suricata
flow-util.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow utility functions
24  */
25 
26 #include "suricata-common.h"
27 #include "threads.h"
28 
29 #include "flow.h"
30 #include "flow-private.h"
31 #include "flow-util.h"
32 #include "flow-var.h"
33 #include "app-layer.h"
34 
35 #include "util-var.h"
36 #include "util-debug.h"
37 #include "util-macset.h"
38 #include "flow-storage.h"
39 
40 #include "detect.h"
41 #include "detect-engine-state.h"
42 
43 #include "decode-icmpv4.h"
44 
45 #include "util-validate.h"
46 
47 /** \brief allocate a flow
48  *
49  * We check against the memuse counter. If it passes that check we increment
50  * the counter first, then we try to alloc.
51  *
52  * \retval f the flow or NULL on out of memory
53  */
55 {
56  Flow *f;
57  size_t size = sizeof(Flow) + FlowStorageSize();
58 
59  if (!(FLOW_CHECK_MEMCAP(size))) {
60  return NULL;
61  }
62 
63  (void) SC_ATOMIC_ADD(flow_memuse, size);
64 
65  f = SCCalloc(1, size);
66  if (unlikely(f == NULL)) {
67  (void)SC_ATOMIC_SUB(flow_memuse, size);
68  return NULL;
69  }
70 
71  /* coverity[missing_lock] */
72  FLOW_INITIALIZE(f);
73  return f;
74 }
75 
76 
77 /**
78  * \brief cleanup & free the memory of a flow
79  *
80  * \param f flow to clear & destroy
81  */
82 void FlowFree(Flow *f)
83 {
84  FLOW_DESTROY(f);
85  SCFree(f);
86 
87  size_t size = sizeof(Flow) + FlowStorageSize();
88  (void) SC_ATOMIC_SUB(flow_memuse, size);
89 }
90 
91 /**
92  * \brief Function to map the protocol to the defined FLOW_PROTO_* enumeration.
93  *
94  * \param proto protocol which is needed to be mapped
95  */
96 
97 uint8_t FlowGetProtoMapping(uint8_t proto)
98 {
99  switch (proto) {
100  case IPPROTO_TCP:
101  return FLOW_PROTO_TCP;
102  case IPPROTO_UDP:
103  return FLOW_PROTO_UDP;
104  case IPPROTO_ICMP:
105  return FLOW_PROTO_ICMP;
106  default:
107  return FLOW_PROTO_DEFAULT;
108  }
109 }
110 
111 uint8_t FlowGetReverseProtoMapping(uint8_t rproto)
112 {
113  switch (rproto) {
114  case FLOW_PROTO_TCP:
115  return IPPROTO_TCP;
116  case FLOW_PROTO_UDP:
117  return IPPROTO_UDP;
118  case FLOW_PROTO_ICMP:
119  return IPPROTO_ICMP;
120  default:
121  exit(EXIT_FAILURE);
122  }
123 }
124 
125 static inline void FlowSetICMPv4CounterPart(Flow *f)
126 {
127  int ctype = ICMPv4GetCounterpart(f->icmp_s.type);
128  if (ctype == -1)
129  return;
130 
131  f->icmp_d.type = (uint8_t)ctype;
132 }
133 
134 static inline void FlowSetICMPv6CounterPart(Flow *f)
135 {
136  int ctype = ICMPv6GetCounterpart(f->icmp_s.type);
137  if (ctype == -1)
138  return;
139 
140  f->icmp_d.type = (uint8_t)ctype;
141 }
142 
143 /* initialize the flow from the first packet
144  * we see from it. */
145 void FlowInit(Flow *f, const Packet *p)
146 {
147  SCEnter();
148  SCLogDebug("flow %p", f);
149 
150  f->proto = p->proto;
152  memcpy(&f->vlan_id[0], &p->vlan_id[0], sizeof(f->vlan_id));
153  f->vlan_idx = p->vlan_idx;
154  f->livedev = p->livedev;
155 
156  if (PKT_IS_IPV4(p)) {
160  f->flags |= FLOW_IPV4;
161  } else if (PKT_IS_IPV6(p)) {
165  f->flags |= FLOW_IPV6;
166  } else {
167  SCLogDebug("neither IPv4 or IPv6, weird");
169  }
170 
171  if (p->tcph != NULL) { /* XXX MACRO */
172  SET_TCP_SRC_PORT(p,&f->sp);
173  SET_TCP_DST_PORT(p,&f->dp);
174  } else if (p->udph != NULL) { /* XXX MACRO */
175  SET_UDP_SRC_PORT(p,&f->sp);
176  SET_UDP_DST_PORT(p,&f->dp);
177  } else if (p->icmpv4h != NULL) {
178  f->icmp_s.type = p->icmp_s.type;
179  f->icmp_s.code = p->icmp_s.code;
180  FlowSetICMPv4CounterPart(f);
181  } else if (p->icmpv6h != NULL) {
182  f->icmp_s.type = p->icmp_s.type;
183  f->icmp_s.code = p->icmp_s.code;
184  FlowSetICMPv6CounterPart(f);
185  } else if (p->sctph != NULL) { /* XXX MACRO */
186  SET_SCTP_SRC_PORT(p,&f->sp);
187  SET_SCTP_DST_PORT(p,&f->dp);
188  } else if (p->esph != NULL) {
189  f->esp.spi = ESP_GET_SPI(p);
190  } else {
191  /* nothing to do for this IP proto. */
192  SCLogDebug("no special setup for IP proto %u", p->proto);
193  }
194  f->startts = p->ts;
195 
197  f->timeout_policy = FlowGetTimeoutPolicy(f);
198  const uint32_t timeout_at = (uint32_t)SCTIME_SECS(f->startts) + f->timeout_policy;
199  f->timeout_at = timeout_at;
200 
201  if (MacSetFlowStorageEnabled()) {
203  MacSet *ms = MacSetInit(10);
205  }
206 
207  SCReturn;
208 }
209 
211 
213 {
214  return g_bypass_info_id;
215 }
216 
217 static void FlowBypassFree(void *x)
218 {
219  FlowBypassInfo *fb = (FlowBypassInfo *) x;
220 
221  if (fb == NULL)
222  return;
223 
224  if (fb->bypass_data && fb->BypassFree) {
225  fb->BypassFree(fb->bypass_data);
226  }
227  SCFree(fb);
228 }
229 
231 {
232  g_bypass_info_id = FlowStorageRegister("bypass_counters", sizeof(void *),
233  NULL, FlowBypassFree);
234 }
235 
237 {
238  for (int i = 0; i < FLOW_STATE_SIZE; i++) {
239  const char *name = NULL;
240  if (i == FLOW_STATE_NEW) {
241  name = "flow.end.state.new";
242  } else if (i == FLOW_STATE_ESTABLISHED) {
243  name = "flow.end.state.established";
244  } else if (i == FLOW_STATE_CLOSED) {
245  name = "flow.end.state.closed";
246  } else if (i == FLOW_STATE_LOCAL_BYPASSED) {
247  name = "flow.end.state.local_bypassed";
248 #ifdef CAPTURE_OFFLOAD
249  } else if (i == FLOW_STATE_CAPTURE_BYPASSED) {
250  name = "flow.end.state.capture_bypassed";
251 #endif
252  }
253  if (name) {
254  fec->flow_state[i] = StatsRegisterCounter(name, t);
255  }
256  }
257 
258  for (enum TcpState i = TCP_NONE; i <= TCP_CLOSED; i++) {
259  const char *name = NULL;
260  switch (i) {
261  case TCP_NONE:
262  name = "flow.end.tcp_state.none";
263  break;
264  case TCP_SYN_SENT:
265  name = "flow.end.tcp_state.syn_sent";
266  break;
267  case TCP_SYN_RECV:
268  name = "flow.end.tcp_state.syn_recv";
269  break;
270  case TCP_ESTABLISHED:
271  name = "flow.end.tcp_state.established";
272  break;
273  case TCP_FIN_WAIT1:
274  name = "flow.end.tcp_state.fin_wait1";
275  break;
276  case TCP_FIN_WAIT2:
277  name = "flow.end.tcp_state.fin_wait2";
278  break;
279  case TCP_TIME_WAIT:
280  name = "flow.end.tcp_state.time_wait";
281  break;
282  case TCP_LAST_ACK:
283  name = "flow.end.tcp_state.last_ack";
284  break;
285  case TCP_CLOSE_WAIT:
286  name = "flow.end.tcp_state.close_wait";
287  break;
288  case TCP_CLOSING:
289  name = "flow.end.tcp_state.closing";
290  break;
291  case TCP_CLOSED:
292  name = "flow.end.tcp_state.closed";
293  break;
294  }
295 
296  fec->flow_tcp_state[i] = StatsRegisterCounter(name, t);
297  }
298  fec->flow_tcp_liberal = StatsRegisterCounter("flow.end.tcp_liberal", t);
299 }
FlowStorageId
Definition: flow-storage.h:31
TCP_SYN_RECV
@ TCP_SYN_RECV
Definition: stream-tcp-private.h:154
Packet_::proto
uint8_t proto
Definition: decode.h:459
Packet_::icmp_s
struct Packet_::@31::@41 icmp_s
SET_SCTP_DST_PORT
#define SET_SCTP_DST_PORT(pkt, prt)
Definition: decode.h:203
Flow_::recursion_level
uint8_t recursion_level
Definition: flow.h:374
Packet_::sctph
SCTPHdr * sctph
Definition: decode.h:571
FLOW_PROTO_ICMP
@ FLOW_PROTO_ICMP
Definition: flow-private.h:70
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:502
TCP_SYN_SENT
@ TCP_SYN_SENT
Definition: stream-tcp-private.h:153
flow-util.h
Flow_::icmp_d
struct Flow_::@119::@125 icmp_d
Flow_::startts
SCTime_t startts
Definition: flow.h:490
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:247
GetFlowBypassInfoID
FlowStorageId GetFlowBypassInfoID(void)
Definition: flow-util.c:212
FlowBypassInfo_
Definition: flow.h:526
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
ICMPv6GetCounterpart
int ICMPv6GetCounterpart(uint8_t type)
Definition: decode-icmpv6.c:146
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
TCP_FIN_WAIT2
@ TCP_FIN_WAIT2
Definition: stream-tcp-private.h:157
g_bypass_info_id
FlowStorageId g_bypass_info_id
Definition: flow-util.c:210
Flow_::proto
uint8_t proto
Definition: flow.h:373
threads.h
util-macset.h
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:465
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:351
RegisterFlowBypassInfo
void RegisterFlowBypassInfo(void)
Definition: flow-util.c:230
Flow_::protomap
uint8_t protomap
Definition: flow.h:445
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:332
TCP_FIN_WAIT1
@ TCP_FIN_WAIT1
Definition: stream-tcp-private.h:156
TCP_LAST_ACK
@ TCP_LAST_ACK
Definition: stream-tcp-private.h:159
Flow
struct Flow_ Flow
Flow data structure.
FlowEndCounters_::flow_tcp_liberal
uint16_t flow_tcp_liberal
Definition: flow-util.h:151
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:155
FlowEndCounters_::flow_state
uint16_t flow_state[FLOW_STATE_SIZE]
Definition: flow-util.h:149
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:468
proto
uint8_t proto
Definition: decode-template.h:0
Flow_::dp
Port dp
Definition: flow.h:367
SET_UDP_DST_PORT
#define SET_UDP_DST_PORT(pkt, prt)
Definition: decode.h:193
util-var.h
FLOW_IPV4
#define FLOW_IPV4
Definition: flow.h:97
FlowGetReverseProtoMapping
uint8_t FlowGetReverseProtoMapping(uint8_t rproto)
Definition: flow-util.c:111
FLOW_SET_IPV6_DST_ADDR_FROM_PACKET
#define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a)
Definition: flow.h:215
TcpState
TcpState
Definition: stream-tcp-private.h:150
FLOW_CHECK_MEMCAP
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
Definition: flow-util.h:136
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:69
Flow_::dst
FlowAddress dst
Definition: flow.h:354
FlowEndCounters_::flow_tcp_state
uint16_t flow_tcp_state[TCP_CLOSED+1]
Definition: flow-util.h:150
TCP_NONE
@ TCP_NONE
Definition: stream-tcp-private.h:151
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:38
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:504
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:467
TCP_CLOSE_WAIT
@ TCP_CLOSE_WAIT
Definition: stream-tcp-private.h:160
Flow_::esp
struct Flow_::@117::@124 esp
util-debug.h
SET_TCP_SRC_PORT
#define SET_TCP_SRC_PORT(pkt, prt)
Definition: decode.h:180
FlowBypassInfo_::BypassFree
void(* BypassFree)(void *data)
Definition: flow.h:528
Packet_::ts
SCTime_t ts
Definition: decode.h:485
SET_UDP_SRC_PORT
#define SET_UDP_SRC_PORT(pkt, prt)
Definition: decode.h:190
FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET
#define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a)
Definition: flow.h:208
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
FlowStorageSize
unsigned int FlowStorageSize(void)
Definition: flow-storage.c:35
FlowSetStorageById
int FlowSetStorageById(Flow *f, FlowStorageId id, void *ptr)
Definition: flow-storage.c:45
FlowStorageRegister
FlowStorageId FlowStorageRegister(const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void(*Free)(void *))
Definition: flow-storage.c:66
FlowBypassInfo_::bypass_data
void * bypass_data
Definition: flow.h:529
Flow_::icmp_s
struct Flow_::@117::@123 icmp_s
MacSetFlowStorageEnabled
bool MacSetFlowStorageEnabled(void)
Definition: util-macset.c:85
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:341
SCReturn
#define SCReturn
Definition: util-debug.h:273
Packet_::icmpv6h
ICMPV6Hdr * icmpv6h
Definition: decode.h:577
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:97
Packet_
Definition: decode.h:437
FLOW_SET_IPV4_DST_ADDR_FROM_PACKET
#define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a)
Definition: flow.h:199
ESP_GET_SPI
#define ESP_GET_SPI(p)
Get the spi field off a packet.
Definition: decode-esp.h:32
decode-icmpv4.h
MacSet_
Definition: util-macset.c:45
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:600
Flow_::vlan_idx
uint8_t vlan_idx
Definition: flow.h:377
ICMPv4GetCounterpart
int ICMPv4GetCounterpart(uint8_t type)
Definition: decode-icmpv4.c:360
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
MacSetGetFlowStorageID
FlowStorageId MacSetGetFlowStorageID(void)
Definition: util-macset.c:114
FLOW_STATE_SIZE
#define FLOW_STATE_SIZE
Definition: flow.h:512
FlowGetStorageById
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
Definition: flow-storage.c:40
Flow_::src
FlowAddress src
Definition: flow.h:354
FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET
#define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a)
Definition: flow.h:192
SET_SCTP_SRC_PORT
#define SET_SCTP_SRC_PORT(pkt, prt)
Definition: decode.h:199
TCP_CLOSED
@ TCP_CLOSED
Definition: stream-tcp-private.h:162
flow-storage.h
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:68
FLOW_STATE_NEW
@ FLOW_STATE_NEW
Definition: flow.h:501
suricata-common.h
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:82
FLOW_IPV6
#define FLOW_IPV6
Definition: flow.h:99
Packet_::tcph
TCPHdr * tcph
Definition: decode.h:567
SCTIME_SECS
#define SCTIME_SECS(t)
Definition: util-time.h:57
MacSetInit
MacSet * MacSetInit(int size)
Definition: util-macset.c:91
Packet_::icmpv4h
ICMPV4Hdr * icmpv4h
Definition: decode.h:575
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:405
TCP_CLOSING
@ TCP_CLOSING
Definition: stream-tcp-private.h:161
Flow_::livedev
struct LiveDevice_ * livedev
Definition: flow.h:398
util-validate.h
FLOW_STATE_CLOSED
@ FLOW_STATE_CLOSED
Definition: flow.h:503
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Flow_::flags
uint32_t flags
Definition: flow.h:421
Packet_::recursion_level
uint8_t recursion_level
Definition: decode.h:462
TCP_TIME_WAIT
@ TCP_TIME_WAIT
Definition: stream-tcp-private.h:158
FlowStorageId::id
int id
Definition: flow-storage.h:32
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
Packet_::udph
UDPHdr * udph
Definition: decode.h:569
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:71
Flow_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: flow.h:375
Packet_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: decode.h:464
Flow_::sp
Port sp
Definition: flow.h:356
flow.h
FlowAlloc
Flow * FlowAlloc(void)
allocate a flow
Definition: flow-util.c:54
FlowEndCountersRegister
void FlowEndCountersRegister(ThreadVars *t, FlowEndCounters *fec)
Definition: flow-util.c:236
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:971
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
Packet_::esph
ESPHdr * esph
Definition: decode.h:573
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:391
FlowEndCounters_
Definition: flow-util.h:148
flow-var.h
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:246
SET_TCP_DST_PORT
#define SET_TCP_DST_PORT(pkt, prt)
Definition: decode.h:184
FlowInit
void FlowInit(Flow *f, const Packet *p)
Definition: flow-util.c:145
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:103
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:121
IPV4_GET_IPTTL
#define IPV4_GET_IPTTL(p)
Definition: decode-ipv4.h:146
app-layer.h