snort.c File Reference

#include <errno.h>
#include <sys/types.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/stat.h>
#include <grp.h>
#include <pwd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <timersub.h>
#include "snort.h"
#include "rules.h"
#include "plugbase.h"
#include "signal.h"
#include "debug.h"
#include "util.h"
#include "parser.h"
#include "tag.h"
#include "log.h"
#include "detect.h"
#include "mstring.h"
#include "fpcreate.h"
#include "fpdetect.h"
#include "sfthreshold.h"
#include "packet_time.h"
#include "src/preprocessors/flow/flow_print.h"
#include "src/detection-plugins/sp_flowbits.h"
#include "src/preprocessors/spp_perfmonitor.h"
#include "src/preprocessors/spp_bait_and_switch.h"
#include "event_queue.h"
#include "asn1.h"
#include "inline.h"
#include "mpse.h"

Go to the source code of this file.

Defines
#define	DLT_OLDPFLOG   17
#define	FPUTS_WIN32(msg)
#define	FPUTS_UNIX(msg)   fputs(msg,stdout)
#define	FPUTS_BOTH(msg)   fputs(msg,stdout)
Functions
static char *	ConfigFileSearch ()
static int	ProcessAlertCommandLine ()
static int	ProcessLogCommandLine ()
static void	Restart ()
static void	SigTermHandler (int signal)
static void	SigIntHandler (int signal)
static void	SigQuitHandler (int signal)
static void	SigHupHandler (int signal)
static void	SigUsrHandler (int signal)
int	main (int argc, char *argv[])
int	SnortMain (int argc, char *argv[])
void	PcapProcessPacket (char *user, struct pcap_pkthdr *pkthdr, u_char *pkt)
void	ProcessPacket (char *user, struct pcap_pkthdr *pkthdr, u_char *pkt, void *ft)
int	ShowUsage (char *progname)
int	ParseCmdLine (int argc, char *argv[])
int	SetPktProcessor ()
void *	InterfaceThread (void *arg)
int	OpenPcap ()
void	SigCantHupHandler (int signal)
void	CleanExit (int exit_val)
Variables
OutputFuncNode *	AlertList
OutputFuncNode *	LogList
int	errno
u_int8_t	runMode = 0
PV	pv
int	datalink
char *	progname
char **	progargs
char *	username
char *	groupname
unsigned long	userid = 0
unsigned long	groupid = 0
passwd *	pw
group *	gr
char *	pcap_cmd
char *	pktidx
pcap_t *	pd
int	g_drop_pkt
FILE *	alert
FILE *	binlog_ptr
int	flow
int	thiszone
PacketCount	pc
u_long	netmasks [33]
pcap_pkthdr *	g_pkthdr
u_char *	g_pkt
u_long	g_caplen
char *	protocol_names [256]
u_int	snaplen
grinder_t	grinder
runtime_config	snort_runtime
char	_PATH_VARRUN [STD_BUF]
SFPERF	sfPerf
char *	optarg
int	optind
int	opterr
int	optopt
static struct timeval	starttime
static struct timeval	endtime
PluginSignalFuncNode *	PluginShutdownList
PluginSignalFuncNode *	PluginCleanExitList
PluginSignalFuncNode *	PluginRestartList

---

Define Documentation

#define DLT_OLDPFLOG   17

Definition at line 108 of file snort.c. Referenced by SetPktProcessor().

#define FPUTS_BOTH (  msg   )     fputs(msg,stdout)

Referenced by ShowUsage().

#define FPUTS_UNIX (  msg   )     fputs(msg,stdout)

Referenced by ShowUsage().

#define FPUTS_WIN32 (  msg   )

Referenced by ShowUsage().

---

Function Documentation

void CleanExit (  int  exit_val  )

Definition at line 2417 of file snort.c. References _PluginSignalFuncNode::arg, bzero, _progvars::done_processing, DropStats(), endtime, fpShowEventStats(), _PluginSignalFuncNode::func, gettimeofday(), InlineMode(), LogMessage(), _PluginSignalFuncNode::next, NULL, pcap_close(), _progvars::pid_filename, SIGQUIT, starttime, _progvars::test_mode_flag, and TIMERSUB. Referenced by InterfaceThread(), SetPktProcessor(), SigIntHandler(), SigQuitHandler(), SigTermHandler(), and SnortMain().

static char * ConfigFileSearch (   )  [static]

Definition at line 2212 of file snort.c. References FatalError(), home_dir, and NULL. Referenced by SnortMain().

void* InterfaceThread (  void *  arg  )

Definition at line 2006 of file snort.c. References bzero, CleanExit(), _progvars::daemon_flag, _progvars::done_processing, ErrorMessage(), gettimeofday(), LOG_CONS, LOG_DAEMON, LOG_PID, NULL, pcap_geterr(), pcap_loop(), PcapProcessPacket(), _progvars::pkt_cnt, starttime, and syslog(). Referenced by SnortMain().

int main (  int  argc, char *  argv[] )

Definition at line 198 of file snort.c. References FatalError(), and SnortMain().

int OpenPcap (   )

Definition at line 2046 of file snort.c. References datalink, DEBUG_INIT, DEBUG_WRAP, DefineIfaceVar(), ErrorMessage(), FatalError(), _progvars::interface, LogMessage(), MIN_SNAPLEN, NULL, _progvars::pcap_cmd, pcap_compile(), pcap_datalink(), PCAP_ERRBUF_SIZE, pcap_geterr(), pcap_lookupdev(), pcap_lookupnet(), pcap_open_live(), pcap_open_offline(), pcap_setfilter(), pcap_snapshot(), _progvars::pkt_snaplen, PRINT_INTERFACE, PROMISC, _progvars::promisc_flag, _progvars::quiet_flag, READ_TIMEOUT, _progvars::readfile, _progvars::readmode_flag, snaplen, SNAPLEN, and strstr(). Referenced by ParseConfig(), and SnortMain().

int ParseCmdLine (  int  argc, char *  argv[] )

Definition at line 967 of file snort.c. References access, _progvars::alert_cmd_override, ALERT_CMG, ALERT_FAST, ALERT_FULL, _progvars::alert_interface_flag, _progvars::alert_mode, ALERT_NONE, ALERT_STDOUT, ALERT_SYSLOG, ALERT_UNSOCK, _progvars::assurance_mode, ASSURE_EST, bcopy, _progvars::binLogFile, _progvars::char_data_flag, _progvars::checksums_mode, _progvars::chroot_dir, _progvars::config_file, copy_argv(), _progvars::daemon_flag, _progvars::data_flag, DEBUG_INIT, DEBUG_WRAP, DisplayBanner(), DO_ICMP_CHECKSUMS, DO_IP_CHECKSUMS, DO_TCP_CHECKSUMS, DO_UDP_CHECKSUMS, _progvars::event_log_id, FatalError(), FatalPrintError(), FILEACCESSBITS, VarEntry::flags, flow_set_daemon(), GenHomenet(), GenObfuscationMask(), GetAdapterFromList(), getopt(), gr, groupid, groupname, _progvars::include_year, _progvars::inline_flag, InlineMode(), _progvars::interface, _progvars::line_buffer_flag, LOG_ASCII, _progvars::log_cmd_override, _progvars::log_dir, _progvars::log_mode, LOG_NONE, LOG_PCAP, LogMessage(), MAX_PIDFILE_SUFFIX, VarEntry::name, NULL, _progvars::obfuscation_flag, optarg, optind, optopt, _progvars::pcap_cmd, PCAP_ERRBUF_SIZE, pcap_lookupdev(), _progvars::pidfile_suffix, _progvars::pkt_cnt, _progvars::pkt_snaplen, PRINT_INTERFACE, PrintDeviceList(), progname, _progvars::promisc_flag, pw, _progvars::quiet_flag, read_infile(), _progvars::readfile, _progvars::readmode_flag, _progvars::rules_order_flag, SetPerfmonitorFile(), _progvars::show2hdr_flag, ShowUsage(), _progvars::showwifimgmt_flag, snprintf, STD_BUF, strcasecmp, strlcpy, strstr(), strtol(), strtoul(), _progvars::test_mode_flag, _progvars::use_utc, userid, username, VAR_STATIC, VarDefine(), _progvars::verbose_bytedump_flag, and _progvars::verbose_flag. Referenced by SnortMain().

void PcapProcessPacket (  char *  user, struct pcap_pkthdr *  pkthdr, u_char *  pkt )

Definition at line 749 of file snort.c. References pcap_pkthdr::caplen, ClearDumpBuf(), NULL, packet_time_update(), ProcessPacket(), _SFPERF::sfBase, sfthreshold_reset(), SnortEventqReset(), _PacketCount::total, pcap_pkthdr::ts, and UpdateWireStats(). Referenced by InterfaceThread().

static int ProcessAlertCommandLine (   )  [static]

Definition at line 2257 of file snort.c. References ActivateOutputPlugin(), _progvars::alert_cmd_override, ALERT_CMG, ALERT_FAST, ALERT_FULL, _progvars::alert_mode, ALERT_NONE, ALERT_STDOUT, ALERT_SYSLOG, ALERT_UNSOCK, FatalError(), NoAlert(), NT_OUTPUT_ALERT, NULL, and SetOutputList(). Referenced by SnortMain().

static int ProcessLogCommandLine (   )  [static]

Definition at line 2306 of file snort.c. References ActivateOutputPlugin(), _progvars::binLogFile, FatalError(), LOG_ASCII, _progvars::log_cmd_override, _progvars::log_mode, LOG_NONE, LOG_PCAP, NoLog(), NT_OUTPUT_LOG, NULL, and SetOutputList(). Referenced by SnortMain().

void ProcessPacket (  char *  user, struct pcap_pkthdr *  pkthdr, u_char *  pkt, void *  ft )

Definition at line 779 of file snort.c. References CallLogPlugins(), ClearDumpBuf(), DEBUG_DECODE, DEBUG_WRAP, g_drop_pkt, _progvars::min_ttl, MODE_IDS, MODE_PACKET_LOG, NULL, _Packet::packet_flags, PKT_IGNORE_PORT, PKT_REBUILT_FRAG, Preprocess(), PrintArpHeader(), PrintEapolPkt(), PrintIPPkt(), PrintWifiPkt(), runMode, _progvars::showwifimgmt_flag, and _progvars::verbose_flag. Referenced by Frag3Rebuild(), PcapProcessPacket(), and RebuildFrag().

static void Restart (   )  [static]

Definition at line 2544 of file snort.c. References _PluginSignalFuncNode::arg, DropStats(), errno, fpShowEventStats(), _PluginSignalFuncNode::func, InlineMode(), LogMessage(), _PluginSignalFuncNode::next, NULL, pcap_close(), _progvars::pid_filename, progargs, progname, SIGHUP, and _progvars::test_mode_flag. Referenced by SigHupHandler().

int SetPktProcessor (   )

Definition at line 1703 of file snort.c. References CleanExit(), datalink, DecodeChdlcPkt(), DecodeEncPkt(), DecodeEthPkt(), DecodeFDDIPkt(), DecodeI4LCiscoIPPkt(), DecodeI4LRawIPPkt(), DecodeIEEE80211Pkt(), DecodeLinuxSLLPkt(), DecodeNullPkt(), DecodeOldPflog(), DecodePflog(), DecodePppPkt(), DecodePppSerialPkt(), DecodeRawPkt(), DecodeSlipPkt(), DecodeTRPkt(), DLT_CHDLC, DLT_EN10MB, DLT_ENC, DLT_FDDI, DLT_IEEE802, DLT_IEEE802_11, DLT_LINUX_SLL, DLT_LOOP, DLT_NULL, DLT_OLDPFLOG, DLT_PFLOG, DLT_PPP, DLT_PPP_SERIAL, DLT_RAW, DLT_SLIP, ErrorMessage(), grinder, InlineMode(), _progvars::interface, LogMessage(), PRINT_INTERFACE, progname, _progvars::quiet_flag, _progvars::readmode_flag, and _progvars::show2hdr_flag. Referenced by SnortMain().

int ShowUsage (  char *  progname  )

Definition at line 855 of file snort.c. References FPUTS_BOTH, FPUTS_UNIX, FPUTS_WIN32, and SNAPLEN. Referenced by ParseCmdLine(), and SnortMain().

void SigCantHupHandler (  int  signal  )

dummy signal handler for nonroot users or chroot. Parameters: signal  signal to exec Definition at line 2397 of file snort.c. References LogMessage(). Referenced by SetChroot(), and SnortMain().

static void SigHupHandler (  int  signal  )  [static]

Definition at line 2356 of file snort.c. References Restart(). Referenced by SnortMain().

static void SigIntHandler (  int  signal  )  [static]

Definition at line 2346 of file snort.c. References CleanExit(). Referenced by SnortMain().

static void SigQuitHandler (  int  signal  )  [static]

Definition at line 2351 of file snort.c. References CleanExit(). Referenced by SnortMain().

static void SigTermHandler (  int  signal  )  [static]

Definition at line 2341 of file snort.c. References CleanExit(). Referenced by SnortMain().

static void SigUsrHandler (  int  signal  )  [static]

Definition at line 2361 of file snort.c. References DropStats(), NULL, _progvars::quiet_flag, _progvars::rotate_perf_file, SIG_SETMASK, SIGNAL_SNORT_ROTATE_STATS, and SIGUSR1. Referenced by SnortMain().

int SnortMain (  int  argc, char *  argv[] )

Definition at line 236 of file snort.c. References _progvars::alert_cmd_override, _progvars::alert_filename, ALERT_FULL, _progvars::alert_mode, _progvars::alert_plugin_active, AlertPreludeSetupAfterSetuid(), asn1_init_mem(), _progvars::assurance_mode, ASSURE_ALL, CheckLogDir(), _progvars::checksums_mode, _progvars::chroot_dir, CleanExit(), _progvars::config_dir, _progvars::config_file, ConfigFileSearch(), CreateDefaultRules(), CreatePidFile(), _progvars::daemon_flag, DEBUG_INIT, DEBUG_WRAP, DEFAULT_LOG_DIR, DisplayBanner(), DO_ICMP_CHECKSUMS, DO_IP_CHECKSUMS, DO_TCP_CHECKSUMS, DO_UDP_CHECKSUMS, DumpOutputPlugins(), DumpPlugIns(), DumpPreprocessors(), errno, _progvars::event_log_id, FatalError(), FlowBitsVerify(), fpCreateFastPacketDetection(), fpInitDetectionEngine(), gmt2local(), GoDaemon(), init_winsock(), InitDecoderFlags(), InitNetmasks(), InitOutputPlugins(), InitPlugIns(), InitPreprocessors(), InitProtoNames(), InitTag(), InlineMode(), _progvars::interface, InterfaceThread(), _progvars::log_cmd_override, LOG_CONS, LOG_DAEMON, _progvars::log_dir, _progvars::log_mode, LOG_PCAP, LOG_PID, _progvars::log_plugin_active, LogMessage(), memset, MODE_IDS, MODE_PACKET_DUMP, MODE_PACKET_LOG, mpsePrintSummary(), NULL, openlog(), OpenPcap(), OrderRuleLists(), OtnXMatchDataInitialize(), ParseCmdLine(), ParseRulesFile(), _progvars::pidfile_suffix, _progvars::pkt_cnt, PRINT_INTERFACE, print_thresholding(), PrintError(), printRuleOrder(), ProcessAlertCommandLine(), ProcessLogCommandLine(), progargs, progname, _progvars::quiet_flag, _progvars::readfile, _progvars::readmode_flag, _progvars::rotate_perf_file, _progvars::rules_order_flag, runMode, SetChroot(), SetPktProcessor(), SetUidGid(), ShowUsage(), SIG_SETMASK, SIGALRM, SigCantHupHandler(), SIGHUP, SigHupHandler(), SigIntHandler(), SIGNAL_SNORT_ROTATE_STATS, SIGQUIT, SigQuitHandler(), SigTermHandler(), SIGUSR1, SigUsrHandler(), SnortEventqInit(), _progvars::test_mode_flag, thiszone, _progvars::use_utc, userid, and _progvars::verbose_flag. Referenced by main().

---

Variable Documentation

char _PATH_VARRUN[STD_BUF]

Definition at line 167 of file snort.c. Referenced by CreatePidFile().

FILE* alert

Definition at line 146 of file snort.c.

OutputFuncNode* AlertList

Definition at line 587 of file plugbase.c.

FILE* binlog_ptr

Definition at line 147 of file snort.c.

int datalink

Definition at line 130 of file snort.c. Referenced by DropStats(), OpenPcap(), Print2ndHeader(), SetPktProcessor(), and UnifiedInitLogFile().

struct timeval endtime [static]

Definition at line 2005 of file snort.c. Referenced by CleanExit().

int errno

Referenced by __pyx_f_4dnet___oserror(), _intf_get_aliases(), AddOptFuncToList(), addr_bcast(), addr_btom(), addr_btos(), addr_ntop(), addr_ntos(), addr_pton(), addr_ston(), AddRspFuncToList(), arg_to_fr(), arp_add(), arp_delete(), arp_get(), arp_loop(), arp_msg(), arp_open(), ByteTestParse(), copy_argv(), err(), eth_get(), eth_open(), eth_send(), eth_set(), fw_add(), fw_delete(), fw_loop(), fw_open(), intf_get_dst(), intf_get_src(), intf_open(), intf_set(), ip_add_option(), ip_open(), ip_send(), LoadStateTable(), OldUnifiedLogPacketAlert(), OpenAlertFile(), OpenAlertSock(), OpenLogFile(), OpenSessionFile(), OpenStatsFile(), ParseActivatedBy(), ParseRuleOptions(), ParseRulesFile(), PayloadSearchDepth(), PayloadSearchDistance(), PayloadSearchOffset(), PayloadSearchWithin(), read_infile(), RealUnifiedLogAlert(), RealUnifiedLogPacketAlert(), RealUnifiedLogStreamAlert(), Restart(), route_add(), route_delete(), route_get(), route_loop(), route_msg(), route_open(), SetChroot(), sfRotatePerformanceStatisticsFile(), SnortMain(), Stream4Init(), TcpdumpInitLogFile(), tun_fileno(), tun_name(), tun_open(), tun_recv(), tun_send(), UnifiedInitAlertFile(), UnifiedInitFile(), UnifiedInitLogFile(), UnifiedLogData(), vsyslog(), warn(), and xatou().

int flow

Definition at line 148 of file snort.c. Referenced by ps_filter_ignore(), ps_tracker_update_ip(), ps_tracker_update_tcp(), and ps_tracker_update_udp().

u_long g_caplen

Definition at line 154 of file snort.c.

int g_drop_pkt

Definition at line 143 of file snort.c. Referenced by ProcessPacket().

u_char* g_pkt

Definition at line 153 of file snort.c.

struct pcap_pkthdr* g_pkthdr

Definition at line 152 of file snort.c.

struct group* gr

Definition at line 138 of file snort.c. Referenced by ParseCmdLine(), and ParseConfig().

grinder_t grinder

Definition at line 159 of file snort.c. Referenced by SetPktProcessor().

unsigned long groupid = 0

Definition at line 136 of file snort.c. Referenced by ParseCmdLine(), ParseConfig(), and SetUidGid().

char* groupname

Definition at line 134 of file snort.c. Referenced by ParseCmdLine(), ParseConfig(), and SetUidGid().

OutputFuncNode* LogList

Definition at line 588 of file plugbase.c.

u_long netmasks[33]

Definition at line 151 of file snort.c. Referenced by GenHomenet(), GenObfuscationMask(), InitNetmasks(), and ParseIP().

char* optarg

Definition at line 27 of file getopt.c. Referenced by getopt(), and ParseCmdLine().

int opterr

Definition at line 30 of file getopt.c. Referenced by getopt().

int optind

Definition at line 28 of file getopt.c. Referenced by getopt(), and ParseCmdLine().

int optopt

Definition at line 32 of file getopt.c. Referenced by getopt(), and ParseCmdLine().

PacketCount pc

Definition at line 150 of file snort.c. Referenced by BuildPacket(), CallAlertFuncs(), CallAlertPlugins(), CallLogFuncs(), CallLogPlugins(), CreateNewSession(), DecodeARP(), DecodeChdlcPkt(), DecodeEAP(), DecodeEapol(), DecodeEapolKey(), DecodeEthLoopback(), DecodeEthPkt(), DecodeFDDIPkt(), DecodeI4LCiscoIPPkt(), DecodeI4LRawIPPkt(), DecodeICMP(), DecodeIEEE80211Pkt(), DecodeIP(), DecodeIPV6(), DecodeIPX(), DecodeOldPflog(), DecodePflog(), DecodeTCP(), DecodeTRPkt(), DecodeUDP(), DecodeVlan(), DirectLogTcpdump(), DropStats(), Frag2Alloc(), Frag2SelfPreserve(), Frag3NewTracker(), Frag3Rebuild(), GetEventsPerSecond(), LoadStateTable(), NewFragTracker(), PassAction(), PruneFragCache(), ReassembleStream4(), RebuildFrag(), RebuildTraverse(), SafeAlloc(), SpoLogTcpdumpCleanExitFunc(), SpoLogTcpdumpRestartFunc(), and TraverseFunc().

char* pcap_cmd

Definition at line 139 of file snort.c.

pcap_t* pd

Definition at line 141 of file snort.c. Referenced by DropStats(), GetPktDropStats(), ParseConfig(), and TcpdumpInitLogFile().

char* pktidx

Definition at line 140 of file snort.c.

PluginSignalFuncNode* PluginCleanExitList

Definition at line 135 of file plugbase.c.

PluginSignalFuncNode* PluginRestartList

Definition at line 136 of file plugbase.c.

PluginSignalFuncNode* PluginShutdownList

Definition at line 134 of file plugbase.c.

char** progargs

Definition at line 132 of file snort.c. Referenced by Restart(), and SnortMain().

char* progname

Definition at line 131 of file snort.c. Referenced by ParseCmdLine(), Restart(), SetPktProcessor(), and SnortMain().

char* protocol_names[256]

Definition at line 155 of file snort.c. Referenced by AlertFast(), AlertSyslog(), CleanupProtoNames(), InitProtoNames(), OpenLogFile(), and PrintIPHeader().

PV pv

Definition at line 129 of file snort.c.

struct passwd* pw

Definition at line 137 of file snort.c. Referenced by ParseCmdLine(), and ParseConfig().

u_int8_t runMode = 0

Definition at line 128 of file snort.c. Referenced by DecodeARP(), DecodeEAP(), DecodeEapol(), DecodeEapolKey(), DecodeICMP(), DecodeIEEE80211Pkt(), DecodeIP(), DecodeIPOptions(), DecodePPPoEPkt(), DecodeTCP(), DecodeTCPOptions(), DecodeTRPkt(), DecodeUDP(), DecodeVlan(), IPHdrTests(), ProcessPacket(), and SnortMain().

SFPERF sfPerf

Definition at line 170 of file snort.c.

u_int snaplen

Definition at line 156 of file snort.c.

runtime_config snort_runtime

Definition at line 160 of file snort.c. Referenced by fpEvalOTN(), PreprocRpcDecode(), and Stream4Init().

struct timeval starttime [static]

Definition at line 2004 of file snort.c. Referenced by CleanExit(), and InterfaceThread().

int thiszone

Definition at line 149 of file snort.c.

unsigned long userid = 0

Definition at line 135 of file snort.c. Referenced by ParseCmdLine(), ParseConfig(), SetUidGid(), and SnortMain().

char* username

Definition at line 133 of file snort.c. Referenced by ParseCmdLine(), ParseConfig(), and SetUidGid().

---