suricata
source-nflog.c
Go to the documentation of this file.
1 /* Copyright (C) 2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Giuseppe Longo <giuseppelng@gmail.com>
22  *
23  * Netfilter's netfilter_log support
24  */
25 #include "suricata-common.h"
26 #include "suricata.h"
27 #include "decode.h"
28 #include "packet-queue.h"
29 
30 #include "threads.h"
31 #include "threadvars.h"
32 #include "tm-threads.h"
33 #include "tm-modules.h"
34 #include "tm-queuehandlers.h"
35 #include "tmqh-packetpool.h"
36 
37 #include "runmodes.h"
38 #include "util-error.h"
39 #include "util-device.h"
40 
41 #ifndef HAVE_NFLOG
42 /** Handle the case where no NFLOG support is compiled in.
43  *
44  */
45 
46 TmEcode NoNFLOGSupportExit(ThreadVars *, const void *, void **);
47 
49 {
50  tmm_modules[TMM_RECEIVENFLOG].name = "ReceiveNFLOG";
52 }
53 
55 {
56  tmm_modules[TMM_DECODENFLOG].name = "DecodeNFLOG";
58 }
59 
60 TmEcode NoNFLOGSupportExit(ThreadVars *tv, const void *initdata, void **data)
61 {
62  SCLogError(SC_ERR_NFLOG_NOSUPPORT,"Error creating thread %s: you do not have support for nflog "
63  "enabled please recompile with --enable-nflog", tv->name);
64  exit(EXIT_FAILURE);
65 }
66 
67 #else /* implied we do have NFLOG support */
68 
69 #include "source-nflog.h"
70 
71 TmEcode ReceiveNFLOGThreadInit(ThreadVars *, const void *, void **);
72 TmEcode ReceiveNFLOGThreadDeinit(ThreadVars *, void *);
73 TmEcode ReceiveNFLOGLoop(ThreadVars *, void *, void *);
74 void ReceiveNFLOGThreadExitStats(ThreadVars *, void *);
75 
76 TmEcode DecodeNFLOGThreadInit(ThreadVars *, const void *, void **);
77 TmEcode DecodeNFLOGThreadDeinit(ThreadVars *tv, void *data);
78 TmEcode DecodeNFLOG(ThreadVars *, Packet *, void *);
79 
80 static int runmode_workers;
81 
82 /* Structure to hold thread specific variables */
83 typedef struct NFLOGThreadVars_ {
84  ThreadVars *tv;
85  TmSlot *slot;
86 
87  char *data;
88  int datalen;
89 
90  uint16_t group;
91  uint32_t nlbufsiz;
92  uint32_t nlbufsiz_max;
93  uint32_t qthreshold;
94  uint32_t qtimeout;
95 
96  struct nflog_handle *h;
97  struct nflog_g_handle *gh;
98 
99  LiveDevice *livedev;
100  int nful_overrun_warned;
101 
102  /* counters */
103  uint32_t pkts;
104  uint64_t bytes;
105  uint32_t errs;
106 
107  uint16_t capture_kernel_packets;
108  uint16_t capture_kernel_drops;
109 } NFLOGThreadVars;
110 
111 /**
112  * \brief Registration function for ReceiveNFLOG
113  */
115 {
116  tmm_modules[TMM_RECEIVENFLOG].name = "ReceiveNFLOG";
117  tmm_modules[TMM_RECEIVENFLOG].ThreadInit = ReceiveNFLOGThreadInit;
119  tmm_modules[TMM_RECEIVENFLOG].PktAcqLoop = ReceiveNFLOGLoop;
121  tmm_modules[TMM_RECEIVENFLOG].ThreadExitPrintStats = ReceiveNFLOGThreadExitStats;
122  tmm_modules[TMM_RECEIVENFLOG].ThreadDeinit = ReceiveNFLOGThreadDeinit;
124 }
125 
126 /**
127  * \brief Registration function for DecodeNFLOG
128  */
129 void TmModuleDecodeNFLOGRegister (void)
130 {
131  tmm_modules[TMM_DECODENFLOG].name = "DecodeNFLOG";
132  tmm_modules[TMM_DECODENFLOG].ThreadInit = DecodeNFLOGThreadInit;
133  tmm_modules[TMM_DECODENFLOG].Func = DecodeNFLOG;
135  tmm_modules[TMM_DECODENFLOG].ThreadDeinit = DecodeNFLOGThreadDeinit;
137 }
138 
139 /**
140  * \brief NFLOG callback function
141  * This function setup a packet from a nflog message
142  */
143 static int NFLOGCallback(struct nflog_g_handle *gh, struct nfgenmsg *msg,
144  struct nflog_data *nfa, void *data)
145 {
146  NFLOGThreadVars *ntv = (NFLOGThreadVars *) data;
147  struct nfulnl_msg_packet_hdr *ph;
148  char *payload;
149  int ret;
150 
151  /* grab a packet*/
153  if (p == NULL)
154  return -1;
155 
157 
158  ph = nflog_get_msg_packet_hdr(nfa);
159  if (ph != NULL) {
160  p->nflog_v.hw_protocol = ph->hw_protocol;
161  }
162 
163  p->nflog_v.ifi = nflog_get_indev(nfa);
164  p->nflog_v.ifo = nflog_get_outdev(nfa);
165 
166  ret = nflog_get_payload(nfa, &payload);
167 
168  if (ret > 0) {
169  if (ret > 65536) {
170  SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "NFLOG sent too big packet");
171  SET_PKT_LEN(p, 0);
172  } else if (runmode_workers)
173  PacketSetData(p, (uint8_t *)payload, ret);
174  else
175  PacketCopyData(p, (uint8_t *)payload, ret);
176  } else if (ret == -1)
177  SET_PKT_LEN(p, 0);
178 
179  ret = nflog_get_timestamp(nfa, &p->ts);
180  if (ret != 0) {
181  memset(&p->ts, 0, sizeof(struct timeval));
182  gettimeofday(&p->ts, NULL);
183  }
184 
185  p->datalink = DLT_RAW;
186 
187 #ifdef COUNTERS
188  ntv->pkts++;
189  ntv->bytes += GET_PKT_LEN(p);
190 #endif
191  (void) SC_ATOMIC_ADD(ntv->livedev->pkts, 1);
192 
193  if (TmThreadsSlotProcessPkt(ntv->tv, ntv->slot, p) != TM_ECODE_OK) {
194  return -1;
195  }
196 
197  return 0;
198 }
199 
200 /**
201  * \brief Receives packet from a nflog group via libnetfilter_log
202  * This is a setup function for recieving packets via libnetfilter_log.
203  * \param tv pointer to ThreadVars
204  * \param initdata pointer to the group passed from the user
205  * \param data pointer gets populated with NFLOGThreadVars
206  * \retvalTM_ECODE_OK on success
207  * \retval TM_ECODE_FAILED on error
208  */
209 TmEcode ReceiveNFLOGThreadInit(ThreadVars *tv, const void *initdata, void **data)
210 {
211  NflogGroupConfig *nflconfig = (NflogGroupConfig *)initdata;
212 
213  if (initdata == NULL) {
214  SCLogError(SC_ERR_INVALID_ARGUMENT, "initdata == NULL");
216  }
217 
218  NFLOGThreadVars *ntv = SCMalloc(sizeof(NFLOGThreadVars));
219  if (unlikely(ntv == NULL)) {
220  nflconfig->DerefFunc(nflconfig);
222  }
223  memset(ntv, 0, sizeof(NFLOGThreadVars));
224 
225  ntv->tv = tv;
226  ntv->group = nflconfig->group;
227  ntv->nlbufsiz = nflconfig->nlbufsiz;
228  ntv->nlbufsiz_max = nflconfig->nlbufsiz_max;
229  ntv->qthreshold = nflconfig->qthreshold;
230  ntv->qtimeout = nflconfig->qtimeout;
231  ntv->nful_overrun_warned = nflconfig->nful_overrun_warned;
232 
233  ntv->h = nflog_open();
234  if (ntv->h == NULL) {
235  SCLogError(SC_ERR_NFLOG_OPEN, "nflog_open() failed");
236  SCFree(ntv);
237  return TM_ECODE_FAILED;
238  }
239 
240  SCLogDebug("binding netfilter_log as nflog handler for AF_INET and AF_INET6");
241 
242  if (nflog_bind_pf(ntv->h, AF_INET) < 0) {
243  FatalError(SC_ERR_FATAL, "nflog_bind_pf() for AF_INET failed");
244  }
245  if (nflog_bind_pf(ntv->h, AF_INET6) < 0) {
246  FatalError(SC_ERR_FATAL, "nflog_bind_pf() for AF_INET6 failed");
247  }
248 
249  ntv->gh = nflog_bind_group(ntv->h, ntv->group);
250  if (!ntv->gh) {
251  SCLogError(SC_ERR_NFLOG_OPEN, "nflog_bind_group() failed");
252  SCFree(ntv);
253  return TM_ECODE_FAILED;
254  }
255 
256  if (nflog_set_mode(ntv->gh, NFULNL_COPY_PACKET, 0xFFFF) < 0) {
257  SCLogError(SC_ERR_NFLOG_SET_MODE, "can't set packet_copy mode");
258  SCFree(ntv);
259  return TM_ECODE_FAILED;
260  }
261 
262  nflog_callback_register(ntv->gh, &NFLOGCallback, (void *)ntv);
263 
264  if (ntv->nlbufsiz < ntv->nlbufsiz_max)
265  ntv->nlbufsiz = nfnl_rcvbufsiz(nflog_nfnlh(ntv->h), ntv->nlbufsiz);
266  else {
267  SCLogError(SC_ERR_NFLOG_MAX_BUFSIZ, "Maximum buffer size (%d) in NFLOG "
268  "has been reached", ntv->nlbufsiz);
269  return TM_ECODE_FAILED;
270  }
271 
272  if (nflog_set_qthresh(ntv->gh, ntv->qthreshold) >= 0)
273  SCLogDebug("NFLOG netlink queue threshold has been set to %d",
274  ntv->qthreshold);
275  else
276  SCLogDebug("NFLOG netlink queue threshold can't be set to %d",
277  ntv->qthreshold);
278 
279  if (nflog_set_timeout(ntv->gh, ntv->qtimeout) >= 0)
280  SCLogDebug("NFLOG netlink queue timeout has been set to %d",
281  ntv->qtimeout);
282  else
283  SCLogDebug("NFLOG netlink queue timeout can't be set to %d",
284  ntv->qtimeout);
285 
286  ntv->livedev = LiveGetDevice(nflconfig->numgroup);
287  if (ntv->livedev == NULL) {
288  SCLogError(SC_ERR_INVALID_VALUE, "Unable to find Live device");
289  SCFree(ntv);
291  }
292 
293  /* set a timeout to the socket so we can check for a signal
294  * in case we don't get packets for a longer period. */
295  struct timeval timev;
296  timev.tv_sec = 1;
297  timev.tv_usec = 0;
298 
299  int fd = nflog_fd(ntv->h);
300  if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timev, sizeof(timev)) == -1) {
301  SCLogWarning(SC_WARN_NFLOG_SETSOCKOPT, "can't set socket "
302  "timeout: %s", strerror(errno));
303  }
304 
305 #ifdef PACKET_STATISTICS
306  ntv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets",
307  ntv->tv);
308  ntv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops",
309  ntv->tv);
310 #endif
311 
312  char *active_runmode = RunmodeGetActive();
313  if (active_runmode && !strcmp("workers", active_runmode))
314  runmode_workers = 1;
315  else
316  runmode_workers = 0;
317 
318 #define T_DATA_SIZE 70000
319  ntv->data = SCMalloc(T_DATA_SIZE);
320  if (ntv->data == NULL) {
321  nflconfig->DerefFunc(nflconfig);
322  SCFree(ntv);
324  }
325 
326  ntv->datalen = T_DATA_SIZE;
327 #undef T_DATA_SIZE
328 
329  *data = (void *)ntv;
330 
331  nflconfig->DerefFunc(nflconfig);
333 }
334 
335 /**
336  * \brief DeInit function unbind group and close nflog's handle
337  * \param tv pointer to ThreadVars
338  * \param data pointer that gets cast into NFLogThreadVars
339  * \retval TM_ECODE_OK is always returned
340  */
341 TmEcode ReceiveNFLOGThreadDeinit(ThreadVars *tv, void *data)
342 {
343  NFLOGThreadVars *ntv = (NFLOGThreadVars *)data;
344 
345  SCLogDebug("closing nflog group %d", ntv->group);
346  if (nflog_unbind_pf(ntv->h, AF_INET) < 0) {
347  FatalError(SC_ERR_FATAL, "nflog_unbind_pf() for AF_INET failed");
348  }
349 
350  if (nflog_unbind_pf(ntv->h, AF_INET6) < 0) {
351  FatalError(SC_ERR_FATAL, "nflog_unbind_pf() for AF_INET6 failed");
352  }
353 
354  if (ntv->gh) {
355  nflog_unbind_group(ntv->gh);
356  ntv->gh = NULL;
357  }
358 
359  if (ntv->h) {
360  nflog_close(ntv->h);
361  ntv->h = NULL;
362  }
363 
364  if (ntv->data != NULL) {
365  SCFree(ntv->data);
366  ntv->data = NULL;
367  }
368  ntv->datalen = 0;
369 
370  SCFree(ntv);
371 
373 }
374 
375 /**
376  * \brief Increases netlink buffer size
377  *
378  * This function netlink's buffer size until
379  * the max buffer size is reached
380  *
381  * \param data pointer that gets cast into NFLOGThreadVars
382  * \param size netlink buffer size
383  */
384 static int NFLOGSetnlbufsiz(void *data, unsigned int size)
385 {
386  SCEnter();
387  NFLOGThreadVars *ntv = (NFLOGThreadVars *)data;
388 
389  if (size < ntv->nlbufsiz_max) {
390  ntv->nlbufsiz = nfnl_rcvbufsiz(nflog_nfnlh(ntv->h), ntv->nlbufsiz);
391  return 1;
392  }
393 
395  "Maximum buffer size (%d) in NFLOG has been "
396  "reached. Please, consider raising "
397  "`buffer-size` and `max-size` in nflog configuration",
398  ntv->nlbufsiz);
399  return 0;
400 
401 }
402 
403 /**
404  * \brief Recieves packets from a group via libnetfilter_log.
405  *
406  * This function recieves packets from a group and passes
407  * the packet on to the nflog callback function.
408  *
409  * \param tv pointer to ThreadVars
410  * \param data pointer that gets cast into NFLOGThreadVars
411  * \param slot slot containing task information
412  * \retval TM_ECODE_OK on success
413  * \retval TM_ECODE_FAILED on failure
414  */
415 TmEcode ReceiveNFLOGLoop(ThreadVars *tv, void *data, void *slot)
416 {
417  SCEnter();
418  NFLOGThreadVars *ntv = (NFLOGThreadVars *)data;
419  int rv, fd;
420  int ret = -1;
421 
422  ntv->slot = ((TmSlot *) slot)->slot_next;
423 
424  fd = nflog_fd(ntv->h);
425  if (fd < 0) {
426  SCLogError(SC_ERR_NFLOG_FD, "Can't obtain a file descriptor");
428  }
429 
430  while (1) {
431  if (suricata_ctl_flags != 0)
432  break;
433 
434  rv = recv(fd, ntv->data, ntv->datalen, 0);
435  if (rv < 0) {
436  /*We received an error on socket read */
437  if (errno == EINTR || errno == EWOULDBLOCK) {
438  /*Nothing for us to process */
439  continue;
440  } else if (errno == ENOBUFS) {
441  if (!ntv->nful_overrun_warned) {
442  int s = ntv->nlbufsiz * 2;
443  if (NFLOGSetnlbufsiz((void *)ntv, s)) {
445  "We are losing events, "
446  "increasing buffer size "
447  "to %d", ntv->nlbufsiz);
448  } else {
449  ntv->nful_overrun_warned = 1;
450  }
451  }
452  continue;
453  } else {
455  "Read from NFLOG fd failed: %s",
456  strerror(errno));
458  }
459  }
460 
461  ret = nflog_handle_packet(ntv->h, ntv->data, rv);
462  if (ret != 0)
464  "nflog_handle_packet error %" PRId32 "", ret);
465 
467  }
468 
470 }
471 
472 /**
473  * \brief This function prints stats to the screen at exit
474  * \param tv pointer to ThreadVars
475  * \param data pointer that gets cast into NFLOGThreadVars
476  */
477 void ReceiveNFLOGThreadExitStats(ThreadVars *tv, void *data)
478 {
479  SCEnter();
480  NFLOGThreadVars *ntv = (NFLOGThreadVars *)data;
481 
482  SCLogNotice("(%s) Pkts %" PRIu32 ", Bytes %" PRIu64 "",
483  tv->name, ntv->pkts, ntv->bytes);
484 }
485 
486 
487 /**
488  * \brief Decode IPv4/v6 packets.
489  *
490  * \param tv pointer to ThreadVars
491  * \param p pointer to the current packet
492  * \param data pointer that gets cast into NFLOGThreadVars for ptv
493  *
494  * \retval TM_ECODE_OK is always returned
495  */
496 TmEcode DecodeNFLOG(ThreadVars *tv, Packet *p, void *data)
497 {
498  SCEnter();
499  IPV4Hdr *ip4h = (IPV4Hdr *)GET_PKT_DATA(p);
500  IPV6Hdr *ip6h = (IPV6Hdr *)GET_PKT_DATA(p);
502 
504 
505  if (IPV4_GET_RAW_VER(ip4h) == 4) {
506  if (unlikely(GET_PKT_LEN(p) > USHRT_MAX)) {
507  return TM_ECODE_FAILED;
508  }
509  SCLogDebug("IPv4 packet");
511  } else if(IPV6_GET_RAW_VER(ip6h) == 6) {
512  if (unlikely(GET_PKT_LEN(p) > USHRT_MAX)) {
513  return TM_ECODE_FAILED;
514  }
515  SCLogDebug("IPv6 packet");
517  } else {
518  SCLogDebug("packet unsupported by NFLOG, first byte: %02x", *GET_PKT_DATA(p));
519  }
520 
522 
524 }
525 
526 /**
527  * \brief This an Init function for DecodeNFLOG
528  *
529  * \param tv pointer to ThreadVars
530  * \param initdata pointer to initilization data.
531  * \param data pointer that gets cast into NFLOGThreadVars
532  * \retval TM_ECODE_OK is returned on success
533  * \retval TM_ECODE_FAILED is returned on error
534  */
535 TmEcode DecodeNFLOGThreadInit(ThreadVars *tv, const void *initdata, void **data)
536 {
537  DecodeThreadVars *dtv = NULL;
539 
540  if (dtv == NULL)
542 
544 
545  *data = (void *)dtv;
546 
548 }
549 
550 TmEcode DecodeNFLOGThreadDeinit(ThreadVars *tv, void *data)
551 {
552  if (data != NULL)
553  DecodeThreadVarsFree(tv, data);
555 }
556 
557 #endif /* NFLOG */
SC_ERR_NFLOG_MAX_BUFSIZ
@ SC_ERR_NFLOG_MAX_BUFSIZ
Definition: util-error.h:282
tm-threads.h
source-nflog.h
IPV6_GET_RAW_VER
#define IPV6_GET_RAW_VER(ip6h)
Definition: decode-ipv6.h:62
ThreadVars_::name
char name[16]
Definition: threadvars.h:65
SC_ERR_INVALID_VALUE
@ SC_ERR_INVALID_VALUE
Definition: util-error.h:160
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:262
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
threads.h
LiveDevice_
Definition: util-device.h:40
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
T_DATA_SIZE
#define T_DATA_SIZE
packet-queue.h
SC_ERR_NFLOG_OPEN
@ SC_ERR_NFLOG_OPEN
Definition: util-error.h:279
tm-modules.h
StatsSyncCountersIfSignalled
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:137
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:118
RunmodeGetActive
char * RunmodeGetActive(void)
Definition: runmodes.c:192
NflogGroupConfig_::numgroup
char numgroup[NFLOG_GROUP_NAME_LENGTH]
Definition: source-nflog.h:47
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
SC_ERR_INVALID_ARGUMENTS
@ SC_ERR_INVALID_ARGUMENTS
Definition: util-error.h:82
tmqh-packetpool.h
TmModule_::PktAcqLoop
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
Definition: tm-modules.h:54
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
Packet_::datalink
int datalink
Definition: decode.h:583
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1150
TMM_DECODENFLOG
@ TMM_DECODENFLOG
Definition: tm-threads-common.h:63
SC_ERR_NFLOG_SET_MODE
@ SC_ERR_NFLOG_SET_MODE
Definition: util-error.h:283
TmModuleDecodeNFLOGRegister
void TmModuleDecodeNFLOGRegister(void)
Definition: source-nflog.c:54
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:484
SET_PKT_LEN
#define SET_PKT_LEN(p, len)
Definition: decode.h:235
SC_WARN_NFLOG_SETSOCKOPT
@ SC_WARN_NFLOG_SETSOCKOPT
Definition: util-error.h:290
decode.h
util-device.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:51
util-error.h
TmModule_::PktAcqBreakLoop
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
Definition: tm-modules.h:57
LiveGetDevice
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:278
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:231
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:52
SC_WARN_NFLOG_LOSING_EVENTS
@ SC_WARN_NFLOG_LOSING_EVENTS
Definition: util-error.h:288
SC_ERR_INVALID_ARGUMENT
@ SC_ERR_INVALID_ARGUMENT
Definition: util-error.h:43
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:414
TM_FLAG_DECODE_TM
#define TM_FLAG_DECODE_TM
Definition: tm-modules.h:32
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:580
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:230
NflogGroupConfig_::qtimeout
uint32_t qtimeout
Definition: source-nflog.h:44
IPV4_GET_RAW_VER
#define IPV4_GET_RAW_VER(ip4h)
Definition: decode-ipv4.h:94
TmSlot_
Definition: tm-threads.h:52
TmEcode
TmEcode
Definition: tm-threads-common.h:79
TmModule_::name
const char * name
Definition: tm-modules.h:44
runmodes.h
TmModuleReceiveNFLOGRegister
void TmModuleReceiveNFLOGRegister(void)
Definition: source-nflog.c:48
SC_ERR_NFLOG_FD
@ SC_ERR_NFLOG_FD
Definition: util-error.h:286
TM_FLAG_RECEIVE_TM
#define TM_FLAG_RECEIVE_TM
Definition: tm-modules.h:31
SC_WARN_NFLOG_RECV
@ SC_WARN_NFLOG_RECV
Definition: util-error.h:287
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
IPV4Hdr_
Definition: decode-ipv4.h:71
tm-queuehandlers.h
NoNFLOGSupportExit
TmEcode NoNFLOGSupportExit(ThreadVars *, const void *, void **)
Definition: source-nflog.c:60
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:658
group
uint8_t group
Definition: app-layer-dnp3.h:0
Packet_::ts
struct timeval ts
Definition: decode.h:457
suricata-common.h
SC_WARN_NFLOG_MAXBUFSIZ_REACHED
@ SC_WARN_NFLOG_MAXBUFSIZ_REACHED
Definition: util-error.h:289
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
TMM_RECEIVENFLOG
@ TMM_RECEIVENFLOG
Definition: tm-threads-common.h:62
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
NflogGroupConfig_::DerefFunc
void(* DerefFunc)(void *)
Definition: source-nflog.h:51
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
NflogGroupConfig_::group
uint16_t group
Definition: source-nflog.h:36
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
TmModule_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:48
threadvars.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
NflogGroupConfig_::qthreshold
uint32_t qthreshold
Definition: source-nflog.h:42
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:631
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
NflogGroupConfig_::nful_overrun_warned
int nful_overrun_warned
Definition: source-nflog.h:49
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:639
PacketSetData
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Definition: decode.c:678
suricata.h
SC_ERR_NFLOG_NOSUPPORT
@ SC_ERR_NFLOG_NOSUPPORT
Definition: util-error.h:278
NflogGroupConfig_
Definition: source-nflog.h:34
DecodeIPV4
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv4.c:517
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:232
msg
const char * msg
Definition: app-layer-htp.c:574
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:939
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:180
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:70
SC_ERR_NFLOG_HANDLE_PKT
@ SC_ERR_NFLOG_HANDLE_PKT
Definition: util-error.h:284
NflogGroupConfig_::nlbufsiz_max
uint32_t nlbufsiz_max
Definition: source-nflog.h:40
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:605
NflogGroupConfig_::nlbufsiz
uint32_t nlbufsiz
Definition: source-nflog.h:38
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:198