suricata
|
Go to the source code of this file.
Data Structures | |
struct | SCInstance_ |
Macros | |
#define | PROG_NAME "Suricata" |
#define | PROG_VER PACKAGE_VERSION |
#define | DEFAULT_CONF_FILE CONFIG_DIR "/suricata.yaml" |
#define | DEFAULT_PID_DIR LOCAL_STATE_DIR "/run/" |
#define | DEFAULT_PID_BASENAME "suricata.pid" |
#define | DEFAULT_PID_FILENAME DEFAULT_PID_DIR DEFAULT_PID_BASENAME |
#define | DOC_URL "https://docs.suricata.io/en/" |
#define | SURICATA_STOP (1 << 0) |
#define | SURICATA_DONE (1 << 2) |
#define | IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode) ((host_mode) == SURI_HOST_IS_SNIFFER_ONLY) |
Typedefs | |
typedef struct SCInstance_ | SCInstance |
Enumerations | |
enum | { SURICATA_INIT = 0, SURICATA_RUNTIME, SURICATA_DEINIT } |
enum | EngineMode { ENGINE_MODE_UNKNOWN, ENGINE_MODE_IDS, ENGINE_MODE_IPS } |
enum | { SURI_HOST_IS_SNIFFER_ONLY, SURI_HOST_IS_ROUTER } |
Functions | |
const char * | GetDocURL (void) |
void | EngineModeSetIPS (void) |
void | EngineModeSetIDS (void) |
int | EngineModeIsUnknown (void) |
int | EngineModeIsIPS (void) |
int | EngineModeIsIDS (void) |
void | GlobalsInitPreConfig (void) |
void | EngineStop (void) |
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be able to tell the engine the file eof is reached. More... | |
void | EngineDone (void) |
Used to indicate that the current task is done. More... | |
int | RunmodeIsUnittests (void) |
int | SCRunmodeGet (void) |
Get the current run mode. More... | |
void | SCRunmodeSet (int run_mode) |
Set the current run mode. More... | |
int | SuriHasSigFile (void) |
void | SuricataPreInit (const char *progname) |
void | SuricataInit (void) |
void | SuricataPostInit (void) |
void | SuricataMainLoop (void) |
void | SuricataShutdown (void) |
int | InitGlobal (void) |
Global initialization common to all runmodes. More... | |
void | GlobalsDestroy (void) |
int | PostConfLoadedSetup (SCInstance *suri) |
void | PostConfLoadedDetectSetup (SCInstance *suri) |
int | SCFinalizeRunMode (void) |
TmEcode | SCParseCommandLine (int argc, char **argv) |
int | SCStartInternalRunMode (int argc, char **argv) |
TmEcode | SCLoadYamlConfig (void) |
void | PreRunInit (const int runmode) |
void | PreRunPostPrivsDropInit (const int runmode) |
void | PostRunDeinit (const int runmode, struct timeval *start_time) |
void | RegisterAllModules (void) |
const char * | GetProgramVersion (void) |
get string with program version More... | |
Variables | |
volatile uint8_t | suricata_ctl_flags |
int | g_disable_randomness |
uint16_t | g_vlan_mask |
uint16_t | g_livedev_mask |
bool | g_disable_hashing |
Definition in file suricata.h.
#define DEFAULT_CONF_FILE CONFIG_DIR "/suricata.yaml" |
Definition at line 80 of file suricata.h.
#define DEFAULT_PID_BASENAME "suricata.pid" |
Definition at line 83 of file suricata.h.
#define DEFAULT_PID_DIR LOCAL_STATE_DIR "/run/" |
Definition at line 82 of file suricata.h.
#define DEFAULT_PID_FILENAME DEFAULT_PID_DIR DEFAULT_PID_BASENAME |
Definition at line 84 of file suricata.h.
#define DOC_URL "https://docs.suricata.io/en/" |
Definition at line 86 of file suricata.h.
#define IS_SURI_HOST_MODE_SNIFFER_ONLY | ( | host_mode | ) | ((host_mode) == SURI_HOST_IS_SNIFFER_ONLY) |
Definition at line 120 of file suricata.h.
#define PROG_NAME "Suricata" |
Definition at line 71 of file suricata.h.
#define PROG_VER PACKAGE_VERSION |
Definition at line 72 of file suricata.h.
#define SURICATA_DONE (1 << 2) |
packets capture ended
Definition at line 92 of file suricata.h.
#define SURICATA_STOP (1 << 0) |
gracefully stop the engine: process all outstanding packets first
Definition at line 91 of file suricata.h.
typedef struct SCInstance_ SCInstance |
anonymous enum |
Enumerator | |
---|---|
SURICATA_INIT | |
SURICATA_RUNTIME | |
SURICATA_DEINIT |
Definition at line 94 of file suricata.h.
anonymous enum |
Enumerator | |
---|---|
SURI_HOST_IS_SNIFFER_ONLY | |
SURI_HOST_IS_ROUTER |
Definition at line 114 of file suricata.h.
enum EngineMode |
Enumerator | |
---|---|
ENGINE_MODE_UNKNOWN | |
ENGINE_MODE_IDS | |
ENGINE_MODE_IPS |
Definition at line 101 of file suricata.h.
void EngineDone | ( | void | ) |
Used to indicate that the current task is done.
This is mainly used by pcap-file to tell it has finished to treat a pcap files when running in unix-socket mode.
Definition at line 459 of file suricata.c.
References suricata_ctl_flags, and SURICATA_DONE.
int EngineModeIsIDS | ( | void | ) |
Definition at line 237 of file suricata.c.
References DEBUG_VALIDATE_BUG_ON.
int EngineModeIsIPS | ( | void | ) |
Definition at line 231 of file suricata.c.
References DEBUG_VALIDATE_BUG_ON.
Referenced by AlertFastLogger(), AlertJsonHeader(), CaptureStatsSetup(), CaptureStatsUpdate(), EveAddVerdict(), ExceptionPolicyParse(), FlowHandlePacketUpdate(), and StreamTcpInitConfig().
int EngineModeIsUnknown | ( | void | ) |
Definition at line 226 of file suricata.c.
Referenced by PostConfLoadedSetup().
void EngineModeSetIDS | ( | void | ) |
Definition at line 248 of file suricata.c.
Referenced by ListAppLayerProtocols(), ListKeywords(), LLVMFuzzerTestOneInput(), PostConfLoadedSetup(), and RunUnittests().
void EngineModeSetIPS | ( | void | ) |
Definition at line 243 of file suricata.c.
void EngineStop | ( | void | ) |
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be able to tell the engine the file eof is reached.
Definition at line 448 of file suricata.c.
References suricata_ctl_flags, and SURICATA_STOP.
Referenced by ReceiveErfFileLoop().
const char* GetDocURL | ( | void | ) |
Definition at line 1120 of file suricata.c.
References DOC_URL, GetProgramVersion(), and PROG_VER.
const char* GetProgramVersion | ( | void | ) |
get string with program version
Get the program version as passed to us from AC_INIT
Add 'RELEASE' is no '-dev' in the version. Add the REVISION if passed to us.
Possible outputs: release: '5.0.1 RELEASE' dev with rev: '5.0.1-dev (64a789bbf 2019-10-18)' dev w/o rev: '5.0.1-dev'
Definition at line 1141 of file suricata.c.
References PROG_VER, and xstr.
Referenced by GetDocURL().
void GlobalsDestroy | ( | void | ) |
Definition at line 370 of file suricata.c.
References AFPPeersListClean(), AppLayerDeSetup(), AppLayerHtpPrintStats(), ConfDeInit(), DatasetsDestroy(), DatasetsSave(), de_ctx, DetectEngineClearMaster(), DetectEngineDeReference(), DetectEngineGetCurrent(), DetectEngineMoveToFreeList(), DetectParseFreeRegexes(), DPDKCleanupEAL(), FeatureTrackingRelease(), HostShutdown(), HTPAtExitPrintStats(), HTPFreeConfig(), LiveDeviceListClean(), MpmHSGlobalCleanup(), NFQContextsClean(), OutputDeregisterAll(), ParseSizeDeinit(), SCInstance_::pid_filename, SCFree, SCLogDeInitLogModule(), SCPidfileRemove(), SCProtoNameRelease(), suricata, TagDestroyCtx(), TimeDeinit(), TmModuleRunDeInit(), TmqhCleanup(), and VarNameStoreDestroy().
Referenced by main().
void GlobalsInitPreConfig | ( | void | ) |
Definition at line 361 of file suricata.c.
References FrameConfigInit(), SCProtoNameInit(), SCThresholdConfGlobalInit(), SupportFastPatternForSigMatchTypes(), and TimeInit().
Referenced by LLVMFuzzerTestOneInput(), RunUnittests(), and SuricataInit().
int InitGlobal | ( | void | ) |
Global initialization common to all runmodes.
This can be used by fuzz targets.
Definition at line 2875 of file suricata.c.
References ConfInit(), ParseSizeInit(), RunModeRegisterRunModes(), SC_ATOMIC_INIT, SCLogError, SCLogInitLogModule(), SCSetThreadName, suricata_context, tmm_modules, TMM_SIZE, UtilSignalBlock(), UtilSignalHandlerSetup(), and VarNameStoreInit().
Referenced by LLVMFuzzerTestOneInput().
void PostConfLoadedDetectSetup | ( | SCInstance * | suri | ) |
Definition at line 2547 of file suricata.c.
References de_ctx, and SCInstance_::disabled_detect.
int PostConfLoadedSetup | ( | SCInstance * | suri | ) |
This function is meant to contain code that needs to be run once the configuration has been loaded.
Definition at line 2638 of file suricata.c.
References AppLayerSetup(), SCInstance_::capture_plugin_args, SCInstance_::capture_plugin_name, SCInstance_::checksum_validation, ConfGet(), ConfGetBool(), ConfGetNode(), ConfNodeChildValueIsTrue(), ConfSet(), EngineModeIsUnknown(), EngineModeSetIDS(), FatalError, FeatureTrackingRegister(), g_stats_eps_per_app_proto_errors, LiveDeviceFinalize(), LiveDevRegisterExtension(), LiveSetOffloadDisable(), LiveSetOffloadWarn(), MacSetRegisterFlowStorage(), MpmTableSetup(), RegisterFlowBypassInfo(), SCInstance_::run_mode, RUNMODE_AFP_DEV, SCInstance_::runmode_custom_mode, RunModeEngineIsIPS(), SCLogInfo, SCPluginsLoad(), SCReturnInt, SetMasterExceptionPolicy(), SpmTableSetup(), StorageInit(), StringParseUint16(), suricata, and TM_ECODE_FAILED.
Referenced by LLVMFuzzerTestOneInput().
void PostRunDeinit | ( | const int | runmode, |
struct timeval * | start_time | ||
) |
Definition at line 2277 of file suricata.c.
References FlowDisableFlowManagerThread(), FlowForceReassembly(), PacketPoolInit(), RUNMODE_UNIX_SOCKET, TmThreadDisablePacketThreads(), and TmThreadDisableReceiveThreads().
Referenced by PreRunPostPrivsDropInit(), and SuricataShutdown().
void PreRunInit | ( | const int | runmode | ) |
Definition at line 2226 of file suricata.c.
References AppLayerParserPostStreamSetup(), AppLayerRegisterGlobalCounters(), DefragInit(), FLOW_QUIET, FlowInitConfig(), HttpRangeContainersInit(), IPPairInitConfig(), OutputFilestoreRegisterGlobalCounters(), RUNMODE_UNIX_SOCKET, SCProfilingInit(), SCProfilingKeywordsGlobalInit(), SCProfilingPrefilterGlobalInit(), SCProfilingRulesGlobalInit(), SCProfilingSghsGlobalInit(), StatsInit(), STREAM_VERBOSE, and StreamTcpInitConfig().
void PreRunPostPrivsDropInit | ( | const int | runmode | ) |
Definition at line 2255 of file suricata.c.
References DatasetsInit(), PostRunDeinit(), RUNMODE_PCAP_FILE, RUNMODE_UNIX_SOCKET, RunModeInitializeOutputs(), StatsSetupPostConfigPostOutput(), and StatsSetupPostConfigPreOutput().
void RegisterAllModules | ( | void | ) |
Definition at line 897 of file suricata.c.
References TmModuleBypassedFlowManagerRegister(), TmModuleDebugList(), TmModuleDecodeAFPRegister(), TmModuleDecodeAFXDPRegister(), TmModuleDecodeDPDKRegister(), TmModuleDecodeErfDagRegister(), TmModuleDecodeErfFileRegister(), TmModuleDecodeIPFWRegister(), TmModuleDecodeNetmapRegister(), TmModuleDecodeNFLOGRegister(), TmModuleDecodeNFQRegister(), TmModuleDecodePcapFileRegister(), TmModuleDecodePcapRegister(), TmModuleDecodePfringRegister(), TmModuleDecodeWinDivertRegister(), TmModuleFlowManagerRegister(), TmModuleFlowRecyclerRegister(), TmModuleFlowWorkerRegister(), TmModuleLoggerRegister(), TmModuleNapatechDecodeRegister(), TmModuleNapatechStreamRegister(), TmModuleReceiveAFPRegister(), TmModuleReceiveAFXDPRegister(), TmModuleReceiveDPDKRegister(), TmModuleReceiveErfDagRegister(), TmModuleReceiveErfFileRegister(), TmModuleReceiveIPFWRegister(), TmModuleReceiveNetmapRegister(), TmModuleReceiveNFLOGRegister(), TmModuleReceiveNFQRegister(), TmModuleReceivePcapFileRegister(), TmModuleReceivePcapRegister(), TmModuleReceivePfringRegister(), TmModuleReceiveWinDivertRegister(), TmModuleRespondRejectRegister(), TmModuleStatsLoggerRegister(), TmModuleUnixManagerRegister(), TmModuleVerdictIPFWRegister(), TmModuleVerdictNFQRegister(), and TmModuleVerdictWinDivertRegister().
Referenced by RunUnittests().
int RunmodeIsUnittests | ( | void | ) |
Definition at line 254 of file suricata.c.
References SCInstance_::run_mode, RUNMODE_UNITTEST, and suricata.
Referenced by AppLayerParserConfParserEnabled(), AppLayerProtoDetectConfProtoDetectionEnabledDefault(), DetectEngineThreadCtxInit(), RegisterDNP3Parsers(), RegisterENIPTCPParsers(), RegisterENIPUDPParsers(), RegisterTFTPParsers(), StreamTcpDecrMemuse(), StreamTcpInitConfig(), StreamTcpReassembleDecrMemuse(), StreamTcpThreadCacheReturnSegment(), and StreamTcpThreadCacheReturnSession().
int SCFinalizeRunMode | ( | void | ) |
Definition at line 2380 of file suricata.c.
References SCInstance_::run_mode, RUNMODE_UNKNOWN, and suricata.
Referenced by main().
TmEcode SCLoadYamlConfig | ( | void | ) |
Definition at line 965 of file suricata.c.
References SCInstance_::additional_configs, SCInstance_::conf_filename, ConfGetRootNode(), ConfYamlHandleInclude(), ConfYamlLoadFile(), DEFAULT_CONF_FILE, SCEnter, SCReturnInt, suricata, TM_ECODE_FAILED, and TM_ECODE_OK.
Referenced by main().
TmEcode SCParseCommandLine | ( | int | argc, |
char ** | argv | ||
) |
Definition at line 1324 of file suricata.c.
References SCInstance_::capture_plugin_args, SCInstance_::capture_plugin_name, ConfSetFinal(), coverage_unittests, engine_analysis, g_disable_randomness, g_skip_prefilter, g_ut_covered, g_ut_modules, LiveRegisterDeviceName(), SCInstance_::pcap_dev, SCInstance_::run_mode, RUNMODE_PFRING, RUNMODE_PLUGIN, SCLogError, strlcpy(), suricata, TM_ECODE_FAILED, and TM_ECODE_OK.
Referenced by main().
int SCRunmodeGet | ( | void | ) |
Get the current run mode.
Definition at line 263 of file suricata.c.
References SCInstance_::run_mode, and suricata.
Referenced by ConfUnixSocketIsEnable(), DPDKCleanupEAL(), DPDKCloseDevice(), DPDKFreeDevice(), RunModeGetMainMode(), and SigLoadSignatures().
void SCRunmodeSet | ( | int | run_mode | ) |
Set the current run mode.
Mainly exposed outside of suricata.c as a unit-test helper.
Definition at line 268 of file suricata.c.
References SCInstance_::run_mode, and suricata.
Referenced by LLVMFuzzerTestOneInput().
int SCStartInternalRunMode | ( | int | argc, |
char ** | argv | ||
) |
Definition at line 2324 of file suricata.c.
References SCInstance_::conf_filename, DEFAULT_CONF_FILE, SCInstance_::keyword_info, ListAppLayerProtocols(), ListKeywords(), SCInstance_::run_mode, RUNMODE_LIST_APP_LAYERS, RUNMODE_LIST_KEYWORDS, RUNMODE_PRINT_VERSION, and suricata.
Referenced by main().
void SuricataInit | ( | void | ) |
Definition at line 2921 of file suricata.c.
References ConfDump(), ConfGetBool(), g_livedev_mask, g_vlan_mask, GlobalsInitPreConfig(), SCInstance_::run_mode, RUNMODE_DUMP_CONFIG, SCLogDebug, and suricata.
Referenced by main().
void SuricataMainLoop | ( | void | ) |
Definition at line 2832 of file suricata.c.
References DetectEngineReload(), DetectEngineReloadIsStart(), DetectEngineReloadSetIdle(), DetectEngineReloadStart(), OutputNotifyFileRotation(), SCLogNotice, sighup_count, sigint_count, sigterm_count, sigusr2_count, suricata, suricata_ctl_flags, SURICATA_STOP, and TmThreadCheckThreadState().
Referenced by main().
void SuricataPostInit | ( | void | ) |
Definition at line 3015 of file suricata.c.
References ConfGetBool(), FatalError, geteuid, PacketPoolPostRunmodes(), prerun_snap, SC_ATOMIC_SET, SCLogWarning, SURICATA_RUNTIME, SystemHugepageSnapshotDestroy(), TM_ECODE_FAILED, TM_ECODE_OK, TmThreadContinueThreads(), TmThreadWaitOnThreadInit(), and TmThreadWaitOnThreadRunning().
Referenced by main().
void SuricataPreInit | ( | const char * | progname | ) |
Definition at line 2912 of file suricata.c.
Referenced by main().
void SuricataShutdown | ( | void | ) |
Definition at line 3004 of file suricata.c.
References PostRunDeinit(), SCInstance_::run_mode, SC_ATOMIC_SET, SCInstance_::start_time, suricata, SURICATA_DEINIT, TmThreadKillThreads(), and UnixSocketKillSocketThread().
Referenced by main().
int SuriHasSigFile | ( | void | ) |
Definition at line 221 of file suricata.c.
References SCInstance_::sig_file, and suricata.
bool g_disable_hashing |
Definition at line 210 of file suricata.c.
Referenced by FileForceHashParseCfg(), SSLEnableJA3(), and SSLEnableJA4().
int g_disable_randomness |
disable randomness to get reproducible results across runs
Definition at line 195 of file suricata.c.
Referenced by RandomGet(), and SCParseCommandLine().
uint16_t g_livedev_mask |
determine (without branching) if we include the livedev ids when hashing or comparing flows
Definition at line 206 of file suricata.c.
Referenced by FlowKeyGetHash(), and SuricataInit().
uint16_t g_vlan_mask |
determine (without branching) if we include the vlan_ids when hashing or comparing flows
Definition at line 202 of file suricata.c.
Referenced by FlowGetIpPairProtoHash(), FlowKeyGetHash(), and SuricataInit().
volatile uint8_t suricata_ctl_flags |
suricata engine control flags
Definition at line 172 of file suricata.c.
Referenced by EngineDone(), EngineStop(), ReceiveErfDagLoop(), ReceiveErfFileLoop(), ReceivePfringLoop(), and SuricataMainLoop().