suricata
runmodes.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /** \file
19  *
20  * \author Victor Julien <victor@inliniac.net>
21  *
22  * Pre-cooked threading runmodes.
23  */
24 
25 #include "suricata-common.h"
26 #include "detect-engine.h"
27 #include "app-layer-parser.h"
28 #include "util-debug.h"
29 #include "util-affinity.h"
30 #include "conf.h"
31 #include "log-flush.h"
32 #include "runmodes.h"
33 #include "runmode-af-packet.h"
34 #include "runmode-af-xdp.h"
35 #include "runmode-dpdk.h"
36 #include "runmode-erf-dag.h"
37 #include "runmode-erf-file.h"
38 #include "runmode-ipfw.h"
39 #include "runmode-netmap.h"
40 #include "runmode-nflog.h"
41 #include "runmode-nfq.h"
42 #include "runmode-pcap.h"
43 #include "runmode-pcap-file.h"
44 #include "runmode-unix-socket.h"
45 #include "runmode-windivert.h"
46 #include "util-unittest.h"
47 #include "util-misc.h"
48 #include "util-plugin.h"
49 
50 #include "output.h"
51 
52 #include "tmqh-flow.h"
53 #include "flow-manager.h"
54 #include "flow-bypass.h"
55 #include "counters.h"
56 
57 #include "suricata-plugin.h"
58 #include "util-device.h"
59 
63 
64 /* Runmode Global Thread Names */
65 const char *thread_name_autofp = "RX";
66 const char *thread_name_single = "W";
67 const char *thread_name_workers = "W";
68 const char *thread_name_verdict = "TX";
69 const char *thread_name_flow_mgr = "FM";
70 const char *thread_name_flow_rec = "FR";
71 const char *thread_name_flow_bypass = "FB";
72 const char *thread_name_unix_socket = "US";
73 const char *thread_name_detect_loader = "DL";
74 const char *thread_name_counter_stats = "CS";
75 const char *thread_name_counter_wakeup = "CW";
76 const char *thread_name_heartbeat = "HB";
77 
78 /**
79  * \brief Holds description for a runmode.
80  */
81 typedef struct RunMode_ {
82  /* the runmode type */
83  enum RunModes runmode;
84  const char *name;
85  const char *description;
86  /* runmode function */
87  int (*RunModeFunc)(void);
88  int (*RunModeIsIPSEnabled)(void);
90 
91 typedef struct RunModes_ {
92  int cnt;
95 
96 static RunModes runmodes[RUNMODE_USER_MAX];
97 
98 static char *active_runmode;
99 
100 /* free list for our outputs */
101 typedef struct OutputFreeList_ {
104 
105  TAILQ_ENTRY(OutputFreeList_) entries;
107 static TAILQ_HEAD(, OutputFreeList_) output_free_list =
108  TAILQ_HEAD_INITIALIZER(output_free_list);
109 
110 /**
111  * \internal
112  * \brief Translate a runmode mode to a printable string.
113  *
114  * \param runmode Runmode to be converted into a printable string.
115  *
116  * \retval string Printable string.
117  */
118 static const char *RunModeTranslateModeToName(int runmode)
119 {
120  switch (runmode) {
121  case RUNMODE_PCAP_DEV:
122  return "PCAP_DEV";
123  case RUNMODE_PCAP_FILE:
124  return "PCAP_FILE";
125  case RUNMODE_PLUGIN:
126  return "PLUGIN";
127  case RUNMODE_NFQ:
128  return "NFQ";
129  case RUNMODE_NFLOG:
130  return "NFLOG";
131  case RUNMODE_IPFW:
132  return "IPFW";
133  case RUNMODE_ERF_FILE:
134  return "ERF_FILE";
135  case RUNMODE_DAG:
136  return "ERF_DAG";
137  case RUNMODE_UNITTEST:
138  return "UNITTEST";
139  case RUNMODE_AFP_DEV:
140  return "AF_PACKET_DEV";
141  case RUNMODE_AFXDP_DEV:
142  return "AF_XDP_DEV";
143  case RUNMODE_NETMAP:
144 #ifdef HAVE_NETMAP
145  return "NETMAP";
146 #else
147  return "NETMAP(DISABLED)";
148 #endif
149  case RUNMODE_UNIX_SOCKET:
150  return "UNIX_SOCKET";
151  case RUNMODE_WINDIVERT:
152 #ifdef WINDIVERT
153  return "WINDIVERT";
154 #else
155  return "WINDIVERT(DISABLED)";
156 #endif
157  case RUNMODE_DPDK:
158 #ifdef HAVE_DPDK
159  return "DPDK";
160 #else
161  return "DPDK(DISABLED)";
162 #endif
163 
164  default:
165  FatalError("Unknown runtime mode. Aborting");
166  }
167 }
168 
169 /**
170  * \internal
171  * \brief Dispatcher function for runmodes. Calls the required runmode function
172  * based on runmode + runmode_custom_id.
173  *
174  * \param runmode The runmode type.
175  * \param runmode_custom_id The runmode custom id.
176  */
177 static RunMode *RunModeGetCustomMode(enum RunModes runmode, const char *custom_mode)
178 {
179  if (runmode < RUNMODE_USER_MAX) {
180  for (int i = 0; i < runmodes[runmode].cnt; i++) {
181  if (strcmp(runmodes[runmode].runmodes[i].name, custom_mode) == 0)
182  return &runmodes[runmode].runmodes[i];
183  }
184  }
185  return NULL;
186 }
187 
188 
189 /**
190  * Return the running mode
191  *
192  * The returned string must not be freed.
193  *
194  * \return a string containing the current running mode
195  */
196 char *RunmodeGetActive(void)
197 {
198  return active_runmode;
199 }
200 
201 /**
202  * Return the running mode
203  *
204  * The returned string must not be freed.
205  *
206  * \return a string containing the current running mode
207  */
208 const char *RunModeGetMainMode(void)
209 {
210  int mainmode = SCRunmodeGet();
211 
212  return RunModeTranslateModeToName(mainmode);
213 }
214 
215 /**
216  * \brief Register all runmodes in the engine.
217  */
219 {
220  memset(runmodes, 0, sizeof(runmodes));
221 
235 #ifdef UNITTESTS
237 #endif
238 }
239 
240 /**
241  * \brief Lists all registered runmodes.
242  */
244 {
245  printf("------------------------------------- Runmodes -------------------"
246  "-----------------------\n");
247 
248  printf("| %-17s | %-17s | %-10s \n",
249  "RunMode Type", "Custom Mode ", "Description");
250  printf("|-----------------------------------------------------------------"
251  "-----------------------\n");
252  int i = RUNMODE_UNKNOWN + 1;
253  int j = 0;
254  for ( ; i < RUNMODE_USER_MAX; i++) {
255  int mode_displayed = 0;
256  for (j = 0; j < runmodes[i].cnt; j++) {
257  if (mode_displayed == 1) {
258  printf("| ----------------------------------------------"
259  "-----------------------\n");
260  RunMode *runmode = &runmodes[i].runmodes[j];
261  printf("| %-17s | %-17s | %-27s \n",
262  "",
263  runmode->name,
264  runmode->description);
265  } else {
266  RunMode *runmode = &runmodes[i].runmodes[j];
267  printf("| %-17s | %-17s | %-27s \n",
268  RunModeTranslateModeToName(runmode->runmode),
269  runmode->name,
270  runmode->description);
271  }
272  if (mode_displayed == 0)
273  mode_displayed = 1;
274  }
275  if (mode_displayed == 1) {
276  printf("|-----------------------------------------------------------------"
277  "-----------------------\n");
278  }
279  }
280 }
281 
282 static const char *RunModeGetConfOrDefault(int capture_mode, const char *capture_plugin_name)
283 {
284  const char *custom_mode = NULL;
285  const char *val = NULL;
286  if (ConfGet("runmode", &val) != 1) {
287  custom_mode = NULL;
288  } else {
289  custom_mode = val;
290  }
291 
292  if ((custom_mode == NULL) || (strcmp(custom_mode, "auto") == 0)) {
293  switch (capture_mode) {
294  case RUNMODE_PCAP_DEV:
295  custom_mode = RunModeIdsGetDefaultMode();
296  break;
297  case RUNMODE_PCAP_FILE:
298  custom_mode = RunModeFilePcapGetDefaultMode();
299  break;
300  case RUNMODE_PLUGIN: {
301 #ifdef HAVE_PLUGINS
302  SCCapturePlugin *plugin = SCPluginFindCaptureByName(capture_plugin_name);
303  if (plugin == NULL) {
304  FatalError("No capture plugin found with name %s", capture_plugin_name);
305  }
306  custom_mode = (const char *)plugin->GetDefaultMode();
307 #endif
308  break;
309  }
310  case RUNMODE_NFQ:
311  custom_mode = RunModeIpsNFQGetDefaultMode();
312  break;
313  case RUNMODE_IPFW:
314  custom_mode = RunModeIpsIPFWGetDefaultMode();
315  break;
316  case RUNMODE_ERF_FILE:
317  custom_mode = RunModeErfFileGetDefaultMode();
318  break;
319  case RUNMODE_DAG:
320  custom_mode = RunModeErfDagGetDefaultMode();
321  break;
322  case RUNMODE_AFP_DEV:
323  custom_mode = RunModeAFPGetDefaultMode();
324  break;
325  case RUNMODE_AFXDP_DEV:
326  custom_mode = RunModeAFXDPGetDefaultMode();
327  break;
328  case RUNMODE_NETMAP:
329  custom_mode = RunModeNetmapGetDefaultMode();
330  break;
331  case RUNMODE_UNIX_SOCKET:
332  custom_mode = RunModeUnixSocketGetDefaultMode();
333  break;
334  case RUNMODE_NFLOG:
335  custom_mode = RunModeIdsNflogGetDefaultMode();
336  break;
337 #ifdef WINDIVERT
338  case RUNMODE_WINDIVERT:
339  custom_mode = RunModeIpsWinDivertGetDefaultMode();
340  break;
341 #endif
342 #ifdef HAVE_DPDK
343  case RUNMODE_DPDK:
344  custom_mode = RunModeDpdkGetDefaultMode();
345  break;
346 #endif
347  default:
348  return NULL;
349  }
350  } else {
351  /* Add compatibility with old 'worker' name */
352  if (!strcmp("worker", custom_mode)) {
353  SCLogWarning("'worker' mode have been renamed "
354  "to 'workers', please modify your setup.");
355  custom_mode = "workers";
356  }
357  }
358 
359  return custom_mode;
360 }
361 
362 int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
363 {
364  if (runmode == NULL) {
365  runmode = RunModeGetConfOrDefault(capture_mode, capture_plugin_name);
366  if (runmode == NULL) // non-standard runmode
367  return 0;
368  }
369 
370  RunMode *mode = RunModeGetCustomMode(capture_mode, runmode);
371  if (mode == NULL) {
372  return 0;
373  }
374 
375  int ips_enabled = 0;
376  if (mode->RunModeIsIPSEnabled != NULL) {
377  ips_enabled = mode->RunModeIsIPSEnabled();
378  if (ips_enabled == 1) {
379  extern uint16_t g_livedev_mask;
380  if (g_livedev_mask != 0 && LiveGetDeviceCount() > 0) {
381  SCLogWarning("disabling livedev.use-for-tracking with IPS mode. See ticket #6726.");
382  g_livedev_mask = 0;
383  }
384  }
385  }
386 
387  return ips_enabled;
388 }
389 
390 /**
391  */
392 void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name,
393  const char *capture_plugin_args)
394 {
395  char *local_custom_mode = NULL;
396 
397  if (custom_mode == NULL) {
398  custom_mode = RunModeGetConfOrDefault(runmode, capture_plugin_name);
399  if (custom_mode == NULL)
400  FatalError("Unknown runtime mode. Aborting");
401  }
402 
403  RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
404  if (mode == NULL) {
405  SCLogError("The custom type \"%s\" doesn't exist "
406  "for this runmode type \"%s\". Please use --list-runmodes to "
407  "see available custom types for this runmode",
408  custom_mode, RunModeTranslateModeToName(runmode));
409  exit(EXIT_FAILURE);
410  }
411 
412  /* Export the custom mode */
413  if (active_runmode) {
414  SCFree(active_runmode);
415  }
416  active_runmode = SCStrdup(custom_mode);
417  if (unlikely(active_runmode == NULL)) {
418  FatalError("Unable to dup active mode");
419  }
420 
421  if (strcasecmp(active_runmode, "autofp") == 0) {
423  }
424 
425  mode->RunModeFunc();
426 
427  if (local_custom_mode != NULL)
428  SCFree(local_custom_mode);
429 
430  /* Check if the alloted queues have at least 1 reader and writer */
432 
433  if (runmode != RUNMODE_UNIX_SOCKET) {
434  /* spawn management threads */
439  }
441  LogFlushThreads();
443  }
444 }
445 
446 static int g_runmode_needs_bypass = 0;
447 
449 {
450  g_runmode_needs_bypass = 1;
451 }
452 
454 {
455  return g_runmode_needs_bypass;
456 }
457 
458 
459 
460 /**
461  * \brief Registers a new runmode.
462  *
463  * \param runmode Runmode type.
464  * \param name Custom mode for this specific runmode type. Within each
465  * runmode type, each custom name is a primary key.
466  * \param description Description for this runmode.
467  * \param RunModeFunc The function to be run for this runmode.
468  */
469 void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description,
470  int (*RunModeFunc)(void), int (*RunModeIsIPSEnabled)(void))
471 {
472  if (RunModeGetCustomMode(runmode, name) != NULL) {
473  FatalError("runmode '%s' has already "
474  "been registered. Please use an unique name.",
475  name);
476  }
477 
478  void *ptmp = SCRealloc(runmodes[runmode].runmodes,
479  (runmodes[runmode].cnt + 1) * sizeof(RunMode));
480  if (ptmp == NULL) {
481  SCFree(runmodes[runmode].runmodes);
482  runmodes[runmode].runmodes = NULL;
483  exit(EXIT_FAILURE);
484  }
485  runmodes[runmode].runmodes = ptmp;
486 
487  RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].cnt];
488  runmodes[runmode].cnt++;
489  memset(mode, 0x00, sizeof(*mode));
490 
491  mode->runmode = runmode;
492  mode->name = SCStrdup(name);
493  if (unlikely(mode->name == NULL)) {
494  FatalError("Failed to allocate string");
495  }
496  mode->description = SCStrdup(description);
497  if (unlikely(mode->description == NULL)) {
498  FatalError("Failed to allocate string");
499  }
500  mode->RunModeFunc = RunModeFunc;
501  mode->RunModeIsIPSEnabled = RunModeIsIPSEnabled;
502 }
503 
504 /**
505  * Setup the outputs for this run mode.
506  *
507  * \param tv The ThreadVars for the thread the outputs will be
508  * appended to.
509  */
510 static void RunOutputFreeList(void)
511 {
512  OutputFreeList *output;
513  while ((output = TAILQ_FIRST(&output_free_list))) {
514  TAILQ_REMOVE(&output_free_list, output, entries);
515 
516  SCLogDebug("output %s %p %p", output->output_module->name, output, output->output_ctx);
517  if (output->output_ctx != NULL && output->output_ctx->DeInit != NULL)
518  output->output_ctx->DeInit(output->output_ctx);
519  SCFree(output);
520  }
521 }
522 
523 static int file_logger_count = 0;
524 static int filedata_logger_count = 0;
525 
527 {
528  return filedata_logger_count > 0;
529 }
530 
531 bool IsRunModeSystem(enum RunModes run_mode_to_check)
532 {
533  switch (run_mode_to_check) {
534  case RUNMODE_PCAP_FILE:
535  case RUNMODE_ERF_FILE:
537  return false;
538  break;
539  default:
540  return true;
541  }
542 }
543 
544 bool IsRunModeOffline(enum RunModes run_mode_to_check)
545 {
546  switch(run_mode_to_check) {
547  case RUNMODE_CONF_TEST:
548  case RUNMODE_PCAP_FILE:
549  case RUNMODE_ERF_FILE:
551  case RUNMODE_UNIX_SOCKET:
552  return true;
553  break;
554  default:
555  return false;
556  }
557 }
558 
559 /**
560  * Cleanup the run mode.
561  */
562 void RunModeShutDown(void)
563 {
564  RunOutputFreeList();
565 
573 
575 
576  /* Reset logger counts. */
577  file_logger_count = 0;
578  filedata_logger_count = 0;
579 }
580 
581 /** \internal
582  * \brief add Sub RunModeOutput to list for Submodule so we can free
583  * the output ctx at shutdown and unix socket reload */
584 static void AddOutputToFreeList(OutputModule *module, OutputCtx *output_ctx)
585 {
586  OutputFreeList *fl_output = SCCalloc(1, sizeof(OutputFreeList));
587  if (unlikely(fl_output == NULL))
588  return;
589  fl_output->output_module = module;
590  fl_output->output_ctx = output_ctx;
591  TAILQ_INSERT_TAIL(&output_free_list, fl_output, entries);
592 }
593 
594 /** \brief Turn output into thread module */
595 static void SetupOutput(
596  const char *name, OutputModule *module, OutputCtx *output_ctx, LoggerId *logger_bits)
597 {
598  /* flow logger doesn't run in the packet path */
599  if (module->FlowLogFunc) {
600  SCOutputRegisterFlowLogger(module->name, module->FlowLogFunc, output_ctx,
601  module->ThreadInit, module->ThreadDeinit);
602  return;
603  }
604  /* stats logger doesn't run in the packet path */
605  if (module->StatsLogFunc) {
606  OutputRegisterStatsLogger(module->name, module->StatsLogFunc, output_ctx,
607  module->ThreadInit, module->ThreadDeinit);
608  return;
609  }
610 
611  if (module->logger_id == LOGGER_ALERT_DEBUG) {
612  debuglog_enabled = 1;
613  }
614 
615  if (module->PacketLogFunc) {
616  SCLogDebug("%s is a packet logger", module->name);
617  SCOutputRegisterPacketLogger(module->logger_id, module->name, module->PacketLogFunc,
618  module->PacketConditionFunc, output_ctx, module->ThreadInit, module->ThreadDeinit);
619  } else if (module->TxLogFunc) {
620  SCLogDebug("%s is a tx logger", module->name);
621  SCOutputRegisterTxLogger(module->logger_id, module->name, module->alproto,
622  module->TxLogFunc, output_ctx, module->tc_log_progress, module->ts_log_progress,
623  module->TxLogCondition, module->ThreadInit, module->ThreadDeinit);
624  /* Not used with wild card loggers */
625  if (module->alproto != ALPROTO_UNKNOWN) {
626  logger_bits[module->alproto] |= BIT_U32(module->logger_id);
627  }
628  } else if (module->FiledataLogFunc) {
629  SCLogDebug("%s is a filedata logger", module->name);
631  output_ctx, module->ThreadInit, module->ThreadDeinit);
632  filedata_logger_count++;
633  } else if (module->FileLogFunc) {
634  SCLogDebug("%s is a file logger", module->name);
635  SCOutputRegisterFileLogger(module->logger_id, module->name, module->FileLogFunc, output_ctx,
636  module->ThreadInit, module->ThreadDeinit);
637  file_logger_count++;
638  } else if (module->StreamingLogFunc) {
639  SCLogDebug("%s is a streaming logger", module->name);
641  output_ctx, module->stream_type, module->ThreadInit, module->ThreadDeinit);
642  } else {
643  SCLogError("Unknown logger type: name=%s", module->name);
644  }
645 }
646 
647 static void RunModeInitializeEveOutput(ConfNode *conf, OutputCtx *parent_ctx, LoggerId *logger_bits)
648 {
649  ConfNode *types = ConfNodeLookupChild(conf, "types");
650  SCLogDebug("types %p", types);
651  if (types == NULL) {
652  return;
653  }
654 
655  ConfNode *type = NULL;
656  TAILQ_FOREACH(type, &types->head, next) {
657  int sub_count = 0;
658  char subname[256];
659 
660  if (strcmp(type->val, "ikev2") == 0) {
661  SCLogWarning("eve module 'ikev2' has been replaced by 'ike'");
662  strlcpy(subname, "eve-log.ike", sizeof(subname));
663  } else {
664  snprintf(subname, sizeof(subname), "eve-log.%s", type->val);
665  }
666 
667  SCLogConfig("enabling 'eve-log' module '%s'", type->val);
668 
669  ConfNode *sub_output_config = ConfNodeLookupChild(type, type->val);
670  if (sub_output_config != NULL) {
671  const char *enabled = ConfNodeLookupChildValue(
672  sub_output_config, "enabled");
673  if (enabled != NULL && !ConfValIsTrue(enabled)) {
674  continue;
675  }
676  }
677 
678  /* Now setup all registers logger of this name. */
679  OutputModule *sub_module;
680  TAILQ_FOREACH(sub_module, &output_modules, entries) {
681  if (strcmp(subname, sub_module->conf_name) == 0) {
682  sub_count++;
683 
684  if (sub_module->parent_name == NULL ||
685  strcmp(sub_module->parent_name, "eve-log") != 0) {
686  FatalError("bad parent for %s", subname);
687  }
688  if (sub_module->InitSubFunc == NULL) {
689  FatalError("bad sub-module for %s", subname);
690  }
691 
692  /* pass on parent output_ctx */
693  OutputInitResult result =
694  sub_module->InitSubFunc(sub_output_config, parent_ctx);
695  if (!result.ok || result.ctx == NULL) {
696  FatalError("unable to initialize sub-module %s", subname);
697  }
698 
699  AddOutputToFreeList(sub_module, result.ctx);
700  SetupOutput(sub_module->name, sub_module, result.ctx, logger_bits);
701  }
702  }
703 
704  /* Error is no registered loggers with this name
705  * were found .*/
706  if (!sub_count) {
707  FatalErrorOnInit("No output module named %s", subname);
708  continue;
709  }
710  }
711 }
712 
713 static void RunModeInitializeLuaOutput(ConfNode *conf, OutputCtx *parent_ctx, LoggerId *logger_bits)
714 {
715  OutputModule *lua_module = OutputGetModuleByConfName("lua");
716  BUG_ON(lua_module == NULL);
717 
718  ConfNode *scripts = ConfNodeLookupChild(conf, "scripts");
719  BUG_ON(scripts == NULL); //TODO
720 
721  OutputModule *m;
722  TAILQ_FOREACH(m, &parent_ctx->submodules, entries) {
723  SCLogDebug("m %p %s:%s", m, m->name, m->conf_name);
724 
725  ConfNode *script = NULL;
726  TAILQ_FOREACH(script, &scripts->head, next) {
727  SCLogDebug("script %s", script->val);
728  if (strcmp(script->val, m->conf_name) == 0) {
729  break;
730  }
731  }
732  BUG_ON(script == NULL);
733 
734  /* pass on parent output_ctx */
735  OutputInitResult result = m->InitSubFunc(script, parent_ctx);
736  if (!result.ok || result.ctx == NULL) {
737  continue;
738  }
739 
740  AddOutputToFreeList(m, result.ctx);
741  SetupOutput(m->name, m, result.ctx, logger_bits);
742  }
743 }
744 
745 extern bool g_file_logger_enabled;
746 extern bool g_filedata_logger_enabled;
747 
748 /**
749  * Initialize the output modules.
750  */
752 {
753  ConfNode *outputs = ConfGetNode("outputs");
754  if (outputs == NULL) {
755  /* No "outputs" section in the configuration. */
756  return;
757  }
758 
759  ConfNode *output, *output_config;
760  const char *enabled;
761  char tls_log_enabled = 0;
762  char tls_store_present = 0;
763 
764  // g_alproto_max is set to its final value
765  LoggerId logger_bits[g_alproto_max];
766  memset(logger_bits, 0, g_alproto_max * sizeof(LoggerId));
767  TAILQ_FOREACH(output, &outputs->head, next) {
768 
769  output_config = ConfNodeLookupChild(output, output->val);
770  if (output_config == NULL) {
771  /* Shouldn't happen. */
772  FatalError("Failed to lookup configuration child node: %s", output->val);
773  }
774 
775  if (strcmp(output->val, "tls-store") == 0) {
776  tls_store_present = 1;
777  }
778 
779  enabled = ConfNodeLookupChildValue(output_config, "enabled");
780  if (enabled == NULL || !ConfValIsTrue(enabled)) {
781  continue;
782  }
783 
784  if (strcmp(output->val, "file-log") == 0) {
785  SCLogWarning("file-log is no longer supported,"
786  " use eve.files instead "
787  "(see ticket #2376"
788  " for an explanation)");
789  continue;
790  } else if (strncmp(output->val, "unified-", sizeof("unified-") - 1) == 0) {
791  SCLogWarning("Unified1 is no longer supported,"
792  " use Unified2 instead "
793  "(see ticket #353"
794  " for an explanation)");
795  continue;
796  } else if (strncmp(output->val, "unified2-", sizeof("unified2-") - 1) == 0) {
797  SCLogWarning("Unified2 is no longer supported.");
798  continue;
799  } else if (strcmp(output->val, "dns-log") == 0) {
800  SCLogWarning("dns-log is not longer available as of Suricata 5.0");
801  continue;
802  } else if (strcmp(output->val, "tls-log") == 0) {
803  tls_log_enabled = 1;
804  }
805 
806  OutputModule *module;
807  int count = 0;
808  TAILQ_FOREACH(module, &output_modules, entries) {
809  if (strcmp(module->conf_name, output->val) != 0) {
810  continue;
811  }
812 
813  count++;
814 
815  OutputCtx *output_ctx = NULL;
816  if (module->InitFunc != NULL) {
817  OutputInitResult r = module->InitFunc(output_config);
818  if (!r.ok) {
819  FatalErrorOnInit("output module \"%s\": setup failed", output->val);
820  continue;
821  } else if (r.ctx == NULL) {
822  continue;
823  }
824  output_ctx = r.ctx;
825  } else if (module->InitSubFunc != NULL) {
826  SCLogInfo("skipping submodule");
827  continue;
828  }
829 
830  // TODO if module == parent, find it's children
831  if (strcmp(output->val, "eve-log") == 0) {
832  RunModeInitializeEveOutput(output_config, output_ctx, logger_bits);
833 
834  /* add 'eve-log' to free list as it's the owner of the
835  * main output ctx from which the sub-modules share the
836  * LogFileCtx */
837  AddOutputToFreeList(module, output_ctx);
838  } else if (strcmp(output->val, "lua") == 0) {
839  SCLogDebug("handle lua");
840  if (output_ctx == NULL)
841  continue;
842  RunModeInitializeLuaOutput(output_config, output_ctx, logger_bits);
843  AddOutputToFreeList(module, output_ctx);
844  } else {
845  AddOutputToFreeList(module, output_ctx);
846  SetupOutput(module->name, module, output_ctx, logger_bits);
847  }
848  }
849  if (count == 0) {
850  FatalErrorOnInit("No output module named %s", output->val);
851  continue;
852  }
853  }
854 
855  /* Backward compatibility code */
856  if (!tls_store_present && tls_log_enabled) {
857  /* old YAML with no "tls-store" in outputs. "tls-log" value needs
858  * to be started using 'tls-log' config as own config */
859  SCLogWarning("Please use 'tls-store' in YAML to configure TLS storage");
860 
861  TAILQ_FOREACH(output, &outputs->head, next) {
862  output_config = ConfNodeLookupChild(output, output->val);
863 
864  if (strcmp(output->val, "tls-log") == 0) {
865 
866  OutputModule *module = OutputGetModuleByConfName("tls-store");
867  if (module == NULL) {
868  SCLogWarning("No output module named %s, ignoring", "tls-store");
869  continue;
870  }
871 
872  OutputCtx *output_ctx = NULL;
873  if (module->InitFunc != NULL) {
874  OutputInitResult r = module->InitFunc(output_config);
875  if (!r.ok) {
876  FatalErrorOnInit("output module setup failed");
877  continue;
878  } else if (r.ctx == NULL) {
879  continue;
880  }
881  output_ctx = r.ctx;
882  }
883 
884  AddOutputToFreeList(module, output_ctx);
885  SetupOutput(module->name, module, output_ctx, logger_bits);
886  }
887  }
888  }
889 
890  /* register the logger bits to the app-layer */
891  AppProto a;
892  for (a = 0; a < g_alproto_max; a++) {
893  if (AppLayerParserSupportsFiles(IPPROTO_TCP, a)) {
895  logger_bits[a] |= BIT_U32(LOGGER_FILE);
897  logger_bits[a] |= BIT_U32(LOGGER_FILEDATA);
898  SCLogDebug("IPPROTO_TCP::%s: g_file_logger_enabled %d g_filedata_logger_enabled %d -> "
899  "%08x",
901  logger_bits[a]);
902  }
903  if (AppLayerParserSupportsFiles(IPPROTO_UDP, a)) {
905  logger_bits[a] |= BIT_U32(LOGGER_FILE);
907  logger_bits[a] |= BIT_U32(LOGGER_FILEDATA);
908  }
909 
910  if (logger_bits[a] == 0)
911  continue;
912 
913  const int tcp = AppLayerParserProtocolHasLogger(IPPROTO_TCP, a) | (g_file_logger_enabled) |
915  const int udp = AppLayerParserProtocolHasLogger(IPPROTO_UDP, a) | (g_file_logger_enabled) |
917  SCLogDebug("tcp %d udp %d", tcp, udp);
918 
919  SCLogDebug("logger for %s: %s %s", AppProtoToString(a),
920  tcp ? "true" : "false", udp ? "true" : "false");
921 
922  SCLogDebug("logger bits for %s: %08x", AppProtoToString(a), logger_bits[a]);
923  if (tcp)
924  AppLayerParserRegisterLoggerBits(IPPROTO_TCP, a, logger_bits[a]);
925  if (udp)
926  AppLayerParserRegisterLoggerBits(IPPROTO_UDP, a, logger_bits[a]);
927  }
929 }
930 
932 
933 /**
934  * Initialize multithreading settings.
935  */
937 {
938  int affinity = 0;
939  if ((ConfGetBool("threading.set-cpu-affinity", &affinity)) == 0) {
941  } else {
942  threading_set_cpu_affinity = affinity == 1;
943  }
944 
945  /* try to get custom cpu mask value if needed */
948  }
949  if ((ConfGetFloat("threading.detect-thread-ratio", &threading_detect_ratio)) != 1) {
950  if (ConfGetNode("threading.detect-thread-ratio") != NULL)
951  WarnInvalidConfEntry("threading.detect-thread-ratio", "%s", "1");
953  }
954 
955  SCLogDebug("threading.detect-thread-ratio %f", threading_detect_ratio);
956 
957  /*
958  * Check if there's a configuration setting for the per-thread stack size
959  * in case the default per-thread stack size is to be adjusted
960  */
961  const char *ss = NULL;
962  if ((ConfGet("threading.stack-size", &ss)) == 1) {
963  if (ss != NULL) {
965  FatalError("Failed to initialize thread_stack_size output, invalid limit: %s", ss);
966  }
967  }
968  } else {
969  pthread_attr_t attr;
970  pthread_attr_init(&attr);
971  size_t size;
972  if (pthread_attr_getstacksize(&attr, &size) == 0 && size < 512 * 1024) {
973  threading_set_stack_size = 512 * 1024;
974  SCLogNotice("thread stack size of %" PRIuMAX " too small: setting to 512k",
975  (uintmax_t)size);
976  }
977  }
978 
979  SCLogDebug("threading.stack-size %" PRIu64, threading_set_stack_size);
980 }
thread_name_workers
const char * thread_name_workers
Definition: runmodes.c:67
RUNMODE_AFXDP_DEV
@ RUNMODE_AFXDP_DEV
Definition: runmodes.h:37
RunModeIpsIPFWGetDefaultMode
const char * RunModeIpsIPFWGetDefaultMode(void)
Definition: runmode-ipfw.c:44
FlowManagerThreadSpawn
void FlowManagerThreadSpawn(void)
spawn the flow manager thread
Definition: flow-manager.c:1000
suricata-plugin.h
AffinitySetupLoadFromConfig
void AffinitySetupLoadFromConfig(void)
Extract cpu affinity configuration from current config file.
Definition: util-affinity.c:162
OutputModule_::parent_name
const char * parent_name
Definition: output.h:61
TmThreadsSealThreads
void TmThreadsSealThreads(void)
Definition: tm-threads.c:2091
thread_name_counter_wakeup
const char * thread_name_counter_wakeup
Definition: runmodes.c:75
log-flush.h
OutputModule_::FileLogFunc
SCFileLogger FileLogFunc
Definition: output.h:73
flow-bypass.h
RunMode_::description
const char * description
Definition: runmodes.c:85
g_livedev_mask
uint16_t g_livedev_mask
Definition: suricata.c:203
detect-engine.h
SCRunmodeGet
int SCRunmodeGet(void)
Get the current run mode.
Definition: suricata.c:264
RUNMODE_UNIX_SOCKET
@ RUNMODE_UNIX_SOCKET
Definition: runmodes.h:41
threading_set_cpu_affinity
bool threading_set_cpu_affinity
Definition: runmodes.c:61
RunModeErfFileRegister
void RunModeErfFileRegister(void)
Definition: runmode-erf-file.c:39
OutputStreamingShutdown
void OutputStreamingShutdown(void)
Definition: output-streaming.c:439
RunMode_::RunModeIsIPSEnabled
int(* RunModeIsIPSEnabled)(void)
Definition: runmodes.c:88
AppLayerParserProtocolHasLogger
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1525
thread_name_flow_mgr
const char * thread_name_flow_mgr
Definition: runmodes.c:69
RUNMODE_UNITTEST
@ RUNMODE_UNITTEST
Definition: runmodes.h:40
RunModeErfFileGetDefaultMode
const char * RunModeErfFileGetDefaultMode(void)
Definition: runmode-erf-file.c:34
ConfNode_::val
char * val
Definition: conf.h:34
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:482
RUNMODE_DPDK
@ RUNMODE_DPDK
Definition: runmodes.h:39
runmode-af-packet.h
RUNMODE_UNKNOWN
@ RUNMODE_UNKNOWN
Definition: runmodes.h:28
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
LOGGER_FILEDATA
@ LOGGER_FILEDATA
Definition: suricata-common.h:479
OutputTxShutdown
void OutputTxShutdown(void)
Definition: output-tx.c:666
TmqhFlowPrintAutofpHandler
void TmqhFlowPrintAutofpHandler(void)
Definition: tmqh-flow.c:84
RunModeIdsAFPRegister
void RunModeIdsAFPRegister(void)
Definition: runmode-af-packet.c:133
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:190
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
BypassedFlowManagerThreadSpawn
void BypassedFlowManagerThreadSpawn(void)
spawn the flow bypass manager thread
Definition: flow-bypass.c:187
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:85
RunModeShutDown
void RunModeShutDown(void)
Definition: runmodes.c:562
RunModeDispatch
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
Definition: runmodes.c:392
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
OutputModule_::name
const char * name
Definition: output.h:59
thread_name_counter_stats
const char * thread_name_counter_stats
Definition: runmodes.c:74
SCOutputRegisterStreamingLogger
int SCOutputRegisterStreamingLogger(LoggerId id, const char *name, SCStreamingLogger LogFunc, void *initdata, enum SCOutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a streaming logger.
Definition: output-streaming.c:63
OutputModule_::logger_id
LoggerId logger_id
Definition: output.h:58
LoggerId
LoggerId
Definition: suricata-common.h:469
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
runmode-pcap.h
AppLayerParserSupportsFiles
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1157
RunModeAFPGetDefaultMode
const char * RunModeAFPGetDefaultMode(void)
Definition: runmode-af-packet.c:64
thread_name_flow_rec
const char * thread_name_flow_rec
Definition: runmodes.c:70
OutputFiledataShutdown
void OutputFiledataShutdown(void)
Definition: output-filedata.c:277
RUNMODE_ERF_FILE
@ RUNMODE_ERF_FILE
Definition: runmodes.h:34
OutputModule_::ts_log_progress
int ts_log_progress
Definition: output.h:81
runmode-erf-file.h
runmode-windivert.h
RunModeFilePcapGetDefaultMode
const char * RunModeFilePcapGetDefaultMode(void)
Definition: runmode-pcap-file.c:35
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
thread_name_autofp
const char * thread_name_autofp
Definition: runmodes.c:65
RUNMODE_NFLOG
@ RUNMODE_NFLOG
Definition: runmodes.h:32
OutputGetModuleByConfName
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
Definition: output.c:615
OutputSetupActiveLoggers
void OutputSetupActiveLoggers(void)
Definition: output.c:826
OutputModule_::StatsLogFunc
StatsLogger StatsLogFunc
Definition: output.h:77
RunModeIdsNflogGetDefaultMode
const char * RunModeIdsNflogGetDefaultMode(void)
Definition: runmode-nflog.c:208
RUNMODE_PCAP_DEV
@ RUNMODE_PCAP_DEV
Definition: runmodes.h:29
RunMode_::RunModeFunc
int(* RunModeFunc)(void)
Definition: runmodes.c:87
OutputStatsShutdown
void OutputStatsShutdown(void)
Definition: output-stats.c:184
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:294
RunmodeGetActive
char * RunmodeGetActive(void)
Definition: runmodes.c:196
m
SCMutex m
Definition: flow-hash.h:6
OutputModule_::InitSubFunc
OutputInitSubFunc InitSubFunc
Definition: output.h:63
SCOutputRegisterFlowLogger
int SCOutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow logger.
Definition: output-flow.c:58
RunModes
struct RunModes_ RunModes
OutputModule_::PacketLogFunc
PacketLogger PacketLogFunc
Definition: output.h:68
TmValidateQueueState
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
Definition: tm-queues.c:101
RunModeAFXDPGetDefaultMode
const char * RunModeAFXDPGetDefaultMode(void)
Definition: runmode-af-xdp.c:66
IsRunModeOffline
bool IsRunModeOffline(enum RunModes run_mode_to_check)
Definition: runmodes.c:544
OutputModule_::FiledataLogFunc
SCFiledataLogger FiledataLogFunc
Definition: output.h:74
RunModeInitializeOutputs
void RunModeInitializeOutputs(void)
Definition: runmodes.c:751
OutputRegisterStatsLogger
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output-stats.c:51
debuglog_enabled
int debuglog_enabled
Definition: runmodes.c:60
thread_name_single
const char * thread_name_single
Definition: runmodes.c:66
OutputModule_::alproto
AppProto alproto
Definition: output.h:78
RUNMODE_DAG
@ RUNMODE_DAG
Definition: runmodes.h:35
RunModes_
Definition: runmodes.c:91
runmode-unix-socket.h
util-unittest.h
RUNMODE_NETMAP
@ RUNMODE_NETMAP
Definition: runmodes.h:38
SCCapturePlugin_::GetDefaultMode
const char *(* GetDefaultMode)(void)
Definition: suricata-plugin.h:49
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:536
OutputClearActiveLoggers
void OutputClearActiveLoggers(void)
Definition: output.c:839
OutputCtx_
Definition: tm-modules.h:84
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
TAILQ_ENTRY
#define TAILQ_ENTRY(type)
Definition: queue.h:239
RunModeUnixSocketGetDefaultMode
const char * RunModeUnixSocketGetDefaultMode(void)
Definition: runmode-unix-socket.c:86
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
RUNMODE_USER_MAX
@ RUNMODE_USER_MAX
Definition: runmodes.h:44
RunModeIpsNFQRegister
void RunModeIpsNFQRegister(void)
Definition: runmode-nfq.c:47
OutputModule_::stream_type
enum SCOutputStreamingType stream_type
Definition: output.h:79
counters.h
RunModeInitializeThreadSettings
void RunModeInitializeThreadSettings(void)
Definition: runmodes.c:936
OutputModule_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output.h:65
RunModeDpdkGetDefaultMode
const char * RunModeDpdkGetDefaultMode(void)
Definition: runmode-dpdk.c:1720
TAILQ_HEAD_INITIALIZER
#define TAILQ_HEAD_INITIALIZER(head)
Definition: queue.h:236
IsRunModeSystem
bool IsRunModeSystem(enum RunModes run_mode_to_check)
Definition: runmodes.c:531
output_modules
OutputModuleList output_modules
RunModes
RunModes
Definition: runmodes.h:27
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
util-device.h
util-debug.h
RunModes_::runmodes
RunMode * runmodes
Definition: runmodes.c:93
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
thread_name_flow_bypass
const char * thread_name_flow_bypass
Definition: runmodes.c:71
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:29
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:47
RUNMODE_CONF_TEST
@ RUNMODE_CONF_TEST
Definition: runmodes.h:52
OutputModule_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output.h:66
RunModeListRunmodes
void RunModeListRunmodes(void)
Lists all registered runmodes.
Definition: runmodes.c:243
g_filedata_logger_enabled
bool g_filedata_logger_enabled
Definition: output-filedata.c:37
BIT_U32
#define BIT_U32(n)
Definition: suricata-common.h:409
RunModeRegisterNewRunMode
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), int(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
Definition: runmodes.c:469
threading_set_stack_size
uint64_t threading_set_stack_size
Definition: runmodes.c:62
RunModeEnablesBypassManager
void RunModeEnablesBypassManager(void)
Definition: runmodes.c:448
OutputPacketShutdown
void OutputPacketShutdown(void)
Definition: output-packet.c:200
RunModeIdsNflogRegister
void RunModeIdsNflogRegister(void)
Definition: runmode-nflog.c:213
util-affinity.h
RunMode_
Holds description for a runmode.
Definition: runmodes.c:81
SCCapturePlugin_
Definition: suricata-plugin.h:44
AppLayerParserRegisterLoggerBits
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
Definition: app-layer-parser.c:457
RunModeIpsIPFWRegister
void RunModeIpsIPFWRegister(void)
Definition: runmode-ipfw.c:49
OutputModule_::StreamingLogFunc
SCStreamingLogger StreamingLogFunc
Definition: output.h:76
OutputInitResult_::ok
bool ok
Definition: output.h:48
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
RunModeErfDagGetDefaultMode
const char * RunModeErfDagGetDefaultMode(void)
Definition: runmode-erf-dag.c:43
app-layer-parser.h
SCOutputRegisterTxLogger
int SCOutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, void *initdata, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a transaction logger.
Definition: output-tx.c:65
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:309
runmode-netmap.h
runmode-erf-dag.h
thread_name_detect_loader
const char * thread_name_detect_loader
Definition: runmodes.c:73
OutputModule_::conf_name
const char * conf_name
Definition: output.h:60
OutputModule_::FlowLogFunc
FlowLogger FlowLogFunc
Definition: output.h:75
type
uint16_t type
Definition: decode-vlan.c:106
conf.h
OutputFileShutdown
void OutputFileShutdown(void)
Definition: output-file.c:239
runmode-pcap-file.h
name
const char * name
Definition: tm-threads.c:2081
FlowRecyclerThreadSpawn
void FlowRecyclerThreadSpawn(void)
spawn the flow recycler thread
Definition: flow-manager.c:1195
util-plugin.h
RunModeErfDagRegister
void RunModeErfDagRegister(void)
Definition: runmode-erf-dag.c:48
RunMode
struct RunMode_ RunMode
Holds description for a runmode.
SCOutputRegisterPacketLogger
int SCOutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet logger.
Definition: output-packet.c:55
SCOutputRegisterFileLogger
int SCOutputRegisterFileLogger(LoggerId id, const char *name, SCFileLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file logger.
Definition: output-file.c:56
runmodes.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
WarnInvalidConfEntry
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
Definition: util-misc.h:35
RunModes_::cnt
int cnt
Definition: runmodes.c:92
RunModeIpsWinDivertRegister
void RunModeIpsWinDivertRegister(void)
Definition: runmode-windivert.c:45
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:781
OutputFreeList_::output_ctx
OutputCtx * output_ctx
Definition: runmodes.c:103
runmode-nfq.h
RunModeIdsAFXDPRegister
void RunModeIdsAFXDPRegister(void)
Definition: runmode-af-xdp.c:71
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
OutputInitResult_
Definition: output.h:46
ConfGetFloat
int ConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
Definition: conf.c:615
OutputModule_::TxLogCondition
TxLoggerCondition TxLogCondition
Definition: output.h:72
RunModeUnixSocketRegister
void RunModeUnixSocketRegister(void)
Definition: runmode-unix-socket.c:557
LogFlushThreads
void LogFlushThreads(void)
Definition: log-flush.c:187
flow-manager.h
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:90
thread_name_heartbeat
const char * thread_name_heartbeat
Definition: runmodes.c:76
FatalErrorOnInit
#define FatalErrorOnInit(...)
Fatal error IF we're starting up, and configured to consider errors to be fatal errors.
Definition: util-debug.h:511
StatsSpawnThreads
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
Definition: counters.c:902
RunModeNeedsBypassManager
int RunModeNeedsBypassManager(void)
Definition: runmodes.c:453
g_file_logger_enabled
bool g_file_logger_enabled
Definition: output-file.c:39
LOGGER_ALERT_DEBUG
@ LOGGER_ALERT_DEBUG
Definition: suricata-common.h:486
RunModeIdsPcapRegister
void RunModeIdsPcapRegister(void)
Definition: runmode-pcap.c:39
RunModeRegisterRunModes
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
Definition: runmodes.c:218
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
RunModeFilePcapRegister
void RunModeFilePcapRegister(void)
Definition: runmode-pcap-file.c:40
FatalError
#define FatalError(...)
Definition: util-debug.h:502
OutputModule_::PacketConditionFunc
PacketLogCondition PacketConditionFunc
Definition: output.h:70
RUNMODE_NFQ
@ RUNMODE_NFQ
Definition: runmodes.h:31
LOGGER_FILE
@ LOGGER_FILE
Definition: suricata-common.h:478
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
RunModeNetmapGetDefaultMode
const char * RunModeNetmapGetDefaultMode(void)
Definition: runmode-netmap.c:55
RunModeIpsNFQGetDefaultMode
const char * RunModeIpsNFQGetDefaultMode(void)
Definition: runmode-nfq.c:42
RUNMODE_ENGINE_ANALYSIS
@ RUNMODE_ENGINE_ANALYSIS
Definition: runmodes.h:54
RunMode_::runmode
enum RunModes runmode
Definition: runmodes.c:83
runmode-af-xdp.h
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SCFree
#define SCFree(p)
Definition: util-mem.h:61
RunModeIdsNetmapRegister
void RunModeIdsNetmapRegister(void)
Definition: runmode-netmap.c:127
ConfNode_
Definition: conf.h:32
OutputFreeList
struct OutputFreeList_ OutputFreeList
thread_name_verdict
const char * thread_name_verdict
Definition: runmodes.c:68
RunModeDpdkRegister
void RunModeDpdkRegister(void)
Definition: runmode-dpdk.c:1725
OutputModule_::TxLogFunc
TxLogger TxLogFunc
Definition: output.h:71
OutputModule_::tc_log_progress
int tc_log_progress
Definition: output.h:80
TAILQ_HEAD
#define TAILQ_HEAD(name, type)
Definition: queue.h:230
OutputFlowShutdown
void OutputFlowShutdown(void)
Definition: output-flow.c:187
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
RunModeEngineIsIPS
int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
Definition: runmodes.c:362
OutputFreeList_
Definition: runmodes.c:101
tmqh-flow.h
RUNMODE_WINDIVERT
@ RUNMODE_WINDIVERT
Definition: runmodes.h:42
runmode-dpdk.h
SCOutputRegisterFiledataLogger
int SCOutputRegisterFiledataLogger(LoggerId id, const char *name, SCFiledataLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file-data logger.
Definition: output-filedata.c:54
runmode-ipfw.h
thread_name_unix_socket
const char * thread_name_unix_socket
Definition: runmodes.c:72
OutputFreeList_::output_module
OutputModule * output_module
Definition: runmodes.c:102
runmode-nflog.h
RunModeGetMainMode
const char * RunModeGetMainMode(void)
Definition: runmodes.c:208
RunModeOutputFiledataEnabled
int RunModeOutputFiledataEnabled(void)
Definition: runmodes.c:526
LiveGetDeviceCount
int LiveGetDeviceCount(void)
Get the number of registered devices.
Definition: util-device.c:164
util-misc.h
RunMode_::name
const char * name
Definition: runmodes.c:84
OutputModule_
Definition: output.h:57
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:237
UtRunModeRegister
void UtRunModeRegister(void)
Definition: util-unittest.c:283
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
RUNMODE_AFP_DEV
@ RUNMODE_AFP_DEV
Definition: runmodes.h:36
RUNMODE_PCAP_FILE
@ RUNMODE_PCAP_FILE
Definition: runmodes.h:30
RunModeIpsWinDivertGetDefaultMode
const char * RunModeIpsWinDivertGetDefaultMode(void)
Definition: runmode-windivert.c:40
RUNMODE_PLUGIN
@ RUNMODE_PLUGIN
Definition: runmodes.h:43
RUNMODE_IPFW
@ RUNMODE_IPFW
Definition: runmodes.h:33
SCPluginFindCaptureByName
SCCapturePlugin * SCPluginFindCaptureByName(const char *name)
threading_detect_ratio
float threading_detect_ratio
Definition: runmodes.c:931
output.h
OutputModule_::InitFunc
OutputInitFunc InitFunc
Definition: output.h:62
RunModeIdsGetDefaultMode
const char * RunModeIdsGetDefaultMode(void)
Definition: runmode-pcap.c:32
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:809