suricata
flow.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __FLOW_H__
25 #define __FLOW_H__
26 
27 #include "decode.h"
28 #include "util-var.h"
29 #include "util-atomic.h"
30 #include "util-device.h"
31 #include "detect-tag.h"
32 #include "util-optimize.h"
33 
34 /* Part of the flow structure, so we declare it here.
35  * The actual declaration is in app-layer-parser.c */
37 
38 #define FLOW_QUIET TRUE
39 #define FLOW_VERBOSE FALSE
40 
41 #define TOSERVER 0
42 #define TOCLIENT 1
43 
44 /* per flow flags */
45 
46 /** At least one packet from the source address was seen */
47 #define FLOW_TO_SRC_SEEN BIT_U32(0)
48 /** At least one packet from the destination address was seen */
49 #define FLOW_TO_DST_SEEN BIT_U32(1)
50 /** Don't return this from the flow hash. It has been replaced. */
51 #define FLOW_TCP_REUSED BIT_U32(2)
52 
53 /** Flow was inspected against IP-Only sigs in the toserver direction */
54 #define FLOW_TOSERVER_IPONLY_SET BIT_U32(3)
55 /** Flow was inspected against IP-Only sigs in the toclient direction */
56 #define FLOW_TOCLIENT_IPONLY_SET BIT_U32(4)
57 
58 /** Packet belonging to this flow should not be inspected at all */
59 #define FLOW_NOPACKET_INSPECTION BIT_U32(5)
60 /** Packet payloads belonging to this flow should not be inspected */
61 #define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)
62 
63 /** All packets in this flow should be dropped */
64 #define FLOW_ACTION_DROP BIT_U32(7)
65 
66 /** Sgh for toserver direction set (even if it's NULL) */
67 #define FLOW_SGH_TOSERVER BIT_U32(8)
68 /** Sgh for toclient direction set (even if it's NULL) */
69 #define FLOW_SGH_TOCLIENT BIT_U32(9)
70 
71 /** packet to server direction has been logged in drop file (only in IPS mode) */
72 #define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)
73 /** packet to client direction has been logged in drop file (only in IPS mode) */
74 #define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)
75 
76 /** flow has alerts */
77 #define FLOW_HAS_ALERTS BIT_U32(12)
78 
79 /** Pattern matcher alproto detection done */
80 #define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)
81 /** Probing parser alproto detection done */
82 #define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)
83 /** Expectation alproto detection done */
84 #define FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)
85 /** Pattern matcher alproto detection done */
86 #define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)
87 /** Probing parser alproto detection done */
88 #define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)
89 /** Expectation alproto detection done */
90 #define FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)
91 #define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)
92 
93 /** flow is ipv4 */
94 #define FLOW_IPV4 BIT_U32(20)
95 /** flow is ipv6 */
96 #define FLOW_IPV6 BIT_U32(21)
97 
98 #define FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)
99 #define FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)
100 
101 /** Indicate that alproto detection for flow should be done again */
102 #define FLOW_CHANGE_PROTO BIT_U32(24)
103 
104 #define FLOW_WRONG_THREAD BIT_U32(25)
105 /** Protocol detection told us flow is picked up in wrong direction (midstream) */
106 #define FLOW_DIR_REVERSED BIT_U32(26)
107 /** Indicate that the flow did trigger an expectation creation */
108 #define FLOW_HAS_EXPECTATION BIT_U32(27)
109 
110 /* File flags */
111 
112 #define FLOWFILE_INIT 0
113 
114 /** no magic on files in this flow */
115 #define FLOWFILE_NO_MAGIC_TS BIT_U16(0)
116 #define FLOWFILE_NO_MAGIC_TC BIT_U16(1)
117 
118 /** even if the flow has files, don't store 'm */
119 #define FLOWFILE_NO_STORE_TS BIT_U16(2)
120 #define FLOWFILE_NO_STORE_TC BIT_U16(3)
121 /** no md5 on files in this flow */
122 #define FLOWFILE_NO_MD5_TS BIT_U16(4)
123 #define FLOWFILE_NO_MD5_TC BIT_U16(5)
124 
125 /** no sha1 on files in this flow */
126 #define FLOWFILE_NO_SHA1_TS BIT_U16(6)
127 #define FLOWFILE_NO_SHA1_TC BIT_U16(7)
128 
129 /** no sha256 on files in this flow */
130 #define FLOWFILE_NO_SHA256_TS BIT_U16(8)
131 #define FLOWFILE_NO_SHA256_TC BIT_U16(9)
132 
133 /** no size tracking of files in this flow */
134 #define FLOWFILE_NO_SIZE_TS BIT_U16(10)
135 #define FLOWFILE_NO_SIZE_TC BIT_U16(11)
136 
137 #define FLOWFILE_NONE_TS (FLOWFILE_NO_MAGIC_TS | \
138  FLOWFILE_NO_STORE_TS | \
139  FLOWFILE_NO_MD5_TS | \
140  FLOWFILE_NO_SHA1_TS | \
141  FLOWFILE_NO_SHA256_TS| \
142  FLOWFILE_NO_SIZE_TS)
143 #define FLOWFILE_NONE_TC (FLOWFILE_NO_MAGIC_TC | \
144  FLOWFILE_NO_STORE_TC | \
145  FLOWFILE_NO_MD5_TC | \
146  FLOWFILE_NO_SHA1_TC | \
147  FLOWFILE_NO_SHA256_TC| \
148  FLOWFILE_NO_SIZE_TC)
149 #define FLOWFILE_NONE (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC)
150 
151 #define FLOW_IS_IPV4(f) \
152  (((f)->flags & FLOW_IPV4) == FLOW_IPV4)
153 #define FLOW_IS_IPV6(f) \
154  (((f)->flags & FLOW_IPV6) == FLOW_IPV6)
155 
156 #define FLOW_GET_SP(f) \
157  ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;
158 #define FLOW_GET_DP(f) \
159  ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;
160 
161 #define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa) do { \
162  (pa)->family = AF_INET; \
163  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
164  } while (0)
165 
166 #define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa) do { \
167  (pa)->family = AF_INET6; \
168  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
169  (pa)->addr_data32[1] = (fa)->addr_data32[1]; \
170  (pa)->addr_data32[2] = (fa)->addr_data32[2]; \
171  (pa)->addr_data32[3] = (fa)->addr_data32[3]; \
172  } while (0)
173 
174 /* Set the IPv4 addressesinto the Addrs of the Packet.
175  * Make sure p->ip4h is initialized and validated.
176  *
177  * We set the rest of the struct to 0 so we can
178  * prevent using memset. */
179 #define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a) do { \
180  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
181  (a)->addr_data32[1] = 0; \
182  (a)->addr_data32[2] = 0; \
183  (a)->addr_data32[3] = 0; \
184  } while (0)
185 
186 #define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a) do { \
187  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
188  (a)->addr_data32[1] = 0; \
189  (a)->addr_data32[2] = 0; \
190  (a)->addr_data32[3] = 0; \
191  } while (0)
192 
193 /* clear the address structure by setting all fields to 0 */
194 #define FLOW_CLEAR_ADDR(a) do { \
195  (a)->addr_data32[0] = 0; \
196  (a)->addr_data32[1] = 0; \
197  (a)->addr_data32[2] = 0; \
198  (a)->addr_data32[3] = 0; \
199  } while (0)
200 
201 /* Set the IPv6 addressesinto the Addrs of the Packet.
202  * Make sure p->ip6h is initialized and validated. */
203 #define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a) do { \
204  (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
205  (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
206  (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
207  (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
208  } while (0)
209 
210 #define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a) do { \
211  (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
212  (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
213  (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
214  (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
215  } while (0)
216 
217 /* pkt flow flags */
218 #define FLOW_PKT_TOSERVER 0x01
219 #define FLOW_PKT_TOCLIENT 0x02
220 #define FLOW_PKT_ESTABLISHED 0x04
221 #define FLOW_PKT_TOSERVER_IPONLY_SET 0x08
222 #define FLOW_PKT_TOCLIENT_IPONLY_SET 0x10
223 #define FLOW_PKT_TOSERVER_FIRST 0x20
224 #define FLOW_PKT_TOCLIENT_FIRST 0x40
225 
226 #define FLOW_END_FLAG_STATE_NEW 0x01
227 #define FLOW_END_FLAG_STATE_ESTABLISHED 0x02
228 #define FLOW_END_FLAG_STATE_CLOSED 0x04
229 #define FLOW_END_FLAG_EMERGENCY 0x08
230 #define FLOW_END_FLAG_TIMEOUT 0x10
231 #define FLOW_END_FLAG_FORCED 0x20
232 #define FLOW_END_FLAG_SHUTDOWN 0x40
233 #define FLOW_END_FLAG_STATE_BYPASSED 0x80
234 
235 /** Mutex or RWLocks for the flow. */
236 //#define FLOWLOCK_RWLOCK
237 #define FLOWLOCK_MUTEX
238 
239 #ifdef FLOWLOCK_RWLOCK
240  #ifdef FLOWLOCK_MUTEX
241  #error Cannot enable both FLOWLOCK_RWLOCK and FLOWLOCK_MUTEX
242  #endif
243 #endif
244 
245 #ifdef FLOWLOCK_RWLOCK
246  #define FLOWLOCK_INIT(fb) SCRWLockInit(&(fb)->r, NULL)
247  #define FLOWLOCK_DESTROY(fb) SCRWLockDestroy(&(fb)->r)
248  #define FLOWLOCK_RDLOCK(fb) SCRWLockRDLock(&(fb)->r)
249  #define FLOWLOCK_WRLOCK(fb) SCRWLockWRLock(&(fb)->r)
250  #define FLOWLOCK_TRYRDLOCK(fb) SCRWLockTryRDLock(&(fb)->r)
251  #define FLOWLOCK_TRYWRLOCK(fb) SCRWLockTryWRLock(&(fb)->r)
252  #define FLOWLOCK_UNLOCK(fb) SCRWLockUnlock(&(fb)->r)
253 #elif defined FLOWLOCK_MUTEX
254  #define FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)
255  #define FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)
256  #define FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m)
257  #define FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m)
258  #define FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m)
259  #define FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m)
260  #define FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)
261 #else
262  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
263 #endif
264 
265 #define FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))
266 #define FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))
267 #define FLOW_IS_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))
268 
269 #define FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE))
270 #define FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE))
271 #define FLOW_SET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PE_ALPROTO_DETECT_DONE))
272 
273 #define FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))
274 #define FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))
275 #define FLOW_RESET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))
276 
277 /* global flow config */
278 typedef struct FlowCnf_
279 {
280  uint32_t hash_rand;
281  uint32_t hash_size;
282  uint32_t max_flows;
283  uint32_t prealloc;
284 
285  uint32_t timeout_new;
286  uint32_t timeout_est;
287 
291 
292  SC_ATOMIC_DECLARE(uint64_t, memcap);
293 } FlowConfig;
294 
295 /* Hash key for the flow hash */
296 typedef struct FlowKey_
297 {
300  uint8_t proto;
302  uint16_t vlan_id[2];
303 } FlowKey;
304 
305 typedef struct FlowAddress_ {
306  union {
307  uint32_t address_un_data32[4]; /* type-specific field */
308  uint16_t address_un_data16[8]; /* type-specific field */
309  uint8_t address_un_data8[16]; /* type-specific field */
310  } address;
311 } FlowAddress;
312 
313 #define addr_data32 address.address_un_data32
314 #define addr_data16 address.address_un_data16
315 #define addr_data8 address.address_un_data8
316 
317 typedef unsigned short FlowRefCount;
318 
319 typedef unsigned short FlowStateType;
320 
321 /** Local Thread ID */
322 typedef uint16_t FlowThreadId;
323 
324 /**
325  * \brief Flow data structure.
326  *
327  * The flow is a global data structure that is created for new packets of a
328  * flow and then looked up for the following packets of a flow.
329  *
330  * Locking
331  *
332  * The flow is updated/used by multiple packets at the same time. This is why
333  * there is a flow-mutex. It's a mutex and not a spinlock because some
334  * operations on the flow can be quite expensive, thus spinning would be
335  * too expensive.
336  *
337  * The flow "header" (addresses, ports, proto, recursion level) are static
338  * after the initialization and remain read-only throughout the entire live
339  * of a flow. This is why we can access those without protection of the lock.
340  */
341 
342 typedef struct Flow_
343 {
344  /* flow "header", used for hashing and flow lookup. Static after init,
345  * so safe to look at without lock */
347  union {
348  Port sp; /**< tcp/udp source port */
349  struct {
350  uint8_t type; /**< icmp type */
351  uint8_t code; /**< icmp code */
352  } icmp_s;
353  };
354  union {
355  Port dp; /**< tcp/udp destination port */
356  struct {
357  uint8_t type; /**< icmp type */
358  uint8_t code; /**< icmp code */
359  } icmp_d;
360  };
361  uint8_t proto;
363  uint16_t vlan_id[2];
364  uint8_t vlan_idx;
365 
366  /** Incoming interface */
368 
369  /** flow hash - the flow hash before hash table size mod. */
370  uint32_t flow_hash;
371 
372  /* time stamp of last update (last packet). Set/updated under the
373  * flow and flow hash row locks, safe to read under either the
374  * flow lock or flow hash row lock. */
375  struct timeval lastts;
376 
377  /* end of flow "header" */
378 
379  SC_ATOMIC_DECLARE(FlowStateType, flow_state);
380 
381  /** how many pkts and stream msgs are using the flow *right now*. This
382  * variable is atomic so not protected by the Flow mutex "m".
383  *
384  * On receiving a packet the counter is incremented while the flow
385  * bucked is locked, which is also the case on timeout pruning.
386  */
388 
389  /** flow tenant id, used to setup flow timeout and stream pseudo
390  * packets with the correct tenant id set */
391  uint32_t tenant_id;
392 
395 
396  uint32_t flags; /**< generic flags */
397 
398  uint16_t file_flags; /**< file tracking/extraction flags */
399 
400  /** destination port to be used in protocol detection. This is meant
401  * for use with STARTTLS and HTTP CONNECT detection */
402  uint16_t protodetect_dp; /**< 0 if not used */
403 
404  /* Parent flow id for protocol like ftp */
405  int64_t parent_id;
406 
407 #ifdef FLOWLOCK_RWLOCK
408  SCRWLock r;
409 #elif defined FLOWLOCK_MUTEX
411 #else
412  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
413 #endif
414 
415  /** protocol specific data pointer, e.g. for TcpSession */
416  void *protoctx;
417 
418  /** mapping to Flow's protocol specific protocols for timeouts
419  and state and free functions. */
420  uint8_t protomap;
421 
422  uint8_t flow_end_flags;
423  /* coccinelle: Flow:flow_end_flags:FLOW_END_FLAG_ */
424 
425  AppProto alproto; /**< \brief application level protocol */
428 
429  /** original application level protocol. Used to indicate the previous
430  protocol when changing to another protocol , e.g. with STARTTLS. */
432  /** expected app protocol: used in protocol change/upgrade like in
433  * STARTTLS. */
435 
436  /** detection engine ctx version used to inspect this flow. Set at initial
437  * inspection. If it doesn't match the currently in use de_ctx, the
438  * stored sgh ptrs are reset. */
439  uint32_t de_ctx_version;
440 
441  /** Thread ID for the stream/detect portion of this flow */
443 
444  /** ttl tracking */
449 
450  /** application level storage ptrs.
451  *
452  */
453  AppLayerParserState *alparser; /**< parser internal state */
454  void *alstate; /**< application layer state */
455 
456  /** toclient sgh for this flow. Only use when FLOW_SGH_TOCLIENT flow flag
457  * has been set. */
459  /** toserver sgh for this flow. Only use when FLOW_SGH_TOSERVER flow flag
460  * has been set. */
462 
463  /* pointer to the var list */
465 
466  /** hash list pointers, protected by fb->s */
467  struct Flow_ *hnext; /* hash list */
468  struct Flow_ *hprev;
469  struct FlowBucket_ *fb;
470 
471  /** queue list pointers, protected by queue mutex */
472  struct Flow_ *lnext; /* list */
473  struct Flow_ *lprev;
474  struct timeval startts;
475 
476  uint32_t todstpktcnt;
477  uint32_t tosrcpktcnt;
478  uint64_t todstbytecnt;
479  uint64_t tosrcbytecnt;
480 } Flow;
481 
482 enum FlowState {
487 #ifdef CAPTURE_OFFLOAD
488  FLOW_STATE_CAPTURE_BYPASSED,
489 #endif
490 };
491 
492 typedef struct FlowProtoTimeout_ {
493  uint32_t new_timeout;
494  uint32_t est_timeout;
495  uint32_t closed_timeout;
498 
499 typedef struct FlowProtoFreeFunc_ {
500  void (*Freefunc)(void *);
502 
503 typedef struct FlowBypassInfo_ {
504  bool (* BypassUpdate)(Flow *f, void *data, time_t tsec);
505  void (* BypassFree)(void *data);
506  void *bypass_data;
507  uint64_t tosrcpktcnt;
508  uint64_t tosrcbytecnt;
509  uint64_t todstpktcnt;
510  uint64_t todstbytecnt;
512 
513 /** \brief prepare packet for a life with flow
514  * Set PKT_WANTS_FLOW flag to incidate workers should do a flow lookup
515  * and calc the hash value to be used in the lookup and autofp flow
516  * balancing. */
517 void FlowSetupPacket(Packet *p);
519 void FlowInitConfig (char);
520 void FlowPrintQueueInfo (void);
521 void FlowShutdown(void);
522 void FlowSetIPOnlyFlag(Flow *, int);
523 void FlowSetHasAlertsFlag(Flow *);
524 int FlowHasAlerts(const Flow *);
527 int FlowChangeProto(Flow *);
528 void FlowSwap(Flow *);
529 
530 void FlowRegisterTests (void);
531 int FlowSetProtoTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t);
532 int FlowSetProtoEmergencyTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t);
533 int FlowSetProtoFreeFunc (uint8_t , void (*Free)(void *));
534 void FlowUpdateQueue(Flow *);
535 
536 struct FlowQueue_;
537 
538 int FlowUpdateSpareFlows(void);
539 
540 static inline void FlowSetNoPacketInspectionFlag(Flow *);
541 static inline void FlowSetNoPayloadInspectionFlag(Flow *);
542 
543 int FlowGetPacketDirection(const Flow *, const Packet *);
544 
545 void FlowCleanupAppLayer(Flow *);
546 
547 void FlowUpdateState(Flow *f, enum FlowState s);
548 
549 int FlowSetMemcap(uint64_t size);
550 uint64_t FlowGetMemcap(void);
551 uint64_t FlowGetMemuse(void);
552 
553 int GetFlowBypassInfoID(void);
554 void RegisterFlowBypassInfo(void);
555 
556 void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs);
557 
558 /** ----- Inline functions ----- */
559 
560 /** \brief Set the No Packet Inspection Flag without locking the flow.
561  *
562  * \param f Flow to set the flag in
563  */
564 static inline void FlowSetNoPacketInspectionFlag(Flow *f)
565 {
566  SCEnter();
567 
568  SCLogDebug("flow %p", f);
570 
571  SCReturn;
572 }
573 
574 /** \brief Set the No payload inspection Flag without locking the flow.
575  *
576  * \param f Flow to set the flag in
577  */
578 static inline void FlowSetNoPayloadInspectionFlag(Flow *f)
579 {
580  SCEnter();
581 
582  SCLogDebug("flow %p", f);
584 
585  SCReturn;
586 }
587 
588 /**
589  * \brief increase the use count of a flow
590  *
591  * \param f flow to decrease use count for
592  */
593 static inline void FlowIncrUsecnt(Flow *f)
594 {
595  if (f == NULL)
596  return;
597 
598  (void) SC_ATOMIC_ADD(f->use_cnt, 1);
599 }
600 
601 /**
602  * \brief decrease the use count of a flow
603  *
604  * \param f flow to decrease use count for
605  */
606 static inline void FlowDecrUsecnt(Flow *f)
607 {
608  if (f == NULL)
609  return;
610 
611  (void) SC_ATOMIC_SUB(f->use_cnt, 1);
612 }
613 
614 /** \brief Reference the flow, bumping the flows use_cnt
615  * \note This should only be called once for a destination
616  * pointer */
617 static inline void FlowReference(Flow **d, Flow *f)
618 {
619  if (likely(f != NULL)) {
620 #ifdef DEBUG_VALIDATION
621  BUG_ON(*d == f);
622 #else
623  if (*d == f)
624  return;
625 #endif
626  FlowIncrUsecnt(f);
627  *d = f;
628  }
629 }
630 
631 static inline void FlowDeReference(Flow **d)
632 {
633  if (likely(*d != NULL)) {
634  FlowDecrUsecnt(*d);
635  *d = NULL;
636  }
637 }
638 
639 /** \brief create a flow id that is as unique as possible
640  * \retval flow_id signed 64bit id
641  * \note signed because of the signedness of json_integer_t in
642  * the json output
643  */
644 static inline int64_t FlowGetId(const Flow *f)
645 {
646  int64_t id = (int64_t)f->flow_hash << 31 |
647  (int64_t)(f->startts.tv_sec & 0x0000FFFF) << 16 |
648  (int64_t)(f->startts.tv_usec & 0x0000FFFF);
649  /* reduce to 51 bits as Javascript and even JSON often seem to
650  * max out there. */
651  id &= 0x7ffffffffffffLL;
652  return id;
653 }
654 
655 int FlowClearMemory(Flow *,uint8_t );
656 
658 void *FlowGetAppState(const Flow *f);
659 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags);
660 
661 void FlowHandlePacketUpdate(Flow *f, Packet *p);
662 
663 #endif /* __FLOW_H__ */
FlowSetMemcap
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:113
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1099
FlowBucket_
Definition: flow-hash.h:41
Flow_::recursion_level
uint8_t recursion_level
Definition: flow.h:362
FlowSetProtoEmergencyTimeout
int FlowSetProtoEmergencyTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
FlowAddress_
Definition: flow.h:305
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:484
Flow_::startts
struct timeval startts
Definition: flow.h:474
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1337
FlowKey_::src
Address src
Definition: flow.h:298
FlowBypassInfo_
Definition: flow.h:503
FlowCnf_::emergency_recovery
uint32_t emergency_recovery
Definition: flow.h:290
FlowCnf_::hash_size
uint32_t hash_size
Definition: flow.h:281
FlowAddress_::address_un_data32
uint32_t address_un_data32[4]
Definition: flow.h:307
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:335
Flow_::hnext
struct Flow_ * hnext
Definition: flow.h:467
FlowUpdateSpareFlows
int FlowUpdateSpareFlows(void)
Make sure we have enough spare flows.
Definition: flow.c:159
FlowHandlePacketUpdate
void FlowHandlePacketUpdate(Flow *f, Packet *p)
Update Packet and Flow.
Definition: flow.c:413
Flow_::proto
uint8_t proto
Definition: flow.h:361
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:71
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *, const Packet *)
determine the direction of the packet compared to the flow
Definition: flow.c:335
FlowClearMemory
int FlowClearMemory(Flow *, uint8_t)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1045
Flow_
Flow data structure.
Definition: flow.h:342
Flow_::protomap
uint8_t protomap
Definition: flow.h:420
LiveDevice_
Definition: util-device.h:40
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:107
FlowProtoTimeout_
Definition: flow.h:492
FlowInitConfig
void FlowInitConfig(char)
initialize the configuration
Definition: flow.c:530
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:61
Flow_::alproto_orig
AppProto alproto_orig
Definition: flow.h:431
Flow_::vlan_id
uint16_t vlan_id[2]
Definition: flow.h:363
Flow
struct Flow_ Flow
Flow data structure.
FlowProtoTimeout_::bypassed_timeout
uint32_t bypassed_timeout
Definition: flow.h:496
FlowBypassInfo_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:508
Flow_::icmp_s
struct Flow_::@122::@126 icmp_s
FlowCnf_::emerg_timeout_new
uint32_t emerg_timeout_new
Definition: flow.h:288
Address_
Definition: decode.h:111
FlowSetupPacket
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow look...
Definition: flow-hash.c:408
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:446
Flow_::dp
Port dp
Definition: flow.h:355
FlowGetAppState
void * FlowGetAppState(const Flow *f)
Definition: flow.c:1087
detect-tag.h
Flow_::protoctx
void * protoctx
Definition: flow.h:416
Flow_::icmp_d
struct Flow_::@124::@127 icmp_d
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:245
Flow_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(FlowStateType, flow_state)
util-var.h
GetFlowBypassInfoID
int GetFlowBypassInfoID(void)
Definition: flow-util.c:209
FlowCnf_::prealloc
uint32_t prealloc
Definition: flow.h:283
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:461
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:479
FlowConfig
struct FlowCnf_ FlowConfig
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:453
Flow_::dst
FlowAddress dst
Definition: flow.h:346
FlowProtoFreeFunc
struct FlowProtoFreeFunc_ FlowProtoFreeFunc
Flow_::fb
struct FlowBucket_ * fb
Definition: flow.h:469
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:486
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:445
Flow_::protodetect_dp
uint16_t protodetect_dp
Definition: flow.h:402
decode.h
util-device.h
FlowBypassInfo_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:510
AppLayerParserState_
Definition: app-layer-parser.c:155
RegisterFlowBypassInfo
void RegisterFlowBypassInfo(void)
Definition: flow-util.c:227
FlowBypassInfo_::BypassUpdate
bool(* BypassUpdate)(Flow *f, void *data, time_t tsec)
Definition: flow.h:504
FlowBypassInfo_::BypassFree
void(* BypassFree)(void *data)
Definition: flow.h:505
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:476
FlowSetProtoTimeout
int FlowSetProtoTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *, int)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:201
FlowSwap
void FlowSwap(Flow *)
swap the flow's direction
Definition: flow.c:304
FlowKey_::recursion_level
uint8_t recursion_level
Definition: flow.h:301
SCEnter
#define SCEnter(...)
Definition: util-debug.h:337
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:685
FlowGetMemuse
uint64_t FlowGetMemuse(void)
Definition: flow.c:134
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:422
FlowCnf_
Definition: flow.h:278
FlowState
FlowState
Definition: flow.h:482
FlowBypassInfo_::todstpktcnt
uint64_t todstpktcnt
Definition: flow.h:509
FlowProtoTimeout_::new_timeout
uint32_t new_timeout
Definition: flow.h:493
util-atomic.h
FlowProtoTimeout_::closed_timeout
uint32_t closed_timeout
Definition: flow.h:495
FlowBypassInfo_::bypass_data
void * bypass_data
Definition: flow.h:506
Flow_::m
SCMutex m
Definition: flow.h:410
FlowBypassInfo
struct FlowBypassInfo_ FlowBypassInfo
FlowCnf_::timeout_new
uint32_t timeout_new
Definition: flow.h:285
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:478
FlowGetLastTimeAsParts
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
Definition: flow.c:1142
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:265
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:458
FlowPrintQueueInfo
void FlowPrintQueueInfo(void)
FlowChangeProto
int FlowChangeProto(Flow *)
Check if change proto flag is set for flow.
Definition: flow.c:255
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:124
FlowThreadId
uint16_t FlowThreadId
Definition: flow.h:322
FlowKey_::sp
Port sp
Definition: flow.h:299
SCReturn
#define SCReturn
Definition: util-debug.h:339
Packet_
Definition: decode.h:408
Flow_::type
uint8_t type
Definition: flow.h:350
FlowRegisterTests
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1362
Port
uint16_t Port
Definition: decode.h:236
FlowKey_::vlan_id
uint16_t vlan_id[2]
Definition: flow.h:302
FlowProtoFreeFunc_::Freefunc
void(* Freefunc)(void *)
Definition: flow.h:500
FlowAddress_::address_un_data16
uint16_t address_un_data16[8]
Definition: flow.h:308
FlowCnf_::hash_rand
uint32_t hash_rand
Definition: flow.h:280
Flow_::vlan_idx
uint8_t vlan_idx
Definition: flow.h:364
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:447
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *)
Definition: flow.c:140
FlowBypassInfo_::tosrcpktcnt
uint64_t tosrcpktcnt
Definition: flow.h:507
Flow_::probing_parser_toclient_alproto_masks
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:394
Flow_::lprev
struct Flow_ * lprev
Definition: flow.h:473
FlowCnf_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(uint64_t, memcap)
Flow_::flow_hash
uint32_t flow_hash
Definition: flow.h:370
Flow_::alproto_expect
AppProto alproto_expect
Definition: flow.h:434
Flow_::src
FlowAddress src
Definition: flow.h:346
Flow_::flowvar
GenericVar * flowvar
Definition: flow.h:464
FlowQueue_
Definition: flow-queue.h:41
Flow_::probing_parser_toserver_alproto_masks
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:393
Flow_::lastts
struct timeval lastts
Definition: flow.h:375
FlowProtoTimeout
struct FlowProtoTimeout_ FlowProtoTimeout
Flow_::lnext
struct Flow_ * lnext
Definition: flow.h:472
FlowCnf_::emerg_timeout_est
uint32_t emerg_timeout_est
Definition: flow.h:289
FlowStateType
unsigned short FlowStateType
Definition: flow.h:319
flags
uint8_t flags
Definition: decode-gre.h:2
FLOW_STATE_NEW
@ FLOW_STATE_NEW
Definition: flow.h:483
Flow_::code
uint8_t code
Definition: flow.h:351
GenericVar_
Definition: util-var.h:48
FlowAddress
struct FlowAddress_ FlowAddress
FlowKey_::dst
Address dst
Definition: flow.h:298
FlowCnf_::max_flows
uint32_t max_flows
Definition: flow.h:282
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:448
Flow_::parent_id
int64_t parent_id
Definition: flow.h:405
FlowCnf_::timeout_est
uint32_t timeout_est
Definition: flow.h:286
Flow_::livedev
struct LiveDevice_ * livedev
Definition: flow.h:367
util-optimize.h
FlowAddress_::address_un_data8
uint8_t address_un_data8[16]
Definition: flow.h:309
FlowKey_::proto
uint8_t proto
Definition: flow.h:300
FLOW_STATE_CLOSED
@ FLOW_STATE_CLOSED
Definition: flow.h:485
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:622
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:426
Flow_::alstate
void * alstate
Definition: flow.h:454
Flow_::flags
uint32_t flags
Definition: flow.h:396
FlowGetAppProtocol
AppProto FlowGetAppProtocol(const Flow *f)
Definition: flow.c:1082
SCRWLock
#define SCRWLock
Definition: threads-debug.h:363
FlowGetMemcap
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:128
FlowKey_
Definition: flow.h:296
likely
#define likely(expr)
Definition: util-optimize.h:32
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:59
FlowHandlePacket
void FlowHandlePacket(ThreadVars *, DecodeThreadVars *, Packet *)
Entry point for packet flow handling.
Definition: flow.c:514
Flow_::hprev
struct Flow_ * hprev
Definition: flow.h:468
FlowProtoTimeout_::est_timeout
uint32_t est_timeout
Definition: flow.h:494
Flow_::sp
Port sp
Definition: flow.h:348
FlowRefCount
unsigned short FlowRefCount
Definition: flow.h:317
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:427
FlowSetChangeProtoFlag
void FlowSetChangeProtoFlag(Flow *)
Set flag to indicate to change proto for the flow.
Definition: flow.c:236
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:398
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:425
FlowUpdateState
void FlowUpdateState(Flow *f, enum FlowState s)
Definition: flow.c:1123
FlowKey_::dp
Port dp
Definition: flow.h:299
FlowAddress_::address
union FlowAddress_::@121 address
FlowUpdateQueue
void FlowUpdateQueue(Flow *)
FlowKey
struct FlowKey_ FlowKey
SCMutex
#define SCMutex
Definition: threads-debug.h:114
FlowSetProtoFreeFunc
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1073
Flow_::tenant_id
uint32_t tenant_id
Definition: flow.h:391
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:477
FlowSetHasAlertsFlag
void FlowSetHasAlertsFlag(Flow *)
Set flag to indicate that flow has alerts.
Definition: flow.c:212
Flow_::thread_id
FlowThreadId thread_id[2]
Definition: flow.h:442
FlowHasAlerts
int FlowHasAlerts(const Flow *)
Check if flow has alerts.
Definition: flow.c:223
FlowProtoFreeFunc_
Definition: flow.h:499
Flow_::de_ctx_version
uint32_t de_ctx_version
Definition: flow.h:439