suricata
flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow implementation.
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 #include "decode.h"
29 #include "conf.h"
30 #include "threadvars.h"
31 #include "tm-threads.h"
32 #include "runmodes.h"
33 
34 #include "util-random.h"
35 #include "util-time.h"
36 
37 #include "flow.h"
38 #include "flow-queue.h"
39 #include "flow-hash.h"
40 #include "flow-util.h"
41 #include "flow-var.h"
42 #include "flow-private.h"
43 #include "flow-timeout.h"
44 #include "flow-manager.h"
45 #include "flow-storage.h"
46 #include "flow-bypass.h"
47 #include "flow-spare-pool.h"
48 
49 #include "stream-tcp-private.h"
50 #include "stream-tcp-reassemble.h"
51 #include "stream-tcp.h"
52 
53 #include "util-unittest.h"
54 #include "util-unittest-helper.h"
55 #include "util-byte.h"
56 #include "util-misc.h"
57 
58 #include "util-debug.h"
59 #include "util-privs.h"
60 #include "util-validate.h"
61 
62 #include "detect.h"
63 #include "detect-engine-state.h"
64 #include "stream.h"
65 
66 #include "app-layer-parser.h"
67 #include "app-layer-expectation.h"
68 
69 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
70 
71 //#define FLOW_DEFAULT_HASHSIZE 262144
72 #define FLOW_DEFAULT_HASHSIZE 65536
73 //#define FLOW_DEFAULT_MEMCAP 128 * 1024 * 1024 /* 128 MB */
74 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32 MB */
75 
76 #define FLOW_DEFAULT_PREALLOC 10000
77 
79 
80 /** atomic int that is used when freeing a flow from the hash. In this
81  * case we walk the hash to find a flow to free. This var records where
82  * we left off in the hash. Without this only the top rows of the hash
83  * are freed. This isn't just about fairness. Under severe presure, the
84  * hash rows on top would be all freed and the time to find a flow to
85  * free increased with every run. */
86 SC_ATOMIC_DECLARE(unsigned int, flow_prune_idx);
87 
88 /** atomic flags */
89 SC_ATOMIC_DECLARE(unsigned int, flow_flags);
90 
91 /** FlowProto specific timeouts and free/state functions */
92 
97 
99 
100 /** flow memuse counter (atomic), for enforcing memcap limit */
101 SC_ATOMIC_DECLARE(uint64_t, flow_memuse);
102 
103 void FlowRegisterTests(void);
104 void FlowInitFlowProto(void);
105 int FlowSetProtoFreeFunc(uint8_t, void (*Free)(void *));
106 
107 /* Run mode selected at suricata.c */
108 extern int run_mode;
109 
110 /**
111  * \brief Update memcap value
112  *
113  * \param size new memcap value
114  */
115 int FlowSetMemcap(uint64_t size)
116 {
117  if ((uint64_t)SC_ATOMIC_GET(flow_memuse) < size) {
118  SC_ATOMIC_SET(flow_config.memcap, size);
119  return 1;
120  }
121 
122  return 0;
123 }
124 
125 /**
126  * \brief Return memcap value
127  *
128  * \retval memcap value
129  */
130 uint64_t FlowGetMemcap(void)
131 {
132  uint64_t memcapcopy = SC_ATOMIC_GET(flow_config.memcap);
133  return memcapcopy;
134 }
135 
136 uint64_t FlowGetMemuse(void)
137 {
138  uint64_t memusecopy = SC_ATOMIC_GET(flow_memuse);
139  return memusecopy;
140 }
141 
143 {
144  if (f == NULL || f->proto == 0)
145  return;
146 
148  f->alstate = NULL;
149  f->alparser = NULL;
150  return;
151 }
152 
153 /** \brief Set the IPOnly scanned flag for 'direction'.
154  *
155  * \param f Flow to set the flag in
156  * \param direction direction to set the flag in
157  */
158 void FlowSetIPOnlyFlag(Flow *f, int direction)
159 {
160  direction ? (f->flags |= FLOW_TOSERVER_IPONLY_SET) :
162  return;
163 }
164 
165 /** \brief Set flag to indicate that flow has alerts
166  *
167  * \param f flow
168  */
170 {
171  f->flags |= FLOW_HAS_ALERTS;
172 }
173 
174 /** \brief Check if flow has alerts
175  *
176  * \param f flow
177  * \retval 1 has alerts
178  * \retval 0 has not alerts
179  */
180 int FlowHasAlerts(const Flow *f)
181 {
182  if (f->flags & FLOW_HAS_ALERTS) {
183  return 1;
184  }
185 
186  return 0;
187 }
188 
189 /** \brief Set flag to indicate to change proto for the flow
190  *
191  * \param f flow
192  */
194 {
195  f->flags |= FLOW_CHANGE_PROTO;
196 }
197 
198 /** \brief Unset flag to indicate to change proto for the flow
199  *
200  * \param f flow
201  */
203 {
204  f->flags &= ~FLOW_CHANGE_PROTO;
205 }
206 
207 /** \brief Check if change proto flag is set for flow
208  * \param f flow
209  * \retval 1 change proto flag is set
210  * \retval 0 change proto flag is not set
211  */
213 {
214  if (f->flags & FLOW_CHANGE_PROTO) {
215  return 1;
216  }
217 
218  return 0;
219 }
220 
221 static inline void FlowSwapFlags(Flow *f)
222 {
226 
231 
233 }
234 
235 static inline void FlowSwapFileFlags(Flow *f)
236 {
241 }
242 
243 static inline void TcpStreamFlowSwap(Flow *f)
244 {
245  TcpSession *ssn = f->protoctx;
246  SWAP_VARS(TcpStream, ssn->server, ssn->client);
249  } else if (ssn->data_first_seen_dir & STREAM_TOCLIENT) {
251  }
252 }
253 
254 /** \brief swap the flow's direction
255  * \note leaves the 'header' untouched. Interpret that based
256  * on FLOW_DIR_REVERSED flag.
257  * \warning: only valid before applayer parsing started. This
258  * function doesn't swap anything in Flow::alparser,
259  * Flow::alstate
260  */
261 void FlowSwap(Flow *f)
262 {
263  f->flags |= FLOW_DIR_REVERSED;
264 
267 
268  FlowSwapFlags(f);
269  FlowSwapFileFlags(f);
270 
271  if (f->proto == IPPROTO_TCP) {
272  TcpStreamFlowSwap(f);
273  }
274 
278 
279  /* not touching Flow::alparser and Flow::alstate */
280 
281  SWAP_VARS(const void *, f->sgh_toclient, f->sgh_toserver);
282 
283  SWAP_VARS(uint32_t, f->todstpktcnt, f->tosrcpktcnt);
284  SWAP_VARS(uint64_t, f->todstbytecnt, f->tosrcbytecnt);
285 }
286 
287 /**
288  * \brief determine the direction of the packet compared to the flow
289  * \retval 0 to_server
290  * \retval 1 to_client
291  */
292 int FlowGetPacketDirection(const Flow *f, const Packet *p)
293 {
294  const int reverse = (f->flags & FLOW_DIR_REVERSED) != 0;
295 
296  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
297  if (!(CMP_PORT(p->sp,p->dp))) {
298  /* update flags and counters */
299  if (CMP_PORT(f->sp,p->sp)) {
300  return TOSERVER ^ reverse;
301  } else {
302  return TOCLIENT ^ reverse;
303  }
304  } else {
305  if (CMP_ADDR(&f->src,&p->src)) {
306  return TOSERVER ^ reverse;
307  } else {
308  return TOCLIENT ^ reverse;
309  }
310  }
311  } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
312  if (CMP_ADDR(&f->src,&p->src)) {
313  return TOSERVER ^ reverse;
314  } else {
315  return TOCLIENT ^ reverse;
316  }
317  }
318 
319  /* default to toserver */
320  return TOSERVER;
321 }
322 
323 /**
324  * \brief Check to update "seen" flags
325  *
326  * \param p packet
327  *
328  * \retval 1 true
329  * \retval 0 false
330  */
331 static inline int FlowUpdateSeenFlag(const Packet *p)
332 {
333  if (PKT_IS_ICMPV4(p)) {
334  if (ICMPV4_IS_ERROR_MSG(p)) {
335  return 0;
336  }
337  }
338 
339  return 1;
340 }
341 
342 static inline void FlowUpdateTTL(Flow *f, Packet *p, uint8_t ttl)
343 {
344  if (FlowGetPacketDirection(f, p) == TOSERVER) {
345  if (f->min_ttl_toserver == 0) {
346  f->min_ttl_toserver = ttl;
347  } else {
348  f->min_ttl_toserver = MIN(f->min_ttl_toserver, ttl);
349  }
350  f->max_ttl_toserver = MAX(f->max_ttl_toserver, ttl);
351  } else {
352  if (f->min_ttl_toclient == 0) {
353  f->min_ttl_toclient = ttl;
354  } else {
355  f->min_ttl_toclient = MIN(f->min_ttl_toclient, ttl);
356  }
357  f->max_ttl_toclient = MAX(f->max_ttl_toclient, ttl);
358  }
359 }
360 
361 static inline void FlowUpdateEthernet(ThreadVars *tv, DecodeThreadVars *dtv,
362  Flow *f, EthernetHdr *ethh, bool toserver)
363 {
364  if (ethh && MacSetFlowStorageEnabled()) {
366  if (ms != NULL) {
367  if (toserver) {
368  MacSetAddWithCtr(ms, ethh->eth_src, ethh->eth_dst, tv,
371  } else {
372  MacSetAddWithCtr(ms, ethh->eth_dst, ethh->eth_src, tv,
375  }
376  }
377  }
378 }
379 
380 /** \brief Update Packet and Flow
381  *
382  * Updates packet and flow based on the new packet.
383  *
384  * \param f locked flow
385  * \param p packet
386  *
387  * \note overwrites p::flowflags
388  */
390 {
391  SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f);
392 
393 #ifdef CAPTURE_OFFLOAD
394  int state = f->flow_state;
395 
396  if (state != FLOW_STATE_CAPTURE_BYPASSED) {
397 #endif
398  /* update the last seen timestamp of this flow */
399  if (timercmp(&p->ts, &f->lastts, >)) {
400  COPY_TIMESTAMP(&p->ts, &f->lastts);
401  const uint32_t timeout_at = (uint32_t)f->lastts.tv_sec + f->timeout_policy;
402  if (timeout_at != f->timeout_at) {
403  f->timeout_at = timeout_at;
404  }
405  }
406 #ifdef CAPTURE_OFFLOAD
407  } else {
408  /* still seeing packet, we downgrade to local bypass */
409  if (p->ts.tv_sec - f->lastts.tv_sec > FLOW_BYPASSED_TIMEOUT / 2) {
410  SCLogDebug("Downgrading flow to local bypass");
411  COPY_TIMESTAMP(&p->ts, &f->lastts);
413  } else {
414  /* In IPS mode the packet could come from the other interface so it would
415  * need to be bypassed */
416  if (EngineModeIsIPS()) {
417  BypassedFlowUpdate(f, p);
418  }
419  }
420  }
421 #endif
422  /* update flags and counters */
423  if (FlowGetPacketDirection(f, p) == TOSERVER) {
424  f->todstpktcnt++;
425  f->todstbytecnt += GET_PKT_LEN(p);
427  if (!(f->flags & FLOW_TO_DST_SEEN)) {
428  if (FlowUpdateSeenFlag(p)) {
429  f->flags |= FLOW_TO_DST_SEEN;
431  }
432  }
433  /* xfer proto detect ts flag to first packet in ts dir */
434  if (f->flags & FLOW_PROTO_DETECT_TS_DONE) {
437  }
438  FlowUpdateEthernet(tv, dtv, f, p->ethh, true);
439  } else {
440  f->tosrcpktcnt++;
441  f->tosrcbytecnt += GET_PKT_LEN(p);
443  if (!(f->flags & FLOW_TO_SRC_SEEN)) {
444  if (FlowUpdateSeenFlag(p)) {
445  f->flags |= FLOW_TO_SRC_SEEN;
447  }
448  }
449  /* xfer proto detect tc flag to first packet in tc dir */
450  if (f->flags & FLOW_PROTO_DETECT_TC_DONE) {
453  }
454  FlowUpdateEthernet(tv, dtv, f, p->ethh, false);
455  }
456 
458  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
460 
461  } else if (f->proto == IPPROTO_TCP) {
462  TcpSession *ssn = (TcpSession *)f->protoctx;
463  if (ssn != NULL && ssn->state >= TCP_ESTABLISHED) {
465  }
466  } else if ((f->flags & (FLOW_TO_DST_SEEN|FLOW_TO_SRC_SEEN)) ==
468  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
470 
472  }
473 
474  /*set the detection bypass flags*/
475  if (f->flags & FLOW_NOPACKET_INSPECTION) {
476  SCLogDebug("setting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
478  }
479  if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
480  SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
482  }
483 
484  /* update flow's ttl fields if needed */
485  if (PKT_IS_IPV4(p)) {
486  FlowUpdateTTL(f, p, IPV4_GET_IPTTL(p));
487  } else if (PKT_IS_IPV6(p)) {
488  FlowUpdateTTL(f, p, IPV6_GET_HLIM(p));
489  }
490 }
491 
492 /** \brief Entry point for packet flow handling
493  *
494  * This is called for every packet.
495  *
496  * \param tv threadvars
497  * \param dtv decode thread vars (for flow output api thread data)
498  * \param p packet to handle flow for
499  */
501 {
502  /* Get this packet's flow from the hash. FlowHandlePacket() will setup
503  * a new flow if nescesary. If we get NULL, we're out of flow memory.
504  * The returned flow is locked. */
505  Flow *f = FlowGetFlowFromHash(tv, fls, p, &p->flow);
506  if (f == NULL)
507  return;
508 
509  /* set the flow in the packet */
510  p->flags |= PKT_HAS_FLOW;
511  return;
512 }
513 
514 /** \brief initialize the configuration
515  * \warning Not thread safe */
516 void FlowInitConfig(char quiet)
517 {
518  SCLogDebug("initializing flow engine...");
519 
520  memset(&flow_config, 0, sizeof(flow_config));
521  SC_ATOMIC_INIT(flow_flags);
522  SC_ATOMIC_INIT(flow_memuse);
523  SC_ATOMIC_INIT(flow_prune_idx);
524  SC_ATOMIC_INIT(flow_config.memcap);
526 
527  /* set defaults */
528  flow_config.hash_rand = (uint32_t)RandomGet();
532 
533  /* If we have specific config, overwrite the defaults with them,
534  * otherwise, leave the default values */
535  intmax_t val = 0;
536  if (ConfGetInt("flow.emergency-recovery", &val) == 1) {
537  if (val <= 100 && val >= 1) {
538  flow_config.emergency_recovery = (uint8_t)val;
539  } else {
540  SCLogError(SC_ERR_INVALID_VALUE, "flow.emergency-recovery must be in the range of "
541  "1 and 100 (as percentage)");
543  }
544  } else {
545  SCLogDebug("flow.emergency-recovery, using default value");
547  }
548 
549  /* Check if we have memcap and hash_size defined at config */
550  const char *conf_val;
551  uint32_t configval = 0;
552 
553  /** set config values for memcap, prealloc and hash_size */
554  uint64_t flow_memcap_copy = 0;
555  if ((ConfGet("flow.memcap", &conf_val)) == 1)
556  {
557  if (conf_val == NULL) {
558  FatalError(SC_ERR_FATAL, "Invalid value for flow.memcap: NULL");
559  }
560 
561  if (ParseSizeStringU64(conf_val, &flow_memcap_copy) < 0) {
562  SCLogError(SC_ERR_SIZE_PARSE, "Error parsing flow.memcap "
563  "from conf file - %s. Killing engine",
564  conf_val);
565  exit(EXIT_FAILURE);
566  } else {
567  SC_ATOMIC_SET(flow_config.memcap, flow_memcap_copy);
568  }
569  }
570  if ((ConfGet("flow.hash-size", &conf_val)) == 1)
571  {
572  if (conf_val == NULL) {
573  FatalError(SC_ERR_FATAL, "Invalid value for flow.hash-size: NULL");
574  }
575 
576  if (StringParseUint32(&configval, 10, strlen(conf_val),
577  conf_val) > 0) {
578  flow_config.hash_size = configval;
579  }
580  }
581  if ((ConfGet("flow.prealloc", &conf_val)) == 1)
582  {
583  if (conf_val == NULL) {
584  FatalError(SC_ERR_FATAL, "Invalid value for flow.prealloc: NULL");
585  }
586 
587  if (StringParseUint32(&configval, 10, strlen(conf_val),
588  conf_val) > 0) {
589  flow_config.prealloc = configval;
590  }
591  }
592  SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: "
593  "%"PRIu32", prealloc: %"PRIu32, SC_ATOMIC_GET(flow_config.memcap),
595 
596  /* alloc hash memory */
597  uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket);
598  if (!(FLOW_CHECK_MEMCAP(hash_size))) {
599  SCLogError(SC_ERR_FLOW_INIT, "allocating flow hash failed: "
600  "max flow memcap is smaller than projected hash size. "
601  "Memcap: %"PRIu64", Hash table size %"PRIu64". Calculate "
602  "total hash size by multiplying \"flow.hash-size\" with %"PRIuMAX", "
603  "which is the hash bucket size.", SC_ATOMIC_GET(flow_config.memcap), hash_size,
604  (uintmax_t)sizeof(FlowBucket));
605  exit(EXIT_FAILURE);
606  }
607  flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS);
608  if (unlikely(flow_hash == NULL)) {
610  "Fatal error encountered in FlowInitConfig. Exiting...");
611  }
612  memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket));
613 
614  uint32_t i = 0;
615  for (i = 0; i < flow_config.hash_size; i++) {
616  FBLOCK_INIT(&flow_hash[i]);
617  SC_ATOMIC_INIT(flow_hash[i].next_ts);
618  }
619  (void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket)));
620 
621  if (quiet == FALSE) {
622  SCLogConfig("allocated %"PRIu64" bytes of memory for the flow hash... "
623  "%" PRIu32 " buckets of size %" PRIuMAX "",
624  SC_ATOMIC_GET(flow_memuse), flow_config.hash_size,
625  (uintmax_t)sizeof(FlowBucket));
626  }
628  if (quiet == FALSE) {
629  SCLogConfig("flow memory usage: %"PRIu64" bytes, maximum: %"PRIu64,
630  SC_ATOMIC_GET(flow_memuse), SC_ATOMIC_GET(flow_config.memcap));
631  }
632 
634 
635  uint32_t sz = sizeof(Flow) + FlowStorageSize();
636  SCLogConfig("flow size %u, memcap allows for %" PRIu64 " flows. Per hash row in perfect "
637  "conditions %" PRIu64,
638  sz, flow_memcap_copy / sz, (flow_memcap_copy / sz) / flow_config.hash_size);
639  return;
640 }
641 
642 /** \brief shutdown the flow engine
643  * \warning Not thread safe */
644 void FlowShutdown(void)
645 {
646  Flow *f;
647  while ((f = FlowDequeue(&flow_recycle_q))) {
648  FlowFree(f);
649  }
650 
651  /* clear and free the hash */
652  if (flow_hash != NULL) {
653  /* clean up flow mutexes */
654  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
655  f = flow_hash[u].head;
656  while (f) {
658  Flow *n = f->next;
659  uint8_t proto_map = FlowGetProtoMapping(f->proto);
660  FlowClearMemory(f, proto_map);
661  FlowFree(f);
662  f = n;
663  }
664  f = flow_hash[u].evicted;
665  while (f) {
667  Flow *n = f->next;
668  uint8_t proto_map = FlowGetProtoMapping(f->proto);
669  FlowClearMemory(f, proto_map);
670  FlowFree(f);
671  f = n;
672  }
673 
675  }
677  flow_hash = NULL;
678  }
679  (void) SC_ATOMIC_SUB(flow_memuse, flow_config.hash_size * sizeof(FlowBucket));
682  return;
683 }
684 
685 /**
686  * \brief Function to set the default timeout, free function and flow state
687  * function for all supported flow_proto.
688  */
689 
691 {
693 
694 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
695  flow_timeouts_normal[(p)].new_timeout = (n); \
696  flow_timeouts_normal[(p)].est_timeout = (e); \
697  flow_timeouts_normal[(p)].closed_timeout = (c); \
698  flow_timeouts_normal[(p)].bypassed_timeout = (b); \
699  flow_timeouts_emerg[(p)].new_timeout = (ne); \
700  flow_timeouts_emerg[(p)].est_timeout = (ee); \
701  flow_timeouts_emerg[(p)].closed_timeout = (ce); \
702  flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
703 
724 
729 
730  /* Let's see if we have custom timeouts defined from config */
731  const char *new = NULL;
732  const char *established = NULL;
733  const char *closed = NULL;
734  const char *bypassed = NULL;
735  const char *emergency_new = NULL;
736  const char *emergency_established = NULL;
737  const char *emergency_closed = NULL;
738  const char *emergency_bypassed = NULL;
739 
740  ConfNode *flow_timeouts = ConfGetNode("flow-timeouts");
741  if (flow_timeouts != NULL) {
742  ConfNode *proto = NULL;
743  uint32_t configval = 0;
744 
745  /* Defaults. */
746  proto = ConfNodeLookupChild(flow_timeouts, "default");
747  if (proto != NULL) {
748  new = ConfNodeLookupChildValue(proto, "new");
749  established = ConfNodeLookupChildValue(proto, "established");
750  closed = ConfNodeLookupChildValue(proto, "closed");
751  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
752  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
753  emergency_established = ConfNodeLookupChildValue(proto,
754  "emergency-established");
755  emergency_closed = ConfNodeLookupChildValue(proto,
756  "emergency-closed");
757  emergency_bypassed = ConfNodeLookupChildValue(proto,
758  "emergency-bypassed");
759 
760  if (new != NULL &&
761  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
762 
764  }
765  if (established != NULL &&
766  StringParseUint32(&configval, 10, strlen(established),
767  established) > 0) {
768 
770  }
771  if (closed != NULL &&
772  StringParseUint32(&configval, 10, strlen(closed),
773  closed) > 0) {
774 
776  }
777  if (bypassed != NULL &&
778  StringParseUint32(&configval, 10,
779  strlen(bypassed),
780  bypassed) > 0) {
781 
783  }
784  if (emergency_new != NULL &&
785  StringParseUint32(&configval, 10, strlen(emergency_new),
786  emergency_new) > 0) {
787 
789  }
790  if (emergency_established != NULL &&
791  StringParseUint32(&configval, 10,
792  strlen(emergency_established),
793  emergency_established) > 0) {
794 
796  }
797  if (emergency_closed != NULL &&
798  StringParseUint32(&configval, 10,
799  strlen(emergency_closed),
800  emergency_closed) > 0) {
801 
803  }
804  if (emergency_bypassed != NULL &&
805  StringParseUint32(&configval, 10,
806  strlen(emergency_bypassed),
807  emergency_bypassed) > 0) {
808 
810  }
811  }
812 
813  /* TCP. */
814  proto = ConfNodeLookupChild(flow_timeouts, "tcp");
815  if (proto != NULL) {
816  new = ConfNodeLookupChildValue(proto, "new");
817  established = ConfNodeLookupChildValue(proto, "established");
818  closed = ConfNodeLookupChildValue(proto, "closed");
819  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
820  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
821  emergency_established = ConfNodeLookupChildValue(proto,
822  "emergency-established");
823  emergency_closed = ConfNodeLookupChildValue(proto,
824  "emergency-closed");
825  emergency_bypassed = ConfNodeLookupChildValue(proto,
826  "emergency-bypassed");
827 
828  if (new != NULL &&
829  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
830 
832  }
833  if (established != NULL &&
834  StringParseUint32(&configval, 10, strlen(established),
835  established) > 0) {
836 
838  }
839  if (closed != NULL &&
840  StringParseUint32(&configval, 10, strlen(closed),
841  closed) > 0) {
842 
844  }
845  if (bypassed != NULL &&
846  StringParseUint32(&configval, 10,
847  strlen(bypassed),
848  bypassed) > 0) {
849 
851  }
852  if (emergency_new != NULL &&
853  StringParseUint32(&configval, 10, strlen(emergency_new),
854  emergency_new) > 0) {
855 
857  }
858  if (emergency_established != NULL &&
859  StringParseUint32(&configval, 10,
860  strlen(emergency_established),
861  emergency_established) > 0) {
862 
864  }
865  if (emergency_closed != NULL &&
866  StringParseUint32(&configval, 10,
867  strlen(emergency_closed),
868  emergency_closed) > 0) {
869 
871  }
872  if (emergency_bypassed != NULL &&
873  StringParseUint32(&configval, 10,
874  strlen(emergency_bypassed),
875  emergency_bypassed) > 0) {
876 
878  }
879  }
880 
881  /* UDP. */
882  proto = ConfNodeLookupChild(flow_timeouts, "udp");
883  if (proto != NULL) {
884  new = ConfNodeLookupChildValue(proto, "new");
885  established = ConfNodeLookupChildValue(proto, "established");
886  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
887  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
888  emergency_established = ConfNodeLookupChildValue(proto,
889  "emergency-established");
890  emergency_bypassed = ConfNodeLookupChildValue(proto,
891  "emergency-bypassed");
892 
893  if (new != NULL &&
894  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
895 
897  }
898  if (established != NULL &&
899  StringParseUint32(&configval, 10, strlen(established),
900  established) > 0) {
901 
903  }
904  if (bypassed != NULL &&
905  StringParseUint32(&configval, 10,
906  strlen(bypassed),
907  bypassed) > 0) {
908 
910  }
911  if (emergency_new != NULL &&
912  StringParseUint32(&configval, 10, strlen(emergency_new),
913  emergency_new) > 0) {
914 
916  }
917  if (emergency_established != NULL &&
918  StringParseUint32(&configval, 10,
919  strlen(emergency_established),
920  emergency_established) > 0) {
921 
923  }
924  if (emergency_bypassed != NULL &&
925  StringParseUint32(&configval, 10,
926  strlen(emergency_bypassed),
927  emergency_bypassed) > 0) {
928 
930  }
931  }
932 
933  /* ICMP. */
934  proto = ConfNodeLookupChild(flow_timeouts, "icmp");
935  if (proto != NULL) {
936  new = ConfNodeLookupChildValue(proto, "new");
937  established = ConfNodeLookupChildValue(proto, "established");
938  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
939  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
940  emergency_established = ConfNodeLookupChildValue(proto,
941  "emergency-established");
942  emergency_bypassed = ConfNodeLookupChildValue(proto,
943  "emergency-bypassed");
944 
945  if (new != NULL &&
946  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
947 
949  }
950  if (established != NULL &&
951  StringParseUint32(&configval, 10, strlen(established),
952  established) > 0) {
953 
955  }
956  if (bypassed != NULL &&
957  StringParseUint32(&configval, 10,
958  strlen(bypassed),
959  bypassed) > 0) {
960 
962  }
963  if (emergency_new != NULL &&
964  StringParseUint32(&configval, 10, strlen(emergency_new),
965  emergency_new) > 0) {
966 
968  }
969  if (emergency_established != NULL &&
970  StringParseUint32(&configval, 10,
971  strlen(emergency_established),
972  emergency_established) > 0) {
973 
975  }
976  if (emergency_bypassed != NULL &&
977  StringParseUint32(&configval, 10,
978  strlen(emergency_bypassed),
979  emergency_bypassed) > 0) {
980 
982  }
983  }
984  }
985 
986  /* validate and if needed update emergency timeout values */
987  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
988  const FlowProtoTimeout *n = &flow_timeouts_normal[i];
990 
991  if (e->est_timeout > n->est_timeout) {
992  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'established\' "
993  "must be below regular value %u", e->est_timeout, n->est_timeout);
994  e->est_timeout = n->est_timeout / 10;
995  }
996 
997  if (e->new_timeout > n->new_timeout) {
998  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'new\' must be "
999  "below regular value %u", e->new_timeout, n->new_timeout);
1000  e->new_timeout = n->new_timeout / 10;
1001  }
1002 
1003  if (e->closed_timeout > n->closed_timeout) {
1004  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'closed\' must "
1005  "be below regular value %u", e->closed_timeout, n->closed_timeout);
1006  e->closed_timeout = n->closed_timeout / 10;
1007  }
1008 
1009  if (e->bypassed_timeout > n->bypassed_timeout) {
1010  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'bypassed\' "
1011  "must be below regular value %u", e->bypassed_timeout, n->bypassed_timeout);
1012  e->bypassed_timeout = n->bypassed_timeout / 10;
1013  }
1014  }
1015 
1016  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
1020 
1021  if (e->est_timeout > n->est_timeout) {
1022  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'established\' must be below normal value");
1023  e->est_timeout = n->est_timeout / 10;
1024  }
1025  d->est_timeout = n->est_timeout - e->est_timeout;
1026 
1027  if (e->new_timeout > n->new_timeout) {
1028  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'new\' must be below normal value");
1029  e->new_timeout = n->new_timeout / 10;
1030  }
1031  d->new_timeout = n->new_timeout - e->new_timeout;
1032 
1033  if (e->closed_timeout > n->closed_timeout) {
1034  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'closed\' must be below normal value");
1035  e->closed_timeout = n->closed_timeout / 10;
1036  }
1038 
1039  if (e->bypassed_timeout > n->bypassed_timeout) {
1040  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'bypassed\' must be below normal value");
1041  e->bypassed_timeout = n->bypassed_timeout / 10;
1042  }
1044 
1045  SCLogDebug("deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1047  }
1048 
1049  return;
1050 }
1051 
1052 /**
1053  * \brief Function clear the flow memory before queueing it to spare flow
1054  * queue.
1055  *
1056  * \param f pointer to the flow needed to be cleared.
1057  * \param proto_map mapped value of the protocol to FLOW_PROTO's.
1058  */
1059 
1060 int FlowClearMemory(Flow* f, uint8_t proto_map)
1061 {
1062  SCEnter();
1063 
1064  if (unlikely(f->flags & FLOW_HAS_EXPECTATION)) {
1066  }
1067 
1068  /* call the protocol specific free function if we have one */
1069  if (flow_freefuncs[proto_map].Freefunc != NULL) {
1070  flow_freefuncs[proto_map].Freefunc(f->protoctx);
1071  }
1072 
1073  FlowFreeStorage(f);
1074 
1075  FLOW_RECYCLE(f);
1076 
1077  SCReturnInt(1);
1078 }
1079 
1080 /**
1081  * \brief Function to set the function to get protocol specific flow state.
1082  *
1083  * \param proto protocol of which function is needed to be set.
1084  * \param Free Function pointer which will be called to free the protocol
1085  * specific memory.
1086  */
1087 
1088 int FlowSetProtoFreeFunc (uint8_t proto, void (*Free)(void *))
1089 {
1090  uint8_t proto_map;
1091  proto_map = FlowGetProtoMapping(proto);
1092 
1093  flow_freefuncs[proto_map].Freefunc = Free;
1094  return 1;
1095 }
1096 
1098 {
1099  return f->alproto;
1100 }
1101 
1102 void *FlowGetAppState(const Flow *f)
1103 {
1104  return f->alstate;
1105 }
1106 
1107 /**
1108  * \brief get 'disruption' flags: GAP/DEPTH/PASS
1109  * \param f locked flow
1110  * \param flags existing flags to be ammended
1111  * \retval flags original flags + disrupt flags (if any)
1112  * \TODO handle UDP
1113  */
1114 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
1115 {
1116  if (f->proto != IPPROTO_TCP) {
1117  return flags;
1118  }
1119  if (f->protoctx == NULL) {
1120  return flags;
1121  }
1122 
1123  uint8_t newflags = flags;
1124  TcpSession *ssn = f->protoctx;
1125  TcpStream *stream = flags & STREAM_TOSERVER ? &ssn->client : &ssn->server;
1126 
1128  newflags |= STREAM_DEPTH;
1129  }
1130  if (stream->flags & STREAMTCP_STREAM_FLAG_GAP) {
1131  newflags |= STREAM_GAP;
1132  }
1133  /* todo: handle pass case (also for UDP!) */
1134 
1135  return newflags;
1136 }
1137 
1138 void FlowUpdateState(Flow *f, const enum FlowState s)
1139 {
1140  if (s != f->flow_state) {
1141  /* set the state */
1142  f->flow_state = s;
1143 
1144  /* update timeout policy and value */
1145  const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1146  if (timeout_policy != f->timeout_policy) {
1147  f->timeout_policy = timeout_policy;
1148  const uint32_t timeout_at = (uint32_t)f->lastts.tv_sec + timeout_policy;
1149  if (timeout_at != f->timeout_at)
1150  f->timeout_at = timeout_at;
1151  }
1152  }
1153 #ifdef UNITTESTS
1154  if (f->fb != NULL) {
1155 #endif
1156  /* and reset the flow buckup next_ts value so that the flow manager
1157  * has to revisit this row */
1158  SC_ATOMIC_SET(f->fb->next_ts, 0);
1159 #ifdef UNITTESTS
1160  }
1161 #endif
1162 }
1163 
1164 /**
1165  * \brief Get flow last time as individual values.
1166  *
1167  * Instead of returning a pointer to the timeval copy the timeval
1168  * parts into output pointers to make it simpler to call from Rust
1169  * over FFI using only basic data types.
1170  */
1171 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
1172 {
1173  *secs = (uint64_t)flow->lastts.tv_sec;
1174  *usecs = (uint64_t)flow->lastts.tv_usec;
1175 }
1176 
1177 /************************************Unittests*******************************/
1178 
1179 #ifdef UNITTESTS
1180 #include "threads.h"
1181 
1182 /**
1183  * \test Test the setting of the per protocol timeouts.
1184  *
1185  * \retval On success it returns 1 and on failure 0.
1186  */
1187 
1188 static int FlowTest01 (void)
1189 {
1190  uint8_t proto_map;
1191 
1193  proto_map = FlowGetProtoMapping(IPPROTO_TCP);
1194  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_TCP_NEW_TIMEOUT);
1195  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_TCP_EST_TIMEOUT);
1198 
1199  proto_map = FlowGetProtoMapping(IPPROTO_UDP);
1200  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_UDP_NEW_TIMEOUT);
1201  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_UDP_EST_TIMEOUT);
1204 
1205  proto_map = FlowGetProtoMapping(IPPROTO_ICMP);
1206  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_ICMP_NEW_TIMEOUT);
1207  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_ICMP_EST_TIMEOUT);
1210 
1211  proto_map = FlowGetProtoMapping(IPPROTO_DCCP);
1212  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_DEFAULT_NEW_TIMEOUT);
1213  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_DEFAULT_EST_TIMEOUT);
1214  FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_DEFAULT_EMERG_NEW_TIMEOUT);
1215  FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_DEFAULT_EMERG_EST_TIMEOUT);
1216 
1217  PASS;
1218 }
1219 
1220 /*Test function for the unit test FlowTest02*/
1221 
1222 static void test(void *f) {}
1223 
1224 /**
1225  * \test Test the setting of the per protocol free function to free the
1226  * protocol specific memory.
1227  *
1228  * \retval On success it returns 1 and on failure 0.
1229  */
1230 
1231 static int FlowTest02 (void)
1232 {
1233  FlowSetProtoFreeFunc(IPPROTO_DCCP, test);
1234  FlowSetProtoFreeFunc(IPPROTO_TCP, test);
1235  FlowSetProtoFreeFunc(IPPROTO_UDP, test);
1236  FlowSetProtoFreeFunc(IPPROTO_ICMP, test);
1237 
1238  FAIL_IF(flow_freefuncs[FLOW_PROTO_DEFAULT].Freefunc != test);
1239  FAIL_IF(flow_freefuncs[FLOW_PROTO_TCP].Freefunc != test);
1240  FAIL_IF(flow_freefuncs[FLOW_PROTO_UDP].Freefunc != test);
1241  FAIL_IF(flow_freefuncs[FLOW_PROTO_ICMP].Freefunc != test);
1242 
1243  PASS;
1244 }
1245 
1246 /**
1247  * \test Test flow allocations when it reach memcap
1248  *
1249  *
1250  * \retval On success it returns 1 and on failure 0.
1251  */
1252 
1253 static int FlowTest07 (void)
1254 {
1255  int result = 0;
1257  FlowConfig backup;
1258  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1259 
1260  uint32_t ini = 0;
1261  uint32_t end = FlowSpareGetPoolSize();
1262  SC_ATOMIC_SET(flow_config.memcap, 10000);
1263  flow_config.prealloc = 100;
1264 
1265  /* Let's get the flow spare pool empty */
1266  UTHBuildPacketOfFlows(ini, end, 0);
1267 
1268  /* And now let's try to reach the memcap val */
1269  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1270  ini = end + 1;
1271  end = end + 2;
1272  UTHBuildPacketOfFlows(ini, end, 0);
1273  }
1274 
1275  /* should time out normal */
1276  TimeSetIncrementTime(2000);
1277  ini = end + 1;
1278  end = end + 2;
1279  UTHBuildPacketOfFlows(ini, end, 0);
1280 
1281  /* This means that the engine entered emerg mode: should happen as easy
1282  * with flow mgr activated */
1283  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1284  result = 1;
1285 
1286  FlowShutdown();
1287  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1288 
1289  return result;
1290 }
1291 
1292 /**
1293  * \test Test flow allocations when it reach memcap
1294  *
1295  *
1296  * \retval On success it returns 1 and on failure 0.
1297  */
1298 
1299 static int FlowTest08 (void)
1300 {
1301  int result = 0;
1302 
1304  FlowConfig backup;
1305  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1306 
1307  uint32_t ini = 0;
1308  uint32_t end = FlowSpareGetPoolSize();
1309  SC_ATOMIC_SET(flow_config.memcap, 10000);
1310  flow_config.prealloc = 100;
1311 
1312  /* Let's get the flow spare pool empty */
1313  UTHBuildPacketOfFlows(ini, end, 0);
1314 
1315  /* And now let's try to reach the memcap val */
1316  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1317  ini = end + 1;
1318  end = end + 2;
1319  UTHBuildPacketOfFlows(ini, end, 0);
1320  }
1321 
1322  /* By default we use 30 for timing out new flows. This means
1323  * that the Emergency mode should be set */
1325  ini = end + 1;
1326  end = end + 2;
1327  UTHBuildPacketOfFlows(ini, end, 0);
1328 
1329  /* This means that the engine released 5 flows by emergency timeout */
1330  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1331  result = 1;
1332 
1333  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1334  FlowShutdown();
1335 
1336  return result;
1337 }
1338 
1339 /**
1340  * \test Test flow allocations when it reach memcap
1341  *
1342  *
1343  * \retval On success it returns 1 and on failure 0.
1344  */
1345 
1346 static int FlowTest09 (void)
1347 {
1348  int result = 0;
1349 
1351  FlowConfig backup;
1352  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1353 
1354  uint32_t ini = 0;
1355  uint32_t end = FlowSpareGetPoolSize();
1356  SC_ATOMIC_SET(flow_config.memcap, 10000);
1357  flow_config.prealloc = 100;
1358 
1359  /* Let's get the flow spare pool empty */
1360  UTHBuildPacketOfFlows(ini, end, 0);
1361 
1362  /* And now let's try to reach the memcap val */
1363  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1364  ini = end + 1;
1365  end = end + 2;
1366  UTHBuildPacketOfFlows(ini, end, 0);
1367  }
1368 
1369  /* No timeout will work */
1371  ini = end + 1;
1372  end = end + 2;
1373  UTHBuildPacketOfFlows(ini, end, 0);
1374 
1375  /* engine in emerg mode */
1376  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1377  result = 1;
1378 
1379  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1380  FlowShutdown();
1381 
1382  return result;
1383 }
1384 
1385 #endif /* UNITTESTS */
1386 
1387 /**
1388  * \brief Function to register the Flow Unitests.
1389  */
1391 {
1392 #ifdef UNITTESTS
1393  UtRegisterTest("FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1394  UtRegisterTest("FlowTest02 -- Setting Protocol Specific Free Function",
1395  FlowTest02);
1396  UtRegisterTest("FlowTest07 -- Test flow Allocations when it reach memcap",
1397  FlowTest07);
1398  UtRegisterTest("FlowTest08 -- Test flow Allocations when it reach memcap",
1399  FlowTest08);
1400  UtRegisterTest("FlowTest09 -- Test flow Allocations when it reach memcap",
1401  FlowTest09);
1402 
1404 #endif /* UNITTESTS */
1405 }
util-byte.h
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:202
FBLOCK_DESTROY
#define FBLOCK_DESTROY(fb)
Definition: flow-hash.h:70
FLOW_DEFAULT_NEW_TIMEOUT
#define FLOW_DEFAULT_NEW_TIMEOUT
Definition: flow-private.h:40
tm-threads.h
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:436
Packet_::proto
uint8_t proto
Definition: decode.h:436
DecodeSetNoPacketInspectionFlag
#define DecodeSetNoPacketInspectionFlag(p)
Set the No packet inspection Flag for the packet.
Definition: decode.h:995
FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
Definition: flow-private.h:58
TcpStream_
Definition: stream-tcp-private.h:94
flow-bypass.h
FLOW_HAS_EXPECTATION
#define FLOW_HAS_EXPECTATION
Definition: flow.h:109
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
Definition: flow.c:169
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:142
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
Definition: flow.c:193
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:73
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1109
SC_ERR_INVALID_VALUE
@ SC_ERR_INVALID_VALUE
Definition: util-error.h:160
FlowSpareGetPoolSize
uint32_t FlowSpareGetPoolSize(void)
Definition: flow-spare-pool.c:48
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:292
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:500
flow-util.h
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:315
FBLOCK_INIT
#define FBLOCK_INIT(fb)
Definition: flow-hash.h:69
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:258
CLS
#define CLS
Definition: suricata-common.h:45
stream-tcp.h
MacSetAddWithCtr
void MacSetAddWithCtr(MacSet *ms, uint8_t *src_addr, uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
Definition: util-macset.c:179
FLOW_DEFAULT_HASHSIZE
#define FLOW_DEFAULT_HASHSIZE
Definition: flow.c:72
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:294
FLOW_DEFAULT_PREALLOC
#define FLOW_DEFAULT_PREALLOC
Definition: flow.c:76
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:285
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1390
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:62
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:70
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:570
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:202
MacSetGetFlowStorageID
int MacSetGetFlowStorageID(void)
Definition: util-macset.c:113
Flow_::proto
uint8_t proto
Definition: flow.h:365
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:73
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:116
Packet_::flags
uint32_t flags
Definition: decode.h:449
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:175
threads.h
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:347
run_mode
int run_mode
Definition: suricata.c:201
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
FlowInitConfig
void FlowInitConfig(char quiet)
initialize the configuration
Definition: flow.c:516
FlowProtoTimeout_
Definition: flow.h:508
flow-hash.h
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:62
FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
Definition: flow.h:81
FlowLookupStruct_
Definition: flow.h:532
FLOW_DEFAULT_EMERG_NEW_TIMEOUT
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
Definition: flow-private.h:55
Flow
struct Flow_ Flow
Flow data structure.
FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:59
BypassedFlowUpdate
void BypassedFlowUpdate(Flow *f, Packet *p)
Definition: flow-bypass.c:203
Flow_::use_cnt
FlowRefCount use_cnt
Definition: flow.h:373
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:512
FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_DEFAULT_EST_TIMEOUT
Definition: flow-private.h:41
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:219
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:143
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:136
MIN
#define MIN(x, y)
Definition: suricata-common.h:377
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:130
FlowQueueDestroy
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
Definition: flow-queue.c:61
util-privs.h
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:500
stream-tcp-reassemble.h
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:95
RandomGet
long int RandomGet(void)
Definition: util-random.c:129
FLOW_TOSERVER_DROP_LOGGED
#define FLOW_TOSERVER_DROP_LOGGED
Definition: flow.h:73
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:468
proto
uint8_t proto
Definition: decode-template.h:0
FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
Definition: flow.h:91
FLOW_DEFAULT_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
Definition: flow-private.h:43
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:445
MAX
#define MAX(x, y)
Definition: suricata-common.h:381
Flow_::protoctx
void * protoctx
Definition: flow.h:441
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:640
FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
Definition: flow-private.h:50
STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
Definition: stream-tcp-private.h:205
util-unittest.h
FLOW_BYPASSED_TIMEOUT
#define FLOW_BYPASSED_TIMEOUT
Definition: flow-private.h:67
FlowGetAppState
void * FlowGetAppState(const Flow *f)
Definition: flow.c:1102
util-unittest-helper.h
FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
Definition: flow-private.h:61
FLOW_IPPROTO_ICMP_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
Definition: flow-private.h:52
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:287
UTHBuildPacketOfFlows
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
Definition: util-unittest-helper.c:931
AppLayerExpectationClean
void AppLayerExpectationClean(Flow *f)
Definition: app-layer-expectation.c:359
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:412
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1133
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:483
FLOW_CHECK_MEMCAP
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
Definition: flow-util.h:144
FLOW_PROTO_ICMP
@ FLOW_PROTO_ICMP
Definition: flow-private.h:72
FLOW_RECYCLE
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
Definition: flow-util.h:83
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:495
flow-spare-pool.h
SC_ERR_SIZE_PARSE
@ SC_ERR_SIZE_PARSE
Definition: util-error.h:230
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:330
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:475
FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
Definition: flow-private.h:65
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:488
app-layer-expectation.h
FLOW_IPPROTO_UDP_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
Definition: flow-private.h:49
SC_ERR_FLOW_INIT
@ SC_ERR_FLOW_INIT
Definition: util-error.h:237
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:502
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:467
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:76
decode.h
util-debug.h
TOSERVER
#define TOSERVER
Definition: flow.h:42
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:492
DecodeSetNoPayloadInspectionFlag
#define DecodeSetNoPayloadInspectionFlag(p)
Set the No payload inspection Flag for the packet.
Definition: decode.h:983
FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
Definition: flow-private.h:46
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:389
STREAM_TOSERVER
#define STREAM_TOSERVER
Definition: stream.h:31
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
FLOW_CHANGE_PROTO
#define FLOW_CHANGE_PROTO
Definition: flow.h:103
Packet_::ethh
EthernetHdr * ethh
Definition: decode.h:502
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
FlowStorageSize
unsigned int FlowStorageSize(void)
Definition: flow-storage.c:34
Packet_::sp
Port sp
Definition: decode.h:421
FlowCnf_
Definition: flow.h:283
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:225
FlowQueueInit
FlowQueue * FlowQueueInit(FlowQueue *q)
Definition: flow-queue.c:47
FlowState
FlowState
Definition: flow.h:498
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:263
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:509
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:511
util-time.h
app-layer-parser.h
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1469
FLOW_PROTO_DETECT_TC_DONE
#define FLOW_PROTO_DETECT_TC_DONE
Definition: flow.h:100
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:494
FLOW_TC_PP_ALPROTO_DETECT_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
Definition: flow.h:89
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:480
MacSetFlowStorageEnabled
bool MacSetFlowStorageEnabled(void)
Definition: util-macset.c:84
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:342
FALSE
#define FALSE
Definition: suricata-common.h:34
stream.h
TimeSetIncrementTime
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
Definition: util-time.c:182
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:95
Packet_
Definition: decode.h:414
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
STREAM_DEPTH
#define STREAM_DEPTH
Definition: stream.h:34
FLOW_DEFAULT_MEMCAP
#define FLOW_DEFAULT_MEMCAP
Definition: flow.c:74
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:230
stream-tcp-private.h
MacSet_
Definition: util-macset.c:44
conf.h
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:158
FLOW_TOSERVER_IPONLY_SET
#define FLOW_TOSERVER_IPONLY_SET
Definition: flow.h:55
FLOW_IPPROTO_TCP_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
Definition: flow-private.h:44
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:516
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1060
flow_timeouts_delta
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Definition: flow.c:95
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:284
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
STREAM_GAP
#define STREAM_GAP
Definition: stream.h:33
flow-timeout.h
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:469
flow-queue.h
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:419
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:220
runmodes.h
FlowGetFlowFromHash
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, const Packet *p, Flow **dest)
Get Flow for packet.
Definition: flow-hash.c:729
FLOW_TO_DST_SEEN
#define FLOW_TO_DST_SEEN
Definition: flow.h:50
FlowUpdateState
void FlowUpdateState(Flow *f, const enum FlowState s)
Definition: flow.c:1138
Flow_::src
FlowAddress src
Definition: flow.h:350
Flow_::next
struct Flow_ * next
Definition: flow.h:394
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:418
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
Flow_::lastts
struct timeval lastts
Definition: flow.h:404
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:814
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:70
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:56
FlowDequeue
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
Definition: flow-queue.c:192
FLOW_TO_SRC_SEEN
#define FLOW_TO_SRC_SEEN
Definition: flow.h:48
StringParseUint32
int StringParseUint32(uint32_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:313
flow-storage.h
FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
Definition: flow.h:85
Packet_::flow
struct Flow_ * flow
Definition: decode.h:451
FLOW_IPPROTO_UDP_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
Definition: flow-private.h:48
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1088
FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
Definition: flow-private.h:51
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:93
CMP_ADDR
#define CMP_ADDR(a1, a2)
Definition: decode.h:245
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:117
flags
uint8_t flags
Definition: decode-gre.h:0
FLOW_TOCLIENT_IPONLY_SET
#define FLOW_TOCLIENT_IPONLY_SET
Definition: flow.h:57
Packet_::ts
struct timeval ts
Definition: decode.h:457
flow-manager.h
suricata-common.h
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:80
flow_config
FlowConfig flow_config
Definition: flow.c:98
FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
Definition: flow-private.h:47
FLOW_HAS_ALERTS
#define FLOW_HAS_ALERTS
Definition: flow.h:78
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:644
FlowSparePoolDestroy
void FlowSparePoolDestroy(void)
Definition: flow-spare-pool.c:264
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
SWAP_VARS
#define SWAP_VARS(type, a, b)
Definition: suricata-common.h:412
FlowTimeoutsInit
void FlowTimeoutsInit(void)
Definition: flow-manager.c:91
STREAM_TOCLIENT
#define STREAM_TOCLIENT
Definition: stream.h:32
FLOW_PROTO_DETECT_TS_DONE
#define FLOW_PROTO_DETECT_TS_DONE
Definition: flow.h:99
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:470
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:273
FLOW_TS_PP_ALPROTO_DETECT_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
Definition: flow.h:83
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1134
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1171
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:410
FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
Definition: flow-private.h:60
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
PKT_IS_ICMPV4
#define PKT_IS_ICMPV4(p)
Definition: decode.h:261
threadvars.h
util-validate.h
FlowSwap
void FlowSwap(Flow *f)
swap the flow's direction
Definition: flow.c:261
FlowGetAppProtocol
AppProto FlowGetAppProtocol(const Flow *f)
Definition: flow.c:1097
ICMPV4_IS_ERROR_MSG
#define ICMPV4_IS_ERROR_MSG(p)
Definition: decode-icmpv4.h:264
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FlowInitFlowProto
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
Definition: flow.c:690
SC_WARN_FLOW_EMERGENCY
@ SC_WARN_FLOW_EMERGENCY
Definition: util-error.h:192
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:272
flow_recycle_q
FlowQueue flow_recycle_q
Definition: flow-manager.c:77
SWAP_FLAGS
#define SWAP_FLAGS(flags, a, b)
Definition: suricata-common.h:401
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:68
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
CMP_PORT
#define CMP_PORT(p1, p2)
Definition: decode.h:250
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:631
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:451
ConfNode_
Definition: conf.h:32
Flow_::alstate
void * alstate
Definition: flow.h:476
flow_freefuncs
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
Definition: flow.c:96
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
flow_timeouts_emerg
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow.c:94
Flow_::flags
uint32_t flags
Definition: flow.h:421
FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
Definition: flow-private.h:63
FlowFreeStorage
void FlowFreeStorage(Flow *f)
Definition: flow-storage.c:59
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:641
FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:64
FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_TOCLIENT_DROP_LOGGED
Definition: flow.h:75
util-random.h
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:221
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
FlowGetStorageById
void * FlowGetStorageById(Flow *f, int id)
Definition: flow-storage.c:39
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:244
FLOW_EMERGENCY
#define FLOW_EMERGENCY
Definition: flow-private.h:37
suricata.h
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:39
FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
Definition: flow.h:87
FLOW_DEFAULT_EMERGENCY_RECOVERY
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
Definition: flow.c:69
FlowHasAlerts
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:180
FlowSparePoolInit
void FlowSparePoolInit(void)
Definition: flow-spare-pool.c:245
COPY_TIMESTAMP
#define COPY_TIMESTAMP(src, dst)
Definition: flow-util.h:30
STREAMTCP_STREAM_FLAG_GAP
#define STREAMTCP_STREAM_FLAG_GAP
Definition: stream-tcp-private.h:199
FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
Definition: flow-private.h:56
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:60
FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
Definition: flow-private.h:53
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:510
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:212
Flow_::sp
Port sp
Definition: flow.h:352
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1114
TcpSession_
Definition: stream-tcp-private.h:261
util-misc.h
TcpSession_::data_first_seen_dir
int8_t data_first_seen_dir
Definition: stream-tcp-private.h:266
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:71
flow.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:452
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:423
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
Packet_::dp
Port dp
Definition: decode.h:429
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:107
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:389
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
FLOW_IPPROTO_TCP_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
Definition: flow-private.h:45
RegisterFlowStorageTests
void RegisterFlowStorageTests(void)
Definition: flow-storage.c:289
SET_DEFAULTS
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
flow-var.h
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:257
TOCLIENT
#define TOCLIENT
Definition: flow.h:43
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:224
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
Packet_::src
Address src
Definition: decode.h:418
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:493
IPV4_GET_IPTTL
#define IPV4_GET_IPTTL(p)
Definition: decode-ipv4.h:146
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:115
FlowProtoFreeFunc_
Definition: flow.h:515
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:842