pcap-file: skip setvbuf on non-seekable streams (v4)

[ssam18]

Make sure these boxes are checked accordingly before submitting your Pull Request -- thank you.

Contribution style:

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Our Contribution agreements:

• I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)

Changes (if applicable):

• I have updated the User Guide (in doc/userguide/) to reflect the changes made
• I have updated the JSON schema (in etc/schema.json) to reflect all logging changes
  (including schema descriptions)
• I have created a ticket at
  https://redmine.openinfosecfoundation.org/projects/suricata/issues

Link to ticket: https://redmine.openinfosecfoundation.org/issues/8464

Replaces #15629.

Changes since #15629

• Copyright dates in the touched source modules now include 2026 (source-pcap-file.c was still 2007-2016; source-pcap-file-helper.c already included 2026). (Addresses @jlucovsky's review.)

Description

Reading a pcap from /dev/stdin or a named pipe regressed in 8.0.0 with the setvbuf change in 7b730c2 and currently fails with failed to get first packet timestamp. pcap_next_ex(): -1. The reason is that InitPcapFile calls setvbuf on the FILE* underlying the pcap handle after libpcap has already consumed the pcap header, and on a non seekable fd glibc cannot recover from that and the very next read returns -1. This change detects non regular files via fstat on the underlying fd and skips setvbuf for that handle, so reading from stdin, named pipes, and other non seekable sources keeps working. pcap-file.buffer-size = 0 remains available as an explicit opt out, matching the workaround proposed on the ticket.

Describe changes:

• In InitPcapFile, fstat the fd behind pcap_file(handle) and skip setvbuf when the file is not a regular file. An info log explains the skip.
• Accept buffer-size 0 as an explicit setvbuf opt-out while keeping the 4 KiB minimum for actual buffering lengths.
• On a buffer-size parse error, retain the default instead of setting it to 0.
• Treat any non-zero setvbuf return value as an error.
• Verified locally that tcpdump piping a pcap into /dev/stdin and reading from a named pipe both now complete with 2 packets read and 0 errors. Regular file reads are unchanged.

SV_BRANCH=OISF/suricata-verify#3108

[codecov]

Codecov Report

❌ Patch coverage is 42.10526% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.88%. Comparing base (8a4eea4) to head (e8c784c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #15631   +/-   ##
=======================================
  Coverage   82.87%   82.88%           
=======================================
  Files        1006     1006           
  Lines      273527   273538   +11     
=======================================
+ Hits       226698   226716   +18     
+ Misses      46829    46822    -7     

Flag	Coverage Δ
fuzzcorpus	61.36% <36.84%> (-0.01%)	⬇️
livemode	18.41% <0.00%> (+<0.01%)	⬆️
netns	22.82% <0.00%> (+0.03%)	⬆️
pcap	45.18% <36.84%> (-0.04%)	⬇️
suricata-verify	66.64% <42.10%> (-0.03%)	⬇️
unittests	58.52% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[victorjulien]

Merged in #15636, thanks!