Go to the documentation of this file.
98 SCLogError(
"Error creating thread %s: you do not have support for pfring "
99 "enabled please recompile with --enable-pfring",
112 #define LIBPFRING_PROMISC 1
113 #define LIBPFRING_REENTRANT 0
114 #define LIBPFRING_WAIT_FOR_INCOMING 1
117 #define PFRING_FLAGS_ZERO_COPY (1 << 0)
118 #define PFRING_FLAGS_BYPASS (1 << 1)
191 pfring_stat pfring_s;
192 if (
likely((pfring_stats(ptv->
pd, &pfring_s) >= 0))) {
204 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
224 static inline void PfringProcessPacket(
void *user,
struct pfring_pkthdr *h,
Packet *p)
228 ptv->
bytes += h->caplen;
233 if (h->ts.tv_sec == 0) {
234 struct timeval tmp_ts;
235 gettimeofday(&tmp_ts, NULL);
259 h->extended_hdr.parsed_pkt.offset.vlan_offset == 0 &&
260 h->extended_hdr.parsed_pkt.vlan_id)
262 p->
vlan_id[0] = h->extended_hdr.parsed_pkt.vlan_id & 0x0fff;
267 "packet. See ticket #2355.");
274 if (h->extended_hdr.rx_direction == 0) {
296 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
303 static int PfringBypassCallback(
Packet *p)
317 r.rule_family_type = generic_flow_id_rule;
318 r.rule_family.flow_id_rule.action = flow_drop_rule;
319 r.rule_family.flow_id_rule.thread = 0;
320 r.rule_family.flow_id_rule.flow_id = p->pfring_v.flow_id;
322 SCLogDebug(
"Bypass set for flow ID = %u", p->pfring_v.flow_id);
324 if (pfring_add_hw_rule(p->pfring_v.ptv->pd, &r) < 0) {
350 struct pfring_pkthdr hdr;
360 int rc = pfring_enable_ring(ptv->
pd);
362 SCLogError(
"pfring_enable_ring failed returned %d ", rc);
386 hdr.ts.tv_sec = hdr.ts.tv_usec = 0;
397 int r = pfring_recv(ptv->
pd, &pkt_buffer,
406 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
409 p->pfring_v.flow_id = hdr.extended_hdr.pkt_hash;
410 p->pfring_v.ptv = ptv;
420 PfringProcessPacket(ptv, &hdr, p);
428 PfringDumpCounters(ptv);
437 TmThreadsCaptureHandleTimeout(
tv, p);
440 SCLogError(
"pfring_recv error %" PRId32
"", r);
466 if (ptv->
pd == NULL) {
470 pfring_breakloop(ptv->
pd);
512 SCLogError(
"Unable to allocate device string");
525 if (active_runmode && strcmp(
"workers", active_runmode) == 0) {
532 opflag = PF_RING_PROMISC;
536 opflag |= PF_RING_LONG_HEADER;
540 if (strncmp(ptv->
interface,
"dna", 3) == 0) {
541 SCLogWarning(
"Can't use rxonly checksum-checks on DNA interface,"
542 " resetting to auto");
545 opflag |= PF_RING_LONG_HEADER;
549 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
551 opflag |= PF_RING_FLOW_OFFLOAD | PF_RING_FLOW_OFFLOAD_NOUPDATES;
557 if (ptv->
pd == NULL) {
558 SCLogError(
"Failed to open %s: pfring_open error."
559 " Check if %s exists and pf_ring module is loaded.",
566 pfring_set_application_name(ptv->
pd, (
char *)
PROG_NAME);
575 SCLogInfo(
"DNA interface detected, not adding thread to cluster");
576 }
else if (strncmp(ptv->
interface,
"zc", 2) == 0) {
577 SCLogInfo(
"ZC interface detected, not adding thread to cluster");
584 "returned %d for cluster-id: %d",
595 SCLogPerf(
"(%s) Using PF_RING v.%d.%d.%d, interface %s, cluster-id %d",
599 SCLogPerf(
"(%s) Using PF_RING v.%d.%d.%d, interface %s, cluster-id %d, single-pfring-thread",
624 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
641 SCLogPerf(
"VLAN not in extended header, setting cluster type to CLUSTER_FLOW_5_TUPLE");
646 "returned %d for cluster-id: %d",
670 PfringDumpCounters(ptv);
671 SCLogPerf(
"(%s) Kernel: Packets %" PRIu64
", dropped %" PRIu64
"",
676 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
678 SCLogPerf(
"(%s) Bypass: Packets %" PRIu64
"",
696 pfring_remove_from_cluster(ptv->
pd);
699 pfring_remove_bpf_filter(ptv->
pd);
703 pfring_close(ptv->
pd);
uint16_t max_pending_packets
TmEcode ReceivePfringThreadInit(ThreadVars *, const void *, void **)
Init function for ReceivePfring.
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
#define SCTIME_CMP_NEQ(a, b)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
TmEcode ReceivePfringLoop(ThreadVars *tv, void *data, void *slot)
Receives packets from an interface via libpfring.
void ReceivePfringThreadExitStats(ThreadVars *, void *)
This function prints stats to the screen at exit.
TmEcode PfringBreakLoop(ThreadVars *tv, void *data)
Stop function for ReceivePfringLoop.
TmEcode DecodePfringThreadDeinit(ThreadVars *tv, void *data)
void TmThreadsSetFlag(ThreadVars *tv, uint32_t flag)
Set a thread flag.
#define PACKET_PROFILING_RESTART(p)
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
@ CHECKSUM_VALIDATION_RXONLY
int SCKernelVersionIsAtLeast(int major, int minor)
#define StatsSyncCountersIfSignalled(tv)
@ CHECKSUM_VALIDATION_DISABLE
#define SCMUTEX_INITIALIZER
#define SC_CAP_NET_BROADCAST
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
char * RunmodeGetActive(void)
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
int(* BypassPacketsFlow)(struct Packet_ *)
void TmModuleReceivePfringRegister(void)
Registration Function for ReceivePfring.
#define GET_PKT_DIRECT_MAX_SIZE(p)
int ChecksumAutoModeCheck(uint64_t thread_count, uint64_t iface_count, uint64_t iface_fail)
Check if the number of invalid checksums indicate checksum offloading in place.
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
#define PKT_SET_SRC(p, src_val)
#define SC_CAP_NET_BIND_SERVICE
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
char iface[PFRING_IFACE_NAME_LENGTH]
@ CHECKSUM_VALIDATION_AUTO
#define SET_PKT_LEN(p, len)
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
#define SCMutexUnlock(mut)
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Per thread variable structure.
#define SCTIME_FROM_TIMEVAL(tv)
TmEcode(* Func)(ThreadVars *, Packet *, void *)
#define SCLogWarning(...)
Macro used to log WARNING messages.
uint64_t StatsGetLocalCounterValue(ThreadVars *tv, uint16_t id)
Get the value of the local copy of the counter that hold this id.
#define PFRING_CONF_FLAGS_CLUSTER
void PacketPoolWait(void)
TmEcode DecodePfringThreadInit(ThreadVars *, const void *, void **)
This an Init function for DecodePfring.
#define TM_FLAG_DECODE_TM
TmModule tmm_modules[TMM_SIZE]
#define PKT_IGNORE_CHECKSUM
struct LiveDevice_ * livedev
#define PFRING_CONF_FLAGS_BYPASS
uint16_t capture_bypassed
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define TM_FLAG_RECEIVE_TM
TmEcode ReceivePfringThreadDeinit(ThreadVars *, void *)
DeInit function closes pd at exit.
Structure to hold thread specific variables.
uint32_t default_packet_size
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
#define CLUSTER_FLOW_5_TUPLE
void(* DerefFunc)(void *)
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
void TmModuleDecodePfringRegister(void)
Registration Function for DecodePfring.
void(* ThreadExitPrintStats)(ThreadVars *, void *)
#define SCLogError(...)
Macro used to log ERROR messages.
void DatalinkSetGlobalType(int datalink)
Structure to hold thread specific data for all decode modules.
uint16_t capture_kernel_drops
#define PFRING_FLAGS_ZERO_COPY
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
#define GET_PKT_DIRECT_DATA(p)
ChecksumValidationMode checksum_mode
uint16_t vlan_id[VLAN_MAX_LAYERS]
struct TmSlot_ * slot_next
uint16_t capture_kernel_packets
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
#define LIBPFRING_WAIT_FOR_INCOMING
#define SCTIME_INITIALIZER
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
ChecksumValidationMode checksum_mode
TmEcode DecodePfring(ThreadVars *, Packet *, void *)
This function passes off to link type decoders.
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
#define PFRING_FLAGS_BYPASS
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
#define LINKTYPE_ETHERNET
volatile uint8_t suricata_ctl_flags