detect: make multi tenancy a global switch

At start up we will set this flag based on "multi-detect.enabled".

diff --git a/src/detect-engine.c b/src/detect-engine.c
index b83e5e64759a03cd3d6d9e1285878d2fc27f36da..61c740922856bd8cc73d91e61b86b7b781ab1463 100644 (file)
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -103,7 +103,7 @@ static DetectEngineThreadCtx *DetectEngineThreadCtxInitForReload(
 
 static uint8_t DetectEngineCtxLoadConf(DetectEngineCtx *);
 
-static DetectEngineMasterCtx g_master_de_ctx = { SCMUTEX_INITIALIZER, NULL, NULL, };
+static DetectEngineMasterCtx g_master_de_ctx = { SCMUTEX_INITIALIZER, 0, NULL, NULL, };
 
 static DetectEngineThreadCtx *DetectEngineThreadCtxInitForMT(ThreadVars *tv);
 
@@ -1658,6 +1658,25 @@ DetectEngineCtx *DetectEngineReference(DetectEngineCtx *de_ctx)
     return de_ctx;
 }
 
+/** TODO locking? Not needed if this is a one time setting at startup */
+int DetectEngineMultiTenantEnabled(void)
+{
+    DetectEngineMasterCtx *master = &g_master_de_ctx;
+    return (master->multi_tenant_enabled);
+}
+
+void DetectEngineMultiTenantSetup(void)
+{
+    DetectEngineMasterCtx *master = &g_master_de_ctx;
+    int enabled = 0;
+    (void)ConfGetBool("multi-detect.enabled", &enabled);
+    if (enabled == 1) {
+        master->multi_tenant_enabled = 1;
+    }
+    SCLogInfo("multi-detect is %s (multi tenancy)",
+            master->multi_tenant_enabled ? "enabled" : "disabled");
+}
+
 DetectEngineCtx *DetectEngineGetByTenantId(int tenant_id)
 {
     DetectEngineMasterCtx *master = &g_master_de_ctx;

diff --git a/src/detect-engine.h b/src/detect-engine.h
index 01c0b858769ba705c1152d6fb1eb7bdeff831e44..70f5f1f758cbde741b955457351286fa1e0f1122 100644 (file)
--- a/src/detect-engine.h
+++ b/src/detect-engine.h
@@ -78,6 +78,8 @@ void DetectEngineDeReference(DetectEngineCtx **de_ctx);
 int DetectEngineReload(const char *filename);
 int DetectEngineEnabled(void);
 int DetectEngineMTApply(void);
+int DetectEngineMultiTenantEnabled(void);
+void DetectEngineMultiTenantSetup(void);
 
 int DetectEngineReloadStart(void);
 int DetectEngineReloadIsStart(void);

diff --git a/src/detect.h b/src/detect.h
index 7cca9ffe265028c10fe5ff42d0d341db84b8151a..7095eec82ca71dbb68db31674730f44cf298dfd3 100644 (file)
--- a/src/detect.h
+++ b/src/detect.h
@@ -1047,6 +1047,9 @@ typedef struct SigGroupHead_ {
 typedef struct DetectEngineMasterCtx_ {
     SCMutex lock;
 
+    /** enable multi tenant mode */
+    int multi_tenant_enabled;
+
     /** list of active detection engines. This list is used to generate the
      *  threads det_ctx's */
     DetectEngineCtx *list;

diff --git a/src/runmode-unix-socket.c b/src/runmode-unix-socket.c
index 2a0d651a2d8517771069ef6405ce66d1bb2b8a47..75ab1eed3674f5687560f975ac1a860eb6f04bdd 100644 (file)
--- a/src/runmode-unix-socket.c
+++ b/src/runmode-unix-socket.c
@@ -418,6 +418,12 @@ TmEcode UnixSocketRegisterTenant(json_t *cmd, json_t* answer, void *data)
     struct stat st;
 #endif /* OS_WIN32 */
 
+    if (!(DetectEngineMultiTenantEnabled())) {
+        SCLogInfo("error: multi-tenant support not enabled");
+        json_object_set_new(answer, "message", json_string("multi-tenant support not enabled"));
+        return TM_ECODE_FAILED;
+    }
+
     /* 1 get tenant id */
     json_t *jarg = json_object_get(cmd, "id");
     if (!json_is_integer(jarg)) {
@@ -498,6 +504,12 @@ TmEcode UnixSocketRegisterTenant(json_t *cmd, json_t* answer, void *data)
  */
 TmEcode UnixSocketUnregisterTenant(json_t *cmd, json_t* answer, void *data)
 {
+    if (!(DetectEngineMultiTenantEnabled())) {
+        SCLogInfo("error: multi-tenant support not enabled");
+        json_object_set_new(answer, "message", json_string("multi-tenant support not enabled"));
+        return TM_ECODE_FAILED;
+    }
+
     /* 1 get tenant id */
     json_t *jarg = json_object_get(cmd, "id");
     if (!json_is_integer(jarg)) {

diff --git a/src/suricata.c b/src/suricata.c
index e571c796bc15acad28d1ea70cf4e80665f34f5a3..7c661e1938ac64c0c30f7bb49c52c1029d4028fa 100644 (file)
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -2270,6 +2270,7 @@ int main(int argc, char **argv)
     if (!suri.disabled_detect) {
         SCClassConfInit();
         SCReferenceConfInit();
+        DetectEngineMultiTenantSetup();
         SetupDelayedDetect(&suri);
         if (!suri.delayed_detect) {
             de_ctx = DetectEngineCtxInit();