suricata
source-pcap-file-helper.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Danny Browning <danny.browning@protectwise.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "tm-threads.h"
26 
27 #ifndef __SOURCE_PCAP_FILE_HELPER_H__
28 #define __SOURCE_PCAP_FILE_HELPER_H__
29 
30 typedef struct PcapFileGlobalVars_ {
31  uint64_t cnt; /** packet counter */
34  SC_ATOMIC_DECLARE(unsigned int, invalid_checksums);
36 
37 /**
38  * Data that is shared amongst File, Directory, and Thread level vars
39  */
40 typedef struct PcapFileSharedVars_
41 {
42  char *bpf_string;
43 
44  uint32_t tenant_id;
45 
46  struct timespec last_processed;
47 
49 
52 
53  /* counters */
54  uint64_t pkts;
55  uint64_t bytes;
56  uint64_t files;
57 
58  uint8_t done;
59  uint32_t errs;
60 
61  /** callback result -- set if one of the thread module failed. */
62  int cb_result;
64 
65 /**
66  * Data specific to a single pcap file
67  */
68 typedef struct PcapFileFileVars_
69 {
70  char *filename;
71  pcap_t *pcap_handle;
72 
73  int datalink;
74  struct bpf_program filter;
75 
77 
78  /* fields used to get the first packet's timestamp early,
79  * so it can be used to setup the time subsys. */
80  const u_char *first_pkt_data;
81  struct pcap_pkthdr *first_pkt_hdr;
82  struct timeval first_pkt_ts;
84 
85 /**
86  * Dispatch a file for processing, where the information necessary to process that
87  * file is as PcapFileFileVars object.
88  * @param ptv PcapFileFileVars object to be processed
89  * @return
90  */
92 
93 /**
94  * From a PcapFileFileVars, prepare the filename for processing by setting
95  * pcap_handle, datalink, and filter
96  * @param pfv PcapFileFileVars object to populate
97  * @return
98  */
100 
101 /**
102  * Cleanup resources associated with a PcapFileFileVars object.
103  * @param pfv Object to be cleaned up
104  */
106 
107 /**
108  * Determine if a datalink type is valid, setting a decoder function if valid.
109  * @param datalink Datalink type to validate
110  * @param decoder Pointer to decoder to set if valid
111  * @return TM_ECODE_OK if valid datalink type and decoder has been set.
112  */
113 TmEcode ValidateLinkType(int datalink, DecoderFunc *decoder);
114 
115 #endif /* __SOURCE_PCAP_FILE_HELPER_H__ */
PcapFileSharedVars_::slot
TmSlot * slot
Definition: source-pcap-file-helper.h:51
tm-threads.h
PcapFileFileVars_::filename
char * filename
Definition: source-pcap-file-helper.h:70
PcapFileSharedVars_
Definition: source-pcap-file-helper.h:41
PcapFileGlobalVars_
Definition: source-pcap-file-helper.h:30
PcapFileFileVars_::first_pkt_data
const u_char * first_pkt_data
Definition: source-pcap-file-helper.h:80
PcapFileFileVars_::datalink
int datalink
Definition: source-pcap-file-helper.h:73
PcapFileFileVars_::shared
PcapFileSharedVars * shared
Definition: source-pcap-file-helper.h:76
CleanupPcapFileFileVars
void CleanupPcapFileFileVars(PcapFileFileVars *pfv)
Definition: source-pcap-file-helper.c:36
PcapFileSharedVars_::should_delete
bool should_delete
Definition: source-pcap-file-helper.h:48
DecoderFunc
int(* DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode.h:952
PcapFileFileVars
struct PcapFileFileVars_ PcapFileFileVars
PcapFileSharedVars_::cb_result
int cb_result
Definition: source-pcap-file-helper.h:62
PcapFileSharedVars
struct PcapFileSharedVars_ PcapFileSharedVars
PcapFileSharedVars_::done
uint8_t done
Definition: source-pcap-file-helper.h:58
InitPcapFile
TmEcode InitPcapFile(PcapFileFileVars *pfv)
Definition: source-pcap-file-helper.c:191
PcapFileSharedVars_::files
uint64_t files
Definition: source-pcap-file-helper.h:56
PcapFileGlobalVars
struct PcapFileGlobalVars_ PcapFileGlobalVars
PcapFileGlobalVars_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(unsigned int, invalid_checksums)
PcapFileGlobalVars_::cnt
uint64_t cnt
Definition: source-pcap-file-helper.h:31
PcapFileGlobalVars_::checksum_mode
ChecksumValidationMode checksum_mode
Definition: source-pcap-file-helper.h:33
PcapFileDispatch
TmEcode PcapFileDispatch(PcapFileFileVars *ptv)
Main PCAP file reading Loop function.
Definition: source-pcap-file-helper.c:119
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
TmSlot_
Definition: tm-threads.h:52
PcapFileFileVars_
Definition: source-pcap-file-helper.h:69
TmEcode
TmEcode
Definition: tm-threads-common.h:77
PcapFileSharedVars_::bpf_string
char * bpf_string
Definition: source-pcap-file-helper.h:42
ChecksumValidationMode
ChecksumValidationMode
Definition: decode.h:41
suricata-common.h
PcapFileSharedVars_::tenant_id
uint32_t tenant_id
Definition: source-pcap-file-helper.h:44
PcapFileFileVars_::first_pkt_ts
struct timeval first_pkt_ts
Definition: source-pcap-file-helper.h:82
ValidateLinkType
TmEcode ValidateLinkType(int datalink, DecoderFunc *decoder)
Definition: source-pcap-file-helper.c:235
PcapFileSharedVars_::last_processed
struct timespec last_processed
Definition: source-pcap-file-helper.h:46
PcapFileGlobalVars_::conf_checksum_mode
ChecksumValidationMode conf_checksum_mode
Definition: source-pcap-file-helper.h:32
bpf_program
Definition: source-af-packet.c:78
PcapFileFileVars_::pcap_handle
pcap_t * pcap_handle
Definition: source-pcap-file-helper.h:71
PcapFileFileVars_::first_pkt_hdr
struct pcap_pkthdr * first_pkt_hdr
Definition: source-pcap-file-helper.h:81
PcapFileFileVars_::filter
struct bpf_program filter
Definition: source-pcap-file-helper.h:74
PcapFileSharedVars_::bytes
uint64_t bytes
Definition: source-pcap-file-helper.h:55
PcapFileSharedVars_::tv
ThreadVars * tv
Definition: source-pcap-file-helper.h:50
PcapFileSharedVars_::errs
uint32_t errs
Definition: source-pcap-file-helper.h:59
PcapFileSharedVars_::pkts
uint64_t pkts
Definition: source-pcap-file-helper.h:54