Flow data structure. More...

#include <flow.h>

Collaboration diagram for Flow_:

[legend]

Public Member Functions
	SC_ATOMIC_DECLARE (FlowStateType, flow_state)

	SC_ATOMIC_DECLARE (FlowRefCount, use_cnt)

Data Fields
FlowAddress	src

FlowAddress	dst

union {
Port sp

struct {
uint8_t type

uint8_t code

} icmp_s

};

union {
Port dp

struct {
uint8_t type

uint8_t code

} icmp_d

};

uint8_t	proto

uint8_t	recursion_level

uint16_t	vlan_id [2]

uint8_t	vlan_idx

struct LiveDevice_ *	livedev

uint32_t	flow_hash

struct timeval	lastts

uint32_t	tenant_id

uint32_t	probing_parser_toserver_alproto_masks

uint32_t	probing_parser_toclient_alproto_masks

uint32_t	flags

uint16_t	file_flags

uint16_t	protodetect_dp

int64_t	parent_id

SCMutex	m

void *	protoctx

uint8_t	protomap

uint8_t	flow_end_flags

AppProto	alproto
	application level protocol More...

AppProto	alproto_ts

AppProto	alproto_tc

AppProto	alproto_orig

AppProto	alproto_expect

uint32_t	de_ctx_version

FlowThreadId	thread_id [2]

uint8_t	min_ttl_toserver

uint8_t	max_ttl_toserver

uint8_t	min_ttl_toclient

uint8_t	max_ttl_toclient

AppLayerParserState *	alparser

void *	alstate

const struct SigGroupHead_ *	sgh_toclient

const struct SigGroupHead_ *	sgh_toserver

GenericVar *	flowvar

struct Flow_ *	hnext

struct Flow_ *	hprev

struct FlowBucket_ *	fb

struct Flow_ *	lnext

struct Flow_ *	lprev

struct timeval	startts

uint32_t	todstpktcnt

uint32_t	tosrcpktcnt

uint64_t	todstbytecnt

uint64_t	tosrcbytecnt

Detailed Description

Flow data structure.

The flow is a global data structure that is created for new packets of a flow and then looked up for the following packets of a flow.

Locking

The flow is updated/used by multiple packets at the same time. This is why there is a flow-mutex. It's a mutex and not a spinlock because some operations on the flow can be quite expensive, thus spinning would be too expensive.

The flow "header" (addresses, ports, proto, recursion level) are static after the initialization and remain read-only throughout the entire live of a flow. This is why we can access those without protection of the lock.

Definition at line 325 of file flow.h.

Member Function Documentation

Flow_::SC_ATOMIC_DECLARE	(	FlowStateType	,
		flow_state
	)

Flow_::SC_ATOMIC_DECLARE	(	FlowRefCount	,
		use_cnt
	)

how many pkts and stream msgs are using the flow right now. This variable is atomic so not protected by the Flow mutex "m".

On receiving a packet the counter is incremented while the flow bucked is locked, which is also the case on timeout pruning.

Field Documentation

union { ... }

AppLayerParserState* Flow_::alparser

application level storage ptrs.parser internal state

Definition at line 437 of file flow.h.

Referenced by AppLayerDecoderEventsSetEvent(), AppLayerParserParse(), AppLayerParserTransactionsCleanup(), AppLayerProtoDetectReset(), DeStateUpdateInspectTransactionId(), DetectEngineStateResetTxs(), DetectLuaRegister(), FlowCleanupAppLayer(), FlowForceReassemblyNeedReassembly(), HtpConfigRestoreBackup(), HttpHeaderGetBufferSpaceForTXID(), OutputRegisterTxLogger(), RegisterSMBParsers(), RegisterSSHParsers(), and SigMatchSignaturesGetSgh().

AppProto Flow_::alproto

application level protocol

Definition at line 409 of file flow.h.

Referenced by AlertJsonHeader(), AppLayerHandleTCPData(), AppLayerHandleUdp(), AppLayerIncTxCounter(), AppLayerParserGetStreamDepth(), AppLayerParserGetTransactionActive(), AppLayerParserGetTxCnt(), AppLayerParserGetTxLogged(), AppLayerParserParse(), AppLayerParserRestoreParserTable(), AppLayerParserSetTransactionInspectId(), AppLayerParserSetTxDetectState(), AppLayerParserStateCleanup(), AppLayerParserStreamTruncated(), AppLayerParserTransactionsCleanup(), AppLayerProtoDetectReset(), DetectAppLayerEventRegister(), DetectBypassRegister(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectBufferGeneric(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineStateResetTxs(), DetectFileInspectGeneric(), DetectFilemagicRegister(), DetectFilenameRegister(), DetectFilestoreRegister(), DetectFtpbounceRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectRunStoreStateTx(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectTemplateRustBufferRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), FileDisableFilesize(), FileDisableMagic(), FileDisableMd5(), FileDisableSha1(), FileDisableSha256(), FileDisableStoring(), FileDisableStoringForTransaction(), FlowForceReassemblyNeedReassembly(), FlowGetAppProtocol(), FTPParserCleanup(), HtpConfigRestoreBackup(), HTPFileClose(), JsonAddFlow(), JsonBuildFileInfoRecord(), OutputRegisterFiledataLogger(), OutputRegisterFileLogger(), OutputRegisterTxLogger(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterDNSTCPParsers(), RegisterDNSUDPParsers(), RegisterENIPTCPParsers(), RegisterModbusParsers(), RegisterSMBParsers(), RegisterSSHParsers(), SCSigSignatureOrderingModuleCleanup(), SMTPParserCleanup(), SSLJA3IsEnabled(), and StreamTcpPacket().

AppProto Flow_::alproto_expect

expected app protocol: used in protocol change/upgrade like in STARTTLS.

Definition at line 418 of file flow.h.

Referenced by AppLayerHandleTCPData(), AppLayerRequestProtocolChange(), and JsonAddFlow().

AppProto Flow_::alproto_orig

original application level protocol. Used to indicate the previous protocol when changing to another protocol , e.g. with STARTTLS.

Definition at line 415 of file flow.h.

Referenced by AppLayerHandleTCPData(), JsonAddFlow(), and JsonTlsLogJSONExtended().

AppProto Flow_::alproto_tc

Definition at line 411 of file flow.h.

Referenced by AppLayerExpectationHandle(), AppLayerHandleTCPData(), AppLayerIncTxCounter(), AppLayerProtoDetectReset(), FlowSwap(), and JsonAddFlow().

AppProto Flow_::alproto_ts

Definition at line 410 of file flow.h.

Referenced by AppLayerExpectationHandle(), AppLayerHandleTCPData(), AppLayerIncTxCounter(), AppLayerProtoDetectReset(), FlowSwap(), and JsonAddFlow().

void* Flow_::alstate

application layer state

Definition at line 438 of file flow.h.

Referenced by AppLayerParserParse(), AppLayerParserTransactionsCleanup(), AppLayerProtoDetectReset(), DeStateUpdateInspectTransactionId(), DetectBypassRegister(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineStateResetTxs(), DetectFilemagicRegister(), DetectFilenameRegister(), DetectFilestoreRegister(), DetectFtpbounceRegister(), DetectHttpClientBodyRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectTemplateRustBufferRegister(), DetectTlsCertsRegister(), DetectTlsFingerprintRegister(), DetectTlsIssuerRegister(), DetectTlsJa3HashRegister(), DetectTlsJa3SHashRegister(), DetectTlsJa3SStringRegister(), DetectTlsJa3StringRegister(), DetectTlsSerialRegister(), DetectTlsSniRegister(), DetectTlsSubjectRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), FileDisableFilesize(), FileDisableMagic(), FileDisableMd5(), FileDisableSha1(), FileDisableSha256(), FileDisableStoring(), FileDisableStoringForTransaction(), FlowCleanupAppLayer(), FlowForceReassemblyNeedReassembly(), FlowGetAppState(), FTPParserCleanup(), HtpConfigRestoreBackup(), HTPFileClose(), JsonFTPDataAddMetadata(), OutputRegisterFiledataLogger(), OutputRegisterFileLogger(), OutputRegisterTxLogger(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterDNSTCPParsers(), RegisterDNSUDPParsers(), RegisterENIPTCPParsers(), RegisterModbusParsers(), RegisterSSHParsers(), SigMatchSignaturesGetSgh(), SMTPParserCleanup(), SMTPProcessDataChunk(), and SSLJA3IsEnabled().

uint8_t Flow_::code

icmp code

Definition at line 334 of file flow.h.

uint32_t Flow_::de_ctx_version

detection engine ctx version used to inspect this flow. Set at initial inspection. If it doesn't match the currently in use de_ctx, the stored sgh ptrs are reset.

Definition at line 423 of file flow.h.

Referenced by SigMatchSignaturesGetSgh().

Port Flow_::dp

tcp/udp destination port

Definition at line 338 of file flow.h.

Referenced by AppLayerExpectationHandle(), AppLayerParserStreamTruncated(), FlowGetFromFlowKey(), FlowInit(), FlowKeyGetHash(), JsonFiveTuple(), and StreamTcpPseudoPacketCreateStreamEndPacket().