suricata
runmode-pfring.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2018 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "tm-threads.h"
20 #include "conf.h"
21 #include "runmodes.h"
22 #include "runmode-pfring.h"
23 #include "source-pfring.h"
24 #include "output.h"
25 
26 #include "util-debug.h"
27 #include "util-time.h"
28 #include "util-cpu.h"
29 #include "util-affinity.h"
30 #include "util-runmodes.h"
31 #include "util-device.h"
32 #include "util-ioctl.h"
33 #include "util-byte.h"
34 
35 #ifdef HAVE_PFRING
36 #include <pfring.h>
37 #endif
38 
39 #define PFRING_CONF_V1 1
40 #define PFRING_CONF_V2 2
41 
43 {
44 #ifdef HAVE_PFRING
45  return "workers";
46 #else
47  return NULL;
48 #endif
49 }
50 
52 {
54  "Multi threaded pfring mode. Packets from "
55  "each flow are assigned to a single detect "
56  "thread, unlike \"pfring_auto\" where packets "
57  "from the same flow can be processed by any "
58  "detect thread",
61  "Single threaded pfring mode",
64  "Workers pfring mode, each thread does all"
65  " tasks from acquisition to logging",
67  return;
68 }
69 
70 #ifdef HAVE_PFRING
71 static void PfringDerefConfig(void *conf)
72 {
73  PfringIfaceConfig *pfp = (PfringIfaceConfig *)conf;
74  if (SC_ATOMIC_SUB(pfp->ref, 1) == 1) {
75  if (pfp->bpf_filter) {
76  SCFree(pfp->bpf_filter);
77  }
78  SCFree(pfp);
79  }
80 }
81 
82 /**
83  * \brief extract information from config file
84  *
85  * The returned structure will be freed by the thread init function.
86  * This is thus necessary to or copy the structure before giving it
87  * to thread or to reparse the file for each thread (and thus have
88  * new structure.
89  *
90  * If old config system is used, then return the smae parameters
91  * value for each interface.
92  *
93  * \return a PfringIfaceConfig corresponding to the interface name
94  */
95 static void *OldParsePfringConfig(const char *iface)
96 {
97  const char *threadsstr = NULL;
98  PfringIfaceConfig *pfconf = SCMalloc(sizeof(*pfconf));
99  const char *tmpclusterid;
100  const char *tmpctype = NULL;
101  cluster_type default_ctype = CLUSTER_ROUND_ROBIN;
102 
103  if (unlikely(pfconf == NULL)) {
104  return NULL;
105  }
106 
107  if (iface == NULL) {
108  SCFree(pfconf);
109  return NULL;
110  }
111 
112  strlcpy(pfconf->iface, iface, sizeof(pfconf->iface));
113  pfconf->flags = 0;
114  pfconf->threads = 1;
115  pfconf->cluster_id = 1;
116  pfconf->ctype = default_ctype;
117  pfconf->DerefFunc = PfringDerefConfig;
119  SC_ATOMIC_INIT(pfconf->ref);
120  (void) SC_ATOMIC_ADD(pfconf->ref, 1);
121 
122  /* Find initial node */
123  if (ConfGet("pfring.threads", &threadsstr) != 1) {
124  pfconf->threads = 1;
125  } else {
126  if (threadsstr != NULL) {
127  if (StringParseUint16(&pfconf->threads, 10, 0, threadsstr) < 0) {
128  SCLogWarning(SC_ERR_INVALID_VALUE, "Invalid value for "
129  "pfring.threads: '%s'. Resetting to 1.", threadsstr);
130  pfconf->threads = 1;
131  }
132  }
133  }
134  if (pfconf->threads == 0) {
135  pfconf->threads = 1;
136  }
137 
138  SC_ATOMIC_RESET(pfconf->ref);
139  (void) SC_ATOMIC_ADD(pfconf->ref, pfconf->threads);
140 
141  if (strncmp(pfconf->iface, "zc", 2) == 0) {
142  SCLogInfo("ZC interface detected, not setting cluster-id");
143  }
144  else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) {
145  SCLogInfo("DNA interface detected, not setting cluster-id");
146  } else if (ConfGet("pfring.cluster-id", &tmpclusterid) != 1) {
147  SCLogError(SC_ERR_INVALID_ARGUMENT,"Could not get cluster-id from config");
148  } else {
149  if (StringParseUint16(&pfconf->cluster_id, 10, 0, (const char *)tmpclusterid) < 0) {
150  SCLogWarning(SC_ERR_INVALID_VALUE, "Invalid value for "
151  "pfring.cluster_id: '%s'. Resetting to 1.", tmpclusterid);
152  pfconf->cluster_id = 1;
153  }
154  pfconf->flags |= PFRING_CONF_FLAGS_CLUSTER;
155  SCLogDebug("Going to use cluster-id %" PRId32, pfconf->cluster_id);
156  }
157 
158  if (strncmp(pfconf->iface, "zc", 2) == 0) {
159  SCLogInfo("ZC interface detected, not setting cluster type for PF_RING (iface %s)",
160  pfconf->iface);
161  } else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) {
162  SCLogInfo("DNA interface detected, not setting cluster type for PF_RING (iface %s)",
163  pfconf->iface);
164  } else if (ConfGet("pfring.cluster-type", &tmpctype) != 1) {
165  SCLogError(SC_ERR_GET_CLUSTER_TYPE_FAILED,"Could not get cluster-type from config");
166  } else if (strcmp(tmpctype, "cluster_round_robin") == 0) {
167  SCLogInfo("Using round-robin cluster mode for PF_RING (iface %s)",
168  pfconf->iface);
169  pfconf->ctype = (cluster_type)tmpctype;
170  } else if (strcmp(tmpctype, "cluster_flow") == 0) {
171  SCLogInfo("Using flow cluster mode for PF_RING (iface %s)",
172  pfconf->iface);
173  pfconf->ctype = (cluster_type)tmpctype;
174  } else {
175  SCLogError(SC_ERR_INVALID_CLUSTER_TYPE,"invalid cluster-type %s",tmpctype);
176  SCFree(pfconf);
177  return NULL;
178  }
179 
180  return pfconf;
181 }
182 
183 /**
184  * \brief extract information from config file
185  *
186  * The returned structure will be freed by the thread init function.
187  * This is thus necessary to or copy the structure before giving it
188  * to thread or to reparse the file for each thread (and thus have
189  * new structure.
190  *
191  * If old config system is used, then return the smae parameters
192  * value for each interface.
193  *
194  * \return a PfringIfaceConfig corresponding to the interface name
195  */
196 static void *ParsePfringConfig(const char *iface)
197 {
198  const char *threadsstr = NULL;
199  ConfNode *if_root;
200  ConfNode *if_default = NULL;
201  ConfNode *pf_ring_node;
202  PfringIfaceConfig *pfconf = SCMalloc(sizeof(*pfconf));
203  const char *tmpclusterid;
204  const char *tmpctype = NULL;
205  cluster_type default_ctype = CLUSTER_ROUND_ROBIN;
206  int getctype = 0;
207  const char *bpf_filter = NULL;
208  int bool_val;
209 
210  if (unlikely(pfconf == NULL)) {
211  return NULL;
212  }
213 
214  if (iface == NULL) {
215  SCFree(pfconf);
216  return NULL;
217  }
218 
219  memset(pfconf, 0, sizeof(PfringIfaceConfig));
220  strlcpy(pfconf->iface, iface, sizeof(pfconf->iface));
221  pfconf->threads = 1;
222  pfconf->cluster_id = 1;
223  pfconf->ctype = (cluster_type)default_ctype;
224  pfconf->DerefFunc = PfringDerefConfig;
225  SC_ATOMIC_INIT(pfconf->ref);
226  (void) SC_ATOMIC_ADD(pfconf->ref, 1);
227 
228  /* Find initial node */
229  pf_ring_node = ConfGetNode("pfring");
230  if (pf_ring_node == NULL) {
231  SCLogInfo("Unable to find pfring config using default value");
232  return pfconf;
233  }
234 
235  if_root = ConfFindDeviceConfig(pf_ring_node, iface);
236 
237  if_default = ConfFindDeviceConfig(pf_ring_node, "default");
238 
239  if (if_root == NULL && if_default == NULL) {
240  SCLogInfo("Unable to find pfring config for "
241  "interface %s, using default value or 1.0 "
242  "configuration system. ",
243  iface);
244  return pfconf;
245  }
246 
247  /* If there is no setting for current interface use default one as main iface */
248  if (if_root == NULL) {
249  if_root = if_default;
250  if_default = NULL;
251  }
252 
253  if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) {
254  pfconf->threads = 1;
255  } else if (threadsstr != NULL) {
256  if (strcmp(threadsstr, "auto") == 0) {
257  pfconf->threads = (int)UtilCpuGetNumProcessorsOnline();
258  if (pfconf->threads > 0) {
259  SCLogPerf("%u cores, so using %u threads", pfconf->threads, pfconf->threads);
260  } else {
261  pfconf->threads = GetIfaceRSSQueuesNum(iface);
262  if (pfconf->threads > 0) {
263  SCLogPerf("%d RSS queues, so using %u threads", pfconf->threads, pfconf->threads);
264  }
265  }
266  } else {
267  if (StringParseUint16(&pfconf->threads, 10, 0, (const char *)threadsstr) < 0) {
268  SCLogWarning(SC_ERR_INVALID_VALUE, "Invalid value for "
269  "pfring.threads: '%s'. Resetting to 1.", threadsstr);
270  pfconf->threads = 1;
271  }
272  }
273  }
274  if (pfconf->threads <= 0) {
275  pfconf->threads = 1;
276  }
277 
278  SC_ATOMIC_RESET(pfconf->ref);
279  (void) SC_ATOMIC_ADD(pfconf->ref, pfconf->threads);
280 
281  /* command line value has precedence */
282  if (ConfGet("pfring.cluster-id", &tmpclusterid) == 1) {
283  if (StringParseUint16(&pfconf->cluster_id, 10, 0, (const char *)tmpclusterid) < 0) {
284  SCLogWarning(SC_ERR_INVALID_VALUE, "Invalid value for "
285  "pfring.cluster-id: '%s'. Resetting to 1.", tmpclusterid);
286  pfconf->cluster_id = 1;
287  }
288  pfconf->flags |= PFRING_CONF_FLAGS_CLUSTER;
289  SCLogDebug("Going to use command-line provided cluster-id %" PRId32,
290  pfconf->cluster_id);
291  } else {
292 
293  if (strncmp(pfconf->iface, "zc", 2) == 0) {
294  SCLogInfo("ZC interface detected, not setting cluster-id for PF_RING (iface %s)",
295  pfconf->iface);
296  } else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) {
297  SCLogInfo("DNA interface detected, not setting cluster-id for PF_RING (iface %s)",
298  pfconf->iface);
299  } else if (ConfGetChildValueWithDefault(if_root, if_default, "cluster-id", &tmpclusterid) != 1) {
301  "Could not get cluster-id from config");
302  } else {
303  if (StringParseUint16(&pfconf->cluster_id, 10, 0, (const char *)tmpclusterid) < 0) {
304  SCLogWarning(SC_ERR_INVALID_VALUE, "Invalid value for "
305  "pfring.cluster-id: '%s'. Resetting to 1.", tmpclusterid);
306  pfconf->cluster_id = 1;
307  }
308  pfconf->flags |= PFRING_CONF_FLAGS_CLUSTER;
309  SCLogDebug("Going to use cluster-id %" PRId32, pfconf->cluster_id);
310  }
311  }
312 
313  /*load pfring bpf filter*/
314  /* command line value has precedence */
315  if (ConfGet("bpf-filter", &bpf_filter) == 1) {
316  if (strlen(bpf_filter) > 0) {
317  pfconf->bpf_filter = SCStrdup(bpf_filter);
318  if (unlikely(pfconf->bpf_filter == NULL)) {
320  "Can't allocate BPF filter string");
321  } else {
322  SCLogDebug("Going to use command-line provided bpf filter %s",
323  pfconf->bpf_filter);
324  }
325  }
326  } else {
327  if (ConfGetChildValueWithDefault(if_root, if_default, "bpf-filter", &bpf_filter) == 1) {
328  if (strlen(bpf_filter) > 0) {
329  pfconf->bpf_filter = SCStrdup(bpf_filter);
330  if (unlikely(pfconf->bpf_filter == NULL)) {
332  "Can't allocate BPF filter string");
333  } else {
334  SCLogDebug("Going to use bpf filter %s",
335  pfconf->bpf_filter);
336  }
337  }
338  }
339  }
340 
341  if (ConfGet("pfring.cluster-type", &tmpctype) == 1) {
342  SCLogDebug("Going to use command-line provided cluster-type");
343  getctype = 1;
344  } else {
345  if (strncmp(pfconf->iface, "zc", 2) == 0) {
346  SCLogInfo("ZC interface detected, not setting cluster type for PF_RING (iface %s)",
347  pfconf->iface);
348  } else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) {
349  SCLogInfo("DNA interface detected, not setting cluster type for PF_RING (iface %s)",
350  pfconf->iface);
351  } else if (ConfGetChildValueWithDefault(if_root, if_default, "cluster-type", &tmpctype) != 1) {
353  "Could not get cluster-type from config");
354  } else {
355  getctype = 1;
356  }
357  }
358 
359  if (getctype) {
360  if (strcmp(tmpctype, "cluster_round_robin") == 0) {
361  SCLogInfo("Using round-robin cluster mode for PF_RING (iface %s)",
362  pfconf->iface);
363  pfconf->ctype = CLUSTER_ROUND_ROBIN;
364  } else if (strcmp(tmpctype, "cluster_flow") == 0) {
365  SCLogInfo("Using flow cluster mode for PF_RING (iface %s)",
366  pfconf->iface);
367  pfconf->ctype = CLUSTER_FLOW;
368  } else {
370  "invalid cluster-type %s",
371  tmpctype);
372  SCFree(pfconf);
373  return NULL;
374  }
375  }
376  if (ConfGetChildValueWithDefault(if_root, if_default, "checksum-checks", &tmpctype) == 1) {
377  if (strcmp(tmpctype, "auto") == 0) {
379  } else if (ConfValIsTrue(tmpctype)) {
381  } else if (ConfValIsFalse(tmpctype)) {
383  } else if (strcmp(tmpctype, "rx-only") == 0) {
385  } else {
386  SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid value for checksum-checks for %s", pfconf->iface);
387  }
388  }
389 
390  if (ConfGetChildValueBoolWithDefault(if_root, if_default, "bypass", &bool_val) == 1) {
391  if (bool_val) {
392 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
393  SCLogConfig("Enabling bypass support in PF_RING for iface %s (if supported by underlying hw)", pfconf->iface);
394  pfconf->flags |= PFRING_CONF_FLAGS_BYPASS;
395 #else
396  SCLogError(SC_ERR_BYPASS_NOT_SUPPORTED, "Bypass is not supported by this Pfring version, please upgrade");
397  SCFree(pfconf);
398  return NULL;
399 #endif
400  }
401  }
402 
403  if (LiveGetOffload() == 0) {
404  if (GetIfaceOffloading(iface, 0, 1) == 1) {
406  "Using PF_RING with offloading activated leads to capture problems");
407  }
408  } else {
410  }
411  return pfconf;
412 }
413 
414 static int PfringConfigGetThreadsCount(void *conf)
415 {
416  PfringIfaceConfig *pfp = (PfringIfaceConfig *)conf;
417  return pfp->threads;
418 }
419 
420 static int PfringConfLevel(void)
421 {
422  const char *def_dev = NULL;
423  /* 1.0 config should return a string */
424  if (ConfGet("pfring.interface", &def_dev) != 1) {
425  return PFRING_CONF_V2;
426  } else {
427  return PFRING_CONF_V1;
428  }
429 }
430 
431 static int GetDevAndParser(const char **live_dev, ConfigIfaceParserFunc *parser)
432 {
433  ConfGet("pfring.live-interface", live_dev);
434 
435  /* determine which config type we have */
436  if (PfringConfLevel() > PFRING_CONF_V1) {
437  *parser = ParsePfringConfig;
438  } else {
439  SCLogInfo("Using 1.0 style configuration for pfring");
440  *parser = OldParsePfringConfig;
441  /* In v1: try to get interface name from config */
442  if (*live_dev == NULL) {
443  if (ConfGet("pfring.interface", live_dev) == 1) {
444  SCLogInfo("Using interface %s", *live_dev);
445  LiveRegisterDevice(*live_dev);
446  } else {
447  SCLogInfo("No interface found, problem incoming");
448  *live_dev = NULL;
449  }
450  }
451  }
452 
453  return 0;
454 }
455 #endif
456 
458 {
459  SCEnter();
460 
461 /* We include only if pfring is enabled */
462 #ifdef HAVE_PFRING
463  int ret;
464  const char *live_dev = NULL;
465  ConfigIfaceParserFunc tparser;
466 
468 
469  TimeModeSetLive();
470 
471  ret = GetDevAndParser(&live_dev, &tparser);
472  if (ret != 0) {
474  "Unable to get parser and interface params");
475  exit(EXIT_FAILURE);
476  }
477 
478  ret = RunModeSetLiveCaptureAutoFp(tparser,
479  PfringConfigGetThreadsCount,
480  "ReceivePfring",
481  "DecodePfring", thread_name_autofp,
482  live_dev);
483  if (ret != 0) {
484  SCLogError(SC_ERR_RUNMODE, "Runmode start failed");
485  exit(EXIT_FAILURE);
486  }
487 
488  SCLogInfo("RunModeIdsPfringAutoFp initialised");
489 #endif /* HAVE_PFRING */
490 
491  return 0;
492 }
493 
495 {
496  SCEnter();
497 
498 /* We include only if pfring is enabled */
499 #ifdef HAVE_PFRING
500  int ret;
501  const char *live_dev = NULL;
502  ConfigIfaceParserFunc tparser;
503 
505 
506  TimeModeSetLive();
507 
508  ret = GetDevAndParser(&live_dev, &tparser);
509  if (ret != 0) {
511  "Unable to get parser and interface params");
512  exit(EXIT_FAILURE);
513  }
514 
515  ret = RunModeSetLiveCaptureSingle(tparser,
516  PfringConfigGetThreadsCount,
517  "ReceivePfring",
518  "DecodePfring", thread_name_single,
519  live_dev);
520  if (ret != 0) {
521  SCLogError(SC_ERR_RUNMODE, "Runmode start failed");
522  exit(EXIT_FAILURE);
523  }
524 
525  SCLogInfo("RunModeIdsPfringSingle initialised");
526 #endif /* HAVE_PFRING */
527 
528  return 0;
529 }
530 
532 {
533  SCEnter();
534 
535 /* We include only if pfring is enabled */
536 #ifdef HAVE_PFRING
537  int ret;
538  const char *live_dev = NULL;
539  ConfigIfaceParserFunc tparser;
540 
542 
543  TimeModeSetLive();
544 
545  ret = GetDevAndParser(&live_dev, &tparser);
546  if (ret != 0) {
548  "Unable to get parser and interface params");
549  exit(EXIT_FAILURE);
550  }
551 
552  ret = RunModeSetLiveCaptureWorkers(tparser,
553  PfringConfigGetThreadsCount,
554  "ReceivePfring",
555  "DecodePfring", thread_name_workers,
556  live_dev);
557  if (ret != 0) {
558  SCLogError(SC_ERR_RUNMODE, "Runmode start failed");
559  exit(EXIT_FAILURE);
560  }
561 
562  SCLogInfo("RunModeIdsPfringWorkers initialised");
563 #endif /* HAVE_PFRING */
564 
565  return 0;
566 }
thread_name_workers
const char * thread_name_workers
Definition: runmodes.c:63
RunModeIdsPfringWorkers
int RunModeIdsPfringWorkers(void)
Definition: runmode-pfring.c:531
util-byte.h
tm-threads.h
SC_ERR_NIC_OFFLOADING
@ SC_ERR_NIC_OFFLOADING
Definition: util-error.h:317
StringParseUint16
int StringParseUint16(uint16_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:336
PfringIfaceConfig_
Definition: source-pfring.h:38
LiveRegisterDevice
int LiveRegisterDevice(const char *dev)
Add a pcap device for monitoring and create structure.
Definition: util-device.c:124
SC_ERR_MISSING_CONFIG_PARAM
@ SC_ERR_MISSING_CONFIG_PARAM
Definition: util-error.h:148
RunModeSetLiveCaptureWorkers
int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:341
SC_ERR_INVALID_VALUE
@ SC_ERR_INVALID_VALUE
Definition: util-error.h:160
GetIfaceRSSQueuesNum
int GetIfaceRSSQueuesNum(const char *pcap_dev)
Definition: util-ioctl.c:737
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:286
PfringIfaceConfig_::cluster_id
int cluster_id
Definition: source-pfring.h:42
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SC_ERR_INVALID_CLUSTER_TYPE
@ SC_ERR_INVALID_CLUSTER_TYPE
Definition: util-error.h:66
ConfGetChildValueBoolWithDefault
int ConfGetChildValueBoolWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, int *val)
Definition: conf.c:543
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
LiveGetOffload
int LiveGetOffload(void)
Definition: util-device.c:79
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
PfringIfaceConfig_::bpf_filter
char * bpf_filter
Definition: source-pfring.h:49
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:304
RunModeInitialize
void RunModeInitialize(void)
Definition: runmodes.c:907
RunModeIdsPfringRegister
void RunModeIdsPfringRegister(void)
Definition: runmode-pfring.c:51
CHECKSUM_VALIDATION_RXONLY
@ CHECKSUM_VALIDATION_RXONLY
Definition: decode.h:45
util-runmodes.h
thread_name_autofp
const char * thread_name_autofp
Definition: runmodes.c:61
CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_DISABLE
Definition: decode.h:42
SC_ERR_RUNMODE
@ SC_ERR_RUNMODE
Definition: util-error.h:219
thread_name_single
const char * thread_name_single
Definition: runmodes.c:62
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:566
RunModeIdsPfringGetDefaultMode
const char * RunModeIdsPfringGetDefaultMode(void)
Definition: runmode-pfring.c:42
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
RunModeSetLiveCaptureAutoFp
int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:89
CHECKSUM_VALIDATION_ENABLE
@ CHECKSUM_VALIDATION_ENABLE
Definition: decode.h:43
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:331
PfringIfaceConfig_::iface
char iface[PFRING_IFACE_NAME_LENGTH]
Definition: source-pfring.h:45
RunModeIdsPfringAutoFp
int RunModeIdsPfringAutoFp(void)
Definition: runmode-pfring.c:457
CHECKSUM_VALIDATION_AUTO
@ CHECKSUM_VALIDATION_AUTO
Definition: decode.h:44
util-device.h
util-debug.h
runmode-pfring.h
util-cpu.h
SC_ERR_GET_CLUSTER_TYPE_FAILED
@ SC_ERR_GET_CLUSTER_TYPE_FAILED
Definition: util-error.h:65
LiveGetDevice
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:278
ConfFindDeviceConfig
ConfNode * ConfFindDeviceConfig(ConfNode *node, const char *iface)
Find the configuration node for a specific device.
Definition: util-conf.c:129
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
util-affinity.h
ConfGetChildValueWithDefault
int ConfGetChildValueWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, const char **vptr)
Definition: conf.c:416
util-time.h
SC_ERR_INVALID_ARGUMENT
@ SC_ERR_INVALID_ARGUMENT
Definition: util-error.h:43
source-pfring.h
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:313
PFRING_CONF_FLAGS_CLUSTER
#define PFRING_CONF_FLAGS_CLUSTER
Definition: source-pfring.h:34
conf.h
GetIfaceOffloading
int GetIfaceOffloading(const char *dev, int csum, int other)
output offloading status of the link
Definition: util-ioctl.c:694
DisableIfaceOffloading
int DisableIfaceOffloading(LiveDevice *dev, int csum, int other)
Definition: util-ioctl.c:707
PFRING_CONF_FLAGS_BYPASS
#define PFRING_CONF_FLAGS_BYPASS
Definition: source-pfring.h:35
runmodes.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
TimeModeSetLive
void TimeModeSetLive(void)
Definition: util-time.c:97
PfringIfaceConfig_::flags
uint32_t flags
Definition: source-pfring.h:39
RUNMODE_PFRING
@ RUNMODE_PFRING
Definition: runmodes.h:31
CLUSTER_ROUND_ROBIN
#define CLUSTER_ROUND_ROBIN
Definition: source-pfring.h:76
suricata-common.h
RunModeRegisterNewRunMode
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void))
Registers a new runmode.
Definition: runmodes.c:419
SCLogPerf
#define SCLogPerf(...)
Definition: util-debug.h:224
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
PfringIfaceConfig_::DerefFunc
void(* DerefFunc)(void *)
Definition: source-pfring.h:53
SC_ERR_BYPASS_NOT_SUPPORTED
@ SC_ERR_BYPASS_NOT_SUPPORTED
Definition: util-error.h:335
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
SC_ATOMIC_RESET
#define SC_ATOMIC_RESET(name)
wrapper for reinitializing an atomic variable.
Definition: util-atomic.h:295
ConfigIfaceParserFunc
void *(* ConfigIfaceParserFunc)(const char *)
Definition: util-runmodes.h:26
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
PfringIfaceConfig_::threads
int threads
Definition: source-pfring.h:47
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
util-ioctl.h
ConfValIsFalse
int ConfValIsFalse(const char *val)
Check if a value is false.
Definition: conf.c:591
RunModeSetLiveCaptureSingle
int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:375
SC_ERR_MEM_ALLOC
@ SC_ERR_MEM_ALLOC
Definition: util-error.h:31
CLUSTER_FLOW
#define CLUSTER_FLOW
Definition: source-pfring.h:75
PFRING_CONF_V1
#define PFRING_CONF_V1
Definition: runmode-pfring.c:39
UtilCpuGetNumProcessorsOnline
uint16_t UtilCpuGetNumProcessorsOnline(void)
Get the number of cpus online in the system.
Definition: util-cpu.c:106
PfringIfaceConfig_::checksum_mode
ChecksumValidationMode checksum_mode
Definition: source-pfring.h:51
RunModeIdsPfringSingle
int RunModeIdsPfringSingle(void)
Definition: runmode-pfring.c:494
output.h
PFRING_CONF_V2
#define PFRING_CONF_V2
Definition: runmode-pfring.c:40
PfringIfaceConfig_::ctype
unsigned int ctype
Definition: source-pfring.h:43