Go to the documentation of this file.
34 #ifdef HAVE_SYS_RESOURCE_H
36 #include <sys/resource.h>
41 #include <systemd/sd-daemon.h>
167 #define DEFAULT_MAX_PENDING_PACKETS 1024
195 #ifndef AFLFUZZ_NO_RANDOM
266 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
267 static void SignalHandlerSigint(
int sig)
271 static void SignalHandlerSigterm(
int sig)
277 #define UNW_LOCAL_ONLY
278 #include <libunwind.h>
279 static void SignalHandlerUnexpected(
int sig_num, siginfo_t *info,
void *context)
284 signal(SIGABRT, SIG_DFL);
285 signal(SIGSEGV, SIG_DFL);
287 if ((r = unw_init_local(&cursor, (unw_context_t *)(context)) != 0)) {
288 SCLogError(
"unable to obtain stack trace: unw_init_local: %s", unw_strerror(r));
297 if (unw_is_signal_frame(&cursor) == 0) {
300 if (unw_get_proc_name(&cursor, name,
sizeof(name), &off) == UNW_ENOMEM) {
309 r = unw_step(&cursor);
319 kill(getpid(), sig_num);
321 #undef UNW_LOCAL_ONLY
331 static void SignalHandlerSigusr2(
int sig)
341 static void SignalHandlerSigHup(
int sig)
394 #ifdef HAVE_AF_PACKET
402 #ifdef BUILD_HYPERSCAN
408 LuajitFreeStatesPool();
424 static void OnNotifyRunning(
void)
427 if (sd_notify(0,
"READY=1") < 0) {
455 static int SetBpfString(
int argc,
char *argv[])
457 char *bpf_filter = NULL;
458 uint32_t bpf_len = 0;
463 while(argv[tmpindex] != NULL) {
464 bpf_len+=strlen(argv[tmpindex]) + 1;
474 memset(bpf_filter, 0x00, bpf_len);
477 while(argv[tmpindex] != NULL) {
478 strlcat(bpf_filter, argv[tmpindex],bpf_len);
479 if(argv[tmpindex + 1] != NULL) {
480 strlcat(bpf_filter,
" ", bpf_len);
485 if(strlen(bpf_filter) > 0) {
497 static void SetBpfStringFromFile(
char *filename)
499 char *bpf_filter = NULL;
500 char *bpf_comment_tmp = NULL;
501 char *bpf_comment_start = NULL;
502 uint32_t bpf_len = 0;
511 fp = fopen(filename,
"r");
513 SCLogError(
"Failed to open file %s", filename);
518 if (_fstat(_fileno(fp), &st) != 0) {
520 if (fstat(fileno(fp), &st) != 0) {
522 SCLogError(
"Failed to stat file %s", filename);
525 bpf_len = st.st_size + 1;
529 SCLogError(
"Failed to allocate buffer for bpf filter in file %s", filename);
532 memset(bpf_filter, 0x00, bpf_len);
534 nm = fread(bpf_filter, 1, bpf_len - 1, fp);
535 if ((ferror(fp) != 0) || (nm != (bpf_len - 1))) {
536 SCLogError(
"Failed to read complete BPF file %s", filename);
542 bpf_filter[nm] =
'\0';
544 if(strlen(bpf_filter) > 0) {
546 bpf_comment_start = bpf_filter;
547 while((bpf_comment_tmp = strchr(bpf_comment_start,
'#')) != NULL) {
548 while((*bpf_comment_tmp !=
'\0') &&
549 (*bpf_comment_tmp !=
'\r') && (*bpf_comment_tmp !=
'\n'))
551 *bpf_comment_tmp++ =
' ';
553 bpf_comment_start = bpf_comment_tmp;
556 while((bpf_comment_tmp = strchr(bpf_filter,
'\r')) != NULL) {
557 *bpf_comment_tmp =
' ';
559 while((bpf_comment_tmp = strchr(bpf_filter,
'\n')) != NULL) {
560 *bpf_comment_tmp =
' ';
563 while (strlen(bpf_filter) > 0 &&
564 bpf_filter[strlen(bpf_filter)-1] ==
' ')
566 bpf_filter[strlen(bpf_filter)-1] =
'\0';
568 if (strlen(bpf_filter) > 0) {
578 static void PrintUsage(
const char *progname)
585 printf(
"USAGE: %s [OPTIONS] [BPF FILTER]\n\n", progname);
586 printf(
"\t-c <path> : path to configuration file\n");
587 printf(
"\t-T : test configuration file (use with -c)\n");
588 printf(
"\t-i <dev or ip> : run in pcap live mode\n");
589 printf(
"\t-F <bpf filter file> : bpf filter file\n");
590 printf(
"\t-r <path> : run in pcap file/offline mode\n");
592 printf(
"\t-q <qid[:qid]> : run in inline nfqueue mode (use colon to specify a range of queues)\n");
595 printf(
"\t-d <divert port> : run in inline ipfw divert mode\n");
597 printf(
"\t-s <path> : path to signature file loaded in addition to suricata.yaml settings (optional)\n");
598 printf(
"\t-S <path> : path to signature file loaded exclusively (optional)\n");
599 printf(
"\t-l <dir> : default log directory\n");
601 printf(
"\t-D : run as daemon\n");
603 printf(
"\t--service-install : install as service\n");
604 printf(
"\t--service-remove : remove service\n");
605 printf(
"\t--service-change-params : change service startup parameters\n");
607 printf(
"\t-k [all|none] : force checksum check (all) or disabled it (none)\n");
608 printf(
"\t-V : display Suricata version\n");
609 printf(
"\t-v : be more verbose (use multiple times to increase verbosity)\n");
611 printf(
"\t-u : run the unittests and exit\n");
612 printf(
"\t-U, --unittest-filter=REGEX : filter unittests with a regex\n");
613 printf(
"\t--list-unittests : list unit tests\n");
614 printf(
"\t--fatal-unittests : enable fatal failure on unittest error\n");
615 printf(
"\t--unittests-coverage : display unittest coverage report\n");
617 printf(
"\t--list-app-layer-protos : list supported app layer protocols\n");
618 printf(
"\t--list-keywords[=all|csv|<kword>] : list keywords implemented by the engine\n");
619 printf(
"\t--list-runmodes : list supported runmodes\n");
620 printf(
"\t--runmode <runmode_id> : specific runmode modification the engine should run. The argument\n"
621 "\t supplied should be the id for the runmode obtained by running\n"
622 "\t --list-runmodes\n");
623 printf(
"\t--engine-analysis : print reports on analysis of different sections in the engine and exit.\n"
624 "\t Please have a look at the conf parameter engine-analysis on what reports\n"
625 "\t can be printed\n");
626 printf(
"\t--pidfile <file> : write pid to this file\n");
627 printf(
"\t--init-errors-fatal : enable fatal failure on signature init error\n");
628 printf(
"\t--disable-detection : disable detection engine\n");
629 printf(
"\t--dump-config : show the running configuration\n");
630 printf(
"\t--dump-features : display provided features\n");
631 printf(
"\t--build-info : display build information\n");
632 printf(
"\t--pcap[=<dev>] : run in pcap mode, no value select interfaces from suricata.yaml\n");
633 printf(
"\t--pcap-file-continuous : when running in pcap mode with a directory, continue checking directory for pcaps until interrupted\n");
634 printf(
"\t--pcap-file-delete : when running in replay mode (-r with directory or file), will delete pcap files that have been processed when done\n");
635 printf(
"\t--pcap-file-recursive : will descend into subdirectories when running in replay mode (-r)\n");
636 #ifdef HAVE_PCAP_SET_BUFF
637 printf(
"\t--pcap-buffer-size : size of the pcap buffer value from 0 - %i\n",INT_MAX);
640 printf(
"\t--dpdk : run in dpdk mode, uses interfaces from "
643 #ifdef HAVE_AF_PACKET
644 printf(
"\t--af-packet[=<dev>] : run in af-packet mode, no value select interfaces from suricata.yaml\n");
647 printf(
"\t--af-xdp[=<dev>] : run in af-xdp mode, no value select "
648 "interfaces from suricata.yaml\n");
651 printf(
"\t--netmap[=<dev>] : run in netmap mode, no value select interfaces from suricata.yaml\n");
654 printf(
"\t--pfring[=<dev>] : run in pfring mode, use interfaces from suricata.yaml\n");
655 printf(
"\t--pfring-int <dev> : run in pfring mode, use interface <dev>\n");
656 printf(
"\t--pfring-cluster-id <id> : pfring cluster id \n");
657 printf(
"\t--pfring-cluster-type <type> : pfring cluster type for PF_RING 4.1.2 and later cluster_round_robin|cluster_flow\n");
659 printf(
"\t--simulate-ips : force engine into IPS mode. Useful for QA\n");
660 #ifdef HAVE_LIBCAP_NG
661 printf(
"\t--user <user> : run suricata as this user after init\n");
662 printf(
"\t--group <group> : run suricata as this group after init\n");
664 printf(
"\t--erf-in <path> : process an ERF file\n");
666 printf(
"\t--dag <dagX:Y> : process ERF records from DAG interface X, stream Y\n");
669 printf(
"\t--napatech : run Napatech Streams using the API\n");
671 #ifdef BUILD_UNIX_SOCKET
672 printf(
"\t--unix-socket[=<file>] : use unix socket to control suricata work\n");
675 printf(
"\t--windivert <filter> : run in inline WinDivert mode\n");
676 printf(
"\t--windivert-forward <filter> : run in inline WinDivert mode, as a gateway\n");
679 printf(
"\t--reject-dev <dev> : send reject packets from this interface\n");
681 printf(
"\t--include <path> : additional configuration file\n");
682 printf(
"\t--set name=value : set a configuration value\n");
684 printf(
"\nTo run the engine with default configuration on "
685 "interface eth0 with signature file \"signatures.rules\", run the "
686 "command as:\n\n%s -c suricata.yaml -s signatures.rules -i eth0 \n\n",
690 static void PrintBuildInfo(
void)
694 char features[2048] =
"";
699 strlcat(features,
"DEBUG ",
sizeof(features));
701 #ifdef DEBUG_VALIDATION
702 strlcat(features,
"DEBUG_VALIDATION ",
sizeof(features));
705 strlcat(features,
"UNITTESTS ",
sizeof(features));
708 strlcat(features,
"NFQ ",
sizeof(features));
711 strlcat(features,
"IPFW ",
sizeof(features));
713 #ifdef HAVE_PCAP_SET_BUFF
714 strlcat(features,
"PCAP_SET_BUFF ",
sizeof(features));
717 strlcat(features,
"PF_RING ",
sizeof(features));
719 #ifdef HAVE_AF_PACKET
720 strlcat(features,
"AF_PACKET ",
sizeof(features));
723 strlcat(features,
"NETMAP ",
sizeof(features));
725 #ifdef HAVE_PACKET_FANOUT
726 strlcat(features,
"HAVE_PACKET_FANOUT ",
sizeof(features));
729 strlcat(features,
"DAG ",
sizeof(features));
731 #ifdef HAVE_LIBCAP_NG
732 strlcat(features,
"LIBCAP_NG ",
sizeof(features));
735 strlcat(features,
"LIBNET1.1 ",
sizeof(features));
737 #ifdef HAVE_HTP_URI_NORMALIZE_HOOK
738 strlcat(features,
"HAVE_HTP_URI_NORMALIZE_HOOK ",
sizeof(features));
740 #ifdef PCRE2_HAVE_JIT
741 strlcat(features,
"PCRE_JIT ",
sizeof(features));
744 strlcat(features,
"HAVE_NSS ",
sizeof(features));
746 strlcat(features,
"HTTP2_DECOMPRESSION ",
sizeof(features));
748 strlcat(features,
"HAVE_LUA ",
sizeof(features));
751 strlcat(features,
"HAVE_LUAJIT ",
sizeof(features));
753 strlcat(features,
"HAVE_LIBJANSSON ",
sizeof(features));
755 strlcat(features,
"PROFILING ",
sizeof(features));
757 #ifdef PROFILE_LOCKING
758 strlcat(features,
"PROFILE_LOCKING ",
sizeof(features));
760 #if defined(TLS_C11) || defined(TLS_GNU)
761 strlcat(features,
"TLS ",
sizeof(features));
764 strlcat(features,
"TLS_C11 ",
sizeof(features));
765 #elif defined(TLS_GNU)
766 strlcat(features,
"TLS_GNU ",
sizeof(features));
769 strlcat(features,
"MAGIC ",
sizeof(features));
771 strlcat(features,
"RUST ",
sizeof(features));
772 #if defined(SC_ADDRESS_SANITIZER)
773 strlcat(features,
"ASAN ",
sizeof(features));
775 if (strlen(features) == 0) {
776 strlcat(features,
"none",
sizeof(features));
779 printf(
"Features: %s\n", features);
782 memset(features, 0x00,
sizeof(features));
783 #if defined(__SSE4_2__)
784 strlcat(features,
"SSE_4_2 ",
sizeof(features));
786 #if defined(__SSE4_1__)
787 strlcat(features,
"SSE_4_1 ",
sizeof(features));
789 #if defined(__SSE3__)
790 strlcat(features,
"SSE_3 ",
sizeof(features));
792 if (strlen(features) == 0) {
793 strlcat(features,
"none",
sizeof(features));
795 printf(
"SIMD support: %s\n", features);
798 memset(features, 0x00,
sizeof(features));
799 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_1)
800 strlcat(features,
"1 ",
sizeof(features));
802 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_2)
803 strlcat(features,
"2 ",
sizeof(features));
805 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_4)
806 strlcat(features,
"4 ",
sizeof(features));
808 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_8)
809 strlcat(features,
"8 ",
sizeof(features));
811 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_16)
812 strlcat(features,
"16 ",
sizeof(features));
814 if (strlen(features) == 0) {
815 strlcat(features,
"none",
sizeof(features));
817 strlcat(features,
"byte(s)",
sizeof(features));
819 printf(
"Atomic intrinsics: %s\n", features);
823 #elif __WORDSIZE == 32
826 bits =
"<unknown>-bits";
829 #if __BYTE_ORDER == __BIG_ENDIAN
830 endian =
"Big-endian";
831 #elif __BYTE_ORDER == __LITTLE_ENDIAN
832 endian =
"Little-endian";
834 endian =
"<unknown>-endian";
837 printf(
"%s, %s architecture\n", bits, endian);
839 printf(
"GCC version %s, C version %"PRIiMAX
"\n", __VERSION__, (intmax_t)__STDC_VERSION__);
841 printf(
"C version %"PRIiMAX
"\n", (intmax_t)__STDC_VERSION__);
845 printf(
"compiled with -fstack-protector\n");
848 printf(
"compiled with -fstack-protector-all\n");
857 #if _FORTIFY_SOURCE == 2
858 printf(
"compiled with _FORTIFY_SOURCE=2\n");
859 #elif _FORTIFY_SOURCE == 1
860 printf(
"compiled with _FORTIFY_SOURCE=1\n");
861 #elif _FORTIFY_SOURCE == 0
862 printf(
"compiled with _FORTIFY_SOURCE=0\n");
865 printf(
"L1 cache line size (CLS)=%d\n",
CLS);
868 tls =
"_Thread_local";
869 #elif defined(TLS_GNU)
872 #error "Unsupported thread local"
874 printf(
"thread local storage method: %s\n", tls);
876 printf(
"compiled with %s, linked against %s\n",
877 HTP_VERSION_STRING_FULL, htp_get_version());
879 #include "build-info.h"
979 static TmEcode ParseInterfacesList(
const int runmode,
char *pcap_dev)
985 if (strlen(pcap_dev) == 0) {
988 SCLogError(
"No interface found in config for pcap");
995 if (strlen(pcap_dev)) {
996 if (
ConfSetFinal(
"pfring.live-interface", pcap_dev) != 1) {
997 SCLogError(
"Failed to set pfring.live-interface");
1006 char iface_selector[] =
"dpdk.interfaces";
1009 SCLogError(
"No interface found in config for %s", iface_selector);
1013 #ifdef HAVE_AF_PACKET
1016 if (strlen(pcap_dev)) {
1017 if (
ConfSetFinal(
"af-packet.live-interface", pcap_dev) != 1) {
1018 SCLogError(
"Failed to set af-packet.live-interface");
1024 SCLogError(
"No interface found in config for af-packet");
1032 if (strlen(pcap_dev)) {
1033 if (
ConfSetFinal(
"af-xdp.live-interface", pcap_dev) != 1) {
1034 SCLogError(
"Failed to set af-xdp.live-interface");
1040 SCLogError(
"No interface found in config for af-xdp");
1048 if (strlen(pcap_dev)) {
1049 if (
ConfSetFinal(
"netmap.live-interface", pcap_dev) != 1) {
1050 SCLogError(
"Failed to set netmap.live-interface");
1056 SCLogError(
"No interface found in config for netmap");
1065 SCLogError(
"No group found in config for nflog");
1074 static void SCInstanceInit(
SCInstance *suri,
const char *progname)
1076 memset(suri, 0x00,
sizeof(*suri));
1103 #if HAVE_DETECT_DISABLED==1
1113 if (strstr(prog_ver,
"RELEASE") != NULL) {
1133 if (strstr(
PROG_VER,
"-dev") == NULL) {
1144 static TmEcode PrintVersion(
void)
1152 const char *mode = suri->
system ?
"SYSTEM" :
"USER";
1153 SCLogNotice(
"This is %s version %s running in %s mode",
1164 static void SCPrintElapsedTime(
struct timeval *start_time)
1166 if (start_time == NULL)
1168 struct timeval end_time;
1169 memset(&end_time, 0,
sizeof(end_time));
1170 gettimeofday(&end_time, NULL);
1171 uint64_t milliseconds = ((end_time.tv_sec - start_time->tv_sec) * 1000) +
1172 (((1000000 + end_time.tv_usec - start_time->tv_usec) / 1000) - 1000);
1173 SCLogInfo(
"time elapsed %.3fs", (
float)milliseconds/(
float)1000);
1176 static int ParseCommandLineAfpacket(
SCInstance *suri,
const char *in_arg)
1178 #ifdef HAVE_AF_PACKET
1190 SCLogInfo(
"Multiple af-packet option without interface on each is useless");
1194 "has been specified");
1200 SCLogError(
"AF_PACKET not enabled. On Linux "
1201 "host, make sure to pass --enable-af-packet to "
1202 "configure when building.");
1207 static int ParseCommandLineAfxdp(
SCInstance *suri,
const char *in_arg)
1221 SCLogInfo(
"Multiple af-xdp options without interface on each is useless");
1225 "has been specified");
1232 "host, make sure correct libraries are installed,"
1233 " see documentation for information.");
1238 static int ParseCommandLineDpdk(
SCInstance *suri,
const char *in_arg)
1244 SCLogInfo(
"Multiple dpdk options have no effect on Suricata");
1247 "has been specified");
1254 "host, make sure to pass --enable-dpdk to "
1255 "configure when building.");
1260 static int ParseCommandLinePcapLive(
SCInstance *suri,
const char *in_arg)
1262 #if defined(OS_WIN32) && !defined(HAVE_LIBWPCAP)
1264 FatalError(
"Live capture not available. To support live capture compile against Npcap.");
1268 if (in_arg != NULL) {
1271 if (strlen(in_arg) > 9 && strncmp(in_arg,
"DeviceNPF", 9) == 0) {
1272 snprintf(suri->
pcap_dev,
sizeof(suri->
pcap_dev),
"\\Device\\NPF%s", in_arg+9);
1278 if (strcmp(suri->
pcap_dev, in_arg) != 0) {
1280 }
else if (strlen(suri->
pcap_dev) > 0 && isdigit((
unsigned char)suri->
pcap_dev[0])) {
1281 SCLogError(
"failed to find a pcap device for IP %s", in_arg);
1295 "has been specified");
1305 static bool IsLogDirectoryWritable(
const char*
str)
1307 if (access(
str, W_OK) == 0)
1316 int dump_config = 0;
1317 int dump_features = 0;
1318 int list_app_layer_protocols = 0;
1319 int list_unittests = 0;
1320 int list_runmodes = 0;
1321 int list_keywords = 0;
1334 struct option long_opts[] = {
1335 {
"dump-config", 0, &dump_config, 1},
1336 {
"dump-features", 0, &dump_features, 1},
1337 {
"pfring", optional_argument, 0, 0},
1338 {
"pfring-int", required_argument, 0, 0},
1339 {
"pfring-cluster-id", required_argument, 0, 0},
1340 {
"pfring-cluster-type", required_argument, 0, 0},
1344 {
"af-packet", optional_argument, 0, 0},
1345 {
"af-xdp", optional_argument, 0, 0},
1346 {
"netmap", optional_argument, 0, 0},
1347 {
"pcap", optional_argument, 0, 0},
1348 {
"pcap-file-continuous", 0, 0, 0},
1349 {
"pcap-file-delete", 0, 0, 0},
1350 {
"pcap-file-recursive", 0, 0, 0},
1351 {
"simulate-ips", 0, 0 , 0},
1353 {
"strict-rule-keywords", optional_argument, 0, 0},
1355 {
"capture-plugin", required_argument, 0, 0},
1356 {
"capture-plugin-args", required_argument, 0, 0},
1358 #ifdef BUILD_UNIX_SOCKET
1359 {
"unix-socket", optional_argument, 0, 0},
1361 {
"pcap-buffer-size", required_argument, 0, 0},
1362 {
"unittest-filter", required_argument, 0,
'U'},
1363 {
"list-app-layer-protos", 0, &list_app_layer_protocols, 1},
1364 {
"list-unittests", 0, &list_unittests, 1},
1365 {
"list-runmodes", 0, &list_runmodes, 1},
1366 {
"list-keywords", optional_argument, &list_keywords, 1},
1367 {
"runmode", required_argument, NULL, 0},
1370 {
"service-install", 0, 0, 0},
1371 {
"service-remove", 0, 0, 0},
1372 {
"service-change-params", 0, 0, 0},
1374 {
"pidfile", required_argument, 0, 0},
1375 {
"init-errors-fatal", 0, 0, 0},
1376 {
"disable-detection", 0, 0, 0},
1377 {
"disable-hashing", 0, 0, 0},
1378 {
"fatal-unittests", 0, 0, 0},
1380 {
"user", required_argument, 0, 0},
1381 {
"group", required_argument, 0, 0},
1382 {
"erf-in", required_argument, 0, 0},
1383 {
"dag", required_argument, 0, 0},
1384 {
"napatech", 0, 0, 0},
1385 {
"build-info", 0, &build_info, 1},
1386 {
"data-dir", required_argument, 0, 0},
1388 {
"windivert", required_argument, 0, 0},
1389 {
"windivert-forward", required_argument, 0, 0},
1391 #ifdef HAVE_LIBNET11
1392 {
"reject-dev", required_argument, 0, 0},
1394 {
"set", required_argument, 0, 0},
1396 {
"nflog", optional_argument, 0, 0},
1398 {
"simulate-packet-flow-memcap", required_argument, 0, 0},
1399 {
"simulate-applayer-error-at-offset-ts", required_argument, 0, 0},
1400 {
"simulate-applayer-error-at-offset-tc", required_argument, 0, 0},
1401 {
"simulate-packet-loss", required_argument, 0, 0},
1402 {
"simulate-packet-tcp-reassembly-memcap", required_argument, 0, 0},
1403 {
"simulate-packet-tcp-ssn-memcap", required_argument, 0, 0},
1404 {
"simulate-packet-defrag-memcap", required_argument, 0, 0},
1405 {
"simulate-alert-queue-realloc-failure", 0, 0, 0},
1406 {
"include", required_argument, 0, 0},
1413 int option_index = 0;
1415 char short_opts[] =
"c:TDhi:l:q:d:r:us:S:U:VF:vk:";
1417 while ((opt = getopt_long(argc, argv, short_opts, long_opts, &option_index)) != -1) {
1420 if (strcmp((long_opts[option_index]).name ,
"pfring") == 0 ||
1421 strcmp((long_opts[option_index]).name ,
"pfring-int") == 0) {
1424 if (optarg != NULL) {
1427 ((strlen(optarg) <
sizeof(suri->
pcap_dev)) ?
1428 (strlen(optarg) + 1) :
sizeof(suri->
pcap_dev)));
1433 "to pass --enable-pfring to configure when building.");
1437 else if(strcmp((long_opts[option_index]).name ,
"pfring-cluster-id") == 0){
1440 SCLogError(
"failed to set pfring.cluster-id");
1445 "to pass --enable-pfring to configure when building.");
1449 else if(strcmp((long_opts[option_index]).name ,
"pfring-cluster-type") == 0){
1451 if (
ConfSetFinal(
"pfring.cluster-type", optarg) != 1) {
1452 SCLogError(
"failed to set pfring.cluster-type");
1457 "to pass --enable-pfring to configure when building.");
1461 else if (strcmp((long_opts[option_index]).name ,
"capture-plugin") == 0){
1465 else if (strcmp((long_opts[option_index]).name ,
"capture-plugin-args") == 0){
1467 }
else if (strcmp((long_opts[option_index]).name,
"dpdk") == 0) {
1468 if (ParseCommandLineDpdk(suri, optarg) !=
TM_ECODE_OK) {
1471 }
else if (strcmp((long_opts[option_index]).name,
"af-packet") == 0) {
1472 if (ParseCommandLineAfpacket(suri, optarg) !=
TM_ECODE_OK) {
1475 }
else if (strcmp((long_opts[option_index]).name,
"af-xdp") == 0) {
1476 if (ParseCommandLineAfxdp(suri, optarg) !=
TM_ECODE_OK) {
1479 }
else if (strcmp((long_opts[option_index]).name,
"netmap") == 0) {
1487 ((strlen(optarg) <
sizeof(suri->
pcap_dev)) ?
1488 (strlen(optarg) + 1) :
sizeof(suri->
pcap_dev)));
1494 SCLogInfo(
"Multiple netmap option without interface on each is useless");
1499 "has been specified");
1500 PrintUsage(argv[0]);
1507 }
else if (strcmp((long_opts[option_index]).name,
"nflog") == 0) {
1517 }
else if (strcmp((long_opts[option_index]).name,
"pcap") == 0) {
1518 if (ParseCommandLinePcapLive(suri, optarg) !=
TM_ECODE_OK) {
1521 }
else if (strcmp((long_opts[option_index]).name,
"simulate-ips") == 0) {
1524 }
else if (strcmp((long_opts[option_index]).name,
"init-errors-fatal") == 0) {
1525 if (
ConfSetFinal(
"engine.init-failure-fatal",
"1") != 1) {
1526 SCLogError(
"failed to set engine init-failure-fatal");
1529 #ifdef BUILD_UNIX_SOCKET
1530 }
else if (strcmp((long_opts[option_index]).name ,
"unix-socket") == 0) {
1534 if (
ConfSetFinal(
"unix-command.filename", optarg) != 1) {
1535 SCLogError(
"failed to set unix-command.filename");
1542 "has been specified");
1543 PrintUsage(argv[0]);
1548 else if(strcmp((long_opts[option_index]).name,
"list-app-layer-protocols") == 0) {
1551 else if(strcmp((long_opts[option_index]).name,
"list-unittests") == 0) {
1555 SCLogError(
"unit tests not enabled. Make sure to pass --enable-unittests to "
1556 "configure when building");
1559 }
else if (strcmp((long_opts[option_index]).name,
"list-runmodes") == 0) {
1562 }
else if (strcmp((long_opts[option_index]).name,
"list-keywords") == 0) {
1564 if (strcmp(
"short",optarg)) {
1568 }
else if (strcmp((long_opts[option_index]).name,
"runmode") == 0) {
1570 }
else if(strcmp((long_opts[option_index]).name,
"engine-analysis") == 0) {
1574 else if(strcmp((long_opts[option_index]).name,
"service-install") == 0) {
1575 suri->
run_mode = RUNMODE_INSTALL_SERVICE;
1578 else if(strcmp((long_opts[option_index]).name,
"service-remove") == 0) {
1579 suri->
run_mode = RUNMODE_REMOVE_SERVICE;
1582 else if(strcmp((long_opts[option_index]).name,
"service-change-params") == 0) {
1583 suri->
run_mode = RUNMODE_CHANGE_SERVICE_PARAMS;
1587 else if(strcmp((long_opts[option_index]).name,
"pidfile") == 0) {
1590 SCLogError(
"strdup failed: %s", strerror(errno));
1594 else if(strcmp((long_opts[option_index]).name,
"disable-detection") == 0) {
1596 }
else if (strcmp((long_opts[option_index]).name,
"disable-hashing") == 0) {
1598 }
else if (strcmp((long_opts[option_index]).name,
"fatal-unittests") == 0) {
1602 SCLogError(
"unit tests not enabled. Make sure to pass --enable-unittests to "
1603 "configure when building");
1606 }
else if (strcmp((long_opts[option_index]).name,
"user") == 0) {
1607 #ifndef HAVE_LIBCAP_NG
1609 " drop privileges, but it was not compiled into Suricata.");
1615 }
else if (strcmp((long_opts[option_index]).name,
"group") == 0) {
1616 #ifndef HAVE_LIBCAP_NG
1618 " drop privileges, but it was not compiled into Suricata.");
1624 }
else if (strcmp((long_opts[option_index]).name,
"erf-in") == 0) {
1630 }
else if (strcmp((long_opts[option_index]).name,
"dag") == 0) {
1636 SCLogError(
"more than one run mode has been specified");
1637 PrintUsage(argv[0]);
1642 SCLogError(
"libdag and a DAG card are required"
1643 " to receive packets using --dag.");
1646 }
else if (strcmp((long_opts[option_index]).name,
"napatech") == 0) {
1647 #ifdef HAVE_NAPATECH
1650 SCLogError(
"libntapi and a Napatech adapter are required"
1651 " to capture packets using --napatech.");
1654 }
else if (strcmp((long_opts[option_index]).name,
"pcap-buffer-size") == 0) {
1655 #ifdef HAVE_PCAP_SET_BUFF
1657 SCLogError(
"failed to set pcap-buffer-size");
1662 " doesn't support setting buffer size.");
1664 }
else if (strcmp((long_opts[option_index]).name,
"build-info") == 0) {
1667 }
else if (strcmp((long_opts[option_index]).name,
"windivert-forward") == 0) {
1671 if (WinDivertRegisterQueue(
true, optarg) == -1) {
1675 if (WinDivertRegisterQueue(
true, optarg) == -1) {
1680 "has been specified");
1681 PrintUsage(argv[0]);
1685 else if(strcmp((long_opts[option_index]).name,
"windivert") == 0) {
1688 if (WinDivertRegisterQueue(
false, optarg) == -1) {
1692 if (WinDivertRegisterQueue(
false, optarg) == -1) {
1697 "has been specified");
1698 PrintUsage(argv[0]);
1702 SCLogError(
"WinDivert not enabled. Make sure to pass --enable-windivert to "
1703 "configure when building.");
1706 }
else if(strcmp((long_opts[option_index]).name,
"reject-dev") == 0) {
1707 #ifdef HAVE_LIBNET11
1709 extern char *g_reject_dev;
1710 extern uint16_t g_reject_dev_mtu;
1711 g_reject_dev = optarg;
1714 g_reject_dev_mtu = (uint16_t)mtu;
1717 SCLogError(
"Libnet 1.1 support not enabled. Compile Suricata with libnet support.");
1721 else if (strcmp((long_opts[option_index]).name,
"set") == 0) {
1722 if (optarg != NULL) {
1724 char *val = strchr(optarg,
'=');
1726 FatalError(
"Invalid argument for --set, must be key=val.");
1729 FatalError(
"failed to set configuration value %s", optarg);
1733 else if (strcmp((long_opts[option_index]).name,
"pcap-file-continuous") == 0) {
1734 if (
ConfSetFinal(
"pcap-file.continuous",
"true") != 1) {
1735 SCLogError(
"Failed to set pcap-file.continuous");
1739 else if (strcmp((long_opts[option_index]).name,
"pcap-file-delete") == 0) {
1740 if (
ConfSetFinal(
"pcap-file.delete-when-done",
"true") != 1) {
1741 SCLogError(
"Failed to set pcap-file.delete-when-done");
1745 else if (strcmp((long_opts[option_index]).name,
"pcap-file-recursive") == 0) {
1746 if (
ConfSetFinal(
"pcap-file.recursive",
"true") != 1) {
1747 SCLogError(
"failed to set pcap-file.recursive");
1751 else if (strcmp((long_opts[option_index]).name,
"data-dir") == 0) {
1752 if (optarg == NULL) {
1753 SCLogError(
"no option argument (optarg) for -d");
1763 " supplied at the command-line (-d %s) doesn't "
1764 "exist. Shutting down the engine.",
1769 }
else if (strcmp((long_opts[option_index]).name ,
"strict-rule-keywords") == 0){
1770 if (optarg == NULL) {
1776 FatalError(
"failed to duplicate 'strict' string");
1778 }
else if (strcmp((long_opts[option_index]).name,
"include") == 0) {
1783 "Failed to allocate memory for additional configuration files: %s",
1788 for (
int i = 0;; i++) {
1790 const char **additional_configs =
1792 if (additional_configs == NULL) {
1793 FatalError(
"Failed to allocate memory for additional configuration "
1807 (long_opts[option_index]).name, optarg);
1817 if (
ConfSetFinal(
"engine.init-failure-fatal",
"1") != 1) {
1818 SCLogError(
"failed to set engine init-failure-fatal");
1831 if (optarg == NULL) {
1832 SCLogError(
"no option argument (optarg) for -i");
1835 #ifdef HAVE_AF_PACKET
1836 if (ParseCommandLineAfpacket(suri, optarg) !=
TM_ECODE_OK) {
1841 #if defined HAVE_PFRING || HAVE_NETMAP
1850 "option%s %s available:"
1852 " PF_RING (--pfring-int=%s)"
1855 " NETMAP (--netmap=%s)"
1857 ". Use --pcap=%s to suppress this warning",
1858 i == 1 ?
"" :
"s", i == 1 ?
"is" :
"are"
1870 if (ParseCommandLinePcapLive(suri, optarg) !=
TM_ECODE_OK) {
1876 if (optarg == NULL) {
1877 SCLogError(
"no option argument (optarg) for -l");
1887 " supplied at the command-line (-l %s) doesn't "
1888 "exist. Shutting down the engine.",
1892 if (!IsLogDirectoryWritable(optarg)) {
1894 " supplied at the command-line (-l %s) is not "
1895 "writable. Shutting down the engine.",
1914 "has been specified");
1915 PrintUsage(argv[0]);
1919 SCLogError(
"NFQUEUE not enabled. Make sure to pass --enable-nfqueue to configure when "
1936 "has been specified");
1937 PrintUsage(argv[0]);
1941 SCLogError(
"IPFW not enabled. Make sure to pass --enable-ipfw to configure when "
1952 "has been specified");
1953 PrintUsage(argv[0]);
1958 if(_stat(optarg, &buf) != 0) {
1961 if (stat(optarg, &buf) != 0) {
1963 SCLogError(
"pcap file '%s': %s", optarg, strerror(errno));
1967 SCLogError(
"ERROR: Failed to set pcap-file.file\n");
1974 SCLogError(
"can't have multiple -s options or mix -s and -S.");
1981 SCLogError(
"can't have multiple -S options or mix -s and -S.");
1994 PrintUsage(argv[0]);
1998 SCLogError(
"unit tests not enabled. Make sure to pass --enable-unittests to configure "
2015 if (optarg == NULL) {
2016 SCLogError(
"no option argument (optarg) for -F");
2020 SetBpfStringFromFile(optarg);
2026 if (optarg == NULL) {
2027 SCLogError(
"no option argument (optarg) for -k");
2030 if (!strcmp(
"all", optarg))
2032 else if (!strcmp(
"none", optarg))
2035 SCLogError(
"option '%s' invalid for -k", optarg);
2040 PrintUsage(argv[0]);
2046 SCLogError(
"can't use -s/-S when detection is disabled");
2053 if (list_app_layer_protocols)
2071 ret = SetBpfString(optind, argv);
2079 static int WindowsInitService(
int argc,
char **argv)
2081 if (SCRunningAsService()) {
2082 char path[MAX_PATH];
2084 strlcpy(path, argv[0], MAX_PATH);
2085 if ((p = strrchr(path,
'\\'))) {
2088 if (!SetCurrentDirectory(path)) {
2089 SCLogError(
"Can't set current directory to: %s", path);
2092 SCLogInfo(
"Current directory is set to: %s", path);
2093 SCServiceInit(argc, argv);
2098 if (0 != WSAStartup(MAKEWORD(2, 2), &wsaData)) {
2099 SCLogError(
"Can't initialize Windows sockets: %d", WSAGetLastError());
2110 const char *pid_filename;
2112 if (
ConfGet(
"pid-file", &pid_filename) == 1) {
2113 SCLogInfo(
"Use pid file %s from config file.", pid_filename);
2120 SCLogError(
"strdup failed: %s", strerror(errno));
2139 SCLogError(
"Unable to create PID file, concurrent run of"
2140 " Suricata can occur.");
2141 SCLogError(
"PID file creation WILL be mandatory for daemon mode"
2142 " in future version");
2157 if (
ConfGet(
"run-as.user", &
id) == 1) {
2161 if (
ConfGet(
"run-as.group", &
id) == 1) {
2188 static int InitSignalHandler(
SCInstance *suri)
2191 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
2196 if (
ConfGetBool(
"logging.stacktrace-on-signal", &enabled) == 0) {
2201 SCLogInfo(
"Preparing unexpected signal handling");
2202 struct sigaction stacktrace_action;
2203 memset(&stacktrace_action, 0,
sizeof(stacktrace_action));
2204 stacktrace_action.sa_sigaction = SignalHandlerUnexpected;
2205 stacktrace_action.sa_flags = SA_SIGINFO;
2206 sigaction(SIGSEGV, &stacktrace_action, NULL);
2207 sigaction(SIGABRT, &stacktrace_action, NULL);
2231 #ifdef PROFILE_RULES
2239 #ifdef PROFILE_RULES
2289 SCPrintElapsedTime(start_time);
2323 static int StartInternalRunMode(
SCInstance *suri,
int argc,
char **argv)
2342 PrintUsage(argv[0]);
2352 case RUNMODE_INSTALL_SERVICE:
2353 if (SCServiceInstall(argc, argv)) {
2356 SCLogInfo(
"Suricata service has been successfully installed.");
2358 case RUNMODE_REMOVE_SERVICE:
2359 if (SCServiceRemove(argc, argv)) {
2362 SCLogInfo(
"Suricata service has been successfully removed.");
2364 case RUNMODE_CHANGE_SERVICE_PARAMS:
2365 if (SCServiceChangeParams(argc, argv)) {
2368 SCLogInfo(
"Suricata service startup parameters has been successfully changed.");
2378 static int FinalizeRunMode(
SCInstance *suri,
char **argv)
2382 PrintUsage(argv[0]);
2397 static void SetupDelayedDetect(
SCInstance *suri)
2406 if (decnf != NULL) {
2408 if (strcmp(denode->
val,
"delayed-detect") == 0) {
2418 SCLogInfo(
"Packets will start being processed before signatures are active.");
2434 static int ConfigGetCaptureValue(
SCInstance *suri)
2438 intmax_t tmp_max_pending_packets;
2439 if (
ConfGetInt(
"max-pending-packets", &tmp_max_pending_packets) != 1)
2441 if (tmp_max_pending_packets < 1 || tmp_max_pending_packets >= UINT16_MAX) {
2442 SCLogError(
"Maximum max-pending-packets setting is 65534 and must be greater than 0. "
2443 "Please check %s for errors",
2454 const char *temp_default_packet_size;
2455 if ((
ConfGet(
"default-packet-size", &temp_default_packet_size)) != 1) {
2458 int strip_trailing_plus = 0;
2463 const int mtu = GetGlobalMTUWin32();
2477 strip_trailing_plus = 1;
2484 for (lthread = 0; lthread < nlive; lthread++) {
2487 (void)
strlcpy(dev, live_dev,
sizeof(dev));
2489 if (strip_trailing_plus) {
2490 size_t len = strlen(dev);
2492 (dev[
len-1] ==
'+' ||
2493 dev[
len-1] ==
'^' ||
2511 SCLogError(
"Error parsing max-pending-packets "
2512 "from conf file - %s. Killing engine",
2513 temp_default_packet_size);
2523 static void PostRunStartedDetectSetup(
const SCInstance *suri)
2537 SCLogNotice(
"Signature(s) loaded, Detect thread(s) activated.");
2551 SetupDelayedDetect(suri);
2553 (void)
ConfGetBool(
"multi-detect.enabled", &mt_enabled);
2554 int default_tenant = 0;
2556 (void)
ConfGetBool(
"multi-detect.default", &default_tenant);
2559 "detection engine contexts failed.");
2569 FatalError(
"initializing detection engine failed.");
2583 static void PostConfLoadedSetupHostMode(
void)
2585 const char *hostmode = NULL;
2587 if (
ConfGet(
"host-mode", &hostmode) == 1) {
2588 if (!strcmp(hostmode,
"router")) {
2590 }
else if (!strcmp(hostmode,
"sniffer-only")) {
2593 if (strcmp(hostmode,
"auto") != 0) {
2605 SCLogInfo(
"No 'host-mode': suricata is in IPS mode, using "
2606 "default setting 'router'");
2609 SCLogInfo(
"No 'host-mode': suricata is in IDS mode, using "
2610 "default setting 'sniffer-only'");
2618 if (suri->
system ==
false) {
2622 FatalError(
"could not set USER mode logdir");
2628 FatalError(
"could not set USER mode datadir");
2642 if (LuajitSetupStatesPool() != 0) {
2651 int disable_offloading;
2652 if (
ConfGetBool(
"capture.disable-offloading", &disable_offloading) == 0)
2653 disable_offloading = 1;
2654 if (disable_offloading) {
2661 const char *cv = NULL;
2662 if (
ConfGet(
"capture.checksum-validation", &cv) == 1) {
2663 if (strcmp(cv,
"none") == 0) {
2665 }
else if (strcmp(cv,
"all") == 0) {
2672 ConfSet(
"stream.checksum-validation",
"0");
2675 ConfSet(
"stream.checksum-validation",
"1");
2684 #ifdef HAVE_PACKET_EBPF
2686 EBPFRegisterExtension();
2700 SCLogInfo(
"Setting engine mode to IDS mode by default");
2710 const char *custom_umask;
2711 if (
ConfGet(
"umask", &custom_umask) == 1) {
2713 if (
StringParseUint16(&mask, 8, (uint16_t)strlen(custom_umask), custom_umask) > 0) {
2714 umask((mode_t)mask);
2732 SCLogInfo(
"== Carrying out Engine Analysis ==");
2733 const char *temp = NULL;
2734 if (
ConfGet(
"engine-analysis", &temp) == 0) {
2735 SCLogInfo(
"no engine-analysis parameter(s) defined in conf file. "
2736 "Please define/enable them in the conf to use this "
2755 "basic address vars test failed. Please check %s for errors", suri->
conf_filename);
2786 "supplied by %s (default-log-dir) doesn't exist. "
2787 "Shutting down the engine",
2791 if (!IsLogDirectoryWritable(suri->
log_dir)) {
2793 "supplied by %s (default-log-dir) is not writable. "
2794 "Shutting down the engine",
2812 PostConfLoadedSetupHostMode();
2819 static void SuricataMainLoop(
SCInstance *suri)
2880 return EXIT_FAILURE;
2895 SCInstanceInit(&
suricata, argv[0]);
2903 if (WindowsInitService(argc, argv) != 0) {
2916 switch (StartInternalRunMode(&
suricata, argc, argv)) {
2936 int vlan_tracking = 1;
2937 if (
ConfGetBool(
"vlan.use-for-tracking", &vlan_tracking) == 1 && !vlan_tracking) {
2941 SCLogDebug(
"vlan tracking is %s", vlan_tracking == 1 ?
"enabled" :
"disabled");
2954 SCLogInfo(
"Running suricata under test mode");
2981 SCLogNotice(
"Configuration provided was successfully loaded. Exiting.");
3001 int limit_nproc = 0;
3002 if (
ConfGetBool(
"security.limit-noproc", &limit_nproc) == 0) {
3006 #if defined(SC_ADDRESS_SANITIZER)
3009 "\"security.limit-noproc\" (setrlimit()) not set when using address sanitizer");
3015 #if defined(HAVE_SYS_RESOURCE_H)
3018 SCLogWarning(
"setrlimit has no effet when running as root.");
3021 struct rlimit r = { 0, 0 };
3022 if (setrlimit(RLIMIT_NPROC, &r) != 0) {
3023 SCLogWarning(
"setrlimit failed to prevent process creation.");
3044 PostRunStartedDetectSetup(&
suricata);
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
void TmModuleUnixManagerRegister(void)
void StatsReleaseResources(void)
Releases the resources alloted by the Stats API.
uint16_t max_pending_packets
void TmModuleReceiveIPFWRegister(void)
Registration Function for RecieveIPFW.
void SCReferenceConfDeinit(void)
int ExceptionSimulationCommandLineParser(const char *name, const char *arg)
void AppLayerHtpNeedFileInspection(void)
Sets a flag that informs the HTP app layer that some module in the engine needs the http request file...
void SCReferenceConfInit(void)
void IPPairInitConfig(bool quiet)
initialize the configuration
void SCLogInitLogModule(SCLogInitData *sc_lid)
Initializes the logging module.
int LiveDeviceListClean(void)
void DetectEngineDeReference(DetectEngineCtx **de_ctx)
void RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
struct timeval start_time
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
void TmThreadContinueThreads(void)
Unpauses all threads present in tv_root.
void SCThresholdConfGlobalFree(void)
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
enum DetectEngineType type
void DetectEnginePruneFreeList(void)
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
@ SURI_HOST_IS_SNIFFER_ONLY
@ RUNMODE_PRINT_BUILDINFO
DetectEngineCtx * DetectEngineCtxInitStubForDD(void)
void LiveDevRegisterExtension(void)
void AppLayerHtpPrintStats(void)
void StatsSetupPostConfigPreOutput(void)
char * runmode_custom_mode
struct HtpBodyChunk_ * next
void TmModuleReceiveNFQRegister(void)
int LiveBuildDeviceList(const char *runmode)
void RunModeShutDown(void)
void SCProtoNameInit(void)
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
volatile sig_atomic_t sigint_count
SC_ATOMIC_DECLARE(unsigned int, engine_stage)
void SCProfilingRulesGlobalInit(void)
void TmModuleRunDeInit(void)
void RegisterFlowBypassInfo(void)
#define SCSetThreadName(n)
void SCLogDeInitLogModule(void)
De-Initializes the logging module.
void TmModuleDecodeErfFileRegister(void)
Register the ERF file decoder module.
main detection engine ctx
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
void DetectEngineReloadSetIdle(void)
DetectEngineCtx * DetectEngineGetCurrent(void)
int EngineModeIsUnknown(void)
void TmModuleFlowRecyclerRegister(void)
void Daemonize(void)
Daemonize the process.
void UtilSignalHandlerSetup(int sig, void(*handler)(int))
#define TAILQ_FOREACH(var, head, field)
void TmModuleDecodeAFPRegister(void)
Registration Function for DecodeAFP.
void TmModuleDecodeWinDivertRegister(void)
void FlowForceReassembly(void)
Force reassembly for all the flows that have unprocessed segments.
int DetectEngineAddToMaster(DetectEngineCtx *de_ctx)
void TmModuleStatsLoggerRegister(void)
int ConfYamlHandleInclude(ConfNode *parent, const char *filename)
Include a file in the configuration.
void RegisterAllModules(void)
int SCGetUserID(const char *user_name, const char *group_name, uint32_t *uid, uint32_t *gid)
Function to get the user and group ID from the specified user name.
int DetectEngineMultiTenantSetup(const bool unix_socket)
setup multi-detect / multi-tenancy
void SupportFastPatternForSigMatchTypes(void)
Registers the keywords(SMs) that should be given fp support.
void ConfDump(void)
Dump configuration to stdout.
const SuricataContext suricata_context
int CheckValidDaemonModes(int daemon, int mode)
Check for a valid combination daemon/mode.
void SCClassConfDeinit(void)
int ConfSetFinal(const char *name, const char *val)
Set a final configuration value.
void TmThreadDisableReceiveThreads(void)
Disable all threads having the specified TMs.
void StatsInit(void)
Initializes the perf counter api. Things are hard coded currently. More work to be done when we imple...
void PreRunInit(const int runmode)
void MacSetRegisterFlowStorage(void)
const char * conf_filename
void GlobalsInitPreConfig(void)
void TmModuleReceiveNetmapRegister(void)
void PacketPoolPostRunmodes(void)
Set the max_pending_return_packets value.
void NFQInitConfig(bool quiet)
To initialize the NFQ global configuration data.
void TmModuleReceiveWinDivertRegister(void)
void TmModuleReceivePfringRegister(void)
Registration Function for ReceivePfring.
void SCProfilingDestroy(void)
Free resources used by profiling.
bool IsRunModeOffline(enum RunModes run_mode_to_check)
void AFPPeersListClean(void)
Clean the global peers list.
void RunModeInitializeOutputs(void)
int DetectPortTestConfVars(void)
void SCThresholdConfGlobalInit(void)
void DecodeUnregisterCounters(void)
const char * capture_plugin_name
void HostBitInitCtx(void)
const char * capture_plugin_args
void TmModuleLoggerRegister(void)
void TmThreadDisablePacketThreads(void)
Disable all packet threads.
void PacketPoolInit(void)
int AppLayerDeSetup(void)
De initializes the app layer.
size_t strlcpy(char *dst, const char *src, size_t siz)
void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
void FlowDisableFlowRecyclerThread(void)
Used to disable flow recycler thread(s).
int GetIfaceMaxPacketSize(const char *pcap_dev)
output max packet size for a link
void TmModuleDecodePcapFileRegister(void)
void TmModuleBypassedFlowManagerRegister(void)
void IPPairShutdown(void)
shutdown the flow engine
void DetectParseFreeRegexes(void)
void TmModuleDecodeNFLOGRegister(void)
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
int NFQParseAndRegisterQueues(const char *queues)
Parses and adds Netfilter queue(s).
ConfNode * ConfGetRootNode(void)
Get the root configuration node.
void FlowInitConfig(bool quiet)
initialize the configuration
int AppLayerSetup(void)
Setup the app layer.
void FeatureTrackingRegister(void)
void TmModuleReceiveDPDKRegister(void)
void UnixManagerThreadSpawnNonRunmode(const bool unix_socket_enabled)
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
bool IsRunModeSystem(enum RunModes run_mode_to_check)
void TmModuleDecodeNetmapRegister(void)
Registration Function for DecodeNetmap.
void PreRunPostPrivsDropInit(const int runmode)
int DetectEngineMoveToFreeList(DetectEngineCtx *de_ctx)
volatile sig_atomic_t sigterm_count
TmEcode TmThreadWaitOnThreadInit(void)
Used to check if all threads have finished their initialization. On finding an un-initialized thread,...
void TmModuleVerdictNFQRegister(void)
int ConfYamlLoadFile(const char *filename)
Load configuration from a YAML file.
void AppLayerRegisterGlobalCounters(void)
HACK to work around our broken unix manager (re)init loop.
void RunModeListRunmodes(void)
Lists all registered runmodes.
size_t strlcat(char *, const char *src, size_t siz)
@ RUNMODE_LIST_APP_LAYERS
void LiveSetOffloadDisable(void)
void StatsSetupPostConfigPostOutput(void)
void EngineModeSetIDS(void)
void TmModuleReceiveAFPRegister(void)
Registration Function for RecieveAFP.
int LiveBuildDeviceListCustom(const char *runmode, const char *itemname)
void UnixSocketKillSocketThread(void)
void TmModuleVerdictIPFWRegister(void)
Registration Function for VerdictIPFW.
int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, int sig_file_exclusive)
Load signatures.
void HttpRangeContainersInit(void)
struct timeval last_reload
void TmModuleVerdictWinDivertRegister(void)
void HostCleanup(void)
Cleanup the host engine.
void FlowDisableFlowManagerThread(void)
Used to disable flow manager thread(s).
int SuricataMain(int argc, char **argv)
int UtilSignalUnblock(int signum)
int DetectEngineEnabled(void)
Check if detection is enabled.
void TmThreadClearThreadsFamily(int family)
void TmModuleRunInit(void)
void EngineModeSetIPS(void)
void HTPAtExitPrintStats(void)
Print the stats of the HTTP requests.
int UtilSignalBlock(int signum)
void SCProfilingPrefilterGlobalInit(void)
#define SCLogWarning(...)
Macro used to log WARNING messages.
int PostConfLoadedSetup(SCInstance *suri)
const char * GetProgramVersion(void)
get string with program version
int SCGetGroupID(const char *group_name, uint32_t *gid)
Function to get the group ID from the specified group name.
void TmModuleReceivePcapFileRegister(void)
int32_t CoredumpLoadConfig(void)
Configures the core dump size.
int IPFWRegisterQueue(char *queue)
Add an IPFW divert.
int ListAppLayerProtocols(const char *conf_filename)
void DatasetsDestroy(void)
void UtilCpuPrintSummary(void)
Print a summary of CPUs detected (configured and online)
void TmThreadKillThreads(void)
void OutputDeregisterAll(void)
Deregister all modules. Useful for a memory clean exit.
void PostConfLoadedDetectSetup(SCInstance *suri)
int EngineModeIsIDS(void)
void TmModuleNapatechDecodeRegister(void)
Register the Napatech decoder module.
TmModule tmm_modules[TMM_SIZE]
void OutputNotifyFileRotation(void)
Notifies all registered file rotation notification flags.
int StorageFinalize(void)
void TmModuleFlowWorkerRegister(void)
enum RunModes aux_run_mode
const char ** additional_configs
#define DEFAULT_PID_FILENAME
volatile sig_atomic_t sighup_count
TmEcode ConfigSetDataDirectory(char *name)
void TmModuleDecodeErfDagRegister(void)
Register the ERF file decoder module.
#define SCDropMainThreadCaps(...)
void TmModuleDebugList(void)
void TmModuleDecodeNFQRegister(void)
void SCProtoNameRelease(void)
int RunmodeIsUnittests(void)
void SCPluginsLoad(const char *capture_plugin_name, const char *capture_plugin_args)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
void TmModuleReceiveNFLOGRegister(void)
#define DEFAULT_PACKET_SIZE
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
void TmModuleReceiveErfFileRegister(void)
Register the ERF file receiver (reader) module.
#define SCRealloc(ptr, sz)
void TmModuleDecodeAFXDPRegister(void)
Registration Function for DecodeAFXDP.
uint32_t default_packet_size
void SigTableApplyStrictCommandLineOption(const char *str)
@ DETECT_ENGINE_TYPE_NORMAL
void TmThreadKillThreadsFamily(int family)
void FeatureTrackingRelease(void)
void TmqhCleanup(void)
Clean up registration time allocs.
void StreamTcpFreeConfig(bool quiet)
void DecodeGlobalConfig(void)
char * strict_rule_parsing_string
DetectEngineCtx * DetectEngineCtxInitStubForMT(void)
const char * LiveGetDeviceName(int number)
Get a pointer to the device name at idx.
void FlowShutdown(void)
shutdown the flow engine
void SCHInfoLoadFromConfig(void)
Load the host os policy information from the configuration.
void DetectEngineBumpVersion(void)
void TmModuleFlowManagerRegister(void)
int SCPidfileTestRunning(const char *pid_filename)
Check the Suricata pid file (used at the startup)
void HostShutdown(void)
shutdown the flow engine
void TmModuleDecodePfringRegister(void)
Registration Function for DecodePfring.
void LiveSetOffloadWarn(void)
void ParseSizeDeinit(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
int ConfGetChildValueBool(const ConfNode *base, const char *name, int *val)
void SCProfilingDump(void)
void TmModuleReceiveAFXDPRegister(void)
void EngineStop(void)
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be a...
void FrameConfigInit(void)
int ParseSizeStringU32(const char *size, uint32_t *res)
void TmModuleReceiveErfDagRegister(void)
Register the ERF file receiver (reader) module.
void IPPairBitInitCtx(void)
void SCClassConfInit(void)
int RunmodeGetCurrent(void)
TmEcode ConfigSetLogDirectory(const char *name)
void TmModuleDecodeIPFWRegister(void)
Registration Function for DecodeIPFW.
int ConfUnixSocketIsEnable(void)
int ConfSetFromString(const char *input, int final)
Set a configuration parameter from a string.
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
void ConfInit(void)
Initialize the configuration system.
const char * ConfigGetLogDirectory(void)
volatile sig_atomic_t sigusr2_count
@ RUNMODE_ENGINE_ANALYSIS
void TmModuleDecodePcapRegister(void)
Registration Function for DecodePcap.
TmEcode ConfigCheckDataDirectory(const char *data_dir)
#define SCLogError(...)
Macro used to log ERROR messages.
int DetectEngineReloadStart(void)
#define DEFAULT_CONF_FILE
#define SC_LOG_MAX_LOG_MSG_LEN
void AppLayerParserPostStreamSetup(void)
void TmModuleReceivePcapRegister(void)
Registration Function for ReceivePcap.
void TmModuleRespondRejectRegister(void)
void CoredumpEnable(void)
Enable coredumps on systems where coredumps can and need to be enabled.
void RunUnittests(int list_unittests, const char *regex_arg)
TmEcode ConfigCheckLogDirectoryExists(const char *log_dir)
void PacketAlertTagInit(void)
DetectEngineCtx * DetectEngineCtxInit(void)
int EngineModeIsIPS(void)
void TmModuleNapatechStreamRegister(void)
Register the Napatech receiver (reader) module.
void SCProfilingKeywordsGlobalInit(void)
void EngineDone(void)
Used to indicate that the current task is done.
const char * GetDocURL(void)
int profiling_rules_enabled
void PostRunDeinit(const int runmode, struct timeval *start_time)
void HostInitConfig(bool quiet)
initialize the configuration
TmEcode TmThreadWaitOnThreadRunning(void)
Waits for all threads to be in a running state.
void ConfDeInit(void)
De-initializes the configuration system.
void HttpRangeContainersDestroy(void)
int ConfSet(const char *name, const char *val)
Set a configuration value.
void SCLogLoadConfig(int daemon, int verbose, uint32_t userid, uint32_t groupid)
int DetectEngineReload(const SCInstance *suri)
Reload the detection engine.
#define DEFAULT_MAX_PENDING_PACKETS
void SetMasterExceptionPolicy(void)
void TmThreadCheckThreadState(void)
Used to check the thread for certain conditions of failure.
void OutputFilestoreRegisterGlobalCounters(void)
int InitGlobal(void)
Global initialization common to all runmodes.
int LiveGetDeviceCount(void)
Get the number of registered devices.
void SCProfilingSghsGlobalInit(void)
int SCPidfileCreate(const char *pidfile)
Write a pid file (used at the startup) This commonly needed by the init scripts.
int LiveRegisterDeviceName(const char *dev)
Add a device for monitoring.
void LiveDeviceFinalize(void)
void TmModuleDecodeDPDKRegister(void)
Registration Function for DecodeDPDK.
void PacketPoolDestroy(void)
void HTPFreeConfig(void)
Clears the HTTP server configuration memory used by HTP library.
void LandlockSandboxing(SCInstance *suri)
int ListKeywords(const char *keyword_info)
#define SCLogNotice(...)
Macro used to log NOTICE messages.
void DPDKCleanupEAL(void)
void SCPidfileRemove(const char *pid_filename)
Remove the pid file (used at the startup)
void NFQContextsClean(void)
Clean global contexts. Must be called on exit.
#define DEBUG_VALIDATE_BUG_ON(exp)
void SCProfilingInit(void)
Initialize profiling.
int DetectEngineReloadIsStart(void)
volatile uint8_t suricata_ctl_flags
void TagDestroyCtx(void)
Destroy tag context hash tables.
int DetectAddressTestConfVars(void)
int GetIfaceMTU(const char *pcap_dev)
output the link MTU
void MpmHSGlobalCleanup(void)
void TmqResetQueues(void)