suricata
flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow implementation.
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 
29 #include "action-globals.h"
30 #include "packet.h"
31 #include "decode.h"
32 #include "conf.h"
33 #include "threadvars.h"
34 #include "tm-threads.h"
35 #include "runmodes.h"
36 
37 #include "util-random.h"
38 #include "util-time.h"
39 
40 #include "flow.h"
41 #include "flow-queue.h"
42 #include "flow-hash.h"
43 #include "flow-util.h"
44 #include "flow-var.h"
45 #include "flow-private.h"
46 #include "flow-timeout.h"
47 #include "flow-manager.h"
48 #include "flow-storage.h"
49 #include "flow-bypass.h"
50 #include "flow-spare-pool.h"
51 
52 #include "stream-tcp-private.h"
53 #include "stream-tcp-reassemble.h"
54 #include "stream-tcp.h"
55 
56 #include "util-unittest.h"
57 #include "util-unittest-helper.h"
58 #include "util-byte.h"
59 #include "util-misc.h"
60 #include "util-macset.h"
61 
62 #include "util-debug.h"
63 #include "util-privs.h"
64 #include "util-validate.h"
65 
66 #include "detect.h"
67 #include "detect-engine-state.h"
68 #include "stream.h"
69 
70 #include "app-layer-parser.h"
71 #include "app-layer-expectation.h"
72 
73 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
74 
75 //#define FLOW_DEFAULT_HASHSIZE 262144
76 #define FLOW_DEFAULT_HASHSIZE 65536
77 //#define FLOW_DEFAULT_MEMCAP 128 * 1024 * 1024 /* 128 MB */
78 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32 MB */
79 
80 #define FLOW_DEFAULT_PREALLOC 10000
81 
83 
84 /** atomic int that is used when freeing a flow from the hash. In this
85  * case we walk the hash to find a flow to free. This var records where
86  * we left off in the hash. Without this only the top rows of the hash
87  * are freed. This isn't just about fairness. Under severe pressure, the
88  * hash rows on top would be all freed and the time to find a flow to
89  * free increased with every run. */
90 SC_ATOMIC_DECLARE(unsigned int, flow_prune_idx);
91 
92 /** atomic flags */
93 SC_ATOMIC_DECLARE(unsigned int, flow_flags);
94 
95 /** FlowProto specific timeouts and free/state functions */
96 
101 
103 
104 /** flow memuse counter (atomic), for enforcing memcap limit */
105 SC_ATOMIC_DECLARE(uint64_t, flow_memuse);
106 
107 void FlowRegisterTests(void);
108 void FlowInitFlowProto(void);
109 int FlowSetProtoFreeFunc(uint8_t, void (*Free)(void *));
110 
111 /* Run mode selected at suricata.c */
112 extern int run_mode;
113 
114 /**
115  * \brief Update memcap value
116  *
117  * \param size new memcap value
118  */
119 int FlowSetMemcap(uint64_t size)
120 {
121  if ((uint64_t)SC_ATOMIC_GET(flow_memuse) < size) {
122  SC_ATOMIC_SET(flow_config.memcap, size);
123  return 1;
124  }
125 
126  return 0;
127 }
128 
129 /**
130  * \brief Return memcap value
131  *
132  * \retval memcap value
133  */
134 uint64_t FlowGetMemcap(void)
135 {
136  uint64_t memcapcopy = SC_ATOMIC_GET(flow_config.memcap);
137  return memcapcopy;
138 }
139 
140 uint64_t FlowGetMemuse(void)
141 {
142  uint64_t memusecopy = SC_ATOMIC_GET(flow_memuse);
143  return memusecopy;
144 }
145 
147 {
148  if (f == NULL || f->proto == 0)
149  return;
150 
152  f->alstate = NULL;
153  f->alparser = NULL;
154  return;
155 }
156 
157 /** \brief Set the IPOnly scanned flag for 'direction'.
158  *
159  * \param f Flow to set the flag in
160  * \param direction direction to set the flag in
161  */
162 void FlowSetIPOnlyFlag(Flow *f, int direction)
163 {
164  direction ? (f->flags |= FLOW_TOSERVER_IPONLY_SET) :
166  return;
167 }
168 
169 /** \brief Set flag to indicate that flow has alerts
170  *
171  * \param f flow
172  */
174 {
175  f->flags |= FLOW_HAS_ALERTS;
176 }
177 
178 /** \brief Check if flow has alerts
179  *
180  * \param f flow
181  * \retval 1 has alerts
182  * \retval 0 has not alerts
183  */
184 int FlowHasAlerts(const Flow *f)
185 {
186  if (f->flags & FLOW_HAS_ALERTS) {
187  return 1;
188  }
189 
190  return 0;
191 }
192 
193 bool FlowHasGaps(const Flow *f, uint8_t way)
194 {
195  if (f->proto == IPPROTO_TCP) {
196  TcpSession *ssn = (TcpSession *)f->protoctx;
197  if (ssn != NULL) {
198  if (way == STREAM_TOCLIENT) {
200  return 1;
201  } else {
203  return 1;
204  }
205  }
206  }
207  return 0;
208 }
209 
210 /** \brief Set flag to indicate to change proto for the flow
211  *
212  * \param f flow
213  */
215 {
216  f->flags |= FLOW_CHANGE_PROTO;
217 }
218 
219 /** \brief Unset flag to indicate to change proto for the flow
220  *
221  * \param f flow
222  */
224 {
225  f->flags &= ~FLOW_CHANGE_PROTO;
226 }
227 
228 /** \brief Check if change proto flag is set for flow
229  * \param f flow
230  * \retval 1 change proto flag is set
231  * \retval 0 change proto flag is not set
232  */
234 {
235  if (f->flags & FLOW_CHANGE_PROTO) {
236  return 1;
237  }
238 
239  return 0;
240 }
241 
242 static inline void FlowSwapFlags(Flow *f)
243 {
247 
252 
254 }
255 
256 static inline void FlowSwapFileFlags(Flow *f)
257 {
264 }
265 
266 static inline void TcpStreamFlowSwap(Flow *f)
267 {
268  TcpSession *ssn = f->protoctx;
269  SWAP_VARS(TcpStream, ssn->server, ssn->client);
270  if (ssn->data_first_seen_dir & STREAM_TOSERVER) {
271  ssn->data_first_seen_dir = STREAM_TOCLIENT;
272  } else if (ssn->data_first_seen_dir & STREAM_TOCLIENT) {
273  ssn->data_first_seen_dir = STREAM_TOSERVER;
274  }
275 }
276 
277 /** \brief swap the flow's direction
278  * \note leaves the 'header' untouched. Interpret that based
279  * on FLOW_DIR_REVERSED flag.
280  * \warning: only valid before applayer parsing started. This
281  * function doesn't swap anything in Flow::alparser,
282  * Flow::alstate
283  */
284 void FlowSwap(Flow *f)
285 {
286  f->flags |= FLOW_DIR_REVERSED;
287 
290 
291  FlowSwapFlags(f);
292  FlowSwapFileFlags(f);
293 
294  SWAP_VARS(FlowThreadId, f->thread_id[0], f->thread_id[1]);
295 
296  if (f->proto == IPPROTO_TCP) {
297  TcpStreamFlowSwap(f);
298  }
299 
303 
304  /* not touching Flow::alparser and Flow::alstate */
305 
306  SWAP_VARS(const void *, f->sgh_toclient, f->sgh_toserver);
307 
308  SWAP_VARS(uint32_t, f->todstpktcnt, f->tosrcpktcnt);
309  SWAP_VARS(uint64_t, f->todstbytecnt, f->tosrcbytecnt);
310 }
311 
312 /**
313  * \brief determine the direction of the packet compared to the flow
314  * \retval 0 to_server
315  * \retval 1 to_client
316  */
317 int FlowGetPacketDirection(const Flow *f, const Packet *p)
318 {
319  const int reverse = (f->flags & FLOW_DIR_REVERSED) != 0;
320 
321  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
322  if (!(CMP_PORT(p->sp,p->dp))) {
323  /* update flags and counters */
324  if (CMP_PORT(f->sp,p->sp)) {
325  return TOSERVER ^ reverse;
326  } else {
327  return TOCLIENT ^ reverse;
328  }
329  } else {
330  if (CMP_ADDR(&f->src,&p->src)) {
331  return TOSERVER ^ reverse;
332  } else {
333  return TOCLIENT ^ reverse;
334  }
335  }
336  } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
337  if (CMP_ADDR(&f->src,&p->src)) {
338  return TOSERVER ^ reverse;
339  } else {
340  return TOCLIENT ^ reverse;
341  }
342  }
343 
344  /* default to toserver */
345  return TOSERVER;
346 }
347 
348 /**
349  * \brief Check to update "seen" flags
350  *
351  * \param p packet
352  *
353  * \retval 1 true
354  * \retval 0 false
355  */
356 static inline int FlowUpdateSeenFlag(const Packet *p)
357 {
358  if (PKT_IS_ICMPV4(p)) {
359  if (ICMPV4_IS_ERROR_MSG(p)) {
360  return 0;
361  }
362  }
363 
364  return 1;
365 }
366 
367 static inline void FlowUpdateTtlTS(Flow *f, Packet *p, uint8_t ttl)
368 {
369  if (f->min_ttl_toserver == 0) {
370  f->min_ttl_toserver = ttl;
371  } else {
372  f->min_ttl_toserver = MIN(f->min_ttl_toserver, ttl);
373  }
374  f->max_ttl_toserver = MAX(f->max_ttl_toserver, ttl);
375 }
376 
377 static inline void FlowUpdateTtlTC(Flow *f, Packet *p, uint8_t ttl)
378 {
379  if (f->min_ttl_toclient == 0) {
380  f->min_ttl_toclient = ttl;
381  } else {
382  f->min_ttl_toclient = MIN(f->min_ttl_toclient, ttl);
383  }
384  f->max_ttl_toclient = MAX(f->max_ttl_toclient, ttl);
385 }
386 
387 static inline void FlowUpdateEthernet(ThreadVars *tv, DecodeThreadVars *dtv,
388  Flow *f, EthernetHdr *ethh, bool toserver)
389 {
390  if (ethh && MacSetFlowStorageEnabled()) {
392  if (ms != NULL) {
393  if (toserver) {
394  MacSetAddWithCtr(ms, ethh->eth_src, ethh->eth_dst, tv,
397  } else {
398  MacSetAddWithCtr(ms, ethh->eth_dst, ethh->eth_src, tv,
401  }
402  }
403  }
404 }
405 
406 /** \brief Update Packet and Flow
407  *
408  * Updates packet and flow based on the new packet.
409  *
410  * \param f locked flow
411  * \param p packet
412  *
413  * \note overwrites p::flowflags
414  */
416 {
417  SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f);
418 
419  const int pkt_dir = FlowGetPacketDirection(f, p);
420 #ifdef CAPTURE_OFFLOAD
421  int state = f->flow_state;
422 
423  if (state != FLOW_STATE_CAPTURE_BYPASSED) {
424 #endif
425  /* update the last seen timestamp of this flow */
426  if (SCTIME_CMP_GT(p->ts, f->lastts)) {
427  f->lastts = p->ts;
428  const uint32_t timeout_at = (uint32_t)SCTIME_SECS(f->lastts) + f->timeout_policy;
429  if (timeout_at != f->timeout_at) {
430  f->timeout_at = timeout_at;
431  }
432  }
433 #ifdef CAPTURE_OFFLOAD
434  } else {
435  /* still seeing packet, we downgrade to local bypass */
436  if (SCTIME_SECS(p->ts) - SCTIME_SECS(f->lastts) > FLOW_BYPASSED_TIMEOUT / 2) {
437  SCLogDebug("Downgrading flow to local bypass");
438  f->lastts = p->ts;
440  } else {
441  /* In IPS mode the packet could come from the other interface so it would
442  * need to be bypassed */
443  if (EngineModeIsIPS()) {
444  BypassedFlowUpdate(f, p);
445  }
446  }
447  }
448 #endif
449  /* update flags and counters */
450  if (pkt_dir == TOSERVER) {
451  f->todstpktcnt++;
452  f->todstbytecnt += GET_PKT_LEN(p);
454  if (!(f->flags & FLOW_TO_DST_SEEN)) {
455  if (FlowUpdateSeenFlag(p)) {
456  f->flags |= FLOW_TO_DST_SEEN;
458  }
459  }
460  /* xfer proto detect ts flag to first packet in ts dir */
461  if (f->flags & FLOW_PROTO_DETECT_TS_DONE) {
464  }
465  FlowUpdateEthernet(tv, dtv, f, p->ethh, true);
466  /* update flow's ttl fields if needed */
467  if (PKT_IS_IPV4(p)) {
468  FlowUpdateTtlTS(f, p, IPV4_GET_IPTTL(p));
469  } else if (PKT_IS_IPV6(p)) {
470  FlowUpdateTtlTS(f, p, IPV6_GET_HLIM(p));
471  }
472  } else {
473  f->tosrcpktcnt++;
474  f->tosrcbytecnt += GET_PKT_LEN(p);
476  if (!(f->flags & FLOW_TO_SRC_SEEN)) {
477  if (FlowUpdateSeenFlag(p)) {
478  f->flags |= FLOW_TO_SRC_SEEN;
480  }
481  }
482  /* xfer proto detect tc flag to first packet in tc dir */
483  if (f->flags & FLOW_PROTO_DETECT_TC_DONE) {
486  }
487  FlowUpdateEthernet(tv, dtv, f, p->ethh, false);
488  /* update flow's ttl fields if needed */
489  if (PKT_IS_IPV4(p)) {
490  FlowUpdateTtlTC(f, p, IPV4_GET_IPTTL(p));
491  } else if (PKT_IS_IPV6(p)) {
492  FlowUpdateTtlTC(f, p, IPV6_GET_HLIM(p));
493  }
494  }
495 
497  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
499 
500  } else if (f->proto == IPPROTO_TCP) {
501  TcpSession *ssn = (TcpSession *)f->protoctx;
502  if (ssn != NULL && ssn->state >= TCP_ESTABLISHED) {
504  }
505  } else if ((f->flags & (FLOW_TO_DST_SEEN|FLOW_TO_SRC_SEEN)) ==
507  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
509 
511  }
512 
513  if (f->flags & FLOW_ACTION_DROP) {
515  }
516  /*set the detection bypass flags*/
517  if (f->flags & FLOW_NOPACKET_INSPECTION) {
518  SCLogDebug("setting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
519  DecodeSetNoPacketInspectionFlag(p);
520  }
521  if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
522  SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
523  DecodeSetNoPayloadInspectionFlag(p);
524  }
525 }
526 
527 /** \brief Entry point for packet flow handling
528  *
529  * This is called for every packet.
530  *
531  * \param tv threadvars
532  * \param dtv decode thread vars (for flow output api thread data)
533  * \param p packet to handle flow for
534  */
536 {
537  /* Get this packet's flow from the hash. FlowHandlePacket() will setup
538  * a new flow if necessary. If we get NULL, we're out of flow memory.
539  * The returned flow is locked. */
540  Flow *f = FlowGetFlowFromHash(tv, fls, p, &p->flow);
541  if (f != NULL) {
542  /* set the flow in the packet */
543  p->flags |= PKT_HAS_FLOW;
544  }
545 }
546 
547 /** \brief initialize the configuration
548  * \warning Not thread safe */
549 void FlowInitConfig(bool quiet)
550 {
551  SCLogDebug("initializing flow engine...");
552 
553  memset(&flow_config, 0, sizeof(flow_config));
554  SC_ATOMIC_INIT(flow_flags);
555  SC_ATOMIC_INIT(flow_memuse);
556  SC_ATOMIC_INIT(flow_prune_idx);
557  SC_ATOMIC_INIT(flow_config.memcap);
559 
560  /* set defaults */
561  flow_config.hash_rand = (uint32_t)RandomGet();
565 
566  /* If we have specific config, overwrite the defaults with them,
567  * otherwise, leave the default values */
568  intmax_t val = 0;
569  if (ConfGetInt("flow.emergency-recovery", &val) == 1) {
570  if (val <= 100 && val >= 1) {
571  flow_config.emergency_recovery = (uint8_t)val;
572  } else {
573  SCLogError("flow.emergency-recovery must be in the range of "
574  "1 and 100 (as percentage)");
576  }
577  } else {
578  SCLogDebug("flow.emergency-recovery, using default value");
580  }
581 
582  /* Check if we have memcap and hash_size defined at config */
583  const char *conf_val;
584  uint32_t configval = 0;
585 
586  /** set config values for memcap, prealloc and hash_size */
587  uint64_t flow_memcap_copy = 0;
588  if ((ConfGet("flow.memcap", &conf_val)) == 1)
589  {
590  if (conf_val == NULL) {
591  FatalError("Invalid value for flow.memcap: NULL");
592  }
593 
594  if (ParseSizeStringU64(conf_val, &flow_memcap_copy) < 0) {
595  SCLogError("Error parsing flow.memcap "
596  "from conf file - %s. Killing engine",
597  conf_val);
598  exit(EXIT_FAILURE);
599  } else {
600  SC_ATOMIC_SET(flow_config.memcap, flow_memcap_copy);
601  }
602  }
603  if ((ConfGet("flow.hash-size", &conf_val)) == 1)
604  {
605  if (conf_val == NULL) {
606  FatalError("Invalid value for flow.hash-size: NULL");
607  }
608 
609  if (StringParseUint32(&configval, 10, strlen(conf_val), conf_val) && configval != 0) {
610  flow_config.hash_size = configval;
611  } else {
612  FatalError("Invalid value for flow.hash-size. Must be a numeric value in the range "
613  "1-4294967295");
614  }
615  }
616  if ((ConfGet("flow.prealloc", &conf_val)) == 1)
617  {
618  if (conf_val == NULL) {
619  FatalError("Invalid value for flow.prealloc: NULL");
620  }
621 
622  if (StringParseUint32(&configval, 10, strlen(conf_val),
623  conf_val) > 0) {
624  flow_config.prealloc = configval;
625  }
626  }
627 
628  flow_config.memcap_policy = ExceptionPolicyParse("flow.memcap-policy", false);
629 
630  SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: "
631  "%"PRIu32", prealloc: %"PRIu32, SC_ATOMIC_GET(flow_config.memcap),
633 
634  /* alloc hash memory */
635  uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket);
636  if (!(FLOW_CHECK_MEMCAP(hash_size))) {
637  SCLogError("allocating flow hash failed: "
638  "max flow memcap is smaller than projected hash size. "
639  "Memcap: %" PRIu64 ", Hash table size %" PRIu64 ". Calculate "
640  "total hash size by multiplying \"flow.hash-size\" with %" PRIuMAX ", "
641  "which is the hash bucket size.",
642  SC_ATOMIC_GET(flow_config.memcap), hash_size, (uintmax_t)sizeof(FlowBucket));
643  exit(EXIT_FAILURE);
644  }
645  flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS);
646  if (unlikely(flow_hash == NULL)) {
647  FatalError("Fatal error encountered in FlowInitConfig. Exiting...");
648  }
649  memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket));
650 
651  uint32_t i = 0;
652  for (i = 0; i < flow_config.hash_size; i++) {
653  FBLOCK_INIT(&flow_hash[i]);
654  SC_ATOMIC_INIT(flow_hash[i].next_ts);
655  }
656  (void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket)));
657 
658  if (!quiet) {
659  SCLogConfig("allocated %"PRIu64" bytes of memory for the flow hash... "
660  "%" PRIu32 " buckets of size %" PRIuMAX "",
661  SC_ATOMIC_GET(flow_memuse), flow_config.hash_size,
662  (uintmax_t)sizeof(FlowBucket));
663  }
665  if (!quiet) {
666  SCLogConfig("flow memory usage: %"PRIu64" bytes, maximum: %"PRIu64,
667  SC_ATOMIC_GET(flow_memuse), SC_ATOMIC_GET(flow_config.memcap));
668  }
669 
671 
672  uint32_t sz = sizeof(Flow) + FlowStorageSize();
673  SCLogConfig("flow size %u, memcap allows for %" PRIu64 " flows. Per hash row in perfect "
674  "conditions %" PRIu64,
675  sz, flow_memcap_copy / sz, (flow_memcap_copy / sz) / flow_config.hash_size);
676  return;
677 }
678 
679 void FlowReset(void)
680 {
681  // resets the flows (for reuse by fuzzing)
682  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
683  Flow *f = flow_hash[u].head;
684  while (f) {
685  Flow *n = f->next;
686  uint8_t proto_map = FlowGetProtoMapping(f->proto);
687  FlowClearMemory(f, proto_map);
688  FlowFree(f);
689  f = n;
690  }
691  flow_hash[u].head = NULL;
692  }
693 }
694 
695 /** \brief shutdown the flow engine
696  * \warning Not thread safe */
697 void FlowShutdown(void)
698 {
699  Flow *f;
700  while ((f = FlowDequeue(&flow_recycle_q))) {
701  FlowFree(f);
702  }
703 
704  /* clear and free the hash */
705  if (flow_hash != NULL) {
706  /* clean up flow mutexes */
707  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
708  f = flow_hash[u].head;
709  while (f) {
710  Flow *n = f->next;
711  uint8_t proto_map = FlowGetProtoMapping(f->proto);
712  FlowClearMemory(f, proto_map);
713  FlowFree(f);
714  f = n;
715  }
716  f = flow_hash[u].evicted;
717  while (f) {
718  Flow *n = f->next;
719  uint8_t proto_map = FlowGetProtoMapping(f->proto);
720  FlowClearMemory(f, proto_map);
721  FlowFree(f);
722  f = n;
723  }
724 
726  }
728  flow_hash = NULL;
729  }
730  (void) SC_ATOMIC_SUB(flow_memuse, flow_config.hash_size * sizeof(FlowBucket));
733  return;
734 }
735 
736 /**
737  * \brief Function to set the default timeout, free function and flow state
738  * function for all supported flow_proto.
739  */
740 
742 {
744 
745 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
746  flow_timeouts_normal[(p)].new_timeout = (n); \
747  flow_timeouts_normal[(p)].est_timeout = (e); \
748  flow_timeouts_normal[(p)].closed_timeout = (c); \
749  flow_timeouts_normal[(p)].bypassed_timeout = (b); \
750  flow_timeouts_emerg[(p)].new_timeout = (ne); \
751  flow_timeouts_emerg[(p)].est_timeout = (ee); \
752  flow_timeouts_emerg[(p)].closed_timeout = (ce); \
753  flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
754 
775 
780 
781  /* Let's see if we have custom timeouts defined from config */
782  const char *new = NULL;
783  const char *established = NULL;
784  const char *closed = NULL;
785  const char *bypassed = NULL;
786  const char *emergency_new = NULL;
787  const char *emergency_established = NULL;
788  const char *emergency_closed = NULL;
789  const char *emergency_bypassed = NULL;
790 
791  ConfNode *flow_timeouts = ConfGetNode("flow-timeouts");
792  if (flow_timeouts != NULL) {
793  ConfNode *proto = NULL;
794  uint32_t configval = 0;
795 
796  /* Defaults. */
797  proto = ConfNodeLookupChild(flow_timeouts, "default");
798  if (proto != NULL) {
799  new = ConfNodeLookupChildValue(proto, "new");
800  established = ConfNodeLookupChildValue(proto, "established");
801  closed = ConfNodeLookupChildValue(proto, "closed");
802  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
803  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
804  emergency_established = ConfNodeLookupChildValue(proto,
805  "emergency-established");
806  emergency_closed = ConfNodeLookupChildValue(proto,
807  "emergency-closed");
808  emergency_bypassed = ConfNodeLookupChildValue(proto,
809  "emergency-bypassed");
810 
811  if (new != NULL &&
812  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
813 
815  }
816  if (established != NULL &&
817  StringParseUint32(&configval, 10, strlen(established),
818  established) > 0) {
819 
821  }
822  if (closed != NULL &&
823  StringParseUint32(&configval, 10, strlen(closed),
824  closed) > 0) {
825 
827  }
828  if (bypassed != NULL &&
829  StringParseUint32(&configval, 10,
830  strlen(bypassed),
831  bypassed) > 0) {
832 
834  }
835  if (emergency_new != NULL &&
836  StringParseUint32(&configval, 10, strlen(emergency_new),
837  emergency_new) > 0) {
838 
840  }
841  if (emergency_established != NULL &&
842  StringParseUint32(&configval, 10,
843  strlen(emergency_established),
844  emergency_established) > 0) {
845 
847  }
848  if (emergency_closed != NULL &&
849  StringParseUint32(&configval, 10,
850  strlen(emergency_closed),
851  emergency_closed) > 0) {
852 
854  }
855  if (emergency_bypassed != NULL &&
856  StringParseUint32(&configval, 10,
857  strlen(emergency_bypassed),
858  emergency_bypassed) > 0) {
859 
861  }
862  }
863 
864  /* TCP. */
865  proto = ConfNodeLookupChild(flow_timeouts, "tcp");
866  if (proto != NULL) {
867  new = ConfNodeLookupChildValue(proto, "new");
868  established = ConfNodeLookupChildValue(proto, "established");
869  closed = ConfNodeLookupChildValue(proto, "closed");
870  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
871  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
872  emergency_established = ConfNodeLookupChildValue(proto,
873  "emergency-established");
874  emergency_closed = ConfNodeLookupChildValue(proto,
875  "emergency-closed");
876  emergency_bypassed = ConfNodeLookupChildValue(proto,
877  "emergency-bypassed");
878 
879  if (new != NULL &&
880  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
881 
883  }
884  if (established != NULL &&
885  StringParseUint32(&configval, 10, strlen(established),
886  established) > 0) {
887 
889  }
890  if (closed != NULL &&
891  StringParseUint32(&configval, 10, strlen(closed),
892  closed) > 0) {
893 
895  }
896  if (bypassed != NULL &&
897  StringParseUint32(&configval, 10,
898  strlen(bypassed),
899  bypassed) > 0) {
900 
902  }
903  if (emergency_new != NULL &&
904  StringParseUint32(&configval, 10, strlen(emergency_new),
905  emergency_new) > 0) {
906 
908  }
909  if (emergency_established != NULL &&
910  StringParseUint32(&configval, 10,
911  strlen(emergency_established),
912  emergency_established) > 0) {
913 
915  }
916  if (emergency_closed != NULL &&
917  StringParseUint32(&configval, 10,
918  strlen(emergency_closed),
919  emergency_closed) > 0) {
920 
922  }
923  if (emergency_bypassed != NULL &&
924  StringParseUint32(&configval, 10,
925  strlen(emergency_bypassed),
926  emergency_bypassed) > 0) {
927 
929  }
930  }
931 
932  /* UDP. */
933  proto = ConfNodeLookupChild(flow_timeouts, "udp");
934  if (proto != NULL) {
935  new = ConfNodeLookupChildValue(proto, "new");
936  established = ConfNodeLookupChildValue(proto, "established");
937  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
938  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
939  emergency_established = ConfNodeLookupChildValue(proto,
940  "emergency-established");
941  emergency_bypassed = ConfNodeLookupChildValue(proto,
942  "emergency-bypassed");
943 
944  if (new != NULL &&
945  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
946 
948  }
949  if (established != NULL &&
950  StringParseUint32(&configval, 10, strlen(established),
951  established) > 0) {
952 
954  }
955  if (bypassed != NULL &&
956  StringParseUint32(&configval, 10,
957  strlen(bypassed),
958  bypassed) > 0) {
959 
961  }
962  if (emergency_new != NULL &&
963  StringParseUint32(&configval, 10, strlen(emergency_new),
964  emergency_new) > 0) {
965 
967  }
968  if (emergency_established != NULL &&
969  StringParseUint32(&configval, 10,
970  strlen(emergency_established),
971  emergency_established) > 0) {
972 
974  }
975  if (emergency_bypassed != NULL &&
976  StringParseUint32(&configval, 10,
977  strlen(emergency_bypassed),
978  emergency_bypassed) > 0) {
979 
981  }
982  }
983 
984  /* ICMP. */
985  proto = ConfNodeLookupChild(flow_timeouts, "icmp");
986  if (proto != NULL) {
987  new = ConfNodeLookupChildValue(proto, "new");
988  established = ConfNodeLookupChildValue(proto, "established");
989  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
990  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
991  emergency_established = ConfNodeLookupChildValue(proto,
992  "emergency-established");
993  emergency_bypassed = ConfNodeLookupChildValue(proto,
994  "emergency-bypassed");
995 
996  if (new != NULL &&
997  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
998 
1000  }
1001  if (established != NULL &&
1002  StringParseUint32(&configval, 10, strlen(established),
1003  established) > 0) {
1004 
1006  }
1007  if (bypassed != NULL &&
1008  StringParseUint32(&configval, 10,
1009  strlen(bypassed),
1010  bypassed) > 0) {
1011 
1013  }
1014  if (emergency_new != NULL &&
1015  StringParseUint32(&configval, 10, strlen(emergency_new),
1016  emergency_new) > 0) {
1017 
1019  }
1020  if (emergency_established != NULL &&
1021  StringParseUint32(&configval, 10,
1022  strlen(emergency_established),
1023  emergency_established) > 0) {
1024 
1026  }
1027  if (emergency_bypassed != NULL &&
1028  StringParseUint32(&configval, 10,
1029  strlen(emergency_bypassed),
1030  emergency_bypassed) > 0) {
1031 
1033  }
1034  }
1035  }
1036 
1037  /* validate and if needed update emergency timeout values */
1038  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
1039  const FlowProtoTimeout *n = &flow_timeouts_normal[i];
1041 
1042  if (e->est_timeout > n->est_timeout) {
1043  SCLogWarning("emergency timeout value %u for \'established\' "
1044  "must be below regular value %u",
1045  e->est_timeout, n->est_timeout);
1046  e->est_timeout = n->est_timeout / 10;
1047  }
1048 
1049  if (e->new_timeout > n->new_timeout) {
1050  SCLogWarning("emergency timeout value %u for \'new\' must be "
1051  "below regular value %u",
1052  e->new_timeout, n->new_timeout);
1053  e->new_timeout = n->new_timeout / 10;
1054  }
1055 
1056  if (e->closed_timeout > n->closed_timeout) {
1057  SCLogWarning("emergency timeout value %u for \'closed\' must "
1058  "be below regular value %u",
1060  e->closed_timeout = n->closed_timeout / 10;
1061  }
1062 
1063  if (e->bypassed_timeout > n->bypassed_timeout) {
1064  SCLogWarning("emergency timeout value %u for \'bypassed\' "
1065  "must be below regular value %u",
1067  e->bypassed_timeout = n->bypassed_timeout / 10;
1068  }
1069  }
1070 
1071  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
1075 
1076  if (e->est_timeout > n->est_timeout) {
1077  SCLogWarning("emergency timeout value for \'established\' must be below normal value");
1078  e->est_timeout = n->est_timeout / 10;
1079  }
1080  d->est_timeout = n->est_timeout - e->est_timeout;
1081 
1082  if (e->new_timeout > n->new_timeout) {
1083  SCLogWarning("emergency timeout value for \'new\' must be below normal value");
1084  e->new_timeout = n->new_timeout / 10;
1085  }
1086  d->new_timeout = n->new_timeout - e->new_timeout;
1087 
1088  if (e->closed_timeout > n->closed_timeout) {
1089  SCLogWarning("emergency timeout value for \'closed\' must be below normal value");
1090  e->closed_timeout = n->closed_timeout / 10;
1091  }
1093 
1094  if (e->bypassed_timeout > n->bypassed_timeout) {
1095  SCLogWarning("emergency timeout value for \'bypassed\' must be below normal value");
1096  e->bypassed_timeout = n->bypassed_timeout / 10;
1097  }
1099 
1100  SCLogDebug("deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1102  }
1103 
1104  return;
1105 }
1106 
1107 /**
1108  * \brief Function clear the flow memory before queueing it to spare flow
1109  * queue.
1110  *
1111  * \param f pointer to the flow needed to be cleared.
1112  * \param proto_map mapped value of the protocol to FLOW_PROTO's.
1113  */
1114 
1115 int FlowClearMemory(Flow* f, uint8_t proto_map)
1116 {
1117  SCEnter();
1118 
1119  if (unlikely(f->flags & FLOW_HAS_EXPECTATION)) {
1121  }
1122 
1123  /* call the protocol specific free function if we have one */
1124  if (flow_freefuncs[proto_map].Freefunc != NULL) {
1125  flow_freefuncs[proto_map].Freefunc(f->protoctx);
1126  }
1127 
1128  FlowFreeStorage(f);
1129 
1130  FLOW_RECYCLE(f);
1131 
1132  SCReturnInt(1);
1133 }
1134 
1135 /**
1136  * \brief Function to set the function to get protocol specific flow state.
1137  *
1138  * \param proto protocol of which function is needed to be set.
1139  * \param Free Function pointer which will be called to free the protocol
1140  * specific memory.
1141  */
1142 
1143 int FlowSetProtoFreeFunc (uint8_t proto, void (*Free)(void *))
1144 {
1145  uint8_t proto_map;
1146  proto_map = FlowGetProtoMapping(proto);
1147 
1148  flow_freefuncs[proto_map].Freefunc = Free;
1149  return 1;
1150 }
1151 
1152 /**
1153  * \brief get 'disruption' flags: GAP/DEPTH/PASS
1154  * \param f locked flow
1155  * \param flags existing flags to be amended
1156  * \retval flags original flags + disrupt flags (if any)
1157  * \TODO handle UDP
1158  */
1159 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
1160 {
1161  if (f->proto != IPPROTO_TCP) {
1162  return flags;
1163  }
1164  if (f->protoctx == NULL) {
1165  return flags;
1166  }
1167 
1168  uint8_t newflags = flags;
1169  TcpSession *ssn = f->protoctx;
1170  TcpStream *stream = flags & STREAM_TOSERVER ? &ssn->client : &ssn->server;
1171 
1173  newflags |= STREAM_DEPTH;
1174  }
1175  /* todo: handle pass case (also for UDP!) */
1176 
1177  return newflags;
1178 }
1179 
1180 void FlowUpdateState(Flow *f, const enum FlowState s)
1181 {
1182  if (s != f->flow_state) {
1183  /* set the state */
1184  // Explicit cast from the enum type to the compact version
1185  f->flow_state = (FlowStateType)s;
1186 
1187  /* update timeout policy and value */
1188  const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1189  if (timeout_policy != f->timeout_policy) {
1190  f->timeout_policy = timeout_policy;
1191  const uint32_t timeout_at = (uint32_t)SCTIME_SECS(f->lastts) + timeout_policy;
1192  if (timeout_at != f->timeout_at)
1193  f->timeout_at = timeout_at;
1194  }
1195  }
1196 #ifdef UNITTESTS
1197  if (f->fb != NULL) {
1198 #endif
1199  /* and reset the flow bucket next_ts value so that the flow manager
1200  * has to revisit this row */
1201  SC_ATOMIC_SET(f->fb->next_ts, 0);
1202 #ifdef UNITTESTS
1203  }
1204 #endif
1205 }
1206 
1207 /**
1208  * \brief Get flow last time as individual values.
1209  *
1210  * Instead of returning a pointer to the timeval copy the timeval
1211  * parts into output pointers to make it simpler to call from Rust
1212  * over FFI using only basic data types.
1213  */
1214 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
1215 {
1216  *secs = (uint64_t)SCTIME_SECS(flow->lastts);
1217  *usecs = (uint64_t)SCTIME_USECS(flow->lastts);
1218 }
1219 
1220 /**
1221  * \brief Get flow source port.
1222  *
1223  * A function to get the flow sport useful when the caller only has an
1224  * opaque pointer to the flow structure.
1225  */
1226 uint16_t FlowGetSourcePort(Flow *flow)
1227 {
1228  return flow->sp;
1229 }
1230 
1231 /**
1232  * \brief Get flow destination port.
1233  *
1234  * A function to get the flow dport useful when the caller only has an
1235  * opaque pointer to the flow structure.
1236  */
1237 
1239 {
1240  return flow->dp;
1241 }
1242 /**
1243  * \brief Get flow flags.
1244  *
1245  * A function to get the flow flags useful when the caller only has an
1246  * opaque pointer to the flow structure.
1247  */
1248 
1249 uint32_t FlowGetFlags(Flow *flow)
1250 {
1251  return flow->flags;
1252 }
1253 /************************************Unittests*******************************/
1254 
1255 #ifdef UNITTESTS
1256 #include "threads.h"
1257 
1258 /**
1259  * \test Test the setting of the per protocol timeouts.
1260  *
1261  * \retval On success it returns 1 and on failure 0.
1262  */
1263 
1264 static int FlowTest01 (void)
1265 {
1266  uint8_t proto_map;
1267 
1269  proto_map = FlowGetProtoMapping(IPPROTO_TCP);
1270  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_TCP_NEW_TIMEOUT);
1271  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_TCP_EST_TIMEOUT);
1274 
1275  proto_map = FlowGetProtoMapping(IPPROTO_UDP);
1276  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_UDP_NEW_TIMEOUT);
1277  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_UDP_EST_TIMEOUT);
1280 
1281  proto_map = FlowGetProtoMapping(IPPROTO_ICMP);
1282  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_ICMP_NEW_TIMEOUT);
1283  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_ICMP_EST_TIMEOUT);
1286 
1287  proto_map = FlowGetProtoMapping(IPPROTO_DCCP);
1288  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_DEFAULT_NEW_TIMEOUT);
1289  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_DEFAULT_EST_TIMEOUT);
1290  FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_DEFAULT_EMERG_NEW_TIMEOUT);
1291  FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_DEFAULT_EMERG_EST_TIMEOUT);
1292 
1293  PASS;
1294 }
1295 
1296 /*Test function for the unit test FlowTest02*/
1297 
1298 static void test(void *f) {}
1299 
1300 /**
1301  * \test Test the setting of the per protocol free function to free the
1302  * protocol specific memory.
1303  *
1304  * \retval On success it returns 1 and on failure 0.
1305  */
1306 
1307 static int FlowTest02 (void)
1308 {
1310  FlowSetProtoFreeFunc(IPPROTO_TCP, test);
1311  FlowSetProtoFreeFunc(IPPROTO_UDP, test);
1312  FlowSetProtoFreeFunc(IPPROTO_ICMP, test);
1313 
1314  FAIL_IF(flow_freefuncs[FLOW_PROTO_DEFAULT].Freefunc != test);
1315  FAIL_IF(flow_freefuncs[FLOW_PROTO_TCP].Freefunc != test);
1316  FAIL_IF(flow_freefuncs[FLOW_PROTO_UDP].Freefunc != test);
1317  FAIL_IF(flow_freefuncs[FLOW_PROTO_ICMP].Freefunc != test);
1318 
1319  PASS;
1320 }
1321 
1322 /**
1323  * \test Test flow allocations when it reach memcap
1324  *
1325  *
1326  * \retval On success it returns 1 and on failure 0.
1327  */
1328 
1329 static int FlowTest07 (void)
1330 {
1331  int result = 0;
1333  FlowConfig backup;
1334  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1335 
1336  uint32_t ini = 0;
1337  uint32_t end = FlowSpareGetPoolSize();
1338  SC_ATOMIC_SET(flow_config.memcap, 10000);
1339  flow_config.prealloc = 100;
1340 
1341  /* Let's get the flow spare pool empty */
1342  UTHBuildPacketOfFlows(ini, end, 0);
1343 
1344  /* And now let's try to reach the memcap val */
1345  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1346  ini = end + 1;
1347  end = end + 2;
1348  UTHBuildPacketOfFlows(ini, end, 0);
1349  }
1350 
1351  /* should time out normal */
1352  TimeSetIncrementTime(2000);
1353  ini = end + 1;
1354  end = end + 2;
1355  UTHBuildPacketOfFlows(ini, end, 0);
1356 
1357  /* This means that the engine entered emerg mode: should happen as easy
1358  * with flow mgr activated */
1359  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1360  result = 1;
1361 
1362  FlowShutdown();
1363  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1364 
1365  return result;
1366 }
1367 
1368 /**
1369  * \test Test flow allocations when it reach memcap
1370  *
1371  *
1372  * \retval On success it returns 1 and on failure 0.
1373  */
1374 
1375 static int FlowTest08 (void)
1376 {
1377  int result = 0;
1378 
1380  FlowConfig backup;
1381  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1382 
1383  uint32_t ini = 0;
1384  uint32_t end = FlowSpareGetPoolSize();
1385  SC_ATOMIC_SET(flow_config.memcap, 10000);
1386  flow_config.prealloc = 100;
1387 
1388  /* Let's get the flow spare pool empty */
1389  UTHBuildPacketOfFlows(ini, end, 0);
1390 
1391  /* And now let's try to reach the memcap val */
1392  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1393  ini = end + 1;
1394  end = end + 2;
1395  UTHBuildPacketOfFlows(ini, end, 0);
1396  }
1397 
1398  /* By default we use 30 for timing out new flows. This means
1399  * that the Emergency mode should be set */
1401  ini = end + 1;
1402  end = end + 2;
1403  UTHBuildPacketOfFlows(ini, end, 0);
1404 
1405  /* This means that the engine released 5 flows by emergency timeout */
1406  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1407  result = 1;
1408 
1409  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1410  FlowShutdown();
1411 
1412  return result;
1413 }
1414 
1415 /**
1416  * \test Test flow allocations when it reach memcap
1417  *
1418  *
1419  * \retval On success it returns 1 and on failure 0.
1420  */
1421 
1422 static int FlowTest09 (void)
1423 {
1424  int result = 0;
1425 
1427  FlowConfig backup;
1428  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1429 
1430  uint32_t ini = 0;
1431  uint32_t end = FlowSpareGetPoolSize();
1432  SC_ATOMIC_SET(flow_config.memcap, 10000);
1433  flow_config.prealloc = 100;
1434 
1435  /* Let's get the flow spare pool empty */
1436  UTHBuildPacketOfFlows(ini, end, 0);
1437 
1438  /* And now let's try to reach the memcap val */
1439  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1440  ini = end + 1;
1441  end = end + 2;
1442  UTHBuildPacketOfFlows(ini, end, 0);
1443  }
1444 
1445  /* No timeout will work */
1447  ini = end + 1;
1448  end = end + 2;
1449  UTHBuildPacketOfFlows(ini, end, 0);
1450 
1451  /* engine in emerg mode */
1452  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1453  result = 1;
1454 
1455  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1456  FlowShutdown();
1457 
1458  return result;
1459 }
1460 
1461 #endif /* UNITTESTS */
1462 
1463 /**
1464  * \brief Function to register the Flow Unitests.
1465  */
1467 {
1468 #ifdef UNITTESTS
1469  UtRegisterTest("FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1470  UtRegisterTest("FlowTest02 -- Setting Protocol Specific Free Function",
1471  FlowTest02);
1472  UtRegisterTest("FlowTest07 -- Test flow Allocations when it reach memcap",
1473  FlowTest07);
1474  UtRegisterTest("FlowTest08 -- Test flow Allocations when it reach memcap",
1475  FlowTest08);
1476  UtRegisterTest("FlowTest09 -- Test flow Allocations when it reach memcap",
1477  FlowTest09);
1478 
1480 #endif /* UNITTESTS */
1481 }
FLOWFILE_NO_MD5_TS
#define FLOWFILE_NO_MD5_TS
Definition: flow.h:130
util-byte.h
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:223
FLOWFILE_NO_MD5_TC
#define FLOWFILE_NO_MD5_TC
Definition: flow.h:131
FBLOCK_DESTROY
#define FBLOCK_DESTROY(fb)
Definition: flow-hash.h:72
FLOW_DEFAULT_NEW_TIMEOUT
#define FLOW_DEFAULT_NEW_TIMEOUT
Definition: flow-private.h:40
tm-threads.h
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:399
Packet_::proto
uint8_t proto
Definition: decode.h:458
FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
Definition: flow-private.h:56
TcpStream_
Definition: stream-tcp-private.h:106
FLOWFILE_NO_SIZE_TS
#define FLOWFILE_NO_SIZE_TS
Definition: flow.h:142
flow-bypass.h
FLOW_HAS_EXPECTATION
#define FLOW_HAS_EXPECTATION
Definition: flow.h:110
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
Definition: flow.c:173
FLOWFILE_NO_SIZE_TC
#define FLOWFILE_NO_SIZE_TC
Definition: flow.h:143
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:146
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
Definition: flow.c:214
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1018
FlowSpareGetPoolSize
uint32_t FlowSpareGetPoolSize(void)
Definition: flow-spare-pool.c:47
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:317
FLOW_PROTO_ICMP
@ FLOW_PROTO_ICMP
Definition: flow-private.h:70
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:501
flow-util.h
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:314
FBLOCK_INIT
#define FBLOCK_INIT(fb)
Definition: flow-hash.h:71
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:246
CLS
#define CLS
Definition: suricata-common.h:56
stream-tcp.h
MacSetAddWithCtr
void MacSetAddWithCtr(MacSet *ms, uint8_t *src_addr, uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
Definition: util-macset.c:180
FLOW_DEFAULT_HASHSIZE
#define FLOW_DEFAULT_HASHSIZE
Definition: flow.c:76
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:294
FLOW_DEFAULT_PREALLOC
#define FLOW_DEFAULT_PREALLOC
Definition: flow.c:80
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:386
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:288
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1466
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:60
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:71
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:607
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:198
Flow_::proto
uint8_t proto
Definition: flow.h:372
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
action-globals.h
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:123
Packet_::flags
uint32_t flags
Definition: decode.h:473
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
threads.h
util-macset.h
FlowGetFlags
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
Definition: flow.c:1249
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:350
run_mode
int run_mode
Definition: suricata.c:176
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:332
FlowProtoTimeout_
Definition: flow.h:514
flow-hash.h
FlowGetSourcePort
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
Definition: flow.c:1226
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:63
FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
Definition: flow.h:82
FlowReset
void FlowReset(void)
Definition: flow.c:679
FlowLookupStruct_
Definition: flow.h:538
FLOW_DEFAULT_EMERG_NEW_TIMEOUT
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
Definition: flow-private.h:54
Flow
struct Flow_ Flow
Flow data structure.
FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:57
BypassedFlowUpdate
void BypassedFlowUpdate(Flow *f, Packet *p)
Definition: flow-bypass.c:211
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:518
FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_DEFAULT_EST_TIMEOUT
Definition: flow-private.h:41
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:222
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:155
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:140
MIN
#define MIN(x, y)
Definition: suricata-common.h:391
IPPROTO_DCCP
#define IPPROTO_DCCP
Definition: decode.h:938
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:134
FlowQueueDestroy
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
Definition: flow-queue.c:60
util-privs.h
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:535
stream-tcp-reassemble.h
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:66
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
RandomGet
long int RandomGet(void)
Definition: util-random.c:130
FLOW_TOSERVER_DROP_LOGGED
#define FLOW_TOSERVER_DROP_LOGGED
Definition: flow.h:74
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:467
proto
uint8_t proto
Definition: decode-template.h:0
Flow_::dp
Port dp
Definition: flow.h:366
FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
Definition: flow.h:92
FLOW_DEFAULT_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
Definition: flow-private.h:42
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:467
MAX
#define MAX(x, y)
Definition: suricata-common.h:395
Flow_::protoctx
void * protoctx
Definition: flow.h:440
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:694
ExceptionPolicyParse
enum ExceptionPolicy ExceptionPolicyParse(const char *option, bool support_flow)
Definition: util-exception-policy.c:232
FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
Definition: flow-private.h:49
STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
Definition: stream-tcp-private.h:223
util-unittest.h
FLOW_BYPASSED_TIMEOUT
#define FLOW_BYPASSED_TIMEOUT
Definition: flow-private.h:65
util-unittest-helper.h
FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
Definition: flow-private.h:59
FLOW_IPPROTO_ICMP_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
Definition: flow-private.h:51
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:289
UTHBuildPacketOfFlows
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
Definition: util-unittest-helper.c:872
AppLayerExpectationClean
void AppLayerExpectationClean(Flow *f)
Definition: app-layer-expectation.c:361
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:411
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1051
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:482
FlowGetDestinationPort
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
Definition: flow.c:1238
FLOW_CHECK_MEMCAP
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
Definition: flow-util.h:136
FLOW_RECYCLE
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
Definition: flow-util.h:81
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:494
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:69
flow-spare-pool.h
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:474
FLOWFILE_NO_SHA1_TC
#define FLOWFILE_NO_SHA1_TC
Definition: flow.h:135
FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
Definition: flow-private.h:63
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:549
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:487
app-layer-expectation.h
FLOW_IPPROTO_UDP_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
Definition: flow-private.h:48
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:503
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:466
decode.h
util-debug.h
TOSERVER
#define TOSERVER
Definition: flow.h:43
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:74
Packet_::ts
SCTime_t ts
Definition: decode.h:484
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:491
FLOWFILE_NO_STORE_TS
#define FLOWFILE_NO_STORE_TS
Definition: flow.h:127
FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
Definition: flow-private.h:45
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:415
Flow_::lastts
SCTime_t lastts
Definition: flow.h:409
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
FLOW_CHANGE_PROTO
#define FLOW_CHANGE_PROTO
Definition: flow.h:104
Packet_::ethh
EthernetHdr * ethh
Definition: decode.h:537
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
FlowStorageSize
unsigned int FlowStorageSize(void)
Definition: flow-storage.c:35
Packet_::sp
Port sp
Definition: decode.h:443
FlowCnf_
Definition: flow.h:286
FLOWFILE_NO_SHA256_TS
#define FLOWFILE_NO_SHA256_TS
Definition: flow.h:138
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:228
FlowQueueInit
FlowQueue * FlowQueueInit(FlowQueue *q)
Definition: flow-queue.c:46
FlowState
FlowState
Definition: flow.h:499
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:285
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:515
StringParseUint32
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:313
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:517
util-time.h
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
app-layer-parser.h
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1651
FLOW_PROTO_DETECT_TC_DONE
#define FLOW_PROTO_DETECT_TC_DONE
Definition: flow.h:101
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:493
FLOW_TC_PP_ALPROTO_DETECT_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
Definition: flow.h:90
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:479
MacSetFlowStorageEnabled
bool MacSetFlowStorageEnabled(void)
Definition: util-macset.c:85
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:341
FlowThreadId
uint16_t FlowThreadId
Definition: flow.h:327
stream.h
TimeSetIncrementTime
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
Definition: util-time.c:180
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:97
Packet_
Definition: decode.h:436
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
FLOW_DEFAULT_MEMCAP
#define FLOW_DEFAULT_MEMCAP
Definition: flow.c:78
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:219
stream-tcp-private.h
MacSet_
Definition: util-macset.c:45
conf.h
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:162
FLOW_TOSERVER_IPONLY_SET
#define FLOW_TOSERVER_IPONLY_SET
Definition: flow.h:56
FLOW_IPPROTO_TCP_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
Definition: flow-private.h:43
STREAMTCP_STREAM_FLAG_HAS_GAP
#define STREAMTCP_STREAM_FLAG_HAS_GAP
Definition: stream-tcp-private.h:217
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:522
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1115
flow_timeouts_delta
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Definition: flow.c:99
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:287
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
flow-timeout.h
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:468
MacSetGetFlowStorageID
FlowStorageId MacSetGetFlowStorageID(void)
Definition: util-macset.c:114
flow-queue.h
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:418
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:223
runmodes.h
FLOW_TO_DST_SEEN
#define FLOW_TO_DST_SEEN
Definition: flow.h:51
FlowGetStorageById
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
Definition: flow-storage.c:40
FlowUpdateState
void FlowUpdateState(Flow *f, const enum FlowState s)
Definition: flow.c:1180
Flow_::src
FlowAddress src
Definition: flow.h:353
Flow_::next
struct Flow_ * next
Definition: flow.h:395
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:417
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
FLOWFILE_NO_SHA256_TC
#define FLOWFILE_NO_SHA256_TC
Definition: flow.h:139
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:786
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:58
FlowDequeue
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
Definition: flow-queue.c:191
FLOW_TO_SRC_SEEN
#define FLOW_TO_SRC_SEEN
Definition: flow.h:49
flow-storage.h
FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
Definition: flow.h:86
Packet_::flow
struct Flow_ * flow
Definition: decode.h:475
FLOW_IPPROTO_UDP_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
Definition: flow-private.h:47
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1143
FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
Definition: flow-private.h:50
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:97
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:68
CMP_ADDR
#define CMP_ADDR(a1, a2)
Definition: decode.h:233
FlowStateType
unsigned short FlowStateType
Definition: flow.h:324
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:124
flags
uint8_t flags
Definition: decode-gre.h:0
FLOW_TOCLIENT_IPONLY_SET
#define FLOW_TOCLIENT_IPONLY_SET
Definition: flow.h:58
flow-manager.h
suricata-common.h
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:82
flow_config
FlowConfig flow_config
Definition: flow.c:102
FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
Definition: flow-private.h:46
FLOW_HAS_ALERTS
#define FLOW_HAS_ALERTS
Definition: flow.h:79
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:697
FlowSparePoolDestroy
void FlowSparePoolDestroy(void)
Definition: flow-spare-pool.c:312
packet.h
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
SWAP_VARS
#define SWAP_VARS(type, a, b)
Definition: suricata-common.h:428
FlowTimeoutsInit
void FlowTimeoutsInit(void)
Definition: flow-manager.c:106
SCTIME_SECS
#define SCTIME_SECS(t)
Definition: util-time.h:57
FLOW_PROTO_DETECT_TS_DONE
#define FLOW_PROTO_DETECT_TS_DONE
Definition: flow.h:100
FatalError
#define FatalError(...)
Definition: util-debug.h:502
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:469
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:295
FLOW_TS_PP_ALPROTO_DETECT_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
Definition: flow.h:84
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1052
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1214
FLOWFILE_NO_STORE_TC
#define FLOWFILE_NO_STORE_TC
Definition: flow.h:128
FlowGetFlowFromHash
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
Definition: flow-hash.c:843
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:404
FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
Definition: flow-private.h:58
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
PKT_IS_ICMPV4
#define PKT_IS_ICMPV4(p)
Definition: decode.h:249
threadvars.h
util-validate.h
FlowSwap
void FlowSwap(Flow *f)
swap the flow's direction
Definition: flow.c:284
FlowCnf_::memcap_policy
enum ExceptionPolicy memcap_policy
Definition: flow.h:296
ICMPV4_IS_ERROR_MSG
#define ICMPV4_IS_ERROR_MSG(p)
Definition: decode-icmpv4.h:284
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FlowInitFlowProto
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
Definition: flow.c:741
SCTIME_CMP_GT
#define SCTIME_CMP_GT(a, b)
Definition: util-time.h:104
FLOWFILE_NO_SHA1_TS
#define FLOWFILE_NO_SHA1_TS
Definition: flow.h:134
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:294
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
flow_recycle_q
FlowQueue flow_recycle_q
Definition: flow-manager.c:73
SWAP_FLAGS
#define SWAP_FLAGS(flags, a, b)
Definition: suricata-common.h:417
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:69
CMP_PORT
#define CMP_PORT(p1, p2)
Definition: decode.h:238
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:685
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:450
ConfNode_
Definition: conf.h:32
Flow_::alstate
void * alstate
Definition: flow.h:475
flow_freefuncs
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
Definition: flow.c:100
flow_timeouts_emerg
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow.c:98
Flow_::flags
uint32_t flags
Definition: flow.h:420
FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
Definition: flow-private.h:61
FlowFreeStorage
void FlowFreeStorage(Flow *f)
Definition: flow-storage.c:60
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:695
FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:62
FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_TOCLIENT_DROP_LOGGED
Definition: flow.h:76
util-random.h
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:224
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
PacketDrop
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
Definition: packet.c:32
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:232
FLOW_EMERGENCY
#define FLOW_EMERGENCY
Definition: flow-private.h:37
suricata.h
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:71
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:41
FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
Definition: flow.h:88
FLOW_DEFAULT_EMERGENCY_RECOVERY
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
Definition: flow.c:73
FlowHasAlerts
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:184
FlowSparePoolInit
void FlowSparePoolInit(void)
Definition: flow-spare-pool.c:293
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:946
FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
Definition: flow-private.h:55
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:61
FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
Definition: flow-private.h:52
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:516
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:233
Flow_::sp
Port sp
Definition: flow.h:355
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1159
TcpSession_
Definition: stream-tcp-private.h:283
util-misc.h
TcpSession_::data_first_seen_dir
int8_t data_first_seen_dir
Definition: stream-tcp-private.h:288
FlowHasGaps
bool FlowHasGaps(const Flow *f, uint8_t way)
Definition: flow.c:193
flow.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:451
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:422
Packet_::dp
Port dp
Definition: decode.h:451
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:108
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:390
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
FLOW_IPPROTO_TCP_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
Definition: flow-private.h:44
RegisterFlowStorageTests
void RegisterFlowStorageTests(void)
Definition: flow-storage.c:295
SET_DEFAULTS
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
flow-var.h
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:245
TOCLIENT
#define TOCLIENT
Definition: flow.h:44
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:227
PKT_DROP_REASON_FLOW_DROP
@ PKT_DROP_REASON_FLOW_DROP
Definition: decode.h:396
Packet_::src
Address src
Definition: decode.h:440
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:492
IPV4_GET_IPTTL
#define IPV4_GET_IPTTL(p)
Definition: decode-ipv4.h:146
Flow_::thread_id
FlowThreadId thread_id[2]
Definition: flow.h:393
SCTIME_USECS
#define SCTIME_USECS(t)
Definition: util-time.h:56
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:119
FlowProtoFreeFunc_
Definition: flow.h:521
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:814