suricata
Flow_ Struct Reference

Flow data structure. More...

#include <flow.h>

Collaboration diagram for Flow_:

Public Member Functions

 SC_ATOMIC_DECLARE (FlowStateType, flow_state)
 
 SC_ATOMIC_DECLARE (FlowRefCount, use_cnt)
 

Data Fields

FlowAddress src
 
FlowAddress dst
 
union {
   Port   sp
 
   struct {
      uint8_t   type
 
      uint8_t   code
 
   }   icmp_s
 
}; 
 
union {
   Port   dp
 
   struct {
      uint8_t   type
 
      uint8_t   code
 
   }   icmp_d
 
}; 
 
uint8_t proto
 
uint8_t recursion_level
 
uint16_t vlan_id [2]
 
uint8_t vlan_idx
 
struct LiveDevice_livedev
 
uint32_t flow_hash
 
struct timeval lastts
 
uint32_t tenant_id
 
uint32_t probing_parser_toserver_alproto_masks
 
uint32_t probing_parser_toclient_alproto_masks
 
uint32_t flags
 
uint16_t file_flags
 
uint16_t protodetect_dp
 
int64_t parent_id
 
SCMutex m
 
void * protoctx
 
uint8_t protomap
 
uint8_t flow_end_flags
 
AppProto alproto
 application level protocol More...
 
AppProto alproto_ts
 
AppProto alproto_tc
 
AppProto alproto_orig
 
AppProto alproto_expect
 
uint32_t de_ctx_version
 
FlowThreadId thread_id [2]
 
uint8_t min_ttl_toserver
 
uint8_t max_ttl_toserver
 
uint8_t min_ttl_toclient
 
uint8_t max_ttl_toclient
 
AppLayerParserStatealparser
 
void * alstate
 
const struct SigGroupHead_sgh_toclient
 
const struct SigGroupHead_sgh_toserver
 
GenericVarflowvar
 
struct Flow_hnext
 
struct Flow_hprev
 
struct FlowBucket_fb
 
struct Flow_lnext
 
struct Flow_lprev
 
struct timeval startts
 
uint32_t todstpktcnt
 
uint32_t tosrcpktcnt
 
uint64_t todstbytecnt
 
uint64_t tosrcbytecnt
 

Detailed Description

Flow data structure.

The flow is a global data structure that is created for new packets of a flow and then looked up for the following packets of a flow.

Locking

The flow is updated/used by multiple packets at the same time. This is why there is a flow-mutex. It's a mutex and not a spinlock because some operations on the flow can be quite expensive, thus spinning would be too expensive.

The flow "header" (addresses, ports, proto, recursion level) are static after the initialization and remain read-only throughout the entire live of a flow. This is why we can access those without protection of the lock.

Definition at line 325 of file flow.h.

Member Function Documentation

Flow_::SC_ATOMIC_DECLARE ( FlowStateType  ,
flow_state   
)
Flow_::SC_ATOMIC_DECLARE ( FlowRefCount  ,
use_cnt   
)

how many pkts and stream msgs are using the flow right now. This variable is atomic so not protected by the Flow mutex "m".

On receiving a packet the counter is incremented while the flow bucked is locked, which is also the case on timeout pruning.

Field Documentation

union { ... }
union { ... }
AppProto Flow_::alproto

application level protocol

Definition at line 409 of file flow.h.

Referenced by AlertJsonHeader(), AppLayerHandleTCPData(), AppLayerHandleUdp(), AppLayerIncTxCounter(), AppLayerParserGetStreamDepth(), AppLayerParserGetTransactionActive(), AppLayerParserGetTxCnt(), AppLayerParserGetTxLogged(), AppLayerParserParse(), AppLayerParserRestoreParserTable(), AppLayerParserSetTransactionInspectId(), AppLayerParserSetTxDetectState(), AppLayerParserStateCleanup(), AppLayerParserStreamTruncated(), AppLayerParserTransactionsCleanup(), AppLayerProtoDetectReset(), DetectAppLayerEventRegister(), DetectBypassRegister(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectBufferGeneric(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineStateResetTxs(), DetectFileInspectGeneric(), DetectFilemagicRegister(), DetectFilenameRegister(), DetectFilestoreRegister(), DetectFtpbounceRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectRunStoreStateTx(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectTemplateRustBufferRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), FileDisableFilesize(), FileDisableMagic(), FileDisableMd5(), FileDisableSha1(), FileDisableSha256(), FileDisableStoring(), FileDisableStoringForTransaction(), FlowForceReassemblyNeedReassembly(), FlowGetAppProtocol(), FTPParserCleanup(), HtpConfigRestoreBackup(), HTPFileClose(), JsonAddFlow(), JsonBuildFileInfoRecord(), OutputRegisterFiledataLogger(), OutputRegisterFileLogger(), OutputRegisterTxLogger(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterDNSTCPParsers(), RegisterDNSUDPParsers(), RegisterENIPTCPParsers(), RegisterModbusParsers(), RegisterSMBParsers(), RegisterSSHParsers(), SCSigSignatureOrderingModuleCleanup(), SMTPParserCleanup(), SSLJA3IsEnabled(), and StreamTcpPacket().

AppProto Flow_::alproto_expect

expected app protocol: used in protocol change/upgrade like in STARTTLS.

Definition at line 418 of file flow.h.

Referenced by AppLayerHandleTCPData(), AppLayerRequestProtocolChange(), and JsonAddFlow().

AppProto Flow_::alproto_orig

original application level protocol. Used to indicate the previous protocol when changing to another protocol , e.g. with STARTTLS.

Definition at line 415 of file flow.h.

Referenced by AppLayerHandleTCPData(), JsonAddFlow(), and JsonTlsLogJSONExtended().

void* Flow_::alstate

application layer state

Definition at line 438 of file flow.h.

Referenced by AppLayerParserParse(), AppLayerParserTransactionsCleanup(), AppLayerProtoDetectReset(), DeStateUpdateInspectTransactionId(), DetectBypassRegister(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineStateResetTxs(), DetectFilemagicRegister(), DetectFilenameRegister(), DetectFilestoreRegister(), DetectFtpbounceRegister(), DetectHttpClientBodyRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectTemplateRustBufferRegister(), DetectTlsCertsRegister(), DetectTlsFingerprintRegister(), DetectTlsIssuerRegister(), DetectTlsJa3HashRegister(), DetectTlsJa3SHashRegister(), DetectTlsJa3SStringRegister(), DetectTlsJa3StringRegister(), DetectTlsSerialRegister(), DetectTlsSniRegister(), DetectTlsSubjectRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), FileDisableFilesize(), FileDisableMagic(), FileDisableMd5(), FileDisableSha1(), FileDisableSha256(), FileDisableStoring(), FileDisableStoringForTransaction(), FlowCleanupAppLayer(), FlowForceReassemblyNeedReassembly(), FlowGetAppState(), FTPParserCleanup(), HtpConfigRestoreBackup(), HTPFileClose(), JsonFTPDataAddMetadata(), OutputRegisterFiledataLogger(), OutputRegisterFileLogger(), OutputRegisterTxLogger(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterDNSTCPParsers(), RegisterDNSUDPParsers(), RegisterENIPTCPParsers(), RegisterModbusParsers(), RegisterSSHParsers(), SigMatchSignaturesGetSgh(), SMTPParserCleanup(), SMTPProcessDataChunk(), and SSLJA3IsEnabled().

uint8_t Flow_::code

icmp code

Definition at line 334 of file flow.h.

uint32_t Flow_::de_ctx_version

detection engine ctx version used to inspect this flow. Set at initial inspection. If it doesn't match the currently in use de_ctx, the stored sgh ptrs are reset.

Definition at line 423 of file flow.h.

Referenced by SigMatchSignaturesGetSgh().

uint16_t Flow_::file_flags
uint8_t Flow_::flow_end_flags

Definition at line 406 of file flow.h.

Referenced by FlowDisableFlowManagerThread(), FlowGetExistingFlowFromHash(), and JsonAddFlow().

uint32_t Flow_::flow_hash

flow hash - the flow hash before hash table size mod.

Definition at line 353 of file flow.h.

Referenced by FlowGetFlowFromHash(), FlowGetFromFlowKey(), and FlowSetupPacket().

struct Flow_* Flow_::hnext
struct { ... } Flow_::icmp_d
struct { ... } Flow_::icmp_s
struct LiveDevice_* Flow_::livedev

Incoming interface

Definition at line 350 of file flow.h.

Referenced by FlowDisableFlowManagerThread(), FlowInit(), and StreamTcpPseudoPacketCreateStreamEndPacket().

struct Flow_* Flow_::lnext

queue list pointers, protected by queue mutex

Definition at line 456 of file flow.h.

Referenced by FlowDequeue(), FlowEnqueue(), and FlowMoveToSpare().

struct Flow_* Flow_::lprev

Definition at line 457 of file flow.h.

Referenced by FlowDequeue(), FlowEnqueue(), and FlowMoveToSpare().

SCMutex Flow_::m

Definition at line 394 of file flow.h.

Referenced by DetectDNP3Register(), and RegisterDNP3Parsers().

uint8_t Flow_::max_ttl_toclient

Definition at line 432 of file flow.h.

Referenced by FlowGetPacketDirection(), and FlowSwap().

uint8_t Flow_::max_ttl_toserver

Definition at line 430 of file flow.h.

Referenced by FlowGetPacketDirection(), FlowInit(), and FlowSwap().

uint8_t Flow_::min_ttl_toclient

Definition at line 431 of file flow.h.

Referenced by FlowGetPacketDirection(), and FlowSwap().

uint8_t Flow_::min_ttl_toserver

ttl tracking

Definition at line 429 of file flow.h.

Referenced by FlowGetPacketDirection(), FlowInit(), and FlowSwap().

int64_t Flow_::parent_id

Definition at line 389 of file flow.h.

Referenced by CreateJSONFlowId().

uint32_t Flow_::probing_parser_toclient_alproto_masks

Definition at line 377 of file flow.h.

Referenced by AppLayerProtoDetectReset(), and FlowSwap().

uint32_t Flow_::probing_parser_toserver_alproto_masks

Definition at line 376 of file flow.h.

Referenced by AppLayerProtoDetectReset(), and FlowSwap().

uint8_t Flow_::proto

Definition at line 344 of file flow.h.

Referenced by AppLayerIncTxCounter(), AppLayerParserParse(), AppLayerParserRestoreParserTable(), AppLayerParserSetTransactionInspectId(), AppLayerParserStreamTruncated(), AppLayerParserTransactionsCleanup(), DetectAppLayerEventRegister(), DetectBypassRegister(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectBufferGeneric(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineStateResetTxs(), DetectFileInspectGeneric(), DetectFilemagicRegister(), DetectFilenameRegister(), DetectFilestoreRegister(), DetectFlowintFree(), DetectFtpbounceRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectRunStoreStateTx(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectTemplateRustBufferRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), FileDisableFilesize(), FileDisableMagic(), FileDisableMd5(), FileDisableSha1(), FileDisableSha256(), FileDisableStoring(), FileDisableStoringForTransaction(), FlowCleanupAppLayer(), FlowGetDisruptionFlags(), FlowGetFlowFromHash(), FlowGetFromFlowKey(), FlowHandlePacketUpdate(), FlowInit(), FlowKeyGetHash(), FlowShutdown(), FlowSwap(), FTPParserCleanup(), HtpConfigRestoreBackup(), HTPFileClose(), HttpXFFGetIPFromTx(), JsonAddFlow(), JsonFiveTuple(), JsonNFSAddMetadata(), JsonNFSAddMetadataRPC(), JsonSIPAddMetadata(), JsonSMBAddMetadata(), OutputRegisterTxLogger(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterDNSTCPParsers(), RegisterDNSUDPParsers(), RegisterENIPTCPParsers(), RegisterModbusParsers(), RegisterSMBParsers(), SCSigSignatureOrderingModuleCleanup(), SigMatchSignaturesGetSgh(), SMTPParserCleanup(), SSLJA3IsEnabled(), StreamTcpAppLayerIsDisabled(), TagTimeoutCheck(), TmModuleFlowRecyclerRegister(), UTHAddStreamToFlow(), and UTHRemoveSessionFromFlow().

void* Flow_::protoctx

protocol specific data pointer, e.g. for TcpSession

Definition at line 400 of file flow.h.

Referenced by AppLayerIncTxCounter(), AppLayerParserParse(), AppLayerParserRestoreParserTable(), AppLayerParserStreamTruncated(), AppLayerParserTriggerRawStreamReassembly(), DetectBypassRegister(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineInspectStream(), DetectEngineStateResetTxs(), DetectFilestoreRegister(), DetectFtpbounceRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectStreamSizeFree(), DetectStreamSizeRegister(), DetectTemplateRustBufferRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), FlowChangeProto(), FlowClearMemory(), FlowForceReassemblyForFlow(), FlowForceReassemblyNeedReassembly(), FlowGetDisruptionFlags(), FlowGetFlowFromHash(), FTPParserCleanup(), HtpConfigRestoreBackup(), HTPFileClose(), HTPFreeConfig(), JsonAddFlow(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterENIPTCPParsers(), RegisterModbusParsers(), RegisterSMBParsers(), RegisterSSHParsers(), SigMatchSignaturesGetSgh(), SMTPParserCleanup(), SMTPProcessDataChunk(), SSLJA3IsEnabled(), StreamTcpAppLayerIsDisabled(), StreamTcpDetectLogFlush(), StreamTcpDisableAppLayer(), StreamTcpFreeConfig(), StreamTcpPacket(), StreamTcpPruneSession(), StreamTcpReassembleDepthReached(), StreamTcpSegmentForEach(), StreamTcpSessionPktFree(), TagTimeoutCheck(), TmModuleFlowRecyclerRegister(), UTHAddSessionToFlow(), UTHAddStreamToFlow(), and UTHRemoveSessionFromFlow().

uint16_t Flow_::protodetect_dp

destination port to be used in protocol detection. This is meant for use with STARTTLS and HTTP CONNECT detection 0 if not used

Definition at line 386 of file flow.h.

Referenced by AppLayerRequestProtocolChange().

uint8_t Flow_::recursion_level

Definition at line 345 of file flow.h.

Referenced by FlowGetFromFlowKey(), FlowInit(), and FlowKeyGetHash().

const struct SigGroupHead_* Flow_::sgh_toclient

toclient sgh for this flow. Only use when FLOW_SGH_TOCLIENT flow flag has been set.

Definition at line 442 of file flow.h.

Referenced by AppLayerParserTransactionsCleanup(), FlowSwap(), and SigMatchSignaturesGetSgh().

const struct SigGroupHead_* Flow_::sgh_toserver

toserver sgh for this flow. Only use when FLOW_SGH_TOSERVER flow flag has been set.

Definition at line 445 of file flow.h.

Referenced by AppLayerParserTransactionsCleanup(), FlowSwap(), and SigMatchSignaturesGetSgh().

struct timeval Flow_::startts

Definition at line 458 of file flow.h.

Referenced by FlowGetFromFlowKey(), FlowInit(), and JsonAddFlow().

uint32_t Flow_::tenant_id

flow tenant id, used to setup flow timeout and stream pseudo packets with the correct tenant id set

Definition at line 374 of file flow.h.

Referenced by SigMatchSignaturesGetSgh(), and StreamTcpPseudoPacketCreateStreamEndPacket().

FlowThreadId Flow_::thread_id[2]

Thread ID for the stream/detect portion of this flow

Definition at line 426 of file flow.h.

Referenced by FlowForceReassemblyForFlow(), and FlowSetupPacket().

uint64_t Flow_::todstbytecnt

Definition at line 462 of file flow.h.

Referenced by FlowHandlePacketUpdate(), FlowSwap(), and JsonAddFlow().

uint32_t Flow_::todstpktcnt

Definition at line 460 of file flow.h.

Referenced by FlowHandlePacketUpdate(), FlowSwap(), and JsonAddFlow().

uint64_t Flow_::tosrcbytecnt

Definition at line 463 of file flow.h.

Referenced by FlowHandlePacketUpdate(), FlowSwap(), and JsonAddFlow().

uint32_t Flow_::tosrcpktcnt

Definition at line 461 of file flow.h.

Referenced by FlowHandlePacketUpdate(), FlowSwap(), and JsonAddFlow().

uint8_t Flow_::type

icmp type

Definition at line 333 of file flow.h.

uint16_t Flow_::vlan_id[2]
uint8_t Flow_::vlan_idx

Definition at line 347 of file flow.h.

Referenced by FlowInit(), and StreamTcpPseudoPacketCreateStreamEndPacket().


The documentation for this struct was generated from the following file: