suricata
source-erf-dag.c
Go to the documentation of this file.
1 /* Copyright (C) 2010-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Endace Technology Limited.
22  * \author Jason MacLulich <jason.maclulich@endace.com>
23  *
24  * Support for reading ERF records from a DAG card.
25  *
26  * Only ethernet supported at this time.
27  */
28 
29 #include "suricata-common.h"
30 #include "suricata.h"
31 #include "tm-threads.h"
32 
33 #include "util-privs.h"
34 #include "util-datalink.h"
35 #include "util-device.h"
36 #include "tmqh-packetpool.h"
37 #include "source-erf-dag.h"
38 
39 #ifndef HAVE_DAG
40 
41 TmEcode NoErfDagSupportExit(ThreadVars *, const void *, void **);
42 
43 void
45 {
46  tmm_modules[TMM_RECEIVEERFDAG].name = "ReceiveErfDag";
47  tmm_modules[TMM_RECEIVEERFDAG].ThreadInit = NoErfDagSupportExit;
53 }
54 
55 void
57 {
58  tmm_modules[TMM_DECODEERFDAG].name = "DecodeErfDag";
59  tmm_modules[TMM_DECODEERFDAG].ThreadInit = NoErfDagSupportExit;
65 }
66 
67 TmEcode
68 NoErfDagSupportExit(ThreadVars *tv, const void *initdata, void **data)
69 {
70  SCLogError("Error creating thread %s: you do not have support for DAG cards "
71  "enabled please recompile with --enable-dag",
72  tv->name);
73  exit(EXIT_FAILURE);
74 }
75 
76 #else /* Implied we do have DAG support */
77 
78 #include <dagapi.h>
79 
80 /* Minimum amount of data to read from the DAG at a time. */
81 #define MINDATA 32768
82 
83 /* Maximum time (us) to wait for MINDATA to be read. */
84 #define MAXWAIT 20000
85 
86 /* Poll interval in microseconds. */
87 #define POLL_INTERVAL 1000;
88 
89 /* Number of bytes per loop to process before fetching more data. */
90 #define BYTES_PER_LOOP (4 * 1024 * 1024) /* 4 MB */
91 
92 extern uint16_t max_pending_packets;
93 
94 typedef struct ErfDagThreadVars_ {
97 
98  int dagfd;
99  int dagstream;
100  char dagname[DAGNAME_BUFSIZE];
101 
102  struct timeval maxwait, poll; /* Could possibly be made static */
103 
105 
106  uint64_t bytes;
107  uint16_t packets;
108  uint16_t drops;
109 
110  /* Current location in the DAG stream input buffer.
111  */
112  uint8_t *top;
113  uint8_t *btm;
114 
116 
117 static inline TmEcode ProcessErfDagRecords(ErfDagThreadVars *ewtn, uint8_t *top,
118  uint32_t *pkts_read);
119 static inline TmEcode ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec);
120 TmEcode ReceiveErfDagLoop(ThreadVars *, void *data, void *slot);
121 TmEcode ReceiveErfDagThreadInit(ThreadVars *, void *, void **);
124 TmEcode DecodeErfDagThreadInit(ThreadVars *, void *, void **);
126 TmEcode DecodeErfDag(ThreadVars *, Packet *, void *);
127 void ReceiveErfDagCloseStream(int dagfd, int stream);
128 
129 /**
130  * \brief Register the ERF file receiver (reader) module.
131  */
132 void
134 {
135  tmm_modules[TMM_RECEIVEERFDAG].name = "ReceiveErfDag";
145 }
146 
147 /**
148  * \brief Register the ERF file decoder module.
149  */
150 void
152 {
153  tmm_modules[TMM_DECODEERFDAG].name = "DecodeErfDag";
160 }
161 
162 /**
163  * \brief Initialize the ERF receiver thread, generate a single
164  * ErfDagThreadVar structure for each thread, this will
165  * contain a DAG file descriptor which is read when the
166  * thread executes.
167  *
168  * \param tv Thread variable to ThreadVars
169  * \param initdata Initial data to the interface passed from the user,
170  * this is processed by the user.
171  *
172  * We assume that we have only a single name for the DAG
173  * interface.
174  *
175  * \param data data pointer gets populated with
176  *
177  */
178 TmEcode
179 ReceiveErfDagThreadInit(ThreadVars *tv, void *initdata, void **data)
180 {
181  SCEnter();
182  int stream_count = 0;
183 
184  if (initdata == NULL) {
185  SCLogError("Error: No DAG interface provided.");
187  }
188 
189  ErfDagThreadVars *ewtn = SCMalloc(sizeof(ErfDagThreadVars));
190  if (unlikely(ewtn == NULL)) {
191  FatalError("Failed to allocate memory for ERF DAG thread vars.");
192  }
193 
194  memset(ewtn, 0, sizeof(*ewtn));
195 
196  /* dag_parse_name will return a DAG device name and stream number
197  * to open for this thread.
198  */
199  if (dag_parse_name(initdata, ewtn->dagname, DAGNAME_BUFSIZE,
200  &ewtn->dagstream) < 0) {
201  SCLogError("Failed to parse DAG interface: %s", (char *)initdata);
202  SCFree(ewtn);
203  exit(EXIT_FAILURE);
204  }
205 
206  ewtn->livedev = LiveGetDevice(initdata);
207  if (ewtn->livedev == NULL) {
208  SCLogError("Unable to get %s live device", (char *)initdata);
209  SCFree(ewtn);
211  }
212 
213  SCLogInfo("Opening DAG: %s on stream: %d for processing",
214  ewtn->dagname, ewtn->dagstream);
215 
216  if ((ewtn->dagfd = dag_open(ewtn->dagname)) < 0) {
217  SCLogError("Failed to open DAG: %s", ewtn->dagname);
218  SCFree(ewtn);
220  }
221 
222  /* Check to make sure the card has enough available streams to
223  * support reading from the one specified.
224  */
225  if ((stream_count = dag_rx_get_stream_count(ewtn->dagfd)) < 0) {
226  SCLogError("Failed to open stream: %d, DAG: %s, could not query stream count",
227  ewtn->dagstream, ewtn->dagname);
228  SCFree(ewtn);
230  }
231 
232  /* Check to make sure we have enough rx streams to open the stream
233  * the user is asking for.
234  */
235  if (ewtn->dagstream > stream_count * 2) {
236  SCLogError("Failed to open stream: %d, DAG: %s, insufficient streams: %d", ewtn->dagstream,
237  ewtn->dagname, stream_count);
238  SCFree(ewtn);
240  }
241 
242  /* If we are transmitting into a soft DAG card then set the stream
243  * to act in reverse mode.
244  */
245  if (0 != (ewtn->dagstream & 0x01)) {
246  /* Setting reverse mode for using with soft dag from daemon side */
247  if (dag_set_mode(ewtn->dagfd, ewtn->dagstream, DAG_REVERSE_MODE)) {
248  SCLogError("Failed to set mode to DAG_REVERSE_MODE on stream: %d, DAG: %s",
249  ewtn->dagstream, ewtn->dagname);
250  SCFree(ewtn);
252  }
253  }
254 
255  if (dag_attach_stream(ewtn->dagfd, ewtn->dagstream, 0, 0) < 0) {
256  SCLogError("Failed to open DAG stream: %d, DAG: %s", ewtn->dagstream, ewtn->dagname);
257  SCFree(ewtn);
259  }
260 
261  if (dag_start_stream(ewtn->dagfd, ewtn->dagstream) < 0) {
262  SCLogError("Failed to start DAG stream: %d, DAG: %s", ewtn->dagstream, ewtn->dagname);
263  SCFree(ewtn);
265  }
266 
267  SCLogInfo("Attached and started stream: %d on DAG: %s",
268  ewtn->dagstream, ewtn->dagname);
269 
270  /*
271  * Initialise DAG Polling parameters.
272  */
273  timerclear(&ewtn->maxwait);
274  ewtn->maxwait.tv_usec = MAXWAIT;
275  timerclear(&ewtn->poll);
276  ewtn->poll.tv_usec = POLL_INTERVAL;
277 
278  /* 32kB minimum data to return -- we still restrict the number of
279  * pkts that are processed to a maximum of dag_max_read_packets.
280  */
281  if (dag_set_stream_poll(ewtn->dagfd, ewtn->dagstream, MINDATA,
282  &(ewtn->maxwait), &(ewtn->poll)) < 0) {
283  SCLogError("Failed to set poll parameters for stream: %d, DAG: %s", ewtn->dagstream,
284  ewtn->dagname);
285  SCFree(ewtn);
287  }
288 
289  ewtn->packets = StatsRegisterCounter("capture.dag_packets", tv);
290  ewtn->drops = StatsRegisterCounter("capture.dag_drops", tv);
291 
292  ewtn->tv = tv;
293  *data = (void *)ewtn;
294 
296 
297  SCLogInfo("Starting processing packets from stream: %d on DAG: %s",
298  ewtn->dagstream, ewtn->dagname);
299 
301 }
302 
303 /**
304  * \brief Receives packets from a DAG interface.
305  *
306  * \param tv pointer to ThreadVars
307  * \param data pointer to ErfDagThreadVars
308  * \param slot slot containing task information
309  *
310  * \retval TM_ECODE_OK on success
311  * \retval TM_ECODE_FAILED on failure
312  */
313 TmEcode
314 ReceiveErfDagLoop(ThreadVars *tv, void *data, void *slot)
315 {
316  SCEnter();
317 
319  uint32_t diff = 0;
320  int err;
321  uint8_t *top = NULL;
322  uint32_t pkts_read = 0;
323  TmSlot *s = (TmSlot *)slot;
324 
325  dtv->slot = s->slot_next;
326 
327  // Indicate that the thread is actually running its application level code (i.e., it can poll
328  // packets)
330 
331  while (1) {
334  }
335 
336  top = dag_advance_stream(dtv->dagfd, dtv->dagstream, &(dtv->btm));
337  if (top == NULL) {
338  if (errno == EAGAIN) {
339  if (dtv->dagstream & 0x1) {
340  TmThreadsCaptureHandleTimeout(tv, NULL);
341  usleep(10 * 1000);
342  dtv->btm = dtv->top;
343  }
344  continue;
345  } else {
346  SCLogError("Failed to read from stream: %d, DAG: %s when "
347  "using dag_advance_stream",
348  dtv->dagstream, dtv->dagname);
350  }
351  }
352 
353  diff = top - dtv->btm;
354  if (diff == 0) {
355  continue;
356  }
357 
358  assert(diff >= dag_record_size);
359 
360  err = ProcessErfDagRecords(dtv, top, &pkts_read);
361 
362  if (err == TM_ECODE_FAILED) {
363  SCLogError("Failed to read from stream: %d, DAG: %s", dtv->dagstream, dtv->dagname);
364  ReceiveErfDagCloseStream(dtv->dagfd, dtv->dagstream);
366  }
367 
369 
370  SCLogDebug("Read %d records from stream: %d, DAG: %s",
371  pkts_read, dtv->dagstream, dtv->dagname);
372  }
373 
375 }
376 
377 /**
378  * \brief Process a chunk of records read from a DAG interface.
379  *
380  * This function takes a pointer to buffer read from the DAG interface
381  * and processes it individual records.
382  */
383 static inline TmEcode
384 ProcessErfDagRecords(ErfDagThreadVars *ewtn, uint8_t *top, uint32_t *pkts_read)
385 {
386  SCEnter();
387 
388  int err = 0;
389  dag_record_t *dr = NULL;
390  char *prec = NULL;
391  int rlen;
392  char hdr_type = 0;
393  int processed = 0;
394 
395  *pkts_read = 0;
396 
397  while (((top - ewtn->btm) >= dag_record_size) &&
398  ((processed + dag_record_size) < BYTES_PER_LOOP)) {
399 
400  /* Make sure we have at least one packet in the packet pool,
401  * to prevent us from alloc'ing packets at line rate. */
402  PacketPoolWait();
403 
404  prec = (char *)ewtn->btm;
405  dr = (dag_record_t*)prec;
406  rlen = SCNtohs(dr->rlen);
407  hdr_type = dr->type;
408 
409  /* If we don't have enough data to finish processing this ERF
410  * record return and maybe next time we will.
411  */
412  if ((top - ewtn->btm) < rlen)
414 
415  ewtn->btm += rlen;
416  processed += rlen;
417 
418  /* Only support ethernet at this time. */
419  switch (hdr_type & 0x7f) {
420  case ERF_TYPE_PAD:
421  case ERF_TYPE_META:
422  /* Skip. */
423  continue;
424  case ERF_TYPE_DSM_COLOR_ETH:
425  case ERF_TYPE_COLOR_ETH:
426  case ERF_TYPE_COLOR_HASH_ETH:
427  /* In these types the color value overwrites the lctr
428  * (drop count). */
429  break;
430  case ERF_TYPE_ETH:
431  if (dr->lctr) {
432  StatsAddUI64(ewtn->tv, ewtn->drops, SCNtohs(dr->lctr));
433  }
434  break;
435  default:
436  SCLogError("Processing of DAG record type: %d not implemented.", dr->type);
438  }
439 
440  err = ProcessErfDagRecord(ewtn, prec);
441  if (err != TM_ECODE_OK) {
443  }
444 
445  (*pkts_read)++;
446  }
447 
449 }
450 
451 /**
452  * \brief Process a DAG record into a TM packet buffer.
453  * \param prec pointer to a DAG record.
454  * \param
455  */
456 static inline TmEcode
457 ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec)
458 {
459  SCEnter();
460 
461  int wlen = 0;
462  int rlen = 0;
463  int hdr_num = 0;
464  char hdr_type = 0;
465  dag_record_t *dr = (dag_record_t*)prec;
466  erf_payload_t *pload;
467  Packet *p;
468 
469  hdr_type = dr->type;
470  wlen = SCNtohs(dr->wlen);
471  rlen = SCNtohs(dr->rlen);
472 
473  /* count extension headers */
474  while (hdr_type & 0x80) {
475  if (rlen < (dag_record_size + (hdr_num * 8))) {
476  SCLogError("Insufficient captured packet length.");
478  }
479  hdr_type = prec[(dag_record_size + (hdr_num * 8))];
480  hdr_num++;
481  }
482 
483  /* Check that the whole frame was captured */
484  if (rlen < (dag_record_size + (8 * hdr_num) + 2 + wlen)) {
485  SCLogInfo("Incomplete frame captured.");
487  }
488 
489  /* skip over extension headers */
490  pload = (erf_payload_t *)(prec + dag_record_size + (8 * hdr_num));
491 
493  if (p == NULL) {
494  SCLogError("Failed to allocate a Packet on stream: %d, DAG: %s", ewtn->dagstream,
495  ewtn->dagname);
497  }
499 
500  SET_PKT_LEN(p, wlen);
502 
503  /* Take into account for link type Ethernet ETH frame starts
504  * after the ERF header + pad.
505  */
506  if (unlikely(PacketCopyData(p, pload->eth.dst, GET_PKT_LEN(p)))) {
507  TmqhOutputPacketpool(ewtn->tv, p);
509  }
510 
511  /* Convert ERF time to timeval - from libpcap. */
512  uint64_t ts = dr->ts;
513  p->ts = SCTIME_FROM_SECS(ts >> 32);
514  ts = (ts & 0xffffffffULL) * 1000000;
515  ts += 0x80000000; /* rounding */
516  uint64_t usecs = ts >> 32;
517  if (usecs >= 1000000) {
518  usecs -= 1000000;
519  p->ts += SCTIME_FROM_SECS(1);
520  }
521  p->ts += SCTIME_FROM_USECS(usecs);
522 
523  StatsIncr(ewtn->tv, ewtn->packets);
524  ewtn->bytes += wlen;
525 
526  if (TmThreadsSlotProcessPkt(ewtn->tv, ewtn->slot, p) != TM_ECODE_OK) {
528  }
529 
531 }
532 
533 /**
534  * \brief Print some stats to the log at program exit.
535  *
536  * \param tv Pointer to ThreadVars.
537  * \param data Pointer to data, ErfFileThreadVars.
538  */
539 void
541 {
542  ErfDagThreadVars *ewtn = (ErfDagThreadVars *)data;
543 
544  (void)SC_ATOMIC_SET(ewtn->livedev->pkts,
546  (void)SC_ATOMIC_SET(ewtn->livedev->drop,
548 
549  SCLogInfo("Stream: %d; Bytes: %"PRIu64"; Packets: %"PRIu64
550  "; Drops: %"PRIu64,
551  ewtn->dagstream,
552  ewtn->bytes,
555 }
556 
557 /**
558  * \brief Deinitializes the DAG card.
559  * \param tv pointer to ThreadVars
560  * \param data pointer that gets cast into PcapThreadVars for ptv
561  */
562 TmEcode
564 {
565  SCEnter();
566 
567  ErfDagThreadVars *ewtn = (ErfDagThreadVars *)data;
568 
570 
572 }
573 
574 void
575 ReceiveErfDagCloseStream(int dagfd, int stream)
576 {
577  dag_stop_stream(dagfd, stream);
578  dag_detach_stream(dagfd, stream);
579  dag_close(dagfd);
580 }
581 
582 /** Decode ErfDag */
583 
584 /**
585  * \brief This function passes off to link type decoders.
586  *
587  * DecodeErfDag decodes packets from DAG and passes
588  * them off to the proper link type decoder.
589  *
590  * \param t pointer to ThreadVars
591  * \param p pointer to the current packet
592  * \param data pointer that gets cast into PcapThreadVars for ptv
593  */
594 TmEcode
595 DecodeErfDag(ThreadVars *tv, Packet *p, void *data)
596 {
597  SCEnter();
599 
601 
602  /* update counters */
604 
605  /* call the decoder */
606  switch(p->datalink) {
607  case LINKTYPE_ETHERNET:
609  break;
610  default:
611  SCLogError("Error: datalink type %" PRId32 " not yet supported in module DecodeErfDag",
612  p->datalink);
613  break;
614  }
615 
617 
619 }
620 
621 TmEcode
622 DecodeErfDagThreadInit(ThreadVars *tv, void *initdata, void **data)
623 {
624  SCEnter();
625  DecodeThreadVars *dtv = NULL;
626 
628 
629  if (dtv == NULL)
631 
633 
634  *data = (void *)dtv;
635 
637 }
638 
639 TmEcode
641 {
642  if (data != NULL)
643  DecodeThreadVarsFree(tv, data);
645 }
646 
647 #endif /* HAVE_DAG */
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:73
tm-threads.h
max_pending_packets
uint16_t max_pending_packets
Definition: suricata.c:186
ts
uint64_t ts
Definition: source-erf-file.c:55
BYTES_PER_LOOP
#define BYTES_PER_LOOP
Definition: source-erf-dag.c:90
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:167
TMM_RECEIVEERFDAG
@ TMM_RECEIVEERFDAG
Definition: tm-threads-common.h:52
ThreadVars_::name
char name[16]
Definition: threadvars.h:64
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:292
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1053
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
TmThreadsSetFlag
void TmThreadsSetFlag(ThreadVars *tv, uint32_t flag)
Set a thread flag.
Definition: tm-threads.c:99
DecodeErfDagThreadInit
TmEcode DecodeErfDagThreadInit(ThreadVars *, void *, void **)
Definition: source-erf-dag.c:622
ErfDagThreadVars_::btm
uint8_t * btm
Definition: source-erf-dag.c:113
LiveDevice_
Definition: util-device.h:49
THV_RUNNING
#define THV_RUNNING
Definition: threadvars.h:54
SURICATA_STOP
#define SURICATA_STOP
Definition: suricata.h:89
SCTIME_FROM_USECS
#define SCTIME_FROM_USECS(us)
Definition: util-time.h:66
ErfDagThreadVars_::bytes
uint64_t bytes
Definition: source-erf-dag.c:106
util-privs.h
StatsSyncCountersIfSignalled
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:141
ErfDagThreadVars_::top
uint8_t * top
Definition: source-erf-dag.c:112
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:147
TmqhOutputPacketpool
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
Definition: tmqh-packetpool.c:356
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
tmqh-packetpool.h
TmModule_::PktAcqLoop
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
Definition: tm-modules.h:54
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
MINDATA
#define MINDATA
Definition: source-erf-dag.c:81
ErfDagThreadVars_::dagname
char dagname[DAGNAME_BUFSIZE]
Definition: source-erf-dag.c:100
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
Packet_::datalink
int datalink
Definition: decode.h:611
source-erf-dag.h
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1056
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:525
SET_PKT_LEN
#define SET_PKT_LEN(p, len)
Definition: decode.h:224
SCTIME_FROM_SECS
#define SCTIME_FROM_SECS(s)
Definition: util-time.h:61
util-device.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:54
TmModule_::PktAcqBreakLoop
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
Definition: tm-modules.h:57
Packet_::ts
SCTime_t ts
Definition: decode.h:475
LiveGetDevice
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:248
MAXWAIT
#define MAXWAIT
Definition: source-erf-dag.c:84
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:220
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:52
ErfDagThreadVars_::livedev
LiveDevice * livedev
Definition: source-erf-dag.c:104
ReceiveErfDagThreadExitStats
void ReceiveErfDagThreadExitStats(ThreadVars *, void *)
Print some stats to the log at program exit.
Definition: source-erf-dag.c:540
ReceiveErfDagCloseStream
void ReceiveErfDagCloseStream(int dagfd, int stream)
Definition: source-erf-dag.c:575
ErfDagThreadVars_::packets
uint16_t packets
Definition: source-erf-dag.c:107
SC_CAP_NET_ADMIN
#define SC_CAP_NET_ADMIN
Definition: util-privs.h:31
ErfDagThreadVars_::dagfd
int dagfd
Definition: source-erf-dag.c:98
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:295
StatsGetLocalCounterValue
uint64_t StatsGetLocalCounterValue(ThreadVars *tv, uint16_t id)
Get the value of the local copy of the counter that hold this id.
Definition: counters.c:1260
PacketPoolWait
void PacketPoolWait(void)
Definition: tmqh-packetpool.c:69
TMM_DECODEERFDAG
@ TMM_DECODEERFDAG
Definition: tm-threads-common.h:53
Packet_
Definition: decode.h:430
TM_FLAG_DECODE_TM
#define TM_FLAG_DECODE_TM
Definition: tm-modules.h:32
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
wlen
uint16_t wlen
Definition: source-erf-file.c:60
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:219
TmSlot_
Definition: tm-threads.h:53
DecodeErfDag
TmEcode DecodeErfDag(ThreadVars *, Packet *, void *)
This function passes off to link type decoders.
Definition: source-erf-dag.c:595
TmEcode
TmEcode
Definition: tm-threads-common.h:83
TmModuleDecodeErfDagRegister
void TmModuleDecodeErfDagRegister(void)
Register the ERF file decoder module.
Definition: source-erf-dag.c:151
TmModule_::name
const char * name
Definition: tm-modules.h:44
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
TM_FLAG_RECEIVE_TM
#define TM_FLAG_RECEIVE_TM
Definition: tm-modules.h:31
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
POLL_INTERVAL
#define POLL_INTERVAL
Definition: source-erf-dag.c:87
ReceiveErfDagThreadInit
TmEcode ReceiveErfDagThreadInit(ThreadVars *, void *, void **)
Initialize the ERF receiver thread, generate a single ErfDagThreadVar structure for each thread,...
Definition: source-erf-dag.c:179
ErfDagThreadVars_::poll
struct timeval maxwait poll
Definition: source-erf-dag.c:102
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:707
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:409
suricata-common.h
ErfDagThreadVars_::tv
ThreadVars * tv
Definition: source-erf-dag.c:95
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
FatalError
#define FatalError(...)
Definition: util-debug.h:502
ErfDagThreadVars_::dagstream
int dagstream
Definition: source-erf-dag.c:99
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
TmModuleReceiveErfDagRegister
void TmModuleReceiveErfDagRegister(void)
Register the ERF file receiver (reader) module.
Definition: source-erf-dag.c:133
TmModule_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:48
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:146
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
ErfDagThreadVars_::drops
uint16_t drops
Definition: source-erf-dag.c:108
ErfDagThreadVars_::slot
TmSlot * slot
Definition: source-erf-dag.c:96
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:668
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:688
ReceiveErfDagThreadDeinit
TmEcode ReceiveErfDagThreadDeinit(ThreadVars *, void *)
Deinitializes the DAG card.
Definition: source-erf-dag.c:563
DecodeErfDagThreadDeinit
TmEcode DecodeErfDagThreadDeinit(ThreadVars *tv, void *data)
Definition: source-erf-dag.c:640
ReceiveErfDagLoop
TmEcode ReceiveErfDagLoop(ThreadVars *, void *data, void *slot)
Receives packets from a DAG interface.
Definition: source-erf-dag.c:314
suricata.h
TmSlot_::slot_next
struct TmSlot_ * slot_next
Definition: tm-threads.h:62
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:961
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
Packet_::type
uint8_t type
Definition: decode.h:440
ErfDagThreadVars
struct ErfDagThreadVars_ ErfDagThreadVars
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:208
DecodeEthernet
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-ethernet.c:42
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:76
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:654
LINKTYPE_ETHERNET
#define LINKTYPE_ETHERNET
Definition: decode.h:969
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:172
ErfDagThreadVars_
Definition: source-erf-dag.c:94
rlen
uint16_t rlen
Definition: source-erf-file.c:58