suricata
flow-worker.c
Go to the documentation of this file.
1 /* Copyright (C) 2016-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow Workers are single thread modules taking care of (almost)
24  * everything related to packets with flows:
25  *
26  * - Lookup/creation
27  * - Stream tracking, reassembly
28  * - Applayer update
29  * - Detection
30  *
31  * This all while holding the flow lock.
32  */
33 
34 #include "suricata-common.h"
35 #include "suricata.h"
36 
37 #include "action-globals.h"
38 #include "packet.h"
39 #include "decode.h"
40 #include "detect.h"
41 #include "stream-tcp.h"
42 #include "app-layer.h"
43 #include "detect-engine.h"
44 #include "output.h"
45 #include "app-layer-parser.h"
46 #include "app-layer-frames.h"
47 
48 #include "util-profiling.h"
49 #include "util-validate.h"
50 #include "util-time.h"
51 #include "tmqh-packetpool.h"
52 
53 #include "flow-util.h"
54 #include "flow-manager.h"
55 #include "flow-timeout.h"
56 #include "flow-spare-pool.h"
57 #include "flow-worker.h"
58 
60 
61 typedef struct FlowTimeoutCounters {
65 
66 typedef struct FlowWorkerThreadData_ {
68 
69  union {
72  };
73 
75 
76  SC_ATOMIC_DECLARE(bool, flush_ack);
77 
78  void *output_thread; /* Output thread data. */
79  void *output_thread_flow; /* Output thread data. */
80 
83  uint16_t both_bypass_pkts;
85  /** Queue to put pseudo packets that have been created by the stream (RST response) and by the
86  * flush logic following a protocol change. */
89 
90  struct {
91  uint16_t flows_injected;
93  uint16_t flows_removed;
96  } cnt;
98 
100 
101 static void FlowWorkerFlowTimeout(
102  ThreadVars *tv, Packet *p, FlowWorkerThreadData *fw, void *detect_thread);
103 
104 /**
105  * \internal
106  * \brief Forces reassembly for flow if it needs it.
107  *
108  * The function requires flow to be locked beforehand.
109  *
110  * \param f Pointer to the flow.
111  *
112  * \retval cnt number of packets injected
113  */
114 static int FlowFinish(ThreadVars *tv, Flow *f, FlowWorkerThreadData *fw, void *detect_thread)
115 {
116  const int server = f->ffr_tc;
117  const int client = f->ffr_ts;
118  int cnt = 0;
119 
120  /* Get the tcp session for the flow */
121  const TcpSession *ssn = (TcpSession *)f->protoctx;
122 
123  /* insert a pseudo packet in the toserver direction */
125  Packet *p = FlowPseudoPacketGet(0, f, ssn);
126  if (p != NULL) {
128  if (server == STREAM_HAS_UNPROCESSED_SEGMENTS_NONE) {
130  }
131  FlowWorkerFlowTimeout(tv, p, fw, detect_thread);
133  cnt++;
134  }
135  }
136 
137  /* handle toclient */
139  Packet *p = FlowPseudoPacketGet(1, f, ssn);
140  if (p != NULL) {
143  FlowWorkerFlowTimeout(tv, p, fw, detect_thread);
146  cnt++;
147  }
148  }
149 
150  if (cnt > 0) {
152  }
153  return cnt;
154 }
155 
156 /** \param[in] max_work Max flows to process. 0 if unlimited. */
157 static void CheckWorkQueue(ThreadVars *tv, FlowWorkerThreadData *fw, FlowTimeoutCounters *counters,
158  FlowQueuePrivate *fq, const uint32_t max_work)
159 {
160  FlowQueuePrivate ret_queue = { NULL, NULL, 0 };
161  uint32_t i = 0;
162  Flow *f;
163  while ((f = FlowQueuePrivateGetFromTop(fq)) != NULL) {
164  FLOWLOCK_WRLOCK(f);
165  f->flow_end_flags |= FLOW_END_FLAG_TIMEOUT; //TODO emerg
166 
167  if (f->proto == IPPROTO_TCP) {
169  !FlowIsBypassed(f) && FlowNeedsReassembly(f) && f->ffr != 0) {
170  /* read detect thread in case we're doing a reload */
171  void *detect_thread = SC_ATOMIC_GET(fw->detect_thread);
172  int cnt = FlowFinish(tv, f, fw, detect_thread);
173  counters->flows_aside_pkt_inject += cnt;
174  counters->flows_aside_needs_work++;
175  }
176  }
177 
178  /* no one is referring to this flow, removed from hash
179  * so we can unlock it and pass it to the flow recycler */
180 
181  if (fw->output_thread_flow != NULL)
182  (void)OutputFlowLog(tv, fw->output_thread_flow, f);
183 
184  FlowEndCountersUpdate(tv, &fw->fec, f);
185  if (f->proto == IPPROTO_TCP && f->protoctx != NULL) {
187  }
189 
190  FlowClearMemory (f, f->protomap);
191  FLOWLOCK_UNLOCK(f);
192 
193  if (fw->fls.spare_queue.len >= (FLOW_SPARE_POOL_BLOCK_SIZE * 2)) {
194  FlowQueuePrivatePrependFlow(&ret_queue, f);
195  if (ret_queue.len == FLOW_SPARE_POOL_BLOCK_SIZE) {
196  FlowSparePoolReturnFlows(&ret_queue);
197  }
198  } else {
200  }
201 
202  if (max_work != 0 && ++i == max_work)
203  break;
204  }
205  if (ret_queue.len > 0) {
206  FlowSparePoolReturnFlows(&ret_queue);
207  }
208 
209  StatsAddUI64(tv, fw->cnt.flows_removed, (uint64_t)i);
210 }
211 
212 /** \brief handle flow for packet
213  *
214  * Handle flow creation/lookup
215  */
216 static inline TmEcode FlowUpdate(ThreadVars *tv, FlowWorkerThreadData *fw, Packet *p)
217 {
218  FlowHandlePacketUpdate(p->flow, p, tv, fw->dtv);
219 
220  int state = p->flow->flow_state;
221  switch (state) {
222 #ifdef CAPTURE_OFFLOAD
223  case FLOW_STATE_CAPTURE_BYPASSED: {
226  Flow *f = p->flow;
227  FlowDeReference(&p->flow);
228  FLOWLOCK_UNLOCK(f);
229  return TM_ECODE_DONE;
230  }
231 #endif
235  Flow *f = p->flow;
236  FlowDeReference(&p->flow);
237  FLOWLOCK_UNLOCK(f);
238  return TM_ECODE_DONE;
239  }
240  default:
241  return TM_ECODE_OK;
242  }
243 }
244 
245 static TmEcode FlowWorkerThreadDeinit(ThreadVars *tv, void *data);
246 
247 static TmEcode FlowWorkerThreadInit(ThreadVars *tv, const void *initdata, void **data)
248 {
249  FlowWorkerThreadData *fw = SCCalloc(1, sizeof(*fw));
250  if (fw == NULL)
251  return TM_ECODE_FAILED;
252 
253  SC_ATOMIC_INITPTR(fw->detect_thread);
254  SC_ATOMIC_SET(fw->detect_thread, NULL);
255 
256  fw->local_bypass_pkts = StatsRegisterCounter("flow_bypassed.local_pkts", tv);
257  fw->local_bypass_bytes = StatsRegisterCounter("flow_bypassed.local_bytes", tv);
258  fw->both_bypass_pkts = StatsRegisterCounter("flow_bypassed.local_capture_pkts", tv);
259  fw->both_bypass_bytes = StatsRegisterCounter("flow_bypassed.local_capture_bytes", tv);
260 
261  fw->cnt.flows_aside_needs_work = StatsRegisterCounter("flow.wrk.flows_evicted_needs_work", tv);
262  fw->cnt.flows_aside_pkt_inject = StatsRegisterCounter("flow.wrk.flows_evicted_pkt_inject", tv);
263  fw->cnt.flows_removed = StatsRegisterCounter("flow.wrk.flows_evicted", tv);
264  fw->cnt.flows_injected = StatsRegisterCounter("flow.wrk.flows_injected", tv);
265  fw->cnt.flows_injected_max = StatsRegisterMaxCounter("flow.wrk.flows_injected_max", tv);
266 
267  fw->fls.dtv = fw->dtv = DecodeThreadVarsAlloc(tv);
268  if (fw->dtv == NULL) {
269  FlowWorkerThreadDeinit(tv, fw);
270  return TM_ECODE_FAILED;
271  }
272 
273  /* setup TCP */
274  if (StreamTcpThreadInit(tv, NULL, &fw->stream_thread_ptr) != TM_ECODE_OK) {
275  FlowWorkerThreadDeinit(tv, fw);
276  return TM_ECODE_FAILED;
277  }
278 
279  if (DetectEngineEnabled()) {
280  /* setup DETECT */
281  void *detect_thread = NULL;
282  if (DetectEngineThreadCtxInit(tv, NULL, &detect_thread) != TM_ECODE_OK) {
283  FlowWorkerThreadDeinit(tv, fw);
284  return TM_ECODE_FAILED;
285  }
286  SC_ATOMIC_SET(fw->detect_thread, detect_thread);
287  }
288 
289  /* Setup outputs for this thread. */
290  if (OutputLoggerThreadInit(tv, initdata, &fw->output_thread) != TM_ECODE_OK) {
291  FlowWorkerThreadDeinit(tv, fw);
292  return TM_ECODE_FAILED;
293  }
295  SCLogError("initializing flow log API for thread failed");
296  FlowWorkerThreadDeinit(tv, fw);
297  return TM_ECODE_FAILED;
298  }
299 
303 
304  /* setup pq for stream end pkts */
305  memset(&fw->pq, 0, sizeof(PacketQueueNoLock));
306  *data = fw;
307  return TM_ECODE_OK;
308 }
309 
310 static TmEcode FlowWorkerThreadDeinit(ThreadVars *tv, void *data)
311 {
312  FlowWorkerThreadData *fw = data;
313 
315 
316  /* free TCP */
317  StreamTcpThreadDeinit(tv, (void *)fw->stream_thread);
318 
319  /* free DETECT */
320  void *detect_thread = SC_ATOMIC_GET(fw->detect_thread);
321  if (detect_thread != NULL) {
322  DetectEngineThreadCtxDeinit(tv, detect_thread);
323  SC_ATOMIC_SET(fw->detect_thread, NULL);
324  }
325 
326  /* Free output. */
329 
330  /* free pq */
331  BUG_ON(fw->pq.len);
332 
333  Flow *f;
334  while ((f = FlowQueuePrivateGetFromTop(&fw->fls.spare_queue)) != NULL) {
335  FlowFree(f);
336  }
337 
338  SCFree(fw);
339  return TM_ECODE_OK;
340 }
341 
342 TmEcode Detect(ThreadVars *tv, Packet *p, void *data);
344 
345 static inline void UpdateCounters(ThreadVars *tv,
346  FlowWorkerThreadData *fw, const FlowTimeoutCounters *counters)
347 {
348  if (counters->flows_aside_needs_work) {
350  (uint64_t)counters->flows_aside_needs_work);
351  }
352  if (counters->flows_aside_pkt_inject) {
354  (uint64_t)counters->flows_aside_pkt_inject);
355  }
356 }
357 
358 /** \brief update stream engine
359  *
360  * We can be called from both the flow timeout path as well as from the
361  * "real" traffic path. If in the timeout path any additional packets we
362  * forge for flushing pipelines should not leave our scope. If the original
363  * packet is real (or related to a real packet) we need to push the packets
364  * on, so IPS logic stays valid.
365  */
366 static inline void FlowWorkerStreamTCPUpdate(ThreadVars *tv, FlowWorkerThreadData *fw, Packet *p,
367  void *detect_thread, const bool timeout)
368 {
370  StreamTcp(tv, p, fw->stream_thread, &fw->pq);
372 
373  // this is the first packet that sets no payload inspection
374  bool setting_nopayload =
375  p->flow->alparser &&
378  if (FlowChangeProto(p->flow) || setting_nopayload) {
379  StreamTcpDetectLogFlush(tv, fw->stream_thread, p->flow, p, &fw->pq);
380  if (setting_nopayload) {
381  FlowSetNoPayloadInspectionFlag(p->flow);
382  }
385  }
386 
387  /* Packets here can safely access p->flow as it's locked */
388  SCLogDebug("packet %"PRIu64": extra packets %u", p->pcap_cnt, fw->pq.len);
389  Packet *x;
390  while ((x = PacketDequeueNoLock(&fw->pq))) {
391  SCLogDebug("packet %"PRIu64" extra packet %p", p->pcap_cnt, x);
392 
393  if (detect_thread != NULL) {
395  Detect(tv, x, detect_thread);
397  }
398 
400 
401  FramesPrune(x->flow, x);
402  /* Release tcp segments. Done here after alerting can use them. */
405  x->flow, x->flowflags & FLOW_PKT_TOSERVER ? STREAM_TOSERVER : STREAM_TOCLIENT);
407 
408  /* no need to keep a flow ref beyond this point */
409  FlowDeReference(&x->flow);
410 
411  /* no further work to do for this pseudo packet, so we can return
412  * it to the pool immediately. */
413  if (timeout) {
415  } else {
416  /* to support IPS verdict logic, in the non-timeout case we need to do a bit more */
418  }
419  }
420  if (FlowChangeProto(p->flow) && p->flow->flags & FLOW_ACTION_DROP) {
421  // in case f->flags & FLOW_ACTION_DROP was set by one of the dequeued packets
423  }
424 }
425 
426 static void FlowWorkerFlowTimeout(ThreadVars *tv, Packet *p, FlowWorkerThreadData *fw,
427  void *detect_thread)
428 {
430 
431  SCLogDebug("packet %"PRIu64" is TCP. Direction %s", p->pcap_cnt, PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
432  DEBUG_VALIDATE_BUG_ON(!(p->flow && PacketIsTCP(p)));
434 
435  /* handle TCP and app layer */
436  FlowWorkerStreamTCPUpdate(tv, fw, p, detect_thread, true);
437 
439 
440  /* handle Detect */
441  SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt);
442  if (detect_thread != NULL) {
444  Detect(tv, p, detect_thread);
446  }
447 
448  // Outputs.
450 
451  FramesPrune(p->flow, p);
452 
453  /* Release tcp segments. Done here after alerting can use them. */
456  STREAM_TOSERVER : STREAM_TOCLIENT);
458 
459  /* run tx cleanup last */
461 
462  FlowDeReference(&p->flow);
463  /* flow is unlocked later in FlowFinish() */
464 }
465 
466 /** \internal
467  * \brief process flows injected into our queue by other threads
468  */
469 static inline void FlowWorkerProcessInjectedFlows(
471 {
472  /* take injected flows and append to our work queue */
474  FlowQueuePrivate injected = { NULL, NULL, 0 };
475  if (SC_ATOMIC_GET(tv->flow_queue->non_empty))
477  if (injected.len > 0) {
478  StatsAddUI64(tv, fw->cnt.flows_injected, (uint64_t)injected.len);
479  if (p->pkt_src == PKT_SRC_WIRE)
480  StatsSetUI64(tv, fw->cnt.flows_injected_max, (uint64_t)injected.len);
481 
482  /* move to local queue so we can process over the course of multiple packets */
484  }
486 }
487 
488 /** \internal
489  * \brief process flows set aside locally during flow lookup
490  */
491 static inline void FlowWorkerProcessLocalFlows(ThreadVars *tv, FlowWorkerThreadData *fw, Packet *p)
492 {
493  uint32_t max_work = 2;
495  max_work = 0;
496 
498  if (fw->fls.work_queue.len) {
499  FlowTimeoutCounters counters = { 0, 0, };
500  CheckWorkQueue(tv, fw, &counters, &fw->fls.work_queue, max_work);
501  UpdateCounters(tv, fw, &counters);
502  }
504 }
505 
506 /** \internal
507  * \brief apply Packet::app_update_direction to the flow flags
508  */
509 static void PacketAppUpdate2FlowFlags(Packet *p)
510 {
511  switch ((enum StreamUpdateDir)p->app_update_direction) {
512  case UPDATE_DIR_NONE: // NONE implies pseudo packet
513  SCLogDebug("pcap_cnt %" PRIu64 ", UPDATE_DIR_NONE", p->pcap_cnt);
514  break;
515  case UPDATE_DIR_PACKET:
516  if (PKT_IS_TOSERVER(p)) {
518  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", p->pcap_cnt);
519  } else {
521  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", p->pcap_cnt);
522  }
523  break;
524  case UPDATE_DIR_BOTH:
525  if (PKT_IS_TOSERVER(p)) {
527  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set",
528  p->pcap_cnt);
529  } else {
531  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set",
532  p->pcap_cnt);
533  }
534  /* fall through */
535  case UPDATE_DIR_OPPOSING:
536  if (PKT_IS_TOSERVER(p)) {
538  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set",
539  p->pcap_cnt);
540  } else {
542  SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set",
543  p->pcap_cnt);
544  }
545  break;
546  }
547 }
548 
549 static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
550 {
551  FlowWorkerThreadData *fw = data;
552  void *detect_thread = SC_ATOMIC_GET(fw->detect_thread);
553 
554  DEBUG_VALIDATE_BUG_ON(p == NULL);
556 
557  SCLogDebug("packet %"PRIu64, p->pcap_cnt);
558 
559  if ((PKT_IS_FLUSHPKT(p))) {
560  SCLogDebug("thread %s flushing", tv->printable_name);
562  /* Ack if a flush was requested */
563  bool notset = false;
564  SC_ATOMIC_CAS(&fw->flush_ack, notset, true);
565  return TM_ECODE_OK;
566  }
567 
568  /* handle Flow */
569  if (p->flags & PKT_WANTS_FLOW) {
571 
572  FlowHandlePacket(tv, &fw->fls, p);
573  if (likely(p->flow != NULL)) {
575  if (FlowUpdate(tv, fw, p) == TM_ECODE_DONE) {
576  /* update time */
577  if (!(PKT_IS_PSEUDOPKT(p))) {
578  TimeSetByThread(tv->id, p->ts);
579  }
580  goto housekeeping;
581  }
582  }
583  /* Flow is now LOCKED */
584 
586 
587  /* if PKT_WANTS_FLOW is not set, but PKT_HAS_FLOW is, then this is a
588  * pseudo packet created by the flow manager. */
589  } else if (p->flags & PKT_HAS_FLOW) {
590  FLOWLOCK_WRLOCK(p->flow);
592  }
593 
594  /* update time */
595  if (!(PKT_IS_PSEUDOPKT(p))) {
596  TimeSetByThread(tv->id, p->ts);
597  }
598 
599  SCLogDebug("packet %"PRIu64" has flow? %s", p->pcap_cnt, p->flow ? "yes" : "no");
600 
601  /* handle TCP and app layer */
602  if (p->flow) {
603  SCLogDebug("packet %" PRIu64
604  ": direction %s FLOW_TS_APP_UPDATE_NEXT %s FLOW_TC_APP_UPDATE_NEXT %s",
605  p->pcap_cnt, PKT_IS_TOSERVER(p) ? "toserver" : "toclient",
608  /* see if need to consider flags set by prev packets */
612  SCLogDebug("FLOW_TS_APP_UPDATED");
613  } else if (PKT_IS_TOCLIENT(p) && (p->flow->flags & FLOW_TC_APP_UPDATE_NEXT)) {
616  SCLogDebug("FLOW_TC_APP_UPDATED");
617  }
618 
619  if (PacketIsTCP(p)) {
620  SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", p->pcap_cnt,
621  PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
623 
624  /* if detect is disabled, we need to apply file flags to the flow
625  * here on the first packet. */
626  if (detect_thread == NULL &&
630  }
631 
632  FlowWorkerStreamTCPUpdate(tv, fw, p, detect_thread, false);
633  PacketAppUpdate2FlowFlags(p);
634 
635  /* handle the app layer part of the UDP packet payload */
636  } else if (p->proto == IPPROTO_UDP && !PacketCheckAction(p, ACTION_DROP)) {
640  PacketAppUpdate2FlowFlags(p);
641  }
642  }
643 
645 
646  /* handle Detect */
648  SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt);
649  if (detect_thread != NULL) {
651  Detect(tv, p, detect_thread);
653  }
654 
655  // Outputs.
657 
658  /* Release tcp segments. Done here after alerting can use them. */
659  if (p->flow != NULL) {
661 
662  if (FlowIsBypassed(p->flow)) {
664  if (p->proto == IPPROTO_TCP) {
666  }
667  } else if (p->proto == IPPROTO_TCP && p->flow->protoctx && p->flags & PKT_STREAM_EST) {
668  if ((p->flow->flags & FLOW_TS_APP_UPDATED) && PKT_IS_TOSERVER(p)) {
669  FramesPrune(p->flow, p);
670  } else if ((p->flow->flags & FLOW_TC_APP_UPDATED) && PKT_IS_TOCLIENT(p)) {
671  FramesPrune(p->flow, p);
672  }
675  STREAM_TOSERVER : STREAM_TOCLIENT);
677  } else if (p->proto == IPPROTO_UDP) {
678  FramesPrune(p->flow, p);
679  }
680 
681  if ((PKT_IS_PSEUDOPKT(p)) ||
683  if ((p->flags & PKT_STREAM_EST) || p->proto != IPPROTO_TCP) {
684  if (PKT_IS_TOSERVER(p)) {
685  if (PKT_IS_PSEUDOPKT(p) || (p->flow->flags & (FLOW_TS_APP_UPDATED))) {
686  AppLayerParserTransactionsCleanup(p->flow, STREAM_TOSERVER);
688  SCLogDebug("~FLOW_TS_APP_UPDATED");
689  }
690  } else {
691  if (PKT_IS_PSEUDOPKT(p) || (p->flow->flags & (FLOW_TC_APP_UPDATED))) {
692  AppLayerParserTransactionsCleanup(p->flow, STREAM_TOCLIENT);
694  SCLogDebug("~FLOW_TC_APP_UPDATED");
695  }
696  }
697  }
698  } else {
699  SCLogDebug("not pseudo, no app update: skip");
700  }
701 
702  if (p->flow->flags & FLOW_ACTION_DROP) {
703  SCLogDebug("flow drop in place: remove app update flags");
705  }
706 
707  Flow *f = p->flow;
708  FlowDeReference(&p->flow);
709  FLOWLOCK_UNLOCK(f);
710  }
711 
712 housekeeping:
713 
714  /* take injected flows and add them to our local queue */
715  FlowWorkerProcessInjectedFlows(tv, fw, p);
716 
717  /* process local work queue */
718  FlowWorkerProcessLocalFlows(tv, fw, p);
719 
720  return TM_ECODE_OK;
721 }
722 
723 void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx)
724 {
725  FlowWorkerThreadData *fw = flow_worker;
726 
727  SC_ATOMIC_SET(fw->detect_thread, detect_ctx);
728 }
729 
730 void *FlowWorkerGetDetectCtxPtr(void *flow_worker)
731 {
732  FlowWorkerThreadData *fw = flow_worker;
733 
734  return SC_ATOMIC_GET(fw->detect_thread);
735 }
736 
737 void *FlowWorkerGetThreadData(void *flow_worker)
738 {
739  return (FlowWorkerThreadData *)flow_worker;
740 }
741 
742 bool FlowWorkerGetFlushAck(void *flow_worker)
743 {
744  FlowWorkerThreadData *fw = flow_worker;
745  return SC_ATOMIC_GET(fw->flush_ack) == true;
746 }
747 
748 void FlowWorkerSetFlushAck(void *flow_worker)
749 {
750  FlowWorkerThreadData *fw = flow_worker;
751  SC_ATOMIC_SET(fw->flush_ack, false);
752 }
753 
755 {
756  switch (fwi) {
758  return "flow";
760  return "stream";
762  return "app-layer";
764  return "detect";
766  return "tcp-prune";
768  return "flow-inject";
770  return "flow-evict";
772  return "size";
773  }
774  return "error";
775 }
776 
777 static bool FlowWorkerIsBusy(ThreadVars *tv, void *flow_worker)
778 {
779  FlowWorkerThreadData *fw = flow_worker;
780  if (fw->pq.len)
781  return true;
782  if (fw->fls.work_queue.len)
783  return true;
784 
785  if (tv->flow_queue) {
787  bool fq_done = (tv->flow_queue->qlen == 0);
789  if (!fq_done) {
790  return true;
791  }
792  }
793 
794  return false;
795 }
796 
798 {
799  tmm_modules[TMM_FLOWWORKER].name = "FlowWorker";
800  tmm_modules[TMM_FLOWWORKER].ThreadInit = FlowWorkerThreadInit;
801  tmm_modules[TMM_FLOWWORKER].Func = FlowWorker;
802  tmm_modules[TMM_FLOWWORKER].ThreadBusy = FlowWorkerIsBusy;
803  tmm_modules[TMM_FLOWWORKER].ThreadDeinit = FlowWorkerThreadDeinit;
806 }
PKT_IS_TOCLIENT
#define PKT_IS_TOCLIENT(p)
Definition: decode.h:235
TmModule_::cap_flags
uint8_t cap_flags
Definition: tm-modules.h:73
PacketCheckAction
bool PacketCheckAction(const Packet *p, const uint8_t a)
Definition: packet.c:49
UPDATE_DIR_BOTH
@ UPDATE_DIR_BOTH
Definition: stream-tcp-reassemble.h:58
Flow_::ffr_tc
uint8_t ffr_tc
Definition: flow.h:386
FlowLookupStruct_::work_queue
FlowQueuePrivate work_queue
Definition: flow.h:544
UPDATE_DIR_PACKET
@ UPDATE_DIR_PACKET
Definition: stream-tcp-reassemble.h:56
ThreadVars_::flow_queue
struct FlowQueue_ * flow_queue
Definition: threadvars.h:135
OutputFlowLog
TmEcode OutputFlowLog(ThreadVars *tv, void *thread_data, Flow *f)
Run flow logger(s)
Definition: output-flow.c:87
FLOW_TC_APP_UPDATE_NEXT
#define FLOW_TC_APP_UPDATE_NEXT
Definition: flow.h:56
Packet_::proto
uint8_t proto
Definition: decode.h:498
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:137
FlowTimeoutCounters
Definition: flow-worker.c:61
detect-engine.h
Flow_::ffr_ts
uint8_t ffr_ts
Definition: flow.h:385
PROFILE_FLOWWORKER_DETECT
@ PROFILE_FLOWWORKER_DETECT
Definition: flow-worker.h:25
DecodeThreadVars_::counter_flow_active
uint16_t counter_flow_active
Definition: decode.h:1000
OutputFlowLogThreadInit
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
Definition: output-flow.c:123
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1266
PROFILE_FLOWWORKER_FLOW_INJECTED
@ PROFILE_FLOWWORKER_FLOW_INJECTED
Definition: flow-worker.h:27
flow-util.h
FlowWorkerThreadData
struct FlowWorkerThreadData_ FlowWorkerThreadData
FlowLookupStruct_::dtv
DecodeThreadVars * dtv
Definition: flow.h:543
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1321
stream-tcp.h
PacketPoolReturnPacket
void PacketPoolReturnPacket(Packet *p)
Return packet to Packet pool.
Definition: tmqh-packetpool.c:177
FLOW_PKT_LAST_PSEUDO
#define FLOW_PKT_LAST_PSEUDO
Definition: flow.h:238
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:386
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:879
PROFILE_FLOWWORKER_FLOW_EVICTED
@ PROFILE_FLOWWORKER_FLOW_EVICTED
Definition: flow-worker.h:28
ProfileFlowWorkerIdToString
const char * ProfileFlowWorkerIdToString(enum ProfileFlowWorkerId fwi)
Definition: flow-worker.c:754
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
PKT_SRC_SHUTDOWN_FLUSH
@ PKT_SRC_SHUTDOWN_FLUSH
Definition: decode.h:63
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:595
StreamTcpThread_
Definition: stream-tcp.h:92
PROFILE_FLOWWORKER_TCPPRUNE
@ PROFILE_FLOWWORKER_TCPPRUNE
Definition: flow-worker.h:26
TM_FLAG_DETECT_TM
#define TM_FLAG_DETECT_TM
Definition: tm-modules.h:35
Flow_::proto
uint8_t proto
Definition: flow.h:376
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:82
PKT_SRC_CAPTURE_TIMEOUT
@ PKT_SRC_CAPTURE_TIMEOUT
Definition: decode.h:61
action-globals.h
TcpReassemblyThreadCtx_::app_tctx
void * app_tctx
Definition: stream-tcp-reassemble.h:62
Packet_::flags
uint32_t flags
Definition: decode.h:513
Flow_
Flow data structure.
Definition: flow.h:354
Flow_::protomap
uint8_t protomap
Definition: flow.h:443
FLOW_TC_APP_UPDATED
#define FLOW_TC_APP_UPDATED
Definition: flow.h:118
StatsSetUI64
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
Definition: counters.c:207
PKT_WANTS_FLOW
#define PKT_WANTS_FLOW
Definition: decode.h:1296
FlowTimeoutCounters::flows_aside_pkt_inject
uint32_t flows_aside_pkt_inject
Definition: flow-worker.c:63
AppLayerRegisterThreadCounters
void AppLayerRegisterThreadCounters(ThreadVars *tv)
Registers per flow counters for all protocols.
Definition: app-layer.c:1306
FlowLookupStruct_
Definition: flow.h:540
FlowWorkerThreadData_::dtv
DecodeThreadVars * dtv
Definition: flow-worker.c:67
StreamTcpThreadInit
TmEcode StreamTcpThreadInit(ThreadVars *tv, void *initdata, void **data)
Definition: stream-tcp.c:5985
SC_ATOMIC_CAS
#define SC_ATOMIC_CAS(name, cmpval, newval)
atomic Compare and Switch
Definition: util-atomic.h:367
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:231
FlowPseudoPacketGet
Packet * FlowPseudoPacketGet(int direction, Flow *f, const TcpSession *ssn)
Definition: flow-timeout.c:268
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:504
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:68
FlowQueuePrivatePrependFlow
void FlowQueuePrivatePrependFlow(FlowQueuePrivate *fqc, Flow *f)
Definition: flow-queue.c:78
PKT_NOPAYLOAD_INSPECTION
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:1255
FlowWorkerThreadData_::flows_aside_needs_work
uint16_t flows_aside_needs_work
Definition: flow-worker.c:94
FlowWorkerThreadData_::stream_thread
StreamTcpThread * stream_thread
Definition: flow-worker.c:70
DecodeThreadVars_::counter_tcp_active_sessions
uint16_t counter_tcp_active_sessions
Definition: decode.h:998
TmModule_::ThreadBusy
bool(* ThreadBusy)(ThreadVars *tv, void *thread_data)
Definition: tm-modules.h:63
PKT_IS_FLUSHPKT
#define PKT_IS_FLUSHPKT(p)
Definition: decode.h:1323
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:507
TmqhOutputPacketpool
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
Definition: tmqh-packetpool.c:314
PROFILE_FLOWWORKER_STREAM
@ PROFILE_FLOWWORKER_STREAM
Definition: flow-worker.h:23
APP_LAYER_PARSER_EOF_TS
#define APP_LAYER_PARSER_EOF_TS
Definition: app-layer-parser.h:39
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
FlowQueuePrivate_::len
uint32_t len
Definition: flow-queue.h:43
Flow_::protoctx
void * protoctx
Definition: flow.h:439
OutputLoggerThreadDeinit
TmEcode OutputLoggerThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output.c:771
DisableDetectFlowFileFlags
void DisableDetectFlowFileFlags(Flow *f)
disable file features we don't need Called if we have no detection engine.
Definition: detect.c:1953
PacketQueueNoLock_
simple fifo queue for packets
Definition: packet-queue.h:34
tmqh-packetpool.h
FLOW_TIMEOUT_REASSEMBLY_DONE
#define FLOW_TIMEOUT_REASSEMBLY_DONE
Definition: flow.h:95
STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
Definition: stream-tcp.h:193
FLOWWORKER_PROFILING_START
#define FLOWWORKER_PROFILING_START(p, id)
Definition: util-profiling.h:147
FlowSparePoolReturnFlows
void FlowSparePoolReturnFlows(FlowQueuePrivate *fqp)
Definition: flow-spare-pool.c:120
FLOWLOCK_UNLOCK
#define FLOWLOCK_UNLOCK(fb)
Definition: flow.h:271
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:410
FQLOCK_LOCK
#define FQLOCK_LOCK(q)
Definition: flow-queue.h:72
TmModule_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: tm-modules.h:49
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1325
flow-spare-pool.h
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:476
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:602
DetectEngineThreadCtxPtr
DetectEngineThreadCtx * DetectEngineThreadCtxPtr
Definition: flow-worker.c:59
StatsDecr
void StatsDecr(ThreadVars *tv, uint16_t id)
Decrements the local counter.
Definition: counters.c:186
StatsRegisterMaxCounter
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
Definition: counters.c:991
FlowWorkerThreadData_::flows_aside_pkt_inject
uint16_t flows_aside_pkt_inject
Definition: flow-worker.c:95
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:505
decode.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:51
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:234
STREAM_HAS_UNPROCESSED_SEGMENTS_NONE
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NONE
Definition: stream-tcp.h:190
DetectEngineThreadCtx_
Definition: detect.h:1116
FlowWorkerThreadData_::flows_injected
uint16_t flows_injected
Definition: flow-worker.c:91
Packet_::ts
SCTime_t ts
Definition: decode.h:524
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:208
ProfileFlowWorkerId
ProfileFlowWorkerId
Definition: flow-worker.h:21
FlowWorkerThreadData_::local_bypass_bytes
uint16_t local_bypass_bytes
Definition: flow-worker.c:82
FlowTimeoutCounters
struct FlowTimeoutCounters FlowTimeoutCounters
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:376
flow-worker.h
BOOL2STR
#define BOOL2STR(b)
Definition: util-debug.h:527
FLOWLOCK_WRLOCK
#define FLOWLOCK_WRLOCK(fb)
Definition: flow.h:268
STREAM_FLAGS_FOR_PACKET
#define STREAM_FLAGS_FOR_PACKET(p)
Definition: stream.h:30
StreamTcp
TmEcode StreamTcp(ThreadVars *, Packet *, void *, PacketQueueNoLock *pq)
Definition: stream-tcp.c:5947
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineEnabled
int DetectEngineEnabled(void)
Check if detection is enabled.
Definition: detect-engine.c:3905
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:445
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3475
TmModule_::Func
TmEcode(* Func)(ThreadVars *, Packet *, void *)
Definition: tm-modules.h:52
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:235
FlowWorkerThreadData_::local_bypass_pkts
uint16_t local_bypass_pkts
Definition: flow-worker.c:81
PROFILE_FLOWWORKER_APPLAYERUDP
@ PROFILE_FLOWWORKER_APPLAYERUDP
Definition: flow-worker.h:24
util-time.h
FlowQueuePrivateGetFromTop
Flow * FlowQueuePrivateGetFromTop(FlowQueuePrivate *fqc)
Definition: flow-queue.c:151
FLOWWORKER_PROFILING_END
#define FLOWWORKER_PROFILING_END(p, id)
Definition: util-profiling.h:154
StreamTcpPruneSession
void StreamTcpPruneSession(Flow *f, uint8_t flags)
Remove idle TcpSegments from TcpSession.
Definition: stream-tcp-list.c:886
OutputLoggerThreadInit
TmEcode OutputLoggerThreadInit(ThreadVars *tv, const void *initdata, void **data)
Definition: output.c:740
app-layer-parser.h
ThreadVars_::id
int id
Definition: threadvars.h:87
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:309
util-profiling.h
Packet_
Definition: decode.h:476
FlowWorkerGetFlushAck
bool FlowWorkerGetFlushAck(void *flow_worker)
Definition: flow-worker.c:742
tmm_modules
TmModule tmm_modules[TMM_SIZE]
Definition: tm-modules.c:29
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:204
APP_LAYER_PARSER_EOF_TC
#define APP_LAYER_PARSER_EOF_TC
Definition: app-layer-parser.h:40
AppLayerHandleUdp
int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *tctx, Packet *p, Flow *f)
Handle a app layer UDP message.
Definition: app-layer.c:877
DEBUG_ASSERT_FLOW_LOCKED
#define DEBUG_ASSERT_FLOW_LOCKED(f)
Definition: util-validate.h:99
TmEcode
TmEcode
Definition: tm-threads-common.h:79
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1081
TmModuleFlowWorkerRegister
void TmModuleFlowWorkerRegister(void)
Definition: flow-worker.c:797
FlowQueuePrivateAppendPrivate
void FlowQueuePrivateAppendPrivate(FlowQueuePrivate *dest, FlowQueuePrivate *src)
Definition: flow-queue.c:88
flow-timeout.h
TimeSetByThread
void TimeSetByThread(const int thread_id, SCTime_t tv)
Definition: util-time.c:116
TmModule_::name
const char * name
Definition: tm-modules.h:44
APP_LAYER_PARSER_NO_INSPECTION
#define APP_LAYER_PARSER_NO_INSPECTION
Definition: app-layer-parser.h:35
UPDATE_DIR_OPPOSING
@ UPDATE_DIR_OPPOSING
Definition: stream-tcp-reassemble.h:57
FlowLookupStruct_::spare_queue
FlowQueuePrivate spare_queue
Definition: flow.h:542
TMM_FLOWWORKER
@ TMM_FLOWWORKER
Definition: tm-threads-common.h:34
Flow_::ffr
uint8_t ffr
Definition: flow.h:388
AppLayerParserStateSetFlag
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1782
FlowWorkerGetDetectCtxPtr
void * FlowWorkerGetDetectCtxPtr(void *flow_worker)
Definition: flow-worker.c:730
FlowWorkerThreadData_::stream_thread_ptr
void * stream_thread_ptr
Definition: flow-worker.c:71
FlowQueueExtractPrivate
FlowQueuePrivate FlowQueueExtractPrivate(FlowQueue *fq)
Definition: flow-queue.c:140
FlowWorkerThreadData_::pq
PacketQueueNoLock pq
Definition: flow-worker.c:87
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
app-layer-frames.h
FlowWorkerThreadData_::flows_removed
uint16_t flows_removed
Definition: flow-worker.c:93
Packet_::flow
struct Flow_ * flow
Definition: decode.h:515
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:792
flow-manager.h
suricata-common.h
PKT_SRC_FFR
@ PKT_SRC_FFR
Definition: decode.h:57
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:83
FlowWorkerGetThreadData
void * FlowWorkerGetThreadData(void *flow_worker)
Definition: flow-worker.c:737
PROFILE_FLOWWORKER_SIZE
@ PROFILE_FLOWWORKER_SIZE
Definition: flow-worker.h:29
packet.h
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3702
Packet_::app_update_direction
uint8_t app_update_direction
Definition: decode.h:510
FlowWorkerSetFlushAck
void FlowWorkerSetFlushAck(void *flow_worker)
Definition: flow-worker.c:748
FlowWorkerThreadData_::both_bypass_bytes
uint16_t both_bypass_bytes
Definition: flow-worker.c:84
FLOW_TS_APP_UPDATED
#define FLOW_TS_APP_UPDATED
Definition: flow.h:117
TmModule_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:47
PacketUpdateEngineEventCounters
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Definition: decode.c:213
ThreadVars_::printable_name
char * printable_name
Definition: threadvars.h:66
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
Detect
TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
Detection engine thread wrapper.
Definition: detect.c:1884
util-validate.h
FlowQueuePrivate_
Definition: flow-queue.h:40
StreamTcpDetectLogFlush
void StreamTcpDetectLogFlush(ThreadVars *tv, StreamTcpThread *stt, Flow *f, Packet *p, PacketQueueNoLock *pq)
create packets in both directions to flush out logging and detection before switching protocols....
Definition: stream-tcp.c:6926
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:37
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:146
FlowWorkerThreadData_::output_thread_flow
void * output_thread_flow
Definition: flow-worker.c:79
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
OutputFlowLogThreadDeinit
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output-flow.c:163
FramesPrune
void FramesPrune(Flow *f, Packet *p)
Definition: app-layer-frames.c:826
OutputLoggerLog
TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data)
Definition: output.c:726
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:580
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:932
OutputLoggerFlush
TmEcode OutputLoggerFlush(ThreadVars *tv, Packet *p, void *thread_data)
Definition: output.c:711
Flow_::flags
uint32_t flags
Definition: flow.h:419
StreamTcpSessionCleanup
void StreamTcpSessionCleanup(TcpSession *ssn)
Session cleanup function. Does not free the ssn.
Definition: stream-tcp.c:327
FlowWorkerThreadData_::fls
FlowLookupStruct fls
Definition: flow-worker.c:88
SC_ATOMIC_INITPTR
#define SC_ATOMIC_INITPTR(name)
Definition: util-atomic.h:317
UPDATE_DIR_NONE
@ UPDATE_DIR_NONE
Definition: stream-tcp-reassemble.h:55
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:774
PROFILE_FLOWWORKER_FLOW
@ PROFILE_FLOWWORKER_FLOW
Definition: flow-worker.h:22
FlowWorkerThreadData_::cnt
struct FlowWorkerThreadData_::@110 cnt
StreamTcpThread_::ra_ctx
TcpReassemblyThreadCtx * ra_ctx
Definition: stream-tcp.h:117
PacketDrop
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
Definition: packet.c:33
suricata.h
StreamUpdateDir
StreamUpdateDir
Definition: stream-tcp-reassemble.h:54
FLOW_END_FLAG_TIMEOUT
#define FLOW_END_FLAG_TIMEOUT
Definition: flow.h:241
FlowWorkerThreadData_::fec
FlowEndCounters fec
Definition: flow-worker.c:97
likely
#define likely(expr)
Definition: util-optimize.h:32
FlowNeedsReassembly
bool FlowNeedsReassembly(Flow *f)
Check if a flow needs forced reassembly, or any other processing.
Definition: flow-timeout.c:289
FlowWorkerThreadData_::output_thread
void * output_thread
Definition: flow-worker.c:78
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:194
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
TcpSession_
Definition: stream-tcp-private.h:283
FlowEndCountersRegister
void FlowEndCountersRegister(ThreadVars *t, FlowEndCounters *fec)
Definition: flow-util.c:236
FlowWorkerThreadData_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(DetectEngineThreadCtxPtr, detect_thread)
AppLayerParserStateIssetFlag
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1790
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:951
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
FlowEndCounters_
Definition: flow-util.h:146
FLOW_SPARE_POOL_BLOCK_SIZE
#define FLOW_SPARE_POOL_BLOCK_SIZE
Definition: flow-spare-pool.h:30
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:234
FlowWorkerThreadData_::both_bypass_pkts
uint16_t both_bypass_pkts
Definition: flow-worker.c:83
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
TM_FLAG_STREAM_TM
#define TM_FLAG_STREAM_TM
Definition: tm-modules.h:34
PKT_DROP_REASON_FLOW_DROP
@ PKT_DROP_REASON_FLOW_DROP
Definition: decode.h:365
FlowWorkerThreadData_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(bool, flush_ack)
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:76
FlowWorkerThreadData_
Definition: flow-worker.c:66
FLOW_TS_APP_UPDATE_NEXT
#define FLOW_TS_APP_UPDATE_NEXT
Definition: flow.h:121
StreamTcpThreadDeinit
TmEcode StreamTcpThreadDeinit(ThreadVars *tv, void *data)
Definition: stream-tcp.c:6072
output.h
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1263
FlowWorkerThreadData_::flows_injected_max
uint16_t flows_injected_max
Definition: flow-worker.c:92
FlowWorkerReplaceDetectCtx
void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx)
Definition: flow-worker.c:723
app-layer.h
FlowTimeoutCounters::flows_aside_needs_work
uint32_t flows_aside_needs_work
Definition: flow-worker.c:62
FQLOCK_UNLOCK
#define FQLOCK_UNLOCK(q)
Definition: flow-queue.h:74