suricata
flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow implementation.
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 
29 #include "action-globals.h"
30 #include "packet.h"
31 #include "decode.h"
32 #include "conf.h"
33 #include "threadvars.h"
34 #include "tm-threads.h"
35 #include "runmodes.h"
36 
37 #include "util-random.h"
38 #include "util-time.h"
39 
40 #include "flow.h"
41 #include "flow-queue.h"
42 #include "flow-hash.h"
43 #include "flow-util.h"
44 #include "flow-var.h"
45 #include "flow-private.h"
46 #include "flow-timeout.h"
47 #include "flow-manager.h"
48 #include "flow-storage.h"
49 #include "flow-bypass.h"
50 #include "flow-spare-pool.h"
51 
52 #include "stream-tcp-private.h"
53 #include "stream-tcp-reassemble.h"
54 #include "stream-tcp.h"
55 
56 #include "util-unittest.h"
57 #include "util-unittest-helper.h"
58 #include "util-byte.h"
59 #include "util-misc.h"
60 #include "util-macset.h"
61 
62 #include "util-debug.h"
63 #include "util-privs.h"
64 #include "util-validate.h"
65 
66 #include "detect.h"
67 #include "detect-engine-state.h"
68 #include "stream.h"
69 
70 #include "app-layer-parser.h"
71 #include "app-layer-expectation.h"
72 
73 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
74 
75 //#define FLOW_DEFAULT_HASHSIZE 262144
76 #define FLOW_DEFAULT_HASHSIZE 65536
77 //#define FLOW_DEFAULT_MEMCAP 128 * 1024 * 1024 /* 128 MB */
78 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32 MB */
79 
80 #define FLOW_DEFAULT_PREALLOC 10000
81 
83 
84 /** atomic int that is used when freeing a flow from the hash. In this
85  * case we walk the hash to find a flow to free. This var records where
86  * we left off in the hash. Without this only the top rows of the hash
87  * are freed. This isn't just about fairness. Under severe pressure, the
88  * hash rows on top would be all freed and the time to find a flow to
89  * free increased with every run. */
90 SC_ATOMIC_DECLARE(unsigned int, flow_prune_idx);
91 
92 /** atomic flags */
93 SC_ATOMIC_DECLARE(unsigned int, flow_flags);
94 
95 /** FlowProto specific timeouts and free/state functions */
96 
101 
103 
104 /** flow memuse counter (atomic), for enforcing memcap limit */
105 SC_ATOMIC_DECLARE(uint64_t, flow_memuse);
106 
107 void FlowRegisterTests(void);
108 void FlowInitFlowProto(void);
109 int FlowSetProtoFreeFunc(uint8_t, void (*Free)(void *));
110 
111 /* Run mode selected at suricata.c */
112 extern int run_mode;
113 
114 /**
115  * \brief Update memcap value
116  *
117  * \param size new memcap value
118  */
119 int FlowSetMemcap(uint64_t size)
120 {
121  if ((uint64_t)SC_ATOMIC_GET(flow_memuse) < size) {
122  SC_ATOMIC_SET(flow_config.memcap, size);
123  return 1;
124  }
125 
126  return 0;
127 }
128 
129 /**
130  * \brief Return memcap value
131  *
132  * \retval memcap value
133  */
134 uint64_t FlowGetMemcap(void)
135 {
136  uint64_t memcapcopy = SC_ATOMIC_GET(flow_config.memcap);
137  return memcapcopy;
138 }
139 
140 uint64_t FlowGetMemuse(void)
141 {
142  uint64_t memusecopy = SC_ATOMIC_GET(flow_memuse);
143  return memusecopy;
144 }
145 
147 {
148  if (f == NULL || f->proto == 0)
149  return;
150 
152  f->alstate = NULL;
153  f->alparser = NULL;
154  return;
155 }
156 
157 /** \brief Set the IPOnly scanned flag for 'direction'.
158  *
159  * \param f Flow to set the flag in
160  * \param direction direction to set the flag in
161  */
162 void FlowSetIPOnlyFlag(Flow *f, int direction)
163 {
164  direction ? (f->flags |= FLOW_TOSERVER_IPONLY_SET) :
166  return;
167 }
168 
169 /** \brief Set flag to indicate that flow has alerts
170  *
171  * \param f flow
172  */
174 {
175  f->flags |= FLOW_HAS_ALERTS;
176 }
177 
178 /** \brief Check if flow has alerts
179  *
180  * \param f flow
181  * \retval 1 has alerts
182  * \retval 0 has not alerts
183  */
184 int FlowHasAlerts(const Flow *f)
185 {
186  if (f->flags & FLOW_HAS_ALERTS) {
187  return 1;
188  }
189 
190  return 0;
191 }
192 
193 bool FlowHasGaps(const Flow *f, uint8_t way)
194 {
195  if (f->proto == IPPROTO_TCP) {
196  TcpSession *ssn = (TcpSession *)f->protoctx;
197  if (ssn != NULL) {
198  if (way == STREAM_TOCLIENT) {
200  return 1;
201  } else {
203  return 1;
204  }
205  }
206  }
207  return 0;
208 }
209 
210 /** \brief Set flag to indicate to change proto for the flow
211  *
212  * \param f flow
213  */
215 {
216  f->flags |= FLOW_CHANGE_PROTO;
217 }
218 
219 /** \brief Unset flag to indicate to change proto for the flow
220  *
221  * \param f flow
222  */
224 {
225  f->flags &= ~FLOW_CHANGE_PROTO;
226 }
227 
228 /** \brief Check if change proto flag is set for flow
229  * \param f flow
230  * \retval 1 change proto flag is set
231  * \retval 0 change proto flag is not set
232  */
234 {
235  if (f->flags & FLOW_CHANGE_PROTO) {
236  return 1;
237  }
238 
239  return 0;
240 }
241 
242 static inline void FlowSwapFlags(Flow *f)
243 {
247 
252 
254 }
255 
256 static inline void FlowSwapFileFlags(Flow *f)
257 {
264 }
265 
266 static inline void TcpStreamFlowSwap(Flow *f)
267 {
268  TcpSession *ssn = f->protoctx;
269  SWAP_VARS(TcpStream, ssn->server, ssn->client);
270  if (ssn->data_first_seen_dir & STREAM_TOSERVER) {
271  ssn->data_first_seen_dir = STREAM_TOCLIENT;
272  } else if (ssn->data_first_seen_dir & STREAM_TOCLIENT) {
273  ssn->data_first_seen_dir = STREAM_TOSERVER;
274  }
275 }
276 
277 /** \brief swap the flow's direction
278  * \note leaves the 'header' untouched. Interpret that based
279  * on FLOW_DIR_REVERSED flag.
280  * \warning: only valid before applayer parsing started. This
281  * function doesn't swap anything in Flow::alparser,
282  * Flow::alstate
283  */
284 void FlowSwap(Flow *f)
285 {
286  f->flags |= FLOW_DIR_REVERSED;
287 
290 
291  FlowSwapFlags(f);
292  FlowSwapFileFlags(f);
293 
294  if (f->proto == IPPROTO_TCP) {
295  TcpStreamFlowSwap(f);
296  }
297 
301 
302  /* not touching Flow::alparser and Flow::alstate */
303 
304  SWAP_VARS(const void *, f->sgh_toclient, f->sgh_toserver);
305 
306  SWAP_VARS(uint32_t, f->todstpktcnt, f->tosrcpktcnt);
307  SWAP_VARS(uint64_t, f->todstbytecnt, f->tosrcbytecnt);
308 }
309 
310 /**
311  * \brief determine the direction of the packet compared to the flow
312  * \retval 0 to_server
313  * \retval 1 to_client
314  */
315 int FlowGetPacketDirection(const Flow *f, const Packet *p)
316 {
317  const int reverse = (f->flags & FLOW_DIR_REVERSED) != 0;
318 
319  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
320  if (!(CMP_PORT(p->sp,p->dp))) {
321  /* update flags and counters */
322  if (CMP_PORT(f->sp,p->sp)) {
323  return TOSERVER ^ reverse;
324  } else {
325  return TOCLIENT ^ reverse;
326  }
327  } else {
328  if (CMP_ADDR(&f->src,&p->src)) {
329  return TOSERVER ^ reverse;
330  } else {
331  return TOCLIENT ^ reverse;
332  }
333  }
334  } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
335  if (CMP_ADDR(&f->src,&p->src)) {
336  return TOSERVER ^ reverse;
337  } else {
338  return TOCLIENT ^ reverse;
339  }
340  }
341 
342  /* default to toserver */
343  return TOSERVER;
344 }
345 
346 /**
347  * \brief Check to update "seen" flags
348  *
349  * \param p packet
350  *
351  * \retval 1 true
352  * \retval 0 false
353  */
354 static inline int FlowUpdateSeenFlag(const Packet *p)
355 {
356  if (PKT_IS_ICMPV4(p)) {
357  if (ICMPV4_IS_ERROR_MSG(p)) {
358  return 0;
359  }
360  }
361 
362  return 1;
363 }
364 
365 static inline void FlowUpdateTtlTS(Flow *f, Packet *p, uint8_t ttl)
366 {
367  if (f->min_ttl_toserver == 0) {
368  f->min_ttl_toserver = ttl;
369  } else {
370  f->min_ttl_toserver = MIN(f->min_ttl_toserver, ttl);
371  }
372  f->max_ttl_toserver = MAX(f->max_ttl_toserver, ttl);
373 }
374 
375 static inline void FlowUpdateTtlTC(Flow *f, Packet *p, uint8_t ttl)
376 {
377  if (f->min_ttl_toclient == 0) {
378  f->min_ttl_toclient = ttl;
379  } else {
380  f->min_ttl_toclient = MIN(f->min_ttl_toclient, ttl);
381  }
382  f->max_ttl_toclient = MAX(f->max_ttl_toclient, ttl);
383 }
384 
385 static inline void FlowUpdateEthernet(ThreadVars *tv, DecodeThreadVars *dtv,
386  Flow *f, EthernetHdr *ethh, bool toserver)
387 {
388  if (ethh && MacSetFlowStorageEnabled()) {
390  if (ms != NULL) {
391  if (toserver) {
392  MacSetAddWithCtr(ms, ethh->eth_src, ethh->eth_dst, tv,
395  } else {
396  MacSetAddWithCtr(ms, ethh->eth_dst, ethh->eth_src, tv,
399  }
400  }
401  }
402 }
403 
404 /** \brief Update Packet and Flow
405  *
406  * Updates packet and flow based on the new packet.
407  *
408  * \param f locked flow
409  * \param p packet
410  *
411  * \note overwrites p::flowflags
412  */
414 {
415  SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f);
416 
417  const int pkt_dir = FlowGetPacketDirection(f, p);
418 #ifdef CAPTURE_OFFLOAD
419  int state = f->flow_state;
420 
421  if (state != FLOW_STATE_CAPTURE_BYPASSED) {
422 #endif
423  /* update the last seen timestamp of this flow */
424  if (SCTIME_CMP_GT(p->ts, f->lastts)) {
425  f->lastts = p->ts;
426  const uint32_t timeout_at = (uint32_t)SCTIME_SECS(f->lastts) + f->timeout_policy;
427  if (timeout_at != f->timeout_at) {
428  f->timeout_at = timeout_at;
429  }
430  }
431 #ifdef CAPTURE_OFFLOAD
432  } else {
433  /* still seeing packet, we downgrade to local bypass */
434  if (SCTIME_SECS(p->ts) - SCTIME_SECS(f->lastts) > FLOW_BYPASSED_TIMEOUT / 2) {
435  SCLogDebug("Downgrading flow to local bypass");
436  f->lastts = p->ts;
438  } else {
439  /* In IPS mode the packet could come from the other interface so it would
440  * need to be bypassed */
441  if (EngineModeIsIPS()) {
442  BypassedFlowUpdate(f, p);
443  }
444  }
445  }
446 #endif
447  /* update flags and counters */
448  if (pkt_dir == TOSERVER) {
449  f->todstpktcnt++;
450  f->todstbytecnt += GET_PKT_LEN(p);
452  if (!(f->flags & FLOW_TO_DST_SEEN)) {
453  if (FlowUpdateSeenFlag(p)) {
454  f->flags |= FLOW_TO_DST_SEEN;
456  }
457  }
458  /* xfer proto detect ts flag to first packet in ts dir */
459  if (f->flags & FLOW_PROTO_DETECT_TS_DONE) {
462  }
463  FlowUpdateEthernet(tv, dtv, f, p->ethh, true);
464  /* update flow's ttl fields if needed */
465  if (PKT_IS_IPV4(p)) {
466  FlowUpdateTtlTS(f, p, IPV4_GET_IPTTL(p));
467  } else if (PKT_IS_IPV6(p)) {
468  FlowUpdateTtlTS(f, p, IPV6_GET_HLIM(p));
469  }
470  } else {
471  f->tosrcpktcnt++;
472  f->tosrcbytecnt += GET_PKT_LEN(p);
474  if (!(f->flags & FLOW_TO_SRC_SEEN)) {
475  if (FlowUpdateSeenFlag(p)) {
476  f->flags |= FLOW_TO_SRC_SEEN;
478  }
479  }
480  /* xfer proto detect tc flag to first packet in tc dir */
481  if (f->flags & FLOW_PROTO_DETECT_TC_DONE) {
484  }
485  FlowUpdateEthernet(tv, dtv, f, p->ethh, false);
486  /* update flow's ttl fields if needed */
487  if (PKT_IS_IPV4(p)) {
488  FlowUpdateTtlTC(f, p, IPV4_GET_IPTTL(p));
489  } else if (PKT_IS_IPV6(p)) {
490  FlowUpdateTtlTC(f, p, IPV6_GET_HLIM(p));
491  }
492  }
493 
495  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
497 
498  } else if (f->proto == IPPROTO_TCP) {
499  TcpSession *ssn = (TcpSession *)f->protoctx;
500  if (ssn != NULL && ssn->state >= TCP_ESTABLISHED) {
502  }
503  } else if ((f->flags & (FLOW_TO_DST_SEEN|FLOW_TO_SRC_SEEN)) ==
505  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
507 
509  }
510 
511  if (f->flags & FLOW_ACTION_DROP) {
513  }
514  /*set the detection bypass flags*/
515  if (f->flags & FLOW_NOPACKET_INSPECTION) {
516  SCLogDebug("setting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
517  DecodeSetNoPacketInspectionFlag(p);
518  }
519  if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
520  SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
521  DecodeSetNoPayloadInspectionFlag(p);
522  }
523 }
524 
525 /** \brief Entry point for packet flow handling
526  *
527  * This is called for every packet.
528  *
529  * \param tv threadvars
530  * \param dtv decode thread vars (for flow output api thread data)
531  * \param p packet to handle flow for
532  */
534 {
535  /* Get this packet's flow from the hash. FlowHandlePacket() will setup
536  * a new flow if necessary. If we get NULL, we're out of flow memory.
537  * The returned flow is locked. */
538  Flow *f = FlowGetFlowFromHash(tv, fls, p, &p->flow);
539  if (f != NULL) {
540  /* set the flow in the packet */
541  p->flags |= PKT_HAS_FLOW;
542  }
543 }
544 
545 /** \brief initialize the configuration
546  * \warning Not thread safe */
547 void FlowInitConfig(bool quiet)
548 {
549  SCLogDebug("initializing flow engine...");
550 
551  memset(&flow_config, 0, sizeof(flow_config));
552  SC_ATOMIC_INIT(flow_flags);
553  SC_ATOMIC_INIT(flow_memuse);
554  SC_ATOMIC_INIT(flow_prune_idx);
555  SC_ATOMIC_INIT(flow_config.memcap);
557 
558  /* set defaults */
559  flow_config.hash_rand = (uint32_t)RandomGet();
563 
564  /* If we have specific config, overwrite the defaults with them,
565  * otherwise, leave the default values */
566  intmax_t val = 0;
567  if (ConfGetInt("flow.emergency-recovery", &val) == 1) {
568  if (val <= 100 && val >= 1) {
569  flow_config.emergency_recovery = (uint8_t)val;
570  } else {
571  SCLogError("flow.emergency-recovery must be in the range of "
572  "1 and 100 (as percentage)");
574  }
575  } else {
576  SCLogDebug("flow.emergency-recovery, using default value");
578  }
579 
580  /* Check if we have memcap and hash_size defined at config */
581  const char *conf_val;
582  uint32_t configval = 0;
583 
584  /** set config values for memcap, prealloc and hash_size */
585  uint64_t flow_memcap_copy = 0;
586  if ((ConfGet("flow.memcap", &conf_val)) == 1)
587  {
588  if (conf_val == NULL) {
589  FatalError("Invalid value for flow.memcap: NULL");
590  }
591 
592  if (ParseSizeStringU64(conf_val, &flow_memcap_copy) < 0) {
593  SCLogError("Error parsing flow.memcap "
594  "from conf file - %s. Killing engine",
595  conf_val);
596  exit(EXIT_FAILURE);
597  } else {
598  SC_ATOMIC_SET(flow_config.memcap, flow_memcap_copy);
599  }
600  }
601  if ((ConfGet("flow.hash-size", &conf_val)) == 1)
602  {
603  if (conf_val == NULL) {
604  FatalError("Invalid value for flow.hash-size: NULL");
605  }
606 
607  if (StringParseUint32(&configval, 10, strlen(conf_val), conf_val) && configval != 0) {
608  flow_config.hash_size = configval;
609  } else {
610  FatalError("Invalid value for flow.hash-size. Must be a numeric value in the range "
611  "1-4294967295");
612  }
613  }
614  if ((ConfGet("flow.prealloc", &conf_val)) == 1)
615  {
616  if (conf_val == NULL) {
617  FatalError("Invalid value for flow.prealloc: NULL");
618  }
619 
620  if (StringParseUint32(&configval, 10, strlen(conf_val),
621  conf_val) > 0) {
622  flow_config.prealloc = configval;
623  }
624  }
625 
626  flow_config.memcap_policy = ExceptionPolicyParse("flow.memcap-policy", false);
627 
628  SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: "
629  "%"PRIu32", prealloc: %"PRIu32, SC_ATOMIC_GET(flow_config.memcap),
631 
632  /* alloc hash memory */
633  uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket);
634  if (!(FLOW_CHECK_MEMCAP(hash_size))) {
635  SCLogError("allocating flow hash failed: "
636  "max flow memcap is smaller than projected hash size. "
637  "Memcap: %" PRIu64 ", Hash table size %" PRIu64 ". Calculate "
638  "total hash size by multiplying \"flow.hash-size\" with %" PRIuMAX ", "
639  "which is the hash bucket size.",
640  SC_ATOMIC_GET(flow_config.memcap), hash_size, (uintmax_t)sizeof(FlowBucket));
641  exit(EXIT_FAILURE);
642  }
643  flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS);
644  if (unlikely(flow_hash == NULL)) {
645  FatalError("Fatal error encountered in FlowInitConfig. Exiting...");
646  }
647  memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket));
648 
649  uint32_t i = 0;
650  for (i = 0; i < flow_config.hash_size; i++) {
651  FBLOCK_INIT(&flow_hash[i]);
652  SC_ATOMIC_INIT(flow_hash[i].next_ts);
653  }
654  (void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket)));
655 
656  if (!quiet) {
657  SCLogConfig("allocated %"PRIu64" bytes of memory for the flow hash... "
658  "%" PRIu32 " buckets of size %" PRIuMAX "",
659  SC_ATOMIC_GET(flow_memuse), flow_config.hash_size,
660  (uintmax_t)sizeof(FlowBucket));
661  }
663  if (!quiet) {
664  SCLogConfig("flow memory usage: %"PRIu64" bytes, maximum: %"PRIu64,
665  SC_ATOMIC_GET(flow_memuse), SC_ATOMIC_GET(flow_config.memcap));
666  }
667 
669 
670  uint32_t sz = sizeof(Flow) + FlowStorageSize();
671  SCLogConfig("flow size %u, memcap allows for %" PRIu64 " flows. Per hash row in perfect "
672  "conditions %" PRIu64,
673  sz, flow_memcap_copy / sz, (flow_memcap_copy / sz) / flow_config.hash_size);
674  return;
675 }
676 
677 void FlowReset(void)
678 {
679  // resets the flows (for reuse by fuzzing)
680  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
681  Flow *f = flow_hash[u].head;
682  while (f) {
683  Flow *n = f->next;
684  uint8_t proto_map = FlowGetProtoMapping(f->proto);
685  FlowClearMemory(f, proto_map);
686  FlowFree(f);
687  f = n;
688  }
689  flow_hash[u].head = NULL;
690  }
691 }
692 
693 /** \brief shutdown the flow engine
694  * \warning Not thread safe */
695 void FlowShutdown(void)
696 {
697  Flow *f;
698  while ((f = FlowDequeue(&flow_recycle_q))) {
699  FlowFree(f);
700  }
701 
702  /* clear and free the hash */
703  if (flow_hash != NULL) {
704  /* clean up flow mutexes */
705  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
706  f = flow_hash[u].head;
707  while (f) {
708  Flow *n = f->next;
709  uint8_t proto_map = FlowGetProtoMapping(f->proto);
710  FlowClearMemory(f, proto_map);
711  FlowFree(f);
712  f = n;
713  }
714  f = flow_hash[u].evicted;
715  while (f) {
716  Flow *n = f->next;
717  uint8_t proto_map = FlowGetProtoMapping(f->proto);
718  FlowClearMemory(f, proto_map);
719  FlowFree(f);
720  f = n;
721  }
722 
724  }
726  flow_hash = NULL;
727  }
728  (void) SC_ATOMIC_SUB(flow_memuse, flow_config.hash_size * sizeof(FlowBucket));
731  return;
732 }
733 
734 /**
735  * \brief Function to set the default timeout, free function and flow state
736  * function for all supported flow_proto.
737  */
738 
740 {
742 
743 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
744  flow_timeouts_normal[(p)].new_timeout = (n); \
745  flow_timeouts_normal[(p)].est_timeout = (e); \
746  flow_timeouts_normal[(p)].closed_timeout = (c); \
747  flow_timeouts_normal[(p)].bypassed_timeout = (b); \
748  flow_timeouts_emerg[(p)].new_timeout = (ne); \
749  flow_timeouts_emerg[(p)].est_timeout = (ee); \
750  flow_timeouts_emerg[(p)].closed_timeout = (ce); \
751  flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
752 
773 
778 
779  /* Let's see if we have custom timeouts defined from config */
780  const char *new = NULL;
781  const char *established = NULL;
782  const char *closed = NULL;
783  const char *bypassed = NULL;
784  const char *emergency_new = NULL;
785  const char *emergency_established = NULL;
786  const char *emergency_closed = NULL;
787  const char *emergency_bypassed = NULL;
788 
789  ConfNode *flow_timeouts = ConfGetNode("flow-timeouts");
790  if (flow_timeouts != NULL) {
791  ConfNode *proto = NULL;
792  uint32_t configval = 0;
793 
794  /* Defaults. */
795  proto = ConfNodeLookupChild(flow_timeouts, "default");
796  if (proto != NULL) {
797  new = ConfNodeLookupChildValue(proto, "new");
798  established = ConfNodeLookupChildValue(proto, "established");
799  closed = ConfNodeLookupChildValue(proto, "closed");
800  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
801  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
802  emergency_established = ConfNodeLookupChildValue(proto,
803  "emergency-established");
804  emergency_closed = ConfNodeLookupChildValue(proto,
805  "emergency-closed");
806  emergency_bypassed = ConfNodeLookupChildValue(proto,
807  "emergency-bypassed");
808 
809  if (new != NULL &&
810  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
811 
813  }
814  if (established != NULL &&
815  StringParseUint32(&configval, 10, strlen(established),
816  established) > 0) {
817 
819  }
820  if (closed != NULL &&
821  StringParseUint32(&configval, 10, strlen(closed),
822  closed) > 0) {
823 
825  }
826  if (bypassed != NULL &&
827  StringParseUint32(&configval, 10,
828  strlen(bypassed),
829  bypassed) > 0) {
830 
832  }
833  if (emergency_new != NULL &&
834  StringParseUint32(&configval, 10, strlen(emergency_new),
835  emergency_new) > 0) {
836 
838  }
839  if (emergency_established != NULL &&
840  StringParseUint32(&configval, 10,
841  strlen(emergency_established),
842  emergency_established) > 0) {
843 
845  }
846  if (emergency_closed != NULL &&
847  StringParseUint32(&configval, 10,
848  strlen(emergency_closed),
849  emergency_closed) > 0) {
850 
852  }
853  if (emergency_bypassed != NULL &&
854  StringParseUint32(&configval, 10,
855  strlen(emergency_bypassed),
856  emergency_bypassed) > 0) {
857 
859  }
860  }
861 
862  /* TCP. */
863  proto = ConfNodeLookupChild(flow_timeouts, "tcp");
864  if (proto != NULL) {
865  new = ConfNodeLookupChildValue(proto, "new");
866  established = ConfNodeLookupChildValue(proto, "established");
867  closed = ConfNodeLookupChildValue(proto, "closed");
868  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
869  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
870  emergency_established = ConfNodeLookupChildValue(proto,
871  "emergency-established");
872  emergency_closed = ConfNodeLookupChildValue(proto,
873  "emergency-closed");
874  emergency_bypassed = ConfNodeLookupChildValue(proto,
875  "emergency-bypassed");
876 
877  if (new != NULL &&
878  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
879 
881  }
882  if (established != NULL &&
883  StringParseUint32(&configval, 10, strlen(established),
884  established) > 0) {
885 
887  }
888  if (closed != NULL &&
889  StringParseUint32(&configval, 10, strlen(closed),
890  closed) > 0) {
891 
893  }
894  if (bypassed != NULL &&
895  StringParseUint32(&configval, 10,
896  strlen(bypassed),
897  bypassed) > 0) {
898 
900  }
901  if (emergency_new != NULL &&
902  StringParseUint32(&configval, 10, strlen(emergency_new),
903  emergency_new) > 0) {
904 
906  }
907  if (emergency_established != NULL &&
908  StringParseUint32(&configval, 10,
909  strlen(emergency_established),
910  emergency_established) > 0) {
911 
913  }
914  if (emergency_closed != NULL &&
915  StringParseUint32(&configval, 10,
916  strlen(emergency_closed),
917  emergency_closed) > 0) {
918 
920  }
921  if (emergency_bypassed != NULL &&
922  StringParseUint32(&configval, 10,
923  strlen(emergency_bypassed),
924  emergency_bypassed) > 0) {
925 
927  }
928  }
929 
930  /* UDP. */
931  proto = ConfNodeLookupChild(flow_timeouts, "udp");
932  if (proto != NULL) {
933  new = ConfNodeLookupChildValue(proto, "new");
934  established = ConfNodeLookupChildValue(proto, "established");
935  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
936  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
937  emergency_established = ConfNodeLookupChildValue(proto,
938  "emergency-established");
939  emergency_bypassed = ConfNodeLookupChildValue(proto,
940  "emergency-bypassed");
941 
942  if (new != NULL &&
943  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
944 
946  }
947  if (established != NULL &&
948  StringParseUint32(&configval, 10, strlen(established),
949  established) > 0) {
950 
952  }
953  if (bypassed != NULL &&
954  StringParseUint32(&configval, 10,
955  strlen(bypassed),
956  bypassed) > 0) {
957 
959  }
960  if (emergency_new != NULL &&
961  StringParseUint32(&configval, 10, strlen(emergency_new),
962  emergency_new) > 0) {
963 
965  }
966  if (emergency_established != NULL &&
967  StringParseUint32(&configval, 10,
968  strlen(emergency_established),
969  emergency_established) > 0) {
970 
972  }
973  if (emergency_bypassed != NULL &&
974  StringParseUint32(&configval, 10,
975  strlen(emergency_bypassed),
976  emergency_bypassed) > 0) {
977 
979  }
980  }
981 
982  /* ICMP. */
983  proto = ConfNodeLookupChild(flow_timeouts, "icmp");
984  if (proto != NULL) {
985  new = ConfNodeLookupChildValue(proto, "new");
986  established = ConfNodeLookupChildValue(proto, "established");
987  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
988  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
989  emergency_established = ConfNodeLookupChildValue(proto,
990  "emergency-established");
991  emergency_bypassed = ConfNodeLookupChildValue(proto,
992  "emergency-bypassed");
993 
994  if (new != NULL &&
995  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
996 
998  }
999  if (established != NULL &&
1000  StringParseUint32(&configval, 10, strlen(established),
1001  established) > 0) {
1002 
1004  }
1005  if (bypassed != NULL &&
1006  StringParseUint32(&configval, 10,
1007  strlen(bypassed),
1008  bypassed) > 0) {
1009 
1011  }
1012  if (emergency_new != NULL &&
1013  StringParseUint32(&configval, 10, strlen(emergency_new),
1014  emergency_new) > 0) {
1015 
1017  }
1018  if (emergency_established != NULL &&
1019  StringParseUint32(&configval, 10,
1020  strlen(emergency_established),
1021  emergency_established) > 0) {
1022 
1024  }
1025  if (emergency_bypassed != NULL &&
1026  StringParseUint32(&configval, 10,
1027  strlen(emergency_bypassed),
1028  emergency_bypassed) > 0) {
1029 
1031  }
1032  }
1033  }
1034 
1035  /* validate and if needed update emergency timeout values */
1036  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
1037  const FlowProtoTimeout *n = &flow_timeouts_normal[i];
1039 
1040  if (e->est_timeout > n->est_timeout) {
1041  SCLogWarning("emergency timeout value %u for \'established\' "
1042  "must be below regular value %u",
1043  e->est_timeout, n->est_timeout);
1044  e->est_timeout = n->est_timeout / 10;
1045  }
1046 
1047  if (e->new_timeout > n->new_timeout) {
1048  SCLogWarning("emergency timeout value %u for \'new\' must be "
1049  "below regular value %u",
1050  e->new_timeout, n->new_timeout);
1051  e->new_timeout = n->new_timeout / 10;
1052  }
1053 
1054  if (e->closed_timeout > n->closed_timeout) {
1055  SCLogWarning("emergency timeout value %u for \'closed\' must "
1056  "be below regular value %u",
1058  e->closed_timeout = n->closed_timeout / 10;
1059  }
1060 
1061  if (e->bypassed_timeout > n->bypassed_timeout) {
1062  SCLogWarning("emergency timeout value %u for \'bypassed\' "
1063  "must be below regular value %u",
1065  e->bypassed_timeout = n->bypassed_timeout / 10;
1066  }
1067  }
1068 
1069  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
1073 
1074  if (e->est_timeout > n->est_timeout) {
1075  SCLogWarning("emergency timeout value for \'established\' must be below normal value");
1076  e->est_timeout = n->est_timeout / 10;
1077  }
1078  d->est_timeout = n->est_timeout - e->est_timeout;
1079 
1080  if (e->new_timeout > n->new_timeout) {
1081  SCLogWarning("emergency timeout value for \'new\' must be below normal value");
1082  e->new_timeout = n->new_timeout / 10;
1083  }
1084  d->new_timeout = n->new_timeout - e->new_timeout;
1085 
1086  if (e->closed_timeout > n->closed_timeout) {
1087  SCLogWarning("emergency timeout value for \'closed\' must be below normal value");
1088  e->closed_timeout = n->closed_timeout / 10;
1089  }
1091 
1092  if (e->bypassed_timeout > n->bypassed_timeout) {
1093  SCLogWarning("emergency timeout value for \'bypassed\' must be below normal value");
1094  e->bypassed_timeout = n->bypassed_timeout / 10;
1095  }
1097 
1098  SCLogDebug("deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1100  }
1101 
1102  return;
1103 }
1104 
1105 /**
1106  * \brief Function clear the flow memory before queueing it to spare flow
1107  * queue.
1108  *
1109  * \param f pointer to the flow needed to be cleared.
1110  * \param proto_map mapped value of the protocol to FLOW_PROTO's.
1111  */
1112 
1113 int FlowClearMemory(Flow* f, uint8_t proto_map)
1114 {
1115  SCEnter();
1116 
1117  if (unlikely(f->flags & FLOW_HAS_EXPECTATION)) {
1119  }
1120 
1121  /* call the protocol specific free function if we have one */
1122  if (flow_freefuncs[proto_map].Freefunc != NULL) {
1123  flow_freefuncs[proto_map].Freefunc(f->protoctx);
1124  }
1125 
1126  FlowFreeStorage(f);
1127 
1128  FLOW_RECYCLE(f);
1129 
1130  SCReturnInt(1);
1131 }
1132 
1133 /**
1134  * \brief Function to set the function to get protocol specific flow state.
1135  *
1136  * \param proto protocol of which function is needed to be set.
1137  * \param Free Function pointer which will be called to free the protocol
1138  * specific memory.
1139  */
1140 
1141 int FlowSetProtoFreeFunc (uint8_t proto, void (*Free)(void *))
1142 {
1143  uint8_t proto_map;
1144  proto_map = FlowGetProtoMapping(proto);
1145 
1146  flow_freefuncs[proto_map].Freefunc = Free;
1147  return 1;
1148 }
1149 
1150 /**
1151  * \brief get 'disruption' flags: GAP/DEPTH/PASS
1152  * \param f locked flow
1153  * \param flags existing flags to be amended
1154  * \retval flags original flags + disrupt flags (if any)
1155  * \TODO handle UDP
1156  */
1157 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
1158 {
1159  if (f->proto != IPPROTO_TCP) {
1160  return flags;
1161  }
1162  if (f->protoctx == NULL) {
1163  return flags;
1164  }
1165 
1166  uint8_t newflags = flags;
1167  TcpSession *ssn = f->protoctx;
1168  TcpStream *stream = flags & STREAM_TOSERVER ? &ssn->client : &ssn->server;
1169 
1171  newflags |= STREAM_DEPTH;
1172  }
1173  /* todo: handle pass case (also for UDP!) */
1174 
1175  return newflags;
1176 }
1177 
1178 void FlowUpdateState(Flow *f, const enum FlowState s)
1179 {
1180  if (s != f->flow_state) {
1181  /* set the state */
1182  // Explicit cast from the enum type to the compact version
1183  f->flow_state = (FlowStateType)s;
1184 
1185  /* update timeout policy and value */
1186  const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1187  if (timeout_policy != f->timeout_policy) {
1188  f->timeout_policy = timeout_policy;
1189  const uint32_t timeout_at = (uint32_t)SCTIME_SECS(f->lastts) + timeout_policy;
1190  if (timeout_at != f->timeout_at)
1191  f->timeout_at = timeout_at;
1192  }
1193  }
1194 #ifdef UNITTESTS
1195  if (f->fb != NULL) {
1196 #endif
1197  /* and reset the flow bucket next_ts value so that the flow manager
1198  * has to revisit this row */
1199  SC_ATOMIC_SET(f->fb->next_ts, 0);
1200 #ifdef UNITTESTS
1201  }
1202 #endif
1203 }
1204 
1205 /**
1206  * \brief Get flow last time as individual values.
1207  *
1208  * Instead of returning a pointer to the timeval copy the timeval
1209  * parts into output pointers to make it simpler to call from Rust
1210  * over FFI using only basic data types.
1211  */
1212 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
1213 {
1214  *secs = (uint64_t)SCTIME_SECS(flow->lastts);
1215  *usecs = (uint64_t)SCTIME_USECS(flow->lastts);
1216 }
1217 
1218 /**
1219  * \brief Get flow source port.
1220  *
1221  * A function to get the flow sport useful when the caller only has an
1222  * opaque pointer to the flow structure.
1223  */
1224 uint16_t FlowGetSourcePort(Flow *flow)
1225 {
1226  return flow->sp;
1227 }
1228 
1229 /**
1230  * \brief Get flow destination port.
1231  *
1232  * A function to get the flow dport useful when the caller only has an
1233  * opaque pointer to the flow structure.
1234  */
1235 
1237 {
1238  return flow->dp;
1239 }
1240 /**
1241  * \brief Get flow flags.
1242  *
1243  * A function to get the flow flags useful when the caller only has an
1244  * opaque pointer to the flow structure.
1245  */
1246 
1247 uint32_t FlowGetFlags(Flow *flow)
1248 {
1249  return flow->flags;
1250 }
1251 /************************************Unittests*******************************/
1252 
1253 #ifdef UNITTESTS
1254 #include "threads.h"
1255 
1256 /**
1257  * \test Test the setting of the per protocol timeouts.
1258  *
1259  * \retval On success it returns 1 and on failure 0.
1260  */
1261 
1262 static int FlowTest01 (void)
1263 {
1264  uint8_t proto_map;
1265 
1267  proto_map = FlowGetProtoMapping(IPPROTO_TCP);
1268  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_TCP_NEW_TIMEOUT);
1269  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_TCP_EST_TIMEOUT);
1272 
1273  proto_map = FlowGetProtoMapping(IPPROTO_UDP);
1274  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_UDP_NEW_TIMEOUT);
1275  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_UDP_EST_TIMEOUT);
1278 
1279  proto_map = FlowGetProtoMapping(IPPROTO_ICMP);
1280  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_ICMP_NEW_TIMEOUT);
1281  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_ICMP_EST_TIMEOUT);
1284 
1285  proto_map = FlowGetProtoMapping(IPPROTO_DCCP);
1286  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_DEFAULT_NEW_TIMEOUT);
1287  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_DEFAULT_EST_TIMEOUT);
1288  FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_DEFAULT_EMERG_NEW_TIMEOUT);
1289  FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_DEFAULT_EMERG_EST_TIMEOUT);
1290 
1291  PASS;
1292 }
1293 
1294 /*Test function for the unit test FlowTest02*/
1295 
1296 static void test(void *f) {}
1297 
1298 /**
1299  * \test Test the setting of the per protocol free function to free the
1300  * protocol specific memory.
1301  *
1302  * \retval On success it returns 1 and on failure 0.
1303  */
1304 
1305 static int FlowTest02 (void)
1306 {
1308  FlowSetProtoFreeFunc(IPPROTO_TCP, test);
1309  FlowSetProtoFreeFunc(IPPROTO_UDP, test);
1310  FlowSetProtoFreeFunc(IPPROTO_ICMP, test);
1311 
1312  FAIL_IF(flow_freefuncs[FLOW_PROTO_DEFAULT].Freefunc != test);
1313  FAIL_IF(flow_freefuncs[FLOW_PROTO_TCP].Freefunc != test);
1314  FAIL_IF(flow_freefuncs[FLOW_PROTO_UDP].Freefunc != test);
1315  FAIL_IF(flow_freefuncs[FLOW_PROTO_ICMP].Freefunc != test);
1316 
1317  PASS;
1318 }
1319 
1320 /**
1321  * \test Test flow allocations when it reach memcap
1322  *
1323  *
1324  * \retval On success it returns 1 and on failure 0.
1325  */
1326 
1327 static int FlowTest07 (void)
1328 {
1329  int result = 0;
1331  FlowConfig backup;
1332  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1333 
1334  uint32_t ini = 0;
1335  uint32_t end = FlowSpareGetPoolSize();
1336  SC_ATOMIC_SET(flow_config.memcap, 10000);
1337  flow_config.prealloc = 100;
1338 
1339  /* Let's get the flow spare pool empty */
1340  UTHBuildPacketOfFlows(ini, end, 0);
1341 
1342  /* And now let's try to reach the memcap val */
1343  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1344  ini = end + 1;
1345  end = end + 2;
1346  UTHBuildPacketOfFlows(ini, end, 0);
1347  }
1348 
1349  /* should time out normal */
1350  TimeSetIncrementTime(2000);
1351  ini = end + 1;
1352  end = end + 2;
1353  UTHBuildPacketOfFlows(ini, end, 0);
1354 
1355  /* This means that the engine entered emerg mode: should happen as easy
1356  * with flow mgr activated */
1357  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1358  result = 1;
1359 
1360  FlowShutdown();
1361  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1362 
1363  return result;
1364 }
1365 
1366 /**
1367  * \test Test flow allocations when it reach memcap
1368  *
1369  *
1370  * \retval On success it returns 1 and on failure 0.
1371  */
1372 
1373 static int FlowTest08 (void)
1374 {
1375  int result = 0;
1376 
1378  FlowConfig backup;
1379  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1380 
1381  uint32_t ini = 0;
1382  uint32_t end = FlowSpareGetPoolSize();
1383  SC_ATOMIC_SET(flow_config.memcap, 10000);
1384  flow_config.prealloc = 100;
1385 
1386  /* Let's get the flow spare pool empty */
1387  UTHBuildPacketOfFlows(ini, end, 0);
1388 
1389  /* And now let's try to reach the memcap val */
1390  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1391  ini = end + 1;
1392  end = end + 2;
1393  UTHBuildPacketOfFlows(ini, end, 0);
1394  }
1395 
1396  /* By default we use 30 for timing out new flows. This means
1397  * that the Emergency mode should be set */
1399  ini = end + 1;
1400  end = end + 2;
1401  UTHBuildPacketOfFlows(ini, end, 0);
1402 
1403  /* This means that the engine released 5 flows by emergency timeout */
1404  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1405  result = 1;
1406 
1407  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1408  FlowShutdown();
1409 
1410  return result;
1411 }
1412 
1413 /**
1414  * \test Test flow allocations when it reach memcap
1415  *
1416  *
1417  * \retval On success it returns 1 and on failure 0.
1418  */
1419 
1420 static int FlowTest09 (void)
1421 {
1422  int result = 0;
1423 
1425  FlowConfig backup;
1426  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1427 
1428  uint32_t ini = 0;
1429  uint32_t end = FlowSpareGetPoolSize();
1430  SC_ATOMIC_SET(flow_config.memcap, 10000);
1431  flow_config.prealloc = 100;
1432 
1433  /* Let's get the flow spare pool empty */
1434  UTHBuildPacketOfFlows(ini, end, 0);
1435 
1436  /* And now let's try to reach the memcap val */
1437  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1438  ini = end + 1;
1439  end = end + 2;
1440  UTHBuildPacketOfFlows(ini, end, 0);
1441  }
1442 
1443  /* No timeout will work */
1445  ini = end + 1;
1446  end = end + 2;
1447  UTHBuildPacketOfFlows(ini, end, 0);
1448 
1449  /* engine in emerg mode */
1450  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1451  result = 1;
1452 
1453  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1454  FlowShutdown();
1455 
1456  return result;
1457 }
1458 
1459 #endif /* UNITTESTS */
1460 
1461 /**
1462  * \brief Function to register the Flow Unitests.
1463  */
1465 {
1466 #ifdef UNITTESTS
1467  UtRegisterTest("FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1468  UtRegisterTest("FlowTest02 -- Setting Protocol Specific Free Function",
1469  FlowTest02);
1470  UtRegisterTest("FlowTest07 -- Test flow Allocations when it reach memcap",
1471  FlowTest07);
1472  UtRegisterTest("FlowTest08 -- Test flow Allocations when it reach memcap",
1473  FlowTest08);
1474  UtRegisterTest("FlowTest09 -- Test flow Allocations when it reach memcap",
1475  FlowTest09);
1476 
1478 #endif /* UNITTESTS */
1479 }
FLOWFILE_NO_MD5_TS
#define FLOWFILE_NO_MD5_TS
Definition: flow.h:130
util-byte.h
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:223
FLOWFILE_NO_MD5_TC
#define FLOWFILE_NO_MD5_TC
Definition: flow.h:131
FBLOCK_DESTROY
#define FBLOCK_DESTROY(fb)
Definition: flow-hash.h:72
FLOW_DEFAULT_NEW_TIMEOUT
#define FLOW_DEFAULT_NEW_TIMEOUT
Definition: flow-private.h:40
tm-threads.h
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:399
Packet_::proto
uint8_t proto
Definition: decode.h:452
FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
Definition: flow-private.h:56
TcpStream_
Definition: stream-tcp-private.h:106
FLOWFILE_NO_SIZE_TS
#define FLOWFILE_NO_SIZE_TS
Definition: flow.h:142
flow-bypass.h
FLOW_HAS_EXPECTATION
#define FLOW_HAS_EXPECTATION
Definition: flow.h:110
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
Definition: flow.c:173
FLOWFILE_NO_SIZE_TC
#define FLOWFILE_NO_SIZE_TC
Definition: flow.h:143
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:146
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
Definition: flow.c:214
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1005
FlowSpareGetPoolSize
uint32_t FlowSpareGetPoolSize(void)
Definition: flow-spare-pool.c:47
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:315
FLOW_PROTO_ICMP
@ FLOW_PROTO_ICMP
Definition: flow-private.h:70
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:501
flow-util.h
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:315
FBLOCK_INIT
#define FBLOCK_INIT(fb)
Definition: flow-hash.h:71
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:246
CLS
#define CLS
Definition: suricata-common.h:56
stream-tcp.h
MacSetAddWithCtr
void MacSetAddWithCtr(MacSet *ms, uint8_t *src_addr, uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
Definition: util-macset.c:179
FLOW_DEFAULT_HASHSIZE
#define FLOW_DEFAULT_HASHSIZE
Definition: flow.c:76
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:294
FLOW_DEFAULT_PREALLOC
#define FLOW_DEFAULT_PREALLOC
Definition: flow.c:80
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:288
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1464
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:60
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:71
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:598
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:198
Flow_::proto
uint8_t proto
Definition: flow.h:372
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
action-globals.h
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:123
Packet_::flags
uint32_t flags
Definition: decode.h:467
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
threads.h
util-macset.h
FlowGetFlags
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
Definition: flow.c:1247
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:350
run_mode
int run_mode
Definition: suricata.c:176
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
FlowProtoTimeout_
Definition: flow.h:514
flow-hash.h
FlowGetSourcePort
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
Definition: flow.c:1224
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:63
FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
Definition: flow.h:82
FlowReset
void FlowReset(void)
Definition: flow.c:677
FlowLookupStruct_
Definition: flow.h:538
FLOW_DEFAULT_EMERG_NEW_TIMEOUT
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
Definition: flow-private.h:54
Flow
struct Flow_ Flow
Flow data structure.
FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:57
BypassedFlowUpdate
void BypassedFlowUpdate(Flow *f, Packet *p)
Definition: flow-bypass.c:211
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:518
FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_DEFAULT_EST_TIMEOUT
Definition: flow-private.h:41
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:222
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:155
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:140
MIN
#define MIN(x, y)
Definition: suricata-common.h:391
IPPROTO_DCCP
#define IPPROTO_DCCP
Definition: decode.h:925
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:134
FlowQueueDestroy
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
Definition: flow-queue.c:60
util-privs.h
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:533
stream-tcp-reassemble.h
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:66
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
RandomGet
long int RandomGet(void)
Definition: util-random.c:130
FLOW_TOSERVER_DROP_LOGGED
#define FLOW_TOSERVER_DROP_LOGGED
Definition: flow.h:74
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:467
proto
uint8_t proto
Definition: decode-template.h:0
Flow_::dp
Port dp
Definition: flow.h:366
FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
Definition: flow.h:92
FLOW_DEFAULT_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
Definition: flow-private.h:42
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:461
MAX
#define MAX(x, y)
Definition: suricata-common.h:395
Flow_::protoctx
void * protoctx
Definition: flow.h:440
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:682
ExceptionPolicyParse
enum ExceptionPolicy ExceptionPolicyParse(const char *option, bool support_flow)
Definition: util-exception-policy.c:231
FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
Definition: flow-private.h:49
STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
Definition: stream-tcp-private.h:223
util-unittest.h
FLOW_BYPASSED_TIMEOUT
#define FLOW_BYPASSED_TIMEOUT
Definition: flow-private.h:65
util-unittest-helper.h
FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
Definition: flow-private.h:59
FLOW_IPPROTO_ICMP_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
Definition: flow-private.h:51
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:289
UTHBuildPacketOfFlows
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
Definition: util-unittest-helper.c:872
AppLayerExpectationClean
void AppLayerExpectationClean(Flow *f)
Definition: app-layer-expectation.c:361
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:411
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1038
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:482
FlowGetDestinationPort
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
Definition: flow.c:1236
FLOW_CHECK_MEMCAP
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
Definition: flow-util.h:136
FLOW_RECYCLE
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
Definition: flow-util.h:81
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:494
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:69
flow-spare-pool.h
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:474
FLOWFILE_NO_SHA1_TC
#define FLOWFILE_NO_SHA1_TC
Definition: flow.h:135
FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
Definition: flow-private.h:63
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:547
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:487
app-layer-expectation.h
FLOW_IPPROTO_UDP_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
Definition: flow-private.h:48
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:503
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:466
decode.h
util-debug.h
TOSERVER
#define TOSERVER
Definition: flow.h:43
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:74
Packet_::ts
SCTime_t ts
Definition: decode.h:475
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:491
FLOWFILE_NO_STORE_TS
#define FLOWFILE_NO_STORE_TS
Definition: flow.h:127
FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
Definition: flow-private.h:45
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:413
Flow_::lastts
SCTime_t lastts
Definition: flow.h:409
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
FLOW_CHANGE_PROTO
#define FLOW_CHANGE_PROTO
Definition: flow.h:104
Packet_::ethh
EthernetHdr * ethh
Definition: decode.h:528
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
FlowStorageSize
unsigned int FlowStorageSize(void)
Definition: flow-storage.c:35
Packet_::sp
Port sp
Definition: decode.h:437
FlowCnf_
Definition: flow.h:286
FLOWFILE_NO_SHA256_TS
#define FLOWFILE_NO_SHA256_TS
Definition: flow.h:138
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:228
FlowQueueInit
FlowQueue * FlowQueueInit(FlowQueue *q)
Definition: flow-queue.c:46
FlowState
FlowState
Definition: flow.h:499
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:285
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:515
StringParseUint32
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:313
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:517
util-time.h
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
app-layer-parser.h
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1649
FLOW_PROTO_DETECT_TC_DONE
#define FLOW_PROTO_DETECT_TC_DONE
Definition: flow.h:101
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:493
FLOW_TC_PP_ALPROTO_DETECT_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
Definition: flow.h:90
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:479
MacSetFlowStorageEnabled
bool MacSetFlowStorageEnabled(void)
Definition: util-macset.c:84
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:342
stream.h
TimeSetIncrementTime
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
Definition: util-time.c:180
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:97
Packet_
Definition: decode.h:430
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
FLOW_DEFAULT_MEMCAP
#define FLOW_DEFAULT_MEMCAP
Definition: flow.c:78
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:219
stream-tcp-private.h
MacSet_
Definition: util-macset.c:44
conf.h
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:162
FLOW_TOSERVER_IPONLY_SET
#define FLOW_TOSERVER_IPONLY_SET
Definition: flow.h:56
FLOW_IPPROTO_TCP_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
Definition: flow-private.h:43
STREAMTCP_STREAM_FLAG_HAS_GAP
#define STREAMTCP_STREAM_FLAG_HAS_GAP
Definition: stream-tcp-private.h:217
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:522
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1113
flow_timeouts_delta
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Definition: flow.c:99
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:287
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
flow-timeout.h
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:468
MacSetGetFlowStorageID
FlowStorageId MacSetGetFlowStorageID(void)
Definition: util-macset.c:113
flow-queue.h
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:418
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:223
runmodes.h
FLOW_TO_DST_SEEN
#define FLOW_TO_DST_SEEN
Definition: flow.h:51
FlowGetStorageById
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
Definition: flow-storage.c:40
FlowUpdateState
void FlowUpdateState(Flow *f, const enum FlowState s)
Definition: flow.c:1178
Flow_::src
FlowAddress src
Definition: flow.h:353
Flow_::next
struct Flow_ * next
Definition: flow.h:395
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:417
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
FLOWFILE_NO_SHA256_TC
#define FLOWFILE_NO_SHA256_TC
Definition: flow.h:139
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:786
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:58
FlowDequeue
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
Definition: flow-queue.c:191
FLOW_TO_SRC_SEEN
#define FLOW_TO_SRC_SEEN
Definition: flow.h:49
flow-storage.h
FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
Definition: flow.h:86
Packet_::flow
struct Flow_ * flow
Definition: decode.h:469
FLOW_IPPROTO_UDP_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
Definition: flow-private.h:47
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1141
FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
Definition: flow-private.h:50
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:97
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:68
CMP_ADDR
#define CMP_ADDR(a1, a2)
Definition: decode.h:233
FlowStateType
unsigned short FlowStateType
Definition: flow.h:324
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:124
flags
uint8_t flags
Definition: decode-gre.h:0
FLOW_TOCLIENT_IPONLY_SET
#define FLOW_TOCLIENT_IPONLY_SET
Definition: flow.h:58
flow-manager.h
suricata-common.h
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:82
flow_config
FlowConfig flow_config
Definition: flow.c:102
FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
Definition: flow-private.h:46
FLOW_HAS_ALERTS
#define FLOW_HAS_ALERTS
Definition: flow.h:79
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:695
FlowSparePoolDestroy
void FlowSparePoolDestroy(void)
Definition: flow-spare-pool.c:312
packet.h
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
SWAP_VARS
#define SWAP_VARS(type, a, b)
Definition: suricata-common.h:428
FlowTimeoutsInit
void FlowTimeoutsInit(void)
Definition: flow-manager.c:106
SCTIME_SECS
#define SCTIME_SECS(t)
Definition: util-time.h:57
FLOW_PROTO_DETECT_TS_DONE
#define FLOW_PROTO_DETECT_TS_DONE
Definition: flow.h:100
FatalError
#define FatalError(...)
Definition: util-debug.h:502
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:469
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:295
FLOW_TS_PP_ALPROTO_DETECT_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
Definition: flow.h:84
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1039
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1212
FLOWFILE_NO_STORE_TC
#define FLOWFILE_NO_STORE_TC
Definition: flow.h:128
FlowGetFlowFromHash
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
Definition: flow-hash.c:843
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:404
FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
Definition: flow-private.h:58
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
PKT_IS_ICMPV4
#define PKT_IS_ICMPV4(p)
Definition: decode.h:249
threadvars.h
util-validate.h
FlowSwap
void FlowSwap(Flow *f)
swap the flow's direction
Definition: flow.c:284
FlowCnf_::memcap_policy
enum ExceptionPolicy memcap_policy
Definition: flow.h:296
ICMPV4_IS_ERROR_MSG
#define ICMPV4_IS_ERROR_MSG(p)
Definition: decode-icmpv4.h:284
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FlowInitFlowProto
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
Definition: flow.c:739
SCTIME_CMP_GT
#define SCTIME_CMP_GT(a, b)
Definition: util-time.h:104
FLOWFILE_NO_SHA1_TS
#define FLOWFILE_NO_SHA1_TS
Definition: flow.h:134
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:294
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
flow_recycle_q
FlowQueue flow_recycle_q
Definition: flow-manager.c:73
SWAP_FLAGS
#define SWAP_FLAGS(flags, a, b)
Definition: suricata-common.h:417
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:69
CMP_PORT
#define CMP_PORT(p1, p2)
Definition: decode.h:238
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:673
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:450
ConfNode_
Definition: conf.h:32
Flow_::alstate
void * alstate
Definition: flow.h:475
flow_freefuncs
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
Definition: flow.c:100
flow_timeouts_emerg
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow.c:98
Flow_::flags
uint32_t flags
Definition: flow.h:420
FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
Definition: flow-private.h:61
FlowFreeStorage
void FlowFreeStorage(Flow *f)
Definition: flow-storage.c:60
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:683
FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:62
FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_TOCLIENT_DROP_LOGGED
Definition: flow.h:76
util-random.h
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:224
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
PacketDrop
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
Definition: packet.c:32
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:229
FLOW_EMERGENCY
#define FLOW_EMERGENCY
Definition: flow-private.h:37
suricata.h
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:71
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:41
FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
Definition: flow.h:88
FLOW_DEFAULT_EMERGENCY_RECOVERY
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
Definition: flow.c:73
FlowHasAlerts
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:184
FlowSparePoolInit
void FlowSparePoolInit(void)
Definition: flow-spare-pool.c:293
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:933
FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
Definition: flow-private.h:55
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:61
FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
Definition: flow-private.h:52
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:516
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:233
Flow_::sp
Port sp
Definition: flow.h:355
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1157
TcpSession_
Definition: stream-tcp-private.h:283
util-misc.h
TcpSession_::data_first_seen_dir
int8_t data_first_seen_dir
Definition: stream-tcp-private.h:288
FlowHasGaps
bool FlowHasGaps(const Flow *f, uint8_t way)
Definition: flow.c:193
flow.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:451
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:422
Packet_::dp
Port dp
Definition: decode.h:445
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:108
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:390
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
FLOW_IPPROTO_TCP_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
Definition: flow-private.h:44
RegisterFlowStorageTests
void RegisterFlowStorageTests(void)
Definition: flow-storage.c:295
SET_DEFAULTS
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
flow-var.h
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:245
TOCLIENT
#define TOCLIENT
Definition: flow.h:44
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:227
PKT_DROP_REASON_FLOW_DROP
@ PKT_DROP_REASON_FLOW_DROP
Definition: decode.h:396
Packet_::src
Address src
Definition: decode.h:434
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:492
IPV4_GET_IPTTL
#define IPV4_GET_IPTTL(p)
Definition: decode-ipv4.h:146
SCTIME_USECS
#define SCTIME_USECS(t)
Definition: util-time.h:56
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:119
FlowProtoFreeFunc_
Definition: flow.h:521
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:814