Go to the documentation of this file.
73 static inline int FlowHashRawAddressIPv6GtU32(
const uint32_t *a,
const uint32_t *b)
75 for (
int i = 0; i < 4; i++) {
94 const uint32_t
u32[5];
114 if (p->
ip4h != NULL) {
117 int ai = (p->
src.addr_data32[0] > p->
dst.addr_data32[0]);
118 fhk.
addrs[1 - ai] = p->
src.addr_data32[0];
119 fhk.
addrs[ai] = p->
dst.addr_data32[0];
121 fhk.
ports[0] = 0xfedc;
122 fhk.
ports[1] = 0xba98;
132 }
else if (p->
ip6h != NULL) {
134 if (FlowHashRawAddressIPv6GtU32(p->
src.addr_data32, p->
dst.addr_data32)) {
135 fhk.
src[0] = p->
src.addr_data32[0];
136 fhk.
src[1] = p->
src.addr_data32[1];
137 fhk.
src[2] = p->
src.addr_data32[2];
138 fhk.
src[3] = p->
src.addr_data32[3];
139 fhk.
dst[0] = p->
dst.addr_data32[0];
140 fhk.
dst[1] = p->
dst.addr_data32[1];
141 fhk.
dst[2] = p->
dst.addr_data32[2];
142 fhk.
dst[3] = p->
dst.addr_data32[3];
144 fhk.
src[0] = p->
dst.addr_data32[0];
145 fhk.
src[1] = p->
dst.addr_data32[1];
146 fhk.
src[2] = p->
dst.addr_data32[2];
147 fhk.
src[3] = p->
dst.addr_data32[3];
148 fhk.
dst[0] = p->
src.addr_data32[0];
149 fhk.
dst[1] = p->
src.addr_data32[1];
150 fhk.
dst[2] = p->
src.addr_data32[2];
151 fhk.
dst[3] = p->
src.addr_data32[3];
154 fhk.
ports[0] = 0xfedc;
155 fhk.
ports[1] = 0xba98;
179 static inline uint32_t FlowGetHash(
const Packet *p)
183 if (p->
ip4h != NULL) {
184 if (p->
tcph != NULL || p->
udph != NULL) {
187 int ai = (p->
src.addr_data32[0] > p->
dst.addr_data32[0]);
188 fhk.
addrs[1-ai] = p->
src.addr_data32[0];
189 fhk.
addrs[ai] = p->
dst.addr_data32[0];
191 const int pi = (p->
sp > p->
dp);
209 const int ai = (psrc > pdst);
210 fhk.
addrs[1-ai] = psrc;
211 fhk.
addrs[ai] = pdst;
226 const int ai = (p->
src.addr_data32[0] > p->
dst.addr_data32[0]);
227 fhk.
addrs[1-ai] = p->
src.addr_data32[0];
228 fhk.
addrs[ai] = p->
dst.addr_data32[0];
229 fhk.
ports[0] = 0xfeed;
230 fhk.
ports[1] = 0xbeef;
238 }
else if (p->
ip6h != NULL) {
240 if (FlowHashRawAddressIPv6GtU32(p->
src.addr_data32, p->
dst.addr_data32)) {
241 fhk.
src[0] = p->
src.addr_data32[0];
242 fhk.
src[1] = p->
src.addr_data32[1];
243 fhk.
src[2] = p->
src.addr_data32[2];
244 fhk.
src[3] = p->
src.addr_data32[3];
245 fhk.
dst[0] = p->
dst.addr_data32[0];
246 fhk.
dst[1] = p->
dst.addr_data32[1];
247 fhk.
dst[2] = p->
dst.addr_data32[2];
248 fhk.
dst[3] = p->
dst.addr_data32[3];
250 fhk.
src[0] = p->
dst.addr_data32[0];
251 fhk.
src[1] = p->
dst.addr_data32[1];
252 fhk.
src[2] = p->
dst.addr_data32[2];
253 fhk.
src[3] = p->
dst.addr_data32[3];
254 fhk.
dst[0] = p->
src.addr_data32[0];
255 fhk.
dst[1] = p->
src.addr_data32[1];
256 fhk.
dst[2] = p->
src.addr_data32[2];
257 fhk.
dst[3] = p->
src.addr_data32[3];
260 const int pi = (p->
sp > p->
dp);
292 const int pi = (fk->
sp > fk->
dp);
325 const int pi = (fk->
sp > fk->
dp);
338 static inline bool CmpAddrs(
const uint32_t addr1[4],
const uint32_t addr2[4])
340 return addr1[0] == addr2[0] && addr1[1] == addr2[1] &&
341 addr1[2] == addr2[2] && addr1[3] == addr2[3];
344 static inline bool CmpAddrsAndPorts(
const uint32_t src1[4],
345 const uint32_t dst1[4],
Port src_port1,
Port dst_port1,
346 const uint32_t src2[4],
const uint32_t dst2[4],
Port src_port2,
352 return (CmpAddrs(src1, src2) && CmpAddrs(dst1, dst2) &&
353 src_port1 == src_port2 && dst_port1 == dst_port2) ||
354 (CmpAddrs(src1, dst2) && CmpAddrs(dst1, src2) &&
355 src_port1 == dst_port2 && dst_port1 == src_port2);
358 static inline bool CmpVlanIds(
const uint16_t vlan_id1[2],
const uint16_t vlan_id2[2])
360 return ((vlan_id1[0] ^ vlan_id2[0]) &
g_vlan_mask) == 0 &&
366 static inline bool CmpFlowPacket(
const Flow *f,
const Packet *p)
372 return CmpAddrsAndPorts(f_src, f_dst, f->
sp, f->
dp, p_src, p_dst, p->
sp,
378 static inline bool CmpFlowKey(
const Flow *f,
const FlowKey *k)
384 return CmpAddrsAndPorts(f_src, f_dst, f->
sp, f->
dp, k_src, k_dst, k->
sp,
390 static inline bool CmpAddrsAndICMPTypes(
const uint32_t src1[4],
391 const uint32_t dst1[4], uint8_t icmp_s_type1, uint8_t icmp_d_type1,
392 const uint32_t src2[4],
const uint32_t dst2[4], uint8_t icmp_s_type2,
393 uint8_t icmp_d_type2)
398 return (CmpAddrs(src1, src2) && CmpAddrs(dst1, dst2) &&
399 icmp_s_type1 == icmp_s_type2 && icmp_d_type1 == icmp_d_type2) ||
400 (CmpAddrs(src1, dst2) && CmpAddrs(dst1, src2) &&
401 icmp_s_type1 == icmp_d_type2 && icmp_d_type1 == icmp_s_type2);
404 static inline bool CmpFlowICMPPacket(
const Flow *f,
const Packet *p)
410 return CmpAddrsAndICMPTypes(f_src, f_dst, f->
icmp_s.type,
426 static inline int FlowCompareICMPv4(
Flow *f,
const Packet *p)
452 return CmpFlowICMPPacket(f, p);
467 static inline int FlowCompareESP(
Flow *f,
const Packet *p)
474 return CmpAddrs(f_src, p_src) && CmpAddrs(f_dst, p_dst) && f->
proto == p->
proto &&
485 static inline int FlowCompare(
Flow *f,
const Packet *p)
487 if (p->
proto == IPPROTO_ICMP) {
488 return FlowCompareICMPv4(f, p);
489 }
else if (p->
proto == IPPROTO_ESP) {
490 return FlowCompareESP(f, p);
492 return CmpFlowPacket(f, p);
507 static inline int FlowCreateCheck(
const Packet *p,
const bool emerg)
563 const Packet *p,
const bool emerg)
566 bool spare_sync =
false;
583 if (
tv && fls->
dtv) {
602 static inline void NoFlowHandleIPS(
Packet *p)
622 if (g_eps_flow_memcap != UINT64_MAX && g_eps_flow_memcap == p->
pcap_cnt) {
626 if (FlowCreateCheck(p, emerg) == 0) {
633 f = FlowSpareSync(
tv, fls, p, emerg);
645 f = FlowGetUsedFlow(
tv, fls->
dtv, p->
ts);
651 if (
tv != NULL && fls->
dtv != NULL) {
666 if (
tv != NULL && fls->
dtv != NULL) {
689 const uint32_t hash,
Packet *p)
692 if (
tv != NULL && fls->
dtv != NULL) {
706 Flow *f = FlowGetNew(
tv, fls, p);
739 FlowBucket *fb,
Flow *f,
Flow *prev_f)
751 if (f->
proto != IPPROTO_TCP || FlowBelongsToUs(
tv, f)) {
758 f->
next = fb->evicted;
766 static inline bool FlowIsTimedOut(
const Flow *f,
const uint32_t sec,
const bool emerg)
775 if ((int64_t)sec >= timeout_at)
807 SCLogDebug(
"fb %p fb->head %p", fb, fb->head);
810 if (fb->head == NULL) {
811 f = FlowGetNew(
tv, fls, p);
826 FlowReference(dest, f);
833 const uint32_t fb_nextts = !emerg ?
SC_ATOMIC_GET(fb->next_ts) : 0;
839 const bool timedout = (fb_nextts < (uint32_t)
SCTIME_SECS(p->
ts) &&
844 MoveToWorkQueue(
tv, fls, fb, f, prev_f);
847 }
else if (FlowCompare(f, p) != 0) {
851 Flow *new_f = TcpReuseReplace(
tv, fls, fb, f, hash, p);
854 MoveToWorkQueue(
tv, fls, fb, f, prev_f);
863 FlowReference(dest, f);
873 if (next_f == NULL) {
874 f = FlowGetNew(
tv, fls, p);
890 FlowReference(dest, f);
902 static inline int FlowCompareKey(
Flow *f,
FlowKey *key)
904 if ((f->
proto != IPPROTO_TCP) && (f->
proto != IPPROTO_UDP))
906 return CmpFlowKey(f, key);
922 uint32_t hash = flow_id & 0x0000FFFF;
927 SCLogDebug(
"fb %p fb->head %p", fb, fb->head);
930 if (fb->head == NULL) {
939 if (FlowGetId(f) != flow_id) {
947 if (FlowGetId(f) != flow_id) {
989 SCLogDebug(
"Can't get a spare flow at start");
995 f->
src.addr_data32[0] = key->
src.addr_data32[0];
996 f->
src.addr_data32[1] = key->
src.addr_data32[1];
997 f->
src.addr_data32[2] = key->
src.addr_data32[2];
998 f->
src.addr_data32[3] = key->
src.addr_data32[3];
999 f->
dst.addr_data32[0] = key->
dst.addr_data32[0];
1000 f->
dst.addr_data32[1] = key->
dst.addr_data32[1];
1001 f->
dst.addr_data32[2] = key->
dst.addr_data32[2];
1002 f->
dst.addr_data32[3] = key->
dst.addr_data32[3];
1009 }
else if (key->
src.
family == AF_INET6) {
1045 SCLogDebug(
"fb %p fb->head %p", fb, fb->head);
1048 if (fb->head == NULL) {
1057 if (FlowCompareKey(f, key) == 0) {
1066 if (FlowCompareKey(f, key) != 0) {
1083 #define FLOW_GET_NEW_TRIES 5
1087 static inline int GetUsedTryLockBucket(FlowBucket *fb)
1092 static inline int GetUsedTryLockFlow(
Flow *f)
1097 static inline uint32_t GetUsedAtomicUpdate(
const uint32_t val)
1134 #define STATSADDUI64(cnt, value) \
1136 StatsAddUI64(tv, dtv->cnt, (value)); \
1139 #define STATSADDUI64(cnt, value) \
1140 StatsAddUI64(tv, dtv->cnt, (value));
1176 if (GetUsedTryLockBucket(fb) != 0) {
1187 if (GetUsedTryLockFlow(f) != 0) {
1193 if (StillAlive(f,
ts)) {
FlowQueuePrivate work_queue
TmEcode OutputFlowLog(ThreadVars *tv, void *thread_data, Flow *f)
Run flow logger(s)
union FlowAddress_::@115 address
uint16_t counter_flow_udp
void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason)
uint16_t counter_flow_active
#define ICMPV4_GET_EMB_PROTO(p)
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
#define IPV4_GET_RAW_IPDST_U32(ip4h)
uint32_t hashword(const uint32_t *k, size_t length, uint32_t initval)
uint16_t counter_flow_icmp4
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
@ PKT_DROP_REASON_FLOW_MEMCAP
uint32_t address_un_data32[4]
FlowQueuePrivate FlowSpareGetFromPool(void)
uint16_t counter_flow_spare_sync_avg
uint32_t FlowKeyGetHash(FlowKey *fk)
#define ICMPV4_DEST_UNREACH_IS_VALID(p)
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
#define FLOWLOCK_TRYWRLOCK(fb)
struct FlowHashKey4_ FlowHashKey4
#define FBLOCK_TRYLOCK(fb)
uint16_t counter_flow_tcp
uint32_t address_un_data32[4]
TcpStreamCnf stream_config
struct Flow_::@116::@122 icmp_s
uint16_t counter_flow_get_used
#define FLOWLOCK_UNLOCK(fb)
uint16_t counter_flow_spare_sync_empty
uint16_t counter_flow_tcp_reuse
uint16_t counter_flow_total
struct Packet_::@32::@42 icmp_s
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
uint32_t emerg_spare_sync_stamp
int TcpSessionPacketSsnReuse(const Packet *p, const Flow *f, const void *tcp_ssn)
uint16_t counter_flow_spare_sync
#define STREAM_PKT_FLAG_TCP_PORT_REUSE
#define FLOW_GET_NEW_TRIES
#define STATSADDUI64(cnt, value)
#define SCTIME_FROM_TIMESPEC(ts)
#define ICMPV4_GET_EMB_IPV4(p)
#define FLOWLOCK_WRLOCK(fb)
SC_ATOMIC_EXTERN(unsigned int, flow_prune_idx)
Per thread variable structure.
unsigned int FlowStorageSize(void)
struct FlowHashKey6_ FlowHashKey6
Flow * FlowQueuePrivateGetFromTop(FlowQueuePrivate *fqc)
Flow * FlowGetExistingFlowFromHash(FlowKey *key, const uint32_t hash)
Look for existing Flow using a FlowKey.
void FlowTimeoutsEmergency(void)
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
#define ESP_GET_SPI(p)
Get the spi field off a packet.
Flow * FlowGetExistingFlowFromFlowId(int64_t flow_id)
Look for existing Flow using a flow id value.
#define FLOW_END_FLAG_EMERGENCY
#define FBLOCK_UNLOCK(fb)
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
#define FlowWakeupFlowManagerThread()
Data structures and function prototypes for keeping state for the detection engine.
union Address_::@31 address
int RunmodeIsUnittests(void)
struct Flow_::@118::@124 icmp_d
void FlowUpdateState(Flow *f, const enum FlowState s)
FlowQueuePrivate spare_queue
uint32_t FlowGetIpPairProtoHash(const Packet *p)
uint16_t counter_flow_spare_sync_incomplete
#define IPV4_GET_RAW_IPSRC_U32(ip4h)
uint16_t counter_flow_icmp6
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
struct Flow_::@116::@123 esp
enum ExceptionPolicy memcap_policy
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
#define ICMPV4_IS_ERROR_MSG(p)
Structure to hold thread specific data for all decode modules.
Flow * FlowGetFromFlowKey(FlowKey *key, struct timespec *ttime, const uint32_t hash)
Get or create a Flow using a FlowKey.
void * output_flow_thread_data
#define STREAM_PKT_FLAG_SET(p, f)
uint16_t counter_flow_memcap
#define FLOW_END_FLAG_TIMEOUT
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
void FlowQueuePrivateAppendFlow(FlowQueuePrivate *fqc, Flow *f)
Flow * FlowAlloc(void)
allocate a flow
#define FLOW_END_FLAG_FORCED
void FlowInit(Flow *f, const Packet *p)
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow look...
struct Packet_::@34::@43 icmp_d
FlowThreadId thread_id[2]
#define SC_ATOMIC_OR(name, val)
Bitwise OR a value to our atomic variable.