suricata
flow.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __FLOW_H__
25 #define __FLOW_H__
26 
27 #include "decode.h"
28 #include "util-var.h"
29 #include "util-atomic.h"
30 #include "detect-tag.h"
31 #include "util-optimize.h"
32 
33 /* Part of the flow structure, so we declare it here.
34  * The actual declaration is in app-layer-parser.c */
36 
37 #define FLOW_QUIET TRUE
38 #define FLOW_VERBOSE FALSE
39 
40 #define TOSERVER 0
41 #define TOCLIENT 1
42 
43 /* per flow flags */
44 
45 /** At least one packet from the source address was seen */
46 #define FLOW_TO_SRC_SEEN BIT_U32(0)
47 /** At least one packet from the destination address was seen */
48 #define FLOW_TO_DST_SEEN BIT_U32(1)
49 /** Don't return this from the flow hash. It has been replaced. */
50 #define FLOW_TCP_REUSED BIT_U32(2)
51 
52 /** Flow was inspected against IP-Only sigs in the toserver direction */
53 #define FLOW_TOSERVER_IPONLY_SET BIT_U32(3)
54 /** Flow was inspected against IP-Only sigs in the toclient direction */
55 #define FLOW_TOCLIENT_IPONLY_SET BIT_U32(4)
56 
57 /** Packet belonging to this flow should not be inspected at all */
58 #define FLOW_NOPACKET_INSPECTION BIT_U32(5)
59 /** Packet payloads belonging to this flow should not be inspected */
60 #define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)
61 
62 /** All packets in this flow should be dropped */
63 #define FLOW_ACTION_DROP BIT_U32(7)
64 
65 /** Sgh for toserver direction set (even if it's NULL) */
66 #define FLOW_SGH_TOSERVER BIT_U32(8)
67 /** Sgh for toclient direction set (even if it's NULL) */
68 #define FLOW_SGH_TOCLIENT BIT_U32(9)
69 
70 /** packet to server direction has been logged in drop file (only in IPS mode) */
71 #define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)
72 /** packet to client direction has been logged in drop file (only in IPS mode) */
73 #define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)
74 
75 /** flow has alerts */
76 #define FLOW_HAS_ALERTS BIT_U32(12)
77 
78 /** Pattern matcher alproto detection done */
79 #define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)
80 /** Probing parser alproto detection done */
81 #define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)
82 /** Expectation alproto detection done */
83 #define FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)
84 /** Pattern matcher alproto detection done */
85 #define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)
86 /** Probing parser alproto detection done */
87 #define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)
88 /** Expectation alproto detection done */
89 #define FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)
90 #define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)
91 
92 /** flow is ipv4 */
93 #define FLOW_IPV4 BIT_U32(20)
94 /** flow is ipv6 */
95 #define FLOW_IPV6 BIT_U32(21)
96 
97 #define FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)
98 #define FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)
99 
100 /** Indicate that alproto detection for flow should be done again */
101 #define FLOW_CHANGE_PROTO BIT_U32(24)
102 
103 #define FLOW_WRONG_THREAD BIT_U32(25)
104 /** Protocol detection told us flow is picked up in wrong direction (midstream) */
105 #define FLOW_DIR_REVERSED BIT_U32(26)
106 
107 /* File flags */
108 
109 /** no magic on files in this flow */
110 #define FLOWFILE_NO_MAGIC_TS BIT_U16(0)
111 #define FLOWFILE_NO_MAGIC_TC BIT_U16(1)
112 
113 /** even if the flow has files, don't store 'm */
114 #define FLOWFILE_NO_STORE_TS BIT_U16(2)
115 #define FLOWFILE_NO_STORE_TC BIT_U16(3)
116 /** no md5 on files in this flow */
117 #define FLOWFILE_NO_MD5_TS BIT_U16(4)
118 #define FLOWFILE_NO_MD5_TC BIT_U16(5)
119 
120 /** no sha1 on files in this flow */
121 #define FLOWFILE_NO_SHA1_TS BIT_U16(6)
122 #define FLOWFILE_NO_SHA1_TC BIT_U16(7)
123 
124 /** no sha256 on files in this flow */
125 #define FLOWFILE_NO_SHA256_TS BIT_U16(8)
126 #define FLOWFILE_NO_SHA256_TC BIT_U16(9)
127 
128 /** no size tracking of files in this flow */
129 #define FLOWFILE_NO_SIZE_TS BIT_U16(10)
130 #define FLOWFILE_NO_SIZE_TC BIT_U16(11)
131 
132 
133 #define FLOW_IS_IPV4(f) \
134  (((f)->flags & FLOW_IPV4) == FLOW_IPV4)
135 #define FLOW_IS_IPV6(f) \
136  (((f)->flags & FLOW_IPV6) == FLOW_IPV6)
137 
138 #define FLOW_GET_SP(f) \
139  ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;
140 #define FLOW_GET_DP(f) \
141  ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;
142 
143 #define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa) do { \
144  (pa)->family = AF_INET; \
145  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
146  } while (0)
147 
148 #define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa) do { \
149  (pa)->family = AF_INET6; \
150  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
151  (pa)->addr_data32[1] = (fa)->addr_data32[1]; \
152  (pa)->addr_data32[2] = (fa)->addr_data32[2]; \
153  (pa)->addr_data32[3] = (fa)->addr_data32[3]; \
154  } while (0)
155 
156 /* Set the IPv4 addressesinto the Addrs of the Packet.
157  * Make sure p->ip4h is initialized and validated.
158  *
159  * We set the rest of the struct to 0 so we can
160  * prevent using memset. */
161 #define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a) do { \
162  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
163  (a)->addr_data32[1] = 0; \
164  (a)->addr_data32[2] = 0; \
165  (a)->addr_data32[3] = 0; \
166  } while (0)
167 
168 #define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a) do { \
169  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
170  (a)->addr_data32[1] = 0; \
171  (a)->addr_data32[2] = 0; \
172  (a)->addr_data32[3] = 0; \
173  } while (0)
174 
175 /* clear the address structure by setting all fields to 0 */
176 #define FLOW_CLEAR_ADDR(a) do { \
177  (a)->addr_data32[0] = 0; \
178  (a)->addr_data32[1] = 0; \
179  (a)->addr_data32[2] = 0; \
180  (a)->addr_data32[3] = 0; \
181  } while (0)
182 
183 /* Set the IPv6 addressesinto the Addrs of the Packet.
184  * Make sure p->ip6h is initialized and validated. */
185 #define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a) do { \
186  (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
187  (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
188  (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
189  (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
190  } while (0)
191 
192 #define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a) do { \
193  (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
194  (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
195  (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
196  (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
197  } while (0)
198 
199 /* pkt flow flags */
200 #define FLOW_PKT_TOSERVER 0x01
201 #define FLOW_PKT_TOCLIENT 0x02
202 #define FLOW_PKT_ESTABLISHED 0x04
203 #define FLOW_PKT_TOSERVER_IPONLY_SET 0x08
204 #define FLOW_PKT_TOCLIENT_IPONLY_SET 0x10
205 #define FLOW_PKT_TOSERVER_FIRST 0x20
206 #define FLOW_PKT_TOCLIENT_FIRST 0x40
207 
208 #define FLOW_END_FLAG_STATE_NEW 0x01
209 #define FLOW_END_FLAG_STATE_ESTABLISHED 0x02
210 #define FLOW_END_FLAG_STATE_CLOSED 0x04
211 #define FLOW_END_FLAG_EMERGENCY 0x08
212 #define FLOW_END_FLAG_TIMEOUT 0x10
213 #define FLOW_END_FLAG_FORCED 0x20
214 #define FLOW_END_FLAG_SHUTDOWN 0x40
215 #define FLOW_END_FLAG_STATE_BYPASSED 0x80
216 
217 /** Mutex or RWLocks for the flow. */
218 //#define FLOWLOCK_RWLOCK
219 #define FLOWLOCK_MUTEX
220 
221 #ifdef FLOWLOCK_RWLOCK
222  #ifdef FLOWLOCK_MUTEX
223  #error Cannot enable both FLOWLOCK_RWLOCK and FLOWLOCK_MUTEX
224  #endif
225 #endif
226 
227 #ifdef FLOWLOCK_RWLOCK
228  #define FLOWLOCK_INIT(fb) SCRWLockInit(&(fb)->r, NULL)
229  #define FLOWLOCK_DESTROY(fb) SCRWLockDestroy(&(fb)->r)
230  #define FLOWLOCK_RDLOCK(fb) SCRWLockRDLock(&(fb)->r)
231  #define FLOWLOCK_WRLOCK(fb) SCRWLockWRLock(&(fb)->r)
232  #define FLOWLOCK_TRYRDLOCK(fb) SCRWLockTryRDLock(&(fb)->r)
233  #define FLOWLOCK_TRYWRLOCK(fb) SCRWLockTryWRLock(&(fb)->r)
234  #define FLOWLOCK_UNLOCK(fb) SCRWLockUnlock(&(fb)->r)
235 #elif defined FLOWLOCK_MUTEX
236  #define FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)
237  #define FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)
238  #define FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m)
239  #define FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m)
240  #define FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m)
241  #define FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m)
242  #define FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)
243 #else
244  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
245 #endif
246 
247 #define FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))
248 #define FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))
249 #define FLOW_IS_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))
250 
251 #define FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE))
252 #define FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE))
253 #define FLOW_SET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PE_ALPROTO_DETECT_DONE))
254 
255 #define FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))
256 #define FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))
257 #define FLOW_RESET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))
258 
259 /* global flow config */
260 typedef struct FlowCnf_
261 {
262  uint32_t hash_rand;
263  uint32_t hash_size;
264  uint32_t max_flows;
265  uint32_t prealloc;
266 
267  uint32_t timeout_new;
268  uint32_t timeout_est;
269 
273 
274  SC_ATOMIC_DECLARE(uint64_t, memcap);
275 } FlowConfig;
276 
277 /* Hash key for the flow hash */
278 typedef struct FlowKey_
279 {
281  Port sp, dp;
282  uint8_t proto;
284 
285 } FlowKey;
286 
287 typedef struct FlowAddress_ {
288  union {
289  uint32_t address_un_data32[4]; /* type-specific field */
290  uint16_t address_un_data16[8]; /* type-specific field */
291  uint8_t address_un_data8[16]; /* type-specific field */
292  } address;
293 } FlowAddress;
294 
295 #define addr_data32 address.address_un_data32
296 #define addr_data16 address.address_un_data16
297 #define addr_data8 address.address_un_data8
298 
299 typedef unsigned short FlowRefCount;
300 
301 typedef unsigned short FlowStateType;
302 
303 /** Local Thread ID */
304 typedef uint16_t FlowThreadId;
305 
306 /**
307  * \brief Flow data structure.
308  *
309  * The flow is a global data structure that is created for new packets of a
310  * flow and then looked up for the following packets of a flow.
311  *
312  * Locking
313  *
314  * The flow is updated/used by multiple packets at the same time. This is why
315  * there is a flow-mutex. It's a mutex and not a spinlock because some
316  * operations on the flow can be quite expensive, thus spinning would be
317  * too expensive.
318  *
319  * The flow "header" (addresses, ports, proto, recursion level) are static
320  * after the initialization and remain read-only throughout the entire live
321  * of a flow. This is why we can access those without protection of the lock.
322  */
323 
324 typedef struct Flow_
325 {
326  /* flow "header", used for hashing and flow lookup. Static after init,
327  * so safe to look at without lock */
329  union {
330  Port sp; /**< tcp/udp source port */
331  struct {
332  uint8_t type; /**< icmp type */
333  uint8_t code; /**< icmp code */
334  } icmp_s;
335  };
336  union {
337  Port dp; /**< tcp/udp destination port */
338  struct {
339  uint8_t type; /**< icmp type */
340  uint8_t code; /**< icmp code */
341  } icmp_d;
342  };
343  uint8_t proto;
345  uint16_t vlan_id[2];
346 
347  /** flow hash - the flow hash before hash table size mod. */
348  uint32_t flow_hash;
349 
350  /* time stamp of last update (last packet). Set/updated under the
351  * flow and flow hash row locks, safe to read under either the
352  * flow lock or flow hash row lock. */
353  struct timeval lastts;
354 
355  /* end of flow "header" */
356 
357  SC_ATOMIC_DECLARE(FlowStateType, flow_state);
358 
359  /** how many pkts and stream msgs are using the flow *right now*. This
360  * variable is atomic so not protected by the Flow mutex "m".
361  *
362  * On receiving a packet the counter is incremented while the flow
363  * bucked is locked, which is also the case on timeout pruning.
364  */
366 
367  /** flow tenant id, used to setup flow timeout and stream pseudo
368  * packets with the correct tenant id set */
369  uint32_t tenant_id;
370 
373 
374  uint32_t flags; /**< generic flags */
375 
376  uint16_t file_flags; /**< file tracking/extraction flags */
377  /* coccinelle: Flow:file_flags:FLOWFILE_ */
378 
379  /** destination port to be used in protocol detection. This is meant
380  * for use with STARTTLS and HTTP CONNECT detection */
381  uint16_t protodetect_dp; /**< 0 if not used */
382 
383  /* Parent flow id for protocol like ftp */
384  int64_t parent_id;
385 
386 #ifdef FLOWLOCK_RWLOCK
387  SCRWLock r;
388 #elif defined FLOWLOCK_MUTEX
390 #else
391  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
392 #endif
393 
394  /** protocol specific data pointer, e.g. for TcpSession */
395  void *protoctx;
396 
397  /** mapping to Flow's protocol specific protocols for timeouts
398  and state and free functions. */
399  uint8_t protomap;
400 
401  uint8_t flow_end_flags;
402  /* coccinelle: Flow:flow_end_flags:FLOW_END_FLAG_ */
403 
404  AppProto alproto; /**< \brief application level protocol */
407 
408  /** original application level protocol. Used to indicate the previous
409  protocol when changing to another protocol , e.g. with STARTTLS. */
411  /** expected app protocol: used in protocol change/upgrade like in
412  * STARTTLS. */
414 
415  /** detection engine ctx version used to inspect this flow. Set at initial
416  * inspection. If it doesn't match the currently in use de_ctx, the
417  * stored sgh ptrs are reset. */
418  uint32_t de_ctx_version;
419 
420  /** Thread ID for the stream/detect portion of this flow */
422 
423  /** ttl tracking */
428 
429  /** application level storage ptrs.
430  *
431  */
432  AppLayerParserState *alparser; /**< parser internal state */
433  void *alstate; /**< application layer state */
434 
435  /** toclient sgh for this flow. Only use when FLOW_SGH_TOCLIENT flow flag
436  * has been set. */
438  /** toserver sgh for this flow. Only use when FLOW_SGH_TOSERVER flow flag
439  * has been set. */
441 
442  /* pointer to the var list */
444 
445  /** hash list pointers, protected by fb->s */
446  struct Flow_ *hnext; /* hash list */
447  struct Flow_ *hprev;
448  struct FlowBucket_ *fb;
449 
450  /** queue list pointers, protected by queue mutex */
451  struct Flow_ *lnext; /* list */
452  struct Flow_ *lprev;
453  struct timeval startts;
454 
455  uint32_t todstpktcnt;
456  uint32_t tosrcpktcnt;
457  uint64_t todstbytecnt;
458  uint64_t tosrcbytecnt;
459 } Flow;
460 
461 enum FlowState {
467 };
468 
469 typedef struct FlowProtoTimeout_ {
470  uint32_t new_timeout;
471  uint32_t est_timeout;
472  uint32_t closed_timeout;
475 
476 typedef struct FlowProtoFreeFunc_ {
477  void (*Freefunc)(void *);
479 
480 /** \brief prepare packet for a life with flow
481  * Set PKT_WANTS_FLOW flag to incidate workers should do a flow lookup
482  * and calc the hash value to be used in the lookup and autofp flow
483  * balancing. */
484 void FlowSetupPacket(Packet *p);
486 void FlowInitConfig (char);
487 void FlowPrintQueueInfo (void);
488 void FlowShutdown(void);
489 void FlowSetIPOnlyFlag(Flow *, int);
490 void FlowSetHasAlertsFlag(Flow *);
491 int FlowHasAlerts(const Flow *);
494 int FlowChangeProto(Flow *);
495 void FlowSwap(Flow *);
496 
497 void FlowRegisterTests (void);
498 int FlowSetProtoTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t);
499 int FlowSetProtoEmergencyTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t);
500 int FlowSetProtoFreeFunc (uint8_t , void (*Free)(void *));
501 void FlowUpdateQueue(Flow *);
502 
503 struct FlowQueue_;
504 
505 int FlowUpdateSpareFlows(void);
506 
507 static inline void FlowSetNoPacketInspectionFlag(Flow *);
508 static inline void FlowSetNoPayloadInspectionFlag(Flow *);
509 
510 int FlowGetPacketDirection(const Flow *, const Packet *);
511 
512 void FlowCleanupAppLayer(Flow *);
513 
514 void FlowUpdateState(Flow *f, enum FlowState s);
515 
516 int FlowSetMemcap(uint64_t size);
517 uint64_t FlowGetMemcap(void);
518 uint64_t FlowGetMemuse(void);
519 
520 /** ----- Inline functions ----- */
521 
522 /** \brief Set the No Packet Inspection Flag without locking the flow.
523  *
524  * \param f Flow to set the flag in
525  */
526 static inline void FlowSetNoPacketInspectionFlag(Flow *f)
527 {
528  SCEnter();
529 
530  SCLogDebug("flow %p", f);
532 
533  SCReturn;
534 }
535 
536 /** \brief Set the No payload inspection Flag without locking the flow.
537  *
538  * \param f Flow to set the flag in
539  */
540 static inline void FlowSetNoPayloadInspectionFlag(Flow *f)
541 {
542  SCEnter();
543 
544  SCLogDebug("flow %p", f);
546 
547  SCReturn;
548 }
549 
550 /**
551  * \brief increase the use count of a flow
552  *
553  * \param f flow to decrease use count for
554  */
555 static inline void FlowIncrUsecnt(Flow *f)
556 {
557  if (f == NULL)
558  return;
559 
560  (void) SC_ATOMIC_ADD(f->use_cnt, 1);
561 }
562 
563 /**
564  * \brief decrease the use count of a flow
565  *
566  * \param f flow to decrease use count for
567  */
568 static inline void FlowDecrUsecnt(Flow *f)
569 {
570  if (f == NULL)
571  return;
572 
573  (void) SC_ATOMIC_SUB(f->use_cnt, 1);
574 }
575 
576 /** \brief Reference the flow, bumping the flows use_cnt
577  * \note This should only be called once for a destination
578  * pointer */
579 static inline void FlowReference(Flow **d, Flow *f)
580 {
581  if (likely(f != NULL)) {
582 #ifdef DEBUG_VALIDATION
583  BUG_ON(*d == f);
584 #else
585  if (*d == f)
586  return;
587 #endif
588  FlowIncrUsecnt(f);
589  *d = f;
590  }
591 }
592 
593 static inline void FlowDeReference(Flow **d)
594 {
595  if (likely(*d != NULL)) {
596  FlowDecrUsecnt(*d);
597  *d = NULL;
598  }
599 }
600 
601 /** \brief create a flow id that is as unique as possible
602  * \retval flow_id signed 64bit id
603  * \note signed because of the signedness of json_integer_t in
604  * the json output
605  */
606 static inline int64_t FlowGetId(const Flow *f)
607 {
608  int64_t id = (int64_t)f->flow_hash << 31 |
609  (int64_t)(f->startts.tv_sec & 0x0000FFFF) << 16 |
610  (int64_t)(f->startts.tv_usec & 0x0000FFFF);
611  /* reduce to 51 bits as Javascript and even JSON often seem to
612  * max out there. */
613  id &= 0x7ffffffffffffLL;
614  return id;
615 }
616 
617 int FlowClearMemory(Flow *,uint8_t );
618 
620 void *FlowGetAppState(const Flow *f);
621 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags);
622 
623 void FlowHandlePacketUpdate(Flow *f, Packet *p);
624 
625 #endif /* __FLOW_H__ */
626 
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow look...
Definition: flow-hash.c:288
AppProto alproto_expect
Definition: flow.h:413
#define SCMutex
uint16_t flags
#define SCLogDebug(...)
Definition: util-debug.h:335
uint32_t bypassed_timeout
Definition: flow.h:473
AppProto alproto_tc
Definition: flow.h:406
struct Flow_ * hnext
Definition: flow.h:446
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:437
struct FlowProtoFreeFunc_ FlowProtoFreeFunc
uint32_t emerg_timeout_new
Definition: flow.h:270
#define BUG_ON(x)
uint32_t new_timeout
Definition: flow.h:470
uint64_t todstbytecnt
Definition: flow.h:457
uint8_t proto
Definition: flow.h:343
struct Flow_ Flow
Flow data structure.
int FlowChangeProto(Flow *)
Check if change proto flag is set for flow.
Definition: flow.c:240
Port sp
Definition: flow.h:330
uint16_t FlowThreadId
Definition: flow.h:304
unsigned short FlowStateType
Definition: flow.h:301
void FlowSetIPOnlyFlag(Flow *, int)
Set the IPOnly scanned flag for &#39;direction&#39;.
Definition: flow.c:186
uint32_t tenant_id
Definition: flow.h:369
uint32_t prealloc
Definition: flow.h:265
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:107
void FlowHandlePacketUpdate(Flow *f, Packet *p)
Update Packet and Flow.
Definition: flow.c:398
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1051
void FlowPrintQueueInfo(void)
uint8_t max_ttl_toserver
Definition: flow.h:425
Address src
Definition: flow.h:280
Container for matching data for a signature group.
Definition: detect.h:1298
struct timeval startts
Definition: flow.h:453
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:124
uint32_t todstpktcnt
Definition: flow.h:455
uint16_t AppProto
AppProto FlowGetAppProtocol(const Flow *f)
Definition: flow.c:1060
void * protoctx
Definition: flow.h:395
void FlowSetHasAlertsFlag(Flow *)
Set flag to indicate that flow has alerts.
Definition: flow.c:197
struct Flow_ * hprev
Definition: flow.h:447
SC_ATOMIC_DECLARE(uint64_t, memcap)
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:372
void * alstate
Definition: flow.h:433
AppProto alproto_orig
Definition: flow.h:410
AppProto alproto_ts
Definition: flow.h:405
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:58
uint64_t tosrcbytecnt
Definition: flow.h:458
uint16_t dst
uint32_t timeout_est
Definition: flow.h:268
Port sp
Definition: flow.h:281
unsigned short FlowRefCount
Definition: flow.h:299
int FlowClearMemory(Flow *, uint8_t)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1027
uint16_t protodetect_dp
Definition: flow.h:381
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get &#39;disruption&#39; flags: GAP/DEPTH/PASS
Definition: flow.c:1077
struct Flow_ * lprev
Definition: flow.h:452
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:113
uint8_t type
void FlowUnsetChangeProtoFlag(Flow *)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:230
void FlowUpdateQueue(Flow *)
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:60
uint8_t code
Definition: flow.h:333
Structure to hold thread specific data for all decode modules.
Definition: decode.h:632
uint32_t est_timeout
Definition: flow.h:471
uint8_t recursion_level
Definition: flow.h:283
#define SCEnter(...)
Definition: util-debug.h:337
SCMutex m
Definition: flow.h:389
uint8_t type
Definition: flow.h:332
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:667
uint32_t timeout_new
Definition: flow.h:267
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:98
struct FlowKey_ FlowKey
uint16_t Port
Definition: decode.h:233
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:371
struct FlowAddress_ FlowAddress
GenericVar * flowvar
Definition: flow.h:443
uint8_t min_ttl_toserver
Definition: flow.h:424
struct FlowBucket_ * fb
Definition: flow.h:448
uint8_t flow_end_flags
Definition: flow.h:401
int FlowUpdateSpareFlows(void)
Make sure we have enough spare flows.
Definition: flow.c:144
struct Flow_ * lnext
Definition: flow.h:451
FlowThreadId thread_id
Definition: flow.h:421
int FlowSetProtoEmergencyTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
uint32_t max_flows
Definition: flow.h:264
int FlowSetProtoTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
Port dp
Definition: flow.h:337
uint8_t address
Definition: decode-ppp.h:311
void FlowUpdateState(Flow *f, enum FlowState s)
Definition: flow.c:1101
Definition: flow.h:278
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:440
uint32_t closed_timeout
Definition: flow.h:472
uint8_t max_ttl_toclient
Definition: flow.h:427
void * FlowGetAppState(const Flow *f)
Definition: flow.c:1065
int64_t parent_id
Definition: flow.h:384
void FlowSetChangeProtoFlag(Flow *)
Set flag to indicate to change proto for the flow.
Definition: flow.c:221
#define SCRWLock
void FlowCleanupAppLayer(Flow *)
Definition: flow.c:125
struct FlowCnf_ FlowConfig
uint8_t min_ttl_toclient
Definition: flow.h:426
uint32_t flow_hash
Definition: flow.h:348
uint8_t recursion_level
Definition: flow.h:344
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1327
FlowAddress src
Definition: flow.h:328
uint32_t hash_rand
Definition: flow.h:262
uint32_t de_ctx_version
Definition: flow.h:418
void FlowSwap(Flow *)
swap the flow&#39;s direction
Definition: flow.c:289
#define SCReturn
Definition: util-debug.h:339
Per thread variable structure.
Definition: threadvars.h:57
uint16_t file_flags
Definition: flow.h:376
uint8_t code
AppProto alproto
application level protocol
Definition: flow.h:404
uint8_t proto
Definition: flow.h:282
uint32_t emerg_timeout_est
Definition: flow.h:271
#define likely(expr)
Definition: util-optimize.h:32
struct FlowProtoTimeout_ FlowProtoTimeout
int FlowHasAlerts(const Flow *)
Check if flow has alerts.
Definition: flow.c:208
uint8_t protomap
Definition: flow.h:399
void FlowInitConfig(char)
initialize the configuration
Definition: flow.c:512
Flow data structure.
Definition: flow.h:324
void FlowHandlePacket(ThreadVars *, DecodeThreadVars *, Packet *)
Entry point for packet flow handling.
Definition: flow.c:496
Definition: flow.h:260
uint32_t flags
Definition: flow.h:374
FlowState
Definition: flow.h:461
uint64_t FlowGetMemuse(void)
Definition: flow.c:119
AppLayerParserState * alparser
Definition: flow.h:432
uint32_t emergency_recovery
Definition: flow.h:272
uint32_t tosrcpktcnt
Definition: flow.h:456
uint32_t hash_size
Definition: flow.h:263
int FlowGetPacketDirection(const Flow *, const Packet *)
determine the direction of the packet compared to the flow
Definition: flow.c:320