suricata
AF_PACKET running mode
Collaboration diagram for AF_PACKET running mode:

Modules

 AFP peers list
 

Files

file  runmode-af-packet.c
 
file  source-af-packet.c
 
file  util-ebpf.c
 

Data Structures

struct  bpf_program
 
union  thdr
 
struct  AFPThreadVars_
 Structure to hold thread specific variables. More...
 

Macros

#define PCAP_DONT_INCLUDE_PCAP_BPF_H   1
 
#define SC_PCAP_DONT_INCLUDE_PCAP_H   1
 
#define AFP_IFACE_NAME_LENGTH   48
 
#define AFP_STATE_DOWN   0
 
#define AFP_STATE_UP   1
 
#define AFP_RECONNECT_TIMEOUT   500000
 
#define AFP_DOWN_COUNTER_INTERVAL   40
 
#define POLL_TIMEOUT   100
 
#define TP_STATUS_USER_BUSY   (1 << 31)
 
#define TP_STATUS_VLAN_VALID   (1 << 4)
 
#define MAX_MAPS   32
 

Typedefs

typedef struct AFPThreadVars_ AFPThreadVars
 Structure to hold thread specific variables. More...
 

Enumerations

enum  { AFP_READ_OK, AFP_READ_FAILURE, AFP_SURI_FAILURE, AFP_KERNEL_DROP }
 
enum  { AFP_FATAL_ERROR = 1, AFP_RECOVERABLE_ERROR }
 

Functions

TmEcode ReceiveAFP (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *)
 
TmEcode ReceiveAFPThreadInit (ThreadVars *tv, const void *initdata, void **data)
 Init function for ReceiveAFP. More...
 
void ReceiveAFPThreadExitStats (ThreadVars *tv, void *data)
 This function prints stats to the screen at exit. More...
 
TmEcode ReceiveAFPThreadDeinit (ThreadVars *tv, void *data)
 DeInit function closes af packet socket at exit. More...
 
TmEcode ReceiveAFPLoop (ThreadVars *tv, void *data, void *slot)
 Main AF_PACKET reading Loop function. More...
 
TmEcode DecodeAFPThreadInit (ThreadVars *, const void *, void **)
 
TmEcode DecodeAFPThreadDeinit (ThreadVars *tv, void *data)
 
TmEcode DecodeAFP (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 This function passes off to link type decoders. More...
 
TmEcode AFPSetBPFFilter (AFPThreadVars *ptv)
 
void TmModuleReceiveAFPRegister (void)
 Registration Function for RecieveAFP. More...
 
void TmModuleDecodeAFPRegister (void)
 Registration Function for DecodeAFP. More...
 
int AFPGetLinkType (const char *ifname)
 
int AFPIsFanoutSupported (void)
 test if we can use FANOUT. Older kernels like those in CentOS6 have HAVE_PACKET_FANOUT defined but fail to work More...
 

Variables

int max_pending_packets
 

Detailed Description

Macro Definition Documentation

#define AFP_DOWN_COUNTER_INTERVAL   40

Definition at line 166 of file source-af-packet.c.

Referenced by TmModuleDecodeAFPRegister().

#define AFP_IFACE_NAME_LENGTH   48

Definition at line 160 of file source-af-packet.c.

Referenced by AFPPeersListCheck(), and ReceiveAFPThreadInit().

#define AFP_RECONNECT_TIMEOUT   500000

Definition at line 165 of file source-af-packet.c.

Referenced by ReceiveAFPLoop().

#define AFP_STATE_DOWN   0
#define AFP_STATE_UP   1
#define MAX_MAPS   32

Definition at line 203 of file source-af-packet.c.

#define PCAP_DONT_INCLUDE_PCAP_BPF_H   1

Definition at line 33 of file source-af-packet.c.

#define POLL_TIMEOUT   100
#define SC_PCAP_DONT_INCLUDE_PCAP_H   1

Definition at line 34 of file source-af-packet.c.

#define TP_STATUS_USER_BUSY   (1 << 31)

Definition at line 172 of file source-af-packet.c.

Referenced by TmModuleDecodeAFPRegister().

#define TP_STATUS_VLAN_VALID   (1 << 4)

Definition at line 176 of file source-af-packet.c.

Referenced by TmModuleDecodeAFPRegister().

Typedef Documentation

typedef struct AFPThreadVars_ AFPThreadVars

Structure to hold thread specific variables.

Enumeration Type Documentation

anonymous enum
Enumerator
AFP_READ_OK 
AFP_READ_FAILURE 
AFP_SURI_FAILURE 

Error during treatment by other functions of Suricata

AFP_KERNEL_DROP 

Definition at line 179 of file source-af-packet.c.

anonymous enum
Enumerator
AFP_FATAL_ERROR 
AFP_RECOVERABLE_ERROR 

Definition at line 187 of file source-af-packet.c.

Function Documentation

TmEcode DecodeAFP ( ThreadVars tv,
Packet p,
void *  data,
PacketQueue pq,
PacketQueue postpq 
)

This function passes off to link type decoders.

DecodeAFP reads packets from the PacketQueue and passes them off to the proper link type decoder.

Parameters
tpointer to ThreadVars
ppointer to the current packet
datapointer that gets cast into AFPThreadVars for ptv
pqpointer to the current PacketQueue

Definition at line 2717 of file source-af-packet.c.

References DecodeThreadVars_::counter_vlan, Packet_::datalink, DecodeEthernet(), DecodeNull(), DecodePPP(), DecodeRaw(), DecodeSll(), DecodeUpdatePacketCounters(), Packet_::flags, GET_PKT_DATA, GET_PKT_LEN, LINKTYPE_ETHERNET, LINKTYPE_GRE_OVER_IP, LINKTYPE_LINUX_SLL, LINKTYPE_NULL, LINKTYPE_PPP, LINKTYPE_RAW, PacketDecodeFinalize(), PKT_PSEUDO_STREAM_END, SC_ERR_DATALINK_UNIMPLEMENTED, SCEnter, SCLogError, SCReturnInt, StatsIncr(), TM_ECODE_OK, and Packet_::vlan_idx.

Referenced by TmModuleDecodeAFPRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodeAFPThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 2780 of file source-af-packet.c.

References DecodeThreadVarsFree(), SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleDecodeAFPRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodeAFPThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Definition at line 2763 of file source-af-packet.c.

References DecodeRegisterPerfCounters(), DecodeThreadVarsAlloc(), SCEnter, SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleDecodeAFPRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceiveAFP ( ThreadVars ,
Packet ,
void *  ,
PacketQueue ,
PacketQueue  
)
TmEcode ReceiveAFPThreadDeinit ( ThreadVars tv,
void *  data 
)

DeInit function closes af packet socket at exit.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into AFPThreadVars for ptv

Definition at line 2679 of file source-af-packet.c.

References AFP_STATE_DOWN, AFP_TPACKET_V3, AFPThreadVars_::bpf_filter, AFPThreadVars_::data, AFPThreadVars_::datalen, AFPThreadVars_::flags, AFPThreadVars_::iface, AFPThreadVars_::ring, SCFree, SCReturnInt, TM_ECODE_OK, AFPThreadVars_::AFPRing::v2, AFPThreadVars_::AFPRing::v3, and AFPThreadVars_::xdp_mode.

Referenced by TmModuleReceiveAFPRegister().

Here is the caller graph for this function:

void ReceiveAFPThreadExitStats ( ThreadVars tv,
void *  data 
)

This function prints stats to the screen at exit.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into AFPThreadVars for ptv

Definition at line 2660 of file source-af-packet.c.

References AFPThreadVars_::capture_kernel_drops, AFPThreadVars_::capture_kernel_packets, ThreadVars_::name, SCEnter, SCLogPerf, and StatsGetLocalCounterValue().

Referenced by TmModuleReceiveAFPRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceiveAFPThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Init function for ReceiveAFP.

Parameters
tvpointer to ThreadVars
initdatapointer to the interface passed from the user
datapointer gets populated with AFPThreadVars
Todo:
Create a general AFP setup function.

Definition at line 2525 of file source-af-packet.c.

References AFP_BYPASS, AFP_COPY_MODE_NONE, AFP_IFACE_NAME_LENGTH, AFP_VLAN_DISABLED, AFP_XDPBYPASS, AFPIfaceConfig_::block_size, AFPThreadVars_::block_size, AFPIfaceConfig_::bpf_filter, AFPThreadVars_::bpf_filter, AFPIfaceConfig_::buffer_size, AFPThreadVars_::buffer_size, AFPThreadVars_::capture_errors, AFPThreadVars_::capture_kernel_drops, AFPThreadVars_::capture_kernel_packets, AFPIfaceConfig_::checksum_mode, AFPThreadVars_::checksum_mode, AFPIfaceConfig_::cluster_id, AFPThreadVars_::cluster_id, AFPIfaceConfig_::cluster_type, AFPThreadVars_::cluster_type, ConfGetBool(), AFPThreadVars_::cooked, AFPIfaceConfig_::copy_mode, AFPThreadVars_::copy_mode, AFPThreadVars_::data, AFPThreadVars_::datalen, AFPIfaceConfig_::DerefFunc, AFPIfaceConfig_::ebpf_filter_fd, AFPThreadVars_::ebpf_filter_fd, AFPIfaceConfig_::ebpf_lb_fd, AFPThreadVars_::ebpf_lb_fd, AFPIfaceConfig_::flags, AFPThreadVars_::flags, AFPIfaceConfig_::iface, AFPThreadVars_::iface, AFPThreadVars_::livedev, LiveGetDevice(), AFPIfaceConfig_::out_iface, AFPThreadVars_::out_iface, PACKET_FANOUT_LB, AFPIfaceConfig_::promisc, AFPThreadVars_::promisc, AFPIfaceConfig_::ring_size, AFPThreadVars_::ring_size, SC_ERR_INVALID_ARGUMENT, SC_ERR_INVALID_VALUE, SC_WARN_UNCOMMON, SCEnter, SCFree, SCKernelVersionIsAtLeast(), SCLogError, SCLogWarning, SCMalloc, SCReturnInt, StatsRegisterCounter(), strlcpy(), T_DATA_SIZE, AFPIfaceConfig_::threads, AFPThreadVars_::threads, TM_ECODE_FAILED, TM_ECODE_OK, AFPThreadVars_::tv, unlikely, AFPIfaceConfig_::xdp_mode, and AFPThreadVars_::xdp_mode.

Referenced by TmModuleReceiveAFPRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void TmModuleDecodeAFPRegister ( void  )

Registration Function for DecodeAFP.

Todo:
Unit tests are needed for this module.

Definition at line 544 of file source-af-packet.c.

References ACTION_DROP, AFP_BYPASS, AFP_COPY_MODE_IPS, AFP_COPY_MODE_NONE, AFP_DOWN_COUNTER_INTERVAL, AFP_EMERGENCY_MODE, AFP_KERNEL_DROP, AFP_READ_FAILURE, AFP_READ_OK, AFP_RING_MODE, AFP_SOCK_PROTECT, AFPThreadVars_::afp_state, AFP_STATE_DOWN, AFP_STATE_UP, AFP_SURI_FAILURE, AFP_TPACKET_V3, AFP_VLAN_DISABLED, AFP_XDPBYPASS, AFP_ZERO_COPY, AFPV_CLEANUP, BUG_ON, Packet_::BypassPacketsFlow, TmModule_::cap_flags, AFPThreadVars_::capture_kernel_drops, AFPThreadVars_::capture_kernel_packets, AFPThreadVars_::checksum_mode, CHECKSUM_VALIDATION_AUTO, CHECKSUM_VALIDATION_DISABLE, ChecksumAutoModeCheck(), AFPThreadVars_::cooked, AFPThreadVars_::copy_mode, AFPThreadVars_::data, AFPThreadVars_::datalen, AFPThreadVars_::datalink, Packet_::datalink, DecodeAFP(), DecodeAFPThreadDeinit(), DecodeAFPThreadInit(), AFPThreadVars_::down_count, Packet_::ethh, TmModule_::flags, AFPThreadVars_::flags, Packet_::flags, AFPThreadVars_::frame_offset, TmModule_::Func, GET_PKT_DATA, GET_PKT_LEN, thdr::h2, AFPPeer_::iface, AFPThreadVars_::iface, LiveDevice_::ignore_checksum, len, AFPThreadVars_::livedev, Packet_::livedev, AFPThreadVars_::mpeer, TmModule_::name, ThreadVars_::name, offset, PACKET_TEST_ACTION, PacketCopyData(), PacketFreeOrRelease(), PacketGetFromQueueOrAlloc(), PacketSetData(), AFPPeer_::peer, PKT_IGNORE_CHECKSUM, PKT_IS_PSEUDOPKT, PKT_SET_SRC, PKT_SRC_WIRE, AFPThreadVars_::pkts, POLL_TIMEOUT, thdr::raw, TmModule_::RegisterTests, Packet_::ReleasePacket, AFPThreadVars_::req, AFPThreadVars_::ring, AFPThreadVars_::ring_buf, AFPThreadVars_::ring_buflen, SC_ATOMIC_ADD, SC_ATOMIC_GET, SC_ATOMIC_SET, SC_ATOMIC_SUB, SC_ERR_AFP_CREATE, SC_ERR_AFP_READ, SC_ERR_INVALID_VALUE, SC_ERR_SOCKET, SCFree, SCLogDebug, SCLogInfo, SCLogWarning, SCMutexLock, SCMutexUnlock, SCReturnInt, SET_PKT_LEN, SLL_HEADER_LEN, AFPThreadVars_::slot, AFPThreadVars_::socket, StatsAddUI64(), suricata_ctl_flags, TmModule_::ThreadDeinit, TmModule_::ThreadExitPrintStats, TmModule_::ThreadInit, TM_ECODE_FAILED, TM_ECODE_OK, TM_FLAG_DECODE_TM, TMM_DECODEAFP, tmm_modules, TmqhOutputPacketpool(), TP_STATUS_USER_BUSY, TP_STATUS_VLAN_VALID, Packet_::ts, AFPThreadVars_::tv, unlikely, AFPThreadVars_::AFPRing::v2, AFPThreadVars_::AFPTpacketReq::v2, AFPThreadVars_::AFPRing::v3, version, VLAN_HEADER_LEN, Packet_::vlan_id, Packet_::vlan_idx, and Packet_::vlanh.

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

void TmModuleReceiveAFPRegister ( void  )

Variable Documentation

int max_pending_packets

Maximum packets to simultaneously process.

Definition at line 213 of file suricata.c.