Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'master' of https://github.com/knielander/bro

Browse source 
I reworked this a bit:

    - Moved the globals into a new Pcap::* namespace, and renamed them
      slightly.

    - Moved the definitions of the globals into pcap/const.bif.

    - Also moved the existing 'snaplen' into Pcap::* and removed
      SnapLen() from the PktSrc API (it's really a pcap thing).

    - Likewise moved the existing functions precompile_pcap_filter,
      install_pcap_filter, and pcap_error, into Pcap::*.

    - Did some more refactoring for the pcap code.

* 'master' of https://github.com/knielander/bro:
  Refactored patch (removed options, less ambiguous name)
  Allow Bro to run in fanout mode.
  Allow libpcap buffer size to be set manually.
  Allow Bro to run in fanout mode.
  Allowed libpcap buffer size to be set via configuration.
This commit is contained in:
Robin Sommer 2015-08-30 21:44:48 -07:00
commit 36b5a4db08
24 changed files with 208 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

91
src/iosource/pcap/Source.cc
View file

@ -7,10 +7,16 @@
#include "Source.h"
#include "iosource/Packet.h"
#include "const.bif.h"
#ifdef HAVE_PCAP_INT_H
#include <pcap-int.h>
#endif
#ifdef HAVE_PACKET_FANOUT
#include <linux/if_packet.h>
#endif
using namespace iosource::pcap;
PcapSource::~PcapSource()
@ -84,32 +90,64 @@ void PcapSource::OpenLive()
props.netmask = PktSrc::NETMASK_UNKNOWN;
#endif
// We use the smallest time-out possible to return almost immediately if
// no packets are available. (We can't use set_nonblocking() as it's
// broken on FreeBSD: even when select() indicates that we can read
// something, we may get nothing if the store buffer hasn't filled up
// yet.)
pd = pcap_open_live(props.path.c_str(), SnapLen(), 1, 1, tmp_errbuf);
pd = pcap_create(props.path.c_str(), errbuf);
if ( ! pd )
{
Error(tmp_errbuf);
PcapError("pcap_create");
return;
}
// ### This needs autoconf'ing.
#ifdef HAVE_PCAP_INT_H
Info(fmt("pcap bufsize = %d\n", ((struct pcap *) pd)->bufsize));
#endif
if ( pcap_set_snaplen(pd, BifConst::Pcap::snaplen) )
{
PcapError("pcap_set_snaplen");
return;
}
if ( pcap_set_promisc(pd, 1) )
{
PcapError("pcap_set_promisc");
return;
}
// We use the smallest time-out possible to return almost immediately
// if no packets are available. (We can't use set_nonblocking() as
// it's broken on FreeBSD: even when select() indicates that we can
// read something, we may get nothing if the store buffer hasn't
// filled up yet.)
//
// TODO: The comment about FreeBSD is pretty old and may not apply
// anymore these days.
if ( pcap_set_timeout(pd, 1) )
{
PcapError("pcap_set_timeout");
return;
}
if ( pcap_set_buffer_size(pd, BifConst::Pcap::bufsize * 1024 * 1024) )
{
PcapError("pcap_set_buffer_size");
return;
}
if ( pcap_activate(pd) )
{
PcapError("pcap_activate");
return;
}
#ifdef HAVE_LINUX
if ( pcap_setnonblock(pd, 1, tmp_errbuf) < 0 )
{
PcapError();
PcapError("pcap_setnonblock");
return;
}
#endif
#ifdef HAVE_PCAP_INT_H
Info(fmt("pcap bufsize = %d\n", ((struct pcap *) pd)->bufsize));
#endif
props.selectable_fd = pcap_fileno(pd);
SetHdrSize();
@ -118,6 +156,24 @@ void PcapSource::OpenLive()
// Was closed, couldn't get header size.
return;
#ifdef HAVE_PACKET_FANOUT
// Turn on cluster mode for the device.
if ( BifConst::Pcap::packet_fanout_enable )
{
uint32_t packet_fanout_arg = (PACKET_FANOUT_HASH << 16)
| (BifConst::Pcap::packet_fanout_id & 0xffff);
if ( BifConst::Pcap::packet_fanout_defrag )
packet_fanout_arg |= (PACKET_FANOUT_FLAG_DEFRAG << 16);
if ( setsockopt(props.selectable_fd, SOL_PACKET, PACKET_FANOUT, &packet_fanout_arg, sizeof(packet_fanout_arg)) == -1 )
{
Error(fmt("packet fanout: %s", strerror(errno)));
return;
}
}
#endif
props.is_live = true;
Opened(props);
@ -257,12 +313,17 @@ void PcapSource::Statistics(Stats* s)
s->dropped = 0;
}
void PcapSource::PcapError()
void PcapSource::PcapError(const char* where)
{
string location;
if ( where )
location = fmt(" (%s)", where);
if ( pd )
Error(fmt("pcap_error: %s", pcap_geterr(pd)));
Error(fmt("pcap_error: %s%s", pcap_geterr(pd), location.c_str()));
else
Error("pcap_error: not open");
Error(fmt("pcap_error: not open%s", location.c_str()));
Close();
}