Go to the documentation of this file.
73 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
76 #define FLOW_DEFAULT_HASHSIZE 65536
78 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024)
80 #define FLOW_DEFAULT_PREALLOC 10000
148 if (f == NULL || f->
proto == 0)
195 if (f->
proto == IPPROTO_TCP) {
198 if (way == STREAM_TOCLIENT) {
242 static inline void FlowSwapFlags(
Flow *f)
256 static inline void FlowSwapFileFlags(
Flow *f)
266 static inline void TcpStreamFlowSwap(
Flow *f)
292 FlowSwapFileFlags(f);
294 if (f->
proto == IPPROTO_TCP) {
295 TcpStreamFlowSwap(f);
334 }
else if (p->
proto == IPPROTO_ICMP || p->
proto == IPPROTO_ICMPV6) {
354 static inline int FlowUpdateSeenFlag(
const Packet *p)
365 static inline void FlowUpdateTtlTS(
Flow *f,
Packet *p, uint8_t ttl)
375 static inline void FlowUpdateTtlTC(
Flow *f,
Packet *p, uint8_t ttl)
386 Flow *f, EthernetHdr *ethh,
bool toserver)
418 #ifdef CAPTURE_OFFLOAD
421 if (state != FLOW_STATE_CAPTURE_BYPASSED) {
431 #ifdef CAPTURE_OFFLOAD
435 SCLogDebug(
"Downgrading flow to local bypass");
453 if (FlowUpdateSeenFlag(p)) {
463 FlowUpdateEthernet(
tv,
dtv, f, p->
ethh,
true);
475 if (FlowUpdateSeenFlag(p)) {
485 FlowUpdateEthernet(
tv,
dtv, f, p->
ethh,
false);
498 }
else if (f->
proto == IPPROTO_TCP) {
516 SCLogDebug(
"setting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
517 DecodeSetNoPacketInspectionFlag(p);
520 SCLogDebug(
"setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
521 DecodeSetNoPayloadInspectionFlag(p);
569 if (
ConfGetInt(
"flow.emergency-recovery", &val) == 1) {
570 if (val <= 100 && val >= 1) {
573 SCLogError(
"flow.emergency-recovery must be in the range of "
574 "1 and 100 (as percentage)");
578 SCLogDebug(
"flow.emergency-recovery, using default value");
583 const char *conf_val;
584 uint32_t configval = 0;
587 uint64_t flow_memcap_copy = 0;
588 if ((
ConfGet(
"flow.memcap", &conf_val)) == 1)
590 if (conf_val == NULL) {
591 FatalError(
"Invalid value for flow.memcap: NULL");
596 "from conf file - %s. Killing engine",
603 if ((
ConfGet(
"flow.hash-size", &conf_val)) == 1)
605 if (conf_val == NULL) {
606 FatalError(
"Invalid value for flow.hash-size: NULL");
609 if (
StringParseUint32(&configval, 10, strlen(conf_val), conf_val) && configval != 0) {
612 FatalError(
"Invalid value for flow.hash-size. Must be a numeric value in the range "
616 if ((
ConfGet(
"flow.prealloc", &conf_val)) == 1)
618 if (conf_val == NULL) {
619 FatalError(
"Invalid value for flow.prealloc: NULL");
630 SCLogDebug(
"Flow config from suricata.yaml: memcap: %"PRIu64
", hash-size: "
638 "max flow memcap is smaller than projected hash size. "
639 "Memcap: %" PRIu64
", Hash table size %" PRIu64
". Calculate "
640 "total hash size by multiplying \"flow.hash-size\" with %" PRIuMAX
", "
641 "which is the hash bucket size.",
647 FatalError(
"Fatal error encountered in FlowInitConfig. Exiting...");
659 SCLogConfig(
"allocated %"PRIu64
" bytes of memory for the flow hash... "
660 "%" PRIu32
" buckets of size %" PRIuMAX
"",
662 (uintmax_t)
sizeof(FlowBucket));
666 SCLogConfig(
"flow memory usage: %"PRIu64
" bytes, maximum: %"PRIu64,
673 SCLogConfig(
"flow size %u, memcap allows for %" PRIu64
" flows. Per hash row in perfect "
674 "conditions %" PRIu64,
745 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
746 flow_timeouts_normal[(p)].new_timeout = (n); \
747 flow_timeouts_normal[(p)].est_timeout = (e); \
748 flow_timeouts_normal[(p)].closed_timeout = (c); \
749 flow_timeouts_normal[(p)].bypassed_timeout = (b); \
750 flow_timeouts_emerg[(p)].new_timeout = (ne); \
751 flow_timeouts_emerg[(p)].est_timeout = (ee); \
752 flow_timeouts_emerg[(p)].closed_timeout = (ce); \
753 flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
782 const char *
new = NULL;
783 const char *established = NULL;
784 const char *closed = NULL;
785 const char *bypassed = NULL;
786 const char *emergency_new = NULL;
787 const char *emergency_established = NULL;
788 const char *emergency_closed = NULL;
789 const char *emergency_bypassed = NULL;
792 if (flow_timeouts != NULL) {
794 uint32_t configval = 0;
805 "emergency-established");
809 "emergency-bypassed");
816 if (established != NULL &&
822 if (closed != NULL &&
828 if (bypassed != NULL &&
835 if (emergency_new != NULL &&
837 emergency_new) > 0) {
841 if (emergency_established != NULL &&
843 strlen(emergency_established),
844 emergency_established) > 0) {
848 if (emergency_closed != NULL &&
850 strlen(emergency_closed),
851 emergency_closed) > 0) {
855 if (emergency_bypassed != NULL &&
857 strlen(emergency_bypassed),
858 emergency_bypassed) > 0) {
873 "emergency-established");
877 "emergency-bypassed");
884 if (established != NULL &&
890 if (closed != NULL &&
896 if (bypassed != NULL &&
903 if (emergency_new != NULL &&
905 emergency_new) > 0) {
909 if (emergency_established != NULL &&
911 strlen(emergency_established),
912 emergency_established) > 0) {
916 if (emergency_closed != NULL &&
918 strlen(emergency_closed),
919 emergency_closed) > 0) {
923 if (emergency_bypassed != NULL &&
925 strlen(emergency_bypassed),
926 emergency_bypassed) > 0) {
940 "emergency-established");
942 "emergency-bypassed");
949 if (established != NULL &&
955 if (bypassed != NULL &&
962 if (emergency_new != NULL &&
964 emergency_new) > 0) {
968 if (emergency_established != NULL &&
970 strlen(emergency_established),
971 emergency_established) > 0) {
975 if (emergency_bypassed != NULL &&
977 strlen(emergency_bypassed),
978 emergency_bypassed) > 0) {
992 "emergency-established");
994 "emergency-bypassed");
1001 if (established != NULL &&
1007 if (bypassed != NULL &&
1014 if (emergency_new != NULL &&
1016 emergency_new) > 0) {
1020 if (emergency_established != NULL &&
1022 strlen(emergency_established),
1023 emergency_established) > 0) {
1027 if (emergency_bypassed != NULL &&
1029 strlen(emergency_bypassed),
1030 emergency_bypassed) > 0) {
1043 SCLogWarning(
"emergency timeout value %u for \'established\' "
1044 "must be below regular value %u",
1050 SCLogWarning(
"emergency timeout value %u for \'new\' must be "
1051 "below regular value %u",
1057 SCLogWarning(
"emergency timeout value %u for \'closed\' must "
1058 "be below regular value %u",
1064 SCLogWarning(
"emergency timeout value %u for \'bypassed\' "
1065 "must be below regular value %u",
1077 SCLogWarning(
"emergency timeout value for \'established\' must be below normal value");
1083 SCLogWarning(
"emergency timeout value for \'new\' must be below normal value");
1089 SCLogWarning(
"emergency timeout value for \'closed\' must be below normal value");
1095 SCLogWarning(
"emergency timeout value for \'bypassed\' must be below normal value");
1100 SCLogDebug(
"deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1161 if (f->
proto != IPPROTO_TCP) {
1168 uint8_t newflags =
flags;
1173 newflags |= STREAM_DEPTH;
1188 const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1197 if (f->
fb != NULL) {
1264 static int FlowTest01 (
void)
1298 static void test(
void *f) {}
1307 static int FlowTest02 (
void)
1329 static int FlowTest07 (
void)
1375 static int FlowTest08 (
void)
1422 static int FlowTest09 (
void)
1469 UtRegisterTest(
"FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1470 UtRegisterTest(
"FlowTest02 -- Setting Protocol Specific Free Function",
1472 UtRegisterTest(
"FlowTest07 -- Test flow Allocations when it reach memcap",
1474 UtRegisterTest(
"FlowTest08 -- Test flow Allocations when it reach memcap",
1476 UtRegisterTest(
"FlowTest09 -- Test flow Allocations when it reach memcap",
#define FLOWFILE_NO_MD5_TS
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
#define FLOWFILE_NO_MD5_TC
#define FBLOCK_DESTROY(fb)
#define FLOW_DEFAULT_NEW_TIMEOUT
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOWFILE_NO_SIZE_TS
#define FLOW_HAS_EXPECTATION
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
#define FLOWFILE_NO_SIZE_TC
void FlowCleanupAppLayer(Flow *f)
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
uint32_t FlowSpareGetPoolSize(void)
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
void MacSetAddWithCtr(MacSet *ms, uint8_t *src_addr, uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
#define FLOW_DEFAULT_HASHSIZE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
uint32_t emergency_recovery
#define FLOW_DEFAULT_PREALLOC
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void FlowRegisterTests(void)
Function to register the Flow Unitests.
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_SGH_TOCLIENT
int ParseSizeStringU64(const char *size, uint64_t *res)
#define FLOWFILE_NO_MAGIC_TS
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
#define FLOW_NOPAYLOAD_INSPECTION
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
struct Flow_ Flow
Flow data structure.
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
void BypassedFlowUpdate(Flow *f, Packet *p)
uint32_t bypassed_timeout
#define FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_PKT_TOSERVER
uint64_t FlowGetMemuse(void)
uint64_t FlowGetMemcap(void)
Return memcap value.
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
#define FLOW_TOSERVER_DROP_LOGGED
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
uint16_t counter_max_mac_addrs_src
enum ExceptionPolicy ExceptionPolicyParse(const char *option, bool support_flow)
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define FLOW_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
void AppLayerExpectationClean(Flow *f)
#define PKT_PROTO_DETECT_TS_DONE
const struct SigGroupHead_ * sgh_toserver
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
AppLayerParserState * alparser
#define FLOWFILE_NO_SHA1_TC
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
void FlowInitConfig(bool quiet)
initialize the configuration
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
@ FLOW_STATE_LOCAL_BYPASSED
#define PASS
Pass the test.
#define FLOWFILE_NO_STORE_TS
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
#define FLOW_CHANGE_PROTO
Per thread variable structure.
unsigned int FlowStorageSize(void)
#define FLOWFILE_NO_SHA256_TS
#define FLOW_PKT_TOCLIENT_FIRST
FlowQueue * FlowQueueInit(FlowQueue *q)
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
#define SCLogWarning(...)
Macro used to log WARNING messages.
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
#define FLOW_PROTO_DETECT_TC_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
const struct SigGroupHead_ * sgh_toclient
bool MacSetFlowStorageEnabled(void)
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
#define FLOW_DEFAULT_MEMCAP
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
#define FLOW_TOSERVER_IPONLY_SET
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
#define STREAMTCP_STREAM_FLAG_HAS_GAP
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Data structures and function prototypes for keeping state for the detection engine.
FlowStorageId MacSetGetFlowStorageID(void)
uint32_t probing_parser_toclient_alproto_masks
#define FLOW_PKT_TOCLIENT
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
void FlowUpdateState(Flow *f, const enum FlowState s)
uint32_t probing_parser_toserver_alproto_masks
#define FLOWFILE_NO_SHA256_TC
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
unsigned short FlowStateType
#define FLOWFILE_NO_MAGIC_TC
#define FLOW_TOCLIENT_IPONLY_SET
void FlowFree(Flow *f)
cleanup & free the memory of a flow
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
void FlowShutdown(void)
shutdown the flow engine
void FlowSparePoolDestroy(void)
#define SCMallocAligned(size, align)
#define SWAP_VARS(type, a, b)
void FlowTimeoutsInit(void)
#define FLOW_PROTO_DETECT_TS_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
#define PKT_PROTO_DETECT_TC_DONE
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
#define FLOWFILE_NO_STORE_TC
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
void FlowSwap(Flow *f)
swap the flow's direction
enum ExceptionPolicy memcap_policy
#define ICMPV4_IS_ERROR_MSG(p)
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
#define SCTIME_CMP_GT(a, b)
#define FLOWFILE_NO_SHA1_TS
#define SCLogError(...)
Macro used to log ERROR messages.
#define SWAP_FLAGS(flags, a, b)
#define FLOW_SGH_TOSERVER
Structure to hold thread specific data for all decode modules.
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
void FlowFreeStorage(Flow *f)
uint16_t counter_max_mac_addrs_dst
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_PKT_ESTABLISHED
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
int EngineModeIsIPS(void)
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
void FlowSparePoolInit(void)
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_NOPACKET_INSPECTION
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
int8_t data_first_seen_dir
bool FlowHasGaps(const Flow *f, uint8_t way)
#define FLOW_DIR_REVERSED
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
void RegisterFlowStorageTests(void)
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
#define FLOW_PKT_TOSERVER_FIRST
@ PKT_DROP_REASON_FLOW_DROP
#define IPV4_GET_IPTTL(p)
int FlowSetMemcap(uint64_t size)
Update memcap value.
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.