suricata
flow.h File Reference
#include "decode.h"
#include "util-var.h"
#include "util-atomic.h"
#include "util-device.h"
#include "detect-tag.h"
#include "util-macset.h"
#include "util-optimize.h"
#include "flow-queue.h"
Include dependency graph for flow.h:

Go to the source code of this file.

Data Structures

struct  FlowCnf_
 
struct  FlowKey_
 
struct  FlowAddress_
 
struct  Flow_
 Flow data structure. More...
 
struct  FlowProtoTimeout_
 
struct  FlowProtoFreeFunc_
 
struct  FlowBypassInfo_
 
struct  FlowLookupStruct_
 

Macros

#define FLOW_QUIET   TRUE
 
#define FLOW_VERBOSE   FALSE
 
#define TOSERVER   0
 
#define TOCLIENT   1
 
#define FLOW_TO_SRC_SEEN   BIT_U32(0)
 
#define FLOW_TO_DST_SEEN   BIT_U32(1)
 
#define FLOW_TCP_REUSED   BIT_U32(2)
 
#define FLOW_TOSERVER_IPONLY_SET   BIT_U32(3)
 
#define FLOW_TOCLIENT_IPONLY_SET   BIT_U32(4)
 
#define FLOW_NOPACKET_INSPECTION   BIT_U32(5)
 
#define FLOW_NOPAYLOAD_INSPECTION   BIT_U32(6)
 
#define FLOW_ACTION_DROP   BIT_U32(7)
 
#define FLOW_SGH_TOSERVER   BIT_U32(8)
 
#define FLOW_SGH_TOCLIENT   BIT_U32(9)
 
#define FLOW_TOSERVER_DROP_LOGGED   BIT_U32(10)
 
#define FLOW_TOCLIENT_DROP_LOGGED   BIT_U32(11)
 
#define FLOW_HAS_ALERTS   BIT_U32(12)
 
#define FLOW_TS_PM_ALPROTO_DETECT_DONE   BIT_U32(13)
 
#define FLOW_TS_PP_ALPROTO_DETECT_DONE   BIT_U32(14)
 
#define FLOW_TS_PE_ALPROTO_DETECT_DONE   BIT_U32(15)
 
#define FLOW_TC_PM_ALPROTO_DETECT_DONE   BIT_U32(16)
 
#define FLOW_TC_PP_ALPROTO_DETECT_DONE   BIT_U32(17)
 
#define FLOW_TC_PE_ALPROTO_DETECT_DONE   BIT_U32(18)
 
#define FLOW_TIMEOUT_REASSEMBLY_DONE   BIT_U32(19)
 
#define FLOW_IPV4   BIT_U32(20)
 
#define FLOW_IPV6   BIT_U32(21)
 
#define FLOW_PROTO_DETECT_TS_DONE   BIT_U32(22)
 
#define FLOW_PROTO_DETECT_TC_DONE   BIT_U32(23)
 
#define FLOW_CHANGE_PROTO   BIT_U32(24)
 
#define FLOW_WRONG_THREAD   BIT_U32(25)
 
#define FLOW_DIR_REVERSED   BIT_U32(26)
 
#define FLOW_HAS_EXPECTATION   BIT_U32(27)
 
#define FLOWFILE_INIT   0
 
#define FLOWFILE_NO_MAGIC_TS   BIT_U16(0)
 
#define FLOWFILE_NO_MAGIC_TC   BIT_U16(1)
 
#define FLOWFILE_NO_STORE_TS   BIT_U16(2)
 
#define FLOWFILE_NO_STORE_TC   BIT_U16(3)
 
#define FLOWFILE_NO_MD5_TS   BIT_U16(4)
 
#define FLOWFILE_NO_MD5_TC   BIT_U16(5)
 
#define FLOWFILE_NO_SHA1_TS   BIT_U16(6)
 
#define FLOWFILE_NO_SHA1_TC   BIT_U16(7)
 
#define FLOWFILE_NO_SHA256_TS   BIT_U16(8)
 
#define FLOWFILE_NO_SHA256_TC   BIT_U16(9)
 
#define FLOWFILE_NO_SIZE_TS   BIT_U16(10)
 
#define FLOWFILE_NO_SIZE_TC   BIT_U16(11)
 
#define FLOWFILE_NONE_TS
 
#define FLOWFILE_NONE_TC
 
#define FLOWFILE_NONE   (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC)
 
#define FLOW_IS_IPV4(f)   (((f)->flags & FLOW_IPV4) == FLOW_IPV4)
 
#define FLOW_IS_IPV6(f)   (((f)->flags & FLOW_IPV6) == FLOW_IPV6)
 
#define FLOW_GET_SP(f)   ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;
 
#define FLOW_GET_DP(f)   ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;
 
#define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa)
 
#define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa)
 
#define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a)
 
#define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a)
 
#define FLOW_CLEAR_ADDR(a)
 
#define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a)
 
#define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a)
 
#define FLOW_PKT_TOSERVER   0x01
 
#define FLOW_PKT_TOCLIENT   0x02
 
#define FLOW_PKT_ESTABLISHED   0x04
 
#define FLOW_PKT_TOSERVER_IPONLY_SET   0x08
 
#define FLOW_PKT_TOCLIENT_IPONLY_SET   0x10
 
#define FLOW_PKT_TOSERVER_FIRST   0x20
 
#define FLOW_PKT_TOCLIENT_FIRST   0x40
 
#define FLOW_PKT_LAST_PSEUDO   0x80
 
#define FLOW_END_FLAG_STATE_NEW   0x01
 
#define FLOW_END_FLAG_STATE_ESTABLISHED   0x02
 
#define FLOW_END_FLAG_STATE_CLOSED   0x04
 
#define FLOW_END_FLAG_EMERGENCY   0x08
 
#define FLOW_END_FLAG_TIMEOUT   0x10
 
#define FLOW_END_FLAG_FORCED   0x20
 
#define FLOW_END_FLAG_SHUTDOWN   0x40
 
#define FLOW_END_FLAG_STATE_BYPASSED   0x80
 
#define FLOWLOCK_MUTEX
 
#define FLOWLOCK_INIT(fb)   SCMutexInit(&(fb)->m, NULL)
 
#define FLOWLOCK_DESTROY(fb)   SCMutexDestroy(&(fb)->m)
 
#define FLOWLOCK_RDLOCK(fb)   SCMutexLock(&(fb)->m)
 
#define FLOWLOCK_WRLOCK(fb)   SCMutexLock(&(fb)->m)
 
#define FLOWLOCK_TRYRDLOCK(fb)   SCMutexTrylock(&(fb)->m)
 
#define FLOWLOCK_TRYWRLOCK(fb)   SCMutexTrylock(&(fb)->m)
 
#define FLOWLOCK_UNLOCK(fb)   SCMutexUnlock(&(fb)->m)
 
#define FLOW_IS_PM_DONE(f, dir)   (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))
 
#define FLOW_IS_PP_DONE(f, dir)   (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))
 
#define FLOW_IS_PE_DONE(f, dir)   (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))
 
#define FLOW_SET_PM_DONE(f, dir)   (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE))
 
#define FLOW_SET_PP_DONE(f, dir)   (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE))
 
#define FLOW_SET_PE_DONE(f, dir)   (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PE_ALPROTO_DETECT_DONE))
 
#define FLOW_RESET_PM_DONE(f, dir)   (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))
 
#define FLOW_RESET_PP_DONE(f, dir)   (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))
 
#define FLOW_RESET_PE_DONE(f, dir)   (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))
 
#define addr_data32   address.address_un_data32
 
#define addr_data16   address.address_un_data16
 
#define addr_data8   address.address_un_data8
 

Typedefs

typedef struct AppLayerParserState_ AppLayerParserState
 
typedef struct FlowCnf_ FlowConfig
 
typedef struct FlowKey_ FlowKey
 
typedef struct FlowAddress_ FlowAddress
 
typedef unsigned short FlowRefCount
 
typedef unsigned short FlowStateType
 
typedef uint16_t FlowThreadId
 
typedef struct Flow_ Flow
 Flow data structure. More...
 
typedef struct FlowProtoTimeout_ FlowProtoTimeout
 
typedef struct FlowProtoFreeFunc_ FlowProtoFreeFunc
 
typedef struct FlowBypassInfo_ FlowBypassInfo
 
typedef struct FlowLookupStruct_ FlowLookupStruct
 

Enumerations

enum  FlowState { FLOW_STATE_NEW = 0, FLOW_STATE_ESTABLISHED, FLOW_STATE_CLOSED, FLOW_STATE_LOCAL_BYPASSED }
 

Functions

void FlowSetupPacket (Packet *p)
 prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow lookup and calc the hash value to be used in the lookup and autofp flow balancing. More...
 
void FlowHandlePacket (ThreadVars *, FlowLookupStruct *, Packet *)
 Entry point for packet flow handling. More...
 
void FlowInitConfig (char)
 initialize the configuration More...
 
void FlowPrintQueueInfo (void)
 
void FlowShutdown (void)
 shutdown the flow engine More...
 
void FlowSetIPOnlyFlag (Flow *, int)
 Set the IPOnly scanned flag for 'direction'. More...
 
void FlowSetHasAlertsFlag (Flow *)
 Set flag to indicate that flow has alerts. More...
 
int FlowHasAlerts (const Flow *)
 Check if flow has alerts. More...
 
void FlowSetChangeProtoFlag (Flow *)
 Set flag to indicate to change proto for the flow. More...
 
void FlowUnsetChangeProtoFlag (Flow *)
 Unset flag to indicate to change proto for the flow. More...
 
int FlowChangeProto (Flow *)
 Check if change proto flag is set for flow. More...
 
void FlowSwap (Flow *)
 swap the flow's direction More...
 
void FlowRegisterTests (void)
 Function to register the Flow Unitests. More...
 
int FlowSetProtoTimeout (uint8_t, uint32_t, uint32_t, uint32_t)
 
int FlowSetProtoEmergencyTimeout (uint8_t, uint32_t, uint32_t, uint32_t)
 
int FlowSetProtoFreeFunc (uint8_t, void(*Free)(void *))
 Function to set the function to get protocol specific flow state. More...
 
void FlowUpdateQueue (Flow *)
 
int FlowUpdateSpareFlows (void)
 
int FlowGetPacketDirection (const Flow *, const Packet *)
 determine the direction of the packet compared to the flow More...
 
void FlowCleanupAppLayer (Flow *)
 
void FlowUpdateState (Flow *f, enum FlowState s)
 
int FlowSetMemcap (uint64_t size)
 Update memcap value. More...
 
uint64_t FlowGetMemcap (void)
 Return memcap value. More...
 
uint64_t FlowGetMemuse (void)
 
int GetFlowBypassInfoID (void)
 
void RegisterFlowBypassInfo (void)
 
void FlowGetLastTimeAsParts (Flow *flow, uint64_t *secs, uint64_t *usecs)
 Get flow last time as individual values. More...
 
int FlowClearMemory (Flow *, uint8_t)
 Function clear the flow memory before queueing it to spare flow queue. More...
 
AppProto FlowGetAppProtocol (const Flow *f)
 
void * FlowGetAppState (const Flow *f)
 
uint8_t FlowGetDisruptionFlags (const Flow *f, uint8_t flags)
 get 'disruption' flags: GAP/DEPTH/PASS More...
 
void FlowHandlePacketUpdate (Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
 Update Packet and Flow. More...
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file flow.h.

Macro Definition Documentation

◆ addr_data16

#define addr_data16   address.address_un_data16

Definition at line 319 of file flow.h.

◆ addr_data32

#define addr_data32   address.address_un_data32

Definition at line 318 of file flow.h.

◆ addr_data8

#define addr_data8   address.address_un_data8

Definition at line 320 of file flow.h.

◆ FLOW_ACTION_DROP

#define FLOW_ACTION_DROP   BIT_U32(7)

All packets in this flow should be dropped

Definition at line 66 of file flow.h.

◆ FLOW_CHANGE_PROTO

#define FLOW_CHANGE_PROTO   BIT_U32(24)

Indicate that alproto detection for flow should be done again

Definition at line 104 of file flow.h.

◆ FLOW_CLEAR_ADDR

#define FLOW_CLEAR_ADDR (   a)
Value:
do { \
(a)->addr_data32[0] = 0; \
(a)->addr_data32[1] = 0; \
(a)->addr_data32[2] = 0; \
(a)->addr_data32[3] = 0; \
} while (0)

Definition at line 196 of file flow.h.

◆ FLOW_COPY_IPV4_ADDR_TO_PACKET

#define FLOW_COPY_IPV4_ADDR_TO_PACKET (   fa,
  pa 
)
Value:
do { \
(pa)->family = AF_INET; \
(pa)->addr_data32[0] = (fa)->addr_data32[0]; \
} while (0)

Definition at line 163 of file flow.h.

◆ FLOW_COPY_IPV6_ADDR_TO_PACKET

#define FLOW_COPY_IPV6_ADDR_TO_PACKET (   fa,
  pa 
)
Value:
do { \
(pa)->family = AF_INET6; \
(pa)->addr_data32[0] = (fa)->addr_data32[0]; \
(pa)->addr_data32[1] = (fa)->addr_data32[1]; \
(pa)->addr_data32[2] = (fa)->addr_data32[2]; \
(pa)->addr_data32[3] = (fa)->addr_data32[3]; \
} while (0)

Definition at line 168 of file flow.h.

◆ FLOW_DIR_REVERSED

#define FLOW_DIR_REVERSED   BIT_U32(26)

Protocol detection told us flow is picked up in wrong direction (midstream)

Definition at line 108 of file flow.h.

◆ FLOW_END_FLAG_EMERGENCY

#define FLOW_END_FLAG_EMERGENCY   0x08

Definition at line 234 of file flow.h.

◆ FLOW_END_FLAG_FORCED

#define FLOW_END_FLAG_FORCED   0x20

Definition at line 236 of file flow.h.

◆ FLOW_END_FLAG_SHUTDOWN

#define FLOW_END_FLAG_SHUTDOWN   0x40

Definition at line 237 of file flow.h.

◆ FLOW_END_FLAG_STATE_BYPASSED

#define FLOW_END_FLAG_STATE_BYPASSED   0x80

Definition at line 238 of file flow.h.

◆ FLOW_END_FLAG_STATE_CLOSED

#define FLOW_END_FLAG_STATE_CLOSED   0x04

Definition at line 233 of file flow.h.

◆ FLOW_END_FLAG_STATE_ESTABLISHED

#define FLOW_END_FLAG_STATE_ESTABLISHED   0x02

Definition at line 232 of file flow.h.

◆ FLOW_END_FLAG_STATE_NEW

#define FLOW_END_FLAG_STATE_NEW   0x01

Definition at line 231 of file flow.h.

◆ FLOW_END_FLAG_TIMEOUT

#define FLOW_END_FLAG_TIMEOUT   0x10

Definition at line 235 of file flow.h.

◆ FLOW_GET_DP

#define FLOW_GET_DP (   f)    ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;

Definition at line 160 of file flow.h.

◆ FLOW_GET_SP

#define FLOW_GET_SP (   f)    ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;

Definition at line 158 of file flow.h.

◆ FLOW_HAS_ALERTS

#define FLOW_HAS_ALERTS   BIT_U32(12)

flow has alerts

Definition at line 79 of file flow.h.

◆ FLOW_HAS_EXPECTATION

#define FLOW_HAS_EXPECTATION   BIT_U32(27)

Indicate that the flow did trigger an expectation creation

Definition at line 110 of file flow.h.

◆ FLOW_IPV4

#define FLOW_IPV4   BIT_U32(20)

flow is ipv4

Definition at line 96 of file flow.h.

◆ FLOW_IPV6

#define FLOW_IPV6   BIT_U32(21)

flow is ipv6

Definition at line 98 of file flow.h.

◆ FLOW_IS_IPV4

#define FLOW_IS_IPV4 (   f)    (((f)->flags & FLOW_IPV4) == FLOW_IPV4)

Definition at line 153 of file flow.h.

◆ FLOW_IS_IPV6

#define FLOW_IS_IPV6 (   f)    (((f)->flags & FLOW_IPV6) == FLOW_IPV6)

Definition at line 155 of file flow.h.

◆ FLOW_IS_PE_DONE

#define FLOW_IS_PE_DONE (   f,
  dir 
)    (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))

Definition at line 272 of file flow.h.

◆ FLOW_IS_PM_DONE

#define FLOW_IS_PM_DONE (   f,
  dir 
)    (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))

Definition at line 270 of file flow.h.

◆ FLOW_IS_PP_DONE

#define FLOW_IS_PP_DONE (   f,
  dir 
)    (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))

Definition at line 271 of file flow.h.

◆ FLOW_NOPACKET_INSPECTION

#define FLOW_NOPACKET_INSPECTION   BIT_U32(5)

Packet belonging to this flow should not be inspected at all

Definition at line 61 of file flow.h.

◆ FLOW_NOPAYLOAD_INSPECTION

#define FLOW_NOPAYLOAD_INSPECTION   BIT_U32(6)

Packet payloads belonging to this flow should not be inspected

Definition at line 63 of file flow.h.

◆ FLOW_PKT_ESTABLISHED

#define FLOW_PKT_ESTABLISHED   0x04

Definition at line 222 of file flow.h.

◆ FLOW_PKT_LAST_PSEUDO

#define FLOW_PKT_LAST_PSEUDO   0x80

last pseudo packet in the flow. Can be used to trigger final clean, logging, etc.

Definition at line 229 of file flow.h.

◆ FLOW_PKT_TOCLIENT

#define FLOW_PKT_TOCLIENT   0x02

Definition at line 221 of file flow.h.

◆ FLOW_PKT_TOCLIENT_FIRST

#define FLOW_PKT_TOCLIENT_FIRST   0x40

Definition at line 226 of file flow.h.

◆ FLOW_PKT_TOCLIENT_IPONLY_SET

#define FLOW_PKT_TOCLIENT_IPONLY_SET   0x10

Definition at line 224 of file flow.h.

◆ FLOW_PKT_TOSERVER

#define FLOW_PKT_TOSERVER   0x01

Definition at line 220 of file flow.h.

◆ FLOW_PKT_TOSERVER_FIRST

#define FLOW_PKT_TOSERVER_FIRST   0x20

Definition at line 225 of file flow.h.

◆ FLOW_PKT_TOSERVER_IPONLY_SET

#define FLOW_PKT_TOSERVER_IPONLY_SET   0x08

Definition at line 223 of file flow.h.

◆ FLOW_PROTO_DETECT_TC_DONE

#define FLOW_PROTO_DETECT_TC_DONE   BIT_U32(23)

Definition at line 101 of file flow.h.

◆ FLOW_PROTO_DETECT_TS_DONE

#define FLOW_PROTO_DETECT_TS_DONE   BIT_U32(22)

Definition at line 100 of file flow.h.

◆ FLOW_QUIET

#define FLOW_QUIET   TRUE

Definition at line 40 of file flow.h.

◆ FLOW_RESET_PE_DONE

#define FLOW_RESET_PE_DONE (   f,
  dir 
)    (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))

Definition at line 280 of file flow.h.

◆ FLOW_RESET_PM_DONE

#define FLOW_RESET_PM_DONE (   f,
  dir 
)    (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))

Definition at line 278 of file flow.h.

◆ FLOW_RESET_PP_DONE

#define FLOW_RESET_PP_DONE (   f,
  dir 
)    (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))

Definition at line 279 of file flow.h.

◆ FLOW_SET_IPV4_DST_ADDR_FROM_PACKET

#define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET (   p,
 
)
Value:
do { \
(a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
(a)->addr_data32[1] = 0; \
(a)->addr_data32[2] = 0; \
(a)->addr_data32[3] = 0; \
} while (0)

Definition at line 188 of file flow.h.

◆ FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET

#define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET (   p,
 
)
Value:
do { \
(a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
(a)->addr_data32[1] = 0; \
(a)->addr_data32[2] = 0; \
(a)->addr_data32[3] = 0; \
} while (0)

Definition at line 181 of file flow.h.

◆ FLOW_SET_IPV6_DST_ADDR_FROM_PACKET

#define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET (   p,
 
)
Value:
do { \
(a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
(a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
(a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
(a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
} while (0)

Definition at line 212 of file flow.h.

◆ FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET

#define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET (   p,
 
)
Value:
do { \
(a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
(a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
(a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
(a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
} while (0)

Definition at line 205 of file flow.h.

◆ FLOW_SET_PE_DONE

#define FLOW_SET_PE_DONE (   f,
  dir 
)    (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PE_ALPROTO_DETECT_DONE))

Definition at line 276 of file flow.h.

◆ FLOW_SET_PM_DONE

#define FLOW_SET_PM_DONE (   f,
  dir 
)    (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE))

Definition at line 274 of file flow.h.

◆ FLOW_SET_PP_DONE

#define FLOW_SET_PP_DONE (   f,
  dir 
)    (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE))

Definition at line 275 of file flow.h.

◆ FLOW_SGH_TOCLIENT

#define FLOW_SGH_TOCLIENT   BIT_U32(9)

Sgh for toclient direction set (even if it's NULL)

Definition at line 71 of file flow.h.

◆ FLOW_SGH_TOSERVER

#define FLOW_SGH_TOSERVER   BIT_U32(8)

Sgh for toserver direction set (even if it's NULL)

Definition at line 69 of file flow.h.

◆ FLOW_TC_PE_ALPROTO_DETECT_DONE

#define FLOW_TC_PE_ALPROTO_DETECT_DONE   BIT_U32(18)

Expectation alproto detection done

Definition at line 92 of file flow.h.

◆ FLOW_TC_PM_ALPROTO_DETECT_DONE

#define FLOW_TC_PM_ALPROTO_DETECT_DONE   BIT_U32(16)

Pattern matcher alproto detection done

Definition at line 88 of file flow.h.

◆ FLOW_TC_PP_ALPROTO_DETECT_DONE

#define FLOW_TC_PP_ALPROTO_DETECT_DONE   BIT_U32(17)

Probing parser alproto detection done

Definition at line 90 of file flow.h.

◆ FLOW_TCP_REUSED

#define FLOW_TCP_REUSED   BIT_U32(2)

Don't return this from the flow hash. It has been replaced.

Definition at line 53 of file flow.h.

◆ FLOW_TIMEOUT_REASSEMBLY_DONE

#define FLOW_TIMEOUT_REASSEMBLY_DONE   BIT_U32(19)

Definition at line 93 of file flow.h.

◆ FLOW_TO_DST_SEEN

#define FLOW_TO_DST_SEEN   BIT_U32(1)

At least one packet from the destination address was seen

Definition at line 51 of file flow.h.

◆ FLOW_TO_SRC_SEEN

#define FLOW_TO_SRC_SEEN   BIT_U32(0)

At least one packet from the source address was seen

Definition at line 49 of file flow.h.

◆ FLOW_TOCLIENT_DROP_LOGGED

#define FLOW_TOCLIENT_DROP_LOGGED   BIT_U32(11)

packet to client direction has been logged in drop file (only in IPS mode)

Definition at line 76 of file flow.h.

◆ FLOW_TOCLIENT_IPONLY_SET

#define FLOW_TOCLIENT_IPONLY_SET   BIT_U32(4)

Flow was inspected against IP-Only sigs in the toclient direction

Definition at line 58 of file flow.h.

◆ FLOW_TOSERVER_DROP_LOGGED

#define FLOW_TOSERVER_DROP_LOGGED   BIT_U32(10)

packet to server direction has been logged in drop file (only in IPS mode)

Definition at line 74 of file flow.h.

◆ FLOW_TOSERVER_IPONLY_SET

#define FLOW_TOSERVER_IPONLY_SET   BIT_U32(3)

Flow was inspected against IP-Only sigs in the toserver direction

Definition at line 56 of file flow.h.

◆ FLOW_TS_PE_ALPROTO_DETECT_DONE

#define FLOW_TS_PE_ALPROTO_DETECT_DONE   BIT_U32(15)

Expectation alproto detection done

Definition at line 86 of file flow.h.

◆ FLOW_TS_PM_ALPROTO_DETECT_DONE

#define FLOW_TS_PM_ALPROTO_DETECT_DONE   BIT_U32(13)

Pattern matcher alproto detection done

Definition at line 82 of file flow.h.

◆ FLOW_TS_PP_ALPROTO_DETECT_DONE

#define FLOW_TS_PP_ALPROTO_DETECT_DONE   BIT_U32(14)

Probing parser alproto detection done

Definition at line 84 of file flow.h.

◆ FLOW_VERBOSE

#define FLOW_VERBOSE   FALSE

Definition at line 41 of file flow.h.

◆ FLOW_WRONG_THREAD

#define FLOW_WRONG_THREAD   BIT_U32(25)

Definition at line 106 of file flow.h.

◆ FLOWFILE_INIT

#define FLOWFILE_INIT   0

Definition at line 114 of file flow.h.

◆ FLOWFILE_NO_MAGIC_TC

#define FLOWFILE_NO_MAGIC_TC   BIT_U16(1)

Definition at line 118 of file flow.h.

◆ FLOWFILE_NO_MAGIC_TS

#define FLOWFILE_NO_MAGIC_TS   BIT_U16(0)

no magic on files in this flow

Definition at line 117 of file flow.h.

◆ FLOWFILE_NO_MD5_TC

#define FLOWFILE_NO_MD5_TC   BIT_U16(5)

Definition at line 125 of file flow.h.

◆ FLOWFILE_NO_MD5_TS

#define FLOWFILE_NO_MD5_TS   BIT_U16(4)

no md5 on files in this flow

Definition at line 124 of file flow.h.

◆ FLOWFILE_NO_SHA1_TC

#define FLOWFILE_NO_SHA1_TC   BIT_U16(7)

Definition at line 129 of file flow.h.

◆ FLOWFILE_NO_SHA1_TS

#define FLOWFILE_NO_SHA1_TS   BIT_U16(6)

no sha1 on files in this flow

Definition at line 128 of file flow.h.

◆ FLOWFILE_NO_SHA256_TC

#define FLOWFILE_NO_SHA256_TC   BIT_U16(9)

Definition at line 133 of file flow.h.

◆ FLOWFILE_NO_SHA256_TS

#define FLOWFILE_NO_SHA256_TS   BIT_U16(8)

no sha256 on files in this flow

Definition at line 132 of file flow.h.

◆ FLOWFILE_NO_SIZE_TC

#define FLOWFILE_NO_SIZE_TC   BIT_U16(11)

Definition at line 137 of file flow.h.

◆ FLOWFILE_NO_SIZE_TS

#define FLOWFILE_NO_SIZE_TS   BIT_U16(10)

no size tracking of files in this flow

Definition at line 136 of file flow.h.

◆ FLOWFILE_NO_STORE_TC

#define FLOWFILE_NO_STORE_TC   BIT_U16(3)

Definition at line 122 of file flow.h.

◆ FLOWFILE_NO_STORE_TS

#define FLOWFILE_NO_STORE_TS   BIT_U16(2)

even if the flow has files, don't store 'm

Definition at line 121 of file flow.h.

◆ FLOWFILE_NONE

#define FLOWFILE_NONE   (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC)

Definition at line 151 of file flow.h.

◆ FLOWFILE_NONE_TC

#define FLOWFILE_NONE_TC
Value:
FLOWFILE_NO_STORE_TC | \
FLOWFILE_NO_MD5_TC | \
FLOWFILE_NO_SHA1_TC | \
FLOWFILE_NO_SHA256_TC| \
FLOWFILE_NO_SIZE_TC)

Definition at line 145 of file flow.h.

◆ FLOWFILE_NONE_TS

#define FLOWFILE_NONE_TS
Value:
FLOWFILE_NO_STORE_TS | \
FLOWFILE_NO_MD5_TS | \
FLOWFILE_NO_SHA1_TS | \
FLOWFILE_NO_SHA256_TS| \
FLOWFILE_NO_SIZE_TS)

Definition at line 139 of file flow.h.

◆ FLOWLOCK_DESTROY

#define FLOWLOCK_DESTROY (   fb)    SCMutexDestroy(&(fb)->m)

Definition at line 260 of file flow.h.

◆ FLOWLOCK_INIT

#define FLOWLOCK_INIT (   fb)    SCMutexInit(&(fb)->m, NULL)

Definition at line 259 of file flow.h.

◆ FLOWLOCK_MUTEX

#define FLOWLOCK_MUTEX

Mutex or RWLocks for the flow.

Definition at line 242 of file flow.h.

◆ FLOWLOCK_RDLOCK

#define FLOWLOCK_RDLOCK (   fb)    SCMutexLock(&(fb)->m)

Definition at line 261 of file flow.h.

◆ FLOWLOCK_TRYRDLOCK

#define FLOWLOCK_TRYRDLOCK (   fb)    SCMutexTrylock(&(fb)->m)

Definition at line 263 of file flow.h.

◆ FLOWLOCK_TRYWRLOCK

#define FLOWLOCK_TRYWRLOCK (   fb)    SCMutexTrylock(&(fb)->m)

Definition at line 264 of file flow.h.

◆ FLOWLOCK_UNLOCK

#define FLOWLOCK_UNLOCK (   fb)    SCMutexUnlock(&(fb)->m)

Definition at line 265 of file flow.h.

◆ FLOWLOCK_WRLOCK

#define FLOWLOCK_WRLOCK (   fb)    SCMutexLock(&(fb)->m)

Definition at line 262 of file flow.h.

◆ TOCLIENT

#define TOCLIENT   1

Definition at line 44 of file flow.h.

◆ TOSERVER

#define TOSERVER   0

Definition at line 43 of file flow.h.

Typedef Documentation

◆ AppLayerParserState

Definition at line 1 of file flow.h.

◆ Flow

typedef struct Flow_ Flow

Flow data structure.

The flow is a global data structure that is created for new packets of a flow and then looked up for the following packets of a flow.

Locking

The flow is updated/used by multiple packets at the same time. This is why there is a flow-mutex. It's a mutex and not a spinlock because some operations on the flow can be quite expensive, thus spinning would be too expensive.

The flow "header" (addresses, ports, proto, recursion level) are static after the initialization and remain read-only throughout the entire live of a flow. This is why we can access those without protection of the lock.

◆ FlowAddress

typedef struct FlowAddress_ FlowAddress

◆ FlowBypassInfo

◆ FlowConfig

typedef struct FlowCnf_ FlowConfig

◆ FlowKey

typedef struct FlowKey_ FlowKey

◆ FlowLookupStruct

◆ FlowProtoFreeFunc

◆ FlowProtoTimeout

◆ FlowRefCount

typedef unsigned short FlowRefCount

Definition at line 321 of file flow.h.

◆ FlowStateType

typedef unsigned short FlowStateType

Definition at line 323 of file flow.h.

◆ FlowThreadId

typedef uint16_t FlowThreadId

Local Thread ID

Definition at line 326 of file flow.h.

Enumeration Type Documentation

◆ FlowState

enum FlowState
Enumerator
FLOW_STATE_NEW 
FLOW_STATE_ESTABLISHED 
FLOW_STATE_CLOSED 
FLOW_STATE_LOCAL_BYPASSED 

Definition at line 498 of file flow.h.

Function Documentation

◆ FlowChangeProto()

int FlowChangeProto ( Flow f)

Check if change proto flag is set for flow.

Parameters
fflow
Return values
1change proto flag is set
0change proto flag is not set

Definition at line 212 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

◆ FlowCleanupAppLayer()

void FlowCleanupAppLayer ( Flow )

Definition at line 142 of file flow.c.

References Flow_::alparser, Flow_::alstate, AppLayerParserStateCleanup(), and Flow_::proto.

Here is the call graph for this function:

◆ FlowClearMemory()

int FlowClearMemory ( Flow f,
uint8_t  proto_map 
)

Function clear the flow memory before queueing it to spare flow queue.

Parameters
fpointer to the flow needed to be cleared.
proto_mapmapped value of the protocol to FLOW_PROTO's.

Definition at line 1057 of file flow.c.

References AppLayerExpectationClean(), Flow_::flags, flow_freefuncs, FLOW_HAS_EXPECTATION, FLOW_RECYCLE, FlowFreeStorage(), FlowProtoFreeFunc_::Freefunc, Flow_::protoctx, SCEnter, SCReturnInt, and unlikely.

Referenced by FlowShutdown().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ FlowGetAppProtocol()

AppProto FlowGetAppProtocol ( const Flow f)

Definition at line 1094 of file flow.c.

References Flow_::alproto.

Referenced by JsonBuildFileInfoRecord().

Here is the caller graph for this function:

◆ FlowGetAppState()

◆ FlowGetDisruptionFlags()

uint8_t FlowGetDisruptionFlags ( const Flow f,
uint8_t  flags 
)

get 'disruption' flags: GAP/DEPTH/PASS

Parameters
flocked flow
flagsexisting flags to be ammended
Return values
flagsoriginal flags + disrupt flags (if any) \TODO handle UDP

Definition at line 1111 of file flow.c.

References TcpSession_::client, flags, TcpStream_::flags, Flow_::proto, Flow_::protoctx, TcpSession_::server, STREAM_DEPTH, STREAM_GAP, STREAM_TOSERVER, STREAMTCP_STREAM_FLAG_DEPTH_REACHED, and STREAMTCP_STREAM_FLAG_GAP.

◆ FlowGetLastTimeAsParts()

void FlowGetLastTimeAsParts ( Flow flow,
uint64_t *  secs,
uint64_t *  usecs 
)

Get flow last time as individual values.

Instead of returning a pointer to the timeval copy the timeval parts into output pointers to make it simpler to call from Rust over FFI using only basic data types.

Definition at line 1168 of file flow.c.

References Flow_::lastts.

◆ FlowGetMemcap()

uint64_t FlowGetMemcap ( void  )

Return memcap value.

Return values
memcapvalue

Definition at line 130 of file flow.c.

References flow_config, and SC_ATOMIC_GET.

◆ FlowGetMemuse()

uint64_t FlowGetMemuse ( void  )

Definition at line 136 of file flow.c.

References SC_ATOMIC_GET.

◆ FlowGetPacketDirection()

int FlowGetPacketDirection ( const Flow f,
const Packet p 
)

determine the direction of the packet compared to the flow

Return values
0to_server
1to_client

Definition at line 292 of file flow.c.

References CMP_ADDR, CMP_PORT, Packet_::dp, Flow_::flags, FLOW_DIR_REVERSED, Packet_::proto, Flow_::sp, Packet_::sp, Flow_::src, Packet_::src, TOCLIENT, and TOSERVER.

Referenced by FlowHandlePacketUpdate().

Here is the caller graph for this function:

◆ FlowHandlePacket()

void FlowHandlePacket ( ThreadVars tv,
FlowLookupStruct fls,
Packet p 
)

Entry point for packet flow handling.

This is called for every packet.

Parameters
tvthreadvars
dtvdecode thread vars (for flow output api thread data)
ppacket to handle flow for

Definition at line 500 of file flow.c.

References Packet_::flags, Packet_::flow, FlowGetFlowFromHash(), PKT_HAS_FLOW, and tv.

Referenced by UTHBuildPacketOfFlows().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ FlowHandlePacketUpdate()

void FlowHandlePacketUpdate ( Flow f,
Packet p,
ThreadVars tv,
DecodeThreadVars dtv 
)

Update Packet and Flow.

Updates packet and flow based on the new packet.

Parameters
flocked flow
ppacket
Note
overwrites p::flowflags

Definition at line 389 of file flow.c.

References BypassedFlowUpdate(), COPY_TIMESTAMP, EngineModeIsIPS(), Flow_::flags, FLOW_BYPASSED_TIMEOUT, FLOW_PKT_TOSERVER, Flow_::flow_state, FLOW_STATE_LOCAL_BYPASSED, FLOW_TO_DST_SEEN, Packet_::flowflags, FlowGetPacketDirection(), FlowUpdateState(), GET_PKT_LEN, Flow_::lastts, Packet_::pcap_cnt, SCLogDebug, Flow_::timeout_at, Flow_::timeout_policy, Flow_::todstbytecnt, Flow_::todstpktcnt, TOSERVER, and Packet_::ts.

Here is the call graph for this function:

◆ FlowHasAlerts()

int FlowHasAlerts ( const Flow f)

Check if flow has alerts.

Parameters
fflow
Return values
1has alerts
0has not alerts

Definition at line 180 of file flow.c.

References Flow_::flags, and FLOW_HAS_ALERTS.

◆ FlowInitConfig()

◆ FlowPrintQueueInfo()

void FlowPrintQueueInfo ( void  )

◆ FlowRegisterTests()

void FlowRegisterTests ( void  )

Function to register the Flow Unitests.

Definition at line 1387 of file flow.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ FlowSetChangeProtoFlag()

void FlowSetChangeProtoFlag ( Flow f)

Set flag to indicate to change proto for the flow.

Parameters
fflow

Definition at line 193 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

Referenced by AppLayerRequestProtocolChange().

Here is the caller graph for this function:

◆ FlowSetHasAlertsFlag()

void FlowSetHasAlertsFlag ( Flow f)

Set flag to indicate that flow has alerts.

Parameters
fflow

Definition at line 169 of file flow.c.

References Flow_::flags, and FLOW_HAS_ALERTS.

◆ FlowSetIPOnlyFlag()

void FlowSetIPOnlyFlag ( Flow f,
int  direction 
)

Set the IPOnly scanned flag for 'direction'.

Parameters
fFlow to set the flag in
directiondirection to set the flag in

Definition at line 158 of file flow.c.

References Flow_::flags, FLOW_TOCLIENT_IPONLY_SET, and FLOW_TOSERVER_IPONLY_SET.

◆ FlowSetMemcap()

int FlowSetMemcap ( uint64_t  size)

Update memcap value.

Parameters
sizenew memcap value

Definition at line 115 of file flow.c.

References flow_config, SC_ATOMIC_GET, and SC_ATOMIC_SET.

◆ FlowSetProtoEmergencyTimeout()

int FlowSetProtoEmergencyTimeout ( uint8_t  ,
uint32_t  ,
uint32_t  ,
uint32_t   
)

◆ FlowSetProtoFreeFunc()

int FlowSetProtoFreeFunc ( uint8_t  proto,
void(*)(void *)  Free 
)

Function to set the function to get protocol specific flow state.

Parameters
protoprotocol of which function is needed to be set.
FreeFunction pointer which will be called to free the protocol specific memory.

Definition at line 1085 of file flow.c.

References flow_freefuncs, FlowGetProtoMapping(), FlowProtoFreeFunc_::Freefunc, and proto.

Here is the call graph for this function:

◆ FlowSetProtoTimeout()

int FlowSetProtoTimeout ( uint8_t  ,
uint32_t  ,
uint32_t  ,
uint32_t   
)

◆ FlowSetupPacket()

void FlowSetupPacket ( Packet p)

prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow lookup and calc the hash value to be used in the lookup and autofp flow balancing.

Definition at line 410 of file flow-hash.c.

References Packet_::flags, Packet_::flow_hash, and PKT_WANTS_FLOW.

◆ FlowShutdown()

void FlowShutdown ( void  )

◆ FlowSwap()

void FlowSwap ( Flow f)

swap the flow's direction

Note
leaves the 'header' untouched. Interpret that based on FLOW_DIR_REVERSED flag.
Warning
: only valid before applayer parsing started. This function doesn't swap anything in Flow::alparser, Flow::alstate

Definition at line 261 of file flow.c.

References Flow_::flags, FLOW_DIR_REVERSED, Flow_::probing_parser_toclient_alproto_masks, Flow_::probing_parser_toserver_alproto_masks, and SWAP_VARS.

◆ FlowUnsetChangeProtoFlag()

void FlowUnsetChangeProtoFlag ( Flow f)

Unset flag to indicate to change proto for the flow.

Parameters
fflow

Definition at line 202 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

Referenced by AppLayerProtoDetectReset().

Here is the caller graph for this function:

◆ FlowUpdateQueue()

void FlowUpdateQueue ( Flow )

◆ FlowUpdateSpareFlows()

int FlowUpdateSpareFlows ( void  )

◆ FlowUpdateState()

void FlowUpdateState ( Flow f,
enum FlowState  s 
)

Definition at line 1135 of file flow.c.

References Flow_::flow_state.

Referenced by FlowHandlePacketUpdate(), and PacketBypassCallback().

Here is the caller graph for this function:

◆ GetFlowBypassInfoID()

int GetFlowBypassInfoID ( void  )

Definition at line 218 of file flow-util.c.

References g_bypass_info_id.

Referenced by EveAddFlow(), and PacketBypassCallback().

Here is the caller graph for this function:

◆ RegisterFlowBypassInfo()

void RegisterFlowBypassInfo ( void  )

Definition at line 236 of file flow-util.c.

References FlowStorageRegister(), and g_bypass_info_id.

Referenced by PostConfLoadedSetup().

Here is the call graph for this function:
Here is the caller graph for this function:
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:116
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:117
addr_data32
#define addr_data32
Definition: flow.h:317