suricata
|
#include "stream-tcp-private.h"
#include "stream.h"
#include "stream-tcp-reassemble.h"
#include "suricata.h"
Go to the source code of this file.
Data Structures | |
struct | TcpStreamCnf_ |
struct | StreamTcpThread_ |
Macros | |
#define | STREAM_VERBOSE false |
#define | STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION BIT_U8(0) |
#define | STREAMTCP_INIT_FLAG_DROP_INVALID BIT_U8(1) |
#define | STREAMTCP_INIT_FLAG_BYPASS BIT_U8(2) |
#define | STREAMTCP_INIT_FLAG_INLINE BIT_U8(3) |
Typedefs | |
typedef struct TcpStreamCnf_ | TcpStreamCnf |
typedef struct StreamTcpThread_ | StreamTcpThread |
typedef int(* | StreamReassembleRawFunc) (void *data, const uint8_t *input, const uint32_t input_len, const uint64_t offset) |
Enumerations | |
enum | { STREAM_HAS_UNPROCESSED_SEGMENTS_NONE = 0, STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION = 1 } |
Functions | |
void | StreamTcpInitConfig (bool) |
To initialize the stream global configuration data. More... | |
void | StreamTcpFreeConfig (bool) |
void | StreamTcpRegisterTests (void) |
void | StreamTcpSessionPktFree (Packet *) |
Function to return the stream segments back to the pool. More... | |
void | StreamTcpInitMemuse (void) |
void | StreamTcpIncrMemuse (uint64_t) |
void | StreamTcpDecrMemuse (uint64_t) |
int | StreamTcpSetMemcap (uint64_t) |
Update memcap value. More... | |
uint64_t | StreamTcpGetMemcap (void) |
Return memcap value. More... | |
int | StreamTcpCheckMemcap (uint64_t) |
Check if alloc'ing "size" would mean we're over memcap. More... | |
uint64_t | StreamTcpMemuseCounter (void) |
uint64_t | StreamTcpReassembleMemuseGlobalCounter (void) |
int | StreamTcpSegmentForEach (const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data) |
int | StreamTcpSegmentForSession (const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data) |
Run callback function on each TCP segment in both directions of a session. More... | |
void | StreamTcpReassembleConfigEnableOverlapCheck (void) |
void | TcpSessionSetReassemblyDepth (TcpSession *ssn, uint32_t size) |
int | StreamReassembleForFrame (TcpSession *ssn, TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, const uint64_t offset, const bool eof) |
int | StreamReassembleLog (TcpSession *ssn, TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, uint64_t progress_in, uint64_t *progress_out, bool eof) |
int | StreamReassembleRaw (TcpSession *ssn, const Packet *p, StreamReassembleRawFunc Callback, void *cb_data, uint64_t *progress_out, bool respect_inspect_depth) |
void | StreamReassembleRawUpdateProgress (TcpSession *ssn, Packet *p, const uint64_t progress) |
update stream engine after detection More... | |
void | StreamTcpDetectLogFlush (ThreadVars *tv, StreamTcpThread *stt, Flow *f, Packet *p, PacketQueueNoLock *pq) |
create packets in both directions to flush out logging and detection before switching protocols. In IDS mode, create first in packet dir, 2nd in opposing In IPS mode, do the reverse. Flag TCP engine that data needs to be inspected regardless of how far we are wrt inspect limits. More... | |
const char * | StreamTcpStateAsString (const enum TcpState) |
const char * | StreamTcpSsnStateAsString (const TcpSession *ssn) |
TmEcode | StreamTcp (ThreadVars *, Packet *, void *, PacketQueueNoLock *) |
uint8_t | StreamNeedsReassembly (const TcpSession *ssn, uint8_t direction) |
see what if any work the TCP session still needs More... | |
TmEcode | StreamTcpThreadInit (ThreadVars *, void *, void **) |
TmEcode | StreamTcpThreadDeinit (ThreadVars *tv, void *data) |
int | StreamTcpPacket (ThreadVars *tv, Packet *p, StreamTcpThread *stt, PacketQueueNoLock *pq) |
void | StreamTcpSessionClear (void *ssnptr) |
Function to return the stream back to the pool. It returns the segments in the stream to the segment pool. More... | |
void | StreamTcpSessionCleanup (TcpSession *ssn) |
Session cleanup function. Does not free the ssn. More... | |
void | StreamTcpStreamCleanup (TcpStream *stream) |
int | StreamTcpBypassEnabled (void) |
int | StreamTcpInlineMode (void) |
See if stream engine is operating in inline mode. More... | |
int | TcpSessionPacketSsnReuse (const Packet *p, const Flow *f, const void *tcp_ssn) |
void | StreamTcpUpdateAppLayerProgress (TcpSession *ssn, char direction, const uint32_t progress) |
update reassembly progress More... | |
uint64_t | StreamTcpGetAcked (const TcpStream *stream) |
uint64_t | StreamTcpGetUsable (const TcpStream *stream, const bool eof) |
uint64_t | StreamDataRightEdge (const TcpStream *stream, const bool eof) |
void | StreamTcpThreadCacheEnable (void) |
enable segment cache. Should only be done for worker threads More... | |
void | StreamTcpThreadCacheCleanup (void) |
Variables | |
TcpStreamCnf | stream_config |
Definition in file stream-tcp.h.
#define STREAM_VERBOSE false |
Definition at line 35 of file stream-tcp.h.
#define STREAMTCP_INIT_FLAG_BYPASS BIT_U8(2) |
Definition at line 40 of file stream-tcp.h.
#define STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION BIT_U8(0) |
Definition at line 38 of file stream-tcp.h.
#define STREAMTCP_INIT_FLAG_DROP_INVALID BIT_U8(1) |
Definition at line 39 of file stream-tcp.h.
#define STREAMTCP_INIT_FLAG_INLINE BIT_U8(3) |
Definition at line 41 of file stream-tcp.h.
typedef int(* StreamReassembleRawFunc) (void *data, const uint8_t *input, const uint32_t input_len, const uint64_t offset) |
Definition at line 129 of file stream-tcp.h.
typedef struct StreamTcpThread_ StreamTcpThread |
typedef struct TcpStreamCnf_ TcpStreamCnf |
anonymous enum |
Enumerator | |
---|---|
STREAM_HAS_UNPROCESSED_SEGMENTS_NONE | |
STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION |
Definition at line 171 of file stream-tcp.h.
uint64_t StreamDataRightEdge | ( | const TcpStream * | stream, |
const bool | eof | ||
) |
Definition at line 415 of file stream-tcp-reassemble.c.
References TcpStream_::base_seq, FALSE, MIN, TcpStream_::segs_right_edge, STREAM_BASE_OFFSET, and StreamTcpInlineMode().
uint8_t StreamNeedsReassembly | ( | const TcpSession * | ssn, |
uint8_t | direction | ||
) |
see what if any work the TCP session still needs
Definition at line 911 of file stream-tcp-reassemble.c.
References TcpStream_::base_seq, TcpSession_::client, TcpStream_::flags, TcpSession_::flags, SCLogDebug, TcpStream_::segs_right_edge, TcpSession_::server, STREAM_APP_PROGRESS, STREAM_BASE_OFFSET, STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION, STREAM_RAW_PROGRESS, STREAMTCP_FLAG_APP_LAYER_DISABLED, and STREAMTCP_STREAM_FLAG_DISABLE_RAW.
Referenced by FlowForceReassemblyNeedReassembly().
int StreamReassembleForFrame | ( | TcpSession * | ssn, |
TcpStream * | stream, | ||
StreamReassembleRawFunc | Callback, | ||
void * | cb_data, | ||
const uint64_t | offset, | ||
const bool | eof | ||
) |
Definition at line 1841 of file stream-tcp-reassemble.c.
References SCLogDebug, and STREAM_APP_PROGRESS.
int StreamReassembleLog | ( | TcpSession * | ssn, |
TcpStream * | stream, | ||
StreamReassembleRawFunc | Callback, | ||
void * | cb_data, | ||
uint64_t | progress_in, | ||
uint64_t * | progress_out, | ||
bool | eof | ||
) |
Definition at line 1918 of file stream-tcp-reassemble.c.
References TcpStream_::flags, and STREAMTCP_STREAM_FLAG_NOREASSEMBLY.
int StreamReassembleRaw | ( | TcpSession * | ssn, |
const Packet * | p, | ||
StreamReassembleRawFunc | Callback, | ||
void * | cb_data, | ||
uint64_t * | progress_out, | ||
bool | respect_inspect_depth | ||
) |
Definition at line 1853 of file stream-tcp-reassemble.c.
References StreamTcpInlineMode(), and TRUE.
Referenced by DetectEngineInspectStreamPayload().
void StreamReassembleRawUpdateProgress | ( | TcpSession * | ssn, |
Packet * | p, | ||
const uint64_t | progress | ||
) |
update stream engine after detection
Tasked with progressing the 'progress' for Raw reassembly. 2 main scenario's:
Additionally, this function is tasked with disabling raw reassembly if the app-layer requested to disable it.
Definition at line 1508 of file stream-tcp-reassemble.c.
References TcpSession_::client, TcpStream_::flags, TcpSession_::flags, PKT_IS_TOSERVER, TcpStream_::raw_progress_rel, TcpSession_::server, STREAM_APP_PROGRESS, STREAM_RAW_PROGRESS, STREAMTCP_FLAG_APP_LAYER_DISABLED, and STREAMTCP_STREAM_FLAG_TRIGGER_RAW.
TmEcode StreamTcp | ( | ThreadVars * | , |
Packet * | , | ||
void * | , | ||
PacketQueueNoLock * | |||
) |
Definition at line 5718 of file stream-tcp.c.
References DEBUG_VALIDATE_BUG_ON, Packet_::flow, FlowGetPacketDirection(), Packet_::pcap_cnt, PKT_IS_TCP, Packet_::pkt_src, PktSrcToString(), SCLogDebug, t_pcapcnt, TM_ECODE_OK, TOSERVER, and unlikely.
int StreamTcpBypassEnabled | ( | void | ) |
Definition at line 6839 of file stream-tcp.c.
References TcpStreamCnf_::flags, stream_config, and STREAMTCP_INIT_FLAG_BYPASS.
int StreamTcpCheckMemcap | ( | uint64_t | size | ) |
Check if alloc'ing "size" would mean we're over memcap.
1 | if in bounds |
0 | if not in bounds |
Definition at line 164 of file stream-tcp.c.
References SC_ATOMIC_GET, and stream_config.
void StreamTcpDecrMemuse | ( | uint64_t | ) |
Definition at line 131 of file stream-tcp.c.
References BUG_ON, RunmodeIsUnittests(), SC_ATOMIC_GET, SC_ATOMIC_SUB, SCLogDebug, and StreamTcpMemuseCounter().
void StreamTcpDetectLogFlush | ( | ThreadVars * | tv, |
StreamTcpThread * | stt, | ||
Flow * | f, | ||
Packet * | p, | ||
PacketQueueNoLock * | pq | ||
) |
create packets in both directions to flush out logging and detection before switching protocols. In IDS mode, create first in packet dir, 2nd in opposing In IPS mode, do the reverse. Flag TCP engine that data needs to be inspected regardless of how far we are wrt inspect limits.
Definition at line 6673 of file stream-tcp.c.
References TcpSession_::client, TcpStream_::flags, PKT_IS_TOSERVER, Flow_::protoctx, TcpSession_::server, STREAMTCP_STREAM_FLAG_TRIGGER_RAW, StreamTcpInlineMode(), and ts.
void StreamTcpFreeConfig | ( | bool | ) |
Definition at line 695 of file stream-tcp.c.
References SCMutexLock, and StreamTcpReassembleFree().
Referenced by StreamTcpUTDeinit().
uint64_t StreamTcpGetAcked | ( | const TcpStream * | stream | ) |
Definition at line 409 of file stream-tcp-reassemble.c.
uint64_t StreamTcpGetMemcap | ( | void | ) |
Return memcap value.
memcap | memcap value |
Definition at line 192 of file stream-tcp.c.
References SC_ATOMIC_GET, and stream_config.
uint64_t StreamTcpGetUsable | ( | const TcpStream * | stream, |
const bool | eof | ||
) |
Definition at line 424 of file stream-tcp-reassemble.c.
Referenced by FrameJsonLogOneFrame().
void StreamTcpIncrMemuse | ( | uint64_t | ) |
Definition at line 124 of file stream-tcp.c.
References SC_ATOMIC_ADD, SCLogDebug, and StreamTcpMemuseCounter().
void StreamTcpInitConfig | ( | bool | quiet | ) |
To initialize the stream global configuration data.
quiet | It tells the mode of operation, if it is true nothing will be get printed. |
Definition at line 359 of file stream-tcp.c.
References TcpStreamCnf_::async_oneside, ConfGet(), ConfGetBool(), ConfGetInt(), ConfGetNode(), EngineModeIsIPS(), EXCEPTION_POLICY_NOT_SET, ExceptionPolicyParse(), FatalError, TcpStreamCnf_::flags, TcpStreamCnf_::max_syn_queued, TcpStreamCnf_::max_synack_queued, TcpStreamCnf_::midstream, TcpStreamCnf_::midstream_policy, ParseSizeStringU16(), ParseSizeStringU32(), ParseSizeStringU64(), TcpStreamCnf_::prealloc_sessions, TcpStreamCnf_::reassembly_depth, TcpStreamCnf_::reassembly_memcap_policy, TcpStreamCnf_::reassembly_toserver_chunk_size, RunmodeIsUnittests(), SC_ATOMIC_GET, SC_ATOMIC_INIT, SC_ATOMIC_SET, SCLogDebug, SCLogError, SCLogWarning, TcpStreamCnf_::ssn_memcap_policy, stream_config, STREAMTCP_DEFAULT_MAX_SYN_QUEUED, STREAMTCP_DEFAULT_MAX_SYNACK_QUEUED, STREAMTCP_DEFAULT_MEMCAP, STREAMTCP_DEFAULT_PREALLOC, STREAMTCP_DEFAULT_REASSEMBLY_MEMCAP, STREAMTCP_DEFAULT_TOSERVER_CHUNK_SIZE, STREAMTCP_INIT_FLAG_BYPASS, STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION, STREAMTCP_INIT_FLAG_DROP_INVALID, STREAMTCP_INIT_FLAG_INLINE, and WarnInvalidConfEntry.
Referenced by PreRunInit(), and StreamTcpUTInit().
void StreamTcpInitMemuse | ( | void | ) |
Definition at line 119 of file stream-tcp.c.
References SC_ATOMIC_INIT.
Referenced by UtRunTests().
int StreamTcpInlineMode | ( | void | ) |
See if stream engine is operating in inline mode.
0 | no |
1 | yes |
Definition at line 6850 of file stream-tcp.c.
References TcpStreamCnf_::flags, stream_config, and STREAMTCP_INIT_FLAG_INLINE.
Referenced by StreamDataRightEdge(), StreamReassembleRaw(), StreamReassembleRawHasDataReady(), StreamTcpDetectLogFlush(), and StreamTcpReassembleHandleSegment().
uint64_t StreamTcpMemuseCounter | ( | void | ) |
Definition at line 152 of file stream-tcp.c.
References SC_ATOMIC_GET.
Referenced by StreamTcpDecrMemuse(), and StreamTcpIncrMemuse().
int StreamTcpPacket | ( | ThreadVars * | tv, |
Packet * | p, | ||
StreamTcpThread * | stt, | ||
PacketQueueNoLock * | pq | ||
) |
Definition at line 5320 of file stream-tcp.c.
References TcpSession_::client, DEBUG_ASSERT_FLOW_LOCKED, TcpSession_::flags, Packet_::flow, Packet_::pcap_cnt, PKT_IS_TOCLIENT, PKT_IS_TOSERVER, Flow_::protoctx, SCEnter, SCLogDebug, TcpSession_::server, STREAM_PKT_BROKEN_ACK, STREAMTCP_FLAG_ASYNC, StreamTcpSetEvent, TcpStream_::tcp_flags, TCP_GET_ACK, TcpSession_::tcp_packet_flags, Packet_::tcph, and TH_ACK.
void StreamTcpReassembleConfigEnableOverlapCheck | ( | void | ) |
Definition at line 40 of file stream-tcp-list.c.
uint64_t StreamTcpReassembleMemuseGlobalCounter | ( | void | ) |
Definition at line 148 of file stream-tcp-reassemble.c.
References SC_ATOMIC_GET.
Referenced by StreamTcpReassembleDecrMemuse(), and StreamTcpReassembleIncrMemuse().
void StreamTcpRegisterTests | ( | void | ) |
Definition at line 3401 of file stream-tcp.c.
References UtRegisterTest().
int StreamTcpSegmentForEach | ( | const Packet * | p, |
uint8_t | flag, | ||
StreamSegmentCallback | CallbackFunc, | ||
void * | data | ||
) |
Definition at line 6697 of file stream-tcp.c.
Referenced by StreamSegmentForEach().
int StreamTcpSegmentForSession | ( | const Packet * | p, |
uint8_t | flag, | ||
StreamSegmentCallback | CallbackFunc, | ||
void * | data | ||
) |
Run callback function on each TCP segment in both directions of a session.
Definition at line 6756 of file stream-tcp.c.
Referenced by StreamSegmentForSession().
void StreamTcpSessionCleanup | ( | TcpSession * | ssn | ) |
Session cleanup function. Does not free the ssn.
ssn | tcp session |
Definition at line 225 of file stream-tcp.c.
References TcpSession_::client, SCEnter, TcpSession_::server, and StreamTcpStreamCleanup().
Referenced by StreamTcpSessionClear(), StreamTcpUTClearSession(), and UTHRemoveSessionFromFlow().
void StreamTcpSessionClear | ( | void * | ssnptr | ) |
Function to return the stream back to the pool. It returns the segments in the stream to the segment pool.
This function is called when the flow is destroyed, so it should free everything related to the tcp session. So including the app layer data.
ssn | Void ptr to the ssn. |
Definition at line 249 of file stream-tcp.c.
References pool_id, TcpSession_::pool_id, SCEnter, SCMutexLock, StreamTcpSessionCleanup(), and StreamTcpThreadCacheReturnSession().
void StreamTcpSessionPktFree | ( | Packet * | p | ) |
Function to return the stream segments back to the pool.
p | Packet used to identify the stream. |
Definition at line 278 of file stream-tcp.c.
References TcpSession_::client, Packet_::flow, Flow_::protoctx, SCEnter, SCReturn, TcpSession_::server, and StreamTcpReturnStreamSegments().
int StreamTcpSetMemcap | ( | uint64_t | size | ) |
Update memcap value.
size | new memcap value |
Definition at line 177 of file stream-tcp.c.
References SC_ATOMIC_GET, SC_ATOMIC_SET, and stream_config.
const char* StreamTcpSsnStateAsString | ( | const TcpSession * | ssn | ) |
Definition at line 6906 of file stream-tcp.c.
References TcpSession_::state, and StreamTcpStateAsString().
const char* StreamTcpStateAsString | ( | const enum | TcpState | ) |
Definition at line 6865 of file stream-tcp.c.
References TCP_CLOSE_WAIT, TCP_CLOSED, TCP_CLOSING, TCP_ESTABLISHED, TCP_FIN_WAIT1, TCP_FIN_WAIT2, TCP_LAST_ACK, TCP_NONE, TCP_SYN_RECV, TCP_SYN_SENT, and TCP_TIME_WAIT.
Referenced by StreamTcpSsnStateAsString().
void StreamTcpStreamCleanup | ( | TcpStream * | stream | ) |
Definition at line 198 of file stream-tcp.c.
References TcpStream_::sb, TcpStreamCnf_::sbcnf, stream_config, StreamingBufferClear(), StreamTcpReturnStreamSegments(), and StreamTcpSackFreeList().
Referenced by StreamTcpSessionCleanup(), and StreamTcpUTClearStream().
void StreamTcpThreadCacheCleanup | ( | void | ) |
Definition at line 134 of file stream-tcp-cache.c.
References SCEnter, and SCLogDebug.
Referenced by StreamTcpReassembleFreeThreadCtx().
void StreamTcpThreadCacheEnable | ( | void | ) |
enable segment cache. Should only be done for worker threads
Definition at line 48 of file stream-tcp-cache.c.
Referenced by StreamTcpThreadInit().
TmEcode StreamTcpThreadDeinit | ( | ThreadVars * | tv, |
void * | data | ||
) |
Definition at line 5829 of file stream-tcp.c.
References StreamTcpThread_::ra_ctx, SCEnter, SCFree, SCReturnInt, StreamTcpReassembleFreeThreadCtx(), and TM_ECODE_OK.
TmEcode StreamTcpThreadInit | ( | ThreadVars * | , |
void * | , | ||
void ** | |||
) |
Definition at line 5760 of file stream-tcp.c.
References StreamTcpThread_::counter_tcp_ack_unseen_data, StreamTcpThread_::counter_tcp_active_sessions, StreamTcpThread_::counter_tcp_invalid_checksum, StreamTcpThread_::counter_tcp_midstream_pickups, StreamTcpThread_::counter_tcp_pseudo, StreamTcpThread_::counter_tcp_pseudo_failed, TcpReassemblyThreadCtx_::counter_tcp_reass_data_normal_fail, TcpReassemblyThreadCtx_::counter_tcp_reass_data_overlap_fail, TcpReassemblyThreadCtx_::counter_tcp_reass_gap, TcpReassemblyThreadCtx_::counter_tcp_reass_overlap, TcpReassemblyThreadCtx_::counter_tcp_reass_overlap_diff_data, TcpReassemblyThreadCtx_::counter_tcp_segment_from_cache, TcpReassemblyThreadCtx_::counter_tcp_segment_from_pool, TcpReassemblyThreadCtx_::counter_tcp_segment_memcap, StreamTcpThread_::counter_tcp_sessions, StreamTcpThread_::counter_tcp_ssn_from_cache, StreamTcpThread_::counter_tcp_ssn_from_pool, StreamTcpThread_::counter_tcp_ssn_memcap, TcpReassemblyThreadCtx_::counter_tcp_stream_depth, StreamTcpThread_::counter_tcp_wrong_thread, StreamTcpThread_::ra_ctx, SCEnter, SCLogDebug, SCMalloc, SCMutexLock, SCReturnInt, StreamTcpThread_::ssn_pool_id, StatsRegisterCounter(), StreamTcpReassembleInitThreadCtx(), StreamTcpThreadCacheEnable(), TM_ECODE_FAILED, tv, and unlikely.
void StreamTcpUpdateAppLayerProgress | ( | TcpSession * | ssn, |
char | direction, | ||
const uint32_t | progress | ||
) |
update reassembly progress
ssn | TCP Session |
direction | direction to set the flag in: 0 toserver, 1 toclient |
Definition at line 6425 of file stream-tcp.c.
References TcpStream_::app_progress_rel, TcpSession_::client, SCLogDebug, TcpSession_::server, and STREAM_APP_PROGRESS.
Definition at line 5706 of file stream-tcp.c.
References Packet_::proto, and Packet_::tcph.
void TcpSessionSetReassemblyDepth | ( | TcpSession * | ssn, |
uint32_t | size | ||
) |
Definition at line 6856 of file stream-tcp.c.
References TcpSession_::reassembly_depth.
TcpStreamCnf stream_config |
Definition at line 115 of file stream-tcp.c.
Referenced by StreamTcpBypassEnabled(), StreamTcpCheckMemcap(), StreamTcpGetMemcap(), StreamTcpInitConfig(), StreamTcpInlineMode(), StreamTcpSetMemcap(), and StreamTcpStreamCleanup().