Project

General

Profile

Feature #507 » 0001-nfq-implement-fail-open-support.patch

Eric Leblond, 08/08/2012 08:53 AM

View differences:

configure.in
553 553
        AC_CHECK_LIB(netfilter_queue, nfq_open,, NFQ="no",)
554 554
        AC_CHECK_LIB([netfilter_queue], [nfq_set_queue_maxlen],AC_DEFINE_UNQUOTED([HAVE_NFQ_MAXLEN],[1],[Found queue max length support in netfilter_queue]) ,,[-lnfnetlink])
555 555
        AC_CHECK_LIB([netfilter_queue], [nfq_set_verdict2],AC_DEFINE_UNQUOTED([HAVE_NFQ_SET_VERDICT2],[1],[Found nfq_set_verdict2 function in netfilter_queue]) ,,[-lnfnetlink])
556
        AC_CHECK_LIB([netfilter_queue], [nfq_set_queue_flags],AC_DEFINE_UNQUOTED([HAVE_NFQ_SET_QUEUE_FLAGS],[1],[Found nfq_set_queue_flags function in netfilter_queue]) ,,[-lnfnetlink])
556 557

  
557 558
        # check if the argument to nfq_get_payload is signed or unsigned
558 559
        AC_MSG_CHECKING([for signed nfq_get_payload payload argument])
src/source-nfq.c
156 156
    NFQ_ROUTE_MODE,
157 157
} NFQMode;
158 158

  
159
#define NFQ_FLAG_FAIL_OPEN  1 << 0
160

  
159 161
typedef struct NFQCnf_ {
160 162
    NFQMode mode;
161 163
    uint32_t mark;
162 164
    uint32_t mask;
163 165
    uint32_t next_queue;
166
    uint32_t flags;
164 167
} NFQCnf;
165 168

  
166 169
NFQCnf nfq_config;
......
208 211
{
209 212
    intmax_t value = 0;
210 213
    char* nfq_mode = NULL;
214
    int boolval;
211 215

  
212 216
    SCLogDebug("Initializing NFQ");
213 217

  
......
228 232
        }
229 233
    }
230 234

  
235
    (void)ConfGetBool("nfq.fail-open", (int *)&boolval);
236
    if (boolval) {
237
        SCLogInfo("Enabling fail-open on queue");
238
        nfq_config.flags |= NFQ_FLAG_FAIL_OPEN;
239
    }
240

  
231 241
    if ((ConfGetInt("nfq.repeat-mark", &value)) == 1) {
232 242
        nfq_config.mark = (uint32_t)value;
233 243
    }
......
497 507
    setsockopt(nfq_q->fd, SOL_NETLINK, NETLINK_NO_ENOBUFS, &opt, sizeof(int));
498 508
#endif
499 509

  
510
#ifdef HAVE_NFQ_SET_QUEUE_FLAGS
511
    if (nfq_config.flags & NFQ_FLAG_FAIL_OPEN) {
512
        uint32_t flags = NFQA_CFG_F_FAIL_OPEN;
513
        uint32_t mask = NFQA_CFG_F_FAIL_OPEN;
514
        int r = nfq_set_queue_flags(nfq_q->qh, mask, flags);
515

  
516
        if (r == -1) {
517
            SCLogWarning(SC_ERR_NFQ_SET_MODE, "can't set fail-open mode: %s",
518
                         strerror(errno));
519
        } else {
520
            SCLogInfo("fail-open mode should be set on queue");
521
        }
522
    }
523
#endif
524

  
500 525
    /* set a timeout to the socket so we can check for a signal
501 526
     * in case we don't get packets for a longer period. */
502 527
    tv.tv_sec = 1;
suricata.yaml.in
189 189
# this mode, you need to set mode to 'repeat'
190 190
# If you want packet to be sent to another queue after an ACCEPT decision
191 191
# set mode to 'route' and set next-queue value.
192
# On linux >= 3.6, you can use the fail-open option to yes to have the kernel
193
# accept the packet if suricata is not able to keep pace.
192 194
nfq:
193 195
#  mode: accept
194 196
#  repeat-mark: 1
195 197
#  repeat-mask: 1
196 198
#  route-queue: 2
199
#  fail-open: yes
197 200

  
198 201
# af-packet support
199 202
# Set threads to > 1 to use PACKET_FANOUT support
200
- 
    (1-1/1)