suricata
|
#include "suricata-common.h"
#include "suricata.h"
#include "conf.h"
#include "conf-yaml-loader.h"
#include "decode.h"
#include "defrag.h"
#include "flow.h"
#include "stream-tcp.h"
#include "ippair.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-address.h"
#include "detect-engine-alert.h"
#include "detect-engine-port.h"
#include "detect-engine-tag.h"
#include "detect-engine-threshold.h"
#include "detect-fast-pattern.h"
#include "datasets.h"
#include "feature.h"
#include "flow-bypass.h"
#include "flow-manager.h"
#include "flow-timeout.h"
#include "flow-worker.h"
#include "flow-bit.h"
#include "host-bit.h"
#include "ippair-bit.h"
#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "app-layer-htp-range.h"
#include "output.h"
#include "output-filestore.h"
#include "respond-reject.h"
#include "runmode-af-packet.h"
#include "runmode-af-xdp.h"
#include "runmode-netmap.h"
#include "runmode-unittests.h"
#include "source-nfq.h"
#include "source-nfq-prototypes.h"
#include "source-nflog.h"
#include "source-ipfw.h"
#include "source-lib.h"
#include "source-pcap.h"
#include "source-pcap-file.h"
#include "source-pcap-file-helper.h"
#include "source-erf-file.h"
#include "source-erf-dag.h"
#include "source-af-packet.h"
#include "source-af-xdp.h"
#include "source-netmap.h"
#include "source-dpdk.h"
#include "source-windivert.h"
#include "source-windivert-prototypes.h"
#include "unix-manager.h"
#include "util-classification-config.h"
#include "util-threshold-config.h"
#include "util-reference-config.h"
#include "tmqh-packetpool.h"
#include "tm-queuehandlers.h"
#include "util-affinity.h"
#include "util-byte.h"
#include "util-conf.h"
#include "util-coredump-config.h"
#include "util-cpu.h"
#include "util-daemon.h"
#include "util-device-private.h"
#include "util-dpdk.h"
#include "util-ebpf.h"
#include "util-exception-policy.h"
#include "util-host-os-info.h"
#include "util-hugepages.h"
#include "util-ioctl.h"
#include "util-landlock.h"
#include "util-macset.h"
#include "util-flow-rate.h"
#include "util-misc.h"
#include "util-mpm-hs.h"
#include "util-path.h"
#include "util-pidfile.h"
#include "util-plugin.h"
#include "util-privs.h"
#include "util-profiling.h"
#include "util-proto-name.h"
#include "util-running-modes.h"
#include "util-signal.h"
#include "util-time.h"
#include "util-validate.h"
#include "util-var-name.h"
#include "build-info.h"
Go to the source code of this file.
Macros | |
#define | DEFAULT_MAX_PENDING_PACKETS 1024 |
Functions | |
SC_ATOMIC_DECLARE (unsigned int, engine_stage) | |
int | SuriHasSigFile (void) |
int | EngineModeIsUnknown (void) |
bool | EngineModeIsFirewall (void) |
int | EngineModeIsIPS (void) |
int | EngineModeIsIDS (void) |
void | EngineModeSetFirewall (void) |
void | EngineModeSetIPS (void) |
void | EngineModeSetIDS (void) |
int | RunmodeIsUnittests (void) |
SCRunMode | SCRunmodeGet (void) |
Get the current run mode. More... | |
void | SCRunmodeSet (SCRunMode run_mode) |
Set the current run mode. More... | |
void | SCEnableDefaultSignalHandlers (void) |
Enable default signal handlers. More... | |
void | GlobalsInitPreConfig (void) |
void | GlobalsDestroy (void) |
void | EngineStop (void) |
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be able to tell the engine the file eof is reached. More... | |
void | EngineDone (void) |
Used to indicate that the current task is done. More... | |
void | RegisterAllModules (void) |
TmEcode | SCLoadYamlConfig (void) |
const char * | GetDocURL (void) |
const char * | GetProgramVersion (void) |
get string with program version More... | |
TmEcode | SCParseCommandLine (int argc, char **argv) |
void | PreRunInit (const int runmode) |
void | PreRunPostPrivsDropInit (const int runmode) |
void | PostRunDeinit (const int runmode, struct timeval *start_time) |
clean up / shutdown code for packet modes More... | |
int | SCStartInternalRunMode (int argc, char **argv) |
int | SCFinalizeRunMode (void) |
void | PostConfLoadedDetectSetup (SCInstance *suri) |
int | PostConfLoadedSetup (SCInstance *suri) |
void | SuricataMainLoop (void) |
int | InitGlobal (void) |
Global initialization common to all runmodes. More... | |
void | SuricataPreInit (const char *progname) |
void | SuricataInit (void) |
void | SuricataShutdown (void) |
void | SuricataPostInit (void) |
Variables | |
volatile sig_atomic_t | sigint_count = 0 |
volatile sig_atomic_t | sighup_count = 0 |
volatile sig_atomic_t | sigterm_count = 0 |
volatile sig_atomic_t | sigusr2_count = 0 |
volatile uint8_t | suricata_ctl_flags = 0 |
uint8_t | host_mode = SURI_HOST_IS_SNIFFER_ONLY |
uint32_t | max_pending_packets |
int | g_detect_disabled = 0 |
bool | sc_set_caps = false |
bool | g_system = false |
int | g_disable_randomness = 0 |
uint16_t | g_vlan_mask = 0xffff |
uint16_t | g_livedev_mask = 0xffff |
uint8_t | g_recurlvl_mask = 0xff |
bool | g_disable_hashing = false |
SystemHugepageSnapshot * | prerun_snap = NULL |
bool | g_stats_eps_per_app_proto_errors = false |
SCInstance | suricata |
int | coverage_unittests |
int | g_ut_modules |
int | g_ut_covered |
int | g_skip_prefilter |
Definition in file suricata.c.
#define DEFAULT_MAX_PENDING_PACKETS 1024 |
Definition at line 170 of file suricata.c.
void EngineDone | ( | void | ) |
Used to indicate that the current task is done.
This is mainly used by pcap-file to tell it has finished to treat a pcap files when running in unix-socket mode.
Definition at line 481 of file suricata.c.
References suricata_ctl_flags, and SURICATA_DONE.
bool EngineModeIsFirewall | ( | void | ) |
Definition at line 235 of file suricata.c.
References DEBUG_VALIDATE_BUG_ON.
int EngineModeIsIDS | ( | void | ) |
Definition at line 248 of file suricata.c.
References DEBUG_VALIDATE_BUG_ON.
int EngineModeIsIPS | ( | void | ) |
Definition at line 242 of file suricata.c.
References DEBUG_VALIDATE_BUG_ON.
Referenced by AlertJsonHeader(), CaptureStatsSetup(), CaptureStatsUpdate(), EveAddVerdict(), FlowHandlePacketUpdate(), and StreamTcpInitConfig().
int EngineModeIsUnknown | ( | void | ) |
Definition at line 230 of file suricata.c.
Referenced by PostConfLoadedSetup().
void EngineModeSetFirewall | ( | void | ) |
Definition at line 254 of file suricata.c.
Referenced by PostConfLoadedSetup().
void EngineModeSetIDS | ( | void | ) |
Definition at line 264 of file suricata.c.
Referenced by ListAppLayerHooks(), ListAppLayerProtocols(), ListKeywords(), LLVMFuzzerTestOneInput(), PostConfLoadedSetup(), and RunUnittests().
void EngineModeSetIPS | ( | void | ) |
Definition at line 259 of file suricata.c.
void EngineStop | ( | void | ) |
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be able to tell the engine the file eof is reached.
Definition at line 470 of file suricata.c.
References suricata_ctl_flags, and SURICATA_STOP.
Referenced by ReceiveErfFileLoop().
const char* GetDocURL | ( | void | ) |
Definition at line 1165 of file suricata.c.
References DOC_URL, GetProgramVersion(), and PROG_VER.
const char* GetProgramVersion | ( | void | ) |
get string with program version
Get the program version as passed to us from AC_INIT
Add 'RELEASE' is no '-dev' in the version. Add the REVISION if passed to us.
Possible outputs: release: '5.0.1 RELEASE' dev with rev: '5.0.1-dev (64a789bbf 2019-10-18)' dev w/o rev: '5.0.1-dev'
Definition at line 1186 of file suricata.c.
References PROG_VER, REVISION, and xstr.
Referenced by GetDocURL().
void GlobalsDestroy | ( | void | ) |
Definition at line 390 of file suricata.c.
References AFPPeersListClean(), AppLayerDeSetup(), AppLayerHtpPrintStats(), DatalinkTableDeinit(), DatasetsDestroy(), DatasetsSave(), de_ctx, DetectEngineClearMaster(), DetectEngineDeReference(), DetectEngineGetCurrent(), DetectEngineMoveToFreeList(), DetectParseFreeRegexes(), DPDKCleanupEAL(), FeatureTrackingRelease(), HostShutdown(), HTPAtExitPrintStats(), HTPFreeConfig(), LiveDeviceListClean(), MpmHSGlobalCleanup(), NFQContextsClean(), OutputDeregisterAll(), OutputTxShutdown(), ParseSizeDeinit(), SCInstance_::pid_filename, SCConfDeInit(), SCFree, SCLogDeInitLogModule(), SCPidfileRemove(), SCProtoNameRelease(), SigTableCleanup(), suricata, TagDestroyCtx(), ThresholdDestroy(), TimeDeinit(), TmModuleRunDeInit(), TmqhCleanup(), and VarNameStoreDestroy().
Referenced by main().
void GlobalsInitPreConfig | ( | void | ) |
Definition at line 382 of file suricata.c.
References SCProtoNameInit(), SCThresholdConfGlobalInit(), SupportFastPatternForSigMatchTypes(), and TimeInit().
Referenced by LLVMFuzzerTestOneInput(), RunUnittests(), and SuricataInit().
int InitGlobal | ( | void | ) |
Global initialization common to all runmodes.
This can be used by fuzz targets.
Definition at line 2965 of file suricata.c.
References DatalinkTableInit(), ParseSizeInit(), RunModeRegisterRunModes(), SC_ATOMIC_INIT, SCConfInit(), SCLogError, SCLogInitLogModule(), SCSetThreadName, suricata_context, tmm_modules, TMM_SIZE, UtilSignalBlock(), UtilSignalHandlerSetup(), and VarNameStoreInit().
Referenced by LLVMFuzzerTestOneInput().
void PostConfLoadedDetectSetup | ( | SCInstance * | suri | ) |
Definition at line 2625 of file suricata.c.
References de_ctx, and SCInstance_::disabled_detect.
int PostConfLoadedSetup | ( | SCInstance * | suri | ) |
This function is meant to contain code that needs to be run once the configuration has been loaded.
Definition at line 2716 of file suricata.c.
References AppLayerSetup(), SCInstance_::capture_plugin_args, SCInstance_::capture_plugin_name, SCInstance_::checksum_validation, EngineModeIsUnknown(), EngineModeSetFirewall(), EngineModeSetIDS(), FatalError, FeatureTrackingRegister(), FlowRateRegisterFlowStorage(), g_stats_eps_per_app_proto_errors, SCInstance_::is_firewall, LiveDeviceFinalize(), LiveDevRegisterExtension(), LiveSetOffloadDisable(), LiveSetOffloadWarn(), MacSetRegisterFlowStorage(), MpmTableSetup(), RegisterFlowBypassInfo(), SCInstance_::run_mode, RUNMODE_AFP_DEV, SCInstance_::runmode_custom_mode, RunModeEngineIsIPS(), SCConfGet(), SCConfGetBool(), SCConfGetNode(), SCConfNodeChildValueIsTrue(), SCConfSet(), SCLogInfo, SCLogWarning, SCPluginsLoad(), SetMasterExceptionPolicy(), SigTableInit(), SpmTableSetup(), StorageInit(), StringParseUint16(), and suricata.
Referenced by LLVMFuzzerTestOneInput().
void PostRunDeinit | ( | const int | runmode, |
struct timeval * | start_time | ||
) |
clean up / shutdown code for packet modes
Shuts down packet modes, so regular packet runmodes and the per pcap mode in the unix socket.
Definition at line 2331 of file suricata.c.
References FlowDisableFlowManagerThread(), FlowWorkToDoCleanup(), PacketPoolInit(), RUNMODE_UNIX_SOCKET, THV_FLOW_LOOP, THV_KILL, THV_REQ_FLOW_LOOP, THV_RUNNING_DONE, TM_FLAG_FLOWWORKER_TM, TM_FLAG_PACKET_ALL, TM_FLAG_RECEIVE_TM, TmThreadDisablePacketThreads(), TmThreadDisableReceiveThreads(), and TmThreadsUnsealThreads().
Referenced by SuricataShutdown().
void PreRunInit | ( | const int | runmode | ) |
Definition at line 2286 of file suricata.c.
References AppLayerParserPostStreamSetup(), AppLayerRegisterGlobalCounters(), DefragInit(), FLOW_QUIET, FlowInitConfig(), HttpRangeContainersInit(), IPPairInitConfig(), OutputFilestoreRegisterGlobalCounters(), RUNMODE_UNIX_SOCKET, SCProfilingInit(), SCProfilingKeywordsGlobalInit(), SCProfilingPrefilterGlobalInit(), SCProfilingSghsGlobalInit(), StatsInit(), STREAM_VERBOSE, and StreamTcpInitConfig().
void PreRunPostPrivsDropInit | ( | const int | runmode | ) |
Definition at line 2315 of file suricata.c.
References DatasetsInit(), RUNMODE_UNIX_SOCKET, RunModeInitializeOutputs(), StatsSetupPostConfigPostOutput(), and StatsSetupPostConfigPreOutput().
void RegisterAllModules | ( | void | ) |
Definition at line 947 of file suricata.c.
References TmModuleBypassedFlowManagerRegister(), TmModuleDebugList(), TmModuleDecodeAFPRegister(), TmModuleDecodeAFXDPRegister(), TmModuleDecodeDPDKRegister(), TmModuleDecodeErfDagRegister(), TmModuleDecodeErfFileRegister(), TmModuleDecodeIPFWRegister(), TmModuleDecodeLibRegister(), TmModuleDecodeNetmapRegister(), TmModuleDecodeNFLOGRegister(), TmModuleDecodeNFQRegister(), TmModuleDecodePcapFileRegister(), TmModuleDecodePcapRegister(), TmModuleDecodeWinDivertRegister(), TmModuleFlowManagerRegister(), TmModuleFlowRecyclerRegister(), TmModuleFlowWorkerRegister(), TmModuleLoggerRegister(), TmModuleReceiveAFPRegister(), TmModuleReceiveAFXDPRegister(), TmModuleReceiveDPDKRegister(), TmModuleReceiveErfDagRegister(), TmModuleReceiveErfFileRegister(), TmModuleReceiveIPFWRegister(), TmModuleReceiveNetmapRegister(), TmModuleReceiveNFLOGRegister(), TmModuleReceiveNFQRegister(), TmModuleReceivePcapFileRegister(), TmModuleReceivePcapRegister(), TmModuleReceiveWinDivertRegister(), TmModuleRespondRejectRegister(), TmModuleStatsLoggerRegister(), TmModuleUnixManagerRegister(), TmModuleVerdictIPFWRegister(), TmModuleVerdictNFQRegister(), and TmModuleVerdictWinDivertRegister().
Referenced by RunUnittests().
int RunmodeIsUnittests | ( | void | ) |
Definition at line 270 of file suricata.c.
References SCInstance_::run_mode, RUNMODE_UNITTEST, and suricata.
Referenced by DetectEngineThreadCtxInit(), RegisterDNP3Parsers(), RegisterTFTPParsers(), SCAppLayerParserConfParserEnabled(), SCAppLayerProtoDetectConfProtoDetectionEnabledDefault(), StreamTcpDecrMemuse(), StreamTcpInitConfig(), StreamTcpThreadCacheReturnSegment(), and StreamTcpThreadCacheReturnSession().
SC_ATOMIC_DECLARE | ( | unsigned int | , |
engine_stage | |||
) |
void SCEnableDefaultSignalHandlers | ( | void | ) |
Enable default signal handlers.
Definition at line 289 of file suricata.c.
References SCInstance_::install_signal_handlers, and suricata.
Referenced by main().
int SCFinalizeRunMode | ( | void | ) |
Definition at line 2451 of file suricata.c.
References SCInstance_::run_mode, RUNMODE_UNKNOWN, and suricata.
Referenced by main().
TmEcode SCLoadYamlConfig | ( | void | ) |
Definition at line 1012 of file suricata.c.
References SCInstance_::additional_configs, SCInstance_::conf_filename, DEFAULT_CONF_FILE, SCConfGetRootNode(), SCConfYamlHandleInclude(), SCConfYamlLoadFile(), SCEnter, SCReturnInt, suricata, TM_ECODE_FAILED, and TM_ECODE_OK.
Referenced by main().
TmEcode SCParseCommandLine | ( | int | argc, |
char ** | argv | ||
) |
Definition at line 1369 of file suricata.c.
References SCInstance_::capture_plugin_args, SCInstance_::capture_plugin_name, coverage_unittests, engine_analysis, g_disable_randomness, g_skip_prefilter, g_ut_covered, g_ut_modules, LiveRegisterDeviceName(), name, SCInstance_::pcap_dev, SCInstance_::run_mode, RUNMODE_PLUGIN, RUNMODE_PRINT_USAGE, SCConfSetFinal(), SCLogError, strlcpy(), suricata, TM_ECODE_FAILED, and TM_ECODE_OK.
Referenced by main().
SCRunMode SCRunmodeGet | ( | void | ) |
Get the current run mode.
Definition at line 279 of file suricata.c.
References SCInstance_::run_mode, and suricata.
Referenced by ConfUnixSocketIsEnable(), DPDKCleanupEAL(), DPDKCloseDevice(), DPDKFreeDevice(), RunModeGetMainMode(), and SigLoadSignatures().
void SCRunmodeSet | ( | SCRunMode | run_mode | ) |
Set the current run mode.
Mainly exposed outside of suricata.c as a unit-test helper.
Definition at line 284 of file suricata.c.
References SCInstance_::run_mode, and suricata.
Referenced by LLVMFuzzerTestOneInput(), and main().
int SCStartInternalRunMode | ( | int | argc, |
char ** | argv | ||
) |
Definition at line 2389 of file suricata.c.
References SCInstance_::conf_filename, DEFAULT_CONF_FILE, SCInstance_::keyword_info, ListAppLayerHooks(), ListAppLayerProtocols(), ListKeywords(), SCInstance_::run_mode, RUNMODE_LIST_APP_LAYER_HOOKS, RUNMODE_LIST_APP_LAYERS, RUNMODE_LIST_KEYWORDS, RUNMODE_PRINT_VERSION, and suricata.
Referenced by main().
void SuricataInit | ( | void | ) |
Definition at line 3012 of file suricata.c.
References g_livedev_mask, g_recurlvl_mask, g_vlan_mask, GlobalsInitPreConfig(), SCInstance_::run_mode, RUNMODE_DUMP_CONFIG, SCConfDump(), SCConfGetBool(), SCLogDebug, and suricata.
Referenced by main().
void SuricataMainLoop | ( | void | ) |
Definition at line 2922 of file suricata.c.
References DetectEngineReload(), DetectEngineReloadIsStart(), DetectEngineReloadSetIdle(), DetectEngineReloadStart(), OutputNotifyFileRotation(), SCLogNotice, sighup_count, sigint_count, sigterm_count, sigusr2_count, suricata, suricata_ctl_flags, SURICATA_STOP, and TmThreadCheckThreadState().
Referenced by main().
void SuricataPostInit | ( | void | ) |
Definition at line 3111 of file suricata.c.
References FatalError, geteuid, PacketPoolPostRunmodes(), prerun_snap, SC_ATOMIC_SET, SCConfGetBool(), SCLogWarning, SURICATA_RUNTIME, SystemHugepageSnapshotDestroy(), TM_ECODE_FAILED, TM_ECODE_OK, TmThreadContinueThreads(), TmThreadWaitOnThreadInit(), and TmThreadWaitOnThreadRunning().
Referenced by main().
void SuricataPreInit | ( | const char * | progname | ) |
Definition at line 3003 of file suricata.c.
Referenced by main().
void SuricataShutdown | ( | void | ) |
Definition at line 3100 of file suricata.c.
References PostRunDeinit(), SCInstance_::run_mode, SC_ATOMIC_SET, SCInstance_::start_time, suricata, SURICATA_DEINIT, TmThreadKillThreads(), and UnixSocketKillSocketThread().
Referenced by main().
int SuriHasSigFile | ( | void | ) |
Definition at line 225 of file suricata.c.
References SCInstance_::sig_file, and suricata.
int coverage_unittests |
Definition at line 943 of file suricata.c.
Referenced by SCParseCommandLine(), SigTableRegisterTests(), and TmModuleRegisterTests().
int g_detect_disabled = 0 |
global indicating if detection is enabled
Definition at line 186 of file suricata.c.
bool g_disable_hashing = false |
Definition at line 214 of file suricata.c.
Referenced by FileForceHashParseCfg(), SSLEnableJA3(), and SSLEnableJA4().
int g_disable_randomness = 0 |
disable randomness to get reproducible results across runs
Definition at line 195 of file suricata.c.
Referenced by RandomGet(), and SCParseCommandLine().
uint16_t g_livedev_mask = 0xffff |
determine (without branching) if we include the livedev ids when hashing or comparing flows
Definition at line 206 of file suricata.c.
Referenced by FlowKeyGetHash(), and SuricataInit().
uint8_t g_recurlvl_mask = 0xff |
determine (without branching) if we include the recursion levels when hashing or comparing flows
Definition at line 210 of file suricata.c.
Referenced by FlowKeyGetHash(), and SuricataInit().
int g_skip_prefilter |
Definition at line 1071 of file detect-engine-mpm.c.
Referenced by RetrieveFPForSig(), and SCParseCommandLine().
bool g_stats_eps_per_app_proto_errors = false |
add per-proto app-layer error counters for exception policies stats? disabled by default
Definition at line 220 of file suricata.c.
Referenced by PostConfLoadedSetup().
bool g_system = false |
Definition at line 191 of file suricata.c.
int g_ut_covered |
Definition at line 945 of file suricata.c.
Referenced by SCParseCommandLine(), SigTableRegisterTests(), and TmModuleRegisterTests().
int g_ut_modules |
Definition at line 944 of file suricata.c.
Referenced by MpmRegisterTests(), SCParseCommandLine(), SigTableRegisterTests(), and TmModuleRegisterTests().
uint16_t g_vlan_mask = 0xffff |
determine (without branching) if we include the vlan_ids when hashing or comparing flows
Definition at line 202 of file suricata.c.
Referenced by FlowKeyGetHash(), and SuricataInit().
uint8_t host_mode = SURI_HOST_IS_SNIFFER_ONLY |
Host mode: set if box is sniffing only or is a router
Definition at line 180 of file suricata.c.
SystemHugepageSnapshot* prerun_snap = NULL |
Definition at line 217 of file suricata.c.
Referenced by SuricataPostInit().
bool sc_set_caps = false |
set caps or not
Definition at line 189 of file suricata.c.
volatile sig_atomic_t sighup_count = 0 |
Definition at line 157 of file suricata.c.
Referenced by SuricataMainLoop().
volatile sig_atomic_t sigint_count = 0 |
Definition at line 156 of file suricata.c.
Referenced by SuricataMainLoop().
volatile sig_atomic_t sigterm_count = 0 |
Definition at line 158 of file suricata.c.
Referenced by SuricataMainLoop().
volatile sig_atomic_t sigusr2_count = 0 |
Definition at line 159 of file suricata.c.
Referenced by SuricataMainLoop().
SCInstance suricata |
Suricata instance
Definition at line 223 of file suricata.c.
Referenced by GlobalsDestroy(), PostConfLoadedSetup(), RunmodeIsUnittests(), SCEnableDefaultSignalHandlers(), SCFinalizeRunMode(), SCLoadYamlConfig(), SCParseCommandLine(), SCRunmodeGet(), SCRunmodeSet(), SCStartInternalRunMode(), SuricataInit(), SuricataMainLoop(), SuricataShutdown(), and SuriHasSigFile().
volatile uint8_t suricata_ctl_flags = 0 |
suricata engine control flags
Definition at line 172 of file suricata.c.
Referenced by EngineDone(), EngineStop(), ReceiveErfDagLoop(), ReceiveErfFileLoop(), and SuricataMainLoop().