suricata
source-nfq.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "packet-queue.h"
#include "threads.h"
#include "threadvars.h"
#include "tm-threads.h"
#include "tm-queuehandlers.h"
#include "tmqh-packetpool.h"
#include "conf.h"
#include "config.h"
#include "conf-yaml-loader.h"
#include "source-nfq-prototypes.h"
#include "action-globals.h"
#include "util-debug.h"
#include "util-error.h"
#include "util-byte.h"
#include "util-cpu.h"
#include "util-privs.h"
#include "util-device.h"
#include "runmodes.h"
#include "source-nfq.h"
Include dependency graph for source-nfq.c:

Go to the source code of this file.

Data Structures

struct  NFQThreadVars_
 
struct  NFQCnf_
 

Macros

#define MAX_ALREADY_TREATED   5
 
#define NFQ_VERDICT_RETRY_TIME   3
 
#define NFQ_BURST_FACTOR   4
 
#define SOL_NETLINK   270
 
#define NFQ_FLAG_FAIL_OPEN   (1 << 0)
 
#define NFQMutexLock(nq)
 
#define NFQMutexUnlock(nq)
 
#define T_DATA_SIZE   70000
 

Typedefs

typedef struct NFQThreadVars_ NFQThreadVars
 
typedef enum NFQMode_ NFQMode
 
typedef struct NFQCnf_ NFQCnf
 

Enumerations

enum  NFQMode_ { NFQ_ACCEPT_MODE, NFQ_REPEAT_MODE, NFQ_ROUTE_MODE }
 

Functions

TmEcode ReceiveNFQLoop (ThreadVars *tv, void *data, void *slot)
 Main NFQ reading Loop function. More...
 
TmEcode ReceiveNFQThreadInit (ThreadVars *, const void *, void **)
 
TmEcode ReceiveNFQThreadDeinit (ThreadVars *, void *)
 
void ReceiveNFQThreadExitStats (ThreadVars *tv, void *data)
 NFQ receive module stats printing function. More...
 
TmEcode VerdictNFQ (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 NFQ verdict module packet entry function. More...
 
TmEcode VerdictNFQThreadInit (ThreadVars *, const void *, void **)
 
TmEcode VerdictNFQThreadDeinit (ThreadVars *, void *)
 
TmEcode DecodeNFQ (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 Decode a packet coming from NFQ. More...
 
TmEcode DecodeNFQThreadInit (ThreadVars *tv, const void *initdata, void **data)
 Initialize the NFQ Decode threadvars. More...
 
TmEcode DecodeNFQThreadDeinit (ThreadVars *tv, void *data)
 
TmEcode NFQSetVerdict (Packet *p)
 NFQ verdict function. More...
 
void TmModuleReceiveNFQRegister (void)
 
void TmModuleVerdictNFQRegister (void)
 
void TmModuleDecodeNFQRegister (void)
 
void NFQInitConfig (char quiet)
 To initialize the NFQ global configuration data. More...
 
int NFQRegisterQueue (const uint16_t number)
 Add a single Netfilter queue. More...
 
int NFQParseAndRegisterQueues (const char *queues)
 Parses and adds Netfilter queue(s). More...
 
void * NFQGetQueue (int number)
 Get a pointer to the NFQ queue at index. More...
 
void * NFQGetThread (int number)
 Get a pointer to the NFQ thread at index. More...
 
void NFQContextsClean ()
 Clean global contexts. Must be called on exit. More...
 

Variables

int max_pending_packets
 
NFQCnf nfq_config
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t
Eric Leblond eric@.nosp@m.regi.nosp@m.t.org

Netfilter's netfilter_queue support for reading packets from the kernel and setting verdicts back to it (inline mode). Supported on Linux and Windows.

Todo:
test if Receive and Verdict if both are present

Definition in file source-nfq.c.

Macro Definition Documentation

#define MAX_ALREADY_TREATED   5

Definition at line 112 of file source-nfq.c.

#define NFQ_BURST_FACTOR   4

Definition at line 117 of file source-nfq.c.

Referenced by ReceiveNFQThreadInit().

#define NFQ_FLAG_FAIL_OPEN   (1 << 0)

Definition at line 168 of file source-nfq.c.

Referenced by NFQInitConfig().

#define NFQ_VERDICT_RETRY_TIME   3

Definition at line 113 of file source-nfq.c.

Referenced by NFQInitConfig(), and NFQSetVerdict().

#define NFQMutexLock (   nq)
Value:
do { \
if ((nq)->use_mutex) \
SCMutexLock(&(nq)->mutex_qh); \
} while (0)
#define SCMutexLock(mut)

Definition at line 409 of file source-nfq.c.

Referenced by NFQGetThread(), NFQSetVerdict(), and ReceiveNFQThreadInit().

#define NFQMutexUnlock (   nq)
Value:
do { \
if ((nq)->use_mutex) \
SCMutexUnlock(&(nq)->mutex_qh); \
} while (0)
#define SCMutexUnlock(mut)

Definition at line 414 of file source-nfq.c.

Referenced by NFQGetThread(), NFQSetVerdict(), and ReceiveNFQThreadInit().

#define SOL_NETLINK   270

Definition at line 120 of file source-nfq.c.

#define T_DATA_SIZE   70000

Referenced by ReceiveNFQThreadInit().

Typedef Documentation

typedef struct NFQCnf_ NFQCnf
typedef enum NFQMode_ NFQMode
typedef struct NFQThreadVars_ NFQThreadVars

Enumeration Type Documentation

enum NFQMode_
Enumerator
NFQ_ACCEPT_MODE 
NFQ_REPEAT_MODE 
NFQ_ROUTE_MODE 

Definition at line 162 of file source-nfq.c.

Function Documentation

TmEcode DecodeNFQ ( ThreadVars tv,
Packet p,
void *  data,
PacketQueue pq,
PacketQueue postpq 
)

Decode a packet coming from NFQ.

Definition at line 1246 of file source-nfq.c.

References DecodeIPV4(), DecodeIPV6(), DecodeUpdatePacketCounters(), GET_PKT_DATA, GET_PKT_LEN, IPV4_GET_RAW_VER, IPV6_GET_RAW_VER, PacketDecodeFinalize(), PKT_IS_PSEUDOPKT, SCLogDebug, TM_ECODE_FAILED, TM_ECODE_OK, and unlikely.

Referenced by TmModuleDecodeNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodeNFQThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 1299 of file source-nfq.c.

References DecodeThreadVarsFree(), SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleDecodeNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodeNFQThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Initialize the NFQ Decode threadvars.

Definition at line 1284 of file source-nfq.c.

References DecodeRegisterPerfCounters(), DecodeThreadVarsAlloc(), SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleDecodeNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void NFQContextsClean ( void  )

Clean global contexts. Must be called on exit.

Definition at line 1309 of file source-nfq.c.

References SCFree.

Referenced by GlobalsInitPreConfig().

Here is the caller graph for this function:

void* NFQGetQueue ( int  number)

Get a pointer to the NFQ queue at index.

Parameters
numberidx of the queue in our array
Return values
ptrpointer to the NFQThreadVars at index
NULLon error

Definition at line 952 of file source-nfq.c.

References unlikely.

Referenced by ReceiveNFQLoop(), ReceiveNFQThreadDeinit(), ReceiveNFQThreadExitStats(), and VerdictNFQThreadDeinit().

Here is the caller graph for this function:

void* NFQGetThread ( int  number)

Get a pointer to the NFQ thread at index.

This function is temporary used as configuration parser.

Parameters
numberidx of the queue in our array
Return values
ptrpointer to the NFQThreadVars at index
NULLon error

Definition at line 970 of file source-nfq.c.

References NFQThreadVars_::data, NFQThreadVars_::datalen, NFQQueueVars_::errs, NFQQueueVars_::fd, NFQQueueVars_::h, NFQMutexLock, NFQMutexUnlock, NFQQueueVars_::qh, SC_ERR_NFQ_HANDLE_PKT, SC_ERR_NFQ_RECV, SCLogWarning, NFQThreadVars_::slot, NFQThreadVars_::tv, and unlikely.

Referenced by RunModeIpsNFQAutoFp(), and RunModeIpsNFQWorker().

Here is the caller graph for this function:

int NFQParseAndRegisterQueues ( const char *  queues)

Parses and adds Netfilter queue(s).

Parameters
stringwith the queue number or range
Return values
0on success.
-1on failure.

Definition at line 893 of file source-nfq.c.

References NFQRegisterQueue(), SC_ERR_INVALID_ARGUMENT, SC_ERR_MEM_ALLOC, SCCalloc, SCFree, and SCLogError.

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

int NFQRegisterQueue ( const uint16_t  number)

Add a single Netfilter queue.

Parameters
stringwith the queue number
Return values
0on success.
-1on failure.

Definition at line 835 of file source-nfq.c.

References NFQThreadVars_::livedev, LiveGetDevice(), LiveRegisterDevice(), NFQThreadVars_::nfq_index, NFQ_MAX_QUEUE, NFQQueueVars_::queue_num, SC_ERR_INVALID_ARGUMENT, SC_ERR_INVALID_VALUE, SC_WARN_UNCOMMON, SCLogDebug, SCLogError, SCLogWarning, SCMutexLock, SCMutexUnlock, and UtilCpuGetNumProcessorsOnline().

Referenced by NFQParseAndRegisterQueues().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceiveNFQLoop ( ThreadVars tv,
void *  data,
void *  slot 
)

Main NFQ reading Loop function.

Definition at line 1035 of file source-nfq.c.

References NFQThreadVars_::nfq_index, NFQGetQueue(), SCEnter, SCReturnInt, NFQThreadVars_::slot, TmSlot_::slot_next, StatsSyncCountersIfSignalled, suricata_ctl_flags, and TM_ECODE_OK.

Referenced by TmModuleReceiveNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceiveNFQThreadDeinit ( ThreadVars t,
void *  data 
)

Definition at line 791 of file source-nfq.c.

References NFQThreadVars_::data, NFQThreadVars_::datalen, NFQThreadVars_::nfq_index, NFQGetQueue(), SCFree, and TM_ECODE_OK.

Referenced by TmModuleReceiveNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void ReceiveNFQThreadExitStats ( ThreadVars tv,
void *  data 
)

NFQ receive module stats printing function.

Definition at line 1058 of file source-nfq.c.

References NFQQueueVars_::accepted, NFQQueueVars_::bytes, NFQQueueVars_::dropped, NFQQueueVars_::errs, ThreadVars_::name, NFQThreadVars_::nfq_index, NFQGetQueue(), NFQQueueVars_::pkts, NFQQueueVars_::replaced, and SCLogNotice.

Referenced by TmModuleReceiveNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void TmModuleDecodeNFQRegister ( void  )
void TmModuleVerdictNFQRegister ( void  )

Definition at line 200 of file source-nfq.c.

References TmModule_::Func, TmModule_::name, TmModule_::RegisterTests, TmModule_::ThreadDeinit, TmModule_::ThreadExitPrintStats, TmModule_::ThreadInit, tmm_modules, TMM_VERDICTNFQ, VerdictNFQ(), VerdictNFQThreadDeinit(), and VerdictNFQThreadInit().

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode VerdictNFQ ( ThreadVars tv,
Packet p,
void *  data,
PacketQueue pq,
PacketQueue postpq 
)

NFQ verdict module packet entry function.

Definition at line 1214 of file source-nfq.c.

References CaptureStatsUpdate(), IS_TUNNEL_PKT, NFQSetVerdict(), Packet_::root, SCLogDebug, NFQThreadVars_::stats, and TM_ECODE_OK.

Referenced by TmModuleVerdictNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode VerdictNFQThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 817 of file source-nfq.c.

References NFQThreadVars_::nfq_index, NFQGetQueue(), and TM_ECODE_OK.

Referenced by TmModuleVerdictNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode VerdictNFQThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Definition at line 807 of file source-nfq.c.

References CaptureStatsSetup(), NFQThreadVars_::stats, and TM_ECODE_OK.

Referenced by TmModuleVerdictNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

NFQCnf nfq_config

Definition at line 181 of file source-nfq.c.