112 Commits (d2c46110d6055960730ceaa4efaeb14c3c97947d)

Author	SHA1	Message	Date
Jeff Lucovsky	d2c46110d6	pcap/bool: Use bool type for is_private	3 years ago
Jeff Lucovsky	310dcd1dc4	general: Use bool instead of int for condition fns ... This commit changes the conditional logging functions to use bool rather than int values.	3 years ago
Jason Ish	8511ef5e2d	pcap-log: close pcap_dead_handle on close ... Fixes leaked handle on exit.	3 years ago
Jason Ish	d2a5a55e0a	log-pcap: one time errors on file open ... If compression was not enabled, the open error was actually suppressed by default by only being logged at info level, however with compression it was logged as an error. As opening is retried as long as it fails to open, make both log as error but wrap in a flag so the error is logged once until success.	3 years ago
Jason Ish	bf589f0812	log-pcap: only open dumper after successful file open (lz4) ... When LZ4 compression is enabled, open the dumper after successful open of the file. The dump handle is what forms the check if opening the file needs to be retried. Ticket: #5022	3 years ago
Victor Julien	c53265bf0e	log: spelling	3 years ago
Victor Julien	0af599f5fa	log/pcap: work around scan-build fp ... log-pcap.c:1008:24: warning: Use of memory after it is freed [unix.Malloc] if (remove(pf->filename) != 0) { ^~~~~~~~~~~~ 1 warning generated.	3 years ago
Jason Ish	a0fc00bb48	log-pcap: fix inverse logic error ... We shouldn't early initialize when *offline*. Instead this accidentally delayed initializing when if an online mode, however its likely not to have been noticed as delaying initializing in online mode is supported as well.	4 years ago
Jason Ish	30a2cfa693	log-pcap: remove early output initializing if offline ... Remove early opening of output files if running in an offline mode, as we don't yet know the timestamp to use. Prevents the first pcap files being opened with a timestamp of 0, bringing us back to the same behvaviour of pcap logging in 6.0. Issue: 5374	4 years ago
Jason Ish	64c069f162	log-pcap: fix typo in multi-mode error message	4 years ago
Jason Ish	e4f85ecc2a	log-pcap: display mininum limit on error ... On fatal error due to limit being less than the allowed minimum, display the minimum value in bytes.	4 years ago
Jeff Lucovsky	31793aface	time: Replace struct timeval with scalar value ... Issue: 5718 This commit switches the majority of time handling to a new type -- SCTime_t -- which is a 64 bit container for time: - 44 bits -- seconds - 20 bits -- useconds	4 years ago
Victor Julien	b31ffde6f4	output: remove error codes from output	4 years ago
Victor Julien	e042cd785e	error: use SC_ENOMEM for alloc errors	4 years ago
Victor Julien	39cf5b151a	src: includes cleanup ... Work towards making `suricata-common.h` only introduce system headers and other things that are independent of complex internal Suricata data structures. Update files to compile after this. Remove special DPDK handling for strlcpy and strlcat, as this caused many compilation failures w/o including DPDK headers for all files. Remove packet macros from decode.h and move them into their own file, turn them into functions and rename them to match our function naming policy.	4 years ago
Philippe Antoine	c6d8daecd3	log: fix coverity warning ... CID 1515529 Checks ftell return value for negative/error	4 years ago
Victor Julien	e250ef6402	debug: remove empty header	4 years ago
Philippe Antoine	02f2602dde	src: rework includes as per cppclean	4 years ago
Victor Julien	ebf0629615	log-pcap: remove tunnel locks ... The tunnel lock mutex only "protects" the tunnel synchronization, not the packet data, length or datalink fields.	4 years ago
Victor Julien	419920288c	log/pcap: open handles outside of lock	4 years ago
Scott Jordan	c751c45850	log/pcap: add buffer timeout ... Set timeout for pcap log so that packets do not sit in buffer. Set default to one second.	4 years ago
Eric Leblond	47a5e6356d	log/pcap: handle case of multiple link types	4 years ago
Eric Leblond	584136ecb7	log/pcap: log segments for pseudo packets	4 years ago
Eric Leblond	8f0ef48e82	log/pcap: fix conditional pcap in tag mode ... We were missing the first packet when using condition pcap logging in tag mode as it was not tagged. As a result we were not getting the stream data triggering the alert in the pcap file.	4 years ago
Scott Jordan	6cfc3343e7	log/pcap: dump segments of both sides of tcp session. ... This patch updates tcp segment dumping to dump segments from both sides of the session in order when capturing alerts and tags.	4 years ago
Eric Leblond	faab853685	log/pcap and eve/alert: get pcap filename to support multi mode ... This patch adds a function to get the current pcap file name that will be used to current packet. This patch also updates EVE alerts to add pcap output filename when pcap capture is done in multi or normal mode.	4 years ago
Eric Leblond	2317fd83ef	log/pcap: fix typo in error message	4 years ago
Eric Leblond	0f14c55e52	log/pcap: update copyright date	4 years ago
Eric Leblond	58ef7bcdee	log/pcap: introduce tag as logging condition ... This patch adds the tag as logging condition. If this option is used all tagged packets are written to the pcap.	4 years ago
Eric Leblond	626fce0712	log/pcap: fix some indentation and white spaces	4 years ago
Eric Leblond	cc04eef007	log/pcap: add support for tunnel logging ... In alert mode, we need to write the root packet to the pcap file instead of the packet that did trigger the alert.	4 years ago
Eric Leblond	e7b1c52c1c	log/pcap: add existing stream logging ... This patch update the alert mode of pcap logging. It uses the packet header data added to the TCP segments to build packets corresponding to the acked data that did trigger the alert. It then write it to the pcap file before starting to dump all packet for the flow that did alert.	4 years ago
Eric Leblond	412ca5d64c	log/pcap: add PcapWrite function ... It will be used later when multiple writing operations will be necessary.	4 years ago
Eric Leblond	4cab5e5262	log/pcap: conditional logging ... Add an option to only write to pcap packets with alerts and flow that have alerted.	4 years ago
Victor Julien	3dfbf0bf11	log-pcap: remove redundant check ... Check is always true but confuses cppcheck: src/log-pcap.c:1224:32: warning: Either the condition 'filename' is redundant or there is possible null pointer dereference: filename. [nullPointerRedundantCheck] if ((pl->prefix = SCStrdup(filename)) == NULL) { ^ src/log-pcap.c:1421:9: note: Assuming that condition 'filename' is not redundant if (filename) { ^ src/log-pcap.c:1224:32: note: Null pointer dereference if ((pl->prefix = SCStrdup(filename)) == NULL) { ^ Bug: #5291.	4 years ago
Philippe Antoine	2a1690e110	pcre2: move header include to suricata-common only	5 years ago
Philippe Antoine	3633c48e6e	pcre2: migrate utility uses of pcre	5 years ago
Eric Leblond	921d44b262	log/pcap: exit on invalid filename ... If the filename has to % sign and if pcap logging is using multi mode, then the pcap capture will fail. So let's exit if ever this is the case.	6 years ago
Shivani Bhardwaj	6f7d8e50c8	src: use FatalError whenever possible ... Replaces all patterns of SCLogError() followed by exit() with FatalError(). Cocci script to do this: @@ constant C; constant char[] msg; @@ - SCLogError(C, + FatalError(SC_ERR_FATAL, msg); - exit(EXIT_FAILURE); Closes redmine ticket 3188.	6 years ago
Victor Julien	531ff3ddec	atomics: change SC_ATOMIC_ADD to 'fetch_add' ... Until this point the SC_ATOMIC_ADD macro pointed to a 'add_fetch' intrinsic. This patch changes it to a 'fetch_add'. There are 2 reasons for this: 1. C11 stdatomics.h has only 'atomic_fetch_add' and no 'add_fetch' So this patch prepares for adding support for C11 atomics. 2. It was not consistent with SC_ATOMIC_SUB, which did use 'fetch_sub' and not 'sub_fetch'. Most callers are not using the return value, so these are unaffected. The callers that do use the return value are updated.	6 years ago
Shivani Bhardwaj	0e4f261224	Use StringParse* for all parsers and configurations	6 years ago
Jason Ish	a2d91d9bf5	log-pcap: fix log message: unified2 -> pcap ... Likely a result of copy and pasted code.	7 years ago
Victor Julien	ab01cbe345	log-pcap: remove stale comments	7 years ago
Victor Julien	505b2dd256	log-pcap: don't print (null) for compression method	7 years ago
Max Fillinger	081fdc6804	pcap-log: Don't leak memory in LZ4 error paths	7 years ago
Victor Julien	00111499b0	log-pcap: fix coverity memleak warning	8 years ago
Victor Julien	d0a8310fcf	pcap-log: don't divide by 0 on no traffic	8 years ago
Max Fillinger	b85a0b188b	Add an option for compressing pcap-log files ... Introduces the option 'outputs.pcap-log.compression' which can be set to 'none' or 'lz4', plus options to set the compression level and to enable checksums. SCFmemopen is used to make pcap_dump() write to a buffer which is then compressed using liblz4.	8 years ago
Victor Julien	a5de9968dd	gcc8: fix format truncation warnings	8 years ago
Jason Ish	00e6cd4ced	output: introduce init return type ... The new OutputInitResult is a struct return type that allows logger init functions to return a NULL context without raising error. Instead of returning NULL to signal error, the "ok" field will be set to false. If ok, but the ctx is NULL, then silently move on to the next logger. Use case: multiple versions of a specific logger, and one implementation decides the configuration is not for that implemenation. It can return NULL, ok.	9 years ago