suricata
flow-worker.c
Go to the documentation of this file.
1 /* Copyright (C) 2016-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow Workers are single thread modules taking care of (almost)
24  * everything related to packets with flows:
25  *
26  * - Lookup/creation
27  * - Stream tracking, reassembly
28  * - Applayer update
29  * - Detection
30  *
31  * This all while holding the flow lock.
32  */
33 
34 #include "suricata-common.h"
35 #include "suricata.h"
36 
37 #include "decode.h"
38 #include "detect.h"
39 #include "stream-tcp.h"
40 #include "app-layer.h"
41 #include "detect-engine.h"
42 #include "output.h"
43 #include "app-layer-parser.h"
44 
45 #include "util-validate.h"
46 
47 #include "flow-util.h"
48 #include "flow-manager.h"
49 #include "flow-timeout.h"
50 #include "flow-spare-pool.h"
51 
53 
54 typedef struct FlowTimeoutCounters {
58 
59 typedef struct FlowWorkerThreadData_ {
61 
62  union {
65  };
66 
68 
69  void *output_thread; /* Output thread data. */
70  void *output_thread_flow; /* Output thread data. */
71 
74  uint16_t both_bypass_pkts;
76 
79 
80  struct {
81  uint16_t flows_injected;
82  uint16_t flows_removed;
85  } cnt;
86 
88 
89 static void FlowWorkerFlowTimeout(ThreadVars *tv, Packet *p, FlowWorkerThreadData *fw, void *detect_thread);
91 
92 /**
93  * \internal
94  * \brief Forces reassembly for flow if it needs it.
95  *
96  * The function requires flow to be locked beforehand.
97  *
98  * \param f Pointer to the flow.
99  *
100  * \retval cnt number of packets injected
101  */
102 static int FlowFinish(ThreadVars *tv, Flow *f, FlowWorkerThreadData *fw, void *detect_thread)
103 {
104  Packet *p1 = NULL, *p2 = NULL;
105  const int server = f->ffr_tc;
106  const int client = f->ffr_ts;
107 
108  /* Get the tcp session for the flow */
109  TcpSession *ssn = (TcpSession *)f->protoctx;
110 
111  /* The packets we use are based on what segments in what direction are
112  * unprocessed.
113  * p1 if we have client segments for reassembly purpose only. If we
114  * have no server segments p2 can be a toserver packet with dummy
115  * seq/ack, and if we have server segments p2 has to carry out reassembly
116  * for server segment as well, in which case we will also need a p3 in the
117  * toclient which is now dummy since all we need it for is detection */
118 
119  /* insert a pseudo packet in the toserver direction */
121  p1 = FlowForceReassemblyPseudoPacketGet(0, f, ssn);
122  if (p1 == NULL) {
123  return 0;
124  }
126 
128  p2 = FlowForceReassemblyPseudoPacketGet(1, f, ssn);
129  if (p2 == NULL) {
130  FlowDeReference(&p1->flow);
131  TmqhOutputPacketpool(NULL, p1);
132  return 0;
133  }
135  p2->flowflags |= FLOW_PKT_LAST_PSEUDO;
136  } else {
138  }
139  } else {
141  p1 = FlowForceReassemblyPseudoPacketGet(1, f, ssn);
142  if (p1 == NULL) {
143  return 0;
144  }
147  } else {
148  /* impossible */
149  BUG_ON(1);
150  }
151  }
153 
154  FlowWorkerFlowTimeout(tv, p1, fw, detect_thread);
156  if (p2) {
157  FlowWorkerFlowTimeout(tv, p2, fw, detect_thread);
159  return 2;
160  }
161  return 1;
162 }
163 
164 static void CheckWorkQueue(ThreadVars *tv, FlowWorkerThreadData *fw,
165  void *detect_thread, // TODO proper type?
166  FlowTimeoutCounters *counters,
167  FlowQueuePrivate *fq)
168 {
169  Flow *f;
170  while ((f = FlowQueuePrivateGetFromTop(fq)) != NULL) {
171  f->flow_end_flags |= FLOW_END_FLAG_TIMEOUT; //TODO emerg
172 
173  const FlowStateType state = f->flow_state;
174  if (f->proto == IPPROTO_TCP) {
175  if (!(f->flags & FLOW_TIMEOUT_REASSEMBLY_DONE) &&
176 #ifdef CAPTURE_OFFLOAD
177  state != FLOW_STATE_CAPTURE_BYPASSED &&
178 #endif
179  state != FLOW_STATE_LOCAL_BYPASSED &&
181  f->ffr != 0)
182  {
183  int cnt = FlowFinish(tv, f, fw, detect_thread);
184  counters->flows_aside_pkt_inject += cnt;
185  counters->flows_aside_needs_work++;
186  }
187  }
188 #if 0
189 // 20200501 this *is* possible if the flow timeout handling triggers a proto upgrade (e.g. http->https)
190 #ifdef DEBUG
191  /* this should not be possible */
192  BUG_ON(f->use_cnt > 0);
193 #endif
194 #endif
195  /* no one is referring to this flow, use_cnt 0, removed from hash
196  * so we can unlock it and pass it to the flow recycler */
197 
198  if (fw->output_thread_flow != NULL)
199  (void)OutputFlowLog(tv, fw->output_thread_flow, f);
200 
201  FlowClearMemory (f, f->protomap);
202  FLOWLOCK_UNLOCK(f);
203  if (fw->fls.spare_queue.len >= 200) { // TODO match to API? 200 = 2 * block size
205  } else {
207  }
208 // TODO 20200503 we can get here with use_cnt > 0. How does it work wrt timeout? Should we not queue it? But what then?
209  }
210 }
211 
212 /** \brief handle flow for packet
213  *
214  * Handle flow creation/lookup
215  */
216 static inline TmEcode FlowUpdate(ThreadVars *tv, FlowWorkerThreadData *fw, Packet *p)
217 {
218  FlowHandlePacketUpdate(p->flow, p, tv, fw->dtv);
219 
220  int state = p->flow->flow_state;
221  switch (state) {
222 #ifdef CAPTURE_OFFLOAD
223  case FLOW_STATE_CAPTURE_BYPASSED:
226  return TM_ECODE_DONE;
227 #endif
231  return TM_ECODE_DONE;
232  default:
233  return TM_ECODE_OK;
234  }
235 }
236 
237 static TmEcode FlowWorkerThreadDeinit(ThreadVars *tv, void *data);
238 
239 static TmEcode FlowWorkerThreadInit(ThreadVars *tv, const void *initdata, void **data)
240 {
241  FlowWorkerThreadData *fw = SCCalloc(1, sizeof(*fw));
242  if (fw == NULL)
243  return TM_ECODE_FAILED;
244 
245  SC_ATOMIC_INITPTR(fw->detect_thread);
246  SC_ATOMIC_SET(fw->detect_thread, NULL);
247 
248  fw->local_bypass_pkts = StatsRegisterCounter("flow_bypassed.local_pkts", tv);
249  fw->local_bypass_bytes = StatsRegisterCounter("flow_bypassed.local_bytes", tv);
250  fw->both_bypass_pkts = StatsRegisterCounter("flow_bypassed.local_capture_pkts", tv);
251  fw->both_bypass_bytes = StatsRegisterCounter("flow_bypassed.local_capture_bytes", tv);
252 
253  fw->cnt.flows_aside_needs_work = StatsRegisterCounter("flow.wrk.flows_evicted_needs_work", tv);
254  fw->cnt.flows_aside_pkt_inject = StatsRegisterCounter("flow.wrk.flows_evicted_pkt_inject", tv);
255  fw->cnt.flows_removed = StatsRegisterCounter("flow.wrk.flows_evicted", tv);
256  fw->cnt.flows_injected = StatsRegisterCounter("flow.wrk.flows_injected", tv);
257 
258  fw->fls.dtv = fw->dtv = DecodeThreadVarsAlloc(tv);
259  if (fw->dtv == NULL) {
260  FlowWorkerThreadDeinit(tv, fw);
261  return TM_ECODE_FAILED;
262  }
263 
264  /* setup TCP */
265  if (StreamTcpThreadInit(tv, NULL, &fw->stream_thread_ptr) != TM_ECODE_OK) {
266  FlowWorkerThreadDeinit(tv, fw);
267  return TM_ECODE_FAILED;
268  }
269 
270  if (DetectEngineEnabled()) {
271  /* setup DETECT */
272  void *detect_thread = NULL;
273  if (DetectEngineThreadCtxInit(tv, NULL, &detect_thread) != TM_ECODE_OK) {
274  FlowWorkerThreadDeinit(tv, fw);
275  return TM_ECODE_FAILED;
276  }
277  SC_ATOMIC_SET(fw->detect_thread, detect_thread);
278  }
279 
280  /* Setup outputs for this thread. */
281  if (OutputLoggerThreadInit(tv, initdata, &fw->output_thread) != TM_ECODE_OK) {
282  FlowWorkerThreadDeinit(tv, fw);
283  return TM_ECODE_FAILED;
284  }
286  SCLogError(SC_ERR_THREAD_INIT, "initializing flow log API for thread failed");
287  FlowWorkerThreadDeinit(tv, fw);
288  return TM_ECODE_FAILED;
289  }
290 
293 
294  /* setup pq for stream end pkts */
295  memset(&fw->pq, 0, sizeof(PacketQueueNoLock));
296  *data = fw;
297  return TM_ECODE_OK;
298 }
299 
300 static TmEcode FlowWorkerThreadDeinit(ThreadVars *tv, void *data)
301 {
302  FlowWorkerThreadData *fw = data;
303 
305 
306  /* free TCP */
307  StreamTcpThreadDeinit(tv, (void *)fw->stream_thread);
308 
309  /* free DETECT */
310  void *detect_thread = SC_ATOMIC_GET(fw->detect_thread);
311  if (detect_thread != NULL) {
312  DetectEngineThreadCtxDeinit(tv, detect_thread);
313  SC_ATOMIC_SET(fw->detect_thread, NULL);
314  }
315 
316  /* Free output. */
319 
320  /* free pq */
321  BUG_ON(fw->pq.len);
322 
323  Flow *f;
324  while ((f = FlowQueuePrivateGetFromTop(&fw->fls.spare_queue)) != NULL) {
325  FlowFree(f);
326  }
327 
328  SCFree(fw);
329  return TM_ECODE_OK;
330 }
331 
332 TmEcode Detect(ThreadVars *tv, Packet *p, void *data);
334 
335 static inline void UpdateCounters(ThreadVars *tv,
336  FlowWorkerThreadData *fw, const FlowTimeoutCounters *counters)
337 {
338  if (counters->flows_aside_needs_work) {
340  (uint64_t)counters->flows_aside_needs_work);
341  }
342  if (counters->flows_aside_pkt_inject) {
344  (uint64_t)counters->flows_aside_pkt_inject);
345  }
346 }
347 
348 static void FlowPruneFiles(Packet *p)
349 {
350  if (p->flow && p->flow->alstate) {
351  Flow *f = p->flow;
354  if (fc != NULL) {
355  FilePrune(fc);
356  }
357  }
358 }
359 
360 static inline void FlowWorkerStreamTCPUpdate(ThreadVars *tv, FlowWorkerThreadData *fw,
361  Packet *p, void *detect_thread)
362 {
364  StreamTcp(tv, p, fw->stream_thread, &fw->pq);
366 
367  if (FlowChangeProto(p->flow)) {
368  StreamTcpDetectLogFlush(tv, fw->stream_thread, p->flow, p, &fw->pq);
371  }
372 
373  /* Packets here can safely access p->flow as it's locked */
374  SCLogDebug("packet %"PRIu64": extra packets %u", p->pcap_cnt, fw->pq.len);
375  Packet *x;
376  while ((x = PacketDequeueNoLock(&fw->pq))) {
377  SCLogDebug("packet %"PRIu64" extra packet %p", p->pcap_cnt, x);
378 
379  if (detect_thread != NULL) {
381  Detect(tv, x, detect_thread);
383  }
384 
386 
387  /* put these packets in the preq queue so that they are
388  * by the other thread modules before packet 'p'. */
390  }
391 }
392 
393 static void FlowWorkerFlowTimeout(ThreadVars *tv, Packet *p, FlowWorkerThreadData *fw,
394  void *detect_thread)
395 {
396  SCLogDebug("packet %"PRIu64" is TCP. Direction %s", p->pcap_cnt, PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
399 
400  /* handle TCP and app layer */
401  FlowWorkerStreamTCPUpdate(tv, fw, p, detect_thread);
402 
404 
405  /* handle Detect */
406  SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt);
407  if (detect_thread != NULL) {
409  Detect(tv, p, detect_thread);
411  }
412 
413  // Outputs.
415 
416  /* Prune any stored files. */
417  FlowPruneFiles(p);
418 
419  /* Release tcp segments. Done here after alerting can use them. */
424 
425  /* run tx cleanup last */
427 
428  FlowDeReference(&p->flow);
429  /* flow is unlocked later in FlowFinish() */
430 }
431 
432 /** \internal
433  * \brief process flows injected into our queue by other threads
434  */
435 static inline void FlowWorkerProcessInjectedFlows(ThreadVars *tv,
436  FlowWorkerThreadData *fw, Packet *p, void *detect_thread)
437 {
438  /* take injected flows and append to our work queue */
440  FlowQueuePrivate injected = { NULL, NULL, 0 };
441  if (SC_ATOMIC_GET(tv->flow_queue->non_empty) == true)
443  if (injected.len > 0) {
444  StatsAddUI64(tv, fw->cnt.flows_injected, (uint64_t)injected.len);
445 
446  FlowTimeoutCounters counters = { 0, 0, };
447  CheckWorkQueue(tv, fw, detect_thread, &counters, &injected);
448  UpdateCounters(tv, fw, &counters);
449  }
451 }
452 
453 /** \internal
454  * \brief process flows set aside locally during flow lookup
455  */
456 static inline void FlowWorkerProcessLocalFlows(ThreadVars *tv,
457  FlowWorkerThreadData *fw, Packet *p, void *detect_thread)
458 {
460  if (fw->fls.work_queue.len) {
461  StatsAddUI64(tv, fw->cnt.flows_removed, (uint64_t)fw->fls.work_queue.len);
462 
463  FlowTimeoutCounters counters = { 0, 0, };
464  CheckWorkQueue(tv, fw, detect_thread, &counters, &fw->fls.work_queue);
465  UpdateCounters(tv, fw, &counters);
466  }
468 }
469 
470 static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
471 {
472  FlowWorkerThreadData *fw = data;
473  void *detect_thread = SC_ATOMIC_GET(fw->detect_thread);
474 
475  DEBUG_VALIDATE_BUG_ON(p == NULL);
477 
478  SCLogDebug("packet %"PRIu64, p->pcap_cnt);
479 
480  /* update time */
481  if (!(PKT_IS_PSEUDOPKT(p))) {
482  TimeSetByThread(tv->id, &p->ts);
483  }
484 
485  /* handle Flow */
486  if (p->flags & PKT_WANTS_FLOW) {
488 
489  FlowHandlePacket(tv, &fw->fls, p);
490  if (likely(p->flow != NULL)) {
492  if (FlowUpdate(tv, fw, p) == TM_ECODE_DONE) {
493  FLOWLOCK_UNLOCK(p->flow);
494  return TM_ECODE_OK;
495  }
496  }
497  /* Flow is now LOCKED */
498 
500 
501  /* if PKT_WANTS_FLOW is not set, but PKT_HAS_FLOW is, then this is a
502  * pseudo packet created by the flow manager. */
503  } else if (p->flags & PKT_HAS_FLOW) {
504  FLOWLOCK_WRLOCK(p->flow);
506  }
507 
508  SCLogDebug("packet %"PRIu64" has flow? %s", p->pcap_cnt, p->flow ? "yes" : "no");
509 
510  /* handle TCP and app layer */
511  if (p->flow && PKT_IS_TCP(p)) {
512  SCLogDebug("packet %"PRIu64" is TCP. Direction %s", p->pcap_cnt, PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
514 
515  /* if detect is disabled, we need to apply file flags to the flow
516  * here on the first packet. */
517  if (detect_thread == NULL &&
520  {
522  }
523 
524  FlowWorkerStreamTCPUpdate(tv, fw, p, detect_thread);
525 
526  /* handle the app layer part of the UDP packet payload */
527  } else if (p->flow && p->proto == IPPROTO_UDP) {
531  }
532 
534 
535  /* handle Detect */
537  SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt);
538  if (detect_thread != NULL) {
540  Detect(tv, p, detect_thread);
542  }
543 
544  // Outputs.
546 
547  /* Prune any stored files. */
548  FlowPruneFiles(p);
549 
550  /* Release tcp segments. Done here after alerting can use them. */
551  if (p->flow != NULL) {
553 
554  if (p->proto == IPPROTO_TCP) {
559  }
560 
561  /* run tx cleanup last */
563 
564  Flow *f = p->flow;
565  FlowDeReference(&p->flow);
566  FLOWLOCK_UNLOCK(f);
567  }
568 
569  /* take injected flows and process them */
570  FlowWorkerProcessInjectedFlows(tv, fw, p, detect_thread);
571 
572  /* process local work queue */
573  FlowWorkerProcessLocalFlows(tv, fw, p, detect_thread);
574 
575  return TM_ECODE_OK;
576 }
577 
578 void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx)
579 {
580  FlowWorkerThreadData *fw = flow_worker;
581 
582  SC_ATOMIC_SET(fw->detect_thread, detect_ctx);
583 }
584 
585 void *FlowWorkerGetDetectCtxPtr(void *flow_worker)
586 {
587  FlowWorkerThreadData *fw = flow_worker;
588 
589  return SC_ATOMIC_GET(fw->detect_thread);
590 }
591 
593 {
594  switch (fwi) {
596  return "flow";
598  return "stream";
600  return "app-layer";
602  return "detect";
604  return "tcp-prune";
606  return "flow-inject";
608  return "flow-evict";
610  return "size";
611  }
612  return "error";
613 }
614 
615 static void FlowWorkerExitPrintStats(ThreadVars *tv, void *data)
616 {
617  FlowWorkerThreadData *fw = data;
619 }
620 
622 {
623  tmm_modules[TMM_FLOWWORKER].name = "FlowWorker";
624  tmm_modules[TMM_FLOWWORKER].ThreadInit = FlowWorkerThreadInit;
625  tmm_modules[TMM_FLOWWORKER].Func = FlowWorker;
626  tmm_modules[TMM_FLOWWORKER].ThreadDeinit = FlowWorkerThreadDeinit;
627  tmm_modules[TMM_FLOWWORKER].ThreadExitPrintStats = FlowWorkerExitPrintStats;
630 }
PKT_IS_TOCLIENT
#define PKT_IS_TOCLIENT(p)
Definition: decode.h:264
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:67
Flow_::ffr_tc
uint8_t ffr_tc
Definition: flow.h:381
FlowLookupStruct_::work_queue
FlowQueuePrivate work_queue
Definition: flow.h:536
ThreadVars_::flow_queue
struct FlowQueue_ * flow_queue
Definition: threadvars.h:133
OutputFlowLog
TmEcode OutputFlowLog(ThreadVars *tv, void *thread_data, Flow *f)
Run flow logger(s)
Definition: output-flow.c:91
Packet_::proto
uint8_t proto
Definition: decode.h:436
FileContainer_
Definition: util-file.h:100
TimeSetByThread
void TimeSetByThread(const int thread_id, const struct timeval *tv)
Definition: util-time.c:114
FlowTimeoutCounters
Definition: flow-worker.c:54
detect-engine.h
Flow_::ffr_ts
uint8_t ffr_ts
Definition: flow.h:380
PROFILE_FLOWWORKER_DETECT
@ PROFILE_FLOWWORKER_DETECT
Definition: flow-worker.h:25
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1109
FlowSparePoolReturnFlow
void FlowSparePoolReturnFlow(Flow *f)
Definition: flow-spare-pool.c:101
PROFILE_FLOWWORKER_FLOW_INJECTED
@ PROFILE_FLOWWORKER_FLOW_INJECTED
Definition: flow-worker.h:27
flow-util.h
FlowWorkerThreadData
struct FlowWorkerThreadData_ FlowWorkerThreadData
FlowLookupStruct_::dtv
DecodeThreadVars * dtv
Definition: flow.h:535
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1147
stream-tcp.h
PacketPoolReturnPacket
void PacketPoolReturnPacket(Packet *p)
Return packet to Packet pool.
Definition: tmqh-packetpool.c:225
FLOW_PKT_LAST_PSEUDO
#define FLOW_PKT_LAST_PSEUDO
Definition: flow.h:228
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
PROFILE_FLOWWORKER_FLOW_EVICTED
@ PROFILE_FLOWWORKER_FLOW_EVICTED
Definition: flow-worker.h:28
ProfileFlowWorkerIdToString
const char * ProfileFlowWorkerIdToString(enum ProfileFlowWorkerId fwi)
Definition: flow-worker.c:592
OutputLoggerExitPrintStats
void OutputLoggerExitPrintStats(ThreadVars *tv, void *thread_data)
Definition: output.c:948
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:570
StreamTcpThread_
Definition: stream-tcp.h:70
PROFILE_FLOWWORKER_TCPPRUNE
@ PROFILE_FLOWWORKER_TCPPRUNE
Definition: flow-worker.h:26
TM_FLAG_DETECT_TM
#define TM_FLAG_DETECT_TM
Definition: tm-modules.h:34
Flow_::proto
uint8_t proto
Definition: flow.h:365
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:82
TcpReassemblyThreadCtx_::app_tctx
void * app_tctx
Definition: stream-tcp-reassemble.h:61
Packet_::flags
uint32_t flags
Definition: decode.h:449
Flow_
Flow data structure.
Definition: flow.h:347
Flow_::protomap
uint8_t protomap
Definition: flow.h:445
PKT_WANTS_FLOW
#define PKT_WANTS_FLOW
Definition: decode.h:1130
FlowTimeoutCounters::flows_aside_pkt_inject
uint32_t flows_aside_pkt_inject
Definition: flow-worker.c:56
AppLayerRegisterThreadCounters
void AppLayerRegisterThreadCounters(ThreadVars *tv)
Registers per flow counters for all protocols.
Definition: app-layer.c:954
FlowLookupStruct_
Definition: flow.h:532
FlowWorkerThreadData_::dtv
DecodeThreadVars * dtv
Definition: flow-worker.c:60
Flow_::use_cnt
FlowRefCount use_cnt
Definition: flow.h:373
StreamTcpThreadInit
TmEcode StreamTcpThreadInit(ThreadVars *tv, void *initdata, void **data)
Definition: stream-tcp.c:5202
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:219
AppLayerParserGetFiles
FileContainer * AppLayerParserGetFiles(const Flow *f, const uint8_t direction)
Definition: app-layer-parser.c:858
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:500
FlowQueuePrivatePrependFlow
void FlowQueuePrivatePrependFlow(FlowQueuePrivate *fqc, Flow *f)
Definition: flow-queue.c:79
FlowWorkerThreadData_::flows_aside_needs_work
uint16_t flows_aside_needs_work
Definition: flow-worker.c:83
FlowWorkerThreadData_::stream_thread
StreamTcpThread * stream_thread
Definition: flow-worker.c:63
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:445
TmqhOutputPacketpool
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
Definition: tmqh-packetpool.c:375
PROFILE_FLOWWORKER_STREAM
@ PROFILE_FLOWWORKER_STREAM
Definition: flow-worker.h:23
APP_LAYER_PARSER_EOF_TS
#define APP_LAYER_PARSER_EOF_TS
Definition: app-layer-parser.h:41
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
FlowQueuePrivate_::len
uint32_t len
Definition: flow-queue.h:44
Flow_::protoctx
void * protoctx
Definition: flow.h:441
OutputLoggerThreadDeinit
TmEcode OutputLoggerThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output.c:922
DisableDetectFlowFileFlags
void DisableDetectFlowFileFlags(Flow *f)
disable file features we don't need Called if we have no detection engine.
Definition: detect.c:1678
PacketQueueNoLock_
simple fifo queue for packets
Definition: packet-queue.h:32
FLOW_TIMEOUT_REASSEMBLY_DONE
#define FLOW_TIMEOUT_REASSEMBLY_DONE
Definition: flow.h:92
FLOWWORKER_PROFILING_START
#define FLOWWORKER_PROFILING_START(p, id)
Definition: util-profiling.h:166
FLOWLOCK_UNLOCK
#define FLOWLOCK_UNLOCK(fb)
Definition: flow.h:264
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:412
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1150
SC_ERR_THREAD_INIT
@ SC_ERR_THREAD_INIT
Definition: util-error.h:79
PKT_IS_TCP
#define PKT_IS_TCP(p)
Definition: decode.h:259
flow-spare-pool.h
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:475
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:484
DetectEngineThreadCtxPtr
DetectEngineThreadCtx * DetectEngineThreadCtxPtr
Definition: flow-worker.c:52
FilePrune
void FilePrune(FileContainer *ffc)
Definition: util-file.c:388
FlowWorkerThreadData_::flows_aside_pkt_inject
uint16_t flows_aside_pkt_inject
Definition: flow-worker.c:84
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:502
decode.h
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:263
DetectEngineThreadCtx_
Definition: detect.h:1010
FlowWorkerThreadData_::flows_injected
uint16_t flows_injected
Definition: flow-worker.c:81
OutputFlowLogThreadInit
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void *initdata, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
Definition: output-flow.c:131
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:206
ProfileFlowWorkerId
ProfileFlowWorkerId
Definition: flow-worker.h:21
FlowWorkerThreadData_::local_bypass_bytes
uint16_t local_bypass_bytes
Definition: flow-worker.c:73
FlowTimeoutCounters
struct FlowTimeoutCounters FlowTimeoutCounters
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:389
STREAM_TOSERVER
#define STREAM_TOSERVER
Definition: stream.h:31
FLOWLOCK_WRLOCK
#define FLOWLOCK_WRLOCK(fb)
Definition: flow.h:261
FlowForceReassemblyNeedReassembly
int FlowForceReassemblyNeedReassembly(Flow *f)
Check if a flow needs forced reassembly, or any other processing.
Definition: flow-timeout.c:294
StreamTcp
TmEcode StreamTcp(ThreadVars *, Packet *, void *, PacketQueueNoLock *pq)
Definition: stream-tcp.c:5166
STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
Definition: stream-tcp.h:174
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineEnabled
int DetectEngineEnabled(void)
Check if detection is enabled.
Definition: detect-engine.c:3199
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:447
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:52
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:225
FlowWorkerThreadData_::local_bypass_pkts
uint16_t local_bypass_pkts
Definition: flow-worker.c:72
PROFILE_FLOWWORKER_APPLAYERUDP
@ PROFILE_FLOWWORKER_APPLAYERUDP
Definition: flow-worker.h:24
FlowWorkerThreadData_::cnt
struct FlowWorkerThreadData_::@118 cnt
FlowQueuePrivateGetFromTop
Flow * FlowQueuePrivateGetFromTop(FlowQueuePrivate *fqc)
Definition: flow-queue.c:152
FLOWWORKER_PROFILING_END
#define FLOWWORKER_PROFILING_END(p, id)
Definition: util-profiling.h:173
StreamTcpPruneSession
void StreamTcpPruneSession(Flow *f, uint8_t flags)
Remove idle TcpSegments from TcpSession.
Definition: stream-tcp-list.c:801
OutputLoggerThreadInit
TmEcode OutputLoggerThreadInit(ThreadVars *tv, const void *initdata, void **data)
Definition: output.c:891
app-layer-parser.h
ThreadVars_::id
int id
Definition: threadvars.h:87
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:282
Packet_
Definition: decode.h:414
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:33
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:230
APP_LAYER_PARSER_EOF_TC
#define APP_LAYER_PARSER_EOF_TC
Definition: app-layer-parser.h:42
AppLayerHandleUdp
int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *tctx, Packet *p, Flow *f)
Handle a app layer UDP message.
Definition: app-layer.c:716
DEBUG_ASSERT_FLOW_LOCKED
#define DEBUG_ASSERT_FLOW_LOCKED(f)
Definition: util-validate.h:108
TmEcode
TmEcode
Definition: tm-threads-common.h:79
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1060
TmModuleFlowWorkerRegister
void TmModuleFlowWorkerRegister(void)
Definition: flow-worker.c:621
flow-timeout.h
TmModule_::name
const char * name
Definition: tm-modules.h:44
FlowLookupStruct_::spare_queue
FlowQueuePrivate spare_queue
Definition: flow.h:534
TMM_FLOWWORKER
@ TMM_FLOWWORKER
Definition: tm-threads-common.h:34
Flow_::ffr
uint8_t ffr
Definition: flow.h:383
FlowWorkerGetDetectCtxPtr
void * FlowWorkerGetDetectCtxPtr(void *flow_worker)
Definition: flow-worker.c:585
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:167
FlowWorkerThreadData_::stream_thread_ptr
void * stream_thread_ptr
Definition: flow-worker.c:64
FlowQueueExtractPrivate
FlowQueuePrivate FlowQueueExtractPrivate(FlowQueue *fq)
Definition: flow-queue.c:141
FlowWorkerThreadData_::pq
PacketQueueNoLock pq
Definition: flow-worker.c:77
FlowWorkerThreadData_::flows_removed
uint16_t flows_removed
Definition: flow-worker.c:82
Packet_::flow
struct Flow_ * flow
Definition: decode.h:451
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:2797
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:876
FlowStateType
unsigned short FlowStateType
Definition: flow.h:323
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:658
Packet_::ts
struct timeval ts
Definition: decode.h:457
flow-manager.h
suricata-common.h
PKT_SRC_FFR
@ PKT_SRC_FFR
Definition: decode.h:57
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:80
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:3005
PROFILE_FLOWWORKER_SIZE
@ PROFILE_FLOWWORKER_SIZE
Definition: flow-worker.h:29
STREAM_TOCLIENT
#define STREAM_TOCLIENT
Definition: stream.h:32
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
FlowWorkerThreadData_::both_bypass_bytes
uint16_t both_bypass_bytes
Definition: flow-worker.c:75
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
PacketUpdateEngineEventCounters
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Definition: decode.c:125
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
TmModule_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: tm-modules.h:48
Detect
TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
Detection engine thread wrapper.
Definition: detect.c:1620
util-validate.h
FlowQueuePrivate_
Definition: flow-queue.h:41
StreamTcpDetectLogFlush
void StreamTcpDetectLogFlush(ThreadVars *tv, StreamTcpThread *stt, Flow *f, Packet *p, PacketQueueNoLock *pq)
create packets in both directions to flush out logging and detection before switching protocols....
Definition: stream-tcp.c:6166
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:35
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:148
FlowWorkerThreadData_::output_thread_flow
void * output_thread_flow
Definition: flow-worker.c:70
OutputFlowLogThreadDeinit
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output-flow.c:173
OutputLoggerLog
TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data)
Definition: output.c:876
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:555
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:631
Flow_::alstate
void * alstate
Definition: flow.h:476
Flow_::flags
uint32_t flags
Definition: flow.h:421
FlowWorkerThreadData_::fls
FlowLookupStruct fls
Definition: flow-worker.c:78
SC_ATOMIC_INITPTR
#define SC_ATOMIC_INITPTR(name)
Definition: util-atomic.h:318
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:639
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:110
PROFILE_FLOWWORKER_FLOW
@ PROFILE_FLOWWORKER_FLOW
Definition: flow-worker.h:22
StreamTcpThread_::ra_ctx
TcpReassemblyThreadCtx * ra_ctx
Definition: stream-tcp.h:103
suricata.h
FLOW_END_FLAG_TIMEOUT
#define FLOW_END_FLAG_TIMEOUT
Definition: flow.h:234
AppLayerParserStateSetFlag
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag)
Definition: app-layer-parser.c:1615
likely
#define likely(expr)
Definition: util-optimize.h:32
FlowWorkerThreadData_::output_thread
void * output_thread
Definition: flow-worker.c:69
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:212
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
TcpSession_
Definition: stream-tcp-private.h:261
FlowWorkerThreadData_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(DetectEngineThreadCtxPtr, detect_thread)
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:939
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:224
FlowWorkerThreadData_::both_bypass_pkts
uint16_t both_bypass_pkts
Definition: flow-worker.c:74
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
TM_FLAG_STREAM_TM
#define TM_FLAG_STREAM_TM
Definition: tm-modules.h:33
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:70
FlowWorkerThreadData_
Definition: flow-worker.c:59
StreamTcpThreadDeinit
TmEcode StreamTcpThreadDeinit(ThreadVars *tv, void *data)
Definition: stream-tcp.c:5269
output.h
FlowWorkerReplaceDetectCtx
void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx)
Definition: flow-worker.c:578
app-layer.h
FlowForceReassemblyPseudoPacketGet
Packet * FlowForceReassemblyPseudoPacketGet(int direction, Flow *f, TcpSession *ssn)
Definition: flow-timeout.c:271
FlowTimeoutCounters::flows_aside_needs_work
uint32_t flows_aside_needs_work
Definition: flow-worker.c:55