suricata
source-pcap.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Live pcap packet acquisition support
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 #include "decode.h"
29 #include "packet-queue.h"
30 #include "threads.h"
31 #include "threadvars.h"
32 #include "tm-queuehandlers.h"
33 #include "tm-threads.h"
34 #include "source-pcap.h"
35 #include "conf.h"
36 #include "util-debug.h"
37 #include "util-error.h"
38 #include "util-privs.h"
39 #include "util-device.h"
40 #include "util-optimize.h"
41 #include "util-checksum.h"
42 #include "util-ioctl.h"
43 #include "tmqh-packetpool.h"
44 
45 #define PCAP_STATE_DOWN 0
46 #define PCAP_STATE_UP 1
47 
48 #define PCAP_RECONNECT_TIMEOUT 500000
49 
50 /**
51  * \brief Structure to hold thread specific variables.
52  */
53 typedef struct PcapThreadVars_
54 {
55  /* thread specific handle */
56  pcap_t *pcap_handle;
57  /* handle state */
58  unsigned char pcap_state;
59  /* thread specific bpf */
61  /* ptr to string from config */
62  const char *bpf_filter;
63 
65 
66  /* data link type for the thread */
67  int datalink;
68 
69  /* counters */
70  uint32_t pkts;
71  uint64_t bytes;
72  uint32_t errs;
73 
77 
80 
81  /** callback result -- set if one of the thread module failed. */
82  int cb_result;
83 
84  /* pcap buffer size */
87 
89 
92 
93 TmEcode ReceivePcapThreadInit(ThreadVars *, const void *, void **);
96 TmEcode ReceivePcapLoop(ThreadVars *tv, void *data, void *slot);
98 
99 TmEcode DecodePcapThreadInit(ThreadVars *, const void *, void **);
102 
103 /** protect pcap_compile and pcap_setfilter, as they are not thread safe:
104  * http://seclists.org/tcpdump/2009/q1/62 */
105 static SCMutex pcap_bpf_compile_lock = SCMUTEX_INITIALIZER;
106 
107 /**
108  * \brief Registration Function for RecievePcap.
109  */
111 {
112  tmm_modules[TMM_RECEIVEPCAP].name = "ReceivePcap";
119 }
120 
121 /**
122  * \brief Registration Function for DecodePcap.
123  */
125 {
126  tmm_modules[TMM_DECODEPCAP].name = "DecodePcap";
131 }
132 
133 static inline void PcapDumpCounters(PcapThreadVars *ptv)
134 {
135  struct pcap_stat pcap_s;
136  if (likely((pcap_stats(ptv->pcap_handle, &pcap_s) >= 0))) {
137  StatsSetUI64(ptv->tv, ptv->capture_kernel_packets, pcap_s.ps_recv);
138  StatsSetUI64(ptv->tv, ptv->capture_kernel_drops, pcap_s.ps_drop);
139  (void) SC_ATOMIC_SET(ptv->livedev->drop, pcap_s.ps_drop);
140  StatsSetUI64(ptv->tv, ptv->capture_kernel_ifdrops, pcap_s.ps_ifdrop);
141  }
142 }
143 
144 static int PcapTryReopen(PcapThreadVars *ptv)
145 {
147 
148  int pcap_activate_r = pcap_activate(ptv->pcap_handle);
149  if (pcap_activate_r != 0) {
150  return pcap_activate_r;
151  }
152 
153  /* set bpf filter if we have one */
154  if (ptv->bpf_filter != NULL) {
155  if (pcap_compile(ptv->pcap_handle, &ptv->filter,
156  (char *)ptv->bpf_filter, 1, 0) < 0)
157  {
158  SCLogError(SC_ERR_BPF, "bpf compilation error %s",
159  pcap_geterr(ptv->pcap_handle));
160  return -1;
161  }
162 
163  if (pcap_setfilter(ptv->pcap_handle, &ptv->filter) < 0) {
164  SCLogError(SC_ERR_BPF, "could not set bpf filter %s",
165  pcap_geterr(ptv->pcap_handle));
166  return -1;
167  }
168  }
169 
170  SCLogInfo("Recovering interface listening");
171  ptv->pcap_state = PCAP_STATE_UP;
172  return 0;
173 }
174 
175 static void PcapCallbackLoop(char *user, struct pcap_pkthdr *h, u_char *pkt)
176 {
177  SCEnter();
178 
179  PcapThreadVars *ptv = (PcapThreadVars *)user;
181  struct timeval current_time;
182 
183  if (unlikely(p == NULL)) {
184  SCReturn;
185  }
186 
188  p->ts.tv_sec = h->ts.tv_sec;
189  p->ts.tv_usec = h->ts.tv_usec;
190  SCLogDebug("p->ts.tv_sec %"PRIuMAX"", (uintmax_t)p->ts.tv_sec);
191  p->datalink = ptv->datalink;
192 
193  ptv->pkts++;
194  ptv->bytes += h->caplen;
195  (void) SC_ATOMIC_ADD(ptv->livedev->pkts, 1);
196  p->livedev = ptv->livedev;
197 
198  if (unlikely(PacketCopyData(p, pkt, h->caplen))) {
199  TmqhOutputPacketpool(ptv->tv, p);
200  SCReturn;
201  }
202 
203  switch (ptv->checksum_mode) {
205  if (ptv->livedev->ignore_checksum) {
207  } else if (ChecksumAutoModeCheck(ptv->pkts,
208  SC_ATOMIC_GET(ptv->livedev->pkts),
209  SC_ATOMIC_GET(ptv->livedev->invalid_checksums))) {
210  ptv->livedev->ignore_checksum = 1;
212  }
213  break;
216  break;
217  default:
218  break;
219  }
220 
221  if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) {
222  pcap_breakloop(ptv->pcap_handle);
223  ptv->cb_result = TM_ECODE_FAILED;
224  }
225 
226  /* Trigger one dump of stats every second */
227  TimeGet(&current_time);
228  if (current_time.tv_sec != ptv->last_stats_dump) {
229  PcapDumpCounters(ptv);
230  ptv->last_stats_dump = current_time.tv_sec;
231  }
232 
233  SCReturn;
234 }
235 
236 #ifndef PCAP_ERROR_BREAK
237 #define PCAP_ERROR_BREAK -2
238 #endif
239 
240 /**
241  * \brief Main PCAP reading Loop function
242  */
244 {
245  SCEnter();
246 
247  int packet_q_len = 64;
248  PcapThreadVars *ptv = (PcapThreadVars *)data;
249  TmSlot *s = (TmSlot *)slot;
250 
251  ptv->slot = s->slot_next;
252  ptv->cb_result = TM_ECODE_OK;
253 
254  while (1) {
257  }
258 
259  /* make sure we have at least one packet in the packet pool, to prevent
260  * us from alloc'ing packets at line rate */
261  PacketPoolWait();
262 
263  int r = pcap_dispatch(ptv->pcap_handle, packet_q_len,
264  (pcap_handler)PcapCallbackLoop, (u_char *)ptv);
265  if (unlikely(r == 0 || r == PCAP_ERROR_BREAK)) {
266  if (r == PCAP_ERROR_BREAK && ptv->cb_result == TM_ECODE_FAILED) {
268  }
269  TmThreadsCaptureHandleTimeout(tv, ptv->slot, NULL);
270  } else if (unlikely(r < 0)) {
271  int dbreak = 0;
272  SCLogError(SC_ERR_PCAP_DISPATCH, "error code %" PRId32 " %s",
273  r, pcap_geterr(ptv->pcap_handle));
274  do {
275  usleep(PCAP_RECONNECT_TIMEOUT);
276  if (suricata_ctl_flags != 0) {
277  dbreak = 1;
278  break;
279  }
280  r = PcapTryReopen(ptv);
281  } while (r < 0);
282  if (dbreak) {
283  break;
284  }
285  } else if (ptv->cb_result == TM_ECODE_FAILED) {
286  SCLogError(SC_ERR_PCAP_DISPATCH, "Pcap callback PcapCallbackLoop failed");
288  }
289 
291  }
292 
293  PcapDumpCounters(ptv);
296 }
297 
298 /**
299  * \brief PCAP Break Loop function.
300  */
302 {
303  SCEnter();
304  PcapThreadVars *ptv = (PcapThreadVars *)data;
305  if (ptv->pcap_handle == NULL) {
307  }
308  pcap_breakloop(ptv->pcap_handle);
310 }
311 
312 /**
313  * \brief Init function for ReceivePcap.
314  *
315  * This is a setup function for recieving packets
316  * via libpcap. There are two versions of this function
317  * depending on the major version of libpcap used.
318  * For versions prior to 1.x we use open_pcap_live,
319  * for versions 1.x and greater we use pcap_create + pcap_activate.
320  *
321  * \param tv pointer to ThreadVars
322  * \param initdata pointer to the interface passed from the user
323  * \param data pointer gets populated with PcapThreadVars
324  *
325  * \todo Create a general pcap setup function.
326  */
327 TmEcode ReceivePcapThreadInit(ThreadVars *tv, const void *initdata, void **data)
328 {
329  SCEnter();
330  PcapIfaceConfig *pcapconfig = (PcapIfaceConfig *)initdata;
331 
332  if (initdata == NULL) {
333  SCLogError(SC_ERR_INVALID_ARGUMENT, "initdata == NULL");
335  }
336 
337  PcapThreadVars *ptv = SCCalloc(1, sizeof(PcapThreadVars));
338  if (unlikely(ptv == NULL)) {
339  pcapconfig->DerefFunc(pcapconfig);
341  }
342 
343  ptv->tv = tv;
344 
345  ptv->livedev = LiveGetDevice(pcapconfig->iface);
346  if (ptv->livedev == NULL) {
347  SCLogError(SC_ERR_INVALID_VALUE, "unable to find Live device");
348  SCFree(ptv);
350  }
351  SCLogInfo("using interface %s", (char *)pcapconfig->iface);
352 
353  if (LiveGetOffload() == 0) {
354  (void)GetIfaceOffloading((char *)pcapconfig->iface, 1, 1);
355  } else {
356  DisableIfaceOffloading(ptv->livedev, 1, 1);
357  }
358 
359  ptv->checksum_mode = pcapconfig->checksum_mode;
361  SCLogInfo("running in 'auto' checksum mode. Detection of interface "
362  "state will require " xstr(CHECKSUM_SAMPLE_COUNT) " packets");
363  }
364 
365  char errbuf[PCAP_ERRBUF_SIZE];
366  ptv->pcap_handle = pcap_create((char *)pcapconfig->iface, errbuf);
367  if (ptv->pcap_handle == NULL) {
368  if (strlen(errbuf)) {
369  SCLogError(SC_ERR_PCAP_CREATE, "could not create a new "
370  "pcap handler for %s, error %s",
371  (char *)pcapconfig->iface, errbuf);
372  } else {
373  SCLogError(SC_ERR_PCAP_CREATE, "could not create a new "
374  "pcap handler for %s",
375  (char *)pcapconfig->iface);
376  }
377  SCFree(ptv);
378  pcapconfig->DerefFunc(pcapconfig);
380  }
381 
382  if (pcapconfig->snaplen == 0) {
383  /* We set snaplen if we can get the MTU */
384  ptv->pcap_snaplen = GetIfaceMaxPacketSize(pcapconfig->iface);
385  } else {
386  ptv->pcap_snaplen = pcapconfig->snaplen;
387  }
388  if (ptv->pcap_snaplen > 0) {
389  /* set Snaplen. Must be called before pcap_activate */
390  int pcap_set_snaplen_r = pcap_set_snaplen(ptv->pcap_handle, ptv->pcap_snaplen);
391  if (pcap_set_snaplen_r != 0) {
392  SCLogError(SC_ERR_PCAP_SET_SNAPLEN, "could not set snaplen, "
393  "error: %s", pcap_geterr(ptv->pcap_handle));
394  SCFree(ptv);
395  pcapconfig->DerefFunc(pcapconfig);
397  }
398  SCLogInfo("Set snaplen to %d for '%s'", ptv->pcap_snaplen,
399  pcapconfig->iface);
400  }
401 
402  /* set Promisc, and Timeout. Must be called before pcap_activate */
403  int pcap_set_promisc_r = pcap_set_promisc(ptv->pcap_handle, pcapconfig->promisc);
404  if (pcap_set_promisc_r != 0) {
405  SCLogError(SC_ERR_PCAP_SET_PROMISC, "could not set promisc mode, "
406  "error %s", pcap_geterr(ptv->pcap_handle));
407  SCFree(ptv);
408  pcapconfig->DerefFunc(pcapconfig);
410  }
411 
412  int pcap_set_timeout_r = pcap_set_timeout(ptv->pcap_handle, LIBPCAP_COPYWAIT);
413  if (pcap_set_timeout_r != 0) {
414  SCLogError(SC_ERR_PCAP_SET_TIMEOUT, "could not set timeout, "
415  "error %s", pcap_geterr(ptv->pcap_handle));
416  SCFree(ptv);
417  pcapconfig->DerefFunc(pcapconfig);
419  }
420 #ifdef HAVE_PCAP_SET_BUFF
421  ptv->pcap_buffer_size = pcapconfig->buffer_size;
422  if (ptv->pcap_buffer_size > 0) {
423  SCLogInfo("going to use pcap buffer size of %" PRId32,
424  ptv->pcap_buffer_size);
425 
426  int pcap_set_buffer_size_r = pcap_set_buffer_size(ptv->pcap_handle,
427  ptv->pcap_buffer_size);
428  if (pcap_set_buffer_size_r != 0) {
429  SCLogError(SC_ERR_PCAP_SET_BUFF_SIZE, "could not set "
430  "pcap buffer size, error %s", pcap_geterr(ptv->pcap_handle));
431  SCFree(ptv);
432  pcapconfig->DerefFunc(pcapconfig);
434  }
435  }
436 #endif /* HAVE_PCAP_SET_BUFF */
437 
438  /* activate the handle */
439  int pcap_activate_r = pcap_activate(ptv->pcap_handle);
440  if (pcap_activate_r != 0) {
441  SCLogError(SC_ERR_PCAP_ACTIVATE_HANDLE, "could not activate the "
442  "pcap handler, error %s", pcap_geterr(ptv->pcap_handle));
443  SCFree(ptv);
444  pcapconfig->DerefFunc(pcapconfig);
446  }
447  ptv->pcap_state = PCAP_STATE_UP;
448 
449  /* set bpf filter if we have one */
450  if (pcapconfig->bpf_filter) {
451  SCMutexLock(&pcap_bpf_compile_lock);
452 
453  ptv->bpf_filter = pcapconfig->bpf_filter;
454 
455  if (pcap_compile(ptv->pcap_handle, &ptv->filter,
456  (char *)ptv->bpf_filter, 1, 0) < 0)
457  {
458  SCLogError(SC_ERR_BPF, "bpf compilation error %s",
459  pcap_geterr(ptv->pcap_handle));
460 
461  SCMutexUnlock(&pcap_bpf_compile_lock);
462  SCFree(ptv);
463  pcapconfig->DerefFunc(pcapconfig);
464  return TM_ECODE_FAILED;
465  }
466 
467  if (pcap_setfilter(ptv->pcap_handle, &ptv->filter) < 0) {
468  SCLogError(SC_ERR_BPF, "could not set bpf filter %s",
469  pcap_geterr(ptv->pcap_handle));
470 
471  SCMutexUnlock(&pcap_bpf_compile_lock);
472  SCFree(ptv);
473  pcapconfig->DerefFunc(pcapconfig);
474  return TM_ECODE_FAILED;
475  }
476 
477  SCMutexUnlock(&pcap_bpf_compile_lock);
478  }
479 
480  /* no offloading supported at all */
481  (void)GetIfaceOffloading(pcapconfig->iface, 1, 1);
482 
483  ptv->datalink = pcap_datalink(ptv->pcap_handle);
484 
485  pcapconfig->DerefFunc(pcapconfig);
486 
487  ptv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets",
488  ptv->tv);
489  ptv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops",
490  ptv->tv);
491  ptv->capture_kernel_ifdrops = StatsRegisterCounter("capture.kernel_ifdrops",
492  ptv->tv);
493 
494  *data = (void *)ptv;
496 }
497 
498 /**
499  * \brief This function prints stats to the screen at exit.
500  * \param tv pointer to ThreadVars
501  * \param data pointer that gets cast into PcapThreadVars for ptv
502  */
504 {
505  SCEnter();
506  PcapThreadVars *ptv = (PcapThreadVars *)data;
507  struct pcap_stat pcap_s;
508 
509  if (pcap_stats(ptv->pcap_handle, &pcap_s) < 0) {
510  SCLogError(SC_ERR_STAT,"(%s) Failed to get pcap_stats: %s",
511  tv->name, pcap_geterr(ptv->pcap_handle));
512  SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "",
513  tv->name, ptv->pkts, ptv->bytes);
514  } else {
515  SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "",
516  tv->name, ptv->pkts, ptv->bytes);
517 
518  /* these numbers are not entirely accurate as ps_recv contains packets
519  * that are still waiting to be processed at exit. ps_drop only contains
520  * packets dropped by the driver and not any packets dropped by the interface.
521  * Additionally see http://tracker.icir.org/bro/ticket/18
522  *
523  * Note: ps_recv includes dropped packets and should be considered total.
524  * Unless we start to look at ps_ifdrop which isn't supported everywhere.
525  */
526  SCLogInfo("(%s) Pcap Total:%" PRIu64 " Recv:%" PRIu64 " Drop:%" PRIu64 " (%02.1f%%).",
527  tv->name, (uint64_t)pcap_s.ps_recv,
528  (uint64_t)pcap_s.ps_recv - (uint64_t)pcap_s.ps_drop,
529  (uint64_t)pcap_s.ps_drop,
530  (((float)(uint64_t)pcap_s.ps_drop)/(float)(uint64_t)pcap_s.ps_recv)*100);
531  }
532 }
533 
534 /**
535  * \brief DeInit function closes pcap_handle at exit.
536  * \param tv pointer to ThreadVars
537  * \param data pointer that gets cast into PcapThreadVars for ptv
538  */
540 {
541  PcapThreadVars *ptv = (PcapThreadVars *)data;
542 
543  pcap_close(ptv->pcap_handle);
545 }
546 
547 /**
548  * \brief This function passes off to link type decoders.
549  *
550  * DecodePcap reads packets from the PacketQueue and passes
551  * them off to the proper link type decoder.
552  *
553  * \param t pointer to ThreadVars
554  * \param p pointer to the current packet
555  * \param data pointer that gets cast into PcapThreadVars for ptv
556  * \param pq pointer to the current PacketQueue
557  */
559 {
560  SCEnter();
561  DecodeThreadVars *dtv = (DecodeThreadVars *)data;
562 
563  /* XXX HACK: flow timeout can call us for injected pseudo packets
564  * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */
565  if (p->flags & PKT_PSEUDO_STREAM_END)
566  return TM_ECODE_OK;
567 
568  /* update counters */
569  DecodeUpdatePacketCounters(tv, dtv, p);
570 
571  /* call the decoder */
572  switch(p->datalink) {
573  case LINKTYPE_LINUX_SLL:
574  DecodeSll(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq);
575  break;
576  case LINKTYPE_ETHERNET:
577  DecodeEthernet(tv, dtv, p,GET_PKT_DATA(p), GET_PKT_LEN(p), pq);
578  break;
579  case LINKTYPE_PPP:
580  DecodePPP(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq);
581  break;
582  case LINKTYPE_RAW:
584  DecodeRaw(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq);
585  break;
586  case LINKTYPE_NULL:
587  DecodeNull(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq);
588  break;
589  default:
590  SCLogError(SC_ERR_DATALINK_UNIMPLEMENTED, "Error: datalink "
591  "type %" PRId32 " not yet supported in module "
592  "DecodePcap", p->datalink);
593  break;
594  }
595 
596  PacketDecodeFinalize(tv, dtv, p);
597 
599 }
600 
601 TmEcode DecodePcapThreadInit(ThreadVars *tv, const void *initdata, void **data)
602 {
603  SCEnter();
604 
606  if (dtv == NULL)
608 
610 
611  *data = (void *)dtv;
612 
614 }
615 
617 {
618  if (data != NULL)
619  DecodeThreadVarsFree(tv, data);
621 }
622 
623 void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
624 {
625  char errbuf[PCAP_ERRBUF_SIZE];
626  pcap_if_t *alldevsp = NULL;
627 
628  struct addrinfo ai_hints;
629  struct addrinfo *ai_list = NULL;
630  int ret = 0;
631 
632  memset(&ai_hints, 0, sizeof(ai_hints));
633  ai_hints.ai_family = AF_UNSPEC;
634  ai_hints.ai_flags = AI_NUMERICHOST;
635 
636  /* try to translate IP */
637  if ((ret = getaddrinfo(pcap_dev, NULL, &ai_hints, &ai_list)) != 0) {
638  return;
639  }
640 
641  if (pcap_findalldevs(&alldevsp, errbuf)) {
642  freeaddrinfo(ai_list);
643  return;
644  }
645 
646  for (pcap_if_t *devsp = alldevsp; devsp ; devsp = devsp->next) {
647  for (pcap_addr_t *ip = devsp->addresses; ip ; ip = ip->next) {
648 
649  if (ai_list->ai_family != ip->addr->sa_family) {
650  continue;
651  }
652 
653  if (ip->addr->sa_family == AF_INET) {
654  if (memcmp(&((struct sockaddr_in*)ai_list->ai_addr)->sin_addr,
655  &((struct sockaddr_in*)ip->addr)->sin_addr,
656  sizeof(struct in_addr)))
657  {
658  continue;
659  }
660  } else if (ip->addr->sa_family == AF_INET6) {
661  if (memcmp(&((struct sockaddr_in6*)ai_list->ai_addr)->sin6_addr,
662  &((struct sockaddr_in6*)ip->addr)->sin6_addr,
663  sizeof(struct in6_addr)))
664  {
665  continue;
666  }
667  } else {
668  continue;
669  }
670 
671  freeaddrinfo(ai_list);
672 
673  memset(pcap_dev, 0, len);
674  strlcpy(pcap_dev, devsp->name, len);
675 
676  pcap_freealldevs(alldevsp);
677  return;
678  }
679  }
680 
681  freeaddrinfo(ai_list);
682 
683  pcap_freealldevs(alldevsp);
684 }
TmEcode ReceivePcapBreakLoop(ThreadVars *tv, void *data)
PCAP Break Loop function.
Definition: source-pcap.c:301
uint32_t pkts
Definition: source-pcap.c:70
#define SCMutex
#define TM_FLAG_DECODE_TM
Definition: tm-modules.h:32
int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-ppp.c:43
struct bpf_program filter
Definition: source-pcap.c:60
time_t last_stats_dump
Definition: source-pcap.c:64
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:614
#define SCLogDebug(...)
Definition: util-debug.h:335
ChecksumValidationMode checksum_mode
Definition: source-pcap.c:88
uint8_t cap_flags
Definition: tm-modules.h:67
LiveDevice * livedev
Definition: source-pcap.c:90
const char * bpf_filter
Definition: source-pcap.h:56
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
char iface[PCAP_IFACE_NAME_LENGTH]
Definition: source-pcap.h:46
#define LINKTYPE_LINUX_SLL
Definition: decode.h:1075
uint8_t flags
Definition: tm-modules.h:70
const char * bpf_filter
Definition: source-pcap.c:62
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:115
#define PCAP_STATE_DOWN
Definition: source-pcap.c:45
#define unlikely(expr)
Definition: util-optimize.h:35
TmEcode(* Func)(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *)
Definition: tm-modules.h:52
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:474
int GetIfaceMaxPacketSize(const char *pcap_dev)
output max packet size for a link
Definition: util-ioctl.c:132
int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-sll.c:39
int DecodeNull(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-null.c:48
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:107
TmEcode DecodePcapThreadInit(ThreadVars *, const void *, void **)
Definition: source-pcap.c:601
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:201
#define CHECKSUM_SAMPLE_COUNT
Definition: util-checksum.h:33
uint16_t capture_kernel_packets
Definition: source-pcap.c:74
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:177
#define xstr(s)
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
Definition: tm-modules.h:54
struct PcapThreadVars_ PcapThreadVars
Structure to hold thread specific variables.
#define SCMutexLock(mut)
int GetIfaceOffloading(const char *dev, int csum, int other)
output offloading status of the link
Definition: util-ioctl.c:694
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1136
uint32_t errs
Definition: source-pcap.c:72
#define TM_FLAG_RECEIVE_TM
Definition: tm-modules.h:31
int ChecksumAutoModeCheck(uint64_t thread_count, uint64_t iface_count, uint64_t iface_fail)
Check if the number of invalid checksums indicate checksum offloading in place.
Definition: util-checksum.c:70
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
Definition: tm-modules.h:57
#define LINKTYPE_PPP
Definition: decode.h:1076
ChecksumValidationMode checksum_mode
Definition: source-pcap.h:57
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:943
#define LINKTYPE_NULL
Definition: decode.h:1073
#define SURICATA_STOP
Definition: suricata.h:95
#define SCCalloc(nm, a)
Definition: util-mem.h:253
Structure to hold thread specific variables.
Definition: source-pcap.c:53
#define SCMutexUnlock(mut)
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
Definition: counters.c:190
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
int datalink
Definition: decode.h:575
#define SCMUTEX_INITIALIZER
void TimeGet(struct timeval *tv)
Definition: util-time.c:146
uint64_t bytes
Definition: source-pcap.c:71
void ReceivePcapThreadExitStats(ThreadVars *, void *)
This function prints stats to the screen at exit.
Definition: source-pcap.c:503
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
Structure to hold thread specific data for all decode modules.
Definition: decode.h:633
void(* DerefFunc)(void *)
Definition: source-pcap.h:59
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
#define SCEnter(...)
Definition: util-debug.h:337
struct TmSlot_ * slot_next
Definition: tm-threads.h:87
#define PKT_IGNORE_CHECKSUM
Definition: decode.h:1103
#define PKT_PSEUDO_STREAM_END
Definition: decode.h:1095
ThreadVars * tv
Definition: source-pcap.c:78
#define SCReturnInt(x)
Definition: util-debug.h:341
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:279
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:48
TmSlot * slot
Definition: source-pcap.c:79
#define LINKTYPE_RAW
Definition: decode.h:1077
#define LINKTYPE_GRE_OVER_IP
Definition: decode.h:1082
#define SC_CAP_NET_RAW
Definition: util-privs.h:32
void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
Definition: source-pcap.c:623
void PacketPoolWait(void)
const char * name
Definition: tm-modules.h:44
int ignore_checksum
Definition: util-device.h:45
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:207
uint16_t capture_kernel_drops
Definition: source-pcap.c:75
TmEcode DecodePcap(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *)
This function passes off to link type decoders.
Definition: source-pcap.c:558
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
#define SCFree(a)
Definition: util-mem.h:322
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.h:73
unsigned char pcap_state
Definition: source-pcap.c:58
int DisableIfaceOffloading(LiveDevice *dev, int csum, int other)
Definition: util-ioctl.c:707
void TmModuleReceivePcapRegister(void)
Registration Function for RecievePcap.
Definition: source-pcap.c:110
pcap_t * pcap_handle
Definition: source-pcap.c:56
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:137
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
ChecksumValidationMode
Definition: decode.h:40
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:192
#define GET_PKT_DATA(p)
Definition: decode.h:226
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:580
TmEcode ReceivePcapLoop(ThreadVars *tv, void *data, void *slot)
Main PCAP reading Loop function.
Definition: source-pcap.c:243
char name[16]
Definition: threadvars.h:59
int DecodeRaw(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-raw.c:46
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:259
#define LINKTYPE_ETHERNET
Definition: decode.h:1074
#define PCAP_RECONNECT_TIMEOUT
Definition: source-pcap.c:48
#define SCReturn
Definition: util-debug.h:339
struct LiveDevice_ * livedev
Definition: decode.h:554
uint8_t len
Per thread variable structure.
Definition: threadvars.h:57
struct timeval ts
Definition: decode.h:452
#define GET_PKT_LEN(p)
Definition: decode.h:225
TmEcode DecodePcapThreadDeinit(ThreadVars *tv, void *data)
Definition: source-pcap.c:616
uint32_t flags
Definition: decode.h:444
void TmModuleDecodePcapRegister(void)
Registration Function for DecodePcap.
Definition: source-pcap.c:124
#define likely(expr)
Definition: util-optimize.h:32
TmEcode ReceivePcapThreadDeinit(ThreadVars *, void *)
DeInit function closes pcap_handle at exit.
Definition: source-pcap.c:539
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:633
int LiveGetOffload(void)
Definition: util-device.c:79
uint16_t capture_kernel_ifdrops
Definition: source-pcap.c:76
TmEcode ReceivePcapThreadInit(ThreadVars *, const void *, void **)
Init function for ReceivePcap.
Definition: source-pcap.c:327
#define PCAP_STATE_UP
Definition: source-pcap.c:46
#define LIBPCAP_COPYWAIT
Definition: source-pcap.h:31
#define PCAP_ERROR_BREAK
Definition: source-pcap.c:237