Flow data structure. More...
#include <flow.h>
Detailed Description
Flow data structure.
The flow is a global data structure that is created for new packets of a flow and then looked up for the following packets of a flow.
Locking
The flow is updated/used by multiple packets at the same time. This is why there is a flow-mutex. It's a mutex and not a spinlock because some operations on the flow can be quite expensive, thus spinning would be too expensive.
The flow "header" (addresses, ports, proto, recursion level) are static after the initialization and remain read-only throughout the entire live of a flow. This is why we can access those without protection of the lock.
Field Documentation
◆ @127
| union { ... } |
◆ @129
| union { ... } |
◆ @131
| union { ... } |
◆ alparser
| AppLayerParserState* Flow_::alparser |
application level storage ptrs. parser internal state
Definition at line 485 of file flow.h.
Referenced by AppLayerFrameDump(), AppLayerFramesFreeContainer(), AppLayerFramesGetContainer(), AppLayerFramesSetupContainer(), AppLayerParserParse(), AppLayerProtoDetectReset(), FlowCleanupAppLayer(), FlowNeedsReassembly(), FlowUpdateState(), LLVMFuzzerTestOneInput(), Prefilter(), and StreamTcpDisableAppLayer().
◆ alproto
| AppProto Flow_::alproto |
application level protocol
Definition at line 457 of file flow.h.
Referenced by AppLayerFramesSetupContainer(), AppLayerHandleTCPData(), AppLayerHandleUdp(), AppLayerIncAllocErrorCounter(), AppLayerIncGapErrorCounter(), AppLayerIncInternalErrorCounter(), AppLayerIncParserErrorCounter(), AppLayerIncTxCounter(), AppLayerParserSetTransactionInspectId(), AppLayerParserStateCleanup(), AppLayerProtoDetectReset(), AppLayerRequestProtocolChange(), DetectEngineInspectFiledata(), DetectRunFrameInspectRule(), DetectRunStoreStateTx(), EveAddAppProto(), FlowNeedsReassembly(), FrameJsonLogOneFrame(), JsonBuildFileInfoRecord(), LLVMFuzzerTestOneInput(), LuaExtensionsMatchSetup(), LuaStateNeedProto(), Prefilter(), RulesDumpMatchArray(), RulesDumpTxMatchArray(), SCAppLayerForceProtocolChange(), SCFlowGetAppProtocol(), SCLuaTxRefInit(), and SCLuaTxRefResolve().
◆ alproto_expect
| AppProto Flow_::alproto_expect |
expected app protocol: used in protocol change/upgrade like in STARTTLS.
Definition at line 466 of file flow.h.
Referenced by AppLayerRequestProtocolChange(), EveAddAppProto(), and SCAppLayerForceProtocolChange().
◆ alproto_orig
| AppProto Flow_::alproto_orig |
original application level protocol. Used to indicate the previous protocol when changing to another protocol , e.g. with STARTTLS.
Definition at line 463 of file flow.h.
Referenced by AppLayerRequestProtocolChange(), EveAddAppProto(), and SCAppLayerForceProtocolChange().
◆ alproto_tc
| AppProto Flow_::alproto_tc |
Definition at line 459 of file flow.h.
Referenced by AppLayerHandleTCPData(), AppLayerHandleUdp(), AppLayerProtoDetectReset(), AppLayerRequestProtocolChange(), EveAddAppProto(), and SCAppLayerForceProtocolChange().
◆ alproto_ts
| AppProto Flow_::alproto_ts |
Definition at line 458 of file flow.h.
Referenced by AppLayerHandleTCPData(), AppLayerHandleUdp(), AppLayerProtoDetectReset(), AppLayerRequestProtocolChange(), EveAddAppProto(), and SCAppLayerForceProtocolChange().
◆ alstate
| void* Flow_::alstate |
application layer state
Definition at line 486 of file flow.h.
Referenced by DetectFileInspectGeneric(), FlowCleanupAppLayer(), FlowNeedsReassembly(), LuaExtensionsMatchSetup(), and SCLuaTxRefResolve().
◆ applied_exception_policy
| uint8_t Flow_::applied_exception_policy |
which exception policies were applied, if any
Definition at line 480 of file flow.h.
Referenced by ExceptionPolicyParse().
◆ code
◆ de_ctx_version
| uint32_t Flow_::de_ctx_version |
◆ dp
| Port Flow_::dp |
tcp/udp destination port
Definition at line 376 of file flow.h.
Referenced by LLVMFuzzerTestOneInput(), SCFlowGetDestinationPort(), and TestHelperBuildFlow().
◆ dst
| FlowAddress Flow_::dst |
Definition at line 363 of file flow.h.
Referenced by LLVMFuzzerTestOneInput(), SCFlowGetDestinationAddressAsRawPtr(), and TestHelperBuildFlow().
◆ esp
| struct { ... } Flow_::esp |
◆ fb
| struct FlowBucket_* Flow_::fb |
Definition at line 498 of file flow.h.
Referenced by FlowBitFree(), FlowBitIsnotset(), and FlowBitIsset().
◆ ffr
◆ ffr_tc
| uint8_t Flow_::ffr_tc |
Definition at line 393 of file flow.h.
Referenced by FlowNeedsReassembly().
◆ ffr_ts
| uint8_t Flow_::ffr_ts |
Definition at line 392 of file flow.h.
Referenced by FlowNeedsReassembly().
◆ file_flags
| uint16_t Flow_::file_flags |
file tracking/extraction flags
Definition at line 412 of file flow.h.
Referenced by FileFlowToFlags().
◆ flags
| uint64_t Flow_::flags |
generic flags
Definition at line 410 of file flow.h.
Referenced by FlowChangeProto(), FlowClearMemory(), FlowGetPacketDirection(), FlowHasAlerts(), FlowSendToLocalThread(), FlowSetChangeProtoFlag(), FlowSetHasAlertsFlag(), FlowSwap(), FlowUnsetChangeProtoFlag(), FlowUpdateState(), LLVMFuzzerTestOneInput(), SCFlowGetFlags(), SSHTxLogCondition(), StreamTcpDisableAppLayer(), and TestHelperBuildFlow().
◆ flow_end_flags
◆ flow_hash
| uint32_t Flow_::flow_hash |
flow hash - the flow hash before hash table size mod. Used for calculating the flow_id.
Definition at line 403 of file flow.h.
Referenced by SCLuaTxRefInit(), and SCLuaTxRefResolve().
◆ flow_state
| FlowStateType Flow_::flow_state |
Definition at line 427 of file flow.h.
Referenced by FlowHandlePacketUpdate(), FlowUpdateState(), and PacketBypassCallback().
◆ flowvar
| GenericVar* Flow_::flowvar |
Definition at line 496 of file flow.h.
Referenced by EveAddMetadata(), FlowVarAddFloat(), FlowVarAddIdValue(), FlowVarAddIntNoLock(), FlowVarAddKeyValue(), FlowVarGet(), and FlowVarGetByKey().
◆ icmp_d
| struct { ... } Flow_::icmp_d |
◆ icmp_s
| struct { ... } Flow_::icmp_s |
◆ lastts
| SCTime_t Flow_::lastts |
time stamp of last update (last packet). Set/updated under the flow and flow hash row locks, safe to read under either the flow lock or flow hash row lock.
Definition at line 425 of file flow.h.
Referenced by AppLayerExpectationCreate(), FlowHandlePacketUpdate(), and SCFlowGetLastTimeAsParts().
◆ livedev_id
| uint16_t Flow_::livedev_id |
◆ m
◆ max_ttl_toclient
◆ max_ttl_toserver
◆ min_ttl_toclient
◆ min_ttl_toserver
◆ next
| struct Flow_* Flow_::next |
Definition at line 408 of file flow.h.
Referenced by FlowGetExistingFlowFromFlowId(), FlowQueuePrivateAppendFlow(), FlowQueuePrivateAppendPrivate(), FlowQueuePrivateGetFromTop(), FlowQueuePrivatePrependFlow(), FlowReset(), and FlowShutdown().
◆ parent_id
◆ probing_parser_toclient_alproto_masks
| uint32_t Flow_::probing_parser_toclient_alproto_masks |
Definition at line 434 of file flow.h.
Referenced by AppLayerProtoDetectReset(), and FlowSwap().
◆ probing_parser_toserver_alproto_masks
| uint32_t Flow_::probing_parser_toserver_alproto_masks |
Definition at line 433 of file flow.h.
Referenced by AppLayerProtoDetectReset(), and FlowSwap().
◆ proto
| uint8_t Flow_::proto |
ip proto of the flow
Definition at line 382 of file flow.h.
Referenced by AppLayerFrameDump(), AppLayerFramesSetupContainer(), AppLayerParserParse(), AppLayerParserSetTransactionInspectId(), DetectEngineInspectFiledata(), DetectRunFrameInspectRule(), DetectRunStoreStateTx(), FlowCleanupAppLayer(), FlowGetDisruptionFlags(), FlowInit(), FlowReset(), FlowShutdown(), FrameJsonLogOneFrame(), FramesPrune(), LLVMFuzzerTestOneInput(), LuaExtensionsMatchSetup(), SCFlowGetIPProtocol(), SCLuaTxRefResolve(), StreamTcpAppLayerIsDisabled(), UTHAddStreamToFlow(), and UTHRemoveSessionFromFlow().
◆ protoctx
| void* Flow_::protoctx |
protocol specific data pointer, e.g. for TcpSession
Definition at line 440 of file flow.h.
Referenced by AppLayerFrameDump(), AppLayerFramesSetupContainer(), AppLayerFramesSlide(), DetectEngineInspectStreamPayload(), FlowClearMemory(), FlowGetDisruptionFlags(), FlowNeedsReassembly(), FramesPrune(), LLVMFuzzerTestOneInput(), SCAppLayerParserTriggerRawStreamInspection(), StreamTcpAppLayerIsDisabled(), StreamTcpDetectLogFlush(), StreamTcpDisableAppLayer(), StreamTcpPacket(), StreamTcpPruneSession(), StreamTcpReassembleDepthReached(), StreamTcpSegmentForEach(), StreamTcpSegmentForSession(), StreamTcpSessionPktFree(), UTHAddSessionToFlow(), UTHAddStreamToFlow(), and UTHRemoveSessionFromFlow().
◆ protodetect_dp
| uint16_t Flow_::protodetect_dp |
destination port to be used in protocol detection. This is meant for use with STARTTLS and HTTP CONNECT detection 0 if not used
Definition at line 416 of file flow.h.
Referenced by AppLayerRequestProtocolChange().
◆ protomap
| uint8_t Flow_::protomap |
mapping to Flow's protocol specific protocols for timeouts and state and free functions.
Definition at line 452 of file flow.h.
Referenced by AppLayerIncAllocErrorCounter(), AppLayerIncGapErrorCounter(), AppLayerIncInternalErrorCounter(), AppLayerIncParserErrorCounter(), AppLayerIncTxCounter(), AppLayerParserParse(), AppLayerParserStateCleanup(), FlowHandlePacketUpdate(), and LLVMFuzzerTestOneInput().
◆ recursion_level
| uint8_t Flow_::recursion_level |
Definition at line 383 of file flow.h.
Referenced by FlowInit().
◆ sgh_toclient
| const struct SigGroupHead_* Flow_::sgh_toclient |
◆ sgh_toserver
| const struct SigGroupHead_* Flow_::sgh_toserver |
◆ sp
| Port Flow_::sp |
tcp/udp source port
Definition at line 365 of file flow.h.
Referenced by FlowGetPacketDirection(), LLVMFuzzerTestOneInput(), SCFlowGetSourcePort(), and TestHelperBuildFlow().
◆ spi
◆ src
| FlowAddress Flow_::src |
Definition at line 363 of file flow.h.
Referenced by FlowGetPacketDirection(), LLVMFuzzerTestOneInput(), SCFlowGetSourceAddressAsRawPtr(), and TestHelperBuildFlow().
◆ startts
| SCTime_t Flow_::startts |
Definition at line 500 of file flow.h.
Referenced by EveAddFlow(), SCLuaTxRefInit(), and SCLuaTxRefResolve().
◆ storage
| Storage Flow_::storage[] |
Definition at line 507 of file flow.h.
Referenced by SCFlowFreeStorage(), SCFlowFreeStorageById(), SCFlowGetStorageById(), and SCFlowSetStorageById().
◆ tenant_id
| uint32_t Flow_::tenant_id |
◆ thread_id
| FlowThreadId Flow_::thread_id[2] |
Thread ID for the stream/detect portion of this flow
Definition at line 399 of file flow.h.
Referenced by FlowInit(), and FlowSendToLocalThread().
◆ timeout_policy
| uint32_t Flow_::timeout_policy |
timeout in seconds by policy, add to Flow::lastts to get actual time this times out. Ignored in emergency mode.
◆ todstbytecnt
| uint64_t Flow_::todstbytecnt |
Definition at line 504 of file flow.h.
Referenced by EveAddFlow(), and FlowHandlePacketUpdate().
◆ todstpktcnt
| uint32_t Flow_::todstpktcnt |
Definition at line 502 of file flow.h.
Referenced by EveAddFlow(), FlowHandlePacketUpdate(), and SCFlowGetToServerPacketCount().
◆ tosrcbytecnt
| uint64_t Flow_::tosrcbytecnt |
Definition at line 505 of file flow.h.
Referenced by EveAddFlow().
◆ tosrcpktcnt
| uint32_t Flow_::tosrcpktcnt |
Definition at line 503 of file flow.h.
Referenced by EveAddFlow(), and SCFlowGetToClientPacketCount().
◆ tunnel_id
| uint16_t Flow_::tunnel_id |
Definition at line 384 of file flow.h.
Referenced by FlowInit().
◆ type
◆ vlan_id
| uint16_t Flow_::vlan_id[VLAN_MAX_LAYERS] |
Definition at line 385 of file flow.h.
Referenced by FlowInit().
◆ vlan_idx
| uint8_t Flow_::vlan_idx |
Definition at line 387 of file flow.h.
Referenced by FlowInit().
The documentation for this struct was generated from the following file:
- src/flow.h
