aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

af-packet: continuing cleaning and hole hunting

Browse Source 
Suppress useless fields in AFPThreadVars. This patch also get rid
of bytes counter as it was only used to display a message at exit.
Information on livedev and on packet counters are enough.
pull/2091/head
Eric Leblond 9 years ago committed by Victor Julien
parent 9500d12c9f
commit b797fd926c
1 changed files with 41 additions and 37 deletions
Show Stats Download Patch File Download Diff File

74
src/source-af-packet.c
Unescape Escape View File

@ -188,30 +188,32 @@ union thdr {
*/ */
typedef struct AFPThreadVars_ typedef struct AFPThreadVars_
{ {
union {
char *ring_v2;
struct iovec *ring_v3;
};
/* counters */ /* counters */
uint64_t pkts; uint64_t pkts;
uint64_t bytes;
ThreadVars *tv; ThreadVars *tv;
TmSlot *slot; TmSlot *slot;
LiveDevice *livedev; LiveDevice *livedev;
/* data link type for the thread */ /* data link type for the thread */
int datalink; uint32_t datalink;
int flags;
unsigned int frame_offset; unsigned int frame_offset;
ChecksumValidationMode checksum_mode; ChecksumValidationMode checksum_mode;
/* references to packet and drop counters */
uint16_t capture_kernel_packets; uint16_t capture_kernel_packets;
uint16_t capture_kernel_drops; uint16_t capture_kernel_drops;
/* handle state */ /* handle state */
uint8_t afp_state; uint8_t afp_state;
uint8_t copy_mode; uint8_t copy_mode;
uint8_t flags;
struct iovec *rd;
char *frame_buf;
/* IPS peer */ /* IPS peer */
AFPPeer *mpeer; AFPPeer *mpeer;
@ -227,29 +229,31 @@ typedef struct AFPThreadVars_
/* thread specific socket */ /* thread specific socket */
int socket; int socket;
int ring_size;
/* Filter */ /* Filter */
char *bpf_filter; char *bpf_filter;
/* socket buffer size */ /* socket buffer size */
int buffer_size; int buffer_size;
int ring_size;
int promisc; int promisc;
int down_count; int down_count;
char iface[AFP_IFACE_NAME_LENGTH];
/* IPS output iface */
char out_iface[AFP_IFACE_NAME_LENGTH];
int cluster_id; int cluster_id;
int cluster_type; int cluster_type;
int threads; int threads;
union {
struct tpacket_req req; struct tpacket_req req;
struct tpacket_req3 req3; struct tpacket_req3 req3;
};
char iface[AFP_IFACE_NAME_LENGTH];
/* IPS output iface */
char out_iface[AFP_IFACE_NAME_LENGTH];
} AFPThreadVars; } AFPThreadVars;
@ -591,7 +595,6 @@ int AFPRead(AFPThreadVars *ptv)
} }
ptv->pkts++; ptv->pkts++;
ptv->bytes += caplen + offset;
p->livedev = ptv->livedev; p->livedev = ptv->livedev;
/* add forged header */ /* add forged header */
@ -757,7 +760,7 @@ int AFPReadFromRing(AFPThreadVars *ptv)
} }
/* Read packet from ring */ /* Read packet from ring */
h.raw = (((union thdr **)ptv->frame_buf)[ptv->frame_offset]); h.raw = (((union thdr **)ptv->ring_v2)[ptv->frame_offset]);
if (h.raw == NULL) { if (h.raw == NULL) {
SCReturnInt(AFP_FAILURE); SCReturnInt(AFP_FAILURE);
} }
@ -807,7 +810,6 @@ int AFPReadFromRing(AFPThreadVars *ptv)
h.h2->tp_status |= TP_STATUS_USER_BUSY; h.h2->tp_status |= TP_STATUS_USER_BUSY;
ptv->pkts++; ptv->pkts++;
ptv->bytes += h.h2->tp_len;
p->livedev = ptv->livedev; p->livedev = ptv->livedev;
p->datalink = ptv->datalink; p->datalink = ptv->datalink;
@ -914,7 +916,6 @@ static inline int AFPParsePacketV3(AFPThreadVars *ptv, struct tpacket_block_desc
PKT_SET_SRC(p, PKT_SRC_WIRE); PKT_SET_SRC(p, PKT_SRC_WIRE);
ptv->pkts++; ptv->pkts++;
ptv->bytes += ppd->tp_len;
p->livedev = ptv->livedev; p->livedev = ptv->livedev;
p->datalink = ptv->datalink; p->datalink = ptv->datalink;
@ -1007,7 +1008,7 @@ int AFPReadFromRingV3(AFPThreadVars *ptv)
break; break;
} }
pbd = (struct tpacket_block_desc *) ptv->rd[ptv->frame_offset].iov_base; pbd = (struct tpacket_block_desc *) ptv->ring_v3[ptv->frame_offset].iov_base;
/* block is not ready to be read */ /* block is not ready to be read */
if ((pbd->hdr.bh1.block_status & TP_STATUS_USER) == 0) { if ((pbd->hdr.bh1.block_status & TP_STATUS_USER) == 0) {
@ -1074,10 +1075,10 @@ void AFPSwitchState(AFPThreadVars *ptv, int state)
/* Do cleaning if switching to down state */ /* Do cleaning if switching to down state */
if (state == AFP_STATE_DOWN) { if (state == AFP_STATE_DOWN) {
if (ptv->frame_buf) { if (ptv->ring_v2) {
/* only used in reading phase, we can free it */ /* only used in reading phase, we can free it */
SCFree(ptv->frame_buf); SCFree(ptv->ring_v2);
ptv->frame_buf = NULL; ptv->ring_v2 = NULL;
} }
if (ptv->socket != -1) { if (ptv->socket != -1) {
/* we need to wait for all packets to return data */ /* we need to wait for all packets to return data */
@ -1149,7 +1150,7 @@ static int AFPReadAndDiscardFromRing(AFPThreadVars *ptv, struct timeval *synctv)
} }
/* Read packet from ring */ /* Read packet from ring */
h.raw = (((union thdr **)ptv->frame_buf)[ptv->frame_offset]); h.raw = (((union thdr **)ptv->ring_v2)[ptv->frame_offset]);
if (h.raw == NULL) { if (h.raw == NULL) {
return -1; return -1;
} }
@ -1794,30 +1795,30 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose)
goto socket_err; goto socket_err;
} }
if (ptv->flags & AFP_TPACKET_V3) { if (ptv->flags & AFP_TPACKET_V3) {
ptv->rd = SCMalloc(ptv->req3.tp_block_nr * sizeof(*ptv->rd)); ptv->ring_v3 = SCMalloc(ptv->req3.tp_block_nr * sizeof(*ptv->ring_v3));
if (!ptv->rd) { if (!ptv->ring_v3) {
SCLogError(SC_ERR_MEM_ALLOC, "Unable to malloc ptv rd"); SCLogError(SC_ERR_MEM_ALLOC, "Unable to malloc ptv ring_v3");
goto mmap_err; goto mmap_err;
} }
for (i = 0; i < ptv->req3.tp_block_nr; ++i) { for (i = 0; i < ptv->req3.tp_block_nr; ++i) {
ptv->rd[i].iov_base = ring_buf + (i * ptv->req3.tp_block_size); ptv->ring_v3[i].iov_base = ring_buf + (i * ptv->req3.tp_block_size);
ptv->rd[i].iov_len = ptv->req3.tp_block_size; ptv->ring_v3[i].iov_len = ptv->req3.tp_block_size;
} }
} else { } else {
/* allocate a ring for each frame header pointer*/ /* allocate a ring for each frame header pointer*/
ptv->frame_buf = SCMalloc(ptv->req.tp_frame_nr * sizeof (union thdr *)); ptv->ring_v2 = SCMalloc(ptv->req.tp_frame_nr * sizeof (union thdr *));
if (ptv->frame_buf == NULL) { if (ptv->ring_v2 == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate frame buf"); SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate frame buf");
goto mmap_err; goto mmap_err;
} }
memset(ptv->frame_buf, 0, ptv->req.tp_frame_nr * sizeof (union thdr *)); memset(ptv->ring_v2, 0, ptv->req.tp_frame_nr * sizeof (union thdr *));
/* fill the header ring with proper frame ptr*/ /* fill the header ring with proper frame ptr*/
ptv->frame_offset = 0; ptv->frame_offset = 0;
for (i = 0; i < ptv->req.tp_block_nr; ++i) { for (i = 0; i < ptv->req.tp_block_nr; ++i) {
void *base = &ring_buf[i * ptv->req.tp_block_size]; void *base = &ring_buf[i * ptv->req.tp_block_size];
unsigned int j; unsigned int j;
for (j = 0; j < ptv->req.tp_block_size / ptv->req.tp_frame_size; ++j, ++ptv->frame_offset) { for (j = 0; j < ptv->req.tp_block_size / ptv->req.tp_frame_size; ++j, ++ptv->frame_offset) {
(((union thdr **)ptv->frame_buf)[ptv->frame_offset]) = base; (((union thdr **)ptv->ring_v2)[ptv->frame_offset]) = base;
base += ptv->req.tp_frame_size; base += ptv->req.tp_frame_size;
} }
} }
@ -1847,10 +1848,13 @@ static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose)
return 0; return 0;
frame_err: frame_err:
if (ptv->frame_buf) if (ptv->flags & AFP_TPACKET_V3) {
SCFree(ptv->frame_buf); if (ptv->ring_v3)
if (ptv->rd) SCFree(ptv->ring_v3);
SCFree(ptv->rd); } else {
if (ptv->ring_v2)
SCFree(ptv->ring_v2);
}
mmap_err: mmap_err:
/* Packet mmap does the cleaning when socket is closed */ /* Packet mmap does the cleaning when socket is closed */
socket_err: socket_err:
@ -2044,7 +2048,7 @@ void ReceiveAFPThreadExitStats(ThreadVars *tv, void *data)
StatsGetLocalCounterValue(tv, ptv->capture_kernel_drops)); StatsGetLocalCounterValue(tv, ptv->capture_kernel_drops));
#endif #endif
SCLogInfo("(%s) Packets %" PRIu64 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes); SCLogInfo("(%s) Packets %" PRIu64, tv->name, ptv->pkts);
} }
/** /**

Write Preview
Loading…
Cancel
Save