Go to the documentation of this file.
96 static char *active_runmode;
116 static const char *RunModeTranslateModeToName(
int runmode)
138 return "AF_PACKET_DEV";
145 return "NETMAP(DISABLED)";
148 return "UNIX_SOCKET";
153 return "WINDIVERT(DISABLED)";
159 return "DPDK(DISABLED)";
175 static RunMode *RunModeGetCustomMode(
enum RunModes runmode,
const char *custom_mode)
178 for (
int i = 0; i < runmodes[runmode].cnt; i++) {
179 if (strcmp(runmodes[runmode].runmodes[i].name, custom_mode) == 0)
180 return &runmodes[runmode].runmodes[i];
196 return active_runmode;
210 return RunModeTranslateModeToName(mainmode);
218 memset(runmodes, 0,
sizeof(runmodes));
243 printf(
"------------------------------------- Runmodes -------------------"
244 "-----------------------\n");
246 printf(
"| %-17s | %-17s | %-10s \n",
247 "RunMode Type",
"Custom Mode ",
"Description");
248 printf(
"|-----------------------------------------------------------------"
249 "-----------------------\n");
253 int mode_displayed = 0;
254 for (j = 0; j < runmodes[i].cnt; j++) {
255 if (mode_displayed == 1) {
256 printf(
"| ----------------------------------------------"
257 "-----------------------\n");
258 RunMode *runmode = &runmodes[i].runmodes[j];
259 printf(
"| %-17s | %-17s | %-27s \n",
264 RunMode *runmode = &runmodes[i].runmodes[j];
265 printf(
"| %-17s | %-17s | %-27s \n",
266 RunModeTranslateModeToName(runmode->
runmode),
270 if (mode_displayed == 0)
273 if (mode_displayed == 1) {
274 printf(
"|-----------------------------------------------------------------"
275 "-----------------------\n");
280 static const char *RunModeGetConfOrDefault(
int capture_mode,
const char *capture_plugin_name)
282 const char *custom_mode = NULL;
283 const char *val = NULL;
284 if (
ConfGet(
"runmode", &val) != 1) {
290 if ((custom_mode == NULL) || (strcmp(custom_mode,
"auto") == 0)) {
291 switch (capture_mode) {
301 if (plugin == NULL) {
302 FatalError(
"No capture plugin found with name %s", capture_plugin_name);
350 if (!strcmp(
"worker", custom_mode)) {
352 "to 'workers', please modify your setup.");
353 custom_mode =
"workers";
362 if (runmode == NULL) {
363 runmode = RunModeGetConfOrDefault(capture_mode, capture_plugin_name);
368 RunMode *mode = RunModeGetCustomMode(capture_mode, runmode);
376 if (ips_enabled == 1) {
379 SCLogWarning(
"disabling livedev.use-for-tracking with IPS mode. See ticket #6726.");
390 void RunModeDispatch(
int runmode,
const char *custom_mode,
const char *capture_plugin_name,
391 const char *capture_plugin_args)
393 char *local_custom_mode = NULL;
395 if (custom_mode == NULL) {
396 custom_mode = RunModeGetConfOrDefault(runmode, capture_plugin_name);
397 if (custom_mode == NULL)
401 RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
403 SCLogError(
"The custom type \"%s\" doesn't exist "
404 "for this runmode type \"%s\". Please use --list-runmodes to "
405 "see available custom types for this runmode",
406 custom_mode, RunModeTranslateModeToName(runmode));
411 if (active_runmode) {
414 active_runmode =
SCStrdup(custom_mode);
415 if (
unlikely(active_runmode == NULL)) {
419 if (strcasecmp(active_runmode,
"autofp") == 0) {
425 if (local_custom_mode != NULL)
426 SCFree(local_custom_mode);
442 static int g_runmode_needs_bypass = 0;
446 g_runmode_needs_bypass = 1;
451 return g_runmode_needs_bypass;
466 int (*RunModeFunc)(
void),
int (*RunModeIsIPSEnabled)(
void))
468 if (RunModeGetCustomMode(runmode, name) != NULL) {
470 "been registered. Please use an unique name.",
474 void *ptmp =
SCRealloc(runmodes[runmode].runmodes,
475 (runmodes[runmode].
cnt + 1) *
sizeof(
RunMode));
477 SCFree(runmodes[runmode].runmodes);
478 runmodes[runmode].runmodes = NULL;
481 runmodes[runmode].runmodes = ptmp;
483 RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].cnt];
484 runmodes[runmode].cnt++;
485 memset(mode, 0x00,
sizeof(*mode));
506 static void RunOutputFreeList(
void)
509 while ((output =
TAILQ_FIRST(&output_free_list))) {
519 static int file_logger_count = 0;
520 static int filedata_logger_count = 0;
524 return filedata_logger_count > 0;
529 switch (run_mode_to_check) {
542 switch(run_mode_to_check) {
573 file_logger_count = 0;
574 filedata_logger_count = 0;
591 static void SetupOutput(
628 filedata_logger_count++;
656 if (strcmp(
type->val,
"ikev2") == 0) {
657 SCLogWarning(
"eve module 'ikev2' has been replaced by 'ike'");
658 strlcpy(subname,
"eve-log.ike",
sizeof(subname));
660 snprintf(subname,
sizeof(subname),
"eve-log.%s",
type->val);
666 if (sub_output_config != NULL) {
668 sub_output_config,
"enabled");
677 if (strcmp(subname, sub_module->
conf_name) == 0) {
690 sub_module->
InitSubFunc(sub_output_config, parent_ctx);
691 if (!result.
ok || result.
ctx == NULL) {
692 FatalError(
"unable to initialize sub-module %s", subname);
695 AddOutputToFreeList(sub_module, result.
ctx);
696 SetupOutput(sub_module->
name, sub_module, result.
ctx, logger_bits);
712 BUG_ON(lua_module == NULL);
724 if (strcmp(script->
val,
m->conf_name) == 0) {
732 if (!result.
ok || result.
ctx == NULL) {
736 AddOutputToFreeList(
m, result.
ctx);
737 SetupOutput(
m->name,
m, result.
ctx, logger_bits);
750 if (outputs == NULL) {
757 char tls_log_enabled = 0;
758 char tls_store_present = 0;
765 if (output_config == NULL) {
767 FatalError(
"Failed to lookup configuration child node: %s", output->
val);
770 if (strcmp(output->
val,
"tls-store") == 0) {
771 tls_store_present = 1;
779 if (strcmp(output->
val,
"file-log") == 0) {
781 " use eve.files instead "
783 " for an explanation)");
785 }
else if (strncmp(output->
val,
"unified-",
sizeof(
"unified-") - 1) == 0) {
787 " use Unified2 instead "
789 " for an explanation)");
791 }
else if (strncmp(output->
val,
"unified2-",
sizeof(
"unified2-") - 1) == 0) {
794 }
else if (strcmp(output->
val,
"dns-log") == 0) {
795 SCLogWarning(
"dns-log is not longer available as of Suricata 5.0");
797 }
else if (strcmp(output->
val,
"tls-log") == 0) {
816 }
else if (r.
ctx == NULL) {
826 if (strcmp(output->
val,
"eve-log") == 0) {
827 RunModeInitializeEveOutput(output_config, output_ctx, logger_bits);
832 AddOutputToFreeList(module, output_ctx);
833 }
else if (strcmp(output->
val,
"lua") == 0) {
835 if (output_ctx == NULL)
837 RunModeInitializeLuaOutput(output_config, output_ctx, logger_bits);
838 AddOutputToFreeList(module, output_ctx);
840 AddOutputToFreeList(module, output_ctx);
841 SetupOutput(module->
name, module, output_ctx, logger_bits);
851 if (!tls_store_present && tls_log_enabled) {
854 SCLogWarning(
"Please use 'tls-store' in YAML to configure TLS storage");
859 if (strcmp(output->
val,
"tls-log") == 0) {
862 if (module == NULL) {
863 SCLogWarning(
"No output module named %s, ignoring",
"tls-store");
873 }
else if (r.
ctx == NULL) {
879 AddOutputToFreeList(module, output_ctx);
880 SetupOutput(module->
name, module, output_ctx, logger_bits);
893 SCLogDebug(
"IPPROTO_TCP::%s: g_file_logger_enabled %d g_filedata_logger_enabled %d -> "
905 if (logger_bits[a] == 0)
915 tcp ?
"true" :
"false", udp ?
"true" :
"false");
935 if ((
ConfGetBool(
"threading.set-cpu-affinity", &affinity)) == 0) {
946 if (
ConfGetNode(
"threading.detect-thread-ratio") != NULL)
957 const char *ss = NULL;
958 if ((
ConfGet(
"threading.stack-size", &ss)) == 1) {
961 FatalError(
"Failed to initialize thread_stack_size output, invalid limit: %s", ss);
966 pthread_attr_init(&attr);
968 if (pthread_attr_getstacksize(&attr, &size) == 0 && size < 512 * 1024) {
970 SCLogNotice(
"thread stack size of %" PRIuMAX
" too small: setting to 512k",
const char * thread_name_workers
const char * RunModeIpsIPFWGetDefaultMode(void)
void FlowManagerThreadSpawn(void)
spawn the flow manager thread
void AffinitySetupLoadFromConfig(void)
Extract cpu affinity configuration from current config file.
const char * thread_name_counter_wakeup
int SCRunmodeGet(void)
Get the current run mode.
bool threading_set_cpu_affinity
void RunModeErfFileRegister(void)
void OutputStreamingShutdown(void)
int(* RunModeIsIPSEnabled)(void)
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
const char * thread_name_flow_mgr
const char * RunModeErfFileGetDefaultMode(void)
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
void OutputTxShutdown(void)
void TmqhFlowPrintAutofpHandler(void)
void RunModeIdsAFPRegister(void)
int ParseSizeStringU64(const char *size, uint64_t *res)
struct HtpBodyChunk_ * next
void BypassedFlowManagerThreadSpawn(void)
spawn the flow bypass manager thread
void RunModeShutDown(void)
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
const char * thread_name_counter_stats
int SCOutputRegisterStreamingLogger(LoggerId id, const char *name, SCStreamingLogger LogFunc, void *initdata, enum SCOutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a streaming logger.
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
const char * RunModeAFPGetDefaultMode(void)
const char * thread_name_flow_rec
void OutputFiledataShutdown(void)
const char * RunModeFilePcapGetDefaultMode(void)
#define TAILQ_FOREACH(var, head, field)
const char * thread_name_autofp
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
void OutputSetupActiveLoggers(void)
const char * RunModeIdsNflogGetDefaultMode(void)
void OutputStatsShutdown(void)
#define TAILQ_INSERT_TAIL(head, elm, field)
char * RunmodeGetActive(void)
OutputInitSubFunc InitSubFunc
int SCOutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow logger.
struct RunModes_ RunModes
PacketLogger PacketLogFunc
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
const char * RunModeAFXDPGetDefaultMode(void)
bool IsRunModeOffline(enum RunModes run_mode_to_check)
SCFiledataLogger FiledataLogFunc
void RunModeInitializeOutputs(void)
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
const char * thread_name_single
const char *(* GetDefaultMode)(void)
int ConfValIsTrue(const char *val)
Check if a value is true.
void OutputClearActiveLoggers(void)
size_t strlcpy(char *dst, const char *src, size_t siz)
#define TAILQ_ENTRY(type)
const char * RunModeUnixSocketGetDefaultMode(void)
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
void RunModeIpsNFQRegister(void)
enum SCOutputStreamingType stream_type
void RunModeInitializeThreadSettings(void)
ThreadInitFunc ThreadInit
const char * RunModeDpdkGetDefaultMode(void)
#define TAILQ_HEAD_INITIALIZER(head)
bool IsRunModeSystem(enum RunModes run_mode_to_check)
OutputModuleList output_modules
#define TAILQ_REMOVE(head, elm, field)
#define TAILQ_FIRST(head)
const char * thread_name_flow_bypass
ThreadDeinitFunc ThreadDeinit
void RunModeListRunmodes(void)
Lists all registered runmodes.
bool g_filedata_logger_enabled
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), int(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
uint64_t threading_set_stack_size
void RunModeEnablesBypassManager(void)
void OutputPacketShutdown(void)
void RunModeIdsNflogRegister(void)
Holds description for a runmode.
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
void RunModeIpsIPFWRegister(void)
SCStreamingLogger StreamingLogFunc
#define SCLogWarning(...)
Macro used to log WARNING messages.
const char * RunModeErfDagGetDefaultMode(void)
int SCOutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, void *initdata, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a transaction logger.
const char * thread_name_detect_loader
void OutputFileShutdown(void)
void FlowRecyclerThreadSpawn(void)
spawn the flow recycler thread
void RunModeErfDagRegister(void)
struct RunMode_ RunMode
Holds description for a runmode.
int SCOutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet logger.
int SCOutputRegisterFileLogger(LoggerId id, const char *name, SCFileLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file logger.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
void RunModeIpsWinDivertRegister(void)
#define SCRealloc(ptr, sz)
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
void RunModeIdsAFXDPRegister(void)
int ConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
TxLoggerCondition TxLogCondition
void RunModeUnixSocketRegister(void)
void(* DeInit)(struct OutputCtx_ *)
#define FatalErrorOnInit(...)
Fatal error IF we're starting up, and configured to consider errors to be fatal errors.
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
int RunModeNeedsBypassManager(void)
bool g_file_logger_enabled
void RunModeIdsPcapRegister(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
void RunModeFilePcapRegister(void)
PacketLogCondition PacketConditionFunc
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
const char * RunModeNetmapGetDefaultMode(void)
const char * RunModeIpsNFQGetDefaultMode(void)
@ RUNMODE_ENGINE_ANALYSIS
#define SCLogError(...)
Macro used to log ERROR messages.
void RunModeIdsNetmapRegister(void)
struct OutputFreeList_ OutputFreeList
const char * thread_name_verdict
void RunModeDpdkRegister(void)
#define TAILQ_HEAD(name, type)
void OutputFlowShutdown(void)
int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
int SCOutputRegisterFiledataLogger(LoggerId id, const char *name, SCFiledataLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file-data logger.
const char * thread_name_unix_socket
OutputModule * output_module
const char * RunModeGetMainMode(void)
int RunModeOutputFiledataEnabled(void)
int LiveGetDeviceCount(void)
Get the number of registered devices.
#define SCLogNotice(...)
Macro used to log NOTICE messages.
void UtRunModeRegister(void)
const char * RunModeIpsWinDivertGetDefaultMode(void)
SCCapturePlugin * SCPluginFindCaptureByName(const char *name)
float threading_detect_ratio
const char * RunModeIdsGetDefaultMode(void)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.