Go to the documentation of this file.
87 SCLogError(
"Error creating thread %s: you do not have support for ipfw "
88 "enabled please recompile with --enable-ipfw",
100 #define IPFW_SOCKET_POLL_MSEC 300
127 static uint16_t receive_port_num = 0;
131 static void *IPFWGetQueue(
int number);
134 static void ReceiveIPFWThreadExitStats(
ThreadVars *,
void *);
140 static void VerdictIPFWThreadExitStats(
ThreadVars *,
void *);
202 if (active_runmode && !strcmp(
"workers", active_runmode)) {
204 SCLogInfo(
"IPFW running in 'workers' runmode, will not use mutex.");
225 #define IP_MAXPACKET 65535
236 struct pollfd IPFWpoll;
237 struct timeval IPFWts;
246 SCLogInfo(
"Thread '%s' will run on port %d (item %d)",
258 IPFWpoll.fd = nq->
fd;
259 IPFWpoll.events = POLLRDNORM;
262 if (!(IPFWpoll.revents & (POLLRDNORM | POLLERR)))
266 if ((pktlen = recvfrom(nq->
fd, pkt,
sizeof(pkt), 0,
270 if (errno == EINTR || errno == EWOULDBLOCK) {
274 SCLogWarning(
"Read from IPFW divert socket failed: %s", strerror(errno));
279 memset (&IPFWts, 0,
sizeof(
struct timeval));
280 gettimeofday(&IPFWts, NULL);
292 SCLogDebug(
"Received Packet Len: %d", pktlen);
297 ptv->
bytes += pktlen;
304 SCLogDebug(
"Packet info: pkt_len: %" PRIu32
" (pkt %02x, pkt_data %02x)",
307 if (TmThreadsSlotProcessPkt(
tv, ((
TmSlot *) slot)->slot_next, p)
332 struct timeval timev;
338 pthread_sigmask(SIG_UNBLOCK, &sigs, NULL);
345 if ((nq->
fd = socket(PF_DIVERT, SOCK_RAW, 0)) == -1) {
347 if ((nq->
fd = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) == -1) {
349 SCLogError(
"Can't create divert socket: %s", strerror(errno));
358 if (setsockopt(nq->
fd, SOL_SOCKET, SO_RCVTIMEO, &timev,
sizeof(timev)) == -1) {
359 SCLogError(
"Can't set IPFW divert socket timeout: %s", strerror(errno));
366 nq->
ipfw_sin.sin_addr.s_addr = INADDR_ANY;
389 void ReceiveIPFWThreadExitStats(
ThreadVars *
tv,
void *data)
395 SCLogNotice(
"(%s) Treated: Pkts %" PRIu32
", Bytes %" PRIu64
", Errors %" PRIu32
"",
397 SCLogNotice(
"(%s) Verdict: Accepted %"PRIu32
", Dropped %"PRIu32
"",
417 if (close(nq->
fd) < 0) {
418 SCLogWarning(
"Unable to disable ipfw socket: %s", strerror(errno));
516 struct pollfd IPFWpoll;
534 IPFWpoll.fd = nq->fd;
535 IPFWpoll.events = POLLWRNORM;
557 SCLogInfo(
"Received ThreadShutdown: IPFW divert socket writing interrupted");
564 if (sendto(nq->fd,
GET_PKT_DATA(p),
GET_PKT_LEN(p), 0,(
struct sockaddr *)&nq->ipfw_sin, nq->ipfw_sinlen) == -1) {
568 SCLogWarning(
"Write to ipfw divert socket failed: %s", strerror(r));
620 if (PacketIsTunnel(p)) {
621 bool verdict = VerdictTunnelPacket(p);
626 retval = IPFWSetVerdict(
tv, ptv, p->
root ? p->
root : p);
631 retval = IPFWSetVerdict(
tv, ptv, p);
686 void VerdictIPFWThreadExitStats(
ThreadVars *
tv,
void *data)
705 uint16_t port_num = 0;
708 SCLogError(
"specified queue number %s is not "
716 SCLogError(
"too much IPFW divert port registered (%d)", receive_port_num);
720 if (receive_port_num == 0) {
721 memset(&ipfw_t, 0,
sizeof(ipfw_t));
722 memset(&ipfw_q, 0,
sizeof(ipfw_q));
725 ntv = &ipfw_t[receive_port_num];
728 nq = &ipfw_q[receive_port_num];
734 SCLogDebug(
"Queue \"%s\" registered.", queue);
746 void *IPFWGetQueue(
int number)
748 if (number >= receive_port_num)
751 return (
void *)&ipfw_q[number];
766 if (number >= receive_port_num)
769 return (
void *)&ipfw_t[number];
bool PacketCheckAction(const Packet *p, const uint8_t a)
void TmModuleReceiveIPFWRegister(void)
Registration Function for RecieveIPFW.
#define IPV6_GET_RAW_VER(ip6h)
#define TM_FLAG_VERDICT_TM
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
void TmThreadsSetFlag(ThreadVars *tv, uint32_t flag)
Set a thread flag.
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
#define SC_CAP_NET_BROADCAST
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
char * RunmodeGetActive(void)
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
#define PKT_SET_SRC(p, src_val)
#define SC_CAP_NET_BIND_SERVICE
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
#define SCMutexUnlock(mut)
#define PKT_PSEUDO_STREAM_END
void TmModuleVerdictIPFWRegister(void)
Registration Function for VerdictIPFW.
Per thread variable structure.
#define SCTIME_FROM_TIMEVAL(tv)
TmEcode(* Func)(ThreadVars *, Packet *, void *)
#define SCLogWarning(...)
Macro used to log WARNING messages.
int IPFWRegisterQueue(char *queue)
Add an IPFW divert.
struct sockaddr_in ipfw_sin
void PacketPoolWait(void)
#define TM_FLAG_DECODE_TM
TmModule tmm_modules[TMM_SIZE]
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
#define IPV4_GET_RAW_VER(ip4h)
uint32_t max_pending_packets
struct IPFWThreadVars_ IPFWThreadVars
Structure to hold thread specific variables.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define SCMutexInit(mut, mutattrs)
#define TM_FLAG_RECEIVE_TM
Structure to hold thread specific variables.
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
#define IPFW_SOCKET_POLL_MSEC
void * IPFWGetThread(int number)
Get a pointer to the IPFW thread at index.
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
void(* ThreadExitPrintStats)(ThreadVars *, void *)
void TmModuleDecodeIPFWRegister(void)
Registration Function for DecodeIPFW.
#define SCLogError(...)
Macro used to log ERROR messages.
void DatalinkSetGlobalType(int datalink)
Structure to hold thread specific data for all decode modules.
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
void StatsSyncCountersIfSignalled(ThreadVars *tv)
int LiveRegisterDeviceName(const char *dev)
Add a device for monitoring.
int TmThreadsCheckFlag(ThreadVars *tv, uint32_t flag)
Check if a thread flag is set.
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
volatile uint8_t suricata_ctl_flags