suricata
stream-tcp.h File Reference
#include "stream-tcp-private.h"
#include "stream.h"
#include "stream-tcp-reassemble.h"
#include "suricata.h"
#include "util-exception-policy-types.h"
Include dependency graph for stream-tcp.h:

Go to the source code of this file.

Data Structures

struct  TcpStreamCnf_
 
struct  StreamTcpThread_
 

Macros

#define STREAM_VERBOSE   false
 
#define STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION   BIT_U8(0)
 
#define STREAMTCP_INIT_FLAG_DROP_INVALID   BIT_U8(1)
 
#define STREAMTCP_INIT_FLAG_BYPASS   BIT_U8(2)
 
#define STREAMTCP_INIT_FLAG_INLINE   BIT_U8(3)
 
#define STREAMTCP_INIT_FLAG_DROP_URG   BIT_U8(4)
 
#define TCP_STREAM_URGENT_DEFAULT   TCP_STREAM_URGENT_INLINE
 

Typedefs

typedef struct TcpStreamCnf_ TcpStreamCnf
 
typedef struct StreamTcpThread_ StreamTcpThread
 
typedef int(* StreamReassembleRawFunc) (void *data, const uint8_t *input, const uint32_t input_len, const uint64_t offset)
 

Enumerations

enum  TcpStreamUrgentHandling { TCP_STREAM_URGENT_INLINE, TCP_STREAM_URGENT_DROP, TCP_STREAM_URGENT_OOB, TCP_STREAM_URGENT_GAP }
 
enum  { STREAM_HAS_UNPROCESSED_SEGMENTS_NONE = 0, STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION = 1 }
 

Functions

void StreamTcpInitConfig (bool)
 To initialize the stream global configuration data. More...
 
void StreamTcpFreeConfig (bool)
 
void StreamTcpRegisterTests (void)
 
void StreamTcpSessionPktFree (Packet *)
 Function to return the stream segments back to the pool. More...
 
void StreamTcpInitMemuse (void)
 
void StreamTcpIncrMemuse (uint64_t)
 
void StreamTcpDecrMemuse (uint64_t)
 
int StreamTcpSetMemcap (uint64_t)
 Update memcap value. More...
 
uint64_t StreamTcpGetMemcap (void)
 Return memcap value. More...
 
int StreamTcpCheckMemcap (uint64_t)
 Check if alloc'ing "size" would mean we're over memcap. More...
 
uint64_t StreamTcpMemuseCounter (void)
 
int StreamTcpSegmentForEach (const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data)
 
int StreamTcpSegmentForSession (const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data)
 Run callback function on each TCP segment in both directions of a session. More...
 
void StreamTcpReassembleConfigEnableOverlapCheck (void)
 
void TcpSessionSetReassemblyDepth (TcpSession *ssn, uint32_t size)
 
int StreamReassembleForFrame (TcpSession *ssn, TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, const uint64_t offset, const bool eof)
 
int StreamReassembleLog (const TcpSession *ssn, const TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, const uint64_t progress_in, uint64_t *progress_out, const bool eof)
 
int StreamReassembleRaw (TcpSession *ssn, const Packet *p, StreamReassembleRawFunc Callback, void *cb_data, uint64_t *progress_out, bool respect_inspect_depth)
 
void StreamReassembleRawUpdateProgress (TcpSession *ssn, Packet *p, const uint64_t progress)
 update stream engine after detection More...
 
void StreamTcpDetectLogFlush (ThreadVars *tv, StreamTcpThread *stt, Flow *f, Packet *p, PacketQueueNoLock *pq)
 create packets in both directions to flush out logging and detection before switching protocols. In IDS mode, create first in packet dir, 2nd in opposing In IPS mode, do the reverse. Flag TCP engine that data needs to be inspected regardless of how far we are wrt inspect limits. More...
 
const char * StreamTcpStateAsString (const enum TcpState)
 
const char * StreamTcpSsnStateAsString (const TcpSession *ssn)
 
TmEcode StreamTcp (ThreadVars *, Packet *, void *, PacketQueueNoLock *)
 
uint8_t StreamNeedsReassembly (const TcpSession *ssn, uint8_t direction)
 see what if any work the TCP session still needs More...
 
TmEcode StreamTcpThreadInit (ThreadVars *, void *, void **)
 
TmEcode StreamTcpThreadDeinit (ThreadVars *tv, void *data)
 
int StreamTcpPacket (ThreadVars *tv, Packet *p, StreamTcpThread *stt, PacketQueueNoLock *pq)
 
void StreamTcpSessionClear (void *ssnptr)
 Function to return the stream back to the pool. It returns the segments in the stream to the segment pool. More...
 
void StreamTcpSessionCleanup (TcpSession *ssn)
 Session cleanup function. Does not free the ssn. More...
 
void StreamTcpStreamCleanup (TcpStream *stream)
 
int StreamTcpBypassEnabled (void)
 
bool StreamTcpInlineMode (void)
 See if stream engine is operating in inline mode. More...
 
bool TcpSessionPacketSsnReuse (const Packet *p, const Flow *f, const void *tcp_ssn)
 
void StreamTcpUpdateAppLayerProgress (TcpSession *ssn, char direction, const uint32_t progress)
 update reassembly progress More...
 
uint64_t StreamTcpGetUsable (const TcpStream *stream, const bool eof)
 
uint64_t StreamDataRightEdge (const TcpStream *stream, const bool eof)
 

Variables

TcpStreamCnf stream_config
 

Detailed Description

Macro Definition Documentation

◆ STREAM_VERBOSE

#define STREAM_VERBOSE   false

Definition at line 36 of file stream-tcp.h.

◆ STREAMTCP_INIT_FLAG_BYPASS

#define STREAMTCP_INIT_FLAG_BYPASS   BIT_U8(2)

Definition at line 41 of file stream-tcp.h.

◆ STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION

#define STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION   BIT_U8(0)

Definition at line 39 of file stream-tcp.h.

◆ STREAMTCP_INIT_FLAG_DROP_INVALID

#define STREAMTCP_INIT_FLAG_DROP_INVALID   BIT_U8(1)

Definition at line 40 of file stream-tcp.h.

◆ STREAMTCP_INIT_FLAG_DROP_URG

#define STREAMTCP_INIT_FLAG_DROP_URG   BIT_U8(4)

flag to drop packets with URG flag set

Definition at line 44 of file stream-tcp.h.

◆ STREAMTCP_INIT_FLAG_INLINE

#define STREAMTCP_INIT_FLAG_INLINE   BIT_U8(3)

Definition at line 42 of file stream-tcp.h.

◆ TCP_STREAM_URGENT_DEFAULT

#define TCP_STREAM_URGENT_DEFAULT   TCP_STREAM_URGENT_INLINE

Definition at line 48 of file stream-tcp.h.

Typedef Documentation

◆ StreamReassembleRawFunc

typedef int(* StreamReassembleRawFunc) (void *data, const uint8_t *input, const uint32_t input_len, const uint64_t offset)

Definition at line 145 of file stream-tcp.h.

◆ StreamTcpThread

◆ TcpStreamCnf

typedef struct TcpStreamCnf_ TcpStreamCnf

Enumeration Type Documentation

◆ anonymous enum

anonymous enum
Enumerator
STREAM_HAS_UNPROCESSED_SEGMENTS_NONE 
STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION 

Definition at line 186 of file stream-tcp.h.

◆ TcpStreamUrgentHandling

Enumerator
TCP_STREAM_URGENT_INLINE 

treat as inline data

TCP_STREAM_URGENT_DROP 

drop TCP packet with URG flag

TCP_STREAM_URGENT_OOB 

treat 1 byte of URG data as OOB

TCP_STREAM_URGENT_GAP 

treat 1 byte of URG data as GAP

Definition at line 45 of file stream-tcp.h.

Function Documentation

◆ StreamDataRightEdge()

uint64_t StreamDataRightEdge ( const TcpStream stream,
const bool  eof 
)

Definition at line 418 of file stream-tcp-reassemble.c.

References TcpStream_::base_seq, MIN, TcpStream_::segs_right_edge, STREAM_BASE_OFFSET, and StreamTcpInlineMode().

Here is the call graph for this function:

◆ StreamNeedsReassembly()

uint8_t StreamNeedsReassembly ( const TcpSession ssn,
uint8_t  direction 
)

◆ StreamReassembleForFrame()

int StreamReassembleForFrame ( TcpSession ssn,
TcpStream stream,
StreamReassembleRawFunc  Callback,
void *  cb_data,
const uint64_t  offset,
const bool  eof 
)

Definition at line 1892 of file stream-tcp-reassemble.c.

References SCLogDebug, and STREAM_APP_PROGRESS.

◆ StreamReassembleLog()

int StreamReassembleLog ( const TcpSession ssn,
const TcpStream stream,
StreamReassembleRawFunc  Callback,
void *  cb_data,
const uint64_t  progress_in,
uint64_t *  progress_out,
const bool  eof 
)

◆ StreamReassembleRaw()

int StreamReassembleRaw ( TcpSession ssn,
const Packet p,
StreamReassembleRawFunc  Callback,
void *  cb_data,
uint64_t *  progress_out,
bool  respect_inspect_depth 
)

Definition at line 1904 of file stream-tcp-reassemble.c.

References StreamTcpInlineMode().

Referenced by DetectEngineInspectStreamPayload().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamReassembleRawUpdateProgress()

void StreamReassembleRawUpdateProgress ( TcpSession ssn,
Packet p,
const uint64_t  progress 
)

update stream engine after detection

Tasked with progressing the 'progress' for Raw reassembly. 2 main scenario's:

  1. progress is != 0, so we use this
  2. progress is 0, meaning the detect engine didn't touch raw at all. In this case we need to look into progressing raw anyway.

Additionally, this function is tasked with disabling raw reassembly if the app-layer requested to disable it.

Definition at line 1555 of file stream-tcp-reassemble.c.

References TcpSession_::client, DEBUG_VALIDATE_BUG_ON, TcpStream_::flags, TcpSession_::flags, PKT_IS_TOSERVER, TcpStream_::raw_progress_rel, TcpSession_::server, STREAM_APP_PROGRESS, STREAM_RAW_PROGRESS, STREAMTCP_FLAG_APP_LAYER_DISABLED, and STREAMTCP_STREAM_FLAG_TRIGGER_RAW.

◆ StreamTcp()

TmEcode StreamTcp ( ThreadVars ,
Packet ,
void *  ,
PacketQueueNoLock  
)

◆ StreamTcpBypassEnabled()

int StreamTcpBypassEnabled ( void  )

Definition at line 7126 of file stream-tcp.c.

References TcpStreamCnf_::flags, stream_config, and STREAMTCP_INIT_FLAG_BYPASS.

◆ StreamTcpCheckMemcap()

int StreamTcpCheckMemcap ( uint64_t  size)

Check if alloc'ing "size" would mean we're over memcap.

Return values
1if in bounds
0if not in bounds

Definition at line 266 of file stream-tcp.c.

References SC_ATOMIC_GET, and stream_config.

◆ StreamTcpDecrMemuse()

void StreamTcpDecrMemuse ( uint64_t  )

Definition at line 234 of file stream-tcp.c.

References BUG_ON, RunmodeIsUnittests(), SC_ATOMIC_GET, SC_ATOMIC_SUB, SCLogDebug, and StreamTcpMemuseCounter().

Here is the call graph for this function:

◆ StreamTcpDetectLogFlush()

void StreamTcpDetectLogFlush ( ThreadVars tv,
StreamTcpThread stt,
Flow f,
Packet p,
PacketQueueNoLock pq 
)

create packets in both directions to flush out logging and detection before switching protocols. In IDS mode, create first in packet dir, 2nd in opposing In IPS mode, do the reverse. Flag TCP engine that data needs to be inspected regardless of how far we are wrt inspect limits.

Definition at line 6960 of file stream-tcp.c.

References TcpSession_::client, TcpStream_::flags, PKT_IS_TOSERVER, Flow_::protoctx, TcpSession_::server, STREAMTCP_STREAM_FLAG_TRIGGER_RAW, StreamTcpInlineMode(), and ts.

Here is the call graph for this function:

◆ StreamTcpFreeConfig()

void StreamTcpFreeConfig ( bool  )

Definition at line 859 of file stream-tcp.c.

References SCMutexLock, and StreamTcpReassembleFree().

Referenced by StreamTcpUTDeinit().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamTcpGetMemcap()

uint64_t StreamTcpGetMemcap ( void  )

Return memcap value.

Parameters
memcapmemcap value

Definition at line 294 of file stream-tcp.c.

References SC_ATOMIC_GET, and stream_config.

◆ StreamTcpGetUsable()

uint64_t StreamTcpGetUsable ( const TcpStream stream,
const bool  eof 
)

Definition at line 427 of file stream-tcp-reassemble.c.

Referenced by FrameJsonLogOneFrame().

Here is the caller graph for this function:

◆ StreamTcpIncrMemuse()

void StreamTcpIncrMemuse ( uint64_t  )

Definition at line 228 of file stream-tcp.c.

References SC_ATOMIC_ADD, SCLogDebug, and StreamTcpMemuseCounter().

Here is the call graph for this function:

◆ StreamTcpInitConfig()

◆ StreamTcpInitMemuse()

void StreamTcpInitMemuse ( void  )

Definition at line 223 of file stream-tcp.c.

References SC_ATOMIC_INIT.

Referenced by UtRunTests().

Here is the caller graph for this function:

◆ StreamTcpInlineMode()

bool StreamTcpInlineMode ( void  )

See if stream engine is operating in inline mode.

Return values
0no
1yes

Definition at line 7137 of file stream-tcp.c.

References TcpStreamCnf_::flags, stream_config, and STREAMTCP_INIT_FLAG_INLINE.

Referenced by StreamDataRightEdge(), StreamReassembleRaw(), StreamReassembleRawHasDataReady(), and StreamTcpDetectLogFlush().

Here is the caller graph for this function:

◆ StreamTcpMemuseCounter()

uint64_t StreamTcpMemuseCounter ( void  )

Definition at line 254 of file stream-tcp.c.

References SC_ATOMIC_GET.

Referenced by StreamTcpDecrMemuse(), and StreamTcpIncrMemuse().

Here is the caller graph for this function:

◆ StreamTcpPacket()

int StreamTcpPacket ( ThreadVars tv,
Packet p,
StreamTcpThread stt,
PacketQueueNoLock pq 
)

◆ StreamTcpReassembleConfigEnableOverlapCheck()

void StreamTcpReassembleConfigEnableOverlapCheck ( void  )

Definition at line 40 of file stream-tcp-list.c.

◆ StreamTcpRegisterTests()

void StreamTcpRegisterTests ( void  )

Definition at line 3405 of file stream-tcp.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ StreamTcpSegmentForEach()

int StreamTcpSegmentForEach ( const Packet p,
uint8_t  flag,
StreamSegmentCallback  CallbackFunc,
void *  data 
)

◆ StreamTcpSegmentForSession()

int StreamTcpSegmentForSession ( const Packet p,
uint8_t  flag,
StreamSegmentCallback  CallbackFunc,
void *  data 
)

Run callback function on each TCP segment in both directions of a session.

Note
when stream engine is running in inline mode all segments are used, in IDS/non-inline mode only ack'd segments are iterated.
Must be called under flow lock.
Returns
-1 in case of error, the number of segment in case of success

Definition at line 7043 of file stream-tcp.c.

References TcpSession_::client, cnt, Packet_::flow, TcpSegment::pcap_hdr_storage, Flow_::protoctx, RB_MIN, TcpStream_::sb, TcpSegment::sbseg, SCLogDebug, SCTIME_CMP_LT, TcpStream_::seg_tree, TcpSession_::server, StreamingBufferSegmentGetData(), and TcpSegmentPcapHdrStorage_::ts.

Referenced by StreamSegmentForSession().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamTcpSessionCleanup()

void StreamTcpSessionCleanup ( TcpSession ssn)

Session cleanup function. Does not free the ssn.

Parameters
ssntcp session

Definition at line 327 of file stream-tcp.c.

References TcpSession_::client, SCEnter, TcpSession_::server, and StreamTcpStreamCleanup().

Referenced by StreamTcpSessionClear(), StreamTcpUTClearSession(), and UTHRemoveSessionFromFlow().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamTcpSessionClear()

void StreamTcpSessionClear ( void *  ssnptr)

Function to return the stream back to the pool. It returns the segments in the stream to the segment pool.

This function is called when the flow is destroyed, so it should free everything related to the tcp session. So including the app layer data.

Parameters
ssnVoid ptr to the ssn.

Definition at line 351 of file stream-tcp.c.

References pool_id, TcpSession_::pool_id, SCEnter, SCMutexLock, StreamTcpSessionCleanup(), and StreamTcpThreadCacheReturnSession().

Here is the call graph for this function:

◆ StreamTcpSessionPktFree()

void StreamTcpSessionPktFree ( Packet p)

Function to return the stream segments back to the pool.

Parameters
pPacket used to identify the stream.

Definition at line 380 of file stream-tcp.c.

References TcpSession_::client, Packet_::flow, Flow_::protoctx, SCEnter, SCReturn, TcpSession_::server, and StreamTcpReturnStreamSegments().

Here is the call graph for this function:

◆ StreamTcpSetMemcap()

int StreamTcpSetMemcap ( uint64_t  size)

Update memcap value.

Parameters
sizenew memcap value

Definition at line 279 of file stream-tcp.c.

References SC_ATOMIC_GET, SC_ATOMIC_SET, and stream_config.

◆ StreamTcpSsnStateAsString()

const char* StreamTcpSsnStateAsString ( const TcpSession ssn)

Definition at line 7191 of file stream-tcp.c.

References TcpSession_::state, and StreamTcpStateAsString().

Here is the call graph for this function:

◆ StreamTcpStateAsString()

const char* StreamTcpStateAsString ( const enum  TcpState)

Definition at line 7150 of file stream-tcp.c.

References TCP_CLOSE_WAIT, TCP_CLOSED, TCP_CLOSING, TCP_ESTABLISHED, TCP_FIN_WAIT1, TCP_FIN_WAIT2, TCP_LAST_ACK, TCP_NONE, TCP_SYN_RECV, TCP_SYN_SENT, and TCP_TIME_WAIT.

Referenced by StreamTcpSsnStateAsString().

Here is the caller graph for this function:

◆ StreamTcpStreamCleanup()

void StreamTcpStreamCleanup ( TcpStream stream)

Definition at line 300 of file stream-tcp.c.

References TcpStream_::sb, TcpStreamCnf_::sbcnf, stream_config, StreamingBufferClear(), StreamTcpReturnStreamSegments(), and StreamTcpSackFreeList().

Referenced by StreamTcpSessionCleanup(), and StreamTcpUTClearStream().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ StreamTcpThreadDeinit()

TmEcode StreamTcpThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 6102 of file stream-tcp.c.

References StreamTcpThread_::ra_ctx, SCEnter, SCFree, SCReturnInt, StreamTcpReassembleFreeThreadCtx(), and TM_ECODE_OK.

Here is the call graph for this function:

◆ StreamTcpThreadInit()

◆ StreamTcpUpdateAppLayerProgress()

void StreamTcpUpdateAppLayerProgress ( TcpSession ssn,
char  direction,
const uint32_t  progress 
)

update reassembly progress

Parameters
ssnTCP Session
directiondirection to set the flag in: 0 toserver, 1 toclient

Definition at line 6708 of file stream-tcp.c.

References TcpStream_::app_progress_rel, TcpSession_::client, SCLogDebug, TcpSession_::server, and STREAM_APP_PROGRESS.

◆ TcpSessionPacketSsnReuse()

bool TcpSessionPacketSsnReuse ( const Packet p,
const Flow f,
const void *  tcp_ssn 
)

Definition at line 5960 of file stream-tcp.c.

References Packet_::proto.

◆ TcpSessionSetReassemblyDepth()

void TcpSessionSetReassemblyDepth ( TcpSession ssn,
uint32_t  size 
)

Definition at line 7143 of file stream-tcp.c.

References TcpSession_::reassembly_depth.

Variable Documentation

◆ stream_config