suricata
runmode-nflog.c
Go to the documentation of this file.
1 /* Copyright (C) 2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Giuseppe Longo <giuseppelng@gmail.com>
22  */
23 #include "suricata-common.h"
24 #include "config.h"
25 #include "tm-threads.h"
26 #include "conf.h"
27 #include "runmodes.h"
28 #include "runmode-nflog.h"
29 
30 #include "util-debug.h"
31 #include "util-device.h"
32 #include "util-runmodes.h"
33 #include "util-misc.h"
34 
35 #include "source-nflog.h"
36 
38 {
39  return "autofp";
40 }
41 
43 {
45  "Multi threaded nflog mode",
48  "Single threaded nflog mode",
51  "Workers nflog mode",
53  return;
54 }
55 
56 #ifdef HAVE_NFLOG
57 static void NflogDerefConfig(void *data)
58 {
59  NflogGroupConfig *nflogconf = (NflogGroupConfig *)data;
60  SCFree(nflogconf);
61 }
62 
63 static void *ParseNflogConfig(const char *group)
64 {
65  ConfNode *group_root;
66  ConfNode *group_default = NULL;
67  ConfNode *nflog_node;
68  NflogGroupConfig *nflogconf = SCMalloc(sizeof(*nflogconf));
69  intmax_t bufsize;
70  intmax_t bufsize_max;
71  intmax_t qthreshold;
72  intmax_t qtimeout;
73  int boolval;
74 
75  if (unlikely(nflogconf == NULL))
76  return NULL;
77 
78  if (group == NULL) {
79  SCFree(nflogconf);
80  return NULL;
81  }
82 
83  nflogconf->DerefFunc = NflogDerefConfig;
84  nflog_node = ConfGetNode("nflog");
85 
86  if (nflog_node == NULL) {
87  SCLogInfo("Unable to find nflog config using default value");
88  return nflogconf;
89  }
90 
91  group_root = ConfNodeLookupKeyValue(nflog_node, "group", group);
92 
93  group_default = ConfNodeLookupKeyValue(nflog_node, "group", "default");
94 
95  if (group_root == NULL && group_default == NULL) {
96  SCLogInfo("Unable to find nflog config for "
97  "group \"%s\" or \"default\", using default value",
98  group);
99  return nflogconf;
100  }
101 
102  nflogconf->nful_overrun_warned = 0;
103  strlcpy(nflogconf->numgroup, group, sizeof(nflogconf->numgroup));
104 
105  if (ParseSizeStringU16(group, &nflogconf->group) < 0) {
106  FatalError(SC_ERR_FATAL, "NFLOG's group number invalid.");
107  }
108 
109  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
110  "buffer-size", &bufsize);
111 
112  if (boolval)
113  nflogconf->nlbufsiz = bufsize;
114  else {
115  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid buffer-size value");
116  SCFree(nflogconf);
117  return NULL;
118  }
119 
120  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
121  "max-size", &bufsize_max);
122 
123  if (boolval)
124  nflogconf->nlbufsiz_max = bufsize_max;
125  else {
126  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid max-size value");
127  SCFree(nflogconf);
128  return NULL;
129  }
130 
131  if (nflogconf->nlbufsiz > nflogconf->nlbufsiz_max) {
132  SCLogWarning(SC_ERR_INVALID_ARGUMENT, "buffer-size value larger "
133  "than max-size value, adjusting buffer-size");
134  nflogconf->nlbufsiz = nflogconf->nlbufsiz_max;
135  }
136 
137  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
138  "qthreshold", &qthreshold);
139 
140  if (boolval)
141  nflogconf->qthreshold = qthreshold;
142  else {
143  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid qthreshold value");
144  SCFree(nflogconf);
145  return NULL;
146  }
147 
148  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
149  "qtimeout", &qtimeout);
150 
151  if (boolval)
152  nflogconf->qtimeout = qtimeout;
153  else {
154  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid qtimeout value");
155  SCFree(nflogconf);
156  return NULL;
157  }
158 
159  return nflogconf;
160 }
161 
162 static int NflogConfigGeThreadsCount(void *conf)
163 {
164  /* for each nflog group there is no reason to use more than 1 thread */
165  return 1;
166 }
167 #endif
168 
170 {
171  SCEnter();
172 
173 #ifdef HAVE_NFLOG
174  int ret = 0;
175  char *live_dev = NULL;
176 
178  TimeModeSetLive();
179 
180  ret = RunModeSetLiveCaptureAutoFp(ParseNflogConfig,
181  NflogConfigGeThreadsCount,
182  "ReceiveNFLOG",
183  "DecodeNFLOG",
185  live_dev);
186  if (ret != 0) {
187  FatalError(SC_ERR_FATAL, "Unable to start runmode");
188  }
189 
190  SCLogInfo("RunModeIdsNflogAutoFp initialised");
191 #endif /* HAVE_NFLOG */
192 
193  SCReturnInt(0);
194 }
195 
197 {
198  SCEnter();
199 
200 #ifdef HAVE_NFLOG
201  int ret = 0;
202  char *live_dev = NULL;
203 
205  TimeModeSetLive();
206 
207  ret = RunModeSetLiveCaptureSingle(ParseNflogConfig,
208  NflogConfigGeThreadsCount,
209  "ReceiveNFLOG",
210  "DecodeNFLOG",
212  live_dev);
213  if (ret != 0) {
214  FatalError(SC_ERR_FATAL, "Unable to start runmode");
215  }
216 
217  SCLogInfo("RunModeIdsNflogSingle initialised");
218 #endif /* HAVE_NFLOG */
219 
220  SCReturnInt(0);
221 }
222 
224 {
225  SCEnter();
226 
227 #ifdef HAVE_NFLOG
228  int ret = 0;
229  char *live_dev = NULL;
230 
232  TimeModeSetLive();
233 
234  ret = RunModeSetLiveCaptureWorkers(ParseNflogConfig,
235  NflogConfigGeThreadsCount,
236  "ReceiveNFLOG",
237  "DecodeNFLOG",
239  live_dev);
240  if (ret != 0) {
241  FatalError(SC_ERR_FATAL, "Unable to start runmode");
242  }
243 
244  SCLogInfo("RunModeIdsNflogWorkers initialised");
245 #endif /* HAVE_NFLOG */
246 
247  SCReturnInt(0);
248 }
thread_name_workers
const char * thread_name_workers
Definition: runmodes.c:63
tm-threads.h
source-nflog.h
RunModeSetLiveCaptureWorkers
int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:341
ParseSizeStringU16
int ParseSizeStringU16(const char *size, uint16_t *res)
Definition: util-misc.c:169
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:175
RunModeInitialize
void RunModeInitialize(void)
Definition: runmodes.c:904
util-runmodes.h
thread_name_autofp
const char * thread_name_autofp
Definition: runmodes.c:61
RUNMODE_NFLOG
@ RUNMODE_NFLOG
Definition: runmodes.h:33
RunModeIdsNflogGetDefaultMode
const char * RunModeIdsNflogGetDefaultMode(void)
Definition: runmode-nflog.c:37
ConfNodeLookupKeyValue
ConfNode * ConfNodeLookupKeyValue(const ConfNode *base, const char *key, const char *value)
Lookup for a key value under a specific node.
Definition: conf.c:859
RunModeIdsNflogAutoFp
int RunModeIdsNflogAutoFp(void)
Definition: runmode-nflog.c:169
NflogGroupConfig_::numgroup
char numgroup[NFLOG_GROUP_NAME_LENGTH]
Definition: source-nflog.h:47
ConfGetChildValueIntWithDefault
int ConfGetChildValueIntWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, intmax_t *val)
Definition: conf.c:494
thread_name_single
const char * thread_name_single
Definition: runmodes.c:62
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
RunModeSetLiveCaptureAutoFp
int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:89
RunModeIdsNflogSingle
int RunModeIdsNflogSingle(void)
Definition: runmode-nflog.c:196
util-device.h
util-debug.h
RunModeIdsNflogWorkers
int RunModeIdsNflogWorkers(void)
Definition: runmode-nflog.c:223
RunModeIdsNflogRegister
void RunModeIdsNflogRegister(void)
Definition: runmode-nflog.c:42
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
SC_ERR_INVALID_ARGUMENT
@ SC_ERR_INVALID_ARGUMENT
Definition: util-error.h:43
NflogGroupConfig_::qtimeout
uint32_t qtimeout
Definition: source-nflog.h:44
conf.h
runmodes.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
TimeModeSetLive
void TimeModeSetLive(void)
Definition: util-time.c:97
group
uint8_t group
Definition: app-layer-dnp3.h:0
suricata-common.h
RunModeRegisterNewRunMode
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void))
Registers a new runmode.
Definition: runmodes.c:416
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
NflogGroupConfig_::DerefFunc
void(* DerefFunc)(void *)
Definition: source-nflog.h:51
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
NflogGroupConfig_::group
uint16_t group
Definition: source-nflog.h:36
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
NflogGroupConfig_::qthreshold
uint32_t qthreshold
Definition: source-nflog.h:42
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
NflogGroupConfig_::nful_overrun_warned
int nful_overrun_warned
Definition: source-nflog.h:49
RunModeSetLiveCaptureSingle
int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:375
runmode-nflog.h
NflogGroupConfig_
Definition: source-nflog.h:34
util-misc.h
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
NflogGroupConfig_::nlbufsiz_max
uint32_t nlbufsiz_max
Definition: source-nflog.h:40
NflogGroupConfig_::nlbufsiz
uint32_t nlbufsiz
Definition: source-nflog.h:38