suricata
source-erf-dag.c
Go to the documentation of this file.
1 /* Copyright (C) 2010-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Endace Technology Limited.
22  * \author Jason MacLulich <jason.maclulich@endace.com>
23  *
24  * Support for reading ERF records from a DAG card.
25  *
26  * Only ethernet supported at this time.
27  */
28 
29 #include "suricata-common.h"
30 #include "suricata.h"
31 #include "tm-threads.h"
32 
33 #include "util-privs.h"
34 #include "util-device.h"
35 #include "tmqh-packetpool.h"
36 #include "source-erf-dag.h"
37 
38 #ifndef HAVE_DAG
39 
40 TmEcode NoErfDagSupportExit(ThreadVars *, const void *, void **);
41 
42 void
44 {
45  tmm_modules[TMM_RECEIVEERFDAG].name = "ReceiveErfDag";
46  tmm_modules[TMM_RECEIVEERFDAG].ThreadInit = NoErfDagSupportExit;
52 }
53 
54 void
56 {
57  tmm_modules[TMM_DECODEERFDAG].name = "DecodeErfDag";
58  tmm_modules[TMM_DECODEERFDAG].ThreadInit = NoErfDagSupportExit;
64 }
65 
66 TmEcode
67 NoErfDagSupportExit(ThreadVars *tv, const void *initdata, void **data)
68 {
70  "Error creating thread %s: you do not have support for DAG cards "
71  "enabled please recompile with --enable-dag", tv->name);
72  exit(EXIT_FAILURE);
73 }
74 
75 #else /* Implied we do have DAG support */
76 
77 #include <dagapi.h>
78 
79 /* Minimum amount of data to read from the DAG at a time. */
80 #define MINDATA 32768
81 
82 /* Maximum time (us) to wait for MINDATA to be read. */
83 #define MAXWAIT 20000
84 
85 /* Poll interval in microseconds. */
86 #define POLL_INTERVAL 1000;
87 
88 /* Number of bytes per loop to process before fetching more data. */
89 #define BYTES_PER_LOOP (4 * 1024 * 1024) /* 4 MB */
90 
91 extern int max_pending_packets;
92 
93 typedef struct ErfDagThreadVars_ {
96 
97  int dagfd;
98  int dagstream;
99  char dagname[DAGNAME_BUFSIZE];
100 
101  struct timeval maxwait, poll; /* Could possibly be made static */
102 
104 
105  uint64_t bytes;
106  uint16_t packets;
107  uint16_t drops;
108 
109  /* Current location in the DAG stream input buffer.
110  */
111  uint8_t *top;
112  uint8_t *btm;
113 
115 
116 static inline TmEcode ProcessErfDagRecords(ErfDagThreadVars *ewtn, uint8_t *top,
117  uint32_t *pkts_read);
118 static inline TmEcode ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec);
119 TmEcode ReceiveErfDagLoop(ThreadVars *, void *data, void *slot);
120 TmEcode ReceiveErfDagThreadInit(ThreadVars *, void *, void **);
123 TmEcode DecodeErfDagThreadInit(ThreadVars *, void *, void **);
125 TmEcode DecodeErfDag(ThreadVars *, Packet *, void *);
126 void ReceiveErfDagCloseStream(int dagfd, int stream);
127 
128 /**
129  * \brief Register the ERF file receiver (reader) module.
130  */
131 void
133 {
134  tmm_modules[TMM_RECEIVEERFDAG].name = "ReceiveErfDag";
144 }
145 
146 /**
147  * \brief Register the ERF file decoder module.
148  */
149 void
151 {
152  tmm_modules[TMM_DECODEERFDAG].name = "DecodeErfDag";
159 }
160 
161 /**
162  * \brief Initialize the ERF receiver thread, generate a single
163  * ErfDagThreadVar structure for each thread, this will
164  * contain a DAG file descriptor which is read when the
165  * thread executes.
166  *
167  * \param tv Thread variable to ThreadVars
168  * \param initdata Initial data to the interface passed from the user,
169  * this is processed by the user.
170  *
171  * We assume that we have only a single name for the DAG
172  * interface.
173  *
174  * \param data data pointer gets populated with
175  *
176  */
177 TmEcode
178 ReceiveErfDagThreadInit(ThreadVars *tv, void *initdata, void **data)
179 {
180  SCEnter();
181  int stream_count = 0;
182 
183  if (initdata == NULL) {
185  "Error: No DAG interface provided.");
187  }
188 
189  ErfDagThreadVars *ewtn = SCMalloc(sizeof(ErfDagThreadVars));
190  if (unlikely(ewtn == NULL)) {
192  "Failed to allocate memory for ERF DAG thread vars.");
193  }
194 
195  memset(ewtn, 0, sizeof(*ewtn));
196 
197  /* dag_parse_name will return a DAG device name and stream number
198  * to open for this thread.
199  */
200  if (dag_parse_name(initdata, ewtn->dagname, DAGNAME_BUFSIZE,
201  &ewtn->dagstream) < 0) {
203  "Failed to parse DAG interface: %s",
204  (char*)initdata);
205  SCFree(ewtn);
206  exit(EXIT_FAILURE);
207  }
208 
209  ewtn->livedev = LiveGetDevice(initdata);
210  if (ewtn->livedev == NULL) {
211  SCLogError(SC_ERR_INVALID_VALUE, "Unable to get %s live device",
212  (char *)initdata);
213  SCFree(ewtn);
215  }
216 
217  SCLogInfo("Opening DAG: %s on stream: %d for processing",
218  ewtn->dagname, ewtn->dagstream);
219 
220  if ((ewtn->dagfd = dag_open(ewtn->dagname)) < 0) {
221  SCLogError(SC_ERR_ERF_DAG_OPEN_FAILED, "Failed to open DAG: %s",
222  ewtn->dagname);
223  SCFree(ewtn);
225  }
226 
227  /* Check to make sure the card has enough available streams to
228  * support reading from the one specified.
229  */
230  if ((stream_count = dag_rx_get_stream_count(ewtn->dagfd)) < 0) {
232  "Failed to open stream: %d, DAG: %s, could not query stream count",
233  ewtn->dagstream, ewtn->dagname);
234  SCFree(ewtn);
236  }
237 
238  /* Check to make sure we have enough rx streams to open the stream
239  * the user is asking for.
240  */
241  if (ewtn->dagstream > stream_count * 2) {
243  "Failed to open stream: %d, DAG: %s, insufficient streams: %d",
244  ewtn->dagstream, ewtn->dagname, stream_count);
245  SCFree(ewtn);
247  }
248 
249  /* If we are transmitting into a soft DAG card then set the stream
250  * to act in reverse mode.
251  */
252  if (0 != (ewtn->dagstream & 0x01)) {
253  /* Setting reverse mode for using with soft dag from daemon side */
254  if (dag_set_mode(ewtn->dagfd, ewtn->dagstream, DAG_REVERSE_MODE)) {
256  "Failed to set mode to DAG_REVERSE_MODE on stream: %d, DAG: %s",
257  ewtn->dagstream, ewtn->dagname);
258  SCFree(ewtn);
260  }
261  }
262 
263  if (dag_attach_stream(ewtn->dagfd, ewtn->dagstream, 0, 0) < 0) {
265  "Failed to open DAG stream: %d, DAG: %s",
266  ewtn->dagstream, ewtn->dagname);
267  SCFree(ewtn);
269  }
270 
271  if (dag_start_stream(ewtn->dagfd, ewtn->dagstream) < 0) {
273  "Failed to start DAG stream: %d, DAG: %s",
274  ewtn->dagstream, ewtn->dagname);
275  SCFree(ewtn);
277  }
278 
279  SCLogInfo("Attached and started stream: %d on DAG: %s",
280  ewtn->dagstream, ewtn->dagname);
281 
282  /*
283  * Initialise DAG Polling parameters.
284  */
285  timerclear(&ewtn->maxwait);
286  ewtn->maxwait.tv_usec = MAXWAIT;
287  timerclear(&ewtn->poll);
288  ewtn->poll.tv_usec = POLL_INTERVAL;
289 
290  /* 32kB minimum data to return -- we still restrict the number of
291  * pkts that are processed to a maximum of dag_max_read_packets.
292  */
293  if (dag_set_stream_poll(ewtn->dagfd, ewtn->dagstream, MINDATA,
294  &(ewtn->maxwait), &(ewtn->poll)) < 0) {
296  "Failed to set poll parameters for stream: %d, DAG: %s",
297  ewtn->dagstream, ewtn->dagname);
298  SCFree(ewtn);
300  }
301 
302  ewtn->packets = StatsRegisterCounter("capture.dag_packets", tv);
303  ewtn->drops = StatsRegisterCounter("capture.dag_drops", tv);
304 
305  ewtn->tv = tv;
306  *data = (void *)ewtn;
307 
308  SCLogInfo("Starting processing packets from stream: %d on DAG: %s",
309  ewtn->dagstream, ewtn->dagname);
310 
312 }
313 
314 /**
315  * \brief Receives packets from a DAG interface.
316  *
317  * \param tv pointer to ThreadVars
318  * \param data pointer to ErfDagThreadVars
319  * \param slot slot containing task information
320  *
321  * \retval TM_ECODE_OK on success
322  * \retval TM_ECODE_FAILED on failure
323  */
324 TmEcode
325 ReceiveErfDagLoop(ThreadVars *tv, void *data, void *slot)
326 {
327  SCEnter();
328 
330  uint32_t diff = 0;
331  int err;
332  uint8_t *top = NULL;
333  uint32_t pkts_read = 0;
334  TmSlot *s = (TmSlot *)slot;
335 
336  dtv->slot = s->slot_next;
337 
338  while (1) {
341  }
342 
343  top = dag_advance_stream(dtv->dagfd, dtv->dagstream, &(dtv->btm));
344  if (top == NULL) {
345  if (errno == EAGAIN) {
346  if (dtv->dagstream & 0x1) {
347  TmThreadsCaptureHandleTimeout(tv, NULL);
348  usleep(10 * 1000);
349  dtv->btm = dtv->top;
350  }
351  continue;
352  } else {
354  "Failed to read from stream: %d, DAG: %s when "
355  "using dag_advance_stream",
356  dtv->dagstream, dtv->dagname);
358  }
359  }
360 
361  diff = top - dtv->btm;
362  if (diff == 0) {
363  continue;
364  }
365 
366  assert(diff >= dag_record_size);
367 
368  err = ProcessErfDagRecords(dtv, top, &pkts_read);
369 
370  if (err == TM_ECODE_FAILED) {
372  "Failed to read from stream: %d, DAG: %s",
373  dtv->dagstream, dtv->dagname);
374  ReceiveErfDagCloseStream(dtv->dagfd, dtv->dagstream);
376  }
377 
379 
380  SCLogDebug("Read %d records from stream: %d, DAG: %s",
381  pkts_read, dtv->dagstream, dtv->dagname);
382  }
383 
385 }
386 
387 /**
388  * \brief Process a chunk of records read from a DAG interface.
389  *
390  * This function takes a pointer to buffer read from the DAG interface
391  * and processes it individual records.
392  */
393 static inline TmEcode
394 ProcessErfDagRecords(ErfDagThreadVars *ewtn, uint8_t *top, uint32_t *pkts_read)
395 {
396  SCEnter();
397 
398  int err = 0;
399  dag_record_t *dr = NULL;
400  char *prec = NULL;
401  int rlen;
402  char hdr_type = 0;
403  int processed = 0;
404 
405  *pkts_read = 0;
406 
407  while (((top - ewtn->btm) >= dag_record_size) &&
408  ((processed + dag_record_size) < BYTES_PER_LOOP)) {
409 
410  /* Make sure we have at least one packet in the packet pool,
411  * to prevent us from alloc'ing packets at line rate. */
412  PacketPoolWait();
413 
414  prec = (char *)ewtn->btm;
415  dr = (dag_record_t*)prec;
416  rlen = SCNtohs(dr->rlen);
417  hdr_type = dr->type;
418 
419  /* If we don't have enough data to finish processing this ERF
420  * record return and maybe next time we will.
421  */
422  if ((top - ewtn->btm) < rlen)
424 
425  ewtn->btm += rlen;
426  processed += rlen;
427 
428  /* Only support ethernet at this time. */
429  switch (hdr_type & 0x7f) {
430  case ERF_TYPE_PAD:
431  case ERF_TYPE_META:
432  /* Skip. */
433  continue;
434  case ERF_TYPE_DSM_COLOR_ETH:
435  case ERF_TYPE_COLOR_ETH:
436  case ERF_TYPE_COLOR_HASH_ETH:
437  /* In these types the color value overwrites the lctr
438  * (drop count). */
439  break;
440  case ERF_TYPE_ETH:
441  if (dr->lctr) {
442  StatsAddUI64(ewtn->tv, ewtn->drops, SCNtohs(dr->lctr));
443  }
444  break;
445  default:
447  "Processing of DAG record type: %d not implemented.", dr->type);
449  }
450 
451  err = ProcessErfDagRecord(ewtn, prec);
452  if (err != TM_ECODE_OK) {
454  }
455 
456  (*pkts_read)++;
457  }
458 
460 }
461 
462 /**
463  * \brief Process a DAG record into a TM packet buffer.
464  * \param prec pointer to a DAG record.
465  * \param
466  */
467 static inline TmEcode
468 ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec)
469 {
470  SCEnter();
471 
472  int wlen = 0;
473  int rlen = 0;
474  int hdr_num = 0;
475  char hdr_type = 0;
476  dag_record_t *dr = (dag_record_t*)prec;
477  erf_payload_t *pload;
478  Packet *p;
479 
480  hdr_type = dr->type;
481  wlen = SCNtohs(dr->wlen);
482  rlen = SCNtohs(dr->rlen);
483 
484  /* count extension headers */
485  while (hdr_type & 0x80) {
486  if (rlen < (dag_record_size + (hdr_num * 8))) {
488  "Insufficient captured packet length.");
490  }
491  hdr_type = prec[(dag_record_size + (hdr_num * 8))];
492  hdr_num++;
493  }
494 
495  /* Check that the whole frame was captured */
496  if (rlen < (dag_record_size + (8 * hdr_num) + 2 + wlen)) {
497  SCLogInfo("Incomplete frame captured.");
499  }
500 
501  /* skip over extension headers */
502  pload = (erf_payload_t *)(prec + dag_record_size + (8 * hdr_num));
503 
505  if (p == NULL) {
507  "Failed to allocate a Packet on stream: %d, DAG: %s",
508  ewtn->dagstream, ewtn->dagname);
510  }
512 
513  SET_PKT_LEN(p, wlen);
515 
516  /* Take into account for link type Ethernet ETH frame starts
517  * after ther ERF header + pad.
518  */
519  if (unlikely(PacketCopyData(p, pload->eth.dst, GET_PKT_LEN(p)))) {
520  TmqhOutputPacketpool(ewtn->tv, p);
522  }
523 
524  /* Convert ERF time to timeval - from libpcap. */
525  uint64_t ts = dr->ts;
526  p->ts.tv_sec = ts >> 32;
527  ts = (ts & 0xffffffffULL) * 1000000;
528  ts += 0x80000000; /* rounding */
529  p->ts.tv_usec = ts >> 32;
530  if (p->ts.tv_usec >= 1000000) {
531  p->ts.tv_usec -= 1000000;
532  p->ts.tv_sec++;
533  }
534 
535  StatsIncr(ewtn->tv, ewtn->packets);
536  ewtn->bytes += wlen;
537 
538  if (TmThreadsSlotProcessPkt(ewtn->tv, ewtn->slot, p) != TM_ECODE_OK) {
540  }
541 
543 }
544 
545 /**
546  * \brief Print some stats to the log at program exit.
547  *
548  * \param tv Pointer to ThreadVars.
549  * \param data Pointer to data, ErfFileThreadVars.
550  */
551 void
553 {
554  ErfDagThreadVars *ewtn = (ErfDagThreadVars *)data;
555 
556  (void)SC_ATOMIC_SET(ewtn->livedev->pkts,
558  (void)SC_ATOMIC_SET(ewtn->livedev->drop,
560 
561  SCLogInfo("Stream: %d; Bytes: %"PRIu64"; Packets: %"PRIu64
562  "; Drops: %"PRIu64,
563  ewtn->dagstream,
564  ewtn->bytes,
567 }
568 
569 /**
570  * \brief Deinitializes the DAG card.
571  * \param tv pointer to ThreadVars
572  * \param data pointer that gets cast into PcapThreadVars for ptv
573  */
574 TmEcode
576 {
577  SCEnter();
578 
579  ErfDagThreadVars *ewtn = (ErfDagThreadVars *)data;
580 
582 
584 }
585 
586 void
587 ReceiveErfDagCloseStream(int dagfd, int stream)
588 {
589  dag_stop_stream(dagfd, stream);
590  dag_detach_stream(dagfd, stream);
591  dag_close(dagfd);
592 }
593 
594 /** Decode ErfDag */
595 
596 /**
597  * \brief This function passes off to link type decoders.
598  *
599  * DecodeErfDag decodes packets from DAG and passes
600  * them off to the proper link type decoder.
601  *
602  * \param t pointer to ThreadVars
603  * \param p pointer to the current packet
604  * \param data pointer that gets cast into PcapThreadVars for ptv
605  */
606 TmEcode
607 DecodeErfDag(ThreadVars *tv, Packet *p, void *data)
608 {
609  SCEnter();
611 
613 
614  /* update counters */
616 
617  /* call the decoder */
618  switch(p->datalink) {
619  case LINKTYPE_ETHERNET:
621  break;
622  default:
624  "Error: datalink type %" PRId32
625  " not yet supported in module DecodeErfDag",
626  p->datalink);
627  break;
628  }
629 
631 
633 }
634 
635 TmEcode
636 DecodeErfDagThreadInit(ThreadVars *tv, void *initdata, void **data)
637 {
638  SCEnter();
639  DecodeThreadVars *dtv = NULL;
640 
642 
643  if (dtv == NULL)
645 
647 
648  *data = (void *)dtv;
649 
651 }
652 
653 TmEcode
655 {
656  if (data != NULL)
657  DecodeThreadVarsFree(tv, data);
659 }
660 
661 #endif /* HAVE_DAG */
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:67
tm-threads.h
ts
uint64_t ts
Definition: source-erf-file.c:54
BYTES_PER_LOOP
#define BYTES_PER_LOOP
Definition: source-erf-dag.c:89
max_pending_packets
int max_pending_packets
Definition: suricata.c:212
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
TMM_RECEIVEERFDAG
@ TMM_RECEIVEERFDAG
Definition: tm-threads-common.h:52
ThreadVars_::name
char name[16]
Definition: threadvars.h:65
SC_ERR_INVALID_VALUE
@ SC_ERR_INVALID_VALUE
Definition: util-error.h:160
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:262
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1147
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
SC_ERR_ERF_DAG_STREAM_START_FAILED
@ SC_ERR_ERF_DAG_STREAM_START_FAILED
Definition: util-error.h:197
DecodeErfDagThreadInit
TmEcode DecodeErfDagThreadInit(ThreadVars *, void *, void **)
Definition: source-erf-dag.c:636
ErfDagThreadVars_::btm
uint8_t * btm
Definition: source-erf-dag.c:112
LiveDevice_
Definition: util-device.h:40
SURICATA_STOP
#define SURICATA_STOP
Definition: suricata.h:90
ErfDagThreadVars_::bytes
uint64_t bytes
Definition: source-erf-dag.c:105
util-privs.h
StatsSyncCountersIfSignalled
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:137
ErfDagThreadVars_::top
uint8_t * top
Definition: source-erf-dag.c:111
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:118
TmqhOutputPacketpool
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
Definition: tmqh-packetpool.c:375
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
tmqh-packetpool.h
TmModule_::PktAcqLoop
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
Definition: tm-modules.h:54
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
MINDATA
#define MINDATA
Definition: source-erf-dag.c:80
ErfDagThreadVars_::dagname
char dagname[DAGNAME_BUFSIZE]
Definition: source-erf-dag.c:99
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
Packet_::datalink
int datalink
Definition: decode.h:583
source-erf-dag.h
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1150
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:484
SC_ERR_ERF_DAG_OPEN_FAILED
@ SC_ERR_ERF_DAG_OPEN_FAILED
Definition: util-error.h:195
SET_PKT_LEN
#define SET_PKT_LEN(p, len)
Definition: decode.h:235
util-device.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:51
TmModule_::PktAcqBreakLoop
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
Definition: tm-modules.h:57
LiveGetDevice
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:278
MAXWAIT
#define MAXWAIT
Definition: source-erf-dag.c:83
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:231
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:52
ErfDagThreadVars_::livedev
LiveDevice * livedev
Definition: source-erf-dag.c:103
ReceiveErfDagThreadExitStats
void ReceiveErfDagThreadExitStats(ThreadVars *, void *)
Print some stats to the log at program exit.
Definition: source-erf-dag.c:552
ReceiveErfDagCloseStream
void ReceiveErfDagCloseStream(int dagfd, int stream)
Definition: source-erf-dag.c:587
ErfDagThreadVars_::packets
uint16_t packets
Definition: source-erf-dag.c:106
SC_CAP_NET_ADMIN
#define SC_CAP_NET_ADMIN
Definition: util-privs.h:31
SC_ERR_INVALID_ARGUMENT
@ SC_ERR_INVALID_ARGUMENT
Definition: util-error.h:43
ErfDagThreadVars_::dagfd
int dagfd
Definition: source-erf-dag.c:97
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:282
StatsGetLocalCounterValue
uint64_t StatsGetLocalCounterValue(ThreadVars *tv, uint16_t id)
Get the value of the local copy of the counter that hold this id.
Definition: counters.c:1240
PacketPoolWait
void PacketPoolWait(void)
Definition: tmqh-packetpool.c:84
TMM_DECODEERFDAG
@ TMM_DECODEERFDAG
Definition: tm-threads-common.h:53
SC_ERR_DAG_NOSUPPORT
@ SC_ERR_DAG_NOSUPPORT
Definition: util-error.h:202
Packet_
Definition: decode.h:414
TM_FLAG_DECODE_TM
#define TM_FLAG_DECODE_TM
Definition: tm-modules.h:32
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
wlen
uint16_t wlen
Definition: source-erf-file.c:59
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:230
TmSlot_
Definition: tm-threads.h:52
DecodeErfDag
TmEcode DecodeErfDag(ThreadVars *, Packet *, void *)
This function passes off to link type decoders.
Definition: source-erf-dag.c:607
TmEcode
TmEcode
Definition: tm-threads-common.h:79
TmModuleDecodeErfDagRegister
void TmModuleDecodeErfDagRegister(void)
Register the ERF file decoder module.
Definition: source-erf-dag.c:150
TmModule_::name
const char * name
Definition: tm-modules.h:44
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
TM_FLAG_RECEIVE_TM
#define TM_FLAG_RECEIVE_TM
Definition: tm-modules.h:31
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
POLL_INTERVAL
#define POLL_INTERVAL
Definition: source-erf-dag.c:86
ReceiveErfDagThreadInit
TmEcode ReceiveErfDagThreadInit(ThreadVars *, void *, void **)
Initialize the ERF receiver thread, generate a single ErfDagThreadVar structure for each thread,...
Definition: source-erf-dag.c:178
ErfDagThreadVars_::poll
struct timeval maxwait poll
Definition: source-erf-dag.c:101
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:658
Packet_::ts
struct timeval ts
Definition: decode.h:457
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:398
suricata-common.h
ErfDagThreadVars_::tv
ThreadVars * tv
Definition: source-erf-dag.c:94
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
ErfDagThreadVars_::dagstream
int dagstream
Definition: source-erf-dag.c:98
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
SC_ERR_UNIMPLEMENTED
@ SC_ERR_UNIMPLEMENTED
Definition: util-error.h:118
TmModuleReceiveErfDagRegister
void TmModuleReceiveErfDagRegister(void)
Register the ERF file receiver (reader) module.
Definition: source-erf-dag.c:132
TmModule_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:48
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:148
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
ErfDagThreadVars_::drops
uint16_t drops
Definition: source-erf-dag.c:107
ErfDagThreadVars_::slot
TmSlot * slot
Definition: source-erf-dag.c:95
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SC_ERR_ERF_DAG_STREAM_OPEN_FAILED
@ SC_ERR_ERF_DAG_STREAM_OPEN_FAILED
Definition: util-error.h:196
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:631
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:639
SC_ERR_ERF_DAG_STREAM_READ_FAILED
@ SC_ERR_ERF_DAG_STREAM_READ_FAILED
Definition: util-error.h:199
SC_ERR_DATALINK_UNIMPLEMENTED
@ SC_ERR_DATALINK_UNIMPLEMENTED
Definition: util-error.h:68
ReceiveErfDagThreadDeinit
TmEcode ReceiveErfDagThreadDeinit(ThreadVars *, void *)
Deinitializes the DAG card.
Definition: source-erf-dag.c:575
DecodeErfDagThreadDeinit
TmEcode DecodeErfDagThreadDeinit(ThreadVars *tv, void *data)
Definition: source-erf-dag.c:654
ReceiveErfDagLoop
TmEcode ReceiveErfDagLoop(ThreadVars *, void *data, void *slot)
Receives packets from a DAG interface.
Definition: source-erf-dag.c:325
SC_ERR_MEM_ALLOC
@ SC_ERR_MEM_ALLOC
Definition: util-error.h:31
suricata.h
TmSlot_::slot_next
struct TmSlot_ * slot_next
Definition: tm-threads.h:61
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:939
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
Packet_::type
uint8_t type
Definition: decode.h:424
SC_ERR_ERF_DAG_STREAM_SET_FAILED
@ SC_ERR_ERF_DAG_STREAM_SET_FAILED
Definition: util-error.h:198
ErfDagThreadVars
struct ErfDagThreadVars_ ErfDagThreadVars
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:180
DecodeEthernet
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-ethernet.c:41
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:70
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:605
LINKTYPE_ETHERNET
#define LINKTYPE_ETHERNET
Definition: decode.h:1088
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:198
ErfDagThreadVars_
Definition: source-erf-dag.c:93
rlen
uint16_t rlen
Definition: source-erf-file.c:57