suricata
source-pcap.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Live pcap packet acquisition support
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 #include "decode.h"
29 #include "packet-queue.h"
30 #include "threads.h"
31 #include "threadvars.h"
32 #include "tm-queuehandlers.h"
33 #include "tm-threads.h"
34 #include "source-pcap.h"
35 #include "conf.h"
36 #include "util-debug.h"
37 #include "util-error.h"
38 #include "util-privs.h"
39 #include "util-device.h"
40 #include "util-optimize.h"
41 #include "util-checksum.h"
42 #include "util-ioctl.h"
43 #include "tmqh-packetpool.h"
44 
45 #define PCAP_STATE_DOWN 0
46 #define PCAP_STATE_UP 1
47 
48 #define PCAP_RECONNECT_TIMEOUT 500000
49 
50 /**
51  * \brief Structure to hold thread specific variables.
52  */
53 typedef struct PcapThreadVars_
54 {
55  /* thread specific handle */
56  pcap_t *pcap_handle;
57  /* handle state */
58  unsigned char pcap_state;
59  /* thread specific bpf */
61  /* ptr to string from config */
62  const char *bpf_filter;
63 
65 
66  /* data link type for the thread */
67  int datalink;
68 
69  /* counters */
70  uint32_t pkts;
71  uint64_t bytes;
72  uint32_t errs;
73 
77 
80 
81  /** callback result -- set if one of the thread module failed. */
82  int cb_result;
83 
84  /* pcap buffer size */
87 
89 
92 
93 TmEcode ReceivePcapThreadInit(ThreadVars *, const void *, void **);
96 TmEcode ReceivePcapLoop(ThreadVars *tv, void *data, void *slot);
98 
99 TmEcode DecodePcapThreadInit(ThreadVars *, const void *, void **);
102 
103 /** protect pcap_compile and pcap_setfilter, as they are not thread safe:
104  * http://seclists.org/tcpdump/2009/q1/62 */
105 static SCMutex pcap_bpf_compile_lock = SCMUTEX_INITIALIZER;
106 
107 /**
108  * \brief Registration Function for RecievePcap.
109  * \todo Unit tests are needed for this module.
110  */
112 {
113  tmm_modules[TMM_RECEIVEPCAP].name = "ReceivePcap";
123 }
124 
125 /**
126  * \brief Registration Function for DecodePcap.
127  * \todo Unit tests are needed for this module.
128  */
130 {
131  tmm_modules[TMM_DECODEPCAP].name = "DecodePcap";
139 }
140 
141 static inline void PcapDumpCounters(PcapThreadVars *ptv)
142 {
143  struct pcap_stat pcap_s;
144  if (likely((pcap_stats(ptv->pcap_handle, &pcap_s) >= 0))) {
145  StatsSetUI64(ptv->tv, ptv->capture_kernel_packets, pcap_s.ps_recv);
146  StatsSetUI64(ptv->tv, ptv->capture_kernel_drops, pcap_s.ps_drop);
147  (void) SC_ATOMIC_SET(ptv->livedev->drop, pcap_s.ps_drop);
148  StatsSetUI64(ptv->tv, ptv->capture_kernel_ifdrops, pcap_s.ps_ifdrop);
149  }
150 }
151 
152 static int PcapTryReopen(PcapThreadVars *ptv)
153 {
154  int pcap_activate_r;
155 
157  pcap_activate_r = pcap_activate(ptv->pcap_handle);
158  if (pcap_activate_r != 0) {
159  return pcap_activate_r;
160  }
161  /* set bpf filter if we have one */
162  if (ptv->bpf_filter != NULL) {
163  if(pcap_compile(ptv->pcap_handle,&ptv->filter,(char *)ptv->bpf_filter,1,0) < 0) {
164  SCLogError(SC_ERR_BPF,"bpf compilation error %s",pcap_geterr(ptv->pcap_handle));
165  return -1;
166  }
167 
168  if(pcap_setfilter(ptv->pcap_handle,&ptv->filter) < 0) {
169  SCLogError(SC_ERR_BPF,"could not set bpf filter %s",pcap_geterr(ptv->pcap_handle));
170  return -1;
171  }
172  }
173 
174  SCLogInfo("Recovering interface listening");
175  ptv->pcap_state = PCAP_STATE_UP;
176  return 0;
177 }
178 
179 static void PcapCallbackLoop(char *user, struct pcap_pkthdr *h, u_char *pkt)
180 {
181  SCEnter();
182 
183  PcapThreadVars *ptv = (PcapThreadVars *)user;
185  struct timeval current_time;
186 
187  if (unlikely(p == NULL)) {
188  SCReturn;
189  }
190 
192  p->ts.tv_sec = h->ts.tv_sec;
193  p->ts.tv_usec = h->ts.tv_usec;
194  SCLogDebug("p->ts.tv_sec %"PRIuMAX"", (uintmax_t)p->ts.tv_sec);
195  p->datalink = ptv->datalink;
196 
197  ptv->pkts++;
198  ptv->bytes += h->caplen;
199  (void) SC_ATOMIC_ADD(ptv->livedev->pkts, 1);
200  p->livedev = ptv->livedev;
201 
202  if (unlikely(PacketCopyData(p, pkt, h->caplen))) {
203  TmqhOutputPacketpool(ptv->tv, p);
204  SCReturn;
205  }
206 
207  switch (ptv->checksum_mode) {
209  if (ptv->livedev->ignore_checksum) {
211  } else if (ChecksumAutoModeCheck(ptv->pkts,
212  SC_ATOMIC_GET(ptv->livedev->pkts),
213  SC_ATOMIC_GET(ptv->livedev->invalid_checksums))) {
214  ptv->livedev->ignore_checksum = 1;
216  }
217  break;
220  break;
221  default:
222  break;
223  }
224 
225  if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) {
226  pcap_breakloop(ptv->pcap_handle);
227  ptv->cb_result = TM_ECODE_FAILED;
228  }
229 
230  /* Trigger one dump of stats every second */
231  TimeGet(&current_time);
232  if (current_time.tv_sec != ptv->last_stats_dump) {
233  PcapDumpCounters(ptv);
234  ptv->last_stats_dump = current_time.tv_sec;
235  }
236 
237  SCReturn;
238 }
239 
240 /**
241  * \brief Main PCAP reading Loop function
242  */
244 {
245  SCEnter();
246 
247  int packet_q_len = 64;
248  PcapThreadVars *ptv = (PcapThreadVars *)data;
249  int r;
250  TmSlot *s = (TmSlot *)slot;
251 
252  ptv->slot = s->slot_next;
253  ptv->cb_result = TM_ECODE_OK;
254 
255  while (1) {
258  }
259 
260  /* make sure we have at least one packet in the packet pool, to prevent
261  * us from alloc'ing packets at line rate */
262  PacketPoolWait();
263 
264  /* Right now we just support reading packets one at a time. */
265  r = pcap_dispatch(ptv->pcap_handle, packet_q_len,
266  (pcap_handler)PcapCallbackLoop, (u_char *)ptv);
267  if (unlikely(r < 0)) {
268  int dbreak = 0;
269  SCLogError(SC_ERR_PCAP_DISPATCH, "error code %" PRId32 " %s",
270  r, pcap_geterr(ptv->pcap_handle));
271 #ifdef PCAP_ERROR_BREAK
272  if (r == PCAP_ERROR_BREAK) {
273  SCReturnInt(ptv->cb_result);
274  }
275 #endif
276  do {
277  usleep(PCAP_RECONNECT_TIMEOUT);
278  if (suricata_ctl_flags != 0) {
279  dbreak = 1;
280  break;
281  }
282  r = PcapTryReopen(ptv);
283  } while (r < 0);
284  if (dbreak) {
285  break;
286  }
287  } else if (ptv->cb_result == TM_ECODE_FAILED) {
288  SCLogError(SC_ERR_PCAP_DISPATCH, "Pcap callback PcapCallbackLoop failed");
290  } else if (unlikely(r == 0)) {
291  TmThreadsCaptureInjectPacket(tv, ptv->slot, NULL);
292  }
293 
295  }
296 
297  PcapDumpCounters(ptv);
300 }
301 
302 /**
303  * \brief PCAP Break Loop function.
304  */
306 {
307  SCEnter();
308  PcapThreadVars *ptv = (PcapThreadVars *)data;
309  if (ptv->pcap_handle == NULL) {
311  }
312  pcap_breakloop(ptv->pcap_handle);
314 }
315 
316 /**
317  * \brief Init function for ReceivePcap.
318  *
319  * This is a setup function for recieving packets
320  * via libpcap. There are two versions of this function
321  * depending on the major version of libpcap used.
322  * For versions prior to 1.x we use open_pcap_live,
323  * for versions 1.x and greater we use pcap_create + pcap_activate.
324  *
325  * \param tv pointer to ThreadVars
326  * \param initdata pointer to the interface passed from the user
327  * \param data pointer gets populated with PcapThreadVars
328  *
329  * \todo Create a general pcap setup function.
330  */
331 TmEcode ReceivePcapThreadInit(ThreadVars *tv, const void *initdata, void **data)
332 {
333  SCEnter();
334  PcapIfaceConfig *pcapconfig = (PcapIfaceConfig *)initdata;
335 
336  if (initdata == NULL) {
337  SCLogError(SC_ERR_INVALID_ARGUMENT, "initdata == NULL");
339  }
340 
341  PcapThreadVars *ptv = SCMalloc(sizeof(PcapThreadVars));
342  if (unlikely(ptv == NULL)) {
343  pcapconfig->DerefFunc(pcapconfig);
345  }
346  memset(ptv, 0, sizeof(PcapThreadVars));
347 
348  ptv->tv = tv;
349 
350  ptv->livedev = LiveGetDevice(pcapconfig->iface);
351  if (ptv->livedev == NULL) {
352  SCLogError(SC_ERR_INVALID_VALUE, "Unable to find Live device");
353  SCFree(ptv);
355  }
356 
357  SCLogInfo("using interface %s", (char *)pcapconfig->iface);
358 
359  if (LiveGetOffload() == 0) {
360  (void)GetIfaceOffloading((char *)pcapconfig->iface, 1, 1);
361  } else {
362  DisableIfaceOffloading(ptv->livedev, 1, 1);
363  }
364 
365  ptv->checksum_mode = pcapconfig->checksum_mode;
367  SCLogInfo("Running in 'auto' checksum mode. Detection of interface state will require "
368  xstr(CHECKSUM_SAMPLE_COUNT) " packets.");
369  }
370 
371  /* XXX create a general pcap setup function */
372  char errbuf[PCAP_ERRBUF_SIZE];
373  ptv->pcap_handle = pcap_create((char *)pcapconfig->iface, errbuf);
374  if (ptv->pcap_handle == NULL) {
375  if (strlen(errbuf)) {
376  SCLogError(SC_ERR_PCAP_CREATE, "Couldn't create a new pcap handler for %s, error %s",
377  (char *)pcapconfig->iface, errbuf);
378  } else {
379  SCLogError(SC_ERR_PCAP_CREATE, "Couldn't create a new pcap handler for %s",
380  (char *)pcapconfig->iface);
381  }
382  SCFree(ptv);
383  pcapconfig->DerefFunc(pcapconfig);
385  }
386 
387  if (pcapconfig->snaplen == 0) {
388  /* We set snaplen if we can get the MTU */
389  ptv->pcap_snaplen = GetIfaceMaxPacketSize(pcapconfig->iface);
390  } else {
391  ptv->pcap_snaplen = pcapconfig->snaplen;
392  }
393  if (ptv->pcap_snaplen > 0) {
394  /* set Snaplen. Must be called before pcap_activate */
395  int pcap_set_snaplen_r = pcap_set_snaplen(ptv->pcap_handle, ptv->pcap_snaplen);
396  if (pcap_set_snaplen_r != 0) {
397  SCLogError(SC_ERR_PCAP_SET_SNAPLEN, "Couldn't set snaplen, error: %s", pcap_geterr(ptv->pcap_handle));
398  SCFree(ptv);
399  pcapconfig->DerefFunc(pcapconfig);
401  }
402  SCLogInfo("Set snaplen to %d for '%s'", ptv->pcap_snaplen,
403  pcapconfig->iface);
404  }
405 
406  /* set Promisc, and Timeout. Must be called before pcap_activate */
407  int pcap_set_promisc_r = pcap_set_promisc(ptv->pcap_handle, pcapconfig->promisc);
408  //printf("ReceivePcapThreadInit: pcap_set_promisc(%p) returned %" PRId32 "\n", ptv->pcap_handle, pcap_set_promisc_r);
409  if (pcap_set_promisc_r != 0) {
410  SCLogError(SC_ERR_PCAP_SET_PROMISC, "Couldn't set promisc mode, error %s", pcap_geterr(ptv->pcap_handle));
411  SCFree(ptv);
412  pcapconfig->DerefFunc(pcapconfig);
414  }
415 
416  int pcap_set_timeout_r = pcap_set_timeout(ptv->pcap_handle,LIBPCAP_COPYWAIT);
417  //printf("ReceivePcapThreadInit: pcap_set_timeout(%p) returned %" PRId32 "\n", ptv->pcap_handle, pcap_set_timeout_r);
418  if (pcap_set_timeout_r != 0) {
419  SCLogError(SC_ERR_PCAP_SET_TIMEOUT, "Problems setting timeout, error %s", pcap_geterr(ptv->pcap_handle));
420  SCFree(ptv);
421  pcapconfig->DerefFunc(pcapconfig);
423  }
424 #ifdef HAVE_PCAP_SET_BUFF
425  ptv->pcap_buffer_size = pcapconfig->buffer_size;
426  if (ptv->pcap_buffer_size > 0) {
427  SCLogInfo("Going to use pcap buffer size of %" PRId32 "", ptv->pcap_buffer_size);
428 
429  int pcap_set_buffer_size_r = pcap_set_buffer_size(ptv->pcap_handle,ptv->pcap_buffer_size);
430  //printf("ReceivePcapThreadInit: pcap_set_timeout(%p) returned %" PRId32 "\n", ptv->pcap_handle, pcap_set_buffer_size_r);
431  if (pcap_set_buffer_size_r != 0) {
432  SCLogError(SC_ERR_PCAP_SET_BUFF_SIZE, "Problems setting pcap buffer size, error %s", pcap_geterr(ptv->pcap_handle));
433  SCFree(ptv);
434  pcapconfig->DerefFunc(pcapconfig);
436  }
437  }
438 #endif /* HAVE_PCAP_SET_BUFF */
439 
440  /* activate the handle */
441  int pcap_activate_r = pcap_activate(ptv->pcap_handle);
442  //printf("ReceivePcapThreadInit: pcap_activate(%p) returned %" PRId32 "\n", ptv->pcap_handle, pcap_activate_r);
443  if (pcap_activate_r != 0) {
444  SCLogError(SC_ERR_PCAP_ACTIVATE_HANDLE, "Couldn't activate the pcap handler, error %s", pcap_geterr(ptv->pcap_handle));
445  SCFree(ptv);
446  pcapconfig->DerefFunc(pcapconfig);
448  } else {
449  ptv->pcap_state = PCAP_STATE_UP;
450  }
451 
452  /* set bpf filter if we have one */
453  if (pcapconfig->bpf_filter) {
454  SCMutexLock(&pcap_bpf_compile_lock);
455 
456  ptv->bpf_filter = pcapconfig->bpf_filter;
457 
458  if (pcap_compile(ptv->pcap_handle,&ptv->filter,(char *)ptv->bpf_filter,1,0) < 0) {
459  SCLogError(SC_ERR_BPF, "bpf compilation error %s", pcap_geterr(ptv->pcap_handle));
460 
461  SCMutexUnlock(&pcap_bpf_compile_lock);
462  SCFree(ptv);
463  pcapconfig->DerefFunc(pcapconfig);
464  return TM_ECODE_FAILED;
465  }
466 
467  if (pcap_setfilter(ptv->pcap_handle,&ptv->filter) < 0) {
468  SCLogError(SC_ERR_BPF, "could not set bpf filter %s", pcap_geterr(ptv->pcap_handle));
469 
470  SCMutexUnlock(&pcap_bpf_compile_lock);
471  SCFree(ptv);
472  pcapconfig->DerefFunc(pcapconfig);
473  return TM_ECODE_FAILED;
474  }
475 
476  SCMutexUnlock(&pcap_bpf_compile_lock);
477  }
478 
479  /* no offloading supported at all */
480  (void)GetIfaceOffloading(pcapconfig->iface, 1, 1);
481 
482  ptv->datalink = pcap_datalink(ptv->pcap_handle);
483 
484  pcapconfig->DerefFunc(pcapconfig);
485 
486  ptv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets",
487  ptv->tv);
488  ptv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops",
489  ptv->tv);
490  ptv->capture_kernel_ifdrops = StatsRegisterCounter("capture.kernel_ifdrops",
491  ptv->tv);
492 
493  *data = (void *)ptv;
495 }
496 
497 /**
498  * \brief This function prints stats to the screen at exit.
499  * \param tv pointer to ThreadVars
500  * \param data pointer that gets cast into PcapThreadVars for ptv
501  */
503 {
504  SCEnter();
505  PcapThreadVars *ptv = (PcapThreadVars *)data;
506  struct pcap_stat pcap_s;
507 
508  if (pcap_stats(ptv->pcap_handle, &pcap_s) < 0) {
509  SCLogError(SC_ERR_STAT,"(%s) Failed to get pcap_stats: %s", tv->name, pcap_geterr(ptv->pcap_handle));
510  SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes);
511 
512  return;
513  } else {
514  SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes);
515 
516  /* these numbers are not entirely accurate as ps_recv contains packets that are still waiting to be processed at exit.
517  * ps_drop only contains packets dropped by the driver and not any packets dropped by the interface.
518  * Additionally see http://tracker.icir.org/bro/ticket/18
519  *
520  * Note: ps_recv includes dropped packets and should be considered total.
521  * Unless we start to look at ps_ifdrop which isn't supported everywhere.
522  */
523  SCLogInfo("(%s) Pcap Total:%" PRIu64 " Recv:%" PRIu64 " Drop:%" PRIu64 " (%02.1f%%).", tv->name,
524  (uint64_t)pcap_s.ps_recv, (uint64_t)pcap_s.ps_recv - (uint64_t)pcap_s.ps_drop, (uint64_t)pcap_s.ps_drop,
525  (((float)(uint64_t)pcap_s.ps_drop)/(float)(uint64_t)pcap_s.ps_recv)*100);
526 
527  return;
528  }
529 }
530 
531 /**
532  * \brief DeInit function closes pcap_handle at exit.
533  * \param tv pointer to ThreadVars
534  * \param data pointer that gets cast into PcapThreadVars for ptv
535  */
537 {
538  PcapThreadVars *ptv = (PcapThreadVars *)data;
539 
540  pcap_close(ptv->pcap_handle);
542 }
543 
544 /**
545  * \brief This function passes off to link type decoders.
546  *
547  * DecodePcap reads packets from the PacketQueue and passes
548  * them off to the proper link type decoder.
549  *
550  * \param t pointer to ThreadVars
551  * \param p pointer to the current packet
552  * \param data pointer that gets cast into PcapThreadVars for ptv
553  * \param pq pointer to the current PacketQueue
554  */
556 {
557  SCEnter();
558  DecodeThreadVars *dtv = (DecodeThreadVars *)data;
559 
560  /* XXX HACK: flow timeout can call us for injected pseudo packets
561  * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */
562  if (p->flags & PKT_PSEUDO_STREAM_END)
563  return TM_ECODE_OK;
564 
565  /* update counters */
566  DecodeUpdatePacketCounters(tv, dtv, p);
567 
568  /* call the decoder */
569  switch(p->datalink) {
570  case LINKTYPE_LINUX_SLL:
571  DecodeSll(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq);
572  break;
573  case LINKTYPE_ETHERNET:
574  DecodeEthernet(tv, dtv, p,GET_PKT_DATA(p), GET_PKT_LEN(p), pq);
575  break;
576  case LINKTYPE_PPP:
577  DecodePPP(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq);
578  break;
579  case LINKTYPE_RAW:
581  DecodeRaw(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq);
582  break;
583  case LINKTYPE_NULL:
584  DecodeNull(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq);
585  break;
586  default:
587  SCLogError(SC_ERR_DATALINK_UNIMPLEMENTED, "Error: datalink type %" PRId32 " not yet supported in module DecodePcap", p->datalink);
588  break;
589  }
590 
591  PacketDecodeFinalize(tv, dtv, p);
592 
594 }
595 
596 TmEcode DecodePcapThreadInit(ThreadVars *tv, const void *initdata, void **data)
597 {
598  SCEnter();
599  DecodeThreadVars *dtv = NULL;
600 
601  dtv = DecodeThreadVarsAlloc(tv);
602 
603  if (dtv == NULL)
605 
607 
608  *data = (void *)dtv;
609 
611 }
612 
614 {
615  if (data != NULL)
616  DecodeThreadVarsFree(tv, data);
618 }
619 
620 void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
621 {
622  char errbuf[PCAP_ERRBUF_SIZE];
623  pcap_if_t *alldevsp = NULL;
624  pcap_if_t *devsp = NULL;
625 
626  struct addrinfo aiHints;
627  struct addrinfo *aiList = NULL;
628  int retVal = 0;
629 
630  memset(&aiHints, 0, sizeof(aiHints));
631  aiHints.ai_family = AF_UNSPEC;
632  aiHints.ai_flags = AI_NUMERICHOST;
633 
634  /* try to translate IP */
635  if ((retVal = getaddrinfo(pcap_dev, NULL, &aiHints, &aiList)) != 0) {
636  return;
637  }
638 
639  if (pcap_findalldevs(&alldevsp, errbuf)) {
640  freeaddrinfo(aiList);
641  return;
642  }
643 
644  for (devsp = alldevsp; devsp ; devsp = devsp->next) {
645  pcap_addr_t *ip = NULL;
646 
647  for (ip = devsp->addresses; ip ; ip = ip->next) {
648 
649  if (aiList->ai_family != ip->addr->sa_family) {
650  continue;
651  }
652 
653  if (ip->addr->sa_family == AF_INET) {
654  if (memcmp(&((struct sockaddr_in*)aiList->ai_addr)->sin_addr, &((struct sockaddr_in*)ip->addr)->sin_addr, sizeof(struct in_addr))) {
655  continue;
656  }
657  } else if (ip->addr->sa_family == AF_INET6) {
658  if (memcmp(&((struct sockaddr_in6*)aiList->ai_addr)->sin6_addr, &((struct sockaddr_in6*)ip->addr)->sin6_addr, sizeof(struct in6_addr))) {
659  continue;
660  }
661  } else {
662  continue;
663  }
664 
665  freeaddrinfo(aiList);
666 
667  memset(pcap_dev, 0, len);
668  strlcpy(pcap_dev, devsp->name, len);
669 
670  pcap_freealldevs(alldevsp);
671  return;
672  }
673  }
674 
675  freeaddrinfo(aiList);
676 
677  pcap_freealldevs(alldevsp);
678 }
679 
680 /* eof */
681 
TmEcode ReceivePcapBreakLoop(ThreadVars *tv, void *data)
PCAP Break Loop function.
Definition: source-pcap.c:305
uint32_t pkts
Definition: source-pcap.c:70
#define SCMutex
#define TM_FLAG_DECODE_TM
Definition: tm-modules.h:32
struct bpf_program filter
Definition: source-pcap.c:60
time_t last_stats_dump
Definition: source-pcap.c:64
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:592
#define SCLogDebug(...)
Definition: util-debug.h:335
ChecksumValidationMode checksum_mode
Definition: source-pcap.c:88
uint8_t cap_flags
Definition: tm-modules.h:67
LiveDevice * livedev
Definition: source-pcap.c:90
const char * bpf_filter
Definition: source-pcap.h:61
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
char iface[PCAP_IFACE_NAME_LENGTH]
Definition: source-pcap.h:51
#define LINKTYPE_LINUX_SLL
Definition: decode.h:1073
int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-ppp.c:43
uint8_t flags
Definition: tm-modules.h:70
const char * bpf_filter
Definition: source-pcap.c:62
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:114
#define PCAP_STATE_DOWN
Definition: source-pcap.c:45
#define unlikely(expr)
Definition: util-optimize.h:35
int DecodeRaw(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-raw.c:46
TmEcode(* Func)(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *)
Definition: tm-modules.h:52
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:453
int GetIfaceMaxPacketSize(const char *pcap_dev)
output max packet size for a link
Definition: util-ioctl.c:132
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:107
TmEcode DecodePcapThreadInit(ThreadVars *, const void *, void **)
Definition: source-pcap.c:596
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:199
#define CHECKSUM_SAMPLE_COUNT
Definition: util-checksum.h:33
uint16_t capture_kernel_packets
Definition: source-pcap.c:74
int DecodeNull(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-null.c:48
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:176
#define xstr(s)
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
Definition: tm-modules.h:54
struct PcapThreadVars_ PcapThreadVars
Structure to hold thread specific variables.
#define SCMutexLock(mut)
int GetIfaceOffloading(const char *dev, int csum, int other)
output offloading status of the link
Definition: util-ioctl.c:694
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1134
uint32_t errs
Definition: source-pcap.c:72
#define TM_FLAG_RECEIVE_TM
Definition: tm-modules.h:31
int ChecksumAutoModeCheck(uint64_t thread_count, uint64_t iface_count, uint64_t iface_fail)
Check if the number of invalid checksums indicate checksum offloading in place.
Definition: util-checksum.c:70
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
Definition: tm-modules.h:57
#define LINKTYPE_PPP
Definition: decode.h:1074
ChecksumValidationMode checksum_mode
Definition: source-pcap.h:62
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:939
#define LINKTYPE_NULL
Definition: decode.h:1071
#define SURICATA_STOP
Definition: suricata.h:95
Structure to hold thread specific variables.
Definition: source-pcap.c:53
#define SCMutexUnlock(mut)
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
Definition: counters.c:185
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
int datalink
Definition: decode.h:574
#define SCMUTEX_INITIALIZER
void TimeGet(struct timeval *tv)
Definition: util-time.c:138
uint64_t bytes
Definition: source-pcap.c:71
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
void ReceivePcapThreadExitStats(ThreadVars *, void *)
This function prints stats to the screen at exit.
Definition: source-pcap.c:502
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
Structure to hold thread specific data for all decode modules.
Definition: decode.h:632
void(* DerefFunc)(void *)
Definition: source-pcap.h:64
void(* RegisterTests)(void)
Definition: tm-modules.h:65
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
#define SCEnter(...)
Definition: util-debug.h:337
struct TmSlot_ * slot_next
Definition: tm-threads.h:87
#define PKT_IGNORE_CHECKSUM
Definition: decode.h:1101
#define PKT_PSEUDO_STREAM_END
Definition: decode.h:1093
ThreadVars * tv
Definition: source-pcap.c:78
#define SCReturnInt(x)
Definition: util-debug.h:341
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:248
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:48
TmSlot * slot
Definition: source-pcap.c:79
#define LINKTYPE_RAW
Definition: decode.h:1075
#define LINKTYPE_GRE_OVER_IP
Definition: decode.h:1080
int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-sll.c:39
#define SC_CAP_NET_RAW
Definition: util-privs.h:32
void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
Definition: source-pcap.c:620
void PacketPoolWait(void)
const char * name
Definition: tm-modules.h:44
int ignore_checksum
Definition: util-device.h:45
#define SCMalloc(a)
Definition: util-mem.h:166
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:207
uint16_t capture_kernel_drops
Definition: source-pcap.c:75
TmEcode DecodePcap(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *)
This function passes off to link type decoders.
Definition: source-pcap.c:555
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
#define SCFree(a)
Definition: util-mem.h:228
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.h:73
unsigned char pcap_state
Definition: source-pcap.c:58
int DisableIfaceOffloading(LiveDevice *dev, int csum, int other)
Definition: util-ioctl.c:707
void TmModuleReceivePcapRegister(void)
Registration Function for RecievePcap.
Definition: source-pcap.c:111
pcap_t * pcap_handle
Definition: source-pcap.c:56
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:136
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
ChecksumValidationMode
Definition: decode.h:40
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:192
#define GET_PKT_DATA(p)
Definition: decode.h:223
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:558
TmEcode ReceivePcapLoop(ThreadVars *tv, void *data, void *slot)
Main PCAP reading Loop function.
Definition: source-pcap.c:243
char name[16]
Definition: threadvars.h:59
#define LINKTYPE_ETHERNET
Definition: decode.h:1072
#define PCAP_RECONNECT_TIMEOUT
Definition: source-pcap.c:48
#define SCReturn
Definition: util-debug.h:339
struct LiveDevice_ * livedev
Definition: decode.h:553
uint8_t len
Per thread variable structure.
Definition: threadvars.h:57
struct timeval ts
Definition: decode.h:449
#define GET_PKT_LEN(p)
Definition: decode.h:222
TmEcode DecodePcapThreadDeinit(ThreadVars *tv, void *data)
Definition: source-pcap.c:613
uint32_t flags
Definition: decode.h:441
void TmModuleDecodePcapRegister(void)
Registration Function for DecodePcap.
Definition: source-pcap.c:129
#define likely(expr)
Definition: util-optimize.h:32
TmEcode ReceivePcapThreadDeinit(ThreadVars *, void *)
DeInit function closes pcap_handle at exit.
Definition: source-pcap.c:536
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:618
int LiveGetOffload(void)
Definition: util-device.c:66
uint16_t capture_kernel_ifdrops
Definition: source-pcap.c:76
int PacketCopyData(Packet *p, uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:258
TmEcode ReceivePcapThreadInit(ThreadVars *, const void *, void **)
Init function for ReceivePcap.
Definition: source-pcap.c:331
#define PCAP_STATE_UP
Definition: source-pcap.c:46
#define LIBPCAP_COPYWAIT
Definition: source-pcap.h:36