/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-pcap-file.h" #include "log-httplog.h" #include "output.h" #include "cuda-packet-batcher.h" #include "source-pfring.h" #include "alert-fastlog.h" #include "alert-prelude.h" #include "alert-unified-log.h" #include "alert-unified-alert.h" #include "alert-unified2-alert.h" #include "alert-debuglog.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" static const char *default_mode = NULL; const char *RunModeFilePcapGetDefaultMode(void) { return default_mode; } void RunModeFilePcapRegister(void) { RunModeRegisterNewRunMode(RUNMODE_PCAP_FILE, "single", "Single threaded pcap file mode", RunModeFilePcap2); RunModeRegisterNewRunMode(RUNMODE_PCAP_FILE, "auto", "Multi threaded pcap file mode", RunModeFilePcapAuto); default_mode = "auto"; RunModeRegisterNewRunMode(RUNMODE_PCAP_FILE, "autofp", "Multi threaded pcap file mode. Packets from " "each flow are assigned to a single detect thread, " "unlike \"pcap_file_auto\" where packets from " "the same flow can be processed by any detect " "thread", RunModeFilePcapAutoFp); return; } /** * \brief Single thread version of the Pcap file processing. */ int RunModeFilePcap2(DetectEngineCtx *de_ctx) { char *file = NULL; if (ConfGet("runmode_pcap_file.file", &file) == 0) { SCLogError(SC_ERR_RUNMODE, "Failed retrieving pcap_file from Conf"); exit(EXIT_FAILURE); } printf("RunModeFilePcap2: file %s\n", file); TimeModeSetOffline(); /* create the threads */ ThreadVars *tv = TmThreadCreatePacketHandler("PcapFile", "packetpool", "packetpool", "packetpool","packetpool", "varslot"); if (tv == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(EXIT_FAILURE); } TmModule *tm_module = TmModuleGetByName("ReceivePcapFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName failed for ReceivePcap\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv, tm_module, file); tm_module = TmModuleGetByName("DecodePcapFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName DecodePcap failed\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv, tm_module, NULL); tm_module = TmModuleGetByName("StreamTcp"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName StreamTcp failed\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv, tm_module, NULL); tm_module = TmModuleGetByName("Detect"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName Detect failed\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv, tm_module, (void *)de_ctx); SetupOutputs(tv); if (TmThreadSpawn(tv) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } return 0; } /* * \brief RunModeFilePcapAuto set up the following thread packet handlers: * - Receive thread (from pcap file) * - Decode thread * - Stream thread * - Detect: If we have only 1 cpu, it will setup one Detect thread * If we have more than one, it will setup num_cpus - 1 * starting from the second cpu available. * - Outputs thread * By default the threads will use the first cpu available * except the Detection threads if we have more than one cpu. * * \param de_ctx Pointer to the Detection Engine. * * \retval 0 If all goes well. (If any problem is detected the engine will * exit()). */ int RunModeFilePcapAuto(DetectEngineCtx *de_ctx) { SCEnter(); char tname[16]; uint16_t cpu = 0; RunModeInitialize(); /* Available cpus */ uint16_t ncpus = UtilCpuGetNumProcessorsOnline(); char *file = NULL; if (ConfGet("runmode_pcap_file.file", &file) == 0) { SCLogError(SC_ERR_RUNMODE, "Failed retrieving pcap_file from Conf"); exit(EXIT_FAILURE); } SCLogDebug("file %s", file); TimeModeSetOffline(); /* create the threads */ ThreadVars *tv_receivepcap = TmThreadCreatePacketHandler("ReceivePcapFile", "packetpool", "packetpool", "pickup-queue", "simple", "1slot"); if (tv_receivepcap == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(EXIT_FAILURE); } TmModule *tm_module = TmModuleGetByName("ReceivePcapFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName failed for ReceivePcap\n"); exit(EXIT_FAILURE); } Tm1SlotSetFunc(tv_receivepcap, tm_module, file); TmThreadSetCPU(tv_receivepcap, RECEIVE_CPU_SET); if (TmThreadSpawn(tv_receivepcap) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } #if defined(__SC_CUDA_SUPPORT__) if (PatternMatchDefaultMatcher() == MPM_B2G_CUDA) { ThreadVars *tv_decode1 = TmThreadCreatePacketHandler("Decode", "pickup-queue", "simple", "decode-queue1", "simple", "1slot"); if (tv_decode1 == NULL) { printf("ERROR: TmThreadsCreate failed for Decode1\n"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName("DecodePcapFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName DecodePcap failed\n"); exit(EXIT_FAILURE); } Tm1SlotSetFunc(tv_decode1, tm_module, NULL); TmThreadSetCPU(tv_decode1, DECODE_CPU_SET); if (TmThreadSpawn(tv_decode1) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } ThreadVars *tv_cuda_PB = TmThreadCreate("CUDA_PB", "decode-queue1", "simple", "cuda-pb-queue1", "simple", "custom", SCCudaPBTmThreadsSlot1, 0); if (tv_cuda_PB == NULL) { printf("ERROR: TmThreadsCreate failed for CUDA_PB\n"); exit(EXIT_FAILURE); } tv_cuda_PB->type = TVT_PPT; tm_module = TmModuleGetByName("CudaPacketBatcher"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName CudaPacketBatcher failed\n"); exit(EXIT_FAILURE); } Tm1SlotSetFunc(tv_cuda_PB, tm_module, (void *)de_ctx); TmThreadSetCPU(tv_cuda_PB, DETECT_CPU_SET); if (TmThreadSpawn(tv_cuda_PB) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } ThreadVars *tv_stream1 = TmThreadCreatePacketHandler("Stream1", "cuda-pb-queue1", "simple", "stream-queue1", "simple", "1slot"); if (tv_stream1 == NULL) { printf("ERROR: TmThreadsCreate failed for Stream1\n"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName("StreamTcp"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName StreamTcp failed\n"); exit(EXIT_FAILURE); } Tm1SlotSetFunc(tv_stream1, tm_module, NULL); TmThreadSetCPU(tv_stream1, STREAM_CPU_SET); if (TmThreadSpawn(tv_stream1) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } } else { ThreadVars *tv_decode1 = TmThreadCreatePacketHandler("Decode & Stream", "pickup-queue", "simple", "stream-queue1", "simple", "varslot"); if (tv_decode1 == NULL) { printf("ERROR: TmThreadsCreate failed for Decode1\n"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName("DecodePcapFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName DecodePcap failed\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv_decode1, tm_module, NULL); tm_module = TmModuleGetByName("StreamTcp"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName StreamTcp failed\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv_decode1, tm_module, NULL); TmThreadSetCPU(tv_decode1, DECODE_CPU_SET); if (TmThreadSpawn(tv_decode1) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } } #else ThreadVars *tv_decode1 = TmThreadCreatePacketHandler("Decode & Stream", "pickup-queue", "simple", "stream-queue1", "simple", "varslot"); if (tv_decode1 == NULL) { printf("ERROR: TmThreadsCreate failed for Decode1\n"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName("DecodePcapFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName DecodePcap failed\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv_decode1, tm_module, NULL); tm_module = TmModuleGetByName("StreamTcp"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName StreamTcp failed\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv_decode1, tm_module, NULL); TmThreadSetCPU(tv_decode1, DECODE_CPU_SET); if (TmThreadSpawn(tv_decode1) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } #endif /* start with cpu 1 so that if we're creating an odd number of detect * threads we're not creating the most on CPU0. */ if (ncpus > 0) cpu = 1; /* always create at least one thread */ int thread_max = TmThreadGetNbThreads(DETECT_CPU_SET); if (thread_max == 0) thread_max = ncpus * threading_detect_ratio; if (thread_max < 1) thread_max = 1; int thread; for (thread = 0; thread < thread_max; thread++) { snprintf(tname, sizeof(tname), "Detect%"PRIu16, thread+1); if (tname == NULL) break; char *thread_name = SCStrdup(tname); SCLogDebug("Assigning %s affinity to cpu %u", thread_name, cpu); ThreadVars *tv_detect_ncpu = TmThreadCreatePacketHandler(thread_name, "stream-queue1", "simple", "alert-queue1", "simple", "1slot"); if (tv_detect_ncpu == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName("Detect"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName Detect failed\n"); exit(EXIT_FAILURE); } Tm1SlotSetFunc(tv_detect_ncpu, tm_module, (void *)de_ctx); TmThreadSetCPU(tv_detect_ncpu, DETECT_CPU_SET); char *thread_group_name = SCStrdup("Detect"); if (thread_group_name == NULL) { printf("Error allocating memory\n"); exit(EXIT_FAILURE); } tv_detect_ncpu->thread_group_name = thread_group_name; if (TmThreadSpawn(tv_detect_ncpu) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } if ((cpu + 1) == ncpus) cpu = 0; else cpu++; } ThreadVars *tv_outputs = TmThreadCreatePacketHandler("Outputs", "alert-queue1", "simple", "packetpool", "packetpool", "varslot"); SetupOutputs(tv_outputs); TmThreadSetCPU(tv_outputs, OUTPUT_CPU_SET); if (TmThreadSpawn(tv_outputs) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } return 0; } /** * \brief RunModeFilePcapAuto set up the following thread packet handlers: * - Receive thread (from pcap file) * - Decode thread * - Stream thread * - Detect: If we have only 1 cpu, it will setup one Detect thread * If we have more than one, it will setup num_cpus - 1 * starting from the second cpu available. * - Outputs thread * By default the threads will use the first cpu available * except the Detection threads if we have more than one cpu. * * \param de_ctx Pointer to the Detection Engine * * \retval 0 If all goes well. (If any problem is detected the engine will * exit()). */ int RunModeFilePcapAutoFp(DetectEngineCtx *de_ctx) { SCEnter(); char tname[12]; char qname[12]; uint16_t cpu = 0; char queues[2048] = ""; RunModeInitialize(); /* Available cpus */ uint16_t ncpus = UtilCpuGetNumProcessorsOnline(); /* start with cpu 1 so that if we're creating an odd number of detect * threads we're not creating the most on CPU0. */ if (ncpus > 0) cpu = 1; /* always create at least one thread */ int thread_max = TmThreadGetNbThreads(DETECT_CPU_SET); if (thread_max == 0) thread_max = ncpus * threading_detect_ratio; if (thread_max < 1) thread_max = 1; int thread; for (thread = 0; thread < thread_max; thread++) { if (strlen(queues) > 0) strlcat(queues, ",", sizeof(queues)); snprintf(qname, sizeof(qname), "pickup%"PRIu16, thread+1); strlcat(queues, qname, sizeof(queues)); } printf("queues %s\n", queues); char *file = NULL; if (ConfGet("runmode_pcap_file.file", &file) == 0) { SCLogError(SC_ERR_RUNMODE, "Failed retrieving pcap_file from Conf"); exit(EXIT_FAILURE); } SCLogDebug("file %s", file); TimeModeSetOffline(); /* create the threads */ ThreadVars *tv_receivepcap = TmThreadCreatePacketHandler("ReceivePcapFile", "packetpool", "packetpool", queues, "flow", "varslot"); if (tv_receivepcap == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(EXIT_FAILURE); } TmModule *tm_module = TmModuleGetByName("ReceivePcapFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName failed for ReceivePcap\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv_receivepcap, tm_module, file); tm_module = TmModuleGetByName("DecodePcapFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName DecodePcap failed\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv_receivepcap, tm_module, NULL); if (threading_set_cpu_affinity) { TmThreadSetCPUAffinity(tv_receivepcap, 0); if (ncpus > 1) TmThreadSetThreadPriority(tv_receivepcap, PRIO_MEDIUM); } if (TmThreadSpawn(tv_receivepcap) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } for (thread = 0; thread < thread_max; thread++) { snprintf(tname, sizeof(tname), "Detect%"PRIu16, thread+1); snprintf(qname, sizeof(qname), "pickup%"PRIu16, thread+1); printf("tname %s, qname %s\n", tname, qname); char *thread_name = SCStrdup(tname); SCLogDebug("Assigning %s affinity to cpu %u", thread_name, cpu); ThreadVars *tv_detect_ncpu = TmThreadCreatePacketHandler(thread_name, qname, "flow", "packetpool", "packetpool", "varslot"); if (tv_detect_ncpu == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName("StreamTcp"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName StreamTcp failed\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv_detect_ncpu, tm_module, NULL); tm_module = TmModuleGetByName("Detect"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName Detect failed\n"); exit(EXIT_FAILURE); } TmVarSlotSetFuncAppend(tv_detect_ncpu, tm_module, (void *)de_ctx); if (threading_set_cpu_affinity) { TmThreadSetCPUAffinity(tv_detect_ncpu, (int)cpu); /* If we have more than one core/cpu, the first Detect thread * (at cpu 0) will have less priority (higher 'nice' value) * In this case we will set the thread priority to +10 (default is 0) */ if (cpu == 0 && ncpus > 1) { TmThreadSetThreadPriority(tv_detect_ncpu, PRIO_LOW); } else if (ncpus > 1) { TmThreadSetThreadPriority(tv_detect_ncpu, PRIO_MEDIUM); } } char *thread_group_name = SCStrdup("Detect"); if (thread_group_name == NULL) { printf("Error allocating memory\n"); exit(EXIT_FAILURE); } tv_detect_ncpu->thread_group_name = thread_group_name; /* add outputs as well */ SetupOutputs(tv_detect_ncpu); if (TmThreadSpawn(tv_detect_ncpu) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } if ((cpu + 1) == ncpus) cpu = 0; else cpu++; } /* ThreadVars *tv_outputs = TmThreadCreatePacketHandler("Outputs", "alert-queue1", "simple", "packetpool", "packetpool", "varslot"); if (threading_set_cpu_affinity) { TmThreadSetCPUAffinity(tv_outputs, 0); if (ncpus > 1) TmThreadSetThreadPriority(tv_outputs, PRIO_MEDIUM); } if (TmThreadSpawn(tv_outputs) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } */ return 0; }