Go to the documentation of this file.
98 static char *active_runmode;
118 static const char *RunModeTranslateModeToName(
int runmode)
140 return "AF_PACKET_DEV";
147 return "NETMAP(DISABLED)";
150 return "UNIX_SOCKET";
155 return "WINDIVERT(DISABLED)";
161 return "DPDK(DISABLED)";
177 static RunMode *RunModeGetCustomMode(
enum RunModes runmode,
const char *custom_mode)
180 for (
int i = 0; i < runmodes[runmode].cnt; i++) {
181 if (strcmp(runmodes[runmode].runmodes[i].
name, custom_mode) == 0)
182 return &runmodes[runmode].runmodes[i];
198 return active_runmode;
212 return RunModeTranslateModeToName(mainmode);
220 memset(runmodes, 0,
sizeof(runmodes));
245 printf(
"------------------------------------- Runmodes -------------------"
246 "-----------------------\n");
248 printf(
"| %-17s | %-17s | %-10s \n",
249 "RunMode Type",
"Custom Mode ",
"Description");
250 printf(
"|-----------------------------------------------------------------"
251 "-----------------------\n");
255 int mode_displayed = 0;
256 for (j = 0; j < runmodes[i].cnt; j++) {
257 if (mode_displayed == 1) {
258 printf(
"| ----------------------------------------------"
259 "-----------------------\n");
260 RunMode *runmode = &runmodes[i].runmodes[j];
261 printf(
"| %-17s | %-17s | %-27s \n",
266 RunMode *runmode = &runmodes[i].runmodes[j];
267 printf(
"| %-17s | %-17s | %-27s \n",
268 RunModeTranslateModeToName(runmode->
runmode),
272 if (mode_displayed == 0)
275 if (mode_displayed == 1) {
276 printf(
"|-----------------------------------------------------------------"
277 "-----------------------\n");
282 static const char *RunModeGetConfOrDefault(
int capture_mode,
const char *capture_plugin_name)
284 const char *custom_mode = NULL;
285 const char *val = NULL;
286 if (
ConfGet(
"runmode", &val) != 1) {
292 if ((custom_mode == NULL) || (strcmp(custom_mode,
"auto") == 0)) {
293 switch (capture_mode) {
303 if (plugin == NULL) {
304 FatalError(
"No capture plugin found with name %s", capture_plugin_name);
352 if (!strcmp(
"worker", custom_mode)) {
354 "to 'workers', please modify your setup.");
355 custom_mode =
"workers";
364 if (runmode == NULL) {
365 runmode = RunModeGetConfOrDefault(capture_mode, capture_plugin_name);
370 RunMode *mode = RunModeGetCustomMode(capture_mode, runmode);
378 if (ips_enabled == 1) {
381 SCLogWarning(
"disabling livedev.use-for-tracking with IPS mode. See ticket #6726.");
392 void RunModeDispatch(
int runmode,
const char *custom_mode,
const char *capture_plugin_name,
393 const char *capture_plugin_args)
395 char *local_custom_mode = NULL;
397 if (custom_mode == NULL) {
398 custom_mode = RunModeGetConfOrDefault(runmode, capture_plugin_name);
399 if (custom_mode == NULL)
403 RunMode *mode = RunModeGetCustomMode(runmode, custom_mode);
405 SCLogError(
"The custom type \"%s\" doesn't exist "
406 "for this runmode type \"%s\". Please use --list-runmodes to "
407 "see available custom types for this runmode",
408 custom_mode, RunModeTranslateModeToName(runmode));
413 if (active_runmode) {
416 active_runmode =
SCStrdup(custom_mode);
417 if (
unlikely(active_runmode == NULL)) {
421 if (strcasecmp(active_runmode,
"autofp") == 0) {
427 if (local_custom_mode != NULL)
428 SCFree(local_custom_mode);
446 static int g_runmode_needs_bypass = 0;
450 g_runmode_needs_bypass = 1;
455 return g_runmode_needs_bypass;
470 int (*RunModeFunc)(
void),
int (*RunModeIsIPSEnabled)(
void))
472 if (RunModeGetCustomMode(runmode,
name) != NULL) {
474 "been registered. Please use an unique name.",
478 void *ptmp =
SCRealloc(runmodes[runmode].runmodes,
479 (runmodes[runmode].
cnt + 1) *
sizeof(
RunMode));
481 SCFree(runmodes[runmode].runmodes);
482 runmodes[runmode].runmodes = NULL;
485 runmodes[runmode].runmodes = ptmp;
487 RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].cnt];
488 runmodes[runmode].cnt++;
489 memset(mode, 0x00,
sizeof(*mode));
510 static void RunOutputFreeList(
void)
513 while ((output =
TAILQ_FIRST(&output_free_list))) {
523 static int file_logger_count = 0;
524 static int filedata_logger_count = 0;
528 return filedata_logger_count > 0;
533 switch (run_mode_to_check) {
546 switch(run_mode_to_check) {
577 file_logger_count = 0;
578 filedata_logger_count = 0;
595 static void SetupOutput(
632 filedata_logger_count++;
660 if (strcmp(
type->val,
"ikev2") == 0) {
661 SCLogWarning(
"eve module 'ikev2' has been replaced by 'ike'");
662 strlcpy(subname,
"eve-log.ike",
sizeof(subname));
664 snprintf(subname,
sizeof(subname),
"eve-log.%s",
type->val);
670 if (sub_output_config != NULL) {
672 sub_output_config,
"enabled");
681 if (strcmp(subname, sub_module->
conf_name) == 0) {
694 sub_module->
InitSubFunc(sub_output_config, parent_ctx);
695 if (!result.
ok || result.
ctx == NULL) {
696 FatalError(
"unable to initialize sub-module %s", subname);
699 AddOutputToFreeList(sub_module, result.
ctx);
700 SetupOutput(sub_module->
name, sub_module, result.
ctx, logger_bits);
716 BUG_ON(lua_module == NULL);
728 if (strcmp(script->
val,
m->conf_name) == 0) {
736 if (!result.
ok || result.
ctx == NULL) {
740 AddOutputToFreeList(
m, result.
ctx);
741 SetupOutput(
m->name,
m, result.
ctx, logger_bits);
754 if (outputs == NULL) {
761 char tls_log_enabled = 0;
762 char tls_store_present = 0;
770 if (output_config == NULL) {
772 FatalError(
"Failed to lookup configuration child node: %s", output->
val);
775 if (strcmp(output->
val,
"tls-store") == 0) {
776 tls_store_present = 1;
784 if (strcmp(output->
val,
"file-log") == 0) {
786 " use eve.files instead "
788 " for an explanation)");
790 }
else if (strncmp(output->
val,
"unified-",
sizeof(
"unified-") - 1) == 0) {
792 " use Unified2 instead "
794 " for an explanation)");
796 }
else if (strncmp(output->
val,
"unified2-",
sizeof(
"unified2-") - 1) == 0) {
799 }
else if (strcmp(output->
val,
"dns-log") == 0) {
800 SCLogWarning(
"dns-log is not longer available as of Suricata 5.0");
802 }
else if (strcmp(output->
val,
"tls-log") == 0) {
821 }
else if (r.
ctx == NULL) {
831 if (strcmp(output->
val,
"eve-log") == 0) {
832 RunModeInitializeEveOutput(output_config, output_ctx, logger_bits);
837 AddOutputToFreeList(module, output_ctx);
838 }
else if (strcmp(output->
val,
"lua") == 0) {
840 if (output_ctx == NULL)
842 RunModeInitializeLuaOutput(output_config, output_ctx, logger_bits);
843 AddOutputToFreeList(module, output_ctx);
845 AddOutputToFreeList(module, output_ctx);
846 SetupOutput(module->
name, module, output_ctx, logger_bits);
856 if (!tls_store_present && tls_log_enabled) {
859 SCLogWarning(
"Please use 'tls-store' in YAML to configure TLS storage");
864 if (strcmp(output->
val,
"tls-log") == 0) {
867 if (module == NULL) {
868 SCLogWarning(
"No output module named %s, ignoring",
"tls-store");
878 }
else if (r.
ctx == NULL) {
884 AddOutputToFreeList(module, output_ctx);
885 SetupOutput(module->
name, module, output_ctx, logger_bits);
898 SCLogDebug(
"IPPROTO_TCP::%s: g_file_logger_enabled %d g_filedata_logger_enabled %d -> "
910 if (logger_bits[a] == 0)
920 tcp ?
"true" :
"false", udp ?
"true" :
"false");
939 if ((
ConfGetBool(
"threading.set-cpu-affinity", &affinity)) == 0) {
950 if (
ConfGetNode(
"threading.detect-thread-ratio") != NULL)
961 const char *ss = NULL;
962 if ((
ConfGet(
"threading.stack-size", &ss)) == 1) {
965 FatalError(
"Failed to initialize thread_stack_size output, invalid limit: %s", ss);
970 pthread_attr_init(&attr);
972 if (pthread_attr_getstacksize(&attr, &size) == 0 && size < 512 * 1024) {
974 SCLogNotice(
"thread stack size of %" PRIuMAX
" too small: setting to 512k",
const char * thread_name_workers
const char * RunModeIpsIPFWGetDefaultMode(void)
void FlowManagerThreadSpawn(void)
spawn the flow manager thread
void AffinitySetupLoadFromConfig(void)
Extract cpu affinity configuration from current config file.
void TmThreadsSealThreads(void)
const char * thread_name_counter_wakeup
int SCRunmodeGet(void)
Get the current run mode.
bool threading_set_cpu_affinity
void RunModeErfFileRegister(void)
void OutputStreamingShutdown(void)
int(* RunModeIsIPSEnabled)(void)
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
const char * thread_name_flow_mgr
const char * RunModeErfFileGetDefaultMode(void)
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
void OutputTxShutdown(void)
void TmqhFlowPrintAutofpHandler(void)
void RunModeIdsAFPRegister(void)
int ParseSizeStringU64(const char *size, uint64_t *res)
struct HtpBodyChunk_ * next
void BypassedFlowManagerThreadSpawn(void)
spawn the flow bypass manager thread
void RunModeShutDown(void)
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
const char * thread_name_counter_stats
int SCOutputRegisterStreamingLogger(LoggerId id, const char *name, SCStreamingLogger LogFunc, void *initdata, enum SCOutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a streaming logger.
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
const char * RunModeAFPGetDefaultMode(void)
const char * thread_name_flow_rec
void OutputFiledataShutdown(void)
const char * RunModeFilePcapGetDefaultMode(void)
#define TAILQ_FOREACH(var, head, field)
const char * thread_name_autofp
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
void OutputSetupActiveLoggers(void)
const char * RunModeIdsNflogGetDefaultMode(void)
void OutputStatsShutdown(void)
#define TAILQ_INSERT_TAIL(head, elm, field)
char * RunmodeGetActive(void)
OutputInitSubFunc InitSubFunc
int SCOutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow logger.
struct RunModes_ RunModes
PacketLogger PacketLogFunc
void TmValidateQueueState(void)
Checks if all the queues allocated so far have at least one reader and writer.
const char * RunModeAFXDPGetDefaultMode(void)
bool IsRunModeOffline(enum RunModes run_mode_to_check)
SCFiledataLogger FiledataLogFunc
void RunModeInitializeOutputs(void)
int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
const char * thread_name_single
const char *(* GetDefaultMode)(void)
int ConfValIsTrue(const char *val)
Check if a value is true.
void OutputClearActiveLoggers(void)
size_t strlcpy(char *dst, const char *src, size_t siz)
#define TAILQ_ENTRY(type)
const char * RunModeUnixSocketGetDefaultMode(void)
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
void RunModeIpsNFQRegister(void)
enum SCOutputStreamingType stream_type
void RunModeInitializeThreadSettings(void)
ThreadInitFunc ThreadInit
const char * RunModeDpdkGetDefaultMode(void)
#define TAILQ_HEAD_INITIALIZER(head)
bool IsRunModeSystem(enum RunModes run_mode_to_check)
OutputModuleList output_modules
#define TAILQ_REMOVE(head, elm, field)
#define TAILQ_FIRST(head)
const char * thread_name_flow_bypass
ThreadDeinitFunc ThreadDeinit
void RunModeListRunmodes(void)
Lists all registered runmodes.
bool g_filedata_logger_enabled
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), int(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
uint64_t threading_set_stack_size
void RunModeEnablesBypassManager(void)
void OutputPacketShutdown(void)
void RunModeIdsNflogRegister(void)
Holds description for a runmode.
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
void RunModeIpsIPFWRegister(void)
SCStreamingLogger StreamingLogFunc
#define SCLogWarning(...)
Macro used to log WARNING messages.
const char * RunModeErfDagGetDefaultMode(void)
int SCOutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, void *initdata, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a transaction logger.
const char * thread_name_detect_loader
void OutputFileShutdown(void)
void FlowRecyclerThreadSpawn(void)
spawn the flow recycler thread
void RunModeErfDagRegister(void)
struct RunMode_ RunMode
Holds description for a runmode.
int SCOutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet logger.
int SCOutputRegisterFileLogger(LoggerId id, const char *name, SCFileLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file logger.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
void RunModeIpsWinDivertRegister(void)
#define SCRealloc(ptr, sz)
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
void RunModeIdsAFXDPRegister(void)
int ConfGetFloat(const char *name, float *val)
Retrieve a configuration value as a float.
TxLoggerCondition TxLogCondition
void RunModeUnixSocketRegister(void)
void LogFlushThreads(void)
void(* DeInit)(struct OutputCtx_ *)
const char * thread_name_heartbeat
#define FatalErrorOnInit(...)
Fatal error IF we're starting up, and configured to consider errors to be fatal errors.
void StatsSpawnThreads(void)
Spawns the wakeup, and the management thread used by the stats api.
int RunModeNeedsBypassManager(void)
bool g_file_logger_enabled
void RunModeIdsPcapRegister(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
void RunModeFilePcapRegister(void)
PacketLogCondition PacketConditionFunc
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
const char * RunModeNetmapGetDefaultMode(void)
const char * RunModeIpsNFQGetDefaultMode(void)
@ RUNMODE_ENGINE_ANALYSIS
#define SCLogError(...)
Macro used to log ERROR messages.
void RunModeIdsNetmapRegister(void)
struct OutputFreeList_ OutputFreeList
const char * thread_name_verdict
void RunModeDpdkRegister(void)
#define TAILQ_HEAD(name, type)
void OutputFlowShutdown(void)
int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
int SCOutputRegisterFiledataLogger(LoggerId id, const char *name, SCFiledataLogger LogFunc, void *initdata, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file-data logger.
const char * thread_name_unix_socket
OutputModule * output_module
const char * RunModeGetMainMode(void)
int RunModeOutputFiledataEnabled(void)
int LiveGetDeviceCount(void)
Get the number of registered devices.
#define SCLogNotice(...)
Macro used to log NOTICE messages.
void UtRunModeRegister(void)
const char * RunModeIpsWinDivertGetDefaultMode(void)
SCCapturePlugin * SCPluginFindCaptureByName(const char *name)
float threading_detect_ratio
const char * RunModeIdsGetDefaultMode(void)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.