suricata: src/flow-manager.c File Reference

suricata

#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "conf.h"
#include "threadvars.h"
#include "tm-threads.h"
#include "runmodes.h"
#include "util-random.h"
#include "util-time.h"
#include "flow.h"
#include "flow-queue.h"
#include "flow-hash.h"
#include "flow-util.h"
#include "flow-var.h"
#include "flow-private.h"
#include "flow-timeout.h"
#include "flow-manager.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-byte.h"
#include "util-debug.h"
#include "util-privs.h"
#include "util-signal.h"
#include "threads.h"
#include "detect.h"
#include "detect-engine-state.h"
#include "stream.h"
#include "app-layer-parser.h"
#include "host-timeout.h"
#include "defrag-timeout.h"
#include "ippair-timeout.h"
#include "output-flow.h"

Include dependency graph for flow-manager.c:

Go to the source code of this file.

Data Structures
struct	FlowTimeoutCounters_

struct	FlowManagerThreadData_

struct	FlowRecyclerThreadData_

Macros
#define	FLOW_NORMAL_MODE_UPDATE_DELAY_SEC 1

#define	FLOW_NORMAL_MODE_UPDATE_DELAY_NSEC 0

#define	FLOW_EMERG_MODE_UPDATE_DELAY_SEC 0

#define	FLOW_EMERG_MODE_UPDATE_DELAY_NSEC 100000

#define	NEW_FLOW_COUNT_COND 10

#define	THREAD_KILL_MAX_WAIT_TIME 60

#define	WAIT_TIME 100

#define	THREAD_KILL_MAX_WAIT_TIME 60

#define	WAIT_TIME 100

Typedefs
typedef FlowProtoTimeout *	FlowProtoTimeoutPtr

typedef struct FlowTimeoutCounters_	FlowTimeoutCounters

typedef struct FlowManagerThreadData_	FlowManagerThreadData

typedef struct FlowRecyclerThreadData_	FlowRecyclerThreadData

Functions
	SC_ATOMIC_DECLARE (uint32_t, flowmgr_cnt)

	SC_ATOMIC_DECLARE (uint32_t, flowrec_cnt)

	SC_ATOMIC_EXTERN (unsigned int, flow_flags)

	SC_ATOMIC_DECLARE (FlowProtoTimeoutPtr, flow_timeouts)

void	FlowTimeoutsInit (void)

void	FlowTimeoutsEmergency (void)

void	FlowDisableFlowManagerThread (void)
	Used to disable flow manager thread(s). More...

void	FlowManagerThreadSpawn ()
	spawn the flow manager thread More...

void	FlowRecyclerThreadSpawn ()
	spawn the flow recycler thread More...

void	FlowDisableFlowRecyclerThread (void)
	Used to disable flow recycler thread(s). More...

void	TmModuleFlowManagerRegister (void)

void	TmModuleFlowRecyclerRegister (void)

void	FlowMgrRegisterTests (void)
	Function to register the Flow Unitests. More...

Variables
int	run_mode

int	g_detect_disabled

Detailed Description

Author: Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com; Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file flow-manager.c.

Macro Definition Documentation

#define FLOW_EMERG_MODE_UPDATE_DELAY_NSEC 100000

Definition at line 104 of file flow-manager.c.

#define FLOW_EMERG_MODE_UPDATE_DELAY_SEC 0

Definition at line 103 of file flow-manager.c.

#define FLOW_NORMAL_MODE_UPDATE_DELAY_NSEC 0

Definition at line 101 of file flow-manager.c.

#define FLOW_NORMAL_MODE_UPDATE_DELAY_SEC 1

Definition at line 100 of file flow-manager.c.

#define NEW_FLOW_COUNT_COND 10

Definition at line 105 of file flow-manager.c.

#define THREAD_KILL_MAX_WAIT_TIME 60

Referenced by FlowDisableFlowManagerThread(), and FlowDisableFlowRecyclerThread().

#define THREAD_KILL_MAX_WAIT_TIME 60

#define WAIT_TIME 100

Referenced by FlowDisableFlowManagerThread(), and FlowDisableFlowRecyclerThread().

#define WAIT_TIME 100

Typedef Documentation

typedef struct FlowManagerThreadData_ FlowManagerThreadData

typedef FlowProtoTimeout* FlowProtoTimeoutPtr

Definition at line 86 of file flow-manager.c.

typedef struct FlowRecyclerThreadData_ FlowRecyclerThreadData

typedef struct FlowTimeoutCounters_ FlowTimeoutCounters

Function Documentation

void FlowDisableFlowManagerThread ( void )

Used to disable flow manager thread(s).

Todo:: Kinda hackish since it uses the tv name to identify flow manager thread. We need an all weather identification scheme.

Definition at line 133 of file flow-manager.c.

References BUG_ON, FlowTimeoutCounters_::byp, FlowProtoTimeout_::bypassed_timeout, FlowTimeoutCounters_::clo, FlowProtoTimeout_::closed_timeout, FlowTimeoutCounters_::est, FlowProtoTimeout_::est_timeout, Flow_::fb, FBLOCK_LOCK, FBLOCK_TRYLOCK, FBLOCK_UNLOCK, Flow_::flags, FLOW_BYPASSED_TIMEOUT, flow_config, FLOW_EMERGENCY, FLOW_END_FLAG_EMERGENCY, FLOW_END_FLAG_SHUTDOWN, FLOW_END_FLAG_STATE_BYPASSED, FLOW_END_FLAG_STATE_CLOSED, FLOW_END_FLAG_STATE_ESTABLISHED, FLOW_END_FLAG_STATE_NEW, FLOW_END_FLAG_TIMEOUT, Flow_::flow_end_flags, flow_hash, flow_manager_ctrl_cond, flow_recycle_q, FLOW_STATE_CAPTURE_BYPASSED, FLOW_STATE_CLOSED, FLOW_STATE_ESTABLISHED, FLOW_STATE_LOCAL_BYPASSED, FLOW_STATE_NEW, FLOW_TCP_REUSED, FLOW_TIMEOUT_REASSEMBLY_DONE, FlowEnqueue(), FlowForceReassemblyForFlow(), FlowForceReassemblyNeedReassembly(), FLOWLOCK_UNLOCK, FLOWLOCK_WRLOCK, FlowTimeoutCounters_::flows_checked, FlowTimeoutCounters_::flows_notimeout, FlowTimeoutCounters_::flows_removed, FlowTimeoutCounters_::flows_timeout, FlowTimeoutCounters_::flows_timeout_inuse, g_detect_disabled, FlowCnf_::hash_size, FlowBucket_::head, Flow_::hnext, Flow_::hprev, Flow_::lastts, ThreadVars_::name, FlowTimeoutCounters_::new, FlowProtoTimeout_::new_timeout, ThreadVars_::next, next, PacketPoolWaitForN(), Flow_::protomap, FlowTimeoutCounters_::rows_busy, FlowTimeoutCounters_::rows_checked, FlowTimeoutCounters_::rows_empty, FlowTimeoutCounters_::rows_maxlen, FlowTimeoutCounters_::rows_skipped, SC_ATOMIC_GET, SC_ATOMIC_SET, SC_ERR_FATAL, SCCtrlCondSignal, SCLogError, SCMutexLock, SCMutexUnlock, FlowBucket_::tail, FlowTimeoutCounters_::tcp_reuse, THREAD_KILL_MAX_WAIT_TIME, thread_name_flow_mgr, THV_KILL, THV_RUNNING_DONE, TmThreadsCheckFlag(), TmThreadsSetFlag(), ts, tv_root, tv_root_lock, TVT_MGMT, and WAIT_TIME.

Referenced by PostRunDeinit().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowDisableFlowRecyclerThread ( void )

Used to disable flow recycler thread(s).

Note: this should only be called when the flow manager is already gone

Todo:: Kinda hackish since it uses the tv name to identify flow recycler thread. We need an all weather identification scheme.

Definition at line 1018 of file flow-manager.c.

References flow_recycler_ctrl_cond, ThreadVars_::name, ThreadVars_::next, SC_ATOMIC_SET, SC_ERR_FATAL, SCCtrlCondSignal, SCLogError, SCMutexLock, SCMutexUnlock, THREAD_KILL_MAX_WAIT_TIME, thread_name_flow_rec, THV_KILL, THV_RUNNING_DONE, TmThreadsCheckFlag(), TmThreadsSetFlag(), tv_root, tv_root_lock, TVT_MGMT, and WAIT_TIME.

Referenced by PostRunDeinit().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowManagerThreadSpawn ( void )

spawn the flow manager thread

Definition at line 804 of file flow-manager.c.

References BUG_ON, ConfGetInt(), flow_manager_ctrl_cond, flow_manager_ctrl_mutex, FlowGetMemuse(), SC_ERR_INVALID_ARGUMENTS, SCCtrlCondInit, SCCtrlMutexInit, SCLogError, StatsRegisterGlobalCounter(), thread_name_flow_mgr, TM_ECODE_OK, TM_THREAD_NAME_MAX, TmThreadCreateMgmtThreadByName(), and TmThreadSpawn().

Referenced by RunModeDispatch().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowMgrRegisterTests ( void )

Function to register the Flow Unitests.

Definition at line 1391 of file flow-manager.c.

References UtRegisterTest().

Referenced by FlowRegisterTests().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowRecyclerThreadSpawn ( void )

spawn the flow recycler thread

Definition at line 965 of file flow-manager.c.

References BUG_ON, ConfGetInt(), flow_recycler_ctrl_cond, flow_recycler_ctrl_mutex, SC_ERR_INVALID_ARGUMENTS, SCCtrlCondInit, SCCtrlMutexInit, SCLogError, thread_name_flow_rec, TM_ECODE_OK, TM_THREAD_NAME_MAX, TmThreadCreateMgmtThreadByName(), and TmThreadSpawn().

Referenced by RunModeDispatch().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowTimeoutsEmergency ( void )

Definition at line 94 of file flow-manager.c.

References flow_timeouts_emerg, and SC_ATOMIC_SET.

Referenced by FlowSetupPacket().

Here is the caller graph for this function:

void FlowTimeoutsInit ( void )

Definition at line 89 of file flow-manager.c.

References flow_timeouts_normal, and SC_ATOMIC_SET.

Referenced by FlowInitFlowProto().

Here is the caller graph for this function:

SC_ATOMIC_DECLARE	(	uint32_t	,
		flowmgr_cnt
	)

SC_ATOMIC_DECLARE	(	uint32_t	,
		flowrec_cnt
	)

SC_ATOMIC_DECLARE	(	FlowProtoTimeoutPtr	,
		flow_timeouts
	)

SC_ATOMIC_EXTERN	(	unsigned	int,
		flow_flags
	)

void TmModuleFlowManagerRegister ( void )

Definition at line 1096 of file flow-manager.c.

References TmModule_::cap_flags, TmModule_::flags, TmModule_::Management, TmModule_::name, SC_ATOMIC_INIT, SCLogDebug, TmModule_::ThreadDeinit, TmModule_::ThreadInit, TM_FLAG_MANAGEMENT_TM, TMM_FLOWMANAGER, and tmm_modules.

Referenced by RegisterAllModules().

Here is the caller graph for this function:

void TmModuleFlowRecyclerRegister ( void )

Definition at line 1111 of file flow-manager.c.

References TmModule_::cap_flags, TcpSession_::client, Flow_::fb, FBLOCK_DESTROY, FBLOCK_INIT, TmModule_::flags, Flow_::flags, FLOW_CHECK_MEMCAP, flow_config, FLOW_DESTROY, FLOW_EMERGENCY, FLOW_INITIALIZE, FLOW_QUIET, flow_recycle_q, flow_spare_q, FLOW_TIMEOUT_REASSEMBLY_DONE, FlowInitConfig(), FlowQueueDestroy(), FlowQueueInit(), FlowShutdown(), FlowCnf_::hash_size, Flow_::lastts, FlowQueue_::len, TmModule_::Management, TmModule_::name, FlowCnf_::prealloc, Flow_::proto, Flow_::protoctx, SC_ATOMIC_GET, SC_ATOMIC_INIT, SC_ATOMIC_SET, SCLogDebug, TcpStream_::seg_tree, TcpSession_::server, TcpSession_::state, TCP_ESTABLISHED, TCP_SEG_LEN, TCP_SYN_SENT, TmModule_::ThreadDeinit, TmModule_::ThreadInit, TimeGet(), TimeSetIncrementTime(), TM_FLAG_MANAGEMENT_TM, TMM_FLOWRECYCLER, tmm_modules, and UTHBuildPacketOfFlows().

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

int g_detect_disabled

global indicating if detection is enabled

Definition at line 218 of file suricata.c.

Referenced by FlowDisableFlowManagerThread().

int run_mode

Run mode selected

Definition at line 204 of file suricata.c.

src
flow-manager.c
Generated on Sat Feb 23 2019 23:30:27 for suricata by 1.8.11