suricata
suricata.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /** \mainpage Doxygen documentation
19  *
20  * \section intro_sec Introduction
21  *
22  * The Suricata Engine is an Open Source Next Generation Intrusion Detection
23  * and Prevention Engine. This engine is not intended to just replace or
24  * emulate the existing tools in the industry, but will bring new ideas and
25  * technologies to the field.
26  *
27  * \section dev_doc Developer documentation
28  *
29  * You've reach the automatically generated documentation of Suricata. This
30  * document contains information about architecture and code structure. It
31  * is attended for developers wanting to understand or contribute to Suricata.
32  *
33  * \subsection modules Modules
34  *
35  * Documentation is generate from comments placed in all parts of the code.
36  * But you will also find some groups describing specific functional parts:
37  * - \ref decode
38  * - \ref httplayer
39  * - \ref sigstate
40  * - \ref threshold
41  *
42  * \section archi Architecture
43  *
44  * \subsection datastruct Data structures
45  *
46  * Regarding matching, there is three main data structures which are:
47  * - ::Packet: Data relative to an individual packet with information about
48  * linked structure such as the ::Flow the ::Packet belongs to.
49  * - ::Flow: Information about a flow for example a TCP session
50  *
51  * \subsection runmode Running mode
52  *
53  * Suricata is multithreaded and running modes define how the different
54  * threads are working together. You can see util-runmodes.c for example
55  * of running mode.
56  */
57 
58 /**
59  * \file
60  *
61  * \author Victor Julien <victor@inliniac.net>
62  */
63 
64 #ifndef SURICATA_SURICATA_H
65 #define SURICATA_SURICATA_H
66 
67 #ifdef __cplusplus
68 extern "C"
69 {
70 #endif
71 
72 #include "suricata-common.h"
73 
74 /* the name of our binary */
75 #define PROG_NAME "Suricata"
76 #define PROG_VER PACKAGE_VERSION
77 
78 /* workaround SPlint error (don't know __gnuc_va_list) */
79 #ifdef S_SPLINT_S
80 # include <err.h>
81 # define CONFIG_DIR "/etc/suricata"
82 #endif
83 
84 #define DEFAULT_CONF_FILE CONFIG_DIR "/suricata.yaml"
85 
86 #define DEFAULT_PID_DIR LOCAL_STATE_DIR "/run/"
87 #define DEFAULT_PID_BASENAME "suricata.pid"
88 #define DEFAULT_PID_FILENAME DEFAULT_PID_DIR DEFAULT_PID_BASENAME
89 
90 #define DOC_URL "https://docs.suricata.io/en/"
91 const char *GetDocURL(void);
92 
93 /* runtime engine control flags */
94 #define SURICATA_STOP (1 << 0) /**< gracefully stop the engine: process all
95  outstanding packets first */
96 #define SURICATA_DONE (1 << 2) /**< packets capture ended */
97 
98 /* Engine stage/status*/
99 enum {
103 };
104 
105 /* Engine is acting as */
109  /* order matters, we need to be able to do IPS is true for >= ENGINE_MODE_IPS */
112 };
113 
114 /* superset of IPS mode */
115 void EngineModeSetFirewall(void);
116 void EngineModeSetIPS(void);
117 void EngineModeSetIDS(void);
118 int EngineModeIsUnknown(void);
119 bool EngineModeIsFirewall(void);
120 int EngineModeIsIPS(void);
121 int EngineModeIsIDS(void);
122 
123 /* Box is acting as router */
124 enum {
127 };
128 
129 #define IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode) ((host_mode) == SURI_HOST_IS_SNIFFER_ONLY)
130 
131 #include "runmodes.h"
132 
133 typedef struct SCInstance_ {
134  enum SCRunModes run_mode;
136 
137  char pcap_dev[128];
138  char *sig_file;
141  char *regex_arg;
144  /* is firewall mode enabled */
146 
149 #ifndef OS_WIN32
150  const char *user_name;
151  const char *group_name;
152  bool do_setuid;
153  bool do_setgid;
154 #endif /* OS_WIN32 */
155  uint32_t userid;
156  uint32_t groupid;
157 
158  bool system;
162 
165  int daemon;
166  int offline;
167  int verbose;
170 
171  struct timeval start_time;
172 
173  const char *log_dir;
174  const char *progname; /**< pointer to argv[0] */
175  const char *conf_filename;
176  const char **additional_configs;
178 
179  const char *capture_plugin_name;
180  const char *capture_plugin_args;
182 
183 
184 /* memset to zeros, and mutex init! */
185 void GlobalsInitPreConfig(void);
186 
187 extern volatile uint8_t suricata_ctl_flags;
188 extern int g_disable_randomness;
189 extern uint16_t g_vlan_mask;
190 extern uint16_t g_livedev_mask;
191 extern uint8_t g_recurlvl_mask;
192 
193 /* Flag to disable hashing (almost) globally. */
194 extern bool g_disable_hashing;
195 
196 void EngineStop(void);
197 void EngineDone(void);
198 
199 #ifdef UNITTESTS
200 int RunmodeIsUnittests(void);
201 #else
202 #define RunmodeIsUnittests() 0
203 #endif
204 
205 /**
206  * \brief Get the current run mode.
207  */
208 SCRunMode SCRunmodeGet(void);
209 
210 /**
211  * \brief Set the current run mode.
212  *
213  * Mainly exposed outside of suricata.c as a unit-test helper.
214  */
215 void SCRunmodeSet(SCRunMode run_mode);
216 
217 int SuriHasSigFile(void);
218 
219 void SuricataPreInit(const char *progname);
220 void SuricataInit(void);
221 void SuricataPostInit(void);
222 void SuricataMainLoop(void);
223 void SuricataShutdown(void);
224 int InitGlobal(void);
225 void GlobalsDestroy(void);
228 int SCFinalizeRunMode(void);
229 TmEcode SCParseCommandLine(int argc, char **argv);
230 int SCStartInternalRunMode(int argc, char **argv);
232 
233 void PreRunInit(const int runmode);
234 void PreRunPostPrivsDropInit(const int runmode);
235 void PostRunDeinit(const int runmode, struct timeval *start_time);
236 void RegisterAllModules(void);
237 
238 #ifdef OS_WIN32
239 int WindowsInitService(int argc, char **argv);
240 #endif
241 
242 const char *GetProgramVersion(void);
243 
244 #ifdef __cplusplus
245 }
246 #endif
247 
248 #endif /* SURICATA_SURICATA_H */
SCRunMode
enum SCRunModes SCRunMode
SCInstance_::is_firewall
bool is_firewall
Definition: suricata.h:145
SCRunmodeSet
void SCRunmodeSet(SCRunMode run_mode)
Set the current run mode.
Definition: suricata.c:284
SCInstance_::run_mode
enum SCRunModes run_mode
Definition: suricata.h:134
SCInstance_::firewall_rule_file
char * firewall_rule_file
Definition: suricata.h:142
g_disable_hashing
bool g_disable_hashing
Definition: suricata.c:214
SCInstance_::groupid
uint32_t groupid
Definition: suricata.h:156
SCInstance_::aux_run_mode
enum SCRunModes aux_run_mode
Definition: suricata.h:135
SCInstance_::daemon
int daemon
Definition: suricata.h:165
SCInstance_::checksum_validation
int checksum_validation
Definition: suricata.h:168
SCInstance_::do_setuid
bool do_setuid
Definition: suricata.h:152
SCInstance_::start_time
struct timeval start_time
Definition: suricata.h:171
g_vlan_mask
uint16_t g_vlan_mask
Definition: suricata.c:202
g_livedev_mask
uint16_t g_livedev_mask
Definition: suricata.c:206
SCInstance_::do_setgid
bool do_setgid
Definition: suricata.h:153
SCInstance
struct SCInstance_ SCInstance
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:270
SCInstance_::group_name
const char * group_name
Definition: suricata.h:151
ENGINE_MODE_FIREWALL
@ ENGINE_MODE_FIREWALL
Definition: suricata.h:111
SCInstance_::runmode_custom_mode
char * runmode_custom_mode
Definition: suricata.h:148
EngineModeIsFirewall
bool EngineModeIsFirewall(void)
Definition: suricata.c:235
SURI_HOST_IS_ROUTER
@ SURI_HOST_IS_ROUTER
Definition: suricata.h:126
SURICATA_DEINIT
@ SURICATA_DEINIT
Definition: suricata.h:102
SCInstance_::userid
uint32_t userid
Definition: suricata.h:155
InitGlobal
int InitGlobal(void)
Global initialization common to all runmodes.
Definition: suricata.c:2958
ENGINE_MODE_IPS
@ ENGINE_MODE_IPS
Definition: suricata.h:110
EngineStop
void EngineStop(void)
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be a...
Definition: suricata.c:465
SCInstance_::output_flush_interval
int output_flush_interval
Definition: suricata.h:169
PreRunPostPrivsDropInit
void PreRunPostPrivsDropInit(const int runmode)
Definition: suricata.c:2310
SCInstance_::conf_filename
const char * conf_filename
Definition: suricata.h:175
SCLoadYamlConfig
TmEcode SCLoadYamlConfig(void)
Definition: suricata.c:1007
SCRunModes
SCRunModes
Definition: runmodes.h:27
SCInstance_::capture_plugin_name
const char * capture_plugin_name
Definition: suricata.h:179
EngineMode
EngineMode
Definition: suricata.h:106
SCInstance_::set_datadir
bool set_datadir
Definition: suricata.h:160
SuricataShutdown
void SuricataShutdown(void)
Definition: suricata.c:3093
SCInstance_::capture_plugin_args
const char * capture_plugin_args
Definition: suricata.h:180
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:242
EngineDone
void EngineDone(void)
Used to indicate that the current task is done.
Definition: suricata.c:476
ENGINE_MODE_UNKNOWN
@ ENGINE_MODE_UNKNOWN
Definition: suricata.h:107
PostConfLoadedDetectSetup
void PostConfLoadedDetectSetup(SCInstance *suri)
Definition: suricata.c:2620
GlobalsInitPreConfig
void GlobalsInitPreConfig(void)
Definition: suricata.c:377
SCInstance_::unix_socket_enabled
bool unix_socket_enabled
Definition: suricata.h:161
SCInstance_::delayed_detect
int delayed_detect
Definition: suricata.h:163
SCInstance_::progname
const char * progname
Definition: suricata.h:174
SCInstance_::pcap_dev
char pcap_dev[128]
Definition: suricata.h:137
GlobalsDestroy
void GlobalsDestroy(void)
Definition: suricata.c:385
SCInstance_::user_name
const char * user_name
Definition: suricata.h:150
SCInstance_::offline
int offline
Definition: suricata.h:166
SuricataMainLoop
void SuricataMainLoop(void)
Definition: suricata.c:2915
GetProgramVersion
const char * GetProgramVersion(void)
get string with program version
Definition: suricata.c:1181
EngineModeSetIDS
void EngineModeSetIDS(void)
Definition: suricata.c:264
SCInstance_::verbose
int verbose
Definition: suricata.h:167
TmEcode
TmEcode
Definition: tm-threads-common.h:80
SCInstance_::additional_configs
const char ** additional_configs
Definition: suricata.h:176
SCInstance_::set_logdir
bool set_logdir
Definition: suricata.h:159
SCInstance_::log_dir
const char * log_dir
Definition: suricata.h:173
runmodes.h
SURICATA_INIT
@ SURICATA_INIT
Definition: suricata.h:100
EngineModeSetIPS
void EngineModeSetIPS(void)
Definition: suricata.c:259
g_recurlvl_mask
uint8_t g_recurlvl_mask
Definition: suricata.c:210
SURI_HOST_IS_SNIFFER_ONLY
@ SURI_HOST_IS_SNIFFER_ONLY
Definition: suricata.h:125
SuricataInit
void SuricataInit(void)
Definition: suricata.c:3005
SCStartInternalRunMode
int SCStartInternalRunMode(int argc, char **argv)
Definition: suricata.c:2384
SCInstance_::strict_rule_parsing_string
char * strict_rule_parsing_string
Definition: suricata.h:177
suricata-common.h
EngineModeIsUnknown
int EngineModeIsUnknown(void)
Definition: suricata.c:230
SURICATA_RUNTIME
@ SURICATA_RUNTIME
Definition: suricata.h:101
SCInstance_::sig_file
char * sig_file
Definition: suricata.h:138
PreRunInit
void PreRunInit(const int runmode)
Definition: suricata.c:2281
EngineModeSetFirewall
void EngineModeSetFirewall(void)
Definition: suricata.c:254
SCInstance_::system
bool system
Definition: suricata.h:158
SCInstance_::pid_filename
char * pid_filename
Definition: suricata.h:140
PostRunDeinit
void PostRunDeinit(const int runmode, struct timeval *start_time)
clean up / shutdown code for packet modes
Definition: suricata.c:2326
SCFinalizeRunMode
int SCFinalizeRunMode(void)
Definition: suricata.c:2446
SuricataPostInit
void SuricataPostInit(void)
Definition: suricata.c:3104
EngineModeIsIDS
int EngineModeIsIDS(void)
Definition: suricata.c:248
SCInstance_::firewall_rule_file_exclusive
bool firewall_rule_file_exclusive
Definition: suricata.h:143
SuricataPreInit
void SuricataPreInit(const char *progname)
Definition: suricata.c:2996
SCInstance_
Definition: suricata.h:133
SCRunmodeGet
SCRunMode SCRunmodeGet(void)
Get the current run mode.
Definition: suricata.c:279
SCInstance_::disabled_detect
int disabled_detect
Definition: suricata.h:164
ENGINE_MODE_IDS
@ ENGINE_MODE_IDS
Definition: suricata.h:108
SCInstance_::sig_file_exclusive
bool sig_file_exclusive
Definition: suricata.h:139
RegisterAllModules
void RegisterAllModules(void)
Definition: suricata.c:942
SCInstance_::regex_arg
char * regex_arg
Definition: suricata.h:141
SCParseCommandLine
TmEcode SCParseCommandLine(int argc, char **argv)
Definition: suricata.c:1364
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:172
g_disable_randomness
int g_disable_randomness
Definition: suricata.c:195
SCInstance_::keyword_info
char * keyword_info
Definition: suricata.h:147
SuriHasSigFile
int SuriHasSigFile(void)
Definition: suricata.c:225
GetDocURL
const char * GetDocURL(void)
Definition: suricata.c:1160
PostConfLoadedSetup
int PostConfLoadedSetup(SCInstance *suri)
Definition: suricata.c:2711