suricata
runmode-nflog.c
Go to the documentation of this file.
1 /* Copyright (C) 2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Giuseppe Longo <giuseppelng@gmail.com>
22  */
23 #include "suricata-common.h"
24 #include "config.h"
25 #include "tm-threads.h"
26 #include "conf.h"
27 #include "runmodes.h"
28 #include "runmode-nflog.h"
29 
30 #include "util-debug.h"
31 #include "util-device.h"
32 #include "util-runmodes.h"
33 #include "util-misc.h"
34 
35 #include "source-nflog.h"
36 
38 {
39  return "autofp";
40 }
41 
43 {
45  "Multi threaded nflog mode",
48  "Single threaded nflog mode",
51  "Workers nflog mode",
53  return;
54 }
55 
56 #ifdef HAVE_NFLOG
57 static void NflogDerefConfig(void *data)
58 {
59  NflogGroupConfig *nflogconf = (NflogGroupConfig *)data;
60  SCFree(nflogconf);
61 }
62 
63 static void *ParseNflogConfig(const char *group)
64 {
65  ConfNode *group_root;
66  ConfNode *group_default = NULL;
67  ConfNode *nflog_node;
68  NflogGroupConfig *nflogconf = SCMalloc(sizeof(*nflogconf));
69  intmax_t bufsize;
70  intmax_t bufsize_max;
71  intmax_t qthreshold;
72  intmax_t qtimeout;
73  int boolval;
74 
75  if (unlikely(nflogconf == NULL))
76  return NULL;
77 
78  if (group == NULL) {
79  SCFree(nflogconf);
80  return NULL;
81  }
82 
83  nflogconf->DerefFunc = NflogDerefConfig;
84  nflog_node = ConfGetNode("nflog");
85 
86  if (nflog_node == NULL) {
87  SCLogInfo("Unable to find nflog config using default value");
88  return nflogconf;
89  }
90 
91  group_root = ConfNodeLookupKeyValue(nflog_node, "group", group);
92 
93  group_default = ConfNodeLookupKeyValue(nflog_node, "group", "default");
94 
95  if (group_root == NULL && group_default == NULL) {
96  SCLogInfo("Unable to find nflog config for "
97  "group \"%s\" or \"default\", using default value",
98  group);
99  return nflogconf;
100  }
101 
102  nflogconf->nful_overrun_warned = 0;
103  strlcpy(nflogconf->numgroup, group, sizeof(nflogconf->numgroup));
104 
105  if (ParseSizeStringU16(group, &nflogconf->group) < 0) {
106  SCLogError(SC_ERR_NFLOG_GROUP, "NFLOG's group number invalid.");
107  exit(EXIT_FAILURE);
108  }
109 
110  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
111  "buffer-size", &bufsize);
112 
113  if (boolval)
114  nflogconf->nlbufsiz = bufsize;
115  else {
116  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid buffer-size value");
117  SCFree(nflogconf);
118  return NULL;
119  }
120 
121  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
122  "max-size", &bufsize_max);
123 
124  if (boolval)
125  nflogconf->nlbufsiz_max = bufsize_max;
126  else {
127  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid max-size value");
128  SCFree(nflogconf);
129  return NULL;
130  }
131 
132  if (nflogconf->nlbufsiz > nflogconf->nlbufsiz_max) {
133  SCLogWarning(SC_ERR_INVALID_ARGUMENT, "buffer-size value larger "
134  "than max-size value, adjusting buffer-size");
135  nflogconf->nlbufsiz = nflogconf->nlbufsiz_max;
136  }
137 
138  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
139  "qthreshold", &qthreshold);
140 
141  if (boolval)
142  nflogconf->qthreshold = qthreshold;
143  else {
144  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid qthreshold value");
145  SCFree(nflogconf);
146  return NULL;
147  }
148 
149  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
150  "qtimeout", &qtimeout);
151 
152  if (boolval)
153  nflogconf->qtimeout = qtimeout;
154  else {
155  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid qtimeout value");
156  SCFree(nflogconf);
157  return NULL;
158  }
159 
160  return nflogconf;
161 }
162 
163 static int NflogConfigGeThreadsCount(void *conf)
164 {
165  /* for each nflog group there is no reason to use more than 1 thread */
166  return 1;
167 }
168 #endif
169 
171 {
172  SCEnter();
173 
174 #ifdef HAVE_NFLOG
175  int ret = 0;
176  char *live_dev = NULL;
177 
179  TimeModeSetLive();
180 
181  ret = RunModeSetLiveCaptureAutoFp(ParseNflogConfig,
182  NflogConfigGeThreadsCount,
183  "ReceiveNFLOG",
184  "DecodeNFLOG",
186  live_dev);
187  if (ret != 0) {
188  SCLogError(SC_ERR_RUNMODE, "Unable to start runmode");
189  exit(EXIT_FAILURE);
190  }
191 
192  SCLogInfo("RunModeIdsNflogAutoFp initialised");
193 #endif /* HAVE_NFLOG */
194 
195  SCReturnInt(0);
196 }
197 
199 {
200  SCEnter();
201 
202 #ifdef HAVE_NFLOG
203  int ret = 0;
204  char *live_dev = NULL;
205 
207  TimeModeSetLive();
208 
209  ret = RunModeSetLiveCaptureSingle(ParseNflogConfig,
210  NflogConfigGeThreadsCount,
211  "ReceiveNFLOG",
212  "DecodeNFLOG",
214  live_dev);
215  if (ret != 0) {
216  SCLogError(SC_ERR_RUNMODE, "Unable to start runmode");
217  exit(EXIT_FAILURE);
218  }
219 
220  SCLogInfo("RunModeIdsNflogSingle initialised");
221 #endif /* HAVE_NFLOG */
222 
223  SCReturnInt(0);
224 }
225 
227 {
228  SCEnter();
229 
230 #ifdef HAVE_NFLOG
231  int ret = 0;
232  char *live_dev = NULL;
233 
235  TimeModeSetLive();
236 
237  ret = RunModeSetLiveCaptureWorkers(ParseNflogConfig,
238  NflogConfigGeThreadsCount,
239  "ReceiveNFLOG",
240  "DecodeNFLOG",
242  live_dev);
243  if (ret != 0) {
244  SCLogError(SC_ERR_RUNMODE, "Unable to start runmode");
245  exit(EXIT_FAILURE);
246  }
247 
248  SCLogInfo("RunModeIdsNflogWorkers initialised");
249 #endif /* HAVE_NFLOG */
250 
251  SCReturnInt(0);
252 }
ConfNode * ConfNodeLookupKeyValue(const ConfNode *base, const char *key, const char *value)
Lookup for a key value under a specific node.
Definition: conf.c:860
void RunModeInitialize(void)
Definition: runmodes.c:908
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
int RunModeIdsNflogSingle(void)
int RunModeIdsNflogAutoFp(void)
#define unlikely(expr)
Definition: util-optimize.h:35
const char * thread_name_single
Definition: runmodes.c:62
void TimeModeSetLive(void)
Definition: util-time.c:90
int RunModeIdsNflogWorkers(void)
void(* DerefFunc)(void *)
Definition: source-nflog.h:51
int ParseSizeStringU16(const char *size, uint16_t *res)
Definition: util-misc.c:169
uint32_t qthreshold
Definition: source-nflog.h:42
int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:89
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
uint8_t group
int ConfGetChildValueIntWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, intmax_t *val)
Definition: conf.c:495
const char * RunModeIdsNflogGetDefaultMode(void)
Definition: runmode-nflog.c:37
#define SCEnter(...)
Definition: util-debug.h:337
char numgroup[NFLOG_GROUP_NAME_LENGTH]
Definition: source-nflog.h:47
#define SCReturnInt(x)
Definition: util-debug.h:341
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: conf.h:32
#define SCMalloc(a)
Definition: util-mem.h:222
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
void RunModeIdsNflogRegister(void)
Definition: runmode-nflog.c:42
#define SCFree(a)
Definition: util-mem.h:322
const char * thread_name_autofp
Definition: runmodes.c:61
uint32_t nlbufsiz_max
Definition: source-nflog.h:40
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void))
Registers a new runmode.
Definition: runmodes.c:419
int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
const char * thread_name_workers
Definition: runmodes.c:63