192 Commits (262a7300d701c44dba13bb2aaa2b14bed3485383)

Author	SHA1	Message	Date
Victor Julien	8cc82c7241	Add -S commandline option that loads a rule file exclusively. Issue #338.	14 years ago
Victor Julien	55da9787a4	Win32 compile fixes.	14 years ago
Eric Leblond	391d813c82	Remove unified1 output module.	14 years ago
Eric Leblond	27f1d88374	Add pcap-info alert format. ... This patch adds a new alert format called pcap-info. It aims at providing an easy to parse one-line per-alert format containing the packet id in the parsed pcap for each alert. This permit to add information inside the pcap parser. This format is made to be used with suriwire which is a plugin for wireshark. Its target is to enable the display of suricata results inside wireshark. This format doesn't use append mode per default because a clean file is needed to operate with wireshark. The format is a list of values separated by ':': Packet number:GID of matching signature:SID of signature:REV of signature:Flow:To Server:To Client:0:0:Message of signature The two zero are not yet used values. Candidate for usage is the part of the packet that matched the signature.	14 years ago
Eric Leblond	788fa1e5a1	pfring: Fix typo in help.	14 years ago
Eric Leblond	c75fffe92d	Improve help message ... Usage of command line has evolved with the introduction of long option. This patch updates the description of the related options.	14 years ago
Eric Leblond	dc075a74a2	pcap: add --pcap option ... This patch adds a --pcap option which can be used to select or an interface if an argument is provided or the interfaces defined in the configuration file.	14 years ago
Eric Leblond	d9d8286671	pfring: restore compatibility with v1.0 config ... Compatibility of pfring module with previous version was broken. This patch restores backward compatibility.	14 years ago
Eric Leblond	a64dcfeba2	pfring: use factorisation function ... This patch convert pfring to pktacqloop and use the new factorisation function. This also fixes commmand line parsing of pfring which is now able to work like af-packet: - 'suricata -c s.yaml --pfring' start suricata with all interfaces in conf - 'suricata -c s.yaml --pfring=eth2' start suricata on eth2	14 years ago
Anoop Saldanha	b6ba944e6d	Rearrange flow manager functions into flow-manager.[ch]. Some other minor changes/updates	14 years ago
Anoop Saldanha	727a950e39	Move time elapsed right after we finish all packet processing	14 years ago
Anoop Saldanha	c365bafbf6	We now inspect timed out streams + streams not processed as yet, at engine shutdown	14 years ago
Anoop Saldanha	a844eecb0e	- Updated all runmodes to use synchronization points, right before each thread(slot function) tries to de-init the thread. - Main thread now first disables receive thread(s) before it kills receive and rest of the threads.	14 years ago
Victor Julien	3d396e8b1e	Update PCRE JIT code to support official JIT implementation in pcre-8.20-RC1.	14 years ago
Eric Leblond	fb4be6199f	af-packet: change option name ... This patch changes the option name. af-packet long option is now used instead of -a to mimic pfring behaviour. This patch improves the standard parsing of the command line. Running suricata -c suricata.yaml --af-packet will start a suricata running in AF_PACKET mode listening on all interfaces defined in the suricata.yaml configuration file. The traditionnal syntax: suricata -c suricata.yaml --af-packet=ppp0 will start a suricata listening on ppp0 only.	14 years ago
Eric Leblond	fbca1a4e6b	af-packet: multi interface support ... This patch adds multi interface support to AF_PACKET. A structure is used at thread creation to give all needed information to the input module. Parsing of the options is done in runmode preparation through a dedicated function which return the configuration in a structure usable by thread creation.	14 years ago
Eric Leblond	e80b30c082	af-packet: finalize code ... This patch handles the end of AF_PACKET socket support work. It provides conditional compilation, autofp and single runmode. It also adds a 'defrag' option which is used to activate defrag support in kernel to avoid rx_hash computation in flow mode to fail due to fragmentation. This patch contains some fixes by Anoop Saldanha, and incorporate change following review by Anoop Saldanha and Victor Julien. AF_PACKET support is only build if the --enable-af-packet flag is given to the configure command line. Detection of code availability is also done: a check of the existence of AF_PACKET in standard header is done. It seems this variable is Linux specific and it should be enough to avoid compilation of AF_PACKET support on other OSes. Compilation does not depend on up-to-date headers on the system. If none are present, wemake our own declaration of FANOUT variables. This will permit compilation of the feature for system where only the kernel has been updated to a version superior to 3.1.	14 years ago
Eric Leblond	871b21892a	factorize pcap live device function ... They are not specific to pcap and could thus be used in other module.	14 years ago
Eric Leblond	c45d898572	af-packet: basic support for AF_PACKET socket ... This patch provides basic support for AF_PACKET socket. It is completed by a subsequent patches prodiding extended features and bugfixes.	14 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	14 years ago
Anoop Saldanha	975ebf2e4f	Minor changes to move function calls that kills threads + frees resources to the clean up phase right to the end of main thread	14 years ago
Anoop Saldanha	576ec7da66	smtp parser support	14 years ago
Gerardo Iglesias Galvan	a9509eea2e	Fix very minor mem leak when setting bpf filter	14 years ago
Gerardo Iglesias Galvan	313067f47f	Check return code of DetectEngineCtxInit at startup	14 years ago
deltay	2856cf0de5	#277 ignore bpf filter if fread failed.	14 years ago
deltay	e3270f20b2	#277 Add -F option to load bpf filter from file	14 years ago
William	d74fe520e5	Experimental support for PCRE-sljit enable via --enable-pcre-sljit	14 years ago
William	85643fe780	Convert to logging perf stats to file by default. Add a few columns to output avg ticks per match, avg ticks non match, allow sorting on based on them.	14 years ago
Victor Julien	36917c7d66	Fix not using new htp callback when using the bundled htp. Add indication to --build-info. Fix valgrind warning in test and further improve test.	14 years ago
Anoop Saldanha	000ce98cd1	push all proto detection code into their respective app parser register functions for every alproto	15 years ago
Victor Julien	a0799f0ff9	Wait longer at shutdown before concluding it's taking too long. Hopefully enables our slow QA boxes to complete in time.	15 years ago
Victor Julien	cd75201dc7	Fix pfring commandline handling.	15 years ago
Victor Julien	5f2a0653b4	If engine shutdown (processing in-engine packets) times out, exit Suricata with EXIT_FAILURE.	15 years ago
Victor Julien	8978266a91	If shutdown doesn't complete processing all packets that are already in the engine within 30 seconds, force quit.	15 years ago
Victor Julien	5d2f633c48	Properly initialize pfring runmode before using it. Fix malformed conf api calls.	15 years ago
Anoop Saldanha	966119b6aa	support for http_raw_uri keyword + mpm engine	15 years ago
Anoop Saldanha	e4d890e186	modify runmode api to accept conf runmode paramter as a char string, instead of an interger id	15 years ago
Anoop Saldanha	229f7281ea	list runmodes. Allow specification of runmode id from cof file. Also allow for command line override	15 years ago
Anoop Saldanha	d7c707e656	modify runmodes to take all arguments from the conf API	15 years ago
Anoop Saldanha	a165d45da9	naming changes for runmodes	15 years ago
Anoop Saldanha	5c880b04c9	fix ipv4 defrag + fix recursion level in defrag pseudo packet	15 years ago
William Metcalf	023a0f94a2	first stab at pcap logging no rotating buff etc	15 years ago
Anoop Saldanha	013d3aea1c	update ssl parser test. Some minor indentation changes	15 years ago
Anoop Saldanha	4e8de99dcd	tls/ssl parser modifications/fixes. We now have just one file doing all the ssl parsing stuff, i.e. app-layer-tls.[ch], instead of app-layer-ssl.[ch] and app-layer-tls.[ch]	15 years ago
Victor Julien	07a85427dd	Add --build-info command line option to output some basic build settings.	15 years ago
Victor Julien	07776c113b	Fix valgrind error on pfring_recv, rename threads from RecvPfring to RxPfring so the name still looks right for 100+ threads. Add --pfring commandline option that just enables pfring, then takes interface from config.	15 years ago
Victor Julien	1c9e48ae98	Fix compilation error on non-pfring systems.	15 years ago
Victor Julien	91f28afef4	Add option to PF_RING to have multiple reader threads. Improve general performance of the PF_RING module.	15 years ago
Gurvinder Singh	7d0781b349	added support to log dropped packet as netfilter logs while in inline mode	15 years ago
Gurvinder Singh	8f8b1212af	support for ssl_version keyword	15 years ago