aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

af-packet: continuing cleaning and hole hunting

Browse Source 
Suppress useless fields in AFPThreadVars. This patch also get rid
of bytes counter as it was only used to display a message at exit.
Information on livedev and on packet counters are enough.
pull/2091/head
Eric Leblond 9 years ago committed by Victor Julien
parent 9500d12c9f
commit b797fd926c
1 changed files with 41 additions and 37 deletions
Show Stats Download Patch File Download Diff File

78
src/source-af-packet.c
Unescape Escape View File

@ -188,30 +188,32 @@ union thdr {
*/
typedef struct AFPThreadVars_
{
union {
char *ring_v2;
struct iovec *ring_v3;
};
/* counters */
uint64_t pkts;
uint64_t bytes;
ThreadVars *tv;
TmSlot *slot;
LiveDevice *livedev;
/* data link type for the thread */
int datalink;
int flags;
uint32_t datalink;
unsigned int frame_offset;
ChecksumValidationMode checksum_mode;
/* references to packet and drop counters */
uint16_t capture_kernel_packets;
uint16_t capture_kernel_drops;
/* handle state */
uint8_t afp_state;
uint8_t copy_mode;
struct iovec *rd;
char *frame_buf;
uint8_t flags;
/* IPS peer */
AFPPeer *mpeer;
@ -227,29 +229,31 @@ typedef struct AFPThreadVars_
/* thread specific socket */
int socket;
int ring_size;
/* Filter */
char *bpf_filter;
/* socket buffer size */
int buffer_size;
int ring_size;
int promisc;
int down_count;
char iface[AFP_IFACE_NAME_LENGTH];
/* IPS output iface */
char out_iface[AFP_IFACE_NAME_LENGTH];
int cluster_id;
int cluster_type;
int threads;
struct tpacket_req req;
struct tpacket_req3 req3;
union {
struct tpacket_req req;
struct tpacket_req3 req3;
};
char iface[AFP_IFACE_NAME_LENGTH];
/* IPS output iface */
char out_iface[AFP_IFACE_NAME_LENGTH];
} AFPThreadVars;
@ -591,7 +595,6 @@ int AFPRead(AFPThreadVars *ptv)
}
ptv->pkts++;
ptv->bytes += caplen + offset;
p->livedev = ptv->livedev;
/* add forged header */
@ -757,7 +760,7 @@ int AFPReadFromRing(AFPThreadVars *ptv)
}
/* Read packet from ring */
h.raw = (((union thdr **)ptv->frame_buf)[ptv->frame_offset]);
h.raw = (((union thdr **)ptv->ring_v2)[ptv->frame_offset]);
if (h.raw == NULL) {
SCReturnInt(AFP_FAILURE);
}
@ -807,7 +810,6 @@ int AFPReadFromRing(AFPThreadVars *ptv)
h.h2->tp_status |= TP_STATUS_USER_BUSY;
ptv->pkts++;
ptv->bytes += h.h2->tp_len;
p->livedev = ptv->livedev;
p->datalink = ptv->datalink;
@ -914,7 +916,6 @@ static inline int AFPParsePacketV3(AFPThreadVars *ptv, struct tpacket_block_desc
PKT_SET_SRC(p, PKT_SRC_WIRE);
ptv->pkts++;
ptv->bytes += ppd->tp_len;
p->livedev = ptv->livedev;
p->datalink = ptv->datalink;
@ -1007,7 +1008,7 @@ int AFPReadFromRingV3(AFPThreadVars *ptv)
break;
}
pbd = (struct tpacket_block_desc *) ptv->rd[ptv->frame_offset].iov_base;
pbd = (struct tpacket_block_desc *) ptv->ring_v3[ptv->frame_offset].iov_base;
/* block is not ready to be read */
if ((pbd->hdr.bh1.block_status & TP_STATUS_USER) == 0) {
@ -1074,10 +1075,10 @@ void AFPSwitchState(AFPThreadVars *ptv, int state)
/* Do cleaning if switching to down state */
if (state == AFP_STATE_DOWN) {
if (ptv->frame_buf) {
if (ptv->ring_v2) {
/* only used in reading phase, we can free it */
SCFree(ptv->frame_buf);
ptv->frame_buf = NULL;
SCFree(ptv->ring_v2);
ptv->ring_v2 = NULL;
}
if (ptv->socket != -1) {
/* we need to wait for all packets to return data */
@ -1149,7 +1150,7 @@ static int AFPReadAndDiscardFromRing(AFPThreadVars *ptv, struct timeval *synctv)
}
/* Read packet from ring */
h.raw = (((union thdr **)ptv->frame_buf)[ptv->frame_offset]);
h.raw = (((union thdr **)ptv->ring_v2)[ptv->frame_offset]);
if (h.raw == NULL) {
return -1;
}
@ -1794,30 +1795,30 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose)
goto socket_err;
}
if (ptv->flags & AFP_TPACKET_V3) {
ptv->rd = SCMalloc(ptv->req3.tp_block_nr * sizeof(*ptv->rd));
if (!ptv->rd) {
SCLogError(SC_ERR_MEM_ALLOC, "Unable to malloc ptv rd");
ptv->ring_v3 = SCMalloc(ptv->req3.tp_block_nr * sizeof(*ptv->ring_v3));
if (!ptv->ring_v3) {
SCLogError(SC_ERR_MEM_ALLOC, "Unable to malloc ptv ring_v3");
goto mmap_err;
}
for (i = 0; i < ptv->req3.tp_block_nr; ++i) {
ptv->rd[i].iov_base = ring_buf + (i * ptv->req3.tp_block_size);
ptv->rd[i].iov_len = ptv->req3.tp_block_size;
ptv->ring_v3[i].iov_base = ring_buf + (i * ptv->req3.tp_block_size);
ptv->ring_v3[i].iov_len = ptv->req3.tp_block_size;
}
} else {
/* allocate a ring for each frame header pointer*/
ptv->frame_buf = SCMalloc(ptv->req.tp_frame_nr * sizeof (union thdr *));
if (ptv->frame_buf == NULL) {
ptv->ring_v2 = SCMalloc(ptv->req.tp_frame_nr * sizeof (union thdr *));
if (ptv->ring_v2 == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate frame buf");
goto mmap_err;
}
memset(ptv->frame_buf, 0, ptv->req.tp_frame_nr * sizeof (union thdr *));
memset(ptv->ring_v2, 0, ptv->req.tp_frame_nr * sizeof (union thdr *));
/* fill the header ring with proper frame ptr*/
ptv->frame_offset = 0;
for (i = 0; i < ptv->req.tp_block_nr; ++i) {
void *base = &ring_buf[i * ptv->req.tp_block_size];
unsigned int j;
for (j = 0; j < ptv->req.tp_block_size / ptv->req.tp_frame_size; ++j, ++ptv->frame_offset) {
(((union thdr **)ptv->frame_buf)[ptv->frame_offset]) = base;
(((union thdr **)ptv->ring_v2)[ptv->frame_offset]) = base;
base += ptv->req.tp_frame_size;
}
}
@ -1847,10 +1848,13 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose)
return 0;
frame_err:
if (ptv->frame_buf)
SCFree(ptv->frame_buf);
if (ptv->rd)
SCFree(ptv->rd);
if (ptv->flags & AFP_TPACKET_V3) {
if (ptv->ring_v3)
SCFree(ptv->ring_v3);
} else {
if (ptv->ring_v2)
SCFree(ptv->ring_v2);
}
mmap_err:
/* Packet mmap does the cleaning when socket is closed */
socket_err:
@ -2044,7 +2048,7 @@ void ReceiveAFPThreadExitStats(ThreadVars *tv, void *data)
StatsGetLocalCounterValue(tv, ptv->capture_kernel_drops));
#endif
SCLogInfo("(%s) Packets %" PRIu64 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes);
SCLogInfo("(%s) Packets %" PRIu64, tv->name, ptv->pkts);
}
/**

Write Preview
Loading…
Cancel
Save