suricata
flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow implementation.
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 
29 #include "action-globals.h"
30 #include "packet.h"
31 #include "decode.h"
32 #include "conf.h"
33 #include "threadvars.h"
34 
35 #include "util-random.h"
36 #include "util-time.h"
37 
38 #include "flow.h"
39 #include "flow-queue.h"
40 #include "flow-hash.h"
41 #include "flow-util.h"
42 #include "flow-private.h"
43 #include "flow-manager.h"
44 #include "flow-storage.h"
45 #include "flow-bypass.h"
46 #include "flow-spare-pool.h"
47 #include "flow-callbacks.h"
48 
49 #include "stream-tcp-private.h"
50 
51 #include "util-unittest.h"
52 #include "util-unittest-helper.h"
53 #include "util-byte.h"
54 #include "util-misc.h"
55 #include "util-macset.h"
56 #include "util-flow-rate.h"
57 
58 #include "util-debug.h"
59 
60 #include "app-layer-parser.h"
61 #include "app-layer-expectation.h"
62 
63 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
64 
65 //#define FLOW_DEFAULT_HASHSIZE 262144
66 #define FLOW_DEFAULT_HASHSIZE 65536
67 //#define FLOW_DEFAULT_MEMCAP 128 * 1024 * 1024 /* 128 MB */
68 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32 MB */
69 
70 #define FLOW_DEFAULT_PREALLOC 10000
71 
73 
74 /** atomic int that is used when freeing a flow from the hash. In this
75  * case we walk the hash to find a flow to free. This var records where
76  * we left off in the hash. Without this only the top rows of the hash
77  * are freed. This isn't just about fairness. Under severe pressure, the
78  * hash rows on top would be all freed and the time to find a flow to
79  * free increased with every run. */
80 SC_ATOMIC_DECLARE(unsigned int, flow_prune_idx);
81 
82 /** atomic flags */
83 SC_ATOMIC_DECLARE(unsigned int, flow_flags);
84 
85 /** FlowProto specific timeouts and free/state functions */
86 
91 
93 
94 /** flow memuse counter (atomic), for enforcing memcap limit */
95 SC_ATOMIC_DECLARE(uint64_t, flow_memuse);
96 
97 void FlowRegisterTests(void);
98 void FlowInitFlowProto(void);
99 int FlowSetProtoFreeFunc(uint8_t, void (*Free)(void *));
100 
101 /**
102  * \brief Update memcap value
103  *
104  * \param size new memcap value
105  */
106 int FlowSetMemcap(uint64_t size)
107 {
108  if ((uint64_t)SC_ATOMIC_GET(flow_memuse) < size) {
109  SC_ATOMIC_SET(flow_config.memcap, size);
110  return 1;
111  }
112 
113  return 0;
114 }
115 
116 /**
117  * \brief Return memcap value
118  *
119  * \retval memcap value
120  */
121 uint64_t FlowGetMemcap(void)
122 {
123  uint64_t memcapcopy = SC_ATOMIC_GET(flow_config.memcap);
124  return memcapcopy;
125 }
126 
127 uint64_t FlowGetMemuse(void)
128 {
129  uint64_t memusecopy = SC_ATOMIC_GET(flow_memuse);
130  return memusecopy;
131 }
132 
134 {
135  return flow_config.memcap_policy;
136 }
137 
139 {
140  if (f == NULL || f->proto == 0)
141  return;
142 
144  f->alstate = NULL;
145  f->alparser = NULL;
146 }
147 
148 /** \brief Set flag to indicate that flow has alerts
149  *
150  * \param f flow
151  */
153 {
154  f->flags |= FLOW_HAS_ALERTS;
155 }
156 
157 /** \brief Check if flow has alerts
158  *
159  * \param f flow
160  * \retval 1 has alerts
161  * \retval 0 has not alerts
162  */
163 int FlowHasAlerts(const Flow *f)
164 {
165  if (f->flags & FLOW_HAS_ALERTS) {
166  return 1;
167  }
168 
169  return 0;
170 }
171 
172 /** \brief Set flag to indicate to change proto for the flow
173  *
174  * \param f flow
175  */
177 {
178  f->flags |= FLOW_CHANGE_PROTO;
179 }
180 
181 /** \brief Unset flag to indicate to change proto for the flow
182  *
183  * \param f flow
184  */
186 {
187  f->flags &= ~FLOW_CHANGE_PROTO;
188 }
189 
190 /** \brief Check if change proto flag is set for flow
191  * \param f flow
192  * \retval 1 change proto flag is set
193  * \retval 0 change proto flag is not set
194  */
196 {
197  if (f->flags & FLOW_CHANGE_PROTO) {
198  return 1;
199  }
200 
201  return 0;
202 }
203 
204 static inline void FlowSwapFlags(Flow *f)
205 {
208 
213 
215 }
216 
217 static inline void FlowSwapFileFlags(Flow *f)
218 {
225 }
226 
227 static inline void TcpStreamFlowSwap(Flow *f)
228 {
229  TcpSession *ssn = f->protoctx;
230  SWAP_VARS(TcpStream, ssn->server, ssn->client);
231  if (ssn->data_first_seen_dir & STREAM_TOSERVER) {
232  ssn->data_first_seen_dir = STREAM_TOCLIENT;
233  } else if (ssn->data_first_seen_dir & STREAM_TOCLIENT) {
234  ssn->data_first_seen_dir = STREAM_TOSERVER;
235  }
236 }
237 
238 /** \brief swap the flow's direction
239  * \note leaves the 'header' untouched. Interpret that based
240  * on FLOW_DIR_REVERSED flag.
241  * \warning: only valid before applayer parsing started. This
242  * function doesn't swap anything in Flow::alparser,
243  * Flow::alstate
244  */
245 void FlowSwap(Flow *f)
246 {
247  f->flags |= FLOW_DIR_REVERSED;
248 
251 
252  FlowSwapFlags(f);
253  FlowSwapFileFlags(f);
254 
255  SWAP_VARS(FlowThreadId, f->thread_id[0], f->thread_id[1]);
256 
257  if (f->proto == IPPROTO_TCP) {
258  TcpStreamFlowSwap(f);
259  }
260 
264 
265  /* not touching Flow::alparser and Flow::alstate */
266 
267  SWAP_VARS(const void *, f->sgh_toclient, f->sgh_toserver);
268 
269  SWAP_VARS(uint32_t, f->todstpktcnt, f->tosrcpktcnt);
270  SWAP_VARS(uint64_t, f->todstbytecnt, f->tosrcbytecnt);
271 }
272 
273 /**
274  * \brief determine the direction of the packet compared to the flow
275  * \retval 0 to_server
276  * \retval 1 to_client
277  */
278 int FlowGetPacketDirection(const Flow *f, const Packet *p)
279 {
280  const int reverse = (f->flags & FLOW_DIR_REVERSED) != 0;
281 
282  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
283  if (!(CMP_PORT(p->sp,p->dp))) {
284  /* update flags and counters */
285  if (CMP_PORT(f->sp,p->sp)) {
286  return TOSERVER ^ reverse;
287  } else {
288  return TOCLIENT ^ reverse;
289  }
290  } else {
291  if (CMP_ADDR(&f->src,&p->src)) {
292  return TOSERVER ^ reverse;
293  } else {
294  return TOCLIENT ^ reverse;
295  }
296  }
297  } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
298  if (CMP_ADDR(&f->src,&p->src)) {
299  return TOSERVER ^ reverse;
300  } else {
301  return TOCLIENT ^ reverse;
302  }
303  }
304 
305  /* default to toserver */
306  return TOSERVER;
307 }
308 
309 /**
310  * \brief Check to update "seen" flags
311  *
312  * \param p packet
313  *
314  * \retval 1 true
315  * \retval 0 false
316  */
317 static inline int FlowUpdateSeenFlag(const Packet *p)
318 {
319  if (PacketIsICMPv4(p)) {
320  if (ICMPV4_IS_ERROR_MSG(p->icmp_s.type)) {
321  return 0;
322  }
323  }
324 
325  return 1;
326 }
327 
328 static inline void FlowUpdateTtlTS(Flow *f, uint8_t ttl)
329 {
330  if (f->min_ttl_toserver == 0) {
331  f->min_ttl_toserver = ttl;
332  } else {
333  f->min_ttl_toserver = MIN(f->min_ttl_toserver, ttl);
334  }
335  f->max_ttl_toserver = MAX(f->max_ttl_toserver, ttl);
336 }
337 
338 static inline void FlowUpdateTtlTC(Flow *f, uint8_t ttl)
339 {
340  if (f->min_ttl_toclient == 0) {
341  f->min_ttl_toclient = ttl;
342  } else {
343  f->min_ttl_toclient = MIN(f->min_ttl_toclient, ttl);
344  }
345  f->max_ttl_toclient = MAX(f->max_ttl_toclient, ttl);
346 }
347 
348 static inline void FlowUpdateFlowRate(
349  ThreadVars *tv, DecodeThreadVars *dtv, Flow *f, const Packet *p, int dir)
350 {
351  if (FlowRateStorageEnabled()) {
352  /* No need to update the struct if flow is already marked as elephant flow */
353  if (f->flags & FLOW_IS_ELEPHANT)
354  return;
356  if (frs != NULL) {
357  FlowRateStoreUpdate(frs, p->ts, GET_PKT_LEN(p), dir);
358  bool fr_exceeds = FlowRateIsExceeding(frs, dir);
359  if (fr_exceeds) {
360  SCLogDebug("Flow rate for flow %p exceeds the configured values, marking it as an "
361  "elephant flow",
362  f);
363  f->flags |= FLOW_IS_ELEPHANT;
364  if (tv != NULL) {
366  }
367  }
368  }
369  }
370 }
371 
372 static inline void FlowUpdateEthernet(
373  ThreadVars *tv, DecodeThreadVars *dtv, Flow *f, const Packet *p, bool toserver)
374 {
375  if (PacketIsEthernet(p) && MacSetFlowStorageEnabled()) {
376  const EthernetHdr *ethh = PacketGetEthernet(p);
378  if (ms != NULL) {
379  if (toserver) {
380  MacSetAddWithCtr(ms, ethh->eth_src, ethh->eth_dst, tv,
383  } else {
384  MacSetAddWithCtr(ms, ethh->eth_dst, ethh->eth_src, tv,
387  }
388  }
389  }
390 }
391 
392 /** \brief Update Packet and Flow
393  *
394  * Updates packet and flow based on the new packet.
395  *
396  * \param f locked flow
397  * \param p packet
398  *
399  * \note overwrites p::flowflags
400  */
402 {
403  SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f);
404 
405  const int pkt_dir = FlowGetPacketDirection(f, p);
406 #ifdef CAPTURE_OFFLOAD
407  int state = f->flow_state;
408 
409  if (state != FLOW_STATE_CAPTURE_BYPASSED) {
410 #endif
411  /* update the last seen timestamp of this flow */
412  if (SCTIME_CMP_GT(p->ts, f->lastts)) {
413  f->lastts = p->ts;
414  }
415 #ifdef CAPTURE_OFFLOAD
416  } else {
417  /* still seeing packet, we downgrade to local bypass */
418  if (SCTIME_SECS(p->ts) - SCTIME_SECS(f->lastts) > FLOW_BYPASSED_TIMEOUT / 2) {
419  SCLogDebug("Downgrading flow to local bypass");
420  f->lastts = p->ts;
422  } else {
423  /* In IPS mode the packet could come from the other interface so it would
424  * need to be bypassed */
425  if (EngineModeIsIPS()) {
426  BypassedFlowUpdate(f, p);
427  }
428  }
429  }
430 #endif
431  /* update flags and counters */
432  if (pkt_dir == TOSERVER) {
433  f->todstpktcnt++;
434  f->todstbytecnt += GET_PKT_LEN(p);
435  FlowUpdateFlowRate(tv, dtv, f, p, TOSERVER);
437  if (!(f->flags & FLOW_TO_DST_SEEN)) {
438  if (FlowUpdateSeenFlag(p)) {
439  f->flags |= FLOW_TO_DST_SEEN;
442  }
443  }
444  /* xfer proto detect ts flag to first packet in ts dir */
445  if (f->flags & FLOW_PROTO_DETECT_TS_DONE) {
448  }
449  FlowUpdateEthernet(tv, dtv, f, p, true);
450  /* update flow's ttl fields if needed */
451  if (PacketIsIPv4(p)) {
452  const IPV4Hdr *ip4h = PacketGetIPv4(p);
453  FlowUpdateTtlTS(f, IPV4_GET_RAW_IPTTL(ip4h));
454  } else if (PacketIsIPv6(p)) {
455  const IPV6Hdr *ip6h = PacketGetIPv6(p);
456  FlowUpdateTtlTS(f, IPV6_GET_RAW_HLIM(ip6h));
457  }
458  } else {
459  f->tosrcpktcnt++;
460  f->tosrcbytecnt += GET_PKT_LEN(p);
461  FlowUpdateFlowRate(tv, dtv, f, p, TOCLIENT);
463  if (!(f->flags & FLOW_TO_SRC_SEEN)) {
464  if (FlowUpdateSeenFlag(p)) {
465  f->flags |= FLOW_TO_SRC_SEEN;
468  }
469  }
470  /* xfer proto detect tc flag to first packet in tc dir */
471  if (f->flags & FLOW_PROTO_DETECT_TC_DONE) {
474  }
475  FlowUpdateEthernet(tv, dtv, f, p, false);
476  /* update flow's ttl fields if needed */
477  if (PacketIsIPv4(p)) {
478  const IPV4Hdr *ip4h = PacketGetIPv4(p);
479  FlowUpdateTtlTC(f, IPV4_GET_RAW_IPTTL(ip4h));
480  } else if (PacketIsIPv6(p)) {
481  const IPV6Hdr *ip6h = PacketGetIPv6(p);
482  FlowUpdateTtlTC(f, IPV6_GET_RAW_HLIM(ip6h));
483  }
484  }
485  if (f->thread_id[pkt_dir] == 0) {
486  f->thread_id[pkt_dir] = (FlowThreadId)tv->id;
487  }
488 
490  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
492 
493  } else if (f->proto == IPPROTO_TCP) {
494  TcpSession *ssn = (TcpSession *)f->protoctx;
495  if (ssn != NULL && ssn->state >= TCP_ESTABLISHED) {
497  }
498  } else if ((f->flags & (FLOW_TO_DST_SEEN|FLOW_TO_SRC_SEEN)) ==
500  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
502 
503  if (
504 #ifdef CAPTURE_OFFLOAD
505  (f->flow_state != FLOW_STATE_CAPTURE_BYPASSED) &&
506 #endif
509  }
510  }
511 
512  if (f->flags & FLOW_ACTION_DROP) {
514  }
515 
516  if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
517  SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
518  DecodeSetNoPayloadInspectionFlag(p);
519  }
520 
522 }
523 
524 /** \brief Entry point for packet flow handling
525  *
526  * This is called for every packet.
527  *
528  * \param tv threadvars
529  * \param dtv decode thread vars (for flow output api thread data)
530  * \param p packet to handle flow for
531  */
533 {
534  /* Get this packet's flow from the hash. FlowHandlePacket() will setup
535  * a new flow if necessary. If we get NULL, we're out of flow memory.
536  * The returned flow is locked. */
537  Flow *f = FlowGetFlowFromHash(tv, fls, p, &p->flow);
538  if (f != NULL) {
539  /* set the flow in the packet */
540  p->flags |= PKT_HAS_FLOW;
541  }
542 }
543 
544 /** \brief initialize the configuration
545  * \warning Not thread safe */
546 void FlowInitConfig(bool quiet)
547 {
548  SCLogDebug("initializing flow engine...");
549 
550  memset(&flow_config, 0, sizeof(flow_config));
551  SC_ATOMIC_INIT(flow_flags);
552  SC_ATOMIC_INIT(flow_memuse);
553  SC_ATOMIC_INIT(flow_prune_idx);
554  SC_ATOMIC_INIT(flow_config.memcap);
556 
557  /* set defaults */
558  flow_config.hash_rand = (uint32_t)RandomGet();
562 
563  /* If we have specific config, overwrite the defaults with them,
564  * otherwise, leave the default values */
565  intmax_t val = 0;
566  if (SCConfGetInt("flow.emergency-recovery", &val) == 1) {
567  if (val <= 100 && val >= 1) {
568  flow_config.emergency_recovery = (uint8_t)val;
569  } else {
570  SCLogError("flow.emergency-recovery must be in the range of "
571  "1 and 100 (as percentage)");
573  }
574  } else {
575  SCLogDebug("flow.emergency-recovery, using default value");
577  }
578 
579  /* Check if we have memcap and hash_size defined at config */
580  const char *conf_val;
581  uint32_t configval = 0;
582 
583  /** set config values for memcap, prealloc and hash_size */
584  uint64_t flow_memcap_copy = 0;
585  if ((SCConfGet("flow.memcap", &conf_val)) == 1) {
586  if (conf_val == NULL) {
587  FatalError("Invalid value for flow.memcap: NULL");
588  }
589 
590  if (ParseSizeStringU64(conf_val, &flow_memcap_copy) < 0) {
591  SCLogError("Error parsing flow.memcap "
592  "from conf file - %s. Killing engine",
593  conf_val);
594  exit(EXIT_FAILURE);
595  } else {
596  SC_ATOMIC_SET(flow_config.memcap, flow_memcap_copy);
597  }
598  }
599  if ((SCConfGet("flow.hash-size", &conf_val)) == 1) {
600  if (conf_val == NULL) {
601  FatalError("Invalid value for flow.hash-size: NULL");
602  }
603 
604  if (StringParseUint32(&configval, 10, strlen(conf_val), conf_val) && configval != 0) {
605  flow_config.hash_size = configval;
606  } else {
607  FatalError("Invalid value for flow.hash-size. Must be a numeric value in the range "
608  "1-4294967295");
609  }
610  }
611  if ((SCConfGet("flow.prealloc", &conf_val)) == 1) {
612  if (conf_val == NULL) {
613  FatalError("Invalid value for flow.prealloc: NULL");
614  }
615 
616  if (StringParseUint32(&configval, 10, strlen(conf_val),
617  conf_val) > 0) {
618  flow_config.prealloc = configval;
619  }
620  }
621 
622  flow_config.memcap_policy = ExceptionPolicyParse("flow.memcap-policy", false);
623 
624  SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: "
625  "%"PRIu32", prealloc: %"PRIu32, SC_ATOMIC_GET(flow_config.memcap),
627 
628  /* alloc hash memory */
629  uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket);
630  if (!(FLOW_CHECK_MEMCAP(hash_size))) {
631  SCLogError("allocating flow hash failed: "
632  "max flow memcap is smaller than projected hash size. "
633  "Memcap: %" PRIu64 ", Hash table size %" PRIu64 ". Calculate "
634  "total hash size by multiplying \"flow.hash-size\" with %" PRIuMAX ", "
635  "which is the hash bucket size.",
636  SC_ATOMIC_GET(flow_config.memcap), hash_size, (uintmax_t)sizeof(FlowBucket));
637  exit(EXIT_FAILURE);
638  }
639  flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS);
640  if (unlikely(flow_hash == NULL)) {
641  FatalError("Fatal error encountered in FlowInitConfig. Exiting...");
642  }
643  memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket));
644 
645  uint32_t i = 0;
646  for (i = 0; i < flow_config.hash_size; i++) {
647  FBLOCK_INIT(&flow_hash[i]);
648  SC_ATOMIC_INIT(flow_hash[i].next_ts);
649  }
650  (void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket)));
651 
652  if (!quiet) {
653  SCLogConfig("allocated %"PRIu64" bytes of memory for the flow hash... "
654  "%" PRIu32 " buckets of size %" PRIuMAX "",
655  SC_ATOMIC_GET(flow_memuse), flow_config.hash_size,
656  (uintmax_t)sizeof(FlowBucket));
657  }
659  if (!quiet) {
660  SCLogConfig("flow memory usage: %"PRIu64" bytes, maximum: %"PRIu64,
661  SC_ATOMIC_GET(flow_memuse), SC_ATOMIC_GET(flow_config.memcap));
662  }
663 
665 
666  uint32_t sz = sizeof(Flow) + FlowStorageSize();
667  SCLogConfig("flow size %u, memcap allows for %" PRIu64 " flows. Per hash row in perfect "
668  "conditions %" PRIu64,
669  sz, flow_memcap_copy / sz, (flow_memcap_copy / sz) / flow_config.hash_size);
670 }
671 
672 void FlowReset(void)
673 {
674  // resets the flows (for reuse by fuzzing)
675  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
676  Flow *f = flow_hash[u].head;
677  while (f) {
678  Flow *n = f->next;
679  uint8_t proto_map = FlowGetProtoMapping(f->proto);
680  FlowClearMemory(f, proto_map);
681  FlowFree(f);
682  f = n;
683  }
684  flow_hash[u].head = NULL;
685  }
686 }
687 
688 /** \brief shutdown the flow engine
689  * \warning Not thread safe */
690 void FlowShutdown(void)
691 {
692  Flow *f;
693  while ((f = FlowDequeue(&flow_recycle_q))) {
694  FlowFree(f);
695  }
696 
697  /* clear and free the hash */
698  if (flow_hash != NULL) {
699  /* clean up flow mutexes */
700  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
701  f = flow_hash[u].head;
702  while (f) {
703  Flow *n = f->next;
704  uint8_t proto_map = FlowGetProtoMapping(f->proto);
705  FlowClearMemory(f, proto_map);
706  FlowFree(f);
707  f = n;
708  }
709  f = flow_hash[u].evicted;
710  while (f) {
711  Flow *n = f->next;
712  uint8_t proto_map = FlowGetProtoMapping(f->proto);
713  FlowClearMemory(f, proto_map);
714  FlowFree(f);
715  f = n;
716  }
717 
719  }
721  flow_hash = NULL;
722  }
723  (void) SC_ATOMIC_SUB(flow_memuse, flow_config.hash_size * sizeof(FlowBucket));
726  DEBUG_VALIDATE_BUG_ON(SC_ATOMIC_GET(flow_memuse) != 0);
727 }
728 
729 /**
730  * \brief Function to set the default timeout, free function and flow state
731  * function for all supported flow_proto.
732  */
733 
735 {
737 
738 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
739  flow_timeouts_normal[(p)].new_timeout = (n); \
740  flow_timeouts_normal[(p)].est_timeout = (e); \
741  flow_timeouts_normal[(p)].closed_timeout = (c); \
742  flow_timeouts_normal[(p)].bypassed_timeout = (b); \
743  flow_timeouts_emerg[(p)].new_timeout = (ne); \
744  flow_timeouts_emerg[(p)].est_timeout = (ee); \
745  flow_timeouts_emerg[(p)].closed_timeout = (ce); \
746  flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
747 
768 
773 
774  /* Let's see if we have custom timeouts defined from config */
775  const char *new = NULL;
776  const char *established = NULL;
777  const char *closed = NULL;
778  const char *bypassed = NULL;
779  const char *emergency_new = NULL;
780  const char *emergency_established = NULL;
781  const char *emergency_closed = NULL;
782  const char *emergency_bypassed = NULL;
783 
784  SCConfNode *flow_timeouts = SCConfGetNode("flow-timeouts");
785  if (flow_timeouts != NULL) {
786  SCConfNode *proto = NULL;
787  uint32_t configval = 0;
788 
789  /* Defaults. */
790  proto = SCConfNodeLookupChild(flow_timeouts, "default");
791  if (proto != NULL) {
792  new = SCConfNodeLookupChildValue(proto, "new");
793  established = SCConfNodeLookupChildValue(proto, "established");
794  closed = SCConfNodeLookupChildValue(proto, "closed");
795  bypassed = SCConfNodeLookupChildValue(proto, "bypassed");
796  emergency_new = SCConfNodeLookupChildValue(proto, "emergency-new");
797  emergency_established = SCConfNodeLookupChildValue(proto, "emergency-established");
798  emergency_closed = SCConfNodeLookupChildValue(proto, "emergency-closed");
799  emergency_bypassed = SCConfNodeLookupChildValue(proto, "emergency-bypassed");
800 
801  if (new != NULL &&
802  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
803 
805  }
806  if (established != NULL &&
807  StringParseUint32(&configval, 10, strlen(established),
808  established) > 0) {
809 
811  }
812  if (closed != NULL &&
813  StringParseUint32(&configval, 10, strlen(closed),
814  closed) > 0) {
815 
817  }
818  if (bypassed != NULL &&
819  StringParseUint32(&configval, 10,
820  strlen(bypassed),
821  bypassed) > 0) {
822 
824  }
825  if (emergency_new != NULL &&
826  StringParseUint32(&configval, 10, strlen(emergency_new),
827  emergency_new) > 0) {
828 
830  }
831  if (emergency_established != NULL &&
832  StringParseUint32(&configval, 10,
833  strlen(emergency_established),
834  emergency_established) > 0) {
835 
837  }
838  if (emergency_closed != NULL &&
839  StringParseUint32(&configval, 10,
840  strlen(emergency_closed),
841  emergency_closed) > 0) {
842 
844  }
845  if (emergency_bypassed != NULL &&
846  StringParseUint32(&configval, 10,
847  strlen(emergency_bypassed),
848  emergency_bypassed) > 0) {
849 
851  }
852  }
853 
854  /* TCP. */
855  proto = SCConfNodeLookupChild(flow_timeouts, "tcp");
856  if (proto != NULL) {
857  new = SCConfNodeLookupChildValue(proto, "new");
858  established = SCConfNodeLookupChildValue(proto, "established");
859  closed = SCConfNodeLookupChildValue(proto, "closed");
860  bypassed = SCConfNodeLookupChildValue(proto, "bypassed");
861  emergency_new = SCConfNodeLookupChildValue(proto, "emergency-new");
862  emergency_established = SCConfNodeLookupChildValue(proto, "emergency-established");
863  emergency_closed = SCConfNodeLookupChildValue(proto, "emergency-closed");
864  emergency_bypassed = SCConfNodeLookupChildValue(proto, "emergency-bypassed");
865 
866  if (new != NULL &&
867  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
868 
870  }
871  if (established != NULL &&
872  StringParseUint32(&configval, 10, strlen(established),
873  established) > 0) {
874 
876  }
877  if (closed != NULL &&
878  StringParseUint32(&configval, 10, strlen(closed),
879  closed) > 0) {
880 
882  }
883  if (bypassed != NULL &&
884  StringParseUint32(&configval, 10,
885  strlen(bypassed),
886  bypassed) > 0) {
887 
889  }
890  if (emergency_new != NULL &&
891  StringParseUint32(&configval, 10, strlen(emergency_new),
892  emergency_new) > 0) {
893 
895  }
896  if (emergency_established != NULL &&
897  StringParseUint32(&configval, 10,
898  strlen(emergency_established),
899  emergency_established) > 0) {
900 
902  }
903  if (emergency_closed != NULL &&
904  StringParseUint32(&configval, 10,
905  strlen(emergency_closed),
906  emergency_closed) > 0) {
907 
909  }
910  if (emergency_bypassed != NULL &&
911  StringParseUint32(&configval, 10,
912  strlen(emergency_bypassed),
913  emergency_bypassed) > 0) {
914 
916  }
917  }
918 
919  /* UDP. */
920  proto = SCConfNodeLookupChild(flow_timeouts, "udp");
921  if (proto != NULL) {
922  new = SCConfNodeLookupChildValue(proto, "new");
923  established = SCConfNodeLookupChildValue(proto, "established");
924  bypassed = SCConfNodeLookupChildValue(proto, "bypassed");
925  emergency_new = SCConfNodeLookupChildValue(proto, "emergency-new");
926  emergency_established = SCConfNodeLookupChildValue(proto, "emergency-established");
927  emergency_bypassed = SCConfNodeLookupChildValue(proto, "emergency-bypassed");
928 
929  if (new != NULL &&
930  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
931 
933  }
934  if (established != NULL &&
935  StringParseUint32(&configval, 10, strlen(established),
936  established) > 0) {
937 
939  }
940  if (bypassed != NULL &&
941  StringParseUint32(&configval, 10,
942  strlen(bypassed),
943  bypassed) > 0) {
944 
946  }
947  if (emergency_new != NULL &&
948  StringParseUint32(&configval, 10, strlen(emergency_new),
949  emergency_new) > 0) {
950 
952  }
953  if (emergency_established != NULL &&
954  StringParseUint32(&configval, 10,
955  strlen(emergency_established),
956  emergency_established) > 0) {
957 
959  }
960  if (emergency_bypassed != NULL &&
961  StringParseUint32(&configval, 10,
962  strlen(emergency_bypassed),
963  emergency_bypassed) > 0) {
964 
966  }
967  }
968 
969  /* ICMP. */
970  proto = SCConfNodeLookupChild(flow_timeouts, "icmp");
971  if (proto != NULL) {
972  new = SCConfNodeLookupChildValue(proto, "new");
973  established = SCConfNodeLookupChildValue(proto, "established");
974  bypassed = SCConfNodeLookupChildValue(proto, "bypassed");
975  emergency_new = SCConfNodeLookupChildValue(proto, "emergency-new");
976  emergency_established = SCConfNodeLookupChildValue(proto, "emergency-established");
977  emergency_bypassed = SCConfNodeLookupChildValue(proto, "emergency-bypassed");
978 
979  if (new != NULL &&
980  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
981 
983  }
984  if (established != NULL &&
985  StringParseUint32(&configval, 10, strlen(established),
986  established) > 0) {
987 
989  }
990  if (bypassed != NULL &&
991  StringParseUint32(&configval, 10,
992  strlen(bypassed),
993  bypassed) > 0) {
994 
996  }
997  if (emergency_new != NULL &&
998  StringParseUint32(&configval, 10, strlen(emergency_new),
999  emergency_new) > 0) {
1000 
1002  }
1003  if (emergency_established != NULL &&
1004  StringParseUint32(&configval, 10,
1005  strlen(emergency_established),
1006  emergency_established) > 0) {
1007 
1009  }
1010  if (emergency_bypassed != NULL &&
1011  StringParseUint32(&configval, 10,
1012  strlen(emergency_bypassed),
1013  emergency_bypassed) > 0) {
1014 
1016  }
1017  }
1018  }
1019 
1020  /* validate and if needed update emergency timeout values */
1021  for (uint8_t i = 0; i < FLOW_PROTO_MAX; i++) {
1022  const FlowProtoTimeout *n = &flow_timeouts_normal[i];
1024 
1025  if (e->est_timeout > n->est_timeout) {
1026  SCLogWarning("emergency timeout value %u for \'established\' "
1027  "must be below regular value %u",
1028  e->est_timeout, n->est_timeout);
1029  e->est_timeout = n->est_timeout / 10;
1030  }
1031 
1032  if (e->new_timeout > n->new_timeout) {
1033  SCLogWarning("emergency timeout value %u for \'new\' must be "
1034  "below regular value %u",
1035  e->new_timeout, n->new_timeout);
1036  e->new_timeout = n->new_timeout / 10;
1037  }
1038 
1039  if (e->closed_timeout > n->closed_timeout) {
1040  SCLogWarning("emergency timeout value %u for \'closed\' must "
1041  "be below regular value %u",
1043  e->closed_timeout = n->closed_timeout / 10;
1044  }
1045 
1046  if (e->bypassed_timeout > n->bypassed_timeout) {
1047  SCLogWarning("emergency timeout value %u for \'bypassed\' "
1048  "must be below regular value %u",
1050  e->bypassed_timeout = n->bypassed_timeout / 10;
1051  }
1052  }
1053 
1054  for (uint8_t i = 0; i < FLOW_PROTO_MAX; i++) {
1058 
1059  if (e->est_timeout > n->est_timeout) {
1060  SCLogWarning("emergency timeout value for \'established\' must be below normal value");
1061  e->est_timeout = n->est_timeout / 10;
1062  }
1063  d->est_timeout = n->est_timeout - e->est_timeout;
1064 
1065  if (e->new_timeout > n->new_timeout) {
1066  SCLogWarning("emergency timeout value for \'new\' must be below normal value");
1067  e->new_timeout = n->new_timeout / 10;
1068  }
1069  d->new_timeout = n->new_timeout - e->new_timeout;
1070 
1071  if (e->closed_timeout > n->closed_timeout) {
1072  SCLogWarning("emergency timeout value for \'closed\' must be below normal value");
1073  e->closed_timeout = n->closed_timeout / 10;
1074  }
1076 
1077  if (e->bypassed_timeout > n->bypassed_timeout) {
1078  SCLogWarning("emergency timeout value for \'bypassed\' must be below normal value");
1079  e->bypassed_timeout = n->bypassed_timeout / 10;
1080  }
1082 
1083  SCLogDebug("deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1085  }
1086 }
1087 
1088 /**
1089  * \brief Function clear the flow memory before queueing it to spare flow
1090  * queue.
1091  *
1092  * \param f pointer to the flow needed to be cleared.
1093  * \param proto_map mapped value of the protocol to FLOW_PROTO's.
1094  */
1095 
1096 int FlowClearMemory(Flow* f, uint8_t proto_map)
1097 {
1098  SCEnter();
1099 
1100  if (unlikely(f->flags & FLOW_HAS_EXPECTATION)) {
1102  }
1103 
1104  /* call the protocol specific free function if we have one */
1105  if (flow_freefuncs[proto_map].Freefunc != NULL) {
1106  flow_freefuncs[proto_map].Freefunc(f->protoctx);
1107  }
1108 
1109  FlowFreeStorage(f);
1110 
1111  FLOW_RECYCLE(f);
1112 
1113  SCReturnInt(1);
1114 }
1115 
1116 /**
1117  * \brief Function to set the function to get protocol specific flow state.
1118  *
1119  * \param proto protocol of which function is needed to be set.
1120  * \param Free Function pointer which will be called to free the protocol
1121  * specific memory.
1122  */
1123 
1124 int FlowSetProtoFreeFunc (uint8_t proto, void (*Free)(void *))
1125 {
1126  uint8_t proto_map;
1127  proto_map = FlowGetProtoMapping(proto);
1128 
1129  flow_freefuncs[proto_map].Freefunc = Free;
1130  return 1;
1131 }
1132 
1133 /**
1134  * \brief get 'disruption' flags: GAP/DEPTH/PASS
1135  * \param f locked flow
1136  * \param flags existing flags to be amended
1137  * \retval flags original flags + disrupt flags (if any)
1138  * \TODO handle UDP
1139  */
1140 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
1141 {
1142  if (f->proto != IPPROTO_TCP) {
1143  return flags;
1144  }
1145  if (f->protoctx == NULL) {
1146  return flags;
1147  }
1148 
1149  uint8_t newflags = flags;
1150  TcpSession *ssn = f->protoctx;
1151  TcpStream *stream = flags & STREAM_TOSERVER ? &ssn->client : &ssn->server;
1152 
1154  newflags |= STREAM_DEPTH;
1155  }
1156  /* todo: handle pass case (also for UDP!) */
1157 
1158  return newflags;
1159 }
1160 
1161 void FlowUpdateState(Flow *f, const enum FlowState s)
1162 {
1163  if (s != f->flow_state) {
1164  /* set the state */
1165  // Explicit cast from the enum type to the compact version
1166  f->flow_state = (FlowStateType)s;
1167 
1168  /* update timeout policy and value */
1169  const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1170  if (timeout_policy != f->timeout_policy) {
1171  f->timeout_policy = timeout_policy;
1172  }
1173  }
1174 #ifdef UNITTESTS
1175  if (f->fb != NULL) {
1176 #endif
1177  /* and reset the flow bucket next_ts value so that the flow manager
1178  * has to revisit this row */
1179  SC_ATOMIC_SET(f->fb->next_ts, 0);
1180 #ifdef UNITTESTS
1181  }
1182 #endif
1183 }
1184 
1185 /**
1186  * \brief Get flow last time as individual values.
1187  *
1188  * Instead of returning a pointer to the timeval copy the timeval
1189  * parts into output pointers to make it simpler to call from Rust
1190  * over FFI using only basic data types.
1191  */
1192 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
1193 {
1194  *secs = (uint64_t)SCTIME_SECS(flow->lastts);
1195  *usecs = (uint64_t)SCTIME_USECS(flow->lastts);
1196 }
1197 
1198 /**
1199  * \brief Get flow source port.
1200  *
1201  * A function to get the flow sport useful when the caller only has an
1202  * opaque pointer to the flow structure.
1203  */
1204 uint16_t FlowGetSourcePort(Flow *flow)
1205 {
1206  return flow->sp;
1207 }
1208 
1209 /**
1210  * \brief Get flow destination port.
1211  *
1212  * A function to get the flow dport useful when the caller only has an
1213  * opaque pointer to the flow structure.
1214  */
1215 
1217 {
1218  return flow->dp;
1219 }
1220 /**
1221  * \brief Get flow flags.
1222  *
1223  * A function to get the flow flags useful when the caller only has an
1224  * opaque pointer to the flow structure.
1225  */
1226 
1227 uint32_t FlowGetFlags(Flow *flow)
1228 {
1229  return flow->flags;
1230 }
1231 /************************************Unittests*******************************/
1232 
1233 #ifdef UNITTESTS
1234 #include "threads.h"
1235 
1236 /**
1237  * \test Test the setting of the per protocol timeouts.
1238  *
1239  * \retval On success it returns 1 and on failure 0.
1240  */
1241 
1242 static int FlowTest01 (void)
1243 {
1244  uint8_t proto_map;
1245 
1247  proto_map = FlowGetProtoMapping(IPPROTO_TCP);
1248  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_TCP_NEW_TIMEOUT);
1249  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_TCP_EST_TIMEOUT);
1252 
1253  proto_map = FlowGetProtoMapping(IPPROTO_UDP);
1254  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_UDP_NEW_TIMEOUT);
1255  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_UDP_EST_TIMEOUT);
1258 
1259  proto_map = FlowGetProtoMapping(IPPROTO_ICMP);
1260  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_ICMP_NEW_TIMEOUT);
1261  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_ICMP_EST_TIMEOUT);
1264 
1265  proto_map = FlowGetProtoMapping(IPPROTO_DCCP);
1266  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_DEFAULT_NEW_TIMEOUT);
1267  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_DEFAULT_EST_TIMEOUT);
1268  FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_DEFAULT_EMERG_NEW_TIMEOUT);
1269  FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_DEFAULT_EMERG_EST_TIMEOUT);
1270 
1271  PASS;
1272 }
1273 
1274 /*Test function for the unit test FlowTest02*/
1275 
1276 static void test(void *f) {}
1277 
1278 /**
1279  * \test Test the setting of the per protocol free function to free the
1280  * protocol specific memory.
1281  *
1282  * \retval On success it returns 1 and on failure 0.
1283  */
1284 
1285 static int FlowTest02 (void)
1286 {
1288  FlowSetProtoFreeFunc(IPPROTO_TCP, test);
1289  FlowSetProtoFreeFunc(IPPROTO_UDP, test);
1290  FlowSetProtoFreeFunc(IPPROTO_ICMP, test);
1291 
1292  FAIL_IF(flow_freefuncs[FLOW_PROTO_DEFAULT].Freefunc != test);
1293  FAIL_IF(flow_freefuncs[FLOW_PROTO_TCP].Freefunc != test);
1294  FAIL_IF(flow_freefuncs[FLOW_PROTO_UDP].Freefunc != test);
1295  FAIL_IF(flow_freefuncs[FLOW_PROTO_ICMP].Freefunc != test);
1296 
1297  PASS;
1298 }
1299 
1300 /**
1301  * \test Test flow allocations when it reach memcap
1302  *
1303  *
1304  * \retval On success it returns 1 and on failure 0.
1305  */
1306 
1307 static int FlowTest07 (void)
1308 {
1309  int result = 0;
1311  FlowConfig backup;
1312  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1313 
1314  uint32_t ini = 0;
1315  uint32_t end = FlowSpareGetPoolSize();
1316  SC_ATOMIC_SET(flow_config.memcap, 10000);
1317  flow_config.prealloc = 100;
1318 
1319  /* Let's get the flow spare pool empty */
1320  UTHBuildPacketOfFlows(ini, end, 0);
1321 
1322  /* And now let's try to reach the memcap val */
1323  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1324  ini = end + 1;
1325  end = end + 2;
1326  UTHBuildPacketOfFlows(ini, end, 0);
1327  }
1328 
1329  /* should time out normal */
1330  TimeSetIncrementTime(2000);
1331  ini = end + 1;
1332  end = end + 2;
1333  UTHBuildPacketOfFlows(ini, end, 0);
1334 
1335  /* This means that the engine entered emerg mode: should happen as easy
1336  * with flow mgr activated */
1337  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1338  result = 1;
1339 
1340  FlowShutdown();
1341  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1342 
1343  return result;
1344 }
1345 
1346 /**
1347  * \test Test flow allocations when it reach memcap
1348  *
1349  *
1350  * \retval On success it returns 1 and on failure 0.
1351  */
1352 
1353 static int FlowTest08 (void)
1354 {
1355  int result = 0;
1356 
1358  FlowConfig backup;
1359  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1360 
1361  uint32_t ini = 0;
1362  uint32_t end = FlowSpareGetPoolSize();
1363  SC_ATOMIC_SET(flow_config.memcap, 10000);
1364  flow_config.prealloc = 100;
1365 
1366  /* Let's get the flow spare pool empty */
1367  UTHBuildPacketOfFlows(ini, end, 0);
1368 
1369  /* And now let's try to reach the memcap val */
1370  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1371  ini = end + 1;
1372  end = end + 2;
1373  UTHBuildPacketOfFlows(ini, end, 0);
1374  }
1375 
1376  /* By default we use 30 for timing out new flows. This means
1377  * that the Emergency mode should be set */
1379  ini = end + 1;
1380  end = end + 2;
1381  UTHBuildPacketOfFlows(ini, end, 0);
1382 
1383  /* This means that the engine released 5 flows by emergency timeout */
1384  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1385  result = 1;
1386 
1387  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1388  FlowShutdown();
1389 
1390  return result;
1391 }
1392 
1393 /**
1394  * \test Test flow allocations when it reach memcap
1395  *
1396  *
1397  * \retval On success it returns 1 and on failure 0.
1398  */
1399 
1400 static int FlowTest09 (void)
1401 {
1402  int result = 0;
1403 
1405  FlowConfig backup;
1406  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1407 
1408  uint32_t ini = 0;
1409  uint32_t end = FlowSpareGetPoolSize();
1410  SC_ATOMIC_SET(flow_config.memcap, 10000);
1411  flow_config.prealloc = 100;
1412 
1413  /* Let's get the flow spare pool empty */
1414  UTHBuildPacketOfFlows(ini, end, 0);
1415 
1416  /* And now let's try to reach the memcap val */
1417  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1418  ini = end + 1;
1419  end = end + 2;
1420  UTHBuildPacketOfFlows(ini, end, 0);
1421  }
1422 
1423  /* No timeout will work */
1425  ini = end + 1;
1426  end = end + 2;
1427  UTHBuildPacketOfFlows(ini, end, 0);
1428 
1429  /* engine in emerg mode */
1430  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1431  result = 1;
1432 
1433  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1434  FlowShutdown();
1435 
1436  return result;
1437 }
1438 
1439 #endif /* UNITTESTS */
1440 
1441 /**
1442  * \brief Function to register the Flow Unitests.
1443  */
1445 {
1446 #ifdef UNITTESTS
1447  UtRegisterTest("FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1448  UtRegisterTest("FlowTest02 -- Setting Protocol Specific Free Function",
1449  FlowTest02);
1450  UtRegisterTest("FlowTest07 -- Test flow Allocations when it reach memcap",
1451  FlowTest07);
1452  UtRegisterTest("FlowTest08 -- Test flow Allocations when it reach memcap",
1453  FlowTest08);
1454  UtRegisterTest("FlowTest09 -- Test flow Allocations when it reach memcap",
1455  FlowTest09);
1456 
1458 #endif /* UNITTESTS */
1459 }
FLOWFILE_NO_MD5_TS
#define FLOWFILE_NO_MD5_TS
Definition: flow.h:137
util-byte.h
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:185
FLOWFILE_NO_MD5_TC
#define FLOWFILE_NO_MD5_TC
Definition: flow.h:138
FBLOCK_DESTROY
#define FBLOCK_DESTROY(fb)
Definition: flow-hash.h:72
FLOW_DEFAULT_NEW_TIMEOUT
#define FLOW_DEFAULT_NEW_TIMEOUT
Definition: flow-private.h:40
Packet_::proto
uint8_t proto
Definition: decode.h:514
FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
Definition: flow-private.h:56
TcpStream_
Definition: stream-tcp-private.h:106
FLOWFILE_NO_SIZE_TS
#define FLOWFILE_NO_SIZE_TS
Definition: flow.h:149
flow-bypass.h
FLOW_HAS_EXPECTATION
#define FLOW_HAS_EXPECTATION
Definition: flow.h:114
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
Definition: flow.c:152
FLOWFILE_NO_SIZE_TC
#define FLOWFILE_NO_SIZE_TC
Definition: flow.h:150
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:138
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:69
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
Definition: flow.c:176
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:166
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1253
IPV6_GET_RAW_HLIM
#define IPV6_GET_RAW_HLIM(ip6h)
Definition: decode-ipv6.h:67
FlowSpareGetPoolSize
uint32_t FlowSpareGetPoolSize(void)
Definition: flow-spare-pool.c:46
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:278
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:505
flow-util.h
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:314
FBLOCK_INIT
#define FBLOCK_INIT(fb)
Definition: flow-hash.h:71
CLS
#define CLS
Definition: suricata-common.h:69
FLOW_DEFAULT_HASHSIZE
#define FLOW_DEFAULT_HASHSIZE
Definition: flow.c:66
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:300
FLOW_DEFAULT_PREALLOC
#define FLOW_DEFAULT_PREALLOC
Definition: flow.c:70
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:386
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:294
BIT_U16
#define BIT_U16(n)
Definition: suricata-common.h:416
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1444
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:270
FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:60
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:75
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:617
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:190
Flow_::proto
uint8_t proto
Definition: flow.h:378
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
action-globals.h
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:130
Packet_::flags
uint32_t flags
Definition: decode.h:535
threads.h
util-macset.h
FlowGetFlags
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
Definition: flow.c:1227
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:356
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:68
Flow
struct Flow_ Flow
Definition: detect-engine-helper.h:31
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:332
Packet_::icmp_s
struct Packet_::@23::@30 icmp_s
FlowProtoTimeout_
Definition: flow.h:518
SCConfGet
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:350
flow-hash.h
FlowGetSourcePort
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
Definition: flow.c:1204
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:67
FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
Definition: flow.h:86
FlowReset
void FlowReset(void)
Definition: flow.c:672
FlowLookupStruct_
Definition: flow.h:542
FlowRateGetStorageID
FlowStorageId FlowRateGetStorageID(void)
Definition: util-flow-rate.c:134
FLOW_DEFAULT_EMERG_NEW_TIMEOUT
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
Definition: flow-private.h:54
FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:57
BypassedFlowUpdate
void BypassedFlowUpdate(Flow *f, Packet *p)
Definition: flow-bypass.c:207
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:522
FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_DEFAULT_EST_TIMEOUT
Definition: flow-private.h:41
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:233
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:155
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:127
MIN
#define MIN(x, y)
Definition: suricata-common.h:408
IPPROTO_DCCP
#define IPPROTO_DCCP
Definition: decode.h:1209
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:121
FlowQueueDestroy
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
Definition: flow-queue.c:60
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:532
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:70
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
SCFlowRunUpdateCallbacks
void SCFlowRunUpdateCallbacks(ThreadVars *tv, Flow *f, Packet *p)
Definition: flow-callbacks.c:93
RandomGet
long int RandomGet(void)
Definition: util-random.c:130
FLOW_TOSERVER_DROP_LOGGED
#define FLOW_TOSERVER_DROP_LOGGED
Definition: flow.h:78
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:468
proto
uint8_t proto
Definition: decode-template.h:0
Flow_::dp
Port dp
Definition: flow.h:372
SCConfNodeLookupChildValue
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:824
FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
Definition: flow.h:96
FLOW_DEFAULT_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
Definition: flow-private.h:42
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:523
MAX
#define MAX(x, y)
Definition: suricata-common.h:412
Flow_::protoctx
void * protoctx
Definition: flow.h:441
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:963
ExceptionPolicyParse
enum ExceptionPolicy ExceptionPolicyParse(const char *option, bool support_flow)
Definition: util-exception-policy.c:300
FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
Definition: flow-private.h:49
STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
Definition: stream-tcp-private.h:223
util-unittest.h
FLOW_BYPASSED_TIMEOUT
#define FLOW_BYPASSED_TIMEOUT
Definition: flow-private.h:65
util-unittest-helper.h
FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
Definition: flow-private.h:59
FLOW_IPPROTO_ICMP_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
Definition: flow-private.h:51
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:295
UTHBuildPacketOfFlows
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
Definition: util-unittest-helper.c:859
AppLayerExpectationClean
void AppLayerExpectationClean(Flow *f)
Definition: app-layer-expectation.c:361
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:412
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1286
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:74
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:486
FlowGetDestinationPort
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
Definition: flow.c:1216
FLOW_CHECK_MEMCAP
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
Definition: flow-util.h:134
FLOW_RECYCLE
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
Definition: flow-util.h:80
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:498
flow-spare-pool.h
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:478
FlowRateStoreUpdate
void FlowRateStoreUpdate(FlowRateStore *frs, SCTime_t p_ts, uint32_t pkt_len, int direction)
Definition: util-flow-rate.c:193
FLOWFILE_NO_SHA1_TC
#define FLOWFILE_NO_SHA1_TC
Definition: flow.h:142
FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
Definition: flow-private.h:63
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:546
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:491
app-layer-expectation.h
FLOW_IPPROTO_UDP_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
Definition: flow-private.h:48
util-flow-rate.h
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:507
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:467
decode.h
util-debug.h
TOSERVER
#define TOSERVER
Definition: flow.h:45
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
Packet_::ts
SCTime_t ts
Definition: decode.h:546
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:495
FLOWFILE_NO_STORE_TS
#define FLOWFILE_NO_STORE_TS
Definition: flow.h:134
FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
Definition: flow-private.h:45
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:401
Flow_::lastts
SCTime_t lastts
Definition: flow.h:410
SCConfGetInt
int SCConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:414
SCEnter
#define SCEnter(...)
Definition: util-debug.h:272
MacSetAddWithCtr
void MacSetAddWithCtr(MacSet *ms, const uint8_t *src_addr, const uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
Definition: util-macset.c:182
FLOW_CHANGE_PROTO
#define FLOW_CHANGE_PROTO
Definition: flow.h:108
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:71
FlowStorageSize
unsigned int FlowStorageSize(void)
Definition: flow-storage.c:35
Packet_::sp
Port sp
Definition: decode.h:499
FlowCnf_
Definition: flow.h:292
FLOWFILE_NO_SHA256_TS
#define FLOWFILE_NO_SHA256_TS
Definition: flow.h:145
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:237
FlowQueueInit
FlowQueue * FlowQueueInit(FlowQueue *q)
Definition: flow-queue.c:46
FlowState
FlowState
Definition: flow.h:503
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:285
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:519
StringParseUint32
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:313
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:521
util-time.h
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:250
app-layer-parser.h
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1663
FLOW_PROTO_DETECT_TC_DONE
#define FLOW_PROTO_DETECT_TC_DONE
Definition: flow.h:105
Packet_::pkt_hooks
uint16_t pkt_hooks
Definition: decode.h:532
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:497
ThreadVars_::id
int id
Definition: threadvars.h:87
FLOW_TC_PP_ALPROTO_DETECT_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
Definition: flow.h:94
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:483
MacSetFlowStorageEnabled
bool MacSetFlowStorageEnabled(void)
Definition: util-macset.c:86
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:341
FlowThreadId
uint16_t FlowThreadId
Definition: flow.h:333
TimeSetIncrementTime
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
Definition: util-time.c:180
IPV6Hdr_
Definition: decode-ipv6.h:32
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:99
Packet_
Definition: decode.h:492
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
IPV4_GET_RAW_IPTTL
#define IPV4_GET_RAW_IPTTL(ip4h)
Definition: decode-ipv4.h:102
FLOW_DEFAULT_MEMCAP
#define FLOW_DEFAULT_MEMCAP
Definition: flow.c:68
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:208
stream-tcp-private.h
MacSet_
Definition: util-macset.c:45
conf.h
FLOW_IPPROTO_TCP_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
Definition: flow-private.h:43
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:526
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1096
flow_timeouts_delta
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Definition: flow.c:89
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:293
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:469
FLOW_IS_ELEPHANT
#define FLOW_IS_ELEPHANT
Definition: flow.h:59
MacSetGetFlowStorageID
FlowStorageId MacSetGetFlowStorageID(void)
Definition: util-macset.c:115
flow-queue.h
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:419
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:234
FLOW_TO_DST_SEEN
#define FLOW_TO_DST_SEEN
Definition: flow.h:53
FlowGetStorageById
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
Definition: flow-storage.c:40
FlowUpdateState
void FlowUpdateState(Flow *f, const enum FlowState s)
Definition: flow.c:1161
Flow_::src
FlowAddress src
Definition: flow.h:359
Flow_::next
struct Flow_ * next
Definition: flow.h:396
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:418
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
FLOWFILE_NO_SHA256_TC
#define FLOWFILE_NO_SHA256_TC
Definition: flow.h:146
IPV4Hdr_
Definition: decode-ipv4.h:72
SCConfNodeLookupChild
SCConfNode * SCConfNodeLookupChild(const SCConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:796
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:59
FlowDequeue
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
Definition: flow-queue.c:191
FLOW_TO_SRC_SEEN
#define FLOW_TO_SRC_SEEN
Definition: flow.h:51
flow-storage.h
FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
Definition: flow.h:90
Packet_::flow
struct Flow_ * flow
Definition: decode.h:537
FLOW_IPPROTO_UDP_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
Definition: flow-private.h:47
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1124
FLOW_PROTO_ICMP
@ FLOW_PROTO_ICMP
Definition: flow-private.h:70
FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
Definition: flow-private.h:50
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:87
CMP_ADDR
#define CMP_ADDR(a1, a2)
Definition: decode.h:222
FlowStateType
unsigned short FlowStateType
Definition: flow.h:330
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:131
flags
uint8_t flags
Definition: decode-gre.h:0
FlowGetMemcapExceptionPolicy
enum ExceptionPolicy FlowGetMemcapExceptionPolicy(void)
Definition: flow.c:133
flow-manager.h
suricata-common.h
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:84
flow_config
FlowConfig flow_config
Definition: flow.c:92
FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
Definition: flow-private.h:46
FLOW_HAS_ALERTS
#define FLOW_HAS_ALERTS
Definition: flow.h:83
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:690
FlowSparePoolDestroy
void FlowSparePoolDestroy(void)
Definition: flow-spare-pool.c:310
packet.h
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
SWAP_VARS
#define SWAP_VARS(type, a, b)
Definition: suricata-common.h:445
FlowTimeoutsInit
void FlowTimeoutsInit(void)
Definition: flow-manager.c:98
SCTIME_SECS
#define SCTIME_SECS(t)
Definition: util-time.h:57
FLOW_PROTO_DETECT_TS_DONE
#define FLOW_PROTO_DETECT_TS_DONE
Definition: flow.h:104
FlowRateIsExceeding
bool FlowRateIsExceeding(FlowRateStore *frs, int direction)
Definition: util-flow-rate.c:228
FatalError
#define FatalError(...)
Definition: util-debug.h:503
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:470
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:297
FLOW_TS_PP_ALPROTO_DETECT_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
Definition: flow.h:88
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1287
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1192
FLOWFILE_NO_STORE_TC
#define FLOWFILE_NO_STORE_TC
Definition: flow.h:135
FlowGetFlowFromHash
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
Definition: flow-hash.c:903
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:405
FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
Definition: flow-private.h:58
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
threadvars.h
FlowSwap
void FlowSwap(Flow *f)
swap the flow's direction
Definition: flow.c:245
FlowCnf_::memcap_policy
enum ExceptionPolicy memcap_policy
Definition: flow.h:302
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FlowInitFlowProto
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
Definition: flow.c:734
SCTIME_CMP_GT
#define SCTIME_CMP_GT(a, b)
Definition: util-time.h:104
FLOWFILE_NO_SHA1_TS
#define FLOWFILE_NO_SHA1_TS
Definition: flow.h:141
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:296
SCConfGetNode
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
Definition: conf.c:181
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:262
flow_recycle_q
FlowQueue flow_recycle_q
Definition: flow-manager.c:65
flow-callbacks.h
SWAP_FLAGS
#define SWAP_FLAGS(flags, a, b)
Definition: suricata-common.h:434
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:73
CMP_PORT
#define CMP_PORT(p1, p2)
Definition: decode.h:227
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:954
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:451
Flow_::alstate
void * alstate
Definition: flow.h:479
flow_freefuncs
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
Definition: flow.c:90
flow_timeouts_emerg
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow.c:88
DecodeThreadVars_::counter_flow_elephant
uint16_t counter_flow_elephant
Definition: decode.h:1029
Flow_::flags
uint32_t flags
Definition: flow.h:421
FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
Definition: flow-private.h:61
FlowFreeStorage
void FlowFreeStorage(Flow *f)
Definition: flow-storage.c:60
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:964
FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:62
FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_TOCLIENT_DROP_LOGGED
Definition: flow.h:80
util-random.h
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:235
FlowRateStorageEnabled
bool FlowRateStorageEnabled(void)
Definition: util-flow-rate.c:97
PacketDrop
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
Definition: packet.c:33
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:234
SIGNATURE_HOOK_PKT_FLOW_START
@ SIGNATURE_HOOK_PKT_FLOW_START
Definition: detect.h:541
FLOW_EMERGENCY
#define FLOW_EMERGENCY
Definition: flow-private.h:37
suricata.h
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:43
FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
Definition: flow.h:92
FLOW_DEFAULT_EMERGENCY_RECOVERY
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
Definition: flow.c:63
FlowHasAlerts
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:163
FlowSparePoolInit
void FlowSparePoolInit(void)
Definition: flow-spare-pool.c:291
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:1217
FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
Definition: flow-private.h:55
FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
Definition: flow-private.h:52
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:520
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:195
Flow_::sp
Port sp
Definition: flow.h:361
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1140
TcpSession_
Definition: stream-tcp-private.h:283
util-misc.h
TcpSession_::data_first_seen_dir
int8_t data_first_seen_dir
Definition: stream-tcp-private.h:288
flow.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:452
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:423
Packet_::dp
Port dp
Definition: decode.h:507
ExceptionPolicy
ExceptionPolicy
Definition: util-exception-policy-types.h:25
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:112
ICMPV4_IS_ERROR_MSG
#define ICMPV4_IS_ERROR_MSG(type)
Definition: decode-icmpv4.h:267
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:276
SCConfNode_
Definition: conf.h:37
FLOW_IPPROTO_TCP_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
Definition: flow-private.h:44
RegisterFlowStorageTests
void RegisterFlowStorageTests(void)
Definition: flow-storage.c:295
SET_DEFAULTS
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
TOCLIENT
#define TOCLIENT
Definition: flow.h:46
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:236
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
PKT_DROP_REASON_FLOW_DROP
@ PKT_DROP_REASON_FLOW_DROP
Definition: decode.h:379
Packet_::src
Address src
Definition: decode.h:496
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:496
FlowRateStore_
Definition: util-flow-rate.h:47
Flow_::thread_id
FlowThreadId thread_id[2]
Definition: flow.h:394
SCTIME_USECS
#define SCTIME_USECS(t)
Definition: util-time.h:56
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:106
FlowProtoFreeFunc_
Definition: flow.h:525