/** Flag to indicate that this session is possible trying to evade the detection
* (http://www.packetstan.com/2010/06/recently-ive-been-on-campaign-to-make.html) */
#define STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT 0x0200
-/** Flag to indicate that this stream direction has reassembled chunks */
-#define STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED 0x0400
/** Flag to indicate the client (SYN pkt) permits SACK */
-#define STREAMTCP_FLAG_CLIENT_SACKOK 0x0800
+#define STREAMTCP_FLAG_CLIENT_SACKOK 0x0400
/** Flag to indicate both sides of the session permit SACK (SYN + SYN/ACK) */
-#define STREAMTCP_FLAG_SACKOK 0x1000
+#define STREAMTCP_FLAG_SACKOK 0x0800
/** Flag for triggering RAW reassembly before the size limit is reached or
the stream reaches EOF. */
-#define STREAMTCP_FLAG_TRIGGER_RAW_REASSEMBLY 0x2000
+#define STREAMTCP_FLAG_TRIGGER_RAW_REASSEMBLY 0x1000
/*
* Per STREAM flags
NULL, 0, flags|STREAM_EOF);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
- /* even if app layer detection failed, we will now move on to
- * release reassembly for both directions. */
- ssn->flags |= STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED;
-
} else {
SCLogDebug("no segments in the list to reassemble");
}
/* set a GAP flag and make sure not bothering this stream anymore */
SCLogDebug("set STREAMTCP_STREAM_FLAG_GAP flag");
stream->flags |= STREAMTCP_STREAM_FLAG_GAP;
- /* flag reassembly as started, so the to_client part can start */
- ssn->flags |= STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED;
StreamTcpSetEvent(p, STREAM_REASSEMBLY_SEQ_GAP);
SCPerfCounterIncr(ra_ctx->counter_tcp_reass_gap, tv->sc_perf_pca);
data_sent += data_len;
}
- if (ssn->flags & STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED) {
- SCLogDebug("proto detection already completed");
- ssn->flags |= STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED;
- } else {
- SCLogDebug("protocol detection not yet completed");
- }
-
if (data_sent == 0 && ssn->state > TCP_ESTABLISHED) {
SCLogDebug("sending empty eof message");
/* send EOF to app layer */
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
NULL, 0, flags|STREAM_EOF);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
-
- /* even if app layer detection failed, we will now move on to
- * release reassembly for both directions. */
- ssn->flags |= STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED;
}
/* store ra_base_seq in the stream */
NULL, 0, flags|STREAM_EOF);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
- /* even if app layer detection failed, we will now move on to
- * release reassembly for both directions. */
- ssn->flags |= STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED;
-
SCReturnInt(0);
}
}
/* set a GAP flag and make sure not bothering this stream anymore */
SCLogDebug("STREAMTCP_STREAM_FLAG_GAP set");
stream->flags |= STREAMTCP_STREAM_FLAG_GAP;
- /* flag reassembly as started, so the to_client part can start */
- ssn->flags |= STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED;
StreamTcpSetEvent(p, STREAM_REASSEMBLY_SEQ_GAP);
SCPerfCounterIncr(ra_ctx->counter_tcp_reass_gap, tv->sc_perf_pca);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
}
- if (ssn->flags & STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED) {
- SCLogDebug("proto detection already completed");
- ssn->flags |= STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED;
- } else {
- SCLogDebug("protocol detection not yet completed");
- }
-
/* store ra_base_seq in the stream */
if ((ssn->flags & STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED)) {
stream->ra_app_base_seq = ra_base_seq;
{
SCEnter();
SCLogDebug("start p %p", p);
-#if 0
- if (PKT_IS_TOSERVER(p) &&
- !(ssn->flags & STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED))
- {
- SCLogDebug("toserver reassembling is not done yet, so "
- "skipping reassembling at the moment for to_client");
- SCReturnInt(0);
- }
-#endif
+
if (stream->seg_list == NULL) {
/* send an empty EOF msg if we have no segments but TCP state
* is beyond ESTABLISHED */
StreamTcpSetupMsg(ssn, stream, p, smsg);
StreamMsgPutInQueue(ra_ctx->stream_q,smsg);
- /* even if app layer detection failed, we will now move on to
- * release reassembly for both directions. */
- ssn->flags |= STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED;
-
} else {
SCLogDebug("no segments in the list to reassemble");
}