suricata
suricata.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "conf.h"
#include "conf-yaml-loader.h"
#include "decode.h"
#include "defrag.h"
#include "flow.h"
#include "stream-tcp.h"
#include "ippair.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-address.h"
#include "detect-engine-alert.h"
#include "detect-engine-port.h"
#include "detect-engine-tag.h"
#include "detect-engine-threshold.h"
#include "detect-fast-pattern.h"
#include "datasets.h"
#include "feature.h"
#include "flow-bypass.h"
#include "flow-manager.h"
#include "flow-timeout.h"
#include "flow-worker.h"
#include "flow-bit.h"
#include "host-bit.h"
#include "ippair-bit.h"
#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "app-layer-htp-range.h"
#include "output.h"
#include "output-filestore.h"
#include "respond-reject.h"
#include "runmode-af-packet.h"
#include "runmode-af-xdp.h"
#include "runmode-netmap.h"
#include "runmode-unittests.h"
#include "source-nfq.h"
#include "source-nfq-prototypes.h"
#include "source-nflog.h"
#include "source-ipfw.h"
#include "source-pcap.h"
#include "source-pcap-file.h"
#include "source-pcap-file-helper.h"
#include "source-erf-file.h"
#include "source-erf-dag.h"
#include "source-af-packet.h"
#include "source-af-xdp.h"
#include "source-netmap.h"
#include "source-dpdk.h"
#include "source-windivert.h"
#include "source-windivert-prototypes.h"
#include "unix-manager.h"
#include "util-classification-config.h"
#include "util-threshold-config.h"
#include "util-reference-config.h"
#include "tmqh-packetpool.h"
#include "tm-queuehandlers.h"
#include "util-byte.h"
#include "util-conf.h"
#include "util-coredump-config.h"
#include "util-cpu.h"
#include "util-daemon.h"
#include "util-device.h"
#include "util-dpdk.h"
#include "util-ebpf.h"
#include "util-exception-policy.h"
#include "util-host-os-info.h"
#include "util-hugepages.h"
#include "util-ioctl.h"
#include "util-landlock.h"
#include "util-macset.h"
#include "util-misc.h"
#include "util-mpm-hs.h"
#include "util-path.h"
#include "util-pidfile.h"
#include "util-plugin.h"
#include "util-privs.h"
#include "util-profiling.h"
#include "util-proto-name.h"
#include "util-running-modes.h"
#include "util-signal.h"
#include "util-time.h"
#include "util-validate.h"
#include "util-var-name.h"
#include "build-info.h"

Go to the source code of this file.

Macros

#define DEFAULT_MAX_PENDING_PACKETS   1024
 

Functions

 SC_ATOMIC_DECLARE (unsigned int, engine_stage)
 
int SuriHasSigFile (void)
 
int EngineModeIsUnknown (void)
 
int EngineModeIsIPS (void)
 
int EngineModeIsIDS (void)
 
void EngineModeSetIPS (void)
 
void EngineModeSetIDS (void)
 
int RunmodeIsUnittests (void)
 
int SCRunmodeGet (void)
 Get the current run mode. More...
 
void SCRunmodeSet (int run_mode)
 Set the current run mode. More...
 
void GlobalsInitPreConfig (void)
 
void GlobalsDestroy (void)
 
void EngineStop (void)
 make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be able to tell the engine the file eof is reached. More...
 
void EngineDone (void)
 Used to indicate that the current task is done. More...
 
void RegisterAllModules (void)
 
TmEcode SCLoadYamlConfig (void)
 
const char * GetDocURL (void)
 
const char * GetProgramVersion (void)
 get string with program version More...
 
TmEcode SCParseCommandLine (int argc, char **argv)
 
void PreRunInit (const int runmode)
 
void PreRunPostPrivsDropInit (const int runmode)
 
void PostRunDeinit (const int runmode, struct timeval *start_time)
 clean up / shutdown code for packet modes More...
 
int SCStartInternalRunMode (int argc, char **argv)
 
int SCFinalizeRunMode (void)
 
void PostConfLoadedDetectSetup (SCInstance *suri)
 
int PostConfLoadedSetup (SCInstance *suri)
 
void SuricataMainLoop (void)
 
int InitGlobal (void)
 Global initialization common to all runmodes. More...
 
void SuricataPreInit (const char *progname)
 
void SuricataInit (void)
 
void SuricataShutdown (void)
 
void SuricataPostInit (void)
 

Variables

volatile sig_atomic_t sigint_count = 0
 
volatile sig_atomic_t sighup_count = 0
 
volatile sig_atomic_t sigterm_count = 0
 
volatile sig_atomic_t sigusr2_count = 0
 
volatile uint8_t suricata_ctl_flags = 0
 
uint8_t host_mode = SURI_HOST_IS_SNIFFER_ONLY
 
uint32_t max_pending_packets
 
int g_detect_disabled = 0
 
bool sc_set_caps = false
 
bool g_system = false
 
int g_disable_randomness = 0
 
uint16_t g_vlan_mask = 0xffff
 
uint16_t g_livedev_mask = 0xffff
 
uint8_t g_recurlvl_mask = 0xff
 
bool g_disable_hashing = false
 
SystemHugepageSnapshotprerun_snap = NULL
 
bool g_stats_eps_per_app_proto_errors = false
 
SCInstance suricata
 
int coverage_unittests
 
int g_ut_modules
 
int g_ut_covered
 
int g_skip_prefilter
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file suricata.c.

Macro Definition Documentation

◆ DEFAULT_MAX_PENDING_PACKETS

#define DEFAULT_MAX_PENDING_PACKETS   1024

Definition at line 167 of file suricata.c.

Function Documentation

◆ EngineDone()

void EngineDone ( void  )

Used to indicate that the current task is done.

This is mainly used by pcap-file to tell it has finished to treat a pcap files when running in unix-socket mode.

Definition at line 460 of file suricata.c.

References suricata_ctl_flags, and SURICATA_DONE.

◆ EngineModeIsIDS()

int EngineModeIsIDS ( void  )

Definition at line 238 of file suricata.c.

References DEBUG_VALIDATE_BUG_ON.

◆ EngineModeIsIPS()

int EngineModeIsIPS ( void  )

Definition at line 232 of file suricata.c.

References DEBUG_VALIDATE_BUG_ON.

Referenced by AlertJsonHeader(), CaptureStatsSetup(), CaptureStatsUpdate(), EveAddVerdict(), ExceptionPolicyParse(), FlowHandlePacketUpdate(), and StreamTcpInitConfig().

Here is the caller graph for this function:

◆ EngineModeIsUnknown()

int EngineModeIsUnknown ( void  )

Definition at line 227 of file suricata.c.

Referenced by PostConfLoadedSetup().

Here is the caller graph for this function:

◆ EngineModeSetIDS()

void EngineModeSetIDS ( void  )

Definition at line 249 of file suricata.c.

Referenced by ListAppLayerProtocols(), ListKeywords(), LLVMFuzzerTestOneInput(), PostConfLoadedSetup(), and RunUnittests().

Here is the caller graph for this function:

◆ EngineModeSetIPS()

void EngineModeSetIPS ( void  )

Definition at line 244 of file suricata.c.

◆ EngineStop()

void EngineStop ( void  )

make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be able to tell the engine the file eof is reached.

Definition at line 449 of file suricata.c.

References suricata_ctl_flags, and SURICATA_STOP.

Referenced by ReceiveErfFileLoop().

Here is the caller graph for this function:

◆ GetDocURL()

const char* GetDocURL ( void  )

Definition at line 1111 of file suricata.c.

References DOC_URL, GetProgramVersion(), and PROG_VER.

Here is the call graph for this function:

◆ GetProgramVersion()

const char* GetProgramVersion ( void  )

get string with program version

Get the program version as passed to us from AC_INIT

Add 'RELEASE' is no '-dev' in the version. Add the REVISION if passed to us.

Possible outputs: release: '5.0.1 RELEASE' dev with rev: '5.0.1-dev (64a789bbf 2019-10-18)' dev w/o rev: '5.0.1-dev'

Definition at line 1132 of file suricata.c.

References PROG_VER, REVISION, and xstr.

Referenced by GetDocURL().

Here is the caller graph for this function:

◆ GlobalsDestroy()

◆ GlobalsInitPreConfig()

void GlobalsInitPreConfig ( void  )

Definition at line 362 of file suricata.c.

References SCProtoNameInit(), SCThresholdConfGlobalInit(), SupportFastPatternForSigMatchTypes(), and TimeInit().

Referenced by LLVMFuzzerTestOneInput(), RunUnittests(), and SuricataInit().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ InitGlobal()

int InitGlobal ( void  )

Global initialization common to all runmodes.

This can be used by fuzz targets.

Definition at line 2855 of file suricata.c.

References ConfInit(), ParseSizeInit(), RunModeRegisterRunModes(), SC_ATOMIC_INIT, SCLogError, SCLogInitLogModule(), SCSetThreadName, suricata_context, tmm_modules, TMM_SIZE, UtilSignalBlock(), UtilSignalHandlerSetup(), and VarNameStoreInit().

Referenced by LLVMFuzzerTestOneInput().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PostConfLoadedDetectSetup()

void PostConfLoadedDetectSetup ( SCInstance suri)

Definition at line 2532 of file suricata.c.

References de_ctx, and SCInstance_::disabled_detect.

◆ PostConfLoadedSetup()

◆ PostRunDeinit()

void PostRunDeinit ( const int  runmode,
struct timeval *  start_time 
)

clean up / shutdown code for packet modes

Shuts down packet modes, so regular packet runmodes and the per pcap mode in the unix socket.

Definition at line 2260 of file suricata.c.

References FlowDisableFlowManagerThread(), FlowWorkToDoCleanup(), PacketPoolInit(), RUNMODE_UNIX_SOCKET, TmThreadDisablePacketThreads(), TmThreadDisableReceiveThreads(), and TmThreadsUnsealThreads().

Referenced by SuricataShutdown().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PreRunInit()

◆ PreRunPostPrivsDropInit()

void PreRunPostPrivsDropInit ( const int  runmode)

Definition at line 2244 of file suricata.c.

References DatasetsInit(), RUNMODE_UNIX_SOCKET, RunModeInitializeOutputs(), StatsSetupPostConfigPostOutput(), and StatsSetupPostConfigPreOutput().

Here is the call graph for this function:

◆ RegisterAllModules()

◆ RunmodeIsUnittests()

◆ SC_ATOMIC_DECLARE()

SC_ATOMIC_DECLARE ( unsigned int  ,
engine_stage   
)

◆ SCFinalizeRunMode()

int SCFinalizeRunMode ( void  )

Definition at line 2365 of file suricata.c.

References SCInstance_::run_mode, RUNMODE_UNKNOWN, and suricata.

Referenced by main().

Here is the caller graph for this function:

◆ SCLoadYamlConfig()

TmEcode SCLoadYamlConfig ( void  )

Definition at line 958 of file suricata.c.

References SCInstance_::additional_configs, SCInstance_::conf_filename, ConfGetRootNode(), ConfYamlHandleInclude(), ConfYamlLoadFile(), DEFAULT_CONF_FILE, SCEnter, SCReturnInt, suricata, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by main().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SCParseCommandLine()

TmEcode SCParseCommandLine ( int  argc,
char **  argv 
)

◆ SCRunmodeGet()

int SCRunmodeGet ( void  )

Get the current run mode.

Definition at line 264 of file suricata.c.

References SCInstance_::run_mode, and suricata.

Referenced by ConfUnixSocketIsEnable(), DPDKCleanupEAL(), DPDKCloseDevice(), DPDKFreeDevice(), RunModeGetMainMode(), and SigLoadSignatures().

Here is the caller graph for this function:

◆ SCRunmodeSet()

void SCRunmodeSet ( int  run_mode)

Set the current run mode.

Mainly exposed outside of suricata.c as a unit-test helper.

Definition at line 269 of file suricata.c.

References SCInstance_::run_mode, and suricata.

Referenced by LLVMFuzzerTestOneInput().

Here is the caller graph for this function:

◆ SCStartInternalRunMode()

int SCStartInternalRunMode ( int  argc,
char **  argv 
)

Definition at line 2309 of file suricata.c.

References SCInstance_::conf_filename, DEFAULT_CONF_FILE, SCInstance_::keyword_info, ListAppLayerProtocols(), ListKeywords(), SCInstance_::run_mode, RUNMODE_LIST_APP_LAYERS, RUNMODE_LIST_KEYWORDS, RUNMODE_PRINT_VERSION, and suricata.

Referenced by main().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SuricataInit()

void SuricataInit ( void  )

Definition at line 2901 of file suricata.c.

References ConfDump(), ConfGetBool(), g_livedev_mask, g_recurlvl_mask, g_vlan_mask, GlobalsInitPreConfig(), SCInstance_::run_mode, RUNMODE_DUMP_CONFIG, SCLogDebug, and suricata.

Referenced by main().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SuricataMainLoop()

void SuricataMainLoop ( void  )

◆ SuricataPostInit()

void SuricataPostInit ( void  )

Definition at line 2998 of file suricata.c.

References ConfGetBool(), FatalError, geteuid, PacketPoolPostRunmodes(), prerun_snap, SC_ATOMIC_SET, SCLogWarning, SURICATA_RUNTIME, SystemHugepageSnapshotDestroy(), TM_ECODE_FAILED, TM_ECODE_OK, TmThreadContinueThreads(), TmThreadWaitOnThreadInit(), and TmThreadWaitOnThreadRunning().

Referenced by main().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SuricataPreInit()

void SuricataPreInit ( const char *  progname)

Definition at line 2892 of file suricata.c.

Referenced by main().

Here is the caller graph for this function:

◆ SuricataShutdown()

void SuricataShutdown ( void  )

Definition at line 2987 of file suricata.c.

References PostRunDeinit(), SCInstance_::run_mode, SC_ATOMIC_SET, SCInstance_::start_time, suricata, SURICATA_DEINIT, TmThreadKillThreads(), and UnixSocketKillSocketThread().

Referenced by main().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SuriHasSigFile()

int SuriHasSigFile ( void  )

Definition at line 222 of file suricata.c.

References SCInstance_::sig_file, and suricata.

Variable Documentation

◆ coverage_unittests

int coverage_unittests

Definition at line 892 of file suricata.c.

Referenced by SCParseCommandLine(), SigTableRegisterTests(), and TmModuleRegisterTests().

◆ g_detect_disabled

int g_detect_disabled = 0

global indicating if detection is enabled

Definition at line 183 of file suricata.c.

◆ g_disable_hashing

bool g_disable_hashing = false

Definition at line 211 of file suricata.c.

Referenced by FileForceHashParseCfg(), SSLEnableJA3(), and SSLEnableJA4().

◆ g_disable_randomness

int g_disable_randomness = 0

disable randomness to get reproducible results across runs

Definition at line 192 of file suricata.c.

Referenced by RandomGet(), and SCParseCommandLine().

◆ g_livedev_mask

uint16_t g_livedev_mask = 0xffff

determine (without branching) if we include the livedev ids when hashing or comparing flows

Definition at line 203 of file suricata.c.

Referenced by FlowKeyGetHash(), and SuricataInit().

◆ g_recurlvl_mask

uint8_t g_recurlvl_mask = 0xff

determine (without branching) if we include the recursion levels when hashing or comparing flows

Definition at line 207 of file suricata.c.

Referenced by FlowKeyGetHash(), and SuricataInit().

◆ g_skip_prefilter

int g_skip_prefilter

Definition at line 1072 of file detect-engine-mpm.c.

Referenced by RetrieveFPForSig(), and SCParseCommandLine().

◆ g_stats_eps_per_app_proto_errors

bool g_stats_eps_per_app_proto_errors = false

add per-proto app-layer error counters for exception policies stats? disabled by default

Definition at line 217 of file suricata.c.

Referenced by PostConfLoadedSetup().

◆ g_system

bool g_system = false

Definition at line 188 of file suricata.c.

◆ g_ut_covered

int g_ut_covered

Definition at line 894 of file suricata.c.

Referenced by SCParseCommandLine(), SigTableRegisterTests(), and TmModuleRegisterTests().

◆ g_ut_modules

int g_ut_modules

◆ g_vlan_mask

uint16_t g_vlan_mask = 0xffff

determine (without branching) if we include the vlan_ids when hashing or comparing flows

Definition at line 199 of file suricata.c.

Referenced by FlowKeyGetHash(), and SuricataInit().

◆ host_mode

uint8_t host_mode = SURI_HOST_IS_SNIFFER_ONLY

Host mode: set if box is sniffing only or is a router

Definition at line 177 of file suricata.c.

◆ prerun_snap

SystemHugepageSnapshot* prerun_snap = NULL

Definition at line 214 of file suricata.c.

Referenced by SuricataPostInit().

◆ sc_set_caps

bool sc_set_caps = false

set caps or not

Definition at line 186 of file suricata.c.

◆ sighup_count

volatile sig_atomic_t sighup_count = 0

Definition at line 154 of file suricata.c.

Referenced by SuricataMainLoop().

◆ sigint_count

volatile sig_atomic_t sigint_count = 0

Definition at line 153 of file suricata.c.

Referenced by SuricataMainLoop().

◆ sigterm_count

volatile sig_atomic_t sigterm_count = 0

Definition at line 155 of file suricata.c.

Referenced by SuricataMainLoop().

◆ sigusr2_count

volatile sig_atomic_t sigusr2_count = 0

Definition at line 156 of file suricata.c.

Referenced by SuricataMainLoop().

◆ suricata

◆ suricata_ctl_flags

volatile uint8_t suricata_ctl_flags = 0

suricata engine control flags

Definition at line 169 of file suricata.c.

Referenced by EngineDone(), EngineStop(), ReceiveErfDagLoop(), ReceiveErfFileLoop(), and SuricataMainLoop().