suricata 3.1 源码分析13 （流初始化）

简介

Suricata中用于管理和维护流的模块称为Flow Engine，主要由两部分实现，第一部分的入口点是FlowHandlePacket函数，用于为新数据包进行流查找/分配，另一部分是FlowManagerThread线程，用于对超时的流进行删除。

初始化
初始化在FlowInitConfig中完成，与之相关的配置结构体为FlowConfig，其字段含义如下：
字段含义hash_rand用于随机化hash table的分布，后面会介绍hash_size流表所使用的hash table的大小（桶数量），默认为65536，memcapflow engine所允许使用的最大内存数量，默认为32MB，prealloc初始时预分配的流的数量，默认为10000，emergency_recovery退出紧急状态前需要删除的流的百分比，默认为30

    /** \brief initialize the configuration
     *  \warning Not thread safe */
    void FlowInitConfig(char quiet)
    {
        SCLogDebug("initializing flow engine...");

    memset(&flow_config,  0, sizeof(flow_config));
       //初始化FlowConfig类型的变量low_config。

    SC_ATOMIC_INIT(flow_flags);
    SC_ATOMIC_INIT(flow_memuse);
    SC_ATOMIC_INIT(flow_prune_idx);
    FlowQueueInit(&flow_spare_q);
    FlowQueueInit(&flow_recycle_q);
使用FlowQueueInit初始化一个用于存放空闲流（预分配的/回收后的）的flow_spare_q和flow_recycle_q。这里专门使用了一个FlowQueue结构体来实现队列，内部是一个标准的链式队列（首指针、尾指针、元素个数），与Ring Buffer那种基于数组实现的循环队列相比，更适合存储容量未知的数据。

    #ifndef AFLFUZZ_NO_RANDOM
    unsigned int seed = RandomTimePreseed();
    /* set defaults */
    flow_config.hash_rand   = (int)( FLOW_DEFAULT_HASHSIZE * (rand_r(&seed) / RAND_MAX + 1.0));
    #endif
    flow_config.hash_size   = FLOW_DEFAULT_HASHSIZE;
设置默认值hash_size：65536

    flow_config.memcap      = FLOW_DEFAULT_MEMCAP;
设置默认值memcap：32*1024*1024  (32M)

    flow_config.prealloc    = FLOW_DEFAULT_PREALLOC;
设置默认值prealloc：10000


    /* If we have specific config, overwrite the defaults with them,
     * otherwise, leave the default values */
    intmax_t val = 0;
    if (ConfGetInt("flow.emergency-recovery", &val) == 1) {
        if (val <= 100 && val >= 1) {
            flow_config.emergency_recovery = (uint8_t)val;
        } else {
            SCLogError(SC_ERR_INVALID_VALUE, "flow.emergency-recovery must be in the range of 1 and 100 (as percentage)");
            flow_config.emergency_recovery = FLOW_DEFAULT_EMERGENCY_RECOVERY;
        }
    } else {
        SCLogDebug("flow.emergency-recovery, using default value");
        flow_config.emergency_recovery = FLOW_DEFAULT_EMERGENCY_RECOVERY;
    }
从配置中读取emergency-recovery

    /* Check if we have memcap and hash_size defined at config */
    char *conf_val;
    uint32_t configval = 0;

    /** set config values for memcap, prealloc and hash_size */
    if ((ConfGet("flow.memcap", &conf_val)) == 1)
    {
        if (ParseSizeStringU64(conf_val, &flow_config.memcap) < 0) {
            SCLogError(SC_ERR_SIZE_PARSE, "Error parsing flow.memcap "
                       "from conf file - %s.  Killing engine",
                       conf_val);
            exit(EXIT_FAILURE);
        }
    }
从配置中读取memcap

    if ((ConfGet("flow.hash-size", &conf_val)) == 1)
    {
        if (ByteExtractStringUint32(&configval, 10, strlen(conf_val),
                                    conf_val) > 0) {
            flow_config.hash_size = configval;
        }
    }
从配置中读取hash_size

    if ((ConfGet("flow.prealloc", &conf_val)) == 1)
    {
        if (ByteExtractStringUint32(&configval, 10, strlen(conf_val),
                                    conf_val) > 0) {
            flow_config.prealloc = configval;
        }
    }
从配置中读取prealloc

    SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: "
               "%"PRIu32", prealloc: %"PRIu32, flow_config.memcap,
               flow_config.hash_size, flow_config.prealloc);

    /* alloc hash memory */
    uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket);
    if (!(FLOW_CHECK_MEMCAP(hash_size))) {
        SCLogError(SC_ERR_FLOW_INIT, "allocating flow hash failed: "
                "max flow memcap is smaller than projected hash size. "
                "Memcap: %"PRIu64", Hash table size %"PRIu64". Calculate "
                "total hash size by multiplying \"flow.hash-size\" with %"PRIuMAX", "
                "which is the hash bucket size.", flow_config.memcap, hash_size,
                (uintmax_t)sizeof(FlowBucket));
        exit(EXIT_FAILURE);
    }
    flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS);
    if (unlikely(flow_hash == NULL)) {
        SCLogError(SC_ERR_FATAL, "Fatal error encountered in FlowInitConfig. Exiting...");
        exit(EXIT_FAILURE);
    }
    memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket));
按照hash_size为流表flow_hash分配内存，并全部初始化为0

    uint32_t i = 0;
    for (i = 0; i < flow_config.hash_size; i++) {
        FBLOCK_INIT(&flow_hash[i]);
    }
初始化各个bucket的锁

    (void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket)));
将hash表大小记录到当前flow engine占用的内存flow_memuse中

    if (quiet == FALSE) {
        SCLogConfig("allocated %llu bytes of memory for the flow hash... "
                  "%" PRIu32 " buckets of size %" PRIuMAX "",
                  SC_ATOMIC_GET(flow_memuse), flow_config.hash_size,
                  (uintmax_t)sizeof(FlowBucket));
    }

    /* pre allocate flows */
    for (i = 0; i < flow_config.prealloc; i++) {
        if (!(FLOW_CHECK_MEMCAP(sizeof(Flow) + FlowStorageSize()))) {
            SCLogError(SC_ERR_FLOW_INIT, "preallocating flows failed: "
                    "max flow memcap reached. Memcap %"PRIu64", "
                    "Memuse %"PRIu64".", flow_config.memcap,
                    ((uint64_t)SC_ATOMIC_GET(flow_memuse) + (uint64_t)sizeof(Flow)));
            exit(EXIT_FAILURE);
        }

        Flow *f = FlowAlloc();
调用FlowAlloc新建prealloc个Flow

        if (f == NULL) {
            SCLogError(SC_ERR_FLOW_INIT, "preallocating flow failed: %s", strerror(errno));
            exit(EXIT_FAILURE);
        }

        FlowEnqueue(&flow_spare_q,f);
使用FlowEnqueue将f放入flow_spare_q中  

    }

    if (quiet == FALSE) {
        SCLogConfig("preallocated %" PRIu32 " flows of size %" PRIuMAX "",
                flow_spare_q.len, (uintmax_t)(sizeof(Flow) + + FlowStorageSize()));
        SCLogConfig("flow memory usage: %llu bytes, maximum: %"PRIu64,
                SC_ATOMIC_GET(flow_memuse), flow_config.memcap);
    }

    FlowInitFlowProto();
调用FlowInitFlowProto，初始化各种协议相关的timeout和清理/状态函数，此处可在配置文件flow-timeouts里设置

    return;
    }