#include "decode.h"
#include "util-time.h"
#include "util-exception-policy.h"
#include "util-exception-policy-types.h"
#include "util-var.h"
#include "util-optimize.h"
#include "app-layer-protos.h"
#include "util-storage.h"
#include "flow-queue.h"

Include dependency graph for flow.h:

Data Structures
struct	FlowCnf_

struct	FlowKey_

struct	FlowAddress_

struct	Flow_
	Flow data structure. More...

struct	FlowProtoTimeout_

struct	FlowProtoFreeFunc_

struct	FlowBypassInfo_

struct	FlowLookupStruct_

Macros
#define	FLOW_QUIET true

#define	TOSERVER 0

#define	TOCLIENT 1

#define	FLOW_TO_SRC_SEEN BIT_U32(0)

#define	FLOW_TO_DST_SEEN BIT_U32(1)

#define	FLOW_TOSERVER_IPONLY_SET BIT_U32(3)

#define	FLOW_TOCLIENT_IPONLY_SET BIT_U32(4)

#define	FLOW_NOPACKET_INSPECTION BIT_U32(5)

#define	FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)

#define	FLOW_ACTION_DROP BIT_U32(7)

#define	FLOW_SGH_TOSERVER BIT_U32(8)

#define	FLOW_SGH_TOCLIENT BIT_U32(9)

#define	FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)

#define	FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)

#define	FLOW_HAS_ALERTS BIT_U32(12)

#define	FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)

#define	FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)

#define	FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)

#define	FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)

#define	FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)

#define	FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)

#define	FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)

#define	FLOW_IPV4 BIT_U32(20)

#define	FLOW_IPV6 BIT_U32(21)

#define	FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)

#define	FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)

#define	FLOW_CHANGE_PROTO BIT_U32(24)

#define	FLOW_WRONG_THREAD BIT_U32(25)

#define	FLOW_DIR_REVERSED BIT_U32(26)

#define	FLOW_HAS_EXPECTATION BIT_U32(27)

#define	FLOW_ACTION_PASS BIT_U32(28)

#define	FLOW_TS_APP_UPDATED BIT_U32(29)

#define	FLOW_TC_APP_UPDATED BIT_U32(30)

#define	FLOWFILE_INIT 0

#define	FLOWFILE_NO_MAGIC_TS BIT_U16(0)

#define	FLOWFILE_NO_MAGIC_TC BIT_U16(1)

#define	FLOWFILE_NO_STORE_TS BIT_U16(2)

#define	FLOWFILE_NO_STORE_TC BIT_U16(3)

#define	FLOWFILE_NO_MD5_TS BIT_U16(4)

#define	FLOWFILE_NO_MD5_TC BIT_U16(5)

#define	FLOWFILE_NO_SHA1_TS BIT_U16(6)

#define	FLOWFILE_NO_SHA1_TC BIT_U16(7)

#define	FLOWFILE_NO_SHA256_TS BIT_U16(8)

#define	FLOWFILE_NO_SHA256_TC BIT_U16(9)

#define	FLOWFILE_NO_SIZE_TS BIT_U16(10)

#define	FLOWFILE_NO_SIZE_TC BIT_U16(11)

#define	FLOWFILE_STORE_TS BIT_U16(12)

#define	FLOWFILE_STORE_TC BIT_U16(13)

#define	FLOWFILE_NONE_TS

#define	FLOWFILE_NONE_TC

#define	FLOWFILE_NONE (FLOWFILE_NONE_TS\|FLOWFILE_NONE_TC)

#define	FLOW_IS_IPV4(f) (((f)->flags & FLOW_IPV4) == FLOW_IPV4)

#define	FLOW_IS_IPV6(f) (((f)->flags & FLOW_IPV6) == FLOW_IPV6)

#define	FLOW_GET_SP(f) ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;

#define	FLOW_GET_DP(f) ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;

#define	FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa)

#define	FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa)

#define	FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(ip4h, a)

#define	FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(ip4h, a)

#define	FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(ip6h, a)

#define	FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(ip6h, a)

#define	FLOW_PKT_TOSERVER 0x01

#define	FLOW_PKT_TOCLIENT 0x02

#define	FLOW_PKT_ESTABLISHED 0x04

#define	FLOW_PKT_TOSERVER_IPONLY_SET 0x08

#define	FLOW_PKT_TOCLIENT_IPONLY_SET 0x10

#define	FLOW_PKT_TOSERVER_FIRST 0x20

#define	FLOW_PKT_TOCLIENT_FIRST 0x40

#define	FLOW_PKT_LAST_PSEUDO 0x80

#define	FLOW_END_FLAG_STATE_NEW 0x01

#define	FLOW_END_FLAG_STATE_ESTABLISHED 0x02

#define	FLOW_END_FLAG_STATE_CLOSED 0x04

#define	FLOW_END_FLAG_EMERGENCY 0x08

#define	FLOW_END_FLAG_TIMEOUT 0x10

#define	FLOW_END_FLAG_FORCED 0x20

#define	FLOW_END_FLAG_SHUTDOWN 0x40

#define	FLOW_END_FLAG_STATE_BYPASSED 0x80

#define	FLOWLOCK_MUTEX

#define	FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)

#define	FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)

#define	FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m)

#define	FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m)

#define	FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m)

#define	FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m)

#define	FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)

#define	FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))

#define	FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))

#define	FLOW_IS_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))

#define	FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PM_ALPROTO_DETECT_DONE))

#define	FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PP_ALPROTO_DETECT_DONE))

#define	FLOW_SET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PE_ALPROTO_DETECT_DONE))

#define	FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))

#define	FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))

#define	FLOW_RESET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))

#define	addr_data32 address.address_un_data32

#define	addr_data16 address.address_un_data16

#define	addr_data8 address.address_un_data8

#define	FLOW_STATE_SIZE 4

Typedefs
typedef struct FlowStorageId	FlowStorageId

typedef struct AppLayerParserState_	AppLayerParserState

typedef struct FlowCnf_	FlowConfig

typedef struct FlowKey_	FlowKey

typedef struct FlowAddress_	FlowAddress

typedef unsigned short	FlowStateType

typedef uint16_t	FlowThreadId

typedef struct Flow_	Flow
	Flow data structure. More...

typedef struct FlowProtoTimeout_	FlowProtoTimeout

typedef struct FlowProtoFreeFunc_	FlowProtoFreeFunc

typedef struct FlowBypassInfo_	FlowBypassInfo

typedef struct FlowLookupStruct_	FlowLookupStruct

Enumerations
enum	FlowState { FLOW_STATE_NEW = 0, FLOW_STATE_ESTABLISHED, FLOW_STATE_CLOSED, FLOW_STATE_LOCAL_BYPASSED }

Functions
void	FlowSetupPacket (Packet *p)
	prepare packet for a life with flow Set PKT_WANTS_FLOW flag to indicate workers should do a flow lookup and calc the hash value to be used in the lookup and autofp flow balancing. More...

void	FlowHandlePacket (ThreadVars , FlowLookupStruct , Packet *)
	Entry point for packet flow handling. More...

void	FlowInitConfig (bool)
	initialize the configuration More...

void	FlowReset (void)

void	FlowShutdown (void)
	shutdown the flow engine More...

void	FlowSetIPOnlyFlag (Flow *, int)
	Set the IPOnly scanned flag for 'direction'. More...

void	FlowSetHasAlertsFlag (Flow *)
	Set flag to indicate that flow has alerts. More...

int	FlowHasAlerts (const Flow *)
	Check if flow has alerts. More...

void	FlowSetChangeProtoFlag (Flow *)
	Set flag to indicate to change proto for the flow. More...

void	FlowUnsetChangeProtoFlag (Flow *)
	Unset flag to indicate to change proto for the flow. More...

int	FlowChangeProto (Flow *)
	Check if change proto flag is set for flow. More...

void	FlowSwap (Flow *)
	swap the flow's direction More...

void	FlowRegisterTests (void)
	Function to register the Flow Unitests. More...

int	FlowSetProtoFreeFunc (uint8_t, void(Free)(void ))
	Function to set the function to get protocol specific flow state. More...

int	FlowGetPacketDirection (const Flow , const Packet )
	determine the direction of the packet compared to the flow More...

void	FlowCleanupAppLayer (Flow *)

void	FlowUpdateState (Flow *f, enum FlowState s)

int	FlowSetMemcap (uint64_t size)
	Update memcap value. More...

uint64_t	FlowGetMemcap (void)
	Return memcap value. More...

uint64_t	FlowGetMemuse (void)

enum ExceptionPolicy	FlowGetMemcapExceptionPolicy (void)

FlowStorageId	GetFlowBypassInfoID (void)

void	RegisterFlowBypassInfo (void)

void	FlowGetLastTimeAsParts (Flow flow, uint64_t secs, uint64_t *usecs)
	Get flow last time as individual values. More...

uint32_t	FlowGetFlags (Flow *flow)
	Get flow flags. More...

uint16_t	FlowGetSourcePort (Flow *flow)
	Get flow source port. More...

uint16_t	FlowGetDestinationPort (Flow *flow)
	Get flow destination port. More...

int	FlowClearMemory (Flow *, uint8_t)
	Function clear the flow memory before queueing it to spare flow queue. More...

uint8_t	FlowGetDisruptionFlags (const Flow *f, uint8_t flags)
	get 'disruption' flags: GAP/DEPTH/PASS More...

void	FlowHandlePacketUpdate (Flow f, Packet p, ThreadVars tv, DecodeThreadVars dtv)
	Update Packet and Flow. More...

Detailed Description

Author: Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file flow.h.

Macro Definition Documentation

◆ addr_data16

#define addr_data16 address.address_un_data16

Definition at line 327 of file flow.h.

◆ addr_data32

#define addr_data32 address.address_un_data32

Definition at line 326 of file flow.h.

◆ addr_data8

#define addr_data8 address.address_un_data8

Definition at line 328 of file flow.h.

◆ FLOW_ACTION_DROP

#define FLOW_ACTION_DROP BIT_U32(7)

All packets in this flow should be dropped

Definition at line 68 of file flow.h.

◆ FLOW_ACTION_PASS

#define FLOW_ACTION_PASS BIT_U32(28)

All packets in this flow should be passed

Definition at line 115 of file flow.h.

◆ FLOW_CHANGE_PROTO

#define FLOW_CHANGE_PROTO BIT_U32(24)

Indicate that alproto detection for flow should be done again

Definition at line 106 of file flow.h.

◆ FLOW_COPY_IPV4_ADDR_TO_PACKET

#define FLOW_COPY_IPV4_ADDR_TO_PACKET	(	fa,
		pa
	)

Value:

        do {      \
        (pa)->family = AF_INET;                         \
        (pa)->addr_data32[0] = (fa)->addr_data32[0];    \
    } while (0)

Definition at line 175 of file flow.h.

◆ FLOW_COPY_IPV6_ADDR_TO_PACKET

#define FLOW_COPY_IPV6_ADDR_TO_PACKET	(	fa,
		pa
	)

Value:

        do {      \
        (pa)->family = AF_INET6;                        \
        (pa)->addr_data32[0] = (fa)->addr_data32[0];    \
        (pa)->addr_data32[1] = (fa)->addr_data32[1];    \
        (pa)->addr_data32[2] = (fa)->addr_data32[2];    \
        (pa)->addr_data32[3] = (fa)->addr_data32[3];    \
    } while (0)

Definition at line 180 of file flow.h.

◆ FLOW_DIR_REVERSED

#define FLOW_DIR_REVERSED BIT_U32(26)

Protocol detection told us flow is picked up in wrong direction (midstream)

Definition at line 110 of file flow.h.

◆ FLOW_END_FLAG_EMERGENCY

#define FLOW_END_FLAG_EMERGENCY 0x08

Definition at line 242 of file flow.h.

◆ FLOW_END_FLAG_FORCED

#define FLOW_END_FLAG_FORCED 0x20

Definition at line 244 of file flow.h.

◆ FLOW_END_FLAG_SHUTDOWN

#define FLOW_END_FLAG_SHUTDOWN 0x40

Definition at line 245 of file flow.h.

◆ FLOW_END_FLAG_STATE_BYPASSED

#define FLOW_END_FLAG_STATE_BYPASSED 0x80

Definition at line 246 of file flow.h.

◆ FLOW_END_FLAG_STATE_CLOSED

#define FLOW_END_FLAG_STATE_CLOSED 0x04

Definition at line 241 of file flow.h.

◆ FLOW_END_FLAG_STATE_ESTABLISHED

#define FLOW_END_FLAG_STATE_ESTABLISHED 0x02

Definition at line 240 of file flow.h.

◆ FLOW_END_FLAG_STATE_NEW

#define FLOW_END_FLAG_STATE_NEW 0x01

Definition at line 239 of file flow.h.

◆ FLOW_END_FLAG_TIMEOUT

#define FLOW_END_FLAG_TIMEOUT 0x10

Definition at line 243 of file flow.h.

◆ FLOW_GET_DP

#define FLOW_GET_DP ( f ) ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;

Definition at line 172 of file flow.h.

◆ FLOW_GET_SP

#define FLOW_GET_SP ( f ) ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;

Definition at line 170 of file flow.h.

◆ FLOW_HAS_ALERTS

#define FLOW_HAS_ALERTS BIT_U32(12)

flow has alerts

Definition at line 81 of file flow.h.

◆ FLOW_HAS_EXPECTATION

#define FLOW_HAS_EXPECTATION BIT_U32(27)

Indicate that the flow did trigger an expectation creation

Definition at line 112 of file flow.h.

◆ FLOW_IPV4

#define FLOW_IPV4 BIT_U32(20)

flow is ipv4

Definition at line 98 of file flow.h.

◆ FLOW_IPV6

#define FLOW_IPV6 BIT_U32(21)

flow is ipv6

Definition at line 100 of file flow.h.

◆ FLOW_IS_IPV4

#define FLOW_IS_IPV4 ( f ) (((f)->flags & FLOW_IPV4) == FLOW_IPV4)

Definition at line 165 of file flow.h.

◆ FLOW_IS_IPV6

#define FLOW_IS_IPV6 ( f ) (((f)->flags & FLOW_IPV6) == FLOW_IPV6)

Definition at line 167 of file flow.h.

◆ FLOW_IS_PE_DONE

#define FLOW_IS_PE_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))

Definition at line 280 of file flow.h.

◆ FLOW_IS_PM_DONE

#define FLOW_IS_PM_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))

Definition at line 278 of file flow.h.

◆ FLOW_IS_PP_DONE

#define FLOW_IS_PP_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))

Definition at line 279 of file flow.h.

◆ FLOW_NOPACKET_INSPECTION

#define FLOW_NOPACKET_INSPECTION BIT_U32(5)

Packet belonging to this flow should not be inspected at all

Definition at line 63 of file flow.h.

◆ FLOW_NOPAYLOAD_INSPECTION

#define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)

Packet payloads belonging to this flow should not be inspected

Definition at line 65 of file flow.h.

◆ FLOW_PKT_ESTABLISHED

#define FLOW_PKT_ESTABLISHED 0x04

Definition at line 230 of file flow.h.

◆ FLOW_PKT_LAST_PSEUDO

#define FLOW_PKT_LAST_PSEUDO 0x80

last pseudo packet in the flow. Can be used to trigger final clean, logging, etc.

Definition at line 237 of file flow.h.

◆ FLOW_PKT_TOCLIENT

#define FLOW_PKT_TOCLIENT 0x02

Definition at line 229 of file flow.h.

◆ FLOW_PKT_TOCLIENT_FIRST

#define FLOW_PKT_TOCLIENT_FIRST 0x40

Definition at line 234 of file flow.h.

◆ FLOW_PKT_TOCLIENT_IPONLY_SET

#define FLOW_PKT_TOCLIENT_IPONLY_SET 0x10

Definition at line 232 of file flow.h.

◆ FLOW_PKT_TOSERVER

#define FLOW_PKT_TOSERVER 0x01

Definition at line 228 of file flow.h.

◆ FLOW_PKT_TOSERVER_FIRST

#define FLOW_PKT_TOSERVER_FIRST 0x20

Definition at line 233 of file flow.h.

◆ FLOW_PKT_TOSERVER_IPONLY_SET

#define FLOW_PKT_TOSERVER_IPONLY_SET 0x08

Definition at line 231 of file flow.h.

◆ FLOW_PROTO_DETECT_TC_DONE

#define FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)

Definition at line 103 of file flow.h.

◆ FLOW_PROTO_DETECT_TS_DONE

#define FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)

Definition at line 102 of file flow.h.

◆ FLOW_QUIET

#define FLOW_QUIET true

Definition at line 43 of file flow.h.

◆ FLOW_RESET_PE_DONE

#define FLOW_RESET_PE_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))

Definition at line 288 of file flow.h.

◆ FLOW_RESET_PM_DONE

#define FLOW_RESET_PM_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))

Definition at line 286 of file flow.h.

◆ FLOW_RESET_PP_DONE

#define FLOW_RESET_PP_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))

Definition at line 287 of file flow.h.

◆ FLOW_SET_IPV4_DST_ADDR_FROM_PACKET

#define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET	(	ip4h,
		a
	)

Value:

    do {                                                                                           \
        (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_dst.s_addr;                                   \
        (a)->addr_data32[1] = 0;                                                                   \
        (a)->addr_data32[2] = 0;                                                                   \
        (a)->addr_data32[3] = 0;                                                                   \
    } while (0)

Definition at line 201 of file flow.h.

◆ FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET

#define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET	(	ip4h,
		a
	)

Value:

    do {                                                                                           \
        (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_src.s_addr;                                   \
        (a)->addr_data32[1] = 0;                                                                   \
        (a)->addr_data32[2] = 0;                                                                   \
        (a)->addr_data32[3] = 0;                                                                   \
    } while (0)

Definition at line 193 of file flow.h.

◆ FLOW_SET_IPV6_DST_ADDR_FROM_PACKET

#define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET	(	ip6h,
		a
	)

Value:

    do {                                                                                           \
        (a)->addr_data32[0] = (ip6h)->s_ip6_dst[0];                                                \
        (a)->addr_data32[1] = (ip6h)->s_ip6_dst[1];                                                \
        (a)->addr_data32[2] = (ip6h)->s_ip6_dst[2];                                                \
        (a)->addr_data32[3] = (ip6h)->s_ip6_dst[3];                                                \
    } while (0)

Definition at line 219 of file flow.h.

◆ FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET

#define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET	(	ip6h,
		a
	)

Value:

    do {                                                                                           \
        (a)->addr_data32[0] = (ip6h)->s_ip6_src[0];                                                \
        (a)->addr_data32[1] = (ip6h)->s_ip6_src[1];                                                \
        (a)->addr_data32[2] = (ip6h)->s_ip6_src[2];                                                \
        (a)->addr_data32[3] = (ip6h)->s_ip6_src[3];                                                \
    } while (0)

Definition at line 211 of file flow.h.

◆ FLOW_SET_PE_DONE

#define FLOW_SET_PE_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PE_ALPROTO_DETECT_DONE))

Definition at line 284 of file flow.h.

◆ FLOW_SET_PM_DONE

#define FLOW_SET_PM_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PM_ALPROTO_DETECT_DONE))

Definition at line 282 of file flow.h.

◆ FLOW_SET_PP_DONE

#define FLOW_SET_PP_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PP_ALPROTO_DETECT_DONE))

Definition at line 283 of file flow.h.

◆ FLOW_SGH_TOCLIENT

#define FLOW_SGH_TOCLIENT BIT_U32(9)

Sgh for toclient direction set (even if it's NULL)

Definition at line 73 of file flow.h.

◆ FLOW_SGH_TOSERVER

#define FLOW_SGH_TOSERVER BIT_U32(8)

Sgh for toserver direction set (even if it's NULL)

Definition at line 71 of file flow.h.

◆ FLOW_STATE_SIZE

#define FLOW_STATE_SIZE 4

Definition at line 517 of file flow.h.

◆ FLOW_TC_APP_UPDATED

#define FLOW_TC_APP_UPDATED BIT_U32(30)

Definition at line 118 of file flow.h.

◆ FLOW_TC_PE_ALPROTO_DETECT_DONE

#define FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)

Expectation alproto detection done

Definition at line 94 of file flow.h.

◆ FLOW_TC_PM_ALPROTO_DETECT_DONE

#define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)

Pattern matcher alproto detection done

Definition at line 90 of file flow.h.

◆ FLOW_TC_PP_ALPROTO_DETECT_DONE

#define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)

Probing parser alproto detection done

Definition at line 92 of file flow.h.

◆ FLOW_TIMEOUT_REASSEMBLY_DONE

#define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)

Definition at line 95 of file flow.h.

◆ FLOW_TO_DST_SEEN

#define FLOW_TO_DST_SEEN BIT_U32(1)

At least one packet from the destination address was seen

Definition at line 53 of file flow.h.

◆ FLOW_TO_SRC_SEEN

#define FLOW_TO_SRC_SEEN BIT_U32(0)

At least one packet from the source address was seen

Definition at line 51 of file flow.h.

◆ FLOW_TOCLIENT_DROP_LOGGED

#define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)

packet to client direction has been logged in drop file (only in IPS mode)

Definition at line 78 of file flow.h.

◆ FLOW_TOCLIENT_IPONLY_SET

#define FLOW_TOCLIENT_IPONLY_SET BIT_U32(4)

Flow was inspected against IP-Only sigs in the toclient direction

Definition at line 60 of file flow.h.

◆ FLOW_TOSERVER_DROP_LOGGED

#define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)

packet to server direction has been logged in drop file (only in IPS mode)

Definition at line 76 of file flow.h.

◆ FLOW_TOSERVER_IPONLY_SET

#define FLOW_TOSERVER_IPONLY_SET BIT_U32(3)

Flow was inspected against IP-Only sigs in the toserver direction

Definition at line 58 of file flow.h.

◆ FLOW_TS_APP_UPDATED

#define FLOW_TS_APP_UPDATED BIT_U32(29)

Definition at line 117 of file flow.h.

◆ FLOW_TS_PE_ALPROTO_DETECT_DONE

#define FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)

Expectation alproto detection done

Definition at line 88 of file flow.h.

◆ FLOW_TS_PM_ALPROTO_DETECT_DONE

#define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)

Pattern matcher alproto detection done

Definition at line 84 of file flow.h.

◆ FLOW_TS_PP_ALPROTO_DETECT_DONE

#define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)

Probing parser alproto detection done

Definition at line 86 of file flow.h.

◆ FLOW_WRONG_THREAD

#define FLOW_WRONG_THREAD BIT_U32(25)

Definition at line 108 of file flow.h.

◆ FLOWFILE_INIT

#define FLOWFILE_INIT 0

Definition at line 122 of file flow.h.

◆ FLOWFILE_NO_MAGIC_TC

#define FLOWFILE_NO_MAGIC_TC BIT_U16(1)

Definition at line 126 of file flow.h.

◆ FLOWFILE_NO_MAGIC_TS

#define FLOWFILE_NO_MAGIC_TS BIT_U16(0)

no magic on files in this flow

Definition at line 125 of file flow.h.

◆ FLOWFILE_NO_MD5_TC

#define FLOWFILE_NO_MD5_TC BIT_U16(5)

Definition at line 133 of file flow.h.

◆ FLOWFILE_NO_MD5_TS

#define FLOWFILE_NO_MD5_TS BIT_U16(4)

no md5 on files in this flow

Definition at line 132 of file flow.h.

◆ FLOWFILE_NO_SHA1_TC

#define FLOWFILE_NO_SHA1_TC BIT_U16(7)

Definition at line 137 of file flow.h.

◆ FLOWFILE_NO_SHA1_TS

#define FLOWFILE_NO_SHA1_TS BIT_U16(6)

no sha1 on files in this flow

Definition at line 136 of file flow.h.

◆ FLOWFILE_NO_SHA256_TC

#define FLOWFILE_NO_SHA256_TC BIT_U16(9)

Definition at line 141 of file flow.h.

◆ FLOWFILE_NO_SHA256_TS

#define FLOWFILE_NO_SHA256_TS BIT_U16(8)

no sha256 on files in this flow

Definition at line 140 of file flow.h.

◆ FLOWFILE_NO_SIZE_TC

#define FLOWFILE_NO_SIZE_TC BIT_U16(11)

Definition at line 145 of file flow.h.

◆ FLOWFILE_NO_SIZE_TS

#define FLOWFILE_NO_SIZE_TS BIT_U16(10)

no size tracking of files in this flow

Definition at line 144 of file flow.h.

◆ FLOWFILE_NO_STORE_TC

#define FLOWFILE_NO_STORE_TC BIT_U16(3)

Definition at line 130 of file flow.h.

◆ FLOWFILE_NO_STORE_TS

#define FLOWFILE_NO_STORE_TS BIT_U16(2)

even if the flow has files, don't store 'm

Definition at line 129 of file flow.h.

◆ FLOWFILE_NONE

#define FLOWFILE_NONE (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC)

Definition at line 163 of file flow.h.

◆ FLOWFILE_NONE_TC

#define FLOWFILE_NONE_TC

Value:

                          (FLOWFILE_NO_MAGIC_TC | \
                          FLOWFILE_NO_STORE_TC | \
                          FLOWFILE_NO_MD5_TC   | \
                          FLOWFILE_NO_SHA1_TC  | \
                          FLOWFILE_NO_SHA256_TC| \
                          FLOWFILE_NO_SIZE_TC)

Definition at line 157 of file flow.h.

◆ FLOWFILE_NONE_TS

#define FLOWFILE_NONE_TS

Value:

                          (FLOWFILE_NO_MAGIC_TS | \
                          FLOWFILE_NO_STORE_TS | \
                          FLOWFILE_NO_MD5_TS   | \
                          FLOWFILE_NO_SHA1_TS  | \
                          FLOWFILE_NO_SHA256_TS| \
                          FLOWFILE_NO_SIZE_TS)

Definition at line 151 of file flow.h.

◆ FLOWFILE_STORE_TC

#define FLOWFILE_STORE_TC BIT_U16(13)

Definition at line 149 of file flow.h.

◆ FLOWFILE_STORE_TS

#define FLOWFILE_STORE_TS BIT_U16(12)

store files in the flow

Definition at line 148 of file flow.h.

◆ FLOWLOCK_DESTROY

#define FLOWLOCK_DESTROY ( fb ) SCMutexDestroy(&(fb)->m)

Definition at line 268 of file flow.h.

◆ FLOWLOCK_INIT

#define FLOWLOCK_INIT ( fb ) SCMutexInit(&(fb)->m, NULL)

Definition at line 267 of file flow.h.

◆ FLOWLOCK_MUTEX

#define FLOWLOCK_MUTEX

Mutex or RWLocks for the flow.

Definition at line 250 of file flow.h.

◆ FLOWLOCK_RDLOCK

#define FLOWLOCK_RDLOCK ( fb ) SCMutexLock(&(fb)->m)

Definition at line 269 of file flow.h.

◆ FLOWLOCK_TRYRDLOCK

#define FLOWLOCK_TRYRDLOCK ( fb ) SCMutexTrylock(&(fb)->m)

Definition at line 271 of file flow.h.

◆ FLOWLOCK_TRYWRLOCK

#define FLOWLOCK_TRYWRLOCK ( fb ) SCMutexTrylock(&(fb)->m)

Definition at line 272 of file flow.h.

◆ FLOWLOCK_UNLOCK

#define FLOWLOCK_UNLOCK ( fb ) SCMutexUnlock(&(fb)->m)

Definition at line 273 of file flow.h.

◆ FLOWLOCK_WRLOCK

#define FLOWLOCK_WRLOCK ( fb ) SCMutexLock(&(fb)->m)

Definition at line 270 of file flow.h.

◆ TOCLIENT

#define TOCLIENT 1

Definition at line 46 of file flow.h.

◆ TOSERVER

#define TOSERVER 0

Definition at line 45 of file flow.h.

Typedef Documentation

◆ AppLayerParserState

typedef struct AppLayerParserState_ AppLayerParserState

Definition at line 1 of file flow.h.

◆ Flow

typedef struct Flow_ Flow

Flow data structure.

The flow is a global data structure that is created for new packets of a flow and then looked up for the following packets of a flow.

Locking

The flow is updated/used by multiple packets at the same time. This is why there is a flow-mutex. It's a mutex and not a spinlock because some operations on the flow can be quite expensive, thus spinning would be too expensive.

The flow "header" (addresses, ports, proto, recursion level) are static after the initialization and remain read-only throughout the entire live of a flow. This is why we can access those without protection of the lock.

◆ FlowAddress

typedef struct FlowAddress_ FlowAddress

◆ FlowBypassInfo

typedef struct FlowBypassInfo_ FlowBypassInfo

◆ FlowConfig

typedef struct FlowCnf_ FlowConfig

◆ FlowKey

typedef struct FlowKey_ FlowKey

◆ FlowLookupStruct

typedef struct FlowLookupStruct_ FlowLookupStruct

◆ FlowProtoFreeFunc

typedef struct FlowProtoFreeFunc_ FlowProtoFreeFunc

◆ FlowProtoTimeout

typedef struct FlowProtoTimeout_ FlowProtoTimeout

◆ FlowStateType

typedef unsigned short FlowStateType

Definition at line 329 of file flow.h.

◆ FlowStorageId

typedef struct FlowStorageId FlowStorageId

Definition at line 1 of file flow.h.

◆ FlowThreadId

typedef uint16_t FlowThreadId

Local Thread ID

Definition at line 332 of file flow.h.

Enumeration Type Documentation

◆ FlowState

enum FlowState

Enumerator
FLOW_STATE_NEW
FLOW_STATE_ESTABLISHED
FLOW_STATE_CLOSED
FLOW_STATE_LOCAL_BYPASSED

Definition at line 504 of file flow.h.

Function Documentation

◆ FlowChangeProto()

int FlowChangeProto ( Flow * f )

Check if change proto flag is set for flow.

Parameters

f flow

Return values

1	change proto flag is set
0	change proto flag is not set

Definition at line 206 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

Referenced by AppLayerRequestProtocolChange(), and LLVMFuzzerTestOneInput().

Here is the caller graph for this function:

◆ FlowCleanupAppLayer()

void FlowCleanupAppLayer ( Flow * )

Definition at line 136 of file flow.c.

References Flow_::alparser, Flow_::alstate, AppLayerParserStateCleanup(), and Flow_::proto.

Here is the call graph for this function:

◆ FlowClearMemory()

int FlowClearMemory	(	Flow *	f,
		uint8_t	proto_map
	)

Function clear the flow memory before queueing it to spare flow queue.

Parameters

f	pointer to the flow needed to be cleared.
proto_map	mapped value of the protocol to FLOW_PROTO's.

Definition at line 1093 of file flow.c.

References AppLayerExpectationClean(), Flow_::flags, flow_freefuncs, FLOW_HAS_EXPECTATION, FLOW_RECYCLE, FlowFreeStorage(), FlowProtoFreeFunc_::Freefunc, Flow_::protoctx, SCEnter, SCReturnInt, and unlikely.

Referenced by FlowReset(), and FlowShutdown().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ FlowGetDestinationPort()

uint16_t FlowGetDestinationPort ( Flow * flow )

Get flow destination port.

A function to get the flow dport useful when the caller only has an opaque pointer to the flow structure.

Definition at line 1216 of file flow.c.

References Flow_::dp.

◆ FlowGetDisruptionFlags()

uint8_t FlowGetDisruptionFlags	(	const Flow *	f,
		uint8_t	flags
	)

get 'disruption' flags: GAP/DEPTH/PASS

Parameters

f	locked flow
flags	existing flags to be amended

Return values

flags original flags + disrupt flags (if any) \TODO handle UDP

Definition at line 1137 of file flow.c.

References TcpSession_::client, flags, TcpStream_::flags, Flow_::proto, Flow_::protoctx, TcpSession_::server, and STREAMTCP_STREAM_FLAG_DEPTH_REACHED.

◆ FlowGetFlags()

uint32_t FlowGetFlags ( Flow * flow )

Get flow flags.

A function to get the flow flags useful when the caller only has an opaque pointer to the flow structure.

Definition at line 1227 of file flow.c.

References Flow_::flags.

◆ FlowGetLastTimeAsParts()

void FlowGetLastTimeAsParts	(	Flow *	flow,
		uint64_t *	secs,
		uint64_t *	usecs
	)

Get flow last time as individual values.

Instead of returning a pointer to the timeval copy the timeval parts into output pointers to make it simpler to call from Rust over FFI using only basic data types.

Definition at line 1192 of file flow.c.

References Flow_::lastts, SCTIME_SECS, and SCTIME_USECS.

◆ FlowGetMemcap()

uint64_t FlowGetMemcap ( void )

Return memcap value.

Return values

memcap value

Definition at line 119 of file flow.c.

References flow_config, and SC_ATOMIC_GET.

◆ FlowGetMemcapExceptionPolicy()

enum ExceptionPolicy FlowGetMemcapExceptionPolicy ( void )

Definition at line 125 of file flow.c.

Referenced by DecodeRegisterPerfCounters().

Here is the caller graph for this function:

◆ FlowGetMemuse()

uint64_t FlowGetMemuse ( void )

Definition at line 125 of file flow.c.

References SC_ATOMIC_GET.

◆ FlowGetPacketDirection()

int FlowGetPacketDirection	(	const Flow *	f,
		const Packet *	p
	)

determine the direction of the packet compared to the flow

Return values

0	to_server
1	to_client

Definition at line 290 of file flow.c.

References CMP_ADDR, CMP_PORT, Packet_::dp, Flow_::flags, FLOW_DIR_REVERSED, IPPROTO_SCTP, Packet_::proto, Flow_::sp, Packet_::sp, Flow_::src, Packet_::src, TOCLIENT, and TOSERVER.

Referenced by FlowHandlePacketUpdate(), and StreamTcp().

Here is the caller graph for this function:

◆ FlowGetSourcePort()

uint16_t FlowGetSourcePort ( Flow * flow )

Get flow source port.

A function to get the flow sport useful when the caller only has an opaque pointer to the flow structure.

Definition at line 1204 of file flow.c.

References Flow_::sp.

◆ FlowHandlePacket()

void FlowHandlePacket	(	ThreadVars *	tv,
		FlowLookupStruct *	fls,
		Packet *	p
	)

Entry point for packet flow handling.

This is called for every packet.

Parameters

tv	threadvars
dtv	decode thread vars (for flow output api thread data)
p	packet to handle flow for

Definition at line 513 of file flow.c.

References Packet_::flags, Packet_::flow, FlowGetFlowFromHash(), PKT_HAS_FLOW, and tv.

Referenced by UTHBuildPacketOfFlows().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ FlowHandlePacketUpdate()

void FlowHandlePacketUpdate	(	Flow *	f,
		Packet *	p,
		ThreadVars *	tv,
		DecodeThreadVars *	dtv
	)

Update Packet and Flow.

Updates packet and flow based on the new packet.

Parameters

f	locked flow
p	packet

Note: overwrites p::flowflags

Definition at line 389 of file flow.c.

References BypassedFlowUpdate(), EngineModeIsIPS(), Flow_::flags, FLOW_BYPASSED_TIMEOUT, FLOW_PKT_TOSERVER, Flow_::flow_state, FLOW_STATE_LOCAL_BYPASSED, FLOW_TO_DST_SEEN, Packet_::flowflags, FlowGetPacketDirection(), FlowUpdateState(), GET_PKT_LEN, Flow_::lastts, Packet_::pcap_cnt, SCLogDebug, SCTIME_CMP_GT, SCTIME_SECS, Flow_::timeout_at, Flow_::timeout_policy, Flow_::todstbytecnt, Flow_::todstpktcnt, TOSERVER, and Packet_::ts.

Here is the call graph for this function:

◆ FlowHasAlerts()

int FlowHasAlerts ( const Flow * f )

Check if flow has alerts.

Parameters

f flow

Return values

1	has alerts
0	has not alerts

Definition at line 174 of file flow.c.

References Flow_::flags, and FLOW_HAS_ALERTS.

◆ FlowInitConfig()

void FlowInitConfig ( bool quiet )

initialize the configuration

Warning: Not thread safe

set config values for memcap, prealloc and hash_size

Definition at line 527 of file flow.c.

References CLS, ConfGet(), ConfGetInt(), FlowCnf_::emergency_recovery, ExceptionPolicyParse(), FatalError, FBLOCK_INIT, FLOW_CHECK_MEMCAP, flow_config, FLOW_DEFAULT_EMERGENCY_RECOVERY, FLOW_DEFAULT_HASHSIZE, FLOW_DEFAULT_MEMCAP, FLOW_DEFAULT_PREALLOC, flow_hash, flow_recycle_q, FlowInitFlowProto(), FlowQueueInit(), FlowSparePoolInit(), FlowStorageSize(), FlowCnf_::hash_rand, FlowCnf_::hash_size, FlowCnf_::memcap_policy, ParseSizeStringU64(), FlowCnf_::prealloc, RandomGet(), SC_ATOMIC_ADD, SC_ATOMIC_GET, SC_ATOMIC_INIT, SC_ATOMIC_SET, SCLogDebug, SCLogError, SCMallocAligned, StringParseUint32(), and unlikely.

Referenced by PreRunInit().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ FlowRegisterTests()

void FlowRegisterTests ( void )

Function to register the Flow Unitests.

Definition at line 1444 of file flow.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ FlowReset()

void FlowReset ( void )

Definition at line 657 of file flow.c.

References flow_config, flow_hash, FlowClearMemory(), FlowFree(), FlowGetProtoMapping(), FlowCnf_::hash_size, Flow_::next, and Flow_::proto.

Here is the call graph for this function:

◆ FlowSetChangeProtoFlag()

void FlowSetChangeProtoFlag ( Flow * f )

Set flag to indicate to change proto for the flow.

Parameters

f flow

Definition at line 187 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

Referenced by AppLayerRequestProtocolChange().

Here is the caller graph for this function:

◆ FlowSetHasAlertsFlag()

void FlowSetHasAlertsFlag ( Flow * f )

Set flag to indicate that flow has alerts.

Parameters

f flow

Definition at line 163 of file flow.c.

References Flow_::flags, and FLOW_HAS_ALERTS.

◆ FlowSetIPOnlyFlag()

void FlowSetIPOnlyFlag	(	Flow *	f,
		int	direction
	)

Set the IPOnly scanned flag for 'direction'.

Parameters

f	Flow to set the flag in
direction	direction to set the flag in

Definition at line 152 of file flow.c.

References Flow_::flags, FLOW_TOCLIENT_IPONLY_SET, and FLOW_TOSERVER_IPONLY_SET.

◆ FlowSetMemcap()

int FlowSetMemcap ( uint64_t size )

Update memcap value.

Parameters

size	new memcap value

Definition at line 104 of file flow.c.

References flow_config, SC_ATOMIC_GET, and SC_ATOMIC_SET.

◆ FlowSetProtoFreeFunc()

int FlowSetProtoFreeFunc	(	uint8_t	proto,
		void()(void )	Free
	)

Function to set the function to get protocol specific flow state.

Parameters

proto	protocol of which function is needed to be set.
Free	Function pointer which will be called to free the protocol specific memory.

Definition at line 1121 of file flow.c.

References flow_freefuncs, FlowGetProtoMapping(), FlowProtoFreeFunc_::Freefunc, and proto.

Here is the call graph for this function:

◆ FlowSetupPacket()

void FlowSetupPacket ( Packet * p )

prepare packet for a life with flow Set PKT_WANTS_FLOW flag to indicate workers should do a flow lookup and calc the hash value to be used in the lookup and autofp flow balancing.

Definition at line 521 of file flow-hash.c.

References Packet_::flags, Packet_::flow_hash, and PKT_WANTS_FLOW.

◆ FlowShutdown()

void FlowShutdown ( void )

shutdown the flow engine

Warning: Not thread safe

Definition at line 675 of file flow.c.

References FBLOCK_DESTROY, flow_config, flow_hash, flow_recycle_q, FlowClearMemory(), FlowDequeue(), FlowFree(), FlowGetProtoMapping(), FlowQueueDestroy(), FlowSparePoolDestroy(), FlowCnf_::hash_size, Flow_::next, Flow_::proto, SC_ATOMIC_SUB, and SCFreeAligned.

Here is the call graph for this function:

◆ FlowSwap()

void FlowSwap ( Flow * f )

swap the flow's direction

Note: leaves the 'header' untouched. Interpret that based on FLOW_DIR_REVERSED flag.

Warning: : only valid before applayer parsing started. This function doesn't swap anything in Flow::alparser, Flow::alstate

Definition at line 257 of file flow.c.

References Flow_::flags, FLOW_DIR_REVERSED, Flow_::probing_parser_toclient_alproto_masks, Flow_::probing_parser_toserver_alproto_masks, and SWAP_VARS.

◆ FlowUnsetChangeProtoFlag()

void FlowUnsetChangeProtoFlag ( Flow * f )

Unset flag to indicate to change proto for the flow.

Parameters

f flow

Definition at line 196 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

◆ FlowUpdateState()

void FlowUpdateState	(	Flow *	f,
		enum FlowState	s
	)

Definition at line 1158 of file flow.c.

References Flow_::flow_state.

Referenced by FlowHandlePacketUpdate(), and PacketBypassCallback().

Here is the caller graph for this function:

◆ GetFlowBypassInfoID()

FlowStorageId GetFlowBypassInfoID ( void )

Definition at line 211 of file flow-util.c.

References g_bypass_info_id.

Referenced by EveAddFlow(), and PacketBypassCallback().

Here is the caller graph for this function:

◆ RegisterFlowBypassInfo()

void RegisterFlowBypassInfo ( void )

Definition at line 229 of file flow-util.c.

References FlowStorageRegister(), and g_bypass_info_id.

Referenced by PostConfLoadedSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

Data Structures

Macros

Typedefs

Enumerations

Functions

Detailed Description

Macro Definition Documentation

◆ addr_data16

◆ addr_data32

◆ addr_data8

◆ FLOW_ACTION_DROP

◆ FLOW_ACTION_PASS

◆ FLOW_CHANGE_PROTO

◆ FLOW_COPY_IPV4_ADDR_TO_PACKET

◆ FLOW_COPY_IPV6_ADDR_TO_PACKET

◆ FLOW_DIR_REVERSED

◆ FLOW_END_FLAG_EMERGENCY

◆ FLOW_END_FLAG_FORCED

◆ FLOW_END_FLAG_SHUTDOWN

◆ FLOW_END_FLAG_STATE_BYPASSED

◆ FLOW_END_FLAG_STATE_CLOSED

◆ FLOW_END_FLAG_STATE_ESTABLISHED

◆ FLOW_END_FLAG_STATE_NEW

◆ FLOW_END_FLAG_TIMEOUT

◆ FLOW_GET_DP

◆ FLOW_GET_SP

◆ FLOW_HAS_ALERTS

◆ FLOW_HAS_EXPECTATION

◆ FLOW_IPV4

◆ FLOW_IPV6

◆ FLOW_IS_IPV4

◆ FLOW_IS_IPV6

◆ FLOW_IS_PE_DONE

◆ FLOW_IS_PM_DONE

◆ FLOW_IS_PP_DONE

◆ FLOW_NOPACKET_INSPECTION

◆ FLOW_NOPAYLOAD_INSPECTION

◆ FLOW_PKT_ESTABLISHED

◆ FLOW_PKT_LAST_PSEUDO

◆ FLOW_PKT_TOCLIENT

◆ FLOW_PKT_TOCLIENT_FIRST

◆ FLOW_PKT_TOCLIENT_IPONLY_SET

◆ FLOW_PKT_TOSERVER

◆ FLOW_PKT_TOSERVER_FIRST

◆ FLOW_PKT_TOSERVER_IPONLY_SET

◆ FLOW_PROTO_DETECT_TC_DONE

◆ FLOW_PROTO_DETECT_TS_DONE

◆ FLOW_QUIET

◆ FLOW_RESET_PE_DONE

◆ FLOW_RESET_PM_DONE

◆ FLOW_RESET_PP_DONE

◆ FLOW_SET_IPV4_DST_ADDR_FROM_PACKET

◆ FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET

◆ FLOW_SET_IPV6_DST_ADDR_FROM_PACKET

◆ FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET

◆ FLOW_SET_PE_DONE

◆ FLOW_SET_PM_DONE

◆ FLOW_SET_PP_DONE

◆ FLOW_SGH_TOCLIENT

◆ FLOW_SGH_TOSERVER

◆ FLOW_STATE_SIZE

◆ FLOW_TC_APP_UPDATED

◆ FLOW_TC_PE_ALPROTO_DETECT_DONE

◆ FLOW_TC_PM_ALPROTO_DETECT_DONE

◆ FLOW_TC_PP_ALPROTO_DETECT_DONE

◆ FLOW_TIMEOUT_REASSEMBLY_DONE

◆ FLOW_TO_DST_SEEN

◆ FLOW_TO_SRC_SEEN

◆ FLOW_TOCLIENT_DROP_LOGGED

◆ FLOW_TOCLIENT_IPONLY_SET

◆ FLOW_TOSERVER_DROP_LOGGED

◆ FLOW_TOSERVER_IPONLY_SET

◆ FLOW_TS_APP_UPDATED

◆ FLOW_TS_PE_ALPROTO_DETECT_DONE

◆ FLOW_TS_PM_ALPROTO_DETECT_DONE

◆ FLOW_TS_PP_ALPROTO_DETECT_DONE

◆ FLOW_WRONG_THREAD

◆ FLOWFILE_INIT

◆ FLOWFILE_NO_MAGIC_TC

◆ FLOWFILE_NO_MAGIC_TS