suricata
source-ipfw.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Nick Rogness <nick@rogness.net>
22  * \author Eric Leblond <eric@regit.org>
23  *
24  * IPFW packet acquisition support
25  */
26 
27 #include "suricata-common.h"
28 #include "suricata.h"
29 #include "decode.h"
30 #include "packet.h"
31 #include "packet-queue.h"
32 #include "threads.h"
33 #include "threadvars.h"
34 #include "tm-queuehandlers.h"
35 #include "tm-threads.h"
36 #include "source-ipfw.h"
37 #include "util-debug.h"
38 #include "conf.h"
39 #include "util-byte.h"
40 #include "util-privs.h"
41 #include "util-datalink.h"
42 #include "util-device.h"
43 #include "runmodes.h"
44 
45 #define IPFW_ACCEPT 0
46 #define IPFW_DROP 1
47 
48 #define IPFW_SOCKET_POLL_MSEC 300
49 
50 #ifndef IP_MAXPACKET
51 #define IP_MAXPACKET 65535
52 #endif
53 
54 #ifndef IPFW
55 /* Handle the case if --enable-ipfw was not used
56  *
57  */
58 
59 TmEcode NoIPFWSupportExit(ThreadVars *, const void *, void **);
60 
62 {
63 
64  tmm_modules[TMM_RECEIVEIPFW].name = "ReceiveIPFW";
65  tmm_modules[TMM_RECEIVEIPFW].ThreadInit = NoIPFWSupportExit;
70 }
71 
73 {
74  tmm_modules[TMM_VERDICTIPFW].name = "VerdictIPFW";
75  tmm_modules[TMM_VERDICTIPFW].ThreadInit = NoIPFWSupportExit;
79 }
80 
82 {
83  tmm_modules[TMM_DECODEIPFW].name = "DecodeIPFW";
84  tmm_modules[TMM_DECODEIPFW].ThreadInit = NoIPFWSupportExit;
90 }
91 
92 TmEcode NoIPFWSupportExit(ThreadVars *tv, const void *initdata, void **data)
93 {
94 
95  SCLogError("Error creating thread %s: you do not have support for ipfw "
96  "enabled please recompile with --enable-ipfw",
97  tv->name);
98  exit(EXIT_FAILURE);
99 }
100 
101 #else /* We have IPFW compiled in */
102 
103 #include "action-globals.h"
104 
105 extern uint16_t max_pending_packets;
106 
107 /**
108  * \brief Structure to hold thread specific variables.
109  */
110 typedef struct IPFWThreadVars_
111 {
112  /* data link type for the thread, probably not needed */
113  int datalink;
114 
115  /* this one should be not changing after init */
116  uint16_t port_num;
117  /* position into the NFQ queue var array */
118  uint16_t ipfw_index;
119 
120  /* counters */
121  uint32_t pkts;
122  uint64_t bytes;
123  uint32_t errs;
124  uint32_t accepted;
125  uint32_t dropped;
127 
128 static IPFWThreadVars ipfw_t[IPFW_MAX_QUEUE];
129 static IPFWQueueVars ipfw_q[IPFW_MAX_QUEUE];
130 static uint16_t receive_port_num = 0;
131 static SCMutex ipfw_init_lock;
132 
133 /* IPFW Prototypes */
134 static void *IPFWGetQueue(int number);
135 static TmEcode ReceiveIPFWThreadInit(ThreadVars *, const void *, void **);
136 static TmEcode ReceiveIPFWLoop(ThreadVars *tv, void *data, void *slot);
137 static void ReceiveIPFWThreadExitStats(ThreadVars *, void *);
138 static TmEcode ReceiveIPFWThreadDeinit(ThreadVars *, void *);
139 
140 static TmEcode IPFWSetVerdict(ThreadVars *, IPFWThreadVars *, Packet *);
141 static TmEcode VerdictIPFW(ThreadVars *, Packet *, void *);
142 static TmEcode VerdictIPFWThreadInit(ThreadVars *, const void *, void **);
143 static void VerdictIPFWThreadExitStats(ThreadVars *, void *);
144 static TmEcode VerdictIPFWThreadDeinit(ThreadVars *, void *);
145 
146 static TmEcode DecodeIPFWThreadInit(ThreadVars *, const void *, void **);
147 static TmEcode DecodeIPFWThreadDeinit(ThreadVars *tv, void *data);
148 static TmEcode DecodeIPFW(ThreadVars *, Packet *, void *);
149 
150 /**
151  * \brief Registration Function for RecieveIPFW.
152  * \todo Unit tests are needed for this module.
153  */
155 {
156  SCMutexInit(&ipfw_init_lock, NULL);
157 
158  tmm_modules[TMM_RECEIVEIPFW].name = "ReceiveIPFW";
159  tmm_modules[TMM_RECEIVEIPFW].ThreadInit = ReceiveIPFWThreadInit;
161  tmm_modules[TMM_RECEIVEIPFW].PktAcqLoop = ReceiveIPFWLoop;
163  tmm_modules[TMM_RECEIVEIPFW].ThreadExitPrintStats = ReceiveIPFWThreadExitStats;
164  tmm_modules[TMM_RECEIVEIPFW].ThreadDeinit = ReceiveIPFWThreadDeinit;
167  SC_CAP_NET_BROADCAST; /** \todo untested */
169 }
170 
171 /**
172  * \brief Registration Function for VerdictIPFW.
173  * \todo Unit tests are needed for this module.
174  */
176 {
177  tmm_modules[TMM_VERDICTIPFW].name = "VerdictIPFW";
178  tmm_modules[TMM_VERDICTIPFW].ThreadInit = VerdictIPFWThreadInit;
179  tmm_modules[TMM_VERDICTIPFW].Func = VerdictIPFW;
180  tmm_modules[TMM_VERDICTIPFW].ThreadExitPrintStats = VerdictIPFWThreadExitStats;
181  tmm_modules[TMM_VERDICTIPFW].ThreadDeinit = VerdictIPFWThreadDeinit;
183  SC_CAP_NET_BIND_SERVICE; /** \todo untested */
184 }
185 
186 /**
187  * \brief Registration Function for DecodeIPFW.
188  * \todo Unit tests are needed for this module.
189  */
191 {
192  tmm_modules[TMM_DECODEIPFW].name = "DecodeIPFW";
193  tmm_modules[TMM_DECODEIPFW].ThreadInit = DecodeIPFWThreadInit;
194  tmm_modules[TMM_DECODEIPFW].Func = DecodeIPFW;
196  tmm_modules[TMM_DECODEIPFW].ThreadDeinit = DecodeIPFWThreadDeinit;
198 }
199 
200 static inline void IPFWMutexInit(IPFWQueueVars *nq)
201 {
202  char *active_runmode = RunmodeGetActive();
203 
204  if (active_runmode && !strcmp("workers", active_runmode)) {
205  nq->use_mutex = 0;
206  SCLogInfo("IPFW running in 'workers' runmode, will not use mutex.");
207  } else {
208  nq->use_mutex = 1;
209  }
210  if (nq->use_mutex)
211  SCMutexInit(&nq->socket_lock, NULL);
212 }
213 
214 static inline void IPFWMutexLock(IPFWQueueVars *nq)
215 {
216  if (nq->use_mutex)
217  SCMutexLock(&nq->socket_lock);
218 }
219 
220 static inline void IPFWMutexUnlock(IPFWQueueVars *nq)
221 {
222  if (nq->use_mutex)
224 }
225 
226 TmEcode ReceiveIPFWLoop(ThreadVars *tv, void *data, void *slot)
227 {
228  SCEnter();
229 
230  IPFWThreadVars *ptv = (IPFWThreadVars *)data;
231  IPFWQueueVars *nq = NULL;
232  uint8_t pkt[IP_MAXPACKET];
233  int pktlen=0;
234  struct pollfd IPFWpoll;
235  struct timeval IPFWts;
236  Packet *p = NULL;
237 
238  nq = IPFWGetQueue(ptv->ipfw_index);
239  if (nq == NULL) {
240  SCLogWarning("Can't get thread variable");
242  }
243 
244  SCLogInfo("Thread '%s' will run on port %d (item %d)",
245  tv->name, nq->port_num, ptv->ipfw_index);
246 
247  // Indicate that the thread is actually running its application level code (i.e., it can poll
248  // packets)
250 
251  while (1) {
252  if (unlikely(suricata_ctl_flags != 0)) {
254  }
255 
256  IPFWpoll.fd = nq->fd;
257  IPFWpoll.events = POLLRDNORM;
258  /* Poll the socket for status */
259  if ( (poll(&IPFWpoll, 1, IPFW_SOCKET_POLL_MSEC)) > 0) {
260  if (!(IPFWpoll.revents & (POLLRDNORM | POLLERR)))
261  continue;
262  }
263 
264  if ((pktlen = recvfrom(nq->fd, pkt, sizeof(pkt), 0,
265  (struct sockaddr *)&nq->ipfw_sin,
266  &nq->ipfw_sinlen)) == -1) {
267  /* We received an error on socket read */
268  if (errno == EINTR || errno == EWOULDBLOCK) {
269  /* Nothing for us to process */
270  continue;
271  } else {
272  SCLogWarning("Read from IPFW divert socket failed: %s", strerror(errno));
274  }
275  }
276  /* We have a packet to process */
277  memset (&IPFWts, 0, sizeof(struct timeval));
278  gettimeofday(&IPFWts, NULL);
279 
280  /* make sure we have at least one packet in the packet pool, to prevent
281  * us from alloc'ing packets at line rate */
282  PacketPoolWait();
283 
285  if (p == NULL) {
287  }
289 
290  SCLogDebug("Received Packet Len: %d", pktlen);
291 
292  p->ts = SCTIME_FROM_TIMEVAL(&IPFWts);
293 
294  ptv->pkts++;
295  ptv->bytes += pktlen;
296 
297  p->datalink = ptv->datalink;
298 
299  p->ipfw_v.ipfw_index = ptv->ipfw_index;
300 
301  PacketCopyData(p, pkt, pktlen);
302  SCLogDebug("Packet info: pkt_len: %" PRIu32 " (pkt %02x, pkt_data %02x)",
303  GET_PKT_LEN(p), *pkt, *(GET_PKT_DATA(p)));
304 
305  if (TmThreadsSlotProcessPkt(tv, ((TmSlot *) slot)->slot_next, p)
306  != TM_ECODE_OK) {
308  }
309 
311  }
312 
314 }
315 
316 /**
317  * \brief Init function for RecieveIPFW.
318  *
319  * This is a setup function for receiving packets
320  * via ipfw divert, binds a socket, and prepares to
321  * to read from it.
322  *
323  * \param tv pointer to ThreadVars
324  * \param initdata pointer to the divert port passed from the user
325  * \param data pointer gets populated with IPFWThreadVars
326  *
327  */
328 TmEcode ReceiveIPFWThreadInit(ThreadVars *tv, const void *initdata, void **data)
329 {
330  struct timeval timev;
331  IPFWThreadVars *ntv = (IPFWThreadVars *) initdata;
332  IPFWQueueVars *nq = IPFWGetQueue(ntv->ipfw_index);
333 
334  sigset_t sigs;
335  sigfillset(&sigs);
336  pthread_sigmask(SIG_UNBLOCK, &sigs, NULL);
337 
338  SCEnter();
339 
340  IPFWMutexInit(nq);
341  /* We need a divert socket to play with */
342 #ifdef PF_DIVERT
343  if ((nq->fd = socket(PF_DIVERT, SOCK_RAW, 0)) == -1) {
344 #else
345  if ((nq->fd = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) == -1) {
346 #endif
347  SCLogError("Can't create divert socket: %s", strerror(errno));
349  }
350 
351  /* set a timeout to the socket so we can check for a signal
352  * in case we don't get packets for a longer period. */
353  timev.tv_sec = 1;
354  timev.tv_usec = 0;
355 
356  if (setsockopt(nq->fd, SOL_SOCKET, SO_RCVTIMEO, &timev, sizeof(timev)) == -1) {
357  SCLogError("Can't set IPFW divert socket timeout: %s", strerror(errno));
359  }
360 
361  nq->ipfw_sinlen=sizeof(nq->ipfw_sin);
362  memset(&nq->ipfw_sin, 0, nq->ipfw_sinlen);
363  nq->ipfw_sin.sin_family = PF_INET;
364  nq->ipfw_sin.sin_addr.s_addr = INADDR_ANY;
365  nq->ipfw_sin.sin_port = htons(nq->port_num);
366 
367  /* Bind that SOB */
368  if (bind(nq->fd, (struct sockaddr *)&nq->ipfw_sin, nq->ipfw_sinlen) == -1) {
369  SCLogError("Can't bind divert socket on port %d: %s", nq->port_num, strerror(errno));
371  }
372 
373  ntv->datalink = DLT_RAW;
375 
376  *data = (void *)ntv;
377 
379 }
380 
381 /**
382  * \brief This function prints stats to the screen at exit.
383  * \todo Unit tests are needed for this module.
384  * \param tv pointer to ThreadVars
385  * \param data pointer that gets cast into IPFWThreadVars for ptv
386  */
387 void ReceiveIPFWThreadExitStats(ThreadVars *tv, void *data)
388 {
389  IPFWThreadVars *ptv = (IPFWThreadVars *)data;
390 
391  SCEnter();
392 
393  SCLogNotice("(%s) Treated: Pkts %" PRIu32 ", Bytes %" PRIu64 ", Errors %" PRIu32 "",
394  tv->name, ptv->pkts, ptv->bytes, ptv->errs);
395  SCLogNotice("(%s) Verdict: Accepted %"PRIu32", Dropped %"PRIu32 "",
396  tv->name, ptv->accepted, ptv->dropped);
397 
398 
399  SCReturn;
400 }
401 
402 /**
403  * \brief DeInit function closes divert socket at exit.
404  * \todo Unit tests are needed for this module.
405  * \param tv pointer to ThreadVars
406  * \param data pointer that gets cast into IPFWThreadVars for ptv
407  */
408 TmEcode ReceiveIPFWThreadDeinit(ThreadVars *tv, void *data)
409 {
410  IPFWThreadVars *ptv = (IPFWThreadVars *)data;
411  IPFWQueueVars *nq = IPFWGetQueue(ptv->ipfw_index);
412 
413  SCEnter();
414 
415  if (close(nq->fd) < 0) {
416  SCLogWarning("Unable to disable ipfw socket: %s", strerror(errno));
418  }
419 
421 }
422 
423 /**
424  * \brief This function passes off to link type decoders.
425  * \todo Unit tests are needed for this module.
426  *
427  * DecodeIPFW decodes packets from IPFW and passes
428  * them off to the proper link type decoder.
429  *
430  * \param tv pointer to ThreadVars
431  * \param p pointer to the current packet
432  * \param data pointer that gets cast into IPFWThreadVars for ptv
433  */
434 TmEcode DecodeIPFW(ThreadVars *tv, Packet *p, void *data)
435 {
436  IPV4Hdr *ip4h = (IPV4Hdr *)GET_PKT_DATA(p);
437  IPV6Hdr *ip6h = (IPV6Hdr *)GET_PKT_DATA(p);
439 
440  SCEnter();
441 
443 
444  /* update counters */
446 
447  /* Process IP packets */
448  if (IPV4_GET_RAW_VER(ip4h) == 4) {
449  if (unlikely(GET_PKT_LEN(p) > USHRT_MAX)) {
450  return TM_ECODE_FAILED;
451  }
452  SCLogDebug("DecodeIPFW ip4 processing");
454 
455  } else if(IPV6_GET_RAW_VER(ip6h) == 6) {
456  if (unlikely(GET_PKT_LEN(p) > USHRT_MAX)) {
457  return TM_ECODE_FAILED;
458  }
459  SCLogDebug("DecodeIPFW ip6 processing");
461 
462  } else {
463  /* We don't support anything besides IP packets for now, bridged packets? */
464  SCLogInfo("IPFW unknown protocol support %02x", *GET_PKT_DATA(p));
466  }
467 
469 
471 }
472 
473 /**
474  * \brief This function initializes the DecodeThreadVariables
475  *
476  *
477  * \param tv pointer to ThreadVars
478  * \param initdata pointer for passing in args
479  * \param data pointer that gets cast into IPFWThreadVars for ptv
480  */
481 TmEcode DecodeIPFWThreadInit(ThreadVars *tv, const void *initdata, void **data)
482 {
483  DecodeThreadVars *dtv = NULL;
485 
486  if (dtv == NULL)
488 
490 
491  *data = (void *)dtv;
492 
494 }
495 
496 TmEcode DecodeIPFWThreadDeinit(ThreadVars *tv, void *data)
497 {
498  if (data != NULL)
499  DecodeThreadVarsFree(tv, data);
501 }
502 
503 /**
504  * \brief This function sets the Verdict and processes the packet
505  *
506  *
507  * \param tv pointer to ThreadVars
508  * \param p pointer to the Packet
509  */
510 TmEcode IPFWSetVerdict(ThreadVars *tv, IPFWThreadVars *ptv, Packet *p)
511 {
512  uint32_t verdict;
513 #if 0
514  struct pollfd IPFWpoll;
515 #endif
516  IPFWQueueVars *nq = NULL;
517 
518  SCEnter();
519 
520  if (p == NULL) {
521  SCLogWarning("Packet is NULL");
523  }
524 
525  nq = IPFWGetQueue(p->ipfw_v.ipfw_index);
526  if (nq == NULL) {
527  SCLogWarning("No thread found");
529  }
530 
531 #if 0
532  IPFWpoll.fd = nq->fd;
533  IPFWpoll.events = POLLWRNORM;
534 #endif
535 
536  if (PacketCheckAction(p, ACTION_DROP)) {
537  verdict = IPFW_DROP;
538  } else {
539  verdict = IPFW_ACCEPT;
540  }
541 
542  if (verdict == IPFW_ACCEPT) {
543  SCLogDebug("IPFW Verdict is to Accept");
544  ptv->accepted++;
545 
546  /* For divert sockets, accepting means writing the
547  * packet back to the socket for ipfw to pick up
548  */
549  SCLogDebug("IPFWSetVerdict writing to socket %d, %p, %u", nq->fd, GET_PKT_DATA(p),GET_PKT_LEN(p));
550 
551 #if 0
552  while ((poll(&IPFWpoll,1,IPFW_SOCKET_POLL_MSEC)) < 1) {
553  /* Did we receive a signal to shutdown */
555  SCLogInfo("Received ThreadShutdown: IPFW divert socket writing interrupted");
557  }
558  }
559 #endif
560 
561  IPFWMutexLock(nq);
562  if (sendto(nq->fd, GET_PKT_DATA(p), GET_PKT_LEN(p), 0,(struct sockaddr *)&nq->ipfw_sin, nq->ipfw_sinlen) == -1) {
563  int r = errno;
564  switch (r) {
565  default:
566  SCLogWarning("Write to ipfw divert socket failed: %s", strerror(r));
567  IPFWMutexUnlock(nq);
569  case EHOSTDOWN:
570  case ENETDOWN:
571  break;
572  }
573  }
574 
575  IPFWMutexUnlock(nq);
576 
577  SCLogDebug("Sent Packet back into IPFW Len: %d",GET_PKT_LEN(p));
578 
579  } /* end IPFW_ACCEPT */
580 
581 
582  if (verdict == IPFW_DROP) {
583  SCLogDebug("IPFW SetVerdict is to DROP");
584  ptv->dropped++;
585 
586  /** \todo For divert sockets, dropping means not writing the packet back to the socket.
587  * Need to see if there is some better way to free the packet from the queue */
588 
589  } /* end IPFW_DROP */
590 
592 }
593 
594 
595 /**
596  * \brief This function handles the Verdict processing
597  * \todo Unit tests are needed for this module.
598  *
599  *
600  * \param tv pointer to ThreadVars
601  * \param p pointer to the Packet
602  * \param data pointer that gets cast into IPFWThreadVars for ptv
603  */
604 TmEcode VerdictIPFW(ThreadVars *tv, Packet *p, void *data)
605 {
606  IPFWThreadVars *ptv = (IPFWThreadVars *)data;
607  TmEcode retval = TM_ECODE_OK;
608 
609  SCEnter();
610 
611  /* can't verdict a "fake" packet */
612  if (p->flags & PKT_PSEUDO_STREAM_END) {
614  }
615 
616  /* This came from NFQ.
617  * if this is a tunnel packet we check if we are ready to verdict
618  * already. */
619  if (IS_TUNNEL_PKT(p)) {
620  bool verdict = VerdictTunnelPacket(p);
621 
622  /* don't verdict if we are not ready */
623  if (verdict == true) {
624  SCLogDebug("Setting verdict on tunnel");
625  retval = IPFWSetVerdict(tv, ptv, p->root ? p->root : p);
626  }
627  } else {
628  /* no tunnel, verdict normally */
629  SCLogDebug("Setting verdict on non-tunnel");
630  retval = IPFWSetVerdict(tv, ptv, p);
631  } /* IS_TUNNEL_PKT end */
632 
633  SCReturnInt(retval);
634 }
635 
636 /**
637  * \brief This function initializes the VerdictThread
638  *
639  *
640  * \param t pointer to ThreadVars
641  * \param initdata pointer for passing in args
642  * \param data pointer that gets cast into IPFWThreadVars for ptv
643  */
644 TmEcode VerdictIPFWThreadInit(ThreadVars *tv, const void *initdata, void **data)
645 {
646 
647  IPFWThreadVars *ptv = NULL;
648 
649  SCEnter();
650 
651  /* Setup Thread vars */
652  if ((ptv = SCCalloc(1, sizeof(IPFWThreadVars))) == NULL)
654 
655  *data = (void *)ptv;
656 
658 }
659 
660 /**
661  * \brief This function deinitializes the VerdictThread
662  *
663  *
664  * \param tv pointer to ThreadVars
665  * \param data pointer that gets cast into IPFWThreadVars for ptv
666  */
667 TmEcode VerdictIPFWThreadDeinit(ThreadVars *tv, void *data)
668 {
669 
670  SCEnter();
671 
672  /* We don't need to do anything...not sure quite yet */
673 
674 
676 }
677 
678 /**
679  * \brief This function prints stats for the VerdictThread
680  *
681  *
682  * \param tv pointer to ThreadVars
683  * \param data pointer that gets cast into IPFWThreadVars for ptv
684  */
685 void VerdictIPFWThreadExitStats(ThreadVars *tv, void *data)
686 {
687  IPFWThreadVars *ptv = (IPFWThreadVars *)data;
688  SCLogInfo("IPFW Processing: - (%s) Pkts accepted %" PRIu32 ", dropped %" PRIu32 "", tv->name, ptv->accepted, ptv->dropped);
689 }
690 
691 /**
692  * \brief Add an IPFW divert
693  *
694  * \param string with the queue name
695  *
696  * \retval 0 on success.
697  * \retval -1 on failure.
698  */
699 int IPFWRegisterQueue(char *queue)
700 {
701  IPFWThreadVars *ntv = NULL;
702  IPFWQueueVars *nq = NULL;
703  /* Extract the queue number from the specified command line argument */
704  uint16_t port_num = 0;
705  if ((StringParseUint16(&port_num, 10, strlen(queue), queue)) < 0)
706  {
707  SCLogError("specified queue number %s is not "
708  "valid",
709  queue);
710  return -1;
711  }
712 
713  SCMutexLock(&ipfw_init_lock);
714  if (receive_port_num >= IPFW_MAX_QUEUE) {
715  SCLogError("too much IPFW divert port registered (%d)", receive_port_num);
716  SCMutexUnlock(&ipfw_init_lock);
717  return -1;
718  }
719  if (receive_port_num == 0) {
720  memset(&ipfw_t, 0, sizeof(ipfw_t));
721  memset(&ipfw_q, 0, sizeof(ipfw_q));
722  }
723 
724  ntv = &ipfw_t[receive_port_num];
725  ntv->ipfw_index = receive_port_num;
726 
727  nq = &ipfw_q[receive_port_num];
728  nq->port_num = port_num;
729  receive_port_num++;
730  SCMutexUnlock(&ipfw_init_lock);
731  LiveRegisterDeviceName(queue);
732 
733  SCLogDebug("Queue \"%s\" registered.", queue);
734  return 0;
735 }
736 
737 /**
738  * \brief Get a pointer to the IPFW queue at index
739  *
740  * \param number idx of the queue in our array
741  *
742  * \retval ptr pointer to the IPFWThreadVars at index
743  * \retval NULL on error
744  */
745 void *IPFWGetQueue(int number)
746 {
747  if (number >= receive_port_num)
748  return NULL;
749 
750  return (void *)&ipfw_q[number];
751 }
752 
753 /**
754  * \brief Get a pointer to the IPFW thread at index
755  *
756  * This function is temporary used as configuration parser.
757  *
758  * \param number idx of the queue in our array
759  *
760  * \retval ptr pointer to the IPFWThreadVars at index
761  * \retval NULL on error
762  */
763 void *IPFWGetThread(int number)
764 {
765  if (number >= receive_port_num)
766  return NULL;
767 
768  return (void *)&ipfw_t[number];
769 }
770 
771 #endif /* End ifdef IPFW */
772 
773 /* eof */
774 
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:73
PacketCheckAction
bool PacketCheckAction(const Packet *p, const uint8_t a)
Definition: packet.c:48
util-byte.h
tm-threads.h
max_pending_packets
uint16_t max_pending_packets
Definition: suricata.c:187
TmModuleReceiveIPFWRegister
void TmModuleReceiveIPFWRegister(void)
Registration Function for RecieveIPFW.
Definition: source-ipfw.c:154
IPFWQueueVars_::socket_lock
SCMutex socket_lock
Definition: source-ipfw.h:39
IPV6_GET_RAW_VER
#define IPV6_GET_RAW_VER(ip6h)
Definition: decode-ipv6.h:62
ThreadVars_::name
char name[16]
Definition: threadvars.h:64
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:292
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1058
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
IPFWThreadVars_::dropped
uint32_t dropped
Definition: source-ipfw.c:125
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
TmThreadsSetFlag
void TmThreadsSetFlag(ThreadVars *tv, uint32_t flag)
Set a thread flag.
Definition: tm-threads.c:99
action-globals.h
Packet_::flags
uint32_t flags
Definition: decode.h:467
threads.h
StringParseUint16
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:337
THV_RUNNING
#define THV_RUNNING
Definition: threadvars.h:54
Packet_::ipfw_v
IPFWPacketVars ipfw_v
Definition: decode.h:486
packet-queue.h
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
util-privs.h
SC_CAP_NET_BROADCAST
#define SC_CAP_NET_BROADCAST
Definition: util-privs.h:34
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:147
RunmodeGetActive
char * RunmodeGetActive(void)
Definition: runmodes.c:217
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
IPFW_MAX_QUEUE
#define IPFW_MAX_QUEUE
Definition: source-ipfw.h:28
THV_PAUSE
#define THV_PAUSE
Definition: threadvars.h:37
IPFW_DROP
#define IPFW_DROP
Definition: source-ipfw.c:46
TmModule_::PktAcqLoop
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
Definition: tm-modules.h:54
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1061
DLT_RAW
#define DLT_RAW
Definition: decode.h:963
SC_CAP_NET_BIND_SERVICE
#define SC_CAP_NET_BIND_SERVICE
Definition: util-privs.h:33
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:525
IPFWThreadVars_::accepted
uint32_t accepted
Definition: source-ipfw.c:124
decode.h
util-device.h
util-debug.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:54
TmModule_::PktAcqBreakLoop
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
Definition: tm-modules.h:57
IPFWQueueVars_::fd
int fd
Definition: source-ipfw.h:38
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
PKT_PSEUDO_STREAM_END
#define PKT_PSEUDO_STREAM_END
Definition: decode.h:1007
TmModuleVerdictIPFWRegister
void TmModuleVerdictIPFWRegister(void)
Registration Function for VerdictIPFW.
Definition: source-ipfw.c:175
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:220
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
SCTIME_FROM_TIMEVAL
#define SCTIME_FROM_TIMEVAL(tv)
Definition: util-time.h:79
IPFWThreadVars_::errs
uint32_t errs
Definition: source-ipfw.c:123
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:52
THV_KILL
#define THV_KILL
Definition: threadvars.h:39
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
SC_CAP_NET_ADMIN
#define SC_CAP_NET_ADMIN
Definition: util-privs.h:31
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
IPFWRegisterQueue
int IPFWRegisterQueue(char *queue)
Add an IPFW divert.
Definition: source-ipfw.c:699
IPFWQueueVars_::ipfw_sin
struct sockaddr_in ipfw_sin
Definition: source-ipfw.h:45
PacketPoolWait
void PacketPoolWait(void)
Definition: tmqh-packetpool.c:80
SCReturn
#define SCReturn
Definition: util-debug.h:273
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:430
TM_FLAG_DECODE_TM
#define TM_FLAG_DECODE_TM
Definition: tm-modules.h:32
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:564
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:219
conf.h
source-ipfw.h
IPV4_GET_RAW_VER
#define IPV4_GET_RAW_VER(ip4h)
Definition: decode-ipv4.h:95
TmSlot_
Definition: tm-threads.h:53
TmEcode
TmEcode
Definition: tm-threads-common.h:83
IS_TUNNEL_PKT
#define IS_TUNNEL_PKT(p)
Definition: decode.h:799
IPFWThreadVars_::ipfw_index
uint16_t ipfw_index
Definition: source-ipfw.c:118
IPFWThreadVars
struct IPFWThreadVars_ IPFWThreadVars
Structure to hold thread specific variables.
TmModule_::name
const char * name
Definition: tm-modules.h:44
runmodes.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
SCMutexInit
#define SCMutexInit(mut, mutattrs)
Definition: threads-debug.h:116
TM_FLAG_RECEIVE_TM
#define TM_FLAG_RECEIVE_TM
Definition: tm-modules.h:31
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
IP_MAXPACKET
#define IP_MAXPACKET
Definition: source-ipfw.c:51
IPV4Hdr_
Definition: decode-ipv4.h:72
tm-queuehandlers.h
IPFWQueueVars_::use_mutex
uint8_t use_mutex
Definition: source-ipfw.h:40
IPFWThreadVars_
Structure to hold thread specific variables.
Definition: source-ipfw.c:111
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:706
IPFW_SOCKET_POLL_MSEC
#define IPFW_SOCKET_POLL_MSEC
Definition: source-ipfw.c:48
suricata-common.h
IPFWGetThread
void * IPFWGetThread(int number)
Get a pointer to the IPFW thread at index.
Definition: source-ipfw.c:763
IPFW_ACCEPT
#define IPFW_ACCEPT
Definition: source-ipfw.c:45
packet.h
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
IPFWThreadVars_::pkts
uint32_t pkts
Definition: source-ipfw.c:121
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
IPFWThreadVars_::datalink
int datalink
Definition: source-ipfw.c:113
TMM_RECEIVEIPFW
@ TMM_RECEIVEIPFW
Definition: tm-threads-common.h:49
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
TMM_VERDICTIPFW
@ TMM_VERDICTIPFW
Definition: tm-threads-common.h:48
TmModule_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:48
threadvars.h
TmModuleDecodeIPFWRegister
void TmModuleDecodeIPFWRegister(void)
Registration Function for DecodeIPFW.
Definition: source-ipfw.c:190
Packet_::root
struct Packet_ * root
Definition: decode.h:622
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
IPFWQueueVars_::port_num
uint16_t port_num
Definition: source-ipfw.h:42
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:673
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:688
IPFWQueueVars_::ipfw_sinlen
socklen_t ipfw_sinlen
Definition: source-ipfw.h:46
IPFWThreadVars_::bytes
uint64_t bytes
Definition: source-ipfw.c:122
suricata.h
IPFWPacketVars_::ipfw_index
int ipfw_index
Definition: source-ipfw.h:33
TMM_DECODEIPFW
@ TMM_DECODEIPFW
Definition: tm-threads-common.h:47
IPFWQueueVars_
Definition: source-ipfw.h:37
StatsSyncCountersIfSignalled
void StatsSyncCountersIfSignalled(ThreadVars *tv)
Definition: counters.c:461
LiveRegisterDeviceName
int LiveRegisterDeviceName(const char *dev)
Add a device for monitoring.
Definition: util-device.c:97
TmThreadsCheckFlag
int TmThreadsCheckFlag(ThreadVars *tv, uint32_t flag)
Check if a thread flag is set.
Definition: tm-threads.c:91
DecodeIPV4
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv4.c:520
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:237
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
SCMutex
#define SCMutex
Definition: threads-debug.h:114
IPFWThreadVars_::port_num
uint16_t port_num
Definition: source-ipfw.c:116
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:208
SC_CAP_NET_RAW
#define SC_CAP_NET_RAW
Definition: util-privs.h:32
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:76
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:654
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:173