suricata flow分配

flow pool

数据结构

typedef struct FlowQueuePrivate_
{
    Flow *top;
    Flow *bot;
    uint32_t len;
} FlowQueuePrivate;

typedef struct FlowSparePool {
    FlowQueuePrivate queue;
    struct FlowSparePool *next;
} FlowSparePool;

初始化

FlowSparePool初始化flow_config.prealloc个(配置节点flow.prealloc)；
FlowQueuePrivate初始化flow_spare_pool_block_size=100个

更新

FlowSparePoolUpdate
调整空闲flow数量，空闲flow总数少于预配置的flow个数的90%则补齐，空闲flow总数多于预配置flow个数的110%则释放。

分配

FlowQueuePrivate FlowSpareGetFromPool(void);

归还

void FlowSparePoolReturnFlow(Flow *f);

申请flow

数据结构

typedef struct FlowLookupStruct_ // TODO name
{
    /** thread store of spare queues */
    FlowQueuePrivate spare_queue;
    DecodeThreadVars *dtv;
    FlowQueuePrivate work_queue;
    uint32_t emerg_spare_sync_stamp;
} FlowLookupStruct;

申请顺序

- 从线程FlowLookupStruct fls的spare_queue申请；
- 从flow pool申请；
- If we reached the max memcap, we get a used flow；否则，直接malloc申请