diff --git a/src/runmode-pfring.c b/src/runmode-pfring.c index d932864a8c..c1fa684502 100644 --- a/src/runmode-pfring.c +++ b/src/runmode-pfring.c @@ -194,6 +194,7 @@ void *ParsePfringConfig(const char *iface) { char *threadsstr = NULL; ConfNode *if_root; + ConfNode *if_default = NULL; ConfNode *pf_ring_node; PfringIfaceConfig *pfconf = SCMalloc(sizeof(*pfconf)); char *tmpclusterid; @@ -234,7 +235,10 @@ void *ParsePfringConfig(const char *iface) } if_root = ConfNodeLookupKeyValue(pf_ring_node, "interface", iface); - if (if_root == NULL) { + + if_default = ConfNodeLookupKeyValue(pf_ring_node, "interface", "default"); + + if (if_root == NULL && if_default == NULL) { /* Switch to old mode */ if_root = pf_ring_node; SCLogInfo("Unable to find pfring config for " @@ -244,7 +248,13 @@ void *ParsePfringConfig(const char *iface) return pfconf; } - if (ConfGetChildValue(if_root, "threads", &threadsstr) != 1) { + /* If there is no setting for current interface use default one as main iface */ + if (if_root == NULL) { + if_root = if_default; + if_default = NULL; + } + + if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) { pfconf->threads = 1; } else { if (threadsstr != NULL) { @@ -264,7 +274,7 @@ void *ParsePfringConfig(const char *iface) SCLogDebug("Going to use command-line provided cluster-id %" PRId32, pfconf->cluster_id); } else { - if (ConfGetChildValue(if_root, "cluster-id", &tmpclusterid) != 1) { + if (ConfGetChildValueWithDefault(if_root, if_default, "cluster-id", &tmpclusterid) != 1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Could not get cluster-id from config"); } else { @@ -282,7 +292,7 @@ void *ParsePfringConfig(const char *iface) pfconf->bpf_filter); } } else { - if (ConfGetChildValue(if_root, "bpf-filter", &bpf_filter) == 1) { + if (ConfGetChildValueWithDefault(if_root, if_default, "bpf-filter", &bpf_filter) == 1) { if (strlen(bpf_filter) > 0) { pfconf->bpf_filter = SCStrdup(bpf_filter); SCLogDebug("Going to use bpf filter %s", pfconf->bpf_filter); @@ -296,7 +306,7 @@ void *ParsePfringConfig(const char *iface) SCLogDebug("Going to use command-line provided cluster-type"); getctype = 1; } else { - if (ConfGetChildValue(if_root, "cluster-type", &tmpctype) != 1) { + if (ConfGetChildValueWithDefault(if_root, if_default, "cluster-type", &tmpctype) != 1) { SCLogError(SC_ERR_GET_CLUSTER_TYPE_FAILED, "Could not get cluster-type fron config"); } else { @@ -324,7 +334,7 @@ void *ParsePfringConfig(const char *iface) #endif /* HAVE_PFRING_CLUSTER_TYPE */ - if (ConfGetChildValue(if_root, "checksum-checks", &tmpctype) == 1) { + if (ConfGetChildValueWithDefault(if_root, if_default, "checksum-checks", &tmpctype) == 1) { if (strcmp(tmpctype, "auto") == 0) { pfconf->checksum_mode = CHECKSUM_VALIDATION_AUTO; } else if (strcmp(tmpctype, "yes") == 0) { diff --git a/suricata.yaml.in b/suricata.yaml.in index 0526765461..7caf4d3566 100644 --- a/suricata.yaml.in +++ b/suricata.yaml.in @@ -680,6 +680,9 @@ pfring: # threads: 3 # cluster-id: 93 # cluster-type: cluster_flow + # Put default values here + - interface: default + #threads: 2 pcap: - interface: eth0