suricata
source-pcap-file.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * File based pcap packet acquisition support
24  */
25 
26 #include "suricata-common.h"
27 #include "source-pcap-file.h"
30 #include "flow-manager.h"
31 #include "util-checksum.h"
32 #include "runmode-unix-socket.h"
33 #include "suricata.h"
34 #include "conf.h"
35 
36 extern uint16_t max_pending_packets;
38 
39 /**
40  * Union determining whether the behavior of the thread is file or directory
41  */
42 typedef union PcapFileBehaviorVar_
43 {
47 
48 /**
49  * Data specific to the thread
50  */
51 typedef struct PcapFileThreadVars_
52 {
55 
58 
59 static TmEcode ReceivePcapFileLoop(ThreadVars *, void *, void *);
60 static TmEcode ReceivePcapFileThreadInit(ThreadVars *, const void *, void **);
61 static void ReceivePcapFileThreadExitStats(ThreadVars *, void *);
62 static TmEcode ReceivePcapFileThreadDeinit(ThreadVars *, void *);
63 
64 static TmEcode DecodePcapFile(ThreadVars *, Packet *, void *);
65 static TmEcode DecodePcapFileThreadInit(ThreadVars *, const void *, void **);
66 static TmEcode DecodePcapFileThreadDeinit(ThreadVars *tv, void *data);
67 
68 static void CleanupPcapDirectoryFromThreadVars(PcapFileThreadVars *tv,
70 static void CleanupPcapFileFromThreadVars(PcapFileThreadVars *tv, PcapFileFileVars *pfv);
71 static void CleanupPcapFileThreadVars(PcapFileThreadVars *tv);
72 static TmEcode PcapFileExit(TmEcode status, struct timespec *last_processed);
73 
74 void CleanupPcapFileFromThreadVars(PcapFileThreadVars *tv, PcapFileFileVars *pfv)
75 {
77  if (tv->is_directory == 0) {
78  tv->behavior.file = NULL;
79  }
80 }
81 
82 void CleanupPcapDirectoryFromThreadVars(PcapFileThreadVars *tv, PcapFileDirectoryVars *ptv)
83 {
85  if (tv->is_directory == 1) {
86  tv->behavior.directory = NULL;
87  }
88 }
89 
90 void CleanupPcapFileThreadVars(PcapFileThreadVars *ptv)
91 {
92  if (ptv != NULL) {
93  if (ptv->is_directory == 0) {
94  if (ptv->behavior.file != NULL) {
95  CleanupPcapFileFromThreadVars(ptv, ptv->behavior.file);
96  }
97  ptv->behavior.file = NULL;
98  } else {
99  if (ptv->behavior.directory != NULL) {
100  CleanupPcapDirectoryFromThreadVars(ptv, ptv->behavior.directory);
101  }
102  ptv->behavior.directory = NULL;
103  }
104  if (ptv->shared.bpf_string != NULL) {
105  SCFree(ptv->shared.bpf_string);
106  ptv->shared.bpf_string = NULL;
107  }
108  SCFree(ptv);
109  }
110 }
111 
112 /**
113  * Pcap File Functionality
114  */
116 {
117  tmm_modules[TMM_RECEIVEPCAPFILE].name = "ReceivePcapFile";
118  tmm_modules[TMM_RECEIVEPCAPFILE].ThreadInit = ReceivePcapFileThreadInit;
120  tmm_modules[TMM_RECEIVEPCAPFILE].PktAcqLoop = ReceivePcapFileLoop;
122  tmm_modules[TMM_RECEIVEPCAPFILE].ThreadExitPrintStats = ReceivePcapFileThreadExitStats;
123  tmm_modules[TMM_RECEIVEPCAPFILE].ThreadDeinit = ReceivePcapFileThreadDeinit;
126 }
127 
129 {
130  tmm_modules[TMM_DECODEPCAPFILE].name = "DecodePcapFile";
131  tmm_modules[TMM_DECODEPCAPFILE].ThreadInit = DecodePcapFileThreadInit;
132  tmm_modules[TMM_DECODEPCAPFILE].Func = DecodePcapFile;
134  tmm_modules[TMM_DECODEPCAPFILE].ThreadDeinit = DecodePcapFileThreadDeinit;
137 }
138 
140 {
141  memset(&pcap_g, 0x00, sizeof(pcap_g));
142  SC_ATOMIC_INIT(pcap_g.invalid_checksums);
143 }
144 
145 TmEcode PcapFileExit(TmEcode status, struct timespec *last_processed)
146 {
148  status = UnixSocketPcapFile(status, last_processed);
149  SCReturnInt(status);
150  } else {
151  EngineStop();
152  SCReturnInt(status);
153  }
154 }
155 
156 TmEcode ReceivePcapFileLoop(ThreadVars *tv, void *data, void *slot)
157 {
158  SCEnter();
159 
160  if(unlikely(data == NULL)) {
161  SCLogError("pcap file reader thread failed to initialize");
162 
163  PcapFileExit(TM_ECODE_FAILED, NULL);
164 
166  }
167 
168  TmEcode status = TM_ECODE_OK;
169  PcapFileThreadVars *ptv = (PcapFileThreadVars *) data;
170  TmSlot *s = (TmSlot *)slot;
171 
172  ptv->shared.slot = s->slot_next;
174 
175  // Indicate that the thread is actually running its application level code (i.e., it can poll
176  // packets)
178 
179  if(ptv->is_directory == 0) {
180  SCLogInfo("Starting file run for %s", ptv->behavior.file->filename);
181  status = PcapFileDispatch(ptv->behavior.file);
182  CleanupPcapFileFromThreadVars(ptv, ptv->behavior.file);
183  } else {
184  SCLogInfo("Starting directory run for %s", ptv->behavior.directory->filename);
186  CleanupPcapDirectoryFromThreadVars(ptv, ptv->behavior.directory);
187  }
188 
189  SCLogDebug("Pcap file loop complete with status %u", status);
190 
191  status = PcapFileExit(status, &ptv->shared.last_processed);
192  SCReturnInt(status);
193 }
194 
195 TmEcode ReceivePcapFileThreadInit(ThreadVars *tv, const void *initdata, void **data)
196 {
197  SCEnter();
198 
199  TmEcode status = TM_ECODE_OK;
200  const char *tmpstring = NULL;
201  const char *tmp_bpf_string = NULL;
202 
203  if (initdata == NULL) {
204  SCLogError("error: initdata == NULL");
205 
207  }
208 
210  if (unlikely(ptv == NULL)) {
212  }
213  memset(&ptv->shared.last_processed, 0, sizeof(struct timespec));
214 
215  intmax_t tenant = 0;
216  if (ConfGetInt("pcap-file.tenant-id", &tenant) == 1) {
217  if (tenant > 0 && tenant < UINT_MAX) {
218  ptv->shared.tenant_id = (uint32_t)tenant;
219  SCLogInfo("tenant %u", ptv->shared.tenant_id);
220  } else {
221  SCLogError("tenant out of range");
222  }
223  }
224 
225  if (ConfGet("bpf-filter", &(tmp_bpf_string)) != 1) {
226  SCLogDebug("could not get bpf or none specified");
227  } else {
228  ptv->shared.bpf_string = SCStrdup(tmp_bpf_string);
229  if (unlikely(ptv->shared.bpf_string == NULL)) {
230  SCLogError("Failed to allocate bpf_string");
231 
232  CleanupPcapFileThreadVars(ptv);
233 
235  }
236  }
237 
238  int should_delete = 0;
239  ptv->shared.should_delete = false;
240  if (ConfGetBool("pcap-file.delete-when-done", &should_delete) == 1) {
241  ptv->shared.should_delete = should_delete == 1;
242  }
243 
244  DIR *directory = NULL;
245  SCLogDebug("checking file or directory %s", (char*)initdata);
246  if(PcapDetermineDirectoryOrFile((char *)initdata, &directory) == TM_ECODE_FAILED) {
247  CleanupPcapFileThreadVars(ptv);
249  }
250 
251  if(directory == NULL) {
252  SCLogDebug("argument %s was a file", (char *)initdata);
253  PcapFileFileVars *pv = SCCalloc(1, sizeof(PcapFileFileVars));
254  if (unlikely(pv == NULL)) {
255  SCLogError("Failed to allocate file vars");
256  CleanupPcapFileThreadVars(ptv);
258  }
259 
260  pv->filename = SCStrdup((char *)initdata);
261  if (unlikely(pv->filename == NULL)) {
262  SCLogError("Failed to allocate filename");
264  CleanupPcapFileThreadVars(ptv);
266  }
267 
268  pv->shared = &ptv->shared;
269  status = InitPcapFile(pv);
270  if(status == TM_ECODE_OK) {
271  ptv->is_directory = 0;
272  ptv->behavior.file = pv;
273  } else {
274  SCLogWarning("Failed to init pcap file %s, skipping", pv->filename);
276  CleanupPcapFileThreadVars(ptv);
278  }
279  } else {
280  SCLogInfo("Argument %s was a directory", (char *)initdata);
282  if (unlikely(pv == NULL)) {
283  SCLogError("Failed to allocate directory vars");
284  closedir(directory);
285  CleanupPcapFileThreadVars(ptv);
287  }
288 
289  pv->filename = SCStrdup((char*)initdata);
290  if (unlikely(pv->filename == NULL)) {
291  SCLogError("Failed to allocate filename");
292  closedir(directory);
294  CleanupPcapFileThreadVars(ptv);
296  }
297  pv->cur_dir_depth = 0;
298 
299  int should_recurse;
300  pv->should_recurse = false;
301  if (ConfGetBool("pcap-file.recursive", &should_recurse) == 1) {
302  pv->should_recurse = (should_recurse == 1);
303  }
304 
305  int should_loop = 0;
306  pv->should_loop = false;
307  if (ConfGetBool("pcap-file.continuous", &should_loop) == 1) {
308  pv->should_loop = (should_loop == 1);
309  }
310 
311  if (pv->should_recurse == true && pv->should_loop == true) {
312  SCLogError("Error, --pcap-file-continuous and --pcap-file-recursive "
313  "cannot be used together.");
314  closedir(directory);
316  CleanupPcapFileThreadVars(ptv);
318  }
319 
320  pv->delay = 30;
321  intmax_t delay = 0;
322  if (ConfGetInt("pcap-file.delay", &delay) == 1) {
323  if (delay > 0 && delay < UINT_MAX) {
324  pv->delay = (time_t)delay;
325  SCLogDebug("delay %lu", pv->delay);
326  } else {
327  SCLogError("delay out of range");
328  }
329  }
330 
331  pv->poll_interval = 5;
332  intmax_t poll_interval = 0;
333  if (ConfGetInt("pcap-file.poll-interval", &poll_interval) == 1) {
334  if (poll_interval > 0 && poll_interval < UINT_MAX) {
335  pv->poll_interval = (time_t)poll_interval;
336  SCLogDebug("poll-interval %lu", pv->delay);
337  } else {
338  SCLogError("poll-interval out of range");
339  }
340  }
341 
342  pv->shared = &ptv->shared;
343  pv->directory = directory;
344  TAILQ_INIT(&pv->directory_content);
345 
346  ptv->is_directory = 1;
347  ptv->behavior.directory = pv;
348  }
349 
350  if (ConfGet("pcap-file.checksum-checks", &tmpstring) != 1) {
352  } else {
353  if (strcmp(tmpstring, "auto") == 0) {
355  } else if (ConfValIsTrue(tmpstring)){
357  } else if (ConfValIsFalse(tmpstring)) {
359  }
360  }
362 
363  ptv->shared.tv = tv;
364  *data = (void *)ptv;
365 
367 }
368 
369 void ReceivePcapFileThreadExitStats(ThreadVars *tv, void *data)
370 {
371  SCEnter();
372  if(data != NULL) {
373  PcapFileThreadVars *ptv = (PcapFileThreadVars *)data;
374 
377  SC_ATOMIC_GET(pcap_g.invalid_checksums)) {
378  uint64_t chrate = pcap_g.cnt / SC_ATOMIC_GET(pcap_g.invalid_checksums);
379  if (chrate < CHECKSUM_INVALID_RATIO)
380  SCLogWarning("1/%" PRIu64 "th of packets have an invalid checksum,"
381  " consider setting pcap-file.checksum-checks variable to no"
382  " or use '-k none' option on command line.",
383  chrate);
384  else
385  SCLogInfo("1/%" PRIu64 "th of packets have an invalid checksum",
386  chrate);
387  }
388  SCLogNotice("read %" PRIu64 " file%s, %" PRIu64 " packets, %" PRIu64 " bytes",
389  ptv->shared.files, ptv->shared.files == 1 ? "" : "s", ptv->shared.pkts,
390  ptv->shared.bytes);
391  }
392 }
393 
394 TmEcode ReceivePcapFileThreadDeinit(ThreadVars *tv, void *data)
395 {
396  SCEnter();
397  if(data != NULL) {
398  PcapFileThreadVars *ptv = (PcapFileThreadVars *) data;
399  CleanupPcapFileThreadVars(ptv);
400  }
402 }
403 
404 static TmEcode DecodePcapFile(ThreadVars *tv, Packet *p, void *data)
405 {
406  SCEnter();
408 
410 
411  /* update counters */
413 
414  DecoderFunc decoder;
415  if(ValidateLinkType(p->datalink, &decoder) == TM_ECODE_OK) {
416 
417  /* call the decoder */
418  decoder(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p));
419 
420 #ifdef DEBUG
422 #endif
423 
425 
427  } else {
429  }
430 }
431 
432 TmEcode DecodePcapFileThreadInit(ThreadVars *tv, const void *initdata, void **data)
433 {
434  SCEnter();
435  DecodeThreadVars *dtv = NULL;
437 
438  if (dtv == NULL)
440 
442 
443  *data = (void *)dtv;
444 
446 }
447 
448 TmEcode DecodePcapFileThreadDeinit(ThreadVars *tv, void *data)
449 {
450  if (data != NULL)
451  DecodeThreadVarsFree(tv, data);
453 }
454 
456 {
457  (void) SC_ATOMIC_ADD(pcap_g.invalid_checksums, 1);
458 }
459 
460 /* eof */
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:74
PcapFileSharedVars_::slot
TmSlot * slot
Definition: source-pcap-file-helper.h:51
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:399
max_pending_packets
uint16_t max_pending_packets
Definition: suricata.c:183
PcapFileThreadVars_::is_directory
bool is_directory
Definition: source-pcap-file.c:54
PcapFileDispatch
TmEcode PcapFileDispatch(PcapFileFileVars *ptv)
Main PCAP file reading Loop function.
Definition: source-pcap-file-helper.c:126
PcapFileFileVars_::filename
char * filename
Definition: source-pcap-file-helper.h:70
PcapFileSharedVars_
Definition: source-pcap-file-helper.h:41
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:262
PcapFileGlobalVars_
Definition: source-pcap-file-helper.h:30
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:314
source-pcap-file.h
ValidateLinkType
TmEcode ValidateLinkType(int datalink, DecoderFunc *DecoderFn)
Definition: source-pcap-file-helper.c:241
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1330
PcapFileFileVars_::shared
PcapFileSharedVars * shared
Definition: source-pcap-file-helper.h:76
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:483
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
PcapFileBehaviorVar
union PcapFileBehaviorVar_ PcapFileBehaviorVar
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
TmThreadsSetFlag
void TmThreadsSetFlag(ThreadVars *tv, uint32_t flag)
Set a thread flag.
Definition: tm-threads.c:99
util-checksum.h
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:86
PcapFileThreadVars
struct PcapFileThreadVars_ PcapFileThreadVars
PcapFileSharedVars_::should_delete
bool should_delete
Definition: source-pcap-file-helper.h:48
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:332
THV_RUNNING
#define THV_RUNNING
Definition: threadvars.h:54
DecoderFunc
int(* DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode.h:1153
CHECKSUM_SAMPLE_COUNT
#define CHECKSUM_SAMPLE_COUNT
Definition: util-checksum.h:35
PcapFileBehaviorVar_::directory
PcapFileDirectoryVars * directory
Definition: source-pcap-file.c:44
PcapFileSharedVars_::cb_result
int cb_result
Definition: source-pcap-file-helper.h:62
CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_DISABLE
Definition: decode.h:46
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:206
PcapFileDirectoryVars_::poll_interval
time_t poll_interval
Definition: source-pcap-file-directory-helper.h:49
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
runmode-unix-socket.h
PcapFileSharedVars_::files
uint64_t files
Definition: source-pcap-file-helper.h:56
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:537
PcapDetermineDirectoryOrFile
TmEcode PcapDetermineDirectoryOrFile(char *filename, DIR **directory)
Definition: source-pcap-file-directory-helper.c:172
TmModule_::PktAcqLoop
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
Definition: tm-modules.h:55
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:50
Packet_::datalink
int datalink
Definition: decode.h:622
TmModuleDecodePcapFileRegister
void TmModuleDecodePcapFileRegister(void)
Definition: source-pcap-file.c:128
CHECKSUM_VALIDATION_ENABLE
@ CHECKSUM_VALIDATION_ENABLE
Definition: decode.h:47
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:602
CHECKSUM_VALIDATION_AUTO
@ CHECKSUM_VALIDATION_AUTO
Definition: decode.h:48
PcapFileGlobalVars_::cnt
uint64_t cnt
Definition: source-pcap-file-helper.h:31
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:55
pcap_g
PcapFileGlobalVars pcap_g
Definition: source-pcap-file.c:37
TmModule_::PktAcqBreakLoop
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
Definition: tm-modules.h:58
PcapFileDirectoryVars_
Definition: source-pcap-file-directory-helper.h:41
TMM_RECEIVEPCAPFILE
@ TMM_RECEIVEPCAPFILE
Definition: tm-threads-common.h:39
PcapFileGlobalVars_::checksum_mode
ChecksumValidationMode checksum_mode
Definition: source-pcap-file-helper.h:33
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:214
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PcapFileThreadVars_::behavior
PcapFileBehaviorVar behavior
Definition: source-pcap-file.c:53
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:53
PcapFileDirectoryVars_::should_recurse
bool should_recurse
Definition: source-pcap-file-directory-helper.h:46
InitPcapFile
TmEcode InitPcapFile(PcapFileFileVars *pfv)
Definition: source-pcap-file-helper.c:196
source-pcap-file-directory-helper.h
RunModeUnixSocketIsActive
int RunModeUnixSocketIsActive(void)
Definition: runmode-unix-socket.c:1700
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
TmModuleReceivePcapFileRegister
void TmModuleReceivePcapFileRegister(void)
Definition: source-pcap-file.c:115
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
source-pcap-file-helper.h
Packet_
Definition: decode.h:482
TM_FLAG_DECODE_TM
#define TM_FLAG_DECODE_TM
Definition: tm-modules.h:33
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
TMM_DECODEPCAPFILE
@ TMM_DECODEPCAPFILE
Definition: tm-threads-common.h:41
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:213
PcapFileThreadVars_::shared
PcapFileSharedVars shared
Definition: source-pcap-file.c:56
conf.h
TmSlot_
Definition: tm-threads.h:53
PcapFileFileVars_
Definition: source-pcap-file-helper.h:69
TmEcode
TmEcode
Definition: tm-threads-common.h:83
PcapIncreaseInvalidChecksum
void PcapIncreaseInvalidChecksum(void)
Definition: source-pcap-file.c:455
TmModule_::name
const char * name
Definition: tm-modules.h:45
PcapFileBehaviorVar_::file
PcapFileFileVars * file
Definition: source-pcap-file.c:45
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
TM_FLAG_RECEIVE_TM
#define TM_FLAG_RECEIVE_TM
Definition: tm-modules.h:32
CHECKSUM_INVALID_RATIO
#define CHECKSUM_INVALID_RATIO
Definition: util-checksum.h:36
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
PcapFileSharedVars_::bpf_string
char * bpf_string
Definition: source-pcap-file-helper.h:42
PcapFileDirectoryVars_::directory
DIR * directory
Definition: source-pcap-file-directory-helper.h:43
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:790
PcapFileThreadVars_
Definition: source-pcap-file.c:52
flow-manager.h
suricata-common.h
PKT_SRC_FFR
@ PKT_SRC_FFR
Definition: decode.h:61
CleanupPcapFileDirectoryVars
void CleanupPcapFileDirectoryVars(PcapFileDirectoryVars *ptv)
Definition: source-pcap-file-directory-helper.c:107
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:48
PcapDirectoryDispatch
TmEcode PcapDirectoryDispatch(PcapFileDirectoryVars *ptv)
Definition: source-pcap-file-directory-helper.c:477
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
EngineStop
void EngineStop(void)
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be a...
Definition: suricata.c:448
PcapFileSharedVars_::tenant_id
uint32_t tenant_id
Definition: source-pcap-file-helper.h:44
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
TmModule_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:49
PcapFileSharedVars_::last_processed
struct timespec last_processed
Definition: source-pcap-file-helper.h:46
PcapFileDirectoryVars_::cur_dir_depth
uint8_t cur_dir_depth
Definition: source-pcap-file-directory-helper.h:47
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
PcapFileGlobalVars_::conf_checksum_mode
ChecksumValidationMode conf_checksum_mode
Definition: source-pcap-file-helper.h:32
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:594
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:946
PcapFileDirectoryVars_::delay
time_t delay
Definition: source-pcap-file-directory-helper.h:48
ConfValIsFalse
int ConfValIsFalse(const char *val)
Check if a value is false.
Definition: conf.c:562
PcapFileDirectoryVars_::shared
PcapFileSharedVars * shared
Definition: source-pcap-file-directory-helper.h:53
PcapFileDirectoryVars_::should_loop
bool should_loop
Definition: source-pcap-file-directory-helper.h:45
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:772
UnixSocketPcapFile
TmEcode UnixSocketPcapFile(TmEcode tm, struct timespec *last_processed)
Definition: runmode-unix-socket.c:593
PcapFileGlobalInit
void PcapFileGlobalInit(void)
Definition: source-pcap-file.c:139
suricata.h
PcapFileDirectoryVars_::filename
char * filename
Definition: source-pcap-file-directory-helper.h:42
TmSlot_::slot_next
struct TmSlot_ * slot_next
Definition: tm-threads.h:62
PcapFileSharedVars_::bytes
uint64_t bytes
Definition: source-pcap-file-helper.h:55
PcapFileBehaviorVar_
Definition: source-pcap-file.c:43
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
CleanupPcapFileFileVars
void CleanupPcapFileFileVars(PcapFileFileVars *pfv)
Definition: source-pcap-file-helper.c:39
PcapFileSharedVars_::tv
ThreadVars * tv
Definition: source-pcap-file-helper.h:50
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:237
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:77
PcapFileSharedVars_::pkts
uint64_t pkts
Definition: source-pcap-file-helper.h:54
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:738