suricata
source-pcap.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Live pcap packet acquisition support
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 #include "decode.h"
29 #include "packet-queue.h"
30 #include "threads.h"
31 #include "threadvars.h"
32 #include "tm-queuehandlers.h"
33 #include "tm-threads.h"
34 #include "source-pcap.h"
35 #include "conf.h"
36 #include "util-debug.h"
37 #include "util-error.h"
38 #include "util-privs.h"
39 #include "util-device.h"
40 #include "util-optimize.h"
41 #include "util-checksum.h"
42 #include "util-ioctl.h"
43 #include "tmqh-packetpool.h"
44 
45 #define PCAP_STATE_DOWN 0
46 #define PCAP_STATE_UP 1
47 
48 #define PCAP_RECONNECT_TIMEOUT 500000
49 
50 /**
51  * \brief Structure to hold thread specific variables.
52  */
53 typedef struct PcapThreadVars_
54 {
55  /* thread specific handle */
56  pcap_t *pcap_handle;
57  /* handle state */
58  unsigned char pcap_state;
59  /* thread specific bpf */
60  struct bpf_program filter;
61  /* ptr to string from config */
62  const char *bpf_filter;
63 
65 
66  /* data link type for the thread */
67  int datalink;
68 
69  /* counters */
70  uint32_t pkts;
71  uint64_t bytes;
72  uint32_t errs;
73 
77 
80 
81  /** callback result -- set if one of the thread module failed. */
82  int cb_result;
83 
84  /* pcap buffer size */
87 
89 
92 
93 static TmEcode ReceivePcapThreadInit(ThreadVars *, const void *, void **);
94 static void ReceivePcapThreadExitStats(ThreadVars *, void *);
95 static TmEcode ReceivePcapLoop(ThreadVars *tv, void *data, void *slot);
96 static TmEcode ReceivePcapBreakLoop(ThreadVars *tv, void *data);
97 
98 static TmEcode DecodePcapThreadInit(ThreadVars *, const void *, void **);
99 static TmEcode DecodePcapThreadDeinit(ThreadVars *tv, void *data);
100 static TmEcode DecodePcap(ThreadVars *, Packet *, void *);
101 
102 /** protect pcap_compile and pcap_setfilter, as they are not thread safe:
103  * http://seclists.org/tcpdump/2009/q1/62 */
104 static SCMutex pcap_bpf_compile_lock = SCMUTEX_INITIALIZER;
105 
106 /**
107  * \brief Registration Function for RecievePcap.
108  */
110 {
111  tmm_modules[TMM_RECEIVEPCAP].name = "ReceivePcap";
112  tmm_modules[TMM_RECEIVEPCAP].ThreadInit = ReceivePcapThreadInit;
113  tmm_modules[TMM_RECEIVEPCAP].PktAcqLoop = ReceivePcapLoop;
114  tmm_modules[TMM_RECEIVEPCAP].PktAcqBreakLoop = ReceivePcapBreakLoop;
115  tmm_modules[TMM_RECEIVEPCAP].ThreadExitPrintStats = ReceivePcapThreadExitStats;
118 }
119 
120 /**
121  * \brief Registration Function for DecodePcap.
122  */
124 {
125  tmm_modules[TMM_DECODEPCAP].name = "DecodePcap";
126  tmm_modules[TMM_DECODEPCAP].ThreadInit = DecodePcapThreadInit;
127  tmm_modules[TMM_DECODEPCAP].Func = DecodePcap;
128  tmm_modules[TMM_DECODEPCAP].ThreadDeinit = DecodePcapThreadDeinit;
130 }
131 
132 static inline void PcapDumpCounters(PcapThreadVars *ptv)
133 {
134  struct pcap_stat pcap_s;
135  if (likely((pcap_stats(ptv->pcap_handle, &pcap_s) >= 0))) {
136  StatsSetUI64(ptv->tv, ptv->capture_kernel_packets, pcap_s.ps_recv);
137  StatsSetUI64(ptv->tv, ptv->capture_kernel_drops, pcap_s.ps_drop);
138  (void) SC_ATOMIC_SET(ptv->livedev->drop, pcap_s.ps_drop);
139  StatsSetUI64(ptv->tv, ptv->capture_kernel_ifdrops, pcap_s.ps_ifdrop);
140  }
141 }
142 
143 static int PcapTryReopen(PcapThreadVars *ptv)
144 {
146 
147  int pcap_activate_r = pcap_activate(ptv->pcap_handle);
148  if (pcap_activate_r != 0) {
149  return pcap_activate_r;
150  }
151 
152  /* set bpf filter if we have one */
153  if (ptv->bpf_filter != NULL) {
154  if (pcap_compile(ptv->pcap_handle, &ptv->filter,
155  (char *)ptv->bpf_filter, 1, 0) < 0)
156  {
157  SCLogError(SC_ERR_BPF, "bpf compilation error %s",
158  pcap_geterr(ptv->pcap_handle));
159  return -1;
160  }
161 
162  if (pcap_setfilter(ptv->pcap_handle, &ptv->filter) < 0) {
163  SCLogError(SC_ERR_BPF, "could not set bpf filter %s",
164  pcap_geterr(ptv->pcap_handle));
165  return -1;
166  }
167  }
168 
169  SCLogInfo("Recovering interface listening");
170  ptv->pcap_state = PCAP_STATE_UP;
171  return 0;
172 }
173 
174 static void PcapCallbackLoop(char *user, struct pcap_pkthdr *h, u_char *pkt)
175 {
176  SCEnter();
177 
178  PcapThreadVars *ptv = (PcapThreadVars *)user;
180  struct timeval current_time;
181 
182  if (unlikely(p == NULL)) {
183  SCReturn;
184  }
185 
187  p->ts.tv_sec = h->ts.tv_sec;
188  p->ts.tv_usec = h->ts.tv_usec;
189  SCLogDebug("p->ts.tv_sec %"PRIuMAX"", (uintmax_t)p->ts.tv_sec);
190  p->datalink = ptv->datalink;
191 
192  ptv->pkts++;
193  ptv->bytes += h->caplen;
194  (void) SC_ATOMIC_ADD(ptv->livedev->pkts, 1);
195  p->livedev = ptv->livedev;
196 
197  if (unlikely(PacketCopyData(p, pkt, h->caplen))) {
198  TmqhOutputPacketpool(ptv->tv, p);
199  SCReturn;
200  }
201 
202  switch (ptv->checksum_mode) {
204  if (ptv->livedev->ignore_checksum) {
206  } else if (ChecksumAutoModeCheck(ptv->pkts,
207  SC_ATOMIC_GET(ptv->livedev->pkts),
208  SC_ATOMIC_GET(ptv->livedev->invalid_checksums))) {
209  ptv->livedev->ignore_checksum = 1;
211  }
212  break;
215  break;
216  default:
217  break;
218  }
219 
220  if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) {
221  pcap_breakloop(ptv->pcap_handle);
222  ptv->cb_result = TM_ECODE_FAILED;
223  }
224 
225  /* Trigger one dump of stats every second */
226  TimeGet(&current_time);
227  if (current_time.tv_sec != ptv->last_stats_dump) {
228  PcapDumpCounters(ptv);
229  ptv->last_stats_dump = current_time.tv_sec;
230  }
231 
232  SCReturn;
233 }
234 
235 #ifndef PCAP_ERROR_BREAK
236 #define PCAP_ERROR_BREAK -2
237 #endif
238 
239 /**
240  * \brief Main PCAP reading Loop function
241  */
242 static TmEcode ReceivePcapLoop(ThreadVars *tv, void *data, void *slot)
243 {
244  SCEnter();
245 
246  int packet_q_len = 64;
247  PcapThreadVars *ptv = (PcapThreadVars *)data;
248  TmSlot *s = (TmSlot *)slot;
249 
250  ptv->slot = s->slot_next;
251  ptv->cb_result = TM_ECODE_OK;
252 
253  while (1) {
256  }
257 
258  /* make sure we have at least one packet in the packet pool, to prevent
259  * us from alloc'ing packets at line rate */
260  PacketPoolWait();
261 
262  int r = pcap_dispatch(ptv->pcap_handle, packet_q_len,
263  (pcap_handler)PcapCallbackLoop, (u_char *)ptv);
264  if (unlikely(r == 0 || r == PCAP_ERROR_BREAK)) {
265  if (r == PCAP_ERROR_BREAK && ptv->cb_result == TM_ECODE_FAILED) {
267  }
268  TmThreadsCaptureHandleTimeout(tv, NULL);
269  } else if (unlikely(r < 0)) {
270  int dbreak = 0;
271  SCLogError(SC_ERR_PCAP_DISPATCH, "error code %" PRId32 " %s",
272  r, pcap_geterr(ptv->pcap_handle));
273  do {
274  usleep(PCAP_RECONNECT_TIMEOUT);
275  if (suricata_ctl_flags != 0) {
276  dbreak = 1;
277  break;
278  }
279  r = PcapTryReopen(ptv);
280  } while (r < 0);
281  if (dbreak) {
282  break;
283  }
284  } else if (ptv->cb_result == TM_ECODE_FAILED) {
285  SCLogError(SC_ERR_PCAP_DISPATCH, "Pcap callback PcapCallbackLoop failed");
287  }
288 
290  }
291 
292  PcapDumpCounters(ptv);
295 }
296 
297 /**
298  * \brief PCAP Break Loop function.
299  */
300 static TmEcode ReceivePcapBreakLoop(ThreadVars *tv, void *data)
301 {
302  SCEnter();
303  PcapThreadVars *ptv = (PcapThreadVars *)data;
304  if (ptv->pcap_handle == NULL) {
306  }
307  pcap_breakloop(ptv->pcap_handle);
309 }
310 
311 /**
312  * \brief Init function for ReceivePcap.
313  *
314  * This is a setup function for recieving packets
315  * via libpcap. There are two versions of this function
316  * depending on the major version of libpcap used.
317  * For versions prior to 1.x we use open_pcap_live,
318  * for versions 1.x and greater we use pcap_create + pcap_activate.
319  *
320  * \param tv pointer to ThreadVars
321  * \param initdata pointer to the interface passed from the user
322  * \param data pointer gets populated with PcapThreadVars
323  *
324  * \todo Create a general pcap setup function.
325  */
326 static TmEcode ReceivePcapThreadInit(ThreadVars *tv, const void *initdata, void **data)
327 {
328  SCEnter();
329  PcapIfaceConfig *pcapconfig = (PcapIfaceConfig *)initdata;
330 
331  if (initdata == NULL) {
332  SCLogError(SC_ERR_INVALID_ARGUMENT, "initdata == NULL");
334  }
335 
336  PcapThreadVars *ptv = SCCalloc(1, sizeof(PcapThreadVars));
337  if (unlikely(ptv == NULL)) {
338  pcapconfig->DerefFunc(pcapconfig);
340  }
341 
342  ptv->tv = tv;
343 
344  ptv->livedev = LiveGetDevice(pcapconfig->iface);
345  if (ptv->livedev == NULL) {
346  SCLogError(SC_ERR_INVALID_VALUE, "unable to find Live device");
347  SCFree(ptv);
349  }
350  SCLogInfo("using interface %s", (char *)pcapconfig->iface);
351 
352  if (LiveGetOffload() == 0) {
353  (void)GetIfaceOffloading((char *)pcapconfig->iface, 1, 1);
354  } else {
355  DisableIfaceOffloading(ptv->livedev, 1, 1);
356  }
357 
358  ptv->checksum_mode = pcapconfig->checksum_mode;
360  SCLogInfo("running in 'auto' checksum mode. Detection of interface "
361  "state will require " xstr(CHECKSUM_SAMPLE_COUNT) " packets");
362  }
363 
364  char errbuf[PCAP_ERRBUF_SIZE];
365  ptv->pcap_handle = pcap_create((char *)pcapconfig->iface, errbuf);
366  if (ptv->pcap_handle == NULL) {
367  if (strlen(errbuf)) {
368  SCLogError(SC_ERR_PCAP_CREATE, "could not create a new "
369  "pcap handler for %s, error %s",
370  (char *)pcapconfig->iface, errbuf);
371  } else {
372  SCLogError(SC_ERR_PCAP_CREATE, "could not create a new "
373  "pcap handler for %s",
374  (char *)pcapconfig->iface);
375  }
376  SCFree(ptv);
377  pcapconfig->DerefFunc(pcapconfig);
379  }
380 
381  if (pcapconfig->snaplen == 0) {
382  /* We set snaplen if we can get the MTU */
383  ptv->pcap_snaplen = GetIfaceMaxPacketSize(pcapconfig->iface);
384  } else {
385  ptv->pcap_snaplen = pcapconfig->snaplen;
386  }
387  if (ptv->pcap_snaplen > 0) {
388  /* set Snaplen. Must be called before pcap_activate */
389  int pcap_set_snaplen_r = pcap_set_snaplen(ptv->pcap_handle, ptv->pcap_snaplen);
390  if (pcap_set_snaplen_r != 0) {
391  SCLogError(SC_ERR_PCAP_SET_SNAPLEN, "could not set snaplen, "
392  "error: %s", pcap_geterr(ptv->pcap_handle));
393  SCFree(ptv);
394  pcapconfig->DerefFunc(pcapconfig);
396  }
397  SCLogInfo("Set snaplen to %d for '%s'", ptv->pcap_snaplen,
398  pcapconfig->iface);
399  }
400 
401  /* set Promisc, and Timeout. Must be called before pcap_activate */
402  int pcap_set_promisc_r = pcap_set_promisc(ptv->pcap_handle, pcapconfig->promisc);
403  if (pcap_set_promisc_r != 0) {
404  SCLogError(SC_ERR_PCAP_SET_PROMISC, "could not set promisc mode, "
405  "error %s", pcap_geterr(ptv->pcap_handle));
406  SCFree(ptv);
407  pcapconfig->DerefFunc(pcapconfig);
409  }
410 
411  int pcap_set_timeout_r = pcap_set_timeout(ptv->pcap_handle, LIBPCAP_COPYWAIT);
412  if (pcap_set_timeout_r != 0) {
413  SCLogError(SC_ERR_PCAP_SET_TIMEOUT, "could not set timeout, "
414  "error %s", pcap_geterr(ptv->pcap_handle));
415  SCFree(ptv);
416  pcapconfig->DerefFunc(pcapconfig);
418  }
419 #ifdef HAVE_PCAP_SET_BUFF
420  ptv->pcap_buffer_size = pcapconfig->buffer_size;
421  if (ptv->pcap_buffer_size > 0) {
422  SCLogInfo("going to use pcap buffer size of %" PRId32,
423  ptv->pcap_buffer_size);
424 
425  int pcap_set_buffer_size_r = pcap_set_buffer_size(ptv->pcap_handle,
426  ptv->pcap_buffer_size);
427  if (pcap_set_buffer_size_r != 0) {
428  SCLogError(SC_ERR_PCAP_SET_BUFF_SIZE, "could not set "
429  "pcap buffer size, error %s", pcap_geterr(ptv->pcap_handle));
430  SCFree(ptv);
431  pcapconfig->DerefFunc(pcapconfig);
433  }
434  }
435 #endif /* HAVE_PCAP_SET_BUFF */
436 
437  /* activate the handle */
438  int pcap_activate_r = pcap_activate(ptv->pcap_handle);
439  if (pcap_activate_r != 0) {
440  SCLogError(SC_ERR_PCAP_ACTIVATE_HANDLE, "could not activate the "
441  "pcap handler, error %s", pcap_geterr(ptv->pcap_handle));
442  SCFree(ptv);
443  pcapconfig->DerefFunc(pcapconfig);
445  }
446  ptv->pcap_state = PCAP_STATE_UP;
447 
448  /* set bpf filter if we have one */
449  if (pcapconfig->bpf_filter) {
450  SCMutexLock(&pcap_bpf_compile_lock);
451 
452  ptv->bpf_filter = pcapconfig->bpf_filter;
453 
454  if (pcap_compile(ptv->pcap_handle, &ptv->filter,
455  (char *)ptv->bpf_filter, 1, 0) < 0)
456  {
457  SCLogError(SC_ERR_BPF, "bpf compilation error %s",
458  pcap_geterr(ptv->pcap_handle));
459 
460  SCMutexUnlock(&pcap_bpf_compile_lock);
461  SCFree(ptv);
462  pcapconfig->DerefFunc(pcapconfig);
463  return TM_ECODE_FAILED;
464  }
465 
466  if (pcap_setfilter(ptv->pcap_handle, &ptv->filter) < 0) {
467  SCLogError(SC_ERR_BPF, "could not set bpf filter %s",
468  pcap_geterr(ptv->pcap_handle));
469 
470  SCMutexUnlock(&pcap_bpf_compile_lock);
471  SCFree(ptv);
472  pcapconfig->DerefFunc(pcapconfig);
473  return TM_ECODE_FAILED;
474  }
475 
476  SCMutexUnlock(&pcap_bpf_compile_lock);
477  }
478 
479  /* no offloading supported at all */
480  (void)GetIfaceOffloading(pcapconfig->iface, 1, 1);
481 
482  ptv->datalink = pcap_datalink(ptv->pcap_handle);
483 
484  pcapconfig->DerefFunc(pcapconfig);
485 
486  ptv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets",
487  ptv->tv);
488  ptv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops",
489  ptv->tv);
490  ptv->capture_kernel_ifdrops = StatsRegisterCounter("capture.kernel_ifdrops",
491  ptv->tv);
492 
493  *data = (void *)ptv;
495 }
496 
497 /**
498  * \brief This function prints stats to the screen at exit.
499  * \param tv pointer to ThreadVars
500  * \param data pointer that gets cast into PcapThreadVars for ptv
501  */
502 static void ReceivePcapThreadExitStats(ThreadVars *tv, void *data)
503 {
504  SCEnter();
505  PcapThreadVars *ptv = (PcapThreadVars *)data;
506  struct pcap_stat pcap_s;
507 
508  if (pcap_stats(ptv->pcap_handle, &pcap_s) < 0) {
509  SCLogError(SC_ERR_STAT,"(%s) Failed to get pcap_stats: %s",
510  tv->name, pcap_geterr(ptv->pcap_handle));
511  SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "",
512  tv->name, ptv->pkts, ptv->bytes);
513  } else {
514  SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "",
515  tv->name, ptv->pkts, ptv->bytes);
516 
517  /* these numbers are not entirely accurate as ps_recv contains packets
518  * that are still waiting to be processed at exit. ps_drop only contains
519  * packets dropped by the driver and not any packets dropped by the interface.
520  * Additionally see http://tracker.icir.org/bro/ticket/18
521  *
522  * Note: ps_recv includes dropped packets and should be considered total.
523  * Unless we start to look at ps_ifdrop which isn't supported everywhere.
524  */
525  SCLogInfo("(%s) Pcap Total:%" PRIu64 " Recv:%" PRIu64 " Drop:%" PRIu64 " (%02.1f%%).",
526  tv->name, (uint64_t)pcap_s.ps_recv,
527  (uint64_t)pcap_s.ps_recv - (uint64_t)pcap_s.ps_drop,
528  (uint64_t)pcap_s.ps_drop,
529  (((float)(uint64_t)pcap_s.ps_drop)/(float)(uint64_t)pcap_s.ps_recv)*100);
530  }
531 }
532 
533 /**
534  * \brief This function passes off to link type decoders.
535  *
536  * DecodePcap decodes packets from libpcap and passes
537  * them off to the proper link type decoder.
538  *
539  * \param t pointer to ThreadVars
540  * \param p pointer to the current packet
541  * \param data pointer that gets cast into PcapThreadVars for ptv
542  */
543 static TmEcode DecodePcap(ThreadVars *tv, Packet *p, void *data)
544 {
545  SCEnter();
547 
549 
550  /* update counters */
552 
553  DecodeLinkLayer(tv, dtv, p->datalink, p, GET_PKT_DATA(p), GET_PKT_LEN(p));
554 
556 
558 }
559 
560 static TmEcode DecodePcapThreadInit(ThreadVars *tv, const void *initdata, void **data)
561 {
562  SCEnter();
563 
565  if (dtv == NULL)
567 
569 
570  *data = (void *)dtv;
571 
573 }
574 
575 static TmEcode DecodePcapThreadDeinit(ThreadVars *tv, void *data)
576 {
577  if (data != NULL)
578  DecodeThreadVarsFree(tv, data);
580 }
581 
582 void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
583 {
584  char errbuf[PCAP_ERRBUF_SIZE];
585  pcap_if_t *alldevsp = NULL;
586 
587  struct addrinfo ai_hints;
588  struct addrinfo *ai_list = NULL;
589  int ret = 0;
590 
591  memset(&ai_hints, 0, sizeof(ai_hints));
592  ai_hints.ai_family = AF_UNSPEC;
593  ai_hints.ai_flags = AI_NUMERICHOST;
594 
595  /* try to translate IP */
596  if ((ret = getaddrinfo(pcap_dev, NULL, &ai_hints, &ai_list)) != 0) {
597  return;
598  }
599 
600  if (pcap_findalldevs(&alldevsp, errbuf)) {
601  freeaddrinfo(ai_list);
602  return;
603  }
604 
605  for (pcap_if_t *devsp = alldevsp; devsp ; devsp = devsp->next) {
606  for (pcap_addr_t *ip = devsp->addresses; ip ; ip = ip->next) {
607 
608  if (ai_list->ai_family != ip->addr->sa_family) {
609  continue;
610  }
611 
612  if (ip->addr->sa_family == AF_INET) {
613  if (memcmp(&((struct sockaddr_in*)ai_list->ai_addr)->sin_addr,
614  &((struct sockaddr_in*)ip->addr)->sin_addr,
615  sizeof(struct in_addr)))
616  {
617  continue;
618  }
619  } else if (ip->addr->sa_family == AF_INET6) {
620  if (memcmp(&((struct sockaddr_in6*)ai_list->ai_addr)->sin6_addr,
621  &((struct sockaddr_in6*)ip->addr)->sin6_addr,
622  sizeof(struct in6_addr)))
623  {
624  continue;
625  }
626  } else {
627  continue;
628  }
629 
630  freeaddrinfo(ai_list);
631 
632  memset(pcap_dev, 0, len);
633  strlcpy(pcap_dev, devsp->name, len);
634 
635  pcap_freealldevs(alldevsp);
636  return;
637  }
638  }
639 
640  freeaddrinfo(ai_list);
641 
642  pcap_freealldevs(alldevsp);
643 }
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:67
SC_ERR_PCAP_SET_TIMEOUT
@ SC_ERR_PCAP_SET_TIMEOUT
Definition: util-error.h:54
PcapThreadVars_::capture_kernel_ifdrops
uint16_t capture_kernel_ifdrops
Definition: source-pcap.c:76
PcapThreadVars_::cb_result
int cb_result
Definition: source-pcap.c:82
tm-threads.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
source-pcap.h
PcapThreadVars_::livedev
LiveDevice * livedev
Definition: source-pcap.c:90
ThreadVars_::name
char name[16]
Definition: threadvars.h:65
SC_ERR_INVALID_VALUE
@ SC_ERR_INVALID_VALUE
Definition: util-error.h:160
PcapThreadVars_::pcap_buffer_size
int pcap_buffer_size
Definition: source-pcap.c:85
PcapThreadVars_::filter
struct bpf_program filter
Definition: source-pcap.c:60
PcapThreadVars_::pkts
uint32_t pkts
Definition: source-pcap.c:70
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:262
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1125
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:355
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
LiveGetOffload
int LiveGetOffload(void)
Definition: util-device.c:79
PcapIfaceConfig_::promisc
int promisc
Definition: source-pcap.h:54
util-checksum.h
Packet_::flags
uint32_t flags
Definition: decode.h:446
threads.h
SC_ERR_PCAP_SET_SNAPLEN
@ SC_ERR_PCAP_SET_SNAPLEN
Definition: util-error.h:52
PcapIfaceConfig_::bpf_filter
const char * bpf_filter
Definition: source-pcap.h:56
PcapThreadVars_::bpf_filter
const char * bpf_filter
Definition: source-pcap.c:62
LiveDevice_
Definition: util-device.h:40
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:304
StatsSetUI64
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
Definition: counters.c:191
CHECKSUM_SAMPLE_COUNT
#define CHECKSUM_SAMPLE_COUNT
Definition: util-checksum.h:33
packet-queue.h
SURICATA_STOP
#define SURICATA_STOP
Definition: suricata.h:90
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
util-privs.h
StatsSyncCountersIfSignalled
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:137
CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_DISABLE
Definition: decode.h:42
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:118
PcapThreadVars_::errs
uint32_t errs
Definition: source-pcap.c:72
PcapThreadVars_::bytes
uint64_t bytes
Definition: source-pcap.c:71
TmqhOutputPacketpool
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
Definition: tmqh-packetpool.c:375
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:79
SC_ERR_PCAP_CREATE
@ SC_ERR_PCAP_CREATE
Definition: util-error.h:51
ChecksumAutoModeCheck
int ChecksumAutoModeCheck(uint64_t thread_count, uint64_t iface_count, uint64_t iface_fail)
Check if the number of invalid checksums indicate checksum offloading in place.
Definition: util-checksum.c:70
tmqh-packetpool.h
TmModule_::PktAcqLoop
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
Definition: tm-modules.h:54
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:78
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
PcapTranslateIPToDevice
void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
Definition: source-pcap.c:582
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
Packet_::datalink
int datalink
Definition: decode.h:577
GetIfaceMaxPacketSize
int GetIfaceMaxPacketSize(const char *pcap_dev)
output max packet size for a link
Definition: util-ioctl.c:132
PcapIfaceConfig_::snaplen
int snaplen
Definition: source-pcap.h:52
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1128
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:477
CHECKSUM_VALIDATION_AUTO
@ CHECKSUM_VALIDATION_AUTO
Definition: decode.h:44
LIBPCAP_COPYWAIT
#define LIBPCAP_COPYWAIT
Definition: source-pcap.h:31
decode.h
util-device.h
util-debug.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:50
LiveDevice_::ignore_checksum
int ignore_checksum
Definition: util-device.h:45
util-error.h
TmModule_::PktAcqBreakLoop
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
Definition: tm-modules.h:57
PcapThreadVars_::capture_kernel_packets
uint16_t capture_kernel_packets
Definition: source-pcap.c:74
PcapThreadVars_::slot
TmSlot * slot
Definition: source-pcap.c:79
PCAP_STATE_DOWN
#define PCAP_STATE_DOWN
Definition: source-pcap.c:45
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
LiveGetDevice
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:279
PCAP_RECONNECT_TIMEOUT
#define PCAP_RECONNECT_TIMEOUT
Definition: source-pcap.c:48
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:228
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PCAP_STATE_UP
#define PCAP_STATE_UP
Definition: source-pcap.c:46
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:52
PcapThreadVars
struct PcapThreadVars_ PcapThreadVars
Structure to hold thread specific variables.
PcapIfaceConfig_::buffer_size
int buffer_size
Definition: source-pcap.h:50
SC_ERR_INVALID_ARGUMENT
@ SC_ERR_INVALID_ARGUMENT
Definition: util-error.h:43
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:282
xstr
#define xstr(s)
Definition: suricata-common.h:272
PcapThreadVars_::capture_kernel_drops
uint16_t capture_kernel_drops
Definition: source-pcap.c:75
PacketPoolWait
void PacketPoolWait(void)
Definition: tmqh-packetpool.c:84
SCReturn
#define SCReturn
Definition: util-debug.h:302
Packet_
Definition: decode.h:411
SC_ERR_PCAP_SET_BUFF_SIZE
@ SC_ERR_PCAP_SET_BUFF_SIZE
Definition: util-error.h:58
TM_FLAG_DECODE_TM
#define TM_FLAG_DECODE_TM
Definition: tm-modules.h:32
PcapIfaceConfig_::DerefFunc
void(* DerefFunc)(void *)
Definition: source-pcap.h:59
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:227
conf.h
TmSlot_
Definition: tm-threads.h:52
PKT_IGNORE_CHECKSUM
#define PKT_IGNORE_CHECKSUM
Definition: decode.h:1096
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:556
TmEcode
TmEcode
Definition: tm-threads-common.h:77
GetIfaceOffloading
int GetIfaceOffloading(const char *dev, int csum, int other)
output offloading status of the link
Definition: util-ioctl.c:694
DisableIfaceOffloading
int DisableIfaceOffloading(LiveDevice *dev, int csum, int other)
Definition: util-ioctl.c:707
TmModule_::name
const char * name
Definition: tm-modules.h:44
PcapIfaceConfig_
Definition: source-pcap.h:45
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
PcapThreadVars_::tv
ThreadVars * tv
Definition: source-pcap.c:78
TM_FLAG_RECEIVE_TM
#define TM_FLAG_RECEIVE_TM
Definition: tm-modules.h:31
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
tm-queuehandlers.h
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:637
Packet_::ts
struct timeval ts
Definition: decode.h:454
ChecksumValidationMode
ChecksumValidationMode
Definition: decode.h:41
suricata-common.h
PcapThreadVars_::pcap_handle
pcap_t * pcap_handle
Definition: source-pcap.c:56
PcapThreadVars_::pcap_state
unsigned char pcap_state
Definition: source-pcap.c:58
SC_ERR_PCAP_DISPATCH
@ SC_ERR_PCAP_DISPATCH
Definition: util-error.h:50
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
PcapIfaceConfig_::iface
char iface[PCAP_IFACE_NAME_LENGTH]
Definition: source-pcap.h:46
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
SC_ERR_BPF
@ SC_ERR_BPF
Definition: util-error.h:157
util-optimize.h
TmModule_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:48
threadvars.h
TMM_DECODEPCAP
@ TMM_DECODEPCAP
Definition: tm-threads-common.h:40
TmModuleDecodePcapRegister
void TmModuleDecodePcapRegister(void)
Registration Function for DecodePcap.
Definition: source-pcap.c:123
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:625
TmModuleReceivePcapRegister
void TmModuleReceivePcapRegister(void)
Registration Function for RecievePcap.
Definition: source-pcap.c:109
bpf_program
Definition: source-af-packet.c:78
util-ioctl.h
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:618
TimeGet
void TimeGet(struct timeval *tv)
Definition: util-time.c:153
SC_ERR_STAT
@ SC_ERR_STAT
Definition: util-error.h:145
suricata.h
PcapIfaceConfig_::checksum_mode
ChecksumValidationMode checksum_mode
Definition: source-pcap.h:57
PcapThreadVars_::last_stats_dump
time_t last_stats_dump
Definition: source-pcap.c:64
TMM_RECEIVEPCAP
@ TMM_RECEIVEPCAP
Definition: tm-threads-common.h:38
likely
#define likely(expr)
Definition: util-optimize.h:32
TmSlot_::slot_next
struct TmSlot_ * slot_next
Definition: tm-threads.h:61
SC_ERR_PCAP_ACTIVATE_HANDLE
@ SC_ERR_PCAP_ACTIVATE_HANDLE
Definition: util-error.h:57
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:347
PcapThreadVars_
Structure to hold thread specific variables.
Definition: source-pcap.c:54
SC_ERR_PCAP_SET_PROMISC
@ SC_ERR_PCAP_SET_PROMISC
Definition: util-error.h:53
PcapThreadVars_::checksum_mode
ChecksumValidationMode checksum_mode
Definition: source-pcap.c:88
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:945
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
PcapThreadVars_::datalink
int datalink
Definition: source-pcap.c:67
PCAP_ERROR_BREAK
#define PCAP_ERROR_BREAK
Definition: source-pcap.c:236
SCMutex
#define SCMutex
Definition: threads-debug.h:114
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:180
SC_CAP_NET_RAW
#define SC_CAP_NET_RAW
Definition: util-privs.h:32
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:70
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:584
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:198
PcapThreadVars_::pcap_snaplen
int pcap_snaplen
Definition: source-pcap.c:86