suricata
runmodes.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /** \file
19  *
20  * \author Victor Julien <victor@inliniac.net>
21  *
22  * Pre-cooked threading runmodes.
23  */
24 
25 #include "suricata-common.h"
26 #include "detect.h"
27 #include "detect-engine.h"
28 #include "detect-engine-mpm.h"
29 #include "app-layer-parser.h"
30 #include "tm-threads.h"
31 #include "util-debug.h"
32 #include "util-time.h"
33 #include "util-cpu.h"
34 #include "util-byte.h"
35 #include "util-affinity.h"
36 #include "conf.h"
37 #include "queue.h"
38 #include "runmodes.h"
39 #include "util-unittest.h"
40 #include "util-misc.h"
41 
42 #include "output.h"
43 
44 #include "alert-fastlog.h"
45 #include "alert-prelude.h"
46 #include "alert-unified2-alert.h"
47 #include "alert-debuglog.h"
48 
49 #include "log-httplog.h"
50 
51 #include "source-pfring.h"
52 
53 #include "tmqh-flow.h"
54 #include "flow-manager.h"
55 #include "flow-bypass.h"
56 #include "counters.h"
57 
59 
60 /* Runmode Global Thread Names */
61 const char *thread_name_autofp = "RX";
62 const char *thread_name_single = "W";
63 const char *thread_name_workers = "W";
64 const char *thread_name_verdict = "TX";
65 const char *thread_name_flow_mgr = "FM";
66 const char *thread_name_flow_rec = "FR";
67 const char *thread_name_unix_socket = "US";
68 const char *thread_name_detect_loader = "DL";
69 const char *thread_name_counter_stats = "CS";
70 const char *thread_name_counter_wakeup = "CW";
71 
72 /**
73  * \brief Holds description for a runmode.
74  */
75 typedef struct RunMode_ {
76  /* the runmode type */
77  int runmode;
78  const char *name;
79  const char *description;
80  /* runmode function */
81  int (*RunModeFunc)(void);
82 } RunMode;
83 
84 typedef struct RunModes_ {
87 } RunModes;
88 
89 static RunModes runmodes[RUNMODE_USER_MAX];
90 
91 static char *active_runmode;
92 
93 /* free list for our outputs */
94 typedef struct OutputFreeList_ {
97 
100 static TAILQ_HEAD(, OutputFreeList_) output_free_list =
101  TAILQ_HEAD_INITIALIZER(output_free_list);
102 
103 /**
104  * \internal
105  * \brief Translate a runmode mode to a printale string.
106  *
107  * \param runmode Runmode to be converted into a printable string.
108  *
109  * \retval string Printable string.
110  */
111 static const char *RunModeTranslateModeToName(int runmode)
112 {
113  switch (runmode) {
114  case RUNMODE_PCAP_DEV:
115  return "PCAP_DEV";
116  case RUNMODE_PCAP_FILE:
117  return "PCAP_FILE";
118  case RUNMODE_PFRING:
119 #ifdef HAVE_PFRING
120  return "PFRING";
121 #else
122  return "PFRING(DISABLED)";
123 #endif
124  case RUNMODE_NFQ:
125  return "NFQ";
126  case RUNMODE_NFLOG:
127  return "NFLOG";
128  case RUNMODE_IPFW:
129  return "IPFW";
130  case RUNMODE_ERF_FILE:
131  return "ERF_FILE";
132  case RUNMODE_DAG:
133  return "ERF_DAG";
134  case RUNMODE_NAPATECH:
135  return "NAPATECH";
136  case RUNMODE_UNITTEST:
137  return "UNITTEST";
139  return "MPIPE";
140  case RUNMODE_AFP_DEV:
141  return "AF_PACKET_DEV";
142  case RUNMODE_NETMAP:
143 #ifdef HAVE_NETMAP
144  return "NETMAP";
145 #else
146  return "NETMAP(DISABLED)";
147 #endif
148  case RUNMODE_UNIX_SOCKET:
149  return "UNIX_SOCKET";
150  case RUNMODE_WINDIVERT:
151 #ifdef WINDIVERT
152  return "WINDIVERT";
153 #else
154  return "WINDIVERT(DISABLED)";
155 #endif
156  default:
157  SCLogError(SC_ERR_UNKNOWN_RUN_MODE, "Unknown runtime mode. Aborting");
158  exit(EXIT_FAILURE);
159  }
160 }
161 
162 /**
163  * \internal
164  * \brief Dispatcher function for runmodes. Calls the required runmode function
165  * based on runmode + runmode_custom_id.
166  *
167  * \param runmode The runmode type.
168  * \param runmode_customd_id The runmode custom id.
169  */
170 static RunMode *RunModeGetCustomMode(int runmode, const char *custom_mode)
171 {
172  int i;
173 
174  for (i = 0; i < runmodes[runmode].no_of_runmodes; i++) {
175  if (strcmp(runmodes[runmode].runmodes[i].name, custom_mode) == 0)
176  return &runmodes[runmode].runmodes[i];
177  }
178 
179  return NULL;
180 }
181 
182 
183 /**
184  * Return the running mode
185  *
186  * The returned string must not be freed.
187  *
188  * \return a string containing the current running mode
189  */
190 char *RunmodeGetActive(void)
191 {
192  return active_runmode;
193 }
194 
195 /**
196  * Return the running mode
197  *
198  * The returned string must not be freed.
199  *
200  * \return a string containing the current running mode
201  */
202 const char *RunModeGetMainMode(void)
203 {
204  int mainmode = RunmodeGetCurrent();
205 
206  return RunModeTranslateModeToName(mainmode);
207 }
208 
209 /**
210  * \brief Register all runmodes in the engine.
211  */
213 {
214  memset(runmodes, 0, sizeof(runmodes));
215 
230 #ifdef UNITTESTS
232 #endif
233  return;
234 }
235 
236 /**
237  * \brief Lists all registered runmodes.
238  */
240 {
241  printf("------------------------------------- Runmodes -------------------"
242  "-----------------------\n");
243 
244  printf("| %-17s | %-17s | %-10s \n",
245  "RunMode Type", "Custom Mode ", "Description");
246  printf("|-----------------------------------------------------------------"
247  "-----------------------\n");
248  int i = RUNMODE_UNKNOWN + 1;
249  int j = 0;
250  for ( ; i < RUNMODE_USER_MAX; i++) {
251  int mode_displayed = 0;
252  for (j = 0; j < runmodes[i].no_of_runmodes; j++) {
253  if (mode_displayed == 1) {
254  printf("| ----------------------------------------------"
255  "-----------------------\n");
256  RunMode *runmode = &runmodes[i].runmodes[j];
257  printf("| %-17s | %-17s | %-27s \n",
258  "",
259  runmode->name,
260  runmode->description);
261  } else {
262  RunMode *runmode = &runmodes[i].runmodes[j];
263  printf("| %-17s | %-17s | %-27s \n",
264  RunModeTranslateModeToName(runmode->runmode),
265  runmode->name,
266  runmode->description);
267  }
268  if (mode_displayed == 0)
269  mode_displayed = 1;
270  }
271  if (mode_displayed == 1) {
272  printf("|-----------------------------------------------------------------"
273  "-----------------------\n");
274  }
275  }
276 
277  return;
278 }
279 
280 /**
281  */
282 void RunModeDispatch(int runmode, const char *custom_mode)
283 {
284  char *local_custom_mode = NULL;
285 
286  if (custom_mode == NULL) {
287  const char *val = NULL;
288  if (ConfGet("runmode", &val) != 1) {
289  custom_mode = NULL;
290  } else {
291  custom_mode = val;
292  }
293  }
294 
295  if (custom_mode == NULL || strcmp(custom_mode, "auto") == 0) {
296  switch (runmode) {
297  case RUNMODE_PCAP_DEV:
298  custom_mode = RunModeIdsGetDefaultMode();
299  break;
300  case RUNMODE_PCAP_FILE:
301  custom_mode = RunModeFilePcapGetDefaultMode();
302  break;
303 #ifdef HAVE_PFRING
304  case RUNMODE_PFRING:
305  custom_mode = RunModeIdsPfringGetDefaultMode();
306  break;
307 #endif
308  case RUNMODE_NFQ:
309  custom_mode = RunModeIpsNFQGetDefaultMode();
310  break;
311  case RUNMODE_IPFW:
312  custom_mode = RunModeIpsIPFWGetDefaultMode();
313  break;
314  case RUNMODE_ERF_FILE:
315  custom_mode = RunModeErfFileGetDefaultMode();
316  break;
317  case RUNMODE_DAG:
318  custom_mode = RunModeErfDagGetDefaultMode();
319  break;
321  custom_mode = RunModeTileMpipeGetDefaultMode();
322  break;
323  case RUNMODE_NAPATECH:
324  custom_mode = RunModeNapatechGetDefaultMode();
325  break;
326  case RUNMODE_AFP_DEV:
327  custom_mode = RunModeAFPGetDefaultMode();
328  break;
329  case RUNMODE_NETMAP:
330  custom_mode = RunModeNetmapGetDefaultMode();
331  break;
332  case RUNMODE_UNIX_SOCKET:
333  custom_mode = RunModeUnixSocketGetDefaultMode();
334  break;
335  case RUNMODE_NFLOG:
336  custom_mode = RunModeIdsNflogGetDefaultMode();
337  break;
338 #ifdef WINDIVERT
339  case RUNMODE_WINDIVERT:
340  custom_mode = RunModeIpsWinDivertGetDefaultMode();
341  break;
342 #endif
343  default:
344  SCLogError(SC_ERR_UNKNOWN_RUN_MODE, "Unknown runtime mode. Aborting");
345  exit(EXIT_FAILURE);
346  }
347  } else { /* if (custom_mode == NULL) */
348  /* Add compability with old 'worker' name */
349  if (!strcmp("worker", custom_mode)) {
350  SCLogWarning(SC_ERR_RUNMODE, "'worker' mode have been renamed "
351  "to 'workers', please modify your setup.");
352  local_custom_mode = SCStrdup("workers");
353  if (unlikely(local_custom_mode == NULL)) {
354  SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup custom mode");
355  exit(EXIT_FAILURE);
356  }
357  custom_mode = local_custom_mode;
358  }
359  }
360 
361  RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
362  if (mode == NULL) {
363  SCLogError(SC_ERR_RUNMODE, "The custom type \"%s\" doesn't exist "
364  "for this runmode type \"%s\". Please use --list-runmodes to "
365  "see available custom types for this runmode",
366  custom_mode, RunModeTranslateModeToName(runmode));
367  exit(EXIT_FAILURE);
368  }
369 
370  /* Export the custom mode */
371  if (active_runmode) {
372  SCFree(active_runmode);
373  }
374  active_runmode = SCStrdup(custom_mode);
375  if (unlikely(active_runmode == NULL)) {
376  SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup active mode");
377  exit(EXIT_FAILURE);
378  }
379 
380  if (strcasecmp(active_runmode, "autofp") == 0) {
382  }
383 
384  mode->RunModeFunc();
385 
386  if (local_custom_mode != NULL)
387  SCFree(local_custom_mode);
388 
389  /* Check if the alloted queues have at least 1 reader and writer */
391 
392  if (runmode != RUNMODE_UNIX_SOCKET) {
393  /* spawn management threads */
398  }
400  }
401 }
402 
403 static int g_runmode_needs_bypass = 0;
404 
406 {
407  g_runmode_needs_bypass = 1;
408 }
409 
411 {
412  return g_runmode_needs_bypass;
413 }
414 
415 
416 
417 /**
418  * \brief Registers a new runmode.
419  *
420  * \param runmode Runmode type.
421  * \param name Custom mode for this specific runmode type. Within each
422  * runmode type, each custom name is a primary key.
423  * \param description Description for this runmode.
424  * \param RunModeFunc The function to be run for this runmode.
425  */
426 void RunModeRegisterNewRunMode(int runmode, const char *name,
427  const char *description,
428  int (*RunModeFunc)(void))
429 {
430  void *ptmp;
431  if (RunModeGetCustomMode(runmode, name) != NULL) {
432  SCLogError(SC_ERR_RUNMODE, "A runmode by this custom name has already "
433  "been registered. Please use an unique name");
434  return;
435  }
436 
437  ptmp = SCRealloc(runmodes[runmode].runmodes,
438  (runmodes[runmode].no_of_runmodes + 1) * sizeof(RunMode));
439  if (ptmp == NULL) {
440  SCFree(runmodes[runmode].runmodes);
441  runmodes[runmode].runmodes = NULL;
442  exit(EXIT_FAILURE);
443  }
444  runmodes[runmode].runmodes = ptmp;
445 
446  RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].no_of_runmodes];
447  runmodes[runmode].no_of_runmodes++;
448 
449  mode->runmode = runmode;
450  mode->name = SCStrdup(name);
451  if (unlikely(mode->name == NULL)) {
452  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate string");
453  exit(EXIT_FAILURE);
454  }
455  mode->description = SCStrdup(description);
456  if (unlikely(mode->description == NULL)) {
457  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate string");
458  exit(EXIT_FAILURE);
459  }
460  mode->RunModeFunc = RunModeFunc;
461 
462  return;
463 }
464 
465 /**
466  * Setup the outputs for this run mode.
467  *
468  * \param tv The ThreadVars for the thread the outputs will be
469  * appended to.
470  */
471 static void RunOutputFreeList(void)
472 {
473  OutputFreeList *output;
474  while ((output = TAILQ_FIRST(&output_free_list))) {
475  SCLogDebug("output %s %p %p", output->output_module->name, output,
476  output->output_ctx);
477 
478  if (output->output_ctx != NULL && output->output_ctx->DeInit != NULL)
479  output->output_ctx->DeInit(output->output_ctx);
480 
481  TAILQ_REMOVE(&output_free_list, output, entries);
482  SCFree(output);
483  }
484 }
485 
486 static int file_logger_count = 0;
487 static int filedata_logger_count = 0;
488 static LoggerId logger_bits[ALPROTO_MAX];
489 
491 {
492  return file_logger_count > 0;
493 }
494 
496 {
497  return filedata_logger_count > 0;
498 }
499 
500 bool IsRunModeOffline(int run_mode_to_check)
501 {
502  switch(run_mode_to_check) {
503  case RUNMODE_CONF_TEST:
504  case RUNMODE_PCAP_FILE:
505  case RUNMODE_ERF_FILE:
507  case RUNMODE_UNIX_SOCKET:
508  return true;
509  break;
510  default:
511  return false;
512  }
513 }
514 
515 /**
516  * Cleanup the run mode.
517  */
518 void RunModeShutDown(void)
519 {
520  RunOutputFreeList();
521 
529 
530  /* Reset logger counts. */
531  file_logger_count = 0;
532  filedata_logger_count = 0;
533 }
534 
535 /** \internal
536  * \brief add Sub RunModeOutput to list for Submodule so we can free
537  * the output ctx at shutdown and unix socket reload */
538 static void AddOutputToFreeList(OutputModule *module, OutputCtx *output_ctx)
539 {
540  OutputFreeList *fl_output = SCCalloc(1, sizeof(OutputFreeList));
541  if (unlikely(fl_output == NULL))
542  return;
543  fl_output->output_module = module;
544  fl_output->output_ctx = output_ctx;
545  TAILQ_INSERT_TAIL(&output_free_list, fl_output, entries);
546 }
547 
548 /** \brief Turn output into thread module */
549 static void SetupOutput(const char *name, OutputModule *module, OutputCtx *output_ctx)
550 {
551  /* flow logger doesn't run in the packet path */
552  if (module->FlowLogFunc) {
553  OutputRegisterFlowLogger(module->name, module->FlowLogFunc,
554  output_ctx, module->ThreadInit, module->ThreadDeinit,
555  module->ThreadExitPrintStats);
556  return;
557  }
558  /* stats logger doesn't run in the packet path */
559  if (module->StatsLogFunc) {
561  output_ctx,module->ThreadInit, module->ThreadDeinit,
562  module->ThreadExitPrintStats);
563  return;
564  }
565 
566  if (module->logger_id == LOGGER_ALERT_DEBUG) {
567  debuglog_enabled = 1;
568  }
569 
570  if (module->PacketLogFunc) {
571  SCLogDebug("%s is a packet logger", module->name);
572  OutputRegisterPacketLogger(module->logger_id, module->name,
573  module->PacketLogFunc, module->PacketConditionFunc, output_ctx,
574  module->ThreadInit, module->ThreadDeinit,
575  module->ThreadExitPrintStats);
576  } else if (module->TxLogFunc) {
577  SCLogDebug("%s is a tx logger", module->name);
578  OutputRegisterTxLogger(module->logger_id, module->name, module->alproto,
579  module->TxLogFunc, output_ctx, module->tc_log_progress,
580  module->ts_log_progress, module->TxLogCondition,
581  module->ThreadInit, module->ThreadDeinit,
582  module->ThreadExitPrintStats);
583  logger_bits[module->alproto] |= (1<<module->logger_id);
584  } else if (module->FiledataLogFunc) {
585  SCLogDebug("%s is a filedata logger", module->name);
587  module->FiledataLogFunc, output_ctx, module->ThreadInit,
588  module->ThreadDeinit, module->ThreadExitPrintStats);
589  filedata_logger_count++;
590  } else if (module->FileLogFunc) {
591  SCLogDebug("%s is a file logger", module->name);
592  OutputRegisterFileLogger(module->logger_id, module->name,
593  module->FileLogFunc, output_ctx, module->ThreadInit,
594  module->ThreadDeinit, module->ThreadExitPrintStats);
595  file_logger_count++;
596  } else if (module->StreamingLogFunc) {
597  SCLogDebug("%s is a streaming logger", module->name);
599  module->StreamingLogFunc, output_ctx, module->stream_type,
600  module->ThreadInit, module->ThreadDeinit,
601  module->ThreadExitPrintStats);
602  } else {
603  SCLogError(SC_ERR_INVALID_ARGUMENT, "Unknown logger type: name=%s",
604  module->name);
605  }
606 }
607 
608 static void RunModeInitializeEveOutput(ConfNode *conf, OutputCtx *parent_ctx)
609 {
610  ConfNode *types = ConfNodeLookupChild(conf, "types");
611  SCLogDebug("types %p", types);
612  if (types == NULL) {
613  return;
614  }
615 
616  ConfNode *type = NULL;
617  TAILQ_FOREACH(type, &types->head, next) {
618  SCLogConfig("enabling 'eve-log' module '%s'", type->val);
619 
620  int sub_count = 0;
621  char subname[256];
622  snprintf(subname, sizeof(subname), "eve-log.%s", type->val);
623 
624  ConfNode *sub_output_config = ConfNodeLookupChild(type, type->val);
625  if (sub_output_config != NULL) {
626  const char *enabled = ConfNodeLookupChildValue(
627  sub_output_config, "enabled");
628  if (enabled != NULL && !ConfValIsTrue(enabled)) {
629  continue;
630  }
631  }
632 
633  /* Now setup all registers logger of this name. */
634  OutputModule *sub_module;
635  TAILQ_FOREACH(sub_module, &output_modules, entries) {
636  if (strcmp(subname, sub_module->conf_name) == 0) {
637  sub_count++;
638 
639  if (sub_module->parent_name == NULL ||
640  strcmp(sub_module->parent_name, "eve-log") != 0) {
642  "bad parent for %s", subname);
643  }
644  if (sub_module->InitSubFunc == NULL) {
646  "bad sub-module for %s", subname);
647  }
648 
649  /* pass on parent output_ctx */
650  OutputInitResult result =
651  sub_module->InitSubFunc(sub_output_config, parent_ctx);
652  if (!result.ok || result.ctx == NULL) {
653  continue;
654  }
655 
656  AddOutputToFreeList(sub_module, result.ctx);
657  SetupOutput(sub_module->name, sub_module,
658  result.ctx);
659  }
660  }
661 
662  /* Error is no registered loggers with this name
663  * were found .*/
664  if (!sub_count) {
665 #ifndef HAVE_RUST
666  const char *rust_types[] = { "eve-log.smb", "eve-log.nfs",
667  "eve-log.dhcp", "eve-log.krb5", "eve-log.ikev2",
668  "eve-log.tftp", NULL, };
669  const char **iter = rust_types;
670  bool is_rust = false;
671  while (*iter) {
672  is_rust |= (strcmp(*iter, subname) == 0);
673  iter++;
674  }
675  if (is_rust) {
677  "module '%s' depends on Rust support", subname);
678  continue;
679  }
680 #endif
682  "No output module named %s", subname);
683  continue;
684  }
685  }
686 }
687 
688 static void RunModeInitializeLuaOutput(ConfNode *conf, OutputCtx *parent_ctx)
689 {
690  OutputModule *lua_module = OutputGetModuleByConfName("lua");
691  BUG_ON(lua_module == NULL);
692 
693  ConfNode *scripts = ConfNodeLookupChild(conf, "scripts");
694  BUG_ON(scripts == NULL); //TODO
695 
696  OutputModule *m;
697  TAILQ_FOREACH(m, &parent_ctx->submodules, entries) {
698  SCLogDebug("m %p %s:%s", m, m->name, m->conf_name);
699 
700  ConfNode *script = NULL;
701  TAILQ_FOREACH(script, &scripts->head, next) {
702  SCLogDebug("script %s", script->val);
703  if (strcmp(script->val, m->conf_name) == 0) {
704  break;
705  }
706  }
707  BUG_ON(script == NULL);
708 
709  /* pass on parent output_ctx */
710  OutputInitResult result = m->InitSubFunc(script, parent_ctx);
711  if (!result.ok || result.ctx == NULL) {
712  continue;
713  }
714 
715  AddOutputToFreeList(m, result.ctx);
716  SetupOutput(m->name, m, result.ctx);
717  }
718 }
719 
720 /**
721  * Initialize the output modules.
722  */
724 {
725  ConfNode *outputs = ConfGetNode("outputs");
726  if (outputs == NULL) {
727  /* No "outputs" section in the configuration. */
728  return;
729  }
730 
731  ConfNode *output, *output_config;
732  const char *enabled;
733  char tls_log_enabled = 0;
734  char tls_store_present = 0;
735 
736  memset(&logger_bits, 0, sizeof(logger_bits));
737 
738  TAILQ_FOREACH(output, &outputs->head, next) {
739 
740  output_config = ConfNodeLookupChild(output, output->val);
741  if (output_config == NULL) {
742  /* Shouldn't happen. */
744  "Failed to lookup configuration child node: %s", output->val);
745  }
746 
747  if (strcmp(output->val, "tls-store") == 0) {
748  tls_store_present = 1;
749  }
750 
751  enabled = ConfNodeLookupChildValue(output_config, "enabled");
752  if (enabled == NULL || !ConfValIsTrue(enabled)) {
753  continue;
754  }
755 
756  if (strncmp(output->val, "unified-", sizeof("unified-") - 1) == 0) {
758  "Unified1 is no longer supported,"
759  " use Unified2 instead "
760  "(see https://redmine.openinfosecfoundation.org/issues/353"
761  " for an explanation)");
762  continue;
763  } else if (strcmp(output->val, "alert-prelude") == 0) {
764 #ifndef PRELUDE
766  "Prelude support not compiled in. Reconfigure/"
767  "recompile with --enable-prelude to add Prelude "
768  "support.");
769  continue;
770 #endif
771  } else if (strcmp(output->val, "eve-log") == 0) {
772 #ifndef HAVE_LIBJANSSON
774  "Eve-log support not compiled in. Reconfigure/"
775  "recompile with libjansson and its development "
776  "files installed to add eve-log support.");
777  continue;
778 #endif
779  } else if (strcmp(output->val, "lua") == 0) {
780 #ifndef HAVE_LUA
782  "lua support not compiled in. Reconfigure/"
783  "recompile with lua(jit) and its development "
784  "files installed to add lua support.");
785  continue;
786 #endif
787  } else if (strcmp(output->val, "dns-log") == 0) {
788 #ifdef HAVE_RUST
790  "dns-log is not available when Rust is enabled.");
791  continue;
792 #endif
793  } else if (strcmp(output->val, "tls-log") == 0) {
794  tls_log_enabled = 1;
795  }
796 
797  OutputModule *module;
798  int count = 0;
799  TAILQ_FOREACH(module, &output_modules, entries) {
800  if (strcmp(module->conf_name, output->val) != 0) {
801  continue;
802  }
803 
804  count++;
805 
806  OutputCtx *output_ctx = NULL;
807  if (module->InitFunc != NULL) {
808  OutputInitResult r = module->InitFunc(output_config);
809  if (!r.ok) {
811  "output module setup failed");
812  continue;
813  } else if (r.ctx == NULL) {
814  continue;
815  }
816  output_ctx = r.ctx;
817  } else if (module->InitSubFunc != NULL) {
818  SCLogInfo("skipping submodule");
819  continue;
820  }
821 
822  // TODO if module == parent, find it's children
823  if (strcmp(output->val, "eve-log") == 0) {
824  RunModeInitializeEveOutput(output_config, output_ctx);
825 
826  /* add 'eve-log' to free list as it's the owner of the
827  * main output ctx from which the sub-modules share the
828  * LogFileCtx */
829  AddOutputToFreeList(module, output_ctx);
830  } else if (strcmp(output->val, "lua") == 0) {
831  SCLogDebug("handle lua");
832  if (output_ctx == NULL)
833  continue;
834  RunModeInitializeLuaOutput(output_config, output_ctx);
835  AddOutputToFreeList(module, output_ctx);
836  } else {
837  AddOutputToFreeList(module, output_ctx);
838  SetupOutput(module->name, module, output_ctx);
839  }
840  }
841  if (count == 0) {
843  "No output module named %s", output->val);
844  continue;
845  }
846  }
847 
848  /* Backward compatibility code */
849  if (!tls_store_present && tls_log_enabled) {
850  /* old YAML with no "tls-store" in outputs. "tls-log" value needs
851  * to be started using 'tls-log' config as own config */
853  "Please use 'tls-store' in YAML to configure TLS storage");
854 
855  TAILQ_FOREACH(output, &outputs->head, next) {
856  output_config = ConfNodeLookupChild(output, output->val);
857 
858  if (strcmp(output->val, "tls-log") == 0) {
859 
860  OutputModule *module = OutputGetModuleByConfName("tls-store");
861  if (module == NULL) {
863  "No output module named %s, ignoring", "tls-store");
864  continue;
865  }
866 
867  OutputCtx *output_ctx = NULL;
868  if (module->InitFunc != NULL) {
869  OutputInitResult r = module->InitFunc(output_config);
870  if (!r.ok) {
872  "output module setup failed");
873  continue;
874  } else if (r.ctx == NULL) {
875  continue;
876  }
877  output_ctx = r.ctx;
878  }
879 
880  AddOutputToFreeList(module, output_ctx);
881  SetupOutput(module->name, module, output_ctx);
882  }
883  }
884  }
885 
886  /* register the logger bits to the app-layer */
887  int a;
888  for (a = 0; a < ALPROTO_MAX; a++) {
889  if (logger_bits[a] == 0)
890  continue;
891 
892  const int tcp = AppLayerParserProtocolHasLogger(IPPROTO_TCP, a);
893  const int udp = AppLayerParserProtocolHasLogger(IPPROTO_UDP, a);
894 
895  SCLogDebug("logger for %s: %s %s", AppProtoToString(a),
896  tcp ? "true" : "false", udp ? "true" : "false");
897 
898  SCLogDebug("logger bits for %s: %08x", AppProtoToString(a), logger_bits[a]);
899  if (tcp)
900  AppLayerParserRegisterLoggerBits(IPPROTO_TCP, a, logger_bits[a]);
901  if (udp)
902  AppLayerParserRegisterLoggerBits(IPPROTO_UDP, a, logger_bits[a]);
903 
904  }
905 }
906 
908 
909 /**
910  * Initialize multithreading settings.
911  */
913 {
915  if ((ConfGetBool("threading.set-cpu-affinity", &threading_set_cpu_affinity)) == 0) {
917  }
918  /* try to get custom cpu mask value if needed */
921  }
922  if ((ConfGetFloat("threading.detect-thread-ratio", &threading_detect_ratio)) != 1) {
923  if (ConfGetNode("threading.detect-thread-ratio") != NULL)
924  WarnInvalidConfEntry("threading.detect-thread-ratio", "%s", "1");
925  threading_detect_ratio = 1;
926  }
927 
928  SCLogDebug("threading.detect-thread-ratio %f", threading_detect_ratio);
929 }
StreamingLogger StreamingLogFunc
Definition: output.h:69
const char * thread_name_counter_wakeup
Definition: runmodes.c:70
void RunModeIpsIPFWRegister(void)
Definition: runmode-ipfw.c:51
const char * name
Definition: runmodes.c:78
int ts_log_progress
Definition: output.h:74
int OutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, OutputCtx *output_ctx, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, void(*ThreadExitPrintStats)(ThreadVars *, void *))
Definition: output-tx.c:66
#define SCLogDebug(...)
Definition: util-debug.h:335
int no_of_runmodes
Definition: runmodes.c:85
float threading_detect_ratio
Definition: runmodes.c:907
#define TAILQ_FIRST(head)
Definition: queue.h:339
void OutputFileShutdown(void)
Definition: output-file.c:277
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:350
struct HtpBodyChunk_ * next
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
void RunModeInitialize(void)
Definition: runmodes.c:912
const char * RunModeErfFileGetDefaultMode(void)
#define BUG_ON(x)
void RunModeRegisterNewRunMode(int runmode, const char *name, const char *description, int(*RunModeFunc)(void))
Registers a new runmode.
Definition: runmodes.c:426
int OutputRegisterFiledataLogger(LoggerId id, const char *name, FiledataLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
#define FALSE
LoggerId
OutputInitFunc InitFunc
Definition: output.h:55
int RunModeOutputFileEnabled(void)
Definition: runmodes.c:490
const char * RunModeNetmapGetDefaultMode(void)
struct RunMode_ RunMode
Holds description for a runmode.
#define unlikely(expr)
Definition: util-optimize.h:35
void RunModeIdsPfringRegister(void)
ThreadDeinitFunc ThreadDeinit
Definition: output.h:59
PacketLogger PacketLogFunc
Definition: output.h:62
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:517
const char * description
Definition: runmodes.c:79
const char * thread_name_single
Definition: runmodes.c:62
int tc_log_progress
Definition: output.h:73
OutputInitSubFunc InitSubFunc
Definition: output.h:56
void RunModeTileMpipeRegister(void)
Definition: runmode-tile.c:59
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
const char * RunModeIpsWinDivertGetDefaultMode(void)
char * val
Definition: conf.h:34
const char * thread_name_counter_stats
Definition: runmodes.c:69
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:815
#define TRUE
void RunModeInitializeOutputs(void)
Definition: runmodes.c:723
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:331
void RunModeIpsWinDivertRegister(void)
char * RunmodeGetActive(void)
Definition: runmodes.c:190
LoggerId logger_id
Definition: output.h:51
#define FatalErrorOnInit(x,...)
Fatal error IF we&#39;re starting up, and configured to consider errors to be fatal errors.
Definition: util-debug.h:547
ThreadInitFunc ThreadInit
Definition: output.h:58
Holds description for a runmode.
Definition: runmodes.c:75
void OutputFiledataShutdown(void)
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
Definition: output.c:821
const char * RunModeNapatechGetDefaultMode(void)
void RunModeIdsPcapRegister(void)
Definition: runmode-pcap.c:44
TxLoggerCondition TxLogCondition
Definition: output.h:65
int(* RunModeFunc)(void)
Definition: runmodes.c:81
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
#define SCCalloc(nm, a)
Definition: util-mem.h:205
RunModes
Definition: runmodes.h:27
const char * RunModeFilePcapGetDefaultMode(void)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:843
uint16_t type
const char * RunModeIpsNFQGetDefaultMode(void)
Definition: runmode-nfq.c:44
TxLogger TxLogFunc
Definition: output.h:64
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
void RunModeFilePcapRegister(void)
int OutputRegisterStreamingLogger(LoggerId id, const char *name, StreamingLogger LogFunc, OutputCtx *output_ctx, enum OutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
void RunModeDispatch(int runmode, const char *custom_mode)
Definition: runmodes.c:282
const char * RunModeIdsGetDefaultMode(void)
Definition: runmode-pcap.c:37
AppProto alproto
Definition: output.h:71
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
const char * RunModeAFPGetDefaultMode(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
Definition: runmodes.c:212
const char * name
Definition: output.h:52
enum OutputStreamingType stream_type
Definition: output.h:72
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:412
const char * RunModeIdsNflogGetDefaultMode(void)
Definition: runmode-nflog.c:39
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
Definition: counters.c:885
void OutputPacketShutdown(void)
OutputCtx * output_ctx
Definition: runmodes.c:96
const char * RunModeUnixSocketGetDefaultMode(void)
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
Definition: tm-queues.c:95
void RunModeUnixSocketRegister(void)
void TmqhFlowPrintAutofpHandler(void)
Definition: tmqh-flow.c:82
const char * thread_name_detect_loader
Definition: runmodes.c:68
struct RunModes_ RunModes
RunMode * runmodes
Definition: runmodes.c:86
const char * RunModeIpsIPFWGetDefaultMode(void)
Definition: runmode-ipfw.c:46
FlowLogger FlowLogFunc
Definition: output.h:68
void AffinitySetupLoadFromConfig()
Extract cpu affinity configuration from current config file.
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
#define SCRealloc(x, a)
Definition: util-mem.h:190
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:566
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:385
void OutputTxShutdown(void)
Definition: output-tx.c:374
void RunModeErfDagRegister(void)
void BypassedFlowManagerThreadSpawn()
spawn the flow manager thread
Definition: flow-bypass.c:122
void RunModeShutDown(void)
Definition: runmodes.c:518
ThreadExitPrintStatsFunc ThreadExitPrintStats
Definition: output.h:60
Definition: conf.h:32
OutputCtx * ctx
Definition: output.h:42
FiledataLogger FiledataLogFunc
Definition: output.h:67
int runmode
Definition: runmodes.c:77
void RunModeListRunmodes(void)
Lists all registered runmodes.
Definition: runmodes.c:239
int RunModeOutputFiledataEnabled(void)
Definition: runmodes.c:495
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
void RunModeIdsNflogRegister(void)
Definition: runmode-nflog.c:44
#define SCFree(a)
Definition: util-mem.h:236
const char * thread_name_verdict
Definition: runmodes.c:64
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-stats.c:56
int RunModeNeedsBypassManager(void)
Definition: runmodes.c:410
void OutputStatsShutdown(void)
Definition: output-stats.c:214
int debuglog_enabled
Definition: runmodes.c:58
#define TAILQ_ENTRY(type)
Definition: queue.h:330
const char * parent_name
Definition: output.h:54
void RunModeIdsNetmapRegister(void)
const char * RunModeGetMainMode(void)
Definition: runmodes.c:202
const char * RunModeErfDagGetDefaultMode(void)
const char * thread_name_autofp
Definition: runmodes.c:61
OutputModuleList output_modules
bool IsRunModeOffline(int run_mode_to_check)
Definition: runmodes.c:500
void RunModeIpsNFQRegister(void)
Definition: runmode-nfq.c:49
void RunModeNapatechRegister(void)
void UtRunModeRegister(void)
#define FatalError(x,...)
Definition: util-debug.h:539
int RunmodeGetCurrent(void)
Definition: suricata.c:269
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
Definition: util-misc.h:37
FileLogger FileLogFunc
Definition: output.h:66
SCMutex m
Definition: flow-hash.h:105
const char * RunModeIdsPfringGetDefaultMode(void)
void FlowManagerThreadSpawn()
spawn the flow manager thread
Definition: flow-manager.c:804
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
int ConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
Definition: conf.c:645
const char * conf_name
Definition: output.h:53
int OutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-flow.c:57
#define SCStrdup(a)
Definition: util-mem.h:220
void RunModeIdsAFPRegister(void)
void OutputFlowShutdown(void)
Definition: output-flow.c:207
int OutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-packet.c:60
StatsLogger StatsLogFunc
Definition: output.h:70
void RunModeEnablesBypassManager(void)
Definition: runmodes.c:405
void FlowRecyclerThreadSpawn()
spawn the flow recycler thread
Definition: flow-manager.c:965
PacketLogCondition PacketConditionFunc
Definition: output.h:63
void RunModeErfFileRegister(void)
#define TAILQ_HEAD_INITIALIZER(head)
Definition: queue.h:327
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
const char * thread_name_unix_socket
Definition: runmodes.c:67
int threading_set_cpu_affinity
Definition: runmodes.h:112
const char * RunModeTileMpipeGetDefaultMode(void)
Definition: runmode-tile.c:54
OutputModule * output_module
Definition: runmodes.c:95
int OutputRegisterFileLogger(LoggerId id, const char *name, FileLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-file.c:63
const char * thread_name_flow_mgr
Definition: runmodes.c:65
const char * thread_name_flow_rec
Definition: runmodes.c:66
void OutputStreamingShutdown(void)
const char * thread_name_workers
Definition: runmodes.c:63