Testimony feature 3675 v3

[MalakhatkoVadym]

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3675

Describe changes:

• Adds testimony packet source to suricata

Testimony is a single-machine, multi-process architecture for sharing AF_PACKET data across processes.
https://github.com/google/testimony

Modifies #4923 by adding placeholders for TmModuleReceiveTestimonyRegister and TmModuleDecodeTestimonyRegister functions if testimony is not enabled and adding hints for user if --testimony option is present but testimony is disabled.

Testing

I tested with 2 testimonyd's running:

sudo testimonyd --config=/etc/testimony.conf

[
  {
      "SocketName": "/tmp/testimony.sock"
    , "Interface": "eth0"
    , "BlockSize": 1048576
    , "NumBlocks": 16
    , "FanoutSize": 4
    , "BlockTimeoutMillis": 1000
    , "User": "root"
  }
]

interface - "eth0"
socket path - "/tmp/testimony.sock"
Fanout size - "4" (packets are balanced between 4 memory blocks, so suricata can use receive thread for each memory block).

sudo testimonyd --config=/etc/testimony2.conf

[
  {
      "SocketName": "/tmp/testimony2.sock"
    , "Interface": "eth1"
    , "BlockSize": 1048576
    , "NumBlocks": 16
    , "BlockTimeoutMillis": 1000
    , "FanoutSize": 1
    , "User": "root"
  }
]

interface - "eth1"
socket path - "/tmp/testimony2.sock"
Fanout size - "1" (packets are not balanced between memory blocks).

sudo suricata -c /etc/suricata/suricata.yaml -k none --testimony=/tmp/testimony.sock --testimony=/tmp/testimony2.sock

suricata.yaml :

testimony:
  - socket: /tmp/testimony.sock
    fanout-size: 4