suricata
stream-tcp-reassemble.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
23  */
24 
25 #ifndef __STREAM_TCP_REASSEMBLE_H__
26 #define __STREAM_TCP_REASSEMBLE_H__
27 
28 #include "stream-tcp-private.h"
29 #include "stream.h"
30 #include "app-layer-detect-proto.h"
31 #include "stream-tcp-private.h"
32 
33 /** Supported OS list and default OS policy is BSD */
34 enum
35 {
52 };
53 
58 };
59 
60 typedef struct TcpReassemblyThreadCtx_ {
61  void *app_tctx;
62 
64 
65  /** TCP segments which are not being reassembled due to memcap was reached */
67  /** number of streams that stop reassembly because their depth is reached */
69  /** count number of streams with a unrecoverable stream gap (missing pkts) */
71 
72  /** count packet data overlaps */
74  /** count overlaps with different data */
76 
81 
82 #define OS_POLICY_DEFAULT OS_POLICY_BSD
83 
86 int StreamTcpReassembleInit(char);
87 void StreamTcpReassembleFree(char);
92  TcpSession *ssn, TcpStream *stream,
93  Packet *p, enum StreamUpdateDir dir);
94 
95 void StreamTcpCreateTestPacket(uint8_t *, uint8_t, uint8_t, uint8_t);
96 
100 
102 
104  TcpSession *ssn, TcpStream *stream, Packet *p);
105 int StreamTcpReassembleInsertSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, TcpSegment *, Packet *, uint32_t pkt_seq, uint8_t *pkt_data, uint16_t pkt_datalen);
107 
110 
112 
113 void StreamTcpPruneSession(Flow *, uint8_t);
115 
116 void StreamTcpReassembleIncrMemuse(uint64_t size);
117 void StreamTcpReassembleDecrMemuse(uint64_t size);
118 int StreamTcpReassembleSetMemcap(uint64_t size);
119 uint64_t StreamTcpReassembleGetMemcap(void);
120 int StreamTcpReassembleCheckMemcap(uint64_t size);
122 
125 
126 #ifdef UNITTESTS
127 int StreamTcpCheckStreamContents(uint8_t *, uint16_t , TcpStream *);
128 #endif
129 
131 void StreamTcpReassemblySetMinInspectDepth(TcpSession *ssn, int direction, uint32_t depth);
132 
133 static inline bool STREAM_LASTACK_GT_BASESEQ(const TcpStream *stream)
134 {
135  /* last ack not yet initialized */
136  if (STREAM_BASE_OFFSET(stream) == 0 && stream->last_ack == 0)
137  return false;
138  if (SEQ_GT(stream->last_ack, stream->base_seq))
139  return true;
140  return false;
141 }
142 
143 #endif /* __STREAM_TCP_REASSEMBLE_H__ */
144 
UPDATE_DIR_BOTH
@ UPDATE_DIR_BOTH
Definition: stream-tcp-reassemble.h:57
UPDATE_DIR_PACKET
@ UPDATE_DIR_PACKET
Definition: stream-tcp-reassemble.h:55
OS_POLICY_LINUX
@ OS_POLICY_LINUX
Definition: stream-tcp-reassemble.h:40
TcpStream_
Definition: stream-tcp-private.h:94
OS_POLICY_BSD
@ OS_POLICY_BSD
Definition: stream-tcp-reassemble.h:37
StreamTcpReassembleRegisterTests
void StreamTcpReassembleRegisterTests(void)
The Function Register the Unit tests to test the reassembly engine for various OS policies.
Definition: stream-tcp-reassemble.c:3701
OS_POLICY_HPUX10
@ OS_POLICY_HPUX10
Definition: stream-tcp-reassemble.h:43
OS_POLICY_WINDOWS2K3
@ OS_POLICY_WINDOWS2K3
Definition: stream-tcp-reassemble.h:49
StreamTcpReassembleInitThreadCtx
TcpReassemblyThreadCtx * StreamTcpReassembleInitThreadCtx(ThreadVars *tv)
Definition: stream-tcp-reassemble.c:434
StreamTcpGetSegment
TcpSegment * StreamTcpGetSegment(ThreadVars *, TcpReassemblyThreadCtx *)
get a segment from the pool
Definition: stream-tcp-reassemble.c:1906
StreamTcpSetDisableRawReassemblyFlag
void StreamTcpSetDisableRawReassemblyFlag(TcpSession *, char)
Set the No reassembly flag for the given direction in given TCP session.
Definition: stream-tcp.c:5870
TcpReassemblyThreadCtx_::app_tctx
void * app_tctx
Definition: stream-tcp-reassemble.h:61
StreamTcpSegmentReturntoPool
void StreamTcpSegmentReturntoPool(TcpSegment *)
Function to return the segment back to the pool.
Definition: stream-tcp-reassemble.c:302
Flow_
Flow data structure.
Definition: flow.h:347
TcpReassemblyThreadCtx_::counter_tcp_stream_depth
uint16_t counter_tcp_stream_depth
Definition: stream-tcp-reassemble.h:68
StreamTcpReassembleMemuseGlobalCounter
uint64_t StreamTcpReassembleMemuseGlobalCounter(void)
Definition: stream-tcp-reassemble.c:132
TcpReassemblyThreadCtx_::counter_tcp_reass_overlap
uint16_t counter_tcp_reass_overlap
Definition: stream-tcp-reassemble.h:73
StreamTcpReassembleGetMemcap
uint64_t StreamTcpReassembleGetMemcap(void)
Return memcap value.
Definition: stream-tcp-reassemble.c:175
TcpReassemblyThreadCtx_::counter_tcp_reass_overlap_diff_data
uint16_t counter_tcp_reass_overlap_diff_data
Definition: stream-tcp-reassemble.h:75
StreamTcpDisableAppLayer
void StreamTcpDisableAppLayer(Flow *f)
Definition: stream-tcp-reassemble.c:337
StreamTcpReassembleCheckMemcap
int StreamTcpReassembleCheckMemcap(uint64_t size)
Function to Check the reassembly memory usage counter against the allowed max memory usgae for TCP se...
Definition: stream-tcp-reassemble.c:146
StreamTcpReassembleHandleSegment
int StreamTcpReassembleHandleSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpSession *, TcpStream *, Packet *, PacketQueueNoLock *)
Definition: stream-tcp-reassemble.c:1808
PacketQueueNoLock_
simple fifo queue for packets
Definition: packet-queue.h:32
StreamTcpReassembleDepthReached
int StreamTcpReassembleDepthReached(Packet *p)
check if stream in pkt direction has depth reached
Definition: stream-tcp-reassemble.c:493
OS_POLICY_FIRST
@ OS_POLICY_FIRST
Definition: stream-tcp-reassemble.h:50
TcpReassemblyThreadCtx_::counter_tcp_reass_data_normal_fail
uint16_t counter_tcp_reass_data_normal_fail
Definition: stream-tcp-reassemble.h:77
TcpStream_::last_ack
uint32_t last_ack
Definition: stream-tcp-private.h:103
StreamTcpReassembleIncrMemuse
void StreamTcpReassembleIncrMemuse(uint64_t size)
Function to Increment the memory usage counter for the TCP reassembly segments.
Definition: stream-tcp-reassemble.c:98
app-layer-detect-proto.h
StreamTcpReassembleHandleSegmentHandleData
int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p)
Insert a packets TCP data into the stream reassembly engine.
Definition: stream-tcp-reassemble.c:600
OS_POLICY_VISTA
@ OS_POLICY_VISTA
Definition: stream-tcp-reassemble.h:48
STREAM_BASE_OFFSET
#define STREAM_BASE_OFFSET(stream)
Definition: stream-tcp-private.h:131
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
TcpReassemblyThreadCtx
struct TcpReassemblyThreadCtx_ TcpReassemblyThreadCtx
StreamTcpCreateTestPacket
void StreamTcpCreateTestPacket(uint8_t *, uint8_t, uint8_t, uint8_t)
The Function to create the packet with given payload, which is used to test the reassembly of the eng...
Definition: stream-tcp-reassemble.c:1984
StreamTcpReassembleDecrMemuse
void StreamTcpReassembleDecrMemuse(uint64_t size)
Function to Decrease the memory usage counter for the TCP reassembly segments.
Definition: stream-tcp-reassemble.c:111
StreamTcpReassembleFreeThreadCtx
void StreamTcpReassembleFreeThreadCtx(TcpReassemblyThreadCtx *)
Definition: stream-tcp-reassemble.c:475
stream.h
TcpSegment
Definition: stream-tcp-private.h:61
Packet_
Definition: decode.h:414
stream-tcp-private.h
OS_POLICY_IRIX
@ OS_POLICY_IRIX
Definition: stream-tcp-reassemble.h:45
TcpReassemblyThreadCtx_::counter_tcp_reass_list_fail
uint16_t counter_tcp_reass_list_fail
Definition: stream-tcp-reassemble.h:79
OS_POLICY_OLD_LINUX
@ OS_POLICY_OLD_LINUX
Definition: stream-tcp-reassemble.h:39
StreamTcpReassembleAppLayer
int StreamTcpReassembleAppLayer(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p, enum StreamUpdateDir dir)
Update the stream reassembly upon receiving a packet.
Definition: stream-tcp-reassemble.c:1194
TcpReassemblyThreadCtx_::counter_tcp_reass_gap
uint16_t counter_tcp_reass_gap
Definition: stream-tcp-reassemble.h:70
OS_POLICY_WINDOWS
@ OS_POLICY_WINDOWS
Definition: stream-tcp-reassemble.h:47
StreamTcpReassembleTriggerRawReassembly
void StreamTcpReassembleTriggerRawReassembly(TcpSession *, int direction)
Trigger RAW stream reassembly.
Definition: stream-tcp-reassemble.c:1933
UPDATE_DIR_OPPOSING
@ UPDATE_DIR_OPPOSING
Definition: stream-tcp-reassemble.h:56
TcpReassemblyThreadCtx_::segment_thread_pool_id
int segment_thread_pool_id
Definition: stream-tcp-reassemble.h:63
StreamTcpSetSessionNoReassemblyFlag
void StreamTcpSetSessionNoReassemblyFlag(TcpSession *, char)
disable reassembly
Definition: stream-tcp.c:5854
SEQ_GT
#define SEQ_GT(a, b)
Definition: stream-tcp-private.h:240
StreamTcpReturnStreamSegments
void StreamTcpReturnStreamSegments(TcpStream *)
return all segments in this stream into the pool(s)
Definition: stream-tcp-reassemble.c:315
StreamTcpReassembleSetMemcap
int StreamTcpReassembleSetMemcap(uint64_t size)
Update memcap value.
Definition: stream-tcp-reassemble.c:160
TcpStream_::base_seq
uint32_t base_seq
Definition: stream-tcp-private.h:112
OS_POLICY_BSD_RIGHT
@ OS_POLICY_BSD_RIGHT
Definition: stream-tcp-reassemble.h:38
StreamReassembleRawHasDataReady
bool StreamReassembleRawHasDataReady(TcpSession *ssn, Packet *p)
does the stream engine have data to inspect?
Definition: stream-tcp-reassemble.c:1307
StreamTcpReassembleInitMemuse
void StreamTcpReassembleInitMemuse(void)
Definition: stream-tcp-reassemble.c:87
StreamTcpReassembleInsertSegment
int StreamTcpReassembleInsertSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, TcpSegment *, Packet *, uint32_t pkt_seq, uint8_t *pkt_data, uint16_t pkt_datalen)
Definition: stream-tcp-list.c:557
OS_POLICY_LAST
@ OS_POLICY_LAST
Definition: stream-tcp-reassemble.h:51
OS_POLICY_NONE
@ OS_POLICY_NONE
Definition: stream-tcp-reassemble.h:36
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
OS_POLICY_OLD_SOLARIS
@ OS_POLICY_OLD_SOLARIS
Definition: stream-tcp-reassemble.h:41
StreamTcpAppLayerIsDisabled
int StreamTcpAppLayerIsDisabled(Flow *f)
Definition: stream-tcp-reassemble.c:353
StreamTcpSetOSPolicy
void StreamTcpSetOSPolicy(TcpStream *, Packet *)
Function to set the OS policy for the given stream based on the destination of the received packet.
Definition: stream-tcp.c:766
OS_POLICY_MACOS
@ OS_POLICY_MACOS
Definition: stream-tcp-reassemble.h:46
TcpReassemblyThreadCtx_::counter_tcp_reass_data_overlap_fail
uint16_t counter_tcp_reass_data_overlap_fail
Definition: stream-tcp-reassemble.h:78
StreamTcpCheckStreamContents
int StreamTcpCheckStreamContents(uint8_t *, uint16_t, TcpStream *)
The Function Checks the reassembled stream contents against predefined stream contents according to O...
Definition: stream-tcp-reassemble.c:2001
TcpReassemblyThreadCtx_
Definition: stream-tcp-reassemble.h:60
OS_POLICY_SOLARIS
@ OS_POLICY_SOLARIS
Definition: stream-tcp-reassemble.h:42
StreamTcpPruneSession
void StreamTcpPruneSession(Flow *, uint8_t)
Remove idle TcpSegments from TcpSession.
Definition: stream-tcp-list.c:799
StreamUpdateDir
StreamUpdateDir
Definition: stream-tcp-reassemble.h:54
OS_POLICY_HPUX11
@ OS_POLICY_HPUX11
Definition: stream-tcp-reassemble.h:44
StreamTcpReassembleInit
int StreamTcpReassembleInit(char)
Definition: stream-tcp-reassemble.c:399
TcpSession_
Definition: stream-tcp-private.h:260
StreamTcpReassembleFree
void StreamTcpReassembleFree(char)
Definition: stream-tcp-reassemble.c:415
StreamTcpReassemblySetMinInspectDepth
void StreamTcpReassemblySetMinInspectDepth(TcpSession *ssn, int direction, uint32_t depth)
Definition: stream-tcp-reassemble.c:1950
TcpReassemblyThreadCtx_::counter_tcp_segment_memcap
uint16_t counter_tcp_segment_memcap
Definition: stream-tcp-reassemble.h:66
StreamTcpSetSessionBypassFlag
void StreamTcpSetSessionBypassFlag(TcpSession *)
enable bypass
Definition: stream-tcp.c:5881