suricata
flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow implementation.
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 
29 #include "action-globals.h"
30 #include "packet.h"
31 #include "decode.h"
32 #include "conf.h"
33 #include "threadvars.h"
34 
35 #include "util-random.h"
36 #include "util-time.h"
37 
38 #include "flow.h"
39 #include "flow-queue.h"
40 #include "flow-hash.h"
41 #include "flow-util.h"
42 #include "flow-private.h"
43 #include "flow-manager.h"
44 #include "flow-storage.h"
45 #include "flow-bypass.h"
46 #include "flow-spare-pool.h"
47 
48 #include "stream-tcp-private.h"
49 
50 #include "util-unittest.h"
51 #include "util-unittest-helper.h"
52 #include "util-byte.h"
53 #include "util-misc.h"
54 #include "util-macset.h"
55 
56 #include "util-debug.h"
57 
58 #include "app-layer-parser.h"
59 #include "app-layer-expectation.h"
60 
61 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
62 
63 //#define FLOW_DEFAULT_HASHSIZE 262144
64 #define FLOW_DEFAULT_HASHSIZE 65536
65 //#define FLOW_DEFAULT_MEMCAP 128 * 1024 * 1024 /* 128 MB */
66 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32 MB */
67 
68 #define FLOW_DEFAULT_PREALLOC 10000
69 
71 
72 /** atomic int that is used when freeing a flow from the hash. In this
73  * case we walk the hash to find a flow to free. This var records where
74  * we left off in the hash. Without this only the top rows of the hash
75  * are freed. This isn't just about fairness. Under severe pressure, the
76  * hash rows on top would be all freed and the time to find a flow to
77  * free increased with every run. */
78 SC_ATOMIC_DECLARE(unsigned int, flow_prune_idx);
79 
80 /** atomic flags */
81 SC_ATOMIC_DECLARE(unsigned int, flow_flags);
82 
83 /** FlowProto specific timeouts and free/state functions */
84 
89 
91 
92 /** flow memuse counter (atomic), for enforcing memcap limit */
93 SC_ATOMIC_DECLARE(uint64_t, flow_memuse);
94 
95 void FlowRegisterTests(void);
96 void FlowInitFlowProto(void);
97 int FlowSetProtoFreeFunc(uint8_t, void (*Free)(void *));
98 
99 /**
100  * \brief Update memcap value
101  *
102  * \param size new memcap value
103  */
104 int FlowSetMemcap(uint64_t size)
105 {
106  if ((uint64_t)SC_ATOMIC_GET(flow_memuse) < size) {
107  SC_ATOMIC_SET(flow_config.memcap, size);
108  return 1;
109  }
110 
111  return 0;
112 }
113 
114 /**
115  * \brief Return memcap value
116  *
117  * \retval memcap value
118  */
119 uint64_t FlowGetMemcap(void)
120 {
121  uint64_t memcapcopy = SC_ATOMIC_GET(flow_config.memcap);
122  return memcapcopy;
123 }
124 
125 uint64_t FlowGetMemuse(void)
126 {
127  uint64_t memusecopy = SC_ATOMIC_GET(flow_memuse);
128  return memusecopy;
129 }
130 
132 {
133  return flow_config.memcap_policy;
134 }
135 
137 {
138  if (f == NULL || f->proto == 0)
139  return;
140 
142  f->alstate = NULL;
143  f->alparser = NULL;
144 }
145 
146 /** \brief Set the IPOnly scanned flag for 'direction'.
147  *
148  * \param f Flow to set the flag in
149  * \param direction direction to set the flag in
150  */
151 void FlowSetIPOnlyFlag(Flow *f, int direction)
152 {
153  direction ? (f->flags |= FLOW_TOSERVER_IPONLY_SET) : (f->flags |= FLOW_TOCLIENT_IPONLY_SET);
154 }
155 
156 /** \brief Set flag to indicate that flow has alerts
157  *
158  * \param f flow
159  */
161 {
162  f->flags |= FLOW_HAS_ALERTS;
163 }
164 
165 /** \brief Check if flow has alerts
166  *
167  * \param f flow
168  * \retval 1 has alerts
169  * \retval 0 has not alerts
170  */
171 int FlowHasAlerts(const Flow *f)
172 {
173  if (f->flags & FLOW_HAS_ALERTS) {
174  return 1;
175  }
176 
177  return 0;
178 }
179 
180 /** \brief Set flag to indicate to change proto for the flow
181  *
182  * \param f flow
183  */
185 {
186  f->flags |= FLOW_CHANGE_PROTO;
187 }
188 
189 /** \brief Unset flag to indicate to change proto for the flow
190  *
191  * \param f flow
192  */
194 {
195  f->flags &= ~FLOW_CHANGE_PROTO;
196 }
197 
198 /** \brief Check if change proto flag is set for flow
199  * \param f flow
200  * \retval 1 change proto flag is set
201  * \retval 0 change proto flag is not set
202  */
204 {
205  if (f->flags & FLOW_CHANGE_PROTO) {
206  return 1;
207  }
208 
209  return 0;
210 }
211 
212 static inline void FlowSwapFlags(Flow *f)
213 {
217 
222 
224 }
225 
226 static inline void FlowSwapFileFlags(Flow *f)
227 {
234 }
235 
236 static inline void TcpStreamFlowSwap(Flow *f)
237 {
238  TcpSession *ssn = f->protoctx;
239  SWAP_VARS(TcpStream, ssn->server, ssn->client);
240  if (ssn->data_first_seen_dir & STREAM_TOSERVER) {
241  ssn->data_first_seen_dir = STREAM_TOCLIENT;
242  } else if (ssn->data_first_seen_dir & STREAM_TOCLIENT) {
243  ssn->data_first_seen_dir = STREAM_TOSERVER;
244  }
245 }
246 
247 /** \brief swap the flow's direction
248  * \note leaves the 'header' untouched. Interpret that based
249  * on FLOW_DIR_REVERSED flag.
250  * \warning: only valid before applayer parsing started. This
251  * function doesn't swap anything in Flow::alparser,
252  * Flow::alstate
253  */
254 void FlowSwap(Flow *f)
255 {
256  f->flags |= FLOW_DIR_REVERSED;
257 
260 
261  FlowSwapFlags(f);
262  FlowSwapFileFlags(f);
263 
264  SWAP_VARS(FlowThreadId, f->thread_id[0], f->thread_id[1]);
265 
266  if (f->proto == IPPROTO_TCP) {
267  TcpStreamFlowSwap(f);
268  }
269 
273 
274  /* not touching Flow::alparser and Flow::alstate */
275 
276  SWAP_VARS(const void *, f->sgh_toclient, f->sgh_toserver);
277 
278  SWAP_VARS(uint32_t, f->todstpktcnt, f->tosrcpktcnt);
279  SWAP_VARS(uint64_t, f->todstbytecnt, f->tosrcbytecnt);
280 }
281 
282 /**
283  * \brief determine the direction of the packet compared to the flow
284  * \retval 0 to_server
285  * \retval 1 to_client
286  */
287 int FlowGetPacketDirection(const Flow *f, const Packet *p)
288 {
289  const int reverse = (f->flags & FLOW_DIR_REVERSED) != 0;
290 
291  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
292  if (!(CMP_PORT(p->sp,p->dp))) {
293  /* update flags and counters */
294  if (CMP_PORT(f->sp,p->sp)) {
295  return TOSERVER ^ reverse;
296  } else {
297  return TOCLIENT ^ reverse;
298  }
299  } else {
300  if (CMP_ADDR(&f->src,&p->src)) {
301  return TOSERVER ^ reverse;
302  } else {
303  return TOCLIENT ^ reverse;
304  }
305  }
306  } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
307  if (CMP_ADDR(&f->src,&p->src)) {
308  return TOSERVER ^ reverse;
309  } else {
310  return TOCLIENT ^ reverse;
311  }
312  }
313 
314  /* default to toserver */
315  return TOSERVER;
316 }
317 
318 /**
319  * \brief Check to update "seen" flags
320  *
321  * \param p packet
322  *
323  * \retval 1 true
324  * \retval 0 false
325  */
326 static inline int FlowUpdateSeenFlag(const Packet *p)
327 {
328  if (PacketIsICMPv4(p)) {
329  if (ICMPV4_IS_ERROR_MSG(p->icmp_s.type)) {
330  return 0;
331  }
332  }
333 
334  return 1;
335 }
336 
337 static inline void FlowUpdateTtlTS(Flow *f, uint8_t ttl)
338 {
339  if (f->min_ttl_toserver == 0) {
340  f->min_ttl_toserver = ttl;
341  } else {
342  f->min_ttl_toserver = MIN(f->min_ttl_toserver, ttl);
343  }
344  f->max_ttl_toserver = MAX(f->max_ttl_toserver, ttl);
345 }
346 
347 static inline void FlowUpdateTtlTC(Flow *f, uint8_t ttl)
348 {
349  if (f->min_ttl_toclient == 0) {
350  f->min_ttl_toclient = ttl;
351  } else {
352  f->min_ttl_toclient = MIN(f->min_ttl_toclient, ttl);
353  }
354  f->max_ttl_toclient = MAX(f->max_ttl_toclient, ttl);
355 }
356 
357 static inline void FlowUpdateEthernet(
358  ThreadVars *tv, DecodeThreadVars *dtv, Flow *f, const Packet *p, bool toserver)
359 {
360  if (PacketIsEthernet(p) && MacSetFlowStorageEnabled()) {
361  const EthernetHdr *ethh = PacketGetEthernet(p);
363  if (ms != NULL) {
364  if (toserver) {
365  MacSetAddWithCtr(ms, ethh->eth_src, ethh->eth_dst, tv,
368  } else {
369  MacSetAddWithCtr(ms, ethh->eth_dst, ethh->eth_src, tv,
372  }
373  }
374  }
375 }
376 
377 /** \brief Update Packet and Flow
378  *
379  * Updates packet and flow based on the new packet.
380  *
381  * \param f locked flow
382  * \param p packet
383  *
384  * \note overwrites p::flowflags
385  */
387 {
388  SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f);
389 
390  const int pkt_dir = FlowGetPacketDirection(f, p);
391 #ifdef CAPTURE_OFFLOAD
392  int state = f->flow_state;
393 
394  if (state != FLOW_STATE_CAPTURE_BYPASSED) {
395 #endif
396  /* update the last seen timestamp of this flow */
397  if (SCTIME_CMP_GT(p->ts, f->lastts)) {
398  f->lastts = p->ts;
399  const uint32_t timeout_at = (uint32_t)SCTIME_SECS(f->lastts) + f->timeout_policy;
400  if (timeout_at != f->timeout_at) {
401  f->timeout_at = timeout_at;
402  }
403  }
404 #ifdef CAPTURE_OFFLOAD
405  } else {
406  /* still seeing packet, we downgrade to local bypass */
407  if (SCTIME_SECS(p->ts) - SCTIME_SECS(f->lastts) > FLOW_BYPASSED_TIMEOUT / 2) {
408  SCLogDebug("Downgrading flow to local bypass");
409  f->lastts = p->ts;
411  } else {
412  /* In IPS mode the packet could come from the other interface so it would
413  * need to be bypassed */
414  if (EngineModeIsIPS()) {
415  BypassedFlowUpdate(f, p);
416  }
417  }
418  }
419 #endif
420  /* update flags and counters */
421  if (pkt_dir == TOSERVER) {
422  f->todstpktcnt++;
423  f->todstbytecnt += GET_PKT_LEN(p);
425  if (!(f->flags & FLOW_TO_DST_SEEN)) {
426  if (FlowUpdateSeenFlag(p)) {
427  f->flags |= FLOW_TO_DST_SEEN;
429  }
430  }
431  /* xfer proto detect ts flag to first packet in ts dir */
432  if (f->flags & FLOW_PROTO_DETECT_TS_DONE) {
435  }
436  FlowUpdateEthernet(tv, dtv, f, p, true);
437  /* update flow's ttl fields if needed */
438  if (PacketIsIPv4(p)) {
439  const IPV4Hdr *ip4h = PacketGetIPv4(p);
440  FlowUpdateTtlTS(f, IPV4_GET_RAW_IPTTL(ip4h));
441  } else if (PacketIsIPv6(p)) {
442  const IPV6Hdr *ip6h = PacketGetIPv6(p);
443  FlowUpdateTtlTS(f, IPV6_GET_RAW_HLIM(ip6h));
444  }
445  } else {
446  f->tosrcpktcnt++;
447  f->tosrcbytecnt += GET_PKT_LEN(p);
449  if (!(f->flags & FLOW_TO_SRC_SEEN)) {
450  if (FlowUpdateSeenFlag(p)) {
451  f->flags |= FLOW_TO_SRC_SEEN;
453  }
454  }
455  /* xfer proto detect tc flag to first packet in tc dir */
456  if (f->flags & FLOW_PROTO_DETECT_TC_DONE) {
459  }
460  FlowUpdateEthernet(tv, dtv, f, p, false);
461  /* update flow's ttl fields if needed */
462  if (PacketIsIPv4(p)) {
463  const IPV4Hdr *ip4h = PacketGetIPv4(p);
464  FlowUpdateTtlTC(f, IPV4_GET_RAW_IPTTL(ip4h));
465  } else if (PacketIsIPv6(p)) {
466  const IPV6Hdr *ip6h = PacketGetIPv6(p);
467  FlowUpdateTtlTC(f, IPV6_GET_RAW_HLIM(ip6h));
468  }
469  }
470 
472  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
474 
475  } else if (f->proto == IPPROTO_TCP) {
476  TcpSession *ssn = (TcpSession *)f->protoctx;
477  if (ssn != NULL && ssn->state >= TCP_ESTABLISHED) {
479  }
480  } else if ((f->flags & (FLOW_TO_DST_SEEN|FLOW_TO_SRC_SEEN)) ==
482  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
484 
485  if (
486 #ifdef CAPTURE_OFFLOAD
487  (f->flow_state != FLOW_STATE_CAPTURE_BYPASSED) &&
488 #endif
491  }
492  }
493 
494  if (f->flags & FLOW_ACTION_DROP) {
496  }
497  /*set the detection bypass flags*/
498  if (f->flags & FLOW_NOPACKET_INSPECTION) {
499  SCLogDebug("setting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
500  DecodeSetNoPacketInspectionFlag(p);
501  }
502  if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
503  SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
504  DecodeSetNoPayloadInspectionFlag(p);
505  }
506 }
507 
508 /** \brief Entry point for packet flow handling
509  *
510  * This is called for every packet.
511  *
512  * \param tv threadvars
513  * \param dtv decode thread vars (for flow output api thread data)
514  * \param p packet to handle flow for
515  */
517 {
518  /* Get this packet's flow from the hash. FlowHandlePacket() will setup
519  * a new flow if necessary. If we get NULL, we're out of flow memory.
520  * The returned flow is locked. */
521  Flow *f = FlowGetFlowFromHash(tv, fls, p, &p->flow);
522  if (f != NULL) {
523  /* set the flow in the packet */
524  p->flags |= PKT_HAS_FLOW;
525  }
526 }
527 
528 /** \brief initialize the configuration
529  * \warning Not thread safe */
530 void FlowInitConfig(bool quiet)
531 {
532  SCLogDebug("initializing flow engine...");
533 
534  memset(&flow_config, 0, sizeof(flow_config));
535  SC_ATOMIC_INIT(flow_flags);
536  SC_ATOMIC_INIT(flow_memuse);
537  SC_ATOMIC_INIT(flow_prune_idx);
538  SC_ATOMIC_INIT(flow_config.memcap);
540 
541  /* set defaults */
542  flow_config.hash_rand = (uint32_t)RandomGet();
546 
547  /* If we have specific config, overwrite the defaults with them,
548  * otherwise, leave the default values */
549  intmax_t val = 0;
550  if (ConfGetInt("flow.emergency-recovery", &val) == 1) {
551  if (val <= 100 && val >= 1) {
552  flow_config.emergency_recovery = (uint8_t)val;
553  } else {
554  SCLogError("flow.emergency-recovery must be in the range of "
555  "1 and 100 (as percentage)");
557  }
558  } else {
559  SCLogDebug("flow.emergency-recovery, using default value");
561  }
562 
563  /* Check if we have memcap and hash_size defined at config */
564  const char *conf_val;
565  uint32_t configval = 0;
566 
567  /** set config values for memcap, prealloc and hash_size */
568  uint64_t flow_memcap_copy = 0;
569  if ((ConfGet("flow.memcap", &conf_val)) == 1)
570  {
571  if (conf_val == NULL) {
572  FatalError("Invalid value for flow.memcap: NULL");
573  }
574 
575  if (ParseSizeStringU64(conf_val, &flow_memcap_copy) < 0) {
576  SCLogError("Error parsing flow.memcap "
577  "from conf file - %s. Killing engine",
578  conf_val);
579  exit(EXIT_FAILURE);
580  } else {
581  SC_ATOMIC_SET(flow_config.memcap, flow_memcap_copy);
582  }
583  }
584  if ((ConfGet("flow.hash-size", &conf_val)) == 1)
585  {
586  if (conf_val == NULL) {
587  FatalError("Invalid value for flow.hash-size: NULL");
588  }
589 
590  if (StringParseUint32(&configval, 10, strlen(conf_val), conf_val) && configval != 0) {
591  flow_config.hash_size = configval;
592  } else {
593  FatalError("Invalid value for flow.hash-size. Must be a numeric value in the range "
594  "1-4294967295");
595  }
596  }
597  if ((ConfGet("flow.prealloc", &conf_val)) == 1)
598  {
599  if (conf_val == NULL) {
600  FatalError("Invalid value for flow.prealloc: NULL");
601  }
602 
603  if (StringParseUint32(&configval, 10, strlen(conf_val),
604  conf_val) > 0) {
605  flow_config.prealloc = configval;
606  }
607  }
608 
609  flow_config.memcap_policy = ExceptionPolicyParse("flow.memcap-policy", false);
610 
611  SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: "
612  "%"PRIu32", prealloc: %"PRIu32, SC_ATOMIC_GET(flow_config.memcap),
614 
615  /* alloc hash memory */
616  uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket);
617  if (!(FLOW_CHECK_MEMCAP(hash_size))) {
618  SCLogError("allocating flow hash failed: "
619  "max flow memcap is smaller than projected hash size. "
620  "Memcap: %" PRIu64 ", Hash table size %" PRIu64 ". Calculate "
621  "total hash size by multiplying \"flow.hash-size\" with %" PRIuMAX ", "
622  "which is the hash bucket size.",
623  SC_ATOMIC_GET(flow_config.memcap), hash_size, (uintmax_t)sizeof(FlowBucket));
624  exit(EXIT_FAILURE);
625  }
626  flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS);
627  if (unlikely(flow_hash == NULL)) {
628  FatalError("Fatal error encountered in FlowInitConfig. Exiting...");
629  }
630  memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket));
631 
632  uint32_t i = 0;
633  for (i = 0; i < flow_config.hash_size; i++) {
634  FBLOCK_INIT(&flow_hash[i]);
635  SC_ATOMIC_INIT(flow_hash[i].next_ts);
636  }
637  (void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket)));
638 
639  if (!quiet) {
640  SCLogConfig("allocated %"PRIu64" bytes of memory for the flow hash... "
641  "%" PRIu32 " buckets of size %" PRIuMAX "",
642  SC_ATOMIC_GET(flow_memuse), flow_config.hash_size,
643  (uintmax_t)sizeof(FlowBucket));
644  }
646  if (!quiet) {
647  SCLogConfig("flow memory usage: %"PRIu64" bytes, maximum: %"PRIu64,
648  SC_ATOMIC_GET(flow_memuse), SC_ATOMIC_GET(flow_config.memcap));
649  }
650 
652 
653  uint32_t sz = sizeof(Flow) + FlowStorageSize();
654  SCLogConfig("flow size %u, memcap allows for %" PRIu64 " flows. Per hash row in perfect "
655  "conditions %" PRIu64,
656  sz, flow_memcap_copy / sz, (flow_memcap_copy / sz) / flow_config.hash_size);
657 }
658 
659 void FlowReset(void)
660 {
661  // resets the flows (for reuse by fuzzing)
662  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
663  Flow *f = flow_hash[u].head;
664  while (f) {
665  Flow *n = f->next;
666  uint8_t proto_map = FlowGetProtoMapping(f->proto);
667  FlowClearMemory(f, proto_map);
668  FlowFree(f);
669  f = n;
670  }
671  flow_hash[u].head = NULL;
672  }
673 }
674 
675 /** \brief shutdown the flow engine
676  * \warning Not thread safe */
677 void FlowShutdown(void)
678 {
679  Flow *f;
680  while ((f = FlowDequeue(&flow_recycle_q))) {
681  FlowFree(f);
682  }
683 
684  /* clear and free the hash */
685  if (flow_hash != NULL) {
686  /* clean up flow mutexes */
687  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
688  f = flow_hash[u].head;
689  while (f) {
690  Flow *n = f->next;
691  uint8_t proto_map = FlowGetProtoMapping(f->proto);
692  FlowClearMemory(f, proto_map);
693  FlowFree(f);
694  f = n;
695  }
696  f = flow_hash[u].evicted;
697  while (f) {
698  Flow *n = f->next;
699  uint8_t proto_map = FlowGetProtoMapping(f->proto);
700  FlowClearMemory(f, proto_map);
701  FlowFree(f);
702  f = n;
703  }
704 
706  }
708  flow_hash = NULL;
709  }
710  (void) SC_ATOMIC_SUB(flow_memuse, flow_config.hash_size * sizeof(FlowBucket));
713  DEBUG_VALIDATE_BUG_ON(SC_ATOMIC_GET(flow_memuse) != 0);
714 }
715 
716 /**
717  * \brief Function to set the default timeout, free function and flow state
718  * function for all supported flow_proto.
719  */
720 
722 {
724 
725 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
726  flow_timeouts_normal[(p)].new_timeout = (n); \
727  flow_timeouts_normal[(p)].est_timeout = (e); \
728  flow_timeouts_normal[(p)].closed_timeout = (c); \
729  flow_timeouts_normal[(p)].bypassed_timeout = (b); \
730  flow_timeouts_emerg[(p)].new_timeout = (ne); \
731  flow_timeouts_emerg[(p)].est_timeout = (ee); \
732  flow_timeouts_emerg[(p)].closed_timeout = (ce); \
733  flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
734 
755 
760 
761  /* Let's see if we have custom timeouts defined from config */
762  const char *new = NULL;
763  const char *established = NULL;
764  const char *closed = NULL;
765  const char *bypassed = NULL;
766  const char *emergency_new = NULL;
767  const char *emergency_established = NULL;
768  const char *emergency_closed = NULL;
769  const char *emergency_bypassed = NULL;
770 
771  ConfNode *flow_timeouts = ConfGetNode("flow-timeouts");
772  if (flow_timeouts != NULL) {
773  ConfNode *proto = NULL;
774  uint32_t configval = 0;
775 
776  /* Defaults. */
777  proto = ConfNodeLookupChild(flow_timeouts, "default");
778  if (proto != NULL) {
779  new = ConfNodeLookupChildValue(proto, "new");
780  established = ConfNodeLookupChildValue(proto, "established");
781  closed = ConfNodeLookupChildValue(proto, "closed");
782  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
783  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
784  emergency_established = ConfNodeLookupChildValue(proto,
785  "emergency-established");
786  emergency_closed = ConfNodeLookupChildValue(proto,
787  "emergency-closed");
788  emergency_bypassed = ConfNodeLookupChildValue(proto,
789  "emergency-bypassed");
790 
791  if (new != NULL &&
792  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
793 
795  }
796  if (established != NULL &&
797  StringParseUint32(&configval, 10, strlen(established),
798  established) > 0) {
799 
801  }
802  if (closed != NULL &&
803  StringParseUint32(&configval, 10, strlen(closed),
804  closed) > 0) {
805 
807  }
808  if (bypassed != NULL &&
809  StringParseUint32(&configval, 10,
810  strlen(bypassed),
811  bypassed) > 0) {
812 
814  }
815  if (emergency_new != NULL &&
816  StringParseUint32(&configval, 10, strlen(emergency_new),
817  emergency_new) > 0) {
818 
820  }
821  if (emergency_established != NULL &&
822  StringParseUint32(&configval, 10,
823  strlen(emergency_established),
824  emergency_established) > 0) {
825 
827  }
828  if (emergency_closed != NULL &&
829  StringParseUint32(&configval, 10,
830  strlen(emergency_closed),
831  emergency_closed) > 0) {
832 
834  }
835  if (emergency_bypassed != NULL &&
836  StringParseUint32(&configval, 10,
837  strlen(emergency_bypassed),
838  emergency_bypassed) > 0) {
839 
841  }
842  }
843 
844  /* TCP. */
845  proto = ConfNodeLookupChild(flow_timeouts, "tcp");
846  if (proto != NULL) {
847  new = ConfNodeLookupChildValue(proto, "new");
848  established = ConfNodeLookupChildValue(proto, "established");
849  closed = ConfNodeLookupChildValue(proto, "closed");
850  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
851  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
852  emergency_established = ConfNodeLookupChildValue(proto,
853  "emergency-established");
854  emergency_closed = ConfNodeLookupChildValue(proto,
855  "emergency-closed");
856  emergency_bypassed = ConfNodeLookupChildValue(proto,
857  "emergency-bypassed");
858 
859  if (new != NULL &&
860  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
861 
863  }
864  if (established != NULL &&
865  StringParseUint32(&configval, 10, strlen(established),
866  established) > 0) {
867 
869  }
870  if (closed != NULL &&
871  StringParseUint32(&configval, 10, strlen(closed),
872  closed) > 0) {
873 
875  }
876  if (bypassed != NULL &&
877  StringParseUint32(&configval, 10,
878  strlen(bypassed),
879  bypassed) > 0) {
880 
882  }
883  if (emergency_new != NULL &&
884  StringParseUint32(&configval, 10, strlen(emergency_new),
885  emergency_new) > 0) {
886 
888  }
889  if (emergency_established != NULL &&
890  StringParseUint32(&configval, 10,
891  strlen(emergency_established),
892  emergency_established) > 0) {
893 
895  }
896  if (emergency_closed != NULL &&
897  StringParseUint32(&configval, 10,
898  strlen(emergency_closed),
899  emergency_closed) > 0) {
900 
902  }
903  if (emergency_bypassed != NULL &&
904  StringParseUint32(&configval, 10,
905  strlen(emergency_bypassed),
906  emergency_bypassed) > 0) {
907 
909  }
910  }
911 
912  /* UDP. */
913  proto = ConfNodeLookupChild(flow_timeouts, "udp");
914  if (proto != NULL) {
915  new = ConfNodeLookupChildValue(proto, "new");
916  established = ConfNodeLookupChildValue(proto, "established");
917  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
918  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
919  emergency_established = ConfNodeLookupChildValue(proto,
920  "emergency-established");
921  emergency_bypassed = ConfNodeLookupChildValue(proto,
922  "emergency-bypassed");
923 
924  if (new != NULL &&
925  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
926 
928  }
929  if (established != NULL &&
930  StringParseUint32(&configval, 10, strlen(established),
931  established) > 0) {
932 
934  }
935  if (bypassed != NULL &&
936  StringParseUint32(&configval, 10,
937  strlen(bypassed),
938  bypassed) > 0) {
939 
941  }
942  if (emergency_new != NULL &&
943  StringParseUint32(&configval, 10, strlen(emergency_new),
944  emergency_new) > 0) {
945 
947  }
948  if (emergency_established != NULL &&
949  StringParseUint32(&configval, 10,
950  strlen(emergency_established),
951  emergency_established) > 0) {
952 
954  }
955  if (emergency_bypassed != NULL &&
956  StringParseUint32(&configval, 10,
957  strlen(emergency_bypassed),
958  emergency_bypassed) > 0) {
959 
961  }
962  }
963 
964  /* ICMP. */
965  proto = ConfNodeLookupChild(flow_timeouts, "icmp");
966  if (proto != NULL) {
967  new = ConfNodeLookupChildValue(proto, "new");
968  established = ConfNodeLookupChildValue(proto, "established");
969  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
970  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
971  emergency_established = ConfNodeLookupChildValue(proto,
972  "emergency-established");
973  emergency_bypassed = ConfNodeLookupChildValue(proto,
974  "emergency-bypassed");
975 
976  if (new != NULL &&
977  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
978 
980  }
981  if (established != NULL &&
982  StringParseUint32(&configval, 10, strlen(established),
983  established) > 0) {
984 
986  }
987  if (bypassed != NULL &&
988  StringParseUint32(&configval, 10,
989  strlen(bypassed),
990  bypassed) > 0) {
991 
993  }
994  if (emergency_new != NULL &&
995  StringParseUint32(&configval, 10, strlen(emergency_new),
996  emergency_new) > 0) {
997 
999  }
1000  if (emergency_established != NULL &&
1001  StringParseUint32(&configval, 10,
1002  strlen(emergency_established),
1003  emergency_established) > 0) {
1004 
1006  }
1007  if (emergency_bypassed != NULL &&
1008  StringParseUint32(&configval, 10,
1009  strlen(emergency_bypassed),
1010  emergency_bypassed) > 0) {
1011 
1013  }
1014  }
1015  }
1016 
1017  /* validate and if needed update emergency timeout values */
1018  for (uint8_t i = 0; i < FLOW_PROTO_MAX; i++) {
1019  const FlowProtoTimeout *n = &flow_timeouts_normal[i];
1021 
1022  if (e->est_timeout > n->est_timeout) {
1023  SCLogWarning("emergency timeout value %u for \'established\' "
1024  "must be below regular value %u",
1025  e->est_timeout, n->est_timeout);
1026  e->est_timeout = n->est_timeout / 10;
1027  }
1028 
1029  if (e->new_timeout > n->new_timeout) {
1030  SCLogWarning("emergency timeout value %u for \'new\' must be "
1031  "below regular value %u",
1032  e->new_timeout, n->new_timeout);
1033  e->new_timeout = n->new_timeout / 10;
1034  }
1035 
1036  if (e->closed_timeout > n->closed_timeout) {
1037  SCLogWarning("emergency timeout value %u for \'closed\' must "
1038  "be below regular value %u",
1040  e->closed_timeout = n->closed_timeout / 10;
1041  }
1042 
1043  if (e->bypassed_timeout > n->bypassed_timeout) {
1044  SCLogWarning("emergency timeout value %u for \'bypassed\' "
1045  "must be below regular value %u",
1047  e->bypassed_timeout = n->bypassed_timeout / 10;
1048  }
1049  }
1050 
1051  for (uint8_t i = 0; i < FLOW_PROTO_MAX; i++) {
1055 
1056  if (e->est_timeout > n->est_timeout) {
1057  SCLogWarning("emergency timeout value for \'established\' must be below normal value");
1058  e->est_timeout = n->est_timeout / 10;
1059  }
1060  d->est_timeout = n->est_timeout - e->est_timeout;
1061 
1062  if (e->new_timeout > n->new_timeout) {
1063  SCLogWarning("emergency timeout value for \'new\' must be below normal value");
1064  e->new_timeout = n->new_timeout / 10;
1065  }
1066  d->new_timeout = n->new_timeout - e->new_timeout;
1067 
1068  if (e->closed_timeout > n->closed_timeout) {
1069  SCLogWarning("emergency timeout value for \'closed\' must be below normal value");
1070  e->closed_timeout = n->closed_timeout / 10;
1071  }
1073 
1074  if (e->bypassed_timeout > n->bypassed_timeout) {
1075  SCLogWarning("emergency timeout value for \'bypassed\' must be below normal value");
1076  e->bypassed_timeout = n->bypassed_timeout / 10;
1077  }
1079 
1080  SCLogDebug("deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1082  }
1083 }
1084 
1085 /**
1086  * \brief Function clear the flow memory before queueing it to spare flow
1087  * queue.
1088  *
1089  * \param f pointer to the flow needed to be cleared.
1090  * \param proto_map mapped value of the protocol to FLOW_PROTO's.
1091  */
1092 
1093 int FlowClearMemory(Flow* f, uint8_t proto_map)
1094 {
1095  SCEnter();
1096 
1097  if (unlikely(f->flags & FLOW_HAS_EXPECTATION)) {
1099  }
1100 
1101  /* call the protocol specific free function if we have one */
1102  if (flow_freefuncs[proto_map].Freefunc != NULL) {
1103  flow_freefuncs[proto_map].Freefunc(f->protoctx);
1104  }
1105 
1106  FlowFreeStorage(f);
1107 
1108  FLOW_RECYCLE(f);
1109 
1110  SCReturnInt(1);
1111 }
1112 
1113 /**
1114  * \brief Function to set the function to get protocol specific flow state.
1115  *
1116  * \param proto protocol of which function is needed to be set.
1117  * \param Free Function pointer which will be called to free the protocol
1118  * specific memory.
1119  */
1120 
1121 int FlowSetProtoFreeFunc (uint8_t proto, void (*Free)(void *))
1122 {
1123  uint8_t proto_map;
1124  proto_map = FlowGetProtoMapping(proto);
1125 
1126  flow_freefuncs[proto_map].Freefunc = Free;
1127  return 1;
1128 }
1129 
1130 /**
1131  * \brief get 'disruption' flags: GAP/DEPTH/PASS
1132  * \param f locked flow
1133  * \param flags existing flags to be amended
1134  * \retval flags original flags + disrupt flags (if any)
1135  * \TODO handle UDP
1136  */
1137 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
1138 {
1139  if (f->proto != IPPROTO_TCP) {
1140  return flags;
1141  }
1142  if (f->protoctx == NULL) {
1143  return flags;
1144  }
1145 
1146  uint8_t newflags = flags;
1147  TcpSession *ssn = f->protoctx;
1148  TcpStream *stream = flags & STREAM_TOSERVER ? &ssn->client : &ssn->server;
1149 
1151  newflags |= STREAM_DEPTH;
1152  }
1153  /* todo: handle pass case (also for UDP!) */
1154 
1155  return newflags;
1156 }
1157 
1158 void FlowUpdateState(Flow *f, const enum FlowState s)
1159 {
1160  if (s != f->flow_state) {
1161  /* set the state */
1162  // Explicit cast from the enum type to the compact version
1163  f->flow_state = (FlowStateType)s;
1164 
1165  /* update timeout policy and value */
1166  const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1167  if (timeout_policy != f->timeout_policy) {
1168  f->timeout_policy = timeout_policy;
1169  const uint32_t timeout_at = (uint32_t)SCTIME_SECS(f->lastts) + timeout_policy;
1170  if (timeout_at != f->timeout_at)
1171  f->timeout_at = timeout_at;
1172  }
1173  }
1174 #ifdef UNITTESTS
1175  if (f->fb != NULL) {
1176 #endif
1177  /* and reset the flow bucket next_ts value so that the flow manager
1178  * has to revisit this row */
1179  SC_ATOMIC_SET(f->fb->next_ts, 0);
1180 #ifdef UNITTESTS
1181  }
1182 #endif
1183 }
1184 
1185 /**
1186  * \brief Get flow last time as individual values.
1187  *
1188  * Instead of returning a pointer to the timeval copy the timeval
1189  * parts into output pointers to make it simpler to call from Rust
1190  * over FFI using only basic data types.
1191  */
1192 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
1193 {
1194  *secs = (uint64_t)SCTIME_SECS(flow->lastts);
1195  *usecs = (uint64_t)SCTIME_USECS(flow->lastts);
1196 }
1197 
1198 /**
1199  * \brief Get flow source port.
1200  *
1201  * A function to get the flow sport useful when the caller only has an
1202  * opaque pointer to the flow structure.
1203  */
1204 uint16_t FlowGetSourcePort(Flow *flow)
1205 {
1206  return flow->sp;
1207 }
1208 
1209 /**
1210  * \brief Get flow destination port.
1211  *
1212  * A function to get the flow dport useful when the caller only has an
1213  * opaque pointer to the flow structure.
1214  */
1215 
1217 {
1218  return flow->dp;
1219 }
1220 /**
1221  * \brief Get flow flags.
1222  *
1223  * A function to get the flow flags useful when the caller only has an
1224  * opaque pointer to the flow structure.
1225  */
1226 
1227 uint32_t FlowGetFlags(Flow *flow)
1228 {
1229  return flow->flags;
1230 }
1231 /************************************Unittests*******************************/
1232 
1233 #ifdef UNITTESTS
1234 #include "threads.h"
1235 
1236 /**
1237  * \test Test the setting of the per protocol timeouts.
1238  *
1239  * \retval On success it returns 1 and on failure 0.
1240  */
1241 
1242 static int FlowTest01 (void)
1243 {
1244  uint8_t proto_map;
1245 
1247  proto_map = FlowGetProtoMapping(IPPROTO_TCP);
1248  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_TCP_NEW_TIMEOUT);
1249  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_TCP_EST_TIMEOUT);
1252 
1253  proto_map = FlowGetProtoMapping(IPPROTO_UDP);
1254  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_UDP_NEW_TIMEOUT);
1255  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_UDP_EST_TIMEOUT);
1258 
1259  proto_map = FlowGetProtoMapping(IPPROTO_ICMP);
1260  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_ICMP_NEW_TIMEOUT);
1261  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_ICMP_EST_TIMEOUT);
1264 
1265  proto_map = FlowGetProtoMapping(IPPROTO_DCCP);
1266  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_DEFAULT_NEW_TIMEOUT);
1267  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_DEFAULT_EST_TIMEOUT);
1268  FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_DEFAULT_EMERG_NEW_TIMEOUT);
1269  FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_DEFAULT_EMERG_EST_TIMEOUT);
1270 
1271  PASS;
1272 }
1273 
1274 /*Test function for the unit test FlowTest02*/
1275 
1276 static void test(void *f) {}
1277 
1278 /**
1279  * \test Test the setting of the per protocol free function to free the
1280  * protocol specific memory.
1281  *
1282  * \retval On success it returns 1 and on failure 0.
1283  */
1284 
1285 static int FlowTest02 (void)
1286 {
1288  FlowSetProtoFreeFunc(IPPROTO_TCP, test);
1289  FlowSetProtoFreeFunc(IPPROTO_UDP, test);
1290  FlowSetProtoFreeFunc(IPPROTO_ICMP, test);
1291 
1292  FAIL_IF(flow_freefuncs[FLOW_PROTO_DEFAULT].Freefunc != test);
1293  FAIL_IF(flow_freefuncs[FLOW_PROTO_TCP].Freefunc != test);
1294  FAIL_IF(flow_freefuncs[FLOW_PROTO_UDP].Freefunc != test);
1295  FAIL_IF(flow_freefuncs[FLOW_PROTO_ICMP].Freefunc != test);
1296 
1297  PASS;
1298 }
1299 
1300 /**
1301  * \test Test flow allocations when it reach memcap
1302  *
1303  *
1304  * \retval On success it returns 1 and on failure 0.
1305  */
1306 
1307 static int FlowTest07 (void)
1308 {
1309  int result = 0;
1311  FlowConfig backup;
1312  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1313 
1314  uint32_t ini = 0;
1315  uint32_t end = FlowSpareGetPoolSize();
1316  SC_ATOMIC_SET(flow_config.memcap, 10000);
1317  flow_config.prealloc = 100;
1318 
1319  /* Let's get the flow spare pool empty */
1320  UTHBuildPacketOfFlows(ini, end, 0);
1321 
1322  /* And now let's try to reach the memcap val */
1323  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1324  ini = end + 1;
1325  end = end + 2;
1326  UTHBuildPacketOfFlows(ini, end, 0);
1327  }
1328 
1329  /* should time out normal */
1330  TimeSetIncrementTime(2000);
1331  ini = end + 1;
1332  end = end + 2;
1333  UTHBuildPacketOfFlows(ini, end, 0);
1334 
1335  /* This means that the engine entered emerg mode: should happen as easy
1336  * with flow mgr activated */
1337  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1338  result = 1;
1339 
1340  FlowShutdown();
1341  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1342 
1343  return result;
1344 }
1345 
1346 /**
1347  * \test Test flow allocations when it reach memcap
1348  *
1349  *
1350  * \retval On success it returns 1 and on failure 0.
1351  */
1352 
1353 static int FlowTest08 (void)
1354 {
1355  int result = 0;
1356 
1358  FlowConfig backup;
1359  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1360 
1361  uint32_t ini = 0;
1362  uint32_t end = FlowSpareGetPoolSize();
1363  SC_ATOMIC_SET(flow_config.memcap, 10000);
1364  flow_config.prealloc = 100;
1365 
1366  /* Let's get the flow spare pool empty */
1367  UTHBuildPacketOfFlows(ini, end, 0);
1368 
1369  /* And now let's try to reach the memcap val */
1370  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1371  ini = end + 1;
1372  end = end + 2;
1373  UTHBuildPacketOfFlows(ini, end, 0);
1374  }
1375 
1376  /* By default we use 30 for timing out new flows. This means
1377  * that the Emergency mode should be set */
1379  ini = end + 1;
1380  end = end + 2;
1381  UTHBuildPacketOfFlows(ini, end, 0);
1382 
1383  /* This means that the engine released 5 flows by emergency timeout */
1384  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1385  result = 1;
1386 
1387  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1388  FlowShutdown();
1389 
1390  return result;
1391 }
1392 
1393 /**
1394  * \test Test flow allocations when it reach memcap
1395  *
1396  *
1397  * \retval On success it returns 1 and on failure 0.
1398  */
1399 
1400 static int FlowTest09 (void)
1401 {
1402  int result = 0;
1403 
1405  FlowConfig backup;
1406  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1407 
1408  uint32_t ini = 0;
1409  uint32_t end = FlowSpareGetPoolSize();
1410  SC_ATOMIC_SET(flow_config.memcap, 10000);
1411  flow_config.prealloc = 100;
1412 
1413  /* Let's get the flow spare pool empty */
1414  UTHBuildPacketOfFlows(ini, end, 0);
1415 
1416  /* And now let's try to reach the memcap val */
1417  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1418  ini = end + 1;
1419  end = end + 2;
1420  UTHBuildPacketOfFlows(ini, end, 0);
1421  }
1422 
1423  /* No timeout will work */
1425  ini = end + 1;
1426  end = end + 2;
1427  UTHBuildPacketOfFlows(ini, end, 0);
1428 
1429  /* engine in emerg mode */
1430  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1431  result = 1;
1432 
1433  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1434  FlowShutdown();
1435 
1436  return result;
1437 }
1438 
1439 #endif /* UNITTESTS */
1440 
1441 /**
1442  * \brief Function to register the Flow Unitests.
1443  */
1445 {
1446 #ifdef UNITTESTS
1447  UtRegisterTest("FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1448  UtRegisterTest("FlowTest02 -- Setting Protocol Specific Free Function",
1449  FlowTest02);
1450  UtRegisterTest("FlowTest07 -- Test flow Allocations when it reach memcap",
1451  FlowTest07);
1452  UtRegisterTest("FlowTest08 -- Test flow Allocations when it reach memcap",
1453  FlowTest08);
1454  UtRegisterTest("FlowTest09 -- Test flow Allocations when it reach memcap",
1455  FlowTest09);
1456 
1458 #endif /* UNITTESTS */
1459 }
FLOWFILE_NO_MD5_TS
#define FLOWFILE_NO_MD5_TS
Definition: flow.h:136
util-byte.h
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:193
FLOWFILE_NO_MD5_TC
#define FLOWFILE_NO_MD5_TC
Definition: flow.h:137
FBLOCK_DESTROY
#define FBLOCK_DESTROY(fb)
Definition: flow-hash.h:72
FLOW_DEFAULT_NEW_TIMEOUT
#define FLOW_DEFAULT_NEW_TIMEOUT
Definition: flow-private.h:40
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:71
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:399
Packet_::proto
uint8_t proto
Definition: decode.h:504
FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
Definition: flow-private.h:56
TcpStream_
Definition: stream-tcp-private.h:106
FLOWFILE_NO_SIZE_TS
#define FLOWFILE_NO_SIZE_TS
Definition: flow.h:148
flow-bypass.h
FLOW_HAS_EXPECTATION
#define FLOW_HAS_EXPECTATION
Definition: flow.h:113
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
Definition: flow.c:160
FLOWFILE_NO_SIZE_TC
#define FLOWFILE_NO_SIZE_TC
Definition: flow.h:149
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:136
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
Definition: flow.c:184
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1281
IPV6_GET_RAW_HLIM
#define IPV6_GET_RAW_HLIM(ip6h)
Definition: decode-ipv6.h:67
FlowSpareGetPoolSize
uint32_t FlowSpareGetPoolSize(void)
Definition: flow-spare-pool.c:46
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:287
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:511
flow-util.h
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:314
FBLOCK_INIT
#define FBLOCK_INIT(fb)
Definition: flow-hash.h:71
CLS
#define CLS
Definition: suricata-common.h:56
FLOW_DEFAULT_HASHSIZE
#define FLOW_DEFAULT_HASHSIZE
Definition: flow.c:64
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:304
FLOW_DEFAULT_PREALLOC
#define FLOW_DEFAULT_PREALLOC
Definition: flow.c:68
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:386
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:298
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1444
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:60
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:74
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:609
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:190
Flow_::proto
uint8_t proto
Definition: flow.h:382
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:82
action-globals.h
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:129
Packet_::flags
uint32_t flags
Definition: decode.h:519
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
threads.h
util-macset.h
FlowGetFlags
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
Definition: flow.c:1227
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:360
FLOW_PROTO_ICMP
@ FLOW_PROTO_ICMP
Definition: flow-private.h:70
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:68
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:332
FlowProtoTimeout_
Definition: flow.h:524
flow-hash.h
FlowGetSourcePort
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
Definition: flow.c:1204
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:66
FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
Definition: flow.h:85
FlowReset
void FlowReset(void)
Definition: flow.c:659
FlowLookupStruct_
Definition: flow.h:548
FLOW_DEFAULT_EMERG_NEW_TIMEOUT
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
Definition: flow-private.h:54
Flow
struct Flow_ Flow
Flow data structure.
FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:57
BypassedFlowUpdate
void BypassedFlowUpdate(Flow *f, Packet *p)
Definition: flow-bypass.c:211
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:528
FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_DEFAULT_EST_TIMEOUT
Definition: flow-private.h:41
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:232
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:155
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:125
MIN
#define MIN(x, y)
Definition: suricata-common.h:391
IPPROTO_DCCP
#define IPPROTO_DCCP
Definition: decode.h:1199
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:119
FlowQueueDestroy
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
Definition: flow-queue.c:60
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:516
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:69
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:69
RandomGet
long int RandomGet(void)
Definition: util-random.c:130
FLOW_TOSERVER_DROP_LOGGED
#define FLOW_TOSERVER_DROP_LOGGED
Definition: flow.h:77
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:477
Packet_::icmp_s
struct Packet_::@29::@36 icmp_s
proto
uint8_t proto
Definition: decode-template.h:0
Flow_::dp
Port dp
Definition: flow.h:376
FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
Definition: flow.h:95
FLOW_DEFAULT_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
Definition: flow-private.h:42
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:513
MAX
#define MAX(x, y)
Definition: suricata-common.h:395
Flow_::protoctx
void * protoctx
Definition: flow.h:450
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:955
ExceptionPolicyParse
enum ExceptionPolicy ExceptionPolicyParse(const char *option, bool support_flow)
Definition: util-exception-policy.c:232
FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
Definition: flow-private.h:49
STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
Definition: stream-tcp-private.h:223
util-unittest.h
FLOW_BYPASSED_TIMEOUT
#define FLOW_BYPASSED_TIMEOUT
Definition: flow-private.h:65
util-unittest-helper.h
FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
Definition: flow-private.h:59
FLOW_IPPROTO_ICMP_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
Definition: flow-private.h:51
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:299
UTHBuildPacketOfFlows
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
Definition: util-unittest-helper.c:853
AppLayerExpectationClean
void AppLayerExpectationClean(Flow *f)
Definition: app-layer-expectation.c:361
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:421
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1314
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:492
FlowGetDestinationPort
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
Definition: flow.c:1216
FLOW_CHECK_MEMCAP
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
Definition: flow-util.h:136
FLOW_RECYCLE
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
Definition: flow-util.h:81
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:504
flow-spare-pool.h
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:484
FLOWFILE_NO_SHA1_TC
#define FLOWFILE_NO_SHA1_TC
Definition: flow.h:141
FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
Definition: flow-private.h:63
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:530
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:497
app-layer-expectation.h
FLOW_IPPROTO_UDP_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
Definition: flow-private.h:48
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:513
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:476
decode.h
util-debug.h
TOSERVER
#define TOSERVER
Definition: flow.h:45
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
Packet_::ts
SCTime_t ts
Definition: decode.h:530
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:501
FLOWFILE_NO_STORE_TS
#define FLOWFILE_NO_STORE_TS
Definition: flow.h:133
FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
Definition: flow-private.h:45
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:386
Flow_::lastts
SCTime_t lastts
Definition: flow.h:419
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
MacSetAddWithCtr
void MacSetAddWithCtr(MacSet *ms, const uint8_t *src_addr, const uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
Definition: util-macset.c:181
FLOW_CHANGE_PROTO
#define FLOW_CHANGE_PROTO
Definition: flow.h:107
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
FlowStorageSize
unsigned int FlowStorageSize(void)
Definition: flow-storage.c:35
Packet_::sp
Port sp
Definition: decode.h:489
FlowCnf_
Definition: flow.h:296
FLOWFILE_NO_SHA256_TS
#define FLOWFILE_NO_SHA256_TS
Definition: flow.h:144
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:238
FlowQueueInit
FlowQueue * FlowQueueInit(FlowQueue *q)
Definition: flow-queue.c:46
FlowState
FlowState
Definition: flow.h:509
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:285
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:525
StringParseUint32
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:313
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:527
util-time.h
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
app-layer-parser.h
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1610
FLOW_PROTO_DETECT_TC_DONE
#define FLOW_PROTO_DETECT_TC_DONE
Definition: flow.h:104
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:503
FLOW_TC_PP_ALPROTO_DETECT_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
Definition: flow.h:93
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:489
MacSetFlowStorageEnabled
bool MacSetFlowStorageEnabled(void)
Definition: util-macset.c:85
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:341
FlowThreadId
uint16_t FlowThreadId
Definition: flow.h:337
TimeSetIncrementTime
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
Definition: util-time.c:180
IPV6Hdr_
Definition: decode-ipv6.h:32
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:97
Packet_
Definition: decode.h:482
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
IPV4_GET_RAW_IPTTL
#define IPV4_GET_RAW_IPTTL(ip4h)
Definition: decode-ipv4.h:102
FLOW_DEFAULT_MEMCAP
#define FLOW_DEFAULT_MEMCAP
Definition: flow.c:66
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:213
stream-tcp-private.h
MacSet_
Definition: util-macset.c:45
conf.h
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:151
FLOW_TOSERVER_IPONLY_SET
#define FLOW_TOSERVER_IPONLY_SET
Definition: flow.h:59
FLOW_IPPROTO_TCP_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
Definition: flow-private.h:43
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:532
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1093
flow_timeouts_delta
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Definition: flow.c:87
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:297
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:478
MacSetGetFlowStorageID
FlowStorageId MacSetGetFlowStorageID(void)
Definition: util-macset.c:114
flow-queue.h
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:428
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:233
FLOW_TO_DST_SEEN
#define FLOW_TO_DST_SEEN
Definition: flow.h:53
FlowGetStorageById
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
Definition: flow-storage.c:40
FlowUpdateState
void FlowUpdateState(Flow *f, const enum FlowState s)
Definition: flow.c:1158
Flow_::src
FlowAddress src
Definition: flow.h:363
Flow_::next
struct Flow_ * next
Definition: flow.h:405
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:427
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
FLOWFILE_NO_SHA256_TC
#define FLOWFILE_NO_SHA256_TC
Definition: flow.h:145
IPV4Hdr_
Definition: decode-ipv4.h:72
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:781
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:58
FlowDequeue
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
Definition: flow-queue.c:191
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:74
FLOW_TO_SRC_SEEN
#define FLOW_TO_SRC_SEEN
Definition: flow.h:51
flow-storage.h
FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
Definition: flow.h:89
Packet_::flow
struct Flow_ * flow
Definition: decode.h:521
FLOW_IPPROTO_UDP_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
Definition: flow-private.h:47
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1121
FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
Definition: flow-private.h:50
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:85
CMP_ADDR
#define CMP_ADDR(a1, a2)
Definition: decode.h:227
FlowStateType
unsigned short FlowStateType
Definition: flow.h:334
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:130
flags
uint8_t flags
Definition: decode-gre.h:0
FlowGetMemcapExceptionPolicy
enum ExceptionPolicy FlowGetMemcapExceptionPolicy(void)
Definition: flow.c:131
FLOW_TOCLIENT_IPONLY_SET
#define FLOW_TOCLIENT_IPONLY_SET
Definition: flow.h:61
flow-manager.h
suricata-common.h
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:82
flow_config
FlowConfig flow_config
Definition: flow.c:90
FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
Definition: flow-private.h:46
FLOW_HAS_ALERTS
#define FLOW_HAS_ALERTS
Definition: flow.h:82
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:677
FlowSparePoolDestroy
void FlowSparePoolDestroy(void)
Definition: flow-spare-pool.c:310
packet.h
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
SWAP_VARS
#define SWAP_VARS(type, a, b)
Definition: suricata-common.h:428
FlowTimeoutsInit
void FlowTimeoutsInit(void)
Definition: flow-manager.c:96
SCTIME_SECS
#define SCTIME_SECS(t)
Definition: util-time.h:57
FLOW_PROTO_DETECT_TS_DONE
#define FLOW_PROTO_DETECT_TS_DONE
Definition: flow.h:103
FatalError
#define FatalError(...)
Definition: util-debug.h:502
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:479
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:295
FLOW_TS_PP_ALPROTO_DETECT_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
Definition: flow.h:87
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1315
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1192
FLOWFILE_NO_STORE_TC
#define FLOWFILE_NO_STORE_TC
Definition: flow.h:134
FlowGetFlowFromHash
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
Definition: flow-hash.c:866
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:414
FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
Definition: flow-private.h:58
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
threadvars.h
FlowSwap
void FlowSwap(Flow *f)
swap the flow's direction
Definition: flow.c:254
FlowCnf_::memcap_policy
enum ExceptionPolicy memcap_policy
Definition: flow.h:306
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FlowInitFlowProto
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
Definition: flow.c:721
SCTIME_CMP_GT
#define SCTIME_CMP_GT(a, b)
Definition: util-time.h:104
FLOWFILE_NO_SHA1_TS
#define FLOWFILE_NO_SHA1_TS
Definition: flow.h:140
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:294
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
flow_recycle_q
FlowQueue flow_recycle_q
Definition: flow-manager.c:63
SWAP_FLAGS
#define SWAP_FLAGS(flags, a, b)
Definition: suricata-common.h:417
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:72
CMP_PORT
#define CMP_PORT(p1, p2)
Definition: decode.h:232
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:946
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:460
ConfNode_
Definition: conf.h:32
Flow_::alstate
void * alstate
Definition: flow.h:485
flow_freefuncs
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
Definition: flow.c:88
flow_timeouts_emerg
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow.c:86
Flow_::flags
uint32_t flags
Definition: flow.h:430
FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
Definition: flow-private.h:61
FlowFreeStorage
void FlowFreeStorage(Flow *f)
Definition: flow-storage.c:60
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:956
FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:62
FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_TOCLIENT_DROP_LOGGED
Definition: flow.h:79
util-random.h
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:234
PacketDrop
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
Definition: packet.c:32
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:230
FLOW_EMERGENCY
#define FLOW_EMERGENCY
Definition: flow-private.h:37
suricata.h
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:43
FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
Definition: flow.h:91
FLOW_DEFAULT_EMERGENCY_RECOVERY
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
Definition: flow.c:61
FlowHasAlerts
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:171
FlowSparePoolInit
void FlowSparePoolInit(void)
Definition: flow-spare-pool.c:291
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:1207
FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
Definition: flow-private.h:55
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:64
FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
Definition: flow-private.h:52
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:526
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:203
Flow_::sp
Port sp
Definition: flow.h:365
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1137
TcpSession_
Definition: stream-tcp-private.h:283
util-misc.h
TcpSession_::data_first_seen_dir
int8_t data_first_seen_dir
Definition: stream-tcp-private.h:288
flow.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:461
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:432
Packet_::dp
Port dp
Definition: decode.h:497
ExceptionPolicy
ExceptionPolicy
Definition: util-exception-policy-types.h:25
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:111
ICMPV4_IS_ERROR_MSG
#define ICMPV4_IS_ERROR_MSG(type)
Definition: decode-icmpv4.h:267
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:400
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
FLOW_IPPROTO_TCP_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
Definition: flow-private.h:44
RegisterFlowStorageTests
void RegisterFlowStorageTests(void)
Definition: flow-storage.c:295
SET_DEFAULTS
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
TOCLIENT
#define TOCLIENT
Definition: flow.h:46
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:237
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
PKT_DROP_REASON_FLOW_DROP
@ PKT_DROP_REASON_FLOW_DROP
Definition: decode.h:372
Packet_::src
Address src
Definition: decode.h:486
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:502
Flow_::thread_id
FlowThreadId thread_id[2]
Definition: flow.h:403
SCTIME_USECS
#define SCTIME_USECS(t)
Definition: util-time.h:56
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:104
FlowProtoFreeFunc_
Definition: flow.h:531
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:809