aboutsummaryrefslogtreecommitdiffstats
path: root/plugins
AgeCommit message (Collapse)AuthorFilesLines
2022-08-19Falco Bridge: Add a NULL check.Gerald Combs1-1/+1
2022-08-15Falco Bridge: Update to match falcosecurity-libs 0.8.0.Gerald Combs3-8/+7
Update sinsp-span to use the current Falco libs APIs. Update the FindSinsp CMake module to use pkg-config.
2022-08-15pluginifdemo: Qt5->Qt6; bump version to 0.0.2Chuck Craft2-6/+6
2022-08-09Use `register_dissector()` for more protocolsDavid Perry3-11/+8
2022-08-02epan: Refactor floating point display typesJoão Valverde1-1/+1
Remove the redundant BASE_FLOAT field display type. The name BASE_FLOAT is meaningless and the value aliased to BASE_NONE. Require BASE_NONE instead of BASE_FLOAT (corresponding to the printf() %g format). Add new float display types using BASE_DEC, BASE_HEX and BASE_EXP corresponfing to %f, %a and %e respectively. Add support for BASE_CUSTOM with floats.
2022-07-23ECATMB: Add SDO Information to CANopenTypeUli Heilmeier1-0/+1
Fixes #18220
2022-07-06Rename Logwolf to LograyGerald Combs1-1/+1
Switch to the name "Logray" for the log analyzer. Rays are biological cousins of sharks and more people like the name "Logray" in a completely unscientific survey here. Apologies for any inconvenience this might cause.
2022-07-06Fix some spellings.Martin Mathieson2-2/+2
2022-06-16ethercat: Fix EEPROM Ctrl/Status bitmask fieldsJohn Thacker1-8/+9
When the field width was corrected by commit b240d5baa062a475ff0943b91205eb2aee2a0471, the masks got messed up. There's 4 reserved bits that don't have fields and the bits are in Little Endian order. Fix #18132.
2022-06-10tap: Adding flags for tap_packetRoland Knall1-9/+9
This allows flags to be passed by the registering listener to the collection of information
2022-06-09irda: Use correct conversation_new() optionsStig Bjørlykke1-1/+1
Fix conversation_new() options after they was changed/improved in commit 709593ee.
2022-05-31Profinet plugin: Dissect writing I&M1 and I&M2, tooDirk Ziegelmeier1-0/+2
2022-05-31Profinet plugin: Decode more error codesDirk Ziegelmeier1-3/+47
according to PN Protocol 2.4MU3 April 2022
2022-05-23epan: Allow conversations based on arbitrary element lists.Gerald Combs1-6/+38
Add conversation_new_full and find_conversation_full, which take arbitrary element lists instead of fixed addresses and ports. Update the comments in conversation.h to be more Doxygen-conformant. Update README.dissector. Use the new functionality to add initial conversation support to the Falco Bridge dissector.
2022-05-21Use proto_tree_add_item where possibleMatthias Dietrich1-7/+8
2022-05-21Add PA Profile 4.02 diagnostics codesMatthias Dietrich1-0/+362
2022-05-21Dissect PA Profile IO dataMatthias Dietrich3-6/+238
2022-05-21Resolve PA Profile 4.02 submodule namesMatthias Dietrich2-0/+354
2022-05-19Falco Bridge: API updates.Gerald Combs3-11/+12
Update to the current (c02ae4b6) API.
2022-05-19Falco Bridge: Fix address field registration.Gerald Combs1-1/+2
2022-05-03Falco Bridge: Fix a couple of bugs.Gerald Combs1-4/+3
Make sure a pointer is valid and only initialize our sinsp span once.
2022-04-29Falco Bridge: Add typed address fields.Gerald Combs2-3/+93
libsinsp currently only supports string and unsigned 64-bit integer field types. For string fields that might contain a parseable address, add ".v4" and ".v6" subtree items with a corresponding field type. For example, the ct.srcip field now dissects as Sysdig Event 1: 880 bytes Falco Bridge cloudtrail Plugin [ ... ] Source IP: 3.92.225.50 [Source IP (IPv4): 3.92.225.50]
2022-04-27Falco Bridge: Fix building on Windows.Gerald Combs1-0/+10
Fix Falco plugin installation in multi-config environments. Fix FindSinsp on Windows. Ignore a couple of warnings for now.
2022-04-27Falco Bridge: Switch to the sinsp capabilities API.Gerald Combs2-11/+5
falcosecurity/libs 448c380e switched from a plugin type to a more generic capabilities enum.
2022-04-27Profinet plugin: Add severity according to PA Profile 4.02Dirk Ziegelmeier1-6/+6
2022-04-26Falco Bridge: Update to match the current libsinsp API.Gerald Combs3-69/+83
The extract_fields struct and calling convention changed, so update to match. Extract all of our fields at once, which noticeably speeds up dissection here.
2022-04-25CMake+Logwolf: Populate our Falco plugin directory.Gerald Combs1-1/+1
Create plugins/<version>/falco and copy over the Cloudtrail plugin.
2022-04-20PROFINET: TSN Dissection implementedVahap Emin Agaogullari2-22/+1963
TSN Records for pn_io and pn_dcp TSN Suboption dissected
2022-04-19epan: Add the ability to add conversation filter protocols.Gerald Combs1-2/+6
Convert our conversation protocols to a dynamic list and add add_conversation_filter_protocol(). Use it in the Falco Bridge plugin to add protocols with conversation filters.
2022-04-16PROFINET: Fix count of IO data objects and IOCSMatthias Dietrich3-19/+29
Split the counts of IO data objects and IOCS between input and output. Remove increment of IO data objects in station information, sometimes leading to extremely high and invalid number of IO data objects.
2022-04-16PROFINET: Split number of IOCS between in and outMatthias Dietrich3-4/+9
Currently a single counter is used, but the number of IOCS is not necessarily the same for input and output CRs.
2022-04-13Falco Bridge: Misc cleanup.Gerald Combs4-92/+60
Remove unused header definitions in packet-falco-bridge.h and move the remaining content to packet-falco-bridge.c and conversation-macros.h. Explicitly set our header files in CMakeLists.txt.
2022-04-04CMake: Finish splitting ADD_PLUGIN_LIBRARY.Gerald Combs23-23/+23
Rename add_plugin_library to add_wireshark_plugin_library and add a backward compatibility wrapper. Make Falco Bridge a Logwolf plugin.
2022-04-04Falco Bridge: Fix a function declaration.Gerald Combs1-1/+1
Fix ../plugins/epan/falco_bridge/packet-falco-bridge.c: In function ‘register_conversation_filters_mappings’: ../plugins/epan/falco_bridge/packet-falco-bridge.c:105:1: error: old-style function definition [-Werror=old-style-definition] register_conversation_filters_mappings() ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2022-04-03PROFINET: Support PROFIsafe 5 byte safety trailerMatthias Dietrich1-5/+19
Calculate the safety IO data length based on the safety trailer length, which is given by the F-Parameter F_CRC_Seed.
2022-03-24PROFINET: TimeAware Dissection and RSI FREQ block fixVahap Emin Agaogullari4-55/+167
TimeAware bit dissected for ARProperties and cyclic frames updated accordingly. Also small length problem fixed in RSI FREQ block dissection.
2022-03-22Falco Bridge: Update the README.Gerald Combs1-0/+5
Update the Licensing section of the README.
2022-03-22Falco Bridge: Miscellaneous fixes.Gerald Combs2-11/+33
Fix some issues found by the pre-commit script. Add a missing Debian symbol. Update the README.
2022-03-22Falco Bridge: Remove some unused code.Gerald Combs1-151/+0
2022-03-22Rename Sysdig Bridge to Falco Bridge.Gerald Combs9-78/+81
The Sysdig Bridge plugin loads Falco plugins, so rename it to Falco Bridge. Make it optional and dependent on libsinsp+libscap, similar to our codec plugins. Remove some unused code.
2022-03-22CMake+Sysdig Bridge: Add a FindSinsp module.Gerald Combs1-15/+6
Add a FindSinsp CMake module, and use it in the Sysdig Bridge plugin CMakeLists.txt. It still needs work, but should at least be usable on more machines. Conflicts: plugins/epan/sysdig_bridge/CMakeLists.txt
2022-03-22Sysdig Bridge: Make sure we fetch the correct field info.Gerald Combs1-8/+7
Fetch the current field number's type and format instead of the first field's.
2022-03-22Sysdig Bridge: Remove old code.Gerald Combs3-431/+10
Remove commented & ifdef0'd code that loaded plugins directly. Destroy our libsinsp instance on exit.
2022-03-22Sysdig Bridge: Handle info and conversation fields.Gerald Combs3-31/+58
Fix our field length display as well.
2022-03-22Sysdig Bridge: Switch to libsinsp/libscap.Gerald Combs5-148/+580
Switch from loading the cloudtrail plugin directly to doing so indirectly via libsinsp. This should let us start leveraging the rich functionality offered by libsinsp.
2022-03-22Sysdig Bridge: Update the Sysdig Plugin fields.Gerald Combs1-5/+14
Update the Sysdig Plugin fields to match falcosecurity/libs scap.c.
2022-03-22Sysdig bridge: Update a struct.Gerald Combs1-0/+1
Update ss_plugin_extract_field to match https://github.com/falcosecurity/plugin-sdk-go/blob/main/pkg/sdk/plugin_info.h
2022-03-22Sysdig bridge: Fix a couple of offsets.Gerald Combs1-2/+2
It looks like the source ID and event data are 4 bytes further into each block. Quick fix pending more details about the block format.
2022-03-22Sysdig bridge: Set our plugin API version to 0.2.0.Gerald Combs1-5/+5
2022-03-22Sysdig bridge: Fix compilation.Gerald Combs1-1/+3
Fix logshark/plugins/epan/sysdig_bridge/packet-sysdig-bridge.c:86:39: error: this old-style function definition is not preceded by a prototype [-Werror,-Wstrict-prototypes] register_conversation_filters_mappings() ^ 1 error generated.
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-05 01:15:48 +0000