suricata
runmode-nflog.c
Go to the documentation of this file.
1 /* Copyright (C) 2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Giuseppe Longo <giuseppelng@gmail.com>
22  */
23 #include "suricata-common.h"
24 #include "config.h"
25 #include "tm-threads.h"
26 #include "conf.h"
27 #include "runmodes.h"
28 #include "runmode-nflog.h"
29 
30 #include "util-debug.h"
31 #include "util-device.h"
32 #include "util-runmodes.h"
33 #include "util-misc.h"
34 
35 #include "source-nflog.h"
36 
37 static const char *default_mode = NULL;
38 
40 {
41  return default_mode;
42 }
43 
45 {
46  default_mode = "autofp";
48  "Multi threaded nflog mode",
51  "Single threaded nflog mode",
54  "Workers nflog mode",
56  return;
57 }
58 
59 #ifdef HAVE_NFLOG
60 static void NflogDerefConfig(void *data)
61 {
62  NflogGroupConfig *nflogconf = (NflogGroupConfig *)data;
63  SCFree(nflogconf);
64 }
65 
66 static void *ParseNflogConfig(const char *group)
67 {
68  ConfNode *group_root;
69  ConfNode *group_default = NULL;
70  ConfNode *nflog_node;
71  NflogGroupConfig *nflogconf = SCMalloc(sizeof(*nflogconf));
72  intmax_t bufsize;
73  intmax_t bufsize_max;
74  intmax_t qthreshold;
75  intmax_t qtimeout;
76  int boolval;
77 
78  if (unlikely(nflogconf == NULL))
79  return NULL;
80 
81  if (group == NULL) {
82  SCFree(nflogconf);
83  return NULL;
84  }
85 
86  nflogconf->DerefFunc = NflogDerefConfig;
87  nflog_node = ConfGetNode("nflog");
88 
89  if (nflog_node == NULL) {
90  SCLogInfo("Unable to find nflog config using default value");
91  return nflogconf;
92  }
93 
94  group_root = ConfNodeLookupKeyValue(nflog_node, "group", group);
95 
96  group_default = ConfNodeLookupKeyValue(nflog_node, "group", "default");
97 
98  if (group_root == NULL && group_default == NULL) {
99  SCLogInfo("Unable to find nflog config for "
100  "group \"%s\" or \"default\", using default value",
101  group);
102  return nflogconf;
103  }
104 
105  nflogconf->nful_overrun_warned = 0;
106  strlcpy(nflogconf->numgroup, group, sizeof(nflogconf->numgroup));
107 
108  if (ParseSizeStringU16(group, &nflogconf->group) < 0) {
109  SCLogError(SC_ERR_NFLOG_GROUP, "NFLOG's group number invalid.");
110  exit(EXIT_FAILURE);
111  }
112 
113  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
114  "buffer-size", &bufsize);
115 
116  if (boolval)
117  nflogconf->nlbufsiz = bufsize;
118  else {
119  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid buffer-size value");
120  SCFree(nflogconf);
121  return NULL;
122  }
123 
124  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
125  "max-size", &bufsize_max);
126 
127  if (boolval)
128  nflogconf->nlbufsiz_max = bufsize_max;
129  else {
130  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid max-size value");
131  SCFree(nflogconf);
132  return NULL;
133  }
134 
135  if (nflogconf->nlbufsiz > nflogconf->nlbufsiz_max) {
136  SCLogWarning(SC_ERR_INVALID_ARGUMENT, "buffer-size value larger "
137  "than max-size value, adjusting buffer-size");
138  nflogconf->nlbufsiz = nflogconf->nlbufsiz_max;
139  }
140 
141  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
142  "qthreshold", &qthreshold);
143 
144  if (boolval)
145  nflogconf->qthreshold = qthreshold;
146  else {
147  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid qthreshold value");
148  SCFree(nflogconf);
149  return NULL;
150  }
151 
152  boolval = ConfGetChildValueIntWithDefault(group_root, group_default,
153  "qtimeout", &qtimeout);
154 
155  if (boolval)
156  nflogconf->qtimeout = qtimeout;
157  else {
158  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid qtimeout value");
159  SCFree(nflogconf);
160  return NULL;
161  }
162 
163  return nflogconf;
164 }
165 
166 static int NflogConfigGeThreadsCount(void *conf)
167 {
168  /* for each nflog group there is no reason to use more than 1 thread */
169  return 1;
170 }
171 #endif
172 
174 {
175  SCEnter();
176 
177 #ifdef HAVE_NFLOG
178  int ret = 0;
179  char *live_dev = NULL;
180 
182  TimeModeSetLive();
183 
184  ret = RunModeSetLiveCaptureAutoFp(ParseNflogConfig,
185  NflogConfigGeThreadsCount,
186  "ReceiveNFLOG",
187  "DecodeNFLOG",
189  live_dev);
190  if (ret != 0) {
191  SCLogError(SC_ERR_RUNMODE, "Unable to start runmode");
192  exit(EXIT_FAILURE);
193  }
194 
195  SCLogInfo("RunModeIdsNflogAutoFp initialised");
196 #endif /* HAVE_NFLOG */
197 
198  SCReturnInt(0);
199 }
200 
202 {
203  SCEnter();
204 
205 #ifdef HAVE_NFLOG
206  int ret = 0;
207  char *live_dev = NULL;
208 
210  TimeModeSetLive();
211 
212  ret = RunModeSetLiveCaptureSingle(ParseNflogConfig,
213  NflogConfigGeThreadsCount,
214  "ReceiveNFLOG",
215  "DecodeNFLOG",
217  live_dev);
218  if (ret != 0) {
219  SCLogError(SC_ERR_RUNMODE, "Unable to start runmode");
220  exit(EXIT_FAILURE);
221  }
222 
223  SCLogInfo("RunModeIdsNflogSingle initialised");
224 #endif /* HAVE_NFLOG */
225 
226  SCReturnInt(0);
227 }
228 
230 {
231  SCEnter();
232 
233 #ifdef HAVE_NFLOG
234  int ret = 0;
235  char *live_dev = NULL;
236 
238  TimeModeSetLive();
239 
240  ret = RunModeSetLiveCaptureWorkers(ParseNflogConfig,
241  NflogConfigGeThreadsCount,
242  "ReceiveNFLOG",
243  "DecodeNFLOG",
245  live_dev);
246  if (ret != 0) {
247  SCLogError(SC_ERR_RUNMODE, "Unable to start runmode");
248  exit(EXIT_FAILURE);
249  }
250 
251  SCLogInfo("RunModeIdsNflogWorkers initialised");
252 #endif /* HAVE_NFLOG */
253 
254  SCReturnInt(0);
255 }
ConfNode * ConfNodeLookupKeyValue(const ConfNode *base, const char *key, const char *value)
Lookup for a key value under a specific node.
Definition: conf.c:860
void RunModeInitialize(void)
Definition: runmodes.c:925
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
int RunModeIdsNflogSingle(void)
void RunModeRegisterNewRunMode(int runmode, const char *name, const char *description, int(*RunModeFunc)(void))
Registers a new runmode.
Definition: runmodes.c:421
int RunModeIdsNflogAutoFp(void)
#define unlikely(expr)
Definition: util-optimize.h:35
const char * thread_name_single
Definition: runmodes.c:62
void TimeModeSetLive(void)
Definition: util-time.c:82
int RunModeIdsNflogWorkers(void)
void(* DerefFunc)(void *)
Definition: source-nflog.h:51
int ParseSizeStringU16(const char *size, uint16_t *res)
Definition: util-misc.c:169
uint32_t qthreshold
Definition: source-nflog.h:42
int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:89
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
uint8_t group
int ConfGetChildValueIntWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, intmax_t *val)
Definition: conf.c:495
const char * RunModeIdsNflogGetDefaultMode(void)
Definition: runmode-nflog.c:39
#define SCEnter(...)
Definition: util-debug.h:337
char numgroup[NFLOG_GROUP_NAME_LENGTH]
Definition: source-nflog.h:47
#define SCReturnInt(x)
Definition: util-debug.h:341
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: conf.h:32
#define SCMalloc(a)
Definition: util-mem.h:166
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
void RunModeIdsNflogRegister(void)
Definition: runmode-nflog.c:44
#define SCFree(a)
Definition: util-mem.h:228
const char * thread_name_autofp
Definition: runmodes.c:61
uint32_t nlbufsiz_max
Definition: source-nflog.h:40
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
const char * thread_name_workers
Definition: runmodes.c:63