suricata
|
#include "suricata-common.h"
#include "suricata.h"
#include "action-globals.h"
#include "packet.h"
#include "decode.h"
#include "conf.h"
#include "threadvars.h"
#include "util-random.h"
#include "util-time.h"
#include "flow.h"
#include "flow-bindgen.h"
#include "flow-queue.h"
#include "flow-hash.h"
#include "flow-util.h"
#include "flow-private.h"
#include "flow-manager.h"
#include "flow-storage.h"
#include "flow-bypass.h"
#include "flow-spare-pool.h"
#include "flow-callbacks.h"
#include "stream-tcp-private.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-byte.h"
#include "util-misc.h"
#include "util-macset.h"
#include "util-flow-rate.h"
#include "util-debug.h"
#include "rust.h"
#include "app-layer-parser.h"
#include "app-layer-expectation.h"
#include "threads.h"
Go to the source code of this file.
Macros | |
#define | FLOW_DEFAULT_EMERGENCY_RECOVERY 30 |
#define | FLOW_DEFAULT_HASHSIZE 65536 |
#define | FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32 MB */ |
#define | FLOW_DEFAULT_PREALLOC 10000 |
#define | SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) |
Functions | |
SC_ATOMIC_DECLARE (FlowProtoTimeoutPtr, flow_timeouts) | |
SC_ATOMIC_DECLARE (unsigned int, flow_prune_idx) | |
SC_ATOMIC_DECLARE (unsigned int, flow_flags) | |
SC_ATOMIC_DECLARE (uint64_t, flow_memuse) | |
void | FlowRegisterTests (void) |
Function to register the Flow Unitests. More... | |
void | FlowInitFlowProto (void) |
Function to set the default timeout, free function and flow state function for all supported flow_proto. More... | |
int | FlowSetProtoFreeFunc (uint8_t proto, void(*Free)(void *)) |
Function to set the function to get protocol specific flow state. More... | |
int | FlowSetMemcap (uint64_t size) |
Update memcap value. More... | |
uint64_t | FlowGetMemcap (void) |
Return memcap value. More... | |
uint64_t | FlowGetMemuse (void) |
enum ExceptionPolicy | FlowGetMemcapExceptionPolicy (void) |
void | FlowCleanupAppLayer (Flow *f) |
void | FlowSetHasAlertsFlag (Flow *f) |
Set flag to indicate that flow has alerts. More... | |
int | FlowHasAlerts (const Flow *f) |
Check if flow has alerts. More... | |
void | FlowSetChangeProtoFlag (Flow *f) |
Set flag to indicate to change proto for the flow. More... | |
void | FlowUnsetChangeProtoFlag (Flow *f) |
Unset flag to indicate to change proto for the flow. More... | |
int | FlowChangeProto (Flow *f) |
Check if change proto flag is set for flow. More... | |
void | FlowSwap (Flow *f) |
swap the flow's direction More... | |
int | FlowGetPacketDirection (const Flow *f, const Packet *p) |
determine the direction of the packet compared to the flow More... | |
void | FlowHandlePacketUpdate (Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv) |
Update Packet and Flow. More... | |
void | FlowHandlePacket (ThreadVars *tv, FlowLookupStruct *fls, Packet *p) |
Entry point for packet flow handling. More... | |
void | FlowInitConfig (bool quiet) |
initialize the configuration More... | |
void | FlowReset (void) |
void | FlowShutdown (void) |
shutdown the flow engine More... | |
int | FlowClearMemory (Flow *f, uint8_t proto_map) |
Function clear the flow memory before queueing it to spare flow queue. More... | |
uint8_t | FlowGetDisruptionFlags (const Flow *f, uint8_t flags) |
get 'disruption' flags: GAP/DEPTH/PASS More... | |
void | FlowUpdateState (Flow *f, const enum FlowState s) |
void | SCFlowGetLastTimeAsParts (const Flow *flow, uint64_t *secs, uint64_t *usecs) |
Get flow last time as individual values. More... | |
uint16_t | SCFlowGetSourcePort (const Flow *flow) |
Get flow source port. More... | |
uint16_t | SCFlowGetDestinationPort (const Flow *flow) |
Get flow destination port. More... | |
uint32_t | SCFlowGetFlags (const Flow *flow) |
Get flow flags. More... | |
Flow implementation.
Definition in file flow.c.
#define SET_DEFAULTS | ( | p, | |
n, | |||
e, | |||
c, | |||
b, | |||
ne, | |||
ee, | |||
ce, | |||
be | |||
) |
int FlowChangeProto | ( | Flow * | f | ) |
Check if change proto flag is set for flow.
f | flow |
1 | change proto flag is set |
0 | change proto flag is not set |
Definition at line 197 of file flow.c.
References Flow_::flags, and FLOW_CHANGE_PROTO.
Referenced by AppLayerRequestProtocolChange(), and LLVMFuzzerTestOneInput().
void FlowCleanupAppLayer | ( | Flow * | f | ) |
Definition at line 140 of file flow.c.
References Flow_::alparser, Flow_::alstate, AppLayerParserStateCleanup(), and Flow_::proto.
int FlowClearMemory | ( | Flow * | f, |
uint8_t | proto_map | ||
) |
Function clear the flow memory before queueing it to spare flow queue.
f | pointer to the flow needed to be cleared. |
proto_map | mapped value of the protocol to FLOW_PROTO's. |
Definition at line 1097 of file flow.c.
References AppLayerExpectationClean(), Flow_::flags, flow_freefuncs, FLOW_HAS_EXPECTATION, FLOW_RECYCLE, FlowFreeStorage(), FlowProtoFreeFunc_::Freefunc, Flow_::protoctx, SCEnter, SCReturnInt, and unlikely.
Referenced by FlowReset(), and FlowShutdown().
uint8_t FlowGetDisruptionFlags | ( | const Flow * | f, |
uint8_t | flags | ||
) |
get 'disruption' flags: GAP/DEPTH/PASS
f | locked flow |
flags | existing flags to be amended |
flags | original flags + disrupt flags (if any) \TODO handle UDP |
Definition at line 1141 of file flow.c.
References TcpSession_::client, flags, TcpStream_::flags, Flow_::proto, Flow_::protoctx, TcpSession_::server, and STREAMTCP_STREAM_FLAG_DEPTH_REACHED.
uint64_t FlowGetMemcap | ( | void | ) |
Return memcap value.
memcap | value |
Definition at line 123 of file flow.c.
References flow_config, and SC_ATOMIC_GET.
enum ExceptionPolicy FlowGetMemcapExceptionPolicy | ( | void | ) |
Definition at line 129 of file flow.c.
Referenced by DecodeRegisterPerfCounters().
uint64_t FlowGetMemuse | ( | void | ) |
Definition at line 129 of file flow.c.
References SC_ATOMIC_GET.
determine the direction of the packet compared to the flow
0 | to_server |
1 | to_client |
Definition at line 279 of file flow.c.
References CMP_ADDR, CMP_PORT, Packet_::dp, Flow_::flags, FLOW_DIR_REVERSED, IPPROTO_SCTP, Packet_::proto, Flow_::sp, Packet_::sp, Flow_::src, Packet_::src, TOCLIENT, and TOSERVER.
Referenced by FlowHandlePacketUpdate(), and StreamTcp().
void FlowHandlePacket | ( | ThreadVars * | tv, |
FlowLookupStruct * | fls, | ||
Packet * | p | ||
) |
Entry point for packet flow handling.
This is called for every packet.
tv | threadvars |
dtv | decode thread vars (for flow output api thread data) |
p | packet to handle flow for |
Definition at line 533 of file flow.c.
References Packet_::flags, Packet_::flow, FlowGetFlowFromHash(), PKT_HAS_FLOW, and tv.
Referenced by UTHBuildPacketOfFlows().
void FlowHandlePacketUpdate | ( | Flow * | f, |
Packet * | p, | ||
ThreadVars * | tv, | ||
DecodeThreadVars * | dtv | ||
) |
Update Packet and Flow.
Updates packet and flow based on the new packet.
f | locked flow |
p | packet |
Definition at line 402 of file flow.c.
References BypassedFlowUpdate(), EngineModeIsIPS(), FLOW_BYPASSED_TIMEOUT, Flow_::flow_state, FLOW_STATE_LOCAL_BYPASSED, FlowGetPacketDirection(), FlowUpdateState(), GET_PKT_LEN, Flow_::lastts, Packet_::pcap_cnt, SCLogDebug, SCTIME_CMP_GT, SCTIME_SECS, Flow_::todstbytecnt, Flow_::todstpktcnt, TOSERVER, and Packet_::ts.
int FlowHasAlerts | ( | const Flow * | f | ) |
Check if flow has alerts.
f | flow |
1 | has alerts |
0 | has not alerts |
Definition at line 165 of file flow.c.
References Flow_::flags, and FLOW_HAS_ALERTS.
void FlowInitConfig | ( | bool | quiet | ) |
initialize the configuration
set config values for memcap, prealloc and hash_size
Definition at line 547 of file flow.c.
References CLS, FlowCnf_::emergency_recovery, ExceptionPolicyParse(), FatalError, FBLOCK_INIT, FLOW_CHECK_MEMCAP, flow_config, FLOW_DEFAULT_EMERGENCY_RECOVERY, FLOW_DEFAULT_HASHSIZE, FLOW_DEFAULT_MEMCAP, FLOW_DEFAULT_PREALLOC, flow_hash, flow_recycle_q, FlowInitFlowProto(), FlowQueueInit(), FlowSparePoolInit(), FlowStorageSize(), FlowCnf_::hash_rand, FlowCnf_::hash_size, FlowCnf_::memcap_policy, ParseSizeStringU64(), FlowCnf_::prealloc, RandomGet(), SC_ATOMIC_ADD, SC_ATOMIC_GET, SC_ATOMIC_INIT, SC_ATOMIC_SET, SCConfGet(), SCConfGetInt(), SCLogDebug, SCLogError, SCMallocAligned, StringParseUint32(), and unlikely.
Referenced by PreRunInit().
void FlowInitFlowProto | ( | void | ) |
Function to set the default timeout, free function and flow state function for all supported flow_proto.
Definition at line 735 of file flow.c.
References FlowProtoTimeout_::bypassed_timeout, FlowProtoTimeout_::closed_timeout, FlowProtoTimeout_::est_timeout, FLOW_DEFAULT_BYPASSED_TIMEOUT, FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT, FLOW_DEFAULT_EMERG_EST_TIMEOUT, FLOW_DEFAULT_EMERG_NEW_TIMEOUT, FLOW_DEFAULT_EST_TIMEOUT, FLOW_DEFAULT_NEW_TIMEOUT, flow_freefuncs, FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT, FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT, FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT, FLOW_IPPROTO_ICMP_EST_TIMEOUT, FLOW_IPPROTO_ICMP_NEW_TIMEOUT, FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT, FLOW_IPPROTO_TCP_CLOSED_TIMEOUT, FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT, FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT, FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT, FLOW_IPPROTO_TCP_EST_TIMEOUT, FLOW_IPPROTO_TCP_NEW_TIMEOUT, FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT, FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT, FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT, FLOW_IPPROTO_UDP_EST_TIMEOUT, FLOW_IPPROTO_UDP_NEW_TIMEOUT, FLOW_PROTO_DEFAULT, FLOW_PROTO_ICMP, FLOW_PROTO_MAX, FLOW_PROTO_TCP, FLOW_PROTO_UDP, flow_timeouts_delta, flow_timeouts_emerg, flow_timeouts_normal, FlowTimeoutsInit(), FlowProtoFreeFunc_::Freefunc, FlowProtoTimeout_::new_timeout, proto, SCConfGetNode(), SCConfNodeLookupChild(), SCConfNodeLookupChildValue(), SCLogDebug, SCLogWarning, SET_DEFAULTS, and StringParseUint32().
Referenced by FlowInitConfig().
void FlowRegisterTests | ( | void | ) |
Function to register the Flow Unitests.
Definition at line 1445 of file flow.c.
References UtRegisterTest().
void FlowReset | ( | void | ) |
Definition at line 673 of file flow.c.
References flow_config, flow_hash, FlowClearMemory(), FlowFree(), FlowGetProtoMapping(), FlowCnf_::hash_size, Flow_::next, and Flow_::proto.
void FlowSetChangeProtoFlag | ( | Flow * | f | ) |
Set flag to indicate to change proto for the flow.
f | flow |
Definition at line 178 of file flow.c.
References Flow_::flags, and FLOW_CHANGE_PROTO.
Referenced by AppLayerRequestProtocolChange().
void FlowSetHasAlertsFlag | ( | Flow * | f | ) |
Set flag to indicate that flow has alerts.
f | flow |
Definition at line 154 of file flow.c.
References Flow_::flags, and FLOW_HAS_ALERTS.
int FlowSetMemcap | ( | uint64_t | size | ) |
Update memcap value.
size | new memcap value |
Definition at line 108 of file flow.c.
References flow_config, SC_ATOMIC_GET, and SC_ATOMIC_SET.
int FlowSetProtoFreeFunc | ( | uint8_t | proto, |
void(*)(void *) | Free | ||
) |
Function to set the function to get protocol specific flow state.
proto | protocol of which function is needed to be set. |
Free | Function pointer which will be called to free the protocol specific memory. |
Definition at line 1125 of file flow.c.
References flow_freefuncs, FlowGetProtoMapping(), FlowProtoFreeFunc_::Freefunc, and proto.
void FlowShutdown | ( | void | ) |
shutdown the flow engine
Definition at line 691 of file flow.c.
References DEBUG_VALIDATE_BUG_ON, FBLOCK_DESTROY, flow_config, flow_hash, flow_recycle_q, FlowClearMemory(), FlowDequeue(), FlowFree(), FlowGetProtoMapping(), FlowQueueDestroy(), FlowSparePoolDestroy(), FlowCnf_::hash_size, Flow_::next, Flow_::proto, SC_ATOMIC_GET, SC_ATOMIC_SUB, and SCFreeAligned.
void FlowSwap | ( | Flow * | f | ) |
swap the flow's direction
Definition at line 246 of file flow.c.
References Flow_::flags, FLOW_DIR_REVERSED, Flow_::probing_parser_toclient_alproto_masks, Flow_::probing_parser_toserver_alproto_masks, and SWAP_VARS.
void FlowUnsetChangeProtoFlag | ( | Flow * | f | ) |
Unset flag to indicate to change proto for the flow.
f | flow |
Definition at line 187 of file flow.c.
References Flow_::flags, and FLOW_CHANGE_PROTO.
Definition at line 1162 of file flow.c.
References Flow_::flow_state.
Referenced by FlowHandlePacketUpdate(), and PacketBypassCallback().
SC_ATOMIC_DECLARE | ( | FlowProtoTimeoutPtr | , |
flow_timeouts | |||
) |
SC_ATOMIC_DECLARE | ( | uint64_t | , |
flow_memuse | |||
) |
flow memuse counter (atomic), for enforcing memcap limit
SC_ATOMIC_DECLARE | ( | unsigned int | , |
flow_flags | |||
) |
atomic flags
SC_ATOMIC_DECLARE | ( | unsigned int | , |
flow_prune_idx | |||
) |
atomic int that is used when freeing a flow from the hash. In this case we walk the hash to find a flow to free. This var records where we left off in the hash. Without this only the top rows of the hash are freed. This isn't just about fairness. Under severe pressure, the hash rows on top would be all freed and the time to find a flow to free increased with every run.
uint16_t SCFlowGetDestinationPort | ( | const Flow * | flow | ) |
uint32_t SCFlowGetFlags | ( | const Flow * | flow | ) |
Get flow flags.
A function to get the flow flags useful when the caller only has an opaque pointer to the flow structure.
Definition at line 1228 of file flow.c.
References Flow_::flags.
void SCFlowGetLastTimeAsParts | ( | const Flow * | flow, |
uint64_t * | secs, | ||
uint64_t * | usecs | ||
) |
Get flow last time as individual values.
Instead of returning a pointer to the timeval copy the timeval parts into output pointers to make it simpler to call from Rust over FFI using only basic data types.
Definition at line 1193 of file flow.c.
References Flow_::lastts, SCTIME_SECS, and SCTIME_USECS.
uint16_t SCFlowGetSourcePort | ( | const Flow * | flow | ) |
FlowConfig flow_config |
Definition at line 94 of file flow.c.
Referenced by FlowGetExistingFlowFromFlowId(), FlowGetFlowFromHash(), FlowGetMemcap(), FlowInitConfig(), FlowKeyGetHash(), FlowReset(), FlowSetMemcap(), FlowShutdown(), and FlowSparePoolUpdate().
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX] |
Definition at line 92 of file flow.c.
Referenced by FlowClearMemory(), FlowInitFlowProto(), and FlowSetProtoFreeFunc().
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX] |
Definition at line 91 of file flow.c.
Referenced by FlowInitFlowProto().
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX] |
Definition at line 90 of file flow.c.
Referenced by FlowInitFlowProto(), and FlowTimeoutsEmergency().
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX] |
FlowProto specific timeouts and free/state functions
Definition at line 89 of file flow.c.
Referenced by FlowInitFlowProto(), and FlowTimeoutsInit().