suricata
runmode-erf-file.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "tm-threads.h"
20 #include "conf.h"
21 #include "runmodes.h"
22 #include "runmode-erf-file.h"
23 #include "output.h"
24 
25 #include "detect-engine.h"
26 
27 #include "util-debug.h"
28 #include "util-time.h"
29 #include "util-cpu.h"
30 #include "util-affinity.h"
31 
32 #include "util-runmodes.h"
33 
35 {
36  return "autofp";
37 }
38 
40 {
41  RunModeRegisterNewRunMode(RUNMODE_ERF_FILE, "single", "Single threaded ERF file mode",
42  RunModeErfFileSingle, NULL);
43 
45  "Multi threaded ERF file mode. Packets from "
46  "each flow are assigned to a single detect thread",
47  RunModeErfFileAutoFp, NULL);
48 
49  return;
50 }
51 
53 {
54  const char *file;
55 
56  SCEnter();
57 
58  if (ConfGet("erf-file.file", &file) == 0) {
59  FatalError("Failed to get erf-file.file from config.");
60  }
61 
63 
65 
66  /* Basically the same setup as PCAP files. */
67 
69  "packetpool", "packetpool",
70  "packetpool", "packetpool",
71  "pktacqloop");
72  if (tv == NULL) {
73  printf("ERROR: TmThreadsCreate failed\n");
74  exit(EXIT_FAILURE);
75  }
76 
77  TmModule *tm_module = TmModuleGetByName("ReceiveErfFile");
78  if (tm_module == NULL) {
79  printf("ERROR: TmModuleGetByName failed for ReceiveErfFile\n");
80  exit(EXIT_FAILURE);
81  }
82  TmSlotSetFuncAppend(tv, tm_module, file);
83 
84  tm_module = TmModuleGetByName("DecodeErfFile");
85  if (tm_module == NULL) {
86  printf("ERROR: TmModuleGetByName DecodeErfFile failed\n");
87  exit(EXIT_FAILURE);
88  }
89  TmSlotSetFuncAppend(tv, tm_module, NULL);
90 
91  tm_module = TmModuleGetByName("FlowWorker");
92  if (tm_module == NULL) {
93  FatalError("TmModuleGetByName for FlowWorker failed");
94  }
95  TmSlotSetFuncAppend(tv, tm_module, NULL);
96 
97  if (TmThreadSpawn(tv) != TM_ECODE_OK) {
98  printf("ERROR: TmThreadSpawn failed\n");
99  exit(EXIT_FAILURE);
100  }
101 
102  SCLogInfo("RunModeErfFileSingle initialised");
103 
104  SCReturnInt(0);
105 }
106 
108 {
109  SCEnter();
110  char tname[TM_THREAD_NAME_MAX];
111  char qname[TM_QUEUE_NAME_MAX];
112  uint16_t cpu = 0;
113  char *queues = NULL;
114  uint16_t thread;
115 
117 
118  const char *file = NULL;
119  if (ConfGet("erf-file.file", &file) == 0) {
120  FatalError("Failed retrieving erf-file.file from config");
121  }
122 
124 
125  /* Available cpus */
126  uint16_t ncpus = UtilCpuGetNumProcessorsOnline();
127 
128  /* start with cpu 1 so that if we're creating an odd number of detect
129  * threads we're not creating the most on CPU0. */
130  if (ncpus > 0)
131  cpu = 1;
132 
133  /* always create at least one thread */
134  int thread_max = TmThreadGetNbThreads(WORKER_CPU_SET);
135  if (thread_max == 0)
136  thread_max = ncpus * threading_detect_ratio;
137  if (thread_max < 1)
138  thread_max = 1;
139  if (thread_max > 1024)
140  thread_max = 1024;
141 
142  queues = RunmodeAutoFpCreatePickupQueuesString(thread_max);
143  if (queues == NULL) {
144  FatalError("RunmodeAutoFpCreatePickupQueuesString failed");
145  }
146 
147  /* create the threads */
148  ThreadVars *tv =
150  "packetpool", "packetpool",
151  queues, "flow",
152  "pktacqloop");
153  SCFree(queues);
154 
155  if (tv == NULL) {
156  printf("ERROR: TmThreadsCreate failed\n");
157  exit(EXIT_FAILURE);
158  }
159  TmModule *tm_module = TmModuleGetByName("ReceiveErfFile");
160  if (tm_module == NULL) {
161  printf("ERROR: TmModuleGetByName failed for ReceiveErfFile\n");
162  exit(EXIT_FAILURE);
163  }
164  TmSlotSetFuncAppend(tv, tm_module, file);
165 
166  tm_module = TmModuleGetByName("DecodeErfFile");
167  if (tm_module == NULL) {
168  printf("ERROR: TmModuleGetByName DecodeErfFile failed\n");
169  exit(EXIT_FAILURE);
170  }
171  TmSlotSetFuncAppend(tv, tm_module, NULL);
172 
175  if (ncpus > 1)
177  }
178 
179  if (TmThreadSpawn(tv) != TM_ECODE_OK) {
180  printf("ERROR: TmThreadSpawn failed\n");
181  exit(EXIT_FAILURE);
182  }
183 
184  for (thread = 0; thread < (uint16_t)thread_max; thread++) {
185  snprintf(tname, sizeof(tname), "%s#%02d", thread_name_workers, thread + 1);
186  snprintf(qname, sizeof(qname), "pickup%d", thread + 1);
187 
188  SCLogDebug("tname %s, qname %s", tname, qname);
189 
190  SCLogDebug("Assigning %s affinity to cpu %u", tname, cpu);
191 
192  ThreadVars *tv_detect_ncpu =
194  qname, "flow",
195  "packetpool", "packetpool",
196  "varslot");
197  if (tv_detect_ncpu == NULL) {
198  printf("ERROR: TmThreadsCreate failed\n");
199  exit(EXIT_FAILURE);
200  }
201 
202  tm_module = TmModuleGetByName("FlowWorker");
203  if (tm_module == NULL) {
204  FatalError("TmModuleGetByName for FlowWorker failed");
205  }
206  TmSlotSetFuncAppend(tv_detect_ncpu, tm_module, NULL);
207 
209  TmThreadSetCPUAffinity(tv_detect_ncpu, cpu);
210  /* If we have more than one core/cpu, the first Detect thread
211  * (at cpu 0) will have less priority (higher 'nice' value)
212  * In this case we will set the thread priority to +10 (default is 0)
213  */
214  if (cpu == 0 && ncpus > 1) {
215  TmThreadSetThreadPriority(tv_detect_ncpu, PRIO_LOW);
216  } else if (ncpus > 1) {
217  TmThreadSetThreadPriority(tv_detect_ncpu, PRIO_MEDIUM);
218  }
219  }
220 
221  TmThreadSetGroupName(tv_detect_ncpu, "Detect");
222 
223  if (TmThreadSpawn(tv_detect_ncpu) != TM_ECODE_OK) {
224  printf("ERROR: TmThreadSpawn failed\n");
225  exit(EXIT_FAILURE);
226  }
227 
228  if ((cpu + 1) == ncpus)
229  cpu = 0;
230  else
231  cpu++;
232  }
233 
234  SCLogInfo("RunModeErfFileAutoFp initialised");
235 
236  SCReturnInt(0);
237 }
thread_name_workers
const char * thread_name_workers
Definition: runmodes.c:81
TmThreadSetCPUAffinity
TmEcode TmThreadSetCPUAffinity(ThreadVars *tv, uint16_t cpu)
Set the thread options (cpu affinity).
Definition: tm-threads.c:802
tm-threads.h
TmThreadSpawn
TmEcode TmThreadSpawn(ThreadVars *tv)
Spawns a thread associated with the ThreadVars instance tv.
Definition: tm-threads.c:1646
detect-engine.h
RunModeErfFileRegister
void RunModeErfFileRegister(void)
Definition: runmode-erf-file.c:39
RunModeErfFileGetDefaultMode
const char * RunModeErfFileGetDefaultMode(void)
Definition: runmode-erf-file.c:34
TmThreadCreatePacketHandler
ThreadVars * TmThreadCreatePacketHandler(const char *name, const char *inq_name, const char *inqh_name, const char *outq_name, const char *outqh_name, const char *slots)
Creates and returns a TV instance for a Packet Processing Thread. This function doesn't support custo...
Definition: tm-threads.c:1032
TmThreadSetGroupName
void TmThreadSetGroupName(ThreadVars *tv, const char *name)
Definition: tm-threads.c:1603
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
RunModeInitialize
void RunModeInitialize(void)
Definition: runmodes.c:985
RUNMODE_ERF_FILE
@ RUNMODE_ERF_FILE
Definition: runmodes.h:35
runmode-erf-file.h
PRIO_MEDIUM
@ PRIO_MEDIUM
Definition: threads.h:89
util-runmodes.h
thread_name_autofp
const char * thread_name_autofp
Definition: runmodes.c:79
RunModeRegisterNewRunMode
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), void(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
Definition: runmodes.c:491
PRIO_LOW
@ PRIO_LOW
Definition: threads.h:88
TmThreadSetThreadPriority
TmEcode TmThreadSetThreadPriority(ThreadVars *tv, int prio)
Set the thread options (thread priority).
Definition: tm-threads.c:754
thread_name_single
const char * thread_name_single
Definition: runmodes.c:80
TM_THREAD_NAME_MAX
#define TM_THREAD_NAME_MAX
Definition: tm-threads.h:49
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
TmModuleGetByName
TmModule * TmModuleGetByName(const char *name)
get a tm module ptr by name
Definition: tm-modules.c:53
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
util-debug.h
RunmodeAutoFpCreatePickupQueuesString
char * RunmodeAutoFpCreatePickupQueuesString(int n)
create a queue string for autofp to pass to the flow queue handler.
Definition: util-runmodes.c:56
util-cpu.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
util-affinity.h
util-time.h
threading_set_cpu_affinity
int threading_set_cpu_affinity
Definition: runmodes.c:75
TM_QUEUE_NAME_MAX
#define TM_QUEUE_NAME_MAX
Definition: tm-threads.h:48
WORKER_CPU_SET
@ WORKER_CPU_SET
Definition: util-affinity.h:53
conf.h
runmodes.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
TmModule_
Definition: tm-modules.h:43
TmSlotSetFuncAppend
void TmSlotSetFuncAppend(ThreadVars *tv, TmModule *tm, const void *data)
Appends a new entry to the slots.
Definition: tm-threads.c:637
TimeModeSetOffline
void TimeModeSetOffline(void)
Definition: util-time.c:105
suricata-common.h
TmThreadGetNbThreads
int TmThreadGetNbThreads(uint8_t type)
Definition: tm-threads.c:827
RunModeErfFileSingle
int RunModeErfFileSingle(void)
Definition: runmode-erf-file.c:52
FatalError
#define FatalError(...)
Definition: util-debug.h:502
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
RunModeErfFileAutoFp
int RunModeErfFileAutoFp(void)
Definition: runmode-erf-file.c:107
SCFree
#define SCFree(p)
Definition: util-mem.h:61
UtilCpuGetNumProcessorsOnline
uint16_t UtilCpuGetNumProcessorsOnline(void)
Get the number of cpus online in the system.
Definition: util-cpu.c:108
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
threading_detect_ratio
float threading_detect_ratio
Definition: runmodes.c:980
output.h