suricata
flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow implementation.
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 #include "decode.h"
29 #include "conf.h"
30 #include "threadvars.h"
31 #include "tm-threads.h"
32 #include "runmodes.h"
33 
34 #include "util-random.h"
35 #include "util-time.h"
36 
37 #include "flow.h"
38 #include "flow-queue.h"
39 #include "flow-hash.h"
40 #include "flow-util.h"
41 #include "flow-var.h"
42 #include "flow-private.h"
43 #include "flow-timeout.h"
44 #include "flow-manager.h"
45 #include "flow-storage.h"
46 #include "flow-bypass.h"
47 #include "flow-spare-pool.h"
48 
49 #include "stream-tcp-private.h"
50 #include "stream-tcp-reassemble.h"
51 #include "stream-tcp.h"
52 
53 #include "util-unittest.h"
54 #include "util-unittest-helper.h"
55 #include "util-byte.h"
56 #include "util-misc.h"
57 
58 #include "util-debug.h"
59 #include "util-privs.h"
60 #include "util-validate.h"
61 
62 #include "detect.h"
63 #include "detect-engine-state.h"
64 #include "stream.h"
65 
66 #include "app-layer-parser.h"
67 #include "app-layer-expectation.h"
68 
69 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
70 
71 //#define FLOW_DEFAULT_HASHSIZE 262144
72 #define FLOW_DEFAULT_HASHSIZE 65536
73 //#define FLOW_DEFAULT_MEMCAP 128 * 1024 * 1024 /* 128 MB */
74 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32 MB */
75 
76 #define FLOW_DEFAULT_PREALLOC 10000
77 
79 
80 /** atomic int that is used when freeing a flow from the hash. In this
81  * case we walk the hash to find a flow to free. This var records where
82  * we left off in the hash. Without this only the top rows of the hash
83  * are freed. This isn't just about fairness. Under severe presure, the
84  * hash rows on top would be all freed and the time to find a flow to
85  * free increased with every run. */
86 SC_ATOMIC_DECLARE(unsigned int, flow_prune_idx);
87 
88 /** atomic flags */
89 SC_ATOMIC_DECLARE(unsigned int, flow_flags);
90 
91 /** FlowProto specific timeouts and free/state functions */
92 
97 
99 
100 /** flow memuse counter (atomic), for enforcing memcap limit */
101 SC_ATOMIC_DECLARE(uint64_t, flow_memuse);
102 
103 void FlowRegisterTests(void);
104 void FlowInitFlowProto(void);
105 int FlowSetProtoFreeFunc(uint8_t, void (*Free)(void *));
106 
107 /* Run mode selected at suricata.c */
108 extern int run_mode;
109 
110 /**
111  * \brief Update memcap value
112  *
113  * \param size new memcap value
114  */
115 int FlowSetMemcap(uint64_t size)
116 {
117  if ((uint64_t)SC_ATOMIC_GET(flow_memuse) < size) {
118  SC_ATOMIC_SET(flow_config.memcap, size);
119  return 1;
120  }
121 
122  return 0;
123 }
124 
125 /**
126  * \brief Return memcap value
127  *
128  * \retval memcap value
129  */
130 uint64_t FlowGetMemcap(void)
131 {
132  uint64_t memcapcopy = SC_ATOMIC_GET(flow_config.memcap);
133  return memcapcopy;
134 }
135 
136 uint64_t FlowGetMemuse(void)
137 {
138  uint64_t memusecopy = SC_ATOMIC_GET(flow_memuse);
139  return memusecopy;
140 }
141 
143 {
144  if (f == NULL || f->proto == 0)
145  return;
146 
148  f->alstate = NULL;
149  f->alparser = NULL;
150  return;
151 }
152 
153 /** \brief Set the IPOnly scanned flag for 'direction'.
154  *
155  * \param f Flow to set the flag in
156  * \param direction direction to set the flag in
157  */
158 void FlowSetIPOnlyFlag(Flow *f, int direction)
159 {
160  direction ? (f->flags |= FLOW_TOSERVER_IPONLY_SET) :
162  return;
163 }
164 
165 /** \brief Set flag to indicate that flow has alerts
166  *
167  * \param f flow
168  */
170 {
171  f->flags |= FLOW_HAS_ALERTS;
172 }
173 
174 /** \brief Check if flow has alerts
175  *
176  * \param f flow
177  * \retval 1 has alerts
178  * \retval 0 has not alerts
179  */
180 int FlowHasAlerts(const Flow *f)
181 {
182  if (f->flags & FLOW_HAS_ALERTS) {
183  return 1;
184  }
185 
186  return 0;
187 }
188 
189 /** \brief Set flag to indicate to change proto for the flow
190  *
191  * \param f flow
192  */
194 {
195  f->flags |= FLOW_CHANGE_PROTO;
196 }
197 
198 /** \brief Unset flag to indicate to change proto for the flow
199  *
200  * \param f flow
201  */
203 {
204  f->flags &= ~FLOW_CHANGE_PROTO;
205 }
206 
207 /** \brief Check if change proto flag is set for flow
208  * \param f flow
209  * \retval 1 change proto flag is set
210  * \retval 0 change proto flag is not set
211  */
213 {
214  if (f->flags & FLOW_CHANGE_PROTO) {
215  return 1;
216  }
217 
218  return 0;
219 }
220 
221 static inline void FlowSwapFlags(Flow *f)
222 {
226 
231 
233 }
234 
235 static inline void FlowSwapFileFlags(Flow *f)
236 {
241 }
242 
243 static inline void TcpStreamFlowSwap(Flow *f)
244 {
245  TcpSession *ssn = f->protoctx;
246  SWAP_VARS(TcpStream, ssn->server, ssn->client);
249  } else if (ssn->data_first_seen_dir & STREAM_TOCLIENT) {
251  }
252 }
253 
254 /** \brief swap the flow's direction
255  * \note leaves the 'header' untouched. Interpret that based
256  * on FLOW_DIR_REVERSED flag.
257  * \warning: only valid before applayer parsing started. This
258  * function doesn't swap anything in Flow::alparser,
259  * Flow::alstate
260  */
261 void FlowSwap(Flow *f)
262 {
263  f->flags |= FLOW_DIR_REVERSED;
264 
267 
268  FlowSwapFlags(f);
269  FlowSwapFileFlags(f);
270 
271  if (f->proto == IPPROTO_TCP) {
272  TcpStreamFlowSwap(f);
273  }
274 
278 
279  /* not touching Flow::alparser and Flow::alstate */
280 
281  SWAP_VARS(const void *, f->sgh_toclient, f->sgh_toserver);
282 
283  SWAP_VARS(uint32_t, f->todstpktcnt, f->tosrcpktcnt);
284  SWAP_VARS(uint64_t, f->todstbytecnt, f->tosrcbytecnt);
285 }
286 
287 /**
288  * \brief determine the direction of the packet compared to the flow
289  * \retval 0 to_server
290  * \retval 1 to_client
291  */
292 int FlowGetPacketDirection(const Flow *f, const Packet *p)
293 {
294  const int reverse = (f->flags & FLOW_DIR_REVERSED) != 0;
295 
296  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
297  if (!(CMP_PORT(p->sp,p->dp))) {
298  /* update flags and counters */
299  if (CMP_PORT(f->sp,p->sp)) {
300  return TOSERVER ^ reverse;
301  } else {
302  return TOCLIENT ^ reverse;
303  }
304  } else {
305  if (CMP_ADDR(&f->src,&p->src)) {
306  return TOSERVER ^ reverse;
307  } else {
308  return TOCLIENT ^ reverse;
309  }
310  }
311  } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
312  if (CMP_ADDR(&f->src,&p->src)) {
313  return TOSERVER ^ reverse;
314  } else {
315  return TOCLIENT ^ reverse;
316  }
317  }
318 
319  /* default to toserver */
320  return TOSERVER;
321 }
322 
323 /**
324  * \brief Check to update "seen" flags
325  *
326  * \param p packet
327  *
328  * \retval 1 true
329  * \retval 0 false
330  */
331 static inline int FlowUpdateSeenFlag(const Packet *p)
332 {
333  if (PKT_IS_ICMPV4(p)) {
334  if (ICMPV4_IS_ERROR_MSG(p)) {
335  return 0;
336  }
337  }
338 
339  return 1;
340 }
341 
342 static inline void FlowUpdateTtlTS(Flow *f, Packet *p, uint8_t ttl)
343 {
344  if (f->min_ttl_toserver == 0) {
345  f->min_ttl_toserver = ttl;
346  } else {
347  f->min_ttl_toserver = MIN(f->min_ttl_toserver, ttl);
348  }
349  f->max_ttl_toserver = MAX(f->max_ttl_toserver, ttl);
350 }
351 
352 static inline void FlowUpdateTtlTC(Flow *f, Packet *p, uint8_t ttl)
353 {
354  if (f->min_ttl_toclient == 0) {
355  f->min_ttl_toclient = ttl;
356  } else {
357  f->min_ttl_toclient = MIN(f->min_ttl_toclient, ttl);
358  }
359  f->max_ttl_toclient = MAX(f->max_ttl_toclient, ttl);
360 }
361 
362 static inline void FlowUpdateEthernet(ThreadVars *tv, DecodeThreadVars *dtv,
363  Flow *f, EthernetHdr *ethh, bool toserver)
364 {
365  if (ethh && MacSetFlowStorageEnabled()) {
367  if (ms != NULL) {
368  if (toserver) {
369  MacSetAddWithCtr(ms, ethh->eth_src, ethh->eth_dst, tv,
372  } else {
373  MacSetAddWithCtr(ms, ethh->eth_dst, ethh->eth_src, tv,
376  }
377  }
378  }
379 }
380 
381 /** \brief Update Packet and Flow
382  *
383  * Updates packet and flow based on the new packet.
384  *
385  * \param f locked flow
386  * \param p packet
387  *
388  * \note overwrites p::flowflags
389  */
391 {
392  SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f);
393 
394  const int pkt_dir = FlowGetPacketDirection(f, p);
395 #ifdef CAPTURE_OFFLOAD
396  int state = f->flow_state;
397 
398  if (state != FLOW_STATE_CAPTURE_BYPASSED) {
399 #endif
400  /* update the last seen timestamp of this flow */
401  if (timercmp(&p->ts, &f->lastts, >)) {
402  COPY_TIMESTAMP(&p->ts, &f->lastts);
403  const uint32_t timeout_at = (uint32_t)f->lastts.tv_sec + f->timeout_policy;
404  if (timeout_at != f->timeout_at) {
405  f->timeout_at = timeout_at;
406  }
407  }
408 #ifdef CAPTURE_OFFLOAD
409  } else {
410  /* still seeing packet, we downgrade to local bypass */
411  if (p->ts.tv_sec - f->lastts.tv_sec > FLOW_BYPASSED_TIMEOUT / 2) {
412  SCLogDebug("Downgrading flow to local bypass");
413  COPY_TIMESTAMP(&p->ts, &f->lastts);
415  } else {
416  /* In IPS mode the packet could come from the other interface so it would
417  * need to be bypassed */
418  if (EngineModeIsIPS()) {
419  BypassedFlowUpdate(f, p);
420  }
421  }
422  }
423 #endif
424  /* update flags and counters */
425  if (pkt_dir == TOSERVER) {
426  f->todstpktcnt++;
427  f->todstbytecnt += GET_PKT_LEN(p);
429  if (!(f->flags & FLOW_TO_DST_SEEN)) {
430  if (FlowUpdateSeenFlag(p)) {
431  f->flags |= FLOW_TO_DST_SEEN;
433  }
434  }
435  /* xfer proto detect ts flag to first packet in ts dir */
436  if (f->flags & FLOW_PROTO_DETECT_TS_DONE) {
439  }
440  FlowUpdateEthernet(tv, dtv, f, p->ethh, true);
441  /* update flow's ttl fields if needed */
442  if (PKT_IS_IPV4(p)) {
443  FlowUpdateTtlTS(f, p, IPV4_GET_IPTTL(p));
444  } else if (PKT_IS_IPV6(p)) {
445  FlowUpdateTtlTS(f, p, IPV6_GET_HLIM(p));
446  }
447  } else {
448  f->tosrcpktcnt++;
449  f->tosrcbytecnt += GET_PKT_LEN(p);
451  if (!(f->flags & FLOW_TO_SRC_SEEN)) {
452  if (FlowUpdateSeenFlag(p)) {
453  f->flags |= FLOW_TO_SRC_SEEN;
455  }
456  }
457  /* xfer proto detect tc flag to first packet in tc dir */
458  if (f->flags & FLOW_PROTO_DETECT_TC_DONE) {
461  }
462  FlowUpdateEthernet(tv, dtv, f, p->ethh, false);
463  /* update flow's ttl fields if needed */
464  if (PKT_IS_IPV4(p)) {
465  FlowUpdateTtlTC(f, p, IPV4_GET_IPTTL(p));
466  } else if (PKT_IS_IPV6(p)) {
467  FlowUpdateTtlTC(f, p, IPV6_GET_HLIM(p));
468  }
469  }
470 
472  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
474 
475  } else if (f->proto == IPPROTO_TCP) {
476  TcpSession *ssn = (TcpSession *)f->protoctx;
477  if (ssn != NULL && ssn->state >= TCP_ESTABLISHED) {
479  }
480  } else if ((f->flags & (FLOW_TO_DST_SEEN|FLOW_TO_SRC_SEEN)) ==
482  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
484 
486  }
487 
488  /*set the detection bypass flags*/
489  if (f->flags & FLOW_NOPACKET_INSPECTION) {
490  SCLogDebug("setting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
492  }
493  if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
494  SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
496  }
497 }
498 
499 /** \brief Entry point for packet flow handling
500  *
501  * This is called for every packet.
502  *
503  * \param tv threadvars
504  * \param dtv decode thread vars (for flow output api thread data)
505  * \param p packet to handle flow for
506  */
508 {
509  /* Get this packet's flow from the hash. FlowHandlePacket() will setup
510  * a new flow if nescesary. If we get NULL, we're out of flow memory.
511  * The returned flow is locked. */
512  Flow *f = FlowGetFlowFromHash(tv, fls, p, &p->flow);
513  if (f == NULL)
514  return;
515 
516  /* set the flow in the packet */
517  p->flags |= PKT_HAS_FLOW;
518  return;
519 }
520 
521 /** \brief initialize the configuration
522  * \warning Not thread safe */
523 void FlowInitConfig(bool quiet)
524 {
525  SCLogDebug("initializing flow engine...");
526 
527  memset(&flow_config, 0, sizeof(flow_config));
528  SC_ATOMIC_INIT(flow_flags);
529  SC_ATOMIC_INIT(flow_memuse);
530  SC_ATOMIC_INIT(flow_prune_idx);
531  SC_ATOMIC_INIT(flow_config.memcap);
533 
534  /* set defaults */
535  flow_config.hash_rand = (uint32_t)RandomGet();
539 
540  /* If we have specific config, overwrite the defaults with them,
541  * otherwise, leave the default values */
542  intmax_t val = 0;
543  if (ConfGetInt("flow.emergency-recovery", &val) == 1) {
544  if (val <= 100 && val >= 1) {
545  flow_config.emergency_recovery = (uint8_t)val;
546  } else {
547  SCLogError(SC_ERR_INVALID_VALUE, "flow.emergency-recovery must be in the range of "
548  "1 and 100 (as percentage)");
550  }
551  } else {
552  SCLogDebug("flow.emergency-recovery, using default value");
554  }
555 
556  /* Check if we have memcap and hash_size defined at config */
557  const char *conf_val;
558  uint32_t configval = 0;
559 
560  /** set config values for memcap, prealloc and hash_size */
561  uint64_t flow_memcap_copy = 0;
562  if ((ConfGet("flow.memcap", &conf_val)) == 1)
563  {
564  if (conf_val == NULL) {
565  FatalError(SC_ERR_FATAL, "Invalid value for flow.memcap: NULL");
566  }
567 
568  if (ParseSizeStringU64(conf_val, &flow_memcap_copy) < 0) {
569  SCLogError(SC_ERR_SIZE_PARSE, "Error parsing flow.memcap "
570  "from conf file - %s. Killing engine",
571  conf_val);
572  exit(EXIT_FAILURE);
573  } else {
574  SC_ATOMIC_SET(flow_config.memcap, flow_memcap_copy);
575  }
576  }
577  if ((ConfGet("flow.hash-size", &conf_val)) == 1)
578  {
579  if (conf_val == NULL) {
580  FatalError(SC_ERR_FATAL, "Invalid value for flow.hash-size: NULL");
581  }
582 
583  if (StringParseUint32(&configval, 10, strlen(conf_val),
584  conf_val) > 0) {
585  flow_config.hash_size = configval;
586  }
587  }
588  if ((ConfGet("flow.prealloc", &conf_val)) == 1)
589  {
590  if (conf_val == NULL) {
591  FatalError(SC_ERR_FATAL, "Invalid value for flow.prealloc: NULL");
592  }
593 
594  if (StringParseUint32(&configval, 10, strlen(conf_val),
595  conf_val) > 0) {
596  flow_config.prealloc = configval;
597  }
598  }
599  SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: "
600  "%"PRIu32", prealloc: %"PRIu32, SC_ATOMIC_GET(flow_config.memcap),
602 
603  /* alloc hash memory */
604  uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket);
605  if (!(FLOW_CHECK_MEMCAP(hash_size))) {
606  SCLogError(SC_ERR_FLOW_INIT, "allocating flow hash failed: "
607  "max flow memcap is smaller than projected hash size. "
608  "Memcap: %"PRIu64", Hash table size %"PRIu64". Calculate "
609  "total hash size by multiplying \"flow.hash-size\" with %"PRIuMAX", "
610  "which is the hash bucket size.", SC_ATOMIC_GET(flow_config.memcap), hash_size,
611  (uintmax_t)sizeof(FlowBucket));
612  exit(EXIT_FAILURE);
613  }
614  flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS);
615  if (unlikely(flow_hash == NULL)) {
617  "Fatal error encountered in FlowInitConfig. Exiting...");
618  }
619  memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket));
620 
621  uint32_t i = 0;
622  for (i = 0; i < flow_config.hash_size; i++) {
623  FBLOCK_INIT(&flow_hash[i]);
624  SC_ATOMIC_INIT(flow_hash[i].next_ts);
625  }
626  (void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket)));
627 
628  if (!quiet) {
629  SCLogConfig("allocated %"PRIu64" bytes of memory for the flow hash... "
630  "%" PRIu32 " buckets of size %" PRIuMAX "",
631  SC_ATOMIC_GET(flow_memuse), flow_config.hash_size,
632  (uintmax_t)sizeof(FlowBucket));
633  }
635  if (!quiet) {
636  SCLogConfig("flow memory usage: %"PRIu64" bytes, maximum: %"PRIu64,
637  SC_ATOMIC_GET(flow_memuse), SC_ATOMIC_GET(flow_config.memcap));
638  }
639 
641 
642  uint32_t sz = sizeof(Flow) + FlowStorageSize();
643  SCLogConfig("flow size %u, memcap allows for %" PRIu64 " flows. Per hash row in perfect "
644  "conditions %" PRIu64,
645  sz, flow_memcap_copy / sz, (flow_memcap_copy / sz) / flow_config.hash_size);
646  return;
647 }
648 
649 /** \brief shutdown the flow engine
650  * \warning Not thread safe */
651 void FlowShutdown(void)
652 {
653  Flow *f;
654  while ((f = FlowDequeue(&flow_recycle_q))) {
655  FlowFree(f);
656  }
657 
658  /* clear and free the hash */
659  if (flow_hash != NULL) {
660  /* clean up flow mutexes */
661  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
662  f = flow_hash[u].head;
663  while (f) {
665  Flow *n = f->next;
666  uint8_t proto_map = FlowGetProtoMapping(f->proto);
667  FlowClearMemory(f, proto_map);
668  FlowFree(f);
669  f = n;
670  }
671  f = flow_hash[u].evicted;
672  while (f) {
674  Flow *n = f->next;
675  uint8_t proto_map = FlowGetProtoMapping(f->proto);
676  FlowClearMemory(f, proto_map);
677  FlowFree(f);
678  f = n;
679  }
680 
682  }
684  flow_hash = NULL;
685  }
686  (void) SC_ATOMIC_SUB(flow_memuse, flow_config.hash_size * sizeof(FlowBucket));
689  return;
690 }
691 
692 /**
693  * \brief Function to set the default timeout, free function and flow state
694  * function for all supported flow_proto.
695  */
696 
698 {
700 
701 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
702  flow_timeouts_normal[(p)].new_timeout = (n); \
703  flow_timeouts_normal[(p)].est_timeout = (e); \
704  flow_timeouts_normal[(p)].closed_timeout = (c); \
705  flow_timeouts_normal[(p)].bypassed_timeout = (b); \
706  flow_timeouts_emerg[(p)].new_timeout = (ne); \
707  flow_timeouts_emerg[(p)].est_timeout = (ee); \
708  flow_timeouts_emerg[(p)].closed_timeout = (ce); \
709  flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
710 
731 
736 
737  /* Let's see if we have custom timeouts defined from config */
738  const char *new = NULL;
739  const char *established = NULL;
740  const char *closed = NULL;
741  const char *bypassed = NULL;
742  const char *emergency_new = NULL;
743  const char *emergency_established = NULL;
744  const char *emergency_closed = NULL;
745  const char *emergency_bypassed = NULL;
746 
747  ConfNode *flow_timeouts = ConfGetNode("flow-timeouts");
748  if (flow_timeouts != NULL) {
749  ConfNode *proto = NULL;
750  uint32_t configval = 0;
751 
752  /* Defaults. */
753  proto = ConfNodeLookupChild(flow_timeouts, "default");
754  if (proto != NULL) {
755  new = ConfNodeLookupChildValue(proto, "new");
756  established = ConfNodeLookupChildValue(proto, "established");
757  closed = ConfNodeLookupChildValue(proto, "closed");
758  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
759  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
760  emergency_established = ConfNodeLookupChildValue(proto,
761  "emergency-established");
762  emergency_closed = ConfNodeLookupChildValue(proto,
763  "emergency-closed");
764  emergency_bypassed = ConfNodeLookupChildValue(proto,
765  "emergency-bypassed");
766 
767  if (new != NULL &&
768  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
769 
771  }
772  if (established != NULL &&
773  StringParseUint32(&configval, 10, strlen(established),
774  established) > 0) {
775 
777  }
778  if (closed != NULL &&
779  StringParseUint32(&configval, 10, strlen(closed),
780  closed) > 0) {
781 
783  }
784  if (bypassed != NULL &&
785  StringParseUint32(&configval, 10,
786  strlen(bypassed),
787  bypassed) > 0) {
788 
790  }
791  if (emergency_new != NULL &&
792  StringParseUint32(&configval, 10, strlen(emergency_new),
793  emergency_new) > 0) {
794 
796  }
797  if (emergency_established != NULL &&
798  StringParseUint32(&configval, 10,
799  strlen(emergency_established),
800  emergency_established) > 0) {
801 
803  }
804  if (emergency_closed != NULL &&
805  StringParseUint32(&configval, 10,
806  strlen(emergency_closed),
807  emergency_closed) > 0) {
808 
810  }
811  if (emergency_bypassed != NULL &&
812  StringParseUint32(&configval, 10,
813  strlen(emergency_bypassed),
814  emergency_bypassed) > 0) {
815 
817  }
818  }
819 
820  /* TCP. */
821  proto = ConfNodeLookupChild(flow_timeouts, "tcp");
822  if (proto != NULL) {
823  new = ConfNodeLookupChildValue(proto, "new");
824  established = ConfNodeLookupChildValue(proto, "established");
825  closed = ConfNodeLookupChildValue(proto, "closed");
826  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
827  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
828  emergency_established = ConfNodeLookupChildValue(proto,
829  "emergency-established");
830  emergency_closed = ConfNodeLookupChildValue(proto,
831  "emergency-closed");
832  emergency_bypassed = ConfNodeLookupChildValue(proto,
833  "emergency-bypassed");
834 
835  if (new != NULL &&
836  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
837 
839  }
840  if (established != NULL &&
841  StringParseUint32(&configval, 10, strlen(established),
842  established) > 0) {
843 
845  }
846  if (closed != NULL &&
847  StringParseUint32(&configval, 10, strlen(closed),
848  closed) > 0) {
849 
851  }
852  if (bypassed != NULL &&
853  StringParseUint32(&configval, 10,
854  strlen(bypassed),
855  bypassed) > 0) {
856 
858  }
859  if (emergency_new != NULL &&
860  StringParseUint32(&configval, 10, strlen(emergency_new),
861  emergency_new) > 0) {
862 
864  }
865  if (emergency_established != NULL &&
866  StringParseUint32(&configval, 10,
867  strlen(emergency_established),
868  emergency_established) > 0) {
869 
871  }
872  if (emergency_closed != NULL &&
873  StringParseUint32(&configval, 10,
874  strlen(emergency_closed),
875  emergency_closed) > 0) {
876 
878  }
879  if (emergency_bypassed != NULL &&
880  StringParseUint32(&configval, 10,
881  strlen(emergency_bypassed),
882  emergency_bypassed) > 0) {
883 
885  }
886  }
887 
888  /* UDP. */
889  proto = ConfNodeLookupChild(flow_timeouts, "udp");
890  if (proto != NULL) {
891  new = ConfNodeLookupChildValue(proto, "new");
892  established = ConfNodeLookupChildValue(proto, "established");
893  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
894  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
895  emergency_established = ConfNodeLookupChildValue(proto,
896  "emergency-established");
897  emergency_bypassed = ConfNodeLookupChildValue(proto,
898  "emergency-bypassed");
899 
900  if (new != NULL &&
901  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
902 
904  }
905  if (established != NULL &&
906  StringParseUint32(&configval, 10, strlen(established),
907  established) > 0) {
908 
910  }
911  if (bypassed != NULL &&
912  StringParseUint32(&configval, 10,
913  strlen(bypassed),
914  bypassed) > 0) {
915 
917  }
918  if (emergency_new != NULL &&
919  StringParseUint32(&configval, 10, strlen(emergency_new),
920  emergency_new) > 0) {
921 
923  }
924  if (emergency_established != NULL &&
925  StringParseUint32(&configval, 10,
926  strlen(emergency_established),
927  emergency_established) > 0) {
928 
930  }
931  if (emergency_bypassed != NULL &&
932  StringParseUint32(&configval, 10,
933  strlen(emergency_bypassed),
934  emergency_bypassed) > 0) {
935 
937  }
938  }
939 
940  /* ICMP. */
941  proto = ConfNodeLookupChild(flow_timeouts, "icmp");
942  if (proto != NULL) {
943  new = ConfNodeLookupChildValue(proto, "new");
944  established = ConfNodeLookupChildValue(proto, "established");
945  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
946  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
947  emergency_established = ConfNodeLookupChildValue(proto,
948  "emergency-established");
949  emergency_bypassed = ConfNodeLookupChildValue(proto,
950  "emergency-bypassed");
951 
952  if (new != NULL &&
953  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
954 
956  }
957  if (established != NULL &&
958  StringParseUint32(&configval, 10, strlen(established),
959  established) > 0) {
960 
962  }
963  if (bypassed != NULL &&
964  StringParseUint32(&configval, 10,
965  strlen(bypassed),
966  bypassed) > 0) {
967 
969  }
970  if (emergency_new != NULL &&
971  StringParseUint32(&configval, 10, strlen(emergency_new),
972  emergency_new) > 0) {
973 
975  }
976  if (emergency_established != NULL &&
977  StringParseUint32(&configval, 10,
978  strlen(emergency_established),
979  emergency_established) > 0) {
980 
982  }
983  if (emergency_bypassed != NULL &&
984  StringParseUint32(&configval, 10,
985  strlen(emergency_bypassed),
986  emergency_bypassed) > 0) {
987 
989  }
990  }
991  }
992 
993  /* validate and if needed update emergency timeout values */
994  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
995  const FlowProtoTimeout *n = &flow_timeouts_normal[i];
997 
998  if (e->est_timeout > n->est_timeout) {
999  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'established\' "
1000  "must be below regular value %u", e->est_timeout, n->est_timeout);
1001  e->est_timeout = n->est_timeout / 10;
1002  }
1003 
1004  if (e->new_timeout > n->new_timeout) {
1005  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'new\' must be "
1006  "below regular value %u", e->new_timeout, n->new_timeout);
1007  e->new_timeout = n->new_timeout / 10;
1008  }
1009 
1010  if (e->closed_timeout > n->closed_timeout) {
1011  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'closed\' must "
1012  "be below regular value %u", e->closed_timeout, n->closed_timeout);
1013  e->closed_timeout = n->closed_timeout / 10;
1014  }
1015 
1016  if (e->bypassed_timeout > n->bypassed_timeout) {
1017  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'bypassed\' "
1018  "must be below regular value %u", e->bypassed_timeout, n->bypassed_timeout);
1019  e->bypassed_timeout = n->bypassed_timeout / 10;
1020  }
1021  }
1022 
1023  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
1027 
1028  if (e->est_timeout > n->est_timeout) {
1029  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'established\' must be below normal value");
1030  e->est_timeout = n->est_timeout / 10;
1031  }
1032  d->est_timeout = n->est_timeout - e->est_timeout;
1033 
1034  if (e->new_timeout > n->new_timeout) {
1035  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'new\' must be below normal value");
1036  e->new_timeout = n->new_timeout / 10;
1037  }
1038  d->new_timeout = n->new_timeout - e->new_timeout;
1039 
1040  if (e->closed_timeout > n->closed_timeout) {
1041  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'closed\' must be below normal value");
1042  e->closed_timeout = n->closed_timeout / 10;
1043  }
1045 
1046  if (e->bypassed_timeout > n->bypassed_timeout) {
1047  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'bypassed\' must be below normal value");
1048  e->bypassed_timeout = n->bypassed_timeout / 10;
1049  }
1051 
1052  SCLogDebug("deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1054  }
1055 
1056  return;
1057 }
1058 
1059 /**
1060  * \brief Function clear the flow memory before queueing it to spare flow
1061  * queue.
1062  *
1063  * \param f pointer to the flow needed to be cleared.
1064  * \param proto_map mapped value of the protocol to FLOW_PROTO's.
1065  */
1066 
1067 int FlowClearMemory(Flow* f, uint8_t proto_map)
1068 {
1069  SCEnter();
1070 
1071  if (unlikely(f->flags & FLOW_HAS_EXPECTATION)) {
1073  }
1074 
1075  /* call the protocol specific free function if we have one */
1076  if (flow_freefuncs[proto_map].Freefunc != NULL) {
1077  flow_freefuncs[proto_map].Freefunc(f->protoctx);
1078  }
1079 
1080  FlowFreeStorage(f);
1081 
1082  FLOW_RECYCLE(f);
1083 
1084  SCReturnInt(1);
1085 }
1086 
1087 /**
1088  * \brief Function to set the function to get protocol specific flow state.
1089  *
1090  * \param proto protocol of which function is needed to be set.
1091  * \param Free Function pointer which will be called to free the protocol
1092  * specific memory.
1093  */
1094 
1095 int FlowSetProtoFreeFunc (uint8_t proto, void (*Free)(void *))
1096 {
1097  uint8_t proto_map;
1098  proto_map = FlowGetProtoMapping(proto);
1099 
1100  flow_freefuncs[proto_map].Freefunc = Free;
1101  return 1;
1102 }
1103 
1105 {
1106  return f->alproto;
1107 }
1108 
1109 void *FlowGetAppState(const Flow *f)
1110 {
1111  return f->alstate;
1112 }
1113 
1114 /**
1115  * \brief get 'disruption' flags: GAP/DEPTH/PASS
1116  * \param f locked flow
1117  * \param flags existing flags to be ammended
1118  * \retval flags original flags + disrupt flags (if any)
1119  * \TODO handle UDP
1120  */
1121 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
1122 {
1123  if (f->proto != IPPROTO_TCP) {
1124  return flags;
1125  }
1126  if (f->protoctx == NULL) {
1127  return flags;
1128  }
1129 
1130  uint8_t newflags = flags;
1131  TcpSession *ssn = f->protoctx;
1132  TcpStream *stream = flags & STREAM_TOSERVER ? &ssn->client : &ssn->server;
1133 
1135  newflags |= STREAM_DEPTH;
1136  }
1137  /* todo: handle pass case (also for UDP!) */
1138 
1139  return newflags;
1140 }
1141 
1142 void FlowUpdateState(Flow *f, const enum FlowState s)
1143 {
1144  if (s != f->flow_state) {
1145  /* set the state */
1146  f->flow_state = s;
1147 
1148  /* update timeout policy and value */
1149  const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1150  if (timeout_policy != f->timeout_policy) {
1151  f->timeout_policy = timeout_policy;
1152  const uint32_t timeout_at = (uint32_t)f->lastts.tv_sec + timeout_policy;
1153  if (timeout_at != f->timeout_at)
1154  f->timeout_at = timeout_at;
1155  }
1156  }
1157 #ifdef UNITTESTS
1158  if (f->fb != NULL) {
1159 #endif
1160  /* and reset the flow buckup next_ts value so that the flow manager
1161  * has to revisit this row */
1162  SC_ATOMIC_SET(f->fb->next_ts, 0);
1163 #ifdef UNITTESTS
1164  }
1165 #endif
1166 }
1167 
1168 /**
1169  * \brief Get flow last time as individual values.
1170  *
1171  * Instead of returning a pointer to the timeval copy the timeval
1172  * parts into output pointers to make it simpler to call from Rust
1173  * over FFI using only basic data types.
1174  */
1175 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
1176 {
1177  *secs = (uint64_t)flow->lastts.tv_sec;
1178  *usecs = (uint64_t)flow->lastts.tv_usec;
1179 }
1180 
1181 /**
1182  * \brief Get flow source port.
1183  *
1184  * A function to get the flow sport useful when the caller only has an
1185  * opaque pointer to the flow structure.
1186  */
1187 uint16_t FlowGetSourcePort(Flow *flow)
1188 {
1189  return flow->sp;
1190 }
1191 
1192 /**
1193  * \brief Get flow destination port.
1194  *
1195  * A function to get the flow dport useful when the caller only has an
1196  * opaque pointer to the flow structure.
1197  */
1198 
1200 {
1201  return flow->dp;
1202 }
1203 /**
1204  * \brief Get flow flags.
1205  *
1206  * A function to get the flow flags useful when the caller only has an
1207  * opaque pointer to the flow structure.
1208  */
1209 
1210 uint32_t FlowGetFlags(Flow *flow)
1211 {
1212  return flow->flags;
1213 }
1214 /************************************Unittests*******************************/
1215 
1216 #ifdef UNITTESTS
1217 #include "threads.h"
1218 
1219 /**
1220  * \test Test the setting of the per protocol timeouts.
1221  *
1222  * \retval On success it returns 1 and on failure 0.
1223  */
1224 
1225 static int FlowTest01 (void)
1226 {
1227  uint8_t proto_map;
1228 
1230  proto_map = FlowGetProtoMapping(IPPROTO_TCP);
1231  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_TCP_NEW_TIMEOUT);
1232  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_TCP_EST_TIMEOUT);
1235 
1236  proto_map = FlowGetProtoMapping(IPPROTO_UDP);
1237  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_UDP_NEW_TIMEOUT);
1238  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_UDP_EST_TIMEOUT);
1241 
1242  proto_map = FlowGetProtoMapping(IPPROTO_ICMP);
1243  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_ICMP_NEW_TIMEOUT);
1244  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_ICMP_EST_TIMEOUT);
1247 
1248  proto_map = FlowGetProtoMapping(IPPROTO_DCCP);
1249  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_DEFAULT_NEW_TIMEOUT);
1250  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_DEFAULT_EST_TIMEOUT);
1251  FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_DEFAULT_EMERG_NEW_TIMEOUT);
1252  FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_DEFAULT_EMERG_EST_TIMEOUT);
1253 
1254  PASS;
1255 }
1256 
1257 /*Test function for the unit test FlowTest02*/
1258 
1259 static void test(void *f) {}
1260 
1261 /**
1262  * \test Test the setting of the per protocol free function to free the
1263  * protocol specific memory.
1264  *
1265  * \retval On success it returns 1 and on failure 0.
1266  */
1267 
1268 static int FlowTest02 (void)
1269 {
1270  FlowSetProtoFreeFunc(IPPROTO_DCCP, test);
1271  FlowSetProtoFreeFunc(IPPROTO_TCP, test);
1272  FlowSetProtoFreeFunc(IPPROTO_UDP, test);
1273  FlowSetProtoFreeFunc(IPPROTO_ICMP, test);
1274 
1275  FAIL_IF(flow_freefuncs[FLOW_PROTO_DEFAULT].Freefunc != test);
1276  FAIL_IF(flow_freefuncs[FLOW_PROTO_TCP].Freefunc != test);
1277  FAIL_IF(flow_freefuncs[FLOW_PROTO_UDP].Freefunc != test);
1278  FAIL_IF(flow_freefuncs[FLOW_PROTO_ICMP].Freefunc != test);
1279 
1280  PASS;
1281 }
1282 
1283 /**
1284  * \test Test flow allocations when it reach memcap
1285  *
1286  *
1287  * \retval On success it returns 1 and on failure 0.
1288  */
1289 
1290 static int FlowTest07 (void)
1291 {
1292  int result = 0;
1294  FlowConfig backup;
1295  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1296 
1297  uint32_t ini = 0;
1298  uint32_t end = FlowSpareGetPoolSize();
1299  SC_ATOMIC_SET(flow_config.memcap, 10000);
1300  flow_config.prealloc = 100;
1301 
1302  /* Let's get the flow spare pool empty */
1303  UTHBuildPacketOfFlows(ini, end, 0);
1304 
1305  /* And now let's try to reach the memcap val */
1306  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1307  ini = end + 1;
1308  end = end + 2;
1309  UTHBuildPacketOfFlows(ini, end, 0);
1310  }
1311 
1312  /* should time out normal */
1313  TimeSetIncrementTime(2000);
1314  ini = end + 1;
1315  end = end + 2;
1316  UTHBuildPacketOfFlows(ini, end, 0);
1317 
1318  /* This means that the engine entered emerg mode: should happen as easy
1319  * with flow mgr activated */
1320  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1321  result = 1;
1322 
1323  FlowShutdown();
1324  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1325 
1326  return result;
1327 }
1328 
1329 /**
1330  * \test Test flow allocations when it reach memcap
1331  *
1332  *
1333  * \retval On success it returns 1 and on failure 0.
1334  */
1335 
1336 static int FlowTest08 (void)
1337 {
1338  int result = 0;
1339 
1341  FlowConfig backup;
1342  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1343 
1344  uint32_t ini = 0;
1345  uint32_t end = FlowSpareGetPoolSize();
1346  SC_ATOMIC_SET(flow_config.memcap, 10000);
1347  flow_config.prealloc = 100;
1348 
1349  /* Let's get the flow spare pool empty */
1350  UTHBuildPacketOfFlows(ini, end, 0);
1351 
1352  /* And now let's try to reach the memcap val */
1353  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1354  ini = end + 1;
1355  end = end + 2;
1356  UTHBuildPacketOfFlows(ini, end, 0);
1357  }
1358 
1359  /* By default we use 30 for timing out new flows. This means
1360  * that the Emergency mode should be set */
1362  ini = end + 1;
1363  end = end + 2;
1364  UTHBuildPacketOfFlows(ini, end, 0);
1365 
1366  /* This means that the engine released 5 flows by emergency timeout */
1367  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1368  result = 1;
1369 
1370  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1371  FlowShutdown();
1372 
1373  return result;
1374 }
1375 
1376 /**
1377  * \test Test flow allocations when it reach memcap
1378  *
1379  *
1380  * \retval On success it returns 1 and on failure 0.
1381  */
1382 
1383 static int FlowTest09 (void)
1384 {
1385  int result = 0;
1386 
1388  FlowConfig backup;
1389  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1390 
1391  uint32_t ini = 0;
1392  uint32_t end = FlowSpareGetPoolSize();
1393  SC_ATOMIC_SET(flow_config.memcap, 10000);
1394  flow_config.prealloc = 100;
1395 
1396  /* Let's get the flow spare pool empty */
1397  UTHBuildPacketOfFlows(ini, end, 0);
1398 
1399  /* And now let's try to reach the memcap val */
1400  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1401  ini = end + 1;
1402  end = end + 2;
1403  UTHBuildPacketOfFlows(ini, end, 0);
1404  }
1405 
1406  /* No timeout will work */
1408  ini = end + 1;
1409  end = end + 2;
1410  UTHBuildPacketOfFlows(ini, end, 0);
1411 
1412  /* engine in emerg mode */
1413  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1414  result = 1;
1415 
1416  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1417  FlowShutdown();
1418 
1419  return result;
1420 }
1421 
1422 #endif /* UNITTESTS */
1423 
1424 /**
1425  * \brief Function to register the Flow Unitests.
1426  */
1428 {
1429 #ifdef UNITTESTS
1430  UtRegisterTest("FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1431  UtRegisterTest("FlowTest02 -- Setting Protocol Specific Free Function",
1432  FlowTest02);
1433  UtRegisterTest("FlowTest07 -- Test flow Allocations when it reach memcap",
1434  FlowTest07);
1435  UtRegisterTest("FlowTest08 -- Test flow Allocations when it reach memcap",
1436  FlowTest08);
1437  UtRegisterTest("FlowTest09 -- Test flow Allocations when it reach memcap",
1438  FlowTest09);
1439 
1441 #endif /* UNITTESTS */
1442 }
util-byte.h
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:202
FBLOCK_DESTROY
#define FBLOCK_DESTROY(fb)
Definition: flow-hash.h:70
FLOW_DEFAULT_NEW_TIMEOUT
#define FLOW_DEFAULT_NEW_TIMEOUT
Definition: flow-private.h:40
tm-threads.h
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:436
Packet_::proto
uint8_t proto
Definition: decode.h:436
DecodeSetNoPacketInspectionFlag
#define DecodeSetNoPacketInspectionFlag(p)
Set the No packet inspection Flag for the packet.
Definition: decode.h:1028
FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
Definition: flow-private.h:58
TcpStream_
Definition: stream-tcp-private.h:94
flow-bypass.h
FLOW_HAS_EXPECTATION
#define FLOW_HAS_EXPECTATION
Definition: flow.h:112
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
Definition: flow.c:169
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:142
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
Definition: flow.c:193
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1152
SC_ERR_INVALID_VALUE
@ SC_ERR_INVALID_VALUE
Definition: util-error.h:160
FlowSpareGetPoolSize
uint32_t FlowSpareGetPoolSize(void)
Definition: flow-spare-pool.c:48
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:292
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:510
flow-util.h
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:315
FBLOCK_INIT
#define FBLOCK_INIT(fb)
Definition: flow-hash.h:69
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:260
CLS
#define CLS
Definition: suricata-common.h:45
stream-tcp.h
MacSetAddWithCtr
void MacSetAddWithCtr(MacSet *ms, uint8_t *src_addr, uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
Definition: util-macset.c:179
FLOW_DEFAULT_HASHSIZE
#define FLOW_DEFAULT_HASHSIZE
Definition: flow.c:72
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:300
FLOW_DEFAULT_PREALLOC
#define FLOW_DEFAULT_PREALLOC
Definition: flow.c:76
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:291
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1427
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:62
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:73
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:572
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:200
Flow_::proto
uint8_t proto
Definition: flow.h:375
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:77
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:122
Packet_::flags
uint32_t flags
Definition: decode.h:449
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:175
threads.h
FlowGetFlags
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
Definition: flow.c:1210
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:353
run_mode
int run_mode
Definition: suricata.c:199
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
FlowProtoTimeout_
Definition: flow.h:518
flow-hash.h
FlowGetSourcePort
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
Definition: flow.c:1187
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:65
FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
Definition: flow.h:84
FlowLookupStruct_
Definition: flow.h:542
FLOW_DEFAULT_EMERG_NEW_TIMEOUT
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
Definition: flow-private.h:55
Flow
struct Flow_ Flow
Flow data structure.
FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:59
BypassedFlowUpdate
void BypassedFlowUpdate(Flow *f, Packet *p)
Definition: flow-bypass.c:203
Flow_::use_cnt
FlowRefCount use_cnt
Definition: flow.h:383
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:522
FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_DEFAULT_EST_TIMEOUT
Definition: flow-private.h:41
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:225
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:143
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:136
MIN
#define MIN(x, y)
Definition: suricata-common.h:368
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:130
FlowQueueDestroy
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
Definition: flow-queue.c:61
util-privs.h
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:507
FLOW_PROTO_ICMP
@ FLOW_PROTO_ICMP
Definition: flow-private.h:72
stream-tcp-reassemble.h
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:95
RandomGet
long int RandomGet(void)
Definition: util-random.c:129
FLOW_TOSERVER_DROP_LOGGED
#define FLOW_TOSERVER_DROP_LOGGED
Definition: flow.h:76
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:478
proto
uint8_t proto
Definition: decode-template.h:0
Flow_::dp
Port dp
Definition: flow.h:369
FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
Definition: flow.h:94
FLOW_DEFAULT_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
Definition: flow-private.h:43
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:445
MAX
#define MAX(x, y)
Definition: suricata-common.h:372
Flow_::protoctx
void * protoctx
Definition: flow.h:451
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:647
FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
Definition: flow-private.h:50
STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
Definition: stream-tcp-private.h:204
util-unittest.h
FLOW_BYPASSED_TIMEOUT
#define FLOW_BYPASSED_TIMEOUT
Definition: flow-private.h:67
FlowGetAppState
void * FlowGetAppState(const Flow *f)
Definition: flow.c:1109
util-unittest-helper.h
FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
Definition: flow-private.h:61
FLOW_IPPROTO_ICMP_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
Definition: flow-private.h:52
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:293
UTHBuildPacketOfFlows
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
Definition: util-unittest-helper.c:931
AppLayerExpectationClean
void AppLayerExpectationClean(Flow *f)
Definition: app-layer-expectation.c:360
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:422
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1185
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:493
FlowGetDestinationPort
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
Definition: flow.c:1199
FLOW_CHECK_MEMCAP
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
Definition: flow-util.h:144
FLOW_RECYCLE
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
Definition: flow-util.h:83
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:505
flow-spare-pool.h
SC_ERR_SIZE_PARSE
@ SC_ERR_SIZE_PARSE
Definition: util-error.h:230
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:330
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:485
FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
Definition: flow-private.h:65
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:523
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:498
app-layer-expectation.h
FLOW_IPPROTO_UDP_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
Definition: flow-private.h:49
SC_ERR_FLOW_INIT
@ SC_ERR_FLOW_INIT
Definition: util-error.h:237
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:512
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:477
decode.h
util-debug.h
TOSERVER
#define TOSERVER
Definition: flow.h:45
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:502
DecodeSetNoPayloadInspectionFlag
#define DecodeSetNoPayloadInspectionFlag(p)
Set the No payload inspection Flag for the packet.
Definition: decode.h:1016
FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
Definition: flow-private.h:46
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:390
STREAM_TOSERVER
#define STREAM_TOSERVER
Definition: stream.h:31
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
FLOW_CHANGE_PROTO
#define FLOW_CHANGE_PROTO
Definition: flow.h:106
Packet_::ethh
EthernetHdr * ethh
Definition: decode.h:502
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
FlowStorageSize
unsigned int FlowStorageSize(void)
Definition: flow-storage.c:34
Packet_::sp
Port sp
Definition: decode.h:421
FlowCnf_
Definition: flow.h:289
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:231
FlowQueueInit
FlowQueue * FlowQueueInit(FlowQueue *q)
Definition: flow-queue.c:47
FlowState
FlowState
Definition: flow.h:508
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:262
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:519
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:521
util-time.h
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:76
app-layer-parser.h
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1506
FLOW_PROTO_DETECT_TC_DONE
#define FLOW_PROTO_DETECT_TC_DONE
Definition: flow.h:103
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:504
FLOW_TC_PP_ALPROTO_DETECT_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
Definition: flow.h:92
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:490
MacSetFlowStorageEnabled
bool MacSetFlowStorageEnabled(void)
Definition: util-macset.c:84
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:342
stream.h
TimeSetIncrementTime
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
Definition: util-time.c:182
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:95
Packet_
Definition: decode.h:414
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
STREAM_DEPTH
#define STREAM_DEPTH
Definition: stream.h:34
FLOW_DEFAULT_MEMCAP
#define FLOW_DEFAULT_MEMCAP
Definition: flow.c:74
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:232
stream-tcp-private.h
MacSet_
Definition: util-macset.c:44
conf.h
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:158
FLOW_TOSERVER_IPONLY_SET
#define FLOW_TOSERVER_IPONLY_SET
Definition: flow.h:58
FLOW_IPPROTO_TCP_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
Definition: flow-private.h:44
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:526
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1067
flow_timeouts_delta
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Definition: flow.c:95
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:290
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
flow-timeout.h
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:479
MacSetGetFlowStorageID
FlowStorageId MacSetGetFlowStorageID(void)
Definition: util-macset.c:113
flow-queue.h
FlowGetStorageById
void * FlowGetStorageById(Flow *f, FlowStorageId id)
Definition: flow-storage.c:39
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:429
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:226
runmodes.h
FlowGetFlowFromHash
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, const Packet *p, Flow **dest)
Get Flow for packet.
Definition: flow-hash.c:755
FLOW_TO_DST_SEEN
#define FLOW_TO_DST_SEEN
Definition: flow.h:53
FlowUpdateState
void FlowUpdateState(Flow *f, const enum FlowState s)
Definition: flow.c:1142
Flow_::src
FlowAddress src
Definition: flow.h:356
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:70
Flow_::next
struct Flow_ * next
Definition: flow.h:404
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:428
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
Flow_::lastts
struct timeval lastts
Definition: flow.h:414
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:814
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:56
FlowDequeue
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
Definition: flow-queue.c:192
FLOW_TO_SRC_SEEN
#define FLOW_TO_SRC_SEEN
Definition: flow.h:51
StringParseUint32
int StringParseUint32(uint32_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:313
flow-storage.h
FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
Definition: flow.h:88
Packet_::flow
struct Flow_ * flow
Definition: decode.h:451
FLOW_IPPROTO_UDP_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
Definition: flow-private.h:48
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1095
FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
Definition: flow-private.h:51
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:93
CMP_ADDR
#define CMP_ADDR(a1, a2)
Definition: decode.h:247
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:123
flags
uint8_t flags
Definition: decode-gre.h:0
FLOW_TOCLIENT_IPONLY_SET
#define FLOW_TOCLIENT_IPONLY_SET
Definition: flow.h:60
Packet_::ts
struct timeval ts
Definition: decode.h:457
flow-manager.h
suricata-common.h
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:80
flow_config
FlowConfig flow_config
Definition: flow.c:98
FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
Definition: flow-private.h:47
FLOW_HAS_ALERTS
#define FLOW_HAS_ALERTS
Definition: flow.h:81
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:651
FlowSparePoolDestroy
void FlowSparePoolDestroy(void)
Definition: flow-spare-pool.c:265
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
SWAP_VARS
#define SWAP_VARS(type, a, b)
Definition: suricata-common.h:405
FlowTimeoutsInit
void FlowTimeoutsInit(void)
Definition: flow-manager.c:92
STREAM_TOCLIENT
#define STREAM_TOCLIENT
Definition: stream.h:32
FLOW_PROTO_DETECT_TS_DONE
#define FLOW_PROTO_DETECT_TS_DONE
Definition: flow.h:102
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:71
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:480
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:272
FLOW_TS_PP_ALPROTO_DETECT_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
Definition: flow.h:86
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1186
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1175
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:420
FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
Definition: flow-private.h:60
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
PKT_IS_ICMPV4
#define PKT_IS_ICMPV4(p)
Definition: decode.h:263
threadvars.h
util-validate.h
FlowSwap
void FlowSwap(Flow *f)
swap the flow's direction
Definition: flow.c:261
FlowGetAppProtocol
AppProto FlowGetAppProtocol(const Flow *f)
Definition: flow.c:1104
ICMPV4_IS_ERROR_MSG
#define ICMPV4_IS_ERROR_MSG(p)
Definition: decode-icmpv4.h:286
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FlowInitFlowProto
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
Definition: flow.c:697
SC_WARN_FLOW_EMERGENCY
@ SC_WARN_FLOW_EMERGENCY
Definition: util-error.h:192
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:271
flow_recycle_q
FlowQueue flow_recycle_q
Definition: flow-manager.c:78
SWAP_FLAGS
#define SWAP_FLAGS(flags, a, b)
Definition: suricata-common.h:394
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:71
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
CMP_PORT
#define CMP_PORT(p1, p2)
Definition: decode.h:252
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:638
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:461
ConfNode_
Definition: conf.h:32
Flow_::alstate
void * alstate
Definition: flow.h:486
flow_freefuncs
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
Definition: flow.c:96
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
flow_timeouts_emerg
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow.c:94
Flow_::flags
uint32_t flags
Definition: flow.h:431
FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
Definition: flow-private.h:63
FlowFreeStorage
void FlowFreeStorage(Flow *f)
Definition: flow-storage.c:59
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:648
FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:64
FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_TOCLIENT_DROP_LOGGED
Definition: flow.h:78
util-random.h
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:227
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:246
FLOW_EMERGENCY
#define FLOW_EMERGENCY
Definition: flow-private.h:37
suricata.h
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:42
FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
Definition: flow.h:90
FLOW_DEFAULT_EMERGENCY_RECOVERY
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
Definition: flow.c:69
FlowHasAlerts
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:180
FlowSparePoolInit
void FlowSparePoolInit(void)
Definition: flow-spare-pool.c:246
COPY_TIMESTAMP
#define COPY_TIMESTAMP(src, dst)
Definition: flow-util.h:30
FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
Definition: flow-private.h:56
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:63
FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
Definition: flow-private.h:53
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:520
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:212
Flow_::sp
Port sp
Definition: flow.h:358
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1121
TcpSession_
Definition: stream-tcp-private.h:260
util-misc.h
TcpSession_::data_first_seen_dir
int8_t data_first_seen_dir
Definition: stream-tcp-private.h:265
flow.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:462
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:73
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:433
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:460
Packet_::dp
Port dp
Definition: decode.h:429
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:110
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:399
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
FLOW_IPPROTO_TCP_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
Definition: flow-private.h:45
RegisterFlowStorageTests
void RegisterFlowStorageTests(void)
Definition: flow-storage.c:294
SET_DEFAULTS
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
flow-var.h
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:259
TOCLIENT
#define TOCLIENT
Definition: flow.h:46
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:230
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
Packet_::src
Address src
Definition: decode.h:418
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:503
IPV4_GET_IPTTL
#define IPV4_GET_IPTTL(p)
Definition: decode-ipv4.h:146
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:115
FlowProtoFreeFunc_
Definition: flow.h:525
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:842