flush available data for atom splitter

diff --git a/ChangeLog b/ChangeLog
index f565228a3c17d2e2c6e0926995ca028ba87d06f5..2453af6b7d0f50397aa4082fdb9f33aea6b9e1b4 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,6 +20,7 @@
 -- josh fixed a decoding issue affecting fragged packets
 -- fixed byte_test config of compare value
 -- fixed byte_test endian
+-- flush available data for non-paf splitters
 
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug

diff --git a/src/stream/tcp/stream_paf.cc b/src/stream/tcp/stream_paf.cc
index 0d041c7d2ca6491a11ad8e5d8414ea95b27d8da5..c22dbdf09cd5dd2c0cdb145a959aff9816fa6e22 100644 (file)
--- a/src/stream/tcp/stream_paf.cc
+++ b/src/stream/tcp/stream_paf.cc
@@ -291,10 +291,7 @@ uint32_t s5_paf_check (
         if ( ft != FT_NOP )
         {
             fp = s5_paf_flush(ss, ps, ft, flags);
-
-            ps->pos += fp;
-            ps->seq = ps->pos;
-
+            s5_paf_jump(ps, fp);
             return fp;
         }
         if ( !cont )
@@ -315,10 +312,7 @@ uint32_t s5_paf_check (
     if ( (ps->paf != StreamSplitter::FLUSH) && (s5_len > ss->max()+fuzz) )
     {
         uint32_t fp = s5_paf_flush(ss, ps, FT_MAX, flags);
-
-        ps->pos += fp;
-        ps->seq = ps->pos;
-
+        s5_paf_jump(ps, fp);
         return fp;
     }
     return 0;

diff --git a/src/stream/tcp/stream_paf.h b/src/stream/tcp/stream_paf.h
index 68296a60730c9918d8e1b7ab9f1cfa21e1a8a841..bf6b72146217bdf709fd9b3bbcfdf5109ee43ed6 100644 (file)
--- a/src/stream/tcp/stream_paf.h
+++ b/src/stream/tcp/stream_paf.h
@@ -69,6 +69,12 @@ static inline uint32_t s5_paf_active (PAF_State* ps)
     return ( ps->paf != StreamSplitter::ABORT );
 }
 
+static inline void s5_paf_jump(PAF_State* ps, uint32_t n)
+{
+    ps->pos += n;
+    ps->seq = ps->pos;
+}
+
 // called on each in order segment
 uint32_t s5_paf_check(
     StreamSplitter* paf_config, PAF_State*, Flow* ssn,

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index dd64fde959290a5415f00cc06ec276c05b896679..3fd119a480e2947a5444de98e112c9a0b31d7401 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -5908,13 +5908,13 @@ static inline uint32_t flush_pdu_ips (
         if ( flush_pt > 0 )
         {
             MODULE_PROFILE_END(s5TcpPAFPerfStats);
-#if 0
-            // for non-paf splitters, flush_pt > 0 means we reached
-            // the minimum required, but we flush what is available 
-            // instead of creating more, but smaller, packets
+
+            // see flush_pdu_ackd()
             if ( !trk->splitter->is_paf() && avail > flush_pt )
+            {
+                s5_paf_jump(&trk->paf_state, avail - flush_pt);
                 return avail;
-#endif
+            }
             return flush_pt;
         }
         seg = seg->next;
@@ -6071,17 +6071,20 @@ static inline uint32_t flush_pdu_ackd (
         if ( flush_pt > 0 )
         {
             MODULE_PROFILE_END(s5TcpPAFPerfStats);
-#if 0
+
             // for non-paf splitters, flush_pt > 0 means we reached
             // the minimum required, but we flush what is available 
             // instead of creating more, but smaller, packets
             if ( !trk->splitter->is_paf() )
             {
-                uint32_t avail = get_q_footprint(trk);
+                // get_q_footprint() w/o side effects
+                uint32_t avail = (trk->r_win_base - trk->seglist_base_seq);
                 if ( avail > flush_pt )
+                {
+                    s5_paf_jump(&trk->paf_state, avail - flush_pt);
                     return avail;
+                }
             }
-#endif
             return flush_pt;
         }
         seg = seg->next;