Go to the documentation of this file.
70 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
73 #define FLOW_DEFAULT_HASHSIZE 65536
75 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024)
77 #define FLOW_DEFAULT_PREALLOC 10000
145 if (f == NULL || f->
proto == 0)
192 if (f->
proto == IPPROTO_TCP) {
195 if (way == STREAM_TOCLIENT) {
239 static inline void FlowSwapFlags(
Flow *f)
253 static inline void FlowSwapFileFlags(
Flow *f)
263 static inline void TcpStreamFlowSwap(
Flow *f)
289 FlowSwapFileFlags(f);
291 if (f->
proto == IPPROTO_TCP) {
292 TcpStreamFlowSwap(f);
331 }
else if (p->
proto == IPPROTO_ICMP || p->
proto == IPPROTO_ICMPV6) {
351 static inline int FlowUpdateSeenFlag(
const Packet *p)
362 static inline void FlowUpdateTtlTS(
Flow *f,
Packet *p, uint8_t ttl)
372 static inline void FlowUpdateTtlTC(
Flow *f,
Packet *p, uint8_t ttl)
383 Flow *f, EthernetHdr *ethh,
bool toserver)
415 #ifdef CAPTURE_OFFLOAD
418 if (state != FLOW_STATE_CAPTURE_BYPASSED) {
428 #ifdef CAPTURE_OFFLOAD
432 SCLogDebug(
"Downgrading flow to local bypass");
450 if (FlowUpdateSeenFlag(p)) {
460 FlowUpdateEthernet(
tv,
dtv, f, p->
ethh,
true);
472 if (FlowUpdateSeenFlag(p)) {
482 FlowUpdateEthernet(
tv,
dtv, f, p->
ethh,
false);
495 }
else if (f->
proto == IPPROTO_TCP) {
510 SCLogDebug(
"setting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
511 DecodeSetNoPacketInspectionFlag(p);
514 SCLogDebug(
"setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
515 DecodeSetNoPayloadInspectionFlag(p);
563 if (
ConfGetInt(
"flow.emergency-recovery", &val) == 1) {
564 if (val <= 100 && val >= 1) {
567 SCLogError(
"flow.emergency-recovery must be in the range of "
568 "1 and 100 (as percentage)");
572 SCLogDebug(
"flow.emergency-recovery, using default value");
577 const char *conf_val;
578 uint32_t configval = 0;
581 uint64_t flow_memcap_copy = 0;
582 if ((
ConfGet(
"flow.memcap", &conf_val)) == 1)
584 if (conf_val == NULL) {
585 FatalError(
"Invalid value for flow.memcap: NULL");
590 "from conf file - %s. Killing engine",
597 if ((
ConfGet(
"flow.hash-size", &conf_val)) == 1)
599 if (conf_val == NULL) {
600 FatalError(
"Invalid value for flow.hash-size: NULL");
608 if ((
ConfGet(
"flow.prealloc", &conf_val)) == 1)
610 if (conf_val == NULL) {
611 FatalError(
"Invalid value for flow.prealloc: NULL");
622 SCLogDebug(
"Flow config from suricata.yaml: memcap: %"PRIu64
", hash-size: "
630 "max flow memcap is smaller than projected hash size. "
631 "Memcap: %" PRIu64
", Hash table size %" PRIu64
". Calculate "
632 "total hash size by multiplying \"flow.hash-size\" with %" PRIuMAX
", "
633 "which is the hash bucket size.",
639 FatalError(
"Fatal error encountered in FlowInitConfig. Exiting...");
651 SCLogConfig(
"allocated %"PRIu64
" bytes of memory for the flow hash... "
652 "%" PRIu32
" buckets of size %" PRIuMAX
"",
654 (uintmax_t)
sizeof(FlowBucket));
658 SCLogConfig(
"flow memory usage: %"PRIu64
" bytes, maximum: %"PRIu64,
665 SCLogConfig(
"flow size %u, memcap allows for %" PRIu64
" flows. Per hash row in perfect "
666 "conditions %" PRIu64,
737 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
738 flow_timeouts_normal[(p)].new_timeout = (n); \
739 flow_timeouts_normal[(p)].est_timeout = (e); \
740 flow_timeouts_normal[(p)].closed_timeout = (c); \
741 flow_timeouts_normal[(p)].bypassed_timeout = (b); \
742 flow_timeouts_emerg[(p)].new_timeout = (ne); \
743 flow_timeouts_emerg[(p)].est_timeout = (ee); \
744 flow_timeouts_emerg[(p)].closed_timeout = (ce); \
745 flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
774 const char *
new = NULL;
775 const char *established = NULL;
776 const char *closed = NULL;
777 const char *bypassed = NULL;
778 const char *emergency_new = NULL;
779 const char *emergency_established = NULL;
780 const char *emergency_closed = NULL;
781 const char *emergency_bypassed = NULL;
784 if (flow_timeouts != NULL) {
786 uint32_t configval = 0;
797 "emergency-established");
801 "emergency-bypassed");
808 if (established != NULL &&
814 if (closed != NULL &&
820 if (bypassed != NULL &&
827 if (emergency_new != NULL &&
829 emergency_new) > 0) {
833 if (emergency_established != NULL &&
835 strlen(emergency_established),
836 emergency_established) > 0) {
840 if (emergency_closed != NULL &&
842 strlen(emergency_closed),
843 emergency_closed) > 0) {
847 if (emergency_bypassed != NULL &&
849 strlen(emergency_bypassed),
850 emergency_bypassed) > 0) {
865 "emergency-established");
869 "emergency-bypassed");
876 if (established != NULL &&
882 if (closed != NULL &&
888 if (bypassed != NULL &&
895 if (emergency_new != NULL &&
897 emergency_new) > 0) {
901 if (emergency_established != NULL &&
903 strlen(emergency_established),
904 emergency_established) > 0) {
908 if (emergency_closed != NULL &&
910 strlen(emergency_closed),
911 emergency_closed) > 0) {
915 if (emergency_bypassed != NULL &&
917 strlen(emergency_bypassed),
918 emergency_bypassed) > 0) {
932 "emergency-established");
934 "emergency-bypassed");
941 if (established != NULL &&
947 if (bypassed != NULL &&
954 if (emergency_new != NULL &&
956 emergency_new) > 0) {
960 if (emergency_established != NULL &&
962 strlen(emergency_established),
963 emergency_established) > 0) {
967 if (emergency_bypassed != NULL &&
969 strlen(emergency_bypassed),
970 emergency_bypassed) > 0) {
984 "emergency-established");
986 "emergency-bypassed");
993 if (established != NULL &&
999 if (bypassed != NULL &&
1006 if (emergency_new != NULL &&
1008 emergency_new) > 0) {
1012 if (emergency_established != NULL &&
1014 strlen(emergency_established),
1015 emergency_established) > 0) {
1019 if (emergency_bypassed != NULL &&
1021 strlen(emergency_bypassed),
1022 emergency_bypassed) > 0) {
1035 SCLogWarning(
"emergency timeout value %u for \'established\' "
1036 "must be below regular value %u",
1042 SCLogWarning(
"emergency timeout value %u for \'new\' must be "
1043 "below regular value %u",
1049 SCLogWarning(
"emergency timeout value %u for \'closed\' must "
1050 "be below regular value %u",
1056 SCLogWarning(
"emergency timeout value %u for \'bypassed\' "
1057 "must be below regular value %u",
1069 SCLogWarning(
"emergency timeout value for \'established\' must be below normal value");
1075 SCLogWarning(
"emergency timeout value for \'new\' must be below normal value");
1081 SCLogWarning(
"emergency timeout value for \'closed\' must be below normal value");
1087 SCLogWarning(
"emergency timeout value for \'bypassed\' must be below normal value");
1092 SCLogDebug(
"deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1153 if (f->
proto != IPPROTO_TCP) {
1160 uint8_t newflags =
flags;
1165 newflags |= STREAM_DEPTH;
1180 const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1189 if (f->
fb != NULL) {
1256 static int FlowTest01 (
void)
1290 static void test(
void *f) {}
1299 static int FlowTest02 (
void)
1321 static int FlowTest07 (
void)
1367 static int FlowTest08 (
void)
1414 static int FlowTest09 (
void)
1461 UtRegisterTest(
"FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1462 UtRegisterTest(
"FlowTest02 -- Setting Protocol Specific Free Function",
1464 UtRegisterTest(
"FlowTest07 -- Test flow Allocations when it reach memcap",
1466 UtRegisterTest(
"FlowTest08 -- Test flow Allocations when it reach memcap",
1468 UtRegisterTest(
"FlowTest09 -- Test flow Allocations when it reach memcap",
#define FLOWFILE_NO_MD5_TS
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
#define FLOWFILE_NO_MD5_TC
#define FBLOCK_DESTROY(fb)
#define FLOW_DEFAULT_NEW_TIMEOUT
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOWFILE_NO_SIZE_TS
#define FLOW_HAS_EXPECTATION
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
#define FLOWFILE_NO_SIZE_TC
void FlowCleanupAppLayer(Flow *f)
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
uint32_t FlowSpareGetPoolSize(void)
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
void MacSetAddWithCtr(MacSet *ms, uint8_t *src_addr, uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
#define FLOW_DEFAULT_HASHSIZE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
uint32_t emergency_recovery
#define FLOW_DEFAULT_PREALLOC
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void FlowRegisterTests(void)
Function to register the Flow Unitests.
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_SGH_TOCLIENT
int ParseSizeStringU64(const char *size, uint64_t *res)
#define FLOWFILE_NO_MAGIC_TS
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
#define FLOW_NOPAYLOAD_INSPECTION
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
struct Flow_ Flow
Flow data structure.
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
void BypassedFlowUpdate(Flow *f, Packet *p)
uint32_t bypassed_timeout
#define FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_PKT_TOSERVER
uint64_t FlowGetMemuse(void)
uint64_t FlowGetMemcap(void)
Return memcap value.
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
#define FLOW_TOSERVER_DROP_LOGGED
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
uint16_t counter_max_mac_addrs_src
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define FLOW_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
void AppLayerExpectationClean(Flow *f)
#define PKT_PROTO_DETECT_TS_DONE
const struct SigGroupHead_ * sgh_toserver
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
AppLayerParserState * alparser
#define FLOWFILE_NO_SHA1_TC
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
void FlowInitConfig(bool quiet)
initialize the configuration
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
@ FLOW_STATE_LOCAL_BYPASSED
#define PASS
Pass the test.
#define FLOWFILE_NO_STORE_TS
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
#define FLOW_CHANGE_PROTO
Per thread variable structure.
unsigned int FlowStorageSize(void)
#define FLOWFILE_NO_SHA256_TS
#define FLOW_PKT_TOCLIENT_FIRST
FlowQueue * FlowQueueInit(FlowQueue *q)
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
#define SCLogWarning(...)
Macro used to log WARNING messages.
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
#define FLOW_PROTO_DETECT_TC_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
const struct SigGroupHead_ * sgh_toclient
bool MacSetFlowStorageEnabled(void)
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
#define FLOW_DEFAULT_MEMCAP
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
#define FLOW_TOSERVER_IPONLY_SET
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
#define STREAMTCP_STREAM_FLAG_HAS_GAP
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Data structures and function prototypes for keeping state for the detection engine.
FlowStorageId MacSetGetFlowStorageID(void)
uint32_t probing_parser_toclient_alproto_masks
#define FLOW_PKT_TOCLIENT
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
void FlowUpdateState(Flow *f, const enum FlowState s)
uint32_t probing_parser_toserver_alproto_masks
#define FLOWFILE_NO_SHA256_TC
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
unsigned short FlowStateType
enum ExceptionPolicy ExceptionPolicyParse(const char *option, const bool support_flow)
#define FLOWFILE_NO_MAGIC_TC
#define FLOW_TOCLIENT_IPONLY_SET
void FlowFree(Flow *f)
cleanup & free the memory of a flow
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
void FlowShutdown(void)
shutdown the flow engine
void FlowSparePoolDestroy(void)
#define SCMallocAligned(size, align)
#define SWAP_VARS(type, a, b)
void FlowTimeoutsInit(void)
#define FLOW_PROTO_DETECT_TS_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
#define PKT_PROTO_DETECT_TC_DONE
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
#define FLOWFILE_NO_STORE_TC
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
void FlowSwap(Flow *f)
swap the flow's direction
enum ExceptionPolicy memcap_policy
#define ICMPV4_IS_ERROR_MSG(p)
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
#define SCTIME_CMP_GT(a, b)
#define FLOWFILE_NO_SHA1_TS
#define SCLogError(...)
Macro used to log ERROR messages.
#define SWAP_FLAGS(flags, a, b)
#define FLOW_SGH_TOSERVER
Structure to hold thread specific data for all decode modules.
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
void FlowFreeStorage(Flow *f)
uint16_t counter_max_mac_addrs_dst
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_PKT_ESTABLISHED
int EngineModeIsIPS(void)
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
void FlowSparePoolInit(void)
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_NOPACKET_INSPECTION
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
int8_t data_first_seen_dir
bool FlowHasGaps(const Flow *f, uint8_t way)
#define FLOW_DIR_REVERSED
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
void RegisterFlowStorageTests(void)
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
#define FLOW_PKT_TOSERVER_FIRST
#define IPV4_GET_IPTTL(p)
int FlowSetMemcap(uint64_t size)
Update memcap value.
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.