Previous commits have considerabily empowered the "single" mode which
could contain multiple threads. This behaviour was not a target for
this runmode and the following patch remedies to the situation by
introducing the "workers" mode where each thread do all the tasks
from acquisition to logging. This runmode is currently implemented
for af-packet and pf-ring.
A devide configuration can be used by multiple threads. It is thus
necessary to wait that all threads stop using the configuration before
freeing it. This patch introduces an atomic counter and a free function
which has to be called by each thread when it will not use anymore
the structure. If the configuration is not used anymore, it is freed
by the free function.
This patch adds a --pcap option which can be used to select or
an interface if an argument is provided or the interfaces defined
in the configuration file.
This patch convert pfring to pktacqloop and use the new factorisation
function. This also fixes commmand line parsing of pfring which is now
able to work like af-packet:
- 'suricata -c s.yaml --pfring' start suricata with all interfaces in
conf
- 'suricata -c s.yaml --pfring=eth2' start suricata on eth2
Generated documentation for unittests and other module was not
generated because doxygen was not assuming the define to be set.
This patch adds the necessary define for unittests and does the
same for NFQ, PFRING, IPFW, AF_PACKET and Prelude. This also adds
a variable that permit parallelisation of dot file generation.
Major fixes for the tag subsystem:
- Removed TimeGet call from tag packet runtime to safe a gettimeofday
- Removed unused lock from data type
- Fixed broken first packet skip logic
- Fix broken reference counter logic
- Fix memory leak on tag expiration
- Cleaned up code