suricata: src/flow-manager.c File Reference

suricata

#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "conf.h"
#include "threadvars.h"
#include "tm-threads.h"
#include "runmodes.h"
#include "util-random.h"
#include "util-time.h"
#include "flow.h"
#include "flow-queue.h"
#include "flow-hash.h"
#include "flow-util.h"
#include "flow-var.h"
#include "flow-private.h"
#include "flow-timeout.h"
#include "flow-manager.h"
#include "flow-storage.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-byte.h"
#include "util-debug.h"
#include "util-privs.h"
#include "util-signal.h"
#include "threads.h"
#include "detect.h"
#include "detect-engine-state.h"
#include "stream.h"
#include "app-layer-parser.h"
#include "host-timeout.h"
#include "defrag-timeout.h"
#include "ippair-timeout.h"
#include "output-flow.h"

Include dependency graph for flow-manager.c:

Go to the source code of this file.

Data Structures
struct	FlowTimeoutCounters_

struct	FlowManagerThreadData_

struct	FlowRecyclerThreadData_

Macros
#define	FLOW_NORMAL_MODE_UPDATE_DELAY_SEC 1

#define	FLOW_NORMAL_MODE_UPDATE_DELAY_NSEC 0

#define	FLOW_EMERG_MODE_UPDATE_DELAY_SEC 0

#define	FLOW_EMERG_MODE_UPDATE_DELAY_NSEC 100000

#define	NEW_FLOW_COUNT_COND 10

Typedefs
typedef FlowProtoTimeout *	FlowProtoTimeoutPtr

typedef struct FlowTimeoutCounters_	FlowTimeoutCounters

typedef struct FlowManagerThreadData_	FlowManagerThreadData

typedef struct FlowRecyclerThreadData_	FlowRecyclerThreadData

Functions
	SC_ATOMIC_DECLARE (uint32_t, flowmgr_cnt)

	SC_ATOMIC_DECLARE (uint32_t, flowrec_cnt)

	SC_ATOMIC_EXTERN (unsigned int, flow_flags)

	SC_ATOMIC_DECLARE (FlowProtoTimeoutPtr, flow_timeouts)

void	FlowTimeoutsInit (void)

void	FlowTimeoutsEmergency (void)

void	FlowDisableFlowManagerThread (void)
	Used to disable flow manager thread(s). More...

void	FlowManagerThreadSpawn ()
	spawn the flow manager thread More...

void	FlowRecyclerThreadSpawn ()
	spawn the flow recycler thread More...

void	FlowDisableFlowRecyclerThread (void)
	Used to disable flow recycler thread(s). More...

void	TmModuleFlowManagerRegister (void)

void	TmModuleFlowRecyclerRegister (void)

void	FlowMgrRegisterTests (void)
	Function to register the Flow Unitests. More...

Variables
int	run_mode

int	g_detect_disabled

Detailed Description

Author: Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com; Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file flow-manager.c.

Macro Definition Documentation

#define FLOW_EMERG_MODE_UPDATE_DELAY_NSEC 100000

Definition at line 105 of file flow-manager.c.

#define FLOW_EMERG_MODE_UPDATE_DELAY_SEC 0

Definition at line 104 of file flow-manager.c.

#define FLOW_NORMAL_MODE_UPDATE_DELAY_NSEC 0

Definition at line 102 of file flow-manager.c.

#define FLOW_NORMAL_MODE_UPDATE_DELAY_SEC 1

Definition at line 101 of file flow-manager.c.

#define NEW_FLOW_COUNT_COND 10

Definition at line 106 of file flow-manager.c.

Typedef Documentation

typedef struct FlowManagerThreadData_ FlowManagerThreadData

typedef FlowProtoTimeout* FlowProtoTimeoutPtr

Definition at line 87 of file flow-manager.c.

typedef struct FlowRecyclerThreadData_ FlowRecyclerThreadData

typedef struct FlowTimeoutCounters_ FlowTimeoutCounters

Function Documentation

void FlowDisableFlowManagerThread ( void )

Used to disable flow manager thread(s).

Todo:: Kinda hackish since it uses the tv name to identify flow manager thread. We need an all weather identification scheme.

Definition at line 138 of file flow-manager.c.

References BUG_ON, FlowTimeoutCounters_::byp, FlowBypassInfo_::bypass_data, FlowTimeoutCounters_::bypassed_bytes, FlowTimeoutCounters_::bypassed_count, FlowTimeoutCounters_::bypassed_pkts, FlowProtoTimeout_::bypassed_timeout, FlowBypassInfo_::BypassUpdate, FlowTimeoutCounters_::clo, FlowProtoTimeout_::closed_timeout, FlowTimeoutCounters_::est, FlowProtoTimeout_::est_timeout, FatalError, Flow_::fb, FBLOCK_LOCK, FBLOCK_TRYLOCK, FBLOCK_UNLOCK, Flow_::flags, FLOW_BYPASSED_TIMEOUT, flow_config, FLOW_EMERGENCY, FLOW_END_FLAG_EMERGENCY, FLOW_END_FLAG_SHUTDOWN, FLOW_END_FLAG_STATE_BYPASSED, FLOW_END_FLAG_STATE_CLOSED, FLOW_END_FLAG_STATE_ESTABLISHED, FLOW_END_FLAG_STATE_NEW, FLOW_END_FLAG_TIMEOUT, Flow_::flow_end_flags, flow_hash, FLOW_IS_IPV4, FLOW_IS_IPV6, flow_manager_ctrl_cond, flow_recycle_q, FLOW_STATE_CAPTURE_BYPASSED, FLOW_STATE_CLOSED, FLOW_STATE_ESTABLISHED, FLOW_STATE_LOCAL_BYPASSED, FLOW_STATE_NEW, FLOW_TCP_REUSED, FLOW_TIMEOUT_REASSEMBLY_DONE, FlowEnqueue(), FlowForceReassemblyForFlow(), FlowForceReassemblyNeedReassembly(), FlowGetStorageById(), FLOWLOCK_UNLOCK, FLOWLOCK_WRLOCK, FlowTimeoutCounters_::flows_checked, FlowTimeoutCounters_::flows_notimeout, FlowTimeoutCounters_::flows_removed, FlowTimeoutCounters_::flows_timeout, FlowTimeoutCounters_::flows_timeout_inuse, g_detect_disabled, GetFlowBypassInfoID(), FlowCnf_::hash_size, FlowBucket_::head, Flow_::hnext, Flow_::hprev, Flow_::lastts, Flow_::livedev, LiveDevSubBypassStats(), ThreadVars_::name, FlowTimeoutCounters_::new, FlowProtoTimeout_::new_timeout, ThreadVars_::next, next, PacketPoolWaitForN(), Flow_::protomap, FlowTimeoutCounters_::rows_busy, FlowTimeoutCounters_::rows_checked, FlowTimeoutCounters_::rows_empty, FlowTimeoutCounters_::rows_maxlen, FlowTimeoutCounters_::rows_skipped, SC_ATOMIC_ADD, SC_ATOMIC_GET, SC_ATOMIC_SET, SC_ERR_SHUTDOWN, SCCtrlCondSignal, SCLogDebug, SCMutexLock, SCMutexUnlock, SleepMsec, FlowBucket_::tail, FlowTimeoutCounters_::tcp_reuse, thread_name_flow_mgr, THV_KILL, THV_RUNNING_DONE, TmThreadsCheckFlag(), TmThreadsSetFlag(), FlowBypassInfo_::todstbytecnt, FlowBypassInfo_::todstpktcnt, FlowBypassInfo_::tosrcbytecnt, FlowBypassInfo_::tosrcpktcnt, ts, tv_root, tv_root_lock, and TVT_MGMT.

Referenced by PostRunDeinit().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowDisableFlowRecyclerThread ( void )

Used to disable flow recycler thread(s).

Note: this should only be called when the flow manager is already gone

Todo:: Kinda hackish since it uses the tv name to identify flow recycler thread. We need an all weather identification scheme.

Definition at line 1082 of file flow-manager.c.

References FatalError, flow_recycler_ctrl_cond, ThreadVars_::name, ThreadVars_::next, SC_ATOMIC_SET, SC_ERR_SHUTDOWN, SCCtrlCondSignal, SCMutexLock, SCMutexUnlock, SleepMsec, thread_name_flow_rec, THV_KILL, THV_RUNNING_DONE, TmThreadsCheckFlag(), TmThreadsSetFlag(), tv_root, tv_root_lock, and TVT_MGMT.

Referenced by PostRunDeinit().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowManagerThreadSpawn ( void )

spawn the flow manager thread

Definition at line 868 of file flow-manager.c.

References BUG_ON, ConfGetInt(), flow_manager_ctrl_cond, flow_manager_ctrl_mutex, FlowGetMemuse(), SC_ERR_INVALID_ARGUMENTS, SCCtrlCondInit, SCCtrlMutexInit, SCLogError, StatsRegisterGlobalCounter(), thread_name_flow_mgr, TM_ECODE_OK, TM_THREAD_NAME_MAX, TmThreadCreateMgmtThreadByName(), and TmThreadSpawn().

Referenced by RunModeDispatch().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowMgrRegisterTests ( void )

Function to register the Flow Unitests.

Definition at line 1456 of file flow-manager.c.

References UtRegisterTest().

Referenced by FlowRegisterTests().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowRecyclerThreadSpawn ( void )

spawn the flow recycler thread

Definition at line 1029 of file flow-manager.c.

References BUG_ON, ConfGetInt(), flow_recycler_ctrl_cond, flow_recycler_ctrl_mutex, SC_ERR_INVALID_ARGUMENTS, SCCtrlCondInit, SCCtrlMutexInit, SCLogError, thread_name_flow_rec, TM_ECODE_OK, TM_THREAD_NAME_MAX, TmThreadCreateMgmtThreadByName(), and TmThreadSpawn().

Referenced by RunModeDispatch().

Here is the call graph for this function:

Here is the caller graph for this function:

void FlowTimeoutsEmergency ( void )

Definition at line 95 of file flow-manager.c.

References flow_timeouts_emerg, and SC_ATOMIC_SET.

Referenced by FlowSetupPacket().

Here is the caller graph for this function:

void FlowTimeoutsInit ( void )

Definition at line 90 of file flow-manager.c.

References flow_timeouts_normal, and SC_ATOMIC_SET.

Referenced by FlowInitFlowProto().

Here is the caller graph for this function:

SC_ATOMIC_DECLARE	(	uint32_t	,
		flowmgr_cnt
	)

SC_ATOMIC_DECLARE	(	uint32_t	,
		flowrec_cnt
	)

SC_ATOMIC_DECLARE	(	FlowProtoTimeoutPtr	,
		flow_timeouts
	)

SC_ATOMIC_EXTERN	(	unsigned	int,
		flow_flags
	)

void TmModuleFlowManagerRegister ( void )

Definition at line 1157 of file flow-manager.c.

References TmModule_::cap_flags, TmModule_::flags, TmModule_::Management, TmModule_::name, SC_ATOMIC_INIT, SCLogDebug, TmModule_::ThreadDeinit, TmModule_::ThreadInit, TM_FLAG_MANAGEMENT_TM, TMM_FLOWMANAGER, and tmm_modules.

Referenced by RegisterAllModules().

Here is the caller graph for this function:

void TmModuleFlowRecyclerRegister ( void )

Definition at line 1172 of file flow-manager.c.

References TmModule_::cap_flags, TcpSession_::client, Flow_::fb, FBLOCK_DESTROY, FBLOCK_INIT, TmModule_::flags, Flow_::flags, FLOW_CHECK_MEMCAP, flow_config, FLOW_DESTROY, FLOW_EMERGENCY, FLOW_INITIALIZE, FLOW_QUIET, flow_recycle_q, flow_spare_q, FLOW_TIMEOUT_REASSEMBLY_DONE, FlowInitConfig(), FlowQueueDestroy(), FlowQueueInit(), FlowShutdown(), FlowCnf_::hash_size, Flow_::lastts, FlowQueue_::len, TmModule_::Management, TmModule_::name, FlowCnf_::prealloc, Flow_::proto, Flow_::protoctx, SC_ATOMIC_GET, SC_ATOMIC_INIT, SC_ATOMIC_SET, SCLogDebug, TcpStream_::seg_tree, TcpSession_::server, TcpSession_::state, TCP_ESTABLISHED, TCP_SEG_LEN, TCP_SYN_SENT, TmModule_::ThreadDeinit, TmModule_::ThreadInit, TimeGet(), TimeSetIncrementTime(), TM_FLAG_MANAGEMENT_TM, TMM_FLOWRECYCLER, tmm_modules, and UTHBuildPacketOfFlows().

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

int g_detect_disabled

global indicating if detection is enabled

Definition at line 218 of file suricata.c.

Referenced by FlowDisableFlowManagerThread().

int run_mode

Run mode selected

Definition at line 204 of file suricata.c.

src
flow-manager.c
Generated on Tue Jun 18 2019 23:30:28 for suricata by 1.8.11