suricata
source-pfring.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author William Metcalf <william.metcalf@gmail.com>
22  * \author Eric Leblond <eric@regit.org>
23  *
24  * PF_RING packet acquisition support
25  *
26  * \todo remove requirement for setting cluster so old 3.x versions are supported
27  * \todo implement DNA support
28  * \todo Allow ring options such as snaplen etc, to be user configurable.
29  */
30 
31 #include "suricata-common.h"
32 #include "suricata.h"
33 #include "conf.h"
34 #include "decode.h"
35 #include "packet-queue.h"
36 #include "threads.h"
37 #include "threadvars.h"
38 #include "tm-queuehandlers.h"
39 #include "tm-threads.h"
40 #include "source-pfring.h"
41 #include "util-debug.h"
42 #include "util-checksum.h"
43 #include "util-privs.h"
44 #include "util-datalink.h"
45 #include "util-device.h"
46 #include "util-host-info.h"
47 #include "runmodes.h"
48 #include "util-profiling.h"
49 
50 TmEcode ReceivePfringLoop(ThreadVars *tv, void *data, void *slot);
51 TmEcode PfringBreakLoop(ThreadVars *tv, void *data);
52 TmEcode ReceivePfringThreadInit(ThreadVars *, const void *, void **);
55 
56 TmEcode DecodePfringThreadInit(ThreadVars *, const void *, void **);
59 
60 extern int max_pending_packets;
61 
62 #ifndef HAVE_PFRING
63 
64 /*Handle cases where we don't have PF_RING support built-in*/
65 TmEcode NoPfringSupportExit(ThreadVars *, const void *, void **);
66 
68 {
69  tmm_modules[TMM_RECEIVEPFRING].name = "ReceivePfring";
70  tmm_modules[TMM_RECEIVEPFRING].ThreadInit = NoPfringSupportExit;
77 }
78 
80 {
81  tmm_modules[TMM_DECODEPFRING].name = "DecodePfring";
82  tmm_modules[TMM_DECODEPFRING].ThreadInit = NoPfringSupportExit;
88 }
89 
90 /**
91  * \brief this function prints an error message and exits.
92  * \param tv pointer to ThreadVars
93  * \param initdata pointer to the interface passed from the user
94  * \param data pointer gets populated with PfringThreadVars
95  */
96 TmEcode NoPfringSupportExit(ThreadVars *tv, const void *initdata, void **data)
97 {
98  SCLogError(SC_ERR_NO_PF_RING,"Error creating thread %s: you do not have support for pfring "
99  "enabled please recompile with --enable-pfring", tv->name);
100  exit(EXIT_FAILURE);
101 }
102 
103 #else /* implied we do have PF_RING support */
104 
105 #include <pfring.h>
106 
107 /** protect pfring_set_bpf_filter, as it is not thread safe */
108 static SCMutex pfring_bpf_set_filter_lock = SCMUTEX_INITIALIZER;
109 
110 /* XXX replace with user configurable options */
111 #define LIBPFRING_PROMISC 1
112 #define LIBPFRING_REENTRANT 0
113 #define LIBPFRING_WAIT_FOR_INCOMING 1
114 
115 /* PfringThreadVars flags */
116 #define PFRING_FLAGS_ZERO_COPY (1 << 0)
117 #define PFRING_FLAGS_BYPASS (1 << 1)
118 
119 /**
120  * \brief Structure to hold thread specific variables.
121  */
123 {
124  /* thread specific handle */
125  pfring *pd;
126 
127  /* counters */
128  uint64_t bytes;
129  uint64_t pkts;
130 
134 
135  uint32_t flags;
136 
139 
141 
142  /* threads count */
143  int threads;
144 
145  cluster_type ctype;
146 
147  uint8_t cluster_id;
148  char *interface;
150 
151  char *bpf_filter;
152 
154 
156 };
157 
158 /**
159  * \brief Registration Function for RecievePfring.
160  * \todo Unit tests are needed for this module.
161  */
163 {
164  tmm_modules[TMM_RECEIVEPFRING].name = "ReceivePfring";
172 }
173 
174 /**
175  * \brief Registration Function for DecodePfring.
176  * \todo Unit tests are needed for this module.
177  */
179 {
180  tmm_modules[TMM_DECODEPFRING].name = "DecodePfring";
186 }
187 
188 static inline void PfringDumpCounters(PfringThreadVars *ptv)
189 {
190  pfring_stat pfring_s;
191  if (likely((pfring_stats(ptv->pd, &pfring_s) >= 0))) {
192  /* pfring counter is per socket and is not cleared after read.
193  * So to get the number of packet on the interface we can add
194  * the newly seen packets and drops for this thread and add it
195  * to the interface counter */
196  uint64_t th_pkts = StatsGetLocalCounterValue(ptv->tv, ptv->capture_kernel_packets);
197  uint64_t th_drops = StatsGetLocalCounterValue(ptv->tv, ptv->capture_kernel_drops);
198  SC_ATOMIC_ADD(ptv->livedev->pkts, pfring_s.recv - th_pkts);
199  SC_ATOMIC_ADD(ptv->livedev->drop, pfring_s.drop - th_drops);
200  StatsSetUI64(ptv->tv, ptv->capture_kernel_packets, pfring_s.recv);
201  StatsSetUI64(ptv->tv, ptv->capture_kernel_drops, pfring_s.drop);
202 
203 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
204  if (ptv->flags & PFRING_FLAGS_BYPASS) {
205  uint64_t th_bypassed = StatsGetLocalCounterValue(ptv->tv, ptv->capture_bypassed);
206  SC_ATOMIC_ADD(ptv->livedev->bypassed, pfring_s.shunt - th_bypassed);
207  StatsSetUI64(ptv->tv, ptv->capture_bypassed, pfring_s.shunt);
208  }
209 #endif
210  }
211 }
212 
213 /**
214  * \brief Pfring Packet Process function.
215  *
216  * This function fills in our packet structure from libpfring.
217  * From here the packets are picked up by the DecodePfring thread.
218  *
219  * \param user pointer to PfringThreadVars
220  * \param h pointer to pfring packet header
221  * \param p pointer to the current packet
222  */
223 static inline void PfringProcessPacket(void *user, struct pfring_pkthdr *h, Packet *p)
224 {
225  PfringThreadVars *ptv = (PfringThreadVars *)user;
226 
227  ptv->bytes += h->caplen;
228  ptv->pkts++;
229  p->livedev = ptv->livedev;
230 
231  /* PF_RING may fail to set timestamp */
232  if (h->ts.tv_sec == 0) {
233  gettimeofday((struct timeval *)&h->ts, NULL);
234  }
235 
236  p->ts.tv_sec = h->ts.tv_sec;
237  p->ts.tv_usec = h->ts.tv_usec;
238 
239  /* PF_RING all packets are marked as a link type of ethernet
240  * so that is what we do here. */
242 
243  /* In the past, we needed this vlan handling in cases
244  * where the vlan header was stripped from the raw packet.
245  * With modern (at least >= 6) versions of PF_RING, the
246  * 'copy_data_to_ring' function (kernel/pf_ring.c) makes
247  * sure that if the hardware stripped the vlan header,
248  * it is put back by PF_RING.
249  *
250  * PF_RING should put it back in all cases, but as a extra
251  * precaution keep the check here. If the vlan header is
252  * part of the raw packet, the vlan_offset will be set.
253  * So if it is not set, use the parsed info from PF_RING's
254  * extended header.
255  */
256  if (ptv->vlan_in_ext_header &&
257  h->extended_hdr.parsed_pkt.offset.vlan_offset == 0 &&
258  h->extended_hdr.parsed_pkt.vlan_id)
259  {
260  p->vlan_id[0] = h->extended_hdr.parsed_pkt.vlan_id & 0x0fff;
261  p->vlan_idx = 1;
262 
263  if (!ptv->vlan_hdr_warned) {
264  SCLogWarning(SC_ERR_PF_RING_VLAN, "no VLAN header in the raw "
265  "packet. See ticket #2355.");
266  ptv->vlan_hdr_warned = true;
267  }
268  }
269 
270  switch (ptv->checksum_mode) {
272  if (h->extended_hdr.rx_direction == 0) {
274  }
275  break;
278  break;
280  if (ChecksumAutoModeCheck(ptv->pkts,
281  SC_ATOMIC_GET(ptv->livedev->pkts),
282  SC_ATOMIC_GET(ptv->livedev->invalid_checksums))) {
285  }
286  break;
287  default:
288  break;
289  }
290 
291  SET_PKT_LEN(p, h->caplen);
292 }
293 
294 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
295 /**
296  * \brief Pfring bypass callback function
297  *
298  * \param p a Packet to use information from to trigger bypass
299  * \return 1 if bypass is successful, 0 if not
300  */
301 static int PfringBypassCallback(Packet *p)
302 {
303  hw_filtering_rule r;
304 
305  /* Only bypass TCP and UDP */
306  if (!(PKT_IS_TCP(p) || PKT_IS_UDP(p))) {
307  return 0;
308  }
309 
310  /* Bypassing tunneled packets is currently not supported */
311  if (IS_TUNNEL_PKT(p)) {
312  return 0;
313  }
314 
315  r.rule_family_type = generic_flow_id_rule;
316  r.rule_family.flow_id_rule.action = flow_drop_rule;
317  r.rule_family.flow_id_rule.thread = 0;
318  r.rule_family.flow_id_rule.flow_id = p->pfring_v.flow_id;
319 
320  SCLogDebug("Bypass set for flow ID = %u", p->pfring_v.flow_id);
321 
322  if (pfring_add_hw_rule(p->pfring_v.ptv->pd, &r) < 0) {
323  return 0;
324  }
325 
326  return 1;
327 }
328 #endif
329 
330 /**
331  * \brief Recieves packets from an interface via libpfring.
332  *
333  * This function recieves packets from an interface and passes
334  * the packet on to the pfring callback function.
335  *
336  * \param tv pointer to ThreadVars
337  * \param data pointer that gets cast into PfringThreadVars for ptv
338  * \param slot slot containing task information
339  * \retval TM_ECODE_OK on success
340  * \retval TM_ECODE_FAILED on failure
341  */
342 TmEcode ReceivePfringLoop(ThreadVars *tv, void *data, void *slot)
343 {
344  SCEnter();
345 
346  PfringThreadVars *ptv = (PfringThreadVars *)data;
347  Packet *p = NULL;
348  struct pfring_pkthdr hdr;
349  TmSlot *s = (TmSlot *)slot;
350  time_t last_dump = 0;
351  u_int buffer_size;
352  u_char *pkt_buffer;
353 
354  ptv->slot = s->slot_next;
355 
356  /* we have to enable the ring here as we need to do it after all
357  * the threads have called pfring_set_cluster(). */
358  int rc = pfring_enable_ring(ptv->pd);
359  if (rc != 0) {
360  SCLogError(SC_ERR_PF_RING_OPEN, "pfring_enable_ring failed returned %d ", rc);
362  }
363 
364  // Indicate that the thread is actually running its application level code (i.e., it can poll
365  // packets)
367 
368  while(1) {
371  }
372 
373  /* make sure we have at least one packet in the packet pool, to prevent
374  * us from alloc'ing packets at line rate */
375  PacketPoolWait();
376 
378  if (p == NULL) {
380  }
382 
383  /* Some flavours of PF_RING may fail to set timestamp - see PF-RING-enabled libpcap code*/
384  hdr.ts.tv_sec = hdr.ts.tv_usec = 0;
385 
386  /* Check for Zero-copy mode */
387  if (ptv->flags & PFRING_FLAGS_ZERO_COPY) {
388  buffer_size = 0;
389  pkt_buffer = NULL;
390  } else {
391  buffer_size = GET_PKT_DIRECT_MAX_SIZE(p);
392  pkt_buffer = GET_PKT_DIRECT_DATA(p);
393  }
394 
395  int r = pfring_recv(ptv->pd, &pkt_buffer,
396  buffer_size,
397  &hdr,
399  if (likely(r == 1)) {
400  /* profiling started before blocking pfring_recv call, so
401  * reset it here */
403 
404 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
405  if (ptv->flags & PFRING_FLAGS_BYPASS) {
406  /* pkt hash contains the flow id in this configuration */
407  p->pfring_v.flow_id = hdr.extended_hdr.pkt_hash;
408  p->pfring_v.ptv = ptv;
409  p->BypassPacketsFlow = PfringBypassCallback;
410  }
411 #endif
412 
413  /* Check for Zero-copy mode */
414  if (ptv->flags & PFRING_FLAGS_ZERO_COPY) {
415  PacketSetData(p, pkt_buffer, hdr.caplen);
416  }
417 
418  PfringProcessPacket(ptv, &hdr, p);
419 
420  if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) {
422  }
423 
424  /* Trigger one dump of stats every second */
425  if (p->ts.tv_sec != last_dump) {
426  PfringDumpCounters(ptv);
427  last_dump = p->ts.tv_sec;
428  }
429  } else if (unlikely(r == 0)) {
432  }
433 
434  /* pfring didn't use the packet yet */
435  TmThreadsCaptureHandleTimeout(tv, p);
436 
437  } else {
438  SCLogError(SC_ERR_PF_RING_RECV,"pfring_recv error %" PRId32 "", r);
439  TmqhOutputPacketpool(ptv->tv, p);
441  }
443  }
444 
445  return TM_ECODE_OK;
446 }
447 
448 /**
449  * \brief Stop function for ReceivePfringLoop.
450  *
451  * This function forces ReceivePfringLoop to stop the
452  * execution, exiting the packet capture loop.
453  *
454  * \param tv pointer to ThreadVars
455  * \param data pointer that gets cast into PfringThreadVars for ptv
456  * \retval TM_ECODE_OK on success
457  * \retval TM_ECODE_FAILED on failure
458  */
460 {
461  PfringThreadVars *ptv = (PfringThreadVars *)data;
462 
463  /* Safety check */
464  if (ptv->pd == NULL) {
465  return TM_ECODE_FAILED;
466  }
467 
468  pfring_breakloop(ptv->pd);
469 
470  return TM_ECODE_OK;
471 }
472 
473 /**
474  * \brief Init function for RecievePfring.
475  *
476  * This is a setup function for recieving packets
477  * via libpfring.
478  *
479  * \param tv pointer to ThreadVars
480  * \param initdata pointer to the interface passed from the user
481  * \param data pointer gets populated with PfringThreadVars
482  * \todo add a config option for setting cluster id
483  * \todo Create a general pfring setup function.
484  * \retval TM_ECODE_OK on success
485  * \retval TM_ECODE_FAILED on error
486  */
487 TmEcode ReceivePfringThreadInit(ThreadVars *tv, const void *initdata, void **data)
488 {
489  int rc;
490  u_int32_t version = 0;
491  PfringIfaceConfig *pfconf = (PfringIfaceConfig *) initdata;
492  unsigned int opflag;
493  char const *active_runmode = RunmodeGetActive();
494 
495  if (pfconf == NULL)
496  return TM_ECODE_FAILED;
497 
499  if (unlikely(ptv == NULL)) {
500  pfconf->DerefFunc(pfconf);
501  return TM_ECODE_FAILED;
502  }
503  memset(ptv, 0, sizeof(PfringThreadVars));
504 
505  ptv->tv = tv;
506  ptv->threads = 1;
507 
508  ptv->interface = SCStrdup(pfconf->iface);
509  if (unlikely(ptv->interface == NULL)) {
510  SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate device string");
511  SCFree(ptv);
513  }
514 
515  ptv->livedev = LiveGetDevice(pfconf->iface);
516  if (ptv->livedev == NULL) {
517  SCLogError(SC_ERR_INVALID_VALUE, "Unable to find Live device");
518  SCFree(ptv);
520  }
521 
522  /* enable zero-copy mode for workers runmode */
523  if (active_runmode && strcmp("workers", active_runmode) == 0) {
525  SCLogPerf("Enabling zero-copy for %s", ptv->interface);
526  }
527 
528  ptv->checksum_mode = pfconf->checksum_mode;
529 
530  opflag = PF_RING_PROMISC;
531 
532  /* if we have a recent kernel, we need to use parsed_pkt to get VLAN info */
533  if (ptv->vlan_in_ext_header) {
534  opflag |= PF_RING_LONG_HEADER;
535  }
536 
538  if (strncmp(ptv->interface, "dna", 3) == 0) {
540  "Can't use rxonly checksum-checks on DNA interface,"
541  " resetting to auto");
543  } else {
544  opflag |= PF_RING_LONG_HEADER;
545  }
546  }
547 
548 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
549  if (pfconf->flags & PFRING_CONF_FLAGS_BYPASS) {
550  opflag |= PF_RING_FLOW_OFFLOAD | PF_RING_FLOW_OFFLOAD_NOUPDATES;
551  ptv->flags |= PFRING_FLAGS_BYPASS;
552  }
553 #endif
554 
555  ptv->pd = pfring_open(ptv->interface, (uint32_t)default_packet_size, opflag);
556  if (ptv->pd == NULL) {
557  SCLogError(SC_ERR_PF_RING_OPEN,"Failed to open %s: pfring_open error."
558  " Check if %s exists and pf_ring module is loaded.",
559  ptv->interface,
560  ptv->interface);
561  pfconf->DerefFunc(pfconf);
562  SCFree(ptv);
563  return TM_ECODE_FAILED;
564  }
565 
566  pfring_set_application_name(ptv->pd, (char *)PROG_NAME);
567  pfring_version(ptv->pd, &version);
568 
569  /* We only set cluster info if the number of pfring threads is greater than 1 */
570  ptv->threads = pfconf->threads;
571 
572  ptv->cluster_id = pfconf->cluster_id;
573 
574  if ((ptv->threads == 1) && (strncmp(ptv->interface, "dna", 3) == 0)) {
575  SCLogInfo("DNA interface detected, not adding thread to cluster");
576  } else if (strncmp(ptv->interface, "zc", 2) == 0) {
577  SCLogInfo("ZC interface detected, not adding thread to cluster");
578  } else {
579  ptv->ctype = (cluster_type)pfconf->ctype;
580  rc = pfring_set_cluster(ptv->pd, ptv->cluster_id, ptv->ctype);
581 
582  if (rc != 0) {
583  SCLogError(SC_ERR_PF_RING_SET_CLUSTER_FAILED, "pfring_set_cluster "
584  "returned %d for cluster-id: %d", rc, ptv->cluster_id);
585  if (rc != PF_RING_ERROR_NOT_SUPPORTED || (pfconf->flags & PFRING_CONF_FLAGS_CLUSTER)) {
586  /* cluster is mandatory as explicitly specified in the configuration */
587  pfconf->DerefFunc(pfconf);
588  return TM_ECODE_FAILED;
589  }
590  }
591  }
592 
593  if (ptv->threads > 1) {
594  SCLogPerf("(%s) Using PF_RING v.%d.%d.%d, interface %s, cluster-id %d",
595  tv->name, (version & 0xFFFF0000) >> 16, (version & 0x0000FF00) >> 8,
596  version & 0x000000FF, ptv->interface, ptv->cluster_id);
597  } else {
598  SCLogPerf("(%s) Using PF_RING v.%d.%d.%d, interface %s, cluster-id %d, single-pfring-thread",
599  tv->name, (version & 0xFFFF0000) >> 16, (version & 0x0000FF00) >> 8,
600  version & 0x000000FF, ptv->interface, ptv->cluster_id);
601  }
602 
603  if (pfconf->bpf_filter) {
604  ptv->bpf_filter = SCStrdup(pfconf->bpf_filter);
605  if (unlikely(ptv->bpf_filter == NULL)) {
606  SCLogError(SC_ERR_MEM_ALLOC, "Set PF_RING bpf filter failed.");
607  } else {
608  SCMutexLock(&pfring_bpf_set_filter_lock);
609  rc = pfring_set_bpf_filter(ptv->pd, ptv->bpf_filter);
610  SCMutexUnlock(&pfring_bpf_set_filter_lock);
611 
612  if (rc < 0) {
613  SCLogError(SC_ERR_INVALID_VALUE, "Failed to compile BPF \"%s\"",
614  ptv->bpf_filter);
615  return TM_ECODE_FAILED;
616  }
617  }
618  }
619 
620  ptv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets",
621  ptv->tv);
622  ptv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops",
623  ptv->tv);
624 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
625  ptv->capture_bypassed = StatsRegisterCounter("capture.bypassed",
626  ptv->tv);
627 #endif
628 
629  /* If kernel is older than 3.0, VLAN is not stripped so we don't
630  * get the info from packt extended header but we will use a standard
631  * parsing */
632  ptv->vlan_in_ext_header = 1;
633  if (! SCKernelVersionIsAtLeast(3, 0)) {
634  ptv->vlan_in_ext_header = 0;
635  }
636 
637  /* If VLAN tags are not in the extended header, set cluster type to 5-tuple
638  * or in case of a ZC interface, do nothing */
639  if ((! ptv->vlan_in_ext_header) && ptv->ctype == CLUSTER_FLOW &&
640  strncmp(ptv->interface, "zc", 2) != 0) {
641  SCLogPerf("VLAN not in extended header, setting cluster type to CLUSTER_FLOW_5_TUPLE");
642  rc = pfring_set_cluster(ptv->pd, ptv->cluster_id, CLUSTER_FLOW_5_TUPLE);
643 
644  if (rc != 0) {
645  SCLogError(SC_ERR_PF_RING_SET_CLUSTER_FAILED, "pfring_set_cluster "
646  "returned %d for cluster-id: %d", rc, ptv->cluster_id);
647  pfconf->DerefFunc(pfconf);
648  return TM_ECODE_FAILED;
649  }
650  }
651 
653 
654  *data = (void *)ptv;
655  pfconf->DerefFunc(pfconf);
656 
657  return TM_ECODE_OK;
658 }
659 
660 /**
661  * \brief This function prints stats to the screen at exit.
662  * \param tv pointer to ThreadVars
663  * \param data pointer that gets cast into PfringThreadVars for ptv
664  */
666 {
667  PfringThreadVars *ptv = (PfringThreadVars *)data;
668 
669  PfringDumpCounters(ptv);
670  SCLogPerf("(%s) Kernel: Packets %" PRIu64 ", dropped %" PRIu64 "",
671  tv->name,
674  SCLogPerf("(%s) Packets %" PRIu64 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes);
675 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
676  if (ptv->flags & PFRING_FLAGS_BYPASS) {
677  SCLogPerf("(%s) Bypass: Packets %" PRIu64 "",
678  tv->name,
680  }
681 #endif
682 }
683 
684 /**
685  * \brief DeInit function closes pd at exit.
686  * \param tv pointer to ThreadVars
687  * \param data pointer that gets cast into PfringThreadVars for ptvi
688  * \retval TM_ECODE_OK is always returned
689  */
691 {
692  PfringThreadVars *ptv = (PfringThreadVars *)data;
693  if (ptv->interface)
694  SCFree(ptv->interface);
695  pfring_remove_from_cluster(ptv->pd);
696 
697  if (ptv->bpf_filter) {
698  pfring_remove_bpf_filter(ptv->pd);
699  SCFree(ptv->bpf_filter);
700  }
701 
702  pfring_close(ptv->pd);
703  return TM_ECODE_OK;
704 }
705 
706 /**
707  * \brief This function passes off to link type decoders.
708  *
709  * DecodePfring decodes raw packets from PF_RING. Inside of libpcap version of
710  * PF_RING all packets are marked as a link type of ethernet so that is what we do here.
711  *
712  * \param tv pointer to ThreadVars
713  * \param p pointer to the current packet
714  * \param data pointer that gets cast into PfringThreadVars for ptv
715  *
716  * \todo Verify that PF_RING only deals with ethernet traffic
717  *
718  * \warning This function bypasses the pkt buf and len macro's
719  *
720  * \retval TM_ECODE_OK is always returned
721  */
723 {
725 
727 
728  /* update counters */
730 
731  /* If suri has set vlan during reading, we increase vlan counter */
732  if (p->vlan_idx) {
734  }
735 
737 
739 
740  return TM_ECODE_OK;
741 }
742 
743 /**
744  * \brief This an Init function for DecodePfring
745  *
746  * \param tv pointer to ThreadVars
747  * \param initdata pointer to initilization data.
748  * \param data pointer that gets cast into PfringThreadVars for ptv
749  * \retval TM_ECODE_OK is returned on success
750  * \retval TM_ECODE_FAILED is returned on error
751  */
752 TmEcode DecodePfringThreadInit(ThreadVars *tv, const void *initdata, void **data)
753 {
754  DecodeThreadVars *dtv = NULL;
755 
757  if (dtv == NULL)
759 
761 
762  *data = (void *)dtv;
763 
764  return TM_ECODE_OK;
765 }
766 
768 {
769  if (data != NULL)
770  DecodeThreadVarsFree(tv, data);
772 }
773 
774 #endif /* HAVE_PFRING */
775 /* eof */
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:67
PKT_IS_UDP
#define PKT_IS_UDP(p)
Definition: decode.h:245
tm-threads.h
ReceivePfringThreadInit
TmEcode ReceivePfringThreadInit(ThreadVars *, const void *, void **)
Init function for RecievePfring.
Definition: source-pfring.c:487
PfringIfaceConfig_
Definition: source-pfring.h:36
max_pending_packets
int max_pending_packets
Definition: suricata.c:175
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:167
ThreadVars_::name
char name[16]
Definition: threadvars.h:64
PfringThreadVars_::cluster_id
uint8_t cluster_id
Definition: source-pfring.c:147
SC_ERR_INVALID_VALUE
@ SC_ERR_INVALID_VALUE
Definition: util-error.h:160
Packet_::vlan_id
uint16_t vlan_id[2]
Definition: decode.h:452
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1052
SC_ERR_PF_RING_RECV
@ SC_ERR_PF_RING_RECV
Definition: util-error.h:61
PfringIfaceConfig_::cluster_id
int cluster_id
Definition: source-pfring.h:40
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
ReceivePfringLoop
TmEcode ReceivePfringLoop(ThreadVars *tv, void *data, void *slot)
Recieves packets from an interface via libpfring.
Definition: source-pfring.c:342
ReceivePfringThreadExitStats
void ReceivePfringThreadExitStats(ThreadVars *, void *)
This function prints stats to the screen at exit.
Definition: source-pfring.c:665
PfringBreakLoop
TmEcode PfringBreakLoop(ThreadVars *tv, void *data)
Stop function for ReceivePfringLoop.
Definition: source-pfring.c:459
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
DecodePfringThreadDeinit
TmEcode DecodePfringThreadDeinit(ThreadVars *tv, void *data)
Definition: source-pfring.c:767
TmThreadsSetFlag
void TmThreadsSetFlag(ThreadVars *tv, uint32_t flag)
Set a thread flag.
Definition: tm-threads.c:98
TMM_DECODEPFRING
@ TMM_DECODEPFRING
Definition: tm-threads-common.h:43
util-checksum.h
Packet_::flags
uint32_t flags
Definition: decode.h:460
threads.h
TMM_RECEIVEPFRING
@ TMM_RECEIVEPFRING
Definition: tm-threads-common.h:42
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:453
PfringThreadVars_::tv
ThreadVars * tv
Definition: source-pfring.c:137
PACKET_PROFILING_RESTART
#define PACKET_PROFILING_RESTART(p)
Definition: util-profiling.h:100
PfringIfaceConfig_::bpf_filter
char * bpf_filter
Definition: source-pfring.h:47
LiveDevice_
Definition: util-device.h:39
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
PfringThreadVars_::livedev
LiveDevice * livedev
Definition: source-pfring.c:149
StatsSetUI64
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
Definition: counters.c:210
THV_RUNNING
#define THV_RUNNING
Definition: threadvars.h:54
PfringThreadVars_::ctype
cluster_type ctype
Definition: source-pfring.c:145
packet-queue.h
CHECKSUM_VALIDATION_RXONLY
@ CHECKSUM_VALIDATION_RXONLY
Definition: decode.h:49
SURICATA_STOP
#define SURICATA_STOP
Definition: suricata.h:89
SCKernelVersionIsAtLeast
int SCKernelVersionIsAtLeast(int major, int minor)
Definition: util-host-info.c:37
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
PfringThreadVars_::vlan_hdr_warned
bool vlan_hdr_warned
Definition: source-pfring.c:155
SC_ERR_PF_RING_OPEN
@ SC_ERR_PF_RING_OPEN
Definition: util-error.h:64
util-privs.h
PfringThreadVars_::slot
TmSlot * slot
Definition: source-pfring.c:138
StatsSyncCountersIfSignalled
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:140
CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_DISABLE
Definition: decode.h:46
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
SC_CAP_NET_BROADCAST
#define SC_CAP_NET_BROADCAST
Definition: util-privs.h:34
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:147
RunmodeGetActive
char * RunmodeGetActive(void)
Definition: runmodes.c:213
TmqhOutputPacketpool
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
Definition: tmqh-packetpool.c:357
Packet_::BypassPacketsFlow
int(* BypassPacketsFlow)(struct Packet_ *)
Definition: decode.h:512
TmModuleReceivePfringRegister
void TmModuleReceivePfringRegister(void)
Registration Function for RecievePfring.
Definition: source-pfring.c:162
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
PfringThreadVars_::pd
pfring * pd
Definition: source-pfring.c:125
GET_PKT_DIRECT_MAX_SIZE
#define GET_PKT_DIRECT_MAX_SIZE(p)
Definition: decode.h:218
ChecksumAutoModeCheck
int ChecksumAutoModeCheck(uint64_t thread_count, uint64_t iface_count, uint64_t iface_fail)
Check if the number of invalid checksums indicate checksum offloading in place.
Definition: util-checksum.c:69
TmModule_::PktAcqLoop
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
Definition: tm-modules.h:54
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
Packet_::datalink
int datalink
Definition: decode.h:601
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1055
SC_CAP_NET_BIND_SERVICE
#define SC_CAP_NET_BIND_SERVICE
Definition: util-privs.h:33
PKT_IS_TCP
#define PKT_IS_TCP(p)
Definition: decode.h:244
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:528
PfringIfaceConfig_::iface
char iface[PFRING_IFACE_NAME_LENGTH]
Definition: source-pfring.h:43
CHECKSUM_VALIDATION_AUTO
@ CHECKSUM_VALIDATION_AUTO
Definition: decode.h:48
SET_PKT_LEN
#define SET_PKT_LEN(p, len)
Definition: decode.h:220
decode.h
SC_ERR_PF_RING_VLAN
@ SC_ERR_PF_RING_VLAN
Definition: util-error.h:337
util-device.h
util-debug.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:54
TmModule_::PktAcqBreakLoop
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
Definition: tm-modules.h:57
PfringThreadVars_::threads
int threads
Definition: source-pfring.c:143
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
LiveGetDevice
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:280
SCEnter
#define SCEnter(...)
Definition: util-debug.h:298
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:216
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:52
SC_CAP_NET_ADMIN
#define SC_CAP_NET_ADMIN
Definition: util-privs.h:31
source-pfring.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:289
util-profiling.h
StatsGetLocalCounterValue
uint64_t StatsGetLocalCounterValue(ThreadVars *tv, uint16_t id)
Get the value of the local copy of the counter that hold this id.
Definition: counters.c:1256
SC_ERR_PF_RING_SET_CLUSTER_FAILED
@ SC_ERR_PF_RING_SET_CLUSTER_FAILED
Definition: util-error.h:67
PFRING_CONF_FLAGS_CLUSTER
#define PFRING_CONF_FLAGS_CLUSTER
Definition: source-pfring.h:32
PacketPoolWait
void PacketPoolWait(void)
Definition: tmqh-packetpool.c:69
DecodePfringThreadInit
TmEcode DecodePfringThreadInit(ThreadVars *, const void *, void **)
This an Init function for DecodePfring.
Definition: source-pfring.c:752
Packet_
Definition: decode.h:425
TM_FLAG_DECODE_TM
#define TM_FLAG_DECODE_TM
Definition: tm-modules.h:32
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:215
conf.h
TmSlot_
Definition: tm-threads.h:53
PKT_IGNORE_CHECKSUM
#define PKT_IGNORE_CHECKSUM
Definition: decode.h:1012
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:580
TmEcode
TmEcode
Definition: tm-threads-common.h:81
IS_TUNNEL_PKT
#define IS_TUNNEL_PKT(p)
Definition: decode.h:790
util-host-info.h
TmModule_::name
const char * name
Definition: tm-modules.h:44
PFRING_CONF_FLAGS_BYPASS
#define PFRING_CONF_FLAGS_BYPASS
Definition: source-pfring.h:33
PfringThreadVars_::capture_bypassed
uint16_t capture_bypassed
Definition: source-pfring.c:133
DecodeThreadVars_::counter_vlan
uint16_t counter_vlan
Definition: decode.h:690
runmodes.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:215
TM_FLAG_RECEIVE_TM
#define TM_FLAG_RECEIVE_TM
Definition: tm-modules.h:31
ReceivePfringThreadDeinit
TmEcode ReceivePfringThreadDeinit(ThreadVars *, void *)
DeInit function closes pd at exit.
Definition: source-pfring.c:690
PfringThreadVars_
Structure to hold thread specific variables.
Definition: source-pfring.c:123
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
default_packet_size
uint32_t default_packet_size
Definition: decode.c:72
tm-queuehandlers.h
PfringIfaceConfig_::flags
uint32_t flags
Definition: source-pfring.h:37
PROG_NAME
#define PROG_NAME
Definition: suricata.h:70
PfringThreadVars_::interface
char * interface
Definition: source-pfring.c:148
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:708
Packet_::ts
struct timeval ts
Definition: decode.h:468
ChecksumValidationMode
ChecksumValidationMode
Definition: decode.h:45
suricata-common.h
CLUSTER_FLOW_5_TUPLE
#define CLUSTER_FLOW_5_TUPLE
Definition: source-pfring.h:75
SCLogPerf
#define SCLogPerf(...)
Definition: util-debug.h:222
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:255
version
uint8_t version
Definition: decode-gre.h:1
PfringIfaceConfig_::DerefFunc
void(* DerefFunc)(void *)
Definition: source-pfring.h:51
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
TmModuleDecodePfringRegister
void TmModuleDecodePfringRegister(void)
Registration Function for DecodePfring.
Definition: source-pfring.c:178
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
PfringThreadVars_::flags
uint32_t flags
Definition: source-pfring.c:135
TmModule_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:48
threadvars.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
PfringIfaceConfig_::threads
int threads
Definition: source-pfring.h:45
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:242
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:659
PfringThreadVars_::capture_kernel_drops
uint16_t capture_kernel_drops
Definition: source-pfring.c:132
PFRING_FLAGS_ZERO_COPY
#define PFRING_FLAGS_ZERO_COPY
Definition: source-pfring.c:116
PfringThreadVars_::vlan_in_ext_header
int vlan_in_ext_header
Definition: source-pfring.c:140
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:689
PacketSetData
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Definition: decode.c:728
GET_PKT_DIRECT_DATA
#define GET_PKT_DIRECT_DATA(p)
Definition: decode.h:217
PfringThreadVars_::bpf_filter
char * bpf_filter
Definition: source-pfring.c:151
PfringThreadVars_::bytes
uint64_t bytes
Definition: source-pfring.c:128
SC_ERR_MEM_ALLOC
@ SC_ERR_MEM_ALLOC
Definition: util-error.h:31
suricata.h
PfringThreadVars_::checksum_mode
ChecksumValidationMode checksum_mode
Definition: source-pfring.c:153
CLUSTER_FLOW
#define CLUSTER_FLOW
Definition: source-pfring.h:73
likely
#define likely(expr)
Definition: util-optimize.h:32
TmSlot_::slot_next
struct TmSlot_ * slot_next
Definition: tm-threads.h:62
PfringThreadVars_::capture_kernel_packets
uint16_t capture_kernel_packets
Definition: source-pfring.c:131
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
LIBPFRING_WAIT_FOR_INCOMING
#define LIBPFRING_WAIT_FOR_INCOMING
Definition: source-pfring.c:113
PfringThreadVars_::pkts
uint64_t pkts
Definition: source-pfring.c:129
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:955
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:302
PfringIfaceConfig_::checksum_mode
ChecksumValidationMode checksum_mode
Definition: source-pfring.h:49
DecodePfring
TmEcode DecodePfring(ThreadVars *, Packet *, void *)
This function passes off to link type decoders.
Definition: source-pfring.c:722
SCMutex
#define SCMutex
Definition: threads-debug.h:114
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:208
SC_CAP_NET_RAW
#define SC_CAP_NET_RAW
Definition: util-privs.h:32
DecodeEthernet
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-ethernet.c:42
PFRING_FLAGS_BYPASS
#define PFRING_FLAGS_BYPASS
Definition: source-pfring.c:117
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:70
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:655
LINKTYPE_ETHERNET
#define LINKTYPE_ETHERNET
Definition: decode.h:965
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:161
SC_ERR_NO_PF_RING
@ SC_ERR_NO_PF_RING
Definition: util-error.h:60
PfringIfaceConfig_::ctype
unsigned int ctype
Definition: source-pfring.h:41