~ubuntu-branches/ubuntu/precise/suricata/precise-proposed

« back to all changes in this revision

Viewing changes to src/flow.h

Committer: Bazaar Package Importer
Author(s): Pierre Chifflier
Date: 2010-06-19 17:39:14 UTC
mfrom: (1.1.3 upstream)
Revision ID: james.westby@ubuntu.com-20100619173914-5vkjfgz24mbia29z

Tags: 0.9.2-1

Imported Upstream version 0.9.2

files added:
doc/INSTALL.PF_RING

doc/INSTALL.WINDOWS

libhtp/m4

libhtp/m4/libtool.m4

libhtp/m4/ltoptions.m4

libhtp/m4/ltsugar.m4

libhtp/m4/ltversion.m4

libhtp/m4/lt~obsolete.m4

src/detect-engine-dcepayload.c

src/detect-engine-dcepayload.h

src/detect-http-uri.c

src/detect-http-uri.h

src/source-erf-dag.c

src/source-erf-dag.h

src/tmqh-ringbuffer.c

src/tmqh-ringbuffer.h

src/util-atomic.h

src/util-ringbuffer.c

src/util-ringbuffer.h

src/win32-service.c

src/win32-service.h

files modified:
Makefile.am

Makefile.in

configure

configure.in

debian/changelog

debian/rules

doc/INSTALL

libhtp/Makefile.am

libhtp/Makefile.in

libhtp/aclocal.m4

libhtp/configure

libhtp/htp/Makefile.in

libhtp/test/Makefile.in

src/Makefile.am

src/Makefile.in

src/alert-debuglog.c

src/alert-fastlog.c

src/alert-prelude.c

src/alert-unified-alert.c

src/alert-unified-log.c

src/alert-unified2-alert.c

src/app-layer-dcerpc-common.h

src/app-layer-dcerpc.c

src/app-layer-detect-proto.c

src/app-layer-detect-proto.h

src/app-layer-ftp.c

src/app-layer-htp.c

src/app-layer-parser.c

src/app-layer-parser.h

src/app-layer-smb.c

src/app-layer-smb2.c

src/app-layer-ssl.c

src/app-layer-tls.c

src/app-layer.c

src/app-layer.h

src/conf.c

src/conf.h

src/counters.c

src/decode-events.h

src/decode-ipv4.c

src/decode-ipv6.c

src/decode-udp.c

src/decode.c

src/decode.h

src/detect-asn1.c

src/detect-bytejump.c

src/detect-bytejump.h

src/detect-bytetest.c

src/detect-bytetest.h

src/detect-classtype.c

src/detect-content.c

src/detect-dce-iface.c

src/detect-dce-opnum.c

src/detect-dce-stub-data.c

src/detect-decode-event.c

src/detect-depth.c

src/detect-detection-filter.c

src/detect-detection-filter.h

src/detect-distance.c

src/detect-engine-alert.c

src/detect-engine-iponly.c

src/detect-engine-mpm.c

src/detect-engine-mpm.h

src/detect-engine-payload.c

src/detect-engine-payload.h

src/detect-engine-port.c

src/detect-engine-proto.c

src/detect-engine-siggroup.c

src/detect-engine-siggroup.h

src/detect-engine-sigorder.c

src/detect-engine-state.c

src/detect-engine-state.h

src/detect-engine-threshold.c

src/detect-engine-threshold.h

src/detect-engine-uri.c

src/detect-engine-uri.h

src/detect-engine.c

src/detect-fast-pattern.c

src/detect-flags.c

src/detect-flow.c

src/detect-flowbits.c

src/detect-fragbits.c

src/detect-ftpbounce.c

src/detect-http-client-body.c

src/detect-http-cookie.c

src/detect-http-header.c

src/detect-http-method.c

src/detect-isdataat.c

src/detect-offset.c

src/detect-parse.c

src/detect-parse.h

src/detect-pcre.c

src/detect-pcre.h

src/detect-threshold.c

src/detect-threshold.h

src/detect-tls-version.c

src/detect-uricontent.c

src/detect-uricontent.h

src/detect-urilen.c

src/detect-within.c

src/detect.c

src/detect.h

src/flow-bit.c

src/flow-hash.c

src/flow-private.h

src/flow-queue.c

src/flow-queue.h

src/flow-util.c

src/flow-util.h

src/flow.c

src/flow.h

src/host.c

src/log-httplog.c

src/respond-reject.c

src/respond-reject.h

src/runmodes.c

src/runmodes.h

src/source-erf-file.c

src/source-ipfw.c

src/source-nfq.c

src/source-pcap-file.c

src/source-pcap.c

src/source-pfring.c

src/stream-tcp-private.h

src/stream-tcp-reassemble.c

src/stream-tcp-reassemble.h

src/stream-tcp.c

src/stream-tcp.h

src/stream.c

src/stream.h

src/suricata-common.h

src/suricata.c

src/suricata.h

src/threadvars.h

src/tm-modules.h

src/tm-queuehandlers.c

src/tm-queuehandlers.h

src/tm-threads.c

src/tmqh-packetpool.c

src/tmqh-simple.c

src/util-classification-config.c

src/util-classification-config.h

src/util-debug.c

src/util-error.c

src/util-error.h

src/util-fmemopen.c

src/util-host-os-info.c

src/util-mpm-b2g.c

src/util-mpm-b2g.h

src/util-mpm.c

src/util-mpm.h

src/util-profiling.c

src/util-profiling.h

src/util-radix-tree.c

src/util-spm-bm.c

src/util-spm-bm.h

src/util-threshold-config.c

src/util-unittest-helper.c

src/util-unittest-helper.h

suricata.yaml

Show diffs side-by-side

added added

removed removed

src/flow.h

#include "decode.h"

#include "util-var.h"

#include "util-atomic.h"

#define FLOW_QUIET TRUE

#define FLOW_VERBOSE FALSE

#define TOSERVER 0

#define TOCLIENT 1

/* per flow flags */

/** At least on packet from the source address was seen */

/** All packets in this flow should be accepted */

#define FLOW_ACTION_PASS 0x0400

/** Sgh for toserver direction set (even if it's NULL) */

#define FLOW_SGH_TOSERVER 0x0800

/** Sgh for toclient direction set (even if it's NULL) */

#define FLOW_SGH_TOCLIENT 0x1000

/* pkt flow flags */

#define FLOW_PKT_TOSERVER 0x01

#define FLOW_PKT_TOCLIENT 0x02

uint32_t emerg_timeout_new;

uint32_t emerg_timeout_est;

uint32_t flow_try_release;

uint32_t emergency_recovery;

} FlowConfig;

107

108

} FlowKey;

109

110

/**

111

* \brief Flow data structure.

112

113

* The flow is a global data structure that is created for new packets of a

114

* flow and then looked up for the following packets of a flow.

115

116

* Locking

117

118

* The flow is updated/used by multiple packets at the same time. This is why

119

* there is a flow-mutex. It's a mutex and not a spinlock because some

120

* operations on the flow can be quite expensive, thus spinning would be

121

* too expensive.

122

123

* The flow "header" (addresses, ports, proto, recursion level) are static

124

* after the initialization and remain read-only throughout the entire live

125

* of a flow. This is why we can access those without protection of the lock.

126

127

128

typedef struct Flow_

100

129

{

130

/* flow "header", used for hashing and flow lookup. Static after init,

131

* so safe to look at without lock */

101

132

Address src, dst;

102

133

union {

103

134

Port sp; /**< tcp/udp source port */

110

141

uint8_t proto;

111

142

uint8_t recursion_level;

112

143

144

/* end of flow "header" */

145

113

146

uint16_t flags;

114

147

115

148

/* ts of flow init and last update */

130

163

/** protocol specific data pointer, e.g. for TcpSession */

131

164

void *protoctx;

132

165

133

/** how many pkts and stream msgs are using the flow *right now* */

134

uint16_t use_cnt;

166

/** how many pkts and stream msgs are using the flow *right now*. This

167

* variable is atomic so not protected by the Flow mutex "m".

168

169

* On receiving a packet the counter is incremented while the flow

170

* bucked is locked, which is also the case on timeout pruning.

171

172

SC_ATOMIC_DECLARE(unsigned short, use_cnt);

135

173

136

174

/** detection engine state */

137

175

struct DetectEngineState_ *de_state;

138

176

177

/** toclient sgh for this flow. Only use when FLOW_SGH_TOCLIENT flow flag

178

* has been set. */

179

struct SigGroupHead_ *sgh_toclient;

180

/** toserver sgh for this flow. Only use when FLOW_SGH_TOSERVER flow flag

181

* has been set. */

182

struct SigGroupHead_ *sgh_toserver;

183

139

184

SCMutex m;

140

185

141

186

/* list flow ptrs

147

192

struct Flow_ *lprev;

148

193

149

194

struct FlowBucket_ *fb;

195

196

uint16_t alproto; /**< application level protocol */

197

void **aldata; /**< application level storage ptrs */

198

uint8_t alflags; /**< application level specific flags */

199

150

200

} Flow;

151

201

202

/** Flow Application Level flags */

203

#define FLOW_AL_PROTO_UNKNOWN 0x01

204

#define FLOW_AL_PROTO_DETECT_DONE 0x02

205

#define FLOW_AL_NO_APPLAYER_INSPECTION 0x04 /** \todo move to flow flags later */

206

#define FLOW_AL_STREAM_START 0x08

207

#define FLOW_AL_STREAM_EOF 0x10

208

#define FLOW_AL_STREAM_TOSERVER 0x20

209

#define FLOW_AL_STREAM_TOCLIENT 0x40

210

#define FLOW_AL_STREAM_GAP 0x80

211

152

212

enum {

153

213

FLOW_STATE_NEW = 0,

154

214

FLOW_STATE_ESTABLISHED,

171

231

void FlowPrintQueueInfo (void);

172

232

void FlowShutdown(void);

173

233

void FlowSetIPOnlyFlag(Flow *, char);

174

void FlowDecrUsecnt(ThreadVars *, Packet *);

234

void FlowSetIPOnlyFlagNoLock(Flow *, char);

235

236

void FlowIncrUsecnt(Flow *);

237

void FlowDecrUsecnt(Flow *);

238

239

uint32_t FlowPruneFlowsCnt(struct timeval *, int);

240

uint32_t FlowKillFlowsCnt(int);

175

241

176

242

void *FlowManagerThread(void *td);

177

243

182

248

int FlowSetProtoFreeFunc (uint8_t , void (*Free)(void *));

183

249

int FlowSetFlowStateFunc (uint8_t , int (*GetProtoState)(void *));

184

250

void FlowUpdateQueue(Flow *);

251

185

252

void FlowLockSetNoPacketInspectionFlag(Flow *);

186

253

void FlowSetNoPacketInspectionFlag(Flow *);

187

254

void FlowLockSetNoPayloadInspectionFlag(Flow *);

188

255

void FlowSetNoPayloadInspectionFlag(Flow *);

256

void FlowSetSessionNoApplayerInspectionFlag(Flow *);

257

258

int FlowGetPacketDirection(Flow *, Packet *);

259

260

void FlowL7DataPtrInit(Flow *);

261

void FlowL7DataPtrFree(Flow *);

189

262

190

263

#endif /* __FLOW_H__ */

191

264

Older »