suricata
|
#include "suricata-common.h"
#include "suricata.h"
#include "conf.h"
#include "conf-yaml-loader.h"
#include "decode.h"
#include "defrag.h"
#include "flow.h"
#include "stream-tcp.h"
#include "ippair.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-address.h"
#include "detect-engine-alert.h"
#include "detect-engine-port.h"
#include "detect-engine-tag.h"
#include "detect-engine-threshold.h"
#include "detect-fast-pattern.h"
#include "datasets.h"
#include "feature.h"
#include "flow-bypass.h"
#include "flow-manager.h"
#include "flow-timeout.h"
#include "flow-worker.h"
#include "flow-bit.h"
#include "host-bit.h"
#include "ippair-bit.h"
#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "app-layer-htp-range.h"
#include "output.h"
#include "output-filestore.h"
#include "respond-reject.h"
#include "runmode-af-packet.h"
#include "runmode-af-xdp.h"
#include "runmode-netmap.h"
#include "runmode-unittests.h"
#include "source-nfq.h"
#include "source-nfq-prototypes.h"
#include "source-nflog.h"
#include "source-ipfw.h"
#include "source-pcap.h"
#include "source-pcap-file.h"
#include "source-pcap-file-helper.h"
#include "source-pfring.h"
#include "source-erf-file.h"
#include "source-erf-dag.h"
#include "source-napatech.h"
#include "source-af-packet.h"
#include "source-af-xdp.h"
#include "source-netmap.h"
#include "source-dpdk.h"
#include "source-windivert.h"
#include "source-windivert-prototypes.h"
#include "unix-manager.h"
#include "util-classification-config.h"
#include "util-threshold-config.h"
#include "util-reference-config.h"
#include "tmqh-packetpool.h"
#include "tm-queuehandlers.h"
#include "util-byte.h"
#include "util-conf.h"
#include "util-coredump-config.h"
#include "util-cpu.h"
#include "util-daemon.h"
#include "util-device.h"
#include "util-dpdk.h"
#include "util-ebpf.h"
#include "util-exception-policy.h"
#include "util-host-os-info.h"
#include "util-hugepages.h"
#include "util-ioctl.h"
#include "util-landlock.h"
#include "util-luajit.h"
#include "util-macset.h"
#include "util-misc.h"
#include "util-mpm-hs.h"
#include "util-path.h"
#include "util-pidfile.h"
#include "util-plugin.h"
#include "util-privs.h"
#include "util-profiling.h"
#include "util-proto-name.h"
#include "util-running-modes.h"
#include "util-signal.h"
#include "util-time.h"
#include "util-validate.h"
#include "util-var-name.h"
#include "build-info.h"
Go to the source code of this file.
Macros | |
#define | DEFAULT_MAX_PENDING_PACKETS 1024 |
Functions | |
SC_ATOMIC_DECLARE (unsigned int, engine_stage) | |
int | SuriHasSigFile (void) |
int | EngineModeIsUnknown (void) |
int | EngineModeIsIPS (void) |
int | EngineModeIsIDS (void) |
void | EngineModeSetIPS (void) |
void | EngineModeSetIDS (void) |
int | RunmodeIsUnittests (void) |
int | RunmodeGetCurrent (void) |
void | GlobalsInitPreConfig (void) |
void | EngineStop (void) |
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be able to tell the engine the file eof is reached. More... | |
void | EngineDone (void) |
Used to indicate that the current task is done. More... | |
void | RegisterAllModules (void) |
const char * | GetDocURL (void) |
const char * | GetProgramVersion (void) |
get string with program version More... | |
void | PreRunInit (const int runmode) |
void | PreRunPostPrivsDropInit (const int runmode) |
void | PostRunDeinit (const int runmode, struct timeval *start_time) |
void | PostConfLoadedDetectSetup (SCInstance *suri) |
int | PostConfLoadedSetup (SCInstance *suri) |
int | InitGlobal (void) |
Global initialization common to all runmodes. More... | |
int | SuricataMain (int argc, char **argv) |
Variables | |
volatile sig_atomic_t | sigint_count = 0 |
volatile sig_atomic_t | sighup_count = 0 |
volatile sig_atomic_t | sigterm_count = 0 |
volatile sig_atomic_t | sigusr2_count = 0 |
volatile uint8_t | suricata_ctl_flags = 0 |
int | run_mode = RUNMODE_UNKNOWN |
uint8_t | host_mode = SURI_HOST_IS_SNIFFER_ONLY |
uint16_t | max_pending_packets |
int | g_detect_disabled = 0 |
bool | sc_set_caps = false |
bool | g_system = false |
int | g_disable_randomness = 0 |
uint16_t | g_vlan_mask = 0xffff |
uint16_t | g_livedev_mask = 0xffff |
bool | g_disable_hashing = false |
SCInstance | suricata |
int | coverage_unittests |
int | g_ut_modules |
int | g_ut_covered |
int | g_skip_prefilter |
Definition in file suricata.c.
#define DEFAULT_MAX_PENDING_PACKETS 1024 |
Definition at line 171 of file suricata.c.
void EngineDone | ( | void | ) |
Used to indicate that the current task is done.
This is mainly used by pcap-file to tell it has finished to treat a pcap files when running in unix-socket mode.
Definition at line 454 of file suricata.c.
References suricata_ctl_flags, and SURICATA_DONE.
int EngineModeIsIDS | ( | void | ) |
Definition at line 235 of file suricata.c.
References DEBUG_VALIDATE_BUG_ON.
int EngineModeIsIPS | ( | void | ) |
Definition at line 229 of file suricata.c.
References DEBUG_VALIDATE_BUG_ON.
Referenced by AlertFastLogger(), AlertJsonHeader(), CaptureStatsSetup(), CaptureStatsUpdate(), EveAddVerdict(), ExceptionPolicyParse(), FlowHandlePacketUpdate(), and StreamTcpInitConfig().
int EngineModeIsUnknown | ( | void | ) |
Definition at line 224 of file suricata.c.
Referenced by PostConfLoadedSetup().
void EngineModeSetIDS | ( | void | ) |
Definition at line 246 of file suricata.c.
Referenced by ListAppLayerProtocols(), ListKeywords(), LLVMFuzzerTestOneInput(), PostConfLoadedSetup(), and RunUnittests().
void EngineModeSetIPS | ( | void | ) |
Definition at line 241 of file suricata.c.
void EngineStop | ( | void | ) |
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be able to tell the engine the file eof is reached.
Definition at line 443 of file suricata.c.
References suricata_ctl_flags, and SURICATA_STOP.
Referenced by ReceiveErfFileLoop().
const char* GetDocURL | ( | void | ) |
Definition at line 1107 of file suricata.c.
References DOC_URL, GetProgramVersion(), and PROG_VER.
const char* GetProgramVersion | ( | void | ) |
get string with program version
Get the program version as passed to us from AC_INIT
Add 'RELEASE' is no '-dev' in the version. Add the REVISION if passed to us.
Possible outputs: release: '5.0.1 RELEASE' dev with rev: '5.0.1-dev (64a789bbf 2019-10-18)' dev w/o rev: '5.0.1-dev'
Definition at line 1128 of file suricata.c.
References PROG_VER, and xstr.
Referenced by GetDocURL().
void GlobalsInitPreConfig | ( | void | ) |
Definition at line 354 of file suricata.c.
References FrameConfigInit(), SCProtoNameInit(), SCThresholdConfGlobalInit(), SupportFastPatternForSigMatchTypes(), and TimeInit().
Referenced by LLVMFuzzerTestOneInput(), and RunUnittests().
int InitGlobal | ( | void | ) |
Global initialization common to all runmodes.
This can be used by fuzz targets.
Definition at line 2849 of file suricata.c.
References ConfInit(), ParseSizeInit(), RunModeRegisterRunModes(), SC_ATOMIC_INIT, SCLogError, SCLogInitLogModule(), SCSetThreadName, suricata_context, tmm_modules, TMM_SIZE, UtilSignalBlock(), UtilSignalHandlerSetup(), and VarNameStoreInit().
Referenced by LLVMFuzzerTestOneInput().
void PostConfLoadedDetectSetup | ( | SCInstance * | suri | ) |
Definition at line 2534 of file suricata.c.
References de_ctx, and SCInstance_::disabled_detect.
int PostConfLoadedSetup | ( | SCInstance * | suri | ) |
This function is meant to contain code that needs to be run once the configuration has been loaded.
Definition at line 2625 of file suricata.c.
References AppLayerSetup(), SCInstance_::capture_plugin_args, SCInstance_::capture_plugin_name, SCInstance_::checksum_validation, ConfGet(), ConfGetBool(), ConfSet(), EngineModeIsUnknown(), EngineModeSetIDS(), LiveDeviceFinalize(), LiveDevRegisterExtension(), LiveSetOffloadDisable(), LiveSetOffloadWarn(), MacSetRegisterFlowStorage(), MpmTableSetup(), RegisterFlowBypassInfo(), SCInstance_::run_mode, RUNMODE_AFP_DEV, SCInstance_::runmode_custom_mode, RunModeEngineIsIPS(), SCLogInfo, SCPluginsLoad(), SCReturnInt, SetMasterExceptionPolicy(), SpmTableSetup(), StorageInit(), StringParseUint16(), suricata, and TM_ECODE_FAILED.
Referenced by LLVMFuzzerTestOneInput().
void PostRunDeinit | ( | const int | runmode, |
struct timeval * | start_time | ||
) |
Definition at line 2263 of file suricata.c.
References FlowDisableFlowManagerThread(), FlowForceReassembly(), PacketPoolInit(), RUNMODE_UNIX_SOCKET, TmThreadDisablePacketThreads(), and TmThreadDisableReceiveThreads().
Referenced by PreRunPostPrivsDropInit().
void PreRunInit | ( | const int | runmode | ) |
Definition at line 2212 of file suricata.c.
References AppLayerParserPostStreamSetup(), AppLayerRegisterGlobalCounters(), DefragInit(), FLOW_QUIET, FlowInitConfig(), HttpRangeContainersInit(), IPPairInitConfig(), OutputFilestoreRegisterGlobalCounters(), RUNMODE_UNIX_SOCKET, SCProfilingInit(), SCProfilingKeywordsGlobalInit(), SCProfilingPrefilterGlobalInit(), SCProfilingRulesGlobalInit(), SCProfilingSghsGlobalInit(), StatsInit(), STREAM_VERBOSE, and StreamTcpInitConfig().
void PreRunPostPrivsDropInit | ( | const int | runmode | ) |
Definition at line 2241 of file suricata.c.
References DatasetsInit(), PostRunDeinit(), RUNMODE_PCAP_FILE, RUNMODE_UNIX_SOCKET, RunModeInitializeOutputs(), StatsSetupPostConfigPostOutput(), and StatsSetupPostConfigPreOutput().
void RegisterAllModules | ( | void | ) |
Definition at line 886 of file suricata.c.
References TmModuleBypassedFlowManagerRegister(), TmModuleDebugList(), TmModuleDecodeAFPRegister(), TmModuleDecodeAFXDPRegister(), TmModuleDecodeDPDKRegister(), TmModuleDecodeErfDagRegister(), TmModuleDecodeErfFileRegister(), TmModuleDecodeIPFWRegister(), TmModuleDecodeNetmapRegister(), TmModuleDecodeNFLOGRegister(), TmModuleDecodeNFQRegister(), TmModuleDecodePcapFileRegister(), TmModuleDecodePcapRegister(), TmModuleDecodePfringRegister(), TmModuleDecodeWinDivertRegister(), TmModuleFlowManagerRegister(), TmModuleFlowRecyclerRegister(), TmModuleFlowWorkerRegister(), TmModuleLoggerRegister(), TmModuleNapatechDecodeRegister(), TmModuleNapatechStreamRegister(), TmModuleReceiveAFPRegister(), TmModuleReceiveAFXDPRegister(), TmModuleReceiveDPDKRegister(), TmModuleReceiveErfDagRegister(), TmModuleReceiveErfFileRegister(), TmModuleReceiveIPFWRegister(), TmModuleReceiveNetmapRegister(), TmModuleReceiveNFLOGRegister(), TmModuleReceiveNFQRegister(), TmModuleReceivePcapFileRegister(), TmModuleReceivePcapRegister(), TmModuleReceivePfringRegister(), TmModuleReceiveWinDivertRegister(), TmModuleRespondRejectRegister(), TmModuleStatsLoggerRegister(), TmModuleUnixManagerRegister(), TmModuleVerdictIPFWRegister(), TmModuleVerdictNFQRegister(), and TmModuleVerdictWinDivertRegister().
Referenced by RunUnittests().
int RunmodeGetCurrent | ( | void | ) |
Definition at line 261 of file suricata.c.
References run_mode.
Referenced by ConfUnixSocketIsEnable(), RunModeGetMainMode(), and SigLoadSignatures().
int RunmodeIsUnittests | ( | void | ) |
Definition at line 252 of file suricata.c.
References run_mode, and RUNMODE_UNITTEST.
Referenced by AppLayerParserConfParserEnabled(), AppLayerProtoDetectConfProtoDetectionEnabledDefault(), DetectEngineThreadCtxInit(), RegisterDNP3Parsers(), RegisterENIPTCPParsers(), RegisterENIPUDPParsers(), RegisterTFTPParsers(), StreamTcpDecrMemuse(), StreamTcpInitConfig(), StreamTcpReassembleDecrMemuse(), StreamTcpThreadCacheReturnSegment(), and StreamTcpThreadCacheReturnSession().
SC_ATOMIC_DECLARE | ( | unsigned int | , |
engine_stage | |||
) |
int SuricataMain | ( | int | argc, |
char ** | argv | ||
) |
Definition at line 2886 of file suricata.c.
Referenced by main().
int SuriHasSigFile | ( | void | ) |
Definition at line 219 of file suricata.c.
References SCInstance_::sig_file, and suricata.
int coverage_unittests |
Definition at line 882 of file suricata.c.
Referenced by SigTableRegisterTests(), and TmModuleRegisterTests().
int g_detect_disabled = 0 |
global indicating if detection is enabled
Definition at line 190 of file suricata.c.
bool g_disable_hashing = false |
Definition at line 214 of file suricata.c.
Referenced by FileForceHashParseCfg(), and SSLEnableJA3().
int g_disable_randomness = 0 |
disable randomness to get reproducible results across runs
Definition at line 199 of file suricata.c.
Referenced by RandomGet().
uint16_t g_livedev_mask = 0xffff |
determine (without branching) if we include the livedev ids when hashing or comparing flows
Definition at line 210 of file suricata.c.
Referenced by FlowKeyGetHash().
int g_skip_prefilter |
Definition at line 1055 of file detect-engine-mpm.c.
Referenced by RetrieveFPForSig().
bool g_system = false |
Definition at line 195 of file suricata.c.
int g_ut_covered |
Definition at line 884 of file suricata.c.
Referenced by SigTableRegisterTests(), and TmModuleRegisterTests().
int g_ut_modules |
Definition at line 883 of file suricata.c.
Referenced by MpmRegisterTests(), SigTableRegisterTests(), and TmModuleRegisterTests().
uint16_t g_vlan_mask = 0xffff |
determine (without branching) if we include the vlan_ids when hashing or comparing flows
Definition at line 206 of file suricata.c.
Referenced by FlowGetIpPairProtoHash(), and FlowKeyGetHash().
uint8_t host_mode = SURI_HOST_IS_SNIFFER_ONLY |
Host mode: set if box is sniffing only or is a router
Definition at line 184 of file suricata.c.
int run_mode = RUNMODE_UNKNOWN |
Run mode selected
Definition at line 176 of file suricata.c.
Referenced by DPDKCleanupEAL(), DPDKCloseDevice(), DPDKFreeDevice(), LLVMFuzzerTestOneInput(), RunmodeGetCurrent(), and RunmodeIsUnittests().
bool sc_set_caps = false |
set caps or not
Definition at line 193 of file suricata.c.
volatile sig_atomic_t sighup_count = 0 |
Definition at line 158 of file suricata.c.
volatile sig_atomic_t sigint_count = 0 |
Definition at line 157 of file suricata.c.
volatile sig_atomic_t sigterm_count = 0 |
Definition at line 159 of file suricata.c.
volatile sig_atomic_t sigusr2_count = 0 |
Definition at line 160 of file suricata.c.
SCInstance suricata |
Suricata instance
Definition at line 217 of file suricata.c.
Referenced by PostConfLoadedSetup(), and SuriHasSigFile().
volatile uint8_t suricata_ctl_flags = 0 |
suricata engine control flags
Definition at line 173 of file suricata.c.
Referenced by EngineDone(), EngineStop(), ReceiveErfDagLoop(), ReceiveErfFileLoop(), and ReceivePfringLoop().