Flow data structure. More...
#include <flow.h>
Detailed Description
Flow data structure.
The flow is a global data structure that is created for new packets of a flow and then looked up for the following packets of a flow.
Locking
The flow is updated/used by multiple packets at the same time. This is why there is a flow-mutex. It's a mutex and not a spinlock because some operations on the flow can be quite expensive, thus spinning would be too expensive.
The flow "header" (addresses, ports, proto, recursion level) are static after the initialization and remain read-only throughout the entire live of a flow. This is why we can access those without protection of the lock.
Field Documentation
◆ @113
| union { ... } |
◆ @115
| union { ... } |
◆ @117
| union { ... } |
◆ alparser
| AppLayerParserState* Flow_::alparser |
application level storage ptrs. parser internal state
Definition at line 482 of file flow.h.
Referenced by AppLayerDecoderEventsSetEvent(), AppLayerParserParse(), AppLayerProtoDetectReset(), DeStateUpdateInspectTransactionId(), FlowCleanupAppLayer(), FlowForceReassemblyNeedReassembly(), LLVMFuzzerTestOneInput(), and StreamTcpDisableAppLayer().
◆ alproto
| AppProto Flow_::alproto |
application level protocol
Definition at line 457 of file flow.h.
Referenced by AppLayerHandleTCPData(), AppLayerHandleUdp(), AppLayerIncTxCounter(), AppLayerParserSetTransactionInspectId(), AppLayerParserStateCleanup(), AppLayerProtoDetectReset(), AppLayerRequestProtocolChange(), DetectEngineInspectBufferGeneric(), DetectRunStoreStateTx(), EveAddAppProto(), FlowForceReassemblyNeedReassembly(), FlowGetAppProtocol(), JsonBuildFileInfoRecord(), and LLVMFuzzerTestOneInput().
◆ alproto_expect
| AppProto Flow_::alproto_expect |
expected app protocol: used in protocol change/upgrade like in STARTTLS.
Definition at line 466 of file flow.h.
Referenced by AppLayerRequestProtocolChange(), and EveAddAppProto().
◆ alproto_orig
| AppProto Flow_::alproto_orig |
original application level protocol. Used to indicate the previous protocol when changing to another protocol , e.g. with STARTTLS.
Definition at line 463 of file flow.h.
Referenced by AppLayerRequestProtocolChange(), and EveAddAppProto().
◆ alproto_tc
| AppProto Flow_::alproto_tc |
Definition at line 459 of file flow.h.
Referenced by AppLayerHandleTCPData(), AppLayerProtoDetectReset(), AppLayerRequestProtocolChange(), and EveAddAppProto().
◆ alproto_ts
| AppProto Flow_::alproto_ts |
Definition at line 458 of file flow.h.
Referenced by AppLayerHandleTCPData(), AppLayerProtoDetectReset(), AppLayerRequestProtocolChange(), and EveAddAppProto().
◆ alstate
| void* Flow_::alstate |
application layer state
Definition at line 483 of file flow.h.
Referenced by DeStateUpdateInspectTransactionId(), DetectFileInspectGeneric(), EveFTPDataAddMetadata(), FlowCleanupAppLayer(), FlowForceReassemblyNeedReassembly(), FlowGetAppState(), and SMTPProcessDataChunk().
◆ code
◆ de_ctx_version
| uint32_t Flow_::de_ctx_version |
◆ dp
| Port Flow_::dp |
tcp/udp destination port
Definition at line 366 of file flow.h.
Referenced by FlowGetFromFlowKey(), FlowInit(), and LLVMFuzzerTestOneInput().
◆ dst
| FlowAddress Flow_::dst |
Definition at line 353 of file flow.h.
Referenced by FlowGetFromFlowKey(), FlowInit(), and LLVMFuzzerTestOneInput().
◆ esp
| struct { ... } Flow_::esp |
◆ fb
| struct FlowBucket_* Flow_::fb |
Definition at line 495 of file flow.h.
Referenced by FlowGetFromFlowKey().
◆ ffr
◆ ffr_tc
| uint8_t Flow_::ffr_tc |
Definition at line 388 of file flow.h.
Referenced by FlowForceReassemblyNeedReassembly().
◆ ffr_ts
| uint8_t Flow_::ffr_ts |
Definition at line 387 of file flow.h.
Referenced by FlowForceReassemblyNeedReassembly().
◆ file_flags
| uint16_t Flow_::file_flags |
file tracking/extraction flags
Definition at line 430 of file flow.h.
Referenced by FileFlowToFlags().
◆ flags
| uint32_t Flow_::flags |
generic flags
Definition at line 428 of file flow.h.
Referenced by FlowChangeProto(), FlowClearMemory(), FlowGetFromFlowKey(), FlowGetPacketDirection(), FlowHandlePacketUpdate(), FlowHasAlerts(), FlowInit(), FlowSetChangeProtoFlag(), FlowSetHasAlertsFlag(), FlowSetIPOnlyFlag(), FlowSwap(), FlowUnsetChangeProtoFlag(), LLVMFuzzerTestOneInput(), and StreamTcpReassembleHandleSegment().
◆ flow_end_flags
◆ flow_hash
| uint32_t Flow_::flow_hash |
flow hash - the flow hash before hash table size mod.
Definition at line 406 of file flow.h.
Referenced by FlowGetFromFlowKey().
◆ flow_state
| FlowStateType Flow_::flow_state |
Definition at line 419 of file flow.h.
Referenced by FlowHandlePacketUpdate(), FlowUpdateState(), and PacketBypassCallback().
◆ flowvar
| GenericVar* Flow_::flowvar |
Definition at line 493 of file flow.h.
Referenced by EveAddMetadata(), FlowVarAddIdValue(), FlowVarAddIntNoLock(), FlowVarAddKeyValue(), FlowVarGet(), and FlowVarGetByKey().
◆ icmp_d
| struct { ... } Flow_::icmp_d |
◆ icmp_s
| struct { ... } Flow_::icmp_s |
Referenced by FlowInit().
◆ lastts
| struct timeval Flow_::lastts |
Definition at line 406 of file flow.h.
Referenced by AppLayerExpectationCreate(), FlowGetFromFlowKey(), FlowGetLastTimeAsParts(), and FlowHandlePacketUpdate().
◆ livedev
| struct LiveDevice_* Flow_::livedev |
◆ m
◆ max_ttl_toclient
◆ max_ttl_toserver
| uint8_t Flow_::max_ttl_toserver |
Definition at line 475 of file flow.h.
Referenced by FlowInit().
◆ min_ttl_toclient
◆ min_ttl_toserver
| uint8_t Flow_::min_ttl_toserver |
◆ next
| struct Flow_* Flow_::next |
Definition at line 401 of file flow.h.
Referenced by FlowGetFromFlowKey(), FlowQueuePrivateAppendFlow(), FlowQueuePrivateAppendPrivate(), FlowQueuePrivateGetFromTop(), FlowQueuePrivatePrependFlow(), FlowShutdown(), and StatsReleaseCounters().
◆ parent_id
◆ probing_parser_toclient_alproto_masks
| uint32_t Flow_::probing_parser_toclient_alproto_masks |
Definition at line 426 of file flow.h.
Referenced by AppLayerProtoDetectReset(), and FlowSwap().
◆ probing_parser_toserver_alproto_masks
| uint32_t Flow_::probing_parser_toserver_alproto_masks |
Definition at line 425 of file flow.h.
Referenced by AppLayerProtoDetectReset(), and FlowSwap().
◆ proto
| uint8_t Flow_::proto |
Definition at line 372 of file flow.h.
Referenced by AppLayerParserParse(), AppLayerParserSetTransactionInspectId(), DetectEngineInspectBufferGeneric(), DetectRunStoreStateTx(), EveHTTP2AddMetadata(), EveIKEAddMetadata(), EveNFSAddMetadata(), EveNFSAddMetadataRPC(), EveSMBAddMetadata(), FlowCleanupAppLayer(), FlowGetDisruptionFlags(), FlowGetFromFlowKey(), FlowInit(), FlowShutdown(), HttpXFFGetIPFromTx(), JsonModbusAddMetadata(), JsonMQTTAddMetadata(), JsonRFBAddMetadata(), JsonSIPAddMetadata(), LLVMFuzzerTestOneInput(), StreamTcpAppLayerIsDisabled(), UTHAddStreamToFlow(), and UTHRemoveSessionFromFlow().
◆ protoctx
| void* Flow_::protoctx |
protocol specific data pointer, e.g. for TcpSession
Definition at line 448 of file flow.h.
Referenced by AppLayerParserTriggerRawStreamReassembly(), DetectEngineInspectStreamPayload(), FlowClearMemory(), FlowForceReassemblyNeedReassembly(), FlowGetDisruptionFlags(), LLVMFuzzerTestOneInput(), SMTPProcessDataChunk(), StreamTcpAppLayerIsDisabled(), StreamTcpDetectLogFlush(), StreamTcpDisableAppLayer(), StreamTcpPruneSession(), StreamTcpReassembleDepthReached(), StreamTcpSessionPktFree(), UTHAddSessionToFlow(), UTHAddStreamToFlow(), and UTHRemoveSessionFromFlow().
◆ protodetect_dp
| uint16_t Flow_::protodetect_dp |
destination port to be used in protocol detection. This is meant for use with STARTTLS and HTTP CONNECT detection 0 if not used
Definition at line 434 of file flow.h.
Referenced by AppLayerRequestProtocolChange().
◆ protomap
| uint8_t Flow_::protomap |
mapping to Flow's protocol specific protocols for timeouts and state and free functions.
Definition at line 452 of file flow.h.
Referenced by AppLayerIncTxCounter(), AppLayerParserParse(), AppLayerParserStateCleanup(), FlowGetFromFlowKey(), and LLVMFuzzerTestOneInput().
◆ recursion_level
| uint8_t Flow_::recursion_level |
Definition at line 373 of file flow.h.
Referenced by FlowGetFromFlowKey(), and FlowInit().
◆ sgh_toclient
| const struct SigGroupHead_* Flow_::sgh_toclient |
◆ sgh_toserver
| const struct SigGroupHead_* Flow_::sgh_toserver |
◆ sp
| Port Flow_::sp |
tcp/udp source port
Definition at line 355 of file flow.h.
Referenced by FlowGetFromFlowKey(), FlowGetPacketDirection(), FlowInit(), and LLVMFuzzerTestOneInput().
◆ spi
◆ src
| FlowAddress Flow_::src |
Definition at line 353 of file flow.h.
Referenced by FlowGetFromFlowKey(), FlowGetPacketDirection(), FlowInit(), and LLVMFuzzerTestOneInput().
◆ startts
| struct timeval Flow_::startts |
Definition at line 495 of file flow.h.
Referenced by EveAddFlow(), and FlowGetFromFlowKey().
◆ tenant_id
| uint32_t Flow_::tenant_id |
◆ thread_id
| FlowThreadId Flow_::thread_id[2] |
Thread ID for the stream/detect portion of this flow
Definition at line 399 of file flow.h.
Referenced by FlowForceReassemblyForFlow().
◆ timeout_at
| uint32_t Flow_::timeout_at |
timestamp in seconds of the moment this flow will timeout according to the timeout policy. Does not take emergency mode into account.
Definition at line 396 of file flow.h.
Referenced by FlowHandlePacketUpdate().
◆ timeout_policy
| uint32_t Flow_::timeout_policy |
timeout policy value in seconds to add to the lastts.tv_sec when a packet has been received.
Definition at line 417 of file flow.h.
Referenced by FlowHandlePacketUpdate().
◆ todstbytecnt
| uint64_t Flow_::todstbytecnt |
Definition at line 501 of file flow.h.
Referenced by EveAddFlow(), and FlowHandlePacketUpdate().
◆ todstpktcnt
| uint32_t Flow_::todstpktcnt |
Definition at line 499 of file flow.h.
Referenced by EveAddFlow(), and FlowHandlePacketUpdate().
◆ tosrcbytecnt
| uint64_t Flow_::tosrcbytecnt |
Definition at line 502 of file flow.h.
Referenced by EveAddFlow().
◆ tosrcpktcnt
| uint32_t Flow_::tosrcpktcnt |
Definition at line 500 of file flow.h.
Referenced by EveAddFlow().
◆ type
◆ use_cnt
| FlowRefCount Flow_::use_cnt |
how many references exist to this flow right now
On receiving a packet the counter is incremented while the flow bucked is locked, which is also the case on timeout pruning.
Definition at line 380 of file flow.h.
Referenced by FlowShutdown(), and UTHBuildPacketOfFlows().
◆ vlan_id
| uint16_t Flow_::vlan_id[2] |
Definition at line 374 of file flow.h.
Referenced by FlowGetFromFlowKey(), and FlowInit().
◆ vlan_idx
| uint8_t Flow_::vlan_idx |
Definition at line 382 of file flow.h.
Referenced by FlowInit().
The documentation for this struct was generated from the following file:
- src/flow.h
