101 commits

Author	SHA1	Message	Date
Alfredo Cardigliano	6359bc9ab0	Fix displayed RTP MOS with TLV (this also fixes other fields formatting with JSON)	2019-12-02 12:09:37 +01:00
Alfredo Cardigliano	e38835a603	Rename SSL to TLS (fix #3013)	2019-11-15 12:40:01 +01:00
Simone Mainardi	1eba832869	Fixes flow aggregation after hash tables rework ... Fixes #3018	2019-10-29 17:49:52 +01:00
Alfredo Cardigliano	3290bd803b	Propagating additional fields to companion interface	2019-10-15 16:41:42 +02:00
Alfredo Cardigliano	a2e74e16a3	New Lua interface.processFlow API, moved processFlow from NetworkInterface to ParserInterface, code cleanup	2019-10-10 12:49:32 +02:00
Alfredo Cardigliano	c5e3d61205	Support for l7 proto name match in sub interfaces	2019-10-08 17:14:10 +02:00
Alfredo Cardigliano	0c2ffc1f94	Dynamic and custom sub-interfaces are now sharing the same data structure (registering through API to the master interface), bug fixes	2019-09-26 15:50:31 +02:00
Alfredo Cardigliano	d672d93750	Sub interfaces support (wip) (#2825)	2019-09-17 10:34:52 +02:00
Alfredo Cardigliano	b7d459dd2b	Moved strdup for JSON/TLV strings from Flow to Parser to handle non-null-terminated strings	2019-09-13 12:36:19 +02:00
Alfredo Cardigliano	e31afe72d6	Enabled additional fields serialization to TLV	2019-09-11 12:03:28 +02:00
Alfredo Cardigliano	9bd00fa0ee	Support for encoding additional fields to TLV	2019-09-10 20:50:34 +02:00
Simone Mainardi	77a3bdb051	Reworks profiling instrumentation	2019-09-10 19:06:52 +02:00
Simone Mainardi	949d2a1025	Calculates flow idle timeouts using nProbe data for ZMQ interfaces	2019-09-10 18:05:16 +02:00
Alfredo Cardigliano	a707e6a058	Moved end-of-record check with TLV	2019-09-10 16:39:49 +02:00
Alfredo Cardigliano	ddfa56dc50	TLV warning improvements	2019-09-10 15:49:15 +02:00
Alfredo Cardigliano	ab9e6cae3a	Checking serialization format for TLV	2019-09-10 15:02:31 +02:00
Alfredo Cardigliano	51ecae22fb	Support for the new ndpi_deserialize_* API	2019-09-10 14:50:12 +02:00
Alfredo Cardigliano	32119bda1f	Temporarily disabled tlv version check (wip)	2019-09-10 11:11:27 +02:00
Alfredo Cardigliano	8637573838	Warning in case of TLV version mismatch (for the future)	2019-09-10 09:30:07 +02:00
Simone Mainardi	ca56f94cef	Implements per-interface updateStats variable frequency	2019-09-04 19:27:55 +02:00
Luca Deri	fa30f76e49	Added check to prevent sampling rate to be 0	2019-09-03 10:04:42 +02:00
Luca Deri	17e4fd0285	Parsing fixes	2019-09-02 08:27:00 +02:00
Simone Mainardi	24cf71a70d	Parses and charts UDP socket drops from nProbe	2019-08-30 12:54:41 +02:00
Alfredo Cardigliano	f8af84df2d	SyslogParserInterface now supports the companion interface for delivering Suricata alerts to a packet interface (#1928)	2019-08-27 17:53:34 +02:00
Alfredo Cardigliano	dc9978c68d	Moved companion interface to ParserInterface to be used by any *ParserInterface	2019-08-27 16:24:46 +02:00
Alfredo Cardigliano	226c9ce621	Support for deserialization of int32/int64/float with uint key	2019-08-26 12:56:05 +02:00
Alfredo Cardigliano	e1b57831eb	Optimized getKeyId (25% performance boost with TLV)	2019-08-26 12:05:47 +02:00
Simone Mainardi	e7ff945227	Fixes IPV4_{DST|DST}_MASK handled as strings	2019-08-14 10:54:27 +02:00
Alfredo Cardigliano	bcfcdb2f58	IPV4_{DST|DST}_MASK parsing fix	2019-08-14 10:26:08 +02:00
Alfredo Cardigliano	e1c7392c02	parseSingleTLVFlow cleanup	2019-08-13 11:48:23 +02:00
Alfredo Cardigliano	d0886b1f9e	Code cleanup, removed temporary warnings	2019-08-12 10:38:45 +02:00
Alfredo Cardigliano	55cad7ae43	Cleanup and comments to ZMQParserInterface	2019-08-12 09:44:53 +02:00
Luca	db284023b8	Workaround to avoid warning messages	2019-08-10 13:15:51 +02:00
Alfredo Cardigliano	c11c144a68	Reworked ZMQ parser to use ParsedValue instead of string/int/float, JSON-C is now parsing the correct type instead of always string	2019-08-05 13:56:41 +02:00
Simone Mainardi	c9223590d9	Workaround to handle \n forcefully set when decoding ZMQ tlv	2019-07-31 16:06:15 +02:00
Luca Deri	694001ed52	Boundary enforcment	2019-07-31 10:32:58 +02:00
Luca Deri	082921360c	TLV parsing enhancements	2019-07-31 01:23:22 +02:00
Alfredo Cardigliano	babab56394	Handling http ret code, dns query type and ret code from the ZMQ parser	2019-07-26 16:12:35 +00:00
Alfredo Cardigliano	dc435fd7a3	Parsing missing IE from the default cento/nprobe template to avoid using 'additional fields' (performance boost +35% - 195Kfps)	2019-07-26 15:30:35 +00:00
Alfredo Cardigliano	289e787da7	Creating the flow additional fields json object only when required	2019-07-26 12:54:40 +00:00
Alfredo Cardigliano	7efc8dfcae	flowProcess profiling	2019-07-25 16:33:41 +00:00
Alfredo Cardigliano	c5c3aaaec7	Fix json export in json2tlv	2019-07-19 20:37:45 +02:00
Alfredo Cardigliano	fdcdff9156	TLV ingestion improvements	2019-07-19 16:16:39 +00:00
Alfredo Cardigliano	55772d2450	json2tlv improvements	2019-07-18 00:12:53 +02:00
Alfredo Cardigliano	36d0930801	Extract multiple TLV records from ZMQ message	2019-07-17 18:54:55 +02:00
Alfredo Cardigliano	43546d8629	Support for ingesting flow records in TLV format	2019-07-17 13:10:41 +00:00
Simone Mainardi	ebb74cd76f	Handles bytes ACKed from Netlink	2019-06-20 19:01:31 +02:00
Simone Mainardi	720911fad8	Uses proper length when parsing nProbe mini INTERFACE_NAME	2019-06-17 22:32:33 +02:00
Simone Mainardi	da56531f63	Uses standard INTERFACE_NAME when parsing nProbe mini flows	2019-06-17 22:22:06 +02:00
Simone Mainardi	f2b90f5c48	Fixes flows direction when receiving eBPF events	2019-06-17 15:02:36 +02:00