Go to the documentation of this file.
41 #define FLOW_QUIET true
42 #define FLOW_VERBOSE false
50 #define FLOW_TO_SRC_SEEN BIT_U32(0)
52 #define FLOW_TO_DST_SEEN BIT_U32(1)
57 #define FLOW_TOSERVER_IPONLY_SET BIT_U32(3)
59 #define FLOW_TOCLIENT_IPONLY_SET BIT_U32(4)
62 #define FLOW_NOPACKET_INSPECTION BIT_U32(5)
64 #define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)
67 #define FLOW_ACTION_DROP BIT_U32(7)
70 #define FLOW_SGH_TOSERVER BIT_U32(8)
72 #define FLOW_SGH_TOCLIENT BIT_U32(9)
75 #define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)
77 #define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)
80 #define FLOW_HAS_ALERTS BIT_U32(12)
83 #define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)
85 #define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)
87 #define FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)
89 #define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)
91 #define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)
93 #define FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)
94 #define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)
97 #define FLOW_IPV4 BIT_U32(20)
99 #define FLOW_IPV6 BIT_U32(21)
101 #define FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)
102 #define FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)
105 #define FLOW_CHANGE_PROTO BIT_U32(24)
107 #define FLOW_WRONG_THREAD BIT_U32(25)
109 #define FLOW_DIR_REVERSED BIT_U32(26)
111 #define FLOW_HAS_EXPECTATION BIT_U32(27)
114 #define FLOW_ACTION_PASS BIT_U32(28)
118 #define FLOWFILE_INIT 0
121 #define FLOWFILE_NO_MAGIC_TS BIT_U16(0)
122 #define FLOWFILE_NO_MAGIC_TC BIT_U16(1)
125 #define FLOWFILE_NO_STORE_TS BIT_U16(2)
126 #define FLOWFILE_NO_STORE_TC BIT_U16(3)
128 #define FLOWFILE_NO_MD5_TS BIT_U16(4)
129 #define FLOWFILE_NO_MD5_TC BIT_U16(5)
132 #define FLOWFILE_NO_SHA1_TS BIT_U16(6)
133 #define FLOWFILE_NO_SHA1_TC BIT_U16(7)
136 #define FLOWFILE_NO_SHA256_TS BIT_U16(8)
137 #define FLOWFILE_NO_SHA256_TC BIT_U16(9)
140 #define FLOWFILE_NO_SIZE_TS BIT_U16(10)
141 #define FLOWFILE_NO_SIZE_TC BIT_U16(11)
144 #define FLOWFILE_STORE BIT_U16(12)
146 #define FLOWFILE_NONE_TS (FLOWFILE_NO_MAGIC_TS | \
147 FLOWFILE_NO_STORE_TS | \
148 FLOWFILE_NO_MD5_TS | \
149 FLOWFILE_NO_SHA1_TS | \
150 FLOWFILE_NO_SHA256_TS| \
152 #define FLOWFILE_NONE_TC (FLOWFILE_NO_MAGIC_TC | \
153 FLOWFILE_NO_STORE_TC | \
154 FLOWFILE_NO_MD5_TC | \
155 FLOWFILE_NO_SHA1_TC | \
156 FLOWFILE_NO_SHA256_TC| \
158 #define FLOWFILE_NONE (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC)
160 #define FLOW_IS_IPV4(f) \
161 (((f)->flags & FLOW_IPV4) == FLOW_IPV4)
162 #define FLOW_IS_IPV6(f) \
163 (((f)->flags & FLOW_IPV6) == FLOW_IPV6)
165 #define FLOW_GET_SP(f) \
166 ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;
167 #define FLOW_GET_DP(f) \
168 ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;
170 #define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa) do { \
171 (pa)->family = AF_INET; \
172 (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
175 #define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa) do { \
176 (pa)->family = AF_INET6; \
177 (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
178 (pa)->addr_data32[1] = (fa)->addr_data32[1]; \
179 (pa)->addr_data32[2] = (fa)->addr_data32[2]; \
180 (pa)->addr_data32[3] = (fa)->addr_data32[3]; \
188 #define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a) do { \
189 (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
190 (a)->addr_data32[1] = 0; \
191 (a)->addr_data32[2] = 0; \
192 (a)->addr_data32[3] = 0; \
195 #define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a) do { \
196 (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
197 (a)->addr_data32[1] = 0; \
198 (a)->addr_data32[2] = 0; \
199 (a)->addr_data32[3] = 0; \
203 #define FLOW_CLEAR_ADDR(a) do { \
204 (a)->addr_data32[0] = 0; \
205 (a)->addr_data32[1] = 0; \
206 (a)->addr_data32[2] = 0; \
207 (a)->addr_data32[3] = 0; \
212 #define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a) do { \
213 (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
214 (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
215 (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
216 (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
219 #define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a) do { \
220 (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
221 (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
222 (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
223 (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
227 #define FLOW_PKT_TOSERVER 0x01
228 #define FLOW_PKT_TOCLIENT 0x02
229 #define FLOW_PKT_ESTABLISHED 0x04
230 #define FLOW_PKT_TOSERVER_IPONLY_SET 0x08
231 #define FLOW_PKT_TOCLIENT_IPONLY_SET 0x10
232 #define FLOW_PKT_TOSERVER_FIRST 0x20
233 #define FLOW_PKT_TOCLIENT_FIRST 0x40
236 #define FLOW_PKT_LAST_PSEUDO 0x80
238 #define FLOW_END_FLAG_STATE_NEW 0x01
239 #define FLOW_END_FLAG_STATE_ESTABLISHED 0x02
240 #define FLOW_END_FLAG_STATE_CLOSED 0x04
241 #define FLOW_END_FLAG_EMERGENCY 0x08
242 #define FLOW_END_FLAG_TIMEOUT 0x10
243 #define FLOW_END_FLAG_FORCED 0x20
244 #define FLOW_END_FLAG_SHUTDOWN 0x40
245 #define FLOW_END_FLAG_STATE_BYPASSED 0x80
249 #define FLOWLOCK_MUTEX
251 #ifdef FLOWLOCK_RWLOCK
252 #ifdef FLOWLOCK_MUTEX
253 #error Cannot enable both FLOWLOCK_RWLOCK and FLOWLOCK_MUTEX
257 #ifdef FLOWLOCK_RWLOCK
258 #define FLOWLOCK_INIT(fb) SCRWLockInit(&(fb)->r, NULL)
259 #define FLOWLOCK_DESTROY(fb) SCRWLockDestroy(&(fb)->r)
260 #define FLOWLOCK_RDLOCK(fb) SCRWLockRDLock(&(fb)->r)
261 #define FLOWLOCK_WRLOCK(fb) SCRWLockWRLock(&(fb)->r)
262 #define FLOWLOCK_TRYRDLOCK(fb) SCRWLockTryRDLock(&(fb)->r)
263 #define FLOWLOCK_TRYWRLOCK(fb) SCRWLockTryWRLock(&(fb)->r)
264 #define FLOWLOCK_UNLOCK(fb) SCRWLockUnlock(&(fb)->r)
265 #elif defined FLOWLOCK_MUTEX
266 #define FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)
267 #define FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)
268 #define FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m)
269 #define FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m)
270 #define FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m)
271 #define FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m)
272 #define FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)
274 #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
277 #define FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))
278 #define FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))
279 #define FLOW_IS_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))
281 #define FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE))
282 #define FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE))
283 #define FLOW_SET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PE_ALPROTO_DETECT_DONE))
285 #define FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))
286 #define FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))
287 #define FLOW_RESET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))
327 #define addr_data32 address.address_un_data32
328 #define addr_data16 address.address_un_data16
329 #define addr_data8 address.address_un_data8
438 #ifdef FLOWLOCK_RWLOCK
440 #elif defined FLOWLOCK_MUTEX
443 #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
509 #ifdef CAPTURE_OFFLOAD
510 FLOW_STATE_CAPTURE_BYPASSED,
513 #ifdef CAPTURE_OFFLOAD
514 #define FLOW_STATE_SIZE 5
516 #define FLOW_STATE_SIZE 4
578 static inline void FlowSetNoPacketInspectionFlag(
Flow *);
579 static inline void FlowSetNoPayloadInspectionFlag(
Flow *);
601 static inline AppProto FlowGetAppProtocol(
const Flow *f)
606 static inline void *FlowGetAppState(
const Flow *f)
615 static inline void FlowSetNoPacketInspectionFlag(
Flow *f)
629 static inline void FlowSetNoPayloadInspectionFlag(
Flow *f)
642 static inline void FlowReference(
Flow **d,
Flow *f)
645 #ifdef DEBUG_VALIDATION
655 static inline void FlowDeReference(
Flow **d)
667 static inline int64_t FlowGetId(
const Flow *f)
673 id &= 0x7ffffffffffffLL;
677 static inline void FlowSetEndFlags(
Flow *f)
688 #ifdef CAPTURE_OFFLOAD
689 else if (state == FLOW_STATE_CAPTURE_BYPASSED)
694 static inline bool FlowIsBypassed(
const Flow *f)
697 #ifdef CAPTURE_OFFLOAD
698 f->
flow_state == FLOW_STATE_CAPTURE_BYPASSED ||
709 void *FlowGetAppState(
const Flow *f);
FlowQueuePrivate work_queue
union FlowAddress_::@115 address
int FlowSetMemcap(uint64_t size)
Update memcap value.
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
int FlowSetProtoEmergencyTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
Container for matching data for a signature group.
#define FLOW_END_FLAG_STATE_NEW
uint32_t emergency_recovery
void FlowHandlePacket(ThreadVars *, FlowLookupStruct *, Packet *)
Entry point for packet flow handling.
uint32_t address_un_data32[4]
int FlowUpdateSpareFlows(void)
struct FlowLookupStruct_ FlowLookupStruct
void FlowInitConfig(bool)
initialize the configuration
int FlowGetPacketDirection(const Flow *, const Packet *)
determine the direction of the packet compared to the flow
int FlowClearMemory(Flow *, uint8_t)
Function clear the flow memory before queueing it to spare flow queue.
#define FLOW_END_FLAG_STATE_ESTABLISHED
#define FLOW_NOPAYLOAD_INSPECTION
struct Flow_ Flow
Flow data structure.
#define FLOW_END_FLAG_STATE_BYPASSED
uint32_t bypassed_timeout
uint32_t emerg_timeout_new
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow look...
void FlowUnsetChangeProtoFlag(Flow *)
Unset flag to indicate to change proto for the flow.
struct Flow_::@116::@122 icmp_s
const struct SigGroupHead_ * sgh_toserver
uint32_t emerg_spare_sync_stamp
struct FlowCnf_ FlowConfig
AppLayerParserState * alparser
struct FlowProtoFreeFunc_ FlowProtoFreeFunc
@ FLOW_STATE_LOCAL_BYPASSED
bool FlowHasGaps(const Flow *, uint8_t way)
uint16_t FlowGetDestinationPort(Flow *flow)
Get flow destination port.
void RegisterFlowBypassInfo(void)
bool(* BypassUpdate)(Flow *f, void *data, time_t tsec)
void(* BypassFree)(void *data)
int FlowSetProtoTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
void FlowSetIPOnlyFlag(Flow *, int)
Set the IPOnly scanned flag for 'direction'.
void FlowSwap(Flow *)
swap the flow's direction
Per thread variable structure.
void FlowShutdown(void)
shutdown the flow engine
uint64_t FlowGetMemuse(void)
struct FlowBypassInfo_ FlowBypassInfo
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
const struct SigGroupHead_ * sgh_toclient
void FlowPrintQueueInfo(void)
int FlowChangeProto(Flow *)
Check if change proto flag is set for flow.
void FlowRegisterTests(void)
Function to register the Flow Unitests.
uint16_t address_un_data16[8]
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
uint32_t FlowGetFlags(Flow *flow)
Get flow flags.
void FlowCleanupAppLayer(Flow *)
uint32_t probing_parser_toclient_alproto_masks
SC_ATOMIC_DECLARE(uint64_t, memcap)
FlowStorageId GetFlowBypassInfoID(void)
struct Flow_::@118::@124 icmp_d
uint32_t probing_parser_toserver_alproto_masks
FlowQueuePrivate spare_queue
struct FlowProtoTimeout_ FlowProtoTimeout
uint32_t emerg_timeout_est
unsigned short FlowStateType
struct FlowAddress_ FlowAddress
#define FLOW_END_FLAG_STATE_CLOSED
struct LiveDevice_ * livedev
struct Flow_::@116::@123 esp
enum ExceptionPolicy memcap_policy
uint8_t address_un_data8[16]
Structure to hold thread specific data for all decode modules.
uint64_t FlowGetMemcap(void)
Return memcap value.
#define FLOW_NOPACKET_INSPECTION
unsigned short FlowRefCount
void FlowSetChangeProtoFlag(Flow *)
Set flag to indicate to change proto for the flow.
AppProto alproto
application level protocol
void FlowUpdateState(Flow *f, enum FlowState s)
void FlowUpdateQueue(Flow *)
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
void FlowSetHasAlertsFlag(Flow *)
Set flag to indicate that flow has alerts.
uint16_t FlowGetSourcePort(Flow *flow)
Get flow source port.
FlowThreadId thread_id[2]
int FlowHasAlerts(const Flow *)
Check if flow has alerts.