suricata
stream-tcp-private.h File Reference
#include "tree.h"
#include "decode.h"
#include "util-pool.h"
#include "util-pool-thread.h"
#include "util-streaming-buffer.h"
Include dependency graph for stream-tcp-private.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  TcpStateQueue_
 
struct  StreamTcpSackRecord
 
struct  TcpSegment
 
struct  TcpStream_
 
struct  TcpSession_
 

Macros

#define STREAMTCP_QUEUE_FLAG_TS   0x01
 
#define STREAMTCP_QUEUE_FLAG_WS   0x02
 
#define STREAMTCP_QUEUE_FLAG_SACK   0x04
 
#define TCP_SEG_LEN(seg)   (seg)->payload_len
 
#define TCP_SEG_OFFSET(seg)   (seg)->sbseg.stream_offset
 
#define SEG_SEQ_RIGHT_EDGE(seg)   ((seg)->seq + TCP_SEG_LEN((seg)))
 
#define STREAM_SEQ_RIGHT_EDGE(stream)   (stream)->segs_right_edge
 
#define STREAM_RIGHT_EDGE(stream)   (STREAM_BASE_OFFSET((stream)) + (STREAM_SEQ_RIGHT_EDGE((stream)) - (stream)->base_seq))
 
#define STREAM_HAS_SEEN_DATA(stream)   (!RB_EMPTY(&(stream)->sb.sbb_tree) || (stream)->sb.stream_offset || (stream)->sb.buf_offset)
 
#define STREAM_BASE_OFFSET(stream)   ((stream)->sb.stream_offset)
 
#define STREAM_APP_PROGRESS(stream)   (STREAM_BASE_OFFSET((stream)) + (stream)->app_progress_rel)
 
#define STREAM_RAW_PROGRESS(stream)   (STREAM_BASE_OFFSET((stream)) + (stream)->raw_progress_rel)
 
#define STREAM_LOG_PROGRESS(stream)   (STREAM_BASE_OFFSET((stream)) + (stream)->log_progress_rel)
 
#define STREAMTCP_FLAG_MIDSTREAM   0x0001
 
#define STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED   0x0002
 
#define STREAMTCP_FLAG_MIDSTREAM_SYNACK   0x0004
 
#define STREAMTCP_FLAG_TIMESTAMP   0x0008
 
#define STREAMTCP_FLAG_SERVER_WSCALE   0x0010
 
#define STREAMTCP_FLAG_ASYNC   0x0040
 
#define STREAMTCP_FLAG_4WHS   0x0080
 
#define STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT   0x0100
 
#define STREAMTCP_FLAG_CLIENT_SACKOK   0x0200
 
#define STREAMTCP_FLAG_SACKOK   0x0400
 
#define STREAMTCP_FLAG_3WHS_CONFIRMED   0x1000
 
#define STREAMTCP_FLAG_APP_LAYER_DISABLED   0x2000
 
#define STREAMTCP_FLAG_BYPASS   0x4000
 
#define STREAMTCP_FLAG_TCP_FAST_OPEN   0x8000
 
#define STREAMTCP_STREAM_FLAG_GAP   BIT_U16(0)
 
#define STREAMTCP_STREAM_FLAG_NOREASSEMBLY   BIT_U16(1)
 
#define STREAMTCP_STREAM_FLAG_KEEPALIVE   BIT_U16(2)
 
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED   BIT_U16(3)
 
#define STREAMTCP_STREAM_FLAG_TRIGGER_RAW   BIT_U16(4)
 
#define STREAMTCP_STREAM_FLAG_TIMESTAMP   BIT_U16(5)
 
#define STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP   BIT_U16(6)
 
#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED   BIT_U16(7)
 
#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED   BIT_U16(8)
 
#define STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED   BIT_U16(9)
 
#define STREAMTCP_STREAM_FLAG_DISABLE_RAW   BIT_U16(10)
 
#define STREAMTCP_STREAM_FLAG_RST_RECV   BIT_U16(11)
 
#define PAWS_24DAYS   2073600
 
#define PKT_IS_IN_RIGHT_DIR(ssn, p)
 
#define SEQ_EQ(a, b)   ((int32_t)((a) - (b)) == 0)
 
#define SEQ_LT(a, b)   ((int32_t)((a) - (b)) < 0)
 
#define SEQ_LEQ(a, b)   ((int32_t)((a) - (b)) <= 0)
 
#define SEQ_GT(a, b)   ((int32_t)((a) - (b)) > 0)
 
#define SEQ_GEQ(a, b)   ((int32_t)((a) - (b)) >= 0)
 
#define STREAMTCP_SET_RA_BASE_SEQ(stream, seq)
 
#define StreamTcpSetEvent(p, e)
 
#define StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream)   ((stream)->flags |= STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)
 
#define StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)   ((stream)->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)
 
#define StreamTcpResetStreamFlagAppProtoDetectionCompleted(stream)   ((stream)->flags &= ~STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED);
 
#define StreamTcpDisableAppLayerReassembly(ssn)
 

Typedefs

typedef struct TcpStateQueue_ TcpStateQueue
 
typedef struct StreamTcpSackRecord StreamTcpSackRecord
 
typedef struct TcpStream_ TcpStream
 
typedef struct TcpSession_ TcpSession
 

Enumerations

enum  {
  TCP_NONE, TCP_LISTEN, TCP_SYN_SENT, TCP_SYN_RECV,
  TCP_ESTABLISHED, TCP_FIN_WAIT1, TCP_FIN_WAIT2, TCP_TIME_WAIT,
  TCP_LAST_ACK, TCP_CLOSE_WAIT, TCP_CLOSING, TCP_CLOSED
}
 

Functions

int TcpSackCompare (struct StreamTcpSackRecord *a, struct StreamTcpSackRecord *b)
 
 RB_HEAD (TCPSACK, StreamTcpSackRecord)
 
 RB_PROTOTYPE (TCPSACK, StreamTcpSackRecord, rb, TcpSackCompare)
 
struct TcpSegment __attribute__ ((__packed__)) TcpSegment
 DNP3 link header. More...
 
 RB_ENTRY (TcpSegment) __attribute__((__packed__)) rb
 
int TcpSegmentCompare (struct TcpSegment *a, struct TcpSegment *b)
 compare function for the Segment tree More...
 
 RB_HEAD (TCPSEG, TcpSegment)
 
 RB_PROTOTYPE (TCPSEG, TcpSegment, rb, TcpSegmentCompare)
 

Variables

PoolThreadReserved res
 
uint16_t payload_len
 
uint32_t seq
 
StreamingBufferSegment sbseg
 

Detailed Description

Macro Definition Documentation

◆ PAWS_24DAYS

#define PAWS_24DAYS   2073600

NOTE: flags field is 12 bits 24 days in seconds

Definition at line 229 of file stream-tcp-private.h.

◆ PKT_IS_IN_RIGHT_DIR

#define PKT_IS_IN_RIGHT_DIR (   ssn,
 
)
Value:
PKT_IS_TOSERVER(p) ? (p)->flowflags &= ~FLOW_PKT_TOSERVER \
(p)->flowflags |= FLOW_PKT_TOCLIENT : (p)->flowflags &= ~FLOW_PKT_TOCLIENT \
(p)->flowflags |= FLOW_PKT_TOSERVER : 0)

Definition at line 231 of file stream-tcp-private.h.

◆ SEG_SEQ_RIGHT_EDGE

#define SEG_SEQ_RIGHT_EDGE (   seg)    ((seg)->seq + TCP_SEG_LEN((seg)))

Definition at line 86 of file stream-tcp-private.h.

◆ SEQ_EQ

#define SEQ_EQ (   a,
 
)    ((int32_t)((a) - (b)) == 0)

Definition at line 238 of file stream-tcp-private.h.

◆ SEQ_GEQ

#define SEQ_GEQ (   a,
 
)    ((int32_t)((a) - (b)) >= 0)

Definition at line 242 of file stream-tcp-private.h.

◆ SEQ_GT

#define SEQ_GT (   a,
 
)    ((int32_t)((a) - (b)) > 0)

Definition at line 241 of file stream-tcp-private.h.

◆ SEQ_LEQ

#define SEQ_LEQ (   a,
 
)    ((int32_t)((a) - (b)) <= 0)

Definition at line 240 of file stream-tcp-private.h.

◆ SEQ_LT

#define SEQ_LT (   a,
 
)    ((int32_t)((a) - (b)) < 0)

Definition at line 239 of file stream-tcp-private.h.

◆ STREAM_APP_PROGRESS

#define STREAM_APP_PROGRESS (   stream)    (STREAM_BASE_OFFSET((stream)) + (stream)->app_progress_rel)

Definition at line 133 of file stream-tcp-private.h.

◆ STREAM_BASE_OFFSET

#define STREAM_BASE_OFFSET (   stream)    ((stream)->sb.stream_offset)

Definition at line 132 of file stream-tcp-private.h.

◆ STREAM_HAS_SEEN_DATA

#define STREAM_HAS_SEEN_DATA (   stream)    (!RB_EMPTY(&(stream)->sb.sbb_tree) || (stream)->sb.stream_offset || (stream)->sb.buf_offset)

Definition at line 93 of file stream-tcp-private.h.

◆ STREAM_LOG_PROGRESS

#define STREAM_LOG_PROGRESS (   stream)    (STREAM_BASE_OFFSET((stream)) + (stream)->log_progress_rel)

Definition at line 135 of file stream-tcp-private.h.

◆ STREAM_RAW_PROGRESS

#define STREAM_RAW_PROGRESS (   stream)    (STREAM_BASE_OFFSET((stream)) + (stream)->raw_progress_rel)

Definition at line 134 of file stream-tcp-private.h.

◆ STREAM_RIGHT_EDGE

#define STREAM_RIGHT_EDGE (   stream)    (STREAM_BASE_OFFSET((stream)) + (STREAM_SEQ_RIGHT_EDGE((stream)) - (stream)->base_seq))

Definition at line 91 of file stream-tcp-private.h.

◆ STREAM_SEQ_RIGHT_EDGE

#define STREAM_SEQ_RIGHT_EDGE (   stream)    (stream)->segs_right_edge

Definition at line 90 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_3WHS_CONFIRMED

#define STREAMTCP_FLAG_3WHS_CONFIRMED   0x1000

3WHS confirmed by server – if suri sees 3whs ACK but server doesn't (pkt is lost on the way to server), SYN/ACK is retransmitted. If server sends normal packet we assume 3whs to be completed. Only used for SYN/ACK resend event.

Definition at line 186 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_4WHS

#define STREAMTCP_FLAG_4WHS   0x0080

Flag to indicate we're dealing with 4WHS: SYN, SYN, SYN/ACK, ACK (http://www.breakingpointsystems.com/community/blog/tcp-portals-the-three-way-handshake-is-a-lie)

Definition at line 173 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_APP_LAYER_DISABLED

#define STREAMTCP_FLAG_APP_LAYER_DISABLED   0x2000

App Layer tracking/reassembly is disabled

Definition at line 188 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_ASYNC

#define STREAMTCP_FLAG_ASYNC   0x0040

Flag to indicate that the session is handling asynchronous stream.

Definition at line 170 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_BYPASS

#define STREAMTCP_FLAG_BYPASS   0x4000

Stream can be bypass

Definition at line 190 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_CLIENT_SACKOK

#define STREAMTCP_FLAG_CLIENT_SACKOK   0x0200

Flag to indicate the client (SYN pkt) permits SACK

Definition at line 178 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT

#define STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT   0x0100

Flag to indicate that this session is possible trying to evade the detection (http://www.packetstan.com/2010/06/recently-ive-been-on-campaign-to-make.html)

Definition at line 176 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_MIDSTREAM

#define STREAMTCP_FLAG_MIDSTREAM   0x0001

Flag for mid stream session

Definition at line 159 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED

#define STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED   0x0002

Flag for mid stream established session

Definition at line 161 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_MIDSTREAM_SYNACK

#define STREAMTCP_FLAG_MIDSTREAM_SYNACK   0x0004

Flag for mid session when syn/ack is received

Definition at line 163 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_SACKOK

#define STREAMTCP_FLAG_SACKOK   0x0400

Flag to indicate both sides of the session permit SACK (SYN + SYN/ACK)

Definition at line 180 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_SERVER_WSCALE

#define STREAMTCP_FLAG_SERVER_WSCALE   0x0010

Server supports wscale (even though it can be 0)

Definition at line 167 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_TCP_FAST_OPEN

#define STREAMTCP_FLAG_TCP_FAST_OPEN   0x8000

SSN uses TCP Fast Open

Definition at line 192 of file stream-tcp-private.h.

◆ STREAMTCP_FLAG_TIMESTAMP

#define STREAMTCP_FLAG_TIMESTAMP   0x0008

Flag for TCP Timestamp option

Definition at line 165 of file stream-tcp-private.h.

◆ STREAMTCP_QUEUE_FLAG_SACK

#define STREAMTCP_QUEUE_FLAG_SACK   0x04

Definition at line 36 of file stream-tcp-private.h.

◆ STREAMTCP_QUEUE_FLAG_TS

#define STREAMTCP_QUEUE_FLAG_TS   0x01

Definition at line 34 of file stream-tcp-private.h.

◆ STREAMTCP_QUEUE_FLAG_WS

#define STREAMTCP_QUEUE_FLAG_WS   0x02

Definition at line 35 of file stream-tcp-private.h.

◆ STREAMTCP_SET_RA_BASE_SEQ

#define STREAMTCP_SET_RA_BASE_SEQ (   stream,
  seq 
)
Value:
{ \
do { \
(stream)->base_seq = (seq) + 1; \
} while(0); \
}

Definition at line 244 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED

#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED   BIT_U16(7)

App proto detection completed

Definition at line 214 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED

#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED   BIT_U16(8)

App proto detection skipped

Definition at line 216 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_DEPTH_REACHED

#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED   BIT_U16(3)

Stream has reached it's reassembly depth, all further packets are ignored

Definition at line 205 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_DISABLE_RAW

#define STREAMTCP_STREAM_FLAG_DISABLE_RAW   BIT_U16(10)

Raw reassembly disabled completely

Definition at line 220 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_GAP

#define STREAMTCP_STREAM_FLAG_GAP   BIT_U16(0)

stream is in a gap state

Definition at line 199 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_KEEPALIVE

#define STREAMTCP_STREAM_FLAG_KEEPALIVE   BIT_U16(2)

we received a keep alive

Definition at line 203 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED

#define STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED   BIT_U16(9)

Raw reassembly disabled for new segments

Definition at line 218 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_NOREASSEMBLY

#define STREAMTCP_STREAM_FLAG_NOREASSEMBLY   BIT_U16(1)

Flag to avoid stream reassembly/app layer inspection for the stream

Definition at line 201 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_RST_RECV

#define STREAMTCP_STREAM_FLAG_RST_RECV   BIT_U16(11)

Definition at line 222 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_TIMESTAMP

#define STREAMTCP_STREAM_FLAG_TIMESTAMP   BIT_U16(5)

Stream supports TIMESTAMP – used to set ssn STREAMTCP_FLAG_TIMESTAMP flag.

Definition at line 210 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_TRIGGER_RAW

#define STREAMTCP_STREAM_FLAG_TRIGGER_RAW   BIT_U16(4)

Trigger reassembly next time we need 'raw'

Definition at line 207 of file stream-tcp-private.h.

◆ STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP

#define STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP   BIT_U16(6)

Flag to indicate the zero value of timestamp

Definition at line 212 of file stream-tcp-private.h.

◆ StreamTcpDisableAppLayerReassembly

#define StreamTcpDisableAppLayerReassembly (   ssn)
Value:
do { \
SCLogDebug("setting STREAMTCP_FLAG_APP_LAYER_DISABLED on ssn %p", ssn); \
} while (0);

Definition at line 283 of file stream-tcp-private.h.

◆ StreamTcpIsSetStreamFlagAppProtoDetectionCompleted

#define StreamTcpIsSetStreamFlagAppProtoDetectionCompleted (   stream)    ((stream)->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)

Definition at line 279 of file stream-tcp-private.h.

◆ StreamTcpResetStreamFlagAppProtoDetectionCompleted

#define StreamTcpResetStreamFlagAppProtoDetectionCompleted (   stream)    ((stream)->flags &= ~STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED);

Definition at line 281 of file stream-tcp-private.h.

◆ StreamTcpSetEvent

#define StreamTcpSetEvent (   p,
 
)
Value:
{ \
if ((p)->flags & PKT_STREAM_NO_EVENTS) { \
SCLogDebug("not setting event %d on pkt %p (%"PRIu64"), " \
"stream in known bad condition", (e), p, (p)->pcap_cnt); \
} else { \
SCLogDebug("setting event %d on pkt %p (%"PRIu64")", \
(e), p, (p)->pcap_cnt); \
ENGINE_SET_EVENT((p), (e)); \
} \
}

Definition at line 250 of file stream-tcp-private.h.

◆ StreamTcpSetStreamFlagAppProtoDetectionCompleted

#define StreamTcpSetStreamFlagAppProtoDetectionCompleted (   stream)    ((stream)->flags |= STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)

Definition at line 277 of file stream-tcp-private.h.

◆ TCP_SEG_LEN

#define TCP_SEG_LEN (   seg)    (seg)->payload_len

Definition at line 83 of file stream-tcp-private.h.

◆ TCP_SEG_OFFSET

#define TCP_SEG_OFFSET (   seg)    (seg)->sbseg.stream_offset

Definition at line 84 of file stream-tcp-private.h.

Typedef Documentation

◆ StreamTcpSackRecord

◆ TcpSession

typedef struct TcpSession_ TcpSession

◆ TcpStateQueue

typedef struct TcpStateQueue_ TcpStateQueue

currently only SYN/ACK

◆ TcpStream

typedef struct TcpStream_ TcpStream

Enumeration Type Documentation

◆ anonymous enum

anonymous enum
Enumerator
TCP_NONE 
TCP_LISTEN 
TCP_SYN_SENT 
TCP_SYN_RECV 
TCP_ESTABLISHED 
TCP_FIN_WAIT1 
TCP_FIN_WAIT2 
TCP_TIME_WAIT 
TCP_LAST_ACK 
TCP_CLOSE_WAIT 
TCP_CLOSING 
TCP_CLOSED 

Definition at line 137 of file stream-tcp-private.h.

Function Documentation

◆ RB_ENTRY()

__attribute__::RB_ENTRY ( TcpSegment  )

◆ RB_HEAD() [1/2]

RB_HEAD ( TCPSACK  ,
StreamTcpSackRecord   
)

◆ RB_HEAD() [2/2]

RB_HEAD ( TCPSEG  ,
TcpSegment   
)

◆ RB_PROTOTYPE() [1/2]

RB_PROTOTYPE ( TCPSACK  ,
StreamTcpSackRecord  ,
rb  ,
TcpSackCompare   
)

◆ RB_PROTOTYPE() [2/2]

RB_PROTOTYPE ( TCPSEG  ,
TcpSegment  ,
rb  ,
TcpSegmentCompare   
)

◆ TcpSackCompare()

int TcpSackCompare ( struct StreamTcpSackRecord a,
struct StreamTcpSackRecord b 
)

Definition at line 34 of file stream-tcp-sack.c.

References StreamTcpSackRecord::le, StreamTcpSackRecord::re, SEQ_EQ, SEQ_GT, and SEQ_LT.

◆ TcpSegmentCompare()

int TcpSegmentCompare ( struct TcpSegment a,
struct TcpSegment b 
)

compare function for the Segment tree

Main sort point is the sequence number. When sequence numbers are equal compare payload_len as well. This way the tree is sorted by seq, and in case of duplicate seqs we are sorted small to large.

Definition at line 49 of file stream-tcp-list.c.

References TcpSegment::payload_len, TcpSegment::seq, SEQ_GT, and SEQ_LT.

Variable Documentation

◆ payload_len

◆ res

◆ sbseg

StreamingBufferSegment sbseg

Definition at line 4 of file stream-tcp-private.h.

◆ seq

seq
uint32_t seq
Definition: stream-tcp-private.h:2
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:218
PKT_STREAM_NO_EVENTS
#define PKT_STREAM_NO_EVENTS
Definition: decode.h:1122
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:260
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:219
flags
uint8_t flags
Definition: decode-gre.h:0
STREAMTCP_FLAG_MIDSTREAM_SYNACK
#define STREAMTCP_FLAG_MIDSTREAM_SYNACK
Definition: stream-tcp-private.h:162
STREAMTCP_FLAG_APP_LAYER_DISABLED
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
Definition: stream-tcp-private.h:187