mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
af_packet: pre-commit fixes
This commit is contained in:
Tim Wojtulewicz
parent
709f876947
commit
62e27ee6f7
8 changed files with 362 additions and 413 deletions
|
|
@ -1,4 +1,3 @@
|
|||
|
||||
cmake_minimum_required(VERSION 3.15 FATAL_ERROR)
|
||||
|
||||
project(ZeekPluginAF_Packet)
|
||||
|
|
|
|||
|
|
@ -91,7 +91,7 @@ To use the AF_Packet plugin with `zeekctl`, the `custom` load balance method can
|
|||
af_packet_fanout_mode=AF_Packet::FANOUT_HASH
|
||||
af_packet_buffer_size=128*1024*1024
|
||||
|
||||
If all interfaces using `lb_method=custom` should be configured for AF_Packet, the prefix can be globally definied by adding the following line to `zeekctl.conf`:
|
||||
If all interfaces using `lb_method=custom` should be configured for AF_Packet, the prefix can be globally defined by adding the following line to `zeekctl.conf`:
|
||||
|
||||
lb_custom.InterfacePrefix=af_packet::
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
// See the file "COPYING" in the main distribution directory for copyright.
|
||||
|
||||
#include "zeek/zeek-config.h"
|
||||
|
||||
// Starting with Zeek 6.0, zeek-config.h does not provide the
|
||||
|
|
@ -9,7 +11,6 @@
|
|||
|
||||
#include "AF_Packet.h"
|
||||
#include "RX_Ring.h"
|
||||
|
||||
#include "af_packet.bif.h"
|
||||
|
||||
// CentOS 7 if_packet.h does not yet have this define, provide it
|
||||
|
|
@ -20,189 +21,169 @@
|
|||
|
||||
using namespace zeek::iosource::pktsrc;
|
||||
|
||||
AF_PacketSource::~AF_PacketSource()
|
||||
{
|
||||
Close();
|
||||
}
|
||||
AF_PacketSource::~AF_PacketSource() { Close(); }
|
||||
|
||||
AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live)
|
||||
{
|
||||
AF_PacketSource::AF_PacketSource(const std::string& path, bool is_live) {
|
||||
if ( ! is_live )
|
||||
Error("AF_Packet source does not support offline input");
|
||||
|
||||
current_filter = -1;
|
||||
props.path = path;
|
||||
props.is_live = is_live;
|
||||
current_filter = -1;
|
||||
props.path = path;
|
||||
props.is_live = is_live;
|
||||
|
||||
socket_fd = -1;
|
||||
rx_ring = nullptr;
|
||||
socket_fd = -1;
|
||||
rx_ring = nullptr;
|
||||
|
||||
checksum_mode = zeek::BifConst::AF_Packet::checksum_validation_mode->AsEnum();
|
||||
}
|
||||
checksum_mode = zeek::BifConst::AF_Packet::checksum_validation_mode->AsEnum();
|
||||
}
|
||||
|
||||
void AF_PacketSource::Open()
|
||||
{
|
||||
uint64_t buffer_size = zeek::BifConst::AF_Packet::buffer_size;
|
||||
uint64_t block_size = zeek::BifConst::AF_Packet::block_size;
|
||||
int block_timeout_msec = static_cast<int>(zeek::BifConst::AF_Packet::block_timeout * 1000.0);
|
||||
int link_type = zeek::BifConst::AF_Packet::link_type;
|
||||
void AF_PacketSource::Open() {
|
||||
uint64_t buffer_size = zeek::BifConst::AF_Packet::buffer_size;
|
||||
uint64_t block_size = zeek::BifConst::AF_Packet::block_size;
|
||||
int block_timeout_msec = static_cast<int>(zeek::BifConst::AF_Packet::block_timeout * 1000.0);
|
||||
int link_type = zeek::BifConst::AF_Packet::link_type;
|
||||
|
||||
bool enable_hw_timestamping = zeek::BifConst::AF_Packet::enable_hw_timestamping;
|
||||
bool enable_fanout = zeek::BifConst::AF_Packet::enable_fanout;
|
||||
bool enable_defrag = zeek::BifConst::AF_Packet::enable_defrag;
|
||||
bool enable_hw_timestamping = zeek::BifConst::AF_Packet::enable_hw_timestamping;
|
||||
bool enable_fanout = zeek::BifConst::AF_Packet::enable_fanout;
|
||||
bool enable_defrag = zeek::BifConst::AF_Packet::enable_defrag;
|
||||
|
||||
socket_fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
|
||||
|
||||
if ( socket_fd < 0 )
|
||||
{
|
||||
if ( socket_fd < 0 ) {
|
||||
Error(errno ? strerror(errno) : "unable to create socket");
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
auto info = GetInterfaceInfo(props.path);
|
||||
auto info = GetInterfaceInfo(props.path);
|
||||
|
||||
if ( ! info.Valid() )
|
||||
{
|
||||
Error(errno ? strerror(errno) : "unable to get interface information");
|
||||
close(socket_fd);
|
||||
socket_fd = -1;
|
||||
return;
|
||||
}
|
||||
if ( ! info.Valid() ) {
|
||||
Error(errno ? strerror(errno) : "unable to get interface information");
|
||||
close(socket_fd);
|
||||
socket_fd = -1;
|
||||
return;
|
||||
}
|
||||
|
||||
if ( ! info.IsUp() )
|
||||
{
|
||||
Error("interface is down");
|
||||
close(socket_fd);
|
||||
socket_fd = -1;
|
||||
return;
|
||||
}
|
||||
if ( ! info.IsUp() ) {
|
||||
Error("interface is down");
|
||||
close(socket_fd);
|
||||
socket_fd = -1;
|
||||
return;
|
||||
}
|
||||
|
||||
// Create RX-ring
|
||||
try {
|
||||
rx_ring = new RX_Ring(socket_fd, buffer_size, block_size, block_timeout_msec);
|
||||
} catch (RX_RingException& e) {
|
||||
Error(errno ? strerror(errno) : "unable to create RX-ring");
|
||||
close(socket_fd);
|
||||
return;
|
||||
}
|
||||
// Create RX-ring
|
||||
try {
|
||||
rx_ring = new RX_Ring(socket_fd, buffer_size, block_size, block_timeout_msec);
|
||||
} catch ( RX_RingException& e ) {
|
||||
Error(errno ? strerror(errno) : "unable to create RX-ring");
|
||||
close(socket_fd);
|
||||
return;
|
||||
}
|
||||
|
||||
// Setup interface
|
||||
if ( ! BindInterface(info) )
|
||||
{
|
||||
Error(errno ? strerror(errno) : "unable to bind to interface");
|
||||
close(socket_fd);
|
||||
return;
|
||||
}
|
||||
// Setup interface
|
||||
if ( ! BindInterface(info) ) {
|
||||
Error(errno ? strerror(errno) : "unable to bind to interface");
|
||||
close(socket_fd);
|
||||
return;
|
||||
}
|
||||
|
||||
if ( ! EnablePromiscMode(info) )
|
||||
{
|
||||
Error(errno ? strerror(errno) : "unable enter promiscious mode");
|
||||
close(socket_fd);
|
||||
return;
|
||||
}
|
||||
if ( ! EnablePromiscMode(info) ) {
|
||||
Error(errno ? strerror(errno) : "unable enter promiscuous mode");
|
||||
close(socket_fd);
|
||||
return;
|
||||
}
|
||||
|
||||
if ( ! ConfigureFanoutGroup(enable_fanout, enable_defrag) )
|
||||
{
|
||||
Error(errno ? strerror(errno) : "failed to join fanout group");
|
||||
close(socket_fd);
|
||||
return;
|
||||
}
|
||||
if ( ! ConfigureFanoutGroup(enable_fanout, enable_defrag) ) {
|
||||
Error(errno ? strerror(errno) : "failed to join fanout group");
|
||||
close(socket_fd);
|
||||
return;
|
||||
}
|
||||
|
||||
if ( ! ConfigureHWTimestamping(enable_hw_timestamping) )
|
||||
{
|
||||
if ( ! ConfigureHWTimestamping(enable_hw_timestamping) ) {
|
||||
Error(errno ? strerror(errno) : "failed to configure hardware timestamping");
|
||||
close(socket_fd);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
props.netmask = NETMASK_UNKNOWN;
|
||||
props.selectable_fd = socket_fd;
|
||||
props.is_live = true;
|
||||
props.link_type = link_type;
|
||||
props.netmask = NETMASK_UNKNOWN;
|
||||
props.selectable_fd = socket_fd;
|
||||
props.is_live = true;
|
||||
props.link_type = link_type;
|
||||
|
||||
stats.received = stats.dropped = stats.link = stats.bytes_received = 0;
|
||||
num_discarded = 0;
|
||||
|
||||
Opened(props);
|
||||
}
|
||||
}
|
||||
|
||||
AF_PacketSource::InterfaceInfo AF_PacketSource::GetInterfaceInfo(const std::string& path)
|
||||
{
|
||||
AF_PacketSource::InterfaceInfo info;
|
||||
struct ifreq ifr;
|
||||
int ret;
|
||||
AF_PacketSource::InterfaceInfo AF_PacketSource::GetInterfaceInfo(const std::string& path) {
|
||||
AF_PacketSource::InterfaceInfo info;
|
||||
struct ifreq ifr;
|
||||
int ret;
|
||||
|
||||
memset(&ifr, 0, sizeof(ifr));
|
||||
snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s", path.c_str());
|
||||
memset(&ifr, 0, sizeof(ifr));
|
||||
snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s", path.c_str());
|
||||
|
||||
ret = ioctl(socket_fd, SIOCGIFFLAGS, &ifr);
|
||||
if ( ret < 0 )
|
||||
return info;
|
||||
ret = ioctl(socket_fd, SIOCGIFFLAGS, &ifr);
|
||||
if ( ret < 0 )
|
||||
return info;
|
||||
|
||||
info.flags = ifr.ifr_flags;
|
||||
info.flags = ifr.ifr_flags;
|
||||
|
||||
ret = ioctl(socket_fd, SIOCGIFINDEX, &ifr);
|
||||
if ( ret < 0 )
|
||||
return info;
|
||||
ret = ioctl(socket_fd, SIOCGIFINDEX, &ifr);
|
||||
if ( ret < 0 )
|
||||
return info;
|
||||
|
||||
info.index = ifr.ifr_ifindex;
|
||||
info.index = ifr.ifr_ifindex;
|
||||
|
||||
return info;
|
||||
}
|
||||
return info;
|
||||
}
|
||||
|
||||
bool AF_PacketSource::BindInterface(const AF_PacketSource::InterfaceInfo& info)
|
||||
{
|
||||
struct sockaddr_ll saddr_ll;
|
||||
int ret;
|
||||
bool AF_PacketSource::BindInterface(const AF_PacketSource::InterfaceInfo& info) {
|
||||
struct sockaddr_ll saddr_ll;
|
||||
int ret;
|
||||
|
||||
memset(&saddr_ll, 0, sizeof(saddr_ll));
|
||||
saddr_ll.sll_family = AF_PACKET;
|
||||
saddr_ll.sll_protocol = htons(ETH_P_ALL);
|
||||
saddr_ll.sll_ifindex = info.index;
|
||||
memset(&saddr_ll, 0, sizeof(saddr_ll));
|
||||
saddr_ll.sll_family = AF_PACKET;
|
||||
saddr_ll.sll_protocol = htons(ETH_P_ALL);
|
||||
saddr_ll.sll_ifindex = info.index;
|
||||
|
||||
ret = bind(socket_fd, (struct sockaddr *) &saddr_ll, sizeof(saddr_ll));
|
||||
ret = bind(socket_fd, (struct sockaddr*)&saddr_ll, sizeof(saddr_ll));
|
||||
return (ret >= 0);
|
||||
}
|
||||
}
|
||||
|
||||
bool AF_PacketSource::EnablePromiscMode(const AF_PacketSource::InterfaceInfo& info)
|
||||
{
|
||||
struct packet_mreq mreq;
|
||||
int ret;
|
||||
bool AF_PacketSource::EnablePromiscMode(const AF_PacketSource::InterfaceInfo& info) {
|
||||
struct packet_mreq mreq;
|
||||
int ret;
|
||||
|
||||
memset(&mreq, 0, sizeof(mreq));
|
||||
mreq.mr_ifindex = info.index;
|
||||
mreq.mr_type = PACKET_MR_PROMISC;
|
||||
memset(&mreq, 0, sizeof(mreq));
|
||||
mreq.mr_ifindex = info.index;
|
||||
mreq.mr_type = PACKET_MR_PROMISC;
|
||||
|
||||
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mreq, sizeof(mreq));
|
||||
return (ret >= 0);
|
||||
}
|
||||
}
|
||||
|
||||
bool AF_PacketSource::ConfigureFanoutGroup(bool enabled, bool defrag)
|
||||
{
|
||||
if ( enabled )
|
||||
{
|
||||
uint32_t fanout_arg, fanout_id;
|
||||
int ret;
|
||||
bool AF_PacketSource::ConfigureFanoutGroup(bool enabled, bool defrag) {
|
||||
if ( enabled ) {
|
||||
uint32_t fanout_arg, fanout_id;
|
||||
int ret;
|
||||
|
||||
fanout_id = zeek::BifConst::AF_Packet::fanout_id;
|
||||
fanout_arg = ((fanout_id & 0xffff) | (GetFanoutMode(defrag) << 16));
|
||||
|
||||
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_FANOUT,
|
||||
&fanout_arg, sizeof(fanout_arg));
|
||||
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_FANOUT, &fanout_arg, sizeof(fanout_arg));
|
||||
|
||||
if ( ret < 0 )
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
bool AF_PacketSource::ConfigureHWTimestamping(bool enabled)
|
||||
{
|
||||
if ( enabled )
|
||||
{
|
||||
struct ifreq ifr;
|
||||
struct hwtstamp_config hwts_cfg;
|
||||
int ret, opt;
|
||||
bool AF_PacketSource::ConfigureHWTimestamping(bool enabled) {
|
||||
if ( enabled ) {
|
||||
struct ifreq ifr;
|
||||
struct hwtstamp_config hwts_cfg;
|
||||
int ret, opt;
|
||||
|
||||
memset(&hwts_cfg, 0, sizeof(hwts_cfg));
|
||||
hwts_cfg.tx_type = HWTSTAMP_TX_OFF;
|
||||
|
|
@ -216,175 +197,150 @@ bool AF_PacketSource::ConfigureHWTimestamping(bool enabled)
|
|||
return false;
|
||||
|
||||
opt = SOF_TIMESTAMPING_RAW_HARDWARE | SOF_TIMESTAMPING_RX_HARDWARE;
|
||||
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_TIMESTAMP,
|
||||
&opt, sizeof(opt));
|
||||
if( ret < 0 )
|
||||
ret = setsockopt(socket_fd, SOL_PACKET, PACKET_TIMESTAMP, &opt, sizeof(opt));
|
||||
if ( ret < 0 )
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
uint32_t AF_PacketSource::GetFanoutMode(bool defrag)
|
||||
{
|
||||
uint32_t fanout_mode;
|
||||
uint32_t AF_PacketSource::GetFanoutMode(bool defrag) {
|
||||
uint32_t fanout_mode;
|
||||
|
||||
switch ( zeek::BifConst::AF_Packet::fanout_mode->AsEnum() ) {
|
||||
case BifEnum::AF_Packet::FANOUT_CPU: fanout_mode = PACKET_FANOUT_CPU;
|
||||
break;
|
||||
#ifdef PACKET_FANOUT_QM
|
||||
case BifEnum::AF_Packet::FANOUT_QM: fanout_mode = PACKET_FANOUT_QM;
|
||||
break;
|
||||
#endif
|
||||
#ifdef PACKET_FANOUT_CBPF
|
||||
case BifEnum::AF_Packet::FANOUT_CBPF: fanout_mode = PACKET_FANOUT_CBPF;
|
||||
break;
|
||||
#endif
|
||||
#ifdef PACKET_FANOUT_EBPF
|
||||
case BifEnum::AF_Packet::FANOUT_EBPF: fanout_mode = PACKET_FANOUT_EBPF;
|
||||
break;
|
||||
#endif
|
||||
default: fanout_mode = PACKET_FANOUT_HASH;
|
||||
break;
|
||||
case BifEnum::AF_Packet::FANOUT_CPU: fanout_mode = PACKET_FANOUT_CPU; break;
|
||||
#ifdef PACKET_FANOUT_QM
|
||||
case BifEnum::AF_Packet::FANOUT_QM: fanout_mode = PACKET_FANOUT_QM; break;
|
||||
#endif
|
||||
#ifdef PACKET_FANOUT_CBPF
|
||||
case BifEnum::AF_Packet::FANOUT_CBPF: fanout_mode = PACKET_FANOUT_CBPF; break;
|
||||
#endif
|
||||
#ifdef PACKET_FANOUT_EBPF
|
||||
case BifEnum::AF_Packet::FANOUT_EBPF: fanout_mode = PACKET_FANOUT_EBPF; break;
|
||||
#endif
|
||||
default: fanout_mode = PACKET_FANOUT_HASH; break;
|
||||
}
|
||||
|
||||
if ( defrag )
|
||||
fanout_mode |= PACKET_FANOUT_FLAG_DEFRAG;
|
||||
|
||||
return fanout_mode;
|
||||
}
|
||||
}
|
||||
|
||||
void AF_PacketSource::Close()
|
||||
{
|
||||
if ( socket_fd < 0 )
|
||||
return;
|
||||
void AF_PacketSource::Close() {
|
||||
if ( socket_fd < 0 )
|
||||
return;
|
||||
|
||||
delete rx_ring;
|
||||
rx_ring = nullptr;
|
||||
delete rx_ring;
|
||||
rx_ring = nullptr;
|
||||
|
||||
close(socket_fd);
|
||||
socket_fd = -1;
|
||||
close(socket_fd);
|
||||
socket_fd = -1;
|
||||
|
||||
Closed();
|
||||
}
|
||||
}
|
||||
|
||||
bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
|
||||
{
|
||||
bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt) {
|
||||
if ( ! socket_fd )
|
||||
return false;
|
||||
|
||||
struct tpacket3_hdr *packet = 0;
|
||||
const u_char *data;
|
||||
while ( true )
|
||||
{
|
||||
if ( ! rx_ring->GetNextPacket(&packet) )
|
||||
return false;
|
||||
struct tpacket3_hdr* packet = 0;
|
||||
const u_char* data;
|
||||
while ( true ) {
|
||||
if ( ! rx_ring->GetNextPacket(&packet) )
|
||||
return false;
|
||||
|
||||
current_hdr.ts.tv_sec = packet->tp_sec;
|
||||
current_hdr.ts.tv_usec = packet->tp_nsec / 1000;
|
||||
current_hdr.caplen = packet->tp_snaplen;
|
||||
current_hdr.len = packet->tp_len;
|
||||
data = (u_char *) packet + packet->tp_mac;
|
||||
data = (u_char*)packet + packet->tp_mac;
|
||||
|
||||
if ( !ApplyBPFFilter(current_filter, ¤t_hdr, data) )
|
||||
{
|
||||
if ( ! ApplyBPFFilter(current_filter, ¤t_hdr, data) ) {
|
||||
++num_discarded;
|
||||
DoneWithPacket();
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
pkt->Init(props.link_type, ¤t_hdr.ts, current_hdr.caplen, current_hdr.len, data);
|
||||
|
||||
if ( packet->tp_status & TP_STATUS_VLAN_VALID )
|
||||
pkt->vlan = packet->hv1.tp_vlan_tci & 0x0fff;
|
||||
if ( packet->tp_status & TP_STATUS_VLAN_VALID )
|
||||
pkt->vlan = packet->hv1.tp_vlan_tci & 0x0fff;
|
||||
|
||||
#if ZEEK_VERSION_NUMBER >= 50100
|
||||
switch ( checksum_mode )
|
||||
{
|
||||
case BifEnum::AF_Packet::CHECKSUM_OFF:
|
||||
{
|
||||
// If set to off, just accept whatever checksum in the packet is correct and
|
||||
// skip checking it here and in Zeek.
|
||||
pkt->l4_checksummed = true;
|
||||
break;
|
||||
}
|
||||
case BifEnum::AF_Packet::CHECKSUM_KERNEL:
|
||||
{
|
||||
// If set to kernel, check whether the kernel thinks the checksum is valid. If it
|
||||
// does, tell Zeek to skip checking by itself.
|
||||
if ( ( (packet->tp_status & TP_STATUS_CSUM_VALID) != 0 ) ||
|
||||
( (packet->tp_status & TP_STATUS_CSUMNOTREADY) != 0 ) )
|
||||
pkt->l4_checksummed = true;
|
||||
else
|
||||
pkt->l4_checksummed = false;
|
||||
break;
|
||||
}
|
||||
case BifEnum::AF_Packet::CHECKSUM_ON:
|
||||
default:
|
||||
{
|
||||
// Let Zeek handle it.
|
||||
pkt->l4_checksummed = false;
|
||||
break;
|
||||
}
|
||||
}
|
||||
switch ( checksum_mode ) {
|
||||
case BifEnum::AF_Packet::CHECKSUM_OFF: {
|
||||
// If set to off, just accept whatever checksum in the packet is correct and
|
||||
// skip checking it here and in Zeek.
|
||||
pkt->l4_checksummed = true;
|
||||
break;
|
||||
}
|
||||
case BifEnum::AF_Packet::CHECKSUM_KERNEL: {
|
||||
// If set to kernel, check whether the kernel thinks the checksum is valid. If it
|
||||
// does, tell Zeek to skip checking by itself.
|
||||
if ( ((packet->tp_status & TP_STATUS_CSUM_VALID) != 0) ||
|
||||
((packet->tp_status & TP_STATUS_CSUMNOTREADY) != 0) )
|
||||
pkt->l4_checksummed = true;
|
||||
else
|
||||
pkt->l4_checksummed = false;
|
||||
break;
|
||||
}
|
||||
case BifEnum::AF_Packet::CHECKSUM_ON:
|
||||
default: {
|
||||
// Let Zeek handle it.
|
||||
pkt->l4_checksummed = false;
|
||||
break;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
if ( current_hdr.len == 0 || current_hdr.caplen == 0 )
|
||||
{
|
||||
Weird("empty_af_packet_header", pkt);
|
||||
return false;
|
||||
}
|
||||
if ( current_hdr.len == 0 || current_hdr.caplen == 0 ) {
|
||||
Weird("empty_af_packet_header", pkt);
|
||||
return false;
|
||||
}
|
||||
|
||||
stats.received++;
|
||||
stats.bytes_received += current_hdr.len;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
void AF_PacketSource::DoneWithPacket()
|
||||
{
|
||||
rx_ring->ReleasePacket();
|
||||
}
|
||||
void AF_PacketSource::DoneWithPacket() { rx_ring->ReleasePacket(); }
|
||||
|
||||
bool AF_PacketSource::PrecompileFilter(int index, const std::string& filter)
|
||||
{
|
||||
bool AF_PacketSource::PrecompileFilter(int index, const std::string& filter) {
|
||||
return PktSrc::PrecompileBPFFilter(index, filter);
|
||||
}
|
||||
}
|
||||
|
||||
bool AF_PacketSource::SetFilter(int index)
|
||||
{
|
||||
bool AF_PacketSource::SetFilter(int index) {
|
||||
current_filter = index;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
void AF_PacketSource::Statistics(Stats* s)
|
||||
{
|
||||
if ( ! socket_fd )
|
||||
{
|
||||
void AF_PacketSource::Statistics(Stats* s) {
|
||||
if ( ! socket_fd ) {
|
||||
s->received = s->bytes_received = s->link = s->dropped = 0;
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
struct tpacket_stats_v3 tp_stats;
|
||||
socklen_t tp_stats_len = sizeof (struct tpacket_stats_v3);
|
||||
socklen_t tp_stats_len = sizeof(struct tpacket_stats_v3);
|
||||
int ret;
|
||||
|
||||
ret = getsockopt(socket_fd, SOL_PACKET, PACKET_STATISTICS, &tp_stats, &tp_stats_len);
|
||||
if ( ret < 0 )
|
||||
{
|
||||
if ( ret < 0 ) {
|
||||
Error(errno ? strerror(errno) : "unable to retrieve statistics");
|
||||
s->received = s->bytes_received = s->link = s->dropped = 0;
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
stats.link += tp_stats.tp_packets;
|
||||
stats.dropped += tp_stats.tp_drops;
|
||||
|
||||
memcpy(s, &stats, sizeof(Stats));
|
||||
}
|
||||
}
|
||||
|
||||
zeek::iosource::PktSrc* AF_PacketSource::InstantiateAF_Packet(const std::string& path, bool is_live)
|
||||
{
|
||||
zeek::iosource::PktSrc* AF_PacketSource::InstantiateAF_Packet(const std::string& path, bool is_live) {
|
||||
return new AF_PacketSource(path, is_live);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,82 +3,81 @@
|
|||
#pragma once
|
||||
|
||||
extern "C" {
|
||||
#include <sys/types.h>
|
||||
#include <sys/socket.h>
|
||||
#include <sys/ioctl.h>
|
||||
|
||||
#include <errno.h> // errorno
|
||||
#include <unistd.h> // close()
|
||||
|
||||
#include <net/ethernet.h> // ETH_P_ALL
|
||||
#include <linux/if.h> // ifreq
|
||||
#include <linux/if_packet.h> // AF_PACKET, etc.
|
||||
#include <linux/sockios.h> // SIOCSHWTSTAMP
|
||||
#include <linux/net_tstamp.h> // hwtstamp_config
|
||||
#include <errno.h> // errorno
|
||||
#include <linux/if.h> // ifreq
|
||||
#include <linux/if_packet.h> // AF_PACKET, etc.
|
||||
#include <linux/net_tstamp.h> // hwtstamp_config
|
||||
#include <linux/sockios.h> // SIOCSHWTSTAMP
|
||||
#include <net/ethernet.h> // ETH_P_ALL
|
||||
#include <pcap.h>
|
||||
#include <sys/ioctl.h>
|
||||
#include <sys/socket.h>
|
||||
#include <sys/types.h>
|
||||
#include <unistd.h> // close()
|
||||
}
|
||||
|
||||
#include "zeek/iosource/PktSrc.h"
|
||||
|
||||
#include "RX_Ring.h"
|
||||
|
||||
namespace af_packet::iosource::pktsrc {
|
||||
|
||||
class AF_PacketSource : public zeek::iosource::PktSrc {
|
||||
public:
|
||||
/**
|
||||
* Constructor.
|
||||
*
|
||||
* path: Name of the interface to open (the AF_Packet source doesn't
|
||||
* support reading from files).
|
||||
*
|
||||
* is_live: Must be true (the AF_Packet source doesn't support offline
|
||||
* operation).
|
||||
*/
|
||||
AF_PacketSource(const std::string& path, bool is_live);
|
||||
/**
|
||||
* Constructor.
|
||||
*
|
||||
* path: Name of the interface to open (the AF_Packet source doesn't
|
||||
* support reading from files).
|
||||
*
|
||||
* is_live: Must be true (the AF_Packet source doesn't support offline
|
||||
* operation).
|
||||
*/
|
||||
AF_PacketSource(const std::string& path, bool is_live);
|
||||
|
||||
/**
|
||||
* Destructor.
|
||||
*/
|
||||
~AF_PacketSource() override;
|
||||
/**
|
||||
* Destructor.
|
||||
*/
|
||||
~AF_PacketSource() override;
|
||||
|
||||
static PktSrc* InstantiateAF_Packet(const std::string& path, bool is_live);
|
||||
static PktSrc* InstantiateAF_Packet(const std::string& path, bool is_live);
|
||||
|
||||
protected:
|
||||
// PktSrc interface.
|
||||
void Open() override;
|
||||
void Close() override;
|
||||
bool ExtractNextPacket(zeek::Packet* pkt) override;
|
||||
void DoneWithPacket() override;
|
||||
bool PrecompileFilter(int index, const std::string& filter) override;
|
||||
bool SetFilter(int index) override;
|
||||
void Statistics(Stats* stats) override;
|
||||
// PktSrc interface.
|
||||
void Open() override;
|
||||
void Close() override;
|
||||
bool ExtractNextPacket(zeek::Packet* pkt) override;
|
||||
void DoneWithPacket() override;
|
||||
bool PrecompileFilter(int index, const std::string& filter) override;
|
||||
bool SetFilter(int index) override;
|
||||
void Statistics(Stats* stats) override;
|
||||
|
||||
private:
|
||||
Properties props;
|
||||
Stats stats;
|
||||
Properties props;
|
||||
Stats stats;
|
||||
|
||||
int current_filter = 0;
|
||||
unsigned int num_discarded = 0;
|
||||
int checksum_mode = 0;
|
||||
int current_filter = 0;
|
||||
unsigned int num_discarded = 0;
|
||||
int checksum_mode = 0;
|
||||
|
||||
int socket_fd = -1;
|
||||
RX_Ring *rx_ring = nullptr;
|
||||
struct pcap_pkthdr current_hdr = {};
|
||||
int socket_fd = -1;
|
||||
RX_Ring* rx_ring = nullptr;
|
||||
struct pcap_pkthdr current_hdr = {};
|
||||
|
||||
struct InterfaceInfo {
|
||||
int index = -1;
|
||||
int flags = 0;
|
||||
struct InterfaceInfo {
|
||||
int index = -1;
|
||||
int flags = 0;
|
||||
|
||||
bool Valid () { return index >= 0; }
|
||||
bool IsUp() { return flags & IFF_UP; }
|
||||
};
|
||||
bool Valid() { return index >= 0; }
|
||||
bool IsUp() { return flags & IFF_UP; }
|
||||
};
|
||||
|
||||
InterfaceInfo GetInterfaceInfo(const std::string& path);
|
||||
bool BindInterface(const InterfaceInfo& info);
|
||||
bool EnablePromiscMode(const InterfaceInfo& info);
|
||||
bool ConfigureFanoutGroup(bool enabled, bool defrag);
|
||||
bool ConfigureHWTimestamping(bool enabled);
|
||||
uint32_t GetFanoutMode(bool defrag);
|
||||
InterfaceInfo GetInterfaceInfo(const std::string& path);
|
||||
bool BindInterface(const InterfaceInfo& info);
|
||||
bool EnablePromiscMode(const InterfaceInfo& info);
|
||||
bool ConfigureFanoutGroup(bool enabled, bool defrag);
|
||||
bool ConfigureHWTimestamping(bool enabled);
|
||||
uint32_t GetFanoutMode(bool defrag);
|
||||
};
|
||||
|
||||
}
|
||||
} // namespace zeek::iosource::pktsrc
|
||||
|
|
|
|||
|
|
@ -1,21 +1,27 @@
|
|||
// See the file "COPYING" in the main distribution directory for copyright.
|
||||
|
||||
#include "Plugin.h"
|
||||
#include "AF_Packet.h"
|
||||
|
||||
#include "zeek/iosource/Component.h"
|
||||
|
||||
namespace af_packet::plugin::Zeek_AF_Packet { Plugin plugin; }
|
||||
#include "AF_Packet.h"
|
||||
|
||||
namespace plugin::Zeek_AF_Packet {
|
||||
Plugin plugin;
|
||||
}
|
||||
|
||||
using namespace af_packet::plugin::Zeek_AF_Packet;
|
||||
|
||||
zeek::plugin::Configuration Plugin::Configure()
|
||||
{
|
||||
AddComponent(new ::zeek::iosource::PktSrcComponent("AF_PacketReader", "af_packet", ::zeek::iosource::PktSrcComponent::LIVE, ::af_packet::iosource::pktsrc::AF_PacketSource::InstantiateAF_Packet));
|
||||
zeek::plugin::Configuration Plugin::Configure() {
|
||||
AddComponent(
|
||||
new ::zeek::iosource::PktSrcComponent("AF_PacketReader", "af_packet", ::zeek::iosource::PktSrcComponent::LIVE,
|
||||
::zeek::iosource::pktsrc::AF_PacketSource::InstantiateAF_Packet));
|
||||
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::AF_Packet";
|
||||
config.description = "Packet acquisition via AF_Packet";
|
||||
config.version.major = 4;
|
||||
config.version.minor = 0;
|
||||
config.version.patch = 0;
|
||||
return config;
|
||||
}
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::AF_Packet";
|
||||
config.description = "Packet acquisition via AF_Packet";
|
||||
config.version.major = 4;
|
||||
config.version.minor = 0;
|
||||
config.version.patch = 0;
|
||||
return config;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,17 @@
|
|||
// See the file "COPYING" in the main distribution directory for copyright.
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <zeek/plugin/Plugin.h>
|
||||
|
||||
namespace af_packet::plugin::Zeek_AF_Packet {
|
||||
|
||||
class Plugin : public zeek::plugin::Plugin
|
||||
{
|
||||
class Plugin : public zeek::plugin::Plugin {
|
||||
protected:
|
||||
// Overridden from zeek::plugin::Plugin.
|
||||
zeek::plugin::Configuration Configure() override;
|
||||
// Overridden from zeek::plugin::Plugin.
|
||||
zeek::plugin::Configuration Configure() override;
|
||||
};
|
||||
|
||||
extern Plugin plugin;
|
||||
|
||||
}
|
||||
} // namespace plugin::Zeek_AF_Packet
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
// See the file "COPYING" in the main distribution directory for copyright.
|
||||
|
||||
#include "RX_Ring.h"
|
||||
|
||||
|
|
@ -5,108 +6,95 @@
|
|||
#include <utility>
|
||||
|
||||
extern "C" {
|
||||
#include <linux/if_packet.h> // AF_PACKET, etc.
|
||||
#include <sys/socket.h> // socketopt consts
|
||||
#include <sys/mman.h> // mmap
|
||||
#include <unistd.h> // sysconf
|
||||
#include <linux/if_packet.h> // AF_PACKET, etc.
|
||||
#include <sys/mman.h> // mmap
|
||||
#include <sys/socket.h> // socketopt consts
|
||||
#include <unistd.h> // sysconf
|
||||
}
|
||||
|
||||
RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec)
|
||||
{
|
||||
int ret, ver = TPACKET_VERSION;
|
||||
RX_Ring::RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec) {
|
||||
int ret, ver = TPACKET_VERSION;
|
||||
|
||||
if ( sock < 0 )
|
||||
throw RX_RingException("invalid socket");
|
||||
if ( sock < 0 )
|
||||
throw RX_RingException("invalid socket");
|
||||
|
||||
// Configure socket
|
||||
ret = setsockopt(sock, SOL_PACKET, PACKET_VERSION, &ver, sizeof(ver));
|
||||
if ( ret )
|
||||
throw RX_RingException("unable to set TPacket version");
|
||||
// Configure socket
|
||||
ret = setsockopt(sock, SOL_PACKET, PACKET_VERSION, &ver, sizeof(ver));
|
||||
if ( ret )
|
||||
throw RX_RingException("unable to set TPacket version");
|
||||
|
||||
InitLayout(bufsize, blocksize, blocktimeout_msec);
|
||||
ret = setsockopt(sock, SOL_PACKET, PACKET_RX_RING, (uint8_t *) &layout,
|
||||
sizeof(layout));
|
||||
if ( ret )
|
||||
throw RX_RingException("unable to set ring layout");
|
||||
InitLayout(bufsize, blocksize, blocktimeout_msec);
|
||||
ret = setsockopt(sock, SOL_PACKET, PACKET_RX_RING, (uint8_t*)&layout, sizeof(layout));
|
||||
if ( ret )
|
||||
throw RX_RingException("unable to set ring layout");
|
||||
|
||||
// Map memory
|
||||
size = layout.tp_block_size * layout.tp_block_nr;
|
||||
ring = (uint8_t *) mmap(NULL, size, PROT_READ | PROT_WRITE,
|
||||
MAP_SHARED, sock, 0);
|
||||
if ( ring == MAP_FAILED )
|
||||
throw RX_RingException("unable to map ring memory");
|
||||
// Map memory
|
||||
size = layout.tp_block_size * layout.tp_block_nr;
|
||||
ring = (uint8_t*)mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, sock, 0);
|
||||
if ( ring == MAP_FAILED )
|
||||
throw RX_RingException("unable to map ring memory");
|
||||
|
||||
block_num = packet_num = 0;
|
||||
packet = NULL;
|
||||
block_num = packet_num = 0;
|
||||
packet = NULL;
|
||||
|
||||
// Init block mapping
|
||||
blocks = new tpacket_block_desc*[layout.tp_block_nr];
|
||||
for ( unsigned int i = 0; i < layout.tp_block_nr; i++ )
|
||||
blocks[i] = (struct tpacket_block_desc *)(ring +
|
||||
i * layout.tp_block_size);
|
||||
}
|
||||
// Init block mapping
|
||||
blocks = new tpacket_block_desc*[layout.tp_block_nr];
|
||||
for ( unsigned int i = 0; i < layout.tp_block_nr; i++ )
|
||||
blocks[i] = (struct tpacket_block_desc*)(ring + i * layout.tp_block_size);
|
||||
}
|
||||
|
||||
RX_Ring::~RX_Ring()
|
||||
{
|
||||
ReleasePacket();
|
||||
RX_Ring::~RX_Ring() {
|
||||
ReleasePacket();
|
||||
|
||||
delete[] blocks;
|
||||
munmap(ring, size);
|
||||
delete[] blocks;
|
||||
munmap(ring, size);
|
||||
|
||||
blocks = 0;
|
||||
size = 0;
|
||||
}
|
||||
blocks = 0;
|
||||
size = 0;
|
||||
}
|
||||
|
||||
bool RX_Ring::GetNextPacket(tpacket3_hdr** hdr)
|
||||
{
|
||||
struct tpacket_hdr_v1 *block_hdr = &(blocks[block_num]->hdr.bh1);
|
||||
bool RX_Ring::GetNextPacket(tpacket3_hdr** hdr) {
|
||||
struct tpacket_hdr_v1* block_hdr = &(blocks[block_num]->hdr.bh1);
|
||||
|
||||
if ( (block_hdr->block_status & TP_STATUS_USER) == 0 )
|
||||
return false;
|
||||
if ( (block_hdr->block_status & TP_STATUS_USER) == 0 )
|
||||
return false;
|
||||
|
||||
if ( packet == NULL )
|
||||
{
|
||||
// New block
|
||||
packet_num = block_hdr->num_pkts;
|
||||
if ( packet_num == 0 )
|
||||
{
|
||||
NextBlock();
|
||||
return false;
|
||||
}
|
||||
packet = (struct tpacket3_hdr *)
|
||||
((uint8_t *) blocks[block_num] + block_hdr->offset_to_first_pkt);
|
||||
}
|
||||
else
|
||||
// Continue with block
|
||||
packet = (struct tpacket3_hdr *)
|
||||
((uint8_t *) packet + packet->tp_next_offset);
|
||||
if ( packet == NULL ) {
|
||||
// New block
|
||||
packet_num = block_hdr->num_pkts;
|
||||
if ( packet_num == 0 ) {
|
||||
NextBlock();
|
||||
return false;
|
||||
}
|
||||
packet = (struct tpacket3_hdr*)((uint8_t*)blocks[block_num] + block_hdr->offset_to_first_pkt);
|
||||
}
|
||||
else
|
||||
// Continue with block
|
||||
packet = (struct tpacket3_hdr*)((uint8_t*)packet + packet->tp_next_offset);
|
||||
|
||||
*hdr = packet;
|
||||
packet_num--;
|
||||
return true;
|
||||
}
|
||||
*hdr = packet;
|
||||
packet_num--;
|
||||
return true;
|
||||
}
|
||||
|
||||
void RX_Ring::ReleasePacket()
|
||||
{
|
||||
if ( packet_num == 0 )
|
||||
NextBlock();
|
||||
}
|
||||
void RX_Ring::ReleasePacket() {
|
||||
if ( packet_num == 0 )
|
||||
NextBlock();
|
||||
}
|
||||
|
||||
void RX_Ring::InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec)
|
||||
{
|
||||
memset(&layout, 0, sizeof(layout));
|
||||
layout.tp_block_size = blocksize;
|
||||
layout.tp_frame_size = TPACKET_ALIGNMENT << 7; // Seems to be irrelevant for V3
|
||||
layout.tp_block_nr = bufsize / layout.tp_block_size;
|
||||
layout.tp_frame_nr = (layout.tp_block_size / layout.tp_frame_size) * layout.tp_block_nr;
|
||||
layout.tp_retire_blk_tov = blocktimeout_msec;
|
||||
}
|
||||
void RX_Ring::InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec) {
|
||||
memset(&layout, 0, sizeof(layout));
|
||||
layout.tp_block_size = blocksize;
|
||||
layout.tp_frame_size = TPACKET_ALIGNMENT << 7; // Seems to be irrelevant for V3
|
||||
layout.tp_block_nr = bufsize / layout.tp_block_size;
|
||||
layout.tp_frame_nr = (layout.tp_block_size / layout.tp_frame_size) * layout.tp_block_nr;
|
||||
layout.tp_retire_blk_tov = blocktimeout_msec;
|
||||
}
|
||||
|
||||
void RX_Ring::NextBlock()
|
||||
{
|
||||
struct tpacket_hdr_v1 *block_hdr = &(blocks[block_num]->hdr.bh1);
|
||||
void RX_Ring::NextBlock() {
|
||||
struct tpacket_hdr_v1* block_hdr = &(blocks[block_num]->hdr.bh1);
|
||||
|
||||
block_hdr->block_status = TP_STATUS_KERNEL;
|
||||
block_num = (block_num +1) % layout.tp_block_nr;
|
||||
packet = NULL;
|
||||
}
|
||||
block_hdr->block_status = TP_STATUS_KERNEL;
|
||||
block_num = (block_num + 1) % layout.tp_block_nr;
|
||||
packet = NULL;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,32 +13,32 @@ extern "C" {
|
|||
|
||||
class RX_RingException : public std::runtime_error {
|
||||
public:
|
||||
RX_RingException(const std::string& what_arg) : std::runtime_error(what_arg) {}
|
||||
RX_RingException(const std::string& what_arg) : std::runtime_error(what_arg) {}
|
||||
};
|
||||
|
||||
class RX_Ring {
|
||||
public:
|
||||
/**
|
||||
* Constructor
|
||||
*/
|
||||
RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec);
|
||||
~RX_Ring();
|
||||
/**
|
||||
* Constructor
|
||||
*/
|
||||
RX_Ring(int sock, size_t bufsize, size_t blocksize, int blocktimeout_msec);
|
||||
~RX_Ring();
|
||||
|
||||
bool GetNextPacket(tpacket3_hdr** hdr);
|
||||
void ReleasePacket();
|
||||
bool GetNextPacket(tpacket3_hdr** hdr);
|
||||
void ReleasePacket();
|
||||
|
||||
protected:
|
||||
void InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec);
|
||||
void NextBlock();
|
||||
void InitLayout(size_t bufsize, size_t blocksize, int blocktimeout_msec);
|
||||
void NextBlock();
|
||||
|
||||
private:
|
||||
struct tpacket_req3 layout;
|
||||
struct tpacket_block_desc** blocks;
|
||||
struct tpacket3_hdr* packet;
|
||||
struct tpacket_req3 layout;
|
||||
struct tpacket_block_desc** blocks;
|
||||
struct tpacket3_hdr* packet;
|
||||
|
||||
unsigned int block_num;
|
||||
unsigned int packet_num;
|
||||
unsigned int block_num;
|
||||
unsigned int packet_num;
|
||||
|
||||
uint8_t* ring;
|
||||
size_t size;
|
||||
uint8_t* ring;
|
||||
size_t size;
|
||||
};
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue