]>
git.ipfire.org Git - thirdparty/suricata.git/log
Lukas Sismis [Mon, 24 Apr 2023 16:04:42 +0000 (18:04 +0200)]
dpdk: warn about processing segmented DPDK mbufs
Segmented mbufs should never happen in Suricata.
Mbuf segmentation divides the received packet into multiple
mbufs. This can happen when MTU of the NIC is larger than
the allocated mbufs in the mbuf mempool. As Suricata sets the size
of the mbuf to be slightly higher than the configured MTU, mbuf
segmentation should never happen in Suricata. This is especially
true, if Suricata runs as a primary process and configures the
packet source (NIC).
Processing segmented mbufs can lead to missed/false
(pattern-matching) detections as Suricata only inspects the first
segment of the packet. It can also lead to segfault if Suricata
moves the detection window out of the segment boundaries.
Lukas Sismis [Tue, 18 Apr 2023 11:50:28 +0000 (13:50 +0200)]
dpdk: query device stats only with one worker
Function rte_eth_stats_get is not thread-safe and
the result is only used by one thread.
Running with multiple workers led to very high values in rx_missed
counters (buffer-overflow-like behavior).
Ticket: #6006
Lukas Sismis [Thu, 4 May 2023 14:57:29 +0000 (16:57 +0200)]
docs: refactor DPDK docs and add performance tuning section
Ticket: #5857
Ticket: #5858
Lukas Sismis [Thu, 4 May 2023 14:05:50 +0000 (16:05 +0200)]
docs: wrap DPDK doc section at 80 chars
Lukas Sismis [Mon, 27 Mar 2023 13:05:01 +0000 (15:05 +0200)]
dpdk: add configure option
Ticket: #5859
Lukas Sismis [Thu, 23 Mar 2023 14:47:18 +0000 (15:47 +0100)]
dpdk: update version checking to DPDK-intended version checking API
Ticket: #5937
Lukas Sismis [Thu, 23 Mar 2023 12:48:03 +0000 (13:48 +0100)]
dpdk: release mempool after the device is closed
Ticket: #5936
Lukas Sismis [Wed, 22 Mar 2023 17:54:35 +0000 (18:54 +0100)]
dpdk: fix multibit comparison
Ticket: #5925
Lukas Sismis [Tue, 21 Mar 2023 09:22:33 +0000 (10:22 +0100)]
dpdk: fix DPDK API change on NUMA/socket retrieval
Ticket: #5923
Thomas Norheim [Fri, 3 Sep 2021 09:21:45 +0000 (11:21 +0200)]
threshold: fixed example rules to match description
Victor Julien [Tue, 9 May 2023 13:54:02 +0000 (15:54 +0200)]
threading: wait for flow housekeeping at shutdown
Flow house keeping can accumulate work that wasn't taken into account
during shutdown. This could lead to flows still in the flowworker
thread context when being it was freed, leading to missed work and
memory leaks.
This patch adds a new way of checking if a thread module is still
busy.
Bug: #6062.
Victor Julien [Wed, 10 May 2023 05:02:27 +0000 (07:02 +0200)]
flowworker: flush local work queue on capture timeout
Capture timeout means no packets have been received for some
time, so this is a good time to flush out all work.
Victor Julien [Tue, 9 May 2023 12:56:33 +0000 (14:56 +0200)]
flowworker: rate limit flow queue processing
Until this patch the logic the flow worker flow house keeping used was:
- at most 2 flows are handled per packet
- pseudo packets could flush the entire queue
This patch changes that. Pseudo packets are fairly common, and can lead
to packet stalls / latency spikes if the number of flows in the queue
is large.
It does that by adding a new packet type only used at shutdown, which
flushes out the queues completely. All other packets will now stick
to the 2 flow rate limit.
Scott Jordan [Tue, 9 May 2023 20:38:55 +0000 (16:38 -0400)]
datasets: bugfix to load ip types from yaml
Victor Julien [Mon, 8 May 2023 09:56:38 +0000 (11:56 +0200)]
src: various comment spelling fixes
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:56:11 +0000 (11:56 +0200)]
dpdk: minor output fixup
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:48:03 +0000 (11:48 +0200)]
detect/parse: fix test spelling
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:47:09 +0000 (11:47 +0200)]
stream: fix test code spelling
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:45:30 +0000 (11:45 +0200)]
dpdk: fix variable spelling
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:44:10 +0000 (11:44 +0200)]
scripts: fix bundle script spelling
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:42:53 +0000 (11:42 +0200)]
rust: spelling fixes
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:41:47 +0000 (11:41 +0200)]
commandline: fix help output spelling
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:40:53 +0000 (11:40 +0200)]
snmp: fix spelling
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:38:05 +0000 (11:38 +0200)]
license: fixup file headers
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:36:21 +0000 (11:36 +0200)]
doc: spelling
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:35:56 +0000 (11:35 +0200)]
changelog: spelling
Thanks to Josh Soref.
Victor Julien [Mon, 8 May 2023 09:16:24 +0000 (11:16 +0200)]
detect/csum: test cleanups
Victor Julien [Mon, 8 May 2023 09:09:34 +0000 (11:09 +0200)]
detect/content: test cleanups
Victor Julien [Sun, 7 May 2023 06:17:31 +0000 (08:17 +0200)]
windivert: compile fixes
Victor Julien [Sun, 7 May 2023 05:42:13 +0000 (07:42 +0200)]
github-ci: add windivert build
Eric Leblond [Tue, 30 Aug 2022 12:10:53 +0000 (14:10 +0200)]
output: target keys have port
Update JSON schema to support signature with target keyword
Philippe Antoine [Fri, 5 May 2023 15:00:11 +0000 (17:00 +0200)]
doc: explain where tls.store stores certificates
By adding a reference/link to the doc about the suricata.yaml
config section pecifying the directory where the certificates
are stored
Victor Julien [Sat, 6 May 2023 05:22:48 +0000 (07:22 +0200)]
util/rule-vars: spelling
Victor Julien [Sat, 6 May 2023 05:22:21 +0000 (07:22 +0200)]
common: spelling
Victor Julien [Sat, 6 May 2023 05:21:48 +0000 (07:21 +0200)]
threshold: spelling
Victor Julien [Sat, 6 May 2023 05:21:33 +0000 (07:21 +0200)]
debug: spelling
Victor Julien [Sat, 6 May 2023 05:20:12 +0000 (07:20 +0200)]
redis: spelling
Victor Julien [Sat, 6 May 2023 05:19:43 +0000 (07:19 +0200)]
mime: spelling
Victor Julien [Sat, 6 May 2023 05:19:28 +0000 (07:19 +0200)]
unix-socket: spelling
Victor Julien [Sat, 6 May 2023 05:19:08 +0000 (07:19 +0200)]
reputation: spelling
Victor Julien [Sat, 6 May 2023 05:18:51 +0000 (07:18 +0200)]
ippair: spelling
Victor Julien [Sat, 6 May 2023 05:18:40 +0000 (07:18 +0200)]
host: spelling
Victor Julien [Sat, 6 May 2023 05:18:27 +0000 (07:18 +0200)]
stats: spelling
Victor Julien [Sat, 6 May 2023 05:18:08 +0000 (07:18 +0200)]
radix: spelling
Victor Julien [Sat, 6 May 2023 05:17:51 +0000 (07:17 +0200)]
hash: spelling
Victor Julien [Sat, 6 May 2023 05:17:21 +0000 (07:17 +0200)]
file: spelling
Victor Julien [Sat, 6 May 2023 05:16:46 +0000 (07:16 +0200)]
profiling: spelling
Victor Julien [Sat, 6 May 2023 05:15:52 +0000 (07:15 +0200)]
unittests: spelling
Victor Julien [Sat, 6 May 2023 05:14:30 +0000 (07:14 +0200)]
reference: spelling
Victor Julien [Sat, 6 May 2023 05:13:23 +0000 (07:13 +0200)]
classification: spelling
Victor Julien [Sat, 6 May 2023 05:12:52 +0000 (07:12 +0200)]
util/lua: spelling
Victor Julien [Sat, 6 May 2023 05:08:25 +0000 (07:08 +0200)]
hash/lookup3: spelling
Victor Julien [Sat, 6 May 2023 05:07:37 +0000 (07:07 +0200)]
util/misc: spelling
Victor Julien [Sat, 6 May 2023 05:00:22 +0000 (07:00 +0200)]
queue: spelling
Victor Julien [Sat, 6 May 2023 04:59:14 +0000 (06:59 +0200)]
runmodes: spelling
Victor Julien [Sat, 6 May 2023 04:58:36 +0000 (06:58 +0200)]
conf: spelling
Victor Julien [Sat, 6 May 2023 04:58:16 +0000 (06:58 +0200)]
stream: spelling
Victor Julien [Sat, 6 May 2023 04:57:42 +0000 (06:57 +0200)]
threading: spelling
Victor Julien [Sat, 6 May 2023 05:28:00 +0000 (07:28 +0200)]
fuzz: spelling
Victor Julien [Sat, 6 May 2023 04:55:58 +0000 (06:55 +0200)]
tests: spelling
Victor Julien [Sat, 6 May 2023 04:55:19 +0000 (06:55 +0200)]
eve: spelling
Victor Julien [Sat, 6 May 2023 04:55:03 +0000 (06:55 +0200)]
output: spelling
Victor Julien [Sat, 6 May 2023 04:54:32 +0000 (06:54 +0200)]
log: spelling
Victor Julien [Sat, 6 May 2023 04:53:20 +0000 (06:53 +0200)]
flow: spelling
Victor Julien [Fri, 5 May 2023 19:11:20 +0000 (21:11 +0200)]
capture: spelling
Victor Julien [Sat, 6 May 2023 06:29:38 +0000 (08:29 +0200)]
detect: spelling
Victor Julien [Fri, 5 May 2023 18:46:05 +0000 (20:46 +0200)]
defrag: spelling
Victor Julien [Fri, 5 May 2023 18:45:48 +0000 (20:45 +0200)]
decode: spelling
Victor Julien [Sat, 6 May 2023 06:51:41 +0000 (08:51 +0200)]
app-layer: spelling
Victor Julien [Fri, 5 May 2023 18:44:14 +0000 (20:44 +0200)]
output/alert: spelling
Victor Julien [Fri, 5 May 2023 18:41:17 +0000 (20:41 +0200)]
scripts: spelling
Victor Julien [Fri, 5 May 2023 18:40:54 +0000 (20:40 +0200)]
rust: spelling
Victor Julien [Fri, 5 May 2023 18:39:56 +0000 (20:39 +0200)]
mpm/spm: spelling
Victor Julien [Fri, 5 May 2023 18:39:05 +0000 (20:39 +0200)]
yaml: spelling
Victor Julien [Fri, 5 May 2023 18:37:48 +0000 (20:37 +0200)]
rules: spelling
Victor Julien [Fri, 5 May 2023 18:37:26 +0000 (20:37 +0200)]
qa: spelling
Victor Julien [Fri, 5 May 2023 18:35:15 +0000 (20:35 +0200)]
lua: spelling
Victor Julien [Fri, 5 May 2023 18:34:55 +0000 (20:34 +0200)]
eve/schema: spelling
Victor Julien [Fri, 5 May 2023 18:30:35 +0000 (20:30 +0200)]
ebpf: spelling
Victor Julien [Fri, 5 May 2023 18:29:54 +0000 (20:29 +0200)]
doxygen: spelling
Victor Julien [Fri, 5 May 2023 18:29:40 +0000 (20:29 +0200)]
doc/userguide: spelling
Victor Julien [Fri, 5 May 2023 18:28:12 +0000 (20:28 +0200)]
doc/readme: spelling
Victor Julien [Sat, 6 May 2023 05:26:11 +0000 (07:26 +0200)]
configure: spelling
Victor Julien [Fri, 5 May 2023 18:26:54 +0000 (20:26 +0200)]
changelog: spelling
Victor Julien [Fri, 5 May 2023 18:17:09 +0000 (20:17 +0200)]
github-ci: spelling
Victor Julien [Sat, 6 May 2023 06:50:58 +0000 (08:50 +0200)]
ftp: rename enum to fix spelling
Victor Julien [Sat, 6 May 2023 06:50:17 +0000 (08:50 +0200)]
enip: rename struct to fix spelling
Victor Julien [Sat, 6 May 2023 06:49:35 +0000 (08:49 +0200)]
dnp3: rename flag to fix spelling
Victor Julien [Sat, 6 May 2023 05:56:55 +0000 (07:56 +0200)]
classification: spelling
Victor Julien [Sat, 6 May 2023 05:14:01 +0000 (07:14 +0200)]
exception/policy: spelling
Victor Julien [Sat, 6 May 2023 06:27:53 +0000 (08:27 +0200)]
detect/threshold: reword alloc failure message
Victor Julien [Sat, 6 May 2023 06:24:23 +0000 (08:24 +0200)]
detect: spelling: DetectBufferMpmRegistry
Victor Julien [Sat, 6 May 2023 06:20:17 +0000 (08:20 +0200)]
detect: spelling: SIG_FLAG_INIT_PRIO_EXPLICIT
Victor Julien [Sat, 6 May 2023 06:18:51 +0000 (08:18 +0200)]
detect: spelling: update SigTableApplyStrictCommandLineOption
Victor Julien [Sat, 6 May 2023 06:01:03 +0000 (08:01 +0200)]
detect: spelling: multi-tenancy fixes
Victor Julien [Sat, 6 May 2023 05:26:35 +0000 (07:26 +0200)]
fuzz: spelling: AFLFUZZ_PERSISTENT_MODE
Victor Julien [Sat, 6 May 2023 05:33:49 +0000 (07:33 +0200)]
doc/install: point to userguide
Victor Julien [Sat, 6 May 2023 05:36:26 +0000 (07:36 +0200)]
doc: remove legacy windows install guide
Victor Julien [Sat, 6 May 2023 05:36:12 +0000 (07:36 +0200)]
doc: remove legacy pfring install guide
Victor Julien [Fri, 5 May 2023 18:35:51 +0000 (20:35 +0200)]
prscript: remove as it is obsolete