suricata
stream-tcp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
23  */
24 
25 #ifndef __STREAM_TCP_H__
26 #define __STREAM_TCP_H__
27 
28 #include "stream-tcp-private.h"
29 
30 #include "stream.h"
31 #include "stream-tcp-reassemble.h"
32 #include "suricata.h"
33 
34 #define STREAM_VERBOSE false
35 /* Flag to indicate that the checksum validation for the stream engine
36  has been enabled */
37 #define STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION BIT_U8(0)
38 #define STREAMTCP_INIT_FLAG_DROP_INVALID BIT_U8(1)
39 #define STREAMTCP_INIT_FLAG_BYPASS BIT_U8(2)
40 #define STREAMTCP_INIT_FLAG_INLINE BIT_U8(3)
41 
42 /*global flow data*/
43 typedef struct TcpStreamCnf_ {
44  /** stream tracking
45  *
46  * max stream mem usage
47  */
48  SC_ATOMIC_DECLARE(uint64_t, memcap);
49  SC_ATOMIC_DECLARE(uint64_t, reassembly_memcap); /**< max memory usage for stream reassembly */
50 
51  uint16_t stream_init_flags; /**< new stream flags will be initialized to this */
52 
53  /* coccinelle: TcpStreamCnf:flags:STREAMTCP_INIT_ */
54  uint8_t flags;
56 
57  uint32_t prealloc_sessions; /**< ssns to prealloc per stream thread */
58  uint32_t prealloc_segments; /**< segments to prealloc per stream thread */
59  bool midstream;
61  uint32_t reassembly_depth; /**< Depth until when we reassemble the stream */
62 
65 
67 
71 
74 
75 typedef struct StreamTcpThread_ {
77 
78  /** queue for pseudo packet(s) that were created in the stream
79  * process and need further handling. Currently only used when
80  * receiving (valid) RST packets */
82 
85  /** sessions not picked up because memcap was reached */
89  /** pseudo packets processed */
91  /** pseudo packets failed to setup */
93  /** packets rejected because their csum is invalid */
95  /** TCP packets with no associated flow */
97  /** sessions reused */
99  /** syn pkts */
100  uint16_t counter_tcp_syn;
101  /** syn/ack pkts */
103  /** rst pkts */
104  uint16_t counter_tcp_rst;
105  /** midstream pickups */
107  /** wrong thread */
109 
110  /** tcp reassembly thread data */
113 
115 void StreamTcpInitConfig(bool);
116 void StreamTcpFreeConfig(bool);
117 void StreamTcpRegisterTests (void);
118 
120 
121 void StreamTcpInitMemuse(void);
122 void StreamTcpIncrMemuse(uint64_t);
123 void StreamTcpDecrMemuse(uint64_t);
124 int StreamTcpSetMemcap(uint64_t);
125 uint64_t StreamTcpGetMemcap(void);
126 int StreamTcpCheckMemcap(uint64_t);
127 uint64_t StreamTcpMemuseCounter(void);
129 
130 Packet *StreamTcpPseudoSetup(Packet *, uint8_t *, uint32_t);
131 
132 int StreamTcpSegmentForEach(const Packet *p, uint8_t flag,
133  StreamSegmentCallback CallbackFunc,
134  void *data);
136  const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data);
138 void TcpSessionSetReassemblyDepth(TcpSession *ssn, uint32_t size);
139 
140 typedef int (*StreamReassembleRawFunc)(
141  void *data, const uint8_t *input, const uint32_t input_len, const uint64_t offset);
142 
144  void *cb_data, const uint64_t offset, const bool eof);
145 int StreamReassembleLog(TcpSession *ssn, TcpStream *stream,
146  StreamReassembleRawFunc Callback, void *cb_data,
147  uint64_t progress_in,
148  uint64_t *progress_out, bool eof);
149 int StreamReassembleRaw(TcpSession *ssn, const Packet *p,
150  StreamReassembleRawFunc Callback, void *cb_data,
151  uint64_t *progress_out, bool respect_inspect_depth);
152 void StreamReassembleRawUpdateProgress(TcpSession *ssn, Packet *p, uint64_t progress);
153 
155 
156 const char *StreamTcpStateAsString(const enum TcpState);
157 const char *StreamTcpSsnStateAsString(const TcpSession *ssn);
158 
159 /** ------- Inline functions: ------ */
160 
161 /**
162  * \brief If we are on IPS mode, and got a drop action triggered from
163  * the IP only module, or from a reassembled msg and/or from an
164  * applayer detection, then drop the rest of the packets of the
165  * same stream and avoid inspecting it any further
166  * \param p pointer to the Packet to check
167  * \retval 1 if we must drop this stream
168  * \retval 0 if the stream still legal
169  */
170 static inline int StreamTcpCheckFlowDrops(Packet *p)
171 {
172  /* If we are on IPS mode, and got a drop action triggered from
173  * the IP only module, or from a reassembled msg and/or from an
174  * applayer detection, then drop the rest of the packets of the
175  * same stream and avoid inspecting it any further */
176  if (EngineModeIsIPS() && (p->flow->flags & FLOW_ACTION_DROP))
177  return 1;
178 
179  return 0;
180 }
181 
182 enum {
183  /* stream has no segments for forced reassembly, nor for detection */
185  /* stream has no segments for forced reassembly, but only segments that
186  * have been sent for detection, but are stuck in the detection queues */
188 };
189 
191 uint8_t StreamNeedsReassembly(const TcpSession *ssn, uint8_t direction);
192 TmEcode StreamTcpThreadInit(ThreadVars *, void *, void **);
194 
196  PacketQueueNoLock *pq);
197 /* clear ssn and return to pool */
198 void StreamTcpSessionClear(void *ssnptr);
199 /* cleanup ssn, but don't free ssn */
201 /* cleanup stream, but don't free the stream */
202 void StreamTcpStreamCleanup(TcpStream *stream);
203 /* check if bypass is enabled */
204 int StreamTcpBypassEnabled(void);
206 int StreamTcpInlineMode(void);
207 
208 int TcpSessionPacketSsnReuse(const Packet *p, const Flow *f, const void *tcp_ssn);
209 
210 void StreamTcpUpdateAppLayerProgress(TcpSession *ssn, char direction,
211  const uint32_t progress);
212 
213 uint64_t StreamTcpGetAcked(const TcpStream *stream);
214 uint64_t StreamTcpGetUsable(const TcpStream *stream, const bool eof);
215 
216 void StreamTcpThreadCacheEnable(void);
217 void StreamTcpThreadCacheCleanup(void);
218 
219 #endif /* __STREAM_TCP_H__ */
220 
StreamReassembleRawFunc
int(* StreamReassembleRawFunc)(void *data, const uint8_t *input, const uint32_t input_len, const uint64_t offset)
Definition: stream-tcp.h:140
StreamTcpThread_::counter_tcp_midstream_pickups
uint16_t counter_tcp_midstream_pickups
Definition: stream-tcp.h:106
StreamSegmentCallback
int(* StreamSegmentCallback)(const Packet *, TcpSegment *, void *, const uint8_t *, uint32_t)
Definition: stream.h:36
TcpStream_
Definition: stream-tcp-private.h:106
TcpStreamCnf_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(uint64_t, memcap)
StreamTcpPacket
int StreamTcpPacket(ThreadVars *tv, Packet *p, StreamTcpThread *stt, PacketQueueNoLock *pq)
Definition: stream-tcp.c:4950
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
TcpStreamCnf
struct TcpStreamCnf_ TcpStreamCnf
StreamTcpSegmentForEach
int StreamTcpSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data)
Definition: stream-tcp.c:6423
StreamTcpDecrMemuse
void StreamTcpDecrMemuse(uint64_t)
Definition: stream-tcp.c:131
StreamTcpCheckMemcap
int StreamTcpCheckMemcap(uint64_t)
Check if alloc'ing "size" would mean we're over memcap.
Definition: stream-tcp.c:164
StreamTcpReassembleConfigEnableOverlapCheck
void StreamTcpReassembleConfigEnableOverlapCheck(void)
Definition: stream-tcp-list.c:40
StreamTcpThread_
Definition: stream-tcp.h:75
StreamTcpThread_::counter_tcp_reused_ssn
uint16_t counter_tcp_reused_ssn
Definition: stream-tcp.h:98
TcpStreamCnf_::reassembly_depth
uint32_t reassembly_depth
Definition: stream-tcp.h:61
Flow_
Flow data structure.
Definition: flow.h:356
TcpStreamCnf_::flags
uint8_t flags
Definition: stream-tcp.h:54
StreamTcpThread_::counter_tcp_ssn_from_cache
uint16_t counter_tcp_ssn_from_cache
Definition: stream-tcp.h:87
StreamTcpThread_::counter_tcp_sessions
uint16_t counter_tcp_sessions
Definition: stream-tcp.h:84
StreamTcpPseudoSetup
Packet * StreamTcpPseudoSetup(Packet *, uint8_t *, uint32_t)
Function to fetch a packet from the packet allocation queue for creation of the pseudo packet from th...
Definition: stream-tcp.c:6161
TcpStreamCnf_::async_oneside
int async_oneside
Definition: stream-tcp.h:60
StreamReassembleRaw
int StreamReassembleRaw(TcpSession *ssn, const Packet *p, StreamReassembleRawFunc Callback, void *cb_data, uint64_t *progress_out, bool respect_inspect_depth)
Definition: stream-tcp-reassemble.c:1829
TcpStreamCnf_::sbcnf
StreamingBufferConfig sbcnf
Definition: stream-tcp.h:72
StreamTcpMemuseCounter
uint64_t StreamTcpMemuseCounter(void)
Definition: stream-tcp.c:152
StreamTcpGetAcked
uint64_t StreamTcpGetAcked(const TcpStream *stream)
Definition: stream-tcp-reassemble.c:405
StreamTcpGetMemcap
uint64_t StreamTcpGetMemcap(void)
Return memcap value.
Definition: stream-tcp.c:192
StreamTcpSessionPktFree
void StreamTcpSessionPktFree(Packet *)
Function to return the stream segments back to the pool.
Definition: stream-tcp.c:279
stream-tcp-reassemble.h
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:66
TcpStreamCnf_
Definition: stream-tcp.h:43
TcpStreamCnf_::streaming_log_api
bool streaming_log_api
Definition: stream-tcp.h:66
TcpStreamCnf_::midstream_policy
enum ExceptionPolicy midstream_policy
Definition: stream-tcp.h:70
StreamTcpSessionClear
void StreamTcpSessionClear(void *ssnptr)
Function to return the stream back to the pool. It returns the segments in the stream to the segment ...
Definition: stream-tcp.c:245
PacketQueueNoLock_
simple fifo queue for packets
Definition: packet-queue.h:34
StreamTcpInlineDropInvalid
int StreamTcpInlineDropInvalid(void)
See if stream engine is dropping invalid packet in inline mode.
Definition: stream-tcp.c:335
StreamReassembleRawUpdateProgress
void StreamReassembleRawUpdateProgress(TcpSession *ssn, Packet *p, uint64_t progress)
update stream engine after detection
Definition: stream-tcp-reassemble.c:1463
TcpState
TcpState
Definition: stream-tcp-private.h:149
StreamTcpThread_::counter_tcp_ssn_memcap
uint16_t counter_tcp_ssn_memcap
Definition: stream-tcp.h:86
TcpStreamCnf_::ssn_memcap_policy
enum ExceptionPolicy ssn_memcap_policy
Definition: stream-tcp.h:68
STREAM_HAS_UNPROCESSED_SEGMENTS_NONE
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NONE
Definition: stream-tcp.h:184
StreamTcpThread_::counter_tcp_synack
uint16_t counter_tcp_synack
Definition: stream-tcp.h:102
StreamTcpBypassEnabled
int StreamTcpBypassEnabled(void)
Definition: stream-tcp.c:6565
StreamTcpIncrMemuse
void StreamTcpIncrMemuse(uint64_t)
Definition: stream-tcp.c:124
StreamTcpThreadInit
TmEcode StreamTcpThreadInit(ThreadVars *, void *, void **)
Definition: stream-tcp.c:5404
StreamTcpThread_::counter_tcp_wrong_thread
uint16_t counter_tcp_wrong_thread
Definition: stream-tcp.h:108
StreamTcpThread_::counter_tcp_invalid_checksum
uint16_t counter_tcp_invalid_checksum
Definition: stream-tcp.h:94
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
StreamTcpUpdateAppLayerProgress
void StreamTcpUpdateAppLayerProgress(TcpSession *ssn, char direction, const uint32_t progress)
update reassembly progress
Definition: stream-tcp.c:6072
StreamTcpThread_::counter_tcp_rst
uint16_t counter_tcp_rst
Definition: stream-tcp.h:104
StreamTcpStreamCleanup
void StreamTcpStreamCleanup(TcpStream *stream)
Definition: stream-tcp.c:198
STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
@ STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION
Definition: stream-tcp.h:187
StreamTcpThread_::counter_tcp_syn
uint16_t counter_tcp_syn
Definition: stream-tcp.h:100
ExceptionPolicy
ExceptionPolicy
Definition: util-exception-policy.h:27
stream.h
StreamTcpDetectLogFlush
void StreamTcpDetectLogFlush(ThreadVars *tv, StreamTcpThread *stt, Flow *f, Packet *p, PacketQueueNoLock *pq)
create packets in both directions to flush out logging and detection before switching protocols....
Definition: stream-tcp.c:6399
TcpStreamCnf_::max_synack_queued
uint8_t max_synack_queued
Definition: stream-tcp.h:55
Packet_
Definition: decode.h:428
StreamTcpReassembleMemuseGlobalCounter
uint64_t StreamTcpReassembleMemuseGlobalCounter(void)
Definition: stream-tcp-reassemble.c:148
stream-tcp-private.h
StreamTcpRegisterTests
void StreamTcpRegisterTests(void)
Definition: stream-tcp.c:3405
TcpSessionSetReassemblyDepth
void TcpSessionSetReassemblyDepth(TcpSession *ssn, uint32_t size)
Definition: stream-tcp.c:6582
TmEcode
TmEcode
Definition: tm-threads-common.h:83
StreamTcpSessionCleanup
void StreamTcpSessionCleanup(TcpSession *ssn)
Session cleanup function. Does not free the ssn.
Definition: stream-tcp.c:211
StreamTcpThread_::counter_tcp_ssn_from_pool
uint16_t counter_tcp_ssn_from_pool
Definition: stream-tcp.h:88
StreamTcpThreadCacheCleanup
void StreamTcpThreadCacheCleanup(void)
Definition: stream-tcp-cache.c:134
StreamReassembleForFrame
int StreamReassembleForFrame(TcpSession *ssn, TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, const uint64_t offset, const bool eof)
Definition: stream-tcp-reassemble.c:1817
TcpSessionPacketSsnReuse
int TcpSessionPacketSsnReuse(const Packet *p, const Flow *f, const void *tcp_ssn)
Definition: stream-tcp.c:5351
TcpStreamCnf_::reassembly_memcap_policy
enum ExceptionPolicy reassembly_memcap_policy
Definition: stream-tcp.h:69
StreamTcp
TmEcode StreamTcp(ThreadVars *, Packet *, void *, PacketQueueNoLock *)
Definition: stream-tcp.c:5363
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:361
StreamTcpThread_::counter_tcp_pseudo_failed
uint16_t counter_tcp_pseudo_failed
Definition: stream-tcp.h:92
Packet_::flow
struct Flow_ * flow
Definition: decode.h:465
StreamTcpThreadCacheEnable
void StreamTcpThreadCacheEnable(void)
enable segment cache. Should only be done for worker threads
Definition: stream-tcp-cache.c:48
StreamTcpSsnStateAsString
const char * StreamTcpSsnStateAsString(const TcpSession *ssn)
Definition: stream-tcp.c:6632
StreamTcpStateAsString
const char * StreamTcpStateAsString(const enum TcpState)
Definition: stream-tcp.c:6591
StreamReassembleLog
int StreamReassembleLog(TcpSession *ssn, TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, uint64_t progress_in, uint64_t *progress_out, bool eof)
Definition: stream-tcp-reassemble.c:1894
StreamTcpThread_::counter_tcp_active_sessions
uint16_t counter_tcp_active_sessions
Definition: stream-tcp.h:83
TcpStreamCnf_::prealloc_sessions
uint32_t prealloc_sessions
Definition: stream-tcp.h:57
stream_config
TcpStreamCnf stream_config
Definition: stream-tcp.c:115
TcpStreamCnf_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(uint64_t, reassembly_memcap)
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
StreamTcpInlineMode
int StreamTcpInlineMode(void)
See if stream engine is operating in inline mode.
Definition: stream-tcp.c:6576
StreamTcpThreadDeinit
TmEcode StreamTcpThreadDeinit(ThreadVars *tv, void *data)
Definition: stream-tcp.c:5476
TcpStreamCnf_::midstream
bool midstream
Definition: stream-tcp.h:59
TcpStreamCnf_::reassembly_toclient_chunk_size
uint16_t reassembly_toclient_chunk_size
Definition: stream-tcp.h:64
StreamingBufferConfig_
Definition: util-streaming-buffer.h:64
StreamTcpInitMemuse
void StreamTcpInitMemuse(void)
Definition: stream-tcp.c:119
StreamTcpThread
struct StreamTcpThread_ StreamTcpThread
StreamTcpThread_::counter_tcp_no_flow
uint16_t counter_tcp_no_flow
Definition: stream-tcp.h:96
StreamTcpGetUsable
uint64_t StreamTcpGetUsable(const TcpStream *stream, const bool eof)
Definition: stream-tcp-reassemble.c:410
StreamTcpSetMemcap
int StreamTcpSetMemcap(uint64_t)
Update memcap value.
Definition: stream-tcp.c:177
Flow_::flags
uint32_t flags
Definition: flow.h:434
StreamTcpThread_::counter_tcp_pseudo
uint16_t counter_tcp_pseudo
Definition: stream-tcp.h:90
StreamTcpThread_::ra_ctx
TcpReassemblyThreadCtx * ra_ctx
Definition: stream-tcp.h:111
TcpStreamCnf_::stream_init_flags
uint16_t stream_init_flags
Definition: stream-tcp.h:51
TcpReassemblyThreadCtx_
Definition: stream-tcp-reassemble.h:59
StreamTcpSegmentForSession
int StreamTcpSegmentForSession(const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data)
Run callback function on each TCP segment in both directions of a session.
Definition: stream-tcp.c:6482
TcpStreamCnf_::prealloc_segments
uint32_t prealloc_segments
Definition: stream-tcp.h:58
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:213
suricata.h
StreamTcpThread_::pseudo_queue
PacketQueueNoLock pseudo_queue
Definition: stream-tcp.h:81
TcpSession_
Definition: stream-tcp-private.h:272
StreamTcpThread_::ssn_pool_id
int ssn_pool_id
Definition: stream-tcp.h:76
StreamNeedsReassembly
uint8_t StreamNeedsReassembly(const TcpSession *ssn, uint8_t direction)
see what if any work the TCP session still needs
Definition: stream-tcp-reassemble.c:882
TcpStreamCnf_::reassembly_toserver_chunk_size
uint16_t reassembly_toserver_chunk_size
Definition: stream-tcp.h:63
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool)
Definition: stream-tcp.c:669