suricata
flow-manager.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  * \author Victor Julien <victor@inliniac.net>
23  */
24 
25 #include "suricata-common.h"
26 #include "suricata.h"
27 #include "decode.h"
28 #include "conf.h"
29 #include "threadvars.h"
30 #include "tm-threads.h"
31 #include "runmodes.h"
32 
33 #include "util-random.h"
34 #include "util-time.h"
35 
36 #include "flow.h"
37 #include "flow-queue.h"
38 #include "flow-hash.h"
39 #include "flow-util.h"
40 #include "flow-var.h"
41 #include "flow-private.h"
42 #include "flow-timeout.h"
43 #include "flow-manager.h"
44 #include "flow-storage.h"
45 #include "flow-spare-pool.h"
46 
47 #include "stream-tcp-private.h"
48 #include "stream-tcp-reassemble.h"
49 #include "stream-tcp.h"
50 
51 #include "util-unittest.h"
52 #include "util-unittest-helper.h"
53 #include "util-byte.h"
54 
55 #include "util-debug.h"
56 #include "util-privs.h"
57 #include "util-signal.h"
58 
59 #include "threads.h"
60 #include "detect.h"
61 #include "detect-engine-state.h"
62 #include "stream.h"
63 
64 #include "app-layer-parser.h"
65 
66 #include "host-timeout.h"
67 #include "defrag-timeout.h"
68 #include "ippair-timeout.h"
69 #include "app-layer-htp-range.h"
70 
71 #include "output-flow.h"
72 #include "util-validate.h"
73 
74 /* Run mode selected at suricata.c */
75 extern int run_mode;
76 
77 /** queue to pass flows to cleanup/log thread(s) */
79 
80 /* multi flow mananger support */
81 static uint32_t flowmgr_number = 1;
82 /* atomic counter for flow managers, to assign instance id */
83 SC_ATOMIC_DECLARE(uint32_t, flowmgr_cnt);
84 
85 /* multi flow recycler support */
86 static uint32_t flowrec_number = 1;
87 /* atomic counter for flow recyclers, to assign instance id */
88 SC_ATOMIC_DECLARE(uint32_t, flowrec_cnt);
89 SC_ATOMIC_DECLARE(uint32_t, flowrec_busy);
90 SC_ATOMIC_EXTERN(unsigned int, flow_flags);
91 
92 void FlowTimeoutsInit(void)
93 {
94  SC_ATOMIC_SET(flow_timeouts, flow_timeouts_normal);
95 }
96 
98 {
99  SC_ATOMIC_SET(flow_timeouts, flow_timeouts_emerg);
100 }
101 
102 /* 1 seconds */
103 #define FLOW_NORMAL_MODE_UPDATE_DELAY_SEC 1
104 #define FLOW_NORMAL_MODE_UPDATE_DELAY_NSEC 0
105 /* 0.3 seconds */
106 #define FLOW_EMERG_MODE_UPDATE_DELAY_SEC 0
107 #define FLOW_EMERG_MODE_UPDATE_DELAY_NSEC 300000
108 #define NEW_FLOW_COUNT_COND 10
109 
110 typedef struct FlowTimeoutCounters_ {
111  uint32_t new;
112  uint32_t est;
113  uint32_t clo;
114  uint32_t byp;
115 
116  uint32_t rows_checked;
117  uint32_t rows_skipped;
118  uint32_t rows_empty;
119  uint32_t rows_maxlen;
120 
121  uint32_t flows_checked;
122  uint32_t flows_notimeout;
123  uint32_t flows_timeout;
125  uint32_t flows_removed;
126  uint32_t flows_aside;
128 
129  uint32_t bypassed_count;
130  uint64_t bypassed_pkts;
131  uint64_t bypassed_bytes;
133 
134 /**
135  * \brief Used to disable flow manager thread(s).
136  *
137  * \todo Kinda hackish since it uses the tv name to identify flow manager
138  * thread. We need an all weather identification scheme.
139  */
141 {
143  /* flow manager thread(s) is/are a part of mgmt threads */
144  for (ThreadVars *tv = tv_root[TVT_MGMT]; tv != NULL; tv = tv->next) {
145  if (strncasecmp(tv->name, thread_name_flow_mgr,
146  strlen(thread_name_flow_mgr)) == 0)
147  {
149  }
150  }
152 
153  struct timeval start_ts;
154  struct timeval cur_ts;
155  gettimeofday(&start_ts, NULL);
156 
157 again:
158  gettimeofday(&cur_ts, NULL);
159  if ((cur_ts.tv_sec - start_ts.tv_sec) > 60) {
160  FatalError(SC_ERR_SHUTDOWN, "unable to get all flow manager "
161  "threads to shutdown in time");
162  }
163 
165  for (ThreadVars *tv = tv_root[TVT_MGMT]; tv != NULL; tv = tv->next) {
166  if (strncasecmp(tv->name, thread_name_flow_mgr,
167  strlen(thread_name_flow_mgr)) == 0)
168  {
171  /* sleep outside lock */
172  SleepMsec(1);
173  goto again;
174  }
175  }
176  }
178 
179  /* reset count, so we can kill and respawn (unix socket) */
180  SC_ATOMIC_SET(flowmgr_cnt, 0);
181  return;
182 }
183 
184 /** \internal
185  * \brief check if a flow is timed out
186  *
187  * \param f flow
188  * \param ts timestamp
189  *
190  * \retval 0 not timed out
191  * \retval 1 timed out
192  */
193 static int FlowManagerFlowTimeout(Flow *f, struct timeval *ts, int32_t *next_ts, const bool emerg)
194 {
195  int32_t flow_times_out_at = f->timeout_at;
196  if (emerg) {
198  flow_times_out_at -= FlowGetFlowTimeoutDirect(flow_timeouts_delta, f->flow_state, f->protomap);
199  }
200  if (*next_ts == 0 || flow_times_out_at < *next_ts)
201  *next_ts = flow_times_out_at;
202 
203  /* do the timeout check */
204  if (flow_times_out_at >= ts->tv_sec) {
205  return 0;
206  }
207 
208  return 1;
209 }
210 
211 /** \internal
212  * \brief check timeout of captured bypassed flow by querying capture method
213  *
214  * \param f Flow
215  * \param ts timestamp
216  * \param counters Flow timeout counters
217  *
218  * \retval 0 not timeout
219  * \retval 1 timeout (or not capture bypassed)
220  */
221 static inline int FlowBypassedTimeout(Flow *f, struct timeval *ts,
222  FlowTimeoutCounters *counters)
223 {
224 #ifdef CAPTURE_OFFLOAD
225  if (f->flow_state != FLOW_STATE_CAPTURE_BYPASSED) {
226  return 1;
227  }
228 
230  if (fc && fc->BypassUpdate) {
231  /* flow will be possibly updated */
232  uint64_t pkts_tosrc = fc->tosrcpktcnt;
233  uint64_t bytes_tosrc = fc->tosrcbytecnt;
234  uint64_t pkts_todst = fc->todstpktcnt;
235  uint64_t bytes_todst = fc->todstbytecnt;
236  bool update = fc->BypassUpdate(f, fc->bypass_data, ts->tv_sec);
237  if (update) {
238  SCLogDebug("Updated flow: %"PRId64"", FlowGetId(f));
239  pkts_tosrc = fc->tosrcpktcnt - pkts_tosrc;
240  bytes_tosrc = fc->tosrcbytecnt - bytes_tosrc;
241  pkts_todst = fc->todstpktcnt - pkts_todst;
242  bytes_todst = fc->todstbytecnt - bytes_todst;
243  if (f->livedev) {
244  SC_ATOMIC_ADD(f->livedev->bypassed,
245  pkts_tosrc + pkts_todst);
246  }
247  counters->bypassed_pkts += pkts_tosrc + pkts_todst;
248  counters->bypassed_bytes += bytes_tosrc + bytes_todst;
249  return 0;
250  } else {
251  SCLogDebug("No new packet, dead flow %"PRId64"", FlowGetId(f));
252  if (f->livedev) {
253  if (FLOW_IS_IPV4(f)) {
254  LiveDevSubBypassStats(f->livedev, 1, AF_INET);
255  } else if (FLOW_IS_IPV6(f)) {
256  LiveDevSubBypassStats(f->livedev, 1, AF_INET6);
257  }
258  }
259  counters->bypassed_count++;
260  return 1;
261  }
262  }
263 #endif /* CAPTURE_OFFLOAD */
264  return 1;
265 }
266 
267 typedef struct FlowManagerTimeoutThread {
268  /* used to temporarily store flows that have timed out and are
269  * removed from the hash */
272 
273 static uint32_t ProcessAsideQueue(FlowManagerTimeoutThread *td, FlowTimeoutCounters *counters)
274 {
275  FlowQueuePrivate recycle = { NULL, NULL, 0 };
276  counters->flows_aside += td->aside_queue.len;
277 
278  uint32_t cnt = 0;
279  Flow *f;
280  while ((f = FlowQueuePrivateGetFromTop(&td->aside_queue)) != NULL) {
281  /* flow is still locked */
282 
283  if (f->proto == IPPROTO_TCP && !(f->flags & FLOW_TIMEOUT_REASSEMBLY_DONE) &&
284  !FlowIsBypassed(f) && FlowForceReassemblyNeedReassembly(f) == 1) {
285  /* Send the flow to its thread */
287  FLOWLOCK_UNLOCK(f);
288  /* flow ownership is passed to the worker thread */
289 
290  counters->flows_aside_needs_work++;
291  continue;
292  }
293  FLOWLOCK_UNLOCK(f);
294 
295  FlowQueuePrivateAppendFlow(&recycle, f);
296  if (recycle.len == 100) {
298  }
299  cnt++;
300  }
301  if (recycle.len) {
303  }
304  return cnt;
305 }
306 
307 /**
308  * \internal
309  *
310  * \brief check all flows in a hash row for timing out
311  *
312  * \param f last flow in the hash row
313  * \param ts timestamp
314  * \param emergency bool indicating emergency mode
315  * \param counters ptr to FlowTimeoutCounters structure
316  */
317 static void FlowManagerHashRowTimeout(FlowManagerTimeoutThread *td,
318  Flow *f, struct timeval *ts,
319  int emergency, FlowTimeoutCounters *counters, int32_t *next_ts)
320 {
321  uint32_t checked = 0;
322  Flow *prev_f = NULL;
323 
324  do {
325  checked++;
326 
327  /* check flow timeout based on lastts and state. Both can be
328  * accessed w/o Flow lock as we do have the hash row lock (so flow
329  * can't disappear) and flow_state is atomic. lastts can only
330  * be modified when we have both the flow and hash row lock */
331 
332  /* timeout logic goes here */
333  if (FlowManagerFlowTimeout(f, ts, next_ts, emergency) == 0) {
334 
335  counters->flows_notimeout++;
336 
337  prev_f = f;
338  f = f->next;
339  continue;
340  }
341 
342  FLOWLOCK_WRLOCK(f);
343 
344  Flow *next_flow = f->next;
345 
346  /* never prune a flow that is used by a packet we
347  * are currently processing in one of the threads */
348  if (f->use_cnt > 0 || !FlowBypassedTimeout(f, ts, counters)) {
349  FLOWLOCK_UNLOCK(f);
350  prev_f = f;
351  if (f->use_cnt > 0) {
352  counters->flows_timeout_inuse++;
353  }
354  f = f->next;
355  continue;
356  }
357 
359 
360  counters->flows_timeout++;
361 
362  RemoveFromHash(f, prev_f);
363 
365  /* flow is still locked in the queue */
366 
367  f = next_flow;
368  } while (f != NULL);
369 
370  counters->flows_checked += checked;
371  if (checked > counters->rows_maxlen)
372  counters->rows_maxlen = checked;
373 }
374 
375 static void FlowManagerHashRowClearEvictedList(FlowManagerTimeoutThread *td,
376  Flow *f, struct timeval *ts, FlowTimeoutCounters *counters)
377 {
378  do {
379  FLOWLOCK_WRLOCK(f);
380  Flow *next_flow = f->next;
381  f->next = NULL;
382  f->fb = NULL;
383 
385 
387  /* flow is still locked in the queue */
388 
389  f = next_flow;
390  } while (f != NULL);
391 }
392 
393 /**
394  * \brief time out flows from the hash
395  *
396  * \param ts timestamp
397  * \param hash_min min hash index to consider
398  * \param hash_max max hash index to consider
399  * \param counters ptr to FlowTimeoutCounters structure
400  *
401  * \retval cnt number of timed out flow
402  */
403 static uint32_t FlowTimeoutHash(FlowManagerTimeoutThread *td,
404  struct timeval *ts,
405  const uint32_t hash_min, const uint32_t hash_max,
406  FlowTimeoutCounters *counters)
407 {
408  uint32_t cnt = 0;
409  const int emergency = ((SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY));
410  const uint32_t rows_checked = hash_max - hash_min;
411  uint32_t rows_skipped = 0;
412  uint32_t rows_empty = 0;
413 
414 #if __WORDSIZE==64
415 #define BITS 64
416 #define TYPE uint64_t
417 #else
418 #define BITS 32
419 #define TYPE uint32_t
420 #endif
421 
422  for (uint32_t idx = hash_min; idx < hash_max; idx+=BITS) {
423  TYPE check_bits = 0;
424  const uint32_t check = MIN(BITS, (hash_max - idx));
425  for (uint32_t i = 0; i < check; i++) {
426  FlowBucket *fb = &flow_hash[idx+i];
427  check_bits |= (TYPE)(SC_ATOMIC_LOAD_EXPLICIT(fb->next_ts, SC_ATOMIC_MEMORY_ORDER_RELAXED) <= (int32_t)ts->tv_sec) << (TYPE)i;
428  }
429  if (check_bits == 0)
430  continue;
431 
432  for (uint32_t i = 0; i < check; i++) {
433  FlowBucket *fb = &flow_hash[idx+i];
434  if ((check_bits & ((TYPE)1 << (TYPE)i)) != 0 && SC_ATOMIC_GET(fb->next_ts) <= (int32_t)ts->tv_sec) {
435  FBLOCK_LOCK(fb);
436  Flow *evicted = NULL;
437  if (fb->evicted != NULL || fb->head != NULL) {
438  if (fb->evicted != NULL) {
439  /* transfer out of bucket so we can do additional work outside
440  * of the bucket lock */
441  evicted = fb->evicted;
442  fb->evicted = NULL;
443  }
444  if (fb->head != NULL) {
445  int32_t next_ts = 0;
446  FlowManagerHashRowTimeout(td, fb->head, ts, emergency, counters, &next_ts);
447 
448  if (SC_ATOMIC_GET(fb->next_ts) != next_ts)
449  SC_ATOMIC_SET(fb->next_ts, next_ts);
450  }
451  if (fb->evicted == NULL && fb->head == NULL) {
452  SC_ATOMIC_SET(fb->next_ts, INT_MAX);
453  }
454  } else {
455  SC_ATOMIC_SET(fb->next_ts, INT_MAX);
456  rows_empty++;
457  }
458  FBLOCK_UNLOCK(fb);
459  /* processed evicted list */
460  if (evicted) {
461  FlowManagerHashRowClearEvictedList(td, evicted, ts, counters);
462  }
463  } else {
464  rows_skipped++;
465  }
466  }
467  if (td->aside_queue.len) {
468  cnt += ProcessAsideQueue(td, counters);
469  }
470  }
471 
472  counters->rows_checked += rows_checked;
473  counters->rows_skipped += rows_skipped;
474  counters->rows_empty += rows_empty;
475 
476  if (td->aside_queue.len) {
477  cnt += ProcessAsideQueue(td, counters);
478  }
479  counters->flows_removed += cnt;
480  /* coverity[missing_unlock : FALSE] */
481  return cnt;
482 }
483 
484 static uint32_t FlowTimeoutHashInChunks(FlowManagerTimeoutThread *td,
485  struct timeval *ts,
486  const uint32_t hash_min, const uint32_t hash_max,
487  FlowTimeoutCounters *counters, uint32_t iter, const uint32_t chunks)
488 {
489  const uint32_t rows = hash_max - hash_min;
490  const uint32_t chunk_size = rows / chunks;
491 
492  const uint32_t min = iter * chunk_size + hash_min;
493  uint32_t max = min + chunk_size;
494  /* we start at beginning of hash at next iteration so let's check
495  * hash till the end */
496  if (iter + 1 == chunks) {
497  max = hash_max;
498  }
499  const uint32_t cnt = FlowTimeoutHash(td, ts, min, max, counters);
500  return cnt;
501 }
502 
503 /**
504  * \internal
505  *
506  * \brief move all flows out of a hash row
507  *
508  * \param f last flow in the hash row
509  *
510  * \retval cnt removed out flows
511  */
512 static uint32_t FlowManagerHashRowCleanup(Flow *f, FlowQueuePrivate *recycle_q, const int mode)
513 {
514  uint32_t cnt = 0;
515 
516  do {
517  FLOWLOCK_WRLOCK(f);
518 
519  Flow *next_flow = f->next;
520 
521  /* remove from the hash */
522  if (mode == 0) {
523  RemoveFromHash(f, NULL);
524  } else {
525  FlowBucket *fb = f->fb;
526  fb->evicted = f->next;
527  f->next = NULL;
528  f->fb = NULL;
529  }
531 
532  /* no one is referring to this flow, use_cnt 0, removed from hash
533  * so we can unlock it and move it to the recycle queue. */
534  FLOWLOCK_UNLOCK(f);
535  FlowQueuePrivateAppendFlow(recycle_q, f);
536 
537  cnt++;
538 
539  f = next_flow;
540  } while (f != NULL);
541 
542  return cnt;
543 }
544 
545 /**
546  * \brief remove all flows from the hash
547  *
548  * \retval cnt number of removes out flows
549  */
550 static uint32_t FlowCleanupHash(void)
551 {
552  FlowQueuePrivate local_queue = { NULL, NULL, 0 };
553  uint32_t cnt = 0;
554 
555  for (uint32_t idx = 0; idx < flow_config.hash_size; idx++) {
556  FlowBucket *fb = &flow_hash[idx];
557 
558  FBLOCK_LOCK(fb);
559 
560  if (fb->head != NULL) {
561  /* we have a flow, or more than one */
562  cnt += FlowManagerHashRowCleanup(fb->head, &local_queue, 0);
563  }
564  if (fb->evicted != NULL) {
565  /* we have a flow, or more than one */
566  cnt += FlowManagerHashRowCleanup(fb->evicted, &local_queue, 1);
567  }
568 
569  FBLOCK_UNLOCK(fb);
570  if (local_queue.len >= 25) {
571  FlowQueueAppendPrivate(&flow_recycle_q, &local_queue);
572  }
573  }
574  FlowQueueAppendPrivate(&flow_recycle_q, &local_queue);
575 
576  return cnt;
577 }
578 
579 static void Recycler(ThreadVars *tv, void *output_thread_data, Flow *f)
580 {
581  FLOWLOCK_WRLOCK(f);
582 
583  (void)OutputFlowLog(tv, output_thread_data, f);
584 
585  FlowClearMemory (f, f->protomap);
586  FLOWLOCK_UNLOCK(f);
588 }
589 
590 typedef struct FlowQueueTimeoutCounters {
591  uint32_t flows_removed;
592  uint32_t flows_timeout;
594 
595 typedef struct FlowCounters_ {
601  uint16_t flow_mgr_spare;
604 
611 
613 
618 
619 typedef struct FlowManagerThreadData_ {
620  uint32_t instance;
621  uint32_t min;
622  uint32_t max;
623 
625 
628 
629 static void FlowCountersInit(ThreadVars *t, FlowCounters *fc)
630 {
631  fc->flow_mgr_full_pass = StatsRegisterCounter("flow.mgr.full_hash_pass", t);
632  fc->flow_mgr_cnt_clo = StatsRegisterCounter("flow.mgr.closed_pruned", t);
633  fc->flow_mgr_cnt_new = StatsRegisterCounter("flow.mgr.new_pruned", t);
634  fc->flow_mgr_cnt_est = StatsRegisterCounter("flow.mgr.est_pruned", t);
635  fc->flow_mgr_cnt_byp = StatsRegisterCounter("flow.mgr.bypassed_pruned", t);
636  fc->flow_mgr_spare = StatsRegisterCounter("flow.spare", t);
637  fc->flow_emerg_mode_enter = StatsRegisterCounter("flow.emerg_mode_entered", t);
638  fc->flow_emerg_mode_over = StatsRegisterCounter("flow.emerg_mode_over", t);
639 
640  fc->flow_mgr_rows_maxlen = StatsRegisterMaxCounter("flow.mgr.rows_maxlen", t);
641  fc->flow_mgr_flows_checked = StatsRegisterCounter("flow.mgr.flows_checked", t);
642  fc->flow_mgr_flows_notimeout = StatsRegisterCounter("flow.mgr.flows_notimeout", t);
643  fc->flow_mgr_flows_timeout = StatsRegisterCounter("flow.mgr.flows_timeout", t);
644  fc->flow_mgr_flows_timeout_inuse = StatsRegisterCounter("flow.mgr.flows_timeout_inuse", t);
645  fc->flow_mgr_flows_aside = StatsRegisterCounter("flow.mgr.flows_evicted", t);
646  fc->flow_mgr_flows_aside_needs_work = StatsRegisterCounter("flow.mgr.flows_evicted_needs_work", t);
647 
648  fc->flow_bypassed_cnt_clo = StatsRegisterCounter("flow_bypassed.closed", t);
649  fc->flow_bypassed_pkts = StatsRegisterCounter("flow_bypassed.pkts", t);
650  fc->flow_bypassed_bytes = StatsRegisterCounter("flow_bypassed.bytes", t);
651 }
652 
653 static TmEcode FlowManagerThreadInit(ThreadVars *t, const void *initdata, void **data)
654 {
656  if (ftd == NULL)
657  return TM_ECODE_FAILED;
658 
659  ftd->instance = SC_ATOMIC_ADD(flowmgr_cnt, 1);
660  SCLogDebug("flow manager instance %u", ftd->instance);
661 
662  /* set the min and max value used for hash row walking
663  * each thread has it's own section of the flow hash */
664  uint32_t range = flow_config.hash_size / flowmgr_number;
665 
666  ftd->min = ftd->instance * range;
667  ftd->max = (ftd->instance + 1) * range;
668 
669  /* last flow-manager takes on hash_size % flowmgr_number extra rows */
670  if ((ftd->instance + 1) == flowmgr_number) {
671  ftd->max = flow_config.hash_size;
672  }
674 
675  SCLogDebug("instance %u hash range %u %u", ftd->instance, ftd->min, ftd->max);
676 
677  /* pass thread data back to caller */
678  *data = ftd;
679 
680  FlowCountersInit(t, &ftd->cnt);
681 
682  PacketPoolInit();
683  return TM_ECODE_OK;
684 }
685 
686 static TmEcode FlowManagerThreadDeinit(ThreadVars *t, void *data)
687 {
689  SCFree(data);
690  return TM_ECODE_OK;
691 }
692 
693 static uint32_t FlowTimeoutsMin(void)
694 {
695  FlowProtoTimeoutPtr t = SC_ATOMIC_GET(flow_timeouts);
696  uint32_t m = -1;
697  for (unsigned int i = 0; i < FLOW_PROTO_MAX; i++) {
698  m = MIN(m, t[i].new_timeout);
699  m = MIN(m, t[i].est_timeout);
700 
701  if (i == FLOW_PROTO_TCP) {
702  m = MIN(m, t[i].closed_timeout);
703  }
704  if (i == FLOW_PROTO_TCP || i == FLOW_PROTO_UDP) {
705  m = MIN(m, t[i].bypassed_timeout);
706  }
707  }
708  return m;
709 }
710 
711 //#define FM_PROFILE
712 
713 /** \brief Thread that manages the flow table and times out flows.
714  *
715  * \param td ThreadVars casted to void ptr
716  *
717  * Keeps an eye on the spare list, alloc flows if needed...
718  */
719 static TmEcode FlowManager(ThreadVars *th_v, void *thread_data)
720 {
721  FlowManagerThreadData *ftd = thread_data;
722  struct timeval ts;
723  uint32_t established_cnt = 0, new_cnt = 0, closing_cnt = 0;
724  bool emerg = false;
725  bool prev_emerg = false;
726  uint32_t other_last_sec = 0; /**< last sec stamp when defrag etc ran */
727  uint32_t flow_last_sec = 0;
728 /* VJ leaving disabled for now, as hosts are only used by tags and the numbers
729  * are really low. Might confuse ppl
730  uint16_t flow_mgr_host_prune = StatsRegisterCounter("hosts.pruned", th_v);
731  uint16_t flow_mgr_host_active = StatsRegisterCounter("hosts.active", th_v);
732  uint16_t flow_mgr_host_spare = StatsRegisterCounter("hosts.spare", th_v);
733 */
734  memset(&ts, 0, sizeof(ts));
735  uint32_t hash_passes = 0;
736 #ifdef FM_PROFILE
737  uint32_t hash_row_checks = 0;
738  uint32_t hash_passes_chunks = 0;
739 #endif
740  uint32_t hash_full_passes = 0;
741 
742  const uint32_t min_timeout = FlowTimeoutsMin();
743  const uint32_t pass_in_sec = min_timeout ? min_timeout * 8 : 60;
744 
745  /* don't start our activities until time is setup */
746  while (!TimeModeIsReady()) {
747  if (suricata_ctl_flags != 0)
748  return TM_ECODE_OK;
749  }
750 
751  SCLogDebug("FM %s/%d starting. min_timeout %us. Full hash pass in %us", th_v->name,
752  ftd->instance, min_timeout, pass_in_sec);
753 
754 #ifdef FM_PROFILE
755  struct timeval endts;
756  struct timeval active;
757  struct timeval paused;
758  struct timeval sleeping;
759  memset(&endts, 0, sizeof(endts));
760  memset(&active, 0, sizeof(active));
761  memset(&paused, 0, sizeof(paused));
762  memset(&sleeping, 0, sizeof(sleeping));
763 #endif
764 
765  struct timeval startts;
766  memset(&startts, 0, sizeof(startts));
767  gettimeofday(&startts, NULL);
768 
769  uint32_t hash_pass_iter = 0;
770  uint32_t emerg_over_cnt = 0;
771  uint64_t next_run_ms = 0;
772 
773  while (1)
774  {
775  if (TmThreadsCheckFlag(th_v, THV_PAUSE)) {
777 #ifdef FM_PROFILE
778  struct timeval pause_startts;
779  memset(&pause_startts, 0, sizeof(pause_startts));
780  gettimeofday(&pause_startts, NULL);
781 #endif
783 #ifdef FM_PROFILE
784  struct timeval pause_endts;
785  memset(&pause_endts, 0, sizeof(pause_endts));
786  gettimeofday(&pause_endts, NULL);
787  struct timeval pause_time;
788  memset(&pause_time, 0, sizeof(pause_time));
789  timersub(&pause_endts, &pause_startts, &pause_time);
790  timeradd(&paused, &pause_time, &paused);
791 #endif
793  }
794 
795  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) {
796  emerg = true;
797  }
798 #ifdef FM_PROFILE
799  struct timeval run_startts;
800  memset(&run_startts, 0, sizeof(run_startts));
801  gettimeofday(&run_startts, NULL);
802 #endif
803  /* Get the time */
804  memset(&ts, 0, sizeof(ts));
805  TimeGet(&ts);
806  SCLogDebug("ts %" PRIdMAX "", (intmax_t)ts.tv_sec);
807  const uint64_t ts_ms = ts.tv_sec * 1000 + ts.tv_usec / 1000;
808  const uint32_t rt = (uint32_t)ts.tv_sec;
809  const bool emerge_p = (emerg && !prev_emerg);
810  if (emerge_p) {
811  next_run_ms = 0;
812  prev_emerg = true;
813  SCLogNotice("Flow emergency mode entered...");
814  StatsIncr(th_v, ftd->cnt.flow_emerg_mode_enter);
815  }
816  if (ts_ms >= next_run_ms) {
817  if (ftd->instance == 0) {
818  const uint32_t sq_len = FlowSpareGetPoolSize();
819  const uint32_t spare_perc = sq_len * 100 / flow_config.prealloc;
820  /* see if we still have enough spare flows */
821  if (spare_perc < 90 || spare_perc > 110) {
822  FlowSparePoolUpdate(sq_len);
823  }
824  }
825  const uint32_t secs_passed = rt - flow_last_sec;
826 
827  /* try to time out flows */
828  FlowTimeoutCounters counters = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
829 
830  if (emerg) {
831  /* in emergency mode, do a full pass of the hash table */
832  FlowTimeoutHash(&ftd->timeout, &ts, ftd->min, ftd->max, &counters);
833  hash_passes++;
834  hash_full_passes++;
835  hash_passes++;
836 #ifdef FM_PROFILE
837  hash_passes_chunks += 1;
838  hash_row_checks += counters.rows_checked;
839 #endif
840  StatsIncr(th_v, ftd->cnt.flow_mgr_full_pass);
841  } else {
842  /* non-emergency mode: scan part of the hash */
843  const uint32_t chunks = MIN(secs_passed, pass_in_sec);
844  for (uint32_t i = 0; i < chunks; i++) {
845  FlowTimeoutHashInChunks(&ftd->timeout, &ts, ftd->min, ftd->max,
846  &counters, hash_pass_iter, pass_in_sec);
847  hash_pass_iter++;
848  if (hash_pass_iter == pass_in_sec) {
849  hash_pass_iter = 0;
850  hash_full_passes++;
851  StatsIncr(th_v, ftd->cnt.flow_mgr_full_pass);
852  }
853  }
854  hash_passes++;
855 #ifdef FM_PROFILE
856  hash_row_checks += counters.rows_checked;
857  hash_passes_chunks += chunks;
858 #endif
859  }
860  flow_last_sec = rt;
861 
862  /*
863  StatsAddUI64(th_v, flow_mgr_host_prune, (uint64_t)hosts_pruned);
864  uint32_t hosts_active = HostGetActiveCount();
865  StatsSetUI64(th_v, flow_mgr_host_active, (uint64_t)hosts_active);
866  uint32_t hosts_spare = HostGetSpareCount();
867  StatsSetUI64(th_v, flow_mgr_host_spare, (uint64_t)hosts_spare);
868  */
869  StatsAddUI64(th_v, ftd->cnt.flow_mgr_cnt_clo, (uint64_t)counters.clo);
870  StatsAddUI64(th_v, ftd->cnt.flow_mgr_cnt_new, (uint64_t)counters.new);
871  StatsAddUI64(th_v, ftd->cnt.flow_mgr_cnt_est, (uint64_t)counters.est);
872  StatsAddUI64(th_v, ftd->cnt.flow_mgr_cnt_byp, (uint64_t)counters.byp);
873 
874  StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_checked, (uint64_t)counters.flows_checked);
875  StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_notimeout, (uint64_t)counters.flows_notimeout);
876 
877  StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_timeout, (uint64_t)counters.flows_timeout);
878  //StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_removed, (uint64_t)counters.flows_removed);
879  StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_timeout_inuse, (uint64_t)counters.flows_timeout_inuse);
880  StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_aside, (uint64_t)counters.flows_aside);
882 
883  StatsAddUI64(th_v, ftd->cnt.flow_bypassed_cnt_clo, (uint64_t)counters.bypassed_count);
884  StatsAddUI64(th_v, ftd->cnt.flow_bypassed_pkts, (uint64_t)counters.bypassed_pkts);
885  StatsAddUI64(th_v, ftd->cnt.flow_bypassed_bytes, (uint64_t)counters.bypassed_bytes);
886 
887  StatsSetUI64(th_v, ftd->cnt.flow_mgr_rows_maxlen, (uint64_t)counters.rows_maxlen);
888  // TODO AVG MAXLEN
889  // TODO LOOKUP STEPS MAXLEN and AVG LEN
890  /* Don't fear, FlowManagerThread is here...
891  * clear emergency bit if we have at least xx flows pruned. */
892  uint32_t len = FlowSpareGetPoolSize();
893  StatsSetUI64(th_v, ftd->cnt.flow_mgr_spare, (uint64_t)len);
894  if (emerg == true) {
895  SCLogDebug("flow_sparse_q.len = %"PRIu32" prealloc: %"PRIu32
896  "flow_spare_q status: %"PRIu32"%% flows at the queue",
898 
899  /* only if we have pruned this "emergency_recovery" percentage
900  * of flows, we will unset the emergency bit */
902  emerg_over_cnt++;
903  } else {
904  emerg_over_cnt = 0;
905  }
906 
907  if (emerg_over_cnt >= 30) {
908  SC_ATOMIC_AND(flow_flags, ~FLOW_EMERGENCY);
910 
911  emerg = false;
912  prev_emerg = false;
913  emerg_over_cnt = 0;
914  hash_pass_iter = 0;
915  SCLogNotice("Flow emergency mode over, back to normal... unsetting"
916  " FLOW_EMERGENCY bit (ts.tv_sec: %"PRIuMAX", "
917  "ts.tv_usec:%"PRIuMAX") flow_spare_q status(): %"PRIu32
918  "%% flows at the queue", (uintmax_t)ts.tv_sec,
919  (uintmax_t)ts.tv_usec, len * 100 / flow_config.prealloc);
920 
921  StatsIncr(th_v, ftd->cnt.flow_emerg_mode_over);
922  }
923  }
924  next_run_ms = ts_ms + 667;
925  if (emerg)
926  next_run_ms = ts_ms + 250;
927  }
928  if (flow_last_sec == 0) {
929  flow_last_sec = rt;
930  }
931 
932  if (ftd->instance == 0 &&
933  (other_last_sec == 0 || other_last_sec < (uint32_t)ts.tv_sec)) {
935  //uint32_t hosts_pruned =
939  other_last_sec = (uint32_t)ts.tv_sec;
940  }
941 
942 
943 #ifdef FM_PROFILE
944  struct timeval run_endts;
945  memset(&run_endts, 0, sizeof(run_endts));
946  gettimeofday(&run_endts, NULL);
947  struct timeval run_time;
948  memset(&run_time, 0, sizeof(run_time));
949  timersub(&run_endts, &run_startts, &run_time);
950  timeradd(&active, &run_time, &active);
951 #endif
952 
953  if (TmThreadsCheckFlag(th_v, THV_KILL)) {
954  StatsSyncCounters(th_v);
955  break;
956  }
957 
958 #ifdef FM_PROFILE
959  struct timeval sleep_startts;
960  memset(&sleep_startts, 0, sizeof(sleep_startts));
961  gettimeofday(&sleep_startts, NULL);
962 #endif
963  usleep(250);
964 
965 #ifdef FM_PROFILE
966  struct timeval sleep_endts;
967  memset(&sleep_endts, 0, sizeof(sleep_endts));
968  gettimeofday(&sleep_endts, NULL);
969 
970  struct timeval sleep_time;
971  memset(&sleep_time, 0, sizeof(sleep_time));
972  timersub(&sleep_endts, &sleep_startts, &sleep_time);
973  timeradd(&sleeping, &sleep_time, &sleeping);
974 #endif
975  SCLogDebug("woke up... %s", SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY ? "emergency":"");
976 
978  }
979  SCLogPerf("%" PRIu32 " new flows, %" PRIu32 " established flows were "
980  "timed out, %"PRIu32" flows in closed state", new_cnt,
981  established_cnt, closing_cnt);
982 
983 #ifdef FM_PROFILE
984  SCLogNotice("hash passes %u avg chunks %u full %u rows %u (rows/s %u)",
985  hash_passes, hash_passes_chunks / (hash_passes ? hash_passes : 1),
986  hash_full_passes, hash_row_checks,
987  hash_row_checks / ((uint32_t)active.tv_sec?(uint32_t)active.tv_sec:1));
988 
989  gettimeofday(&endts, NULL);
990  struct timeval total_run_time;
991  timersub(&endts, &startts, &total_run_time);
992 
993  SCLogNotice("FM: active %u.%us out of %u.%us; sleeping %u.%us, paused %u.%us",
994  (uint32_t)active.tv_sec, (uint32_t)active.tv_usec,
995  (uint32_t)total_run_time.tv_sec, (uint32_t)total_run_time.tv_usec,
996  (uint32_t)sleeping.tv_sec, (uint32_t)sleeping.tv_usec,
997  (uint32_t)paused.tv_sec, (uint32_t)paused.tv_usec);
998 #endif
999  return TM_ECODE_OK;
1000 }
1001 
1002 /** \brief spawn the flow manager thread */
1004 {
1005  intmax_t setting = 1;
1006  (void)ConfGetInt("flow.managers", &setting);
1007 
1008  if (setting < 1 || setting > 1024) {
1010  "invalid flow.managers setting %"PRIdMAX, setting);
1011  }
1012  flowmgr_number = (uint32_t)setting;
1013 
1014  SCLogConfig("using %u flow manager threads", flowmgr_number);
1015  StatsRegisterGlobalCounter("flow.memuse", FlowGetMemuse);
1016 
1017  for (uint32_t u = 0; u < flowmgr_number; u++) {
1018  char name[TM_THREAD_NAME_MAX];
1019  snprintf(name, sizeof(name), "%s#%02u", thread_name_flow_mgr, u+1);
1020 
1021  ThreadVars *tv_flowmgr = TmThreadCreateMgmtThreadByName(name,
1022  "FlowManager", 0);
1023  BUG_ON(tv_flowmgr == NULL);
1024 
1025  if (tv_flowmgr == NULL) {
1026  FatalError(SC_ERR_FATAL, "flow manager thread creation failed");
1027  }
1028  if (TmThreadSpawn(tv_flowmgr) != TM_ECODE_OK) {
1029  FatalError(SC_ERR_FATAL, "flow manager thread spawn failed");
1030  }
1031  }
1032  return;
1033 }
1034 
1035 typedef struct FlowRecyclerThreadData_ {
1038 
1039 static TmEcode FlowRecyclerThreadInit(ThreadVars *t, const void *initdata, void **data)
1040 {
1042  if (ftd == NULL)
1043  return TM_ECODE_FAILED;
1044  if (OutputFlowLogThreadInit(t, NULL, &ftd->output_thread_data) != TM_ECODE_OK) {
1045  SCLogError(SC_ERR_THREAD_INIT, "initializing flow log API for thread failed");
1046  SCFree(ftd);
1047  return TM_ECODE_FAILED;
1048  }
1049  SCLogDebug("output_thread_data %p", ftd->output_thread_data);
1050 
1051  *data = ftd;
1052  return TM_ECODE_OK;
1053 }
1054 
1055 static TmEcode FlowRecyclerThreadDeinit(ThreadVars *t, void *data)
1056 {
1058  if (ftd->output_thread_data != NULL)
1060 
1061  SCFree(data);
1062  return TM_ECODE_OK;
1063 }
1064 
1065 /** \brief Thread that manages timed out flows.
1066  *
1067  * \param td ThreadVars casted to void ptr
1068  */
1069 static TmEcode FlowRecycler(ThreadVars *th_v, void *thread_data)
1070 {
1071  struct timeval ts;
1072  uint64_t recycled_cnt = 0;
1073  FlowRecyclerThreadData *ftd = (FlowRecyclerThreadData *)thread_data;
1074  BUG_ON(ftd == NULL);
1075 
1076  memset(&ts, 0, sizeof(ts));
1077  uint32_t fr_passes = 0;
1078 
1079 #ifdef FM_PROFILE
1080  struct timeval endts;
1081  struct timeval active;
1082  struct timeval paused;
1083  struct timeval sleeping;
1084  memset(&endts, 0, sizeof(endts));
1085  memset(&active, 0, sizeof(active));
1086  memset(&paused, 0, sizeof(paused));
1087  memset(&sleeping, 0, sizeof(sleeping));
1088 #endif
1089  struct timeval startts;
1090  memset(&startts, 0, sizeof(startts));
1091  gettimeofday(&startts, NULL);
1092 
1093  while (1)
1094  {
1095  if (TmThreadsCheckFlag(th_v, THV_PAUSE)) {
1097 #ifdef FM_PROFILE
1098  struct timeval pause_startts;
1099  memset(&pause_startts, 0, sizeof(pause_startts));
1100  gettimeofday(&pause_startts, NULL);
1101 #endif
1103 
1104 #ifdef FM_PROFILE
1105  struct timeval pause_endts;
1106  memset(&pause_endts, 0, sizeof(pause_endts));
1107  gettimeofday(&pause_endts, NULL);
1108 
1109  struct timeval pause_time;
1110  memset(&pause_time, 0, sizeof(pause_time));
1111  timersub(&pause_endts, &pause_startts, &pause_time);
1112  timeradd(&paused, &pause_time, &paused);
1113 #endif
1115  }
1116  fr_passes++;
1117 #ifdef FM_PROFILE
1118  struct timeval run_startts;
1119  memset(&run_startts, 0, sizeof(run_startts));
1120  gettimeofday(&run_startts, NULL);
1121 #endif
1122  SC_ATOMIC_ADD(flowrec_busy,1);
1124 
1125  const int bail = (TmThreadsCheckFlag(th_v, THV_KILL));
1126 
1127  /* Get the time */
1128  memset(&ts, 0, sizeof(ts));
1129  TimeGet(&ts);
1130  SCLogDebug("ts %" PRIdMAX "", (intmax_t)ts.tv_sec);
1131 
1132  Flow *f;
1133  while ((f = FlowQueuePrivateGetFromTop(&list)) != NULL) {
1134  Recycler(th_v, ftd->output_thread_data, f);
1135  recycled_cnt++;
1136  }
1137  SC_ATOMIC_SUB(flowrec_busy,1);
1138 
1139 #ifdef FM_PROFILE
1140  struct timeval run_endts;
1141  memset(&run_endts, 0, sizeof(run_endts));
1142  gettimeofday(&run_endts, NULL);
1143 
1144  struct timeval run_time;
1145  memset(&run_time, 0, sizeof(run_time));
1146  timersub(&run_endts, &run_startts, &run_time);
1147  timeradd(&active, &run_time, &active);
1148 #endif
1149 
1150  if (bail) {
1151  break;
1152  }
1153 
1154 #ifdef FM_PROFILE
1155  struct timeval sleep_startts;
1156  memset(&sleep_startts, 0, sizeof(sleep_startts));
1157  gettimeofday(&sleep_startts, NULL);
1158 #endif
1159  usleep(250);
1160 #ifdef FM_PROFILE
1161  struct timeval sleep_endts;
1162  memset(&sleep_endts, 0, sizeof(sleep_endts));
1163  gettimeofday(&sleep_endts, NULL);
1164  struct timeval sleep_time;
1165  memset(&sleep_time, 0, sizeof(sleep_time));
1166  timersub(&sleep_endts, &sleep_startts, &sleep_time);
1167  timeradd(&sleeping, &sleep_time, &sleeping);
1168 #endif
1169 
1170  SCLogDebug("woke up...");
1171 
1173  }
1174  StatsSyncCounters(th_v);
1175 #ifdef FM_PROFILE
1176  gettimeofday(&endts, NULL);
1177  struct timeval total_run_time;
1178  timersub(&endts, &startts, &total_run_time);
1179  SCLogNotice("FR: active %u.%us out of %u.%us; sleeping %u.%us, paused %u.%us",
1180  (uint32_t)active.tv_sec, (uint32_t)active.tv_usec,
1181  (uint32_t)total_run_time.tv_sec, (uint32_t)total_run_time.tv_usec,
1182  (uint32_t)sleeping.tv_sec, (uint32_t)sleeping.tv_usec,
1183  (uint32_t)paused.tv_sec, (uint32_t)paused.tv_usec);
1184 
1185  SCLogNotice("FR passes %u passes/s %u", fr_passes,
1186  (uint32_t)fr_passes/((uint32_t)active.tv_sec?(uint32_t)active.tv_sec:1));
1187 #endif
1188  SCLogPerf("%"PRIu64" flows processed", recycled_cnt);
1189  return TM_ECODE_OK;
1190 }
1191 
1192 static bool FlowRecyclerReadyToShutdown(void)
1193 {
1194  if (SC_ATOMIC_GET(flowrec_busy) != 0) {
1195  return false;
1196  }
1197  uint32_t len = 0;
1199  len = flow_recycle_q.qlen;
1201 
1202  return ((len == 0));
1203 }
1204 
1205 /** \brief spawn the flow recycler thread */
1207 {
1208  intmax_t setting = 1;
1209  (void)ConfGetInt("flow.recyclers", &setting);
1210 
1211  if (setting < 1 || setting > 1024) {
1213  "invalid flow.recyclers setting %"PRIdMAX, setting);
1214  }
1215  flowrec_number = (uint32_t)setting;
1216 
1217  SCLogConfig("using %u flow recycler threads", flowrec_number);
1218 
1219  for (uint32_t u = 0; u < flowrec_number; u++) {
1220  char name[TM_THREAD_NAME_MAX];
1221  snprintf(name, sizeof(name), "%s#%02u", thread_name_flow_rec, u+1);
1222 
1223  ThreadVars *tv_flowrec = TmThreadCreateMgmtThreadByName(name,
1224  "FlowRecycler", 0);
1225 
1226  if (tv_flowrec == NULL) {
1227  FatalError(SC_ERR_FATAL, "flow recycler thread creation failed");
1228  }
1229  if (TmThreadSpawn(tv_flowrec) != TM_ECODE_OK) {
1230  FatalError(SC_ERR_FATAL, "flow recycler thread spawn failed");
1231  }
1232  }
1233  return;
1234 }
1235 
1236 /**
1237  * \brief Used to disable flow recycler thread(s).
1238  *
1239  * \note this should only be called when the flow manager is already gone
1240  *
1241  * \todo Kinda hackish since it uses the tv name to identify flow recycler
1242  * thread. We need an all weather identification scheme.
1243  */
1245 {
1246  int cnt = 0;
1247 
1248  /* move all flows still in the hash to the recycler queue */
1249 #ifndef DEBUG
1250  (void)FlowCleanupHash();
1251 #else
1252  uint32_t flows = FlowCleanupHash();
1253  SCLogDebug("flows to progress: %u", flows);
1254 #endif
1255 
1256  /* make sure all flows are processed */
1257  do {
1258  usleep(10);
1259  } while (FlowRecyclerReadyToShutdown() == false);
1260 
1262  /* flow recycler thread(s) is/are a part of mgmt threads */
1263  for (ThreadVars *tv = tv_root[TVT_MGMT]; tv != NULL; tv = tv->next) {
1264  if (strncasecmp(tv->name, thread_name_flow_rec,
1265  strlen(thread_name_flow_rec)) == 0)
1266  {
1268  cnt++;
1269  }
1270  }
1272 
1273  struct timeval start_ts;
1274  struct timeval cur_ts;
1275  gettimeofday(&start_ts, NULL);
1276 
1277 again:
1278  gettimeofday(&cur_ts, NULL);
1279  if ((cur_ts.tv_sec - start_ts.tv_sec) > 60) {
1280  FatalError(SC_ERR_SHUTDOWN, "unable to get all flow recycler "
1281  "threads to shutdown in time");
1282  }
1283 
1285  for (ThreadVars *tv = tv_root[TVT_MGMT]; tv != NULL; tv = tv->next) {
1286  if (strncasecmp(tv->name, thread_name_flow_rec,
1287  strlen(thread_name_flow_rec)) == 0)
1288  {
1291  /* sleep outside lock */
1292  SleepMsec(1);
1293  goto again;
1294  }
1295  }
1296  }
1298 
1299  /* reset count, so we can kill and respawn (unix socket) */
1300  SC_ATOMIC_SET(flowrec_cnt, 0);
1301  return;
1302 }
1303 
1305 {
1306  tmm_modules[TMM_FLOWMANAGER].name = "FlowManager";
1307  tmm_modules[TMM_FLOWMANAGER].ThreadInit = FlowManagerThreadInit;
1308  tmm_modules[TMM_FLOWMANAGER].ThreadDeinit = FlowManagerThreadDeinit;
1309  tmm_modules[TMM_FLOWMANAGER].Management = FlowManager;
1312  SCLogDebug("%s registered", tmm_modules[TMM_FLOWMANAGER].name);
1313 
1314  SC_ATOMIC_INIT(flowmgr_cnt);
1315  SC_ATOMIC_INITPTR(flow_timeouts);
1316 }
1317 
1319 {
1320  tmm_modules[TMM_FLOWRECYCLER].name = "FlowRecycler";
1321  tmm_modules[TMM_FLOWRECYCLER].ThreadInit = FlowRecyclerThreadInit;
1322  tmm_modules[TMM_FLOWRECYCLER].ThreadDeinit = FlowRecyclerThreadDeinit;
1323  tmm_modules[TMM_FLOWRECYCLER].Management = FlowRecycler;
1326  SCLogDebug("%s registered", tmm_modules[TMM_FLOWRECYCLER].name);
1327 
1328  SC_ATOMIC_INIT(flowrec_cnt);
1329  SC_ATOMIC_INIT(flowrec_busy);
1330 }
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:67
FlowTimeoutCounters_::rows_empty
uint32_t rows_empty
Definition: flow-manager.c:118
FlowSparePoolUpdate
void FlowSparePoolUpdate(uint32_t size)
Definition: flow-spare-pool.c:172
util-byte.h
tm-threads.h
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:436
OutputFlowLog
TmEcode OutputFlowLog(ThreadVars *tv, void *thread_data, Flow *f)
Run flow logger(s)
Definition: output-flow.c:87
len
uint8_t len
Definition: app-layer-dnp3.h:2
ts
uint64_t ts
Definition: source-erf-file.c:54
TmThreadSpawn
TmEcode TmThreadSpawn(ThreadVars *tv)
Spawns a thread associated with the ThreadVars instance tv.
Definition: tm-threads.c:1635
app-layer-htp-range.h
FlowTimeoutCounters
Definition: flow-worker.c:54
FlowForceReassemblyForFlow
void FlowForceReassemblyForFlow(Flow *f)
Definition: flow-timeout.c:349
TmThreadCreateMgmtThreadByName
ThreadVars * TmThreadCreateMgmtThreadByName(const char *name, const char *module, int mucond)
Creates and returns the TV instance for a Management thread(MGMT). This function supports only custom...
Definition: tm-threads.c:1079
run_mode
int run_mode
Definition: suricata.c:203
FlowBucket_::evicted
Flow * evicted
Definition: flow-hash.h:46
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
FLOW_IS_IPV6
#define FLOW_IS_IPV6(f)
Definition: flow.h:160
FlowManagerThreadData_::max
uint32_t max
Definition: flow-manager.c:622
FlowManagerTimeoutThread
Definition: flow-manager.c:267
FlowSparePoolReturnFlow
void FlowSparePoolReturnFlow(Flow *f)
Definition: flow-spare-pool.c:101
ThreadVars_::name
char name[16]
Definition: threadvars.h:65
thread_name_flow_mgr
const char * thread_name_flow_mgr
Definition: runmodes.c:68
FlowSpareGetPoolSize
uint32_t FlowSpareGetPoolSize(void)
Definition: flow-spare-pool.c:48
flow-util.h
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:315
FlowManagerThreadData_::cnt
FlowCounters cnt
Definition: flow-manager.c:624
FBLOCK_LOCK
#define FBLOCK_LOCK(fb)
Definition: flow-hash.h:71
TMM_FLOWRECYCLER
@ TMM_FLOWRECYCLER
Definition: tm-threads-common.h:71
stream-tcp.h
GetFlowBypassInfoID
FlowStorageId GetFlowBypassInfoID(void)
Definition: flow-util.c:220
FlowBypassInfo_
Definition: flow.h:529
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:300
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:291
FlowManagerThreadData_::instance
uint32_t instance
Definition: flow-manager.c:620
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
TmThreadsSetFlag
void TmThreadsSetFlag(ThreadVars *tv, uint32_t flag)
Set a thread flag.
Definition: tm-threads.c:97
StatsRegisterGlobalCounter
uint16_t StatsRegisterGlobalCounter(const char *name, uint64_t(*Func)(void))
Registers a counter, which represents a global value.
Definition: counters.c:994
Flow_::proto
uint8_t proto
Definition: flow.h:375
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(uint32_t, flowmgr_cnt)
threads.h
flow-private.h
FlowCounters_::flow_mgr_flows_notimeout
uint16_t flow_mgr_flows_notimeout
Definition: flow-manager.c:606
Flow_
Flow data structure.
Definition: flow.h:353
TYPE
#define TYPE
Flow_::protomap
uint8_t protomap
Definition: flow.h:455
SC_ATOMIC_EXTERN
SC_ATOMIC_EXTERN(unsigned int, flow_flags)
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
thread_name_flow_rec
const char * thread_name_flow_rec
Definition: runmodes.c:69
FlowProtoTimeout_
Definition: flow.h:518
StatsSetUI64
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
Definition: counters.c:191
flow-hash.h
TmModuleFlowRecyclerRegister
void TmModuleFlowRecyclerRegister(void)
Definition: flow-manager.c:1318
FlowTimeoutCounters_::flows_removed
uint32_t flows_removed
Definition: flow-manager.c:125
Flow_::use_cnt
FlowRefCount use_cnt
Definition: flow.h:383
FlowBypassInfo_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:534
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:136
MIN
#define MIN(x, y)
Definition: suricata-common.h:372
tv_root
ThreadVars * tv_root[TVT_MAX]
Definition: tm-threads.c:78
FlowTimeoutCounters_::flows_timeout
uint32_t flows_timeout
Definition: flow-manager.c:123
util-privs.h
defrag-timeout.h
stream-tcp-reassemble.h
StatsSyncCountersIfSignalled
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:137
FlowCounters_::flow_mgr_flows_timeout_inuse
uint16_t flow_mgr_flows_timeout_inuse
Definition: flow-manager.c:608
m
SCMutex m
Definition: flow-hash.h:6
LiveDevSubBypassStats
void LiveDevSubBypassStats(LiveDevice *dev, uint64_t cnt, int family)
Definition: util-device.c:562
SC_ERR_SHUTDOWN
@ SC_ERR_SHUTDOWN
Definition: util-error.h:220
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
FlowQueuePrivate_::len
uint32_t len
Definition: flow-queue.h:44
FlowCounters_
Definition: flow-manager.c:595
FlowManagerTimeoutThread
struct FlowManagerTimeoutThread FlowManagerTimeoutThread
SC_ERR_INVALID_ARGUMENTS
@ SC_ERR_INVALID_ARGUMENTS
Definition: util-error.h:82
FlowCounters_::flow_mgr_flows_aside
uint16_t flow_mgr_flows_aside
Definition: flow-manager.c:609
FLOW_TIMEOUT_REASSEMBLY_DONE
#define FLOW_TIMEOUT_REASSEMBLY_DONE
Definition: flow.h:95
util-unittest.h
FlowTimeoutCounters_::bypassed_count
uint32_t bypassed_count
Definition: flow-manager.c:129
THV_PAUSE
#define THV_PAUSE
Definition: threadvars.h:39
TM_THREAD_NAME_MAX
#define TM_THREAD_NAME_MAX
Definition: tm-threads.h:48
util-unittest-helper.h
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:293
FlowQueueTimeoutCounters::flows_removed
uint32_t flows_removed
Definition: flow-manager.c:591
FLOWLOCK_UNLOCK
#define FLOWLOCK_UNLOCK(fb)
Definition: flow.h:270
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
PacketPoolInit
void PacketPoolInit(void)
Definition: tmqh-packetpool.c:302
FlowCounters_::flow_mgr_cnt_new
uint16_t flow_mgr_cnt_new
Definition: flow-manager.c:598
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:422
FQLOCK_LOCK
#define FQLOCK_LOCK(q)
Definition: flow-queue.h:73
FlowDisableFlowRecyclerThread
void FlowDisableFlowRecyclerThread(void)
Used to disable flow recycler thread(s).
Definition: flow-manager.c:1244
FlowCounters_::flow_mgr_cnt_byp
uint16_t flow_mgr_cnt_byp
Definition: flow-manager.c:600
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
FlowTimeoutCounters_::rows_maxlen
uint32_t rows_maxlen
Definition: flow-manager.c:119
FlowCounters_::flow_bypassed_bytes
uint16_t flow_bypassed_bytes
Definition: flow-manager.c:616
FlowTimeoutCounters_::flows_checked
uint32_t flows_checked
Definition: flow-manager.c:121
THV_RUNNING_DONE
#define THV_RUNNING_DONE
Definition: threadvars.h:47
TmThreadsUnsetFlag
void TmThreadsUnsetFlag(ThreadVars *tv, uint32_t flag)
Unset a thread flag.
Definition: tm-threads.c:105
util-signal.h
SC_ERR_THREAD_INIT
@ SC_ERR_THREAD_INIT
Definition: util-error.h:79
flow-spare-pool.h
FlowTimeoutCounters_::byp
uint32_t byp
Definition: flow-manager.c:114
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:498
FlowCounters_::flow_mgr_full_pass
uint16_t flow_mgr_full_pass
Definition: flow-manager.c:596
StatsRegisterMaxCounter
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
Definition: counters.c:976
SC_ATOMIC_MEMORY_ORDER_RELAXED
#define SC_ATOMIC_MEMORY_ORDER_RELAXED
Definition: util-atomic.h:166
decode.h
util-debug.h
FlowBypassInfo_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:536
DefragTimeoutHash
uint32_t DefragTimeoutHash(struct timeval *ts)
time out tracker from the hash
Definition: defrag-timeout.c:119
FlowBypassInfo_::BypassUpdate
bool(* BypassUpdate)(Flow *f, void *data, time_t tsec)
Definition: flow.h:530
TVT_MGMT
@ TVT_MGMT
Definition: tm-threads-common.h:90
OutputFlowLogThreadInit
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void *initdata, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
Definition: output-flow.c:125
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
FlowCounters_::flow_mgr_rows_maxlen
uint16_t flow_mgr_rows_maxlen
Definition: flow-manager.c:612
FLOWLOCK_WRLOCK
#define FLOWLOCK_WRLOCK(fb)
Definition: flow.h:267
FlowTimeoutsReset
#define FlowTimeoutsReset()
Definition: flow-manager.h:27
FlowForceReassemblyNeedReassembly
int FlowForceReassemblyNeedReassembly(Flow *f)
Check if a flow needs forced reassembly, or any other processing.
Definition: flow-timeout.c:295
FlowDisableFlowManagerThread
void FlowDisableFlowManagerThread(void)
Used to disable flow manager thread(s).
Definition: flow-manager.c:140
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
TmThreadTestThreadUnPaused
void TmThreadTestThreadUnPaused(ThreadVars *tv)
Tests if the thread represented in the arg has been unpaused or not.
Definition: tm-threads.c:1740
TmModule_::Management
TmEcode(* Management)(ThreadVars *, void *)
Definition: tm-modules.h:59
TimeModeIsReady
bool TimeModeIsReady(void)
Definition: util-time.c:90
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:457
THV_KILL
#define THV_KILL
Definition: threadvars.h:41
FlowBypassInfo_::todstpktcnt
uint64_t todstpktcnt
Definition: flow.h:535
util-time.h
FlowQueuePrivateGetFromTop
Flow * FlowQueuePrivateGetFromTop(FlowQueuePrivate *fqc)
Definition: flow-queue.c:152
FlowBypassInfo_::bypass_data
void * bypass_data
Definition: flow.h:532
FlowQueueAppendPrivate
void FlowQueueAppendPrivate(FlowQueue *fq, FlowQueuePrivate *fqc)
Definition: flow-queue.c:120
FlowQueueTimeoutCounters
struct FlowQueueTimeoutCounters FlowQueueTimeoutCounters
FlowCounters_::flow_mgr_flows_aside_needs_work
uint16_t flow_mgr_flows_aside_needs_work
Definition: flow-manager.c:610
app-layer-parser.h
ThreadVars_::next
struct ThreadVars_ * next
Definition: threadvars.h:123
FlowRecyclerThreadData_
Definition: flow-manager.c:1035
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:281
FLOW_IS_IPV4
#define FLOW_IS_IPV4(f)
Definition: flow.h:158
FlowCounters_::flow_bypassed_cnt_clo
uint16_t flow_bypassed_cnt_clo
Definition: flow-manager.c:614
tv_root_lock
SCMutex tv_root_lock
Definition: tm-threads.c:81
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:342
flow_timeouts_emerg
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow.c:94
stream.h
FlowTimeoutsEmergency
void FlowTimeoutsEmergency(void)
Definition: flow-manager.c:97
FlowTimeoutCounters
struct FlowTimeoutCounters_ FlowTimeoutCounters
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
FlowManagerThreadSpawn
void FlowManagerThreadSpawn()
spawn the flow manager thread
Definition: flow-manager.c:1003
stream-tcp-private.h
conf.h
FlowRecyclerThreadData_::output_thread_data
void * output_thread_data
Definition: flow-manager.c:1036
FlowTimeoutCounters_::rows_checked
uint32_t rows_checked
Definition: flow-manager.c:116
FBLOCK_UNLOCK
#define FBLOCK_UNLOCK(fb)
Definition: flow-hash.h:73
TmEcode
TmEcode
Definition: tm-threads-common.h:81
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1083
flow_timeouts_delta
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Definition: flow.c:95
output-flow.h
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
flow-timeout.h
FlowCounters_::flow_mgr_cnt_est
uint16_t flow_mgr_cnt_est
Definition: flow-manager.c:599
flow-queue.h
TmModule_::name
const char * name
Definition: tm-modules.h:44
FlowRecyclerThreadData
struct FlowRecyclerThreadData_ FlowRecyclerThreadData
FlowGetStorageById
void * FlowGetStorageById(Flow *f, FlowStorageId id)
Definition: flow-storage.c:39
FlowBypassInfo_::tosrcpktcnt
uint64_t tosrcpktcnt
Definition: flow.h:533
host-timeout.h
FlowRecyclerThreadSpawn
void FlowRecyclerThreadSpawn()
spawn the flow recycler thread
Definition: flow-manager.c:1206
runmodes.h
FlowTimeoutCounters_::flows_aside_needs_work
uint32_t flows_aside_needs_work
Definition: flow-manager.c:127
HttpRangeContainersTimeoutHash
uint32_t HttpRangeContainersTimeoutHash(struct timeval *ts)
Definition: app-layer-htp-range.c:190
Flow_::next
struct Flow_ * next
Definition: flow.h:404
FlowQueue_
Definition: flow-queue.h:49
FlowCounters_::flow_bypassed_pkts
uint16_t flow_bypassed_pkts
Definition: flow-manager.c:615
TMM_FLOWMANAGER
@ TMM_FLOWMANAGER
Definition: tm-threads-common.h:70
THV_PAUSED
#define THV_PAUSED
Definition: threadvars.h:40
HostTimeoutHash
uint32_t HostTimeoutHash(struct timeval *ts)
time out hosts from the hash
Definition: host-timeout.c:156
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:56
FlowQueueExtractPrivate
FlowQueuePrivate FlowQueueExtractPrivate(FlowQueue *fq)
Definition: flow-queue.c:141
flow-storage.h
FlowTimeoutCounters_
Definition: flow-manager.c:110
FlowManagerThreadData_
Definition: flow-manager.c:619
SleepMsec
#define SleepMsec(msec)
Definition: tm-threads.h:44
flow-manager.h
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:71
suricata-common.h
FlowManagerThreadData
struct FlowManagerThreadData_ FlowManagerThreadData
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:70
flow_config
FlowConfig flow_config
Definition: flow.c:98
FlowQueueTimeoutCounters::flows_timeout
uint32_t flows_timeout
Definition: flow-manager.c:592
TmModuleFlowManagerRegister
void TmModuleFlowManagerRegister(void)
Definition: flow-manager.c:1304
SCLogPerf
#define SCLogPerf(...)
Definition: util-debug.h:224
FlowTimeoutsInit
void FlowTimeoutsInit(void)
Definition: flow-manager.c:92
SC_ATOMIC_LOAD_EXPLICIT
#define SC_ATOMIC_LOAD_EXPLICIT(name, order)
Definition: util-atomic.h:379
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
FlowTimeoutCounters_::est
uint32_t est
Definition: flow-manager.c:112
Flow_::livedev
struct LiveDevice_ * livedev
Definition: flow.h:406
threadvars.h
util-validate.h
FlowQueuePrivate_
Definition: flow-queue.h:41
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:148
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FlowTimeoutCounters_::bypassed_bytes
uint64_t bypassed_bytes
Definition: flow-manager.c:131
FlowManagerThreadData_::min
uint32_t min
Definition: flow-manager.c:621
FlowCounters_::flow_mgr_cnt_clo
uint16_t flow_mgr_cnt_clo
Definition: flow-manager.c:597
OutputFlowLogThreadDeinit
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output-flow.c:167
flow_recycle_q
FlowQueue flow_recycle_q
Definition: flow-manager.c:78
SCFree
#define SCFree(p)
Definition: util-mem.h:61
FlowTimeoutCounters_::bypassed_pkts
uint64_t bypassed_pkts
Definition: flow-manager.c:130
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
Flow_::flags
uint32_t flags
Definition: flow.h:431
SC_ATOMIC_INITPTR
#define SC_ATOMIC_INITPTR(name)
Definition: util-atomic.h:318
FlowManagerThreadData_::timeout
FlowManagerTimeoutThread timeout
Definition: flow-manager.c:626
util-random.h
FlowCounters
struct FlowCounters_ FlowCounters
FlowCounters_::flow_emerg_mode_enter
uint16_t flow_emerg_mode_enter
Definition: flow-manager.c:602
TimeGet
void TimeGet(struct timeval *tv)
Definition: util-time.c:153
FLOW_END_FLAG_SHUTDOWN
#define FLOW_END_FLAG_SHUTDOWN
Definition: flow.h:242
FLOW_EMERGENCY
#define FLOW_EMERGENCY
Definition: flow-private.h:37
IPPairTimeoutHash
uint32_t IPPairTimeoutHash(struct timeval *ts)
time out ippairs from the hash
Definition: ippair-timeout.c:142
suricata.h
ippair-timeout.h
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:76
FlowCounters_::flow_mgr_flows_timeout
uint16_t flow_mgr_flows_timeout
Definition: flow-manager.c:607
FlowManagerTimeoutThread::aside_queue
FlowQueuePrivate aside_queue
Definition: flow-manager.c:270
FLOW_END_FLAG_TIMEOUT
#define FLOW_END_FLAG_TIMEOUT
Definition: flow.h:240
StatsSyncCounters
#define StatsSyncCounters(tv)
Definition: counters.h:134
FlowTimeoutCounters_::flows_notimeout
uint32_t flows_notimeout
Definition: flow-manager.c:122
flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:93
FlowCounters_::flow_mgr_spare
uint16_t flow_mgr_spare
Definition: flow-manager.c:601
FlowTimeoutCounters_::flows_aside
uint32_t flows_aside
Definition: flow-manager.c:126
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
PacketPoolDestroy
void PacketPoolDestroy(void)
Definition: tmqh-packetpool.c:335
FlowTimeoutCounters_::clo
uint32_t clo
Definition: flow-manager.c:113
flow.h
FlowQueuePrivateAppendFlow
void FlowQueuePrivateAppendFlow(FlowQueuePrivate *fqc, Flow *f)
Definition: flow-queue.c:66
TmThreadsCheckFlag
int TmThreadsCheckFlag(ThreadVars *tv, uint32_t flag)
Check if a thread flag is set.
Definition: tm-threads.c:89
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:232
evicted
Flow * evicted
Definition: flow-hash.h:4
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:936
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
BITS
#define BITS
FlowTimeoutCounters_::flows_timeout_inuse
uint32_t flows_timeout_inuse
Definition: flow-manager.c:124
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:399
flow-var.h
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:70
SC_ATOMIC_AND
#define SC_ATOMIC_AND(name, val)
Bitwise AND a value to our atomic variable.
Definition: util-atomic.h:360
FlowCounters_::flow_emerg_mode_over
uint16_t flow_emerg_mode_over
Definition: flow-manager.c:603
TM_FLAG_MANAGEMENT_TM
#define TM_FLAG_MANAGEMENT_TM
Definition: tm-modules.h:36
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:200
FlowTimeoutCounters_::rows_skipped
uint32_t rows_skipped
Definition: flow-manager.c:117
FlowCounters_::flow_mgr_flows_checked
uint16_t flow_mgr_flows_checked
Definition: flow-manager.c:605
FlowQueueTimeoutCounters
Definition: flow-manager.c:590
FlowTimeoutCounters::flows_aside_needs_work
uint32_t flows_aside_needs_work
Definition: flow-worker.c:55
FQLOCK_UNLOCK
#define FQLOCK_UNLOCK(q)
Definition: flow-queue.h:75