Go to the documentation of this file.
99 static char *active_runmode;
119 static const char *RunModeTranslateModeToName(
int runmode)
141 return "AF_PACKET_DEV";
148 return "NETMAP(DISABLED)";
151 return "UNIX_SOCKET";
156 return "WINDIVERT(DISABLED)";
162 return "DPDK(DISABLED)";
180 static RunMode *RunModeGetCustomMode(
enum SCRunModes runmode,
const char *custom_mode)
183 for (
int i = 0; i < runmodes[runmode].
cnt; i++) {
184 if (strcmp(runmodes[runmode].runmodes[i].
name, custom_mode) == 0)
185 return &runmodes[runmode].
runmodes[i];
201 return active_runmode;
225 return RunModeTranslateModeToName(mainmode);
233 memset(runmodes, 0,
sizeof(runmodes));
259 printf(
"------------------------------------- Runmodes -------------------"
260 "-----------------------\n");
262 printf(
"| %-17s | %-17s | %-10s \n",
263 "RunMode Type",
"Custom Mode ",
"Description");
264 printf(
"|-----------------------------------------------------------------"
265 "-----------------------\n");
269 int mode_displayed = 0;
270 for (j = 0; j < runmodes[i].
cnt; j++) {
271 if (mode_displayed == 1) {
272 printf(
"| ----------------------------------------------"
273 "-----------------------\n");
275 printf(
"| %-17s | %-17s | %-27s \n",
281 printf(
"| %-17s | %-17s | %-27s \n",
282 RunModeTranslateModeToName(runmode->
runmode),
286 if (mode_displayed == 0)
289 if (mode_displayed == 1) {
290 printf(
"|-----------------------------------------------------------------"
291 "-----------------------\n");
296 static const char *RunModeGetConfOrDefault(
int capture_mode,
const char *capture_plugin_name)
298 const char *custom_mode = NULL;
299 const char *val = NULL;
306 if ((custom_mode == NULL) || (strcmp(custom_mode,
"auto") == 0)) {
307 switch (capture_mode) {
317 if (plugin == NULL) {
318 FatalError(
"No capture plugin found with name %s", capture_plugin_name);
369 if (!strcmp(
"worker", custom_mode)) {
371 "to 'workers', please modify your setup.");
372 custom_mode =
"workers";
381 if (runmode == NULL) {
382 runmode = RunModeGetConfOrDefault(capture_mode, capture_plugin_name);
387 RunMode *mode = RunModeGetCustomMode(capture_mode, runmode);
395 if (ips_enabled == 1) {
398 SCLogWarning(
"disabling livedev.use-for-tracking with IPS mode. See ticket #6726.");
409 void RunModeDispatch(
int runmode,
const char *custom_mode,
const char *capture_plugin_name,
410 const char *capture_plugin_args)
412 char *local_custom_mode = NULL;
414 if (custom_mode == NULL) {
415 custom_mode = RunModeGetConfOrDefault(runmode, capture_plugin_name);
416 if (custom_mode == NULL)
420 RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
422 SCLogError(
"The custom type \"%s\" doesn't exist "
423 "for this runmode type \"%s\". Please use --list-runmodes to "
424 "see available custom types for this runmode",
425 custom_mode, RunModeTranslateModeToName(runmode));
430 if (active_runmode) {
433 active_runmode =
SCStrdup(custom_mode);
434 if (
unlikely(active_runmode == NULL)) {
438 if (strcasecmp(active_runmode,
"autofp") == 0) {
444 if (local_custom_mode != NULL)
445 SCFree(local_custom_mode);
463 static int g_runmode_needs_bypass = 0;
467 g_runmode_needs_bypass = 1;
472 return g_runmode_needs_bypass;
487 int (*RunModeFunc)(
void),
int (*RunModeIsIPSEnabled)(
void))
489 if (RunModeGetCustomMode(runmode,
name) != NULL) {
491 "been registered. Please use an unique name.",
495 void *ptmp =
SCRealloc(runmodes[runmode].runmodes,
496 (runmodes[runmode].
cnt + 1) *
sizeof(
RunMode));
498 SCFree(runmodes[runmode].runmodes);
505 runmodes[runmode].
cnt++;
506 memset(mode, 0x00,
sizeof(*mode));
527 static void RunOutputFreeList(
void)
530 while ((output =
TAILQ_FIRST(&output_free_list))) {
540 static int file_logger_count = 0;
541 static int filedata_logger_count = 0;
545 return filedata_logger_count > 0;
550 switch (run_mode_to_check) {
563 switch(run_mode_to_check) {
594 file_logger_count = 0;
595 filedata_logger_count = 0;
612 static void SetupOutput(
649 filedata_logger_count++;
664 static void RunModeInitializeEveOutput(
678 if (strcmp(
type->val,
"ikev2") == 0) {
679 SCLogWarning(
"eve module 'ikev2' has been replaced by 'ike'");
680 strlcpy(subname,
"eve-log.ike",
sizeof(subname));
682 snprintf(subname,
sizeof(subname),
"eve-log.%s",
type->val);
688 if (sub_output_config != NULL) {
698 if (strcmp(subname, sub_module->
conf_name) == 0) {
711 sub_module->
InitSubFunc(sub_output_config, parent_ctx);
712 if (!result.
ok || result.
ctx == NULL) {
713 FatalError(
"unable to initialize sub-module %s", subname);
716 AddOutputToFreeList(sub_module, result.
ctx);
717 SetupOutput(sub_module->
name, sub_module, result.
ctx, logger_bits);
730 static void RunModeInitializeLuaOutput(
734 BUG_ON(lua_module == NULL);
746 if (strcmp(script->
val,
m->conf_name) == 0) {
754 if (!result.
ok || result.
ctx == NULL) {
758 AddOutputToFreeList(
m, result.
ctx);
759 SetupOutput(
m->name,
m, result.
ctx, logger_bits);
772 if (outputs == NULL) {
779 char tls_log_enabled = 0;
780 char tls_store_present = 0;
788 if (output_config == NULL) {
790 FatalError(
"Failed to lookup configuration child node: %s", output->
val);
793 if (strcmp(output->
val,
"tls-store") == 0) {
794 tls_store_present = 1;
802 if (strcmp(output->
val,
"file-log") == 0) {
804 " use eve.files instead "
806 " for an explanation)");
808 }
else if (strncmp(output->
val,
"unified-",
sizeof(
"unified-") - 1) == 0) {
810 " use Unified2 instead "
812 " for an explanation)");
814 }
else if (strncmp(output->
val,
"unified2-",
sizeof(
"unified2-") - 1) == 0) {
817 }
else if (strcmp(output->
val,
"dns-log") == 0) {
818 SCLogWarning(
"dns-log is not longer available as of Suricata 5.0");
820 }
else if (strcmp(output->
val,
"tls-log") == 0) {
839 }
else if (r.
ctx == NULL) {
849 if (strcmp(output->
val,
"eve-log") == 0) {
850 RunModeInitializeEveOutput(output_config, output_ctx, logger_bits);
855 AddOutputToFreeList(module, output_ctx);
856 }
else if (strcmp(output->
val,
"lua") == 0) {
858 if (output_ctx == NULL)
860 RunModeInitializeLuaOutput(output_config, output_ctx, logger_bits);
861 AddOutputToFreeList(module, output_ctx);
863 AddOutputToFreeList(module, output_ctx);
864 SetupOutput(module->
name, module, output_ctx, logger_bits);
874 if (!tls_store_present && tls_log_enabled) {
877 SCLogWarning(
"Please use 'tls-store' in YAML to configure TLS storage");
882 if (strcmp(output->
val,
"tls-log") == 0) {
885 if (module == NULL) {
886 SCLogWarning(
"No output module named %s, ignoring",
"tls-store");
896 }
else if (r.
ctx == NULL) {
902 AddOutputToFreeList(module, output_ctx);
903 SetupOutput(module->
name, module, output_ctx, logger_bits);
916 SCLogDebug(
"IPPROTO_TCP::%s: g_file_logger_enabled %d g_filedata_logger_enabled %d -> "
928 if (logger_bits[a] == 0)
938 tcp ?
"true" :
"false", udp ?
"true" :
"false");
957 if ((
SCConfGetBool(
"threading.set-cpu-affinity", &affinity)) == 0) {
979 const char *ss = NULL;
980 if ((
SCConfGet(
"threading.stack-size", &ss)) == 1) {
983 FatalError(
"Failed to initialize thread_stack_size output, invalid limit: %s", ss);
988 pthread_attr_init(&attr);
990 if (pthread_attr_getstacksize(&attr, &size) == 0 && size < 512 * 1024) {
992 SCLogNotice(
"thread stack size of %" PRIuMAX
" too small: setting to 512k",
const char * thread_name_workers
const char * RunModeIpsIPFWGetDefaultMode(void)
void FlowManagerThreadSpawn(void)
spawn the flow manager thread
void AffinitySetupLoadFromConfig(void)
Extract CPU affinity configuration from current config file.
@ RUNMODE_ENGINE_ANALYSIS
void TmThreadsSealThreads(void)
const char * thread_name_counter_wakeup
int SCConfValIsTrue(const char *val)
Check if a value is true.
bool threading_set_cpu_affinity
void RunModeErfFileRegister(void)
void OutputStreamingShutdown(void)
int(* RunModeIsIPSEnabled)(void)
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
const char * thread_name_flow_mgr
const char * RunModeErfFileGetDefaultMode(void)
bool IsRunModeOffline(enum SCRunModes run_mode_to_check)
void OutputTxShutdown(void)
void TmqhFlowPrintAutofpHandler(void)
void RunModeIdsAFPRegister(void)
int ParseSizeStringU64(const char *size, uint64_t *res)
struct HtpBodyChunk_ * next
void BypassedFlowManagerThreadSpawn(void)
spawn the flow bypass manager thread
void RunModeShutDown(void)
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
const char * thread_name_counter_stats
int SCOutputRegisterStreamingLogger(LoggerId id, const char *name, SCStreamingLogger LogFunc, void *initdata, enum SCOutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a streaming logger.
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
const char * RunModeAFPGetDefaultMode(void)
const char * thread_name_flow_rec
void OutputFiledataShutdown(void)
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
const char * RunModeFilePcapGetDefaultMode(void)
#define TAILQ_FOREACH(var, head, field)
const char * thread_name_autofp
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
void OutputSetupActiveLoggers(void)
const char * RunModeIdsNflogGetDefaultMode(void)
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
void OutputStatsShutdown(void)
#define TAILQ_INSERT_TAIL(head, elm, field)
char * RunmodeGetActive(void)
OutputInitSubFunc InitSubFunc
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
int SCOutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow logger.
struct RunModes_ RunModes
PacketLogger PacketLogFunc
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
const char * RunModeAFXDPGetDefaultMode(void)
SCFiledataLogger FiledataLogFunc
void RunModeInitializeOutputs(void)
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
const char * thread_name_single
bool IsRunModeSystem(enum SCRunModes run_mode_to_check)
const char *(* GetDefaultMode)(void)
const char * SCRunModeLibGetDefaultMode(void)
runmode default mode (live)
void OutputClearActiveLoggers(void)
size_t strlcpy(char *dst, const char *src, size_t siz)
#define TAILQ_ENTRY(type)
const char * RunModeUnixSocketGetDefaultMode(void)
void RunModeIpsNFQRegister(void)
enum SCOutputStreamingType stream_type
void RunModeInitializeThreadSettings(void)
ThreadInitFunc ThreadInit
const char * RunModeDpdkGetDefaultMode(void)
bool RunmodeIsWorkers(void)
#define TAILQ_HEAD_INITIALIZER(head)
OutputModuleList output_modules
#define TAILQ_REMOVE(head, elm, field)
SCRunMode SCRunmodeGet(void)
Get the current run mode.
#define TAILQ_FIRST(head)
const char * thread_name_flow_bypass
bool RunmodeIsAutofp(void)
ThreadDeinitFunc ThreadDeinit
void RunModeListRunmodes(void)
Lists all registered runmodes.
bool g_filedata_logger_enabled
uint64_t threading_set_stack_size
void RunModeEnablesBypassManager(void)
void OutputPacketShutdown(void)
void RunModeIdsNflogRegister(void)
Holds description for a runmode.
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
void RunModeIpsIPFWRegister(void)
SCStreamingLogger StreamingLogFunc
#define SCLogWarning(...)
Macro used to log WARNING messages.
const char * RunModeErfDagGetDefaultMode(void)
int SCOutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, void *initdata, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a transaction logger.
const char * thread_name_detect_loader
void OutputFileShutdown(void)
void RunModeRegisterNewRunMode(enum SCRunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), int(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
void FlowRecyclerThreadSpawn(void)
spawn the flow recycler thread
void RunModeErfDagRegister(void)
struct RunMode_ RunMode
Holds description for a runmode.
int SCOutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet logger.
int SCOutputRegisterFileLogger(LoggerId id, const char *name, SCFileLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file logger.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
void RunModeIpsWinDivertRegister(void)
#define SCRealloc(ptr, sz)
SCConfNode * SCConfNodeLookupChild(const SCConfNode *node, const char *name)
Lookup a child configuration node by name.
void RunModeIdsAFXDPRegister(void)
TxLoggerCondition TxLogCondition
void RunModeUnixSocketRegister(void)
void LogFlushThreads(void)
void(* DeInit)(struct OutputCtx_ *)
const char * thread_name_heartbeat
#define FatalErrorOnInit(...)
Fatal error IF we're starting up, and configured to consider errors to be fatal errors.
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
int RunModeNeedsBypassManager(void)
bool g_file_logger_enabled
void RunModeIdsPcapRegister(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
void RunModeFilePcapRegister(void)
PacketLogCondition PacketConditionFunc
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
const char * RunModeNetmapGetDefaultMode(void)
const char * RunModeIpsNFQGetDefaultMode(void)
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
#define SCLogError(...)
Macro used to log ERROR messages.
void RunModeIdsNetmapRegister(void)
struct OutputFreeList_ OutputFreeList
const char * thread_name_verdict
void RunModeDpdkRegister(void)
#define TAILQ_HEAD(name, type)
void OutputFlowShutdown(void)
int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
int SCOutputRegisterFiledataLogger(LoggerId id, const char *name, SCFiledataLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file-data logger.
const char * thread_name_unix_socket
OutputModule * output_module
const char * RunModeGetMainMode(void)
int RunModeOutputFiledataEnabled(void)
int LiveGetDeviceCount(void)
Get the number of registered devices.
void SCRunModeLibIdsRegister(void)
register runmodes for suricata as a library
#define SCLogNotice(...)
Macro used to log NOTICE messages.
void UtRunModeRegister(void)
const char * RunModeIpsWinDivertGetDefaultMode(void)
int SCConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
SCCapturePlugin * SCPluginFindCaptureByName(const char *name)
float threading_detect_ratio
const char * RunModeIdsGetDefaultMode(void)