diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c index 02e060c206..92107c78f1 100644 --- a/src/runmode-af-packet.c +++ b/src/runmode-af-packet.c @@ -160,15 +160,15 @@ static void *ParseAFPConfig(const char *iface) if (ConfGet("bpf-filter", &bpf_filter) == 1) { if (strlen(bpf_filter) > 0) { aconf->bpf_filter = bpf_filter; - SCLogConfig("Going to use command-line provided bpf filter '%s'", - aconf->bpf_filter); + SCLogConfig( + "%s: using command-line provided bpf filter '%s'", iface, aconf->bpf_filter); } } /* Find initial node */ af_packet_node = ConfGetNode("af-packet"); if (af_packet_node == NULL) { - SCLogInfo("unable to find af-packet config using default values"); + SCLogInfo("%s: unable to find af-packet config using default values", iface); goto finalize; } @@ -176,9 +176,9 @@ static void *ParseAFPConfig(const char *iface) if_default = ConfFindDeviceConfig(af_packet_node, "default"); if (if_root == NULL && if_default == NULL) { - SCLogInfo("unable to find af-packet config for " + SCLogInfo("%s: unable to find af-packet config for " "interface \"%s\" or \"default\", using default values", - iface); + iface, iface); goto finalize; } @@ -198,8 +198,9 @@ static void *ParseAFPConfig(const char *iface) aconf->threads = 0; } else { if (StringParseInt32(&aconf->threads, 10, 0, (const char *)threadsstr) < 0) { - SCLogWarning("Invalid number of " - "threads, resetting to default"); + SCLogWarning("%s: invalid number of " + "threads, resetting to default", + iface); aconf->threads = 0; } } @@ -221,7 +222,7 @@ static void *ParseAFPConfig(const char *iface) (void)ConfGetChildValueBoolWithDefault(if_root, if_default, "mmap-locked", (int *)&boolval); if (boolval) { - SCLogConfig("Enabling locked memory for mmap on iface %s", aconf->iface); + SCLogConfig("%s: enabling locked memory for mmap", aconf->iface); aconf->flags |= AFP_MMAP_LOCKED; } @@ -229,15 +230,16 @@ static void *ParseAFPConfig(const char *iface) if (boolval) { if (strcasecmp(RunmodeGetActive(), "workers") == 0) { #ifdef HAVE_TPACKET_V3 - SCLogConfig("Enabling tpacket v3 capture on iface %s", aconf->iface); + SCLogConfig("%s: enabling tpacket v3", aconf->iface); aconf->flags |= AFP_TPACKET_V3; #else - SCLogNotice("System too old for tpacket v3 switching to v2"); + SCLogWarning("%s: system too old for tpacket v3 switching to v2", iface); aconf->flags &= ~AFP_TPACKET_V3; #endif } else { - SCLogWarning("tpacket v3 is only implemented for 'workers' runmode." - " Switching to tpacket v2."); + SCLogWarning("%s: tpacket v3 is only implemented for 'workers' runmode." + " Switching to tpacket v2.", + iface); aconf->flags &= ~AFP_TPACKET_V3; } } else { @@ -248,34 +250,31 @@ static void *ParseAFPConfig(const char *iface) (void)ConfGetChildValueBoolWithDefault( if_root, if_default, "use-emergency-flush", (int *)&boolval); if (boolval) { - SCLogConfig("Enabling emergency ring flush on iface %s", aconf->iface); + SCLogConfig("%s: using emergency ring flush", aconf->iface); aconf->flags |= AFP_EMERGENCY_MODE; } if (ConfGetChildValueWithDefault(if_root, if_default, "copy-mode", ©modestr) == 1) { if (aconf->out_iface == NULL) { - SCLogInfo("Copy mode activated but no destination" - " iface. Disabling feature"); + SCLogWarning("%s: copy mode activated but no destination" + " iface. Disabling feature", + iface); } else if (strlen(copymodestr) <= 0) { aconf->out_iface = NULL; } else if (strcmp(copymodestr, "ips") == 0) { - SCLogInfo("AF_PACKET IPS mode activated %s->%s", - iface, - aconf->out_iface); + SCLogInfo("%s: AF_PACKET IPS mode activated %s->%s", iface, iface, aconf->out_iface); aconf->copy_mode = AFP_COPY_MODE_IPS; if (aconf->flags & AFP_TPACKET_V3) { - SCLogWarning("Using tpacket_v3 in IPS mode will result in high latency"); + SCLogWarning("%s: using tpacket_v3 in IPS mode will result in high latency", iface); } } else if (strcmp(copymodestr, "tap") == 0) { - SCLogInfo("AF_PACKET TAP mode activated %s->%s", - iface, - aconf->out_iface); + SCLogInfo("%s: AF_PACKET TAP mode activated %s->%s", iface, iface, aconf->out_iface); aconf->copy_mode = AFP_COPY_MODE_TAP; if (aconf->flags & AFP_TPACKET_V3) { - SCLogWarning("Using tpacket_v3 in TAP mode will result in high latency"); + SCLogWarning("%s: using tpacket_v3 in TAP mode will result in high latency", iface); } } else { - SCLogInfo("Invalid mode (not in tap, ips)"); + SCLogWarning("Invalid 'copy-mode' (not in tap, ips)"); } } @@ -283,7 +282,7 @@ static void *ParseAFPConfig(const char *iface) aconf->cluster_id = (uint16_t)(cluster_id_auto++); } else { if (StringParseUint16(&aconf->cluster_id, 10, 0, (const char *)tmpclusterid) < 0) { - SCLogWarning("Invalid cluster_id, resetting to 0"); + SCLogWarning("%s: invalid cluster_id, resetting to 0", iface); aconf->cluster_id = 0; } SCLogDebug("Going to use cluster-id %" PRIu16, aconf->cluster_id); @@ -294,8 +293,7 @@ static void *ParseAFPConfig(const char *iface) aconf->cluster_type = PACKET_FANOUT_HASH | PACKET_FANOUT_FLAG_DEFRAG; cluster_type = PACKET_FANOUT_HASH; } else if (strcmp(tmpctype, "cluster_round_robin") == 0) { - SCLogConfig("Using round-robin cluster mode for AF_PACKET (iface %s)", - aconf->iface); + SCLogConfig("%s: using round-robin cluster mode for AF_PACKET", aconf->iface); aconf->cluster_type = PACKET_FANOUT_LB; cluster_type = PACKET_FANOUT_LB; } else if (strcmp(tmpctype, "cluster_flow") == 0) { @@ -303,42 +301,36 @@ static void *ParseAFPConfig(const char *iface) * compute the hash */ uint16_t defrag = 0; int conf_val = 0; - SCLogConfig("Using flow cluster mode for AF_PACKET (iface %s)", - aconf->iface); + SCLogConfig("%s: using flow cluster mode for AF_PACKET", aconf->iface); ConfGetChildValueBoolWithDefault(if_root, if_default, "defrag", &conf_val); if (conf_val) { - SCLogConfig("Using defrag kernel functionality for AF_PACKET (iface %s)", - aconf->iface); + SCLogConfig("%s: using defrag kernel functionality for AF_PACKET", aconf->iface); defrag = PACKET_FANOUT_FLAG_DEFRAG; } aconf->cluster_type = PACKET_FANOUT_HASH | defrag; cluster_type = PACKET_FANOUT_HASH; } else if (strcmp(tmpctype, "cluster_cpu") == 0) { - SCLogConfig("Using cpu cluster mode for AF_PACKET (iface %s)", - aconf->iface); + SCLogConfig("%s: using cpu cluster mode for AF_PACKET", aconf->iface); aconf->cluster_type = PACKET_FANOUT_CPU; cluster_type = PACKET_FANOUT_CPU; } else if (strcmp(tmpctype, "cluster_qm") == 0) { - SCLogConfig("Using queue based cluster mode for AF_PACKET (iface %s)", - aconf->iface); + SCLogConfig("%s: using queue based cluster mode for AF_PACKET", aconf->iface); aconf->cluster_type = PACKET_FANOUT_QM; cluster_type = PACKET_FANOUT_QM; } else if (strcmp(tmpctype, "cluster_random") == 0) { - SCLogConfig("Using random based cluster mode for AF_PACKET (iface %s)", - aconf->iface); + SCLogConfig("%s: using random based cluster mode for AF_PACKET", aconf->iface); aconf->cluster_type = PACKET_FANOUT_RND; cluster_type = PACKET_FANOUT_RND; } else if (strcmp(tmpctype, "cluster_rollover") == 0) { - SCLogConfig("Using rollover based cluster mode for AF_PACKET (iface %s)", - aconf->iface); - SCLogWarning("Rollover mode is causing severe flow " - "tracking issues, use it at your own risk."); + SCLogConfig("%s: using rollover based cluster mode for AF_PACKET", aconf->iface); + SCLogWarning("%s: rollover mode is causing severe flow " + "tracking issues, use it at your own risk.", + iface); aconf->cluster_type = PACKET_FANOUT_ROLLOVER; cluster_type = PACKET_FANOUT_ROLLOVER; #ifdef HAVE_PACKET_EBPF } else if (strcmp(tmpctype, "cluster_ebpf") == 0) { - SCLogInfo("Using ebpf based cluster mode for AF_PACKET (iface %s)", - aconf->iface); + SCLogInfo("%s: using ebpf based cluster mode for AF_PACKET", aconf->iface); aconf->cluster_type = PACKET_FANOUT_EBPF; cluster_type = PACKET_FANOUT_EBPF; #endif @@ -349,11 +341,11 @@ static void *ParseAFPConfig(const char *iface) int conf_val = 0; ConfGetChildValueBoolWithDefault(if_root, if_default, "rollover", &conf_val); if (conf_val) { - SCLogConfig("Using rollover kernel functionality for AF_PACKET (iface %s)", - aconf->iface); + SCLogConfig("%s: Using rollover kernel functionality for AF_PACKET", aconf->iface); aconf->cluster_type |= PACKET_FANOUT_FLAG_ROLLOVER; - SCLogWarning("Rollover option is causing severe flow " - "tracking issues, use it at your own risk."); + SCLogWarning("%s: rollover option is causing severe flow " + "tracking issues, use it at your own risk.", + iface); } /*load af_packet bpf filter*/ @@ -362,7 +354,7 @@ static void *ParseAFPConfig(const char *iface) if (ConfGetChildValueWithDefault(if_root, if_default, "bpf-filter", &bpf_filter) == 1) { if (strlen(bpf_filter) > 0) { aconf->bpf_filter = bpf_filter; - SCLogConfig("Going to use bpf filter %s", aconf->bpf_filter); + SCLogConfig("%s: bpf filter %s", iface, aconf->bpf_filter); } } } @@ -371,8 +363,7 @@ static void *ParseAFPConfig(const char *iface) aconf->ebpf_lb_file = NULL; } else { #ifdef HAVE_PACKET_EBPF - SCLogConfig("af-packet will use '%s' as eBPF load balancing file", - ebpf_file); + SCLogConfig("%s: af-packet will use '%s' as eBPF load balancing file", iface, ebpf_file); aconf->ebpf_lb_file = ebpf_file; aconf->ebpf_t_config.flags |= EBPF_SOCKET_FILTER; #endif @@ -382,8 +373,7 @@ static void *ParseAFPConfig(const char *iface) boolval = false; if (ConfGetChildValueBoolWithDefault(if_root, if_default, "pinned-maps", (int *)&boolval) == 1) { if (boolval) { - SCLogConfig("Using pinned maps on iface %s", - aconf->iface); + SCLogConfig("%s: using pinned maps", aconf->iface); aconf->ebpf_t_config.flags |= EBPF_PINNED_MAPS; } const char *pinned_maps_name = NULL; @@ -406,12 +396,12 @@ static void *ParseAFPConfig(const char *iface) &aconf->ebpf_lb_fd, &aconf->ebpf_t_config); if (ret != 0) { - SCLogWarning("Error when loading eBPF lb file"); + SCLogWarning("%s: failed to load eBPF lb file", iface); } } #else if (aconf->ebpf_lb_file) { - SCLogError("eBPF support is not build-in"); + SCLogError("%s: eBPF support is not built-in", iface); } #endif @@ -419,8 +409,7 @@ static void *ParseAFPConfig(const char *iface) aconf->ebpf_filter_file = NULL; } else { #ifdef HAVE_PACKET_EBPF - SCLogConfig("af-packet will use '%s' as eBPF filter file", - ebpf_file); + SCLogConfig("%s: af-packet will use '%s' as eBPF filter file", iface, ebpf_file); aconf->ebpf_filter_file = ebpf_file; aconf->ebpf_t_config.mode = AFP_MODE_EBPF_BYPASS; aconf->ebpf_t_config.flags |= EBPF_SOCKET_FILTER; @@ -428,12 +417,11 @@ static void *ParseAFPConfig(const char *iface) ConfGetChildValueBoolWithDefault(if_root, if_default, "bypass", &conf_val); if (conf_val) { #ifdef HAVE_PACKET_EBPF - SCLogConfig("Using bypass kernel functionality for AF_PACKET (iface %s)", - aconf->iface); + SCLogConfig("%s: using bypass kernel functionality for AF_PACKET", aconf->iface); aconf->flags |= AFP_BYPASS; BypassedFlowManagerRegisterUpdateFunc(EBPFUpdateFlow, NULL); #else - SCLogError("Bypass set but eBPF support is not built-in"); + SCLogError("%s: bypass set but eBPF support is not built-in", iface); #endif } } @@ -445,10 +433,10 @@ static void *ParseAFPConfig(const char *iface) &aconf->ebpf_filter_fd, &aconf->ebpf_t_config); if (ret != 0) { - SCLogWarning("Error when loading eBPF filter file"); + SCLogWarning("%s: failed to load eBPF filter file", iface); } #else - SCLogError("eBPF support is not build-in"); + SCLogError("%s: eBPF support is not built-in", iface); #endif } @@ -461,15 +449,14 @@ static void *ParseAFPConfig(const char *iface) aconf->xdp_filter_file = ebpf_file; ConfGetChildValueBoolWithDefault(if_root, if_default, "bypass", &conf_val); if (conf_val) { - SCLogConfig("Using bypass kernel functionality for AF_PACKET (iface %s)", - aconf->iface); + SCLogConfig("%s: using bypass kernel functionality for AF_PACKET", aconf->iface); aconf->flags |= AFP_XDPBYPASS; /* if maps are pinned we need to read them at start */ if (aconf->ebpf_t_config.flags & EBPF_PINNED_MAPS) { RunModeEnablesBypassManager(); struct ebpf_timeout_config *ebt = SCCalloc(1, sizeof(struct ebpf_timeout_config)); if (ebt == NULL) { - SCLogError("Flow bypass alloc error"); + SCLogError("%s: flow bypass alloc error", iface); } else { memcpy(ebt, &(aconf->ebpf_t_config), sizeof(struct ebpf_timeout_config)); BypassedFlowManagerRegisterCheckFunc(NULL, @@ -480,7 +467,7 @@ static void *ParseAFPConfig(const char *iface) BypassedFlowManagerRegisterUpdateFunc(EBPFUpdateFlow, NULL); } #else - SCLogWarning("XDP filter set but XDP support is not built-in"); + SCLogWarning("%s: XDP filter set but XDP support is not built-in", iface); #endif #ifdef HAVE_PACKET_XDP const char *xdp_mode; @@ -502,8 +489,7 @@ static void *ParseAFPConfig(const char *iface) boolval = true; if (ConfGetChildValueBoolWithDefault(if_root, if_default, "use-percpu-hash", (int *)&boolval) == 1) { if (boolval == false) { - SCLogConfig("Not using percpu hash on iface %s", - aconf->iface); + SCLogConfig("%s: not using percpu hash", aconf->iface); aconf->ebpf_t_config.cpus_count = 1; } } @@ -518,21 +504,21 @@ static void *ParseAFPConfig(const char *iface) &aconf->ebpf_t_config); switch (ret) { case 1: - SCLogInfo("Loaded pinned maps from sysfs"); + SCLogInfo("%s: loaded pinned maps from sysfs", iface); break; case -1: - SCLogWarning("Error when loading XDP filter file"); + SCLogWarning("%s: failed to load XDP filter file", iface); break; case 0: ret = EBPFSetupXDP(aconf->iface, aconf->xdp_filter_fd, aconf->xdp_mode); if (ret != 0) { - SCLogWarning("Error when setting up XDP"); + SCLogWarning("%s: failed to set up XDP", iface); } else { /* Try to get the xdp-cpu-redirect key */ const char *cpuset; if (ConfGetChildValueWithDefault(if_root, if_default, "xdp-cpu-redirect", &cpuset) == 1) { - SCLogConfig("Setting up CPU map XDP"); + SCLogConfig("%s: Setting up CPU map XDP", iface); ConfNode *node = ConfGetChildWithDefault(if_root, if_default, "xdp-cpu-redirect"); if (node == NULL) { SCLogError("Previously found node has disappeared"); @@ -550,7 +536,7 @@ static void *ParseAFPConfig(const char *iface) } } #else - SCLogError("XDP support is not built-in"); + SCLogError("%s: XDP support is not built-in", iface); #endif } @@ -565,7 +551,8 @@ static void *ParseAFPConfig(const char *iface) if ((ConfGetChildValueIntWithDefault(if_root, if_default, "block-size", &value)) == 1) { if (value % getpagesize()) { - SCLogError("Block-size must be a multiple of pagesize."); + SCLogWarning("%s: block-size %" PRIuMAX " must be a multiple of pagesize (%u).", iface, + value, getpagesize()); } else { aconf->block_size = value; } @@ -579,8 +566,7 @@ static void *ParseAFPConfig(const char *iface) (void)ConfGetChildValueBoolWithDefault(if_root, if_default, "disable-promisc", (int *)&boolval); if (boolval) { - SCLogConfig("Disabling promiscuous mode on iface %s", - aconf->iface); + SCLogConfig("%s: disabling promiscuous mode", aconf->iface); aconf->promisc = 0; } @@ -594,7 +580,7 @@ static void *ParseAFPConfig(const char *iface) } else if (strcmp(tmpctype, "kernel") == 0) { aconf->checksum_mode = CHECKSUM_VALIDATION_KERNEL; } else { - SCLogError("Invalid value for checksum-checks for %s", aconf->iface); + SCLogWarning("%s: invalid value for checksum-checks", aconf->iface); } } @@ -605,8 +591,9 @@ finalize: if (aconf->threads != 1) { if (AFPIsFanoutSupported(aconf->cluster_id) == 0) { if (aconf->threads != 0) { - SCLogNotice("fanout not supported on this system, falling " - "back to 1 capture thread"); + SCLogNotice("%s: fanout not supported on this system, falling " + "back to 1 capture thread", + iface); } aconf->threads = 1; } @@ -617,15 +604,16 @@ finalize: /* for cluster_flow use core count */ if (cluster_type == PACKET_FANOUT_HASH) { aconf->threads = (int)UtilCpuGetNumProcessorsOnline(); - SCLogPerf("cluster_flow: %u cores, using %u threads", aconf->threads, aconf->threads); + SCLogPerf("%s: cluster_flow: %u cores, using %u threads", iface, aconf->threads, + aconf->threads); /* for cluster_qm use RSS queue count */ } else if (cluster_type == PACKET_FANOUT_QM) { int rss_queues = GetIfaceRSSQueuesNum(iface); if (rss_queues > 0) { aconf->threads = rss_queues; - SCLogPerf( - "cluster_qm: %d RSS queues, using %u threads", rss_queues, aconf->threads); + SCLogPerf("%s: cluster_qm: %d RSS queues, using %u threads", iface, rss_queues, + aconf->threads); } } @@ -642,9 +630,9 @@ finalize: if (aconf->ring_size != 0) { if (aconf->ring_size * aconf->threads < max_pending_packets) { aconf->ring_size = max_pending_packets / aconf->threads + 1; - SCLogWarning("Inefficient setup: ring-size < max_pending_packets. " + SCLogWarning("%s: inefficient setup: ring-size < max_pending_packets. " "Resetting to decent value %d.", - aconf->ring_size); + iface, aconf->ring_size); /* We want at least that max_pending_packets packets can be handled by the * interface. This is generous if we have multiple interfaces listening. */ } @@ -662,7 +650,8 @@ finalize: if (LiveGetOffload() == 0) { if (GetIfaceOffloading(iface, 0, 1) == 1) { SCLogWarning( - "Using AF_PACKET with offloading activated leads to capture problems"); + "%s: using AF_PACKET with offloads enabled leads to capture problems", + iface); } } else { DisableIfaceOffloading(LiveGetDevice(iface), 0, 1); diff --git a/src/source-af-packet.c b/src/source-af-packet.c index 104dfd3965..39d5e03fd2 100644 --- a/src/source-af-packet.c +++ b/src/source-af-packet.c @@ -477,7 +477,7 @@ TmEcode AFPPeersListCheck() } try++; } - SCLogError("Threads number not equals"); + SCLogError("thread number not equal"); SCReturnInt(TM_ECODE_FAILED); } @@ -527,9 +527,9 @@ static TmEcode AFPPeersListAdd(AFPThreadVars *ptv) mtu = GetIfaceMTU(ptv->iface); out_mtu = GetIfaceMTU(ptv->out_iface); if (mtu != out_mtu) { - SCLogError("MTU on %s (%d) and %s (%d) are not equal, " - "transmission of packets bigger than %d will fail.", - ptv->iface, mtu, ptv->out_iface, out_mtu, (out_mtu > mtu) ? mtu : out_mtu); + SCLogWarning("MTU on %s (%d) and %s (%d) are not equal, " + "transmission of packets bigger than %d will fail.", + ptv->iface, mtu, ptv->out_iface, out_mtu, MIN(out_mtu, mtu)); } peerslist.peered += 2; break; @@ -653,7 +653,7 @@ static void AFPWritePacket(Packet *p, int version) } if (p->ethh == NULL) { - SCLogWarning("Should have an Ethernet header"); + SCLogWarning("packet should have an ethernet header"); return; } @@ -672,7 +672,8 @@ static void AFPWritePacket(Packet *p, int version) if (sendto(socket, GET_PKT_DATA(p), GET_PKT_LEN(p), 0, (struct sockaddr *)&socket_address, sizeof(struct sockaddr_ll)) < 0) { if (SC_ATOMIC_ADD(p->afp_v.peer->send_errors, 1) == 0) { - SCLogWarning("sending packet failed on socket %d: %s", socket, strerror(errno)); + SCLogWarning("%s: sending packet failed on socket %d: %s", p->afp_v.peer->iface, socket, + strerror(errno)); } } if (p->afp_v.peer->flags & AFP_SOCK_PROTECT) @@ -1026,7 +1027,7 @@ static int AFPReadFromRingV3(AFPThreadVars *ptv) /* Loop till we have packets available */ while (1) { if (unlikely(suricata_ctl_flags != 0)) { - SCLogInfo("Exiting AFP V3 read loop"); + SCLogDebug("Exiting AFP V3 read loop"); break; } @@ -1207,8 +1208,8 @@ static int AFPSynchronizeStart(AFPThreadVars *ptv, uint64_t *discarded_pkts) int r = poll(&fds, 1, POLL_TIMEOUT); if (r > 0 && (fds.revents & (POLLHUP|POLLRDHUP|POLLERR|POLLNVAL))) { - SCLogWarning( - "poll failed %02x", fds.revents & (POLLHUP | POLLRDHUP | POLLERR | POLLNVAL)); + SCLogWarning("%s: poll failed %02x", ptv->iface, + fds.revents & (POLLHUP | POLLRDHUP | POLLERR | POLLNVAL)); return 0; } else if (r > 0) { if (AFPPeersListStarted() && synctv.tv_sec == (time_t) 0xffffffff) { @@ -1256,12 +1257,12 @@ static int AFPTryReopen(AFPThreadVars *ptv) int afp_activate_r = AFPCreateSocket(ptv, ptv->iface, 0); if (afp_activate_r != 0) { if (ptv->down_count % AFP_DOWN_COUNTER_INTERVAL == 0) { - SCLogWarning("Can not open iface '%s'", ptv->iface); + SCLogWarning("%s: can't reopen interface", ptv->iface); } return afp_activate_r; } - SCLogInfo("Interface '%s' is back", ptv->iface); + SCLogInfo("%s: interface is back up", ptv->iface); return 0; } @@ -1301,10 +1302,11 @@ TmEcode ReceiveAFPLoop(ThreadVars *tv, void *data, void *slot) if (r < 0) { switch (-r) { case AFP_FATAL_ERROR: - SCLogError("Couldn't init AF_PACKET socket, fatal error"); + SCLogError("%s: failed to init socket for interface", ptv->iface); SCReturnInt(TM_ECODE_FAILED); case AFP_RECOVERABLE_ERROR: - SCLogWarning("Couldn't init AF_PACKET socket, retrying soon"); + SCLogWarning( + "%s: failed to init socket for interface, retrying soon", ptv->iface); } } AFPPeersListReachedInc(); @@ -1379,12 +1381,11 @@ TmEcode ReceiveAFPLoop(ThreadVars *tv, void *data, void *slot) /* Do a recv to get errno */ if (recv(ptv->socket, &c, sizeof c, MSG_PEEK) != -1) continue; /* what, no error? */ - SCLogError("Error reading data from iface '%s': (%d) %s", ptv->iface, errno, - strerror(errno)); + SCLogWarning("%s: failed to poll interface: %s", ptv->iface, strerror(errno)); AFPSwitchState(ptv, AFP_STATE_DOWN); continue; } else if (fds.revents & POLLNVAL) { - SCLogError("Invalid polling request"); + SCLogWarning("%s: invalid poll request: %s", ptv->iface, strerror(errno)); AFPSwitchState(ptv, AFP_STATE_DOWN); continue; } @@ -1402,8 +1403,7 @@ TmEcode ReceiveAFPLoop(ThreadVars *tv, void *data, void *slot) break; case AFP_READ_FAILURE: /* AFPRead in error: best to reset the socket */ - SCLogError("AFPRead error reading data from iface '%s': (%d) %s", ptv->iface, - errno, strerror(errno)); + SCLogWarning("%s: read failure: %s", ptv->iface, strerror(errno)); AFPSwitchState(ptv, AFP_STATE_DOWN); continue; case AFP_SURI_FAILURE: @@ -1426,8 +1426,7 @@ TmEcode ReceiveAFPLoop(ThreadVars *tv, void *data, void *slot) } else if ((r < 0) && (errno != EINTR)) { StatsIncr(ptv->tv, ptv->capture_afp_poll_err); - SCLogError("Error reading data from iface '%s': (%d) %s", ptv->iface, errno, - strerror(errno)); + SCLogWarning("%s: poll failure: %s", ptv->iface, strerror(errno)); AFPSwitchState(ptv, AFP_STATE_DOWN); continue; } @@ -1447,7 +1446,7 @@ static int AFPGetDevFlags(int fd, const char *ifname) strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); if (ioctl(fd, SIOCGIFFLAGS, &ifr) == -1) { - SCLogError("Unable to find type for iface \"%s\": %s", ifname, strerror(errno)); + SCLogError("%s: failed to get interface flags: %s", ifname, strerror(errno)); return -1; } @@ -1464,7 +1463,7 @@ static int AFPGetIfnumByDev(int fd, const char *ifname, int verbose) if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) { if (verbose) - SCLogError("Unable to find iface %s: %s", ifname, strerror(errno)); + SCLogError("%s: failed to find interface: %s", ifname, strerror(errno)); return -1; } @@ -1479,7 +1478,7 @@ static int AFPGetDevLinktype(int fd, const char *ifname) strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) { - SCLogError("Unable to find type for iface \"%s\": %s", ifname, strerror(errno)); + SCLogError("%s: failed to find interface type: %s", ifname, strerror(errno)); return -1; } @@ -1500,7 +1499,7 @@ int AFPGetLinkType(const char *ifname) int fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (fd == -1) { - SCLogError("Couldn't create a AF_PACKET socket, error %s", strerror(errno)); + SCLogError("%s: failed to create AF_PACKET socket: %s", ifname, strerror(errno)); return LINKTYPE_RAW; } @@ -1543,7 +1542,7 @@ frame size: TPACKET_ALIGN(snaplen + TPACKET_ALIGN(TPACKET_ALIGN(tp_hdrlen) + siz if (snaplen == 0) { snaplen = GetIfaceMaxPacketSize(ptv->iface); if (snaplen <= 0) { - SCLogWarning("Unable to get MTU, setting snaplen to sane default of 1514"); + SCLogWarning("%s: unable to get MTU, setting snaplen default of 1514", ptv->iface); snaplen = 1514; } } @@ -1552,14 +1551,14 @@ frame size: TPACKET_ALIGN(snaplen + TPACKET_ALIGN(TPACKET_ALIGN(tp_hdrlen) + siz ptv->req.v2.tp_block_size = getpagesize() << order; int frames_per_block = ptv->req.v2.tp_block_size / ptv->req.v2.tp_frame_size; if (frames_per_block == 0) { - SCLogError("Frame size bigger than block size"); + SCLogError("%s: Frame size bigger than block size", ptv->iface); return -1; } ptv->req.v2.tp_frame_nr = ptv->ring_size; ptv->req.v2.tp_block_nr = ptv->req.v2.tp_frame_nr / frames_per_block + 1; /* exact division */ ptv->req.v2.tp_frame_nr = ptv->req.v2.tp_block_nr * frames_per_block; - SCLogPerf("rx ring: block_size=%d block_nr=%d frame_size=%d frame_nr=%d", + SCLogPerf("%s: rx ring: block_size=%d block_nr=%d frame_size=%d frame_nr=%d", ptv->iface, ptv->req.v2.tp_block_size, ptv->req.v2.tp_block_nr, ptv->req.v2.tp_frame_size, ptv->req.v2.tp_frame_nr); return 1; @@ -1577,7 +1576,7 @@ static int AFPComputeRingParamsV3(AFPThreadVars *ptv) if (snaplen == 0) { snaplen = GetIfaceMaxPacketSize(ptv->iface); if (snaplen <= 0) { - SCLogWarning("Unable to get MTU, setting snaplen to sane default of 1514"); + SCLogWarning("%s: unable to get MTU, setting snaplen default of 1514", ptv->iface); snaplen = 1514; } } @@ -1586,7 +1585,8 @@ static int AFPComputeRingParamsV3(AFPThreadVars *ptv) frames_per_block = ptv->req.v3.tp_block_size / ptv->req.v3.tp_frame_size; if (frames_per_block == 0) { - SCLogError("Block size is too small, it should be at least %d", ptv->req.v3.tp_frame_size); + SCLogError("%s: block size is too small, it should be at least %d", ptv->iface, + ptv->req.v3.tp_frame_size); return -1; } ptv->req.v3.tp_block_nr = ptv->ring_size / frames_per_block + 1; @@ -1594,11 +1594,10 @@ static int AFPComputeRingParamsV3(AFPThreadVars *ptv) ptv->req.v3.tp_frame_nr = ptv->req.v3.tp_block_nr * frames_per_block; ptv->req.v3.tp_retire_blk_tov = ptv->block_timeout; ptv->req.v3.tp_feature_req_word = TP_FT_REQ_FILL_RXHASH; - SCLogPerf("AF_PACKET V3 RX Ring params: block_size=%d block_nr=%d frame_size=%d frame_nr=%d (mem: %d)", - ptv->req.v3.tp_block_size, ptv->req.v3.tp_block_nr, - ptv->req.v3.tp_frame_size, ptv->req.v3.tp_frame_nr, - ptv->req.v3.tp_block_size * ptv->req.v3.tp_block_nr - ); + SCLogPerf("%s: rx ring params: block_size=%d block_nr=%d frame_size=%d frame_nr=%d (mem: %d)", + ptv->iface, ptv->req.v3.tp_block_size, ptv->req.v3.tp_block_nr, + ptv->req.v3.tp_frame_size, ptv->req.v3.tp_frame_nr, + ptv->req.v3.tp_block_size * ptv->req.v3.tp_block_nr); return 1; } #endif @@ -1621,12 +1620,12 @@ static int AFPSetupRing(AFPThreadVars *ptv, char *devname) if (getsockopt(ptv->socket, SOL_PACKET, PACKET_HDRLEN, &val, &len) < 0) { if (errno == ENOPROTOOPT) { if (ptv->flags & AFP_TPACKET_V3) { - SCLogError("Too old kernel giving up (need 3.2 for TPACKET_V3)"); + SCLogError("%s: kernel too old for TPACKET_V3 (need 3.2+)", devname); } else { - SCLogError("Too old kernel giving up (need 2.6.27 at least)"); + SCLogError("%s: kernel too old (need 2.6.27+)", devname); } } - SCLogError("Error when retrieving packet header len"); + SCLogError("%s: failed to retrieve packet header len", devname); return AFP_FATAL_ERROR; } @@ -1638,7 +1637,8 @@ static int AFPSetupRing(AFPThreadVars *ptv, char *devname) #endif if (setsockopt(ptv->socket, SOL_PACKET, PACKET_VERSION, &val, sizeof(val)) < 0) { - SCLogError("Can't activate TPACKET_V2/TPACKET_V3 on packet socket: %s", strerror(errno)); + SCLogError("%s: failed to activate TPACKET_V2/TPACKET_V3 on packet socket: %s", devname, + strerror(errno)); return AFP_FATAL_ERROR; } @@ -1646,7 +1646,8 @@ static int AFPSetupRing(AFPThreadVars *ptv, char *devname) int req = SOF_TIMESTAMPING_RAW_HARDWARE; if (setsockopt(ptv->socket, SOL_PACKET, PACKET_TIMESTAMP, (void *) &req, sizeof(req)) < 0) { - SCLogWarning("Can't activate hardware timestamping on packet socket: %s", strerror(errno)); + SCLogWarning("%s: failed to activate hardware timestamping on packet socket: %s", devname, + strerror(errno)); } #endif @@ -1655,7 +1656,7 @@ static int AFPSetupRing(AFPThreadVars *ptv, char *devname) int reserve = VLAN_HEADER_LEN; if (setsockopt(ptv->socket, SOL_PACKET, PACKET_RESERVE, (void *)&reserve, sizeof(reserve)) < 0) { - SCLogError("Can't activate reserve on packet socket: %s", strerror(errno)); + SCLogError("%s: failed to activate reserve on packet socket: %s", devname, strerror(errno)); return AFP_FATAL_ERROR; } @@ -1668,15 +1669,14 @@ static int AFPSetupRing(AFPThreadVars *ptv, char *devname) r = setsockopt(ptv->socket, SOL_PACKET, PACKET_RX_RING, (void *) &ptv->req.v3, sizeof(ptv->req.v3)); if (r < 0) { - SCLogError("Unable to allocate RX Ring for iface %s: (%d) %s", devname, errno, - strerror(errno)); + SCLogError("%s: failed to allocate RX Ring: %s", devname, strerror(errno)); return AFP_FATAL_ERROR; } } else { #endif for (order = AFP_BLOCK_SIZE_DEFAULT_ORDER; order >= 0; order--) { if (AFPComputeRingParams(ptv, order) != 1) { - SCLogInfo("Ring parameter are incorrect. Please correct the devel"); + SCLogError("%s: ring parameters are incorrect. Please file a bug report", devname); return AFP_FATAL_ERROR; } @@ -1685,18 +1685,17 @@ static int AFPSetupRing(AFPThreadVars *ptv, char *devname) if (r < 0) { if (errno == ENOMEM) { - SCLogInfo("Memory issue with ring parameters. Retrying."); + SCLogWarning("%s: memory issue with ring parameters. Retrying", devname); continue; } - SCLogError("Unable to setup RX Ring for iface %s: (%d) %s", devname, errno, - strerror(errno)); + SCLogError("%s: failed to setup RX Ring: %s", devname, strerror(errno)); return AFP_FATAL_ERROR; } else { break; } } if (order < 0) { - SCLogError("Unable to setup RX Ring for iface %s (order 0 failed)", devname); + SCLogError("%s: failed to setup RX Ring (order 0 failed)", devname); return AFP_FATAL_ERROR; } #ifdef HAVE_TPACKET_V3 @@ -1719,14 +1718,14 @@ static int AFPSetupRing(AFPThreadVars *ptv, char *devname) ptv->ring_buf = mmap(0, ptv->ring_buflen, PROT_READ|PROT_WRITE, mmap_flag, ptv->socket, 0); if (ptv->ring_buf == MAP_FAILED) { - SCLogError("Unable to mmap, error %s", strerror(errno)); + SCLogError("%s: failed to mmap: %s", devname, strerror(errno)); goto mmap_err; } #ifdef HAVE_TPACKET_V3 if (ptv->flags & AFP_TPACKET_V3) { ptv->ring.v3 = SCMalloc(ptv->req.v3.tp_block_nr * sizeof(*ptv->ring.v3)); if (!ptv->ring.v3) { - SCLogError("Unable to malloc ptv ring.v3"); + SCLogError("%s: failed to alloc ring: %s", devname, strerror(errno)); goto postmmap_err; } for (i = 0; i < ptv->req.v3.tp_block_nr; ++i) { @@ -1738,7 +1737,7 @@ static int AFPSetupRing(AFPThreadVars *ptv, char *devname) /* allocate a ring for each frame header pointer*/ ptv->ring.v2 = SCCalloc(ptv->req.v2.tp_frame_nr, sizeof(union thdr *)); if (ptv->ring.v2 == NULL) { - SCLogError("Unable to allocate frame buf"); + SCLogError("%s: failed to alloc ring: %s", devname, strerror(errno)); goto postmmap_err; } /* fill the header ring with proper frame ptr*/ @@ -1844,12 +1843,11 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose) /* open socket */ ptv->socket = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (ptv->socket == -1) { - SCLogError("Couldn't create a AF_PACKET socket, error %s", strerror(errno)); + SCLogError("%s: failed to create socket: %s", devname, strerror(errno)); goto error; } if_idx = AFPGetIfnumByDev(ptv->socket, devname, verbose); - if (if_idx == -1) { goto socket_err; } @@ -1861,7 +1859,7 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose) bind_address.sll_ifindex = if_idx; if (bind_address.sll_ifindex == -1) { if (verbose) - SCLogError("Couldn't find iface %s", devname); + SCLogWarning("%s: device for found", devname); ret = AFP_RECOVERABLE_ERROR; goto socket_err; } @@ -1869,13 +1867,13 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose) int if_flags = AFPGetDevFlags(ptv->socket, ptv->iface); if (if_flags == -1) { if (verbose) { - SCLogError("Couldn't get flags for interface '%s'", ptv->iface); + SCLogWarning("%s: failed to get interface flags", ptv->iface); } ret = AFP_RECOVERABLE_ERROR; goto socket_err; } else if ((if_flags & (IFF_UP | IFF_RUNNING)) == 0) { if (verbose) { - SCLogError("Interface '%s' is down", ptv->iface); + SCLogWarning("%s: interface is down", ptv->iface); } ret = AFP_RECOVERABLE_ERROR; goto socket_err; @@ -1888,8 +1886,7 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose) sock_params.mr_ifindex = bind_address.sll_ifindex; r = setsockopt(ptv->socket, SOL_PACKET, PACKET_ADD_MEMBERSHIP,(void *)&sock_params, sizeof(sock_params)); if (r < 0) { - SCLogError( - "Couldn't switch iface %s to promiscuous, error %s", devname, strerror(errno)); + SCLogError("%s: failed to set promisc mode: %s", devname, strerror(errno)); goto socket_err; } } @@ -1898,7 +1895,8 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose) int val = 1; if (setsockopt(ptv->socket, SOL_PACKET, PACKET_AUXDATA, &val, sizeof(val)) == -1 && errno != ENOPROTOOPT) { - SCLogWarning("'kernel' checksum mode not supported, falling back to full mode."); + SCLogWarning( + "%s: 'kernel' checksum mode not supported, falling back to full mode", devname); ptv->checksum_mode = CHECKSUM_VALIDATION_ENABLE; } } @@ -1908,12 +1906,12 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose) /* * Set the socket buffer size to the specified value. */ - SCLogPerf("Setting AF_PACKET socket buffer to %d", ptv->buffer_size); + SCLogPerf("%s: setting socket buffer to %d", devname, ptv->buffer_size); if (setsockopt(ptv->socket, SOL_SOCKET, SO_RCVBUF, &ptv->buffer_size, sizeof(ptv->buffer_size)) == -1) { - SCLogError("Couldn't set buffer size to %d on iface %s, error %s", ptv->buffer_size, - devname, strerror(errno)); + SCLogError("%s: failed to set buffer size to %d: %s", devname, ptv->buffer_size, + strerror(errno)); goto socket_err; } } @@ -1922,10 +1920,9 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose) if (r < 0) { if (verbose) { if (errno == ENETDOWN) { - SCLogError("Couldn't bind AF_PACKET socket, iface %s is down", devname); + SCLogWarning("%s: failed to bind socket, iface is down", devname); } else { - SCLogError("Couldn't bind AF_PACKET socket to iface %s, error %s", devname, - strerror(errno)); + SCLogWarning("%s: failed to bind socket: %s", devname, strerror(errno)); } } ret = AFP_RECOVERABLE_ERROR; @@ -1941,7 +1938,7 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose) uint32_t option = (mode << 16) | (id & 0xffff); r = setsockopt(ptv->socket, SOL_PACKET, PACKET_FANOUT,(void *)&option, sizeof(option)); if (r < 0) { - SCLogError("Couldn't set fanout mode, error %s", strerror(errno)); + SCLogError("%s: failed to set fanout mode: %s", devname, strerror(errno)); goto socket_err; } } @@ -1951,7 +1948,7 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose) if (ptv->cluster_type == PACKET_FANOUT_EBPF) { r = SockFanoutSeteBPF(ptv); if (r < 0) { - SCLogError("Coudn't set EBPF, error %s", strerror(errno)); + SCLogError("%s: failed to set eBPF: %s", devname, strerror(errno)); goto socket_err; } } @@ -2009,9 +2006,7 @@ TmEcode AFPSetBPFFilter(AFPThreadVars *ptv) if (!ptv->bpf_filter) return TM_ECODE_OK; - SCLogInfo("Using BPF '%s' on iface '%s'", - ptv->bpf_filter, - ptv->iface); + SCLogInfo("%s: using BPF '%s'", ptv->iface, ptv->bpf_filter); char errbuf[PCAP_ERRBUF_SIZE]; if (SCBPFCompile(default_packet_size, /* snaplen_arg */ @@ -2022,7 +2017,7 @@ TmEcode AFPSetBPFFilter(AFPThreadVars *ptv) 0, /* mask */ errbuf, sizeof(errbuf)) == -1) { - SCLogError("Failed to compile BPF \"%s\": %s", ptv->bpf_filter, errbuf); + SCLogError("%s: failed to compile BPF \"%s\": %s", ptv->iface, ptv->bpf_filter, errbuf); return TM_ECODE_FAILED; } @@ -2036,7 +2031,7 @@ TmEcode AFPSetBPFFilter(AFPThreadVars *ptv) SCBPFFree(&filter); if(rc == -1) { - SCLogError("Failed to attach filter: %s", strerror(errno)); + SCLogError("%s: failed to attach filter: %s", ptv->iface, strerror(errno)); return TM_ECODE_FAILED; } @@ -2583,8 +2578,7 @@ void ReceiveAFPThreadExitStats(ThreadVars *tv, void *data) #ifdef PACKET_STATISTICS AFPDumpCounters(ptv); - SCLogPerf("(%s) Kernel: Packets %" PRIu64 ", dropped %" PRIu64 "", - tv->name, + SCLogPerf("%s: (%s) kernel: Packets %" PRIu64 ", dropped %" PRIu64 "", ptv->iface, tv->name, StatsGetLocalCounterValue(tv, ptv->capture_kernel_packets), StatsGetLocalCounterValue(tv, ptv->capture_kernel_drops)); #endif