suricata
AF_PACKET running mode
Collaboration diagram for AF_PACKET running mode:

Modules

 AFP peers list
 AF_PACKET has an IPS mode were interface are peered: packet from on interface are sent the peered interface and the other way. The AFPPeer list is maitaining the list of peers. Each AFPPeer is storing the needed information to be able to send packet on the interface. A element of the list must not be destroyed during the run of Suricata as it is used by Packet and other threads.
 

Files

file  runmode-af-packet.c
 
file  source-af-packet.c
 
file  util-ebpf.c
 

Data Structures

struct  bpf_program
 
union  thdr
 
struct  AFPThreadVars_
 Structure to hold thread specific variables. More...
 

Macros

#define PCAP_DONT_INCLUDE_PCAP_BPF_H   1
 
#define SC_PCAP_DONT_INCLUDE_PCAP_H   1
 
#define AFP_IFACE_NAME_LENGTH   48
 
#define AFP_STATE_DOWN   0
 
#define AFP_STATE_UP   1
 
#define AFP_RECONNECT_TIMEOUT   500000
 
#define AFP_DOWN_COUNTER_INTERVAL   40
 
#define POLL_TIMEOUT   100
 
#define TP_STATUS_USER_BUSY   (1 << 31)
 
#define TP_STATUS_VLAN_VALID   (1 << 4)
 
#define MAX_MAPS   32
 

Typedefs

typedef struct AFPThreadVars_ AFPThreadVars
 Structure to hold thread specific variables. More...
 

Enumerations

enum  { AFP_READ_OK, AFP_READ_FAILURE, AFP_SURI_FAILURE, AFP_KERNEL_DROP }
 
enum  { AFP_FATAL_ERROR = 1, AFP_RECOVERABLE_ERROR }
 

Functions

void TmModuleReceiveAFPRegister (void)
 Registration Function for RecieveAFP. More...
 
void TmModuleDecodeAFPRegister (void)
 Registration Function for DecodeAFP. More...
 
int AFPGetLinkType (const char *ifname)
 
int AFPIsFanoutSupported (int cluster_id)
 test if we can use FANOUT. Older kernels like those in CentOS6 have HAVE_PACKET_FANOUT defined but fail to work More...
 

Variables

int max_pending_packets
 
bool g_flowv4_ok = true
 
bool g_flowv6_ok = true
 

Detailed Description

Macro Definition Documentation

◆ AFP_DOWN_COUNTER_INTERVAL

#define AFP_DOWN_COUNTER_INTERVAL   40

Definition at line 171 of file source-af-packet.c.

◆ AFP_IFACE_NAME_LENGTH

#define AFP_IFACE_NAME_LENGTH   48

Definition at line 165 of file source-af-packet.c.

◆ AFP_RECONNECT_TIMEOUT

#define AFP_RECONNECT_TIMEOUT   500000

Definition at line 170 of file source-af-packet.c.

◆ AFP_STATE_DOWN

#define AFP_STATE_DOWN   0

Definition at line 167 of file source-af-packet.c.

◆ AFP_STATE_UP

#define AFP_STATE_UP   1

Definition at line 168 of file source-af-packet.c.

◆ MAX_MAPS

#define MAX_MAPS   32

Definition at line 208 of file source-af-packet.c.

◆ PCAP_DONT_INCLUDE_PCAP_BPF_H

#define PCAP_DONT_INCLUDE_PCAP_BPF_H   1

Definition at line 33 of file source-af-packet.c.

◆ POLL_TIMEOUT

#define POLL_TIMEOUT   100

Definition at line 173 of file source-af-packet.c.

◆ SC_PCAP_DONT_INCLUDE_PCAP_H

#define SC_PCAP_DONT_INCLUDE_PCAP_H   1

Definition at line 34 of file source-af-packet.c.

◆ TP_STATUS_USER_BUSY

#define TP_STATUS_USER_BUSY   (1 << 31)

Definition at line 177 of file source-af-packet.c.

◆ TP_STATUS_VLAN_VALID

#define TP_STATUS_VLAN_VALID   (1 << 4)

Definition at line 181 of file source-af-packet.c.

Typedef Documentation

◆ AFPThreadVars

typedef struct AFPThreadVars_ AFPThreadVars

Structure to hold thread specific variables.

Enumeration Type Documentation

◆ anonymous enum

anonymous enum
Enumerator
AFP_READ_OK 
AFP_READ_FAILURE 
AFP_SURI_FAILURE 

Error during treatment by other functions of Suricata

AFP_KERNEL_DROP 

Definition at line 184 of file source-af-packet.c.

◆ anonymous enum

anonymous enum
Enumerator
AFP_FATAL_ERROR 
AFP_RECOVERABLE_ERROR 

Definition at line 192 of file source-af-packet.c.

Function Documentation

◆ AFPGetLinkType()

int AFPGetLinkType ( const char *  ifname)

Definition at line 1692 of file source-af-packet.c.

References LINKTYPE_RAW, SC_ERR_AFP_CREATE, and SCLogError.

◆ AFPIsFanoutSupported()

int AFPIsFanoutSupported ( int  cluster_id)

test if we can use FANOUT. Older kernels like those in CentOS6 have HAVE_PACKET_FANOUT defined but fail to work

Definition at line 1994 of file source-af-packet.c.

References PACKET_FANOUT, PACKET_FANOUT_FLAG_DEFRAG, PACKET_FANOUT_HASH, SC_ERR_INVALID_VALUE, and SCLogError.

◆ TmModuleDecodeAFPRegister()

void TmModuleDecodeAFPRegister ( void  )

Registration Function for DecodeAFP.

Todo:
Unit tests are needed for this module.

Definition at line 549 of file source-af-packet.c.

References TmModule_::name, TmModule_::ThreadInit, TMM_DECODEAFP, and tmm_modules.

Referenced by RegisterAllModules().

Here is the caller graph for this function:

◆ TmModuleReceiveAFPRegister()

void TmModuleReceiveAFPRegister ( void  )

Registration Function for RecieveAFP.

Todo:
Unit tests are needed for this module.

Definition at line 326 of file source-af-packet.c.

References TmModule_::name, TmModule_::ThreadInit, tmm_modules, and TMM_RECEIVEAFP.

Referenced by RegisterAllModules().

Here is the caller graph for this function:

Variable Documentation

◆ g_flowv4_ok

bool g_flowv4_ok = true

Definition at line 2676 of file source-af-packet.c.

◆ g_flowv6_ok

bool g_flowv6_ok = true

Definition at line 2677 of file source-af-packet.c.

◆ max_pending_packets

int max_pending_packets

Maximum packets to simultaneously process.

Definition at line 212 of file suricata.c.