Go to the documentation of this file.
97 static char *active_runmode;
117 static const char *RunModeTranslateModeToName(
int runmode)
141 return "AF_PACKET_DEV";
148 return "NETMAP(DISABLED)";
151 return "UNIX_SOCKET";
156 return "WINDIVERT(DISABLED)";
162 return "DPDK(DISABLED)";
178 static RunMode *RunModeGetCustomMode(
enum RunModes runmode,
const char *custom_mode)
181 for (
int i = 0; i < runmodes[runmode].cnt; i++) {
182 if (strcmp(runmodes[runmode].runmodes[i].name, custom_mode) == 0)
183 return &runmodes[runmode].runmodes[i];
199 return active_runmode;
213 return RunModeTranslateModeToName(mainmode);
221 memset(runmodes, 0,
sizeof(runmodes));
247 printf(
"------------------------------------- Runmodes -------------------"
248 "-----------------------\n");
250 printf(
"| %-17s | %-17s | %-10s \n",
251 "RunMode Type",
"Custom Mode ",
"Description");
252 printf(
"|-----------------------------------------------------------------"
253 "-----------------------\n");
257 int mode_displayed = 0;
258 for (j = 0; j < runmodes[i].cnt; j++) {
259 if (mode_displayed == 1) {
260 printf(
"| ----------------------------------------------"
261 "-----------------------\n");
262 RunMode *runmode = &runmodes[i].runmodes[j];
263 printf(
"| %-17s | %-17s | %-27s \n",
268 RunMode *runmode = &runmodes[i].runmodes[j];
269 printf(
"| %-17s | %-17s | %-27s \n",
270 RunModeTranslateModeToName(runmode->
runmode),
274 if (mode_displayed == 0)
277 if (mode_displayed == 1) {
278 printf(
"|-----------------------------------------------------------------"
279 "-----------------------\n");
284 static const char *RunModeGetConfOrDefault(
int capture_mode,
const char *capture_plugin_name)
286 const char *custom_mode = NULL;
287 const char *val = NULL;
288 if (
ConfGet(
"runmode", &val) != 1) {
294 if ((custom_mode == NULL) || (strcmp(custom_mode,
"auto") == 0)) {
295 switch (capture_mode) {
305 if (plugin == NULL) {
306 FatalError(
"No capture plugin found with name %s", capture_plugin_name);
357 if (!strcmp(
"worker", custom_mode)) {
359 "to 'workers', please modify your setup.");
360 custom_mode =
"workers";
369 if (runmode == NULL) {
370 runmode = RunModeGetConfOrDefault(capture_mode, capture_plugin_name);
375 RunMode *mode = RunModeGetCustomMode(capture_mode, runmode);
383 if (ips_enabled == 1) {
386 SCLogWarning(
"disabling livedev.use-for-tracking with IPS mode. See ticket #6726.");
397 void RunModeDispatch(
int runmode,
const char *custom_mode,
const char *capture_plugin_name,
398 const char *capture_plugin_args)
400 char *local_custom_mode = NULL;
402 if (custom_mode == NULL) {
403 custom_mode = RunModeGetConfOrDefault(runmode, capture_plugin_name);
404 if (custom_mode == NULL)
408 RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
410 SCLogError(
"The custom type \"%s\" doesn't exist "
411 "for this runmode type \"%s\". Please use --list-runmodes to "
412 "see available custom types for this runmode",
413 custom_mode, RunModeTranslateModeToName(runmode));
418 if (active_runmode) {
421 active_runmode =
SCStrdup(custom_mode);
422 if (
unlikely(active_runmode == NULL)) {
426 if (strcasecmp(active_runmode,
"autofp") == 0) {
432 if (local_custom_mode != NULL)
433 SCFree(local_custom_mode);
449 static int g_runmode_needs_bypass = 0;
453 g_runmode_needs_bypass = 1;
458 return g_runmode_needs_bypass;
473 int (*RunModeFunc)(
void),
int (*RunModeIsIPSEnabled)(
void))
475 if (RunModeGetCustomMode(runmode, name) != NULL) {
477 "been registered. Please use an unique name.",
481 void *ptmp =
SCRealloc(runmodes[runmode].runmodes,
482 (runmodes[runmode].
cnt + 1) *
sizeof(
RunMode));
484 SCFree(runmodes[runmode].runmodes);
485 runmodes[runmode].runmodes = NULL;
488 runmodes[runmode].runmodes = ptmp;
490 RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].cnt];
491 runmodes[runmode].cnt++;
492 memset(mode, 0x00,
sizeof(*mode));
513 static void RunOutputFreeList(
void)
516 while ((output =
TAILQ_FIRST(&output_free_list))) {
526 static int file_logger_count = 0;
527 static int filedata_logger_count = 0;
532 return filedata_logger_count > 0;
537 switch (run_mode_to_check) {
550 switch(run_mode_to_check) {
581 file_logger_count = 0;
582 filedata_logger_count = 0;
642 filedata_logger_count++;
673 if (strcmp(
type->val,
"ikev2") == 0) {
674 SCLogWarning(
"eve module 'ikev2' has been replaced by 'ike'");
675 strlcpy(subname,
"eve-log.ike",
sizeof(subname));
677 snprintf(subname,
sizeof(subname),
"eve-log.%s",
type->val);
683 if (sub_output_config != NULL) {
685 sub_output_config,
"enabled");
694 if (strcmp(subname, sub_module->
conf_name) == 0) {
707 sub_module->
InitSubFunc(sub_output_config, parent_ctx);
708 if (!result.
ok || result.
ctx == NULL) {
709 FatalError(
"unable to initialize sub-module %s", subname);
712 AddOutputToFreeList(sub_module, result.
ctx);
713 SetupOutput(sub_module->
name, sub_module,
730 BUG_ON(lua_module == NULL);
742 if (strcmp(script->
val,
m->conf_name) == 0) {
750 if (!result.
ok || result.
ctx == NULL) {
754 AddOutputToFreeList(
m, result.
ctx);
755 SetupOutput(
m->name,
m, result.
ctx);
768 if (outputs == NULL) {
775 char tls_log_enabled = 0;
776 char tls_store_present = 0;
778 memset(&logger_bits, 0,
sizeof(logger_bits));
783 if (output_config == NULL) {
785 FatalError(
"Failed to lookup configuration child node: %s", output->
val);
788 if (strcmp(output->
val,
"tls-store") == 0) {
789 tls_store_present = 1;
797 if (strcmp(output->
val,
"file-log") == 0) {
799 " use eve.files instead "
801 " for an explanation)");
803 }
else if (strncmp(output->
val,
"unified-",
sizeof(
"unified-") - 1) == 0) {
805 " use Unified2 instead "
807 " for an explanation)");
809 }
else if (strncmp(output->
val,
"unified2-",
sizeof(
"unified2-") - 1) == 0) {
812 }
else if (strcmp(output->
val,
"dns-log") == 0) {
813 SCLogWarning(
"dns-log is not longer available as of Suricata 5.0");
815 }
else if (strcmp(output->
val,
"tls-log") == 0) {
834 }
else if (r.
ctx == NULL) {
844 if (strcmp(output->
val,
"eve-log") == 0) {
845 RunModeInitializeEveOutput(output_config, output_ctx);
850 AddOutputToFreeList(module, output_ctx);
851 }
else if (strcmp(output->
val,
"lua") == 0) {
853 if (output_ctx == NULL)
855 RunModeInitializeLuaOutput(output_config, output_ctx);
856 AddOutputToFreeList(module, output_ctx);
858 AddOutputToFreeList(module, output_ctx);
859 SetupOutput(module->
name, module, output_ctx);
869 if (!tls_store_present && tls_log_enabled) {
872 SCLogWarning(
"Please use 'tls-store' in YAML to configure TLS storage");
877 if (strcmp(output->
val,
"tls-log") == 0) {
880 if (module == NULL) {
881 SCLogWarning(
"No output module named %s, ignoring",
"tls-store");
891 }
else if (r.
ctx == NULL) {
897 AddOutputToFreeList(module, output_ctx);
898 SetupOutput(module->
name, module, output_ctx);
911 SCLogDebug(
"IPPROTO_TCP::%s: g_file_logger_enabled %d g_filedata_logger_enabled %d -> "
923 if (logger_bits[a] == 0)
933 tcp ?
"true" :
"false", udp ?
"true" :
"false");
953 if ((
ConfGetBool(
"threading.set-cpu-affinity", &affinity)) == 0) {
964 if (
ConfGetNode(
"threading.detect-thread-ratio") != NULL)
975 const char *ss = NULL;
976 if ((
ConfGet(
"threading.stack-size", &ss)) == 1) {
979 FatalError(
"Failed to initialize thread_stack_size output, invalid limit: %s", ss);
984 pthread_attr_init(&attr);
986 if (pthread_attr_getstacksize(&attr, &size) == 0 && size < 512 * 1024) {
988 SCLogNotice(
"thread stack size of %" PRIuMAX
" to too small: setting to 512k",
const char * thread_name_workers
const char * RunModeIpsIPFWGetDefaultMode(void)
void FlowManagerThreadSpawn(void)
spawn the flow manager thread
int OutputRegisterStreamingLogger(LoggerId id, const char *name, StreamingLogger LogFunc, OutputCtx *output_ctx, enum OutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
void AffinitySetupLoadFromConfig(void)
Extract cpu affinity configuration from current config file.
const char * thread_name_counter_wakeup
int SCRunmodeGet(void)
Get the current run mode.
bool threading_set_cpu_affinity
void RunModeErfFileRegister(void)
void OutputStreamingShutdown(void)
int(* RunModeIsIPSEnabled)(void)
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
const char * thread_name_flow_mgr
const char * RunModeErfFileGetDefaultMode(void)
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
void OutputTxShutdown(void)
void TmqhFlowPrintAutofpHandler(void)
void RunModeIdsAFPRegister(void)
int ParseSizeStringU64(const char *size, uint64_t *res)
struct HtpBodyChunk_ * next
void BypassedFlowManagerThreadSpawn(void)
spawn the flow bypass manager thread
int OutputRegisterFileLogger(LoggerId id, const char *name, FileLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
void RunModeShutDown(void)
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
const char * thread_name_counter_stats
StreamingLogger StreamingLogFunc
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
const char * RunModeAFPGetDefaultMode(void)
const char * thread_name_flow_rec
void OutputFiledataShutdown(void)
const char * RunModeFilePcapGetDefaultMode(void)
#define TAILQ_FOREACH(var, head, field)
const char * thread_name_autofp
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
void OutputSetupActiveLoggers(void)
const char * RunModeIdsNflogGetDefaultMode(void)
void OutputStatsShutdown(void)
#define TAILQ_INSERT_TAIL(head, elm, field)
char * RunmodeGetActive(void)
OutputInitSubFunc InitSubFunc
struct RunModes_ RunModes
PacketLogger PacketLogFunc
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
const char * RunModeAFXDPGetDefaultMode(void)
bool IsRunModeOffline(enum RunModes run_mode_to_check)
void RunModeInitializeOutputs(void)
const char * thread_name_single
const char *(* GetDefaultMode)(void)
int ConfValIsTrue(const char *val)
Check if a value is true.
void OutputClearActiveLoggers(void)
enum OutputStreamingType stream_type
size_t strlcpy(char *dst, const char *src, size_t siz)
int OutputRegisterFiledataLogger(LoggerId id, const char *name, FiledataLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
#define TAILQ_ENTRY(type)
const char * RunModeUnixSocketGetDefaultMode(void)
int OutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
void RunModeIpsNFQRegister(void)
void RunModeInitializeThreadSettings(void)
int OutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, OutputCtx *output_ctx, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, void(*ThreadExitPrintStats)(ThreadVars *, void *))
ThreadInitFunc ThreadInit
const char * RunModeDpdkGetDefaultMode(void)
#define TAILQ_HEAD_INITIALIZER(head)
bool IsRunModeSystem(enum RunModes run_mode_to_check)
OutputModuleList output_modules
#define TAILQ_REMOVE(head, elm, field)
FiledataLogger FiledataLogFunc
#define TAILQ_FIRST(head)
const char * thread_name_flow_bypass
ThreadDeinitFunc ThreadDeinit
void RunModeListRunmodes(void)
Lists all registered runmodes.
bool g_filedata_logger_enabled
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), int(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
uint64_t threading_set_stack_size
void RunModeEnablesBypassManager(void)
void OutputPacketShutdown(void)
void RunModeIdsNflogRegister(void)
Holds description for a runmode.
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
void RunModeIpsIPFWRegister(void)
#define SCLogWarning(...)
Macro used to log WARNING messages.
const char * RunModeErfDagGetDefaultMode(void)
const char * thread_name_detect_loader
void OutputFileShutdown(void)
void FlowRecyclerThreadSpawn(void)
spawn the flow recycler thread
void RunModeErfDagRegister(void)
ThreadExitPrintStatsFunc ThreadExitPrintStats
struct RunMode_ RunMode
Holds description for a runmode.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
void RunModeIpsWinDivertRegister(void)
#define SCRealloc(ptr, sz)
const char * RunModeNapatechGetDefaultMode(void)
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
void RunModeIdsAFXDPRegister(void)
int ConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
TxLoggerCondition TxLogCondition
void RunModeUnixSocketRegister(void)
void(* DeInit)(struct OutputCtx_ *)
#define FatalErrorOnInit(...)
Fatal error IF we're starting up, and configured to consider errors to be fatal errors.
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
int RunModeNeedsBypassManager(void)
bool g_file_logger_enabled
void RunModeIdsPcapRegister(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
void RunModeFilePcapRegister(void)
PacketLogCondition PacketConditionFunc
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
const char * RunModeNetmapGetDefaultMode(void)
const char * RunModeIpsNFQGetDefaultMode(void)
@ RUNMODE_ENGINE_ANALYSIS
#define SCLogError(...)
Macro used to log ERROR messages.
void RunModeIdsNetmapRegister(void)
struct OutputFreeList_ OutputFreeList
const char * thread_name_verdict
void RunModeDpdkRegister(void)
#define TAILQ_HEAD(name, type)
void OutputFlowShutdown(void)
int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
const char * thread_name_unix_socket
void RunModeNapatechRegister(void)
OutputModule * output_module
const char * RunModeGetMainMode(void)
int RunModeOutputFiledataEnabled(void)
int LiveGetDeviceCount(void)
Get the number of registered devices.
#define SCLogNotice(...)
Macro used to log NOTICE messages.
void UtRunModeRegister(void)
const char * RunModeIpsWinDivertGetDefaultMode(void)
SCCapturePlugin * SCPluginFindCaptureByName(const char *name)
float threading_detect_ratio
int OutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
const char * RunModeIdsGetDefaultMode(void)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.