suricata
flow.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __FLOW_H__
25 #define __FLOW_H__
26 
27 #include "decode.h"
28 #include "util-var.h"
29 #include "util-atomic.h"
30 #include "detect-tag.h"
31 #include "util-optimize.h"
32 
33 /* Part of the flow structure, so we declare it here.
34  * The actual declaration is in app-layer-parser.c */
36 
37 #define FLOW_QUIET TRUE
38 #define FLOW_VERBOSE FALSE
39 
40 #define TOSERVER 0
41 #define TOCLIENT 1
42 
43 /* per flow flags */
44 
45 /** At least one packet from the source address was seen */
46 #define FLOW_TO_SRC_SEEN BIT_U32(0)
47 /** At least one packet from the destination address was seen */
48 #define FLOW_TO_DST_SEEN BIT_U32(1)
49 /** Don't return this from the flow hash. It has been replaced. */
50 #define FLOW_TCP_REUSED BIT_U32(2)
51 
52 /** Flow was inspected against IP-Only sigs in the toserver direction */
53 #define FLOW_TOSERVER_IPONLY_SET BIT_U32(3)
54 /** Flow was inspected against IP-Only sigs in the toclient direction */
55 #define FLOW_TOCLIENT_IPONLY_SET BIT_U32(4)
56 
57 /** Packet belonging to this flow should not be inspected at all */
58 #define FLOW_NOPACKET_INSPECTION BIT_U32(5)
59 /** Packet payloads belonging to this flow should not be inspected */
60 #define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)
61 
62 /** All packets in this flow should be dropped */
63 #define FLOW_ACTION_DROP BIT_U32(7)
64 
65 /** Sgh for toserver direction set (even if it's NULL) */
66 #define FLOW_SGH_TOSERVER BIT_U32(8)
67 /** Sgh for toclient direction set (even if it's NULL) */
68 #define FLOW_SGH_TOCLIENT BIT_U32(9)
69 
70 /** packet to server direction has been logged in drop file (only in IPS mode) */
71 #define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)
72 /** packet to client direction has been logged in drop file (only in IPS mode) */
73 #define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)
74 
75 /** flow has alerts */
76 #define FLOW_HAS_ALERTS BIT_U32(12)
77 
78 /** Pattern matcher alproto detection done */
79 #define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)
80 /** Probing parser alproto detection done */
81 #define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)
82 /** Expectation alproto detection done */
83 #define FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)
84 /** Pattern matcher alproto detection done */
85 #define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)
86 /** Probing parser alproto detection done */
87 #define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)
88 /** Expectation alproto detection done */
89 #define FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)
90 #define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)
91 
92 /** flow is ipv4 */
93 #define FLOW_IPV4 BIT_U32(20)
94 /** flow is ipv6 */
95 #define FLOW_IPV6 BIT_U32(21)
96 
97 #define FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)
98 #define FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)
99 
100 /** Indicate that alproto detection for flow should be done again */
101 #define FLOW_CHANGE_PROTO BIT_U32(24)
102 
103 #define FLOW_WRONG_THREAD BIT_U32(25)
104 
105 /* File flags */
106 
107 /** no magic on files in this flow */
108 #define FLOWFILE_NO_MAGIC_TS BIT_U16(0)
109 #define FLOWFILE_NO_MAGIC_TC BIT_U16(1)
110 
111 /** even if the flow has files, don't store 'm */
112 #define FLOWFILE_NO_STORE_TS BIT_U16(2)
113 #define FLOWFILE_NO_STORE_TC BIT_U16(3)
114 /** no md5 on files in this flow */
115 #define FLOWFILE_NO_MD5_TS BIT_U16(4)
116 #define FLOWFILE_NO_MD5_TC BIT_U16(5)
117 
118 /** no sha1 on files in this flow */
119 #define FLOWFILE_NO_SHA1_TS BIT_U16(6)
120 #define FLOWFILE_NO_SHA1_TC BIT_U16(7)
121 
122 /** no sha256 on files in this flow */
123 #define FLOWFILE_NO_SHA256_TS BIT_U16(8)
124 #define FLOWFILE_NO_SHA256_TC BIT_U16(9)
125 
126 /** no size tracking of files in this flow */
127 #define FLOWFILE_NO_SIZE_TS BIT_U16(10)
128 #define FLOWFILE_NO_SIZE_TC BIT_U16(11)
129 
130 
131 #define FLOW_IS_IPV4(f) \
132  (((f)->flags & FLOW_IPV4) == FLOW_IPV4)
133 #define FLOW_IS_IPV6(f) \
134  (((f)->flags & FLOW_IPV6) == FLOW_IPV6)
135 
136 #define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa) do { \
137  (pa)->family = AF_INET; \
138  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
139  } while (0)
140 
141 #define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa) do { \
142  (pa)->family = AF_INET6; \
143  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
144  (pa)->addr_data32[1] = (fa)->addr_data32[1]; \
145  (pa)->addr_data32[2] = (fa)->addr_data32[2]; \
146  (pa)->addr_data32[3] = (fa)->addr_data32[3]; \
147  } while (0)
148 
149 /* Set the IPv4 addressesinto the Addrs of the Packet.
150  * Make sure p->ip4h is initialized and validated.
151  *
152  * We set the rest of the struct to 0 so we can
153  * prevent using memset. */
154 #define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a) do { \
155  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
156  (a)->addr_data32[1] = 0; \
157  (a)->addr_data32[2] = 0; \
158  (a)->addr_data32[3] = 0; \
159  } while (0)
160 
161 #define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a) do { \
162  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
163  (a)->addr_data32[1] = 0; \
164  (a)->addr_data32[2] = 0; \
165  (a)->addr_data32[3] = 0; \
166  } while (0)
167 
168 /* clear the address structure by setting all fields to 0 */
169 #define FLOW_CLEAR_ADDR(a) do { \
170  (a)->addr_data32[0] = 0; \
171  (a)->addr_data32[1] = 0; \
172  (a)->addr_data32[2] = 0; \
173  (a)->addr_data32[3] = 0; \
174  } while (0)
175 
176 /* Set the IPv6 addressesinto the Addrs of the Packet.
177  * Make sure p->ip6h is initialized and validated. */
178 #define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a) do { \
179  (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
180  (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
181  (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
182  (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
183  } while (0)
184 
185 #define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a) do { \
186  (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
187  (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
188  (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
189  (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
190  } while (0)
191 
192 /* pkt flow flags */
193 #define FLOW_PKT_TOSERVER 0x01
194 #define FLOW_PKT_TOCLIENT 0x02
195 #define FLOW_PKT_ESTABLISHED 0x04
196 #define FLOW_PKT_TOSERVER_IPONLY_SET 0x08
197 #define FLOW_PKT_TOCLIENT_IPONLY_SET 0x10
198 #define FLOW_PKT_TOSERVER_FIRST 0x20
199 #define FLOW_PKT_TOCLIENT_FIRST 0x40
200 
201 #define FLOW_END_FLAG_STATE_NEW 0x01
202 #define FLOW_END_FLAG_STATE_ESTABLISHED 0x02
203 #define FLOW_END_FLAG_STATE_CLOSED 0x04
204 #define FLOW_END_FLAG_EMERGENCY 0x08
205 #define FLOW_END_FLAG_TIMEOUT 0x10
206 #define FLOW_END_FLAG_FORCED 0x20
207 #define FLOW_END_FLAG_SHUTDOWN 0x40
208 #define FLOW_END_FLAG_STATE_BYPASSED 0x80
209 
210 /** Mutex or RWLocks for the flow. */
211 //#define FLOWLOCK_RWLOCK
212 #define FLOWLOCK_MUTEX
213 
214 #ifdef FLOWLOCK_RWLOCK
215  #ifdef FLOWLOCK_MUTEX
216  #error Cannot enable both FLOWLOCK_RWLOCK and FLOWLOCK_MUTEX
217  #endif
218 #endif
219 
220 #ifdef FLOWLOCK_RWLOCK
221  #define FLOWLOCK_INIT(fb) SCRWLockInit(&(fb)->r, NULL)
222  #define FLOWLOCK_DESTROY(fb) SCRWLockDestroy(&(fb)->r)
223  #define FLOWLOCK_RDLOCK(fb) SCRWLockRDLock(&(fb)->r)
224  #define FLOWLOCK_WRLOCK(fb) SCRWLockWRLock(&(fb)->r)
225  #define FLOWLOCK_TRYRDLOCK(fb) SCRWLockTryRDLock(&(fb)->r)
226  #define FLOWLOCK_TRYWRLOCK(fb) SCRWLockTryWRLock(&(fb)->r)
227  #define FLOWLOCK_UNLOCK(fb) SCRWLockUnlock(&(fb)->r)
228 #elif defined FLOWLOCK_MUTEX
229  #define FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)
230  #define FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)
231  #define FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m)
232  #define FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m)
233  #define FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m)
234  #define FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m)
235  #define FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)
236 #else
237  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
238 #endif
239 
240 #define FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))
241 #define FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))
242 #define FLOW_IS_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))
243 
244 #define FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE))
245 #define FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE))
246 #define FLOW_SET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PE_ALPROTO_DETECT_DONE))
247 
248 #define FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))
249 #define FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))
250 #define FLOW_RESET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))
251 
252 /* global flow config */
253 typedef struct FlowCnf_
254 {
255  uint32_t hash_rand;
256  uint32_t hash_size;
257  uint32_t max_flows;
258  uint32_t prealloc;
259 
260  uint32_t timeout_new;
261  uint32_t timeout_est;
262 
266 
267  SC_ATOMIC_DECLARE(uint64_t, memcap);
268 } FlowConfig;
269 
270 /* Hash key for the flow hash */
271 typedef struct FlowKey_
272 {
274  Port sp, dp;
275  uint8_t proto;
277 
278 } FlowKey;
279 
280 typedef struct FlowAddress_ {
281  union {
282  uint32_t address_un_data32[4]; /* type-specific field */
283  uint16_t address_un_data16[8]; /* type-specific field */
284  uint8_t address_un_data8[16]; /* type-specific field */
285  } address;
286 } FlowAddress;
287 
288 #define addr_data32 address.address_un_data32
289 #define addr_data16 address.address_un_data16
290 #define addr_data8 address.address_un_data8
291 
292 #ifdef __tile__
293 /* Atomic Ints performance better on Tile. */
294 typedef unsigned int FlowRefCount;
295 #else
296 typedef unsigned short FlowRefCount;
297 #endif
298 
299 #ifdef __tile__
300 /* Atomic Ints performance better on Tile. */
301 typedef unsigned int FlowStateType;
302 #else
303 typedef unsigned short FlowStateType;
304 #endif
305 
306 /** Local Thread ID */
307 typedef uint16_t FlowThreadId;
308 
309 /**
310  * \brief Flow data structure.
311  *
312  * The flow is a global data structure that is created for new packets of a
313  * flow and then looked up for the following packets of a flow.
314  *
315  * Locking
316  *
317  * The flow is updated/used by multiple packets at the same time. This is why
318  * there is a flow-mutex. It's a mutex and not a spinlock because some
319  * operations on the flow can be quite expensive, thus spinning would be
320  * too expensive.
321  *
322  * The flow "header" (addresses, ports, proto, recursion level) are static
323  * after the initialization and remain read-only throughout the entire live
324  * of a flow. This is why we can access those without protection of the lock.
325  */
326 
327 typedef struct Flow_
328 {
329  /* flow "header", used for hashing and flow lookup. Static after init,
330  * so safe to look at without lock */
332  union {
333  Port sp; /**< tcp/udp source port */
334  struct {
335  uint8_t type; /**< icmp type */
336  uint8_t code; /**< icmp code */
337  } icmp_s;
338  };
339  union {
340  Port dp; /**< tcp/udp destination port */
341  struct {
342  uint8_t type; /**< icmp type */
343  uint8_t code; /**< icmp code */
344  } icmp_d;
345  };
346  uint8_t proto;
348  uint16_t vlan_id[2];
349 
350  /** flow hash - the flow hash before hash table size mod. */
351  uint32_t flow_hash;
352 
353  /* time stamp of last update (last packet). Set/updated under the
354  * flow and flow hash row locks, safe to read under either the
355  * flow lock or flow hash row lock. */
356  struct timeval lastts;
357 
358  /* end of flow "header" */
359 
360  SC_ATOMIC_DECLARE(FlowStateType, flow_state);
361 
362  /** how many pkts and stream msgs are using the flow *right now*. This
363  * variable is atomic so not protected by the Flow mutex "m".
364  *
365  * On receiving a packet the counter is incremented while the flow
366  * bucked is locked, which is also the case on timeout pruning.
367  */
369 
370  /** flow tenant id, used to setup flow timeout and stream pseudo
371  * packets with the correct tenant id set */
372  uint32_t tenant_id;
373 
376 
377  uint32_t flags; /**< generic flags */
378 
379  uint16_t file_flags; /**< file tracking/extraction flags */
380  /* coccinelle: Flow:file_flags:FLOWFILE_ */
381 
382  /** destination port to be used in protocol detection. This is meant
383  * for use with STARTTLS and HTTP CONNECT detection */
384  uint16_t protodetect_dp; /**< 0 if not used */
385 
386  /* Parent flow id for protocol like ftp */
387  int64_t parent_id;
388 
389 #ifdef FLOWLOCK_RWLOCK
390  SCRWLock r;
391 #elif defined FLOWLOCK_MUTEX
393 #else
394  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
395 #endif
396 
397  /** protocol specific data pointer, e.g. for TcpSession */
398  void *protoctx;
399 
400  /** mapping to Flow's protocol specific protocols for timeouts
401  and state and free functions. */
402  uint8_t protomap;
403 
404  uint8_t flow_end_flags;
405  /* coccinelle: Flow:flow_end_flags:FLOW_END_FLAG_ */
406 
407  AppProto alproto; /**< \brief application level protocol */
410 
411  /** original application level protocol. Used to indicate the previous
412  protocol when changing to another protocol , e.g. with STARTTLS. */
414  /** expected app protocol: used in protocol change/upgrade like in
415  * STARTTLS. */
417 
418  /** detection engine ctx version used to inspect this flow. Set at initial
419  * inspection. If it doesn't match the currently in use de_ctx, the
420  * stored sgh ptrs are reset. */
421  uint32_t de_ctx_version;
422 
423  /** Thread ID for the stream/detect portion of this flow */
425 
426  /** ttl tracking */
431 
432  /** application level storage ptrs.
433  *
434  */
435  AppLayerParserState *alparser; /**< parser internal state */
436  void *alstate; /**< application layer state */
437 
438  /** toclient sgh for this flow. Only use when FLOW_SGH_TOCLIENT flow flag
439  * has been set. */
441  /** toserver sgh for this flow. Only use when FLOW_SGH_TOSERVER flow flag
442  * has been set. */
444 
445  /* pointer to the var list */
447 
448  /** hash list pointers, protected by fb->s */
449  struct Flow_ *hnext; /* hash list */
450  struct Flow_ *hprev;
451  struct FlowBucket_ *fb;
452 
453  /** queue list pointers, protected by queue mutex */
454  struct Flow_ *lnext; /* list */
455  struct Flow_ *lprev;
456  struct timeval startts;
457 
458  uint32_t todstpktcnt;
459  uint32_t tosrcpktcnt;
460  uint64_t todstbytecnt;
461  uint64_t tosrcbytecnt;
462 } Flow;
463 
464 enum FlowState {
470 };
471 
472 typedef struct FlowProtoTimeout_ {
473  uint32_t new_timeout;
474  uint32_t est_timeout;
475  uint32_t closed_timeout;
478 
479 typedef struct FlowProtoFreeFunc_ {
480  void (*Freefunc)(void *);
482 
483 /** \brief prepare packet for a life with flow
484  * Set PKT_WANTS_FLOW flag to incidate workers should do a flow lookup
485  * and calc the hash value to be used in the lookup and autofp flow
486  * balancing. */
487 void FlowSetupPacket(Packet *p);
489 void FlowInitConfig (char);
490 void FlowPrintQueueInfo (void);
491 void FlowShutdown(void);
492 void FlowSetIPOnlyFlag(Flow *, int);
493 void FlowSetHasAlertsFlag(Flow *);
494 int FlowHasAlerts(const Flow *);
497 int FlowChangeProto(Flow *);
498 
499 void FlowRegisterTests (void);
500 int FlowSetProtoTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t);
501 int FlowSetProtoEmergencyTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t);
502 int FlowSetProtoFreeFunc (uint8_t , void (*Free)(void *));
503 void FlowUpdateQueue(Flow *);
504 
505 struct FlowQueue_;
506 
507 int FlowUpdateSpareFlows(void);
508 
509 static inline void FlowSetNoPacketInspectionFlag(Flow *);
510 static inline void FlowSetNoPayloadInspectionFlag(Flow *);
511 
512 int FlowGetPacketDirection(const Flow *, const Packet *);
513 
514 void FlowCleanupAppLayer(Flow *);
515 
516 void FlowUpdateState(Flow *f, enum FlowState s);
517 
518 int FlowSetMemcap(uint64_t size);
519 uint64_t FlowGetMemcap(void);
520 uint64_t FlowGetMemuse(void);
521 
522 /** ----- Inline functions ----- */
523 
524 /** \brief Set the No Packet Inspection Flag without locking the flow.
525  *
526  * \param f Flow to set the flag in
527  */
528 static inline void FlowSetNoPacketInspectionFlag(Flow *f)
529 {
530  SCEnter();
531 
532  SCLogDebug("flow %p", f);
534 
535  SCReturn;
536 }
537 
538 /** \brief Set the No payload inspection Flag without locking the flow.
539  *
540  * \param f Flow to set the flag in
541  */
542 static inline void FlowSetNoPayloadInspectionFlag(Flow *f)
543 {
544  SCEnter();
545 
546  SCLogDebug("flow %p", f);
548 
549  SCReturn;
550 }
551 
552 /**
553  * \brief increase the use count of a flow
554  *
555  * \param f flow to decrease use count for
556  */
557 static inline void FlowIncrUsecnt(Flow *f)
558 {
559  if (f == NULL)
560  return;
561 
562  (void) SC_ATOMIC_ADD(f->use_cnt, 1);
563 }
564 
565 /**
566  * \brief decrease the use count of a flow
567  *
568  * \param f flow to decrease use count for
569  */
570 static inline void FlowDecrUsecnt(Flow *f)
571 {
572  if (f == NULL)
573  return;
574 
575  (void) SC_ATOMIC_SUB(f->use_cnt, 1);
576 }
577 
578 /** \brief Reference the flow, bumping the flows use_cnt
579  * \note This should only be called once for a destination
580  * pointer */
581 static inline void FlowReference(Flow **d, Flow *f)
582 {
583  if (likely(f != NULL)) {
584 #ifdef DEBUG_VALIDATION
585  BUG_ON(*d == f);
586 #else
587  if (*d == f)
588  return;
589 #endif
590  FlowIncrUsecnt(f);
591  *d = f;
592  }
593 }
594 
595 static inline void FlowDeReference(Flow **d)
596 {
597  if (likely(*d != NULL)) {
598  FlowDecrUsecnt(*d);
599  *d = NULL;
600  }
601 }
602 
603 /** \brief create a flow id that is as unique as possible
604  * \retval flow_id signed 64bit id
605  * \note signed because of the signedness of json_integer_t in
606  * the json output
607  */
608 static inline int64_t FlowGetId(const Flow *f)
609 {
610  int64_t id = (int64_t)f->flow_hash << 31 |
611  (int64_t)(f->startts.tv_sec & 0x0000FFFF) << 16 |
612  (int64_t)(f->startts.tv_usec & 0x0000FFFF);
613  /* reduce to 51 bits as Javascript and even JSON often seem to
614  * max out there. */
615  id &= 0x7ffffffffffffLL;
616  return id;
617 }
618 
619 int FlowClearMemory(Flow *,uint8_t );
620 
622 void *FlowGetAppState(const Flow *f);
623 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags);
624 
625 void FlowHandlePacketUpdate(Flow *f, Packet *p);
626 
627 #endif /* __FLOW_H__ */
628 
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow look...
Definition: flow-hash.c:288
AppProto alproto_expect
Definition: flow.h:416
uint16_t flags
#define SCLogDebug(...)
Definition: util-debug.h:335
uint32_t bypassed_timeout
Definition: flow.h:476
AppProto alproto_tc
Definition: flow.h:409
struct Flow_ * hnext
Definition: flow.h:449
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:440
struct FlowProtoFreeFunc_ FlowProtoFreeFunc
uint32_t emerg_timeout_new
Definition: flow.h:263
#define BUG_ON(x)
uint32_t new_timeout
Definition: flow.h:473
uint64_t todstbytecnt
Definition: flow.h:460
uint8_t proto
Definition: flow.h:346
struct Flow_ Flow
Flow data structure.
int FlowChangeProto(Flow *)
Check if change proto flag is set for flow.
Definition: flow.c:240
Port sp
Definition: flow.h:333
uint16_t FlowThreadId
Definition: flow.h:307
unsigned short FlowStateType
Definition: flow.h:303
void FlowSetIPOnlyFlag(Flow *, int)
Set the IPOnly scanned flag for &#39;direction&#39;.
Definition: flow.c:186
uint32_t tenant_id
Definition: flow.h:372
uint32_t prealloc
Definition: flow.h:258
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:108
void FlowHandlePacketUpdate(Flow *f, Packet *p)
Update Packet and Flow.
Definition: flow.c:330
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:983
void FlowPrintQueueInfo(void)
uint8_t max_ttl_toserver
Definition: flow.h:428
Address src
Definition: flow.h:273
Container for matching data for a signature group.
Definition: detect.h:1295
struct timeval startts
Definition: flow.h:456
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:125
uint32_t todstpktcnt
Definition: flow.h:458
uint16_t AppProto
AppProto FlowGetAppProtocol(const Flow *f)
Definition: flow.c:992
void * protoctx
Definition: flow.h:398
void FlowSetHasAlertsFlag(Flow *)
Set flag to indicate that flow has alerts.
Definition: flow.c:197
struct Flow_ * hprev
Definition: flow.h:450
SC_ATOMIC_DECLARE(uint64_t, memcap)
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:375
void * alstate
Definition: flow.h:436
AppProto alproto_orig
Definition: flow.h:413
AppProto alproto_ts
Definition: flow.h:408
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:58
uint64_t tosrcbytecnt
Definition: flow.h:461
uint16_t dst
uint32_t timeout_est
Definition: flow.h:261
Port sp
Definition: flow.h:274
uint16_t type
unsigned short FlowRefCount
Definition: flow.h:296
int FlowClearMemory(Flow *, uint8_t)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:959
uint16_t protodetect_dp
Definition: flow.h:384
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get &#39;disruption&#39; flags: GAP/DEPTH/PASS
Definition: flow.c:1009
struct Flow_ * lprev
Definition: flow.h:455
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:113
void FlowUnsetChangeProtoFlag(Flow *)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:230
void FlowUpdateQueue(Flow *)
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:60
uint8_t code
Definition: flow.h:336
Structure to hold thread specific data for all decode modules.
Definition: decode.h:642
uint32_t est_timeout
Definition: flow.h:474
uint8_t recursion_level
Definition: flow.h:276
#define SCEnter(...)
Definition: util-debug.h:337
SCMutex m
Definition: flow.h:392
uint8_t type
Definition: flow.h:335
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:599
uint32_t timeout_new
Definition: flow.h:260
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:98
struct FlowKey_ FlowKey
uint16_t Port
Definition: decode.h:234
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:374
struct FlowAddress_ FlowAddress
GenericVar * flowvar
Definition: flow.h:446
uint8_t min_ttl_toserver
Definition: flow.h:427
struct FlowBucket_ * fb
Definition: flow.h:451
uint8_t flow_end_flags
Definition: flow.h:404
int FlowUpdateSpareFlows(void)
Make sure we have enough spare flows.
Definition: flow.c:144
struct Flow_ * lnext
Definition: flow.h:454
FlowThreadId thread_id
Definition: flow.h:424
int FlowSetProtoEmergencyTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
uint32_t max_flows
Definition: flow.h:257
int FlowSetProtoTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
Port dp
Definition: flow.h:340
uint8_t address
Definition: decode-ppp.h:311
#define SCRWLock
void FlowUpdateState(Flow *f, enum FlowState s)
Definition: flow.c:1033
Definition: flow.h:271
#define SCMutex
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:443
uint32_t closed_timeout
Definition: flow.h:475
uint8_t max_ttl_toclient
Definition: flow.h:430
void * FlowGetAppState(const Flow *f)
Definition: flow.c:997
int64_t parent_id
Definition: flow.h:387
void FlowSetChangeProtoFlag(Flow *)
Set flag to indicate to change proto for the flow.
Definition: flow.c:221
void FlowCleanupAppLayer(Flow *)
Definition: flow.c:125
struct FlowCnf_ FlowConfig
uint8_t min_ttl_toclient
Definition: flow.h:429
uint32_t flow_hash
Definition: flow.h:351
uint8_t recursion_level
Definition: flow.h:347
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1259
FlowAddress src
Definition: flow.h:331
uint32_t hash_rand
Definition: flow.h:255
uint32_t de_ctx_version
Definition: flow.h:421
#define SCReturn
Definition: util-debug.h:339
Per thread variable structure.
Definition: threadvars.h:57
uint16_t file_flags
Definition: flow.h:379
uint8_t code
AppProto alproto
application level protocol
Definition: flow.h:407
uint8_t proto
Definition: flow.h:275
uint32_t emerg_timeout_est
Definition: flow.h:264
#define likely(expr)
Definition: util-optimize.h:32
struct FlowProtoTimeout_ FlowProtoTimeout
int FlowHasAlerts(const Flow *)
Check if flow has alerts.
Definition: flow.c:208
uint8_t protomap
Definition: flow.h:402
void FlowInitConfig(char)
initialize the configuration
Definition: flow.c:444
Flow data structure.
Definition: flow.h:327
void FlowHandlePacket(ThreadVars *, DecodeThreadVars *, Packet *)
Entry point for packet flow handling.
Definition: flow.c:428
Definition: flow.h:253
uint32_t flags
Definition: flow.h:377
FlowState
Definition: flow.h:464
uint64_t FlowGetMemuse(void)
Definition: flow.c:119
AppLayerParserState * alparser
Definition: flow.h:435
uint32_t emergency_recovery
Definition: flow.h:265
uint32_t tosrcpktcnt
Definition: flow.h:459
uint32_t hash_size
Definition: flow.h:256
int FlowGetPacketDirection(const Flow *, const Packet *)
determine the direction of the packet compared to the flow
Definition: flow.c:254