Commit Graph

6721 Commits (2f0e0f17dbb4f289f045ab38cf13dc2ef209a148)
 

Author SHA1 Message Date
Victor Julien 2f0e0f17db flow: move flow handling into worker threads
Instead of handling the packet update during flow lookup, handle
it in the stream/detect threads. This lowers the load of the
capture thread(s) in autofp mode.

The decoders now set a flag in the packet if the packet needs a
flow lookup. Then the workers will take care of this. The decoders
also already calculate the raw flow hash value. This is so that
this value can be used in flow balancing in autofp.

Because the flow lookup/creation is now done in the worker threads,
the flow balancing can no longer use the flow. It's not yet
available. Autofp load balancing uses raw hash values instead.

In the same line, move UDP AppLayer out of the DecodeUDP module,
and also into the stream/detect threads.

Handle TCP session reuse inside the flow engine itself. If a looked up
flow matches the packet, but is a TCP stream starter, check if the
ssn needs to be reused. If that is the case handle it within the
lookup function. Simplies the locking and removes potential race
conditions.
10 years ago
Victor Julien ae7aae81dc flow: get flow reference during lookup
Update Flow lookup functions to get a flow reference during lookup.

This reference is set under the FlowBucket lock.

This paves the way to not getting a flow lock during lookups.
10 years ago
Victor Julien a81766c046 detect: split detect entry into flow/noflow
This is a preparation for flow locking updates.
10 years ago
Mats Klepsland a13df67864 detect: add (mpm) keyword for tls_sni
Match on server name indication (SNI) extension in TLS using tls_sni
keyword, e.g:

alert tls any any -> any any (msg:"SNI test"; tls_sni;
        content:"example.com"; sid:12345;)
10 years ago
Jason Ish 3da79610af typo: SURCATA -> SURICATA 10 years ago
Jason Ish baf528e751 typos: surictsc -> suricatasc
Reported by Markus Lude on the mailing list.
10 years ago
Victor Julien b77d307272 ipv6: simplify ext hdr parsing 10 years ago
Victor Julien abb0a31aed defrag: work around packet creation issues
Defrag tests set up packets but don't call Decode on them. Work
around failing IPv6 tests.
10 years ago
Victor Julien 68c7fae79f ipv6: simplify ext hdr parsing and storage
This reduces size of the IPV6ExtHdr structure part of every packet
significantly.

Clean up macro's in the ipv6 header.
10 years ago
Victor Julien 64405ae194 detect-ipopts: optimize matching 10 years ago
Victor Julien 3ab7dfd988 detect-ipopts: cleanup 10 years ago
Victor Julien 6ea0db2f60 ipv4: removed unused variables 10 years ago
Victor Julien 8c37906cf9 ipv4: store ipopts as flags, not bools 10 years ago
Victor Julien be5a5df1f7 ipv4: shrink per packet ipopts storage 10 years ago
Victor Julien 8dc63f625f qa: update drmemory suppressions for hyperscan spm matching 10 years ago
Justin Viiret 91011b30a6 spm: add "spm-algo: auto" setting
This will default to Hyperscan when Suricata is built with Hyperscan
support. Otherwise, Boyer-Moore is used by default.
10 years ago
Justin Viiret 6a6d019245 spm: add Hyperscan implementation 10 years ago
Justin Viiret cce2d114e8 spm: add and use new SPM API
This new API allows for different SPM implementations, using a function
pointer table like that used for MPM.

This change also switches over the paths that make use of
DetectContentData (which previously used BoyerMoore directly) to the new
API.
10 years ago
Justin Viiret 7ba9dbe36a suricata.yaml: document spm-algo option 10 years ago
Justin Viiret ce408c4d10 spm: add SinglePatternMatchDefaultMatcher
Allows selecting SPM algorithm with the 'spm-algo' value in the YAML
config file.
10 years ago
Victor Julien d84dc02bd7 tcp sack: improve tests 10 years ago
Victor Julien fbf0a7aa45 detect app-layer-event: fix tests 10 years ago
Victor Julien 80716f860e app-layer: test fixes 10 years ago
Victor Julien 90414472ed thread storage: fix memset 0 after realloc
Thread storage expansion would not properly memset 0 the new part
of the memory.
10 years ago
Jason Ish 667e4e68bf configure.ac: escape $srcdir when used in a variable
$srcdir needs to be escaped for proper expansion when used
as part of a Makefile variable.
10 years ago
Mats Klepsland 45342078e4 tlsstore: fix memleak
Bug #1771.

Direct leak of 1834 byte(s) in 1 object(s) allocated from:
    #0 0x4e2e65 in realloc ??:?
    #1 0xcec27b in LogTlsLogPem /home/mats/suricata/src/log-tlsstore.c:130
    #2 0xcea4f5 in LogTlsStoreLogger /home/mats/suricata/src/log-tlsstore.c:303
    #3 0xd8b99c in OutputPacketLog /home/mats/suricata/src/output-packet.c:104
10 years ago
Mats Klepsland ed33f5f148 tlsstore: use TxLogger 10 years ago
Mats Klepsland 77cc03505b output: add new tx logger to log at certain condition
Some loggers needs certain conditions to be met before logging.
This enables us to use conditions on the tx logger.
10 years ago
Mats Klepsland 663273a31e tls: change flag checking in SSLParserTest23
Change flag checking in SSLParserTest23 to check each flag individually
to enable adding more flags without the test failing.
10 years ago
Mats Klepsland 47a4daeeb8 output: allow more than one TLS logger 10 years ago
Mats Klepsland e9074bc829 jsontls: use TxLogger 10 years ago
Mats Klepsland c6a61e009b tlslog: use TxLogger 10 years ago
Mats Klepsland 88bf866381 output-lua: use LuaTxLogger for TLS 10 years ago
Mats Klepsland fa6257b66a output: add new logger to log at specified state
Sometimes we want to log when we reach a specified state instead of
waiting for the session to end. E.g for TLS we want to log as soon
as the handshake is done.

To do this, a new logger is added, where it is possible to specify
a custom "ProgressCompletionStatus".
10 years ago
Mats Klepsland 4166ec3064 template: register logger functions 10 years ago
Mats Klepsland 593f81527a modbus: register logger functions 10 years ago
Mats Klepsland c52fe9a5fa http: register logger functions 10 years ago
Mats Klepsland d484812d05 smtp: register logger functions 10 years ago
Mats Klepsland dacb860d24 dns: register logger functions 10 years ago
Mats Klepsland 1f98915ebe tls: register logger functions 10 years ago
Mats Klepsland f3599323e4 tx: add functions for logging
Add function AppLayerParserRegisterLoggerFuncs for registering
a callback function for checking if a specific logger has logged
a transaction, and a callback function for specifying that it has.

Also add functions AppLayerParserGetTxLogged and
AppLayerParserSetTxLogged to invoke these callback functions.
10 years ago
Mats Klepsland c4b918b6c4 tx: do not store ProgressCompletionStatus per ipproto
Change AppLayerParserRegisterGetStateProgressCompletionStatus to
only store one ProgressCompletionStatus callback function for each
alproto, instead of storing one for each ipproto.

This enables us to use AppLayerParserGetStateProgressCompletionStatus
in functions where we do not know the ipproto used.
10 years ago
Mats Klepsland e4f03b18ba tls: make TX aware 10 years ago
Mats Klepsland a422ae9f3c tls-sni: fix alignment issues 10 years ago
Victor Julien 8dc477f85a sources: fix netmap compilation and pcap setup 10 years ago
Victor Julien be714a2f02 flow queue handler: use int16_t
Use int16_t instead of int to store the autofp queue id. We should
not easily get to 32k threads so 2 bytes per flow is sufficient.
10 years ago
Victor Julien ba64069b35 flow: remove unused debug code 10 years ago
Victor Julien 2c7cd1c22a flowint: redo tests 10 years ago
Victor Julien 3a36dea358 detect: add missing sigorder case 10 years ago
DIALLO David 271bd04539 modbus: fix AddressSanitizer error (segmentation fault)
In case of Mask Write register or Write single register request with
no data (malformed packet), app-layer-modbus checks response content
(data) with the none stored request content. That causes the segmentation
fault.

Before accessing to request content, app-layer-modbus checks now if
content has been previously stored. 4 unitests have been adding, 2 of them
to test the management of Mask Write register and Write single register requests,
and the 2 others to check invalid Mask Write register and Write single register
requests.
10 years ago