125 Commits (28ac86096ab520978a716fc917d36e85e44e8034)

Author	SHA1	Message	Date
Victor Julien	b9e5202f3c	Make fast.log use finer grained locking, move protocol lookup outside of the lock.	15 years ago
Victor Julien	b8e741de9e	Minor optimizations to unified2 and fast.log.	15 years ago
Victor Julien	28e15be526	Clean up default output. Use simpler output format for releases.	15 years ago
Victor Julien	aac2d91bcc	Set DROP flag for reject action so in addition to sending the rst, in IPS mode also drop the offending packet.	15 years ago
Mike Pomraning	dfec9c0f6a	Switch 'fast', 'http-log', 'drop' and 'alert-debug' to SCConfLogOpenGeneric.	15 years ago
Anoop Saldanha	7433d92dd2	undo this commit - ... commit eff08f93d8 Author: Anoop Saldanha <poonaatsoc@gmail.com> Date: Thu Nov 3 14:31:24 2011 +0530 update failing unittest to reflect the mpm design update Fixed a bug in the mpm code that would make all the changes in the commit just undone wrong.	15 years ago
Anoop Saldanha	eff08f93d8	update failing unittest to reflect the mpm design update	15 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	15 years ago
Anoop Saldanha	4307ea2348	Replace all frees with SCFrees	15 years ago
Eileen Donlon	89599d3b9b	fixed bug 288; corrected config boolean parsing problems	15 years ago
Anoop Saldanha	58b595cc21	fastlog print updates for ipv6. combine the io write	15 years ago
Anoop Saldanha	e8f9557664	fastlog print updates. combine the io write	15 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	15 years ago
Eric Leblond	6b9d1012ff	Transform inet_ntop call into PrintInet one.	15 years ago
Victor Julien	75439863ed	Shrink PacketAlerts structure so that Packet structure is a lot smaller. Reduce max events per packet from 256 to 15.	16 years ago
Victor Julien	cee615315f	Fix [drop] not being printed for IPv6 fast.log alerts.	16 years ago
Gurvinder Singh	7d0781b349	added support to log dropped packet as netfilter logs while in inline mode	16 years ago
Victor Julien	0f5b6a8bd7	Fix minor comment typo.	16 years ago
Eric Leblond	dd038c1906	Modify files to avoid direct pckt payload access ... This patch implements the needed modification of payload access in a Packet structure to support the abstraction introduced by the extended data system.	16 years ago
Victor Julien	d48ff8f6aa	Extend 'append' option to stats.log as well. Small cleanups.	16 years ago
Gurvinder Singh	f4392e1dcc	added support for appending the log files	16 years ago
Victor Julien	355f237bfd	Fix compiler warnings, cleanup counters config code.	16 years ago
Gurvinder Singh	ba18110abd	support for stats.log configurable and fixed timezone issue in faslog and debuglog	16 years ago
Gurvinder Singh	f2f0b54d25	removed xref from the alert-fastlog	16 years ago
Gurvinder Singh	3eab715153	support for printing protocol names for known protocol	16 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	16 years ago
Victor Julien	39cb1bdbda	Fix app layer sigs being recognized as decoder event only or ip only.	17 years ago
Victor Julien	d41b5645ef	Make sure decoder event rules are inspected even if the packet is invalid and has no addesses or proto. Update fast log and alert debug log to display the alerts. Fixes #179.	17 years ago
Victor Julien	4e7df60b2f	Make pcap file mode read multiple packets per 'read'. Update threading model to deal with this.	17 years ago
William Metcalf	2eef905c07	GPL and Copyright header updates.	17 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	17 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	17 years ago
Victor Julien	070ed778b8	Libcap-ng support by Gurvinder Singh and myself. Basic support for per thread caps is added, but not activated as it doesn't seem to work yet. Work around for incompatibility between libnet 1.1 and libcap-ng added.	17 years ago
William Metcalf	57a679be49	Small fix where a space was added before \n in fast-log if a xref wasn't used	17 years ago
Victor Julien	2dd28ea7fd	Use threadsafe time functions.	17 years ago
Victor Julien	eeb98c6900	Move SCSetThreadName to proper functions.	17 years ago
Gerardo Iglesias Galvan	9f35a24a1f	Set threads name. Fix bug #83	17 years ago
Victor Julien	fe7ece997a	Different approach to the reference keyword. Lots of cleanups, bug fixes in reference keyword code and tests.	17 years ago
Breno Silva	89baf93a40	Reference Support	17 years ago
Jason Ish	40f9653c06	Have output plugs use an OutputCtx which is a little more generic than LogFileCtx. The OutputCtx provides a place for module private data to avoi overriding the LogFileCtx.	17 years ago
Pablo Rincon	25a3a5c6d8	Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.	17 years ago
Anoop Saldanha	41e6735b92	mpm b2g cuda support added	17 years ago
Pablo Rincon	cef12d30b5	Unified output fixes: alert count per module (not per thread), fix timestamps on pcap mode, write *all* the alerts of a packet, write the log header once also on unified alert	17 years ago
Steve Grubb	f6653752c5	memory leak cleanup in alerts ... Hello, I ran the code through an analysis program and found several memory leaks in the alert code. *In src/alert-fastlog.c at line 178, aft was not being freed *In src/alert-debuglog.c at line 205, aftwas not being freed *In src/alert-unified-log.c at lines 234 and 243, aun was not being freed *In src/alert-unified-alert.c at lines 219 and 230, aun was not being freed *In src/alert-unified2-alert.c at line 505, aun was not being freed The patch below fixes this. -Steve	17 years ago
Jason Ish	095f2cf6ef	Consistency fix.. Xxxlog -> XxxLog.	17 years ago
Jason Ish	e204d07717	Have output modules register themselves so run mode configurator becomes aware of them for purposes of being configured from the config file.	17 years ago
Jason Ish	844c444af1	Use the configuration file to setup alert logging (and http logging). ... Only setup for the live pcap modes at the moment.	17 years ago
Anoop Saldanha	8189f4d88e	Change error log messags to debug ones in the log modules	17 years ago
Victor Julien	9e5f7459c2	Actually use classification msg	17 years ago
Victor Julien	ecab1fae36	Remove contents of VRT classification.config.	17 years ago
Anoop Saldanha	011b74df63	Modify the classification config tests to use the buffer than a temp file and also fix an invalid free	17 years ago
Anoop Saldanha	bc4df59414	Support for Classtype keyword and Classification Config file	17 years ago
Anoop Saldanha	4d430060d2	fix for unclear error messages bug 15	17 years ago
Victor Julien	ecf86f9c23	Rename to Suricata.	17 years ago
Pablo Rincon	e26833be3f	Changing mutex/spinlocks/conditions naming types	17 years ago
Pablo Rincon	769022f4be	Adding support for Mac OS X, FreeBSD, centrailizing mutex/spins/conditions in a macro API, and some unittests	17 years ago
Pablo Rincon	15855e11f3	Fixing alert unified log file rotation. Adding unittests	17 years ago
Gurvinder Singh	40b8afdd56	support for thread exit constants	17 years ago
Pablo Rincon Crespo	a84cc38bc9	Preparing multithreading support for alert modules and logfilectx	17 years ago
Victor Julien	bcc5bbef93	Yet more logging api usage changes.	17 years ago
Victor Julien	0d0ffb9963	Reorganize header inclusions.	17 years ago
Victor Julien	a39108843e	Small tm module API rename to reflect that Init/Deinit/ExitPrintStats are per thread calls.	17 years ago
Jason Ish	e3b538c7d7	Simple configuration API. ... Allow the log directory to be changed.	17 years ago
Brian Rectanus	fa5939ca91	64 bit cleanup part2	17 years ago
Victor Julien	7c36b315fd	Kill the engine if one of the threads fails to initialize.	17 years ago
Victor Julien	689bbfdc45	Rename all structure definitions in the "typedef struct _SomeStruct" format to "typedef struct SomeStruct_" to make the Doxygen output more useful. ... Remove the Trie multi pattern matcher code. It wasn't used anymore.	18 years ago
Victor Julien	51a9e36e10	Remove vips references. Rename to eidps.	18 years ago
Victor Julien	5df5b35e90	Put all globals in the detection engine ctx. Add HashList type, a hash that also stores the items ina list to it can be traversed. Many cleanups.	18 years ago
Victor Julien	4c4862d838	Improve logging, add alert-output module, at module exit stats, add HTTP POST uri capture.	18 years ago
Victor Julien	edf8650a7e	Tunnel update.	18 years ago
Victor Julien	f0ed41fb0a	Support priority keyword, add priority to alert-fastlog.	18 years ago
Victor Julien	9afa171d71	cosmetic update of alert-fastlog Will	18 years ago
Victor Julien	a7ee4c5b1b	Update todo of alert-fastlog	18 years ago
Victor Julien	6c1f2071be	Add unittest registration to the threading modules api.	18 years ago
Victor Julien	bab4b62376	Initial add of the files.	18 years ago