suricata
source-af-packet.c File Reference
#include "suricata-common.h"
#include "config.h"
#include "suricata.h"
#include "decode.h"
#include "packet-queue.h"
#include "threads.h"
#include "threadvars.h"
#include "tm-queuehandlers.h"
#include "tm-modules.h"
#include "tm-threads.h"
#include "tm-threads-common.h"
#include "conf.h"
#include "util-cpu.h"
#include "util-debug.h"
#include "util-device.h"
#include "util-ebpf.h"
#include "util-error.h"
#include "util-privs.h"
#include "util-optimize.h"
#include "util-checksum.h"
#include "util-ioctl.h"
#include "util-host-info.h"
#include "tmqh-packetpool.h"
#include "source-af-packet.h"
#include "runmodes.h"
#include "flow-storage.h"
#include "util-bpf.h"
Include dependency graph for source-af-packet.c:

Go to the source code of this file.

Data Structures

struct  bpf_program
 
union  thdr
 
struct  AFPThreadVars_
 Structure to hold thread specific variables. More...
 
union  AFPThreadVars_::AFPRing
 
union  AFPThreadVars_::AFPTpacketReq
 
struct  AFPPeersList_
 

Macros

#define PCAP_DONT_INCLUDE_PCAP_BPF_H   1
 
#define SC_PCAP_DONT_INCLUDE_PCAP_H   1
 
#define AFP_IFACE_NAME_LENGTH   48
 
#define AFP_STATE_DOWN   0
 
#define AFP_STATE_UP   1
 
#define AFP_RECONNECT_TIMEOUT   500000
 
#define AFP_DOWN_COUNTER_INTERVAL   40
 
#define POLL_TIMEOUT   100
 
#define TP_STATUS_USER_BUSY   (1 << 31)
 
#define TP_STATUS_VLAN_VALID   (1 << 4)
 
#define MAX_MAPS   32
 
#define AFP_PEERS_MAX_TRY   4
 
#define AFP_PEERS_WAIT   20000
 
#define T_DATA_SIZE   70000
 

Typedefs

typedef struct AFPThreadVars_ AFPThreadVars
 Structure to hold thread specific variables. More...
 
typedef struct AFPPeersList_ AFPPeersList
 

Enumerations

enum  { AFP_READ_OK, AFP_READ_FAILURE, AFP_SURI_FAILURE, AFP_KERNEL_DROP }
 
enum  { AFP_FATAL_ERROR = 1, AFP_RECOVERABLE_ERROR }
 

Functions

TmEcode ReceiveAFP (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *)
 
TmEcode ReceiveAFPThreadInit (ThreadVars *tv, const void *initdata, void **data)
 Init function for ReceiveAFP. More...
 
void ReceiveAFPThreadExitStats (ThreadVars *tv, void *data)
 This function prints stats to the screen at exit. More...
 
TmEcode ReceiveAFPThreadDeinit (ThreadVars *tv, void *data)
 DeInit function closes af packet socket at exit. More...
 
TmEcode ReceiveAFPLoop (ThreadVars *tv, void *data, void *slot)
 Main AF_PACKET reading Loop function. More...
 
TmEcode DecodeAFPThreadInit (ThreadVars *, const void *, void **)
 
TmEcode DecodeAFPThreadDeinit (ThreadVars *tv, void *data)
 
TmEcode DecodeAFP (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 This function passes off to link type decoders. More...
 
TmEcode AFPSetBPFFilter (AFPThreadVars *ptv)
 
void TmModuleReceiveAFPRegister (void)
 Registration Function for RecieveAFP. More...
 
TmEcode AFPPeersListInit ()
 Init the global list of AFPPeer. More...
 
TmEcode AFPPeersListCheck ()
 Check that all AFPPeer got a peer. More...
 
void AFPPeersListClean ()
 Clean the global peers list. More...
 
void TmModuleDecodeAFPRegister (void)
 Registration Function for DecodeAFP. More...
 
int AFPGetLinkType (const char *ifname)
 
int AFPIsFanoutSupported (void)
 test if we can use FANOUT. Older kernels like those in CentOS6 have HAVE_PACKET_FANOUT defined but fail to work More...
 

Variables

int max_pending_packets
 
AFPPeersList peerslist
 
bool g_flowv4_ok = true
 
bool g_flowv6_ok = true
 

Detailed Description

Author
Eric Leblond eric@.nosp@m.regi.nosp@m.t.org

AF_PACKET socket acquisition support

Definition in file source-af-packet.c.

Macro Definition Documentation

#define AFP_PEERS_MAX_TRY   4

Referenced by AFPPeersListCheck().

#define AFP_PEERS_WAIT   20000

Referenced by AFPPeersListCheck().

#define T_DATA_SIZE   70000