11682 Commits (2696fda04168cb82bedc8920fb8a3cc7d55289de)

Author	SHA1	Message	Date
Victor Julien	2696fda041	detect: use explicit rule types ... Instead of using flags to indicate a rule type, use an explicit `type` field. This will make it more clean in code paths what paths a rule is taking, and will allow easier debugging as well as analyzer output. Define the following fields: - SIG_TYPE_IPONLY: sig meets IP-only criteria and is handled by the IP-only engine. - SIG_TYPE_PDONLY: sig inspects protocol detection results only. - SIG_TYPE_DEONLY: sig inspects decoder events only. - SIG_TYPE_PKT: sig is inspected per packet. - SIG_TYPE_PKT_STREAM: sig is inspected against either packet payload or stream payload. - SIG_TYPE_STREAM: sig is inspected against the reassembled stream - SIG_TYPE_APPLAYER: sig is inspected against an app-layer property, but not against a tx engine. - SIG_TYPE_APP_TX: sig is inspected the tx aware inspection engine(s). Ticket: #6085.	3 years ago
Victor Julien	f6f2c22574	detect/pcre: remove redundant applayer flag set	3 years ago
Victor Julien	681b4c3a23	detect: minor cleanup	3 years ago
Philippe Antoine	afef35b9dc	http: fix leak of normailzed uri ... if tx_ud == NULL, still need to free alloced normailzed uri	3 years ago
Victor Julien	ebe0a7bdc0	streaming: minor guards cleanup	3 years ago
Victor Julien	b401fe5259	streaming: fix region buf_offset update ... If region wasn't the first region, the buf_offset could get out of sync. Bug: #6041.	3 years ago
Victor Julien	facdbca95b	streaming: stricter validation check	3 years ago
Victor Julien	cf7cca4950	streaming: fix intersect detection ... Update logic to always use data right edge. Bug: #5834.	3 years ago
Philippe Antoine	5fb0b3b8cb	fuzz: make targets more resitant to allocation failures	3 years ago
Victor Julien	3247e39f0c	flowworker: simplify pseudo packet use ... Pseudo packets originating in the flow worker do not need to leave the flow worker. Putting those in the ThreadVars::decode_pq will make them be evaluated by the next steps in the pipeline, but those will all ignore pseudo packets. Instead, this patch returns them to the packet pool, while still honoring the IPS verdict logic.	4 years ago
Philippe Antoine	d47dba27bf	all: remove unused literals	4 years ago
Victor Julien	3e0d2ff29a	profiling/rules: minor fatal error cleanup	4 years ago
Victor Julien	ecc7ec3ea7	profiling/rules: add BUG_ON to profile tracking	4 years ago
Victor Julien	2423b2a483	profiling/rules: simplify return code handling	4 years ago
Victor Julien	835eaf7ccd	profiling/rules: minor code cleanup	4 years ago
Victor Julien	2596dc262b	profiling/rules: use atomics for rule flag	4 years ago
Victor Julien	b591813b86	profiling/rules: reduce sync logic scope ... Use a simple once a second scheme.	4 years ago
Eric Leblond	8b2313b0ae	profiling: socket command to control rules profiling ... This patch adds unix socket command to start and stop the collection of stats when running in rules profiling mode.	4 years ago
Eric Leblond	ea95e85755	profiling: set sample rate to power of 2 ... For the rules profiling, we really want to limit the performance impact to the maximum. So let's use an hash size that is a power of 2. This will allow to not use the modulo operation that is costly and simply use a single binary operator. This code is only active for rules profiling so we are backward compatible.	4 years ago
Eric Leblond	df88ef0249	profiling: let 'ruleset-profile' send message ... Let's send the profile output as an answer on the Unix socket.	4 years ago
Eric Leblond	75b46edd79	profiling: add 'ruleset-profile' unix command ... This patch adds a new unix command that allows the user to trigger a dump of the ruleset profile to the file without having to stop Suricata. This will be really useful to debug performance issue related to signatures in production environment.	4 years ago
Eric Leblond	020cfbcd61	profiling: introduce rules profiling ... Performance measurement of rules is important on live Suricata as bad rules can cause severe performance regression. This patch introduces the --enable-profiling-rules that activate profiling for the rules. This reduces the performance impact of full profiling and provide visiblity on the rules performance at the same time.	4 years ago
Philippe Antoine	656cddcf65	detect: http_client_body for HTTP2 ... By using the file.data logic Ticket: #4067	4 years ago
Philippe Antoine	6b32bc459b	detect: http.response_body for HTTP2 ... Already using the file.data logic Ticket: #4067	4 years ago
Philippe Antoine	5391f0a8a0	detect: http_response_line for HTTP2 ... Ticket: #4067 Synthetized as HTTP/2 <STAT>\r\n	4 years ago
Philippe Antoine	0dca8cc796	detect: http_request_line support for HTTP2 ... Ticket: #4067 Synthetized as <METHOD> <URI> HTTP/2\r\n	4 years ago
Philippe Antoine	22fb385e23	detect: http_stat_msg supported for HTTP2 ... By providing a constant empty buffer Ticket: #4067	4 years ago
Philippe Antoine	c00c345123	detect: support http.protocol for HTTP2 ... Ticket: #4067 By having a synthetic constant HTTP/2 buffer	4 years ago
Victor Julien	1c182de468	dpdk: support capture timeout support ... To not inject too many packets, simulate a 100ms timeout based on af-packet's 100ms poll() timeout. Bug: #6064.	4 years ago
Jeff Lucovsky	e75bacd19e	dataset: Address compile-time error ... This commit fixes an issue with using a `in_addr` when an IPv6 structure should be used.	4 years ago
Victor Julien	36f6e05155	counters: make tcp stats independent of flow, ssn ... Counters depended on availability of flow and tcp session, meaning that 2 memcaps could affect the counters. Bug: #5017.	4 years ago
Victor Julien	0360cb6542	stream: update no-flow checks	4 years ago
Lukas Sismis	f751c93cb8	dpdk: warn about processing segmented DPDK mbufs ... Segmented mbufs should never happen in Suricata. Mbuf segmentation divides the received packet into multiple mbufs. This can happen when MTU of the NIC is larger than the allocated mbufs in the mbuf mempool. As Suricata sets the size of the mbuf to be slightly higher than the configured MTU, mbuf segmentation should never happen in Suricata. This is especially true, if Suricata runs as a primary process and configures the packet source (NIC). Processing segmented mbufs can lead to missed/false (pattern-matching) detections as Suricata only inspects the first segment of the packet. It can also lead to segfault if Suricata moves the detection window out of the segment boundaries.	4 years ago
Lukas Sismis	d421d42411	dpdk: query device stats only with one worker ... Function rte_eth_stats_get is not thread-safe and the result is only used by one thread. Running with multiple workers led to very high values in rx_missed counters (buffer-overflow-like behavior). Ticket: #6006	4 years ago
Lukas Sismis	a331726eef	dpdk: update version checking to DPDK-intended version checking API ... Ticket: #5937	4 years ago
Lukas Sismis	b6f7693e86	dpdk: release mempool after the device is closed ... Ticket: #5936	4 years ago
Lukas Sismis	15a61f02a0	dpdk: fix multibit comparison ... Ticket: #5925	4 years ago
Lukas Sismis	95abe11a92	dpdk: fix DPDK API change on NUMA/socket retrieval ... Ticket: #5923	4 years ago
Victor Julien	fa3f16ec75	threading: wait for flow housekeeping at shutdown ... Flow house keeping can accumulate work that wasn't taken into account during shutdown. This could lead to flows still in the flowworker thread context when being it was freed, leading to missed work and memory leaks. This patch adds a new way of checking if a thread module is still busy. Bug: #6062.	4 years ago
Victor Julien	d333dffdcb	flowworker: flush local work queue on capture timeout ... Capture timeout means no packets have been received for some time, so this is a good time to flush out all work.	4 years ago
Victor Julien	55e32b2544	flowworker: rate limit flow queue processing ... Until this patch the logic the flow worker flow house keeping used was: - at most 2 flows are handled per packet - pseudo packets could flush the entire queue This patch changes that. Pseudo packets are fairly common, and can lead to packet stalls / latency spikes if the number of flows in the queue is large. It does that by adding a new packet type only used at shutdown, which flushes out the queues completely. All other packets will now stick to the 2 flow rate limit.	4 years ago
Scott Jordan	04d3584889	datasets: bugfix to load ip types from yaml	4 years ago
Victor Julien	9a4231d737	src: various comment spelling fixes ... Thanks to Josh Soref.	4 years ago
Victor Julien	8d016fe3ed	dpdk: minor output fixup ... Thanks to Josh Soref.	4 years ago
Victor Julien	197af37626	detect/parse: fix test spelling ... Thanks to Josh Soref.	4 years ago
Victor Julien	74f5d080e6	stream: fix test code spelling ... Thanks to Josh Soref.	4 years ago
Victor Julien	77862d503a	dpdk: fix variable spelling ... Thanks to Josh Soref.	4 years ago
Victor Julien	e3e0ff6edf	commandline: fix help output spelling ... Thanks to Josh Soref.	4 years ago
Victor Julien	9287320330	license: fixup file headers ... Thanks to Josh Soref.	4 years ago
Victor Julien	a6ccf63540	detect/csum: test cleanups	4 years ago