suricata
flow-worker.c
Go to the documentation of this file.
1 /* Copyright (C) 2016-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow Workers are single thread modules taking care of (almost)
24  * everything related to packets with flows:
25  *
26  * - Lookup/creation
27  * - Stream tracking, reassembly
28  * - Applayer update
29  * - Detection
30  *
31  * This all while holding the flow lock.
32  */
33 
34 #include "suricata-common.h"
35 #include "suricata.h"
36 
37 #include "action-globals.h"
38 #include "packet.h"
39 #include "decode.h"
40 #include "detect.h"
41 #include "stream-tcp.h"
42 #include "app-layer.h"
43 #include "detect-engine.h"
44 #include "output.h"
45 #include "app-layer-parser.h"
46 #include "app-layer-frames.h"
47 
48 #include "util-profiling.h"
49 #include "util-validate.h"
50 #include "util-time.h"
51 #include "tmqh-packetpool.h"
52 
53 #include "flow-util.h"
54 #include "flow-manager.h"
55 #include "flow-timeout.h"
56 #include "flow-spare-pool.h"
57 #include "flow-worker.h"
58 
60 
61 typedef struct FlowTimeoutCounters {
65 
66 typedef struct FlowWorkerThreadData_ {
68 
69  union {
72  };
73 
75 
76  void *output_thread; /* Output thread data. */
77  void *output_thread_flow; /* Output thread data. */
78 
81  uint16_t both_bypass_pkts;
83  /** Queue to put pseudo packets that have been created by the stream (RST response) and by the
84  * flush logic following a protocol change. */
87 
88  struct {
89  uint16_t flows_injected;
91  uint16_t flows_removed;
94  } cnt;
96 
98 
99 static void FlowWorkerFlowTimeout(
100  ThreadVars *tv, Packet *p, FlowWorkerThreadData *fw, void *detect_thread);
101 
102 /**
103  * \internal
104  * \brief Forces reassembly for flow if it needs it.
105  *
106  * The function requires flow to be locked beforehand.
107  *
108  * \param f Pointer to the flow.
109  *
110  * \retval cnt number of packets injected
111  */
112 static int FlowFinish(ThreadVars *tv, Flow *f, FlowWorkerThreadData *fw, void *detect_thread)
113 {
114  const int server = f->ffr_tc;
115  const int client = f->ffr_ts;
116  int cnt = 0;
117 
118  /* Get the tcp session for the flow */
119  const TcpSession *ssn = (TcpSession *)f->protoctx;
120 
121  /* insert a pseudo packet in the toserver direction */
124  if (p != NULL) {
126  if (server == STREAM_HAS_UNPROCESSED_SEGMENTS_NONE) {
128  }
129  FlowWorkerFlowTimeout(tv, p, fw, detect_thread);
131  cnt++;
132  }
133  }
134 
135  /* handle toclient */
138  if (p != NULL) {
141  FlowWorkerFlowTimeout(tv, p, fw, detect_thread);
144  cnt++;
145  }
146  }
147 
148  if (cnt > 0) {
150  }
151  return cnt;
152 }
153 
154 extern uint32_t flow_spare_pool_block_size;
155 
156 /** \param[in] max_work Max flows to process. 0 if unlimited. */
157 static void CheckWorkQueue(ThreadVars *tv, FlowWorkerThreadData *fw, FlowTimeoutCounters *counters,
158  FlowQueuePrivate *fq, const uint32_t max_work)
159 {
160  FlowQueuePrivate ret_queue = { NULL, NULL, 0 };
161  uint32_t i = 0;
162  Flow *f;
163  while ((f = FlowQueuePrivateGetFromTop(fq)) != NULL) {
164  FLOWLOCK_WRLOCK(f);
165  f->flow_end_flags |= FLOW_END_FLAG_TIMEOUT; //TODO emerg
166 
167  if (f->proto == IPPROTO_TCP) {
169  !FlowIsBypassed(f) && FlowForceReassemblyNeedReassembly(f) == 1 &&
170  f->ffr != 0) {
171  /* read detect thread in case we're doing a reload */
172  void *detect_thread = SC_ATOMIC_GET(fw->detect_thread);
173  int cnt = FlowFinish(tv, f, fw, detect_thread);
174  counters->flows_aside_pkt_inject += cnt;
175  counters->flows_aside_needs_work++;
176  }
177  }
178 
179  /* no one is referring to this flow, removed from hash
180  * so we can unlock it and pass it to the flow recycler */
181 
182  if (fw->output_thread_flow != NULL)
183  (void)OutputFlowLog(tv, fw->output_thread_flow, f);
184 
185  FlowEndCountersUpdate(tv, &fw->fec, f);
186  if (f->proto == IPPROTO_TCP && f->protoctx != NULL) {
188  }
190 
191  FlowClearMemory (f, f->protomap);
192  FLOWLOCK_UNLOCK(f);
193 
194  if (fw->fls.spare_queue.len >= (flow_spare_pool_block_size * 2)) {
195  FlowQueuePrivatePrependFlow(&ret_queue, f);
196  if (ret_queue.len == flow_spare_pool_block_size) {
197  FlowSparePoolReturnFlows(&ret_queue);
198  }
199  } else {
201  }
202 
203  if (max_work != 0 && ++i == max_work)
204  break;
205  }
206  if (ret_queue.len > 0) {
207  FlowSparePoolReturnFlows(&ret_queue);
208  }
209 
210  StatsAddUI64(tv, fw->cnt.flows_removed, (uint64_t)i);
211 }
212 
213 /** \brief handle flow for packet
214  *
215  * Handle flow creation/lookup
216  */
217 static inline TmEcode FlowUpdate(ThreadVars *tv, FlowWorkerThreadData *fw, Packet *p)
218 {
219  FlowHandlePacketUpdate(p->flow, p, tv, fw->dtv);
220 
221  int state = p->flow->flow_state;
222  switch (state) {
223 #ifdef CAPTURE_OFFLOAD
224  case FLOW_STATE_CAPTURE_BYPASSED: {
227  Flow *f = p->flow;
228  FlowDeReference(&p->flow);
229  FLOWLOCK_UNLOCK(f);
230  return TM_ECODE_DONE;
231  }
232 #endif
236  Flow *f = p->flow;
237  FlowDeReference(&p->flow);
238  FLOWLOCK_UNLOCK(f);
239  return TM_ECODE_DONE;
240  }
241  default:
242  return TM_ECODE_OK;
243  }
244 }
245 
246 static TmEcode FlowWorkerThreadDeinit(ThreadVars *tv, void *data);
247 
248 static TmEcode FlowWorkerThreadInit(ThreadVars *tv, const void *initdata, void **data)
249 {
250  FlowWorkerThreadData *fw = SCCalloc(1, sizeof(*fw));
251  if (fw == NULL)
252  return TM_ECODE_FAILED;
253 
254  SC_ATOMIC_INITPTR(fw->detect_thread);
255  SC_ATOMIC_SET(fw->detect_thread, NULL);
256 
257  fw->local_bypass_pkts = StatsRegisterCounter("flow_bypassed.local_pkts", tv);
258  fw->local_bypass_bytes = StatsRegisterCounter("flow_bypassed.local_bytes", tv);
259  fw->both_bypass_pkts = StatsRegisterCounter("flow_bypassed.local_capture_pkts", tv);
260  fw->both_bypass_bytes = StatsRegisterCounter("flow_bypassed.local_capture_bytes", tv);
261 
262  fw->cnt.flows_aside_needs_work = StatsRegisterCounter("flow.wrk.flows_evicted_needs_work", tv);
263  fw->cnt.flows_aside_pkt_inject = StatsRegisterCounter("flow.wrk.flows_evicted_pkt_inject", tv);
264  fw->cnt.flows_removed = StatsRegisterCounter("flow.wrk.flows_evicted", tv);
265  fw->cnt.flows_injected = StatsRegisterCounter("flow.wrk.flows_injected", tv);
266  fw->cnt.flows_injected_max = StatsRegisterMaxCounter("flow.wrk.flows_injected_max", tv);
267 
268  fw->fls.dtv = fw->dtv = DecodeThreadVarsAlloc(tv);
269  if (fw->dtv == NULL) {
270  FlowWorkerThreadDeinit(tv, fw);
271  return TM_ECODE_FAILED;
272  }
273 
274  /* setup TCP */
275  if (StreamTcpThreadInit(tv, NULL, &fw->stream_thread_ptr) != TM_ECODE_OK) {
276  FlowWorkerThreadDeinit(tv, fw);
277  return TM_ECODE_FAILED;
278  }
279 
280  if (DetectEngineEnabled()) {
281  /* setup DETECT */
282  void *detect_thread = NULL;
283  if (DetectEngineThreadCtxInit(tv, NULL, &detect_thread) != TM_ECODE_OK) {
284  FlowWorkerThreadDeinit(tv, fw);
285  return TM_ECODE_FAILED;
286  }
287  SC_ATOMIC_SET(fw->detect_thread, detect_thread);
288  }
289 
290  /* Setup outputs for this thread. */
291  if (OutputLoggerThreadInit(tv, initdata, &fw->output_thread) != TM_ECODE_OK) {
292  FlowWorkerThreadDeinit(tv, fw);
293  return TM_ECODE_FAILED;
294  }
296  SCLogError("initializing flow log API for thread failed");
297  FlowWorkerThreadDeinit(tv, fw);
298  return TM_ECODE_FAILED;
299  }
300 
304 
305  /* setup pq for stream end pkts */
306  memset(&fw->pq, 0, sizeof(PacketQueueNoLock));
307  *data = fw;
308  return TM_ECODE_OK;
309 }
310 
311 static TmEcode FlowWorkerThreadDeinit(ThreadVars *tv, void *data)
312 {
313  FlowWorkerThreadData *fw = data;
314 
316 
317  /* free TCP */
318  StreamTcpThreadDeinit(tv, (void *)fw->stream_thread);
319 
320  /* free DETECT */
321  void *detect_thread = SC_ATOMIC_GET(fw->detect_thread);
322  if (detect_thread != NULL) {
323  DetectEngineThreadCtxDeinit(tv, detect_thread);
324  SC_ATOMIC_SET(fw->detect_thread, NULL);
325  }
326 
327  /* Free output. */
330 
331  /* free pq */
332  BUG_ON(fw->pq.len);
333 
334  Flow *f;
335  while ((f = FlowQueuePrivateGetFromTop(&fw->fls.spare_queue)) != NULL) {
336  FlowFree(f);
337  }
338 
339  SCFree(fw);
340  return TM_ECODE_OK;
341 }
342 
343 TmEcode Detect(ThreadVars *tv, Packet *p, void *data);
345 
346 static inline void UpdateCounters(ThreadVars *tv,
347  FlowWorkerThreadData *fw, const FlowTimeoutCounters *counters)
348 {
349  if (counters->flows_aside_needs_work) {
351  (uint64_t)counters->flows_aside_needs_work);
352  }
353  if (counters->flows_aside_pkt_inject) {
355  (uint64_t)counters->flows_aside_pkt_inject);
356  }
357 }
358 
359 /** \brief update stream engine
360  *
361  * We can be called from both the flow timeout path as well as from the
362  * "real" traffic path. If in the timeout path any additional packets we
363  * forge for flushing pipelines should not leave our scope. If the original
364  * packet is real (or related to a real packet) we need to push the packets
365  * on, so IPS logic stays valid.
366  */
367 static inline void FlowWorkerStreamTCPUpdate(ThreadVars *tv, FlowWorkerThreadData *fw, Packet *p,
368  void *detect_thread, const bool timeout)
369 {
371  StreamTcp(tv, p, fw->stream_thread, &fw->pq);
373 
374  // this is the first packet that sets no payload inspection
375  bool setting_nopayload =
376  p->flow->alparser &&
379  if (FlowChangeProto(p->flow) || setting_nopayload) {
380  StreamTcpDetectLogFlush(tv, fw->stream_thread, p->flow, p, &fw->pq);
381  if (setting_nopayload) {
382  FlowSetNoPayloadInspectionFlag(p->flow);
383  }
386  }
387 
388  /* Packets here can safely access p->flow as it's locked */
389  SCLogDebug("packet %"PRIu64": extra packets %u", p->pcap_cnt, fw->pq.len);
390  Packet *x;
391  while ((x = PacketDequeueNoLock(&fw->pq))) {
392  SCLogDebug("packet %"PRIu64" extra packet %p", p->pcap_cnt, x);
393 
394  if (detect_thread != NULL) {
396  Detect(tv, x, detect_thread);
398  }
399 
401 
402  FramesPrune(x->flow, x);
403  /* Release tcp segments. Done here after alerting can use them. */
406  x->flow, x->flowflags & FLOW_PKT_TOSERVER ? STREAM_TOSERVER : STREAM_TOCLIENT);
408 
409  /* no need to keep a flow ref beyond this point */
410  FlowDeReference(&x->flow);
411 
412  /* no further work to do for this pseudo packet, so we can return
413  * it to the pool immediately. */
414  if (timeout) {
416  } else {
417  /* to support IPS verdict logic, in the non-timeout case we need to do a bit more */
419  }
420  }
421  if (FlowChangeProto(p->flow) && p->flow->flags & FLOW_ACTION_DROP) {
422  // in case f->flags & FLOW_ACTION_DROP was set by one of the dequeued packets
424  }
425 }
426 
427 static void FlowWorkerFlowTimeout(ThreadVars *tv, Packet *p, FlowWorkerThreadData *fw,
428  void *detect_thread)
429 {
431 
432  SCLogDebug("packet %"PRIu64" is TCP. Direction %s", p->pcap_cnt, PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
435 
436  /* handle TCP and app layer */
437  FlowWorkerStreamTCPUpdate(tv, fw, p, detect_thread, true);
438 
440 
441  /* handle Detect */
442  SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt);
443  if (detect_thread != NULL) {
445  Detect(tv, p, detect_thread);
447  }
448 
449  // Outputs.
451 
452  FramesPrune(p->flow, p);
453 
454  /* Release tcp segments. Done here after alerting can use them. */
457  STREAM_TOSERVER : STREAM_TOCLIENT);
459 
460  /* run tx cleanup last */
462 
463  FlowDeReference(&p->flow);
464  /* flow is unlocked later in FlowFinish() */
465 }
466 
467 /** \internal
468  * \brief process flows injected into our queue by other threads
469  */
470 static inline void FlowWorkerProcessInjectedFlows(
472 {
473  /* take injected flows and append to our work queue */
475  FlowQueuePrivate injected = { NULL, NULL, 0 };
476  if (SC_ATOMIC_GET(tv->flow_queue->non_empty) == true)
478  if (injected.len > 0) {
479  StatsAddUI64(tv, fw->cnt.flows_injected, (uint64_t)injected.len);
480  if (p->pkt_src == PKT_SRC_WIRE)
481  StatsSetUI64(tv, fw->cnt.flows_injected_max, (uint64_t)injected.len);
482 
483  /* move to local queue so we can process over the course of multiple packets */
485  }
487 }
488 
489 /** \internal
490  * \brief process flows set aside locally during flow lookup
491  */
492 static inline void FlowWorkerProcessLocalFlows(ThreadVars *tv, FlowWorkerThreadData *fw, Packet *p)
493 {
494  uint32_t max_work = 2;
496  max_work = 0;
497 
499  if (fw->fls.work_queue.len) {
500  FlowTimeoutCounters counters = { 0, 0, };
501  CheckWorkQueue(tv, fw, &counters, &fw->fls.work_queue, max_work);
502  UpdateCounters(tv, fw, &counters);
503  }
505 }
506 
507 /** \internal
508  * \brief apply Packet::app_update_direction to the flow flags
509  */
510 static void PacketAppUpdate2FlowFlags(Packet *p)
511 {
512  switch ((enum StreamUpdateDir)p->app_update_direction) {
513  case UPDATE_DIR_NONE: // NONE implies pseudo packet
514  break;
515  case UPDATE_DIR_PACKET:
516  if (PKT_IS_TOSERVER(p)) {
518  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", p->pcap_cnt);
519  } else {
521  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", p->pcap_cnt);
522  }
523  break;
524  case UPDATE_DIR_BOTH:
525  if (PKT_IS_TOSERVER(p)) {
527  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", p->pcap_cnt);
528  } else {
530  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", p->pcap_cnt);
531  }
532  /* fall through */
533  case UPDATE_DIR_OPPOSING:
534  if (PKT_IS_TOSERVER(p)) {
536  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", p->pcap_cnt);
537  } else {
539  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", p->pcap_cnt);
540  }
541  break;
542  }
543 }
544 
545 static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
546 {
547  FlowWorkerThreadData *fw = data;
548  void *detect_thread = SC_ATOMIC_GET(fw->detect_thread);
549 
550  DEBUG_VALIDATE_BUG_ON(p == NULL);
552 
553  SCLogDebug("packet %"PRIu64, p->pcap_cnt);
554 
555  /* update time */
556  if (!(PKT_IS_PSEUDOPKT(p))) {
557  TimeSetByThread(tv->id, p->ts);
558  }
559 
560  /* handle Flow */
561  if (p->flags & PKT_WANTS_FLOW) {
563 
564  FlowHandlePacket(tv, &fw->fls, p);
565  if (likely(p->flow != NULL)) {
567  if (FlowUpdate(tv, fw, p) == TM_ECODE_DONE) {
568  goto housekeeping;
569  }
570  }
571  /* Flow is now LOCKED */
572 
574 
575  /* if PKT_WANTS_FLOW is not set, but PKT_HAS_FLOW is, then this is a
576  * pseudo packet created by the flow manager. */
577  } else if (p->flags & PKT_HAS_FLOW) {
578  FLOWLOCK_WRLOCK(p->flow);
580  }
581 
582  SCLogDebug("packet %"PRIu64" has flow? %s", p->pcap_cnt, p->flow ? "yes" : "no");
583 
584  /* handle TCP and app layer */
585  if (p->flow) {
586  if (PKT_IS_TCP(p)) {
587  SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", p->pcap_cnt,
588  PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
590 
591  /* if detect is disabled, we need to apply file flags to the flow
592  * here on the first packet. */
593  if (detect_thread == NULL &&
597  }
598 
599  FlowWorkerStreamTCPUpdate(tv, fw, p, detect_thread, false);
600  PacketAppUpdate2FlowFlags(p);
601 
602  /* handle the app layer part of the UDP packet payload */
603  } else if (p->proto == IPPROTO_UDP && !PacketCheckAction(p, ACTION_DROP)) {
607  PacketAppUpdate2FlowFlags(p);
608  }
609  }
610 
612 
613  /* handle Detect */
615  SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt);
616  if (detect_thread != NULL) {
618  Detect(tv, p, detect_thread);
620  }
621 
622  // Outputs.
624 
625  /* Release tcp segments. Done here after alerting can use them. */
626  if (p->flow != NULL) {
628 
629  if (FlowIsBypassed(p->flow)) {
631  if (p->proto == IPPROTO_TCP) {
633  }
634  } else if (p->proto == IPPROTO_TCP && p->flow->protoctx && p->flags & PKT_STREAM_EST) {
635  FramesPrune(p->flow, p);
638  STREAM_TOSERVER : STREAM_TOCLIENT);
640  } else if (p->proto == IPPROTO_UDP) {
641  FramesPrune(p->flow, p);
642  }
643 
644  if ((PKT_IS_PSEUDOPKT(p)) ||
646  if ((p->flags & PKT_STREAM_EST) || p->proto != IPPROTO_TCP) {
647  if (PKT_IS_TOSERVER(p)) {
648  if (PKT_IS_PSEUDOPKT(p) || (p->flow->flags & (FLOW_TS_APP_UPDATED))) {
649  AppLayerParserTransactionsCleanup(p->flow, STREAM_TOSERVER);
651  }
652  } else {
653  if (PKT_IS_PSEUDOPKT(p) || (p->flow->flags & (FLOW_TC_APP_UPDATED))) {
654  AppLayerParserTransactionsCleanup(p->flow, STREAM_TOCLIENT);
656  }
657  }
658  }
659  } else {
660  SCLogDebug("not pseudo, no app update: skip");
661  }
662 
663  if (p->flow->flags & FLOW_ACTION_DROP) {
664  SCLogDebug("flow drop in place: remove app update flags");
666  }
667 
668  Flow *f = p->flow;
669  FlowDeReference(&p->flow);
670  FLOWLOCK_UNLOCK(f);
671  }
672 
673 housekeeping:
674 
675  /* take injected flows and add them to our local queue */
676  FlowWorkerProcessInjectedFlows(tv, fw, p);
677 
678  /* process local work queue */
679  FlowWorkerProcessLocalFlows(tv, fw, p);
680 
681  return TM_ECODE_OK;
682 }
683 
684 void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx)
685 {
686  FlowWorkerThreadData *fw = flow_worker;
687 
688  SC_ATOMIC_SET(fw->detect_thread, detect_ctx);
689 }
690 
691 void *FlowWorkerGetDetectCtxPtr(void *flow_worker)
692 {
693  FlowWorkerThreadData *fw = flow_worker;
694 
695  return SC_ATOMIC_GET(fw->detect_thread);
696 }
697 
699 {
700  switch (fwi) {
702  return "flow";
704  return "stream";
706  return "app-layer";
708  return "detect";
710  return "tcp-prune";
712  return "flow-inject";
714  return "flow-evict";
716  return "size";
717  }
718  return "error";
719 }
720 
721 static void FlowWorkerExitPrintStats(ThreadVars *tv, void *data)
722 {
723  FlowWorkerThreadData *fw = data;
725 }
726 
727 static bool FlowWorkerIsBusy(ThreadVars *tv, void *flow_worker)
728 {
729  FlowWorkerThreadData *fw = flow_worker;
730  if (fw->pq.len)
731  return true;
732  if (fw->fls.work_queue.len)
733  return true;
734 
735  if (tv->flow_queue) {
737  bool fq_done = (tv->flow_queue->qlen == 0);
739  if (!fq_done) {
740  return true;
741  }
742  }
743 
744  return false;
745 }
746 
748 {
749  tmm_modules[TMM_FLOWWORKER].name = "FlowWorker";
750  tmm_modules[TMM_FLOWWORKER].ThreadInit = FlowWorkerThreadInit;
751  tmm_modules[TMM_FLOWWORKER].Func = FlowWorker;
752  tmm_modules[TMM_FLOWWORKER].ThreadBusy = FlowWorkerIsBusy;
753  tmm_modules[TMM_FLOWWORKER].ThreadDeinit = FlowWorkerThreadDeinit;
754  tmm_modules[TMM_FLOWWORKER].ThreadExitPrintStats = FlowWorkerExitPrintStats;
757 }
PKT_IS_TOCLIENT
#define PKT_IS_TOCLIENT(p)
Definition: decode.h:253
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:74
PacketCheckAction
bool PacketCheckAction(const Packet *p, const uint8_t a)
Definition: packet.c:48
UPDATE_DIR_BOTH
@ UPDATE_DIR_BOTH
Definition: stream-tcp-reassemble.h:58
Flow_::ffr_tc
uint8_t ffr_tc
Definition: flow.h:383
FlowLookupStruct_::work_queue
FlowQueuePrivate work_queue
Definition: flow.h:543
UPDATE_DIR_PACKET
@ UPDATE_DIR_PACKET
Definition: stream-tcp-reassemble.h:56
ThreadVars_::flow_queue
struct FlowQueue_ * flow_queue
Definition: threadvars.h:134
OutputFlowLog
TmEcode OutputFlowLog(ThreadVars *tv, void *thread_data, Flow *f)
Run flow logger(s)
Definition: output-flow.c:85
Packet_::proto
uint8_t proto
Definition: decode.h:459
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:151
FlowTimeoutCounters
Definition: flow-worker.c:61
detect-engine.h
Flow_::ffr_ts
uint8_t ffr_ts
Definition: flow.h:382
PROFILE_FLOWWORKER_DETECT
@ PROFILE_FLOWWORKER_DETECT
Definition: flow-worker.h:25
DecodeThreadVars_::counter_flow_active
uint16_t counter_flow_active
Definition: decode.h:748
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1022
PROFILE_FLOWWORKER_FLOW_INJECTED
@ PROFILE_FLOWWORKER_FLOW_INJECTED
Definition: flow-worker.h:27
flow-util.h
FlowWorkerThreadData
struct FlowWorkerThreadData_ FlowWorkerThreadData
FlowLookupStruct_::dtv
DecodeThreadVars * dtv
Definition: flow.h:542
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1075
stream-tcp.h
PacketPoolReturnPacket
void PacketPoolReturnPacket(Packet *p)
Return packet to Packet pool.
Definition: tmqh-packetpool.c:179
FLOW_PKT_LAST_PSEUDO
#define FLOW_PKT_LAST_PSEUDO
Definition: flow.h:232
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:386
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:908
PROFILE_FLOWWORKER_FLOW_EVICTED
@ PROFILE_FLOWWORKER_FLOW_EVICTED
Definition: flow-worker.h:28
ProfileFlowWorkerIdToString
const char * ProfileFlowWorkerIdToString(enum ProfileFlowWorkerId fwi)
Definition: flow-worker.c:698
OutputLoggerExitPrintStats
void OutputLoggerExitPrintStats(ThreadVars *tv, void *thread_data)
Definition: output.c:822
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
PKT_SRC_SHUTDOWN_FLUSH
@ PKT_SRC_SHUTDOWN_FLUSH
Definition: decode.h:67
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:607
StreamTcpThread_
Definition: stream-tcp.h:80
PROFILE_FLOWWORKER_TCPPRUNE
@ PROFILE_FLOWWORKER_TCPPRUNE
Definition: flow-worker.h:26
TM_FLAG_DETECT_TM
#define TM_FLAG_DETECT_TM
Definition: tm-modules.h:35
Flow_::proto
uint8_t proto
Definition: flow.h:373
FlowForceReassemblyPseudoPacketGet
Packet * FlowForceReassemblyPseudoPacketGet(int direction, Flow *f, const TcpSession *ssn)
Definition: flow-timeout.c:266
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:86
PKT_SRC_CAPTURE_TIMEOUT
@ PKT_SRC_CAPTURE_TIMEOUT
Definition: decode.h:65
action-globals.h
TcpReassemblyThreadCtx_::app_tctx
void * app_tctx
Definition: stream-tcp-reassemble.h:62
Packet_::flags
uint32_t flags
Definition: decode.h:474
Flow_
Flow data structure.
Definition: flow.h:351
Flow_::protomap
uint8_t protomap
Definition: flow.h:445
FLOW_TC_APP_UPDATED
#define FLOW_TC_APP_UPDATED
Definition: flow.h:117
StatsSetUI64
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
Definition: counters.c:210
PKT_WANTS_FLOW
#define PKT_WANTS_FLOW
Definition: decode.h:1052
FlowTimeoutCounters::flows_aside_pkt_inject
uint32_t flows_aside_pkt_inject
Definition: flow-worker.c:63
AppLayerRegisterThreadCounters
void AppLayerRegisterThreadCounters(ThreadVars *tv)
Registers per flow counters for all protocols.
Definition: app-layer.c:1244
FlowLookupStruct_
Definition: flow.h:539
FlowWorkerThreadData_::dtv
DecodeThreadVars * dtv
Definition: flow-worker.c:67
StreamTcpThreadInit
TmEcode StreamTcpThreadInit(ThreadVars *tv, void *initdata, void **data)
Definition: stream-tcp.c:5907
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:223
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:523
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:67
FlowQueuePrivatePrependFlow
void FlowQueuePrivatePrependFlow(FlowQueuePrivate *fqc, Flow *f)
Definition: flow-queue.c:78
PKT_NOPAYLOAD_INSPECTION
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:1011
FlowWorkerThreadData_::flows_aside_needs_work
uint16_t flows_aside_needs_work
Definition: flow-worker.c:92
FlowWorkerThreadData_::stream_thread
StreamTcpThread * stream_thread
Definition: flow-worker.c:70
DecodeThreadVars_::counter_tcp_active_sessions
uint16_t counter_tcp_active_sessions
Definition: decode.h:746
TmModule_::ThreadBusy
bool(* ThreadBusy)(ThreadVars *tv, void *thread_data)
Definition: tm-modules.h:64
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:468
TmqhOutputPacketpool
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
Definition: tmqh-packetpool.c:317
PROFILE_FLOWWORKER_STREAM
@ PROFILE_FLOWWORKER_STREAM
Definition: flow-worker.h:23
APP_LAYER_PARSER_EOF_TS
#define APP_LAYER_PARSER_EOF_TS
Definition: app-layer-parser.h:39
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
FlowQueuePrivate_::len
uint32_t len
Definition: flow-queue.h:44
Flow_::protoctx
void * protoctx
Definition: flow.h:441
OutputLoggerThreadDeinit
TmEcode OutputLoggerThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output.c:796
DisableDetectFlowFileFlags
void DisableDetectFlowFileFlags(Flow *f)
disable file features we don't need Called if we have no detection engine.
Definition: detect.c:1874
PacketQueueNoLock_
simple fifo queue for packets
Definition: packet-queue.h:34
tmqh-packetpool.h
FLOW_TIMEOUT_REASSEMBLY_DONE
#define FLOW_TIMEOUT_REASSEMBLY_DONE
Definition: flow.h:94
FLOWWORKER_PROFILING_START
#define FLOWWORKER_PROFILING_START(p, id)
Definition: util-profiling.h:147
FlowSparePoolReturnFlows
void FlowSparePoolReturnFlows(FlowQueuePrivate *fqp)
Definition: flow-spare-pool.c:122
FLOWLOCK_UNLOCK
#define FLOWLOCK_UNLOCK(fb)
Definition: flow.h:268
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:412
FQLOCK_LOCK
#define FQLOCK_LOCK(q)
Definition: flow-queue.h:73
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:50
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1078
STREAM_HAS_UNPROCESSED_SEGMENTS_NONE
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NONE
Definition: stream-tcp.h:177
PKT_IS_TCP
#define PKT_IS_TCP(p)
Definition: decode.h:248
flow-spare-pool.h
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:475
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:599
DetectEngineThreadCtxPtr
DetectEngineThreadCtx * DetectEngineThreadCtxPtr
Definition: flow-worker.c:59
StatsDecr
void StatsDecr(ThreadVars *tv, uint16_t id)
Decrements the local counter.
Definition: counters.c:188
StatsRegisterMaxCounter
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
Definition: counters.c:1011
FlowWorkerThreadData_::flows_aside_pkt_inject
uint16_t flows_aside_pkt_inject
Definition: flow-worker.c:93
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:504
decode.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:55
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:252
DetectEngineThreadCtx_
Definition: detect.h:1092
FlowWorkerThreadData_::flows_injected
uint16_t flows_injected
Definition: flow-worker.c:89
Packet_::ts
SCTime_t ts
Definition: decode.h:485
OutputFlowLogThreadInit
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void *initdata, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
Definition: output-flow.c:123
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:208
ProfileFlowWorkerId
ProfileFlowWorkerId
Definition: flow-worker.h:21
FlowWorkerThreadData_::local_bypass_bytes
uint16_t local_bypass_bytes
Definition: flow-worker.c:80
FlowTimeoutCounters
struct FlowTimeoutCounters FlowTimeoutCounters
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:403
flow-worker.h
FLOWLOCK_WRLOCK
#define FLOWLOCK_WRLOCK(fb)
Definition: flow.h:265
STREAM_FLAGS_FOR_PACKET
#define STREAM_FLAGS_FOR_PACKET(p)
Definition: stream.h:30
FlowForceReassemblyNeedReassembly
int FlowForceReassemblyNeedReassembly(Flow *f)
Check if a flow needs forced reassembly, or any other processing.
Definition: flow-timeout.c:287
StreamTcp
TmEcode StreamTcp(ThreadVars *, Packet *, void *, PacketQueueNoLock *pq)
Definition: stream-tcp.c:5865
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
DetectEngineEnabled
int DetectEngineEnabled(void)
Check if detection is enabled.
Definition: detect-engine.c:3657
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:447
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:53
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:229
flow_spare_pool_block_size
uint32_t flow_spare_pool_block_size
Definition: flow-spare-pool.c:43
FlowWorkerThreadData_::local_bypass_pkts
uint16_t local_bypass_pkts
Definition: flow-worker.c:79
PROFILE_FLOWWORKER_APPLAYERUDP
@ PROFILE_FLOWWORKER_APPLAYERUDP
Definition: flow-worker.h:24
util-time.h
FlowQueuePrivateGetFromTop
Flow * FlowQueuePrivateGetFromTop(FlowQueuePrivate *fqc)
Definition: flow-queue.c:151
FLOWWORKER_PROFILING_END
#define FLOWWORKER_PROFILING_END(p, id)
Definition: util-profiling.h:154
StreamTcpPruneSession
void StreamTcpPruneSession(Flow *f, uint8_t flags)
Remove idle TcpSegments from TcpSession.
Definition: stream-tcp-list.c:890
OutputLoggerThreadInit
TmEcode OutputLoggerThreadInit(ThreadVars *tv, const void *initdata, void **data)
Definition: output.c:765
app-layer-parser.h
ThreadVars_::id
int id
Definition: threadvars.h:86
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
util-profiling.h
Packet_
Definition: decode.h:437
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:220
APP_LAYER_PARSER_EOF_TC
#define APP_LAYER_PARSER_EOF_TC
Definition: app-layer-parser.h:40
AppLayerHandleUdp
int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *tctx, Packet *p, Flow *f)
Handle a app layer UDP message.
Definition: app-layer.c:874
DEBUG_ASSERT_FLOW_LOCKED
#define DEBUG_ASSERT_FLOW_LOCKED(f)
Definition: util-validate.h:100
TmEcode
TmEcode
Definition: tm-threads-common.h:83
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1103
TmModuleFlowWorkerRegister
void TmModuleFlowWorkerRegister(void)
Definition: flow-worker.c:747
FlowQueuePrivateAppendPrivate
void FlowQueuePrivateAppendPrivate(FlowQueuePrivate *dest, FlowQueuePrivate *src)
Definition: flow-queue.c:88
flow-timeout.h
TimeSetByThread
void TimeSetByThread(const int thread_id, SCTime_t tv)
Definition: util-time.c:116
TmModule_::name
const char * name
Definition: tm-modules.h:45
APP_LAYER_PARSER_NO_INSPECTION
#define APP_LAYER_PARSER_NO_INSPECTION
Definition: app-layer-parser.h:35
UPDATE_DIR_OPPOSING
@ UPDATE_DIR_OPPOSING
Definition: stream-tcp-reassemble.h:57
FlowLookupStruct_::spare_queue
FlowQueuePrivate spare_queue
Definition: flow.h:541
TMM_FLOWWORKER
@ TMM_FLOWWORKER
Definition: tm-threads-common.h:34
Flow_::ffr
uint8_t ffr
Definition: flow.h:385
AppLayerParserStateSetFlag
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1786
FlowWorkerGetDetectCtxPtr
void * FlowWorkerGetDetectCtxPtr(void *flow_worker)
Definition: flow-worker.c:691
FlowWorkerThreadData_::cnt
struct FlowWorkerThreadData_::@115 cnt
FlowWorkerThreadData_::stream_thread_ptr
void * stream_thread_ptr
Definition: flow-worker.c:71
FlowQueueExtractPrivate
FlowQueuePrivate FlowQueueExtractPrivate(FlowQueue *fq)
Definition: flow-queue.c:140
FlowWorkerThreadData_::pq
PacketQueueNoLock pq
Definition: flow-worker.c:85
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
app-layer-frames.h
FlowWorkerThreadData_::flows_removed
uint16_t flows_removed
Definition: flow-worker.c:91
Packet_::flow
struct Flow_ * flow
Definition: decode.h:476
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:3244
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:787
flow-manager.h
suricata-common.h
PKT_SRC_FFR
@ PKT_SRC_FFR
Definition: decode.h:61
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:82
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:3454
STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
Definition: stream-tcp.h:180
PROFILE_FLOWWORKER_SIZE
@ PROFILE_FLOWWORKER_SIZE
Definition: flow-worker.h:29
packet.h
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
Packet_::app_update_direction
uint8_t app_update_direction
Definition: decode.h:471
FlowWorkerThreadData_::both_bypass_bytes
uint16_t both_bypass_bytes
Definition: flow-worker.c:82
FLOW_TS_APP_UPDATED
#define FLOW_TS_APP_UPDATED
Definition: flow.h:116
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:48
PacketUpdateEngineEventCounters
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Definition: decode.c:210
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
TmModule_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:49
Detect
TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
Detection engine thread wrapper.
Definition: detect.c:1805
util-validate.h
FlowQueuePrivate_
Definition: flow-queue.h:41
StreamTcpDetectLogFlush
void StreamTcpDetectLogFlush(ThreadVars *tv, StreamTcpThread *stt, Flow *f, Packet *p, PacketQueueNoLock *pq)
create packets in both directions to flush out logging and detection before switching protocols....
Definition: stream-tcp.c:6852
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:37
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:146
FlowWorkerThreadData_::output_thread_flow
void * output_thread_flow
Definition: flow-worker.c:77
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
OutputFlowLogThreadDeinit
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output-flow.c:163
FramesPrune
void FramesPrune(Flow *f, Packet *p)
Definition: app-layer-frames.c:763
OutputLoggerLog
TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data)
Definition: output.c:751
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:592
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:685
Flow_::flags
uint32_t flags
Definition: flow.h:421
StreamTcpSessionCleanup
void StreamTcpSessionCleanup(TcpSession *ssn)
Session cleanup function. Does not free the ssn.
Definition: stream-tcp.c:329
FlowWorkerThreadData_::fls
FlowLookupStruct fls
Definition: flow-worker.c:86
SC_ATOMIC_INITPTR
#define SC_ATOMIC_INITPTR(name)
Definition: util-atomic.h:317
UPDATE_DIR_NONE
@ UPDATE_DIR_NONE
Definition: stream-tcp-reassemble.h:55
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:769
PROFILE_FLOWWORKER_FLOW
@ PROFILE_FLOWWORKER_FLOW
Definition: flow-worker.h:22
StreamTcpThread_::ra_ctx
TcpReassemblyThreadCtx * ra_ctx
Definition: stream-tcp.h:107
PacketDrop
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
Definition: packet.c:32
suricata.h
StreamUpdateDir
StreamUpdateDir
Definition: stream-tcp-reassemble.h:54
FLOW_END_FLAG_TIMEOUT
#define FLOW_END_FLAG_TIMEOUT
Definition: flow.h:238
FlowWorkerThreadData_::fec
FlowEndCounters fec
Definition: flow-worker.c:95
likely
#define likely(expr)
Definition: util-optimize.h:32
FlowWorkerThreadData_::output_thread
void * output_thread
Definition: flow-worker.c:76
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:221
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
TcpSession_
Definition: stream-tcp-private.h:283
FlowEndCountersRegister
void FlowEndCountersRegister(ThreadVars *t, FlowEndCounters *fec)
Definition: flow-util.c:236
FlowWorkerThreadData_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(DetectEngineThreadCtxPtr, detect_thread)
AppLayerParserStateIssetFlag
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1794
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:971
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
FlowEndCounters_
Definition: flow-util.h:148
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:228
FlowWorkerThreadData_::both_bypass_pkts
uint16_t both_bypass_pkts
Definition: flow-worker.c:81
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:103
TM_FLAG_STREAM_TM
#define TM_FLAG_STREAM_TM
Definition: tm-modules.h:34
PKT_DROP_REASON_FLOW_DROP
@ PKT_DROP_REASON_FLOW_DROP
Definition: decode.h:397
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:77
FlowWorkerThreadData_
Definition: flow-worker.c:66
StreamTcpThreadDeinit
TmEcode StreamTcpThreadDeinit(ThreadVars *tv, void *data)
Definition: stream-tcp.c:5994
output.h
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1019
FlowWorkerThreadData_::flows_injected_max
uint16_t flows_injected_max
Definition: flow-worker.c:90
FlowWorkerReplaceDetectCtx
void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx)
Definition: flow-worker.c:684
app-layer.h
FlowTimeoutCounters::flows_aside_needs_work
uint32_t flows_aside_needs_work
Definition: flow-worker.c:62
FQLOCK_UNLOCK
#define FQLOCK_UNLOCK(q)
Definition: flow-queue.h:75