suricata
flow.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "conf.h"
#include "threadvars.h"
#include "tm-threads.h"
#include "runmodes.h"
#include "util-random.h"
#include "util-time.h"
#include "flow.h"
#include "flow-queue.h"
#include "flow-hash.h"
#include "flow-util.h"
#include "flow-var.h"
#include "flow-private.h"
#include "flow-timeout.h"
#include "flow-manager.h"
#include "flow-storage.h"
#include "flow-bypass.h"
#include "flow-spare-pool.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-byte.h"
#include "util-misc.h"
#include "util-debug.h"
#include "util-privs.h"
#include "util-validate.h"
#include "detect.h"
#include "detect-engine-state.h"
#include "stream.h"
#include "app-layer-parser.h"
#include "app-layer-expectation.h"
#include "threads.h"
Include dependency graph for flow.c:

Go to the source code of this file.

Macros

#define FLOW_DEFAULT_EMERGENCY_RECOVERY   30
 
#define FLOW_DEFAULT_HASHSIZE   65536
 
#define FLOW_DEFAULT_MEMCAP   (32 * 1024 * 1024) /* 32 MB */
 
#define FLOW_DEFAULT_PREALLOC   10000
 
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
 

Functions

 SC_ATOMIC_DECLARE (FlowProtoTimeoutPtr, flow_timeouts)
 
 SC_ATOMIC_DECLARE (unsigned int, flow_prune_idx)
 
 SC_ATOMIC_DECLARE (unsigned int, flow_flags)
 
 SC_ATOMIC_DECLARE (uint64_t, flow_memuse)
 
void FlowRegisterTests (void)
 Function to register the Flow Unitests. More...
 
void FlowInitFlowProto (void)
 Function to set the default timeout, free function and flow state function for all supported flow_proto. More...
 
int FlowSetProtoFreeFunc (uint8_t proto, void(*Free)(void *))
 Function to set the function to get protocol specific flow state. More...
 
int FlowSetMemcap (uint64_t size)
 Update memcap value. More...
 
uint64_t FlowGetMemcap (void)
 Return memcap value. More...
 
uint64_t FlowGetMemuse (void)
 
void FlowCleanupAppLayer (Flow *f)
 
void FlowSetIPOnlyFlag (Flow *f, int direction)
 Set the IPOnly scanned flag for 'direction'. More...
 
void FlowSetHasAlertsFlag (Flow *f)
 Set flag to indicate that flow has alerts. More...
 
int FlowHasAlerts (const Flow *f)
 Check if flow has alerts. More...
 
void FlowSetChangeProtoFlag (Flow *f)
 Set flag to indicate to change proto for the flow. More...
 
void FlowUnsetChangeProtoFlag (Flow *f)
 Unset flag to indicate to change proto for the flow. More...
 
int FlowChangeProto (Flow *f)
 Check if change proto flag is set for flow. More...
 
void FlowSwap (Flow *f)
 swap the flow's direction More...
 
int FlowGetPacketDirection (const Flow *f, const Packet *p)
 determine the direction of the packet compared to the flow More...
 
void FlowHandlePacketUpdate (Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
 Update Packet and Flow. More...
 
void FlowHandlePacket (ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
 Entry point for packet flow handling. More...
 
void FlowInitConfig (char quiet)
 initialize the configuration More...
 
void FlowShutdown (void)
 shutdown the flow engine More...
 
int FlowClearMemory (Flow *f, uint8_t proto_map)
 Function clear the flow memory before queueing it to spare flow queue. More...
 
AppProto FlowGetAppProtocol (const Flow *f)
 
void * FlowGetAppState (const Flow *f)
 
uint8_t FlowGetDisruptionFlags (const Flow *f, uint8_t flags)
 get 'disruption' flags: GAP/DEPTH/PASS More...
 
void FlowUpdateState (Flow *f, const enum FlowState s)
 
void FlowGetLastTimeAsParts (Flow *flow, uint64_t *secs, uint64_t *usecs)
 Get flow last time as individual values. More...
 

Variables

FlowProtoTimeout flow_timeouts_normal [FLOW_PROTO_MAX]
 
FlowProtoTimeout flow_timeouts_emerg [FLOW_PROTO_MAX]
 
FlowProtoTimeout flow_timeouts_delta [FLOW_PROTO_MAX]
 
FlowProtoFreeFunc flow_freefuncs [FLOW_PROTO_MAX]
 
FlowConfig flow_config
 
int run_mode
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Flow implementation.

Definition in file flow.c.

Macro Definition Documentation

◆ FLOW_DEFAULT_EMERGENCY_RECOVERY

#define FLOW_DEFAULT_EMERGENCY_RECOVERY   30

Definition at line 70 of file flow.c.

◆ FLOW_DEFAULT_HASHSIZE

#define FLOW_DEFAULT_HASHSIZE   65536

Definition at line 73 of file flow.c.

◆ FLOW_DEFAULT_MEMCAP

#define FLOW_DEFAULT_MEMCAP   (32 * 1024 * 1024) /* 32 MB */

Definition at line 75 of file flow.c.

◆ FLOW_DEFAULT_PREALLOC

#define FLOW_DEFAULT_PREALLOC   10000

Definition at line 77 of file flow.c.

◆ SET_DEFAULTS

#define SET_DEFAULTS (   p,
  n,
  e,
  c,
  b,
  ne,
  ee,
  ce,
  be 
)
Value:
flow_timeouts_normal[(p)].new_timeout = (n); \
flow_timeouts_normal[(p)].est_timeout = (e); \
flow_timeouts_normal[(p)].closed_timeout = (c); \
flow_timeouts_normal[(p)].bypassed_timeout = (b); \
flow_timeouts_emerg[(p)].new_timeout = (ne); \
flow_timeouts_emerg[(p)].est_timeout = (ee); \
flow_timeouts_emerg[(p)].closed_timeout = (ce); \
flow_timeouts_emerg[(p)].bypassed_timeout = (be); \

Function Documentation

◆ FlowChangeProto()

int FlowChangeProto ( Flow f)

Check if change proto flag is set for flow.

Parameters
fflow
Return values
1change proto flag is set
0change proto flag is not set

Definition at line 212 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

◆ FlowCleanupAppLayer()

void FlowCleanupAppLayer ( Flow f)

Definition at line 142 of file flow.c.

References Flow_::alparser, Flow_::alstate, AppLayerParserStateCleanup(), and Flow_::proto.

Here is the call graph for this function:

◆ FlowClearMemory()

int FlowClearMemory ( Flow f,
uint8_t  proto_map 
)

Function clear the flow memory before queueing it to spare flow queue.

Parameters
fpointer to the flow needed to be cleared.
proto_mapmapped value of the protocol to FLOW_PROTO's.

Definition at line 1060 of file flow.c.

References AppLayerExpectationClean(), Flow_::flags, flow_freefuncs, FLOW_HAS_EXPECTATION, FLOW_RECYCLE, FlowFreeStorage(), FlowProtoFreeFunc_::Freefunc, Flow_::protoctx, SCEnter, SCReturnInt, and unlikely.

Referenced by FlowShutdown().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ FlowGetAppProtocol()

AppProto FlowGetAppProtocol ( const Flow f)

Definition at line 1097 of file flow.c.

References Flow_::alproto.

Referenced by JsonBuildFileInfoRecord().

Here is the caller graph for this function:

◆ FlowGetAppState()

◆ FlowGetDisruptionFlags()

uint8_t FlowGetDisruptionFlags ( const Flow f,
uint8_t  flags 
)

get 'disruption' flags: GAP/DEPTH/PASS

Parameters
flocked flow
flagsexisting flags to be ammended
Return values
flagsoriginal flags + disrupt flags (if any) \TODO handle UDP

Definition at line 1114 of file flow.c.

References TcpSession_::client, flags, TcpStream_::flags, Flow_::proto, Flow_::protoctx, TcpSession_::server, STREAM_DEPTH, STREAM_GAP, STREAM_TOSERVER, STREAMTCP_STREAM_FLAG_DEPTH_REACHED, and STREAMTCP_STREAM_FLAG_GAP.

◆ FlowGetLastTimeAsParts()

void FlowGetLastTimeAsParts ( Flow flow,
uint64_t *  secs,
uint64_t *  usecs 
)

Get flow last time as individual values.

Instead of returning a pointer to the timeval copy the timeval parts into output pointers to make it simpler to call from Rust over FFI using only basic data types.

Definition at line 1171 of file flow.c.

References Flow_::lastts.

◆ FlowGetMemcap()

uint64_t FlowGetMemcap ( void  )

Return memcap value.

Return values
memcapvalue

Definition at line 130 of file flow.c.

References flow_config, and SC_ATOMIC_GET.

◆ FlowGetMemuse()

uint64_t FlowGetMemuse ( void  )

Definition at line 136 of file flow.c.

References SC_ATOMIC_GET.

◆ FlowGetPacketDirection()

int FlowGetPacketDirection ( const Flow f,
const Packet p 
)

determine the direction of the packet compared to the flow

Return values
0to_server
1to_client

Definition at line 292 of file flow.c.

References CMP_ADDR, CMP_PORT, Packet_::dp, Flow_::flags, FLOW_DIR_REVERSED, Packet_::proto, Flow_::sp, Packet_::sp, Flow_::src, Packet_::src, TOCLIENT, and TOSERVER.

Referenced by FlowHandlePacketUpdate().

Here is the caller graph for this function:

◆ FlowHandlePacket()

void FlowHandlePacket ( ThreadVars tv,
FlowLookupStruct fls,
Packet p 
)

Entry point for packet flow handling.

This is called for every packet.

Parameters
tvthreadvars
dtvdecode thread vars (for flow output api thread data)
ppacket to handle flow for

Definition at line 500 of file flow.c.

References Packet_::flags, Packet_::flow, FlowGetFlowFromHash(), PKT_HAS_FLOW, and tv.

Referenced by UTHBuildPacketOfFlows().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ FlowHandlePacketUpdate()

void FlowHandlePacketUpdate ( Flow f,
Packet p,
ThreadVars tv,
DecodeThreadVars dtv 
)

Update Packet and Flow.

Updates packet and flow based on the new packet.

Parameters
flocked flow
ppacket
Note
overwrites p::flowflags

Definition at line 389 of file flow.c.

References BypassedFlowUpdate(), COPY_TIMESTAMP, EngineModeIsIPS(), Flow_::flags, FLOW_BYPASSED_TIMEOUT, FLOW_PKT_TOSERVER, Flow_::flow_state, FLOW_STATE_LOCAL_BYPASSED, FLOW_TO_DST_SEEN, Packet_::flowflags, FlowGetPacketDirection(), FlowUpdateState(), GET_PKT_LEN, Flow_::lastts, Packet_::pcap_cnt, SCLogDebug, Flow_::timeout_at, Flow_::timeout_policy, Flow_::todstbytecnt, Flow_::todstpktcnt, TOSERVER, and Packet_::ts.

Here is the call graph for this function:

◆ FlowHasAlerts()

int FlowHasAlerts ( const Flow f)

Check if flow has alerts.

Parameters
fflow
Return values
1has alerts
0has not alerts

Definition at line 180 of file flow.c.

References Flow_::flags, and FLOW_HAS_ALERTS.

◆ FlowInitConfig()

◆ FlowInitFlowProto()

void FlowInitFlowProto ( void  )

Function to set the default timeout, free function and flow state function for all supported flow_proto.

Definition at line 690 of file flow.c.

References FlowProtoTimeout_::bypassed_timeout, FlowProtoTimeout_::closed_timeout, ConfGetNode(), ConfNodeLookupChild(), ConfNodeLookupChildValue(), FlowProtoTimeout_::est_timeout, FLOW_DEFAULT_BYPASSED_TIMEOUT, FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT, FLOW_DEFAULT_EMERG_EST_TIMEOUT, FLOW_DEFAULT_EMERG_NEW_TIMEOUT, FLOW_DEFAULT_EST_TIMEOUT, FLOW_DEFAULT_NEW_TIMEOUT, flow_freefuncs, FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT, FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT, FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT, FLOW_IPPROTO_ICMP_EST_TIMEOUT, FLOW_IPPROTO_ICMP_NEW_TIMEOUT, FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT, FLOW_IPPROTO_TCP_CLOSED_TIMEOUT, FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT, FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT, FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT, FLOW_IPPROTO_TCP_EST_TIMEOUT, FLOW_IPPROTO_TCP_NEW_TIMEOUT, FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT, FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT, FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT, FLOW_IPPROTO_UDP_EST_TIMEOUT, FLOW_IPPROTO_UDP_NEW_TIMEOUT, FLOW_PROTO_DEFAULT, FLOW_PROTO_ICMP, FLOW_PROTO_MAX, FLOW_PROTO_TCP, FLOW_PROTO_UDP, flow_timeouts_delta, flow_timeouts_emerg, flow_timeouts_normal, FlowTimeoutsInit(), FlowProtoFreeFunc_::Freefunc, FlowProtoTimeout_::new_timeout, proto, SC_WARN_FLOW_EMERGENCY, SCLogDebug, SCLogWarning, SET_DEFAULTS, and StringParseUint32().

Referenced by FlowInitConfig().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ FlowRegisterTests()

void FlowRegisterTests ( void  )

Function to register the Flow Unitests.

Definition at line 1390 of file flow.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ FlowSetChangeProtoFlag()

void FlowSetChangeProtoFlag ( Flow f)

Set flag to indicate to change proto for the flow.

Parameters
fflow

Definition at line 193 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

Referenced by AppLayerRequestProtocolChange().

Here is the caller graph for this function:

◆ FlowSetHasAlertsFlag()

void FlowSetHasAlertsFlag ( Flow f)

Set flag to indicate that flow has alerts.

Parameters
fflow

Definition at line 169 of file flow.c.

References Flow_::flags, and FLOW_HAS_ALERTS.

◆ FlowSetIPOnlyFlag()

void FlowSetIPOnlyFlag ( Flow f,
int  direction 
)

Set the IPOnly scanned flag for 'direction'.

Parameters
fFlow to set the flag in
directiondirection to set the flag in

Definition at line 158 of file flow.c.

References Flow_::flags, FLOW_TOCLIENT_IPONLY_SET, and FLOW_TOSERVER_IPONLY_SET.

◆ FlowSetMemcap()

int FlowSetMemcap ( uint64_t  size)

Update memcap value.

Parameters
sizenew memcap value

Definition at line 115 of file flow.c.

References flow_config, SC_ATOMIC_GET, and SC_ATOMIC_SET.

◆ FlowSetProtoFreeFunc()

int FlowSetProtoFreeFunc ( uint8_t  proto,
void(*)(void *)  Free 
)

Function to set the function to get protocol specific flow state.

Parameters
protoprotocol of which function is needed to be set.
FreeFunction pointer which will be called to free the protocol specific memory.

Definition at line 1088 of file flow.c.

References flow_freefuncs, FlowGetProtoMapping(), FlowProtoFreeFunc_::Freefunc, and proto.

Here is the call graph for this function:

◆ FlowShutdown()

void FlowShutdown ( void  )

◆ FlowSwap()

void FlowSwap ( Flow f)

swap the flow's direction

Note
leaves the 'header' untouched. Interpret that based on FLOW_DIR_REVERSED flag.
Warning
: only valid before applayer parsing started. This function doesn't swap anything in Flow::alparser, Flow::alstate

Definition at line 261 of file flow.c.

References Flow_::flags, FLOW_DIR_REVERSED, Flow_::probing_parser_toclient_alproto_masks, Flow_::probing_parser_toserver_alproto_masks, and SWAP_VARS.

◆ FlowUnsetChangeProtoFlag()

void FlowUnsetChangeProtoFlag ( Flow f)

Unset flag to indicate to change proto for the flow.

Parameters
fflow

Definition at line 202 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

◆ FlowUpdateState()

void FlowUpdateState ( Flow f,
const enum FlowState  s 
)

Definition at line 1138 of file flow.c.

References Flow_::flow_state.

Referenced by FlowHandlePacketUpdate(), and PacketBypassCallback().

Here is the caller graph for this function:

◆ SC_ATOMIC_DECLARE() [1/4]

SC_ATOMIC_DECLARE ( FlowProtoTimeoutPtr  ,
flow_timeouts   
)

◆ SC_ATOMIC_DECLARE() [2/4]

SC_ATOMIC_DECLARE ( uint64_t  ,
flow_memuse   
)

flow memuse counter (atomic), for enforcing memcap limit

◆ SC_ATOMIC_DECLARE() [3/4]

SC_ATOMIC_DECLARE ( unsigned int  ,
flow_flags   
)

atomic flags

◆ SC_ATOMIC_DECLARE() [4/4]

SC_ATOMIC_DECLARE ( unsigned int  ,
flow_prune_idx   
)

atomic int that is used when freeing a flow from the hash. In this case we walk the hash to find a flow to free. This var records where we left off in the hash. Without this only the top rows of the hash are freed. This isn't just about fairness. Under severe presure, the hash rows on top would be all freed and the time to find a flow to free increased with every run.

Variable Documentation

◆ flow_config

◆ flow_freefuncs

Definition at line 96 of file flow.c.

Referenced by FlowClearMemory(), FlowInitFlowProto(), and FlowSetProtoFreeFunc().

◆ flow_timeouts_delta

FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]

Definition at line 95 of file flow.c.

Referenced by FlowInitFlowProto().

◆ flow_timeouts_emerg

FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]

Definition at line 94 of file flow.c.

Referenced by FlowInitFlowProto(), and FlowTimeoutsEmergency().

◆ flow_timeouts_normal

FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]

FlowProto specific timeouts and free/state functions

Definition at line 93 of file flow.c.

Referenced by FlowInitFlowProto(), and FlowTimeoutsInit().

◆ run_mode

int run_mode

Run mode selected

Definition at line 201 of file suricata.c.

flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:93