11275 Commits (d720ead470bcb5dd5a0c0ae7db302ab170205ee6)

Author	SHA1	Message	Date
Victor Julien	d2001ef94b	stream: improve gap tests	4 years ago
Victor Julien	96dfd65b96	eve: log max regions	4 years ago
Victor Julien	1bb6f44ff0	stream: flow timeout improvement ... Check continuous data for app-layer and post gap data as well for stream inspection.	4 years ago
Victor Julien	1dac2467c5	streaming: implement memory regions ... In TCP, large gaps in the data could lead to an extremely poor utilization of the streaming buffer memory. This was caused by the implementation using a single continues memory allocation from the "stream offset" to the current data. If a 100 byte segment was inserted for ISN + 20MiB, we would allocate 20MiB, even if only 100 bytes were actually used. This patch addresses the issue by implementing a list of memory regions. The StreamingBuffer structure holds a static "main" region, which can be extended in the form of a simple list of regions. [ main region ] [ gap ] [ aux region ] [ sbb ] [ sbb ] On insert, find the correct region and see if the new data fits. If it doesn't, see if we can expand the current region, or than we need to add a new region. If expanding the current region means we overlap or get too close to the next region, we merge them. On sliding, we free any regions that slide out of window and consolidate auxilary regions into main where needed. Bug: #4580.	4 years ago
Victor Julien	61e47ad6f5	stream: reduce streaming buffer internals use	4 years ago
Philippe Antoine	e22b59b8c1	fuzz: check libpcap timestamp consistency ... That is microseconds should be positive	4 years ago
Philippe Antoine	1c436fe0ca	fuzz: fix use of uninitialized value ... packet timestamp is not set when function returns error. also use C positive modulo for microseconds	4 years ago
Philippe Antoine	1660172a8b	ftp: completely resets port_line ... In the case port_line is first allocated and port_line_len is set, Then a second request reaches memcap and frees port_line, port_line_len should also be reset, because both will get used by the response parsing. Ticket: #5701	4 years ago
Victor Julien	b79c14f710	flow-worker: prune frames and stream for pseudo packets as well	4 years ago
Victor Julien	af211cbfad	debug: add pkt_src to detect/stream entry log	4 years ago
Victor Julien	ef2ed35311	stream: add debug statements	4 years ago
Victor Julien	db28d85d01	stream: consider any uninspected data	4 years ago
Victor Julien	1a35801f96	stream: minor constification	4 years ago
Victor Julien	989e5c7ba2	streaming/sbb: fix debug message	4 years ago
Victor Julien	a00db15bd4	stream: remove bug on from packet path	4 years ago
Victor Julien	ee6c39b985	output: improve debug format by adding function name	4 years ago
Victor Julien	41ca206fdf	src: fix deprecated-non-prototype compile warnings ... Tested on Fedora 37 with clang 15. util-strlcatu.c:45:8: error: a function definition without a prototype is deprecated in all versions of C and is not supported in C2x [-Werror,-Wdeprecated-non-prototype] size_t strlcat(dst, src, siz) ^ 1 error generated.	4 years ago
Victor Julien	1bc6976a06	src: fix unused-but-set-variable compile warnings ... Tested on Fedora 37 with clang 15. datasets.c:852:9: error: variable 'n' set but not used [-Werror,-Wunused-but-set-variable] int n = 0; ^ 1 error generated.	4 years ago
Victor Julien	ebd8728219	src: fix strict-prototype warnings ... Tested on Fedora 37 with clang 15. app-layer.c:1055:27: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] void AppLayerSetupCounters() ^ void app-layer.c:1176:29: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] void AppLayerDeSetupCounters() ^ void 2 errors generated.	4 years ago
Philippe Antoine	8c3107472b	detect/frames: fix crash when parsing bad rule ... Indexing of Signature::init_data::smlists would fail for a rule that used a frame and fast_pattern w/o content, as the array would only be expanded when adding a content. Adding a check to see if there list id is in bounds is an implicit check for the "no content" case. Ticket: #5530	4 years ago
Jason Ish	531c4336c9	logging: use ISO-like timestamp in file log ... Also update suricata.yaml to show this default, as updating the "default-log-format" does not affect the file output.	4 years ago
Jason Ish	bac8b8d26d	logging: add new date format: YYYY-MM-DD HH:MM:SS ... Adds a new logging format character, %z that uses a more standard time format of "YYYY-MM-DD HH:MM:SS". Ticket #5764	4 years ago
Philippe Antoine	9f21e2bcde	src: remove unneeded double colon ... git grep ';;' src/ | grep -v for | cut -d: -f1 | uniq | while read f; do sed -i -e 's/;;/;/' $f; done	4 years ago
Philippe Antoine	0dfaf2802f	test: remove one duplicate line	4 years ago
Philippe Antoine	27d2bce1a1	flow: complete stats for app_layer protocol counters ... In the case of a gap, or in the case of a flow where one side is recognized, but the other is not before the end, we still increase the counters to have consistency between jq 'select(.event_type=="flow" and .app_proto=="ftp") | .app_proto' log/eve.json | wc -l jq 'select(.event_type=="stats") | .stats."app_layer".flow.ftp' log/eve.json Ticket: #5769	4 years ago
Philippe Antoine	fff4475d91	stream: fix memory leak when failing to insert segment ... As introduced by commit f848e34bcc DoInsertSegment can now return `-EINVAL` and there was no generic handling of error values to return the tcp segment to its pool. Ticket: #5777	4 years ago
Jeff Lucovsky	e15c9451f2	log/stats: Ensure output exists for the stats thread ... Issue: 5198 This commit ensures that a log output destination exists for the stats thread.	4 years ago
Jeff Lucovsky	018ea2625f	log: Use hash table for slot maintenance ... Issue: 5198 This commit modifies the threaded logging support to use the hash table for handling thread/slot mappings. As a result, it's no longer necessary to provide the thread id when ensuring the log output exists.	4 years ago
Jeff Lucovsky	f06aabc32a	log: Add hash table for thread/slot mappings ... Issue: 5198 This commit adds a hash table to manage thread id to slot mappings. This ensures that each thread will have its own slot (file output device)	4 years ago
Jeff Lucovsky	dfcb429524	detect/cert: Use client side certs ... Issue: 5516 This commit modifies the detect logic to choose the certificate based on the flow direction -- to server or to client.	4 years ago
Victor Julien	23eeba3e35	app/protos: reformat string to proto	4 years ago
Victor Julien	4f6d388740	app-layer: check name vs proto mapping in registration	4 years ago
Victor Julien	0ff88c0315	netmap/runmode: minor code cleanup	4 years ago
Victor Julien	0e5af9e8a7	ioctl: output cleanups	4 years ago
Victor Julien	07008f0da2	netmap: output cleanups	4 years ago
Victor Julien	597601b294	dpdk: don't "fix" broken ips setting	4 years ago
Victor Julien	4e945351a5	dpdk: output cleanups	4 years ago
Victor Julien	7196257f68	nfq: minor error message improvement	4 years ago
Victor Julien	a4eefd16b7	output: add %M format option for the log message body ... If %M is not specified, it is automatically appended to the format string, to provide backwards compatibility.	4 years ago
Victor Julien	fa7760aa67	commandline: output cleanups	4 years ago
Victor Julien	da5fa24ab2	pcap: output cleanups	4 years ago
Victor Julien	1db4dc4fcb	output: default output format ... Add a separate default for file output.	4 years ago
Victor Julien	5b58be6076	output: remove unused log levels ... Critical, alert and emergency were unused, so remove.	4 years ago
Victor Julien	8a3c8984b4	output: print detect-engine as detect	4 years ago
Victor Julien	199e444498	output/capture: group source and runmode ... So outputs from runmode-af-packet and source-af-packet both will show 'af-packet' as the module.	4 years ago
Victor Julien	1b755653c0	output: add %D for compact log level	4 years ago
Jeff Lucovsky	2c9c18a9d0	log/json: Convert log output to use JsonBuilder ... This commit converts the file logging logic to use JsonBuilder instead of libjansson.	4 years ago
Jeff Lucovsky	3a37cf4507	log: Use SCCalloc instead of alloc/clear	4 years ago
Jeff Lucovsky	f8474344cd	log: Add module and subsystem identifiers to log ... Issue: 2497 This changeset provides subsystem and module identifiers in the log when the log format string contains "%S". By convention, the log format surrounds "%S" with brackets. The subsystem name is generally the same as the thread name. The module name is derived from the source code module name and usually consists of the first one or 2 segments of the name using the dash character as the segment delimiter.	4 years ago
Victor Julien	197aa010d6	unix-socket: minor output improvements	4 years ago
Victor Julien	381e9f2bdf	mpm/ac: remove dead code	4 years ago
Victor Julien	f33784bed3	mpm/ac: use FatalError instead of Critical and exit	4 years ago
Victor Julien	dcf2f6b2be	detect: more compact message on error	4 years ago
Victor Julien	8b846bdcff	af-packet: output cleanups and unification ... Make all messages use the same format: <iface>: <message>	4 years ago
Victor Julien	806104c09a	output: issue warning if file can't be opened	4 years ago
Victor Julien	79c84211d5	output: remove all custom errors	4 years ago
Victor Julien	b31ffde6f4	output: remove error codes from output	4 years ago
Victor Julien	39f5c7f56a	error: use SC_EINVAL for invalid input	4 years ago
Victor Julien	e855fa0fe7	error: remove unused alloc error code	4 years ago
Victor Julien	e042cd785e	error: use SC_ENOMEM for alloc errors	4 years ago
Victor Julien	d2c98c3281	logopenfile: errno style error handling	4 years ago
Victor Julien	1e36db9d0e	hashlist: use errno style error handling	4 years ago
Victor Julien	0efdab1f5a	membuffer: errno style error reporting	4 years ago
Victor Julien	8ef95c10a8	pool: use errno style error reporting	4 years ago
Victor Julien	e621416d80	error: bootstrap errno like error code approach	4 years ago
Victor Julien	cdd52dc8cd	detect/mpm: output cleanups	4 years ago
Victor Julien	cdac0425a8	device: special case handling of dpdk devices	4 years ago
Victor Julien	d84bcdfd5c	device: output tweak	4 years ago
Victor Julien	c78ebd1352	dpdk: set RSS flags for igb driver ... Tested on i340.	4 years ago
Victor Julien	b08e3e7460	dpdk: ips output cleanups	4 years ago
Victor Julien	70b69a3171	output: minor code cleanups	4 years ago
Victor Julien	10c26bb628	unix-socket: don't print unix socket message twice	4 years ago
Jeff Lucovsky	82158f92c1	general: Correct typos	4 years ago
Victor Julien	be895d67b6	runmodes: minor output cleanup	4 years ago
Victor Julien	cef0a84bd2	detect: turn cleanup message into debug message	4 years ago
Victor Julien	b76f6dfa42	device/mtu: clean up mtu message	4 years ago
Victor Julien	7ccfa9b9a6	device: cleanup stats print	4 years ago
Victor Julien	fd4e522038	runmode: log test mode later	4 years ago
Victor Julien	181400bfdd	pcap-file: output cleanups	4 years ago
Victor Julien	ef881c942b	af-packet: output cleanups	4 years ago
Victor Julien	393546af07	mpm/hs: turn cleanup messages in to debug	4 years ago
Victor Julien	892b7021b2	stream: debug message cleanup	4 years ago
Victor Julien	d973e1021c	threading: memset cpu_set_t to address cppcheck warning ... src/tm-threads.c:734:5: error: Uninitialized variable: cs [uninitvar] CPU_ZERO(&cs);	4 years ago
Victor Julien	58c28d1778	dpdk: fix cppcheck warnings ... src/runmode-dpdk.c:202:11: warning: Size of pointer 'argv' used instead of size of its data. This is likely to lead to a buffer overflow. You probably intend to write 'sizeof(*argv)'. [pointerSize] args->argv = SCCalloc(capacity, sizeof(args->argv)); ^ src/runmode-dpdk.c:777:23: error: Shifting 32-bit value by 63 bits is undefined behaviour [shiftTooManyBits] if (bits & (1 << i)) ^ src/runmode-dpdk.c:776:23: note: Assuming that condition 'i<64' is not redundant for (int i = 0; i < 64; i++) { ^ src/runmode-dpdk.c:777:23: note: Shift if (bits & (1 << i)) ^	4 years ago
Victor Julien	17cd41c887	frames: suppress cppcheck warning ... src/app-layer-frames.c:471:5: warning: Identical condition 'stream_slice->input==NULL', second condition is always false [identicalConditionAfterEarlyExit] BUG_ON(stream_slice->input == NULL); ^ src/app-layer-frames.c:468:29: note: If condition 'stream_slice->input==NULL' is true, the function will return/exit if (stream_slice->input == NULL) ^ src/app-layer-frames.c:471:5: note: Testing identical condition 'stream_slice->input==NULL' BUG_ON(stream_slice->input == NULL); ^ src/app-layer-frames.c:548:5: warning: Identical condition 'stream_slice->input==NULL', second condition is always false [identicalConditionAfterEarlyExit] BUG_ON(stream_slice->input == NULL); ^ src/app-layer-frames.c:545:29: note: If condition 'stream_slice->input==NULL' is true, the function will return/exit if (stream_slice->input == NULL) ^ src/app-layer-frames.c:548:5: note: Testing identical condition 'stream_slice->input==NULL' BUG_ON(stream_slice->input == NULL); ^	4 years ago
Victor Julien	16c19bd2f6	capture: remove unnecessary mtu check	4 years ago
Victor Julien	f45914cd99	classification: avoid duplicate errors	4 years ago
Victor Julien	7d46d4217f	unix-socket: avoid duplicate errors	4 years ago
Victor Julien	4dfb584164	dnp3: no error logging in packet path	4 years ago
Haleema Khan	05e87bf32e	detect-detection: Convert unittests to new FAIL/PASS API ... Ticket: #4019	4 years ago
Haleema Khan	6094aeee9e	detect-detection: Apply clang-format	4 years ago
Victor Julien	eb69902719	dpdk: NUMA output adjustments ... Reduce verbosity of the NUMA logs; switch them to start with the iface. Don't print the cpu number.	4 years ago
Haleema Khan	4a98c4bde6	detect/sigorder: Convert unittests to new FAIL/PASS API ... Ticket: #4029	4 years ago
Lukas Sismis	563f8bb56b	dpdk: decrease intensity of warnings related to NUMA placement ... Ticket: #5617	4 years ago
Victor Julien	991f9fde32	radix: fix ipv6 address parsing warning ... The check meant to see if the ip address part of the ip/cidr combo was more specific than needed wasn't fully implemented, leading to warnings being issued on completely valid and correct input. This patch implements the same logic as in IPv4. If the ip address as specified is different from the ip after the mask has been applied, a warning is displayed. Bug: #5747.	4 years ago
Bazzan Don	b289030696	detect-engine-tag: convert unittests to new FAIL/PASS API ... Ticket: #4030	4 years ago
Philippe Antoine	a58ffe5b3e	fuzz: do not use timestamps at the end of times ... so as not to have integer overflows	4 years ago
Philippe Antoine	190c945e67	ftp: disables debug assertion ... Ticket: #5443 Until we decide on the right way to fix this.	4 years ago
Philippe Antoine	4daee8bae1	quic: do not use stack for inspection buffer ... Make the inspection buffer copy the content in one buffer it owns. Ticket: #5707	4 years ago
Jason Ish	4a7567b3f0	template: rename template-rust to template ... Remove the distinction between the C template protocol "template" and the Rust template protocol "template-rust" and make the Rust parser simply template now that we no longer have support to generate a C protocol template.	4 years ago