suricata
flow-hash.c File Reference
#include "suricata-common.h"
#include "threads.h"
#include "decode.h"
#include "detect-engine-state.h"
#include "flow.h"
#include "flow-hash.h"
#include "flow-util.h"
#include "flow-private.h"
#include "flow-manager.h"
#include "flow-storage.h"
#include "app-layer-parser.h"
#include "util-time.h"
#include "util-debug.h"
#include "util-hash-lookup3.h"
#include "conf.h"
#include "output.h"
#include "output-flow.h"
Include dependency graph for flow-hash.c:

Go to the source code of this file.

Data Structures

struct  FlowHashKey4_
 
struct  FlowHashKey6_
 

Macros

#define FLOW_DEFAULT_FLOW_PRUNE   5
 
#define CMP_FLOW(f1, f2)
 
#define CMP_FLOW_ICMP(f1, f2)
 

Typedefs

typedef struct FlowHashKey4_ FlowHashKey4
 
typedef struct FlowHashKey6_ FlowHashKey6
 

Functions

 SC_ATOMIC_EXTERN (unsigned int, flow_prune_idx)
 
 SC_ATOMIC_EXTERN (unsigned int, flow_flags)
 
void FlowSetupPacket (Packet *p)
 prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow lookup and calc the hash value to be used in the lookup and autofp flow balancing. More...
 
int TcpSessionPacketSsnReuse (const Packet *p, const Flow *f, void *tcp_ssn)
 
FlowFlowGetFlowFromHash (ThreadVars *tv, DecodeThreadVars *dtv, const Packet *p, Flow **dest)
 Get Flow for packet. More...
 

Detailed Description

Macro Definition Documentation

#define CMP_FLOW (   f1,
  f2 
)
Value:
(((CMP_ADDR(&(f1)->src, &(f2)->src) && \
CMP_ADDR(&(f1)->dst, &(f2)->dst) && \
CMP_PORT((f1)->sp, (f2)->sp) && CMP_PORT((f1)->dp, (f2)->dp)) || \
(CMP_ADDR(&(f1)->src, &(f2)->dst) && \
CMP_ADDR(&(f1)->dst, &(f2)->src) && \
CMP_PORT((f1)->sp, (f2)->dp) && CMP_PORT((f1)->dp, (f2)->sp))) && \
(f1)->proto == (f2)->proto && \
(f1)->recursion_level == (f2)->recursion_level && \
(f1)->vlan_id[0] == (f2)->vlan_id[0] && \
(f1)->vlan_id[1] == (f2)->vlan_id[1])
uint16_t src
uint16_t dst
uint8_t proto
#define CMP_ADDR(a1, a2)
Definition: decode.h:238
#define CMP_PORT(p1, p2)
Definition: decode.h:243

Definition at line 215 of file flow-hash.c.

Referenced by FlowSetupPacket().

#define CMP_FLOW_ICMP (   f1,
  f2 
)
Value:
(((CMP_ADDR(&(f1)->src, &(f2)->src) && \
CMP_ADDR(&(f1)->dst, &(f2)->dst) && \
CMP_PORT((f1)->icmp_s.type, (f2)->icmp_s.type) && CMP_PORT((f1)->icmp_d.type, (f2)->icmp_d.type)) || \
(CMP_ADDR(&(f1)->src, &(f2)->dst) && \
CMP_ADDR(&(f1)->dst, &(f2)->src) && \
CMP_PORT((f1)->icmp_d.type, (f2)->icmp_s.type) && CMP_PORT((f1)->icmp_s.type, (f2)->icmp_d.type))) && \
(f1)->proto == (f2)->proto && \
(f1)->recursion_level == (f2)->recursion_level && \
(f1)->vlan_id[0] == (f2)->vlan_id[0] && \
(f1)->vlan_id[1] == (f2)->vlan_id[1])
uint16_t src
uint16_t dst
uint8_t proto
#define CMP_ADDR(a1, a2)
Definition: decode.h:238
#define CMP_PORT(p1, p2)
Definition: decode.h:243

Definition at line 226 of file flow-hash.c.

#define FLOW_DEFAULT_FLOW_PRUNE   5

Definition at line 50 of file flow-hash.c.

Typedef Documentation

typedef struct FlowHashKey4_ FlowHashKey4
typedef struct FlowHashKey6_ FlowHashKey6

Function Documentation

Flow* FlowGetFlowFromHash ( ThreadVars tv,
DecodeThreadVars dtv,
const Packet p,
Flow **  dest 
)

Get Flow for packet.

Hash retrieval function for flows. Looks up the hash bucket containing the flow pointer. Then compares the packet with the found flow to see if it is the flow we need. If it isn't, walk the list until the right flow is found.

If the flow is not found or the bucket was emtpy, a new flow is taken from the queue. FlowDequeue() will alloc new flows as long as we stay within our memcap limit.

The p->flow pointer is updated to point to the flow.

Parameters
tvthread vars
dtvdecode thread vars (for flow log api thread data)
Return values
fLOCKED flow or NULL

Definition at line 483 of file flow-hash.c.

References Flow_::fb, FBLOCK_LOCK, FBLOCK_TRYLOCK, FBLOCK_UNLOCK, flow_config, FLOW_EMERGENCY, FLOW_END_FLAG_EMERGENCY, FLOW_END_FLAG_FORCED, FLOW_END_FLAG_STATE_BYPASSED, FLOW_END_FLAG_STATE_CLOSED, FLOW_END_FLAG_STATE_ESTABLISHED, FLOW_END_FLAG_STATE_NEW, Flow_::flow_end_flags, flow_hash, Flow_::flow_hash, Packet_::flow_hash, FLOW_STATE_CAPTURE_BYPASSED, FLOW_STATE_CLOSED, FLOW_STATE_ESTABLISHED, FLOW_STATE_LOCAL_BYPASSED, FLOW_STATE_NEW, FlowClearMemory(), FlowInit(), FLOWLOCK_TRYWRLOCK, FLOWLOCK_UNLOCK, FLOWLOCK_WRLOCK, FlowUpdateState(), FlowCnf_::hash_size, Flow_::hnext, Flow_::hprev, DecodeThreadVars_::output_flow_thread_data, OutputFlowLog(), Flow_::protoctx, Flow_::protomap, SC_ATOMIC_ADD, SC_ATOMIC_GET, SC_ATOMIC_SET, SCLogDebug, TcpSessionPacketSsnReuse(), and unlikely.

Referenced by FlowHandlePacket().

Here is the call graph for this function:

Here is the caller graph for this function:

SC_ATOMIC_EXTERN ( unsigned  int,
flow_prune_idx   
)
SC_ATOMIC_EXTERN ( unsigned  int,
flow_flags   
)
int TcpSessionPacketSsnReuse ( const Packet p,
const Flow f,
void *  tcp_ssn 
)

Referenced by FlowGetFlowFromHash(), and FlowSetupPacket().

Here is the caller graph for this function: