suricata
stream-tcp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
23  */
24 
25 #ifndef __STREAM_TCP_H__
26 #define __STREAM_TCP_H__
27 
28 #include "stream-tcp-private.h"
29 
30 #include "stream.h"
31 #include "stream-tcp-reassemble.h"
32 
33 #define STREAM_VERBOSE FALSE
34 /* Flag to indicate that the checksum validation for the stream engine
35  has been enabled */
36 #define STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION BIT_U8(0)
37 #define STREAMTCP_INIT_FLAG_DROP_INVALID BIT_U8(1)
38 #define STREAMTCP_INIT_FLAG_BYPASS BIT_U8(2)
39 #define STREAMTCP_INIT_FLAG_INLINE BIT_U8(3)
40 
41 /*global flow data*/
42 typedef struct TcpStreamCnf_ {
43  /** stream tracking
44  *
45  * max stream mem usage
46  */
47  SC_ATOMIC_DECLARE(uint64_t, memcap);
48  SC_ATOMIC_DECLARE(uint64_t, reassembly_memcap); /**< max memory usage for stream reassembly */
49 
50  uint16_t stream_init_flags; /**< new stream flags will be initialized to this */
51 
52  /* coccinelle: TcpStreamCnf:flags:STREAMTCP_INIT_ */
53  uint8_t flags;
55 
56  uint32_t prealloc_sessions; /**< ssns to prealloc per stream thread */
57  uint32_t prealloc_segments; /**< segments to prealloc per stream thread */
58  int midstream;
60  uint32_t reassembly_depth; /**< Depth until when we reassemble the stream */
61 
64 
66 
68 } TcpStreamCnf;
69 
70 typedef struct StreamTcpThread_ {
72 
73  /** queue for pseudo packet(s) that were created in the stream
74  * process and need further handling. Currently only used when
75  * receiving (valid) RST packets */
77 
79  /** sessions not picked up because memcap was reached */
81  /** pseudo packets processed */
83  /** pseudo packets failed to setup */
85  /** packets rejected because their csum is invalid */
87  /** TCP packets with no associated flow */
89  /** sessions reused */
91  /** syn pkts */
92  uint16_t counter_tcp_syn;
93  /** syn/ack pkts */
95  /** rst pkts */
96  uint16_t counter_tcp_rst;
97  /** midstream pickups */
99  /** wrong thread */
101 
102  /** tcp reassembly thread data */
105 
107 void StreamTcpInitConfig (char);
108 void StreamTcpFreeConfig(char);
109 void StreamTcpRegisterTests (void);
110 
112 
113 void StreamTcpInitMemuse(void);
114 void StreamTcpIncrMemuse(uint64_t);
115 void StreamTcpDecrMemuse(uint64_t);
116 int StreamTcpSetMemcap(uint64_t);
117 uint64_t StreamTcpGetMemcap(void);
118 int StreamTcpCheckMemcap(uint64_t);
119 uint64_t StreamTcpMemuseCounter(void);
121 
122 Packet *StreamTcpPseudoSetup(Packet *, uint8_t *, uint32_t);
123 
124 int StreamTcpSegmentForEach(const Packet *p, uint8_t flag,
125  StreamSegmentCallback CallbackFunc,
126  void *data);
128 void TcpSessionSetReassemblyDepth(TcpSession *ssn, uint32_t size);
129 
130 typedef int (*StreamReassembleRawFunc)(void *data, const uint8_t *input, const uint32_t input_len);
131 
132 int StreamReassembleLog(TcpSession *ssn, TcpStream *stream,
133  StreamReassembleRawFunc Callback, void *cb_data,
134  uint64_t progress_in,
135  uint64_t *progress_out, bool eof);
136 int StreamReassembleRaw(TcpSession *ssn, const Packet *p,
137  StreamReassembleRawFunc Callback, void *cb_data,
138  uint64_t *progress_out, bool respect_inspect_depth);
139 void StreamReassembleRawUpdateProgress(TcpSession *ssn, Packet *p, uint64_t progress);
140 
142 
143 
144 /** ------- Inline functions: ------ */
145 
146 /**
147  * \brief If we are on IPS mode, and got a drop action triggered from
148  * the IP only module, or from a reassembled msg and/or from an
149  * applayer detection, then drop the rest of the packets of the
150  * same stream and avoid inspecting it any further
151  * \param p pointer to the Packet to check
152  * \retval 1 if we must drop this stream
153  * \retval 0 if the stream still legal
154  */
155 static inline int StreamTcpCheckFlowDrops(Packet *p)
156 {
157  /* If we are on IPS mode, and got a drop action triggered from
158  * the IP only module, or from a reassembled msg and/or from an
159  * applayer detection, then drop the rest of the packets of the
160  * same stream and avoid inspecting it any further */
161  if (EngineModeIsIPS() && (p->flow->flags & FLOW_ACTION_DROP))
162  return 1;
163 
164  return 0;
165 }
166 
167 enum {
168  /* stream has no segments for forced reassembly, nor for detection */
170  /* stream has no segments for forced reassembly, but only segments that
171  * have been sent for detection, but are stuck in the detection queues */
173 };
174 
176 int StreamNeedsReassembly(const TcpSession *ssn, uint8_t direction);
177 TmEcode StreamTcpThreadInit(ThreadVars *, void *, void **);
178 TmEcode StreamTcpThreadDeinit(ThreadVars *tv, void *data);
179 void StreamTcpRegisterTests (void);
180 
182  PacketQueue *pq);
183 /* clear ssn and return to pool */
184 void StreamTcpSessionClear(void *ssnptr);
185 /* cleanup ssn, but don't free ssn */
187 /* cleanup stream, but don't free the stream */
188 void StreamTcpStreamCleanup(TcpStream *stream);
189 /* check if bypass is enabled */
190 int StreamTcpBypassEnabled(void);
192 int StreamTcpInlineMode(void);
193 
194 int TcpSessionPacketSsnReuse(const Packet *p, const Flow *f, const void *tcp_ssn);
195 
196 #endif /* __STREAM_TCP_H__ */
197 
int async_oneside
Definition: stream-tcp.h:59
void StreamTcpRegisterTests(void)
Definition: stream-tcp.c:10788
uint16_t counter_tcp_synack
Definition: stream-tcp.h:94
void StreamTcpDecrMemuse(uint64_t)
Definition: stream-tcp.c:135
uint16_t counter_tcp_no_flow
Definition: stream-tcp.h:88
struct Flow_ * flow
Definition: decode.h:445
SC_ATOMIC_DECLARE(uint64_t, memcap)
TcpStreamCnf stream_config
Definition: stream-tcp.h:106
int StreamTcpPacket(ThreadVars *tv, Packet *p, StreamTcpThread *stt, PacketQueue *pq)
Definition: stream-tcp.c:4707
void StreamTcpStreamCleanup(TcpStream *stream)
Definition: stream-tcp.c:202
#define FLOW_ACTION_DROP
Definition: flow.h:64
uint16_t counter_tcp_wrong_thread
Definition: stream-tcp.h:100
int(* StreamReassembleRawFunc)(void *data, const uint8_t *input, const uint32_t input_len)
Definition: stream-tcp.h:130
uint16_t counter_tcp_rst
Definition: stream-tcp.h:96
void StreamTcpInitMemuse(void)
Definition: stream-tcp.c:123
void StreamTcpSessionClear(void *ssnptr)
Function to return the stream back to the pool. It returns the segments in the stream to the segment ...
Definition: stream-tcp.c:249
int TcpSessionPacketSsnReuse(const Packet *p, const Flow *f, const void *tcp_ssn)
Definition: stream-tcp.c:5124
void StreamTcpSessionPktFree(Packet *)
Function to return the stream segments back to the pool.
Definition: stream-tcp.c:283
uint16_t counter_tcp_ssn_memcap
Definition: stream-tcp.h:80
int EngineModeIsIPS(void)
Definition: suricata.c:245
struct TcpStreamCnf_ TcpStreamCnf
uint16_t counter_tcp_invalid_checksum
Definition: stream-tcp.h:86
TmEcode StreamTcp(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *)
Definition: stream-tcp.c:5136
int StreamTcpBypassEnabled(void)
Definition: stream-tcp.c:6302
void StreamTcpFreeConfig(char)
Definition: stream-tcp.c:669
int StreamNeedsReassembly(const TcpSession *ssn, uint8_t direction)
see what if any work the TCP session still needs
TcpReassemblyThreadCtx * ra_ctx
Definition: stream-tcp.h:103
uint16_t reassembly_toclient_chunk_size
Definition: stream-tcp.h:63
uint8_t max_synack_queued
Definition: stream-tcp.h:54
int StreamReassembleLog(TcpSession *ssn, TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, uint64_t progress_in, uint64_t *progress_out, bool eof)
PacketQueue pseudo_queue
Definition: stream-tcp.h:76
void StreamReassembleRawUpdateProgress(TcpSession *ssn, Packet *p, uint64_t progress)
update stream engine after detection
TmEcode StreamTcpThreadDeinit(ThreadVars *tv, void *data)
Definition: stream-tcp.c:5239
int StreamTcpInlineMode(void)
See if stream engine is operating in inline mode.
Definition: stream-tcp.c:6313
void StreamTcpIncrMemuse(uint64_t)
Definition: stream-tcp.c:128
uint16_t counter_tcp_sessions
Definition: stream-tcp.h:78
int StreamReassembleRaw(TcpSession *ssn, const Packet *p, StreamReassembleRawFunc Callback, void *cb_data, uint64_t *progress_out, bool respect_inspect_depth)
uint16_t reassembly_toserver_chunk_size
Definition: stream-tcp.h:62
void TcpSessionSetReassemblyDepth(TcpSession *ssn, uint32_t size)
Definition: stream-tcp.c:6319
uint32_t reassembly_depth
Definition: stream-tcp.h:60
int StreamTcpInlineDropInvalid(void)
See if stream engine is dropping invalid packet in inline mode.
Definition: stream-tcp.c:339
uint16_t stream_init_flags
Definition: stream-tcp.h:50
int StreamTcpSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data)
Run callback function on each TCP segment.
Definition: stream-tcp.c:6258
uint64_t StreamTcpMemuseCounter(void)
Definition: stream-tcp.c:156
int StreamTcpCheckMemcap(uint64_t)
Check if alloc&#39;ing "size" would mean we&#39;re over memcap.
Definition: stream-tcp.c:168
void StreamTcpReassembleConfigEnableOverlapCheck(void)
struct StreamTcpThread_ StreamTcpThread
uint16_t counter_tcp_reused_ssn
Definition: stream-tcp.h:90
uint16_t counter_tcp_midstream_pickups
Definition: stream-tcp.h:98
int StreamTcpSetMemcap(uint64_t)
Update memcap value.
Definition: stream-tcp.c:181
Packet * StreamTcpPseudoSetup(Packet *, uint8_t *, uint32_t)
Function to fetch a packet from the packet allocation queue for creation of the pseudo packet from th...
Definition: stream-tcp.c:5883
bool streaming_log_api
Definition: stream-tcp.h:65
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
uint32_t prealloc_segments
Definition: stream-tcp.h:57
uint8_t flags
Definition: stream-tcp.h:53
uint64_t StreamTcpReassembleMemuseGlobalCounter(void)
TmEcode StreamTcpThreadInit(ThreadVars *, void *, void **)
Definition: stream-tcp.c:5172
void StreamTcpSessionCleanup(TcpSession *ssn)
Session cleanup function. Does not free the ssn.
Definition: stream-tcp.c:215
uint16_t counter_tcp_pseudo
Definition: stream-tcp.h:82
StreamingBufferConfig sbcnf
Definition: stream-tcp.h:67
uint64_t StreamTcpGetMemcap(void)
Return memcap value.
Definition: stream-tcp.c:196
Per thread variable structure.
Definition: threadvars.h:57
void StreamTcpDetectLogFlush(ThreadVars *tv, StreamTcpThread *stt, Flow *f, Packet *p, PacketQueue *pq)
create packets in both directions to flush out logging and detection before switching protocols...
Definition: stream-tcp.c:6236
uint32_t prealloc_sessions
Definition: stream-tcp.h:56
uint16_t counter_tcp_syn
Definition: stream-tcp.h:92
Flow data structure.
Definition: flow.h:325
uint32_t flags
Definition: flow.h:379
uint16_t counter_tcp_pseudo_failed
Definition: stream-tcp.h:84
int(* StreamSegmentCallback)(const Packet *, void *, const uint8_t *, uint32_t)
Definition: stream.h:38