Go to the documentation of this file.
69 static bool AFPRunModeIsIPS(
void)
76 if (af_packet_node == NULL) {
77 SCLogConfig(
"no 'af-packet' section in the yaml, default to IDS");
83 for (
int ldev = 0; ldev < nlive; ldev++) {
85 if (live_dev == NULL) {
86 SCLogConfig(
"invalid livedev at index %d, default to IDS", ldev);
90 if (if_root == NULL) {
91 if (if_default == NULL) {
93 "no 'af-packet' section for '%s' or 'default' in the yaml, default to IDS",
100 const char *copymodestr = NULL;
101 const char *copyifacestr = NULL;
104 if (strcmp(copymodestr,
"ips") == 0) {
114 if (has_ids && has_ips) {
115 SCLogError(
"using both IPS and TAP/IDS mode is not allowed due to undefined behavior. See "
123 static int AFPRunModeEnableIPS(
void)
125 bool r = AFPRunModeIsIPS();
138 "Workers af-packet mode, each thread does all"
139 " tasks from acquisition to logging",
142 "Multi socket AF_PACKET mode. Packets from "
143 "each flow are assigned to a single detect "
149 #ifdef HAVE_AF_PACKET
151 static void AFPDerefConfig(
void *conf)
162 static int cluster_id_auto = 1;
174 static void *ParseAFPConfig(
const char *iface)
176 const char *threadsstr = NULL;
180 const char *tmpclusterid;
181 const char *tmpctype;
182 const char *copymodestr;
185 const char *out_iface = NULL;
187 const char *ebpf_file = NULL;
220 #ifdef HAVE_PACKET_EBPF
226 if (af_packet_node == NULL) {
227 SCLogInfo(
"%s: unable to find af-packet config using default values", iface);
234 if (if_root == NULL && if_default == NULL) {
235 SCLogInfo(
"%s: unable to find af-packet config for "
236 "interface \"%s\" or \"default\", using default values",
242 if (if_root == NULL) {
243 if_root = if_default;
247 if (active_runmode && !strcmp(
"single", active_runmode)) {
252 if (threadsstr != NULL) {
253 if (strcmp(threadsstr,
"auto") == 0) {
258 "threads, resetting to default",
267 if (out_iface != NULL) {
268 if (strlen(out_iface) > 0) {
270 if (strcmp(iface, out_iface) == 0) {
272 "Invalid config: interface (%s) and copy-iface (%s) can't be the same",
277 SCLogWarning(
"copy-iface corresponding to %s interface cannot be NULL", iface);
295 SCLogWarning(
"%s: copy mode activated but no destination"
296 " iface. Disabling feature",
298 }
else if (strlen(copymodestr) <= 0) {
300 }
else if (strcmp(copymodestr,
"ips") == 0) {
303 }
else if (strcmp(copymodestr,
"tap") == 0) {
317 SCLogWarning(
"%s: tpacket v3 is only implemented for 'workers' runmode."
318 " Switching to tpacket v2.",
333 SCLogWarning(
"%s: using tpacket-v3 in IPS or TAP mode will result in high latency", iface);
337 aconf->
cluster_id = (uint16_t)(cluster_id_auto++);
340 SCLogWarning(
"%s: invalid cluster_id, resetting to 0", iface);
347 SCLogConfig(
"%s: using default cluster-type of \"cluster_flow\"", aconf->
iface);
348 tmpctype =
"cluster_flow";
351 if (strcmp(tmpctype,
"cluster_rollover") == 0) {
353 "%s: cluster_rollover deprecated; using \"cluster_flow\" instead. See ticket #6128",
355 tmpctype =
"cluster_flow";
358 if (strcmp(tmpctype,
"cluster_round_robin") == 0) {
359 SCLogConfig(
"%s: using round-robin cluster mode for AF_PACKET", aconf->
iface);
362 }
else if (strcmp(tmpctype,
"cluster_flow") == 0) {
370 SCLogConfig(
"%s: using defrag kernel functionality for AF_PACKET", aconf->
iface);
376 SCLogConfig(
"%s: enabling defrag for AF_PACKET cluster_flow", aconf->
iface);
382 }
else if (strcmp(tmpctype,
"cluster_cpu") == 0) {
386 }
else if (strcmp(tmpctype,
"cluster_qm") == 0) {
387 SCLogConfig(
"%s: using queue based cluster mode for AF_PACKET", aconf->
iface);
390 }
else if (strcmp(tmpctype,
"cluster_random") == 0) {
391 SCLogConfig(
"%s: using random based cluster mode for AF_PACKET", aconf->
iface);
394 #ifdef HAVE_PACKET_EBPF
395 }
else if (strcmp(tmpctype,
"cluster_ebpf") == 0) {
396 SCLogInfo(
"%s: using ebpf based cluster mode for AF_PACKET", aconf->
iface);
398 cluster_type = PACKET_FANOUT_EBPF;
407 SCLogConfig(
"%s: Rollover requested for AF_PACKET but ignored -- see ticket #6128.",
409 SCLogWarning(
"%s: rollover option has been deprecated and will be ignored as it can cause "
411 "tracking issues; see ticket #6128.",
420 #ifdef HAVE_PACKET_EBPF
421 SCLogConfig(
"%s: af-packet will use '%s' as eBPF load balancing file", iface, ebpf_file);
423 aconf->ebpf_t_config.
flags |= EBPF_SOCKET_FILTER;
427 #ifdef HAVE_PACKET_EBPF
432 aconf->ebpf_t_config.
flags |= EBPF_PINNED_MAPS;
434 const char *pinned_maps_name = NULL;
437 &pinned_maps_name) != 1) {
438 aconf->ebpf_t_config.pinned_maps_name = pinned_maps_name;
440 aconf->ebpf_t_config.pinned_maps_name = NULL;
443 aconf->ebpf_t_config.pinned_maps_name = NULL;
447 #ifdef HAVE_PACKET_EBPF
449 if (aconf->
ebpf_lb_file && cluster_type == PACKET_FANOUT_EBPF) {
452 &aconf->ebpf_t_config);
459 SCLogError(
"%s: eBPF support is not built-in", iface);
466 #ifdef HAVE_PACKET_EBPF
467 SCLogConfig(
"%s: af-packet will use '%s' as eBPF filter file", iface, ebpf_file);
469 aconf->ebpf_t_config.mode = AFP_MODE_EBPF_BYPASS;
470 aconf->ebpf_t_config.
flags |= EBPF_SOCKET_FILTER;
474 #ifdef HAVE_PACKET_EBPF
475 SCLogConfig(
"%s: using bypass kernel functionality for AF_PACKET", aconf->
iface);
479 SCLogError(
"%s: bypass set but eBPF support is not built-in", iface);
486 #ifdef HAVE_PACKET_EBPF
489 &aconf->ebpf_t_config);
491 SCLogWarning(
"%s: failed to load eBPF filter file", iface);
494 SCLogError(
"%s: eBPF support is not built-in", iface);
501 #ifdef HAVE_PACKET_XDP
502 aconf->ebpf_t_config.mode = AFP_MODE_XDP_BYPASS;
503 aconf->ebpf_t_config.
flags |= EBPF_XDP_CODE;
507 SCLogConfig(
"%s: using bypass kernel functionality for AF_PACKET", aconf->
iface);
510 if (aconf->ebpf_t_config.
flags & EBPF_PINNED_MAPS) {
512 struct ebpf_timeout_config *ebt =
SCCalloc(1,
sizeof(
struct ebpf_timeout_config));
514 SCLogError(
"%s: flow bypass alloc error", iface);
516 memcpy(ebt, &(aconf->ebpf_t_config),
sizeof(
struct ebpf_timeout_config));
518 EBPFCheckBypassedFlowCreate,
525 SCLogWarning(
"%s: XDP filter set but XDP support is not built-in", iface);
527 #ifdef HAVE_PACKET_XDP
528 const char *xdp_mode;
530 aconf->
xdp_mode = XDP_FLAGS_SKB_MODE;
532 if (!strcmp(xdp_mode,
"soft")) {
533 aconf->
xdp_mode = XDP_FLAGS_SKB_MODE;
534 }
else if (!strcmp(xdp_mode,
"driver")) {
535 aconf->
xdp_mode = XDP_FLAGS_DRV_MODE;
536 }
else if (!strcmp(xdp_mode,
"hw")) {
537 aconf->
xdp_mode = XDP_FLAGS_HW_MODE;
538 aconf->ebpf_t_config.
flags |= EBPF_XDP_HW_MODE;
549 aconf->ebpf_t_config.cpus_count = 1;
557 #ifdef HAVE_PACKET_XDP
560 &aconf->ebpf_t_config);
563 SCLogInfo(
"%s: loaded pinned maps from sysfs", iface);
566 SCLogWarning(
"%s: failed to load XDP filter file", iface);
576 "xdp-cpu-redirect", &cpuset) == 1) {
580 SCLogError(
"Previously found node has disappeared");
582 EBPFBuildCPUSet(node, aconf->
iface);
586 EBPFBuildCPUSet(NULL, aconf->
iface);
595 SCLogError(
"%s: XDP support is not built-in", iface);
609 if (value % getpagesize()) {
610 SCLogWarning(
"%s: block-size %" PRIuMAX
" must be a multiple of pagesize (%u).", iface,
611 value, getpagesize());
624 if (value % getpagesize()) {
625 SCLogWarning(
"%s: v2-block-size %" PRIuMAX
" must be a multiple of pagesize (%u).",
626 iface, value, getpagesize());
639 if (strcmp(tmpctype,
"auto") == 0) {
645 }
else if (strcmp(tmpctype,
"kernel") == 0) {
659 SCLogNotice(
"%s: fanout not supported on this system, falling "
660 "back to 1 capture thread",
672 SCLogPerf(
"%s: cluster_flow: %u cores, using %u threads", iface, aconf->
threads,
678 if (rss_queues > 0) {
680 SCLogPerf(
"%s: cluster_qm: %d RSS queues, using %u threads", iface, rss_queues,
698 SCLogWarning(
"%s: inefficient setup: ring-size < max_pending_packets. "
699 "Resetting to decent value %d.",
718 "%s: using AF_PACKET with offloads enabled leads to capture problems",
730 if (active_runmode == NULL || strcmp(
"workers", active_runmode) != 0) {
739 "%s: AF_PACKET defrag is not recommended for inline use, please disable", iface);
745 SCLogWarning(
"%s: AF_PACKET defrag is recommended for IDS cluster_flow", iface);
752 SCLogWarning(
"%s: AF_PACKET v2-block-size is not large enough for max fragmented IP packet "
761 SCLogWarning(
"%s: AF_PACKET block-size is not large enough for max fragmented IP packet "
768 SCLogWarning(
"%s: AF_PACKET tpacket-v3 is recommended for non-inline operation", iface);
774 static int AFPConfigGeThreadsCount(
void *conf)
787 #ifdef HAVE_AF_PACKET
789 const char *live_dev = NULL;
793 (void)
ConfGet(
"af-packet.live-interface", &live_dev);
809 FatalError(
"Some IPS capture threads did not peer.");
812 SCLogDebug(
"RunModeIdsAFPAutoFp initialised");
824 #ifdef HAVE_AF_PACKET
826 const char *live_dev = NULL;
830 (void)
ConfGet(
"af-packet.live-interface", &live_dev);
837 AFPConfigGeThreadsCount,
847 FatalError(
"Some IPS capture threads did not peer.");
850 SCLogDebug(
"RunModeIdsAFPSingle initialised");
865 #ifdef HAVE_AF_PACKET
867 const char *live_dev = NULL;
871 (void)
ConfGet(
"af-packet.live-interface", &live_dev);
885 FatalError(
"Some IPS capture threads did not peer.");
888 SCLogDebug(
"RunModeIdsAFPWorkers initialised");
const char * thread_name_workers
ChecksumValidationMode checksum_mode
#define PACKET_FANOUT_FLAG_DEFRAG
int RunModeIdsAFPWorkers(void)
Workers version of the AF_PACKET processing.
int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
#define AFP_COPY_MODE_NONE
int RunModeIdsAFPSingle(void)
Single thread version of the AF_PACKET processing.
void RunModeIdsAFPRegister(void)
int ConfGetChildValueBoolWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, int *val)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
#define PACKET_FANOUT_RND
uint16_t UtilCpuGetNumProcessorsConfigured(void)
Get the number of cpus configured in the system.
#define PACKET_FANOUT_HASH
TmEcode AFPPeersListInit(void)
Init the global list of AFPPeer.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
const char * RunModeAFPGetDefaultMode(void)
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
const char * thread_name_autofp
ConfNode * ConfNodeLookupKeyValue(const ConfNode *base, const char *key, const char *value)
Lookup for a key value under a specific node.
@ CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_KERNEL
char * RunmodeGetActive(void)
int StringParseInt32(int32_t *res, int base, size_t len, const char *str)
int ConfGetChildValueIntWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, intmax_t *val)
const char * thread_name_single
ConfNode * ConfGetChildWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name)
int AFPGetLinkType(const char *ifname)
TmEcode AFPPeersListCheck(void)
Check that all AFPPeer got a peer.
int ConfValIsTrue(const char *val)
Check if a value is true.
#define AFP_BLOCK_SIZE_DEFAULT_ORDER
size_t strlcpy(char *dst, const char *src, size_t siz)
int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
@ CHECKSUM_VALIDATION_ENABLE
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
@ CHECKSUM_VALIDATION_AUTO
const char * ebpf_filter_file
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), int(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
void RunModeEnablesBypassManager(void)
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
int GetIfaceRSSQueuesNum(const char *dev)
ConfNode * ConfFindDeviceConfig(ConfNode *node, const char *iface)
Find the configuration node for a specific device.
#define PACKET_FANOUT_CPU
void EngineModeSetIPS(void)
int ConfGetChildValueWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, const char **vptr)
void(* DerefFunc)(void *)
#define SCLogWarning(...)
Macro used to log WARNING messages.
#define AFP_COPY_MODE_TAP
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
int GetIfaceOffloading(const char *dev, int csum, int other)
output offloading status of the link
int DisableIfaceOffloading(LiveDevice *dev, int csum, int other)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
uint32_t max_pending_packets
int ConfGetChildValue(const ConfNode *base, const char *name, const char **vptr)
void TimeModeSetLive(void)
void ConfSetBPFFilter(ConfNode *if_root, ConfNode *if_default, const char *iface, const char **bpf_filter)
const char * LiveGetDeviceName(int number)
Get a pointer to the device name at idx.
const char * xdp_filter_file
int RunModeIdsAFPAutoFp(void)
#define SC_ATOMIC_RESET(name)
wrapper for reinitializing an atomic variable.
int BypassedFlowManagerRegisterUpdateFunc(BypassedUpdateFunc UpdateFunc, void *data)
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
#define SCLogError(...)
Macro used to log ERROR messages.
#define AFP_COPY_MODE_IPS
int ConfValIsFalse(const char *val)
Check if a value is false.
int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
char iface[AFP_IFACE_NAME_LENGTH]
int LiveGetDeviceCount(void)
Get the number of registered devices.
uint16_t UtilCpuGetNumProcessorsOnline(void)
Get the number of cpus online in the system.
const char * ebpf_lb_file
#define SCLogNotice(...)
Macro used to log NOTICE messages.
int BypassedFlowManagerRegisterCheckFunc(BypassedCheckFunc CheckFunc, BypassedCheckFuncInit CheckFuncInit, void *data)
int AFPIsFanoutSupported(uint16_t cluster_id)
test if we can use FANOUT. Older kernels like those in CentOS6 have HAVE_PACKET_FANOUT defined but fa...
#define LINKTYPE_ETHERNET
#define AFP_EMERGENCY_MODE