75 static SCMutex segment_pool_memuse_mutex;
76 static uint64_t segment_pool_memuse = 0;
77 static uint64_t segment_pool_memcnt = 0;
89 static int g_tcp_session_dump_enabled = 0;
93 return g_tcp_session_dump_enabled == 1;
98 g_tcp_session_dump_enabled = 1;
116 static void StreamTcpReassembleIncrMemuse(uint64_t size)
129 static void StreamTcpReassembleDecrMemuse(uint64_t size)
134 BUG_ON(presize > UINT_MAX);
143 BUG_ON(postsize > presize);
167 if (
unlikely((g_eps_stream_reassembly_memcap != UINT64_MAX &&
168 g_eps_stream_reassembly_memcap ==
t_pcapcnt))) {
174 if (memcapcopy == 0 ||
175 (uint64_t)((uint64_t)size +
SC_ATOMIC_GET(ra_memuse)) <= memcapcopy)
187 if (size == 0 || (uint64_t)
SC_ATOMIC_GET(ra_memuse) < size) {
211 static void *ReassembleCalloc(
size_t n,
size_t size)
222 StreamTcpReassembleIncrMemuse(n * size);
231 if (size > orig_size) {
244 if (size > orig_size) {
245 StreamTcpReassembleIncrMemuse(size - orig_size);
247 StreamTcpReassembleDecrMemuse(orig_size - size);
255 static void ReassembleFree(
void *ptr,
size_t size)
258 StreamTcpReassembleDecrMemuse(size);
262 static void *TcpSegmentPoolAlloc(
void)
286 "TcpSegmentPcapHdrStorage");
295 "packet header data within "
296 "TcpSegmentPcapHdrStorage");
303 StreamTcpReassembleIncrMemuse(memuse);
311 static int TcpSegmentPoolInit(
void *data,
void *initdata)
329 StreamTcpReassembleIncrMemuse(memuse);
339 segment_pool_memcnt++;
340 SCLogDebug(
"segment_pool_memcnt %"PRIu64
"", segment_pool_memcnt);
344 StreamTcpReassembleIncrMemuse((uint32_t)
sizeof(
TcpSegment));
349 static void TcpSegmentPoolCleanup(
void *ptr)
365 StreamTcpReassembleDecrMemuse((uint32_t)
sizeof(
TcpSegment));
370 segment_pool_memcnt--;
371 SCLogDebug(
"segment_pool_memcnt %"PRIu64
"", segment_pool_memcnt);
408 static inline uint64_t GetAbsLastAck(
const TcpStream *stream)
410 if (STREAM_LASTACK_GT_BASESEQ(stream)) {
421 right_edge =
MIN(GetAbsLastAck(stream), right_edge);
428 uint64_t right_edge = StreamingBufferGetConsecutiveDataRightEdge(&stream->
sb);
430 right_edge =
MIN(GetAbsLastAck(stream), right_edge);
472 static int StreamTcpReassemblyConfig(
bool quiet)
474 uint32_t segment_prealloc = 2048;
477 uint32_t prealloc = 0;
484 segment_prealloc = prealloc;
487 SCLogConfig(
"stream.reassembly \"segment-prealloc\": %u", segment_prealloc);
490 int overlap_diff_data = 0;
491 (void)
SCConfGetBool(
"stream.reassembly.check-overlap-different-data", &overlap_diff_data);
492 if (overlap_diff_data) {
499 uint16_t max_regions = 8;
510 SCLogConfig(
"stream.reassembly \"max-regions\": %u", max_regions);
528 if (StreamTcpReassemblyConfig(quiet) < 0)
550 if (segment_pool_memuse > 0)
551 SCLogDebug(
"segment_pool_memuse %" PRIu64
" segment_pool_memcnt %" PRIu64
"",
552 segment_pool_memuse, segment_pool_memcnt);
573 TcpSegmentPoolInit, NULL,
574 TcpSegmentPoolCleanup, NULL);
576 SCLogDebug(
"pool size %d, thread segment_thread_pool_id %d",
582 SCLogDebug(
"pool size %d, thread segment_thread_pool_id %d",
588 SCLogError(
"failed to setup/expand stream segment pool. Expand stream.reassembly.memcap?");
608 static void StreamTcpReassembleExceptionPolicyStatsIncr(
654 uint32_t
seq, uint32_t size)
672 SCLogDebug(
"segment entirely before base_seq, weird: base %u, seq %u, re %u",
686 SCLogDebug(
"seq + size %u, base %u, seg_depth %"PRIu64
" limit %u", (
seq + size),
691 SCLogDebug(
"STREAMTCP_STREAM_FLAG_DEPTH_REACHED");
695 SCLogDebug(
"NOT STREAMTCP_STREAM_FLAG_DEPTH_REACHED");
698 SCLogDebug(
"full depth not yet reached: %"PRIu64
" <= %"PRIu32,
699 (stream->base_seq_offset + stream->
base_seq + size),
766 SCLogDebug(
"ssn %p: both app and raw reassembly disabled, not reassembling", ssn);
770 uint16_t *urg_offset;
777 const TCPHdr *tcph = PacketGetTCP(p);
781 uint8_t urg_data = 0;
791 if ((*urg_offset) < UINT16_MAX) {
795 if ((*urg_offset) == UINT16_MAX) {
812 (*urg_offset) == UINT16_MAX &&
828 uint32_t size = StreamTcpReassembleCheckDepth(ssn, stream, seg_seq,
payload_len);
829 SCLogDebug(
"ssn %p: check depth returned %"PRIu32, ssn, size);
838 SCLogDebug(
"ssn %p: depth reached, not reassembling", ssn);
876 SCLogDebug(
"StreamTcpReassembleInsertSegment failed");
888 flag |= STREAM_START;
896 flag |= STREAM_MIDSTREAM;
903 if (&ssn->
client == stream) {
904 flag |= STREAM_TOSERVER;
906 flag |= STREAM_TOCLIENT;
909 flag |= STREAM_DEPTH;
920 static bool StreamTcpReassembleRawCheckLimit(
926 #define STREAMTCP_STREAM_FLAG_FLUSH_FLAGS \
927 ( STREAMTCP_STREAM_FLAG_DEPTH_REACHED \
928 | STREAMTCP_STREAM_FLAG_TRIGGER_RAW \
929 | STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED)
933 SCLogDebug(
"reassembling now as STREAMTCP_STREAM_FLAG_DEPTH_REACHED "
934 "is set, so not expecting any new data segments");
937 SCLogDebug(
"reassembling now as STREAMTCP_STREAM_FLAG_TRIGGER_RAW is set");
940 SCLogDebug(
"reassembling now as STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED is set, "
941 "so no new segments will be considered");
945 #undef STREAMTCP_STREAM_FLAG_FLUSH_FLAGS
954 const uint64_t last_ack_abs = GetAbsLastAck(stream);
960 if (chunk_size <= diff) {
963 SCLogDebug(
"%s min chunk len not yet reached: "
964 "last_ack %" PRIu32
", ra_raw_base_seq %" PRIu32
", %" PRIu32
" < "
981 const char *dirstr = NULL;
983 if (direction == STREAM_TOSERVER) {
1007 const uint64_t right_edge =
1009 SCLogDebug(
"%s: app %" PRIu64
" (use: %s), raw %" PRIu64
1010 " (use: %s). Stream right edge: %" PRIu64,
1014 SCLogDebug(
"%s: STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION", dirstr);
1019 const uint64_t right_edge = StreamingBufferGetConsecutiveDataRightEdge(&stream->
sb);
1020 SCLogDebug(
"%s: app %" PRIu64
" (use: %s), raw %" PRIu64
1021 " (use: %s). Stream right edge: %" PRIu64,
1025 SCLogDebug(
"%s: STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION", dirstr);
1030 SCLogDebug(
"%s: STREAM_HAS_UNPROCESSED_SEGMENTS_NONE", dirstr);
1035 static uint64_t GetStreamSize(
TcpStream *stream)
1040 uint64_t last_ack_abs = GetAbsLastAck(stream);
1041 uint64_t last_re = 0;
1047 const uint64_t seg_abs =
1049 if (last_re != 0 && last_re < seg_abs) {
1050 const char *gacked = NULL;
1051 if (last_ack_abs >= seg_abs) {
1052 gacked =
"fully ack'd";
1053 }
else if (last_ack_abs > last_re) {
1054 gacked =
"partly ack'd";
1056 gacked =
"not yet ack'd";
1058 SCLogDebug(
" -> gap of size %" PRIu64
", ack:%s", seg_abs - last_re, gacked);
1061 const char *acked = NULL;
1062 if (last_ack_abs >= seg_abs + (uint64_t)
TCP_SEG_LEN(seg)) {
1063 acked =
"fully ack'd";
1064 }
else if (last_ack_abs > seg_abs) {
1065 acked =
"partly ack'd";
1067 acked =
"not yet ack'd";
1070 SCLogDebug(
"%u -> seg %p seq %u abs %" PRIu64
" size %u abs %" PRIu64
" (%" PRIu64
1089 size = GetStreamSize(&ssn->
client);
1090 size += GetStreamSize(&ssn->
server);
1105 GetAbsLastAck(stream) > (cur_blk->
offset + cur_blk->
len)) {
1120 static bool GetAppBuffer(
const TcpStream *stream,
const uint8_t **data, uint32_t *data_len,
1121 uint64_t
offset,
const bool check_for_gap)
1123 const uint8_t *mydata;
1124 uint32_t mydata_len;
1125 bool gap_ahead =
false;
1133 *data_len = mydata_len;
1152 gap_ahead = check_for_gap && GapAhead(stream, blk);
1156 SCLogDebug(
"gap, want data at offset %"PRIu64
", "
1157 "got data at %"PRIu64
". GAP of size %"PRIu64,
1164 SCLogDebug(
"get data from offset %"PRIu64
". SBB %"PRIu64
"/%u",
1167 SCLogDebug(
"data %p, data_len %u", *data, *data_len);
1169 gap_ahead = check_for_gap && GapAhead(stream, blk);
1188 const uint64_t last_ack_abs = GetAbsLastAck(stream) - (uint64_t)ackadded;
1195 if (last_ack_abs > app_progress) {
1202 "next_seq %u < last_ack %u, but no data in list",
1206 const uint64_t next_seq_abs =
1209 if (blk->
offset > next_seq_abs && blk->
offset < last_ack_abs) {
1212 "next_seq %u < last_ack %u, but ACK'd data beyond gap.",
1219 "last_ack_abs %" PRIu64
" > app_progress %" PRIu64
", "
1220 "but we have no data.",
1221 p->
pcap_cnt, last_ack_abs, app_progress);
1225 "last_ack_abs %"PRIu64
" <= app_progress %"PRIu64,
1226 p->
pcap_cnt, last_ack_abs, app_progress);
1230 static inline uint32_t AdjustToAcked(
const Packet *p,
1232 const uint64_t app_progress,
const uint32_t data_len)
1234 uint32_t adjusted = data_len;
1245 const uint64_t last_ack_abs = GetAbsLastAck(stream);
1249 if (app_progress <= last_ack_abs && app_progress + data_len > last_ack_abs) {
1250 uint32_t check = data_len;
1251 adjusted = (uint32_t)(last_ack_abs - app_progress);
1252 BUG_ON(adjusted > check);
1253 SCLogDebug(
"data len adjusted to %u to make sure only ACK'd "
1254 "data is considered", adjusted);
1271 SCLogDebug(
"app progress %"PRIu64, app_progress);
1273 uint64_t last_ack_abs = GetAbsLastAck(*stream);
1274 SCLogDebug(
"last_ack %u (abs %" PRIu64
"), base_seq %u", (*stream)->last_ack, last_ack_abs,
1275 (*stream)->base_seq);
1277 const uint8_t *mydata;
1278 uint32_t mydata_len;
1279 bool last_was_gap =
false;
1282 const uint8_t
flags = StreamGetAppLayerFlags(ssn, *stream, p);
1283 bool check_for_gap_ahead = ((*stream)->data_required > 0);
1285 GetAppBuffer(*stream, &mydata, &mydata_len, app_progress, check_for_gap_ahead);
1287 if (last_was_gap && mydata_len == 0) {
1290 last_was_gap =
false;
1293 mydata_len = AdjustToAcked(p, ssn, *stream, app_progress, mydata_len);
1295 if (mydata == NULL && mydata_len > 0 && CheckGap(ssn, *stream, p)) {
1296 SCLogDebug(
"sending GAP to app-layer (size: %u)", mydata_len);
1299 StreamGetAppLayerFlags(ssn, *stream, p) | STREAM_GAP, app_update_dir);
1313 if ((*stream)->data_required > 0) {
1314 if ((*stream)->data_required > mydata_len) {
1315 (*stream)->data_required -= mydata_len;
1317 (*stream)->data_required = 0;
1322 if (no_progress_update)
1324 last_was_gap =
true;
1327 }
else if (
flags & STREAM_DEPTH) {
1330 if (mydata == NULL && mydata_len > 0) {
1333 }
else if (mydata == NULL || (mydata_len == 0 && ((
flags & STREAM_EOF) == 0))) {
1346 SCLogDebug(
"stream %p data in buffer %p of len %u and offset %"PRIu64,
1347 *stream, &(*stream)->sb, mydata_len, app_progress);
1351 if (mydata_len < (*stream)->data_required) {
1354 SCLogDebug(
"GAP while expecting more data (expect %u, gap size %u)",
1355 (*stream)->data_required, mydata_len);
1356 (*stream)->app_progress_rel += mydata_len;
1357 (*stream)->data_required -= mydata_len;
1367 (*stream)->data_required = 0;
1372 mydata_len,
flags, app_update_dir);
1378 app_progress = new_app_progress;
1379 if (
flags & STREAM_DEPTH)
1407 SCLogDebug(
"stream no reassembly flag set or app-layer disabled.");
1413 GetSessionSize(ssn, p);
1424 uint8_t stream_flags = StreamGetAppLayerFlags(ssn, stream, p);
1427 tv, ra_ctx, p, p->
flow, ssn, &stream, NULL, 0, stream_flags, app_update_dir);
1435 return ReassembleUpdateAppLayer(
tv, ra_ctx, ssn, &stream, p, app_update_dir);
1441 static int GetRawBuffer(
const TcpStream *stream,
const uint8_t **data, uint32_t *data_len,
1444 const uint8_t *mydata;
1445 uint32_t mydata_len;
1450 uint64_t roffset =
offset;
1458 *data_len = mydata_len;
1459 *data_offset = roffset;
1461 SCLogDebug(
"multiblob %s. Want offset %"PRIu64,
1462 *iter == NULL ?
"starting" :
"continuing",
offset);
1463 if (*iter == NULL) {
1468 if (*iter == NULL) {
1475 SCLogDebug(
"getting multiple blobs. Iter %p, %"PRIu64
"/%u", *iter, (*iter)->offset, (*iter)->len);
1480 if ((*iter)->offset <
offset) {
1481 uint64_t delta =
offset - (*iter)->offset;
1482 if (delta < mydata_len) {
1483 *data = mydata + delta;
1484 *data_len = (uint32_t)(mydata_len - delta);
1495 *data_len = mydata_len;
1496 *data_offset = (*iter)->offset;
1499 *iter = SBB_RB_NEXT(*iter);
1530 const uint64_t segs_re_abs =
1535 if (StreamTcpReassembleRawCheckLimit(ssn, stream, p) == 1) {
1573 }
else if (progress == 0) {
1578 target = GetAbsLastAck(stream);
1588 SCLogDebug(
"p->pcap_cnt %"PRIu64
": progress %"PRIu64
" app %"PRIu64
" raw %"PRIu64
" tcp win %"PRIu32,
1597 SCLogDebug(
"ssn %p: STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED set, "
1598 "now that detect ran also set STREAMTCP_STREAM_FLAG_DISABLE_RAW", ssn);
1645 "packet payload len %u, so chunk_size adjusted to %u", p->
payload_len, chunk_size);
1648 const TCPHdr *tcph = PacketGetTCP(p);
1649 uint64_t packet_leftedge_abs =
1651 uint64_t packet_rightedge_abs = packet_leftedge_abs + p->
payload_len;
1652 SCLogDebug(
"packet_leftedge_abs %"PRIu64
", rightedge %"PRIu64,
1653 packet_leftedge_abs, packet_rightedge_abs);
1655 const uint8_t *mydata = NULL;
1656 uint32_t mydata_len = 0;
1657 uint64_t mydata_offset = 0;
1659 bool return_progress =
false;
1664 return_progress =
true;
1667 SCLogDebug(
"finding our SBB from offset %"PRIu64, packet_leftedge_abs);
1674 mydata_offset = sbb->
offset;
1679 uint64_t mydata_rightedge_abs = mydata_offset + mydata_len;
1680 if ((mydata == NULL || mydata_len == 0) ||
1681 (mydata_offset >= packet_rightedge_abs ||
1682 packet_leftedge_abs >= mydata_rightedge_abs) ||
1683 (packet_leftedge_abs < mydata_offset ||
1684 packet_rightedge_abs > mydata_rightedge_abs))
1689 mydata_offset = packet_leftedge_abs;
1693 SCLogDebug(
"chunk_size %u mydata_len %u", chunk_size, mydata_len);
1694 if (mydata_len > chunk_size) {
1695 uint32_t excess = mydata_len - chunk_size;
1696 SCLogDebug(
"chunk_size %u mydata_len %u excess %u", chunk_size, mydata_len, excess);
1698 if (mydata_rightedge_abs == packet_rightedge_abs) {
1700 mydata_len -= excess;
1701 mydata_offset += excess;
1702 SCLogDebug(
"cutting front of the buffer with %u", excess);
1703 }
else if (mydata_offset == packet_leftedge_abs) {
1704 mydata_len -= excess;
1705 SCLogDebug(
"cutting tail of the buffer with %u", excess);
1708 uint32_t abs_before = (uint32_t)(packet_leftedge_abs - mydata_offset);
1710 uint32_t abs_after = (uint32_t)(mydata_rightedge_abs - packet_rightedge_abs);
1711 uint32_t before = abs_before;
1712 uint32_t after = abs_after;
1713 SCLogDebug(
"before %u after %u", before, after);
1718 if (before >= (chunk_size - p->
payload_len) / 2) {
1720 before = after = (chunk_size - p->
payload_len) / 2;
1729 if (before >= (chunk_size - p->
payload_len) / 2) {
1738 uint32_t skip = abs_before - before;
1740 uint32_t cut = abs_after - after;
1745 mydata_len -= (skip + cut);
1746 mydata_offset += skip;
1752 r = Callback(cb_data, mydata, mydata_len, mydata_offset);
1755 if (return_progress) {
1756 *progress_out = (mydata_offset + mydata_len);
1763 const uint64_t last_ack_abs = GetAbsLastAck(stream);
1764 SCLogDebug(
"last_ack_abs %"PRIu64, last_ack_abs);
1767 if (mydata_offset > last_ack_abs) {
1769 *progress_out = last_ack_abs;
1771 *progress_out = (mydata_offset + mydata_len);
1810 const uint64_t re, uint64_t *progress_out,
bool eof)
1816 uint64_t progress = progress_in;
1821 const uint8_t *mydata;
1822 uint32_t mydata_len;
1823 uint64_t mydata_offset = 0;
1825 GetRawBuffer(stream, &mydata, &mydata_len, &iter, progress, &mydata_offset);
1826 if (mydata_len == 0) {
1832 SCLogDebug(
"raw progress %"PRIu64, progress);
1833 SCLogDebug(
"stream %p data in buffer %p of len %u and offset %"PRIu64,
1834 stream, &stream->
sb, mydata_len, progress);
1839 if (re < progress) {
1844 SCLogDebug(
"re %" PRIu64
", raw_progress %" PRIu64, re, progress);
1845 SCLogDebug(
"raw_progress + mydata_len %" PRIu64
", re %" PRIu64, progress + mydata_len,
1849 if (progress + mydata_len > re) {
1850 uint32_t check = mydata_len;
1851 mydata_len = (uint32_t)(re - progress);
1852 BUG_ON(check < mydata_len);
1853 SCLogDebug(
"data len adjusted to %u to make sure only ACK'd "
1854 "data is considered", mydata_len);
1857 if (mydata_len == 0)
1860 SCLogDebug(
"data %p len %u", mydata, mydata_len);
1863 r = Callback(cb_data, mydata, mydata_len, mydata_offset);
1866 if (mydata_offset == progress) {
1867 SCLogDebug(
"progress %"PRIu64
" increasing with data len %u to %"PRIu64,
1868 progress, mydata_len, progress_in + mydata_len);
1870 progress += mydata_len;
1871 SCLogDebug(
"raw progress now %"PRIu64, progress);
1874 }
else if (mydata_offset > progress && mydata_offset < re) {
1875 SCLogDebug(
"GAP: data is missing from %"PRIu64
" (%u bytes), setting to first data we have: %"PRIu64, progress, (uint32_t)(mydata_offset - progress), mydata_offset);
1877 progress = mydata_offset;
1878 SCLogDebug(
"raw progress now %"PRIu64, progress);
1881 SCLogDebug(
"not increasing progress, data gap => mydata_offset "
1882 "%"PRIu64
" != progress %"PRIu64, mydata_offset, progress);
1885 if (iter == NULL || r == 1)
1889 *progress_out = progress;
1894 void *cb_data,
const uint64_t
offset,
const bool eof)
1898 SCLogDebug(
"app_progress %" PRIu64, app_progress);
1900 uint64_t unused = 0;
1901 return StreamReassembleRawDo(
1902 ssn, stream, Callback, cb_data,
offset, app_progress, &unused, eof);
1907 uint64_t *progress_out,
bool respect_inspect_depth)
1911 return StreamReassembleRawInline(ssn, p, Callback, cb_data, progress_out);
1922 StreamTcpReassembleRawCheckLimit(ssn, stream, p) == 0)
1934 SCLogDebug(
"respect_inspect_depth %s STREAMTCP_STREAM_FLAG_TRIGGER_RAW %s "
1935 "stream->min_inspect_depth %u",
1936 respect_inspect_depth ?
"true" :
"false",
1953 SCLogDebug(
"applied min inspect depth due to STREAMTCP_STREAM_FLAG_TRIGGER_RAW: progress "
1963 const uint64_t last_ack_abs = GetAbsLastAck(stream);
1964 SCLogDebug(
"last_ack_abs %" PRIu64, last_ack_abs);
1966 return StreamReassembleRawDo(ssn, stream, Callback, cb_data, progress, last_ack_abs,
1972 uint64_t *progress_out,
const bool eof)
1978 const uint64_t last_ack_abs = GetAbsLastAck(stream);
1979 SCLogDebug(
"last_ack_abs %" PRIu64, last_ack_abs);
1981 return StreamReassembleRawDo(
1982 ssn, stream, Callback, cb_data, progress_in, last_ack_abs, progress_out, eof);
1990 static int StreamTcpReassembleHandleSegmentUpdateACK (
ThreadVars *
tv,
2007 const TCPHdr *tcph = PacketGetTCP(p);
2009 SCLogDebug(
"ssn %p, stream %p, p %p, p->payload_len %"PRIu16
"",
2039 if (stream == &ssn->
client) {
2040 opposing_stream = &ssn->
server;
2042 opposing_stream = &ssn->
client;
2047 if (StreamTcpReassembleHandleSegmentUpdateACK(
tv, ra_ctx, ssn, opposing_stream, p) != 0) {
2048 SCLogDebug(
"StreamTcpReassembleHandleSegmentUpdateACK error");
2056 if (reversed_before_ack_handling != reversed_after_ack_handling) {
2058 stream = opposing_stream;
2064 SCLogDebug(
"calling StreamTcpReassembleHandleSegmentHandleData");
2067 SCLogDebug(
"StreamTcpReassembleHandleSegmentHandleData error");
2071 StreamTcpReassembleExceptionPolicyStatsIncr(
2079 SCLogDebug(
"ssn %p / stream %p: not calling StreamTcpReassembleHandleSegmentHandleData:"
2080 " p->payload_len %u, STREAMTCP_STREAM_FLAG_NOREASSEMBLY %s",
2090 if ((stream->
flags &
2094 SCLogDebug(
"STREAMTCP_STREAM_FLAG_DEPTH_REACHED, truncate applayer");
2096 SCLogDebug(
"override: direction now UPDATE_DIR_PACKET so we "
2097 "can trigger Truncate");
2105 SCLogDebug(
"inline (%s) or PKT_PSEUDO_STREAM_END (%s)",
2164 if (direction == STREAM_TOSERVER) {
2170 SCLogDebug(
"flagged ssn %p for immediate raw reassembly", ssn);
2181 if (direction == STREAM_TOSERVER) {
2183 SCLogDebug(
"ssn %p: set client.min_inspect_depth to %u", ssn, depth);
2186 SCLogDebug(
"ssn %p: set server.min_inspect_depth to %u", ssn, depth);
2194 #define SET_ISN(stream, setseq) \
2195 (stream)->isn = (setseq); \
2196 (stream)->base_seq = (setseq) + 1
2214 for (; i <
len; i++)
2228 data, data_len) == 0)
2237 #define MISSED_START(isn) \
2238 TcpReassemblyThreadCtx *ra_ctx = NULL; \
2241 memset(&tv, 0, sizeof(tv)); \
2243 StreamTcpUTInit(&ra_ctx); \
2245 StreamTcpUTSetupSession(&ssn); \
2246 StreamTcpUTSetupStream(&ssn.server, (isn)); \
2247 StreamTcpUTSetupStream(&ssn.client, (isn)); \
2249 TcpStream *stream = &ssn.client;
2251 #define MISSED_END \
2252 StreamTcpUTClearSession(&ssn); \
2253 StreamTcpUTDeinit(ra_ctx); \
2256 #define MISSED_STEP(seq, seg, seglen, buf, buflen) \
2257 StreamTcpUTAddPayload(&tv, ra_ctx, &ssn, stream, (seq), (uint8_t *)(seg), (seglen)); \
2258 FAIL_IF(!(VALIDATE(stream, (uint8_t *)(buf), (buflen))));
2260 #define MISSED_ADD_PAYLOAD(seq, seg, seglen) \
2261 StreamTcpUTAddPayload(&tv, ra_ctx, &ssn, stream, (seq), (uint8_t *)(seg), (seglen));
2268 uint64_t last_re = 0;
2272 if (sbb->
offset != last_re) {
2292 uint64_t last_re = 0;
2296 if (sbb->
offset != last_re) {
2302 const uint8_t *buf = NULL;
2303 uint32_t buf_len = 0;
2306 if (
len == buf_len) {
2307 return (memcmp(data, buf,
len) == 0);
2324 static int StreamTcpReassembleTest25 (
void)
2345 static int StreamTcpReassembleTest26 (
void)
2364 static int StreamTcpReassembleTest27 (
void)
2381 static int StreamTcpReassembleTest28 (
void)
2405 static int StreamTcpReassembleTest29 (
void)
2417 static int StreamTcpReassembleTest33(
void)
2426 uint8_t packet[1460] =
"";
2431 memset(&f, 0,
sizeof (
Flow));
2432 memset(&tcph, 0,
sizeof (
TCPHdr));
2437 f.
proto = IPPROTO_TCP;
2440 p->
proto = IPPROTO_TCP;
2478 static int StreamTcpReassembleTest34(
void)
2487 uint8_t packet[1460] =
"";
2491 memset(&f, 0,
sizeof (
Flow));
2492 memset(&tcph, 0,
sizeof (
TCPHdr));
2497 f.
proto = IPPROTO_TCP;
2500 p->
proto = IPPROTO_TCP;
2509 tcph.
th_seq = htonl(857961230);
2515 tcph.
th_seq = htonl(857961534);
2521 tcph.
th_seq = htonl(857963582);
2527 tcph.
th_seq = htonl(857960946);
2547 static int StreamTcpReassembleTest39 (
void)
2557 memset (&f, 0,
sizeof(
Flow));
2559 memset(&stt, 0,
sizeof (stt));
2560 memset(&tcph, 0,
sizeof (
TCPHdr));
2564 f.
proto = IPPROTO_TCP;
2571 tcph.
th_win = htons(5480);
2639 uint8_t request1[] = { 0x47, 0x45, };
2686 uint8_t request2[] = {
2687 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2688 0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
2689 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
2690 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
2691 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
2692 0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
2693 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
2694 0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
2695 0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
2696 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
2697 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
2722 uint8_t response[] = {
2723 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
2724 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2725 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2726 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2727 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2728 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2729 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2730 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2731 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2732 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2733 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2734 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2735 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2736 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2737 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2738 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2739 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2740 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2741 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2742 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2743 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2744 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2745 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2746 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2747 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2748 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2749 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2750 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2751 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2752 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2753 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2754 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2755 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2756 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2757 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2758 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2759 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2760 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2761 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2762 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2763 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2789 tcph.
th_ack = htonl(328);
2815 tcph.
th_seq = htonl(328);
2839 tcph.
th_ack = htonl(328);
2864 tcph.
th_seq = htonl(328);
2889 tcph.
th_ack = htonl(328);
2915 tcph.
th_seq = htonl(328);
2940 tcph.
th_ack = htonl(328);
2966 tcph.
th_ack = htonl(175);
2967 tcph.
th_seq = htonl(328);
2993 tcph.
th_ack = htonl(175);
2994 tcph.
th_seq = htonl(328);
3010 tcph.
th_ack = htonl(328);
3011 tcph.
th_seq = htonl(175);
3031 static int StreamTcpReassembleTest40 (
void)
3038 memset(&tcph, 0,
sizeof (
TCPHdr));
3048 uint8_t httpbuf1[] =
"P";
3049 uint32_t httplen1 =
sizeof(httpbuf1) - 1;
3050 uint8_t httpbuf3[] =
"O";
3051 uint32_t httplen3 =
sizeof(httpbuf3) - 1;
3052 uint8_t httpbuf4[] =
"S";
3053 uint32_t httplen4 =
sizeof(httpbuf4) - 1;
3054 uint8_t httpbuf5[] =
"T \r\n";
3055 uint32_t httplen5 =
sizeof(httpbuf5) - 1;
3057 uint8_t httpbuf2[] =
"HTTP/1.0 200 OK\r\nServer: VictorServer/1.0\r\n\r\n";
3058 uint32_t httplen2 =
sizeof(httpbuf2) - 1;
3065 f =
UTHBuildFlow(AF_INET,
"1.2.3.4",
"1.2.3.5", 200, 220);
3068 f->
proto = IPPROTO_TCP;
3071 tcph.
th_win = htons(5480);
3123 tcph.
th_ack = htonl(100);
3132 tcph.
th_seq = htonl(100);
3143 tcph.
th_ack = htonl(145);
3152 tcph.
th_seq = htonl(145);
3169 static int StreamTcpReassembleTest44(
void)
3173 StreamTcpReassembleIncrMemuse(500);
3175 StreamTcpReassembleDecrMemuse(500);
3190 static int StreamTcpReassembleTest45 (
void)
3195 memset(&
tv, 0,
sizeof(
tv));
3196 uint8_t payload[100] = {0};
3197 uint16_t payload_size = 100;
3228 static int StreamTcpReassembleTest46 (
void)
3234 memset(&
tv, 0,
sizeof(
tv));
3235 uint8_t payload[100] = {0};
3236 uint16_t payload_size = 100;
3249 printf(
"STREAMTCP_STREAM_FLAG_NOREASSEMBLY set: ");
3257 printf(
"STREAMTCP_STREAM_FLAG_NOREASSEMBLY set: ");
3277 static int StreamTcpReassembleTest47 (
void)
3285 memset(&tcph, 0,
sizeof (
TCPHdr));
3292 uint8_t httpbuf1[] =
"GET /EVILSUFF HTTP/1.1\r\n\r\n";
3293 uint32_t httplen1 =
sizeof(httpbuf1) - 1;
3301 f =
UTHBuildFlow(AF_INET,
"1.2.3.4",
"1.2.3.5", 200, 220);
3304 f->
proto = IPPROTO_TCP;
3307 tcph.
th_win = htons(5480);
3314 tcph.
th_ack = htonl(572799782UL);
3326 tcph.
th_seq = htonl(572799782UL);
3345 static int StreamTcpReassembleInlineTest01(
void)
3353 memset(&
tv, 0x00,
sizeof(
tv));
3361 uint8_t payload[] = {
'C',
'C',
'C',
'C',
'C' };
3364 printf(
"couldn't get a packet: ");
3371 printf(
"failed to add segment 1: ");
3375 printf(
"failed to add segment 2: ");
3379 printf(
"failed to add segment 3: ");
3395 static int StreamTcpReassembleInlineTest02(
void)
3403 memset(&
tv, 0x00,
sizeof(
tv));
3411 uint8_t payload[] = {
'C',
'C',
'C',
'C',
'C' };
3414 printf(
"couldn't get a packet: ");
3421 printf(
"failed to add segment 1: ");
3425 printf(
"failed to add segment 2: ");
3429 printf(
"failed to add segment 3: ");
3434 printf(
"failed to add segment 4: ");
3451 static int StreamTcpReassembleInlineTest03(
void)
3459 memset(&
tv, 0x00,
sizeof(
tv));
3469 uint8_t payload[] = {
'C',
'C',
'C',
'C',
'C' };
3472 printf(
"couldn't get a packet: ");
3480 printf(
"failed to add segment 1: ");
3484 printf(
"failed to add segment 2: ");
3488 printf(
"failed to add segment 3: ");
3493 printf(
"failed to add segment 4: ");
3512 static int StreamTcpReassembleInlineTest04(
void)
3520 memset(&
tv, 0x00,
sizeof(
tv));
3530 uint8_t payload[] = {
'C',
'C',
'C',
'C',
'C' };
3533 printf(
"couldn't get a packet: ");
3541 printf(
"failed to add segment 1: ");
3545 printf(
"failed to add segment 2: ");
3549 printf(
"failed to add segment 3: ");
3554 printf(
"failed to add segment 4: ");
3574 static int StreamTcpReassembleInlineTest08(
void)
3578 memset(&
tv, 0x00,
sizeof(
tv));
3590 uint8_t payload[] = {
'C',
'C',
'C',
'C',
'C' };
3622 static int StreamTcpReassembleInlineTest09(
void)
3630 memset(&
tv, 0x00,
sizeof(
tv));
3640 uint8_t payload[] = {
'C',
'C',
'C',
'C',
'C' };
3643 printf(
"couldn't get a packet: ");
3651 printf(
"failed to add segment 1: ");
3655 printf(
"failed to add segment 2: ");
3659 printf(
"failed to add segment 3: ");
3667 printf(
"failed to add segment 4: ");
3689 static int StreamTcpReassembleInlineTest10(
void)
3698 memset(&
tv, 0x00,
sizeof(
tv));
3709 f =
UTHBuildFlow(AF_INET,
"1.1.1.1",
"2.2.2.2", 1024, 80);
3713 f->
proto = IPPROTO_TCP;
3715 uint8_t stream_payload1[] =
"GE";
3716 uint8_t stream_payload2[] =
"T /";
3717 uint8_t stream_payload3[] =
"HTTP/1.0\r\n\r\n";
3719 p =
UTHBuildPacketReal(stream_payload3, 12, IPPROTO_TCP,
"1.1.1.1",
"2.2.2.2", 1024, 80);
3721 printf(
"couldn't get a packet: ");
3729 printf(
"failed to add segment 1: ");
3736 printf(
"StreamTcpReassembleAppLayer failed: ");
3742 printf(
"expected ra_app_base_seq 1, got %u: ", ssn.
client.
base_seq);
3747 printf(
"failed to add segment 2: ");
3751 printf(
"failed to add segment 3: ");
3758 printf(
"StreamTcpReassembleAppLayer failed: ");
3775 static int StreamTcpReassembleInsertTest01(
void)
3782 memset(&
tv, 0x00,
sizeof(
tv));
3790 uint8_t payload[] = {
'C',
'C',
'C',
'C',
'C' };
3812 static int StreamTcpReassembleInsertTest02(
void)
3819 memset(&
tv, 0x00,
sizeof(
tv));
3826 for (i = 2; i < 10; i++) {
3837 printf(
"failed to add segment 1: ");
3842 printf(
"failed to add segment 2: ");
3855 static int StreamTcpReassembleInsertTest03(
void)
3862 memset(&
tv, 0x00,
sizeof(
tv));
3869 printf(
"failed to add segment 2: ");
3874 for (i = 2; i < 10; i++) {
3885 printf(
"failed to add segment 2: ");
3906 UtRegisterTest(
"StreamTcpReassembleTest25 -- Gap at Start Reassembly Test",
3907 StreamTcpReassembleTest25);
3908 UtRegisterTest(
"StreamTcpReassembleTest26 -- Gap at middle Reassembly Test",
3909 StreamTcpReassembleTest26);
3910 UtRegisterTest(
"StreamTcpReassembleTest27 -- Gap at after Reassembly Test",
3911 StreamTcpReassembleTest27);
3912 UtRegisterTest(
"StreamTcpReassembleTest28 -- Gap at Start IDS missed packet Reassembly Test",
3913 StreamTcpReassembleTest28);
3914 UtRegisterTest(
"StreamTcpReassembleTest29 -- Gap at Middle IDS missed packet Reassembly Test",
3915 StreamTcpReassembleTest29);
3917 StreamTcpReassembleTest33);
3919 StreamTcpReassembleTest34);
3921 StreamTcpReassembleTest39);
3923 StreamTcpReassembleTest40);
3925 StreamTcpReassembleTest44);
3927 StreamTcpReassembleTest45);
3929 StreamTcpReassembleTest46);
3930 UtRegisterTest(
"StreamTcpReassembleTest47 -- TCP Sequence Wraparound Test",
3931 StreamTcpReassembleTest47);
3933 UtRegisterTest(
"StreamTcpReassembleInlineTest01 -- inline RAW ra",
3934 StreamTcpReassembleInlineTest01);
3935 UtRegisterTest(
"StreamTcpReassembleInlineTest02 -- inline RAW ra 2",
3936 StreamTcpReassembleInlineTest02);
3937 UtRegisterTest(
"StreamTcpReassembleInlineTest03 -- inline RAW ra 3",
3938 StreamTcpReassembleInlineTest03);
3939 UtRegisterTest(
"StreamTcpReassembleInlineTest04 -- inline RAW ra 4",
3940 StreamTcpReassembleInlineTest04);
3941 UtRegisterTest(
"StreamTcpReassembleInlineTest08 -- inline RAW ra 8 cleanup",
3942 StreamTcpReassembleInlineTest08);
3943 UtRegisterTest(
"StreamTcpReassembleInlineTest09 -- inline RAW ra 9 GAP cleanup",
3944 StreamTcpReassembleInlineTest09);
3946 UtRegisterTest(
"StreamTcpReassembleInlineTest10 -- inline APP ra 10",
3947 StreamTcpReassembleInlineTest10);
3949 UtRegisterTest(
"StreamTcpReassembleInsertTest01 -- insert with overlap",
3950 StreamTcpReassembleInsertTest01);
3951 UtRegisterTest(
"StreamTcpReassembleInsertTest02 -- insert with overlap",
3952 StreamTcpReassembleInsertTest02);
3953 UtRegisterTest(
"StreamTcpReassembleInsertTest03 -- insert with overlap",
3954 StreamTcpReassembleInsertTest03);
3959 StreamTcpReassembleRawRegisterTests();