Go to the documentation of this file.
39 #define PFRING_CONF_V1 1
40 #define PFRING_CONF_V2 2
54 "Multi threaded pfring mode. Packets from "
55 "each flow are assigned to a single detect "
56 "thread, unlike \"pfring_auto\" where packets "
57 "from the same flow can be processed by any "
63 "Workers pfring mode, each thread does all"
64 " tasks from acquisition to logging",
70 static void PfringDerefConfig(
void *conf)
91 static void *OldParsePfringConfig(
const char *iface)
93 const char *threadsstr = NULL;
95 const char *tmpclusterid;
96 const char *tmpctype = NULL;
112 pfconf->
ctype = default_ctype;
119 if (
ConfGet(
"pfring.threads", &threadsstr) != 1) {
122 if (threadsstr != NULL) {
125 "pfring.threads: '%s'. Resetting to 1.",
138 if (strncmp(pfconf->
iface,
"zc", 2) == 0) {
139 SCLogInfo(
"%s: ZC interface detected, not setting cluster-id", pfconf->
iface);
141 else if ((pfconf->
threads == 1) && (strncmp(pfconf->
iface,
"dna", 3) == 0)) {
142 SCLogInfo(
"DNA interface detected, not setting cluster-id");
143 }
else if (
ConfGet(
"pfring.cluster-id", &tmpclusterid) != 1) {
144 SCLogError(
"Could not get cluster-id from config");
148 "pfring.cluster_id: '%s'. Resetting to 1.",
156 if (strncmp(pfconf->
iface,
"zc", 2) == 0) {
157 SCLogInfo(
"%s: ZC interface detected, not setting cluster type for PF_RING", pfconf->
iface);
158 }
else if ((pfconf->
threads == 1) && (strncmp(pfconf->
iface,
"dna", 3) == 0)) {
160 "%s: DNA interface detected, not setting cluster type for PF_RING", pfconf->
iface);
161 }
else if (
ConfGet(
"pfring.cluster-type", &tmpctype) != 1) {
162 SCLogError(
"Could not get cluster-type from config");
163 }
else if (strcmp(tmpctype,
"cluster_round_robin") == 0) {
164 SCLogInfo(
"%s: Using round-robin cluster mode for PF_RING", pfconf->
iface);
165 pfconf->
ctype = (cluster_type)tmpctype;
166 }
else if (strcmp(tmpctype,
"cluster_flow") == 0) {
167 SCLogInfo(
"%s: Using flow cluster mode for PF_RING", pfconf->
iface);
168 pfconf->
ctype = (cluster_type)tmpctype;
170 SCLogError(
"invalid cluster-type %s", tmpctype);
191 static void *ParsePfringConfig(
const char *iface)
193 const char *threadsstr = NULL;
198 const char *tmpclusterid;
199 const char *tmpctype = NULL;
217 pfconf->
ctype = (cluster_type)default_ctype;
224 if (pf_ring_node == NULL) {
225 SCLogInfo(
"Unable to find pfring config using default value");
233 if (if_root == NULL && if_default == NULL) {
234 SCLogInfo(
"Unable to find pfring config for "
235 "interface %s, using default value or 1.0 "
236 "configuration system. ",
242 if (if_root == NULL) {
243 if_root = if_default;
249 }
else if (threadsstr != NULL) {
250 if (strcmp(threadsstr,
"auto") == 0) {
261 uint16_t threads = 0;
264 "pfring.threads: '%s'. Resetting to 1.",
280 if (
ConfGet(
"pfring.cluster-id", &tmpclusterid) == 1) {
283 "pfring.cluster-id: '%s'. Resetting to 1.",
288 SCLogDebug(
"Going to use command-line provided cluster-id %" PRId32,
292 if (strncmp(pfconf->
iface,
"zc", 2) == 0) {
294 "%s: ZC interface detected, not setting cluster-id for PF_RING", pfconf->
iface);
295 }
else if ((pfconf->
threads == 1) && (strncmp(pfconf->
iface,
"dna", 3) == 0)) {
296 SCLogInfo(
"%s: DNA interface detected, not setting cluster-id for PF_RING",
299 SCLogError(
"Could not get cluster-id from config");
303 "pfring.cluster-id: '%s'. Resetting to 1.",
315 FatalError(
"IPS mode not supported in PF_RING.");
318 if (
ConfGet(
"pfring.cluster-type", &tmpctype) == 1) {
319 SCLogDebug(
"Going to use command-line provided cluster-type");
322 if (strncmp(pfconf->
iface,
"zc", 2) == 0) {
323 SCLogInfo(
"%s: ZC interface detected, not setting cluster type for PF_RING",
325 }
else if ((pfconf->
threads == 1) && (strncmp(pfconf->
iface,
"dna", 3) == 0)) {
326 SCLogInfo(
"%s: DNA interface detected, not setting cluster type for PF_RING",
329 SCLogError(
"Could not get cluster-type from config");
336 if (strcmp(tmpctype,
"cluster_round_robin") == 0) {
337 SCLogInfo(
"%s: Using round-robin cluster mode for PF_RING."
338 " This mode is not recommended.",
341 }
else if (strcmp(tmpctype,
"cluster_flow") == 0) {
342 SCLogInfo(
"%s: Using flow cluster mode for PF_RING", pfconf->
iface);
344 }
else if (strcmp(tmpctype,
"cluster_inner_flow") == 0) {
345 SCLogInfo(
"%s: Using flow cluster mode inner mode for PF_RING", pfconf->
iface);
347 }
else if (strcmp(tmpctype,
"cluster_inner_flow_2_tuple") == 0) {
348 SCLogInfo(
"%s: Using flow cluster inner 2 tuple mode for PF_RING", pfconf->
iface);
350 }
else if (strcmp(tmpctype,
"cluster_inner_flow_4_tuple") == 0) {
351 SCLogInfo(
"%s: Using flow cluster inner 4 tuple mode for PF_RING", pfconf->
iface);
353 }
else if (strcmp(tmpctype,
"cluster_inner_flow_5_tuple") == 0) {
354 SCLogInfo(
"%s: Using flow cluster inner 5 tuple mode for PF_RING", pfconf->
iface);
357 SCLogError(
"invalid cluster-type %s", tmpctype);
363 if (strcmp(tmpctype,
"auto") == 0) {
369 }
else if (strcmp(tmpctype,
"rx-only") == 0) {
378 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
379 SCLogConfig(
"%s: Enabling bypass support in PF_RING (if supported by underlying hw)",
383 SCLogError(
"Bypass is not supported by this Pfring version, please upgrade");
392 SCLogWarning(
"Using PF_RING with offloading activated leads to capture problems");
400 static int PfringConfigGetThreadsCount(
void *conf)
406 static int PfringConfLevel(
void)
408 const char *def_dev = NULL;
410 if (
ConfGet(
"pfring.interface", &def_dev) != 1) {
419 ConfGet(
"pfring.live-interface", live_dev);
423 *parser = ParsePfringConfig;
425 SCLogInfo(
"Using 1.0 style configuration for pfring");
426 *parser = OldParsePfringConfig;
428 if (*live_dev == NULL) {
429 if (
ConfGet(
"pfring.interface", live_dev) == 1) {
430 SCLogInfo(
"Using interface %s", *live_dev);
433 SCLogInfo(
"No interface found, problem incoming");
450 const char *live_dev = NULL;
455 ret = GetDevAndParser(&live_dev, &tparser);
457 FatalError(
"Unable to get parser and interface params");
466 SCLogInfo(
"RunModeIdsPfringAutoFp initialised");
479 const char *live_dev = NULL;
484 ret = GetDevAndParser(&live_dev, &tparser);
486 FatalError(
"Unable to get parser and interface params");
490 PfringConfigGetThreadsCount,
498 SCLogInfo(
"RunModeIdsPfringSingle initialised");
511 const char *live_dev = NULL;
516 ret = GetDevAndParser(&live_dev, &tparser);
518 FatalError(
"Unable to get parser and interface params");
527 SCLogInfo(
"RunModeIdsPfringWorkers initialised");
const char * thread_name_workers
int RunModeIdsPfringWorkers(void)
int LiveRegisterDevice(const char *dev)
Add a pcap device for monitoring and create structure.
#define CLUSTER_INNER_FLOW_2_TUPLE
int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
int ConfGetChildValueBoolWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, int *val)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
void RunModeIdsPfringRegister(void)
@ CHECKSUM_VALIDATION_RXONLY
const char * thread_name_autofp
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), void(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
@ CHECKSUM_VALIDATION_DISABLE
int StringParseInt32(int32_t *res, int base, size_t len, const char *str)
const char * thread_name_single
int ConfValIsTrue(const char *val)
Check if a value is true.
#define CLUSTER_INNER_FLOW_5_TUPLE
const char * RunModeIdsPfringGetDefaultMode(void)
size_t strlcpy(char *dst, const char *src, size_t siz)
int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
@ CHECKSUM_VALIDATION_ENABLE
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
char iface[PFRING_IFACE_NAME_LENGTH]
int RunModeIdsPfringAutoFp(void)
@ CHECKSUM_VALIDATION_AUTO
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
int GetIfaceRSSQueuesNum(const char *dev)
ConfNode * ConfFindDeviceConfig(ConfNode *node, const char *iface)
Find the configuration node for a specific device.
int ConfGetChildValueWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, const char **vptr)
#define SCLogWarning(...)
Macro used to log WARNING messages.
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
#define PFRING_CONF_FLAGS_CLUSTER
#define CLUSTER_INNER_FLOW
int GetIfaceOffloading(const char *dev, int csum, int other)
output offloading status of the link
int DisableIfaceOffloading(LiveDevice *dev, int csum, int other)
#define PFRING_CONF_FLAGS_BYPASS
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
void TimeModeSetLive(void)
#define CLUSTER_ROUND_ROBIN
void ConfSetBPFFilter(ConfNode *if_root, ConfNode *if_default, const char *iface, const char **bpf_filter)
#define CLUSTER_INNER_FLOW_4_TUPLE
void(* DerefFunc)(void *)
#define SC_ATOMIC_RESET(name)
wrapper for reinitializing an atomic variable.
void *(* ConfigIfaceParserFunc)(const char *)
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
#define SCLogError(...)
Macro used to log ERROR messages.
int ConfValIsFalse(const char *val)
Check if a value is false.
int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
int EngineModeIsIPS(void)
uint16_t UtilCpuGetNumProcessorsOnline(void)
Get the number of cpus online in the system.
ChecksumValidationMode checksum_mode
int RunModeIdsPfringSingle(void)