suricata
flow-hash.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2012 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __FLOW_HASH_H__
25 #define __FLOW_HASH_H__
26 
27 /** Spinlocks or Mutex for the flow buckets. */
28 //#define FBLOCK_SPIN
29 #define FBLOCK_MUTEX
30 
31 #ifdef FBLOCK_SPIN
32  #ifdef FBLOCK_MUTEX
33  #error Cannot enable both FBLOCK_SPIN and FBLOCK_MUTEX
34  #endif
35 #endif
36 
37 /* flow hash bucket -- the hash is basically an array of these buckets.
38  * Each bucket contains a flow or list of flows. All these flows have
39  * the same hashkey (the hash is a chained hash). When doing modifications
40  * to the list, the entire bucket is locked. */
41 typedef struct FlowBucket_ {
42  /** head of the list of active flows for this row. */
44  /** head of the list of evicted flows for this row. Waiting to be
45  * collected by the Flow Manager. */
47 #ifdef FBLOCK_MUTEX
49 #elif defined FBLOCK_SPIN
50  SCSpinlock s;
51 #else
52  #error Enable FBLOCK_SPIN or FBLOCK_MUTEX
53 #endif
54  /** timestamp in seconds of the earliest possible moment a flow
55  * will time out in this row. Set by the flow manager. Cleared
56  * to 0 by workers, either when new flows are added or when a
57  * flow state changes. The flow manager sets this to INT_MAX for
58  * empty buckets. */
59  SC_ATOMIC_DECLARE(int32_t, next_ts);
60 } __attribute__((aligned(CLS))) FlowBucket;
61 
62 #ifdef FBLOCK_SPIN
63  #define FBLOCK_INIT(fb) SCSpinInit(&(fb)->s, 0)
64  #define FBLOCK_DESTROY(fb) SCSpinDestroy(&(fb)->s)
65  #define FBLOCK_LOCK(fb) SCSpinLock(&(fb)->s)
66  #define FBLOCK_TRYLOCK(fb) SCSpinTrylock(&(fb)->s)
67  #define FBLOCK_UNLOCK(fb) SCSpinUnlock(&(fb)->s)
68 #elif defined FBLOCK_MUTEX
69  #define FBLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)
70  #define FBLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)
71  #define FBLOCK_LOCK(fb) SCMutexLock(&(fb)->m)
72  #define FBLOCK_TRYLOCK(fb) SCMutexTrylock(&(fb)->m)
73  #define FBLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)
74 #else
75  #error Enable FBLOCK_SPIN or FBLOCK_MUTEX
76 #endif
77 
78 /* prototypes */
79 
81  const Packet *, Flow **);
82 
83 Flow *FlowGetFromFlowKey(FlowKey *key, struct timespec *ttime, const uint32_t hash);
84 Flow *FlowGetExistingFlowFromHash(FlowKey * key, uint32_t hash);
85 uint32_t FlowKeyGetHash(FlowKey *flow_key);
86 
87 /** \note f->fb must be locked */
88 static inline void RemoveFromHash(Flow *f, Flow *prev_f)
89 {
90  FlowBucket *fb = f->fb;
91 
92  /* remove from the hash */
93  if (prev_f != NULL) {
94  prev_f->next = f->next;
95  } else {
96  fb->head = f->next;
97  }
98 
99  f->next = NULL;
100  f->fb = NULL;
101 }
102 
103 #endif /* __FLOW_HASH_H__ */
104 
FlowBucket_
Definition: flow-hash.h:41
FlowBucket_::evicted
Flow * evicted
Definition: flow-hash.h:46
CLS
#define CLS
Definition: suricata-common.h:45
Flow_
Flow data structure.
Definition: flow.h:347
FlowLookupStruct_
Definition: flow.h:532
FlowKeyGetHash
uint32_t FlowKeyGetHash(FlowKey *flow_key)
Definition: flow-hash.c:226
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:488
FlowBucket_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(int32_t, next_ts)
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
FlowBucket_::m
SCMutex m
Definition: flow-hash.h:48
Packet_
Definition: decode.h:414
Flow_::next
struct Flow_ * next
Definition: flow.h:394
FlowBucket_::head
Flow * head
Definition: flow-hash.h:43
FlowGetExistingFlowFromHash
Flow * FlowGetExistingFlowFromHash(FlowKey *key, uint32_t hash)
Look for existing Flow using a FlowKey.
Definition: flow-hash.c:914
FlowGetFromFlowKey
Flow * FlowGetFromFlowKey(FlowKey *key, struct timespec *ttime, const uint32_t hash)
Get or create a Flow using a FlowKey.
Definition: flow-hash.c:852
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
SCSpinlock
#define SCSpinlock
Definition: threads-debug.h:234
FlowKey_
Definition: flow.h:301
__attribute__
struct FlowBucket_ __attribute__((aligned(CLS))) FlowBucket
SCMutex
#define SCMutex
Definition: threads-debug.h:114
FlowGetFlowFromHash
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *tctx, const Packet *, Flow **)
Get Flow for packet.
Definition: flow-hash.c:729