Pull request #4243: stream: count retransmits when we disable content rules

Merge in SNORT/snort3 from ~MMATIRKO/snort3:rexmit to master

Squashed commit of the following:

commit 338821c3170cf12362c666cc0eb98f9291de268c
Author: Michael Matirko <mmatirko@cisco.com>
Date:   Wed Mar 13 15:28:23 2024 -0400

    stream: count retransmits when we disable content rules

diff --git a/src/stream/tcp/segment_overlap_editor.cc b/src/stream/tcp/segment_overlap_editor.cc
index 9896a0d954d76246eab3e7f9b039c24aa1478fa8..d6377a5af038ef25b7f1d29aec495c31fd5e7f67 100644 (file)
--- a/src/stream/tcp/segment_overlap_editor.cc
+++ b/src/stream/tcp/segment_overlap_editor.cc
@@ -154,6 +154,8 @@ void SegmentOverlapEditor::eval_right(TcpReassemblerState& trs)
                 trs.sos.tsd->set_retransmit_flag();
                 snort::DetectionEngine::disable_content(trs.sos.tsd->get_pkt());
                 trs.sos.keep_segment = false;
+                tcpStats.full_retransmits++;
+
             }
             else
             {
@@ -173,7 +175,11 @@ void SegmentOverlapEditor::eval_right(TcpReassemblerState& trs)
             if ( is_segment_retransmit(trs, &full_retransmit) )
             {
                 if ( full_retransmit )
+                {
+                    tcpStats.full_retransmits++;
                     break;
+                }
+
                 continue;
             }
 

diff --git a/src/stream/tcp/tcp_module.cc b/src/stream/tcp/tcp_module.cc
index 49ece67d950e32a3a3843a0ceffa8ef1bb6e2022..dea8b90dd9dc6971a2829de8db4be63b419b3dd6 100644 (file)
--- a/src/stream/tcp/tcp_module.cc
+++ b/src/stream/tcp/tcp_module.cc
@@ -117,6 +117,7 @@ const PegInfo tcp_pegs[] =
     { CountType::SUM, "zero_len_tcp_opt", "number of zero length tcp options" },
     { CountType::SUM, "zero_win_probes", "number of tcp zero window probes" },
     { CountType::SUM, "proxy_mode_flows", "number of flows set to proxy normalization policy" },
+    { CountType::SUM, "full_retransmits", "number of fully retransmitted segments" },
     { CountType::END, nullptr, nullptr }
 };
 

diff --git a/src/stream/tcp/tcp_module.h b/src/stream/tcp/tcp_module.h
index 3188ffc39eeacbe0249d6ad8b1b393a652309c5e..242c09fb4303e707926a1037e45ba22e47aca2fe 100644 (file)
--- a/src/stream/tcp/tcp_module.h
+++ b/src/stream/tcp/tcp_module.h
@@ -117,6 +117,7 @@ struct TcpStats
     PegCount zero_len_tcp_opt;
     PegCount zero_win_probes;
     PegCount proxy_mode_flows;
+    PegCount full_retransmits;
 };
 
 extern THREAD_LOCAL struct TcpStats tcpStats;