suricata
runmode-pcap-file.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "tm-threads.h"
20 #include "conf.h"
21 #include "runmodes.h"
22 #include "runmode-pcap-file.h"
23 #include "output.h"
24 
25 #include "detect-engine.h"
26 #include "source-pcap-file.h"
27 
28 #include "util-debug.h"
29 #include "util-time.h"
30 #include "util-cpu.h"
31 #include "util-affinity.h"
32 
33 #include "util-runmodes.h"
34 
36 {
37  return "autofp";
38 }
39 
41 {
43  "Single threaded pcap file mode",
46  "Multi threaded pcap file mode. Packets from "
47  "each flow are assigned to a single detect thread, "
48  "unlike \"pcap-file-auto\" where packets from "
49  "the same flow can be processed by any detect "
50  "thread",
52 
53  return;
54 }
55 
56 /**
57  * \brief Single thread version of the Pcap file processing.
58  */
60 {
61  const char *file = NULL;
62  char tname[TM_THREAD_NAME_MAX];
63 
64  if (ConfGet("pcap-file.file", &file) == 0) {
65  FatalError(SC_ERR_FATAL, "Failed retrieving pcap-file from Conf");
66  }
67 
70 
72 
73  snprintf(tname, sizeof(tname), "%s#01", thread_name_single);
74 
75  /* create the threads */
77  "packetpool", "packetpool",
78  "packetpool", "packetpool",
79  "pktacqloop");
80  if (tv == NULL) {
81  FatalError(SC_ERR_FATAL, "threading setup failed");
82  }
83 
84  TmModule *tm_module = TmModuleGetByName("ReceivePcapFile");
85  if (tm_module == NULL) {
86  FatalError(SC_ERR_FATAL, "TmModuleGetByName failed for ReceivePcap");
87  }
88  TmSlotSetFuncAppend(tv, tm_module, file);
89 
90  tm_module = TmModuleGetByName("DecodePcapFile");
91  if (tm_module == NULL) {
92  FatalError(SC_ERR_FATAL, "TmModuleGetByName DecodePcap failed");
93  }
94  TmSlotSetFuncAppend(tv, tm_module, NULL);
95 
96  tm_module = TmModuleGetByName("FlowWorker");
97  if (tm_module == NULL) {
98  FatalError(SC_ERR_FATAL, "TmModuleGetByName for FlowWorker failed");
99  }
100  TmSlotSetFuncAppend(tv, tm_module, NULL);
101 
103 
104  if (TmThreadSpawn(tv) != TM_ECODE_OK) {
105  FatalError(SC_ERR_FATAL, "TmThreadSpawn failed");
106  }
107  return 0;
108 }
109 
110 /**
111  * \brief RunModeFilePcapAutoFp set up the following thread packet handlers:
112  * - Receive thread (from pcap file)
113  * - Decode thread
114  * - Stream thread
115  * - Detect: If we have only 1 cpu, it will setup one Detect thread
116  * If we have more than one, it will setup num_cpus - 1
117  * starting from the second cpu available.
118  * - Outputs thread
119  * By default the threads will use the first cpu available
120  * except the Detection threads if we have more than one cpu.
121  *
122  * \retval 0 If all goes well. (If any problem is detected the engine will
123  * exit()).
124  */
126 {
127  SCEnter();
128  char tname[TM_THREAD_NAME_MAX];
129  char qname[TM_QUEUE_NAME_MAX];
130  uint16_t cpu = 0;
131  char *queues = NULL;
132  uint16_t thread;
133 
135 
136  const char *file = NULL;
137  if (ConfGet("pcap-file.file", &file) == 0) {
138  FatalError(SC_ERR_FATAL, "Failed retrieving pcap-file from Conf");
139  }
140  SCLogDebug("file %s", file);
141 
143 
145 
146  /* Available cpus */
147  uint16_t ncpus = UtilCpuGetNumProcessorsOnline();
148 
149  /* start with cpu 1 so that if we're creating an odd number of detect
150  * threads we're not creating the most on CPU0. */
151  if (ncpus > 0)
152  cpu = 1;
153 
154  /* always create at least one thread */
155  int thread_max = TmThreadGetNbThreads(WORKER_CPU_SET);
156  if (thread_max == 0)
157  thread_max = ncpus * threading_detect_ratio;
158  if (thread_max < 1)
159  thread_max = 1;
160  if (thread_max > 1024)
161  thread_max = 1024;
162 
163  queues = RunmodeAutoFpCreatePickupQueuesString(thread_max);
164  if (queues == NULL) {
166  "RunmodeAutoFpCreatePickupQueuesString failed");
167  }
168 
169  snprintf(tname, sizeof(tname), "%s#01", thread_name_autofp);
170 
171  /* create the threads */
172  ThreadVars *tv_receivepcap =
174  "packetpool", "packetpool",
175  queues, "flow",
176  "pktacqloop");
177  SCFree(queues);
178 
179  if (tv_receivepcap == NULL) {
180  FatalError(SC_ERR_FATAL, "threading setup failed");
181  }
182  TmModule *tm_module = TmModuleGetByName("ReceivePcapFile");
183  if (tm_module == NULL) {
184  FatalError(SC_ERR_FATAL, "TmModuleGetByName failed for ReceivePcap");
185  }
186  TmSlotSetFuncAppend(tv_receivepcap, tm_module, file);
187 
188  tm_module = TmModuleGetByName("DecodePcapFile");
189  if (tm_module == NULL) {
190  FatalError(SC_ERR_FATAL, "TmModuleGetByName DecodePcap failed");
191  }
192  TmSlotSetFuncAppend(tv_receivepcap, tm_module, NULL);
193 
194  TmThreadSetCPU(tv_receivepcap, RECEIVE_CPU_SET);
195 
196  if (TmThreadSpawn(tv_receivepcap) != TM_ECODE_OK) {
197  FatalError(SC_ERR_FATAL, "TmThreadSpawn failed");
198  }
199 
200  for (thread = 0; thread < (uint16_t)thread_max; thread++) {
201  snprintf(tname, sizeof(tname), "%s#%02u", thread_name_workers, thread+1);
202  snprintf(qname, sizeof(qname), "pickup%u", thread+1);
203 
204  SCLogDebug("tname %s, qname %s", tname, qname);
205  SCLogDebug("Assigning %s affinity to cpu %u", tname, cpu);
206 
207  ThreadVars *tv_detect_ncpu =
209  qname, "flow",
210  "packetpool", "packetpool",
211  "varslot");
212  if (tv_detect_ncpu == NULL) {
213  FatalError(SC_ERR_FATAL, "TmThreadsCreate failed");
214  }
215 
216  tm_module = TmModuleGetByName("FlowWorker");
217  if (tm_module == NULL) {
219  "TmModuleGetByName for FlowWorker failed");
220  }
221  TmSlotSetFuncAppend(tv_detect_ncpu, tm_module, NULL);
222 
223  TmThreadSetGroupName(tv_detect_ncpu, "Detect");
224 
225  TmThreadSetCPU(tv_detect_ncpu, WORKER_CPU_SET);
226 
227  if (TmThreadSpawn(tv_detect_ncpu) != TM_ECODE_OK) {
228  FatalError(SC_ERR_FATAL, "TmThreadSpawn failed");
229  }
230 
231  if ((cpu + 1) == ncpus)
232  cpu = 0;
233  else
234  cpu++;
235  }
236 
237  return 0;
238 }
thread_name_workers
const char * thread_name_workers
Definition: runmodes.c:63
tm-threads.h
TmThreadSpawn
TmEcode TmThreadSpawn(ThreadVars *tv)
Spawns a thread associated with the ThreadVars instance tv.
Definition: tm-threads.c:1630
detect-engine.h
source-pcap-file.h
TmThreadCreatePacketHandler
ThreadVars * TmThreadCreatePacketHandler(const char *name, const char *inq_name, const char *inqh_name, const char *outq_name, const char *outqh_name, const char *slots)
Creates and returns a TV instance for a Packet Processing Thread. This function doesn't support custo...
Definition: tm-threads.c:1041
TmThreadSetGroupName
void TmThreadSetGroupName(ThreadVars *tv, const char *name)
Definition: tm-threads.c:1587
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
RunModeInitialize
void RunModeInitialize(void)
Definition: runmodes.c:904
RunModeFilePcapGetDefaultMode
const char * RunModeFilePcapGetDefaultMode(void)
Definition: runmode-pcap-file.c:35
util-runmodes.h
thread_name_autofp
const char * thread_name_autofp
Definition: runmodes.c:61
thread_name_single
const char * thread_name_single
Definition: runmodes.c:62
TM_THREAD_NAME_MAX
#define TM_THREAD_NAME_MAX
Definition: tm-threads.h:48
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:78
TmModuleGetByName
TmModule * TmModuleGetByName(const char *name)
get a tm module ptr by name
Definition: tm-modules.c:53
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:330
util-debug.h
RunmodeAutoFpCreatePickupQueuesString
char * RunmodeAutoFpCreatePickupQueuesString(int n)
create a queue string for autofp to pass to the flow queue handler.
Definition: util-runmodes.c:58
util-cpu.h
WORKER_CPU_SET
@ WORKER_CPU_SET
Definition: util-affinity.h:52
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
util-affinity.h
util-time.h
TM_QUEUE_NAME_MAX
#define TM_QUEUE_NAME_MAX
Definition: tm-threads.h:47
conf.h
runmode-pcap-file.h
runmodes.h
TmModule_
Definition: tm-modules.h:43
TmSlotSetFuncAppend
void TmSlotSetFuncAppend(ThreadVars *tv, TmModule *tm, const void *data)
Appends a new entry to the slots.
Definition: tm-threads.c:623
TimeModeSetOffline
void TimeModeSetOffline(void)
Definition: util-time.c:103
suricata-common.h
TmThreadSetCPU
TmEcode TmThreadSetCPU(ThreadVars *tv, uint8_t type)
Definition: tm-threads.c:820
RunModeRegisterNewRunMode
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void))
Registers a new runmode.
Definition: runmodes.c:416
PcapFileGlobalInit
void PcapFileGlobalInit()
Definition: source-pcap-file.c:138
TmThreadGetNbThreads
int TmThreadGetNbThreads(uint8_t type)
Definition: tm-threads.c:836
RunModeFilePcapSingle
int RunModeFilePcapSingle(void)
Single thread version of the Pcap file processing.
Definition: runmode-pcap-file.c:59
RunModeFilePcapRegister
void RunModeFilePcapRegister(void)
Definition: runmode-pcap-file.c:40
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
RECEIVE_CPU_SET
@ RECEIVE_CPU_SET
Definition: util-affinity.h:51
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
UtilCpuGetNumProcessorsOnline
uint16_t UtilCpuGetNumProcessorsOnline(void)
Get the number of cpus online in the system.
Definition: util-cpu.c:106
RUNMODE_PCAP_FILE
@ RUNMODE_PCAP_FILE
Definition: runmodes.h:30
threading_detect_ratio
float threading_detect_ratio
Definition: runmodes.c:899
output.h
RunModeFilePcapAutoFp
int RunModeFilePcapAutoFp(void)
RunModeFilePcapAutoFp set up the following thread packet handlers:
Definition: runmode-pcap-file.c:125