suricata
suricata.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "suricata-common.h"
25 
26 #if HAVE_GETOPT_H
27 #include <getopt.h>
28 #endif
29 
30 #if HAVE_SIGNAL_H
31 #include <signal.h>
32 #endif
33 #ifndef OS_WIN32
34 #ifdef HAVE_SYS_RESOURCE_H
35 // setrlimit
36 #include <sys/resource.h>
37 #endif
38 #endif
39 
40 #include "suricata.h"
41 
42 #include "conf.h"
43 #include "conf-yaml-loader.h"
44 
45 #include "decode.h"
46 #include "defrag.h"
47 #include "flow.h"
48 #include "stream-tcp.h"
49 #include "ippair.h"
50 
51 #include "detect.h"
52 #include "detect-parse.h"
53 #include "detect-engine.h"
54 #include "detect-engine-address.h"
55 #include "detect-engine-alert.h"
56 #include "detect-engine-port.h"
57 #include "detect-engine-tag.h"
59 #include "detect-fast-pattern.h"
60 
61 #include "datasets.h"
62 
63 #include "feature.h"
64 
65 #include "flow-bypass.h"
66 #include "flow-manager.h"
67 #include "flow-timeout.h"
68 #include "flow-worker.h"
69 
70 #include "flow-bit.h"
71 #include "host-bit.h"
72 #include "ippair-bit.h"
73 
74 #include "app-layer.h"
75 #include "app-layer-parser.h"
76 #include "app-layer-htp.h"
77 #include "app-layer-htp-range.h"
78 
79 #include "output.h"
80 #include "output-filestore.h"
81 
82 #include "respond-reject.h"
83 
84 #include "runmode-af-packet.h"
85 #include "runmode-af-xdp.h"
86 #include "runmode-netmap.h"
87 #include "runmode-unittests.h"
88 
89 #include "source-nfq.h"
90 #include "source-nfq-prototypes.h"
91 #include "source-nflog.h"
92 #include "source-ipfw.h"
93 #include "source-pcap.h"
94 #include "source-pcap-file.h"
96 #include "source-pfring.h"
97 #include "source-erf-file.h"
98 #include "source-erf-dag.h"
99 #include "source-napatech.h"
100 #include "source-af-packet.h"
101 #include "source-af-xdp.h"
102 #include "source-netmap.h"
103 #include "source-dpdk.h"
104 #include "source-windivert.h"
106 
107 #include "unix-manager.h"
108 
110 #include "util-threshold-config.h"
111 #include "util-reference-config.h"
112 
113 #include "tmqh-packetpool.h"
114 #include "tm-queuehandlers.h"
115 
116 #include "util-byte.h"
117 #include "util-conf.h"
118 #include "util-coredump-config.h"
119 #include "util-cpu.h"
120 #include "util-daemon.h"
121 #include "util-device.h"
122 #include "util-dpdk.h"
123 #include "util-ebpf.h"
124 #include "util-exception-policy.h"
125 #include "util-host-os-info.h"
126 #include "util-hugepages.h"
127 #include "util-ioctl.h"
128 #include "util-landlock.h"
129 #include "util-macset.h"
130 #include "util-misc.h"
131 #include "util-mpm-hs.h"
132 #include "util-path.h"
133 #include "util-pidfile.h"
134 #include "util-plugin.h"
135 #include "util-privs.h"
136 #include "util-profiling.h"
137 #include "util-proto-name.h"
138 #include "util-running-modes.h"
139 #include "util-signal.h"
140 #include "util-time.h"
141 #include "util-validate.h"
142 #include "util-var-name.h"
143 #ifdef SYSTEMD_NOTIFY
144 #include "util-systemd.h"
145 #endif
146 
147 #ifdef WINDIVERT
148 #include "decode-sll.h"
149 #include "win32-syscall.h"
150 #endif
151 
152 /*
153  * we put this here, because we only use it here in main.
154  */
155 volatile sig_atomic_t sigint_count = 0;
156 volatile sig_atomic_t sighup_count = 0;
157 volatile sig_atomic_t sigterm_count = 0;
158 volatile sig_atomic_t sigusr2_count = 0;
159 
160 /*
161  * Flag to indicate if the engine is at the initialization
162  * or already processing packets. 3 stages: SURICATA_INIT,
163  * SURICATA_RUNTIME and SURICATA_FINALIZE
164  */
165 SC_ATOMIC_DECLARE(unsigned int, engine_stage);
166 
167 /* Max packets processed simultaneously per thread. */
168 #define DEFAULT_MAX_PENDING_PACKETS 1024
169 
170 /** suricata engine control flags */
171 volatile uint8_t suricata_ctl_flags = 0;
172 
173 /** Engine mode: inline (ENGINE_MODE_IPS) or just
174  * detection mode (ENGINE_MODE_IDS by default) */
175 static enum EngineMode g_engine_mode = ENGINE_MODE_UNKNOWN;
176 
177 /** Host mode: set if box is sniffing only
178  * or is a router */
180 
181 /** Maximum packets to simultaneously process. */
183 
184 /** global indicating if detection is enabled */
186 
187 /** set caps or not */
188 bool sc_set_caps = false;
189 
190 bool g_system = false;
191 
192 /** disable randomness to get reproducible results across runs */
193 #ifndef AFLFUZZ_NO_RANDOM
195 #else
196 int g_disable_randomness = 1;
197 #endif
198 
199 /** determine (without branching) if we include the vlan_ids when hashing or
200  * comparing flows */
201 uint16_t g_vlan_mask = 0xffff;
202 
203 /** determine (without branching) if we include the livedev ids when hashing or
204  * comparing flows */
205 uint16_t g_livedev_mask = 0xffff;
206 
207 /* flag to disable hashing almost globally, to be similar to disabling nss
208  * support */
209 bool g_disable_hashing = false;
210 
211 /* snapshot of the system's hugepages before system intitialization. */
213 
214 /** add per-proto app-layer error counters for exception policies stats? disabled by default */
216 
217 /** Suricata instance */
219 
220 int SuriHasSigFile(void)
221 {
222  return (suricata.sig_file != NULL);
223 }
224 
226 {
227  return (g_engine_mode == ENGINE_MODE_UNKNOWN);
228 }
229 
231 {
232  DEBUG_VALIDATE_BUG_ON(g_engine_mode == ENGINE_MODE_UNKNOWN);
233  return (g_engine_mode == ENGINE_MODE_IPS);
234 }
235 
237 {
238  DEBUG_VALIDATE_BUG_ON(g_engine_mode == ENGINE_MODE_UNKNOWN);
239  return (g_engine_mode == ENGINE_MODE_IDS);
240 }
241 
243 {
244  g_engine_mode = ENGINE_MODE_IPS;
245 }
246 
248 {
249  g_engine_mode = ENGINE_MODE_IDS;
250 }
251 
252 #ifdef UNITTESTS
254 {
256  return 1;
257 
258  return 0;
259 }
260 #endif
261 
262 int SCRunmodeGet(void)
263 {
264  return suricata.run_mode;
265 }
266 
267 void SCRunmodeSet(int run_mode)
268 {
269  suricata.run_mode = run_mode;
270 }
271 
272 /** signal handlers
273  *
274  * WARNING: don't use the SCLog* API in the handlers. The API is complex
275  * with memory allocation possibly happening, calls to syslog, json message
276  * construction, etc.
277  */
278 
279 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
280 static void SignalHandlerSigint(/*@unused@*/ int sig)
281 {
282  sigint_count = 1;
283 }
284 static void SignalHandlerSigterm(/*@unused@*/ int sig)
285 {
286  sigterm_count = 1;
287 }
288 #ifndef OS_WIN32
289 #if HAVE_LIBUNWIND
290 #define UNW_LOCAL_ONLY
291 #include <libunwind.h>
292 static void SignalHandlerUnexpected(int sig_num, siginfo_t *info, void *context)
293 {
295  unw_cursor_t cursor;
296  /* Restore defaults for signals to avoid loops */
297  signal(SIGABRT, SIG_DFL);
298  signal(SIGSEGV, SIG_DFL);
299  int r;
300  if ((r = unw_init_local(&cursor, (unw_context_t *)(context)) != 0)) {
301  SCLogError("unable to obtain stack trace: unw_init_local: %s", unw_strerror(r));
302  goto terminate;
303  }
304 
305  char *temp = msg;
306  int cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - msg), "stacktrace:sig %d:", sig_num);
307  temp += cw;
308  r = 1;
309  while (r > 0) {
310  if (unw_is_signal_frame(&cursor) == 0) {
311  unw_word_t off;
312  char name[256];
313  if (unw_get_proc_name(&cursor, name, sizeof(name), &off) == UNW_ENOMEM) {
314  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - msg), "[unknown]:");
315  } else {
316  cw = snprintf(
317  temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - msg), "%s+0x%08" PRIx64, name, off);
318  }
319  temp += cw;
320  }
321 
322  r = unw_step(&cursor);
323  if (r > 0) {
324  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - msg), ";");
325  temp += cw;
326  }
327  }
328  SCLogError("%s", msg);
329 
330 terminate:
331  // Propagate signal to watchers, if any
332  kill(getpid(), sig_num);
333 }
334 #undef UNW_LOCAL_ONLY
335 #endif /* HAVE_LIBUNWIND */
336 #endif /* !OS_WIN32 */
337 #endif
338 
339 #ifndef OS_WIN32
340 /**
341  * SIGUSR2 handler. Just set sigusr2_count. The main loop will act on
342  * it.
343  */
344 static void SignalHandlerSigusr2(int sig)
345 {
346  if (sigusr2_count < 2)
347  sigusr2_count++;
348 }
349 
350 /**
351  * SIGHUP handler. Just set sighup_count. The main loop will act on
352  * it.
353  */
354 static void SignalHandlerSigHup(/*@unused@*/ int sig)
355 {
356  sighup_count = 1;
357 }
358 #endif
359 
361 {
362  TimeInit();
365  SCProtoNameInit();
366  FrameConfigInit();
367 }
368 
369 void GlobalsDestroy(void)
370 {
371  SCInstance *suri = &suricata;
372  HostShutdown();
373  HTPFreeConfig();
375 
377 
378  /* TODO this can do into it's own func */
380  if (de_ctx) {
383  }
385 
386  AppLayerDeSetup();
387  DatasetsSave();
388  DatasetsDestroy();
389  TagDestroyCtx();
390 
395  TimeDeinit();
396  SigTableCleanup();
397  TmqhCleanup();
399  ParseSizeDeinit();
400 
401 #ifdef HAVE_DPDK
402  DPDKCleanupEAL();
403 #endif
404 
405 #ifdef HAVE_AF_PACKET
407 #endif
408 
409 #ifdef NFQ
411 #endif
412 
413 #ifdef BUILD_HYPERSCAN
415 #endif
416 
417  ConfDeInit();
418 
420 
422  SCFree(suri->pid_filename);
423  suri->pid_filename = NULL;
424 
427 }
428 
429 /**
430  * \brief Used to send OS specific notification of running threads
431  *
432  * \retval TmEcode TM_ECODE_OK on success; TM_ECODE_FAILED on failure.
433  */
434 static void OnNotifyRunning(void)
435 {
436 #ifdef SYSTEMD_NOTIFY
437  if (SystemDNotifyReady() < 0) {
438  SCLogWarning("failed to notify systemd");
439  }
440 #endif
441 }
442 
443 /** \brief make sure threads can stop the engine by calling this
444  * function. Purpose: pcap file mode needs to be able to tell the
445  * engine the file eof is reached. */
446 void EngineStop(void)
447 {
449 }
450 
451 /**
452  * \brief Used to indicate that the current task is done.
453  *
454  * This is mainly used by pcap-file to tell it has finished
455  * to treat a pcap files when running in unix-socket mode.
456  */
457 void EngineDone(void)
458 {
460 }
461 
462 static int SetBpfString(int argc, char *argv[])
463 {
464  char *bpf_filter = NULL;
465  uint32_t bpf_len = 0;
466  int tmpindex = 0;
467 
468  /* attempt to parse remaining args as bpf filter */
469  tmpindex = argc;
470  while(argv[tmpindex] != NULL) {
471  bpf_len+=strlen(argv[tmpindex]) + 1;
472  tmpindex++;
473  }
474 
475  if (bpf_len == 0)
476  return TM_ECODE_OK;
477 
478  bpf_filter = SCCalloc(1, bpf_len);
479  if (unlikely(bpf_filter == NULL))
480  return TM_ECODE_FAILED;
481 
482  tmpindex = optind;
483  while(argv[tmpindex] != NULL) {
484  strlcat(bpf_filter, argv[tmpindex],bpf_len);
485  if(argv[tmpindex + 1] != NULL) {
486  strlcat(bpf_filter," ", bpf_len);
487  }
488  tmpindex++;
489  }
490 
491  if(strlen(bpf_filter) > 0) {
492  if (ConfSetFinal("bpf-filter", bpf_filter) != 1) {
493  SCLogError("Failed to set bpf filter.");
494  SCFree(bpf_filter);
495  return TM_ECODE_FAILED;
496  }
497  }
498  SCFree(bpf_filter);
499 
500  return TM_ECODE_OK;
501 }
502 
503 static void SetBpfStringFromFile(char *filename)
504 {
505  char *bpf_filter = NULL;
506  char *bpf_comment_tmp = NULL;
507  char *bpf_comment_start = NULL;
508  uint32_t bpf_len = 0;
509  SCStat st;
510  FILE *fp = NULL;
511  size_t nm = 0;
512 
513  fp = fopen(filename, "r");
514  if (fp == NULL) {
515  SCLogError("Failed to open file %s", filename);
516  exit(EXIT_FAILURE);
517  }
518 
519  if (SCFstatFn(fileno(fp), &st) != 0) {
520  SCLogError("Failed to stat file %s", filename);
521  exit(EXIT_FAILURE);
522  }
523  bpf_len = st.st_size + 1;
524 
525  bpf_filter = SCCalloc(1, bpf_len);
526  if (unlikely(bpf_filter == NULL)) {
527  SCLogError("Failed to allocate buffer for bpf filter in file %s", filename);
528  exit(EXIT_FAILURE);
529  }
530 
531  nm = fread(bpf_filter, 1, bpf_len - 1, fp);
532  if ((ferror(fp) != 0) || (nm != (bpf_len - 1))) {
533  SCLogError("Failed to read complete BPF file %s", filename);
534  SCFree(bpf_filter);
535  fclose(fp);
536  exit(EXIT_FAILURE);
537  }
538  fclose(fp);
539  bpf_filter[nm] = '\0';
540 
541  if(strlen(bpf_filter) > 0) {
542  /*replace comments with space*/
543  bpf_comment_start = bpf_filter;
544  while((bpf_comment_tmp = strchr(bpf_comment_start, '#')) != NULL) {
545  while((*bpf_comment_tmp !='\0') &&
546  (*bpf_comment_tmp != '\r') && (*bpf_comment_tmp != '\n'))
547  {
548  *bpf_comment_tmp++ = ' ';
549  }
550  bpf_comment_start = bpf_comment_tmp;
551  }
552  /*remove remaining '\r' and '\n' */
553  while((bpf_comment_tmp = strchr(bpf_filter, '\r')) != NULL) {
554  *bpf_comment_tmp = ' ';
555  }
556  while((bpf_comment_tmp = strchr(bpf_filter, '\n')) != NULL) {
557  *bpf_comment_tmp = ' ';
558  }
559  /* cut trailing spaces */
560  while (strlen(bpf_filter) > 0 &&
561  bpf_filter[strlen(bpf_filter)-1] == ' ')
562  {
563  bpf_filter[strlen(bpf_filter)-1] = '\0';
564  }
565  if (strlen(bpf_filter) > 0) {
566  if (ConfSetFinal("bpf-filter", bpf_filter) != 1) {
567  SCFree(bpf_filter);
568  FatalError("failed to set bpf filter");
569  }
570  }
571  }
572  SCFree(bpf_filter);
573 }
574 
575 static void PrintUsage(const char *progname)
576 {
577 #ifdef REVISION
578  printf("%s %s (%s)\n", PROG_NAME, PROG_VER, xstr(REVISION));
579 #else
580  printf("%s %s\n", PROG_NAME, PROG_VER);
581 #endif
582  printf("USAGE: %s [OPTIONS] [BPF FILTER]\n\n", progname);
583  printf("\t-c <path> : path to configuration file\n");
584  printf("\t-T : test configuration file (use with -c)\n");
585  printf("\t-i <dev or ip> : run in pcap live mode\n");
586  printf("\t-F <bpf filter file> : bpf filter file\n");
587  printf("\t-r <path> : run in pcap file/offline mode\n");
588 #ifdef NFQ
589  printf("\t-q <qid[:qid]> : run in inline nfqueue mode (use colon to specify a range of queues)\n");
590 #endif /* NFQ */
591 #ifdef IPFW
592  printf("\t-d <divert port> : run in inline ipfw divert mode\n");
593 #endif /* IPFW */
594  printf("\t-s <path> : path to signature file loaded in addition to suricata.yaml settings (optional)\n");
595  printf("\t-S <path> : path to signature file loaded exclusively (optional)\n");
596  printf("\t-l <dir> : default log directory\n");
597 #ifndef OS_WIN32
598  printf("\t-D : run as daemon\n");
599 #else
600  printf("\t--service-install : install as service\n");
601  printf("\t--service-remove : remove service\n");
602  printf("\t--service-change-params : change service startup parameters\n");
603 #endif /* OS_WIN32 */
604  printf("\t-k [all|none] : force checksum check (all) or disabled it (none)\n");
605  printf("\t-V : display Suricata version\n");
606  printf("\t-v : be more verbose (use multiple times to increase verbosity)\n");
607 #ifdef UNITTESTS
608  printf("\t-u : run the unittests and exit\n");
609  printf("\t-U, --unittest-filter=REGEX : filter unittests with a regex\n");
610  printf("\t--list-unittests : list unit tests\n");
611  printf("\t--fatal-unittests : enable fatal failure on unittest error\n");
612  printf("\t--unittests-coverage : display unittest coverage report\n");
613 #endif /* UNITTESTS */
614  printf("\t--list-app-layer-protos : list supported app layer protocols\n");
615  printf("\t--list-keywords[=all|csv|<kword>] : list keywords implemented by the engine\n");
616  printf("\t--list-runmodes : list supported runmodes\n");
617  printf("\t--runmode <runmode_id> : specific runmode modification the engine should run. The argument\n"
618  "\t supplied should be the id for the runmode obtained by running\n"
619  "\t --list-runmodes\n");
620  printf("\t--engine-analysis : print reports on analysis of different sections in the engine and exit.\n"
621  "\t Please have a look at the conf parameter engine-analysis on what reports\n"
622  "\t can be printed\n");
623  printf("\t--pidfile <file> : write pid to this file\n");
624  printf("\t--init-errors-fatal : enable fatal failure on signature init error\n");
625  printf("\t--disable-detection : disable detection engine\n");
626  printf("\t--dump-config : show the running configuration\n");
627  printf("\t--dump-features : display provided features\n");
628  printf("\t--build-info : display build information\n");
629  printf("\t--pcap[=<dev>] : run in pcap mode, no value select interfaces from suricata.yaml\n");
630  printf("\t--pcap-file-continuous : when running in pcap mode with a directory, continue checking directory for pcaps until interrupted\n");
631  printf("\t--pcap-file-delete : when running in replay mode (-r with directory or file), will delete pcap files that have been processed when done\n");
632  printf("\t--pcap-file-recursive : will descend into subdirectories when running in replay mode (-r)\n");
633 #ifdef HAVE_PCAP_SET_BUFF
634  printf("\t--pcap-buffer-size : size of the pcap buffer value from 0 - %i\n",INT_MAX);
635 #endif /* HAVE_SET_PCAP_BUFF */
636 #ifdef HAVE_DPDK
637  printf("\t--dpdk : run in dpdk mode, uses interfaces from "
638  "suricata.yaml\n");
639 #endif
640 #ifdef HAVE_AF_PACKET
641  printf("\t--af-packet[=<dev>] : run in af-packet mode, no value select interfaces from suricata.yaml\n");
642 #endif
643 #ifdef HAVE_AF_XDP
644  printf("\t--af-xdp[=<dev>] : run in af-xdp mode, no value select "
645  "interfaces from suricata.yaml\n");
646 #endif
647 #ifdef HAVE_NETMAP
648  printf("\t--netmap[=<dev>] : run in netmap mode, no value select interfaces from suricata.yaml\n");
649 #endif
650 #ifdef HAVE_PFRING
651  printf("\t--pfring[=<dev>] : run in pfring mode, use interfaces from suricata.yaml\n");
652  printf("\t--pfring-int <dev> : run in pfring mode, use interface <dev>\n");
653  printf("\t--pfring-cluster-id <id> : pfring cluster id \n");
654  printf("\t--pfring-cluster-type <type> : pfring cluster type for PF_RING 4.1.2 and later cluster_round_robin|cluster_flow\n");
655 #endif /* HAVE_PFRING */
656  printf("\t--simulate-ips : force engine into IPS mode. Useful for QA\n");
657 #ifdef HAVE_LIBCAP_NG
658  printf("\t--user <user> : run suricata as this user after init\n");
659  printf("\t--group <group> : run suricata as this group after init\n");
660 #endif /* HAVE_LIBCAP_NG */
661  printf("\t--erf-in <path> : process an ERF file\n");
662 #ifdef HAVE_DAG
663  printf("\t--dag <dagX:Y> : process ERF records from DAG interface X, stream Y\n");
664 #endif
665 #ifdef HAVE_NAPATECH
666  printf("\t--napatech : run Napatech Streams using the API\n");
667 #endif
668 #ifdef BUILD_UNIX_SOCKET
669  printf("\t--unix-socket[=<file>] : use unix socket to control suricata work\n");
670 #endif
671 #ifdef WINDIVERT
672  printf("\t--windivert <filter> : run in inline WinDivert mode\n");
673  printf("\t--windivert-forward <filter> : run in inline WinDivert mode, as a gateway\n");
674 #endif
675 #ifdef HAVE_LIBNET11
676  printf("\t--reject-dev <dev> : send reject packets from this interface\n");
677 #endif
678  printf("\t--include <path> : additional configuration file\n");
679  printf("\t--set name=value : set a configuration value\n");
680  printf("\n");
681  printf("\nTo run the engine with default configuration on "
682  "interface eth0 with signature file \"signatures.rules\", run the "
683  "command as:\n\n%s -c suricata.yaml -s signatures.rules -i eth0 \n\n",
684  progname);
685 }
686 
687 static void PrintBuildInfo(void)
688 {
689  const char *bits;
690  const char *endian;
691  char features[2048] = "";
692  const char *tls;
693 
694  printf("This is %s version %s\n", PROG_NAME, GetProgramVersion());
695 #ifdef DEBUG
696  strlcat(features, "DEBUG ", sizeof(features));
697 #endif
698 #ifdef DEBUG_VALIDATION
699  strlcat(features, "DEBUG_VALIDATION ", sizeof(features));
700 #endif
701 #ifdef UNITTESTS
702  strlcat(features, "UNITTESTS ", sizeof(features));
703 #endif
704 #ifdef NFQ
705  strlcat(features, "NFQ ", sizeof(features));
706 #endif
707 #ifdef IPFW
708  strlcat(features, "IPFW ", sizeof(features));
709 #endif
710 #ifdef HAVE_PCAP_SET_BUFF
711  strlcat(features, "PCAP_SET_BUFF ", sizeof(features));
712 #endif
713 #ifdef HAVE_PFRING
714  strlcat(features, "PF_RING ", sizeof(features));
715 #endif
716 #ifdef HAVE_AF_PACKET
717  strlcat(features, "AF_PACKET ", sizeof(features));
718 #endif
719 #ifdef HAVE_NETMAP
720  strlcat(features, "NETMAP ", sizeof(features));
721 #endif
722 #ifdef HAVE_PACKET_FANOUT
723  strlcat(features, "HAVE_PACKET_FANOUT ", sizeof(features));
724 #endif
725 #ifdef HAVE_DAG
726  strlcat(features, "DAG ", sizeof(features));
727 #endif
728 #ifdef HAVE_LIBCAP_NG
729  strlcat(features, "LIBCAP_NG ", sizeof(features));
730 #endif
731 #ifdef HAVE_LIBNET11
732  strlcat(features, "LIBNET1.1 ", sizeof(features));
733 #endif
734 #ifdef HAVE_HTP_URI_NORMALIZE_HOOK
735  strlcat(features, "HAVE_HTP_URI_NORMALIZE_HOOK ", sizeof(features));
736 #endif
737 #ifdef PCRE2_HAVE_JIT
738  strlcat(features, "PCRE_JIT ", sizeof(features));
739 #endif
740  /* For compatibility, just say we have HAVE_NSS. */
741  strlcat(features, "HAVE_NSS ", sizeof(features));
742  /* HTTP2_DECOMPRESSION is not an optional feature in this major version */
743  strlcat(features, "HTTP2_DECOMPRESSION ", sizeof(features));
744  /* Lua is now vendored in and always available. */
745  strlcat(features, "HAVE_LUA ", sizeof(features));
746 #ifdef HAVE_JA3
747  strlcat(features, "HAVE_JA3 ", sizeof(features));
748 #endif
749 #ifdef HAVE_JA4
750  strlcat(features, "HAVE_JA4 ", sizeof(features));
751 #endif
752  strlcat(features, "HAVE_LIBJANSSON ", sizeof(features));
753 #ifdef PROFILING
754  strlcat(features, "PROFILING ", sizeof(features));
755 #endif
756 #ifdef PROFILE_LOCKING
757  strlcat(features, "PROFILE_LOCKING ", sizeof(features));
758 #endif
759 #if defined(TLS_C11) || defined(TLS_GNU)
760  strlcat(features, "TLS ", sizeof(features));
761 #endif
762 #if defined(TLS_C11)
763  strlcat(features, "TLS_C11 ", sizeof(features));
764 #elif defined(TLS_GNU)
765  strlcat(features, "TLS_GNU ", sizeof(features));
766 #endif
767 #ifdef HAVE_MAGIC
768  strlcat(features, "MAGIC ", sizeof(features));
769 #endif
770  strlcat(features, "RUST ", sizeof(features));
771 #if defined(SC_ADDRESS_SANITIZER)
772  strlcat(features, "ASAN ", sizeof(features));
773 #endif
774 #if defined(HAVE_POPCNT64)
775  strlcat(features, "POPCNT64 ", sizeof(features));
776 #endif
777  if (strlen(features) == 0) {
778  strlcat(features, "none", sizeof(features));
779  }
780 
781  printf("Features: %s\n", features);
782 
783  /* SIMD stuff */
784  memset(features, 0x00, sizeof(features));
785 #if defined(__SSE4_2__)
786  strlcat(features, "SSE_4_2 ", sizeof(features));
787 #endif
788 #if defined(__SSE4_1__)
789  strlcat(features, "SSE_4_1 ", sizeof(features));
790 #endif
791 #if defined(__SSE3__)
792  strlcat(features, "SSE_3 ", sizeof(features));
793 #endif
794 #if defined(__SSE2__)
795  strlcat(features, "SSE_2 ", sizeof(features));
796 #endif
797  if (strlen(features) == 0) {
798  strlcat(features, "none", sizeof(features));
799  }
800  printf("SIMD support: %s\n", features);
801 
802  /* atomics stuff */
803  memset(features, 0x00, sizeof(features));
804 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_1)
805  strlcat(features, "1 ", sizeof(features));
806 #endif
807 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_2)
808  strlcat(features, "2 ", sizeof(features));
809 #endif
810 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_4)
811  strlcat(features, "4 ", sizeof(features));
812 #endif
813 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_8)
814  strlcat(features, "8 ", sizeof(features));
815 #endif
816 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_16)
817  strlcat(features, "16 ", sizeof(features));
818 #endif
819  if (strlen(features) == 0) {
820  strlcat(features, "none", sizeof(features));
821  } else {
822  strlcat(features, "byte(s)", sizeof(features));
823  }
824  printf("Atomic intrinsics: %s\n", features);
825 
826 #if __WORDSIZE == 64
827  bits = "64-bits";
828 #elif __WORDSIZE == 32
829  bits = "32-bits";
830 #else
831  bits = "<unknown>-bits";
832 #endif
833 
834 #if __BYTE_ORDER == __BIG_ENDIAN
835  endian = "Big-endian";
836 #elif __BYTE_ORDER == __LITTLE_ENDIAN
837  endian = "Little-endian";
838 #else
839  endian = "<unknown>-endian";
840 #endif
841 
842  printf("%s, %s architecture\n", bits, endian);
843 #ifdef __GNUC__
844  printf("GCC version %s, C version %"PRIiMAX"\n", __VERSION__, (intmax_t)__STDC_VERSION__);
845 #else
846  printf("C version %"PRIiMAX"\n", (intmax_t)__STDC_VERSION__);
847 #endif
848 
849 #if __SSP__ == 1
850  printf("compiled with -fstack-protector\n");
851 #endif
852 #if __SSP_ALL__ == 2
853  printf("compiled with -fstack-protector-all\n");
854 #endif
855 /*
856  * Workaround for special defines of _FORTIFY_SOURCE like
857  * FORTIFY_SOURCE=((defined __OPTIMIZE && OPTIMIZE > 0) ? 2 : 0)
858  * which is used by Gentoo for example and would result in the error
859  * 'defined' undeclared when _FORTIFY_SOURCE used via %d in printf func
860  *
861  */
862 #if _FORTIFY_SOURCE == 2
863  printf("compiled with _FORTIFY_SOURCE=2\n");
864 #elif _FORTIFY_SOURCE == 1
865  printf("compiled with _FORTIFY_SOURCE=1\n");
866 #elif _FORTIFY_SOURCE == 0
867  printf("compiled with _FORTIFY_SOURCE=0\n");
868 #endif
869 #ifdef CLS
870  printf("L1 cache line size (CLS)=%d\n", CLS);
871 #endif
872 #if defined(TLS_C11)
873  tls = "_Thread_local";
874 #elif defined(TLS_GNU)
875  tls = "__thread";
876 #else
877 #error "Unsupported thread local"
878 #endif
879  printf("thread local storage method: %s\n", tls);
880 
881  printf("compiled with %s, linked against %s\n",
882  HTP_VERSION_STRING_FULL, htp_get_version());
883  printf("\n");
884 #include "build-info.h"
885 }
886 
890 
892 {
893  /* commanders */
895  /* managers */
899  /* nfq */
903  /* ipfw */
907  /* pcap live */
910  /* pcap file */
913  /* af-packet */
916  /* af-xdp */
919  /* netmap */
922  /* pfring */
925  /* dag file */
928  /* dag live */
931  /* napatech */
934 
935  /* flow worker */
937  /* respond-reject */
939 
940  /* log api */
943 
945  /* nflog */
948 
949  /* windivert */
953 
954  /* Dpdk */
957 }
958 
960 {
961  SCEnter();
962 
963  SCInstance *suri = &suricata;
964 
965  if (suri->conf_filename == NULL)
967 
968  if (ConfYamlLoadFile(suri->conf_filename) != 0) {
969  /* Error already displayed. */
971  }
972 
973  if (suri->additional_configs) {
974  for (int i = 0; suri->additional_configs[i] != NULL; i++) {
975  SCLogConfig("Loading additional configuration file %s", suri->additional_configs[i]);
977  }
978  }
979 
981 }
982 
983 static TmEcode ParseInterfacesList(const int runmode, char *pcap_dev)
984 {
985  SCEnter();
986 
987  /* run the selected runmode */
988  if (runmode == RUNMODE_PCAP_DEV) {
989  if (strlen(pcap_dev) == 0) {
990  int ret = LiveBuildDeviceList("pcap");
991  if (ret == 0) {
992  SCLogError("No interface found in config for pcap");
994  }
995  }
996  } else if (runmode == RUNMODE_PFRING) {
997  /* FIXME add backward compat support */
998  /* iface has been set on command line */
999  if (strlen(pcap_dev)) {
1000  if (ConfSetFinal("pfring.live-interface", pcap_dev) != 1) {
1001  SCLogError("Failed to set pfring.live-interface");
1003  }
1004  } else {
1005  /* not an error condition if we have a 1.0 config */
1006  LiveBuildDeviceList("pfring");
1007  }
1008 #ifdef HAVE_DPDK
1009  } else if (runmode == RUNMODE_DPDK) {
1010  char iface_selector[] = "dpdk.interfaces";
1011  int ret = LiveBuildDeviceList(iface_selector);
1012  if (ret == 0) {
1013  SCLogError("No interface found in config for %s", iface_selector);
1015  }
1016 #endif
1017 #ifdef HAVE_AF_PACKET
1018  } else if (runmode == RUNMODE_AFP_DEV) {
1019  /* iface has been set on command line */
1020  if (strlen(pcap_dev)) {
1021  if (ConfSetFinal("af-packet.live-interface", pcap_dev) != 1) {
1022  SCLogError("Failed to set af-packet.live-interface");
1024  }
1025  } else {
1026  int ret = LiveBuildDeviceList("af-packet");
1027  if (ret == 0) {
1028  SCLogError("No interface found in config for af-packet");
1030  }
1031  }
1032 #endif
1033 #ifdef HAVE_AF_XDP
1034  } else if (runmode == RUNMODE_AFXDP_DEV) {
1035  /* iface has been set on command line */
1036  if (strlen(pcap_dev)) {
1037  if (ConfSetFinal("af-xdp.live-interface", pcap_dev) != 1) {
1038  SCLogError("Failed to set af-xdp.live-interface");
1040  }
1041  } else {
1042  int ret = LiveBuildDeviceList("af-xdp");
1043  if (ret == 0) {
1044  SCLogError("No interface found in config for af-xdp");
1046  }
1047  }
1048 #endif
1049 #ifdef HAVE_NETMAP
1050  } else if (runmode == RUNMODE_NETMAP) {
1051  /* iface has been set on command line */
1052  if (strlen(pcap_dev)) {
1053  if (ConfSetFinal("netmap.live-interface", pcap_dev) != 1) {
1054  SCLogError("Failed to set netmap.live-interface");
1056  }
1057  } else {
1058  int ret = LiveBuildDeviceList("netmap");
1059  if (ret == 0) {
1060  SCLogError("No interface found in config for netmap");
1062  }
1063  }
1064 #endif
1065 #ifdef HAVE_NFLOG
1066  } else if (runmode == RUNMODE_NFLOG) {
1067  int ret = LiveBuildDeviceListCustom("nflog", "group");
1068  if (ret == 0) {
1069  SCLogError("No group found in config for nflog");
1071  }
1072 #endif
1073  }
1074 
1076 }
1077 
1078 static void SCInstanceInit(SCInstance *suri, const char *progname)
1079 {
1080  memset(suri, 0x00, sizeof(*suri));
1081 
1082  suri->progname = progname;
1083  suri->run_mode = RUNMODE_UNKNOWN;
1084 
1085  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
1086  suri->sig_file = NULL;
1087  suri->sig_file_exclusive = false;
1088  suri->pid_filename = NULL;
1089  suri->regex_arg = NULL;
1090 
1091  suri->keyword_info = NULL;
1092  suri->runmode_custom_mode = NULL;
1093 #ifndef OS_WIN32
1094  suri->user_name = NULL;
1095  suri->group_name = NULL;
1096  suri->do_setuid = false;
1097  suri->do_setgid = false;
1098 #endif /* OS_WIN32 */
1099  suri->userid = 0;
1100  suri->groupid = 0;
1101  suri->delayed_detect = 0;
1102  suri->daemon = 0;
1103  suri->offline = 0;
1104  suri->verbose = 0;
1105  /* use -1 as unknown */
1106  suri->checksum_validation = -1;
1107 #if HAVE_DETECT_DISABLED==1
1108  g_detect_disabled = suri->disabled_detect = 1;
1109 #else
1110  g_detect_disabled = suri->disabled_detect = 0;
1111 #endif
1112 }
1113 
1114 const char *GetDocURL(void)
1115 {
1116  const char *prog_ver = GetProgramVersion();
1117  if (strstr(prog_ver, "RELEASE") != NULL) {
1118  return DOC_URL "suricata-" PROG_VER;
1119  }
1120  return DOC_URL "latest";
1121 }
1122 
1123 /** \brief get string with program version
1124  *
1125  * Get the program version as passed to us from AC_INIT
1126  *
1127  * Add 'RELEASE' is no '-dev' in the version. Add the REVISION if passed
1128  * to us.
1129  *
1130  * Possible outputs:
1131  * release: '5.0.1 RELEASE'
1132  * dev with rev: '5.0.1-dev (64a789bbf 2019-10-18)'
1133  * dev w/o rev: '5.0.1-dev'
1134  */
1135 const char *GetProgramVersion(void)
1136 {
1137  if (strstr(PROG_VER, "-dev") == NULL) {
1138  return PROG_VER " RELEASE";
1139  } else {
1140 #ifdef REVISION
1141  return PROG_VER " (" xstr(REVISION) ")";
1142 #else
1143  return PROG_VER;
1144 #endif
1145  }
1146 }
1147 
1148 static TmEcode PrintVersion(void)
1149 {
1150  printf("This is %s version %s\n", PROG_NAME, GetProgramVersion());
1151  return TM_ECODE_OK;
1152 }
1153 
1154 static TmEcode LogVersion(SCInstance *suri)
1155 {
1156  const char *mode = suri->system ? "SYSTEM" : "USER";
1157  SCLogNotice("This is %s version %s running in %s mode",
1158  PROG_NAME, GetProgramVersion(), mode);
1159  return TM_ECODE_OK;
1160 }
1161 
1162 static void SCSetStartTime(SCInstance *suri)
1163 {
1164  memset(&suri->start_time, 0, sizeof(suri->start_time));
1165  gettimeofday(&suri->start_time, NULL);
1166 }
1167 
1168 static void SCPrintElapsedTime(struct timeval *start_time)
1169 {
1170  if (start_time == NULL)
1171  return;
1172  struct timeval end_time;
1173  memset(&end_time, 0, sizeof(end_time));
1174  gettimeofday(&end_time, NULL);
1175  uint64_t milliseconds = ((end_time.tv_sec - start_time->tv_sec) * 1000) +
1176  (((1000000 + end_time.tv_usec - start_time->tv_usec) / 1000) - 1000);
1177  SCLogInfo("time elapsed %.3fs", (float)milliseconds/(float)1000);
1178 }
1179 
1180 static int ParseCommandLineAfpacket(SCInstance *suri, const char *in_arg)
1181 {
1182 #ifdef HAVE_AF_PACKET
1183  if (suri->run_mode == RUNMODE_UNKNOWN) {
1184  suri->run_mode = RUNMODE_AFP_DEV;
1185  if (in_arg) {
1186  LiveRegisterDeviceName(in_arg);
1187  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
1188  strlcpy(suri->pcap_dev, in_arg, sizeof(suri->pcap_dev));
1189  }
1190  } else if (suri->run_mode == RUNMODE_AFP_DEV) {
1191  if (in_arg) {
1192  LiveRegisterDeviceName(in_arg);
1193  } else {
1194  SCLogInfo("Multiple af-packet option without interface on each is useless");
1195  }
1196  } else {
1197  SCLogError("more than one run mode "
1198  "has been specified");
1199  PrintUsage(suri->progname);
1200  return TM_ECODE_FAILED;
1201  }
1202  return TM_ECODE_OK;
1203 #else
1204  SCLogError("AF_PACKET not enabled. On Linux "
1205  "host, make sure to pass --enable-af-packet to "
1206  "configure when building.");
1207  return TM_ECODE_FAILED;
1208 #endif
1209 }
1210 
1211 static int ParseCommandLineAfxdp(SCInstance *suri, const char *in_arg)
1212 {
1213 #ifdef HAVE_AF_XDP
1214  if (suri->run_mode == RUNMODE_UNKNOWN) {
1215  suri->run_mode = RUNMODE_AFXDP_DEV;
1216  if (in_arg) {
1217  LiveRegisterDeviceName(in_arg);
1218  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
1219  strlcpy(suri->pcap_dev, in_arg, sizeof(suri->pcap_dev));
1220  }
1221  } else if (suri->run_mode == RUNMODE_AFXDP_DEV) {
1222  if (in_arg) {
1223  LiveRegisterDeviceName(in_arg);
1224  } else {
1225  SCLogInfo("Multiple af-xdp options without interface on each is useless");
1226  }
1227  } else {
1228  SCLogError("more than one run mode "
1229  "has been specified");
1230  PrintUsage(suri->progname);
1231  return TM_ECODE_FAILED;
1232  }
1233  return TM_ECODE_OK;
1234 #else
1235  SCLogError("AF_XDP not enabled. On Linux "
1236  "host, make sure correct libraries are installed,"
1237  " see documentation for information.");
1238  return TM_ECODE_FAILED;
1239 #endif
1240 }
1241 
1242 static int ParseCommandLineDpdk(SCInstance *suri, const char *in_arg)
1243 {
1244 #ifdef HAVE_DPDK
1245  if (suri->run_mode == RUNMODE_UNKNOWN) {
1246  suri->run_mode = RUNMODE_DPDK;
1247  } else if (suri->run_mode == RUNMODE_DPDK) {
1248  SCLogInfo("Multiple dpdk options have no effect on Suricata");
1249  } else {
1250  SCLogError("more than one run mode "
1251  "has been specified");
1252  PrintUsage(suri->progname);
1253  return TM_ECODE_FAILED;
1254  }
1255  return TM_ECODE_OK;
1256 #else
1257  SCLogError("DPDK not enabled. On Linux "
1258  "host, make sure to pass --enable-dpdk to "
1259  "configure when building.");
1260  return TM_ECODE_FAILED;
1261 #endif
1262 }
1263 
1264 static int ParseCommandLinePcapLive(SCInstance *suri, const char *in_arg)
1265 {
1266 #if defined(OS_WIN32) && !defined(HAVE_LIBWPCAP)
1267  /* If running on Windows without Npcap, bail early as live capture is not supported. */
1268  FatalError("Live capture not available. To support live capture compile against Npcap.");
1269 #endif
1270  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
1271 
1272  if (in_arg != NULL) {
1273  /* some windows shells require escaping of the \ in \Device. Otherwise
1274  * the backslashes are stripped. We put them back here. */
1275  if (strlen(in_arg) > 9 && strncmp(in_arg, "DeviceNPF", 9) == 0) {
1276  snprintf(suri->pcap_dev, sizeof(suri->pcap_dev), "\\Device\\NPF%s", in_arg+9);
1277  } else {
1278  strlcpy(suri->pcap_dev, in_arg, sizeof(suri->pcap_dev));
1279  PcapTranslateIPToDevice(suri->pcap_dev, sizeof(suri->pcap_dev));
1280  }
1281 
1282  if (strcmp(suri->pcap_dev, in_arg) != 0) {
1283  SCLogInfo("translated %s to pcap device %s", in_arg, suri->pcap_dev);
1284  } else if (strlen(suri->pcap_dev) > 0 && isdigit((unsigned char)suri->pcap_dev[0])) {
1285  SCLogError("failed to find a pcap device for IP %s", in_arg);
1286  return TM_ECODE_FAILED;
1287  }
1288  }
1289 
1290  if (suri->run_mode == RUNMODE_UNKNOWN) {
1291  suri->run_mode = RUNMODE_PCAP_DEV;
1292  if (in_arg) {
1294  }
1295  } else if (suri->run_mode == RUNMODE_PCAP_DEV) {
1297  } else {
1298  SCLogError("more than one run mode "
1299  "has been specified");
1300  PrintUsage(suri->progname);
1301  return TM_ECODE_FAILED;
1302  }
1303  return TM_ECODE_OK;
1304 }
1305 
1306 /**
1307  * Helper function to check if log directory is writable
1308  */
1309 static bool IsLogDirectoryWritable(const char* str)
1310 {
1311  if (access(str, W_OK) == 0)
1312  return true;
1313  return false;
1314 }
1315 
1316 extern int g_skip_prefilter;
1317 
1318 TmEcode SCParseCommandLine(int argc, char **argv)
1319 {
1320  SCInstance *suri = &suricata;
1321  int opt;
1322 
1323  int dump_config = 0;
1324  int dump_features = 0;
1325  int list_app_layer_protocols = 0;
1326  int list_unittests = 0;
1327  int list_runmodes = 0;
1328  int list_keywords = 0;
1329  int build_info = 0;
1330  int conf_test = 0;
1331  int engine_analysis = 0;
1332  int ret = TM_ECODE_OK;
1333 
1334 #ifdef UNITTESTS
1335  coverage_unittests = 0;
1336  g_ut_modules = 0;
1337  g_ut_covered = 0;
1338 #endif
1339 
1340  // clang-format off
1341  struct option long_opts[] = {
1342  {"dump-config", 0, &dump_config, 1},
1343  {"dump-features", 0, &dump_features, 1},
1344  {"pfring", optional_argument, 0, 0},
1345  {"pfring-int", required_argument, 0, 0},
1346  {"pfring-cluster-id", required_argument, 0, 0},
1347  {"pfring-cluster-type", required_argument, 0, 0},
1348 #ifdef HAVE_DPDK
1349  {"dpdk", 0, 0, 0},
1350 #endif
1351  {"af-packet", optional_argument, 0, 0},
1352  {"af-xdp", optional_argument, 0, 0},
1353  {"netmap", optional_argument, 0, 0},
1354  {"pcap", optional_argument, 0, 0},
1355  {"pcap-file-continuous", 0, 0, 0},
1356  {"pcap-file-delete", 0, 0, 0},
1357  {"pcap-file-recursive", 0, 0, 0},
1358  {"simulate-ips", 0, 0 , 0},
1359  {"no-random", 0, &g_disable_randomness, 1},
1360  {"strict-rule-keywords", optional_argument, 0, 0},
1361 
1362  {"capture-plugin", required_argument, 0, 0},
1363  {"capture-plugin-args", required_argument, 0, 0},
1364 
1365 #ifdef BUILD_UNIX_SOCKET
1366  {"unix-socket", optional_argument, 0, 0},
1367 #endif
1368  {"pcap-buffer-size", required_argument, 0, 0},
1369  {"unittest-filter", required_argument, 0, 'U'},
1370  {"list-app-layer-protos", 0, &list_app_layer_protocols, 1},
1371  {"list-unittests", 0, &list_unittests, 1},
1372  {"list-runmodes", 0, &list_runmodes, 1},
1373  {"list-keywords", optional_argument, &list_keywords, 1},
1374  {"runmode", required_argument, NULL, 0},
1375  {"engine-analysis", 0, &engine_analysis, 1},
1376 #ifdef OS_WIN32
1377  {"service-install", 0, 0, 0},
1378  {"service-remove", 0, 0, 0},
1379  {"service-change-params", 0, 0, 0},
1380 #endif /* OS_WIN32 */
1381  {"pidfile", required_argument, 0, 0},
1382  {"init-errors-fatal", 0, 0, 0},
1383  {"disable-detection", 0, 0, 0},
1384  {"disable-hashing", 0, 0, 0},
1385  {"fatal-unittests", 0, 0, 0},
1386  {"unittests-coverage", 0, &coverage_unittests, 1},
1387  {"user", required_argument, 0, 0},
1388  {"group", required_argument, 0, 0},
1389  {"erf-in", required_argument, 0, 0},
1390  {"dag", required_argument, 0, 0},
1391  {"napatech", 0, 0, 0},
1392  {"build-info", 0, &build_info, 1},
1393  {"data-dir", required_argument, 0, 0},
1394 #ifdef WINDIVERT
1395  {"windivert", required_argument, 0, 0},
1396  {"windivert-forward", required_argument, 0, 0},
1397 #endif
1398 #ifdef HAVE_LIBNET11
1399  {"reject-dev", required_argument, 0, 0},
1400 #endif
1401  {"set", required_argument, 0, 0},
1402 #ifdef HAVE_NFLOG
1403  {"nflog", optional_argument, 0, 0},
1404 #endif
1405  {"simulate-packet-flow-memcap", required_argument, 0, 0},
1406  {"simulate-applayer-error-at-offset-ts", required_argument, 0, 0},
1407  {"simulate-applayer-error-at-offset-tc", required_argument, 0, 0},
1408  {"simulate-packet-loss", required_argument, 0, 0},
1409  {"simulate-packet-tcp-reassembly-memcap", required_argument, 0, 0},
1410  {"simulate-packet-tcp-ssn-memcap", required_argument, 0, 0},
1411  {"simulate-packet-defrag-memcap", required_argument, 0, 0},
1412  {"simulate-alert-queue-realloc-failure", 0, 0, 0},
1413 
1414  {"qa-skip-prefilter", 0, &g_skip_prefilter, 1 },
1415 
1416  {"include", required_argument, 0, 0},
1417 
1418  {NULL, 0, NULL, 0}
1419  };
1420  // clang-format on
1421 
1422  /* getopt_long stores the option index here. */
1423  int option_index = 0;
1424 
1425  char short_opts[] = "c:TDhi:l:q:d:r:us:S:U:VF:vk:";
1426 
1427  while ((opt = getopt_long(argc, argv, short_opts, long_opts, &option_index)) != -1) {
1428  switch (opt) {
1429  case 0:
1430  if (strcmp((long_opts[option_index]).name , "pfring") == 0 ||
1431  strcmp((long_opts[option_index]).name , "pfring-int") == 0) {
1432 #ifdef HAVE_PFRING
1433  suri->run_mode = RUNMODE_PFRING;
1434  if (optarg != NULL) {
1435  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
1436  strlcpy(suri->pcap_dev, optarg,
1437  ((strlen(optarg) < sizeof(suri->pcap_dev)) ?
1438  (strlen(optarg) + 1) : sizeof(suri->pcap_dev)));
1439  LiveRegisterDeviceName(optarg);
1440  }
1441 #else
1442  SCLogError("PF_RING not enabled. Make sure "
1443  "to pass --enable-pfring to configure when building.");
1444  return TM_ECODE_FAILED;
1445 #endif /* HAVE_PFRING */
1446  }
1447  else if(strcmp((long_opts[option_index]).name , "pfring-cluster-id") == 0){
1448 #ifdef HAVE_PFRING
1449  if (ConfSetFinal("pfring.cluster-id", optarg) != 1) {
1450  SCLogError("failed to set pfring.cluster-id");
1451  return TM_ECODE_FAILED;
1452  }
1453 #else
1454  SCLogError("PF_RING not enabled. Make sure "
1455  "to pass --enable-pfring to configure when building.");
1456  return TM_ECODE_FAILED;
1457 #endif /* HAVE_PFRING */
1458  }
1459  else if(strcmp((long_opts[option_index]).name , "pfring-cluster-type") == 0){
1460 #ifdef HAVE_PFRING
1461  if (ConfSetFinal("pfring.cluster-type", optarg) != 1) {
1462  SCLogError("failed to set pfring.cluster-type");
1463  return TM_ECODE_FAILED;
1464  }
1465 #else
1466  SCLogError("PF_RING not enabled. Make sure "
1467  "to pass --enable-pfring to configure when building.");
1468  return TM_ECODE_FAILED;
1469 #endif /* HAVE_PFRING */
1470  }
1471  else if (strcmp((long_opts[option_index]).name , "capture-plugin") == 0){
1472  suri->run_mode = RUNMODE_PLUGIN;
1473  suri->capture_plugin_name = optarg;
1474  }
1475  else if (strcmp((long_opts[option_index]).name , "capture-plugin-args") == 0){
1476  suri->capture_plugin_args = optarg;
1477  } else if (strcmp((long_opts[option_index]).name, "dpdk") == 0) {
1478  if (ParseCommandLineDpdk(suri, optarg) != TM_ECODE_OK) {
1479  return TM_ECODE_FAILED;
1480  }
1481  } else if (strcmp((long_opts[option_index]).name, "af-packet") == 0) {
1482  if (ParseCommandLineAfpacket(suri, optarg) != TM_ECODE_OK) {
1483  return TM_ECODE_FAILED;
1484  }
1485  } else if (strcmp((long_opts[option_index]).name, "af-xdp") == 0) {
1486  if (ParseCommandLineAfxdp(suri, optarg) != TM_ECODE_OK) {
1487  return TM_ECODE_FAILED;
1488  }
1489  } else if (strcmp((long_opts[option_index]).name, "netmap") == 0) {
1490 #ifdef HAVE_NETMAP
1491  if (suri->run_mode == RUNMODE_UNKNOWN) {
1492  suri->run_mode = RUNMODE_NETMAP;
1493  if (optarg) {
1494  LiveRegisterDeviceName(optarg);
1495  memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev));
1496  strlcpy(suri->pcap_dev, optarg,
1497  ((strlen(optarg) < sizeof(suri->pcap_dev)) ?
1498  (strlen(optarg) + 1) : sizeof(suri->pcap_dev)));
1499  }
1500  } else if (suri->run_mode == RUNMODE_NETMAP) {
1501  if (optarg) {
1502  LiveRegisterDeviceName(optarg);
1503  } else {
1504  SCLogInfo("Multiple netmap option without interface on each is useless");
1505  break;
1506  }
1507  } else {
1508  SCLogError("more than one run mode "
1509  "has been specified");
1510  PrintUsage(argv[0]);
1511  return TM_ECODE_FAILED;
1512  }
1513 #else
1514  SCLogError("NETMAP not enabled.");
1515  return TM_ECODE_FAILED;
1516 #endif
1517  } else if (strcmp((long_opts[option_index]).name, "nflog") == 0) {
1518 #ifdef HAVE_NFLOG
1519  if (suri->run_mode == RUNMODE_UNKNOWN) {
1520  suri->run_mode = RUNMODE_NFLOG;
1521  LiveBuildDeviceListCustom("nflog", "group");
1522  }
1523 #else
1524  SCLogError("NFLOG not enabled.");
1525  return TM_ECODE_FAILED;
1526 #endif /* HAVE_NFLOG */
1527  } else if (strcmp((long_opts[option_index]).name, "pcap") == 0) {
1528  if (ParseCommandLinePcapLive(suri, optarg) != TM_ECODE_OK) {
1529  return TM_ECODE_FAILED;
1530  }
1531  } else if (strcmp((long_opts[option_index]).name, "simulate-ips") == 0) {
1532  SCLogInfo("Setting IPS mode");
1533  EngineModeSetIPS();
1534  } else if (strcmp((long_opts[option_index]).name, "init-errors-fatal") == 0) {
1535  if (ConfSetFinal("engine.init-failure-fatal", "1") != 1) {
1536  SCLogError("failed to set engine init-failure-fatal");
1537  return TM_ECODE_FAILED;
1538  }
1539 #ifdef BUILD_UNIX_SOCKET
1540  } else if (strcmp((long_opts[option_index]).name , "unix-socket") == 0) {
1541  if (suri->run_mode == RUNMODE_UNKNOWN) {
1542  suri->run_mode = RUNMODE_UNIX_SOCKET;
1543  if (optarg) {
1544  if (ConfSetFinal("unix-command.filename", optarg) != 1) {
1545  SCLogError("failed to set unix-command.filename");
1546  return TM_ECODE_FAILED;
1547  }
1548 
1549  }
1550  } else {
1551  SCLogError("more than one run mode "
1552  "has been specified");
1553  PrintUsage(argv[0]);
1554  return TM_ECODE_FAILED;
1555  }
1556 #endif
1557  }
1558  else if(strcmp((long_opts[option_index]).name, "list-app-layer-protocols") == 0) {
1559  /* listing all supported app layer protocols */
1560  }
1561  else if(strcmp((long_opts[option_index]).name, "list-unittests") == 0) {
1562 #ifdef UNITTESTS
1564 #else
1565  SCLogError("unit tests not enabled. Make sure to pass --enable-unittests to "
1566  "configure when building");
1567  return TM_ECODE_FAILED;
1568 #endif /* UNITTESTS */
1569  } else if (strcmp((long_opts[option_index]).name, "list-runmodes") == 0) {
1571  return TM_ECODE_OK;
1572  } else if (strcmp((long_opts[option_index]).name, "list-keywords") == 0) {
1573  if (optarg) {
1574  if (strcmp("short",optarg)) {
1575  suri->keyword_info = optarg;
1576  }
1577  }
1578  } else if (strcmp((long_opts[option_index]).name, "runmode") == 0) {
1579  suri->runmode_custom_mode = optarg;
1580  } else if(strcmp((long_opts[option_index]).name, "engine-analysis") == 0) {
1581  // do nothing for now
1582  }
1583 #ifdef OS_WIN32
1584  else if(strcmp((long_opts[option_index]).name, "service-install") == 0) {
1585  suri->run_mode = RUNMODE_INSTALL_SERVICE;
1586  return TM_ECODE_OK;
1587  }
1588  else if(strcmp((long_opts[option_index]).name, "service-remove") == 0) {
1589  suri->run_mode = RUNMODE_REMOVE_SERVICE;
1590  return TM_ECODE_OK;
1591  }
1592  else if(strcmp((long_opts[option_index]).name, "service-change-params") == 0) {
1593  suri->run_mode = RUNMODE_CHANGE_SERVICE_PARAMS;
1594  return TM_ECODE_OK;
1595  }
1596 #endif /* OS_WIN32 */
1597  else if(strcmp((long_opts[option_index]).name, "pidfile") == 0) {
1598  suri->pid_filename = SCStrdup(optarg);
1599  if (suri->pid_filename == NULL) {
1600  SCLogError("strdup failed: %s", strerror(errno));
1601  return TM_ECODE_FAILED;
1602  }
1603  }
1604  else if(strcmp((long_opts[option_index]).name, "disable-detection") == 0) {
1605  g_detect_disabled = suri->disabled_detect = 1;
1606  } else if (strcmp((long_opts[option_index]).name, "disable-hashing") == 0) {
1607  g_disable_hashing = true;
1608  } else if (strcmp((long_opts[option_index]).name, "fatal-unittests") == 0) {
1609 #ifdef UNITTESTS
1610  unittests_fatal = 1;
1611 #else
1612  SCLogError("unit tests not enabled. Make sure to pass --enable-unittests to "
1613  "configure when building");
1614  return TM_ECODE_FAILED;
1615 #endif /* UNITTESTS */
1616  } else if (strcmp((long_opts[option_index]).name, "user") == 0) {
1617 #ifndef HAVE_LIBCAP_NG
1618  SCLogError("libcap-ng is required to"
1619  " drop privileges, but it was not compiled into Suricata.");
1620  return TM_ECODE_FAILED;
1621 #else
1622  suri->user_name = optarg;
1623  suri->do_setuid = true;
1624 #endif /* HAVE_LIBCAP_NG */
1625  } else if (strcmp((long_opts[option_index]).name, "group") == 0) {
1626 #ifndef HAVE_LIBCAP_NG
1627  SCLogError("libcap-ng is required to"
1628  " drop privileges, but it was not compiled into Suricata.");
1629  return TM_ECODE_FAILED;
1630 #else
1631  suri->group_name = optarg;
1632  suri->do_setgid = true;
1633 #endif /* HAVE_LIBCAP_NG */
1634  } else if (strcmp((long_opts[option_index]).name, "erf-in") == 0) {
1635  suri->run_mode = RUNMODE_ERF_FILE;
1636  if (ConfSetFinal("erf-file.file", optarg) != 1) {
1637  SCLogError("failed to set erf-file.file");
1638  return TM_ECODE_FAILED;
1639  }
1640  } else if (strcmp((long_opts[option_index]).name, "dag") == 0) {
1641 #ifdef HAVE_DAG
1642  if (suri->run_mode == RUNMODE_UNKNOWN) {
1643  suri->run_mode = RUNMODE_DAG;
1644  }
1645  else if (suri->run_mode != RUNMODE_DAG) {
1646  SCLogError("more than one run mode has been specified");
1647  PrintUsage(argv[0]);
1648  return TM_ECODE_FAILED;
1649  }
1650  LiveRegisterDeviceName(optarg);
1651 #else
1652  SCLogError("libdag and a DAG card are required"
1653  " to receive packets using --dag.");
1654  return TM_ECODE_FAILED;
1655 #endif /* HAVE_DAG */
1656  } else if (strcmp((long_opts[option_index]).name, "napatech") == 0) {
1657 #ifdef HAVE_NAPATECH
1658  suri->run_mode = RUNMODE_NAPATECH;
1659 #else
1660  SCLogError("libntapi and a Napatech adapter are required"
1661  " to capture packets using --napatech.");
1662  return TM_ECODE_FAILED;
1663 #endif /* HAVE_NAPATECH */
1664  } else if (strcmp((long_opts[option_index]).name, "pcap-buffer-size") == 0) {
1665 #ifdef HAVE_PCAP_SET_BUFF
1666  if (ConfSetFinal("pcap.buffer-size", optarg) != 1) {
1667  SCLogError("failed to set pcap-buffer-size");
1668  return TM_ECODE_FAILED;
1669  }
1670 #else
1671  SCLogError("The version of libpcap you have"
1672  " doesn't support setting buffer size.");
1673 #endif /* HAVE_PCAP_SET_BUFF */
1674  } else if (strcmp((long_opts[option_index]).name, "build-info") == 0) {
1676  return TM_ECODE_OK;
1677  } else if (strcmp((long_opts[option_index]).name, "windivert-forward") == 0) {
1678 #ifdef WINDIVERT
1679  if (suri->run_mode == RUNMODE_UNKNOWN) {
1680  suri->run_mode = RUNMODE_WINDIVERT;
1681  if (WinDivertRegisterQueue(true, optarg) == -1) {
1682  exit(EXIT_FAILURE);
1683  }
1684  } else if (suri->run_mode == RUNMODE_WINDIVERT) {
1685  if (WinDivertRegisterQueue(true, optarg) == -1) {
1686  exit(EXIT_FAILURE);
1687  }
1688  } else {
1689  SCLogError("more than one run mode "
1690  "has been specified");
1691  PrintUsage(argv[0]);
1692  exit(EXIT_FAILURE);
1693  }
1694  }
1695  else if(strcmp((long_opts[option_index]).name, "windivert") == 0) {
1696  if (suri->run_mode == RUNMODE_UNKNOWN) {
1697  suri->run_mode = RUNMODE_WINDIVERT;
1698  if (WinDivertRegisterQueue(false, optarg) == -1) {
1699  exit(EXIT_FAILURE);
1700  }
1701  } else if (suri->run_mode == RUNMODE_WINDIVERT) {
1702  if (WinDivertRegisterQueue(false, optarg) == -1) {
1703  exit(EXIT_FAILURE);
1704  }
1705  } else {
1706  SCLogError("more than one run mode "
1707  "has been specified");
1708  PrintUsage(argv[0]);
1709  exit(EXIT_FAILURE);
1710  }
1711 #else
1712  SCLogError("WinDivert not enabled. Make sure to pass --enable-windivert to "
1713  "configure when building.");
1714  return TM_ECODE_FAILED;
1715 #endif /* WINDIVERT */
1716  } else if(strcmp((long_opts[option_index]).name, "reject-dev") == 0) {
1717 #ifdef HAVE_LIBNET11
1718  BUG_ON(optarg == NULL); /* for static analysis */
1719  extern char *g_reject_dev;
1720  extern uint16_t g_reject_dev_mtu;
1721  g_reject_dev = optarg;
1722  int mtu = GetIfaceMTU(g_reject_dev);
1723  if (mtu > 0) {
1724  g_reject_dev_mtu = (uint16_t)mtu;
1725  }
1726 #else
1727  SCLogError("Libnet 1.1 support not enabled. Compile Suricata with libnet support.");
1728  return TM_ECODE_FAILED;
1729 #endif
1730  }
1731  else if (strcmp((long_opts[option_index]).name, "set") == 0) {
1732  if (optarg != NULL) {
1733  /* Quick validation. */
1734  char *val = strchr(optarg, '=');
1735  if (val == NULL) {
1736  FatalError("Invalid argument for --set, must be key=val.");
1737  }
1738  if (!ConfSetFromString(optarg, 1)) {
1739  FatalError("failed to set configuration value %s", optarg);
1740  }
1741  }
1742  }
1743  else if (strcmp((long_opts[option_index]).name, "pcap-file-continuous") == 0) {
1744  if (ConfSetFinal("pcap-file.continuous", "true") != 1) {
1745  SCLogError("Failed to set pcap-file.continuous");
1746  return TM_ECODE_FAILED;
1747  }
1748  }
1749  else if (strcmp((long_opts[option_index]).name, "pcap-file-delete") == 0) {
1750  if (ConfSetFinal("pcap-file.delete-when-done", "true") != 1) {
1751  SCLogError("Failed to set pcap-file.delete-when-done");
1752  return TM_ECODE_FAILED;
1753  }
1754  }
1755  else if (strcmp((long_opts[option_index]).name, "pcap-file-recursive") == 0) {
1756  if (ConfSetFinal("pcap-file.recursive", "true") != 1) {
1757  SCLogError("failed to set pcap-file.recursive");
1758  return TM_ECODE_FAILED;
1759  }
1760  }
1761  else if (strcmp((long_opts[option_index]).name, "data-dir") == 0) {
1762  if (optarg == NULL) {
1763  SCLogError("no option argument (optarg) for -d");
1764  return TM_ECODE_FAILED;
1765  }
1766 
1767  if (ConfigSetDataDirectory(optarg) != TM_ECODE_OK) {
1768  SCLogError("Failed to set data directory.");
1769  return TM_ECODE_FAILED;
1770  }
1771  if (ConfigCheckDataDirectory(optarg) != TM_ECODE_OK) {
1772  SCLogError("The data directory \"%s\""
1773  " supplied at the command-line (-d %s) doesn't "
1774  "exist. Shutting down the engine.",
1775  optarg, optarg);
1776  return TM_ECODE_FAILED;
1777  }
1778  suri->set_datadir = true;
1779  } else if (strcmp((long_opts[option_index]).name , "strict-rule-keywords") == 0){
1780  if (optarg == NULL) {
1781  suri->strict_rule_parsing_string = SCStrdup("all");
1782  } else {
1783  suri->strict_rule_parsing_string = SCStrdup(optarg);
1784  }
1785  if (suri->strict_rule_parsing_string == NULL) {
1786  FatalError("failed to duplicate 'strict' string");
1787  }
1788  } else if (strcmp((long_opts[option_index]).name, "include") == 0) {
1789  if (suri->additional_configs == NULL) {
1790  suri->additional_configs = SCCalloc(2, sizeof(char *));
1791  if (suri->additional_configs == NULL) {
1792  FatalError(
1793  "Failed to allocate memory for additional configuration files: %s",
1794  strerror(errno));
1795  }
1796  suri->additional_configs[0] = optarg;
1797  } else {
1798  for (int i = 0;; i++) {
1799  if (suri->additional_configs[i] == NULL) {
1800  const char **additional_configs =
1801  SCRealloc(suri->additional_configs, (i + 2) * sizeof(char *));
1802  if (additional_configs == NULL) {
1803  FatalError("Failed to allocate memory for additional configuration "
1804  "files: %s",
1805  strerror(errno));
1806  } else {
1807  suri->additional_configs = additional_configs;
1808  }
1809  suri->additional_configs[i] = optarg;
1810  suri->additional_configs[i + 1] = NULL;
1811  break;
1812  }
1813  }
1814  }
1815  } else {
1817  (long_opts[option_index]).name, optarg);
1818  if (r < 0)
1819  return TM_ECODE_FAILED;
1820  }
1821  break;
1822  case 'c':
1823  suri->conf_filename = optarg;
1824  break;
1825  case 'T':
1826  conf_test = 1;
1827  if (ConfSetFinal("engine.init-failure-fatal", "1") != 1) {
1828  SCLogError("failed to set engine init-failure-fatal");
1829  return TM_ECODE_FAILED;
1830  }
1831  break;
1832 #ifndef OS_WIN32
1833  case 'D':
1834  suri->daemon = 1;
1835  break;
1836 #endif /* OS_WIN32 */
1837  case 'h':
1838  suri->run_mode = RUNMODE_PRINT_USAGE;
1839  return TM_ECODE_OK;
1840  case 'i':
1841  if (optarg == NULL) {
1842  SCLogError("no option argument (optarg) for -i");
1843  return TM_ECODE_FAILED;
1844  }
1845 #ifdef HAVE_AF_PACKET
1846  if (ParseCommandLineAfpacket(suri, optarg) != TM_ECODE_OK) {
1847  return TM_ECODE_FAILED;
1848  }
1849 #else /* not afpacket */
1850  /* warn user if netmap or pf-ring are available */
1851 #if defined HAVE_PFRING || HAVE_NETMAP
1852  int i = 0;
1853 #ifdef HAVE_PFRING
1854  i++;
1855 #endif
1856 #ifdef HAVE_NETMAP
1857  i++;
1858 #endif
1859  SCLogWarning("faster capture "
1860  "option%s %s available:"
1861 #ifdef HAVE_PFRING
1862  " PF_RING (--pfring-int=%s)"
1863 #endif
1864 #ifdef HAVE_NETMAP
1865  " NETMAP (--netmap=%s)"
1866 #endif
1867  ". Use --pcap=%s to suppress this warning",
1868  i == 1 ? "" : "s", i == 1 ? "is" : "are"
1869 #ifdef HAVE_PFRING
1870  ,
1871  optarg
1872 #endif
1873 #ifdef HAVE_NETMAP
1874  ,
1875  optarg
1876 #endif
1877  ,
1878  optarg);
1879 #endif /* have faster methods */
1880  if (ParseCommandLinePcapLive(suri, optarg) != TM_ECODE_OK) {
1881  return TM_ECODE_FAILED;
1882  }
1883 #endif
1884  break;
1885  case 'l':
1886  if (optarg == NULL) {
1887  SCLogError("no option argument (optarg) for -l");
1888  return TM_ECODE_FAILED;
1889  }
1890 
1891  if (ConfigSetLogDirectory(optarg) != TM_ECODE_OK) {
1892  SCLogError("Failed to set log directory.");
1893  return TM_ECODE_FAILED;
1894  }
1895  if (ConfigCheckLogDirectoryExists(optarg) != TM_ECODE_OK) {
1896  SCLogError("The logging directory \"%s\""
1897  " supplied at the command-line (-l %s) doesn't "
1898  "exist. Shutting down the engine.",
1899  optarg, optarg);
1900  return TM_ECODE_FAILED;
1901  }
1902  if (!IsLogDirectoryWritable(optarg)) {
1903  SCLogError("The logging directory \"%s\""
1904  " supplied at the command-line (-l %s) is not "
1905  "writable. Shutting down the engine.",
1906  optarg, optarg);
1907  return TM_ECODE_FAILED;
1908  }
1909  suri->set_logdir = true;
1910 
1911  break;
1912  case 'q':
1913 #ifdef NFQ
1914  if (suri->run_mode == RUNMODE_UNKNOWN) {
1915  suri->run_mode = RUNMODE_NFQ;
1916  EngineModeSetIPS();
1917  if (NFQParseAndRegisterQueues(optarg) == -1)
1918  return TM_ECODE_FAILED;
1919  } else if (suri->run_mode == RUNMODE_NFQ) {
1920  if (NFQParseAndRegisterQueues(optarg) == -1)
1921  return TM_ECODE_FAILED;
1922  } else {
1923  SCLogError("more than one run mode "
1924  "has been specified");
1925  PrintUsage(argv[0]);
1926  return TM_ECODE_FAILED;
1927  }
1928 #else
1929  SCLogError("NFQUEUE not enabled. Make sure to pass --enable-nfqueue to configure when "
1930  "building.");
1931  return TM_ECODE_FAILED;
1932 #endif /* NFQ */
1933  break;
1934  case 'd':
1935 #ifdef IPFW
1936  if (suri->run_mode == RUNMODE_UNKNOWN) {
1937  suri->run_mode = RUNMODE_IPFW;
1938  EngineModeSetIPS();
1939  if (IPFWRegisterQueue(optarg) == -1)
1940  return TM_ECODE_FAILED;
1941  } else if (suri->run_mode == RUNMODE_IPFW) {
1942  if (IPFWRegisterQueue(optarg) == -1)
1943  return TM_ECODE_FAILED;
1944  } else {
1945  SCLogError("more than one run mode "
1946  "has been specified");
1947  PrintUsage(argv[0]);
1948  return TM_ECODE_FAILED;
1949  }
1950 #else
1951  SCLogError("IPFW not enabled. Make sure to pass --enable-ipfw to configure when "
1952  "building.");
1953  return TM_ECODE_FAILED;
1954 #endif /* IPFW */
1955  break;
1956  case 'r':
1957  BUG_ON(optarg == NULL); /* for static analysis */
1958  if (suri->run_mode == RUNMODE_UNKNOWN) {
1959  suri->run_mode = RUNMODE_PCAP_FILE;
1960  } else {
1961  SCLogError("more than one run mode "
1962  "has been specified");
1963  PrintUsage(argv[0]);
1964  return TM_ECODE_FAILED;
1965  }
1966  SCStat buf;
1967  if (SCStatFn(optarg, &buf) != 0) {
1968  SCLogError("pcap file '%s': %s", optarg, strerror(errno));
1969  return TM_ECODE_FAILED;
1970  }
1971  if (ConfSetFinal("pcap-file.file", optarg) != 1) {
1972  SCLogError("ERROR: Failed to set pcap-file.file\n");
1973  return TM_ECODE_FAILED;
1974  }
1975 
1976  break;
1977  case 's':
1978  if (suri->sig_file != NULL) {
1979  SCLogError("can't have multiple -s options or mix -s and -S.");
1980  return TM_ECODE_FAILED;
1981  }
1982  suri->sig_file = optarg;
1983  break;
1984  case 'S':
1985  if (suri->sig_file != NULL) {
1986  SCLogError("can't have multiple -S options or mix -s and -S.");
1987  return TM_ECODE_FAILED;
1988  }
1989  suri->sig_file = optarg;
1990  suri->sig_file_exclusive = true;
1991  break;
1992  case 'u':
1993 #ifdef UNITTESTS
1994  if (suri->run_mode == RUNMODE_UNKNOWN) {
1995  suri->run_mode = RUNMODE_UNITTEST;
1996  } else {
1997  SCLogError("more than one run mode has"
1998  " been specified");
1999  PrintUsage(argv[0]);
2000  return TM_ECODE_FAILED;
2001  }
2002 #else
2003  SCLogError("unit tests not enabled. Make sure to pass --enable-unittests to configure "
2004  "when building.");
2005  return TM_ECODE_FAILED;
2006 #endif /* UNITTESTS */
2007  break;
2008  case 'U':
2009 #ifdef UNITTESTS
2010  suri->regex_arg = optarg;
2011 
2012  if(strlen(suri->regex_arg) == 0)
2013  suri->regex_arg = NULL;
2014 #endif
2015  break;
2016  case 'V':
2018  return TM_ECODE_OK;
2019  case 'F':
2020  if (optarg == NULL) {
2021  SCLogError("no option argument (optarg) for -F");
2022  return TM_ECODE_FAILED;
2023  }
2024 
2025  SetBpfStringFromFile(optarg);
2026  break;
2027  case 'v':
2028  suri->verbose++;
2029  break;
2030  case 'k':
2031  if (optarg == NULL) {
2032  SCLogError("no option argument (optarg) for -k");
2033  return TM_ECODE_FAILED;
2034  }
2035  if (!strcmp("all", optarg))
2036  suri->checksum_validation = 1;
2037  else if (!strcmp("none", optarg))
2038  suri->checksum_validation = 0;
2039  else {
2040  SCLogError("option '%s' invalid for -k", optarg);
2041  return TM_ECODE_FAILED;
2042  }
2043  break;
2044  default:
2045  PrintUsage(argv[0]);
2046  return TM_ECODE_FAILED;
2047  }
2048  }
2049 
2050  if (suri->disabled_detect && suri->sig_file != NULL) {
2051  SCLogError("can't use -s/-S when detection is disabled");
2052  return TM_ECODE_FAILED;
2053  }
2054 
2055  /* save the runmode from the command-line (if any) */
2056  suri->aux_run_mode = suri->run_mode;
2057 
2058  if (list_app_layer_protocols)
2060  if (list_keywords)
2062  if (list_unittests)
2064  if (dump_config)
2065  suri->run_mode = RUNMODE_DUMP_CONFIG;
2066  if (dump_features)
2068  if (conf_test)
2069  suri->run_mode = RUNMODE_CONF_TEST;
2070  if (engine_analysis)
2072 
2073  suri->offline = IsRunModeOffline(suri->run_mode);
2074  g_system = suri->system = IsRunModeSystem(suri->run_mode);
2075 
2076  ret = SetBpfString(optind, argv);
2077  if (ret != TM_ECODE_OK)
2078  return ret;
2079 
2080  return TM_ECODE_OK;
2081 }
2082 
2083 #ifdef OS_WIN32
2084 int WindowsInitService(int argc, char **argv)
2085 {
2086  if (SCRunningAsService()) {
2087  char path[MAX_PATH];
2088  char *p = NULL;
2089  strlcpy(path, argv[0], MAX_PATH);
2090  if ((p = strrchr(path, '\\'))) {
2091  *p = '\0';
2092  }
2093  if (!SetCurrentDirectory(path)) {
2094  SCLogError("Can't set current directory to: %s", path);
2095  return -1;
2096  }
2097  SCLogInfo("Current directory is set to: %s", path);
2098  SCServiceInit(argc, argv);
2099  }
2100 
2101  /* Windows socket subsystem initialization */
2102  WSADATA wsaData;
2103  if (0 != WSAStartup(MAKEWORD(2, 2), &wsaData)) {
2104  SCLogError("Can't initialize Windows sockets: %d", WSAGetLastError());
2105  return -1;
2106  }
2107 
2108  return 0;
2109 }
2110 #endif /* OS_WIN32 */
2111 
2112 static int MayDaemonize(SCInstance *suri)
2113 {
2114  if (suri->daemon == 1 && suri->pid_filename == NULL) {
2115  const char *pid_filename;
2116 
2117  if (ConfGet("pid-file", &pid_filename) == 1) {
2118  SCLogInfo("Use pid file %s from config file.", pid_filename);
2119  } else {
2120  pid_filename = DEFAULT_PID_FILENAME;
2121  }
2122  /* The pid file name may be in config memory, but is needed later. */
2123  suri->pid_filename = SCStrdup(pid_filename);
2124  if (suri->pid_filename == NULL) {
2125  SCLogError("strdup failed: %s", strerror(errno));
2126  return TM_ECODE_FAILED;
2127  }
2128  }
2129 
2130  if (suri->pid_filename != NULL && SCPidfileTestRunning(suri->pid_filename) != 0) {
2131  SCFree(suri->pid_filename);
2132  suri->pid_filename = NULL;
2133  return TM_ECODE_FAILED;
2134  }
2135 
2136  if (suri->daemon == 1) {
2137  Daemonize();
2138  }
2139 
2140  if (suri->pid_filename != NULL) {
2141  if (SCPidfileCreate(suri->pid_filename) != 0) {
2142  SCFree(suri->pid_filename);
2143  suri->pid_filename = NULL;
2144  SCLogError("Unable to create PID file, concurrent run of"
2145  " Suricata can occur.");
2146  SCLogError("PID file creation WILL be mandatory for daemon mode"
2147  " in future version");
2148  }
2149  }
2150 
2151  return TM_ECODE_OK;
2152 }
2153 
2154 /* Initialize the user and group Suricata is to run as. */
2155 static int InitRunAs(SCInstance *suri)
2156 {
2157 #ifndef OS_WIN32
2158  /* Try to get user/group to run suricata as if
2159  command line as not decide of that */
2160  if (!suri->do_setuid && !suri->do_setgid) {
2161  const char *id;
2162  if (ConfGet("run-as.user", &id) == 1) {
2163  suri->do_setuid = true;
2164  suri->user_name = id;
2165  }
2166  if (ConfGet("run-as.group", &id) == 1) {
2167  suri->do_setgid = true;
2168  suri->group_name = id;
2169  }
2170  }
2171  /* Get the suricata user ID to given user ID */
2172  if (suri->do_setuid) {
2173  SCGetUserID(suri->user_name, suri->group_name, &suri->userid, &suri->groupid);
2174  sc_set_caps = true;
2175  /* Get the suricata group ID to given group ID */
2176  } else if (suri->do_setgid) {
2177  SCGetGroupID(suri->group_name, &suri->groupid);
2178  sc_set_caps = true;
2179  }
2180 #endif
2181  return TM_ECODE_OK;
2182 }
2183 
2184 static int InitSignalHandler(SCInstance *suri)
2185 {
2186  /* registering signals we use */
2187 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
2188  UtilSignalHandlerSetup(SIGINT, SignalHandlerSigint);
2189  UtilSignalHandlerSetup(SIGTERM, SignalHandlerSigterm);
2190 #if HAVE_LIBUNWIND
2191  int enabled;
2192  if (ConfGetBool("logging.stacktrace-on-signal", &enabled) == 0) {
2193  enabled = 1;
2194  }
2195 
2196  if (enabled) {
2197  SCLogInfo("Preparing unexpected signal handling");
2198  struct sigaction stacktrace_action;
2199  memset(&stacktrace_action, 0, sizeof(stacktrace_action));
2200  stacktrace_action.sa_sigaction = SignalHandlerUnexpected;
2201  stacktrace_action.sa_flags = SA_SIGINFO;
2202  sigaction(SIGSEGV, &stacktrace_action, NULL);
2203  sigaction(SIGABRT, &stacktrace_action, NULL);
2204  }
2205 #endif /* HAVE_LIBUNWIND */
2206 #endif
2207 #ifndef OS_WIN32
2208  UtilSignalHandlerSetup(SIGHUP, SignalHandlerSigHup);
2209  UtilSignalHandlerSetup(SIGPIPE, SIG_IGN);
2210  UtilSignalHandlerSetup(SIGSYS, SIG_IGN);
2211 #endif /* OS_WIN32 */
2212 
2213  return TM_ECODE_OK;
2214 }
2215 
2216 /* initialization code for both the main modes and for
2217  * unix socket mode.
2218  *
2219  * Will be run once per pcap in unix-socket mode */
2220 void PreRunInit(const int runmode)
2221 {
2223  if (runmode == RUNMODE_UNIX_SOCKET)
2224  return;
2225 
2226  StatsInit();
2227 #ifdef PROFILE_RULES
2229 #endif
2230 #ifdef PROFILING
2234 #endif /* PROFILING */
2235 #ifdef PROFILE_RULES
2236  SCProfilingInit();
2237 #endif
2238  DefragInit();
2245 }
2246 
2247 /* tasks we need to run before packets start flowing,
2248  * but after we dropped privs */
2249 void PreRunPostPrivsDropInit(const int runmode)
2250 {
2253  DatasetsInit();
2254 
2255  if (runmode == RUNMODE_UNIX_SOCKET) {
2256  /* As the above did some necessary startup initialization, it
2257  * also setup some outputs where only one is allowed, so
2258  * deinitialize to the state that unix-mode does after every
2259  * pcap. */
2261  return;
2262  }
2263 
2265 }
2266 
2267 /* clean up / shutdown code for both the main modes and for
2268  * unix socket mode.
2269  *
2270  * Will be run once per pcap in unix-socket mode */
2271 void PostRunDeinit(const int runmode, struct timeval *start_time)
2272 {
2273  if (runmode == RUNMODE_UNIX_SOCKET)
2274  return;
2275 
2276  /* needed by FlowForceReassembly */
2277  PacketPoolInit();
2278 
2279  /* handle graceful shutdown of the flow engine, it's helper
2280  * threads and the packet threads */
2285  SCPrintElapsedTime(start_time);
2287 
2288  /* kill the stats threads */
2291 
2292  /* kill packet threads -- already in 'disabled' state */
2295 
2297 
2298  /* mgt and ppt threads killed, we can run non thread-safe
2299  * shutdown functions */
2302  RunModeShutDown();
2303  FlowShutdown();
2304  IPPairShutdown();
2305  HostCleanup();
2307  DefragDestroy();
2309 
2310  TmqResetQueues();
2311 #ifdef PROFILING
2313  SCProfilingDump();
2315 #endif
2316 }
2317 
2318 int SCStartInternalRunMode(int argc, char **argv)
2319 {
2320  SCInstance *suri = &suricata;
2321  /* Treat internal running mode */
2322  switch (suri->run_mode) {
2323  case RUNMODE_LIST_KEYWORDS:
2324  return ListKeywords(suri->keyword_info);
2326  if (suri->conf_filename != NULL) {
2327  return ListAppLayerProtocols(suri->conf_filename);
2328  } else {
2330  }
2331  case RUNMODE_PRINT_VERSION:
2332  PrintVersion();
2333  return TM_ECODE_DONE;
2335  PrintBuildInfo();
2336  return TM_ECODE_DONE;
2337  case RUNMODE_PRINT_USAGE:
2338  PrintUsage(argv[0]);
2339  return TM_ECODE_DONE;
2340  case RUNMODE_LIST_RUNMODES:
2342  return TM_ECODE_DONE;
2343  case RUNMODE_LIST_UNITTEST:
2344  RunUnittests(1, suri->regex_arg);
2345  case RUNMODE_UNITTEST:
2346  RunUnittests(0, suri->regex_arg);
2347 #ifdef OS_WIN32
2348  case RUNMODE_INSTALL_SERVICE:
2349  if (SCServiceInstall(argc, argv)) {
2350  return TM_ECODE_FAILED;
2351  }
2352  SCLogInfo("Suricata service has been successfully installed.");
2353  return TM_ECODE_DONE;
2354  case RUNMODE_REMOVE_SERVICE:
2355  if (SCServiceRemove()) {
2356  return TM_ECODE_FAILED;
2357  }
2358  SCLogInfo("Suricata service has been successfully removed.");
2359  return TM_ECODE_DONE;
2360  case RUNMODE_CHANGE_SERVICE_PARAMS:
2361  if (SCServiceChangeParams(argc, argv)) {
2362  return TM_ECODE_FAILED;
2363  }
2364  SCLogInfo("Suricata service startup parameters has been successfully changed.");
2365  return TM_ECODE_DONE;
2366 #endif /* OS_WIN32 */
2367  default:
2368  /* simply continue for other running mode */
2369  break;
2370  }
2371  return TM_ECODE_OK;
2372 }
2373 
2375 {
2376  SCInstance *suri = &suricata;
2377  switch (suri->run_mode) {
2378  case RUNMODE_UNKNOWN:
2379  PrintUsage(suri->progname);
2380  return TM_ECODE_FAILED;
2381  default:
2382  break;
2383  }
2384 
2385  if (!CheckValidDaemonModes(suri->daemon, suri->run_mode)) {
2386  return TM_ECODE_FAILED;
2387  }
2388 
2389  return TM_ECODE_OK;
2390 }
2391 
2392 static void SetupDelayedDetect(SCInstance *suri)
2393 {
2394  /* In offline mode delayed init of detect is a bad idea */
2395  if (suri->offline) {
2396  suri->delayed_detect = 0;
2397  } else {
2398  if (ConfGetBool("detect.delayed-detect", &suri->delayed_detect) != 1) {
2399  ConfNode *denode = NULL;
2400  ConfNode *decnf = ConfGetNode("detect-engine");
2401  if (decnf != NULL) {
2402  TAILQ_FOREACH(denode, &decnf->head, next) {
2403  if (strcmp(denode->val, "delayed-detect") == 0) {
2404  (void)ConfGetChildValueBool(denode, "delayed-detect", &suri->delayed_detect);
2405  }
2406  }
2407  }
2408  }
2409  }
2410 
2411  SCLogConfig("Delayed detect %s", suri->delayed_detect ? "enabled" : "disabled");
2412  if (suri->delayed_detect) {
2413  SCLogInfo("Packets will start being processed before signatures are active.");
2414  }
2415 
2416 }
2417 
2418 static int LoadSignatures(DetectEngineCtx *de_ctx, SCInstance *suri)
2419 {
2420  if (SigLoadSignatures(de_ctx, suri->sig_file, suri->sig_file_exclusive) < 0) {
2421  SCLogError("Loading signatures failed.");
2422  if (de_ctx->failure_fatal)
2423  return TM_ECODE_FAILED;
2424  }
2425 
2426  return TM_ECODE_OK;
2427 }
2428 
2429 static int ConfigGetCaptureValue(SCInstance *suri)
2430 {
2431  /* Pull the max pending packets from the config, if not found fall
2432  * back on a sane default. */
2433  intmax_t tmp_max_pending_packets;
2434  if (ConfGetInt("max-pending-packets", &tmp_max_pending_packets) != 1)
2435  tmp_max_pending_packets = DEFAULT_MAX_PENDING_PACKETS;
2436  if (tmp_max_pending_packets < 1 || tmp_max_pending_packets >= UINT16_MAX) {
2437  SCLogError("Maximum max-pending-packets setting is 65534 and must be greater than 0. "
2438  "Please check %s for errors",
2439  suri->conf_filename);
2440  return TM_ECODE_FAILED;
2441  } else {
2442  max_pending_packets = (uint16_t)tmp_max_pending_packets;
2443  }
2444 
2445  SCLogDebug("Max pending packets set to %" PRIu16, max_pending_packets);
2446 
2447  /* Pull the default packet size from the config, if not found fall
2448  * back on a sane default. */
2449  const char *temp_default_packet_size;
2450  if ((ConfGet("default-packet-size", &temp_default_packet_size)) != 1) {
2451  int lthread;
2452  int nlive;
2453  int strip_trailing_plus = 0;
2454  switch (suri->run_mode) {
2455 #ifdef WINDIVERT
2456  case RUNMODE_WINDIVERT: {
2457  /* by default, WinDivert collects from all devices */
2458  const int mtu = GetGlobalMTUWin32();
2459 
2460  if (mtu > 0) {
2461  /* SLL_HEADER_LEN is the longest header + 8 for VLAN */
2462  default_packet_size = mtu + SLL_HEADER_LEN + 8;
2463  break;
2464  }
2466  break;
2467  }
2468 #endif /* WINDIVERT */
2469  case RUNMODE_NETMAP:
2470  /* in netmap igb0+ has a special meaning, however the
2471  * interface really is igb0 */
2472  strip_trailing_plus = 1;
2473  /* fall through */
2474  case RUNMODE_PCAP_DEV:
2475  case RUNMODE_AFP_DEV:
2476  case RUNMODE_AFXDP_DEV:
2477  case RUNMODE_PFRING:
2478  nlive = LiveGetDeviceCount();
2479  for (lthread = 0; lthread < nlive; lthread++) {
2480  const char *live_dev = LiveGetDeviceName(lthread);
2481  char dev[128]; /* need to be able to support GUID names on Windows */
2482  (void)strlcpy(dev, live_dev, sizeof(dev));
2483 
2484  if (strip_trailing_plus) {
2485  size_t len = strlen(dev);
2486  if (len &&
2487  (dev[len-1] == '+' ||
2488  dev[len-1] == '^' ||
2489  dev[len-1] == '*'))
2490  {
2491  dev[len-1] = '\0';
2492  }
2493  }
2494  LiveDevice *ld = LiveGetDevice(dev);
2495  unsigned int iface_max_packet_size = GetIfaceMaxPacketSize(ld);
2496  if (iface_max_packet_size > default_packet_size)
2497  default_packet_size = iface_max_packet_size;
2498  }
2499  if (default_packet_size)
2500  break;
2501  /* fall through */
2502  default:
2504  }
2505  } else {
2506  if (ParseSizeStringU32(temp_default_packet_size, &default_packet_size) < 0) {
2507  SCLogError("Error parsing max-pending-packets "
2508  "from conf file - %s. Killing engine",
2509  temp_default_packet_size);
2510  return TM_ECODE_FAILED;
2511  }
2512  }
2513 
2514  SCLogDebug("Default packet size set to %"PRIu32, default_packet_size);
2515 
2516  return TM_ECODE_OK;
2517 }
2518 
2519 static void PostRunStartedDetectSetup(const SCInstance *suri)
2520 {
2521 #ifndef OS_WIN32
2522  /* registering signal handlers we use. We setup usr2 here, so that one
2523  * can't call it during the first sig load phase or while threads are still
2524  * starting up. */
2525  if (DetectEngineEnabled() && suri->delayed_detect == 0) {
2526  UtilSignalHandlerSetup(SIGUSR2, SignalHandlerSigusr2);
2527  UtilSignalUnblock(SIGUSR2);
2528  }
2529 #endif
2530  if (suri->delayed_detect) {
2531  /* force 'reload', this will load the rules and swap engines */
2532  DetectEngineReload(suri);
2533  SCLogNotice("Signature(s) loaded, Detect thread(s) activated.");
2534 #ifndef OS_WIN32
2535  UtilSignalHandlerSetup(SIGUSR2, SignalHandlerSigusr2);
2536  UtilSignalUnblock(SIGUSR2);
2537 #endif
2538  }
2539 }
2540 
2542 {
2543  DetectEngineCtx *de_ctx = NULL;
2544  if (!suri->disabled_detect) {
2545  SetupDelayedDetect(suri);
2546  int mt_enabled = 0;
2547  (void)ConfGetBool("multi-detect.enabled", &mt_enabled);
2548  int default_tenant = 0;
2549  if (mt_enabled)
2550  (void)ConfGetBool("multi-detect.default", &default_tenant);
2552  FatalError("initializing multi-detect "
2553  "detection engine contexts failed.");
2554  }
2555  if (suri->delayed_detect && suri->run_mode != RUNMODE_CONF_TEST) {
2557  } else if (mt_enabled && !default_tenant && suri->run_mode != RUNMODE_CONF_TEST) {
2559  } else {
2561  }
2562  if (de_ctx == NULL) {
2563  FatalError("initializing detection engine failed.");
2564  }
2565 
2567  if (LoadSignatures(de_ctx, suri) != TM_ECODE_OK)
2568  exit(EXIT_FAILURE);
2569  }
2570 
2571  gettimeofday(&de_ctx->last_reload, NULL);
2574  }
2575 }
2576 
2577 static void PostConfLoadedSetupHostMode(void)
2578 {
2579  const char *hostmode = NULL;
2580 
2581  if (ConfGet("host-mode", &hostmode) == 1) {
2582  if (!strcmp(hostmode, "router")) {
2584  } else if (!strcmp(hostmode, "sniffer-only")) {
2586  } else {
2587  if (strcmp(hostmode, "auto") != 0) {
2588  WarnInvalidConfEntry("host-mode", "%s", "auto");
2589  }
2590  if (EngineModeIsIPS()) {
2592  } else {
2594  }
2595  }
2596  } else {
2597  if (EngineModeIsIPS()) {
2599  SCLogInfo("No 'host-mode': suricata is in IPS mode, using "
2600  "default setting 'router'");
2601  } else {
2603  SCLogInfo("No 'host-mode': suricata is in IDS mode, using "
2604  "default setting 'sniffer-only'");
2605  }
2606  }
2607 }
2608 
2609 static void SetupUserMode(SCInstance *suri)
2610 {
2611  /* apply 'user mode' config updates here */
2612  if (suri->system == false) {
2613  if (suri->set_logdir == false) {
2614  /* override log dir to current work dir" */
2615  if (ConfigSetLogDirectory((char *)".") != TM_ECODE_OK) {
2616  FatalError("could not set USER mode logdir");
2617  }
2618  }
2619  if (suri->set_datadir == false) {
2620  /* override data dir to current work dir" */
2621  if (ConfigSetDataDirectory((char *)".") != TM_ECODE_OK) {
2622  FatalError("could not set USER mode datadir");
2623  }
2624  }
2625  }
2626 }
2627 
2628 /**
2629  * This function is meant to contain code that needs
2630  * to be run once the configuration has been loaded.
2631  */
2633 {
2634  /* load the pattern matchers */
2635  MpmTableSetup();
2636  SpmTableSetup();
2637 
2638  int disable_offloading;
2639  if (ConfGetBool("capture.disable-offloading", &disable_offloading) == 0)
2640  disable_offloading = 1;
2641  if (disable_offloading) {
2643  } else {
2645  }
2646 
2647  if (suri->checksum_validation == -1) {
2648  const char *cv = NULL;
2649  if (ConfGet("capture.checksum-validation", &cv) == 1) {
2650  if (strcmp(cv, "none") == 0) {
2651  suri->checksum_validation = 0;
2652  } else if (strcmp(cv, "all") == 0) {
2653  suri->checksum_validation = 1;
2654  }
2655  }
2656  }
2657  switch (suri->checksum_validation) {
2658  case 0:
2659  ConfSet("stream.checksum-validation", "0");
2660  break;
2661  case 1:
2662  ConfSet("stream.checksum-validation", "1");
2663  break;
2664  }
2665 
2666  if (suri->runmode_custom_mode) {
2667  ConfSet("runmode", suri->runmode_custom_mode);
2668  }
2669 
2670  StorageInit();
2671 #ifdef HAVE_PACKET_EBPF
2672  if (suri->run_mode == RUNMODE_AFP_DEV) {
2673  EBPFRegisterExtension();
2675  }
2676 #endif
2678 
2680 
2681 #ifdef HAVE_PLUGINS
2683 #endif
2684 
2685  LiveDeviceFinalize(); // must be after EBPF extension registration
2686 
2689  FatalError("IPS mode setup failed");
2690  }
2691 
2692  if (EngineModeIsUnknown()) { // if still uninitialized, set the default
2693  SCLogInfo("Setting engine mode to IDS mode by default");
2694  EngineModeSetIDS();
2695  }
2696 
2698 
2699  ConfNode *eps = ConfGetNode("stats.exception-policy");
2700  if (eps != NULL) {
2701  if (ConfNodeChildValueIsTrue(eps, "per-app-proto-errors")) {
2703  }
2704  }
2705 
2706  /* Must occur prior to output mod registration
2707  and app layer setup. */
2709 
2710  AppLayerSetup();
2711 
2712  /* Suricata will use this umask if provided. By default it will use the
2713  umask passed on from the shell. */
2714  const char *custom_umask;
2715  if (ConfGet("umask", &custom_umask) == 1) {
2716  uint16_t mask;
2717  if (StringParseUint16(&mask, 8, (uint16_t)strlen(custom_umask), custom_umask) > 0) {
2718  umask((mode_t)mask);
2719  }
2720  }
2721 
2722 
2723  if (ConfigGetCaptureValue(suri) != TM_ECODE_OK) {
2725  }
2726 
2727 #ifdef NFQ
2728  if (suri->run_mode == RUNMODE_NFQ)
2729  NFQInitConfig(false);
2730 #endif
2731 
2732  /* Load the Host-OS lookup. */
2734 
2735  if (suri->run_mode == RUNMODE_ENGINE_ANALYSIS) {
2736  SCLogInfo("== Carrying out Engine Analysis ==");
2737  const char *temp = NULL;
2738  if (ConfGet("engine-analysis", &temp) == 0) {
2739  SCLogInfo("no engine-analysis parameter(s) defined in conf file. "
2740  "Please define/enable them in the conf to use this "
2741  "feature.");
2743  }
2744  }
2745 
2746  /* hardcoded initialization code */
2747  SigTableSetup(); /* load the rule keywords */
2749  TmqhSetup();
2750 
2751  TagInitCtx();
2753  ThresholdInit();
2754  HostBitInitCtx();
2755  IPPairBitInitCtx();
2756 
2757  if (DetectAddressTestConfVars() < 0) {
2758  SCLogError(
2759  "basic address vars test failed. Please check %s for errors", suri->conf_filename);
2761  }
2762  if (DetectPortTestConfVars() < 0) {
2763  SCLogError("basic port vars test failed. Please check %s for errors", suri->conf_filename);
2765  }
2766 
2769 
2770  StorageFinalize();
2771 
2772  TmModuleRunInit();
2773 
2774  if (MayDaemonize(suri) != TM_ECODE_OK)
2776 
2777  if (InitSignalHandler(suri) != TM_ECODE_OK)
2779 
2780  /* Check for the existence of the default logging directory which we pick
2781  * from suricata.yaml. If not found, shut the engine down */
2782  suri->log_dir = ConfigGetLogDirectory();
2783 
2785  SCLogError("The logging directory \"%s\" "
2786  "supplied by %s (default-log-dir) doesn't exist. "
2787  "Shutting down the engine",
2788  suri->log_dir, suri->conf_filename);
2790  }
2791  if (!IsLogDirectoryWritable(suri->log_dir)) {
2792  SCLogError("The logging directory \"%s\" "
2793  "supplied by %s (default-log-dir) is not writable. "
2794  "Shutting down the engine",
2795  suri->log_dir, suri->conf_filename);
2797  }
2798 
2799  if (suri->disabled_detect) {
2800  SCLogConfig("detection engine disabled");
2801  /* disable raw reassembly */
2802  (void)ConfSetFinal("stream.reassembly.raw", "false");
2803  }
2804 
2806 
2808 
2810 
2811  /* hostmode depends on engine mode being set */
2812  PostConfLoadedSetupHostMode();
2813 
2814  PreRunInit(suri->run_mode);
2815 
2817 }
2818 
2820 {
2821  SCInstance *suri = &suricata;
2822  while(1) {
2823  if (sigterm_count || sigint_count) {
2825  }
2826 
2828  SCLogNotice("Signal Received. Stopping engine.");
2829  break;
2830  }
2831 
2833 
2834  if (sighup_count > 0) {
2836  sighup_count--;
2837  }
2838 
2839  if (sigusr2_count > 0) {
2840  if (!(DetectEngineReloadIsStart())) {
2842  DetectEngineReload(suri);
2844  sigusr2_count--;
2845  }
2846 
2847  } else if (DetectEngineReloadIsStart()) {
2848  DetectEngineReload(suri);
2850  }
2851 
2852  usleep(10* 1000);
2853  }
2854 }
2855 
2856 /**
2857  * \brief Global initialization common to all runmodes.
2858  *
2859  * This can be used by fuzz targets.
2860  */
2861 
2862 int InitGlobal(void)
2863 {
2864  rs_init(&suricata_context);
2865 
2866  SC_ATOMIC_INIT(engine_stage);
2867 
2868  /* initialize the logging subsys */
2869  SCLogInitLogModule(NULL);
2870 
2871  SCSetThreadName("Suricata-Main");
2872 
2873  /* Ignore SIGUSR2 as early as possible. We redeclare interest
2874  * once we're done launching threads. The goal is to either die
2875  * completely or handle any and all SIGUSR2s correctly.
2876  */
2877 #ifndef OS_WIN32
2878  UtilSignalHandlerSetup(SIGUSR2, SIG_IGN);
2879  if (UtilSignalBlock(SIGUSR2)) {
2880  SCLogError("SIGUSR2 initialization error");
2881  return EXIT_FAILURE;
2882  }
2883 #endif
2884 
2885  ParseSizeInit();
2887 
2888  /* Initialize the configuration module. */
2889  ConfInit();
2890 
2891  VarNameStoreInit();
2892 
2893  // zero all module storage
2894  memset(tmm_modules, 0, TMM_SIZE * sizeof(TmModule));
2895 
2896  return 0;
2897 }
2898 
2899 void SuricataPreInit(const char *progname)
2900 {
2901  SCInstanceInit(&suricata, progname);
2902 
2903  if (InitGlobal() != 0) {
2904  exit(EXIT_FAILURE);
2905  }
2906 }
2907 
2908 void SuricataInit(void)
2909 {
2910  /* Initializations for global vars, queues, etc (memsets, mutex init..) */
2912 
2914  ConfDump();
2915  exit(EXIT_SUCCESS);
2916  }
2917 
2918  int tracking = 1;
2919  if (ConfGetBool("vlan.use-for-tracking", &tracking) == 1 && !tracking) {
2920  /* Ignore vlan_ids when comparing flows. */
2921  g_vlan_mask = 0x0000;
2922  }
2923  SCLogDebug("vlan tracking is %s", tracking == 1 ? "enabled" : "disabled");
2924  if (ConfGetBool("livedev.use-for-tracking", &tracking) == 1 && !tracking) {
2925  /* Ignore livedev id when comparing flows. */
2926  g_livedev_mask = 0x0000;
2927  }
2928  SetupUserMode(&suricata);
2929  InitRunAs(&suricata);
2930 
2931  /* Since our config is now loaded we can finish configurating the
2932  * logging module. */
2934 
2935  LogVersion(&suricata);
2938 
2940  SCLogInfo("Running suricata under test mode");
2941 
2942  if (ParseInterfacesList(suricata.aux_run_mode, suricata.pcap_dev) != TM_ECODE_OK) {
2943  exit(EXIT_FAILURE);
2944  }
2945 
2947  exit(EXIT_FAILURE);
2948  }
2949 
2951 
2952  /* Re-enable coredumps after privileges are dropped. */
2953  CoredumpEnable();
2954 
2957  }
2958 
2960 
2962 
2965  goto out;
2966  } else if (suricata.run_mode == RUNMODE_CONF_TEST){
2967  SCLogNotice("Configuration provided was successfully loaded. Exiting.");
2968  goto out;
2969  } else if (suricata.run_mode == RUNMODE_DUMP_FEATURES) {
2970  FeatureDump();
2971  goto out;
2972  }
2973 
2976 
2977  SCSetStartTime(&suricata);
2982  }
2983 
2984  return;
2985 
2986 out:
2987  GlobalsDestroy();
2988  exit(EXIT_SUCCESS);
2989 }
2990 
2992 {
2993  /* Update the engine stage/status flag */
2994  SC_ATOMIC_SET(engine_stage, SURICATA_DEINIT);
2995 
2998  /* kill remaining threads */
3000 }
3001 
3003 {
3004  /* Wait till all the threads have been initialized */
3007  FatalError("Engine initialization failed, "
3008  "aborting...");
3009  }
3010 
3011  int limit_nproc = 0;
3012  if (ConfGetBool("security.limit-noproc", &limit_nproc) == 0) {
3013  limit_nproc = 0;
3014  }
3015 
3016 #if defined(SC_ADDRESS_SANITIZER)
3017  if (limit_nproc) {
3018  SCLogWarning(
3019  "\"security.limit-noproc\" (setrlimit()) not set when using address sanitizer");
3020  limit_nproc = 0;
3021  }
3022 #endif
3023 
3024  if (limit_nproc) {
3025 #if defined(HAVE_SYS_RESOURCE_H)
3026 #ifdef linux
3027  if (geteuid() == 0) {
3028  SCLogWarning("setrlimit has no effet when running as root.");
3029  }
3030 #endif
3031  struct rlimit r = { 0, 0 };
3032  if (setrlimit(RLIMIT_NPROC, &r) != 0) {
3033  SCLogWarning("setrlimit failed to prevent process creation.");
3034  }
3035 #else
3036  SCLogWarning("setrlimit unavailable.");
3037 #endif
3038  }
3039 
3040  SC_ATOMIC_SET(engine_stage, SURICATA_RUNTIME);
3042 
3043  /* Un-pause all the paused threads */
3045 
3046  /* Must ensure all threads are fully operational before continuing with init process */
3049  exit(EXIT_FAILURE);
3050  }
3051 
3052  /* Print notice and send OS specific notification of threads in running state */
3053  OnNotifyRunning();
3054 
3055  PostRunStartedDetectSetup(&suricata);
3056  if (suricata.run_mode == RUNMODE_DPDK) { // only DPDK uses hpages at the moment
3060  SystemHugepageSnapshotDestroy(postrun_snap);
3061  }
3062  SCPledge();
3063 }
RUNMODE_AFXDP_DEV
@ RUNMODE_AFXDP_DEV
Definition: runmodes.h:38
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1133
util-byte.h
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:399
TmModuleUnixManagerRegister
void TmModuleUnixManagerRegister(void)
Definition: unix-manager.c:1289
StatsReleaseResources
void StatsReleaseResources(void)
Releases the resources allotted by the Stats API.
Definition: counters.c:1272
max_pending_packets
uint16_t max_pending_packets
Definition: suricata.c:182
source-nflog.h
TagInitCtx
void TagInitCtx(void)
Definition: detect-engine-tag.c:52
TmModuleReceiveIPFWRegister
void TmModuleReceiveIPFWRegister(void)
Registration Function for RecieveIPFW.
Definition: source-ipfw.c:150
flow-bypass.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
SuricataMainLoop
void SuricataMainLoop(void)
Definition: suricata.c:2819
ExceptionSimulationCommandLineParser
int ExceptionSimulationCommandLineParser(const char *name, const char *arg)
Definition: util-exception-policy.c:316
ippair.h
g_livedev_mask
uint16_t g_livedev_mask
Definition: suricata.c:205
app-layer-htp-range.h
AppLayerHtpNeedFileInspection
void AppLayerHtpNeedFileInspection(void)
Sets a flag that informs the HTP app layer that some module in the engine needs the http request file...
Definition: app-layer-htp.c:501
SCInstance_::run_mode
enum RunModes run_mode
Definition: suricata.h:124
detect-engine.h
source-pcap.h
SCInstance_::groupid
uint32_t groupid
Definition: suricata.h:142
SCRunmodeGet
int SCRunmodeGet(void)
Get the current run mode.
Definition: suricata.c:262
RUNMODE_UNIX_SOCKET
@ RUNMODE_UNIX_SOCKET
Definition: runmodes.h:43
g_system
bool g_system
Definition: suricata.c:190
ConfNodeChildValueIsTrue
int ConfNodeChildValueIsTrue(const ConfNode *node, const char *key)
Test if a configuration node has a true value.
Definition: conf.c:854
win32-syscall.h
SCInstance_::daemon
int daemon
Definition: suricata.h:151
IPPairInitConfig
void IPPairInitConfig(bool quiet)
initialize the configuration
Definition: ippair.c:162
SCLogInitLogModule
void SCLogInitLogModule(SCLogInitData *sc_lid)
Initializes the logging module.
Definition: util-debug.c:1390
SLL_HEADER_LEN
#define SLL_HEADER_LEN
Definition: decode-sll.h:27
SCInstance_::checksum_validation
int checksum_validation
Definition: suricata.h:154
LiveDeviceListClean
int LiveDeviceListClean(void)
Definition: util-device.c:314
SCInstance_::do_setuid
bool do_setuid
Definition: suricata.h:138
DetectEngineDeReference
void DetectEngineDeReference(DetectEngineCtx **de_ctx)
Definition: detect-engine.c:4556
RUNMODE_UNITTEST
@ RUNMODE_UNITTEST
Definition: runmodes.h:41
StorageInit
void StorageInit(void)
Definition: util-storage.c:68
SCInstance_::start_time
struct timeval start_time
Definition: suricata.h:156
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:314
prerun_snap
SystemHugepageSnapshot * prerun_snap
Definition: suricata.c:212
TmThreadContinueThreads
void TmThreadContinueThreads(void)
Unpauses all threads present in tv_root.
Definition: tm-threads.c:1915
source-pcap-file.h
SCInstance_::do_setgid
bool do_setgid
Definition: suricata.h:139
ConfNode_::val
char * val
Definition: conf.h:34
CLS
#define CLS
Definition: suricata-common.h:56
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:482
RUNMODE_DPDK
@ RUNMODE_DPDK
Definition: runmodes.h:40
stream-tcp.h
DetectEngineCtx_::type
enum DetectEngineType type
Definition: detect.h:975
SigLoadSignatures
int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, bool sig_file_exclusive)
Load signatures.
Definition: detect-engine-loader.c:287
runmode-af-packet.h
RUNMODE_UNKNOWN
@ RUNMODE_UNKNOWN
Definition: runmodes.h:28
SCInstance_::group_name
const char * group_name
Definition: suricata.h:137
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:386
runmode-unittests.h
TmqhSetup
void TmqhSetup(void)
Definition: tm-queuehandlers.c:39
RUNMODE_PRINT_BUILDINFO
@ RUNMODE_PRINT_BUILDINFO
Definition: runmodes.h:51
DetectEngineCtxInitStubForDD
DetectEngineCtx * DetectEngineCtxInitStubForDD(void)
Definition: detect-engine.c:2550
LiveDevRegisterExtension
void LiveDevRegisterExtension(void)
Definition: util-device.c:465
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
AppLayerHtpPrintStats
void AppLayerHtpPrintStats(void)
Definition: app-layer-htp.c:2625
util-hugepages.h
StatsSetupPostConfigPreOutput
void StatsSetupPostConfigPreOutput(void)
Definition: counters.c:895
SCInstance_::runmode_custom_mode
char * runmode_custom_mode
Definition: suricata.h:134
util-coredump-config.h
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
SigTableSetup
void SigTableSetup(void)
Definition: detect-engine-register.c:477
TmModuleReceiveNFQRegister
void TmModuleReceiveNFQRegister(void)
Definition: source-nfq.c:169
LiveBuildDeviceList
int LiveBuildDeviceList(const char *runmode)
Definition: util-device.c:274
RunModeShutDown
void RunModeShutDown(void)
Definition: runmodes.c:581
SuricataInit
void SuricataInit(void)
Definition: suricata.c:2908
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:86
SCProtoNameInit
void SCProtoNameInit(void)
Definition: util-proto-name.c:417
SuricataPostInit
void SuricataPostInit(void)
Definition: suricata.c:3002
ippair-bit.h
RunModeDispatch
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
Definition: runmodes.c:412
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
util-macset.h
RUNMODE_LIST_RUNMODES
@ RUNMODE_LIST_RUNMODES
Definition: runmodes.h:49
sigint_count
volatile sig_atomic_t sigint_count
Definition: suricata.c:155
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(unsigned int, engine_stage)
SCProfilingRulesGlobalInit
void SCProfilingRulesGlobalInit(void)
TmModuleRunDeInit
void TmModuleRunDeInit(void)
Definition: tm-modules.c:136
RegisterFlowBypassInfo
void RegisterFlowBypassInfo(void)
Definition: flow-util.c:229
SCSetThreadName
#define SCSetThreadName(n)
Definition: threads.h:303
SCRunmodeSet
void SCRunmodeSet(int run_mode)
Set the current run mode.
Definition: suricata.c:267
sc_set_caps
bool sc_set_caps
Definition: suricata.c:188
SCLogDeInitLogModule
void SCLogDeInitLogModule(void)
De-Initializes the logging module.
Definition: util-debug.c:1597
LiveDevice_
Definition: util-device.h:50
util-pidfile.h
TmModuleDecodeErfFileRegister
void TmModuleDecodeErfFileRegister(void)
Register the ERF file decoder module.
Definition: source-erf-file.c:98
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:850
StringParseUint16
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:337
DetectEngineReloadSetIdle
void DetectEngineReloadSetIdle(void)
Definition: detect-engine.c:2061
SCInstance_::userid
uint32_t userid
Definition: suricata.h:141
RUNMODE_ERF_FILE
@ RUNMODE_ERF_FILE
Definition: runmodes.h:35
source-windivert-prototypes.h
SURI_HOST_IS_SNIFFER_ONLY
@ SURI_HOST_IS_SNIFFER_ONLY
Definition: suricata.h:115
SURI_HOST_IS_ROUTER
@ SURI_HOST_IS_ROUTER
Definition: suricata.h:116
DetectEngineGetCurrent
DetectEngineCtx * DetectEngineGetCurrent(void)
Definition: detect-engine.c:3768
EngineModeIsUnknown
int EngineModeIsUnknown(void)
Definition: suricata.c:225
VarNameStoreInit
void VarNameStoreInit(void)
TmModuleFlowRecyclerRegister
void TmModuleFlowRecyclerRegister(void)
Definition: flow-manager.c:1242
g_skip_prefilter
int g_skip_prefilter
Definition: detect-engine-mpm.c:1067
Daemonize
void Daemonize(void)
Daemonize the process.
Definition: util-daemon.c:101
UtilSignalHandlerSetup
void UtilSignalHandlerSetup(int sig, void(*handler)(int))
Definition: util-signal.c:60
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
TmModuleDecodeAFPRegister
void TmModuleDecodeAFPRegister(void)
Registration Function for DecodeAFP.
Definition: source-af-packet.c:602
RUNMODE_NFLOG
@ RUNMODE_NFLOG
Definition: runmodes.h:33
TmModuleDecodeWinDivertRegister
void TmModuleDecodeWinDivertRegister(void)
Definition: source-windivert.c:74
SURICATA_STOP
#define SURICATA_STOP
Definition: suricata.h:89
FlowForceReassembly
void FlowForceReassembly(void)
Force reassembly for all the flows that have unprocessed segments.
Definition: flow-timeout.c:417
DetectEngineAddToMaster
int DetectEngineAddToMaster(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:4580
TmModuleStatsLoggerRegister
void TmModuleStatsLoggerRegister(void)
Definition: output-stats.c:189
ConfYamlHandleInclude
int ConfYamlHandleInclude(ConfNode *parent, const char *filename)
Include a file in the configuration.
Definition: conf-yaml-loader.c:114
RegisterAllModules
void RegisterAllModules(void)
Definition: suricata.c:891
ENGINE_MODE_IPS
@ ENGINE_MODE_IPS
Definition: suricata.h:104
RUNMODE_PCAP_DEV
@ RUNMODE_PCAP_DEV
Definition: runmodes.h:29
DetectEngineMultiTenantSetup
int DetectEngineMultiTenantSetup(const bool unix_socket)
setup multi-detect / multi-tenancy
Definition: detect-engine.c:4217
flow-bit.h
SupportFastPatternForSigMatchTypes
void SupportFastPatternForSigMatchTypes(void)
Registers the keywords(SMs) that should be given fp support.
Definition: detect-fast-pattern.c:142
util-var-name.h
ConfDump
void ConfDump(void)
Dump configuration to stdout.
Definition: conf.c:746
suricata_context
const SuricataContext suricata_context
Definition: rust-context.c:25
SCParseCommandLine
TmEcode SCParseCommandLine(int argc, char **argv)
Definition: suricata.c:1318
SCPledge
#define SCPledge(...)
Definition: util-privs.h:99
CheckValidDaemonModes
int CheckValidDaemonModes(int daemon, int mode)
Check for a valid combination daemon/mode.
Definition: util-daemon.c:177
SCGetGroupID
void SCGetGroupID(const char *group_name, uint32_t *gid)
Function to get the group ID from the specified group name.
Definition: util-privs.c:213
ConfSetFinal
int ConfSetFinal(const char *name, const char *val)
Set a final configuration value.
Definition: conf.c:303
unittests_fatal
int unittests_fatal
Definition: util-unittest.c:52
TmThreadDisableReceiveThreads
void TmThreadDisableReceiveThreads(void)
Disable all threads having the specified TMs.
Definition: tm-threads.c:1349
StatsInit
void StatsInit(void)
Initializes the perf counter api. Things are hard coded currently. More work to be done when we imple...
Definition: counters.c:885
util-privs.h
PreRunInit
void PreRunInit(const int runmode)
Definition: suricata.c:2220
RUNMODE_LIST_KEYWORDS
@ RUNMODE_LIST_KEYWORDS
Definition: runmodes.h:47
SURICATA_DONE
#define SURICATA_DONE
Definition: suricata.h:91
MacSetRegisterFlowStorage
void MacSetRegisterFlowStorage(void)
Definition: util-macset.c:62
SuricataShutdown
void SuricataShutdown(void)
Definition: suricata.c:2991
SCInstance_::conf_filename
const char * conf_filename
Definition: suricata.h:160
GetIfaceMTU
int GetIfaceMTU(const char *dev)
output the link MTU
Definition: util-ioctl.c:81
RUNMODE_NAPATECH
@ RUNMODE_NAPATECH
Definition: runmodes.h:42
GlobalsInitPreConfig
void GlobalsInitPreConfig(void)
Definition: suricata.c:360
TmModuleReceiveNetmapRegister
void TmModuleReceiveNetmapRegister(void)
Definition: source-netmap.c:74
PacketPoolPostRunmodes
void PacketPoolPostRunmodes(void)
Set the max_pending_return_packets value.
Definition: tmqh-packetpool.c:462
NFQInitConfig
void NFQInitConfig(bool quiet)
To initialize the NFQ global configuration data.
Definition: source-nfq.c:206
TmModuleReceiveWinDivertRegister
void TmModuleReceiveWinDivertRegister(void)
Definition: source-windivert.c:61
SystemHugepageSnapshot
Definition: util-hugepages.h:44
TmModuleReceivePfringRegister
void TmModuleReceivePfringRegister(void)
Registration Function for ReceivePfring.
Definition: source-pfring.c:163
HOST_VERBOSE
#define HOST_VERBOSE
Definition: host.h:92
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
SCProfilingDestroy
void SCProfilingDestroy(void)
Free resources used by profiling.
Definition: util-profiling.c:263
IsRunModeOffline
bool IsRunModeOffline(enum RunModes run_mode_to_check)
Definition: runmodes.c:563
AFPPeersListClean
void AFPPeersListClean(void)
Clean the global peers list.
Definition: source-af-packet.c:584
RunModeInitializeOutputs
void RunModeInitializeOutputs(void)
Definition: runmodes.c:780
DetectPortTestConfVars
int DetectPortTestConfVars(void)
Definition: detect-engine-port.c:1106
SCThresholdConfGlobalInit
void SCThresholdConfGlobalInit(void)
Definition: util-threshold-config.c:97
DecodeUnregisterCounters
void DecodeUnregisterCounters(void)
Definition: decode.c:576
SCInstance_::capture_plugin_name
const char * capture_plugin_name
Definition: suricata.h:164
RUNMODE_DAG
@ RUNMODE_DAG
Definition: runmodes.h:36
HostBitInitCtx
void HostBitInitCtx(void)
Definition: host-bit.c:49
EngineMode
EngineMode
Definition: suricata.h:101
SCInstance_::set_datadir
bool set_datadir
Definition: suricata.h:146
tmqh-packetpool.h
g_ut_covered
int g_ut_covered
Definition: suricata.c:889
SCInstance_::capture_plugin_args
const char * capture_plugin_args
Definition: suricata.h:165
TmModuleLoggerRegister
void TmModuleLoggerRegister(void)
Definition: output.c:892
TmThreadDisablePacketThreads
void TmThreadDisablePacketThreads(void)
Disable all packet threads.
Definition: tm-threads.c:1478
host_mode
uint8_t host_mode
Definition: suricata.c:179
RUNMODE_NETMAP
@ RUNMODE_NETMAP
Definition: runmodes.h:39
RUNMODE_DUMP_FEATURES
@ RUNMODE_DUMP_FEATURES
Definition: runmodes.h:62
FeatureDump
void FeatureDump(void)
Definition: feature.c:144
PacketPoolInit
void PacketPoolInit(void)
Definition: tmqh-packetpool.c:246
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
AppLayerDeSetup
int AppLayerDeSetup(void)
De initializes the app layer.
Definition: app-layer.c:1046
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
PcapTranslateIPToDevice
void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
Definition: source-pcap.c:656
FlowDisableFlowRecyclerThread
void FlowDisableFlowRecyclerThread(void)
Used to disable flow recycler thread(s).
Definition: flow-manager.c:1170
ParseSizeInit
void ParseSizeInit(void)
Definition: util-misc.c:35
TVT_PPT
@ TVT_PPT
Definition: tm-threads-common.h:91
TmModuleDecodePcapFileRegister
void TmModuleDecodePcapFileRegister(void)
Definition: source-pcap-file.c:128
TmModuleBypassedFlowManagerRegister
void TmModuleBypassedFlowManagerRegister(void)
Definition: flow-bypass.c:222
IPPairShutdown
void IPPairShutdown(void)
shutdown the flow engine
Definition: ippair.c:293
source-erf-dag.h
util-signal.h
DetectParseFreeRegexes
void DetectParseFreeRegexes(void)
Definition: detect-parse.c:2672
TmModuleDecodeNFLOGRegister
void TmModuleDecodeNFLOGRegister(void)
Definition: source-nflog.c:55
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
NFQParseAndRegisterQueues
int NFQParseAndRegisterQueues(const char *queues)
Parses and adds Netfilter queue(s).
Definition: source-nfq.c:879
ConfGetRootNode
ConfNode * ConfGetRootNode(void)
Get the root configuration node.
Definition: conf.c:207
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:524
AppLayerSetup
int AppLayerSetup(void)
Setup the app layer.
Definition: app-layer.c:1031
FeatureTrackingRegister
void FeatureTrackingRegister(void)
Definition: feature.c:152
TmModuleReceiveDPDKRegister
void TmModuleReceiveDPDKRegister(void)
Definition: source-dpdk.c:50
UnixManagerThreadSpawnNonRunmode
void UnixManagerThreadSpawnNonRunmode(const bool unix_socket_enabled)
Definition: unix-manager.c:1283
RunModeInitializeThreadSettings
void RunModeInitializeThreadSettings(void)
Definition: runmodes.c:965
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:461
ENGINE_MODE_UNKNOWN
@ ENGINE_MODE_UNKNOWN
Definition: suricata.h:102
app-layer-htp.h
IsRunModeSystem
bool IsRunModeSystem(enum RunModes run_mode_to_check)
Definition: runmodes.c:550
datasets.h
GetIfaceMaxPacketSize
int GetIfaceMaxPacketSize(LiveDevice *ld)
output max packet size for a link
Definition: util-ioctl.c:120
TmModuleDecodeNetmapRegister
void TmModuleDecodeNetmapRegister(void)
Registration Function for DecodeNetmap.
Definition: source-netmap.c:84
PreRunPostPrivsDropInit
void PreRunPostPrivsDropInit(const int runmode)
Definition: suricata.c:2249
feature.h
decode.h
util-device.h
SigTableCleanup
void SigTableCleanup(void)
Definition: detect-engine-register.c:468
DetectEngineMoveToFreeList
int DetectEngineMoveToFreeList(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:4640
sigterm_count
volatile sig_atomic_t sigterm_count
Definition: suricata.c:157
source-nfq.h
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
TmThreadWaitOnThreadInit
TmEcode TmThreadWaitOnThreadInit(void)
Used to check if all threads have finished their initialization. On finding an un-initialized thread,...
Definition: tm-threads.c:1954
TmModuleVerdictNFQRegister
void TmModuleVerdictNFQRegister(void)
Definition: source-nfq.c:184
ConfYamlLoadFile
int ConfYamlLoadFile(const char *filename)
Load configuration from a YAML file.
Definition: conf-yaml-loader.c:473
RUNMODE_CONF_TEST
@ RUNMODE_CONF_TEST
Definition: runmodes.h:54
AppLayerRegisterGlobalCounters
void AppLayerRegisterGlobalCounters(void)
HACK to work around our broken unix manager (re)init loop.
Definition: app-layer.c:1109
RunModeListRunmodes
void RunModeListRunmodes(void)
Lists all registered runmodes.
Definition: runmodes.c:255
RUNMODE_PRINT_USAGE
@ RUNMODE_PRINT_USAGE
Definition: runmodes.h:52
strlcat
size_t strlcat(char *, const char *src, size_t siz)
Definition: util-strlcatu.c:45
RUNMODE_LIST_APP_LAYERS
@ RUNMODE_LIST_APP_LAYERS
Definition: runmodes.h:48
util-cpu.h
suricata
SCInstance suricata
Definition: suricata.c:218
SCInstance_::unix_socket_enabled
bool unix_socket_enabled
Definition: suricata.h:147
LiveSetOffloadDisable
void LiveSetOffloadDisable(void)
Definition: util-device.c:71
StatsSetupPostConfigPostOutput
void StatsSetupPostConfigPostOutput(void)
Definition: counters.c:900
EngineModeSetIDS
void EngineModeSetIDS(void)
Definition: suricata.c:247
SpmTableSetup
void SpmTableSetup(void)
Definition: util-spm.c:122
TmModuleReceiveAFPRegister
void TmModuleReceiveAFPRegister(void)
Registration Function for RecieveAFP.
Definition: source-af-packet.c:384
LiveBuildDeviceListCustom
int LiveBuildDeviceListCustom(const char *runmode, const char *itemname)
Definition: util-device.c:279
util-exception-policy.h
LiveGetDevice
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:248
UnixSocketKillSocketThread
void UnixSocketKillSocketThread(void)
Definition: unix-manager.c:1279
TmModuleVerdictIPFWRegister
void TmModuleVerdictIPFWRegister(void)
Registration Function for VerdictIPFW.
Definition: source-ipfw.c:171
flow-worker.h
g_stats_eps_per_app_proto_errors
bool g_stats_eps_per_app_proto_errors
Definition: suricata.c:215
HttpRangeContainersInit
void HttpRangeContainersInit(void)
Definition: app-layer-htp-range.c:150
util-reference-config.h
source-napatech.h
DetectEngineCtx_::last_reload
struct timeval last_reload
Definition: detect.h:1021
SCInstance_::delayed_detect
int delayed_detect
Definition: suricata.h:149
TmModuleVerdictWinDivertRegister
void TmModuleVerdictWinDivertRegister(void)
Definition: source-windivert.c:68
DetectEngineCtx_::failure_fatal
bool failure_fatal
Definition: detect.h:851
SCInstance_::progname
const char * progname
Definition: suricata.h:159
HostCleanup
void HostCleanup(void)
Cleanup the host engine.
Definition: host.c:332
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
FlowDisableFlowManagerThread
void FlowDisableFlowManagerThread(void)
Used to disable flow manager thread(s).
Definition: flow-manager.c:129
util-ebpf.h
SCInstance_::pcap_dev
char pcap_dev[128]
Definition: suricata.h:127
detect.h
UtilSignalUnblock
int UtilSignalUnblock(int signum)
Definition: util-signal.c:46
DetectEngineEnabled
int DetectEngineEnabled(void)
Check if detection is enabled.
Definition: detect-engine.c:3735
TmThreadClearThreadsFamily
void TmThreadClearThreadsFamily(int family)
Definition: tm-threads.c:1627
TmModuleRunInit
void TmModuleRunInit(void)
Definition: tm-modules.c:118
detect-engine-port.h
EngineModeSetIPS
void EngineModeSetIPS(void)
Definition: suricata.c:242
SCInstance_::user_name
const char * user_name
Definition: suricata.h:136
HTPAtExitPrintStats
void HTPAtExitPrintStats(void)
Print the stats of the HTTP requests.
Definition: app-layer-htp.c:1647
util-time.h
UtilSignalBlock
int UtilSignalBlock(int signum)
Definition: util-signal.c:29
SCProfilingPrefilterGlobalInit
void SCProfilingPrefilterGlobalInit(void)
Definition: util-profiling-prefilter.c:60
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
PostConfLoadedSetup
int PostConfLoadedSetup(SCInstance *suri)
Definition: suricata.c:2632
GetProgramVersion
const char * GetProgramVersion(void)
get string with program version
Definition: suricata.c:1135
engine_analysis
int engine_analysis
app-layer-parser.h
TmModuleReceivePcapFileRegister
void TmModuleReceivePcapFileRegister(void)
Definition: source-pcap-file.c:115
source-pfring.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
runmode-netmap.h
CoredumpLoadConfig
int32_t CoredumpLoadConfig(void)
Configures the core dump size.
Definition: util-coredump-config.c:90
detect-engine-tag.h
IPFWRegisterQueue
int IPFWRegisterQueue(char *queue)
Add an IPFW divert.
Definition: source-ipfw.c:698
xstr
#define xstr(s)
Definition: suricata-common.h:290
util-profiling.h
ListAppLayerProtocols
int ListAppLayerProtocols(const char *conf_filename)
Definition: util-running-modes.c:43
SCInstance_::offline
int offline
Definition: suricata.h:152
DatasetsDestroy
void DatasetsDestroy(void)
Definition: datasets.c:988
UtilCpuPrintSummary
void UtilCpuPrintSummary(void)
Print a summary of CPUs detected (configured and online)
Definition: util-cpu.c:140
SystemDNotifyReady
int SystemDNotifyReady(void)
TmThreadKillThreads
void TmThreadKillThreads(void)
Definition: tm-threads.c:1557
OutputDeregisterAll
void OutputDeregisterAll(void)
Deregister all modules. Useful for a memory clean exit.
Definition: output.c:675
source-pcap-file-helper.h
PostConfLoadedDetectSetup
void PostConfLoadedDetectSetup(SCInstance *suri)
Definition: suricata.c:2541
EngineModeIsIDS
int EngineModeIsIDS(void)
Definition: suricata.c:236
util-systemd.h
TmModuleNapatechDecodeRegister
void TmModuleNapatechDecodeRegister(void)
Register the Napatech decoder module.
Definition: source-napatech.c:192
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
conf-yaml-loader.h
decode-sll.h
coverage_unittests
int coverage_unittests
Definition: suricata.c:887
RUNMODE_DUMP_CONFIG
@ RUNMODE_DUMP_CONFIG
Definition: runmodes.h:53
DatasetsSave
void DatasetsSave(void)
Definition: datasets.c:1066
detect-engine-alert.h
conf.h
util-landlock.h
source-ipfw.h
TMM_SIZE
@ TMM_SIZE
Definition: tm-threads-common.h:79
source-netmap.h
OutputNotifyFileRotation
void OutputNotifyFileRotation(void)
Notifies all registered file rotation notification flags.
Definition: output.c:745
StorageFinalize
int StorageFinalize(void)
Definition: util-storage.c:138
VarNameStoreDestroy
void VarNameStoreDestroy(void)
Definition: util-var-name.c:116
SCInstance_::verbose
int verbose
Definition: suricata.h:153
TmEcode
TmEcode
Definition: tm-threads-common.h:83
source-windivert.h
TmModuleFlowWorkerRegister
void TmModuleFlowWorkerRegister(void)
Definition: flow-worker.c:774
SCInstance_::aux_run_mode
enum RunModes aux_run_mode
Definition: suricata.h:125
util-plugin.h
SCInstance_::additional_configs
const char ** additional_configs
Definition: suricata.h:161
flow-timeout.h
DEFAULT_PID_FILENAME
#define DEFAULT_PID_FILENAME
Definition: suricata.h:83
sighup_count
volatile sig_atomic_t sighup_count
Definition: suricata.c:156
ConfigSetDataDirectory
TmEcode ConfigSetDataDirectory(char *name)
Definition: util-conf.c:66
TmModuleDecodeErfDagRegister
void TmModuleDecodeErfDagRegister(void)
Register the ERF file decoder module.
Definition: source-erf-dag.c:151
SCInstance_::set_logdir
bool set_logdir
Definition: suricata.h:145
SCDropMainThreadCaps
#define SCDropMainThreadCaps(...)
Definition: util-privs.h:90
TmModuleDebugList
void TmModuleDebugList(void)
Definition: tm-modules.c:35
TmModuleDecodeNFQRegister
void TmModuleDecodeNFQRegister(void)
Definition: source-nfq.c:192
util-proto-name.h
STREAM_VERBOSE
#define STREAM_VERBOSE
Definition: stream-tcp.h:35
defrag.h
SCProtoNameRelease
void SCProtoNameRelease(void)
Definition: util-proto-name.c:438
MpmTableSetup
void MpmTableSetup(void)
Definition: util-mpm.c:225
SCInstance_::log_dir
const char * log_dir
Definition: suricata.h:158
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:253
source-nfq-prototypes.h
SCPluginsLoad
void SCPluginsLoad(const char *capture_plugin_name, const char *capture_plugin_args)
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
TmModuleReceiveNFLOGRegister
void TmModuleReceiveNFLOGRegister(void)
Definition: source-nflog.c:49
DEFAULT_PACKET_SIZE
#define DEFAULT_PACKET_SIZE
Definition: decode.h:682
WarnInvalidConfEntry
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
Definition: util-misc.h:35
util-host-os-info.h
TmModuleReceiveErfFileRegister
void TmModuleReceiveErfFileRegister(void)
Register the ERF file receiver (reader) module.
Definition: source-erf-file.c:80
TmModule_
Definition: tm-modules.h:44
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
TmModuleDecodeAFXDPRegister
void TmModuleDecodeAFXDPRegister(void)
Registration Function for DecodeAFXDP.
Definition: source-af-xdp.c:91
default_packet_size
uint32_t default_packet_size
Definition: decode.c:77
tm-queuehandlers.h
SigTableApplyStrictCommandLineOption
void SigTableApplyStrictCommandLineOption(const char *str)
Definition: detect-parse.c:392
DETECT_ENGINE_TYPE_NORMAL
@ DETECT_ENGINE_TYPE_NORMAL
Definition: detect.h:837
PROG_NAME
#define PROG_NAME
Definition: suricata.h:70
TmThreadKillThreadsFamily
void TmThreadKillThreadsFamily(int family)
Definition: tm-threads.c:1528
detect-fast-pattern.h
FeatureTrackingRelease
void FeatureTrackingRelease(void)
Definition: feature.c:136
TmqhCleanup
void TmqhCleanup(void)
Clean up registration time allocs.
Definition: tm-queuehandlers.c:49
util-dpdk.h
util-conf.h
RUNMODE_PFRING
@ RUNMODE_PFRING
Definition: runmodes.h:31
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:792
source-dpdk.h
flow-manager.h
DecodeGlobalConfig
void DecodeGlobalConfig(void)
Definition: decode.c:999
SCInstance_::strict_rule_parsing_string
char * strict_rule_parsing_string
Definition: suricata.h:162
SuriHasSigFile
int SuriHasSigFile(void)
Definition: suricata.c:220
suricata-common.h
DetectEngineCtxInitStubForMT
DetectEngineCtx * DetectEngineCtxInitStubForMT(void)
Definition: detect-engine.c:2545
util-path.h
util-daemon.h
LiveGetDeviceName
const char * LiveGetDeviceName(int number)
Get a pointer to the device name at idx.
Definition: util-device.c:184
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:671
SCHInfoLoadFromConfig
void SCHInfoLoadFromConfig(void)
Load the host os policy information from the configuration.
Definition: util-host-os-info.c:331
DetectEngineBumpVersion
void DetectEngineBumpVersion(void)
Definition: detect-engine.c:3759
source-af-xdp.h
TmModuleFlowManagerRegister
void TmModuleFlowManagerRegister(void)
Definition: flow-manager.c:1228
SCStartInternalRunMode
int SCStartInternalRunMode(int argc, char **argv)
Definition: suricata.c:2318
SCPidfileTestRunning
int SCPidfileTestRunning(const char *pid_filename)
Check the Suricata pid file (used at the startup)
Definition: util-pidfile.c:105
HostShutdown
void HostShutdown(void)
shutdown the flow engine
Definition: host.c:296
DOC_URL
#define DOC_URL
Definition: suricata.h:85
SCFstatFn
#define SCFstatFn(fd, statbuf)
Definition: util-path.h:34
output-filestore.h
TmModuleDecodePfringRegister
void TmModuleDecodePfringRegister(void)
Registration Function for DecodePfring.
Definition: source-pfring.c:179
LiveSetOffloadWarn
void LiveSetOffloadWarn(void)
Definition: util-device.c:76
ParseSizeDeinit
void ParseSizeDeinit(void)
Definition: util-misc.c:54
util-classification-config.h
RunModeRegisterRunModes
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
Definition: runmodes.c:228
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
FatalError
#define FatalError(...)
Definition: util-debug.h:502
ConfGetChildValueBool
int ConfGetChildValueBool(const ConfNode *base, const char *name, int *val)
Definition: conf.c:500
SCProfilingDump
void SCProfilingDump(void)
Definition: util-profiling.c:289
TmModuleReceiveAFXDPRegister
void TmModuleReceiveAFXDPRegister(void)
Definition: source-af-xdp.c:77
EngineStop
void EngineStop(void)
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be a...
Definition: suricata.c:446
FrameConfigInit
void FrameConfigInit(void)
Definition: app-layer-frames.c:38
SCInstance_::sig_file
char * sig_file
Definition: suricata.h:128
ParseSizeStringU32
int ParseSizeStringU32(const char *size, uint32_t *res)
Definition: util-misc.c:181
TmModuleReceiveErfDagRegister
void TmModuleReceiveErfDagRegister(void)
Register the ERF file receiver (reader) module.
Definition: source-erf-dag.c:133
IPPairBitInitCtx
void IPPairBitInitCtx(void)
Definition: ippair-bit.c:49
ConfigSetLogDirectory
TmEcode ConfigSetLogDirectory(const char *name)
Definition: util-conf.c:33
util-validate.h
TmModuleDecodeIPFWRegister
void TmModuleDecodeIPFWRegister(void)
Registration Function for DecodeIPFW.
Definition: source-ipfw.c:186
source-af-packet.h
ConfUnixSocketIsEnable
int ConfUnixSocketIsEnable(void)
Definition: util-conf.c:136
RUNMODE_NFQ
@ RUNMODE_NFQ
Definition: runmodes.h:32
ConfSetFromString
int ConfSetFromString(const char *input, int final)
Set a configuration parameter from a string.
Definition: conf.c:249
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
g_vlan_mask
uint16_t g_vlan_mask
Definition: suricata.c:201
ConfInit
void ConfInit(void)
Initialize the configuration system.
Definition: conf.c:120
TVT_MGMT
@ TVT_MGMT
Definition: tm-threads-common.h:92
DatasetsInit
int DatasetsInit(void)
Definition: datasets.c:854
ConfigGetLogDirectory
const char * ConfigGetLogDirectory(void)
Definition: util-conf.c:38
sigusr2_count
volatile sig_atomic_t sigusr2_count
Definition: suricata.c:158
SystemHugepageSnapshotDestroy
void SystemHugepageSnapshotDestroy(SystemHugepageSnapshot *s)
Definition: util-hugepages.c:304
RUNMODE_ENGINE_ANALYSIS
@ RUNMODE_ENGINE_ANALYSIS
Definition: runmodes.h:56
RUNMODE_PRINT_VERSION
@ RUNMODE_PRINT_VERSION
Definition: runmodes.h:50
TmModuleDecodePcapRegister
void TmModuleDecodePcapRegister(void)
Registration Function for DecodePcap.
Definition: source-pcap.c:153
util-running-modes.h
SCLoadYamlConfig
TmEcode SCLoadYamlConfig(void)
Definition: suricata.c:959
unix-manager.h
runmode-af-xdp.h
str
#define str(s)
Definition: suricata-common.h:291
ConfigCheckDataDirectory
TmEcode ConfigCheckDataDirectory(const char *data_dir)
Definition: util-conf.c:99
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
g_detect_disabled
int g_detect_disabled
Definition: suricata.c:185
DetectEngineReloadStart
int DetectEngineReloadStart(void)
Definition: detect-engine.c:2035
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DEFAULT_CONF_FILE
#define DEFAULT_CONF_FILE
Definition: suricata.h:79
ConfNode_
Definition: conf.h:32
SC_LOG_MAX_LOG_MSG_LEN
#define SC_LOG_MAX_LOG_MSG_LEN
Definition: util-debug.h:84
AppLayerParserPostStreamSetup
void AppLayerParserPostStreamSetup(void)
Definition: app-layer-parser.c:260
TmModuleReceivePcapRegister
void TmModuleReceivePcapRegister(void)
Registration Function for ReceivePcap.
Definition: source-pcap.c:135
SCGetUserID
void SCGetUserID(const char *user_name, const char *group_name, uint32_t *uid, uint32_t *gid)
Function to get the user and group ID from the specified user name.
Definition: util-privs.c:146
util-ioctl.h
detect-parse.h
SCInstance_::system
bool system
Definition: suricata.h:144
SCInstance_::pid_filename
char * pid_filename
Definition: suricata.h:130
TmModuleRespondRejectRegister
void TmModuleRespondRejectRegister(void)
Definition: respond-reject.c:50
CoredumpEnable
void CoredumpEnable(void)
Enable coredumps on systems where coredumps can and need to be enabled.
Definition: util-coredump-config.c:57
RunUnittests
void RunUnittests(int list_unittests, const char *regex_arg)
Definition: runmode-unittests.c:229
source-erf-file.h
ConfigCheckLogDirectoryExists
TmEcode ConfigCheckLogDirectoryExists(const char *log_dir)
Definition: util-conf.c:56
TimeDeinit
void TimeDeinit(void)
Definition: util-time.c:87
PacketAlertTagInit
void PacketAlertTagInit(void)
Definition: detect-engine-alert.c:45
RunModeEngineIsIPS
int RunModeEngineIsIPS(int capture_mode, const char *runmode, const char *capture_plugin_name)
Definition: runmodes.c:382
SURICATA_RUNTIME
@ SURICATA_RUNTIME
Definition: suricata.h:96
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2555
RUNMODE_WINDIVERT
@ RUNMODE_WINDIVERT
Definition: runmodes.h:44
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:230
TmModuleNapatechStreamRegister
void TmModuleNapatechStreamRegister(void)
Register the Napatech receiver (reader) module.
Definition: source-napatech.c:174
SCProfilingKeywordsGlobalInit
void SCProfilingKeywordsGlobalInit(void)
Definition: util-profiling-keywords.c:60
suricata.h
EngineDone
void EngineDone(void)
Used to indicate that the current task is done.
Definition: suricata.c:457
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:43
GetDocURL
const char * GetDocURL(void)
Definition: suricata.c:1114
util-mpm-hs.h
profiling_rules_enabled
int profiling_rules_enabled
PostRunDeinit
void PostRunDeinit(const int runmode, struct timeval *start_time)
Definition: suricata.c:2271
HostInitConfig
void HostInitConfig(bool quiet)
initialize the configuration
Definition: host.c:168
TmThreadWaitOnThreadRunning
TmEcode TmThreadWaitOnThreadRunning(void)
Waits for all threads to be in a running state.
Definition: tm-threads.c:1846
ConfDeInit
void ConfDeInit(void)
De-initializes the configuration system.
Definition: conf.c:688
HttpRangeContainersDestroy
void HttpRangeContainersDestroy(void)
Definition: app-layer-htp-range.c:183
ConfSet
int ConfSet(const char *name, const char *val)
Set a configuration value.
Definition: conf.c:224
SCLogLoadConfig
void SCLogLoadConfig(int daemon, int verbose, uint32_t userid, uint32_t groupid)
Definition: util-debug.c:1420
DetectEngineReload
int DetectEngineReload(const SCInstance *suri)
Reload the detection engine.
Definition: detect-engine.c:4707
DEFAULT_MAX_PENDING_PACKETS
#define DEFAULT_MAX_PENDING_PACKETS
Definition: suricata.c:168
SCInstance_
Definition: suricata.h:123
DetectEngineClearMaster
void DetectEngineClearMaster(void)
Definition: detect-engine.c:4680
SetMasterExceptionPolicy
void SetMasterExceptionPolicy(void)
Definition: util-exception-policy.c:59
TmThreadCheckThreadState
void TmThreadCheckThreadState(void)
Used to check the thread for certain conditions of failure.
Definition: tm-threads.c:1931
OutputFilestoreRegisterGlobalCounters
void OutputFilestoreRegisterGlobalCounters(void)
Definition: output-filestore.c:517
InitGlobal
int InitGlobal(void)
Global initialization common to all runmodes.
Definition: suricata.c:2862
SCInstance_::disabled_detect
int disabled_detect
Definition: suricata.h:150
LiveGetDeviceCount
int LiveGetDeviceCount(void)
Get the number of registered devices.
Definition: util-device.c:164
SystemHugepageSnapshotCreate
SystemHugepageSnapshot * SystemHugepageSnapshotCreate(void)
The function creates a snapshot of the system's hugepage usage per NUMA node and per hugepage size....
Definition: util-hugepages.c:323
SCProfilingSghsGlobalInit
void SCProfilingSghsGlobalInit(void)
Definition: util-profiling-rulegroups.c:63
SCPidfileCreate
int SCPidfileCreate(const char *pidfile)
Write a pid file (used at the startup) This commonly needed by the init scripts.
Definition: util-pidfile.c:42
LiveRegisterDeviceName
int LiveRegisterDeviceName(const char *dev)
Add a device for monitoring.
Definition: util-device.c:97
SCStatFn
#define SCStatFn(pathname, statbuf)
Definition: util-path.h:35
ENGINE_MODE_IDS
@ ENGINE_MODE_IDS
Definition: suricata.h:103
LiveDeviceFinalize
void LiveDeviceFinalize(void)
Definition: util-device.c:442
TmModuleDecodeDPDKRegister
void TmModuleDecodeDPDKRegister(void)
Registration Function for DecodeDPDK.
Definition: source-dpdk.c:64
SCInstance_::sig_file_exclusive
bool sig_file_exclusive
Definition: suricata.h:129
PROG_VER
#define PROG_VER
Definition: suricata.h:71
util-misc.h
PacketPoolDestroy
void PacketPoolDestroy(void)
Definition: tmqh-packetpool.c:277
HTPFreeConfig
void HTPFreeConfig(void)
Clears the HTTP server configuration memory used by HTP library.
Definition: app-layer-htp.c:1660
flow.h
LandlockSandboxing
void LandlockSandboxing(SCInstance *suri)
Definition: util-landlock.c:34
respond-reject.h
SCInstance_::regex_arg
char * regex_arg
Definition: suricata.h:131
ListKeywords
int ListKeywords(const char *keyword_info)
Definition: util-running-modes.c:32
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:237
SuricataPreInit
void SuricataPreInit(const char *progname)
Definition: suricata.c:2899
msg
const char * msg
Definition: app-layer-htp.c:564
DPDKCleanupEAL
void DPDKCleanupEAL(void)
Definition: util-dpdk.c:28
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
RUNMODE_AFP_DEV
@ RUNMODE_AFP_DEV
Definition: runmodes.h:37
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
SURICATA_DEINIT
@ SURICATA_DEINIT
Definition: suricata.h:97
SCPidfileRemove
void SCPidfileRemove(const char *pid_filename)
Remove the pid file (used at the startup)
Definition: util-pidfile.c:83
ThresholdInit
void ThresholdInit(void)
Definition: detect-engine-threshold.c:81
TimeInit
void TimeInit(void)
Definition: util-time.c:79
RUNMODE_PCAP_FILE
@ RUNMODE_PCAP_FILE
Definition: runmodes.h:30
SCInstance_::keyword_info
char * keyword_info
Definition: suricata.h:133
RUNMODE_PLUGIN
@ RUNMODE_PLUGIN
Definition: runmodes.h:45
NFQContextsClean
void NFQContextsClean(void)
Clean global contexts. Must be called on exit.
Definition: source-nfq.c:1300
SystemHugepageEvaluateHugepages
void SystemHugepageEvaluateHugepages(SystemHugepageSnapshot *pre_s, SystemHugepageSnapshot *post_s)
The function compares two hugepage snapshots and prints out recommendations for hugepage configuratio...
Definition: util-hugepages.c:363
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
SCFinalizeRunMode
int SCFinalizeRunMode(void)
Definition: suricata.c:2374
SCStat
struct stat SCStat
Definition: util-path.h:33
SCProfilingInit
void SCProfilingInit(void)
Initialize profiling.
Definition: util-profiling.c:135
g_ut_modules
int g_ut_modules
Definition: suricata.c:888
detect-engine-address.h
RUNMODE_IPFW
@ RUNMODE_IPFW
Definition: runmodes.h:34
GlobalsDestroy
void GlobalsDestroy(void)
Definition: suricata.c:369
output.h
util-threshold-config.h
DefragInit
void DefragInit(void)
Definition: defrag.c:1113
DetectEngineReloadIsStart
int DetectEngineReloadIsStart(void)
Definition: detect-engine.c:2049
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:171
host-bit.h
detect-engine-threshold.h
RUNMODE_LIST_UNITTEST
@ RUNMODE_LIST_UNITTEST
Definition: runmodes.h:55
app-layer.h
TagDestroyCtx
void TagDestroyCtx(void)
Destroy tag context hash tables.
Definition: detect-engine-tag.c:72
DetectAddressTestConfVars
int DetectAddressTestConfVars(void)
Definition: detect-engine-address.c:1217
g_disable_randomness
int g_disable_randomness
Definition: suricata.c:194
geteuid
#define geteuid()
Definition: win32-misc.h:41
MpmHSGlobalCleanup
void MpmHSGlobalCleanup(void)
g_disable_hashing
bool g_disable_hashing
Definition: suricata.c:209
TmqResetQueues
void TmqResetQueues(void)
Definition: tm-queues.c:80