suricata
flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow implementation.
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 #include "decode.h"
29 #include "conf.h"
30 #include "threadvars.h"
31 #include "tm-threads.h"
32 #include "runmodes.h"
33 
34 #include "util-random.h"
35 #include "util-time.h"
36 
37 #include "flow.h"
38 #include "flow-queue.h"
39 #include "flow-hash.h"
40 #include "flow-util.h"
41 #include "flow-var.h"
42 #include "flow-private.h"
43 #include "flow-timeout.h"
44 #include "flow-manager.h"
45 #include "flow-storage.h"
46 #include "flow-bypass.h"
47 #include "flow-spare-pool.h"
48 
49 #include "stream-tcp-private.h"
50 #include "stream-tcp-reassemble.h"
51 #include "stream-tcp.h"
52 
53 #include "util-unittest.h"
54 #include "util-unittest-helper.h"
55 #include "util-byte.h"
56 #include "util-misc.h"
57 #include "util-macset.h"
58 
59 #include "util-debug.h"
60 #include "util-privs.h"
61 #include "util-validate.h"
62 
63 #include "detect.h"
64 #include "detect-engine-state.h"
65 #include "stream.h"
66 
67 #include "app-layer-parser.h"
68 #include "app-layer-expectation.h"
69 
70 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
71 
72 //#define FLOW_DEFAULT_HASHSIZE 262144
73 #define FLOW_DEFAULT_HASHSIZE 65536
74 //#define FLOW_DEFAULT_MEMCAP 128 * 1024 * 1024 /* 128 MB */
75 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32 MB */
76 
77 #define FLOW_DEFAULT_PREALLOC 10000
78 
80 
81 /** atomic int that is used when freeing a flow from the hash. In this
82  * case we walk the hash to find a flow to free. This var records where
83  * we left off in the hash. Without this only the top rows of the hash
84  * are freed. This isn't just about fairness. Under severe presure, the
85  * hash rows on top would be all freed and the time to find a flow to
86  * free increased with every run. */
87 SC_ATOMIC_DECLARE(unsigned int, flow_prune_idx);
88 
89 /** atomic flags */
90 SC_ATOMIC_DECLARE(unsigned int, flow_flags);
91 
92 /** FlowProto specific timeouts and free/state functions */
93 
98 
100 
101 /** flow memuse counter (atomic), for enforcing memcap limit */
102 SC_ATOMIC_DECLARE(uint64_t, flow_memuse);
103 
104 void FlowRegisterTests(void);
105 void FlowInitFlowProto(void);
106 int FlowSetProtoFreeFunc(uint8_t, void (*Free)(void *));
107 
108 /* Run mode selected at suricata.c */
109 extern int run_mode;
110 
111 /**
112  * \brief Update memcap value
113  *
114  * \param size new memcap value
115  */
116 int FlowSetMemcap(uint64_t size)
117 {
118  if ((uint64_t)SC_ATOMIC_GET(flow_memuse) < size) {
119  SC_ATOMIC_SET(flow_config.memcap, size);
120  return 1;
121  }
122 
123  return 0;
124 }
125 
126 /**
127  * \brief Return memcap value
128  *
129  * \retval memcap value
130  */
131 uint64_t FlowGetMemcap(void)
132 {
133  uint64_t memcapcopy = SC_ATOMIC_GET(flow_config.memcap);
134  return memcapcopy;
135 }
136 
137 uint64_t FlowGetMemuse(void)
138 {
139  uint64_t memusecopy = SC_ATOMIC_GET(flow_memuse);
140  return memusecopy;
141 }
142 
144 {
145  if (f == NULL || f->proto == 0)
146  return;
147 
149  f->alstate = NULL;
150  f->alparser = NULL;
151  return;
152 }
153 
154 /** \brief Set the IPOnly scanned flag for 'direction'.
155  *
156  * \param f Flow to set the flag in
157  * \param direction direction to set the flag in
158  */
159 void FlowSetIPOnlyFlag(Flow *f, int direction)
160 {
161  direction ? (f->flags |= FLOW_TOSERVER_IPONLY_SET) :
163  return;
164 }
165 
166 /** \brief Set flag to indicate that flow has alerts
167  *
168  * \param f flow
169  */
171 {
172  f->flags |= FLOW_HAS_ALERTS;
173 }
174 
175 /** \brief Check if flow has alerts
176  *
177  * \param f flow
178  * \retval 1 has alerts
179  * \retval 0 has not alerts
180  */
181 int FlowHasAlerts(const Flow *f)
182 {
183  if (f->flags & FLOW_HAS_ALERTS) {
184  return 1;
185  }
186 
187  return 0;
188 }
189 
190 /** \brief Set flag to indicate to change proto for the flow
191  *
192  * \param f flow
193  */
195 {
196  f->flags |= FLOW_CHANGE_PROTO;
197 }
198 
199 /** \brief Unset flag to indicate to change proto for the flow
200  *
201  * \param f flow
202  */
204 {
205  f->flags &= ~FLOW_CHANGE_PROTO;
206 }
207 
208 /** \brief Check if change proto flag is set for flow
209  * \param f flow
210  * \retval 1 change proto flag is set
211  * \retval 0 change proto flag is not set
212  */
214 {
215  if (f->flags & FLOW_CHANGE_PROTO) {
216  return 1;
217  }
218 
219  return 0;
220 }
221 
222 static inline void FlowSwapFlags(Flow *f)
223 {
227 
232 
234 }
235 
236 static inline void FlowSwapFileFlags(Flow *f)
237 {
242 }
243 
244 static inline void TcpStreamFlowSwap(Flow *f)
245 {
246  TcpSession *ssn = f->protoctx;
247  SWAP_VARS(TcpStream, ssn->server, ssn->client);
248  if (ssn->data_first_seen_dir & STREAM_TOSERVER) {
249  ssn->data_first_seen_dir = STREAM_TOCLIENT;
250  } else if (ssn->data_first_seen_dir & STREAM_TOCLIENT) {
251  ssn->data_first_seen_dir = STREAM_TOSERVER;
252  }
253 }
254 
255 /** \brief swap the flow's direction
256  * \note leaves the 'header' untouched. Interpret that based
257  * on FLOW_DIR_REVERSED flag.
258  * \warning: only valid before applayer parsing started. This
259  * function doesn't swap anything in Flow::alparser,
260  * Flow::alstate
261  */
262 void FlowSwap(Flow *f)
263 {
264  f->flags |= FLOW_DIR_REVERSED;
265 
268 
269  FlowSwapFlags(f);
270  FlowSwapFileFlags(f);
271 
272  if (f->proto == IPPROTO_TCP) {
273  TcpStreamFlowSwap(f);
274  }
275 
279 
280  /* not touching Flow::alparser and Flow::alstate */
281 
282  SWAP_VARS(const void *, f->sgh_toclient, f->sgh_toserver);
283 
284  SWAP_VARS(uint32_t, f->todstpktcnt, f->tosrcpktcnt);
285  SWAP_VARS(uint64_t, f->todstbytecnt, f->tosrcbytecnt);
286 }
287 
288 /**
289  * \brief determine the direction of the packet compared to the flow
290  * \retval 0 to_server
291  * \retval 1 to_client
292  */
293 int FlowGetPacketDirection(const Flow *f, const Packet *p)
294 {
295  const int reverse = (f->flags & FLOW_DIR_REVERSED) != 0;
296 
297  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
298  if (!(CMP_PORT(p->sp,p->dp))) {
299  /* update flags and counters */
300  if (CMP_PORT(f->sp,p->sp)) {
301  return TOSERVER ^ reverse;
302  } else {
303  return TOCLIENT ^ reverse;
304  }
305  } else {
306  if (CMP_ADDR(&f->src,&p->src)) {
307  return TOSERVER ^ reverse;
308  } else {
309  return TOCLIENT ^ reverse;
310  }
311  }
312  } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
313  if (CMP_ADDR(&f->src,&p->src)) {
314  return TOSERVER ^ reverse;
315  } else {
316  return TOCLIENT ^ reverse;
317  }
318  }
319 
320  /* default to toserver */
321  return TOSERVER;
322 }
323 
324 /**
325  * \brief Check to update "seen" flags
326  *
327  * \param p packet
328  *
329  * \retval 1 true
330  * \retval 0 false
331  */
332 static inline int FlowUpdateSeenFlag(const Packet *p)
333 {
334  if (PKT_IS_ICMPV4(p)) {
335  if (ICMPV4_IS_ERROR_MSG(p)) {
336  return 0;
337  }
338  }
339 
340  return 1;
341 }
342 
343 static inline void FlowUpdateTtlTS(Flow *f, Packet *p, uint8_t ttl)
344 {
345  if (f->min_ttl_toserver == 0) {
346  f->min_ttl_toserver = ttl;
347  } else {
348  f->min_ttl_toserver = MIN(f->min_ttl_toserver, ttl);
349  }
350  f->max_ttl_toserver = MAX(f->max_ttl_toserver, ttl);
351 }
352 
353 static inline void FlowUpdateTtlTC(Flow *f, Packet *p, uint8_t ttl)
354 {
355  if (f->min_ttl_toclient == 0) {
356  f->min_ttl_toclient = ttl;
357  } else {
358  f->min_ttl_toclient = MIN(f->min_ttl_toclient, ttl);
359  }
360  f->max_ttl_toclient = MAX(f->max_ttl_toclient, ttl);
361 }
362 
363 static inline void FlowUpdateEthernet(ThreadVars *tv, DecodeThreadVars *dtv,
364  Flow *f, EthernetHdr *ethh, bool toserver)
365 {
366  if (ethh && MacSetFlowStorageEnabled()) {
368  if (ms != NULL) {
369  if (toserver) {
370  MacSetAddWithCtr(ms, ethh->eth_src, ethh->eth_dst, tv,
373  } else {
374  MacSetAddWithCtr(ms, ethh->eth_dst, ethh->eth_src, tv,
377  }
378  }
379  }
380 }
381 
382 /** \brief Update Packet and Flow
383  *
384  * Updates packet and flow based on the new packet.
385  *
386  * \param f locked flow
387  * \param p packet
388  *
389  * \note overwrites p::flowflags
390  */
392 {
393  SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f);
394 
395  const int pkt_dir = FlowGetPacketDirection(f, p);
396 #ifdef CAPTURE_OFFLOAD
397  int state = f->flow_state;
398 
399  if (state != FLOW_STATE_CAPTURE_BYPASSED) {
400 #endif
401  /* update the last seen timestamp of this flow */
402  if (timercmp(&p->ts, &f->lastts, >)) {
403  COPY_TIMESTAMP(&p->ts, &f->lastts);
404  const uint32_t timeout_at = (uint32_t)f->lastts.tv_sec + f->timeout_policy;
405  if (timeout_at != f->timeout_at) {
406  f->timeout_at = timeout_at;
407  }
408  }
409 #ifdef CAPTURE_OFFLOAD
410  } else {
411  /* still seeing packet, we downgrade to local bypass */
412  if (p->ts.tv_sec - f->lastts.tv_sec > FLOW_BYPASSED_TIMEOUT / 2) {
413  SCLogDebug("Downgrading flow to local bypass");
414  COPY_TIMESTAMP(&p->ts, &f->lastts);
416  } else {
417  /* In IPS mode the packet could come from the other interface so it would
418  * need to be bypassed */
419  if (EngineModeIsIPS()) {
420  BypassedFlowUpdate(f, p);
421  }
422  }
423  }
424 #endif
425  /* update flags and counters */
426  if (pkt_dir == TOSERVER) {
427  f->todstpktcnt++;
428  f->todstbytecnt += GET_PKT_LEN(p);
430  if (!(f->flags & FLOW_TO_DST_SEEN)) {
431  if (FlowUpdateSeenFlag(p)) {
432  f->flags |= FLOW_TO_DST_SEEN;
434  }
435  }
436  /* xfer proto detect ts flag to first packet in ts dir */
437  if (f->flags & FLOW_PROTO_DETECT_TS_DONE) {
440  }
441  FlowUpdateEthernet(tv, dtv, f, p->ethh, true);
442  /* update flow's ttl fields if needed */
443  if (PKT_IS_IPV4(p)) {
444  FlowUpdateTtlTS(f, p, IPV4_GET_IPTTL(p));
445  } else if (PKT_IS_IPV6(p)) {
446  FlowUpdateTtlTS(f, p, IPV6_GET_HLIM(p));
447  }
448  } else {
449  f->tosrcpktcnt++;
450  f->tosrcbytecnt += GET_PKT_LEN(p);
452  if (!(f->flags & FLOW_TO_SRC_SEEN)) {
453  if (FlowUpdateSeenFlag(p)) {
454  f->flags |= FLOW_TO_SRC_SEEN;
456  }
457  }
458  /* xfer proto detect tc flag to first packet in tc dir */
459  if (f->flags & FLOW_PROTO_DETECT_TC_DONE) {
462  }
463  FlowUpdateEthernet(tv, dtv, f, p->ethh, false);
464  /* update flow's ttl fields if needed */
465  if (PKT_IS_IPV4(p)) {
466  FlowUpdateTtlTC(f, p, IPV4_GET_IPTTL(p));
467  } else if (PKT_IS_IPV6(p)) {
468  FlowUpdateTtlTC(f, p, IPV6_GET_HLIM(p));
469  }
470  }
471 
473  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
475 
476  } else if (f->proto == IPPROTO_TCP) {
477  TcpSession *ssn = (TcpSession *)f->protoctx;
478  if (ssn != NULL && ssn->state >= TCP_ESTABLISHED) {
480  }
481  } else if ((f->flags & (FLOW_TO_DST_SEEN|FLOW_TO_SRC_SEEN)) ==
483  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
485 
487  }
488 
489  /*set the detection bypass flags*/
490  if (f->flags & FLOW_NOPACKET_INSPECTION) {
491  SCLogDebug("setting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
492  DecodeSetNoPacketInspectionFlag(p);
493  }
494  if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
495  SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
496  DecodeSetNoPayloadInspectionFlag(p);
497  }
498 }
499 
500 /** \brief Entry point for packet flow handling
501  *
502  * This is called for every packet.
503  *
504  * \param tv threadvars
505  * \param dtv decode thread vars (for flow output api thread data)
506  * \param p packet to handle flow for
507  */
509 {
510  /* Get this packet's flow from the hash. FlowHandlePacket() will setup
511  * a new flow if nescesary. If we get NULL, we're out of flow memory.
512  * The returned flow is locked. */
513  Flow *f = FlowGetFlowFromHash(tv, fls, p, &p->flow);
514  if (f == NULL)
515  return;
516 
517  /* set the flow in the packet */
518  p->flags |= PKT_HAS_FLOW;
519  return;
520 }
521 
522 /** \brief initialize the configuration
523  * \warning Not thread safe */
524 void FlowInitConfig(bool quiet)
525 {
526  SCLogDebug("initializing flow engine...");
527 
528  memset(&flow_config, 0, sizeof(flow_config));
529  SC_ATOMIC_INIT(flow_flags);
530  SC_ATOMIC_INIT(flow_memuse);
531  SC_ATOMIC_INIT(flow_prune_idx);
532  SC_ATOMIC_INIT(flow_config.memcap);
534 
535  /* set defaults */
536  flow_config.hash_rand = (uint32_t)RandomGet();
540 
541  /* If we have specific config, overwrite the defaults with them,
542  * otherwise, leave the default values */
543  intmax_t val = 0;
544  if (ConfGetInt("flow.emergency-recovery", &val) == 1) {
545  if (val <= 100 && val >= 1) {
546  flow_config.emergency_recovery = (uint8_t)val;
547  } else {
548  SCLogError(SC_ERR_INVALID_VALUE, "flow.emergency-recovery must be in the range of "
549  "1 and 100 (as percentage)");
551  }
552  } else {
553  SCLogDebug("flow.emergency-recovery, using default value");
555  }
556 
557  /* Check if we have memcap and hash_size defined at config */
558  const char *conf_val;
559  uint32_t configval = 0;
560 
561  /** set config values for memcap, prealloc and hash_size */
562  uint64_t flow_memcap_copy = 0;
563  if ((ConfGet("flow.memcap", &conf_val)) == 1)
564  {
565  if (conf_val == NULL) {
566  FatalError(SC_ERR_FATAL, "Invalid value for flow.memcap: NULL");
567  }
568 
569  if (ParseSizeStringU64(conf_val, &flow_memcap_copy) < 0) {
570  SCLogError(SC_ERR_SIZE_PARSE, "Error parsing flow.memcap "
571  "from conf file - %s. Killing engine",
572  conf_val);
573  exit(EXIT_FAILURE);
574  } else {
575  SC_ATOMIC_SET(flow_config.memcap, flow_memcap_copy);
576  }
577  }
578  if ((ConfGet("flow.hash-size", &conf_val)) == 1)
579  {
580  if (conf_val == NULL) {
581  FatalError(SC_ERR_FATAL, "Invalid value for flow.hash-size: NULL");
582  }
583 
584  if (StringParseUint32(&configval, 10, strlen(conf_val),
585  conf_val) > 0) {
586  flow_config.hash_size = configval;
587  }
588  }
589  if ((ConfGet("flow.prealloc", &conf_val)) == 1)
590  {
591  if (conf_val == NULL) {
592  FatalError(SC_ERR_FATAL, "Invalid value for flow.prealloc: NULL");
593  }
594 
595  if (StringParseUint32(&configval, 10, strlen(conf_val),
596  conf_val) > 0) {
597  flow_config.prealloc = configval;
598  }
599  }
600 
601  flow_config.memcap_policy = ExceptionPolicyParse("flow.memcap-policy", false);
602 
603  SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: "
604  "%"PRIu32", prealloc: %"PRIu32, SC_ATOMIC_GET(flow_config.memcap),
606 
607  /* alloc hash memory */
608  uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket);
609  if (!(FLOW_CHECK_MEMCAP(hash_size))) {
610  SCLogError(SC_ERR_FLOW_INIT, "allocating flow hash failed: "
611  "max flow memcap is smaller than projected hash size. "
612  "Memcap: %"PRIu64", Hash table size %"PRIu64". Calculate "
613  "total hash size by multiplying \"flow.hash-size\" with %"PRIuMAX", "
614  "which is the hash bucket size.", SC_ATOMIC_GET(flow_config.memcap), hash_size,
615  (uintmax_t)sizeof(FlowBucket));
616  exit(EXIT_FAILURE);
617  }
618  flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS);
619  if (unlikely(flow_hash == NULL)) {
621  "Fatal error encountered in FlowInitConfig. Exiting...");
622  }
623  memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket));
624 
625  uint32_t i = 0;
626  for (i = 0; i < flow_config.hash_size; i++) {
627  FBLOCK_INIT(&flow_hash[i]);
628  SC_ATOMIC_INIT(flow_hash[i].next_ts);
629  }
630  (void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket)));
631 
632  if (!quiet) {
633  SCLogConfig("allocated %"PRIu64" bytes of memory for the flow hash... "
634  "%" PRIu32 " buckets of size %" PRIuMAX "",
635  SC_ATOMIC_GET(flow_memuse), flow_config.hash_size,
636  (uintmax_t)sizeof(FlowBucket));
637  }
639  if (!quiet) {
640  SCLogConfig("flow memory usage: %"PRIu64" bytes, maximum: %"PRIu64,
641  SC_ATOMIC_GET(flow_memuse), SC_ATOMIC_GET(flow_config.memcap));
642  }
643 
645 
646  uint32_t sz = sizeof(Flow) + FlowStorageSize();
647  SCLogConfig("flow size %u, memcap allows for %" PRIu64 " flows. Per hash row in perfect "
648  "conditions %" PRIu64,
649  sz, flow_memcap_copy / sz, (flow_memcap_copy / sz) / flow_config.hash_size);
650  return;
651 }
652 
653 void FlowReset(void)
654 {
655  // resets the flows (for reuse by fuzzing)
656  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
657  Flow *f = flow_hash[u].head;
658  while (f) {
659  Flow *n = f->next;
660  uint8_t proto_map = FlowGetProtoMapping(f->proto);
661  FlowClearMemory(f, proto_map);
662  FlowFree(f);
663  f = n;
664  }
665  flow_hash[u].head = NULL;
666  }
667 }
668 
669 /** \brief shutdown the flow engine
670  * \warning Not thread safe */
671 void FlowShutdown(void)
672 {
673  Flow *f;
674  while ((f = FlowDequeue(&flow_recycle_q))) {
675  FlowFree(f);
676  }
677 
678  /* clear and free the hash */
679  if (flow_hash != NULL) {
680  /* clean up flow mutexes */
681  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
682  f = flow_hash[u].head;
683  while (f) {
685  Flow *n = f->next;
686  uint8_t proto_map = FlowGetProtoMapping(f->proto);
687  FlowClearMemory(f, proto_map);
688  FlowFree(f);
689  f = n;
690  }
691  f = flow_hash[u].evicted;
692  while (f) {
694  Flow *n = f->next;
695  uint8_t proto_map = FlowGetProtoMapping(f->proto);
696  FlowClearMemory(f, proto_map);
697  FlowFree(f);
698  f = n;
699  }
700 
702  }
704  flow_hash = NULL;
705  }
706  (void) SC_ATOMIC_SUB(flow_memuse, flow_config.hash_size * sizeof(FlowBucket));
709  return;
710 }
711 
712 /**
713  * \brief Function to set the default timeout, free function and flow state
714  * function for all supported flow_proto.
715  */
716 
718 {
720 
721 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
722  flow_timeouts_normal[(p)].new_timeout = (n); \
723  flow_timeouts_normal[(p)].est_timeout = (e); \
724  flow_timeouts_normal[(p)].closed_timeout = (c); \
725  flow_timeouts_normal[(p)].bypassed_timeout = (b); \
726  flow_timeouts_emerg[(p)].new_timeout = (ne); \
727  flow_timeouts_emerg[(p)].est_timeout = (ee); \
728  flow_timeouts_emerg[(p)].closed_timeout = (ce); \
729  flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
730 
751 
756 
757  /* Let's see if we have custom timeouts defined from config */
758  const char *new = NULL;
759  const char *established = NULL;
760  const char *closed = NULL;
761  const char *bypassed = NULL;
762  const char *emergency_new = NULL;
763  const char *emergency_established = NULL;
764  const char *emergency_closed = NULL;
765  const char *emergency_bypassed = NULL;
766 
767  ConfNode *flow_timeouts = ConfGetNode("flow-timeouts");
768  if (flow_timeouts != NULL) {
769  ConfNode *proto = NULL;
770  uint32_t configval = 0;
771 
772  /* Defaults. */
773  proto = ConfNodeLookupChild(flow_timeouts, "default");
774  if (proto != NULL) {
775  new = ConfNodeLookupChildValue(proto, "new");
776  established = ConfNodeLookupChildValue(proto, "established");
777  closed = ConfNodeLookupChildValue(proto, "closed");
778  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
779  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
780  emergency_established = ConfNodeLookupChildValue(proto,
781  "emergency-established");
782  emergency_closed = ConfNodeLookupChildValue(proto,
783  "emergency-closed");
784  emergency_bypassed = ConfNodeLookupChildValue(proto,
785  "emergency-bypassed");
786 
787  if (new != NULL &&
788  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
789 
791  }
792  if (established != NULL &&
793  StringParseUint32(&configval, 10, strlen(established),
794  established) > 0) {
795 
797  }
798  if (closed != NULL &&
799  StringParseUint32(&configval, 10, strlen(closed),
800  closed) > 0) {
801 
803  }
804  if (bypassed != NULL &&
805  StringParseUint32(&configval, 10,
806  strlen(bypassed),
807  bypassed) > 0) {
808 
810  }
811  if (emergency_new != NULL &&
812  StringParseUint32(&configval, 10, strlen(emergency_new),
813  emergency_new) > 0) {
814 
816  }
817  if (emergency_established != NULL &&
818  StringParseUint32(&configval, 10,
819  strlen(emergency_established),
820  emergency_established) > 0) {
821 
823  }
824  if (emergency_closed != NULL &&
825  StringParseUint32(&configval, 10,
826  strlen(emergency_closed),
827  emergency_closed) > 0) {
828 
830  }
831  if (emergency_bypassed != NULL &&
832  StringParseUint32(&configval, 10,
833  strlen(emergency_bypassed),
834  emergency_bypassed) > 0) {
835 
837  }
838  }
839 
840  /* TCP. */
841  proto = ConfNodeLookupChild(flow_timeouts, "tcp");
842  if (proto != NULL) {
843  new = ConfNodeLookupChildValue(proto, "new");
844  established = ConfNodeLookupChildValue(proto, "established");
845  closed = ConfNodeLookupChildValue(proto, "closed");
846  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
847  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
848  emergency_established = ConfNodeLookupChildValue(proto,
849  "emergency-established");
850  emergency_closed = ConfNodeLookupChildValue(proto,
851  "emergency-closed");
852  emergency_bypassed = ConfNodeLookupChildValue(proto,
853  "emergency-bypassed");
854 
855  if (new != NULL &&
856  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
857 
859  }
860  if (established != NULL &&
861  StringParseUint32(&configval, 10, strlen(established),
862  established) > 0) {
863 
865  }
866  if (closed != NULL &&
867  StringParseUint32(&configval, 10, strlen(closed),
868  closed) > 0) {
869 
871  }
872  if (bypassed != NULL &&
873  StringParseUint32(&configval, 10,
874  strlen(bypassed),
875  bypassed) > 0) {
876 
878  }
879  if (emergency_new != NULL &&
880  StringParseUint32(&configval, 10, strlen(emergency_new),
881  emergency_new) > 0) {
882 
884  }
885  if (emergency_established != NULL &&
886  StringParseUint32(&configval, 10,
887  strlen(emergency_established),
888  emergency_established) > 0) {
889 
891  }
892  if (emergency_closed != NULL &&
893  StringParseUint32(&configval, 10,
894  strlen(emergency_closed),
895  emergency_closed) > 0) {
896 
898  }
899  if (emergency_bypassed != NULL &&
900  StringParseUint32(&configval, 10,
901  strlen(emergency_bypassed),
902  emergency_bypassed) > 0) {
903 
905  }
906  }
907 
908  /* UDP. */
909  proto = ConfNodeLookupChild(flow_timeouts, "udp");
910  if (proto != NULL) {
911  new = ConfNodeLookupChildValue(proto, "new");
912  established = ConfNodeLookupChildValue(proto, "established");
913  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
914  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
915  emergency_established = ConfNodeLookupChildValue(proto,
916  "emergency-established");
917  emergency_bypassed = ConfNodeLookupChildValue(proto,
918  "emergency-bypassed");
919 
920  if (new != NULL &&
921  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
922 
924  }
925  if (established != NULL &&
926  StringParseUint32(&configval, 10, strlen(established),
927  established) > 0) {
928 
930  }
931  if (bypassed != NULL &&
932  StringParseUint32(&configval, 10,
933  strlen(bypassed),
934  bypassed) > 0) {
935 
937  }
938  if (emergency_new != NULL &&
939  StringParseUint32(&configval, 10, strlen(emergency_new),
940  emergency_new) > 0) {
941 
943  }
944  if (emergency_established != NULL &&
945  StringParseUint32(&configval, 10,
946  strlen(emergency_established),
947  emergency_established) > 0) {
948 
950  }
951  if (emergency_bypassed != NULL &&
952  StringParseUint32(&configval, 10,
953  strlen(emergency_bypassed),
954  emergency_bypassed) > 0) {
955 
957  }
958  }
959 
960  /* ICMP. */
961  proto = ConfNodeLookupChild(flow_timeouts, "icmp");
962  if (proto != NULL) {
963  new = ConfNodeLookupChildValue(proto, "new");
964  established = ConfNodeLookupChildValue(proto, "established");
965  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
966  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
967  emergency_established = ConfNodeLookupChildValue(proto,
968  "emergency-established");
969  emergency_bypassed = ConfNodeLookupChildValue(proto,
970  "emergency-bypassed");
971 
972  if (new != NULL &&
973  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
974 
976  }
977  if (established != NULL &&
978  StringParseUint32(&configval, 10, strlen(established),
979  established) > 0) {
980 
982  }
983  if (bypassed != NULL &&
984  StringParseUint32(&configval, 10,
985  strlen(bypassed),
986  bypassed) > 0) {
987 
989  }
990  if (emergency_new != NULL &&
991  StringParseUint32(&configval, 10, strlen(emergency_new),
992  emergency_new) > 0) {
993 
995  }
996  if (emergency_established != NULL &&
997  StringParseUint32(&configval, 10,
998  strlen(emergency_established),
999  emergency_established) > 0) {
1000 
1002  }
1003  if (emergency_bypassed != NULL &&
1004  StringParseUint32(&configval, 10,
1005  strlen(emergency_bypassed),
1006  emergency_bypassed) > 0) {
1007 
1009  }
1010  }
1011  }
1012 
1013  /* validate and if needed update emergency timeout values */
1014  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
1015  const FlowProtoTimeout *n = &flow_timeouts_normal[i];
1017 
1018  if (e->est_timeout > n->est_timeout) {
1019  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'established\' "
1020  "must be below regular value %u", e->est_timeout, n->est_timeout);
1021  e->est_timeout = n->est_timeout / 10;
1022  }
1023 
1024  if (e->new_timeout > n->new_timeout) {
1025  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'new\' must be "
1026  "below regular value %u", e->new_timeout, n->new_timeout);
1027  e->new_timeout = n->new_timeout / 10;
1028  }
1029 
1030  if (e->closed_timeout > n->closed_timeout) {
1031  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'closed\' must "
1032  "be below regular value %u", e->closed_timeout, n->closed_timeout);
1033  e->closed_timeout = n->closed_timeout / 10;
1034  }
1035 
1036  if (e->bypassed_timeout > n->bypassed_timeout) {
1037  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value %u for \'bypassed\' "
1038  "must be below regular value %u", e->bypassed_timeout, n->bypassed_timeout);
1039  e->bypassed_timeout = n->bypassed_timeout / 10;
1040  }
1041  }
1042 
1043  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
1047 
1048  if (e->est_timeout > n->est_timeout) {
1049  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'established\' must be below normal value");
1050  e->est_timeout = n->est_timeout / 10;
1051  }
1052  d->est_timeout = n->est_timeout - e->est_timeout;
1053 
1054  if (e->new_timeout > n->new_timeout) {
1055  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'new\' must be below normal value");
1056  e->new_timeout = n->new_timeout / 10;
1057  }
1058  d->new_timeout = n->new_timeout - e->new_timeout;
1059 
1060  if (e->closed_timeout > n->closed_timeout) {
1061  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'closed\' must be below normal value");
1062  e->closed_timeout = n->closed_timeout / 10;
1063  }
1065 
1066  if (e->bypassed_timeout > n->bypassed_timeout) {
1067  SCLogWarning(SC_WARN_FLOW_EMERGENCY, "emergency timeout value for \'bypassed\' must be below normal value");
1068  e->bypassed_timeout = n->bypassed_timeout / 10;
1069  }
1071 
1072  SCLogDebug("deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1074  }
1075 
1076  return;
1077 }
1078 
1079 /**
1080  * \brief Function clear the flow memory before queueing it to spare flow
1081  * queue.
1082  *
1083  * \param f pointer to the flow needed to be cleared.
1084  * \param proto_map mapped value of the protocol to FLOW_PROTO's.
1085  */
1086 
1087 int FlowClearMemory(Flow* f, uint8_t proto_map)
1088 {
1089  SCEnter();
1090 
1091  if (unlikely(f->flags & FLOW_HAS_EXPECTATION)) {
1093  }
1094 
1095  /* call the protocol specific free function if we have one */
1096  if (flow_freefuncs[proto_map].Freefunc != NULL) {
1097  flow_freefuncs[proto_map].Freefunc(f->protoctx);
1098  }
1099 
1100  FlowFreeStorage(f);
1101 
1102  FLOW_RECYCLE(f);
1103 
1104  SCReturnInt(1);
1105 }
1106 
1107 /**
1108  * \brief Function to set the function to get protocol specific flow state.
1109  *
1110  * \param proto protocol of which function is needed to be set.
1111  * \param Free Function pointer which will be called to free the protocol
1112  * specific memory.
1113  */
1114 
1115 int FlowSetProtoFreeFunc (uint8_t proto, void (*Free)(void *))
1116 {
1117  uint8_t proto_map;
1118  proto_map = FlowGetProtoMapping(proto);
1119 
1120  flow_freefuncs[proto_map].Freefunc = Free;
1121  return 1;
1122 }
1123 
1125 {
1126  return f->alproto;
1127 }
1128 
1129 void *FlowGetAppState(const Flow *f)
1130 {
1131  return f->alstate;
1132 }
1133 
1134 /**
1135  * \brief get 'disruption' flags: GAP/DEPTH/PASS
1136  * \param f locked flow
1137  * \param flags existing flags to be ammended
1138  * \retval flags original flags + disrupt flags (if any)
1139  * \TODO handle UDP
1140  */
1141 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
1142 {
1143  if (f->proto != IPPROTO_TCP) {
1144  return flags;
1145  }
1146  if (f->protoctx == NULL) {
1147  return flags;
1148  }
1149 
1150  uint8_t newflags = flags;
1151  TcpSession *ssn = f->protoctx;
1152  TcpStream *stream = flags & STREAM_TOSERVER ? &ssn->client : &ssn->server;
1153 
1155  newflags |= STREAM_DEPTH;
1156  }
1157  /* todo: handle pass case (also for UDP!) */
1158 
1159  return newflags;
1160 }
1161 
1162 void FlowUpdateState(Flow *f, const enum FlowState s)
1163 {
1164  if (s != f->flow_state) {
1165  /* set the state */
1166  // Explicit cast from the enum type to the compact version
1167  f->flow_state = (FlowStateType)s;
1168 
1169  /* update timeout policy and value */
1170  const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1171  if (timeout_policy != f->timeout_policy) {
1172  f->timeout_policy = timeout_policy;
1173  const uint32_t timeout_at = (uint32_t)f->lastts.tv_sec + timeout_policy;
1174  if (timeout_at != f->timeout_at)
1175  f->timeout_at = timeout_at;
1176  }
1177  }
1178 #ifdef UNITTESTS
1179  if (f->fb != NULL) {
1180 #endif
1181  /* and reset the flow buckup next_ts value so that the flow manager
1182  * has to revisit this row */
1183  SC_ATOMIC_SET(f->fb->next_ts, 0);
1184 #ifdef UNITTESTS
1185  }
1186 #endif
1187 }
1188 
1189 /**
1190  * \brief Get flow last time as individual values.
1191  *
1192  * Instead of returning a pointer to the timeval copy the timeval
1193  * parts into output pointers to make it simpler to call from Rust
1194  * over FFI using only basic data types.
1195  */
1196 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
1197 {
1198  *secs = (uint64_t)flow->lastts.tv_sec;
1199  *usecs = (uint64_t)flow->lastts.tv_usec;
1200 }
1201 
1202 /**
1203  * \brief Get flow source port.
1204  *
1205  * A function to get the flow sport useful when the caller only has an
1206  * opaque pointer to the flow structure.
1207  */
1208 uint16_t FlowGetSourcePort(Flow *flow)
1209 {
1210  return flow->sp;
1211 }
1212 
1213 /**
1214  * \brief Get flow destination port.
1215  *
1216  * A function to get the flow dport useful when the caller only has an
1217  * opaque pointer to the flow structure.
1218  */
1219 
1221 {
1222  return flow->dp;
1223 }
1224 /**
1225  * \brief Get flow flags.
1226  *
1227  * A function to get the flow flags useful when the caller only has an
1228  * opaque pointer to the flow structure.
1229  */
1230 
1231 uint32_t FlowGetFlags(Flow *flow)
1232 {
1233  return flow->flags;
1234 }
1235 /************************************Unittests*******************************/
1236 
1237 #ifdef UNITTESTS
1238 #include "threads.h"
1239 
1240 /**
1241  * \test Test the setting of the per protocol timeouts.
1242  *
1243  * \retval On success it returns 1 and on failure 0.
1244  */
1245 
1246 static int FlowTest01 (void)
1247 {
1248  uint8_t proto_map;
1249 
1251  proto_map = FlowGetProtoMapping(IPPROTO_TCP);
1252  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_TCP_NEW_TIMEOUT);
1253  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_TCP_EST_TIMEOUT);
1256 
1257  proto_map = FlowGetProtoMapping(IPPROTO_UDP);
1258  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_UDP_NEW_TIMEOUT);
1259  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_UDP_EST_TIMEOUT);
1262 
1263  proto_map = FlowGetProtoMapping(IPPROTO_ICMP);
1264  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_ICMP_NEW_TIMEOUT);
1265  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_ICMP_EST_TIMEOUT);
1268 
1269  proto_map = FlowGetProtoMapping(IPPROTO_DCCP);
1270  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_DEFAULT_NEW_TIMEOUT);
1271  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_DEFAULT_EST_TIMEOUT);
1272  FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_DEFAULT_EMERG_NEW_TIMEOUT);
1273  FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_DEFAULT_EMERG_EST_TIMEOUT);
1274 
1275  PASS;
1276 }
1277 
1278 /*Test function for the unit test FlowTest02*/
1279 
1280 static void test(void *f) {}
1281 
1282 /**
1283  * \test Test the setting of the per protocol free function to free the
1284  * protocol specific memory.
1285  *
1286  * \retval On success it returns 1 and on failure 0.
1287  */
1288 
1289 static int FlowTest02 (void)
1290 {
1291  FlowSetProtoFreeFunc(IPPROTO_DCCP, test);
1292  FlowSetProtoFreeFunc(IPPROTO_TCP, test);
1293  FlowSetProtoFreeFunc(IPPROTO_UDP, test);
1294  FlowSetProtoFreeFunc(IPPROTO_ICMP, test);
1295 
1296  FAIL_IF(flow_freefuncs[FLOW_PROTO_DEFAULT].Freefunc != test);
1297  FAIL_IF(flow_freefuncs[FLOW_PROTO_TCP].Freefunc != test);
1298  FAIL_IF(flow_freefuncs[FLOW_PROTO_UDP].Freefunc != test);
1299  FAIL_IF(flow_freefuncs[FLOW_PROTO_ICMP].Freefunc != test);
1300 
1301  PASS;
1302 }
1303 
1304 /**
1305  * \test Test flow allocations when it reach memcap
1306  *
1307  *
1308  * \retval On success it returns 1 and on failure 0.
1309  */
1310 
1311 static int FlowTest07 (void)
1312 {
1313  int result = 0;
1315  FlowConfig backup;
1316  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1317 
1318  uint32_t ini = 0;
1319  uint32_t end = FlowSpareGetPoolSize();
1320  SC_ATOMIC_SET(flow_config.memcap, 10000);
1321  flow_config.prealloc = 100;
1322 
1323  /* Let's get the flow spare pool empty */
1324  UTHBuildPacketOfFlows(ini, end, 0);
1325 
1326  /* And now let's try to reach the memcap val */
1327  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1328  ini = end + 1;
1329  end = end + 2;
1330  UTHBuildPacketOfFlows(ini, end, 0);
1331  }
1332 
1333  /* should time out normal */
1334  TimeSetIncrementTime(2000);
1335  ini = end + 1;
1336  end = end + 2;
1337  UTHBuildPacketOfFlows(ini, end, 0);
1338 
1339  /* This means that the engine entered emerg mode: should happen as easy
1340  * with flow mgr activated */
1341  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1342  result = 1;
1343 
1344  FlowShutdown();
1345  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1346 
1347  return result;
1348 }
1349 
1350 /**
1351  * \test Test flow allocations when it reach memcap
1352  *
1353  *
1354  * \retval On success it returns 1 and on failure 0.
1355  */
1356 
1357 static int FlowTest08 (void)
1358 {
1359  int result = 0;
1360 
1362  FlowConfig backup;
1363  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1364 
1365  uint32_t ini = 0;
1366  uint32_t end = FlowSpareGetPoolSize();
1367  SC_ATOMIC_SET(flow_config.memcap, 10000);
1368  flow_config.prealloc = 100;
1369 
1370  /* Let's get the flow spare pool empty */
1371  UTHBuildPacketOfFlows(ini, end, 0);
1372 
1373  /* And now let's try to reach the memcap val */
1374  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1375  ini = end + 1;
1376  end = end + 2;
1377  UTHBuildPacketOfFlows(ini, end, 0);
1378  }
1379 
1380  /* By default we use 30 for timing out new flows. This means
1381  * that the Emergency mode should be set */
1383  ini = end + 1;
1384  end = end + 2;
1385  UTHBuildPacketOfFlows(ini, end, 0);
1386 
1387  /* This means that the engine released 5 flows by emergency timeout */
1388  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1389  result = 1;
1390 
1391  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1392  FlowShutdown();
1393 
1394  return result;
1395 }
1396 
1397 /**
1398  * \test Test flow allocations when it reach memcap
1399  *
1400  *
1401  * \retval On success it returns 1 and on failure 0.
1402  */
1403 
1404 static int FlowTest09 (void)
1405 {
1406  int result = 0;
1407 
1409  FlowConfig backup;
1410  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1411 
1412  uint32_t ini = 0;
1413  uint32_t end = FlowSpareGetPoolSize();
1414  SC_ATOMIC_SET(flow_config.memcap, 10000);
1415  flow_config.prealloc = 100;
1416 
1417  /* Let's get the flow spare pool empty */
1418  UTHBuildPacketOfFlows(ini, end, 0);
1419 
1420  /* And now let's try to reach the memcap val */
1421  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1422  ini = end + 1;
1423  end = end + 2;
1424  UTHBuildPacketOfFlows(ini, end, 0);
1425  }
1426 
1427  /* No timeout will work */
1429  ini = end + 1;
1430  end = end + 2;
1431  UTHBuildPacketOfFlows(ini, end, 0);
1432 
1433  /* engine in emerg mode */
1434  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1435  result = 1;
1436 
1437  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1438  FlowShutdown();
1439 
1440  return result;
1441 }
1442 
1443 #endif /* UNITTESTS */
1444 
1445 /**
1446  * \brief Function to register the Flow Unitests.
1447  */
1449 {
1450 #ifdef UNITTESTS
1451  UtRegisterTest("FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1452  UtRegisterTest("FlowTest02 -- Setting Protocol Specific Free Function",
1453  FlowTest02);
1454  UtRegisterTest("FlowTest07 -- Test flow Allocations when it reach memcap",
1455  FlowTest07);
1456  UtRegisterTest("FlowTest08 -- Test flow Allocations when it reach memcap",
1457  FlowTest08);
1458  UtRegisterTest("FlowTest09 -- Test flow Allocations when it reach memcap",
1459  FlowTest09);
1460 
1462 #endif /* UNITTESTS */
1463 }
util-byte.h
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:203
FBLOCK_DESTROY
#define FBLOCK_DESTROY(fb)
Definition: flow-hash.h:70
FLOW_DEFAULT_NEW_TIMEOUT
#define FLOW_DEFAULT_NEW_TIMEOUT
Definition: flow-private.h:40
tm-threads.h
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:392
Packet_::proto
uint8_t proto
Definition: decode.h:456
FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
Definition: flow-private.h:58
TcpStream_
Definition: stream-tcp-private.h:106
flow-bypass.h
FLOW_HAS_EXPECTATION
#define FLOW_HAS_EXPECTATION
Definition: flow.h:110
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
Definition: flow.c:170
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:143
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
Definition: flow.c:194
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1169
SC_ERR_INVALID_VALUE
@ SC_ERR_INVALID_VALUE
Definition: util-error.h:160
FlowSpareGetPoolSize
uint32_t FlowSpareGetPoolSize(void)
Definition: flow-spare-pool.c:47
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:293
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:510
flow-util.h
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:315
FBLOCK_INIT
#define FBLOCK_INIT(fb)
Definition: flow-hash.h:69
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:254
CLS
#define CLS
Definition: suricata-common.h:45
stream-tcp.h
MacSetAddWithCtr
void MacSetAddWithCtr(MacSet *ms, uint8_t *src_addr, uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
Definition: util-macset.c:179
FLOW_DEFAULT_HASHSIZE
#define FLOW_DEFAULT_HASHSIZE
Definition: flow.c:73
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:298
FLOW_DEFAULT_PREALLOC
#define FLOW_DEFAULT_PREALLOC
Definition: flow.c:77
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:289
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1448
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:62
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:71
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:595
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:200
Flow_::proto
uint8_t proto
Definition: flow.h:375
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:120
Packet_::flags
uint32_t flags
Definition: decode.h:469
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:175
threads.h
util-macset.h
FlowGetFlags
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
Definition: flow.c:1231
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:353
run_mode
int run_mode
Definition: suricata.c:211
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
FlowProtoTimeout_
Definition: flow.h:523
flow-hash.h
FlowGetSourcePort
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
Definition: flow.c:1208
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:63
FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
Definition: flow.h:82
FlowReset
void FlowReset(void)
Definition: flow.c:653
FlowLookupStruct_
Definition: flow.h:547
FLOW_DEFAULT_EMERG_NEW_TIMEOUT
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
Definition: flow-private.h:55
Flow
struct Flow_ Flow
Flow data structure.
FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:59
BypassedFlowUpdate
void BypassedFlowUpdate(Flow *f, Packet *p)
Definition: flow-bypass.c:204
Flow_::use_cnt
FlowRefCount use_cnt
Definition: flow.h:383
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:527
FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_DEFAULT_EST_TIMEOUT
Definition: flow-private.h:41
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:223
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:154
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:137
MIN
#define MIN(x, y)
Definition: suricata-common.h:372
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:131
FlowQueueDestroy
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
Definition: flow-queue.c:60
util-privs.h
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:508
stream-tcp-reassemble.h
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
RandomGet
long int RandomGet(void)
Definition: util-random.c:130
FLOW_TOSERVER_DROP_LOGGED
#define FLOW_TOSERVER_DROP_LOGGED
Definition: flow.h:74
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:478
proto
uint8_t proto
Definition: decode-template.h:0
Flow_::dp
Port dp
Definition: flow.h:369
FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
Definition: flow.h:92
FLOW_DEFAULT_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
Definition: flow-private.h:43
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:465
MAX
#define MAX(x, y)
Definition: suricata-common.h:376
Flow_::protoctx
void * protoctx
Definition: flow.h:451
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:673
FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
Definition: flow-private.h:50
STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
Definition: stream-tcp-private.h:215
util-unittest.h
FLOW_BYPASSED_TIMEOUT
#define FLOW_BYPASSED_TIMEOUT
Definition: flow-private.h:67
FlowGetAppState
void * FlowGetAppState(const Flow *f)
Definition: flow.c:1129
util-unittest-helper.h
FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
Definition: flow-private.h:61
FLOW_IPPROTO_ICMP_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
Definition: flow-private.h:52
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:291
UTHBuildPacketOfFlows
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
Definition: util-unittest-helper.c:891
AppLayerExpectationClean
void AppLayerExpectationClean(Flow *f)
Definition: app-layer-expectation.c:363
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:422
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1202
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:493
FlowGetDestinationPort
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
Definition: flow.c:1220
FLOW_CHECK_MEMCAP
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
Definition: flow-util.h:143
FLOW_RECYCLE
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
Definition: flow-util.h:82
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:505
flow-spare-pool.h
SC_ERR_SIZE_PARSE
@ SC_ERR_SIZE_PARSE
Definition: util-error.h:230
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:330
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:485
FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
Definition: flow-private.h:65
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:524
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:498
app-layer-expectation.h
FLOW_IPPROTO_UDP_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
Definition: flow-private.h:49
SC_ERR_FLOW_INIT
@ SC_ERR_FLOW_INIT
Definition: util-error.h:237
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:512
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:477
decode.h
util-debug.h
TOSERVER
#define TOSERVER
Definition: flow.h:43
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:73
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:502
FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
Definition: flow-private.h:46
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:391
SCEnter
#define SCEnter(...)
Definition: util-debug.h:298
FLOW_CHANGE_PROTO
#define FLOW_CHANGE_PROTO
Definition: flow.h:104
Packet_::ethh
EthernetHdr * ethh
Definition: decode.h:525
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:56
FlowStorageSize
unsigned int FlowStorageSize(void)
Definition: flow-storage.c:34
Packet_::sp
Port sp
Definition: decode.h:441
FlowCnf_
Definition: flow.h:287
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:229
FlowQueueInit
FlowQueue * FlowQueueInit(FlowQueue *q)
Definition: flow-queue.c:46
FlowState
FlowState
Definition: flow.h:508
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:273
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:524
StringParseUint32
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:313
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:526
util-time.h
app-layer-parser.h
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1577
FLOW_PROTO_DETECT_TC_DONE
#define FLOW_PROTO_DETECT_TC_DONE
Definition: flow.h:101
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:504
FLOW_TC_PP_ALPROTO_DETECT_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
Definition: flow.h:90
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:490
FLOW_PROTO_ICMP
@ FLOW_PROTO_ICMP
Definition: flow-private.h:72
MacSetFlowStorageEnabled
bool MacSetFlowStorageEnabled(void)
Definition: util-macset.c:84
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:342
stream.h
TimeSetIncrementTime
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
Definition: util-time.c:184
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:96
Packet_
Definition: decode.h:434
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
FLOW_DEFAULT_MEMCAP
#define FLOW_DEFAULT_MEMCAP
Definition: flow.c:75
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:226
stream-tcp-private.h
MacSet_
Definition: util-macset.c:44
conf.h
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:159
FLOW_TOSERVER_IPONLY_SET
#define FLOW_TOSERVER_IPONLY_SET
Definition: flow.h:56
FLOW_IPPROTO_TCP_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
Definition: flow-private.h:44
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:531
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1087
flow_timeouts_delta
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Definition: flow.c:96
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:288
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
flow-timeout.h
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:479
MacSetGetFlowStorageID
FlowStorageId MacSetGetFlowStorageID(void)
Definition: util-macset.c:113
flow-queue.h
FlowGetStorageById
void * FlowGetStorageById(Flow *f, FlowStorageId id)
Definition: flow-storage.c:39
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:429
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:224
runmodes.h
FLOW_TO_DST_SEEN
#define FLOW_TO_DST_SEEN
Definition: flow.h:51
FlowUpdateState
void FlowUpdateState(Flow *f, const enum FlowState s)
Definition: flow.c:1162
Flow_::src
FlowAddress src
Definition: flow.h:356
Flow_::next
struct Flow_ * next
Definition: flow.h:404
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:428
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:32
Flow_::lastts
struct timeval lastts
Definition: flow.h:414
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:770
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:57
FlowDequeue
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
Definition: flow-queue.c:191
FLOW_TO_SRC_SEEN
#define FLOW_TO_SRC_SEEN
Definition: flow.h:49
flow-storage.h
FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
Definition: flow.h:86
Packet_::flow
struct Flow_ * flow
Definition: decode.h:471
FLOW_IPPROTO_UDP_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
Definition: flow-private.h:48
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1115
FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
Definition: flow-private.h:51
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:94
CMP_ADDR
#define CMP_ADDR(a1, a2)
Definition: decode.h:241
FlowStateType
unsigned short FlowStateType
Definition: flow.h:329
ExceptionPolicyParse
enum ExceptionPolicy ExceptionPolicyParse(const char *option, const bool support_flow)
Definition: util-exception-policy.c:75
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:121
flags
uint8_t flags
Definition: decode-gre.h:0
FLOW_TOCLIENT_IPONLY_SET
#define FLOW_TOCLIENT_IPONLY_SET
Definition: flow.h:58
Packet_::ts
struct timeval ts
Definition: decode.h:477
flow-manager.h
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:71
suricata-common.h
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:81
flow_config
FlowConfig flow_config
Definition: flow.c:99
FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
Definition: flow-private.h:47
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:70
FLOW_HAS_ALERTS
#define FLOW_HAS_ALERTS
Definition: flow.h:79
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:671
FlowSparePoolDestroy
void FlowSparePoolDestroy(void)
Definition: flow-spare-pool.c:264
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
SWAP_VARS
#define SWAP_VARS(type, a, b)
Definition: suricata-common.h:409
FlowTimeoutsInit
void FlowTimeoutsInit(void)
Definition: flow-manager.c:100
FLOW_PROTO_DETECT_TS_DONE
#define FLOW_PROTO_DETECT_TS_DONE
Definition: flow.h:100
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:255
FatalError
#define FatalError(x,...)
Definition: util-debug.h:530
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:480
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:284
FLOW_TS_PP_ALPROTO_DETECT_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
Definition: flow.h:84
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1203
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1196
FlowGetFlowFromHash
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
Definition: flow-hash.c:743
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:420
FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
Definition: flow-private.h:60
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:31
PKT_IS_ICMPV4
#define PKT_IS_ICMPV4(p)
Definition: decode.h:257
threadvars.h
util-validate.h
FlowSwap
void FlowSwap(Flow *f)
swap the flow's direction
Definition: flow.c:262
FlowCnf_::memcap_policy
enum ExceptionPolicy memcap_policy
Definition: flow.h:300
FlowGetAppProtocol
AppProto FlowGetAppProtocol(const Flow *f)
Definition: flow.c:1124
ICMPV4_IS_ERROR_MSG
#define ICMPV4_IS_ERROR_MSG(p)
Definition: decode-icmpv4.h:284
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FlowInitFlowProto
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
Definition: flow.c:717
SC_WARN_FLOW_EMERGENCY
@ SC_WARN_FLOW_EMERGENCY
Definition: util-error.h:192
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:283
flow_recycle_q
FlowQueue flow_recycle_q
Definition: flow-manager.c:81
SWAP_FLAGS
#define SWAP_FLAGS(flags, a, b)
Definition: suricata-common.h:398
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:69
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:242
CMP_PORT
#define CMP_PORT(p1, p2)
Definition: decode.h:246
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:664
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:461
ConfNode_
Definition: conf.h:32
Flow_::alstate
void * alstate
Definition: flow.h:486
flow_freefuncs
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
Definition: flow.c:97
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
flow_timeouts_emerg
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow.c:95
Flow_::flags
uint32_t flags
Definition: flow.h:431
FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
Definition: flow-private.h:63
FlowFreeStorage
void FlowFreeStorage(Flow *f)
Definition: flow-storage.c:59
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:674
FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:64
FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_TOCLIENT_DROP_LOGGED
Definition: flow.h:76
util-random.h
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:225
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:258
FLOW_EMERGENCY
#define FLOW_EMERGENCY
Definition: flow-private.h:37
suricata.h
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:40
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:76
FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
Definition: flow.h:88
FLOW_DEFAULT_EMERGENCY_RECOVERY
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
Definition: flow.c:70
FlowHasAlerts
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:181
FlowSparePoolInit
void FlowSparePoolInit(void)
Definition: flow-spare-pool.c:245
COPY_TIMESTAMP
#define COPY_TIMESTAMP(src, dst)
Definition: flow-util.h:29
FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
Definition: flow-private.h:56
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:61
FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
Definition: flow-private.h:53
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:525
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:213
Flow_::sp
Port sp
Definition: flow.h:358
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1141
TcpSession_
Definition: stream-tcp-private.h:271
util-misc.h
TcpSession_::data_first_seen_dir
int8_t data_first_seen_dir
Definition: stream-tcp-private.h:276
flow.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:462
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:433
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:460
Packet_::dp
Port dp
Definition: decode.h:449
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:108
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:399
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:302
FLOW_IPPROTO_TCP_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
Definition: flow-private.h:45
RegisterFlowStorageTests
void RegisterFlowStorageTests(void)
Definition: flow-storage.c:294
SET_DEFAULTS
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
flow-var.h
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:253
TOCLIENT
#define TOCLIENT
Definition: flow.h:44
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:228
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
Packet_::src
Address src
Definition: decode.h:438
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:503
IPV4_GET_IPTTL
#define IPV4_GET_IPTTL(p)
Definition: decode-ipv4.h:146
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:116
FlowProtoFreeFunc_
Definition: flow.h:530
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:798