suricata
Flow_ Struct Reference

Flow data structure. More...

#include <flow.h>

Collaboration diagram for Flow_:

Data Fields

FlowAddress src
 
FlowAddress dst
 
union {
   Port   sp
 
   struct {
      uint8_t   type
 
      uint8_t   code
 
   }   icmp_s
 
   struct {
      uint32_t   spi
 
   }   esp
 
}; 
 
union {
   Port   dp
 
   struct {
      uint8_t   type
 
      uint8_t   code
 
   }   icmp_d
 
}; 
 
uint8_t proto
 
uint8_t recursion_level
 
uint16_t vlan_id [VLAN_MAX_LAYERS]
 
uint8_t vlan_idx
 
union {
   struct {
      uint8_t   ffr_ts:4
 
      uint8_t   ffr_tc:4
 
   } 
 
   uint8_t   ffr
 
}; 
 
uint32_t timeout_at
 
FlowThreadId thread_id [2]
 
struct Flow_next
 
struct LiveDevice_livedev
 
uint32_t flow_hash
 
uint32_t timeout_policy
 
SCTime_t lastts
 
FlowStateType flow_state
 
uint32_t tenant_id
 
uint32_t probing_parser_toserver_alproto_masks
 
uint32_t probing_parser_toclient_alproto_masks
 
uint32_t flags
 
uint16_t file_flags
 
uint16_t protodetect_dp
 
int64_t parent_id
 
SCMutex m
 
void * protoctx
 
uint8_t protomap
 
uint8_t flow_end_flags
 
AppProto alproto
 application level protocol More...
 
AppProto alproto_ts
 
AppProto alproto_tc
 
AppProto alproto_orig
 
AppProto alproto_expect
 
uint32_t de_ctx_version
 
uint8_t min_ttl_toserver
 
uint8_t max_ttl_toserver
 
uint8_t min_ttl_toclient
 
uint8_t max_ttl_toclient
 
AppLayerParserStatealparser
 
void * alstate
 
const struct SigGroupHead_sgh_toclient
 
const struct SigGroupHead_sgh_toserver
 
GenericVarflowvar
 
struct FlowBucket_fb
 
SCTime_t startts
 
uint32_t todstpktcnt
 
uint32_t tosrcpktcnt
 
uint64_t todstbytecnt
 
uint64_t tosrcbytecnt
 
Storage storage []
 

Detailed Description

Flow data structure.

The flow is a global data structure that is created for new packets of a flow and then looked up for the following packets of a flow.

Locking

The flow is updated/used by multiple packets at the same time. This is why there is a flow-mutex. It's a mutex and not a spinlock because some operations on the flow can be quite expensive, thus spinning would be too expensive.

The flow "header" (addresses, ports, proto, recursion level) are static after the initialization and remain read-only throughout the entire live of a flow. This is why we can access those without protection of the lock.

Definition at line 349 of file flow.h.

Field Documentation

◆ @118

union { ... }

◆ @120

union { ... }

◆ @122

union { ... }

◆ alparser

◆ alproto

◆ alproto_expect

AppProto Flow_::alproto_expect

expected app protocol: used in protocol change/upgrade like in STARTTLS.

Definition at line 458 of file flow.h.

Referenced by AppLayerRequestProtocolChange(), and EveAddAppProto().

◆ alproto_orig

AppProto Flow_::alproto_orig

original application level protocol. Used to indicate the previous protocol when changing to another protocol , e.g. with STARTTLS.

Definition at line 455 of file flow.h.

Referenced by AppLayerRequestProtocolChange(), and EveAddAppProto().

◆ alproto_tc

◆ alproto_ts

◆ alstate

void* Flow_::alstate

application layer state

Definition at line 475 of file flow.h.

Referenced by DetectFileInspectGeneric(), FlowCleanupAppLayer(), FlowForceReassemblyNeedReassembly(), and SMTPProcessDataChunk().

◆ code

uint8_t Flow_::code

icmp code

Definition at line 358 of file flow.h.

◆ de_ctx_version

uint32_t Flow_::de_ctx_version

detection engine ctx version used to inspect this flow. Set at initial inspection. If it doesn't match the currently in use de_ctx, the stored sgh ptrs are reset.

Definition at line 463 of file flow.h.

◆ dp

Port Flow_::dp

tcp/udp destination port

Definition at line 366 of file flow.h.

Referenced by FlowGetDestinationPort(), FlowInit(), and LLVMFuzzerTestOneInput().

◆ dst

FlowAddress Flow_::dst

Definition at line 353 of file flow.h.

Referenced by FlowInit(), and LLVMFuzzerTestOneInput().

◆ esp

struct { ... } Flow_::esp

◆ fb

struct FlowBucket_* Flow_::fb

Definition at line 487 of file flow.h.

◆ ffr

uint8_t Flow_::ffr

Definition at line 384 of file flow.h.

◆ ffr_tc

uint8_t Flow_::ffr_tc

Definition at line 382 of file flow.h.

Referenced by FlowForceReassemblyNeedReassembly().

◆ ffr_ts

uint8_t Flow_::ffr_ts

Definition at line 381 of file flow.h.

Referenced by FlowForceReassemblyNeedReassembly().

◆ file_flags

uint16_t Flow_::file_flags

file tracking/extraction flags

Definition at line 422 of file flow.h.

Referenced by FileFlowToFlags().

◆ flags

◆ flow_end_flags

uint8_t Flow_::flow_end_flags

Definition at line 446 of file flow.h.

◆ flow_hash

uint32_t Flow_::flow_hash

flow hash - the flow hash before hash table size mod.

Definition at line 400 of file flow.h.

◆ flow_state

FlowStateType Flow_::flow_state

Definition at line 411 of file flow.h.

Referenced by FlowHandlePacketUpdate(), FlowUpdateState(), and PacketBypassCallback().

◆ flowvar

◆ icmp_d

struct { ... } Flow_::icmp_d

◆ icmp_s

struct { ... } Flow_::icmp_s

Referenced by FlowInit().

◆ lastts

SCTime_t Flow_::lastts

◆ livedev

struct LiveDevice_* Flow_::livedev

Incoming interface

Definition at line 397 of file flow.h.

Referenced by FlowInit().

◆ m

SCMutex Flow_::m

Definition at line 434 of file flow.h.

◆ max_ttl_toclient

uint8_t Flow_::max_ttl_toclient

Definition at line 469 of file flow.h.

◆ max_ttl_toserver

uint8_t Flow_::max_ttl_toserver

Definition at line 467 of file flow.h.

Referenced by FlowInit().

◆ min_ttl_toclient

uint8_t Flow_::min_ttl_toclient

Definition at line 468 of file flow.h.

◆ min_ttl_toserver

uint8_t Flow_::min_ttl_toserver

ttl tracking

Definition at line 466 of file flow.h.

Referenced by FlowInit().

◆ next

◆ parent_id

int64_t Flow_::parent_id

Definition at line 429 of file flow.h.

◆ probing_parser_toclient_alproto_masks

uint32_t Flow_::probing_parser_toclient_alproto_masks

Definition at line 418 of file flow.h.

Referenced by AppLayerProtoDetectReset(), and FlowSwap().

◆ probing_parser_toserver_alproto_masks

uint32_t Flow_::probing_parser_toserver_alproto_masks

Definition at line 417 of file flow.h.

Referenced by AppLayerProtoDetectReset(), and FlowSwap().

◆ proto

◆ protoctx

◆ protodetect_dp

uint16_t Flow_::protodetect_dp

destination port to be used in protocol detection. This is meant for use with STARTTLS and HTTP CONNECT detection 0 if not used

Definition at line 426 of file flow.h.

Referenced by AppLayerRequestProtocolChange().

◆ protomap

uint8_t Flow_::protomap

mapping to Flow's protocol specific protocols for timeouts and state and free functions.

Definition at line 444 of file flow.h.

Referenced by AppLayerIncAllocErrorCounter(), AppLayerIncGapErrorCounter(), AppLayerIncInternalErrorCounter(), AppLayerIncParserErrorCounter(), AppLayerIncTxCounter(), AppLayerParserParse(), AppLayerParserStateCleanup(), and LLVMFuzzerTestOneInput().

◆ recursion_level

uint8_t Flow_::recursion_level

Definition at line 373 of file flow.h.

Referenced by FlowInit().

◆ sgh_toclient

const struct SigGroupHead_* Flow_::sgh_toclient

toclient sgh for this flow. Only use when FLOW_SGH_TOCLIENT flow flag has been set.

Definition at line 479 of file flow.h.

◆ sgh_toserver

const struct SigGroupHead_* Flow_::sgh_toserver

toserver sgh for this flow. Only use when FLOW_SGH_TOSERVER flow flag has been set.

Definition at line 482 of file flow.h.

◆ sp

Port Flow_::sp

tcp/udp source port

Definition at line 355 of file flow.h.

Referenced by FlowGetPacketDirection(), FlowGetSourcePort(), FlowInit(), and LLVMFuzzerTestOneInput().

◆ spi

uint32_t Flow_::spi

esp spi

Definition at line 362 of file flow.h.

◆ src

FlowAddress Flow_::src

Definition at line 353 of file flow.h.

Referenced by FlowGetPacketDirection(), FlowInit(), and LLVMFuzzerTestOneInput().

◆ startts

SCTime_t Flow_::startts

Definition at line 489 of file flow.h.

Referenced by EveAddFlow().

◆ storage

◆ tenant_id

uint32_t Flow_::tenant_id

flow tenant id, used to setup flow timeout and stream pseudo packets with the correct tenant id set

Definition at line 415 of file flow.h.

◆ thread_id

FlowThreadId Flow_::thread_id[2]

Thread ID for the stream/detect portion of this flow

Definition at line 393 of file flow.h.

Referenced by FlowForceReassemblyForFlow().

◆ timeout_at

uint32_t Flow_::timeout_at

timestamp in seconds of the moment this flow will timeout according to the timeout policy. Does not take emergency mode into account.

Definition at line 390 of file flow.h.

Referenced by FlowHandlePacketUpdate().

◆ timeout_policy

uint32_t Flow_::timeout_policy

timeout policy value in seconds to add to the lastts.tv_sec when a packet has been received.

Definition at line 404 of file flow.h.

Referenced by FlowHandlePacketUpdate().

◆ todstbytecnt

uint64_t Flow_::todstbytecnt

Definition at line 493 of file flow.h.

Referenced by EveAddFlow(), and FlowHandlePacketUpdate().

◆ todstpktcnt

uint32_t Flow_::todstpktcnt

Definition at line 491 of file flow.h.

Referenced by EveAddFlow(), FlowForceReassemblyForFlow(), and FlowHandlePacketUpdate().

◆ tosrcbytecnt

uint64_t Flow_::tosrcbytecnt

Definition at line 494 of file flow.h.

Referenced by EveAddFlow().

◆ tosrcpktcnt

uint32_t Flow_::tosrcpktcnt

Definition at line 492 of file flow.h.

Referenced by EveAddFlow().

◆ type

uint8_t Flow_::type

icmp type

Definition at line 357 of file flow.h.

◆ vlan_id

uint16_t Flow_::vlan_id[VLAN_MAX_LAYERS]

Definition at line 374 of file flow.h.

Referenced by FlowInit().

◆ vlan_idx

uint8_t Flow_::vlan_idx

Definition at line 376 of file flow.h.

Referenced by FlowInit().


The documentation for this struct was generated from the following file: