Merge pull request #3010 in SNORT/snort3 from ~MASHASAN/snort3:skip_old_segment to...

Squashed commit of the following:

commit c5482358cf1437daeab531673b1f96cb96580ea3
Author: Masud Hasan <mashasan@cisco.com>
Date:   Sat Jul 24 23:54:31 2021 -0400

    stream_tcp: Skip unordered segments if last flushed position already moved past

diff --git a/src/stream/tcp/segment_overlap_editor.cc b/src/stream/tcp/segment_overlap_editor.cc
index b0b8ad07c9d184d99b3808a8bc9bfe9e304448a4..a36439addfd68f26a073ef7c66cbba4211ae7a73 100644 (file)
--- a/src/stream/tcp/segment_overlap_editor.cc
+++ b/src/stream/tcp/segment_overlap_editor.cc
@@ -48,7 +48,6 @@ void SegmentOverlapState::init_sos(TcpSession* ssn, StreamPolicy pol)
     total_bytes_queued = 0;
     total_segs_queued = 0;
     overlap_count = 0;
-    scan_total = 0;
 
     tsd = nullptr;
     left = nullptr;

diff --git a/src/stream/tcp/segment_overlap_editor.h b/src/stream/tcp/segment_overlap_editor.h
index f3a213b4f862c1fccaaf4f83ed483e30e4abb7b1..530deacd087516f11fcf53aed29aa72bc5945656 100644 (file)
--- a/src/stream/tcp/segment_overlap_editor.h
+++ b/src/stream/tcp/segment_overlap_editor.h
@@ -47,7 +47,6 @@ struct SegmentOverlapState
     uint32_t total_bytes_queued;    /* total bytes queued (life of session) */
     uint32_t total_segs_queued;     /* number of segments queued (life) */
     uint32_t overlap_count;         /* overlaps encountered */
-    uint32_t scan_total;
 
     uint32_t seq;
     uint32_t seq_end;

diff --git a/src/stream/tcp/tcp_reassembler.cc b/src/stream/tcp/tcp_reassembler.cc
index d31d17d047328a99a2ac6536ff11d242a83b9a66..0d65f31821e00d62be659b4029894122f6498ec6 100644 (file)
--- a/src/stream/tcp/tcp_reassembler.cc
+++ b/src/stream/tcp/tcp_reassembler.cc
@@ -1193,6 +1193,12 @@ void TcpReassembler::insert_segment_in_seglist(
 
     if ( trs.sos.keep_segment )
     {
+        if ( !trs.sos.left and trs.sos.right and
+            paf_initialized(&trs.paf_state) and trs.paf_state.pos > tsd.get_seq() )
+        {
+            return;
+        }
+
         /* Adjust slide so that is correct relative to orig seq */
         trs.sos.slide = trs.sos.seq - tsd.get_seq();
         // FIXIT-L for some reason length - slide - trunc_len is sometimes negative