suricata
suricata.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /** \mainpage Doxygen documentation
19  *
20  * \section intro_sec Introduction
21  *
22  * The Suricata Engine is an Open Source Next Generation Intrusion Detection
23  * and Prevention Engine. This engine is not intended to just replace or
24  * emulate the existing tools in the industry, but will bring new ideas and
25  * technologies to the field.
26  *
27  * \section dev_doc Developer documentation
28  *
29  * You've reach the automically generated documentation of Suricata. This
30  * document contains information about architecture and code structure. It
31  * is attended for developers wanting to understand or contribute to Suricata.
32  *
33  * \subsection modules Modules
34  *
35  * Documentation is generate from comments placed in all parts of the code.
36  * But you will also find some groups describing specific functional parts:
37  * - \ref decode
38  * - \ref httplayer
39  * - \ref sigstate
40  * - \ref threshold
41  *
42  * \section archi Architecture
43  *
44  * \subsection datastruct Data structures
45  *
46  * Regarding matching, there is three main data structures which are:
47  * - ::Packet: Data relative to an individual packet with information about
48  * linked structure such as the ::Flow the ::Packet belongs to.
49  * - ::Flow: Information about a flow for example a TCP session
50  *
51  * \subsection runmode Running mode
52  *
53  * Suricata is multithreaded and running modes define how the different
54  * threads are working together. You can see util-runmodes.c for example
55  * of running mode.
56  */
57 
58 /**
59  * \file
60  *
61  * \author Victor Julien <victor@inliniac.net>
62  */
63 
64 #ifndef __SURICATA_H__
65 #define __SURICATA_H__
66 
67 #include "suricata-common.h"
68 #include "packet-queue.h"
69 
70 /* the name of our binary */
71 #define PROG_NAME "Suricata"
72 #define PROG_VER "5.0.0-dev"
73 
74 /* workaround SPlint error (don't know __gnuc_va_list) */
75 #ifdef S_SPLINT_S
76 # include <err.h>
77 # define CONFIG_DIR "/etc/suricata"
78 #endif
79 
80 #define DEFAULT_CONF_FILE CONFIG_DIR "/suricata.yaml"
81 
82 #define DEFAULT_PID_DIR LOCAL_STATE_DIR "/run/"
83 #define DEFAULT_PID_BASENAME "suricata.pid"
84 #define DEFAULT_PID_FILENAME DEFAULT_PID_DIR DEFAULT_PID_BASENAME
85 
86 #define DOC_URL "https://suricata.readthedocs.io/en/"
87 
88 #if defined RELEASE
89 #define DOC_VERSION "suricata-" PROG_VER
90 #else
91 #define DOC_VERSION "latest"
92 #endif
93 
94 /* runtime engine control flags */
95 #define SURICATA_STOP (1 << 0) /**< gracefully stop the engine: process all
96  outstanding packets first */
97 #define SURICATA_DONE (1 << 2) /**< packets capture ended */
98 
99 /* Engine stage/status*/
100 enum {
101  SURICATA_INIT = 0,
104 };
105 
106 /* Engine is acting as */
107 enum EngineMode {
110 };
111 
112 void EngineModeSetIPS(void);
113 void EngineModeSetIDS(void);
114 int EngineModeIsIPS(void);
115 int EngineModeIsIDS(void);
116 
117 /* Box is acting as router */
118 enum {
121 };
122 
123 #define IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode) ((host_mode) == SURI_HOST_IS_SNIFFER_ONLY)
124 #define IS_SURI_HOST_MODE_ROUTER(host_mode) ((host_mode) == SURI_HOST_IS_ROUTER)
126 #include "runmodes.h"
127 
128 /* queue's between various other threads
129  * XXX move to the TmQueue structure later
130  */
131 PacketQueue trans_q[256];
133 typedef struct SCInstance_ {
137  char pcap_dev[128];
138  char *sig_file;
141  char *regex_arg;
143  char *keyword_info;
145 #ifndef OS_WIN32
146  const char *user_name;
147  const char *group_name;
148  uint8_t do_setuid;
149  uint8_t do_setgid;
150  uint32_t userid;
151  uint32_t groupid;
152 #endif /* OS_WIN32 */
153 
154  bool system;
157  int delayed_detect;
159  int daemon;
160  int offline;
161  int verbose;
164  struct timeval start_time;
166  const char *log_dir;
167  const char *progname; /**< pointer to argv[0] */
168  const char *conf_filename;
170 
171 
172 /* memset to zeros, and mutex init! */
173 void GlobalsInitPreConfig(void);
174 
175 extern volatile uint8_t suricata_ctl_flags;
176 extern int g_disable_randomness;
177 extern uint16_t g_vlan_mask;
178 
179 #include <ctype.h>
180 #define u8_tolower(c) tolower((uint8_t)(c))
182 void EngineStop(void);
183 void EngineDone(void);
184 
185 int RunmodeIsUnittests(void);
186 int RunmodeGetCurrent(void);
187 int IsRuleReloadSet(int quiet);
188 
189 int SuriHasSigFile(void);
190 
191 extern int run_mode;
192 
193 void PreRunInit(const int runmode);
194 void PreRunPostPrivsDropInit(const int runmode);
195 void PostRunDeinit(const int runmode, struct timeval *start_time);
196 void RegisterAllModules(void);
197 
198 #endif /* __SURICATA_H__ */
199 
void PostRunDeinit(const int runmode, struct timeval *start_time)
Definition: suricata.c:2278
int disabled_detect
Definition: suricata.h:159
void EngineStop(void)
make sure threads can stop the engine by calling this function. Purpose: pcap file mode needs to be a...
Definition: suricata.c:426
void EngineModeSetIPS(void)
Definition: suricata.c:255
char * runmode_custom_mode
Definition: suricata.h:145
int daemon
Definition: suricata.h:160
int IsRuleReloadSet(int quiet)
void EngineModeSetIDS(void)
Definition: suricata.c:260
uint16_t g_vlan_mask
Definition: suricata.c:235
EngineMode
Definition: suricata.h:108
int EngineModeIsIDS(void)
Definition: suricata.c:250
uint32_t userid
Definition: suricata.h:151
int checksum_validation
Definition: suricata.h:163
const char * user_name
Definition: suricata.h:147
void RegisterAllModules(void)
Definition: suricata.c:869
RunModes
Definition: runmodes.h:27
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:201
void PreRunInit(const int runmode)
Definition: suricata.c:2241
const char * conf_filename
Definition: suricata.h:169
int EngineModeIsIPS(void)
Definition: suricata.c:245
int delayed_detect
Definition: suricata.h:158
char pcap_dev[128]
Definition: suricata.h:138
void PreRunPostPrivsDropInit(const int runmode)
Definition: suricata.c:2264
int RunmodeIsUnittests(void)
Definition: suricata.c:265
bool set_logdir
Definition: suricata.h:156
bool system
Definition: suricata.h:155
enum RunModes aux_run_mode
Definition: suricata.h:136
void GlobalsInitPreConfig(void)
Definition: suricata.c:328
int g_disable_randomness
Definition: suricata.c:228
char * pid_filename
Definition: suricata.h:141
const char * progname
Definition: suricata.h:168
int offline
Definition: suricata.h:161
PacketQueue trans_q[256]
Definition: suricata.h:132
char * regex_arg
Definition: suricata.h:142
int verbose
Definition: suricata.h:162
void EngineDone(void)
Used to indicate that the current task is done.
Definition: suricata.c:437
int SuriHasSigFile(void)
Definition: suricata.c:240
const char * log_dir
Definition: suricata.h:167
const char * group_name
Definition: suricata.h:148
struct SCInstance_ SCInstance
uint8_t do_setuid
Definition: suricata.h:149
int RunmodeGetCurrent(void)
Definition: suricata.c:273
char * keyword_info
Definition: suricata.h:144
uint32_t groupid
Definition: suricata.h:152
int sig_file_exclusive
Definition: suricata.h:140
uint8_t do_setgid
Definition: suricata.h:150
struct timeval start_time
Definition: suricata.h:165
char * sig_file
Definition: suricata.h:139
enum RunModes run_mode
Definition: suricata.h:135