Go to the documentation of this file.
68 NoErfDagSupportExit(
ThreadVars *
tv,
const void *initdata,
void **data)
71 "Error creating thread %s: you do not have support for DAG cards "
72 "enabled please recompile with --enable-dag",
tv->
name);
87 #define POLL_INTERVAL 1000;
90 #define BYTES_PER_LOOP (4 * 1024 * 1024)
102 struct timeval maxwait,
poll;
118 uint32_t *pkts_read);
182 int stream_count = 0;
184 if (initdata == NULL) {
186 "Error: No DAG interface provided.");
193 "Failed to allocate memory for ERF DAG thread vars.");
196 memset(ewtn, 0,
sizeof(*ewtn));
201 if (dag_parse_name(initdata, ewtn->
dagname, DAGNAME_BUFSIZE,
204 "Failed to parse DAG interface: %s",
218 SCLogInfo(
"Opening DAG: %s on stream: %d for processing",
231 if ((stream_count = dag_rx_get_stream_count(ewtn->
dagfd)) < 0) {
233 "Failed to open stream: %d, DAG: %s, could not query stream count",
242 if (ewtn->
dagstream > stream_count * 2) {
244 "Failed to open stream: %d, DAG: %s, insufficient streams: %d",
255 if (dag_set_mode(ewtn->
dagfd, ewtn->
dagstream, DAG_REVERSE_MODE)) {
257 "Failed to set mode to DAG_REVERSE_MODE on stream: %d, DAG: %s",
266 "Failed to open DAG stream: %d, DAG: %s",
274 "Failed to start DAG stream: %d, DAG: %s",
280 SCLogInfo(
"Attached and started stream: %d on DAG: %s",
286 timerclear(&ewtn->maxwait);
287 ewtn->maxwait.tv_usec =
MAXWAIT;
288 timerclear(&ewtn->
poll);
295 &(ewtn->maxwait), &(ewtn->
poll)) < 0) {
297 "Failed to set poll parameters for stream: %d, DAG: %s",
307 *data = (
void *)ewtn;
311 SCLogInfo(
"Starting processing packets from stream: %d on DAG: %s",
336 uint32_t pkts_read = 0;
346 top = dag_advance_stream(
dtv->dagfd,
dtv->dagstream, &(
dtv->btm));
348 if (errno == EAGAIN) {
349 if (
dtv->dagstream & 0x1) {
350 TmThreadsCaptureHandleTimeout(
tv, NULL);
357 "Failed to read from stream: %d, DAG: %s when "
358 "using dag_advance_stream",
359 dtv->dagstream,
dtv->dagname);
364 diff = top -
dtv->btm;
369 assert(diff >= dag_record_size);
371 err = ProcessErfDagRecords(
dtv, top, &pkts_read);
375 "Failed to read from stream: %d, DAG: %s",
376 dtv->dagstream,
dtv->dagname);
383 SCLogDebug(
"Read %d records from stream: %d, DAG: %s",
384 pkts_read,
dtv->dagstream,
dtv->dagname);
397 ProcessErfDagRecords(
ErfDagThreadVars *ewtn, uint8_t *top, uint32_t *pkts_read)
402 dag_record_t *dr = NULL;
410 while (((top - ewtn->
btm) >= dag_record_size) &&
417 prec = (
char *)ewtn->
btm;
418 dr = (dag_record_t*)prec;
432 switch (hdr_type & 0x7f) {
437 case ERF_TYPE_DSM_COLOR_ETH:
438 case ERF_TYPE_COLOR_ETH:
439 case ERF_TYPE_COLOR_HASH_ETH:
450 "Processing of DAG record type: %d not implemented.", dr->type);
454 err = ProcessErfDagRecord(ewtn, prec);
479 dag_record_t *dr = (dag_record_t*)prec;
480 erf_payload_t *pload;
488 while (hdr_type & 0x80) {
489 if (
rlen < (dag_record_size + (hdr_num * 8))) {
491 "Insufficient captured packet length.");
494 hdr_type = prec[(dag_record_size + (hdr_num * 8))];
499 if (
rlen < (dag_record_size + (8 * hdr_num) + 2 +
wlen)) {
505 pload = (erf_payload_t *)(prec + dag_record_size + (8 * hdr_num));
510 "Failed to allocate a Packet on stream: %d, DAG: %s",
528 uint64_t
ts = dr->ts;
529 p->
ts.tv_sec =
ts >> 32;
530 ts = (
ts & 0xffffffffULL) * 1000000;
532 p->
ts.tv_usec =
ts >> 32;
533 if (p->
ts.tv_usec >= 1000000) {
534 p->
ts.tv_usec -= 1000000;
564 SCLogInfo(
"Stream: %d; Bytes: %"PRIu64
"; Packets: %"PRIu64
592 dag_stop_stream(dagfd, stream);
593 dag_detach_stream(dagfd, stream);
627 "Error: datalink type %" PRId32
628 " not yet supported in module DecodeErfDag",
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
@ SC_ERR_ERF_DAG_STREAM_START_FAILED
TmEcode DecodeErfDagThreadInit(ThreadVars *, void *, void **)
#define StatsSyncCountersIfSignalled(tv)
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
char dagname[DAGNAME_BUFSIZE]
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
#define PKT_SET_SRC(p, src_val)
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
@ SC_ERR_ERF_DAG_OPEN_FAILED
#define SET_PKT_LEN(p, len)
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Per thread variable structure.
TmEcode(* Func)(ThreadVars *, Packet *, void *)
void ReceiveErfDagThreadExitStats(ThreadVars *, void *)
Print some stats to the log at program exit.
void ReceiveErfDagCloseStream(int dagfd, int stream)
@ SC_ERR_INVALID_ARGUMENT
uint64_t StatsGetLocalCounterValue(ThreadVars *tv, uint16_t id)
Get the value of the local copy of the counter that hold this id.
void PacketPoolWait(void)
#define TM_FLAG_DECODE_TM
TmModule tmm_modules[TMM_SIZE]
TmEcode DecodeErfDag(ThreadVars *, Packet *, void *)
This function passes off to link type decoders.
void TmModuleDecodeErfDagRegister(void)
Register the ERF file decoder module.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define TM_FLAG_RECEIVE_TM
TmEcode ReceiveErfDagThreadInit(ThreadVars *, void *, void **)
Initialize the ERF receiver thread, generate a single ErfDagThreadVar structure for each thread,...
struct timeval maxwait poll
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
#define FatalError(x,...)
void TmModuleReceiveErfDagRegister(void)
Register the ERF file receiver (reader) module.
void(* ThreadExitPrintStats)(ThreadVars *, void *)
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
void DatalinkSetGlobalType(int datalink)
@ SC_ERR_ERF_DAG_STREAM_OPEN_FAILED
Structure to hold thread specific data for all decode modules.
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
@ SC_ERR_ERF_DAG_STREAM_READ_FAILED
@ SC_ERR_DATALINK_UNIMPLEMENTED
TmEcode ReceiveErfDagThreadDeinit(ThreadVars *, void *)
Deinitializes the DAG card.
TmEcode DecodeErfDagThreadDeinit(ThreadVars *tv, void *data)
TmEcode ReceiveErfDagLoop(ThreadVars *, void *data, void *slot)
Receives packets from a DAG interface.
struct TmSlot_ * slot_next
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
@ SC_ERR_ERF_DAG_STREAM_SET_FAILED
struct ErfDagThreadVars_ ErfDagThreadVars
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
#define LINKTYPE_ETHERNET
volatile uint8_t suricata_ctl_flags