suricata
flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow implementation.
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 #include "decode.h"
29 #include "conf.h"
30 #include "threadvars.h"
31 #include "tm-threads.h"
32 #include "runmodes.h"
33 
34 #include "util-random.h"
35 #include "util-time.h"
36 
37 #include "flow.h"
38 #include "flow-queue.h"
39 #include "flow-hash.h"
40 #include "flow-util.h"
41 #include "flow-var.h"
42 #include "flow-private.h"
43 #include "flow-timeout.h"
44 #include "flow-manager.h"
45 #include "flow-storage.h"
46 #include "flow-bypass.h"
47 #include "flow-spare-pool.h"
48 
49 #include "stream-tcp-private.h"
50 #include "stream-tcp-reassemble.h"
51 #include "stream-tcp.h"
52 
53 #include "util-unittest.h"
54 #include "util-unittest-helper.h"
55 #include "util-byte.h"
56 #include "util-misc.h"
57 #include "util-macset.h"
58 
59 #include "util-debug.h"
60 #include "util-privs.h"
61 #include "util-validate.h"
62 
63 #include "detect.h"
64 #include "detect-engine-state.h"
65 #include "stream.h"
66 
67 #include "app-layer-parser.h"
68 #include "app-layer-expectation.h"
69 
70 #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30
71 
72 //#define FLOW_DEFAULT_HASHSIZE 262144
73 #define FLOW_DEFAULT_HASHSIZE 65536
74 //#define FLOW_DEFAULT_MEMCAP 128 * 1024 * 1024 /* 128 MB */
75 #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32 MB */
76 
77 #define FLOW_DEFAULT_PREALLOC 10000
78 
80 
81 /** atomic int that is used when freeing a flow from the hash. In this
82  * case we walk the hash to find a flow to free. This var records where
83  * we left off in the hash. Without this only the top rows of the hash
84  * are freed. This isn't just about fairness. Under severe pressure, the
85  * hash rows on top would be all freed and the time to find a flow to
86  * free increased with every run. */
87 SC_ATOMIC_DECLARE(unsigned int, flow_prune_idx);
88 
89 /** atomic flags */
90 SC_ATOMIC_DECLARE(unsigned int, flow_flags);
91 
92 /** FlowProto specific timeouts and free/state functions */
93 
98 
100 
101 /** flow memuse counter (atomic), for enforcing memcap limit */
102 SC_ATOMIC_DECLARE(uint64_t, flow_memuse);
103 
104 void FlowRegisterTests(void);
105 void FlowInitFlowProto(void);
106 int FlowSetProtoFreeFunc(uint8_t, void (*Free)(void *));
107 
108 /* Run mode selected at suricata.c */
109 extern int run_mode;
110 
111 /**
112  * \brief Update memcap value
113  *
114  * \param size new memcap value
115  */
116 int FlowSetMemcap(uint64_t size)
117 {
118  if ((uint64_t)SC_ATOMIC_GET(flow_memuse) < size) {
119  SC_ATOMIC_SET(flow_config.memcap, size);
120  return 1;
121  }
122 
123  return 0;
124 }
125 
126 /**
127  * \brief Return memcap value
128  *
129  * \retval memcap value
130  */
131 uint64_t FlowGetMemcap(void)
132 {
133  uint64_t memcapcopy = SC_ATOMIC_GET(flow_config.memcap);
134  return memcapcopy;
135 }
136 
137 uint64_t FlowGetMemuse(void)
138 {
139  uint64_t memusecopy = SC_ATOMIC_GET(flow_memuse);
140  return memusecopy;
141 }
142 
144 {
145  if (f == NULL || f->proto == 0)
146  return;
147 
149  f->alstate = NULL;
150  f->alparser = NULL;
151  return;
152 }
153 
154 /** \brief Set the IPOnly scanned flag for 'direction'.
155  *
156  * \param f Flow to set the flag in
157  * \param direction direction to set the flag in
158  */
159 void FlowSetIPOnlyFlag(Flow *f, int direction)
160 {
161  direction ? (f->flags |= FLOW_TOSERVER_IPONLY_SET) :
163  return;
164 }
165 
166 /** \brief Set flag to indicate that flow has alerts
167  *
168  * \param f flow
169  */
171 {
172  f->flags |= FLOW_HAS_ALERTS;
173 }
174 
175 /** \brief Check if flow has alerts
176  *
177  * \param f flow
178  * \retval 1 has alerts
179  * \retval 0 has not alerts
180  */
181 int FlowHasAlerts(const Flow *f)
182 {
183  if (f->flags & FLOW_HAS_ALERTS) {
184  return 1;
185  }
186 
187  return 0;
188 }
189 
190 bool FlowHasGaps(const Flow *f, uint8_t way)
191 {
192  if (f->proto == IPPROTO_TCP) {
193  TcpSession *ssn = (TcpSession *)f->protoctx;
194  if (ssn != NULL) {
195  if (way == STREAM_TOCLIENT) {
197  return 1;
198  } else {
200  return 1;
201  }
202  }
203  }
204  return 0;
205 }
206 
207 /** \brief Set flag to indicate to change proto for the flow
208  *
209  * \param f flow
210  */
212 {
213  f->flags |= FLOW_CHANGE_PROTO;
214 }
215 
216 /** \brief Unset flag to indicate to change proto for the flow
217  *
218  * \param f flow
219  */
221 {
222  f->flags &= ~FLOW_CHANGE_PROTO;
223 }
224 
225 /** \brief Check if change proto flag is set for flow
226  * \param f flow
227  * \retval 1 change proto flag is set
228  * \retval 0 change proto flag is not set
229  */
231 {
232  if (f->flags & FLOW_CHANGE_PROTO) {
233  return 1;
234  }
235 
236  return 0;
237 }
238 
239 static inline void FlowSwapFlags(Flow *f)
240 {
244 
249 
251 }
252 
253 static inline void FlowSwapFileFlags(Flow *f)
254 {
261 }
262 
263 static inline void TcpStreamFlowSwap(Flow *f)
264 {
265  TcpSession *ssn = f->protoctx;
266  SWAP_VARS(TcpStream, ssn->server, ssn->client);
267  if (ssn->data_first_seen_dir & STREAM_TOSERVER) {
268  ssn->data_first_seen_dir = STREAM_TOCLIENT;
269  } else if (ssn->data_first_seen_dir & STREAM_TOCLIENT) {
270  ssn->data_first_seen_dir = STREAM_TOSERVER;
271  }
272 }
273 
274 /** \brief swap the flow's direction
275  * \note leaves the 'header' untouched. Interpret that based
276  * on FLOW_DIR_REVERSED flag.
277  * \warning: only valid before applayer parsing started. This
278  * function doesn't swap anything in Flow::alparser,
279  * Flow::alstate
280  */
281 void FlowSwap(Flow *f)
282 {
283  f->flags |= FLOW_DIR_REVERSED;
284 
287 
288  FlowSwapFlags(f);
289  FlowSwapFileFlags(f);
290 
291  if (f->proto == IPPROTO_TCP) {
292  TcpStreamFlowSwap(f);
293  }
294 
298 
299  /* not touching Flow::alparser and Flow::alstate */
300 
301  SWAP_VARS(const void *, f->sgh_toclient, f->sgh_toserver);
302 
303  SWAP_VARS(uint32_t, f->todstpktcnt, f->tosrcpktcnt);
304  SWAP_VARS(uint64_t, f->todstbytecnt, f->tosrcbytecnt);
305 }
306 
307 /**
308  * \brief determine the direction of the packet compared to the flow
309  * \retval 0 to_server
310  * \retval 1 to_client
311  */
312 int FlowGetPacketDirection(const Flow *f, const Packet *p)
313 {
314  const int reverse = (f->flags & FLOW_DIR_REVERSED) != 0;
315 
316  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
317  if (!(CMP_PORT(p->sp,p->dp))) {
318  /* update flags and counters */
319  if (CMP_PORT(f->sp,p->sp)) {
320  return TOSERVER ^ reverse;
321  } else {
322  return TOCLIENT ^ reverse;
323  }
324  } else {
325  if (CMP_ADDR(&f->src,&p->src)) {
326  return TOSERVER ^ reverse;
327  } else {
328  return TOCLIENT ^ reverse;
329  }
330  }
331  } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
332  if (CMP_ADDR(&f->src,&p->src)) {
333  return TOSERVER ^ reverse;
334  } else {
335  return TOCLIENT ^ reverse;
336  }
337  }
338 
339  /* default to toserver */
340  return TOSERVER;
341 }
342 
343 /**
344  * \brief Check to update "seen" flags
345  *
346  * \param p packet
347  *
348  * \retval 1 true
349  * \retval 0 false
350  */
351 static inline int FlowUpdateSeenFlag(const Packet *p)
352 {
353  if (PKT_IS_ICMPV4(p)) {
354  if (ICMPV4_IS_ERROR_MSG(p)) {
355  return 0;
356  }
357  }
358 
359  return 1;
360 }
361 
362 static inline void FlowUpdateTtlTS(Flow *f, Packet *p, uint8_t ttl)
363 {
364  if (f->min_ttl_toserver == 0) {
365  f->min_ttl_toserver = ttl;
366  } else {
367  f->min_ttl_toserver = MIN(f->min_ttl_toserver, ttl);
368  }
369  f->max_ttl_toserver = MAX(f->max_ttl_toserver, ttl);
370 }
371 
372 static inline void FlowUpdateTtlTC(Flow *f, Packet *p, uint8_t ttl)
373 {
374  if (f->min_ttl_toclient == 0) {
375  f->min_ttl_toclient = ttl;
376  } else {
377  f->min_ttl_toclient = MIN(f->min_ttl_toclient, ttl);
378  }
379  f->max_ttl_toclient = MAX(f->max_ttl_toclient, ttl);
380 }
381 
382 static inline void FlowUpdateEthernet(ThreadVars *tv, DecodeThreadVars *dtv,
383  Flow *f, EthernetHdr *ethh, bool toserver)
384 {
385  if (ethh && MacSetFlowStorageEnabled()) {
387  if (ms != NULL) {
388  if (toserver) {
389  MacSetAddWithCtr(ms, ethh->eth_src, ethh->eth_dst, tv,
392  } else {
393  MacSetAddWithCtr(ms, ethh->eth_dst, ethh->eth_src, tv,
396  }
397  }
398  }
399 }
400 
401 /** \brief Update Packet and Flow
402  *
403  * Updates packet and flow based on the new packet.
404  *
405  * \param f locked flow
406  * \param p packet
407  *
408  * \note overwrites p::flowflags
409  */
411 {
412  SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f);
413 
414  const int pkt_dir = FlowGetPacketDirection(f, p);
415 #ifdef CAPTURE_OFFLOAD
416  int state = f->flow_state;
417 
418  if (state != FLOW_STATE_CAPTURE_BYPASSED) {
419 #endif
420  /* update the last seen timestamp of this flow */
421  if (SCTIME_CMP_GT(p->ts, f->lastts)) {
422  f->lastts = p->ts;
423  const uint32_t timeout_at = (uint32_t)SCTIME_SECS(f->lastts) + f->timeout_policy;
424  if (timeout_at != f->timeout_at) {
425  f->timeout_at = timeout_at;
426  }
427  }
428 #ifdef CAPTURE_OFFLOAD
429  } else {
430  /* still seeing packet, we downgrade to local bypass */
431  if (SCTIME_SECS(p->ts) - SCTIME_SECS(f->lastts) > FLOW_BYPASSED_TIMEOUT / 2) {
432  SCLogDebug("Downgrading flow to local bypass");
433  f->lastts = p->ts;
435  } else {
436  /* In IPS mode the packet could come from the other interface so it would
437  * need to be bypassed */
438  if (EngineModeIsIPS()) {
439  BypassedFlowUpdate(f, p);
440  }
441  }
442  }
443 #endif
444  /* update flags and counters */
445  if (pkt_dir == TOSERVER) {
446  f->todstpktcnt++;
447  f->todstbytecnt += GET_PKT_LEN(p);
449  if (!(f->flags & FLOW_TO_DST_SEEN)) {
450  if (FlowUpdateSeenFlag(p)) {
451  f->flags |= FLOW_TO_DST_SEEN;
453  }
454  }
455  /* xfer proto detect ts flag to first packet in ts dir */
456  if (f->flags & FLOW_PROTO_DETECT_TS_DONE) {
459  }
460  FlowUpdateEthernet(tv, dtv, f, p->ethh, true);
461  /* update flow's ttl fields if needed */
462  if (PKT_IS_IPV4(p)) {
463  FlowUpdateTtlTS(f, p, IPV4_GET_IPTTL(p));
464  } else if (PKT_IS_IPV6(p)) {
465  FlowUpdateTtlTS(f, p, IPV6_GET_HLIM(p));
466  }
467  } else {
468  f->tosrcpktcnt++;
469  f->tosrcbytecnt += GET_PKT_LEN(p);
471  if (!(f->flags & FLOW_TO_SRC_SEEN)) {
472  if (FlowUpdateSeenFlag(p)) {
473  f->flags |= FLOW_TO_SRC_SEEN;
475  }
476  }
477  /* xfer proto detect tc flag to first packet in tc dir */
478  if (f->flags & FLOW_PROTO_DETECT_TC_DONE) {
481  }
482  FlowUpdateEthernet(tv, dtv, f, p->ethh, false);
483  /* update flow's ttl fields if needed */
484  if (PKT_IS_IPV4(p)) {
485  FlowUpdateTtlTC(f, p, IPV4_GET_IPTTL(p));
486  } else if (PKT_IS_IPV6(p)) {
487  FlowUpdateTtlTC(f, p, IPV6_GET_HLIM(p));
488  }
489  }
490 
492  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
494 
495  } else if (f->proto == IPPROTO_TCP) {
496  TcpSession *ssn = (TcpSession *)f->protoctx;
497  if (ssn != NULL && ssn->state >= TCP_ESTABLISHED) {
499  }
500  } else if ((f->flags & (FLOW_TO_DST_SEEN|FLOW_TO_SRC_SEEN)) ==
502  SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p);
504 
506  }
507 
508  /*set the detection bypass flags*/
509  if (f->flags & FLOW_NOPACKET_INSPECTION) {
510  SCLogDebug("setting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
511  DecodeSetNoPacketInspectionFlag(p);
512  }
513  if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
514  SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
515  DecodeSetNoPayloadInspectionFlag(p);
516  }
517 }
518 
519 /** \brief Entry point for packet flow handling
520  *
521  * This is called for every packet.
522  *
523  * \param tv threadvars
524  * \param dtv decode thread vars (for flow output api thread data)
525  * \param p packet to handle flow for
526  */
528 {
529  /* Get this packet's flow from the hash. FlowHandlePacket() will setup
530  * a new flow if necessary. If we get NULL, we're out of flow memory.
531  * The returned flow is locked. */
532  Flow *f = FlowGetFlowFromHash(tv, fls, p, &p->flow);
533  if (f == NULL)
534  return;
535 
536  /* set the flow in the packet */
537  p->flags |= PKT_HAS_FLOW;
538  return;
539 }
540 
541 /** \brief initialize the configuration
542  * \warning Not thread safe */
543 void FlowInitConfig(bool quiet)
544 {
545  SCLogDebug("initializing flow engine...");
546 
547  memset(&flow_config, 0, sizeof(flow_config));
548  SC_ATOMIC_INIT(flow_flags);
549  SC_ATOMIC_INIT(flow_memuse);
550  SC_ATOMIC_INIT(flow_prune_idx);
551  SC_ATOMIC_INIT(flow_config.memcap);
553 
554  /* set defaults */
555  flow_config.hash_rand = (uint32_t)RandomGet();
559 
560  /* If we have specific config, overwrite the defaults with them,
561  * otherwise, leave the default values */
562  intmax_t val = 0;
563  if (ConfGetInt("flow.emergency-recovery", &val) == 1) {
564  if (val <= 100 && val >= 1) {
565  flow_config.emergency_recovery = (uint8_t)val;
566  } else {
567  SCLogError("flow.emergency-recovery must be in the range of "
568  "1 and 100 (as percentage)");
570  }
571  } else {
572  SCLogDebug("flow.emergency-recovery, using default value");
574  }
575 
576  /* Check if we have memcap and hash_size defined at config */
577  const char *conf_val;
578  uint32_t configval = 0;
579 
580  /** set config values for memcap, prealloc and hash_size */
581  uint64_t flow_memcap_copy = 0;
582  if ((ConfGet("flow.memcap", &conf_val)) == 1)
583  {
584  if (conf_val == NULL) {
585  FatalError("Invalid value for flow.memcap: NULL");
586  }
587 
588  if (ParseSizeStringU64(conf_val, &flow_memcap_copy) < 0) {
589  SCLogError("Error parsing flow.memcap "
590  "from conf file - %s. Killing engine",
591  conf_val);
592  exit(EXIT_FAILURE);
593  } else {
594  SC_ATOMIC_SET(flow_config.memcap, flow_memcap_copy);
595  }
596  }
597  if ((ConfGet("flow.hash-size", &conf_val)) == 1)
598  {
599  if (conf_val == NULL) {
600  FatalError("Invalid value for flow.hash-size: NULL");
601  }
602 
603  if (StringParseUint32(&configval, 10, strlen(conf_val),
604  conf_val) > 0) {
605  flow_config.hash_size = configval;
606  }
607  }
608  if ((ConfGet("flow.prealloc", &conf_val)) == 1)
609  {
610  if (conf_val == NULL) {
611  FatalError("Invalid value for flow.prealloc: NULL");
612  }
613 
614  if (StringParseUint32(&configval, 10, strlen(conf_val),
615  conf_val) > 0) {
616  flow_config.prealloc = configval;
617  }
618  }
619 
620  flow_config.memcap_policy = ExceptionPolicyParse("flow.memcap-policy", false);
621 
622  SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: "
623  "%"PRIu32", prealloc: %"PRIu32, SC_ATOMIC_GET(flow_config.memcap),
625 
626  /* alloc hash memory */
627  uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket);
628  if (!(FLOW_CHECK_MEMCAP(hash_size))) {
629  SCLogError("allocating flow hash failed: "
630  "max flow memcap is smaller than projected hash size. "
631  "Memcap: %" PRIu64 ", Hash table size %" PRIu64 ". Calculate "
632  "total hash size by multiplying \"flow.hash-size\" with %" PRIuMAX ", "
633  "which is the hash bucket size.",
634  SC_ATOMIC_GET(flow_config.memcap), hash_size, (uintmax_t)sizeof(FlowBucket));
635  exit(EXIT_FAILURE);
636  }
637  flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS);
638  if (unlikely(flow_hash == NULL)) {
639  FatalError("Fatal error encountered in FlowInitConfig. Exiting...");
640  }
641  memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket));
642 
643  uint32_t i = 0;
644  for (i = 0; i < flow_config.hash_size; i++) {
645  FBLOCK_INIT(&flow_hash[i]);
646  SC_ATOMIC_INIT(flow_hash[i].next_ts);
647  }
648  (void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket)));
649 
650  if (!quiet) {
651  SCLogConfig("allocated %"PRIu64" bytes of memory for the flow hash... "
652  "%" PRIu32 " buckets of size %" PRIuMAX "",
653  SC_ATOMIC_GET(flow_memuse), flow_config.hash_size,
654  (uintmax_t)sizeof(FlowBucket));
655  }
657  if (!quiet) {
658  SCLogConfig("flow memory usage: %"PRIu64" bytes, maximum: %"PRIu64,
659  SC_ATOMIC_GET(flow_memuse), SC_ATOMIC_GET(flow_config.memcap));
660  }
661 
663 
664  uint32_t sz = sizeof(Flow) + FlowStorageSize();
665  SCLogConfig("flow size %u, memcap allows for %" PRIu64 " flows. Per hash row in perfect "
666  "conditions %" PRIu64,
667  sz, flow_memcap_copy / sz, (flow_memcap_copy / sz) / flow_config.hash_size);
668  return;
669 }
670 
671 void FlowReset(void)
672 {
673  // resets the flows (for reuse by fuzzing)
674  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
675  Flow *f = flow_hash[u].head;
676  while (f) {
677  Flow *n = f->next;
678  uint8_t proto_map = FlowGetProtoMapping(f->proto);
679  FlowClearMemory(f, proto_map);
680  FlowFree(f);
681  f = n;
682  }
683  flow_hash[u].head = NULL;
684  }
685 }
686 
687 /** \brief shutdown the flow engine
688  * \warning Not thread safe */
689 void FlowShutdown(void)
690 {
691  Flow *f;
692  while ((f = FlowDequeue(&flow_recycle_q))) {
693  FlowFree(f);
694  }
695 
696  /* clear and free the hash */
697  if (flow_hash != NULL) {
698  /* clean up flow mutexes */
699  for (uint32_t u = 0; u < flow_config.hash_size; u++) {
700  f = flow_hash[u].head;
701  while (f) {
702  Flow *n = f->next;
703  uint8_t proto_map = FlowGetProtoMapping(f->proto);
704  FlowClearMemory(f, proto_map);
705  FlowFree(f);
706  f = n;
707  }
708  f = flow_hash[u].evicted;
709  while (f) {
710  Flow *n = f->next;
711  uint8_t proto_map = FlowGetProtoMapping(f->proto);
712  FlowClearMemory(f, proto_map);
713  FlowFree(f);
714  f = n;
715  }
716 
718  }
720  flow_hash = NULL;
721  }
722  (void) SC_ATOMIC_SUB(flow_memuse, flow_config.hash_size * sizeof(FlowBucket));
725  return;
726 }
727 
728 /**
729  * \brief Function to set the default timeout, free function and flow state
730  * function for all supported flow_proto.
731  */
732 
734 {
736 
737 #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \
738  flow_timeouts_normal[(p)].new_timeout = (n); \
739  flow_timeouts_normal[(p)].est_timeout = (e); \
740  flow_timeouts_normal[(p)].closed_timeout = (c); \
741  flow_timeouts_normal[(p)].bypassed_timeout = (b); \
742  flow_timeouts_emerg[(p)].new_timeout = (ne); \
743  flow_timeouts_emerg[(p)].est_timeout = (ee); \
744  flow_timeouts_emerg[(p)].closed_timeout = (ce); \
745  flow_timeouts_emerg[(p)].bypassed_timeout = (be); \
746 
767 
772 
773  /* Let's see if we have custom timeouts defined from config */
774  const char *new = NULL;
775  const char *established = NULL;
776  const char *closed = NULL;
777  const char *bypassed = NULL;
778  const char *emergency_new = NULL;
779  const char *emergency_established = NULL;
780  const char *emergency_closed = NULL;
781  const char *emergency_bypassed = NULL;
782 
783  ConfNode *flow_timeouts = ConfGetNode("flow-timeouts");
784  if (flow_timeouts != NULL) {
785  ConfNode *proto = NULL;
786  uint32_t configval = 0;
787 
788  /* Defaults. */
789  proto = ConfNodeLookupChild(flow_timeouts, "default");
790  if (proto != NULL) {
791  new = ConfNodeLookupChildValue(proto, "new");
792  established = ConfNodeLookupChildValue(proto, "established");
793  closed = ConfNodeLookupChildValue(proto, "closed");
794  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
795  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
796  emergency_established = ConfNodeLookupChildValue(proto,
797  "emergency-established");
798  emergency_closed = ConfNodeLookupChildValue(proto,
799  "emergency-closed");
800  emergency_bypassed = ConfNodeLookupChildValue(proto,
801  "emergency-bypassed");
802 
803  if (new != NULL &&
804  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
805 
807  }
808  if (established != NULL &&
809  StringParseUint32(&configval, 10, strlen(established),
810  established) > 0) {
811 
813  }
814  if (closed != NULL &&
815  StringParseUint32(&configval, 10, strlen(closed),
816  closed) > 0) {
817 
819  }
820  if (bypassed != NULL &&
821  StringParseUint32(&configval, 10,
822  strlen(bypassed),
823  bypassed) > 0) {
824 
826  }
827  if (emergency_new != NULL &&
828  StringParseUint32(&configval, 10, strlen(emergency_new),
829  emergency_new) > 0) {
830 
832  }
833  if (emergency_established != NULL &&
834  StringParseUint32(&configval, 10,
835  strlen(emergency_established),
836  emergency_established) > 0) {
837 
839  }
840  if (emergency_closed != NULL &&
841  StringParseUint32(&configval, 10,
842  strlen(emergency_closed),
843  emergency_closed) > 0) {
844 
846  }
847  if (emergency_bypassed != NULL &&
848  StringParseUint32(&configval, 10,
849  strlen(emergency_bypassed),
850  emergency_bypassed) > 0) {
851 
853  }
854  }
855 
856  /* TCP. */
857  proto = ConfNodeLookupChild(flow_timeouts, "tcp");
858  if (proto != NULL) {
859  new = ConfNodeLookupChildValue(proto, "new");
860  established = ConfNodeLookupChildValue(proto, "established");
861  closed = ConfNodeLookupChildValue(proto, "closed");
862  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
863  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
864  emergency_established = ConfNodeLookupChildValue(proto,
865  "emergency-established");
866  emergency_closed = ConfNodeLookupChildValue(proto,
867  "emergency-closed");
868  emergency_bypassed = ConfNodeLookupChildValue(proto,
869  "emergency-bypassed");
870 
871  if (new != NULL &&
872  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
873 
875  }
876  if (established != NULL &&
877  StringParseUint32(&configval, 10, strlen(established),
878  established) > 0) {
879 
881  }
882  if (closed != NULL &&
883  StringParseUint32(&configval, 10, strlen(closed),
884  closed) > 0) {
885 
887  }
888  if (bypassed != NULL &&
889  StringParseUint32(&configval, 10,
890  strlen(bypassed),
891  bypassed) > 0) {
892 
894  }
895  if (emergency_new != NULL &&
896  StringParseUint32(&configval, 10, strlen(emergency_new),
897  emergency_new) > 0) {
898 
900  }
901  if (emergency_established != NULL &&
902  StringParseUint32(&configval, 10,
903  strlen(emergency_established),
904  emergency_established) > 0) {
905 
907  }
908  if (emergency_closed != NULL &&
909  StringParseUint32(&configval, 10,
910  strlen(emergency_closed),
911  emergency_closed) > 0) {
912 
914  }
915  if (emergency_bypassed != NULL &&
916  StringParseUint32(&configval, 10,
917  strlen(emergency_bypassed),
918  emergency_bypassed) > 0) {
919 
921  }
922  }
923 
924  /* UDP. */
925  proto = ConfNodeLookupChild(flow_timeouts, "udp");
926  if (proto != NULL) {
927  new = ConfNodeLookupChildValue(proto, "new");
928  established = ConfNodeLookupChildValue(proto, "established");
929  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
930  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
931  emergency_established = ConfNodeLookupChildValue(proto,
932  "emergency-established");
933  emergency_bypassed = ConfNodeLookupChildValue(proto,
934  "emergency-bypassed");
935 
936  if (new != NULL &&
937  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
938 
940  }
941  if (established != NULL &&
942  StringParseUint32(&configval, 10, strlen(established),
943  established) > 0) {
944 
946  }
947  if (bypassed != NULL &&
948  StringParseUint32(&configval, 10,
949  strlen(bypassed),
950  bypassed) > 0) {
951 
953  }
954  if (emergency_new != NULL &&
955  StringParseUint32(&configval, 10, strlen(emergency_new),
956  emergency_new) > 0) {
957 
959  }
960  if (emergency_established != NULL &&
961  StringParseUint32(&configval, 10,
962  strlen(emergency_established),
963  emergency_established) > 0) {
964 
966  }
967  if (emergency_bypassed != NULL &&
968  StringParseUint32(&configval, 10,
969  strlen(emergency_bypassed),
970  emergency_bypassed) > 0) {
971 
973  }
974  }
975 
976  /* ICMP. */
977  proto = ConfNodeLookupChild(flow_timeouts, "icmp");
978  if (proto != NULL) {
979  new = ConfNodeLookupChildValue(proto, "new");
980  established = ConfNodeLookupChildValue(proto, "established");
981  bypassed = ConfNodeLookupChildValue(proto, "bypassed");
982  emergency_new = ConfNodeLookupChildValue(proto, "emergency-new");
983  emergency_established = ConfNodeLookupChildValue(proto,
984  "emergency-established");
985  emergency_bypassed = ConfNodeLookupChildValue(proto,
986  "emergency-bypassed");
987 
988  if (new != NULL &&
989  StringParseUint32(&configval, 10, strlen(new), new) > 0) {
990 
992  }
993  if (established != NULL &&
994  StringParseUint32(&configval, 10, strlen(established),
995  established) > 0) {
996 
998  }
999  if (bypassed != NULL &&
1000  StringParseUint32(&configval, 10,
1001  strlen(bypassed),
1002  bypassed) > 0) {
1003 
1005  }
1006  if (emergency_new != NULL &&
1007  StringParseUint32(&configval, 10, strlen(emergency_new),
1008  emergency_new) > 0) {
1009 
1011  }
1012  if (emergency_established != NULL &&
1013  StringParseUint32(&configval, 10,
1014  strlen(emergency_established),
1015  emergency_established) > 0) {
1016 
1018  }
1019  if (emergency_bypassed != NULL &&
1020  StringParseUint32(&configval, 10,
1021  strlen(emergency_bypassed),
1022  emergency_bypassed) > 0) {
1023 
1025  }
1026  }
1027  }
1028 
1029  /* validate and if needed update emergency timeout values */
1030  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
1031  const FlowProtoTimeout *n = &flow_timeouts_normal[i];
1033 
1034  if (e->est_timeout > n->est_timeout) {
1035  SCLogWarning("emergency timeout value %u for \'established\' "
1036  "must be below regular value %u",
1037  e->est_timeout, n->est_timeout);
1038  e->est_timeout = n->est_timeout / 10;
1039  }
1040 
1041  if (e->new_timeout > n->new_timeout) {
1042  SCLogWarning("emergency timeout value %u for \'new\' must be "
1043  "below regular value %u",
1044  e->new_timeout, n->new_timeout);
1045  e->new_timeout = n->new_timeout / 10;
1046  }
1047 
1048  if (e->closed_timeout > n->closed_timeout) {
1049  SCLogWarning("emergency timeout value %u for \'closed\' must "
1050  "be below regular value %u",
1052  e->closed_timeout = n->closed_timeout / 10;
1053  }
1054 
1055  if (e->bypassed_timeout > n->bypassed_timeout) {
1056  SCLogWarning("emergency timeout value %u for \'bypassed\' "
1057  "must be below regular value %u",
1059  e->bypassed_timeout = n->bypassed_timeout / 10;
1060  }
1061  }
1062 
1063  for (int i = 0; i < FLOW_PROTO_MAX; i++) {
1067 
1068  if (e->est_timeout > n->est_timeout) {
1069  SCLogWarning("emergency timeout value for \'established\' must be below normal value");
1070  e->est_timeout = n->est_timeout / 10;
1071  }
1072  d->est_timeout = n->est_timeout - e->est_timeout;
1073 
1074  if (e->new_timeout > n->new_timeout) {
1075  SCLogWarning("emergency timeout value for \'new\' must be below normal value");
1076  e->new_timeout = n->new_timeout / 10;
1077  }
1078  d->new_timeout = n->new_timeout - e->new_timeout;
1079 
1080  if (e->closed_timeout > n->closed_timeout) {
1081  SCLogWarning("emergency timeout value for \'closed\' must be below normal value");
1082  e->closed_timeout = n->closed_timeout / 10;
1083  }
1085 
1086  if (e->bypassed_timeout > n->bypassed_timeout) {
1087  SCLogWarning("emergency timeout value for \'bypassed\' must be below normal value");
1088  e->bypassed_timeout = n->bypassed_timeout / 10;
1089  }
1091 
1092  SCLogDebug("deltas: new: -%u est: -%u closed: -%u bypassed: -%u",
1094  }
1095 
1096  return;
1097 }
1098 
1099 /**
1100  * \brief Function clear the flow memory before queueing it to spare flow
1101  * queue.
1102  *
1103  * \param f pointer to the flow needed to be cleared.
1104  * \param proto_map mapped value of the protocol to FLOW_PROTO's.
1105  */
1106 
1107 int FlowClearMemory(Flow* f, uint8_t proto_map)
1108 {
1109  SCEnter();
1110 
1111  if (unlikely(f->flags & FLOW_HAS_EXPECTATION)) {
1113  }
1114 
1115  /* call the protocol specific free function if we have one */
1116  if (flow_freefuncs[proto_map].Freefunc != NULL) {
1117  flow_freefuncs[proto_map].Freefunc(f->protoctx);
1118  }
1119 
1120  FlowFreeStorage(f);
1121 
1122  FLOW_RECYCLE(f);
1123 
1124  SCReturnInt(1);
1125 }
1126 
1127 /**
1128  * \brief Function to set the function to get protocol specific flow state.
1129  *
1130  * \param proto protocol of which function is needed to be set.
1131  * \param Free Function pointer which will be called to free the protocol
1132  * specific memory.
1133  */
1134 
1135 int FlowSetProtoFreeFunc (uint8_t proto, void (*Free)(void *))
1136 {
1137  uint8_t proto_map;
1138  proto_map = FlowGetProtoMapping(proto);
1139 
1140  flow_freefuncs[proto_map].Freefunc = Free;
1141  return 1;
1142 }
1143 
1144 /**
1145  * \brief get 'disruption' flags: GAP/DEPTH/PASS
1146  * \param f locked flow
1147  * \param flags existing flags to be amended
1148  * \retval flags original flags + disrupt flags (if any)
1149  * \TODO handle UDP
1150  */
1151 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
1152 {
1153  if (f->proto != IPPROTO_TCP) {
1154  return flags;
1155  }
1156  if (f->protoctx == NULL) {
1157  return flags;
1158  }
1159 
1160  uint8_t newflags = flags;
1161  TcpSession *ssn = f->protoctx;
1162  TcpStream *stream = flags & STREAM_TOSERVER ? &ssn->client : &ssn->server;
1163 
1165  newflags |= STREAM_DEPTH;
1166  }
1167  /* todo: handle pass case (also for UDP!) */
1168 
1169  return newflags;
1170 }
1171 
1172 void FlowUpdateState(Flow *f, const enum FlowState s)
1173 {
1174  if (s != f->flow_state) {
1175  /* set the state */
1176  // Explicit cast from the enum type to the compact version
1177  f->flow_state = (FlowStateType)s;
1178 
1179  /* update timeout policy and value */
1180  const uint32_t timeout_policy = FlowGetTimeoutPolicy(f);
1181  if (timeout_policy != f->timeout_policy) {
1182  f->timeout_policy = timeout_policy;
1183  const uint32_t timeout_at = (uint32_t)SCTIME_SECS(f->lastts) + timeout_policy;
1184  if (timeout_at != f->timeout_at)
1185  f->timeout_at = timeout_at;
1186  }
1187  }
1188 #ifdef UNITTESTS
1189  if (f->fb != NULL) {
1190 #endif
1191  /* and reset the flow bucket next_ts value so that the flow manager
1192  * has to revisit this row */
1193  SC_ATOMIC_SET(f->fb->next_ts, 0);
1194 #ifdef UNITTESTS
1195  }
1196 #endif
1197 }
1198 
1199 /**
1200  * \brief Get flow last time as individual values.
1201  *
1202  * Instead of returning a pointer to the timeval copy the timeval
1203  * parts into output pointers to make it simpler to call from Rust
1204  * over FFI using only basic data types.
1205  */
1206 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
1207 {
1208  *secs = (uint64_t)SCTIME_SECS(flow->lastts);
1209  *usecs = (uint64_t)SCTIME_USECS(flow->lastts);
1210 }
1211 
1212 /**
1213  * \brief Get flow source port.
1214  *
1215  * A function to get the flow sport useful when the caller only has an
1216  * opaque pointer to the flow structure.
1217  */
1218 uint16_t FlowGetSourcePort(Flow *flow)
1219 {
1220  return flow->sp;
1221 }
1222 
1223 /**
1224  * \brief Get flow destination port.
1225  *
1226  * A function to get the flow dport useful when the caller only has an
1227  * opaque pointer to the flow structure.
1228  */
1229 
1231 {
1232  return flow->dp;
1233 }
1234 /**
1235  * \brief Get flow flags.
1236  *
1237  * A function to get the flow flags useful when the caller only has an
1238  * opaque pointer to the flow structure.
1239  */
1240 
1241 uint32_t FlowGetFlags(Flow *flow)
1242 {
1243  return flow->flags;
1244 }
1245 /************************************Unittests*******************************/
1246 
1247 #ifdef UNITTESTS
1248 #include "threads.h"
1249 
1250 /**
1251  * \test Test the setting of the per protocol timeouts.
1252  *
1253  * \retval On success it returns 1 and on failure 0.
1254  */
1255 
1256 static int FlowTest01 (void)
1257 {
1258  uint8_t proto_map;
1259 
1261  proto_map = FlowGetProtoMapping(IPPROTO_TCP);
1262  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_TCP_NEW_TIMEOUT);
1263  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_TCP_EST_TIMEOUT);
1266 
1267  proto_map = FlowGetProtoMapping(IPPROTO_UDP);
1268  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_UDP_NEW_TIMEOUT);
1269  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_UDP_EST_TIMEOUT);
1272 
1273  proto_map = FlowGetProtoMapping(IPPROTO_ICMP);
1274  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_ICMP_NEW_TIMEOUT);
1275  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_ICMP_EST_TIMEOUT);
1278 
1279  proto_map = FlowGetProtoMapping(IPPROTO_DCCP);
1280  FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_DEFAULT_NEW_TIMEOUT);
1281  FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_DEFAULT_EST_TIMEOUT);
1282  FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_DEFAULT_EMERG_NEW_TIMEOUT);
1283  FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_DEFAULT_EMERG_EST_TIMEOUT);
1284 
1285  PASS;
1286 }
1287 
1288 /*Test function for the unit test FlowTest02*/
1289 
1290 static void test(void *f) {}
1291 
1292 /**
1293  * \test Test the setting of the per protocol free function to free the
1294  * protocol specific memory.
1295  *
1296  * \retval On success it returns 1 and on failure 0.
1297  */
1298 
1299 static int FlowTest02 (void)
1300 {
1302  FlowSetProtoFreeFunc(IPPROTO_TCP, test);
1303  FlowSetProtoFreeFunc(IPPROTO_UDP, test);
1304  FlowSetProtoFreeFunc(IPPROTO_ICMP, test);
1305 
1306  FAIL_IF(flow_freefuncs[FLOW_PROTO_DEFAULT].Freefunc != test);
1307  FAIL_IF(flow_freefuncs[FLOW_PROTO_TCP].Freefunc != test);
1308  FAIL_IF(flow_freefuncs[FLOW_PROTO_UDP].Freefunc != test);
1309  FAIL_IF(flow_freefuncs[FLOW_PROTO_ICMP].Freefunc != test);
1310 
1311  PASS;
1312 }
1313 
1314 /**
1315  * \test Test flow allocations when it reach memcap
1316  *
1317  *
1318  * \retval On success it returns 1 and on failure 0.
1319  */
1320 
1321 static int FlowTest07 (void)
1322 {
1323  int result = 0;
1325  FlowConfig backup;
1326  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1327 
1328  uint32_t ini = 0;
1329  uint32_t end = FlowSpareGetPoolSize();
1330  SC_ATOMIC_SET(flow_config.memcap, 10000);
1331  flow_config.prealloc = 100;
1332 
1333  /* Let's get the flow spare pool empty */
1334  UTHBuildPacketOfFlows(ini, end, 0);
1335 
1336  /* And now let's try to reach the memcap val */
1337  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1338  ini = end + 1;
1339  end = end + 2;
1340  UTHBuildPacketOfFlows(ini, end, 0);
1341  }
1342 
1343  /* should time out normal */
1344  TimeSetIncrementTime(2000);
1345  ini = end + 1;
1346  end = end + 2;
1347  UTHBuildPacketOfFlows(ini, end, 0);
1348 
1349  /* This means that the engine entered emerg mode: should happen as easy
1350  * with flow mgr activated */
1351  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1352  result = 1;
1353 
1354  FlowShutdown();
1355  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1356 
1357  return result;
1358 }
1359 
1360 /**
1361  * \test Test flow allocations when it reach memcap
1362  *
1363  *
1364  * \retval On success it returns 1 and on failure 0.
1365  */
1366 
1367 static int FlowTest08 (void)
1368 {
1369  int result = 0;
1370 
1372  FlowConfig backup;
1373  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1374 
1375  uint32_t ini = 0;
1376  uint32_t end = FlowSpareGetPoolSize();
1377  SC_ATOMIC_SET(flow_config.memcap, 10000);
1378  flow_config.prealloc = 100;
1379 
1380  /* Let's get the flow spare pool empty */
1381  UTHBuildPacketOfFlows(ini, end, 0);
1382 
1383  /* And now let's try to reach the memcap val */
1384  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1385  ini = end + 1;
1386  end = end + 2;
1387  UTHBuildPacketOfFlows(ini, end, 0);
1388  }
1389 
1390  /* By default we use 30 for timing out new flows. This means
1391  * that the Emergency mode should be set */
1393  ini = end + 1;
1394  end = end + 2;
1395  UTHBuildPacketOfFlows(ini, end, 0);
1396 
1397  /* This means that the engine released 5 flows by emergency timeout */
1398  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1399  result = 1;
1400 
1401  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1402  FlowShutdown();
1403 
1404  return result;
1405 }
1406 
1407 /**
1408  * \test Test flow allocations when it reach memcap
1409  *
1410  *
1411  * \retval On success it returns 1 and on failure 0.
1412  */
1413 
1414 static int FlowTest09 (void)
1415 {
1416  int result = 0;
1417 
1419  FlowConfig backup;
1420  memcpy(&backup, &flow_config, sizeof(FlowConfig));
1421 
1422  uint32_t ini = 0;
1423  uint32_t end = FlowSpareGetPoolSize();
1424  SC_ATOMIC_SET(flow_config.memcap, 10000);
1425  flow_config.prealloc = 100;
1426 
1427  /* Let's get the flow spare pool empty */
1428  UTHBuildPacketOfFlows(ini, end, 0);
1429 
1430  /* And now let's try to reach the memcap val */
1431  while (FLOW_CHECK_MEMCAP(sizeof(Flow))) {
1432  ini = end + 1;
1433  end = end + 2;
1434  UTHBuildPacketOfFlows(ini, end, 0);
1435  }
1436 
1437  /* No timeout will work */
1439  ini = end + 1;
1440  end = end + 2;
1441  UTHBuildPacketOfFlows(ini, end, 0);
1442 
1443  /* engine in emerg mode */
1444  if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)
1445  result = 1;
1446 
1447  memcpy(&flow_config, &backup, sizeof(FlowConfig));
1448  FlowShutdown();
1449 
1450  return result;
1451 }
1452 
1453 #endif /* UNITTESTS */
1454 
1455 /**
1456  * \brief Function to register the Flow Unitests.
1457  */
1459 {
1460 #ifdef UNITTESTS
1461  UtRegisterTest("FlowTest01 -- Protocol Specific Timeouts", FlowTest01);
1462  UtRegisterTest("FlowTest02 -- Setting Protocol Specific Free Function",
1463  FlowTest02);
1464  UtRegisterTest("FlowTest07 -- Test flow Allocations when it reach memcap",
1465  FlowTest07);
1466  UtRegisterTest("FlowTest08 -- Test flow Allocations when it reach memcap",
1467  FlowTest08);
1468  UtRegisterTest("FlowTest09 -- Test flow Allocations when it reach memcap",
1469  FlowTest09);
1470 
1472 #endif /* UNITTESTS */
1473 }
FLOWFILE_NO_MD5_TS
#define FLOWFILE_NO_MD5_TS
Definition: flow.h:127
util-byte.h
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:220
FLOWFILE_NO_MD5_TC
#define FLOWFILE_NO_MD5_TC
Definition: flow.h:128
FBLOCK_DESTROY
#define FBLOCK_DESTROY(fb)
Definition: flow-hash.h:72
FLOW_DEFAULT_NEW_TIMEOUT
#define FLOW_DEFAULT_NEW_TIMEOUT
Definition: flow-private.h:40
tm-threads.h
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:71
ConfGetInt
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:397
Packet_::proto
uint8_t proto
Definition: decode.h:451
FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT
Definition: flow-private.h:56
TcpStream_
Definition: stream-tcp-private.h:106
FLOWFILE_NO_SIZE_TS
#define FLOWFILE_NO_SIZE_TS
Definition: flow.h:139
flow-bypass.h
FLOW_HAS_EXPECTATION
#define FLOW_HAS_EXPECTATION
Definition: flow.h:110
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *f)
Set flag to indicate that flow has alerts.
Definition: flow.c:170
FLOWFILE_NO_SIZE_TC
#define FLOWFILE_NO_SIZE_TC
Definition: flow.h:140
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:143
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *f)
Set flag to indicate to change proto for the flow.
Definition: flow.c:211
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1007
FlowSpareGetPoolSize
uint32_t FlowSpareGetPoolSize(void)
Definition: flow-spare-pool.c:47
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:312
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:492
flow-util.h
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:315
FBLOCK_INIT
#define FBLOCK_INIT(fb)
Definition: flow-hash.h:71
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:247
CLS
#define CLS
Definition: suricata-common.h:59
stream-tcp.h
MacSetAddWithCtr
void MacSetAddWithCtr(MacSet *ms, uint8_t *src_addr, uint8_t *dst_addr, ThreadVars *tv, uint16_t ctr_src, uint16_t ctr_dst)
Definition: util-macset.c:179
FLOW_DEFAULT_HASHSIZE
#define FLOW_DEFAULT_HASHSIZE
Definition: flow.c:73
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts)
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:290
FLOW_DEFAULT_PREALLOC
#define FLOW_DEFAULT_PREALLOC
Definition: flow.c:77
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:284
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1458
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:60
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:71
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:595
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:198
Flow_::proto
uint8_t proto
Definition: flow.h:365
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:120
Packet_::flags
uint32_t flags
Definition: decode.h:464
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
threads.h
util-macset.h
FlowGetFlags
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
Definition: flow.c:1241
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:343
run_mode
int run_mode
Definition: suricata.c:173
FLOW_PROTO_ICMP
@ FLOW_PROTO_ICMP
Definition: flow-private.h:70
FLOW_PROTO_TCP
@ FLOW_PROTO_TCP
Definition: flow-private.h:68
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:333
FlowProtoTimeout_
Definition: flow.h:505
flow-hash.h
FlowGetSourcePort
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
Definition: flow.c:1218
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:63
FLOW_TS_PM_ALPROTO_DETECT_DONE
#define FLOW_TS_PM_ALPROTO_DETECT_DONE
Definition: flow.h:82
FlowReset
void FlowReset(void)
Definition: flow.c:671
FlowLookupStruct_
Definition: flow.h:529
FLOW_DEFAULT_EMERG_NEW_TIMEOUT
#define FLOW_DEFAULT_EMERG_NEW_TIMEOUT
Definition: flow-private.h:54
Flow
struct Flow_ Flow
Flow data structure.
FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:57
BypassedFlowUpdate
void BypassedFlowUpdate(Flow *f, Packet *p)
Definition: flow-bypass.c:204
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:509
FLOW_DEFAULT_EST_TIMEOUT
#define FLOW_DEFAULT_EST_TIMEOUT
Definition: flow-private.h:41
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:218
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:155
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:137
MIN
#define MIN(x, y)
Definition: suricata-common.h:386
IPPROTO_DCCP
#define IPPROTO_DCCP
Definition: decode.h:927
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:131
FlowQueueDestroy
void FlowQueueDestroy(FlowQueue *q)
Destroy a flow queue.
Definition: flow-queue.c:60
util-privs.h
FlowHandlePacket
void FlowHandlePacket(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
Entry point for packet flow handling.
Definition: flow.c:527
stream-tcp-reassemble.h
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
FLOW_PROTO_UDP
@ FLOW_PROTO_UDP
Definition: flow-private.h:69
RandomGet
long int RandomGet(void)
Definition: util-random.c:130
FLOW_TOSERVER_DROP_LOGGED
#define FLOW_TOSERVER_DROP_LOGGED
Definition: flow.h:74
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:460
proto
uint8_t proto
Definition: decode-template.h:0
Flow_::dp
Port dp
Definition: flow.h:359
FLOW_TC_PE_ALPROTO_DETECT_DONE
#define FLOW_TC_PE_ALPROTO_DETECT_DONE
Definition: flow.h:92
FLOW_DEFAULT_BYPASSED_TIMEOUT
#define FLOW_DEFAULT_BYPASSED_TIMEOUT
Definition: flow-private.h:42
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:460
MAX
#define MAX(x, y)
Definition: suricata-common.h:390
Flow_::protoctx
void * protoctx
Definition: flow.h:433
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:674
FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT
Definition: flow-private.h:49
STREAMTCP_STREAM_FLAG_DEPTH_REACHED
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
Definition: stream-tcp-private.h:223
util-unittest.h
FLOW_BYPASSED_TIMEOUT
#define FLOW_BYPASSED_TIMEOUT
Definition: flow-private.h:65
util-unittest-helper.h
FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_CLOSED_TIMEOUT
Definition: flow-private.h:59
FLOW_IPPROTO_ICMP_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EST_TIMEOUT
Definition: flow-private.h:51
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:285
UTHBuildPacketOfFlows
uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir)
Definition: util-unittest-helper.c:892
AppLayerExpectationClean
void AppLayerExpectationClean(Flow *f)
Definition: app-layer-expectation.c:361
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:404
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1040
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:475
FlowGetDestinationPort
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
Definition: flow.c:1230
FLOW_CHECK_MEMCAP
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
Definition: flow-util.h:142
FLOW_RECYCLE
#define FLOW_RECYCLE(f)
macro to recycle a flow before it goes into the spare queue for reuse.
Definition: flow-util.h:81
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:487
flow-spare-pool.h
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:467
FLOWFILE_NO_SHA1_TC
#define FLOWFILE_NO_SHA1_TC
Definition: flow.h:132
FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT
Definition: flow-private.h:63
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:543
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:480
app-layer-expectation.h
FLOW_IPPROTO_UDP_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EST_TIMEOUT
Definition: flow-private.h:48
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:494
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:459
decode.h
util-debug.h
TOSERVER
#define TOSERVER
Definition: flow.h:43
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
Packet_::ts
SCTime_t ts
Definition: decode.h:472
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:484
FLOWFILE_NO_STORE_TS
#define FLOWFILE_NO_STORE_TS
Definition: flow.h:124
FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
#define FLOW_IPPROTO_TCP_CLOSED_TIMEOUT
Definition: flow-private.h:45
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:410
Flow_::lastts
SCTime_t lastts
Definition: flow.h:402
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
FLOW_CHANGE_PROTO
#define FLOW_CHANGE_PROTO
Definition: flow.h:104
Packet_::ethh
EthernetHdr * ethh
Definition: decode.h:525
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
FlowStorageSize
unsigned int FlowStorageSize(void)
Definition: flow-storage.c:35
Packet_::sp
Port sp
Definition: decode.h:436
FlowCnf_
Definition: flow.h:282
FLOWFILE_NO_SHA256_TS
#define FLOWFILE_NO_SHA256_TS
Definition: flow.h:135
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:224
FlowQueueInit
FlowQueue * FlowQueueInit(FlowQueue *q)
Definition: flow-queue.c:46
FlowState
FlowState
Definition: flow.h:490
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:285
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:506
StringParseUint32
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:313
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:508
util-time.h
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
app-layer-parser.h
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1653
FLOW_PROTO_DETECT_TC_DONE
#define FLOW_PROTO_DETECT_TC_DONE
Definition: flow.h:101
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:486
FLOW_TC_PP_ALPROTO_DETECT_DONE
#define FLOW_TC_PP_ALPROTO_DETECT_DONE
Definition: flow.h:90
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:472
MacSetFlowStorageEnabled
bool MacSetFlowStorageEnabled(void)
Definition: util-macset.c:84
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:342
stream.h
TimeSetIncrementTime
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
Definition: util-time.c:180
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:98
Packet_
Definition: decode.h:429
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
FLOW_DEFAULT_MEMCAP
#define FLOW_DEFAULT_MEMCAP
Definition: flow.c:75
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:219
stream-tcp-private.h
MacSet_
Definition: util-macset.c:44
conf.h
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:159
FLOW_TOSERVER_IPONLY_SET
#define FLOW_TOSERVER_IPONLY_SET
Definition: flow.h:56
FLOW_IPPROTO_TCP_NEW_TIMEOUT
#define FLOW_IPPROTO_TCP_NEW_TIMEOUT
Definition: flow-private.h:43
STREAMTCP_STREAM_FLAG_HAS_GAP
#define STREAMTCP_STREAM_FLAG_HAS_GAP
Definition: stream-tcp-private.h:217
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:513
FlowClearMemory
int FlowClearMemory(Flow *f, uint8_t proto_map)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1107
flow_timeouts_delta
FlowProtoTimeout flow_timeouts_delta[FLOW_PROTO_MAX]
Definition: flow.c:96
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:283
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
flow-timeout.h
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:461
MacSetGetFlowStorageID
FlowStorageId MacSetGetFlowStorageID(void)
Definition: util-macset.c:113
flow-queue.h
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:411
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:219
runmodes.h
FLOW_TO_DST_SEEN
#define FLOW_TO_DST_SEEN
Definition: flow.h:51
FlowGetStorageById
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
Definition: flow-storage.c:40
FlowUpdateState
void FlowUpdateState(Flow *f, const enum FlowState s)
Definition: flow.c:1172
Flow_::src
FlowAddress src
Definition: flow.h:346
Flow_::next
struct Flow_ * next
Definition: flow.h:388
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:410
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
FLOWFILE_NO_SHA256_TC
#define FLOWFILE_NO_SHA256_TC
Definition: flow.h:136
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:784
flow_hash
FlowBucket * flow_hash
Definition: flow-hash.c:57
FlowDequeue
Flow * FlowDequeue(FlowQueue *q)
remove a flow from the queue
Definition: flow-queue.c:191
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:74
FLOW_TO_SRC_SEEN
#define FLOW_TO_SRC_SEEN
Definition: flow.h:49
flow-storage.h
FLOW_TS_PE_ALPROTO_DETECT_DONE
#define FLOW_TS_PE_ALPROTO_DETECT_DONE
Definition: flow.h:86
Packet_::flow
struct Flow_ * flow
Definition: decode.h:466
FLOW_IPPROTO_UDP_NEW_TIMEOUT
#define FLOW_IPPROTO_UDP_NEW_TIMEOUT
Definition: flow-private.h:47
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1135
FLOW_IPPROTO_ICMP_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_NEW_TIMEOUT
Definition: flow-private.h:50
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
flow_timeouts_normal
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow.c:94
CMP_ADDR
#define CMP_ADDR(a1, a2)
Definition: decode.h:234
FlowStateType
unsigned short FlowStateType
Definition: flow.h:319
ExceptionPolicyParse
enum ExceptionPolicy ExceptionPolicyParse(const char *option, const bool support_flow)
Definition: util-exception-policy.c:148
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:121
flags
uint8_t flags
Definition: decode-gre.h:0
FLOW_TOCLIENT_IPONLY_SET
#define FLOW_TOCLIENT_IPONLY_SET
Definition: flow.h:58
flow-manager.h
suricata-common.h
FlowFree
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:83
flow_config
FlowConfig flow_config
Definition: flow.c:99
FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT
Definition: flow-private.h:46
FLOW_HAS_ALERTS
#define FLOW_HAS_ALERTS
Definition: flow.h:79
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:689
FlowSparePoolDestroy
void FlowSparePoolDestroy(void)
Definition: flow-spare-pool.c:312
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
SWAP_VARS
#define SWAP_VARS(type, a, b)
Definition: suricata-common.h:423
FlowTimeoutsInit
void FlowTimeoutsInit(void)
Definition: flow-manager.c:100
SCTIME_SECS
#define SCTIME_SECS(t)
Definition: util-time.h:57
FLOW_PROTO_DETECT_TS_DONE
#define FLOW_PROTO_DETECT_TS_DONE
Definition: flow.h:100
FatalError
#define FatalError(...)
Definition: util-debug.h:502
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:462
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:295
FLOW_TS_PP_ALPROTO_DETECT_DONE
#define FLOW_TS_PP_ALPROTO_DETECT_DONE
Definition: flow.h:84
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1041
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1206
FLOWFILE_NO_STORE_TC
#define FLOWFILE_NO_STORE_TC
Definition: flow.h:125
FlowGetFlowFromHash
Flow * FlowGetFlowFromHash(ThreadVars *tv, FlowLookupStruct *fls, Packet *p, Flow **dest)
Get Flow for packet.
Definition: flow-hash.c:801
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:397
FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT
Definition: flow-private.h:58
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
PKT_IS_ICMPV4
#define PKT_IS_ICMPV4(p)
Definition: decode.h:250
threadvars.h
util-validate.h
FlowSwap
void FlowSwap(Flow *f)
swap the flow's direction
Definition: flow.c:281
FlowCnf_::memcap_policy
enum ExceptionPolicy memcap_policy
Definition: flow.h:292
ICMPV4_IS_ERROR_MSG
#define ICMPV4_IS_ERROR_MSG(p)
Definition: decode-icmpv4.h:284
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FlowInitFlowProto
void FlowInitFlowProto(void)
Function to set the default timeout, free function and flow state function for all supported flow_pro...
Definition: flow.c:733
SCTIME_CMP_GT
#define SCTIME_CMP_GT(a, b)
Definition: util-time.h:89
FLOWFILE_NO_SHA1_TS
#define FLOWFILE_NO_SHA1_TS
Definition: flow.h:131
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:294
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
flow_recycle_q
FlowQueue flow_recycle_q
Definition: flow-manager.c:81
SWAP_FLAGS
#define SWAP_FLAGS(flags, a, b)
Definition: suricata-common.h:412
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:69
CMP_PORT
#define CMP_PORT(p1, p2)
Definition: decode.h:239
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:665
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:443
ConfNode_
Definition: conf.h:32
Flow_::alstate
void * alstate
Definition: flow.h:468
flow_freefuncs
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
Definition: flow.c:97
flow_timeouts_emerg
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow.c:95
Flow_::flags
uint32_t flags
Definition: flow.h:413
FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
#define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT
Definition: flow-private.h:61
FlowFreeStorage
void FlowFreeStorage(Flow *f)
Definition: flow-storage.c:60
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:675
FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
#define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT
Definition: flow-private.h:62
FLOW_TOCLIENT_DROP_LOGGED
#define FLOW_TOCLIENT_DROP_LOGGED
Definition: flow.h:76
util-random.h
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:220
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:222
FLOW_EMERGENCY
#define FLOW_EMERGENCY
Definition: flow-private.h:37
suricata.h
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:41
FLOW_TC_PM_ALPROTO_DETECT_DONE
#define FLOW_TC_PM_ALPROTO_DETECT_DONE
Definition: flow.h:88
FLOW_DEFAULT_EMERGENCY_RECOVERY
#define FLOW_DEFAULT_EMERGENCY_RECOVERY
Definition: flow.c:70
FlowHasAlerts
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:181
FlowSparePoolInit
void FlowSparePoolInit(void)
Definition: flow-spare-pool.c:293
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:935
FLOW_DEFAULT_EMERG_EST_TIMEOUT
#define FLOW_DEFAULT_EMERG_EST_TIMEOUT
Definition: flow-private.h:55
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:61
FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
#define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT
Definition: flow-private.h:52
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:507
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:230
Flow_::sp
Port sp
Definition: flow.h:348
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1151
TcpSession_
Definition: stream-tcp-private.h:283
util-misc.h
TcpSession_::data_first_seen_dir
int8_t data_first_seen_dir
Definition: stream-tcp-private.h:288
FlowHasGaps
bool FlowHasGaps(const Flow *f, uint8_t way)
Definition: flow.c:190
flow.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:444
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:415
Packet_::dp
Port dp
Definition: decode.h:444
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:108
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:383
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
FLOW_IPPROTO_TCP_EST_TIMEOUT
#define FLOW_IPPROTO_TCP_EST_TIMEOUT
Definition: flow-private.h:44
RegisterFlowStorageTests
void RegisterFlowStorageTests(void)
Definition: flow-storage.c:295
SET_DEFAULTS
#define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be)
flow-var.h
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:246
TOCLIENT
#define TOCLIENT
Definition: flow.h:44
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:223
Packet_::src
Address src
Definition: decode.h:433
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:485
IPV4_GET_IPTTL
#define IPV4_GET_IPTTL(p)
Definition: decode-ipv4.h:146
SCTIME_USECS
#define SCTIME_USECS(t)
Definition: util-time.h:56
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:116
FlowProtoFreeFunc_
Definition: flow.h:512
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:812