af_packet: pre-commit fixes

This commit is contained in:
Tim Wojtulewicz 2025-08-17 21:33:37 -07:00
parent 709f876947
commit 62e27ee6f7
8 changed files with 362 additions and 413 deletions

View file

@ -1,4 +1,3 @@
cmake_minimum_required(VERSION 3.15 FATAL_ERROR)
project(ZeekPluginAF_Packet)

View file

@ -91,7 +91,7 @@ To use the AF_Packet plugin with `zeekctl`, the `custom` load balance method can
af_packet_fanout_mode=AF_Packet::FANOUT_HASH
af_packet_buffer_size=128*1024*1024
If all interfaces using `lb_method=custom` should be configured for AF_Packet, the prefix can be globally definied by adding the following line to `zeekctl.conf`:
If all interfaces using `lb_method=custom` should be configured for AF_Packet, the prefix can be globally defined by adding the following line to `zeekctl.conf`:
lb_custom.InterfacePrefix=af_packet::

View file

@ -1,3 +1,5 @@
// See the file "COPYING" in the main distribution directory for copyright.
#include "zeek/zeek-config.h"
// Starting with Zeek 6.0, zeek-config.h does not provide the
@ -9,7 +11,6 @@
#include "AF_Packet.h"
#include "RX_Ring.h"
#include "af_packet.bif.h"
// CentOS 7 if_packet.h does not yet have this define, provide it
@ -20,13 +21,9 @@
using namespace zeek::iosource::pktsrc;
AF_PacketSource::~AF_PacketSource()
{
Close();
}
AF_PacketSource::~AF_PacketSource() { Close(); }
AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live)
{
AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live) {
if ( ! is_live )
Error("AF_Packet source does not support offline input");
@ -40,8 +37,7 @@ AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live)
checksum_mode = zeek::BifConst::AF_Packet::checksum_validation_mode->AsEnum();
}
void AF_PacketSource::Open()
{
void AF_PacketSource::Open() {
uint64_t buffer_size = zeek::BifConst::AF_Packet::buffer_size;
uint64_t block_size = zeek::BifConst::AF_Packet::block_size;
int block_timeout_msec = static_cast<int>(zeek::BifConst::AF_Packet::block_timeout * 1000.0);
@ -53,24 +49,21 @@ void AF_PacketSource::Open()
socket_fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if ( socket_fd < 0 )
{
if ( socket_fd < 0 ) {
Error(errno ? strerror(errno) : "unable to create socket");
return;
}
auto info = GetInterfaceInfo(props.path);
if ( ! info.Valid() )
{
if ( ! info.Valid() ) {
Error(errno ? strerror(errno) : "unable to get interface information");
close(socket_fd);
socket_fd = -1;
return;
}
if ( ! info.IsUp() )
{
if ( ! info.IsUp() ) {
Error("interface is down");
close(socket_fd);
socket_fd = -1;
@ -87,29 +80,25 @@ void AF_PacketSource::Open()
}
// Setup interface
if ( ! BindInterface(info) )
{
if ( ! BindInterface(info) ) {
Error(errno ? strerror(errno) : "unable to bind to interface");
close(socket_fd);
return;
}
if ( ! EnablePromiscMode(info) )
{
Error(errno ? strerror(errno) : "unable enter promiscious mode");
if ( ! EnablePromiscMode(info) ) {
Error(errno ? strerror(errno) : "unable enter promiscuous mode");
close(socket_fd);
return;
}
if ( ! ConfigureFanoutGroup(enable_fanout, enable_defrag) )
{
if ( ! ConfigureFanoutGroup(enable_fanout, enable_defrag) ) {
Error(errno ? strerror(errno) : "failed to join fanout group");
close(socket_fd);
return;
}
if ( ! ConfigureHWTimestamping(enable_hw_timestamping) )
{
if ( ! ConfigureHWTimestamping(enable_hw_timestamping) ) {
Error(errno ? strerror(errno) : "failed to configure hardware timestamping");
close(socket_fd);
return;
@ -126,8 +115,7 @@ void AF_PacketSource::Open()
Opened(props);
}
AF_PacketSource::InterfaceInfo AF_PacketSource::GetInterfaceInfo(const std::string& path)
{
AF_PacketSource::InterfaceInfo AF_PacketSource::GetInterfaceInfo(const std::string& path) {
AF_PacketSource::InterfaceInfo info;
struct ifreq ifr;
int ret;
@ -150,8 +138,7 @@ AF_PacketSource::InterfaceInfo AF_PacketSource::GetInterfaceInfo(const std::stri
return info;
}
bool AF_PacketSource::BindInterface(const AF_PacketSource::InterfaceInfo& info)
{
bool AF_PacketSource::BindInterface(const AF_PacketSource::InterfaceInfo& info) {
struct sockaddr_ll saddr_ll;
int ret;
@ -164,8 +151,7 @@ bool AF_PacketSource::BindInterface(const AF_PacketSource::InterfaceInfo& info)
return (ret >= 0);
}
bool AF_PacketSource::EnablePromiscMode(const AF_PacketSource::InterfaceInfo& info)
{
bool AF_PacketSource::EnablePromiscMode(const AF_PacketSource::InterfaceInfo& info) {
struct packet_mreq mreq;
int ret;
@ -177,18 +163,15 @@ bool AF_PacketSource::EnablePromiscMode(const AF_PacketSource::InterfaceInfo& in
return (ret >= 0);
}
bool AF_PacketSource::ConfigureFanoutGroup(bool enabled, bool defrag)
{
if ( enabled )
{
bool AF_PacketSource::ConfigureFanoutGroup(bool enabled, bool defrag) {
if ( enabled ) {
uint32_t fanout_arg, fanout_id;
int ret;
fanout_id = zeek::BifConst::AF_Packet::fanout_id;
fanout_arg = ((fanout_id & 0xffff) | (GetFanoutMode(defrag) << 16));
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_FANOUT,
&fanout_arg, sizeof(fanout_arg));
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_FANOUT, &fanout_arg, sizeof(fanout_arg));
if ( ret < 0 )
return false;
@ -196,10 +179,8 @@ bool AF_PacketSource::ConfigureFanoutGroup(bool enabled, bool defrag)
return true;
}
bool AF_PacketSource::ConfigureHWTimestamping(bool enabled)
{
if ( enabled )
{
bool AF_PacketSource::ConfigureHWTimestamping(bool enabled) {
if ( enabled ) {
struct ifreq ifr;
struct hwtstamp_config hwts_cfg;
int ret, opt;
@ -216,35 +197,28 @@ bool AF_PacketSource::ConfigureHWTimestamping(bool enabled)
return false;
opt = SOF_TIMESTAMPING_RAW_HARDWARE | SOF_TIMESTAMPING_RX_HARDWARE;
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_TIMESTAMP,
&opt, sizeof(opt));
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_TIMESTAMP, &opt, sizeof(opt));
if ( ret < 0 )
return false;
}
return true;
}
uint32_t AF_PacketSource::GetFanoutMode(bool defrag)
{
uint32_t AF_PacketSource::GetFanoutMode(bool defrag) {
uint32_t fanout_mode;
switch ( zeek::BifConst::AF_Packet::fanout_mode->AsEnum() ) {
case BifEnum::AF_Packet::FANOUT_CPU: fanout_mode = PACKET_FANOUT_CPU;
break;
case BifEnum::AF_Packet::FANOUT_CPU: fanout_mode = PACKET_FANOUT_CPU; break;
#ifdef PACKET_FANOUT_QM
case BifEnum::AF_Packet::FANOUT_QM: fanout_mode = PACKET_FANOUT_QM;
break;
case BifEnum::AF_Packet::FANOUT_QM: fanout_mode = PACKET_FANOUT_QM; break;
#endif
#ifdef PACKET_FANOUT_CBPF
case BifEnum::AF_Packet::FANOUT_CBPF: fanout_mode = PACKET_FANOUT_CBPF;
break;
case BifEnum::AF_Packet::FANOUT_CBPF: fanout_mode = PACKET_FANOUT_CBPF; break;
#endif
#ifdef PACKET_FANOUT_EBPF
case BifEnum::AF_Packet::FANOUT_EBPF: fanout_mode = PACKET_FANOUT_EBPF;
break;
case BifEnum::AF_Packet::FANOUT_EBPF: fanout_mode = PACKET_FANOUT_EBPF; break;
#endif
default: fanout_mode = PACKET_FANOUT_HASH;
break;
default: fanout_mode = PACKET_FANOUT_HASH; break;
}
if ( defrag )
@ -253,8 +227,7 @@ uint32_t AF_PacketSource::GetFanoutMode(bool defrag)
return fanout_mode;
}
void AF_PacketSource::Close()
{
void AF_PacketSource::Close() {
if ( socket_fd < 0 )
return;
@ -267,15 +240,13 @@ void AF_PacketSource::Close()
Closed();
}
bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
{
bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt) {
if ( ! socket_fd )
return false;
struct tpacket3_hdr* packet = 0;
const u_char* data;
while ( true )
{
while ( true ) {
if ( ! rx_ring->GetNextPacket(&packet) )
return false;
@ -285,8 +256,7 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
current_hdr.len = packet->tp_len;
data = (u_char*)packet + packet->tp_mac;
if ( !ApplyBPFFilter(current_filter, &current_hdr, data) )
{
if ( ! ApplyBPFFilter(current_filter, &current_hdr, data) ) {
++num_discarded;
DoneWithPacket();
continue;
@ -298,17 +268,14 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
pkt->vlan = packet->hv1.tp_vlan_tci & 0x0fff;
#if ZEEK_VERSION_NUMBER >= 50100
switch ( checksum_mode )
{
case BifEnum::AF_Packet::CHECKSUM_OFF:
{
switch ( checksum_mode ) {
case BifEnum::AF_Packet::CHECKSUM_OFF: {
// If set to off, just accept whatever checksum in the packet is correct and
// skip checking it here and in Zeek.
pkt->l4_checksummed = true;
break;
}
case BifEnum::AF_Packet::CHECKSUM_KERNEL:
{
case BifEnum::AF_Packet::CHECKSUM_KERNEL: {
// If set to kernel, check whether the kernel thinks the checksum is valid. If it
// does, tell Zeek to skip checking by itself.
if ( ((packet->tp_status & TP_STATUS_CSUM_VALID) != 0) ||
@ -319,8 +286,7 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
break;
}
case BifEnum::AF_Packet::CHECKSUM_ON:
default:
{
default: {
// Let Zeek handle it.
pkt->l4_checksummed = false;
break;
@ -328,8 +294,7 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
}
#endif
if ( current_hdr.len == 0 || current_hdr.caplen == 0 )
{
if ( current_hdr.len == 0 || current_hdr.caplen == 0 ) {
Weird("empty_af_packet_header", pkt);
return false;
}
@ -342,26 +307,19 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
return false;
}
void AF_PacketSource::DoneWithPacket()
{
rx_ring->ReleasePacket();
}
void AF_PacketSource::DoneWithPacket() { rx_ring->ReleasePacket(); }
bool AF_PacketSource::PrecompileFilter(int index, const std::string& filter)
{
bool AF_PacketSource::PrecompileFilter(int index, const std::string& filter) {
return PktSrc::PrecompileBPFFilter(index, filter);
}
bool AF_PacketSource::SetFilter(int index)
{
bool AF_PacketSource::SetFilter(int index) {
current_filter = index;
return true;
}
void AF_PacketSource::Statistics(Stats* s)
{
if ( ! socket_fd )
{
void AF_PacketSource::Statistics(Stats* s) {
if ( ! socket_fd ) {
s->received = s->bytes_received = s->link = s->dropped = 0;
return;
}
@ -371,8 +329,7 @@ void AF_PacketSource::Statistics(Stats* s)
int ret;
ret = getsockopt(socket_fd, SOL_PACKET, PACKET_STATISTICS, &tp_stats, &tp_stats_len);
if ( ret < 0 )
{
if ( ret < 0 ) {
Error(errno ? strerror(errno) : "unable to retrieve statistics");
s->received = s->bytes_received = s->link = s->dropped = 0;
return;
@ -384,7 +341,6 @@ void AF_PacketSource::Statistics(Stats* s)
memcpy(s, &stats, sizeof(Stats));
}
zeek::iosource::PktSrc* AF_PacketSource::InstantiateAF_Packet(const std::string& path, bool is_live)
{
zeek::iosource::PktSrc* AF_PacketSource::InstantiateAF_Packet(const std::string& path, bool is_live) {
return new AF_PacketSource(path, is_live);
}

View file

@ -3,22 +3,21 @@
#pragma once
extern "C" {
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <errno.h> // errorno
#include <unistd.h> // close()
#include <net/ethernet.h> // ETH_P_ALL
#include <linux/if.h> // ifreq
#include <linux/if_packet.h> // AF_PACKET, etc.
#include <linux/sockios.h> // SIOCSHWTSTAMP
#include <linux/net_tstamp.h> // hwtstamp_config
#include <linux/sockios.h> // SIOCSHWTSTAMP
#include <net/ethernet.h> // ETH_P_ALL
#include <pcap.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <unistd.h> // close()
}
#include "zeek/iosource/PktSrc.h"
#include "RX_Ring.h"
namespace af_packet::iosource::pktsrc {
@ -81,4 +80,4 @@ private:
uint32_t GetFanoutMode(bool defrag);
};
}
} // namespace zeek::iosource::pktsrc

View file

@ -1,15 +1,21 @@
// See the file "COPYING" in the main distribution directory for copyright.
#include "Plugin.h"
#include "AF_Packet.h"
#include "zeek/iosource/Component.h"
namespace af_packet::plugin::Zeek_AF_Packet { Plugin plugin; }
#include "AF_Packet.h"
namespace plugin::Zeek_AF_Packet {
Plugin plugin;
}
using namespace af_packet::plugin::Zeek_AF_Packet;
zeek::plugin::Configuration Plugin::Configure()
{
AddComponent(new ::zeek::iosource::PktSrcComponent("AF_PacketReader", "af_packet", ::zeek::iosource::PktSrcComponent::LIVE, ::af_packet::iosource::pktsrc::AF_PacketSource::InstantiateAF_Packet));
zeek::plugin::Configuration Plugin::Configure() {
AddComponent(
new ::zeek::iosource::PktSrcComponent("AF_PacketReader", "af_packet", ::zeek::iosource::PktSrcComponent::LIVE,
::zeek::iosource::pktsrc::AF_PacketSource::InstantiateAF_Packet));
zeek::plugin::Configuration config;
config.name = "Zeek::AF_Packet";

View file

@ -1,11 +1,12 @@
// See the file "COPYING" in the main distribution directory for copyright.
#pragma once
#include <zeek/plugin/Plugin.h>
namespace af_packet::plugin::Zeek_AF_Packet {
class Plugin : public zeek::plugin::Plugin
{
class Plugin : public zeek::plugin::Plugin {
protected:
// Overridden from zeek::plugin::Plugin.
zeek::plugin::Configuration Configure() override;
@ -13,4 +14,4 @@ protected:
extern Plugin plugin;
}
} // namespace plugin::Zeek_AF_Packet

View file

@ -1,3 +1,4 @@
// See the file "COPYING" in the main distribution directory for copyright.
#include "RX_Ring.h"
@ -6,13 +7,12 @@
extern "C" {
#include <linux/if_packet.h> // AF_PACKET, etc.
#include <sys/socket.h> // socketopt consts
#include <sys/mman.h> // mmap
#include <sys/socket.h> // socketopt consts
#include <unistd.h> // sysconf
}
RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec)
{
RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec) {
int ret, ver = TPACKET_VERSION;
if ( sock < 0 )
@ -24,15 +24,13 @@ RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_ms
throw RX_RingException("unable to set TPacket version");
InitLayout(bufsize, blocksize, blocktimeout_msec);
ret = setsockopt(sock, SOL_PACKET, PACKET_RX_RING, (uint8_t *) &layout,
sizeof(layout));
ret = setsockopt(sock, SOL_PACKET, PACKET_RX_RING, (uint8_t*)&layout, sizeof(layout));
if ( ret )
throw RX_RingException("unable to set ring layout");
// Map memory
size = layout.tp_block_size * layout.tp_block_nr;
ring = (uint8_t *) mmap(NULL, size, PROT_READ | PROT_WRITE,
MAP_SHARED, sock, 0);
ring = (uint8_t*)mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, sock, 0);
if ( ring == MAP_FAILED )
throw RX_RingException("unable to map ring memory");
@ -42,12 +40,10 @@ RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_ms
// Init block mapping
blocks = new tpacket_block_desc*[layout.tp_block_nr];
for ( unsigned int i = 0; i < layout.tp_block_nr; i++ )
blocks[i] = (struct tpacket_block_desc *)(ring +
i * layout.tp_block_size);
blocks[i] = (struct tpacket_block_desc*)(ring + i * layout.tp_block_size);
}
RX_Ring::~RX_Ring()
{
RX_Ring::~RX_Ring() {
ReleasePacket();
delete[] blocks;
@ -57,43 +53,36 @@ RX_Ring::~RX_Ring()
size = 0;
}
bool RX_Ring::GetNextPacket(tpacket3_hdr** hdr)
{
bool RX_Ring::GetNextPacket(tpacket3_hdr** hdr) {
struct tpacket_hdr_v1* block_hdr = &(blocks[block_num]->hdr.bh1);
if ( (block_hdr->block_status & TP_STATUS_USER) == 0 )
return false;
if ( packet == NULL )
{
if ( packet == NULL ) {
// New block
packet_num = block_hdr->num_pkts;
if ( packet_num == 0 )
{
if ( packet_num == 0 ) {
NextBlock();
return false;
}
packet = (struct tpacket3_hdr *)
((uint8_t *) blocks[block_num] + block_hdr->offset_to_first_pkt);
packet = (struct tpacket3_hdr*)((uint8_t*)blocks[block_num] + block_hdr->offset_to_first_pkt);
}
else
// Continue with block
packet = (struct tpacket3_hdr *)
((uint8_t *) packet + packet->tp_next_offset);
packet = (struct tpacket3_hdr*)((uint8_t*)packet + packet->tp_next_offset);
*hdr = packet;
packet_num--;
return true;
}
void RX_Ring::ReleasePacket()
{
void RX_Ring::ReleasePacket() {
if ( packet_num == 0 )
NextBlock();
}
void RX_Ring::InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec)
{
void RX_Ring::InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec) {
memset(&layout, 0, sizeof(layout));
layout.tp_block_size = blocksize;
layout.tp_frame_size = TPACKET_ALIGNMENT << 7; // Seems to be irrelevant for V3
@ -102,8 +91,7 @@ void RX_Ring::InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec
layout.tp_retire_blk_tov = blocktimeout_msec;
}
void RX_Ring::NextBlock()
{
void RX_Ring::NextBlock() {
struct tpacket_hdr_v1* block_hdr = &(blocks[block_num]->hdr.bh1);
block_hdr->block_status = TP_STATUS_KERNEL;