From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Fri, 9 Oct 2015 17:38:39 +0000 (-0400)
Subject: Merge pull request #70 in SNORT/snort3 from crc/cleanup to master
X-Git-Tag: 3.0.0-233~796
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4286e9cb3b3db91e31e9966d0614d650fd0edb47;p=thirdparty%2Fsnort3.git

Merge pull request #70 in SNORT/snort3 from crc/cleanup to master

Squashed commit of the following:

commit 5b3501d68c43a3fcccd456986ff8a462dc18dec4
Author: russ <russ@localhost.localdomain>
Date:   Fri Oct 9 11:34:22 2015 -0400

    -- build 173
    -- update change log
    -- added pkt_num rule option to extras
    -- fix final -> finalize changes for extras
    -- moved alert_unixsock and log_null to extras
    -- removed duplicate pat_stats source from extras
    -- prevent tcp session restart on rebuilt packets
       thanks to rmkml for reporting the issue

    update change log
---

diff --git a/ChangeLog b/ChangeLog
index 496d2c3c4..370101bae 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,20 @@
+15/10/09 - build 173
+
+-- added pkt_num rule option to extras
+-- fix final -> finalize changes for extras
+-- moved alert_unixsock and log_null to extras
+-- removed duplicate pat_stats source from extras
+-- prevent tcp session restart on rebuilt packets
+   thanks to rmkml for reporting the issue
+-- fixed profiler configuration
+-- fixed ppm event logging
+-- added filename to reload commands
+-- fixed -B switch
+-- reverted tcp syn only logic to match 2X
+-- ensure ip6 extension decoder state is reset for ip4 too since ip4
+   packets may have ip6 next proto
+-- update default manuals
+
 15/10/01 - build 172
 
 -- check for bool value before setting fastpath config option in PPM
diff --git a/extra/src/ips_options/CMakeLists.txt b/extra/src/ips_options/CMakeLists.txt
index 859f7acdf..1fd7a2bf2 100644
--- a/extra/src/ips_options/CMakeLists.txt
+++ b/extra/src/ips_options/CMakeLists.txt
@@ -1,5 +1,6 @@
 
 add_example_library(ips_urg ips_options ips_urg.cc)
+add_example_library(ips_pkt_num ips_options ips_pkt_num.cc)
 
 install (
     FILES find.lua
diff --git a/extra/src/ips_options/Makefile.am b/extra/src/ips_options/Makefile.am
index 68b12c412..081b6a1a5 100644
--- a/extra/src/ips_options/Makefile.am
+++ b/extra/src/ips_options/Makefile.am
@@ -1,6 +1,12 @@
 
 optlibdir = $(pkglibdir)/ips_options
-optlib_LTLIBRARIES = libips_urg.la
+
+optlib_LTLIBRARIES = libips_pkt_num.la
+libips_pkt_num_la_CXXFLAGS = $(AM_CXXFLAGS)
+libips_pkt_num_la_LDFLAGS = -export-dynamic -shared
+libips_pkt_num_la_SOURCES = ips_pkt_num.cc
+
+optlib_LTLIBRARIES += libips_urg.la
 libips_urg_la_CXXFLAGS = $(AM_CXXFLAGS)
 libips_urg_la_LDFLAGS = -export-dynamic -shared
 libips_urg_la_SOURCES = ips_urg.cc
diff --git a/extra/src/ips_options/ips_pkt_num.cc b/extra/src/ips_options/ips_pkt_num.cc
new file mode 100644
index 000000000..d3d5fafe0
--- /dev/null
+++ b/extra/src/ips_options/ips_pkt_num.cc
@@ -0,0 +1,202 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+
+// ips_pkt_num.cc author Russ Combs <rucombs@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <stdlib.h>
+#include <ctype.h>
+
+#include "main/snort_types.h"
+#include "main/thread.h"
+#include "detection/detection_defines.h"
+#include "detection/treenodes.h"
+#include "framework/ips_option.h"
+#include "framework/module.h"
+#include "framework/parameter.h"
+#include "framework/range.h"
+#include "hash/sfhashfcn.h"
+#include "protocols/packet.h"
+#include "protocols/tcp.h"
+#include "time/profiler.h"
+#include "utils/stats.h"
+
+static const char* s_name = "pkt_num";
+static const char* s_help = "alert on raw packet number";
+
+static THREAD_LOCAL ProfileStats pkt_num_perf_stats;
+
+//-------------------------------------------------------------------------
+// option
+//-------------------------------------------------------------------------
+
+class PktNumOption : public IpsOption
+{
+public:
+    PktNumOption(const RangeCheck& c) : IpsOption(s_name)
+    { config = c; }
+
+    uint32_t hash() const override;
+    bool operator==(const IpsOption&) const override;
+
+    int eval(Cursor&, Packet*) override;
+
+private:
+    RangeCheck config;
+};
+
+uint32_t PktNumOption::hash() const
+{
+    uint32_t a, b, c;
+
+    a = config.op;
+    b = config.min;
+    c = config.max;
+
+    mix_str(a,b,c,get_name());
+    finalize(a,b,c);
+
+    return c;
+}
+
+bool PktNumOption::operator==(const IpsOption& ips) const
+{
+    if ( strcmp(s_name, ips.get_name()) )
+        return false;
+
+    PktNumOption& rhs = (PktNumOption&)ips;
+    return ( config == rhs.config );
+}
+
+int PktNumOption::eval(Cursor&, Packet*)
+{
+    PROFILE_VARS;
+    MODULE_PROFILE_START(pkt_num_perf_stats);
+
+    int rval;
+
+    if ( config.eval(pc.total_from_daq) )
+        rval = DETECTION_OPTION_MATCH;
+
+    else
+        rval = DETECTION_OPTION_NO_MATCH;
+
+    MODULE_PROFILE_END(pkt_num_perf_stats);
+    return rval;
+}
+
+//-------------------------------------------------------------------------
+// module
+//-------------------------------------------------------------------------
+
+static const Parameter s_params[] =
+{
+    { "~range", Parameter::PT_STRING, nullptr, nullptr,
+      "check if packet number is in given range" },
+
+    { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+class PktNumModule : public Module
+{
+public:
+    PktNumModule() : Module(s_name, s_help, s_params) { }
+
+    bool begin(const char*, int, SnortConfig*) override;
+    bool set(const char*, Value&, SnortConfig*) override;
+
+    ProfileStats* get_profile() const override
+    { return &pkt_num_perf_stats; }
+
+    RangeCheck data;
+};
+
+bool PktNumModule::begin(const char*, int, SnortConfig*)
+{
+    data.init();
+    return true;
+}
+
+bool PktNumModule::set(const char*, Value& v, SnortConfig*)
+{
+    if ( !v.is("~range") )
+        return false;
+
+    return data.parse(v.get_string());
+}
+
+//-------------------------------------------------------------------------
+// api methods
+//-------------------------------------------------------------------------
+
+static Module* mod_ctor()
+{
+    return new PktNumModule;
+}
+
+static void mod_dtor(Module* m)
+{
+    delete m;
+}
+
+static IpsOption* pkt_num_ctor(Module* p, OptTreeNode*)
+{
+    PktNumModule* m = (PktNumModule*)p;
+    return new PktNumOption(m->data);
+}
+
+static void pkt_num_dtor(IpsOption* p)
+{
+    delete p;
+}
+
+static const IpsApi pkt_num_api =
+{
+    {
+        PT_IPS_OPTION,
+        sizeof(IpsApi),
+        IPSAPI_VERSION,
+        0,
+        API_RESERVED,
+        API_OPTIONS,
+        s_name,
+        s_help,
+        mod_ctor,
+        mod_dtor
+    },
+    OPT_TYPE_DETECTION,
+    1, PROTO_BIT__TCP,
+    nullptr, // pinit
+    nullptr, // pterm
+    nullptr, // tinit
+    nullptr, // tterm
+    pkt_num_ctor,
+    pkt_num_dtor,
+    nullptr
+};
+
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+    &pkt_num_api.base,
+    nullptr
+};
+
diff --git a/extra/src/ips_options/ips_urg.cc b/extra/src/ips_options/ips_urg.cc
index b414aa400..f5fdb6c6c 100644
--- a/extra/src/ips_options/ips_urg.cc
+++ b/extra/src/ips_options/ips_urg.cc
@@ -72,7 +72,7 @@ uint32_t TcpUrgOption::hash() const
     c = config.max;
 
     mix_str(a,b,c,get_name());
-    final(a,b,c);
+    finalize(a,b,c);
 
     return c;
 }
diff --git a/extra/src/loggers/CMakeLists.txt b/extra/src/loggers/CMakeLists.txt
index bbe037765..b05e6a2a6 100644
--- a/extra/src/loggers/CMakeLists.txt
+++ b/extra/src/loggers/CMakeLists.txt
@@ -1,5 +1,7 @@
 
 add_example_library(alert_ex loggers alert_ex.cc)
+add_example_library(alert_unixsock loggers alert_unixsock.cc)
+add_example_library(log_null loggers log_null.cc)
 
 install (
     FILES alert.lua
diff --git a/extra/src/loggers/Makefile.am b/extra/src/loggers/Makefile.am
index 0f3e46f1e..43ddafc46 100644
--- a/extra/src/loggers/Makefile.am
+++ b/extra/src/loggers/Makefile.am
@@ -6,6 +6,16 @@ libalert_ex_la_CXXFLAGS = $(AM_CXXFLAGS)
 libalert_ex_la_LDFLAGS = -export-dynamic -shared
 libalert_ex_la_SOURCES = alert_ex.cc
 
+loglib_LTLIBRARIES += libalert_unixsock.la
+libalert_unixsock_la_CXXFLAGS = $(AM_CXXFLAGS)
+libalert_unixsock_la_LDFLAGS = -export-dynamic -shared
+libalert_unixsock_la_SOURCES = alert_unixsock.cc
+
+loglib_LTLIBRARIES += liblog_null.la
+liblog_null_la_CXXFLAGS = $(AM_CXXFLAGS)
+liblog_null_la_LDFLAGS = -export-dynamic -shared
+liblog_null_la_SOURCES = log_null.cc
+
 dist_loglib_SCRIPTS = alert.lua
 
 AM_CXXFLAGS = @AM_CXXFLAGS@
diff --git a/src/loggers/alert_unixsock.cc b/extra/src/loggers/alert_unixsock.cc
similarity index 94%
rename from src/loggers/alert_unixsock.cc
rename to extra/src/loggers/alert_unixsock.cc
index 551527c81..0def72553 100644
--- a/src/loggers/alert_unixsock.cc
+++ b/extra/src/loggers/alert_unixsock.cc
@@ -35,11 +35,10 @@
 #include "main/snort_debug.h"
 #include "framework/logger.h"
 #include "framework/module.h"
+#include "detection/signature.h"
 #include "events/event.h"
 #include "protocols/packet.h"
-#include "parser/parser.h"
 #include "utils/util.h"
-#include "packet_io/sfdaq.h"
 
 #define UNSOCK_FILE "snort_alert"
 
@@ -139,14 +138,11 @@ static void get_alert_pkt(
 
     if (p && p->pkt)
     {
-        uint32_t snaplen = DAQ_GetSnapLen();
-        memmove( (void*)&us.alert.pkth, (const void*)p->pkth,
-            sizeof(us.alert.pkth));
-        memmove(us.alert.pkt, (const void*)p->pkt,
-            us.alert.pkth.caplen > snaplen ? snaplen : us.alert.pkth.caplen);
+        memmove( (void*)&us.alert.pkth, (const void*)p->pkth, sizeof(us.alert.pkth));
+        memmove(us.alert.pkt, (const void*)p->pkt, us.alert.pkth.caplen);
     }
     else
-        us.alert.val|=NOPACKET_STRUCT;
+        us.alert.val |= NOPACKET_STRUCT;
 
     if (msg)
     {
@@ -298,13 +294,9 @@ static LogApi unix_sock_api
     unix_sock_dtor
 };
 
-#ifdef BUILDING_SO
 SO_PUBLIC const BaseApi* snort_plugins[] =
 {
     &unix_sock_api.base,
     nullptr
 };
-#else
-const BaseApi* alert_unix_sock = &unix_sock_api.base;
-#endif
 
diff --git a/src/loggers/log_null.cc b/extra/src/loggers/log_null.cc
similarity index 94%
rename from src/loggers/log_null.cc
rename to extra/src/loggers/log_null.cc
index 9932140cc..65401759a 100644
--- a/src/loggers/log_null.cc
+++ b/extra/src/loggers/log_null.cc
@@ -33,7 +33,7 @@
 #include "framework/module.h"
 
 #define s_name "log_null"
-#define s_help "support for null encapsulation"
+#define s_help "disable logging of packets"
 
 //-------------------------------------------------------------------------
 // log_null module
@@ -70,13 +70,9 @@ static LogApi null_api
     null_dtor
 };
 
-#ifdef BUILDING_SO
 SO_PUBLIC const BaseApi* snort_plugins[] =
 {
     &null_api.base,
     nullptr
 };
-#else
-const BaseApi* log_null = &null_api.base;
-#endif
 
diff --git a/extra/src/search_engines/Makefile.am b/extra/src/search_engines/Makefile.am
index 7feaaa4d7..c3d21923b 100644
--- a/extra/src/search_engines/Makefile.am
+++ b/extra/src/search_engines/Makefile.am
@@ -7,7 +7,6 @@ liblowmem_la_LDFLAGS = -export-dynamic -shared
 liblowmem_la_SOURCES = \
 lowmem.cc \
 lowmem_q.cc \
-pat_stats.cc \
 sfksearch.cc \
 sfksearch.h \
 trie_api.cc
diff --git a/src/framework/module.h b/src/framework/module.h
index d66407187..fb1e5d4bb 100644
--- a/src/framework/module.h
+++ b/src/framework/module.h
@@ -82,7 +82,7 @@ public:
     { return true; }
 
     virtual bool set(const char*, Value&, SnortConfig*)
-    { return !get_parameters(); }
+    { return false; }
 
     // ips events:
     virtual unsigned get_gid() const
diff --git a/src/log/messages.h b/src/log/messages.h
index acb473204..193cc1b58 100644
--- a/src/log/messages.h
+++ b/src/log/messages.h
@@ -48,7 +48,7 @@ struct ThrottleInfo
 void ErrorMessageThrottled(ThrottleInfo*,const char*, ...) __attribute__((format (printf, 2, 3)));
 
 // FIXIT-M do not call FatalError() during runtime
-NORETURN void FatalError(const char*, ...) __attribute__((format (printf, 1, 2)));
+SO_PUBLIC NORETURN void FatalError(const char*, ...) __attribute__((format (printf, 1, 2)));
 
 SO_PUBLIC void PrintPacketData(const uint8_t*, const uint32_t);
 SO_PUBLIC char* ObfuscateIpToText(const sfip_t*);
diff --git a/src/loggers/CMakeLists.txt b/src/loggers/CMakeLists.txt
index e26616769..c930e4c84 100644
--- a/src/loggers/CMakeLists.txt
+++ b/src/loggers/CMakeLists.txt
@@ -11,9 +11,7 @@ set (PLUGIN_LIST
     alert_fast.cc
     alert_full.cc
     alert_syslog.cc
-    alert_unixsock.cc
     log_hext.cc
-    log_null.cc
     log_pcap.cc
     unified2.cc
     unified2_common.h
@@ -44,9 +42,7 @@ else (STATIC_LOGGERS)
     add_shared_library(alert_fast loggers alert_fast.cc)
     add_shared_library(alert_full loggers alert_full.cc)
     add_shared_library(alert_syslog loggers alert_syslog.cc)
-    add_shared_library(alert_unixsock loggers alert_unixsock.cc)
     add_shared_library(log_hext loggers log_hext.cc)
-    add_shared_library(log_null loggers log_null.cc)
     add_shared_library(log_pcap loggers log_pcap.cc)
     add_shared_library(unified2 loggers unified2.cc unified2_common.h)
 
diff --git a/src/loggers/Makefile.am b/src/loggers/Makefile.am
index 2e4ac58b3..7af92026a 100644
--- a/src/loggers/Makefile.am
+++ b/src/loggers/Makefile.am
@@ -11,9 +11,7 @@ alert_csv.cc \
 alert_fast.cc \
 alert_full.cc \
 alert_syslog.cc \
-alert_unixsock.cc \
 log_hext.cc \
-log_null.cc \
 log_pcap.cc \
 unified2.cc \
 unified2_common.h
@@ -48,21 +46,11 @@ libalert_syslog_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
 libalert_syslog_la_LDFLAGS = -export-dynamic -shared
 libalert_syslog_la_SOURCES = alert_syslog.cc
 
-ehlib_LTLIBRARIES += libalert_unixsock.la
-libalert_unixsock_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libalert_unixsock_la_LDFLAGS = -export-dynamic -shared
-libalert_unixsock_la_SOURCES = alert_unixsock.cc
-
 ehlib_LTLIBRARIES += liblog_hext.la
 liblog_hext_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
 liblog_hext_la_LDFLAGS = -export-dynamic -shared
 liblog_hext_la_SOURCES = log_hext.cc
 
-ehlib_LTLIBRARIES += liblog_null.la
-liblog_null_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-liblog_null_la_LDFLAGS = -export-dynamic -shared
-liblog_null_la_SOURCES = log_null.cc
-
 ehlib_LTLIBRARIES += liblog_pcap.la
 liblog_pcap_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
 liblog_pcap_la_LDFLAGS = -export-dynamic -shared
diff --git a/src/loggers/loggers.cc b/src/loggers/loggers.cc
index cf50d1d0c..0eea95e87 100644
--- a/src/loggers/loggers.cc
+++ b/src/loggers/loggers.cc
@@ -37,15 +37,16 @@ extern const BaseApi* alert_csv;
 extern const BaseApi* alert_fast;
 extern const BaseApi* alert_full;
 extern const BaseApi* alert_syslog;
-extern const BaseApi* alert_unix_sock;
 extern const BaseApi* log_hext;
-extern const BaseApi* log_null;
 extern const BaseApi* log_pcap;
 extern const BaseApi* eh_unified2;
 #endif
 
 const BaseApi* loggers[] =
 {
+    // loggers
+    log_codecs,
+
 #ifdef LINUX
     alert_sf_socket,
 #endif
@@ -56,18 +57,15 @@ const BaseApi* loggers[] =
     alert_fast,
     alert_full,
     alert_syslog,
-    alert_unix_sock,
+
     // loggers
     log_hext,
-    log_null,
     log_pcap,
 
     // both
     eh_unified2,
 #endif
-    // loggers
-    log_codecs,
-    // both
+
     nullptr
 };
 
diff --git a/src/main.cc b/src/main.cc
index d199dac6d..fe3daa0c0 100644
--- a/src/main.cc
+++ b/src/main.cc
@@ -58,6 +58,7 @@ using namespace std;
 #include "control/idle_processing.h"
 #include "target_based/sftarget_reader.h"
 #include "flow/flow_control.h"
+#include "lua/lua.h"
 #include "helpers/process.h"
 #include "helpers/swapper.h"
 #include "time/profiler.h"
diff --git a/src/main/build.h b/src/main/build.h
index c86775825..da0bddd85 100644
--- a/src/main/build.h
+++ b/src/main/build.h
@@ -10,7 +10,7 @@
 //                                               //
 //-----------------------------------------------//
 
-#define BUILD "172"
+#define BUILD "173"
 
 #endif
 
diff --git a/src/main/snort.cc b/src/main/snort.cc
index 270efe6a0..f12ebe514 100644
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -687,21 +687,6 @@ void Snort::thread_term()
     Active::term();
 }
 
-void Snort::decode_rebuilt_packet(
-    Packet* p, const DAQ_PktHdr_t* pkthdr, const uint8_t* pkt,
-    Flow* lws)
-{
-    SnortEventqPush();
-    PacketManager::decode(p, pkthdr, pkt, true);
-
-    p->flow = lws;
-
-    set_policy(p);  // FIXIT-M rebuilt should reuse original bindings from flow
-
-    SnortEventqReset();
-    SnortEventqPop();
-}
-
 void Snort::detect_rebuilt_packet(Packet* p)
 {
     int tmp_do_detect = do_detect;
diff --git a/src/main/snort.h b/src/main/snort.h
index e54e41309..41180a309 100644
--- a/src/main/snort.h
+++ b/src/main/snort.h
@@ -54,7 +54,6 @@ public:
     static void thread_rotate();
 
     static void capture_packet();
-    static void decode_rebuilt_packet(Packet*, const DAQ_PktHdr_t*, const uint8_t* pkt, Flow*);
     static void detect_rebuilt_packet(Packet*);
 
     static DAQ_Verdict process_packet(
diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index 36aaecdc5..eb8fccf1f 100644
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -766,7 +766,7 @@ void InspectorManager::full_inspection(FrameworkPolicy* fp, Packet* p)
     if ( !flow->service )
         ::execute(p, fp->network.vec, fp->network.num);
 
-    else if ( flow->clouseau )
+    else if ( flow->clouseau and !p->is_cooked() )
         bumble(p);
 
     if ( !p->dsize )
diff --git a/src/search_engines/pat_stats.h b/src/search_engines/pat_stats.h
index 97564cdd2..5e41e3866 100644
--- a/src/search_engines/pat_stats.h
+++ b/src/search_engines/pat_stats.h
@@ -36,7 +36,7 @@ struct PatMatQStat
 
 extern THREAD_LOCAL PatMatQStat pmqs;
 
-void print_pat_stats(const char*, unsigned max);
+SO_PUBLIC void print_pat_stats(const char*, unsigned max);
 
 #endif
 
diff --git a/src/service_inspectors/rpc_decode/rpc_module.h b/src/service_inspectors/rpc_decode/rpc_module.h
index 2a5ca79a5..5ba20c07a 100644
--- a/src/service_inspectors/rpc_decode/rpc_module.h
+++ b/src/service_inspectors/rpc_decode/rpc_module.h
@@ -42,9 +42,6 @@ class RpcDecodeModule : public Module
 public:
     RpcDecodeModule();
 
-    bool set(const char*, Value&, SnortConfig*) override
-    { return false; }
-
     unsigned get_gid() const override
     { return GID_RPC_DECODE; }
 
diff --git a/src/service_inspectors/wizard/wizard.cc b/src/service_inspectors/wizard/wizard.cc
index 5651998e5..033400b49 100644
--- a/src/service_inspectors/wizard/wizard.cc
+++ b/src/service_inspectors/wizard/wizard.cc
@@ -129,6 +129,7 @@ MagicSplitter::~MagicSplitter()
     wizard->rem_ref();
 }
 
+// FIXIT-M stop search on hit and failure (no possible match)
 StreamSplitter::Status MagicSplitter::scan(
     Flow* f, const uint8_t* data, uint32_t len,
     uint32_t, uint32_t*)
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index f694feab8..dbfe3728c 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -2559,6 +2559,9 @@ void TcpSession::clear()
 
 void TcpSession::restart(Packet* p)
 {
+    // sanity check since this is called externally
+    assert(p->ptrs.tcph);
+
     TcpTracker* talker, *listener;
 
     if (p->packet_flags & PKT_FROM_SERVER)