From 5f516c58969566875187037e58342f2b36a6239b Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Thu, 11 Jul 2024 12:39:47 -0600 Subject: [PATCH] doc: add pf-ring plugin upgrade notes Ticket: #7162 --- doc/userguide/upgrade.rst | 2 + doc/userguide/upgrade/8.0-pfring-plugin.rst | 43 +++++++++++++++++++++ 2 files changed, 45 insertions(+) create mode 100644 doc/userguide/upgrade/8.0-pfring-plugin.rst diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst index 3748c1f403..4aadb978e1 100644 --- a/doc/userguide/upgrade.rst +++ b/doc/userguide/upgrade.rst @@ -68,6 +68,8 @@ Major changes - DNS logging has been modified to be more consistent across requests, responses and alerts. See :doc:`DNS Logging Changes for 8.0 `. +- PF_RING support has been moved to a plugin. See :doc:`PF_RING plugin + `. Upgrading 6.0 to 7.0 -------------------- diff --git a/doc/userguide/upgrade/8.0-pfring-plugin.rst b/doc/userguide/upgrade/8.0-pfring-plugin.rst new file mode 100644 index 0000000000..10632ea8ba --- /dev/null +++ b/doc/userguide/upgrade/8.0-pfring-plugin.rst @@ -0,0 +1,43 @@ +:orphan: Document only referenced from upgrade.rst + +PF_RING as a Plugin +=================== + +Suricata 8.0 moves PF_RING support to a dynamically loaded plugin. For +convenience, this plugin is still bundled with Suricata, but it may be +removed from the Suricata source tree into its own repository in a +future release. + +Upgrading +--------- + +Suricata 8.0 continues to respect the ``--enable-pfring`` compile time +option, as well as the ``--pfring*`` command line options, and also +the ``pfring`` section of the configuration file. + +.. note:: When the PF_RING plugin is eventually removed from the + Suricata source tree these options may be removed and/or + changed as this would allow the PF_RING plugin to have its + own release cycle and make changes independent of Suricata. + +However, the ``pfring`` plugin must be loaded before it can be +used. If doing a fresh build of Suricata with PF_RING support, the +``suricata.yaml`` configuration file should be configured to load the +plugin already, for example:: + + plugins: + - /usr/lib/suricata/pfring.so + +If you are upgrading, you will need to add the location of +``pfring.so`` to the ``plugins`` section of your ``suricata.yaml`` +manually. + +Then your existing PF_RING command line options and configuration +should continue to work. + +Caveats +------- + +Currently builing the PF_RING plugin is not compatible with the +``--disable-shared`` configure argument. + -- 2.47.3