suricata
runmodes.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /** \file
19  *
20  * \author Victor Julien <victor@inliniac.net>
21  *
22  * Pre-cooked threading runmodes.
23  */
24 
25 #include "suricata-common.h"
26 #include "detect-engine.h"
27 #include "app-layer-parser.h"
28 #include "util-debug.h"
29 #include "util-affinity.h"
30 #include "conf.h"
31 #include "runmodes.h"
32 #include "runmode-af-packet.h"
33 #include "runmode-af-xdp.h"
34 #include "runmode-dpdk.h"
35 #include "runmode-erf-dag.h"
36 #include "runmode-erf-file.h"
37 #include "runmode-ipfw.h"
38 #include "runmode-napatech.h"
39 #include "runmode-netmap.h"
40 #include "runmode-nflog.h"
41 #include "runmode-nfq.h"
42 #include "runmode-pcap.h"
43 #include "runmode-pcap-file.h"
44 #include "runmode-pfring.h"
45 #include "runmode-unix-socket.h"
46 #include "runmode-windivert.h"
47 #include "util-unittest.h"
48 #include "util-misc.h"
49 #include "util-plugin.h"
50 
51 #include "output.h"
52 
53 #include "source-pfring.h"
54 
55 #include "tmqh-flow.h"
56 #include "flow-manager.h"
57 #include "flow-bypass.h"
58 #include "counters.h"
59 
60 #include "suricata-plugin.h"
61 #include "util-device.h"
62 
66 
67 /* Runmode Global Thread Names */
68 const char *thread_name_autofp = "RX";
69 const char *thread_name_single = "W";
70 const char *thread_name_workers = "W";
71 const char *thread_name_verdict = "TX";
72 const char *thread_name_flow_mgr = "FM";
73 const char *thread_name_flow_rec = "FR";
74 const char *thread_name_flow_bypass = "FB";
75 const char *thread_name_unix_socket = "US";
76 const char *thread_name_detect_loader = "DL";
77 const char *thread_name_counter_stats = "CS";
78 const char *thread_name_counter_wakeup = "CW";
79 
80 /**
81  * \brief Holds description for a runmode.
82  */
83 typedef struct RunMode_ {
84  /* the runmode type */
85  enum RunModes runmode;
86  const char *name;
87  const char *description;
88  /* runmode function */
89  int (*RunModeFunc)(void);
90  int (*RunModeIsIPSEnabled)(void);
92 
93 typedef struct RunModes_ {
94  int cnt;
97 
98 static RunModes runmodes[RUNMODE_USER_MAX];
99 
100 static char *active_runmode;
101 
102 /* free list for our outputs */
103 typedef struct OutputFreeList_ {
106 
107  TAILQ_ENTRY(OutputFreeList_) entries;
109 static TAILQ_HEAD(, OutputFreeList_) output_free_list =
110  TAILQ_HEAD_INITIALIZER(output_free_list);
111 
112 /**
113  * \internal
114  * \brief Translate a runmode mode to a printable string.
115  *
116  * \param runmode Runmode to be converted into a printable string.
117  *
118  * \retval string Printable string.
119  */
120 static const char *RunModeTranslateModeToName(int runmode)
121 {
122  switch (runmode) {
123  case RUNMODE_PCAP_DEV:
124  return "PCAP_DEV";
125  case RUNMODE_PCAP_FILE:
126  return "PCAP_FILE";
127  case RUNMODE_PFRING:
128 #ifdef HAVE_PFRING
129  return "PFRING";
130 #else
131  return "PFRING(DISABLED)";
132 #endif
133  case RUNMODE_PLUGIN:
134  return "PLUGIN";
135  case RUNMODE_NFQ:
136  return "NFQ";
137  case RUNMODE_NFLOG:
138  return "NFLOG";
139  case RUNMODE_IPFW:
140  return "IPFW";
141  case RUNMODE_ERF_FILE:
142  return "ERF_FILE";
143  case RUNMODE_DAG:
144  return "ERF_DAG";
145  case RUNMODE_NAPATECH:
146  return "NAPATECH";
147  case RUNMODE_UNITTEST:
148  return "UNITTEST";
149  case RUNMODE_AFP_DEV:
150  return "AF_PACKET_DEV";
151  case RUNMODE_AFXDP_DEV:
152  return "AF_XDP_DEV";
153  case RUNMODE_NETMAP:
154 #ifdef HAVE_NETMAP
155  return "NETMAP";
156 #else
157  return "NETMAP(DISABLED)";
158 #endif
159  case RUNMODE_UNIX_SOCKET:
160  return "UNIX_SOCKET";
161  case RUNMODE_WINDIVERT:
162 #ifdef WINDIVERT
163  return "WINDIVERT";
164 #else
165  return "WINDIVERT(DISABLED)";
166 #endif
167  case RUNMODE_DPDK:
168 #ifdef HAVE_DPDK
169  return "DPDK";
170 #else
171  return "DPDK(DISABLED)";
172 #endif
173 
174  default:
175  FatalError("Unknown runtime mode. Aborting");
176  }
177 }
178 
179 /**
180  * \internal
181  * \brief Dispatcher function for runmodes. Calls the required runmode function
182  * based on runmode + runmode_custom_id.
183  *
184  * \param runmode The runmode type.
185  * \param runmode_custom_id The runmode custom id.
186  */
187 static RunMode *RunModeGetCustomMode(enum RunModes runmode, const char *custom_mode)
188 {
189  if (runmode < RUNMODE_USER_MAX) {
190  for (int i = 0; i < runmodes[runmode].cnt; i++) {
191  if (strcmp(runmodes[runmode].runmodes[i].name, custom_mode) == 0)
192  return &runmodes[runmode].runmodes[i];
193  }
194  }
195  return NULL;
196 }
197 
198 
199 /**
200  * Return the running mode
201  *
202  * The returned string must not be freed.
203  *
204  * \return a string containing the current running mode
205  */
206 char *RunmodeGetActive(void)
207 {
208  return active_runmode;
209 }
210 
211 /**
212  * Return the running mode
213  *
214  * The returned string must not be freed.
215  *
216  * \return a string containing the current running mode
217  */
218 const char *RunModeGetMainMode(void)
219 {
220  int mainmode = SCRunmodeGet();
221 
222  return RunModeTranslateModeToName(mainmode);
223 }
224 
225 /**
226  * \brief Register all runmodes in the engine.
227  */
229 {
230  memset(runmodes, 0, sizeof(runmodes));
231 
247 #ifdef UNITTESTS
249 #endif
250 }
251 
252 /**
253  * \brief Lists all registered runmodes.
254  */
256 {
257  printf("------------------------------------- Runmodes -------------------"
258  "-----------------------\n");
259 
260  printf("| %-17s | %-17s | %-10s \n",
261  "RunMode Type", "Custom Mode ", "Description");
262  printf("|-----------------------------------------------------------------"
263  "-----------------------\n");
264  int i = RUNMODE_UNKNOWN + 1;
265  int j = 0;
266  for ( ; i < RUNMODE_USER_MAX; i++) {
267  int mode_displayed = 0;
268  for (j = 0; j < runmodes[i].cnt; j++) {
269  if (mode_displayed == 1) {
270  printf("| ----------------------------------------------"
271  "-----------------------\n");
272  RunMode *runmode = &runmodes[i].runmodes[j];
273  printf("| %-17s | %-17s | %-27s \n",
274  "",
275  runmode->name,
276  runmode->description);
277  } else {
278  RunMode *runmode = &runmodes[i].runmodes[j];
279  printf("| %-17s | %-17s | %-27s \n",
280  RunModeTranslateModeToName(runmode->runmode),
281  runmode->name,
282  runmode->description);
283  }
284  if (mode_displayed == 0)
285  mode_displayed = 1;
286  }
287  if (mode_displayed == 1) {
288  printf("|-----------------------------------------------------------------"
289  "-----------------------\n");
290  }
291  }
292 }
293 
294 static const char *RunModeGetConfOrDefault(int capture_mode, const char *capture_plugin_name)
295 {
296  const char *custom_mode = NULL;
297  const char *val = NULL;
298  if (ConfGet("runmode", &val) != 1) {
299  custom_mode = NULL;
300  } else {
301  custom_mode = val;
302  }
303 
304  if ((custom_mode == NULL) || (strcmp(custom_mode, "auto") == 0)) {
305  switch (capture_mode) {
306  case RUNMODE_PCAP_DEV:
307  custom_mode = RunModeIdsGetDefaultMode();
308  break;
309  case RUNMODE_PCAP_FILE:
310  custom_mode = RunModeFilePcapGetDefaultMode();
311  break;
312 #ifdef HAVE_PFRING
313  case RUNMODE_PFRING:
314  custom_mode = RunModeIdsPfringGetDefaultMode();
315  break;
316 #endif
317  case RUNMODE_PLUGIN: {
318 #ifdef HAVE_PLUGINS
319  SCCapturePlugin *plugin = SCPluginFindCaptureByName(capture_plugin_name);
320  if (plugin == NULL) {
321  FatalError("No capture plugin found with name %s", capture_plugin_name);
322  }
323  custom_mode = (const char *)plugin->GetDefaultMode();
324 #endif
325  break;
326  }
327  case RUNMODE_NFQ:
328  custom_mode = RunModeIpsNFQGetDefaultMode();
329  break;
330  case RUNMODE_IPFW:
331  custom_mode = RunModeIpsIPFWGetDefaultMode();
332  break;
333  case RUNMODE_ERF_FILE:
334  custom_mode = RunModeErfFileGetDefaultMode();
335  break;
336  case RUNMODE_DAG:
337  custom_mode = RunModeErfDagGetDefaultMode();
338  break;
339  case RUNMODE_NAPATECH:
340  custom_mode = RunModeNapatechGetDefaultMode();
341  break;
342  case RUNMODE_AFP_DEV:
343  custom_mode = RunModeAFPGetDefaultMode();
344  break;
345  case RUNMODE_AFXDP_DEV:
346  custom_mode = RunModeAFXDPGetDefaultMode();
347  break;
348  case RUNMODE_NETMAP:
349  custom_mode = RunModeNetmapGetDefaultMode();
350  break;
351  case RUNMODE_UNIX_SOCKET:
352  custom_mode = RunModeUnixSocketGetDefaultMode();
353  break;
354  case RUNMODE_NFLOG:
355  custom_mode = RunModeIdsNflogGetDefaultMode();
356  break;
357 #ifdef WINDIVERT
358  case RUNMODE_WINDIVERT:
359  custom_mode = RunModeIpsWinDivertGetDefaultMode();
360  break;
361 #endif
362 #ifdef HAVE_DPDK
363  case RUNMODE_DPDK:
364  custom_mode = RunModeDpdkGetDefaultMode();
365  break;
366 #endif
367  default:
368  return NULL;
369  }
370  } else {
371  /* Add compatibility with old 'worker' name */
372  if (!strcmp("worker", custom_mode)) {
373  SCLogWarning("'worker' mode have been renamed "
374  "to 'workers', please modify your setup.");
375  custom_mode = "workers";
376  }
377  }
378 
379  return custom_mode;
380 }
381 
382 int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
383 {
384  if (runmode == NULL) {
385  runmode = RunModeGetConfOrDefault(capture_mode, capture_plugin_name);
386  if (runmode == NULL) // non-standard runmode
387  return 0;
388  }
389 
390  RunMode *mode = RunModeGetCustomMode(capture_mode, runmode);
391  if (mode == NULL) {
392  return 0;
393  }
394 
395  int ips_enabled = 0;
396  if (mode->RunModeIsIPSEnabled != NULL) {
397  ips_enabled = mode->RunModeIsIPSEnabled();
398  if (ips_enabled == 1) {
399  extern uint16_t g_livedev_mask;
400  if (g_livedev_mask != 0 && LiveGetDeviceCount() > 0) {
401  SCLogWarning("disabling livedev.use-for-tracking with IPS mode. See ticket #6726.");
402  g_livedev_mask = 0;
403  }
404  }
405  }
406 
407  return ips_enabled;
408 }
409 
410 /**
411  */
412 void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name,
413  const char *capture_plugin_args)
414 {
415  char *local_custom_mode = NULL;
416 
417  if (custom_mode == NULL) {
418  custom_mode = RunModeGetConfOrDefault(runmode, capture_plugin_name);
419  if (custom_mode == NULL)
420  FatalError("Unknown runtime mode. Aborting");
421  }
422 
423  RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
424  if (mode == NULL) {
425  SCLogError("The custom type \"%s\" doesn't exist "
426  "for this runmode type \"%s\". Please use --list-runmodes to "
427  "see available custom types for this runmode",
428  custom_mode, RunModeTranslateModeToName(runmode));
429  exit(EXIT_FAILURE);
430  }
431 
432  /* Export the custom mode */
433  if (active_runmode) {
434  SCFree(active_runmode);
435  }
436  active_runmode = SCStrdup(custom_mode);
437  if (unlikely(active_runmode == NULL)) {
438  FatalError("Unable to dup active mode");
439  }
440 
441  if (strcasecmp(active_runmode, "autofp") == 0) {
443  }
444 
445  mode->RunModeFunc();
446 
447  if (local_custom_mode != NULL)
448  SCFree(local_custom_mode);
449 
450  /* Check if the alloted queues have at least 1 reader and writer */
452 
453  if (runmode != RUNMODE_UNIX_SOCKET) {
454  /* spawn management threads */
459  }
461  }
462 }
463 
464 static int g_runmode_needs_bypass = 0;
465 
467 {
468  g_runmode_needs_bypass = 1;
469 }
470 
472 {
473  return g_runmode_needs_bypass;
474 }
475 
476 
477 
478 /**
479  * \brief Registers a new runmode.
480  *
481  * \param runmode Runmode type.
482  * \param name Custom mode for this specific runmode type. Within each
483  * runmode type, each custom name is a primary key.
484  * \param description Description for this runmode.
485  * \param RunModeFunc The function to be run for this runmode.
486  */
487 void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description,
488  int (*RunModeFunc)(void), int (*RunModeIsIPSEnabled)(void))
489 {
490  if (RunModeGetCustomMode(runmode, name) != NULL) {
491  FatalError("runmode '%s' has already "
492  "been registered. Please use an unique name.",
493  name);
494  }
495 
496  void *ptmp = SCRealloc(runmodes[runmode].runmodes,
497  (runmodes[runmode].cnt + 1) * sizeof(RunMode));
498  if (ptmp == NULL) {
499  SCFree(runmodes[runmode].runmodes);
500  runmodes[runmode].runmodes = NULL;
501  exit(EXIT_FAILURE);
502  }
503  runmodes[runmode].runmodes = ptmp;
504 
505  RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].cnt];
506  runmodes[runmode].cnt++;
507  memset(mode, 0x00, sizeof(*mode));
508 
509  mode->runmode = runmode;
510  mode->name = SCStrdup(name);
511  if (unlikely(mode->name == NULL)) {
512  FatalError("Failed to allocate string");
513  }
514  mode->description = SCStrdup(description);
515  if (unlikely(mode->description == NULL)) {
516  FatalError("Failed to allocate string");
517  }
518  mode->RunModeFunc = RunModeFunc;
519  mode->RunModeIsIPSEnabled = RunModeIsIPSEnabled;
520 }
521 
522 /**
523  * Setup the outputs for this run mode.
524  *
525  * \param tv The ThreadVars for the thread the outputs will be
526  * appended to.
527  */
528 static void RunOutputFreeList(void)
529 {
530  OutputFreeList *output;
531  while ((output = TAILQ_FIRST(&output_free_list))) {
532  TAILQ_REMOVE(&output_free_list, output, entries);
533 
534  SCLogDebug("output %s %p %p", output->output_module->name, output, output->output_ctx);
535  if (output->output_ctx != NULL && output->output_ctx->DeInit != NULL)
536  output->output_ctx->DeInit(output->output_ctx);
537  SCFree(output);
538  }
539 }
540 
541 static int file_logger_count = 0;
542 static int filedata_logger_count = 0;
543 static LoggerId logger_bits[ALPROTO_MAX];
544 
546 {
547  return filedata_logger_count > 0;
548 }
549 
550 bool IsRunModeSystem(enum RunModes run_mode_to_check)
551 {
552  switch (run_mode_to_check) {
553  case RUNMODE_PCAP_FILE:
554  case RUNMODE_ERF_FILE:
556  return false;
557  break;
558  default:
559  return true;
560  }
561 }
562 
563 bool IsRunModeOffline(enum RunModes run_mode_to_check)
564 {
565  switch(run_mode_to_check) {
566  case RUNMODE_CONF_TEST:
567  case RUNMODE_PCAP_FILE:
568  case RUNMODE_ERF_FILE:
570  case RUNMODE_UNIX_SOCKET:
571  return true;
572  break;
573  default:
574  return false;
575  }
576 }
577 
578 /**
579  * Cleanup the run mode.
580  */
581 void RunModeShutDown(void)
582 {
583  RunOutputFreeList();
584 
592 
594 
595  /* Reset logger counts. */
596  file_logger_count = 0;
597  filedata_logger_count = 0;
598 }
599 
600 /** \internal
601  * \brief add Sub RunModeOutput to list for Submodule so we can free
602  * the output ctx at shutdown and unix socket reload */
603 static void AddOutputToFreeList(OutputModule *module, OutputCtx *output_ctx)
604 {
605  OutputFreeList *fl_output = SCCalloc(1, sizeof(OutputFreeList));
606  if (unlikely(fl_output == NULL))
607  return;
608  fl_output->output_module = module;
609  fl_output->output_ctx = output_ctx;
610  TAILQ_INSERT_TAIL(&output_free_list, fl_output, entries);
611 }
612 
613 /** \brief Turn output into thread module */
614 static void SetupOutput(const char *name, OutputModule *module, OutputCtx *output_ctx)
615 {
616  /* flow logger doesn't run in the packet path */
617  if (module->FlowLogFunc) {
618  OutputRegisterFlowLogger(module->name, module->FlowLogFunc,
619  output_ctx, module->ThreadInit, module->ThreadDeinit,
620  module->ThreadExitPrintStats);
621  return;
622  }
623  /* stats logger doesn't run in the packet path */
624  if (module->StatsLogFunc) {
626  output_ctx,module->ThreadInit, module->ThreadDeinit,
627  module->ThreadExitPrintStats);
628  return;
629  }
630 
631  if (module->logger_id == LOGGER_ALERT_DEBUG) {
632  debuglog_enabled = 1;
633  }
634 
635  if (module->PacketLogFunc) {
636  SCLogDebug("%s is a packet logger", module->name);
637  OutputRegisterPacketLogger(module->logger_id, module->name,
638  module->PacketLogFunc, module->PacketConditionFunc, output_ctx,
639  module->ThreadInit, module->ThreadDeinit,
640  module->ThreadExitPrintStats);
641  } else if (module->TxLogFunc) {
642  SCLogDebug("%s is a tx logger", module->name);
643  OutputRegisterTxLogger(module->logger_id, module->name, module->alproto,
644  module->TxLogFunc, output_ctx, module->tc_log_progress,
645  module->ts_log_progress, module->TxLogCondition,
646  module->ThreadInit, module->ThreadDeinit,
647  module->ThreadExitPrintStats);
648  /* Not used with wild card loggers */
649  if (module->alproto != ALPROTO_UNKNOWN) {
650  logger_bits[module->alproto] |= BIT_U32(module->logger_id);
651  }
652  } else if (module->FiledataLogFunc) {
653  SCLogDebug("%s is a filedata logger", module->name);
655  module->FiledataLogFunc, output_ctx, module->ThreadInit,
656  module->ThreadDeinit, module->ThreadExitPrintStats);
657  filedata_logger_count++;
658  } else if (module->FileLogFunc) {
659  SCLogDebug("%s is a file logger", module->name);
660  OutputRegisterFileLogger(module->logger_id, module->name,
661  module->FileLogFunc, output_ctx, module->ThreadInit,
662  module->ThreadDeinit, module->ThreadExitPrintStats);
663  file_logger_count++;
664  } else if (module->StreamingLogFunc) {
665  SCLogDebug("%s is a streaming logger", module->name);
667  module->StreamingLogFunc, output_ctx, module->stream_type,
668  module->ThreadInit, module->ThreadDeinit,
669  module->ThreadExitPrintStats);
670  } else {
671  SCLogError("Unknown logger type: name=%s", module->name);
672  }
673 }
674 
675 static void RunModeInitializeEveOutput(ConfNode *conf, OutputCtx *parent_ctx)
676 {
677  ConfNode *types = ConfNodeLookupChild(conf, "types");
678  SCLogDebug("types %p", types);
679  if (types == NULL) {
680  return;
681  }
682 
683  ConfNode *type = NULL;
684  TAILQ_FOREACH(type, &types->head, next) {
685  int sub_count = 0;
686  char subname[256];
687 
688  if (strcmp(type->val, "ikev2") == 0) {
689  SCLogWarning("eve module 'ikev2' has been replaced by 'ike'");
690  strlcpy(subname, "eve-log.ike", sizeof(subname));
691  } else {
692  snprintf(subname, sizeof(subname), "eve-log.%s", type->val);
693  }
694 
695  SCLogConfig("enabling 'eve-log' module '%s'", type->val);
696 
697  ConfNode *sub_output_config = ConfNodeLookupChild(type, type->val);
698  if (sub_output_config != NULL) {
699  const char *enabled = ConfNodeLookupChildValue(
700  sub_output_config, "enabled");
701  if (enabled != NULL && !ConfValIsTrue(enabled)) {
702  continue;
703  }
704  }
705 
706  /* Now setup all registers logger of this name. */
707  OutputModule *sub_module;
708  TAILQ_FOREACH(sub_module, &output_modules, entries) {
709  if (strcmp(subname, sub_module->conf_name) == 0) {
710  sub_count++;
711 
712  if (sub_module->parent_name == NULL ||
713  strcmp(sub_module->parent_name, "eve-log") != 0) {
714  FatalError("bad parent for %s", subname);
715  }
716  if (sub_module->InitSubFunc == NULL) {
717  FatalError("bad sub-module for %s", subname);
718  }
719 
720  /* pass on parent output_ctx */
721  OutputInitResult result =
722  sub_module->InitSubFunc(sub_output_config, parent_ctx);
723  if (!result.ok || result.ctx == NULL) {
724  FatalError("unable to initialize sub-module %s", subname);
725  }
726 
727  AddOutputToFreeList(sub_module, result.ctx);
728  SetupOutput(sub_module->name, sub_module,
729  result.ctx);
730  }
731  }
732 
733  /* Error is no registered loggers with this name
734  * were found .*/
735  if (!sub_count) {
736  FatalErrorOnInit("No output module named %s", subname);
737  continue;
738  }
739  }
740 }
741 
742 static void RunModeInitializeLuaOutput(ConfNode *conf, OutputCtx *parent_ctx)
743 {
744  OutputModule *lua_module = OutputGetModuleByConfName("lua");
745  BUG_ON(lua_module == NULL);
746 
747  ConfNode *scripts = ConfNodeLookupChild(conf, "scripts");
748  BUG_ON(scripts == NULL); //TODO
749 
750  OutputModule *m;
751  TAILQ_FOREACH(m, &parent_ctx->submodules, entries) {
752  SCLogDebug("m %p %s:%s", m, m->name, m->conf_name);
753 
754  ConfNode *script = NULL;
755  TAILQ_FOREACH(script, &scripts->head, next) {
756  SCLogDebug("script %s", script->val);
757  if (strcmp(script->val, m->conf_name) == 0) {
758  break;
759  }
760  }
761  BUG_ON(script == NULL);
762 
763  /* pass on parent output_ctx */
764  OutputInitResult result = m->InitSubFunc(script, parent_ctx);
765  if (!result.ok || result.ctx == NULL) {
766  continue;
767  }
768 
769  AddOutputToFreeList(m, result.ctx);
770  SetupOutput(m->name, m, result.ctx);
771  }
772 }
773 
774 extern bool g_file_logger_enabled;
775 extern bool g_filedata_logger_enabled;
776 
777 /**
778  * Initialize the output modules.
779  */
781 {
782  ConfNode *outputs = ConfGetNode("outputs");
783  if (outputs == NULL) {
784  /* No "outputs" section in the configuration. */
785  return;
786  }
787 
788  ConfNode *output, *output_config;
789  const char *enabled;
790  char tls_log_enabled = 0;
791  char tls_store_present = 0;
792 
793  memset(&logger_bits, 0, sizeof(logger_bits));
794 
795  TAILQ_FOREACH(output, &outputs->head, next) {
796 
797  output_config = ConfNodeLookupChild(output, output->val);
798  if (output_config == NULL) {
799  /* Shouldn't happen. */
800  FatalError("Failed to lookup configuration child node: %s", output->val);
801  }
802 
803  if (strcmp(output->val, "tls-store") == 0) {
804  tls_store_present = 1;
805  }
806 
807  enabled = ConfNodeLookupChildValue(output_config, "enabled");
808  if (enabled == NULL || !ConfValIsTrue(enabled)) {
809  continue;
810  }
811 
812  if (strcmp(output->val, "file-log") == 0) {
813  SCLogWarning("file-log is no longer supported,"
814  " use eve.files instead "
815  "(see ticket #2376"
816  " for an explanation)");
817  continue;
818  } else if (strncmp(output->val, "unified-", sizeof("unified-") - 1) == 0) {
819  SCLogWarning("Unified1 is no longer supported,"
820  " use Unified2 instead "
821  "(see ticket #353"
822  " for an explanation)");
823  continue;
824  } else if (strncmp(output->val, "unified2-", sizeof("unified2-") - 1) == 0) {
825  SCLogWarning("Unified2 is no longer supported.");
826  continue;
827  } else if (strcmp(output->val, "dns-log") == 0) {
828  SCLogWarning("dns-log is not longer available as of Suricata 5.0");
829  continue;
830  } else if (strcmp(output->val, "tls-log") == 0) {
831  tls_log_enabled = 1;
832  }
833 
834  OutputModule *module;
835  int count = 0;
836  TAILQ_FOREACH(module, &output_modules, entries) {
837  if (strcmp(module->conf_name, output->val) != 0) {
838  continue;
839  }
840 
841  count++;
842 
843  OutputCtx *output_ctx = NULL;
844  if (module->InitFunc != NULL) {
845  OutputInitResult r = module->InitFunc(output_config);
846  if (!r.ok) {
847  FatalErrorOnInit("output module \"%s\": setup failed", output->val);
848  continue;
849  } else if (r.ctx == NULL) {
850  continue;
851  }
852  output_ctx = r.ctx;
853  } else if (module->InitSubFunc != NULL) {
854  SCLogInfo("skipping submodule");
855  continue;
856  }
857 
858  // TODO if module == parent, find it's children
859  if (strcmp(output->val, "eve-log") == 0) {
860  RunModeInitializeEveOutput(output_config, output_ctx);
861 
862  /* add 'eve-log' to free list as it's the owner of the
863  * main output ctx from which the sub-modules share the
864  * LogFileCtx */
865  AddOutputToFreeList(module, output_ctx);
866  } else if (strcmp(output->val, "lua") == 0) {
867  SCLogDebug("handle lua");
868  if (output_ctx == NULL)
869  continue;
870  RunModeInitializeLuaOutput(output_config, output_ctx);
871  AddOutputToFreeList(module, output_ctx);
872  } else {
873  AddOutputToFreeList(module, output_ctx);
874  SetupOutput(module->name, module, output_ctx);
875  }
876  }
877  if (count == 0) {
878  FatalErrorOnInit("No output module named %s", output->val);
879  continue;
880  }
881  }
882 
883  /* Backward compatibility code */
884  if (!tls_store_present && tls_log_enabled) {
885  /* old YAML with no "tls-store" in outputs. "tls-log" value needs
886  * to be started using 'tls-log' config as own config */
887  SCLogWarning("Please use 'tls-store' in YAML to configure TLS storage");
888 
889  TAILQ_FOREACH(output, &outputs->head, next) {
890  output_config = ConfNodeLookupChild(output, output->val);
891 
892  if (strcmp(output->val, "tls-log") == 0) {
893 
894  OutputModule *module = OutputGetModuleByConfName("tls-store");
895  if (module == NULL) {
896  SCLogWarning("No output module named %s, ignoring", "tls-store");
897  continue;
898  }
899 
900  OutputCtx *output_ctx = NULL;
901  if (module->InitFunc != NULL) {
902  OutputInitResult r = module->InitFunc(output_config);
903  if (!r.ok) {
904  FatalErrorOnInit("output module setup failed");
905  continue;
906  } else if (r.ctx == NULL) {
907  continue;
908  }
909  output_ctx = r.ctx;
910  }
911 
912  AddOutputToFreeList(module, output_ctx);
913  SetupOutput(module->name, module, output_ctx);
914  }
915  }
916  }
917 
918  /* register the logger bits to the app-layer */
919  AppProto a;
920  for (a = 0; a < ALPROTO_MAX; a++) {
921  if (AppLayerParserSupportsFiles(IPPROTO_TCP, a)) {
923  logger_bits[a] |= BIT_U32(LOGGER_FILE);
925  logger_bits[a] |= BIT_U32(LOGGER_FILEDATA);
926  SCLogDebug("IPPROTO_TCP::%s: g_file_logger_enabled %d g_filedata_logger_enabled %d -> "
927  "%08x",
929  logger_bits[a]);
930  }
931  if (AppLayerParserSupportsFiles(IPPROTO_UDP, a)) {
933  logger_bits[a] |= BIT_U32(LOGGER_FILE);
935  logger_bits[a] |= BIT_U32(LOGGER_FILEDATA);
936  }
937 
938  if (logger_bits[a] == 0)
939  continue;
940 
941  const int tcp = AppLayerParserProtocolHasLogger(IPPROTO_TCP, a) | (g_file_logger_enabled) |
943  const int udp = AppLayerParserProtocolHasLogger(IPPROTO_UDP, a) | (g_file_logger_enabled) |
945  SCLogDebug("tcp %d udp %d", tcp, udp);
946 
947  SCLogDebug("logger for %s: %s %s", AppProtoToString(a),
948  tcp ? "true" : "false", udp ? "true" : "false");
949 
950  SCLogDebug("logger bits for %s: %08x", AppProtoToString(a), logger_bits[a]);
951  if (tcp)
952  AppLayerParserRegisterLoggerBits(IPPROTO_TCP, a, logger_bits[a]);
953  if (udp)
954  AppLayerParserRegisterLoggerBits(IPPROTO_UDP, a, logger_bits[a]);
955 
956  }
958 }
959 
961 
962 /**
963  * Initialize multithreading settings.
964  */
966 {
967  int affinity = 0;
968  if ((ConfGetBool("threading.set-cpu-affinity", &affinity)) == 0) {
970  } else {
971  threading_set_cpu_affinity = affinity == 1;
972  }
973 
974  /* try to get custom cpu mask value if needed */
977  }
978  if ((ConfGetFloat("threading.detect-thread-ratio", &threading_detect_ratio)) != 1) {
979  if (ConfGetNode("threading.detect-thread-ratio") != NULL)
980  WarnInvalidConfEntry("threading.detect-thread-ratio", "%s", "1");
982  }
983 
984  SCLogDebug("threading.detect-thread-ratio %f", threading_detect_ratio);
985 
986  /*
987  * Check if there's a configuration setting for the per-thread stack size
988  * in case the default per-thread stack size is to be adjusted
989  */
990  const char *ss = NULL;
991  if ((ConfGet("threading.stack-size", &ss)) == 1) {
992  if (ss != NULL) {
994  FatalError("Failed to initialize thread_stack_size output, invalid limit: %s", ss);
995  }
996  }
997  } else {
998  pthread_attr_t attr;
999  pthread_attr_init(&attr);
1000  size_t size;
1001  if (pthread_attr_getstacksize(&attr, &size) == 0 && size < 512 * 1024) {
1002  threading_set_stack_size = 512 * 1024;
1003  SCLogNotice("thread stack size of %" PRIuMAX " to too small: setting to 512k",
1004  (uintmax_t)size);
1005  }
1006  }
1007 
1008  SCLogDebug("threading.stack-size %" PRIu64, threading_set_stack_size);
1009 }
thread_name_workers
const char * thread_name_workers
Definition: runmodes.c:70
RUNMODE_AFXDP_DEV
@ RUNMODE_AFXDP_DEV
Definition: runmodes.h:38
RunModeIpsIPFWGetDefaultMode
const char * RunModeIpsIPFWGetDefaultMode(void)
Definition: runmode-ipfw.c:44
FlowManagerThreadSpawn
void FlowManagerThreadSpawn(void)
spawn the flow manager thread
Definition: flow-manager.c:977
OutputRegisterStreamingLogger
int OutputRegisterStreamingLogger(LoggerId id, const char *name, StreamingLogger LogFunc, OutputCtx *output_ctx, enum OutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-streaming.c:64
suricata-plugin.h
AffinitySetupLoadFromConfig
void AffinitySetupLoadFromConfig(void)
Extract cpu affinity configuration from current config file.
Definition: util-affinity.c:164
OutputModule_::parent_name
const char * parent_name
Definition: output.h:60
thread_name_counter_wakeup
const char * thread_name_counter_wakeup
Definition: runmodes.c:78
flow-bypass.h
RunMode_::description
const char * description
Definition: runmodes.c:87
g_livedev_mask
uint16_t g_livedev_mask
Definition: suricata.c:205
detect-engine.h
SCRunmodeGet
int SCRunmodeGet(void)
Get the current run mode.
Definition: suricata.c:262
RUNMODE_UNIX_SOCKET
@ RUNMODE_UNIX_SOCKET
Definition: runmodes.h:43
threading_set_cpu_affinity
bool threading_set_cpu_affinity
Definition: runmodes.c:64
RunModeErfFileRegister
void RunModeErfFileRegister(void)
Definition: runmode-erf-file.c:39
OutputStreamingShutdown
void OutputStreamingShutdown(void)
Definition: output-streaming.c:459
RunMode_::RunModeIsIPSEnabled
int(* RunModeIsIPSEnabled)(void)
Definition: runmodes.c:90
AppLayerParserProtocolHasLogger
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1516
thread_name_flow_mgr
const char * thread_name_flow_mgr
Definition: runmodes.c:72
RUNMODE_UNITTEST
@ RUNMODE_UNITTEST
Definition: runmodes.h:41
RunModeErfFileGetDefaultMode
const char * RunModeErfFileGetDefaultMode(void)
Definition: runmode-erf-file.c:34
ConfNode_::val
char * val
Definition: conf.h:34
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:482
RUNMODE_DPDK
@ RUNMODE_DPDK
Definition: runmodes.h:40
runmode-af-packet.h
RUNMODE_UNKNOWN
@ RUNMODE_UNKNOWN
Definition: runmodes.h:28
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
LOGGER_FILEDATA
@ LOGGER_FILEDATA
Definition: suricata-common.h:470
OutputTxShutdown
void OutputTxShutdown(void)
Definition: output-tx.c:673
TmqhFlowPrintAutofpHandler
void TmqhFlowPrintAutofpHandler(void)
Definition: tmqh-flow.c:84
RunModeIdsAFPRegister
void RunModeIdsAFPRegister(void)
Definition: runmode-af-packet.c:136
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:190
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
BypassedFlowManagerThreadSpawn
void BypassedFlowManagerThreadSpawn(void)
spawn the flow bypass manager thread
Definition: flow-bypass.c:191
OutputRegisterFileLogger
int OutputRegisterFileLogger(LoggerId id, const char *name, FileLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-file.c:57
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:82
RunModeShutDown
void RunModeShutDown(void)
Definition: runmodes.c:581
OutputRegisterStatsLogger
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-stats.c:52
RunModeDispatch
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
Definition: runmodes.c:412
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
OutputModule_::name
const char * name
Definition: output.h:58
thread_name_counter_stats
const char * thread_name_counter_stats
Definition: runmodes.c:77
OutputModule_::StreamingLogFunc
StreamingLogger StreamingLogFunc
Definition: output.h:75
OutputModule_::FileLogFunc
FileLogger FileLogFunc
Definition: output.h:72
OutputModule_::logger_id
LoggerId logger_id
Definition: output.h:57
LoggerId
LoggerId
Definition: suricata-common.h:460
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:76
runmode-pcap.h
AppLayerParserSupportsFiles
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1148
RunModeAFPGetDefaultMode
const char * RunModeAFPGetDefaultMode(void)
Definition: runmode-af-packet.c:64
thread_name_flow_rec
const char * thread_name_flow_rec
Definition: runmodes.c:73
OutputFiledataShutdown
void OutputFiledataShutdown(void)
Definition: output-filedata.c:281
RUNMODE_ERF_FILE
@ RUNMODE_ERF_FILE
Definition: runmodes.h:35
RunModeIdsPfringRegister
void RunModeIdsPfringRegister(void)
Definition: runmode-pfring.c:51
OutputModule_::ts_log_progress
int ts_log_progress
Definition: output.h:80
runmode-erf-file.h
runmode-windivert.h
RunModeFilePcapGetDefaultMode
const char * RunModeFilePcapGetDefaultMode(void)
Definition: runmode-pcap-file.c:35
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
thread_name_autofp
const char * thread_name_autofp
Definition: runmodes.c:68
RUNMODE_NFLOG
@ RUNMODE_NFLOG
Definition: runmodes.h:33
OutputGetModuleByConfName
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
Definition: output.c:660
OutputSetupActiveLoggers
void OutputSetupActiveLoggers(void)
Definition: output.c:870
OutputModule_::StatsLogFunc
StatsLogger StatsLogFunc
Definition: output.h:76
RunModeIdsNflogGetDefaultMode
const char * RunModeIdsNflogGetDefaultMode(void)
Definition: runmode-nflog.c:208
RUNMODE_PCAP_DEV
@ RUNMODE_PCAP_DEV
Definition: runmodes.h:29
RunMode_::RunModeFunc
int(* RunModeFunc)(void)
Definition: runmodes.c:89
OutputStatsShutdown
void OutputStatsShutdown(void)
Definition: output-stats.c:205
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:294
RunmodeGetActive
char * RunmodeGetActive(void)
Definition: runmodes.c:206
m
SCMutex m
Definition: flow-hash.h:6
OutputModule_::InitSubFunc
OutputInitSubFunc InitSubFunc
Definition: output.h:62
RUNMODE_NAPATECH
@ RUNMODE_NAPATECH
Definition: runmodes.h:42
RunModes
struct RunModes_ RunModes
OutputModule_::PacketLogFunc
PacketLogger PacketLogFunc
Definition: output.h:68
TmValidateQueueState
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
Definition: tm-queues.c:101
RunModeAFXDPGetDefaultMode
const char * RunModeAFXDPGetDefaultMode(void)
Definition: runmode-af-xdp.c:66
ALPROTO_MAX
@ ALPROTO_MAX
Definition: app-layer-protos.h:77
IsRunModeOffline
bool IsRunModeOffline(enum RunModes run_mode_to_check)
Definition: runmodes.c:563
RunModeInitializeOutputs
void RunModeInitializeOutputs(void)
Definition: runmodes.c:780
debuglog_enabled
int debuglog_enabled
Definition: runmodes.c:63
thread_name_single
const char * thread_name_single
Definition: runmodes.c:69
OutputModule_::alproto
AppProto alproto
Definition: output.h:77
RUNMODE_DAG
@ RUNMODE_DAG
Definition: runmodes.h:36
RunModes_
Definition: runmodes.c:93
runmode-unix-socket.h
util-unittest.h
RUNMODE_NETMAP
@ RUNMODE_NETMAP
Definition: runmodes.h:39
SCCapturePlugin_::GetDefaultMode
const char *(* GetDefaultMode)(void)
Definition: suricata-plugin.h:49
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:536
OutputClearActiveLoggers
void OutputClearActiveLoggers(void)
Definition: output.c:883
OutputCtx_
Definition: tm-modules.h:85
RunModeIdsPfringGetDefaultMode
const char * RunModeIdsPfringGetDefaultMode(void)
Definition: runmode-pfring.c:42
OutputModule_::stream_type
enum OutputStreamingType stream_type
Definition: output.h:78
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
OutputRegisterFiledataLogger
int OutputRegisterFiledataLogger(LoggerId id, const char *name, FiledataLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-filedata.c:55
TAILQ_ENTRY
#define TAILQ_ENTRY(type)
Definition: queue.h:239
RunModeUnixSocketGetDefaultMode
const char * RunModeUnixSocketGetDefaultMode(void)
Definition: runmode-unix-socket.c:84
OutputRegisterFlowLogger
int OutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-flow.c:53
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
RUNMODE_USER_MAX
@ RUNMODE_USER_MAX
Definition: runmodes.h:46
RunModeIpsNFQRegister
void RunModeIpsNFQRegister(void)
Definition: runmode-nfq.c:47
counters.h
RunModeInitializeThreadSettings
void RunModeInitializeThreadSettings(void)
Definition: runmodes.c:965
OutputRegisterTxLogger
int OutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, OutputCtx *output_ctx, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, void(*ThreadExitPrintStats)(ThreadVars *, void *))
Definition: output-tx.c:66
OutputModule_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output.h:64
RunModeDpdkGetDefaultMode
const char * RunModeDpdkGetDefaultMode(void)
Definition: runmode-dpdk.c:1697
TAILQ_HEAD_INITIALIZER
#define TAILQ_HEAD_INITIALIZER(head)
Definition: queue.h:236
IsRunModeSystem
bool IsRunModeSystem(enum RunModes run_mode_to_check)
Definition: runmodes.c:550
output_modules
OutputModuleList output_modules
RunModes
RunModes
Definition: runmodes.h:27
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
OutputModule_::FiledataLogFunc
FiledataLogger FiledataLogFunc
Definition: output.h:73
util-device.h
util-debug.h
RunModes_::runmodes
RunMode * runmodes
Definition: runmodes.c:95
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
thread_name_flow_bypass
const char * thread_name_flow_bypass
Definition: runmodes.c:74
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:47
RUNMODE_CONF_TEST
@ RUNMODE_CONF_TEST
Definition: runmodes.h:54
OutputModule_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output.h:65
RunModeListRunmodes
void RunModeListRunmodes(void)
Lists all registered runmodes.
Definition: runmodes.c:255
runmode-pfring.h
g_filedata_logger_enabled
bool g_filedata_logger_enabled
Definition: output-filedata.c:37
BIT_U32
#define BIT_U32(n)
Definition: suricata-common.h:400
RunModeRegisterNewRunMode
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), int(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
Definition: runmodes.c:487
threading_set_stack_size
uint64_t threading_set_stack_size
Definition: runmodes.c:65
RunModeEnablesBypassManager
void RunModeEnablesBypassManager(void)
Definition: runmodes.c:466
OutputPacketShutdown
void OutputPacketShutdown(void)
Definition: output-packet.c:220
RunModeIdsNflogRegister
void RunModeIdsNflogRegister(void)
Definition: runmode-nflog.c:213
util-affinity.h
RunMode_
Holds description for a runmode.
Definition: runmodes.c:83
SCCapturePlugin_
Definition: suricata-plugin.h:44
AppLayerParserRegisterLoggerBits
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
Definition: app-layer-parser.c:448
RunModeIpsIPFWRegister
void RunModeIpsIPFWRegister(void)
Definition: runmode-ipfw.c:49
OutputInitResult_::ok
bool ok
Definition: output.h:48
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
RunModeErfDagGetDefaultMode
const char * RunModeErfDagGetDefaultMode(void)
Definition: runmode-erf-dag.c:43
app-layer-parser.h
source-pfring.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
runmode-netmap.h
runmode-erf-dag.h
thread_name_detect_loader
const char * thread_name_detect_loader
Definition: runmodes.c:76
OutputModule_::conf_name
const char * conf_name
Definition: output.h:59
OutputModule_::FlowLogFunc
FlowLogger FlowLogFunc
Definition: output.h:74
type
uint16_t type
Definition: decode-vlan.c:107
conf.h
OutputFileShutdown
void OutputFileShutdown(void)
Definition: output-file.c:243
runmode-pcap-file.h
FlowRecyclerThreadSpawn
void FlowRecyclerThreadSpawn(void)
spawn the flow recycler thread
Definition: flow-manager.c:1177
util-plugin.h
RunModeErfDagRegister
void RunModeErfDagRegister(void)
Definition: runmode-erf-dag.c:48
OutputModule_::ThreadExitPrintStats
ThreadExitPrintStatsFunc ThreadExitPrintStats
Definition: output.h:66
RunMode
struct RunMode_ RunMode
Holds description for a runmode.
runmodes.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
WarnInvalidConfEntry
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
Definition: util-misc.h:35
RunModes_::cnt
int cnt
Definition: runmodes.c:94
RunModeIpsWinDivertRegister
void RunModeIpsWinDivertRegister(void)
Definition: runmode-windivert.c:45
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
RunModeNapatechGetDefaultMode
const char * RunModeNapatechGetDefaultMode(void)
Definition: runmode-napatech.c:82
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:781
OutputFreeList_::output_ctx
OutputCtx * output_ctx
Definition: runmodes.c:105
runmode-nfq.h
RunModeIdsAFXDPRegister
void RunModeIdsAFXDPRegister(void)
Definition: runmode-af-xdp.c:71
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
OutputInitResult_
Definition: output.h:46
ConfGetFloat
int ConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
Definition: conf.c:615
OutputModule_::TxLogCondition
TxLoggerCondition TxLogCondition
Definition: output.h:71
RUNMODE_PFRING
@ RUNMODE_PFRING
Definition: runmodes.h:31
RunModeUnixSocketRegister
void RunModeUnixSocketRegister(void)
Definition: runmode-unix-socket.c:582
flow-manager.h
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:91
FatalErrorOnInit
#define FatalErrorOnInit(...)
Fatal error IF we're starting up, and configured to consider errors to be fatal errors.
Definition: util-debug.h:511
StatsSpawnThreads
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
Definition: counters.c:912
RunModeNeedsBypassManager
int RunModeNeedsBypassManager(void)
Definition: runmodes.c:471
g_file_logger_enabled
bool g_file_logger_enabled
Definition: output-file.c:39
LOGGER_ALERT_DEBUG
@ LOGGER_ALERT_DEBUG
Definition: suricata-common.h:477
RunModeIdsPcapRegister
void RunModeIdsPcapRegister(void)
Definition: runmode-pcap.c:39
RunModeRegisterRunModes
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
Definition: runmodes.c:228
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
RunModeFilePcapRegister
void RunModeFilePcapRegister(void)
Definition: runmode-pcap-file.c:40
FatalError
#define FatalError(...)
Definition: util-debug.h:502
OutputModule_::PacketConditionFunc
PacketLogCondition PacketConditionFunc
Definition: output.h:69
RUNMODE_NFQ
@ RUNMODE_NFQ
Definition: runmodes.h:32
LOGGER_FILE
@ LOGGER_FILE
Definition: suricata-common.h:469
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
RunModeNetmapGetDefaultMode
const char * RunModeNetmapGetDefaultMode(void)
Definition: runmode-netmap.c:55
RunModeIpsNFQGetDefaultMode
const char * RunModeIpsNFQGetDefaultMode(void)
Definition: runmode-nfq.c:42
RUNMODE_ENGINE_ANALYSIS
@ RUNMODE_ENGINE_ANALYSIS
Definition: runmodes.h:56
RunMode_::runmode
enum RunModes runmode
Definition: runmodes.c:85
runmode-af-xdp.h
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SCFree
#define SCFree(p)
Definition: util-mem.h:61
RunModeIdsNetmapRegister
void RunModeIdsNetmapRegister(void)
Definition: runmode-netmap.c:127
ConfNode_
Definition: conf.h:32
OutputFreeList
struct OutputFreeList_ OutputFreeList
thread_name_verdict
const char * thread_name_verdict
Definition: runmodes.c:71
runmode-napatech.h
RunModeDpdkRegister
void RunModeDpdkRegister(void)
Definition: runmode-dpdk.c:1702
OutputModule_::TxLogFunc
TxLogger TxLogFunc
Definition: output.h:70
OutputModule_::tc_log_progress
int tc_log_progress
Definition: output.h:79
TAILQ_HEAD
#define TAILQ_HEAD(name, type)
Definition: queue.h:230
OutputFlowShutdown
void OutputFlowShutdown(void)
Definition: output-flow.c:187
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
RunModeEngineIsIPS
int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
Definition: runmodes.c:382
OutputFreeList_
Definition: runmodes.c:103
tmqh-flow.h
RUNMODE_WINDIVERT
@ RUNMODE_WINDIVERT
Definition: runmodes.h:44
runmode-dpdk.h
runmode-ipfw.h
thread_name_unix_socket
const char * thread_name_unix_socket
Definition: runmodes.c:75
RunModeNapatechRegister
void RunModeNapatechRegister(void)
Definition: runmode-napatech.c:87
OutputFreeList_::output_module
OutputModule * output_module
Definition: runmodes.c:104
runmode-nflog.h
RunModeGetMainMode
const char * RunModeGetMainMode(void)
Definition: runmodes.c:218
RunModeOutputFiledataEnabled
int RunModeOutputFiledataEnabled(void)
Definition: runmodes.c:545
LiveGetDeviceCount
int LiveGetDeviceCount(void)
Get the number of registered devices.
Definition: util-device.c:164
util-misc.h
RunMode_::name
const char * name
Definition: runmodes.c:86
OutputModule_
Definition: output.h:56
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:237
UtRunModeRegister
void UtRunModeRegister(void)
Definition: util-unittest.c:283
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
RUNMODE_AFP_DEV
@ RUNMODE_AFP_DEV
Definition: runmodes.h:37
RUNMODE_PCAP_FILE
@ RUNMODE_PCAP_FILE
Definition: runmodes.h:30
RunModeIpsWinDivertGetDefaultMode
const char * RunModeIpsWinDivertGetDefaultMode(void)
Definition: runmode-windivert.c:40
RUNMODE_PLUGIN
@ RUNMODE_PLUGIN
Definition: runmodes.h:45
RUNMODE_IPFW
@ RUNMODE_IPFW
Definition: runmodes.h:34
SCPluginFindCaptureByName
SCCapturePlugin * SCPluginFindCaptureByName(const char *name)
threading_detect_ratio
float threading_detect_ratio
Definition: runmodes.c:960
output.h
OutputModule_::InitFunc
OutputInitFunc InitFunc
Definition: output.h:61
OutputRegisterPacketLogger
int OutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-packet.c:55
RunModeIdsGetDefaultMode
const char * RunModeIdsGetDefaultMode(void)
Definition: runmode-pcap.c:32
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:809