pcap-file: skip setvbuf on non-seekable streams (v3)

[ssam18]

Make sure these boxes are checked accordingly before submitting your Pull Request -- thank you.

Contribution style:

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Our Contribution agreements:

• I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)

Changes (if applicable):

• I have updated the User Guide (in doc/userguide/) to reflect the changes made
• I have updated the JSON schema (in etc/schema.json) to reflect all logging changes
  (including schema descriptions)
• I have created a ticket at
  https://redmine.openinfosecfoundation.org/projects/suricata/issues

Link to ticket: https://redmine.openinfosecfoundation.org/issues/8464

Replaces #15562.

Changes since #15562 (all addressing @jlucovsky's review)

• Accepted pcap-file.buffer-size values are now exactly 0 (disables setvbuf buffering) or PCAP_FILE_BUFFER_SIZE_MIN (4 KiB) to PCAP_FILE_BUFFER_SIZE_MAX (64 MiB); values in between are rejected with a warning naming both valid forms.
• PCAP_FILE_BUFFER_SIZE_MIN is restored to 4096U and referenced again by the validation.
• The setvbuf return value is checked with != 0 since any non-zero value (not just negative) indicates an error.
• When buffering is disabled via 0, the log now says so explicitly instead of "will use 0 buffer size".
• User Guide updated to document the valid values as 0 or 4 KiB to 64 MiB.
• Rebased on current main.

Description

Reading a pcap from /dev/stdin or a named pipe regressed in 8.0.0 with the setvbuf change in 7b730c2 and currently fails with failed to get first packet timestamp. pcap_next_ex(): -1. The reason is that InitPcapFile calls setvbuf on the FILE* underlying the pcap handle after libpcap has already consumed the pcap header, and on a non seekable fd glibc cannot recover from that and the very next read returns -1. This change detects non regular files via fstat on the underlying fd and skips setvbuf for that handle, so reading from stdin, named pipes, and other non seekable sources keeps working. pcap-file.buffer-size = 0 remains available as an explicit opt out, matching the workaround proposed on the ticket.

Describe changes:

• In InitPcapFile, fstat the fd behind pcap_file(handle) and skip setvbuf when the file is not a regular file. An info log explains the skip.
• Accept buffer-size 0 as an explicit setvbuf opt-out while keeping the 4 KiB minimum for actual buffering lengths.
• On a buffer-size parse error, retain the default instead of setting it to 0.
• Treat any non-zero setvbuf return value as an error.
• Verified locally that tcpdump piping a pcap into /dev/stdin and reading from a named pipe both now complete with 2 packets read and 0 errors. Regular file reads are unchanged.

SV_BRANCH=OISF/suricata-verify#3108

[jlucovsky]

Looks good

Minor but important -- please adjust the copyright dates in all source modules to include 2026.

[ssam18]

Thanks @jlucovsky — copyright dates updated to include 2026 in the v4 PR #15631 (source-pcap-file.c was still 2007-2016; the helper already had 2026). Closing in favor of #15631.