suricata
runmodes.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /** \file
19  *
20  * \author Victor Julien <victor@inliniac.net>
21  *
22  * Pre-cooked threading runmodes.
23  */
24 
25 #include "suricata-common.h"
26 #include "detect-engine.h"
27 #include "app-layer-parser.h"
28 #include "util-debug.h"
29 #include "util-affinity.h"
30 #include "conf.h"
31 #include "log-flush.h"
32 #include "runmodes.h"
33 #include "runmode-af-packet.h"
34 #include "runmode-af-xdp.h"
35 #include "runmode-dpdk.h"
36 #include "runmode-erf-dag.h"
37 #include "runmode-erf-file.h"
38 #include "runmode-ipfw.h"
39 #include "runmode-lib.h"
40 #include "runmode-netmap.h"
41 #include "runmode-nflog.h"
42 #include "runmode-nfq.h"
43 #include "runmode-pcap.h"
44 #include "runmode-pcap-file.h"
45 #include "runmode-unix-socket.h"
46 #include "runmode-windivert.h"
47 #include "util-unittest.h"
48 #include "util-misc.h"
49 #include "util-plugin.h"
50 
51 #include "output.h"
52 
53 #include "tmqh-flow.h"
54 #include "flow-manager.h"
55 #include "flow-bypass.h"
56 #include "counters.h"
57 
58 #include "suricata-plugin.h"
59 #include "util-device-private.h"
60 
64 
65 /* Runmode Global Thread Names */
66 const char *thread_name_autofp = "RX";
67 const char *thread_name_single = "W";
68 const char *thread_name_workers = "W";
69 const char *thread_name_verdict = "TX";
70 const char *thread_name_flow_mgr = "FM";
71 const char *thread_name_flow_rec = "FR";
72 const char *thread_name_flow_bypass = "FB";
73 const char *thread_name_unix_socket = "US";
74 const char *thread_name_detect_loader = "DL";
75 const char *thread_name_counter_stats = "CS";
76 const char *thread_name_counter_wakeup = "CW";
77 const char *thread_name_heartbeat = "HB";
78 
79 /**
80  * \brief Holds description for a runmode.
81  */
82 typedef struct RunMode_ {
83  /* the runmode type */
84  enum SCRunModes runmode;
85  const char *name;
86  const char *description;
87  /* runmode function */
88  int (*RunModeFunc)(void);
89  int (*RunModeIsIPSEnabled)(void);
91 
92 typedef struct RunModes_ {
93  int cnt;
96 
97 static RunModes runmodes[RUNMODE_USER_MAX];
98 
99 static char *active_runmode;
100 
101 /* free list for our outputs */
102 typedef struct OutputFreeList_ {
105 
106  TAILQ_ENTRY(OutputFreeList_) entries;
108 static TAILQ_HEAD(, OutputFreeList_) output_free_list =
109  TAILQ_HEAD_INITIALIZER(output_free_list);
110 
111 /**
112  * \internal
113  * \brief Translate a runmode mode to a printable string.
114  *
115  * \param runmode Runmode to be converted into a printable string.
116  *
117  * \retval string Printable string.
118  */
119 static const char *RunModeTranslateModeToName(int runmode)
120 {
121  switch (runmode) {
122  case RUNMODE_PCAP_DEV:
123  return "PCAP_DEV";
124  case RUNMODE_PCAP_FILE:
125  return "PCAP_FILE";
126  case RUNMODE_PLUGIN:
127  return "PLUGIN";
128  case RUNMODE_NFQ:
129  return "NFQ";
130  case RUNMODE_NFLOG:
131  return "NFLOG";
132  case RUNMODE_IPFW:
133  return "IPFW";
134  case RUNMODE_ERF_FILE:
135  return "ERF_FILE";
136  case RUNMODE_DAG:
137  return "ERF_DAG";
138  case RUNMODE_UNITTEST:
139  return "UNITTEST";
140  case RUNMODE_AFP_DEV:
141  return "AF_PACKET_DEV";
142  case RUNMODE_AFXDP_DEV:
143  return "AF_XDP_DEV";
144  case RUNMODE_NETMAP:
145 #ifdef HAVE_NETMAP
146  return "NETMAP";
147 #else
148  return "NETMAP(DISABLED)";
149 #endif
150  case RUNMODE_UNIX_SOCKET:
151  return "UNIX_SOCKET";
152  case RUNMODE_WINDIVERT:
153 #ifdef WINDIVERT
154  return "WINDIVERT";
155 #else
156  return "WINDIVERT(DISABLED)";
157 #endif
158  case RUNMODE_DPDK:
159 #ifdef HAVE_DPDK
160  return "DPDK";
161 #else
162  return "DPDK(DISABLED)";
163 #endif
164  case RUNMODE_LIB:
165  return "LIB";
166 
167  default:
168  FatalError("Unknown runtime mode. Aborting");
169  }
170 }
171 
172 /**
173  * \internal
174  * \brief Dispatcher function for runmodes. Calls the required runmode function
175  * based on runmode + runmode_custom_id.
176  *
177  * \param runmode The runmode type.
178  * \param runmode_custom_id The runmode custom id.
179  */
180 static RunMode *RunModeGetCustomMode(enum SCRunModes runmode, const char *custom_mode)
181 {
182  if (runmode < RUNMODE_USER_MAX) {
183  for (int i = 0; i < runmodes[runmode].cnt; i++) {
184  if (strcmp(runmodes[runmode].runmodes[i].name, custom_mode) == 0)
185  return &runmodes[runmode].runmodes[i];
186  }
187  }
188  return NULL;
189 }
190 
191 
192 /**
193  * Return the running mode
194  *
195  * The returned string must not be freed.
196  *
197  * \return a string containing the current running mode
198  */
199 char *RunmodeGetActive(void)
200 {
201  return active_runmode;
202 }
203 
205 {
206  return RunmodeGetActive() && (strcmp(RunmodeGetActive(), "workers") == 0);
207 }
208 
209 bool RunmodeIsAutofp(void)
210 {
211  return RunmodeGetActive() && (strcmp(RunmodeGetActive(), "autofp") == 0);
212 }
213 
214 /**
215  * Return the running mode
216  *
217  * The returned string must not be freed.
218  *
219  * \return a string containing the current running mode
220  */
221 const char *RunModeGetMainMode(void)
222 {
223  int mainmode = SCRunmodeGet();
224 
225  return RunModeTranslateModeToName(mainmode);
226 }
227 
228 /**
229  * \brief Register all runmodes in the engine.
230  */
232 {
233  memset(runmodes, 0, sizeof(runmodes));
234 
249 #ifdef UNITTESTS
251 #endif
252 }
253 
254 /**
255  * \brief Lists all registered runmodes.
256  */
258 {
259  printf("------------------------------------- Runmodes -------------------"
260  "-----------------------\n");
261 
262  printf("| %-17s | %-17s | %-10s \n",
263  "RunMode Type", "Custom Mode ", "Description");
264  printf("|-----------------------------------------------------------------"
265  "-----------------------\n");
266  int i = RUNMODE_UNKNOWN + 1;
267  int j = 0;
268  for ( ; i < RUNMODE_USER_MAX; i++) {
269  int mode_displayed = 0;
270  for (j = 0; j < runmodes[i].cnt; j++) {
271  if (mode_displayed == 1) {
272  printf("| ----------------------------------------------"
273  "-----------------------\n");
274  RunMode *runmode = &runmodes[i].runmodes[j];
275  printf("| %-17s | %-17s | %-27s \n",
276  "",
277  runmode->name,
278  runmode->description);
279  } else {
280  RunMode *runmode = &runmodes[i].runmodes[j];
281  printf("| %-17s | %-17s | %-27s \n",
282  RunModeTranslateModeToName(runmode->runmode),
283  runmode->name,
284  runmode->description);
285  }
286  if (mode_displayed == 0)
287  mode_displayed = 1;
288  }
289  if (mode_displayed == 1) {
290  printf("|-----------------------------------------------------------------"
291  "-----------------------\n");
292  }
293  }
294 }
295 
296 static const char *RunModeGetConfOrDefault(int capture_mode, const char *capture_plugin_name)
297 {
298  const char *custom_mode = NULL;
299  const char *val = NULL;
300  if (SCConfGet("runmode", &val) != 1) {
301  custom_mode = NULL;
302  } else {
303  custom_mode = val;
304  }
305 
306  if ((custom_mode == NULL) || (strcmp(custom_mode, "auto") == 0)) {
307  switch (capture_mode) {
308  case RUNMODE_PCAP_DEV:
309  custom_mode = RunModeIdsGetDefaultMode();
310  break;
311  case RUNMODE_PCAP_FILE:
312  custom_mode = RunModeFilePcapGetDefaultMode();
313  break;
314  case RUNMODE_PLUGIN: {
315 #ifdef HAVE_PLUGINS
316  SCCapturePlugin *plugin = SCPluginFindCaptureByName(capture_plugin_name);
317  if (plugin == NULL) {
318  FatalError("No capture plugin found with name %s", capture_plugin_name);
319  }
320  custom_mode = (const char *)plugin->GetDefaultMode();
321 #endif
322  break;
323  }
324  case RUNMODE_NFQ:
325  custom_mode = RunModeIpsNFQGetDefaultMode();
326  break;
327  case RUNMODE_IPFW:
328  custom_mode = RunModeIpsIPFWGetDefaultMode();
329  break;
330  case RUNMODE_ERF_FILE:
331  custom_mode = RunModeErfFileGetDefaultMode();
332  break;
333  case RUNMODE_DAG:
334  custom_mode = RunModeErfDagGetDefaultMode();
335  break;
336  case RUNMODE_AFP_DEV:
337  custom_mode = RunModeAFPGetDefaultMode();
338  break;
339  case RUNMODE_AFXDP_DEV:
340  custom_mode = RunModeAFXDPGetDefaultMode();
341  break;
342  case RUNMODE_NETMAP:
343  custom_mode = RunModeNetmapGetDefaultMode();
344  break;
345  case RUNMODE_UNIX_SOCKET:
346  custom_mode = RunModeUnixSocketGetDefaultMode();
347  break;
348  case RUNMODE_NFLOG:
349  custom_mode = RunModeIdsNflogGetDefaultMode();
350  break;
351 #ifdef WINDIVERT
352  case RUNMODE_WINDIVERT:
353  custom_mode = RunModeIpsWinDivertGetDefaultMode();
354  break;
355 #endif
356 #ifdef HAVE_DPDK
357  case RUNMODE_DPDK:
358  custom_mode = RunModeDpdkGetDefaultMode();
359  break;
360 #endif
361  case RUNMODE_LIB:
362  custom_mode = SCRunModeLibGetDefaultMode();
363  break;
364  default:
365  return NULL;
366  }
367  } else {
368  /* Add compatibility with old 'worker' name */
369  if (!strcmp("worker", custom_mode)) {
370  SCLogWarning("'worker' mode have been renamed "
371  "to 'workers', please modify your setup.");
372  custom_mode = "workers";
373  }
374  }
375 
376  return custom_mode;
377 }
378 
379 int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
380 {
381  if (runmode == NULL) {
382  runmode = RunModeGetConfOrDefault(capture_mode, capture_plugin_name);
383  if (runmode == NULL) // non-standard runmode
384  return 0;
385  }
386 
387  RunMode *mode = RunModeGetCustomMode(capture_mode, runmode);
388  if (mode == NULL) {
389  return 0;
390  }
391 
392  int ips_enabled = 0;
393  if (mode->RunModeIsIPSEnabled != NULL) {
394  ips_enabled = mode->RunModeIsIPSEnabled();
395  if (ips_enabled == 1) {
396  extern uint16_t g_livedev_mask;
397  if (g_livedev_mask != 0 && LiveGetDeviceCount() > 0) {
398  SCLogWarning("disabling livedev.use-for-tracking with IPS mode. See ticket #6726.");
399  g_livedev_mask = 0;
400  }
401  }
402  }
403 
404  return ips_enabled;
405 }
406 
407 /**
408  */
409 void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name,
410  const char *capture_plugin_args)
411 {
412  char *local_custom_mode = NULL;
413 
414  if (custom_mode == NULL) {
415  custom_mode = RunModeGetConfOrDefault(runmode, capture_plugin_name);
416  if (custom_mode == NULL)
417  FatalError("Unknown runtime mode. Aborting");
418  }
419 
420  RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
421  if (mode == NULL) {
422  SCLogError("The custom type \"%s\" doesn't exist "
423  "for this runmode type \"%s\". Please use --list-runmodes to "
424  "see available custom types for this runmode",
425  custom_mode, RunModeTranslateModeToName(runmode));
426  exit(EXIT_FAILURE);
427  }
428 
429  /* Export the custom mode */
430  if (active_runmode) {
431  SCFree(active_runmode);
432  }
433  active_runmode = SCStrdup(custom_mode);
434  if (unlikely(active_runmode == NULL)) {
435  FatalError("Unable to dup active mode");
436  }
437 
438  if (strcasecmp(active_runmode, "autofp") == 0) {
440  }
441 
442  mode->RunModeFunc();
443 
444  if (local_custom_mode != NULL)
445  SCFree(local_custom_mode);
446 
447  /* Check if the alloted queues have at least 1 reader and writer */
449 
450  if (runmode != RUNMODE_UNIX_SOCKET) {
451  /* spawn management threads */
456  }
458  LogFlushThreads();
460  }
461 }
462 
463 static int g_runmode_needs_bypass = 0;
464 
466 {
467  g_runmode_needs_bypass = 1;
468 }
469 
471 {
472  return g_runmode_needs_bypass;
473 }
474 
475 
476 
477 /**
478  * \brief Registers a new runmode.
479  *
480  * \param runmode Runmode type.
481  * \param name Custom mode for this specific runmode type. Within each
482  * runmode type, each custom name is a primary key.
483  * \param description Description for this runmode.
484  * \param RunModeFunc The function to be run for this runmode.
485  */
486 void RunModeRegisterNewRunMode(enum SCRunModes runmode, const char *name, const char *description,
487  int (*RunModeFunc)(void), int (*RunModeIsIPSEnabled)(void))
488 {
489  if (RunModeGetCustomMode(runmode, name) != NULL) {
490  FatalError("runmode '%s' has already "
491  "been registered. Please use an unique name.",
492  name);
493  }
494 
495  void *ptmp = SCRealloc(runmodes[runmode].runmodes,
496  (runmodes[runmode].cnt + 1) * sizeof(RunMode));
497  if (ptmp == NULL) {
498  SCFree(runmodes[runmode].runmodes);
499  runmodes[runmode].runmodes = NULL;
500  exit(EXIT_FAILURE);
501  }
502  runmodes[runmode].runmodes = ptmp;
503 
504  RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].cnt];
505  runmodes[runmode].cnt++;
506  memset(mode, 0x00, sizeof(*mode));
507 
508  mode->runmode = runmode;
509  mode->name = SCStrdup(name);
510  if (unlikely(mode->name == NULL)) {
511  FatalError("Failed to allocate string");
512  }
513  mode->description = SCStrdup(description);
514  if (unlikely(mode->description == NULL)) {
515  FatalError("Failed to allocate string");
516  }
517  mode->RunModeFunc = RunModeFunc;
518  mode->RunModeIsIPSEnabled = RunModeIsIPSEnabled;
519 }
520 
521 /**
522  * Setup the outputs for this run mode.
523  *
524  * \param tv The ThreadVars for the thread the outputs will be
525  * appended to.
526  */
527 static void RunOutputFreeList(void)
528 {
529  OutputFreeList *output;
530  while ((output = TAILQ_FIRST(&output_free_list))) {
531  TAILQ_REMOVE(&output_free_list, output, entries);
532 
533  SCLogDebug("output %s %p %p", output->output_module->name, output, output->output_ctx);
534  if (output->output_ctx != NULL && output->output_ctx->DeInit != NULL)
535  output->output_ctx->DeInit(output->output_ctx);
536  SCFree(output);
537  }
538 }
539 
540 static int file_logger_count = 0;
541 static int filedata_logger_count = 0;
542 
544 {
545  return filedata_logger_count > 0;
546 }
547 
548 bool IsRunModeSystem(enum SCRunModes run_mode_to_check)
549 {
550  switch (run_mode_to_check) {
551  case RUNMODE_PCAP_FILE:
552  case RUNMODE_ERF_FILE:
554  return false;
555  break;
556  default:
557  return true;
558  }
559 }
560 
561 bool IsRunModeOffline(enum SCRunModes run_mode_to_check)
562 {
563  switch(run_mode_to_check) {
564  case RUNMODE_CONF_TEST:
565  case RUNMODE_PCAP_FILE:
566  case RUNMODE_ERF_FILE:
568  case RUNMODE_UNIX_SOCKET:
569  return true;
570  break;
571  default:
572  return false;
573  }
574 }
575 
576 /**
577  * Cleanup the run mode.
578  */
579 void RunModeShutDown(void)
580 {
581  RunOutputFreeList();
582 
590 
592 
593  /* Reset logger counts. */
594  file_logger_count = 0;
595  filedata_logger_count = 0;
596 }
597 
598 /** \internal
599  * \brief add Sub RunModeOutput to list for Submodule so we can free
600  * the output ctx at shutdown and unix socket reload */
601 static void AddOutputToFreeList(OutputModule *module, OutputCtx *output_ctx)
602 {
603  OutputFreeList *fl_output = SCCalloc(1, sizeof(OutputFreeList));
604  if (unlikely(fl_output == NULL))
605  return;
606  fl_output->output_module = module;
607  fl_output->output_ctx = output_ctx;
608  TAILQ_INSERT_TAIL(&output_free_list, fl_output, entries);
609 }
610 
611 /** \brief Turn output into thread module */
612 static void SetupOutput(
613  const char *name, OutputModule *module, OutputCtx *output_ctx, LoggerId *logger_bits)
614 {
615  /* flow logger doesn't run in the packet path */
616  if (module->FlowLogFunc) {
617  SCOutputRegisterFlowLogger(module->name, module->FlowLogFunc, output_ctx,
618  module->ThreadInit, module->ThreadDeinit);
619  return;
620  }
621  /* stats logger doesn't run in the packet path */
622  if (module->StatsLogFunc) {
623  OutputRegisterStatsLogger(module->name, module->StatsLogFunc, output_ctx,
624  module->ThreadInit, module->ThreadDeinit);
625  return;
626  }
627 
628  if (module->logger_id == LOGGER_ALERT_DEBUG) {
629  debuglog_enabled = 1;
630  }
631 
632  if (module->PacketLogFunc) {
633  SCLogDebug("%s is a packet logger", module->name);
634  SCOutputRegisterPacketLogger(module->logger_id, module->name, module->PacketLogFunc,
635  module->PacketConditionFunc, output_ctx, module->ThreadInit, module->ThreadDeinit);
636  } else if (module->TxLogFunc) {
637  SCLogDebug("%s is a tx logger", module->name);
638  SCOutputRegisterTxLogger(module->logger_id, module->name, module->alproto,
639  module->TxLogFunc, output_ctx, module->tc_log_progress, module->ts_log_progress,
640  module->TxLogCondition, module->ThreadInit, module->ThreadDeinit);
641  /* Not used with wild card loggers */
642  if (module->alproto != ALPROTO_UNKNOWN) {
643  logger_bits[module->alproto] |= BIT_U32(module->logger_id);
644  }
645  } else if (module->FiledataLogFunc) {
646  SCLogDebug("%s is a filedata logger", module->name);
648  output_ctx, module->ThreadInit, module->ThreadDeinit);
649  filedata_logger_count++;
650  } else if (module->FileLogFunc) {
651  SCLogDebug("%s is a file logger", module->name);
652  SCOutputRegisterFileLogger(module->logger_id, module->name, module->FileLogFunc, output_ctx,
653  module->ThreadInit, module->ThreadDeinit);
654  file_logger_count++;
655  } else if (module->StreamingLogFunc) {
656  SCLogDebug("%s is a streaming logger", module->name);
658  output_ctx, module->stream_type, module->ThreadInit, module->ThreadDeinit);
659  } else {
660  SCLogError("Unknown logger type: name=%s", module->name);
661  }
662 }
663 
664 static void RunModeInitializeEveOutput(
665  SCConfNode *conf, OutputCtx *parent_ctx, LoggerId *logger_bits)
666 {
667  SCConfNode *types = SCConfNodeLookupChild(conf, "types");
668  SCLogDebug("types %p", types);
669  if (types == NULL) {
670  return;
671  }
672 
673  SCConfNode *type = NULL;
674  TAILQ_FOREACH(type, &types->head, next) {
675  int sub_count = 0;
676  char subname[256];
677 
678  if (strcmp(type->val, "ikev2") == 0) {
679  SCLogWarning("eve module 'ikev2' has been replaced by 'ike'");
680  strlcpy(subname, "eve-log.ike", sizeof(subname));
681  } else {
682  snprintf(subname, sizeof(subname), "eve-log.%s", type->val);
683  }
684 
685  SCLogConfig("enabling 'eve-log' module '%s'", type->val);
686 
687  SCConfNode *sub_output_config = SCConfNodeLookupChild(type, type->val);
688  if (sub_output_config != NULL) {
689  const char *enabled = SCConfNodeLookupChildValue(sub_output_config, "enabled");
690  if (enabled != NULL && !SCConfValIsTrue(enabled)) {
691  continue;
692  }
693  }
694 
695  /* Now setup all registers logger of this name. */
696  OutputModule *sub_module;
697  TAILQ_FOREACH(sub_module, &output_modules, entries) {
698  if (strcmp(subname, sub_module->conf_name) == 0) {
699  sub_count++;
700 
701  if (sub_module->parent_name == NULL ||
702  strcmp(sub_module->parent_name, "eve-log") != 0) {
703  FatalError("bad parent for %s", subname);
704  }
705  if (sub_module->InitSubFunc == NULL) {
706  FatalError("bad sub-module for %s", subname);
707  }
708 
709  /* pass on parent output_ctx */
710  OutputInitResult result =
711  sub_module->InitSubFunc(sub_output_config, parent_ctx);
712  if (!result.ok || result.ctx == NULL) {
713  FatalError("unable to initialize sub-module %s", subname);
714  }
715 
716  AddOutputToFreeList(sub_module, result.ctx);
717  SetupOutput(sub_module->name, sub_module, result.ctx, logger_bits);
718  }
719  }
720 
721  /* Error is no registered loggers with this name
722  * were found .*/
723  if (!sub_count) {
724  FatalErrorOnInit("No output module named %s", subname);
725  continue;
726  }
727  }
728 }
729 
730 static void RunModeInitializeLuaOutput(
731  SCConfNode *conf, OutputCtx *parent_ctx, LoggerId *logger_bits)
732 {
733  OutputModule *lua_module = OutputGetModuleByConfName("lua");
734  BUG_ON(lua_module == NULL);
735 
736  SCConfNode *scripts = SCConfNodeLookupChild(conf, "scripts");
737  BUG_ON(scripts == NULL); //TODO
738 
739  OutputModule *m;
740  TAILQ_FOREACH(m, &parent_ctx->submodules, entries) {
741  SCLogDebug("m %p %s:%s", m, m->name, m->conf_name);
742 
743  SCConfNode *script = NULL;
744  TAILQ_FOREACH(script, &scripts->head, next) {
745  SCLogDebug("script %s", script->val);
746  if (strcmp(script->val, m->conf_name) == 0) {
747  break;
748  }
749  }
750  BUG_ON(script == NULL);
751 
752  /* pass on parent output_ctx */
753  OutputInitResult result = m->InitSubFunc(script, parent_ctx);
754  if (!result.ok || result.ctx == NULL) {
755  continue;
756  }
757 
758  AddOutputToFreeList(m, result.ctx);
759  SetupOutput(m->name, m, result.ctx, logger_bits);
760  }
761 }
762 
763 extern bool g_file_logger_enabled;
764 extern bool g_filedata_logger_enabled;
765 
766 /**
767  * Initialize the output modules.
768  */
770 {
771  SCConfNode *outputs = SCConfGetNode("outputs");
772  if (outputs == NULL) {
773  /* No "outputs" section in the configuration. */
774  return;
775  }
776 
777  SCConfNode *output, *output_config;
778  const char *enabled;
779  char tls_log_enabled = 0;
780  char tls_store_present = 0;
781 
782  // g_alproto_max is set to its final value
783  LoggerId logger_bits[g_alproto_max];
784  memset(logger_bits, 0, g_alproto_max * sizeof(LoggerId));
785  TAILQ_FOREACH(output, &outputs->head, next) {
786 
787  output_config = SCConfNodeLookupChild(output, output->val);
788  if (output_config == NULL) {
789  /* Shouldn't happen. */
790  FatalError("Failed to lookup configuration child node: %s", output->val);
791  }
792 
793  if (strcmp(output->val, "tls-store") == 0) {
794  tls_store_present = 1;
795  }
796 
797  enabled = SCConfNodeLookupChildValue(output_config, "enabled");
798  if (enabled == NULL || !SCConfValIsTrue(enabled)) {
799  continue;
800  }
801 
802  if (strcmp(output->val, "file-log") == 0) {
803  SCLogWarning("file-log is no longer supported,"
804  " use eve.files instead "
805  "(see ticket #2376"
806  " for an explanation)");
807  continue;
808  } else if (strncmp(output->val, "unified-", sizeof("unified-") - 1) == 0) {
809  SCLogWarning("Unified1 is no longer supported,"
810  " use Unified2 instead "
811  "(see ticket #353"
812  " for an explanation)");
813  continue;
814  } else if (strncmp(output->val, "unified2-", sizeof("unified2-") - 1) == 0) {
815  SCLogWarning("Unified2 is no longer supported.");
816  continue;
817  } else if (strcmp(output->val, "dns-log") == 0) {
818  SCLogWarning("dns-log is not longer available as of Suricata 5.0");
819  continue;
820  } else if (strcmp(output->val, "tls-log") == 0) {
821  tls_log_enabled = 1;
822  }
823 
824  OutputModule *module;
825  int count = 0;
826  TAILQ_FOREACH(module, &output_modules, entries) {
827  if (strcmp(module->conf_name, output->val) != 0) {
828  continue;
829  }
830 
831  count++;
832 
833  OutputCtx *output_ctx = NULL;
834  if (module->InitFunc != NULL) {
835  OutputInitResult r = module->InitFunc(output_config);
836  if (!r.ok) {
837  FatalErrorOnInit("output module \"%s\": setup failed", output->val);
838  continue;
839  } else if (r.ctx == NULL) {
840  continue;
841  }
842  output_ctx = r.ctx;
843  } else if (module->InitSubFunc != NULL) {
844  SCLogInfo("skipping submodule");
845  continue;
846  }
847 
848  // TODO if module == parent, find it's children
849  if (strcmp(output->val, "eve-log") == 0) {
850  RunModeInitializeEveOutput(output_config, output_ctx, logger_bits);
851 
852  /* add 'eve-log' to free list as it's the owner of the
853  * main output ctx from which the sub-modules share the
854  * LogFileCtx */
855  AddOutputToFreeList(module, output_ctx);
856  } else if (strcmp(output->val, "lua") == 0) {
857  SCLogDebug("handle lua");
858  if (output_ctx == NULL)
859  continue;
860  RunModeInitializeLuaOutput(output_config, output_ctx, logger_bits);
861  AddOutputToFreeList(module, output_ctx);
862  } else {
863  AddOutputToFreeList(module, output_ctx);
864  SetupOutput(module->name, module, output_ctx, logger_bits);
865  }
866  }
867  if (count == 0) {
868  FatalErrorOnInit("No output module named %s", output->val);
869  continue;
870  }
871  }
872 
873  /* Backward compatibility code */
874  if (!tls_store_present && tls_log_enabled) {
875  /* old YAML with no "tls-store" in outputs. "tls-log" value needs
876  * to be started using 'tls-log' config as own config */
877  SCLogWarning("Please use 'tls-store' in YAML to configure TLS storage");
878 
879  TAILQ_FOREACH(output, &outputs->head, next) {
880  output_config = SCConfNodeLookupChild(output, output->val);
881 
882  if (strcmp(output->val, "tls-log") == 0) {
883 
884  OutputModule *module = OutputGetModuleByConfName("tls-store");
885  if (module == NULL) {
886  SCLogWarning("No output module named %s, ignoring", "tls-store");
887  continue;
888  }
889 
890  OutputCtx *output_ctx = NULL;
891  if (module->InitFunc != NULL) {
892  OutputInitResult r = module->InitFunc(output_config);
893  if (!r.ok) {
894  FatalErrorOnInit("output module setup failed");
895  continue;
896  } else if (r.ctx == NULL) {
897  continue;
898  }
899  output_ctx = r.ctx;
900  }
901 
902  AddOutputToFreeList(module, output_ctx);
903  SetupOutput(module->name, module, output_ctx, logger_bits);
904  }
905  }
906  }
907 
908  /* register the logger bits to the app-layer */
909  AppProto a;
910  for (a = 0; a < g_alproto_max; a++) {
911  if (AppLayerParserSupportsFiles(IPPROTO_TCP, a)) {
913  logger_bits[a] |= BIT_U32(LOGGER_FILE);
915  logger_bits[a] |= BIT_U32(LOGGER_FILEDATA);
916  SCLogDebug("IPPROTO_TCP::%s: g_file_logger_enabled %d g_filedata_logger_enabled %d -> "
917  "%08x",
919  logger_bits[a]);
920  }
921  if (AppLayerParserSupportsFiles(IPPROTO_UDP, a)) {
923  logger_bits[a] |= BIT_U32(LOGGER_FILE);
925  logger_bits[a] |= BIT_U32(LOGGER_FILEDATA);
926  }
927 
928  if (logger_bits[a] == 0)
929  continue;
930 
931  const int tcp = AppLayerParserProtocolHasLogger(IPPROTO_TCP, a) | (g_file_logger_enabled) |
933  const int udp = AppLayerParserProtocolHasLogger(IPPROTO_UDP, a) | (g_file_logger_enabled) |
935  SCLogDebug("tcp %d udp %d", tcp, udp);
936 
937  SCLogDebug("logger for %s: %s %s", AppProtoToString(a),
938  tcp ? "true" : "false", udp ? "true" : "false");
939 
940  SCLogDebug("logger bits for %s: %08x", AppProtoToString(a), logger_bits[a]);
941  if (tcp)
942  AppLayerParserRegisterLoggerBits(IPPROTO_TCP, a, logger_bits[a]);
943  if (udp)
944  AppLayerParserRegisterLoggerBits(IPPROTO_UDP, a, logger_bits[a]);
945  }
947 }
948 
950 
951 /**
952  * Initialize multithreading settings.
953  */
955 {
956  int affinity = 0;
957  if ((SCConfGetBool("threading.set-cpu-affinity", &affinity)) == 0) {
959  } else {
960  threading_set_cpu_affinity = affinity == 1;
961  }
962 
963  /* try to get custom cpu mask value if needed */
966  }
967  if ((SCConfGetFloat("threading.detect-thread-ratio", &threading_detect_ratio)) != 1) {
968  if (SCConfGetNode("threading.detect-thread-ratio") != NULL)
969  WarnInvalidConfEntry("threading.detect-thread-ratio", "%s", "1");
971  }
972 
973  SCLogDebug("threading.detect-thread-ratio %f", threading_detect_ratio);
974 
975  /*
976  * Check if there's a configuration setting for the per-thread stack size
977  * in case the default per-thread stack size is to be adjusted
978  */
979  const char *ss = NULL;
980  if ((SCConfGet("threading.stack-size", &ss)) == 1) {
981  if (ss != NULL) {
983  FatalError("Failed to initialize thread_stack_size output, invalid limit: %s", ss);
984  }
985  }
986  } else {
987  pthread_attr_t attr;
988  pthread_attr_init(&attr);
989  size_t size;
990  if (pthread_attr_getstacksize(&attr, &size) == 0 && size < 512 * 1024) {
991  threading_set_stack_size = 512 * 1024;
992  SCLogNotice("thread stack size of %" PRIuMAX " too small: setting to 512k",
993  (uintmax_t)size);
994  }
995  }
996 
997  SCLogDebug("threading.stack-size %" PRIu64, threading_set_stack_size);
998 }
thread_name_workers
const char * thread_name_workers
Definition: runmodes.c:68
RunModeIpsIPFWGetDefaultMode
const char * RunModeIpsIPFWGetDefaultMode(void)
Definition: runmode-ipfw.c:44
FlowManagerThreadSpawn
void FlowManagerThreadSpawn(void)
spawn the flow manager thread
Definition: flow-manager.c:1000
suricata-plugin.h
AffinitySetupLoadFromConfig
void AffinitySetupLoadFromConfig(void)
Extract CPU affinity configuration from current config file.
Definition: util-affinity.c:588
RUNMODE_ENGINE_ANALYSIS
@ RUNMODE_ENGINE_ANALYSIS
Definition: runmodes.h:56
util-device-private.h
OutputModule_::parent_name
const char * parent_name
Definition: output.h:61
TmThreadsSealThreads
void TmThreadsSealThreads(void)
Definition: tm-threads.c:2173
thread_name_counter_wakeup
const char * thread_name_counter_wakeup
Definition: runmodes.c:76
log-flush.h
OutputModule_::FileLogFunc
SCFileLogger FileLogFunc
Definition: output.h:73
flow-bypass.h
RunMode_::description
const char * description
Definition: runmodes.c:86
g_livedev_mask
uint16_t g_livedev_mask
Definition: suricata.c:206
SCConfValIsTrue
int SCConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:551
RUNMODE_AFXDP_DEV
@ RUNMODE_AFXDP_DEV
Definition: runmodes.h:37
detect-engine.h
threading_set_cpu_affinity
bool threading_set_cpu_affinity
Definition: runmodes.c:62
RunModeErfFileRegister
void RunModeErfFileRegister(void)
Definition: runmode-erf-file.c:39
OutputStreamingShutdown
void OutputStreamingShutdown(void)
Definition: output-streaming.c:437
RunMode_::RunModeIsIPSEnabled
int(* RunModeIsIPSEnabled)(void)
Definition: runmodes.c:89
AppLayerParserProtocolHasLogger
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1541
thread_name_flow_mgr
const char * thread_name_flow_mgr
Definition: runmodes.c:70
RunModeErfFileGetDefaultMode
const char * RunModeErfFileGetDefaultMode(void)
Definition: runmode-erf-file.c:34
IsRunModeOffline
bool IsRunModeOffline(enum SCRunModes run_mode_to_check)
Definition: runmodes.c:561
RUNMODE_NFLOG
@ RUNMODE_NFLOG
Definition: runmodes.h:32
runmode-af-packet.h
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
RUNMODE_UNKNOWN
@ RUNMODE_UNKNOWN
Definition: runmodes.h:28
LOGGER_FILEDATA
@ LOGGER_FILEDATA
Definition: suricata-common.h:487
OutputTxShutdown
void OutputTxShutdown(void)
Definition: output-tx.c:660
TmqhFlowPrintAutofpHandler
void TmqhFlowPrintAutofpHandler(void)
Definition: tmqh-flow.c:84
RunModeIdsAFPRegister
void RunModeIdsAFPRegister(void)
Definition: runmode-af-packet.c:133
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:275
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:190
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
BypassedFlowManagerThreadSpawn
void BypassedFlowManagerThreadSpawn(void)
spawn the flow bypass manager thread
Definition: flow-bypass.c:187
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
RunModeShutDown
void RunModeShutDown(void)
Definition: runmodes.c:579
RunModeDispatch
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
Definition: runmodes.c:409
OutputModule_::name
const char * name
Definition: output.h:59
thread_name_counter_stats
const char * thread_name_counter_stats
Definition: runmodes.c:75
RUNMODE_NFQ
@ RUNMODE_NFQ
Definition: runmodes.h:31
SCOutputRegisterStreamingLogger
int SCOutputRegisterStreamingLogger(LoggerId id, const char *name, SCStreamingLogger LogFunc, void *initdata, enum SCOutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a streaming logger.
Definition: output-streaming.c:63
OutputModule_::logger_id
LoggerId logger_id
Definition: output.h:58
LoggerId
LoggerId
Definition: suricata-common.h:477
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
runmode-pcap.h
AppLayerParserSupportsFiles
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1173
RunModeAFPGetDefaultMode
const char * RunModeAFPGetDefaultMode(void)
Definition: runmode-af-packet.c:64
thread_name_flow_rec
const char * thread_name_flow_rec
Definition: runmodes.c:71
OutputFiledataShutdown
void OutputFiledataShutdown(void)
Definition: output-filedata.c:275
SCConfGet
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:350
OutputModule_::ts_log_progress
int ts_log_progress
Definition: output.h:81
runmode-erf-file.h
runmode-windivert.h
RunModeFilePcapGetDefaultMode
const char * RunModeFilePcapGetDefaultMode(void)
Definition: runmode-pcap-file.c:35
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
thread_name_autofp
const char * thread_name_autofp
Definition: runmodes.c:66
OutputGetModuleByConfName
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
Definition: output.c:641
OutputSetupActiveLoggers
void OutputSetupActiveLoggers(void)
Definition: output.c:903
OutputModule_::StatsLogFunc
StatsLogger StatsLogFunc
Definition: output.h:77
RunModeIdsNflogGetDefaultMode
const char * RunModeIdsNflogGetDefaultMode(void)
Definition: runmode-nflog.c:206
SCConfGetBool
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:497
RunMode_::RunModeFunc
int(* RunModeFunc)(void)
Definition: runmodes.c:88
OutputStatsShutdown
void OutputStatsShutdown(void)
Definition: output-stats.c:184
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:294
RunmodeGetActive
char * RunmodeGetActive(void)
Definition: runmodes.c:199
m
SCMutex m
Definition: flow-hash.h:6
OutputModule_::InitSubFunc
OutputInitSubFunc InitSubFunc
Definition: output.h:63
SCConfNodeLookupChildValue
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:824
SCOutputRegisterFlowLogger
int SCOutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow logger.
Definition: output-flow.c:58
RunModes
struct RunModes_ RunModes
SCRunModes
SCRunModes
Definition: runmodes.h:27
OutputModule_::PacketLogFunc
PacketLogger PacketLogFunc
Definition: output.h:68
TmValidateQueueState
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
Definition: tm-queues.c:101
RunModeAFXDPGetDefaultMode
const char * RunModeAFXDPGetDefaultMode(void)
Definition: runmode-af-xdp.c:66
RUNMODE_LIB
@ RUNMODE_LIB
Definition: runmodes.h:40
OutputModule_::FiledataLogFunc
SCFiledataLogger FiledataLogFunc
Definition: output.h:74
RunModeInitializeOutputs
void RunModeInitializeOutputs(void)
Definition: runmodes.c:769
OutputRegisterStatsLogger
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output-stats.c:51
debuglog_enabled
int debuglog_enabled
Definition: runmodes.c:61
thread_name_single
const char * thread_name_single
Definition: runmodes.c:67
OutputModule_::alproto
AppProto alproto
Definition: output.h:78
RunModes_
Definition: runmodes.c:92
IsRunModeSystem
bool IsRunModeSystem(enum SCRunModes run_mode_to_check)
Definition: runmodes.c:548
runmode-unix-socket.h
util-unittest.h
SCCapturePlugin_::GetDefaultMode
const char *(* GetDefaultMode)(void)
Definition: suricata-plugin.h:59
SCRunModeLibGetDefaultMode
const char * SCRunModeLibGetDefaultMode(void)
runmode default mode (live)
Definition: runmode-lib.c:54
OutputClearActiveLoggers
void OutputClearActiveLoggers(void)
Definition: output.c:916
OutputCtx_
Definition: tm-modules.h:88
RUNMODE_UNIX_SOCKET
@ RUNMODE_UNIX_SOCKET
Definition: runmodes.h:42
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
TAILQ_ENTRY
#define TAILQ_ENTRY(type)
Definition: queue.h:239
RunModeUnixSocketGetDefaultMode
const char * RunModeUnixSocketGetDefaultMode(void)
Definition: runmode-unix-socket.c:87
RunModeIpsNFQRegister
void RunModeIpsNFQRegister(void)
Definition: runmode-nfq.c:47
RUNMODE_NETMAP
@ RUNMODE_NETMAP
Definition: runmodes.h:38
OutputModule_::stream_type
enum SCOutputStreamingType stream_type
Definition: output.h:79
counters.h
RunModeInitializeThreadSettings
void RunModeInitializeThreadSettings(void)
Definition: runmodes.c:954
OutputModule_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output.h:65
RunModeDpdkGetDefaultMode
const char * RunModeDpdkGetDefaultMode(void)
Definition: runmode-dpdk.c:1929
RunmodeIsWorkers
bool RunmodeIsWorkers(void)
Definition: runmodes.c:204
TAILQ_HEAD_INITIALIZER
#define TAILQ_HEAD_INITIALIZER(head)
Definition: queue.h:236
output_modules
OutputModuleList output_modules
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
SCRunmodeGet
SCRunMode SCRunmodeGet(void)
Get the current run mode.
Definition: suricata.c:279
util-debug.h
RunModes_::runmodes
RunMode * runmodes
Definition: runmodes.c:94
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
thread_name_flow_bypass
const char * thread_name_flow_bypass
Definition: runmodes.c:72
RunmodeIsAutofp
bool RunmodeIsAutofp(void)
Definition: runmodes.c:209
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:29
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:47
OutputModule_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output.h:66
RunModeListRunmodes
void RunModeListRunmodes(void)
Lists all registered runmodes.
Definition: runmodes.c:257
g_filedata_logger_enabled
bool g_filedata_logger_enabled
Definition: output-filedata.c:37
BIT_U32
#define BIT_U32(n)
Definition: suricata-common.h:417
threading_set_stack_size
uint64_t threading_set_stack_size
Definition: runmodes.c:63
RUNMODE_UNITTEST
@ RUNMODE_UNITTEST
Definition: runmodes.h:41
RunModeEnablesBypassManager
void RunModeEnablesBypassManager(void)
Definition: runmodes.c:465
OutputPacketShutdown
void OutputPacketShutdown(void)
Definition: output-packet.c:200
RunModeIdsNflogRegister
void RunModeIdsNflogRegister(void)
Definition: runmode-nflog.c:211
RUNMODE_DAG
@ RUNMODE_DAG
Definition: runmodes.h:35
util-affinity.h
RunMode_
Holds description for a runmode.
Definition: runmodes.c:82
SCCapturePlugin_
Definition: suricata-plugin.h:54
AppLayerParserRegisterLoggerBits
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
Definition: app-layer-parser.c:482
RunModeIpsIPFWRegister
void RunModeIpsIPFWRegister(void)
Definition: runmode-ipfw.c:49
OutputModule_::StreamingLogFunc
SCStreamingLogger StreamingLogFunc
Definition: output.h:76
OutputInitResult_::ok
bool ok
Definition: output.h:48
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:255
RunModeErfDagGetDefaultMode
const char * RunModeErfDagGetDefaultMode(void)
Definition: runmode-erf-dag.c:43
app-layer-parser.h
SCOutputRegisterTxLogger
int SCOutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, void *initdata, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a transaction logger.
Definition: output-tx.c:66
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:317
runmode-netmap.h
RunMode_::runmode
enum SCRunModes runmode
Definition: runmodes.c:84
runmode-erf-dag.h
thread_name_detect_loader
const char * thread_name_detect_loader
Definition: runmodes.c:74
OutputModule_::conf_name
const char * conf_name
Definition: output.h:60
OutputModule_::FlowLogFunc
FlowLogger FlowLogFunc
Definition: output.h:75
RUNMODE_PLUGIN
@ RUNMODE_PLUGIN
Definition: runmodes.h:44
type
uint16_t type
Definition: decode-vlan.c:106
conf.h
OutputFileShutdown
void OutputFileShutdown(void)
Definition: output-file.c:239
RunModeRegisterNewRunMode
void RunModeRegisterNewRunMode(enum SCRunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), int(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
Definition: runmodes.c:486
RUNMODE_WINDIVERT
@ RUNMODE_WINDIVERT
Definition: runmodes.h:43
runmode-pcap-file.h
name
const char * name
Definition: tm-threads.c:2163
FlowRecyclerThreadSpawn
void FlowRecyclerThreadSpawn(void)
spawn the flow recycler thread
Definition: flow-manager.c:1195
util-plugin.h
RUNMODE_AFP_DEV
@ RUNMODE_AFP_DEV
Definition: runmodes.h:36
RunModeErfDagRegister
void RunModeErfDagRegister(void)
Definition: runmode-erf-dag.c:48
RunMode
struct RunMode_ RunMode
Holds description for a runmode.
SCOutputRegisterPacketLogger
int SCOutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet logger.
Definition: output-packet.c:55
SCOutputRegisterFileLogger
int SCOutputRegisterFileLogger(LoggerId id, const char *name, SCFileLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file logger.
Definition: output-file.c:56
runmodes.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:225
WarnInvalidConfEntry
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
Definition: util-misc.h:35
RunModes_::cnt
int cnt
Definition: runmodes.c:93
RunModeIpsWinDivertRegister
void RunModeIpsWinDivertRegister(void)
Definition: runmode-windivert.c:45
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
OutputFreeList_::output_ctx
OutputCtx * output_ctx
Definition: runmodes.c:104
SCConfNodeLookupChild
SCConfNode * SCConfNodeLookupChild(const SCConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:796
runmode-nfq.h
RunModeIdsAFXDPRegister
void RunModeIdsAFXDPRegister(void)
Definition: runmode-af-xdp.c:71
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
OutputInitResult_
Definition: output.h:46
OutputModule_::TxLogCondition
TxLoggerCondition TxLogCondition
Definition: output.h:72
RunModeUnixSocketRegister
void RunModeUnixSocketRegister(void)
Definition: runmode-unix-socket.c:558
LogFlushThreads
void LogFlushThreads(void)
Definition: log-flush.c:187
flow-manager.h
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:94
thread_name_heartbeat
const char * thread_name_heartbeat
Definition: runmodes.c:77
FatalErrorOnInit
#define FatalErrorOnInit(...)
Fatal error IF we're starting up, and configured to consider errors to be fatal errors.
Definition: util-debug.h:519
StatsSpawnThreads
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
Definition: counters.c:903
RunModeNeedsBypassManager
int RunModeNeedsBypassManager(void)
Definition: runmodes.c:470
g_file_logger_enabled
bool g_file_logger_enabled
Definition: output-file.c:39
LOGGER_ALERT_DEBUG
@ LOGGER_ALERT_DEBUG
Definition: suricata-common.h:494
RunModeIdsPcapRegister
void RunModeIdsPcapRegister(void)
Definition: runmode-pcap.c:39
RunModeRegisterRunModes
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
Definition: runmodes.c:231
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
RunModeFilePcapRegister
void RunModeFilePcapRegister(void)
Definition: runmode-pcap-file.c:40
FatalError
#define FatalError(...)
Definition: util-debug.h:510
OutputModule_::PacketConditionFunc
PacketLogCondition PacketConditionFunc
Definition: output.h:70
LOGGER_FILE
@ LOGGER_FILE
Definition: suricata-common.h:486
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
RunModeNetmapGetDefaultMode
const char * RunModeNetmapGetDefaultMode(void)
Definition: runmode-netmap.c:55
RUNMODE_ERF_FILE
@ RUNMODE_ERF_FILE
Definition: runmodes.h:34
RunModeIpsNFQGetDefaultMode
const char * RunModeIpsNFQGetDefaultMode(void)
Definition: runmode-nfq.c:42
runmode-af-xdp.h
SCConfGetNode
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
Definition: conf.c:181
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:267
SCFree
#define SCFree(p)
Definition: util-mem.h:61
RunModeIdsNetmapRegister
void RunModeIdsNetmapRegister(void)
Definition: runmode-netmap.c:127
OutputFreeList
struct OutputFreeList_ OutputFreeList
RUNMODE_DPDK
@ RUNMODE_DPDK
Definition: runmodes.h:39
thread_name_verdict
const char * thread_name_verdict
Definition: runmodes.c:69
runmode-lib.h
RUNMODE_PCAP_DEV
@ RUNMODE_PCAP_DEV
Definition: runmodes.h:29
RunModeDpdkRegister
void RunModeDpdkRegister(void)
Definition: runmode-dpdk.c:1934
OutputModule_::TxLogFunc
TxLogger TxLogFunc
Definition: output.h:71
OutputModule_::tc_log_progress
int tc_log_progress
Definition: output.h:80
TAILQ_HEAD
#define TAILQ_HEAD(name, type)
Definition: queue.h:230
OutputFlowShutdown
void OutputFlowShutdown(void)
Definition: output-flow.c:187
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
RunModeEngineIsIPS
int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
Definition: runmodes.c:379
OutputFreeList_
Definition: runmodes.c:102
tmqh-flow.h
runmode-dpdk.h
SCOutputRegisterFiledataLogger
int SCOutputRegisterFiledataLogger(LoggerId id, const char *name, SCFiledataLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file-data logger.
Definition: output-filedata.c:54
runmode-ipfw.h
thread_name_unix_socket
const char * thread_name_unix_socket
Definition: runmodes.c:73
RUNMODE_USER_MAX
@ RUNMODE_USER_MAX
Definition: runmodes.h:45
OutputFreeList_::output_module
OutputModule * output_module
Definition: runmodes.c:103
runmode-nflog.h
RUNMODE_CONF_TEST
@ RUNMODE_CONF_TEST
Definition: runmodes.h:54
RunModeGetMainMode
const char * RunModeGetMainMode(void)
Definition: runmodes.c:221
RunModeOutputFiledataEnabled
int RunModeOutputFiledataEnabled(void)
Definition: runmodes.c:543
LiveGetDeviceCount
int LiveGetDeviceCount(void)
Get the number of registered devices.
Definition: util-device.c:170
SCRunModeLibIdsRegister
void SCRunModeLibIdsRegister(void)
register runmodes for suricata as a library
Definition: runmode-lib.c:30
util-misc.h
RunMode_::name
const char * name
Definition: runmodes.c:85
OutputModule_
Definition: output.h:57
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:243
UtRunModeRegister
void UtRunModeRegister(void)
Definition: util-unittest.c:283
RUNMODE_PCAP_FILE
@ RUNMODE_PCAP_FILE
Definition: runmodes.h:30
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCConfNode_
Definition: conf.h:37
SCConfNode_::val
char * val
Definition: conf.h:39
RunModeIpsWinDivertGetDefaultMode
const char * RunModeIpsWinDivertGetDefaultMode(void)
Definition: runmode-windivert.c:40
SCConfGetFloat
int SCConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
Definition: conf.c:630
SCPluginFindCaptureByName
SCCapturePlugin * SCPluginFindCaptureByName(const char *name)
threading_detect_ratio
float threading_detect_ratio
Definition: runmodes.c:949
output.h
RUNMODE_IPFW
@ RUNMODE_IPFW
Definition: runmodes.h:33
OutputModule_::InitFunc
OutputInitFunc InitFunc
Definition: output.h:62
RunModeIdsGetDefaultMode
const char * RunModeIdsGetDefaultMode(void)
Definition: runmode-pcap.c:32