suricata
flow-hash.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2012 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef SURICATA_FLOW_HASH_H
25 #define SURICATA_FLOW_HASH_H
26 
27 #include "flow.h"
28 
29 /** Spinlocks or Mutex for the flow buckets. */
30 //#define FBLOCK_SPIN
31 #define FBLOCK_MUTEX
32 
33 #ifdef FBLOCK_SPIN
34  #ifdef FBLOCK_MUTEX
35  #error Cannot enable both FBLOCK_SPIN and FBLOCK_MUTEX
36  #endif
37 #endif
38 
39 /* flow hash bucket -- the hash is basically an array of these buckets.
40  * Each bucket contains a flow or list of flows. All these flows have
41  * the same hashkey (the hash is a chained hash). When doing modifications
42  * to the list, the entire bucket is locked. */
43 typedef struct FlowBucket_ {
44  /** head of the list of active flows for this row. */
46  /** head of the list of evicted flows for this row. Waiting to be
47  * collected by the Flow Manager. */
49 #ifdef FBLOCK_MUTEX
51 #elif defined FBLOCK_SPIN
52  SCSpinlock s;
53 #else
54  #error Enable FBLOCK_SPIN or FBLOCK_MUTEX
55 #endif
56  /** timestamp in seconds of the earliest possible moment a flow
57  * will time out in this row. Set by the flow manager. Cleared
58  * to 0 by workers, either when new flows are added or when a
59  * flow state changes. The flow manager sets this to UINT_MAX for
60  * empty buckets. */
61  SC_ATOMIC_DECLARE(uint32_t, next_ts);
62 } __attribute__((aligned(CLS))) FlowBucket;
63 
64 #ifdef FBLOCK_SPIN
65  #define FBLOCK_INIT(fb) SCSpinInit(&(fb)->s, 0)
66  #define FBLOCK_DESTROY(fb) SCSpinDestroy(&(fb)->s)
67  #define FBLOCK_LOCK(fb) SCSpinLock(&(fb)->s)
68  #define FBLOCK_TRYLOCK(fb) SCSpinTrylock(&(fb)->s)
69  #define FBLOCK_UNLOCK(fb) SCSpinUnlock(&(fb)->s)
70 #elif defined FBLOCK_MUTEX
71  #define FBLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)
72  #define FBLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)
73  #define FBLOCK_LOCK(fb) SCMutexLock(&(fb)->m)
74  #define FBLOCK_TRYLOCK(fb) SCMutexTrylock(&(fb)->m)
75  #define FBLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)
76 #else
77  #error Enable FBLOCK_SPIN or FBLOCK_MUTEX
78 #endif
79 
80 /* prototypes */
81 
83 
84 Flow *FlowGetFromFlowKey(FlowKey *key, struct timespec *ttime, const uint32_t hash);
85 Flow *FlowGetExistingFlowFromFlowId(int64_t flow_id);
86 uint32_t FlowKeyGetHash(FlowKey *flow_key);
87 uint32_t FlowGetIpPairProtoHash(const Packet *p);
88 
89 /** \note f->fb must be locked */
90 static inline void RemoveFromHash(Flow *f, Flow *prev_f)
91 {
92  FlowBucket *fb = f->fb;
93 
94  /* remove from the hash */
95  if (prev_f != NULL) {
96  prev_f->next = f->next;
97  } else {
98  fb->head = f->next;
99  }
100 
101  f->next = NULL;
102  f->fb = NULL;
103 }
104 
105 #endif /* SURICATA_FLOW_HASH_H */
FlowBucket_
Definition: flow-hash.h:43
FlowBucket_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(uint32_t, next_ts)
FlowBucket_::evicted
Flow * evicted
Definition: flow-hash.h:48
CLS
#define CLS
Definition: suricata-common.h:56
Flow_
Flow data structure.
Definition: flow.h:356
FlowLookupStruct_
Definition: flow.h:544
FlowKeyGetHash
uint32_t FlowKeyGetHash(FlowKey *flow_key)
Definition: flow-hash.c:307
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:493
FlowGetFlowFromHash
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *tctx, Packet *, Flow **)
Get Flow for packet.
Definition: flow-hash.c:866
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
FlowBucket_::m
SCMutex m
Definition: flow-hash.h:50
FlowGetExistingFlowFromFlowId
Flow * FlowGetExistingFlowFromFlowId(int64_t flow_id)
Look for existing Flow using a flow id value.
Definition: flow-hash.c:991
Packet_
Definition: decode.h:479
Flow_::next
struct Flow_ * next
Definition: flow.h:401
FlowBucket_::head
Flow * head
Definition: flow-hash.h:45
FlowGetFromFlowKey
Flow * FlowGetFromFlowKey(FlowKey *key, struct timespec *ttime, const uint32_t hash)
Get or create a Flow using a FlowKey.
Definition: flow-hash.c:1055
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
FlowGetIpPairProtoHash
uint32_t FlowGetIpPairProtoHash(const Packet *p)
Definition: flow-hash.c:116
SCSpinlock
#define SCSpinlock
Definition: threads-debug.h:234
FlowKey_
Definition: flow.h:309
__attribute__
struct FlowBucket_ __attribute__((aligned(CLS))) FlowBucket
flow.h
SCMutex
#define SCMutex
Definition: threads-debug.h:114