Go to the documentation of this file.
99 static char *active_runmode;
119 static const char *RunModeTranslateModeToName(
int runmode)
141 return "AF_PACKET_DEV";
148 return "NETMAP(DISABLED)";
151 return "UNIX_SOCKET";
156 return "WINDIVERT(DISABLED)";
162 return "DPDK(DISABLED)";
180 static RunMode *RunModeGetCustomMode(
enum SCRunModes runmode,
const char *custom_mode)
183 for (
int i = 0; i < runmodes[runmode].
cnt; i++) {
184 if (strcmp(runmodes[runmode].runmodes[i].
name, custom_mode) == 0)
185 return &runmodes[runmode].
runmodes[i];
201 return active_runmode;
215 return RunModeTranslateModeToName(mainmode);
223 memset(runmodes, 0,
sizeof(runmodes));
249 printf(
"------------------------------------- Runmodes -------------------"
250 "-----------------------\n");
252 printf(
"| %-17s | %-17s | %-10s \n",
253 "RunMode Type",
"Custom Mode ",
"Description");
254 printf(
"|-----------------------------------------------------------------"
255 "-----------------------\n");
259 int mode_displayed = 0;
260 for (j = 0; j < runmodes[i].
cnt; j++) {
261 if (mode_displayed == 1) {
262 printf(
"| ----------------------------------------------"
263 "-----------------------\n");
265 printf(
"| %-17s | %-17s | %-27s \n",
271 printf(
"| %-17s | %-17s | %-27s \n",
272 RunModeTranslateModeToName(runmode->
runmode),
276 if (mode_displayed == 0)
279 if (mode_displayed == 1) {
280 printf(
"|-----------------------------------------------------------------"
281 "-----------------------\n");
286 static const char *RunModeGetConfOrDefault(
int capture_mode,
const char *capture_plugin_name)
288 const char *custom_mode = NULL;
289 const char *val = NULL;
296 if ((custom_mode == NULL) || (strcmp(custom_mode,
"auto") == 0)) {
297 switch (capture_mode) {
307 if (plugin == NULL) {
308 FatalError(
"No capture plugin found with name %s", capture_plugin_name);
359 if (!strcmp(
"worker", custom_mode)) {
361 "to 'workers', please modify your setup.");
362 custom_mode =
"workers";
371 if (runmode == NULL) {
372 runmode = RunModeGetConfOrDefault(capture_mode, capture_plugin_name);
377 RunMode *mode = RunModeGetCustomMode(capture_mode, runmode);
385 if (ips_enabled == 1) {
388 SCLogWarning(
"disabling livedev.use-for-tracking with IPS mode. See ticket #6726.");
399 void RunModeDispatch(
int runmode,
const char *custom_mode,
const char *capture_plugin_name,
400 const char *capture_plugin_args)
402 char *local_custom_mode = NULL;
404 if (custom_mode == NULL) {
405 custom_mode = RunModeGetConfOrDefault(runmode, capture_plugin_name);
406 if (custom_mode == NULL)
410 RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
412 SCLogError(
"The custom type \"%s\" doesn't exist "
413 "for this runmode type \"%s\". Please use --list-runmodes to "
414 "see available custom types for this runmode",
415 custom_mode, RunModeTranslateModeToName(runmode));
420 if (active_runmode) {
423 active_runmode =
SCStrdup(custom_mode);
424 if (
unlikely(active_runmode == NULL)) {
428 if (strcasecmp(active_runmode,
"autofp") == 0) {
434 if (local_custom_mode != NULL)
435 SCFree(local_custom_mode);
453 static int g_runmode_needs_bypass = 0;
457 g_runmode_needs_bypass = 1;
462 return g_runmode_needs_bypass;
477 int (*RunModeFunc)(
void),
int (*RunModeIsIPSEnabled)(
void))
479 if (RunModeGetCustomMode(runmode,
name) != NULL) {
481 "been registered. Please use an unique name.",
485 void *ptmp =
SCRealloc(runmodes[runmode].runmodes,
486 (runmodes[runmode].
cnt + 1) *
sizeof(
RunMode));
488 SCFree(runmodes[runmode].runmodes);
495 runmodes[runmode].
cnt++;
496 memset(mode, 0x00,
sizeof(*mode));
517 static void RunOutputFreeList(
void)
520 while ((output =
TAILQ_FIRST(&output_free_list))) {
530 static int file_logger_count = 0;
531 static int filedata_logger_count = 0;
535 return filedata_logger_count > 0;
540 switch (run_mode_to_check) {
553 switch(run_mode_to_check) {
584 file_logger_count = 0;
585 filedata_logger_count = 0;
602 static void SetupOutput(
639 filedata_logger_count++;
654 static void RunModeInitializeEveOutput(
668 if (strcmp(
type->val,
"ikev2") == 0) {
669 SCLogWarning(
"eve module 'ikev2' has been replaced by 'ike'");
670 strlcpy(subname,
"eve-log.ike",
sizeof(subname));
672 snprintf(subname,
sizeof(subname),
"eve-log.%s",
type->val);
678 if (sub_output_config != NULL) {
688 if (strcmp(subname, sub_module->
conf_name) == 0) {
701 sub_module->
InitSubFunc(sub_output_config, parent_ctx);
702 if (!result.
ok || result.
ctx == NULL) {
703 FatalError(
"unable to initialize sub-module %s", subname);
706 AddOutputToFreeList(sub_module, result.
ctx);
707 SetupOutput(sub_module->
name, sub_module, result.
ctx, logger_bits);
720 static void RunModeInitializeLuaOutput(
724 BUG_ON(lua_module == NULL);
736 if (strcmp(script->
val,
m->conf_name) == 0) {
744 if (!result.
ok || result.
ctx == NULL) {
748 AddOutputToFreeList(
m, result.
ctx);
749 SetupOutput(
m->name,
m, result.
ctx, logger_bits);
762 if (outputs == NULL) {
769 char tls_log_enabled = 0;
770 char tls_store_present = 0;
778 if (output_config == NULL) {
780 FatalError(
"Failed to lookup configuration child node: %s", output->
val);
783 if (strcmp(output->
val,
"tls-store") == 0) {
784 tls_store_present = 1;
792 if (strcmp(output->
val,
"file-log") == 0) {
794 " use eve.files instead "
796 " for an explanation)");
798 }
else if (strncmp(output->
val,
"unified-",
sizeof(
"unified-") - 1) == 0) {
800 " use Unified2 instead "
802 " for an explanation)");
804 }
else if (strncmp(output->
val,
"unified2-",
sizeof(
"unified2-") - 1) == 0) {
807 }
else if (strcmp(output->
val,
"dns-log") == 0) {
808 SCLogWarning(
"dns-log is not longer available as of Suricata 5.0");
810 }
else if (strcmp(output->
val,
"tls-log") == 0) {
829 }
else if (r.
ctx == NULL) {
839 if (strcmp(output->
val,
"eve-log") == 0) {
840 RunModeInitializeEveOutput(output_config, output_ctx, logger_bits);
845 AddOutputToFreeList(module, output_ctx);
846 }
else if (strcmp(output->
val,
"lua") == 0) {
848 if (output_ctx == NULL)
850 RunModeInitializeLuaOutput(output_config, output_ctx, logger_bits);
851 AddOutputToFreeList(module, output_ctx);
853 AddOutputToFreeList(module, output_ctx);
854 SetupOutput(module->
name, module, output_ctx, logger_bits);
864 if (!tls_store_present && tls_log_enabled) {
867 SCLogWarning(
"Please use 'tls-store' in YAML to configure TLS storage");
872 if (strcmp(output->
val,
"tls-log") == 0) {
875 if (module == NULL) {
876 SCLogWarning(
"No output module named %s, ignoring",
"tls-store");
886 }
else if (r.
ctx == NULL) {
892 AddOutputToFreeList(module, output_ctx);
893 SetupOutput(module->
name, module, output_ctx, logger_bits);
906 SCLogDebug(
"IPPROTO_TCP::%s: g_file_logger_enabled %d g_filedata_logger_enabled %d -> "
918 if (logger_bits[a] == 0)
928 tcp ?
"true" :
"false", udp ?
"true" :
"false");
947 if ((
SCConfGetBool(
"threading.set-cpu-affinity", &affinity)) == 0) {
969 const char *ss = NULL;
970 if ((
SCConfGet(
"threading.stack-size", &ss)) == 1) {
973 FatalError(
"Failed to initialize thread_stack_size output, invalid limit: %s", ss);
978 pthread_attr_init(&attr);
980 if (pthread_attr_getstacksize(&attr, &size) == 0 && size < 512 * 1024) {
982 SCLogNotice(
"thread stack size of %" PRIuMAX
" too small: setting to 512k",
const char * thread_name_workers
const char * RunModeIpsIPFWGetDefaultMode(void)
void FlowManagerThreadSpawn(void)
spawn the flow manager thread
void AffinitySetupLoadFromConfig(void)
Extract cpu affinity configuration from current config file.
@ RUNMODE_ENGINE_ANALYSIS
void TmThreadsSealThreads(void)
const char * thread_name_counter_wakeup
int SCConfValIsTrue(const char *val)
Check if a value is true.
bool threading_set_cpu_affinity
void RunModeErfFileRegister(void)
void OutputStreamingShutdown(void)
int(* RunModeIsIPSEnabled)(void)
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
const char * thread_name_flow_mgr
const char * RunModeErfFileGetDefaultMode(void)
bool IsRunModeOffline(enum SCRunModes run_mode_to_check)
void OutputTxShutdown(void)
void TmqhFlowPrintAutofpHandler(void)
void RunModeIdsAFPRegister(void)
int ParseSizeStringU64(const char *size, uint64_t *res)
struct HtpBodyChunk_ * next
void BypassedFlowManagerThreadSpawn(void)
spawn the flow bypass manager thread
void RunModeShutDown(void)
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
const char * thread_name_counter_stats
int SCOutputRegisterStreamingLogger(LoggerId id, const char *name, SCStreamingLogger LogFunc, void *initdata, enum SCOutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a streaming logger.
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
const char * RunModeAFPGetDefaultMode(void)
const char * thread_name_flow_rec
void OutputFiledataShutdown(void)
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
const char * RunModeFilePcapGetDefaultMode(void)
#define TAILQ_FOREACH(var, head, field)
const char * thread_name_autofp
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
void OutputSetupActiveLoggers(void)
const char * RunModeIdsNflogGetDefaultMode(void)
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
void OutputStatsShutdown(void)
#define TAILQ_INSERT_TAIL(head, elm, field)
char * RunmodeGetActive(void)
OutputInitSubFunc InitSubFunc
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
int SCOutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow logger.
struct RunModes_ RunModes
PacketLogger PacketLogFunc
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
const char * RunModeAFXDPGetDefaultMode(void)
SCFiledataLogger FiledataLogFunc
void RunModeInitializeOutputs(void)
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
const char * thread_name_single
bool IsRunModeSystem(enum SCRunModes run_mode_to_check)
const char *(* GetDefaultMode)(void)
const char * SCRunModeLibGetDefaultMode(void)
runmode default mode (live)
void OutputClearActiveLoggers(void)
size_t strlcpy(char *dst, const char *src, size_t siz)
#define TAILQ_ENTRY(type)
const char * RunModeUnixSocketGetDefaultMode(void)
void RunModeIpsNFQRegister(void)
enum SCOutputStreamingType stream_type
void RunModeInitializeThreadSettings(void)
ThreadInitFunc ThreadInit
const char * RunModeDpdkGetDefaultMode(void)
#define TAILQ_HEAD_INITIALIZER(head)
OutputModuleList output_modules
#define TAILQ_REMOVE(head, elm, field)
SCRunMode SCRunmodeGet(void)
Get the current run mode.
#define TAILQ_FIRST(head)
const char * thread_name_flow_bypass
ThreadDeinitFunc ThreadDeinit
void RunModeListRunmodes(void)
Lists all registered runmodes.
bool g_filedata_logger_enabled
uint64_t threading_set_stack_size
void RunModeEnablesBypassManager(void)
void OutputPacketShutdown(void)
void RunModeIdsNflogRegister(void)
Holds description for a runmode.
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
void RunModeIpsIPFWRegister(void)
SCStreamingLogger StreamingLogFunc
#define SCLogWarning(...)
Macro used to log WARNING messages.
const char * RunModeErfDagGetDefaultMode(void)
int SCOutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, void *initdata, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a transaction logger.
const char * thread_name_detect_loader
void OutputFileShutdown(void)
void RunModeRegisterNewRunMode(enum SCRunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), int(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
void FlowRecyclerThreadSpawn(void)
spawn the flow recycler thread
void RunModeErfDagRegister(void)
struct RunMode_ RunMode
Holds description for a runmode.
int SCOutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet logger.
int SCOutputRegisterFileLogger(LoggerId id, const char *name, SCFileLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file logger.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
void RunModeIpsWinDivertRegister(void)
#define SCRealloc(ptr, sz)
SCConfNode * SCConfNodeLookupChild(const SCConfNode *node, const char *name)
Lookup a child configuration node by name.
void RunModeIdsAFXDPRegister(void)
TxLoggerCondition TxLogCondition
void RunModeUnixSocketRegister(void)
void LogFlushThreads(void)
void(* DeInit)(struct OutputCtx_ *)
const char * thread_name_heartbeat
#define FatalErrorOnInit(...)
Fatal error IF we're starting up, and configured to consider errors to be fatal errors.
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
int RunModeNeedsBypassManager(void)
bool g_file_logger_enabled
void RunModeIdsPcapRegister(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
void RunModeFilePcapRegister(void)
PacketLogCondition PacketConditionFunc
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
const char * RunModeNetmapGetDefaultMode(void)
const char * RunModeIpsNFQGetDefaultMode(void)
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
#define SCLogError(...)
Macro used to log ERROR messages.
void RunModeIdsNetmapRegister(void)
struct OutputFreeList_ OutputFreeList
const char * thread_name_verdict
void RunModeDpdkRegister(void)
#define TAILQ_HEAD(name, type)
void OutputFlowShutdown(void)
int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
int SCOutputRegisterFiledataLogger(LoggerId id, const char *name, SCFiledataLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file-data logger.
const char * thread_name_unix_socket
OutputModule * output_module
const char * RunModeGetMainMode(void)
int RunModeOutputFiledataEnabled(void)
int LiveGetDeviceCount(void)
Get the number of registered devices.
void SCRunModeLibIdsRegister(void)
register runmodes for suricata as a library
#define SCLogNotice(...)
Macro used to log NOTICE messages.
void UtRunModeRegister(void)
const char * RunModeIpsWinDivertGetDefaultMode(void)
int SCConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
SCCapturePlugin * SCPluginFindCaptureByName(const char *name)
float threading_detect_ratio
const char * RunModeIdsGetDefaultMode(void)