From: Juweria Ali Imran (jaliimra) <jaliimra@cisco.com>
Date: Mon, 9 Oct 2023 19:59:13 +0000 (+0000)
Subject: Pull request #4032: stream_tcp: update rcv_nxt appropriately after each segment
X-Git-Tag: 3.1.72.0~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5745ba8e55b081cf1e056dbc81858fb2e6e37e92;p=thirdparty%2Fsnort3.git

Pull request #4032: stream_tcp: update rcv_nxt appropriately after each segment

Merge in SNORT/snort3 from ~JALIIMRA/snort3:update_rcv_nxt to master

Squashed commit of the following:

commit d04ba2b4f24c2f035509b4801e60a98d9452fbcb
Author: Juweria Ali Imran <jaliimra@cisco.com>
Date:   Fri Sep 29 16:58:49 2023 -0400

    stream_tcp: update rcv_nxt appropriately for each segment
---

diff --git a/src/stream/tcp/tcp_reassembler.cc b/src/stream/tcp/tcp_reassembler.cc
index 043426263..4f19145b7 100644
--- a/src/stream/tcp/tcp_reassembler.cc
+++ b/src/stream/tcp/tcp_reassembler.cc
@@ -922,6 +922,7 @@ int32_t TcpReassembler::scan_data_pre_ack(TcpReassemblerState& trs, uint32_t* fl
         if (flush_pt >= 0)
         {
             trs.sos.seglist.cur_sseg = tsn;
+            update_rcv_nxt(trs, *tsn);
             return flush_pt;
         }
 
@@ -936,6 +937,7 @@ int32_t TcpReassembler::scan_data_pre_ack(TcpReassemblerState& trs, uint32_t* fl
     }
 
     trs.sos.seglist.cur_sseg = tsn;
+    update_rcv_nxt(trs, *tsn);
     return ret_val;
 }
 
@@ -1003,6 +1005,16 @@ void TcpReassembler::check_first_segment_hole(TcpReassemblerState& trs)
         }
 }
 
+void TcpReassembler::update_rcv_nxt(TcpReassemblerState& trs, TcpSegmentNode& tsn)
+{
+    uint32_t temp = (tsn.i_seq + tsn.i_len);
+
+    if (!trs.tracker->ooo_packet_seen and SEQ_LT(trs.tracker->rcv_nxt, temp))
+        trs.tracker->ooo_packet_seen = true;
+
+    trs.tracker->rcv_nxt = temp;
+}
+
 bool TcpReassembler::has_seglist_hole(TcpReassemblerState& trs, TcpSegmentNode& tsn, PAF_State& ps,
     uint32_t& total, uint32_t& flags)
 {
diff --git a/src/stream/tcp/tcp_reassembler.h b/src/stream/tcp/tcp_reassembler.h
index 4177953a1..9e4d5ade9 100644
--- a/src/stream/tcp/tcp_reassembler.h
+++ b/src/stream/tcp/tcp_reassembler.h
@@ -101,6 +101,7 @@ protected:
     void update_next(TcpReassemblerState&, const TcpSegmentNode&);
     void update_skipped_bytes(uint32_t, TcpReassemblerState&);
     void check_first_segment_hole(TcpReassemblerState&);
+    void update_rcv_nxt(TcpReassemblerState&, TcpSegmentNode&);
     bool has_seglist_hole(TcpReassemblerState&, TcpSegmentNode&, PAF_State&, uint32_t& total,
         uint32_t& flags);
     void skip_seglist_hole(TcpReassemblerState&, snort::Packet*, uint32_t flags,
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 5df70791c..67f9f67ce 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -172,6 +172,9 @@ void TcpSession::clear_session(bool free_flow_data, bool flush_segments, bool re
     tcp_init = false;
     tcpStats.released++;
 
+    client.ooo_packet_seen = false;
+    server.ooo_packet_seen = false;
+
     if ( flush_segments )
     {
         client.reassembler.flush_queued_segments(flow, true, p);
@@ -455,7 +458,7 @@ void TcpSession::update_stream_order(const TcpSegmentDescriptor& tsd, bool align
             if ( !(flow->get_session_flags() & SSNFLAG_STREAM_ORDER_BAD) )
                 flow->set_session_flags(SSNFLAG_STREAM_ORDER_BAD);
             tsd.set_packet_flags(PKT_STREAM_ORDER_BAD);
-         }
+        }
     }
 }
 
@@ -494,7 +497,7 @@ int TcpSession::process_tcp_data(TcpSegmentDescriptor& tsd)
 
         if ( tsd.is_data_segment() )
         {
-            update_stream_order(tsd, true);
+            update_stream_order(tsd, !listener->ooo_packet_seen);
             process_tcp_stream(tsd);
             return STREAM_ALIGNED;
         }
diff --git a/src/stream/tcp/tcp_stream_tracker.h b/src/stream/tcp/tcp_stream_tracker.h
index 14dfba876..1267c4048 100644
--- a/src/stream/tcp/tcp_stream_tracker.h
+++ b/src/stream/tcp/tcp_stream_tracker.h
@@ -331,6 +331,7 @@ public:
     bool client_tracker;
     bool require_3whs = false;
     bool rst_pkt_sent = false;
+    bool ooo_packet_seen = false;
 
 // FIXIT-L make these non-public
 public: