suricata
suricata.h File Reference
#include "suricata-common.h"
#include "runmodes.h"
Include dependency graph for suricata.h:

Go to the source code of this file.

Data Structures

struct  SCInstance_
 

Macros

#define PROG_NAME   "Suricata"
 
#define PROG_VER   PACKAGE_VERSION
 
#define DEFAULT_CONF_FILE   CONFIG_DIR "/suricata.yaml"
 
#define DEFAULT_PID_DIR   LOCAL_STATE_DIR "/run/"
 
#define DEFAULT_PID_BASENAME   "suricata.pid"
 
#define DEFAULT_PID_FILENAME   DEFAULT_PID_DIR DEFAULT_PID_BASENAME
 
#define DOC_URL   "https://docs.suricata.io/en/"
 
#define SURICATA_STOP   (1 << 0)
 
#define SURICATA_DONE   (1 << 2)
 
#define IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode)   ((host_mode) == SURI_HOST_IS_SNIFFER_ONLY)
 

Typedefs

typedef struct SCInstance_ SCInstance
 

Enumerations

enum  { SURICATA_INIT = 0, SURICATA_RUNTIME, SURICATA_DEINIT }
 
enum  EngineMode { ENGINE_MODE_UNKNOWN, ENGINE_MODE_IDS, ENGINE_MODE_IPS }
 
enum  { SURI_HOST_IS_SNIFFER_ONLY, SURI_HOST_IS_ROUTER }
 

Functions

const char * GetDocURL (void)
 
void EngineModeSetIPS (void)
 
void EngineModeSetIDS (void)
 
int EngineModeIsUnknown (void)
 
int EngineModeIsIPS (void)
 
int EngineModeIsIDS (void)
 
void GlobalsInitPreConfig (void)
 
void EngineStop (void)
 make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be able to tell the engine the file eof is reached. More...
 
void EngineDone (void)
 Used to indicate that the current task is done. More...
 
int RunmodeIsUnittests (void)
 
int SCRunmodeGet (void)
 Get the current run mode. More...
 
void SCRunmodeSet (int run_mode)
 Set the current run mode. More...
 
int SuriHasSigFile (void)
 
void SuricataPreInit (const char *progname)
 
void SuricataInit (void)
 
void SuricataPostInit (void)
 
void SuricataMainLoop (void)
 
void SuricataShutdown (void)
 
int InitGlobal (void)
 Global initialization common to all runmodes. More...
 
void GlobalsDestroy (void)
 
int PostConfLoadedSetup (SCInstance *suri)
 
void PostConfLoadedDetectSetup (SCInstance *suri)
 
int SCFinalizeRunMode (void)
 
TmEcode SCParseCommandLine (int argc, char **argv)
 
int SCStartInternalRunMode (int argc, char **argv)
 
TmEcode SCLoadYamlConfig (void)
 
void PreRunInit (const int runmode)
 
void PreRunPostPrivsDropInit (const int runmode)
 
void PostRunDeinit (const int runmode, struct timeval *start_time)
 
void RegisterAllModules (void)
 
const char * GetProgramVersion (void)
 get string with program version More...
 

Variables

volatile uint8_t suricata_ctl_flags
 
int g_disable_randomness
 
uint16_t g_vlan_mask
 
uint16_t g_livedev_mask
 
bool g_disable_hashing
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file suricata.h.

Macro Definition Documentation

◆ DEFAULT_CONF_FILE

#define DEFAULT_CONF_FILE   CONFIG_DIR "/suricata.yaml"

Definition at line 80 of file suricata.h.

◆ DEFAULT_PID_BASENAME

#define DEFAULT_PID_BASENAME   "suricata.pid"

Definition at line 83 of file suricata.h.

◆ DEFAULT_PID_DIR

#define DEFAULT_PID_DIR   LOCAL_STATE_DIR "/run/"

Definition at line 82 of file suricata.h.

◆ DEFAULT_PID_FILENAME

#define DEFAULT_PID_FILENAME   DEFAULT_PID_DIR DEFAULT_PID_BASENAME

Definition at line 84 of file suricata.h.

◆ DOC_URL

#define DOC_URL   "https://docs.suricata.io/en/"

Definition at line 86 of file suricata.h.

◆ IS_SURI_HOST_MODE_SNIFFER_ONLY

#define IS_SURI_HOST_MODE_SNIFFER_ONLY (   host_mode)    ((host_mode) == SURI_HOST_IS_SNIFFER_ONLY)

Definition at line 120 of file suricata.h.

◆ PROG_NAME

#define PROG_NAME   "Suricata"

Definition at line 71 of file suricata.h.

◆ PROG_VER

#define PROG_VER   PACKAGE_VERSION

Definition at line 72 of file suricata.h.

◆ SURICATA_DONE

#define SURICATA_DONE   (1 << 2)

packets capture ended

Definition at line 92 of file suricata.h.

◆ SURICATA_STOP

#define SURICATA_STOP   (1 << 0)

gracefully stop the engine: process all outstanding packets first

Definition at line 91 of file suricata.h.

Typedef Documentation

◆ SCInstance

typedef struct SCInstance_ SCInstance

Enumeration Type Documentation

◆ anonymous enum

anonymous enum
Enumerator
SURICATA_INIT 
SURICATA_RUNTIME 
SURICATA_DEINIT 

Definition at line 94 of file suricata.h.

◆ anonymous enum

anonymous enum
Enumerator
SURI_HOST_IS_SNIFFER_ONLY 
SURI_HOST_IS_ROUTER 

Definition at line 114 of file suricata.h.

◆ EngineMode

enum EngineMode
Enumerator
ENGINE_MODE_UNKNOWN 
ENGINE_MODE_IDS 
ENGINE_MODE_IPS 

Definition at line 101 of file suricata.h.

Function Documentation

◆ EngineDone()

void EngineDone ( void  )

Used to indicate that the current task is done.

This is mainly used by pcap-file to tell it has finished to treat a pcap files when running in unix-socket mode.

Definition at line 458 of file suricata.c.

References suricata_ctl_flags, and SURICATA_DONE.

◆ EngineModeIsIDS()

int EngineModeIsIDS ( void  )

Definition at line 235 of file suricata.c.

References DEBUG_VALIDATE_BUG_ON.

◆ EngineModeIsIPS()

int EngineModeIsIPS ( void  )

Definition at line 229 of file suricata.c.

References DEBUG_VALIDATE_BUG_ON.

Referenced by AlertJsonHeader(), CaptureStatsSetup(), CaptureStatsUpdate(), EveAddVerdict(), ExceptionPolicyParse(), FlowHandlePacketUpdate(), and StreamTcpInitConfig().

Here is the caller graph for this function:

◆ EngineModeIsUnknown()

int EngineModeIsUnknown ( void  )

Definition at line 224 of file suricata.c.

Referenced by PostConfLoadedSetup().

Here is the caller graph for this function:

◆ EngineModeSetIDS()

void EngineModeSetIDS ( void  )

Definition at line 246 of file suricata.c.

Referenced by ListAppLayerProtocols(), ListKeywords(), LLVMFuzzerTestOneInput(), PostConfLoadedSetup(), and RunUnittests().

Here is the caller graph for this function:

◆ EngineModeSetIPS()

void EngineModeSetIPS ( void  )

Definition at line 241 of file suricata.c.

◆ EngineStop()

void EngineStop ( void  )

make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be able to tell the engine the file eof is reached.

Definition at line 447 of file suricata.c.

References suricata_ctl_flags, and SURICATA_STOP.

Referenced by ReceiveErfFileLoop().

Here is the caller graph for this function:

◆ GetDocURL()

const char* GetDocURL ( void  )

Definition at line 1111 of file suricata.c.

References DOC_URL, GetProgramVersion(), and PROG_VER.

Here is the call graph for this function:

◆ GetProgramVersion()

const char* GetProgramVersion ( void  )

get string with program version

Get the program version as passed to us from AC_INIT

Add 'RELEASE' is no '-dev' in the version. Add the REVISION if passed to us.

Possible outputs: release: '5.0.1 RELEASE' dev with rev: '5.0.1-dev (64a789bbf 2019-10-18)' dev w/o rev: '5.0.1-dev'

Definition at line 1132 of file suricata.c.

References PROG_VER, and xstr.

Referenced by GetDocURL().

Here is the caller graph for this function:

◆ GlobalsDestroy()

◆ GlobalsInitPreConfig()

void GlobalsInitPreConfig ( void  )

Definition at line 359 of file suricata.c.

References FrameConfigInit(), SCProtoNameInit(), SCThresholdConfGlobalInit(), SupportFastPatternForSigMatchTypes(), and TimeInit().

Referenced by LLVMFuzzerTestOneInput(), RunUnittests(), and SuricataInit().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ InitGlobal()

int InitGlobal ( void  )

Global initialization common to all runmodes.

This can be used by fuzz targets.

Definition at line 2856 of file suricata.c.

References ConfInit(), ParseSizeInit(), RunModeRegisterRunModes(), SC_ATOMIC_INIT, SCLogError, SCLogInitLogModule(), SCSetThreadName, suricata_context, tmm_modules, TMM_SIZE, UtilSignalBlock(), UtilSignalHandlerSetup(), and VarNameStoreInit().

Referenced by LLVMFuzzerTestOneInput().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PostConfLoadedDetectSetup()

void PostConfLoadedDetectSetup ( SCInstance suri)

Definition at line 2535 of file suricata.c.

References de_ctx, and SCInstance_::disabled_detect.

◆ PostConfLoadedSetup()

◆ PostRunDeinit()

void PostRunDeinit ( const int  runmode,
struct timeval *  start_time 
)

Definition at line 2265 of file suricata.c.

References FlowDisableFlowManagerThread(), FlowWorkToDoCleanup(), PacketPoolInit(), RUNMODE_UNIX_SOCKET, TmThreadDisablePacketThreads(), and TmThreadDisableReceiveThreads().

Referenced by PreRunPostPrivsDropInit(), and SuricataShutdown().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PreRunInit()

◆ PreRunPostPrivsDropInit()

void PreRunPostPrivsDropInit ( const int  runmode)

◆ RegisterAllModules()

◆ RunmodeIsUnittests()

◆ SCFinalizeRunMode()

int SCFinalizeRunMode ( void  )

Definition at line 2368 of file suricata.c.

References SCInstance_::run_mode, RUNMODE_UNKNOWN, and suricata.

Referenced by main().

Here is the caller graph for this function:

◆ SCLoadYamlConfig()

TmEcode SCLoadYamlConfig ( void  )

Definition at line 958 of file suricata.c.

References SCInstance_::additional_configs, SCInstance_::conf_filename, ConfGetRootNode(), ConfYamlHandleInclude(), ConfYamlLoadFile(), DEFAULT_CONF_FILE, SCEnter, SCReturnInt, suricata, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by main().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SCParseCommandLine()

TmEcode SCParseCommandLine ( int  argc,
char **  argv 
)

◆ SCRunmodeGet()

int SCRunmodeGet ( void  )

Get the current run mode.

Definition at line 261 of file suricata.c.

References SCInstance_::run_mode, and suricata.

Referenced by ConfUnixSocketIsEnable(), DPDKCleanupEAL(), DPDKCloseDevice(), DPDKFreeDevice(), RunModeGetMainMode(), and SigLoadSignatures().

Here is the caller graph for this function:

◆ SCRunmodeSet()

void SCRunmodeSet ( int  run_mode)

Set the current run mode.

Mainly exposed outside of suricata.c as a unit-test helper.

Definition at line 266 of file suricata.c.

References SCInstance_::run_mode, and suricata.

Referenced by LLVMFuzzerTestOneInput().

Here is the caller graph for this function:

◆ SCStartInternalRunMode()

int SCStartInternalRunMode ( int  argc,
char **  argv 
)

Definition at line 2312 of file suricata.c.

References SCInstance_::conf_filename, DEFAULT_CONF_FILE, SCInstance_::keyword_info, ListAppLayerProtocols(), ListKeywords(), SCInstance_::run_mode, RUNMODE_LIST_APP_LAYERS, RUNMODE_LIST_KEYWORDS, RUNMODE_PRINT_VERSION, and suricata.

Referenced by main().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SuricataInit()

void SuricataInit ( void  )

Definition at line 2902 of file suricata.c.

References ConfDump(), ConfGetBool(), g_livedev_mask, g_vlan_mask, GlobalsInitPreConfig(), SCInstance_::run_mode, RUNMODE_DUMP_CONFIG, SCLogDebug, and suricata.

Referenced by main().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SuricataMainLoop()

void SuricataMainLoop ( void  )

◆ SuricataPostInit()

void SuricataPostInit ( void  )

Definition at line 2996 of file suricata.c.

References ConfGetBool(), FatalError, geteuid, PacketPoolPostRunmodes(), prerun_snap, SC_ATOMIC_SET, SCLogWarning, SURICATA_RUNTIME, SystemHugepageSnapshotDestroy(), TM_ECODE_FAILED, TM_ECODE_OK, TmThreadContinueThreads(), TmThreadWaitOnThreadInit(), and TmThreadWaitOnThreadRunning().

Referenced by main().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SuricataPreInit()

void SuricataPreInit ( const char *  progname)

Definition at line 2893 of file suricata.c.

Referenced by main().

Here is the caller graph for this function:

◆ SuricataShutdown()

void SuricataShutdown ( void  )

Definition at line 2985 of file suricata.c.

References PostRunDeinit(), SCInstance_::run_mode, SC_ATOMIC_SET, SCInstance_::start_time, suricata, SURICATA_DEINIT, TmThreadKillThreads(), and UnixSocketKillSocketThread().

Referenced by main().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SuriHasSigFile()

int SuriHasSigFile ( void  )

Definition at line 219 of file suricata.c.

References SCInstance_::sig_file, and suricata.

Variable Documentation

◆ g_disable_hashing

bool g_disable_hashing

Definition at line 208 of file suricata.c.

Referenced by FileForceHashParseCfg(), SSLEnableJA3(), and SSLEnableJA4().

◆ g_disable_randomness

int g_disable_randomness

disable randomness to get reproducible results across runs

Definition at line 193 of file suricata.c.

Referenced by RandomGet(), and SCParseCommandLine().

◆ g_livedev_mask

uint16_t g_livedev_mask

determine (without branching) if we include the livedev ids when hashing or comparing flows

Definition at line 204 of file suricata.c.

Referenced by FlowKeyGetHash(), and SuricataInit().

◆ g_vlan_mask

uint16_t g_vlan_mask

determine (without branching) if we include the vlan_ids when hashing or comparing flows

Definition at line 200 of file suricata.c.

Referenced by FlowKeyGetHash(), and SuricataInit().

◆ suricata_ctl_flags

volatile uint8_t suricata_ctl_flags

suricata engine control flags

Definition at line 170 of file suricata.c.

Referenced by EngineDone(), EngineStop(), ReceiveErfDagLoop(), ReceiveErfFileLoop(), and SuricataMainLoop().