suricata
stream-tcp-reassemble.h File Reference
#include "stream-tcp-private.h"
#include "stream.h"
#include "app-layer-detect-proto.h"
Include dependency graph for stream-tcp-reassemble.h:

Go to the source code of this file.

Data Structures

struct  TcpReassemblyThreadCtx_
 

Macros

#define OS_POLICY_DEFAULT   OS_POLICY_BSD
 

Typedefs

typedef struct TcpReassemblyThreadCtx_ TcpReassemblyThreadCtx
 

Enumerations

enum  {
  OS_POLICY_NONE = 1, OS_POLICY_BSD, OS_POLICY_BSD_RIGHT, OS_POLICY_OLD_LINUX,
  OS_POLICY_LINUX, OS_POLICY_OLD_SOLARIS, OS_POLICY_SOLARIS, OS_POLICY_HPUX10,
  OS_POLICY_HPUX11, OS_POLICY_IRIX, OS_POLICY_MACOS, OS_POLICY_WINDOWS,
  OS_POLICY_VISTA, OS_POLICY_WINDOWS2K3, OS_POLICY_FIRST, OS_POLICY_LAST
}
 
enum  StreamUpdateDir { UPDATE_DIR_PACKET, UPDATE_DIR_OPPOSING, UPDATE_DIR_BOTH }
 

Functions

void StreamTcpReassembleInitMemuse (void)
 
int StreamTcpReassembleHandleSegment (ThreadVars *, TcpReassemblyThreadCtx *, TcpSession *, TcpStream *, Packet *, PacketQueueNoLock *)
 
int StreamTcpReassembleInit (char)
 
void StreamTcpReassembleFree (char)
 
void StreamTcpReassembleRegisterTests (void)
 The Function Register the Unit tests to test the reassembly engine for various OS policies. More...
 
TcpReassemblyThreadCtxStreamTcpReassembleInitThreadCtx (ThreadVars *tv)
 
void StreamTcpReassembleFreeThreadCtx (TcpReassemblyThreadCtx *)
 
int StreamTcpReassembleAppLayer (ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p, enum StreamUpdateDir dir)
 Update the stream reassembly upon receiving a packet. More...
 
void StreamTcpCreateTestPacket (uint8_t *, uint8_t, uint8_t, uint8_t)
 The Function to create the packet with given payload, which is used to test the reassembly of the engine. More...
 
void StreamTcpSetSessionNoReassemblyFlag (TcpSession *, char)
 disable reassembly More...
 
void StreamTcpSetSessionBypassFlag (TcpSession *)
 enable bypass More...
 
void StreamTcpSetDisableRawReassemblyFlag (TcpSession *, char)
 Set the No reassembly flag for the given direction in given TCP session. More...
 
void StreamTcpSetOSPolicy (TcpStream *, Packet *)
 Function to set the OS policy for the given stream based on the destination of the received packet. More...
 
int StreamTcpReassembleHandleSegmentHandleData (ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p)
 Insert a packets TCP data into the stream reassembly engine. More...
 
int StreamTcpReassembleInsertSegment (ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, TcpSegment *, Packet *, uint32_t pkt_seq, uint8_t *pkt_data, uint16_t pkt_datalen)
 
TcpSegmentStreamTcpGetSegment (ThreadVars *, TcpReassemblyThreadCtx *)
 get a segment from the pool More...
 
void StreamTcpReturnStreamSegments (TcpStream *)
 return all segments in this stream into the pool(s) More...
 
void StreamTcpSegmentReturntoPool (TcpSegment *)
 Function to return the segment back to the pool. More...
 
void StreamTcpReassembleTriggerRawReassembly (TcpSession *, int direction)
 Trigger RAW stream reassembly. More...
 
void StreamTcpPruneSession (Flow *, uint8_t)
 Remove idle TcpSegments from TcpSession. More...
 
int StreamTcpReassembleDepthReached (Packet *p)
 check if stream in pkt direction has depth reached More...
 
void StreamTcpReassembleIncrMemuse (uint64_t size)
 Function to Increment the memory usage counter for the TCP reassembly segments. More...
 
void StreamTcpReassembleDecrMemuse (uint64_t size)
 Function to Decrease the memory usage counter for the TCP reassembly segments. More...
 
int StreamTcpReassembleSetMemcap (uint64_t size)
 Update memcap value. More...
 
uint64_t StreamTcpReassembleGetMemcap (void)
 Return memcap value. More...
 
int StreamTcpReassembleCheckMemcap (uint64_t size)
 Function to Check the reassembly memory usage counter against the allowed max memory usgae for TCP segments. More...
 
uint64_t StreamTcpReassembleMemuseGlobalCounter (void)
 
void StreamTcpDisableAppLayer (Flow *f)
 
int StreamTcpAppLayerIsDisabled (Flow *f)
 
int StreamTcpCheckStreamContents (uint8_t *, uint16_t, TcpStream *)
 The Function Checks the reassembled stream contents against predefined stream contents according to OS policy used. More...
 
bool StreamReassembleRawHasDataReady (TcpSession *ssn, Packet *p)
 does the stream engine have data to inspect? More...
 
void StreamTcpReassemblySetMinInspectDepth (TcpSession *ssn, int direction, uint32_t depth)
 

Detailed Description

Macro Definition Documentation

◆ OS_POLICY_DEFAULT

#define OS_POLICY_DEFAULT   OS_POLICY_BSD

Definition at line 83 of file stream-tcp-reassemble.h.

Typedef Documentation

◆ TcpReassemblyThreadCtx

Enumeration Type Documentation

◆ anonymous enum

anonymous enum

Supported OS list and default OS policy is BSD

Enumerator
OS_POLICY_NONE 
OS_POLICY_BSD 
OS_POLICY_BSD_RIGHT 
OS_POLICY_OLD_LINUX 
OS_POLICY_LINUX 
OS_POLICY_OLD_SOLARIS 
OS_POLICY_SOLARIS 
OS_POLICY_HPUX10 
OS_POLICY_HPUX11 
OS_POLICY_IRIX 
OS_POLICY_MACOS 
OS_POLICY_WINDOWS 
OS_POLICY_VISTA 
OS_POLICY_WINDOWS2K3 
OS_POLICY_FIRST 
OS_POLICY_LAST 

Definition at line 34 of file stream-tcp-reassemble.h.

◆ StreamUpdateDir

Enumerator
UPDATE_DIR_PACKET 
UPDATE_DIR_OPPOSING 
UPDATE_DIR_BOTH 

Definition at line 54 of file stream-tcp-reassemble.h.

Function Documentation

◆ StreamReassembleRawHasDataReady()

bool StreamReassembleRawHasDataReady ( TcpSession ssn,
Packet p 
)

does the stream engine have data to inspect?

Returns true if there is data to inspect. In IDS case this is about ACK'd data in the packet's direction.

In the IPS case this is about the packet itself.

Definition at line 1231 of file stream-tcp-reassemble.c.

References StreamingBuffer_::buf_offset, TcpSession_::client, FALSE, TcpStream_::flags, PKT_IS_TOSERVER, RB_EMPTY, TcpStream_::sb, TcpStream_::seg_tree, TcpSession_::server, STREAM_BASE_OFFSET, STREAM_RAW_PROGRESS, STREAMTCP_STREAM_FLAG_DISABLE_RAW, STREAMTCP_STREAM_FLAG_NOREASSEMBLY, and StreamTcpInlineMode().

Here is the call graph for this function:

◆ StreamTcpAppLayerIsDisabled()

int StreamTcpAppLayerIsDisabled ( Flow f)
Parameters
flocked flow

Definition at line 348 of file stream-tcp-reassemble.c.

References TcpSession_::flags, Flow_::proto, Flow_::protoctx, and STREAMTCP_FLAG_APP_LAYER_DISABLED.

◆ StreamTcpCheckStreamContents()

int StreamTcpCheckStreamContents ( uint8_t *  stream_policy,
uint16_t  sp_size,
TcpStream stream 
)

The Function Checks the reassembled stream contents against predefined stream contents according to OS policy used.

Parameters
stream_policyPredefined value of stream for different OS policies
streamReassembled stream returned from the reassembly functions

Definition at line 1928 of file stream-tcp-reassemble.c.

References TcpStream_::sb, and StreamingBufferCompareRawData().

Here is the call graph for this function:

◆ StreamTcpCreateTestPacket()

void StreamTcpCreateTestPacket ( uint8_t *  payload,
uint8_t  value,
uint8_t  payload_len,
uint8_t  len 
)

The Function to create the packet with given payload, which is used to test the reassembly of the engine.

Parameters
payloadThe variable used to store the payload contents of the current packet.
valueThe value which current payload will have for this packet
payload_lenThe length of the filed payload for current packet.
lenLength of the payload array

Definition at line 1911 of file stream-tcp-reassemble.c.

References len, and payload_len.

◆ StreamTcpDisableAppLayer()

void StreamTcpDisableAppLayer ( Flow f)

◆ StreamTcpGetSegment()

TcpSegment* StreamTcpGetSegment ( ThreadVars tv,
TcpReassemblyThreadCtx ra_ctx 
)

get a segment from the pool

Return values
segSegment from the pool or NULL

Definition at line 1833 of file stream-tcp-reassemble.c.

References PoolThreadGetById().

Referenced by StreamTcpUTAddSegmentWithByte(), and StreamTcpUTAddSegmentWithPayload().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamTcpPruneSession()

void StreamTcpPruneSession ( Flow f,
uint8_t  flags 
)

Remove idle TcpSegments from TcpSession.

Checks app progress and raw progress and progresses them if needed, slides the streaming buffer, then gets rid of excess segments.

Parameters
fflow
flagsdirection flags

Definition at line 801 of file stream-tcp-list.c.

References TcpSession_::client, flags, TcpStream_::flags, TcpSession_::flags, Flow_::protoctx, TcpStream_::sb, SCEnter, SCLogDebug, SCReturn, TcpSession_::server, STREAM_TOCLIENT, STREAM_TOSERVER, StreamingBufferClear(), STREAMTCP_FLAG_APP_LAYER_DISABLED, STREAMTCP_STREAM_FLAG_DEPTH_REACHED, STREAMTCP_STREAM_FLAG_DISABLE_RAW, STREAMTCP_STREAM_FLAG_GAP, STREAMTCP_STREAM_FLAG_NOREASSEMBLY, and StreamTcpReturnStreamSegments().

Here is the call graph for this function:

◆ StreamTcpReassembleAppLayer()

int StreamTcpReassembleAppLayer ( ThreadVars tv,
TcpReassemblyThreadCtx ra_ctx,
TcpSession ssn,
TcpStream stream,
Packet p,
enum StreamUpdateDir  dir 
)

Update the stream reassembly upon receiving a packet.

For IDS mode, the stream is in the opposite direction of the packet, as the ACK-packet is ACK'ing the stream.

One of the utilities call by this function AppLayerHandleTCPData(), has a feature where it will call this very same function for the stream opposing the stream it is called with. This shouldn't cause any issues, since processing of each stream is independent of the other stream.

Definition at line 1118 of file stream-tcp-reassemble.c.

References AppLayerHandleTCPData(), TcpStream_::flags, TcpSession_::flags, Packet_::flags, Packet_::flow, PKT_PSEUDO_STREAM_END, RB_MIN, SCEnter, SCLogDebug, SCReturnInt, TcpStream_::seg_tree, TcpSession_::state, STREAM_APP_PROGRESS, STREAM_HAS_SEEN_DATA, STREAM_RIGHT_EDGE, STREAMTCP_FLAG_APP_LAYER_DISABLED, STREAMTCP_STREAM_FLAG_NOREASSEMBLY, TCP_CLOSING, and tv.

Here is the call graph for this function:

◆ StreamTcpReassembleCheckMemcap()

int StreamTcpReassembleCheckMemcap ( uint64_t  size)

Function to Check the reassembly memory usage counter against the allowed max memory usgae for TCP segments.

Parameters
sizeSize of the TCP segment and its payload length memory allocated
Return values
1if in bounds
0if not in bounds

Definition at line 145 of file stream-tcp-reassemble.c.

References SC_ATOMIC_GET, and stream_config.

◆ StreamTcpReassembleDecrMemuse()

void StreamTcpReassembleDecrMemuse ( uint64_t  size)

Function to Decrease the memory usage counter for the TCP reassembly segments.

Parameters
sizeSize of the TCP segment and its payload length memory allocated

Definition at line 110 of file stream-tcp-reassemble.c.

References BUG_ON, RunmodeIsUnittests(), SC_ATOMIC_GET, SC_ATOMIC_SUB, SCLogDebug, and StreamTcpReassembleMemuseGlobalCounter().

Here is the call graph for this function:

◆ StreamTcpReassembleDepthReached()

int StreamTcpReassembleDepthReached ( Packet p)

check if stream in pkt direction has depth reached

Parameters
ppacket with LOCKED flow
Return values
1stream has depth reached
0stream does not have depth reached

Definition at line 486 of file stream-tcp-reassemble.c.

References TcpSession_::client, TcpStream_::flags, Packet_::flow, FLOW_PKT_TOSERVER, Packet_::flowflags, Flow_::protoctx, TcpSession_::server, and STREAMTCP_STREAM_FLAG_DEPTH_REACHED.

◆ StreamTcpReassembleFree()

void StreamTcpReassembleFree ( char  )

Definition at line 410 of file stream-tcp-reassemble.c.

References SCMutexLock.

Referenced by StreamTcpFreeConfig().

Here is the caller graph for this function:

◆ StreamTcpReassembleFreeThreadCtx()

void StreamTcpReassembleFreeThreadCtx ( TcpReassemblyThreadCtx )

Definition at line 470 of file stream-tcp-reassemble.c.

References TcpReassemblyThreadCtx_::app_tctx, AppLayerDestroyCtxThread(), SCEnter, SCFree, and SCReturn.

Referenced by StreamTcpThreadDeinit(), and StreamTcpUTDeinit().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamTcpReassembleGetMemcap()

uint64_t StreamTcpReassembleGetMemcap ( )

Return memcap value.

Returns
memcap memcap value

Definition at line 174 of file stream-tcp-reassemble.c.

References SC_ATOMIC_GET, and stream_config.

◆ StreamTcpReassembleHandleSegment()

◆ StreamTcpReassembleHandleSegmentHandleData()

int StreamTcpReassembleHandleSegmentHandleData ( ThreadVars tv,
TcpReassemblyThreadCtx ra_ctx,
TcpSession ssn,
TcpStream stream,
Packet p 
)

Insert a packets TCP data into the stream reassembly engine.

Return values
0good segment, as far as we checked.
-1badness, reason to drop in inline mode

If the retval is 0 the segment is inserted correctly, or overlap is handled, or it wasn't added because of reassembly depth.

Definition at line 593 of file stream-tcp-reassemble.c.

References TcpSession_::data_first_seen_dir, TcpStream_::flags, TcpSession_::flags, TcpStream_::os_policy, PKT_IS_TOSERVER, SCEnter, SCLogDebug, SCReturnInt, STREAM_TOCLIENT, STREAM_TOSERVER, STREAMTCP_FLAG_APP_LAYER_DISABLED, STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED, and StreamTcpSetOSPolicy().

Referenced by StreamTcpUTAddPayload().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamTcpReassembleIncrMemuse()

void StreamTcpReassembleIncrMemuse ( uint64_t  size)

Function to Increment the memory usage counter for the TCP reassembly segments.

Parameters
sizeSize of the TCP segment and its payload length memory allocated

Definition at line 97 of file stream-tcp-reassemble.c.

References SC_ATOMIC_ADD, SCLogDebug, and StreamTcpReassembleMemuseGlobalCounter().

Here is the call graph for this function:

◆ StreamTcpReassembleInit()

int StreamTcpReassembleInit ( char  )

Definition at line 394 of file stream-tcp-reassemble.c.

References StreamTcpReassembleInitMemuse().

Here is the call graph for this function:

◆ StreamTcpReassembleInitMemuse()

void StreamTcpReassembleInitMemuse ( void  )

Definition at line 86 of file stream-tcp-reassemble.c.

References SC_ATOMIC_INIT.

Referenced by StreamTcpReassembleInit(), and UtRunTests().

Here is the caller graph for this function:

◆ StreamTcpReassembleInitThreadCtx()

TcpReassemblyThreadCtx* StreamTcpReassembleInitThreadCtx ( ThreadVars tv)

Definition at line 429 of file stream-tcp-reassemble.c.

References TcpReassemblyThreadCtx_::app_tctx, AppLayerGetCtxThread(), SCEnter, SCMalloc, SCMutexLock, tv, and unlikely.

Referenced by StreamTcpThreadInit(), and StreamTcpUTInit().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamTcpReassembleInsertSegment()

int StreamTcpReassembleInsertSegment ( ThreadVars tv,
TcpReassemblyThreadCtx ra_ctx,
TcpStream stream,
TcpSegment seg,
Packet p,
uint32_t  pkt_seq,
uint8_t *  pkt_data,
uint16_t  pkt_datalen 
)
Return values
-1segment not inserted
Parameters
segsegment, this function takes total ownership

In case of error, this function returns the segment to the pool

Definition at line 557 of file stream-tcp-list.c.

References SCEnter.

Referenced by StreamTcpUTAddSegmentWithByte(), and StreamTcpUTAddSegmentWithPayload().

Here is the caller graph for this function:

◆ StreamTcpReassembleMemuseGlobalCounter()

uint64_t StreamTcpReassembleMemuseGlobalCounter ( void  )

Definition at line 131 of file stream-tcp-reassemble.c.

◆ StreamTcpReassembleRegisterTests()

void StreamTcpReassembleRegisterTests ( void  )

The Function Register the Unit tests to test the reassembly engine for various OS policies.

Definition at line 3630 of file stream-tcp-reassemble.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ StreamTcpReassembleSetMemcap()

int StreamTcpReassembleSetMemcap ( uint64_t  size)

Update memcap value.

Parameters
sizenew memcap value

Definition at line 159 of file stream-tcp-reassemble.c.

References SC_ATOMIC_GET, SC_ATOMIC_SET, and stream_config.

◆ StreamTcpReassembleTriggerRawReassembly()

void StreamTcpReassembleTriggerRawReassembly ( TcpSession ssn,
int  direction 
)

Trigger RAW stream reassembly.

Used by AppLayerTriggerRawStreamReassembly to trigger RAW stream reassembly from the applayer, for example upon completion of a HTTP request.

It sets a flag in the stream so that the next Raw call will return the data.

Parameters
ssnTcpSession

Definition at line 1860 of file stream-tcp-reassemble.c.

References BUG_ON, TcpSession_::client, TcpStream_::flags, SCLogDebug, TcpSession_::server, STREAM_TOSERVER, and STREAMTCP_STREAM_FLAG_TRIGGER_RAW.

Referenced by AppLayerParserTriggerRawStreamReassembly().

Here is the caller graph for this function:

◆ StreamTcpReassemblySetMinInspectDepth()

void StreamTcpReassemblySetMinInspectDepth ( TcpSession ssn,
int  direction,
uint32_t  depth 
)

Definition at line 1877 of file stream-tcp-reassemble.c.

References BUG_ON, TcpSession_::client, TcpStream_::min_inspect_depth, SCLogDebug, TcpSession_::server, and STREAM_TOSERVER.

Referenced by SMTPProcessDataChunk().

Here is the caller graph for this function:

◆ StreamTcpReturnStreamSegments()

void StreamTcpReturnStreamSegments ( TcpStream stream)

return all segments in this stream into the pool(s)

Parameters
streamthe stream to cleanup

Definition at line 314 of file stream-tcp-reassemble.c.

◆ StreamTcpSegmentReturntoPool()

void StreamTcpSegmentReturntoPool ( TcpSegment seg)

Function to return the segment back to the pool.

Parameters
segSegment which will be returned back to the pool.

Definition at line 301 of file stream-tcp-reassemble.c.

References PoolThreadReturn().

Referenced by StreamTcpReturnStreamSegments().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamTcpSetDisableRawReassemblyFlag()

void StreamTcpSetDisableRawReassemblyFlag ( TcpSession ssn,
char  direction 
)

Set the No reassembly flag for the given direction in given TCP session.

Parameters
ssnTCP Session to set the flag in
directiondirection to set the flag in: 0 toserver, 1 toclient

Definition at line 5888 of file stream-tcp.c.

References TcpSession_::client, TcpStream_::flags, TcpSession_::server, and STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED.

◆ StreamTcpSetOSPolicy()

void StreamTcpSetOSPolicy ( TcpStream stream,
Packet p 
)

Function to set the OS policy for the given stream based on the destination of the received packet.

Parameters
streamTcpStream of which os_policy needs to set
pPacket which is used to set the os policy

Definition at line 767 of file stream-tcp.c.

References GET_IPV4_DST_ADDR_PTR, GET_IPV6_DST_ADDR, TcpStream_::os_policy, OS_POLICY_BSD, OS_POLICY_BSD_RIGHT, OS_POLICY_DEFAULT, OS_POLICY_OLD_SOLARIS, OS_POLICY_SOLARIS, PKT_IS_IPV4, PKT_IS_IPV6, SCHInfoGetIPv4HostOSFlavour(), SCHInfoGetIPv6HostOSFlavour(), and SCLogDebug.

Referenced by StreamTcpReassembleHandleSegmentHandleData().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamTcpSetSessionBypassFlag()

void StreamTcpSetSessionBypassFlag ( TcpSession ssn)

enable bypass

Parameters
ssnTCP Session to set the flag in
directiondirection to set the flag in: 0 toserver, 1 toclient

Definition at line 5899 of file stream-tcp.c.

References TcpSession_::flags, and STREAMTCP_FLAG_BYPASS.

◆ StreamTcpSetSessionNoReassemblyFlag()

void StreamTcpSetSessionNoReassemblyFlag ( TcpSession ssn,
char  direction 
)

disable reassembly

Disable app layer and set raw inspect to no longer accept new data. Stream engine will then fully disable raw after last inspection.

Parameters
ssnTCP Session to set the flag in
directiondirection to set the flag in: 0 toserver, 1 toclient

Definition at line 5872 of file stream-tcp.c.

References TcpSession_::client, TcpStream_::flags, TcpSession_::flags, TcpSession_::server, STREAMTCP_FLAG_APP_LAYER_DISABLED, and STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED.