suricata
source-ipfw.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "packet-queue.h"
#include "threads.h"
#include "threadvars.h"
#include "tm-queuehandlers.h"
#include "tm-threads.h"
#include "source-ipfw.h"
#include "util-debug.h"
#include "conf.h"
#include "util-byte.h"
#include "util-privs.h"
#include "util-device.h"
#include "runmodes.h"
Include dependency graph for source-ipfw.c:

Go to the source code of this file.

Data Structures

struct  IPFWThreadVars_
 Structure to hold thread specific variables. More...
 

Macros

#define IPFW_ACCEPT   0
 
#define IPFW_DROP   1
 
#define IPFW_SOCKET_POLL_MSEC   300
 
#define IP_MAXPACKET   65535
 

Typedefs

typedef struct IPFWThreadVars_ IPFWThreadVars
 Structure to hold thread specific variables. More...
 

Functions

void * IPFWGetQueue (int number)
 Get a pointer to the IPFW queue at index. More...
 
TmEcode ReceiveIPFWThreadInit (ThreadVars *tv, const void *initdata, void **data)
 Init function for RecieveIPFW. More...
 
TmEcode ReceiveIPFW (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *)
 
TmEcode ReceiveIPFWLoop (ThreadVars *tv, void *data, void *slot)
 
void ReceiveIPFWThreadExitStats (ThreadVars *tv, void *data)
 This function prints stats to the screen at exit. More...
 
TmEcode ReceiveIPFWThreadDeinit (ThreadVars *tv, void *data)
 DeInit function closes divert socket at exit. More...
 
TmEcode IPFWSetVerdict (ThreadVars *tv, IPFWThreadVars *ptv, Packet *p)
 This function sets the Verdict and processes the packet. More...
 
TmEcode VerdictIPFW (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 This function handles the Verdict processing. More...
 
TmEcode VerdictIPFWThreadInit (ThreadVars *tv, const void *initdata, void **data)
 This function initializes the VerdictThread. More...
 
void VerdictIPFWThreadExitStats (ThreadVars *tv, void *data)
 This function prints stats for the VerdictThread. More...
 
TmEcode VerdictIPFWThreadDeinit (ThreadVars *tv, void *data)
 This function deinitializes the VerdictThread. More...
 
TmEcode DecodeIPFWThreadInit (ThreadVars *tv, const void *initdata, void **data)
 This function initializes the DecodeThreadVariables. More...
 
TmEcode DecodeIPFWThreadDeinit (ThreadVars *tv, void *data)
 
TmEcode DecodeIPFW (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 This function passes off to link type decoders. More...
 
void TmModuleReceiveIPFWRegister (void)
 Registration Function for RecieveIPFW. More...
 
void TmModuleVerdictIPFWRegister (void)
 Registration Function for VerdictIPFW. More...
 
void TmModuleDecodeIPFWRegister (void)
 Registration Function for DecodeIPFW. More...
 
int IPFWRegisterQueue (char *queue)
 Add an IPFW divert. More...
 
void * IPFWGetThread (int number)
 Get a pointer to the IPFW thread at index. More...
 

Variables

int max_pending_packets
 

Detailed Description

Author
Nick Rogness nick@.nosp@m.rogn.nosp@m.ess.n.nosp@m.et
Eric Leblond eric@.nosp@m.regi.nosp@m.t.org

IPFW packet acquisition support

Definition in file source-ipfw.c.

Macro Definition Documentation

#define IP_MAXPACKET   65535

Definition at line 49 of file source-ipfw.c.

Referenced by ReceiveIPFWLoop().

#define IPFW_ACCEPT   0

Definition at line 43 of file source-ipfw.c.

Referenced by IPFWSetVerdict().

#define IPFW_DROP   1

Definition at line 44 of file source-ipfw.c.

Referenced by IPFWSetVerdict().

#define IPFW_SOCKET_POLL_MSEC   300

Definition at line 46 of file source-ipfw.c.

Referenced by IPFWSetVerdict(), and ReceiveIPFWLoop().

Typedef Documentation

Structure to hold thread specific variables.

Function Documentation

TmEcode DecodeIPFW ( ThreadVars tv,
Packet p,
void *  data,
PacketQueue pq,
PacketQueue postpq 
)

This function passes off to link type decoders.

Todo:
Unit tests are needed for this module.

DecodeIPFW reads packets from the PacketQueue and passes them off to the proper link type decoder.

Parameters
tvpointer to ThreadVars
ppointer to the current packet
datapointer that gets cast into IPFWThreadVars for ptv
pqpointer to the PacketQueue

Definition at line 442 of file source-ipfw.c.

References DecodeIPV4(), DecodeIPV6(), DecodeUpdatePacketCounters(), Packet_::flags, GET_PKT_DATA, GET_PKT_LEN, ip4h, ip6h, IPV4_GET_RAW_VER, IPV6_GET_RAW_VER, PacketDecodeFinalize(), PKT_PSEUDO_STREAM_END, SCEnter, SCLogDebug, SCLogInfo, SCReturnInt, TM_ECODE_FAILED, TM_ECODE_OK, and unlikely.

Referenced by TmModuleDecodeIPFWRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodeIPFWThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 507 of file source-ipfw.c.

References DecodeThreadVarsFree(), SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleDecodeIPFWRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodeIPFWThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

This function initializes the DecodeThreadVariables.

Parameters
tvpointer to ThreadVars
initdatapointer for passing in args
datapointer that gets cast into IPFWThreadVars for ptv

Definition at line 492 of file source-ipfw.c.

References DecodeRegisterPerfCounters(), DecodeThreadVarsAlloc(), SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleDecodeIPFWRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void * IPFWGetQueue ( int  number)

Get a pointer to the IPFW queue at index.

Parameters
numberidx of the queue in our array
Return values
ptrpointer to the IPFWThreadVars at index
NULLon error

Definition at line 760 of file source-ipfw.c.

Referenced by IPFWSetVerdict(), ReceiveIPFWLoop(), ReceiveIPFWThreadDeinit(), and ReceiveIPFWThreadInit().

Here is the caller graph for this function:

void* IPFWGetThread ( int  number)

Get a pointer to the IPFW thread at index.

This function is temporary used as configuration parser.

Parameters
numberidx of the queue in our array
Return values
ptrpointer to the IPFWThreadVars at index
NULLon error

Definition at line 778 of file source-ipfw.c.

Referenced by RunModeIpsIPFWAutoFp(), and RunModeIpsIPFWWorker().

Here is the caller graph for this function:

int IPFWRegisterQueue ( char *  queue)

Add an IPFW divert.

Parameters
stringwith the queue name
Return values
0on success.
-1on failure.

Definition at line 713 of file source-ipfw.c.

References ByteExtractStringUint16(), IPFWThreadVars_::ipfw_index, IPFW_MAX_QUEUE, LiveRegisterDeviceName(), IPFWQueueVars_::port_num, IPFWThreadVars_::port_num, SC_ERR_INVALID_ARGUMENT, SCLogDebug, SCLogError, SCMutexLock, and SCMutexUnlock.

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode IPFWSetVerdict ( ThreadVars tv,
IPFWThreadVars ptv,
Packet p 
)

This function sets the Verdict and processes the packet.

Parameters
tvpointer to ThreadVars
ppointer to the Packet
Todo:
For divert sockets, dropping means not writing the packet back to the socket. Need to see if there is some better way to free the packet from the queue

Definition at line 521 of file source-ipfw.c.

References IPFWThreadVars_::accepted, ACTION_DROP, IPFWThreadVars_::dropped, GET_PKT_DATA, GET_PKT_LEN, IPFW_ACCEPT, IPFW_DROP, IPFWPacketVars_::ipfw_index, IPFW_SOCKET_POLL_MSEC, Packet_::ipfw_v, IPFWGetQueue(), PACKET_TEST_ACTION, SC_ERR_INVALID_ARGUMENT, SC_WARN_IPFW_XMIT, SCEnter, SCLogDebug, SCLogInfo, SCLogWarning, SCReturnInt, THV_KILL, THV_PAUSE, TM_ECODE_FAILED, TM_ECODE_OK, and TmThreadsCheckFlag().

Referenced by VerdictIPFW().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceiveIPFW ( ThreadVars ,
Packet ,
void *  ,
PacketQueue ,
PacketQueue  
)
TmEcode ReceiveIPFWThreadDeinit ( ThreadVars tv,
void *  data 
)

DeInit function closes divert socket at exit.

Todo:
Unit tests are needed for this module.
Parameters
tvpointer to ThreadVars
datapointer that gets cast into IPFWThreadVars for ptv

Definition at line 414 of file source-ipfw.c.

References IPFWQueueVars_::fd, IPFWThreadVars_::ipfw_index, IPFWGetQueue(), SC_WARN_IPFW_UNBIND, SCEnter, SCLogWarning, SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleReceiveIPFWRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void ReceiveIPFWThreadExitStats ( ThreadVars tv,
void *  data 
)

This function prints stats to the screen at exit.

Todo:
Unit tests are needed for this module.
Parameters
tvpointer to ThreadVars
datapointer that gets cast into IPFWThreadVars for ptv

Definition at line 393 of file source-ipfw.c.

References IPFWThreadVars_::accepted, IPFWThreadVars_::bytes, IPFWThreadVars_::dropped, IPFWThreadVars_::errs, ThreadVars_::name, IPFWThreadVars_::pkts, SCEnter, SCLogNotice, and SCReturn.

Referenced by TmModuleReceiveIPFWRegister().

Here is the caller graph for this function:

TmEcode ReceiveIPFWThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Init function for RecieveIPFW.

This is a setup function for recieving packets via ipfw divert, binds a socket, and prepares to to read from it.

Parameters
tvpointer to ThreadVars
initdatapointer to the divert port passed from the user
datapointer gets populated with IPFWThreadVars

Definition at line 329 of file source-ipfw.c.

References IPFWThreadVars_::datalink, IPFWQueueVars_::fd, IPFWThreadVars_::ipfw_index, IPFWQueueVars_::ipfw_sin, IPFWQueueVars_::ipfw_sinlen, IPFWGetQueue(), IPFWQueueVars_::port_num, SC_ERR_IPFW_BIND, SC_ERR_IPFW_SETSOCKOPT, SC_ERR_IPFW_SOCK, SCEnter, SCLogError, SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleReceiveIPFWRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void TmModuleDecodeIPFWRegister ( void  )
void TmModuleReceiveIPFWRegister ( void  )
void TmModuleVerdictIPFWRegister ( void  )

Registration Function for VerdictIPFW.

Todo:
Unit tests are needed for this module.
Todo:
untested

Definition at line 175 of file source-ipfw.c.

References TmModule_::cap_flags, TmModule_::Func, TmModule_::name, TmModule_::RegisterTests, SC_CAP_NET_ADMIN, SC_CAP_NET_BIND_SERVICE, SC_CAP_NET_RAW, TmModule_::ThreadDeinit, TmModule_::ThreadExitPrintStats, TmModule_::ThreadInit, tmm_modules, TMM_VERDICTIPFW, VerdictIPFW(), VerdictIPFWThreadDeinit(), VerdictIPFWThreadExitStats(), and VerdictIPFWThreadInit().

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode VerdictIPFW ( ThreadVars tv,
Packet p,
void *  data,
PacketQueue pq,
PacketQueue postpq 
)

This function handles the Verdict processing.

Todo:
Unit tests are needed for this module.
Parameters
tvpointer to ThreadVars
ppointer to the Packet
datapointer that gets cast into IPFWThreadVars for ptv
pqpointer for the Packet Queue access (Not used)

Definition at line 616 of file source-ipfw.c.

References Packet_::flags, IPFWSetVerdict(), IS_TUNNEL_PKT, PKT_PSEUDO_STREAM_END, Packet_::root, SCEnter, SCLogDebug, SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleVerdictIPFWRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode VerdictIPFWThreadDeinit ( ThreadVars tv,
void *  data 
)

This function deinitializes the VerdictThread.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into IPFWThreadVars for ptv

Definition at line 681 of file source-ipfw.c.

References SCEnter, SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleVerdictIPFWRegister().

Here is the caller graph for this function:

void VerdictIPFWThreadExitStats ( ThreadVars tv,
void *  data 
)

This function prints stats for the VerdictThread.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into IPFWThreadVars for ptv

Definition at line 699 of file source-ipfw.c.

References IPFWThreadVars_::accepted, IPFWThreadVars_::dropped, ThreadVars_::name, and SCLogInfo.

Referenced by TmModuleVerdictIPFWRegister().

Here is the caller graph for this function:

TmEcode VerdictIPFWThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

This function initializes the VerdictThread.

Parameters
tpointer to ThreadVars
initdatapointer for passing in args
datapointer that gets cast into IPFWThreadVars for ptv

Definition at line 656 of file source-ipfw.c.

References SCEnter, SCMalloc, SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleVerdictIPFWRegister().

Here is the caller graph for this function: