suricata
source-pcap.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "packet-queue.h"
#include "threads.h"
#include "threadvars.h"
#include "tm-queuehandlers.h"
#include "tm-threads.h"
#include "source-pcap.h"
#include "conf.h"
#include "util-debug.h"
#include "util-error.h"
#include "util-privs.h"
#include "util-device.h"
#include "util-optimize.h"
#include "util-checksum.h"
#include "util-ioctl.h"
#include "tmqh-packetpool.h"
Include dependency graph for source-pcap.c:

Go to the source code of this file.

Data Structures

struct  PcapThreadVars_
 Structure to hold thread specific variables. More...
 

Macros

#define PCAP_STATE_DOWN   0
 
#define PCAP_STATE_UP   1
 
#define PCAP_RECONNECT_TIMEOUT   500000
 

Typedefs

typedef struct PcapThreadVars_ PcapThreadVars
 Structure to hold thread specific variables. More...
 

Functions

TmEcode ReceivePcapThreadInit (ThreadVars *tv, const void *initdata, void **data)
 Init function for ReceivePcap. More...
 
void ReceivePcapThreadExitStats (ThreadVars *tv, void *data)
 This function prints stats to the screen at exit. More...
 
TmEcode ReceivePcapThreadDeinit (ThreadVars *tv, void *data)
 DeInit function closes pcap_handle at exit. More...
 
TmEcode ReceivePcapLoop (ThreadVars *tv, void *data, void *slot)
 Main PCAP reading Loop function. More...
 
TmEcode ReceivePcapBreakLoop (ThreadVars *tv, void *data)
 PCAP Break Loop function. More...
 
TmEcode DecodePcapThreadInit (ThreadVars *, const void *, void **)
 
TmEcode DecodePcapThreadDeinit (ThreadVars *tv, void *data)
 
TmEcode DecodePcap (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 This function passes off to link type decoders. More...
 
void TmModuleReceivePcapRegister (void)
 Registration Function for RecievePcap. More...
 
void TmModuleDecodePcapRegister (void)
 Registration Function for DecodePcap. More...
 
void PcapTranslateIPToDevice (char *pcap_dev, size_t len)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Live pcap packet acquisition support

Definition in file source-pcap.c.

Macro Definition Documentation

#define PCAP_RECONNECT_TIMEOUT   500000

Definition at line 48 of file source-pcap.c.

Referenced by ReceivePcapLoop().

#define PCAP_STATE_DOWN   0

Definition at line 45 of file source-pcap.c.

Referenced by TmModuleDecodePcapRegister().

#define PCAP_STATE_UP   1

Definition at line 46 of file source-pcap.c.

Referenced by ReceivePcapThreadInit(), and TmModuleDecodePcapRegister().

Typedef Documentation

Structure to hold thread specific variables.

Function Documentation

TmEcode DecodePcap ( ThreadVars tv,
Packet p,
void *  data,
PacketQueue pq,
PacketQueue postpq 
)

This function passes off to link type decoders.

DecodePcap reads packets from the PacketQueue and passes them off to the proper link type decoder.

Parameters
tpointer to ThreadVars
ppointer to the current packet
datapointer that gets cast into PcapThreadVars for ptv
pqpointer to the current PacketQueue

Definition at line 555 of file source-pcap.c.

References Packet_::datalink, DecodeEthernet(), DecodeNull(), DecodePPP(), DecodeRaw(), DecodeSll(), DecodeUpdatePacketCounters(), Packet_::flags, GET_PKT_DATA, GET_PKT_LEN, LINKTYPE_ETHERNET, LINKTYPE_GRE_OVER_IP, LINKTYPE_LINUX_SLL, LINKTYPE_NULL, LINKTYPE_PPP, LINKTYPE_RAW, PacketDecodeFinalize(), PKT_PSEUDO_STREAM_END, SC_ERR_DATALINK_UNIMPLEMENTED, SCEnter, SCLogError, SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleDecodePcapRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodePcapThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 613 of file source-pcap.c.

References DecodeThreadVarsFree(), SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleDecodePcapRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodePcapThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Definition at line 596 of file source-pcap.c.

References DecodeRegisterPerfCounters(), DecodeThreadVarsAlloc(), SCEnter, SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleDecodePcapRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void PcapTranslateIPToDevice ( char *  pcap_dev,
size_t  len 
)

Definition at line 620 of file source-pcap.c.

References strlcpy().

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceivePcapBreakLoop ( ThreadVars tv,
void *  data 
)

PCAP Break Loop function.

Definition at line 305 of file source-pcap.c.

References PcapThreadVars_::pcap_handle, SCEnter, SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleReceivePcapRegister().

Here is the caller graph for this function:

TmEcode ReceivePcapLoop ( ThreadVars tv,
void *  data,
void *  slot 
)

Main PCAP reading Loop function.

Definition at line 243 of file source-pcap.c.

References PcapThreadVars_::cb_result, PacketPoolWait(), PcapThreadVars_::pcap_handle, PCAP_RECONNECT_TIMEOUT, SC_ERR_PCAP_DISPATCH, SCEnter, SCLogError, SCReturnInt, PcapThreadVars_::slot, TmSlot_::slot_next, StatsSyncCountersIfSignalled, suricata_ctl_flags, SURICATA_STOP, TM_ECODE_FAILED, TM_ECODE_OK, and unlikely.

Referenced by TmModuleReceivePcapRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceivePcapThreadDeinit ( ThreadVars tv,
void *  data 
)

DeInit function closes pcap_handle at exit.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PcapThreadVars for ptv

Definition at line 536 of file source-pcap.c.

References PcapThreadVars_::pcap_handle, SCReturnInt, and TM_ECODE_OK.

void ReceivePcapThreadExitStats ( ThreadVars tv,
void *  data 
)

This function prints stats to the screen at exit.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PcapThreadVars for ptv

Definition at line 502 of file source-pcap.c.

References PcapThreadVars_::bytes, ThreadVars_::name, PcapThreadVars_::pcap_handle, PcapThreadVars_::pkts, SC_ERR_STAT, SCEnter, SCLogError, and SCLogInfo.

Referenced by TmModuleReceivePcapRegister().

Here is the caller graph for this function:

TmEcode ReceivePcapThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Init function for ReceivePcap.

This is a setup function for recieving packets via libpcap. There are two versions of this function depending on the major version of libpcap used. For versions prior to 1.x we use open_pcap_live, for versions 1.x and greater we use pcap_create + pcap_activate.

Parameters
tvpointer to ThreadVars
initdatapointer to the interface passed from the user
datapointer gets populated with PcapThreadVars
Todo:
Create a general pcap setup function.

Definition at line 331 of file source-pcap.c.

References PcapIfaceConfig_::bpf_filter, PcapThreadVars_::bpf_filter, PcapIfaceConfig_::buffer_size, PcapThreadVars_::capture_kernel_drops, PcapThreadVars_::capture_kernel_ifdrops, PcapThreadVars_::capture_kernel_packets, PcapIfaceConfig_::checksum_mode, PcapThreadVars_::checksum_mode, CHECKSUM_SAMPLE_COUNT, CHECKSUM_VALIDATION_AUTO, PcapThreadVars_::datalink, PcapIfaceConfig_::DerefFunc, DisableIfaceOffloading(), PcapThreadVars_::filter, GetIfaceMaxPacketSize(), GetIfaceOffloading(), PcapIfaceConfig_::iface, LIBPCAP_COPYWAIT, PcapThreadVars_::livedev, LiveGetDevice(), LiveGetOffload(), PcapThreadVars_::pcap_buffer_size, PcapThreadVars_::pcap_handle, PcapThreadVars_::pcap_snaplen, PcapThreadVars_::pcap_state, PCAP_STATE_UP, PcapIfaceConfig_::promisc, SC_ERR_BPF, SC_ERR_INVALID_ARGUMENT, SC_ERR_INVALID_VALUE, SC_ERR_PCAP_ACTIVATE_HANDLE, SC_ERR_PCAP_CREATE, SC_ERR_PCAP_SET_BUFF_SIZE, SC_ERR_PCAP_SET_PROMISC, SC_ERR_PCAP_SET_SNAPLEN, SC_ERR_PCAP_SET_TIMEOUT, SCEnter, SCFree, SCLogError, SCLogInfo, SCMalloc, SCMutexLock, SCMutexUnlock, SCReturnInt, PcapIfaceConfig_::snaplen, StatsRegisterCounter(), TM_ECODE_FAILED, TM_ECODE_OK, PcapThreadVars_::tv, unlikely, and xstr.

Referenced by TmModuleReceivePcapRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void TmModuleDecodePcapRegister ( void  )

Registration Function for DecodePcap.

Todo:
Unit tests are needed for this module.

Definition at line 129 of file source-pcap.c.

References PcapThreadVars_::bpf_filter, PcapThreadVars_::bytes, TmModule_::cap_flags, PcapThreadVars_::capture_kernel_drops, PcapThreadVars_::capture_kernel_ifdrops, PcapThreadVars_::capture_kernel_packets, PcapThreadVars_::cb_result, PcapThreadVars_::checksum_mode, CHECKSUM_VALIDATION_AUTO, CHECKSUM_VALIDATION_DISABLE, ChecksumAutoModeCheck(), PcapThreadVars_::datalink, Packet_::datalink, DecodePcap(), DecodePcapThreadDeinit(), DecodePcapThreadInit(), PcapThreadVars_::filter, TmModule_::flags, Packet_::flags, TmModule_::Func, LiveDevice_::ignore_checksum, PcapThreadVars_::last_stats_dump, likely, PcapThreadVars_::livedev, Packet_::livedev, TmModule_::name, PacketCopyData(), PacketGetFromQueueOrAlloc(), PcapThreadVars_::pcap_handle, PcapThreadVars_::pcap_state, PCAP_STATE_DOWN, PCAP_STATE_UP, PKT_IGNORE_CHECKSUM, PKT_SET_SRC, PKT_SRC_WIRE, PcapThreadVars_::pkts, TmModule_::RegisterTests, SC_ATOMIC_ADD, SC_ATOMIC_GET, SC_ATOMIC_SET, SC_ERR_BPF, SCEnter, SCLogDebug, SCLogError, SCLogInfo, SCReturn, PcapThreadVars_::slot, StatsSetUI64(), TmModule_::ThreadDeinit, TmModule_::ThreadExitPrintStats, TmModule_::ThreadInit, TimeGet(), TM_ECODE_FAILED, TM_ECODE_OK, TM_FLAG_DECODE_TM, TMM_DECODEPCAP, tmm_modules, TmqhOutputPacketpool(), Packet_::ts, PcapThreadVars_::tv, and unlikely.

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

void TmModuleReceivePcapRegister ( void  )