suricata
flow.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __FLOW_H__
25 #define __FLOW_H__
26 
27 #include "decode.h"
28 #include "util-var.h"
29 #include "util-atomic.h"
30 #include "util-device.h"
31 #include "detect-tag.h"
32 #include "util-optimize.h"
33 
34 /* Part of the flow structure, so we declare it here.
35  * The actual declaration is in app-layer-parser.c */
37 
38 #define FLOW_QUIET TRUE
39 #define FLOW_VERBOSE FALSE
40 
41 #define TOSERVER 0
42 #define TOCLIENT 1
43 
44 /* per flow flags */
45 
46 /** At least one packet from the source address was seen */
47 #define FLOW_TO_SRC_SEEN BIT_U32(0)
48 /** At least one packet from the destination address was seen */
49 #define FLOW_TO_DST_SEEN BIT_U32(1)
50 /** Don't return this from the flow hash. It has been replaced. */
51 #define FLOW_TCP_REUSED BIT_U32(2)
52 
53 /** Flow was inspected against IP-Only sigs in the toserver direction */
54 #define FLOW_TOSERVER_IPONLY_SET BIT_U32(3)
55 /** Flow was inspected against IP-Only sigs in the toclient direction */
56 #define FLOW_TOCLIENT_IPONLY_SET BIT_U32(4)
57 
58 /** Packet belonging to this flow should not be inspected at all */
59 #define FLOW_NOPACKET_INSPECTION BIT_U32(5)
60 /** Packet payloads belonging to this flow should not be inspected */
61 #define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6)
62 
63 /** All packets in this flow should be dropped */
64 #define FLOW_ACTION_DROP BIT_U32(7)
65 
66 /** Sgh for toserver direction set (even if it's NULL) */
67 #define FLOW_SGH_TOSERVER BIT_U32(8)
68 /** Sgh for toclient direction set (even if it's NULL) */
69 #define FLOW_SGH_TOCLIENT BIT_U32(9)
70 
71 /** packet to server direction has been logged in drop file (only in IPS mode) */
72 #define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10)
73 /** packet to client direction has been logged in drop file (only in IPS mode) */
74 #define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11)
75 
76 /** flow has alerts */
77 #define FLOW_HAS_ALERTS BIT_U32(12)
78 
79 /** Pattern matcher alproto detection done */
80 #define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13)
81 /** Probing parser alproto detection done */
82 #define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14)
83 /** Expectation alproto detection done */
84 #define FLOW_TS_PE_ALPROTO_DETECT_DONE BIT_U32(15)
85 /** Pattern matcher alproto detection done */
86 #define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(16)
87 /** Probing parser alproto detection done */
88 #define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(17)
89 /** Expectation alproto detection done */
90 #define FLOW_TC_PE_ALPROTO_DETECT_DONE BIT_U32(18)
91 #define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(19)
92 
93 /** flow is ipv4 */
94 #define FLOW_IPV4 BIT_U32(20)
95 /** flow is ipv6 */
96 #define FLOW_IPV6 BIT_U32(21)
97 
98 #define FLOW_PROTO_DETECT_TS_DONE BIT_U32(22)
99 #define FLOW_PROTO_DETECT_TC_DONE BIT_U32(23)
100 
101 /** Indicate that alproto detection for flow should be done again */
102 #define FLOW_CHANGE_PROTO BIT_U32(24)
103 
104 #define FLOW_WRONG_THREAD BIT_U32(25)
105 /** Protocol detection told us flow is picked up in wrong direction (midstream) */
106 #define FLOW_DIR_REVERSED BIT_U32(26)
107 
108 /* File flags */
109 
110 /** no magic on files in this flow */
111 #define FLOWFILE_NO_MAGIC_TS BIT_U16(0)
112 #define FLOWFILE_NO_MAGIC_TC BIT_U16(1)
113 
114 /** even if the flow has files, don't store 'm */
115 #define FLOWFILE_NO_STORE_TS BIT_U16(2)
116 #define FLOWFILE_NO_STORE_TC BIT_U16(3)
117 /** no md5 on files in this flow */
118 #define FLOWFILE_NO_MD5_TS BIT_U16(4)
119 #define FLOWFILE_NO_MD5_TC BIT_U16(5)
120 
121 /** no sha1 on files in this flow */
122 #define FLOWFILE_NO_SHA1_TS BIT_U16(6)
123 #define FLOWFILE_NO_SHA1_TC BIT_U16(7)
124 
125 /** no sha256 on files in this flow */
126 #define FLOWFILE_NO_SHA256_TS BIT_U16(8)
127 #define FLOWFILE_NO_SHA256_TC BIT_U16(9)
128 
129 /** no size tracking of files in this flow */
130 #define FLOWFILE_NO_SIZE_TS BIT_U16(10)
131 #define FLOWFILE_NO_SIZE_TC BIT_U16(11)
132 
133 
134 #define FLOW_IS_IPV4(f) \
135  (((f)->flags & FLOW_IPV4) == FLOW_IPV4)
136 #define FLOW_IS_IPV6(f) \
137  (((f)->flags & FLOW_IPV6) == FLOW_IPV6)
138 
139 #define FLOW_GET_SP(f) \
140  ((f)->flags & FLOW_DIR_REVERSED) ? (f)->dp : (f)->sp;
141 #define FLOW_GET_DP(f) \
142  ((f)->flags & FLOW_DIR_REVERSED) ? (f)->sp : (f)->dp;
143 
144 #define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa) do { \
145  (pa)->family = AF_INET; \
146  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
147  } while (0)
148 
149 #define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa) do { \
150  (pa)->family = AF_INET6; \
151  (pa)->addr_data32[0] = (fa)->addr_data32[0]; \
152  (pa)->addr_data32[1] = (fa)->addr_data32[1]; \
153  (pa)->addr_data32[2] = (fa)->addr_data32[2]; \
154  (pa)->addr_data32[3] = (fa)->addr_data32[3]; \
155  } while (0)
156 
157 /* Set the IPv4 addressesinto the Addrs of the Packet.
158  * Make sure p->ip4h is initialized and validated.
159  *
160  * We set the rest of the struct to 0 so we can
161  * prevent using memset. */
162 #define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a) do { \
163  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
164  (a)->addr_data32[1] = 0; \
165  (a)->addr_data32[2] = 0; \
166  (a)->addr_data32[3] = 0; \
167  } while (0)
168 
169 #define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a) do { \
170  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
171  (a)->addr_data32[1] = 0; \
172  (a)->addr_data32[2] = 0; \
173  (a)->addr_data32[3] = 0; \
174  } while (0)
175 
176 /* clear the address structure by setting all fields to 0 */
177 #define FLOW_CLEAR_ADDR(a) do { \
178  (a)->addr_data32[0] = 0; \
179  (a)->addr_data32[1] = 0; \
180  (a)->addr_data32[2] = 0; \
181  (a)->addr_data32[3] = 0; \
182  } while (0)
183 
184 /* Set the IPv6 addressesinto the Addrs of the Packet.
185  * Make sure p->ip6h is initialized and validated. */
186 #define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a) do { \
187  (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
188  (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
189  (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
190  (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
191  } while (0)
192 
193 #define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a) do { \
194  (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
195  (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
196  (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
197  (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
198  } while (0)
199 
200 /* pkt flow flags */
201 #define FLOW_PKT_TOSERVER 0x01
202 #define FLOW_PKT_TOCLIENT 0x02
203 #define FLOW_PKT_ESTABLISHED 0x04
204 #define FLOW_PKT_TOSERVER_IPONLY_SET 0x08
205 #define FLOW_PKT_TOCLIENT_IPONLY_SET 0x10
206 #define FLOW_PKT_TOSERVER_FIRST 0x20
207 #define FLOW_PKT_TOCLIENT_FIRST 0x40
208 
209 #define FLOW_END_FLAG_STATE_NEW 0x01
210 #define FLOW_END_FLAG_STATE_ESTABLISHED 0x02
211 #define FLOW_END_FLAG_STATE_CLOSED 0x04
212 #define FLOW_END_FLAG_EMERGENCY 0x08
213 #define FLOW_END_FLAG_TIMEOUT 0x10
214 #define FLOW_END_FLAG_FORCED 0x20
215 #define FLOW_END_FLAG_SHUTDOWN 0x40
216 #define FLOW_END_FLAG_STATE_BYPASSED 0x80
217 
218 /** Mutex or RWLocks for the flow. */
219 //#define FLOWLOCK_RWLOCK
220 #define FLOWLOCK_MUTEX
221 
222 #ifdef FLOWLOCK_RWLOCK
223  #ifdef FLOWLOCK_MUTEX
224  #error Cannot enable both FLOWLOCK_RWLOCK and FLOWLOCK_MUTEX
225  #endif
226 #endif
227 
228 #ifdef FLOWLOCK_RWLOCK
229  #define FLOWLOCK_INIT(fb) SCRWLockInit(&(fb)->r, NULL)
230  #define FLOWLOCK_DESTROY(fb) SCRWLockDestroy(&(fb)->r)
231  #define FLOWLOCK_RDLOCK(fb) SCRWLockRDLock(&(fb)->r)
232  #define FLOWLOCK_WRLOCK(fb) SCRWLockWRLock(&(fb)->r)
233  #define FLOWLOCK_TRYRDLOCK(fb) SCRWLockTryRDLock(&(fb)->r)
234  #define FLOWLOCK_TRYWRLOCK(fb) SCRWLockTryWRLock(&(fb)->r)
235  #define FLOWLOCK_UNLOCK(fb) SCRWLockUnlock(&(fb)->r)
236 #elif defined FLOWLOCK_MUTEX
237  #define FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL)
238  #define FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m)
239  #define FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m)
240  #define FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m)
241  #define FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m)
242  #define FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m)
243  #define FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m)
244 #else
245  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
246 #endif
247 
248 #define FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE))
249 #define FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE))
250 #define FLOW_IS_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PE_ALPROTO_DETECT_DONE))
251 
252 #define FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE))
253 #define FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE))
254 #define FLOW_SET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PE_ALPROTO_DETECT_DONE))
255 
256 #define FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE))
257 #define FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE))
258 #define FLOW_RESET_PE_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PE_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PE_ALPROTO_DETECT_DONE))
259 
260 /* global flow config */
261 typedef struct FlowCnf_
262 {
263  uint32_t hash_rand;
264  uint32_t hash_size;
265  uint32_t max_flows;
266  uint32_t prealloc;
267 
268  uint32_t timeout_new;
269  uint32_t timeout_est;
270 
274 
275  SC_ATOMIC_DECLARE(uint64_t, memcap);
276 } FlowConfig;
277 
278 /* Hash key for the flow hash */
279 typedef struct FlowKey_
280 {
282  Port sp, dp;
283  uint8_t proto;
285  uint16_t vlan_id[2];
286 } FlowKey;
287 
288 typedef struct FlowAddress_ {
289  union {
290  uint32_t address_un_data32[4]; /* type-specific field */
291  uint16_t address_un_data16[8]; /* type-specific field */
292  uint8_t address_un_data8[16]; /* type-specific field */
293  } address;
294 } FlowAddress;
295 
296 #define addr_data32 address.address_un_data32
297 #define addr_data16 address.address_un_data16
298 #define addr_data8 address.address_un_data8
299 
300 typedef unsigned short FlowRefCount;
301 
302 typedef unsigned short FlowStateType;
303 
304 /** Local Thread ID */
305 typedef uint16_t FlowThreadId;
306 
307 /**
308  * \brief Flow data structure.
309  *
310  * The flow is a global data structure that is created for new packets of a
311  * flow and then looked up for the following packets of a flow.
312  *
313  * Locking
314  *
315  * The flow is updated/used by multiple packets at the same time. This is why
316  * there is a flow-mutex. It's a mutex and not a spinlock because some
317  * operations on the flow can be quite expensive, thus spinning would be
318  * too expensive.
319  *
320  * The flow "header" (addresses, ports, proto, recursion level) are static
321  * after the initialization and remain read-only throughout the entire live
322  * of a flow. This is why we can access those without protection of the lock.
323  */
324 
325 typedef struct Flow_
326 {
327  /* flow "header", used for hashing and flow lookup. Static after init,
328  * so safe to look at without lock */
330  union {
331  Port sp; /**< tcp/udp source port */
332  struct {
333  uint8_t type; /**< icmp type */
334  uint8_t code; /**< icmp code */
335  } icmp_s;
336  };
337  union {
338  Port dp; /**< tcp/udp destination port */
339  struct {
340  uint8_t type; /**< icmp type */
341  uint8_t code; /**< icmp code */
342  } icmp_d;
343  };
344  uint8_t proto;
346  uint16_t vlan_id[2];
347  uint8_t vlan_idx;
348 
349  /** Incoming interface */
351 
352  /** flow hash - the flow hash before hash table size mod. */
353  uint32_t flow_hash;
354 
355  /* time stamp of last update (last packet). Set/updated under the
356  * flow and flow hash row locks, safe to read under either the
357  * flow lock or flow hash row lock. */
358  struct timeval lastts;
359 
360  /* end of flow "header" */
361 
362  SC_ATOMIC_DECLARE(FlowStateType, flow_state);
363 
364  /** how many pkts and stream msgs are using the flow *right now*. This
365  * variable is atomic so not protected by the Flow mutex "m".
366  *
367  * On receiving a packet the counter is incremented while the flow
368  * bucked is locked, which is also the case on timeout pruning.
369  */
371 
372  /** flow tenant id, used to setup flow timeout and stream pseudo
373  * packets with the correct tenant id set */
374  uint32_t tenant_id;
375 
378 
379  uint32_t flags; /**< generic flags */
380 
381  uint16_t file_flags; /**< file tracking/extraction flags */
382  /* coccinelle: Flow:file_flags:FLOWFILE_ */
383 
384  /** destination port to be used in protocol detection. This is meant
385  * for use with STARTTLS and HTTP CONNECT detection */
386  uint16_t protodetect_dp; /**< 0 if not used */
387 
388  /* Parent flow id for protocol like ftp */
389  int64_t parent_id;
390 
391 #ifdef FLOWLOCK_RWLOCK
392  SCRWLock r;
393 #elif defined FLOWLOCK_MUTEX
395 #else
396  #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX
397 #endif
398 
399  /** protocol specific data pointer, e.g. for TcpSession */
400  void *protoctx;
401 
402  /** mapping to Flow's protocol specific protocols for timeouts
403  and state and free functions. */
404  uint8_t protomap;
405 
406  uint8_t flow_end_flags;
407  /* coccinelle: Flow:flow_end_flags:FLOW_END_FLAG_ */
408 
409  AppProto alproto; /**< \brief application level protocol */
412 
413  /** original application level protocol. Used to indicate the previous
414  protocol when changing to another protocol , e.g. with STARTTLS. */
416  /** expected app protocol: used in protocol change/upgrade like in
417  * STARTTLS. */
419 
420  /** detection engine ctx version used to inspect this flow. Set at initial
421  * inspection. If it doesn't match the currently in use de_ctx, the
422  * stored sgh ptrs are reset. */
423  uint32_t de_ctx_version;
424 
425  /** Thread ID for the stream/detect portion of this flow */
427 
428  /** ttl tracking */
433 
434  /** application level storage ptrs.
435  *
436  */
437  AppLayerParserState *alparser; /**< parser internal state */
438  void *alstate; /**< application layer state */
439 
440  /** toclient sgh for this flow. Only use when FLOW_SGH_TOCLIENT flow flag
441  * has been set. */
443  /** toserver sgh for this flow. Only use when FLOW_SGH_TOSERVER flow flag
444  * has been set. */
446 
447  /* pointer to the var list */
449 
450  /** hash list pointers, protected by fb->s */
451  struct Flow_ *hnext; /* hash list */
452  struct Flow_ *hprev;
453  struct FlowBucket_ *fb;
454 
455  /** queue list pointers, protected by queue mutex */
456  struct Flow_ *lnext; /* list */
457  struct Flow_ *lprev;
458  struct timeval startts;
459 
460  uint32_t todstpktcnt;
461  uint32_t tosrcpktcnt;
462  uint64_t todstbytecnt;
463  uint64_t tosrcbytecnt;
464 } Flow;
465 
466 enum FlowState {
472 };
473 
474 typedef struct FlowProtoTimeout_ {
475  uint32_t new_timeout;
476  uint32_t est_timeout;
477  uint32_t closed_timeout;
480 
481 typedef struct FlowProtoFreeFunc_ {
482  void (*Freefunc)(void *);
484 
485 typedef struct FlowBypassInfo_ {
486  bool (* BypassUpdate)(Flow *f, void *data, time_t tsec);
487  void (* BypassFree)(void *data);
488  void *bypass_data;
489  uint64_t tosrcpktcnt;
490  uint64_t tosrcbytecnt;
491  uint64_t todstpktcnt;
492  uint64_t todstbytecnt;
494 
495 /** \brief prepare packet for a life with flow
496  * Set PKT_WANTS_FLOW flag to incidate workers should do a flow lookup
497  * and calc the hash value to be used in the lookup and autofp flow
498  * balancing. */
499 void FlowSetupPacket(Packet *p);
501 void FlowInitConfig (char);
502 void FlowPrintQueueInfo (void);
503 void FlowShutdown(void);
504 void FlowSetIPOnlyFlag(Flow *, int);
505 void FlowSetHasAlertsFlag(Flow *);
506 int FlowHasAlerts(const Flow *);
509 int FlowChangeProto(Flow *);
510 void FlowSwap(Flow *);
511 
512 void FlowRegisterTests (void);
513 int FlowSetProtoTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t);
514 int FlowSetProtoEmergencyTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t);
515 int FlowSetProtoFreeFunc (uint8_t , void (*Free)(void *));
516 void FlowUpdateQueue(Flow *);
517 
518 struct FlowQueue_;
519 
520 int FlowUpdateSpareFlows(void);
521 
522 static inline void FlowSetNoPacketInspectionFlag(Flow *);
523 static inline void FlowSetNoPayloadInspectionFlag(Flow *);
524 
525 int FlowGetPacketDirection(const Flow *, const Packet *);
526 
527 void FlowCleanupAppLayer(Flow *);
528 
529 void FlowUpdateState(Flow *f, enum FlowState s);
530 
531 int FlowSetMemcap(uint64_t size);
532 uint64_t FlowGetMemcap(void);
533 uint64_t FlowGetMemuse(void);
534 
535 int GetFlowBypassInfoID(void);
536 void RegisterFlowBypassInfo(void);
537 
538 /** ----- Inline functions ----- */
539 
540 /** \brief Set the No Packet Inspection Flag without locking the flow.
541  *
542  * \param f Flow to set the flag in
543  */
544 static inline void FlowSetNoPacketInspectionFlag(Flow *f)
545 {
546  SCEnter();
547 
548  SCLogDebug("flow %p", f);
550 
551  SCReturn;
552 }
553 
554 /** \brief Set the No payload inspection Flag without locking the flow.
555  *
556  * \param f Flow to set the flag in
557  */
558 static inline void FlowSetNoPayloadInspectionFlag(Flow *f)
559 {
560  SCEnter();
561 
562  SCLogDebug("flow %p", f);
564 
565  SCReturn;
566 }
567 
568 /**
569  * \brief increase the use count of a flow
570  *
571  * \param f flow to decrease use count for
572  */
573 static inline void FlowIncrUsecnt(Flow *f)
574 {
575  if (f == NULL)
576  return;
577 
578  (void) SC_ATOMIC_ADD(f->use_cnt, 1);
579 }
580 
581 /**
582  * \brief decrease the use count of a flow
583  *
584  * \param f flow to decrease use count for
585  */
586 static inline void FlowDecrUsecnt(Flow *f)
587 {
588  if (f == NULL)
589  return;
590 
591  (void) SC_ATOMIC_SUB(f->use_cnt, 1);
592 }
593 
594 /** \brief Reference the flow, bumping the flows use_cnt
595  * \note This should only be called once for a destination
596  * pointer */
597 static inline void FlowReference(Flow **d, Flow *f)
598 {
599  if (likely(f != NULL)) {
600 #ifdef DEBUG_VALIDATION
601  BUG_ON(*d == f);
602 #else
603  if (*d == f)
604  return;
605 #endif
606  FlowIncrUsecnt(f);
607  *d = f;
608  }
609 }
610 
611 static inline void FlowDeReference(Flow **d)
612 {
613  if (likely(*d != NULL)) {
614  FlowDecrUsecnt(*d);
615  *d = NULL;
616  }
617 }
618 
619 /** \brief create a flow id that is as unique as possible
620  * \retval flow_id signed 64bit id
621  * \note signed because of the signedness of json_integer_t in
622  * the json output
623  */
624 static inline int64_t FlowGetId(const Flow *f)
625 {
626  int64_t id = (int64_t)f->flow_hash << 31 |
627  (int64_t)(f->startts.tv_sec & 0x0000FFFF) << 16 |
628  (int64_t)(f->startts.tv_usec & 0x0000FFFF);
629  /* reduce to 51 bits as Javascript and even JSON often seem to
630  * max out there. */
631  id &= 0x7ffffffffffffLL;
632  return id;
633 }
634 
635 int FlowClearMemory(Flow *,uint8_t );
636 
638 void *FlowGetAppState(const Flow *f);
639 uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags);
640 
641 void FlowHandlePacketUpdate(Flow *f, Packet *p);
642 
643 #endif /* __FLOW_H__ */
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to incidate workers should do a flow look...
Definition: flow-hash.c:352
AppProto alproto_expect
Definition: flow.h:418
#define SCMutex
uint16_t flags
#define SCLogDebug(...)
Definition: util-debug.h:335
uint64_t tosrcbytecnt
Definition: flow.h:490
uint32_t bypassed_timeout
Definition: flow.h:478
AppProto alproto_tc
Definition: flow.h:411
struct Flow_ * hnext
Definition: flow.h:451
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:442
struct FlowProtoFreeFunc_ FlowProtoFreeFunc
uint32_t emerg_timeout_new
Definition: flow.h:271
#define BUG_ON(x)
uint32_t new_timeout
Definition: flow.h:475
uint64_t todstbytecnt
Definition: flow.h:462
uint8_t proto
Definition: flow.h:344
struct Flow_ Flow
Flow data structure.
int FlowChangeProto(Flow *)
Check if change proto flag is set for flow.
Definition: flow.c:240
Port sp
Definition: flow.h:331
uint16_t FlowThreadId
Definition: flow.h:305
unsigned short FlowStateType
Definition: flow.h:302
void FlowSetIPOnlyFlag(Flow *, int)
Set the IPOnly scanned flag for &#39;direction&#39;.
Definition: flow.c:186
uint32_t tenant_id
Definition: flow.h:374
uint32_t prealloc
Definition: flow.h:266
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:107
void FlowHandlePacketUpdate(Flow *f, Packet *p)
Update Packet and Flow.
Definition: flow.c:398
int FlowSetProtoFreeFunc(uint8_t, void(*Free)(void *))
Function to set the function to get protocol specific flow state.
Definition: flow.c:1051
struct FlowBypassInfo_ FlowBypassInfo
void FlowPrintQueueInfo(void)
uint8_t max_ttl_toserver
Definition: flow.h:430
Address src
Definition: flow.h:281
Container for matching data for a signature group.
Definition: detect.h:1321
struct timeval startts
Definition: flow.h:458
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:124
uint32_t todstpktcnt
Definition: flow.h:460
uint16_t AppProto
uint64_t todstpktcnt
Definition: flow.h:491
AppProto FlowGetAppProtocol(const Flow *f)
Definition: flow.c:1060
void * protoctx
Definition: flow.h:400
void FlowSetHasAlertsFlag(Flow *)
Set flag to indicate that flow has alerts.
Definition: flow.c:197
struct Flow_ * hprev
Definition: flow.h:452
uint64_t todstbytecnt
Definition: flow.h:492
SC_ATOMIC_DECLARE(uint64_t, memcap)
uint32_t probing_parser_toclient_alproto_masks
Definition: flow.h:377
void * alstate
Definition: flow.h:438
AppProto alproto_orig
Definition: flow.h:415
AppProto alproto_ts
Definition: flow.h:410
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:59
uint64_t tosrcbytecnt
Definition: flow.h:463
uint16_t dst
uint32_t timeout_est
Definition: flow.h:269
Port sp
Definition: flow.h:282
unsigned short FlowRefCount
Definition: flow.h:300
int FlowClearMemory(Flow *, uint8_t)
Function clear the flow memory before queueing it to spare flow queue.
Definition: flow.c:1027
uint16_t protodetect_dp
Definition: flow.h:386
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get &#39;disruption&#39; flags: GAP/DEPTH/PASS
Definition: flow.c:1077
struct Flow_ * lprev
Definition: flow.h:457
uint64_t FlowGetMemcap(void)
Return memcap value.
Definition: flow.c:113
uint8_t type
void FlowUnsetChangeProtoFlag(Flow *)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:230
void FlowUpdateQueue(Flow *)
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:61
uint8_t code
Definition: flow.h:334
Structure to hold thread specific data for all decode modules.
Definition: decode.h:632
uint32_t est_timeout
Definition: flow.h:476
uint8_t recursion_level
Definition: flow.h:284
#define SCEnter(...)
Definition: util-debug.h:337
SCMutex m
Definition: flow.h:394
uint8_t type
Definition: flow.h:333
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:667
uint32_t timeout_new
Definition: flow.h:268
int FlowSetMemcap(uint64_t size)
Update memcap value.
Definition: flow.c:98
uint8_t vlan_idx
Definition: flow.h:347
void * bypass_data
Definition: flow.h:488
void RegisterFlowBypassInfo(void)
Definition: flow-util.c:227
struct FlowKey_ FlowKey
struct LiveDevice_ * livedev
Definition: flow.h:350
uint16_t Port
Definition: decode.h:233
uint32_t probing_parser_toserver_alproto_masks
Definition: flow.h:376
struct FlowAddress_ FlowAddress
GenericVar * flowvar
Definition: flow.h:448
uint8_t min_ttl_toserver
Definition: flow.h:429
struct FlowBucket_ * fb
Definition: flow.h:453
uint8_t flow_end_flags
Definition: flow.h:406
int FlowUpdateSpareFlows(void)
Make sure we have enough spare flows.
Definition: flow.c:144
struct Flow_ * lnext
Definition: flow.h:456
FlowThreadId thread_id
Definition: flow.h:426
int FlowSetProtoEmergencyTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
int GetFlowBypassInfoID(void)
Definition: flow-util.c:209
uint32_t max_flows
Definition: flow.h:265
int FlowSetProtoTimeout(uint8_t, uint32_t, uint32_t, uint32_t)
Port dp
Definition: flow.h:338
uint8_t address
Definition: decode-ppp.h:311
void FlowUpdateState(Flow *f, enum FlowState s)
Definition: flow.c:1101
Definition: flow.h:279
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:445
uint32_t closed_timeout
Definition: flow.h:477
uint8_t max_ttl_toclient
Definition: flow.h:432
uint64_t tosrcpktcnt
Definition: flow.h:489
void * FlowGetAppState(const Flow *f)
Definition: flow.c:1065
int64_t parent_id
Definition: flow.h:389
void FlowSetChangeProtoFlag(Flow *)
Set flag to indicate to change proto for the flow.
Definition: flow.c:221
#define SCRWLock
void FlowCleanupAppLayer(Flow *)
Definition: flow.c:125
struct FlowCnf_ FlowConfig
uint8_t min_ttl_toclient
Definition: flow.h:431
uint32_t flow_hash
Definition: flow.h:353
uint8_t recursion_level
Definition: flow.h:345
void FlowRegisterTests(void)
Function to register the Flow Unitests.
Definition: flow.c:1327
FlowAddress src
Definition: flow.h:329
uint32_t hash_rand
Definition: flow.h:263
uint32_t de_ctx_version
Definition: flow.h:423
void FlowSwap(Flow *)
swap the flow&#39;s direction
Definition: flow.c:289
#define SCReturn
Definition: util-debug.h:339
Per thread variable structure.
Definition: threadvars.h:57
uint16_t file_flags
Definition: flow.h:381
uint8_t code
AppProto alproto
application level protocol
Definition: flow.h:409
uint8_t proto
Definition: flow.h:283
uint32_t emerg_timeout_est
Definition: flow.h:272
#define likely(expr)
Definition: util-optimize.h:32
struct FlowProtoTimeout_ FlowProtoTimeout
int FlowHasAlerts(const Flow *)
Check if flow has alerts.
Definition: flow.c:208
uint8_t protomap
Definition: flow.h:404
void FlowInitConfig(char)
initialize the configuration
Definition: flow.c:512
Flow data structure.
Definition: flow.h:325
void FlowHandlePacket(ThreadVars *, DecodeThreadVars *, Packet *)
Entry point for packet flow handling.
Definition: flow.c:496
Definition: flow.h:261
uint32_t flags
Definition: flow.h:379
FlowState
Definition: flow.h:466
uint64_t FlowGetMemuse(void)
Definition: flow.c:119
AppLayerParserState * alparser
Definition: flow.h:437
uint32_t emergency_recovery
Definition: flow.h:273
uint32_t tosrcpktcnt
Definition: flow.h:461
uint32_t hash_size
Definition: flow.h:264
int FlowGetPacketDirection(const Flow *, const Packet *)
determine the direction of the packet compared to the flow
Definition: flow.c:320