LOCAL void *reader_snf_thread(gpointer ring)
{
struct snf_recv_req req;
while (!config.quitting) {
int err = snf_ring_recv(ring, -1, &req);
if (err) {
if (err == EBUSY || err == EAGAIN || err == EINTR)
continue;
LOG("SNF quiting %d", err);
moloch_quit();
break;
}
MolochPacket_t *packet = MOLOCH_TYPE_ALLOC0(MolochPacket_t);
packet->pkt = (u_char *)req.pkt_addr;
packet->ts.tv_sec = req.timestamp / 1000000000;
packet->ts.tv_usec = req.timestamp % 1000000000000;
packet->pktlen = req.length;
moloch_packet(packet);
}
return NULL;
}
void reader_libpcapfile_start() {
reader_libpcapfile_next();
if (!pcap) {
if (config.pcapMonitor) {
g_timeout_add(100, reader_libpcapfile_monitor_gfunc, 0);
} else {
moloch_quit();
}
}
}
LOCAL gboolean reader_libpcapfile_read()
{
// pause reading if too many waiting disk operations
if (moloch_writer_queue_length() > 10) {
return TRUE;
}
// pause reading if too many waiting ES operations
if (moloch_http_queue_length(esServer) > 50) {
return TRUE;
}
// pause reading if too many packets are waiting to be processed
if (moloch_packet_outstanding() > (int32_t)(config.maxPacketsInQueue/3)) {
return TRUE;
}
int r;
if (pktsToRead > 0) {
r = pcap_dispatch(pcap, MIN(pktsToRead, 5000), reader_libpcapfile_pcap_cb, NULL);
if (r > 0)
pktsToRead -= r;
if (pktsToRead == 0)
r = 0;
} else {
r = pcap_dispatch(pcap, 5000, reader_libpcapfile_pcap_cb, NULL);
}
moloch_packet_batch_flush(&batch);
// Some kind of failure, move to the next file or quit
if (r <= 0) {
if (config.pcapDelete && r == 0) {
if (config.debug)
LOG("Deleting %s", offlinePcapFilename);
int rc = unlink(offlinePcapFilename);
if (rc != 0)
LOG("Failed to delete file %s %s (%d)", offlinePcapFilename, strerror(errno), errno);
}
pcap_close(pcap);
if (reader_libpcapfile_next()) {
return FALSE;
}
if (config.pcapMonitor)
g_timeout_add(100, reader_libpcapfile_monitor_gfunc, 0);
else
moloch_quit();
return FALSE;
}
return TRUE;
}
static void *reader_pfring_thread(void *ringv)
{
pfring *ring = ringv;
while (1) {
int r = pfring_loop(ring, reader_pfring_packet_cb, NULL, -1);
// Some kind of failure we quit
if (unlikely(r <= 0)) {
moloch_quit();
ring = 0;
break;
}
}
return NULL;
}
static void *reader_libpcap_thread(gpointer pcapv)
{
pcap_t *pcap = pcapv;
LOG("THREAD %p", (gpointer)pthread_self());
while (1) {
int r = pcap_loop(pcap, -1, reader_libpcap_pcap_cb, NULL);
// Some kind of failure we quit
if (unlikely(r <= 0)) {
moloch_quit();
pcap = 0;
break;
}
}
//ALW - Need to close after packet finishes
//pcap_close(pcap);
return NULL;
}
LOCAL void reader_libpcapfile_start() {
// Compile all the filename ops. The formation is fieldexpr=value%value
// value is expanded using the g_regex_replace rules (\1 being the first capture group)
// https://developer.gnome.org/glib/stable/glib-Perl-compatible-regular-expressions.html#g-regex-replace
char **filenameOpsStr;
filenameOpsStr = moloch_config_str_list(NULL, "filenameOps", "");
int i;
for (i = 0; filenameOpsStr && filenameOpsStr[i] && i < 100; i++) {
if (!filenameOpsStr[i][0])
continue;
char *equal = strchr(filenameOpsStr[i], '=');
if (!equal) {
LOGEXIT("Must be FieldExpr=regex%%value, missing equal '%s'", filenameOpsStr[i]);
}
char *percent = strchr(equal+1, '%');
if (!percent) {
LOGEXIT("Must be FieldExpr=regex%%value, missing percent '%s'", filenameOpsStr[i]);
}
*equal = 0;
*percent = 0;
int elen = strlen(equal+1);
if (!elen) {
LOGEXIT("Must be FieldExpr=regex%%value, empty regex for '%s'", filenameOpsStr[i]);
}
int vlen = strlen(percent+1);
if (!vlen) {
LOGEXIT("Must be FieldExpr=regex%%value, empty value for '%s'", filenameOpsStr[i]);
}
int fieldPos = moloch_field_by_exp(filenameOpsStr[i]);
if (fieldPos == -1) {
LOGEXIT("Must be FieldExpr=regex?value, Unknown field expression '%s'", filenameOpsStr[i]);
}
filenameOps[filenameOpsNum].regex = g_regex_new(equal+1, 0, 0, 0);
filenameOps[filenameOpsNum].expand = g_strdup(percent+1);
if (!filenameOps[filenameOpsNum].regex)
LOGEXIT("Couldn't compile regex '%s'", equal+1);
filenameOps[filenameOpsNum].field = fieldPos;
filenameOpsNum++;
}
g_strfreev(filenameOpsStr);
// Now actually start
reader_libpcapfile_next();
if (!pcap) {
if (config.pcapMonitor) {
g_timeout_add(100, reader_libpcapfile_monitor_gfunc, 0);
} else {
moloch_quit();
}
}
}
void controlc(int UNUSED(sig))
{
LOG("Control-C");
signal(SIGINT, exit); // Double Control-C quits right away
moloch_quit();
}
