61 Commits (f10dd603ff42201ec931c33325327d1bdce00e18)

Author	SHA1	Message	Date
Ken Steele	9c7b411a5d	More PacketGetFromMalloc() to allocate packets.	12 years ago
Ken Steele	699d9e01f1	Move memset() out of PACKET_INITIALIZE() ... The memset() inside PACKET_INITIALIZE() is redundant in some cases and it is cleaner to do as part of the memory allocation. This simplifies changes for integrating Tilera mPIPE support because the size of memory cleared in that case is different from SIZE_OF_PACKET. For the cases where Packets are directly allocated and then call PACKET_INITIALIZE() without memset() first, this patch adds memset() calls. A further change would use GetPacketFromAlloc() directly.	12 years ago
Victor Julien	e30b1bfe64	Simple IP reputation implementation	13 years ago
Anoop Saldanha	b33986c887	Add a packet src for every packet generated inside suricata.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	7a044a99ee	Defrag engine ... Big rewrite of defrag engine to make it more scalable and fix some locking logic flaws. Now uses a hash of trackers similar to Flow and Host hashes.	13 years ago
Anoop Saldanha	a19a249230	Set the packet protocol only if it can parsed without error	14 years ago
Anoop Saldanha	87c2dae010	bug #403 - fix setting ip proto for packets	14 years ago
Eric Leblond	acf10525f6	doc: add decode group and related documentation.	14 years ago
Eric Leblond	4071d3cf57	PACKET_INITIALIZE is enough for packet init.	14 years ago
Eric Leblond	2be09b0c86	Fix Defrag unit test. ... This patch fixes the unittest for IPV4 defrag. The direct usage of the pkt pointer in the Packet structure is not allowed. This is fixed by using PacketCopyData function. This modification was requiring some other fixes, like using memcmp to compare data instead of an iteration on pkt pointer.	14 years ago
Eric Leblond	7425bf5ca6	Rename some decode event structure and macro. ... This patch renames DECODER_SET_EVENT, DECODER_ISSET_EVENT and some other structures to ENGINE equivalent to take into account the fact the event list is now related to all engines and not only to decoder.	14 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	14 years ago
Eric Leblond	6b9d1012ff	Transform inet_ntop call into PrintInet one.	14 years ago
Victor Julien	4025567a5a	Fix a number of unittests not properly initializing a packet causing issues on some archs.	14 years ago
Victor Julien	e1d4e16645	Simplify packet decoding macro's.	14 years ago
Victor Julien	54cd3552e1	Remove tunnel_proto field from Packet structure.	14 years ago
Victor Julien	6aa551c558	Small optimizations to IPV4 and TCP header parsing.	14 years ago
Victor Julien	6d766f91ef	Fix compiler warnings in defrag unittests.	15 years ago
Anoop Saldanha	5c880b04c9	fix ipv4 defrag + fix recursion level in defrag pseudo packet	15 years ago
Eric Leblond	8be92fdd99	SCTP support: add parsing of sctp ... This patch adds support of SCTP in all part of the code in charge of decoding packets.	15 years ago
Eric Leblond	1db4aadd16	Supress usage of Packet declaration in tests. ... For convenience, a massive usage of 'Packet p;' declaration has been done in the tests function. Although this was completely legal, this is not possible anymore because of the new Packet allocation structure. This massive patch modifies all suricata files to use a SCMalloc allocated pointer to Packet instead. This patch has been done using coccinelle (http://coccinelle.lip6.fr) which is a semantic patching tool. This ensures that things like call to SCFree() should have not been forget because the semantic patch explicitly forces the call to SCFree(p) before each return. With this patch all unittests are running fine with a small and a big default packet size.	15 years ago
Eric Leblond	dd038c1906	Modify files to avoid direct pckt payload access ... This patch implements the needed modification of payload access in a Packet structure to support the abstraction introduced by the extended data system.	15 years ago
Victor Julien	718fecb6fc	Better handle low memory conditions.	15 years ago
Victor Julien	4c3e17d4ab	Fix thresholding issues.	15 years ago
Victor Julien	e741bd0202	Cleanup packet recycling code. Fix issues in the packet tunnel/pseudo code.	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Pablo Rincon	943b4742a8	Moving inline functions to the .h files, so gcc can inline them correctly	15 years ago
Jason Ish	6b562f7aa6	Issue 82 - fragment counters. - number of fragments - number reassembled - number of timeouts	16 years ago
William Metcalf	8a64321340	raw pcap support additionl ipv4/6 validation	16 years ago
Jason Ish	6547725b39	consolidate more common code between ipv4 and ipv6.	16 years ago
Victor Julien	b7bac14040	Fixup code to compile with -Wall -Werror -Wextra -Wno-unused-parameter compiler options.	16 years ago
Victor Julien	ecf86f9c23	Rename to Suricata.	16 years ago
Anoop Saldanha	ceb7e495ae	refactoring perf stats code	16 years ago
Jason Ish	e0b9e85230	Break out checksum fixup code to make the license separation more clear.	16 years ago
Breno Silva	c43319c337	Regular expression for UnitTests ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	16 years ago
Victor Julien	968d8df12b	More logging API usage. Changed logging macro's slightly so the vars inside them won't conflict with vars used by the calling function.	16 years ago
Victor Julien	91bc83e5c6	More logging API usage changes.	16 years ago
Victor Julien	3a28171fbd	Another round of logging api usage updates.	16 years ago
Anoop Saldanha	22c0ec2bc5	Added support for the csum-<protocol> rules keyword to the detection engine. Keywords added are ipv4-csum, tcpv4-csum, tcpv6-csum, udpv4-csum, udpv6-csum, icmpv4-csum and icmpv6-csum	16 years ago
Anoop Saldanha	41dd0f8e62	checksum calculation functions for ipv4, tcp, udpv4, icmpv4	16 years ago
Victor Julien	855dc62e30	Git merge artifact.	16 years ago
Brian Rectanus	63d970eb0b	Fix compiler warning and add better ipv4 options debugging output.	16 years ago
Victor Julien	e7f8a02484	Improve GRE counting. Actually use the GRE decoder. Register the GRE counter.	16 years ago
Victor Julien	f5fe190b45	Fix a ipv4 compiler warning. Improve TCP opt decoding error handling logic.	16 years ago
Brian Rectanus	74cb73fc1d	Decode IPv4 options.	16 years ago
Victor Julien	57f71f7e4b	Pass the DecodeThreadVars to all Decoder functions properly. Improve the error handling.	16 years ago
Anoop Saldanha	244f5d547a	new registration functions for the stats api, with local thread storage for counter ids	16 years ago
Victor Julien	4ec31e0445	Fix short IPv4 packets not getting detected in the decoder. Set decode event on short ipv6 packets.	16 years ago
Brian Rectanus	fa5939ca91	64 bit cleanup part2	16 years ago