pcap-file: skip setvbuf on non-seekable streams (v2)

[ssam18]

Make sure these boxes are checked accordingly before submitting your Pull Request -- thank you.

Contribution style:

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Our Contribution agreements:

• I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)

Changes (if applicable):

• I have updated the User Guide (in doc/userguide/) to reflect the changes made
• I have updated the JSON schema (in etc/schema.json) to reflect all logging changes
  (including schema descriptions)
• I have created a ticket at
  https://redmine.openinfosecfoundation.org/projects/suricata/issues

Link to ticket: https://redmine.openinfosecfoundation.org/issues/8464

Replaces #15384 (auto-closed because the branch was updated after the PR was opened).

Changes since #15384

• Parse-error handling: when pcap-file.buffer-size fails to parse, the default buffer size is now retained instead of falling through and silently setting it to 0. The branches are mutually exclusive (else if) so only one of the parse-error / accepted / out-of-range messages is logged. (Addresses @jlucovsky's review.)
• User Guide updated: --pcap-file-buffer-size now documents 0 to 64 MiB (0 disables setvbuf), and pcap-file.rst notes that buffer-size: 0 is the explicit opt-out for non-seekable sources such as stdin and named pipes. (Addresses @jlucovsky's doc comment.)

Description

Reading a pcap from /dev/stdin or a named pipe regressed in 8.0.0 with the setvbuf change in 7b730c2 and currently fails with failed to get first packet timestamp. pcap_next_ex(): -1. The reason is that InitPcapFile calls setvbuf on the FILE* underlying the pcap handle after libpcap has already consumed the pcap header, and on a non seekable fd glibc cannot recover from that and the very next read returns -1. This change detects non regular files via fstat on the underlying fd and skips setvbuf for that handle, so reading from stdin, named pipes, and other non seekable sources keeps working. It also lowers PCAP_FILE_BUFFER_SIZE_MIN to 0 so pcap-file.buffer-size = 0 stays available as an explicit opt out, matching the workaround proposed on the ticket.

Describe changes:

• In InitPcapFile, fstat the fd behind pcap_file(handle) and skip setvbuf when the file is not a regular file. An info log explains the skip.
• Lower PCAP_FILE_BUFFER_SIZE_MIN from 4096 to 0 so users can opt out of setvbuf explicitly via pcap-file.buffer-size = 0.
• On a buffer-size parse error, retain the default instead of setting it to 0.
• Verified locally that tcpdump piping a pcap into /dev/stdin and reading from a named pipe both now complete with 2 packets read and 0 errors. Regular file reads are unchanged.

SV_BRANCH=OISF/suricata-verify#3108

[jlucovsky]

I think the values accepted for the buffer size should be
0 - disable standard buffering
4096 - PCAP_FILE_BUFFER_SIZE_MAX: buffering length set

[ssam18]

Thanks for the review @jlucovsky. All three comments are addressed in the v3 PR #15629. Closing in favor of #15629.