Pull request #4032: stream_tcp: update rcv_nxt appropriately after each segment

Merge in SNORT/snort3 from ~JALIIMRA/snort3:update_rcv_nxt to master

Squashed commit of the following:

commit d04ba2b4f24c2f035509b4801e60a98d9452fbcb
Author: Juweria Ali Imran <jaliimra@cisco.com>
Date:   Fri Sep 29 16:58:49 2023 -0400

    stream_tcp: update rcv_nxt appropriately for each segment

diff --git a/src/stream/tcp/tcp_reassembler.cc b/src/stream/tcp/tcp_reassembler.cc
index 043426263c08e20ff217f8c80292ce5c4909e7e5..4f19145b76d4b15719a5ade469498929f8330e82 100644 (file)
--- a/src/stream/tcp/tcp_reassembler.cc
+++ b/src/stream/tcp/tcp_reassembler.cc
@@ -922,6 +922,7 @@ int32_t TcpReassembler::scan_data_pre_ack(TcpReassemblerState& trs, uint32_t* fl
         if (flush_pt >= 0)
         {
             trs.sos.seglist.cur_sseg = tsn;
+            update_rcv_nxt(trs, *tsn);
             return flush_pt;
         }
 
@@ -936,6 +937,7 @@ int32_t TcpReassembler::scan_data_pre_ack(TcpReassemblerState& trs, uint32_t* fl
     }
 
     trs.sos.seglist.cur_sseg = tsn;
+    update_rcv_nxt(trs, *tsn);
     return ret_val;
 }
 
@@ -1003,6 +1005,16 @@ void TcpReassembler::check_first_segment_hole(TcpReassemblerState& trs)
         }
 }
 
+void TcpReassembler::update_rcv_nxt(TcpReassemblerState& trs, TcpSegmentNode& tsn)
+{
+    uint32_t temp = (tsn.i_seq + tsn.i_len);
+
+    if (!trs.tracker->ooo_packet_seen and SEQ_LT(trs.tracker->rcv_nxt, temp))
+        trs.tracker->ooo_packet_seen = true;
+
+    trs.tracker->rcv_nxt = temp;
+}
+
 bool TcpReassembler::has_seglist_hole(TcpReassemblerState& trs, TcpSegmentNode& tsn, PAF_State& ps,
     uint32_t& total, uint32_t& flags)
 {

diff --git a/src/stream/tcp/tcp_reassembler.h b/src/stream/tcp/tcp_reassembler.h
index 4177953a1e9805da911da5bf0a05486def9717b0..9e4d5ade93787a5738891415ef8bb692bb4ae52e 100644 (file)
--- a/src/stream/tcp/tcp_reassembler.h
+++ b/src/stream/tcp/tcp_reassembler.h
@@ -101,6 +101,7 @@ protected:
     void update_next(TcpReassemblerState&, const TcpSegmentNode&);
     void update_skipped_bytes(uint32_t, TcpReassemblerState&);
     void check_first_segment_hole(TcpReassemblerState&);
+    void update_rcv_nxt(TcpReassemblerState&, TcpSegmentNode&);
     bool has_seglist_hole(TcpReassemblerState&, TcpSegmentNode&, PAF_State&, uint32_t& total,
         uint32_t& flags);
     void skip_seglist_hole(TcpReassemblerState&, snort::Packet*, uint32_t flags,

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 5df70791c48f5e9f9c8e581015b40a947d5572c0..67f9f67cedcbe8412f7b8d637fecb9cc4a4c5e3c 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -172,6 +172,9 @@ void TcpSession::clear_session(bool free_flow_data, bool flush_segments, bool re
     tcp_init = false;
     tcpStats.released++;
 
+    client.ooo_packet_seen = false;
+    server.ooo_packet_seen = false;
+
     if ( flush_segments )
     {
         client.reassembler.flush_queued_segments(flow, true, p);
@@ -455,7 +458,7 @@ void TcpSession::update_stream_order(const TcpSegmentDescriptor& tsd, bool align
             if ( !(flow->get_session_flags() & SSNFLAG_STREAM_ORDER_BAD) )
                 flow->set_session_flags(SSNFLAG_STREAM_ORDER_BAD);
             tsd.set_packet_flags(PKT_STREAM_ORDER_BAD);
-         }
+        }
     }
 }
 
@@ -494,7 +497,7 @@ int TcpSession::process_tcp_data(TcpSegmentDescriptor& tsd)
 
         if ( tsd.is_data_segment() )
         {
-            update_stream_order(tsd, true);
+            update_stream_order(tsd, !listener->ooo_packet_seen);
             process_tcp_stream(tsd);
             return STREAM_ALIGNED;
         }

diff --git a/src/stream/tcp/tcp_stream_tracker.h b/src/stream/tcp/tcp_stream_tracker.h
index 14dfba8768db4af9a614de2cc5176d2cdf397cb7..1267c404856dc1c948a648638c83842db5abc1d2 100644 (file)
--- a/src/stream/tcp/tcp_stream_tracker.h
+++ b/src/stream/tcp/tcp_stream_tracker.h
@@ -331,6 +331,7 @@ public:
     bool client_tracker;
     bool require_3whs = false;
     bool rst_pkt_sent = false;
+    bool ooo_packet_seen = false;
 
 // FIXIT-L make these non-public
 public: