Go to the documentation of this file.
64 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
67 #define FLOW_DEFAULT_HASHSIZE 65536
69 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024)
71 #define FLOW_DEFAULT_PREALLOC 10000
141 if (f == NULL || f->
proto == 0)
205 static inline void FlowSwapFlags(
Flow *f)
218 static inline void FlowSwapFileFlags(
Flow *f)
228 static inline void TcpStreamFlowSwap(
Flow *f)
254 FlowSwapFileFlags(f);
258 if (f->
proto == IPPROTO_TCP) {
259 TcpStreamFlowSwap(f);
298 }
else if (p->
proto == IPPROTO_ICMP || p->
proto == IPPROTO_ICMPV6) {
318 static inline int FlowUpdateSeenFlag(
const Packet *p)
320 if (PacketIsICMPv4(p)) {
329 static inline void FlowUpdateTtlTS(
Flow *f, uint8_t ttl)
339 static inline void FlowUpdateTtlTC(
Flow *f, uint8_t ttl)
349 static inline void FlowUpdateFlowRate(
361 SCLogDebug(
"Flow rate for flow %p exceeds the configured values, marking it as an "
373 static inline void FlowUpdateEthernet(
377 const EthernetHdr *ethh = PacketGetEthernet(p);
407 #ifdef CAPTURE_OFFLOAD
410 if (state != FLOW_STATE_CAPTURE_BYPASSED) {
416 #ifdef CAPTURE_OFFLOAD
420 SCLogDebug(
"Downgrading flow to local bypass");
439 if (FlowUpdateSeenFlag(p)) {
450 FlowUpdateEthernet(
tv,
dtv, f, p,
true);
452 if (PacketIsIPv4(p)) {
453 const IPV4Hdr *ip4h = PacketGetIPv4(p);
455 }
else if (PacketIsIPv6(p)) {
456 const IPV6Hdr *ip6h = PacketGetIPv6(p);
465 if (FlowUpdateSeenFlag(p)) {
476 FlowUpdateEthernet(
tv,
dtv, f, p,
false);
478 if (PacketIsIPv4(p)) {
479 const IPV4Hdr *ip4h = PacketGetIPv4(p);
481 }
else if (PacketIsIPv6(p)) {
482 const IPV6Hdr *ip6h = PacketGetIPv6(p);
494 }
else if (f->
proto == IPPROTO_TCP) {
505 #ifdef CAPTURE_OFFLOAD
506 (f->
flow_state != FLOW_STATE_CAPTURE_BYPASSED) &&
518 SCLogDebug(
"setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
519 DecodeSetNoPayloadInspectionFlag(p);
567 if (
SCConfGetInt(
"flow.emergency-recovery", &val) == 1) {
568 if (val <= 100 && val >= 1) {
571 SCLogError(
"flow.emergency-recovery must be in the range of "
572 "1 and 100 (as percentage)");
576 SCLogDebug(
"flow.emergency-recovery, using default value");
581 const char *conf_val;
582 uint32_t configval = 0;
585 uint64_t flow_memcap_copy = 0;
586 if ((
SCConfGet(
"flow.memcap", &conf_val)) == 1) {
587 if (conf_val == NULL) {
588 FatalError(
"Invalid value for flow.memcap: NULL");
593 "from conf file - %s. Killing engine",
600 if ((
SCConfGet(
"flow.hash-size", &conf_val)) == 1) {
601 if (conf_val == NULL) {
602 FatalError(
"Invalid value for flow.hash-size: NULL");
605 if (
StringParseUint32(&configval, 10, strlen(conf_val), conf_val) && configval != 0) {
608 FatalError(
"Invalid value for flow.hash-size. Must be a numeric value in the range "
612 if ((
SCConfGet(
"flow.prealloc", &conf_val)) == 1) {
613 if (conf_val == NULL) {
614 FatalError(
"Invalid value for flow.prealloc: NULL");
625 SCLogDebug(
"Flow config from suricata.yaml: memcap: %"PRIu64
", hash-size: "
633 "max flow memcap is smaller than projected hash size. "
634 "Memcap: %" PRIu64
", Hash table size %" PRIu64
". Calculate "
635 "total hash size by multiplying \"flow.hash-size\" with %" PRIuMAX
", "
636 "which is the hash bucket size.",
642 FatalError(
"Fatal error encountered in FlowInitConfig. Exiting...");
654 SCLogConfig(
"allocated %"PRIu64
" bytes of memory for the flow hash... "
655 "%" PRIu32
" buckets of size %" PRIuMAX
"",
657 (uintmax_t)
sizeof(FlowBucket));
661 SCLogConfig(
"flow memory usage: %"PRIu64
" bytes, maximum: %"PRIu64,
668 SCLogConfig(
"flow size %u, memcap allows for %" PRIu64
" flows. Per hash row in perfect "
669 "conditions %" PRIu64,
739 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
740 flow_timeouts_normal[(p)].new_timeout = (n); \
741 flow_timeouts_normal[(p)].est_timeout = (e); \
742 flow_timeouts_normal[(p)].closed_timeout = (c); \
743 flow_timeouts_normal[(p)].bypassed_timeout = (b); \
744 flow_timeouts_emerg[(p)].new_timeout = (ne); \
745 flow_timeouts_emerg[(p)].est_timeout = (ee); \
746 flow_timeouts_emerg[(p)].closed_timeout = (ce); \
747 flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
776 const char *
new = NULL;
777 const char *established = NULL;
778 const char *closed = NULL;
779 const char *bypassed = NULL;
780 const char *emergency_new = NULL;
781 const char *emergency_established = NULL;
782 const char *emergency_closed = NULL;
783 const char *emergency_bypassed = NULL;
786 if (flow_timeouts != NULL) {
788 uint32_t configval = 0;
807 if (established != NULL &&
813 if (closed != NULL &&
819 if (bypassed != NULL &&
826 if (emergency_new != NULL &&
828 emergency_new) > 0) {
832 if (emergency_established != NULL &&
834 strlen(emergency_established),
835 emergency_established) > 0) {
839 if (emergency_closed != NULL &&
841 strlen(emergency_closed),
842 emergency_closed) > 0) {
846 if (emergency_bypassed != NULL &&
848 strlen(emergency_bypassed),
849 emergency_bypassed) > 0) {
872 if (established != NULL &&
878 if (closed != NULL &&
884 if (bypassed != NULL &&
891 if (emergency_new != NULL &&
893 emergency_new) > 0) {
897 if (emergency_established != NULL &&
899 strlen(emergency_established),
900 emergency_established) > 0) {
904 if (emergency_closed != NULL &&
906 strlen(emergency_closed),
907 emergency_closed) > 0) {
911 if (emergency_bypassed != NULL &&
913 strlen(emergency_bypassed),
914 emergency_bypassed) > 0) {
935 if (established != NULL &&
941 if (bypassed != NULL &&
948 if (emergency_new != NULL &&
950 emergency_new) > 0) {
954 if (emergency_established != NULL &&
956 strlen(emergency_established),
957 emergency_established) > 0) {
961 if (emergency_bypassed != NULL &&
963 strlen(emergency_bypassed),
964 emergency_bypassed) > 0) {
985 if (established != NULL &&
991 if (bypassed != NULL &&
998 if (emergency_new != NULL &&
1000 emergency_new) > 0) {
1004 if (emergency_established != NULL &&
1006 strlen(emergency_established),
1007 emergency_established) > 0) {
1011 if (emergency_bypassed != NULL &&
1013 strlen(emergency_bypassed),
1014 emergency_bypassed) > 0) {
1027 SCLogWarning(
"emergency timeout value %u for \'established\' "
1028 "must be below regular value %u",
1034 SCLogWarning(
"emergency timeout value %u for \'new\' must be "
1035 "below regular value %u",
1041 SCLogWarning(
"emergency timeout value %u for \'closed\' must "
1042 "be below regular value %u",
1048 SCLogWarning(
"emergency timeout value %u for \'bypassed\' "
1049 "must be below regular value %u",
1061 SCLogWarning(
"emergency timeout value for \'established\' must be below normal value");
1067 SCLogWarning(
"emergency timeout value for \'new\' must be below normal value");
1073 SCLogWarning(
"emergency timeout value for \'closed\' must be below normal value");
1079 SCLogWarning(
"emergency timeout value for \'bypassed\' must be below normal value");
1084 SCLogDebug(
"deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1143 if (f->
proto != IPPROTO_TCP) {
1150 uint8_t newflags =
flags;
1155 newflags |= STREAM_DEPTH;
1170 const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1176 if (f->
fb != NULL) {
1243 static int FlowTest01 (
void)
1277 static void test(
void *f) {}
1286 static int FlowTest02 (
void)
1308 static int FlowTest07 (
void)
1354 static int FlowTest08 (
void)
1401 static int FlowTest09 (
void)
1448 UtRegisterTest(
"FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1449 UtRegisterTest(
"FlowTest02 -- Setting Protocol Specific Free Function",
1451 UtRegisterTest(
"FlowTest07 -- Test flow Allocations when it reach memcap",
1453 UtRegisterTest(
"FlowTest08 -- Test flow Allocations when it reach memcap",
1455 UtRegisterTest(
"FlowTest09 -- Test flow Allocations when it reach memcap",
#define FLOWFILE_NO_MD5_TS
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
#define FLOWFILE_NO_MD5_TC
#define FBLOCK_DESTROY(fb)
#define FLOW_DEFAULT_NEW_TIMEOUT
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOWFILE_NO_SIZE_TS
#define FLOW_HAS_EXPECTATION
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
#define FLOWFILE_NO_SIZE_TC
void FlowCleanupAppLayer(Flow *f)
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
#define IPV6_GET_RAW_HLIM(ip6h)
uint32_t FlowSpareGetPoolSize(void)
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
#define FLOW_DEFAULT_HASHSIZE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
uint32_t emergency_recovery
#define FLOW_DEFAULT_PREALLOC
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void FlowRegisterTests(void)
Function to register the Flow Unitests.
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_SGH_TOCLIENT
int ParseSizeStringU64(const char *size, uint64_t *res)
#define FLOWFILE_NO_MAGIC_TS
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
#define FLOW_NOPAYLOAD_INSPECTION
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
FlowStorageId FlowRateGetStorageID(void)
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
void BypassedFlowUpdate(Flow *f, Packet *p)
uint32_t bypassed_timeout
#define FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_PKT_TOSERVER
uint64_t FlowGetMemuse(void)
uint64_t FlowGetMemcap(void)
Return memcap value.
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
void SCFlowRunUpdateCallbacks(ThreadVars *tv, Flow *f, Packet *p)
#define FLOW_TOSERVER_DROP_LOGGED
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
struct Packet_::@33::@40 icmp_s
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
uint16_t counter_max_mac_addrs_src
enum ExceptionPolicy ExceptionPolicyParse(const char *option, bool support_flow)
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define FLOW_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
void AppLayerExpectationClean(Flow *f)
#define PKT_PROTO_DETECT_TS_DONE
const struct SigGroupHead_ * sgh_toserver
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
AppLayerParserState * alparser
void FlowRateStoreUpdate(FlowRateStore *frs, SCTime_t p_ts, uint32_t pkt_len, int direction)
#define FLOWFILE_NO_SHA1_TC
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
void FlowInitConfig(bool quiet)
initialize the configuration
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
@ FLOW_STATE_LOCAL_BYPASSED
#define PASS
Pass the test.
#define FLOWFILE_NO_STORE_TS
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
int SCConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
void MacSetAddWithCtr(MacSet *ms, const uint8_t *src_addr, const uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
#define FLOW_CHANGE_PROTO
Per thread variable structure.
unsigned int FlowStorageSize(void)
#define FLOWFILE_NO_SHA256_TS
#define FLOW_PKT_TOCLIENT_FIRST
FlowQueue * FlowQueueInit(FlowQueue *q)
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
#define SCLogWarning(...)
Macro used to log WARNING messages.
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
#define FLOW_PROTO_DETECT_TC_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
const struct SigGroupHead_ * sgh_toclient
bool MacSetFlowStorageEnabled(void)
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
#define IPV4_GET_RAW_IPTTL(ip4h)
#define FLOW_DEFAULT_MEMCAP
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
FlowStorageId MacSetGetFlowStorageID(void)
uint32_t probing_parser_toclient_alproto_masks
#define FLOW_PKT_TOCLIENT
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
void FlowUpdateState(Flow *f, const enum FlowState s)
uint32_t probing_parser_toserver_alproto_masks
#define FLOWFILE_NO_SHA256_TC
SCConfNode * SCConfNodeLookupChild(const SCConfNode *node, const char *name)
Lookup a child configuration node by name.
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
unsigned short FlowStateType
#define FLOWFILE_NO_MAGIC_TC
enum ExceptionPolicy FlowGetMemcapExceptionPolicy(void)
void FlowFree(Flow *f)
cleanup & free the memory of a flow
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
void FlowShutdown(void)
shutdown the flow engine
void FlowSparePoolDestroy(void)
#define SCMallocAligned(size, align)
#define SWAP_VARS(type, a, b)
void FlowTimeoutsInit(void)
#define FLOW_PROTO_DETECT_TS_DONE
bool FlowRateIsExceeding(FlowRateStore *frs, int direction)
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
#define PKT_PROTO_DETECT_TC_DONE
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
#define FLOWFILE_NO_STORE_TC
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
void FlowSwap(Flow *f)
swap the flow's direction
enum ExceptionPolicy memcap_policy
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
#define SCTIME_CMP_GT(a, b)
#define FLOWFILE_NO_SHA1_TS
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
#define SCLogError(...)
Macro used to log ERROR messages.
#define SWAP_FLAGS(flags, a, b)
#define FLOW_SGH_TOSERVER
Structure to hold thread specific data for all decode modules.
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
uint16_t counter_flow_elephant
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
void FlowFreeStorage(Flow *f)
uint16_t counter_max_mac_addrs_dst
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_PKT_ESTABLISHED
bool FlowRateStorageEnabled(void)
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
int EngineModeIsIPS(void)
@ SIGNATURE_HOOK_PKT_FLOW_START
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
void FlowSparePoolInit(void)
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
int8_t data_first_seen_dir
#define FLOW_DIR_REVERSED
#define ICMPV4_IS_ERROR_MSG(type)
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
void RegisterFlowStorageTests(void)
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
#define FLOW_PKT_TOSERVER_FIRST
#define DEBUG_VALIDATE_BUG_ON(exp)
@ PKT_DROP_REASON_FLOW_DROP
FlowThreadId thread_id[2]
int FlowSetMemcap(uint64_t size)
Update memcap value.