简介
Suricata中用于管理和维护流的模块称为Flow Engine,主要由两部分实现,第一部分的入口点是FlowHandlePacket函数,用于为新数据包进行流查找/分配,另一部分是FlowManagerThread线程,用于对超时的流进行删除。
初始化
初始化在FlowInitConfig中完成,与之相关的配置结构体为FlowConfig,其字段含义如下:
字段含义hash_rand用于随机化hash table的分布,后面会介绍hash_size流表所使用的hash table的大小(桶数量),默认为65536,memcapflow engine所允许使用的最大内存数量,默认为32MB,prealloc初始时预分配的流的数量,默认为10000,emergency_recovery退出紧急状态前需要删除的流的百分比,默认为30
/** \brief initialize the configuration
* \warning Not thread safe */
void FlowInitConfig(char quiet)
{
SCLogDebug("initializing flow engine...");
memset(&flow_config, 0, sizeof(flow_config));
//初始化FlowConfig类型的变量low_config。
SC_ATOMIC_INIT(flow_flags);
SC_ATOMIC_INIT(flow_memuse);
SC_ATOMIC_INIT(flow_prune_idx);
FlowQueueInit(&flow_spare_q);
FlowQueueInit(&flow_recycle_q);
使用FlowQueueInit初始化一个用于存放空闲流(预分配的/回收后的)的flow_spare_q和flow_recycle_q。这里专门使用了一个FlowQueue结构体来实现队列,内部是一个标准的链式队列(首指针、尾指针、元素个数),与Ring Buffer那种基于数组实现的循环队列相比,更适合存储容量未知的数据。
#ifndef AFLFUZZ_NO_RANDOM
unsigned int seed = RandomTimePreseed();
/* set defaults */
flow_config.hash_rand = (int)( FLOW_DEFAULT_HASHSIZE * (rand_r(&seed) / RAND_MAX + 1.0));
#endif
flow_config.hash_size = FLOW_DEFAULT_HASHSIZE;
设置默认值hash_size:65536
flow_config.memcap = FLOW_DEFAULT_MEMCAP;
设置默认值memcap:32*1024*1024 (32M)
flow_config.prealloc = FLOW_DEFAULT_PREALLOC;
设置默认值prealloc:10000
/* If we have specific config, overwrite the defaults with them,
* otherwise, leave the default values */
intmax_t val = 0;
if (ConfGetInt("flow.emergency-recovery", &val) == 1) {
if (val <= 100 && val >= 1) {
flow_config.emergency_recovery = (uint8_t)val;
} else {
SCLogError(SC_ERR_INVALID_VALUE, "flow.emergency-recovery must be in the range of 1 and 100 (as percentage)");
flow_config.emergency_recovery = FLOW_DEFAULT_EMERGENCY_RECOVERY;
}
} else {
SCLogDebug("flow.emergency-recovery, using default value");
flow_config.emergency_recovery = FLOW_DEFAULT_EMERGENCY_RECOVERY;
}
从配置中读取emergency-recovery
/* Check if we have memcap and hash_size defined at config */
char *conf_val;
uint32_t configval = 0;
/** set config values for memcap, prealloc and hash_size */
if ((ConfGet("flow.memcap", &conf_val)) == 1)
{
if (ParseSizeStringU64(conf_val, &flow_config.memcap) < 0) {
SCLogError(SC_ERR_SIZE_PARSE, "Error parsing flow.memcap "
"from conf file - %s. Killing engine",
conf_val);
exit(EXIT_FAILURE);
}
}
从配置中读取memcap
if ((ConfGet("flow.hash-size", &conf_val)) == 1)
{
if (ByteExtractStringUint32(&configval, 10, strlen(conf_val),
conf_val) > 0) {
flow_config.hash_size = configval;
}
}
从配置中读取hash_size
if ((ConfGet("flow.prealloc", &conf_val)) == 1)
{
if (ByteExtractStringUint32(&configval, 10, strlen(conf_val),
conf_val) > 0) {
flow_config.prealloc = configval;
}
}
从配置中读取prealloc
SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: "
"%"PRIu32", prealloc: %"PRIu32, flow_config.memcap,
flow_config.hash_size, flow_config.prealloc);
/* alloc hash memory */
uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket);
if (!(FLOW_CHECK_MEMCAP(hash_size))) {
SCLogError(SC_ERR_FLOW_INIT, "allocating flow hash failed: "
"max flow memcap is smaller than projected hash size. "
"Memcap: %"PRIu64", Hash table size %"PRIu64". Calculate "
"total hash size by multiplying \"flow.hash-size\" with %"PRIuMAX", "
"which is the hash bucket size.", flow_config.memcap, hash_size,
(uintmax_t)sizeof(FlowBucket));
exit(EXIT_FAILURE);
}
flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS);
if (unlikely(flow_hash == NULL)) {
SCLogError(SC_ERR_FATAL, "Fatal error encountered in FlowInitConfig. Exiting...");
exit(EXIT_FAILURE);
}
memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket));
按照hash_size为流表flow_hash分配内存,并全部初始化为0
uint32_t i = 0;
for (i = 0; i < flow_config.hash_size; i++) {
FBLOCK_INIT(&flow_hash[i]);
}
初始化各个bucket的锁
(void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket)));
将hash表大小记录到当前flow engine占用的内存flow_memuse中
if (quiet == FALSE) {
SCLogConfig("allocated %llu bytes of memory for the flow hash... "
"%" PRIu32 " buckets of size %" PRIuMAX "",
SC_ATOMIC_GET(flow_memuse), flow_config.hash_size,
(uintmax_t)sizeof(FlowBucket));
}
/* pre allocate flows */
for (i = 0; i < flow_config.prealloc; i++) {
if (!(FLOW_CHECK_MEMCAP(sizeof(Flow) + FlowStorageSize()))) {
SCLogError(SC_ERR_FLOW_INIT, "preallocating flows failed: "
"max flow memcap reached. Memcap %"PRIu64", "
"Memuse %"PRIu64".", flow_config.memcap,
((uint64_t)SC_ATOMIC_GET(flow_memuse) + (uint64_t)sizeof(Flow)));
exit(EXIT_FAILURE);
}
Flow *f = FlowAlloc();
调用FlowAlloc新建prealloc个Flow
if (f == NULL) {
SCLogError(SC_ERR_FLOW_INIT, "preallocating flow failed: %s", strerror(errno));
exit(EXIT_FAILURE);
}
FlowEnqueue(&flow_spare_q,f);
使用FlowEnqueue将f放入flow_spare_q中
}
if (quiet == FALSE) {
SCLogConfig("preallocated %" PRIu32 " flows of size %" PRIuMAX "",
flow_spare_q.len, (uintmax_t)(sizeof(Flow) + + FlowStorageSize()));
SCLogConfig("flow memory usage: %llu bytes, maximum: %"PRIu64,
SC_ATOMIC_GET(flow_memuse), flow_config.memcap);
}
FlowInitFlowProto();
调用FlowInitFlowProto,初始化各种协议相关的timeout和清理/状态函数,此处可在配置文件flow-timeouts里设置
return;
}