Eric Leblond [Wed, 17 Apr 2013 11:37:40 +0000 (13:37 +0200)]
Add SuriInstance structure
To be able to split code in functions in main, we need to pass
information about the current running Suricata to functions.
For that we create a structure to store suricata run parameters.
In this patch it allows to separate command line parsing and to
treat internal running mode in a switch just after command line
parsing.
Eric Leblond [Tue, 30 Jul 2013 08:44:29 +0000 (10:44 +0200)]
unittest: make check use a qa/log dir for logging
This patch is using the qa/log directory to store the output
of the check. In case of success, the directory is deleted.
In case of failure, the directory remains in place.
Eric Leblond [Tue, 9 Apr 2013 09:05:39 +0000 (11:05 +0200)]
suricata: separate keyword and app layer listing code
The list-keyword and app-layer listing code was spread over all the
init code. This patch introduces a separate file to store non standard
running mode like these ones.
Eric Leblond [Wed, 20 Mar 2013 10:28:58 +0000 (11:28 +0100)]
flow tag: conversion to flow storage API
This patch is updating the flow tag system to use the flow
storage API. The tag_list member of Flow structure is suppressed
and its cleaning operation are suppressed too as this is handled
transparently by the flow storage API.
Eric Leblond [Mon, 18 Mar 2013 10:05:52 +0000 (11:05 +0100)]
Host: use global free storage function
This patch is here to avoid that all modules using a local storage
have to update host code to add their free function. It modifies
previous behavior by calling HostFreeStorage in any case.
Ken Steele [Fri, 26 Jul 2013 17:22:19 +0000 (13:22 -0400)]
Add TILE-Gx mPIPE packet processing support.
The TILE-Gx processor includes a packet processing engine, called
mPIPE, that can deliver packets directly into user space memory. It
handles buffer allocation and load balancing (either static 5-tuple
hashing, or dynamic flow affinity hashing are used here). The new
packet source code is in source-mpipe.c and source-mpipe.h
A new Tile runmode is added that configures the Suricata pipelines in
worker mode, where each thread does the entire packet processing
pipeline. It scales across all the Gx chips sizes of 9, 16, 36 or 72
cores. The new runmode is in runmode-tile.c and runmode-tile.h
The configure script detects the TILE-Gx architecture and defines
HAVE_MPIPE, which is then used to conditionally enable the code to
support mPIPE packet processing. Suricata runs on TILE-Gx even without
mPIPE support enabled.
The Suricata Packet structures are allocated by the mPIPE hardware by
allocating the Suricata Packet structure immediatley before the mPIPE
packet buffer and then pushing the mPIPE packet buffer pointer onto
the mPIPE buffer stack. This way, mPIPE writes the packet data into
the buffer, returns the mPIPE packet buffer pointer, which is then
converted into a Suricata Packet pointer for processing inside
Suricata. When the Packet is freed, the buffer is returned to mPIPE's
buffer stack, by setting ReleasePacket to an mPIPE release specific
function.
The code checks for the largest Huge page available in Linux when
Suricata is started. TILE-Gx supports Huge pages sizes of 16MB, 64MB,
256MB, 1GB and 4GB. Suricata then divides one of those page into
packet buffers for mPIPE.
The code is not yet optimized for high performance. Performance
improvements will follow shortly.
The code was originally written by Tom Decanio and then further
modified by Tilera.
This code has been tested with Tilera's Multicore Developement
Environment (MDE) version 4.1.5. The TILEncore-Gx36 (PCIe card) and
TILEmpower-Gx (1U Rack mount).
Victor Julien [Tue, 23 Jul 2013 11:23:08 +0000 (13:23 +0200)]
Add yaml option to disable vlan ids hashing
In some cases using the vlan id(s) in flow hashing is problematic. Cases
of broken routers have been reported. So this option allows for disabling
the use of vlan id(s) while calculating the flow hash, and in the future
other hashes.
Ken Steele [Wed, 10 Jul 2013 20:47:52 +0000 (16:47 -0400)]
Replace ReleaseData function on Packet Structure with ReleasePacket.
This commit allows handling Packets allocated by different methods.
The ReleaseData function pointer in the Packet structure is replaced
with ReleasePacket function pointer, which is then always called to
release the memory associated with a Packet.
Currently, the only usage of ReleaseData is in AF Packet. Previously
ReleaseData was only called when it was not NULL. To implement the
same functionality as before in AF Packet, a new function is defined
in AF Packet to first call the AFP specific ReleaseData function and
then releases the Packet structure.
Three new general functions are defined for releasing packets in the
default case:
1) PacketFree() - To release a packet alloced with SCMalloc()
2) PacketPoolReturnPacket() - For packets allocated from the Packet Pool.
Calls RECYCLE_PACKET(p)
3) PacketFreeOrRelease() - Calls PacketFree() or PacketPoolReturnPacket()
based on the PKT_ALLOC flag.
Having these functions removes the need to check the PKT_ALLOC flag
when releasing a packet in most cases, since the ReleasePacket
function encodes how the Packet was allocated. The PKT_ALLOC flag is
still set and is needed when AF Packet releases a packet, since it
replaces the ReleasePacket function pointer with its own function and
then calls PacketFreeOfRelease(), which uses the PKT_ALLOC flag.
Code to enable cuda support for live mode pcap and af-packet. Keep an eye
out on the mailing list and http://planet.suricata-ids.org for performance
and other profiling data.
Eric Leblond [Fri, 5 Jul 2013 10:28:30 +0000 (12:28 +0200)]
coccinelle: add script to generate flags test
This patch adds a script which can be used to generate a test
on coherence of flag usage.
By adding comment in the code, it is possible to declare that we
link a flag in a structure to a specific family of constant:
For example:
/* coccinelle: Packet:flowflags:FLOW_PKT_ */
will trigger the generation on a test which verifies that the
flowflags field in Packet structure is only used with constant
starting by FLOW_PKT_.
Victor Julien [Thu, 11 Jul 2013 08:36:22 +0000 (10:36 +0200)]
Use relative dir instead of ac_builddir
When generating src/build-info.h the use of ac_builddir was problematic.
There were several cases where it was undefined leading to the absolute
path /src/build-info.h. ./configure should be called from the parent dir
to the actual src dir, so this should work. Make distcheck and normal builds
complete fine.
Victor Julien [Wed, 10 Jul 2013 13:10:32 +0000 (15:10 +0200)]
Autotools: move libhtp conditionals to configure
In preparation of the libhtp upgrade, move all libhtp related conditionals
to configure. This allows for one set of build scripts that works regardless
of the presence of a local libhtp dir.
projects / thirdparty / suricata.git / log
