suricata
flow.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __FLOW_H__
25 #define __FLOW_H__
26 
27 /* forward declaration for macset include */
28 typedef struct FlowStorageId FlowStorageId;
29 
30 #include "decode.h"
31 #include "util-var.h"
32 #include "util-atomic.h"
33 #include "util-device.h"
34 #include "detect-tag.h"
35 #include "util-macset.h"
36 #include "util-optimize.h"
37 
38 /* Part of the flow structure, so we declare it here.
39  * The actual declaration is in app-layer-parser.c */
41 
42 #define FLOW_QUIET true
43 #define FLOW_VERBOSE false
44 
45 #define TOSERVER 0
46 #define TOCLIENT 1
47 
48 /* per flow flags */
49 
50 /** At least one packet from the source address was seen */
51 #define FLOW_TO_SRC_SEEN BIT_U32(0)
52 /** At least one packet from the destination address was seen */
53 #define FLOW_TO_DST_SEEN BIT_U32(1)
54 /** Don't return this from the flow hash. It has been replaced. */
55 #define FLOW_TCP_REUSED BIT_U32(2)
56 
57 /** Flow was inspected against IP-Only sigs in the toserver direction */
58 #define FLOW_TOSERVER_IPONLY_SET BIT_U32(3)
59 /** Flow was inspected against IP-Only sigs in the toclient direction */
60 #define FLOW_TOCLIENT_IPONLY_SET BIT_U32(4)
61 
62 /** Packet belonging to this flow should not be inspected at all */
63 #define FLOW_NOPACKET_INSPECTION BIT_U32(5)
64 /** Packet payloads belonging to this flow should not be inspected */
65 #define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)
66 
67 /** All packets in this flow should be dropped */
68 #define FLOW_ACTION_DROP BIT_U32(7)
69 
70 /** Sgh for toserver direction set (even if it's NULL) */
71 #define FLOW_SGH_TOSERVER BIT_U32(8)
72 /** Sgh for toclient direction set (even if it's NULL) */
73 #define FLOW_SGH_TOCLIENT BIT_U32(9)
74 
75 /** packet to server direction has been logged in drop file (only in IPS mode) */
76 #define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)
77 /** packet to client direction has been logged in drop file (only in IPS mode) */
78 #define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)
79 
80 /** flow has alerts */
81 #define FLOW_HAS_ALERTS BIT_U32(12)
82 
83 /** Pattern matcher alproto detection done */
84 #define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)
85 /** Probing parser alproto detection done */
86 #define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)
87 /** Expectation alproto detection done */
88 #define FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)
89 /** Pattern matcher alproto detection done */
90 #define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)
91 /** Probing parser alproto detection done */
92 #define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)
93 /** Expectation alproto detection done */
94 #define FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)
95 #define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)
96 
97 /** flow is ipv4 */
98 #define FLOW_IPV4 BIT_U32(20)
99 /** flow is ipv6 */
100 #define FLOW_IPV6 BIT_U32(21)
101 
102 #define FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)
103 #define FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)
104 
105 /** Indicate that alproto detection for flow should be done again */
106 #define FLOW_CHANGE_PROTO BIT_U32(24)
107 
108 #define FLOW_WRONG_THREAD BIT_U32(25)
109 /** Protocol detection told us flow is picked up in wrong direction (midstream) */
110 #define FLOW_DIR_REVERSED BIT_U32(26)
111 /** Indicate that the flow did trigger an expectation creation */
112 #define FLOW_HAS_EXPECTATION BIT_U32(27)
113 
114 /** All packets in this flow should be passed */
115 #define FLOW_ACTION_PASS BIT_U32(28)
116 
117 /* File flags */
118 
119 #define FLOWFILE_INIT 0
120 
121 /** no magic on files in this flow */
122 #define FLOWFILE_NO_MAGIC_TS BIT_U16(0)
123 #define FLOWFILE_NO_MAGIC_TC BIT_U16(1)
124 
125 /** even if the flow has files, don't store 'm */
126 #define FLOWFILE_NO_STORE_TS BIT_U16(2)
127 #define FLOWFILE_NO_STORE_TC BIT_U16(3)
128 /** no md5 on files in this flow */
129 #define FLOWFILE_NO_MD5_TS BIT_U16(4)
130 #define FLOWFILE_NO_MD5_TC BIT_U16(5)
131 
132 /** no sha1 on files in this flow */
133 #define FLOWFILE_NO_SHA1_TS BIT_U16(6)
134 #define FLOWFILE_NO_SHA1_TC BIT_U16(7)
135 
136 /** no sha256 on files in this flow */
137 #define FLOWFILE_NO_SHA256_TS BIT_U16(8)
138 #define FLOWFILE_NO_SHA256_TC BIT_U16(9)
139 
140 /** no size tracking of files in this flow */
141 #define FLOWFILE_NO_SIZE_TS BIT_U16(10)
142 #define FLOWFILE_NO_SIZE_TC BIT_U16(11)
143 
144 #define FLOWFILE_NONE_TS (FLOWFILE_NO_MAGIC_TS | \
145  FLOWFILE_NO_STORE_TS | \
146  FLOWFILE_NO_MD5_TS | \
147  FLOWFILE_NO_SHA1_TS | \
148  FLOWFILE_NO_SHA256_TS| \
149  FLOWFILE_NO_SIZE_TS)
150 #define FLOWFILE_NONE_TC (FLOWFILE_NO_MAGIC_TC | \
151  FLOWFILE_NO_STORE_TC | \
152  FLOWFILE_NO_MD5_TC | \
153  FLOWFILE_NO_SHA1_TC | \
154  FLOWFILE_NO_SHA256_TC| \
155  FLOWFILE_NO_SIZE_TC)
156 #define FLOWFILE_NONE (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC)
157 
158 #define FLOW_IS_IPV4(f) \
159  (((f)->flags & FLOW_IPV4) == FLOW_IPV4)
160 #define FLOW_IS_IPV6(f) \
161  (((f)->flags & FLOW_IPV6) == FLOW_IPV6)
162 
163 #define FLOW_GET_SP(f) \
164  ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;
165 #define FLOW_GET_DP(f) \
166  ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;
167 
168 #define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa) do { \
169  (pa)->family = AF_INET; \
170  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
171  } while (0)
172 
173 #define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa) do { \
174  (pa)->family = AF_INET6; \
175  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
176  (pa)->addr_data32[1] = (fa)->addr_data32[1]; \
177  (pa)->addr_data32[2] = (fa)->addr_data32[2]; \
178  (pa)->addr_data32[3] = (fa)->addr_data32[3]; \
179  } while (0)
180 
181 /* Set the IPv4 addressesinto the Addrs of the Packet.
182  * Make sure p->ip4h is initialized and validated.
183  *
184  * We set the rest of the struct to 0 so we can
185  * prevent using memset. */
186 #define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a) do { \
187  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
188  (a)->addr_data32[1] = 0; \
189  (a)->addr_data32[2] = 0; \
190  (a)->addr_data32[3] = 0; \
191  } while (0)
192 
193 #define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a) do { \
194  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
195  (a)->addr_data32[1] = 0; \
196  (a)->addr_data32[2] = 0; \
197  (a)->addr_data32[3] = 0; \
198  } while (0)
199 
200 /* clear the address structure by setting all fields to 0 */
201 #define FLOW_CLEAR_ADDR(a) do { \
202  (a)->addr_data32[0] = 0; \
203  (a)->addr_data32[1] = 0; \
204  (a)->addr_data32[2] = 0; \
205  (a)->addr_data32[3] = 0; \
206  } while (0)
207 
208 /* Set the IPv6 addressesinto the Addrs of the Packet.
209  * Make sure p->ip6h is initialized and validated. */
210 #define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a) do { \
211  (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
212  (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
213  (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
214  (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
215  } while (0)
216 
217 #define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a) do { \
218  (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
219  (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
220  (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
221  (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
222  } while (0)
223 
224 /* pkt flow flags */
225 #define FLOW_PKT_TOSERVER 0x01
226 #define FLOW_PKT_TOCLIENT 0x02
227 #define FLOW_PKT_ESTABLISHED 0x04
228 #define FLOW_PKT_TOSERVER_IPONLY_SET 0x08
229 #define FLOW_PKT_TOCLIENT_IPONLY_SET 0x10
230 #define FLOW_PKT_TOSERVER_FIRST 0x20
231 #define FLOW_PKT_TOCLIENT_FIRST 0x40
232 /** last pseudo packet in the flow. Can be used to trigger final clean,
233  * logging, etc. */
234 #define FLOW_PKT_LAST_PSEUDO 0x80
235 
236 #define FLOW_END_FLAG_STATE_NEW 0x01
237 #define FLOW_END_FLAG_STATE_ESTABLISHED 0x02
238 #define FLOW_END_FLAG_STATE_CLOSED 0x04
239 #define FLOW_END_FLAG_EMERGENCY 0x08
240 #define FLOW_END_FLAG_TIMEOUT 0x10
241 #define FLOW_END_FLAG_FORCED 0x20
242 #define FLOW_END_FLAG_SHUTDOWN 0x40
243 #define FLOW_END_FLAG_STATE_BYPASSED 0x80
244 
245 /** Mutex or RWLocks for the flow. */
246 //#define FLOWLOCK_RWLOCK
247 #define FLOWLOCK_MUTEX
248 
249 #ifdef FLOWLOCK_RWLOCK
250  #ifdef FLOWLOCK_MUTEX
251  #error Cannot enable both FLOWLOCK_RWLOCK and FLOWLOCK_MUTEX
252  #endif
253 #endif
254 
255 #ifdef FLOWLOCK_RWLOCK
256  #define FLOWLOCK_INIT(fb) SCRWLockInit(&(fb)->r, NULL)
257  #define FLOWLOCK_DESTROY(fb) SCRWLockDestroy(&(fb)->r)
258  #define FLOWLOCK_RDLOCK(fb) SCRWLockRDLock(&(fb)->r)
259  #define FLOWLOCK_WRLOCK(fb) SCRWLockWRLock(&(fb)->r)
260  #define FLOWLOCK_TRYRDLOCK(fb) SCRWLockTryRDLock(&(fb)->r)
261  #define FLOWLOCK_TRYWRLOCK(fb) SCRWLockTryWRLock(&(fb)->r)
262  #define FLOWLOCK_UNLOCK(fb) SCRWLockUnlock(&(fb)->r)
263 #elif defined FLOWLOCK_MUTEX
264  #define FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)
265  #define FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)
266  #define FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m)
267  #define FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m)
268  #define FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m)
269  #define FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m)
270  #define FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)
271 #else
272  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
273 #endif
274 
275 #define FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))
276 #define FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))
277 #define FLOW_IS_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))
278 
279 #define FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE))
280 #define FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE))
281 #define FLOW_SET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PE_ALPROTO_DETECT_DONE))
282 
283 #define FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))
284 #define FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))
285 #define FLOW_RESET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))
286 
287 /* global flow config */
288 typedef struct FlowCnf_
289 {
290  uint32_t hash_rand;
291  uint32_t hash_size;
292  uint32_t max_flows;
293  uint32_t prealloc;
294 
295  uint32_t timeout_new;
296  uint32_t timeout_est;
297 
301 
302  SC_ATOMIC_DECLARE(uint64_t, memcap);
304 
305 /* Hash key for the flow hash */
306 typedef struct FlowKey_
307 {
310  uint8_t proto;
312  uint16_t vlan_id[2];
314 
315 typedef struct FlowAddress_ {
316  union {
317  uint32_t address_un_data32[4]; /* type-specific field */
318  uint16_t address_un_data16[8]; /* type-specific field */
319  uint8_t address_un_data8[16]; /* type-specific field */
322 
323 #define addr_data32 address.address_un_data32
324 #define addr_data16 address.address_un_data16
325 #define addr_data8 address.address_un_data8
326 
327 typedef unsigned short FlowRefCount;
328 
329 typedef unsigned short FlowStateType;
330 
331 /** Local Thread ID */
332 typedef uint16_t FlowThreadId;
333 
334 /**
335  * \brief Flow data structure.
336  *
337  * The flow is a global data structure that is created for new packets of a
338  * flow and then looked up for the following packets of a flow.
339  *
340  * Locking
341  *
342  * The flow is updated/used by multiple packets at the same time. This is why
343  * there is a flow-mutex. It's a mutex and not a spinlock because some
344  * operations on the flow can be quite expensive, thus spinning would be
345  * too expensive.
346  *
347  * The flow "header" (addresses, ports, proto, recursion level) are static
348  * after the initialization and remain read-only throughout the entire live
349  * of a flow. This is why we can access those without protection of the lock.
350  */
351 
352 typedef struct Flow_
353 {
354  /* flow "header", used for hashing and flow lookup. Static after init,
355  * so safe to look at without lock */
357  union {
358  Port sp; /**< tcp/udp source port */
359  struct {
360  uint8_t type; /**< icmp type */
361  uint8_t code; /**< icmp code */
363 
364  struct {
365  uint32_t spi; /**< esp spi */
366  } esp;
367  };
368  union {
369  Port dp; /**< tcp/udp destination port */
370  struct {
371  uint8_t type; /**< icmp type */
372  uint8_t code; /**< icmp code */
374  };
375  uint8_t proto;
377  uint16_t vlan_id[2];
378  /** how many references exist to this flow *right now*
379  *
380  * On receiving a packet the counter is incremented while the flow
381  * bucked is locked, which is also the case on timeout pruning.
382  */
384 
385  uint8_t vlan_idx;
386 
387  /* track toserver/toclient flow timeout needs */
388  union {
389  struct {
390  uint8_t ffr_ts:4;
391  uint8_t ffr_tc:4;
392  };
393  uint8_t ffr;
394  };
395 
396  /** timestamp in seconds of the moment this flow will timeout
397  * according to the timeout policy. Does *not* take emergency
398  * mode into account. */
399  uint32_t timeout_at;
400 
401  /** Thread ID for the stream/detect portion of this flow */
403 
404  struct Flow_ *next; /* (hash) list next */
405  /** Incoming interface */
407 
408  /** flow hash - the flow hash before hash table size mod. */
409  uint32_t flow_hash;
410 
411  /* time stamp of last update (last packet). Set/updated under the
412  * flow and flow hash row locks, safe to read under either the
413  * flow lock or flow hash row lock. */
414  struct timeval lastts;
415 
416  /* end of flow "header" */
417 
418  /** timeout policy value in seconds to add to the lastts.tv_sec
419  * when a packet has been received. */
420  uint32_t timeout_policy;
421 
423 
424  /** flow tenant id, used to setup flow timeout and stream pseudo
425  * packets with the correct tenant id set */
426  uint32_t tenant_id;
427 
430 
431  uint32_t flags; /**< generic flags */
432 
433  uint16_t file_flags; /**< file tracking/extraction flags */
434 
435  /** destination port to be used in protocol detection. This is meant
436  * for use with STARTTLS and HTTP CONNECT detection */
437  uint16_t protodetect_dp; /**< 0 if not used */
438 
439  /* Parent flow id for protocol like ftp */
440  int64_t parent_id;
441 
442 #ifdef FLOWLOCK_RWLOCK
443  SCRWLock r;
444 #elif defined FLOWLOCK_MUTEX
446 #else
447  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
448 #endif
449 
450  /** protocol specific data pointer, e.g. for TcpSession */
451  void *protoctx;
452 
453  /** mapping to Flow's protocol specific protocols for timeouts
454  and state and free functions. */
455  uint8_t protomap;
456 
457  uint8_t flow_end_flags;
458  /* coccinelle: Flow:flow_end_flags:FLOW_END_FLAG_ */
459 
460  AppProto alproto; /**< \brief application level protocol */
463 
464  /** original application level protocol. Used to indicate the previous
465  protocol when changing to another protocol , e.g. with STARTTLS. */
467  /** expected app protocol: used in protocol change/upgrade like in
468  * STARTTLS. */
470 
471  /** detection engine ctx version used to inspect this flow. Set at initial
472  * inspection. If it doesn't match the currently in use de_ctx, the
473  * stored sgh ptrs are reset. */
474  uint32_t de_ctx_version;
475 
476  /** ttl tracking */
481 
482  /** application level storage ptrs.
483  *
484  */
485  AppLayerParserState *alparser; /**< parser internal state */
486  void *alstate; /**< application layer state */
487 
488  /** toclient sgh for this flow. Only use when FLOW_SGH_TOCLIENT flow flag
489  * has been set. */
491  /** toserver sgh for this flow. Only use when FLOW_SGH_TOSERVER flow flag
492  * has been set. */
494 
495  /* pointer to the var list */
497 
498  struct FlowBucket_ *fb;
499 
500  struct timeval startts;
501 
502  uint32_t todstpktcnt;
503  uint32_t tosrcpktcnt;
504  uint64_t todstbytecnt;
505  uint64_t tosrcbytecnt;
507 
508 enum FlowState {
513 #ifdef CAPTURE_OFFLOAD
514  FLOW_STATE_CAPTURE_BYPASSED,
515 #endif
516 };
517 
518 typedef struct FlowProtoTimeout_ {
519  uint32_t new_timeout;
520  uint32_t est_timeout;
521  uint32_t closed_timeout;
524 
525 typedef struct FlowProtoFreeFunc_ {
526  void (*Freefunc)(void *);
528 
529 typedef struct FlowBypassInfo_ {
530  bool (* BypassUpdate)(Flow *f, void *data, time_t tsec);
531  void (* BypassFree)(void *data);
532  void *bypass_data;
533  uint64_t tosrcpktcnt;
534  uint64_t tosrcbytecnt;
535  uint64_t todstpktcnt;
536  uint64_t todstbytecnt;
538 
539 #include "flow-queue.h"
540 
541 typedef struct FlowLookupStruct_ // TODO name
542 {
543  /** thread store of spare queues */
549 
550 /** \brief prepare packet for a life with flow
551  * Set PKT_WANTS_FLOW flag to incidate workers should do a flow lookup
552  * and calc the hash value to be used in the lookup and autofp flow
553  * balancing. */
554 void FlowSetupPacket(Packet *p);
556 void FlowInitConfig(bool);
557 void FlowPrintQueueInfo (void);
558 void FlowShutdown(void);
559 void FlowSetIPOnlyFlag(Flow *, int);
560 void FlowSetHasAlertsFlag(Flow *);
561 int FlowHasAlerts(const Flow *);
564 int FlowChangeProto(Flow *);
565 void FlowSwap(Flow *);
566 
567 void FlowRegisterTests (void);
568 int FlowSetProtoTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t);
569 int FlowSetProtoEmergencyTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t);
570 int FlowSetProtoFreeFunc (uint8_t , void (*Free)(void *));
572 
574 
575 static inline void FlowSetNoPacketInspectionFlag(Flow *);
576 static inline void FlowSetNoPayloadInspectionFlag(Flow *);
577 
578 int FlowGetPacketDirection(const Flow *, const Packet *);
579 
580 void FlowCleanupAppLayer(Flow *);
581 
582 void FlowUpdateState(Flow *f, enum FlowState s);
583 
584 int FlowSetMemcap(uint64_t size);
585 uint64_t FlowGetMemcap(void);
586 uint64_t FlowGetMemuse(void);
587 
589 void RegisterFlowBypassInfo(void);
590 
591 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs);
592 uint32_t FlowGetFlags(Flow *flow);
593 uint16_t FlowGetSourcePort(Flow *flow);
594 uint16_t FlowGetDestinationPort(Flow *flow);
595 
596 /** ----- Inline functions ----- */
597 
598 /** \brief Set the No Packet Inspection Flag without locking the flow.
599  *
600  * \param f Flow to set the flag in
601  */
602 static inline void FlowSetNoPacketInspectionFlag(Flow *f)
603 {
604  SCEnter();
605 
606  SCLogDebug("flow %p", f);
608 
609  SCReturn;
610 }
611 
612 /** \brief Set the No payload inspection Flag without locking the flow.
613  *
614  * \param f Flow to set the flag in
615  */
616 static inline void FlowSetNoPayloadInspectionFlag(Flow *f)
617 {
618  SCEnter();
619 
620  SCLogDebug("flow %p", f);
622 
623  SCReturn;
624 }
625 
626 /**
627  * \brief increase the use count of a flow
628  *
629  * \param f flow to decrease use count for
630  */
631 static inline void FlowIncrUsecnt(Flow *f)
632 {
633  if (f == NULL)
634  return;
635 
636  f->use_cnt++;
637 }
638 
639 /**
640  * \brief decrease the use count of a flow
641  *
642  * \param f flow to decrease use count for
643  */
644 static inline void FlowDecrUsecnt(Flow *f)
645 {
646  if (f == NULL)
647  return;
648 
649  f->use_cnt--;
650 }
651 
652 /** \brief Reference the flow, bumping the flows use_cnt
653  * \note This should only be called once for a destination
654  * pointer */
655 static inline void FlowReference(Flow **d, Flow *f)
656 {
657  if (likely(f != NULL)) {
658 #ifdef DEBUG_VALIDATION
659  BUG_ON(*d == f);
660 #else
661  if (*d == f)
662  return;
663 #endif
664  FlowIncrUsecnt(f);
665  *d = f;
666  }
667 }
668 
669 static inline void FlowDeReference(Flow **d)
670 {
671  if (likely(*d != NULL)) {
672  FlowDecrUsecnt(*d);
673  *d = NULL;
674  }
675 }
676 
677 /** \brief create a flow id that is as unique as possible
678  * \retval flow_id signed 64bit id
679  * \note signed because of the signedness of json_integer_t in
680  * the json output
681  */
682 static inline int64_t FlowGetId(const Flow *f)
683 {
684  int64_t id = (int64_t)f->flow_hash << 31 |
685  (int64_t)(f->startts.tv_sec & 0x0000FFFF) << 16 |
686  (int64_t)(f->startts.tv_usec & 0x0000FFFF);
687  /* reduce to 51 bits as Javascript and even JSON often seem to
688  * max out there. */
689  id &= 0x7ffffffffffffLL;
690  return id;
691 }
692 
693 static inline void FlowSetEndFlags(Flow *f)
694 {
695  const int state = f->flow_state;
696  if (state == FLOW_STATE_NEW)
698  else if (state == FLOW_STATE_ESTABLISHED)
700  else if (state == FLOW_STATE_CLOSED)
702  else if (state == FLOW_STATE_LOCAL_BYPASSED)
704 #ifdef CAPTURE_OFFLOAD
705  else if (state == FLOW_STATE_CAPTURE_BYPASSED)
707 #endif
708 }
709 
710 int FlowClearMemory(Flow *,uint8_t );
711 
713 void *FlowGetAppState(const Flow *f);
714 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags);
715 
717 
718 #endif /* __FLOW_H__ */
FlowStorageId
Definition: flow-storage.h:32
Flow_::ffr_tc
uint8_t ffr_tc
Definition: flow.h:391
FlowLookupStruct_::work_queue
FlowQueuePrivate work_queue
Definition: flow.h:546
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:115
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1121
FlowBucket_
Definition: flow-hash.h:41
Flow_::ffr_ts
uint8_t ffr_ts
Definition: flow.h:390
Flow_::recursion_level
uint8_t recursion_level
Definition: flow.h:376
FlowSetProtoEmergencyTimeout
int FlowSetProtoEmergencyTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
FlowAddress_
Definition: flow.h:315
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:510
FlowLookupStruct_::dtv
DecodeThreadVars * dtv
Definition: flow.h:545
Flow_::startts
struct timeval startts
Definition: flow.h:500
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1346
FlowKey_::src
Address src
Definition: flow.h:308
FLOW_END_FLAG_STATE_NEW
#define FLOW_END_FLAG_STATE_NEW
Definition: flow.h:236
FlowBypassInfo_
Definition: flow.h:529
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:300
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:291
FlowHandlePacket
void FlowHandlePacket(ThreadVars *, FlowLookupStruct *, Packet *)
Entry point for packet flow handling.
Definition: flow.c:507
FlowAddress_::address_un_data32
uint32_t address_un_data32[4]
Definition: flow.h:317
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
FlowUpdateSpareFlows
int FlowUpdateSpareFlows(void)
FlowLookupStruct
struct FlowLookupStruct_ FlowLookupStruct
Flow_::proto
uint8_t proto
Definition: flow.h:375
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:77
FlowInitConfig
void FlowInitConfig(bool)
initialize the configuration
Definition: flow.c:523
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *, const Packet *)
determine the direction of the packet compared to the flow
Definition: flow.c:292
FlowClearMemory
int FlowClearMemory(Flow *, uint8_t)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1067
util-macset.h
Flow_
Flow data structure.
Definition: flow.h:353
Flow_::protomap
uint8_t protomap
Definition: flow.h:455
LiveDevice_
Definition: util-device.h:40
FlowProtoTimeout_
Definition: flow.h:518
FLOW_END_FLAG_STATE_ESTABLISHED
#define FLOW_END_FLAG_STATE_ESTABLISHED
Definition: flow.h:237
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:65
FlowLookupStruct_
Definition: flow.h:542
Flow_::alproto_orig
AppProto alproto_orig
Definition: flow.h:466
Flow_::vlan_id
uint16_t vlan_id[2]
Definition: flow.h:377
Flow
struct Flow_ Flow
Flow data structure.
FLOW_END_FLAG_STATE_BYPASSED
#define FLOW_END_FLAG_STATE_BYPASSED
Definition: flow.h:243
Flow_::use_cnt
FlowRefCount use_cnt
Definition: flow.h:383
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:522
FlowBypassInfo_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:534
FlowCnf_::emerg_timeout_new
uint32_t emerg_timeout_new
Definition: flow.h:298
Address_
Definition: decode.h:119
FlowSetupPacket
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow look...
Definition: flow-hash.c:431
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:478
Flow_::dp
Port dp
Definition: flow.h:369
FlowGetAppState
void * FlowGetAppState(const Flow *f)
Definition: flow.c:1109
detect-tag.h
Flow_::protoctx
void * protoctx
Definition: flow.h:451
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:202
util-var.h
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:293
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:422
Flow_::spi
uint32_t spi
Definition: flow.h:365
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:493
FlowLookupStruct_::emerg_spare_sync_stamp
uint32_t emerg_spare_sync_stamp
Definition: flow.h:547
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:505
FlowConfig
struct FlowCnf_ FlowConfig
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:485
Flow_::dst
FlowAddress dst
Definition: flow.h:356
FlowProtoFreeFunc
struct FlowProtoFreeFunc_ FlowProtoFreeFunc
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:498
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:512
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:477
Flow_::protodetect_dp
uint16_t protodetect_dp
Definition: flow.h:437
decode.h
util-device.h
FlowBypassInfo_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:536
FlowGetDestinationPort
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
Definition: flow.c:1199
AppLayerParserState_
Definition: app-layer-parser.c:153
RegisterFlowBypassInfo
void RegisterFlowBypassInfo(void)
Definition: flow-util.c:238
FlowBypassInfo_::BypassUpdate
bool(* BypassUpdate)(Flow *f, void *data, time_t tsec)
Definition: flow.h:530
FlowBypassInfo_::BypassFree
void(* BypassFree)(void *data)
Definition: flow.h:531
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:502
FlowSetProtoTimeout
int FlowSetProtoTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *, int)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:158
FlowSwap
void FlowSwap(Flow *)
swap the flow's direction
Definition: flow.c:261
FlowKey_::recursion_level
uint8_t recursion_level
Definition: flow.h:311
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:651
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:136
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:457
FlowCnf_
Definition: flow.h:289
FlowState
FlowState
Definition: flow.h:508
FlowBypassInfo_::todstpktcnt
uint64_t todstpktcnt
Definition: flow.h:535
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:519
util-atomic.h
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:521
FlowBypassInfo_::bypass_data
void * bypass_data
Definition: flow.h:532
Flow_::m
SCMutex m
Definition: flow.h:445
FlowBypassInfo
struct FlowBypassInfo_ FlowBypassInfo
FlowCnf_::timeout_new
uint32_t timeout_new
Definition: flow.h:295
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:504
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1175
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:277
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:490
FlowPrintQueueInfo
void FlowPrintQueueInfo(void)
FlowChangeProto
int FlowChangeProto(Flow *)
Check if change proto flag is set for flow.
Definition: flow.c:212
FlowThreadId
uint16_t FlowThreadId
Definition: flow.h:332
FlowKey_::sp
Port sp
Definition: flow.h:309
SCReturn
#define SCReturn
Definition: util-debug.h:302
Packet_
Definition: decode.h:414
Flow_::type
uint8_t type
Definition: flow.h:360
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1427
Port
uint16_t Port
Definition: decode.h:243
FlowKey_::vlan_id
uint16_t vlan_id[2]
Definition: flow.h:312
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:526
FlowAddress_::address_un_data16
uint16_t address_un_data16[8]
Definition: flow.h:318
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:290
Flow_::vlan_idx
uint8_t vlan_idx
Definition: flow.h:385
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:390
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:479
FlowGetFlags
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
Definition: flow.c:1210
flow-queue.h
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *)
Definition: flow.c:142
FlowBypassInfo_::tosrcpktcnt
uint64_t tosrcpktcnt
Definition: flow.h:533
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:429
FlowCnf_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(uint64_t, memcap)
Flow_::flow_hash
uint32_t flow_hash
Definition: flow.h:409
Flow_::alproto_expect
AppProto alproto_expect
Definition: flow.h:469
GetFlowBypassInfoID
FlowStorageId GetFlowBypassInfoID(void)
Definition: flow-util.c:220
Flow_::src
FlowAddress src
Definition: flow.h:356
Flow_::flowvar
GenericVar * flowvar
Definition: flow.h:496
Flow_::next
struct Flow_ * next
Definition: flow.h:404
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:428
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
Flow_::lastts
struct timeval lastts
Definition: flow.h:414
FlowLookupStruct_::spare_queue
FlowQueuePrivate spare_queue
Definition: flow.h:544
FlowProtoTimeout
struct FlowProtoTimeout_ FlowProtoTimeout
Flow_::ffr
uint8_t ffr
Definition: flow.h:393
FlowCnf_::emerg_timeout_est
uint32_t emerg_timeout_est
Definition: flow.h:299
FlowStateType
unsigned short FlowStateType
Definition: flow.h:329
flags
uint8_t flags
Definition: decode-gre.h:0
FLOW_STATE_NEW
@ FLOW_STATE_NEW
Definition: flow.h:509
Flow_::code
uint8_t code
Definition: flow.h:361
GenericVar_
Definition: util-var.h:48
FlowAddress
struct FlowAddress_ FlowAddress
FlowKey_::dst
Address dst
Definition: flow.h:308
FlowCnf_::max_flows
uint32_t max_flows
Definition: flow.h:292
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:480
Flow_::parent_id
int64_t parent_id
Definition: flow.h:440
FLOW_END_FLAG_STATE_CLOSED
#define FLOW_END_FLAG_STATE_CLOSED
Definition: flow.h:238
Flow_::icmp_d
struct Flow_::@114::@120 icmp_d
FlowCnf_::timeout_est
uint32_t timeout_est
Definition: flow.h:296
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:420
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
Flow_::icmp_s
struct Flow_::@112::@118 icmp_s
Flow_::livedev
struct LiveDevice_ * livedev
Definition: flow.h:406
util-optimize.h
FlowQueuePrivate_
Definition: flow-queue.h:41
FlowAddress_::address_un_data8
uint8_t address_un_data8[16]
Definition: flow.h:319
FlowKey_::proto
uint8_t proto
Definition: flow.h:310
FLOW_STATE_CLOSED
@ FLOW_STATE_CLOSED
Definition: flow.h:511
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:638
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:461
Flow_::alstate
void * alstate
Definition: flow.h:486
Flow_::flags
uint32_t flags
Definition: flow.h:431
FlowAddress_::address
union FlowAddress_::@111 address
FlowGetAppProtocol
AppProto FlowGetAppProtocol(const Flow *f)
Definition: flow.c:1104
SCRWLock
#define SCRWLock
Definition: threads-debug.h:363
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:130
FlowKey_
Definition: flow.h:307
likely
#define likely(expr)
Definition: util-optimize.h:32
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:63
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:520
Flow_::sp
Port sp
Definition: flow.h:358
FlowRefCount
unsigned short FlowRefCount
Definition: flow.h:327
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:462
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *)
Set flag to indicate to change proto for the flow.
Definition: flow.c:193
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:433
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:460
FlowUpdateState
void FlowUpdateState(Flow *f, enum FlowState s)
Definition: flow.c:1142
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:399
FlowKey_::dp
Port dp
Definition: flow.h:309
FlowUpdateQueue
void FlowUpdateQueue(Flow *)
FlowKey
struct FlowKey_ FlowKey
SCMutex
#define SCMutex
Definition: threads-debug.h:114
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1095
Flow_::tenant_id
uint32_t tenant_id
Definition: flow.h:426
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:503
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *)
Set flag to indicate that flow has alerts.
Definition: flow.c:169
FlowGetSourcePort
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
Definition: flow.c:1187
Flow_::thread_id
FlowThreadId thread_id[2]
Definition: flow.h:402
FlowHasAlerts
int FlowHasAlerts(const Flow *)
Check if flow has alerts.
Definition: flow.c:180
FlowProtoFreeFunc_
Definition: flow.h:525
Flow_::de_ctx_version
uint32_t de_ctx_version
Definition: flow.h:474
Flow_::esp
struct Flow_::@112::@119 esp