#include "decode.h"
#include "util-time.h"
#include "util-exception-policy.h"
#include "util-exception-policy-types.h"
#include "util-var.h"
#include "util-optimize.h"
#include "util-validate.h"
#include "app-layer-protos.h"
#include "util-storage.h"
#include "flow-queue.h"

Include dependency graph for flow.h:

Data Structures
struct	FlowCnf_

struct	FlowKey_

struct	FlowAddress_

struct	Flow_
	Flow data structure. More...

struct	FlowProtoTimeout_

struct	FlowProtoFreeFunc_

struct	FlowBypassInfo_

struct	FlowLookupStruct_

Macros
#define	FLOW_QUIET true

#define	TOSERVER 0

#define	TOCLIENT 1

#define	FLOW_TO_SRC_SEEN BIT_U32(0)

#define	FLOW_TO_DST_SEEN BIT_U32(1)

#define	FLOW_TC_APP_UPDATE_NEXT BIT_U32(2)

#define	FLOW_IS_ELEPHANT BIT_U32(3)

#define	FLOW_ACTION_ACCEPT BIT_U32(4)

#define	FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)

#define	FLOW_ACTION_DROP BIT_U32(7)

#define	FLOW_SGH_TOSERVER BIT_U32(8)

#define	FLOW_SGH_TOCLIENT BIT_U32(9)

#define	FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)

#define	FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)

#define	FLOW_HAS_ALERTS BIT_U32(12)

#define	FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)

#define	FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)

#define	FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)

#define	FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)

#define	FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)

#define	FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)

#define	FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)

#define	FLOW_IPV4 BIT_U32(20)

#define	FLOW_IPV6 BIT_U32(21)

#define	FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)

#define	FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)

#define	FLOW_CHANGE_PROTO BIT_U32(24)

#define	FLOW_WRONG_THREAD BIT_U32(25)

#define	FLOW_DIR_REVERSED BIT_U32(26)

#define	FLOW_HAS_EXPECTATION BIT_U32(27)

#define	FLOW_ACTION_PASS BIT_U32(28)

#define	FLOW_TS_APP_UPDATED BIT_U32(29)

#define	FLOW_TC_APP_UPDATED BIT_U32(30)

#define	FLOW_TS_APP_UPDATE_NEXT BIT_U32(31)

#define	FLOWFILE_INIT 0

#define	FLOWFILE_NO_MAGIC_TS BIT_U16(0)

#define	FLOWFILE_NO_MAGIC_TC BIT_U16(1)

#define	FLOWFILE_NO_STORE_TS BIT_U16(2)

#define	FLOWFILE_NO_STORE_TC BIT_U16(3)

#define	FLOWFILE_NO_MD5_TS BIT_U16(4)

#define	FLOWFILE_NO_MD5_TC BIT_U16(5)

#define	FLOWFILE_NO_SHA1_TS BIT_U16(6)

#define	FLOWFILE_NO_SHA1_TC BIT_U16(7)

#define	FLOWFILE_NO_SHA256_TS BIT_U16(8)

#define	FLOWFILE_NO_SHA256_TC BIT_U16(9)

#define	FLOWFILE_STORE_TS BIT_U16(12)

#define	FLOWFILE_STORE_TC BIT_U16(13)

#define	FLOWFILE_NONE_TS

#define	FLOWFILE_NONE_TC

#define	FLOWFILE_NONE (FLOWFILE_NONE_TS\|FLOWFILE_NONE_TC)

#define	FLOW_IS_IPV4(f) (((f)->flags & FLOW_IPV4) == FLOW_IPV4)

#define	FLOW_IS_IPV6(f) (((f)->flags & FLOW_IPV6) == FLOW_IPV6)

#define	FLOW_GET_SP(f) ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;

#define	FLOW_GET_DP(f) ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;

#define	FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa)

#define	FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa)

#define	FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(ip4h, a)

#define	FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(ip4h, a)

#define	FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(ip6h, a)

#define	FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(ip6h, a)

#define	FLOW_PKT_TOSERVER 0x01

#define	FLOW_PKT_TOCLIENT 0x02

#define	FLOW_PKT_ESTABLISHED 0x04

#define	FLOW_PKT_TOSERVER_FIRST 0x08

#define	FLOW_PKT_TOCLIENT_FIRST 0x10

#define	FLOW_PKT_LAST_PSEUDO 0x20

#define	FLOW_END_FLAG_EMERGENCY 0x01

#define	FLOW_END_FLAG_TIMEOUT 0x02

#define	FLOW_END_FLAG_FORCED 0x04

#define	FLOW_END_FLAG_SHUTDOWN 0x08

#define	FLOW_END_FLAG_TCPREUSE 0x10

#define	FLOWLOCK_MUTEX

#define	FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)

#define	FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)

#define	FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m)

#define	FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m)

#define	FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m)

#define	FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m)

#define	FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)

#define	FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))

#define	FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))

#define	FLOW_IS_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))

#define	FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PM_ALPROTO_DETECT_DONE))

#define	FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PP_ALPROTO_DETECT_DONE))

#define	FLOW_SET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PE_ALPROTO_DETECT_DONE))

#define	FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))

#define	FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))

#define	FLOW_RESET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))

#define	addr_data32 address.address_un_data32

#define	addr_data16 address.address_un_data16

#define	addr_data8 address.address_un_data8

#define	FLOW_STATE_SIZE 4

Typedefs
typedef struct FlowStorageId	FlowStorageId

typedef struct AppLayerParserState_	AppLayerParserState

typedef struct FlowCnf_	FlowConfig

typedef struct FlowKey_	FlowKey

typedef struct FlowAddress_	FlowAddress

typedef unsigned short	FlowStateType

typedef uint16_t	FlowThreadId

typedef struct Flow_	Flow
	Flow data structure. More...

typedef struct FlowProtoTimeout_	FlowProtoTimeout

typedef struct FlowProtoFreeFunc_	FlowProtoFreeFunc

typedef struct FlowBypassInfo_	FlowBypassInfo

typedef struct FlowLookupStruct_	FlowLookupStruct

Enumerations
enum	FlowState { FLOW_STATE_NEW = 0, FLOW_STATE_ESTABLISHED, FLOW_STATE_CLOSED, FLOW_STATE_LOCAL_BYPASSED }

Functions
void	FlowSetupPacket (Packet *p)
	prepare packet for a life with flow Set PKT_WANTS_FLOW flag to indicate workers should do a flow lookup and calc the hash value to be used in the lookup and autofp flow balancing. More...

void	FlowHandlePacket (ThreadVars , FlowLookupStruct , Packet *)
	Entry point for packet flow handling. More...

void	FlowInitConfig (bool)
	initialize the configuration More...

void	FlowReset (void)

void	FlowShutdown (void)
	shutdown the flow engine More...

void	FlowSetHasAlertsFlag (Flow *)
	Set flag to indicate that flow has alerts. More...

int	FlowHasAlerts (const Flow *)
	Check if flow has alerts. More...

void	FlowSetChangeProtoFlag (Flow *)
	Set flag to indicate to change proto for the flow. More...

void	FlowUnsetChangeProtoFlag (Flow *)
	Unset flag to indicate to change proto for the flow. More...

int	FlowChangeProto (Flow *)
	Check if change proto flag is set for flow. More...

void	FlowSwap (Flow *)
	swap the flow's direction More...

void	FlowRegisterTests (void)
	Function to register the Flow Unitests. More...

int	FlowSetProtoFreeFunc (uint8_t, void(Free)(void ))
	Function to set the function to get protocol specific flow state. More...

int	FlowGetPacketDirection (const Flow , const Packet )
	determine the direction of the packet compared to the flow More...

void	FlowCleanupAppLayer (Flow *)

void	FlowUpdateState (Flow *f, enum FlowState s)

int	FlowSetMemcap (uint64_t size)
	Update memcap value. More...

uint64_t	FlowGetMemcap (void)
	Return memcap value. More...

uint64_t	FlowGetMemuse (void)

enum ExceptionPolicy	FlowGetMemcapExceptionPolicy (void)

FlowStorageId	GetFlowBypassInfoID (void)

void	RegisterFlowBypassInfo (void)

int	FlowClearMemory (Flow *, uint8_t)
	Function clear the flow memory before queueing it to spare flow queue. More...

uint8_t	FlowGetDisruptionFlags (const Flow *f, uint8_t flags)
	get 'disruption' flags: GAP/DEPTH/PASS More...

void	FlowHandlePacketUpdate (Flow f, Packet p, ThreadVars tv, DecodeThreadVars dtv)
	Update Packet and Flow. More...

Detailed Description

Author: Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file flow.h.

Macro Definition Documentation

◆ addr_data16

#define addr_data16 address.address_un_data16

Definition at line 320 of file flow.h.

◆ addr_data32

#define addr_data32 address.address_un_data32

Definition at line 319 of file flow.h.

◆ addr_data8

#define addr_data8 address.address_un_data8

Definition at line 321 of file flow.h.

◆ FLOW_ACTION_ACCEPT

#define FLOW_ACTION_ACCEPT BIT_U32(4)

All packets in this flow should be accepted

Definition at line 63 of file flow.h.

◆ FLOW_ACTION_DROP

#define FLOW_ACTION_DROP BIT_U32(7)

All packets in this flow should be dropped

Definition at line 71 of file flow.h.

◆ FLOW_ACTION_PASS

#define FLOW_ACTION_PASS BIT_U32(28)

All packets in this flow should be passed

Definition at line 118 of file flow.h.

◆ FLOW_CHANGE_PROTO

#define FLOW_CHANGE_PROTO BIT_U32(24)

Indicate that alproto detection for flow should be done again

Definition at line 109 of file flow.h.

◆ FLOW_COPY_IPV4_ADDR_TO_PACKET

#define FLOW_COPY_IPV4_ADDR_TO_PACKET	(	fa,
		pa
	)

Value:

        do {      \
        (pa)->family = AF_INET;                         \
        (pa)->addr_data32[0] = (fa)->addr_data32[0];    \
    } while (0)

Definition at line 173 of file flow.h.

◆ FLOW_COPY_IPV6_ADDR_TO_PACKET

#define FLOW_COPY_IPV6_ADDR_TO_PACKET	(	fa,
		pa
	)

Value:

        do {      \
        (pa)->family = AF_INET6;                        \
        (pa)->addr_data32[0] = (fa)->addr_data32[0];    \
        (pa)->addr_data32[1] = (fa)->addr_data32[1];    \
        (pa)->addr_data32[2] = (fa)->addr_data32[2];    \
        (pa)->addr_data32[3] = (fa)->addr_data32[3];    \
    } while (0)

Definition at line 178 of file flow.h.

◆ FLOW_DIR_REVERSED

#define FLOW_DIR_REVERSED BIT_U32(26)

Protocol detection told us flow is picked up in wrong direction (midstream)

Definition at line 113 of file flow.h.

◆ FLOW_END_FLAG_EMERGENCY

#define FLOW_END_FLAG_EMERGENCY 0x01

Definition at line 235 of file flow.h.

◆ FLOW_END_FLAG_FORCED

#define FLOW_END_FLAG_FORCED 0x04

Definition at line 237 of file flow.h.

◆ FLOW_END_FLAG_SHUTDOWN

#define FLOW_END_FLAG_SHUTDOWN 0x08

Definition at line 238 of file flow.h.

◆ FLOW_END_FLAG_TCPREUSE

#define FLOW_END_FLAG_TCPREUSE 0x10

Definition at line 239 of file flow.h.

◆ FLOW_END_FLAG_TIMEOUT

#define FLOW_END_FLAG_TIMEOUT 0x02

Definition at line 236 of file flow.h.

◆ FLOW_GET_DP

#define FLOW_GET_DP ( f ) ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;

Definition at line 170 of file flow.h.

◆ FLOW_GET_SP

#define FLOW_GET_SP ( f ) ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;

Definition at line 168 of file flow.h.

◆ FLOW_HAS_ALERTS

#define FLOW_HAS_ALERTS BIT_U32(12)

flow has alerts

Definition at line 84 of file flow.h.

◆ FLOW_HAS_EXPECTATION

#define FLOW_HAS_EXPECTATION BIT_U32(27)

Indicate that the flow did trigger an expectation creation

Definition at line 115 of file flow.h.

◆ FLOW_IPV4

#define FLOW_IPV4 BIT_U32(20)

flow is ipv4

Definition at line 101 of file flow.h.

◆ FLOW_IPV6

#define FLOW_IPV6 BIT_U32(21)

flow is ipv6

Definition at line 103 of file flow.h.

◆ FLOW_IS_ELEPHANT

#define FLOW_IS_ELEPHANT BIT_U32(3)

Flow is marked an elephant flow

Definition at line 60 of file flow.h.

◆ FLOW_IS_IPV4

#define FLOW_IS_IPV4 ( f ) (((f)->flags & FLOW_IPV4) == FLOW_IPV4)

Definition at line 163 of file flow.h.

◆ FLOW_IS_IPV6

#define FLOW_IS_IPV6 ( f ) (((f)->flags & FLOW_IPV6) == FLOW_IPV6)

Definition at line 165 of file flow.h.

◆ FLOW_IS_PE_DONE

#define FLOW_IS_PE_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))

Definition at line 273 of file flow.h.

◆ FLOW_IS_PM_DONE

#define FLOW_IS_PM_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))

Definition at line 271 of file flow.h.

◆ FLOW_IS_PP_DONE

#define FLOW_IS_PP_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))

Definition at line 272 of file flow.h.

◆ FLOW_NOPAYLOAD_INSPECTION

#define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)

Packet payloads belonging to this flow should not be inspected

Definition at line 68 of file flow.h.

◆ FLOW_PKT_ESTABLISHED

#define FLOW_PKT_ESTABLISHED 0x04

Definition at line 228 of file flow.h.

◆ FLOW_PKT_LAST_PSEUDO

#define FLOW_PKT_LAST_PSEUDO 0x20

last pseudo packet in the flow. Can be used to trigger final clean, logging, etc.

Definition at line 233 of file flow.h.

◆ FLOW_PKT_TOCLIENT

#define FLOW_PKT_TOCLIENT 0x02

Definition at line 227 of file flow.h.

◆ FLOW_PKT_TOCLIENT_FIRST

#define FLOW_PKT_TOCLIENT_FIRST 0x10

Definition at line 230 of file flow.h.

◆ FLOW_PKT_TOSERVER

#define FLOW_PKT_TOSERVER 0x01

Definition at line 226 of file flow.h.

◆ FLOW_PKT_TOSERVER_FIRST

#define FLOW_PKT_TOSERVER_FIRST 0x08

Definition at line 229 of file flow.h.

◆ FLOW_PROTO_DETECT_TC_DONE

#define FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)

Definition at line 106 of file flow.h.

◆ FLOW_PROTO_DETECT_TS_DONE

#define FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)

Definition at line 105 of file flow.h.

◆ FLOW_QUIET

#define FLOW_QUIET true

Definition at line 44 of file flow.h.

◆ FLOW_RESET_PE_DONE

#define FLOW_RESET_PE_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))

Definition at line 281 of file flow.h.

◆ FLOW_RESET_PM_DONE

#define FLOW_RESET_PM_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))

Definition at line 279 of file flow.h.

◆ FLOW_RESET_PP_DONE

#define FLOW_RESET_PP_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))

Definition at line 280 of file flow.h.

◆ FLOW_SET_IPV4_DST_ADDR_FROM_PACKET

#define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET	(	ip4h,
		a
	)

Value:

    do {                                                                                           \
        (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_dst.s_addr;                                   \
        (a)->addr_data32[1] = 0;                                                                   \
        (a)->addr_data32[2] = 0;                                                                   \
        (a)->addr_data32[3] = 0;                                                                   \
    } while (0)

Definition at line 199 of file flow.h.

◆ FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET

#define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET	(	ip4h,
		a
	)

Value:

    do {                                                                                           \
        (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_src.s_addr;                                   \
        (a)->addr_data32[1] = 0;                                                                   \
        (a)->addr_data32[2] = 0;                                                                   \
        (a)->addr_data32[3] = 0;                                                                   \
    } while (0)

Definition at line 191 of file flow.h.

◆ FLOW_SET_IPV6_DST_ADDR_FROM_PACKET

#define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET	(	ip6h,
		a
	)

Value:

    do {                                                                                           \
        (a)->addr_data32[0] = (ip6h)->s_ip6_dst[0];                                                \
        (a)->addr_data32[1] = (ip6h)->s_ip6_dst[1];                                                \
        (a)->addr_data32[2] = (ip6h)->s_ip6_dst[2];                                                \
        (a)->addr_data32[3] = (ip6h)->s_ip6_dst[3];                                                \
    } while (0)

Definition at line 217 of file flow.h.

◆ FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET

#define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET	(	ip6h,
		a
	)

Value:

    do {                                                                                           \
        (a)->addr_data32[0] = (ip6h)->s_ip6_src[0];                                                \
        (a)->addr_data32[1] = (ip6h)->s_ip6_src[1];                                                \
        (a)->addr_data32[2] = (ip6h)->s_ip6_src[2];                                                \
        (a)->addr_data32[3] = (ip6h)->s_ip6_src[3];                                                \
    } while (0)

Definition at line 209 of file flow.h.

◆ FLOW_SET_PE_DONE

#define FLOW_SET_PE_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PE_ALPROTO_DETECT_DONE))

Definition at line 277 of file flow.h.

◆ FLOW_SET_PM_DONE

#define FLOW_SET_PM_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PM_ALPROTO_DETECT_DONE))

Definition at line 275 of file flow.h.

◆ FLOW_SET_PP_DONE

#define FLOW_SET_PP_DONE	(	f,
		dir
	)	(((dir) & STREAM_TOSERVER) ? ((f)->flags \|= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags \|= FLOW_TC_PP_ALPROTO_DETECT_DONE))

Definition at line 276 of file flow.h.

◆ FLOW_SGH_TOCLIENT

#define FLOW_SGH_TOCLIENT BIT_U32(9)

Sgh for toclient direction set (even if it's NULL)

Definition at line 76 of file flow.h.

◆ FLOW_SGH_TOSERVER

#define FLOW_SGH_TOSERVER BIT_U32(8)

Sgh for toserver direction set (even if it's NULL)

Definition at line 74 of file flow.h.

◆ FLOW_STATE_SIZE

#define FLOW_STATE_SIZE 4

Definition at line 508 of file flow.h.

◆ FLOW_TC_APP_UPDATE_NEXT

#define FLOW_TC_APP_UPDATE_NEXT BIT_U32(2)

next packet in toclient direction will act on updated app-layer state

Definition at line 57 of file flow.h.

◆ FLOW_TC_APP_UPDATED

#define FLOW_TC_APP_UPDATED BIT_U32(30)

Definition at line 121 of file flow.h.

◆ FLOW_TC_PE_ALPROTO_DETECT_DONE

#define FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)

Expectation alproto detection done

Definition at line 97 of file flow.h.

◆ FLOW_TC_PM_ALPROTO_DETECT_DONE

#define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)

Pattern matcher alproto detection done

Definition at line 93 of file flow.h.

◆ FLOW_TC_PP_ALPROTO_DETECT_DONE

#define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)

Probing parser alproto detection done

Definition at line 95 of file flow.h.

◆ FLOW_TIMEOUT_REASSEMBLY_DONE

#define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)

Definition at line 98 of file flow.h.

◆ FLOW_TO_DST_SEEN

#define FLOW_TO_DST_SEEN BIT_U32(1)

At least one packet from the destination address was seen

Definition at line 54 of file flow.h.

◆ FLOW_TO_SRC_SEEN

#define FLOW_TO_SRC_SEEN BIT_U32(0)

At least one packet from the source address was seen

Definition at line 52 of file flow.h.

◆ FLOW_TOCLIENT_DROP_LOGGED

#define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)

packet to client direction has been logged in drop file (only in IPS mode)

Definition at line 81 of file flow.h.

◆ FLOW_TOSERVER_DROP_LOGGED

#define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)

packet to server direction has been logged in drop file (only in IPS mode)

Definition at line 79 of file flow.h.

◆ FLOW_TS_APP_UPDATE_NEXT

#define FLOW_TS_APP_UPDATE_NEXT BIT_U32(31)

next packet in toserver direction will act on updated app-layer state

Definition at line 124 of file flow.h.

◆ FLOW_TS_APP_UPDATED

#define FLOW_TS_APP_UPDATED BIT_U32(29)

Definition at line 120 of file flow.h.

◆ FLOW_TS_PE_ALPROTO_DETECT_DONE

#define FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)

Expectation alproto detection done

Definition at line 91 of file flow.h.

◆ FLOW_TS_PM_ALPROTO_DETECT_DONE

#define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)

Pattern matcher alproto detection done

Definition at line 87 of file flow.h.

◆ FLOW_TS_PP_ALPROTO_DETECT_DONE

#define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)

Probing parser alproto detection done

Definition at line 89 of file flow.h.

◆ FLOW_WRONG_THREAD

#define FLOW_WRONG_THREAD BIT_U32(25)

Definition at line 111 of file flow.h.

◆ FLOWFILE_INIT

#define FLOWFILE_INIT 0

Definition at line 128 of file flow.h.

◆ FLOWFILE_NO_MAGIC_TC

#define FLOWFILE_NO_MAGIC_TC BIT_U16(1)

Definition at line 132 of file flow.h.

◆ FLOWFILE_NO_MAGIC_TS

#define FLOWFILE_NO_MAGIC_TS BIT_U16(0)

no magic on files in this flow

Definition at line 131 of file flow.h.

◆ FLOWFILE_NO_MD5_TC

#define FLOWFILE_NO_MD5_TC BIT_U16(5)

Definition at line 139 of file flow.h.

◆ FLOWFILE_NO_MD5_TS

#define FLOWFILE_NO_MD5_TS BIT_U16(4)

no md5 on files in this flow

Definition at line 138 of file flow.h.

◆ FLOWFILE_NO_SHA1_TC

#define FLOWFILE_NO_SHA1_TC BIT_U16(7)

Definition at line 143 of file flow.h.

◆ FLOWFILE_NO_SHA1_TS

#define FLOWFILE_NO_SHA1_TS BIT_U16(6)

no sha1 on files in this flow

Definition at line 142 of file flow.h.

◆ FLOWFILE_NO_SHA256_TC

#define FLOWFILE_NO_SHA256_TC BIT_U16(9)

Definition at line 147 of file flow.h.

◆ FLOWFILE_NO_SHA256_TS

#define FLOWFILE_NO_SHA256_TS BIT_U16(8)

no sha256 on files in this flow

Definition at line 146 of file flow.h.

◆ FLOWFILE_NO_STORE_TC

#define FLOWFILE_NO_STORE_TC BIT_U16(3)

Definition at line 136 of file flow.h.

◆ FLOWFILE_NO_STORE_TS

#define FLOWFILE_NO_STORE_TS BIT_U16(2)

even if the flow has files, don't store 'm

Definition at line 135 of file flow.h.

◆ FLOWFILE_NONE

#define FLOWFILE_NONE (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC)

Definition at line 161 of file flow.h.

◆ FLOWFILE_NONE_TC

#define FLOWFILE_NONE_TC

Value:

(FLOWFILE_NO_MAGIC_TC | FLOWFILE_NO_STORE_TC | FLOWFILE_NO_MD5_TC | FLOWFILE_NO_SHA1_TC | \

FLOWFILE_NO_SHA256_TC)

Definition at line 158 of file flow.h.

◆ FLOWFILE_NONE_TS

#define FLOWFILE_NONE_TS

Value:

(FLOWFILE_NO_MAGIC_TS | FLOWFILE_NO_STORE_TS | FLOWFILE_NO_MD5_TS | FLOWFILE_NO_SHA1_TS | \

FLOWFILE_NO_SHA256_TS)

Definition at line 155 of file flow.h.

◆ FLOWFILE_STORE_TC

#define FLOWFILE_STORE_TC BIT_U16(13)

Definition at line 153 of file flow.h.

◆ FLOWFILE_STORE_TS

#define FLOWFILE_STORE_TS BIT_U16(12)

store files in the flow

Definition at line 152 of file flow.h.

◆ FLOWLOCK_DESTROY

#define FLOWLOCK_DESTROY ( fb ) SCMutexDestroy(&(fb)->m)

Definition at line 261 of file flow.h.

◆ FLOWLOCK_INIT

#define FLOWLOCK_INIT ( fb ) SCMutexInit(&(fb)->m, NULL)

Definition at line 260 of file flow.h.

◆ FLOWLOCK_MUTEX

#define FLOWLOCK_MUTEX

Mutex or RWLocks for the flow.

Definition at line 243 of file flow.h.

◆ FLOWLOCK_RDLOCK

#define FLOWLOCK_RDLOCK ( fb ) SCMutexLock(&(fb)->m)

Definition at line 262 of file flow.h.

◆ FLOWLOCK_TRYRDLOCK

#define FLOWLOCK_TRYRDLOCK ( fb ) SCMutexTrylock(&(fb)->m)

Definition at line 264 of file flow.h.

◆ FLOWLOCK_TRYWRLOCK

#define FLOWLOCK_TRYWRLOCK ( fb ) SCMutexTrylock(&(fb)->m)

Definition at line 265 of file flow.h.

◆ FLOWLOCK_UNLOCK

#define FLOWLOCK_UNLOCK ( fb ) SCMutexUnlock(&(fb)->m)

Definition at line 266 of file flow.h.

◆ FLOWLOCK_WRLOCK

#define FLOWLOCK_WRLOCK ( fb ) SCMutexLock(&(fb)->m)

Definition at line 263 of file flow.h.

◆ TOCLIENT

#define TOCLIENT 1

Definition at line 47 of file flow.h.

◆ TOSERVER

#define TOSERVER 0

Definition at line 46 of file flow.h.

Typedef Documentation

◆ AppLayerParserState

typedef struct AppLayerParserState_ AppLayerParserState

Definition at line 1 of file flow.h.

◆ Flow

typedef struct Flow_ Flow

Flow data structure.

The flow is a global data structure that is created for new packets of a flow and then looked up for the following packets of a flow.

Locking

The flow is updated/used by multiple packets at the same time. This is why there is a flow-mutex. It's a mutex and not a spinlock because some operations on the flow can be quite expensive, thus spinning would be too expensive.

The flow "header" (addresses, ports, proto, recursion level) are static after the initialization and remain read-only throughout the entire live of a flow. This is why we can access those without protection of the lock.

◆ FlowAddress

typedef struct FlowAddress_ FlowAddress

◆ FlowBypassInfo

typedef struct FlowBypassInfo_ FlowBypassInfo

◆ FlowConfig

typedef struct FlowCnf_ FlowConfig

◆ FlowKey

typedef struct FlowKey_ FlowKey

◆ FlowLookupStruct

typedef struct FlowLookupStruct_ FlowLookupStruct

◆ FlowProtoFreeFunc

typedef struct FlowProtoFreeFunc_ FlowProtoFreeFunc

◆ FlowProtoTimeout

typedef struct FlowProtoTimeout_ FlowProtoTimeout

◆ FlowStateType

typedef unsigned short FlowStateType

Definition at line 322 of file flow.h.

◆ FlowStorageId

typedef struct FlowStorageId FlowStorageId

Definition at line 1 of file flow.h.

◆ FlowThreadId

typedef uint16_t FlowThreadId

Local Thread ID

Definition at line 325 of file flow.h.

Enumeration Type Documentation

◆ FlowState

enum FlowState

Enumerator
FLOW_STATE_NEW
FLOW_STATE_ESTABLISHED
FLOW_STATE_CLOSED
FLOW_STATE_LOCAL_BYPASSED

Definition at line 495 of file flow.h.

Function Documentation

◆ FlowChangeProto()

int FlowChangeProto ( Flow * f )

Check if change proto flag is set for flow.

Parameters

f flow

Return values

1	change proto flag is set
0	change proto flag is not set

Definition at line 197 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

Referenced by AppLayerRequestProtocolChange(), and LLVMFuzzerTestOneInput().

Here is the caller graph for this function:

◆ FlowCleanupAppLayer()

void FlowCleanupAppLayer ( Flow * )

Definition at line 140 of file flow.c.

References Flow_::alparser, Flow_::alstate, AppLayerParserStateCleanup(), and Flow_::proto.

Here is the call graph for this function:

◆ FlowClearMemory()

int FlowClearMemory	(	Flow *	f,
		uint8_t	proto_map
	)

Function clear the flow memory before queueing it to spare flow queue.

Parameters

f	pointer to the flow needed to be cleared.
proto_map	mapped value of the protocol to FLOW_PROTO's.

Definition at line 1097 of file flow.c.

References AppLayerExpectationClean(), Flow_::flags, flow_freefuncs, FLOW_HAS_EXPECTATION, FLOW_RECYCLE, FlowFreeStorage(), FlowProtoFreeFunc_::Freefunc, Flow_::protoctx, SCEnter, SCReturnInt, and unlikely.

Referenced by FlowReset(), and FlowShutdown().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ FlowGetDisruptionFlags()

uint8_t FlowGetDisruptionFlags	(	const Flow *	f,
		uint8_t	flags
	)

get 'disruption' flags: GAP/DEPTH/PASS

Parameters

f	locked flow
flags	existing flags to be amended

Return values

flags original flags + disrupt flags (if any) \TODO handle UDP

Definition at line 1141 of file flow.c.

References TcpSession_::client, flags, TcpStream_::flags, Flow_::proto, Flow_::protoctx, TcpSession_::server, and STREAMTCP_STREAM_FLAG_DEPTH_REACHED.

◆ FlowGetMemcap()

uint64_t FlowGetMemcap ( void )

Return memcap value.

Return values

memcap value

Definition at line 123 of file flow.c.

References flow_config, and SC_ATOMIC_GET.

◆ FlowGetMemcapExceptionPolicy()

enum ExceptionPolicy FlowGetMemcapExceptionPolicy ( void )

Definition at line 129 of file flow.c.

Referenced by DecodeRegisterPerfCounters().

Here is the caller graph for this function:

◆ FlowGetMemuse()

uint64_t FlowGetMemuse ( void )

Definition at line 129 of file flow.c.

References SC_ATOMIC_GET.

◆ FlowGetPacketDirection()

int FlowGetPacketDirection	(	const Flow *	f,
		const Packet *	p
	)

determine the direction of the packet compared to the flow

Return values

0	to_server
1	to_client

Definition at line 279 of file flow.c.

References CMP_ADDR, CMP_PORT, Packet_::dp, Flow_::flags, FLOW_DIR_REVERSED, IPPROTO_SCTP, Packet_::proto, Flow_::sp, Packet_::sp, Flow_::src, Packet_::src, TOCLIENT, and TOSERVER.

Referenced by FlowHandlePacketUpdate(), and StreamTcp().

Here is the caller graph for this function:

◆ FlowHandlePacket()

void FlowHandlePacket	(	ThreadVars *	tv,
		FlowLookupStruct *	fls,
		Packet *	p
	)

Entry point for packet flow handling.

This is called for every packet.

Parameters

tv	threadvars
dtv	decode thread vars (for flow output api thread data)
p	packet to handle flow for

Definition at line 533 of file flow.c.

References Packet_::flags, Packet_::flow, FlowGetFlowFromHash(), PKT_HAS_FLOW, and tv.

Referenced by UTHBuildPacketOfFlows().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ FlowHandlePacketUpdate()

void FlowHandlePacketUpdate	(	Flow *	f,
		Packet *	p,
		ThreadVars *	tv,
		DecodeThreadVars *	dtv
	)

Update Packet and Flow.

Updates packet and flow based on the new packet.

Parameters

f	locked flow
p	packet

Note: overwrites p::flowflags

Definition at line 402 of file flow.c.

References BypassedFlowUpdate(), EngineModeIsIPS(), FLOW_BYPASSED_TIMEOUT, Flow_::flow_state, FLOW_STATE_LOCAL_BYPASSED, FlowGetPacketDirection(), FlowUpdateState(), GET_PKT_LEN, Flow_::lastts, Packet_::pcap_cnt, SCLogDebug, SCTIME_CMP_GT, SCTIME_SECS, Flow_::todstbytecnt, Flow_::todstpktcnt, TOSERVER, and Packet_::ts.

Here is the call graph for this function:

◆ FlowHasAlerts()

int FlowHasAlerts ( const Flow * f )

Check if flow has alerts.

Parameters

f flow

Return values

1	has alerts
0	has not alerts

Definition at line 165 of file flow.c.

References Flow_::flags, and FLOW_HAS_ALERTS.

◆ FlowInitConfig()

void FlowInitConfig ( bool quiet )

initialize the configuration

Warning: Not thread safe

set config values for memcap, prealloc and hash_size

Definition at line 547 of file flow.c.

References CLS, FlowCnf_::emergency_recovery, ExceptionPolicyParse(), FatalError, FBLOCK_INIT, FLOW_CHECK_MEMCAP, flow_config, FLOW_DEFAULT_EMERGENCY_RECOVERY, FLOW_DEFAULT_HASHSIZE, FLOW_DEFAULT_MEMCAP, FLOW_DEFAULT_PREALLOC, flow_hash, flow_recycle_q, FlowInitFlowProto(), FlowQueueInit(), FlowSparePoolInit(), FlowStorageSize(), FlowCnf_::hash_rand, FlowCnf_::hash_size, FlowCnf_::memcap_policy, ParseSizeStringU64(), FlowCnf_::prealloc, RandomGet(), SC_ATOMIC_ADD, SC_ATOMIC_GET, SC_ATOMIC_INIT, SC_ATOMIC_SET, SCConfGet(), SCConfGetInt(), SCLogDebug, SCLogError, SCMallocAligned, StringParseUint32(), and unlikely.

Referenced by PreRunInit().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ FlowRegisterTests()

void FlowRegisterTests ( void )

Function to register the Flow Unitests.

Definition at line 1445 of file flow.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ FlowReset()

void FlowReset ( void )

Definition at line 673 of file flow.c.

References flow_config, flow_hash, FlowClearMemory(), FlowFree(), FlowGetProtoMapping(), FlowCnf_::hash_size, Flow_::next, and Flow_::proto.

Here is the call graph for this function:

◆ FlowSetChangeProtoFlag()

void FlowSetChangeProtoFlag ( Flow * f )

Set flag to indicate to change proto for the flow.

Parameters

f flow

Definition at line 178 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

Referenced by AppLayerRequestProtocolChange().

Here is the caller graph for this function:

◆ FlowSetHasAlertsFlag()

void FlowSetHasAlertsFlag ( Flow * f )

Set flag to indicate that flow has alerts.

Parameters

f flow

Definition at line 154 of file flow.c.

References Flow_::flags, and FLOW_HAS_ALERTS.

◆ FlowSetMemcap()

int FlowSetMemcap ( uint64_t size )

Update memcap value.

Parameters

size	new memcap value

Definition at line 108 of file flow.c.

References flow_config, SC_ATOMIC_GET, and SC_ATOMIC_SET.

◆ FlowSetProtoFreeFunc()

int FlowSetProtoFreeFunc	(	uint8_t	proto,
		void()(void )	Free
	)

Function to set the function to get protocol specific flow state.

Parameters

proto	protocol of which function is needed to be set.
Free	Function pointer which will be called to free the protocol specific memory.

Definition at line 1125 of file flow.c.

References flow_freefuncs, FlowGetProtoMapping(), FlowProtoFreeFunc_::Freefunc, and proto.

Here is the call graph for this function:

◆ FlowSetupPacket()

void FlowSetupPacket ( Packet * p )

prepare packet for a life with flow Set PKT_WANTS_FLOW flag to indicate workers should do a flow lookup and calc the hash value to be used in the lookup and autofp flow balancing.

Definition at line 533 of file flow-hash.c.

References Packet_::flags, Packet_::flow_hash, and PKT_WANTS_FLOW.

◆ FlowShutdown()

void FlowShutdown ( void )

shutdown the flow engine

Warning: Not thread safe

Definition at line 691 of file flow.c.

References DEBUG_VALIDATE_BUG_ON, FBLOCK_DESTROY, flow_config, flow_hash, flow_recycle_q, FlowClearMemory(), FlowDequeue(), FlowFree(), FlowGetProtoMapping(), FlowQueueDestroy(), FlowSparePoolDestroy(), FlowCnf_::hash_size, Flow_::next, Flow_::proto, SC_ATOMIC_GET, SC_ATOMIC_SUB, and SCFreeAligned.

Here is the call graph for this function:

◆ FlowSwap()

void FlowSwap ( Flow * f )

swap the flow's direction

Note: leaves the 'header' untouched. Interpret that based on FLOW_DIR_REVERSED flag.

Warning: : only valid before applayer parsing started. This function doesn't swap anything in Flow::alparser, Flow::alstate

Definition at line 246 of file flow.c.

References Flow_::flags, FLOW_DIR_REVERSED, Flow_::probing_parser_toclient_alproto_masks, Flow_::probing_parser_toserver_alproto_masks, and SWAP_VARS.

◆ FlowUnsetChangeProtoFlag()

void FlowUnsetChangeProtoFlag ( Flow * f )

Unset flag to indicate to change proto for the flow.

Parameters

f flow

Definition at line 187 of file flow.c.

References Flow_::flags, and FLOW_CHANGE_PROTO.

◆ FlowUpdateState()

void FlowUpdateState	(	Flow *	f,
		enum FlowState	s
	)

Definition at line 1162 of file flow.c.

References Flow_::flow_state.

Referenced by FlowHandlePacketUpdate(), and PacketBypassCallback().

Here is the caller graph for this function:

◆ GetFlowBypassInfoID()

FlowStorageId GetFlowBypassInfoID ( void )

Definition at line 222 of file flow-util.c.

References g_bypass_info_id.

Referenced by EveAddFlow(), and PacketBypassCallback().

Here is the caller graph for this function:

◆ RegisterFlowBypassInfo()

void RegisterFlowBypassInfo ( void )

Definition at line 240 of file flow-util.c.

References FlowStorageRegister(), and g_bypass_info_id.

Referenced by PostConfLoadedSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

Data Structures

Macros

Typedefs

Enumerations

Functions

Detailed Description

Macro Definition Documentation

◆ addr_data16

◆ addr_data32

◆ addr_data8

◆ FLOW_ACTION_ACCEPT

◆ FLOW_ACTION_DROP

◆ FLOW_ACTION_PASS

◆ FLOW_CHANGE_PROTO

◆ FLOW_COPY_IPV4_ADDR_TO_PACKET

◆ FLOW_COPY_IPV6_ADDR_TO_PACKET

◆ FLOW_DIR_REVERSED

◆ FLOW_END_FLAG_EMERGENCY

◆ FLOW_END_FLAG_FORCED

◆ FLOW_END_FLAG_SHUTDOWN

◆ FLOW_END_FLAG_TCPREUSE

◆ FLOW_END_FLAG_TIMEOUT

◆ FLOW_GET_DP

◆ FLOW_GET_SP

◆ FLOW_HAS_ALERTS

◆ FLOW_HAS_EXPECTATION

◆ FLOW_IPV4

◆ FLOW_IPV6

◆ FLOW_IS_ELEPHANT

◆ FLOW_IS_IPV4

◆ FLOW_IS_IPV6

◆ FLOW_IS_PE_DONE

◆ FLOW_IS_PM_DONE

◆ FLOW_IS_PP_DONE

◆ FLOW_NOPAYLOAD_INSPECTION

◆ FLOW_PKT_ESTABLISHED

◆ FLOW_PKT_LAST_PSEUDO

◆ FLOW_PKT_TOCLIENT

◆ FLOW_PKT_TOCLIENT_FIRST

◆ FLOW_PKT_TOSERVER

◆ FLOW_PKT_TOSERVER_FIRST

◆ FLOW_PROTO_DETECT_TC_DONE

◆ FLOW_PROTO_DETECT_TS_DONE

◆ FLOW_QUIET

◆ FLOW_RESET_PE_DONE

◆ FLOW_RESET_PM_DONE

◆ FLOW_RESET_PP_DONE

◆ FLOW_SET_IPV4_DST_ADDR_FROM_PACKET

◆ FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET

◆ FLOW_SET_IPV6_DST_ADDR_FROM_PACKET

◆ FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET

◆ FLOW_SET_PE_DONE

◆ FLOW_SET_PM_DONE

◆ FLOW_SET_PP_DONE

◆ FLOW_SGH_TOCLIENT

◆ FLOW_SGH_TOSERVER

◆ FLOW_STATE_SIZE

◆ FLOW_TC_APP_UPDATE_NEXT

◆ FLOW_TC_APP_UPDATED

◆ FLOW_TC_PE_ALPROTO_DETECT_DONE

◆ FLOW_TC_PM_ALPROTO_DETECT_DONE

◆ FLOW_TC_PP_ALPROTO_DETECT_DONE

◆ FLOW_TIMEOUT_REASSEMBLY_DONE

◆ FLOW_TO_DST_SEEN

◆ FLOW_TO_SRC_SEEN

◆ FLOW_TOCLIENT_DROP_LOGGED

◆ FLOW_TOSERVER_DROP_LOGGED

◆ FLOW_TS_APP_UPDATE_NEXT

◆ FLOW_TS_APP_UPDATED

◆ FLOW_TS_PE_ALPROTO_DETECT_DONE

◆ FLOW_TS_PM_ALPROTO_DETECT_DONE

◆ FLOW_TS_PP_ALPROTO_DETECT_DONE

◆ FLOW_WRONG_THREAD

◆ FLOWFILE_INIT

◆ FLOWFILE_NO_MAGIC_TC

◆ FLOWFILE_NO_MAGIC_TS

◆ FLOWFILE_NO_MD5_TC

◆ FLOWFILE_NO_MD5_TS

◆ FLOWFILE_NO_SHA1_TC

◆ FLOWFILE_NO_SHA1_TS