63 "enabled please recompile with --enable-nflog", tv->
name);
74 void ReceiveNFLOGThreadExitStats(
ThreadVars *,
void *);
80 static int runmode_workers;
83 typedef struct NFLOGThreadVars_ {
92 uint32_t nlbufsiz_max;
96 struct nflog_handle *h;
97 struct nflog_g_handle *gh;
100 int nful_overrun_warned;
107 uint16_t capture_kernel_packets;
108 uint16_t capture_kernel_drops;
145 static int NFLOGCallback(
struct nflog_g_handle *gh,
struct nfgenmsg *
msg,
146 struct nflog_data *nfa,
void *data)
148 NFLOGThreadVars *ntv = (NFLOGThreadVars *) data;
149 struct nfulnl_msg_packet_hdr *ph;
160 ph = nflog_get_msg_packet_hdr(nfa);
162 p->nflog_v.hw_protocol = ph->hw_protocol;
165 p->nflog_v.ifi = nflog_get_indev(nfa);
166 p->nflog_v.ifo = nflog_get_outdev(nfa);
168 ret = nflog_get_payload(nfa, &payload);
174 }
else if (runmode_workers)
178 }
else if (ret == -1)
181 ret = nflog_get_timestamp(nfa, &p->
ts);
183 memset(&p->
ts, 0,
sizeof(
struct timeval));
184 gettimeofday(&p->
ts, NULL);
195 if (TmThreadsSlotProcessPkt(ntv->tv, ntv->slot, p) !=
TM_ECODE_OK) {
212 TmEcode ReceiveNFLOGThreadInit(
ThreadVars *tv,
const void *initdata,
void **data)
216 if (initdata == NULL) {
221 NFLOGThreadVars *ntv =
SCMalloc(
sizeof(NFLOGThreadVars));
226 memset(ntv, 0,
sizeof(NFLOGThreadVars));
229 ntv->group = nflconfig->
group;
230 ntv->nlbufsiz = nflconfig->
nlbufsiz;
233 ntv->qtimeout = nflconfig->
qtimeout;
236 ntv->h = nflog_open();
237 if (ntv->h == NULL) {
243 SCLogDebug(
"binding netfilter_log as nflog handler for AF_INET and AF_INET6");
245 if (nflog_bind_pf(ntv->h, AF_INET) < 0) {
249 if (nflog_bind_pf(ntv->h, AF_INET6) < 0) {
254 ntv->gh = nflog_bind_group(ntv->h, ntv->group);
261 if (nflog_set_mode(ntv->gh, NFULNL_COPY_PACKET, 0xFFFF) < 0) {
267 nflog_callback_register(ntv->gh, &NFLOGCallback, (
void *)ntv);
269 if (ntv->nlbufsiz < ntv->nlbufsiz_max)
270 ntv->nlbufsiz = nfnl_rcvbufsiz(nflog_nfnlh(ntv->h), ntv->nlbufsiz);
273 "has been reached", ntv->nlbufsiz);
277 if (nflog_set_qthresh(ntv->gh, ntv->qthreshold) >= 0)
278 SCLogDebug(
"NFLOG netlink queue threshold has been set to %d",
281 SCLogDebug(
"NFLOG netlink queue threshold can't be set to %d",
284 if (nflog_set_timeout(ntv->gh, ntv->qtimeout) >= 0)
285 SCLogDebug(
"NFLOG netlink queue timeout has been set to %d",
288 SCLogDebug(
"NFLOG netlink queue timeout can't be set to %d",
292 if (ntv->livedev == NULL) {
300 struct timeval timev;
304 int fd = nflog_fd(ntv->h);
305 if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timev,
sizeof(timev)) == -1) {
307 "timeout: %s", strerror(errno));
310 #ifdef PACKET_STATISTICS 318 if (active_runmode && !strcmp(
"workers", active_runmode))
323 #define T_DATA_SIZE 70000 325 if (ntv->data == NULL) {
348 NFLOGThreadVars *ntv = (NFLOGThreadVars *)data;
350 SCLogDebug(
"closing nflog group %d", ntv->group);
351 if (nflog_unbind_pf(ntv->h, AF_INET) < 0) {
356 if (nflog_unbind_pf(ntv->h, AF_INET6) < 0) {
362 nflog_unbind_group(ntv->gh);
383 static int NFLOGSetnlbufsiz(
void *data,
unsigned int size)
386 NFLOGThreadVars *ntv = (NFLOGThreadVars *)data;
388 if (size < ntv->nlbufsiz_max) {
389 ntv->nlbufsiz = nfnl_rcvbufsiz(nflog_nfnlh(ntv->h), ntv->nlbufsiz);
394 "Maximum buffer size (%d) in NFLOG has been " 395 "reached. Please, consider raising " 396 "`buffer-size` and `max-size` in nflog configuration",
417 NFLOGThreadVars *ntv = (NFLOGThreadVars *)data;
421 ntv->slot = ((
TmSlot *) slot)->slot_next;
423 fd = nflog_fd(ntv->h);
433 rv = recv(fd, ntv->data, ntv->datalen, 0);
436 if (errno == EINTR || errno == EWOULDBLOCK) {
439 }
else if (errno == ENOBUFS) {
440 if (!ntv->nful_overrun_warned) {
441 int s = ntv->nlbufsiz * 2;
442 if (NFLOGSetnlbufsiz((
void *)ntv, s)) {
444 "We are losing events, " 445 "increasing buffer size " 446 "to %d", ntv->nlbufsiz);
448 ntv->nful_overrun_warned = 1;
454 "Read from NFLOG fd failed: %s",
460 ret = nflog_handle_packet(ntv->h, ntv->data, rv);
463 "nflog_handle_packet error %" PRId32
"", ret);
476 void ReceiveNFLOGThreadExitStats(
ThreadVars *tv,
void *data)
479 NFLOGThreadVars *ntv = (NFLOGThreadVars *)data;
481 SCLogNotice(
"(%s) Pkts %" PRIu32
", Bytes %" PRIu64
"",
482 tv->
name, ntv->pkts, ntv->bytes);
#define TM_FLAG_DECODE_TM
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
TmEcode NoNFLOGSupportExit(ThreadVars *, const void *, void **)
#define SET_PKT_LEN(p, len)
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
TmEcode(* Func)(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *)
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
void TmModuleReceiveNFLOGRegister(void)
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
void TmModuleDecodeNFLOGRegister(void)
volatile uint8_t suricata_ctl_flags
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
#define IPV4_GET_RAW_VER(ip4h)
void(* DerefFunc)(void *)
char * RunmodeGetActive(void)
#define PKT_SET_SRC(p, src_val)
#define TM_FLAG_RECEIVE_TM
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
#define IPV6_GET_RAW_VER(ip6h)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Structure to hold thread specific data for all decode modules.
void(* RegisterTests)(void)
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
char numgroup[NFLOG_GROUP_NAME_LENGTH]
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
void(* ThreadExitPrintStats)(ThreadVars *, void *)
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
int PacketSetData(Packet *p, uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zeo copy is used.
#define SCLogNotice(...)
Macro used to log NOTICE messages.
TmModule tmm_modules[TMM_SIZE]
#define StatsSyncCountersIfSignalled(tv)
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Per thread variable structure.
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
int PacketCopyData(Packet *p, uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.