suricata 3.1 源码分析35 (FlowWorker处理流程4 - 流重用函数)

static Flow *TcpReuseReplace(ThreadVars *tv, DecodeThreadVars *dtv,
                             FlowBucket *fb, Flow *old_f,
                             const uint32_t hash, const Packet *p)
{
    /* tag flow as reused so future lookups won't find it */
/*将老流标识为已重用*/
    old_f->flags |= FLOW_TCP_REUSED;
    /* get some settings that we move over to the new flow */
/*备份thread_id,后续会根据thread_id将一些设置备份到新的流中*/
    FlowThreadId thread_id = old_f->thread_id;

    /* since fb lock is still held this flow won't be found until we are done */
    FLOWLOCK_UNLOCK(old_f);

    /* Get a new flow. It will be either a locked flow or NULL */
/*申请新的流,这点之后会详细说明*/
    Flow *f = FlowGetNew(tv, dtv, p);
    if (f == NULL) {
        return NULL;
    }

    /* flow is locked */

    /* put at the start of the list */
    f->hnext = fb->head;
    fb->head->hprev = f;
    fb->head = f;

    /* initialize and return */
/*根据包初始化流的值,并指明流所属的hash*/
    FlowInit(f, p);
    f->flow_hash = hash;
    f->fb = fb;
/*将之前保存的thread_id赋值给新的流*/
    f->thread_id = thread_id;
    return f;
}

你可能感兴趣的:(suricata,suricata源码分析)