109 Commits (b763885d1b167ca3a1c8f0fe8a8e797e19dffafe)

Author	SHA1	Message	Date
Philippe Antoine	5597801ccb	perf: optimizes alert fast log ... In the case when we have multiple alerts for one packet We suppose this happens more often than having decoder_event != 0	7 years ago
Victor Julien	1cdb2182e4	fastlog: apply icmp type logic to icmpv6 too	7 years ago
Philippe Antoine	08b84e060b	fastlog: use icmp type and code instead of port ... Fixes #3266	7 years ago
Philippe Antoine	75a7d9641c	fastlog: move code to reduce variable scope	7 years ago
Jason Ish	00e6cd4ced	output: introduce init return type ... The new OutputInitResult is a struct return type that allows logger init functions to return a NULL context without raising error. Instead of returning NULL to signal error, the "ok" field will be set to false. If ok, but the ctx is NULL, then silently move on to the next logger. Use case: multiple versions of a specific logger, and one implementation decides the configuration is not for that implemenation. It can return NULL, ok.	9 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	10 years ago
Jason Ish	6585ac4a9f	logging: remove unused print stats callbacks ... Remove the ThreadExitPrintStats callback from logging modules that weren't doing anything with it.	10 years ago
Jason Ish	0c3f1e2974	logging: move lock into write function ... All loggers were wrapping just the write in a lock with some updating a counter. This moves the lock into the write function. The log_ctx alerts counter was also removed as many modules have stopped using this and the alert count is available elsewhere. Should satisfy Coverity CID 1400798: CID 1400798 (#1 of 1): Data race condition (MISSING_LOCK) 2. missing_lock: Accessing log_ctx->rotation_flag without holding lock LogFileCtx_.fp_mutex. Elsewhere, "LogFileCtx_.rotation_flag" is accessed with LogFileCtx_.fp_mutex held 4 out of 5 times. Which appears to be a false positive as all calls to SCLogFileWrite were done under lock, but this will make it more explicit.	10 years ago
Jason Ish	1b4ba4496c	logging: rename registration functions to not have tmm ... As the logging modules are no longer threading modules, rename them so they don't look like they are being registered as threading modules. Also, move the registration to the output.c which will handle registration of the loggers.	10 years ago
Jason Ish	fa27a76462	logging: add profiling back for non-tmm loggers ... The loggers moved away from a TMM required a new profiling support.	10 years ago
Jason Ish	b1200dba54	logging: convert fast log to a non-thread module	10 years ago
Victor Julien	b3bf7a5729	output: introduce config and perf output levels ... Goal is to reduce info output	11 years ago
maxtors	9d3fd82849	Removed duplicate include statements.	11 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	11 years ago
Jason Ish	b512580bbe	logging: integrate rotation into SCConfLogOpenGeneric. ... Addresses issue 1492, and will make it harder to omit rotation on new outputs.	11 years ago
Victor Julien	c0807c3df5	fast log: clean up tests	12 years ago
Victor Julien	393689ce44	classification: remove global from parsing ... Parsing code used a 'fd' global. Remove this.	12 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Jason Ish	fc2014ab40	Unregister for file rotation notification when a context is ... de-initialized. Required for unix-socket mode where contexts come and go.	13 years ago
Jason Ish	e1b97fed70	Add signal based file rotation for: ... - alert debug log - fast log - stats log - dns log - drop log - file log - http log - tls log - eve/json log	13 years ago
Victor Julien	96adcf6829	refactor IDS/IPS engine mode logic ... Instead of error phrone externs with macro's, use functions with a local static enum var instead. - EngineModeIsIPS(): in IPS mode - EngineModeIsIDS(): in IDS mode To set the modes: - EngineModeSetIDS(): IDS mode (default) - EngineModeSetIPS(): IPS mode Bug #1177.	13 years ago
Victor Julien	70efc66e33	fast-log: restore logging of Drop/wDrop ... Restore drop print logic. Probably got lost in large refactoring round introducing log APIs. Bug #1138.	13 years ago
Ken Steele	497575d38e	Add option on Tile-Gx for logging for fast.log alerts over PCIe ... When running on a TILEncore-Gx PCIe card, setting the filetype of fast.log to pcie, will open a connection over PCIe to a host application caleld tile-pcie-logd, that receives the alert strings and writes them to a file on the host. The file name to open is also passed over the PCIe link. This allows running Suricata on the TILEncore-Gx PCIe card, but have the alerts logged to the host system's file system efficiently. The PCIe API that is used is the Tilera Packet Queue (PQ) API which can access PCIe from User Space, thus avoiding system calls. Created util-logopenfile-tile.c and util-logopen-tile.h for the TILE specific PCIe logging functionality. Using Write() and Close() function pointers in LogFileCtx, which default to standard write and close for files and sockets, but are changed to PCIe write and close functions when a PCIe channel is openned for logging. Moved Logging contex out of tm-modules.h into util-logopenfile.h, where it makes more sense. This required including util-logopenfile.h into a couple of alert-*.c files, which previously were getting the definitions from tm-modules.h. The source and Makefile for tile-pcie-logd are added in contrib/tile-pcie-logd. By default, the file name for fast.log specified in suricata.yaml is used as the filename on the host. An optional argument to tile-pcie-logd, --prefix=, can be added to prepend the supplied file path. For example, is the file in suricata.yaml is specified as "/var/log/fast.log" and --prefix="/tmp", then the file will be written to "/tmp/var/log/fast.log". Check for TILERA_ROOT environment variable before building tile_pcie_logd Building tile_pcie_logd on x86 requires the Tilera MDE for its PCIe libraries and API header files. Configure now checs for TILERA_ROOT before enabling builing tile_pcie_logd in contrib/tile_pcie_logd	13 years ago
Ken Steele	2200dd61a1	Reduce time the file lock is held to write an alert to Fast.log ... Generate the alert string into a temporary buffer before aquiring the file lock. Only hold the file lock while writing the alert string to the file. In the case of multiple alerts, it would be better to generate all the alerts, then aquire the lock once and write them all and then flush. Changed PrintRawLineHexFp, which printed to a file, to PrintBufferRawLineHex, that puts the same output into a string buffer. It was only used by fast.log.	13 years ago
Ken Steele	235cd0211a	Alert file formatting clean up. ... Put { on new line for function declarations. Remove space after function name. Add static to unit tests delcaration.	13 years ago
Victor Julien	a3b0577a1f	output: add TM_FLAG_LOGAPI_TM thread module flag ... The TM_FLAG_LOGAPI_TM flag indicates that a module is run by the log api, not by the 'regular' thread module call functions. Set flag in all all Log API users' registration code. Purpose of this flag is in profiling. In profiling output it will be used to list log api thread modules separately.	13 years ago
Victor Julien	4049c2f74c	Packet logging API: convert unified2 ... Convert unified2 alert to new logging API.	13 years ago
Victor Julien	d43ac9ae98	Introduce packet logging output API ... This patch introduces a new API for outputs that log based on the packet, such as alert outputs. In converts fast-log to the new API. The API gets rid of the concept of each logger being a thread module, but instead there is one thread module that runs all packet loggers. Through the registration function OutputRegisterPacketModule a log module can register itself to be considered for each packet. Each logger registers itself to this new API with 2 functions and the OutputCtx object that was already used in the old implementation. The function pointers are: LogFunc: the log function ConditionFunc: this function is called before the LogFunc and only if this returns TRUE the LogFunc is called. For a simple alert logger like fast-log, the condition function will simply return TRUE if p->alerts.cnt > 0.	13 years ago
Ken Steele	68d26dcec7	Merge multiple copies of CreateTimeString() to one copy. ... There were 8 identical copies of CreateTimeString() in 8 files. Most used SCLocalTime, to replace localtime_r(), but some did not. Created one copy in util-time.c.	13 years ago
Anoop Saldanha	b787da5643	Remove all cuda related code in the engine except for the cuda api wrappers	14 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	14 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	14 years ago
Eric Leblond	a0e57f58e5	OpenBSD: introduce SCLocalTime function. ... This function is a wrapper to localtime_r. It is needed to avoid a compilation warning on OpenBSD. I'm forced to type the function to a non pointer first parameter. If not we will have to use two differents functions in OpenBSD where tv->tv_sec is a long (different from time_t).	15 years ago
Victor Julien	c682c5f1dd	Fix error in proto handling for ipv6 in fast.log.	15 years ago
Victor Julien	b9e5202f3c	Make fast.log use finer grained locking, move protocol lookup outside of the lock.	15 years ago
Victor Julien	b8e741de9e	Minor optimizations to unified2 and fast.log.	15 years ago
Victor Julien	28e15be526	Clean up default output. Use simpler output format for releases.	15 years ago
Victor Julien	aac2d91bcc	Set DROP flag for reject action so in addition to sending the rst, in IPS mode also drop the offending packet.	15 years ago
Mike Pomraning	dfec9c0f6a	Switch 'fast', 'http-log', 'drop' and 'alert-debug' to SCConfLogOpenGeneric.	15 years ago
Anoop Saldanha	7433d92dd2	undo this commit - ... commit eff08f93d8 Author: Anoop Saldanha <poonaatsoc@gmail.com> Date: Thu Nov 3 14:31:24 2011 +0530 update failing unittest to reflect the mpm design update Fixed a bug in the mpm code that would make all the changes in the commit just undone wrong.	15 years ago
Anoop Saldanha	eff08f93d8	update failing unittest to reflect the mpm design update	15 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	15 years ago
Anoop Saldanha	4307ea2348	Replace all frees with SCFrees	15 years ago
Eileen Donlon	89599d3b9b	fixed bug 288; corrected config boolean parsing problems	15 years ago
Anoop Saldanha	58b595cc21	fastlog print updates for ipv6. combine the io write	15 years ago
Anoop Saldanha	e8f9557664	fastlog print updates. combine the io write	15 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	15 years ago
Eric Leblond	6b9d1012ff	Transform inet_ntop call into PrintInet one.	15 years ago
Victor Julien	75439863ed	Shrink PacketAlerts structure so that Packet structure is a lot smaller. Reduce max events per packet from 256 to 15.	16 years ago
Victor Julien	cee615315f	Fix [drop] not being printed for IPv6 fast.log alerts.	16 years ago