suricata
flow-timeout.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "suricata.h"
26 #include "decode.h"
27 #include "conf.h"
28 #include "threadvars.h"
29 #include "tm-threads.h"
30 #include "runmodes.h"
31 
32 #include "util-random.h"
33 #include "util-time.h"
34 
35 #include "flow.h"
36 #include "flow-queue.h"
37 #include "flow-hash.h"
38 #include "flow-util.h"
39 #include "flow-var.h"
40 #include "flow-private.h"
41 #include "flow-manager.h"
42 #include "flow-timeout.h"
43 #include "pkt-var.h"
44 #include "host.h"
45 
46 #include "stream-tcp-private.h"
47 #include "stream-tcp-reassemble.h"
48 #include "stream-tcp.h"
49 
50 #include "util-unittest.h"
51 #include "util-unittest-helper.h"
52 #include "util-byte.h"
53 
54 #include "util-debug.h"
55 #include "util-privs.h"
56 #include "util-datalink.h"
57 
58 #include "detect.h"
59 #include "detect-engine-state.h"
60 #include "stream.h"
61 
62 #include "app-layer-parser.h"
63 #include "app-layer.h"
64 
65 #include "util-profiling.h"
66 
67 /**
68  * \internal
69  * \brief Pseudo packet setup for flow forced reassembly.
70  *
71  * \param direction Direction of the packet. 0 indicates toserver and 1
72  * indicates toclient.
73  * \param f Pointer to the flow.
74  * \param ssn Pointer to the tcp session.
75  * \param dummy Indicates to create a dummy pseudo packet. Not all pseudo
76  * packets need to force reassembly, in which case we just
77  * set dummy ack/seq values.
78  */
79 static inline Packet *FlowForceReassemblyPseudoPacketSetup(Packet *p,
80  int direction,
81  Flow *f,
82  TcpSession *ssn)
83 {
84  const int orig_dir = direction;
85  p->tenant_id = f->tenant_id;
87  p->proto = IPPROTO_TCP;
88  FlowReference(&p->flow, f);
89  p->flags |= PKT_STREAM_EST;
90  p->flags |= PKT_STREAM_EOF;
91  p->flags |= PKT_HAS_FLOW;
93  p->vlan_id[0] = f->vlan_id[0];
94  p->vlan_id[1] = f->vlan_id[1];
95  p->vlan_idx = f->vlan_idx;
96  p->livedev = (struct LiveDevice_ *)f->livedev;
97 
99  DecodeSetNoPacketInspectionFlag(p);
100  }
101  if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
102  DecodeSetNoPayloadInspectionFlag(p);
103  }
104 
105  if (direction == 0)
107  else
110  p->payload = NULL;
111  p->payload_len = 0;
112 
113  /* apply reversed flow logic after setting direction to the packet */
114  direction ^= ((f->flags & FLOW_DIR_REVERSED) != 0);
115 
116  if (FLOW_IS_IPV4(f)) {
117  if (direction == 0) {
120  p->sp = f->sp;
121  p->dp = f->dp;
122  } else {
125  p->sp = f->dp;
126  p->dp = f->sp;
127  }
128 
129  /* Check if we have enough room in direct data. We need ipv4 hdr + tcp hdr.
130  * Force an allocation if it is not the case.
131  */
132  if (GET_PKT_DIRECT_MAX_SIZE(p) < 40) {
133  if (PacketCallocExtPkt(p, 40) == -1) {
134  goto error;
135  }
136  }
137  /* set the ip header */
138  p->ip4h = (IPV4Hdr *)GET_PKT_DATA(p);
139  /* version 4 and length 20 bytes for the tcp header */
140  p->ip4h->ip_verhl = 0x45;
141  p->ip4h->ip_tos = 0;
142  p->ip4h->ip_len = htons(40);
143  p->ip4h->ip_id = 0;
144  p->ip4h->ip_off = 0;
145  p->ip4h->ip_ttl = 64;
146  p->ip4h->ip_proto = IPPROTO_TCP;
147  //p->ip4h->ip_csum =
148  if (direction == 0) {
149  p->ip4h->s_ip_src.s_addr = f->src.addr_data32[0];
150  p->ip4h->s_ip_dst.s_addr = f->dst.addr_data32[0];
151  } else {
152  p->ip4h->s_ip_src.s_addr = f->dst.addr_data32[0];
153  p->ip4h->s_ip_dst.s_addr = f->src.addr_data32[0];
154  }
155 
156  /* set the tcp header */
157  p->tcph = (TCPHdr *)((uint8_t *)GET_PKT_DATA(p) + 20);
158 
159  SET_PKT_LEN(p, 40); /* ipv4 hdr + tcp hdr */
160 
161  } else if (FLOW_IS_IPV6(f)) {
162  if (direction == 0) {
165  p->sp = f->sp;
166  p->dp = f->dp;
167  } else {
170  p->sp = f->dp;
171  p->dp = f->sp;
172  }
173 
174  /* Check if we have enough room in direct data. We need ipv6 hdr + tcp hdr.
175  * Force an allocation if it is not the case.
176  */
177  if (GET_PKT_DIRECT_MAX_SIZE(p) < 60) {
178  if (PacketCallocExtPkt(p, 60) == -1) {
179  goto error;
180  }
181  }
182  /* set the ip header */
183  p->ip6h = (IPV6Hdr *)GET_PKT_DATA(p);
184  /* version 6 */
185  p->ip6h->s_ip6_vfc = 0x60;
186  p->ip6h->s_ip6_flow = 0;
187  p->ip6h->s_ip6_nxt = IPPROTO_TCP;
188  p->ip6h->s_ip6_plen = htons(20);
189  p->ip6h->s_ip6_hlim = 64;
190  if (direction == 0) {
191  p->ip6h->s_ip6_src[0] = f->src.addr_data32[0];
192  p->ip6h->s_ip6_src[1] = f->src.addr_data32[1];
193  p->ip6h->s_ip6_src[2] = f->src.addr_data32[2];
194  p->ip6h->s_ip6_src[3] = f->src.addr_data32[3];
195  p->ip6h->s_ip6_dst[0] = f->dst.addr_data32[0];
196  p->ip6h->s_ip6_dst[1] = f->dst.addr_data32[1];
197  p->ip6h->s_ip6_dst[2] = f->dst.addr_data32[2];
198  p->ip6h->s_ip6_dst[3] = f->dst.addr_data32[3];
199  } else {
200  p->ip6h->s_ip6_src[0] = f->dst.addr_data32[0];
201  p->ip6h->s_ip6_src[1] = f->dst.addr_data32[1];
202  p->ip6h->s_ip6_src[2] = f->dst.addr_data32[2];
203  p->ip6h->s_ip6_src[3] = f->dst.addr_data32[3];
204  p->ip6h->s_ip6_dst[0] = f->src.addr_data32[0];
205  p->ip6h->s_ip6_dst[1] = f->src.addr_data32[1];
206  p->ip6h->s_ip6_dst[2] = f->src.addr_data32[2];
207  p->ip6h->s_ip6_dst[3] = f->src.addr_data32[3];
208  }
209 
210  /* set the tcp header */
211  p->tcph = (TCPHdr *)((uint8_t *)GET_PKT_DATA(p) + 40);
212 
213  SET_PKT_LEN(p, 60); /* ipv6 hdr + tcp hdr */
214  }
215 
216  p->tcph->th_offx2 = 0x50;
217  p->tcph->th_flags |= TH_ACK;
218  p->tcph->th_win = 10;
219  p->tcph->th_urp = 0;
220 
221  /* to server */
222  if (orig_dir == 0) {
223  p->tcph->th_sport = htons(f->sp);
224  p->tcph->th_dport = htons(f->dp);
225 
226  p->tcph->th_seq = htonl(ssn->client.next_seq);
227  p->tcph->th_ack = htonl(ssn->server.last_ack);
228 
229  /* to client */
230  } else {
231  p->tcph->th_sport = htons(f->dp);
232  p->tcph->th_dport = htons(f->sp);
233 
234  p->tcph->th_seq = htonl(ssn->server.next_seq);
235  p->tcph->th_ack = htonl(ssn->client.last_ack);
236  }
237 
238  if (FLOW_IS_IPV4(f)) {
239  p->tcph->th_sum = TCPChecksum(p->ip4h->s_ip_addrs,
240  (uint16_t *)p->tcph, 20, 0);
241  /* calc ipv4 csum as we may log it and barnyard might reject
242  * a wrong checksum */
243  p->ip4h->ip_csum = IPV4Checksum((uint16_t *)p->ip4h,
244  IPV4_GET_RAW_HLEN(p->ip4h), 0);
245  } else if (FLOW_IS_IPV6(f)) {
246  p->tcph->th_sum = TCPChecksum(p->ip6h->s_ip6_addrs,
247  (uint16_t *)p->tcph, 20, 0);
248  }
249 
250  p->ts = TimeGet();
251 
252  if (direction == 0) {
253  if (f->alparser && !STREAM_HAS_SEEN_DATA(&ssn->client)) {
255  }
256  } else {
257  if (f->alparser && !STREAM_HAS_SEEN_DATA(&ssn->server)) {
259  }
260  }
261 
262  return p;
263 
264 error:
265  FlowDeReference(&p->flow);
266  return NULL;
267 }
268 
270  Flow *f,
271  TcpSession *ssn);
273  Flow *f,
274  TcpSession *ssn)
275 {
276  PacketPoolWait();
278  if (p == NULL) {
279  return NULL;
280  }
281 
283 
284  return FlowForceReassemblyPseudoPacketSetup(p, direction, f, ssn);
285 }
286 
287 /**
288  * \brief Check if a flow needs forced reassembly, or any other processing
289  *
290  * \param f *LOCKED* flow
291  *
292  * \retval 0 no
293  * \retval 1 yes
294  */
296 {
297 
298  if (f == NULL || f->protoctx == NULL) {
299  SCReturnInt(0);
300  }
301 
302  TcpSession *ssn = (TcpSession *)f->protoctx;
303  uint8_t client = StreamNeedsReassembly(ssn, STREAM_TOSERVER);
304  uint8_t server = StreamNeedsReassembly(ssn, STREAM_TOCLIENT);
305 
306  /* if state is not fully closed we assume that we haven't fully
307  * inspected the app layer state yet */
308  if (ssn->state >= TCP_ESTABLISHED && ssn->state != TCP_CLOSED)
309  {
312  }
313 
314  /* if app layer still needs some love, push through */
315  if (f->alproto != ALPROTO_UNKNOWN && f->alstate != NULL) {
316  const uint64_t total_txs = AppLayerParserGetTxCnt(f, f->alstate);
317 
318  if (AppLayerParserGetTransactionActive(f, f->alparser, STREAM_TOCLIENT) < total_txs)
319  {
321  }
322  if (AppLayerParserGetTransactionActive(f, f->alparser, STREAM_TOSERVER) < total_txs)
323  {
325  }
326  }
327 
328  /* nothing to do */
329  if (client == STREAM_HAS_UNPROCESSED_SEGMENTS_NONE &&
331  SCReturnInt(0);
332  }
333 
334  f->ffr_ts = client;
335  f->ffr_tc = server;
336  SCReturnInt(1);
337 }
338 
339 /**
340  * \internal
341  * \brief Forces reassembly for flow if it needs it.
342  *
343  * The function requires flow to be locked beforehand.
344  *
345  * \param f Pointer to the flow.
346  *
347  * \retval 0 This flow doesn't need any reassembly processing; 1 otherwise.
348  */
350 {
351  const int thread_id = (int)f->thread_id[0];
352  TmThreadsInjectFlowById(f, thread_id);
353 }
354 
355 /**
356  * \internal
357  * \brief Forces reassembly for flows that need it.
358  *
359  * When this function is called we're running in virtually dead engine,
360  * so locking the flows is not strictly required. The reasons it is still
361  * done are:
362  * - code consistency
363  * - silence complaining profilers
364  * - allow us to aggressively check using debug valdation assertions
365  * - be robust in case of future changes
366  * - locking overhead if neglectable when no other thread fights us
367  *
368  * \param q The queue to process flows from.
369  */
370 static inline void FlowForceReassemblyForHash(void)
371 {
372  for (uint32_t idx = 0; idx < flow_config.hash_size; idx++) {
373  FlowBucket *fb = &flow_hash[idx];
374 
376  FBLOCK_LOCK(fb);
377 
378  Flow *f = fb->head;
379  Flow *prev_f = NULL;
380 
381  /* we need to loop through all the flows in the queue */
382  while (f != NULL) {
383  Flow *next_f = f->next;
385 
386  FLOWLOCK_WRLOCK(f);
387 
388  /* Get the tcp session for the flow */
389  TcpSession *ssn = (TcpSession *)f->protoctx;
390  /* \todo Also skip flows that shouldn't be inspected */
391  if (ssn == NULL) {
392  FLOWLOCK_UNLOCK(f);
393  prev_f = f;
394  f = next_f;
395  continue;
396  }
397 
398  /* in case of additional work, we pull the flow out of the
399  * hash and xfer ownership to the injected packet(s) */
400  if (FlowForceReassemblyNeedReassembly(f) == 1) {
401  RemoveFromHash(f, prev_f);
404  FLOWLOCK_UNLOCK(f);
405  f = next_f;
406  continue;
407  }
408 
409  FLOWLOCK_UNLOCK(f);
410 
411  /* next flow in the queue */
412  prev_f = f;
413  f = f->next;
414  }
415  FBLOCK_UNLOCK(fb);
416  }
417  return;
418 }
419 
420 /**
421  * \brief Force reassembly for all the flows that have unprocessed segments.
422  */
424 {
425  /* Carry out flow reassembly for unattended flows */
426  FlowForceReassemblyForHash();
427  return;
428 }
Flow_::ffr_tc
uint8_t ffr_tc
Definition: flow.h:389
util-byte.h
host.h
tm-threads.h
Packet_::proto
uint8_t proto
Definition: decode.h:450
FlowForceReassemblyForFlow
void FlowForceReassemblyForFlow(Flow *f)
Definition: flow-timeout.c:349
Flow_::ffr_ts
uint8_t ffr_ts
Definition: flow.h:388
FLOW_IS_IPV6
#define FLOW_IS_IPV6(f)
Definition: flow.h:162
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1003
IPV4Hdr_::ip_ttl
uint8_t ip_ttl
Definition: decode-ipv4.h:78
flow-util.h
FBLOCK_LOCK
#define FBLOCK_LOCK(fb)
Definition: flow-hash.h:73
Packet_::vlan_id
uint16_t vlan_id[2]
Definition: decode.h:455
stream-tcp.h
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:293
Packet_::payload
uint8_t * payload
Definition: decode.h:573
Packet_::flags
uint32_t flags
Definition: decode.h:463
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:456
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:357
LiveDevice_
Definition: util-device.h:39
flow-hash.h
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:64
Flow_::vlan_id
uint16_t vlan_id[2]
Definition: flow.h:381
FlowForceReassembly
void FlowForceReassembly(void)
Force reassembly for all the flows that have unprocessed segments.
Definition: flow-timeout.c:423
IPV4Hdr_::ip_id
uint16_t ip_id
Definition: decode-ipv4.h:76
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:227
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:154
IPV4Hdr_::ip_tos
uint8_t ip_tos
Definition: decode-ipv4.h:74
util-privs.h
stream-tcp-reassemble.h
Flow_::dp
Port dp
Definition: flow.h:373
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:459
APP_LAYER_PARSER_EOF_TS
#define APP_LAYER_PARSER_EOF_TS
Definition: app-layer-parser.h:39
Flow_::protoctx
void * protoctx
Definition: flow.h:447
GET_PKT_DIRECT_MAX_SIZE
#define GET_PKT_DIRECT_MAX_SIZE(p)
Definition: decode.h:221
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:574
util-unittest.h
util-unittest-helper.h
FLOWLOCK_UNLOCK
#define FLOWLOCK_UNLOCK(fb)
Definition: flow.h:272
TmThreadsInjectFlowById
void TmThreadsInjectFlowById(Flow *f, const int id)
inject a flow into a threads flow queue
Definition: tm-threads.c:2294
FLOW_COPY_IPV6_ADDR_TO_PACKET
#define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa)
Definition: flow.h:175
Packet_::datalink
int datalink
Definition: decode.h:607
TcpStream_::last_ack
uint32_t last_ack
Definition: stream-tcp-private.h:115
IPV4Hdr_::ip_len
uint16_t ip_len
Definition: decode-ipv4.h:75
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:481
Flow_::dst
FlowAddress dst
Definition: flow.h:360
SET_PKT_LEN
#define SET_PKT_LEN(p, len)
Definition: decode.h:223
decode.h
util-debug.h
STREAM_HAS_UNPROCESSED_SEGMENTS_NONE
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NONE
Definition: stream-tcp.h:182
AppLayerParserGetTransactionActive
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:1186
STREAM_HAS_SEEN_DATA
#define STREAM_HAS_SEEN_DATA(stream)
Definition: stream-tcp-private.h:104
Packet_::ts
SCTime_t ts
Definition: decode.h:471
PKT_PSEUDO_STREAM_END
#define PKT_PSEUDO_STREAM_END
Definition: decode.h:1005
FLOWLOCK_WRLOCK
#define FLOWLOCK_WRLOCK(fb)
Definition: flow.h:269
FlowForceReassemblyNeedReassembly
int FlowForceReassemblyNeedReassembly(Flow *f)
Check if a flow needs forced reassembly, or any other processing.
Definition: flow-timeout.c:295
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:219
PacketPoolWaitForN
void PacketPoolWaitForN(int n)
Wait until we have the requested amount of packets in the pool.
Definition: tmqh-packetpool.c:98
detect.h
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:453
pkt-var.h
Packet_::sp
Port sp
Definition: decode.h:435
IPV4_GET_RAW_HLEN
#define IPV4_GET_RAW_HLEN(ip4h)
Definition: decode-ipv4.h:96
StreamNeedsReassembly
uint8_t StreamNeedsReassembly(const TcpSession *ssn, uint8_t direction)
see what if any work the TCP session still needs
Definition: stream-tcp-reassemble.c:911
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:274
TH_ACK
#define TH_ACK
Definition: decode-tcp.h:38
util-time.h
app-layer-parser.h
STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
Definition: stream-tcp.h:185
FLOW_IS_IPV4
#define FLOW_IS_IPV4(f)
Definition: flow.h:160
util-profiling.h
PacketCallocExtPkt
int PacketCallocExtPkt(Packet *p, int datalen)
Definition: decode.c:224
PacketPoolWait
void PacketPoolWait(void)
Definition: tmqh-packetpool.c:69
stream.h
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:428
TimeGet
SCTime_t TimeGet(void)
Definition: util-time.c:152
stream-tcp-private.h
APP_LAYER_PARSER_EOF_TC
#define APP_LAYER_PARSER_EOF_TC
Definition: app-layer-parser.h:40
conf.h
Packet_::ip4h
IPV4Hdr * ip4h
Definition: decode.h:531
FBLOCK_UNLOCK
#define FBLOCK_UNLOCK(fb)
Definition: flow-hash.h:75
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:586
PKT_STREAM_EOF
#define PKT_STREAM_EOF
Definition: decode.h:1002
Flow_::vlan_idx
uint8_t vlan_idx
Definition: flow.h:383
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
flow-timeout.h
flow-queue.h
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:228
runmodes.h
Flow_::src
FlowAddress src
Definition: flow.h:360
Flow_::next
struct Flow_ * next
Definition: flow.h:402
IPV4Hdr_
Definition: decode-ipv4.h:72
TCP_CLOSED
@ TCP_CLOSED
Definition: stream-tcp-private.h:161
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:57
AppLayerParserStateSetFlag
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1814
Packet_::flow
struct Flow_ * flow
Definition: decode.h:465
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:630
flow-manager.h
suricata-common.h
Packet_::tcph
TCPHdr * tcph
Definition: decode.h:553
flow_config
FlowConfig flow_config
Definition: flow.c:99
FlowForceReassemblyPseudoPacketGet
Packet * FlowForceReassemblyPseudoPacketGet(int direction, Flow *f, TcpSession *ssn)
Definition: flow-timeout.c:272
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:285
Flow_::livedev
struct LiveDevice_ * livedev
Definition: flow.h:404
PACKET_PROFILING_START
#define PACKET_PROFILING_START(p)
Definition: util-profiling.h:93
TcpStream_::next_seq
uint32_t next_seq
Definition: stream-tcp-private.h:114
threadvars.h
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:284
Flow_::alstate
void * alstate
Definition: flow.h:482
Flow_::flags
uint32_t flags
Definition: flow.h:427
PacketPoolGetPacket
Packet * PacketPoolGetPacket(void)
Get a new packet from the packet pool.
Definition: tmqh-packetpool.c:167
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
util-random.h
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:229
IPV4Hdr_::ip_csum
uint16_t ip_csum
Definition: decode-ipv4.h:80
FLOW_END_FLAG_SHUTDOWN
#define FLOW_END_FLAG_SHUTDOWN
Definition: flow.h:244
suricata.h
Packet_::dst
Address dst
Definition: decode.h:433
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:62
IPV4Hdr_::ip_off
uint16_t ip_off
Definition: decode-ipv4.h:77
Flow_::sp
Port sp
Definition: flow.h:362
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:533
TcpSession_
Definition: stream-tcp-private.h:272
flow.h
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:456
Packet_::dp
Port dp
Definition: decode.h:443
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:109
IPV4Hdr_::ip_proto
uint8_t ip_proto
Definition: decode-ipv4.h:79
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
flow-var.h
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
Definition: app-layer-parser.c:1136
IPV4Hdr_::ip_verhl
uint8_t ip_verhl
Definition: decode-ipv4.h:73
Packet_::src
Address src
Definition: decode.h:432
Flow_::tenant_id
uint32_t tenant_id
Definition: flow.h:422
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1000
Flow_::thread_id
FlowThreadId thread_id[2]
Definition: flow.h:400
app-layer.h
FLOW_COPY_IPV4_ADDR_TO_PACKET
#define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa)
Definition: flow.h:170