Hello Luca, and all
I efforted to make easier to compile PF_RING enabled libpcap, so I
edited configure.in.
The attached patch includes configure.in for libpcap-0.9.7
Following steps is needed before make:
1. fetch the original libpcap-0.9.7.tar.gz, and extract it, and patch
the attached patch.
2. autoreconf -if
3. ./configure --with-pfring=DIR which is subversion check out directory.
regards,
Hitoshi IRINO
diff -Naru libpcap-0.9.7/configure.in libpcap-0.9.7-ring3/configure.in
--- libpcap-0.9.7/configure.in 2007-07-05 22:56:00.000000000 +0900
+++ libpcap-0.9.7-ring3/configure.in 2007-08-16 01:35:00.000000000 +0900
@@ -433,6 +433,14 @@
dag_lib_dir=$withval
],[])
+# Check for PF_RING support.
+AC_ARG_WITH([pfring], [ --with-pfring=DIR include PF_RING support],
+[
+ AC_DEFINE(HAVE_PF_RING,1,[pfring])
+ V_INCLS="$V_INCLS -I$withval/kernel/include
-I$withval/userland/libpfring"
+ V_LIBS="$V_LIBS $withval/userland/libpfring/pfring.o"
+],[])
+
case "$V_PCAP" in
linux|bpf|dag)
#
diff -Naru libpcap-0.9.7/pcap-int.h libpcap-0.9.7-ring3/pcap-int.h
--- libpcap-0.9.7/pcap-int.h 2007-07-05 22:56:00.000000000 +0900
+++ libpcap-0.9.7-ring3/pcap-int.h 2007-08-16 01:35:00.000000000 +0900
@@ -51,6 +51,11 @@
#include <io.h>
#endif
+#ifdef HAVE_PF_RING
+#define HAVE_PCAP
+#include "pfring.h"
+#endif
+
/*
* Swap byte ordering of unsigned long long timestamp on a big endian
* machine.
@@ -204,6 +209,10 @@
u_int *dlt_list;
struct pcap_pkthdr pcap_header; /* This is needed for the
pcap_next_ex() to work */
+
+#ifdef HAVE_PF_RING
+ pfring *ring;
+#endif
};
/*
diff -Naru libpcap-0.9.7/pcap-linux.c libpcap-0.9.7-ring3/pcap-linux.c
--- libpcap-0.9.7/pcap-linux.c 2007-06-12 04:34:28.000000000 +0900
+++ libpcap-0.9.7-ring3/pcap-linux.c 2007-08-16 01:35:00.000000000 +0900
@@ -270,6 +270,19 @@
handle->snapshot = snaplen;
handle->md.timeout = to_ms;
+#ifdef HAVE_PF_RING
+ handle->ring = pfring_open((char*)device, promisc);
+
+ if(handle->ring != NULL) {
+ handle->fd = handle->ring->fd;
+ handle->bufsize = handle->snapshot;
+ handle->linktype = DLT_EN10MB;
+ handle->offset = 2;
+
+ /* printf("Open HAVE_PF_RING(%s)\n", device); */
+ } else {
+ /* printf("Open HAVE_PF_RING(%s) failed. Fallback to pcap\n",
device); */
+#endif
/*
* NULL and "any" are special devices which give us the hint to
* monitor all devices.
@@ -406,6 +419,9 @@
}
handle->bufsize = handle->snapshot;
}
+#ifdef HAVE_PF_RING
+ }
+#endif
/* Allocate the buffer */
@@ -472,6 +488,39 @@
int packet_len, caplen;
struct pcap_pkthdr pcap_header;
+#ifdef HAVE_PF_RING
+ if(handle->ring) {
+ retry:
+
+ if (handle->break_loop) {
+ /*
+ * Yes - clear the flag that indicates that it
+ * has, and return -2 as an indication that we
+ * were told to break out of the loop.
+ *
+ * Patch courtesy of Michael Stiller <[EMAIL PROTECTED]>
+ */
+ handle->break_loop = 0;
+ return -2;
+ }
+
+ packet_len = pfring_recv(handle->ring, (char*)handle->buffer,
+ handle->bufsize,
+ (struct pfring_pkthdr*)&pcap_header,
+ 1 /* wait_for_incoming_packet */);
+ if (packet_len > 0) {
+ bp = handle->buffer;
+ pcap_header.caplen = min(pcap_header.caplen, handle->bufsize);
+ caplen = pcap_header.caplen, packet_len = pcap_header.len;
+ goto pfring_pcap_read_packet;
+ } else if (packet_len == -1 && errno == EINTR)
+ goto retry;
+ else
+ return(-1);
+ }
+
+#endif
+
#ifdef HAVE_PF_PACKET_SOCKETS
/*
* If this is a cooked device, leave extra room for a
@@ -632,6 +681,10 @@
}
#endif
+#ifdef HAVE_PF_RING
+ pfring_pcap_read_packet:
+#endif
+
/*
* XXX: According to the kernel source we should get the real
* packet len if calling recvfrom with MSG_TRUNC set. It does
@@ -678,6 +731,9 @@
}
}
+#ifdef HAVE_PF_RING
+ if(!handle->ring) {
+#endif
/* Fill in our own header data */
if (ioctl(handle->fd, SIOCGSTAMP, &pcap_header.ts) == -1) {
@@ -687,6 +743,9 @@
}
pcap_header.caplen = caplen;
pcap_header.len = packet_len;
+#ifdef HAVE_PF_RING
+ }
+#endif
/*
* Count the packet.
@@ -1702,6 +1761,13 @@
struct pcap *p, *prevp;
struct ifreq ifr;
+#ifdef HAVE_PF_RING
+ if(handle->ring) {
+ pfring_close(handle->ring);
+ return;
+ }
+#endif
+
if (handle->md.clear_promisc) {
/*
* We put the interface into promiscuous mode; take
@@ -2141,7 +2207,13 @@
* the filtering done in userland even if it could have been
* done in the kernel.
*/
- if (setsockopt(handle->fd, SOL_SOCKET, SO_ATTACH_FILTER,
+ if (setsockopt(handle->fd,
+#ifdef HAVE_PF_RING
+ 0,
+#else
+ SOL_SOCKET,
+#endif
+ SO_ATTACH_FILTER,
&total_fcode, sizeof(total_fcode)) == 0) {
char drain[1];
@@ -2150,6 +2222,7 @@
*/
total_filter_on = 1;
+#ifndef HAVE_PF_RING
/*
* Save the socket's current mode, and put it in
* non-blocking mode; we drain it by reading packets
@@ -2172,12 +2245,19 @@
return -2;
}
}
+#endif
}
/*
* Now attach the new filter.
*/
- ret = setsockopt(handle->fd, SOL_SOCKET, SO_ATTACH_FILTER,
+ ret = setsockopt(handle->fd,
+#ifdef HAVE_PF_RING
+ 0,
+#else
+ SOL_SOCKET,
+#endif
+ SO_ATTACH_FILTER,
fcode, sizeof(*fcode));
if (ret == -1 && total_filter_on) {
/*
@@ -2219,3 +2299,9 @@
&dummy, sizeof(dummy));
}
#endif
+
+#ifdef HAVE_PF_RING
+int pcap_set_cluster(pfring *ring, u_int clusterId) {
return(pfring_set_cluster(ring, clusterId)); }
+int pcap_remove_from_cluster(pfring *ring) {
return(pfring_remove_from_cluster(ring)); }
+int pcap_set_reflector(pfring *ring, char *reflectorDevice) {
return(pfring_set_reflector(ring, reflectorDevice)); }
+#endif
_______________________________________________
Ntop-dev mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-dev
