Go to the documentation of this file.
61 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
64 #define FLOW_DEFAULT_HASHSIZE 65536
66 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024)
68 #define FLOW_DEFAULT_PREALLOC 10000
138 if (f == NULL || f->
proto == 0)
212 static inline void FlowSwapFlags(
Flow *f)
226 static inline void FlowSwapFileFlags(
Flow *f)
236 static inline void TcpStreamFlowSwap(
Flow *f)
262 FlowSwapFileFlags(f);
266 if (f->
proto == IPPROTO_TCP) {
267 TcpStreamFlowSwap(f);
306 }
else if (p->
proto == IPPROTO_ICMP || p->
proto == IPPROTO_ICMPV6) {
326 static inline int FlowUpdateSeenFlag(
const Packet *p)
328 if (PacketIsICMPv4(p)) {
337 static inline void FlowUpdateTtlTS(
Flow *f, uint8_t ttl)
347 static inline void FlowUpdateTtlTC(
Flow *f, uint8_t ttl)
357 static inline void FlowUpdateEthernet(
361 const EthernetHdr *ethh = PacketGetEthernet(p);
391 #ifdef CAPTURE_OFFLOAD
394 if (state != FLOW_STATE_CAPTURE_BYPASSED) {
404 #ifdef CAPTURE_OFFLOAD
408 SCLogDebug(
"Downgrading flow to local bypass");
426 if (FlowUpdateSeenFlag(p)) {
436 FlowUpdateEthernet(
tv,
dtv, f, p,
true);
438 if (PacketIsIPv4(p)) {
439 const IPV4Hdr *ip4h = PacketGetIPv4(p);
441 }
else if (PacketIsIPv6(p)) {
442 const IPV6Hdr *ip6h = PacketGetIPv6(p);
450 if (FlowUpdateSeenFlag(p)) {
460 FlowUpdateEthernet(
tv,
dtv, f, p,
false);
462 if (PacketIsIPv4(p)) {
463 const IPV4Hdr *ip4h = PacketGetIPv4(p);
465 }
else if (PacketIsIPv6(p)) {
466 const IPV6Hdr *ip6h = PacketGetIPv6(p);
475 }
else if (f->
proto == IPPROTO_TCP) {
486 #ifdef CAPTURE_OFFLOAD
487 (f->
flow_state != FLOW_STATE_CAPTURE_BYPASSED) &&
499 SCLogDebug(
"setting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
500 DecodeSetNoPacketInspectionFlag(p);
503 SCLogDebug(
"setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
504 DecodeSetNoPayloadInspectionFlag(p);
550 if (
ConfGetInt(
"flow.emergency-recovery", &val) == 1) {
551 if (val <= 100 && val >= 1) {
554 SCLogError(
"flow.emergency-recovery must be in the range of "
555 "1 and 100 (as percentage)");
559 SCLogDebug(
"flow.emergency-recovery, using default value");
564 const char *conf_val;
565 uint32_t configval = 0;
568 uint64_t flow_memcap_copy = 0;
569 if ((
ConfGet(
"flow.memcap", &conf_val)) == 1)
571 if (conf_val == NULL) {
572 FatalError(
"Invalid value for flow.memcap: NULL");
577 "from conf file - %s. Killing engine",
584 if ((
ConfGet(
"flow.hash-size", &conf_val)) == 1)
586 if (conf_val == NULL) {
587 FatalError(
"Invalid value for flow.hash-size: NULL");
590 if (
StringParseUint32(&configval, 10, strlen(conf_val), conf_val) && configval != 0) {
593 FatalError(
"Invalid value for flow.hash-size. Must be a numeric value in the range "
597 if ((
ConfGet(
"flow.prealloc", &conf_val)) == 1)
599 if (conf_val == NULL) {
600 FatalError(
"Invalid value for flow.prealloc: NULL");
611 SCLogDebug(
"Flow config from suricata.yaml: memcap: %"PRIu64
", hash-size: "
619 "max flow memcap is smaller than projected hash size. "
620 "Memcap: %" PRIu64
", Hash table size %" PRIu64
". Calculate "
621 "total hash size by multiplying \"flow.hash-size\" with %" PRIuMAX
", "
622 "which is the hash bucket size.",
628 FatalError(
"Fatal error encountered in FlowInitConfig. Exiting...");
640 SCLogConfig(
"allocated %"PRIu64
" bytes of memory for the flow hash... "
641 "%" PRIu32
" buckets of size %" PRIuMAX
"",
643 (uintmax_t)
sizeof(FlowBucket));
647 SCLogConfig(
"flow memory usage: %"PRIu64
" bytes, maximum: %"PRIu64,
654 SCLogConfig(
"flow size %u, memcap allows for %" PRIu64
" flows. Per hash row in perfect "
655 "conditions %" PRIu64,
725 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
726 flow_timeouts_normal[(p)].new_timeout = (n); \
727 flow_timeouts_normal[(p)].est_timeout = (e); \
728 flow_timeouts_normal[(p)].closed_timeout = (c); \
729 flow_timeouts_normal[(p)].bypassed_timeout = (b); \
730 flow_timeouts_emerg[(p)].new_timeout = (ne); \
731 flow_timeouts_emerg[(p)].est_timeout = (ee); \
732 flow_timeouts_emerg[(p)].closed_timeout = (ce); \
733 flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
762 const char *
new = NULL;
763 const char *established = NULL;
764 const char *closed = NULL;
765 const char *bypassed = NULL;
766 const char *emergency_new = NULL;
767 const char *emergency_established = NULL;
768 const char *emergency_closed = NULL;
769 const char *emergency_bypassed = NULL;
772 if (flow_timeouts != NULL) {
774 uint32_t configval = 0;
785 "emergency-established");
789 "emergency-bypassed");
796 if (established != NULL &&
802 if (closed != NULL &&
808 if (bypassed != NULL &&
815 if (emergency_new != NULL &&
817 emergency_new) > 0) {
821 if (emergency_established != NULL &&
823 strlen(emergency_established),
824 emergency_established) > 0) {
828 if (emergency_closed != NULL &&
830 strlen(emergency_closed),
831 emergency_closed) > 0) {
835 if (emergency_bypassed != NULL &&
837 strlen(emergency_bypassed),
838 emergency_bypassed) > 0) {
853 "emergency-established");
857 "emergency-bypassed");
864 if (established != NULL &&
870 if (closed != NULL &&
876 if (bypassed != NULL &&
883 if (emergency_new != NULL &&
885 emergency_new) > 0) {
889 if (emergency_established != NULL &&
891 strlen(emergency_established),
892 emergency_established) > 0) {
896 if (emergency_closed != NULL &&
898 strlen(emergency_closed),
899 emergency_closed) > 0) {
903 if (emergency_bypassed != NULL &&
905 strlen(emergency_bypassed),
906 emergency_bypassed) > 0) {
920 "emergency-established");
922 "emergency-bypassed");
929 if (established != NULL &&
935 if (bypassed != NULL &&
942 if (emergency_new != NULL &&
944 emergency_new) > 0) {
948 if (emergency_established != NULL &&
950 strlen(emergency_established),
951 emergency_established) > 0) {
955 if (emergency_bypassed != NULL &&
957 strlen(emergency_bypassed),
958 emergency_bypassed) > 0) {
972 "emergency-established");
974 "emergency-bypassed");
981 if (established != NULL &&
987 if (bypassed != NULL &&
994 if (emergency_new != NULL &&
996 emergency_new) > 0) {
1000 if (emergency_established != NULL &&
1002 strlen(emergency_established),
1003 emergency_established) > 0) {
1007 if (emergency_bypassed != NULL &&
1009 strlen(emergency_bypassed),
1010 emergency_bypassed) > 0) {
1023 SCLogWarning(
"emergency timeout value %u for \'established\' "
1024 "must be below regular value %u",
1030 SCLogWarning(
"emergency timeout value %u for \'new\' must be "
1031 "below regular value %u",
1037 SCLogWarning(
"emergency timeout value %u for \'closed\' must "
1038 "be below regular value %u",
1044 SCLogWarning(
"emergency timeout value %u for \'bypassed\' "
1045 "must be below regular value %u",
1057 SCLogWarning(
"emergency timeout value for \'established\' must be below normal value");
1063 SCLogWarning(
"emergency timeout value for \'new\' must be below normal value");
1069 SCLogWarning(
"emergency timeout value for \'closed\' must be below normal value");
1075 SCLogWarning(
"emergency timeout value for \'bypassed\' must be below normal value");
1080 SCLogDebug(
"deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1139 if (f->
proto != IPPROTO_TCP) {
1146 uint8_t newflags =
flags;
1151 newflags |= STREAM_DEPTH;
1166 const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1175 if (f->
fb != NULL) {
1242 static int FlowTest01 (
void)
1276 static void test(
void *f) {}
1285 static int FlowTest02 (
void)
1307 static int FlowTest07 (
void)
1353 static int FlowTest08 (
void)
1400 static int FlowTest09 (
void)
1447 UtRegisterTest(
"FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1448 UtRegisterTest(
"FlowTest02 -- Setting Protocol Specific Free Function",
1450 UtRegisterTest(
"FlowTest07 -- Test flow Allocations when it reach memcap",
1452 UtRegisterTest(
"FlowTest08 -- Test flow Allocations when it reach memcap",
1454 UtRegisterTest(
"FlowTest09 -- Test flow Allocations when it reach memcap",
#define FLOWFILE_NO_MD5_TS
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
#define FLOWFILE_NO_MD5_TC
#define FBLOCK_DESTROY(fb)
#define FLOW_DEFAULT_NEW_TIMEOUT
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOWFILE_NO_SIZE_TS
#define FLOW_HAS_EXPECTATION
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
#define FLOWFILE_NO_SIZE_TC
void FlowCleanupAppLayer(Flow *f)
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
#define IPV6_GET_RAW_HLIM(ip6h)
uint32_t FlowSpareGetPoolSize(void)
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
#define FLOW_DEFAULT_HASHSIZE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
uint32_t emergency_recovery
#define FLOW_DEFAULT_PREALLOC
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void FlowRegisterTests(void)
Function to register the Flow Unitests.
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_SGH_TOCLIENT
int ParseSizeStringU64(const char *size, uint64_t *res)
#define FLOWFILE_NO_MAGIC_TS
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
#define FLOW_NOPAYLOAD_INSPECTION
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
struct Flow_ Flow
Flow data structure.
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
void BypassedFlowUpdate(Flow *f, Packet *p)
uint32_t bypassed_timeout
#define FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_PKT_TOSERVER
uint64_t FlowGetMemuse(void)
uint64_t FlowGetMemcap(void)
Return memcap value.
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
#define FLOW_TOSERVER_DROP_LOGGED
struct Packet_::@29::@36 icmp_s
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
uint16_t counter_max_mac_addrs_src
enum ExceptionPolicy ExceptionPolicyParse(const char *option, bool support_flow)
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define FLOW_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
void AppLayerExpectationClean(Flow *f)
#define PKT_PROTO_DETECT_TS_DONE
const struct SigGroupHead_ * sgh_toserver
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
AppLayerParserState * alparser
#define FLOWFILE_NO_SHA1_TC
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
void FlowInitConfig(bool quiet)
initialize the configuration
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
@ FLOW_STATE_LOCAL_BYPASSED
#define PASS
Pass the test.
#define FLOWFILE_NO_STORE_TS
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
void MacSetAddWithCtr(MacSet *ms, const uint8_t *src_addr, const uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
#define FLOW_CHANGE_PROTO
Per thread variable structure.
unsigned int FlowStorageSize(void)
#define FLOWFILE_NO_SHA256_TS
#define FLOW_PKT_TOCLIENT_FIRST
FlowQueue * FlowQueueInit(FlowQueue *q)
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
#define SCLogWarning(...)
Macro used to log WARNING messages.
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
#define FLOW_PROTO_DETECT_TC_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
const struct SigGroupHead_ * sgh_toclient
bool MacSetFlowStorageEnabled(void)
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
#define IPV4_GET_RAW_IPTTL(ip4h)
#define FLOW_DEFAULT_MEMCAP
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
#define FLOW_TOSERVER_IPONLY_SET
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
FlowStorageId MacSetGetFlowStorageID(void)
uint32_t probing_parser_toclient_alproto_masks
#define FLOW_PKT_TOCLIENT
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
void FlowUpdateState(Flow *f, const enum FlowState s)
uint32_t probing_parser_toserver_alproto_masks
#define FLOWFILE_NO_SHA256_TC
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
unsigned short FlowStateType
#define FLOWFILE_NO_MAGIC_TC
enum ExceptionPolicy FlowGetMemcapExceptionPolicy(void)
#define FLOW_TOCLIENT_IPONLY_SET
void FlowFree(Flow *f)
cleanup & free the memory of a flow
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
void FlowShutdown(void)
shutdown the flow engine
void FlowSparePoolDestroy(void)
#define SCMallocAligned(size, align)
#define SWAP_VARS(type, a, b)
void FlowTimeoutsInit(void)
#define FLOW_PROTO_DETECT_TS_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
#define PKT_PROTO_DETECT_TC_DONE
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
#define FLOWFILE_NO_STORE_TC
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
void FlowSwap(Flow *f)
swap the flow's direction
enum ExceptionPolicy memcap_policy
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
#define SCTIME_CMP_GT(a, b)
#define FLOWFILE_NO_SHA1_TS
#define SCLogError(...)
Macro used to log ERROR messages.
#define SWAP_FLAGS(flags, a, b)
#define FLOW_SGH_TOSERVER
Structure to hold thread specific data for all decode modules.
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
void FlowFreeStorage(Flow *f)
uint16_t counter_max_mac_addrs_dst
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_PKT_ESTABLISHED
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
int EngineModeIsIPS(void)
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
void FlowSparePoolInit(void)
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_NOPACKET_INSPECTION
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
int8_t data_first_seen_dir
#define FLOW_DIR_REVERSED
#define ICMPV4_IS_ERROR_MSG(type)
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
void RegisterFlowStorageTests(void)
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
#define FLOW_PKT_TOSERVER_FIRST
#define DEBUG_VALIDATE_BUG_ON(exp)
@ PKT_DROP_REASON_FLOW_DROP
FlowThreadId thread_id[2]
int FlowSetMemcap(uint64_t size)
Update memcap value.
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.