Go to the documentation of this file.
111 static char *active_runmode;
131 static const char *RunModeTranslateModeToName(
int runmode)
142 return "PFRING(DISABLED)";
161 return "AF_PACKET_DEV";
168 return "NETMAP(DISABLED)";
171 return "UNIX_SOCKET";
176 return "WINDIVERT(DISABLED)";
182 return "DPDK(DISABLED)";
198 static RunMode *RunModeGetCustomMode(
enum RunModes runmode,
const char *custom_mode)
201 for (
int i = 0; i < runmodes[runmode].cnt; i++) {
202 if (strcmp(runmodes[runmode].runmodes[i].name, custom_mode) == 0)
203 return &runmodes[runmode].runmodes[i];
219 return active_runmode;
233 return RunModeTranslateModeToName(mainmode);
241 memset(runmodes, 0,
sizeof(runmodes));
269 printf(
"------------------------------------- Runmodes -------------------"
270 "-----------------------\n");
272 printf(
"| %-17s | %-17s | %-10s \n",
273 "RunMode Type",
"Custom Mode ",
"Description");
274 printf(
"|-----------------------------------------------------------------"
275 "-----------------------\n");
279 int mode_displayed = 0;
280 for (j = 0; j < runmodes[i].cnt; j++) {
281 if (mode_displayed == 1) {
282 printf(
"| ----------------------------------------------"
283 "-----------------------\n");
284 RunMode *runmode = &runmodes[i].runmodes[j];
285 printf(
"| %-17s | %-17s | %-27s \n",
290 RunMode *runmode = &runmodes[i].runmodes[j];
291 printf(
"| %-17s | %-17s | %-27s \n",
292 RunModeTranslateModeToName(runmode->
runmode),
296 if (mode_displayed == 0)
299 if (mode_displayed == 1) {
300 printf(
"|-----------------------------------------------------------------"
301 "-----------------------\n");
308 static const char *RunModeGetConfOrDefault(
int capture_mode,
const char *capture_plugin_name)
310 const char *custom_mode = NULL;
311 const char *val = NULL;
312 if (
ConfGet(
"runmode", &val) != 1) {
318 if ((custom_mode == NULL) || (strcmp(custom_mode,
"auto") == 0)) {
319 switch (capture_mode) {
334 if (plugin == NULL) {
335 FatalError(
"No capture plugin found with name %s", capture_plugin_name);
386 if (!strcmp(
"worker", custom_mode)) {
388 "to 'workers', please modify your setup.");
389 custom_mode =
"workers";
398 if (runmode == NULL) {
399 runmode = RunModeGetConfOrDefault(capture_mode, capture_plugin_name);
404 RunMode *mode = RunModeGetCustomMode(capture_mode, runmode);
416 void RunModeDispatch(
int runmode,
const char *custom_mode,
const char *capture_plugin_name,
417 const char *capture_plugin_args)
419 char *local_custom_mode = NULL;
421 if (custom_mode == NULL) {
422 custom_mode = RunModeGetConfOrDefault(runmode, capture_plugin_name);
423 if (custom_mode == NULL)
427 RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
429 SCLogError(
"The custom type \"%s\" doesn't exist "
430 "for this runmode type \"%s\". Please use --list-runmodes to "
431 "see available custom types for this runmode",
432 custom_mode, RunModeTranslateModeToName(runmode));
437 if (active_runmode) {
440 active_runmode =
SCStrdup(custom_mode);
441 if (
unlikely(active_runmode == NULL)) {
445 if (strcasecmp(active_runmode,
"autofp") == 0) {
451 if (local_custom_mode != NULL)
452 SCFree(local_custom_mode);
468 static int g_runmode_needs_bypass = 0;
472 g_runmode_needs_bypass = 1;
477 return g_runmode_needs_bypass;
492 int (*RunModeFunc)(
void),
void (*RunModeIsIPSEnabled)(
void))
494 if (RunModeGetCustomMode(runmode, name) != NULL) {
496 "been registered. Please use an unique name.",
500 void *ptmp =
SCRealloc(runmodes[runmode].runmodes,
501 (runmodes[runmode].
cnt + 1) *
sizeof(
RunMode));
503 SCFree(runmodes[runmode].runmodes);
504 runmodes[runmode].runmodes = NULL;
507 runmodes[runmode].runmodes = ptmp;
509 RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].cnt];
510 runmodes[runmode].cnt++;
511 memset(mode, 0x00,
sizeof(*mode));
534 static void RunOutputFreeList(
void)
537 while ((output =
TAILQ_FIRST(&output_free_list))) {
547 static int file_logger_count = 0;
548 static int filedata_logger_count = 0;
553 return file_logger_count > 0;
558 return filedata_logger_count > 0;
563 switch (run_mode_to_check) {
576 switch(run_mode_to_check) {
607 file_logger_count = 0;
608 filedata_logger_count = 0;
668 filedata_logger_count++;
699 if (strcmp(
type->val,
"ikev2") == 0) {
700 SCLogWarning(
"eve module 'ikev2' has been replaced by 'ike'");
701 strlcpy(subname,
"eve-log.ike",
sizeof(subname));
703 snprintf(subname,
sizeof(subname),
"eve-log.%s",
type->val);
709 if (sub_output_config != NULL) {
711 sub_output_config,
"enabled");
720 if (strcmp(subname, sub_module->
conf_name) == 0) {
733 sub_module->
InitSubFunc(sub_output_config, parent_ctx);
734 if (!result.
ok || result.
ctx == NULL) {
735 FatalError(
"unable to initialize sub-module %s", subname);
738 AddOutputToFreeList(sub_module, result.
ctx);
739 SetupOutput(sub_module->
name, sub_module,
756 BUG_ON(lua_module == NULL);
768 if (strcmp(script->
val,
m->conf_name) == 0) {
776 if (!result.
ok || result.
ctx == NULL) {
780 AddOutputToFreeList(
m, result.
ctx);
781 SetupOutput(
m->name,
m, result.
ctx);
794 if (outputs == NULL) {
801 char tls_log_enabled = 0;
802 char tls_store_present = 0;
804 memset(&logger_bits, 0,
sizeof(logger_bits));
809 if (output_config == NULL) {
811 FatalError(
"Failed to lookup configuration child node: %s", output->
val);
814 if (strcmp(output->
val,
"tls-store") == 0) {
815 tls_store_present = 1;
823 if (strcmp(output->
val,
"file-log") == 0) {
825 " use eve.files instead "
827 " for an explanation)");
829 }
else if (strncmp(output->
val,
"unified-",
sizeof(
"unified-") - 1) == 0) {
831 " use Unified2 instead "
833 " for an explanation)");
835 }
else if (strncmp(output->
val,
"unified2-",
sizeof(
"unified2-") - 1) == 0) {
838 }
else if (strcmp(output->
val,
"lua") == 0) {
840 SCLogWarning(
"lua support not compiled in. Reconfigure/"
841 "recompile with lua(jit) and its development "
842 "files installed to add lua support.");
845 }
else if (strcmp(output->
val,
"dns-log") == 0) {
846 SCLogWarning(
"dns-log is not longer available as of Suricata 5.0");
848 }
else if (strcmp(output->
val,
"tls-log") == 0) {
867 }
else if (r.
ctx == NULL) {
877 if (strcmp(output->
val,
"eve-log") == 0) {
878 RunModeInitializeEveOutput(output_config, output_ctx);
883 AddOutputToFreeList(module, output_ctx);
884 }
else if (strcmp(output->
val,
"lua") == 0) {
886 if (output_ctx == NULL)
888 RunModeInitializeLuaOutput(output_config, output_ctx);
889 AddOutputToFreeList(module, output_ctx);
891 AddOutputToFreeList(module, output_ctx);
892 SetupOutput(module->
name, module, output_ctx);
902 if (!tls_store_present && tls_log_enabled) {
905 SCLogWarning(
"Please use 'tls-store' in YAML to configure TLS storage");
910 if (strcmp(output->
val,
"tls-log") == 0) {
913 if (module == NULL) {
914 SCLogWarning(
"No output module named %s, ignoring",
"tls-store");
924 }
else if (r.
ctx == NULL) {
930 AddOutputToFreeList(module, output_ctx);
931 SetupOutput(module->
name, module, output_ctx);
944 SCLogDebug(
"IPPROTO_TCP::%s: g_file_logger_enabled %d g_filedata_logger_enabled %d -> "
956 if (logger_bits[a] == 0)
966 tcp ?
"true" :
"false", udp ?
"true" :
"false");
986 if ((
ConfGetBool(
"threading.set-cpu-affinity", &affinity)) == 0) {
997 if (
ConfGetNode(
"threading.detect-thread-ratio") != NULL)
1008 const char *ss = NULL;
1009 if ((
ConfGet(
"threading.stack-size", &ss)) == 1) {
1012 FatalError(
"Failed to initialize thread_stack_size output, invalid limit: %s", ss);
1016 pthread_attr_t attr;
1017 pthread_attr_init(&attr);
1019 if (pthread_attr_getstacksize(&attr, &size) == 0 && size < 512 * 1024) {
1021 SCLogNotice(
"thread stack size of %" PRIuMAX
" to too small: setting to 512k",
const char * thread_name_workers
const char * RunModeIpsIPFWGetDefaultMode(void)
void FlowManagerThreadSpawn(void)
spawn the flow manager thread
int OutputRegisterStreamingLogger(LoggerId id, const char *name, StreamingLogger LogFunc, OutputCtx *output_ctx, enum OutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
void AffinitySetupLoadFromConfig(void)
Extract cpu affinity configuration from current config file.
const char * thread_name_counter_wakeup
bool threading_set_cpu_affinity
void RunModeErfFileRegister(void)
void OutputStreamingShutdown(void)
void RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
const char * thread_name_flow_mgr
const char * RunModeErfFileGetDefaultMode(void)
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
void OutputTxShutdown(void)
void TmqhFlowPrintAutofpHandler(void)
void RunModeIdsAFPRegister(void)
int ParseSizeStringU64(const char *size, uint64_t *res)
struct HtpBodyChunk_ * next
void BypassedFlowManagerThreadSpawn(void)
spawn the flow bypass manager thread
int OutputRegisterFileLogger(LoggerId id, const char *name, FileLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
void RunModeShutDown(void)
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
const char * thread_name_counter_stats
StreamingLogger StreamingLogFunc
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
const char * RunModeAFPGetDefaultMode(void)
const char * thread_name_flow_rec
void OutputFiledataShutdown(void)
void RunModeIdsPfringRegister(void)
const char * RunModeFilePcapGetDefaultMode(void)
#define TAILQ_FOREACH(var, head, field)
const char * thread_name_autofp
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), void(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
void OutputSetupActiveLoggers(void)
const char * RunModeIdsNflogGetDefaultMode(void)
void OutputStatsShutdown(void)
#define TAILQ_INSERT_TAIL(head, elm, field)
char * RunmodeGetActive(void)
OutputInitSubFunc InitSubFunc
struct RunModes_ RunModes
PacketLogger PacketLogFunc
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
const char * RunModeAFXDPGetDefaultMode(void)
bool IsRunModeOffline(enum RunModes run_mode_to_check)
void RunModeInitializeOutputs(void)
const char * thread_name_single
const char *(* GetDefaultMode)(void)
int ConfValIsTrue(const char *val)
Check if a value is true.
void OutputClearActiveLoggers(void)
const char * RunModeIdsPfringGetDefaultMode(void)
enum OutputStreamingType stream_type
size_t strlcpy(char *dst, const char *src, size_t siz)
int OutputRegisterFiledataLogger(LoggerId id, const char *name, FiledataLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
#define TAILQ_ENTRY(type)
const char * RunModeUnixSocketGetDefaultMode(void)
int OutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
void RunModeIpsNFQRegister(void)
void RunModeInitializeThreadSettings(void)
int OutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, OutputCtx *output_ctx, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, void(*ThreadExitPrintStats)(ThreadVars *, void *))
ThreadInitFunc ThreadInit
const char * RunModeDpdkGetDefaultMode(void)
#define TAILQ_HEAD_INITIALIZER(head)
bool IsRunModeSystem(enum RunModes run_mode_to_check)
OutputModuleList output_modules
#define TAILQ_REMOVE(head, elm, field)
FiledataLogger FiledataLogFunc
#define TAILQ_FIRST(head)
const char * thread_name_flow_bypass
void(* RunModeIsIPSEnabled)(void)
ThreadDeinitFunc ThreadDeinit
void RunModeListRunmodes(void)
Lists all registered runmodes.
bool g_filedata_logger_enabled
uint64_t threading_set_stack_size
void RunModeEnablesBypassManager(void)
void OutputPacketShutdown(void)
void RunModeIdsNflogRegister(void)
Holds description for a runmode.
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
void RunModeIpsIPFWRegister(void)
#define SCLogWarning(...)
Macro used to log WARNING messages.
const char * RunModeErfDagGetDefaultMode(void)
const char * thread_name_detect_loader
void OutputFileShutdown(void)
void FlowRecyclerThreadSpawn(void)
spawn the flow recycler thread
void RunModeErfDagRegister(void)
ThreadExitPrintStatsFunc ThreadExitPrintStats
struct RunMode_ RunMode
Holds description for a runmode.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
void RunModeIpsWinDivertRegister(void)
#define SCRealloc(ptr, sz)
const char * RunModeNapatechGetDefaultMode(void)
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
void RunModeIdsAFXDPRegister(void)
int ConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
TxLoggerCondition TxLogCondition
void RunModeUnixSocketRegister(void)
void(* DeInit)(struct OutputCtx_ *)
#define FatalErrorOnInit(...)
Fatal error IF we're starting up, and configured to consider errors to be fatal errors.
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
int RunModeNeedsBypassManager(void)
bool g_file_logger_enabled
void RunModeIdsPcapRegister(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
void RunModeFilePcapRegister(void)
PacketLogCondition PacketConditionFunc
int RunmodeGetCurrent(void)
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
const char * RunModeNetmapGetDefaultMode(void)
const char * RunModeIpsNFQGetDefaultMode(void)
@ RUNMODE_ENGINE_ANALYSIS
#define SCLogError(...)
Macro used to log ERROR messages.
void RunModeIdsNetmapRegister(void)
struct OutputFreeList_ OutputFreeList
const char * thread_name_verdict
void RunModeDpdkRegister(void)
#define TAILQ_HEAD(name, type)
void OutputFlowShutdown(void)
const char * thread_name_unix_socket
void RunModeNapatechRegister(void)
OutputModule * output_module
const char * RunModeGetMainMode(void)
int RunModeOutputFiledataEnabled(void)
#define SCLogNotice(...)
Macro used to log NOTICE messages.
void UtRunModeRegister(void)
const char * RunModeIpsWinDivertGetDefaultMode(void)
SCCapturePlugin * SCPluginFindCaptureByName(const char *name)
float threading_detect_ratio
int RunModeOutputFileEnabled(void)
int OutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
const char * RunModeIdsGetDefaultMode(void)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.