suricata
source-pfring.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "conf.h"
#include "decode.h"
#include "packet-queue.h"
#include "threads.h"
#include "threadvars.h"
#include "tm-queuehandlers.h"
#include "tm-threads.h"
#include "source-pfring.h"
#include "util-debug.h"
#include "util-checksum.h"
#include "util-privs.h"
#include "util-device.h"
#include "util-host-info.h"
#include "runmodes.h"
#include "util-profiling.h"
#include <pfring.h>
Include dependency graph for source-pfring.c:

Go to the source code of this file.

Data Structures

struct  PfringThreadVars_
 Structure to hold thread specific variables. More...
 

Macros

#define LIBPFRING_PROMISC   1
 
#define LIBPFRING_REENTRANT   0
 
#define LIBPFRING_WAIT_FOR_INCOMING   1
 
#define PFRING_FLAGS_ZERO_COPY   (1 << 0)
 
#define PFRING_FLAGS_BYPASS   (1 << 1)
 

Functions

TmEcode ReceivePfringLoop (ThreadVars *tv, void *data, void *slot)
 Recieves packets from an interface via libpfring. More...
 
TmEcode PfringBreakLoop (ThreadVars *tv, void *data)
 Stop function for ReceivePfringLoop. More...
 
TmEcode ReceivePfringThreadInit (ThreadVars *tv, const void *initdata, void **data)
 Init function for RecievePfring. More...
 
void ReceivePfringThreadExitStats (ThreadVars *tv, void *data)
 This function prints stats to the screen at exit. More...
 
TmEcode ReceivePfringThreadDeinit (ThreadVars *tv, void *data)
 DeInit function closes pd at exit. More...
 
TmEcode DecodePfringThreadInit (ThreadVars *tv, const void *initdata, void **data)
 This an Init function for DecodePfring. More...
 
TmEcode DecodePfring (ThreadVars *tv, Packet *p, void *data)
 This function passes off to link type decoders. More...
 
TmEcode DecodePfringThreadDeinit (ThreadVars *tv, void *data)
 
void TmModuleReceivePfringRegister (void)
 Registration Function for RecievePfring. More...
 
void TmModuleDecodePfringRegister (void)
 Registration Function for DecodePfring. More...
 

Variables

int max_pending_packets
 

Detailed Description

Author
William Metcalf willi.nosp@m.am.m.nosp@m.etcal.nosp@m.f@gm.nosp@m.ail.c.nosp@m.om
Eric Leblond eric@.nosp@m.regi.nosp@m.t.org

PF_RING packet acquisition support

Todo:

remove requirement for setting cluster so old 3.x versions are supported

implement DNA support

Allow ring options such as snaplen etc, to be user configurable.

Definition in file source-pfring.c.

Macro Definition Documentation

◆ LIBPFRING_PROMISC

#define LIBPFRING_PROMISC   1

Definition at line 112 of file source-pfring.c.

◆ LIBPFRING_REENTRANT

#define LIBPFRING_REENTRANT   0

Definition at line 113 of file source-pfring.c.

◆ LIBPFRING_WAIT_FOR_INCOMING

#define LIBPFRING_WAIT_FOR_INCOMING   1

Definition at line 114 of file source-pfring.c.

◆ PFRING_FLAGS_BYPASS

#define PFRING_FLAGS_BYPASS   (1 << 1)

Definition at line 118 of file source-pfring.c.

◆ PFRING_FLAGS_ZERO_COPY

#define PFRING_FLAGS_ZERO_COPY   (1 << 0)

Definition at line 117 of file source-pfring.c.

Function Documentation

◆ DecodePfring()

TmEcode DecodePfring ( ThreadVars tv,
Packet p,
void *  data 
)

This function passes off to link type decoders.

DecodePfring decodes raw packets from PF_RING. Inside of libpcap version of PF_RING all packets are marked as a link type of ethernet so that is what we do here.

Parameters
tvpointer to ThreadVars
ppointer to the current packet
datapointer that gets cast into PfringThreadVars for ptv
Todo:
Verify that PF_RING only deals with ethernet traffic
Warning
This function bypasses the pkt buf and len macro's
Return values
TM_ECODE_OKis always returned

Definition at line 721 of file source-pfring.c.

References BUG_ON, DecodeThreadVars_::counter_vlan, DecodeEthernet(), DecodeUpdatePacketCounters(), dtv, GET_PKT_DATA, GET_PKT_LEN, PacketDecodeFinalize(), PKT_IS_PSEUDOPKT, StatsIncr(), TM_ECODE_OK, tv, and Packet_::vlan_idx.

Referenced by TmModuleDecodePfringRegister().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DecodePfringThreadDeinit()

TmEcode DecodePfringThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 766 of file source-pfring.c.

References DecodeThreadVarsFree(), SCReturnInt, TM_ECODE_OK, and tv.

Referenced by TmModuleDecodePfringRegister().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DecodePfringThreadInit()

TmEcode DecodePfringThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

This an Init function for DecodePfring.

Parameters
tvpointer to ThreadVars
initdatapointer to initilization data.
datapointer that gets cast into PfringThreadVars for ptv
Return values
TM_ECODE_OKis returned on success
TM_ECODE_FAILEDis returned on error

Definition at line 751 of file source-pfring.c.

References DecodeRegisterPerfCounters(), DecodeThreadVarsAlloc(), dtv, SCReturnInt, TM_ECODE_FAILED, TM_ECODE_OK, and tv.

Referenced by TmModuleDecodePfringRegister().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PfringBreakLoop()

TmEcode PfringBreakLoop ( ThreadVars tv,
void *  data 
)

Stop function for ReceivePfringLoop.

This function forces ReceivePfringLoop to stop the execution, exiting the packet capture loop.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PfringThreadVars for ptv
Return values
TM_ECODE_OKon success
TM_ECODE_FAILEDon failure

Definition at line 460 of file source-pfring.c.

References PfringThreadVars_::pd, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleReceivePfringRegister().

Here is the caller graph for this function:

◆ ReceivePfringLoop()

TmEcode ReceivePfringLoop ( ThreadVars tv,
void *  data,
void *  slot 
)

Recieves packets from an interface via libpfring.

This function recieves packets from an interface and passes the packet on to the pfring callback function.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PfringThreadVars for ptv
slotslot containing task information
Return values
TM_ECODE_OKon success
TM_ECODE_FAILEDon failure

Definition at line 347 of file source-pfring.c.

References Packet_::BypassPacketsFlow, PfringThreadVars_::flags, GET_PKT_DIRECT_DATA, GET_PKT_DIRECT_MAX_SIZE, LIBPFRING_WAIT_FOR_INCOMING, likely, PACKET_PROFILING_RESTART, PacketGetFromQueueOrAlloc(), PacketPoolWait(), PacketSetData(), PfringThreadVars_::pd, PFRING_FLAGS_BYPASS, PFRING_FLAGS_ZERO_COPY, PKT_SET_SRC, PKT_SRC_WIRE, SC_ERR_PF_RING_OPEN, SCEnter, SCLogError, SCReturnInt, PfringThreadVars_::slot, TmSlot_::slot_next, suricata_ctl_flags, SURICATA_STOP, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleReceivePfringRegister().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ ReceivePfringThreadDeinit()

TmEcode ReceivePfringThreadDeinit ( ThreadVars tv,
void *  data 
)

DeInit function closes pd at exit.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PfringThreadVars for ptvi
Return values
TM_ECODE_OKis always returned

Definition at line 689 of file source-pfring.c.

References PfringThreadVars_::bpf_filter, PfringThreadVars_::interface, PfringThreadVars_::pd, SCFree, and TM_ECODE_OK.

Referenced by TmModuleReceivePfringRegister().

Here is the caller graph for this function:

◆ ReceivePfringThreadExitStats()

void ReceivePfringThreadExitStats ( ThreadVars tv,
void *  data 
)

This function prints stats to the screen at exit.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PfringThreadVars for ptv

Definition at line 664 of file source-pfring.c.

Referenced by TmModuleReceivePfringRegister().

Here is the caller graph for this function:

◆ ReceivePfringThreadInit()

TmEcode ReceivePfringThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Init function for RecievePfring.

This is a setup function for recieving packets via libpfring.

Parameters
tvpointer to ThreadVars
initdatapointer to the interface passed from the user
datapointer gets populated with PfringThreadVars
Todo:

add a config option for setting cluster id

Create a general pfring setup function.

Return values
TM_ECODE_OKon success
TM_ECODE_FAILEDon error

Definition at line 488 of file source-pfring.c.

References version.

Referenced by TmModuleReceivePfringRegister().

Here is the caller graph for this function:

◆ TmModuleDecodePfringRegister()

void TmModuleDecodePfringRegister ( void  )

Registration Function for DecodePfring.

Todo:
Unit tests are needed for this module.

Definition at line 180 of file source-pfring.c.

References DecodePfring(), DecodePfringThreadDeinit(), DecodePfringThreadInit(), TmModule_::flags, TmModule_::Func, TmModule_::name, TmModule_::RegisterTests, TmModule_::ThreadDeinit, TmModule_::ThreadExitPrintStats, TmModule_::ThreadInit, TM_FLAG_DECODE_TM, TMM_DECODEPFRING, and tmm_modules.

Referenced by RegisterAllModules().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ TmModuleReceivePfringRegister()

void TmModuleReceivePfringRegister ( void  )