Flow data structure. More...

#include <flow.h>

Collaboration diagram for Flow_:

[legend]

Data Fields
FlowAddress	src

FlowAddress	dst

union {

Port sp

struct {

uint8_t type

uint8_t code

} icmp_s

struct {

uint32_t spi

} esp

};

union {

Port dp

struct {

uint8_t type

uint8_t code

} icmp_d

};

uint8_t	proto

uint8_t	recursion_level

uint16_t	vlan_id [VLAN_MAX_LAYERS]

uint8_t	vlan_idx

union {

struct {

uint8_t ffr_ts:4

uint8_t ffr_tc:4

}

uint8_t ffr

};

FlowThreadId	thread_id [2]

struct Flow_ *	next

struct LiveDevice_ *	livedev

uint32_t	flow_hash

uint32_t	timeout_policy

SCTime_t	lastts

FlowStateType	flow_state

uint32_t	tenant_id

uint32_t	probing_parser_toserver_alproto_masks

uint32_t	probing_parser_toclient_alproto_masks

uint32_t	flags

uint16_t	file_flags

uint16_t	protodetect_dp

int64_t	parent_id

SCMutex	m

void *	protoctx

uint8_t	protomap

uint8_t	flow_end_flags

AppProto	alproto
	application level protocol

AppProto	alproto_ts

AppProto	alproto_tc

AppProto	alproto_orig

AppProto	alproto_expect

uint32_t	de_ctx_version

uint8_t	min_ttl_toserver

uint8_t	max_ttl_toserver

uint8_t	min_ttl_toclient

uint8_t	max_ttl_toclient

uint8_t	applied_exception_policy

AppLayerParserState *	alparser

void *	alstate

const struct SigGroupHead_ *	sgh_toclient

const struct SigGroupHead_ *	sgh_toserver

GenericVar *	flowvar

struct FlowBucket_ *	fb

SCTime_t	startts

uint32_t	todstpktcnt

uint32_t	tosrcpktcnt

uint64_t	todstbytecnt

uint64_t	tosrcbytecnt

Storage	storage []

Detailed Description

Flow data structure.

The flow is a global data structure that is created for new packets of a flow and then looked up for the following packets of a flow.

Locking

The flow is updated/used by multiple packets at the same time. This is why there is a flow-mutex. It's a mutex and not a spinlock because some operations on the flow can be quite expensive, thus spinning would be too expensive.

The flow "header" (addresses, ports, proto, recursion level) are static after the initialization and remain read-only throughout the entire live of a flow. This is why we can access those without protection of the lock.

Definition at line 355 of file flow.h.

Field Documentation

◆ [union]

union { ... } Flow_

◆ [union]

union { ... } Flow_

◆ [union]

union { ... } Flow_

◆ alparser

AppLayerParserState* Flow_::alparser

application level storage ptrs. parser internal state

Definition at line 478 of file flow.h.

Referenced by AppLayerFrameDump(), AppLayerFrameNewByAbsoluteOffset(), AppLayerFrameNewByPointer(), AppLayerFrameNewByRelativeOffset(), AppLayerFramesFreeContainer(), AppLayerFramesGetContainer(), AppLayerFramesSetupContainer(), AppLayerHandleTCPData(), AppLayerParserParse(), AppLayerParserTransactionsCleanup(), AppLayerProtoDetectReset(), DetectEngineStateResetTxs(), FlowCleanupAppLayer(), FlowNeedsReassembly(), LLVMFuzzerTestOneInput(), Prefilter(), and StreamTcpDisableAppLayer().

◆ alproto

AppProto Flow_::alproto

application level protocol

Definition at line 450 of file flow.h.

Referenced by AppLayerFrameGetLastOpenByType(), AppLayerFrameNewByAbsoluteOffset(), AppLayerFrameNewByPointer(), AppLayerFrameNewByRelativeOffset(), AppLayerFramesSetupContainer(), AppLayerHandleTCPData(), AppLayerHandleUdp(), AppLayerIncAllocErrorCounter(), AppLayerIncGapErrorCounter(), AppLayerIncInternalErrorCounter(), AppLayerIncParserErrorCounter(), AppLayerIncTxCounter(), AppLayerParserGetStreamDepth(), AppLayerParserGetTransactionActive(), AppLayerParserGetTxCnt(), AppLayerParserGetTxFiles(), AppLayerParserParse(), AppLayerParserSetTransactionInspectId(), AppLayerParserStateCleanup(), AppLayerParserTransactionsCleanup(), AppLayerProtoDetectReset(), AppLayerRequestProtocolChange(), DetectEngineInspectBufferGeneric(), DetectEngineInspectBufferSingle(), DetectEngineInspectFiledata(), DetectEngineInspectMultiBufferGeneric(), DetectEngineStateResetTxs(), DetectRunFrameInspectRule(), DetectRunStoreStateTx(), EveAddAppProto(), FileDisableStoringForTransaction(), FileUpdateFlowFileFlags(), FlowNeedsReassembly(), FrameJsonLogOneFrame(), JsonBuildFileInfoRecord(), LLVMFuzzerTestOneInput(), LuaExtensionsMatchSetup(), LuaStateNeedProto(), Prefilter(), RulesDumpMatchArray(), RulesDumpTxMatchArray(), SCAppLayerForceProtocolChange(), and StreamTcpPacket().

◆ alproto_expect

AppProto Flow_::alproto_expect

expected app protocol: used in protocol change/upgrade like in STARTTLS.

Definition at line 459 of file flow.h.

Referenced by AppLayerHandleTCPData(), AppLayerRequestProtocolChange(), and EveAddAppProto().

◆ alproto_orig

AppProto Flow_::alproto_orig

original application level protocol. Used to indicate the previous protocol when changing to another protocol , e.g. with STARTTLS.

Definition at line 456 of file flow.h.

Referenced by AppLayerHandleTCPData(), AppLayerParserParse(), AppLayerRequestProtocolChange(), EveAddAppProto(), and SCAppLayerForceProtocolChange().

◆ alproto_tc

AppProto Flow_::alproto_tc

Definition at line 452 of file flow.h.

Referenced by AppLayerExpectationHandle(), AppLayerHandleTCPData(), AppLayerHandleUdp(), AppLayerProtoDetectGetProto(), AppLayerProtoDetectReset(), AppLayerRequestProtocolChange(), EveAddAppProto(), FlowSwap(), and SCAppLayerForceProtocolChange().

◆ alproto_ts

AppProto Flow_::alproto_ts

Definition at line 451 of file flow.h.

Referenced by AppLayerExpectationHandle(), AppLayerHandleTCPData(), AppLayerHandleUdp(), AppLayerProtoDetectGetProto(), AppLayerProtoDetectReset(), AppLayerRequestProtocolChange(), EveAddAppProto(), FlowSwap(), and SCAppLayerForceProtocolChange().

◆ alstate

void* Flow_::alstate

application layer state

Definition at line 479 of file flow.h.

Referenced by AppLayerHandleTCPData(), AppLayerParserParse(), AppLayerParserTransactionsCleanup(), DetectFileInspectGeneric(), FileUpdateFlowFileFlags(), FlowCleanupAppLayer(), FlowNeedsReassembly(), and LuaExtensionsMatchSetup().

◆ applied_exception_policy

uint8_t Flow_::applied_exception_policy

which exception policies were applied, if any

Definition at line 473 of file flow.h.

Referenced by ExceptionPolicyApply().

◆ code

uint8_t Flow_::code

icmp code

Definition at line 364 of file flow.h.

Referenced by FlowInit().

◆ de_ctx_version

uint32_t Flow_::de_ctx_version

detection engine ctx version used to inspect this flow. Set at initial inspection. If it doesn't match the currently in use de_ctx, the stored sgh ptrs are reset.

Definition at line 464 of file flow.h.