suricata
runmodes.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /** \file
19  *
20  * \author Victor Julien <victor@inliniac.net>
21  *
22  * Pre-cooked threading runmodes.
23  */
24 
25 #include "suricata-common.h"
26 #include "detect.h"
27 #include "detect-engine.h"
28 #include "detect-engine-mpm.h"
29 #include "app-layer-parser.h"
30 #include "tm-threads.h"
31 #include "util-debug.h"
32 #include "util-time.h"
33 #include "util-cpu.h"
34 #include "util-byte.h"
35 #include "util-affinity.h"
36 #include "conf.h"
37 #include "queue.h"
38 #include "runmodes.h"
39 #include "util-unittest.h"
40 #include "util-misc.h"
41 
42 #include "output.h"
43 
44 #include "alert-fastlog.h"
45 #include "alert-prelude.h"
46 #include "alert-unified2-alert.h"
47 #include "alert-debuglog.h"
48 
49 #include "log-httplog.h"
50 
51 #include "source-pfring.h"
52 
53 #include "tmqh-flow.h"
54 #include "flow-manager.h"
55 #include "flow-bypass.h"
56 #include "counters.h"
57 
59 
60 /* Runmode Global Thread Names */
61 const char *thread_name_autofp = "RX";
62 const char *thread_name_single = "W";
63 const char *thread_name_workers = "W";
64 const char *thread_name_verdict = "TX";
65 const char *thread_name_flow_mgr = "FM";
66 const char *thread_name_flow_rec = "FR";
67 const char *thread_name_flow_bypass = "FB";
68 const char *thread_name_unix_socket = "US";
69 const char *thread_name_detect_loader = "DL";
70 const char *thread_name_counter_stats = "CS";
71 const char *thread_name_counter_wakeup = "CW";
72 
73 /**
74  * \brief Holds description for a runmode.
75  */
76 typedef struct RunMode_ {
77  /* the runmode type */
78  int runmode;
79  const char *name;
80  const char *description;
81  /* runmode function */
82  int (*RunModeFunc)(void);
83 } RunMode;
84 
85 typedef struct RunModes_ {
88 } RunModes;
89 
90 static RunModes runmodes[RUNMODE_USER_MAX];
91 
92 static char *active_runmode;
93 
94 /* free list for our outputs */
95 typedef struct OutputFreeList_ {
98 
101 static TAILQ_HEAD(, OutputFreeList_) output_free_list =
102  TAILQ_HEAD_INITIALIZER(output_free_list);
103 
104 /**
105  * \internal
106  * \brief Translate a runmode mode to a printale string.
107  *
108  * \param runmode Runmode to be converted into a printable string.
109  *
110  * \retval string Printable string.
111  */
112 static const char *RunModeTranslateModeToName(int runmode)
113 {
114  switch (runmode) {
115  case RUNMODE_PCAP_DEV:
116  return "PCAP_DEV";
117  case RUNMODE_PCAP_FILE:
118  return "PCAP_FILE";
119  case RUNMODE_PFRING:
120 #ifdef HAVE_PFRING
121  return "PFRING";
122 #else
123  return "PFRING(DISABLED)";
124 #endif
125  case RUNMODE_NFQ:
126  return "NFQ";
127  case RUNMODE_NFLOG:
128  return "NFLOG";
129  case RUNMODE_IPFW:
130  return "IPFW";
131  case RUNMODE_ERF_FILE:
132  return "ERF_FILE";
133  case RUNMODE_DAG:
134  return "ERF_DAG";
135  case RUNMODE_NAPATECH:
136  return "NAPATECH";
137  case RUNMODE_UNITTEST:
138  return "UNITTEST";
139  case RUNMODE_AFP_DEV:
140  return "AF_PACKET_DEV";
141  case RUNMODE_NETMAP:
142 #ifdef HAVE_NETMAP
143  return "NETMAP";
144 #else
145  return "NETMAP(DISABLED)";
146 #endif
147  case RUNMODE_UNIX_SOCKET:
148  return "UNIX_SOCKET";
149  case RUNMODE_WINDIVERT:
150 #ifdef WINDIVERT
151  return "WINDIVERT";
152 #else
153  return "WINDIVERT(DISABLED)";
154 #endif
155  default:
156  SCLogError(SC_ERR_UNKNOWN_RUN_MODE, "Unknown runtime mode. Aborting");
157  exit(EXIT_FAILURE);
158  }
159 }
160 
161 /**
162  * \internal
163  * \brief Dispatcher function for runmodes. Calls the required runmode function
164  * based on runmode + runmode_custom_id.
165  *
166  * \param runmode The runmode type.
167  * \param runmode_customd_id The runmode custom id.
168  */
169 static RunMode *RunModeGetCustomMode(int runmode, const char *custom_mode)
170 {
171  int i;
172 
173  for (i = 0; i < runmodes[runmode].no_of_runmodes; i++) {
174  if (strcmp(runmodes[runmode].runmodes[i].name, custom_mode) == 0)
175  return &runmodes[runmode].runmodes[i];
176  }
177 
178  return NULL;
179 }
180 
181 
182 /**
183  * Return the running mode
184  *
185  * The returned string must not be freed.
186  *
187  * \return a string containing the current running mode
188  */
189 char *RunmodeGetActive(void)
190 {
191  return active_runmode;
192 }
193 
194 /**
195  * Return the running mode
196  *
197  * The returned string must not be freed.
198  *
199  * \return a string containing the current running mode
200  */
201 const char *RunModeGetMainMode(void)
202 {
203  int mainmode = RunmodeGetCurrent();
204 
205  return RunModeTranslateModeToName(mainmode);
206 }
207 
208 /**
209  * \brief Register all runmodes in the engine.
210  */
212 {
213  memset(runmodes, 0, sizeof(runmodes));
214 
228 #ifdef UNITTESTS
230 #endif
231  return;
232 }
233 
234 /**
235  * \brief Lists all registered runmodes.
236  */
238 {
239  printf("------------------------------------- Runmodes -------------------"
240  "-----------------------\n");
241 
242  printf("| %-17s | %-17s | %-10s \n",
243  "RunMode Type", "Custom Mode ", "Description");
244  printf("|-----------------------------------------------------------------"
245  "-----------------------\n");
246  int i = RUNMODE_UNKNOWN + 1;
247  int j = 0;
248  for ( ; i < RUNMODE_USER_MAX; i++) {
249  int mode_displayed = 0;
250  for (j = 0; j < runmodes[i].no_of_runmodes; j++) {
251  if (mode_displayed == 1) {
252  printf("| ----------------------------------------------"
253  "-----------------------\n");
254  RunMode *runmode = &runmodes[i].runmodes[j];
255  printf("| %-17s | %-17s | %-27s \n",
256  "",
257  runmode->name,
258  runmode->description);
259  } else {
260  RunMode *runmode = &runmodes[i].runmodes[j];
261  printf("| %-17s | %-17s | %-27s \n",
262  RunModeTranslateModeToName(runmode->runmode),
263  runmode->name,
264  runmode->description);
265  }
266  if (mode_displayed == 0)
267  mode_displayed = 1;
268  }
269  if (mode_displayed == 1) {
270  printf("|-----------------------------------------------------------------"
271  "-----------------------\n");
272  }
273  }
274 
275  return;
276 }
277 
278 /**
279  */
280 void RunModeDispatch(int runmode, const char *custom_mode)
281 {
282  char *local_custom_mode = NULL;
283 
284  if (custom_mode == NULL) {
285  const char *val = NULL;
286  if (ConfGet("runmode", &val) != 1) {
287  custom_mode = NULL;
288  } else {
289  custom_mode = val;
290  }
291  }
292 
293  if (custom_mode == NULL || strcmp(custom_mode, "auto") == 0) {
294  switch (runmode) {
295  case RUNMODE_PCAP_DEV:
296  custom_mode = RunModeIdsGetDefaultMode();
297  break;
298  case RUNMODE_PCAP_FILE:
299  custom_mode = RunModeFilePcapGetDefaultMode();
300  break;
301 #ifdef HAVE_PFRING
302  case RUNMODE_PFRING:
303  custom_mode = RunModeIdsPfringGetDefaultMode();
304  break;
305 #endif
306  case RUNMODE_NFQ:
307  custom_mode = RunModeIpsNFQGetDefaultMode();
308  break;
309  case RUNMODE_IPFW:
310  custom_mode = RunModeIpsIPFWGetDefaultMode();
311  break;
312  case RUNMODE_ERF_FILE:
313  custom_mode = RunModeErfFileGetDefaultMode();
314  break;
315  case RUNMODE_DAG:
316  custom_mode = RunModeErfDagGetDefaultMode();
317  break;
318  case RUNMODE_NAPATECH:
319  custom_mode = RunModeNapatechGetDefaultMode();
320  break;
321  case RUNMODE_AFP_DEV:
322  custom_mode = RunModeAFPGetDefaultMode();
323  break;
324  case RUNMODE_NETMAP:
325  custom_mode = RunModeNetmapGetDefaultMode();
326  break;
327  case RUNMODE_UNIX_SOCKET:
328  custom_mode = RunModeUnixSocketGetDefaultMode();
329  break;
330  case RUNMODE_NFLOG:
331  custom_mode = RunModeIdsNflogGetDefaultMode();
332  break;
333 #ifdef WINDIVERT
334  case RUNMODE_WINDIVERT:
335  custom_mode = RunModeIpsWinDivertGetDefaultMode();
336  break;
337 #endif
338  default:
339  SCLogError(SC_ERR_UNKNOWN_RUN_MODE, "Unknown runtime mode. Aborting");
340  exit(EXIT_FAILURE);
341  }
342  } else { /* if (custom_mode == NULL) */
343  /* Add compability with old 'worker' name */
344  if (!strcmp("worker", custom_mode)) {
345  SCLogWarning(SC_ERR_RUNMODE, "'worker' mode have been renamed "
346  "to 'workers', please modify your setup.");
347  local_custom_mode = SCStrdup("workers");
348  if (unlikely(local_custom_mode == NULL)) {
349  SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup custom mode");
350  exit(EXIT_FAILURE);
351  }
352  custom_mode = local_custom_mode;
353  }
354  }
355 
356  RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
357  if (mode == NULL) {
358  SCLogError(SC_ERR_RUNMODE, "The custom type \"%s\" doesn't exist "
359  "for this runmode type \"%s\". Please use --list-runmodes to "
360  "see available custom types for this runmode",
361  custom_mode, RunModeTranslateModeToName(runmode));
362  exit(EXIT_FAILURE);
363  }
364 
365  /* Export the custom mode */
366  if (active_runmode) {
367  SCFree(active_runmode);
368  }
369  active_runmode = SCStrdup(custom_mode);
370  if (unlikely(active_runmode == NULL)) {
371  SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup active mode");
372  exit(EXIT_FAILURE);
373  }
374 
375  if (strcasecmp(active_runmode, "autofp") == 0) {
377  }
378 
379  mode->RunModeFunc();
380 
381  if (local_custom_mode != NULL)
382  SCFree(local_custom_mode);
383 
384  /* Check if the alloted queues have at least 1 reader and writer */
386 
387  if (runmode != RUNMODE_UNIX_SOCKET) {
388  /* spawn management threads */
393  }
395  }
396 }
397 
398 static int g_runmode_needs_bypass = 0;
399 
401 {
402  g_runmode_needs_bypass = 1;
403 }
404 
406 {
407  return g_runmode_needs_bypass;
408 }
409 
410 
411 
412 /**
413  * \brief Registers a new runmode.
414  *
415  * \param runmode Runmode type.
416  * \param name Custom mode for this specific runmode type. Within each
417  * runmode type, each custom name is a primary key.
418  * \param description Description for this runmode.
419  * \param RunModeFunc The function to be run for this runmode.
420  */
421 void RunModeRegisterNewRunMode(int runmode, const char *name,
422  const char *description,
423  int (*RunModeFunc)(void))
424 {
425  void *ptmp;
426  if (RunModeGetCustomMode(runmode, name) != NULL) {
427  SCLogError(SC_ERR_RUNMODE, "A runmode by this custom name has already "
428  "been registered. Please use an unique name");
429  return;
430  }
431 
432  ptmp = SCRealloc(runmodes[runmode].runmodes,
433  (runmodes[runmode].no_of_runmodes + 1) * sizeof(RunMode));
434  if (ptmp == NULL) {
435  SCFree(runmodes[runmode].runmodes);
436  runmodes[runmode].runmodes = NULL;
437  exit(EXIT_FAILURE);
438  }
439  runmodes[runmode].runmodes = ptmp;
440 
441  RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].no_of_runmodes];
442  runmodes[runmode].no_of_runmodes++;
443 
444  mode->runmode = runmode;
445  mode->name = SCStrdup(name);
446  if (unlikely(mode->name == NULL)) {
447  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate string");
448  exit(EXIT_FAILURE);
449  }
450  mode->description = SCStrdup(description);
451  if (unlikely(mode->description == NULL)) {
452  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate string");
453  exit(EXIT_FAILURE);
454  }
455  mode->RunModeFunc = RunModeFunc;
456 
457  return;
458 }
459 
460 /**
461  * Setup the outputs for this run mode.
462  *
463  * \param tv The ThreadVars for the thread the outputs will be
464  * appended to.
465  */
466 static void RunOutputFreeList(void)
467 {
468  OutputFreeList *output;
469  while ((output = TAILQ_FIRST(&output_free_list))) {
470  SCLogDebug("output %s %p %p", output->output_module->name, output,
471  output->output_ctx);
472 
473  if (output->output_ctx != NULL && output->output_ctx->DeInit != NULL)
474  output->output_ctx->DeInit(output->output_ctx);
475 
476  TAILQ_REMOVE(&output_free_list, output, entries);
477  SCFree(output);
478  }
479 }
480 
481 static int file_logger_count = 0;
482 static int filedata_logger_count = 0;
483 static LoggerId logger_bits[ALPROTO_MAX];
484 
486 {
487  return file_logger_count > 0;
488 }
489 
491 {
492  return filedata_logger_count > 0;
493 }
494 
495 bool IsRunModeSystem(enum RunModes run_mode_to_check)
496 {
497  switch (run_mode_to_check) {
498  case RUNMODE_PCAP_FILE:
499  case RUNMODE_ERF_FILE:
501  return false;
502  break;
503  default:
504  return true;
505  }
506 }
507 
508 bool IsRunModeOffline(int run_mode_to_check)
509 {
510  switch(run_mode_to_check) {
511  case RUNMODE_CONF_TEST:
512  case RUNMODE_PCAP_FILE:
513  case RUNMODE_ERF_FILE:
515  case RUNMODE_UNIX_SOCKET:
516  return true;
517  break;
518  default:
519  return false;
520  }
521 }
522 
523 /**
524  * Cleanup the run mode.
525  */
526 void RunModeShutDown(void)
527 {
528  RunOutputFreeList();
529 
537 
538  /* Reset logger counts. */
539  file_logger_count = 0;
540  filedata_logger_count = 0;
541 }
542 
543 /** \internal
544  * \brief add Sub RunModeOutput to list for Submodule so we can free
545  * the output ctx at shutdown and unix socket reload */
546 static void AddOutputToFreeList(OutputModule *module, OutputCtx *output_ctx)
547 {
548  OutputFreeList *fl_output = SCCalloc(1, sizeof(OutputFreeList));
549  if (unlikely(fl_output == NULL))
550  return;
551  fl_output->output_module = module;
552  fl_output->output_ctx = output_ctx;
553  TAILQ_INSERT_TAIL(&output_free_list, fl_output, entries);
554 }
555 
556 /** \brief Turn output into thread module */
557 static void SetupOutput(const char *name, OutputModule *module, OutputCtx *output_ctx)
558 {
559  /* flow logger doesn't run in the packet path */
560  if (module->FlowLogFunc) {
561  OutputRegisterFlowLogger(module->name, module->FlowLogFunc,
562  output_ctx, module->ThreadInit, module->ThreadDeinit,
563  module->ThreadExitPrintStats);
564  return;
565  }
566  /* stats logger doesn't run in the packet path */
567  if (module->StatsLogFunc) {
569  output_ctx,module->ThreadInit, module->ThreadDeinit,
570  module->ThreadExitPrintStats);
571  return;
572  }
573 
574  if (module->logger_id == LOGGER_ALERT_DEBUG) {
575  debuglog_enabled = 1;
576  }
577 
578  if (module->PacketLogFunc) {
579  SCLogDebug("%s is a packet logger", module->name);
580  OutputRegisterPacketLogger(module->logger_id, module->name,
581  module->PacketLogFunc, module->PacketConditionFunc, output_ctx,
582  module->ThreadInit, module->ThreadDeinit,
583  module->ThreadExitPrintStats);
584  } else if (module->TxLogFunc) {
585  SCLogDebug("%s is a tx logger", module->name);
586  OutputRegisterTxLogger(module->logger_id, module->name, module->alproto,
587  module->TxLogFunc, output_ctx, module->tc_log_progress,
588  module->ts_log_progress, module->TxLogCondition,
589  module->ThreadInit, module->ThreadDeinit,
590  module->ThreadExitPrintStats);
591  /* Not used with wild card loggers */
592  if (module->alproto != ALPROTO_UNKNOWN) {
593  logger_bits[module->alproto] |= (1<<module->logger_id);
594  }
595  } else if (module->FiledataLogFunc) {
596  SCLogDebug("%s is a filedata logger", module->name);
598  module->FiledataLogFunc, output_ctx, module->ThreadInit,
599  module->ThreadDeinit, module->ThreadExitPrintStats);
600  filedata_logger_count++;
601  } else if (module->FileLogFunc) {
602  SCLogDebug("%s is a file logger", module->name);
603  OutputRegisterFileLogger(module->logger_id, module->name,
604  module->FileLogFunc, output_ctx, module->ThreadInit,
605  module->ThreadDeinit, module->ThreadExitPrintStats);
606  file_logger_count++;
607  } else if (module->StreamingLogFunc) {
608  SCLogDebug("%s is a streaming logger", module->name);
610  module->StreamingLogFunc, output_ctx, module->stream_type,
611  module->ThreadInit, module->ThreadDeinit,
612  module->ThreadExitPrintStats);
613  } else {
614  SCLogError(SC_ERR_INVALID_ARGUMENT, "Unknown logger type: name=%s",
615  module->name);
616  }
617 }
618 
619 static void RunModeInitializeEveOutput(ConfNode *conf, OutputCtx *parent_ctx)
620 {
621  ConfNode *types = ConfNodeLookupChild(conf, "types");
622  SCLogDebug("types %p", types);
623  if (types == NULL) {
624  return;
625  }
626 
627  ConfNode *type = NULL;
628  TAILQ_FOREACH(type, &types->head, next) {
629  SCLogConfig("enabling 'eve-log' module '%s'", type->val);
630 
631  int sub_count = 0;
632  char subname[256];
633  snprintf(subname, sizeof(subname), "eve-log.%s", type->val);
634 
635  ConfNode *sub_output_config = ConfNodeLookupChild(type, type->val);
636  if (sub_output_config != NULL) {
637  const char *enabled = ConfNodeLookupChildValue(
638  sub_output_config, "enabled");
639  if (enabled != NULL && !ConfValIsTrue(enabled)) {
640  continue;
641  }
642  }
643 
644  /* Now setup all registers logger of this name. */
645  OutputModule *sub_module;
646  TAILQ_FOREACH(sub_module, &output_modules, entries) {
647  if (strcmp(subname, sub_module->conf_name) == 0) {
648  sub_count++;
649 
650  if (sub_module->parent_name == NULL ||
651  strcmp(sub_module->parent_name, "eve-log") != 0) {
653  "bad parent for %s", subname);
654  }
655  if (sub_module->InitSubFunc == NULL) {
657  "bad sub-module for %s", subname);
658  }
659 
660  /* pass on parent output_ctx */
661  OutputInitResult result =
662  sub_module->InitSubFunc(sub_output_config, parent_ctx);
663  if (!result.ok || result.ctx == NULL) {
664  continue;
665  }
666 
667  AddOutputToFreeList(sub_module, result.ctx);
668  SetupOutput(sub_module->name, sub_module,
669  result.ctx);
670  }
671  }
672 
673  /* Error is no registered loggers with this name
674  * were found .*/
675  if (!sub_count) {
676 #ifndef HAVE_RUST
677  const char *rust_types[] = { "eve-log.smb", "eve-log.nfs",
678  "eve-log.dhcp", "eve-log.krb5", "eve-log.ikev2",
679  "eve-log.tftp", NULL, };
680  const char **iter = rust_types;
681  bool is_rust = false;
682  while (*iter) {
683  is_rust |= (strcmp(*iter, subname) == 0);
684  iter++;
685  }
686  if (is_rust) {
688  "module '%s' depends on Rust support", subname);
689  continue;
690  }
691 #endif
693  "No output module named %s", subname);
694  continue;
695  }
696  }
697 }
698 
699 static void RunModeInitializeLuaOutput(ConfNode *conf, OutputCtx *parent_ctx)
700 {
701  OutputModule *lua_module = OutputGetModuleByConfName("lua");
702  BUG_ON(lua_module == NULL);
703 
704  ConfNode *scripts = ConfNodeLookupChild(conf, "scripts");
705  BUG_ON(scripts == NULL); //TODO
706 
707  OutputModule *m;
708  TAILQ_FOREACH(m, &parent_ctx->submodules, entries) {
709  SCLogDebug("m %p %s:%s", m, m->name, m->conf_name);
710 
711  ConfNode *script = NULL;
712  TAILQ_FOREACH(script, &scripts->head, next) {
713  SCLogDebug("script %s", script->val);
714  if (strcmp(script->val, m->conf_name) == 0) {
715  break;
716  }
717  }
718  BUG_ON(script == NULL);
719 
720  /* pass on parent output_ctx */
721  OutputInitResult result = m->InitSubFunc(script, parent_ctx);
722  if (!result.ok || result.ctx == NULL) {
723  continue;
724  }
725 
726  AddOutputToFreeList(m, result.ctx);
727  SetupOutput(m->name, m, result.ctx);
728  }
729 }
730 
731 /**
732  * Initialize the output modules.
733  */
735 {
736  ConfNode *outputs = ConfGetNode("outputs");
737  if (outputs == NULL) {
738  /* No "outputs" section in the configuration. */
739  return;
740  }
741 
742  ConfNode *output, *output_config;
743  const char *enabled;
744  char tls_log_enabled = 0;
745  char tls_store_present = 0;
746 
747  memset(&logger_bits, 0, sizeof(logger_bits));
748 
749  TAILQ_FOREACH(output, &outputs->head, next) {
750 
751  output_config = ConfNodeLookupChild(output, output->val);
752  if (output_config == NULL) {
753  /* Shouldn't happen. */
755  "Failed to lookup configuration child node: %s", output->val);
756  }
757 
758  if (strcmp(output->val, "tls-store") == 0) {
759  tls_store_present = 1;
760  }
761 
762  enabled = ConfNodeLookupChildValue(output_config, "enabled");
763  if (enabled == NULL || !ConfValIsTrue(enabled)) {
764  continue;
765  }
766 
767  if (strcmp(output->val, "file-log") == 0) {
769  "file-log is no longer supported,"
770  " use eve.files instead "
771  "(see https://redmine.openinfosecfoundation.org/issues/2376"
772  " for an explanation)");
773  continue;
774  } else if (strncmp(output->val, "unified-", sizeof("unified-") - 1) == 0) {
776  "Unified1 is no longer supported,"
777  " use Unified2 instead "
778  "(see https://redmine.openinfosecfoundation.org/issues/353"
779  " for an explanation)");
780  continue;
781  } else if (strcmp(output->val, "alert-prelude") == 0) {
782 #ifndef PRELUDE
784  "Prelude support not compiled in. Reconfigure/"
785  "recompile with --enable-prelude to add Prelude "
786  "support.");
787  continue;
788 #endif
789  } else if (strcmp(output->val, "eve-log") == 0) {
790 #ifndef HAVE_LIBJANSSON
792  "Eve-log support not compiled in. Reconfigure/"
793  "recompile with libjansson and its development "
794  "files installed to add eve-log support.");
795  continue;
796 #endif
797  } else if (strcmp(output->val, "lua") == 0) {
798 #ifndef HAVE_LUA
800  "lua support not compiled in. Reconfigure/"
801  "recompile with lua(jit) and its development "
802  "files installed to add lua support.");
803  continue;
804 #endif
805  } else if (strcmp(output->val, "dns-log") == 0) {
807  "dns-log is not longer available as of Suricata 5.0");
808  continue;
809  } else if (strcmp(output->val, "tls-log") == 0) {
810  tls_log_enabled = 1;
811  }
812 
813  OutputModule *module;
814  int count = 0;
815  TAILQ_FOREACH(module, &output_modules, entries) {
816  if (strcmp(module->conf_name, output->val) != 0) {
817  continue;
818  }
819 
820  count++;
821 
822  OutputCtx *output_ctx = NULL;
823  if (module->InitFunc != NULL) {
824  OutputInitResult r = module->InitFunc(output_config);
825  if (!r.ok) {
827  "output module \"%s\": setup failed", output->val);
828  continue;
829  } else if (r.ctx == NULL) {
830  continue;
831  }
832  output_ctx = r.ctx;
833  } else if (module->InitSubFunc != NULL) {
834  SCLogInfo("skipping submodule");
835  continue;
836  }
837 
838  // TODO if module == parent, find it's children
839  if (strcmp(output->val, "eve-log") == 0) {
840  RunModeInitializeEveOutput(output_config, output_ctx);
841 
842  /* add 'eve-log' to free list as it's the owner of the
843  * main output ctx from which the sub-modules share the
844  * LogFileCtx */
845  AddOutputToFreeList(module, output_ctx);
846  } else if (strcmp(output->val, "lua") == 0) {
847  SCLogDebug("handle lua");
848  if (output_ctx == NULL)
849  continue;
850  RunModeInitializeLuaOutput(output_config, output_ctx);
851  AddOutputToFreeList(module, output_ctx);
852  } else {
853  AddOutputToFreeList(module, output_ctx);
854  SetupOutput(module->name, module, output_ctx);
855  }
856  }
857  if (count == 0) {
859  "No output module named %s", output->val);
860  continue;
861  }
862  }
863 
864  /* Backward compatibility code */
865  if (!tls_store_present && tls_log_enabled) {
866  /* old YAML with no "tls-store" in outputs. "tls-log" value needs
867  * to be started using 'tls-log' config as own config */
869  "Please use 'tls-store' in YAML to configure TLS storage");
870 
871  TAILQ_FOREACH(output, &outputs->head, next) {
872  output_config = ConfNodeLookupChild(output, output->val);
873 
874  if (strcmp(output->val, "tls-log") == 0) {
875 
876  OutputModule *module = OutputGetModuleByConfName("tls-store");
877  if (module == NULL) {
879  "No output module named %s, ignoring", "tls-store");
880  continue;
881  }
882 
883  OutputCtx *output_ctx = NULL;
884  if (module->InitFunc != NULL) {
885  OutputInitResult r = module->InitFunc(output_config);
886  if (!r.ok) {
888  "output module setup failed");
889  continue;
890  } else if (r.ctx == NULL) {
891  continue;
892  }
893  output_ctx = r.ctx;
894  }
895 
896  AddOutputToFreeList(module, output_ctx);
897  SetupOutput(module->name, module, output_ctx);
898  }
899  }
900  }
901 
902  /* register the logger bits to the app-layer */
903  int a;
904  for (a = 0; a < ALPROTO_MAX; a++) {
905  if (logger_bits[a] == 0)
906  continue;
907 
908  const int tcp = AppLayerParserProtocolHasLogger(IPPROTO_TCP, a);
909  const int udp = AppLayerParserProtocolHasLogger(IPPROTO_UDP, a);
910 
911  SCLogDebug("logger for %s: %s %s", AppProtoToString(a),
912  tcp ? "true" : "false", udp ? "true" : "false");
913 
914  SCLogDebug("logger bits for %s: %08x", AppProtoToString(a), logger_bits[a]);
915  if (tcp)
916  AppLayerParserRegisterLoggerBits(IPPROTO_TCP, a, logger_bits[a]);
917  if (udp)
918  AppLayerParserRegisterLoggerBits(IPPROTO_UDP, a, logger_bits[a]);
919 
920  }
921 }
922 
924 
925 /**
926  * Initialize multithreading settings.
927  */
929 {
931  if ((ConfGetBool("threading.set-cpu-affinity", &threading_set_cpu_affinity)) == 0) {
933  }
934  /* try to get custom cpu mask value if needed */
937  }
938  if ((ConfGetFloat("threading.detect-thread-ratio", &threading_detect_ratio)) != 1) {
939  if (ConfGetNode("threading.detect-thread-ratio") != NULL)
940  WarnInvalidConfEntry("threading.detect-thread-ratio", "%s", "1");
941  threading_detect_ratio = 1;
942  }
943 
944  SCLogDebug("threading.detect-thread-ratio %f", threading_detect_ratio);
945 }
StreamingLogger StreamingLogFunc
Definition: output.h:69
const char * thread_name_counter_wakeup
Definition: runmodes.c:71
void RunModeIpsIPFWRegister(void)
Definition: runmode-ipfw.c:51
const char * name
Definition: runmodes.c:79
int ts_log_progress
Definition: output.h:74
int OutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, OutputCtx *output_ctx, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, void(*ThreadExitPrintStats)(ThreadVars *, void *))
Definition: output-tx.c:67
#define SCLogDebug(...)
Definition: util-debug.h:335
int no_of_runmodes
Definition: runmodes.c:86
float threading_detect_ratio
Definition: runmodes.c:923
#define TAILQ_FIRST(head)
Definition: queue.h:339
void OutputFileShutdown(void)
Definition: output-file.c:277
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:350
struct HtpBodyChunk_ * next
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
void RunModeInitialize(void)
Definition: runmodes.c:928
const char * RunModeErfFileGetDefaultMode(void)
#define BUG_ON(x)
void RunModeRegisterNewRunMode(int runmode, const char *name, const char *description, int(*RunModeFunc)(void))
Registers a new runmode.
Definition: runmodes.c:421
int OutputRegisterFiledataLogger(LoggerId id, const char *name, FiledataLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
#define FALSE
LoggerId
OutputInitFunc InitFunc
Definition: output.h:55
int RunModeOutputFileEnabled(void)
Definition: runmodes.c:485
const char * RunModeNetmapGetDefaultMode(void)
struct RunMode_ RunMode
Holds description for a runmode.
#define unlikely(expr)
Definition: util-optimize.h:35
void RunModeIdsPfringRegister(void)
ThreadDeinitFunc ThreadDeinit
Definition: output.h:59
PacketLogger PacketLogFunc
Definition: output.h:62
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:517
const char * description
Definition: runmodes.c:80
const char * thread_name_flow_bypass
Definition: runmodes.c:67
const char * thread_name_single
Definition: runmodes.c:62
int tc_log_progress
Definition: output.h:73
OutputInitSubFunc InitSubFunc
Definition: output.h:56
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
const char * RunModeIpsWinDivertGetDefaultMode(void)
char * val
Definition: conf.h:34
const char * thread_name_counter_stats
Definition: runmodes.c:70
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:815
#define TRUE
void RunModeInitializeOutputs(void)
Definition: runmodes.c:734
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:331
void RunModeIpsWinDivertRegister(void)
char * RunmodeGetActive(void)
Definition: runmodes.c:189
LoggerId logger_id
Definition: output.h:51
#define FatalErrorOnInit(x,...)
Fatal error IF we&#39;re starting up, and configured to consider errors to be fatal errors.
Definition: util-debug.h:547
ThreadInitFunc ThreadInit
Definition: output.h:58
Holds description for a runmode.
Definition: runmodes.c:76
void OutputFiledataShutdown(void)
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
Definition: output.c:821
const char * RunModeNapatechGetDefaultMode(void)
void RunModeIdsPcapRegister(void)
Definition: runmode-pcap.c:44
TxLoggerCondition TxLogCondition
Definition: output.h:65
int(* RunModeFunc)(void)
Definition: runmodes.c:82
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
#define SCCalloc(nm, a)
Definition: util-mem.h:197
RunModes
Definition: runmodes.h:27
const char * RunModeFilePcapGetDefaultMode(void)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:843
const char * RunModeIpsNFQGetDefaultMode(void)
Definition: runmode-nfq.c:44
TxLogger TxLogFunc
Definition: output.h:64
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
void RunModeFilePcapRegister(void)
int OutputRegisterStreamingLogger(LoggerId id, const char *name, StreamingLogger LogFunc, OutputCtx *output_ctx, enum OutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
void RunModeDispatch(int runmode, const char *custom_mode)
Definition: runmodes.c:280
uint8_t type
const char * RunModeIdsGetDefaultMode(void)
Definition: runmode-pcap.c:37
AppProto alproto
Definition: output.h:71
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
const char * RunModeAFPGetDefaultMode(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
Definition: runmodes.c:211
const char * name
Definition: output.h:52
enum OutputStreamingType stream_type
Definition: output.h:72
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:412
const char * RunModeIdsNflogGetDefaultMode(void)
Definition: runmode-nflog.c:39
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
Definition: counters.c:877
void OutputPacketShutdown(void)
OutputCtx * output_ctx
Definition: runmodes.c:97
const char * RunModeUnixSocketGetDefaultMode(void)
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
Definition: tm-queues.c:95
void RunModeUnixSocketRegister(void)
void TmqhFlowPrintAutofpHandler(void)
Definition: tmqh-flow.c:82
const char * thread_name_detect_loader
Definition: runmodes.c:69
struct RunModes_ RunModes
RunMode * runmodes
Definition: runmodes.c:87
const char * RunModeIpsIPFWGetDefaultMode(void)
Definition: runmode-ipfw.c:46
FlowLogger FlowLogFunc
Definition: output.h:68
void AffinitySetupLoadFromConfig()
Extract cpu affinity configuration from current config file.
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
#define SCRealloc(x, a)
Definition: util-mem.h:182
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:566
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:385
void OutputTxShutdown(void)
Definition: output-tx.c:379
void RunModeErfDagRegister(void)
void BypassedFlowManagerThreadSpawn()
spawn the flow bypass manager thread
Definition: flow-bypass.c:176
void RunModeShutDown(void)
Definition: runmodes.c:526
ThreadExitPrintStatsFunc ThreadExitPrintStats
Definition: output.h:60
Definition: conf.h:32
OutputCtx * ctx
Definition: output.h:42
FiledataLogger FiledataLogFunc
Definition: output.h:67
int runmode
Definition: runmodes.c:78
void RunModeListRunmodes(void)
Lists all registered runmodes.
Definition: runmodes.c:237
int RunModeOutputFiledataEnabled(void)
Definition: runmodes.c:490
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
void RunModeIdsNflogRegister(void)
Definition: runmode-nflog.c:44
#define SCFree(a)
Definition: util-mem.h:228
const char * thread_name_verdict
Definition: runmodes.c:64
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-stats.c:57
int RunModeNeedsBypassManager(void)
Definition: runmodes.c:405
void OutputStatsShutdown(void)
Definition: output-stats.c:213
int debuglog_enabled
Definition: runmodes.c:58
#define TAILQ_ENTRY(type)
Definition: queue.h:330
const char * parent_name
Definition: output.h:54
void RunModeIdsNetmapRegister(void)
const char * RunModeGetMainMode(void)
Definition: runmodes.c:201
const char * RunModeErfDagGetDefaultMode(void)
const char * thread_name_autofp
Definition: runmodes.c:61
OutputModuleList output_modules
bool IsRunModeOffline(int run_mode_to_check)
Definition: runmodes.c:508
void RunModeIpsNFQRegister(void)
Definition: runmode-nfq.c:49
void RunModeNapatechRegister(void)
void UtRunModeRegister(void)
#define FatalError(x,...)
Definition: util-debug.h:539
int RunmodeGetCurrent(void)
Definition: suricata.c:269
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
Definition: util-misc.h:37
FileLogger FileLogFunc
Definition: output.h:66
SCMutex m
Definition: flow-hash.h:105
const char * RunModeIdsPfringGetDefaultMode(void)
void FlowManagerThreadSpawn()
spawn the flow manager thread
Definition: flow-manager.c:868
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
int ConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
Definition: conf.c:645
bool IsRunModeSystem(enum RunModes run_mode_to_check)
Definition: runmodes.c:495
const char * conf_name
Definition: output.h:53
int OutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-flow.c:58
#define SCStrdup(a)
Definition: util-mem.h:212
void RunModeIdsAFPRegister(void)
void OutputFlowShutdown(void)
Definition: output-flow.c:208
int OutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-packet.c:61
StatsLogger StatsLogFunc
Definition: output.h:70
void RunModeEnablesBypassManager(void)
Definition: runmodes.c:400
void FlowRecyclerThreadSpawn()
spawn the flow recycler thread
PacketLogCondition PacketConditionFunc
Definition: output.h:63
void RunModeErfFileRegister(void)
#define TAILQ_HEAD_INITIALIZER(head)
Definition: queue.h:327
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
const char * thread_name_unix_socket
Definition: runmodes.c:68
int threading_set_cpu_affinity
Definition: runmodes.h:112
OutputModule * output_module
Definition: runmodes.c:96
int OutputRegisterFileLogger(LoggerId id, const char *name, FileLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-file.c:63
const char * thread_name_flow_mgr
Definition: runmodes.c:65
const char * thread_name_flow_rec
Definition: runmodes.c:66
void OutputStreamingShutdown(void)
const char * thread_name_workers
Definition: runmodes.c:63