Task #2693
opentracking: libsuricata
Description
This request came up at Suricon2018, but has come up before. The idea is to turn much of Suricata into a library that can be reused in other tools.
The first step would be to define some of the use cases we'd like to initially support so that an API could be designed for that.
Goals for 8.0:
- Allow a library user to replicate the Suricata application by exposing all functions needed by the current SuricataMain, or refactoring to allow this.
- Given replication of Suricata, allow the library user to register custom capture modes and output callbacks
- Allow the user to bring their own threads
General library challenges given we've been an application for so long:
- Command line parsing should be opt-in
- Loading the configuration file should be opt-in
- Registering signal handlers should be opt-in, but the functionality they provide should be exposed to the library user can easily call them
- A library should never fatal exit outside of extreme conditions, instead error codes must be ripple back to where the library user can decide what to do
- Global state should be non-existent. One could imagine where a user might want to have a "handle" on multiple discrete Suricata instances.
Future goals:
- Remove global state
- Improve developer experience. I imagine an interface where you bootstrap a Suricata "engine" and feed your own packets into
- Refactor modules to make them more usable outside the scope of Suricata? What modules would make sense here? Capture methods, just to get packets. Flow, to defrag, or TCP re-assembly if you already have your own packets.
Scope:
- Initially, the should be limited to code that Suricata uses itself. That is, Suricata the application is a user of the library. If Suricata the application does not use a module, it should be looked at closely if it belongs in the library, mainly for scope, QA, and support reasons.
Updated by Victor Julien almost 6 years ago
- Related to Task #2685: SuriCon 2018 brainstorm added
Updated by Victor Julien over 4 years ago
- Assignee changed from Community Ticket to OISF Dev
Updated by Victor Julien over 4 years ago
One of the use cases that has been brought forward is to be able to integrate the Suricata detection and logging into OVS.
Updated by Victor Julien almost 4 years ago
- Related to Task #4097: Suricon 2020 brainstorm added
Updated by Victor Julien almost 4 years ago
- Tracker changed from Feature to Task
- Subject changed from libsuricata to tracking: libsuricata
- Status changed from New to Assigned
- Assignee changed from OISF Dev to Jason Ish
- Target version changed from TBD to 7.0.0-beta1
Updated by Jason Ish almost 4 years ago
- Related to Task #4221: Build Suricata into a static and shared library added
Updated by Jason Ish over 3 years ago
- Related to Task #4429: libsuricata: Use cases with examples added
Updated by Jason Ish about 3 years ago
- Related to Task #4101: tracking: plugins added
Updated by Jason Ish about 3 years ago
- Related to Task #4704: unix-socket: separate functionality from the unix socket interface added
Updated by Jason Ish about 3 years ago
- Related to Task #4742: Make the auto-generated config.h not conflict with other config.h. added
Updated by Jason Ish almost 3 years ago
- Status changed from Assigned to In Progress
Updated by Victor Julien over 2 years ago
- Related to Task #5433: tracking: reduce number of public data structures added
Updated by Victor Julien almost 2 years ago
- Target version changed from 7.0.0-beta1 to 8.0.0-beta1
Updated by Philippe Antoine almost 2 years ago
Use cases :
- Have packets from some other source
- Have some already reassembled stream (SSL proxy)
- Have a very dynamic way to tell which packet which should be handled by this config/ruleset (complexity from global variables), have some way for tenants to remove certain categories, or have a finite set of precompiled rulesets and have a plugin be able to tell which ruleset should be used for each packet
- Have packet returned with metadata like the alerts it has
Idea to persist precompiled ruleset
Updated by Philippe Antoine almost 2 years ago
- Related to Task #5488: Suricon 2022 brainstorm added
Updated by Philippe Antoine almost 2 years ago
- Related to Task #2313: tracking: save & restore state when suricata restarts added
Updated by Jason Ish 8 months ago
- Related to Task #6752: libsuricata: don't include autoconf.h from other includes added
Updated by Jason Ish about 1 month ago
- Related to Feature #7240: libsuricata: use provided threads and packets added