suricata
flow-bypass.c
Go to the documentation of this file.
1 /* Copyright (C) 2016-2018 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Eric Leblond <eleblond@stamus-networks.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "tm-threads.h"
26 #include "flow.h"
27 #include "flow-bypass.h"
28 #include "flow-private.h"
29 #include "util-ebpf.h"
30 #include "runmodes.h"
31 
32 #ifdef CAPTURE_OFFLOAD_MANAGER
33 
34 #define FLOW_BYPASS_DELAY 10
35 
36 #ifndef TIMEVAL_TO_TIMESPEC
37 #define TIMEVAL_TO_TIMESPEC(tv, ts) { \
38  (ts)->tv_sec = (tv)->tv_sec; \
39  (ts)->tv_nsec = (tv)->tv_usec * 1000; \
40 }
41 #endif
42 
43 typedef struct BypassedFlowManagerThreadData_ {
44  uint16_t flow_bypassed_cnt_clo;
45  uint16_t flow_bypassed_pkts;
46  uint16_t flow_bypassed_bytes;
47 } BypassedFlowManagerThreadData;
48 
49 #define BYPASSFUNCMAX 4
50 
51 typedef struct BypassedCheckFuncItem_ {
52  BypassedCheckFunc Func;
53  BypassedCheckFuncInit FuncInit;
54  void *data;
55 } BypassedCheckFuncItem;
56 
57 int g_bypassed_func_max_index = 0;
58 BypassedCheckFuncItem bypassedfunclist[BYPASSFUNCMAX];
59 
60 typedef struct BypassedUpdateFuncItem_ {
61  BypassedUpdateFunc Func;
62  void *data;
63 } BypassedUpdateFuncItem;
64 
65 int g_bypassed_update_max_index = 0;
66 BypassedUpdateFuncItem updatefunclist[BYPASSFUNCMAX];
67 
68 static TmEcode BypassedFlowManager(ThreadVars *th_v, void *thread_data)
69 {
70  int tcount = 0;
71  int i;
72  BypassedFlowManagerThreadData *ftd = thread_data;
73  struct timespec curtime = {0, 0};
74 
75  struct timeval tv;
76  gettimeofday(&tv, NULL);
77  TIMEVAL_TO_TIMESPEC(&tv, &curtime);
78 
79  for (i = 0; i < g_bypassed_func_max_index; i++) {
80  if (bypassedfunclist[i].FuncInit) {
81  bypassedfunclist[i].FuncInit(th_v, &curtime, bypassedfunclist[i].data);
82  }
83  }
84 
85  /* check if we have a periodic check function */
86  bool found = false;
87  for (i = 0; i < g_bypassed_func_max_index; i++) {
88  if (bypassedfunclist[i].FuncInit) {
89  found = true;
90  break;
91  }
92  }
93  if (!found)
94  return TM_ECODE_OK;
95 
96  while (1) {
97  SCLogDebug("Dumping the table");
98  gettimeofday(&tv, NULL);
99  TIMEVAL_TO_TIMESPEC(&tv, &curtime);
100 
101  for (i = 0; i < g_bypassed_func_max_index; i++) {
102  struct flows_stats bypassstats = { 0, 0, 0};
103  if (bypassedfunclist[i].Func == NULL)
104  continue;
105  tcount = bypassedfunclist[i].Func(th_v, &bypassstats, &curtime, bypassedfunclist[i].data);
106  if (tcount) {
107  StatsAddUI64(th_v, ftd->flow_bypassed_cnt_clo, (uint64_t)bypassstats.count);
108  }
109  StatsAddUI64(th_v, ftd->flow_bypassed_pkts, (uint64_t)bypassstats.packets);
110  StatsAddUI64(th_v, ftd->flow_bypassed_bytes, (uint64_t)bypassstats.bytes);
111  }
112 
113  if (TmThreadsCheckFlag(th_v, THV_KILL)) {
114  StatsSyncCounters(th_v);
115  return TM_ECODE_OK;
116  }
117  for (i = 0; i < FLOW_BYPASS_DELAY * 100; i++) {
118  if (TmThreadsCheckFlag(th_v, THV_KILL)) {
119  StatsSyncCounters(th_v);
120  return TM_ECODE_OK;
121  }
123  usleep(10000);
124  }
125  }
126  return TM_ECODE_OK;
127 }
128 
129 static TmEcode BypassedFlowManagerThreadInit(ThreadVars *t, const void *initdata, void **data)
130 {
131  BypassedFlowManagerThreadData *ftd = SCCalloc(1, sizeof(BypassedFlowManagerThreadData));
132  if (ftd == NULL)
133  return TM_ECODE_FAILED;
134 
135  *data = ftd;
136 
137  ftd->flow_bypassed_cnt_clo = StatsRegisterCounter("flow_bypassed.closed", t);
138  ftd->flow_bypassed_pkts = StatsRegisterCounter("flow_bypassed.pkts", t);
139  ftd->flow_bypassed_bytes = StatsRegisterCounter("flow_bypassed.bytes", t);
140 
141  return TM_ECODE_OK;
142 }
143 
144 static TmEcode BypassedFlowManagerThreadDeinit(ThreadVars *t, void *data)
145 {
146  if (data)
147  SCFree(data);
148  return TM_ECODE_OK;
149 }
150 
152  BypassedCheckFuncInit CheckFuncInit,
153  void *data)
154 {
155  if (g_bypassed_func_max_index < BYPASSFUNCMAX) {
156  bypassedfunclist[g_bypassed_func_max_index].Func = CheckFunc;
157  bypassedfunclist[g_bypassed_func_max_index].FuncInit = CheckFuncInit;
158  bypassedfunclist[g_bypassed_func_max_index].data = data;
159  g_bypassed_func_max_index++;
160  } else {
161  return -1;
162  }
163  return 0;
164 }
165 
167  void *data)
168 {
169  if (!UpdateFunc) {
170  return -1;
171  }
172  if (g_bypassed_update_max_index < BYPASSFUNCMAX) {
173  updatefunclist[g_bypassed_update_max_index].Func = UpdateFunc;
174  updatefunclist[g_bypassed_update_max_index].data = data;
175  g_bypassed_update_max_index++;
176  } else {
177  return -1;
178  }
179  return 0;
180 }
181 #endif
182 
183 /** \brief spawn the flow bypass manager thread */
185 {
186 #ifdef CAPTURE_OFFLOAD_MANAGER
187 
188  ThreadVars *tv_flowmgr = NULL;
190  "BypassedFlowManager", 0);
191  BUG_ON(tv_flowmgr == NULL);
192 
193  if (tv_flowmgr == NULL) {
194  printf("ERROR: TmThreadsCreate failed\n");
195  exit(1);
196  }
197  if (TmThreadSpawn(tv_flowmgr) != TM_ECODE_OK) {
198  printf("ERROR: TmThreadSpawn failed\n");
199  exit(1);
200  }
201 #endif
202 }
203 
205 {
206 #ifdef CAPTURE_OFFLOAD_MANAGER
207  for (int i = 0; i < g_bypassed_update_max_index; i++) {
208  if (updatefunclist[i].Func(f, p, updatefunclist[i].data)) {
209  return;
210  }
211  }
212 #endif
213 }
214 
216 {
217 #ifdef CAPTURE_OFFLOAD_MANAGER
218  tmm_modules[TMM_BYPASSEDFLOWMANAGER].name = "BypassedFlowManager";
219  tmm_modules[TMM_BYPASSEDFLOWMANAGER].ThreadInit = BypassedFlowManagerThreadInit;
220  tmm_modules[TMM_BYPASSEDFLOWMANAGER].ThreadDeinit = BypassedFlowManagerThreadDeinit;
221  tmm_modules[TMM_BYPASSEDFLOWMANAGER].Management = BypassedFlowManager;
224  SCLogDebug("%s registered", tmm_modules[TMM_BYPASSEDFLOWMANAGER].name);
225 #endif
226 }
227 
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:67
tm-threads.h
flow-bypass.h
TmThreadSpawn
TmEcode TmThreadSpawn(ThreadVars *tv)
Spawns a thread associated with the ThreadVars instance tv.
Definition: tm-threads.c:1639
TmThreadCreateMgmtThreadByName
ThreadVars * TmThreadCreateMgmtThreadByName(const char *name, const char *module, int mucond)
Creates and returns the TV instance for a Management thread(MGMT). This function supports only custom...
Definition: tm-threads.c:1083
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
flows_stats::count
uint64_t count
Definition: flow-bypass.h:30
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:356
BypassedFlowUpdate
void BypassedFlowUpdate(Flow *f, Packet *p)
Definition: flow-bypass.c:204
StatsSyncCountersIfSignalled
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:140
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
TmModuleBypassedFlowManagerRegister
void TmModuleBypassedFlowManagerRegister(void)
Definition: flow-bypass.c:215
TMM_BYPASSEDFLOWMANAGER
@ TMM_BYPASSEDFLOWMANAGER
Definition: tm-threads-common.h:72
thread_name_flow_bypass
const char * thread_name_flow_bypass
Definition: runmodes.c:84
BypassedFlowManagerThreadSpawn
void BypassedFlowManagerThreadSpawn()
spawn the flow bypass manager thread
Definition: flow-bypass.c:184
util-ebpf.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
BypassedCheckFunc
int(* BypassedCheckFunc)(ThreadVars *th_v, struct flows_stats *bypassstats, struct timespec *curtime, void *data)
Definition: flow-bypass.h:35
TmModule_::Management
TmEcode(* Management)(ThreadVars *, void *)
Definition: tm-modules.h:59
THV_KILL
#define THV_KILL
Definition: threadvars.h:39
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:289
Packet_
Definition: decode.h:425
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
TmEcode
TmEcode
Definition: tm-threads-common.h:81
TmModule_::name
const char * name
Definition: tm-modules.h:44
runmodes.h
flows_stats::bytes
uint64_t bytes
Definition: flow-bypass.h:32
suricata-common.h
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
BypassedCheckFuncInit
int(* BypassedCheckFuncInit)(ThreadVars *th_v, struct timespec *curtime, void *data)
Definition: flow-bypass.h:38
BypassedFlowManagerRegisterUpdateFunc
int BypassedFlowManagerRegisterUpdateFunc(BypassedUpdateFunc UpdateFunc, void *data)
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:146
SCFree
#define SCFree(p)
Definition: util-mem.h:61
StatsSyncCounters
#define StatsSyncCounters(tv)
Definition: counters.h:137
flow.h
BypassedUpdateFunc
int(* BypassedUpdateFunc)(Flow *f, Packet *p, void *data)
Definition: flow-bypass.h:40
TmThreadsCheckFlag
int TmThreadsCheckFlag(ThreadVars *tv, uint32_t flag)
Check if a thread flag is set.
Definition: tm-threads.c:90
BypassedFlowManagerRegisterCheckFunc
int BypassedFlowManagerRegisterCheckFunc(BypassedCheckFunc CheckFunc, BypassedCheckFuncInit CheckFuncInit, void *data)
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:955
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
flows_stats::packets
uint64_t packets
Definition: flow-bypass.h:31
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:70
TM_FLAG_MANAGEMENT_TM
#define TM_FLAG_MANAGEMENT_TM
Definition: tm-modules.h:36
flows_stats
Definition: flow-bypass.h:29