suricata
stream-tcp-reassemble.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
23  */
24 
25 #ifndef __STREAM_TCP_REASSEMBLE_H__
26 #define __STREAM_TCP_REASSEMBLE_H__
27 
28 #include "suricata.h"
29 #include "flow.h"
30 #include "stream-tcp-private.h"
31 
32 /** Supported OS list and default OS policy is BSD */
33 enum
34 {
51 };
52 
57 };
58 
59 typedef struct TcpReassemblyThreadCtx_ {
60  void *app_tctx;
61 
63 
64  /** TCP segments which are not being reassembled due to memcap was reached */
66 
69 
70  /** number of streams that stop reassembly because their depth is reached */
72  /** count number of streams with a unrecoverable stream gap (missing pkts) */
74 
75  /** count packet data overlaps */
77  /** count overlaps with different data */
79 
83 
84 #define OS_POLICY_DEFAULT OS_POLICY_BSD
85 
88 int StreamTcpReassembleInit(bool);
89 void StreamTcpReassembleFree(bool);
90 void *StreamTcpReassembleRealloc(void *optr, size_t orig_size, size_t size);
95  TcpSession *ssn, TcpStream *stream,
96  Packet *p, enum StreamUpdateDir dir);
97 
98 void StreamTcpCreateTestPacket(uint8_t *, uint8_t, uint8_t, uint8_t);
99 
103 
105 
107  TcpSession *ssn, TcpStream *stream, Packet *p);
108 int StreamTcpReassembleInsertSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, TcpSegment *, Packet *, uint32_t pkt_seq, uint8_t *pkt_data, uint16_t pkt_datalen);
110 
113 
115 
116 void StreamTcpPruneSession(Flow *, uint8_t);
118 
119 void StreamTcpReassembleIncrMemuse(uint64_t size);
120 void StreamTcpReassembleDecrMemuse(uint64_t size);
121 int StreamTcpReassembleSetMemcap(uint64_t size);
122 uint64_t StreamTcpReassembleGetMemcap(void);
123 int StreamTcpReassembleCheckMemcap(uint64_t size);
125 
128 
129 #ifdef UNITTESTS
130 int StreamTcpCheckStreamContents(uint8_t *, uint16_t , TcpStream *);
131 #endif
132 
134 void StreamTcpReassemblySetMinInspectDepth(TcpSession *ssn, int direction, uint32_t depth);
135 
136 bool IsTcpSessionDumpingEnabled(void);
137 void EnableTcpSessionDumping(void);
138 
139 static inline bool STREAM_LASTACK_GT_BASESEQ(const TcpStream *stream)
140 {
141  /* last ack not yet initialized */
142  if (STREAM_BASE_OFFSET(stream) == 0 && (stream->tcp_flags & TH_ACK) == 0) {
143 #ifdef UNITTESTS
144  if (RunmodeIsUnittests() && stream->last_ack == 0)
145  return false;
146 #else
147  return false;
148 #endif
149  }
150  if (SEQ_GT(stream->last_ack, stream->base_seq))
151  return true;
152  return false;
153 }
154 
156 
157 #endif /* __STREAM_TCP_REASSEMBLE_H__ */
158 
UPDATE_DIR_BOTH
@ UPDATE_DIR_BOTH
Definition: stream-tcp-reassemble.h:56
UPDATE_DIR_PACKET
@ UPDATE_DIR_PACKET
Definition: stream-tcp-reassemble.h:54
OS_POLICY_FIRST
@ OS_POLICY_FIRST
Definition: stream-tcp-reassemble.h:49
TcpStream_
Definition: stream-tcp-private.h:106
EnableTcpSessionDumping
void EnableTcpSessionDumping(void)
Definition: stream-tcp-reassemble.c:94
StreamTcpReassembleRegisterTests
void StreamTcpReassembleRegisterTests(void)
The Function Register the Unit tests to test the reassembly engine for various OS policies.
Definition: stream-tcp-reassemble.c:3768
OS_POLICY_MACOS
@ OS_POLICY_MACOS
Definition: stream-tcp-reassemble.h:45
StreamTcpReassembleInitThreadCtx
TcpReassemblyThreadCtx * StreamTcpReassembleInitThreadCtx(ThreadVars *tv)
Definition: stream-tcp-reassemble.c:525
StreamTcpGetSegment
TcpSegment * StreamTcpGetSegment(ThreadVars *, TcpReassemblyThreadCtx *)
get a segment from the pool
Definition: stream-tcp-reassemble.c:2041
OS_POLICY_OLD_LINUX
@ OS_POLICY_OLD_LINUX
Definition: stream-tcp-reassemble.h:38
StreamTcpSetDisableRawReassemblyFlag
void StreamTcpSetDisableRawReassemblyFlag(TcpSession *, char)
Set the No reassembly flag for the given direction in given TCP session.
Definition: stream-tcp.c:6106
TcpReassemblyThreadCtx_::app_tctx
void * app_tctx
Definition: stream-tcp-reassemble.h:60
StreamDataAvailableForProtoDetect
uint32_t StreamDataAvailableForProtoDetect(TcpStream *stream)
Definition: stream-tcp-reassemble.c:683
OS_POLICY_IRIX
@ OS_POLICY_IRIX
Definition: stream-tcp-reassemble.h:44
StreamTcpSegmentReturntoPool
void StreamTcpSegmentReturntoPool(TcpSegment *)
Function to return the segment back to the pool.
Definition: stream-tcp-reassemble.c:369
Flow_
Flow data structure.
Definition: flow.h:356
TcpReassemblyThreadCtx_::counter_tcp_stream_depth
uint16_t counter_tcp_stream_depth
Definition: stream-tcp-reassemble.h:71
StreamTcpReassembleInit
int StreamTcpReassembleInit(bool)
Definition: stream-tcp-reassemble.c:490
StreamTcpReassembleMemuseGlobalCounter
uint64_t StreamTcpReassembleMemuseGlobalCounter(void)
Definition: stream-tcp-reassemble.c:148
TcpReassemblyThreadCtx_::counter_tcp_reass_overlap
uint16_t counter_tcp_reass_overlap
Definition: stream-tcp-reassemble.h:76
StreamTcpReassembleGetMemcap
uint64_t StreamTcpReassembleGetMemcap(void)
Return memcap value.
Definition: stream-tcp-reassemble.c:198
TcpReassemblyThreadCtx_::counter_tcp_reass_overlap_diff_data
uint16_t counter_tcp_reass_overlap_diff_data
Definition: stream-tcp-reassemble.h:78
StreamTcpDisableAppLayer
void StreamTcpDisableAppLayer(Flow *f)
Definition: stream-tcp-reassemble.c:431
StreamTcpReassembleCheckMemcap
int StreamTcpReassembleCheckMemcap(uint64_t size)
Function to Check the reassembly memory usage counter against the allowed max memory usage for TCP se...
Definition: stream-tcp-reassemble.c:162
StreamTcpReassembleHandleSegment
int StreamTcpReassembleHandleSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpSession *, TcpStream *, Packet *, PacketQueueNoLock *)
Definition: stream-tcp-reassemble.c:1926
PacketQueueNoLock_
simple fifo queue for packets
Definition: packet-queue.h:34
StreamTcpReassembleDepthReached
int StreamTcpReassembleDepthReached(Packet *p)
check if stream in pkt direction has depth reached
Definition: stream-tcp-reassemble.c:586
TcpReassemblyThreadCtx_::counter_tcp_reass_data_normal_fail
uint16_t counter_tcp_reass_data_normal_fail
Definition: stream-tcp-reassemble.h:80
TcpStream_::last_ack
uint32_t last_ack
Definition: stream-tcp-private.h:115
StreamTcpReassembleIncrMemuse
void StreamTcpReassembleIncrMemuse(uint64_t size)
Function to Increment the memory usage counter for the TCP reassembly segments.
Definition: stream-tcp-reassemble.c:114
StreamTcpReassembleFree
void StreamTcpReassembleFree(bool)
Definition: stream-tcp-reassemble.c:506
StreamTcpReassembleHandleSegmentHandleData
int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p)
Insert a packets TCP data into the stream reassembly engine.
Definition: stream-tcp-reassemble.c:707
STREAM_BASE_OFFSET
#define STREAM_BASE_OFFSET(stream)
Definition: stream-tcp-private.h:143
OS_POLICY_BSD
@ OS_POLICY_BSD
Definition: stream-tcp-reassemble.h:36
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
TcpReassemblyThreadCtx
struct TcpReassemblyThreadCtx_ TcpReassemblyThreadCtx
OS_POLICY_NONE
@ OS_POLICY_NONE
Definition: stream-tcp-reassemble.h:35
StreamTcpCreateTestPacket
void StreamTcpCreateTestPacket(uint8_t *, uint8_t, uint8_t, uint8_t)
The Function to create the packet with given payload, which is used to test the reassembly of the eng...
Definition: stream-tcp-reassemble.c:2128
TH_ACK
#define TH_ACK
Definition: decode-tcp.h:38
StreamTcpReassembleDecrMemuse
void StreamTcpReassembleDecrMemuse(uint64_t size)
Function to Decrease the memory usage counter for the TCP reassembly segments.
Definition: stream-tcp-reassemble.c:127
StreamTcpReassembleFreeThreadCtx
void StreamTcpReassembleFreeThreadCtx(TcpReassemblyThreadCtx *)
Definition: stream-tcp-reassemble.c:566
TcpSegment
Definition: stream-tcp-private.h:72
Packet_
Definition: decode.h:425
stream-tcp-private.h
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:232
StreamTcpReassembleAppLayer
int StreamTcpReassembleAppLayer(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p, enum StreamUpdateDir dir)
Update the stream reassembly upon receiving a packet.
Definition: stream-tcp-reassemble.c:1306
TcpReassemblyThreadCtx_::counter_tcp_reass_gap
uint16_t counter_tcp_reass_gap
Definition: stream-tcp-reassemble.h:73
StreamTcpReassembleTriggerRawReassembly
void StreamTcpReassembleTriggerRawReassembly(TcpSession *, int direction)
Trigger RAW stream reassembly.
Definition: stream-tcp-reassemble.c:2077
UPDATE_DIR_OPPOSING
@ UPDATE_DIR_OPPOSING
Definition: stream-tcp-reassemble.h:55
TcpReassemblyThreadCtx_::segment_thread_pool_id
int segment_thread_pool_id
Definition: stream-tcp-reassemble.h:62
OS_POLICY_OLD_SOLARIS
@ OS_POLICY_OLD_SOLARIS
Definition: stream-tcp-reassemble.h:40
IsTcpSessionDumpingEnabled
bool IsTcpSessionDumpingEnabled(void)
Definition: stream-tcp-reassemble.c:89
StreamTcpSetSessionNoReassemblyFlag
void StreamTcpSetSessionNoReassemblyFlag(TcpSession *, char)
disable reassembly
Definition: stream-tcp.c:6090
OS_POLICY_HPUX10
@ OS_POLICY_HPUX10
Definition: stream-tcp-reassemble.h:42
SEQ_GT
#define SEQ_GT(a, b)
Definition: stream-tcp-private.h:252
StreamTcpReturnStreamSegments
void StreamTcpReturnStreamSegments(TcpStream *)
return all segments in this stream into the pool(s)
Definition: stream-tcp-reassemble.c:386
StreamTcpReassembleSetMemcap
int StreamTcpReassembleSetMemcap(uint64_t size)
Update memcap value.
Definition: stream-tcp-reassemble.c:183
TcpStream_::base_seq
uint32_t base_seq
Definition: stream-tcp-private.h:124
StreamReassembleRawHasDataReady
bool StreamReassembleRawHasDataReady(TcpSession *ssn, Packet *p)
does the stream engine have data to inspect?
Definition: stream-tcp-reassemble.c:1419
OS_POLICY_VISTA
@ OS_POLICY_VISTA
Definition: stream-tcp-reassemble.h:47
StreamTcpReassembleInitMemuse
void StreamTcpReassembleInitMemuse(void)
Definition: stream-tcp-reassemble.c:103
StreamTcpReassembleInsertSegment
int StreamTcpReassembleInsertSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, TcpSegment *, Packet *, uint32_t pkt_seq, uint8_t *pkt_data, uint16_t pkt_datalen)
Definition: stream-tcp-list.c:634
OS_POLICY_SOLARIS
@ OS_POLICY_SOLARIS
Definition: stream-tcp-reassemble.h:41
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
OS_POLICY_WINDOWS
@ OS_POLICY_WINDOWS
Definition: stream-tcp-reassemble.h:46
OS_POLICY_LAST
@ OS_POLICY_LAST
Definition: stream-tcp-reassemble.h:50
OS_POLICY_LINUX
@ OS_POLICY_LINUX
Definition: stream-tcp-reassemble.h:39
StreamTcpAppLayerIsDisabled
int StreamTcpAppLayerIsDisabled(Flow *f)
Definition: stream-tcp-reassemble.c:447
StreamTcpSetOSPolicy
void StreamTcpSetOSPolicy(TcpStream *, Packet *)
Function to set the OS policy for the given stream based on the destination of the received packet.
Definition: stream-tcp.c:788
TcpReassemblyThreadCtx_::counter_tcp_reass_data_overlap_fail
uint16_t counter_tcp_reass_data_overlap_fail
Definition: stream-tcp-reassemble.h:81
StreamTcpReassembleRealloc
void * StreamTcpReassembleRealloc(void *optr, size_t orig_size, size_t size)
Definition: stream-tcp-reassemble.c:223
StreamTcpCheckStreamContents
int StreamTcpCheckStreamContents(uint8_t *, uint16_t, TcpStream *)
The Function Checks the reassembled stream contents against predefined stream contents according to O...
Definition: stream-tcp-reassemble.c:2145
OS_POLICY_HPUX11
@ OS_POLICY_HPUX11
Definition: stream-tcp-reassemble.h:43
TcpReassemblyThreadCtx_
Definition: stream-tcp-reassemble.h:59
suricata.h
OS_POLICY_WINDOWS2K3
@ OS_POLICY_WINDOWS2K3
Definition: stream-tcp-reassemble.h:48
StreamTcpPruneSession
void StreamTcpPruneSession(Flow *, uint8_t)
Remove idle TcpSegments from TcpSession.
Definition: stream-tcp-list.c:885
StreamUpdateDir
StreamUpdateDir
Definition: stream-tcp-reassemble.h:53
OS_POLICY_BSD_RIGHT
@ OS_POLICY_BSD_RIGHT
Definition: stream-tcp-reassemble.h:37
TcpReassemblyThreadCtx_::counter_tcp_segment_from_pool
uint16_t counter_tcp_segment_from_pool
Definition: stream-tcp-reassemble.h:68
TcpSession_
Definition: stream-tcp-private.h:272
flow.h
StreamTcpReassemblySetMinInspectDepth
void StreamTcpReassemblySetMinInspectDepth(TcpSession *ssn, int direction, uint32_t depth)
Definition: stream-tcp-reassemble.c:2094
TcpStream_::tcp_flags
uint8_t tcp_flags
Definition: stream-tcp-private.h:111
TcpReassemblyThreadCtx_::counter_tcp_segment_memcap
uint16_t counter_tcp_segment_memcap
Definition: stream-tcp-reassemble.h:65
StreamTcpSetSessionBypassFlag
void StreamTcpSetSessionBypassFlag(TcpSession *)
enable bypass
Definition: stream-tcp.c:6117
TcpReassemblyThreadCtx_::counter_tcp_segment_from_cache
uint16_t counter_tcp_segment_from_cache
Definition: stream-tcp-reassemble.h:67