suricata
stream-tcp-private.h File Reference
#include "tree.h"
#include "decode.h"
#include "util-pool.h"
#include "util-pool-thread.h"
#include "util-streaming-buffer.h"
Include dependency graph for stream-tcp-private.h:

Go to the source code of this file.

Data Structures

struct  TcpStateQueue_
 
struct  StreamTcpSackRecord
 
struct  TcpSegment
 
struct  TcpStream_
 
struct  TcpSession_
 

Macros

#define STREAMTCP_QUEUE_FLAG_TS   0x01
 
#define STREAMTCP_QUEUE_FLAG_WS   0x02
 
#define STREAMTCP_QUEUE_FLAG_SACK   0x04
 
#define TCP_SEG_LEN(seg)   (seg)->payload_len
 
#define TCP_SEG_OFFSET(seg)   (seg)->sbseg.stream_offset
 
#define SEG_SEQ_RIGHT_EDGE(seg)   ((seg)->seq + TCP_SEG_LEN((seg)))
 
#define STREAM_SEQ_RIGHT_EDGE(stream)   (stream)->segs_right_edge
 
#define STREAM_RIGHT_EDGE(stream)   (STREAM_BASE_OFFSET((stream)) + (STREAM_SEQ_RIGHT_EDGE((stream)) - (stream)->base_seq))
 
#define STREAM_HAS_SEEN_DATA(stream)   (!RB_EMPTY(&(stream)->sb.sbb_tree) || (stream)->sb.stream_offset)
 
#define STREAM_BASE_OFFSET(stream)   ((stream)->sb.stream_offset)
 
#define STREAM_APP_PROGRESS(stream)   (STREAM_BASE_OFFSET((stream)) + (stream)->app_progress_rel)
 
#define STREAM_RAW_PROGRESS(stream)   (STREAM_BASE_OFFSET((stream)) + (stream)->raw_progress_rel)
 
#define STREAM_LOG_PROGRESS(stream)   (STREAM_BASE_OFFSET((stream)) + (stream)->log_progress_rel)
 
#define STREAMTCP_FLAG_MIDSTREAM   0x0001
 
#define STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED   0x0002
 
#define STREAMTCP_FLAG_MIDSTREAM_SYNACK   0x0004
 
#define STREAMTCP_FLAG_TIMESTAMP   0x0008
 
#define STREAMTCP_FLAG_SERVER_WSCALE   0x0010
 
#define STREAMTCP_FLAG_ASYNC   0x0040
 
#define STREAMTCP_FLAG_4WHS   0x0080
 
#define STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT   0x0100
 
#define STREAMTCP_FLAG_CLIENT_SACKOK   0x0200
 
#define STREAMTCP_FLAG_SACKOK   0x0400
 
#define STREAMTCP_FLAG_3WHS_CONFIRMED   0x1000
 
#define STREAMTCP_FLAG_APP_LAYER_DISABLED   0x2000
 
#define STREAMTCP_FLAG_BYPASS   0x4000
 
#define STREAMTCP_STREAM_FLAG_GAP   0x0001
 
#define STREAMTCP_STREAM_FLAG_NOREASSEMBLY   0x0002
 
#define STREAMTCP_STREAM_FLAG_KEEPALIVE   0x0004
 
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED   0x0008
 
#define STREAMTCP_STREAM_FLAG_TRIGGER_RAW   0x0010
 
#define STREAMTCP_STREAM_FLAG_TIMESTAMP   0x0020
 
#define STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP   0x0040
 
#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED   0x0080
 
#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED   0x0100
 
#define STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED   0x0200
 
#define STREAMTCP_STREAM_FLAG_DISABLE_RAW   0x400
 
#define STREAMTCP_STREAM_FLAG_RST_RECV   0x800
 
#define PAWS_24DAYS   2073600
 
#define PKT_IS_IN_RIGHT_DIR(ssn, p)
 
#define SEQ_EQ(a, b)   ((int32_t)((a) - (b)) == 0)
 
#define SEQ_LT(a, b)   ((int32_t)((a) - (b)) < 0)
 
#define SEQ_LEQ(a, b)   ((int32_t)((a) - (b)) <= 0)
 
#define SEQ_GT(a, b)   ((int32_t)((a) - (b)) > 0)
 
#define SEQ_GEQ(a, b)   ((int32_t)((a) - (b)) >= 0)
 
#define STREAMTCP_SET_RA_BASE_SEQ(stream, seq)
 
#define StreamTcpSetEvent(p, e)
 
#define StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream)   ((stream)->flags |= STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)
 
#define StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)   ((stream)->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)
 
#define StreamTcpResetStreamFlagAppProtoDetectionCompleted(stream)   ((stream)->flags &= ~STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED);
 
#define StreamTcpDisableAppLayerReassembly(ssn)
 

Typedefs

typedef struct TcpStateQueue_ TcpStateQueue
 
typedef struct StreamTcpSackRecord StreamTcpSackRecord
 
typedef struct TcpStream_ TcpStream
 
typedef struct TcpSession_ TcpSession
 

Enumerations

enum  {
  TCP_NONE, TCP_LISTEN, TCP_SYN_SENT, TCP_SYN_RECV,
  TCP_ESTABLISHED, TCP_FIN_WAIT1, TCP_FIN_WAIT2, TCP_TIME_WAIT,
  TCP_LAST_ACK, TCP_CLOSE_WAIT, TCP_CLOSING, TCP_CLOSED
}
 

Functions

int TcpSackCompare (struct StreamTcpSackRecord *a, struct StreamTcpSackRecord *b)
 
 RB_HEAD (TCPSACK, StreamTcpSackRecord)
 
 RB_PROTOTYPE (TCPSACK, StreamTcpSackRecord, rb, TcpSackCompare)
 
struct TcpSegment __attribute__ ((__packed__)) TcpSegment
 DNP3 link header. More...
 
 RB_ENTRY (TcpSegment) __attribute__((__packed__)) rb
 
int TcpSegmentCompare (struct TcpSegment *a, struct TcpSegment *b)
 compare function for the Segment tree More...
 
 RB_HEAD (TCPSEG, TcpSegment)
 
 RB_PROTOTYPE (TCPSEG, TcpSegment, rb, TcpSegmentCompare)
 

Variables

PoolThreadReserved res
 
uint16_t payload_len
 
uint32_t seq
 
StreamingBufferSegment sbseg
 

Detailed Description

Macro Definition Documentation

#define PAWS_24DAYS   2073600

NOTE: flags field is 12 bits 24 days in seconds

Definition at line 225 of file stream-tcp-private.h.

Referenced by StreamTcpThreadDeinit().

#define PKT_IS_IN_RIGHT_DIR (   ssn,
 
)
Value:
PKT_IS_TOSERVER(p) ? (p)->flowflags &= ~FLOW_PKT_TOSERVER \
(p)->flowflags |= FLOW_PKT_TOCLIENT : (p)->flowflags &= ~FLOW_PKT_TOCLIENT \
(p)->flowflags |= FLOW_PKT_TOSERVER : 0)
uint16_t flags
#define PKT_IS_TOSERVER(p)
Definition: decode.h:256
#define FLOW_PKT_TOSERVER
Definition: flow.h:193
#define STREAMTCP_FLAG_MIDSTREAM_SYNACK
#define FLOW_PKT_TOCLIENT
Definition: flow.h:194

Definition at line 227 of file stream-tcp-private.h.

#define SEG_SEQ_RIGHT_EDGE (   seg)    ((seg)->seq + TCP_SEG_LEN((seg)))

Definition at line 85 of file stream-tcp-private.h.

Referenced by TcpSegmentCompare().

#define SEQ_EQ (   a,
 
)    ((int32_t)((a) - (b)) == 0)
#define SEQ_GEQ (   a,
 
)    ((int32_t)((a) - (b)) >= 0)
#define SEQ_LEQ (   a,
 
)    ((int32_t)((a) - (b)) <= 0)
#define STREAM_APP_PROGRESS (   stream)    (STREAM_BASE_OFFSET((stream)) + (stream)->app_progress_rel)
#define STREAM_HAS_SEEN_DATA (   stream)    (!RB_EMPTY(&(stream)->sb.sbb_tree) || (stream)->sb.stream_offset)

Definition at line 92 of file stream-tcp-private.h.

Referenced by StreamTcpReassembleAppLayer().

#define STREAM_LOG_PROGRESS (   stream)    (STREAM_BASE_OFFSET((stream)) + (stream)->log_progress_rel)

Definition at line 133 of file stream-tcp-private.h.

Referenced by StreamTcpReassembleInsertSegment().

#define STREAM_RIGHT_EDGE (   stream)    (STREAM_BASE_OFFSET((stream)) + (STREAM_SEQ_RIGHT_EDGE((stream)) - (stream)->base_seq))

Definition at line 90 of file stream-tcp-private.h.

Referenced by StreamTcpReassembleAppLayer().

#define STREAM_SEQ_RIGHT_EDGE (   stream)    (stream)->segs_right_edge

Definition at line 89 of file stream-tcp-private.h.

#define STREAMTCP_FLAG_3WHS_CONFIRMED   0x1000

3WHS confirmed by server – if suri sees 3whs ACK but server doesn't (pkt is lost on the way to server), SYN/ACK is retransmitted. If server sends normal packet we assume 3whs to be completed. Only used for SYN/ACK resend event.

Definition at line 184 of file stream-tcp-private.h.

#define STREAMTCP_FLAG_4WHS   0x0080

Flag to indicate we're dealing with 4WHS: SYN, SYN, SYN/ACK, ACK (http://www.breakingpointsystems.com/community/blog/tcp-portals-the-three-way-handshake-is-a-lie)

Definition at line 171 of file stream-tcp-private.h.

#define STREAMTCP_FLAG_ASYNC   0x0040

Flag to indicate that the session is handling asynchronous stream.

Definition at line 168 of file stream-tcp-private.h.

Referenced by StreamTcpPacket(), and StreamTcpThreadDeinit().

#define STREAMTCP_FLAG_BYPASS   0x4000

Stream can be bypass

Definition at line 188 of file stream-tcp-private.h.

Referenced by StreamTcpPacket(), and StreamTcpSetSessionBypassFlag().

#define STREAMTCP_FLAG_CLIENT_SACKOK   0x0200

Flag to indicate the client (SYN pkt) permits SACK

Definition at line 176 of file stream-tcp-private.h.

#define STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT   0x0100

Flag to indicate that this session is possible trying to evade the detection (http://www.packetstan.com/2010/06/recently-ive-been-on-campaign-to-make.html)

Definition at line 174 of file stream-tcp-private.h.

#define STREAMTCP_FLAG_MIDSTREAM   0x0001

Flag for mid stream session

Definition at line 157 of file stream-tcp-private.h.

Referenced by AppLayerIncTxCounter(), StreamTcpReassembleHandleSegmentHandleData(), and StreamTcpThreadDeinit().

#define STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED   0x0002

Flag for mid stream established session

Definition at line 159 of file stream-tcp-private.h.

#define STREAMTCP_FLAG_MIDSTREAM_SYNACK   0x0004

Flag for mid session when syn/ack is received

Definition at line 161 of file stream-tcp-private.h.

Referenced by AppLayerIncTxCounter(), and StreamTcpPacket().

#define STREAMTCP_FLAG_SACKOK   0x0400

Flag to indicate both sides of the session permit SACK (SYN + SYN/ACK)

Definition at line 178 of file stream-tcp-private.h.

#define STREAMTCP_FLAG_SERVER_WSCALE   0x0010

Server supports wscale (even though it can be 0)

Definition at line 165 of file stream-tcp-private.h.

#define STREAMTCP_FLAG_TIMESTAMP   0x0008

Flag for TCP Timestamp option

Definition at line 163 of file stream-tcp-private.h.

Referenced by StreamTcpThreadDeinit().

#define STREAMTCP_QUEUE_FLAG_SACK   0x04

Definition at line 35 of file stream-tcp-private.h.

#define STREAMTCP_QUEUE_FLAG_TS   0x01

Definition at line 33 of file stream-tcp-private.h.

#define STREAMTCP_QUEUE_FLAG_WS   0x02

Definition at line 34 of file stream-tcp-private.h.

#define STREAMTCP_SET_RA_BASE_SEQ (   stream,
  seq 
)
Value:
{ \
do { \
(stream)->base_seq = (seq) + 1; \
} while(0); \
}
uint32_t seq

Definition at line 240 of file stream-tcp-private.h.

Referenced by StreamTcpUTSetupStream().

#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED   0x0080

App proto detection completed

Definition at line 210 of file stream-tcp-private.h.

Referenced by StreamTcpReassembleHandleSegmentHandleData().

#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED   0x0100

App proto detection skipped

Definition at line 212 of file stream-tcp-private.h.

Referenced by StreamTcpReassembleHandleSegmentHandleData().

#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED   0x0008
#define STREAMTCP_STREAM_FLAG_GAP   0x0001
#define STREAMTCP_STREAM_FLAG_KEEPALIVE   0x0004

we received a keep alive

Definition at line 199 of file stream-tcp-private.h.

#define STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED   0x0200
#define STREAMTCP_STREAM_FLAG_RST_RECV   0x800

Definition at line 218 of file stream-tcp-private.h.

#define STREAMTCP_STREAM_FLAG_TIMESTAMP   0x0020

Stream supports TIMESTAMP – used to set ssn STREAMTCP_FLAG_TIMESTAMP flag.

Definition at line 206 of file stream-tcp-private.h.

#define STREAMTCP_STREAM_FLAG_TRIGGER_RAW   0x0010
#define STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP   0x0040

Flag to indicate the zero value of timestamp

Definition at line 208 of file stream-tcp-private.h.

Referenced by StreamTcpThreadDeinit().

#define StreamTcpDisableAppLayerReassembly (   ssn)
Value:
do { \
SCLogDebug("setting STREAMTCP_FLAG_APP_LAYER_DISABLED on ssn %p", ssn); \
} while (0);
uint16_t flags
#define SCLogDebug(...)
Definition: util-debug.h:335
#define STREAMTCP_FLAG_APP_LAYER_DISABLED

Definition at line 279 of file stream-tcp-private.h.

Referenced by StreamTcpDisableAppLayer().

#define StreamTcpIsSetStreamFlagAppProtoDetectionCompleted (   stream)    ((stream)->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)
#define StreamTcpResetStreamFlagAppProtoDetectionCompleted (   stream)    ((stream)->flags &= ~STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED);

Definition at line 277 of file stream-tcp-private.h.

Referenced by AppLayerIncTxCounter().

#define StreamTcpSetEvent (   p,
 
)
Value:
{ \
SCLogDebug("not setting event %"PRIu8" on pkt %p (%"PRIu64"), " \
"stream in known bad condition", (e), p, (p)->pcap_cnt); \
} else { \
SCLogDebug("setting event %"PRIu8" on pkt %p (%"PRIu64")", \
(e), p, (p)->pcap_cnt); \
ENGINE_SET_EVENT((p), (e)); \
} \
}
uint16_t flags
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:1000
#define SCLogDebug(...)
Definition: util-debug.h:335
#define PKT_STREAM_NO_EVENTS
Definition: decode.h:1137

Definition at line 246 of file stream-tcp-private.h.

Referenced by StreamNeedsReassembly(), StreamTcpPacket(), StreamTcpReassembleHandleSegmentHandleData(), StreamTcpThreadDeinit(), and TcpSegmentCompare().

#define StreamTcpSetStreamFlagAppProtoDetectionCompleted (   stream)    ((stream)->flags |= STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)
#define TCP_SEG_OFFSET (   seg)    (seg)->sbseg.stream_offset

Definition at line 83 of file stream-tcp-private.h.

Referenced by StreamTcpReassembleInsertSegment().

Typedef Documentation

typedef struct TcpSession_ TcpSession
typedef struct TcpStateQueue_ TcpStateQueue

currently only SYN/ACK

typedef struct TcpStream_ TcpStream

Enumeration Type Documentation

anonymous enum
Enumerator
TCP_NONE 
TCP_LISTEN 
TCP_SYN_SENT 
TCP_SYN_RECV 
TCP_ESTABLISHED 
TCP_FIN_WAIT1 
TCP_FIN_WAIT2 
TCP_TIME_WAIT 
TCP_LAST_ACK 
TCP_CLOSE_WAIT 
TCP_CLOSING 
TCP_CLOSED 

Definition at line 136 of file stream-tcp-private.h.

Function Documentation

__attribute__::RB_ENTRY ( TcpSegment  )
RB_HEAD ( TCPSACK  ,
StreamTcpSackRecord   
)
RB_HEAD ( TCPSEG  ,
TcpSegment   
)
RB_PROTOTYPE ( TCPSACK  ,
StreamTcpSackRecord  ,
rb  ,
TcpSackCompare   
)
RB_PROTOTYPE ( TCPSEG  ,
TcpSegment  ,
rb  ,
TcpSegmentCompare   
)
int TcpSegmentCompare ( struct TcpSegment a,
struct TcpSegment b 
)

Variable Documentation

Definition at line 60 of file stream-tcp-private.h.

Referenced by ActionInitConfig(), DetectAddressMapFree(), DetectBufferTypeGetByIdTransforms(), DetectBufferTypeMaxId(), DetectByteExtractDoMatch(), DetectBytejumpDoMatch(), DetectBytetestDoMatch(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDetectionFilterRegister(), DetectDsizeRegister(), DetectEngineEventRegister(), DetectFastPatternRegister(), DetectFilesizeRegister(), DetectFilestorePostMatch(), DetectFlagsRegister(), DetectFlowintMatch(), DetectFlowMatch(), DetectFlowvarMatch(), DetectFragBitsRegister(), DetectFragOffsetRegister(), DetectFtpdataRegister(), DetectIcmpIdRegister(), DetectIcmpSeqRegister(), DetectIdRegister(), DetectIPProtoRegister(), DetectIPRepRegister(), DetectIsdataatRegister(), DetectMarkRegister(), DetectNfsProcedureRegister(), DetectNfsVersionRegister(), DetectPcrePayloadMatch(), DetectPktvarRegister(), DetectReferenceFree(), DetectRpcRegister(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectSslStateRegister(), DetectSslVersionRegister(), DetectStreamSizeRegister(), DetectTagRegister(), DetectTargetRegister(), DetectTemplate2Register(), DetectThresholdRegister(), DetectTlsRegister(), DetectTlsValidityRegister(), DetectTlsVersionRegister(), DetectTosRegister(), DetectTtlRegister(), DetectUrilenRegister(), DetectUrilenValidateContent(), DetectWindowRegister(), DetectXbitsRegister(), MimeDecAddEntity(), PacketAlertFinalize(), ParseSizeDeinit(), RegisterDNSUDPParsers(), RegisterNFSTCPParsers(), SBB_RB_FIND_INCLUSIVE(), StreamingBufferFree(), StreamTcpReassembleInsertSegment(), TcpSackCompare(), TcpSegmentCompare(), and UTHCheckPacketMatchResults().

StreamingBufferSegment sbseg

Definition at line 64 of file stream-tcp-private.h.