[Oisf-devel] Suricata 1.3rc1 Available!

Nikolay Denev ndenev at gmail.com
Sat Jun 30 05:05:13 UTC 2012


Hi,

Latest Suricata fails to build for me on FreeBSD 9.0-STABLE machine :

flow-manager.c: In function 'FlowManagerThread':
flow-manager.c:426: error: expected expression before '<' token
*** Error code 1

Stop in /usr/home/ndenev/oisf/src.
*** Error code 1

Stop in /usr/home/ndenev/oisf/src.
*** Error code 1

Stop in /usr/home/ndenev/oisf.
*** Error code 1

Stop in /usr/home/ndenev/oisf.

This patch seems to fix it for me and also adds experimental thread name setting for FreeBSD :)

diff --git a/src/threads.h b/src/threads.h
index c4e9bba..1b3ef04 100644
--- a/src/threads.h
+++ b/src/threads.h
@@ -467,18 +467,26 @@ extern __thread uint64_t spin_lock_cnt;
  * OS specific macro's for setting the thread name. "top" can display
  * this name.
  */
-#ifndef PR_SET_NAME /*PR_SET_NAME */
-#define SCSetThreadName(n)
-#elif defined OS_FREEBSD || __OpenBSD__ /* FreeBSD or OpenBSD */
+#if defined OS_FREEBSD /* FreeBSD */
 /** \todo Add implementation for FreeBSD */
-#define SCSetThreadName(n)
-#elif OS_WIN32 /* Windows */
+#define SCSetThreadName(n) ({ \
+    char tname[16] = ""; \
+    if (strlen(n) > 16) \
+        SCLogDebug("Thread name is too long, truncating it..."); \
+    strlcpy(tname, n, 16); \
+    pthread_set_name_np(pthread_self(), tname); \
+    0; \
+})
+#elif defined __OpenBSD__ /* OpenBSD */
+/** \todo Add implementation for OpenBSD */
+#define SCSetThreadName(n) (0)
+#elif defined OS_WIN32 /* Windows */
 /** \todo Add implementation for Windows */
-#define SCSetThreadName(n)
-#elif OS_DARWIN /* Mac OS X */
+#define SCSetThreadName(n) (0)
+#elif defined OS_DARWIN /* Mac OS X */
 /** \todo Add implementation for MacOS */
-#define SCSetThreadName(n)
-#else /* Linux */
+#define SCSetThreadName(n) (0)
+#elif defined PR_SET_NAME /*PR_SET_NAME */
 /**
  * \brief Set the threads name
  */
@@ -492,6 +500,8 @@ extern __thread uint64_t spin_lock_cnt;
         SCLogDebug("Error setting thread name \"%s\": %s", tname, strerror(errno)); \
     ret; \
 })
+#else
+#define SCSetThreadName(n) (0)
 #endif
 
 Here are the thread names :

[7:03]root at sauron.SF:/home/ndenev/oisf# procstat -t 96738
  PID    TID COMM             TDNAME           CPU  PRI STATE   WCHAN    
96738 100473 suricata         RxPcapix01         2  120 sleep   select    
96738 100489 suricata         Detect1            5  120 sleep   uwait     
96738 100493 suricata         Detect2            0  120 sleep   uwait     
96738 100514 suricata         Detect3            6  120 sleep   uwait     
96738 101957 suricata         Detect4            7  120 sleep   uwait     
96738 101962 suricata         Detect5            1  120 sleep   uwait     
96738 102469 suricata         Detect6            3  120 sleep   uwait     
96738 102473 suricata         Detect7            4  120 sleep   uwait     
96738 103937 suricata         -                  0  120 sleep   nanslp    
96738 104122 suricata         Detect8            3  120 sleep   uwait     
96738 104123 suricata         Detect9            3  120 sleep   uwait     
96738 104124 suricata         Detect10           5  120 sleep   uwait     
96738 104125 suricata         Detect11           0  120 sleep   uwait     
96738 104126 suricata         Detect12           3  120 sleep   uwait     
96738 104127 suricata         FlowManagerThre    1  121 sleep   uwait     
96738 104128 suricata         SCPerfWakeupThr    3  120 sleep   uwait     
96738 104129 suricata         SCPerfMgmtThrea    0  120 sleep   uwait     


On Jun 29, 2012, at 9:36 PM, Victor Julien wrote:

> The OISF development team is proud to announce Suricata 1.3rc1, the
> first (and hopefully only) release candidate for Suricata 1.3. This
> release improves stability and accuracy, in addition to adding a few new
> exciting features.
> 
> Get the new release here:
> http://www.openinfosecfoundation.org/download/suricata-1.3rc1.tar.gz
> 
> The new release comes with a number of important improvements and fixes.
> 
> New features
> 
> - http_user_agent keyword for matching on the HTTP User-Agent header
> - experimental live rule reload by sending a USR2 signal (#279)
> - AF_PACKET BPF support (#449)
> - AF_PACKET live packet loss counters (#441)
> - Rule analyzer (#349)
> - add pcap workers runmode for use with libpcap wrappers that support
> load balancing, such as  Napatech's or Myricom's
> - negated filemd5 matching, allowing for md5 whitelisting
> 
> Improvements
> 
> - signatures with depth and/or offset are now checked against packets in
> addition to the stream (#404)
> - http_cookie keyword now also inspects "Set-Cookie" header (#479)
> - filemd5 keyword no longer depends on log-file output module (#447)
> - http_raw_header keyword inspects original header line terminators (#475)
> - deal with double encoded URI (#464)
> 
> Fixes
> 
> - improved SMB/SMB2/DCERPC robustness
> - ICMPv6 parsing fixes
> - improve HTTP body inspection
> - stream.inline accuracy issues fixed (#339)
> - general stability fixes (#482, #486)
> - missing unittests added (#471)
> - "threshold.conf not found" error made more clear (#446)
> - IPS mode segment logging for Unified2 improved
> 
> Known issues & missing features
> 
> This is a "release candidate"-quality release so the stability should be
> good although unexpected corner cases might happen. If you encounter
> one, please let us know!
> 
> As always, we are doing our best to make you aware of continuing
> development and items within the engine that are not yet complete or
> optimal.  With this in mind, please notice the list we have included of
> known items we are working on.
> 
> See http://redmine.openinfosecfoundation.org/projects/suricata/issues
> for an up to date list and to report new issues. See
> http://redmine.openinfosecfoundation.org/projects/suricata/wiki/Known_issues
> for a discussion and time line for the major issues.
> 
> -- 
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
> 
> 
> _______________________________________________
> Oisf-devel mailing list
> Oisf-devel at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel




More information about the Oisf-devel mailing list