if (ConfGet("bpf-filter", &bpf_filter) == 1) {
if (strlen(bpf_filter) > 0) {
aconf->bpf_filter = bpf_filter;
- SCLogConfig("Going to use command-line provided bpf filter '%s'",
- aconf->bpf_filter);
+ SCLogConfig(
+ "%s: using command-line provided bpf filter '%s'", iface, aconf->bpf_filter);
}
}
/* Find initial node */
af_packet_node = ConfGetNode("af-packet");
if (af_packet_node == NULL) {
- SCLogInfo("unable to find af-packet config using default values");
+ SCLogInfo("%s: unable to find af-packet config using default values", iface);
goto finalize;
}
if_default = ConfFindDeviceConfig(af_packet_node, "default");
if (if_root == NULL && if_default == NULL) {
- SCLogInfo("unable to find af-packet config for "
+ SCLogInfo("%s: unable to find af-packet config for "
"interface \"%s\" or \"default\", using default values",
- iface);
+ iface, iface);
goto finalize;
}
aconf->threads = 0;
} else {
if (StringParseInt32(&aconf->threads, 10, 0, (const char *)threadsstr) < 0) {
- SCLogWarning("Invalid number of "
- "threads, resetting to default");
+ SCLogWarning("%s: invalid number of "
+ "threads, resetting to default",
+ iface);
aconf->threads = 0;
}
}
(void)ConfGetChildValueBoolWithDefault(if_root, if_default, "mmap-locked", (int *)&boolval);
if (boolval) {
- SCLogConfig("Enabling locked memory for mmap on iface %s", aconf->iface);
+ SCLogConfig("%s: enabling locked memory for mmap", aconf->iface);
aconf->flags |= AFP_MMAP_LOCKED;
}
if (boolval) {
if (strcasecmp(RunmodeGetActive(), "workers") == 0) {
#ifdef HAVE_TPACKET_V3
- SCLogConfig("Enabling tpacket v3 capture on iface %s", aconf->iface);
+ SCLogConfig("%s: enabling tpacket v3", aconf->iface);
aconf->flags |= AFP_TPACKET_V3;
#else
- SCLogNotice("System too old for tpacket v3 switching to v2");
+ SCLogWarning("%s: system too old for tpacket v3 switching to v2", iface);
aconf->flags &= ~AFP_TPACKET_V3;
#endif
} else {
- SCLogWarning("tpacket v3 is only implemented for 'workers' runmode."
- " Switching to tpacket v2.");
+ SCLogWarning("%s: tpacket v3 is only implemented for 'workers' runmode."
+ " Switching to tpacket v2.",
+ iface);
aconf->flags &= ~AFP_TPACKET_V3;
}
} else {
(void)ConfGetChildValueBoolWithDefault(
if_root, if_default, "use-emergency-flush", (int *)&boolval);
if (boolval) {
- SCLogConfig("Enabling emergency ring flush on iface %s", aconf->iface);
+ SCLogConfig("%s: using emergency ring flush", aconf->iface);
aconf->flags |= AFP_EMERGENCY_MODE;
}
if (ConfGetChildValueWithDefault(if_root, if_default, "copy-mode", ©modestr) == 1) {
if (aconf->out_iface == NULL) {
- SCLogInfo("Copy mode activated but no destination"
- " iface. Disabling feature");
+ SCLogWarning("%s: copy mode activated but no destination"
+ " iface. Disabling feature",
+ iface);
} else if (strlen(copymodestr) <= 0) {
aconf->out_iface = NULL;
} else if (strcmp(copymodestr, "ips") == 0) {
- SCLogInfo("AF_PACKET IPS mode activated %s->%s",
- iface,
- aconf->out_iface);
+ SCLogInfo("%s: AF_PACKET IPS mode activated %s->%s", iface, iface, aconf->out_iface);
aconf->copy_mode = AFP_COPY_MODE_IPS;
if (aconf->flags & AFP_TPACKET_V3) {
- SCLogWarning("Using tpacket_v3 in IPS mode will result in high latency");
+ SCLogWarning("%s: using tpacket_v3 in IPS mode will result in high latency", iface);
}
} else if (strcmp(copymodestr, "tap") == 0) {
- SCLogInfo("AF_PACKET TAP mode activated %s->%s",
- iface,
- aconf->out_iface);
+ SCLogInfo("%s: AF_PACKET TAP mode activated %s->%s", iface, iface, aconf->out_iface);
aconf->copy_mode = AFP_COPY_MODE_TAP;
if (aconf->flags & AFP_TPACKET_V3) {
- SCLogWarning("Using tpacket_v3 in TAP mode will result in high latency");
+ SCLogWarning("%s: using tpacket_v3 in TAP mode will result in high latency", iface);
}
} else {
- SCLogInfo("Invalid mode (not in tap, ips)");
+ SCLogWarning("Invalid 'copy-mode' (not in tap, ips)");
}
}
aconf->cluster_id = (uint16_t)(cluster_id_auto++);
} else {
if (StringParseUint16(&aconf->cluster_id, 10, 0, (const char *)tmpclusterid) < 0) {
- SCLogWarning("Invalid cluster_id, resetting to 0");
+ SCLogWarning("%s: invalid cluster_id, resetting to 0", iface);
aconf->cluster_id = 0;
}
SCLogDebug("Going to use cluster-id %" PRIu16, aconf->cluster_id);
aconf->cluster_type = PACKET_FANOUT_HASH | PACKET_FANOUT_FLAG_DEFRAG;
cluster_type = PACKET_FANOUT_HASH;
} else if (strcmp(tmpctype, "cluster_round_robin") == 0) {
- SCLogConfig("Using round-robin cluster mode for AF_PACKET (iface %s)",
- aconf->iface);
+ SCLogConfig("%s: using round-robin cluster mode for AF_PACKET", aconf->iface);
aconf->cluster_type = PACKET_FANOUT_LB;
cluster_type = PACKET_FANOUT_LB;
} else if (strcmp(tmpctype, "cluster_flow") == 0) {
* compute the hash */
uint16_t defrag = 0;
int conf_val = 0;
- SCLogConfig("Using flow cluster mode for AF_PACKET (iface %s)",
- aconf->iface);
+ SCLogConfig("%s: using flow cluster mode for AF_PACKET", aconf->iface);
ConfGetChildValueBoolWithDefault(if_root, if_default, "defrag", &conf_val);
if (conf_val) {
- SCLogConfig("Using defrag kernel functionality for AF_PACKET (iface %s)",
- aconf->iface);
+ SCLogConfig("%s: using defrag kernel functionality for AF_PACKET", aconf->iface);
defrag = PACKET_FANOUT_FLAG_DEFRAG;
}
aconf->cluster_type = PACKET_FANOUT_HASH | defrag;
cluster_type = PACKET_FANOUT_HASH;
} else if (strcmp(tmpctype, "cluster_cpu") == 0) {
- SCLogConfig("Using cpu cluster mode for AF_PACKET (iface %s)",
- aconf->iface);
+ SCLogConfig("%s: using cpu cluster mode for AF_PACKET", aconf->iface);
aconf->cluster_type = PACKET_FANOUT_CPU;
cluster_type = PACKET_FANOUT_CPU;
} else if (strcmp(tmpctype, "cluster_qm") == 0) {
- SCLogConfig("Using queue based cluster mode for AF_PACKET (iface %s)",
- aconf->iface);
+ SCLogConfig("%s: using queue based cluster mode for AF_PACKET", aconf->iface);
aconf->cluster_type = PACKET_FANOUT_QM;
cluster_type = PACKET_FANOUT_QM;
} else if (strcmp(tmpctype, "cluster_random") == 0) {
- SCLogConfig("Using random based cluster mode for AF_PACKET (iface %s)",
- aconf->iface);
+ SCLogConfig("%s: using random based cluster mode for AF_PACKET", aconf->iface);
aconf->cluster_type = PACKET_FANOUT_RND;
cluster_type = PACKET_FANOUT_RND;
} else if (strcmp(tmpctype, "cluster_rollover") == 0) {
- SCLogConfig("Using rollover based cluster mode for AF_PACKET (iface %s)",
- aconf->iface);
- SCLogWarning("Rollover mode is causing severe flow "
- "tracking issues, use it at your own risk.");
+ SCLogConfig("%s: using rollover based cluster mode for AF_PACKET", aconf->iface);
+ SCLogWarning("%s: rollover mode is causing severe flow "
+ "tracking issues, use it at your own risk.",
+ iface);
aconf->cluster_type = PACKET_FANOUT_ROLLOVER;
cluster_type = PACKET_FANOUT_ROLLOVER;
#ifdef HAVE_PACKET_EBPF
} else if (strcmp(tmpctype, "cluster_ebpf") == 0) {
- SCLogInfo("Using ebpf based cluster mode for AF_PACKET (iface %s)",
- aconf->iface);
+ SCLogInfo("%s: using ebpf based cluster mode for AF_PACKET", aconf->iface);
aconf->cluster_type = PACKET_FANOUT_EBPF;
cluster_type = PACKET_FANOUT_EBPF;
#endif
int conf_val = 0;
ConfGetChildValueBoolWithDefault(if_root, if_default, "rollover", &conf_val);
if (conf_val) {
- SCLogConfig("Using rollover kernel functionality for AF_PACKET (iface %s)",
- aconf->iface);
+ SCLogConfig("%s: Using rollover kernel functionality for AF_PACKET", aconf->iface);
aconf->cluster_type |= PACKET_FANOUT_FLAG_ROLLOVER;
- SCLogWarning("Rollover option is causing severe flow "
- "tracking issues, use it at your own risk.");
+ SCLogWarning("%s: rollover option is causing severe flow "
+ "tracking issues, use it at your own risk.",
+ iface);
}
/*load af_packet bpf filter*/
if (ConfGetChildValueWithDefault(if_root, if_default, "bpf-filter", &bpf_filter) == 1) {
if (strlen(bpf_filter) > 0) {
aconf->bpf_filter = bpf_filter;
- SCLogConfig("Going to use bpf filter %s", aconf->bpf_filter);
+ SCLogConfig("%s: bpf filter %s", iface, aconf->bpf_filter);
}
}
}
aconf->ebpf_lb_file = NULL;
} else {
#ifdef HAVE_PACKET_EBPF
- SCLogConfig("af-packet will use '%s' as eBPF load balancing file",
- ebpf_file);
+ SCLogConfig("%s: af-packet will use '%s' as eBPF load balancing file", iface, ebpf_file);
aconf->ebpf_lb_file = ebpf_file;
aconf->ebpf_t_config.flags |= EBPF_SOCKET_FILTER;
#endif
boolval = false;
if (ConfGetChildValueBoolWithDefault(if_root, if_default, "pinned-maps", (int *)&boolval) == 1) {
if (boolval) {
- SCLogConfig("Using pinned maps on iface %s",
- aconf->iface);
+ SCLogConfig("%s: using pinned maps", aconf->iface);
aconf->ebpf_t_config.flags |= EBPF_PINNED_MAPS;
}
const char *pinned_maps_name = NULL;
&aconf->ebpf_lb_fd,
&aconf->ebpf_t_config);
if (ret != 0) {
- SCLogWarning("Error when loading eBPF lb file");
+ SCLogWarning("%s: failed to load eBPF lb file", iface);
}
}
#else
if (aconf->ebpf_lb_file) {
- SCLogError("eBPF support is not build-in");
+ SCLogError("%s: eBPF support is not built-in", iface);
}
#endif
aconf->ebpf_filter_file = NULL;
} else {
#ifdef HAVE_PACKET_EBPF
- SCLogConfig("af-packet will use '%s' as eBPF filter file",
- ebpf_file);
+ SCLogConfig("%s: af-packet will use '%s' as eBPF filter file", iface, ebpf_file);
aconf->ebpf_filter_file = ebpf_file;
aconf->ebpf_t_config.mode = AFP_MODE_EBPF_BYPASS;
aconf->ebpf_t_config.flags |= EBPF_SOCKET_FILTER;
ConfGetChildValueBoolWithDefault(if_root, if_default, "bypass", &conf_val);
if (conf_val) {
#ifdef HAVE_PACKET_EBPF
- SCLogConfig("Using bypass kernel functionality for AF_PACKET (iface %s)",
- aconf->iface);
+ SCLogConfig("%s: using bypass kernel functionality for AF_PACKET", aconf->iface);
aconf->flags |= AFP_BYPASS;
BypassedFlowManagerRegisterUpdateFunc(EBPFUpdateFlow, NULL);
#else
- SCLogError("Bypass set but eBPF support is not built-in");
+ SCLogError("%s: bypass set but eBPF support is not built-in", iface);
#endif
}
}
&aconf->ebpf_filter_fd,
&aconf->ebpf_t_config);
if (ret != 0) {
- SCLogWarning("Error when loading eBPF filter file");
+ SCLogWarning("%s: failed to load eBPF filter file", iface);
}
#else
- SCLogError("eBPF support is not build-in");
+ SCLogError("%s: eBPF support is not built-in", iface);
#endif
}
aconf->xdp_filter_file = ebpf_file;
ConfGetChildValueBoolWithDefault(if_root, if_default, "bypass", &conf_val);
if (conf_val) {
- SCLogConfig("Using bypass kernel functionality for AF_PACKET (iface %s)",
- aconf->iface);
+ SCLogConfig("%s: using bypass kernel functionality for AF_PACKET", aconf->iface);
aconf->flags |= AFP_XDPBYPASS;
/* if maps are pinned we need to read them at start */
if (aconf->ebpf_t_config.flags & EBPF_PINNED_MAPS) {
RunModeEnablesBypassManager();
struct ebpf_timeout_config *ebt = SCCalloc(1, sizeof(struct ebpf_timeout_config));
if (ebt == NULL) {
- SCLogError("Flow bypass alloc error");
+ SCLogError("%s: flow bypass alloc error", iface);
} else {
memcpy(ebt, &(aconf->ebpf_t_config), sizeof(struct ebpf_timeout_config));
BypassedFlowManagerRegisterCheckFunc(NULL,
BypassedFlowManagerRegisterUpdateFunc(EBPFUpdateFlow, NULL);
}
#else
- SCLogWarning("XDP filter set but XDP support is not built-in");
+ SCLogWarning("%s: XDP filter set but XDP support is not built-in", iface);
#endif
#ifdef HAVE_PACKET_XDP
const char *xdp_mode;
boolval = true;
if (ConfGetChildValueBoolWithDefault(if_root, if_default, "use-percpu-hash", (int *)&boolval) == 1) {
if (boolval == false) {
- SCLogConfig("Not using percpu hash on iface %s",
- aconf->iface);
+ SCLogConfig("%s: not using percpu hash", aconf->iface);
aconf->ebpf_t_config.cpus_count = 1;
}
}
&aconf->ebpf_t_config);
switch (ret) {
case 1:
- SCLogInfo("Loaded pinned maps from sysfs");
+ SCLogInfo("%s: loaded pinned maps from sysfs", iface);
break;
case -1:
- SCLogWarning("Error when loading XDP filter file");
+ SCLogWarning("%s: failed to load XDP filter file", iface);
break;
case 0:
ret = EBPFSetupXDP(aconf->iface, aconf->xdp_filter_fd, aconf->xdp_mode);
if (ret != 0) {
- SCLogWarning("Error when setting up XDP");
+ SCLogWarning("%s: failed to set up XDP", iface);
} else {
/* Try to get the xdp-cpu-redirect key */
const char *cpuset;
if (ConfGetChildValueWithDefault(if_root, if_default,
"xdp-cpu-redirect", &cpuset) == 1) {
- SCLogConfig("Setting up CPU map XDP");
+ SCLogConfig("%s: Setting up CPU map XDP", iface);
ConfNode *node = ConfGetChildWithDefault(if_root, if_default, "xdp-cpu-redirect");
if (node == NULL) {
SCLogError("Previously found node has disappeared");
}
}
#else
- SCLogError("XDP support is not built-in");
+ SCLogError("%s: XDP support is not built-in", iface);
#endif
}
if ((ConfGetChildValueIntWithDefault(if_root, if_default, "block-size", &value)) == 1) {
if (value % getpagesize()) {
- SCLogError("Block-size must be a multiple of pagesize.");
+ SCLogWarning("%s: block-size %" PRIuMAX " must be a multiple of pagesize (%u).", iface,
+ value, getpagesize());
} else {
aconf->block_size = value;
}
(void)ConfGetChildValueBoolWithDefault(if_root, if_default, "disable-promisc", (int *)&boolval);
if (boolval) {
- SCLogConfig("Disabling promiscuous mode on iface %s",
- aconf->iface);
+ SCLogConfig("%s: disabling promiscuous mode", aconf->iface);
aconf->promisc = 0;
}
} else if (strcmp(tmpctype, "kernel") == 0) {
aconf->checksum_mode = CHECKSUM_VALIDATION_KERNEL;
} else {
- SCLogError("Invalid value for checksum-checks for %s", aconf->iface);
+ SCLogWarning("%s: invalid value for checksum-checks", aconf->iface);
}
}
if (aconf->threads != 1) {
if (AFPIsFanoutSupported(aconf->cluster_id) == 0) {
if (aconf->threads != 0) {
- SCLogNotice("fanout not supported on this system, falling "
- "back to 1 capture thread");
+ SCLogNotice("%s: fanout not supported on this system, falling "
+ "back to 1 capture thread",
+ iface);
}
aconf->threads = 1;
}
/* for cluster_flow use core count */
if (cluster_type == PACKET_FANOUT_HASH) {
aconf->threads = (int)UtilCpuGetNumProcessorsOnline();
- SCLogPerf("cluster_flow: %u cores, using %u threads", aconf->threads, aconf->threads);
+ SCLogPerf("%s: cluster_flow: %u cores, using %u threads", iface, aconf->threads,
+ aconf->threads);
/* for cluster_qm use RSS queue count */
} else if (cluster_type == PACKET_FANOUT_QM) {
int rss_queues = GetIfaceRSSQueuesNum(iface);
if (rss_queues > 0) {
aconf->threads = rss_queues;
- SCLogPerf(
- "cluster_qm: %d RSS queues, using %u threads", rss_queues, aconf->threads);
+ SCLogPerf("%s: cluster_qm: %d RSS queues, using %u threads", iface, rss_queues,
+ aconf->threads);
}
}
if (aconf->ring_size != 0) {
if (aconf->ring_size * aconf->threads < max_pending_packets) {
aconf->ring_size = max_pending_packets / aconf->threads + 1;
- SCLogWarning("Inefficient setup: ring-size < max_pending_packets. "
+ SCLogWarning("%s: inefficient setup: ring-size < max_pending_packets. "
"Resetting to decent value %d.",
- aconf->ring_size);
+ iface, aconf->ring_size);
/* We want at least that max_pending_packets packets can be handled by the
* interface. This is generous if we have multiple interfaces listening. */
}
if (LiveGetOffload() == 0) {
if (GetIfaceOffloading(iface, 0, 1) == 1) {
SCLogWarning(
- "Using AF_PACKET with offloading activated leads to capture problems");
+ "%s: using AF_PACKET with offloads enabled leads to capture problems",
+ iface);
}
} else {
DisableIfaceOffloading(LiveGetDevice(iface), 0, 1);
}
try++;
}
- SCLogError("Threads number not equals");
+ SCLogError("thread number not equal");
SCReturnInt(TM_ECODE_FAILED);
}
mtu = GetIfaceMTU(ptv->iface);
out_mtu = GetIfaceMTU(ptv->out_iface);
if (mtu != out_mtu) {
- SCLogError("MTU on %s (%d) and %s (%d) are not equal, "
- "transmission of packets bigger than %d will fail.",
- ptv->iface, mtu, ptv->out_iface, out_mtu, (out_mtu > mtu) ? mtu : out_mtu);
+ SCLogWarning("MTU on %s (%d) and %s (%d) are not equal, "
+ "transmission of packets bigger than %d will fail.",
+ ptv->iface, mtu, ptv->out_iface, out_mtu, MIN(out_mtu, mtu));
}
peerslist.peered += 2;
break;
}
if (p->ethh == NULL) {
- SCLogWarning("Should have an Ethernet header");
+ SCLogWarning("packet should have an ethernet header");
return;
}
if (sendto(socket, GET_PKT_DATA(p), GET_PKT_LEN(p), 0, (struct sockaddr *)&socket_address,
sizeof(struct sockaddr_ll)) < 0) {
if (SC_ATOMIC_ADD(p->afp_v.peer->send_errors, 1) == 0) {
- SCLogWarning("sending packet failed on socket %d: %s", socket, strerror(errno));
+ SCLogWarning("%s: sending packet failed on socket %d: %s", p->afp_v.peer->iface, socket,
+ strerror(errno));
}
}
if (p->afp_v.peer->flags & AFP_SOCK_PROTECT)
/* Loop till we have packets available */
while (1) {
if (unlikely(suricata_ctl_flags != 0)) {
- SCLogInfo("Exiting AFP V3 read loop");
+ SCLogDebug("Exiting AFP V3 read loop");
break;
}
int r = poll(&fds, 1, POLL_TIMEOUT);
if (r > 0 &&
(fds.revents & (POLLHUP|POLLRDHUP|POLLERR|POLLNVAL))) {
- SCLogWarning(
- "poll failed %02x", fds.revents & (POLLHUP | POLLRDHUP | POLLERR | POLLNVAL));
+ SCLogWarning("%s: poll failed %02x", ptv->iface,
+ fds.revents & (POLLHUP | POLLRDHUP | POLLERR | POLLNVAL));
return 0;
} else if (r > 0) {
if (AFPPeersListStarted() && synctv.tv_sec == (time_t) 0xffffffff) {
int afp_activate_r = AFPCreateSocket(ptv, ptv->iface, 0);
if (afp_activate_r != 0) {
if (ptv->down_count % AFP_DOWN_COUNTER_INTERVAL == 0) {
- SCLogWarning("Can not open iface '%s'", ptv->iface);
+ SCLogWarning("%s: can't reopen interface", ptv->iface);
}
return afp_activate_r;
}
- SCLogInfo("Interface '%s' is back", ptv->iface);
+ SCLogInfo("%s: interface is back up", ptv->iface);
return 0;
}
if (r < 0) {
switch (-r) {
case AFP_FATAL_ERROR:
- SCLogError("Couldn't init AF_PACKET socket, fatal error");
+ SCLogError("%s: failed to init socket for interface", ptv->iface);
SCReturnInt(TM_ECODE_FAILED);
case AFP_RECOVERABLE_ERROR:
- SCLogWarning("Couldn't init AF_PACKET socket, retrying soon");
+ SCLogWarning(
+ "%s: failed to init socket for interface, retrying soon", ptv->iface);
}
}
AFPPeersListReachedInc();
/* Do a recv to get errno */
if (recv(ptv->socket, &c, sizeof c, MSG_PEEK) != -1)
continue; /* what, no error? */
- SCLogError("Error reading data from iface '%s': (%d) %s", ptv->iface, errno,
- strerror(errno));
+ SCLogWarning("%s: failed to poll interface: %s", ptv->iface, strerror(errno));
AFPSwitchState(ptv, AFP_STATE_DOWN);
continue;
} else if (fds.revents & POLLNVAL) {
- SCLogError("Invalid polling request");
+ SCLogWarning("%s: invalid poll request: %s", ptv->iface, strerror(errno));
AFPSwitchState(ptv, AFP_STATE_DOWN);
continue;
}
break;
case AFP_READ_FAILURE:
/* AFPRead in error: best to reset the socket */
- SCLogError("AFPRead error reading data from iface '%s': (%d) %s", ptv->iface,
- errno, strerror(errno));
+ SCLogWarning("%s: read failure: %s", ptv->iface, strerror(errno));
AFPSwitchState(ptv, AFP_STATE_DOWN);
continue;
case AFP_SURI_FAILURE:
} else if ((r < 0) && (errno != EINTR)) {
StatsIncr(ptv->tv, ptv->capture_afp_poll_err);
- SCLogError("Error reading data from iface '%s': (%d) %s", ptv->iface, errno,
- strerror(errno));
+ SCLogWarning("%s: poll failure: %s", ptv->iface, strerror(errno));
AFPSwitchState(ptv, AFP_STATE_DOWN);
continue;
}
strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
if (ioctl(fd, SIOCGIFFLAGS, &ifr) == -1) {
- SCLogError("Unable to find type for iface \"%s\": %s", ifname, strerror(errno));
+ SCLogError("%s: failed to get interface flags: %s", ifname, strerror(errno));
return -1;
}
if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) {
if (verbose)
- SCLogError("Unable to find iface %s: %s", ifname, strerror(errno));
+ SCLogError("%s: failed to find interface: %s", ifname, strerror(errno));
return -1;
}
strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) {
- SCLogError("Unable to find type for iface \"%s\": %s", ifname, strerror(errno));
+ SCLogError("%s: failed to find interface type: %s", ifname, strerror(errno));
return -1;
}
int fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if (fd == -1) {
- SCLogError("Couldn't create a AF_PACKET socket, error %s", strerror(errno));
+ SCLogError("%s: failed to create AF_PACKET socket: %s", ifname, strerror(errno));
return LINKTYPE_RAW;
}
if (snaplen == 0) {
snaplen = GetIfaceMaxPacketSize(ptv->iface);
if (snaplen <= 0) {
- SCLogWarning("Unable to get MTU, setting snaplen to sane default of 1514");
+ SCLogWarning("%s: unable to get MTU, setting snaplen default of 1514", ptv->iface);
snaplen = 1514;
}
}
ptv->req.v2.tp_block_size = getpagesize() << order;
int frames_per_block = ptv->req.v2.tp_block_size / ptv->req.v2.tp_frame_size;
if (frames_per_block == 0) {
- SCLogError("Frame size bigger than block size");
+ SCLogError("%s: Frame size bigger than block size", ptv->iface);
return -1;
}
ptv->req.v2.tp_frame_nr = ptv->ring_size;
ptv->req.v2.tp_block_nr = ptv->req.v2.tp_frame_nr / frames_per_block + 1;
/* exact division */
ptv->req.v2.tp_frame_nr = ptv->req.v2.tp_block_nr * frames_per_block;
- SCLogPerf("rx ring: block_size=%d block_nr=%d frame_size=%d frame_nr=%d",
+ SCLogPerf("%s: rx ring: block_size=%d block_nr=%d frame_size=%d frame_nr=%d", ptv->iface,
ptv->req.v2.tp_block_size, ptv->req.v2.tp_block_nr, ptv->req.v2.tp_frame_size,
ptv->req.v2.tp_frame_nr);
return 1;
if (snaplen == 0) {
snaplen = GetIfaceMaxPacketSize(ptv->iface);
if (snaplen <= 0) {
- SCLogWarning("Unable to get MTU, setting snaplen to sane default of 1514");
+ SCLogWarning("%s: unable to get MTU, setting snaplen default of 1514", ptv->iface);
snaplen = 1514;
}
}
frames_per_block = ptv->req.v3.tp_block_size / ptv->req.v3.tp_frame_size;
if (frames_per_block == 0) {
- SCLogError("Block size is too small, it should be at least %d", ptv->req.v3.tp_frame_size);
+ SCLogError("%s: block size is too small, it should be at least %d", ptv->iface,
+ ptv->req.v3.tp_frame_size);
return -1;
}
ptv->req.v3.tp_block_nr = ptv->ring_size / frames_per_block + 1;
ptv->req.v3.tp_frame_nr = ptv->req.v3.tp_block_nr * frames_per_block;
ptv->req.v3.tp_retire_blk_tov = ptv->block_timeout;
ptv->req.v3.tp_feature_req_word = TP_FT_REQ_FILL_RXHASH;
- SCLogPerf("AF_PACKET V3 RX Ring params: block_size=%d block_nr=%d frame_size=%d frame_nr=%d (mem: %d)",
- ptv->req.v3.tp_block_size, ptv->req.v3.tp_block_nr,
- ptv->req.v3.tp_frame_size, ptv->req.v3.tp_frame_nr,
- ptv->req.v3.tp_block_size * ptv->req.v3.tp_block_nr
- );
+ SCLogPerf("%s: rx ring params: block_size=%d block_nr=%d frame_size=%d frame_nr=%d (mem: %d)",
+ ptv->iface, ptv->req.v3.tp_block_size, ptv->req.v3.tp_block_nr,
+ ptv->req.v3.tp_frame_size, ptv->req.v3.tp_frame_nr,
+ ptv->req.v3.tp_block_size * ptv->req.v3.tp_block_nr);
return 1;
}
#endif
if (getsockopt(ptv->socket, SOL_PACKET, PACKET_HDRLEN, &val, &len) < 0) {
if (errno == ENOPROTOOPT) {
if (ptv->flags & AFP_TPACKET_V3) {
- SCLogError("Too old kernel giving up (need 3.2 for TPACKET_V3)");
+ SCLogError("%s: kernel too old for TPACKET_V3 (need 3.2+)", devname);
} else {
- SCLogError("Too old kernel giving up (need 2.6.27 at least)");
+ SCLogError("%s: kernel too old (need 2.6.27+)", devname);
}
}
- SCLogError("Error when retrieving packet header len");
+ SCLogError("%s: failed to retrieve packet header len", devname);
return AFP_FATAL_ERROR;
}
#endif
if (setsockopt(ptv->socket, SOL_PACKET, PACKET_VERSION, &val,
sizeof(val)) < 0) {
- SCLogError("Can't activate TPACKET_V2/TPACKET_V3 on packet socket: %s", strerror(errno));
+ SCLogError("%s: failed to activate TPACKET_V2/TPACKET_V3 on packet socket: %s", devname,
+ strerror(errno));
return AFP_FATAL_ERROR;
}
int req = SOF_TIMESTAMPING_RAW_HARDWARE;
if (setsockopt(ptv->socket, SOL_PACKET, PACKET_TIMESTAMP, (void *) &req,
sizeof(req)) < 0) {
- SCLogWarning("Can't activate hardware timestamping on packet socket: %s", strerror(errno));
+ SCLogWarning("%s: failed to activate hardware timestamping on packet socket: %s", devname,
+ strerror(errno));
}
#endif
int reserve = VLAN_HEADER_LEN;
if (setsockopt(ptv->socket, SOL_PACKET, PACKET_RESERVE, (void *)&reserve, sizeof(reserve)) <
0) {
- SCLogError("Can't activate reserve on packet socket: %s", strerror(errno));
+ SCLogError("%s: failed to activate reserve on packet socket: %s", devname, strerror(errno));
return AFP_FATAL_ERROR;
}
r = setsockopt(ptv->socket, SOL_PACKET, PACKET_RX_RING,
(void *) &ptv->req.v3, sizeof(ptv->req.v3));
if (r < 0) {
- SCLogError("Unable to allocate RX Ring for iface %s: (%d) %s", devname, errno,
- strerror(errno));
+ SCLogError("%s: failed to allocate RX Ring: %s", devname, strerror(errno));
return AFP_FATAL_ERROR;
}
} else {
#endif
for (order = AFP_BLOCK_SIZE_DEFAULT_ORDER; order >= 0; order--) {
if (AFPComputeRingParams(ptv, order) != 1) {
- SCLogInfo("Ring parameter are incorrect. Please correct the devel");
+ SCLogError("%s: ring parameters are incorrect. Please file a bug report", devname);
return AFP_FATAL_ERROR;
}
if (r < 0) {
if (errno == ENOMEM) {
- SCLogInfo("Memory issue with ring parameters. Retrying.");
+ SCLogWarning("%s: memory issue with ring parameters. Retrying", devname);
continue;
}
- SCLogError("Unable to setup RX Ring for iface %s: (%d) %s", devname, errno,
- strerror(errno));
+ SCLogError("%s: failed to setup RX Ring: %s", devname, strerror(errno));
return AFP_FATAL_ERROR;
} else {
break;
}
}
if (order < 0) {
- SCLogError("Unable to setup RX Ring for iface %s (order 0 failed)", devname);
+ SCLogError("%s: failed to setup RX Ring (order 0 failed)", devname);
return AFP_FATAL_ERROR;
}
#ifdef HAVE_TPACKET_V3
ptv->ring_buf = mmap(0, ptv->ring_buflen, PROT_READ|PROT_WRITE,
mmap_flag, ptv->socket, 0);
if (ptv->ring_buf == MAP_FAILED) {
- SCLogError("Unable to mmap, error %s", strerror(errno));
+ SCLogError("%s: failed to mmap: %s", devname, strerror(errno));
goto mmap_err;
}
#ifdef HAVE_TPACKET_V3
if (ptv->flags & AFP_TPACKET_V3) {
ptv->ring.v3 = SCMalloc(ptv->req.v3.tp_block_nr * sizeof(*ptv->ring.v3));
if (!ptv->ring.v3) {
- SCLogError("Unable to malloc ptv ring.v3");
+ SCLogError("%s: failed to alloc ring: %s", devname, strerror(errno));
goto postmmap_err;
}
for (i = 0; i < ptv->req.v3.tp_block_nr; ++i) {
/* allocate a ring for each frame header pointer*/
ptv->ring.v2 = SCCalloc(ptv->req.v2.tp_frame_nr, sizeof(union thdr *));
if (ptv->ring.v2 == NULL) {
- SCLogError("Unable to allocate frame buf");
+ SCLogError("%s: failed to alloc ring: %s", devname, strerror(errno));
goto postmmap_err;
}
/* fill the header ring with proper frame ptr*/
/* open socket */
ptv->socket = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if (ptv->socket == -1) {
- SCLogError("Couldn't create a AF_PACKET socket, error %s", strerror(errno));
+ SCLogError("%s: failed to create socket: %s", devname, strerror(errno));
goto error;
}
if_idx = AFPGetIfnumByDev(ptv->socket, devname, verbose);
-
if (if_idx == -1) {
goto socket_err;
}
bind_address.sll_ifindex = if_idx;
if (bind_address.sll_ifindex == -1) {
if (verbose)
- SCLogError("Couldn't find iface %s", devname);
+ SCLogWarning("%s: device for found", devname);
ret = AFP_RECOVERABLE_ERROR;
goto socket_err;
}
int if_flags = AFPGetDevFlags(ptv->socket, ptv->iface);
if (if_flags == -1) {
if (verbose) {
- SCLogError("Couldn't get flags for interface '%s'", ptv->iface);
+ SCLogWarning("%s: failed to get interface flags", ptv->iface);
}
ret = AFP_RECOVERABLE_ERROR;
goto socket_err;
} else if ((if_flags & (IFF_UP | IFF_RUNNING)) == 0) {
if (verbose) {
- SCLogError("Interface '%s' is down", ptv->iface);
+ SCLogWarning("%s: interface is down", ptv->iface);
}
ret = AFP_RECOVERABLE_ERROR;
goto socket_err;
sock_params.mr_ifindex = bind_address.sll_ifindex;
r = setsockopt(ptv->socket, SOL_PACKET, PACKET_ADD_MEMBERSHIP,(void *)&sock_params, sizeof(sock_params));
if (r < 0) {
- SCLogError(
- "Couldn't switch iface %s to promiscuous, error %s", devname, strerror(errno));
+ SCLogError("%s: failed to set promisc mode: %s", devname, strerror(errno));
goto socket_err;
}
}
int val = 1;
if (setsockopt(ptv->socket, SOL_PACKET, PACKET_AUXDATA, &val,
sizeof(val)) == -1 && errno != ENOPROTOOPT) {
- SCLogWarning("'kernel' checksum mode not supported, falling back to full mode.");
+ SCLogWarning(
+ "%s: 'kernel' checksum mode not supported, falling back to full mode", devname);
ptv->checksum_mode = CHECKSUM_VALIDATION_ENABLE;
}
}
/*
* Set the socket buffer size to the specified value.
*/
- SCLogPerf("Setting AF_PACKET socket buffer to %d", ptv->buffer_size);
+ SCLogPerf("%s: setting socket buffer to %d", devname, ptv->buffer_size);
if (setsockopt(ptv->socket, SOL_SOCKET, SO_RCVBUF,
&ptv->buffer_size,
sizeof(ptv->buffer_size)) == -1) {
- SCLogError("Couldn't set buffer size to %d on iface %s, error %s", ptv->buffer_size,
- devname, strerror(errno));
+ SCLogError("%s: failed to set buffer size to %d: %s", devname, ptv->buffer_size,
+ strerror(errno));
goto socket_err;
}
}
if (r < 0) {
if (verbose) {
if (errno == ENETDOWN) {
- SCLogError("Couldn't bind AF_PACKET socket, iface %s is down", devname);
+ SCLogWarning("%s: failed to bind socket, iface is down", devname);
} else {
- SCLogError("Couldn't bind AF_PACKET socket to iface %s, error %s", devname,
- strerror(errno));
+ SCLogWarning("%s: failed to bind socket: %s", devname, strerror(errno));
}
}
ret = AFP_RECOVERABLE_ERROR;
uint32_t option = (mode << 16) | (id & 0xffff);
r = setsockopt(ptv->socket, SOL_PACKET, PACKET_FANOUT,(void *)&option, sizeof(option));
if (r < 0) {
- SCLogError("Couldn't set fanout mode, error %s", strerror(errno));
+ SCLogError("%s: failed to set fanout mode: %s", devname, strerror(errno));
goto socket_err;
}
}
if (ptv->cluster_type == PACKET_FANOUT_EBPF) {
r = SockFanoutSeteBPF(ptv);
if (r < 0) {
- SCLogError("Coudn't set EBPF, error %s", strerror(errno));
+ SCLogError("%s: failed to set eBPF: %s", devname, strerror(errno));
goto socket_err;
}
}
if (!ptv->bpf_filter)
return TM_ECODE_OK;
- SCLogInfo("Using BPF '%s' on iface '%s'",
- ptv->bpf_filter,
- ptv->iface);
+ SCLogInfo("%s: using BPF '%s'", ptv->iface, ptv->bpf_filter);
char errbuf[PCAP_ERRBUF_SIZE];
if (SCBPFCompile(default_packet_size, /* snaplen_arg */
0, /* mask */
errbuf,
sizeof(errbuf)) == -1) {
- SCLogError("Failed to compile BPF \"%s\": %s", ptv->bpf_filter, errbuf);
+ SCLogError("%s: failed to compile BPF \"%s\": %s", ptv->iface, ptv->bpf_filter, errbuf);
return TM_ECODE_FAILED;
}
SCBPFFree(&filter);
if(rc == -1) {
- SCLogError("Failed to attach filter: %s", strerror(errno));
+ SCLogError("%s: failed to attach filter: %s", ptv->iface, strerror(errno));
return TM_ECODE_FAILED;
}
#ifdef PACKET_STATISTICS
AFPDumpCounters(ptv);
- SCLogPerf("(%s) Kernel: Packets %" PRIu64 ", dropped %" PRIu64 "",
- tv->name,
+ SCLogPerf("%s: (%s) kernel: Packets %" PRIu64 ", dropped %" PRIu64 "", ptv->iface, tv->name,
StatsGetLocalCounterValue(tv, ptv->capture_kernel_packets),
StatsGetLocalCounterValue(tv, ptv->capture_kernel_drops));
#endif
projects / thirdparty / suricata.git / commitdiff
