Go to the documentation of this file.
39 #define FLOW_QUIET TRUE
40 #define FLOW_VERBOSE FALSE
48 #define FLOW_TO_SRC_SEEN BIT_U32(0)
50 #define FLOW_TO_DST_SEEN BIT_U32(1)
52 #define FLOW_TCP_REUSED BIT_U32(2)
55 #define FLOW_TOSERVER_IPONLY_SET BIT_U32(3)
57 #define FLOW_TOCLIENT_IPONLY_SET BIT_U32(4)
60 #define FLOW_NOPACKET_INSPECTION BIT_U32(5)
62 #define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)
65 #define FLOW_ACTION_DROP BIT_U32(7)
68 #define FLOW_SGH_TOSERVER BIT_U32(8)
70 #define FLOW_SGH_TOCLIENT BIT_U32(9)
73 #define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)
75 #define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)
78 #define FLOW_HAS_ALERTS BIT_U32(12)
81 #define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)
83 #define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)
85 #define FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)
87 #define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)
89 #define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)
91 #define FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)
92 #define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)
95 #define FLOW_IPV4 BIT_U32(20)
97 #define FLOW_IPV6 BIT_U32(21)
99 #define FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)
100 #define FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)
103 #define FLOW_CHANGE_PROTO BIT_U32(24)
105 #define FLOW_WRONG_THREAD BIT_U32(25)
107 #define FLOW_DIR_REVERSED BIT_U32(26)
109 #define FLOW_HAS_EXPECTATION BIT_U32(27)
113 #define FLOWFILE_INIT 0
116 #define FLOWFILE_NO_MAGIC_TS BIT_U16(0)
117 #define FLOWFILE_NO_MAGIC_TC BIT_U16(1)
120 #define FLOWFILE_NO_STORE_TS BIT_U16(2)
121 #define FLOWFILE_NO_STORE_TC BIT_U16(3)
123 #define FLOWFILE_NO_MD5_TS BIT_U16(4)
124 #define FLOWFILE_NO_MD5_TC BIT_U16(5)
127 #define FLOWFILE_NO_SHA1_TS BIT_U16(6)
128 #define FLOWFILE_NO_SHA1_TC BIT_U16(7)
131 #define FLOWFILE_NO_SHA256_TS BIT_U16(8)
132 #define FLOWFILE_NO_SHA256_TC BIT_U16(9)
135 #define FLOWFILE_NO_SIZE_TS BIT_U16(10)
136 #define FLOWFILE_NO_SIZE_TC BIT_U16(11)
138 #define FLOWFILE_NONE_TS (FLOWFILE_NO_MAGIC_TS | \
139 FLOWFILE_NO_STORE_TS | \
140 FLOWFILE_NO_MD5_TS | \
141 FLOWFILE_NO_SHA1_TS | \
142 FLOWFILE_NO_SHA256_TS| \
144 #define FLOWFILE_NONE_TC (FLOWFILE_NO_MAGIC_TC | \
145 FLOWFILE_NO_STORE_TC | \
146 FLOWFILE_NO_MD5_TC | \
147 FLOWFILE_NO_SHA1_TC | \
148 FLOWFILE_NO_SHA256_TC| \
150 #define FLOWFILE_NONE (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC)
152 #define FLOW_IS_IPV4(f) \
153 (((f)->flags & FLOW_IPV4) == FLOW_IPV4)
154 #define FLOW_IS_IPV6(f) \
155 (((f)->flags & FLOW_IPV6) == FLOW_IPV6)
157 #define FLOW_GET_SP(f) \
158 ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;
159 #define FLOW_GET_DP(f) \
160 ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;
162 #define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa) do { \
163 (pa)->family = AF_INET; \
164 (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
167 #define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa) do { \
168 (pa)->family = AF_INET6; \
169 (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
170 (pa)->addr_data32[1] = (fa)->addr_data32[1]; \
171 (pa)->addr_data32[2] = (fa)->addr_data32[2]; \
172 (pa)->addr_data32[3] = (fa)->addr_data32[3]; \
180 #define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a) do { \
181 (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
182 (a)->addr_data32[1] = 0; \
183 (a)->addr_data32[2] = 0; \
184 (a)->addr_data32[3] = 0; \
187 #define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a) do { \
188 (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
189 (a)->addr_data32[1] = 0; \
190 (a)->addr_data32[2] = 0; \
191 (a)->addr_data32[3] = 0; \
195 #define FLOW_CLEAR_ADDR(a) do { \
196 (a)->addr_data32[0] = 0; \
197 (a)->addr_data32[1] = 0; \
198 (a)->addr_data32[2] = 0; \
199 (a)->addr_data32[3] = 0; \
204 #define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a) do { \
205 (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
206 (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
207 (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
208 (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
211 #define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a) do { \
212 (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
213 (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
214 (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
215 (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
219 #define FLOW_PKT_TOSERVER 0x01
220 #define FLOW_PKT_TOCLIENT 0x02
221 #define FLOW_PKT_ESTABLISHED 0x04
222 #define FLOW_PKT_TOSERVER_IPONLY_SET 0x08
223 #define FLOW_PKT_TOCLIENT_IPONLY_SET 0x10
224 #define FLOW_PKT_TOSERVER_FIRST 0x20
225 #define FLOW_PKT_TOCLIENT_FIRST 0x40
228 #define FLOW_PKT_LAST_PSEUDO 0x80
230 #define FLOW_END_FLAG_STATE_NEW 0x01
231 #define FLOW_END_FLAG_STATE_ESTABLISHED 0x02
232 #define FLOW_END_FLAG_STATE_CLOSED 0x04
233 #define FLOW_END_FLAG_EMERGENCY 0x08
234 #define FLOW_END_FLAG_TIMEOUT 0x10
235 #define FLOW_END_FLAG_FORCED 0x20
236 #define FLOW_END_FLAG_SHUTDOWN 0x40
237 #define FLOW_END_FLAG_STATE_BYPASSED 0x80
241 #define FLOWLOCK_MUTEX
243 #ifdef FLOWLOCK_RWLOCK
244 #ifdef FLOWLOCK_MUTEX
245 #error Cannot enable both FLOWLOCK_RWLOCK and FLOWLOCK_MUTEX
249 #ifdef FLOWLOCK_RWLOCK
250 #define FLOWLOCK_INIT(fb) SCRWLockInit(&(fb)->r, NULL)
251 #define FLOWLOCK_DESTROY(fb) SCRWLockDestroy(&(fb)->r)
252 #define FLOWLOCK_RDLOCK(fb) SCRWLockRDLock(&(fb)->r)
253 #define FLOWLOCK_WRLOCK(fb) SCRWLockWRLock(&(fb)->r)
254 #define FLOWLOCK_TRYRDLOCK(fb) SCRWLockTryRDLock(&(fb)->r)
255 #define FLOWLOCK_TRYWRLOCK(fb) SCRWLockTryWRLock(&(fb)->r)
256 #define FLOWLOCK_UNLOCK(fb) SCRWLockUnlock(&(fb)->r)
257 #elif defined FLOWLOCK_MUTEX
258 #define FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)
259 #define FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)
260 #define FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m)
261 #define FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m)
262 #define FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m)
263 #define FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m)
264 #define FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)
266 #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
269 #define FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))
270 #define FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))
271 #define FLOW_IS_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))
273 #define FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE))
274 #define FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE))
275 #define FLOW_SET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PE_ALPROTO_DETECT_DONE))
277 #define FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))
278 #define FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))
279 #define FLOW_RESET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))
317 #define addr_data32 address.address_un_data32
318 #define addr_data16 address.address_un_data16
319 #define addr_data8 address.address_un_data8
436 #ifdef FLOWLOCK_RWLOCK
438 #elif defined FLOWLOCK_MUTEX
441 #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
507 #ifdef CAPTURE_OFFLOAD
508 FLOW_STATE_CAPTURE_BYPASSED,
569 static inline void FlowSetNoPacketInspectionFlag(
Flow *);
570 static inline void FlowSetNoPayloadInspectionFlag(
Flow *);
593 static inline void FlowSetNoPacketInspectionFlag(
Flow *f)
607 static inline void FlowSetNoPayloadInspectionFlag(
Flow *f)
622 static inline void FlowIncrUsecnt(
Flow *f)
635 static inline void FlowDecrUsecnt(
Flow *f)
646 static inline void FlowReference(
Flow **d,
Flow *f)
649 #ifdef DEBUG_VALIDATION
660 static inline void FlowDeReference(
Flow **d)
673 static inline int64_t FlowGetId(
const Flow *f)
675 int64_t
id = (int64_t)f->
flow_hash << 31 |
676 (int64_t)(f->
startts.tv_sec & 0x0000FFFF) << 16 |
677 (int64_t)(f->
startts.tv_usec & 0x0000FFFF);
680 id &= 0x7ffffffffffffLL;
684 static inline void FlowSetEndFlags(
Flow *f)
695 #ifdef CAPTURE_OFFLOAD
696 else if (state == FLOW_STATE_CAPTURE_BYPASSED)
FlowQueuePrivate work_queue
int FlowSetMemcap(uint64_t size)
Update memcap value.
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
int FlowSetProtoEmergencyTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
Container for matching data for a signature group.
#define FLOW_END_FLAG_STATE_NEW
uint32_t emergency_recovery
void FlowHandlePacket(ThreadVars *, FlowLookupStruct *, Packet *)
Entry point for packet flow handling.
uint32_t address_un_data32[4]
int FlowUpdateSpareFlows(void)
struct FlowLookupStruct_ FlowLookupStruct
int FlowGetPacketDirection(const Flow *, const Packet *)
determine the direction of the packet compared to the flow
int FlowClearMemory(Flow *, uint8_t)
Function clear the flow memory before queueing it to spare flow queue.
#define FLOW_END_FLAG_STATE_ESTABLISHED
void FlowInitConfig(char)
initialize the configuration
#define FLOW_NOPAYLOAD_INSPECTION
struct Flow_ Flow
Flow data structure.
#define FLOW_END_FLAG_STATE_BYPASSED
uint32_t bypassed_timeout
uint32_t emerg_timeout_new
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow look...
void * FlowGetAppState(const Flow *f)
void FlowUnsetChangeProtoFlag(Flow *)
Unset flag to indicate to change proto for the flow.
int GetFlowBypassInfoID(void)
const struct SigGroupHead_ * sgh_toserver
uint32_t emerg_spare_sync_stamp
struct FlowCnf_ FlowConfig
AppLayerParserState * alparser
struct FlowProtoFreeFunc_ FlowProtoFreeFunc
@ FLOW_STATE_LOCAL_BYPASSED
void RegisterFlowBypassInfo(void)
bool(* BypassUpdate)(Flow *f, void *data, time_t tsec)
void(* BypassFree)(void *data)
int FlowSetProtoTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
void FlowSetIPOnlyFlag(Flow *, int)
Set the IPOnly scanned flag for 'direction'.
union FlowAddress_::@118 address
void FlowSwap(Flow *)
swap the flow's direction
Per thread variable structure.
void FlowShutdown(void)
shutdown the flow engine
uint64_t FlowGetMemuse(void)
struct FlowBypassInfo_ FlowBypassInfo
void FlowGetLastTimeAsParts(Flow *flow, uint64_t *secs, uint64_t *usecs)
Get flow last time as individual values.
const struct SigGroupHead_ * sgh_toclient
void FlowPrintQueueInfo(void)
int FlowChangeProto(Flow *)
Check if change proto flag is set for flow.
void FlowRegisterTests(void)
Function to register the Flow Unitests.
uint16_t address_un_data16[8]
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
Update Packet and Flow.
void FlowCleanupAppLayer(Flow *)
uint32_t probing_parser_toclient_alproto_masks
SC_ATOMIC_DECLARE(uint64_t, memcap)
uint32_t probing_parser_toserver_alproto_masks
FlowQueuePrivate spare_queue
struct FlowProtoTimeout_ FlowProtoTimeout
uint32_t emerg_timeout_est
unsigned short FlowStateType
struct Flow_::@121::@127 icmp_d
struct FlowAddress_ FlowAddress
#define FLOW_END_FLAG_STATE_CLOSED
struct LiveDevice_ * livedev
uint8_t address_un_data8[16]
Structure to hold thread specific data for all decode modules.
AppProto FlowGetAppProtocol(const Flow *f)
uint64_t FlowGetMemcap(void)
Return memcap value.
struct Flow_::@119::@126 esp
#define FLOW_NOPACKET_INSPECTION
unsigned short FlowRefCount
void FlowSetChangeProtoFlag(Flow *)
Set flag to indicate to change proto for the flow.
AppProto alproto
application level protocol
void FlowUpdateState(Flow *f, enum FlowState s)
void FlowUpdateQueue(Flow *)
struct Flow_::@119::@125 icmp_s
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
void FlowSetHasAlertsFlag(Flow *)
Set flag to indicate that flow has alerts.
FlowThreadId thread_id[2]
int FlowHasAlerts(const Flow *)
Check if flow has alerts.