aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
8,834 Commits
7 Branches
155 Tags
197 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '6c7aacce9e'
${ noResults }
Commit Graph

8834 Commits (6c7aacce9e4be2e884ab3034f496fcc770a78943)
 

Author SHA1 Message Date
Jesper Dangaard Brouer b93548d2ab ebpf: maintain a copy of kernel UAPI header file linux/bpf.h 7 years ago
Eric Leblond 027c903f50 ebpf: fix detection of llc 7 years ago
Eric Leblond 8c7b5cb088 doc: add info about xdp IPS bypass 7 years ago
Eric Leblond f04391031f af-packet: XDP bypass in IPS mode 
Implement XDP bypass in IPS mode by using XDP redirect to send
packets from bypassed flow directly to the transmission interface.
 7 years ago
Eric Leblond 7bec54158f flow-bypass: introduce update function 
Main objective of the function is to be able to bypass a flow on
other interfaces. This is necessary in AF_PACKET case as the flow
table are per interface.
 7 years ago
Eric Leblond bc34703c09 ebpf: add some comments to eBPF filter 7 years ago
Eric Leblond 0807dd6740 ebpf: slight bypass_filter optimization 7 years ago
Eric Leblond 2b56b02569 util-ebpf: simplify code cleaning 
Avoid to use an unnecessary callback strategy as the purpose of the
function using the callback is hardcoded.
 7 years ago
Eric Leblond 94a622cb55 af-packet: add comments to eBPF/XDP code 7 years ago
Eric Leblond 3379311e66 af-packet: fix error handling in bypass case 
If the key is already in the hash table then the bypass is
succesful.
 7 years ago
Eric Leblond e1515b48ad util-ebpf: fix libbpf error handling 7 years ago
Eric Leblond ce8b74b524 doc: document XDP CPU redirect 7 years ago
Eric Leblond 4f57008a23 af-packet: add support for XDP cpu redirect map 
This patch adds a boolean option "xdp-cpu-redirect" to af-packet
interface configuration. If set, then the XDP filter will load
balance the skb creation on specified CPUs instead of doing the
creation on the CPU handling the packet. In the case of a card
with asymetric hashing this will allow to avoid saturating the
single CPU handling the trafic.

The XDP filter must contains a set of map allowing load balancing.
This is the case of xdp_filter.bpf.

Fixed-by: Jesper Dangaard Brouer <netoptimizer@brouer.com>
 7 years ago
Eric Leblond 33072a49fe ebpf: import more recent version of helpers 7 years ago
Eric Leblond ac5957d461 util-affinity: export CPU set parsing function 7 years ago
Eric Leblond 2598078ee6 af-packet: code cleaning and comments 7 years ago
Eric Leblond cde438f670 af-packet: add missing copyright header 
And also fixes the copyright date in some files.
 7 years ago
Eric Leblond 3f3a206722 util-ebpf: add error handling in hash value fetch 7 years ago
Eric Leblond 60265e023a doc: update xdp documentation 
Also remove configuration info from yaml as they are now in the
documentation.
 7 years ago
Peter Manev 5ee44c877c doc: add XDP setup documentation 7 years ago
Eric Leblond 1e729f059f af-packet: improve xdp error handling 
Don't try to bypass the flow if the flow table is unknown.

Also continue after error message if ever XDP was not correctly
setup.
 7 years ago
Eric Leblond 126488f74d af-packet: add support for multi iface bypass 7 years ago
Eric Leblond 4474889667 util-device: change logic of registration 
Device storage requires the devices to be created after storage
is finalized so we need to first get the list of devices then
create them when the storage is finalized.

This patch introduces the LiveDeviceName structure that is a list
of device name used during registration.

Code uses LiveRegisterDeviceName for pre registration and keep
using the LiveRegisterDevice function for part of the code that
create the interface during the runmode creation.
 7 years ago
Eric Leblond 0998f37b78 util-device: add an iteration function 7 years ago
Eric Leblond 3ae714d354 device-storage: introduce feature 
The capture method may have to store data depending related to the
offloading so having a per interface storage via LiveDevice seems
interesting.
 7 years ago
Eric Leblond e2d31e1c57 flow-bypass: fix sleep strategy 7 years ago
Eric Leblond 7a0d53448d tm-threads: fix build warning in afl mode 7 years ago
Eric Leblond 9cb591aa6c af-packet: remove done fixme in XDP 7 years ago
Eric Leblond eff10fce10 af-packet: end of map factoring 7 years ago
Eric Leblond d65f45856c af-packet: cache map fd search 7 years ago
Eric Leblond 17a32bdaa0 af-packet: fix bypassing of IPv6 
Also misc fixes.
 7 years ago
Eric Leblond b937e1afef util-ebpf: fix ipv6 cleaning and add comments 7 years ago
Eric Leblond 60752d231c util-ebpf: fix XDP delete key 
The key was deleted twice so let's remove the local deletion.
 7 years ago
Eric Leblond 08eec0833e flow-bypass: add abstraction layer 
The flow bypass thread can now be used by any capture method that
register it timeout check function.
 7 years ago
Eric Leblond 43ecf0d78d util-ebpf: add call to remove memlock limit 
Without that, user has to use ulimit to be able to load the eBPF
file.
 7 years ago
Eric Leblond a229635792 ebpf: implement vlan filter 
Basic filter allowing only a list of VLANs.
 7 years ago
Eric Leblond 0654c31397 util-ebpf: suppress call on loop init 7 years ago
Eric Leblond 8c88087948 af-packet: implementation of XDP bypass 
This patch adds support for XDP bypass. It provides an XDP
filter that can be loaded to realize the bypass of flows.
 7 years ago
Eric Leblond 31c947b4d8 af-packet: use per CPU hash in bypass 
eBPF has a data type which is a per CPU array. By adding one element
to the array it is in fact added to all per CPU arrays in the kernel.
This allows to have a lockless structure in the kernel even when doing
counter update.

In userspace, we need to update the flow bypass code to fetch all
elements of the per CPU arrays.
 7 years ago
Eric Leblond 8640cc5dcf flow-bypass: only start thread on demand 7 years ago
Eric Leblond 06173267c6 af-packet: kernel bypass implementation 
This patch implements bypass capability for af-packet.

The filter only bypass TCP and UDP in IPv4 and IPv6. It don't
don't bypass IPv6 with extended headers.

This patch also introduces a bypassed flow manager that takes
care of timeouting the bypassed flows. It uses a 60 sec
timeout on flow. As they are supposed to be active we can
try that. If they are not active then we don't care to get them
back in Suricata.
 7 years ago
Eric Leblond 91e1256b01 af-packet: add support for eBPF cluster and filter 
This patch introduces the ebpf cluster mode. This mode is using
an extended BPF function that is loaded into the kernel and
provide the load balancing.

An example of cluster function is provided in the ebpf
subdirectory and provide ippair load balancing function.
This is a function which uses the same method as
the one used in autofp ippair to provide a symetrical
load balancing based on IP addresses.

A simple filter example allowing to drop IPv6 is added to the
source.

This patch also prepares the infrastructure to be able to load
and use map inside eBPF files. This will be used later for flow
bypass.
 7 years ago
Giuseppe Longo d2121945c9 doc: update file_data description 7 years ago
Giuseppe Longo 884e051671 detect-engine-hsbd: decompress swf files 
This checks if a buffer is a swf file and try
to decompress it, if decompression is enabled.
 7 years ago
Giuseppe Longo 7b23d30542 util-file-decompression: add swf decompression API 
This adds a new module that permits to decompress
swf file compressed with zlib or lzma algorithms.

The API that performs decompression will take a compressed
buffer and build a new decompressed buffer following the
FWS format which represents an uncompressed file.

The maximum buffer that can be created is up to 50mb.
 7 years ago
Giuseppe Longo 822faa08f8 detect: set events in inspection phase 
During the inspection phase actually is not possible to catch
an error if it occurs.
This patch permits to store events in the detection engine
such that we can match on events and catch them.
 7 years ago
Giuseppe Longo d0f92e2a56 app-layer-htp: add swf decompression settings 
This adds some settings needed to do swf file decompression
under libhtp section in suricata.yaml
 7 years ago
Giuseppe Longo b60065caec configure: check for zlib and liblzma 
This checks if zlib and libzma are installed on the system
in order to decompress swf files.
 7 years ago
Maurizio Abba 8354f62b19 signal: enable SIGUSR2 after Reload when delayed-detect 
Enable SIGUSR2 Handler after the first rule reload when delayed-detect
is enabled
 7 years ago
Eric Leblond 3c68a22092 suricatasc: implement autoreconnect 
Implement a basic autoreconnect support. It tries to reconnect once
when connection has been lost. If it fails, it discards the command
and try again to connect at next command.
 7 years ago