suricata
source-erf-dag.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "tm-threads.h"
#include "util-privs.h"
#include "util-device.h"
#include "tmqh-packetpool.h"
#include "source-erf-dag.h"
#include <dagapi.h>
Include dependency graph for source-erf-dag.c:

Go to the source code of this file.

Data Structures

struct  ErfDagThreadVars_
 

Macros

#define MINDATA   32768
 
#define MAXWAIT   20000
 
#define POLL_INTERVAL   1000;
 
#define BYTES_PER_LOOP   (4 * 1024 * 1024) /* 4 MB */
 

Typedefs

typedef struct ErfDagThreadVars_ ErfDagThreadVars
 

Functions

TmEcode ReceiveErfDagLoop (ThreadVars *tv, void *data, void *slot)
 Receives packets from a DAG interface. More...
 
TmEcode ReceiveErfDagThreadInit (ThreadVars *tv, void *initdata, void **data)
 Initialize the ERF receiver thread, generate a single ErfDagThreadVar structure for each thread, this will contain a DAG file descriptor which is read when the thread executes. More...
 
void ReceiveErfDagThreadExitStats (ThreadVars *tv, void *data)
 Print some stats to the log at program exit. More...
 
TmEcode ReceiveErfDagThreadDeinit (ThreadVars *tv, void *data)
 Deinitializes the DAG card. More...
 
TmEcode DecodeErfDagThreadInit (ThreadVars *, void *, void **)
 
TmEcode DecodeErfDagThreadDeinit (ThreadVars *tv, void *data)
 
TmEcode DecodeErfDag (ThreadVars *tv, Packet *p, void *data)
 This function passes off to link type decoders. More...
 
void ReceiveErfDagCloseStream (int dagfd, int stream)
 
void TmModuleReceiveErfDagRegister (void)
 Register the ERF file receiver (reader) module. More...
 
void TmModuleDecodeErfDagRegister (void)
 Register the ERF file decoder module. More...
 

Variables

int max_pending_packets
 

Detailed Description

Author
Endace Technology Limited.
Jason MacLulich jason.nosp@m..mac.nosp@m.lulic.nosp@m.h@en.nosp@m.dace..nosp@m.com

Support for reading ERF records from a DAG card.

Only ethernet supported at this time.

Definition in file source-erf-dag.c.

Macro Definition Documentation

◆ BYTES_PER_LOOP

#define BYTES_PER_LOOP   (4 * 1024 * 1024) /* 4 MB */

Definition at line 90 of file source-erf-dag.c.

◆ MAXWAIT

#define MAXWAIT   20000

Definition at line 84 of file source-erf-dag.c.

◆ MINDATA

#define MINDATA   32768

Definition at line 81 of file source-erf-dag.c.

◆ POLL_INTERVAL

#define POLL_INTERVAL   1000;

Definition at line 87 of file source-erf-dag.c.

Typedef Documentation

◆ ErfDagThreadVars

Function Documentation

◆ DecodeErfDag()

TmEcode DecodeErfDag ( ThreadVars tv,
Packet p,
void *  data 
)

This function passes off to link type decoders.

Decode ErfDag DecodeErfDag decodes packets from DAG and passes them off to the proper link type decoder.

Parameters
tpointer to ThreadVars
ppointer to the current packet
datapointer that gets cast into PcapThreadVars for ptv

Definition at line 607 of file source-erf-dag.c.

References BUG_ON, Packet_::datalink, DecodeEthernet(), DecodeUpdatePacketCounters(), dtv, GET_PKT_DATA, GET_PKT_LEN, LINKTYPE_ETHERNET, PacketDecodeFinalize(), PKT_IS_PSEUDOPKT, SC_ERR_DATALINK_UNIMPLEMENTED, SCEnter, SCLogError, SCReturnInt, TM_ECODE_OK, and tv.

Referenced by TmModuleDecodeErfDagRegister().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DecodeErfDagThreadDeinit()

TmEcode DecodeErfDagThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 654 of file source-erf-dag.c.

References DecodeThreadVarsFree(), SCReturnInt, TM_ECODE_OK, and tv.

Referenced by TmModuleDecodeErfDagRegister().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DecodeErfDagThreadInit()

TmEcode DecodeErfDagThreadInit ( ThreadVars tv,
void *  initdata,
void **  data 
)

Definition at line 636 of file source-erf-dag.c.

References DecodeRegisterPerfCounters(), DecodeThreadVarsAlloc(), dtv, SCEnter, SCReturnInt, TM_ECODE_FAILED, TM_ECODE_OK, and tv.

Referenced by TmModuleDecodeErfDagRegister().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ ReceiveErfDagCloseStream()

void ReceiveErfDagCloseStream ( int  dagfd,
int  stream 
)

Definition at line 587 of file source-erf-dag.c.

Referenced by ReceiveErfDagThreadDeinit().

Here is the caller graph for this function:

◆ ReceiveErfDagLoop()

TmEcode ReceiveErfDagLoop ( ThreadVars tv,
void *  data,
void *  slot 
)

Receives packets from a DAG interface.

Parameters
tvpointer to ThreadVars
datapointer to ErfDagThreadVars
slotslot containing task information
Return values
TM_ECODE_OKon success
TM_ECODE_FAILEDon failure

Definition at line 325 of file source-erf-dag.c.

References dtv, SCEnter, SCReturnInt, TmSlot_::slot_next, suricata_ctl_flags, SURICATA_STOP, and TM_ECODE_OK.

Referenced by TmModuleReceiveErfDagRegister().

Here is the caller graph for this function:

◆ ReceiveErfDagThreadDeinit()

TmEcode ReceiveErfDagThreadDeinit ( ThreadVars tv,
void *  data 
)

Deinitializes the DAG card.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PcapThreadVars for ptv

Definition at line 575 of file source-erf-dag.c.

References ErfDagThreadVars_::dagfd, ErfDagThreadVars_::dagstream, ReceiveErfDagCloseStream(), SCEnter, SCReturnInt, and TM_ECODE_OK.

Here is the call graph for this function:

◆ ReceiveErfDagThreadExitStats()

void ReceiveErfDagThreadExitStats ( ThreadVars tv,
void *  data 
)

Print some stats to the log at program exit.

Parameters
tvPointer to ThreadVars.
dataPointer to data, ErfFileThreadVars.

Definition at line 552 of file source-erf-dag.c.

References ErfDagThreadVars_::bytes, ErfDagThreadVars_::dagstream, ErfDagThreadVars_::drops, ErfDagThreadVars_::livedev, ErfDagThreadVars_::packets, SC_ATOMIC_SET, SCLogInfo, StatsGetLocalCounterValue(), and tv.

Referenced by TmModuleReceiveErfDagRegister().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ ReceiveErfDagThreadInit()

TmEcode ReceiveErfDagThreadInit ( ThreadVars tv,
void *  initdata,
void **  data 
)

Initialize the ERF receiver thread, generate a single ErfDagThreadVar structure for each thread, this will contain a DAG file descriptor which is read when the thread executes.

Parameters
tvThread variable to ThreadVars
initdataInitial data to the interface passed from the user, this is processed by the user.

We assume that we have only a single name for the DAG interface.

Parameters
datadata pointer gets populated with

Definition at line 178 of file source-erf-dag.c.

References ErfDagThreadVars_::dagfd, ErfDagThreadVars_::dagname, ErfDagThreadVars_::dagstream, ErfDagThreadVars_::drops, FatalError, ErfDagThreadVars_::livedev, LiveGetDevice(), MAXWAIT, MINDATA, ErfDagThreadVars_::packets, ErfDagThreadVars_::poll, POLL_INTERVAL, SC_ERR_ERF_DAG_OPEN_FAILED, SC_ERR_ERF_DAG_STREAM_OPEN_FAILED, SC_ERR_ERF_DAG_STREAM_SET_FAILED, SC_ERR_ERF_DAG_STREAM_START_FAILED, SC_ERR_FATAL, SC_ERR_INVALID_ARGUMENT, SC_ERR_INVALID_VALUE, SCEnter, SCFree, SCLogError, SCLogInfo, SCMalloc, SCReturnInt, StatsRegisterCounter(), TM_ECODE_FAILED, TM_ECODE_OK, tv, ErfDagThreadVars_::tv, and unlikely.

Referenced by TmModuleReceiveErfDagRegister().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ TmModuleDecodeErfDagRegister()

void TmModuleDecodeErfDagRegister ( void  )

Register the ERF file decoder module.

Definition at line 150 of file source-erf-dag.c.

References TmModule_::cap_flags, DecodeErfDag(), DecodeErfDagThreadDeinit(), DecodeErfDagThreadInit(), TmModule_::flags, TmModule_::Func, TmModule_::name, TmModule_::ThreadDeinit, TmModule_::ThreadExitPrintStats, TmModule_::ThreadInit, TM_FLAG_DECODE_TM, TMM_DECODEERFDAG, and tmm_modules.

Referenced by RegisterAllModules().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ TmModuleReceiveErfDagRegister()

void TmModuleReceiveErfDagRegister ( void  )