33 #define PCAP_DONT_INCLUDE_PCAP_BPF_H 1
34 #define SC_PCAP_DONT_INCLUDE_PCAP_H 1
68 #include <sys/ioctl.h>
71 #if HAVE_LINUX_SOCKIOS_H
72 #include <linux/sockios.h>
75 #ifdef HAVE_PACKET_EBPF
76 #include <bpf/libbpf.h>
89 #ifdef HAVE_PCAP_PCAP_H
90 #include <pcap/pcap.h>
95 #if HAVE_LINUX_IF_ETHER_H
96 #include <linux/if_ether.h>
99 #if HAVE_LINUX_IF_PACKET_H
100 #include <linux/if_packet.h>
103 #if HAVE_LINUX_IF_ARP_H
104 #include <linux/if_arp.h>
107 #if HAVE_LINUX_FILTER_H
108 #include <linux/filter.h>
112 #include <sys/mman.h>
115 #ifdef HAVE_HW_TIMESTAMPING
116 #include <linux/net_tstamp.h>
123 #ifndef HAVE_AF_PACKET
157 SCLogError(
"Error creating thread %s: you do not have "
158 "support for AF_PACKET enabled, on Linux host please recompile "
159 "with --enable-af-packet",
166 #define AFP_IFACE_NAME_LENGTH 48
168 #define AFP_STATE_DOWN 0
169 #define AFP_STATE_UP 1
171 #define AFP_RECONNECT_TIMEOUT 500000
172 #define AFP_DOWN_COUNTER_INTERVAL 40
174 #define POLL_TIMEOUT 100
177 #ifndef TP_STATUS_KERNEL
178 #define TP_STATUS_KERNEL 0
180 #ifndef TP_STATUS_USER
181 #define TP_STATUS_USER BIT_U32(0)
183 #ifndef TP_STATUS_COPY
184 #define TP_STATUS_COPY BIT_U32(1)
186 #ifndef TP_STATUS_LOSING
187 #define TP_STATUS_LOSING BIT_U32(2)
189 #ifndef TP_STATUS_CSUMNOTREADY
190 #define TP_STATUS_CSUMNOTREADY BIT_U32(3)
192 #ifndef TP_STATUS_VLAN_VALID
193 #define TP_STATUS_VLAN_VALID BIT_U32(4)
195 #ifndef TP_STATUS_BLK_TMO
196 #define TP_STATUS_BLK_TMO BIT_U32(5)
198 #ifndef TP_STATUS_VLAN_TPID_VALID
199 #define TP_STATUS_VLAN_TPID_VALID BIT_U32(6)
201 #ifndef TP_STATUS_CSUM_VALID
202 #define TP_STATUS_CSUM_VALID BIT_U32(7)
205 #ifndef TP_STATUS_TS_SOFTWARE
206 #define TP_STATUS_TS_SOFTWARE BIT_U32(29)
208 #ifndef TP_STATUS_TS_SYS_HARDWARE
209 #define TP_STATUS_TS_SYS_HARDWARE BIT_U32(30)
211 #ifndef TP_STATUS_TS_RAW_HARDWARE
212 #define TP_STATUS_TS_RAW_HARDWARE BIT_U32(31)
215 #ifndef TP_STATUS_USER_BUSY
227 #define TP_STATUS_USER_BUSY \
228 (uint32_t)((uint32_t)TP_STATUS_TS_SOFTWARE | (uint32_t)TP_STATUS_TS_SYS_HARDWARE | \
229 (uint32_t)TP_STATUS_TS_RAW_HARDWARE)
231 #define FRAME_BUSY(tp_status) \
232 (((uint32_t)(tp_status) & (uint32_t)TP_STATUS_USER_BUSY) == (uint32_t)TP_STATUS_USER_BUSY)
248 struct tpacket2_hdr *
h2;
249 #ifdef HAVE_TPACKET_V3
250 struct tpacket3_hdr *h3;
255 #ifdef HAVE_PACKET_EBPF
256 static int AFPBypassCallback(
Packet *p);
257 static int AFPXDPBypassCallback(
Packet *p);
280 #ifdef HAVE_PACKET_EBPF
338 struct tpacket_req
v2;
339 #ifdef HAVE_TPACKET_V3
340 struct tpacket_req3 v3;
352 #ifdef HAVE_PACKET_EBPF
356 struct ebpf_timeout_config ebpf_t_config;
362 static void ReceiveAFPThreadExitStats(
ThreadVars *,
void *);
371 static int AFPGetIfnumByDev(
int fd,
const char *ifname,
int verbose);
372 static int AFPGetDevFlags(
int fd,
const char *ifname);
373 static int AFPDerefSocket(
AFPPeer* peer);
374 static int AFPRefSocket(
AFPPeer* peer);
425 if (ptv->
mpeer == NULL) {
436 static void AFPPeerClean(
AFPPeer *peer)
468 #define AFP_PEERS_MAX_TRY 4
469 #define AFP_PEERS_WAIT 20000
497 memset(peer, 0,
sizeof(
AFPPeer));
529 if (mtu != out_mtu) {
530 SCLogWarning(
"MTU on %s (%d) and %s (%d) are not equal, "
531 "transmission of packets bigger than %d will fail.",
544 static int AFPPeersListWaitTurn(
AFPPeer *peer)
555 static void AFPPeersListReachedInc(
void)
569 static int AFPPeersListStarted(
void)
607 static int AFPCreateSocket(
AFPThreadVars *ptv,
char *devname,
int verbose);
611 #ifdef PACKET_STATISTICS
612 struct tpacket_stats kstats;
613 socklen_t
len =
sizeof (
struct tpacket_stats);
614 if (getsockopt(ptv->
socket, SOL_PACKET, PACKET_STATISTICS,
615 &kstats, &
len) > -1) {
616 SCLogDebug(
"(%s) Kernel: Packets %" PRIu32
", dropped %" PRIu32
"",
618 kstats.tp_packets, kstats.tp_drops);
646 struct sockaddr_ll socket_address;
655 if (p->
ethh == NULL) {
661 socket_address.sll_ifindex =
SC_ATOMIC_GET(p->afp_v.peer->if_idx);
663 socket_address.sll_halen = ETH_ALEN;
665 memcpy(socket_address.sll_addr, p->
ethh, 6);
673 sizeof(
struct sockaddr_ll)) < 0) {
675 SCLogWarning(
"%s: sending packet failed on socket %d: %s", p->afp_v.peer->iface, socket,
683 static void AFPReleaseDataFromRing(
Packet *p)
690 AFPWritePacket(p, TPACKET_V2);
693 BUG_ON(p->afp_v.relptr == NULL);
696 h.
raw = p->afp_v.relptr;
699 (void)AFPDerefSocket(p->afp_v.mpeer);
704 #ifdef HAVE_TPACKET_V3
705 static void AFPReleasePacketV3(
Packet *p)
712 AFPWritePacket(p, TPACKET_V3);
718 static void AFPReleasePacket(
Packet *p)
720 AFPReleaseDataFromRing(p);
739 #ifdef HAVE_PACKET_EBPF
742 p->afp_v.v4_map_fd = ptv->v4_map_fd;
743 p->afp_v.v6_map_fd = ptv->v6_map_fd;
744 p->afp_v.nr_cpus = ptv->ebpf_t_config.cpus_count;
748 p->afp_v.v4_map_fd = ptv->v4_map_fd;
749 p->afp_v.v6_map_fd = ptv->v6_map_fd;
750 p->afp_v.nr_cpus = ptv->ebpf_t_config.cpus_count;
758 static void AFPReadFromRingSetupPacket(
771 AFPReadApplyBypass(ptv, p);
773 if (h.
h2->tp_len > h.
h2->tp_snaplen) {
774 SCLogDebug(
"Packet length (%d) > snaplen (%d), truncating", h.
h2->tp_len, h.
h2->tp_snaplen);
780 p->
vlan_id[0] = h.
h2->tp_vlan_tci & 0x0fff;
782 p->afp_v.vlan_tci = h.
h2->tp_vlan_tci;
788 p->afp_v.relptr = h.
raw;
790 p->afp_v.mpeer = ptv->
mpeer;
791 AFPRefSocket(ptv->
mpeer);
793 p->afp_v.mpeer = NULL;
818 static inline int AFPReadFromRingWaitForPacket(
AFPThreadVars *ptv)
821 struct timeval start_time;
822 gettimeofday(&start_time, NULL);
823 uint64_t busy_loop_iter = 0;
834 const unsigned int tp_status = h.
h2->tp_status;
838 struct timeval cur_time;
839 memset(&cur_time, 0,
sizeof(cur_time));
840 uint64_t milliseconds =
841 ((cur_time.tv_sec - start_time.tv_sec) * 1000) +
842 (((1000000 + cur_time.tv_usec - start_time.tv_usec) / 1000) - 1000);
843 if (milliseconds > 1000) {
850 if (busy_loop_iter) {
868 bool emergency_flush =
false;
873 if (AFPReadFromRingWaitForPacket(ptv) !=
AFP_READ_OK)
885 const unsigned int tp_status = h.
h2->tp_status;
903 return AFPSuriFailure(ptv, h);
905 AFPReadFromRingSetupPacket(ptv, h, tp_status, p);
908 return AFPSuriFailure(ptv, h);
918 if (emergency_flush) {
919 AFPDumpCounters(ptv);
924 #ifdef HAVE_TPACKET_V3
925 static inline void AFPFlushBlock(
struct tpacket_block_desc *pbd)
930 static inline int AFPParsePacketV3(
AFPThreadVars *ptv,
struct tpacket_block_desc *pbd,
struct tpacket3_hdr *ppd)
938 AFPReadApplyBypass(ptv, p);
946 p->
vlan_id[0] = ppd->hv1.tp_vlan_tci & 0x0fff;
948 p->afp_v.vlan_tci = (uint16_t)ppd->hv1.tp_vlan_tci;
951 (void)
PacketSetData(p, (
unsigned char *)ppd + ppd->tp_mac, ppd->tp_snaplen);
954 p->afp_v.relptr = NULL;
955 p->afp_v.mpeer = NULL;
960 p->
ts = (
SCTime_t){ .
secs = ppd->tp_sec, .usecs = ppd->tp_nsec / 1000 };
961 SCLogDebug(
"pktlen: %" PRIu32
" (pkt %p, pkt data %p)",
987 static inline int AFPWalkBlock(
AFPThreadVars *ptv,
struct tpacket_block_desc *pbd)
989 const int num_pkts = pbd->hdr.bh1.num_pkts;
990 uint8_t *ppd = (uint8_t *)pbd + pbd->hdr.bh1.offset_to_first_pkt;
992 for (
int i = 0; i < num_pkts; ++i) {
993 int ret = AFPParsePacketV3(ptv, pbd, (
struct tpacket3_hdr *)ppd);
1006 ppd = ppd + ((
struct tpacket3_hdr *)ppd)->tp_next_offset;
1024 #ifdef HAVE_TPACKET_V3
1032 struct tpacket_block_desc *pbd =
1040 int ret = AFPWalkBlock(ptv, pbd);
1062 static int AFPRefSocket(
AFPPeer* peer)
1077 static int AFPDerefSocket(
AFPPeer* peer)
1090 if (ptv->
mpeer != NULL)
1094 #ifdef HAVE_TPACKET_V3
1115 static void AFPSwitchState(
AFPThreadVars *ptv, uint8_t state)
1132 static int AFPReadAndDiscardFromRing(
AFPThreadVars *ptv,
struct timeval *synctv,
1133 uint64_t *discarded_pkts)
1139 #ifdef HAVE_TPACKET_V3
1142 struct tpacket_block_desc *pbd =
1144 *discarded_pkts += pbd->hdr.bh1.num_pkts;
1145 struct tpacket3_hdr *ppd =
1146 (
struct tpacket3_hdr *)((uint8_t *)pbd + pbd->hdr.bh1.offset_to_first_pkt);
1147 if (((time_t)ppd->tp_sec > synctv->tv_sec) ||
1148 ((time_t)ppd->tp_sec == synctv->tv_sec &&
1149 (suseconds_t) (ppd->tp_nsec / 1000) > (suseconds_t)synctv->tv_usec)) {
1162 if (h.
raw == NULL) {
1168 if (((time_t)h.
h2->tp_sec > synctv->tv_sec) ||
1169 ((time_t)h.
h2->tp_sec == synctv->tv_sec &&
1170 (suseconds_t) (h.
h2->tp_nsec / 1000) > synctv->tv_usec)) {
1174 (*discarded_pkts)++;
1193 static int AFPSynchronizeStart(
AFPThreadVars *ptv, uint64_t *discarded_pkts)
1195 struct timeval synctv;
1199 fds.events = POLLIN;
1202 synctv.tv_sec = 0xffffffff;
1203 synctv.tv_usec = 0xffffffff;
1208 (fds.revents & (POLLHUP|POLLRDHUP|POLLERR|POLLNVAL))) {
1210 fds.revents & (POLLHUP | POLLRDHUP | POLLERR | POLLNVAL));
1213 if (AFPPeersListStarted() && synctv.tv_sec == (time_t) 0xffffffff) {
1214 gettimeofday(&synctv, NULL);
1216 r = AFPReadAndDiscardFromRing(ptv, &synctv, discarded_pkts);
1226 }
else if (r == 0 && AFPPeersListStarted()) {
1253 AFPCloseSocket(ptv);
1255 int afp_activate_r = AFPCreateSocket(ptv, ptv->
iface, 0);
1256 if (afp_activate_r != 0) {
1260 return afp_activate_r;
1278 time_t last_dump = 0;
1279 time_t current_time;
1281 uint64_t discarded_pkts = 0;
1286 AFPReadFunc = AFPReadFromRingV3;
1288 AFPReadFunc = AFPReadFromRing;
1293 while (AFPPeersListWaitTurn(ptv->
mpeer)) {
1299 r = AFPCreateSocket(ptv, ptv->
iface, 1);
1307 "%s: failed to init socket for interface, retrying soon", ptv->
iface);
1310 AFPPeersListReachedInc();
1314 AFPSynchronizeStart(ptv, &discarded_pkts);
1317 #ifdef PACKET_STATISTICS
1318 struct tpacket_stats kstats;
1319 socklen_t
len =
sizeof (
struct tpacket_stats);
1320 if (getsockopt(ptv->
socket, SOL_PACKET, PACKET_STATISTICS,
1321 &kstats, &
len) > -1) {
1323 SCLogDebug(
"(%s) Kernel socket startup: Packets %" PRIu32
1324 ", dropped %" PRIu32
"",
1326 kstats.tp_packets, kstats.tp_drops);
1327 pkts = kstats.tp_packets - discarded_pkts - kstats.tp_drops;
1335 fds.events = POLLIN;
1352 r = AFPTryReopen(ptv);
1372 (fds.revents & (POLLHUP|POLLRDHUP|POLLERR|POLLNVAL))) {
1374 if (fds.revents & (POLLHUP | POLLRDHUP)) {
1377 }
else if (fds.revents & POLLERR) {
1380 if (recv(ptv->
socket, &c,
sizeof c, MSG_PEEK) != -1)
1385 }
else if (fds.revents & POLLNVAL) {
1392 r = AFPReadFunc(ptv);
1396 current_time = time(NULL);
1397 if (current_time != last_dump) {
1398 AFPDumpCounters(ptv);
1399 last_dump = current_time;
1411 AFPDumpCounters(ptv);
1417 current_time = time(NULL);
1418 if (current_time != last_dump) {
1419 AFPDumpCounters(ptv);
1420 last_dump = current_time;
1423 TmThreadsCaptureHandleTimeout(
tv, NULL);
1425 }
else if ((r < 0) && (errno != EINTR)) {
1434 AFPDumpCounters(ptv);
1439 static int AFPGetDevFlags(
int fd,
const char *ifname)
1443 memset(&ifr, 0,
sizeof(ifr));
1444 strlcpy(ifr.ifr_name, ifname,
sizeof(ifr.ifr_name));
1446 if (ioctl(fd, SIOCGIFFLAGS, &ifr) == -1) {
1447 SCLogError(
"%s: failed to get interface flags: %s", ifname, strerror(errno));
1451 return ifr.ifr_flags;
1455 static int AFPGetIfnumByDev(
int fd,
const char *ifname,
int verbose)
1459 memset(&ifr, 0,
sizeof(ifr));
1460 strlcpy(ifr.ifr_name, ifname,
sizeof(ifr.ifr_name));
1462 if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) {
1464 SCLogError(
"%s: failed to find interface: %s", ifname, strerror(errno));
1468 return ifr.ifr_ifindex;
1471 static int AFPGetDevLinktype(
int fd,
const char *ifname)
1475 memset(&ifr, 0,
sizeof(ifr));
1476 strlcpy(ifr.ifr_name, ifname,
sizeof(ifr.ifr_name));
1478 if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) {
1479 SCLogError(
"%s: failed to find interface type: %s", ifname, strerror(errno));
1483 switch (ifr.ifr_hwaddr.sa_family) {
1484 case ARPHRD_LOOPBACK:
1490 return ifr.ifr_hwaddr.sa_family;
1498 int fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
1500 SCLogError(
"%s: failed to create AF_PACKET socket: %s", ifname, strerror(errno));
1504 ltype = AFPGetDevLinktype(fd, ifname);
1512 static int AFPComputeRingParams(
AFPThreadVars *ptv,
int order)
1537 int tp_hdrlen =
sizeof(
struct tpacket_hdr);
1543 SCLogWarning(
"%s: unable to get MTU, setting snaplen default of 1514", ptv->
iface);
1548 ptv->
req.
v2.tp_frame_size = TPACKET_ALIGN(snaplen +TPACKET_ALIGN(TPACKET_ALIGN(tp_hdrlen) +
sizeof(
struct sockaddr_ll) + ETH_HLEN) - ETH_HLEN);
1549 ptv->
req.
v2.tp_block_size = getpagesize() << order;
1550 int frames_per_block = ptv->
req.
v2.tp_block_size / ptv->
req.
v2.tp_frame_size;
1551 if (frames_per_block == 0) {
1556 ptv->
req.
v2.tp_block_nr = ptv->
req.
v2.tp_frame_nr / frames_per_block + 1;
1558 ptv->
req.
v2.tp_frame_nr = ptv->
req.
v2.tp_block_nr * frames_per_block;
1559 SCLogPerf(
"%s: rx ring: block_size=%d block_nr=%d frame_size=%d frame_nr=%d", ptv->
iface,
1560 ptv->
req.
v2.tp_block_size, ptv->
req.
v2.tp_block_nr, ptv->
req.
v2.tp_frame_size,
1561 ptv->
req.
v2.tp_frame_nr);
1565 #ifdef HAVE_TPACKET_V3
1569 ptv->
req.v3.tp_frame_size = 2048;
1570 int frames_per_block = 0;
1571 int tp_hdrlen =
sizeof(
struct tpacket3_hdr);
1577 SCLogWarning(
"%s: unable to get MTU, setting snaplen default of 1514", ptv->
iface);
1582 ptv->
req.v3.tp_frame_size = TPACKET_ALIGN(snaplen +TPACKET_ALIGN(TPACKET_ALIGN(tp_hdrlen) +
sizeof(
struct sockaddr_ll) + ETH_HLEN) - ETH_HLEN);
1583 frames_per_block = ptv->
req.v3.tp_block_size / ptv->
req.v3.tp_frame_size;
1585 if (frames_per_block == 0) {
1586 SCLogError(
"%s: block size is too small, it should be at least %d", ptv->
iface,
1587 ptv->
req.v3.tp_frame_size);
1590 ptv->
req.v3.tp_block_nr = ptv->
ring_size / frames_per_block + 1;
1592 ptv->
req.v3.tp_frame_nr = ptv->
req.v3.tp_block_nr * frames_per_block;
1594 ptv->
req.v3.tp_feature_req_word = TP_FT_REQ_FILL_RXHASH;
1595 SCLogPerf(
"%s: rx ring params: block_size=%d block_nr=%d frame_size=%d frame_nr=%d (mem: %d)",
1596 ptv->
iface, ptv->
req.v3.tp_block_size, ptv->
req.v3.tp_block_nr,
1597 ptv->
req.v3.tp_frame_size, ptv->
req.v3.tp_frame_nr,
1598 ptv->
req.v3.tp_block_size * ptv->
req.v3.tp_block_nr);
1606 unsigned int len =
sizeof(val), i;
1610 #ifdef HAVE_TPACKET_V3
1618 if (getsockopt(ptv->
socket, SOL_PACKET, PACKET_HDRLEN, &val, &
len) < 0) {
1619 if (errno == ENOPROTOOPT) {
1621 SCLogError(
"%s: kernel too old for TPACKET_V3 (need 3.2+)", devname);
1623 SCLogError(
"%s: kernel too old (need 2.6.27+)", devname);
1626 SCLogError(
"%s: failed to retrieve packet header len", devname);
1631 #ifdef HAVE_TPACKET_V3
1636 if (setsockopt(ptv->
socket, SOL_PACKET, PACKET_VERSION, &val,
1638 SCLogError(
"%s: failed to activate TPACKET_V2/TPACKET_V3 on packet socket: %s", devname,
1643 #ifdef HAVE_HW_TIMESTAMPING
1644 int req = SOF_TIMESTAMPING_RAW_HARDWARE;
1645 if (setsockopt(ptv->
socket, SOL_PACKET, PACKET_TIMESTAMP, (
void *) &req,
1647 SCLogWarning(
"%s: failed to activate hardware timestamping on packet socket: %s", devname,
1655 if (setsockopt(ptv->
socket, SOL_PACKET, PACKET_RESERVE, (
void *)&reserve,
sizeof(reserve)) <
1657 SCLogError(
"%s: failed to activate reserve on packet socket: %s", devname, strerror(errno));
1662 #ifdef HAVE_TPACKET_V3
1664 if (AFPComputeRingParamsV3(ptv) != 1) {
1667 r = setsockopt(ptv->
socket, SOL_PACKET, PACKET_RX_RING,
1668 (
void *) &ptv->
req.v3,
sizeof(ptv->
req.v3));
1670 SCLogError(
"%s: failed to allocate RX Ring: %s", devname, strerror(errno));
1676 if (AFPComputeRingParams(ptv, order) != 1) {
1677 SCLogError(
"%s: ring parameters are incorrect. Please file a bug report", devname);
1681 r = setsockopt(ptv->
socket, SOL_PACKET, PACKET_RX_RING,
1682 (
void *) &ptv->
req,
sizeof(ptv->
req));
1685 if (errno == ENOMEM) {
1686 SCLogWarning(
"%s: memory issue with ring parameters. Retrying", devname);
1689 SCLogError(
"%s: failed to setup RX Ring: %s", devname, strerror(errno));
1696 SCLogError(
"%s: failed to setup RX Ring (order 0 failed)", devname);
1699 #ifdef HAVE_TPACKET_V3
1704 #ifdef HAVE_TPACKET_V3
1710 #ifdef HAVE_TPACKET_V3
1713 mmap_flag = MAP_SHARED;
1715 mmap_flag |= MAP_LOCKED;
1717 mmap_flag, ptv->
socket, 0);
1719 SCLogError(
"%s: failed to mmap: %s", devname, strerror(errno));
1722 #ifdef HAVE_TPACKET_V3
1726 SCLogError(
"%s: failed to alloc ring: %s", devname, strerror(errno));
1729 for (i = 0; i < ptv->
req.v3.tp_block_nr; ++i) {
1731 ptv->
ring.
v3[i].iov_len = ptv->
req.v3.tp_block_size;
1737 if (ptv->
ring.
v2 == NULL) {
1738 SCLogError(
"%s: failed to alloc ring: %s", devname, strerror(errno));
1743 for (i = 0; i < ptv->
req.
v2.tp_block_nr; ++i) {
1744 void *base = &(ptv->
ring_buf[i * ptv->
req.
v2.tp_block_size]);
1748 base += ptv->
req.
v2.tp_frame_size;
1752 #ifdef HAVE_TPACKET_V3
1774 #ifdef HAVE_PACKET_FANOUT
1775 int fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
1780 uint32_t option = (mode << 16) | cluster_id;
1781 int r = setsockopt(fd, SOL_PACKET,
PACKET_FANOUT,(
void *)&option,
sizeof(option));
1785 SCLogError(
"fanout not supported by kernel: "
1786 "Kernel too old or cluster-id %d already in use.",
1796 #ifdef HAVE_PACKET_EBPF
1800 int pfd = ptv->ebpf_lb_fd;
1802 SCLogError(
"Fanout file descriptor is invalid");
1806 if (setsockopt(ptv->
socket, SOL_PACKET, PACKET_FANOUT_DATA, &pfd,
sizeof(pfd))) {
1817 int pfd = ptv->ebpf_filter_fd;
1819 SCLogError(
"Filter file descriptor is invalid");
1823 if (setsockopt(ptv->
socket, SOL_SOCKET, SO_ATTACH_BPF, &pfd,
sizeof(pfd))) {
1824 SCLogError(
"Error setting ebpf: %s", strerror(errno));
1827 SCLogInfo(
"Activated eBPF filter on socket");
1833 static int AFPCreateSocket(
AFPThreadVars *ptv,
char *devname,
int verbose)
1837 struct packet_mreq sock_params;
1838 struct sockaddr_ll bind_address;
1842 ptv->
socket = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
1844 SCLogError(
"%s: failed to create socket: %s", devname, strerror(errno));
1848 if_idx = AFPGetIfnumByDev(ptv->
socket, devname, verbose);
1854 memset(&bind_address, 0,
sizeof(bind_address));
1855 bind_address.sll_family = AF_PACKET;
1856 bind_address.sll_protocol = htons(ETH_P_ALL);
1857 bind_address.sll_ifindex = if_idx;
1858 if (bind_address.sll_ifindex == -1) {
1865 int if_flags = AFPGetDevFlags(ptv->
socket, ptv->
iface);
1866 if (if_flags == -1) {
1872 }
else if ((if_flags & (IFF_UP | IFF_RUNNING)) == 0) {
1882 memset(&sock_params, 0,
sizeof(sock_params));
1883 sock_params.mr_type = PACKET_MR_PROMISC;
1884 sock_params.mr_ifindex = bind_address.sll_ifindex;
1885 r = setsockopt(ptv->
socket, SOL_PACKET, PACKET_ADD_MEMBERSHIP,(
void *)&sock_params,
sizeof(sock_params));
1887 SCLogError(
"%s: failed to set promisc mode: %s", devname, strerror(errno));
1894 if (setsockopt(ptv->
socket, SOL_PACKET, PACKET_AUXDATA, &val,
1895 sizeof(val)) == -1 && errno != ENOPROTOOPT) {
1897 "%s: 'kernel' checksum mode not supported, falling back to full mode", devname);
1908 if (setsockopt(ptv->
socket, SOL_SOCKET, SO_RCVBUF,
1917 r = bind(ptv->
socket, (
struct sockaddr *)&bind_address,
sizeof(bind_address));
1920 if (errno == ENETDOWN) {
1921 SCLogWarning(
"%s: failed to bind socket, iface is down", devname);
1923 SCLogWarning(
"%s: failed to bind socket: %s", devname, strerror(errno));
1931 #ifdef HAVE_PACKET_FANOUT
1936 uint32_t option = (mode << 16) | (
id & 0xffff);
1939 SCLogError(
"%s: failed to set fanout mode: %s", devname, strerror(errno));
1945 #ifdef HAVE_PACKET_EBPF
1947 r = SockFanoutSeteBPF(ptv);
1949 SCLogError(
"%s: failed to set eBPF: %s", devname, strerror(errno));
1955 ret = AFPSetupRing(ptv, devname);
1959 SCLogDebug(
"Using interface '%s' via socket %d", (
char *)devname, ptv->
socket);
1963 TmEcode rc = AFPSetBPFFilter(ptv);
1995 struct sock_fprog fcode;
1998 #ifdef HAVE_PACKET_EBPF
1999 if (ptv->ebpf_filter_fd != -1) {
2000 return SetEbpfFilter(ptv);
2009 char errbuf[PCAP_ERRBUF_SIZE];
2017 sizeof(errbuf)) == -1) {
2022 if (filter.bf_len > USHRT_MAX) {
2025 fcode.len = (
unsigned short)filter.bf_len;
2026 fcode.filter = (
struct sock_filter*)filter.bf_insns;
2028 rc = setsockopt(ptv->
socket, SOL_SOCKET, SO_ATTACH_FILTER, &fcode,
sizeof(fcode));
2032 SCLogError(
"%s: failed to attach filter: %s", ptv->
iface, strerror(errno));
2039 #ifdef HAVE_PACKET_EBPF
2047 static int AFPInsertHalfFlow(
int mapd,
void *key,
unsigned int nr_cpus)
2049 BPF_DECLARE_PERCPU(
struct pair, value, nr_cpus);
2058 for (i = 0; i < nr_cpus; i++) {
2059 BPF_PERCPU(value, i).packets = 0;
2060 BPF_PERCPU(value, i).bytes = 0;
2062 if (bpf_map_update_elem(mapd, key, value, BPF_NOEXIST) != 0) {
2075 SCLogError(
"Can't update eBPF map: %s (%d)", strerror(errno), errno);
2082 static int AFPSetFlowStorage(
Packet *p,
int map_fd,
void *key0,
void* key1,
2093 EBPFBypassData *eb =
SCCalloc(1,
sizeof(EBPFBypassData));
2095 EBPFDeleteKey(map_fd, key0);
2096 EBPFDeleteKey(map_fd, key1);
2105 eb->cpus_count = p->afp_v.nr_cpus;
2110 EBPFDeleteKey(map_fd, key0);
2111 EBPFDeleteKey(map_fd, key1);
2137 static int AFPBypassCallback(
Packet *p)
2139 SCLogDebug(
"Calling af_packet callback function");
2148 if (p->
flow == NULL) {
2159 if (p->afp_v.v4_map_fd == -1) {
2162 struct flowv4_keys *keys[2];
2163 keys[0] =
SCCalloc(1,
sizeof(
struct flowv4_keys));
2164 if (keys[0] == NULL) {
2171 keys[0]->vlan0 = p->
vlan_id[0];
2172 keys[0]->vlan1 = p->
vlan_id[1];
2175 keys[0]->ip_proto = 1;
2177 keys[0]->ip_proto = 0;
2179 if (AFPInsertHalfFlow(p->afp_v.v4_map_fd, keys[0],
2180 p->afp_v.nr_cpus) == 0) {
2185 keys[1]=
SCCalloc(1,
sizeof(
struct flowv4_keys));
2186 if (keys[1] == NULL) {
2187 EBPFDeleteKey(p->afp_v.v4_map_fd, keys[0]);
2196 keys[1]->vlan0 = p->
vlan_id[0];
2197 keys[1]->vlan1 = p->
vlan_id[1];
2199 keys[1]->ip_proto = keys[0]->ip_proto;
2200 if (AFPInsertHalfFlow(p->afp_v.v4_map_fd, keys[1],
2201 p->afp_v.nr_cpus) == 0) {
2202 EBPFDeleteKey(p->afp_v.v4_map_fd, keys[0]);
2208 EBPFUpdateFlow(p->
flow, p, NULL);
2209 return AFPSetFlowStorage(p, p->afp_v.v4_map_fd, keys[0], keys[1], AF_INET);
2215 if (p->afp_v.v6_map_fd == -1) {
2219 struct flowv6_keys *keys[2];
2220 keys[0] =
SCCalloc(1,
sizeof(
struct flowv6_keys));
2221 if (keys[0] == NULL) {
2225 for (i = 0; i < 4; i++) {
2231 keys[0]->vlan0 = p->
vlan_id[0];
2232 keys[0]->vlan1 = p->
vlan_id[1];
2235 keys[0]->ip_proto = 1;
2237 keys[0]->ip_proto = 0;
2239 if (AFPInsertHalfFlow(p->afp_v.v6_map_fd, keys[0],
2240 p->afp_v.nr_cpus) == 0) {
2245 keys[1]=
SCCalloc(1,
sizeof(
struct flowv6_keys));
2246 if (keys[1] == NULL) {
2247 EBPFDeleteKey(p->afp_v.v6_map_fd, keys[0]);
2252 for (i = 0; i < 4; i++) {
2258 keys[1]->vlan0 = p->
vlan_id[0];
2259 keys[1]->vlan1 = p->
vlan_id[1];
2261 keys[1]->ip_proto = keys[0]->ip_proto;
2262 if (AFPInsertHalfFlow(p->afp_v.v6_map_fd, keys[1],
2263 p->afp_v.nr_cpus) == 0) {
2264 EBPFDeleteKey(p->afp_v.v6_map_fd, keys[0]);
2271 EBPFUpdateFlow(p->
flow, p, NULL);
2272 return AFPSetFlowStorage(p, p->afp_v.v6_map_fd, keys[0], keys[1], AF_INET6);
2288 static int AFPXDPBypassCallback(
Packet *p)
2290 SCLogDebug(
"Calling af_packet callback function");
2299 if (p->
flow == NULL) {
2309 struct flowv4_keys *keys[2];
2310 keys[0]=
SCCalloc(1,
sizeof(
struct flowv4_keys));
2311 if (keys[0] == NULL) {
2315 if (p->afp_v.v4_map_fd == -1) {
2319 keys[0]->src = p->
src.addr_data32[0];
2320 keys[0]->dst = p->
dst.addr_data32[0];
2323 keys[0]->port16[0] = htons(p->
sp);
2324 keys[0]->port16[1] = htons(p->
dp);
2325 keys[0]->vlan0 = p->
vlan_id[0];
2326 keys[0]->vlan1 = p->
vlan_id[1];
2328 keys[0]->ip_proto = 1;
2330 keys[0]->ip_proto = 0;
2332 if (AFPInsertHalfFlow(p->afp_v.v4_map_fd, keys[0],
2333 p->afp_v.nr_cpus) == 0) {
2338 keys[1]=
SCCalloc(1,
sizeof(
struct flowv4_keys));
2339 if (keys[1] == NULL) {
2340 EBPFDeleteKey(p->afp_v.v4_map_fd, keys[0]);
2345 keys[1]->src = p->
dst.addr_data32[0];
2346 keys[1]->dst = p->
src.addr_data32[0];
2347 keys[1]->port16[0] = htons(p->
dp);
2348 keys[1]->port16[1] = htons(p->
sp);
2349 keys[1]->vlan0 = p->
vlan_id[0];
2350 keys[1]->vlan1 = p->
vlan_id[1];
2351 keys[1]->ip_proto = keys[0]->ip_proto;
2352 if (AFPInsertHalfFlow(p->afp_v.v4_map_fd, keys[1],
2353 p->afp_v.nr_cpus) == 0) {
2354 EBPFDeleteKey(p->afp_v.v4_map_fd, keys[0]);
2360 return AFPSetFlowStorage(p, p->afp_v.v4_map_fd, keys[0], keys[1], AF_INET);
2366 if (p->afp_v.v6_map_fd == -1) {
2370 struct flowv6_keys *keys[2];
2371 keys[0] =
SCCalloc(1,
sizeof(
struct flowv6_keys));
2372 if (keys[0] == NULL) {
2376 for (i = 0; i < 4; i++) {
2382 keys[0]->vlan0 = p->
vlan_id[0];
2383 keys[0]->vlan1 = p->
vlan_id[1];
2385 keys[0]->ip_proto = 1;
2387 keys[0]->ip_proto = 0;
2389 if (AFPInsertHalfFlow(p->afp_v.v6_map_fd, keys[0],
2390 p->afp_v.nr_cpus) == 0) {
2395 keys[1]=
SCCalloc(1,
sizeof(
struct flowv6_keys));
2396 if (keys[1] == NULL) {
2397 EBPFDeleteKey(p->afp_v.v6_map_fd, keys[0]);
2402 for (i = 0; i < 4; i++) {
2408 keys[1]->vlan0 = p->
vlan_id[0];
2409 keys[1]->vlan1 = p->
vlan_id[1];
2410 keys[1]->ip_proto = keys[0]->ip_proto;
2411 if (AFPInsertHalfFlow(p->afp_v.v6_map_fd, keys[1],
2412 p->afp_v.nr_cpus) == 0) {
2413 EBPFDeleteKey(p->afp_v.v6_map_fd, keys[0]);
2419 return AFPSetFlowStorage(p, p->afp_v.v6_map_fd, keys[0], keys[1], AF_INET6);
2424 bool g_flowv4_ok =
true;
2425 bool g_flowv6_ok =
true;
2443 if (initdata == NULL) {
2477 #ifdef HAVE_PACKET_FANOUT
2492 #ifdef HAVE_PACKET_EBPF
2495 ptv->xdp_mode = afpconfig->
xdp_mode;
2499 ptv->v4_map_fd = EBPFGetMapFDByName(ptv->
iface,
"flow_table_v4");
2500 if (ptv->v4_map_fd == -1) {
2501 if (g_flowv4_ok ==
false) {
2502 SCLogError(
"Can't find eBPF map fd for '%s'",
"flow_table_v4");
2506 ptv->v6_map_fd = EBPFGetMapFDByName(ptv->
iface,
"flow_table_v6");
2507 if (ptv->v6_map_fd == -1) {
2509 SCLogError(
"Can't find eBPF map fd for '%s'",
"flow_table_v6");
2510 g_flowv6_ok =
false;
2514 ptv->ebpf_t_config = afpconfig->ebpf_t_config;
2517 #ifdef PACKET_STATISTICS
2541 SCLogWarning(
"Enabling a BPF filter in IPS mode result"
2542 " in dropping all non matching packets.");
2553 *data = (
void *)ptv;
2572 void ReceiveAFPThreadExitStats(
ThreadVars *
tv,
void *data)
2577 #ifdef PACKET_STATISTICS
2578 AFPDumpCounters(ptv);
2596 #ifdef HAVE_PACKET_XDP
2597 if ((ptv->ebpf_t_config.
flags & EBPF_XDP_CODE) &&
2598 (!(ptv->ebpf_t_config.
flags & EBPF_PINNED_MAPS))) {
2599 EBPFSetupXDP(ptv->
iface, -1, ptv->xdp_mode);
2625 static void UpdateRawDataForVLANHdr(
Packet *p)
2627 if (p->afp_v.vlan_tci != 0) {
2633 *(uint16_t *)(pstart + 2 * ETH_ALEN) = htons(0x8100);
2634 *(uint16_t *)(pstart + 2 * ETH_ALEN + 2) = htons(p->afp_v.vlan_tci);
2639 p->
ethh = (
void *)pstart;
2657 const bool afp_vlan_hdr = p->
vlan_idx != 0;
2670 UpdateRawDataForVLANHdr(p);
2687 *data = (
void *)
dtv;