SCLogConfig("stream \"midstream\" session pickups: %s", stream_config.midstream ? "enabled" : "disabled");
}
- (void)ConfGetBool("stream.async-oneside", &stream_config.async_oneside);
+ int async_oneside;
+ (void)ConfGetBool("stream.async-oneside", &async_oneside);
+ stream_config.async_oneside = async_oneside != 0;
if (!quiet) {
SCLogConfig("stream \"async-oneside\": %s", stream_config.async_oneside ? "enabled" : "disabled");
/* Drop reason will only be used if midstream policy is set to fail closed */
ExceptionPolicyApply(p, stream_config.midstream_policy, PKT_DROP_REASON_STREAM_MIDSTREAM);
- if (!stream_config.midstream && stream_config.async_oneside == FALSE) {
+ if (!stream_config.midstream && !stream_config.async_oneside) {
SCLogDebug("Midstream not enabled, so won't pick up a session");
return 0;
}
/* Handle the asynchronous stream, when we receive a SYN packet
and now instead of receiving a SYN/ACK we receive a ACK from the
same host, which sent the SYN, this suggests the ASYNC streams.*/
- if (stream_config.async_oneside == FALSE)
+ if (!stream_config.async_oneside)
return 0;
/* we are in AYNC (one side) mode now. */
/* If asynchronous stream handling is allowed then set the session,
if packet's seq number is equal the expected seq no.*/
- } else if (stream_config.async_oneside == TRUE &&
- (SEQ_EQ(TCP_GET_SEQ(p), ssn->server.next_seq)))
- {
+ } else if (stream_config.async_oneside && (SEQ_EQ(TCP_GET_SEQ(p), ssn->server.next_seq))) {
/*set the ASYNC flag used to indicate the session as async stream
and helps in relaxing the windows checks.*/
ssn->flags |= STREAMTCP_FLAG_ASYNC;
ACK number, it causes the other end to send RST. But some target
system (Linux & solaris) does not RST the connection, so it is
likely to avoid the detection */
- } else if (SEQ_EQ(TCP_GET_SEQ(p), ssn->client.next_seq)){
+ } else if (SEQ_EQ(TCP_GET_SEQ(p), ssn->client.next_seq)) {
ssn->flags |= STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT;
SCLogDebug("ssn %p: wrong ack nr on packet, possible evasion!!",
ssn);
* async and other stream is not updating it anymore :( */
StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_SEQ(p));
- } else if (SEQ_EQ(ssn->client.next_seq, TCP_GET_SEQ(p)) &&
- (stream_config.async_oneside == TRUE) &&
- (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) {
+ } else if (SEQ_EQ(ssn->client.next_seq, TCP_GET_SEQ(p)) && stream_config.async_oneside &&
+ (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) {
SCLogDebug("ssn %p: server => Asynchronous stream, packet SEQ."
" %" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 "), "
"ssn->client.last_ack %" PRIu32 ", ssn->client.next_win "
ssn->flags |= STREAMTCP_FLAG_ASYNC;
} else if (SEQ_EQ(ssn->client.last_ack, (ssn->client.isn + 1)) &&
- (stream_config.async_oneside == TRUE) &&
- (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) {
+ stream_config.async_oneside && (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) {
SCLogDebug("ssn %p: server => Asynchronous stream, packet SEQ"
" %" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 "), "
"ssn->client.last_ack %" PRIu32 ", ssn->client.next_win "
* In this case we do accept the data before last_ack if it is (partly)
* beyond next seq */
} else if (SEQ_GT(ssn->client.last_ack, ssn->client.next_seq) &&
- SEQ_GT((TCP_GET_SEQ(p)+p->payload_len),ssn->client.next_seq))
- {
+ SEQ_GT((TCP_GET_SEQ(p) + p->payload_len), ssn->client.next_seq)) {
SCLogDebug("ssn %p: PKT SEQ %"PRIu32" payload_len %"PRIu16
" before last_ack %"PRIu32", after next_seq %"PRIu32":"
" acked data that we haven't seen before",
return 1;
}
- if (stream_config.midstream || stream_config.async_oneside == TRUE) {
+ if (stream_config.midstream || stream_config.async_oneside) {
if (p->tcph->th_flags == (TH_SYN|TH_ACK)) {
SCLogDebug("packet %"PRIu64" is a midstream stream starter: %02x", p->pcap_cnt, p->tcph->th_flags);
return 1;
return TcpSessionReuseDoneEnoughSyn(p, f, ssn);
}
- if (stream_config.midstream || stream_config.async_oneside == TRUE) {
+ if (stream_config.midstream || stream_config.async_oneside) {
if (p->tcph->th_flags == (TH_SYN|TH_ACK)) {
return TcpSessionReuseDoneEnoughSynAck(p, f, ssn);
}