suricata
source-nfq.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "packet-queue.h"
#include "threads.h"
#include "threadvars.h"
#include "tm-threads.h"
#include "tm-queuehandlers.h"
#include "tmqh-packetpool.h"
#include "conf.h"
#include "config.h"
#include "conf-yaml-loader.h"
#include "source-nfq-prototypes.h"
#include "action-globals.h"
#include "util-debug.h"
#include "util-error.h"
#include "util-byte.h"
#include "util-cpu.h"
#include "util-privs.h"
#include "util-device.h"
#include "runmodes.h"
#include "source-nfq.h"
Include dependency graph for source-nfq.c:

Go to the source code of this file.

Data Structures

struct  NFQThreadVars_
 
struct  NFQCnf_
 

Macros

#define MAX_ALREADY_TREATED   5
 
#define NFQ_VERDICT_RETRY_TIME   3
 
#define NFQ_BURST_FACTOR   4
 
#define SOL_NETLINK   270
 
#define NFQ_FLAG_FAIL_OPEN   (1 << 0)
 
#define NFQMutexLock(nq)
 
#define NFQMutexUnlock(nq)
 
#define T_DATA_SIZE   70000
 

Typedefs

typedef struct NFQThreadVars_ NFQThreadVars
 
typedef enum NFQMode_ NFQMode
 
typedef struct NFQCnf_ NFQCnf
 

Enumerations

enum  NFQMode_ { NFQ_ACCEPT_MODE, NFQ_REPEAT_MODE, NFQ_ROUTE_MODE }
 

Functions

TmEcode ReceiveNFQLoop (ThreadVars *tv, void *data, void *slot)
 Main NFQ reading Loop function. More...
 
TmEcode ReceiveNFQThreadInit (ThreadVars *, const void *, void **)
 
TmEcode ReceiveNFQThreadDeinit (ThreadVars *, void *)
 
void ReceiveNFQThreadExitStats (ThreadVars *tv, void *data)
 NFQ receive module stats printing function. More...
 
TmEcode VerdictNFQ (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 NFQ verdict module packet entry function. More...
 
TmEcode VerdictNFQThreadInit (ThreadVars *, const void *, void **)
 
TmEcode VerdictNFQThreadDeinit (ThreadVars *, void *)
 
TmEcode DecodeNFQ (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 Decode a packet coming from NFQ. More...
 
TmEcode DecodeNFQThreadInit (ThreadVars *tv, const void *initdata, void **data)
 Initialize the NFQ Decode threadvars. More...
 
TmEcode DecodeNFQThreadDeinit (ThreadVars *tv, void *data)
 
TmEcode NFQSetVerdict (Packet *p)
 NFQ verdict function. More...
 
void TmModuleReceiveNFQRegister (void)
 
void TmModuleVerdictNFQRegister (void)
 
void TmModuleDecodeNFQRegister (void)
 
void NFQInitConfig (char quiet)
 To initialize the NFQ global configuration data. More...
 
int NFQRegisterQueue (const uint16_t number)
 Add a single Netfilter queue. More...
 
int NFQParseAndRegisterQueues (const char *queues)
 Parses and adds Netfilter queue(s). More...
 
void * NFQGetQueue (int number)
 Get a pointer to the NFQ queue at index. More...
 
void * NFQGetThread (int number)
 Get a pointer to the NFQ thread at index. More...
 

Variables

int max_pending_packets
 
NFQCnf nfq_config
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t
Eric Leblond eric@.nosp@m.regi.nosp@m.t.org

Netfilter's netfilter_queue support for reading packets from the kernel and setting verdicts back to it (inline mode). Supported on Linux and Windows.

Todo:
test if Receive and Verdict if both are present

Definition in file source-nfq.c.

Macro Definition Documentation

#define MAX_ALREADY_TREATED   5

Definition at line 112 of file source-nfq.c.

#define NFQ_BURST_FACTOR   4

Definition at line 117 of file source-nfq.c.

Referenced by ReceiveNFQThreadInit().

#define NFQ_FLAG_FAIL_OPEN   (1 << 0)

Definition at line 166 of file source-nfq.c.

Referenced by NFQInitConfig().

#define NFQ_VERDICT_RETRY_TIME   3

Definition at line 113 of file source-nfq.c.

Referenced by NFQInitConfig(), and NFQSetVerdict().

#define NFQMutexLock (   nq)
Value:
do { \
if ((nq)->use_mutex) \
SCMutexLock(&(nq)->mutex_qh); \
} while (0)
#define SCMutexLock(mut)

Definition at line 407 of file source-nfq.c.

Referenced by NFQGetThread(), NFQSetVerdict(), and ReceiveNFQThreadInit().

#define NFQMutexUnlock (   nq)
Value:
do { \
if ((nq)->use_mutex) \
SCMutexUnlock(&(nq)->mutex_qh); \
} while (0)
#define SCMutexUnlock(mut)

Definition at line 412 of file source-nfq.c.

Referenced by NFQGetThread(), NFQSetVerdict(), and ReceiveNFQThreadInit().

#define SOL_NETLINK   270

Definition at line 120 of file source-nfq.c.

#define T_DATA_SIZE   70000

Referenced by ReceiveNFQThreadInit().

Typedef Documentation

typedef struct NFQCnf_ NFQCnf
typedef enum NFQMode_ NFQMode
typedef struct NFQThreadVars_ NFQThreadVars

Enumeration Type Documentation

enum NFQMode_
Enumerator
NFQ_ACCEPT_MODE 
NFQ_REPEAT_MODE 
NFQ_ROUTE_MODE 

Definition at line 160 of file source-nfq.c.

Function Documentation

TmEcode DecodeNFQ ( ThreadVars tv,
Packet p,
void *  data,
PacketQueue pq,
PacketQueue postpq 
)

Decode a packet coming from NFQ.

Definition at line 1242 of file source-nfq.c.

References DecodeIPV4(), DecodeIPV6(), DecodeUpdatePacketCounters(), GET_PKT_DATA, GET_PKT_LEN, ip4h, ip6h, IPV4_GET_RAW_VER, IPV6_GET_RAW_VER, PacketDecodeFinalize(), PKT_IS_PSEUDOPKT, SCLogDebug, TM_ECODE_FAILED, TM_ECODE_OK, and unlikely.

Referenced by TmModuleDecodeNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodeNFQThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 1295 of file source-nfq.c.

References DecodeThreadVarsFree(), SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleDecodeNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodeNFQThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Initialize the NFQ Decode threadvars.

Definition at line 1280 of file source-nfq.c.

References DecodeRegisterPerfCounters(), DecodeThreadVarsAlloc(), SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleDecodeNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void* NFQGetQueue ( int  number)

Get a pointer to the NFQ queue at index.

Parameters
numberidx of the queue in our array
Return values
ptrpointer to the NFQThreadVars at index
NULLon error

Definition at line 948 of file source-nfq.c.

Referenced by ReceiveNFQLoop(), ReceiveNFQThreadDeinit(), ReceiveNFQThreadExitStats(), and VerdictNFQThreadDeinit().

Here is the caller graph for this function:

void* NFQGetThread ( int  number)

Get a pointer to the NFQ thread at index.

This function is temporary used as configuration parser.

Parameters
numberidx of the queue in our array
Return values
ptrpointer to the NFQThreadVars at index
NULLon error

Definition at line 966 of file source-nfq.c.

References NFQThreadVars_::data, NFQThreadVars_::datalen, NFQQueueVars_::errs, NFQQueueVars_::fd, NFQQueueVars_::h, NFQMutexLock, NFQMutexUnlock, NFQQueueVars_::qh, SC_ERR_NFQ_HANDLE_PKT, SC_ERR_NFQ_RECV, SCLogWarning, NFQThreadVars_::slot, and NFQThreadVars_::tv.

Referenced by RunModeIpsNFQAutoFp(), and RunModeIpsNFQWorker().

Here is the caller graph for this function:

int NFQParseAndRegisterQueues ( const char *  queues)

Parses and adds Netfilter queue(s).

Parameters
stringwith the queue number or range
Return values
0on success.
-1on failure.

Definition at line 889 of file source-nfq.c.

References NFQRegisterQueue(), SC_ERR_INVALID_ARGUMENT, SC_ERR_MEM_ALLOC, SCCalloc, SCFree, and SCLogError.

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

int NFQRegisterQueue ( const uint16_t  number)

Add a single Netfilter queue.

Parameters
stringwith the queue number
Return values
0on success.
-1on failure.

Definition at line 838 of file source-nfq.c.

References LiveRegisterDeviceName(), NFQThreadVars_::nfq_index, NFQ_MAX_QUEUE, NFQQueueVars_::queue_num, SC_ERR_INVALID_ARGUMENT, SC_WARN_UNCOMMON, SCLogDebug, SCLogError, SCLogWarning, SCMutexLock, SCMutexUnlock, and UtilCpuGetNumProcessorsOnline().

Referenced by NFQParseAndRegisterQueues().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceiveNFQLoop ( ThreadVars tv,
void *  data,
void *  slot 
)

Main NFQ reading Loop function.

Definition at line 1031 of file source-nfq.c.

References NFQThreadVars_::nfq_index, NFQGetQueue(), SCEnter, SCReturnInt, NFQThreadVars_::slot, TmSlot_::slot_next, StatsSyncCountersIfSignalled, suricata_ctl_flags, and TM_ECODE_OK.

Referenced by TmModuleReceiveNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceiveNFQThreadDeinit ( ThreadVars t,
void *  data 
)

Definition at line 786 of file source-nfq.c.

References NFQThreadVars_::data, NFQThreadVars_::datalen, NFQThreadVars_::nfq_index, NFQGetQueue(), SCFree, SCMutexLock, SCMutexUnlock, and TM_ECODE_OK.

Referenced by TmModuleReceiveNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void ReceiveNFQThreadExitStats ( ThreadVars tv,
void *  data 
)

NFQ receive module stats printing function.

Definition at line 1054 of file source-nfq.c.

References NFQQueueVars_::accepted, NFQQueueVars_::bytes, NFQQueueVars_::dropped, NFQQueueVars_::errs, ThreadVars_::name, NFQThreadVars_::nfq_index, NFQGetQueue(), NFQQueueVars_::pkts, NFQQueueVars_::replaced, and SCLogNotice.

Referenced by TmModuleReceiveNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void TmModuleDecodeNFQRegister ( void  )
void TmModuleVerdictNFQRegister ( void  )

Definition at line 198 of file source-nfq.c.

References TmModule_::Func, TmModule_::name, TmModule_::RegisterTests, TmModule_::ThreadDeinit, TmModule_::ThreadExitPrintStats, TmModule_::ThreadInit, tmm_modules, TMM_VERDICTNFQ, VerdictNFQ(), VerdictNFQThreadDeinit(), and VerdictNFQThreadInit().

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode VerdictNFQ ( ThreadVars tv,
Packet p,
void *  data,
PacketQueue pq,
PacketQueue postpq 
)

NFQ verdict module packet entry function.

Definition at line 1210 of file source-nfq.c.

References CaptureStatsUpdate(), IS_TUNNEL_PKT, NFQSetVerdict(), Packet_::root, SCLogDebug, NFQThreadVars_::stats, and TM_ECODE_OK.

Referenced by TmModuleVerdictNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode VerdictNFQThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 820 of file source-nfq.c.

References NFQThreadVars_::nfq_index, NFQGetQueue(), and TM_ECODE_OK.

Referenced by TmModuleVerdictNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode VerdictNFQThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Definition at line 810 of file source-nfq.c.

References CaptureStatsSetup(), NFQThreadVars_::stats, and TM_ECODE_OK.

Referenced by TmModuleVerdictNFQRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

NFQCnf nfq_config

Definition at line 179 of file source-nfq.c.