suricata
runmode-pcap.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "runmode-pcap.h"
20 #include "runmodes.h"
21 #include "output.h"
22 
23 #include "util-conf.h"
24 #include "util-debug.h"
25 #include "util-time.h"
26 #include "util-cpu.h"
27 #include "util-device.h"
28 #include "util-runmodes.h"
29 #include "util-misc.h"
30 #include "util-byte.h"
31 
32 const char *RunModeIdsGetDefaultMode(void)
33 {
34  return "autofp";
35 }
36 
37 int RunModeIdsPcapWorkers(void);
38 
40 {
41  RunModeRegisterNewRunMode(RUNMODE_PCAP_DEV, "single", "Single threaded pcap live mode",
42  RunModeIdsPcapSingle, NULL);
44  "Multi-threaded pcap live mode. Packets from each flow are assigned to a consistent "
45  "detection thread",
46  RunModeIdsPcapAutoFp, NULL);
48  "Workers pcap live mode, each thread does all"
49  " tasks from acquisition to logging",
50  RunModeIdsPcapWorkers, NULL);
51 
52  return;
53 }
54 
55 static void PcapDerefConfig(void *conf)
56 {
57  PcapIfaceConfig *pfp = (PcapIfaceConfig *)conf;
58  /* Pcap config is used only once but cost of this low. */
59  if (SC_ATOMIC_SUB(pfp->ref, 1) == 1) {
60  SCFree(pfp);
61  }
62 }
63 
64 static void *ParsePcapConfig(const char *iface)
65 {
66  const char *threadsstr = NULL;
67  ConfNode *if_root;
68  ConfNode *if_default = NULL;
69  ConfNode *pcap_node;
70  PcapIfaceConfig *aconf = SCMalloc(sizeof(*aconf));
71  const char *tmpbpf;
72  const char *tmpctype;
73  intmax_t value;
74  int promisc = 0;
75  intmax_t snaplen = 0;
76 
77  if (unlikely(aconf == NULL)) {
78  return NULL;
79  }
80 
81  if (iface == NULL) {
82  SCFree(aconf);
83  return NULL;
84  }
85 
86  memset(aconf, 0x00, sizeof(*aconf));
87  strlcpy(aconf->iface, iface, sizeof(aconf->iface));
88 
89  aconf->buffer_size = 0;
90  /* If set command line option has precedence over config */
91  if ((ConfGetInt("pcap.buffer-size", &value)) == 1) {
92  if (value >= 0 && value <= INT_MAX) {
93  SCLogInfo("Pcap will use %d buffer size", (int)value);
94  aconf->buffer_size = value;
95  } else {
96  SCLogWarning("pcap.buffer-size "
97  "value of %" PRIiMAX " is invalid. Valid range is "
98  "0-2147483647",
99  value);
100  }
101  }
102 
104  aconf->bpf_filter = NULL;
105  if ((ConfGet("bpf-filter", &tmpbpf)) == 1) {
106  aconf->bpf_filter = tmpbpf;
107  }
108 
109  SC_ATOMIC_INIT(aconf->ref);
110  aconf->DerefFunc = PcapDerefConfig;
111  aconf->threads = 1;
112 
113  /* Find initial node */
114  pcap_node = ConfGetNode("pcap");
115  if (pcap_node == NULL) {
116  SCLogInfo("Unable to find pcap config using default value");
117  return aconf;
118  }
119 
120  if_root = ConfFindDeviceConfig(pcap_node, iface);
121 
122  if_default = ConfFindDeviceConfig(pcap_node, "default");
123 
124  if (if_root == NULL && if_default == NULL) {
125  SCLogInfo("Unable to find pcap config for "
126  "interface %s, using default value",
127  iface);
128  return aconf;
129  }
130 
131  /* If there is no setting for current interface use default one as main iface */
132  if (if_root == NULL) {
133  if_root = if_default;
134  if_default = NULL;
135  }
136 
137  if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) {
138  aconf->threads = 1;
139  } else {
140  if (threadsstr != NULL) {
141  if (StringParseInt32(&aconf->threads, 10, 0, (const char *)threadsstr) < 0) {
142  SCLogWarning("Invalid value for "
143  "pcap.threads: %s, resetting to 1",
144  threadsstr);
145  aconf->threads = 1;
146  }
147  }
148  }
149  if (aconf->threads == 0) {
150  aconf->threads = 1;
151  }
152  (void) SC_ATOMIC_ADD(aconf->ref, aconf->threads);
153 
154  if (aconf->buffer_size == 0) {
155  const char *s_limit = NULL;
156  int ret;
157  ret = ConfGetChildValueWithDefault(if_root, if_default, "buffer-size", &s_limit);
158  if (ret == 1 && s_limit) {
159  uint64_t bsize = 0;
160 
161  if (ParseSizeStringU64(s_limit, &bsize) < 0) {
162  SCLogError("Failed to parse pcap buffer size: %s", s_limit);
163  } else {
164  /* the string 2gb returns 2147483648 which is 1 to high
165  * for a int. */
166  if (bsize == (uint64_t)((uint64_t)INT_MAX + (uint64_t)1))
167  bsize = (uint64_t)INT_MAX;
168 
169  if (bsize > INT_MAX) {
170  SCLogError("Failed to set pcap buffer size: 2gb max. %" PRIu64 " > %d", bsize,
171  INT_MAX);
172  } else {
173  aconf->buffer_size = (int)bsize;
174  }
175  }
176  }
177  }
178 
179  if (aconf->bpf_filter == NULL) {
180  /* set bpf filter if we have one */
181  if (ConfGetChildValueWithDefault(if_root, if_default, "bpf-filter", &tmpbpf) != 1) {
182  SCLogDebug("could not get bpf or none specified");
183  } else {
184  aconf->bpf_filter = tmpbpf;
185  }
186  } else {
187  SCLogInfo("BPF filter set from command line or via old 'bpf-filter' option.");
188  }
189 
190  if (ConfGetChildValueWithDefault(if_root, if_default, "checksum-checks", &tmpctype) == 1) {
191  if (strcmp(tmpctype, "auto") == 0) {
193  } else if (ConfValIsTrue(tmpctype)) {
195  } else if (ConfValIsFalse(tmpctype)) {
197  } else {
198  SCLogError("Invalid value for checksum-checks for %s", aconf->iface);
199  }
200  }
201 
202  aconf->promisc = LIBPCAP_PROMISC;
203  if (ConfGetChildValueBoolWithDefault(if_root, if_default, "promisc", &promisc) != 1) {
204  SCLogDebug("could not get promisc or none specified");
205  } else {
206  aconf->promisc = promisc;
207  }
208 
209  aconf->snaplen = 0;
210  if (ConfGetChildValueIntWithDefault(if_root, if_default, "snaplen", &snaplen) != 1) {
211  SCLogDebug("could not get snaplen or none specified");
212  } else {
213  aconf->snaplen = snaplen;
214  }
215 
216  return aconf;
217 }
218 
219 static int PcapConfigGeThreadsCount(void *conf)
220 {
221  PcapIfaceConfig *pfp = (PcapIfaceConfig *)conf;
222  return pfp->threads;
223 }
224 
225 /**
226  * \brief Single thread version of the Pcap live processing.
227  */
229 {
230  int ret;
231  const char *live_dev = NULL;
232 
233  SCEnter();
234 
235  TimeModeSetLive();
236 
237  (void)ConfGet("pcap.single-pcap-dev", &live_dev);
238 
239  ret = RunModeSetLiveCaptureSingle(ParsePcapConfig,
240  PcapConfigGeThreadsCount,
241  "ReceivePcap",
242  "DecodePcap", thread_name_single,
243  live_dev);
244  if (ret != 0) {
245  FatalError("Runmode start failed");
246  }
247 
248  SCLogDebug("RunModeIdsPcapSingle initialised");
249 
250  SCReturnInt(0);
251 }
252 
253 /**
254  * \brief RunModIdsPcapAutoFp set up the following thread packet handlers:
255  * - Receive thread (from pcap device)
256  * - Decode thread
257  * - Stream thread
258  * - Detect: If we have only 1 cpu, it will setup one Detect thread
259  * If we have more than one, it will setup num_cpus - 1
260  * starting from the second cpu available.
261  * - Outputs thread
262  * By default the threads will use the first cpu available
263  * except the Detection threads if we have more than one cpu.
264  *
265  * \retval 0 If all goes well. (If any problem is detected the engine will
266  * exit()).
267  */
269 {
270  int ret;
271  const char *live_dev = NULL;
272 
273  SCEnter();
274  TimeModeSetLive();
275 
276  (void) ConfGet("pcap.single-pcap-dev", &live_dev);
277 
278  ret = RunModeSetLiveCaptureAutoFp(ParsePcapConfig, PcapConfigGeThreadsCount, "ReceivePcap",
279  "DecodePcap", thread_name_autofp, live_dev);
280  if (ret != 0) {
281  FatalError("Runmode start failed");
282  }
283 
284  SCLogDebug("RunModeIdsPcapAutoFp initialised");
285 
286  SCReturnInt(0);
287 }
288 
289 /**
290  * \brief Workers version of the PCAP LIVE processing.
291  *
292  * Start N threads with each thread doing all the work.
293  *
294  */
296 {
297  int ret;
298  const char *live_dev = NULL;
299  SCEnter();
300 
301  TimeModeSetLive();
302 
303  (void) ConfGet("pcap.single-pcap-dev", &live_dev);
304 
305  ret = RunModeSetLiveCaptureWorkers(ParsePcapConfig, PcapConfigGeThreadsCount, "ReceivePcap",
306  "DecodePcap", thread_name_workers, live_dev);
307  if (ret != 0) {
308  FatalError("Unable to start runmode");
309  }
310 
311  SCLogDebug("RunModeIdsPcapWorkers initialised");
312 
313  SCReturnInt(0);
314 }
thread_name_workers
const char * thread_name_workers
Definition: runmodes.c:81
util-byte.h
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:399
RunModeSetLiveCaptureWorkers
int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:321
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:314
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
ConfGetChildValueBoolWithDefault
int ConfGetChildValueBoolWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, int *val)
Definition: conf.c:514
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:198
PcapIfaceConfig_::promisc
int promisc
Definition: source-pcap.h:54
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
PcapIfaceConfig_::bpf_filter
const char * bpf_filter
Definition: source-pcap.h:56
runmode-pcap.h
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:332
util-runmodes.h
thread_name_autofp
const char * thread_name_autofp
Definition: runmodes.c:79
RunModeRegisterNewRunMode
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), void(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
Definition: runmodes.c:491
RUNMODE_PCAP_DEV
@ RUNMODE_PCAP_DEV
Definition: runmodes.h:29
CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_DISABLE
Definition: decode.h:46
StringParseInt32
int StringParseInt32(int32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:622
ConfGetChildValueIntWithDefault
int ConfGetChildValueIntWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, intmax_t *val)
Definition: conf.c:462
thread_name_single
const char * thread_name_single
Definition: runmodes.c:80
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:537
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
RunModeSetLiveCaptureAutoFp
int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:85
PcapIfaceConfig_::snaplen
int snaplen
Definition: source-pcap.h:52
CHECKSUM_VALIDATION_ENABLE
@ CHECKSUM_VALIDATION_ENABLE
Definition: decode.h:47
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
CHECKSUM_VALIDATION_AUTO
@ CHECKSUM_VALIDATION_AUTO
Definition: decode.h:48
util-device.h
util-debug.h
util-cpu.h
ConfFindDeviceConfig
ConfNode * ConfFindDeviceConfig(ConfNode *node, const char *iface)
Find the configuration node for a specific device.
Definition: util-conf.c:121
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
PcapIfaceConfig_::threads
int threads
Definition: source-pcap.h:48
RunModeIdsPcapSingle
int RunModeIdsPcapSingle(void)
Single thread version of the Pcap live processing.
Definition: runmode-pcap.c:228
ConfGetChildValueWithDefault
int ConfGetChildValueWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, const char **vptr)
Definition: conf.c:378
util-time.h
PcapIfaceConfig_::buffer_size
int buffer_size
Definition: source-pcap.h:50
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:341
LIBPCAP_PROMISC
#define LIBPCAP_PROMISC
Definition: source-pcap.h:32
PcapIfaceConfig_::DerefFunc
void(* DerefFunc)(void *)
Definition: source-pcap.h:59
PcapIfaceConfig_
Definition: source-pcap.h:45
runmodes.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
TimeModeSetLive
void TimeModeSetLive(void)
Definition: util-time.c:99
util-conf.h
suricata-common.h
RunModeIdsPcapRegister
void RunModeIdsPcapRegister(void)
Definition: runmode-pcap.c:39
FatalError
#define FatalError(...)
Definition: util-debug.h:502
PcapIfaceConfig_::iface
char iface[PCAP_IFACE_NAME_LENGTH]
Definition: source-pcap.h:46
RunModeIdsPcapAutoFp
int RunModeIdsPcapAutoFp(void)
RunModIdsPcapAutoFp set up the following thread packet handlers:
Definition: runmode-pcap.c:268
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
ConfValIsFalse
int ConfValIsFalse(const char *val)
Check if a value is false.
Definition: conf.c:562
RunModeSetLiveCaptureSingle
int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:350
PcapIfaceConfig_::checksum_mode
ChecksumValidationMode checksum_mode
Definition: source-pcap.h:57
util-misc.h
RunModeIdsPcapWorkers
int RunModeIdsPcapWorkers(void)
Workers version of the PCAP LIVE processing.
Definition: runmode-pcap.c:295
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
output.h
RunModeIdsGetDefaultMode
const char * RunModeIdsGetDefaultMode(void)
Definition: runmode-pcap.c:32