aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

util-ebpf: fix iteration in flow timeout

Browse Source 
We were not setting the key using the correct item in map. Result
was deletion of wrong flow.
pull/3952/head
Eric Leblond 7 years ago committed by Victor Julien
parent f270e53477
commit 522e98d830
1 changed files with 26 additions and 26 deletions
Show Stats Download Patch File Download Diff File

52
src/util-ebpf.c
Unescape Escape View File

@ -539,31 +539,31 @@ static int EBPFForEachFlowV4Table(LiveDevice *dev, const char *name,
* its counters and lastseen if needed */ * its counters and lastseen if needed */
FlowKey flow_key; FlowKey flow_key;
if (tcfg->mode == AFP_MODE_XDP_BYPASS) { if (tcfg->mode == AFP_MODE_XDP_BYPASS) {
flow_key.sp = ntohs(key.port16[0]); flow_key.sp = ntohs(next_key.port16[0]);
flow_key.dp = ntohs(key.port16[1]); flow_key.dp = ntohs(next_key.port16[1]);
} else { } else {
flow_key.sp = key.port16[0]; flow_key.sp = next_key.port16[0];
flow_key.dp = key.port16[1]; flow_key.dp = next_key.port16[1];
} }
flow_key.src.family = AF_INET; flow_key.src.family = AF_INET;
flow_key.src.addr_data32[0] = key.src; flow_key.src.addr_data32[0] = next_key.src;
flow_key.src.addr_data32[1] = 0; flow_key.src.addr_data32[1] = 0;
flow_key.src.addr_data32[2] = 0; flow_key.src.addr_data32[2] = 0;
flow_key.src.addr_data32[3] = 0; flow_key.src.addr_data32[3] = 0;
flow_key.dst.family = AF_INET; flow_key.dst.family = AF_INET;
flow_key.dst.addr_data32[0] = key.dst; flow_key.dst.addr_data32[0] = next_key.dst;
flow_key.dst.addr_data32[1] = 0; flow_key.dst.addr_data32[1] = 0;
flow_key.dst.addr_data32[2] = 0; flow_key.dst.addr_data32[2] = 0;
flow_key.dst.addr_data32[3] = 0; flow_key.dst.addr_data32[3] = 0;
flow_key.vlan_id[0] = key.vlan_id[0]; flow_key.vlan_id[0] = next_key.vlan_id[0];
flow_key.vlan_id[1] = key.vlan_id[1]; flow_key.vlan_id[1] = next_key.vlan_id[1];
flow_key.proto = key.ip_proto; flow_key.proto = next_key.ip_proto;
flow_key.recursion_level = 0; flow_key.recursion_level = 0;
pkts_cnt = EBPFUpdateFlowForKey(flowstats, &flow_key, values_array[0].hash, pkts_cnt = EBPFUpdateFlowForKey(flowstats, &flow_key, values_array[0].hash,
pkts_cnt, bytes_cnt); pkts_cnt, bytes_cnt);
if (pkts_cnt > 0) { if (pkts_cnt > 0) {
SC_ATOMIC_ADD(dev->bypassed, pkts_cnt); SC_ATOMIC_ADD(dev->bypassed, pkts_cnt);
EBPFDeleteKey(mapfd, &key); EBPFDeleteKey(mapfd, &next_key);
found = 1; found = 1;
} }
key = next_key; key = next_key;
@ -624,31 +624,31 @@ static int EBPFForEachFlowV6Table(LiveDevice *dev, const char *name,
* its counters and lastseen if needed */ * its counters and lastseen if needed */
FlowKey flow_key; FlowKey flow_key;
if (tcfg->mode == AFP_MODE_XDP_BYPASS) { if (tcfg->mode == AFP_MODE_XDP_BYPASS) {
flow_key.sp = ntohs(key.port16[0]); flow_key.sp = ntohs(next_key.port16[0]);
flow_key.dp = ntohs(key.port16[1]); flow_key.dp = ntohs(next_key.port16[1]);
} else { } else {
flow_key.sp = key.port16[0]; flow_key.sp = next_key.port16[0];
flow_key.dp = key.port16[1]; flow_key.dp = next_key.port16[1];
} }
flow_key.src.family = AF_INET6; flow_key.src.family = AF_INET6;
flow_key.src.addr_data32[0] = key.src[0]; flow_key.src.addr_data32[0] = next_key.src[0];
flow_key.src.addr_data32[1] = key.src[1]; flow_key.src.addr_data32[1] = next_key.src[1];
flow_key.src.addr_data32[2] = key.src[2]; flow_key.src.addr_data32[2] = next_key.src[2];
flow_key.src.addr_data32[3] = key.src[3]; flow_key.src.addr_data32[3] = next_key.src[3];
flow_key.dst.family = AF_INET6; flow_key.dst.family = AF_INET6;
flow_key.dst.addr_data32[0] = key.dst[0]; flow_key.dst.addr_data32[0] = next_key.dst[0];
flow_key.dst.addr_data32[1] = key.dst[1]; flow_key.dst.addr_data32[1] = next_key.dst[1];
flow_key.dst.addr_data32[2] = key.dst[2]; flow_key.dst.addr_data32[2] = next_key.dst[2];
flow_key.dst.addr_data32[3] = key.dst[3]; flow_key.dst.addr_data32[3] = next_key.dst[3];
flow_key.vlan_id[0] = key.vlan_id[0]; flow_key.vlan_id[0] = next_key.vlan_id[0];
flow_key.vlan_id[1] = key.vlan_id[1]; flow_key.vlan_id[1] = next_key.vlan_id[1];
flow_key.proto = key.ip_proto; flow_key.proto = next_key.ip_proto;
flow_key.recursion_level = 0; flow_key.recursion_level = 0;
pkts_cnt = EBPFUpdateFlowForKey(flowstats, &flow_key, values_array[0].hash, pkts_cnt = EBPFUpdateFlowForKey(flowstats, &flow_key, values_array[0].hash,
pkts_cnt, bytes_cnt); pkts_cnt, bytes_cnt);
if (pkts_cnt > 0) { if (pkts_cnt > 0) {
SC_ATOMIC_ADD(dev->bypassed, pkts_cnt); SC_ATOMIC_ADD(dev->bypassed, pkts_cnt);
EBPFDeleteKey(mapfd, &key); EBPFDeleteKey(mapfd, &next_key);
found = 1; found = 1;
} }
key = next_key; key = next_key;

Write Preview
Loading…
Cancel
Save