suricata
source-pfring.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "conf.h"
#include "decode.h"
#include "packet-queue.h"
#include "threads.h"
#include "threadvars.h"
#include "tm-queuehandlers.h"
#include "tm-threads.h"
#include "source-pfring.h"
#include "util-debug.h"
#include "util-checksum.h"
#include "util-privs.h"
#include "util-device.h"
#include "util-host-info.h"
#include "runmodes.h"
#include "util-profiling.h"
#include <pfring.h>
Include dependency graph for source-pfring.c:

Go to the source code of this file.

Data Structures

struct  PfringThreadVars_
 Structure to hold thread specific variables. More...
 

Macros

#define LIBPFRING_PROMISC   1
 
#define LIBPFRING_REENTRANT   0
 
#define LIBPFRING_WAIT_FOR_INCOMING   1
 
#define PFRING_FLAGS_ZERO_COPY   (1 << 0)
 
#define PFRING_FLAGS_BYPASS   (1 << 1)
 

Functions

TmEcode ReceivePfringLoop (ThreadVars *tv, void *data, void *slot)
 Recieves packets from an interface via libpfring. More...
 
TmEcode PfringBreakLoop (ThreadVars *tv, void *data)
 Stop function for ReceivePfringLoop. More...
 
TmEcode ReceivePfringThreadInit (ThreadVars *tv, const void *initdata, void **data)
 Init function for RecievePfring. More...
 
void ReceivePfringThreadExitStats (ThreadVars *tv, void *data)
 This function prints stats to the screen at exit. More...
 
TmEcode ReceivePfringThreadDeinit (ThreadVars *tv, void *data)
 DeInit function closes pd at exit. More...
 
TmEcode DecodePfringThreadInit (ThreadVars *tv, const void *initdata, void **data)
 This an Init function for DecodePfring. More...
 
TmEcode DecodePfring (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 This function passes off to link type decoders. More...
 
TmEcode DecodePfringThreadDeinit (ThreadVars *tv, void *data)
 
void TmModuleReceivePfringRegister (void)
 Registration Function for RecievePfring. More...
 
void TmModuleDecodePfringRegister (void)
 Registration Function for DecodePfring. More...
 

Variables

int max_pending_packets
 

Detailed Description

Author
William Metcalf willi.nosp@m.am.m.nosp@m.etcal.nosp@m.f@gm.nosp@m.ail.c.nosp@m.om
Eric Leblond eric@.nosp@m.regi.nosp@m.t.org

PF_RING packet acquisition support

Todo:

remove requirement for setting cluster so old 3.x versions are supported

implement DNA support

Allow ring options such as snaplen etc, to be user configurable.

Definition in file source-pfring.c.

Macro Definition Documentation

#define LIBPFRING_PROMISC   1

Definition at line 112 of file source-pfring.c.

#define LIBPFRING_REENTRANT   0

Definition at line 113 of file source-pfring.c.

#define LIBPFRING_WAIT_FOR_INCOMING   1

Definition at line 114 of file source-pfring.c.

Referenced by ReceivePfringLoop().

#define PFRING_FLAGS_BYPASS   (1 << 1)
#define PFRING_FLAGS_ZERO_COPY   (1 << 0)

Definition at line 117 of file source-pfring.c.

Referenced by ReceivePfringLoop(), and ReceivePfringThreadInit().

Function Documentation

TmEcode DecodePfring ( ThreadVars tv,
Packet p,
void *  data,
PacketQueue pq,
PacketQueue postpq 
)

This function passes off to link type decoders.

DecodePfring reads packets from the PacketQueue. Inside of libpcap version of PF_RING all packets are marked as a link type of ethernet so that is what we do here.

Parameters
tvpointer to ThreadVars
ppointer to the current packet
datapointer that gets cast into PfringThreadVars for ptv
pqpointer to the current PacketQueue
Todo:
Verify that PF_RING only deals with ethernet traffic
Warning
This function bypasses the pkt buf and len macro's
Return values
TM_ECODE_OKis always returned

Definition at line 732 of file source-pfring.c.

References DecodeThreadVars_::counter_vlan, DecodeEthernet(), DecodeUpdatePacketCounters(), Packet_::flags, GET_PKT_DATA, GET_PKT_LEN, PacketDecodeFinalize(), PKT_PSEUDO_STREAM_END, StatsIncr(), TM_ECODE_OK, and Packet_::vlan_idx.

Referenced by TmModuleDecodePfringRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodePfringThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 780 of file source-pfring.c.

References DecodeThreadVarsFree(), SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleDecodePfringRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodePfringThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

This an Init function for DecodePfring.

Parameters
tvpointer to ThreadVars
initdatapointer to initilization data.
datapointer that gets cast into PfringThreadVars for ptv
Return values
TM_ECODE_OKis returned on success
TM_ECODE_FAILEDis returned on error

Definition at line 765 of file source-pfring.c.

References DecodeRegisterPerfCounters(), DecodeThreadVarsAlloc(), SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleDecodePfringRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode PfringBreakLoop ( ThreadVars tv,
void *  data 
)

Stop function for ReceivePfringLoop.

This function forces ReceivePfringLoop to stop the execution, exiting the packet capture loop.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PfringThreadVars for ptv
Return values
TM_ECODE_OKon success
TM_ECODE_FAILEDon failure

Definition at line 462 of file source-pfring.c.

References PfringThreadVars_::pd, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleReceivePfringRegister().

Here is the caller graph for this function:

TmEcode ReceivePfringLoop ( ThreadVars tv,
void *  data,
void *  slot 
)

Recieves packets from an interface via libpfring.

This function recieves packets from an interface and passes the packet on to the pfring callback function.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PfringThreadVars for ptv
slotslot containing task information
Return values
TM_ECODE_OKon success
TM_ECODE_FAILEDon failure

Definition at line 348 of file source-pfring.c.

References Packet_::BypassPacketsFlow, PfringThreadVars_::flags, GET_PKT_DIRECT_DATA, GET_PKT_DIRECT_MAX_SIZE, LIBPFRING_WAIT_FOR_INCOMING, likely, PACKET_PROFILING_RESTART, PacketGetFromQueueOrAlloc(), PacketPoolWait(), PacketSetData(), PfringThreadVars_::pd, PFRING_FLAGS_BYPASS, PFRING_FLAGS_ZERO_COPY, PKT_SET_SRC, PKT_SRC_WIRE, SC_ERR_PF_RING_OPEN, SC_ERR_PF_RING_RECV, SCEnter, SCLogError, SCReturnInt, PfringThreadVars_::slot, TmSlot_::slot_next, StatsSyncCountersIfSignalled, suricata_ctl_flags, SURICATA_STOP, TM_ECODE_FAILED, TM_ECODE_OK, TmqhOutputPacketpool(), Packet_::ts, PfringThreadVars_::tv, and unlikely.

Referenced by TmModuleReceivePfringRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceivePfringThreadDeinit ( ThreadVars tv,
void *  data 
)

DeInit function closes pd at exit.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PfringThreadVars for ptvi
Return values
TM_ECODE_OKis always returned

Definition at line 699 of file source-pfring.c.

References PfringThreadVars_::bpf_filter, PfringThreadVars_::interface, PfringThreadVars_::pd, SCFree, and TM_ECODE_OK.

Referenced by TmModuleReceivePfringRegister().

Here is the caller graph for this function:

void ReceivePfringThreadExitStats ( ThreadVars tv,
void *  data 
)

This function prints stats to the screen at exit.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PfringThreadVars for ptv

Definition at line 674 of file source-pfring.c.

References PfringThreadVars_::bytes, PfringThreadVars_::capture_bypassed, PfringThreadVars_::capture_kernel_drops, PfringThreadVars_::capture_kernel_packets, PfringThreadVars_::flags, ThreadVars_::name, PFRING_FLAGS_BYPASS, PfringThreadVars_::pkts, SCLogPerf, and StatsGetLocalCounterValue().

Referenced by TmModuleReceivePfringRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceivePfringThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Init function for RecievePfring.

This is a setup function for recieving packets via libpfring.

Parameters
tvpointer to ThreadVars
initdatapointer to the interface passed from the user
datapointer gets populated with PfringThreadVars
Todo:

add a config option for setting cluster id

Create a general pfring setup function.

Return values
TM_ECODE_OKon success
TM_ECODE_FAILEDon error

Definition at line 490 of file source-pfring.c.

References PfringIfaceConfig_::bpf_filter, PfringThreadVars_::bpf_filter, PfringThreadVars_::capture_bypassed, PfringThreadVars_::capture_kernel_drops, PfringThreadVars_::capture_kernel_packets, PfringIfaceConfig_::checksum_mode, PfringThreadVars_::checksum_mode, CHECKSUM_VALIDATION_AUTO, CHECKSUM_VALIDATION_RXONLY, CLUSTER_FLOW, CLUSTER_FLOW_5_TUPLE, PfringIfaceConfig_::cluster_id, PfringThreadVars_::cluster_id, ConfGetBool(), PfringIfaceConfig_::ctype, PfringThreadVars_::ctype, default_packet_size, PfringIfaceConfig_::DerefFunc, PfringIfaceConfig_::flags, PfringThreadVars_::flags, PfringIfaceConfig_::iface, PfringThreadVars_::interface, PfringThreadVars_::livedev, LiveGetDevice(), ThreadVars_::name, PfringThreadVars_::pd, PFRING_CONF_FLAGS_BYPASS, PFRING_CONF_FLAGS_CLUSTER, PFRING_FLAGS_BYPASS, PFRING_FLAGS_ZERO_COPY, PROG_NAME, RunmodeGetActive(), SC_ERR_INVALID_VALUE, SC_ERR_MEM_ALLOC, SC_ERR_PF_RING_OPEN, SC_ERR_PF_RING_SET_CLUSTER_FAILED, SCFree, SCKernelVersionIsAtLeast(), SCLogError, SCLogInfo, SCLogPerf, SCLogWarning, SCMalloc, SCMutexLock, SCMutexUnlock, SCReturnInt, SCStrdup, StatsRegisterCounter(), PfringIfaceConfig_::threads, PfringThreadVars_::threads, TM_ECODE_FAILED, TM_ECODE_OK, PfringThreadVars_::tv, unlikely, version, and PfringThreadVars_::vlan_disabled.

Referenced by TmModuleReceivePfringRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void TmModuleReceivePfringRegister ( void  )