Suricata之源代码(三)

布满荆棘的人生 2022-08-21 00:25 243阅读 0赞

# Yaml文件的构造 #

在准备说下面代码所干的事情之前，我准备介绍一下suricata.yaml文件。介绍引用自[百度百科Yaml][Yaml]

## 概念 ##

YAML（IPA: /ˈjæməl/，尾音类似camel骆驼）是一个可读性高，用来表达资料序列的编程语言，  
    YAML是一种很简单的类似于XML的[数据描述语言][Link 1]，语法比XML简单很多。

## 诞生 ##

YAML参考了其他多种语言，包括：[XML][]、[C语言][C]、[Python][]、[Perl][]以及电子邮件格式RFC2822。

Clark Evans在2001年5月在首次发表了这种语言\[2\]，另外Ingy döt Net与Oren Ben-Kiki也是这语言的共同设计者。

## 命名 ##

YAML是"YAML Ain't a Markup Language"（YAML不是一种置标语言）的递归缩写。

在开发的这种语言时，YAML 的意思其实是："Yet Another Markup Language"（仍是一种置标语言），但为了强调这种语言以数据做为中心，而不是以置标语言为重点，而用返璞词重新命名。

## 功能 ##

YAML的语法和其他高阶语言类似，并且可以简单表达清单、散列表，标量等资料形态、。

它使用空白符号缩排和大量依赖外观的特色，特别适合用来表达或编辑数据结构、各种设定档、倾印除错内容、文件大纲（例如：许多电子邮件标题格式和YAML非常接近）。

尽管它比较适合用来表达阶层式（hierarchical model）的数据结构，不过也有精致的语法可以表示关联性（relational model）的资料。

由于YAML使用空白字符和分行来分隔资料，使的他特别适合用grep、Python、Perl、Ruby操作。

其让人最容易上手的特色是巧妙避开各种封闭符号，如：引号、各种括号等，这些符号在巢状结构时会变得复杂而难以辨认。

# Suricata.yaml #

suricata的整个配置都是通过Yaml来配置的，在我认为它也就是一种key-value的形式。通过不同的缩进来区分孩子。

**\[plain\]** [ view plain][view plain] [ copy][view plain]

[print][view plain] [?][view plain] [![在CODE上查看代码片][CODE]][CODE_CODE] [![派生到我的代码片][ico_fork.svg]][ico_fork.svg 1]

1. <span style="font-family:SimHei;font-size:14px;">classification-file: /etc/suricata/classfication.config  //这是对classification.config的配置路径  
2. reference-config-file: /etc/suricata/reference.config    //这是对reference.config的配置路径  
3. magic-file: /usr/share/file/magic                       //这是对magic文件的配置路径

classification-file: /etc/suricata/classfication.config //这是对classification.config的配置路径
 reference-config-file: /etc/suricata/reference.config //这是对reference.config的配置路径
 magic-file: /usr/share/file/magic  //这是对magic文件的配置路径

## Max-pending-packets(最大包处理数)    ##

用max-pending-packets来设置允许suricata所能同时处理的数据包的个数。这个设置的范围是在一个数据包到上千个数据包之间的数字。

max-pending-packets: 1024

## Runmodes(运行模式)    ##

对于rumodes的设置是根据你自己的喜好，你喜欢什么样的模式就在这里设置你所喜欢的模式。在安装了Suricata之后你可以在命令行输入suricata  --list-runmodes来查看Suricata支持的所有运行模式。

runmode: autofp

## Default-packet-size(默认包的大小) ##

对于default-packet-size这个选项，主要是设置你网络中的数据包的大小。

default-packet-size: 1514

## Action-order ##

1)pass：Suricata允许数据包通过网络，接下来Suricata就不会对它再进行检测。

2)drop：这个功能只会存在IPS/inline模式，如果有特征匹配到了，并且这个特征的动作是drop那么这个数据包也不会进行下面的检测，而是丢弃数据包。

3)reject:：对错误的ICMP包和TCP的有些错误包产生reject，在IPS模式下reject和drop的含义一样。

4)alert：这种数据包被看作是没有攻击的，这种可以让系统管理员注意到。在Inline/IPS模式中，这种被对待成drop或者是reject。

action-order: 
     - pass
     - drop
     - reject
     - alert

## Outputs ##

这个模块主要是针对Suricata的输出日志进行配置，可以配置你所感兴趣的日志。

-fast:                    #The log-name.
       enabled:yes            #This log is enabled. Set to 'no' to disable.//是否要开启这个日志文件
       filename: fast.log     #The name of the file in the default logging directory.//日志文件的名称
       append: yes/no         #If this option is set to yes, the last filled fast.log-file will not be
                              #overwritten while restarting Suricata.

-Unified-log:                     #The log-name.
       enabled: no                    #This log is not enabled. Set 'yes' to enable.
       filename: unified.log          #The name of the file in the default logging directory.
       limit: 32                      #The file size limit in megabytes.//如果日志大小超过就会重新创建下一个日志文件

- http-log:                     #The log-name.
        enabled: yes                #This log is enabled. Set 'no' to disable.
        filename: http.log          #The name of the file in the default logging directory.    
        append: yes/no              #If this option is set to yes, the last filled fast.log-file will not be
                                    # overwritten while restarting Suricata.

###  ###

##  ##

## detection-engine grouping tree ##

###  ###

src             Stands for source IP-address.
    dst             Stands for destination IP-address.
    sp              Stands for source port.
    dp              Stands for destination port.

![20140413221035203][]

##  ##

## Multi-pattern-matcher(多模匹配) ##

![20140413221231828][]

mpm-algo: b2gc  //选择的多模匹配算法

pattern-matcher: 
      - b2gc:
          search_algo: B2gSearchBNDMq 
          hash_size: low                    #Determines the size of the hash-table.
          bf_size: medium                   #Determines the size of the bloom- filter.
      - b3g: 
          search_algo: B3gSearchBNDMq 
          hash_size: low                    #See hash-size -b2gc.
          bf_size: medium                   #See bf-size -b2gc.
      - wumanber: 
          hash_size: low                    #See hash-size -b2gc.
          bf_size: medium                   #See bf-size -b2gc.

详细的[suricata.yaml][]

# Yaml文件的加载 #

**\[cpp\]** [ view plain][view plain] [ copy][view plain]

[print][view plain] [?][view plain] [![在CODE上查看代码片][CODE]][CODE_CODE] [![派生到我的代码片][ico_fork.svg]][ico_fork.svg 1]

1.  <span style="font-size:12px;">/\*\* \\todo we need an api for these \*/  
2.     /\* Load yaml configuration file if provided. \*/  
3.     if (conf\_filename != NULL) \{  
4. \#ifdef UNITTESTS  
5.         if (run\_mode == RUNMODE\_UNITTEST) \{  
6.             SCLogError(SC\_ERR\_CMD\_LINE, "should not use a configuration file with unittests");  
7.             exit(EXIT\_FAILURE);  
8.         \}  
9. \#endif  
10.         if (ConfYamlLoadFile(conf\_filename) != 0) \{  
11.             /\* Error already displayed. \*/  
12.             exit(EXIT\_FAILURE);  
13.         \}

/** \todo we need an api for these */
 /* Load yaml configuration file if provided. */
 if (conf_filename != NULL) {
 #ifdef UNITTESTS
 if (run_mode == RUNMODE_UNITTEST) {
 SCLogError(SC_ERR_CMD_LINE, "should not use a configuration file with unittests");
 exit(EXIT_FAILURE);
 }
 #endif
 if (ConfYamlLoadFile(conf_filename) != 0) {
 /* Error already displayed. */
 exit(EXIT_FAILURE);
 }

这里主要函数是ConfYamlLoadFile(conf\_filename)，该函数是将变量conf\_filename加载到内存中。

**\[cpp\]** [ view plain][view plain] [ copy][view plain]

[print][view plain] [?][view plain] [![在CODE上查看代码片][CODE]][CODE_CODE] [![派生到我的代码片][ico_fork.svg]][ico_fork.svg 1]

1. <span style="font-size:12px;">/\*\* 
2.  \* \\brief Load configuration from a YAML file. 
3.  \* 
4.  \* This function will load a configuration file.  On failure -1 will 
5.  \* be returned and it is suggested that the program then exit.  Any 
6.  \* errors while loading the configuration file will have already been 
7.  \* logged. 
8.  \* 
9.  \* \\param filename Filename of configuration file to load. 
10.  \* 
11.  \* \\retval 0 on success, -1 on failure. 
12.  \*/  
13. int  
14. ConfYamlLoadFile(const char \*filename)  
15. \{  
16.     FILE \*infile;  
17.     yaml\_parser\_t parser;  
18.     int ret;  
19.     ConfNode \*root = ConfGetRootNode();  
20.   
21.     if (yaml\_parser\_initialize(&parser) != 1) \{  
22.         fprintf(stderr, "Failed to initialize yaml parser.\\n");  
23.         return -1;  
24.     \}  
25.   
26.     infile = fopen(filename, "r");  
27.     if (infile == NULL) \{  
28.         fprintf(stderr, "Failed to open file: %s: %s\\n", filename,  
29.             strerror(errno));  
30.         yaml\_parser\_delete(&parser);  
31.         return -1;  
32.     \}  
33.     yaml\_parser\_set\_input\_file(&parser, infile);  
34.     ret = ConfYamlParse(&parser, root, 0);  
35.     yaml\_parser\_delete(&parser);  
36.     fclose(infile);  
37.   
38.     return ret;  
39. \}

/**
 * \brief Load configuration from a YAML file.
 *
 * This function will load a configuration file. On failure -1 will
 * be returned and it is suggested that the program then exit. Any
 * errors while loading the configuration file will have already been
 * logged.
 *
 * \param filename Filename of configuration file to load.
 *
 * \retval 0 on success, -1 on failure.
 */
 int
 ConfYamlLoadFile(const char *filename)
 {
 FILE *infile;
 yaml_parser_t parser;
 int ret;
 ConfNode *root = ConfGetRootNode();
 
 if (yaml_parser_initialize(&parser) != 1) {
 fprintf(stderr, "Failed to initialize yaml parser.\n");
 return -1;
 }
 
 infile = fopen(filename, "r");
 if (infile == NULL) {
 fprintf(stderr, "Failed to open file: %s: %s\n", filename,
 strerror(errno));
 yaml_parser_delete(&parser);
 return -1;
 }
 yaml_parser_set_input_file(&parser, infile);
 ret = ConfYamlParse(&parser, root, 0);
 yaml_parser_delete(&parser);
 fclose(infile);
 
 return ret;
 }

函数ConfYamlLoadFile使用yaml库中的方法进行解析，主要的函数是ConfYamlParse。通过该函数对suricata.yaml全部的选项进行解析。

**\[cpp\]** [ view plain][view plain] [ copy][view plain]

[print][view plain] [?][view plain] [![在CODE上查看代码片][CODE]][CODE_CODE] [![派生到我的代码片][ico_fork.svg]][ico_fork.svg 1]

1. <span style="font-size:12px;">/\*\* 
2.  \* \\brief Parse a YAML layer. 
3.  \* 
4.  \* \\param parser A pointer to an active yaml\_parser\_t. 
5.  \* \\param parent The parent configuration node. 
6.  \* 
7.  \* \\retval 0 on success, -1 on failure. 
8.  \*/  
9. static int  
10. ConfYamlParse(yaml\_parser\_t \*parser, ConfNode \*parent, int inseq)  
11. \{  
12.     ConfNode \*node = parent;  
13.     yaml\_event\_t event;  
14.     int done = 0;  
15.     int state = 0;  
16.     int seq\_idx = 0;  
17.   
18.     while (!done) \{  
19.         if (!yaml\_parser\_parse(parser, &event)) \{  
20.             fprintf(stderr,  
21.                 "Failed to parse configuration file at line %" PRIuMAX ": %s\\n",  
22.                 (uintmax\_t)parser->problem\_mark.line, parser->problem);  
23.             return -1;  
24.         \}  
25.   
26.         if (event.type == YAML\_DOCUMENT\_START\_EVENT) \{  
27.             /\* Verify YAML version - its more likely to be a valid 
28.              \* Suricata configuration file if the version is 
29.              \* correct. \*/  
30.             yaml\_version\_directive\_t \*ver =  
31.                 event.data.document\_start.version\_directive;  
32.             if (ver == NULL) \{  
33.                 fprintf(stderr, "ERROR: Invalid configuration file.\\n\\n");  
34.                 fprintf(stderr, "The configuration file must begin with the following two lines:\\n\\n");  
35.                 fprintf(stderr, "%%YAML 1.1\\n---\\n\\n");  
36.                 goto fail;  
37.             \}  
38.             int major = event.data.document\_start.version\_directive->major;  
39.             int minor = event.data.document\_start.version\_directive->minor;  
40.             if (!(major == YAML\_VERSION\_MAJOR && minor == YAML\_VERSION\_MINOR)) \{  
41.                 fprintf(stderr, "ERROR: Invalid YAML version.  Must be 1.1\\n");  
42.                 goto fail;  
43.             \}  
44.         \}  
45.         else if (event.type == YAML\_SCALAR\_EVENT) \{  
46.             char \*value = (char \*)event.data.scalar.value;  
47.             SCLogDebug("event.type = YAML\_SCALAR\_EVENT (%s) inseq=%d",  
48.                 value, inseq);  
49.             if (inseq) \{  
50.                 ConfNode \*seq\_node = ConfNodeNew();  
51.                 seq\_node->name = SCCalloc(1, DEFAULT\_NAME\_LEN);  
52.                 if (seq\_node->name == NULL)  
53.                     return -1;  
54.                 snprintf(seq\_node->name, DEFAULT\_NAME\_LEN, "%d", seq\_idx++);  
55.                 seq\_node->val = SCStrdup(value);  
56.                 TAILQ\_INSERT\_TAIL(&parent->head, seq\_node, next);  
57.             \}  
58.             else \{  
59.                 if (state == CONF\_KEY) \{  
60.                     if (parent->is\_seq) \{  
61.                         if (parent->val == NULL) \{  
62.                             parent->val = SCStrdup(value);  
63.                             if (parent->val && strchr(parent->val, '\_'))  
64.                                 Mangle(parent->val);  
65.                         \}  
66.                     \}  
67.                     ConfNode \*n0 = ConfNodeLookupChild(parent, value);  
68.                     if (n0 != NULL) \{  
69.                         node = n0;  
70.                     \}  
71.                     else \{  
72.                         node = ConfNodeNew();  
73.                         node->name = SCStrdup(value);  
74.                         if (node->name && strchr(node->name, '\_')) \{  
75.                             if (!(parent->name &&  
76.                                    ((strcmp(parent->name, "address-groups") == 0) ||  
77.                                     (strcmp(parent->name, "port-groups") == 0)))) \{  
78.                                 Mangle(node->name);  
79.                                 if (mangle\_errors < MANGLE\_ERRORS\_MAX) \{  
80.                                     SCLogWarning(SC\_WARN\_DEPRECATED,  
81.                                             "%s is deprecated. Please use %s on line %"PRIuMAX".",  
82.                                             value, node->name, (uintmax\_t)parser->mark.line+1);  
83.                                     mangle\_errors++;  
84.                                     if (mangle\_errors >= MANGLE\_ERRORS\_MAX)  
85.                                         SCLogWarning(SC\_WARN\_DEPRECATED, "not showing more "  
86.                                                 "parameter name warnings.");  
87.                                 \}  
88.                             \}  
89.                         \}  
90.                         TAILQ\_INSERT\_TAIL(&parent->head, node, next);  
91.                     \}  
92.                     state = CONF\_VAL;  
93.                 \}  
94.                 else \{  
95.                     if (node->allow\_override) \{  
96.                         if (node->val != NULL)  
97.                             SCFree(node->val);  
98.                         node->val = SCStrdup(value);  
99.                     \}  
100.                     state = CONF\_KEY;  
101.                 \}  
102.             \}  
103.         \}  
104.         else if (event.type == YAML\_SEQUENCE\_START\_EVENT) \{  
105.             SCLogDebug("event.type = YAML\_SEQUENCE\_START\_EVENT");  
106.             if (ConfYamlParse(parser, node, 1) != 0)  
107.                 goto fail;  
108.             state = CONF\_KEY;  
109.         \}  
110.         else if (event.type == YAML\_SEQUENCE\_END\_EVENT) \{  
111.             SCLogDebug("event.type = YAML\_SEQUENCE\_END\_EVENT");  
112.             return 0;  
113.         \}  
114.         else if (event.type == YAML\_MAPPING\_START\_EVENT) \{  
115.             SCLogDebug("event.type = YAML\_MAPPING\_START\_EVENT");  
116.             if (inseq) \{  
117.                 ConfNode \*seq\_node = ConfNodeNew();  
118.                 seq\_node->is\_seq = 1;  
119.                 seq\_node->name = SCCalloc(1, DEFAULT\_NAME\_LEN);  
120.                 if (seq\_node->name == NULL)  
121.                     return -1;  
122.                 snprintf(seq\_node->name, DEFAULT\_NAME\_LEN, "%d", seq\_idx++);  
123.                 TAILQ\_INSERT\_TAIL(&node->head, seq\_node, next);  
124.                 if (ConfYamlParse(parser, seq\_node, 0) != 0)  
125.                     goto fail;  
126.             \}  
127.             else \{  
128.                 if (ConfYamlParse(parser, node, inseq) != 0)  
129.                     goto fail;  
130.             \}  
131.             state = CONF\_KEY;  
132.         \}  
133.         else if (event.type == YAML\_MAPPING\_END\_EVENT) \{  
134.             SCLogDebug("event.type = YAML\_MAPPING\_END\_EVENT");  
135.             done = 1;  
136.         \}  
137.         else if (event.type == YAML\_STREAM\_END\_EVENT) \{  
138.             done = 1;  
139.         \}  
140.   
141.         yaml\_event\_delete(&event);  
142.         continue;  
143.   
144.     fail:  
145.         yaml\_event\_delete(&event);  
146.         return -1;  
147.     \}  
148.   
149.     return 0;  
150. \}

/**
 * \brief Parse a YAML layer.
 *
 * \param parser A pointer to an active yaml_parser_t.
 * \param parent The parent configuration node.
 *
 * \retval 0 on success, -1 on failure.
 */
 static int
 ConfYamlParse(yaml_parser_t *parser, ConfNode *parent, int inseq)
 {
 ConfNode *node = parent;
 yaml_event_t event;
 int done = 0;
 int state = 0;
 int seq_idx = 0;
 
 while (!done) {
 if (!yaml_parser_parse(parser, &event)) {
 fprintf(stderr,
 "Failed to parse configuration file at line %" PRIuMAX ": %s\n",
 (uintmax_t)parser->problem_mark.line, parser->problem);
 return -1;
 }
 
 if (event.type == YAML_DOCUMENT_START_EVENT) {
 /* Verify YAML version - its more likely to be a valid
 * Suricata configuration file if the version is
 * correct. */
 yaml_version_directive_t *ver =
 event.data.document_start.version_directive;
 if (ver == NULL) {
 fprintf(stderr, "ERROR: Invalid configuration file.\n\n");
 fprintf(stderr, "The configuration file must begin with the following two lines:\n\n");
 fprintf(stderr, "%%YAML 1.1\n---\n\n");
 goto fail;
 }
 int major = event.data.document_start.version_directive->major;
 int minor = event.data.document_start.version_directive->minor;
 if (!(major == YAML_VERSION_MAJOR && minor == YAML_VERSION_MINOR)) {
 fprintf(stderr, "ERROR: Invalid YAML version. Must be 1.1\n");
 goto fail;
 }
 }
 else if (event.type == YAML_SCALAR_EVENT) {
 char *value = (char *)event.data.scalar.value;
 SCLogDebug("event.type = YAML_SCALAR_EVENT (%s) inseq=%d",
 value, inseq);
 if (inseq) {
 ConfNode *seq_node = ConfNodeNew();
 seq_node->name = SCCalloc(1, DEFAULT_NAME_LEN);
 if (seq_node->name == NULL)
 return -1;
 snprintf(seq_node->name, DEFAULT_NAME_LEN, "%d", seq_idx++);
 seq_node->val = SCStrdup(value);
 TAILQ_INSERT_TAIL(&parent->head, seq_node, next);
 }
 else {
 if (state == CONF_KEY) {
 if (parent->is_seq) {
 if (parent->val == NULL) {
 parent->val = SCStrdup(value);
 if (parent->val && strchr(parent->val, '_'))
 Mangle(parent->val);
 }
 }
 ConfNode *n0 = ConfNodeLookupChild(parent, value);
 if (n0 != NULL) {
 node = n0;
 }
 else {
 node = ConfNodeNew();
 node->name = SCStrdup(value);
 if (node->name && strchr(node->name, '_')) {
 if (!(parent->name &&
 ((strcmp(parent->name, "address-groups") == 0) ||
 (strcmp(parent->name, "port-groups") == 0)))) {
 Mangle(node->name);
 if (mangle_errors < MANGLE_ERRORS_MAX) {
 SCLogWarning(SC_WARN_DEPRECATED,
 "%s is deprecated. Please use %s on line %"PRIuMAX".",
 value, node->name, (uintmax_t)parser->mark.line+1);
 mangle_errors++;
 if (mangle_errors >= MANGLE_ERRORS_MAX)
 SCLogWarning(SC_WARN_DEPRECATED, "not showing more "
 "parameter name warnings.");
 }
 }
 }
 TAILQ_INSERT_TAIL(&parent->head, node, next);
 }
 state = CONF_VAL;
 }
 else {
 if (node->allow_override) {
 if (node->val != NULL)
 SCFree(node->val);
 node->val = SCStrdup(value);
 }
 state = CONF_KEY;
 }
 }
 }
 else if (event.type == YAML_SEQUENCE_START_EVENT) {
 SCLogDebug("event.type = YAML_SEQUENCE_START_EVENT");
 if (ConfYamlParse(parser, node, 1) != 0)
 goto fail;
 state = CONF_KEY;
 }
 else if (event.type == YAML_SEQUENCE_END_EVENT) {
 SCLogDebug("event.type = YAML_SEQUENCE_END_EVENT");
 return 0;
 }
 else if (event.type == YAML_MAPPING_START_EVENT) {
 SCLogDebug("event.type = YAML_MAPPING_START_EVENT");
 if (inseq) {
 ConfNode *seq_node = ConfNodeNew();
 seq_node->is_seq = 1;
 seq_node->name = SCCalloc(1, DEFAULT_NAME_LEN);
 if (seq_node->name == NULL)
 return -1;
 snprintf(seq_node->name, DEFAULT_NAME_LEN, "%d", seq_idx++);
 TAILQ_INSERT_TAIL(&node->head, seq_node, next);
 if (ConfYamlParse(parser, seq_node, 0) != 0)
 goto fail;
 }
 else {
 if (ConfYamlParse(parser, node, inseq) != 0)
 goto fail;
 }
 state = CONF_KEY;
 }
 else if (event.type == YAML_MAPPING_END_EVENT) {
 SCLogDebug("event.type = YAML_MAPPING_END_EVENT");
 done = 1;
 }
 else if (event.type == YAML_STREAM_END_EVENT) {
 done = 1;
 }
 
 yaml_event_delete(&event);
 continue;
 
 fail:
 yaml_event_delete(&event);
 return -1;
 }
 
 return 0;
 }

该函数会通过yaml\_parser\_parse(parser, &event)得到event变量。再次通过event.type的类型，将所有的配置都存入ConfNode的变量中，然后suricata通过key的值搜索value的值，从而得到配置文件中的值。

ConfNode结构是这样的：

**\[cpp\]** [ view plain][view plain] [ copy][view plain]

[print][view plain] [?][view plain] [![在CODE上查看代码片][CODE]][CODE_CODE] [![派生到我的代码片][ico_fork.svg]][ico_fork.svg 1]

1. <span style="font-size:12px;">/\*\* 
2.  \* Structure of a configuration parameter. 
3.  \*/  
4. typedef struct ConfNode\_ \{  
5.     char \*name;//key  
6.     char \*val;//value  
7.   
8.     int is\_seq;  
9.     int allow\_override;  
10.   
11.     struct ConfNode\_ \*parent;  
12.     TAILQ\_HEAD(, ConfNode\_) head;  
13.     TAILQ\_ENTRY(ConfNode\_) next;  
14. \} ConfNode;

/**
 * Structure of a configuration parameter.
 */
 typedef struct ConfNode_ {
 char *name;//key
 char *val;//value
 
 int is_seq;
 int allow_override;
 
 struct ConfNode_ *parent;
 TAILQ_HEAD(, ConfNode_) head;
 TAILQ_ENTRY(ConfNode_) next;
 } ConfNode;

[Yaml]: http://baike.baidu.com/link?url=VdhgG-tVHaCvNSKdBtxrNXPJrFZe8wFfraXxZFRsb1HH7JhmZ8sqlY3RH_cxt4YM4L_3JoNgJDZd5PtxjURJ3K
[Link 1]: http://baike.baidu.com/view/1106703.htm
[XML]: http://baike.baidu.com/view/63.htm
[C]: http://baike.baidu.com/view/1219.htm
[Python]: http://lib.csdn.net/base/11
[Perl]: http://baike.baidu.com/view/46614.htm
[view plain]: http://blog.csdn.net/qianligaoshan/article/details/23618673#
[CODE]: https://code.csdn.net/assets/CODE_ico.png
[CODE_CODE]: https://code.csdn.net/snippets/290561
[ico_fork.svg]: https://code.csdn.net/assets/ico_fork.svg
[ico_fork.svg 1]: https://code.csdn.net/snippets/290561/fork
[20140413221035203]: /images/20220731/70c5c0836267420d904a777e89328656.png
[20140413221231828]: /images/20220731/6233e0c7017b4382b5bf7222f7e70f34.png
[suricata.yaml]: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#Action-order