From 62e27ee6f763f2e8eda58c86fa6602ba18c4781c Mon Sep 17 00:00:00 2001 From: Tim Wojtulewicz Date: Sun, 17 Aug 2025 21:33:37 -0700 Subject: [PATCH] af_packet: pre-commit fixes --- src/iosource/af_packet/CMakeLists.txt | 1 - src/iosource/af_packet/README | 2 +- src/iosource/af_packet/src/AF_Packet.cc | 424 +++++++++++------------- src/iosource/af_packet/src/AF_Packet.h | 111 +++---- src/iosource/af_packet/src/Plugin.cc | 32 +- src/iosource/af_packet/src/Plugin.h | 11 +- src/iosource/af_packet/src/RX_Ring.cc | 160 +++++---- src/iosource/af_packet/src/RX_Ring.h | 34 +- 8 files changed, 362 insertions(+), 413 deletions(-) diff --git a/src/iosource/af_packet/CMakeLists.txt b/src/iosource/af_packet/CMakeLists.txt index fae83bbeb7..3cb19806f6 100644 --- a/src/iosource/af_packet/CMakeLists.txt +++ b/src/iosource/af_packet/CMakeLists.txt @@ -1,4 +1,3 @@ - cmake_minimum_required(VERSION 3.15 FATAL_ERROR) project(ZeekPluginAF_Packet) diff --git a/src/iosource/af_packet/README b/src/iosource/af_packet/README index ecf9c991ce..e882f6e9fb 100644 --- a/src/iosource/af_packet/README +++ b/src/iosource/af_packet/README @@ -91,7 +91,7 @@ To use the AF_Packet plugin with `zeekctl`, the `custom` load balance method can af_packet_fanout_mode=AF_Packet::FANOUT_HASH af_packet_buffer_size=128*1024*1024 -If all interfaces using `lb_method=custom` should be configured for AF_Packet, the prefix can be globally definied by adding the following line to `zeekctl.conf`: +If all interfaces using `lb_method=custom` should be configured for AF_Packet, the prefix can be globally defined by adding the following line to `zeekctl.conf`: lb_custom.InterfacePrefix=af_packet:: diff --git a/src/iosource/af_packet/src/AF_Packet.cc b/src/iosource/af_packet/src/AF_Packet.cc index 1d4155b949..ba8fcddd47 100644 --- a/src/iosource/af_packet/src/AF_Packet.cc +++ b/src/iosource/af_packet/src/AF_Packet.cc @@ -1,3 +1,5 @@ +// See the file "COPYING" in the main distribution directory for copyright. + #include "zeek/zeek-config.h" // Starting with Zeek 6.0, zeek-config.h does not provide the @@ -9,7 +11,6 @@ #include "AF_Packet.h" #include "RX_Ring.h" - #include "af_packet.bif.h" // CentOS 7 if_packet.h does not yet have this define, provide it @@ -20,189 +21,169 @@ using namespace zeek::iosource::pktsrc; -AF_PacketSource::~AF_PacketSource() - { - Close(); - } +AF_PacketSource::~AF_PacketSource() { Close(); } -AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live) - { +AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live) { if ( ! is_live ) Error("AF_Packet source does not support offline input"); - current_filter = -1; - props.path = path; - props.is_live = is_live; + current_filter = -1; + props.path = path; + props.is_live = is_live; - socket_fd = -1; - rx_ring = nullptr; + socket_fd = -1; + rx_ring = nullptr; - checksum_mode = zeek::BifConst::AF_Packet::checksum_validation_mode->AsEnum(); - } + checksum_mode = zeek::BifConst::AF_Packet::checksum_validation_mode->AsEnum(); +} -void AF_PacketSource::Open() - { - uint64_t buffer_size = zeek::BifConst::AF_Packet::buffer_size; - uint64_t block_size = zeek::BifConst::AF_Packet::block_size; - int block_timeout_msec = static_cast(zeek::BifConst::AF_Packet::block_timeout * 1000.0); - int link_type = zeek::BifConst::AF_Packet::link_type; +void AF_PacketSource::Open() { + uint64_t buffer_size = zeek::BifConst::AF_Packet::buffer_size; + uint64_t block_size = zeek::BifConst::AF_Packet::block_size; + int block_timeout_msec = static_cast(zeek::BifConst::AF_Packet::block_timeout * 1000.0); + int link_type = zeek::BifConst::AF_Packet::link_type; - bool enable_hw_timestamping = zeek::BifConst::AF_Packet::enable_hw_timestamping; - bool enable_fanout = zeek::BifConst::AF_Packet::enable_fanout; - bool enable_defrag = zeek::BifConst::AF_Packet::enable_defrag; + bool enable_hw_timestamping = zeek::BifConst::AF_Packet::enable_hw_timestamping; + bool enable_fanout = zeek::BifConst::AF_Packet::enable_fanout; + bool enable_defrag = zeek::BifConst::AF_Packet::enable_defrag; socket_fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); - if ( socket_fd < 0 ) - { + if ( socket_fd < 0 ) { Error(errno ? strerror(errno) : "unable to create socket"); return; - } + } - auto info = GetInterfaceInfo(props.path); + auto info = GetInterfaceInfo(props.path); - if ( ! info.Valid() ) - { - Error(errno ? strerror(errno) : "unable to get interface information"); - close(socket_fd); - socket_fd = -1; - return; - } + if ( ! info.Valid() ) { + Error(errno ? strerror(errno) : "unable to get interface information"); + close(socket_fd); + socket_fd = -1; + return; + } - if ( ! info.IsUp() ) - { - Error("interface is down"); - close(socket_fd); - socket_fd = -1; - return; - } + if ( ! info.IsUp() ) { + Error("interface is down"); + close(socket_fd); + socket_fd = -1; + return; + } - // Create RX-ring - try { - rx_ring = new RX_Ring(socket_fd, buffer_size, block_size, block_timeout_msec); - } catch (RX_RingException& e) { - Error(errno ? strerror(errno) : "unable to create RX-ring"); - close(socket_fd); - return; - } + // Create RX-ring + try { + rx_ring = new RX_Ring(socket_fd, buffer_size, block_size, block_timeout_msec); + } catch ( RX_RingException& e ) { + Error(errno ? strerror(errno) : "unable to create RX-ring"); + close(socket_fd); + return; + } - // Setup interface - if ( ! BindInterface(info) ) - { - Error(errno ? strerror(errno) : "unable to bind to interface"); - close(socket_fd); - return; - } + // Setup interface + if ( ! BindInterface(info) ) { + Error(errno ? strerror(errno) : "unable to bind to interface"); + close(socket_fd); + return; + } - if ( ! EnablePromiscMode(info) ) - { - Error(errno ? strerror(errno) : "unable enter promiscious mode"); - close(socket_fd); - return; - } + if ( ! EnablePromiscMode(info) ) { + Error(errno ? strerror(errno) : "unable enter promiscuous mode"); + close(socket_fd); + return; + } - if ( ! ConfigureFanoutGroup(enable_fanout, enable_defrag) ) - { - Error(errno ? strerror(errno) : "failed to join fanout group"); - close(socket_fd); - return; - } + if ( ! ConfigureFanoutGroup(enable_fanout, enable_defrag) ) { + Error(errno ? strerror(errno) : "failed to join fanout group"); + close(socket_fd); + return; + } - if ( ! ConfigureHWTimestamping(enable_hw_timestamping) ) - { + if ( ! ConfigureHWTimestamping(enable_hw_timestamping) ) { Error(errno ? strerror(errno) : "failed to configure hardware timestamping"); close(socket_fd); return; - } + } - props.netmask = NETMASK_UNKNOWN; - props.selectable_fd = socket_fd; - props.is_live = true; - props.link_type = link_type; + props.netmask = NETMASK_UNKNOWN; + props.selectable_fd = socket_fd; + props.is_live = true; + props.link_type = link_type; stats.received = stats.dropped = stats.link = stats.bytes_received = 0; num_discarded = 0; Opened(props); - } +} -AF_PacketSource::InterfaceInfo AF_PacketSource::GetInterfaceInfo(const std::string& path) - { - AF_PacketSource::InterfaceInfo info; - struct ifreq ifr; - int ret; +AF_PacketSource::InterfaceInfo AF_PacketSource::GetInterfaceInfo(const std::string& path) { + AF_PacketSource::InterfaceInfo info; + struct ifreq ifr; + int ret; - memset(&ifr, 0, sizeof(ifr)); - snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s", path.c_str()); + memset(&ifr, 0, sizeof(ifr)); + snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s", path.c_str()); - ret = ioctl(socket_fd, SIOCGIFFLAGS, &ifr); - if ( ret < 0 ) - return info; + ret = ioctl(socket_fd, SIOCGIFFLAGS, &ifr); + if ( ret < 0 ) + return info; - info.flags = ifr.ifr_flags; + info.flags = ifr.ifr_flags; - ret = ioctl(socket_fd, SIOCGIFINDEX, &ifr); - if ( ret < 0 ) - return info; + ret = ioctl(socket_fd, SIOCGIFINDEX, &ifr); + if ( ret < 0 ) + return info; - info.index = ifr.ifr_ifindex; + info.index = ifr.ifr_ifindex; - return info; - } + return info; +} -bool AF_PacketSource::BindInterface(const AF_PacketSource::InterfaceInfo& info) - { - struct sockaddr_ll saddr_ll; - int ret; +bool AF_PacketSource::BindInterface(const AF_PacketSource::InterfaceInfo& info) { + struct sockaddr_ll saddr_ll; + int ret; - memset(&saddr_ll, 0, sizeof(saddr_ll)); - saddr_ll.sll_family = AF_PACKET; - saddr_ll.sll_protocol = htons(ETH_P_ALL); - saddr_ll.sll_ifindex = info.index; + memset(&saddr_ll, 0, sizeof(saddr_ll)); + saddr_ll.sll_family = AF_PACKET; + saddr_ll.sll_protocol = htons(ETH_P_ALL); + saddr_ll.sll_ifindex = info.index; - ret = bind(socket_fd, (struct sockaddr *) &saddr_ll, sizeof(saddr_ll)); + ret = bind(socket_fd, (struct sockaddr*)&saddr_ll, sizeof(saddr_ll)); return (ret >= 0); - } +} -bool AF_PacketSource::EnablePromiscMode(const AF_PacketSource::InterfaceInfo& info) - { - struct packet_mreq mreq; - int ret; +bool AF_PacketSource::EnablePromiscMode(const AF_PacketSource::InterfaceInfo& info) { + struct packet_mreq mreq; + int ret; - memset(&mreq, 0, sizeof(mreq)); - mreq.mr_ifindex = info.index; - mreq.mr_type = PACKET_MR_PROMISC; + memset(&mreq, 0, sizeof(mreq)); + mreq.mr_ifindex = info.index; + mreq.mr_type = PACKET_MR_PROMISC; ret = setsockopt(socket_fd, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mreq, sizeof(mreq)); return (ret >= 0); - } +} -bool AF_PacketSource::ConfigureFanoutGroup(bool enabled, bool defrag) - { - if ( enabled ) - { - uint32_t fanout_arg, fanout_id; - int ret; +bool AF_PacketSource::ConfigureFanoutGroup(bool enabled, bool defrag) { + if ( enabled ) { + uint32_t fanout_arg, fanout_id; + int ret; fanout_id = zeek::BifConst::AF_Packet::fanout_id; fanout_arg = ((fanout_id & 0xffff) | (GetFanoutMode(defrag) << 16)); - ret = setsockopt(socket_fd, SOL_PACKET, PACKET_FANOUT, - &fanout_arg, sizeof(fanout_arg)); + ret = setsockopt(socket_fd, SOL_PACKET, PACKET_FANOUT, &fanout_arg, sizeof(fanout_arg)); if ( ret < 0 ) return false; - } - return true; } + return true; +} -bool AF_PacketSource::ConfigureHWTimestamping(bool enabled) - { - if ( enabled ) - { - struct ifreq ifr; - struct hwtstamp_config hwts_cfg; - int ret, opt; +bool AF_PacketSource::ConfigureHWTimestamping(bool enabled) { + if ( enabled ) { + struct ifreq ifr; + struct hwtstamp_config hwts_cfg; + int ret, opt; memset(&hwts_cfg, 0, sizeof(hwts_cfg)); hwts_cfg.tx_type = HWTSTAMP_TX_OFF; @@ -216,175 +197,150 @@ bool AF_PacketSource::ConfigureHWTimestamping(bool enabled) return false; opt = SOF_TIMESTAMPING_RAW_HARDWARE | SOF_TIMESTAMPING_RX_HARDWARE; - ret = setsockopt(socket_fd, SOL_PACKET, PACKET_TIMESTAMP, - &opt, sizeof(opt)); - if( ret < 0 ) + ret = setsockopt(socket_fd, SOL_PACKET, PACKET_TIMESTAMP, &opt, sizeof(opt)); + if ( ret < 0 ) return false; - } - return true; } + return true; +} -uint32_t AF_PacketSource::GetFanoutMode(bool defrag) - { - uint32_t fanout_mode; +uint32_t AF_PacketSource::GetFanoutMode(bool defrag) { + uint32_t fanout_mode; switch ( zeek::BifConst::AF_Packet::fanout_mode->AsEnum() ) { - case BifEnum::AF_Packet::FANOUT_CPU: fanout_mode = PACKET_FANOUT_CPU; - break; - #ifdef PACKET_FANOUT_QM - case BifEnum::AF_Packet::FANOUT_QM: fanout_mode = PACKET_FANOUT_QM; - break; - #endif - #ifdef PACKET_FANOUT_CBPF - case BifEnum::AF_Packet::FANOUT_CBPF: fanout_mode = PACKET_FANOUT_CBPF; - break; - #endif - #ifdef PACKET_FANOUT_EBPF - case BifEnum::AF_Packet::FANOUT_EBPF: fanout_mode = PACKET_FANOUT_EBPF; - break; - #endif - default: fanout_mode = PACKET_FANOUT_HASH; - break; + case BifEnum::AF_Packet::FANOUT_CPU: fanout_mode = PACKET_FANOUT_CPU; break; +#ifdef PACKET_FANOUT_QM + case BifEnum::AF_Packet::FANOUT_QM: fanout_mode = PACKET_FANOUT_QM; break; +#endif +#ifdef PACKET_FANOUT_CBPF + case BifEnum::AF_Packet::FANOUT_CBPF: fanout_mode = PACKET_FANOUT_CBPF; break; +#endif +#ifdef PACKET_FANOUT_EBPF + case BifEnum::AF_Packet::FANOUT_EBPF: fanout_mode = PACKET_FANOUT_EBPF; break; +#endif + default: fanout_mode = PACKET_FANOUT_HASH; break; } if ( defrag ) fanout_mode |= PACKET_FANOUT_FLAG_DEFRAG; return fanout_mode; - } +} -void AF_PacketSource::Close() - { - if ( socket_fd < 0 ) - return; +void AF_PacketSource::Close() { + if ( socket_fd < 0 ) + return; - delete rx_ring; - rx_ring = nullptr; + delete rx_ring; + rx_ring = nullptr; - close(socket_fd); - socket_fd = -1; + close(socket_fd); + socket_fd = -1; Closed(); - } +} -bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt) - { +bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt) { if ( ! socket_fd ) return false; - struct tpacket3_hdr *packet = 0; - const u_char *data; - while ( true ) - { - if ( ! rx_ring->GetNextPacket(&packet) ) - return false; + struct tpacket3_hdr* packet = 0; + const u_char* data; + while ( true ) { + if ( ! rx_ring->GetNextPacket(&packet) ) + return false; current_hdr.ts.tv_sec = packet->tp_sec; current_hdr.ts.tv_usec = packet->tp_nsec / 1000; current_hdr.caplen = packet->tp_snaplen; current_hdr.len = packet->tp_len; - data = (u_char *) packet + packet->tp_mac; + data = (u_char*)packet + packet->tp_mac; - if ( !ApplyBPFFilter(current_filter, ¤t_hdr, data) ) - { + if ( ! ApplyBPFFilter(current_filter, ¤t_hdr, data) ) { ++num_discarded; DoneWithPacket(); continue; - } + } pkt->Init(props.link_type, ¤t_hdr.ts, current_hdr.caplen, current_hdr.len, data); - if ( packet->tp_status & TP_STATUS_VLAN_VALID ) - pkt->vlan = packet->hv1.tp_vlan_tci & 0x0fff; + if ( packet->tp_status & TP_STATUS_VLAN_VALID ) + pkt->vlan = packet->hv1.tp_vlan_tci & 0x0fff; #if ZEEK_VERSION_NUMBER >= 50100 - switch ( checksum_mode ) - { - case BifEnum::AF_Packet::CHECKSUM_OFF: - { - // If set to off, just accept whatever checksum in the packet is correct and - // skip checking it here and in Zeek. - pkt->l4_checksummed = true; - break; - } - case BifEnum::AF_Packet::CHECKSUM_KERNEL: - { - // If set to kernel, check whether the kernel thinks the checksum is valid. If it - // does, tell Zeek to skip checking by itself. - if ( ( (packet->tp_status & TP_STATUS_CSUM_VALID) != 0 ) || - ( (packet->tp_status & TP_STATUS_CSUMNOTREADY) != 0 ) ) - pkt->l4_checksummed = true; - else - pkt->l4_checksummed = false; - break; - } - case BifEnum::AF_Packet::CHECKSUM_ON: - default: - { - // Let Zeek handle it. - pkt->l4_checksummed = false; - break; - } - } + switch ( checksum_mode ) { + case BifEnum::AF_Packet::CHECKSUM_OFF: { + // If set to off, just accept whatever checksum in the packet is correct and + // skip checking it here and in Zeek. + pkt->l4_checksummed = true; + break; + } + case BifEnum::AF_Packet::CHECKSUM_KERNEL: { + // If set to kernel, check whether the kernel thinks the checksum is valid. If it + // does, tell Zeek to skip checking by itself. + if ( ((packet->tp_status & TP_STATUS_CSUM_VALID) != 0) || + ((packet->tp_status & TP_STATUS_CSUMNOTREADY) != 0) ) + pkt->l4_checksummed = true; + else + pkt->l4_checksummed = false; + break; + } + case BifEnum::AF_Packet::CHECKSUM_ON: + default: { + // Let Zeek handle it. + pkt->l4_checksummed = false; + break; + } + } #endif - if ( current_hdr.len == 0 || current_hdr.caplen == 0 ) - { - Weird("empty_af_packet_header", pkt); - return false; - } + if ( current_hdr.len == 0 || current_hdr.caplen == 0 ) { + Weird("empty_af_packet_header", pkt); + return false; + } stats.received++; stats.bytes_received += current_hdr.len; return true; - } + } return false; - } +} -void AF_PacketSource::DoneWithPacket() - { - rx_ring->ReleasePacket(); - } +void AF_PacketSource::DoneWithPacket() { rx_ring->ReleasePacket(); } -bool AF_PacketSource::PrecompileFilter(int index, const std::string& filter) - { +bool AF_PacketSource::PrecompileFilter(int index, const std::string& filter) { return PktSrc::PrecompileBPFFilter(index, filter); - } +} -bool AF_PacketSource::SetFilter(int index) - { +bool AF_PacketSource::SetFilter(int index) { current_filter = index; return true; - } +} -void AF_PacketSource::Statistics(Stats* s) - { - if ( ! socket_fd ) - { +void AF_PacketSource::Statistics(Stats* s) { + if ( ! socket_fd ) { s->received = s->bytes_received = s->link = s->dropped = 0; return; - } + } struct tpacket_stats_v3 tp_stats; - socklen_t tp_stats_len = sizeof (struct tpacket_stats_v3); + socklen_t tp_stats_len = sizeof(struct tpacket_stats_v3); int ret; ret = getsockopt(socket_fd, SOL_PACKET, PACKET_STATISTICS, &tp_stats, &tp_stats_len); - if ( ret < 0 ) - { + if ( ret < 0 ) { Error(errno ? strerror(errno) : "unable to retrieve statistics"); s->received = s->bytes_received = s->link = s->dropped = 0; return; - } + } stats.link += tp_stats.tp_packets; stats.dropped += tp_stats.tp_drops; memcpy(s, &stats, sizeof(Stats)); - } +} -zeek::iosource::PktSrc* AF_PacketSource::InstantiateAF_Packet(const std::string& path, bool is_live) - { +zeek::iosource::PktSrc* AF_PacketSource::InstantiateAF_Packet(const std::string& path, bool is_live) { return new AF_PacketSource(path, is_live); - } +} diff --git a/src/iosource/af_packet/src/AF_Packet.h b/src/iosource/af_packet/src/AF_Packet.h index 971c468459..fe6ecb15f7 100644 --- a/src/iosource/af_packet/src/AF_Packet.h +++ b/src/iosource/af_packet/src/AF_Packet.h @@ -3,82 +3,81 @@ #pragma once extern "C" { -#include -#include -#include - -#include // errorno -#include // close() - -#include // ETH_P_ALL -#include // ifreq -#include // AF_PACKET, etc. -#include // SIOCSHWTSTAMP -#include // hwtstamp_config +#include // errorno +#include // ifreq +#include // AF_PACKET, etc. +#include // hwtstamp_config +#include // SIOCSHWTSTAMP +#include // ETH_P_ALL #include +#include +#include +#include +#include // close() } #include "zeek/iosource/PktSrc.h" + #include "RX_Ring.h" namespace af_packet::iosource::pktsrc { class AF_PacketSource : public zeek::iosource::PktSrc { public: - /** - * Constructor. - * - * path: Name of the interface to open (the AF_Packet source doesn't - * support reading from files). - * - * is_live: Must be true (the AF_Packet source doesn't support offline - * operation). - */ - AF_PacketSource(const std::string& path, bool is_live); + /** + * Constructor. + * + * path: Name of the interface to open (the AF_Packet source doesn't + * support reading from files). + * + * is_live: Must be true (the AF_Packet source doesn't support offline + * operation). + */ + AF_PacketSource(const std::string& path, bool is_live); - /** - * Destructor. - */ - ~AF_PacketSource() override; + /** + * Destructor. + */ + ~AF_PacketSource() override; - static PktSrc* InstantiateAF_Packet(const std::string& path, bool is_live); + static PktSrc* InstantiateAF_Packet(const std::string& path, bool is_live); protected: - // PktSrc interface. - void Open() override; - void Close() override; - bool ExtractNextPacket(zeek::Packet* pkt) override; - void DoneWithPacket() override; - bool PrecompileFilter(int index, const std::string& filter) override; - bool SetFilter(int index) override; - void Statistics(Stats* stats) override; + // PktSrc interface. + void Open() override; + void Close() override; + bool ExtractNextPacket(zeek::Packet* pkt) override; + void DoneWithPacket() override; + bool PrecompileFilter(int index, const std::string& filter) override; + bool SetFilter(int index) override; + void Statistics(Stats* stats) override; private: - Properties props; - Stats stats; + Properties props; + Stats stats; - int current_filter = 0; - unsigned int num_discarded = 0; - int checksum_mode = 0; + int current_filter = 0; + unsigned int num_discarded = 0; + int checksum_mode = 0; - int socket_fd = -1; - RX_Ring *rx_ring = nullptr; - struct pcap_pkthdr current_hdr = {}; + int socket_fd = -1; + RX_Ring* rx_ring = nullptr; + struct pcap_pkthdr current_hdr = {}; - struct InterfaceInfo { - int index = -1; - int flags = 0; + struct InterfaceInfo { + int index = -1; + int flags = 0; - bool Valid () { return index >= 0; } - bool IsUp() { return flags & IFF_UP; } - }; + bool Valid() { return index >= 0; } + bool IsUp() { return flags & IFF_UP; } + }; - InterfaceInfo GetInterfaceInfo(const std::string& path); - bool BindInterface(const InterfaceInfo& info); - bool EnablePromiscMode(const InterfaceInfo& info); - bool ConfigureFanoutGroup(bool enabled, bool defrag); - bool ConfigureHWTimestamping(bool enabled); - uint32_t GetFanoutMode(bool defrag); + InterfaceInfo GetInterfaceInfo(const std::string& path); + bool BindInterface(const InterfaceInfo& info); + bool EnablePromiscMode(const InterfaceInfo& info); + bool ConfigureFanoutGroup(bool enabled, bool defrag); + bool ConfigureHWTimestamping(bool enabled); + uint32_t GetFanoutMode(bool defrag); }; -} +} // namespace zeek::iosource::pktsrc diff --git a/src/iosource/af_packet/src/Plugin.cc b/src/iosource/af_packet/src/Plugin.cc index 5dc08730b1..ca8aa96ac3 100644 --- a/src/iosource/af_packet/src/Plugin.cc +++ b/src/iosource/af_packet/src/Plugin.cc @@ -1,21 +1,27 @@ +// See the file "COPYING" in the main distribution directory for copyright. #include "Plugin.h" -#include "AF_Packet.h" + #include "zeek/iosource/Component.h" -namespace af_packet::plugin::Zeek_AF_Packet { Plugin plugin; } +#include "AF_Packet.h" + +namespace plugin::Zeek_AF_Packet { +Plugin plugin; +} using namespace af_packet::plugin::Zeek_AF_Packet; -zeek::plugin::Configuration Plugin::Configure() - { - AddComponent(new ::zeek::iosource::PktSrcComponent("AF_PacketReader", "af_packet", ::zeek::iosource::PktSrcComponent::LIVE, ::af_packet::iosource::pktsrc::AF_PacketSource::InstantiateAF_Packet)); +zeek::plugin::Configuration Plugin::Configure() { + AddComponent( + new ::zeek::iosource::PktSrcComponent("AF_PacketReader", "af_packet", ::zeek::iosource::PktSrcComponent::LIVE, + ::zeek::iosource::pktsrc::AF_PacketSource::InstantiateAF_Packet)); - zeek::plugin::Configuration config; - config.name = "Zeek::AF_Packet"; - config.description = "Packet acquisition via AF_Packet"; - config.version.major = 4; - config.version.minor = 0; - config.version.patch = 0; - return config; - } + zeek::plugin::Configuration config; + config.name = "Zeek::AF_Packet"; + config.description = "Packet acquisition via AF_Packet"; + config.version.major = 4; + config.version.minor = 0; + config.version.patch = 0; + return config; +} diff --git a/src/iosource/af_packet/src/Plugin.h b/src/iosource/af_packet/src/Plugin.h index 511b943857..ad2961a379 100644 --- a/src/iosource/af_packet/src/Plugin.h +++ b/src/iosource/af_packet/src/Plugin.h @@ -1,16 +1,17 @@ +// See the file "COPYING" in the main distribution directory for copyright. + #pragma once #include namespace af_packet::plugin::Zeek_AF_Packet { -class Plugin : public zeek::plugin::Plugin -{ +class Plugin : public zeek::plugin::Plugin { protected: - // Overridden from zeek::plugin::Plugin. - zeek::plugin::Configuration Configure() override; + // Overridden from zeek::plugin::Plugin. + zeek::plugin::Configuration Configure() override; }; extern Plugin plugin; -} +} // namespace plugin::Zeek_AF_Packet diff --git a/src/iosource/af_packet/src/RX_Ring.cc b/src/iosource/af_packet/src/RX_Ring.cc index f364d2d827..99c38912b3 100644 --- a/src/iosource/af_packet/src/RX_Ring.cc +++ b/src/iosource/af_packet/src/RX_Ring.cc @@ -1,3 +1,4 @@ +// See the file "COPYING" in the main distribution directory for copyright. #include "RX_Ring.h" @@ -5,108 +6,95 @@ #include extern "C" { -#include // AF_PACKET, etc. -#include // socketopt consts -#include // mmap -#include // sysconf +#include // AF_PACKET, etc. +#include // mmap +#include // socketopt consts +#include // sysconf } -RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec) - { - int ret, ver = TPACKET_VERSION; +RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec) { + int ret, ver = TPACKET_VERSION; - if ( sock < 0 ) - throw RX_RingException("invalid socket"); + if ( sock < 0 ) + throw RX_RingException("invalid socket"); - // Configure socket - ret = setsockopt(sock, SOL_PACKET, PACKET_VERSION, &ver, sizeof(ver)); - if ( ret ) - throw RX_RingException("unable to set TPacket version"); + // Configure socket + ret = setsockopt(sock, SOL_PACKET, PACKET_VERSION, &ver, sizeof(ver)); + if ( ret ) + throw RX_RingException("unable to set TPacket version"); - InitLayout(bufsize, blocksize, blocktimeout_msec); - ret = setsockopt(sock, SOL_PACKET, PACKET_RX_RING, (uint8_t *) &layout, - sizeof(layout)); - if ( ret ) - throw RX_RingException("unable to set ring layout"); + InitLayout(bufsize, blocksize, blocktimeout_msec); + ret = setsockopt(sock, SOL_PACKET, PACKET_RX_RING, (uint8_t*)&layout, sizeof(layout)); + if ( ret ) + throw RX_RingException("unable to set ring layout"); - // Map memory - size = layout.tp_block_size * layout.tp_block_nr; - ring = (uint8_t *) mmap(NULL, size, PROT_READ | PROT_WRITE, - MAP_SHARED, sock, 0); - if ( ring == MAP_FAILED ) - throw RX_RingException("unable to map ring memory"); + // Map memory + size = layout.tp_block_size * layout.tp_block_nr; + ring = (uint8_t*)mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, sock, 0); + if ( ring == MAP_FAILED ) + throw RX_RingException("unable to map ring memory"); - block_num = packet_num = 0; - packet = NULL; + block_num = packet_num = 0; + packet = NULL; - // Init block mapping - blocks = new tpacket_block_desc*[layout.tp_block_nr]; - for ( unsigned int i = 0; i < layout.tp_block_nr; i++ ) - blocks[i] = (struct tpacket_block_desc *)(ring + - i * layout.tp_block_size); - } + // Init block mapping + blocks = new tpacket_block_desc*[layout.tp_block_nr]; + for ( unsigned int i = 0; i < layout.tp_block_nr; i++ ) + blocks[i] = (struct tpacket_block_desc*)(ring + i * layout.tp_block_size); +} -RX_Ring::~RX_Ring() - { - ReleasePacket(); +RX_Ring::~RX_Ring() { + ReleasePacket(); - delete[] blocks; - munmap(ring, size); + delete[] blocks; + munmap(ring, size); - blocks = 0; - size = 0; - } + blocks = 0; + size = 0; +} -bool RX_Ring::GetNextPacket(tpacket3_hdr** hdr) - { - struct tpacket_hdr_v1 *block_hdr = &(blocks[block_num]->hdr.bh1); +bool RX_Ring::GetNextPacket(tpacket3_hdr** hdr) { + struct tpacket_hdr_v1* block_hdr = &(blocks[block_num]->hdr.bh1); - if ( (block_hdr->block_status & TP_STATUS_USER) == 0 ) - return false; + if ( (block_hdr->block_status & TP_STATUS_USER) == 0 ) + return false; - if ( packet == NULL ) - { - // New block - packet_num = block_hdr->num_pkts; - if ( packet_num == 0 ) - { - NextBlock(); - return false; - } - packet = (struct tpacket3_hdr *) - ((uint8_t *) blocks[block_num] + block_hdr->offset_to_first_pkt); - } - else - // Continue with block - packet = (struct tpacket3_hdr *) - ((uint8_t *) packet + packet->tp_next_offset); + if ( packet == NULL ) { + // New block + packet_num = block_hdr->num_pkts; + if ( packet_num == 0 ) { + NextBlock(); + return false; + } + packet = (struct tpacket3_hdr*)((uint8_t*)blocks[block_num] + block_hdr->offset_to_first_pkt); + } + else + // Continue with block + packet = (struct tpacket3_hdr*)((uint8_t*)packet + packet->tp_next_offset); - *hdr = packet; - packet_num--; - return true; - } + *hdr = packet; + packet_num--; + return true; +} -void RX_Ring::ReleasePacket() - { - if ( packet_num == 0 ) - NextBlock(); - } +void RX_Ring::ReleasePacket() { + if ( packet_num == 0 ) + NextBlock(); +} -void RX_Ring::InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec) - { - memset(&layout, 0, sizeof(layout)); - layout.tp_block_size = blocksize; - layout.tp_frame_size = TPACKET_ALIGNMENT << 7; // Seems to be irrelevant for V3 - layout.tp_block_nr = bufsize / layout.tp_block_size; - layout.tp_frame_nr = (layout.tp_block_size / layout.tp_frame_size) * layout.tp_block_nr; - layout.tp_retire_blk_tov = blocktimeout_msec; - } +void RX_Ring::InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec) { + memset(&layout, 0, sizeof(layout)); + layout.tp_block_size = blocksize; + layout.tp_frame_size = TPACKET_ALIGNMENT << 7; // Seems to be irrelevant for V3 + layout.tp_block_nr = bufsize / layout.tp_block_size; + layout.tp_frame_nr = (layout.tp_block_size / layout.tp_frame_size) * layout.tp_block_nr; + layout.tp_retire_blk_tov = blocktimeout_msec; +} -void RX_Ring::NextBlock() - { - struct tpacket_hdr_v1 *block_hdr = &(blocks[block_num]->hdr.bh1); +void RX_Ring::NextBlock() { + struct tpacket_hdr_v1* block_hdr = &(blocks[block_num]->hdr.bh1); - block_hdr->block_status = TP_STATUS_KERNEL; - block_num = (block_num +1) % layout.tp_block_nr; - packet = NULL; - } + block_hdr->block_status = TP_STATUS_KERNEL; + block_num = (block_num + 1) % layout.tp_block_nr; + packet = NULL; +} diff --git a/src/iosource/af_packet/src/RX_Ring.h b/src/iosource/af_packet/src/RX_Ring.h index 7f26aedb06..c11e7140ef 100644 --- a/src/iosource/af_packet/src/RX_Ring.h +++ b/src/iosource/af_packet/src/RX_Ring.h @@ -13,32 +13,32 @@ extern "C" { class RX_RingException : public std::runtime_error { public: - RX_RingException(const std::string& what_arg) : std::runtime_error(what_arg) {} + RX_RingException(const std::string& what_arg) : std::runtime_error(what_arg) {} }; class RX_Ring { public: - /** - * Constructor - */ - RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec); - ~RX_Ring(); + /** + * Constructor + */ + RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec); + ~RX_Ring(); - bool GetNextPacket(tpacket3_hdr** hdr); - void ReleasePacket(); + bool GetNextPacket(tpacket3_hdr** hdr); + void ReleasePacket(); protected: - void InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec); - void NextBlock(); + void InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec); + void NextBlock(); private: - struct tpacket_req3 layout; - struct tpacket_block_desc** blocks; - struct tpacket3_hdr* packet; + struct tpacket_req3 layout; + struct tpacket_block_desc** blocks; + struct tpacket3_hdr* packet; - unsigned int block_num; - unsigned int packet_num; + unsigned int block_num; + unsigned int packet_num; - uint8_t* ring; - size_t size; + uint8_t* ring; + size_t size; };