suricata
flow.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef SURICATA_FLOW_H
25 #define SURICATA_FLOW_H
26 
27 /* forward declaration for macset include */
28 typedef struct FlowStorageId FlowStorageId;
29 
30 #include "decode.h"
31 #include "util-time.h"
32 #include "util-exception-policy.h"
34 #include "util-var.h"
35 #include "util-optimize.h"
36 #include "util-validate.h"
37 #include "app-layer-protos.h"
38 
39 /* Part of the flow structure, so we declare it here.
40  * The actual declaration is in app-layer-parser.c */
42 
43 #define FLOW_QUIET true
44 
45 #define TOSERVER 0
46 #define TOCLIENT 1
47 
48 /* per flow flags */
49 
50 /** At least one packet from the source address was seen */
51 #define FLOW_TO_SRC_SEEN BIT_U32(0)
52 /** At least one packet from the destination address was seen */
53 #define FLOW_TO_DST_SEEN BIT_U32(1)
54 
55 /** next packet in toclient direction will act on updated app-layer state */
56 #define FLOW_TC_APP_UPDATE_NEXT BIT_U32(2)
57 
58 /** Flow was inspected against IP-Only sigs in the toserver direction */
59 #define FLOW_TOSERVER_IPONLY_SET BIT_U32(3)
60 /** Flow was inspected against IP-Only sigs in the toclient direction */
61 #define FLOW_TOCLIENT_IPONLY_SET BIT_U32(4)
62 
63 /** Packet belonging to this flow should not be inspected at all */
64 #define FLOW_NOPACKET_INSPECTION BIT_U32(5)
65 /** Packet payloads belonging to this flow should not be inspected */
66 #define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)
67 
68 /** All packets in this flow should be dropped */
69 #define FLOW_ACTION_DROP BIT_U32(7)
70 
71 /** Sgh for toserver direction set (even if it's NULL) */
72 #define FLOW_SGH_TOSERVER BIT_U32(8)
73 /** Sgh for toclient direction set (even if it's NULL) */
74 #define FLOW_SGH_TOCLIENT BIT_U32(9)
75 
76 /** packet to server direction has been logged in drop file (only in IPS mode) */
77 #define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)
78 /** packet to client direction has been logged in drop file (only in IPS mode) */
79 #define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)
80 
81 /** flow has alerts */
82 #define FLOW_HAS_ALERTS BIT_U32(12)
83 
84 /** Pattern matcher alproto detection done */
85 #define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)
86 /** Probing parser alproto detection done */
87 #define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)
88 /** Expectation alproto detection done */
89 #define FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)
90 /** Pattern matcher alproto detection done */
91 #define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)
92 /** Probing parser alproto detection done */
93 #define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)
94 /** Expectation alproto detection done */
95 #define FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)
96 #define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)
97 
98 /** flow is ipv4 */
99 #define FLOW_IPV4 BIT_U32(20)
100 /** flow is ipv6 */
101 #define FLOW_IPV6 BIT_U32(21)
102 
103 #define FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)
104 #define FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)
105 
106 /** Indicate that alproto detection for flow should be done again */
107 #define FLOW_CHANGE_PROTO BIT_U32(24)
108 
109 #define FLOW_WRONG_THREAD BIT_U32(25)
110 /** Protocol detection told us flow is picked up in wrong direction (midstream) */
111 #define FLOW_DIR_REVERSED BIT_U32(26)
112 /** Indicate that the flow did trigger an expectation creation */
113 #define FLOW_HAS_EXPECTATION BIT_U32(27)
114 
115 /** All packets in this flow should be passed */
116 #define FLOW_ACTION_PASS BIT_U32(28)
117 
118 #define FLOW_TS_APP_UPDATED BIT_U32(29)
119 #define FLOW_TC_APP_UPDATED BIT_U32(30)
120 
121 /** next packet in toserver direction will act on updated app-layer state */
122 #define FLOW_TS_APP_UPDATE_NEXT BIT_U32(31)
123 
124 /* File flags */
125 
126 #define FLOWFILE_INIT 0
127 
128 /** no magic on files in this flow */
129 #define FLOWFILE_NO_MAGIC_TS BIT_U16(0)
130 #define FLOWFILE_NO_MAGIC_TC BIT_U16(1)
131 
132 /** even if the flow has files, don't store 'm */
133 #define FLOWFILE_NO_STORE_TS BIT_U16(2)
134 #define FLOWFILE_NO_STORE_TC BIT_U16(3)
135 /** no md5 on files in this flow */
136 #define FLOWFILE_NO_MD5_TS BIT_U16(4)
137 #define FLOWFILE_NO_MD5_TC BIT_U16(5)
138 
139 /** no sha1 on files in this flow */
140 #define FLOWFILE_NO_SHA1_TS BIT_U16(6)
141 #define FLOWFILE_NO_SHA1_TC BIT_U16(7)
142 
143 /** no sha256 on files in this flow */
144 #define FLOWFILE_NO_SHA256_TS BIT_U16(8)
145 #define FLOWFILE_NO_SHA256_TC BIT_U16(9)
146 
147 /** no size tracking of files in this flow */
148 #define FLOWFILE_NO_SIZE_TS BIT_U16(10)
149 #define FLOWFILE_NO_SIZE_TC BIT_U16(11)
150 
151 /** store files in the flow */
152 #define FLOWFILE_STORE_TS BIT_U16(12)
153 #define FLOWFILE_STORE_TC BIT_U16(13)
154 
155 #define FLOWFILE_NONE_TS (FLOWFILE_NO_MAGIC_TS | \
156  FLOWFILE_NO_STORE_TS | \
157  FLOWFILE_NO_MD5_TS | \
158  FLOWFILE_NO_SHA1_TS | \
159  FLOWFILE_NO_SHA256_TS| \
160  FLOWFILE_NO_SIZE_TS)
161 #define FLOWFILE_NONE_TC (FLOWFILE_NO_MAGIC_TC | \
162  FLOWFILE_NO_STORE_TC | \
163  FLOWFILE_NO_MD5_TC | \
164  FLOWFILE_NO_SHA1_TC | \
165  FLOWFILE_NO_SHA256_TC| \
166  FLOWFILE_NO_SIZE_TC)
167 #define FLOWFILE_NONE (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC)
168 
169 #define FLOW_IS_IPV4(f) \
170  (((f)->flags & FLOW_IPV4) == FLOW_IPV4)
171 #define FLOW_IS_IPV6(f) \
172  (((f)->flags & FLOW_IPV6) == FLOW_IPV6)
173 
174 #define FLOW_GET_SP(f) \
175  ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;
176 #define FLOW_GET_DP(f) \
177  ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;
178 
179 #define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa) do { \
180  (pa)->family = AF_INET; \
181  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
182  } while (0)
183 
184 #define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa) do { \
185  (pa)->family = AF_INET6; \
186  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
187  (pa)->addr_data32[1] = (fa)->addr_data32[1]; \
188  (pa)->addr_data32[2] = (fa)->addr_data32[2]; \
189  (pa)->addr_data32[3] = (fa)->addr_data32[3]; \
190  } while (0)
191 
192 /* Set the IPv4 addressesinto the Addrs of the Packet.
193  * Make sure p->ip4h is initialized and validated.
194  *
195  * We set the rest of the struct to 0 so we can
196  * prevent using memset. */
197 #define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(ip4h, a) \
198  do { \
199  (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_src.s_addr; \
200  (a)->addr_data32[1] = 0; \
201  (a)->addr_data32[2] = 0; \
202  (a)->addr_data32[3] = 0; \
203  } while (0)
204 
205 #define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(ip4h, a) \
206  do { \
207  (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_dst.s_addr; \
208  (a)->addr_data32[1] = 0; \
209  (a)->addr_data32[2] = 0; \
210  (a)->addr_data32[3] = 0; \
211  } while (0)
212 
213 /* Set the IPv6 addressesinto the Addrs of the Packet.
214  * Make sure p->ip6h is initialized and validated. */
215 #define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(ip6h, a) \
216  do { \
217  (a)->addr_data32[0] = (ip6h)->s_ip6_src[0]; \
218  (a)->addr_data32[1] = (ip6h)->s_ip6_src[1]; \
219  (a)->addr_data32[2] = (ip6h)->s_ip6_src[2]; \
220  (a)->addr_data32[3] = (ip6h)->s_ip6_src[3]; \
221  } while (0)
222 
223 #define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(ip6h, a) \
224  do { \
225  (a)->addr_data32[0] = (ip6h)->s_ip6_dst[0]; \
226  (a)->addr_data32[1] = (ip6h)->s_ip6_dst[1]; \
227  (a)->addr_data32[2] = (ip6h)->s_ip6_dst[2]; \
228  (a)->addr_data32[3] = (ip6h)->s_ip6_dst[3]; \
229  } while (0)
230 
231 /* pkt flow flags */
232 #define FLOW_PKT_TOSERVER 0x01
233 #define FLOW_PKT_TOCLIENT 0x02
234 #define FLOW_PKT_ESTABLISHED 0x04
235 #define FLOW_PKT_TOSERVER_IPONLY_SET 0x08
236 #define FLOW_PKT_TOCLIENT_IPONLY_SET 0x10
237 #define FLOW_PKT_TOSERVER_FIRST 0x20
238 #define FLOW_PKT_TOCLIENT_FIRST 0x40
239 /** last pseudo packet in the flow. Can be used to trigger final clean,
240  * logging, etc. */
241 #define FLOW_PKT_LAST_PSEUDO 0x80
242 
243 #define FLOW_END_FLAG_STATE_NEW 0x01
244 #define FLOW_END_FLAG_STATE_ESTABLISHED 0x02
245 #define FLOW_END_FLAG_STATE_CLOSED 0x04
246 #define FLOW_END_FLAG_EMERGENCY 0x08
247 #define FLOW_END_FLAG_TIMEOUT 0x10
248 #define FLOW_END_FLAG_FORCED 0x20
249 #define FLOW_END_FLAG_SHUTDOWN 0x40
250 #define FLOW_END_FLAG_STATE_BYPASSED 0x80
251 
252 /** Mutex or RWLocks for the flow. */
253 //#define FLOWLOCK_RWLOCK
254 #define FLOWLOCK_MUTEX
255 
256 #ifdef FLOWLOCK_RWLOCK
257  #ifdef FLOWLOCK_MUTEX
258  #error Cannot enable both FLOWLOCK_RWLOCK and FLOWLOCK_MUTEX
259  #endif
260 #endif
261 
262 #ifdef FLOWLOCK_RWLOCK
263  #define FLOWLOCK_INIT(fb) SCRWLockInit(&(fb)->r, NULL)
264  #define FLOWLOCK_DESTROY(fb) SCRWLockDestroy(&(fb)->r)
265  #define FLOWLOCK_RDLOCK(fb) SCRWLockRDLock(&(fb)->r)
266  #define FLOWLOCK_WRLOCK(fb) SCRWLockWRLock(&(fb)->r)
267  #define FLOWLOCK_TRYRDLOCK(fb) SCRWLockTryRDLock(&(fb)->r)
268  #define FLOWLOCK_TRYWRLOCK(fb) SCRWLockTryWRLock(&(fb)->r)
269  #define FLOWLOCK_UNLOCK(fb) SCRWLockUnlock(&(fb)->r)
270 #elif defined FLOWLOCK_MUTEX
271  #define FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)
272  #define FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)
273  #define FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m)
274  #define FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m)
275  #define FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m)
276  #define FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m)
277  #define FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)
278 #else
279  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
280 #endif
281 
282 #define FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))
283 #define FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))
284 #define FLOW_IS_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))
285 
286 #define FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE))
287 #define FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE))
288 #define FLOW_SET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PE_ALPROTO_DETECT_DONE))
289 
290 #define FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))
291 #define FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))
292 #define FLOW_RESET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))
293 
294 /* global flow config */
295 typedef struct FlowCnf_
296 {
297  uint32_t hash_rand;
298  uint32_t hash_size;
299  uint32_t prealloc;
300 
301  uint32_t timeout_new;
302  uint32_t timeout_est;
303 
305 
307 
308  SC_ATOMIC_DECLARE(uint64_t, memcap);
310 
311 /* Hash key for the flow hash */
312 typedef struct FlowKey_
313 {
316  uint8_t proto;
318  uint16_t livedev_id;
321 
322 typedef struct FlowAddress_ {
323  union {
324  uint32_t address_un_data32[4]; /* type-specific field */
325  uint16_t address_un_data16[8]; /* type-specific field */
326  uint8_t address_un_data8[16]; /* type-specific field */
329 
330 #define addr_data32 address.address_un_data32
331 #define addr_data16 address.address_un_data16
332 #define addr_data8 address.address_un_data8
333 
334 typedef unsigned short FlowStateType;
335 
336 /** Local Thread ID */
337 typedef uint16_t FlowThreadId;
338 
339 #include "util-storage.h"
340 
341 /**
342  * \brief Flow data structure.
343  *
344  * The flow is a global data structure that is created for new packets of a
345  * flow and then looked up for the following packets of a flow.
346  *
347  * Locking
348  *
349  * The flow is updated/used by multiple packets at the same time. This is why
350  * there is a flow-mutex. It's a mutex and not a spinlock because some
351  * operations on the flow can be quite expensive, thus spinning would be
352  * too expensive.
353  *
354  * The flow "header" (addresses, ports, proto, recursion level) are static
355  * after the initialization and remain read-only throughout the entire live
356  * of a flow. This is why we can access those without protection of the lock.
357  */
358 
359 typedef struct Flow_
360 {
361  /* flow "header", used for hashing and flow lookup. Static after init,
362  * so safe to look at without lock */
364  union {
365  Port sp; /**< tcp/udp source port */
366  struct {
367  uint8_t type; /**< icmp type */
368  uint8_t code; /**< icmp code */
370 
371  struct {
372  uint32_t spi; /**< esp spi */
373  } esp;
374  };
375  union {
376  Port dp; /**< tcp/udp destination port */
377  struct {
378  uint8_t type; /**< icmp type */
379  uint8_t code; /**< icmp code */
381  };
382  uint8_t proto;
385 
386  uint8_t vlan_idx;
387 
388  /* track toserver/toclient flow timeout needs */
389  union {
390  struct {
391  uint8_t ffr_ts:4;
392  uint8_t ffr_tc:4;
393  };
394  uint8_t ffr;
395  };
396 
397  /** timestamp in seconds of the moment this flow will timeout
398  * according to the timeout policy. Does *not* take emergency
399  * mode into account. */
400  uint32_t timeout_at;
401 
402  /** Thread ID for the stream/detect portion of this flow */
404 
405  struct Flow_ *next; /* (hash) list next */
406  /** Incoming interface */
408 
409  /** flow hash - the flow hash before hash table size mod. */
410  uint32_t flow_hash;
411 
412  /** timeout policy value in seconds to add to the lastts.tv_sec
413  * when a packet has been received. */
414  uint32_t timeout_policy;
415 
416  /* time stamp of last update (last packet). Set/updated under the
417  * flow and flow hash row locks, safe to read under either the
418  * flow lock or flow hash row lock. */
420 
422 
423  /** flow tenant id, used to setup flow timeout and stream pseudo
424  * packets with the correct tenant id set */
425  uint32_t tenant_id;
426 
429 
430  uint32_t flags; /**< generic flags */
431 
432  uint16_t file_flags; /**< file tracking/extraction flags */
433 
434  /** destination port to be used in protocol detection. This is meant
435  * for use with STARTTLS and HTTP CONNECT detection */
436  uint16_t protodetect_dp; /**< 0 if not used */
437 
438  /* Parent flow id for protocol like ftp */
439  int64_t parent_id;
440 
441 #ifdef FLOWLOCK_RWLOCK
442  SCRWLock r;
443 #elif defined FLOWLOCK_MUTEX
445 #else
446  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
447 #endif
448 
449  /** protocol specific data pointer, e.g. for TcpSession */
450  void *protoctx;
451 
452  /** mapping to Flow's protocol specific protocols for timeouts
453  and state and free functions. */
454  uint8_t protomap;
455 
456  uint8_t flow_end_flags;
457  /* coccinelle: Flow:flow_end_flags:FLOW_END_FLAG_ */
458 
459  AppProto alproto; /**< \brief application level protocol */
462 
463  /** original application level protocol. Used to indicate the previous
464  protocol when changing to another protocol , e.g. with STARTTLS. */
466  /** expected app protocol: used in protocol change/upgrade like in
467  * STARTTLS. */
469 
470  /** detection engine ctx version used to inspect this flow. Set at initial
471  * inspection. If it doesn't match the currently in use de_ctx, the
472  * stored sgh ptrs are reset. */
473  uint32_t de_ctx_version;
474 
475  /** ttl tracking */
480 
481  /** application level storage ptrs.
482  *
483  */
484  AppLayerParserState *alparser; /**< parser internal state */
485  void *alstate; /**< application layer state */
486 
487  /** toclient sgh for this flow. Only use when FLOW_SGH_TOCLIENT flow flag
488  * has been set. */
490  /** toserver sgh for this flow. Only use when FLOW_SGH_TOSERVER flow flag
491  * has been set. */
493 
494  /* pointer to the var list */
496 
497  struct FlowBucket_ *fb;
498 
500 
501  uint32_t todstpktcnt;
502  uint32_t tosrcpktcnt;
503  uint64_t todstbytecnt;
504  uint64_t tosrcbytecnt;
505 
508 
509 enum FlowState {
514 #ifdef CAPTURE_OFFLOAD
515  FLOW_STATE_CAPTURE_BYPASSED,
516 #endif
517 };
518 #ifdef CAPTURE_OFFLOAD
519 #define FLOW_STATE_SIZE 5
520 #else
521 #define FLOW_STATE_SIZE 4
522 #endif
523 
524 typedef struct FlowProtoTimeout_ {
525  uint32_t new_timeout;
526  uint32_t est_timeout;
527  uint32_t closed_timeout;
530 
531 typedef struct FlowProtoFreeFunc_ {
532  void (*Freefunc)(void *);
534 
535 typedef struct FlowBypassInfo_ {
536  bool (* BypassUpdate)(Flow *f, void *data, time_t tsec);
537  void (* BypassFree)(void *data);
538  void *bypass_data;
539  uint64_t tosrcpktcnt;
540  uint64_t tosrcbytecnt;
541  uint64_t todstpktcnt;
542  uint64_t todstbytecnt;
544 
545 #include "flow-queue.h"
546 
547 typedef struct FlowLookupStruct_ // TODO name
548 {
549  /** thread store of spare queues */
555 
556 /** \brief prepare packet for a life with flow
557  * Set PKT_WANTS_FLOW flag to indicate workers should do a flow lookup
558  * and calc the hash value to be used in the lookup and autofp flow
559  * balancing. */
560 void FlowSetupPacket(Packet *p);
562 void FlowInitConfig(bool);
563 void FlowReset(void);
564 void FlowShutdown(void);
565 void FlowSetIPOnlyFlag(Flow *, int);
566 void FlowSetHasAlertsFlag(Flow *);
567 int FlowHasAlerts(const Flow *);
570 int FlowChangeProto(Flow *);
571 void FlowSwap(Flow *);
572 
573 void FlowRegisterTests(void);
574 int FlowSetProtoFreeFunc(uint8_t, void (*Free)(void *));
575 
576 static inline void FlowSetNoPacketInspectionFlag(Flow *);
577 static inline void FlowSetNoPayloadInspectionFlag(Flow *);
578 
579 int FlowGetPacketDirection(const Flow *, const Packet *);
580 
581 void FlowCleanupAppLayer(Flow *);
582 
583 void FlowUpdateState(Flow *f, enum FlowState s);
584 
585 int FlowSetMemcap(uint64_t size);
586 uint64_t FlowGetMemcap(void);
587 uint64_t FlowGetMemuse(void);
589 
591 void RegisterFlowBypassInfo(void);
592 
593 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs);
594 uint32_t FlowGetFlags(Flow *flow);
595 uint16_t FlowGetSourcePort(Flow *flow);
596 uint16_t FlowGetDestinationPort(Flow *flow);
597 
598 /** ----- Inline functions ----- */
599 
600 static inline AppProto FlowGetAppProtocol(const Flow *f)
601 {
602  return f->alproto;
603 }
604 
605 static inline void *FlowGetAppState(const Flow *f)
606 {
607  return f->alstate;
608 }
609 
610 /** \brief Set the No Packet Inspection Flag without locking the flow.
611  *
612  * \param f Flow to set the flag in
613  */
614 static inline void FlowSetNoPacketInspectionFlag(Flow *f)
615 {
616  SCEnter();
617 
618  SCLogDebug("flow %p", f);
620 
621  SCReturn;
622 }
623 
624 /** \brief Set the No payload inspection Flag without locking the flow.
625  *
626  * \param f Flow to set the flag in
627  */
628 static inline void FlowSetNoPayloadInspectionFlag(Flow *f)
629 {
630  SCEnter();
631 
632  SCLogDebug("flow %p", f);
634 
635  SCReturn;
636 }
637 
638 /** \brief Reference the flow
639  * \note This should only be called once for a destination
640  * pointer */
641 static inline void FlowReference(Flow **d, Flow *f)
642 {
643  if (likely(f != NULL)) {
644  DEBUG_VALIDATE_BUG_ON(*d == f);
645  if (*d == f)
646  return;
647  *d = f;
648  }
649 }
650 
651 static inline void FlowDeReference(Flow **d)
652 {
653  if (likely(*d != NULL)) {
654  *d = NULL;
655  }
656 }
657 
658 /** \brief create a flow id that is as unique as possible
659  * \retval flow_id signed 64bit id
660  * \note signed because of the signedness of json_integer_t in
661  * the json output
662  */
663 static inline int64_t FlowGetId(const Flow *f)
664 {
665  int64_t id = (uint64_t)(SCTIME_SECS(f->startts) & 0x0000FFFF) << 48 |
666  (uint64_t)(SCTIME_USECS(f->startts) & 0x0000FFFF) << 32 | (int64_t)f->flow_hash;
667  /* reduce to 51 bits as JavaScript and even JSON often seem to
668  * max out there. */
669  id &= 0x7ffffffffffffLL;
670  return id;
671 }
672 
673 static inline void FlowSetEndFlags(Flow *f)
674 {
675  const int state = f->flow_state;
676  if (state == FLOW_STATE_NEW)
678  else if (state == FLOW_STATE_ESTABLISHED)
680  else if (state == FLOW_STATE_CLOSED)
682  else if (state == FLOW_STATE_LOCAL_BYPASSED)
684 #ifdef CAPTURE_OFFLOAD
685  else if (state == FLOW_STATE_CAPTURE_BYPASSED)
687 #endif
688 }
689 
690 static inline bool FlowIsBypassed(const Flow *f)
691 {
692  if (
693 #ifdef CAPTURE_OFFLOAD
694  f->flow_state == FLOW_STATE_CAPTURE_BYPASSED ||
695 #endif
697  return true;
698  }
699  return false;
700 }
701 
702 int FlowClearMemory(Flow *,uint8_t );
703 
704 AppProto FlowGetAppProtocol(const Flow *f);
705 void *FlowGetAppState(const Flow *f);
706 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags);
707 
709 
710 #endif /* SURICATA_FLOW_H */
FlowStorageId
Definition: flow-storage.h:31
Flow_::ffr_tc
uint8_t ffr_tc
Definition: flow.h:392
FlowLookupStruct_::work_queue
FlowQueuePrivate work_queue
Definition: flow.h:552
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:104
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1131
FlowBucket_
Definition: flow-hash.h:43
Flow_::ffr_ts
uint8_t ffr_ts
Definition: flow.h:391
Flow_::recursion_level
uint8_t recursion_level
Definition: flow.h:383
FlowAddress_
Definition: flow.h:322
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:511
FlowLookupStruct_::dtv
DecodeThreadVars * dtv
Definition: flow.h:551
Flow_::startts
SCTime_t startts
Definition: flow.h:499
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1475
FlowKey_::src
Address src
Definition: flow.h:314
FLOW_END_FLAG_STATE_NEW
#define FLOW_END_FLAG_STATE_NEW
Definition: flow.h:243
FlowBypassInfo_
Definition: flow.h:535
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:304
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:298
FlowHandlePacket
void FlowHandlePacket(ThreadVars *, FlowLookupStruct *, Packet *)
Entry point for packet flow handling.
Definition: flow.c:510
FlowAddress_::address_un_data32
uint32_t address_un_data32[4]
Definition: flow.h:324
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
FlowLookupStruct
struct FlowLookupStruct_ FlowLookupStruct
Flow_::proto
uint8_t proto
Definition: flow.h:382
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:82
FlowInitConfig
void FlowInitConfig(bool)
initialize the configuration
Definition: flow.c:524
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *, const Packet *)
determine the direction of the packet compared to the flow
Definition: flow.c:287
FlowClearMemory
int FlowClearMemory(Flow *, uint8_t)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1087
Flow_
Flow data structure.
Definition: flow.h:360
Flow_::protomap
uint8_t protomap
Definition: flow.h:454
LiveDevice_
Definition: util-device.h:50
FlowProtoTimeout_
Definition: flow.h:524
FLOW_END_FLAG_STATE_ESTABLISHED
#define FLOW_END_FLAG_STATE_ESTABLISHED
Definition: flow.h:244
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:66
FlowLookupStruct_
Definition: flow.h:548
Flow_::alproto_orig
AppProto alproto_orig
Definition: flow.h:465
Flow
struct Flow_ Flow
Flow data structure.
FLOW_END_FLAG_STATE_BYPASSED
#define FLOW_END_FLAG_STATE_BYPASSED
Definition: flow.h:250
util-exception-policy-types.h
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:528
FlowBypassInfo_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:540
Address_
Definition: decode.h:117
FlowSetupPacket
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to indicate workers should do a flow look...
Definition: flow-hash.c:521
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:477
Flow_::dp
Port dp
Definition: flow.h:376
Flow_::protoctx
void * protoctx
Definition: flow.h:450
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:193
util-var.h
Storage
Definition: util-storage.h:39
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:299
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:421
Flow_::spi
uint32_t spi
Definition: flow.h:372
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:492
FlowLookupStruct_::emerg_spare_sync_stamp
uint32_t emerg_spare_sync_stamp
Definition: flow.h:553
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:504
FlowConfig
struct FlowCnf_ FlowConfig
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:484
Flow_::dst
FlowAddress dst
Definition: flow.h:363
FlowProtoFreeFunc
struct FlowProtoFreeFunc_ FlowProtoFreeFunc
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:497
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:513
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:476
Flow_::protodetect_dp
uint16_t protodetect_dp
Definition: flow.h:436
decode.h
FlowBypassInfo_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:542
FlowGetDestinationPort
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
Definition: flow.c:1210
AppLayerParserState_
Definition: app-layer-parser.c:131
RegisterFlowBypassInfo
void RegisterFlowBypassInfo(void)
Definition: flow-util.c:229
FlowBypassInfo_::BypassUpdate
bool(* BypassUpdate)(Flow *f, void *data, time_t tsec)
Definition: flow.h:536
FlowBypassInfo_::BypassFree
void(* BypassFree)(void *data)
Definition: flow.h:537
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:501
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *, int)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:151
util-exception-policy.h
Flow_::lastts
SCTime_t lastts
Definition: flow.h:419
FlowSwap
void FlowSwap(Flow *)
swap the flow's direction
Definition: flow.c:254
FlowKey_::recursion_level
uint8_t recursion_level
Definition: flow.h:317
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
Flow_::esp
struct Flow_::@111::@118 esp
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:671
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:125
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:456
FlowCnf_
Definition: flow.h:296
FlowAddress_::address
union FlowAddress_::@110 address
FlowState
FlowState
Definition: flow.h:509
FlowBypassInfo_::todstpktcnt
uint64_t todstpktcnt
Definition: flow.h:541
Flow_::icmp_d
struct Flow_::@113::@119 icmp_d
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:525
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:527
util-time.h
FlowBypassInfo_::bypass_data
void * bypass_data
Definition: flow.h:538
Flow_::m
SCMutex m
Definition: flow.h:444
FlowBypassInfo
struct FlowBypassInfo_ FlowBypassInfo
FlowCnf_::timeout_new
uint32_t timeout_new
Definition: flow.h:301
FlowKey_::livedev_id
uint16_t livedev_id
Definition: flow.h:318
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:503
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1186
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:489
FlowChangeProto
int FlowChangeProto(Flow *)
Check if change proto flag is set for flow.
Definition: flow.c:203
FlowThreadId
uint16_t FlowThreadId
Definition: flow.h:337
FlowKey_::sp
Port sp
Definition: flow.h:315
SCReturn
#define SCReturn
Definition: util-debug.h:273
Packet_
Definition: decode.h:482
Flow_::type
uint8_t type
Definition: flow.h:367
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1438
Port
uint16_t Port
Definition: decode.h:223
SCTime_t
Definition: util-time.h:40
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:532
FlowAddress_::address_un_data16
uint16_t address_un_data16[8]
Definition: flow.h:325
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:297
Flow_::vlan_idx
uint8_t vlan_idx
Definition: flow.h:386
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
Definition: flow.c:386
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:478
FlowGetFlags
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
Definition: flow.c:1221
flow-queue.h
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *)
Definition: flow.c:136
FlowBypassInfo_::tosrcpktcnt
uint64_t tosrcpktcnt
Definition: flow.h:539
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:428
FlowCnf_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(uint64_t, memcap)
Flow_::flow_hash
uint32_t flow_hash
Definition: flow.h:410
Flow_::alproto_expect
AppProto alproto_expect
Definition: flow.h:468
GetFlowBypassInfoID
FlowStorageId GetFlowBypassInfoID(void)
Definition: flow-util.c:211
Flow_::src
FlowAddress src
Definition: flow.h:363
Flow_::flowvar
GenericVar * flowvar
Definition: flow.h:495
FlowReset
void FlowReset(void)
Definition: flow.c:653
Flow_::next
struct Flow_ * next
Definition: flow.h:405
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:427
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
FlowLookupStruct_::spare_queue
FlowQueuePrivate spare_queue
Definition: flow.h:550
FlowProtoTimeout
struct FlowProtoTimeout_ FlowProtoTimeout
Flow_::ffr
uint8_t ffr
Definition: flow.h:394
FlowStateType
unsigned short FlowStateType
Definition: flow.h:334
flags
uint8_t flags
Definition: decode-gre.h:0
FLOW_STATE_NEW
@ FLOW_STATE_NEW
Definition: flow.h:510
Flow_::code
uint8_t code
Definition: flow.h:368
GenericVar_
Definition: util-var.h:48
FlowAddress
struct FlowAddress_ FlowAddress
FlowKey_::dst
Address dst
Definition: flow.h:314
SCTIME_SECS
#define SCTIME_SECS(t)
Definition: util-time.h:57
FlowGetMemcapExceptionPolicy
enum ExceptionPolicy FlowGetMemcapExceptionPolicy(void)
Definition: flow.c:131
VLAN_MAX_LAYERS
#define VLAN_MAX_LAYERS
Definition: decode-vlan.h:51
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:479
Flow_::parent_id
int64_t parent_id
Definition: flow.h:439
FLOW_END_FLAG_STATE_CLOSED
#define FLOW_END_FLAG_STATE_CLOSED
Definition: flow.h:245
FlowCnf_::timeout_est
uint32_t timeout_est
Definition: flow.h:302
Flow_::timeout_policy
uint32_t timeout_policy
Definition: flow.h:414
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
Flow_::livedev
struct LiveDevice_ * livedev
Definition: flow.h:407
util-optimize.h
util-validate.h
FlowQueuePrivate_
Definition: flow-queue.h:41
FlowCnf_::memcap_policy
enum ExceptionPolicy memcap_policy
Definition: flow.h:306
FlowAddress_::address_un_data8
uint8_t address_un_data8[16]
Definition: flow.h:326
FlowKey_::proto
uint8_t proto
Definition: flow.h:316
FLOW_STATE_CLOSED
@ FLOW_STATE_CLOSED
Definition: flow.h:512
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:946
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:460
Flow_::alstate
void * alstate
Definition: flow.h:485
Flow_::flags
uint32_t flags
Definition: flow.h:430
Flow_::icmp_s
struct Flow_::@111::@117 icmp_s
SCRWLock
#define SCRWLock
Definition: threads-debug.h:363
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:119
FlowKey_
Definition: flow.h:313
app-layer-protos.h
Flow_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: flow.h:384
likely
#define likely(expr)
Definition: util-optimize.h:32
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:64
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:526
Flow_::sp
Port sp
Definition: flow.h:365
FlowKey_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: flow.h:319
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:461
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *)
Set flag to indicate to change proto for the flow.
Definition: flow.c:184
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:432
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:459
FlowUpdateState
void FlowUpdateState(Flow *f, enum FlowState s)
Definition: flow.c:1152
ExceptionPolicy
ExceptionPolicy
Definition: util-exception-policy-types.h:25
Flow_::timeout_at
uint32_t timeout_at
Definition: flow.h:400
FlowKey_::dp
Port dp
Definition: flow.h:315
Flow_::storage
Storage storage[]
Definition: flow.h:506
FlowKey
struct FlowKey_ FlowKey
SCMutex
#define SCMutex
Definition: threads-debug.h:114
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1115
Flow_::tenant_id
uint32_t tenant_id
Definition: flow.h:425
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:502
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *)
Set flag to indicate that flow has alerts.
Definition: flow.c:160
util-storage.h
FlowGetSourcePort
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
Definition: flow.c:1198
Flow_::thread_id
FlowThreadId thread_id[2]
Definition: flow.h:403
FlowHasAlerts
int FlowHasAlerts(const Flow *)
Check if flow has alerts.
Definition: flow.c:171
SCTIME_USECS
#define SCTIME_USECS(t)
Definition: util-time.h:56
FlowProtoFreeFunc_
Definition: flow.h:531
Flow_::de_ctx_version
uint32_t de_ctx_version
Definition: flow.h:473