suricata
suricata.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "suricata-common.h"
25 
26 #if HAVE_GETOPT_H
27 #include <getopt.h>
28 #endif
29 
30 #if HAVE_SIGNAL_H
31 #include <signal.h>
32 #endif
33 
34 #include "suricata.h"
35 #include "decode.h"
36 #include "feature.h"
37 #include "detect.h"
38 #include "packet-queue.h"
39 #include "threads.h"
40 #include "threadvars.h"
41 #include "flow-worker.h"
42 
43 #include "util-atomic.h"
44 #include "util-spm.h"
45 #include "util-cpu.h"
46 #include "util-action.h"
47 #include "util-pidfile.h"
48 #include "util-ioctl.h"
49 #include "util-device.h"
50 #include "util-misc.h"
51 #include "util-running-modes.h"
52 
53 #include "detect-engine.h"
54 #include "detect-parse.h"
55 #include "detect-fast-pattern.h"
56 #include "detect-engine-tag.h"
58 #include "detect-engine-address.h"
59 #include "detect-engine-port.h"
60 #include "detect-engine-mpm.h"
61 
62 #include "tm-queuehandlers.h"
63 #include "tm-queues.h"
64 #include "tm-threads.h"
65 
66 #include "tmqh-flow.h"
67 
68 #include "conf.h"
69 #include "conf-yaml-loader.h"
70 
71 #include "datasets.h"
72 
73 #include "stream-tcp.h"
74 
75 #include "source-nfq.h"
76 #include "source-nfq-prototypes.h"
77 
78 #include "source-nflog.h"
79 
80 #include "source-ipfw.h"
81 
82 #include "source-pcap.h"
83 #include "source-pcap-file.h"
84 
85 #include "source-pfring.h"
86 
87 #include "source-erf-file.h"
88 #include "source-erf-dag.h"
89 #include "source-napatech.h"
90 
91 #include "source-af-packet.h"
92 #include "source-netmap.h"
93 
94 #include "source-windivert.h"
96 
97 #include "respond-reject.h"
98 
99 #include "flow.h"
100 #include "flow-timeout.h"
101 #include "flow-manager.h"
102 #include "flow-bypass.h"
103 #include "flow-var.h"
104 #include "flow-bit.h"
105 #include "pkt-var.h"
106 #include "host-bit.h"
107 
108 #include "ippair.h"
109 #include "ippair-bit.h"
110 
111 #include "host.h"
112 #include "unix-manager.h"
113 
114 #include "app-layer.h"
115 #include "app-layer-parser.h"
116 #include "app-layer-register.h"
117 #include "app-layer-htp.h"
118 #include "app-layer-ssl.h"
119 #include "app-layer-ssh.h"
120 #include "app-layer-ftp.h"
121 #include "app-layer-smtp.h"
122 #include "app-layer-enip.h"
123 #include "app-layer-dnp3.h"
124 #include "app-layer-smb.h"
125 
126 #include "output-filestore.h"
127 
128 #include "util-ebpf.h"
129 #include "util-radix-tree.h"
130 #include "util-host-os-info.h"
131 #include "util-cidr.h"
132 #include "util-unittest.h"
133 #include "util-unittest-helper.h"
134 #include "util-time.h"
135 #include "util-rule-vars.h"
137 #include "util-threshold-config.h"
138 #include "util-reference-config.h"
139 #include "util-profiling.h"
140 #include "util-magic.h"
141 #include "util-signal.h"
142 
143 #include "util-coredump-config.h"
144 
145 #include "util-decode-mime.h"
146 
147 #include "defrag.h"
148 
149 #include "runmodes.h"
150 #include "runmode-unittests.h"
151 
152 #include "util-debug.h"
153 #include "util-error.h"
154 #include "util-daemon.h"
155 #include "util-byte.h"
156 #include "reputation.h"
157 
158 #include "output.h"
159 
160 #include "util-privs.h"
161 
162 #include "tmqh-packetpool.h"
163 
164 #include "util-proto-name.h"
165 #include "util-mpm-hs.h"
166 #include "util-storage.h"
167 #include "host-storage.h"
168 
169 #include "util-lua.h"
170 
171 #include "util-plugin.h"
172 
173 #include "rust.h"
174 
175 /*
176  * we put this here, because we only use it here in main.
177  */
178 volatile sig_atomic_t sigint_count = 0;
179 volatile sig_atomic_t sighup_count = 0;
180 volatile sig_atomic_t sigterm_count = 0;
181 volatile sig_atomic_t sigusr2_count = 0;
182 
183 /*
184  * Flag to indicate if the engine is at the initialization
185  * or already processing packets. 3 stages: SURICATA_INIT,
186  * SURICATA_RUNTIME and SURICATA_FINALIZE
187  */
188 SC_ATOMIC_DECLARE(unsigned int, engine_stage);
189 
190 /* Max packets processed simultaniously per thread. */
191 #define DEFAULT_MAX_PENDING_PACKETS 1024
192 
193 /** suricata engine control flags */
194 volatile uint8_t suricata_ctl_flags = 0;
195 
196 /** Run mode selected */
198 
199 /** Engine mode: inline (ENGINE_MODE_IPS) or just
200  * detection mode (ENGINE_MODE_IDS by default) */
201 static enum EngineMode g_engine_mode = ENGINE_MODE_IDS;
202 
203 /** Host mode: set if box is sniffing only
204  * or is a router */
206 
207 /** Maximum packets to simultaneously process. */
209 
210 /** global indicating if detection is enabled */
212 
213 /** set caps or not */
215 
216 /** highest mtu of the interfaces we monitor */
218 
219 bool g_system = false;
220 
221 /** disable randomness to get reproducible results accross runs */
222 #ifndef AFLFUZZ_NO_RANDOM
224 #else
225 int g_disable_randomness = 1;
226 #endif
227 
228 /** determine (without branching) if we include the vlan_ids when hashing or
229  * comparing flows */
230 uint16_t g_vlan_mask = 0xffff;
231 
232 /* flag to disable hashing almost globally, to be similar to disabling nss
233  * support */
234 bool g_disable_hashing = false;
235 
236 /** Suricata instance */
238 
239 int SuriHasSigFile(void)
240 {
241  return (suricata.sig_file != NULL);
242 }
243 
245 {
246  return (g_engine_mode == ENGINE_MODE_IPS);
247 }
248 
250 {
251  return (g_engine_mode == ENGINE_MODE_IDS);
252 }
253 
255 {
256  g_engine_mode = ENGINE_MODE_IPS;
257 }
258 
260 {
261  g_engine_mode = ENGINE_MODE_IDS;
262 }
263 
264 #ifdef UNITTESTS
266 {
267  if (run_mode == RUNMODE_UNITTEST)
268  return 1;
269 
270  return 0;
271 }
272 #endif
273 
275 {
276  return run_mode;
277 }
278 
279 /** signal handlers
280  *
281  * WARNING: don't use the SCLog* API in the handlers. The API is complex
282  * with memory allocation possibly happening, calls to syslog, json message
283  * construction, etc.
284  */
285 
286 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
287 static void SignalHandlerSigint(/*@unused@*/ int sig)
288 {
289  sigint_count = 1;
290 }
291 static void SignalHandlerSigterm(/*@unused@*/ int sig)
292 {
293  sigterm_count = 1;
294 }
295 #endif
296 
297 #ifndef OS_WIN32
298 /**
299  * SIGUSR2 handler. Just set sigusr2_count. The main loop will act on
300  * it.
301  */
302 static void SignalHandlerSigusr2(int sig)
303 {
304  if (sigusr2_count < 2)
305  sigusr2_count++;
306 }
307 
308 /**
309  * SIGHUP handler. Just set sighup_count. The main loop will act on
310  * it.
311  */
312 static void SignalHandlerSigHup(/*@unused@*/ int sig)
313 {
314  sighup_count = 1;
315 }
316 #endif
317 
319 {
320  TimeInit();
323 }
324 
325 static void GlobalsDestroy(SCInstance *suri)
326 {
327  HostShutdown();
328  HTPFreeConfig();
330 
332 
333  /* TODO this can do into it's own func */
335  if (de_ctx) {
338  }
340 
341  AppLayerDeSetup();
342  DatasetsSave();
343  DatasetsDestroy();
344  TagDestroyCtx();
345 
349  TimeDeinit();
350  if (!suri->disabled_detect) {
353  }
354  TmqhCleanup();
356  ParseSizeDeinit();
357 
358 #ifdef HAVE_AF_PACKET
360 #endif
361 
362 #ifdef NFQ
364 #endif
365 
366 #ifdef BUILD_HYPERSCAN
368 #endif
369 
370  ConfDeInit();
371 #ifdef HAVE_LUAJIT
372  LuajitFreeStatesPool();
373 #endif
377 
379  SCFree(suri->pid_filename);
380  suri->pid_filename = NULL;
381 }
382 
383 /** \brief make sure threads can stop the engine by calling this
384  * function. Purpose: pcap file mode needs to be able to tell the
385  * engine the file eof is reached. */
386 void EngineStop(void)
387 {
389 }
390 
391 /**
392  * \brief Used to indicate that the current task is done.
393  *
394  * This is mainly used by pcap-file to tell it has finished
395  * to treat a pcap files when running in unix-socket mode.
396  */
397 void EngineDone(void)
398 {
400 }
401 
402 static int SetBpfString(int argc, char *argv[])
403 {
404  char *bpf_filter = NULL;
405  uint32_t bpf_len = 0;
406  int tmpindex = 0;
407 
408  /* attempt to parse remaining args as bpf filter */
409  tmpindex = argc;
410  while(argv[tmpindex] != NULL) {
411  bpf_len+=strlen(argv[tmpindex]) + 1;
412  tmpindex++;
413  }
414 
415  if (bpf_len == 0)
416  return TM_ECODE_OK;
417 
418  if (EngineModeIsIPS()) {
420  "BPF filter not available in IPS mode."
421  " Use firewall filtering if possible.");
422  return TM_ECODE_FAILED;
423  }
424 
425  bpf_filter = SCMalloc(bpf_len);
426  if (unlikely(bpf_filter == NULL))
427  return TM_ECODE_OK;
428  memset(bpf_filter, 0x00, bpf_len);
429 
430  tmpindex = optind;
431  while(argv[tmpindex] != NULL) {
432  strlcat(bpf_filter, argv[tmpindex],bpf_len);
433  if(argv[tmpindex + 1] != NULL) {
434  strlcat(bpf_filter," ", bpf_len);
435  }
436  tmpindex++;
437  }
438 
439  if(strlen(bpf_filter) > 0) {
440  if (ConfSetFinal("bpf-filter", bpf_filter) != 1) {
441  SCLogError(SC_ERR_FATAL, "Failed to set bpf filter.");
442  SCFree(bpf_filter);
443  return TM_ECODE_FAILED;
444  }
445  }
446  SCFree(bpf_filter);
447 
448  return TM_ECODE_OK;
449 }
450 
451 static void SetBpfStringFromFile(char *filename)
452 {
453  char *bpf_filter = NULL;
454  char *bpf_comment_tmp = NULL;
455  char *bpf_comment_start = NULL;
456  uint32_t bpf_len = 0;
457 #ifdef OS_WIN32
458  struct _stat st;
459 #else
460  struct stat st;
461 #endif /* OS_WIN32 */
462  FILE *fp = NULL;
463  size_t nm = 0;
464 
465  if (EngineModeIsIPS()) {
467  "BPF filter not available in IPS mode."
468  " Use firewall filtering if possible.");
469  }
470 
471 #ifdef OS_WIN32
472  if(_stat(filename, &st) != 0) {
473 #else
474  if(stat(filename, &st) != 0) {
475 #endif /* OS_WIN32 */
476  SCLogError(SC_ERR_FOPEN, "Failed to stat file %s", filename);
477  exit(EXIT_FAILURE);
478  }
479  bpf_len = st.st_size + 1;
480 
481  // coverity[toctou : FALSE]
482  fp = fopen(filename,"r");
483  if (fp == NULL) {
484  SCLogError(SC_ERR_FOPEN, "Failed to open file %s", filename);
485  exit(EXIT_FAILURE);
486  }
487 
488  bpf_filter = SCMalloc(bpf_len * sizeof(char));
489  if (unlikely(bpf_filter == NULL)) {
490  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate buffer for bpf filter in file %s", filename);
491  exit(EXIT_FAILURE);
492  }
493  memset(bpf_filter, 0x00, bpf_len);
494 
495  nm = fread(bpf_filter, 1, bpf_len - 1, fp);
496  if ((ferror(fp) != 0) || (nm != (bpf_len - 1))) {
497  SCLogError(SC_ERR_BPF, "Failed to read complete BPF file %s", filename);
498  SCFree(bpf_filter);
499  fclose(fp);
500  exit(EXIT_FAILURE);
501  }
502  fclose(fp);
503  bpf_filter[nm] = '\0';
504 
505  if(strlen(bpf_filter) > 0) {
506  /*replace comments with space*/
507  bpf_comment_start = bpf_filter;
508  while((bpf_comment_tmp = strchr(bpf_comment_start, '#')) != NULL) {
509  while((*bpf_comment_tmp !='\0') &&
510  (*bpf_comment_tmp != '\r') && (*bpf_comment_tmp != '\n'))
511  {
512  *bpf_comment_tmp++ = ' ';
513  }
514  bpf_comment_start = bpf_comment_tmp;
515  }
516  /*remove remaining '\r' and '\n' */
517  while((bpf_comment_tmp = strchr(bpf_filter, '\r')) != NULL) {
518  *bpf_comment_tmp = ' ';
519  }
520  while((bpf_comment_tmp = strchr(bpf_filter, '\n')) != NULL) {
521  *bpf_comment_tmp = ' ';
522  }
523  /* cut trailing spaces */
524  while (strlen(bpf_filter) > 0 &&
525  bpf_filter[strlen(bpf_filter)-1] == ' ')
526  {
527  bpf_filter[strlen(bpf_filter)-1] = '\0';
528  }
529  if (strlen(bpf_filter) > 0) {
530  if(ConfSetFinal("bpf-filter", bpf_filter) != 1) {
531  SCLogError(SC_ERR_FOPEN, "ERROR: Failed to set bpf filter!");
532  SCFree(bpf_filter);
533  exit(EXIT_FAILURE);
534  }
535  }
536  }
537  SCFree(bpf_filter);
538 }
539 
540 static void PrintUsage(const char *progname)
541 {
542 #ifdef REVISION
543  printf("%s %s (%s)\n", PROG_NAME, PROG_VER, xstr(REVISION));
544 #else
545  printf("%s %s\n", PROG_NAME, PROG_VER);
546 #endif
547  printf("USAGE: %s [OPTIONS] [BPF FILTER]\n\n", progname);
548  printf("\t-c <path> : path to configuration file\n");
549  printf("\t-T : test configuration file (use with -c)\n");
550  printf("\t-i <dev or ip> : run in pcap live mode\n");
551  printf("\t-F <bpf filter file> : bpf filter file\n");
552  printf("\t-r <path> : run in pcap file/offline mode\n");
553 #ifdef NFQ
554  printf("\t-q <qid[:qid]> : run in inline nfqueue mode (use colon to specify a range of queues)\n");
555 #endif /* NFQ */
556 #ifdef IPFW
557  printf("\t-d <divert port> : run in inline ipfw divert mode\n");
558 #endif /* IPFW */
559  printf("\t-s <path> : path to signature file loaded in addition to suricata.yaml settings (optional)\n");
560  printf("\t-S <path> : path to signature file loaded exclusively (optional)\n");
561  printf("\t-l <dir> : default log directory\n");
562 #ifndef OS_WIN32
563  printf("\t-D : run as daemon\n");
564 #else
565  printf("\t--service-install : install as service\n");
566  printf("\t--service-remove : remove service\n");
567  printf("\t--service-change-params : change service startup parameters\n");
568 #endif /* OS_WIN32 */
569  printf("\t-k [all|none] : force checksum check (all) or disabled it (none)\n");
570  printf("\t-V : display Suricata version\n");
571  printf("\t-v : be more verbose (use multiple times to increase verbosity)\n");
572 #ifdef UNITTESTS
573  printf("\t-u : run the unittests and exit\n");
574  printf("\t-U, --unittest-filter=REGEX : filter unittests with a regex\n");
575  printf("\t--list-unittests : list unit tests\n");
576  printf("\t--fatal-unittests : enable fatal failure on unittest error\n");
577  printf("\t--unittests-coverage : display unittest coverage report\n");
578 #endif /* UNITTESTS */
579  printf("\t--list-app-layer-protos : list supported app layer protocols\n");
580  printf("\t--list-keywords[=all|csv|<kword>] : list keywords implemented by the engine\n");
581  printf("\t--list-runmodes : list supported runmodes\n");
582  printf("\t--runmode <runmode_id> : specific runmode modification the engine should run. The argument\n"
583  "\t supplied should be the id for the runmode obtained by running\n"
584  "\t --list-runmodes\n");
585  printf("\t--engine-analysis : print reports on analysis of different sections in the engine and exit.\n"
586  "\t Please have a look at the conf parameter engine-analysis on what reports\n"
587  "\t can be printed\n");
588  printf("\t--pidfile <file> : write pid to this file\n");
589  printf("\t--init-errors-fatal : enable fatal failure on signature init error\n");
590  printf("\t--disable-detection : disable detection engine\n");
591  printf("\t--dump-config : show the running configuration\n");
592  printf("\t--dump-features : display provided features\n");
593  printf("\t--build-info : display build information\n");
594  printf("\t--pcap[=<dev>] : run in pcap mode, no value select interfaces from suricata.yaml\n");
595  printf("\t--pcap-file-continuous : when running in pcap mode with a directory, continue checking directory for pcaps until interrupted\n");
596  printf("\t--pcap-file-delete : when running in replay mode (-r with directory or file), will delete pcap files that have been processed when done\n");
597  printf("\t--pcap-file-recursive : will descend into subdirectories when running in replay mode (-r)\n");
598 #ifdef HAVE_PCAP_SET_BUFF
599  printf("\t--pcap-buffer-size : size of the pcap buffer value from 0 - %i\n",INT_MAX);
600 #endif /* HAVE_SET_PCAP_BUFF */
601 #ifdef HAVE_AF_PACKET
602  printf("\t--af-packet[=<dev>] : run in af-packet mode, no value select interfaces from suricata.yaml\n");
603 #endif
604 #ifdef HAVE_NETMAP
605  printf("\t--netmap[=<dev>] : run in netmap mode, no value select interfaces from suricata.yaml\n");
606 #endif
607 #ifdef HAVE_PFRING
608  printf("\t--pfring[=<dev>] : run in pfring mode, use interfaces from suricata.yaml\n");
609  printf("\t--pfring-int <dev> : run in pfring mode, use interface <dev>\n");
610  printf("\t--pfring-cluster-id <id> : pfring cluster id \n");
611  printf("\t--pfring-cluster-type <type> : pfring cluster type for PF_RING 4.1.2 and later cluster_round_robin|cluster_flow\n");
612 #endif /* HAVE_PFRING */
613  printf("\t--simulate-ips : force engine into IPS mode. Useful for QA\n");
614 #ifdef HAVE_LIBCAP_NG
615  printf("\t--user <user> : run suricata as this user after init\n");
616  printf("\t--group <group> : run suricata as this group after init\n");
617 #endif /* HAVE_LIBCAP_NG */
618  printf("\t--erf-in <path> : process an ERF file\n");
619 #ifdef HAVE_DAG
620  printf("\t--dag <dagX:Y> : process ERF records from DAG interface X, stream Y\n");
621 #endif
622 #ifdef HAVE_NAPATECH
623  printf("\t--napatech : run Napatech Streams using the API\n");
624 #endif
625 #ifdef BUILD_UNIX_SOCKET
626  printf("\t--unix-socket[=<file>] : use unix socket to control suricata work\n");
627 #endif
628 #ifdef WINDIVERT
629  printf("\t--windivert <filter> : run in inline WinDivert mode\n");
630  printf("\t--windivert-forward <filter> : run in inline WinDivert mode, as a gateway\n");
631 #endif
632 #ifdef HAVE_LIBNET11
633  printf("\t--reject-dev <dev> : send reject packets from this interface\n");
634 #endif
635  printf("\t--set name=value : set a configuration value\n");
636  printf("\n");
637  printf("\nTo run the engine with default configuration on "
638  "interface eth0 with signature file \"signatures.rules\", run the "
639  "command as:\n\n%s -c suricata.yaml -s signatures.rules -i eth0 \n\n",
640  progname);
641 }
642 
643 static void PrintBuildInfo(void)
644 {
645  const char *bits = "<unknown>-bits";
646  const char *endian = "<unknown>-endian";
647  char features[2048] = "";
648  const char *tls;
649 
650  printf("This is %s version %s\n", PROG_NAME, GetProgramVersion());
651 
652 #ifdef DEBUG
653  strlcat(features, "DEBUG ", sizeof(features));
654 #endif
655 #ifdef DEBUG_VALIDATION
656  strlcat(features, "DEBUG_VALIDATION ", sizeof(features));
657 #endif
658 #ifdef UNITTESTS
659  strlcat(features, "UNITTESTS ", sizeof(features));
660 #endif
661 #ifdef NFQ
662  strlcat(features, "NFQ ", sizeof(features));
663 #endif
664 #ifdef IPFW
665  strlcat(features, "IPFW ", sizeof(features));
666 #endif
667 #ifdef HAVE_PCAP_SET_BUFF
668  strlcat(features, "PCAP_SET_BUFF ", sizeof(features));
669 #endif
670 #ifdef HAVE_PFRING
671  strlcat(features, "PF_RING ", sizeof(features));
672 #endif
673 #ifdef HAVE_AF_PACKET
674  strlcat(features, "AF_PACKET ", sizeof(features));
675 #endif
676 #ifdef HAVE_NETMAP
677  strlcat(features, "NETMAP ", sizeof(features));
678 #endif
679 #ifdef HAVE_PACKET_FANOUT
680  strlcat(features, "HAVE_PACKET_FANOUT ", sizeof(features));
681 #endif
682 #ifdef HAVE_DAG
683  strlcat(features, "DAG ", sizeof(features));
684 #endif
685 #ifdef HAVE_LIBCAP_NG
686  strlcat(features, "LIBCAP_NG ", sizeof(features));
687 #endif
688 #ifdef HAVE_LIBNET11
689  strlcat(features, "LIBNET1.1 ", sizeof(features));
690 #endif
691 #ifdef HAVE_HTP_URI_NORMALIZE_HOOK
692  strlcat(features, "HAVE_HTP_URI_NORMALIZE_HOOK ", sizeof(features));
693 #endif
694 #ifdef PCRE_HAVE_JIT
695  strlcat(features, "PCRE_JIT ", sizeof(features));
696 #endif
697  /* For compatibility, just say we have HAVE_NSS. */
698  strlcat(features, "HAVE_NSS ", sizeof(features));
699  /* HTTP2_DECOMPRESSION is not an optional feature in this major version */
700  strlcat(features, "HTTP2_DECOMPRESSION ", sizeof(features));
701 #ifdef HAVE_LUA
702  strlcat(features, "HAVE_LUA ", sizeof(features));
703 #endif
704 #ifdef HAVE_LUAJIT
705  strlcat(features, "HAVE_LUAJIT ", sizeof(features));
706 #endif
707  strlcat(features, "HAVE_LIBJANSSON ", sizeof(features));
708 #ifdef PROFILING
709  strlcat(features, "PROFILING ", sizeof(features));
710 #endif
711 #ifdef PROFILE_LOCKING
712  strlcat(features, "PROFILE_LOCKING ", sizeof(features));
713 #endif
714 #if defined(TLS_C11) || defined(TLS_GNU)
715  strlcat(features, "TLS ", sizeof(features));
716 #endif
717 #if defined(TLS_C11)
718  strlcat(features, "TLS_C11 ", sizeof(features));
719 #elif defined(TLS_GNU)
720  strlcat(features, "TLS_GNU ", sizeof(features));
721 #endif
722 #ifdef HAVE_MAGIC
723  strlcat(features, "MAGIC ", sizeof(features));
724 #endif
725  strlcat(features, "RUST ", sizeof(features));
726  if (strlen(features) == 0) {
727  strlcat(features, "none", sizeof(features));
728  }
729 
730  printf("Features: %s\n", features);
731 
732  /* SIMD stuff */
733  memset(features, 0x00, sizeof(features));
734 #if defined(__SSE4_2__)
735  strlcat(features, "SSE_4_2 ", sizeof(features));
736 #endif
737 #if defined(__SSE4_1__)
738  strlcat(features, "SSE_4_1 ", sizeof(features));
739 #endif
740 #if defined(__SSE3__)
741  strlcat(features, "SSE_3 ", sizeof(features));
742 #endif
743  if (strlen(features) == 0) {
744  strlcat(features, "none", sizeof(features));
745  }
746  printf("SIMD support: %s\n", features);
747 
748  /* atomics stuff */
749  memset(features, 0x00, sizeof(features));
750 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_1)
751  strlcat(features, "1 ", sizeof(features));
752 #endif
753 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_2)
754  strlcat(features, "2 ", sizeof(features));
755 #endif
756 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_4)
757  strlcat(features, "4 ", sizeof(features));
758 #endif
759 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_8)
760  strlcat(features, "8 ", sizeof(features));
761 #endif
762 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_16)
763  strlcat(features, "16 ", sizeof(features));
764 #endif
765  if (strlen(features) == 0) {
766  strlcat(features, "none", sizeof(features));
767  } else {
768  strlcat(features, "byte(s)", sizeof(features));
769  }
770  printf("Atomic intrinsics: %s\n", features);
771 
772 #if __WORDSIZE == 64
773  bits = "64-bits";
774 #elif __WORDSIZE == 32
775  bits = "32-bits";
776 #endif
777 
778 #if __BYTE_ORDER == __BIG_ENDIAN
779  endian = "Big-endian";
780 #elif __BYTE_ORDER == __LITTLE_ENDIAN
781  endian = "Little-endian";
782 #endif
783 
784  printf("%s, %s architecture\n", bits, endian);
785 #ifdef __GNUC__
786  printf("GCC version %s, C version %"PRIiMAX"\n", __VERSION__, (intmax_t)__STDC_VERSION__);
787 #else
788  printf("C version %"PRIiMAX"\n", (intmax_t)__STDC_VERSION__);
789 #endif
790 
791 #if __SSP__ == 1
792  printf("compiled with -fstack-protector\n");
793 #endif
794 #if __SSP_ALL__ == 2
795  printf("compiled with -fstack-protector-all\n");
796 #endif
797 /*
798  * Workaround for special defines of _FORTIFY_SOURCE like
799  * FORTIFY_SOURCE=((defined __OPTIMIZE && OPTIMIZE > 0) ? 2 : 0)
800  * which is used by Gentoo for example and would result in the error
801  * 'defined' undeclared when _FORTIFY_SOURCE used via %d in printf func
802  *
803  */
804 #if _FORTIFY_SOURCE == 2
805  printf("compiled with _FORTIFY_SOURCE=2\n");
806 #elif _FORTIFY_SOURCE == 1
807  printf("compiled with _FORTIFY_SOURCE=1\n");
808 #elif _FORTIFY_SOURCE == 0
809  printf("compiled with _FORTIFY_SOURCE=0\n");
810 #endif
811 #ifdef CLS
812  printf("L1 cache line size (CLS)=%d\n", CLS);
813 #endif
814 #if defined(TLS_C11)
815  tls = "_Thread_local";
816 #elif defined(TLS_GNU)
817  tls = "__thread";
818 #else
819 #error "Unsupported thread local"
820 #endif
821  printf("thread local storage method: %s\n", tls);
822 
823  printf("compiled with %s, linked against %s\n",
824  HTP_VERSION_STRING_FULL, htp_get_version());
825  printf("\n");
826 #include "build-info.h"
827 }
828 
832 
834 {
835  // zero all module storage
836  memset(tmm_modules, 0, TMM_SIZE * sizeof(TmModule));
837 
838  /* commanders */
840  /* managers */
844  /* nfq */
848  /* ipfw */
852  /* pcap live */
855  /* pcap file */
858  /* af-packet */
861  /* netmap */
864  /* pfring */
867  /* dag file */
870  /* dag live */
873  /* napatech */
876 
877  /* flow worker */
879  /* respond-reject */
881 
882  /* log api */
885 
887  /* nflog */
890 
891  /* windivert */
895 }
896 
897 static TmEcode LoadYamlConfig(SCInstance *suri)
898 {
899  SCEnter();
900 
901  if (suri->conf_filename == NULL)
903 
904  if (ConfYamlLoadFile(suri->conf_filename) != 0) {
905  /* Error already displayed. */
907  }
908 
910 }
911 
912 static TmEcode ParseInterfacesList(const int runmode, char *pcap_dev)
913 {
914  SCEnter();
915 
916  /* run the selected runmode */
917  if (runmode == RUNMODE_PCAP_DEV) {
918  if (strlen(pcap_dev) == 0) {
919  int ret = LiveBuildDeviceList("pcap");
920  if (ret == 0) {
921  SCLogError(SC_ERR_INITIALIZATION, "No interface found in config for pcap");
923  }
924  }
925  } else if (runmode == RUNMODE_PFRING) {
926  /* FIXME add backward compat support */
927  /* iface has been set on command line */
928  if (strlen(pcap_dev)) {
929  if (ConfSetFinal("pfring.live-interface", pcap_dev) != 1) {
930  SCLogError(SC_ERR_INITIALIZATION, "Failed to set pfring.live-interface");
932  }
933  } else {
934  /* not an error condition if we have a 1.0 config */
935  LiveBuildDeviceList("pfring");
936  }
937 #ifdef HAVE_AF_PACKET
938  } else if (runmode == RUNMODE_AFP_DEV) {
939  /* iface has been set on command line */
940  if (strlen(pcap_dev)) {
941  if (ConfSetFinal("af-packet.live-interface", pcap_dev) != 1) {
942  SCLogError(SC_ERR_INITIALIZATION, "Failed to set af-packet.live-interface");
944  }
945  } else {
946  int ret = LiveBuildDeviceList("af-packet");
947  if (ret == 0) {
948  SCLogError(SC_ERR_INITIALIZATION, "No interface found in config for af-packet");
950  }
951  }
952 #endif
953 #ifdef HAVE_NETMAP
954  } else if (runmode == RUNMODE_NETMAP) {
955  /* iface has been set on command line */
956  if (strlen(pcap_dev)) {
957  if (ConfSetFinal("netmap.live-interface", pcap_dev) != 1) {
958  SCLogError(SC_ERR_INITIALIZATION, "Failed to set netmap.live-interface");
960  }
961  } else {
962  int ret = LiveBuildDeviceList("netmap");
963  if (ret == 0) {
964  SCLogError(SC_ERR_INITIALIZATION, "No interface found in config for netmap");
966  }
967  }
968 #endif
969 #ifdef HAVE_NFLOG
970  } else if (runmode == RUNMODE_NFLOG) {
971  int ret = LiveBuildDeviceListCustom("nflog", "group");
972  if (ret == 0) {
973  SCLogError(SC_ERR_INITIALIZATION, "No group found in config for nflog");
975  }
976 #endif
977  }
978 
980 }
981 
982 static void SCInstanceInit(SCInstance *suri, const char *progname)
983 {
984  memset(suri, 0x00, sizeof(*suri));
985 
986  suri->progname = progname;
987  suri->run_mode = RUNMODE_UNKNOWN;
988 
989  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
990  suri->sig_file = NULL;
991  suri->sig_file_exclusive = FALSE;
992  suri->pid_filename = NULL;
993  suri->regex_arg = NULL;
994 
995  suri->keyword_info = NULL;
996  suri->runmode_custom_mode = NULL;
997 #ifndef OS_WIN32
998  suri->user_name = NULL;
999  suri->group_name = NULL;
1000  suri->do_setuid = FALSE;
1001  suri->do_setgid = FALSE;
1002  suri->userid = 0;
1003  suri->groupid = 0;
1004 #endif /* OS_WIN32 */
1005  suri->delayed_detect = 0;
1006  suri->daemon = 0;
1007  suri->offline = 0;
1008  suri->verbose = 0;
1009  /* use -1 as unknown */
1010  suri->checksum_validation = -1;
1011 #if HAVE_DETECT_DISABLED==1
1012  g_detect_disabled = suri->disabled_detect = 1;
1013 #else
1014  g_detect_disabled = suri->disabled_detect = 0;
1015 #endif
1016 }
1017 
1018 const char *GetDocURL(void)
1019 {
1020  const char *prog_ver = GetProgramVersion();
1021  if (strstr(prog_ver, "RELEASE") != NULL) {
1022  return DOC_URL "suricata-" PROG_VER;
1023  }
1024  return DOC_URL "latest";
1025 }
1026 
1027 /** \brief get string with program version
1028  *
1029  * Get the program version as passed to us from AC_INIT
1030  *
1031  * Add 'RELEASE' is no '-dev' in the version. Add the REVISION if passed
1032  * to us.
1033  *
1034  * Possible outputs:
1035  * release: '5.0.1 RELEASE'
1036  * dev with rev: '5.0.1-dev (64a789bbf 2019-10-18)'
1037  * dev w/o rev: '5.0.1-dev'
1038  */
1039 const char *GetProgramVersion(void)
1040 {
1041  if (strstr(PROG_VER, "-dev") == NULL) {
1042  return PROG_VER " RELEASE";
1043  } else {
1044 #ifdef REVISION
1045  return PROG_VER " (" xstr(REVISION) ")";
1046 #else
1047  return PROG_VER;
1048 #endif
1049  }
1050 }
1051 
1052 static TmEcode PrintVersion(void)
1053 {
1054  printf("This is %s version %s\n", PROG_NAME, GetProgramVersion());
1055  return TM_ECODE_OK;
1056 }
1057 
1058 static TmEcode LogVersion(SCInstance *suri)
1059 {
1060  const char *mode = suri->system ? "SYSTEM" : "USER";
1061  SCLogNotice("This is %s version %s running in %s mode",
1062  PROG_NAME, GetProgramVersion(), mode);
1063  return TM_ECODE_OK;
1064 }
1065 
1066 static void SCSetStartTime(SCInstance *suri)
1067 {
1068  memset(&suri->start_time, 0, sizeof(suri->start_time));
1069  gettimeofday(&suri->start_time, NULL);
1070 }
1071 
1072 static void SCPrintElapsedTime(struct timeval *start_time)
1073 {
1074  if (start_time == NULL)
1075  return;
1076  struct timeval end_time;
1077  memset(&end_time, 0, sizeof(end_time));
1078  gettimeofday(&end_time, NULL);
1079  uint64_t milliseconds = ((end_time.tv_sec - start_time->tv_sec) * 1000) +
1080  (((1000000 + end_time.tv_usec - start_time->tv_usec) / 1000) - 1000);
1081  SCLogInfo("time elapsed %.3fs", (float)milliseconds/(float)1000);
1082 }
1083 
1084 static int ParseCommandLineAfpacket(SCInstance *suri, const char *in_arg)
1085 {
1086 #ifdef HAVE_AF_PACKET
1087  if (suri->run_mode == RUNMODE_UNKNOWN) {
1088  suri->run_mode = RUNMODE_AFP_DEV;
1089  if (in_arg) {
1090  LiveRegisterDeviceName(in_arg);
1091  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
1092  strlcpy(suri->pcap_dev, in_arg, sizeof(suri->pcap_dev));
1093  }
1094  } else if (suri->run_mode == RUNMODE_AFP_DEV) {
1095  if (in_arg) {
1096  LiveRegisterDeviceName(in_arg);
1097  } else {
1098  SCLogInfo("Multiple af-packet option without interface on each is useless");
1099  }
1100  } else {
1101  SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode "
1102  "has been specified");
1103  PrintUsage(suri->progname);
1104  return TM_ECODE_FAILED;
1105  }
1106  return TM_ECODE_OK;
1107 #else
1108  SCLogError(SC_ERR_NO_AF_PACKET,"AF_PACKET not enabled. On Linux "
1109  "host, make sure to pass --enable-af-packet to "
1110  "configure when building.");
1111  return TM_ECODE_FAILED;
1112 #endif
1113 }
1114 
1115 static int ParseCommandLinePcapLive(SCInstance *suri, const char *in_arg)
1116 {
1117  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
1118 
1119  if (in_arg != NULL) {
1120  /* some windows shells require escaping of the \ in \Device. Otherwise
1121  * the backslashes are stripped. We put them back here. */
1122  if (strlen(in_arg) > 9 && strncmp(in_arg, "DeviceNPF", 9) == 0) {
1123  snprintf(suri->pcap_dev, sizeof(suri->pcap_dev), "\\Device\\NPF%s", in_arg+9);
1124  } else {
1125  strlcpy(suri->pcap_dev, in_arg, sizeof(suri->pcap_dev));
1126  PcapTranslateIPToDevice(suri->pcap_dev, sizeof(suri->pcap_dev));
1127  }
1128 
1129  if (strcmp(suri->pcap_dev, in_arg) != 0) {
1130  SCLogInfo("translated %s to pcap device %s", in_arg, suri->pcap_dev);
1131  } else if (strlen(suri->pcap_dev) > 0 && isdigit((unsigned char)suri->pcap_dev[0])) {
1132  SCLogError(SC_ERR_PCAP_TRANSLATE, "failed to find a pcap device for IP %s", in_arg);
1133  return TM_ECODE_FAILED;
1134  }
1135  }
1136 
1137  if (suri->run_mode == RUNMODE_UNKNOWN) {
1138  suri->run_mode = RUNMODE_PCAP_DEV;
1139  if (in_arg) {
1141  }
1142  } else if (suri->run_mode == RUNMODE_PCAP_DEV) {
1144  } else {
1145  SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode "
1146  "has been specified");
1147  PrintUsage(suri->progname);
1148  return TM_ECODE_FAILED;
1149  }
1150  return TM_ECODE_OK;
1151 }
1152 
1153 /**
1154  * Helper function to check if log directory is writable
1155  */
1156 static bool IsLogDirectoryWritable(const char* str)
1157 {
1158  if (access(str, W_OK) == 0)
1159  return true;
1160  return false;
1161 }
1162 
1163 static TmEcode ParseCommandLine(int argc, char** argv, SCInstance *suri)
1164 {
1165  int opt;
1166 
1167  int dump_config = 0;
1168  int dump_features = 0;
1169  int list_app_layer_protocols = 0;
1170  int list_unittests = 0;
1171  int list_runmodes = 0;
1172  int list_keywords = 0;
1173  int build_info = 0;
1174  int conf_test = 0;
1175  int engine_analysis = 0;
1176  int ret = TM_ECODE_OK;
1177 
1178 #ifdef UNITTESTS
1179  coverage_unittests = 0;
1180  g_ut_modules = 0;
1181  g_ut_covered = 0;
1182 #endif
1183 
1184  // clang-format off
1185  struct option long_opts[] = {
1186  {"dump-config", 0, &dump_config, 1},
1187  {"dump-features", 0, &dump_features, 1},
1188  {"pfring", optional_argument, 0, 0},
1189  {"pfring-int", required_argument, 0, 0},
1190  {"pfring-cluster-id", required_argument, 0, 0},
1191  {"pfring-cluster-type", required_argument, 0, 0},
1192  {"af-packet", optional_argument, 0, 0},
1193  {"netmap", optional_argument, 0, 0},
1194  {"pcap", optional_argument, 0, 0},
1195  {"pcap-file-continuous", 0, 0, 0},
1196  {"pcap-file-delete", 0, 0, 0},
1197  {"pcap-file-recursive", 0, 0, 0},
1198  {"simulate-ips", 0, 0 , 0},
1199  {"no-random", 0, &g_disable_randomness, 1},
1200  {"strict-rule-keywords", optional_argument, 0, 0},
1201 
1202  {"capture-plugin", required_argument, 0, 0},
1203  {"capture-plugin-args", required_argument, 0, 0},
1204 
1205 #ifdef BUILD_UNIX_SOCKET
1206  {"unix-socket", optional_argument, 0, 0},
1207 #endif
1208  {"pcap-buffer-size", required_argument, 0, 0},
1209  {"unittest-filter", required_argument, 0, 'U'},
1210  {"list-app-layer-protos", 0, &list_app_layer_protocols, 1},
1211  {"list-unittests", 0, &list_unittests, 1},
1212  {"list-runmodes", 0, &list_runmodes, 1},
1213  {"list-keywords", optional_argument, &list_keywords, 1},
1214  {"runmode", required_argument, NULL, 0},
1215  {"engine-analysis", 0, &engine_analysis, 1},
1216 #ifdef OS_WIN32
1217  {"service-install", 0, 0, 0},
1218  {"service-remove", 0, 0, 0},
1219  {"service-change-params", 0, 0, 0},
1220 #endif /* OS_WIN32 */
1221  {"pidfile", required_argument, 0, 0},
1222  {"init-errors-fatal", 0, 0, 0},
1223  {"disable-detection", 0, 0, 0},
1224  {"disable-hashing", 0, 0, 0},
1225  {"fatal-unittests", 0, 0, 0},
1226  {"unittests-coverage", 0, &coverage_unittests, 1},
1227  {"user", required_argument, 0, 0},
1228  {"group", required_argument, 0, 0},
1229  {"erf-in", required_argument, 0, 0},
1230  {"dag", required_argument, 0, 0},
1231  {"napatech", 0, 0, 0},
1232  {"build-info", 0, &build_info, 1},
1233  {"data-dir", required_argument, 0, 0},
1234 #ifdef WINDIVERT
1235  {"windivert", required_argument, 0, 0},
1236  {"windivert-forward", required_argument, 0, 0},
1237 #endif
1238 #ifdef HAVE_LIBNET11
1239  {"reject-dev", required_argument, 0, 0},
1240 #endif
1241  {"set", required_argument, 0, 0},
1242 #ifdef HAVE_NFLOG
1243  {"nflog", optional_argument, 0, 0},
1244 #endif
1245  {NULL, 0, NULL, 0}
1246  };
1247  // clang-format on
1248 
1249  /* getopt_long stores the option index here. */
1250  int option_index = 0;
1251 
1252  char short_opts[] = "c:TDhi:l:q:d:r:us:S:U:VF:vk:";
1253 
1254  while ((opt = getopt_long(argc, argv, short_opts, long_opts, &option_index)) != -1) {
1255  switch (opt) {
1256  case 0:
1257  if (strcmp((long_opts[option_index]).name , "pfring") == 0 ||
1258  strcmp((long_opts[option_index]).name , "pfring-int") == 0) {
1259 #ifdef HAVE_PFRING
1260  suri->run_mode = RUNMODE_PFRING;
1261  if (optarg != NULL) {
1262  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
1263  strlcpy(suri->pcap_dev, optarg,
1264  ((strlen(optarg) < sizeof(suri->pcap_dev)) ?
1265  (strlen(optarg) + 1) : sizeof(suri->pcap_dev)));
1266  LiveRegisterDeviceName(optarg);
1267  }
1268 #else
1269  SCLogError(SC_ERR_NO_PF_RING,"PF_RING not enabled. Make sure "
1270  "to pass --enable-pfring to configure when building.");
1271  return TM_ECODE_FAILED;
1272 #endif /* HAVE_PFRING */
1273  }
1274  else if(strcmp((long_opts[option_index]).name , "pfring-cluster-id") == 0){
1275 #ifdef HAVE_PFRING
1276  if (ConfSetFinal("pfring.cluster-id", optarg) != 1) {
1277  fprintf(stderr, "ERROR: Failed to set pfring.cluster-id.\n");
1278  return TM_ECODE_FAILED;
1279  }
1280 #else
1281  SCLogError(SC_ERR_NO_PF_RING,"PF_RING not enabled. Make sure "
1282  "to pass --enable-pfring to configure when building.");
1283  return TM_ECODE_FAILED;
1284 #endif /* HAVE_PFRING */
1285  }
1286  else if(strcmp((long_opts[option_index]).name , "pfring-cluster-type") == 0){
1287 #ifdef HAVE_PFRING
1288  if (ConfSetFinal("pfring.cluster-type", optarg) != 1) {
1289  fprintf(stderr, "ERROR: Failed to set pfring.cluster-type.\n");
1290  return TM_ECODE_FAILED;
1291  }
1292 #else
1293  SCLogError(SC_ERR_NO_PF_RING,"PF_RING not enabled. Make sure "
1294  "to pass --enable-pfring to configure when building.");
1295  return TM_ECODE_FAILED;
1296 #endif /* HAVE_PFRING */
1297  }
1298  else if (strcmp((long_opts[option_index]).name , "capture-plugin") == 0){
1299  suri->run_mode = RUNMODE_PLUGIN;
1300  suri->capture_plugin_name = optarg;
1301  }
1302  else if (strcmp((long_opts[option_index]).name , "capture-plugin-args") == 0){
1303  suri->capture_plugin_args = optarg;
1304  }
1305  else if (strcmp((long_opts[option_index]).name , "af-packet") == 0)
1306  {
1307  if (ParseCommandLineAfpacket(suri, optarg) != TM_ECODE_OK) {
1308  return TM_ECODE_FAILED;
1309  }
1310  } else if (strcmp((long_opts[option_index]).name , "netmap") == 0){
1311 #ifdef HAVE_NETMAP
1312  if (suri->run_mode == RUNMODE_UNKNOWN) {
1313  suri->run_mode = RUNMODE_NETMAP;
1314  if (optarg) {
1315  LiveRegisterDeviceName(optarg);
1316  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
1317  strlcpy(suri->pcap_dev, optarg,
1318  ((strlen(optarg) < sizeof(suri->pcap_dev)) ?
1319  (strlen(optarg) + 1) : sizeof(suri->pcap_dev)));
1320  }
1321  } else if (suri->run_mode == RUNMODE_NETMAP) {
1322  if (optarg) {
1323  LiveRegisterDeviceName(optarg);
1324  } else {
1325  SCLogInfo("Multiple netmap option without interface on each is useless");
1326  break;
1327  }
1328  } else {
1329  SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode "
1330  "has been specified");
1331  PrintUsage(argv[0]);
1332  return TM_ECODE_FAILED;
1333  }
1334 #else
1335  SCLogError(SC_ERR_NO_NETMAP, "NETMAP not enabled.");
1336  return TM_ECODE_FAILED;
1337 #endif
1338  } else if (strcmp((long_opts[option_index]).name, "nflog") == 0) {
1339 #ifdef HAVE_NFLOG
1340  if (suri->run_mode == RUNMODE_UNKNOWN) {
1341  suri->run_mode = RUNMODE_NFLOG;
1342  LiveBuildDeviceListCustom("nflog", "group");
1343  }
1344 #else
1345  SCLogError(SC_ERR_NFLOG_NOSUPPORT, "NFLOG not enabled.");
1346  return TM_ECODE_FAILED;
1347 #endif /* HAVE_NFLOG */
1348  } else if (strcmp((long_opts[option_index]).name , "pcap") == 0) {
1349  if (ParseCommandLinePcapLive(suri, optarg) != TM_ECODE_OK) {
1350  return TM_ECODE_FAILED;
1351  }
1352  } else if(strcmp((long_opts[option_index]).name, "simulate-ips") == 0) {
1353  SCLogInfo("Setting IPS mode");
1354  EngineModeSetIPS();
1355  } else if(strcmp((long_opts[option_index]).name, "init-errors-fatal") == 0) {
1356  if (ConfSetFinal("engine.init-failure-fatal", "1") != 1) {
1357  fprintf(stderr, "ERROR: Failed to set engine init-failure-fatal.\n");
1358  return TM_ECODE_FAILED;
1359  }
1360 #ifdef BUILD_UNIX_SOCKET
1361  } else if (strcmp((long_opts[option_index]).name , "unix-socket") == 0) {
1362  if (suri->run_mode == RUNMODE_UNKNOWN) {
1363  suri->run_mode = RUNMODE_UNIX_SOCKET;
1364  if (optarg) {
1365  if (ConfSetFinal("unix-command.filename", optarg) != 1) {
1366  fprintf(stderr, "ERROR: Failed to set unix-command.filename.\n");
1367  return TM_ECODE_FAILED;
1368  }
1369 
1370  }
1371  } else {
1372  SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode "
1373  "has been specified");
1374  PrintUsage(argv[0]);
1375  return TM_ECODE_FAILED;
1376  }
1377 #endif
1378  }
1379  else if(strcmp((long_opts[option_index]).name, "list-app-layer-protocols") == 0) {
1380  /* listing all supported app layer protocols */
1381  }
1382  else if(strcmp((long_opts[option_index]).name, "list-unittests") == 0) {
1383 #ifdef UNITTESTS
1385 #else
1386  fprintf(stderr, "ERROR: Unit tests not enabled. Make sure to pass --enable-unittests to configure when building.\n");
1387  return TM_ECODE_FAILED;
1388 #endif /* UNITTESTS */
1389  } else if (strcmp((long_opts[option_index]).name, "list-runmodes") == 0) {
1391  return TM_ECODE_OK;
1392  } else if (strcmp((long_opts[option_index]).name, "list-keywords") == 0) {
1393  if (optarg) {
1394  if (strcmp("short",optarg)) {
1395  suri->keyword_info = optarg;
1396  }
1397  }
1398  } else if (strcmp((long_opts[option_index]).name, "runmode") == 0) {
1399  suri->runmode_custom_mode = optarg;
1400  } else if(strcmp((long_opts[option_index]).name, "engine-analysis") == 0) {
1401  // do nothing for now
1402  }
1403 #ifdef OS_WIN32
1404  else if(strcmp((long_opts[option_index]).name, "service-install") == 0) {
1405  suri->run_mode = RUNMODE_INSTALL_SERVICE;
1406  return TM_ECODE_OK;
1407  }
1408  else if(strcmp((long_opts[option_index]).name, "service-remove") == 0) {
1409  suri->run_mode = RUNMODE_REMOVE_SERVICE;
1410  return TM_ECODE_OK;
1411  }
1412  else if(strcmp((long_opts[option_index]).name, "service-change-params") == 0) {
1413  suri->run_mode = RUNMODE_CHANGE_SERVICE_PARAMS;
1414  return TM_ECODE_OK;
1415  }
1416 #endif /* OS_WIN32 */
1417  else if(strcmp((long_opts[option_index]).name, "pidfile") == 0) {
1418  suri->pid_filename = SCStrdup(optarg);
1419  if (suri->pid_filename == NULL) {
1420  SCLogError(SC_ERR_MEM_ALLOC, "strdup failed: %s",
1421  strerror(errno));
1422  return TM_ECODE_FAILED;
1423  }
1424  }
1425  else if(strcmp((long_opts[option_index]).name, "disable-detection") == 0) {
1426  g_detect_disabled = suri->disabled_detect = 1;
1427  } else if (strcmp((long_opts[option_index]).name, "disable-hashing") == 0) {
1428  g_disable_hashing = true;
1429  } else if (strcmp((long_opts[option_index]).name, "fatal-unittests") == 0) {
1430 #ifdef UNITTESTS
1431  unittests_fatal = 1;
1432 #else
1433  fprintf(stderr, "ERROR: Unit tests not enabled. Make sure to pass --enable-unittests to configure when building.\n");
1434  return TM_ECODE_FAILED;
1435 #endif /* UNITTESTS */
1436  } else if (strcmp((long_opts[option_index]).name, "user") == 0) {
1437 #ifndef HAVE_LIBCAP_NG
1438  SCLogError(SC_ERR_LIBCAP_NG_REQUIRED, "libcap-ng is required to"
1439  " drop privileges, but it was not compiled into Suricata.");
1440  return TM_ECODE_FAILED;
1441 #else
1442  suri->user_name = optarg;
1443  suri->do_setuid = TRUE;
1444 #endif /* HAVE_LIBCAP_NG */
1445  } else if (strcmp((long_opts[option_index]).name, "group") == 0) {
1446 #ifndef HAVE_LIBCAP_NG
1447  SCLogError(SC_ERR_LIBCAP_NG_REQUIRED, "libcap-ng is required to"
1448  " drop privileges, but it was not compiled into Suricata.");
1449  return TM_ECODE_FAILED;
1450 #else
1451  suri->group_name = optarg;
1452  suri->do_setgid = TRUE;
1453 #endif /* HAVE_LIBCAP_NG */
1454  } else if (strcmp((long_opts[option_index]).name, "erf-in") == 0) {
1455  suri->run_mode = RUNMODE_ERF_FILE;
1456  if (ConfSetFinal("erf-file.file", optarg) != 1) {
1457  fprintf(stderr, "ERROR: Failed to set erf-file.file\n");
1458  return TM_ECODE_FAILED;
1459  }
1460  } else if (strcmp((long_opts[option_index]).name, "dag") == 0) {
1461 #ifdef HAVE_DAG
1462  if (suri->run_mode == RUNMODE_UNKNOWN) {
1463  suri->run_mode = RUNMODE_DAG;
1464  }
1465  else if (suri->run_mode != RUNMODE_DAG) {
1467  "more than one run mode has been specified");
1468  PrintUsage(argv[0]);
1469  return TM_ECODE_FAILED;
1470  }
1471  LiveRegisterDeviceName(optarg);
1472 #else
1473  SCLogError(SC_ERR_DAG_REQUIRED, "libdag and a DAG card are required"
1474  " to receive packets using --dag.");
1475  return TM_ECODE_FAILED;
1476 #endif /* HAVE_DAG */
1477  } else if (strcmp((long_opts[option_index]).name, "napatech") == 0) {
1478 #ifdef HAVE_NAPATECH
1479  suri->run_mode = RUNMODE_NAPATECH;
1480 #else
1481  SCLogError(SC_ERR_NAPATECH_REQUIRED, "libntapi and a Napatech adapter are required"
1482  " to capture packets using --napatech.");
1483  return TM_ECODE_FAILED;
1484 #endif /* HAVE_NAPATECH */
1485  } else if (strcmp((long_opts[option_index]).name, "pcap-buffer-size") == 0) {
1486 #ifdef HAVE_PCAP_SET_BUFF
1487  if (ConfSetFinal("pcap.buffer-size", optarg) != 1) {
1488  fprintf(stderr, "ERROR: Failed to set pcap-buffer-size.\n");
1489  return TM_ECODE_FAILED;
1490  }
1491 #else
1492  SCLogError(SC_ERR_NO_PCAP_SET_BUFFER_SIZE, "The version of libpcap you have"
1493  " doesn't support setting buffer size.");
1494 #endif /* HAVE_PCAP_SET_BUFF */
1495  } else if (strcmp((long_opts[option_index]).name, "build-info") == 0) {
1497  return TM_ECODE_OK;
1498  } else if (strcmp((long_opts[option_index]).name, "windivert-forward") == 0) {
1499 #ifdef WINDIVERT
1500  if (suri->run_mode == RUNMODE_UNKNOWN) {
1501  suri->run_mode = RUNMODE_WINDIVERT;
1502  if (WinDivertRegisterQueue(true, optarg) == -1) {
1503  exit(EXIT_FAILURE);
1504  }
1505  } else if (suri->run_mode == RUNMODE_WINDIVERT) {
1506  if (WinDivertRegisterQueue(true, optarg) == -1) {
1507  exit(EXIT_FAILURE);
1508  }
1509  } else {
1510  SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode "
1511  "has been specified");
1512  PrintUsage(argv[0]);
1513  exit(EXIT_FAILURE);
1514  }
1515  }
1516  else if(strcmp((long_opts[option_index]).name, "windivert") == 0) {
1517  if (suri->run_mode == RUNMODE_UNKNOWN) {
1518  suri->run_mode = RUNMODE_WINDIVERT;
1519  if (WinDivertRegisterQueue(false, optarg) == -1) {
1520  exit(EXIT_FAILURE);
1521  }
1522  } else if (suri->run_mode == RUNMODE_WINDIVERT) {
1523  if (WinDivertRegisterQueue(false, optarg) == -1) {
1524  exit(EXIT_FAILURE);
1525  }
1526  } else {
1527  SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode "
1528  "has been specified");
1529  PrintUsage(argv[0]);
1530  exit(EXIT_FAILURE);
1531  }
1532 #else
1533  SCLogError(SC_ERR_WINDIVERT_NOSUPPORT,"WinDivert not enabled. Make sure to pass --enable-windivert to configure when building.");
1534  return TM_ECODE_FAILED;
1535 #endif /* WINDIVERT */
1536  } else if(strcmp((long_opts[option_index]).name, "reject-dev") == 0) {
1537 #ifdef HAVE_LIBNET11
1538  BUG_ON(optarg == NULL); /* for static analysis */
1539  extern char *g_reject_dev;
1540  extern uint16_t g_reject_dev_mtu;
1541  g_reject_dev = optarg;
1542  int mtu = GetIfaceMTU(g_reject_dev);
1543  if (mtu > 0) {
1544  g_reject_dev_mtu = (uint16_t)mtu;
1545  }
1546 #else
1548  "Libnet 1.1 support not enabled. Compile Suricata with libnet support.");
1549  return TM_ECODE_FAILED;
1550 #endif
1551  }
1552  else if (strcmp((long_opts[option_index]).name, "set") == 0) {
1553  if (optarg != NULL) {
1554  /* Quick validation. */
1555  char *val = strchr(optarg, '=');
1556  if (val == NULL) {
1558  "Invalid argument for --set, must be key=val.");
1559  }
1560  if (!ConfSetFromString(optarg, 1)) {
1561  fprintf(stderr, "Failed to set configuration value %s.",
1562  optarg);
1563  exit(EXIT_FAILURE);
1564  }
1565  }
1566  }
1567  else if (strcmp((long_opts[option_index]).name, "pcap-file-continuous") == 0) {
1568  if (ConfSetFinal("pcap-file.continuous", "true") != 1) {
1569  SCLogError(SC_ERR_CMD_LINE, "Failed to set pcap-file.continuous");
1570  return TM_ECODE_FAILED;
1571  }
1572  }
1573  else if (strcmp((long_opts[option_index]).name, "pcap-file-delete") == 0) {
1574  if (ConfSetFinal("pcap-file.delete-when-done", "true") != 1) {
1575  SCLogError(SC_ERR_CMD_LINE, "Failed to set pcap-file.delete-when-done");
1576  return TM_ECODE_FAILED;
1577  }
1578  }
1579  else if (strcmp((long_opts[option_index]).name, "pcap-file-recursive") == 0) {
1580  if (ConfSetFinal("pcap-file.recursive", "true") != 1) {
1581  SCLogError(SC_ERR_CMD_LINE, "ERROR: Failed to set pcap-file.recursive");
1582  return TM_ECODE_FAILED;
1583  }
1584  }
1585  else if (strcmp((long_opts[option_index]).name, "data-dir") == 0) {
1586  if (optarg == NULL) {
1587  SCLogError(SC_ERR_INITIALIZATION, "no option argument (optarg) for -d");
1588  return TM_ECODE_FAILED;
1589  }
1590 
1591  if (ConfigSetDataDirectory(optarg) != TM_ECODE_OK) {
1592  SCLogError(SC_ERR_FATAL, "Failed to set data directory.");
1593  return TM_ECODE_FAILED;
1594  }
1595  if (ConfigCheckDataDirectory(optarg) != TM_ECODE_OK) {
1596  SCLogError(SC_ERR_LOGDIR_CMDLINE, "The data directory \"%s\""
1597  " supplied at the commandline (-d %s) doesn't "
1598  "exist. Shutting down the engine.", optarg, optarg);
1599  return TM_ECODE_FAILED;
1600  }
1601  suri->set_datadir = true;
1602  } else if (strcmp((long_opts[option_index]).name , "strict-rule-keywords") == 0){
1603  if (optarg == NULL) {
1604  suri->strict_rule_parsing_string = SCStrdup("all");
1605  } else {
1606  suri->strict_rule_parsing_string = SCStrdup(optarg);
1607  }
1608  if (suri->strict_rule_parsing_string == NULL) {
1609  FatalError(SC_ERR_MEM_ALLOC, "failed to duplicate 'strict' string");
1610  }
1611  }
1612  break;
1613  case 'c':
1614  suri->conf_filename = optarg;
1615  break;
1616  case 'T':
1617  SCLogInfo("Running suricata under test mode");
1618  conf_test = 1;
1619  if (ConfSetFinal("engine.init-failure-fatal", "1") != 1) {
1620  fprintf(stderr, "ERROR: Failed to set engine init-failure-fatal.\n");
1621  return TM_ECODE_FAILED;
1622  }
1623  break;
1624 #ifndef OS_WIN32
1625  case 'D':
1626  suri->daemon = 1;
1627  break;
1628 #endif /* OS_WIN32 */
1629  case 'h':
1630  suri->run_mode = RUNMODE_PRINT_USAGE;
1631  return TM_ECODE_OK;
1632  case 'i':
1633  if (optarg == NULL) {
1634  SCLogError(SC_ERR_INITIALIZATION, "no option argument (optarg) for -i");
1635  return TM_ECODE_FAILED;
1636  }
1637 #ifdef HAVE_AF_PACKET
1638  if (ParseCommandLineAfpacket(suri, optarg) != TM_ECODE_OK) {
1639  return TM_ECODE_FAILED;
1640  }
1641 #else /* not afpacket */
1642  /* warn user if netmap or pf-ring are available */
1643 #if defined HAVE_PFRING || HAVE_NETMAP
1644  int i = 0;
1645 #ifdef HAVE_PFRING
1646  i++;
1647 #endif
1648 #ifdef HAVE_NETMAP
1649  i++;
1650 #endif
1652  "option%s %s available:"
1653 #ifdef HAVE_PFRING
1654  " PF_RING (--pfring-int=%s)"
1655 #endif
1656 #ifdef HAVE_NETMAP
1657  " NETMAP (--netmap=%s)"
1658 #endif
1659  ". Use --pcap=%s to suppress this warning",
1660  i == 1 ? "" : "s", i == 1 ? "is" : "are"
1661 #ifdef HAVE_PFRING
1662  , optarg
1663 #endif
1664 #ifdef HAVE_NETMAP
1665  , optarg
1666 #endif
1667  , optarg
1668  );
1669 #endif /* have faster methods */
1670  if (ParseCommandLinePcapLive(suri, optarg) != TM_ECODE_OK) {
1671  return TM_ECODE_FAILED;
1672  }
1673 #endif
1674  break;
1675  case 'l':
1676  if (optarg == NULL) {
1677  SCLogError(SC_ERR_INITIALIZATION, "no option argument (optarg) for -l");
1678  return TM_ECODE_FAILED;
1679  }
1680 
1681  if (ConfigSetLogDirectory(optarg) != TM_ECODE_OK) {
1682  SCLogError(SC_ERR_FATAL, "Failed to set log directory.");
1683  return TM_ECODE_FAILED;
1684  }
1685  if (ConfigCheckLogDirectoryExists(optarg) != TM_ECODE_OK) {
1686  SCLogError(SC_ERR_LOGDIR_CMDLINE, "The logging directory \"%s\""
1687  " supplied at the commandline (-l %s) doesn't "
1688  "exist. Shutting down the engine.", optarg, optarg);
1689  return TM_ECODE_FAILED;
1690  }
1691  if (!IsLogDirectoryWritable(optarg)) {
1692  SCLogError(SC_ERR_LOGDIR_CMDLINE, "The logging directory \"%s\""
1693  " supplied at the commandline (-l %s) is not "
1694  "writable. Shutting down the engine.", optarg, optarg);
1695  return TM_ECODE_FAILED;
1696  }
1697  suri->set_logdir = true;
1698 
1699  break;
1700  case 'q':
1701 #ifdef NFQ
1702  if (suri->run_mode == RUNMODE_UNKNOWN) {
1703  suri->run_mode = RUNMODE_NFQ;
1704  EngineModeSetIPS();
1705  if (NFQParseAndRegisterQueues(optarg) == -1)
1706  return TM_ECODE_FAILED;
1707  } else if (suri->run_mode == RUNMODE_NFQ) {
1708  if (NFQParseAndRegisterQueues(optarg) == -1)
1709  return TM_ECODE_FAILED;
1710  } else {
1711  SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode "
1712  "has been specified");
1713  PrintUsage(argv[0]);
1714  return TM_ECODE_FAILED;
1715  }
1716 #else
1717  SCLogError(SC_ERR_NFQ_NOSUPPORT,"NFQUEUE not enabled. Make sure to pass --enable-nfqueue to configure when building.");
1718  return TM_ECODE_FAILED;
1719 #endif /* NFQ */
1720  break;
1721  case 'd':
1722 #ifdef IPFW
1723  if (suri->run_mode == RUNMODE_UNKNOWN) {
1724  suri->run_mode = RUNMODE_IPFW;
1725  EngineModeSetIPS();
1726  if (IPFWRegisterQueue(optarg) == -1)
1727  return TM_ECODE_FAILED;
1728  } else if (suri->run_mode == RUNMODE_IPFW) {
1729  if (IPFWRegisterQueue(optarg) == -1)
1730  return TM_ECODE_FAILED;
1731  } else {
1732  SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode "
1733  "has been specified");
1734  PrintUsage(argv[0]);
1735  return TM_ECODE_FAILED;
1736  }
1737 #else
1738  SCLogError(SC_ERR_IPFW_NOSUPPORT,"IPFW not enabled. Make sure to pass --enable-ipfw to configure when building.");
1739  return TM_ECODE_FAILED;
1740 #endif /* IPFW */
1741  break;
1742  case 'r':
1743  BUG_ON(optarg == NULL); /* for static analysis */
1744  if (suri->run_mode == RUNMODE_UNKNOWN) {
1745  suri->run_mode = RUNMODE_PCAP_FILE;
1746  } else {
1747  SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode "
1748  "has been specified");
1749  PrintUsage(argv[0]);
1750  return TM_ECODE_FAILED;
1751  }
1752 #ifdef OS_WIN32
1753  struct _stat buf;
1754  if(_stat(optarg, &buf) != 0) {
1755 #else
1756  struct stat buf;
1757  if (stat(optarg, &buf) != 0) {
1758 #endif /* OS_WIN32 */
1759  SCLogError(SC_ERR_INITIALIZATION, "ERROR: Pcap file does not exist\n");
1760  return TM_ECODE_FAILED;
1761  }
1762  if (ConfSetFinal("pcap-file.file", optarg) != 1) {
1763  SCLogError(SC_ERR_INITIALIZATION, "ERROR: Failed to set pcap-file.file\n");
1764  return TM_ECODE_FAILED;
1765  }
1766 
1767  break;
1768  case 's':
1769  if (suri->sig_file != NULL) {
1770  SCLogError(SC_ERR_CMD_LINE, "can't have multiple -s options or mix -s and -S.");
1771  return TM_ECODE_FAILED;
1772  }
1773  suri->sig_file = optarg;
1774  break;
1775  case 'S':
1776  if (suri->sig_file != NULL) {
1777  SCLogError(SC_ERR_CMD_LINE, "can't have multiple -S options or mix -s and -S.");
1778  return TM_ECODE_FAILED;
1779  }
1780  suri->sig_file = optarg;
1781  suri->sig_file_exclusive = TRUE;
1782  break;
1783  case 'u':
1784 #ifdef UNITTESTS
1785  if (suri->run_mode == RUNMODE_UNKNOWN) {
1786  suri->run_mode = RUNMODE_UNITTEST;
1787  } else {
1788  SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode has"
1789  " been specified");
1790  PrintUsage(argv[0]);
1791  return TM_ECODE_FAILED;
1792  }
1793 #else
1794  fprintf(stderr, "ERROR: Unit tests not enabled. Make sure to pass --enable-unittests to configure when building.\n");
1795  return TM_ECODE_FAILED;
1796 #endif /* UNITTESTS */
1797  break;
1798  case 'U':
1799 #ifdef UNITTESTS
1800  suri->regex_arg = optarg;
1801 
1802  if(strlen(suri->regex_arg) == 0)
1803  suri->regex_arg = NULL;
1804 #endif
1805  break;
1806  case 'V':
1808  return TM_ECODE_OK;
1809  case 'F':
1810  if (optarg == NULL) {
1811  SCLogError(SC_ERR_INITIALIZATION, "no option argument (optarg) for -F");
1812  return TM_ECODE_FAILED;
1813  }
1814 
1815  SetBpfStringFromFile(optarg);
1816  break;
1817  case 'v':
1818  suri->verbose++;
1819  break;
1820  case 'k':
1821  if (optarg == NULL) {
1822  SCLogError(SC_ERR_INITIALIZATION, "no option argument (optarg) for -k");
1823  return TM_ECODE_FAILED;
1824  }
1825  if (!strcmp("all", optarg))
1826  suri->checksum_validation = 1;
1827  else if (!strcmp("none", optarg))
1828  suri->checksum_validation = 0;
1829  else {
1830  SCLogError(SC_ERR_INITIALIZATION, "option '%s' invalid for -k", optarg);
1831  return TM_ECODE_FAILED;
1832  }
1833  break;
1834  default:
1835  PrintUsage(argv[0]);
1836  return TM_ECODE_FAILED;
1837  }
1838  }
1839 
1840  if (suri->disabled_detect && suri->sig_file != NULL) {
1841  SCLogError(SC_ERR_INITIALIZATION, "can't use -s/-S when detection is disabled");
1842  return TM_ECODE_FAILED;
1843  }
1844 
1845  /* save the runmode from the commandline (if any) */
1846  suri->aux_run_mode = suri->run_mode;
1847 
1848  if (list_app_layer_protocols)
1850  if (list_keywords)
1852  if (list_unittests)
1854  if (dump_config)
1855  suri->run_mode = RUNMODE_DUMP_CONFIG;
1856  if (dump_features)
1858  if (conf_test)
1859  suri->run_mode = RUNMODE_CONF_TEST;
1860  if (engine_analysis)
1862 
1863  suri->offline = IsRunModeOffline(suri->run_mode);
1864  g_system = suri->system = IsRunModeSystem(suri->run_mode);
1865 
1866  ret = SetBpfString(optind, argv);
1867  if (ret != TM_ECODE_OK)
1868  return ret;
1869 
1870  return TM_ECODE_OK;
1871 }
1872 
1873 #ifdef OS_WIN32
1874 static int WindowsInitService(int argc, char **argv)
1875 {
1876  if (SCRunningAsService()) {
1877  char path[MAX_PATH];
1878  char *p = NULL;
1879  strlcpy(path, argv[0], MAX_PATH);
1880  if ((p = strrchr(path, '\\'))) {
1881  *p = '\0';
1882  }
1883  if (!SetCurrentDirectory(path)) {
1884  SCLogError(SC_ERR_FATAL, "Can't set current directory to: %s", path);
1885  return -1;
1886  }
1887  SCLogInfo("Current directory is set to: %s", path);
1888  SCServiceInit(argc, argv);
1889  }
1890 
1891  /* Windows socket subsystem initialization */
1892  WSADATA wsaData;
1893  if (0 != WSAStartup(MAKEWORD(2, 2), &wsaData)) {
1894  SCLogError(SC_ERR_FATAL, "Can't initialize Windows sockets: %d", WSAGetLastError());
1895  return -1;
1896  }
1897 
1898  return 0;
1899 }
1900 #endif /* OS_WIN32 */
1901 
1902 static int MayDaemonize(SCInstance *suri)
1903 {
1904  if (suri->daemon == 1 && suri->pid_filename == NULL) {
1905  const char *pid_filename;
1906 
1907  if (ConfGet("pid-file", &pid_filename) == 1) {
1908  SCLogInfo("Use pid file %s from config file.", pid_filename);
1909  } else {
1910  pid_filename = DEFAULT_PID_FILENAME;
1911  }
1912  /* The pid file name may be in config memory, but is needed later. */
1913  suri->pid_filename = SCStrdup(pid_filename);
1914  if (suri->pid_filename == NULL) {
1915  SCLogError(SC_ERR_MEM_ALLOC, "strdup failed: %s", strerror(errno));
1916  return TM_ECODE_FAILED;
1917  }
1918  }
1919 
1920  if (suri->pid_filename != NULL && SCPidfileTestRunning(suri->pid_filename) != 0) {
1921  SCFree(suri->pid_filename);
1922  suri->pid_filename = NULL;
1923  return TM_ECODE_FAILED;
1924  }
1925 
1926  if (suri->daemon == 1) {
1927  Daemonize();
1928  }
1929 
1930  if (suri->pid_filename != NULL) {
1931  if (SCPidfileCreate(suri->pid_filename) != 0) {
1932  SCFree(suri->pid_filename);
1933  suri->pid_filename = NULL;
1935  "Unable to create PID file, concurrent run of"
1936  " Suricata can occur.");
1938  "PID file creation WILL be mandatory for daemon mode"
1939  " in future version");
1940  }
1941  }
1942 
1943  return TM_ECODE_OK;
1944 }
1945 
1946 static int InitSignalHandler(SCInstance *suri)
1947 {
1948  /* registering signals we use */
1949 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1950  UtilSignalHandlerSetup(SIGINT, SignalHandlerSigint);
1951  UtilSignalHandlerSetup(SIGTERM, SignalHandlerSigterm);
1952 #endif
1953 #ifndef OS_WIN32
1954  UtilSignalHandlerSetup(SIGHUP, SignalHandlerSigHup);
1955  UtilSignalHandlerSetup(SIGPIPE, SIG_IGN);
1956  UtilSignalHandlerSetup(SIGSYS, SIG_IGN);
1957 
1958  /* Try to get user/group to run suricata as if
1959  command line as not decide of that */
1960  if (suri->do_setuid == FALSE && suri->do_setgid == FALSE) {
1961  const char *id;
1962  if (ConfGet("run-as.user", &id) == 1) {
1963  suri->do_setuid = TRUE;
1964  suri->user_name = id;
1965  }
1966  if (ConfGet("run-as.group", &id) == 1) {
1967  suri->do_setgid = TRUE;
1968  suri->group_name = id;
1969  }
1970  }
1971  /* Get the suricata user ID to given user ID */
1972  if (suri->do_setuid == TRUE) {
1973  if (SCGetUserID(suri->user_name, suri->group_name,
1974  &suri->userid, &suri->groupid) != 0) {
1975  SCLogError(SC_ERR_UID_FAILED, "failed in getting user ID");
1976  return TM_ECODE_FAILED;
1977  }
1978 
1979  sc_set_caps = TRUE;
1980  /* Get the suricata group ID to given group ID */
1981  } else if (suri->do_setgid == TRUE) {
1982  if (SCGetGroupID(suri->group_name, &suri->groupid) != 0) {
1983  SCLogError(SC_ERR_GID_FAILED, "failed in getting group ID");
1984  return TM_ECODE_FAILED;
1985  }
1986 
1987  sc_set_caps = TRUE;
1988  }
1989 #endif /* OS_WIN32 */
1990 
1991  return TM_ECODE_OK;
1992 }
1993 
1994 /* initialization code for both the main modes and for
1995  * unix socket mode.
1996  *
1997  * Will be run once per pcap in unix-socket mode */
1998 void PreRunInit(const int runmode)
1999 {
2000  /* Initialize Datasets to be able to use them with unix socket */
2001  DatasetsInit();
2002  if (runmode == RUNMODE_UNIX_SOCKET)
2003  return;
2004 
2005  StatsInit();
2006 #ifdef PROFILING
2011  SCProfilingInit();
2012 #endif /* PROFILING */
2013  DefragInit();
2020 }
2021 
2022 /* tasks we need to run before packets start flowing,
2023  * but after we dropped privs */
2024 void PreRunPostPrivsDropInit(const int runmode)
2025 {
2028 
2029  if (runmode == RUNMODE_UNIX_SOCKET) {
2030  /* As the above did some necessary startup initialization, it
2031  * also setup some outputs where only one is allowed, so
2032  * deinitialize to the state that unix-mode does after every
2033  * pcap. */
2035  return;
2036  }
2037 
2039 }
2040 
2041 /* clean up / shutdown code for both the main modes and for
2042  * unix socket mode.
2043  *
2044  * Will be run once per pcap in unix-socket mode */
2045 void PostRunDeinit(const int runmode, struct timeval *start_time)
2046 {
2047  if (runmode == RUNMODE_UNIX_SOCKET)
2048  return;
2049 
2050  /* needed by FlowForceReassembly */
2051  PacketPoolInit();
2052 
2053  /* handle graceful shutdown of the flow engine, it's helper
2054  * threads and the packet threads */
2059  SCPrintElapsedTime(start_time);
2061 
2062  /* kill the stats threads */
2065 
2066  /* kill packet threads -- already in 'disabled' state */
2069 
2071 
2072  /* mgt and ppt threads killed, we can run non thread-safe
2073  * shutdown functions */
2076  RunModeShutDown();
2077  FlowShutdown();
2078  IPPairShutdown();
2079  HostCleanup();
2081  DefragDestroy();
2082 
2083  TmqResetQueues();
2084 #ifdef PROFILING
2086  SCProfilingDump();
2088 #endif
2089 }
2090 
2091 
2092 static int StartInternalRunMode(SCInstance *suri, int argc, char **argv)
2093 {
2094  /* Treat internal running mode */
2095  switch(suri->run_mode) {
2096  case RUNMODE_LIST_KEYWORDS:
2097  return ListKeywords(suri->keyword_info);
2099  if (suri->conf_filename != NULL) {
2100  return ListAppLayerProtocols(suri->conf_filename);
2101  } else {
2103  }
2104  case RUNMODE_PRINT_VERSION:
2105  PrintVersion();
2106  return TM_ECODE_DONE;
2108  PrintBuildInfo();
2109  return TM_ECODE_DONE;
2110  case RUNMODE_PRINT_USAGE:
2111  PrintUsage(argv[0]);
2112  return TM_ECODE_DONE;
2113  case RUNMODE_LIST_RUNMODES:
2115  return TM_ECODE_DONE;
2116  case RUNMODE_LIST_UNITTEST:
2117  RunUnittests(1, suri->regex_arg);
2118  case RUNMODE_UNITTEST:
2119  RunUnittests(0, suri->regex_arg);
2120 #ifdef OS_WIN32
2121  case RUNMODE_INSTALL_SERVICE:
2122  if (SCServiceInstall(argc, argv)) {
2123  return TM_ECODE_FAILED;
2124  }
2125  SCLogInfo("Suricata service has been successfuly installed.");
2126  return TM_ECODE_DONE;
2127  case RUNMODE_REMOVE_SERVICE:
2128  if (SCServiceRemove(argc, argv)) {
2129  return TM_ECODE_FAILED;
2130  }
2131  SCLogInfo("Suricata service has been successfuly removed.");
2132  return TM_ECODE_DONE;
2133  case RUNMODE_CHANGE_SERVICE_PARAMS:
2134  if (SCServiceChangeParams(argc, argv)) {
2135  return TM_ECODE_FAILED;
2136  }
2137  SCLogInfo("Suricata service startup parameters has been successfuly changed.");
2138  return TM_ECODE_DONE;
2139 #endif /* OS_WIN32 */
2140  default:
2141  /* simply continue for other running mode */
2142  break;
2143  }
2144  return TM_ECODE_OK;
2145 }
2146 
2147 static int FinalizeRunMode(SCInstance *suri, char **argv)
2148 {
2149  switch (suri->run_mode) {
2150  case RUNMODE_UNKNOWN:
2151  PrintUsage(argv[0]);
2152  return TM_ECODE_FAILED;
2153  default:
2154  break;
2155  }
2156  /* Set the global run mode and offline flag. */
2157  run_mode = suri->run_mode;
2158 
2159  if (!CheckValidDaemonModes(suri->daemon, suri->run_mode)) {
2160  return TM_ECODE_FAILED;
2161  }
2162 
2163  return TM_ECODE_OK;
2164 }
2165 
2166 static void SetupDelayedDetect(SCInstance *suri)
2167 {
2168  /* In offline mode delayed init of detect is a bad idea */
2169  if (suri->offline) {
2170  suri->delayed_detect = 0;
2171  } else {
2172  if (ConfGetBool("detect.delayed-detect", &suri->delayed_detect) != 1) {
2173  ConfNode *denode = NULL;
2174  ConfNode *decnf = ConfGetNode("detect-engine");
2175  if (decnf != NULL) {
2176  TAILQ_FOREACH(denode, &decnf->head, next) {
2177  if (strcmp(denode->val, "delayed-detect") == 0) {
2178  (void)ConfGetChildValueBool(denode, "delayed-detect", &suri->delayed_detect);
2179  }
2180  }
2181  }
2182  }
2183  }
2184 
2185  SCLogConfig("Delayed detect %s", suri->delayed_detect ? "enabled" : "disabled");
2186  if (suri->delayed_detect) {
2187  SCLogInfo("Packets will start being processed before signatures are active.");
2188  }
2189 
2190 }
2191 
2192 static int LoadSignatures(DetectEngineCtx *de_ctx, SCInstance *suri)
2193 {
2194  if (SigLoadSignatures(de_ctx, suri->sig_file, suri->sig_file_exclusive) < 0) {
2195  SCLogError(SC_ERR_NO_RULES_LOADED, "Loading signatures failed.");
2196  if (de_ctx->failure_fatal)
2197  return TM_ECODE_FAILED;
2198  }
2199 
2200  return TM_ECODE_OK;
2201 }
2202 
2203 static int ConfigGetCaptureValue(SCInstance *suri)
2204 {
2205  /* Pull the max pending packets from the config, if not found fall
2206  * back on a sane default. */
2207  if (ConfGetInt("max-pending-packets", &max_pending_packets) != 1)
2209  if (max_pending_packets >= 65535) {
2211  "Maximum max-pending-packets setting is 65534. "
2212  "Please check %s for errors", suri->conf_filename);
2213  return TM_ECODE_FAILED;
2214  }
2215 
2216  SCLogDebug("Max pending packets set to %"PRIiMAX, max_pending_packets);
2217 
2218  /* Pull the default packet size from the config, if not found fall
2219  * back on a sane default. */
2220  const char *temp_default_packet_size;
2221  if ((ConfGet("default-packet-size", &temp_default_packet_size)) != 1) {
2222  int mtu = 0;
2223  int lthread;
2224  int nlive;
2225  int strip_trailing_plus = 0;
2226  switch (suri->run_mode) {
2227 #ifdef WINDIVERT
2228  case RUNMODE_WINDIVERT:
2229  /* by default, WinDivert collects from all devices */
2230  mtu = GetGlobalMTUWin32();
2231 
2232  if (mtu > 0) {
2233  g_default_mtu = mtu;
2234  /* SLL_HEADER_LEN is the longest header + 8 for VLAN */
2235  default_packet_size = mtu + SLL_HEADER_LEN + 8;
2236  break;
2237  }
2238 
2241  break;
2242 #endif /* WINDIVERT */
2243  case RUNMODE_NETMAP:
2244  /* in netmap igb0+ has a special meaning, however the
2245  * interface really is igb0 */
2246  strip_trailing_plus = 1;
2247  /* fall through */
2248  case RUNMODE_PCAP_DEV:
2249  case RUNMODE_AFP_DEV:
2250  case RUNMODE_PFRING:
2251  nlive = LiveGetDeviceNameCount();
2252  for (lthread = 0; lthread < nlive; lthread++) {
2253  const char *live_dev = LiveGetDeviceNameName(lthread);
2254  char dev[128]; /* need to be able to support GUID names on Windows */
2255  (void)strlcpy(dev, live_dev, sizeof(dev));
2256 
2257  if (strip_trailing_plus) {
2258  size_t len = strlen(dev);
2259  if (len &&
2260  (dev[len-1] == '+' ||
2261  dev[len-1] == '^' ||
2262  dev[len-1] == '*'))
2263  {
2264  dev[len-1] = '\0';
2265  }
2266  }
2267  mtu = GetIfaceMTU(dev);
2269 
2270  unsigned int iface_max_packet_size = GetIfaceMaxPacketSize(dev);
2271  if (iface_max_packet_size > default_packet_size)
2272  default_packet_size = iface_max_packet_size;
2273  }
2274  if (default_packet_size)
2275  break;
2276  /* fall through */
2277  default:
2280  }
2281  } else {
2282  if (ParseSizeStringU32(temp_default_packet_size, &default_packet_size) < 0) {
2283  SCLogError(SC_ERR_SIZE_PARSE, "Error parsing max-pending-packets "
2284  "from conf file - %s. Killing engine",
2285  temp_default_packet_size);
2286  return TM_ECODE_FAILED;
2287  }
2288  }
2289 
2290  SCLogDebug("Default packet size set to %"PRIu32, default_packet_size);
2291 
2292  return TM_ECODE_OK;
2293 }
2294 
2295 static void PostRunStartedDetectSetup(const SCInstance *suri)
2296 {
2297 #ifndef OS_WIN32
2298  /* registering signal handlers we use. We setup usr2 here, so that one
2299  * can't call it during the first sig load phase or while threads are still
2300  * starting up. */
2301  if (DetectEngineEnabled() && suri->delayed_detect == 0) {
2302  UtilSignalHandlerSetup(SIGUSR2, SignalHandlerSigusr2);
2303  UtilSignalUnblock(SIGUSR2);
2304  }
2305 #endif
2306  if (suri->delayed_detect) {
2307  /* force 'reload', this will load the rules and swap engines */
2308  DetectEngineReload(suri);
2309  SCLogNotice("Signature(s) loaded, Detect thread(s) activated.");
2310 #ifndef OS_WIN32
2311  UtilSignalHandlerSetup(SIGUSR2, SignalHandlerSigusr2);
2312  UtilSignalUnblock(SIGUSR2);
2313 #endif
2314  }
2315 }
2316 
2318 {
2319  DetectEngineCtx *de_ctx = NULL;
2320  if (!suri->disabled_detect) {
2321  SCClassConfInit();
2323  SetupDelayedDetect(suri);
2324  int mt_enabled = 0;
2325  (void)ConfGetBool("multi-detect.enabled", &mt_enabled);
2326  int default_tenant = 0;
2327  if (mt_enabled)
2328  (void)ConfGetBool("multi-detect.default", &default_tenant);
2329  if (DetectEngineMultiTenantSetup() == -1) {
2330  FatalError(SC_ERR_FATAL, "initializing multi-detect "
2331  "detection engine contexts failed.");
2332  }
2333  if (suri->delayed_detect && suri->run_mode != RUNMODE_CONF_TEST) {
2335  } else if (mt_enabled && !default_tenant && suri->run_mode != RUNMODE_CONF_TEST) {
2337  } else {
2339  }
2340  if (de_ctx == NULL) {
2341  FatalError(SC_ERR_FATAL, "initializing detection engine "
2342  "context failed.");
2343  }
2344 
2346  if (LoadSignatures(de_ctx, suri) != TM_ECODE_OK)
2347  exit(EXIT_FAILURE);
2348  }
2349 
2350  gettimeofday(&de_ctx->last_reload, NULL);
2353  }
2354 }
2355 
2356 static int PostDeviceFinalizedSetup(SCInstance *suri)
2357 {
2358  SCEnter();
2359 
2360 #ifdef HAVE_AF_PACKET
2361  if (suri->run_mode == RUNMODE_AFP_DEV) {
2362  if (AFPRunModeIsIPS()) {
2363  SCLogInfo("AF_PACKET: Setting IPS mode");
2364  EngineModeSetIPS();
2365  }
2366  }
2367 #endif
2368 #ifdef HAVE_NETMAP
2369  if (suri->run_mode == RUNMODE_NETMAP) {
2370  if (NetmapRunModeIsIPS()) {
2371  SCLogInfo("Netmap: Setting IPS mode");
2372  EngineModeSetIPS();
2373  }
2374  }
2375 #endif
2376 
2378 }
2379 
2380 static void PostConfLoadedSetupHostMode(void)
2381 {
2382  const char *hostmode = NULL;
2383 
2384  if (ConfGetValue("host-mode", &hostmode) == 1) {
2385  if (!strcmp(hostmode, "router")) {
2387  } else if (!strcmp(hostmode, "sniffer-only")) {
2389  } else {
2390  if (strcmp(hostmode, "auto") != 0) {
2391  WarnInvalidConfEntry("host-mode", "%s", "auto");
2392  }
2393  if (EngineModeIsIPS()) {
2395  } else {
2397  }
2398  }
2399  } else {
2400  if (EngineModeIsIPS()) {
2402  SCLogInfo("No 'host-mode': suricata is in IPS mode, using "
2403  "default setting 'router'");
2404  } else {
2406  SCLogInfo("No 'host-mode': suricata is in IDS mode, using "
2407  "default setting 'sniffer-only'");
2408  }
2409  }
2410 
2411 }
2412 
2413 static void SetupUserMode(SCInstance *suri)
2414 {
2415  /* apply 'user mode' config updates here */
2416  if (suri->system == false) {
2417  if (suri->set_logdir == false) {
2418  /* override log dir to current work dir" */
2419  if (ConfigSetLogDirectory((char *)".") != TM_ECODE_OK) {
2420  FatalError(SC_ERR_LOGDIR_CONFIG, "could not set USER mode logdir");
2421  }
2422  }
2423  if (suri->set_datadir == false) {
2424  /* override data dir to current work dir" */
2425  if (ConfigSetDataDirectory((char *)".") != TM_ECODE_OK) {
2426  FatalError(SC_ERR_LOGDIR_CONFIG, "could not set USER mode datadir");
2427  }
2428  }
2429  }
2430 }
2431 
2432 /**
2433  * This function is meant to contain code that needs
2434  * to be run once the configuration has been loaded.
2435  */
2437 {
2438  /* do this as early as possible #1577 #1955 */
2439 #ifdef HAVE_LUAJIT
2440  if (LuajitSetupStatesPool() != 0) {
2442  }
2443 #endif
2444 
2445  /* load the pattern matchers */
2446  MpmTableSetup();
2447  SpmTableSetup();
2448 
2449  int disable_offloading;
2450  if (ConfGetBool("capture.disable-offloading", &disable_offloading) == 0)
2451  disable_offloading = 1;
2452  if (disable_offloading) {
2454  } else {
2456  }
2457 
2458  if (suri->checksum_validation == -1) {
2459  const char *cv = NULL;
2460  if (ConfGetValue("capture.checksum-validation", &cv) == 1) {
2461  if (strcmp(cv, "none") == 0) {
2462  suri->checksum_validation = 0;
2463  } else if (strcmp(cv, "all") == 0) {
2464  suri->checksum_validation = 1;
2465  }
2466  }
2467  }
2468  switch (suri->checksum_validation) {
2469  case 0:
2470  ConfSet("stream.checksum-validation", "0");
2471  break;
2472  case 1:
2473  ConfSet("stream.checksum-validation", "1");
2474  break;
2475  }
2476 
2477  if (suri->runmode_custom_mode) {
2478  ConfSet("runmode", suri->runmode_custom_mode);
2479  }
2480 
2481  StorageInit();
2482 #ifdef HAVE_PACKET_EBPF
2483  if (suri->run_mode == RUNMODE_AFP_DEV) {
2484  EBPFRegisterExtension();
2486  }
2487 #endif
2489 
2491 
2492  AppLayerSetup();
2493 
2494  /* Suricata will use this umask if provided. By default it will use the
2495  umask passed on from the shell. */
2496  const char *custom_umask;
2497  if (ConfGet("umask", &custom_umask) == 1) {
2498  uint16_t mask;
2499  if (StringParseUint16(&mask, 8, strlen(custom_umask),
2500  custom_umask) > 0) {
2501  umask((mode_t)mask);
2502  }
2503  }
2504 
2505 
2506  if (ConfigGetCaptureValue(suri) != TM_ECODE_OK) {
2508  }
2509 
2510 #ifdef NFQ
2511  if (suri->run_mode == RUNMODE_NFQ)
2512  NFQInitConfig(false);
2513 #endif
2514 
2515  /* Load the Host-OS lookup. */
2517 
2518  if (suri->run_mode == RUNMODE_ENGINE_ANALYSIS) {
2519  SCLogInfo("== Carrying out Engine Analysis ==");
2520  const char *temp = NULL;
2521  if (ConfGet("engine-analysis", &temp) == 0) {
2522  SCLogInfo("no engine-analysis parameter(s) defined in conf file. "
2523  "Please define/enable them in the conf to use this "
2524  "feature.");
2526  }
2527  }
2528 
2529  /* hardcoded initialization code */
2530  SigTableSetup(); /* load the rule keywords */
2532  TmqhSetup();
2533 
2534  CIDRInit();
2535 
2536  TagInitCtx();
2538  ThresholdInit();
2539  HostBitInitCtx();
2540  IPPairBitInitCtx();
2541 
2542  if (DetectAddressTestConfVars() < 0) {
2544  "basic address vars test failed. Please check %s for errors",
2545  suri->conf_filename);
2547  }
2548  if (DetectPortTestConfVars() < 0) {
2550  "basic port vars test failed. Please check %s for errors",
2551  suri->conf_filename);
2553  }
2554 
2555  FeatureTrackingRegister(); /* must occur prior to output mod registration */
2557 #ifdef HAVE_PLUGINS
2559 #endif
2561 
2562  StorageFinalize();
2563 
2564  TmModuleRunInit();
2565 
2566  if (MayDaemonize(suri) != TM_ECODE_OK)
2568 
2569  if (InitSignalHandler(suri) != TM_ECODE_OK)
2571 
2572  /* Check for the existance of the default logging directory which we pick
2573  * from suricata.yaml. If not found, shut the engine down */
2574  suri->log_dir = ConfigGetLogDirectory();
2575 
2577  SCLogError(SC_ERR_LOGDIR_CONFIG, "The logging directory \"%s\" "
2578  "supplied by %s (default-log-dir) doesn't exist. "
2579  "Shutting down the engine", suri->log_dir, suri->conf_filename);
2581  }
2582  if (!IsLogDirectoryWritable(suri->log_dir)) {
2583  SCLogError(SC_ERR_LOGDIR_CONFIG, "The logging directory \"%s\" "
2584  "supplied by %s (default-log-dir) is not writable. "
2585  "Shutting down the engine", suri->log_dir, suri->conf_filename);
2587  }
2588 
2589  if (suri->disabled_detect) {
2590  SCLogConfig("detection engine disabled");
2591  /* disable raw reassembly */
2592  (void)ConfSetFinal("stream.reassembly.raw", "false");
2593  }
2594 
2596 
2598 
2600 
2602 
2603  /* set engine mode if L2 IPS */
2604  if (PostDeviceFinalizedSetup(suri) != TM_ECODE_OK) {
2605  exit(EXIT_FAILURE);
2606  }
2607 
2608  /* hostmode depends on engine mode being set */
2609  PostConfLoadedSetupHostMode();
2610 
2611  PreRunInit(suri->run_mode);
2612 
2614 }
2615 
2616 static void SuricataMainLoop(SCInstance *suri)
2617 {
2618  while(1) {
2619  if (sigterm_count || sigint_count) {
2621  }
2622 
2624  SCLogNotice("Signal Received. Stopping engine.");
2625  break;
2626  }
2627 
2629 
2630  if (sighup_count > 0) {
2632  sighup_count--;
2633  }
2634 
2635  if (sigusr2_count > 0) {
2636  if (!(DetectEngineReloadIsStart())) {
2638  DetectEngineReload(suri);
2640  sigusr2_count--;
2641  }
2642 
2643  } else if (DetectEngineReloadIsStart()) {
2644  DetectEngineReload(suri);
2646  }
2647 
2648  usleep(10* 1000);
2649  }
2650 }
2651 
2652 /**
2653  * \brief Global initialization common to all runmodes.
2654  *
2655  * This can be used by fuzz targets.
2656  */
2657 
2658 int InitGlobal(void) {
2665 
2673 
2675 
2676  rs_init(&suricata_context);
2677 
2678  SC_ATOMIC_INIT(engine_stage);
2679 
2680  /* initialize the logging subsys */
2681  SCLogInitLogModule(NULL);
2682 
2683  (void)SCSetThreadName("Suricata-Main");
2684 
2685  /* Ignore SIGUSR2 as early as possble. We redeclare interest
2686  * once we're done launching threads. The goal is to either die
2687  * completely or handle any and all SIGUSR2s correctly.
2688  */
2689 #ifndef OS_WIN32
2690  UtilSignalHandlerSetup(SIGUSR2, SIG_IGN);
2691  if (UtilSignalBlock(SIGUSR2)) {
2692  SCLogError(SC_ERR_INITIALIZATION, "SIGUSR2 initialization error");
2693  return EXIT_FAILURE;
2694  }
2695 #endif
2696 
2697  ParseSizeInit();
2699 
2700  /* Initialize the configuration module. */
2701  ConfInit();
2702 
2703  return 0;
2704 }
2705 
2706 int SuricataMain(int argc, char **argv)
2707 {
2708  SCInstanceInit(&suricata, argv[0]);
2709 
2710  if (InitGlobal() != 0) {
2711  exit(EXIT_FAILURE);
2712  }
2713 
2714 #ifdef OS_WIN32
2715  /* service initialization */
2716  if (WindowsInitService(argc, argv) != 0) {
2717  exit(EXIT_FAILURE);
2718  }
2719 #endif /* OS_WIN32 */
2720 
2721  if (ParseCommandLine(argc, argv, &suricata) != TM_ECODE_OK) {
2722  exit(EXIT_FAILURE);
2723  }
2724 
2725  if (FinalizeRunMode(&suricata, argv) != TM_ECODE_OK) {
2726  exit(EXIT_FAILURE);
2727  }
2728 
2729  switch (StartInternalRunMode(&suricata, argc, argv)) {
2730  case TM_ECODE_DONE:
2731  exit(EXIT_SUCCESS);
2732  case TM_ECODE_FAILED:
2733  exit(EXIT_FAILURE);
2734  }
2735 
2736  /* Initializations for global vars, queues, etc (memsets, mutex init..) */
2738 
2739  /* Load yaml configuration file if provided. */
2740  if (LoadYamlConfig(&suricata) != TM_ECODE_OK) {
2741  exit(EXIT_FAILURE);
2742  }
2743 
2745  ConfDump();
2746  exit(EXIT_SUCCESS);
2747  }
2748 
2749  int vlan_tracking = 1;
2750  if (ConfGetBool("vlan.use-for-tracking", &vlan_tracking) == 1 && !vlan_tracking) {
2751  /* Ignore vlan_ids when comparing flows. */
2752  g_vlan_mask = 0x0000;
2753  }
2754  SCLogDebug("vlan tracking is %s", vlan_tracking == 1 ? "enabled" : "disabled");
2755 
2756  SetupUserMode(&suricata);
2757 
2758  /* Since our config is now loaded we can finish configurating the
2759  * logging module. */
2761 
2762  LogVersion(&suricata);
2764 
2765  if (ParseInterfacesList(suricata.aux_run_mode, suricata.pcap_dev) != TM_ECODE_OK) {
2766  exit(EXIT_FAILURE);
2767  }
2768 
2770  exit(EXIT_FAILURE);
2771  }
2772 
2774 
2775  /* Re-enable coredumps after privileges are dropped. */
2776  CoredumpEnable();
2777 
2779 
2782  goto out;
2783  } else if (suricata.run_mode == RUNMODE_CONF_TEST){
2784  SCLogNotice("Configuration provided was successfully loaded. Exiting.");
2785  goto out;
2786  } else if (suricata.run_mode == RUNMODE_DUMP_FEATURES) {
2787  FeatureDump();
2788  goto out;
2789  }
2790 
2791  SCSetStartTime(&suricata);
2796  }
2797 
2798  /* Wait till all the threads have been initialized */
2800  FatalError(SC_ERR_FATAL, "Engine initialization failed, "
2801  "aborting...");
2802  }
2803 
2804  SC_ATOMIC_SET(engine_stage, SURICATA_RUNTIME);
2806 
2807  /* Un-pause all the paused threads */
2809 
2810  PostRunStartedDetectSetup(&suricata);
2811 
2812  SCPledge();
2813  SuricataMainLoop(&suricata);
2814 
2815  /* Update the engine stage/status flag */
2816  SC_ATOMIC_SET(engine_stage, SURICATA_DEINIT);
2817 
2820  /* kill remaining threads */
2822 
2823 out:
2824  GlobalsDestroy(&suricata);
2825 
2826  exit(EXIT_SUCCESS);
2827 }
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1085
util-byte.h
host.h
tm-threads.h
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:436
TmModuleUnixManagerRegister
void TmModuleUnixManagerRegister(void)
Definition: unix-manager.c:1259
profiling_rules_enabled
int profiling_rules_enabled
Definition: util-profiling-rules.c:81
SuricataContext_::DetectEngineStateFree
void(* DetectEngineStateFree)(DetectEngineState *)
Definition: rust-context.h:33
source-nflog.h
TagInitCtx
void TagInitCtx(void)
Definition: detect-engine-tag.c:51
TmModuleReceiveIPFWRegister
void TmModuleReceiveIPFWRegister(void)
Registration Function for RecieveIPFW.
Definition: source-ipfw.c:150
flow-bypass.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
SCReferenceConfDeinit
void SCReferenceConfDeinit(void)
Definition: util-reference-config.c:80
ippair.h
AppLayerHtpNeedFileInspection
void AppLayerHtpNeedFileInspection(void)
Sets a flag that informs the HTP app layer that some module in the engine needs the http request file...
Definition: app-layer-htp.c:514
SCInstance_::run_mode
enum RunModes run_mode
Definition: suricata.h:124
detect-engine.h
StringParseUint16
int StringParseUint16(uint16_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:336
source-pcap.h
SCInstance_::groupid
uint32_t groupid
Definition: suricata.h:141
RUNMODE_UNIX_SOCKET
@ RUNMODE_UNIX_SOCKET
Definition: runmodes.h:41
g_system
bool g_system
Definition: suricata.c:219
SCReferenceConfInit
void SCReferenceConfInit(void)
Definition: util-reference-config.c:56
host-storage.h
SCInstance_::daemon
int daemon
Definition: suricata.h:150
max_pending_packets
intmax_t max_pending_packets
Definition: suricata.c:208
SuricataContext_::SCLogMessage
SCError(* SCLogMessage)(const SCLogLevel, const char *, const unsigned int, const char *, const SCError, const char *message)
Definition: rust-context.h:31
app-layer-ssh.h
IPPairInitConfig
void IPPairInitConfig(bool quiet)
initialize the configuration
Definition: ippair.c:168
SCLogInitLogModule
void SCLogInitLogModule(SCLogInitData *sc_lid)
Initializes the logging module.
Definition: util-debug.c:1304
SLL_HEADER_LEN
#define SLL_HEADER_LEN
Definition: decode-sll.h:27
SCInstance_::checksum_validation
int checksum_validation
Definition: suricata.h:153
SC_ERR_DAG_REQUIRED
@ SC_ERR_DAG_REQUIRED
Definition: util-error.h:201
app-layer-register.h
SC_ERR_WINDIVERT_NOSUPPORT
@ SC_ERR_WINDIVERT_NOSUPPORT
Definition: util-error.h:346
DetectEngineDeReference
void DetectEngineDeReference(DetectEngineCtx **de_ctx)
Definition: detect-engine.c:3907
RUNMODE_UNITTEST
@ RUNMODE_UNITTEST
Definition: runmodes.h:39
StorageInit
void StorageInit(void)
Definition: util-storage.c:67
SCInstance_::start_time
struct timeval start_time
Definition: suricata.h:155
SCLogLoadConfig
void SCLogLoadConfig(int daemon, int verbose)
Definition: util-debug.c:1337
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:315
FileAppendGAPById
int FileAppendGAPById(FileContainer *ffc, uint32_t track_id, const uint8_t *data, uint32_t data_len)
Store/handle a chunk of file data in the File structure The file with 'track_id' in the FileContainer...
Definition: util-file.c:775
SCThresholdConfGlobalFree
void SCThresholdConfGlobalFree(void)
Definition: util-threshold-config.c:152
source-pcap-file.h
AFPPeersListClean
void AFPPeersListClean()
Clean the global peers list.
Definition: source-af-packet.c:524
ConfNode_::val
char * val
Definition: conf.h:34
CLS
#define CLS
Definition: suricata-common.h:45
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:516
stream-tcp.h
DetectEngineCtx_::type
enum DetectEngineType type
Definition: detect.h:892
DetectEnginePruneFreeList
void DetectEnginePruneFreeList(void)
Definition: detect-engine.c:3998
RUNMODE_UNKNOWN
@ RUNMODE_UNKNOWN
Definition: runmodes.h:28
SuricataContext_::AppLayerDecoderEventsSetEventRaw
void(* AppLayerDecoderEventsSetEventRaw)(AppLayerDecoderEvents **, uint8_t)
Definition: rust-context.h:34
SCInstance_::group_name
const char * group_name
Definition: suricata.h:137
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
runmode-unittests.h
SigTableApplyStrictCommandlineOption
void SigTableApplyStrictCommandlineOption(const char *str)
Definition: detect-parse.c:306
TmqhSetup
void TmqhSetup(void)
Definition: tm-queuehandlers.c:39
SC_ERR_GID_FAILED
@ SC_ERR_GID_FAILED
Definition: util-error.h:188
RUNMODE_PRINT_BUILDINFO
@ RUNMODE_PRINT_BUILDINFO
Definition: runmodes.h:49
DetectEngineCtxInitStubForDD
DetectEngineCtx * DetectEngineCtxInitStubForDD(void)
Definition: detect-engine.c:2017
LiveDevRegisterExtension
void LiveDevRegisterExtension(void)
Definition: util-device.c:492
SC_ERR_NFQ_NOSUPPORT
@ SC_ERR_NFQ_NOSUPPORT
Definition: util-error.h:97
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
AppLayerHtpPrintStats
void AppLayerHtpPrintStats(void)
Definition: app-layer-htp.c:2922
StatsSetupPostConfigPreOutput
void StatsSetupPostConfigPreOutput(void)
Definition: counters.c:876
SCInstance_::runmode_custom_mode
char * runmode_custom_mode
Definition: suricata.h:134
util-coredump-config.h
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
SigTableSetup
void SigTableSetup(void)
Definition: detect-engine-register.c:437
TmModuleReceiveNFQRegister
void TmModuleReceiveNFQRegister(void)
Definition: source-nfq.c:167
LiveBuildDeviceList
int LiveBuildDeviceList(const char *runmode)
Definition: util-device.c:307
util-lua.h
RunModeShutDown
void RunModeShutDown(void)
Definition: runmodes.c:535
AppLayerParserTriggerRawStreamReassembly
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
Definition: app-layer-parser.c:1446
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:82
DEFAULT_MTU
#define DEFAULT_MTU
Definition: decode.h:627
ippair-bit.h
RunModeDispatch
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
Definition: runmodes.c:282
SC_ERR_NOT_SUPPORTED
@ SC_ERR_NOT_SUPPORTED
Definition: util-error.h:257
SuricataContext_::AppLayerDecoderEventsFreeEvents
void(* AppLayerDecoderEventsFreeEvents)(AppLayerDecoderEvents **)
Definition: rust-context.h:36
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:175
threads.h
RUNMODE_LIST_RUNMODES
@ RUNMODE_LIST_RUNMODES
Definition: runmodes.h:47
sigint_count
volatile sig_atomic_t sigint_count
Definition: suricata.c:178
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(unsigned int, engine_stage)
TmModuleRunDeInit
void TmModuleRunDeInit(void)
Definition: tm-modules.c:146
RegisterFlowBypassInfo
void RegisterFlowBypassInfo(void)
Definition: flow-util.c:238
SCSetThreadName
#define SCSetThreadName(n)
Definition: threads.h:303
SC_ERR_NO_PCAP_SET_BUFFER_SIZE
@ SC_ERR_NO_PCAP_SET_BUFFER_SIZE
Definition: util-error.h:59
SCLogDeInitLogModule
void SCLogDeInitLogModule(void)
De-Initializes the logging module.
Definition: util-debug.c:1518
util-pidfile.h
TmModuleDecodeErfFileRegister
void TmModuleDecodeErfFileRegister(void)
Register the ERF file decoder module.
Definition: source-erf-file.c:97
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:758
DetectEngineReloadSetIdle
void DetectEngineReloadSetIdle(void)
Definition: detect-engine.c:1541
SCInstance_::userid
uint32_t userid
Definition: suricata.h:140
RUNMODE_ERF_FILE
@ RUNMODE_ERF_FILE
Definition: runmodes.h:35
source-windivert-prototypes.h
SC_ERR_IPFW_NOSUPPORT
@ SC_ERR_IPFW_NOSUPPORT
Definition: util-error.h:109
DetectEngineGetCurrent
DetectEngineCtx * DetectEngineGetCurrent(void)
Definition: detect-engine.c:3206
TmModuleFlowRecyclerRegister
void TmModuleFlowRecyclerRegister(void)
Definition: flow-manager.c:1384
packet-queue.h
SURICATA_RUNTIME
@ SURICATA_RUNTIME
Definition: suricata.h:97
Daemonize
void Daemonize(void)
Daemonize the process.
Definition: util-daemon.c:101
UtilSignalHandlerSetup
void UtilSignalHandlerSetup(int sig, void(*handler)(int))
Definition: util-signal.c:60
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:350
TmModuleDecodeAFPRegister
void TmModuleDecodeAFPRegister(void)
Registration Function for DecodeAFP.
Definition: source-af-packet.c:542
RUNMODE_NFLOG
@ RUNMODE_NFLOG
Definition: runmodes.h:33
TmModuleDecodeWinDivertRegister
void TmModuleDecodeWinDivertRegister(void)
Definition: source-windivert.c:74
SURICATA_STOP
#define SURICATA_STOP
Definition: suricata.h:90
FlowForceReassembly
void FlowForceReassembly(void)
Force reassembly for all the flows that have unprocessed segments.
Definition: flow-timeout.c:423
DetectEngineAddToMaster
int DetectEngineAddToMaster(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:3931
TmModuleStatsLoggerRegister
void TmModuleStatsLoggerRegister(void)
Definition: output-stats.c:197
RegisterAllModules
void RegisterAllModules(void)
Definition: suricata.c:833
ENGINE_MODE_IPS
@ ENGINE_MODE_IPS
Definition: suricata.h:104
SCGetUserID
int SCGetUserID(const char *user_name, const char *group_name, uint32_t *uid, uint32_t *gid)
Function to get the user and group ID from the specified user name.
Definition: util-privs.c:149
RUNMODE_PCAP_DEV
@ RUNMODE_PCAP_DEV
Definition: runmodes.h:29
flow-bit.h
SupportFastPatternForSigMatchTypes
void SupportFastPatternForSigMatchTypes(void)
Registers the keywords(SMs) that should be given fp support.
Definition: detect-fast-pattern.c:135
ConfDump
void ConfDump(void)
Dump configuration to stdout.
Definition: conf.c:779
rust.h
SCPledge
#define SCPledge(...)
Definition: util-privs.h:100
CheckValidDaemonModes
int CheckValidDaemonModes(int daemon, int mode)
Check for a valid combination daemon/mode.
Definition: util-daemon.c:171
AppLayerDecoderEventsFreeEvents
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:148
SCClassConfDeinit
void SCClassConfDeinit(void)
Definition: util-classification-config.c:87
LiveGetDeviceNameName
const char * LiveGetDeviceNameName(int number)
Get a pointer to the pre device name at idx.
Definition: util-device.c:217
ConfSetFinal
int ConfSetFinal(const char *name, const char *val)
Set a final configuration value.
Definition: conf.c:298
unittests_fatal
int unittests_fatal
Definition: util-unittest.c:52
TmThreadDisableReceiveThreads
void TmThreadDisableReceiveThreads(void)
Disable all threads having the specified TMs.
Definition: tm-threads.c:1373
StatsInit
void StatsInit(void)
Initializes the perf counter api. Things are hard coded currently. More work to be done when we imple...
Definition: counters.c:864
util-privs.h
PreRunInit
void PreRunInit(const int runmode)
Definition: suricata.c:1998
RUNMODE_LIST_KEYWORDS
@ RUNMODE_LIST_KEYWORDS
Definition: runmodes.h:45
SURICATA_DONE
#define SURICATA_DONE
Definition: suricata.h:92
SuricataContext_::AppLayerRegisterParser
int(* AppLayerRegisterParser)(const struct AppLayerParser *p, AppProto alproto)
Definition: rust-context.h:52
MacSetRegisterFlowStorage
void MacSetRegisterFlowStorage(void)
Definition: util-macset.c:61
SCInstance_::conf_filename
const char * conf_filename
Definition: suricata.h:159
RUNMODE_NAPATECH
@ RUNMODE_NAPATECH
Definition: runmodes.h:40
GlobalsInitPreConfig
void GlobalsInitPreConfig(void)
Definition: suricata.c:318
TmModuleReceiveNetmapRegister
void TmModuleReceiveNetmapRegister(void)
Definition: source-netmap.c:90
PacketPoolPostRunmodes
void PacketPoolPostRunmodes(void)
Set the max_pending_return_packets value.
Definition: tmqh-packetpool.c:512
NFQInitConfig
void NFQInitConfig(bool quiet)
To initialize the NFQ global configuration data.
Definition: source-nfq.c:204
TmModuleReceiveWinDivertRegister
void TmModuleReceiveWinDivertRegister(void)
Definition: source-windivert.c:61
app-layer-ftp.h
MAX
#define MAX(x, y)
Definition: suricata-common.h:376
TmModuleReceivePfringRegister
void TmModuleReceivePfringRegister(void)
Registration Function for RecievePfring.
Definition: source-pfring.c:161
HOST_VERBOSE
#define HOST_VERBOSE
Definition: host.h:92
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
SCProfilingDestroy
void SCProfilingDestroy(void)
Free resources used by profiling.
Definition: util-profiling.c:268
IsRunModeOffline
bool IsRunModeOffline(enum RunModes run_mode_to_check)
Definition: runmodes.c:517
SuricataContext_::FileSetTx
void(* FileSetTx)(FileContainer *, uint64_t)
Definition: rust-context.h:50
RunModeInitializeOutputs
void RunModeInitializeOutputs(void)
Definition: runmodes.c:735
DetectPortTestConfVars
int DetectPortTestConfVars(void)
Definition: detect-engine-port.c:1165
SCThresholdConfGlobalInit
void SCThresholdConfGlobalInit(void)
Definition: util-threshold-config.c:104
DecodeUnregisterCounters
void DecodeUnregisterCounters(void)
Definition: decode.c:481
SURI_HOST_IS_SNIFFER_ONLY
@ SURI_HOST_IS_SNIFFER_ONLY
Definition: suricata.h:114
SCInstance_::capture_plugin_name
const char * capture_plugin_name
Definition: suricata.h:162
RUNMODE_DAG
@ RUNMODE_DAG
Definition: runmodes.h:36
HostBitInitCtx
void HostBitInitCtx(void)
Definition: host-bit.c:49
EngineMode
EngineMode
Definition: suricata.h:102
SCInstance_::set_datadir
bool set_datadir
Definition: suricata.h:146
tmqh-packetpool.h
FileContainerSetTx
void FileContainerSetTx(FileContainer *ffc, uint64_t tx_id)
Definition: util-file.c:575
g_ut_covered
int g_ut_covered
Definition: suricata.c:831
util-unittest.h
SCInstance_::capture_plugin_args
const char * capture_plugin_args
Definition: suricata.h:163
TmModuleLoggerRegister
void TmModuleLoggerRegister(void)
Definition: output.c:1017
TmThreadDisablePacketThreads
void TmThreadDisablePacketThreads(void)
Disable all packet threads.
Definition: tm-threads.c:1502
host_mode
uint8_t host_mode
Definition: suricata.c:205
RUNMODE_NETMAP
@ RUNMODE_NETMAP
Definition: runmodes.h:38
util-unittest-helper.h
RUNMODE_DUMP_FEATURES
@ RUNMODE_DUMP_FEATURES
Definition: runmodes.h:60
FeatureDump
void FeatureDump(void)
Definition: feature.c:142
PacketPoolInit
void PacketPoolInit(void)
Definition: tmqh-packetpool.c:302
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
AppLayerDeSetup
int AppLayerDeSetup(void)
De initializes the app layer.
Definition: app-layer.c:847
TmThreadContinueThreads
void TmThreadContinueThreads()
Unpauses all threads present in tv_root.
Definition: tm-threads.c:1831
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
PcapTranslateIPToDevice
void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
Definition: source-pcap.c:649
FlowDisableFlowRecyclerThread
void FlowDisableFlowRecyclerThread(void)
Used to disable flow recycler thread(s).
Definition: flow-manager.c:1310
ParseSizeInit
void ParseSizeInit(void)
Definition: util-misc.c:35
GetIfaceMaxPacketSize
int GetIfaceMaxPacketSize(const char *pcap_dev)
output max packet size for a link
Definition: util-ioctl.c:132
TVT_PPT
@ TVT_PPT
Definition: tm-threads-common.h:87
TmModuleDecodePcapFileRegister
void TmModuleDecodePcapFileRegister(void)
Definition: source-pcap-file.c:125
TmModuleBypassedFlowManagerRegister
void TmModuleBypassedFlowManagerRegister(void)
Definition: flow-bypass.c:214
IPPairShutdown
void IPPairShutdown(void)
shutdown the flow engine
Definition: ippair.c:300
source-erf-dag.h
util-signal.h
DetectParseFreeRegexes
void DetectParseFreeRegexes(void)
Definition: detect-parse.c:2459
SC_ERR_UID_FAILED
@ SC_ERR_UID_FAILED
Definition: util-error.h:187
SC_ERR_SIZE_PARSE
@ SC_ERR_SIZE_PARSE
Definition: util-error.h:230
TmModuleDecodeNFLOGRegister
void TmModuleDecodeNFLOGRegister(void)
Definition: source-nflog.c:54
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:330
NFQParseAndRegisterQueues
int NFQParseAndRegisterQueues(const char *queues)
Parses and adds Netfilter queue(s).
Definition: source-nfq.c:860
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:523
AppLayerSetup
int AppLayerSetup(void)
Setup the app layer.
Definition: app-layer.c:832
FeatureTrackingRegister
void FeatureTrackingRegister(void)
Definition: feature.c:150
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
util-cidr.h
FilePrune
void FilePrune(FileContainer *ffc)
Definition: util-file.c:391
app-layer-htp.h
UnixManagerThreadSpawnNonRunmode
void UnixManagerThreadSpawnNonRunmode(void)
Definition: unix-manager.c:1252
IsRunModeSystem
bool IsRunModeSystem(enum RunModes run_mode_to_check)
Definition: runmodes.c:504
datasets.h
TmModuleDecodeNetmapRegister
void TmModuleDecodeNetmapRegister(void)
Registration Function for DecodeNetmap.
Definition: source-netmap.c:100
PreRunPostPrivsDropInit
void PreRunPostPrivsDropInit(const int runmode)
Definition: suricata.c:2024
feature.h
decode.h
util-device.h
util-debug.h
DetectEngineMoveToFreeList
int DetectEngineMoveToFreeList(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:3947
sigterm_count
volatile sig_atomic_t sigterm_count
Definition: suricata.c:180
run_mode
int run_mode
Definition: suricata.c:197
source-nfq.h
SC_ERR_CMD_LINE
@ SC_ERR_CMD_LINE
Definition: util-error.h:227
util-error.h
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
TmThreadWaitOnThreadInit
TmEcode TmThreadWaitOnThreadInit(void)
Used to check if all threads have finished their initialization. On finding an un-initialized thread,...
Definition: tm-threads.c:1901
TmModuleVerdictNFQRegister
void TmModuleVerdictNFQRegister(void)
Definition: source-nfq.c:182
ConfYamlLoadFile
int ConfYamlLoadFile(const char *filename)
Load configuration from a YAML file.
Definition: conf-yaml-loader.c:428
RUNMODE_CONF_TEST
@ RUNMODE_CONF_TEST
Definition: runmodes.h:52
AppLayerRegisterGlobalCounters
void AppLayerRegisterGlobalCounters(void)
HACK to work around our broken unix manager (re)init loop.
Definition: app-layer.c:909
RunModeListRunmodes
void RunModeListRunmodes(void)
Lists all registered runmodes.
Definition: runmodes.c:239
RUNMODE_PRINT_USAGE
@ RUNMODE_PRINT_USAGE
Definition: runmodes.h:50
strlcat
size_t strlcat(char *, const char *src, size_t siz)
Definition: util-strlcatu.c:45
RUNMODE_LIST_APP_LAYERS
@ RUNMODE_LIST_APP_LAYERS
Definition: runmodes.h:46
util-cpu.h
suricata
SCInstance suricata
Definition: suricata.c:237
LiveSetOffloadDisable
void LiveSetOffloadDisable(void)
Definition: util-device.c:69
app-layer-dnp3.h
StatsSetupPostConfigPostOutput
void StatsSetupPostConfigPostOutput(void)
Definition: counters.c:881
EngineModeSetIDS
void EngineModeSetIDS(void)
Definition: suricata.c:259
SpmTableSetup
void SpmTableSetup(void)
Definition: util-spm.c:123
TmModuleReceiveAFPRegister
void TmModuleReceiveAFPRegister(void)
Registration Function for RecieveAFP.
Definition: source-af-packet.c:323
LiveBuildDeviceListCustom
int LiveBuildDeviceListCustom(const char *runmode, const char *itemname)
Definition: util-device.c:312
UnixSocketKillSocketThread
void UnixSocketKillSocketThread(void)
Definition: unix-manager.c:1247
TmModuleVerdictIPFWRegister
void TmModuleVerdictIPFWRegister(void)
Registration Function for VerdictIPFW.
Definition: source-ipfw.c:171
flow-worker.h
SuricataContext_::FileAppendDataById
int(* FileAppendDataById)(FileContainer *, uint32_t track_id, const uint8_t *data, uint32_t data_len)
Definition: rust-context.h:44
SigLoadSignatures
int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, int sig_file_exclusive)
Load signatures.
Definition: detect-engine-loader.c:276
util-reference-config.h
source-napatech.h
DetectEngineCtx_::last_reload
struct timeval last_reload
Definition: detect.h:937
SCInstance_::delayed_detect
int delayed_detect
Definition: suricata.h:148
TmModuleVerdictWinDivertRegister
void TmModuleVerdictWinDivertRegister(void)
Definition: source-windivert.c:68
SCInstance_::progname
const char * progname
Definition: suricata.h:158
HostCleanup
void HostCleanup(void)
Cleanup the host engine.
Definition: host.c:343
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
FlowDisableFlowManagerThread
void FlowDisableFlowManagerThread(void)
Used to disable flow manager thread(s).
Definition: flow-manager.c:140
detect-engine-mpm.h
util-ebpf.h
SCInstance_::pcap_dev
char pcap_dev[128]
Definition: suricata.h:127
detect.h
SuricataMain
int SuricataMain(int argc, char **argv)
Definition: suricata.c:2706
SURICATA_DEINIT
@ SURICATA_DEINIT
Definition: suricata.h:98
UtilSignalUnblock
int UtilSignalUnblock(int signum)
Definition: util-signal.c:46
DetectEngineEnabled
int DetectEngineEnabled(void)
Check if detection is enabled.
Definition: detect-engine.c:3173
pkt-var.h
TmThreadClearThreadsFamily
void TmThreadClearThreadsFamily(int family)
Definition: tm-threads.c:1683
SC_ERR_PIDFILE_DAEMON
@ SC_ERR_PIDFILE_DAEMON
Definition: util-error.h:186
TmModuleRunInit
void TmModuleRunInit(void)
Definition: tm-modules.c:128
detect-engine-port.h
EngineModeSetIPS
void EngineModeSetIPS(void)
Definition: suricata.c:254
util-atomic.h
SCInstance_::user_name
const char * user_name
Definition: suricata.h:136
HTPAtExitPrintStats
void HTPAtExitPrintStats(void)
Print the stats of the HTTP requests.
Definition: app-layer-htp.c:2011
util-time.h
UtilSignalBlock
int UtilSignalBlock(int signum)
Definition: util-signal.c:29
SCProfilingPrefilterGlobalInit
void SCProfilingPrefilterGlobalInit(void)
Definition: util-profiling-prefilter.c:63
PostConfLoadedSetup
int PostConfLoadedSetup(SCInstance *suri)
Definition: suricata.c:2436
GetProgramVersion
const char * GetProgramVersion(void)
get string with program version
Definition: suricata.c:1039
engine_analysis
int engine_analysis
app-layer-parser.h
SC_ERR_LIBCAP_NG_REQUIRED
@ SC_ERR_LIBCAP_NG_REQUIRED
Definition: util-error.h:190
TRUE
#define TRUE
Definition: suricata-common.h:33
SCGetGroupID
int SCGetGroupID(const char *group_name, uint32_t *gid)
Function to get the group ID from the specified group name.
Definition: util-privs.c:213
TmModuleReceivePcapFileRegister
void TmModuleReceivePcapFileRegister(void)
Definition: source-pcap-file.c:112
source-pfring.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:277
SuricataContext_::FileCloseFileById
int(* FileCloseFileById)(FileContainer *, uint32_t track_id, const uint8_t *data, uint32_t data_len, uint16_t flags)
Definition: rust-context.h:42
CoredumpLoadConfig
int32_t CoredumpLoadConfig(void)
Configures the core dump size.
Definition: util-coredump-config.c:85
detect-engine-tag.h
IPFWRegisterQueue
int IPFWRegisterQueue(char *queue)
Add an IPFW divert.
Definition: source-ipfw.c:701
xstr
#define xstr(s)
Definition: suricata-common.h:267
util-profiling.h
util-rule-vars.h
FALSE
#define FALSE
Definition: suricata-common.h:34
AFPRunModeIsIPS
int AFPRunModeIsIPS()
Definition: runmode-af-packet.c:719
ListAppLayerProtocols
int ListAppLayerProtocols(const char *conf_filename)
Definition: util-running-modes.c:42
SCInstance_::offline
int offline
Definition: suricata.h:151
DatasetsDestroy
void DatasetsDestroy(void)
Definition: datasets.c:737
UtilCpuPrintSummary
void UtilCpuPrintSummary(void)
Print a summary of CPUs detected (configured and online)
Definition: util-cpu.c:169
TmThreadKillThreads
void TmThreadKillThreads(void)
Definition: tm-threads.c:1611
SC_ERR_FOPEN
@ SC_ERR_FOPEN
Definition: util-error.h:74
OutputDeregisterAll
void OutputDeregisterAll(void)
Deregister all modules. Useful for a memory clean exit.
Definition: output.c:798
PostConfLoadedDetectSetup
void PostConfLoadedDetectSetup(SCInstance *suri)
Definition: suricata.c:2317
EngineModeIsIDS
int EngineModeIsIDS(void)
Definition: suricata.c:249
TmModuleNapatechDecodeRegister
void TmModuleNapatechDecodeRegister(void)
Register the Napatech decoder module.
Definition: source-napatech.c:160
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
SuricataContext_::AppLayerParserTriggerRawStreamReassembly
void(* AppLayerParserTriggerRawStreamReassembly)(Flow *, int direction)
Definition: rust-context.h:37
conf-yaml-loader.h
SC_WARN_FASTER_CAPTURE_AVAILABLE
@ SC_WARN_FASTER_CAPTURE_AVAILABLE
Definition: util-error.h:308
coverage_unittests
int coverage_unittests
Definition: suricata.c:829
RUNMODE_DUMP_CONFIG
@ RUNMODE_DUMP_CONFIG
Definition: runmodes.h:51
DatasetsSave
void DatasetsSave(void)
Definition: datasets.c:792
conf.h
source-ipfw.h
TMM_SIZE
@ TMM_SIZE
Definition: tm-threads-common.h:75
source-netmap.h
OutputNotifyFileRotation
void OutputNotifyFileRotation(void)
Notifies all registered file rotation notification flags.
Definition: output.c:869
util-magic.h
StorageFinalize
int StorageFinalize(void)
Definition: util-storage.c:139
SCInstance_::verbose
int verbose
Definition: suricata.h:152
util-radix-tree.h
TmEcode
TmEcode
Definition: tm-threads-common.h:79
source-windivert.h
FileOpenFileWithId
int FileOpenFileWithId(FileContainer *ffc, const StreamingBufferConfig *sbcfg, uint32_t track_id, const uint8_t *name, uint16_t name_len, const uint8_t *data, uint32_t data_len, uint16_t flags)
Open a new File.
Definition: util-file.c:920
TmModuleFlowWorkerRegister
void TmModuleFlowWorkerRegister(void)
Definition: flow-worker.c:632
SCInstance_::aux_run_mode
enum RunModes aux_run_mode
Definition: suricata.h:125
LiveGetDeviceNameCount
int LiveGetDeviceNameCount(void)
Get the number of pre registered devices.
Definition: util-device.c:197
util-plugin.h
flow-timeout.h
DEFAULT_PID_FILENAME
#define DEFAULT_PID_FILENAME
Definition: suricata.h:84
reputation.h
util-action.h
sighup_count
volatile sig_atomic_t sighup_count
Definition: suricata.c:179
ConfigSetDataDirectory
TmEcode ConfigSetDataDirectory(char *name)
Definition: util-conf.c:68
TmModuleDecodeErfDagRegister
void TmModuleDecodeErfDagRegister(void)
Register the ERF file decoder module.
Definition: source-erf-dag.c:150
SCInstance_::set_logdir
bool set_logdir
Definition: suricata.h:145
SCDropMainThreadCaps
#define SCDropMainThreadCaps(...)
Definition: util-privs.h:38
TmModuleDebugList
void TmModuleDebugList(void)
Definition: tm-modules.c:35
TmModuleDecodeNFQRegister
void TmModuleDecodeNFQRegister(void)
Definition: source-nfq.c:190
util-proto-name.h
STREAM_VERBOSE
#define STREAM_VERBOSE
Definition: stream-tcp.h:33
defrag.h
MpmTableSetup
void MpmTableSetup(void)
Definition: util-mpm.c:215
SCInstance_::log_dir
const char * log_dir
Definition: suricata.h:157
runmodes.h
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:265
source-nfq-prototypes.h
FileAppendDataById
int FileAppendDataById(FileContainer *ffc, uint32_t track_id, const uint8_t *data, uint32_t data_len)
Store/handle a chunk of file data in the File structure The file with 'track_id' in the FileContainer...
Definition: util-file.c:744
SCPluginsLoad
void SCPluginsLoad(const char *capture_plugin_name, const char *capture_plugin_args)
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
TmModuleReceiveNFLOGRegister
void TmModuleReceiveNFLOGRegister(void)
Definition: source-nflog.c:48
SC_ERR_INVALID_YAML_CONF_ENTRY
@ SC_ERR_INVALID_YAML_CONF_ENTRY
Definition: util-error.h:169
SCLogMessage
SCError SCLogMessage(const SCLogLevel log_level, const char *file, const unsigned int line, const char *function, const SCError error_code, const char *message)
Adds the global log_format to the outgoing buffer.
Definition: util-debug.c:541
DEFAULT_PACKET_SIZE
#define DEFAULT_PACKET_SIZE
Definition: decode.h:630
WarnInvalidConfEntry
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
Definition: util-misc.h:37
DetectEngineStateFree
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
Definition: detect-engine-state.c:173
util-host-os-info.h
TmModuleReceiveErfFileRegister
void TmModuleReceiveErfFileRegister(void)
Register the ERF file receiver (reader) module.
Definition: source-erf-file.c:79
TmModule_
Definition: tm-modules.h:43
default_packet_size
uint32_t default_packet_size
Definition: decode.c:71
tm-queuehandlers.h
SuricataContext_::FilePrune
void(* FilePrune)(FileContainer *ffc)
Definition: rust-context.h:49
DETECT_ENGINE_TYPE_NORMAL
@ DETECT_ENGINE_TYPE_NORMAL
Definition: detect.h:745
PROG_NAME
#define PROG_NAME
Definition: suricata.h:71
TmThreadKillThreadsFamily
void TmThreadKillThreadsFamily(int family)
Definition: tm-threads.c:1582
detect-fast-pattern.h
FeatureTrackingRelease
void FeatureTrackingRelease(void)
Definition: feature.c:134
SuricataContext_::FileAppendGAPById
int(* FileAppendGAPById)(FileContainer *, uint32_t track_id, const uint8_t *data, uint32_t data_len)
Definition: rust-context.h:46
app-layer-enip.h
TmqhCleanup
void TmqhCleanup(void)
Clean up registration time allocs.
Definition: tm-queuehandlers.c:49
RUNMODE_PFRING
@ RUNMODE_PFRING
Definition: runmodes.h:31
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:670
SC_ERR_NO_RULES_LOADED
@ SC_ERR_NO_RULES_LOADED
Definition: util-error.h:73
flow-manager.h
DecodeGlobalConfig
void DecodeGlobalConfig(void)
Definition: decode.c:766
SCInstance_::strict_rule_parsing_string
char * strict_rule_parsing_string
Definition: suricata.h:160
SuriHasSigFile
int SuriHasSigFile(void)
Definition: suricata.c:239
suricata-common.h
g_default_mtu
int g_default_mtu
Definition: suricata.c:217
sc_set_caps
int sc_set_caps
Definition: suricata.c:214
DetectEngineCtxInitStubForMT
DetectEngineCtx * DetectEngineCtxInitStubForMT(void)
Definition: detect-engine.c:2012
tm-queues.h
util-daemon.h
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:651
SCHInfoLoadFromConfig
void SCHInfoLoadFromConfig(void)
Load the host os policy information from the configuration.
Definition: util-host-os-info.c:333
DetectEngineBumpVersion
void DetectEngineBumpVersion(void)
Definition: detect-engine.c:3197
util-decode-mime.h
AppLayerDecoderEventsSetEventRaw
void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
Set an app layer decoder event.
Definition: app-layer-events.c:89
SC_ERR_PCAP_TRANSLATE
@ SC_ERR_PCAP_TRANSLATE
Definition: util-error.h:233
TmModuleFlowManagerRegister
void TmModuleFlowManagerRegister(void)
Definition: flow-manager.c:1370
util-spm.h
SCPidfileTestRunning
int SCPidfileTestRunning(const char *pid_filename)
Check the Suricata pid file (used at the startup)
Definition: util-pidfile.c:105
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
HostShutdown
void HostShutdown(void)
shutdown the flow engine
Definition: host.c:305
DOC_URL
#define DOC_URL
Definition: suricata.h:86
output-filestore.h
TmModuleDecodePfringRegister
void TmModuleDecodePfringRegister(void)
Registration Function for DecodePfring.
Definition: source-pfring.c:177
LiveSetOffloadWarn
void LiveSetOffloadWarn(void)
Definition: util-device.c:74
ParseSizeDeinit
void ParseSizeDeinit(void)
Definition: util-misc.c:54
util-classification-config.h
RunModeRegisterRunModes
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
Definition: runmodes.c:213
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
ConfGetChildValueBool
int ConfGetChildValueBool(const ConfNode *base, const char *name, int *val)
Definition: conf.c:529
SCProfilingDump
void SCProfilingDump(void)
Definition: util-profiling.c:294
EngineStop
void EngineStop(void)
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be a...
Definition: suricata.c:386
SCInstance_::sig_file
char * sig_file
Definition: suricata.h:128
SC_ERR_NO_AF_PACKET
@ SC_ERR_NO_AF_PACKET
Definition: util-error.h:225
ParseSizeStringU32
int ParseSizeStringU32(const char *size, uint32_t *res)
Definition: util-misc.c:185
SC_ERR_BPF
@ SC_ERR_BPF
Definition: util-error.h:157
TmModuleReceiveErfDagRegister
void TmModuleReceiveErfDagRegister(void)
Register the ERF file receiver (reader) module.
Definition: source-erf-dag.c:132
DetectEngineMultiTenantSetup
int DetectEngineMultiTenantSetup(void)
setup multi-detect / multi-tenancy
Definition: detect-engine.c:3581
IPPairBitInitCtx
void IPPairBitInitCtx(void)
Definition: ippair-bit.c:49
SCClassConfInit
void SCClassConfInit(void)
Definition: util-classification-config.c:64
RunmodeGetCurrent
int RunmodeGetCurrent(void)
Definition: suricata.c:274
ConfigSetLogDirectory
TmEcode ConfigSetLogDirectory(const char *name)
Definition: util-conf.c:30
CIDRInit
void CIDRInit(void)
Definition: util-cidr.c:31
threadvars.h
TmModuleDecodeIPFWRegister
void TmModuleDecodeIPFWRegister(void)
Registration Function for DecodeIPFW.
Definition: source-ipfw.c:186
source-af-packet.h
RUNMODE_NFQ
@ RUNMODE_NFQ
Definition: runmodes.h:32
ConfSetFromString
int ConfSetFromString(const char *input, int final)
Set a configuration parameter from a string.
Definition: conf.c:244
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
g_vlan_mask
uint16_t g_vlan_mask
Definition: suricata.c:230
ConfInit
void ConfInit(void)
Initialize the configuration system.
Definition: conf.c:113
TVT_MGMT
@ TVT_MGMT
Definition: tm-threads-common.h:88
DatasetsInit
int DatasetsInit(void)
Definition: datasets.c:626
sigusr2_count
volatile sig_atomic_t sigusr2_count
Definition: suricata.c:181
RUNMODE_ENGINE_ANALYSIS
@ RUNMODE_ENGINE_ANALYSIS
Definition: runmodes.h:54
RUNMODE_PRINT_VERSION
@ RUNMODE_PRINT_VERSION
Definition: runmodes.h:48
TmModuleDecodePcapRegister
void TmModuleDecodePcapRegister(void)
Registration Function for DecodePcap.
Definition: source-pcap.c:147
util-running-modes.h
unix-manager.h
LiveDeviceListClean
int LiveDeviceListClean()
Definition: util-device.c:347
str
#define str(s)
Definition: suricata-common.h:268
ConfigCheckDataDirectory
TmEcode ConfigCheckDataDirectory(const char *data_dir)
Definition: util-conf.c:101
SCInstance_::sig_file_exclusive
int sig_file_exclusive
Definition: suricata.h:129
g_detect_disabled
int g_detect_disabled
Definition: suricata.c:211
ConfigGetLogDirectory
const char * ConfigGetLogDirectory()
Definition: util-conf.c:35
DetectEngineReloadStart
int DetectEngineReloadStart(void)
Definition: detect-engine.c:1515
SC_ERR_NO_NETMAP
@ SC_ERR_NO_NETMAP
Definition: util-error.h:294
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DEFAULT_CONF_FILE
#define DEFAULT_CONF_FILE
Definition: suricata.h:80
ConfNode_
Definition: conf.h:32
AppLayerParserPostStreamSetup
void AppLayerParserPostStreamSetup(void)
Definition: app-layer-parser.c:224
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
TmModuleReceivePcapRegister
void TmModuleReceivePcapRegister(void)
Registration Function for ReceivePcap.
Definition: source-pcap.c:130
util-ioctl.h
detect-parse.h
SCInstance_::system
bool system
Definition: suricata.h:144
SCInstance_::pid_filename
char * pid_filename
Definition: suricata.h:130
TmModuleRespondRejectRegister
void TmModuleRespondRejectRegister(void)
Definition: respond-reject.c:49
CoredumpEnable
void CoredumpEnable(void)
Enable coredumps on systems where coredumps can and need to be enabled.
Definition: util-coredump-config.c:53
RunUnittests
void RunUnittests(int list_unittests, const char *regex_arg)
Definition: runmode-unittests.c:215
source-erf-file.h
ConfigCheckLogDirectoryExists
TmEcode ConfigCheckLogDirectoryExists(const char *log_dir)
Definition: util-conf.c:53
TimeDeinit
void TimeDeinit(void)
Definition: util-time.c:85
PacketAlertTagInit
void PacketAlertTagInit(void)
Definition: detect-engine-alert.c:37
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2022
AppLayerRegisterParser
int AppLayerRegisterParser(const struct AppLayerParser *p, AppProto alproto)
App layer protocol registration function.
Definition: app-layer-register.c:94
tmqh-flow.h
RUNMODE_WINDIVERT
@ RUNMODE_WINDIVERT
Definition: runmodes.h:42
SCProfilingRulesGlobalInit
void SCProfilingRulesGlobalInit(void)
Definition: util-profiling-rules.c:114
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:244
SC_ERR_MEM_ALLOC
@ SC_ERR_MEM_ALLOC
Definition: util-error.h:31
TmModuleNapatechStreamRegister
void TmModuleNapatechStreamRegister(void)
Register the Napatech receiver (reader) module.
Definition: source-napatech.c:128
SCProfilingKeywordsGlobalInit
void SCProfilingKeywordsGlobalInit(void)
Definition: util-profiling-keywords.c:69
suricata.h
ConfGetValue
int ConfGetValue(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:359
SC_ERR_NFLOG_NOSUPPORT
@ SC_ERR_NFLOG_NOSUPPORT
Definition: util-error.h:278
EngineDone
void EngineDone(void)
Used to indicate that the current task is done.
Definition: suricata.c:397
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:42
app-layer-smb.h
GetDocURL
const char * GetDocURL(void)
Definition: suricata.c:1018
util-mpm-hs.h
SC_ERR_LOGDIR_CMDLINE
@ SC_ERR_LOGDIR_CMDLINE
Definition: util-error.h:147
PostRunDeinit
void PostRunDeinit(const int runmode, struct timeval *start_time)
Definition: suricata.c:2045
HostInitConfig
void HostInitConfig(bool quiet)
initialize the configuration
Definition: host.c:173
ConfDeInit
void ConfDeInit(void)
De-initializes the configuration system.
Definition: conf.c:721
SuricataContext_::FileOpenFileWithId
int(* FileOpenFileWithId)(FileContainer *, const StreamingBufferConfig *, uint32_t track_id, const uint8_t *name, uint16_t name_len, const uint8_t *data, uint32_t data_len, uint16_t flags)
Definition: rust-context.h:39
SC_ERR_LIBNET_NOT_ENABLED
@ SC_ERR_LIBNET_NOT_ENABLED
Definition: util-error.h:178
NFQContextsClean
void NFQContextsClean()
Clean global contexts. Must be called on exit.
Definition: source-nfq.c:1274
SuricataContext_::FileContainerRecycle
void(* FileContainerRecycle)(FileContainer *ffc)
Definition: rust-context.h:48
ConfSet
int ConfSet(const char *name, const char *val)
Set a configuration value.
Definition: conf.c:219
DetectEngineReload
int DetectEngineReload(const SCInstance *suri)
Reload the detection engine.
Definition: detect-engine.c:4037
SCInstance_::do_setgid
uint8_t do_setgid
Definition: suricata.h:139
DEFAULT_MAX_PENDING_PACKETS
#define DEFAULT_MAX_PENDING_PACKETS
Definition: suricata.c:191
SCInstance_
Definition: suricata.h:123
TmThreadCheckThreadState
void TmThreadCheckThreadState(void)
Used to check the thread for certain conditions of failure.
Definition: tm-threads.c:1877
OutputFilestoreRegisterGlobalCounters
void OutputFilestoreRegisterGlobalCounters(void)
Definition: output-filestore.c:544
InitGlobal
int InitGlobal(void)
Global initialization common to all runmodes.
Definition: suricata.c:2658
SC_ERR_INITIALIZATION
@ SC_ERR_INITIALIZATION
Definition: util-error.h:75
SCInstance_::disabled_detect
int disabled_detect
Definition: suricata.h:149
app-layer-smtp.h
FileCloseFileById
int FileCloseFileById(FileContainer *ffc, uint32_t track_id, const uint8_t *data, uint32_t data_len, uint16_t flags)
Definition: util-file.c:1024
SURI_HOST_IS_ROUTER
@ SURI_HOST_IS_ROUTER
Definition: suricata.h:115
SCProfilingSghsGlobalInit
void SCProfilingSghsGlobalInit(void)
Definition: util-profiling-rulegroups.c:71
SCPidfileCreate
int SCPidfileCreate(const char *pidfile)
Write a pid file (used at the startup) This commonly needed by the init scripts.
Definition: util-pidfile.c:41
LiveRegisterDeviceName
int LiveRegisterDeviceName(const char *dev)
Add a device for monitoring.
Definition: util-device.c:95
ENGINE_MODE_IDS
@ ENGINE_MODE_IDS
Definition: suricata.h:103
LiveDeviceFinalize
void LiveDeviceFinalize(void)
Definition: util-device.c:469
PROG_VER
#define PROG_VER
Definition: suricata.h:72
util-misc.h
PacketPoolDestroy
void PacketPoolDestroy(void)
Definition: tmqh-packetpool.c:335
HTPFreeConfig
void HTPFreeConfig(void)
Clears the HTTP server configuration memory used by HTP library.
Definition: app-layer-htp.c:2024
flow.h
suricata_context
SuricataContext suricata_context
Definition: rust-context.c:21
respond-reject.h
SCInstance_::regex_arg
char * regex_arg
Definition: suricata.h:131
ListKeywords
int ListKeywords(const char *keyword_info)
Definition: util-running-modes.c:32
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:232
FileContainerRecycle
void FileContainerRecycle(FileContainer *ffc)
Recycle a FileContainer.
Definition: util-file.c:443
StatsReleaseResources
void StatsReleaseResources()
Releases the resources alloted by the Stats API.
Definition: counters.c:1255
RUNMODE_AFP_DEV
@ RUNMODE_AFP_DEV
Definition: runmodes.h:37
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
SCPidfileRemove
void SCPidfileRemove(const char *pid_filename)
Remove the pid file (used at the startup)
Definition: util-pidfile.c:83
flow-var.h
SC_ERR_NAPATECH_REQUIRED
@ SC_ERR_NAPATECH_REQUIRED
Definition: util-error.h:249
ThresholdInit
void ThresholdInit(void)
Definition: detect-engine-threshold.c:80
TimeInit
void TimeInit(void)
Definition: util-time.c:77
RUNMODE_PCAP_FILE
@ RUNMODE_PCAP_FILE
Definition: runmodes.h:30
SCInstance_::keyword_info
char * keyword_info
Definition: suricata.h:133
RUNMODE_PLUGIN
@ RUNMODE_PLUGIN
Definition: runmodes.h:43
SC_ERR_LOGDIR_CONFIG
@ SC_ERR_LOGDIR_CONFIG
Definition: util-error.h:146
SC_ERR_MULTIPLE_RUN_MODE
@ SC_ERR_MULTIPLE_RUN_MODE
Definition: util-error.h:156
SCInstance_::do_setuid
uint8_t do_setuid
Definition: suricata.h:138
app-layer-ssl.h
NetmapRunModeIsIPS
int NetmapRunModeIsIPS(void)
SCProfilingInit
void SCProfilingInit(void)
Initialize profiling.
Definition: util-profiling.c:140
g_ut_modules
int g_ut_modules
Definition: suricata.c:830
detect-engine-address.h
RUNMODE_IPFW
@ RUNMODE_IPFW
Definition: runmodes.h:34
output.h
util-storage.h
DetectEngineCtx_::failure_fatal
int failure_fatal
Definition: detect.h:760
util-threshold-config.h
DefragInit
void DefragInit(void)
Definition: defrag.c:1064
DetectEngineReloadIsStart
int DetectEngineReloadIsStart(void)
Definition: detect-engine.c:1529
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:194
host-bit.h
detect-engine-threshold.h
SC_ERR_NO_PF_RING
@ SC_ERR_NO_PF_RING
Definition: util-error.h:60
RUNMODE_LIST_UNITTEST
@ RUNMODE_LIST_UNITTEST
Definition: runmodes.h:53
app-layer.h
TagDestroyCtx
void TagDestroyCtx(void)
Destroy tag context hash tables.
Definition: detect-engine-tag.c:71
DetectAddressTestConfVars
int DetectAddressTestConfVars(void)
Definition: detect-engine-address.c:1263
g_disable_randomness
int g_disable_randomness
Definition: suricata.c:223
GetIfaceMTU
int GetIfaceMTU(const char *pcap_dev)
output the link MTU
Definition: util-ioctl.c:91
MpmHSGlobalCleanup
void MpmHSGlobalCleanup(void)
g_disable_hashing
bool g_disable_hashing
Definition: suricata.c:234
TmqResetQueues
void TmqResetQueues(void)
Definition: tm-queues.c:80