mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 16:48:19 +00:00
IOSource reorg.
A bunch of infrastructure work to move IOSource, IOSourceRegistry (now iosource::Manager) and PktSrc/PktDumper code into iosource/, and over to a plugin structure. Other IOSources aren't touched yet, they are still in src/*. It compiles and does something with a small trace, but that's all I've tested so far. There are quite certainly a number of problems left, as well as various TODOs and cleanup; and nothing's cast in stone yet. Will continue to work on this.
This commit is contained in:
Robin Sommer
parent
6c20df11cc
commit
93d9dde969
52 changed files with 2223 additions and 1306 deletions
119
src/Net.cc
119
src/Net.cc
|
|
@ -30,6 +30,9 @@
|
|||
#include "PacketSort.h"
|
||||
#include "Serializer.h"
|
||||
#include "PacketDumper.h"
|
||||
#include "iosource/Manager.h"
|
||||
#include "iosource/pktsrc/PktSrc.h"
|
||||
#include "iosource/pktsrc/PktDumper.h"
|
||||
|
||||
extern "C" {
|
||||
#include "setsignal.h"
|
||||
|
|
@ -39,10 +42,7 @@ extern "C" {
|
|||
extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
|
||||
}
|
||||
|
||||
PList(PktSrc) pkt_srcs;
|
||||
|
||||
// FIXME: We should really merge PktDumper and PacketDumper.
|
||||
PktDumper* pkt_dumper = 0;
|
||||
iosource::PktDumper* pkt_dumper = 0;
|
||||
|
||||
int reading_live = 0;
|
||||
int reading_traces = 0;
|
||||
|
|
@ -65,8 +65,8 @@ const u_char* current_pkt = 0;
|
|||
int current_dispatched = 0;
|
||||
int current_hdr_size = 0;
|
||||
double current_timestamp = 0.0;
|
||||
PktSrc* current_pktsrc = 0;
|
||||
IOSource* current_iosrc;
|
||||
iosource::PktSrc* current_pktsrc = 0;
|
||||
iosource::IOSource* current_iosrc = 0;
|
||||
|
||||
std::list<ScannedFile> files_scanned;
|
||||
std::vector<string> sig_files;
|
||||
|
|
@ -115,8 +115,8 @@ RETSIGTYPE watchdog(int /* signo */)
|
|||
// saving the packet which caused the
|
||||
// watchdog to trigger may be helpful,
|
||||
// so we'll save that one nevertheless.
|
||||
pkt_dumper = new PktDumper("watchdog-pkt.pcap");
|
||||
if ( pkt_dumper->IsError() )
|
||||
pkt_dumper = iosource_mgr->OpenPktDumper("watchdog-pkt.pcap", false);
|
||||
if ( ! pkt_dumper || pkt_dumper->IsError() )
|
||||
{
|
||||
reporter->Error("watchdog: can't open watchdog-pkt.pcap for writing\n");
|
||||
delete pkt_dumper;
|
||||
|
|
@ -125,7 +125,12 @@ RETSIGTYPE watchdog(int /* signo */)
|
|||
}
|
||||
|
||||
if ( pkt_dumper )
|
||||
pkt_dumper->Dump(current_hdr, current_pkt);
|
||||
{
|
||||
iosource::PktDumper::Packet p;
|
||||
p.hdr = current_hdr;
|
||||
p.data = current_pkt;
|
||||
pkt_dumper->Record(&p);
|
||||
}
|
||||
}
|
||||
|
||||
net_get_final_stats();
|
||||
|
|
@ -157,18 +162,10 @@ void net_init(name_list& interfaces, name_list& readfiles,
|
|||
reading_traces = 1;
|
||||
|
||||
for ( int i = 0; i < readfiles.length(); ++i )
|
||||
{
|
||||
PktFileSrc* ps = new PktFileSrc(readfiles[i], filter);
|
||||
|
||||
if ( ! ps->IsOpen() )
|
||||
reporter->FatalError("%s: problem with trace file %s - %s\n",
|
||||
prog, readfiles[i], ps->ErrorMsg());
|
||||
else
|
||||
{
|
||||
pkt_srcs.append(ps);
|
||||
io_sources.Register(ps);
|
||||
}
|
||||
iosource_mgr->OpenPktSrc(readfiles[i], filter, false);
|
||||
}
|
||||
|
||||
#if 0
|
||||
if ( secondary_filter )
|
||||
{
|
||||
// We use a second PktFileSrc for the
|
||||
|
|
@ -189,7 +186,6 @@ void net_init(name_list& interfaces, name_list& readfiles,
|
|||
|
||||
ps->AddSecondaryTablePrograms();
|
||||
}
|
||||
}
|
||||
|
||||
for ( int i = 0; i < flowfiles.length(); ++i )
|
||||
{
|
||||
|
|
@ -203,7 +199,7 @@ void net_init(name_list& interfaces, name_list& readfiles,
|
|||
io_sources.Register(fs);
|
||||
}
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
else if ((interfaces.length() > 0 || netflows.length() > 0))
|
||||
{
|
||||
|
|
@ -211,22 +207,13 @@ void net_init(name_list& interfaces, name_list& readfiles,
|
|||
reading_traces = 0;
|
||||
|
||||
for ( int i = 0; i < interfaces.length(); ++i )
|
||||
{
|
||||
PktSrc* ps;
|
||||
ps = new PktInterfaceSrc(interfaces[i], filter);
|
||||
|
||||
if ( ! ps->IsOpen() )
|
||||
reporter->FatalError("%s: problem with interface %s - %s\n",
|
||||
prog, interfaces[i], ps->ErrorMsg());
|
||||
else
|
||||
{
|
||||
pkt_srcs.append(ps);
|
||||
io_sources.Register(ps);
|
||||
}
|
||||
iosource_mgr->OpenPktSrc(interfaces[i], filter, true);
|
||||
}
|
||||
#if 0
|
||||
|
||||
if ( secondary_filter )
|
||||
{
|
||||
PktSrc* ps;
|
||||
iosource::PktSrc* ps;
|
||||
ps = new PktInterfaceSrc(interfaces[i],
|
||||
filter, TYPE_FILTER_SECONDARY);
|
||||
|
||||
|
|
@ -258,8 +245,7 @@ void net_init(name_list& interfaces, name_list& readfiles,
|
|||
else
|
||||
io_sources.Register(fs);
|
||||
}
|
||||
|
||||
}
|
||||
#endif
|
||||
|
||||
else
|
||||
// have_pending_timers = 1, possibly. We don't set
|
||||
|
|
@ -270,12 +256,7 @@ void net_init(name_list& interfaces, name_list& readfiles,
|
|||
|
||||
if ( writefile )
|
||||
{
|
||||
// ### This will fail horribly if there are multiple
|
||||
// interfaces with different-lengthed media.
|
||||
pkt_dumper = new PktDumper(writefile);
|
||||
if ( pkt_dumper->IsError() )
|
||||
reporter->FatalError("%s: can't open write file \"%s\" - %s\n",
|
||||
prog, writefile, pkt_dumper->ErrorMsg());
|
||||
pkt_dumper = iosource_mgr->OpenPktDumper(writefile, false);
|
||||
|
||||
ID* id = global_scope()->Lookup("trace_output_file");
|
||||
if ( ! id )
|
||||
|
|
@ -299,7 +280,7 @@ void net_init(name_list& interfaces, name_list& readfiles,
|
|||
}
|
||||
}
|
||||
|
||||
void expire_timers(PktSrc* src_ps)
|
||||
void expire_timers(iosource::PktSrc* src_ps)
|
||||
{
|
||||
SegmentProfiler(segment_logger, "expiring-timers");
|
||||
TimerMgr* tmgr =
|
||||
|
|
@ -313,7 +294,7 @@ void expire_timers(PktSrc* src_ps)
|
|||
|
||||
void net_packet_dispatch(double t, const struct pcap_pkthdr* hdr,
|
||||
const u_char* pkt, int hdr_size,
|
||||
PktSrc* src_ps, PacketSortElement* pkt_elem)
|
||||
iosource::PktSrc* src_ps, PacketSortElement* pkt_elem)
|
||||
{
|
||||
if ( ! bro_start_network_time )
|
||||
bro_start_network_time = t;
|
||||
|
|
@ -394,7 +375,7 @@ int process_packet_sorter(double latest_packet_time)
|
|||
|
||||
void net_packet_arrival(double t, const struct pcap_pkthdr* hdr,
|
||||
const u_char* pkt, int hdr_size,
|
||||
PktSrc* src_ps)
|
||||
iosource::PktSrc* src_ps)
|
||||
{
|
||||
if ( packet_sorter )
|
||||
{
|
||||
|
|
@ -421,12 +402,12 @@ void net_run()
|
|||
{
|
||||
set_processing_status("RUNNING", "net_run");
|
||||
|
||||
while ( io_sources.Size() ||
|
||||
while ( iosource_mgr->Size() ||
|
||||
(packet_sorter && ! packet_sorter->Empty()) ||
|
||||
(BifConst::exit_only_after_terminate && ! terminating) )
|
||||
{
|
||||
double ts;
|
||||
IOSource* src = io_sources.FindSoonest(&ts);
|
||||
iosource::IOSource* src = iosource_mgr->FindSoonest(&ts);
|
||||
|
||||
#ifdef DEBUG
|
||||
static int loop_counter = 0;
|
||||
|
|
@ -535,16 +516,19 @@ void net_run()
|
|||
|
||||
void net_get_final_stats()
|
||||
{
|
||||
loop_over_list(pkt_srcs, i)
|
||||
const iosource::Manager::PktSrcList& pkt_srcs(iosource_mgr->GetPktSrcs());
|
||||
|
||||
for ( iosource::Manager::PktSrcList::const_iterator i = pkt_srcs.begin();
|
||||
i != pkt_srcs.end(); i++ )
|
||||
{
|
||||
PktSrc* ps = pkt_srcs[i];
|
||||
iosource::PktSrc* ps = *i;
|
||||
|
||||
if ( ps->IsLive() )
|
||||
{
|
||||
struct PktSrc::Stats s;
|
||||
iosource::PktSrc::Stats s;
|
||||
ps->Statistics(&s);
|
||||
reporter->Info("%d packets received on interface %s, %d dropped\n",
|
||||
s.received, ps->Interface(), s.dropped);
|
||||
s.received, ps->Path().c_str(), s.dropped);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -587,29 +571,6 @@ void net_delete()
|
|||
delete ip_anonymizer[i];
|
||||
}
|
||||
|
||||
// net_packet_match
|
||||
//
|
||||
// Description:
|
||||
// - Checks if a packet matches a filter. It just wraps up a call to
|
||||
// [pcap.h's] bpf_filter().
|
||||
//
|
||||
// Inputs:
|
||||
// - fp: a BPF-compiled filter
|
||||
// - pkt: a pointer to the packet
|
||||
// - len: the original packet length
|
||||
// - caplen: the captured packet length. This is pkt length
|
||||
//
|
||||
// Output:
|
||||
// - return: 1 if the packet matches the filter, 0 otherwise
|
||||
|
||||
int net_packet_match(BPF_Program* fp, const u_char* pkt,
|
||||
u_int len, u_int caplen)
|
||||
{
|
||||
// NOTE: I don't like too much un-const'ing the pkt variable.
|
||||
return bpf_filter(fp->GetProgram()->bf_insns, (u_char*) pkt, len, caplen);
|
||||
}
|
||||
|
||||
|
||||
int _processing_suspended = 0;
|
||||
|
||||
static double suspend_start = 0;
|
||||
|
|
@ -627,8 +588,12 @@ void net_continue_processing()
|
|||
if ( _processing_suspended == 1 )
|
||||
{
|
||||
reporter->Info("processing continued");
|
||||
loop_over_list(pkt_srcs, i)
|
||||
pkt_srcs[i]->ContinueAfterSuspend();
|
||||
|
||||
const iosource::Manager::PktSrcList& pkt_srcs(iosource_mgr->GetPktSrcs());
|
||||
|
||||
for ( iosource::Manager::PktSrcList::const_iterator i = pkt_srcs.begin();
|
||||
i != pkt_srcs.end(); i++ )
|
||||
(*i)->ContinueAfterSuspend();
|
||||
}
|
||||
|
||||
--_processing_suspended;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue