Go to the documentation of this file.
101 static void FlowWorkerFlowTimeout(
116 const int server = f->
ffr_tc;
117 const int client = f->
ffr_ts;
131 FlowWorkerFlowTimeout(
tv, p, fw, detect_thread);
143 FlowWorkerFlowTimeout(
tv, p, fw, detect_thread);
167 if (f->
proto == IPPROTO_TCP) {
172 int cnt = FlowFinish(
tv, f, fw, detect_thread);
184 FlowEndCountersUpdate(
tv, &fw->
fec, f);
202 if (max_work != 0 && ++i == max_work)
205 if (ret_queue.
len > 0) {
222 #ifdef CAPTURE_OFFLOAD
223 case FLOW_STATE_CAPTURE_BYPASSED: {
227 FlowDeReference(&p->
flow);
236 FlowDeReference(&p->
flow);
268 if (fw->
dtv == NULL) {
269 FlowWorkerThreadDeinit(
tv, fw);
275 FlowWorkerThreadDeinit(
tv, fw);
281 void *detect_thread = NULL;
283 FlowWorkerThreadDeinit(
tv, fw);
291 FlowWorkerThreadDeinit(
tv, fw);
295 SCLogError(
"initializing flow log API for thread failed");
296 FlowWorkerThreadDeinit(
tv, fw);
321 if (detect_thread != NULL) {
367 void *detect_thread,
const bool timeout)
374 bool setting_nopayload =
380 if (setting_nopayload) {
381 FlowSetNoPayloadInspectionFlag(p->
flow);
393 if (detect_thread != NULL) {
409 FlowDeReference(&x->
flow);
436 FlowWorkerStreamTCPUpdate(
tv, fw, p, detect_thread,
true);
442 if (detect_thread != NULL) {
456 STREAM_TOSERVER : STREAM_TOCLIENT);
462 FlowDeReference(&p->
flow);
469 static inline void FlowWorkerProcessInjectedFlows(
477 if (injected.
len > 0) {
493 uint32_t max_work = 2;
501 UpdateCounters(
tv, fw, &counters);
509 static void PacketAppUpdate2FlowFlags(
Packet *p)
527 SCLogDebug(
"pcap_cnt %" PRIu64
", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set",
531 SCLogDebug(
"pcap_cnt %" PRIu64
", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set",
538 SCLogDebug(
"pcap_cnt %" PRIu64
", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set",
542 SCLogDebug(
"pcap_cnt %" PRIu64
", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set",
604 ": direction %s FLOW_TS_APP_UPDATE_NEXT %s FLOW_TC_APP_UPDATE_NEXT %s",
619 if (PacketIsTCP(p)) {
626 if (detect_thread == NULL &&
632 FlowWorkerStreamTCPUpdate(
tv, fw, p, detect_thread,
false);
633 PacketAppUpdate2FlowFlags(p);
640 PacketAppUpdate2FlowFlags(p);
649 if (detect_thread != NULL) {
659 if (p->
flow != NULL) {
662 if (FlowIsBypassed(p->
flow)) {
664 if (p->
proto == IPPROTO_TCP) {
675 STREAM_TOSERVER : STREAM_TOCLIENT);
677 }
else if (p->
proto == IPPROTO_UDP) {
699 SCLogDebug(
"not pseudo, no app update: skip");
703 SCLogDebug(
"flow drop in place: remove app update flags");
708 FlowDeReference(&p->
flow);
715 FlowWorkerProcessInjectedFlows(
tv, fw, p);
718 FlowWorkerProcessLocalFlows(
tv, fw, p);
768 return "flow-inject";
777 static bool FlowWorkerIsBusy(
ThreadVars *
tv,
void *flow_worker)
#define PKT_IS_TOCLIENT(p)
bool PacketCheckAction(const Packet *p, const uint8_t a)
FlowQueuePrivate work_queue
struct FlowQueue_ * flow_queue
TmEcode OutputFlowLog(ThreadVars *tv, void *thread_data, Flow *f)
Run flow logger(s)
#define FLOW_TC_APP_UPDATE_NEXT
void FlowCleanupAppLayer(Flow *f)
@ PROFILE_FLOWWORKER_DETECT
uint16_t counter_flow_active
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
@ PROFILE_FLOWWORKER_FLOW_INJECTED
struct FlowWorkerThreadData_ FlowWorkerThreadData
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
void PacketPoolReturnPacket(Packet *p)
Return packet to Packet pool.
#define FLOW_PKT_LAST_PSEUDO
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
remove obsolete (inspected and logged) transactions
@ PROFILE_FLOWWORKER_FLOW_EVICTED
const char * ProfileFlowWorkerIdToString(enum ProfileFlowWorkerId fwi)
@ PROFILE_FLOWWORKER_TCPPRUNE
#define TM_FLAG_DETECT_TM
@ PKT_SRC_CAPTURE_TIMEOUT
#define FLOW_TC_APP_UPDATED
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
uint32_t flows_aside_pkt_inject
void AppLayerRegisterThreadCounters(ThreadVars *tv)
Registers per flow counters for all protocols.
TmEcode StreamTcpThreadInit(ThreadVars *tv, void *initdata, void **data)
#define SC_ATOMIC_CAS(name, cmpval, newval)
atomic Compare and Switch
#define FLOW_PKT_TOSERVER
Packet * FlowPseudoPacketGet(int direction, Flow *f, const TcpSession *ssn)
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
void FlowQueuePrivatePrependFlow(FlowQueuePrivate *fqc, Flow *f)
#define PKT_NOPAYLOAD_INSPECTION
uint16_t flows_aside_needs_work
StreamTcpThread * stream_thread
uint16_t counter_tcp_active_sessions
bool(* ThreadBusy)(ThreadVars *tv, void *thread_data)
#define PKT_IS_FLUSHPKT(p)
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
@ PROFILE_FLOWWORKER_STREAM
#define APP_LAYER_PARSER_EOF_TS
TmEcode OutputLoggerThreadDeinit(ThreadVars *tv, void *thread_data)
void DisableDetectFlowFileFlags(Flow *f)
disable file features we don't need Called if we have no detection engine.
simple fifo queue for packets
#define FLOW_TIMEOUT_REASSEMBLY_DONE
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
#define FLOWWORKER_PROFILING_START(p, id)
void FlowSparePoolReturnFlows(FlowQueuePrivate *fqp)
#define FLOWLOCK_UNLOCK(fb)
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
#define PKT_SET_SRC(p, src_val)
AppLayerParserState * alparser
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
DetectEngineThreadCtx * DetectEngineThreadCtxPtr
void StatsDecr(ThreadVars *tv, uint16_t id)
Decrements the local counter.
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
uint16_t flows_aside_pkt_inject
@ FLOW_STATE_LOCAL_BYPASSED
#define PKT_IS_TOSERVER(p)
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NONE
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
uint16_t local_bypass_bytes
struct FlowTimeoutCounters FlowTimeoutCounters
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
#define FLOWLOCK_WRLOCK(fb)
#define STREAM_FLAGS_FOR_PACKET(p)
TmEcode StreamTcp(ThreadVars *, Packet *, void *, PacketQueueNoLock *pq)
Per thread variable structure.
int DetectEngineEnabled(void)
Check if detection is enabled.
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
TmEcode(* Func)(ThreadVars *, Packet *, void *)
#define FLOW_PKT_TOCLIENT_FIRST
uint16_t local_bypass_pkts
@ PROFILE_FLOWWORKER_APPLAYERUDP
Flow * FlowQueuePrivateGetFromTop(FlowQueuePrivate *fqc)
#define FLOWWORKER_PROFILING_END(p, id)
void StreamTcpPruneSession(Flow *f, uint8_t flags)
Remove idle TcpSegments from TcpSession.
TmEcode OutputLoggerThreadInit(ThreadVars *tv, const void *initdata, void **data)
bool FlowWorkerGetFlushAck(void *flow_worker)
TmModule tmm_modules[TMM_SIZE]
#define APP_LAYER_PARSER_EOF_TC
int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *tctx, Packet *p, Flow *f)
Handle a app layer UDP message.
#define DEBUG_ASSERT_FLOW_LOCKED(f)
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
void TmModuleFlowWorkerRegister(void)
void FlowQueuePrivateAppendPrivate(FlowQueuePrivate *dest, FlowQueuePrivate *src)
void TimeSetByThread(const int thread_id, SCTime_t tv)
#define APP_LAYER_PARSER_NO_INSPECTION
FlowQueuePrivate spare_queue
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint16_t flag)
void * FlowWorkerGetDetectCtxPtr(void *flow_worker)
FlowQueuePrivate FlowQueueExtractPrivate(FlowQueue *fq)
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
void FlowFree(Flow *f)
cleanup & free the memory of a flow
void * FlowWorkerGetThreadData(void *flow_worker)
@ PROFILE_FLOWWORKER_SIZE
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
uint8_t app_update_direction
void FlowWorkerSetFlushAck(void *flow_worker)
uint16_t both_bypass_bytes
#define FLOW_TS_APP_UPDATED
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
Detection engine thread wrapper.
void StreamTcpDetectLogFlush(ThreadVars *tv, StreamTcpThread *stt, Flow *f, Packet *p, PacketQueueNoLock *pq)
create packets in both directions to flush out logging and detection before switching protocols....
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
void * output_thread_flow
#define SCLogError(...)
Macro used to log ERROR messages.
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
void FramesPrune(Flow *f, Packet *p)
TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data)
Structure to hold thread specific data for all decode modules.
TmEcode OutputLoggerFlush(ThreadVars *tv, Packet *p, void *thread_data)
void StreamTcpSessionCleanup(TcpSession *ssn)
Session cleanup function. Does not free the ssn.
#define SC_ATOMIC_INITPTR(name)
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
@ PROFILE_FLOWWORKER_FLOW
struct FlowWorkerThreadData_::@110 cnt
TcpReassemblyThreadCtx * ra_ctx
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
#define FLOW_END_FLAG_TIMEOUT
bool FlowNeedsReassembly(Flow *f)
Check if a flow needs forced reassembly, or any other processing.
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
void FlowEndCountersRegister(ThreadVars *t, FlowEndCounters *fec)
SC_ATOMIC_DECLARE(DetectEngineThreadCtxPtr, detect_thread)
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
#define FLOW_SPARE_POOL_BLOCK_SIZE
#define FLOW_PKT_TOSERVER_FIRST
uint16_t both_bypass_pkts
#define DEBUG_VALIDATE_BUG_ON(exp)
#define TM_FLAG_STREAM_TM
@ PKT_DROP_REASON_FLOW_DROP
SC_ATOMIC_DECLARE(bool, flush_ack)
#define FLOW_TS_APP_UPDATE_NEXT
TmEcode StreamTcpThreadDeinit(ThreadVars *tv, void *data)
uint16_t flows_injected_max
void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx)
uint32_t flows_aside_needs_work