lib: take pointer to LiveDevice, not name

In the library capture example, show how the packet counter can be
updated.

Ticket: #7240
pull/12891/head
Jason Ish 2 years ago committed by Victor Julien
parent 60860e43ac
commit 04b29aa8d3

@ -49,13 +49,21 @@ static void *SimpleWorker(void *arg)
pthread_exit(NULL); pthread_exit(NULL);
} }
LiveDevice *device = LiveGetDevice("lib0");
assert(device != NULL);
int datalink = pcap_datalink(fp); int datalink = pcap_datalink(fp);
int count = 0;
struct pcap_pkthdr pkthdr; struct pcap_pkthdr pkthdr;
const u_char *packet; const u_char *packet;
while ((packet = pcap_next(fp, &pkthdr)) != NULL) { while ((packet = pcap_next(fp, &pkthdr)) != NULL) {
if (TmModuleLibHandlePacket(tv, packet, datalink, pkthdr.ts, pkthdr.len, 0, 0, NULL) != 0) { if (TmModuleLibHandlePacket(tv, device, packet, datalink, pkthdr.ts, pkthdr.len, 0, 0) !=
0) {
pthread_exit(NULL); pthread_exit(NULL);
} }
(void)SC_ATOMIC_ADD(device->pkts, 1);
count++;
} }
pcap_close(fp); pcap_close(fp);
@ -120,6 +128,11 @@ int main(int argc, char **argv)
/* Force logging to the current directory. */ /* Force logging to the current directory. */
ConfSetFromString("default-log-dir=.", 1); ConfSetFromString("default-log-dir=.", 1);
if (LiveRegisterDevice("lib0") < 0) {
fprintf(stderr, "LiveRegisterDevice failed");
exit(1);
}
SuricataInit(); SuricataInit();
/* Create and start worker on its own thread, passing the PCAP /* Create and start worker on its own thread, passing the PCAP

@ -122,17 +122,17 @@ TmEcode DecodeLib(ThreadVars *tv, Packet *p, void *data)
/** \brief process a single packet. /** \brief process a single packet.
* *
* \param tv Pointer to the per-thread structure. * \param tv Pointer to the per-thread structure.
* \param device Pionter to LiveDevice instance
* \param data Pointer to the raw packet. * \param data Pointer to the raw packet.
* \param datalink Datalink type. * \param datalink Datalink type.
* \param ts Timeval structure. * \param ts Timeval structure.
* \param len Packet length. * \param len Packet length.
* \param tenant_id Tenant id of the detection engine to use. * \param tenant_id Tenant id of the detection engine to use.
* \param flags Packet flags (packet checksum, rule profiling...). * \param flags Packet flags (packet checksum, rule profiling...).
* \param iface Sniffing interface this packet comes from (can be NULL).
* \return Error code. * \return Error code.
*/ */
int TmModuleLibHandlePacket(ThreadVars *tv, const uint8_t *data, int datalink, struct timeval ts, int TmModuleLibHandlePacket(ThreadVars *tv, LiveDevice *device, const uint8_t *data, int datalink,
uint32_t len, uint32_t tenant_id, uint32_t flags, const char *iface) struct timeval ts, uint32_t len, uint32_t tenant_id, uint32_t flags)
{ {
/* If the packet is NULL, consider it as a read timeout. */ /* If the packet is NULL, consider it as a read timeout. */
@ -159,11 +159,7 @@ int TmModuleLibHandlePacket(ThreadVars *tv, const uint8_t *data, int datalink, s
p->datalink = datalink; p->datalink = datalink;
p->tenant_id = tenant_id; p->tenant_id = tenant_id;
p->flags |= flags; p->flags |= flags;
p->livedev = device;
/* Set the sniffing interface. */
if (iface) {
p->livedev = LiveGetDevice(iface);
}
if (PacketSetData(p, data, len) == -1) { if (PacketSetData(p, data, len) == -1) {
TmqhOutputPacketpool(tv, p); TmqhOutputPacketpool(tv, p);

@ -27,6 +27,7 @@
#define SURICATA_SOURCE_LIB_H #define SURICATA_SOURCE_LIB_H
#include "tm-threads.h" #include "tm-threads.h"
#include "util-device.h"
/** \brief register a "Decode" module for suricata as a library. /** \brief register a "Decode" module for suricata as a library.
* *
@ -45,7 +46,7 @@ void TmModuleDecodeLibRegister(void);
* \param iface Sniffing interface this packet comes from (can be NULL). * \param iface Sniffing interface this packet comes from (can be NULL).
* \return Error code. * \return Error code.
*/ */
int TmModuleLibHandlePacket(ThreadVars *tv, const uint8_t *data, int datalink, struct timeval ts, int TmModuleLibHandlePacket(ThreadVars *tv, LiveDevice *device, const uint8_t *data, int datalink,
uint32_t len, uint32_t tenant_id, uint32_t flags, const char *iface); struct timeval ts, uint32_t len, uint32_t tenant_id, uint32_t flags);
#endif /* SURICATA_SOURCE_LIB_H */ #endif /* SURICATA_SOURCE_LIB_H */

Loading…
Cancel
Save