mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
af_packet: pre-commit fixes
This commit is contained in:
parent
709f876947
commit
62e27ee6f7
8 changed files with 362 additions and 413 deletions
|
@ -1,4 +1,3 @@
|
||||||
|
|
||||||
cmake_minimum_required(VERSION 3.15 FATAL_ERROR)
|
cmake_minimum_required(VERSION 3.15 FATAL_ERROR)
|
||||||
|
|
||||||
project(ZeekPluginAF_Packet)
|
project(ZeekPluginAF_Packet)
|
||||||
|
|
|
@ -91,7 +91,7 @@ To use the AF_Packet plugin with `zeekctl`, the `custom` load balance method can
|
||||||
af_packet_fanout_mode=AF_Packet::FANOUT_HASH
|
af_packet_fanout_mode=AF_Packet::FANOUT_HASH
|
||||||
af_packet_buffer_size=128*1024*1024
|
af_packet_buffer_size=128*1024*1024
|
||||||
|
|
||||||
If all interfaces using `lb_method=custom` should be configured for AF_Packet, the prefix can be globally definied by adding the following line to `zeekctl.conf`:
|
If all interfaces using `lb_method=custom` should be configured for AF_Packet, the prefix can be globally defined by adding the following line to `zeekctl.conf`:
|
||||||
|
|
||||||
lb_custom.InterfacePrefix=af_packet::
|
lb_custom.InterfacePrefix=af_packet::
|
||||||
|
|
||||||
|
|
|
@ -1,3 +1,5 @@
|
||||||
|
// See the file "COPYING" in the main distribution directory for copyright.
|
||||||
|
|
||||||
#include "zeek/zeek-config.h"
|
#include "zeek/zeek-config.h"
|
||||||
|
|
||||||
// Starting with Zeek 6.0, zeek-config.h does not provide the
|
// Starting with Zeek 6.0, zeek-config.h does not provide the
|
||||||
|
@ -9,7 +11,6 @@
|
||||||
|
|
||||||
#include "AF_Packet.h"
|
#include "AF_Packet.h"
|
||||||
#include "RX_Ring.h"
|
#include "RX_Ring.h"
|
||||||
|
|
||||||
#include "af_packet.bif.h"
|
#include "af_packet.bif.h"
|
||||||
|
|
||||||
// CentOS 7 if_packet.h does not yet have this define, provide it
|
// CentOS 7 if_packet.h does not yet have this define, provide it
|
||||||
|
@ -20,13 +21,9 @@
|
||||||
|
|
||||||
using namespace zeek::iosource::pktsrc;
|
using namespace zeek::iosource::pktsrc;
|
||||||
|
|
||||||
AF_PacketSource::~AF_PacketSource()
|
AF_PacketSource::~AF_PacketSource() { Close(); }
|
||||||
{
|
|
||||||
Close();
|
|
||||||
}
|
|
||||||
|
|
||||||
AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live)
|
AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live) {
|
||||||
{
|
|
||||||
if ( ! is_live )
|
if ( ! is_live )
|
||||||
Error("AF_Packet source does not support offline input");
|
Error("AF_Packet source does not support offline input");
|
||||||
|
|
||||||
|
@ -40,8 +37,7 @@ AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live)
|
||||||
checksum_mode = zeek::BifConst::AF_Packet::checksum_validation_mode->AsEnum();
|
checksum_mode = zeek::BifConst::AF_Packet::checksum_validation_mode->AsEnum();
|
||||||
}
|
}
|
||||||
|
|
||||||
void AF_PacketSource::Open()
|
void AF_PacketSource::Open() {
|
||||||
{
|
|
||||||
uint64_t buffer_size = zeek::BifConst::AF_Packet::buffer_size;
|
uint64_t buffer_size = zeek::BifConst::AF_Packet::buffer_size;
|
||||||
uint64_t block_size = zeek::BifConst::AF_Packet::block_size;
|
uint64_t block_size = zeek::BifConst::AF_Packet::block_size;
|
||||||
int block_timeout_msec = static_cast<int>(zeek::BifConst::AF_Packet::block_timeout * 1000.0);
|
int block_timeout_msec = static_cast<int>(zeek::BifConst::AF_Packet::block_timeout * 1000.0);
|
||||||
|
@ -53,24 +49,21 @@ void AF_PacketSource::Open()
|
||||||
|
|
||||||
socket_fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
|
socket_fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
|
||||||
|
|
||||||
if ( socket_fd < 0 )
|
if ( socket_fd < 0 ) {
|
||||||
{
|
|
||||||
Error(errno ? strerror(errno) : "unable to create socket");
|
Error(errno ? strerror(errno) : "unable to create socket");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
auto info = GetInterfaceInfo(props.path);
|
auto info = GetInterfaceInfo(props.path);
|
||||||
|
|
||||||
if ( ! info.Valid() )
|
if ( ! info.Valid() ) {
|
||||||
{
|
|
||||||
Error(errno ? strerror(errno) : "unable to get interface information");
|
Error(errno ? strerror(errno) : "unable to get interface information");
|
||||||
close(socket_fd);
|
close(socket_fd);
|
||||||
socket_fd = -1;
|
socket_fd = -1;
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( ! info.IsUp() )
|
if ( ! info.IsUp() ) {
|
||||||
{
|
|
||||||
Error("interface is down");
|
Error("interface is down");
|
||||||
close(socket_fd);
|
close(socket_fd);
|
||||||
socket_fd = -1;
|
socket_fd = -1;
|
||||||
|
@ -87,29 +80,25 @@ void AF_PacketSource::Open()
|
||||||
}
|
}
|
||||||
|
|
||||||
// Setup interface
|
// Setup interface
|
||||||
if ( ! BindInterface(info) )
|
if ( ! BindInterface(info) ) {
|
||||||
{
|
|
||||||
Error(errno ? strerror(errno) : "unable to bind to interface");
|
Error(errno ? strerror(errno) : "unable to bind to interface");
|
||||||
close(socket_fd);
|
close(socket_fd);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( ! EnablePromiscMode(info) )
|
if ( ! EnablePromiscMode(info) ) {
|
||||||
{
|
Error(errno ? strerror(errno) : "unable enter promiscuous mode");
|
||||||
Error(errno ? strerror(errno) : "unable enter promiscious mode");
|
|
||||||
close(socket_fd);
|
close(socket_fd);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( ! ConfigureFanoutGroup(enable_fanout, enable_defrag) )
|
if ( ! ConfigureFanoutGroup(enable_fanout, enable_defrag) ) {
|
||||||
{
|
|
||||||
Error(errno ? strerror(errno) : "failed to join fanout group");
|
Error(errno ? strerror(errno) : "failed to join fanout group");
|
||||||
close(socket_fd);
|
close(socket_fd);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( ! ConfigureHWTimestamping(enable_hw_timestamping) )
|
if ( ! ConfigureHWTimestamping(enable_hw_timestamping) ) {
|
||||||
{
|
|
||||||
Error(errno ? strerror(errno) : "failed to configure hardware timestamping");
|
Error(errno ? strerror(errno) : "failed to configure hardware timestamping");
|
||||||
close(socket_fd);
|
close(socket_fd);
|
||||||
return;
|
return;
|
||||||
|
@ -126,8 +115,7 @@ void AF_PacketSource::Open()
|
||||||
Opened(props);
|
Opened(props);
|
||||||
}
|
}
|
||||||
|
|
||||||
AF_PacketSource::InterfaceInfo AF_PacketSource::GetInterfaceInfo(const std::string& path)
|
AF_PacketSource::InterfaceInfo AF_PacketSource::GetInterfaceInfo(const std::string& path) {
|
||||||
{
|
|
||||||
AF_PacketSource::InterfaceInfo info;
|
AF_PacketSource::InterfaceInfo info;
|
||||||
struct ifreq ifr;
|
struct ifreq ifr;
|
||||||
int ret;
|
int ret;
|
||||||
|
@ -150,8 +138,7 @@ AF_PacketSource::InterfaceInfo AF_PacketSource::GetInterfaceInfo(const std::stri
|
||||||
return info;
|
return info;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool AF_PacketSource::BindInterface(const AF_PacketSource::InterfaceInfo& info)
|
bool AF_PacketSource::BindInterface(const AF_PacketSource::InterfaceInfo& info) {
|
||||||
{
|
|
||||||
struct sockaddr_ll saddr_ll;
|
struct sockaddr_ll saddr_ll;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
|
@ -164,8 +151,7 @@ bool AF_PacketSource::BindInterface(const AF_PacketSource::InterfaceInfo& info)
|
||||||
return (ret >= 0);
|
return (ret >= 0);
|
||||||
}
|
}
|
||||||
|
|
||||||
bool AF_PacketSource::EnablePromiscMode(const AF_PacketSource::InterfaceInfo& info)
|
bool AF_PacketSource::EnablePromiscMode(const AF_PacketSource::InterfaceInfo& info) {
|
||||||
{
|
|
||||||
struct packet_mreq mreq;
|
struct packet_mreq mreq;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
|
@ -177,18 +163,15 @@ bool AF_PacketSource::EnablePromiscMode(const AF_PacketSource::InterfaceInfo& in
|
||||||
return (ret >= 0);
|
return (ret >= 0);
|
||||||
}
|
}
|
||||||
|
|
||||||
bool AF_PacketSource::ConfigureFanoutGroup(bool enabled, bool defrag)
|
bool AF_PacketSource::ConfigureFanoutGroup(bool enabled, bool defrag) {
|
||||||
{
|
if ( enabled ) {
|
||||||
if ( enabled )
|
|
||||||
{
|
|
||||||
uint32_t fanout_arg, fanout_id;
|
uint32_t fanout_arg, fanout_id;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
fanout_id = zeek::BifConst::AF_Packet::fanout_id;
|
fanout_id = zeek::BifConst::AF_Packet::fanout_id;
|
||||||
fanout_arg = ((fanout_id & 0xffff) | (GetFanoutMode(defrag) << 16));
|
fanout_arg = ((fanout_id & 0xffff) | (GetFanoutMode(defrag) << 16));
|
||||||
|
|
||||||
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_FANOUT,
|
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_FANOUT, &fanout_arg, sizeof(fanout_arg));
|
||||||
&fanout_arg, sizeof(fanout_arg));
|
|
||||||
|
|
||||||
if ( ret < 0 )
|
if ( ret < 0 )
|
||||||
return false;
|
return false;
|
||||||
|
@ -196,10 +179,8 @@ bool AF_PacketSource::ConfigureFanoutGroup(bool enabled, bool defrag)
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool AF_PacketSource::ConfigureHWTimestamping(bool enabled)
|
bool AF_PacketSource::ConfigureHWTimestamping(bool enabled) {
|
||||||
{
|
if ( enabled ) {
|
||||||
if ( enabled )
|
|
||||||
{
|
|
||||||
struct ifreq ifr;
|
struct ifreq ifr;
|
||||||
struct hwtstamp_config hwts_cfg;
|
struct hwtstamp_config hwts_cfg;
|
||||||
int ret, opt;
|
int ret, opt;
|
||||||
|
@ -216,35 +197,28 @@ bool AF_PacketSource::ConfigureHWTimestamping(bool enabled)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
opt = SOF_TIMESTAMPING_RAW_HARDWARE | SOF_TIMESTAMPING_RX_HARDWARE;
|
opt = SOF_TIMESTAMPING_RAW_HARDWARE | SOF_TIMESTAMPING_RX_HARDWARE;
|
||||||
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_TIMESTAMP,
|
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_TIMESTAMP, &opt, sizeof(opt));
|
||||||
&opt, sizeof(opt));
|
|
||||||
if ( ret < 0 )
|
if ( ret < 0 )
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
uint32_t AF_PacketSource::GetFanoutMode(bool defrag)
|
uint32_t AF_PacketSource::GetFanoutMode(bool defrag) {
|
||||||
{
|
|
||||||
uint32_t fanout_mode;
|
uint32_t fanout_mode;
|
||||||
|
|
||||||
switch ( zeek::BifConst::AF_Packet::fanout_mode->AsEnum() ) {
|
switch ( zeek::BifConst::AF_Packet::fanout_mode->AsEnum() ) {
|
||||||
case BifEnum::AF_Packet::FANOUT_CPU: fanout_mode = PACKET_FANOUT_CPU;
|
case BifEnum::AF_Packet::FANOUT_CPU: fanout_mode = PACKET_FANOUT_CPU; break;
|
||||||
break;
|
|
||||||
#ifdef PACKET_FANOUT_QM
|
#ifdef PACKET_FANOUT_QM
|
||||||
case BifEnum::AF_Packet::FANOUT_QM: fanout_mode = PACKET_FANOUT_QM;
|
case BifEnum::AF_Packet::FANOUT_QM: fanout_mode = PACKET_FANOUT_QM; break;
|
||||||
break;
|
|
||||||
#endif
|
#endif
|
||||||
#ifdef PACKET_FANOUT_CBPF
|
#ifdef PACKET_FANOUT_CBPF
|
||||||
case BifEnum::AF_Packet::FANOUT_CBPF: fanout_mode = PACKET_FANOUT_CBPF;
|
case BifEnum::AF_Packet::FANOUT_CBPF: fanout_mode = PACKET_FANOUT_CBPF; break;
|
||||||
break;
|
|
||||||
#endif
|
#endif
|
||||||
#ifdef PACKET_FANOUT_EBPF
|
#ifdef PACKET_FANOUT_EBPF
|
||||||
case BifEnum::AF_Packet::FANOUT_EBPF: fanout_mode = PACKET_FANOUT_EBPF;
|
case BifEnum::AF_Packet::FANOUT_EBPF: fanout_mode = PACKET_FANOUT_EBPF; break;
|
||||||
break;
|
|
||||||
#endif
|
#endif
|
||||||
default: fanout_mode = PACKET_FANOUT_HASH;
|
default: fanout_mode = PACKET_FANOUT_HASH; break;
|
||||||
break;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( defrag )
|
if ( defrag )
|
||||||
|
@ -253,8 +227,7 @@ uint32_t AF_PacketSource::GetFanoutMode(bool defrag)
|
||||||
return fanout_mode;
|
return fanout_mode;
|
||||||
}
|
}
|
||||||
|
|
||||||
void AF_PacketSource::Close()
|
void AF_PacketSource::Close() {
|
||||||
{
|
|
||||||
if ( socket_fd < 0 )
|
if ( socket_fd < 0 )
|
||||||
return;
|
return;
|
||||||
|
|
||||||
|
@ -267,15 +240,13 @@ void AF_PacketSource::Close()
|
||||||
Closed();
|
Closed();
|
||||||
}
|
}
|
||||||
|
|
||||||
bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
|
bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt) {
|
||||||
{
|
|
||||||
if ( ! socket_fd )
|
if ( ! socket_fd )
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
struct tpacket3_hdr* packet = 0;
|
struct tpacket3_hdr* packet = 0;
|
||||||
const u_char* data;
|
const u_char* data;
|
||||||
while ( true )
|
while ( true ) {
|
||||||
{
|
|
||||||
if ( ! rx_ring->GetNextPacket(&packet) )
|
if ( ! rx_ring->GetNextPacket(&packet) )
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
|
@ -285,8 +256,7 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
|
||||||
current_hdr.len = packet->tp_len;
|
current_hdr.len = packet->tp_len;
|
||||||
data = (u_char*)packet + packet->tp_mac;
|
data = (u_char*)packet + packet->tp_mac;
|
||||||
|
|
||||||
if ( !ApplyBPFFilter(current_filter, ¤t_hdr, data) )
|
if ( ! ApplyBPFFilter(current_filter, ¤t_hdr, data) ) {
|
||||||
{
|
|
||||||
++num_discarded;
|
++num_discarded;
|
||||||
DoneWithPacket();
|
DoneWithPacket();
|
||||||
continue;
|
continue;
|
||||||
|
@ -298,17 +268,14 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
|
||||||
pkt->vlan = packet->hv1.tp_vlan_tci & 0x0fff;
|
pkt->vlan = packet->hv1.tp_vlan_tci & 0x0fff;
|
||||||
|
|
||||||
#if ZEEK_VERSION_NUMBER >= 50100
|
#if ZEEK_VERSION_NUMBER >= 50100
|
||||||
switch ( checksum_mode )
|
switch ( checksum_mode ) {
|
||||||
{
|
case BifEnum::AF_Packet::CHECKSUM_OFF: {
|
||||||
case BifEnum::AF_Packet::CHECKSUM_OFF:
|
|
||||||
{
|
|
||||||
// If set to off, just accept whatever checksum in the packet is correct and
|
// If set to off, just accept whatever checksum in the packet is correct and
|
||||||
// skip checking it here and in Zeek.
|
// skip checking it here and in Zeek.
|
||||||
pkt->l4_checksummed = true;
|
pkt->l4_checksummed = true;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
case BifEnum::AF_Packet::CHECKSUM_KERNEL:
|
case BifEnum::AF_Packet::CHECKSUM_KERNEL: {
|
||||||
{
|
|
||||||
// If set to kernel, check whether the kernel thinks the checksum is valid. If it
|
// If set to kernel, check whether the kernel thinks the checksum is valid. If it
|
||||||
// does, tell Zeek to skip checking by itself.
|
// does, tell Zeek to skip checking by itself.
|
||||||
if ( ((packet->tp_status & TP_STATUS_CSUM_VALID) != 0) ||
|
if ( ((packet->tp_status & TP_STATUS_CSUM_VALID) != 0) ||
|
||||||
|
@ -319,8 +286,7 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
case BifEnum::AF_Packet::CHECKSUM_ON:
|
case BifEnum::AF_Packet::CHECKSUM_ON:
|
||||||
default:
|
default: {
|
||||||
{
|
|
||||||
// Let Zeek handle it.
|
// Let Zeek handle it.
|
||||||
pkt->l4_checksummed = false;
|
pkt->l4_checksummed = false;
|
||||||
break;
|
break;
|
||||||
|
@ -328,8 +294,7 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
if ( current_hdr.len == 0 || current_hdr.caplen == 0 )
|
if ( current_hdr.len == 0 || current_hdr.caplen == 0 ) {
|
||||||
{
|
|
||||||
Weird("empty_af_packet_header", pkt);
|
Weird("empty_af_packet_header", pkt);
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
@ -342,26 +307,19 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
void AF_PacketSource::DoneWithPacket()
|
void AF_PacketSource::DoneWithPacket() { rx_ring->ReleasePacket(); }
|
||||||
{
|
|
||||||
rx_ring->ReleasePacket();
|
|
||||||
}
|
|
||||||
|
|
||||||
bool AF_PacketSource::PrecompileFilter(int index, const std::string& filter)
|
bool AF_PacketSource::PrecompileFilter(int index, const std::string& filter) {
|
||||||
{
|
|
||||||
return PktSrc::PrecompileBPFFilter(index, filter);
|
return PktSrc::PrecompileBPFFilter(index, filter);
|
||||||
}
|
}
|
||||||
|
|
||||||
bool AF_PacketSource::SetFilter(int index)
|
bool AF_PacketSource::SetFilter(int index) {
|
||||||
{
|
|
||||||
current_filter = index;
|
current_filter = index;
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
void AF_PacketSource::Statistics(Stats* s)
|
void AF_PacketSource::Statistics(Stats* s) {
|
||||||
{
|
if ( ! socket_fd ) {
|
||||||
if ( ! socket_fd )
|
|
||||||
{
|
|
||||||
s->received = s->bytes_received = s->link = s->dropped = 0;
|
s->received = s->bytes_received = s->link = s->dropped = 0;
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
@ -371,8 +329,7 @@ void AF_PacketSource::Statistics(Stats* s)
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
ret = getsockopt(socket_fd, SOL_PACKET, PACKET_STATISTICS, &tp_stats, &tp_stats_len);
|
ret = getsockopt(socket_fd, SOL_PACKET, PACKET_STATISTICS, &tp_stats, &tp_stats_len);
|
||||||
if ( ret < 0 )
|
if ( ret < 0 ) {
|
||||||
{
|
|
||||||
Error(errno ? strerror(errno) : "unable to retrieve statistics");
|
Error(errno ? strerror(errno) : "unable to retrieve statistics");
|
||||||
s->received = s->bytes_received = s->link = s->dropped = 0;
|
s->received = s->bytes_received = s->link = s->dropped = 0;
|
||||||
return;
|
return;
|
||||||
|
@ -384,7 +341,6 @@ void AF_PacketSource::Statistics(Stats* s)
|
||||||
memcpy(s, &stats, sizeof(Stats));
|
memcpy(s, &stats, sizeof(Stats));
|
||||||
}
|
}
|
||||||
|
|
||||||
zeek::iosource::PktSrc* AF_PacketSource::InstantiateAF_Packet(const std::string& path, bool is_live)
|
zeek::iosource::PktSrc* AF_PacketSource::InstantiateAF_Packet(const std::string& path, bool is_live) {
|
||||||
{
|
|
||||||
return new AF_PacketSource(path, is_live);
|
return new AF_PacketSource(path, is_live);
|
||||||
}
|
}
|
||||||
|
|
|
@ -3,22 +3,21 @@
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
extern "C" {
|
extern "C" {
|
||||||
#include <sys/types.h>
|
|
||||||
#include <sys/socket.h>
|
|
||||||
#include <sys/ioctl.h>
|
|
||||||
|
|
||||||
#include <errno.h> // errorno
|
#include <errno.h> // errorno
|
||||||
#include <unistd.h> // close()
|
|
||||||
|
|
||||||
#include <net/ethernet.h> // ETH_P_ALL
|
|
||||||
#include <linux/if.h> // ifreq
|
#include <linux/if.h> // ifreq
|
||||||
#include <linux/if_packet.h> // AF_PACKET, etc.
|
#include <linux/if_packet.h> // AF_PACKET, etc.
|
||||||
#include <linux/sockios.h> // SIOCSHWTSTAMP
|
|
||||||
#include <linux/net_tstamp.h> // hwtstamp_config
|
#include <linux/net_tstamp.h> // hwtstamp_config
|
||||||
|
#include <linux/sockios.h> // SIOCSHWTSTAMP
|
||||||
|
#include <net/ethernet.h> // ETH_P_ALL
|
||||||
#include <pcap.h>
|
#include <pcap.h>
|
||||||
|
#include <sys/ioctl.h>
|
||||||
|
#include <sys/socket.h>
|
||||||
|
#include <sys/types.h>
|
||||||
|
#include <unistd.h> // close()
|
||||||
}
|
}
|
||||||
|
|
||||||
#include "zeek/iosource/PktSrc.h"
|
#include "zeek/iosource/PktSrc.h"
|
||||||
|
|
||||||
#include "RX_Ring.h"
|
#include "RX_Ring.h"
|
||||||
|
|
||||||
namespace af_packet::iosource::pktsrc {
|
namespace af_packet::iosource::pktsrc {
|
||||||
|
@ -81,4 +80,4 @@ private:
|
||||||
uint32_t GetFanoutMode(bool defrag);
|
uint32_t GetFanoutMode(bool defrag);
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
} // namespace zeek::iosource::pktsrc
|
||||||
|
|
|
@ -1,15 +1,21 @@
|
||||||
|
// See the file "COPYING" in the main distribution directory for copyright.
|
||||||
|
|
||||||
#include "Plugin.h"
|
#include "Plugin.h"
|
||||||
#include "AF_Packet.h"
|
|
||||||
#include "zeek/iosource/Component.h"
|
#include "zeek/iosource/Component.h"
|
||||||
|
|
||||||
namespace af_packet::plugin::Zeek_AF_Packet { Plugin plugin; }
|
#include "AF_Packet.h"
|
||||||
|
|
||||||
|
namespace plugin::Zeek_AF_Packet {
|
||||||
|
Plugin plugin;
|
||||||
|
}
|
||||||
|
|
||||||
using namespace af_packet::plugin::Zeek_AF_Packet;
|
using namespace af_packet::plugin::Zeek_AF_Packet;
|
||||||
|
|
||||||
zeek::plugin::Configuration Plugin::Configure()
|
zeek::plugin::Configuration Plugin::Configure() {
|
||||||
{
|
AddComponent(
|
||||||
AddComponent(new ::zeek::iosource::PktSrcComponent("AF_PacketReader", "af_packet", ::zeek::iosource::PktSrcComponent::LIVE, ::af_packet::iosource::pktsrc::AF_PacketSource::InstantiateAF_Packet));
|
new ::zeek::iosource::PktSrcComponent("AF_PacketReader", "af_packet", ::zeek::iosource::PktSrcComponent::LIVE,
|
||||||
|
::zeek::iosource::pktsrc::AF_PacketSource::InstantiateAF_Packet));
|
||||||
|
|
||||||
zeek::plugin::Configuration config;
|
zeek::plugin::Configuration config;
|
||||||
config.name = "Zeek::AF_Packet";
|
config.name = "Zeek::AF_Packet";
|
||||||
|
|
|
@ -1,11 +1,12 @@
|
||||||
|
// See the file "COPYING" in the main distribution directory for copyright.
|
||||||
|
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
#include <zeek/plugin/Plugin.h>
|
#include <zeek/plugin/Plugin.h>
|
||||||
|
|
||||||
namespace af_packet::plugin::Zeek_AF_Packet {
|
namespace af_packet::plugin::Zeek_AF_Packet {
|
||||||
|
|
||||||
class Plugin : public zeek::plugin::Plugin
|
class Plugin : public zeek::plugin::Plugin {
|
||||||
{
|
|
||||||
protected:
|
protected:
|
||||||
// Overridden from zeek::plugin::Plugin.
|
// Overridden from zeek::plugin::Plugin.
|
||||||
zeek::plugin::Configuration Configure() override;
|
zeek::plugin::Configuration Configure() override;
|
||||||
|
@ -13,4 +14,4 @@ protected:
|
||||||
|
|
||||||
extern Plugin plugin;
|
extern Plugin plugin;
|
||||||
|
|
||||||
}
|
} // namespace plugin::Zeek_AF_Packet
|
||||||
|
|
|
@ -1,3 +1,4 @@
|
||||||
|
// See the file "COPYING" in the main distribution directory for copyright.
|
||||||
|
|
||||||
#include "RX_Ring.h"
|
#include "RX_Ring.h"
|
||||||
|
|
||||||
|
@ -6,13 +7,12 @@
|
||||||
|
|
||||||
extern "C" {
|
extern "C" {
|
||||||
#include <linux/if_packet.h> // AF_PACKET, etc.
|
#include <linux/if_packet.h> // AF_PACKET, etc.
|
||||||
#include <sys/socket.h> // socketopt consts
|
|
||||||
#include <sys/mman.h> // mmap
|
#include <sys/mman.h> // mmap
|
||||||
|
#include <sys/socket.h> // socketopt consts
|
||||||
#include <unistd.h> // sysconf
|
#include <unistd.h> // sysconf
|
||||||
}
|
}
|
||||||
|
|
||||||
RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec)
|
RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec) {
|
||||||
{
|
|
||||||
int ret, ver = TPACKET_VERSION;
|
int ret, ver = TPACKET_VERSION;
|
||||||
|
|
||||||
if ( sock < 0 )
|
if ( sock < 0 )
|
||||||
|
@ -24,15 +24,13 @@ RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_ms
|
||||||
throw RX_RingException("unable to set TPacket version");
|
throw RX_RingException("unable to set TPacket version");
|
||||||
|
|
||||||
InitLayout(bufsize, blocksize, blocktimeout_msec);
|
InitLayout(bufsize, blocksize, blocktimeout_msec);
|
||||||
ret = setsockopt(sock, SOL_PACKET, PACKET_RX_RING, (uint8_t *) &layout,
|
ret = setsockopt(sock, SOL_PACKET, PACKET_RX_RING, (uint8_t*)&layout, sizeof(layout));
|
||||||
sizeof(layout));
|
|
||||||
if ( ret )
|
if ( ret )
|
||||||
throw RX_RingException("unable to set ring layout");
|
throw RX_RingException("unable to set ring layout");
|
||||||
|
|
||||||
// Map memory
|
// Map memory
|
||||||
size = layout.tp_block_size * layout.tp_block_nr;
|
size = layout.tp_block_size * layout.tp_block_nr;
|
||||||
ring = (uint8_t *) mmap(NULL, size, PROT_READ | PROT_WRITE,
|
ring = (uint8_t*)mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, sock, 0);
|
||||||
MAP_SHARED, sock, 0);
|
|
||||||
if ( ring == MAP_FAILED )
|
if ( ring == MAP_FAILED )
|
||||||
throw RX_RingException("unable to map ring memory");
|
throw RX_RingException("unable to map ring memory");
|
||||||
|
|
||||||
|
@ -42,12 +40,10 @@ RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_ms
|
||||||
// Init block mapping
|
// Init block mapping
|
||||||
blocks = new tpacket_block_desc*[layout.tp_block_nr];
|
blocks = new tpacket_block_desc*[layout.tp_block_nr];
|
||||||
for ( unsigned int i = 0; i < layout.tp_block_nr; i++ )
|
for ( unsigned int i = 0; i < layout.tp_block_nr; i++ )
|
||||||
blocks[i] = (struct tpacket_block_desc *)(ring +
|
blocks[i] = (struct tpacket_block_desc*)(ring + i * layout.tp_block_size);
|
||||||
i * layout.tp_block_size);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
RX_Ring::~RX_Ring()
|
RX_Ring::~RX_Ring() {
|
||||||
{
|
|
||||||
ReleasePacket();
|
ReleasePacket();
|
||||||
|
|
||||||
delete[] blocks;
|
delete[] blocks;
|
||||||
|
@ -57,43 +53,36 @@ RX_Ring::~RX_Ring()
|
||||||
size = 0;
|
size = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool RX_Ring::GetNextPacket(tpacket3_hdr** hdr)
|
bool RX_Ring::GetNextPacket(tpacket3_hdr** hdr) {
|
||||||
{
|
|
||||||
struct tpacket_hdr_v1* block_hdr = &(blocks[block_num]->hdr.bh1);
|
struct tpacket_hdr_v1* block_hdr = &(blocks[block_num]->hdr.bh1);
|
||||||
|
|
||||||
if ( (block_hdr->block_status & TP_STATUS_USER) == 0 )
|
if ( (block_hdr->block_status & TP_STATUS_USER) == 0 )
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
if ( packet == NULL )
|
if ( packet == NULL ) {
|
||||||
{
|
|
||||||
// New block
|
// New block
|
||||||
packet_num = block_hdr->num_pkts;
|
packet_num = block_hdr->num_pkts;
|
||||||
if ( packet_num == 0 )
|
if ( packet_num == 0 ) {
|
||||||
{
|
|
||||||
NextBlock();
|
NextBlock();
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
packet = (struct tpacket3_hdr *)
|
packet = (struct tpacket3_hdr*)((uint8_t*)blocks[block_num] + block_hdr->offset_to_first_pkt);
|
||||||
((uint8_t *) blocks[block_num] + block_hdr->offset_to_first_pkt);
|
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
// Continue with block
|
// Continue with block
|
||||||
packet = (struct tpacket3_hdr *)
|
packet = (struct tpacket3_hdr*)((uint8_t*)packet + packet->tp_next_offset);
|
||||||
((uint8_t *) packet + packet->tp_next_offset);
|
|
||||||
|
|
||||||
*hdr = packet;
|
*hdr = packet;
|
||||||
packet_num--;
|
packet_num--;
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
void RX_Ring::ReleasePacket()
|
void RX_Ring::ReleasePacket() {
|
||||||
{
|
|
||||||
if ( packet_num == 0 )
|
if ( packet_num == 0 )
|
||||||
NextBlock();
|
NextBlock();
|
||||||
}
|
}
|
||||||
|
|
||||||
void RX_Ring::InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec)
|
void RX_Ring::InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec) {
|
||||||
{
|
|
||||||
memset(&layout, 0, sizeof(layout));
|
memset(&layout, 0, sizeof(layout));
|
||||||
layout.tp_block_size = blocksize;
|
layout.tp_block_size = blocksize;
|
||||||
layout.tp_frame_size = TPACKET_ALIGNMENT << 7; // Seems to be irrelevant for V3
|
layout.tp_frame_size = TPACKET_ALIGNMENT << 7; // Seems to be irrelevant for V3
|
||||||
|
@ -102,8 +91,7 @@ void RX_Ring::InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec
|
||||||
layout.tp_retire_blk_tov = blocktimeout_msec;
|
layout.tp_retire_blk_tov = blocktimeout_msec;
|
||||||
}
|
}
|
||||||
|
|
||||||
void RX_Ring::NextBlock()
|
void RX_Ring::NextBlock() {
|
||||||
{
|
|
||||||
struct tpacket_hdr_v1* block_hdr = &(blocks[block_num]->hdr.bh1);
|
struct tpacket_hdr_v1* block_hdr = &(blocks[block_num]->hdr.bh1);
|
||||||
|
|
||||||
block_hdr->block_status = TP_STATUS_KERNEL;
|
block_hdr->block_status = TP_STATUS_KERNEL;
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue