Go to the documentation of this file.
199 #define DEFAULT_MAX_PENDING_PACKETS 1024
230 #ifndef AFLFUZZ_NO_RANDOM
294 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
295 static void SignalHandlerSigint(
int sig)
299 static void SignalHandlerSigterm(
int sig)
305 #define UNW_LOCAL_ONLY
306 #include <libunwind.h>
307 static void SignalHandlerUnexpected(
int sig_num, siginfo_t *info,
void *context)
312 signal(SIGABRT, SIG_DFL);
313 signal(SIGSEGV, SIG_DFL);
315 if ((r = unw_init_local(&cursor, (unw_context_t *)(context)) != 0)) {
316 fprintf(stderr,
"unable to obtain stack trace: unw_init_local: %s\n", unw_strerror(r));
325 if (unw_is_signal_frame(&cursor) == 0) {
328 if (unw_get_proc_name(&cursor, name,
sizeof(name), &off) == UNW_ENOMEM) {
337 r = unw_step(&cursor);
347 kill(getpid(), sig_num);
349 #undef UNW_LOCAL_ONLY
359 static void SignalHandlerSigusr2(
int sig)
369 static void SignalHandlerSigHup(
int sig)
422 #ifdef HAVE_AF_PACKET
430 #ifdef BUILD_HYPERSCAN
436 LuajitFreeStatesPool();
466 static int SetBpfString(
int argc,
char *argv[])
468 char *bpf_filter = NULL;
469 uint32_t bpf_len = 0;
474 while(argv[tmpindex] != NULL) {
475 bpf_len+=strlen(argv[tmpindex]) + 1;
484 "BPF filter not available in IPS mode."
485 " Use firewall filtering if possible.");
492 memset(bpf_filter, 0x00, bpf_len);
495 while(argv[tmpindex] != NULL) {
496 strlcat(bpf_filter, argv[tmpindex],bpf_len);
497 if(argv[tmpindex + 1] != NULL) {
498 strlcat(bpf_filter,
" ", bpf_len);
503 if(strlen(bpf_filter) > 0) {
515 static void SetBpfStringFromFile(
char *filename)
517 char *bpf_filter = NULL;
518 char *bpf_comment_tmp = NULL;
519 char *bpf_comment_start = NULL;
520 uint32_t bpf_len = 0;
531 "BPF filter not available in IPS mode."
532 " Use firewall filtering if possible.");
535 fp = fopen(filename,
"r");
542 if (_fstat(_fileno(fp), &st) != 0) {
544 if (fstat(fileno(fp), &st) != 0) {
549 bpf_len = st.st_size + 1;
551 bpf_filter =
SCMalloc(bpf_len *
sizeof(
char));
556 memset(bpf_filter, 0x00, bpf_len);
558 nm = fread(bpf_filter, 1, bpf_len - 1, fp);
559 if ((ferror(fp) != 0) || (nm != (bpf_len - 1))) {
566 bpf_filter[nm] =
'\0';
568 if(strlen(bpf_filter) > 0) {
570 bpf_comment_start = bpf_filter;
571 while((bpf_comment_tmp = strchr(bpf_comment_start,
'#')) != NULL) {
572 while((*bpf_comment_tmp !=
'\0') &&
573 (*bpf_comment_tmp !=
'\r') && (*bpf_comment_tmp !=
'\n'))
575 *bpf_comment_tmp++ =
' ';
577 bpf_comment_start = bpf_comment_tmp;
580 while((bpf_comment_tmp = strchr(bpf_filter,
'\r')) != NULL) {
581 *bpf_comment_tmp =
' ';
583 while((bpf_comment_tmp = strchr(bpf_filter,
'\n')) != NULL) {
584 *bpf_comment_tmp =
' ';
587 while (strlen(bpf_filter) > 0 &&
588 bpf_filter[strlen(bpf_filter)-1] ==
' ')
590 bpf_filter[strlen(bpf_filter)-1] =
'\0';
592 if (strlen(bpf_filter) > 0) {
603 static void PrintUsage(
const char *progname)
610 printf(
"USAGE: %s [OPTIONS] [BPF FILTER]\n\n", progname);
611 printf(
"\t-c <path> : path to configuration file\n");
612 printf(
"\t-T : test configuration file (use with -c)\n");
613 printf(
"\t-i <dev or ip> : run in pcap live mode\n");
614 printf(
"\t-F <bpf filter file> : bpf filter file\n");
615 printf(
"\t-r <path> : run in pcap file/offline mode\n");
617 printf(
"\t-q <qid[:qid]> : run in inline nfqueue mode (use colon to specify a range of queues)\n");
620 printf(
"\t-d <divert port> : run in inline ipfw divert mode\n");
622 printf(
"\t-s <path> : path to signature file loaded in addition to suricata.yaml settings (optional)\n");
623 printf(
"\t-S <path> : path to signature file loaded exclusively (optional)\n");
624 printf(
"\t-l <dir> : default log directory\n");
626 printf(
"\t-D : run as daemon\n");
628 printf(
"\t--service-install : install as service\n");
629 printf(
"\t--service-remove : remove service\n");
630 printf(
"\t--service-change-params : change service startup parameters\n");
632 printf(
"\t-k [all|none] : force checksum check (all) or disabled it (none)\n");
633 printf(
"\t-V : display Suricata version\n");
634 printf(
"\t-v : be more verbose (use multiple times to increase verbosity)\n");
636 printf(
"\t-u : run the unittests and exit\n");
637 printf(
"\t-U, --unittest-filter=REGEX : filter unittests with a regex\n");
638 printf(
"\t--list-unittests : list unit tests\n");
639 printf(
"\t--fatal-unittests : enable fatal failure on unittest error\n");
640 printf(
"\t--unittests-coverage : display unittest coverage report\n");
642 printf(
"\t--list-app-layer-protos : list supported app layer protocols\n");
643 printf(
"\t--list-keywords[=all|csv|<kword>] : list keywords implemented by the engine\n");
644 printf(
"\t--list-runmodes : list supported runmodes\n");
645 printf(
"\t--runmode <runmode_id> : specific runmode modification the engine should run. The argument\n"
646 "\t supplied should be the id for the runmode obtained by running\n"
647 "\t --list-runmodes\n");
648 printf(
"\t--engine-analysis : print reports on analysis of different sections in the engine and exit.\n"
649 "\t Please have a look at the conf parameter engine-analysis on what reports\n"
650 "\t can be printed\n");
651 printf(
"\t--pidfile <file> : write pid to this file\n");
652 printf(
"\t--init-errors-fatal : enable fatal failure on signature init error\n");
653 printf(
"\t--disable-detection : disable detection engine\n");
654 printf(
"\t--dump-config : show the running configuration\n");
655 printf(
"\t--dump-features : display provided features\n");
656 printf(
"\t--build-info : display build information\n");
657 printf(
"\t--pcap[=<dev>] : run in pcap mode, no value select interfaces from suricata.yaml\n");
658 printf(
"\t--pcap-file-continuous : when running in pcap mode with a directory, continue checking directory for pcaps until interrupted\n");
659 printf(
"\t--pcap-file-delete : when running in replay mode (-r with directory or file), will delete pcap files that have been processed when done\n");
660 printf(
"\t--pcap-file-recursive : will descend into subdirectories when running in replay mode (-r)\n");
661 #ifdef HAVE_PCAP_SET_BUFF
662 printf(
"\t--pcap-buffer-size : size of the pcap buffer value from 0 - %i\n",INT_MAX);
665 printf(
"\t--dpdk : run in dpdk mode, uses interfaces from "
668 #ifdef HAVE_AF_PACKET
669 printf(
"\t--af-packet[=<dev>] : run in af-packet mode, no value select interfaces from suricata.yaml\n");
672 printf(
"\t--netmap[=<dev>] : run in netmap mode, no value select interfaces from suricata.yaml\n");
675 printf(
"\t--pfring[=<dev>] : run in pfring mode, use interfaces from suricata.yaml\n");
676 printf(
"\t--pfring-int <dev> : run in pfring mode, use interface <dev>\n");
677 printf(
"\t--pfring-cluster-id <id> : pfring cluster id \n");
678 printf(
"\t--pfring-cluster-type <type> : pfring cluster type for PF_RING 4.1.2 and later cluster_round_robin|cluster_flow\n");
680 printf(
"\t--simulate-ips : force engine into IPS mode. Useful for QA\n");
681 #ifdef HAVE_LIBCAP_NG
682 printf(
"\t--user <user> : run suricata as this user after init\n");
683 printf(
"\t--group <group> : run suricata as this group after init\n");
685 printf(
"\t--erf-in <path> : process an ERF file\n");
687 printf(
"\t--dag <dagX:Y> : process ERF records from DAG interface X, stream Y\n");
690 printf(
"\t--napatech : run Napatech Streams using the API\n");
692 #ifdef BUILD_UNIX_SOCKET
693 printf(
"\t--unix-socket[=<file>] : use unix socket to control suricata work\n");
696 printf(
"\t--windivert <filter> : run in inline WinDivert mode\n");
697 printf(
"\t--windivert-forward <filter> : run in inline WinDivert mode, as a gateway\n");
700 printf(
"\t--reject-dev <dev> : send reject packets from this interface\n");
702 printf(
"\t--set name=value : set a configuration value\n");
704 printf(
"\nTo run the engine with default configuration on "
705 "interface eth0 with signature file \"signatures.rules\", run the "
706 "command as:\n\n%s -c suricata.yaml -s signatures.rules -i eth0 \n\n",
710 static void PrintBuildInfo(
void)
712 const char *bits =
"<unknown>-bits";
713 const char *endian =
"<unknown>-endian";
714 char features[2048] =
"";
720 strlcat(features,
"DEBUG ",
sizeof(features));
722 #ifdef DEBUG_VALIDATION
723 strlcat(features,
"DEBUG_VALIDATION ",
sizeof(features));
726 strlcat(features,
"UNITTESTS ",
sizeof(features));
729 strlcat(features,
"NFQ ",
sizeof(features));
732 strlcat(features,
"IPFW ",
sizeof(features));
734 #ifdef HAVE_PCAP_SET_BUFF
735 strlcat(features,
"PCAP_SET_BUFF ",
sizeof(features));
738 strlcat(features,
"PF_RING ",
sizeof(features));
740 #ifdef HAVE_AF_PACKET
741 strlcat(features,
"AF_PACKET ",
sizeof(features));
744 strlcat(features,
"NETMAP ",
sizeof(features));
746 #ifdef HAVE_PACKET_FANOUT
747 strlcat(features,
"HAVE_PACKET_FANOUT ",
sizeof(features));
750 strlcat(features,
"DAG ",
sizeof(features));
752 #ifdef HAVE_LIBCAP_NG
753 strlcat(features,
"LIBCAP_NG ",
sizeof(features));
756 strlcat(features,
"LIBNET1.1 ",
sizeof(features));
758 #ifdef HAVE_HTP_URI_NORMALIZE_HOOK
759 strlcat(features,
"HAVE_HTP_URI_NORMALIZE_HOOK ",
sizeof(features));
761 #ifdef PCRE2_HAVE_JIT
762 strlcat(features,
"PCRE_JIT ",
sizeof(features));
765 strlcat(features,
"HAVE_NSS ",
sizeof(features));
767 strlcat(features,
"HTTP2_DECOMPRESSION ",
sizeof(features));
769 strlcat(features,
"HAVE_LUA ",
sizeof(features));
772 strlcat(features,
"HAVE_LUAJIT ",
sizeof(features));
774 strlcat(features,
"HAVE_LIBJANSSON ",
sizeof(features));
776 strlcat(features,
"PROFILING ",
sizeof(features));
778 #ifdef PROFILE_LOCKING
779 strlcat(features,
"PROFILE_LOCKING ",
sizeof(features));
781 #if defined(TLS_C11) || defined(TLS_GNU)
782 strlcat(features,
"TLS ",
sizeof(features));
785 strlcat(features,
"TLS_C11 ",
sizeof(features));
786 #elif defined(TLS_GNU)
787 strlcat(features,
"TLS_GNU ",
sizeof(features));
790 strlcat(features,
"MAGIC ",
sizeof(features));
792 strlcat(features,
"RUST ",
sizeof(features));
793 if (strlen(features) == 0) {
794 strlcat(features,
"none",
sizeof(features));
797 printf(
"Features: %s\n", features);
800 memset(features, 0x00,
sizeof(features));
801 #if defined(__SSE4_2__)
802 strlcat(features,
"SSE_4_2 ",
sizeof(features));
804 #if defined(__SSE4_1__)
805 strlcat(features,
"SSE_4_1 ",
sizeof(features));
807 #if defined(__SSE3__)
808 strlcat(features,
"SSE_3 ",
sizeof(features));
810 if (strlen(features) == 0) {
811 strlcat(features,
"none",
sizeof(features));
813 printf(
"SIMD support: %s\n", features);
816 memset(features, 0x00,
sizeof(features));
817 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_1)
818 strlcat(features,
"1 ",
sizeof(features));
820 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_2)
821 strlcat(features,
"2 ",
sizeof(features));
823 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_4)
824 strlcat(features,
"4 ",
sizeof(features));
826 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_8)
827 strlcat(features,
"8 ",
sizeof(features));
829 #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_16)
830 strlcat(features,
"16 ",
sizeof(features));
832 if (strlen(features) == 0) {
833 strlcat(features,
"none",
sizeof(features));
835 strlcat(features,
"byte(s)",
sizeof(features));
837 printf(
"Atomic intrinsics: %s\n", features);
841 #elif __WORDSIZE == 32
845 #if __BYTE_ORDER == __BIG_ENDIAN
846 endian =
"Big-endian";
847 #elif __BYTE_ORDER == __LITTLE_ENDIAN
848 endian =
"Little-endian";
851 printf(
"%s, %s architecture\n", bits, endian);
853 printf(
"GCC version %s, C version %"PRIiMAX
"\n", __VERSION__, (intmax_t)__STDC_VERSION__);
855 printf(
"C version %"PRIiMAX
"\n", (intmax_t)__STDC_VERSION__);
859 printf(
"compiled with -fstack-protector\n");
862 printf(
"compiled with -fstack-protector-all\n");
871 #if _FORTIFY_SOURCE == 2
872 printf(
"compiled with _FORTIFY_SOURCE=2\n");
873 #elif _FORTIFY_SOURCE == 1
874 printf(
"compiled with _FORTIFY_SOURCE=1\n");
875 #elif _FORTIFY_SOURCE == 0
876 printf(
"compiled with _FORTIFY_SOURCE=0\n");
879 printf(
"L1 cache line size (CLS)=%d\n",
CLS);
882 tls =
"_Thread_local";
883 #elif defined(TLS_GNU)
886 #error "Unsupported thread local"
888 printf(
"thread local storage method: %s\n", tls);
890 printf(
"compiled with %s, linked against %s\n",
891 HTP_VERSION_STRING_FULL, htp_get_version());
893 #include "build-info.h"
983 static TmEcode ParseInterfacesList(
const int runmode,
char *pcap_dev)
989 if (strlen(pcap_dev) == 0) {
999 if (strlen(pcap_dev)) {
1000 if (
ConfSetFinal(
"pfring.live-interface", pcap_dev) != 1) {
1010 char iface_selector[] =
"dpdk.interfaces";
1018 #ifdef HAVE_AF_PACKET
1021 if (strlen(pcap_dev)) {
1022 if (
ConfSetFinal(
"af-packet.live-interface", pcap_dev) != 1) {
1037 if (strlen(pcap_dev)) {
1038 if (
ConfSetFinal(
"netmap.live-interface", pcap_dev) != 1) {
1063 static void SCInstanceInit(
SCInstance *suri,
const char *progname)
1065 memset(suri, 0x00,
sizeof(*suri));
1092 #if HAVE_DETECT_DISABLED==1
1102 if (strstr(prog_ver,
"RELEASE") != NULL) {
1122 if (strstr(
PROG_VER,
"-dev") == NULL) {
1133 static TmEcode PrintVersion(
void)
1141 const char *mode = suri->
system ?
"SYSTEM" :
"USER";
1142 SCLogNotice(
"This is %s version %s running in %s mode",
1153 static void SCPrintElapsedTime(
struct timeval *start_time)
1155 if (start_time == NULL)
1157 struct timeval end_time;
1158 memset(&end_time, 0,
sizeof(end_time));
1159 gettimeofday(&end_time, NULL);
1160 uint64_t milliseconds = ((end_time.tv_sec - start_time->tv_sec) * 1000) +
1161 (((1000000 + end_time.tv_usec - start_time->tv_usec) / 1000) - 1000);
1162 SCLogInfo(
"time elapsed %.3fs", (
float)milliseconds/(
float)1000);
1165 static int ParseCommandLineAfpacket(
SCInstance *suri,
const char *in_arg)
1167 #ifdef HAVE_AF_PACKET
1179 SCLogInfo(
"Multiple af-packet option without interface on each is useless");
1183 "has been specified");
1190 "host, make sure to pass --enable-af-packet to "
1191 "configure when building.");
1196 static int ParseCommandLineDpdk(
SCInstance *suri,
const char *in_arg)
1202 SCLogInfo(
"Multiple dpdk options have no effect on Suricata");
1205 "has been specified");
1212 "host, make sure to pass --enable-dpdk to "
1213 "configure when building.");
1218 static int ParseCommandLinePcapLive(
SCInstance *suri,
const char *in_arg)
1220 #if defined(OS_WIN32) && !defined(HAVE_LIBWPCAP)
1223 "Live capture not available. To support live capture compile against Npcap.");
1227 if (in_arg != NULL) {
1230 if (strlen(in_arg) > 9 && strncmp(in_arg,
"DeviceNPF", 9) == 0) {
1231 snprintf(suri->
pcap_dev,
sizeof(suri->
pcap_dev),
"\\Device\\NPF%s", in_arg+9);
1237 if (strcmp(suri->
pcap_dev, in_arg) != 0) {
1239 }
else if (strlen(suri->
pcap_dev) > 0 && isdigit((
unsigned char)suri->
pcap_dev[0])) {
1254 "has been specified");
1264 static bool IsLogDirectoryWritable(
const char*
str)
1266 if (access(
str, W_OK) == 0)
1275 int dump_config = 0;
1276 int dump_features = 0;
1277 int list_app_layer_protocols = 0;
1278 int list_unittests = 0;
1279 int list_runmodes = 0;
1280 int list_keywords = 0;
1293 struct option long_opts[] = {
1294 {
"dump-config", 0, &dump_config, 1},
1295 {
"dump-features", 0, &dump_features, 1},
1296 {
"pfring", optional_argument, 0, 0},
1297 {
"pfring-int", required_argument, 0, 0},
1298 {
"pfring-cluster-id", required_argument, 0, 0},
1299 {
"pfring-cluster-type", required_argument, 0, 0},
1303 {
"af-packet", optional_argument, 0, 0},
1304 {
"netmap", optional_argument, 0, 0},
1305 {
"pcap", optional_argument, 0, 0},
1306 {
"pcap-file-continuous", 0, 0, 0},
1307 {
"pcap-file-delete", 0, 0, 0},
1308 {
"pcap-file-recursive", 0, 0, 0},
1309 {
"simulate-ips", 0, 0 , 0},
1311 {
"strict-rule-keywords", optional_argument, 0, 0},
1313 {
"capture-plugin", required_argument, 0, 0},
1314 {
"capture-plugin-args", required_argument, 0, 0},
1316 #ifdef BUILD_UNIX_SOCKET
1317 {
"unix-socket", optional_argument, 0, 0},
1319 {
"pcap-buffer-size", required_argument, 0, 0},
1320 {
"unittest-filter", required_argument, 0,
'U'},
1321 {
"list-app-layer-protos", 0, &list_app_layer_protocols, 1},
1322 {
"list-unittests", 0, &list_unittests, 1},
1323 {
"list-runmodes", 0, &list_runmodes, 1},
1324 {
"list-keywords", optional_argument, &list_keywords, 1},
1325 {
"runmode", required_argument, NULL, 0},
1328 {
"service-install", 0, 0, 0},
1329 {
"service-remove", 0, 0, 0},
1330 {
"service-change-params", 0, 0, 0},
1332 {
"pidfile", required_argument, 0, 0},
1333 {
"init-errors-fatal", 0, 0, 0},
1334 {
"disable-detection", 0, 0, 0},
1335 {
"disable-hashing", 0, 0, 0},
1336 {
"fatal-unittests", 0, 0, 0},
1338 {
"user", required_argument, 0, 0},
1339 {
"group", required_argument, 0, 0},
1340 {
"erf-in", required_argument, 0, 0},
1341 {
"dag", required_argument, 0, 0},
1342 {
"napatech", 0, 0, 0},
1343 {
"build-info", 0, &build_info, 1},
1344 {
"data-dir", required_argument, 0, 0},
1346 {
"windivert", required_argument, 0, 0},
1347 {
"windivert-forward", required_argument, 0, 0},
1349 #ifdef HAVE_LIBNET11
1350 {
"reject-dev", required_argument, 0, 0},
1352 {
"set", required_argument, 0, 0},
1354 {
"nflog", optional_argument, 0, 0},
1356 {
"simulate-packet-flow-memcap", required_argument, 0, 0},
1357 {
"simulate-applayer-error-at-offset-ts", required_argument, 0, 0},
1358 {
"simulate-applayer-error-at-offset-tc", required_argument, 0, 0},
1359 {
"simulate-packet-loss", required_argument, 0, 0},
1360 {
"simulate-packet-tcp-reassembly-memcap", required_argument, 0, 0},
1361 {
"simulate-packet-tcp-ssn-memcap", required_argument, 0, 0},
1362 {
"simulate-packet-defrag-memcap", required_argument, 0, 0},
1369 int option_index = 0;
1371 char short_opts[] =
"c:TDhi:l:q:d:r:us:S:U:VF:vk:";
1373 while ((opt = getopt_long(argc, argv, short_opts, long_opts, &option_index)) != -1) {
1376 if (strcmp((long_opts[option_index]).name ,
"pfring") == 0 ||
1377 strcmp((long_opts[option_index]).name ,
"pfring-int") == 0) {
1380 if (optarg != NULL) {
1383 ((strlen(optarg) <
sizeof(suri->
pcap_dev)) ?
1384 (strlen(optarg) + 1) :
sizeof(suri->
pcap_dev)));
1389 "to pass --enable-pfring to configure when building.");
1393 else if(strcmp((long_opts[option_index]).name ,
"pfring-cluster-id") == 0){
1396 fprintf(stderr,
"ERROR: Failed to set pfring.cluster-id.\n");
1401 "to pass --enable-pfring to configure when building.");
1405 else if(strcmp((long_opts[option_index]).name ,
"pfring-cluster-type") == 0){
1407 if (
ConfSetFinal(
"pfring.cluster-type", optarg) != 1) {
1408 fprintf(stderr,
"ERROR: Failed to set pfring.cluster-type.\n");
1413 "to pass --enable-pfring to configure when building.");
1417 else if (strcmp((long_opts[option_index]).name ,
"capture-plugin") == 0){
1421 else if (strcmp((long_opts[option_index]).name ,
"capture-plugin-args") == 0){
1423 }
else if (strcmp((long_opts[option_index]).name,
"dpdk") == 0) {
1424 if (ParseCommandLineDpdk(suri, optarg) !=
TM_ECODE_OK) {
1427 }
else if (strcmp((long_opts[option_index]).name,
"af-packet") == 0) {
1428 if (ParseCommandLineAfpacket(suri, optarg) !=
TM_ECODE_OK) {
1431 }
else if (strcmp((long_opts[option_index]).name,
"netmap") == 0) {
1439 ((strlen(optarg) <
sizeof(suri->
pcap_dev)) ?
1440 (strlen(optarg) + 1) :
sizeof(suri->
pcap_dev)));
1446 SCLogInfo(
"Multiple netmap option without interface on each is useless");
1451 "has been specified");
1452 PrintUsage(argv[0]);
1459 }
else if (strcmp((long_opts[option_index]).name,
"nflog") == 0) {
1469 }
else if (strcmp((long_opts[option_index]).name,
"pcap") == 0) {
1470 if (ParseCommandLinePcapLive(suri, optarg) !=
TM_ECODE_OK) {
1473 }
else if (strcmp((long_opts[option_index]).name,
"simulate-ips") == 0) {
1476 }
else if (strcmp((long_opts[option_index]).name,
"init-errors-fatal") == 0) {
1477 if (
ConfSetFinal(
"engine.init-failure-fatal",
"1") != 1) {
1478 fprintf(stderr,
"ERROR: Failed to set engine init-failure-fatal.\n");
1481 #ifdef BUILD_UNIX_SOCKET
1482 }
else if (strcmp((long_opts[option_index]).name ,
"unix-socket") == 0) {
1486 if (
ConfSetFinal(
"unix-command.filename", optarg) != 1) {
1487 fprintf(stderr,
"ERROR: Failed to set unix-command.filename.\n");
1494 "has been specified");
1495 PrintUsage(argv[0]);
1500 else if(strcmp((long_opts[option_index]).name,
"list-app-layer-protocols") == 0) {
1503 else if(strcmp((long_opts[option_index]).name,
"list-unittests") == 0) {
1507 fprintf(stderr,
"ERROR: Unit tests not enabled. Make sure to pass --enable-unittests to configure when building.\n");
1510 }
else if (strcmp((long_opts[option_index]).name,
"list-runmodes") == 0) {
1513 }
else if (strcmp((long_opts[option_index]).name,
"list-keywords") == 0) {
1515 if (strcmp(
"short",optarg)) {
1519 }
else if (strcmp((long_opts[option_index]).name,
"runmode") == 0) {
1521 }
else if(strcmp((long_opts[option_index]).name,
"engine-analysis") == 0) {
1525 else if(strcmp((long_opts[option_index]).name,
"service-install") == 0) {
1526 suri->
run_mode = RUNMODE_INSTALL_SERVICE;
1529 else if(strcmp((long_opts[option_index]).name,
"service-remove") == 0) {
1530 suri->
run_mode = RUNMODE_REMOVE_SERVICE;
1533 else if(strcmp((long_opts[option_index]).name,
"service-change-params") == 0) {
1534 suri->
run_mode = RUNMODE_CHANGE_SERVICE_PARAMS;
1538 else if(strcmp((long_opts[option_index]).name,
"pidfile") == 0) {
1546 else if(strcmp((long_opts[option_index]).name,
"disable-detection") == 0) {
1548 }
else if (strcmp((long_opts[option_index]).name,
"disable-hashing") == 0) {
1550 }
else if (strcmp((long_opts[option_index]).name,
"fatal-unittests") == 0) {
1554 fprintf(stderr,
"ERROR: Unit tests not enabled. Make sure to pass --enable-unittests to configure when building.\n");
1557 }
else if (strcmp((long_opts[option_index]).name,
"user") == 0) {
1558 #ifndef HAVE_LIBCAP_NG
1560 " drop privileges, but it was not compiled into Suricata.");
1566 }
else if (strcmp((long_opts[option_index]).name,
"group") == 0) {
1567 #ifndef HAVE_LIBCAP_NG
1569 " drop privileges, but it was not compiled into Suricata.");
1575 }
else if (strcmp((long_opts[option_index]).name,
"erf-in") == 0) {
1578 fprintf(stderr,
"ERROR: Failed to set erf-file.file\n");
1581 }
else if (strcmp((long_opts[option_index]).name,
"dag") == 0) {
1588 "more than one run mode has been specified");
1589 PrintUsage(argv[0]);
1595 " to receive packets using --dag.");
1598 }
else if (strcmp((long_opts[option_index]).name,
"napatech") == 0) {
1599 #ifdef HAVE_NAPATECH
1603 " to capture packets using --napatech.");
1606 }
else if (strcmp((long_opts[option_index]).name,
"pcap-buffer-size") == 0) {
1607 #ifdef HAVE_PCAP_SET_BUFF
1609 fprintf(stderr,
"ERROR: Failed to set pcap-buffer-size.\n");
1614 " doesn't support setting buffer size.");
1616 }
else if (strcmp((long_opts[option_index]).name,
"build-info") == 0) {
1619 }
else if (strcmp((long_opts[option_index]).name,
"windivert-forward") == 0) {
1623 if (WinDivertRegisterQueue(
true, optarg) == -1) {
1627 if (WinDivertRegisterQueue(
true, optarg) == -1) {
1632 "has been specified");
1633 PrintUsage(argv[0]);
1637 else if(strcmp((long_opts[option_index]).name,
"windivert") == 0) {
1640 if (WinDivertRegisterQueue(
false, optarg) == -1) {
1644 if (WinDivertRegisterQueue(
false, optarg) == -1) {
1649 "has been specified");
1650 PrintUsage(argv[0]);
1657 }
else if(strcmp((long_opts[option_index]).name,
"reject-dev") == 0) {
1658 #ifdef HAVE_LIBNET11
1660 extern char *g_reject_dev;
1661 extern uint16_t g_reject_dev_mtu;
1662 g_reject_dev = optarg;
1665 g_reject_dev_mtu = (uint16_t)mtu;
1669 "Libnet 1.1 support not enabled. Compile Suricata with libnet support.");
1673 else if (strcmp((long_opts[option_index]).name,
"set") == 0) {
1674 if (optarg != NULL) {
1676 char *val = strchr(optarg,
'=');
1679 "Invalid argument for --set, must be key=val.");
1682 fprintf(stderr,
"Failed to set configuration value %s.",
1688 else if (strcmp((long_opts[option_index]).name,
"pcap-file-continuous") == 0) {
1689 if (
ConfSetFinal(
"pcap-file.continuous",
"true") != 1) {
1694 else if (strcmp((long_opts[option_index]).name,
"pcap-file-delete") == 0) {
1695 if (
ConfSetFinal(
"pcap-file.delete-when-done",
"true") != 1) {
1700 else if (strcmp((long_opts[option_index]).name,
"pcap-file-recursive") == 0) {
1701 if (
ConfSetFinal(
"pcap-file.recursive",
"true") != 1) {
1706 else if (strcmp((long_opts[option_index]).name,
"data-dir") == 0) {
1707 if (optarg == NULL) {
1718 " supplied at the commandline (-d %s) doesn't "
1719 "exist. Shutting down the engine.", optarg, optarg);
1723 }
else if (strcmp((long_opts[option_index]).name ,
"strict-rule-keywords") == 0){
1724 if (optarg == NULL) {
1734 (long_opts[option_index]).name, optarg);
1743 SCLogInfo(
"Running suricata under test mode");
1745 if (
ConfSetFinal(
"engine.init-failure-fatal",
"1") != 1) {
1746 fprintf(stderr,
"ERROR: Failed to set engine init-failure-fatal.\n");
1759 if (optarg == NULL) {
1763 #ifdef HAVE_AF_PACKET
1764 if (ParseCommandLineAfpacket(suri, optarg) !=
TM_ECODE_OK) {
1769 #if defined HAVE_PFRING || HAVE_NETMAP
1778 "option%s %s available:"
1780 " PF_RING (--pfring-int=%s)"
1783 " NETMAP (--netmap=%s)"
1785 ". Use --pcap=%s to suppress this warning",
1786 i == 1 ?
"" :
"s", i == 1 ?
"is" :
"are"
1796 if (ParseCommandLinePcapLive(suri, optarg) !=
TM_ECODE_OK) {
1802 if (optarg == NULL) {
1813 " supplied at the commandline (-l %s) doesn't "
1814 "exist. Shutting down the engine.", optarg, optarg);
1817 if (!IsLogDirectoryWritable(optarg)) {
1819 " supplied at the commandline (-l %s) is not "
1820 "writable. Shutting down the engine.", optarg, optarg);
1838 "has been specified");
1839 PrintUsage(argv[0]);
1859 "has been specified");
1860 PrintUsage(argv[0]);
1874 "has been specified");
1875 PrintUsage(argv[0]);
1880 if(_stat(optarg, &buf) != 0) {
1883 if (stat(optarg, &buf) != 0) {
1916 PrintUsage(argv[0]);
1920 fprintf(stderr,
"ERROR: Unit tests not enabled. Make sure to pass --enable-unittests to configure when building.\n");
1936 if (optarg == NULL) {
1941 SetBpfStringFromFile(optarg);
1947 if (optarg == NULL) {
1951 if (!strcmp(
"all", optarg))
1953 else if (!strcmp(
"none", optarg))
1961 PrintUsage(argv[0]);
1974 if (list_app_layer_protocols)
1992 ret = SetBpfString(optind, argv);
2000 static int WindowsInitService(
int argc,
char **argv)
2002 if (SCRunningAsService()) {
2003 char path[MAX_PATH];
2005 strlcpy(path, argv[0], MAX_PATH);
2006 if ((p = strrchr(path,
'\\'))) {
2009 if (!SetCurrentDirectory(path)) {
2013 SCLogInfo(
"Current directory is set to: %s", path);
2014 SCServiceInit(argc, argv);
2019 if (0 != WSAStartup(MAKEWORD(2, 2), &wsaData)) {
2031 const char *pid_filename;
2033 if (
ConfGet(
"pid-file", &pid_filename) == 1) {
2034 SCLogInfo(
"Use pid file %s from config file.", pid_filename);
2061 "Unable to create PID file, concurrent run of"
2062 " Suricata can occur.");
2064 "PID file creation WILL be mandatory for daemon mode"
2065 " in future version");
2080 if (
ConfGet(
"run-as.user", &
id) == 1) {
2084 if (
ConfGet(
"run-as.group", &
id) == 1) {
2111 static int InitSignalHandler(
SCInstance *suri)
2114 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
2119 if (
ConfGetBool(
"logging.stacktrace-on-signal", &enabled) == 0) {
2124 SCLogInfo(
"Preparing unexpected signal handling");
2125 struct sigaction stacktrace_action;
2126 memset(&stacktrace_action, 0,
sizeof(stacktrace_action));
2127 stacktrace_action.sa_sigaction = SignalHandlerUnexpected;
2128 stacktrace_action.sa_flags = SA_SIGINFO;
2129 sigaction(SIGSEGV, &stacktrace_action, NULL);
2130 sigaction(SIGABRT, &stacktrace_action, NULL);
2208 SCPrintElapsedTime(start_time);
2241 static int StartInternalRunMode(
SCInstance *suri,
int argc,
char **argv)
2260 PrintUsage(argv[0]);
2270 case RUNMODE_INSTALL_SERVICE:
2271 if (SCServiceInstall(argc, argv)) {
2274 SCLogInfo(
"Suricata service has been successfuly installed.");
2276 case RUNMODE_REMOVE_SERVICE:
2277 if (SCServiceRemove(argc, argv)) {
2280 SCLogInfo(
"Suricata service has been successfuly removed.");
2282 case RUNMODE_CHANGE_SERVICE_PARAMS:
2283 if (SCServiceChangeParams(argc, argv)) {
2286 SCLogInfo(
"Suricata service startup parameters has been successfuly changed.");
2296 static int FinalizeRunMode(
SCInstance *suri,
char **argv)
2300 PrintUsage(argv[0]);
2315 static void SetupDelayedDetect(
SCInstance *suri)
2324 if (decnf != NULL) {
2326 if (strcmp(denode->
val,
"delayed-detect") == 0) {
2336 SCLogInfo(
"Packets will start being processed before signatures are active.");
2352 static int ConfigGetCaptureValue(
SCInstance *suri)
2360 "Maximum max-pending-packets setting is 65534. "
2369 const char *temp_default_packet_size;
2370 if ((
ConfGet(
"default-packet-size", &temp_default_packet_size)) != 1) {
2374 int strip_trailing_plus = 0;
2379 mtu = GetGlobalMTUWin32();
2395 strip_trailing_plus = 1;
2401 for (lthread = 0; lthread < nlive; lthread++) {
2404 (void)
strlcpy(dev, live_dev,
sizeof(dev));
2406 if (strip_trailing_plus) {
2407 size_t len = strlen(dev);
2409 (dev[
len-1] ==
'+' ||
2410 dev[
len-1] ==
'^' ||
2433 "from conf file - %s. Killing engine",
2434 temp_default_packet_size);
2444 static void PostRunStartedDetectSetup(
const SCInstance *suri)
2458 SCLogNotice(
"Signature(s) loaded, Detect thread(s) activated.");
2472 SetupDelayedDetect(suri);
2474 (void)
ConfGetBool(
"multi-detect.enabled", &mt_enabled);
2475 int default_tenant = 0;
2477 (void)
ConfGetBool(
"multi-detect.default", &default_tenant);
2480 "detection engine contexts failed.");
2505 static int PostDeviceFinalizedSetup(
SCInstance *suri)
2509 #ifdef HAVE_AF_PACKET
2512 SCLogInfo(
"AF_PACKET: Setting IPS mode");
2529 static void PostConfLoadedSetupHostMode(
void)
2531 const char *hostmode = NULL;
2533 if (
ConfGet(
"host-mode", &hostmode) == 1) {
2534 if (!strcmp(hostmode,
"router")) {
2536 }
else if (!strcmp(hostmode,
"sniffer-only")) {
2539 if (strcmp(hostmode,
"auto") != 0) {
2551 SCLogInfo(
"No 'host-mode': suricata is in IPS mode, using "
2552 "default setting 'router'");
2555 SCLogInfo(
"No 'host-mode': suricata is in IDS mode, using "
2556 "default setting 'sniffer-only'");
2564 if (suri->
system ==
false) {
2588 if (LuajitSetupStatesPool() != 0) {
2597 int disable_offloading;
2598 if (
ConfGetBool(
"capture.disable-offloading", &disable_offloading) == 0)
2599 disable_offloading = 1;
2600 if (disable_offloading) {
2607 const char *cv = NULL;
2608 if (
ConfGet(
"capture.checksum-validation", &cv) == 1) {
2609 if (strcmp(cv,
"none") == 0) {
2611 }
else if (strcmp(cv,
"all") == 0) {
2618 ConfSet(
"stream.checksum-validation",
"0");
2621 ConfSet(
"stream.checksum-validation",
"1");
2630 #ifdef HAVE_PACKET_EBPF
2632 EBPFRegisterExtension();
2644 const char *custom_umask;
2645 if (
ConfGet(
"umask", &custom_umask) == 1) {
2647 if (
StringParseUint16(&mask, 8, (uint16_t)strlen(custom_umask), custom_umask) > 0) {
2648 umask((mode_t)mask);
2666 SCLogInfo(
"== Carrying out Engine Analysis ==");
2667 const char *temp = NULL;
2668 if (
ConfGet(
"engine-analysis", &temp) == 0) {
2669 SCLogInfo(
"no engine-analysis parameter(s) defined in conf file. "
2670 "Please define/enable them in the conf to use this "
2689 "basic address vars test failed. Please check %s for errors",
2695 "basic port vars test failed. Please check %s for errors",
2723 "supplied by %s (default-log-dir) doesn't exist. "
2727 if (!IsLogDirectoryWritable(suri->
log_dir)) {
2729 "supplied by %s (default-log-dir) is not writable. "
2749 if (PostDeviceFinalizedSetup(suri) !=
TM_ECODE_OK) {
2754 PostConfLoadedSetupHostMode();
2761 static void SuricataMainLoop(
SCInstance *suri)
2821 return EXIT_FAILURE;
2836 SCInstanceInit(&
suricata, argv[0]);
2844 if (WindowsInitService(argc, argv) != 0) {
2857 switch (StartInternalRunMode(&
suricata, argc, argv)) {
2877 int vlan_tracking = 1;
2878 if (
ConfGetBool(
"vlan.use-for-tracking", &vlan_tracking) == 1 && !vlan_tracking) {
2882 SCLogDebug(
"vlan tracking is %s", vlan_tracking == 1 ?
"enabled" :
"disabled");
2913 SCLogNotice(
"Configuration provided was successfully loaded. Exiting.");
2939 PostRunStartedDetectSetup(&
suricata);
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
void TmModuleUnixManagerRegister(void)
int profiling_rules_enabled
void TmModuleReceiveIPFWRegister(void)
Registration Function for RecieveIPFW.
void SCReferenceConfDeinit(void)
void AppLayerHtpNeedFileInspection(void)
Sets a flag that informs the HTP app layer that some module in the engine needs the http request file...
void SCReferenceConfInit(void)
intmax_t max_pending_packets
void IPPairInitConfig(bool quiet)
initialize the configuration
void SCLogInitLogModule(SCLogInitData *sc_lid)
Initializes the logging module.
@ SC_ERR_WINDIVERT_NOSUPPORT
void DetectEngineDeReference(DetectEngineCtx **de_ctx)
struct timeval start_time
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
void SCThresholdConfGlobalFree(void)
void AFPPeersListClean()
Clean the global peers list.
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
enum DetectEngineType type
void DetectEnginePruneFreeList(void)
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
void SigTableApplyStrictCommandlineOption(const char *str)
@ RUNMODE_PRINT_BUILDINFO
DetectEngineCtx * DetectEngineCtxInitStubForDD(void)
void LiveDevRegisterExtension(void)
void AppLayerHtpPrintStats(void)
void StatsSetupPostConfigPreOutput(void)
char * runmode_custom_mode
struct HtpBodyChunk_ * next
void TmModuleReceiveNFQRegister(void)
int LiveBuildDeviceList(const char *runmode)
void RunModeShutDown(void)
void SCProtoNameInit(void)
void RunModeDispatch(int runmode, const char *custom_mode, const char *capture_plugin_name, const char *capture_plugin_args)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
volatile sig_atomic_t sigint_count
SC_ATOMIC_DECLARE(unsigned int, engine_stage)
void TmModuleRunDeInit(void)
void RegisterFlowBypassInfo(void)
#define SCSetThreadName(n)
@ SC_ERR_NO_PCAP_SET_BUFFER_SIZE
void SCLogDeInitLogModule(void)
De-Initializes the logging module.
void TmModuleDecodeErfFileRegister(void)
Register the ERF file decoder module.
main detection engine ctx
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
void DetectEngineReloadSetIdle(void)
DetectEngineCtx * DetectEngineGetCurrent(void)
void TmModuleFlowRecyclerRegister(void)
void Daemonize(void)
Daemonize the process.
void UtilSignalHandlerSetup(int sig, void(*handler)(int))
#define TAILQ_FOREACH(var, head, field)
void TmModuleDecodeAFPRegister(void)
Registration Function for DecodeAFP.
void TmModuleDecodeWinDivertRegister(void)
void FlowForceReassembly(void)
Force reassembly for all the flows that have unprocessed segments.
int DetectEngineAddToMaster(DetectEngineCtx *de_ctx)
void TmModuleStatsLoggerRegister(void)
void RegisterAllModules(void)
int SCGetUserID(const char *user_name, const char *group_name, uint32_t *uid, uint32_t *gid)
Function to get the user and group ID from the specified user name.
void SupportFastPatternForSigMatchTypes(void)
Registers the keywords(SMs) that should be given fp support.
void ConfDump(void)
Dump configuration to stdout.
const SuricataContext suricata_context
int CheckValidDaemonModes(int daemon, int mode)
Check for a valid combination daemon/mode.
void SCClassConfDeinit(void)
const char * LiveGetDeviceNameName(int number)
Get a pointer to the pre device name at idx.
int ConfSetFinal(const char *name, const char *val)
Set a final configuration value.
void TmThreadDisableReceiveThreads(void)
Disable all threads having the specified TMs.
void StatsInit(void)
Initializes the perf counter api. Things are hard coded currently. More work to be done when we imple...
void PreRunInit(const int runmode)
void MacSetRegisterFlowStorage(void)
const char * conf_filename
int ExceptionSimulationCommandlineParser(const char *name, const char *arg)
void GlobalsInitPreConfig(void)
void TmModuleReceiveNetmapRegister(void)
void PacketPoolPostRunmodes(void)
Set the max_pending_return_packets value.
void NFQInitConfig(bool quiet)
To initialize the NFQ global configuration data.
void TmModuleReceiveWinDivertRegister(void)
void TmModuleReceivePfringRegister(void)
Registration Function for RecievePfring.
void SCProfilingDestroy(void)
Free resources used by profiling.
bool IsRunModeOffline(enum RunModes run_mode_to_check)
void RunModeInitializeOutputs(void)
int DetectPortTestConfVars(void)
void SCThresholdConfGlobalInit(void)
void DecodeUnregisterCounters(void)
const char * capture_plugin_name
@ SURI_HOST_IS_SNIFFER_ONLY
void HostBitInitCtx(void)
const char * capture_plugin_args
void TmModuleLoggerRegister(void)
void TmThreadDisablePacketThreads(void)
Disable all packet threads.
void PacketPoolInit(void)
int AppLayerDeSetup(void)
De initializes the app layer.
void TmThreadContinueThreads()
Unpauses all threads present in tv_root.
size_t strlcpy(char *dst, const char *src, size_t siz)
void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
void FlowDisableFlowRecyclerThread(void)
Used to disable flow recycler thread(s).
int GetIfaceMaxPacketSize(const char *pcap_dev)
output max packet size for a link
void TmModuleDecodePcapFileRegister(void)
void TmModuleBypassedFlowManagerRegister(void)
void IPPairShutdown(void)
shutdown the flow engine
void DetectParseFreeRegexes(void)
void TmModuleDecodeNFLOGRegister(void)
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
int NFQParseAndRegisterQueues(const char *queues)
Parses and adds Netfilter queue(s).
void FlowInitConfig(bool quiet)
initialize the configuration
int AppLayerSetup(void)
Setup the app layer.
void FeatureTrackingRegister(void)
void TmModuleReceiveDPDKRegister(void)
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
void UnixManagerThreadSpawnNonRunmode(void)
bool IsRunModeSystem(enum RunModes run_mode_to_check)
void TmModuleDecodeNetmapRegister(void)
Registration Function for DecodeNetmap.
void PreRunPostPrivsDropInit(const int runmode)
int DetectEngineMoveToFreeList(DetectEngineCtx *de_ctx)
volatile sig_atomic_t sigterm_count
TmEcode TmThreadWaitOnThreadInit(void)
Used to check if all threads have finished their initialization. On finding an un-initialized thread,...
void TmModuleVerdictNFQRegister(void)
int ConfYamlLoadFile(const char *filename)
Load configuration from a YAML file.
void AppLayerRegisterGlobalCounters(void)
HACK to work around our broken unix manager (re)init loop.
void RunModeListRunmodes(void)
Lists all registered runmodes.
size_t strlcat(char *, const char *src, size_t siz)
@ RUNMODE_LIST_APP_LAYERS
void LiveSetOffloadDisable(void)
void StatsSetupPostConfigPostOutput(void)
void EngineModeSetIDS(void)
void TmModuleReceiveAFPRegister(void)
Registration Function for RecieveAFP.
int LiveBuildDeviceListCustom(const char *runmode, const char *itemname)
void UnixSocketKillSocketThread(void)
void TmModuleVerdictIPFWRegister(void)
Registration Function for VerdictIPFW.
int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, int sig_file_exclusive)
Load signatures.
void HttpRangeContainersInit(void)
struct timeval last_reload
void TmModuleVerdictWinDivertRegister(void)
void HostCleanup(void)
Cleanup the host engine.
void FlowDisableFlowManagerThread(void)
Used to disable flow manager thread(s).
int SuricataMain(int argc, char **argv)
int UtilSignalUnblock(int signum)
int DetectEngineEnabled(void)
Check if detection is enabled.
void TmThreadClearThreadsFamily(int family)
void TmModuleRunInit(void)
void EngineModeSetIPS(void)
void HTPAtExitPrintStats(void)
Print the stats of the HTTP requests.
int UtilSignalBlock(int signum)
void SCProfilingPrefilterGlobalInit(void)
int PostConfLoadedSetup(SCInstance *suri)
const char * GetProgramVersion(void)
get string with program version
@ SC_ERR_LIBCAP_NG_REQUIRED
int SCGetGroupID(const char *group_name, uint32_t *gid)
Function to get the group ID from the specified group name.
void TmModuleReceivePcapFileRegister(void)
int32_t CoredumpLoadConfig(void)
Configures the core dump size.
int IPFWRegisterQueue(char *queue)
Add an IPFW divert.
int ListAppLayerProtocols(const char *conf_filename)
void DatasetsDestroy(void)
void UtilCpuPrintSummary(void)
Print a summary of CPUs detected (configured and online)
void TmThreadKillThreads(void)
void OutputDeregisterAll(void)
Deregister all modules. Useful for a memory clean exit.
void PostConfLoadedDetectSetup(SCInstance *suri)
int EngineModeIsIDS(void)
void TmModuleNapatechDecodeRegister(void)
Register the Napatech decoder module.
TmModule tmm_modules[TMM_SIZE]
@ SC_WARN_FASTER_CAPTURE_AVAILABLE
void OutputNotifyFileRotation(void)
Notifies all registered file rotation notification flags.
int StorageFinalize(void)
void TmModuleFlowWorkerRegister(void)
enum RunModes aux_run_mode
int LiveGetDeviceNameCount(void)
Get the number of pre registered devices.
#define DEFAULT_PID_FILENAME
volatile sig_atomic_t sighup_count
TmEcode ConfigSetDataDirectory(char *name)
void TmModuleDecodeErfDagRegister(void)
Register the ERF file decoder module.
#define SCDropMainThreadCaps(...)
void TmModuleDebugList(void)
void TmModuleDecodeNFQRegister(void)
void SCProtoNameRelease(void)
int RunmodeIsUnittests(void)
void SCPluginsLoad(const char *capture_plugin_name, const char *capture_plugin_args)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
void TmModuleReceiveNFLOGRegister(void)
@ SC_ERR_INVALID_YAML_CONF_ENTRY
#define DEFAULT_PACKET_SIZE
#define WarnInvalidConfEntry(param_name, format, value)
Generic API that can be used by all to log an invalid conf entry.
void TmModuleReceiveErfFileRegister(void)
Register the ERF file receiver (reader) module.
uint32_t default_packet_size
@ DETECT_ENGINE_TYPE_NORMAL
void TmThreadKillThreadsFamily(int family)
void FeatureTrackingRelease(void)
void TmqhCleanup(void)
Clean up registration time allocs.
void StreamTcpFreeConfig(bool quiet)
void DecodeGlobalConfig(void)
char * strict_rule_parsing_string
DetectEngineCtx * DetectEngineCtxInitStubForMT(void)
void FlowShutdown(void)
shutdown the flow engine
void SCHInfoLoadFromConfig(void)
Load the host os policy information from the configuration.
void DetectEngineBumpVersion(void)
void TmModuleFlowManagerRegister(void)
int SCPidfileTestRunning(const char *pid_filename)
Check the Suricata pid file (used at the startup)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
void HostShutdown(void)
shutdown the flow engine
void TmModuleDecodePfringRegister(void)
Registration Function for DecodePfring.
void LiveSetOffloadWarn(void)
void ParseSizeDeinit(void)
void RunModeRegisterRunModes(void)
Register all runmodes in the engine.
#define FatalError(x,...)
int ConfGetChildValueBool(const ConfNode *base, const char *name, int *val)
void SCProfilingDump(void)
void EngineStop(void)
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be a...
int ParseSizeStringU32(const char *size, uint32_t *res)
void TmModuleReceiveErfDagRegister(void)
Register the ERF file receiver (reader) module.
int DetectEngineMultiTenantSetup(void)
setup multi-detect / multi-tenancy
void IPPairBitInitCtx(void)
void SCClassConfInit(void)
int RunmodeGetCurrent(void)
TmEcode ConfigSetLogDirectory(const char *name)
void TmModuleDecodeIPFWRegister(void)
Registration Function for DecodeIPFW.
int ConfSetFromString(const char *input, int final)
Set a configuration parameter from a string.
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
void ConfInit(void)
Initialize the configuration system.
volatile sig_atomic_t sigusr2_count
@ RUNMODE_ENGINE_ANALYSIS
void TmModuleDecodePcapRegister(void)
Registration Function for DecodePcap.
int LiveDeviceListClean()
TmEcode ConfigCheckDataDirectory(const char *data_dir)
const char * ConfigGetLogDirectory()
int DetectEngineReloadStart(void)
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
#define DEFAULT_CONF_FILE
#define SC_LOG_MAX_LOG_MSG_LEN
void AppLayerParserPostStreamSetup(void)
void TmModuleReceivePcapRegister(void)
Registration Function for ReceivePcap.
void TmModuleRespondRejectRegister(void)
void CoredumpEnable(void)
Enable coredumps on systems where coredumps can and need to be enabled.
void RunUnittests(int list_unittests, const char *regex_arg)
TmEcode ConfigCheckLogDirectoryExists(const char *log_dir)
void PacketAlertTagInit(void)
DetectEngineCtx * DetectEngineCtxInit(void)
void SCProfilingRulesGlobalInit(void)
int EngineModeIsIPS(void)
void TmModuleNapatechStreamRegister(void)
Register the Napatech receiver (reader) module.
void SCProfilingKeywordsGlobalInit(void)
void EngineDone(void)
Used to indicate that the current task is done.
const char * GetDocURL(void)
void PostRunDeinit(const int runmode, struct timeval *start_time)
void HostInitConfig(bool quiet)
initialize the configuration
void ConfDeInit(void)
De-initializes the configuration system.
void HttpRangeContainersDestroy(void)
@ SC_ERR_LIBNET_NOT_ENABLED
void NFQContextsClean()
Clean global contexts. Must be called on exit.
int ConfSet(const char *name, const char *val)
Set a configuration value.
void SCLogLoadConfig(int daemon, int verbose, uint32_t userid, uint32_t groupid)
int DetectEngineReload(const SCInstance *suri)
Reload the detection engine.
#define DEFAULT_MAX_PENDING_PACKETS
void TmThreadCheckThreadState(void)
Used to check the thread for certain conditions of failure.
void OutputFilestoreRegisterGlobalCounters(void)
int InitGlobal(void)
Global initialization common to all runmodes.
void SCProfilingSghsGlobalInit(void)
int SCPidfileCreate(const char *pidfile)
Write a pid file (used at the startup) This commonly needed by the init scripts.
int LiveRegisterDeviceName(const char *dev)
Add a device for monitoring.
void LiveDeviceFinalize(void)
void TmModuleDecodeDPDKRegister(void)
Registration Function for DecodeDPDK.
void PacketPoolDestroy(void)
void HTPFreeConfig(void)
Clears the HTTP server configuration memory used by HTP library.
int ListKeywords(const char *keyword_info)
#define SCLogNotice(...)
Macro used to log NOTICE messages.
void DPDKCleanupEAL(void)
void StatsReleaseResources()
Releases the resources alloted by the Stats API.
void SCPidfileRemove(const char *pid_filename)
Remove the pid file (used at the startup)
@ SC_ERR_NAPATECH_REQUIRED
@ SC_ERR_MULTIPLE_RUN_MODE
int NetmapRunModeIsIPS(void)
void SCProfilingInit(void)
Initialize profiling.
int DetectEngineReloadIsStart(void)
volatile uint8_t suricata_ctl_flags
void TagDestroyCtx(void)
Destroy tag context hash tables.
int DetectAddressTestConfVars(void)
int GetIfaceMTU(const char *pcap_dev)
output the link MTU
void MpmHSGlobalCleanup(void)
void TmqResetQueues(void)