Packets received in segmented mbufs that cannot be linearized are
inspected as a copy. In the copy modes (IPS/TAP), modifications made to
the copy (inline stream normalization, the replace keyword) did not
reach the mbufs, so the unmodified packet was forwarded. Chains larger
than the maximum packet size were truncated for inspection but
forwarded in full, and chains that could not be copied were forwarded
uninspected.
When Suricata modifies a copied packet, it now writes the data back to
the mbuf chain before transmitting it. Chains that cannot be inspected
in full or transmitted are dropped: chains larger than the maximum
packet size, chains with more segments than the copy interface can
transmit, and malformed chains.
Forwarding chains requires the multi-segment TX offload, which replaces
MBUF_FAST_FREE and selects a slower TX path on some NICs. As mbufs sized
from the MTU rarely lead to chains on physical NICs, forwarding them is
opt-in through the new tx-segmented-mbufs interface setting (default
false), which both copy interfaces must share. Without it, chains that
cannot be linearized are dropped in the copy modes.
The drops are counted in capture.dpdk.segmented_drops and
capture.dpdk.segmented_too_large. In IPS mode, they are also counted in
ips.blocked with the new capture_error drop reason, so that the drop
reasons explain the blocked packets.
Ticket: 6012
Reading a pcap from /dev/stdin or a named pipe currently fails with "failed to get first packet timestamp. pcap_next_ex(): -1" because InitPcapFile calls setvbuf on the FILE* underlying the pcap handle after libpcap has already consumed the pcap header. On a non-seekable fd glibc cannot recover from that and the next read returns -1.
Detect non-regular files via fstat and skip setvbuf in that case so the read keeps working on pipes, fifos and stdin.
Accept pcap-file.buffer-size values of 0, which disables setvbuf buffering as an explicit opt-out, or PCAP_FILE_BUFFER_SIZE_MIN (4 KiB) to PCAP_FILE_BUFFER_SIZE_MAX (64 MiB). Treat any non-zero setvbuf return value as an error, not just negative values.
When pcap-file.buffer-size fails to parse, retain the default buffer size instead of falling through and setting it to 0. The branches are now mutually exclusive so only one of the parse-error, accepted, or out-of-range messages is logged.
Update the user guide: --pcap-file-buffer-size now documents valid values of 0 (disables setvbuf buffering) or 4 KiB to 64 MiB, and pcap-file.rst notes that 0 is the opt-out for non-seekable sources such as stdin and named pipes.
Bug: #8464.
Refactor pcap file deletion to use a single delete-when-done option
with three values instead of separate boolean options:
- false (default): No deletion
- true: Always delete files
- "non-alerts": Delete only files with no alerts
Also account for alerts produced by pseudo packets (flow timeout / shutdown flush):
- Introduce small capture hooks and invoke on pseudo-packet creation so the
capture layer can retain references and observe alerts emitted after the last
live packet
- Call the hook from both TmThreadDisableReceiveThreads and TmThreadDrainPacketThreads
Key changes:
- Replace should_delete/delete_non_alerts_only bools with enum
- Move alert counter from global to per-file PcapFileFileVars
- Relocate alert counting from PacketAlertFinalize to pcap module
- Ensure thread safety for both single and continuous pcap modes
- Add unit tests for configuration parsing and pseudo-packet alert path
The --pcap-file-delete command line option overrides YAML config
and forces "always delete" mode for backward compatibility.
Documentation updated to reflect the new three-value configuration.
Fixes OISF#7786
Provide backward compatibility with the previous configuration
format to allow smooth transition to the new format.
The commit adds docs about the new format and the introduced changes.
ICE card (Intel E810) was not receiving packets immediatelly
after startup, Suricata workers would act as processing while
it was not. This eliminates the problem by only continuing
in the initialization if the link is already up.
The setting can be turned off manually from the configuraiton
file.
Ticket: 7381
When the packet load is low, Suricata can run in interrupt
mode. This more resembles the classic approach of processing
packets - CPU cores run low and only fetch packets
on interrupt.
Ticket: #5839
Previous integration of hugepage analysis only fetched data
from /proc/meminfo. However this proved to be often
deceiving mainly for providing only global information and
not taking into account different hugepage sizes (e.g. 1GB
hugepages) and different NUMA nodes.
Ticket: #6419
Lukas Sismis
Samaresh Kumar Singh
jason taylor
Philippe Antoine
Juliana Fajardini
Ofer Dagan
Victor Julien
Lukas Sismis
Jason Ish
Ralph Eastwood
John Dewey
Richard McConnell
Phil Young
Jeff Lucovsky
Odin Jenseg
Eric Leblond
Hilko Bengen
Eloïse Brocas