago
Eric Leblond	34b3f19465	af-packet: Implement zero copy ... This patch adds support for zero copy to AF_PACKET running mode. This requires to use the 'worker' mode which is the only one where the threading architecture is simple enough to permit this without heavy modification.	14 years ago
Eric Leblond	3593cb051e	decode: add PacketSetData funtion ... This patch adds a function which can be used to set the payload of a packet when a zero copy mode is used.	14 years ago
Eric Leblond	c3eaa6cc60	Add per-interface counter for invalid checksum. ... This patch adds a per-device counter for invalid checksum as well as a simple packet counter.	14 years ago
Eric Leblond	551cb3e4c2	decode: introduce checksum mode enum.	14 years ago
Eric Leblond	81bc6f5518	Treat incomplete checksum. ... Checksum of local traffic is often offloaded to the network device. This causes some problems on parsing of this traffic. This patch introduces a PKT_INCOMPLETE_CHECKSUM flag which can be used to indicate that the checksum is not computed/correct for good reason.	14 years ago
Eric Leblond	6e7a8f38bf	ipfw: Add support for autofp and worker runmode ... This patch convert ipfw code to the PcktAcqLoop API and rework the running mode to use the running mode wrapper already used by NFQ.	14 years ago
Anoop Saldanha	7c9d1b80fd	Update size parsing API with new calls for returing u8, u16, u32 and u64 values. Make updates in the codebase to use these new calls	14 years ago
Anoop Saldanha	01a35bb604	introduce app layer local storage api support	14 years ago
Eric Leblond	60a99915c1	doc: create http support group ... This patch create an httplayer group and adds related files to it. It also fixes some typo in documentation string and format.	14 years ago
Victor Julien	2e2e80b812	Add packet alert flag to indicate a match happened (partly) in the app layer state. Make unified2 use this flag.	14 years ago
Victor Julien	4c641f0deb	Fix compilation with profiling enabled.	14 years ago
Anoop Saldanha	246a4e9fff	for shutdown reassembly properly init the reassembly packet using PACKET_RECYCLE	14 years ago
pilcrow	ed69eeab14	Safer macro parenthesization and do/while use	14 years ago
Anoop Saldanha	54f6e4ff4d	Merge thread kill functions. Merge slot's tm_id with the one used by packet profiling. Remove some junk unused code from ms sync pts. Timeout setup cleanup as well. packet q dbg_maxlen now u32 var.	14 years ago
Anoop Saldanha	b4887943fb	packet queue len member is now 32 bit unsigned from the previous 16 bit unsigned. Should take care of the overflow for now	14 years ago
Anoop Saldanha	99207c718d	Avoid possiblity of potential engine idling from consumption of all packetpool packets - v1 ... - Now forced reassembly uses only malloced packets.	14 years ago
Victor Julien	cc4e89fbe1	Profiling: convert all packet profile counters/variables to u64. Improve output for larger numbers.	14 years ago
Victor Julien	c590bba4a4	Undo tunnel reference counting using atomic operations. Revert to mutex based code.	14 years ago
Victor Julien	3693a7a9ee	Profiling: add accounting for several detection phases.	14 years ago
Victor Julien	e8e392fb1f	Profiling: add per packet accounting of how much ticks are spend in protocol detection.	14 years ago
Eric Leblond	7425bf5ca6	Rename some decode event structure and macro. ... This patch renames DECODER_SET_EVENT, DECODER_ISSET_EVENT and some other structures to ENGINE equivalent to take into account the fact the event list is now related to all engines and not only to decoder.	14 years ago
Victor Julien	fca541f40e	Add per app layer parser profiling ... Per packet per app layer parser profiling. Example summary output: Per App layer parser stats: App Layer IP ver Proto cnt min max avg -------------------- ------ ----- ------ ------ ---------- ------- ALPROTO_HTTP IPv4 6 163394 126 38560320 42814 ALPROTO_FTP IPv4 6 644 117 26100 2566 ALPROTO_TLS IPv4 6 670 117 7137 799 ALPROTO_SMB IPv4 6 114794 126 225270 957 ALPROTO_DCERPC IPv4 6 5207 126 25596 1266 Also added to the csv out. In the csv out there is a new column "stream (no app)" that removes the app layer parsers from the stream tracking. So raw stream engine performance becomes visible.	14 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	14 years ago