suricata
source-pcap-file-helper.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Danny Browning <danny.browning@protectwise.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "tm-threads.h"
26 
27 #ifndef __SOURCE_PCAP_FILE_HELPER_H__
28 #define __SOURCE_PCAP_FILE_HELPER_H__
29 
30 typedef struct PcapFileGlobalVars_ {
31  uint64_t cnt; /** packet counter */
34  SC_ATOMIC_DECLARE(unsigned int, invalid_checksums);
36 
37 /**
38  * Data that is shared amongst File, Directory, and Thread level vars
39  */
40 typedef struct PcapFileSharedVars_
41 {
42  char *bpf_string;
43 
44  uint32_t tenant_id;
45 
46  struct timespec last_processed;
47 
49 
52 
53  /* counters */
54  uint64_t pkts;
55  uint64_t bytes;
56  uint64_t files;
57 
58  uint8_t done;
59  uint32_t errs;
60 
61  /** callback result -- set if one of the thread module failed. */
62  int cb_result;
64 
65 /**
66  * Data specific to a single pcap file
67  */
68 typedef struct PcapFileFileVars_
69 {
70  char *filename;
71  pcap_t *pcap_handle;
72 
73  int datalink;
74  struct bpf_program filter;
75 
78 
79 /**
80  * Dispatch a file for processing, where the information necessary to process that
81  * file is as PcapFileFileVars object.
82  * @param ptv PcapFileFileVars object to be processed
83  * @return
84  */
86 
87 /**
88  * From a PcapFileFileVars, prepare the filename for processing by setting
89  * pcap_handle, datalink, and filter
90  * @param pfv PcapFileFileVars object to populate
91  * @return
92  */
94 
95 /**
96  * Cleanup resources associated with a PcapFileFileVars object.
97  * @param pfv Object to be cleaned up
98  */
100 
101 /**
102  * Determine if a datalink type is valid, setting a decoder function if valid.
103  * @param datalink Datalink type to validate
104  * @param decoder Pointer to decoder to set if valid
105  * @return TM_ECODE_OK if valid datalink type and decoder has been set.
106  */
107 TmEcode ValidateLinkType(int datalink, DecoderFunc *decoder);
108 
109 #endif /* __SOURCE_PCAP_FILE_HELPER_H__ */
ChecksumValidationMode checksum_mode
struct PcapFileSharedVars_ PcapFileSharedVars
int(* DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode.h:955
PcapFileSharedVars * shared
struct PcapFileGlobalVars_ PcapFileGlobalVars
void CleanupPcapFileFileVars(PcapFileFileVars *pfv)
ChecksumValidationMode conf_checksum_mode
TmEcode InitPcapFile(PcapFileFileVars *pfv)
ChecksumValidationMode
Definition: decode.h:40
SC_ATOMIC_DECLARE(unsigned int, invalid_checksums)
Per thread variable structure.
Definition: threadvars.h:57
struct PcapFileFileVars_ PcapFileFileVars
TmEcode PcapFileDispatch(PcapFileFileVars *ptv)
Main PCAP file reading Loop function.
TmEcode ValidateLinkType(int datalink, DecoderFunc *decoder)