suricata
runmode-pfring.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2018 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "runmode-pfring.h"
20 #include "tm-threads.h"
21 #include "conf.h"
22 #include "runmodes.h"
23 #include "source-pfring.h"
24 #include "suricata.h"
25 #include "util-bpf.h"
26 #include "util-debug.h"
27 #include "util-time.h"
28 #include "util-cpu.h"
29 #include "util-runmodes.h"
30 #include "util-device.h"
31 #include "util-ioctl.h"
32 #include "util-byte.h"
33 #include "util-conf.h"
34 
35 #ifdef HAVE_PFRING
36 #include <pfring.h>
37 #endif
38 
39 #define PFRING_CONF_V1 1
40 #define PFRING_CONF_V2 2
41 
43 {
44 #ifdef HAVE_PFRING
45  return "workers";
46 #else
47  return NULL;
48 #endif
49 }
50 
52 {
54  "Multi threaded pfring mode. Packets from "
55  "each flow are assigned to a single detect "
56  "thread, unlike \"pfring_auto\" where packets "
57  "from the same flow can be processed by any "
58  "detect thread",
61  RUNMODE_PFRING, "single", "Single threaded pfring mode", RunModeIdsPfringSingle, NULL);
63  "Workers pfring mode, each thread does all"
64  " tasks from acquisition to logging",
66  return;
67 }
68 
69 #ifdef HAVE_PFRING
70 static void PfringDerefConfig(void *conf)
71 {
72  PfringIfaceConfig *pfp = (PfringIfaceConfig *)conf;
73  if (SC_ATOMIC_SUB(pfp->ref, 1) == 1) {
74  SCFree(pfp);
75  }
76 }
77 
78 /**
79  * \brief extract information from config file
80  *
81  * The returned structure will be freed by the thread init function.
82  * This is thus necessary to or copy the structure before giving it
83  * to thread or to reparse the file for each thread (and thus have
84  * new structure.
85  *
86  * If old config system is used, then return the same parameters
87  * value for each interface.
88  *
89  * \return a PfringIfaceConfig corresponding to the interface name
90  */
91 static void *OldParsePfringConfig(const char *iface)
92 {
93  const char *threadsstr = NULL;
94  PfringIfaceConfig *pfconf = SCMalloc(sizeof(*pfconf));
95  const char *tmpclusterid;
96  const char *tmpctype = NULL;
97  cluster_type default_ctype = CLUSTER_FLOW;
98 
99  if (unlikely(pfconf == NULL)) {
100  return NULL;
101  }
102 
103  if (iface == NULL) {
104  SCFree(pfconf);
105  return NULL;
106  }
107 
108  strlcpy(pfconf->iface, iface, sizeof(pfconf->iface));
109  pfconf->flags = 0;
110  pfconf->threads = 1;
111  pfconf->cluster_id = 1;
112  pfconf->ctype = default_ctype;
113  pfconf->DerefFunc = PfringDerefConfig;
115  SC_ATOMIC_INIT(pfconf->ref);
116  (void) SC_ATOMIC_ADD(pfconf->ref, 1);
117 
118  /* Find initial node */
119  if (ConfGet("pfring.threads", &threadsstr) != 1) {
120  pfconf->threads = 1;
121  } else {
122  if (threadsstr != NULL) {
123  if (StringParseInt32(&pfconf->threads, 10, 0, threadsstr) < 0) {
124  SCLogWarning("Invalid value for "
125  "pfring.threads: '%s'. Resetting to 1.",
126  threadsstr);
127  pfconf->threads = 1;
128  }
129  }
130  }
131  if (pfconf->threads == 0) {
132  pfconf->threads = 1;
133  }
134 
135  SC_ATOMIC_RESET(pfconf->ref);
136  (void) SC_ATOMIC_ADD(pfconf->ref, pfconf->threads);
137 
138  if (strncmp(pfconf->iface, "zc", 2) == 0) {
139  SCLogInfo("%s: ZC interface detected, not setting cluster-id", pfconf->iface);
140  }
141  else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) {
142  SCLogInfo("DNA interface detected, not setting cluster-id");
143  } else if (ConfGet("pfring.cluster-id", &tmpclusterid) != 1) {
144  SCLogError("Could not get cluster-id from config");
145  } else {
146  if (StringParseInt32(&pfconf->cluster_id, 10, 0, (const char *)tmpclusterid) < 0) {
147  SCLogWarning("Invalid value for "
148  "pfring.cluster_id: '%s'. Resetting to 1.",
149  tmpclusterid);
150  pfconf->cluster_id = 1;
151  }
152  pfconf->flags |= PFRING_CONF_FLAGS_CLUSTER;
153  SCLogDebug("Going to use cluster-id %" PRId32, pfconf->cluster_id);
154  }
155 
156  if (strncmp(pfconf->iface, "zc", 2) == 0) {
157  SCLogInfo("%s: ZC interface detected, not setting cluster type for PF_RING", pfconf->iface);
158  } else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) {
159  SCLogInfo(
160  "%s: DNA interface detected, not setting cluster type for PF_RING", pfconf->iface);
161  } else if (ConfGet("pfring.cluster-type", &tmpctype) != 1) {
162  SCLogError("Could not get cluster-type from config");
163  } else if (strcmp(tmpctype, "cluster_round_robin") == 0) {
164  SCLogInfo("%s: Using round-robin cluster mode for PF_RING", pfconf->iface);
165  pfconf->ctype = (cluster_type)tmpctype;
166  } else if (strcmp(tmpctype, "cluster_flow") == 0) {
167  SCLogInfo("%s: Using flow cluster mode for PF_RING", pfconf->iface);
168  pfconf->ctype = (cluster_type)tmpctype;
169  } else {
170  SCLogError("invalid cluster-type %s", tmpctype);
171  SCFree(pfconf);
172  return NULL;
173  }
174 
175  return pfconf;
176 }
177 
178 /**
179  * \brief extract information from config file
180  *
181  * The returned structure will be freed by the thread init function.
182  * This is thus necessary to or copy the structure before giving it
183  * to thread or to reparse the file for each thread (and thus have
184  * new structure.
185  *
186  * If old config system is used, then return the same parameters
187  * value for each interface.
188  *
189  * \return a PfringIfaceConfig corresponding to the interface name
190  */
191 static void *ParsePfringConfig(const char *iface)
192 {
193  const char *threadsstr = NULL;
194  ConfNode *if_root;
195  ConfNode *if_default = NULL;
196  ConfNode *pf_ring_node;
197  PfringIfaceConfig *pfconf = SCMalloc(sizeof(*pfconf));
198  const char *tmpclusterid;
199  const char *tmpctype = NULL;
200  cluster_type default_ctype = CLUSTER_FLOW;
201  int getctype = 0;
202  int bool_val;
203 
204  if (unlikely(pfconf == NULL)) {
205  return NULL;
206  }
207 
208  if (iface == NULL) {
209  SCFree(pfconf);
210  return NULL;
211  }
212 
213  memset(pfconf, 0, sizeof(PfringIfaceConfig));
214  strlcpy(pfconf->iface, iface, sizeof(pfconf->iface));
215  pfconf->threads = 1;
216  pfconf->cluster_id = 1;
217  pfconf->ctype = (cluster_type)default_ctype;
218  pfconf->DerefFunc = PfringDerefConfig;
219  SC_ATOMIC_INIT(pfconf->ref);
220  (void) SC_ATOMIC_ADD(pfconf->ref, 1);
221 
222  /* Find initial node */
223  pf_ring_node = ConfGetNode("pfring");
224  if (pf_ring_node == NULL) {
225  SCLogInfo("Unable to find pfring config using default value");
226  return pfconf;
227  }
228 
229  if_root = ConfFindDeviceConfig(pf_ring_node, iface);
230 
231  if_default = ConfFindDeviceConfig(pf_ring_node, "default");
232 
233  if (if_root == NULL && if_default == NULL) {
234  SCLogInfo("Unable to find pfring config for "
235  "interface %s, using default value or 1.0 "
236  "configuration system. ",
237  iface);
238  return pfconf;
239  }
240 
241  /* If there is no setting for current interface use default one as main iface */
242  if (if_root == NULL) {
243  if_root = if_default;
244  if_default = NULL;
245  }
246 
247  if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) {
248  pfconf->threads = 1;
249  } else if (threadsstr != NULL) {
250  if (strcmp(threadsstr, "auto") == 0) {
251  pfconf->threads = (int)UtilCpuGetNumProcessorsOnline();
252  if (pfconf->threads > 0) {
253  SCLogPerf("%u cores, so using %u threads", pfconf->threads, pfconf->threads);
254  } else {
255  pfconf->threads = GetIfaceRSSQueuesNum(iface);
256  if (pfconf->threads > 0) {
257  SCLogPerf("%d RSS queues, so using %u threads", pfconf->threads, pfconf->threads);
258  }
259  }
260  } else {
261  uint16_t threads = 0;
262  if (StringParseUint16(&threads, 10, 0, (const char *)threadsstr) < 0) {
263  SCLogWarning("Invalid value for "
264  "pfring.threads: '%s'. Resetting to 1.",
265  threadsstr);
266  pfconf->threads = 1;
267  } else {
268  pfconf->threads = threads;
269  }
270  }
271  }
272  if (pfconf->threads <= 0) {
273  pfconf->threads = 1;
274  }
275 
276  SC_ATOMIC_RESET(pfconf->ref);
277  (void) SC_ATOMIC_ADD(pfconf->ref, pfconf->threads);
278 
279  /* command line value has precedence */
280  if (ConfGet("pfring.cluster-id", &tmpclusterid) == 1) {
281  if (StringParseInt32(&pfconf->cluster_id, 10, 0, (const char *)tmpclusterid) < 0) {
282  SCLogWarning("Invalid value for "
283  "pfring.cluster-id: '%s'. Resetting to 1.",
284  tmpclusterid);
285  pfconf->cluster_id = 1;
286  }
287  pfconf->flags |= PFRING_CONF_FLAGS_CLUSTER;
288  SCLogDebug("Going to use command-line provided cluster-id %" PRId32,
289  pfconf->cluster_id);
290  } else {
291 
292  if (strncmp(pfconf->iface, "zc", 2) == 0) {
293  SCLogInfo(
294  "%s: ZC interface detected, not setting cluster-id for PF_RING", pfconf->iface);
295  } else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) {
296  SCLogInfo("%s: DNA interface detected, not setting cluster-id for PF_RING",
297  pfconf->iface);
298  } else if (ConfGetChildValueWithDefault(if_root, if_default, "cluster-id", &tmpclusterid) != 1) {
299  SCLogError("Could not get cluster-id from config");
300  } else {
301  if (StringParseInt32(&pfconf->cluster_id, 10, 0, (const char *)tmpclusterid) < 0) {
302  SCLogWarning("Invalid value for "
303  "pfring.cluster-id: '%s'. Resetting to 1.",
304  tmpclusterid);
305  pfconf->cluster_id = 1;
306  }
307  pfconf->flags |= PFRING_CONF_FLAGS_CLUSTER;
308  SCLogDebug("Going to use cluster-id %" PRId32, pfconf->cluster_id);
309  }
310  }
311 
312  ConfSetBPFFilter(if_root, if_default, pfconf->iface, &pfconf->bpf_filter);
313 
314  if (EngineModeIsIPS()) {
315  FatalError("IPS mode not supported in PF_RING.");
316  }
317 
318  if (ConfGet("pfring.cluster-type", &tmpctype) == 1) {
319  SCLogDebug("Going to use command-line provided cluster-type");
320  getctype = 1;
321  } else {
322  if (strncmp(pfconf->iface, "zc", 2) == 0) {
323  SCLogInfo("%s: ZC interface detected, not setting cluster type for PF_RING",
324  pfconf->iface);
325  } else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) {
326  SCLogInfo("%s: DNA interface detected, not setting cluster type for PF_RING",
327  pfconf->iface);
328  } else if (ConfGetChildValueWithDefault(if_root, if_default, "cluster-type", &tmpctype) != 1) {
329  SCLogError("Could not get cluster-type from config");
330  } else {
331  getctype = 1;
332  }
333  }
334 
335  if (getctype) {
336  if (strcmp(tmpctype, "cluster_round_robin") == 0) {
337  SCLogInfo("%s: Using round-robin cluster mode for PF_RING."
338  " This mode is not recommended.",
339  pfconf->iface);
340  pfconf->ctype = CLUSTER_ROUND_ROBIN;
341  } else if (strcmp(tmpctype, "cluster_flow") == 0) {
342  SCLogInfo("%s: Using flow cluster mode for PF_RING", pfconf->iface);
343  pfconf->ctype = CLUSTER_FLOW;
344  } else if (strcmp(tmpctype, "cluster_inner_flow") == 0) {
345  SCLogInfo("%s: Using flow cluster mode inner mode for PF_RING", pfconf->iface);
346  pfconf->ctype = CLUSTER_INNER_FLOW;
347  } else if (strcmp(tmpctype, "cluster_inner_flow_2_tuple") == 0) {
348  SCLogInfo("%s: Using flow cluster inner 2 tuple mode for PF_RING", pfconf->iface);
350  } else if (strcmp(tmpctype, "cluster_inner_flow_4_tuple") == 0) {
351  SCLogInfo("%s: Using flow cluster inner 4 tuple mode for PF_RING", pfconf->iface);
353  } else if (strcmp(tmpctype, "cluster_inner_flow_5_tuple") == 0) {
354  SCLogInfo("%s: Using flow cluster inner 5 tuple mode for PF_RING", pfconf->iface);
356  } else {
357  SCLogError("invalid cluster-type %s", tmpctype);
358  SCFree(pfconf);
359  return NULL;
360  }
361  }
362  if (ConfGetChildValueWithDefault(if_root, if_default, "checksum-checks", &tmpctype) == 1) {
363  if (strcmp(tmpctype, "auto") == 0) {
365  } else if (ConfValIsTrue(tmpctype)) {
367  } else if (ConfValIsFalse(tmpctype)) {
369  } else if (strcmp(tmpctype, "rx-only") == 0) {
371  } else {
372  SCLogError("%s: Invalid value for checksum-checks", pfconf->iface);
373  }
374  }
375 
376  if (ConfGetChildValueBoolWithDefault(if_root, if_default, "bypass", &bool_val) == 1) {
377  if (bool_val) {
378 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
379  SCLogConfig("%s: Enabling bypass support in PF_RING (if supported by underlying hw)",
380  pfconf->iface);
381  pfconf->flags |= PFRING_CONF_FLAGS_BYPASS;
382 #else
383  SCLogError("Bypass is not supported by this Pfring version, please upgrade");
384  SCFree(pfconf);
385  return NULL;
386 #endif
387  }
388  }
389 
390  if (LiveGetOffload() == 0) {
391  if (GetIfaceOffloading(iface, 0, 1) == 1) {
392  SCLogWarning("Using PF_RING with offloading activated leads to capture problems");
393  }
394  } else {
396  }
397  return pfconf;
398 }
399 
400 static int PfringConfigGetThreadsCount(void *conf)
401 {
402  PfringIfaceConfig *pfp = (PfringIfaceConfig *)conf;
403  return pfp->threads;
404 }
405 
406 static int PfringConfLevel(void)
407 {
408  const char *def_dev = NULL;
409  /* 1.0 config should return a string */
410  if (ConfGet("pfring.interface", &def_dev) != 1) {
411  return PFRING_CONF_V2;
412  } else {
413  return PFRING_CONF_V1;
414  }
415 }
416 
417 static int GetDevAndParser(const char **live_dev, ConfigIfaceParserFunc *parser)
418 {
419  ConfGet("pfring.live-interface", live_dev);
420 
421  /* determine which config type we have */
422  if (PfringConfLevel() > PFRING_CONF_V1) {
423  *parser = ParsePfringConfig;
424  } else {
425  SCLogInfo("Using 1.0 style configuration for pfring");
426  *parser = OldParsePfringConfig;
427  /* In v1: try to get interface name from config */
428  if (*live_dev == NULL) {
429  if (ConfGet("pfring.interface", live_dev) == 1) {
430  SCLogInfo("Using interface %s", *live_dev);
431  LiveRegisterDevice(*live_dev);
432  } else {
433  SCLogInfo("No interface found, problem incoming");
434  *live_dev = NULL;
435  }
436  }
437  }
438 
439  return 0;
440 }
441 #endif
442 
444 {
445  SCEnter();
446 
447 /* We include only if pfring is enabled */
448 #ifdef HAVE_PFRING
449  int ret;
450  const char *live_dev = NULL;
451  ConfigIfaceParserFunc tparser;
452 
453  TimeModeSetLive();
454 
455  ret = GetDevAndParser(&live_dev, &tparser);
456  if (ret != 0) {
457  FatalError("Unable to get parser and interface params");
458  }
459 
460  ret = RunModeSetLiveCaptureAutoFp(tparser, PfringConfigGetThreadsCount, "ReceivePfring",
461  "DecodePfring", thread_name_autofp, live_dev);
462  if (ret != 0) {
463  FatalError("Runmode start failed");
464  }
465 
466  SCLogInfo("RunModeIdsPfringAutoFp initialised");
467 #endif /* HAVE_PFRING */
468 
469  return 0;
470 }
471 
473 {
474  SCEnter();
475 
476 /* We include only if pfring is enabled */
477 #ifdef HAVE_PFRING
478  int ret;
479  const char *live_dev = NULL;
480  ConfigIfaceParserFunc tparser;
481 
482  TimeModeSetLive();
483 
484  ret = GetDevAndParser(&live_dev, &tparser);
485  if (ret != 0) {
486  FatalError("Unable to get parser and interface params");
487  }
488 
489  ret = RunModeSetLiveCaptureSingle(tparser,
490  PfringConfigGetThreadsCount,
491  "ReceivePfring",
492  "DecodePfring", thread_name_single,
493  live_dev);
494  if (ret != 0) {
495  FatalError("Runmode start failed");
496  }
497 
498  SCLogInfo("RunModeIdsPfringSingle initialised");
499 #endif /* HAVE_PFRING */
500 
501  return 0;
502 }
503 
505 {
506  SCEnter();
507 
508 /* We include only if pfring is enabled */
509 #ifdef HAVE_PFRING
510  int ret;
511  const char *live_dev = NULL;
512  ConfigIfaceParserFunc tparser;
513 
514  TimeModeSetLive();
515 
516  ret = GetDevAndParser(&live_dev, &tparser);
517  if (ret != 0) {
518  FatalError("Unable to get parser and interface params");
519  }
520 
521  ret = RunModeSetLiveCaptureWorkers(tparser, PfringConfigGetThreadsCount, "ReceivePfring",
522  "DecodePfring", thread_name_workers, live_dev);
523  if (ret != 0) {
524  FatalError("Runmode start failed");
525  }
526 
527  SCLogInfo("RunModeIdsPfringWorkers initialised");
528 #endif /* HAVE_PFRING */
529 
530  return 0;
531 }
thread_name_workers
const char * thread_name_workers
Definition: runmodes.c:81
RunModeIdsPfringWorkers
int RunModeIdsPfringWorkers(void)
Definition: runmode-pfring.c:504
util-byte.h
tm-threads.h
PfringIfaceConfig_
Definition: source-pfring.h:36
LiveRegisterDevice
int LiveRegisterDevice(const char *dev)
Add a pcap device for monitoring and create structure.
Definition: util-device.c:126
CLUSTER_INNER_FLOW_2_TUPLE
#define CLUSTER_INNER_FLOW_2_TUPLE
Definition: source-pfring.h:81
RunModeSetLiveCaptureWorkers
int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:322
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:315
PfringIfaceConfig_::cluster_id
int cluster_id
Definition: source-pfring.h:40
util-bpf.h
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
ConfGetChildValueBoolWithDefault
int ConfGetChildValueBoolWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, int *val)
Definition: conf.c:514
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
LiveGetOffload
int LiveGetOffload(void)
Definition: util-device.c:81
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
StringParseUint16
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:337
RunModeIdsPfringRegister
void RunModeIdsPfringRegister(void)
Definition: runmode-pfring.c:51
CHECKSUM_VALIDATION_RXONLY
@ CHECKSUM_VALIDATION_RXONLY
Definition: decode.h:48
util-runmodes.h
thread_name_autofp
const char * thread_name_autofp
Definition: runmodes.c:79
RunModeRegisterNewRunMode
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), void(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
Definition: runmodes.c:491
CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_DISABLE
Definition: decode.h:45
StringParseInt32
int StringParseInt32(int32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:622
thread_name_single
const char * thread_name_single
Definition: runmodes.c:80
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:537
CLUSTER_INNER_FLOW_5_TUPLE
#define CLUSTER_INNER_FLOW_5_TUPLE
Definition: source-pfring.h:83
RunModeIdsPfringGetDefaultMode
const char * RunModeIdsPfringGetDefaultMode(void)
Definition: runmode-pfring.c:42
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
RunModeSetLiveCaptureAutoFp
int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:86
CHECKSUM_VALIDATION_ENABLE
@ CHECKSUM_VALIDATION_ENABLE
Definition: decode.h:46
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
PfringIfaceConfig_::iface
char iface[PFRING_IFACE_NAME_LENGTH]
Definition: source-pfring.h:43
RunModeIdsPfringAutoFp
int RunModeIdsPfringAutoFp(void)
Definition: runmode-pfring.c:443
CHECKSUM_VALIDATION_AUTO
@ CHECKSUM_VALIDATION_AUTO
Definition: decode.h:47
util-device.h
util-debug.h
runmode-pfring.h
util-cpu.h
LiveGetDevice
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:248
GetIfaceRSSQueuesNum
int GetIfaceRSSQueuesNum(const char *dev)
Definition: util-ioctl.c:709
ConfFindDeviceConfig
ConfNode * ConfFindDeviceConfig(ConfNode *node, const char *iface)
Find the configuration node for a specific device.
Definition: util-conf.c:121
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
ConfGetChildValueWithDefault
int ConfGetChildValueWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, const char **vptr)
Definition: conf.c:378
util-time.h
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
source-pfring.h
PfringIfaceConfig_::bpf_filter
const char * bpf_filter
Definition: source-pfring.h:47
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:342
PFRING_CONF_FLAGS_CLUSTER
#define PFRING_CONF_FLAGS_CLUSTER
Definition: source-pfring.h:32
conf.h
CLUSTER_INNER_FLOW
#define CLUSTER_INNER_FLOW
Definition: source-pfring.h:80
GetIfaceOffloading
int GetIfaceOffloading(const char *dev, int csum, int other)
output offloading status of the link
Definition: util-ioctl.c:666
DisableIfaceOffloading
int DisableIfaceOffloading(LiveDevice *dev, int csum, int other)
Definition: util-ioctl.c:679
PFRING_CONF_FLAGS_BYPASS
#define PFRING_CONF_FLAGS_BYPASS
Definition: source-pfring.h:33
runmodes.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
TimeModeSetLive
void TimeModeSetLive(void)
Definition: util-time.c:99
PfringIfaceConfig_::flags
uint32_t flags
Definition: source-pfring.h:37
util-conf.h
RUNMODE_PFRING
@ RUNMODE_PFRING
Definition: runmodes.h:31
CLUSTER_ROUND_ROBIN
#define CLUSTER_ROUND_ROBIN
Definition: source-pfring.h:78
suricata-common.h
ConfSetBPFFilter
void ConfSetBPFFilter(ConfNode *if_root, ConfNode *if_default, const char *iface, const char **bpf_filter)
Definition: util-bpf.c:30
SCLogPerf
#define SCLogPerf(...)
Definition: util-debug.h:230
CLUSTER_INNER_FLOW_4_TUPLE
#define CLUSTER_INNER_FLOW_4_TUPLE
Definition: source-pfring.h:82
PfringIfaceConfig_::DerefFunc
void(* DerefFunc)(void *)
Definition: source-pfring.h:51
FatalError
#define FatalError(...)
Definition: util-debug.h:502
SC_ATOMIC_RESET
#define SC_ATOMIC_RESET(name)
wrapper for reinitializing an atomic variable.
Definition: util-atomic.h:324
ConfigIfaceParserFunc
void *(* ConfigIfaceParserFunc)(const char *)
Definition: util-runmodes.h:26
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
PfringIfaceConfig_::threads
int threads
Definition: source-pfring.h:45
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
util-ioctl.h
ConfValIsFalse
int ConfValIsFalse(const char *val)
Check if a value is false.
Definition: conf.c:562
RunModeSetLiveCaptureSingle
int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
Definition: util-runmodes.c:351
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:228
suricata.h
CLUSTER_FLOW
#define CLUSTER_FLOW
Definition: source-pfring.h:77
PFRING_CONF_V1
#define PFRING_CONF_V1
Definition: runmode-pfring.c:39
UtilCpuGetNumProcessorsOnline
uint16_t UtilCpuGetNumProcessorsOnline(void)
Get the number of cpus online in the system.
Definition: util-cpu.c:108
PfringIfaceConfig_::checksum_mode
ChecksumValidationMode checksum_mode
Definition: source-pfring.h:49
RunModeIdsPfringSingle
int RunModeIdsPfringSingle(void)
Definition: runmode-pfring.c:472
PFRING_CONF_V2
#define PFRING_CONF_V2
Definition: runmode-pfring.c:40
PfringIfaceConfig_::ctype
unsigned int ctype
Definition: source-pfring.h:41