suricata
source-pcap-file.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * File based pcap packet acquisition support
24  */
25 
26 #include "suricata-common.h"
27 #include "source-pcap-file.h"
30 #include "flow-manager.h"
31 #include "util-checksum.h"
32 
33 extern int max_pending_packets;
35 
36 /**
37  * Union determining whether the behavior of the thread is file or directory
38  */
39 typedef union PcapFileBehaviorVar_
40 {
44 
45 /**
46  * Data specific to the thread
47  */
48 typedef struct PcapFileThreadVars_
49 {
52 
55 
56 static TmEcode ReceivePcapFileLoop(ThreadVars *, void *, void *);
57 static TmEcode ReceivePcapFileThreadInit(ThreadVars *, const void *, void **);
58 static void ReceivePcapFileThreadExitStats(ThreadVars *, void *);
59 static TmEcode ReceivePcapFileThreadDeinit(ThreadVars *, void *);
60 
61 static TmEcode DecodePcapFile(ThreadVars *, Packet *, void *);
62 static TmEcode DecodePcapFileThreadInit(ThreadVars *, const void *, void **);
63 static TmEcode DecodePcapFileThreadDeinit(ThreadVars *tv, void *data);
64 
65 static void CleanupPcapDirectoryFromThreadVars(PcapFileThreadVars *tv,
67 static void CleanupPcapFileFromThreadVars(PcapFileThreadVars *tv, PcapFileFileVars *pfv);
68 static void CleanupPcapFileThreadVars(PcapFileThreadVars *tv);
69 static TmEcode PcapFileExit(TmEcode status, struct timespec *last_processed);
70 
71 void CleanupPcapFileFromThreadVars(PcapFileThreadVars *tv, PcapFileFileVars *pfv)
72 {
74  if (tv->is_directory == 0) {
75  tv->behavior.file = NULL;
76  }
77 }
78 
79 void CleanupPcapDirectoryFromThreadVars(PcapFileThreadVars *tv, PcapFileDirectoryVars *ptv)
80 {
82  if (tv->is_directory == 1) {
83  tv->behavior.directory = NULL;
84  }
85 }
86 
87 void CleanupPcapFileThreadVars(PcapFileThreadVars *tv)
88 {
89  if(tv != NULL) {
90  if (tv->is_directory == 0) {
91  if (tv->behavior.file != NULL) {
92  CleanupPcapFileFromThreadVars(tv, tv->behavior.file);
93  }
94  tv->behavior.file = NULL;
95  } else {
96  if (tv->behavior.directory != NULL) {
97  CleanupPcapDirectoryFromThreadVars(tv, tv->behavior.directory);
98  }
99  tv->behavior.directory = NULL;
100  }
101  if (tv->shared.bpf_string != NULL) {
102  SCFree(tv->shared.bpf_string);
103  tv->shared.bpf_string = NULL;
104  }
105  SCFree(tv);
106  }
107 }
108 
109 /**
110  * Pcap File Functionality
111  */
113 {
114  tmm_modules[TMM_RECEIVEPCAPFILE].name = "ReceivePcapFile";
115  tmm_modules[TMM_RECEIVEPCAPFILE].ThreadInit = ReceivePcapFileThreadInit;
117  tmm_modules[TMM_RECEIVEPCAPFILE].PktAcqLoop = ReceivePcapFileLoop;
119  tmm_modules[TMM_RECEIVEPCAPFILE].ThreadExitPrintStats = ReceivePcapFileThreadExitStats;
120  tmm_modules[TMM_RECEIVEPCAPFILE].ThreadDeinit = ReceivePcapFileThreadDeinit;
123 }
124 
126 {
127  tmm_modules[TMM_DECODEPCAPFILE].name = "DecodePcapFile";
128  tmm_modules[TMM_DECODEPCAPFILE].ThreadInit = DecodePcapFileThreadInit;
129  tmm_modules[TMM_DECODEPCAPFILE].Func = DecodePcapFile;
131  tmm_modules[TMM_DECODEPCAPFILE].ThreadDeinit = DecodePcapFileThreadDeinit;
134 }
135 
137 {
138  memset(&pcap_g, 0x00, sizeof(pcap_g));
139  SC_ATOMIC_INIT(pcap_g.invalid_checksums);
140 }
141 
142 TmEcode PcapFileExit(TmEcode status, struct timespec *last_processed)
143 {
145  status = UnixSocketPcapFile(status, last_processed);
146  SCReturnInt(status);
147  } else {
148  EngineStop();
149  SCReturnInt(status);
150  }
151 }
152 
153 TmEcode ReceivePcapFileLoop(ThreadVars *tv, void *data, void *slot)
154 {
155  SCEnter();
156 
157  if(unlikely(data == NULL)) {
158  SCLogError(SC_ERR_INVALID_ARGUMENT, "pcap file reader thread failed to initialize");
159 
160  PcapFileExit(TM_ECODE_FAILED, NULL);
161 
163  }
164 
165  TmEcode status = TM_ECODE_OK;
166  PcapFileThreadVars *ptv = (PcapFileThreadVars *) data;
167  TmSlot *s = (TmSlot *)slot;
168 
169  ptv->shared.slot = s->slot_next;
171 
172  if(ptv->is_directory == 0) {
173  SCLogInfo("Starting file run for %s", ptv->behavior.file->filename);
174  status = PcapFileDispatch(ptv->behavior.file);
175  CleanupPcapFileFromThreadVars(ptv, ptv->behavior.file);
176  } else {
177  SCLogInfo("Starting directory run for %s", ptv->behavior.directory->filename);
179  CleanupPcapDirectoryFromThreadVars(ptv, ptv->behavior.directory);
180  }
181 
182  SCLogDebug("Pcap file loop complete with status %u", status);
183 
184  status = PcapFileExit(status, &ptv->shared.last_processed);
185  SCReturnInt(status);
186 }
187 
188 TmEcode ReceivePcapFileThreadInit(ThreadVars *tv, const void *initdata, void **data)
189 {
190  SCEnter();
191 
192  TmEcode status = TM_ECODE_OK;
193  const char *tmpstring = NULL;
194  const char *tmp_bpf_string = NULL;
195 
196  if (initdata == NULL) {
197  SCLogError(SC_ERR_INVALID_ARGUMENT, "error: initdata == NULL");
198 
200  }
201 
203  if (unlikely(ptv == NULL)) {
205  }
206  memset(ptv, 0, sizeof(PcapFileThreadVars));
207  memset(&ptv->shared.last_processed, 0, sizeof(struct timespec));
208 
209  intmax_t tenant = 0;
210  if (ConfGetInt("pcap-file.tenant-id", &tenant) == 1) {
211  if (tenant > 0 && tenant < UINT_MAX) {
212  ptv->shared.tenant_id = (uint32_t)tenant;
213  SCLogInfo("tenant %u", ptv->shared.tenant_id);
214  } else {
215  SCLogError(SC_ERR_INVALID_ARGUMENT, "tenant out of range");
216  }
217  }
218 
219  if (ConfGet("bpf-filter", &(tmp_bpf_string)) != 1) {
220  SCLogDebug("could not get bpf or none specified");
221  } else {
222  ptv->shared.bpf_string = SCStrdup(tmp_bpf_string);
223  if (unlikely(ptv->shared.bpf_string == NULL)) {
224  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate bpf_string");
225 
226  CleanupPcapFileThreadVars(ptv);
227 
229  }
230  }
231 
232  int should_delete = 0;
233  ptv->shared.should_delete = false;
234  if (ConfGetBool("pcap-file.delete-when-done", &should_delete) == 1) {
235  ptv->shared.should_delete = should_delete == 1;
236  }
237 
238  DIR *directory = NULL;
239  SCLogDebug("checking file or directory %s", (char*)initdata);
240  if(PcapDetermineDirectoryOrFile((char *)initdata, &directory) == TM_ECODE_FAILED) {
241  CleanupPcapFileThreadVars(ptv);
243  }
244 
245  if(directory == NULL) {
246  SCLogDebug("argument %s was a file", (char *)initdata);
248  if (unlikely(pv == NULL)) {
249  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate file vars");
250  CleanupPcapFileThreadVars(ptv);
252  }
253  memset(pv, 0, sizeof(PcapFileFileVars));
254 
255  pv->filename = SCStrdup((char *)initdata);
256  if (unlikely(pv->filename == NULL)) {
257  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate filename");
259  CleanupPcapFileThreadVars(ptv);
261  }
262 
263  pv->shared = &ptv->shared;
264  status = InitPcapFile(pv);
265  if(status == TM_ECODE_OK) {
266  ptv->is_directory = 0;
267  ptv->behavior.file = pv;
268  } else {
270  "Failed to init pcap file %s, skipping", pv->filename);
272  CleanupPcapFileThreadVars(ptv);
274  }
275  } else {
276  SCLogInfo("Argument %s was a directory", (char *)initdata);
278  if (unlikely(pv == NULL)) {
279  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate directory vars");
280  closedir(directory);
281  CleanupPcapFileThreadVars(ptv);
283  }
284  memset(pv, 0, sizeof(PcapFileDirectoryVars));
285 
286  pv->filename = SCStrdup((char*)initdata);
287  if (unlikely(pv->filename == NULL)) {
288  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate filename");
290  CleanupPcapFileThreadVars(ptv);
292  }
293  pv->cur_dir_depth = 0;
294 
295  int should_recurse;
296  pv->should_recurse = false;
297  if (ConfGetBool("pcap-file.recursive", &should_recurse) == 1) {
298  pv->should_recurse = (should_recurse == 1);
299  }
300 
301  int should_loop = 0;
302  pv->should_loop = false;
303  if (ConfGetBool("pcap-file.continuous", &should_loop) == 1) {
304  pv->should_loop = (should_loop == 1);
305  }
306 
307  if (pv->should_recurse == true && pv->should_loop == true) {
308  SCLogError(SC_ERR_INVALID_ARGUMENT, "Error, --pcap-file-continuous and --pcap-file-recursive "
309  "cannot be used together.");
311  CleanupPcapFileThreadVars(ptv);
313  }
314 
315  pv->delay = 30;
316  intmax_t delay = 0;
317  if (ConfGetInt("pcap-file.delay", &delay) == 1) {
318  if (delay > 0 && delay < UINT_MAX) {
319  pv->delay = (time_t)delay;
320  SCLogDebug("delay %lu", pv->delay);
321  } else {
322  SCLogError(SC_ERR_INVALID_ARGUMENT, "delay out of range");
323  }
324  }
325 
326  pv->poll_interval = 5;
327  intmax_t poll_interval = 0;
328  if (ConfGetInt("pcap-file.poll-interval", &poll_interval) == 1) {
329  if (poll_interval > 0 && poll_interval < UINT_MAX) {
330  pv->poll_interval = (time_t)poll_interval;
331  SCLogDebug("poll-interval %lu", pv->delay);
332  } else {
333  SCLogError(SC_ERR_INVALID_ARGUMENT, "poll-interval out of range");
334  }
335  }
336 
337  pv->shared = &ptv->shared;
338  pv->directory = directory;
339  TAILQ_INIT(&pv->directory_content);
340 
341  ptv->is_directory = 1;
342  ptv->behavior.directory = pv;
343  }
344 
345  if (ConfGet("pcap-file.checksum-checks", &tmpstring) != 1) {
347  } else {
348  if (strcmp(tmpstring, "auto") == 0) {
350  } else if (ConfValIsTrue(tmpstring)){
352  } else if (ConfValIsFalse(tmpstring)) {
354  }
355  }
357 
358  ptv->shared.tv = tv;
359  *data = (void *)ptv;
360 
362 }
363 
364 void ReceivePcapFileThreadExitStats(ThreadVars *tv, void *data)
365 {
366  SCEnter();
367  if(data != NULL) {
368  PcapFileThreadVars *ptv = (PcapFileThreadVars *)data;
369 
372  SC_ATOMIC_GET(pcap_g.invalid_checksums)) {
373  uint64_t chrate = pcap_g.cnt / SC_ATOMIC_GET(pcap_g.invalid_checksums);
374  if (chrate < CHECKSUM_INVALID_RATIO)
376  "1/%" PRIu64 "th of packets have an invalid checksum,"
377  " consider setting pcap-file.checksum-checks variable to no"
378  " or use '-k none' option on command line.",
379  chrate);
380  else
381  SCLogInfo("1/%" PRIu64 "th of packets have an invalid checksum",
382  chrate);
383  }
384  SCLogNotice(
385  "Pcap-file module read %" PRIu64 " files, %" PRIu64 " packets, %" PRIu64 " bytes",
386  ptv->shared.files,
387  ptv->shared.pkts,
388  ptv->shared.bytes
389  );
390  }
391 }
392 
393 TmEcode ReceivePcapFileThreadDeinit(ThreadVars *tv, void *data)
394 {
395  SCEnter();
396  if(data != NULL) {
397  PcapFileThreadVars *ptv = (PcapFileThreadVars *) data;
398  CleanupPcapFileThreadVars(ptv);
399  }
401 }
402 
403 static double prev_signaled_ts = 0;
404 
405 static TmEcode DecodePcapFile(ThreadVars *tv, Packet *p, void *data)
406 {
407  SCEnter();
409 
411 
412  /* update counters */
414 
415  double curr_ts = p->ts.tv_sec + p->ts.tv_usec / 1000.0;
416  if (curr_ts < prev_signaled_ts || (curr_ts - prev_signaled_ts) > 60.0) {
417  prev_signaled_ts = curr_ts;
418 #if 0
419  FlowWakeupFlowManagerThread();
420 #endif
421  }
422 
423  DecoderFunc decoder;
424  if(ValidateLinkType(p->datalink, &decoder) == TM_ECODE_OK) {
425 
426  /* call the decoder */
427  decoder(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p));
428 
429 #ifdef DEBUG
431 #endif
432 
434 
436  } else {
438  }
439 }
440 
441 TmEcode DecodePcapFileThreadInit(ThreadVars *tv, const void *initdata, void **data)
442 {
443  SCEnter();
444  DecodeThreadVars *dtv = NULL;
446 
447  if (dtv == NULL)
449 
451 
452  *data = (void *)dtv;
453 
455 }
456 
457 TmEcode DecodePcapFileThreadDeinit(ThreadVars *tv, void *data)
458 {
459  if (data != NULL)
460  DecodeThreadVarsFree(tv, data);
462 }
463 
465 {
466  (void) SC_ATOMIC_ADD(pcap_g.invalid_checksums, 1);
467 }
468 
469 /* eof */
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:67
PcapFileSharedVars_::slot
TmSlot * slot
Definition: source-pcap-file-helper.h:51
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:436
PcapFileThreadVars_::is_directory
bool is_directory
Definition: source-pcap-file.c:51
PcapFileDispatch
TmEcode PcapFileDispatch(PcapFileFileVars *ptv)
Main PCAP file reading Loop function.
Definition: source-pcap-file-helper.c:119
PcapFileFileVars_::filename
char * filename
Definition: source-pcap-file-helper.h:70
PcapFileSharedVars_
Definition: source-pcap-file-helper.h:41
max_pending_packets
int max_pending_packets
Definition: suricata.c:212
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:370
PcapFileGlobalVars_
Definition: source-pcap-file-helper.h:30
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:315
source-pcap-file.h
ValidateLinkType
TmEcode ValidateLinkType(int datalink, DecoderFunc *DecoderFn)
Definition: source-pcap-file-helper.c:235
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1147
PcapFileFileVars_::shared
PcapFileSharedVars * shared
Definition: source-pcap-file-helper.h:76
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:516
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
PcapFileBehaviorVar
union PcapFileBehaviorVar_ PcapFileBehaviorVar
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
util-checksum.h
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:82
PcapFileThreadVars
struct PcapFileThreadVars_ PcapFileThreadVars
PcapFileSharedVars_::should_delete
bool should_delete
Definition: source-pcap-file-helper.h:48
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
DecoderFunc
int(* DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode.h:974
CHECKSUM_SAMPLE_COUNT
#define CHECKSUM_SAMPLE_COUNT
Definition: util-checksum.h:33
PcapFileBehaviorVar_::directory
PcapFileDirectoryVars * directory
Definition: source-pcap-file.c:41
PcapFileSharedVars_::cb_result
int cb_result
Definition: source-pcap-file-helper.h:62
CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_DISABLE
Definition: decode.h:43
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:118
PcapFileDirectoryVars_::poll_interval
time_t poll_interval
Definition: source-pcap-file-directory-helper.h:49
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
PcapFileSharedVars_::files
uint64_t files
Definition: source-pcap-file-helper.h:56
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:565
PcapDetermineDirectoryOrFile
TmEcode PcapDetermineDirectoryOrFile(char *filename, DIR **directory)
Definition: source-pcap-file-directory-helper.c:169
TmModule_::PktAcqLoop
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
Definition: tm-modules.h:54
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
Packet_::datalink
int datalink
Definition: decode.h:583
TmModuleDecodePcapFileRegister
void TmModuleDecodePcapFileRegister(void)
Definition: source-pcap-file.c:125
CHECKSUM_VALIDATION_ENABLE
@ CHECKSUM_VALIDATION_ENABLE
Definition: decode.h:44
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:330
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:484
CHECKSUM_VALIDATION_AUTO
@ CHECKSUM_VALIDATION_AUTO
Definition: decode.h:45
PcapFileGlobalVars_::cnt
uint64_t cnt
Definition: source-pcap-file-helper.h:31
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:51
pcap_g
PcapFileGlobalVars pcap_g
Definition: source-pcap-file.c:34
TmModule_::PktAcqBreakLoop
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
Definition: tm-modules.h:57
PcapFileDirectoryVars_
Definition: source-pcap-file-directory-helper.h:41
TMM_RECEIVEPCAPFILE
@ TMM_RECEIVEPCAPFILE
Definition: tm-threads-common.h:39
PcapFileGlobalVars_::checksum_mode
ChecksumValidationMode checksum_mode
Definition: source-pcap-file-helper.h:33
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:231
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PcapFileThreadVars_::behavior
PcapFileBehaviorVar behavior
Definition: source-pcap-file.c:50
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:52
PcapFileDirectoryVars_::should_recurse
bool should_recurse
Definition: source-pcap-file-directory-helper.h:46
InitPcapFile
TmEcode InitPcapFile(PcapFileFileVars *pfv)
Definition: source-pcap-file-helper.c:191
source-pcap-file-directory-helper.h
RunModeUnixSocketIsActive
int RunModeUnixSocketIsActive(void)
Definition: runmode-unix-socket.c:1567
SC_ERR_INVALID_ARGUMENT
@ SC_ERR_INVALID_ARGUMENT
Definition: util-error.h:43
TmModuleReceivePcapFileRegister
void TmModuleReceivePcapFileRegister(void)
Definition: source-pcap-file.c:112
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:282
source-pcap-file-helper.h
Packet_
Definition: decode.h:414
TM_FLAG_DECODE_TM
#define TM_FLAG_DECODE_TM
Definition: tm-modules.h:32
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
TMM_DECODEPCAPFILE
@ TMM_DECODEPCAPFILE
Definition: tm-threads-common.h:41
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:230
PcapFileThreadVars_::shared
PcapFileSharedVars shared
Definition: source-pcap-file.c:53
TmSlot_
Definition: tm-threads.h:52
PcapFileFileVars_
Definition: source-pcap-file-helper.h:69
SC_ERR_INVALID_CHECKSUM
@ SC_ERR_INVALID_CHECKSUM
Definition: util-error.h:41
TmEcode
TmEcode
Definition: tm-threads-common.h:79
TmModule_::name
const char * name
Definition: tm-modules.h:44
PcapFileBehaviorVar_::file
PcapFileFileVars * file
Definition: source-pcap-file.c:42
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
TM_FLAG_RECEIVE_TM
#define TM_FLAG_RECEIVE_TM
Definition: tm-modules.h:31
CHECKSUM_INVALID_RATIO
#define CHECKSUM_INVALID_RATIO
Definition: util-checksum.h:34
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
PcapFileSharedVars_::bpf_string
char * bpf_string
Definition: source-pcap-file-helper.h:42
PcapIncreaseInvalidChecksum
void PcapIncreaseInvalidChecksum()
Definition: source-pcap-file.c:464
PcapFileDirectoryVars_::directory
DIR * directory
Definition: source-pcap-file-directory-helper.h:43
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:658
PcapFileThreadVars_
Definition: source-pcap-file.c:49
Packet_::ts
struct timeval ts
Definition: decode.h:457
flow-manager.h
suricata-common.h
PKT_SRC_FFR
@ PKT_SRC_FFR
Definition: decode.h:57
PcapFileGlobalInit
void PcapFileGlobalInit()
Definition: source-pcap-file.c:136
CleanupPcapFileDirectoryVars
void CleanupPcapFileDirectoryVars(PcapFileDirectoryVars *ptv)
Definition: source-pcap-file-directory-helper.c:104
SC_ERR_PCAP_DISPATCH
@ SC_ERR_PCAP_DISPATCH
Definition: util-error.h:50
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
PcapDirectoryDispatch
TmEcode PcapDirectoryDispatch(PcapFileDirectoryVars *ptv)
Definition: source-pcap-file-directory-helper.c:496
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
EngineStop
void EngineStop(void)
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be a...
Definition: suricata.c:391
PcapFileSharedVars_::tenant_id
uint32_t tenant_id
Definition: source-pcap-file-helper.h:44
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
TmModule_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:48
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
PcapFileSharedVars_::last_processed
struct timespec last_processed
Definition: source-pcap-file-helper.h:46
PcapFileDirectoryVars_::cur_dir_depth
uint8_t cur_dir_depth
Definition: source-pcap-file-directory-helper.h:47
PcapFileGlobalVars_::conf_checksum_mode
ChecksumValidationMode conf_checksum_mode
Definition: source-pcap-file-helper.h:32
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:555
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:631
PcapFileDirectoryVars_::delay
time_t delay
Definition: source-pcap-file-directory-helper.h:48
ConfValIsFalse
int ConfValIsFalse(const char *val)
Check if a value is false.
Definition: conf.c:590
PcapFileDirectoryVars_::shared
PcapFileSharedVars * shared
Definition: source-pcap-file-directory-helper.h:53
PcapFileDirectoryVars_::should_loop
bool should_loop
Definition: source-pcap-file-directory-helper.h:45
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:639
UnixSocketPcapFile
TmEcode UnixSocketPcapFile(TmEcode tm, struct timespec *last_processed)
Definition: runmode-unix-socket.c:600
SC_ERR_MEM_ALLOC
@ SC_ERR_MEM_ALLOC
Definition: util-error.h:31
PcapFileDirectoryVars_::filename
char * filename
Definition: source-pcap-file-directory-helper.h:42
TmSlot_::slot_next
struct TmSlot_ * slot_next
Definition: tm-threads.h:61
PcapFileSharedVars_::bytes
uint64_t bytes
Definition: source-pcap-file-helper.h:55
PcapFileBehaviorVar_
Definition: source-pcap-file.c:40
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
CleanupPcapFileFileVars
void CleanupPcapFileFileVars(PcapFileFileVars *pfv)
Definition: source-pcap-file-helper.c:36
PcapFileSharedVars_::tv
ThreadVars * tv
Definition: source-pcap-file-helper.h:50
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:232
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:70
PcapFileSharedVars_::pkts
uint64_t pkts
Definition: source-pcap-file-helper.h:54
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:605