suricata
flow-manager.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  * \author Victor Julien <victor@inliniac.net>
23  */
24 
25 #include "suricata-common.h"
26 #include "suricata.h"
27 #include "decode.h"
28 #include "conf.h"
29 #include "threadvars.h"
30 #include "tm-threads.h"
31 #include "runmodes.h"
32 
33 #include "util-random.h"
34 #include "util-time.h"
35 
36 #include "flow.h"
37 #include "flow-queue.h"
38 #include "flow-hash.h"
39 #include "flow-util.h"
40 #include "flow-var.h"
41 #include "flow-private.h"
42 #include "flow-timeout.h"
43 #include "flow-manager.h"
44 #include "flow-storage.h"
45 #include "flow-spare-pool.h"
46 
47 #include "stream-tcp-private.h"
48 #include "stream-tcp-reassemble.h"
49 #include "stream-tcp.h"
50 
51 #include "util-unittest.h"
52 #include "util-unittest-helper.h"
53 #include "util-byte.h"
54 
55 #include "util-debug.h"
56 #include "util-privs.h"
57 #include "util-signal.h"
58 
59 #include "threads.h"
60 #include "detect.h"
61 #include "detect-engine-state.h"
62 #include "stream.h"
63 
64 #include "app-layer-parser.h"
65 
66 #include "host-timeout.h"
67 #include "defrag-timeout.h"
68 #include "ippair-timeout.h"
69 
70 #include "output-flow.h"
71 #include "util-validate.h"
72 
73 /* Run mode selected at suricata.c */
74 extern int run_mode;
75 
76 /** queue to pass flows to cleanup/log thread(s) */
78 
79 /* multi flow mananger support */
80 static uint32_t flowmgr_number = 1;
81 /* atomic counter for flow managers, to assign instance id */
82 SC_ATOMIC_DECLARE(uint32_t, flowmgr_cnt);
83 
84 /* multi flow recycler support */
85 static uint32_t flowrec_number = 1;
86 /* atomic counter for flow recyclers, to assign instance id */
87 SC_ATOMIC_DECLARE(uint32_t, flowrec_cnt);
88 SC_ATOMIC_DECLARE(uint32_t, flowrec_busy);
89 SC_ATOMIC_EXTERN(unsigned int, flow_flags);
90 
91 void FlowTimeoutsInit(void)
92 {
93  SC_ATOMIC_SET(flow_timeouts, flow_timeouts_normal);
94 }
95 
97 {
98  SC_ATOMIC_SET(flow_timeouts, flow_timeouts_emerg);
99 }
100 
101 /* 1 seconds */
102 #define FLOW_NORMAL_MODE_UPDATE_DELAY_SEC 1
103 #define FLOW_NORMAL_MODE_UPDATE_DELAY_NSEC 0
104 /* 0.3 seconds */
105 #define FLOW_EMERG_MODE_UPDATE_DELAY_SEC 0
106 #define FLOW_EMERG_MODE_UPDATE_DELAY_NSEC 300000
107 #define NEW_FLOW_COUNT_COND 10
108 
109 typedef struct FlowTimeoutCounters_ {
110  uint32_t new;
111  uint32_t est;
112  uint32_t clo;
113  uint32_t byp;
114 
115  uint32_t rows_checked;
116  uint32_t rows_skipped;
117  uint32_t rows_empty;
118  uint32_t rows_busy;
119  uint32_t rows_maxlen;
120 
121  uint32_t flows_checked;
122  uint32_t flows_notimeout;
123  uint32_t flows_timeout;
125  uint32_t flows_removed;
126  uint32_t flows_aside;
128 
129  uint32_t bypassed_count;
130  uint64_t bypassed_pkts;
131  uint64_t bypassed_bytes;
133 
134 /**
135  * \brief Used to disable flow manager thread(s).
136  *
137  * \todo Kinda hackish since it uses the tv name to identify flow manager
138  * thread. We need an all weather identification scheme.
139  */
141 {
143  /* flow manager thread(s) is/are a part of mgmt threads */
144  for (ThreadVars *tv = tv_root[TVT_MGMT]; tv != NULL; tv = tv->next) {
145  if (strncasecmp(tv->name, thread_name_flow_mgr,
146  strlen(thread_name_flow_mgr)) == 0)
147  {
149  }
150  }
152 
153  struct timeval start_ts;
154  struct timeval cur_ts;
155  gettimeofday(&start_ts, NULL);
156 
157 again:
158  gettimeofday(&cur_ts, NULL);
159  if ((cur_ts.tv_sec - start_ts.tv_sec) > 60) {
160  FatalError(SC_ERR_SHUTDOWN, "unable to get all flow manager "
161  "threads to shutdown in time");
162  }
163 
165  for (ThreadVars *tv = tv_root[TVT_MGMT]; tv != NULL; tv = tv->next) {
166  if (strncasecmp(tv->name, thread_name_flow_mgr,
167  strlen(thread_name_flow_mgr)) == 0)
168  {
171  /* sleep outside lock */
172  SleepMsec(1);
173  goto again;
174  }
175  }
176  }
178 
179  /* reset count, so we can kill and respawn (unix socket) */
180  SC_ATOMIC_SET(flowmgr_cnt, 0);
181  return;
182 }
183 
184 /** \internal
185  * \brief check if a flow is timed out
186  *
187  * \param f flow
188  * \param ts timestamp
189  *
190  * \retval 0 not timed out
191  * \retval 1 timed out
192  */
193 static int FlowManagerFlowTimeout(Flow *f, struct timeval *ts, int32_t *next_ts, const bool emerg)
194 {
195  int32_t flow_times_out_at = f->timeout_at;
196  if (emerg) {
198  flow_times_out_at -= FlowGetFlowTimeoutDirect(flow_timeouts_delta, f->flow_state, f->protomap);
199  }
200  if (*next_ts == 0 || flow_times_out_at < *next_ts)
201  *next_ts = flow_times_out_at;
202 
203  /* do the timeout check */
204  if (flow_times_out_at >= ts->tv_sec) {
205  return 0;
206  }
207 
208  return 1;
209 }
210 
211 static inline int FlowBypassedTimeout(Flow *f, struct timeval *ts,
212  FlowTimeoutCounters *counters)
213 {
214 #ifdef CAPTURE_OFFLOAD
215  if (f->flow_state != FLOW_STATE_CAPTURE_BYPASSED) {
216  return 1;
217  }
218 
220  if (fc && fc->BypassUpdate) {
221  /* flow will be possibly updated */
222  uint64_t pkts_tosrc = fc->tosrcpktcnt;
223  uint64_t bytes_tosrc = fc->tosrcbytecnt;
224  uint64_t pkts_todst = fc->todstpktcnt;
225  uint64_t bytes_todst = fc->todstbytecnt;
226  bool update = fc->BypassUpdate(f, fc->bypass_data, ts->tv_sec);
227  if (update) {
228  SCLogDebug("Updated flow: %"PRId64"", FlowGetId(f));
229  pkts_tosrc = fc->tosrcpktcnt - pkts_tosrc;
230  bytes_tosrc = fc->tosrcbytecnt - bytes_tosrc;
231  pkts_todst = fc->todstpktcnt - pkts_todst;
232  bytes_todst = fc->todstbytecnt - bytes_todst;
233  if (f->livedev) {
234  SC_ATOMIC_ADD(f->livedev->bypassed,
235  pkts_tosrc + pkts_todst);
236  }
237  counters->bypassed_pkts += pkts_tosrc + pkts_todst;
238  counters->bypassed_bytes += bytes_tosrc + bytes_todst;
239  return 0;
240  } else {
241  SCLogDebug("No new packet, dead flow %"PRId64"", FlowGetId(f));
242  if (f->livedev) {
243  if (FLOW_IS_IPV4(f)) {
244  LiveDevSubBypassStats(f->livedev, 1, AF_INET);
245  } else if (FLOW_IS_IPV6(f)) {
246  LiveDevSubBypassStats(f->livedev, 1, AF_INET6);
247  }
248  }
249  counters->bypassed_count++;
250  return 1;
251  }
252  }
253 #endif /* CAPTURE_OFFLOAD */
254  return 1;
255 }
256 
257 /** \internal
258  * \brief See if we can really discard this flow. Check use_cnt reference
259  * counter and force reassembly if necessary.
260  *
261  * \param f flow
262  * \param ts timestamp
263  *
264  * \retval 0 not timed out just yet
265  * \retval 1 fully timed out, lets kill it
266  */
267 #if 0
268 static inline int FlowManagerFlowTimedOut(Flow *f, struct timeval *ts,
269  FlowTimeoutCounters *counters)
270 {
271  /* never prune a flow that is used by a packet we
272  * are currently processing in one of the threads */
273  if (f->use_cnt > 0) {
274  return 0;
275  }
276 
277  if (!FlowBypassedTimeout(f, ts, counters)) {
278  return 0;
279  }
280 
281  int server = 0, client = 0;
282 
283  if (!(f->flags & FLOW_TIMEOUT_REASSEMBLY_DONE) &&
284 #ifdef CAPTURE_OFFLOAD
285  f->flow_state != FLOW_STATE_CAPTURE_BYPASSED &&
286 #endif
288  FlowForceReassemblyNeedReassembly(f, &server, &client) == 1) {
289  FlowForceReassemblyForFlow(f, server, client);
290  return 0;
291  }
292 #ifdef DEBUG
293  /* this should not be possible */
294  BUG_ON(f->use_cnt > 0);
295 #endif
296 
297  return 1;
298 }
299 #endif
300 
301 static inline int FMTryLockBucket(FlowBucket *fb)
302 {
303  int r = FBLOCK_TRYLOCK(fb);
304  return r;
305 }
306 static inline void FMFlowLock(Flow *f)
307 {
308  FLOWLOCK_WRLOCK(f);
309 }
310 
311 typedef struct FlowManagerTimeoutThread {
312  /* used to temporarily store flows that have timed out and are
313  * removed from the hash */
316 
317 static uint32_t ProcessAsideQueue(FlowManagerTimeoutThread *td, FlowTimeoutCounters *counters)
318 {
319  FlowQueuePrivate recycle = { NULL, NULL, 0 };
320  counters->flows_aside += td->aside_queue.len;
321 
322  uint32_t cnt = 0;
323  Flow *f;
324  while ((f = FlowQueuePrivateGetFromTop(&td->aside_queue)) != NULL) {
325  /* flow is still locked */
326 
327  if (f->proto == IPPROTO_TCP &&
329 #ifdef CAPTURE_OFFLOAD
330  f->flow_state != FLOW_STATE_CAPTURE_BYPASSED &&
331 #endif
334  {
336  /* flow ownership is passed to the worker thread */
337 
338  /* flow remains locked */
339  counters->flows_aside_needs_work++;
340  continue;
341  }
342  FLOWLOCK_UNLOCK(f);
343 
344  FlowQueuePrivateAppendFlow(&recycle, f);
345  if (recycle.len == 100) {
347  }
348  cnt++;
349  }
350  if (recycle.len) {
352  }
353  return cnt;
354 }
355 
356 /**
357  * \internal
358  *
359  * \brief check all flows in a hash row for timing out
360  *
361  * \param f last flow in the hash row
362  * \param ts timestamp
363  * \param emergency bool indicating emergency mode
364  * \param counters ptr to FlowTimeoutCounters structure
365  */
366 static void FlowManagerHashRowTimeout(FlowManagerTimeoutThread *td,
367  Flow *f, struct timeval *ts,
368  int emergency, FlowTimeoutCounters *counters, int32_t *next_ts)
369 {
370  uint32_t checked = 0;
371  Flow *prev_f = NULL;
372 
373  do {
374  checked++;
375 
376  /* check flow timeout based on lastts and state. Both can be
377  * accessed w/o Flow lock as we do have the hash row lock (so flow
378  * can't disappear) and flow_state is atomic. lastts can only
379  * be modified when we have both the flow and hash row lock */
380 
381  /* timeout logic goes here */
382  if (FlowManagerFlowTimeout(f, ts, next_ts, emergency) == 0) {
383 
384  counters->flows_notimeout++;
385 
386  prev_f = f;
387  f = f->next;
388  continue;
389  }
390 
391  FMFlowLock(f); //FLOWLOCK_WRLOCK(f);
392 
393  Flow *next_flow = f->next;
394 
395  counters->flows_timeout++;
396 
397  /* never prune a flow that is used by a packet we
398  * are currently processing in one of the threads */
399  if (f->use_cnt > 0 || !FlowBypassedTimeout(f, ts, counters)) {
400  FLOWLOCK_UNLOCK(f);
401  prev_f = f;
402  counters->flows_timeout_inuse++;
403  f = f->next;
404  continue;
405  }
406 
407  RemoveFromHash(f, prev_f);
408 
410  /* flow is still locked in the queue */
411 
412  f = next_flow;
413  } while (f != NULL);
414 
415  counters->flows_checked += checked;
416  if (checked > counters->rows_maxlen)
417  counters->rows_maxlen = checked;
418 }
419 
420 static void FlowManagerHashRowClearEvictedList(FlowManagerTimeoutThread *td,
421  Flow *f, struct timeval *ts, FlowTimeoutCounters *counters)
422 {
423  do {
424  FLOWLOCK_WRLOCK(f);
425  Flow *next_flow = f->next;
426  f->next = NULL;
427  f->fb = NULL;
428 
429  DEBUG_VALIDATE_BUG_ON(f->use_cnt > 0 || !FlowBypassedTimeout(f, ts, counters));
430 
432  /* flow is still locked in the queue */
433 
434  f = next_flow;
435  } while (f != NULL);
436 }
437 
438 /**
439  * \brief time out flows from the hash
440  *
441  * \param ts timestamp
442  * \param hash_min min hash index to consider
443  * \param hash_max max hash index to consider
444  * \param counters ptr to FlowTimeoutCounters structure
445  *
446  * \retval cnt number of timed out flow
447  */
448 static uint32_t FlowTimeoutHash(FlowManagerTimeoutThread *td,
449  struct timeval *ts,
450  const uint32_t hash_min, const uint32_t hash_max,
451  FlowTimeoutCounters *counters)
452 {
453  uint32_t cnt = 0;
454  const int emergency = ((SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY));
455  const uint32_t rows_checked = hash_max - hash_min;
456  uint32_t rows_skipped = 0;
457  uint32_t rows_busy = 0;
458  uint32_t rows_empty = 0;
459 
460 #if __WORDSIZE==64
461 #define BITS 64
462 #define TYPE uint64_t
463 #else
464 #define BITS 32
465 #define TYPE uint32_t
466 #endif
467 
468  for (uint32_t idx = hash_min; idx < hash_max; idx+=BITS) {
469  TYPE check_bits = 0;
470  const uint32_t check = MIN(BITS, (hash_max - idx));
471  for (uint32_t i = 0; i < check; i++) {
472  FlowBucket *fb = &flow_hash[idx+i];
473  check_bits |= (TYPE)(SC_ATOMIC_LOAD_EXPLICIT(fb->next_ts, SC_ATOMIC_MEMORY_ORDER_RELAXED) <= (int32_t)ts->tv_sec) << (TYPE)i;
474  }
475  if (check_bits == 0)
476  continue;
477 
478  for (uint32_t i = 0; i < check; i++) {
479  FlowBucket *fb = &flow_hash[idx+i];
480  if ((check_bits & ((TYPE)1 << (TYPE)i)) != 0 && SC_ATOMIC_GET(fb->next_ts) <= (int32_t)ts->tv_sec) {
481  if (FMTryLockBucket(fb) == 0) {
482  Flow *evicted = NULL;
483  if (fb->evicted != NULL || fb->head != NULL) {
484  /* if evicted is set, we only process that list right now.
485  * Since its set we've had traffic that touched this row
486  * very recently, and there is a good chance more of it will
487  * come in in the near future. So unlock the row asap and leave
488  * the possible eviction of flows to the packet lookup path. */
489  if (fb->evicted != NULL) {
490  /* transfer out of bucket so we can do additional work outside
491  * of the bucket lock */
492  evicted = fb->evicted;
493  fb->evicted = NULL;
494  } else if (fb->head != NULL) {
495  int32_t next_ts = 0;
496  FlowManagerHashRowTimeout(td,
497  fb->head, ts, emergency, counters, &next_ts);
498 
499  if (SC_ATOMIC_GET(fb->next_ts) != next_ts)
500  SC_ATOMIC_SET(fb->next_ts, next_ts);
501  }
502  if (fb->evicted == NULL && fb->head == NULL) {
503  SC_ATOMIC_SET(fb->next_ts, INT_MAX);
504  } else if (fb->evicted != NULL && fb->head == NULL) {
505  SC_ATOMIC_SET(fb->next_ts, 0);
506  }
507  } else {
508  SC_ATOMIC_SET(fb->next_ts, INT_MAX);
509  rows_empty++;
510  }
511  FBLOCK_UNLOCK(fb);
512  /* processed evicted list */
513  if (evicted) {
514  FlowManagerHashRowClearEvictedList(td, evicted, ts, counters);
515  }
516  } else {
517  rows_busy++;
518  }
519  } else {
520  rows_skipped++;
521  }
522  }
523  if (td->aside_queue.len) {
524  cnt += ProcessAsideQueue(td, counters);
525  }
526  }
527 
528  counters->rows_checked += rows_checked;
529  counters->rows_skipped += rows_skipped;
530  counters->rows_busy += rows_busy;
531  counters->rows_empty += rows_empty;
532 
533  if (td->aside_queue.len) {
534  cnt += ProcessAsideQueue(td, counters);
535  }
536  counters->flows_removed += cnt;
537  /* coverity[missing_unlock : FALSE] */
538  return cnt;
539 }
540 
541 static uint32_t FlowTimeoutHashInChunks(FlowManagerTimeoutThread *td,
542  struct timeval *ts,
543  const uint32_t hash_min, const uint32_t hash_max,
544  FlowTimeoutCounters *counters, uint32_t iter, const uint32_t chunks)
545 {
546  const uint32_t rows = hash_max - hash_min;
547  const uint32_t chunk_size = rows / chunks;
548 
549  const uint32_t min = iter * chunk_size + hash_min;
550  uint32_t max = min + chunk_size;
551  if (iter + 1 == chunks) {
552  max = rows;
553  }
554  const uint32_t cnt = FlowTimeoutHash(td, ts, min, max, counters);
555  return cnt;
556 }
557 
558 /**
559  * \internal
560  *
561  * \brief move all flows out of a hash row
562  *
563  * \param f last flow in the hash row
564  *
565  * \retval cnt removed out flows
566  */
567 static uint32_t FlowManagerHashRowCleanup(Flow *f, FlowQueuePrivate *recycle_q, const int mode)
568 {
569  uint32_t cnt = 0;
570 
571  do {
572  FLOWLOCK_WRLOCK(f);
573 
574  Flow *next_flow = f->next;
575 
576  /* remove from the hash */
577  if (mode == 0) {
578  RemoveFromHash(f, NULL);
579  } else {
580  FlowBucket *fb = f->fb;
581  fb->evicted = f->next;
582  f->next = NULL;
583  f->fb = NULL;
584  }
586 
587  /* no one is referring to this flow, use_cnt 0, removed from hash
588  * so we can unlock it and move it to the recycle queue. */
589  FLOWLOCK_UNLOCK(f);
590  FlowQueuePrivateAppendFlow(recycle_q, f);
591 
592  cnt++;
593 
594  f = next_flow;
595  } while (f != NULL);
596 
597  return cnt;
598 }
599 
600 /**
601  * \brief remove all flows from the hash
602  *
603  * \retval cnt number of removes out flows
604  */
605 static uint32_t FlowCleanupHash(void)
606 {
607  FlowQueuePrivate local_queue = { NULL, NULL, 0 };
608  uint32_t cnt = 0;
609 
610  for (uint32_t idx = 0; idx < flow_config.hash_size; idx++) {
611  FlowBucket *fb = &flow_hash[idx];
612 
613  FBLOCK_LOCK(fb);
614 
615  if (fb->head != NULL) {
616  /* we have a flow, or more than one */
617  cnt += FlowManagerHashRowCleanup(fb->head, &local_queue, 0);
618  }
619  if (fb->evicted != NULL) {
620  /* we have a flow, or more than one */
621  cnt += FlowManagerHashRowCleanup(fb->evicted, &local_queue, 1);
622  }
623 
624  FBLOCK_UNLOCK(fb);
625  if (local_queue.len >= 25) {
626  FlowQueueAppendPrivate(&flow_recycle_q, &local_queue);
627  }
628  }
629  FlowQueueAppendPrivate(&flow_recycle_q, &local_queue);
630 
631  return cnt;
632 }
633 
634 static void Recycler(ThreadVars *tv, void *output_thread_data, Flow *f)
635 {
636  FLOWLOCK_WRLOCK(f);
637 
638  (void)OutputFlowLog(tv, output_thread_data, f);
639 
640  FlowClearMemory (f, f->protomap);
641  FLOWLOCK_UNLOCK(f);
643 }
644 
645 typedef struct FlowQueueTimeoutCounters {
646  uint32_t flows_removed;
647  uint32_t flows_timeout;
649 
650 extern int g_detect_disabled;
651 
652 typedef struct FlowCounters_ {
658  uint16_t flow_mgr_spare;
661 
668 
670 
675 
676 typedef struct FlowManagerThreadData_ {
677  uint32_t instance;
678  uint32_t min;
679  uint32_t max;
680 
682 
685 
686 static void FlowCountersInit(ThreadVars *t, FlowCounters *fc)
687 {
688  fc->flow_mgr_full_pass = StatsRegisterCounter("flow.mgr.full_hash_pass", t);
689  fc->flow_mgr_cnt_clo = StatsRegisterCounter("flow.mgr.closed_pruned", t);
690  fc->flow_mgr_cnt_new = StatsRegisterCounter("flow.mgr.new_pruned", t);
691  fc->flow_mgr_cnt_est = StatsRegisterCounter("flow.mgr.est_pruned", t);
692  fc->flow_mgr_cnt_byp = StatsRegisterCounter("flow.mgr.bypassed_pruned", t);
693  fc->flow_mgr_spare = StatsRegisterCounter("flow.spare", t);
694  fc->flow_emerg_mode_enter = StatsRegisterCounter("flow.emerg_mode_entered", t);
695  fc->flow_emerg_mode_over = StatsRegisterCounter("flow.emerg_mode_over", t);
696 
697  fc->flow_mgr_rows_maxlen = StatsRegisterMaxCounter("flow.mgr.rows_maxlen", t);
698  fc->flow_mgr_flows_checked = StatsRegisterCounter("flow.mgr.flows_checked", t);
699  fc->flow_mgr_flows_notimeout = StatsRegisterCounter("flow.mgr.flows_notimeout", t);
700  fc->flow_mgr_flows_timeout = StatsRegisterCounter("flow.mgr.flows_timeout", t);
701  fc->flow_mgr_flows_timeout_inuse = StatsRegisterCounter("flow.mgr.flows_timeout_inuse", t);
702  fc->flow_mgr_flows_aside = StatsRegisterCounter("flow.mgr.flows_evicted", t);
703  fc->flow_mgr_flows_aside_needs_work = StatsRegisterCounter("flow.mgr.flows_evicted_needs_work", t);
704 
705  fc->flow_bypassed_cnt_clo = StatsRegisterCounter("flow_bypassed.closed", t);
706  fc->flow_bypassed_pkts = StatsRegisterCounter("flow_bypassed.pkts", t);
707  fc->flow_bypassed_bytes = StatsRegisterCounter("flow_bypassed.bytes", t);
708 }
709 
710 static TmEcode FlowManagerThreadInit(ThreadVars *t, const void *initdata, void **data)
711 {
713  if (ftd == NULL)
714  return TM_ECODE_FAILED;
715 
716  ftd->instance = SC_ATOMIC_ADD(flowmgr_cnt, 1);
717  SCLogDebug("flow manager instance %u", ftd->instance);
718 
719  /* set the min and max value used for hash row walking
720  * each thread has it's own section of the flow hash */
721  uint32_t range = flow_config.hash_size / flowmgr_number;
722  if (ftd->instance == 0)
723  ftd->max = range;
724  else if ((ftd->instance + 1) == flowmgr_number) {
725  ftd->min = (range * ftd->instance) + 1;
726  ftd->max = flow_config.hash_size;
727  } else {
728  ftd->min = (range * ftd->instance) + 1;
729  ftd->max = (range * (ftd->instance + 1));
730  }
732 
733  SCLogDebug("instance %u hash range %u %u", ftd->instance, ftd->min, ftd->max);
734 
735  /* pass thread data back to caller */
736  *data = ftd;
737 
738  FlowCountersInit(t, &ftd->cnt);
739 
740  PacketPoolInit();
741  return TM_ECODE_OK;
742 }
743 
744 static TmEcode FlowManagerThreadDeinit(ThreadVars *t, void *data)
745 {
747  SCFree(data);
748  return TM_ECODE_OK;
749 }
750 
751 static uint32_t FlowTimeoutsMin(void)
752 {
753  FlowProtoTimeoutPtr t = SC_ATOMIC_GET(flow_timeouts);
754  uint32_t m = -1;
755  for (unsigned int i = 0; i < FLOW_PROTO_MAX; i++) {
756  m = MIN(m, t[i].new_timeout);
757  m = MIN(m, t[i].est_timeout);
758 
759  if (i == FLOW_PROTO_TCP) {
760  m = MIN(m, t[i].closed_timeout);
761  }
762  if (i == FLOW_PROTO_TCP || i == FLOW_PROTO_UDP) {
763  m = MIN(m, t[i].bypassed_timeout);
764  }
765  }
766  return m;
767 }
768 
769 //#define FM_PROFILE
770 
771 /** \brief Thread that manages the flow table and times out flows.
772  *
773  * \param td ThreadVars casted to void ptr
774  *
775  * Keeps an eye on the spare list, alloc flows if needed...
776  */
777 static TmEcode FlowManager(ThreadVars *th_v, void *thread_data)
778 {
779  FlowManagerThreadData *ftd = thread_data;
780  struct timeval ts;
781  uint32_t established_cnt = 0, new_cnt = 0, closing_cnt = 0;
782  bool emerg = false;
783  bool prev_emerg = false;
784  uint32_t other_last_sec = 0; /**< last sec stamp when defrag etc ran */
785  uint32_t flow_last_sec = 0;
786 /* VJ leaving disabled for now, as hosts are only used by tags and the numbers
787  * are really low. Might confuse ppl
788  uint16_t flow_mgr_host_prune = StatsRegisterCounter("hosts.pruned", th_v);
789  uint16_t flow_mgr_host_active = StatsRegisterCounter("hosts.active", th_v);
790  uint16_t flow_mgr_host_spare = StatsRegisterCounter("hosts.spare", th_v);
791 */
792  memset(&ts, 0, sizeof(ts));
793  uint32_t hash_passes = 0;
794  uint32_t hash_row_checks = 0;
795  uint32_t hash_passes_chunks = 0;
796  uint32_t hash_full_passes = 0;
797 
798  const uint32_t min_timeout = FlowTimeoutsMin();
799  const uint32_t pass_in_sec = min_timeout ? min_timeout * 8 : 60;
800 
801  /* don't start our activities until time is setup */
802  while (!TimeModeIsReady()) {
803  if (suricata_ctl_flags != 0)
804  return TM_ECODE_OK;
805  }
806 
807  SCLogDebug("FM %s/%d starting. min_timeout %us. Full hash pass in %us", th_v->name,
808  ftd->instance, min_timeout, pass_in_sec);
809 
810 #ifdef FM_PROFILE
811  struct timeval endts;
812  struct timeval active;
813  struct timeval paused;
814  struct timeval sleeping;
815  memset(&endts, 0, sizeof(endts));
816  memset(&active, 0, sizeof(active));
817  memset(&paused, 0, sizeof(paused));
818  memset(&sleeping, 0, sizeof(sleeping));
819 #endif
820 
821  struct timeval startts;
822  memset(&startts, 0, sizeof(startts));
823  gettimeofday(&startts, NULL);
824 
825  uint32_t hash_pass_iter = 0;
826  uint32_t emerg_over_cnt = 0;
827  uint64_t next_run_ms = 0;
828 
829  while (1)
830  {
831  if (TmThreadsCheckFlag(th_v, THV_PAUSE)) {
833 #ifdef FM_PROFILE
834  struct timeval pause_startts;
835  memset(&pause_startts, 0, sizeof(pause_startts));
836  gettimeofday(&pause_startts, NULL);
837 #endif
839 #ifdef FM_PROFILE
840  struct timeval pause_endts;
841  memset(&pause_endts, 0, sizeof(pause_endts));
842  gettimeofday(&pause_endts, NULL);
843  struct timeval pause_time;
844  memset(&pause_time, 0, sizeof(pause_time));
845  timersub(&pause_endts, &pause_startts, &pause_time);
846  timeradd(&paused, &pause_time, &paused);
847 #endif
849  }
850 
851  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) {
852  emerg = true;
853  }
854 #ifdef FM_PROFILE
855  struct timeval run_startts;
856  memset(&run_startts, 0, sizeof(run_startts));
857  gettimeofday(&run_startts, NULL);
858 #endif
859  /* Get the time */
860  memset(&ts, 0, sizeof(ts));
861  TimeGet(&ts);
862  SCLogDebug("ts %" PRIdMAX "", (intmax_t)ts.tv_sec);
863  const uint64_t ts_ms = ts.tv_sec * 1000 + ts.tv_usec / 1000;
864  const uint32_t rt = (uint32_t)ts.tv_sec;
865  const bool emerge_p = (emerg && !prev_emerg);
866  if (emerge_p) {
867  next_run_ms = 0;
868  prev_emerg = true;
869  SCLogNotice("Flow emergency mode entered...");
870  StatsIncr(th_v, ftd->cnt.flow_emerg_mode_enter);
871  }
872  if (ts_ms >= next_run_ms) {
873  if (ftd->instance == 0) {
874  const uint32_t sq_len = FlowSpareGetPoolSize();
875  const uint32_t spare_perc = sq_len * 100 / flow_config.prealloc;
876  /* see if we still have enough spare flows */
877  if (spare_perc < 90 || spare_perc > 110) {
878  FlowSparePoolUpdate(sq_len);
879  }
880  }
881  const uint32_t secs_passed = rt - flow_last_sec;
882 
883  /* try to time out flows */
884  FlowTimeoutCounters counters = { 0, 0, 0, 0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
885 
886  if (emerg) {
887  /* in emergency mode, do a full pass of the hash table */
888  FlowTimeoutHash(&ftd->timeout, &ts, ftd->min, ftd->max, &counters);
889  hash_passes++;
890  hash_full_passes++;
891  hash_passes_chunks += 1;
892  hash_passes++;
893  hash_row_checks += counters.rows_checked;
894  StatsIncr(th_v, ftd->cnt.flow_mgr_full_pass);
895  } else {
896  /* non-emergency mode: scan part of the hash */
897  const uint32_t chunks = MIN(secs_passed, pass_in_sec);
898  for (uint32_t i = 0; i < chunks; i++) {
899  FlowTimeoutHashInChunks(&ftd->timeout, &ts, ftd->min, ftd->max,
900  &counters, hash_pass_iter, pass_in_sec);
901  hash_pass_iter++;
902  if (hash_pass_iter == pass_in_sec) {
903  hash_pass_iter = 0;
904  hash_full_passes++;
905  StatsIncr(th_v, ftd->cnt.flow_mgr_full_pass);
906  }
907  }
908  hash_passes++;
909  hash_row_checks += counters.rows_checked;
910  hash_passes_chunks += chunks;
911  }
912  flow_last_sec = rt;
913 
914  /*
915  StatsAddUI64(th_v, flow_mgr_host_prune, (uint64_t)hosts_pruned);
916  uint32_t hosts_active = HostGetActiveCount();
917  StatsSetUI64(th_v, flow_mgr_host_active, (uint64_t)hosts_active);
918  uint32_t hosts_spare = HostGetSpareCount();
919  StatsSetUI64(th_v, flow_mgr_host_spare, (uint64_t)hosts_spare);
920  */
921  StatsAddUI64(th_v, ftd->cnt.flow_mgr_cnt_clo, (uint64_t)counters.clo);
922  StatsAddUI64(th_v, ftd->cnt.flow_mgr_cnt_new, (uint64_t)counters.new);
923  StatsAddUI64(th_v, ftd->cnt.flow_mgr_cnt_est, (uint64_t)counters.est);
924  StatsAddUI64(th_v, ftd->cnt.flow_mgr_cnt_byp, (uint64_t)counters.byp);
925 
926  StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_checked, (uint64_t)counters.flows_checked);
927  StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_notimeout, (uint64_t)counters.flows_notimeout);
928 
929  StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_timeout, (uint64_t)counters.flows_timeout);
930  //StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_removed, (uint64_t)counters.flows_removed);
931  StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_timeout_inuse, (uint64_t)counters.flows_timeout_inuse);
932  StatsAddUI64(th_v, ftd->cnt.flow_mgr_flows_aside, (uint64_t)counters.flows_aside);
934 
935  StatsAddUI64(th_v, ftd->cnt.flow_bypassed_cnt_clo, (uint64_t)counters.bypassed_count);
936  StatsAddUI64(th_v, ftd->cnt.flow_bypassed_pkts, (uint64_t)counters.bypassed_pkts);
937  StatsAddUI64(th_v, ftd->cnt.flow_bypassed_bytes, (uint64_t)counters.bypassed_bytes);
938 
939  StatsSetUI64(th_v, ftd->cnt.flow_mgr_rows_maxlen, (uint64_t)counters.rows_maxlen);
940  // TODO AVG MAXLEN
941  // TODO LOOKUP STEPS MAXLEN and AVG LEN
942  /* Don't fear, FlowManagerThread is here...
943  * clear emergency bit if we have at least xx flows pruned. */
944  uint32_t len = FlowSpareGetPoolSize();
945  StatsSetUI64(th_v, ftd->cnt.flow_mgr_spare, (uint64_t)len);
946  if (emerg == true) {
947  SCLogDebug("flow_sparse_q.len = %"PRIu32" prealloc: %"PRIu32
948  "flow_spare_q status: %"PRIu32"%% flows at the queue",
950 
951  /* only if we have pruned this "emergency_recovery" percentage
952  * of flows, we will unset the emergency bit */
954  emerg_over_cnt++;
955  } else {
956  emerg_over_cnt = 0;
957  }
958 
959  if (emerg_over_cnt >= 30) {
960  SC_ATOMIC_AND(flow_flags, ~FLOW_EMERGENCY);
962 
963  emerg = false;
964  prev_emerg = FALSE;
965  emerg_over_cnt = 0;
966  hash_pass_iter = 0;
967  SCLogNotice("Flow emergency mode over, back to normal... unsetting"
968  " FLOW_EMERGENCY bit (ts.tv_sec: %"PRIuMAX", "
969  "ts.tv_usec:%"PRIuMAX") flow_spare_q status(): %"PRIu32
970  "%% flows at the queue", (uintmax_t)ts.tv_sec,
971  (uintmax_t)ts.tv_usec, len * 100 / flow_config.prealloc);
972 
973  StatsIncr(th_v, ftd->cnt.flow_emerg_mode_over);
974  }
975  }
976  next_run_ms = ts_ms + 667;
977  if (emerg)
978  next_run_ms = ts_ms + 250;
979  }
980  if (flow_last_sec == 0) {
981  flow_last_sec = rt;
982  }
983 
984  if (ftd->instance == 0 &&
985  (other_last_sec == 0 || other_last_sec < (uint32_t)ts.tv_sec)) {
987  //uint32_t hosts_pruned =
990  other_last_sec = (uint32_t)ts.tv_sec;
991  }
992 
993 
994 #ifdef FM_PROFILE
995  struct timeval run_endts;
996  memset(&run_endts, 0, sizeof(run_endts));
997  gettimeofday(&run_endts, NULL);
998  struct timeval run_time;
999  memset(&run_time, 0, sizeof(run_time));
1000  timersub(&run_endts, &run_startts, &run_time);
1001  timeradd(&active, &run_time, &active);
1002 #endif
1003 
1004  if (TmThreadsCheckFlag(th_v, THV_KILL)) {
1005  StatsSyncCounters(th_v);
1006  break;
1007  }
1008 
1009 #ifdef FM_PROFILE
1010  struct timeval sleep_startts;
1011  memset(&sleep_startts, 0, sizeof(sleep_startts));
1012  gettimeofday(&sleep_startts, NULL);
1013 #endif
1014  usleep(100);
1015 
1016 #ifdef FM_PROFILE
1017  struct timeval sleep_endts;
1018  memset(&sleep_endts, 0, sizeof(sleep_endts));
1019  gettimeofday(&sleep_endts, NULL);
1020 
1021  struct timeval sleep_time;
1022  memset(&sleep_time, 0, sizeof(sleep_time));
1023  timersub(&sleep_endts, &sleep_startts, &sleep_time);
1024  timeradd(&sleeping, &sleep_time, &sleeping);
1025 #endif
1026  SCLogDebug("woke up... %s", SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY ? "emergency":"");
1027 
1029  }
1030  SCLogPerf("%" PRIu32 " new flows, %" PRIu32 " established flows were "
1031  "timed out, %"PRIu32" flows in closed state", new_cnt,
1032  established_cnt, closing_cnt);
1033 
1034 #ifdef FM_PROFILE
1035  SCLogNotice("hash passes %u avg chunks %u full %u rows %u (rows/s %u)",
1036  hash_passes, hash_passes_chunks / (hash_passes ? hash_passes : 1),
1037  hash_full_passes, hash_row_checks,
1038  hash_row_checks / ((uint32_t)active.tv_sec?(uint32_t)active.tv_sec:1));
1039 
1040  gettimeofday(&endts, NULL);
1041  struct timeval total_run_time;
1042  timersub(&endts, &startts, &total_run_time);
1043 
1044  SCLogNotice("FM: active %u.%us out of %u.%us; sleeping %u.%us, paused %u.%us",
1045  (uint32_t)active.tv_sec, (uint32_t)active.tv_usec,
1046  (uint32_t)total_run_time.tv_sec, (uint32_t)total_run_time.tv_usec,
1047  (uint32_t)sleeping.tv_sec, (uint32_t)sleeping.tv_usec,
1048  (uint32_t)paused.tv_sec, (uint32_t)paused.tv_usec);
1049 #endif
1050  return TM_ECODE_OK;
1051 }
1052 
1053 /** \brief spawn the flow manager thread */
1055 {
1056  intmax_t setting = 1;
1057  (void)ConfGetInt("flow.managers", &setting);
1058 
1059  if (setting < 1 || setting > 1024) {
1061  "invalid flow.managers setting %"PRIdMAX, setting);
1062  }
1063  flowmgr_number = (uint32_t)setting;
1064 
1065  SCLogConfig("using %u flow manager threads", flowmgr_number);
1066  StatsRegisterGlobalCounter("flow.memuse", FlowGetMemuse);
1067 
1068  for (uint32_t u = 0; u < flowmgr_number; u++) {
1069  char name[TM_THREAD_NAME_MAX];
1070  snprintf(name, sizeof(name), "%s#%02u", thread_name_flow_mgr, u+1);
1071 
1072  ThreadVars *tv_flowmgr = TmThreadCreateMgmtThreadByName(name,
1073  "FlowManager", 0);
1074  BUG_ON(tv_flowmgr == NULL);
1075 
1076  if (tv_flowmgr == NULL) {
1077  FatalError(SC_ERR_FATAL, "flow manager thread creation failed");
1078  }
1079  if (TmThreadSpawn(tv_flowmgr) != TM_ECODE_OK) {
1080  FatalError(SC_ERR_FATAL, "flow manager thread spawn failed");
1081  }
1082  }
1083  return;
1084 }
1085 
1086 typedef struct FlowRecyclerThreadData_ {
1089 
1090 static TmEcode FlowRecyclerThreadInit(ThreadVars *t, const void *initdata, void **data)
1091 {
1093  if (ftd == NULL)
1094  return TM_ECODE_FAILED;
1095  if (OutputFlowLogThreadInit(t, NULL, &ftd->output_thread_data) != TM_ECODE_OK) {
1096  SCLogError(SC_ERR_THREAD_INIT, "initializing flow log API for thread failed");
1097  SCFree(ftd);
1098  return TM_ECODE_FAILED;
1099  }
1100  SCLogDebug("output_thread_data %p", ftd->output_thread_data);
1101 
1102  *data = ftd;
1103  return TM_ECODE_OK;
1104 }
1105 
1106 static TmEcode FlowRecyclerThreadDeinit(ThreadVars *t, void *data)
1107 {
1109  if (ftd->output_thread_data != NULL)
1111 
1112  SCFree(data);
1113  return TM_ECODE_OK;
1114 }
1115 
1116 /** \brief Thread that manages timed out flows.
1117  *
1118  * \param td ThreadVars casted to void ptr
1119  */
1120 static TmEcode FlowRecycler(ThreadVars *th_v, void *thread_data)
1121 {
1122  struct timeval ts;
1123  uint64_t recycled_cnt = 0;
1124  FlowRecyclerThreadData *ftd = (FlowRecyclerThreadData *)thread_data;
1125  BUG_ON(ftd == NULL);
1126 
1127  memset(&ts, 0, sizeof(ts));
1128  uint32_t fr_passes = 0;
1129 
1130 #ifdef FM_PROFILE
1131  struct timeval endts;
1132  struct timeval active;
1133  struct timeval paused;
1134  struct timeval sleeping;
1135  memset(&endts, 0, sizeof(endts));
1136  memset(&active, 0, sizeof(active));
1137  memset(&paused, 0, sizeof(paused));
1138  memset(&sleeping, 0, sizeof(sleeping));
1139 #endif
1140  struct timeval startts;
1141  memset(&startts, 0, sizeof(startts));
1142  gettimeofday(&startts, NULL);
1143 
1144  while (1)
1145  {
1146  if (TmThreadsCheckFlag(th_v, THV_PAUSE)) {
1148 #ifdef FM_PROFILE
1149  struct timeval pause_startts;
1150  memset(&pause_startts, 0, sizeof(pause_startts));
1151  gettimeofday(&pause_startts, NULL);
1152 #endif
1154 
1155 #ifdef FM_PROFILE
1156  struct timeval pause_endts;
1157  memset(&pause_endts, 0, sizeof(pause_endts));
1158  gettimeofday(&pause_endts, NULL);
1159 
1160  struct timeval pause_time;
1161  memset(&pause_time, 0, sizeof(pause_time));
1162  timersub(&pause_endts, &pause_startts, &pause_time);
1163  timeradd(&paused, &pause_time, &paused);
1164 #endif
1166  }
1167  fr_passes++;
1168 #ifdef FM_PROFILE
1169  struct timeval run_startts;
1170  memset(&run_startts, 0, sizeof(run_startts));
1171  gettimeofday(&run_startts, NULL);
1172 #endif
1173  SC_ATOMIC_ADD(flowrec_busy,1);
1175 
1176  const int bail = (TmThreadsCheckFlag(th_v, THV_KILL));
1177 
1178  /* Get the time */
1179  memset(&ts, 0, sizeof(ts));
1180  TimeGet(&ts);
1181  SCLogDebug("ts %" PRIdMAX "", (intmax_t)ts.tv_sec);
1182 
1183  Flow *f;
1184  while ((f = FlowQueuePrivateGetFromTop(&list)) != NULL) {
1185  Recycler(th_v, ftd->output_thread_data, f);
1186  recycled_cnt++;
1187  }
1188  SC_ATOMIC_SUB(flowrec_busy,1);
1189 
1190 #ifdef FM_PROFILE
1191  struct timeval run_endts;
1192  memset(&run_endts, 0, sizeof(run_endts));
1193  gettimeofday(&run_endts, NULL);
1194 
1195  struct timeval run_time;
1196  memset(&run_time, 0, sizeof(run_time));
1197  timersub(&run_endts, &run_startts, &run_time);
1198  timeradd(&active, &run_time, &active);
1199 #endif
1200 
1201  if (bail) {
1202  break;
1203  }
1204 
1205 #ifdef FM_PROFILE
1206  struct timeval sleep_startts;
1207  memset(&sleep_startts, 0, sizeof(sleep_startts));
1208  gettimeofday(&sleep_startts, NULL);
1209 #endif
1210  usleep(100);
1211 #ifdef FM_PROFILE
1212  struct timeval sleep_endts;
1213  memset(&sleep_endts, 0, sizeof(sleep_endts));
1214  gettimeofday(&sleep_endts, NULL);
1215  struct timeval sleep_time;
1216  memset(&sleep_time, 0, sizeof(sleep_time));
1217  timersub(&sleep_endts, &sleep_startts, &sleep_time);
1218  timeradd(&sleeping, &sleep_time, &sleeping);
1219 #endif
1220 
1221  SCLogDebug("woke up...");
1222 
1224  }
1225  StatsSyncCounters(th_v);
1226 #ifdef FM_PROFILE
1227  gettimeofday(&endts, NULL);
1228  struct timeval total_run_time;
1229  timersub(&endts, &startts, &total_run_time);
1230  SCLogNotice("FR: active %u.%us out of %u.%us; sleeping %u.%us, paused %u.%us",
1231  (uint32_t)active.tv_sec, (uint32_t)active.tv_usec,
1232  (uint32_t)total_run_time.tv_sec, (uint32_t)total_run_time.tv_usec,
1233  (uint32_t)sleeping.tv_sec, (uint32_t)sleeping.tv_usec,
1234  (uint32_t)paused.tv_sec, (uint32_t)paused.tv_usec);
1235 
1236  SCLogNotice("FR passes %u passes/s %u", fr_passes,
1237  (uint32_t)fr_passes/((uint32_t)active.tv_sec?(uint32_t)active.tv_sec:1));
1238 #endif
1239  SCLogPerf("%"PRIu64" flows processed", recycled_cnt);
1240  return TM_ECODE_OK;
1241 }
1242 
1243 static bool FlowRecyclerReadyToShutdown(void)
1244 {
1245  if (SC_ATOMIC_GET(flowrec_busy) != 0) {
1246  return false;
1247  }
1248  uint32_t len = 0;
1250  len = flow_recycle_q.qlen;
1252 
1253  return ((len == 0));
1254 }
1255 
1256 /** \brief spawn the flow recycler thread */
1258 {
1259  intmax_t setting = 1;
1260  (void)ConfGetInt("flow.recyclers", &setting);
1261 
1262  if (setting < 1 || setting > 1024) {
1264  "invalid flow.recyclers setting %"PRIdMAX, setting);
1265  }
1266  flowrec_number = (uint32_t)setting;
1267 
1268  SCLogConfig("using %u flow recycler threads", flowrec_number);
1269 
1270  for (uint32_t u = 0; u < flowrec_number; u++) {
1271  char name[TM_THREAD_NAME_MAX];
1272  snprintf(name, sizeof(name), "%s#%02u", thread_name_flow_rec, u+1);
1273 
1274  ThreadVars *tv_flowrec = TmThreadCreateMgmtThreadByName(name,
1275  "FlowRecycler", 0);
1276 
1277  if (tv_flowrec == NULL) {
1278  FatalError(SC_ERR_FATAL, "flow recycler thread creation failed");
1279  }
1280  if (TmThreadSpawn(tv_flowrec) != TM_ECODE_OK) {
1281  FatalError(SC_ERR_FATAL, "flow recycler thread spawn failed");
1282  }
1283  }
1284  return;
1285 }
1286 
1287 /**
1288  * \brief Used to disable flow recycler thread(s).
1289  *
1290  * \note this should only be called when the flow manager is already gone
1291  *
1292  * \todo Kinda hackish since it uses the tv name to identify flow recycler
1293  * thread. We need an all weather identification scheme.
1294  */
1296 {
1297  int cnt = 0;
1298 
1299  /* move all flows still in the hash to the recycler queue */
1300 #ifndef DEBUG
1301  (void)FlowCleanupHash();
1302 #else
1303  uint32_t flows = FlowCleanupHash();
1304  SCLogDebug("flows to progress: %u", flows);
1305 #endif
1306 
1307  /* make sure all flows are processed */
1308  do {
1309  usleep(10);
1310  } while (FlowRecyclerReadyToShutdown() == false);
1311 
1313  /* flow recycler thread(s) is/are a part of mgmt threads */
1314  for (ThreadVars *tv = tv_root[TVT_MGMT]; tv != NULL; tv = tv->next) {
1315  if (strncasecmp(tv->name, thread_name_flow_rec,
1316  strlen(thread_name_flow_rec)) == 0)
1317  {
1319  cnt++;
1320  }
1321  }
1323 
1324  struct timeval start_ts;
1325  struct timeval cur_ts;
1326  gettimeofday(&start_ts, NULL);
1327 
1328 again:
1329  gettimeofday(&cur_ts, NULL);
1330  if ((cur_ts.tv_sec - start_ts.tv_sec) > 60) {
1331  FatalError(SC_ERR_SHUTDOWN, "unable to get all flow recycler "
1332  "threads to shutdown in time");
1333  }
1334 
1336  for (ThreadVars *tv = tv_root[TVT_MGMT]; tv != NULL; tv = tv->next) {
1337  if (strncasecmp(tv->name, thread_name_flow_rec,
1338  strlen(thread_name_flow_rec)) == 0)
1339  {
1342  /* sleep outside lock */
1343  SleepMsec(1);
1344  goto again;
1345  }
1346  }
1347  }
1349 
1350  /* reset count, so we can kill and respawn (unix socket) */
1351  SC_ATOMIC_SET(flowrec_cnt, 0);
1352  return;
1353 }
1354 
1356 {
1357  tmm_modules[TMM_FLOWMANAGER].name = "FlowManager";
1358  tmm_modules[TMM_FLOWMANAGER].ThreadInit = FlowManagerThreadInit;
1359  tmm_modules[TMM_FLOWMANAGER].ThreadDeinit = FlowManagerThreadDeinit;
1360  tmm_modules[TMM_FLOWMANAGER].Management = FlowManager;
1363  SCLogDebug("%s registered", tmm_modules[TMM_FLOWMANAGER].name);
1364 
1365  SC_ATOMIC_INIT(flowmgr_cnt);
1366  SC_ATOMIC_INITPTR(flow_timeouts);
1367 }
1368 
1370 {
1371  tmm_modules[TMM_FLOWRECYCLER].name = "FlowRecycler";
1372  tmm_modules[TMM_FLOWRECYCLER].ThreadInit = FlowRecyclerThreadInit;
1373  tmm_modules[TMM_FLOWRECYCLER].ThreadDeinit = FlowRecyclerThreadDeinit;
1374  tmm_modules[TMM_FLOWRECYCLER].Management = FlowRecycler;
1377  SCLogDebug("%s registered", tmm_modules[TMM_FLOWRECYCLER].name);
1378 
1379  SC_ATOMIC_INIT(flowrec_cnt);
1380  SC_ATOMIC_INIT(flowrec_busy);
1381 }
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:67
FlowTimeoutCounters_::rows_empty
uint32_t rows_empty
Definition: flow-manager.c:117
FlowSparePoolUpdate
void FlowSparePoolUpdate(uint32_t size)
Definition: flow-spare-pool.c:172
util-byte.h
tm-threads.h
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:436
OutputFlowLog
TmEcode OutputFlowLog(ThreadVars *tv, void *thread_data, Flow *f)
Run flow logger(s)
Definition: output-flow.c:91
len
uint8_t len
Definition: app-layer-dnp3.h:2
ts
uint64_t ts
Definition: source-erf-file.c:54
TmThreadSpawn
TmEcode TmThreadSpawn(ThreadVars *tv)
Spawns a thread associated with the ThreadVars instance tv.
Definition: tm-threads.c:1708
FlowTimeoutCounters
Definition: flow-worker.c:54
FlowForceReassemblyForFlow
void FlowForceReassemblyForFlow(Flow *f)
Definition: flow-timeout.c:348
TmThreadCreateMgmtThreadByName
ThreadVars * TmThreadCreateMgmtThreadByName(const char *name, const char *module, int mucond)
Creates and returns the TV instance for a Management thread(MGMT). This function supports only custom...
Definition: tm-threads.c:1123
run_mode
int run_mode
Definition: suricata.c:201
FlowBucket_::evicted
Flow * evicted
Definition: flow-hash.h:46
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
FLOW_IS_IPV6
#define FLOW_IS_IPV6(f)
Definition: flow.h:154
FlowManagerThreadData_::max
uint32_t max
Definition: flow-manager.c:679
FlowManagerTimeoutThread
Definition: flow-manager.c:311
FlowSparePoolReturnFlow
void FlowSparePoolReturnFlow(Flow *f)
Definition: flow-spare-pool.c:101
ThreadVars_::name
char name[16]
Definition: threadvars.h:65
thread_name_flow_mgr
const char * thread_name_flow_mgr
Definition: runmodes.c:68
FlowSpareGetPoolSize
uint32_t FlowSpareGetPoolSize(void)
Definition: flow-spare-pool.c:48
flow-util.h
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:315
FlowManagerThreadData_::cnt
FlowCounters cnt
Definition: flow-manager.c:681
FBLOCK_LOCK
#define FBLOCK_LOCK(fb)
Definition: flow-hash.h:71
TMM_FLOWRECYCLER
@ TMM_FLOWRECYCLER
Definition: tm-threads-common.h:69
stream-tcp.h
FlowBypassInfo_
Definition: flow.h:519
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:294
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:285
FlowManagerThreadData_::instance
uint32_t instance
Definition: flow-manager.c:677
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
TmThreadsSetFlag
void TmThreadsSetFlag(ThreadVars *tv, uint32_t flag)
Set a thread flag.
Definition: tm-threads.c:97
StatsRegisterGlobalCounter
uint16_t StatsRegisterGlobalCounter(const char *name, uint64_t(*Func)(void))
Registers a counter, which represents a global value.
Definition: counters.c:997
Flow_::proto
uint8_t proto
Definition: flow.h:365
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(uint32_t, flowmgr_cnt)
threads.h
flow-private.h
FlowCounters_::flow_mgr_flows_notimeout
uint16_t flow_mgr_flows_notimeout
Definition: flow-manager.c:663
Flow_
Flow data structure.
Definition: flow.h:347
TYPE
#define TYPE
Flow_::protomap
uint8_t protomap
Definition: flow.h:445
SC_ATOMIC_EXTERN
SC_ATOMIC_EXTERN(unsigned int, flow_flags)
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
thread_name_flow_rec
const char * thread_name_flow_rec
Definition: runmodes.c:69
FlowProtoTimeout_
Definition: flow.h:508
StatsSetUI64
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
Definition: counters.c:191
flow-hash.h
TmModuleFlowRecyclerRegister
void TmModuleFlowRecyclerRegister(void)
Definition: flow-manager.c:1369
FlowTimeoutCounters_::flows_removed
uint32_t flows_removed
Definition: flow-manager.c:125
Flow_::use_cnt
FlowRefCount use_cnt
Definition: flow.h:373
FlowBypassInfo_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:524
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:136
MIN
#define MIN(x, y)
Definition: suricata-common.h:377
FBLOCK_TRYLOCK
#define FBLOCK_TRYLOCK(fb)
Definition: flow-hash.h:72
tv_root
ThreadVars * tv_root[TVT_MAX]
Definition: tm-threads.c:78
FlowTimeoutCounters_::flows_timeout
uint32_t flows_timeout
Definition: flow-manager.c:123
util-privs.h
defrag-timeout.h
stream-tcp-reassemble.h
StatsSyncCountersIfSignalled
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:137
FlowCounters_::flow_mgr_flows_timeout_inuse
uint16_t flow_mgr_flows_timeout_inuse
Definition: flow-manager.c:665
m
SCMutex m
Definition: flow-hash.h:6
LiveDevSubBypassStats
void LiveDevSubBypassStats(LiveDevice *dev, uint64_t cnt, int family)
Definition: util-device.c:561
SC_ERR_SHUTDOWN
@ SC_ERR_SHUTDOWN
Definition: util-error.h:220
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
FlowQueuePrivate_::len
uint32_t len
Definition: flow-queue.h:44
FlowCounters_
Definition: flow-manager.c:652
FlowManagerTimeoutThread
struct FlowManagerTimeoutThread FlowManagerTimeoutThread
SC_ERR_INVALID_ARGUMENTS
@ SC_ERR_INVALID_ARGUMENTS
Definition: util-error.h:82
FlowCounters_::flow_mgr_flows_aside
uint16_t flow_mgr_flows_aside
Definition: flow-manager.c:666
FLOW_TIMEOUT_REASSEMBLY_DONE
#define FLOW_TIMEOUT_REASSEMBLY_DONE
Definition: flow.h:92
util-unittest.h
FlowTimeoutCounters_::bypassed_count
uint32_t bypassed_count
Definition: flow-manager.c:129
THV_PAUSE
#define THV_PAUSE
Definition: threadvars.h:39
TM_THREAD_NAME_MAX
#define TM_THREAD_NAME_MAX
Definition: tm-threads.h:48
util-unittest-helper.h
TVT_MGMT
@ TVT_MGMT
Definition: tm-threads-common.h:88
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:287
FlowQueueTimeoutCounters::flows_removed
uint32_t flows_removed
Definition: flow-manager.c:646
FLOWLOCK_UNLOCK
#define FLOWLOCK_UNLOCK(fb)
Definition: flow.h:264
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
PacketPoolInit
void PacketPoolInit(void)
Definition: tmqh-packetpool.c:302
FlowCounters_::flow_mgr_cnt_new
uint16_t flow_mgr_cnt_new
Definition: flow-manager.c:655
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:412
FQLOCK_LOCK
#define FQLOCK_LOCK(q)
Definition: flow-queue.h:73
FlowDisableFlowRecyclerThread
void FlowDisableFlowRecyclerThread(void)
Used to disable flow recycler thread(s).
Definition: flow-manager.c:1295
FlowCounters_::flow_mgr_cnt_byp
uint16_t flow_mgr_cnt_byp
Definition: flow-manager.c:657
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
FlowTimeoutCounters_::rows_maxlen
uint32_t rows_maxlen
Definition: flow-manager.c:119
FlowCounters_::flow_bypassed_bytes
uint16_t flow_bypassed_bytes
Definition: flow-manager.c:673
FlowTimeoutCounters_::flows_checked
uint32_t flows_checked
Definition: flow-manager.c:121
THV_RUNNING_DONE
#define THV_RUNNING_DONE
Definition: threadvars.h:47
TmThreadsUnsetFlag
void TmThreadsUnsetFlag(ThreadVars *tv, uint32_t flag)
Unset a thread flag.
Definition: tm-threads.c:105
util-signal.h
SC_ERR_THREAD_INIT
@ SC_ERR_THREAD_INIT
Definition: util-error.h:79
flow-spare-pool.h
FlowTimeoutCounters_::byp
uint32_t byp
Definition: flow-manager.c:113
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:488
FlowCounters_::flow_mgr_full_pass
uint16_t flow_mgr_full_pass
Definition: flow-manager.c:653
StatsRegisterMaxCounter
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
Definition: counters.c:979
SC_ATOMIC_MEMORY_ORDER_RELAXED
#define SC_ATOMIC_MEMORY_ORDER_RELAXED
Definition: util-atomic.h:166
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:502
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:76
decode.h
util-debug.h
FlowBypassInfo_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:526
DefragTimeoutHash
uint32_t DefragTimeoutHash(struct timeval *ts)
time out tracker from the hash
Definition: defrag-timeout.c:119
FlowBypassInfo_::BypassUpdate
bool(* BypassUpdate)(Flow *f, void *data, time_t tsec)
Definition: flow.h:520
OutputFlowLogThreadInit
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void *initdata, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
Definition: output-flow.c:131
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
FlowCounters_::flow_mgr_rows_maxlen
uint16_t flow_mgr_rows_maxlen
Definition: flow-manager.c:669
FLOWLOCK_WRLOCK
#define FLOWLOCK_WRLOCK(fb)
Definition: flow.h:261
FlowTimeoutsReset
#define FlowTimeoutsReset()
Definition: flow-manager.h:27
FlowForceReassemblyNeedReassembly
int FlowForceReassemblyNeedReassembly(Flow *f)
Check if a flow needs forced reassembly, or any other processing.
Definition: flow-timeout.c:294
FlowDisableFlowManagerThread
void FlowDisableFlowManagerThread(void)
Used to disable flow manager thread(s).
Definition: flow-manager.c:140
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
TmThreadTestThreadUnPaused
void TmThreadTestThreadUnPaused(ThreadVars *tv)
Tests if the thread represented in the arg has been unpaused or not.
Definition: tm-threads.c:1789
TmModule_::Management
TmEcode(* Management)(ThreadVars *, void *)
Definition: tm-modules.h:59
TimeModeIsReady
bool TimeModeIsReady(void)
Definition: util-time.c:90
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:447
THV_KILL
#define THV_KILL
Definition: threadvars.h:41
FlowBypassInfo_::todstpktcnt
uint64_t todstpktcnt
Definition: flow.h:525
util-time.h
FlowQueuePrivateGetFromTop
Flow * FlowQueuePrivateGetFromTop(FlowQueuePrivate *fqc)
Definition: flow-queue.c:152
FlowBypassInfo_::bypass_data
void * bypass_data
Definition: flow.h:522
FlowQueueAppendPrivate
void FlowQueueAppendPrivate(FlowQueue *fq, FlowQueuePrivate *fqc)
Definition: flow-queue.c:120
FlowQueueTimeoutCounters
struct FlowQueueTimeoutCounters FlowQueueTimeoutCounters
FlowCounters_::flow_mgr_flows_aside_needs_work
uint16_t flow_mgr_flows_aside_needs_work
Definition: flow-manager.c:667
app-layer-parser.h
ThreadVars_::next
struct ThreadVars_ * next
Definition: threadvars.h:123
FlowRecyclerThreadData_
Definition: flow-manager.c:1086
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:282
FLOW_IS_IPV4
#define FLOW_IS_IPV4(f)
Definition: flow.h:152
FlowCounters_::flow_bypassed_cnt_clo
uint16_t flow_bypassed_cnt_clo
Definition: flow-manager.c:671
tv_root_lock
SCMutex tv_root_lock
Definition: tm-threads.c:81
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:342
FALSE
#define FALSE
Definition: suricata-common.h:34
flow_timeouts_emerg
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow.c:94
stream.h
FlowTimeoutsEmergency
void FlowTimeoutsEmergency(void)
Definition: flow-manager.c:96
FlowTimeoutCounters
struct FlowTimeoutCounters_ FlowTimeoutCounters
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
FlowManagerThreadSpawn
void FlowManagerThreadSpawn()
spawn the flow manager thread
Definition: flow-manager.c:1054
stream-tcp-private.h
conf.h
FlowRecyclerThreadData_::output_thread_data
void * output_thread_data
Definition: flow-manager.c:1087
FlowTimeoutCounters_::rows_checked
uint32_t rows_checked
Definition: flow-manager.c:115
FBLOCK_UNLOCK
#define FBLOCK_UNLOCK(fb)
Definition: flow-hash.h:73
TmEcode
TmEcode
Definition: tm-threads-common.h:79
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1060
flow_timeouts_delta
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Definition: flow.c:95
output-flow.h
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
flow-timeout.h
g_detect_disabled
int g_detect_disabled
Definition: suricata.c:215
FlowCounters_::flow_mgr_cnt_est
uint16_t flow_mgr_cnt_est
Definition: flow-manager.c:656
flow-queue.h
TmModule_::name
const char * name
Definition: tm-modules.h:44
FlowRecyclerThreadData
struct FlowRecyclerThreadData_ FlowRecyclerThreadData
FlowBypassInfo_::tosrcpktcnt
uint64_t tosrcpktcnt
Definition: flow.h:523
host-timeout.h
FlowRecyclerThreadSpawn
void FlowRecyclerThreadSpawn()
spawn the flow recycler thread
Definition: flow-manager.c:1257
runmodes.h
FlowTimeoutCounters_::flows_aside_needs_work
uint32_t flows_aside_needs_work
Definition: flow-manager.c:127
Flow_::next
struct Flow_ * next
Definition: flow.h:394
FlowQueue_
Definition: flow-queue.h:49
FlowCounters_::flow_bypassed_pkts
uint16_t flow_bypassed_pkts
Definition: flow-manager.c:672
TMM_FLOWMANAGER
@ TMM_FLOWMANAGER
Definition: tm-threads-common.h:68
THV_PAUSED
#define THV_PAUSED
Definition: threadvars.h:40
HostTimeoutHash
uint32_t HostTimeoutHash(struct timeval *ts)
time out hosts from the hash
Definition: host-timeout.c:156
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:70
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:56
FlowQueueExtractPrivate
FlowQueuePrivate FlowQueueExtractPrivate(FlowQueue *fq)
Definition: flow-queue.c:141
flow-storage.h
FlowTimeoutCounters_::rows_busy
uint32_t rows_busy
Definition: flow-manager.c:118
FlowTimeoutCounters_
Definition: flow-manager.c:109
FlowManagerThreadData_
Definition: flow-manager.c:676
SleepMsec
#define SleepMsec(msec)
Definition: tm-threads.h:44
flow-manager.h
suricata-common.h
FlowManagerThreadData
struct FlowManagerThreadData_ FlowManagerThreadData
flow_config
FlowConfig flow_config
Definition: flow.c:98
FlowQueueTimeoutCounters::flows_timeout
uint32_t flows_timeout
Definition: flow-manager.c:647
TmModuleFlowManagerRegister
void TmModuleFlowManagerRegister(void)
Definition: flow-manager.c:1355
SCLogPerf
#define SCLogPerf(...)
Definition: util-debug.h:224
FlowTimeoutsInit
void FlowTimeoutsInit(void)
Definition: flow-manager.c:91
SC_ATOMIC_LOAD_EXPLICIT
#define SC_ATOMIC_LOAD_EXPLICIT(name, order)
Definition: util-atomic.h:379
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
FlowTimeoutCounters_::est
uint32_t est
Definition: flow-manager.c:111
Flow_::livedev
struct LiveDevice_ * livedev
Definition: flow.h:396
threadvars.h
util-validate.h
FlowQueuePrivate_
Definition: flow-queue.h:41
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:148
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FlowTimeoutCounters_::bypassed_bytes
uint64_t bypassed_bytes
Definition: flow-manager.c:131
FlowManagerThreadData_::min
uint32_t min
Definition: flow-manager.c:678
FlowCounters_::flow_mgr_cnt_clo
uint16_t flow_mgr_cnt_clo
Definition: flow-manager.c:654
OutputFlowLogThreadDeinit
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output-flow.c:173
flow_recycle_q
FlowQueue flow_recycle_q
Definition: flow-manager.c:77
SCFree
#define SCFree(p)
Definition: util-mem.h:61
FlowTimeoutCounters_::bypassed_pkts
uint64_t bypassed_pkts
Definition: flow-manager.c:130
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
Flow_::flags
uint32_t flags
Definition: flow.h:421
SC_ATOMIC_INITPTR
#define SC_ATOMIC_INITPTR(name)
Definition: util-atomic.h:318
FlowManagerThreadData_::timeout
FlowManagerTimeoutThread timeout
Definition: flow-manager.c:683
util-random.h
FlowCounters
struct FlowCounters_ FlowCounters
FlowCounters_::flow_emerg_mode_enter
uint16_t flow_emerg_mode_enter
Definition: flow-manager.c:659
TimeGet
void TimeGet(struct timeval *tv)
Definition: util-time.c:153
FlowGetStorageById
void * FlowGetStorageById(Flow *f, int id)
Definition: flow-storage.c:39
FLOW_END_FLAG_SHUTDOWN
#define FLOW_END_FLAG_SHUTDOWN
Definition: flow.h:236
FLOW_EMERGENCY
#define FLOW_EMERGENCY
Definition: flow-private.h:37
IPPairTimeoutHash
uint32_t IPPairTimeoutHash(struct timeval *ts)
time out ippairs from the hash
Definition: ippair-timeout.c:142
suricata.h
ippair-timeout.h
FlowCounters_::flow_mgr_flows_timeout
uint16_t flow_mgr_flows_timeout
Definition: flow-manager.c:664
FlowManagerTimeoutThread::aside_queue
FlowQueuePrivate aside_queue
Definition: flow-manager.c:314
StatsSyncCounters
#define StatsSyncCounters(tv)
Definition: counters.h:134
FlowTimeoutCounters_::flows_notimeout
uint32_t flows_notimeout
Definition: flow-manager.c:122
flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:93
FlowCounters_::flow_mgr_spare
uint16_t flow_mgr_spare
Definition: flow-manager.c:658
FlowTimeoutCounters_::flows_aside
uint32_t flows_aside
Definition: flow-manager.c:126
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
PacketPoolDestroy
void PacketPoolDestroy(void)
Definition: tmqh-packetpool.c:335
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:71
FlowTimeoutCounters_::clo
uint32_t clo
Definition: flow-manager.c:112
flow.h
FlowQueuePrivateAppendFlow
void FlowQueuePrivateAppendFlow(FlowQueuePrivate *fqc, Flow *f)
Definition: flow-queue.c:66
TmThreadsCheckFlag
int TmThreadsCheckFlag(ThreadVars *tv, uint32_t flag)
Check if a thread flag is set.
Definition: tm-threads.c:89
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:232
GetFlowBypassInfoID
int GetFlowBypassInfoID(void)
Definition: flow-util.c:218
evicted
Flow * evicted
Definition: flow-hash.h:4
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:939
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
BITS
#define BITS
FlowTimeoutCounters_::flows_timeout_inuse
uint32_t flows_timeout_inuse
Definition: flow-manager.c:124
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:389
flow-var.h
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:70
SC_ATOMIC_AND
#define SC_ATOMIC_AND(name, val)
Bitwise AND a value to our atomic variable.
Definition: util-atomic.h:360
FlowCounters_::flow_emerg_mode_over
uint16_t flow_emerg_mode_over
Definition: flow-manager.c:660
TM_FLAG_MANAGEMENT_TM
#define TM_FLAG_MANAGEMENT_TM
Definition: tm-modules.h:36
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:198
FlowTimeoutCounters_::rows_skipped
uint32_t rows_skipped
Definition: flow-manager.c:116
FlowCounters_::flow_mgr_flows_checked
uint16_t flow_mgr_flows_checked
Definition: flow-manager.c:662
FlowQueueTimeoutCounters
Definition: flow-manager.c:645
FlowTimeoutCounters::flows_aside_needs_work
uint32_t flows_aside_needs_work
Definition: flow-worker.c:55
FQLOCK_UNLOCK
#define FQLOCK_UNLOCK(q)
Definition: flow-queue.h:75