flow.h File Reference

#include "flow_error.h"
#include "util_math.h"
#include "common_defs.h"
#include "flow_print.h"
#include "flow_packet.h"
#include "bitop.h"

Go to the source code of this file.

Defines
#define	FROM_INITIATOR   1
#define	FROM_RESPONDER   2
#define	FLOW_REVERSED   0x00000001
#define	FLOW_CLOSEME   0x00000002
Typedefs
typedef _FLOWDATA	FLOWDATA
typedef _FLOWKEY	FLOWKEY
typedef _FLOWSTATS	FLOWSTATS
typedef _FLOW	FLOW
Enumerations
enum	FLOW_POSITION {   FLOW_NEW, FLOW_FIRST_BIDIRECTIONAL, FLOW_ADDITIONAL, FLOW_SHUTDOWN,   FLOW_MAX }
enum	FLOWHASHID { HASH1 = 1, HASH2 = 2 }
Functions
int	flow_init (FLOW *flow, char protocol, u_int32_t init_address, u_int16_t init_port, u_int32_t resp_address, u_int16_t resp_port)
int	flow_alloc (int family, FLOW **flow, int *size)
static INLINE void	flow_mark (FLOW *flow, int flags)
static INLINE int	flow_checkflag (FLOW *flow, u_long flags)
int	flowkey_reverse (FLOWKEY *key)
int	flowkey_make (FLOWKEY *key, FLOWPACKET *p)
int	flowkey_print (FLOWKEY *key)
int	flowkey_normalize (FLOWKEY *dst, const FLOWKEY *src)
int	flowkeycmp_fcn (const void *s1, const void *s2, size_t n)

---

Define Documentation

#define FLOW_CLOSEME   0x00000002

shutdown this flow ASAP Definition at line 16 of file flow.h. Referenced by CheckFlowShutdown().

#define FLOW_REVERSED   0x00000001

this flow was swapped Definition at line 15 of file flow.h.

#define FROM_INITIATOR   1

Definition at line 11 of file flow.h. Referenced by CheckFlowShutdown(), flowcache_find(), FlowPreprocessor(), flowstat_increment(), ps_tracker_update_ip(), ps_tracker_update_tcp(), and ps_tracker_update_udp().

#define FROM_RESPONDER   2

Definition at line 12 of file flow.h. Referenced by flowcache_find(), FlowPreprocessor(), flowstat_increment(), ps_filter_ignore(), ps_tracker_update_ip(), ps_tracker_update_tcp(), and ps_tracker_update_udp().

---

Typedef Documentation

typedef struct _FLOW FLOW

typedef struct _FLOWDATA FLOWDATA

typedef struct _FLOWKEY FLOWKEY

typedef struct _FLOWSTATS FLOWSTATS

---

Enumeration Type Documentation

enum FLOW_POSITION

Enumeration values: FLOW_NEW  first packet in flow FLOW_FIRST_BIDIRECTIONAL  first response packet in flow FLOW_ADDITIONAL  additional data on an existing flow FLOW_SHUTDOWN  shutdown of a existing flow due to timeout or protocol layer FLOW_MAX  this should not be used and should always be the biggest in the enum for flow_callbacks() Definition at line 24 of file flow.h.

enum FLOWHASHID

Enumeration values: HASH1  HASH2  Definition at line 70 of file flow.h.

---

Function Documentation

int flow_alloc (  int  family, FLOW **  flow, int *  size )

Calloc a FLOW object of the right type -- this function is not needed Parameters: family  address family flow  paramter to return the actual flow in size  # of bytes allocated for a new flow Returns: 0 on sucess, else failure Definition at line 59 of file flow.c. References FLOW_ENOMEM, FLOW_ENULL, FLOW_SUCCESS, and NULL.

static INLINE int flow_checkflag (  FLOW *  flow, u_long  flags )  [static]

Check to see if a particular flag exists Parameters: flow  flags  Definition at line 99 of file flow.h. References _FLOWSTATS::flow_flags, and _FLOW::stats. Referenced by CheckFlowShutdown().

int flow_init (  FLOW *  flow, char  protocol, u_int32_t  init_address, u_int16_t  init_port, u_int32_t  resp_address, u_int16_t  resp_port )

have not done anything with the flow->data section yet Definition at line 22 of file flow.c. References FLOW_EINVALID, FLOW_ENULL, flow_printf(), FLOW_SUCCESS, flowstat_clear(), _FLOWKEY::init_address, _FLOWKEY::init_port, _FLOW::key, NULL, _FLOWKEY::protocol, _FLOWKEY::resp_address, _FLOWKEY::resp_port, and _FLOW::stats. Referenced by flowcache_newflow().

static INLINE void flow_mark (  FLOW *  flow, int  flags )  [static]

Mark a flow with a particular flag Parameters: flow  flags  Definition at line 88 of file flow.h. References _FLOWSTATS::flow_flags, and _FLOW::stats.

int flowkey_make (  FLOWKEY *  key, FLOWPACKET *  p )

Given a packet, generate a key. Todo: ICMP errors on an existing flow Parameters: key  where to set the key p  Packet to make a key from Returns: FLOW_SUCCESS on success, else failure Definition at line 94 of file flow.c. References FLOW_EINVALID, FLOW_ENULL, FLOW_SUCCESS, GetIPv4DstIp(), GetIPv4DstPort(), GetIPv4Proto(), GetIPv4SrcIp(), GetIPv4SrcPort(), _FLOWKEY::init_address, _FLOWKEY::init_port, IsIPv4Packet(), memset, _FLOWKEY::protocol, _FLOWKEY::resp_address, and _FLOWKEY::resp_port. Referenced by FlowPreprocessor().

int flowkey_normalize (  FLOWKEY *  dst, const FLOWKEY *  src )

Copy into dst from src and normalize the results so that things will hash to the same entry no matter what. This should only be used for SEARCHING as it doesn't store much else. Parameters: dst  where to copy to src  where to copy from Definition at line 153 of file flow.c. References _FLOWKEY::init_address, _FLOWKEY::init_port, _FLOWKEY::protocol, _FLOWKEY::resp_address, and _FLOWKEY::resp_port. Referenced by flowcache_find(), flowcache_newflow(), and flowcache_releaseflow().

int flowkey_print (  FLOWKEY *  key  )

print out a key to a file stream Parameters: key  what to print Returns: 0 on sucess Definition at line 134 of file flow.c. References flow_printf(), _FLOWKEY::init_address, _FLOWKEY::init_port, _FLOWKEY::protocol, _FLOWKEY::resp_address, and _FLOWKEY::resp_port. Referenced by flow_callbacks(), FlowPreprocessor(), and flowps_newflow_callback().

int flowkey_reverse (  FLOWKEY *  key  )

int flowkeycmp_fcn (  const void *  s1, const void *  s2, size_t  n )

perform key comparison Parameters: s1  pointer to A s2  pointer to B n  size of each node Returns: 0 if they are equal, else they aren't equal Definition at line 186 of file flow.c. References _FLOWKEY::init_address, _FLOWKEY::init_port, _FLOWKEY::protocol, _FLOWKEY::resp_address, and _FLOWKEY::resp_port. Referenced by flowcache_init().

---