suricata
source-af-packet.h
Go to the documentation of this file.
1 /* Copyright (C) 2011,2012 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Eric Leblond <eric@regit.org>
22  */
23 
24 #ifndef __SOURCE_AFP_H__
25 #define __SOURCE_AFP_H__
26 
27 #ifndef HAVE_PACKET_FANOUT /* not defined if linux/if_packet.h trying to force */
28 #define HAVE_PACKET_FANOUT 1
29 
30 #define PACKET_FANOUT 18
31 
32 #define PACKET_FANOUT_HASH 0
33 #define PACKET_FANOUT_LB 1
34 #define PACKET_FANOUT_CPU 2
35 #define PACKET_FANOUT_ROLLOVER 3
36 #define PACKET_FANOUT_RND 4
37 #define PACKET_FANOUT_QM 5
38 
39 #define PACKET_FANOUT_FLAG_ROLLOVER 0x1000
40 #define PACKET_FANOUT_FLAG_DEFRAG 0x8000
41 #else /* HAVE_PACKET_FANOUT */
42 #include <linux/if_packet.h>
43 #endif /* HAVE_PACKET_FANOUT */
44 #include "queue.h"
45 
46 #ifdef HAVE_PACKET_EBPF
47 #define AFP_MODE_XDP_BYPASS 1
48 #define AFP_MODE_EBPF_BYPASS 2
49 struct ebpf_timeout_config {
50  const char *pinned_maps_name;
51  uint16_t cpus_count;
52  uint8_t mode;
53  uint8_t flags;
54 };
55 #endif
56 
57 /* value for flags */
58 #define AFP_RING_MODE (1<<0)
59 #define AFP_ZERO_COPY (1<<1)
60 #define AFP_SOCK_PROTECT (1<<2)
61 #define AFP_EMERGENCY_MODE (1<<3)
62 #define AFP_TPACKET_V3 (1<<4)
63 #define AFP_VLAN_IN_HEADER (1<<5)
64 #define AFP_MMAP_LOCKED (1<<6)
65 #define AFP_BYPASS (1<<7)
66 #define AFP_XDPBYPASS (1<<8)
67 
68 #define AFP_COPY_MODE_NONE 0
69 #define AFP_COPY_MODE_TAP 1
70 #define AFP_COPY_MODE_IPS 2
71 
72 #define AFP_FILE_MAX_PKTS 256
73 #define AFP_IFACE_NAME_LENGTH 48
74 
75 /* In kernel the allocated block size is allocated using the formula
76  * page_size << order. So default value is using the same formula with
77  * an order of 3 which guarantee we have some room in the block compared
78  * to standard frame size */
79 #define AFP_BLOCK_SIZE_DEFAULT_ORDER 3
80 
81 typedef struct AFPIfaceConfig_
82 {
83  char iface[AFP_IFACE_NAME_LENGTH];
84  /* number of threads */
85  int threads;
86  /* socket buffer size */
88  /* ring size in number of packets */
89  int ring_size;
90  /* block size for tpacket_v3 in */
92  /* block timeout for tpacket_v3 in milliseconds */
94  /* cluster param */
97  /* promisc mode */
98  int promisc;
99  /* misc use flags including ring mode */
100  unsigned int flags;
103  const char *bpf_filter;
104  const char *ebpf_lb_file;
106  const char *ebpf_filter_file;
108  const char *xdp_filter_file;
110  uint8_t xdp_mode;
111  const char *out_iface;
112 #ifdef HAVE_PACKET_EBPF
113  struct ebpf_timeout_config ebpf_t_config;
114 #endif
115  SC_ATOMIC_DECLARE(unsigned int, ref);
116  void (*DerefFunc)(void *);
118 
119 /**
120  * \ingroup afppeers
121  * @{
122  */
123 
124 typedef struct AFPPeer_ {
125  SC_ATOMIC_DECLARE(int, socket);
126  SC_ATOMIC_DECLARE(int, sock_usage);
127  SC_ATOMIC_DECLARE(int, if_idx);
128  int flags;
130  int turn; /**< Field used to store initialisation order. */
131  SC_ATOMIC_DECLARE(uint8_t, state);
132  struct AFPPeer_ *peer;
135 } AFPPeer;
136 
137 /**
138  * \brief per packet AF_PACKET vars
139  *
140  * This structure is used y the release data system and is cleaned
141  * up by the AFPV_CLEANUP macro below.
142  */
143 typedef struct AFPPacketVars_
144 {
145  void *relptr;
146  AFPPeer *peer; /**< Sending peer for IPS/TAP mode */
147  /** Pointer to ::AFPPeer used for capture. Field is used to be able
148  * to do reference counting.
149  */
151  uint8_t copy_mode;
152 #ifdef HAVE_PACKET_EBPF
153  int v4_map_fd;
154  int v6_map_fd;
155  unsigned int nr_cpus;
156 #endif
157 } AFPPacketVars;
158 
159 #ifdef HAVE_PACKET_EBPF
160 #define AFPV_CLEANUP(afpv) do { \
161  (afpv)->relptr = NULL; \
162  (afpv)->copy_mode = 0; \
163  (afpv)->peer = NULL; \
164  (afpv)->mpeer = NULL; \
165  (afpv)->v4_map_fd = -1; \
166  (afpv)->v6_map_fd = -1; \
167 } while(0)
168 #else
169 #define AFPV_CLEANUP(afpv) do { \
170  (afpv)->relptr = NULL; \
171  (afpv)->copy_mode = 0; \
172  (afpv)->peer = NULL; \
173  (afpv)->mpeer = NULL; \
174 } while(0)
175 #endif
176 
177 /**
178  * @}
179  */
180 
181 void TmModuleReceiveAFPRegister (void);
182 void TmModuleDecodeAFPRegister (void);
183 
186 void AFPPeersListClean(void);
187 int AFPGetLinkType(const char *ifname);
188 
189 int AFPIsFanoutSupported(void);
190 
191 #endif /* __SOURCE_AFP_H__ */
TmEcode AFPPeersListInit(void)
Init the global list of AFPPeer.
#define SCMutex
uint16_t flags
SCMutex sock_protect
void TmModuleDecodeAFPRegister(void)
Registration Function for DecodeAFP.
#define SC_ATOMIC_DECLARE(type, name)
wrapper to declare an atomic variable including a (spin) lock to protect it.
Definition: util-atomic.h:56
struct HtpBodyChunk_ * next
TmEcode AFPPeersListCheck(void)
Check that all AFPPeer got a peer.
int AFPGetLinkType(const char *ifname)
void AFPPeersListClean(void)
Clean the global peers list.
char iface[AFP_IFACE_NAME_LENGTH]
struct AFPIfaceConfig_ AFPIfaceConfig
const char * ebpf_filter_file
int AFPIsFanoutSupported(void)
test if we can use FANOUT. Older kernels like those in CentOS6 have HAVE_PACKET_FANOUT defined but fa...
unsigned int flags
const char * out_iface
void TmModuleReceiveAFPRegister(void)
Registration Function for RecieveAFP.
#define TAILQ_ENTRY(type)
Definition: queue.h:330
const char * ebpf_lb_file
struct AFPPeer_ * peer
#define AFP_IFACE_NAME_LENGTH
ChecksumValidationMode
Definition: decode.h:40
struct AFPPacketVars_ AFPPacketVars
per packet AF_PACKET vars
const char * xdp_filter_file
ChecksumValidationMode checksum_mode
per packet AF_PACKET vars
const char * bpf_filter