Programmatically send packets to Suricata in C

Developers
1

How would one go about sending packets to Suricata 7 via C code? I’ve looked around in the source code for a while. I’ve gotten a bit confused with how a packet is initially received, sent to the engine and then classified as triggering a rule or not. Also, Suricata would be run in process. It would not be a separate service or a process.

An example of what the C method might look like would be:

int process_packet(void* data, int data_len, int tenant, struct suricata_rules* rules);

The definition of “struct suricata_rules” is TBD. At a minimum it would have information regarding what rules were triggered.

The goal is to create a C library that could be used by

  1. a cli tool too process packets from something like a pcap file
  2. a specialized service on a router running OpenWrt
  3. a DPDK plugin.

I know that Suricata can do all of these natively, but due to specific requirements of this project a reusable C method/library would be most efficient for us.

I know we would need to write code. This isn’t an issue. I’m just trying to figure out where to start.

Any and all suggestions appreciated!

~Chelsea

2

Take a look at 27. Suricata Developer Guide — Suricata 7.0.3-dev documentation
and in particular to 27.3. Extending Suricata — Suricata 7.0.3-dev documentation to get a general idea.

3

This is a major goal of 8.0, but given we just released 7.0 months ago its a ways off.

You can see some preliminary work here: libsuricata: threads, sources - v6 by jasonish · Pull Request #9428 · OISF/suricata · GitHub

But nothing is stable yet in this area in terms of API.

The tracking ticket for this is Task #2693: tracking: libsuricata - Suricata - Open Information Security Foundation.