aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
4,755 Commits
7 Branches
155 Tags
192 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'f830cb8026'
${ noResults }
Commit Graph

4755 Commits (f830cb80268962300312826ee7bca3d34bb506ba)
 

Author SHA1 Message Date
Victor Julien f830cb8026 output: introduce concept of sub-modules 
To support the 'eve-log' idea, we need to be able to force all log
modules to be enabled by the master eve-log module, and need to be
able to make all logs go into a single file. This didn't fit the
API so far, so added the sub-module concept.

A sub-module is a regular module, that registers itself as a sub-
module of another module:

    OutputRegisterTxSubModule("eve-log", "JsonHttpLog", "http",
            OutputHttpLogInitSub, ALPROTO_HTTP, JsonHttpLogger);

The first argument is the name of the parent. The 4th argument is
the OutputCtx init function. It differs slightly from the non-sub
one. The different is that in addition to it's ConfNode, it gets
the OutputCtx from the parent. This way it can set the parents
LogFileCtx in it's own OutputCtx.

The runmode setup code will take care of all the extra setup. It's
possible to register a module both as a normal module and as a sub-
module, which can operate at the same time.

Only the TxLogger API is handled in this patch, the rest will be
updated later.
 11 years ago
Victor Julien 8c3e71559a dns-json: turn logger to tx api 
Convert Json DNS logger into a Tx Logger API logger.
 11 years ago
Victor Julien bc71a43e08 http-json: separate module using tx api 
Turn HTTP json logger into a Tx Logger API logger.
 11 years ago
Victor Julien 4874d5abbb Various compile fixes after rebase with master 11 years ago
Tom DeCanio 18458a14fb json: rebase fixes 
- restore json output-file.[ch] as output-json-file.[ch] after rebase conflict
- fix Makefile.am after merge conflict
- some dev-log-api-v4.0 rebase json fallout cleanup
 11 years ago
Tom DeCanio 6fd1b31c57 Remaining JSON output pull request comment edits 11 years ago
Tom DeCanio a3d86594dc address most initial JSON pull request comments 11 years ago
Tom DeCanio 55df2d5cdb add "united" drop JSON log 11 years ago
Tom DeCanio 0c067646a8 Add "united" JSON files output 11 years ago
Tom DeCanio 730ee3d721 First cut at "united" file log output in JSON 11 years ago
Tom DeCanio 88a04742c0 JSON output cleanup 11 years ago
Tom DeCanio b4ac0d90a4 remove unused http JSON code 11 years ago
Tom DeCanio a12fa7c4e1 more output JSON cleanup 11 years ago
Tom DeCanio 6974817f72 remove dead JSON DNS output code 11 years ago
Tom DeCanio a44b2b987b JSON output cleanup 11 years ago
Tom DeCanio 3241732e27 rename alert-json.[ch] output-json.[ch] 11 years ago
Tom DeCanio 3bc95c9258 fix compile errors w/o libjansson 11 years ago
Tom DeCanio 8adbc741ba remove unused JSON TMM_*JSON enumerations 11 years ago
Tom DeCanio 07d3b38d3b Add support for JSON output to syslog/unix_stream/unix_dgram 11 years ago
Tom DeCanio 1dd6d7a104 Add "united" log to suricata.yaml.in 11 years ago
Tom DeCanio 6c1de2115c JSON output cleanup 11 years ago
Tom DeCanio c654b63f6a add united TLS JSON logging 11 years ago
Tom DeCanio 51b7cf1491 add ICMP type and code support to JSON log 11 years ago
Tom DeCanio c8beb9bf9d Support for configuration of JSON http output module 11 years ago
Tom DeCanio 8c95b085c5 Add vlan and pcap_cnt to JSON logs 11 years ago
Tom DeCanio ce6b07b1b9 First cut at united .yaml configuration 11 years ago
Tom DeCanio 11f84d4ff7 beginning of JSON config alignment 11 years ago
Tom DeCanio 280e4bcb61 move some JSON alert work outside of lock 11 years ago
Tom DeCanio 34d04c3104 JSON cleanup 11 years ago
Tom DeCanio 0df6af3a0b Alert/HTTP/DNS JSON output working with Logstash 11 years ago
Tom DeCanio 5543b6eef4 nested json alert output 11 years ago
Tom DeCanio b94b8e03bd cleanup fallout from upstream merge with alert json work 11 years ago
Tom DeCanio 07571367d3 Change JSON alert syslog level to INFO 11 years ago
Tom DeCanio 860523f5bc fix NULL string into JSON in alert-json 11 years ago
Tom DeCanio e9b192fcc0 change srcport->sp dstport->dp 11 years ago
Tom DeCanio 5498654114 Add JSON formatted alert output 11 years ago
Victor Julien 7450f32351 stream: add performance output for stream pools 
Add info messages at shutdown that give an indication of pool use
for the various segment and chunk pools.
 11 years ago
Victor Julien 84696ebe2a stream: configurable stream chunk prealloc 
The stream chunk pool contains preallocating stream chunks (StreamMsg).
These are used for raw reassembly, used in raw content inspection by
the detection engine. The default setting so far has been 250, which
was hardcoded. This meant that in setups that needed more, allocs and
frees would be happen constantly.

This patch introduces a yaml option to set the 'prealloc' value in the
pool. The default is still 250.

stream.reassembly.chunk-prealloc

Related to feature #1093.
 11 years ago
Victor Julien fe1c4951f9 stream: silence stream.reassembly.raw message 11 years ago
Victor Julien b5f8f386a3 stream: configurable segment pools 
The stream reassembly engine uses a set of pools in which preallocated
segments are stored. There are various pools each with different packet
sizes. The goal is to lower memory presure. Until now, these pools were
hardcoded.

This patch introduces the ability to configure them fully from the yaml.
There can be at max 256 of these pools.

Yaml layout is as follows:

stream:
  reassemble:
    segments:
      - size: 2048
        prealloc: 3000
      - size: 4
        prealloc: 1000
      - size: 1024
        prealloc: 2000

The size is the packet size. The prealloc value indicates how many
segments are set up at startup.

The pools have no limit wrt how many segments can be used of a certain
size. If the engine needs more than the prealloc size, segments are
malloc'd and free'd. The only limit here is the stream.reassemble.memcap.

If the yaml part if omitted, the default values are the same as before.

Feature #1093
 11 years ago
Victor Julien b27d03e2f9 log-filestore: convert to FiledataLog API 
This patch converts the log-filestore module to use the new
FiledataLog API.
 11 years ago
Victor Julien 9ff6608668 Introduce Filedata Logger API 
A new logger API for registering file storage handlers. Where the
FileLog handler is called once per file, this handler will be called
for each data chunk so that storing the entire file is possible.

The logger call in the API is as follows:
    typedef int (*FiledataLogger)(ThreadVars *, void *thread_data,
        const Packet *, const File *, const FileData *, uint8_t flags);

All data is const, thus should be read only. The final flags field
is used to indicate to the caller that the file is new, or if it's
being closed.

Files use an internal unique id 'file_id' which can be used by the
loggers to create unique file names. This id can use the 'waldo'
feature of the log-filestore module. This patch moves that waldo
loading and storing logic to this API's implementation. A new
configuration directive 'file-store-waldo: <filename>' is added,
but the existing waldo settings will also continue to work.
 11 years ago
Victor Julien b31e0abffe log-filestore: cleanups 
Remove unused code.
Make functions static.
Move registration to the bottom.
 11 years ago
Victor Julien 3e33ab4f83 log-filestore: tag truncated files as such 
Tag truncated files as truncated in the same way log-file does.
 11 years ago
Victor Julien 38249398a3 tx-logger: speed up 
By bailing out early in case no logger is enabled for the protocol,
a significant speed up is reached.
 11 years ago
Victor Julien 078ff0c0cc app-layer: add logger check to API 
The new API call:
    int AppLayerParserProtocolHasLogger(uint8_t ipproto,
                                        AppProto alproto)

Returns TRUE if a logger is registered on the ip/alproto pair, and
FALSE otherwise.
 11 years ago
Victor Julien 4c024f9658 profiling: add logger api labels 11 years ago
Victor Julien 0e8ad126d7 log-file: convert to file-logger API 
Use file logger API.

Also, check if the protocol is HTTP before getting the HTTP
fields.
 11 years ago
Victor Julien ee2a8a9cda Introduce 'file' logging API 
This patch introduces a new logging API for logging extracted file info.
It allows for registration of a callback that is called once per file:
when it's considered 'closed'.

Users of this API register their Log Function through:
    OutputRegisterFileModule()

The API uses a magic settings globally. This might be changed later.
 11 years ago
Victor Julien cef2eb01c5 log-file: cleanups 
Make all functions static.
Move registration to the bottom.
 11 years ago