flow_cache.c File Reference

where flows are stored More...

#include <stdio.h>
#include "flow_cache.h"
#include "flow_callback.h"
#include "flow_hash.h"

Go to the source code of this file.

Defines
#define	FLOW_PERF_FIX
Functions
static int	flowcache_anrfree (void *key, void *data)
static int	flowcache_usrfree (void *key, void *data)
static INLINE int	flowcache_mru (FLOWCACHE *flowcachep, FLOW **flowpp)
static INLINE int	flowcache_lru (FLOWCACHE *flowcachep, FLOW **flowpp)
static INLINE int	FCS_find (FLOWCACHE *flowcachecp, FLOWKEY *keyp)
static INLINE int	FCS_revfind (FLOWCACHE *flowcachecp, FLOWKEY *keyp)
static INLINE int	FCS_new (FLOWCACHE *flowcachecp, FLOWKEY *keyp)
static INLINE int	FCS_find_success (FLOWCACHE *flowcachecp, FLOWKEY *keyp)
static INLINE int	FCS_find_fail (FLOWCACHE *flowcachecp, FLOWKEY *keyp)
int	flowcache_init (FLOWCACHE *flowcachep, unsigned int rows, int memcap, int datasize, FLOWHASHID hashid)
int	flowcache_destroy (FLOWCACHE *flowcachep)
unsigned	flowcache_overhead_blocks (FLOWCACHE *fcp)
int	flowcache_releaseflow (FLOWCACHE *flowcachep, FLOW **flowpp)
int	init_flowdata (FLOWCACHE *fcp, FLOW *flowp)
int	flowcache_newflow (FLOWCACHE *flowcachep, FLOWKEY *keyp, FLOW **flowpp)
int	flowcache_find (FLOWCACHE *flowcachep, FLOWKEY *keyp, FLOW **flowpp, int *direction)
const char *	flowcache_pname (FLOW_POSITION position)
void	flowcache_stats (FILE *stream, FLOWCACHE *flowcachep)
int	flowcache_row_count (FLOWCACHE *sbp)
int	flowcache_overhead_bytes (FLOWCACHE *sbp)

---

Detailed Description

where flows are stored

Author:

Chris Green <cmg@sourcefire.com>

Date:

Fri Jun 20 09:04:51 2003

The FlowCache is a memory-capped storage area for the FLOW datatype. It is inspired by spp_conversation, ipaudit, stream4 and frag2.

Each FLOW is uniquely identified by the 5-tuple (ipproto,sip,dip,sport,dport)

Currently we only support IPV4 but new protocols will only require the addition of additional protocol specific hash tables. Ideally, the API will stay the same and just do a switch on the key type to support the various address families.

This is meant to centralize the state management routines so that it's easy to just worry about higher level protocols in other modules.

This is built on top of sfxhash currently and relies on it for memory management. flow_hash.c contains the hashing keys

Definition in file flow_cache.c.

---

Define Documentation

#define FLOW_PERF_FIX

Definition at line 28 of file flow_cache.c.

---

Function Documentation

static INLINE int FCS_find (  FLOWCACHE *  flowcachecp, FLOWKEY *  keyp )  [static]

Definition at line 471 of file flow_cache.c. References _FCSTAT::find_ops, _FLOWCACHE::per_proto, _FLOWKEY::protocol, and _FLOWCACHE::total. Referenced by flowcache_find().

static INLINE int FCS_find_fail (  FLOWCACHE *  flowcachecp, FLOWKEY *  keyp )  [static]

Definition at line 501 of file flow_cache.c. References _FCSTAT::find_fail, _FLOWCACHE::per_proto, _FLOWKEY::protocol, and _FLOWCACHE::total. Referenced by flowcache_find().

static INLINE int FCS_find_success (  FLOWCACHE *  flowcachecp, FLOWKEY *  keyp )  [static]

Definition at line 494 of file flow_cache.c. References _FCSTAT::find_success, _FLOWCACHE::per_proto, _FLOWKEY::protocol, and _FLOWCACHE::total. Referenced by flowcache_find().

static INLINE int FCS_new (  FLOWCACHE *  flowcachecp, FLOWKEY *  keyp )  [static]

Definition at line 487 of file flow_cache.c. References _FCSTAT::new_flows, _FLOWCACHE::per_proto, _FLOWKEY::protocol, and _FLOWCACHE::total. Referenced by flowcache_newflow().

static INLINE int FCS_revfind (  FLOWCACHE *  flowcachecp, FLOWKEY *  keyp )  [static]

Definition at line 480 of file flow_cache.c. References _FLOWCACHE::per_proto, _FLOWKEY::protocol, _FCSTAT::reversed_ops, and _FLOWCACHE::total. Referenced by flowcache_find().

static int flowcache_anrfree (  void *  key, void *  data )  [static]

Automatically recover nodes and make sure that all the other references are taken care of. Parameters: key  hash key data  ptr to FLOW data Returns: 0 if this node can be removed Definition at line 433 of file flow_cache.c. References flow_callbacks(), FLOW_SHUTDOWN, and NULL. Referenced by flowcache_init().

int flowcache_destroy (  FLOWCACHE *  flowcachep  )

Definition at line 141 of file flow_cache.c. References FLOW_ENULL, FLOW_SUCCESS, _FLOWCACHE::ipv4_table, NULL, and sfxhash_delete(). Referenced by FlowCleanExit().

int flowcache_find (  FLOWCACHE *  flowcachep, FLOWKEY *  keyp, FLOW **  flowpp, int *  direction )

Look for the data in the flow tables. Parameters: flowcachep  cache to look in keyp  pointer to searching key data flowpp  pointer to set with this module direction  pass back argument (FROM_INITIATOR or FROM_RESPONDER) Returns: FLOW_SUCCESS on success, FLOW_NOTFOUND when not found, else usage error Definition at line 346 of file flow_cache.c. References FCS_find(), FCS_find_fail(), FCS_find_success(), FCS_revfind(), FLOW_ENULL, FLOW_NOTFOUND, FLOW_SUCCESS, flowkey_normalize(), FROM_INITIATOR, FROM_RESPONDER, _FLOWKEY::init_address, _FLOWKEY::init_port, _FLOWCACHE::ipv4_table, _FLOW::key, NULL, and sfxhash_find(). Referenced by FlowPreprocessor().

int flowcache_init (  FLOWCACHE *  flowcachep, unsigned int  rows, int  memcap, int  datasize, FLOWHASHID  hashid )

Definition at line 55 of file flow_cache.c. References FLOW_BADJUJU, FLOW_EINVALID, FLOW_ENOMEM, FLOW_ENULL, FLOW_SUCCESS, flowcache_anrfree(), flowcache_usrfree(), flowkey_hashfcn1(), flowkey_hashfcn2(), flowkeycmp_fcn(), HASH1, HASH2, int(), _FLOWCACHE::ipv4_table, _FLOWCACHE::max_flowbits_bytes, memset, NULL, sfxhash_delete(), sfxhash_new(), and sfxhash_set_keyops(). Referenced by FlowInit().

static INLINE int flowcache_lru (  FLOWCACHE *  flowcachep, FLOW **  flowpp )  [static]

Get the least recently used flow from the cache Parameters: flowcachep  flow cache to operate on flowp  where to put the flow Returns: FLOW_SUCCESS on sucess Definition at line 323 of file flow_cache.c. References FLOW_EINVALID, FLOW_NOTFOUND, FLOW_SUCCESS, _FLOWCACHE::ipv4_table, NULL, and sfxhash_lru(). Referenced by flowcache_stats().

static INLINE int flowcache_mru (  FLOWCACHE *  flowcachep, FLOW **  flowpp )  [static]

Get the most recently used flow from the cache Parameters: flowcachep  flow cache to operate on flowp  where to put the flow Returns: FLOW_SUCCESS on sucess Definition at line 302 of file flow_cache.c. References FLOW_EINVALID, FLOW_NOTFOUND, FLOW_SUCCESS, _FLOWCACHE::ipv4_table, NULL, and sfxhash_mru(). Referenced by flowcache_newflow(), and flowcache_stats().

int flowcache_newflow (  FLOWCACHE *  flowcachep, FLOWKEY *  keyp, FLOW **  flowpp )

Definition at line 203 of file flow_cache.c. References _sfxhash_node::data, FCS_new(), FLOW_BADJUJU, FLOW_EINVALID, FLOW_ENOMEM, FLOW_ENULL, flow_init(), flow_printf(), FLOW_SUCCESS, flowcache_mru(), flowkey_normalize(), _FLOWKEY::init_address, init_flowdata(), _FLOWKEY::init_port, _FLOWCACHE::ipv4_table, memset, NULL, _FLOWKEY::protocol, _FLOWKEY::resp_address, _FLOWKEY::resp_port, sfxhash_add(), sfxhash_get_node(), SFXHASH_INTABLE, SFXHASH_NOMEM, and SFXHASH_OK. Referenced by FlowPreprocessor().

unsigned flowcache_overhead_blocks (  FLOWCACHE *  fcp  )

Definition at line 155 of file flow_cache.c. References _FLOWCACHE::ipv4_table, and sfxhash_overhead_blocks(). Referenced by flowcache_stats().

int flowcache_overhead_bytes (  FLOWCACHE *  sbp  )

get the overhead # of bytes Parameters: sbp  flowcache ptr to return the memcap of Returns: nrows or -1 Definition at line 635 of file flow_cache.c. References _FLOWCACHE::ipv4_table, NULL, and sfxhash_overhead_bytes(). Referenced by DisplayFlowConfig(), and flowcache_stats().

const char* flowcache_pname (  FLOW_POSITION  position  )

map a position to a name Parameters: position  where to return the name of Returns: string reprenting position name Definition at line 407 of file flow_cache.c. References FLOW_MAX. Referenced by flow_callbacks().

int flowcache_releaseflow (  FLOWCACHE *  flowcachep, FLOW **  flowpp )

Todo: remove any associated data with the flow Definition at line 161 of file flow_cache.c. References FLOW_ENULL, FLOW_NOTFOUND, FLOW_SUCCESS, flowkey_normalize(), _FLOWCACHE::ipv4_table, NULL, and sfxhash_remove(). Referenced by CheckFlowShutdown().

int flowcache_row_count (  FLOWCACHE *  sbp  )

get the row count Parameters: sbp  flowcache ptr to return the memcap of Returns: nrows or -1 Definition at line 619 of file flow_cache.c. References _FLOWCACHE::ipv4_table, _sfxhash::nrows, and NULL. Referenced by DisplayFlowConfig().

void flowcache_stats (  FILE *  stream, FLOWCACHE *  flowcachep )

Definition at line 508 of file flow_cache.c. References calc_percent(), _FCSTAT::find_fail, _FCSTAT::find_ops, _FCSTAT::find_success, flow_printf(), FLOW_SUCCESS, flowcache_lru(), flowcache_mru(), flowcache_overhead_blocks(), flowcache_overhead_bytes(), _FLOWCACHE::ipv4_table, _FLOWSTATS::last_packet, _sfxhash::mc, MEMCAP::memcap, MEMCAP::memused, MEMCAP::nblocks, _FCSTAT::new_flows, _FLOWCACHE::per_proto, _FCSTAT::reversed_ops, sfxhash_anr_count(), sfxhash_count(), sfxhash_maxdepth(), _FLOW::stats, and _FLOWCACHE::total. Referenced by FlowCleanExit(), and FlowPreprocessor().

static int flowcache_usrfree (  void *  key, void *  data )  [static]

Automatically recover nodes and make sure that all the other references are taken care of. Parameters: key  hash key data  ptr to FLOW data p Returns: 0 if this node can be removed Definition at line 456 of file flow_cache.c. Referenced by flowcache_init().

int init_flowdata (  FLOWCACHE *  fcp, FLOW *  flowp )

Definition at line 189 of file flow_cache.c. References _FLOWDATA::boFlowbits, boInitStaticBITOP(), _FLOW::data, _FLOWDATA::flowb, and _FLOWCACHE::max_flowbits_bytes. Referenced by flowcache_newflow().

---