suricata
flow-bypass.c
Go to the documentation of this file.
1 /* Copyright (C) 2016-2018 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Eric Leblond <eleblond@stamus-networks.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "tm-threads.h"
26 #include "flow.h"
27 #include "flow-bypass.h"
28 #include "flow-private.h"
29 #include "util-ebpf.h"
30 
31 #ifndef OS_WIN32
32 
33 #define FLOW_BYPASS_DELAY 10
34 
40 
41 #define BYPASSFUNCMAX 4
42 
43 typedef struct BypassedCheckFuncItem_ {
46  void *data;
48 
51 
52 typedef struct BypassedUpdateFuncItem_ {
54  void *data;
56 
59 
60 static TmEcode BypassedFlowManager(ThreadVars *th_v, void *thread_data)
61 {
62  int tcount = 0;
63  int i;
64  BypassedFlowManagerThreadData *ftd = thread_data;
65  struct timespec curtime = {0, 0};
66 
67  struct timeval tv;
68  gettimeofday(&tv, NULL);
69  TIMEVAL_TO_TIMESPEC(&tv, &curtime);
70 
71  for (i = 0; i < g_bypassed_func_max_index; i++) {
72  if (bypassedfunclist[i].FuncInit) {
73  bypassedfunclist[i].FuncInit(th_v, &curtime, bypassedfunclist[i].data);
74  }
75  }
76 
77  /* check if we have a periodic check function */
78  bool found = false;
79  for (i = 0; i < g_bypassed_func_max_index; i++) {
80  if (bypassedfunclist[i].FuncInit) {
81  found = true;
82  break;
83  }
84  }
85  if (!found)
86  return TM_ECODE_OK;
87 
88  while (1) {
89  SCLogDebug("Dumping the table");
90  gettimeofday(&tv, NULL);
91  TIMEVAL_TO_TIMESPEC(&tv, &curtime);
92 
93  for (i = 0; i < g_bypassed_func_max_index; i++) {
94  struct flows_stats bypassstats = { 0, 0, 0};
95  if (bypassedfunclist[i].Func == NULL)
96  continue;
97  tcount = bypassedfunclist[i].Func(th_v, &bypassstats, &curtime, bypassedfunclist[i].data);
98  if (tcount) {
99  StatsAddUI64(th_v, ftd->flow_bypassed_cnt_clo, (uint64_t)bypassstats.count);
100  }
101  StatsAddUI64(th_v, ftd->flow_bypassed_pkts, (uint64_t)bypassstats.packets);
102  StatsAddUI64(th_v, ftd->flow_bypassed_bytes, (uint64_t)bypassstats.bytes);
103  }
104 
105  if (TmThreadsCheckFlag(th_v, THV_KILL)) {
106  StatsSyncCounters(th_v);
107  return TM_ECODE_OK;
108  }
109  for (i = 0; i < FLOW_BYPASS_DELAY * 100; i++) {
110  if (TmThreadsCheckFlag(th_v, THV_KILL)) {
111  StatsSyncCounters(th_v);
112  return TM_ECODE_OK;
113  }
115  usleep(10000);
116  }
117  }
118  return TM_ECODE_OK;
119 }
120 
121 static TmEcode BypassedFlowManagerThreadInit(ThreadVars *t, const void *initdata, void **data)
122 {
124  if (ftd == NULL)
125  return TM_ECODE_FAILED;
126 
127  *data = ftd;
128 
129  ftd->flow_bypassed_cnt_clo = StatsRegisterCounter("flow_bypassed.closed", t);
130  ftd->flow_bypassed_pkts = StatsRegisterCounter("flow_bypassed.pkts", t);
131  ftd->flow_bypassed_bytes = StatsRegisterCounter("flow_bypassed.bytes", t);
132 
133  return TM_ECODE_OK;
134 }
135 
136 static TmEcode BypassedFlowManagerThreadDeinit(ThreadVars *t, void *data)
137 {
138  if (data)
139  SCFree(data);
140  return TM_ECODE_OK;
141 }
142 
144  BypassedCheckFuncInit CheckFuncInit,
145  void *data)
146 {
148  bypassedfunclist[g_bypassed_func_max_index].Func = CheckFunc;
149  bypassedfunclist[g_bypassed_func_max_index].FuncInit = CheckFuncInit;
150  bypassedfunclist[g_bypassed_func_max_index].data = data;
152  } else {
153  return -1;
154  }
155  return 0;
156 }
157 
159  void *data)
160 {
161  if (!UpdateFunc) {
162  return -1;
163  }
165  updatefunclist[g_bypassed_update_max_index].Func = UpdateFunc;
166  updatefunclist[g_bypassed_update_max_index].data = data;
168  } else {
169  return -1;
170  }
171  return 0;
172 }
173 #endif
174 
175 /** \brief spawn the flow bypass manager thread */
177 {
178 #ifndef OS_WIN32
179 #ifdef AFLFUZZ_DISABLE_MGTTHREADS
180  return;
181 #endif
182 
183  ThreadVars *tv_flowmgr = NULL;
185  "BypassedFlowManager", 0);
186  BUG_ON(tv_flowmgr == NULL);
187 
188  if (tv_flowmgr == NULL) {
189  printf("ERROR: TmThreadsCreate failed\n");
190  exit(1);
191  }
192  if (TmThreadSpawn(tv_flowmgr) != TM_ECODE_OK) {
193  printf("ERROR: TmThreadSpawn failed\n");
194  exit(1);
195  }
196 #endif
197 }
198 
200 {
201 #ifndef OS_WIN32
202  for (int i = 0; i < g_bypassed_update_max_index; i++) {
203  if (updatefunclist[i].Func(f, p, updatefunclist[i].data)) {
204  return;
205  }
206  }
207 #endif
208 }
209 
211 {
212 #ifndef OS_WIN32
213  tmm_modules[TMM_BYPASSEDFLOWMANAGER].name = "BypassedFlowManager";
214  tmm_modules[TMM_BYPASSEDFLOWMANAGER].ThreadInit = BypassedFlowManagerThreadInit;
215  tmm_modules[TMM_BYPASSEDFLOWMANAGER].ThreadDeinit = BypassedFlowManagerThreadDeinit;
216  tmm_modules[TMM_BYPASSEDFLOWMANAGER].Management = BypassedFlowManager;
219  SCLogDebug("%s registered", tmm_modules[TMM_BYPASSEDFLOWMANAGER].name);
220 #endif
221 }
222 
#define SCLogDebug(...)
Definition: util-debug.h:335
BypassedUpdateFuncItem updatefunclist[BYPASSFUNCMAX]
Definition: flow-bypass.c:58
uint8_t cap_flags
Definition: tm-modules.h:67
#define BUG_ON(x)
uint8_t flags
Definition: tm-modules.h:70
int g_bypassed_func_max_index
Definition: flow-bypass.c:49
struct BypassedFlowManagerThreadData_ BypassedFlowManagerThreadData
const char * thread_name_flow_bypass
Definition: runmodes.c:67
int(* BypassedCheckFuncInit)(ThreadVars *th_v, struct timespec *curtime, void *data)
Definition: flow-bypass.h:36
uint64_t count
Definition: flow-bypass.h:28
int(* BypassedCheckFunc)(ThreadVars *th_v, struct flows_stats *bypassstats, struct timespec *curtime, void *data)
Definition: flow-bypass.h:33
struct BypassedCheckFuncItem_ BypassedCheckFuncItem
BypassedCheckFuncItem bypassedfunclist[BYPASSFUNCMAX]
Definition: flow-bypass.c:50
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:931
int(* BypassedUpdateFunc)(Flow *f, Packet *p, void *data)
Definition: flow-bypass.h:38
struct BypassedUpdateFuncItem_ BypassedUpdateFuncItem
#define SCCalloc(nm, a)
Definition: util-mem.h:253
int BypassedFlowManagerRegisterCheckFunc(BypassedCheckFunc CheckFunc, BypassedCheckFuncInit CheckFuncInit, void *data)
Definition: flow-bypass.c:143
TmEcode(* Management)(ThreadVars *, void *)
Definition: tm-modules.h:59
#define TM_FLAG_MANAGEMENT_TM
Definition: tm-modules.h:36
#define BYPASSFUNCMAX
Definition: flow-bypass.c:41
#define FLOW_BYPASS_DELAY
Definition: flow-bypass.c:33
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
ThreadVars * TmThreadCreateMgmtThreadByName(const char *name, const char *module, int mucond)
Creates and returns the TV instance for a Management thread(MGMT). This function supports only custom...
Definition: tm-threads.c:1283
BypassedCheckFunc Func
Definition: flow-bypass.c:44
BypassedCheckFuncInit FuncInit
Definition: flow-bypass.c:45
#define THV_KILL
Definition: threadvars.h:39
void BypassedFlowManagerThreadSpawn()
spawn the flow bypass manager thread
Definition: flow-bypass.c:176
int BypassedFlowManagerRegisterUpdateFunc(BypassedUpdateFunc UpdateFunc, void *data)
Definition: flow-bypass.c:158
const char * name
Definition: tm-modules.h:44
#define SCFree(a)
Definition: util-mem.h:322
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.h:73
int g_bypassed_update_max_index
Definition: flow-bypass.c:57
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:136
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
uint64_t bytes
Definition: flow-bypass.h:30
int TmThreadsCheckFlag(ThreadVars *tv, uint16_t flag)
Check if a thread flag is set.
Definition: tm-threads.c:90
#define StatsSyncCounters(tv)
Definition: counters.h:133
BypassedUpdateFunc Func
Definition: flow-bypass.c:53
void TmModuleBypassedFlowManagerRegister(void)
Definition: flow-bypass.c:210
Per thread variable structure.
Definition: threadvars.h:57
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:142
void BypassedFlowUpdate(Flow *f, Packet *p)
Definition: flow-bypass.c:199
TmEcode TmThreadSpawn(ThreadVars *tv)
Spawns a thread associated with the ThreadVars instance tv.
Definition: tm-threads.c:1855
Flow data structure.
Definition: flow.h:325
uint64_t packets
Definition: flow-bypass.h:29