Suricata6.0流表管理源码注释六：流的老化02

本文主要是介绍Suricata6.0流表管理源码注释六：流的老化02，对大家解决编程问题具有一定的参考价值，需要的程序猿们随着小编来一起学习吧！

        流老化入口函数FlowManger调用函数FlowTimeoutHash完成流老化处理，这个函数完成了大部分老化工作，把一个老化的流从flow_hash上移走，移入了回收队列，由回收线程取出来放入空闲全局flow内存池。

1. FlowTimeoutHash 函数

FlowManager-》FlowTimeoutHash

函数有两个参数表示flow bucket的范围值，const uint32_t hash_min, const uint32_t hash_max，先把老化的flow移入参数td->aside_queue队列，再从aside_queue队列移入回收线程的队列flow_recycle_q，如此玩法，flow必晕。

/**
 *  \brief time out flows from the hash
 *
 *  \param ts timestamp
 *  \param hash_min min hash index to consider
 *  \param hash_max max hash index to consider
 *  \param counters ptr to FlowTimeoutCounters structure
 *
 *  \retval cnt number of timed out flow
 */

//新版本的老化策略比旧版本复杂了很多，流分配那块修改应该是有效率提升，
//但是这个函数应该没有效率提升，
//这个函数总思路就是先设置一个位图，每1位表示一个bucket是否有需要老化的flow，
//还是和旧版一样判断每个bucket的next_ts与最新时间，先循环32或64次检查每个
//bucket是否有超时的flow，有超时的放入一个32或64位的整数，
//循环完成，再循环这个整数，检查每一位同时检查next_ts，都符合超时条件则进行老化，好复杂，没毛用
static uint32_t FlowTimeoutHash(FlowManagerTimeoutThread *td,
        struct timeval *ts,
        const uint32_t hash_min, const uint32_t hash_max,
        FlowTimeoutCounters *counters)
{
    uint32_t cnt = 0;
    //获取紧急模式标志
    const int emergency = ((SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY));
    //计算检查的bucket数量
    const uint32_t rows_checked = hash_max - hash_min;
    uint32_t rows_skipped = 0;
    uint32_t rows_empty = 0;

//那个一次取32还是64个bucket就是这个系统位数决定的，以下都认为64位吧
#if __WORDSIZE==64
#define BITS 64
#define TYPE uint64_t
#else
#define BITS 32
#define TYPE uint32_t
#endif

    for (uint32_t idx = hash_min; idx < hash_max; idx+=BITS) {
        TYPE check_bits = 0; //64位整数
        //取最小的数，万一bucket数量不够64个呢
        const uint32_t check = MIN(BITS, (hash_max - idx));
        //循环64次，检查64个bucket是否有超时的flow，有则设置一位到check_bits
        for (uint32_t i = 0; i < check; i++) {
            FlowBucket *fb = &flow_hash[idx+i];
            check_bits |= (TYPE)(SC_ATOMIC_LOAD_EXPLICIT(fb->next_ts, SC_ATOMIC_MEMORY_ORDER_RELAXED) <= (int32_t)ts->tv_sec) << (TYPE)i;
        }
        if (check_bits == 0) //没有一个超时的则继续下一轮64个bucket的超时判断
            continue;

        //多循环一次
        for (uint32_t i = 0; i < check; i++) {
            //有超时的，则循环检测这个64位数，然后老化之
            FlowBucket *fb = &flow_hash[idx+i];
            //多比较一次，何苦呢
            if ((check_bits & ((TYPE)1 << (TYPE)i)) != 0 && SC_ATOMIC_GET(fb->next_ts) <= (int32_t)ts->tv_sec) {
                FBLOCK_LOCK(fb);
                Flow *evicted = NULL;
                if (fb->evicted != NULL || fb->head != NULL) {
                    if (fb->evicted != NULL) {
                        //这个evicted队列不为空，说明在建立流获取流时检查到超时流，把那个超时
                        //放到有条件的放到这个队列了，也需要老化回收
                        /* transfer out of bucket so we can do additional work outside
                         * of the bucket lock */
                        //这里把这个evicted队列放到临时变量，后边代码处理这个evicted队列
                        evicted = fb->evicted;
                        fb->evicted = NULL;
                    }
                    if (fb->head != NULL) {
                        //这个flow bucket上有超时flow，所以调用FlowManagerHashRowTimeout
                        //进行超时处理,超时的流放到了td->aside_queue这个队列，这bucket老化
                        //就是把flow移入些队列，然后再将这些队列的flow以如回收线程的队列，繁琐
                        int32_t next_ts = 0;
                        FlowManagerHashRowTimeout(td, fb->head, ts, emergency, counters, &next_ts);
                            //设置bucket的最小超时时间，就是下一次超时时间
                            if (SC_ATOMIC_GET(fb->next_ts) != next_ts)
                            SC_ATOMIC_SET(fb->next_ts, next_ts);
                    }
                    //如果bucket的evicted队列没有flow， 且head为空不包含flow了，说明这个
                    //bucket的flow都被老化了，则设置下次老化时间为INT_MAX，就是不需要老化了
                    if (fb->evicted == NULL && fb->head == NULL) {
                        SC_ATOMIC_SET(fb->next_ts, INT_MAX);
                    }
                } else {
                    //如果bucket的evicted队列没有flow，且head为空不包含flow了，说明这个
                    //bucket的flow都被老化了，则设置下次老化时间为INT_MAX，就是不需要老化了
                    SC_ATOMIC_SET(fb->next_ts, INT_MAX);
                    rows_empty++;
                }
                FBLOCK_UNLOCK(fb);
                /* processed evicted list */
                if (evicted) {
                    //这个bucket的超时处理完成，现在处理移入evicted队列的超时flow
                    //其实，这个函数又把这些flow移入了td->aside_queue，尴尬
                    FlowManagerHashRowClearEvictedList(td, evicted, ts, counters);
                }
            } else {
                //没有超时的bucket，跳过计数增1
                rows_skipped++;
            }
        }
        if (td->aside_queue.len) {
            //这个是最后真正处理超时的flow，把td->aside_queue的flow移入回收线程的回收队列，
            //何苦呢
            cnt += ProcessAsideQueue(td, counters);
        }
    }

    counters->rows_checked += rows_checked;
    counters->rows_skipped += rows_skipped;
    counters->rows_empty += rows_empty;

    if (td->aside_queue.len) {
        //如果有未处理的flow，则继续把td->aside_queue的flow移入
        //回收线程的回收队列flow_recycle_q
        cnt += ProcessAsideQueue(td, counters);
    }
    counters->flows_removed += cnt;
    /* coverity[missing_unlock : FALSE] */
    return cnt;
}

2. FlowManagerHashRowTimeout 函数

FlowManager-》FlowTimeoutHash-》FlowManagerHashRowTimeout

这函数实际执行了老化操作，其实就调用FlowManagerFlowTimeout检查是否超时，是就把老化的flow从flow_hash移除，然后移入参数td->aside_queue，别的什么没干。

/**
 *  \internal
 *
 *  \brief check all flows in a hash row for timing out
 *
 *  \param f last flow in the hash row
 *  \param ts timestamp
 *  \param emergency bool indicating emergency mode
 *  \param counters ptr to FlowTimeoutCounters structure
 */
static void FlowManagerHashRowTimeout(FlowManagerTimeoutThread *td,
        Flow *f, struct timeval *ts,
        int emergency, FlowTimeoutCounters *counters, int32_t *next_ts)
{
    uint32_t checked = 0;
    Flow *prev_f = NULL;

    //循环检查bucket上的每个flow
    do {
        checked++;

        /* check flow timeout based on lastts and state. Both can be
         * accessed w/o Flow lock as we do have the hash row lock (so flow
         * can't disappear) and flow_state is atomic. lastts can only
         * be modified when we have both the flow and hash row lock */

        /* timeout logic goes here */
        //检查flow是否超时
        if (FlowManagerFlowTimeout(f, ts, next_ts, emergency) == 0) {
            //未超时继续检查下个flow
            counters->flows_notimeout++;

            prev_f = f;
            f = f->next;
            continue;
        }

        FMFlowLock(f); //FLOWLOCK_WRLOCK(f);

        Flow *next_flow = f->next;

        /* never prune a flow that is used by a packet we
         * are currently processing in one of the threads */
        //到这里说明flow超时了，引用计数如果大于0则不能老化
        //FlowBypassedTimeout这个函数还需要再看看
        if (f->use_cnt > 0 || !FlowBypassedTimeout(f, ts, counters)) {
            FLOWLOCK_UNLOCK(f);
            prev_f = f;
            if (f->use_cnt > 0) {
                counters->flows_timeout_inuse++;
            }
            f = f->next;
            continue;
        }

        //设置老化标志为超时老化
        f->flow_end_flags |= FLOW_END_FLAG_TIMEOUT;

        counters->flows_timeout++;

        //从bucket上移除flow
        RemoveFromHash(f, prev_f);

        //将超时的flow移入td->aside_queue队列
        //函数返回后，会将这个队列的flow移入回收线程的回收队列
        FlowQueuePrivateAppendFlow(&td->aside_queue, f);
        /* flow is still locked in the queue */

        f = next_flow;
    } while (f != NULL);

    counters->flows_checked += checked;
    if (checked > counters->rows_maxlen)
        counters->rows_maxlen = checked;
}

这篇关于Suricata6.0流表管理源码注释六：流的老化02的文章就介绍到这儿，希望我们推荐的文章对大家有所帮助，也希望大家多多支持为之网！