snort: plugin rework 33/42933/27
authorDamjan Marion <[email protected]>
Tue, 6 May 2025 15:45:16 +0000 (17:45 +0200)
committerDamjan Marion <[email protected]>
Fri, 5 Sep 2025 10:33:41 +0000 (10:33 +0000)
commite070068b768cbd72173a945d9954d1200c69bb08
tree32cebc4e920363d1075fbe870327cf6fdefbf694
parentd5409a16476c92b98e366cdafdf9fa82a067f5d6
snort: plugin rework

Changes:
  - support for multiple qpairs per thread
  - ability for daq to connect to multiple instances
  - ability for daq to connect to specific qpairs
  - added ownership to each qpair to avoid multiple clients using same one
  - enabled packet rewrite
  - enqueue and dequeue nodes are decoupled from feature arcs so they
    can be used in different datapaths
  - feature arc doesn't support multiple-instances anymore, use multiple
    qpairs for load-balancing
  - per-instance drop decisions based on drop bitmap

sample snort invocation:

snort \
  <standard args> \
  --max-packet-threads 3 \  # number of threads snort will launch
  --daq-dir <daq dir> \     # path to dir with libdaq_bpp.so
  --daq vpp \               # enable VPP daq
  --daq-var <path> \        # optional, path to snort.sock
  --daq-var debug \         # optional, turn on debug prints
  -i vpp0:1 \               # attach instance to vpp0 instance qpair 1.0
  -i vpp0:1.1 \             # attach instance to vpp0 instance qpair 1.1
  -i vpp0:2.0,2.1,0 \       # attach instance to vpp0 instance qpairs 2.0, 2.1 and 0.0

qpair is identified as x.y where x is thread_id and y is queue_id, .y
part can be ommited if queue_id is 0.

Type: feature

Change-Id: I4f65b9a12ec71b115b9cb2da814c7918ddf6191d
Signed-off-by: Damjan Marion <[email protected]>
Signed-off-by: Mohsin Kazmi <[email protected]>
21 files changed:
build/external/Makefile
build/external/packages/daq.mk [new file with mode: 0644]
src/plugins/snort/CMakeLists.txt
src/plugins/snort/cli.c
src/plugins/snort/daq/config.c [new file with mode: 0644]
src/plugins/snort/daq/daq_vpp.h [new file with mode: 0644]
src/plugins/snort/daq/daq_vpp_shared.h [new file with mode: 0644]
src/plugins/snort/daq/main.c [new file with mode: 0644]
src/plugins/snort/daq/socket.c [new file with mode: 0644]
src/plugins/snort/daq_vpp.c [deleted file]
src/plugins/snort/daq_vpp.h [deleted file]
src/plugins/snort/dequeue.c
src/plugins/snort/enqueue.c
src/plugins/snort/export.h [new file with mode: 0644]
src/plugins/snort/format.c [new file with mode: 0644]
src/plugins/snort/interface.c [new file with mode: 0644]
src/plugins/snort/main.c
src/plugins/snort/snort.h
src/plugins/snort/snort_api.c
src/plugins/snort/socket.c [new file with mode: 0644]
test/test_snort.py