suricata
source-pcap-file-helper.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Danny Browning <danny.browning@protectwise.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "tm-threads.h"
26 
27 #ifndef __SOURCE_PCAP_FILE_HELPER_H__
28 #define __SOURCE_PCAP_FILE_HELPER_H__
29 
30 typedef struct PcapFileGlobalVars_ {
31  uint64_t cnt; /** packet counter */
34  SC_ATOMIC_DECLARE(unsigned int, invalid_checksums);
36 
37 /**
38  * Data that is shared amongst File, Directory, and Thread level vars
39  */
40 typedef struct PcapFileSharedVars_
41 {
42  char *bpf_string;
43 
44  uint32_t tenant_id;
45 
46  struct timespec last_processed;
47 
49 
52 
53  /* counters */
54  uint64_t pkts;
55  uint64_t bytes;
56  uint64_t files;
57 
58  uint8_t done;
59  uint32_t errs;
60 
61  /** callback result -- set if one of the thread module failed. */
62  int cb_result;
64 
65 /**
66  * Data specific to a single pcap file
67  */
68 typedef struct PcapFileFileVars_
69 {
70  char *filename;
71  pcap_t *pcap_handle;
72 
73  int datalink;
74  struct bpf_program filter;
75 
78 
79 typedef int (*Decoder)(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
80 
81 /**
82  * Dispatch a file for processing, where the information necessary to process that
83  * file is as PcapFileFileVars object.
84  * @param ptv PcapFileFileVars object to be processed
85  * @return
86  */
88 
89 /**
90  * From a PcapFileFileVars, prepare the filename for processing by setting
91  * pcap_handle, datalink, and filter
92  * @param pfv PcapFileFileVars object to populate
93  * @return
94  */
96 
97 /**
98  * Cleanup resources associated with a PcapFileFileVars object.
99  * @param pfv Object to be cleaned up
100  */
102 
103 /**
104  * Determine if a datalink type is valid, setting a decoder function if valid.
105  * @param datalink Datalink type to validate
106  * @param decoder Pointer to decoder to set if valid
107  * @return TM_ECODE_OK if valid datalink type and decoder has been set.
108  */
109 TmEcode ValidateLinkType(int datalink, Decoder *decoder);
110 
111 #endif /* __SOURCE_PCAP_FILE_HELPER_H__ */
ChecksumValidationMode checksum_mode
struct PcapFileSharedVars_ PcapFileSharedVars
PcapFileSharedVars * shared
struct PcapFileGlobalVars_ PcapFileGlobalVars
void CleanupPcapFileFileVars(PcapFileFileVars *pfv)
ChecksumValidationMode conf_checksum_mode
TmEcode ValidateLinkType(int datalink, Decoder *decoder)
int(* Decoder)(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Structure to hold thread specific data for all decode modules.
Definition: decode.h:632
TmEcode InitPcapFile(PcapFileFileVars *pfv)
ChecksumValidationMode
Definition: decode.h:40
SC_ATOMIC_DECLARE(unsigned int, invalid_checksums)
Per thread variable structure.
Definition: threadvars.h:57
struct PcapFileFileVars_ PcapFileFileVars
TmEcode PcapFileDispatch(PcapFileFileVars *ptv)
Main PCAP file reading Loop function.