suricata
runmodes.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /** \file
19  *
20  * \author Victor Julien <victor@inliniac.net>
21  *
22  * Pre-cooked threading runmodes.
23  */
24 
25 #include "suricata-common.h"
26 #include "detect.h"
27 #include "detect-engine.h"
28 #include "detect-engine-mpm.h"
29 #include "app-layer-parser.h"
30 #include "tm-threads.h"
31 #include "util-debug.h"
32 #include "util-time.h"
33 #include "util-cpu.h"
34 #include "util-byte.h"
35 #include "util-affinity.h"
36 #include "conf.h"
37 #include "queue.h"
38 #include "runmodes.h"
39 #include "util-unittest.h"
40 #include "util-misc.h"
41 
42 #include "output.h"
43 
44 #include "alert-fastlog.h"
45 #include "alert-prelude.h"
46 #include "alert-unified2-alert.h"
47 #include "alert-debuglog.h"
48 
49 #include "log-httplog.h"
50 
51 #include "source-pfring.h"
52 
53 #include "tmqh-flow.h"
54 #include "flow-manager.h"
55 #include "flow-bypass.h"
56 #include "counters.h"
57 
59 
60 /* Runmode Global Thread Names */
61 const char *thread_name_autofp = "RX";
62 const char *thread_name_single = "W";
63 const char *thread_name_workers = "W";
64 const char *thread_name_verdict = "TX";
65 const char *thread_name_flow_mgr = "FM";
66 const char *thread_name_flow_rec = "FR";
67 const char *thread_name_flow_bypass = "FB";
68 const char *thread_name_unix_socket = "US";
69 const char *thread_name_detect_loader = "DL";
70 const char *thread_name_counter_stats = "CS";
71 const char *thread_name_counter_wakeup = "CW";
72 
73 /**
74  * \brief Holds description for a runmode.
75  */
76 typedef struct RunMode_ {
77  /* the runmode type */
79  const char *name;
80  const char *description;
81  /* runmode function */
82  int (*RunModeFunc)(void);
83 } RunMode;
84 
85 typedef struct RunModes_ {
86  int cnt;
88 } RunModes;
89 
90 static RunModes runmodes[RUNMODE_USER_MAX];
91 
92 static char *active_runmode;
93 
94 /* free list for our outputs */
95 typedef struct OutputFreeList_ {
98 
101 static TAILQ_HEAD(, OutputFreeList_) output_free_list =
102  TAILQ_HEAD_INITIALIZER(output_free_list);
103 
104 /**
105  * \internal
106  * \brief Translate a runmode mode to a printale string.
107  *
108  * \param runmode Runmode to be converted into a printable string.
109  *
110  * \retval string Printable string.
111  */
112 static const char *RunModeTranslateModeToName(int runmode)
113 {
114  switch (runmode) {
115  case RUNMODE_PCAP_DEV:
116  return "PCAP_DEV";
117  case RUNMODE_PCAP_FILE:
118  return "PCAP_FILE";
119  case RUNMODE_PFRING:
120 #ifdef HAVE_PFRING
121  return "PFRING";
122 #else
123  return "PFRING(DISABLED)";
124 #endif
125  case RUNMODE_NFQ:
126  return "NFQ";
127  case RUNMODE_NFLOG:
128  return "NFLOG";
129  case RUNMODE_IPFW:
130  return "IPFW";
131  case RUNMODE_ERF_FILE:
132  return "ERF_FILE";
133  case RUNMODE_DAG:
134  return "ERF_DAG";
135  case RUNMODE_NAPATECH:
136  return "NAPATECH";
137  case RUNMODE_UNITTEST:
138  return "UNITTEST";
139  case RUNMODE_AFP_DEV:
140  return "AF_PACKET_DEV";
141  case RUNMODE_NETMAP:
142 #ifdef HAVE_NETMAP
143  return "NETMAP";
144 #else
145  return "NETMAP(DISABLED)";
146 #endif
147  case RUNMODE_UNIX_SOCKET:
148  return "UNIX_SOCKET";
149  case RUNMODE_WINDIVERT:
150 #ifdef WINDIVERT
151  return "WINDIVERT";
152 #else
153  return "WINDIVERT(DISABLED)";
154 #endif
155  default:
156  FatalError(SC_ERR_UNKNOWN_RUN_MODE, "Unknown runtime mode. Aborting");
157  }
158 }
159 
160 /**
161  * \internal
162  * \brief Dispatcher function for runmodes. Calls the required runmode function
163  * based on runmode + runmode_custom_id.
164  *
165  * \param runmode The runmode type.
166  * \param runmode_customd_id The runmode custom id.
167  */
168 static RunMode *RunModeGetCustomMode(enum RunModes runmode, const char *custom_mode)
169 {
170  if (runmode < RUNMODE_USER_MAX) {
171  for (int i = 0; i < runmodes[runmode].cnt; i++) {
172  if (strcmp(runmodes[runmode].runmodes[i].name, custom_mode) == 0)
173  return &runmodes[runmode].runmodes[i];
174  }
175  }
176  return NULL;
177 }
178 
179 
180 /**
181  * Return the running mode
182  *
183  * The returned string must not be freed.
184  *
185  * \return a string containing the current running mode
186  */
187 char *RunmodeGetActive(void)
188 {
189  return active_runmode;
190 }
191 
192 /**
193  * Return the running mode
194  *
195  * The returned string must not be freed.
196  *
197  * \return a string containing the current running mode
198  */
199 const char *RunModeGetMainMode(void)
200 {
201  int mainmode = RunmodeGetCurrent();
202 
203  return RunModeTranslateModeToName(mainmode);
204 }
205 
206 /**
207  * \brief Register all runmodes in the engine.
208  */
210 {
211  memset(runmodes, 0, sizeof(runmodes));
212 
226 #ifdef UNITTESTS
228 #endif
229  return;
230 }
231 
232 /**
233  * \brief Lists all registered runmodes.
234  */
236 {
237  printf("------------------------------------- Runmodes -------------------"
238  "-----------------------\n");
239 
240  printf("| %-17s | %-17s | %-10s \n",
241  "RunMode Type", "Custom Mode ", "Description");
242  printf("|-----------------------------------------------------------------"
243  "-----------------------\n");
244  int i = RUNMODE_UNKNOWN + 1;
245  int j = 0;
246  for ( ; i < RUNMODE_USER_MAX; i++) {
247  int mode_displayed = 0;
248  for (j = 0; j < runmodes[i].cnt; j++) {
249  if (mode_displayed == 1) {
250  printf("| ----------------------------------------------"
251  "-----------------------\n");
252  RunMode *runmode = &runmodes[i].runmodes[j];
253  printf("| %-17s | %-17s | %-27s \n",
254  "",
255  runmode->name,
256  runmode->description);
257  } else {
258  RunMode *runmode = &runmodes[i].runmodes[j];
259  printf("| %-17s | %-17s | %-27s \n",
260  RunModeTranslateModeToName(runmode->runmode),
261  runmode->name,
262  runmode->description);
263  }
264  if (mode_displayed == 0)
265  mode_displayed = 1;
266  }
267  if (mode_displayed == 1) {
268  printf("|-----------------------------------------------------------------"
269  "-----------------------\n");
270  }
271  }
272 
273  return;
274 }
275 
276 /**
277  */
278 void RunModeDispatch(int runmode, const char *custom_mode)
279 {
280  char *local_custom_mode = NULL;
281 
282  if (custom_mode == NULL) {
283  const char *val = NULL;
284  if (ConfGet("runmode", &val) != 1) {
285  custom_mode = NULL;
286  } else {
287  custom_mode = val;
288  }
289  }
290 
291  if (custom_mode == NULL || strcmp(custom_mode, "auto") == 0) {
292  switch (runmode) {
293  case RUNMODE_PCAP_DEV:
294  custom_mode = RunModeIdsGetDefaultMode();
295  break;
296  case RUNMODE_PCAP_FILE:
297  custom_mode = RunModeFilePcapGetDefaultMode();
298  break;
299 #ifdef HAVE_PFRING
300  case RUNMODE_PFRING:
301  custom_mode = RunModeIdsPfringGetDefaultMode();
302  break;
303 #endif
304  case RUNMODE_NFQ:
305  custom_mode = RunModeIpsNFQGetDefaultMode();
306  break;
307  case RUNMODE_IPFW:
308  custom_mode = RunModeIpsIPFWGetDefaultMode();
309  break;
310  case RUNMODE_ERF_FILE:
311  custom_mode = RunModeErfFileGetDefaultMode();
312  break;
313  case RUNMODE_DAG:
314  custom_mode = RunModeErfDagGetDefaultMode();
315  break;
316  case RUNMODE_NAPATECH:
317  custom_mode = RunModeNapatechGetDefaultMode();
318  break;
319  case RUNMODE_AFP_DEV:
320  custom_mode = RunModeAFPGetDefaultMode();
321  break;
322  case RUNMODE_NETMAP:
323  custom_mode = RunModeNetmapGetDefaultMode();
324  break;
325  case RUNMODE_UNIX_SOCKET:
326  custom_mode = RunModeUnixSocketGetDefaultMode();
327  break;
328  case RUNMODE_NFLOG:
329  custom_mode = RunModeIdsNflogGetDefaultMode();
330  break;
331 #ifdef WINDIVERT
332  case RUNMODE_WINDIVERT:
333  custom_mode = RunModeIpsWinDivertGetDefaultMode();
334  break;
335 #endif
336  default:
337  SCLogError(SC_ERR_UNKNOWN_RUN_MODE, "Unknown runtime mode. Aborting");
338  exit(EXIT_FAILURE);
339  }
340  } else { /* if (custom_mode == NULL) */
341  /* Add compability with old 'worker' name */
342  if (!strcmp("worker", custom_mode)) {
343  SCLogWarning(SC_ERR_RUNMODE, "'worker' mode have been renamed "
344  "to 'workers', please modify your setup.");
345  local_custom_mode = SCStrdup("workers");
346  if (unlikely(local_custom_mode == NULL)) {
347  SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup custom mode");
348  exit(EXIT_FAILURE);
349  }
350  custom_mode = local_custom_mode;
351  }
352  }
353 
354  RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
355  if (mode == NULL) {
356  SCLogError(SC_ERR_RUNMODE, "The custom type \"%s\" doesn't exist "
357  "for this runmode type \"%s\". Please use --list-runmodes to "
358  "see available custom types for this runmode",
359  custom_mode, RunModeTranslateModeToName(runmode));
360  exit(EXIT_FAILURE);
361  }
362 
363  /* Export the custom mode */
364  if (active_runmode) {
365  SCFree(active_runmode);
366  }
367  active_runmode = SCStrdup(custom_mode);
368  if (unlikely(active_runmode == NULL)) {
369  SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup active mode");
370  exit(EXIT_FAILURE);
371  }
372 
373  if (strcasecmp(active_runmode, "autofp") == 0) {
375  }
376 
377  mode->RunModeFunc();
378 
379  if (local_custom_mode != NULL)
380  SCFree(local_custom_mode);
381 
382  /* Check if the alloted queues have at least 1 reader and writer */
384 
385  if (runmode != RUNMODE_UNIX_SOCKET) {
386  /* spawn management threads */
391  }
393  }
394 }
395 
396 static int g_runmode_needs_bypass = 0;
397 
399 {
400  g_runmode_needs_bypass = 1;
401 }
402 
404 {
405  return g_runmode_needs_bypass;
406 }
407 
408 
409 
410 /**
411  * \brief Registers a new runmode.
412  *
413  * \param runmode Runmode type.
414  * \param name Custom mode for this specific runmode type. Within each
415  * runmode type, each custom name is a primary key.
416  * \param description Description for this runmode.
417  * \param RunModeFunc The function to be run for this runmode.
418  */
420  const char *name,
421  const char *description,
422  int (*RunModeFunc)(void))
423 {
424  if (RunModeGetCustomMode(runmode, name) != NULL) {
425  FatalError(SC_ERR_RUNMODE, "runmode '%s' has already "
426  "been registered. Please use an unique name.", name);
427  }
428 
429  void *ptmp = SCRealloc(runmodes[runmode].runmodes,
430  (runmodes[runmode].cnt + 1) * sizeof(RunMode));
431  if (ptmp == NULL) {
432  SCFree(runmodes[runmode].runmodes);
433  runmodes[runmode].runmodes = NULL;
434  exit(EXIT_FAILURE);
435  }
436  runmodes[runmode].runmodes = ptmp;
437 
438  RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].cnt];
439  runmodes[runmode].cnt++;
440  memset(mode, 0x00, sizeof(*mode));
441 
442  mode->runmode = runmode;
443  mode->name = SCStrdup(name);
444  if (unlikely(mode->name == NULL)) {
445  FatalError(SC_ERR_MEM_ALLOC, "Failed to allocate string");
446  }
447  mode->description = SCStrdup(description);
448  if (unlikely(mode->description == NULL)) {
449  FatalError(SC_ERR_MEM_ALLOC, "Failed to allocate string");
450  }
451  mode->RunModeFunc = RunModeFunc;
452 
453  return;
454 }
455 
456 /**
457  * Setup the outputs for this run mode.
458  *
459  * \param tv The ThreadVars for the thread the outputs will be
460  * appended to.
461  */
462 static void RunOutputFreeList(void)
463 {
464  OutputFreeList *output;
465  while ((output = TAILQ_FIRST(&output_free_list))) {
466  SCLogDebug("output %s %p %p", output->output_module->name, output,
467  output->output_ctx);
468 
469  if (output->output_ctx != NULL && output->output_ctx->DeInit != NULL)
470  output->output_ctx->DeInit(output->output_ctx);
471 
472  TAILQ_REMOVE(&output_free_list, output, entries);
473  SCFree(output);
474  }
475 }
476 
477 static int file_logger_count = 0;
478 static int filedata_logger_count = 0;
479 static LoggerId logger_bits[ALPROTO_MAX];
480 
482 {
483  return file_logger_count > 0;
484 }
485 
487 {
488  return filedata_logger_count > 0;
489 }
490 
491 bool IsRunModeSystem(enum RunModes run_mode_to_check)
492 {
493  switch (run_mode_to_check) {
494  case RUNMODE_PCAP_FILE:
495  case RUNMODE_ERF_FILE:
497  return false;
498  break;
499  default:
500  return true;
501  }
502 }
503 
504 bool IsRunModeOffline(enum RunModes run_mode_to_check)
505 {
506  switch(run_mode_to_check) {
507  case RUNMODE_CONF_TEST:
508  case RUNMODE_PCAP_FILE:
509  case RUNMODE_ERF_FILE:
511  case RUNMODE_UNIX_SOCKET:
512  return true;
513  break;
514  default:
515  return false;
516  }
517 }
518 
519 /**
520  * Cleanup the run mode.
521  */
522 void RunModeShutDown(void)
523 {
524  RunOutputFreeList();
525 
533 
534  /* Reset logger counts. */
535  file_logger_count = 0;
536  filedata_logger_count = 0;
537 }
538 
539 /** \internal
540  * \brief add Sub RunModeOutput to list for Submodule so we can free
541  * the output ctx at shutdown and unix socket reload */
542 static void AddOutputToFreeList(OutputModule *module, OutputCtx *output_ctx)
543 {
544  OutputFreeList *fl_output = SCCalloc(1, sizeof(OutputFreeList));
545  if (unlikely(fl_output == NULL))
546  return;
547  fl_output->output_module = module;
548  fl_output->output_ctx = output_ctx;
549  TAILQ_INSERT_TAIL(&output_free_list, fl_output, entries);
550 }
551 
552 /** \brief Turn output into thread module */
553 static void SetupOutput(const char *name, OutputModule *module, OutputCtx *output_ctx)
554 {
555  /* flow logger doesn't run in the packet path */
556  if (module->FlowLogFunc) {
557  OutputRegisterFlowLogger(module->name, module->FlowLogFunc,
558  output_ctx, module->ThreadInit, module->ThreadDeinit,
559  module->ThreadExitPrintStats);
560  return;
561  }
562  /* stats logger doesn't run in the packet path */
563  if (module->StatsLogFunc) {
565  output_ctx,module->ThreadInit, module->ThreadDeinit,
566  module->ThreadExitPrintStats);
567  return;
568  }
569 
570  if (module->logger_id == LOGGER_ALERT_DEBUG) {
571  debuglog_enabled = 1;
572  }
573 
574  if (module->PacketLogFunc) {
575  SCLogDebug("%s is a packet logger", module->name);
576  OutputRegisterPacketLogger(module->logger_id, module->name,
577  module->PacketLogFunc, module->PacketConditionFunc, output_ctx,
578  module->ThreadInit, module->ThreadDeinit,
579  module->ThreadExitPrintStats);
580  } else if (module->TxLogFunc) {
581  SCLogDebug("%s is a tx logger", module->name);
582  OutputRegisterTxLogger(module->logger_id, module->name, module->alproto,
583  module->TxLogFunc, output_ctx, module->tc_log_progress,
584  module->ts_log_progress, module->TxLogCondition,
585  module->ThreadInit, module->ThreadDeinit,
586  module->ThreadExitPrintStats);
587  /* Not used with wild card loggers */
588  if (module->alproto != ALPROTO_UNKNOWN) {
589  logger_bits[module->alproto] |= (1<<module->logger_id);
590  }
591  } else if (module->FiledataLogFunc) {
592  SCLogDebug("%s is a filedata logger", module->name);
594  module->FiledataLogFunc, output_ctx, module->ThreadInit,
595  module->ThreadDeinit, module->ThreadExitPrintStats);
596  filedata_logger_count++;
597  } else if (module->FileLogFunc) {
598  SCLogDebug("%s is a file logger", module->name);
599  OutputRegisterFileLogger(module->logger_id, module->name,
600  module->FileLogFunc, output_ctx, module->ThreadInit,
601  module->ThreadDeinit, module->ThreadExitPrintStats);
602  file_logger_count++;
603  } else if (module->StreamingLogFunc) {
604  SCLogDebug("%s is a streaming logger", module->name);
606  module->StreamingLogFunc, output_ctx, module->stream_type,
607  module->ThreadInit, module->ThreadDeinit,
608  module->ThreadExitPrintStats);
609  } else {
610  SCLogError(SC_ERR_INVALID_ARGUMENT, "Unknown logger type: name=%s",
611  module->name);
612  }
613 }
614 
615 static void RunModeInitializeEveOutput(ConfNode *conf, OutputCtx *parent_ctx)
616 {
617  ConfNode *types = ConfNodeLookupChild(conf, "types");
618  SCLogDebug("types %p", types);
619  if (types == NULL) {
620  return;
621  }
622 
623  ConfNode *type = NULL;
624  TAILQ_FOREACH(type, &types->head, next) {
625  SCLogConfig("enabling 'eve-log' module '%s'", type->val);
626 
627  int sub_count = 0;
628  char subname[256];
629  snprintf(subname, sizeof(subname), "eve-log.%s", type->val);
630 
631  ConfNode *sub_output_config = ConfNodeLookupChild(type, type->val);
632  if (sub_output_config != NULL) {
633  const char *enabled = ConfNodeLookupChildValue(
634  sub_output_config, "enabled");
635  if (enabled != NULL && !ConfValIsTrue(enabled)) {
636  continue;
637  }
638  }
639 
640  /* Now setup all registers logger of this name. */
641  OutputModule *sub_module;
642  TAILQ_FOREACH(sub_module, &output_modules, entries) {
643  if (strcmp(subname, sub_module->conf_name) == 0) {
644  sub_count++;
645 
646  if (sub_module->parent_name == NULL ||
647  strcmp(sub_module->parent_name, "eve-log") != 0) {
649  "bad parent for %s", subname);
650  }
651  if (sub_module->InitSubFunc == NULL) {
653  "bad sub-module for %s", subname);
654  }
655 
656  /* pass on parent output_ctx */
657  OutputInitResult result =
658  sub_module->InitSubFunc(sub_output_config, parent_ctx);
659  if (!result.ok || result.ctx == NULL) {
660  continue;
661  }
662 
663  AddOutputToFreeList(sub_module, result.ctx);
664  SetupOutput(sub_module->name, sub_module,
665  result.ctx);
666  }
667  }
668 
669  /* Error is no registered loggers with this name
670  * were found .*/
671  if (!sub_count) {
673  "No output module named %s", subname);
674  continue;
675  }
676  }
677 }
678 
679 static void RunModeInitializeLuaOutput(ConfNode *conf, OutputCtx *parent_ctx)
680 {
681  OutputModule *lua_module = OutputGetModuleByConfName("lua");
682  BUG_ON(lua_module == NULL);
683 
684  ConfNode *scripts = ConfNodeLookupChild(conf, "scripts");
685  BUG_ON(scripts == NULL); //TODO
686 
687  OutputModule *m;
688  TAILQ_FOREACH(m, &parent_ctx->submodules, entries) {
689  SCLogDebug("m %p %s:%s", m, m->name, m->conf_name);
690 
691  ConfNode *script = NULL;
692  TAILQ_FOREACH(script, &scripts->head, next) {
693  SCLogDebug("script %s", script->val);
694  if (strcmp(script->val, m->conf_name) == 0) {
695  break;
696  }
697  }
698  BUG_ON(script == NULL);
699 
700  /* pass on parent output_ctx */
701  OutputInitResult result = m->InitSubFunc(script, parent_ctx);
702  if (!result.ok || result.ctx == NULL) {
703  continue;
704  }
705 
706  AddOutputToFreeList(m, result.ctx);
707  SetupOutput(m->name, m, result.ctx);
708  }
709 }
710 
711 /**
712  * Initialize the output modules.
713  */
715 {
716  ConfNode *outputs = ConfGetNode("outputs");
717  if (outputs == NULL) {
718  /* No "outputs" section in the configuration. */
719  return;
720  }
721 
722  ConfNode *output, *output_config;
723  const char *enabled;
724  char tls_log_enabled = 0;
725  char tls_store_present = 0;
726 
727  memset(&logger_bits, 0, sizeof(logger_bits));
728 
729  TAILQ_FOREACH(output, &outputs->head, next) {
730 
731  output_config = ConfNodeLookupChild(output, output->val);
732  if (output_config == NULL) {
733  /* Shouldn't happen. */
735  "Failed to lookup configuration child node: %s", output->val);
736  }
737 
738  if (strcmp(output->val, "tls-store") == 0) {
739  tls_store_present = 1;
740  }
741 
742  enabled = ConfNodeLookupChildValue(output_config, "enabled");
743  if (enabled == NULL || !ConfValIsTrue(enabled)) {
744  continue;
745  }
746 
747  if (strcmp(output->val, "file-log") == 0) {
749  "file-log is no longer supported,"
750  " use eve.files instead "
751  "(see https://redmine.openinfosecfoundation.org/issues/2376"
752  " for an explanation)");
753  continue;
754  } else if (strncmp(output->val, "unified-", sizeof("unified-") - 1) == 0) {
756  "Unified1 is no longer supported,"
757  " use Unified2 instead "
758  "(see https://redmine.openinfosecfoundation.org/issues/353"
759  " for an explanation)");
760  continue;
761  } else if (strcmp(output->val, "alert-prelude") == 0) {
762 #ifndef PRELUDE
764  "Prelude support not compiled in. Reconfigure/"
765  "recompile with --enable-prelude to add Prelude "
766  "support.");
767  continue;
768 #endif
769  } else if (strcmp(output->val, "lua") == 0) {
770 #ifndef HAVE_LUA
772  "lua support not compiled in. Reconfigure/"
773  "recompile with lua(jit) and its development "
774  "files installed to add lua support.");
775  continue;
776 #endif
777  } else if (strcmp(output->val, "dns-log") == 0) {
779  "dns-log is not longer available as of Suricata 5.0");
780  continue;
781  } else if (strcmp(output->val, "tls-log") == 0) {
782  tls_log_enabled = 1;
783  }
784 
785  OutputModule *module;
786  int count = 0;
787  TAILQ_FOREACH(module, &output_modules, entries) {
788  if (strcmp(module->conf_name, output->val) != 0) {
789  continue;
790  }
791 
792  count++;
793 
794  OutputCtx *output_ctx = NULL;
795  if (module->InitFunc != NULL) {
796  OutputInitResult r = module->InitFunc(output_config);
797  if (!r.ok) {
799  "output module \"%s\": setup failed", output->val);
800  continue;
801  } else if (r.ctx == NULL) {
802  continue;
803  }
804  output_ctx = r.ctx;
805  } else if (module->InitSubFunc != NULL) {
806  SCLogInfo("skipping submodule");
807  continue;
808  }
809 
810  // TODO if module == parent, find it's children
811  if (strcmp(output->val, "eve-log") == 0) {
812  RunModeInitializeEveOutput(output_config, output_ctx);
813 
814  /* add 'eve-log' to free list as it's the owner of the
815  * main output ctx from which the sub-modules share the
816  * LogFileCtx */
817  AddOutputToFreeList(module, output_ctx);
818  } else if (strcmp(output->val, "lua") == 0) {
819  SCLogDebug("handle lua");
820  if (output_ctx == NULL)
821  continue;
822  RunModeInitializeLuaOutput(output_config, output_ctx);
823  AddOutputToFreeList(module, output_ctx);
824  } else {
825  AddOutputToFreeList(module, output_ctx);
826  SetupOutput(module->name, module, output_ctx);
827  }
828  }
829  if (count == 0) {
831  "No output module named %s", output->val);
832  continue;
833  }
834  }
835 
836  /* Backward compatibility code */
837  if (!tls_store_present && tls_log_enabled) {
838  /* old YAML with no "tls-store" in outputs. "tls-log" value needs
839  * to be started using 'tls-log' config as own config */
841  "Please use 'tls-store' in YAML to configure TLS storage");
842 
843  TAILQ_FOREACH(output, &outputs->head, next) {
844  output_config = ConfNodeLookupChild(output, output->val);
845 
846  if (strcmp(output->val, "tls-log") == 0) {
847 
848  OutputModule *module = OutputGetModuleByConfName("tls-store");
849  if (module == NULL) {
851  "No output module named %s, ignoring", "tls-store");
852  continue;
853  }
854 
855  OutputCtx *output_ctx = NULL;
856  if (module->InitFunc != NULL) {
857  OutputInitResult r = module->InitFunc(output_config);
858  if (!r.ok) {
860  "output module setup failed");
861  continue;
862  } else if (r.ctx == NULL) {
863  continue;
864  }
865  output_ctx = r.ctx;
866  }
867 
868  AddOutputToFreeList(module, output_ctx);
869  SetupOutput(module->name, module, output_ctx);
870  }
871  }
872  }
873 
874  /* register the logger bits to the app-layer */
875  int a;
876  for (a = 0; a < ALPROTO_MAX; a++) {
877  if (logger_bits[a] == 0)
878  continue;
879 
880  const int tcp = AppLayerParserProtocolHasLogger(IPPROTO_TCP, a);
881  const int udp = AppLayerParserProtocolHasLogger(IPPROTO_UDP, a);
882 
883  SCLogDebug("logger for %s: %s %s", AppProtoToString(a),
884  tcp ? "true" : "false", udp ? "true" : "false");
885 
886  SCLogDebug("logger bits for %s: %08x", AppProtoToString(a), logger_bits[a]);
887  if (tcp)
888  AppLayerParserRegisterLoggerBits(IPPROTO_TCP, a, logger_bits[a]);
889  if (udp)
890  AppLayerParserRegisterLoggerBits(IPPROTO_UDP, a, logger_bits[a]);
891 
892  }
893 }
894 
896 
897 /**
898  * Initialize multithreading settings.
899  */
901 {
903  if ((ConfGetBool("threading.set-cpu-affinity", &threading_set_cpu_affinity)) == 0) {
905  }
906  /* try to get custom cpu mask value if needed */
909  }
910  if ((ConfGetFloat("threading.detect-thread-ratio", &threading_detect_ratio)) != 1) {
911  if (ConfGetNode("threading.detect-thread-ratio") != NULL)
912  WarnInvalidConfEntry("threading.detect-thread-ratio", "%s", "1");
913  threading_detect_ratio = 1;
914  }
915 
916  SCLogDebug("threading.detect-thread-ratio %f", threading_detect_ratio);
917 }
StreamingLogger StreamingLogFunc
Definition: output.h:69
const char * thread_name_counter_wakeup
Definition: runmodes.c:71
void RunModeIpsIPFWRegister(void)
Definition: runmode-ipfw.c:49
const char * name
Definition: runmodes.c:79
int ts_log_progress
Definition: output.h:74
int OutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, OutputCtx *output_ctx, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, void(*ThreadExitPrintStats)(ThreadVars *, void *))
Definition: output-tx.c:67
#define SCLogDebug(...)
Definition: util-debug.h:335
float threading_detect_ratio
Definition: runmodes.c:895
#define TAILQ_FIRST(head)
Definition: queue.h:339
void OutputFileShutdown(void)
Definition: output-file.c:272
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:350
struct HtpBodyChunk_ * next
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
void RunModeInitialize(void)
Definition: runmodes.c:900
const char * RunModeErfFileGetDefaultMode(void)
#define BUG_ON(x)
int OutputRegisterFiledataLogger(LoggerId id, const char *name, FiledataLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
#define FALSE
LoggerId
OutputInitFunc InitFunc
Definition: output.h:55
int RunModeOutputFileEnabled(void)
Definition: runmodes.c:481
const char * RunModeNetmapGetDefaultMode(void)
struct RunMode_ RunMode
Holds description for a runmode.
#define unlikely(expr)
Definition: util-optimize.h:35
void RunModeIdsPfringRegister(void)
ThreadDeinitFunc ThreadDeinit
Definition: output.h:59
PacketLogger PacketLogFunc
Definition: output.h:62
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:517
const char * description
Definition: runmodes.c:80
bool IsRunModeOffline(enum RunModes run_mode_to_check)
Definition: runmodes.c:504
const char * thread_name_flow_bypass
Definition: runmodes.c:67
const char * thread_name_single
Definition: runmodes.c:62
int tc_log_progress
Definition: output.h:73
OutputInitSubFunc InitSubFunc
Definition: output.h:56
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
const char * RunModeIpsWinDivertGetDefaultMode(void)
char * val
Definition: conf.h:34
const char * thread_name_counter_stats
Definition: runmodes.c:70
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:815
#define TRUE
void RunModeInitializeOutputs(void)
Definition: runmodes.c:714
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:331
void RunModeIpsWinDivertRegister(void)
char * RunmodeGetActive(void)
Definition: runmodes.c:187
LoggerId logger_id
Definition: output.h:51
#define FatalErrorOnInit(x,...)
Fatal error IF we&#39;re starting up, and configured to consider errors to be fatal errors.
Definition: util-debug.h:547
ThreadInitFunc ThreadInit
Definition: output.h:58
Holds description for a runmode.
Definition: runmodes.c:76
void OutputFiledataShutdown(void)
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
Definition: output.c:824
const char * RunModeNapatechGetDefaultMode(void)
void RunModeIdsPcapRegister(void)
Definition: runmode-pcap.c:42
TxLoggerCondition TxLogCondition
Definition: output.h:65
int(* RunModeFunc)(void)
Definition: runmodes.c:82
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
#define SCCalloc(nm, a)
Definition: util-mem.h:253
RunModes
Definition: runmodes.h:27
const char * RunModeFilePcapGetDefaultMode(void)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:843
const char * RunModeIpsNFQGetDefaultMode(void)
Definition: runmode-nfq.c:42
TxLogger TxLogFunc
Definition: output.h:64
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
void RunModeFilePcapRegister(void)
int OutputRegisterStreamingLogger(LoggerId id, const char *name, StreamingLogger LogFunc, OutputCtx *output_ctx, enum OutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
void RunModeDispatch(int runmode, const char *custom_mode)
Definition: runmodes.c:278
uint8_t type
const char * RunModeIdsGetDefaultMode(void)
Definition: runmode-pcap.c:35
AppProto alproto
Definition: output.h:71
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
const char * RunModeAFPGetDefaultMode(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
Definition: runmodes.c:209
const char * name
Definition: output.h:52
enum OutputStreamingType stream_type
Definition: output.h:72
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:412
const char * RunModeIdsNflogGetDefaultMode(void)
Definition: runmode-nflog.c:37
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
Definition: counters.c:889
void OutputPacketShutdown(void)
OutputCtx * output_ctx
Definition: runmodes.c:97
const char * RunModeUnixSocketGetDefaultMode(void)
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
Definition: tm-queues.c:95
void RunModeUnixSocketRegister(void)
void TmqhFlowPrintAutofpHandler(void)
Definition: tmqh-flow.c:82
const char * thread_name_detect_loader
Definition: runmodes.c:69
struct RunModes_ RunModes
RunMode * runmodes
Definition: runmodes.c:87
const char * RunModeIpsIPFWGetDefaultMode(void)
Definition: runmode-ipfw.c:44
FlowLogger FlowLogFunc
Definition: output.h:68
void AffinitySetupLoadFromConfig()
Extract cpu affinity configuration from current config file.
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
#define SCRealloc(x, a)
Definition: util-mem.h:238
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:566
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:385
void OutputTxShutdown(void)
Definition: output-tx.c:379
void RunModeErfDagRegister(void)
void BypassedFlowManagerThreadSpawn()
spawn the flow bypass manager thread
Definition: flow-bypass.c:183
void RunModeShutDown(void)
Definition: runmodes.c:522
ThreadExitPrintStatsFunc ThreadExitPrintStats
Definition: output.h:60
Definition: conf.h:32
enum RunModes runmode
Definition: runmodes.c:78
OutputCtx * ctx
Definition: output.h:42
FiledataLogger FiledataLogFunc
Definition: output.h:67
void RunModeListRunmodes(void)
Lists all registered runmodes.
Definition: runmodes.c:235
int RunModeOutputFiledataEnabled(void)
Definition: runmodes.c:486
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
void RunModeIdsNflogRegister(void)
Definition: runmode-nflog.c:42
#define SCFree(a)
Definition: util-mem.h:322
const char * thread_name_verdict
Definition: runmodes.c:64
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-stats.c:57
int RunModeNeedsBypassManager(void)
Definition: runmodes.c:403
void OutputStatsShutdown(void)
Definition: output-stats.c:213
int debuglog_enabled
Definition: runmodes.c:58
#define TAILQ_ENTRY(type)
Definition: queue.h:330
const char * parent_name
Definition: output.h:54
void RunModeIdsNetmapRegister(void)
const char * RunModeGetMainMode(void)
Definition: runmodes.c:199
const char * RunModeErfDagGetDefaultMode(void)
int cnt
Definition: runmodes.c:86
const char * thread_name_autofp
Definition: runmodes.c:61
OutputModuleList output_modules
void RunModeIpsNFQRegister(void)
Definition: runmode-nfq.c:47
void RunModeNapatechRegister(void)
void UtRunModeRegister(void)
#define FatalError(x,...)
Definition: util-debug.h:539
int RunmodeGetCurrent(void)
Definition: suricata.c:275
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
Definition: util-misc.h:37
FileLogger FileLogFunc
Definition: output.h:66
SCMutex m
Definition: flow-hash.h:105
const char * RunModeIdsPfringGetDefaultMode(void)
void FlowManagerThreadSpawn()
spawn the flow manager thread
Definition: flow-manager.c:878
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
int ConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
Definition: conf.c:645
bool IsRunModeSystem(enum RunModes run_mode_to_check)
Definition: runmodes.c:491
const char * conf_name
Definition: output.h:53
int OutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-flow.c:58
#define SCStrdup(a)
Definition: util-mem.h:268
void RunModeIdsAFPRegister(void)
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void))
Registers a new runmode.
Definition: runmodes.c:419
void OutputFlowShutdown(void)
Definition: output-flow.c:208
int OutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-packet.c:61
StatsLogger StatsLogFunc
Definition: output.h:70
void RunModeEnablesBypassManager(void)
Definition: runmodes.c:398
void FlowRecyclerThreadSpawn()
spawn the flow recycler thread
PacketLogCondition PacketConditionFunc
Definition: output.h:63
void RunModeErfFileRegister(void)
#define TAILQ_HEAD_INITIALIZER(head)
Definition: queue.h:327
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
const char * thread_name_unix_socket
Definition: runmodes.c:68
int threading_set_cpu_affinity
Definition: runmodes.h:112
OutputModule * output_module
Definition: runmodes.c:96
int OutputRegisterFileLogger(LoggerId id, const char *name, FileLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-file.c:63
const char * thread_name_flow_mgr
Definition: runmodes.c:65
const char * thread_name_flow_rec
Definition: runmodes.c:66
void OutputStreamingShutdown(void)
const char * thread_name_workers
Definition: runmodes.c:63