Go to the documentation of this file.
63 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
66 #define FLOW_DEFAULT_HASHSIZE 65536
68 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024)
70 #define FLOW_DEFAULT_PREALLOC 10000
140 if (f == NULL || f->
proto == 0)
204 static inline void FlowSwapFlags(
Flow *f)
217 static inline void FlowSwapFileFlags(
Flow *f)
227 static inline void TcpStreamFlowSwap(
Flow *f)
253 FlowSwapFileFlags(f);
257 if (f->
proto == IPPROTO_TCP) {
258 TcpStreamFlowSwap(f);
297 }
else if (p->
proto == IPPROTO_ICMP || p->
proto == IPPROTO_ICMPV6) {
317 static inline int FlowUpdateSeenFlag(
const Packet *p)
319 if (PacketIsICMPv4(p)) {
328 static inline void FlowUpdateTtlTS(
Flow *f, uint8_t ttl)
338 static inline void FlowUpdateTtlTC(
Flow *f, uint8_t ttl)
348 static inline void FlowUpdateFlowRate(
360 SCLogDebug(
"Flow rate for flow %p exceeds the configured values, marking it as an "
372 static inline void FlowUpdateEthernet(
376 const EthernetHdr *ethh = PacketGetEthernet(p);
406 #ifdef CAPTURE_OFFLOAD
409 if (state != FLOW_STATE_CAPTURE_BYPASSED) {
415 #ifdef CAPTURE_OFFLOAD
419 SCLogDebug(
"Downgrading flow to local bypass");
438 if (FlowUpdateSeenFlag(p)) {
449 FlowUpdateEthernet(
tv,
dtv, f, p,
true);
451 if (PacketIsIPv4(p)) {
452 const IPV4Hdr *ip4h = PacketGetIPv4(p);
454 }
else if (PacketIsIPv6(p)) {
455 const IPV6Hdr *ip6h = PacketGetIPv6(p);
464 if (FlowUpdateSeenFlag(p)) {
475 FlowUpdateEthernet(
tv,
dtv, f, p,
false);
477 if (PacketIsIPv4(p)) {
478 const IPV4Hdr *ip4h = PacketGetIPv4(p);
480 }
else if (PacketIsIPv6(p)) {
481 const IPV6Hdr *ip6h = PacketGetIPv6(p);
493 }
else if (f->
proto == IPPROTO_TCP) {
504 #ifdef CAPTURE_OFFLOAD
505 (f->
flow_state != FLOW_STATE_CAPTURE_BYPASSED) &&
517 SCLogDebug(
"setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
518 DecodeSetNoPayloadInspectionFlag(p);
566 if (
SCConfGetInt(
"flow.emergency-recovery", &val) == 1) {
567 if (val <= 100 && val >= 1) {
570 SCLogError(
"flow.emergency-recovery must be in the range of "
571 "1 and 100 (as percentage)");
575 SCLogDebug(
"flow.emergency-recovery, using default value");
580 const char *conf_val;
581 uint32_t configval = 0;
584 uint64_t flow_memcap_copy = 0;
585 if ((
SCConfGet(
"flow.memcap", &conf_val)) == 1) {
586 if (conf_val == NULL) {
587 FatalError(
"Invalid value for flow.memcap: NULL");
592 "from conf file - %s. Killing engine",
599 if ((
SCConfGet(
"flow.hash-size", &conf_val)) == 1) {
600 if (conf_val == NULL) {
601 FatalError(
"Invalid value for flow.hash-size: NULL");
604 if (
StringParseUint32(&configval, 10, strlen(conf_val), conf_val) && configval != 0) {
607 FatalError(
"Invalid value for flow.hash-size. Must be a numeric value in the range "
611 if ((
SCConfGet(
"flow.prealloc", &conf_val)) == 1) {
612 if (conf_val == NULL) {
613 FatalError(
"Invalid value for flow.prealloc: NULL");
624 SCLogDebug(
"Flow config from suricata.yaml: memcap: %"PRIu64
", hash-size: "
632 "max flow memcap is smaller than projected hash size. "
633 "Memcap: %" PRIu64
", Hash table size %" PRIu64
". Calculate "
634 "total hash size by multiplying \"flow.hash-size\" with %" PRIuMAX
", "
635 "which is the hash bucket size.",
641 FatalError(
"Fatal error encountered in FlowInitConfig. Exiting...");
653 SCLogConfig(
"allocated %"PRIu64
" bytes of memory for the flow hash... "
654 "%" PRIu32
" buckets of size %" PRIuMAX
"",
656 (uintmax_t)
sizeof(FlowBucket));
660 SCLogConfig(
"flow memory usage: %"PRIu64
" bytes, maximum: %"PRIu64,
667 SCLogConfig(
"flow size %u, memcap allows for %" PRIu64
" flows. Per hash row in perfect "
668 "conditions %" PRIu64,
738 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
739 flow_timeouts_normal[(p)].new_timeout = (n); \
740 flow_timeouts_normal[(p)].est_timeout = (e); \
741 flow_timeouts_normal[(p)].closed_timeout = (c); \
742 flow_timeouts_normal[(p)].bypassed_timeout = (b); \
743 flow_timeouts_emerg[(p)].new_timeout = (ne); \
744 flow_timeouts_emerg[(p)].est_timeout = (ee); \
745 flow_timeouts_emerg[(p)].closed_timeout = (ce); \
746 flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
775 const char *
new = NULL;
776 const char *established = NULL;
777 const char *closed = NULL;
778 const char *bypassed = NULL;
779 const char *emergency_new = NULL;
780 const char *emergency_established = NULL;
781 const char *emergency_closed = NULL;
782 const char *emergency_bypassed = NULL;
785 if (flow_timeouts != NULL) {
787 uint32_t configval = 0;
806 if (established != NULL &&
812 if (closed != NULL &&
818 if (bypassed != NULL &&
825 if (emergency_new != NULL &&
827 emergency_new) > 0) {
831 if (emergency_established != NULL &&
833 strlen(emergency_established),
834 emergency_established) > 0) {
838 if (emergency_closed != NULL &&
840 strlen(emergency_closed),
841 emergency_closed) > 0) {
845 if (emergency_bypassed != NULL &&
847 strlen(emergency_bypassed),
848 emergency_bypassed) > 0) {
871 if (established != NULL &&
877 if (closed != NULL &&
883 if (bypassed != NULL &&
890 if (emergency_new != NULL &&
892 emergency_new) > 0) {
896 if (emergency_established != NULL &&
898 strlen(emergency_established),
899 emergency_established) > 0) {
903 if (emergency_closed != NULL &&
905 strlen(emergency_closed),
906 emergency_closed) > 0) {
910 if (emergency_bypassed != NULL &&
912 strlen(emergency_bypassed),
913 emergency_bypassed) > 0) {
934 if (established != NULL &&
940 if (bypassed != NULL &&
947 if (emergency_new != NULL &&
949 emergency_new) > 0) {
953 if (emergency_established != NULL &&
955 strlen(emergency_established),
956 emergency_established) > 0) {
960 if (emergency_bypassed != NULL &&
962 strlen(emergency_bypassed),
963 emergency_bypassed) > 0) {
984 if (established != NULL &&
990 if (bypassed != NULL &&
997 if (emergency_new != NULL &&
999 emergency_new) > 0) {
1003 if (emergency_established != NULL &&
1005 strlen(emergency_established),
1006 emergency_established) > 0) {
1010 if (emergency_bypassed != NULL &&
1012 strlen(emergency_bypassed),
1013 emergency_bypassed) > 0) {
1026 SCLogWarning(
"emergency timeout value %u for \'established\' "
1027 "must be below regular value %u",
1033 SCLogWarning(
"emergency timeout value %u for \'new\' must be "
1034 "below regular value %u",
1040 SCLogWarning(
"emergency timeout value %u for \'closed\' must "
1041 "be below regular value %u",
1047 SCLogWarning(
"emergency timeout value %u for \'bypassed\' "
1048 "must be below regular value %u",
1060 SCLogWarning(
"emergency timeout value for \'established\' must be below normal value");
1066 SCLogWarning(
"emergency timeout value for \'new\' must be below normal value");
1072 SCLogWarning(
"emergency timeout value for \'closed\' must be below normal value");
1078 SCLogWarning(
"emergency timeout value for \'bypassed\' must be below normal value");
1083 SCLogDebug(
"deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1142 if (f->
proto != IPPROTO_TCP) {
1149 uint8_t newflags =
flags;
1154 newflags |= STREAM_DEPTH;
1169 const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1175 if (f->
fb != NULL) {
1242 static int FlowTest01 (
void)
1276 static void test(
void *f) {}
1285 static int FlowTest02 (
void)
1307 static int FlowTest07 (
void)
1353 static int FlowTest08 (
void)
1400 static int FlowTest09 (
void)
1447 UtRegisterTest(
"FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1448 UtRegisterTest(
"FlowTest02 -- Setting Protocol Specific Free Function",
1450 UtRegisterTest(
"FlowTest07 -- Test flow Allocations when it reach memcap",
1452 UtRegisterTest(
"FlowTest08 -- Test flow Allocations when it reach memcap",
1454 UtRegisterTest(
"FlowTest09 -- Test flow Allocations when it reach memcap",
#define FLOWFILE_NO_MD5_TS
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
#define FLOWFILE_NO_MD5_TC
#define FBLOCK_DESTROY(fb)
#define FLOW_DEFAULT_NEW_TIMEOUT
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOWFILE_NO_SIZE_TS
#define FLOW_HAS_EXPECTATION
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
#define FLOWFILE_NO_SIZE_TC
void FlowCleanupAppLayer(Flow *f)
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
#define IPV6_GET_RAW_HLIM(ip6h)
uint32_t FlowSpareGetPoolSize(void)
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
#define FLOW_DEFAULT_HASHSIZE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
uint32_t emergency_recovery
#define FLOW_DEFAULT_PREALLOC
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void FlowRegisterTests(void)
Function to register the Flow Unitests.
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_SGH_TOCLIENT
int ParseSizeStringU64(const char *size, uint64_t *res)
#define FLOWFILE_NO_MAGIC_TS
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
struct Packet_::@23::@30 icmp_s
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
#define FLOW_NOPAYLOAD_INSPECTION
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
FlowStorageId FlowRateGetStorageID(void)
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
void BypassedFlowUpdate(Flow *f, Packet *p)
uint32_t bypassed_timeout
#define FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_PKT_TOSERVER
uint64_t FlowGetMemuse(void)
uint64_t FlowGetMemcap(void)
Return memcap value.
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
void SCFlowRunUpdateCallbacks(ThreadVars *tv, Flow *f, Packet *p)
#define FLOW_TOSERVER_DROP_LOGGED
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
uint16_t counter_max_mac_addrs_src
enum ExceptionPolicy ExceptionPolicyParse(const char *option, bool support_flow)
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define FLOW_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
void AppLayerExpectationClean(Flow *f)
#define PKT_PROTO_DETECT_TS_DONE
const struct SigGroupHead_ * sgh_toserver
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
AppLayerParserState * alparser
void FlowRateStoreUpdate(FlowRateStore *frs, SCTime_t p_ts, uint32_t pkt_len, int direction)
#define FLOWFILE_NO_SHA1_TC
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
void FlowInitConfig(bool quiet)
initialize the configuration
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
@ FLOW_STATE_LOCAL_BYPASSED
#define PASS
Pass the test.
#define FLOWFILE_NO_STORE_TS
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
int SCConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
void MacSetAddWithCtr(MacSet *ms, const uint8_t *src_addr, const uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
#define FLOW_CHANGE_PROTO
Per thread variable structure.
unsigned int FlowStorageSize(void)
#define FLOWFILE_NO_SHA256_TS
#define FLOW_PKT_TOCLIENT_FIRST
FlowQueue * FlowQueueInit(FlowQueue *q)
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
#define SCLogWarning(...)
Macro used to log WARNING messages.
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
#define FLOW_PROTO_DETECT_TC_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
const struct SigGroupHead_ * sgh_toclient
bool MacSetFlowStorageEnabled(void)
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
#define IPV4_GET_RAW_IPTTL(ip4h)
#define FLOW_DEFAULT_MEMCAP
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
FlowStorageId MacSetGetFlowStorageID(void)
uint32_t probing_parser_toclient_alproto_masks
#define FLOW_PKT_TOCLIENT
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
void FlowUpdateState(Flow *f, const enum FlowState s)
uint32_t probing_parser_toserver_alproto_masks
#define FLOWFILE_NO_SHA256_TC
SCConfNode * SCConfNodeLookupChild(const SCConfNode *node, const char *name)
Lookup a child configuration node by name.
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
unsigned short FlowStateType
#define FLOWFILE_NO_MAGIC_TC
enum ExceptionPolicy FlowGetMemcapExceptionPolicy(void)
void FlowFree(Flow *f)
cleanup & free the memory of a flow
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
void FlowShutdown(void)
shutdown the flow engine
void FlowSparePoolDestroy(void)
#define SCMallocAligned(size, align)
#define SWAP_VARS(type, a, b)
void FlowTimeoutsInit(void)
#define FLOW_PROTO_DETECT_TS_DONE
bool FlowRateIsExceeding(FlowRateStore *frs, int direction)
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
#define PKT_PROTO_DETECT_TC_DONE
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
#define FLOWFILE_NO_STORE_TC
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
void FlowSwap(Flow *f)
swap the flow's direction
enum ExceptionPolicy memcap_policy
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
#define SCTIME_CMP_GT(a, b)
#define FLOWFILE_NO_SHA1_TS
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
#define SCLogError(...)
Macro used to log ERROR messages.
#define SWAP_FLAGS(flags, a, b)
#define FLOW_SGH_TOSERVER
Structure to hold thread specific data for all decode modules.
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
uint16_t counter_flow_elephant
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
void FlowFreeStorage(Flow *f)
uint16_t counter_max_mac_addrs_dst
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_PKT_ESTABLISHED
bool FlowRateStorageEnabled(void)
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
int EngineModeIsIPS(void)
@ SIGNATURE_HOOK_PKT_FLOW_START
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
void FlowSparePoolInit(void)
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
int8_t data_first_seen_dir
#define FLOW_DIR_REVERSED
#define ICMPV4_IS_ERROR_MSG(type)
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
void RegisterFlowStorageTests(void)
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
#define FLOW_PKT_TOSERVER_FIRST
#define DEBUG_VALIDATE_BUG_ON(exp)
@ PKT_DROP_REASON_FLOW_DROP
FlowThreadId thread_id[2]
int FlowSetMemcap(uint64_t size)
Update memcap value.