reorg: modular file reorganization of C source code - v10

[jasonish]

Continuation of #9973.

Some tests still fail:

• The template tests, fixing the template generation will need to be done manually, so will wait til we're 100% on the layout
• Example plugin with standalone makefile as devel headers aren't installed correctly. This will probably have to be a manual update to the Makefile(s)
• Somethings else are bound to fail.

Tasks:

• app-layer/
• output/eve
• output/
• util/
• util/mpm/
• sources/
• detect/engine
• detect/

The clang-format check will fail. I'm using clang-format-14, the CI check
depends on clang-format-9. See: #9984

Closes #9973.

[suricata-qa]

ERROR:

ERROR: QA failed on build_asan.

Pipeline 17008

[victorjulien]

There is some logging code that relies on (parsing) the source code filename, have you looked at how that would work now?

[jasonish]

There is some logging code that relies on (parsing) the source code filename, have you looked at how that would work now?

This logging seems fine:

Perf: af-packet: enp10s0: (W#01-enp10s0) kernel: Packets 316449, dropped 104548 [ReceiveAFPThreadExitStats:source/af-packet/source-af-packet.c:2601]
Perf: af-packet: enp10s0: (W#02-enp10s0) kernel: Packets 198017, dropped 20193 [ReceiveAFPThreadExitStats:source/af-packet/source-af-packet.c:2601]
Perf: af-packet: enp10s0: (W#03-enp10s0) kernel: Packets 596661, dropped 257360 [ReceiveAFPThreadExitStats:source/af-packet/source-af-packet.c:2601]
Perf: af-packet: enp10s0: (W#04-enp10s0) kernel: Packets 174038, dropped 11683 [ReceiveAFPThreadExitStats:source/af-packet/source-af-packet.c:2601]

is there other logging that does filename parsing?

[jasonish]

Hmm, the -DSCFILENAME set by the Makefile is off:

gcc -DHAVE_CONFIG_H -I. -I./../libhtp/ -I/usr/include/hs -D__SCFILENAME__="parser" -march=native -Wextra -Werror-implicit-function-declaration -I/usr/include -DLOCAL_STATE_DIR="/opt/suricata/8.0.0-dev/var" -Wall -Wno-unused-parameter -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char -ggdb -O0 -fno-common -Wall -Wextra -Wchar-subscripts -Wno-unused-parameter -Wno-unused-function -Wno-deprecated-declarations -ggdb3 -O0 -fsanitize=address -fno-omit-frame-pointer -fno-inline -fPIC -std=c11 -march=native -I./../rust/gen -I./../rust/dist -MT app-layer/mqtt/parser.o -MD -MP -MF $depbase.Tpo -c -o app-layer/mqtt/parser.o app-layer/mqtt/parser.c &&\

And: https://github.com/OISF/suricata/blob/master/src/util-debug.c#L281

TODO:

• Use full filename in SCFILENAME
• Modify module name to handle paths

[jasonish]

I think there is some more thought required here... Take 2 examples that adapt well:

• app-layer/dnp3/parser.c
• source/af-packet/runmode.c
  We could simply take up to the last '/' as the module name resulting in:
• app-layer/dnp3
• source/af-packet

But if you apply the same logic to something like util/ioctl.c we end up with:

Info: util: enp10s0: MTU 1500 [GetIfaceMTU:util/ioctl.c:99]

instead of the current module name of ioctl which makes more sense:

Info: ioctl: enp10s0: MTU 1500 [GetIfaceMTU:util/ioctl.c:99]

If there is only one / in the name maybe we could retain it, if there are 2+, we just retain the last 2 components?

[jasonish]

Logging fixups: #10041