From: Russ Combs <rucombs@cisco.com>
Date: Thu, 23 Oct 2014 16:58:48 +0000 (-0400)
Subject: stream flushing tweaks
X-Git-Tag: 3.0.0-233~1338
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ec7bd7a11557a89c2e8533460cfaf8b7c52a271e;p=thirdparty%2Fsnort3.git

stream flushing tweaks
---

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 0305434b1..30e42240f 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -1964,6 +1964,7 @@ static int FlushStream(
         {
             s5_pkt->data = sb->data;
             s5_pkt->dsize = sb->length;
+            assert(sb->length < 65536); // FIXIT-H should be < s5_pkt->max_dsize);
 
             // FIXIT-M flushbuf should be eliminated from this function
             // since we are actually using the stream splitter buffer
@@ -1989,9 +1990,6 @@ static int FlushStream(
         st->flush_count++;
         segs++;
 
-        if ( sb )
-            break;
-
         if ( flushbuf >= flushbuf_end )
             break;
 
@@ -2013,6 +2011,9 @@ static int FlushStream(
             break;
 
         st->seglist_next = ss->next;
+
+        if ( sb )
+            break;
     }
 
     STREAM5_DEBUG_WRAP(bytes_queued -= bytes_flushed;);
@@ -2098,6 +2099,10 @@ static inline int _flush_to_seq (
         STREAM5_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
                     "Attempting to flush %lu bytes\n", footprint););
 
+        ((DAQ_PktHdr_t*)s5_pkt->pkth)->ts.tv_sec = st->seglist_next->tv.tv_sec;
+        ((DAQ_PktHdr_t*)s5_pkt->pkth)->ts.tv_usec = st->seglist_next->tv.tv_usec;
+        ((TCPHdr *)s5_pkt->ptrs.tcph)->th_seq = htonl(st->seglist_next->seq);
+
         /* setup the pseudopacket payload */
         s5_pkt->dsize = 0;
         const uint8_t* s5_pkt_end = s5_pkt->data + s5_pkt->max_dsize;
@@ -2111,7 +2116,6 @@ static inline int _flush_to_seq (
 
         else
         {
-            ((TCPHdr *)s5_pkt->ptrs.tcph)->th_seq = htonl(st->seglist_next->seq);
             s5_pkt->packet_flags |= (PKT_REBUILT_STREAM|PKT_STREAM_EST);
 
             if ((p->packet_flags & PKT_PDU_TAIL))
@@ -2119,9 +2123,6 @@ static inline int _flush_to_seq (
 
             PacketManager::encode_update(s5_pkt);
 
-            ((DAQ_PktHdr_t*)s5_pkt->pkth)->ts.tv_sec = st->seglist_next->tv.tv_sec;
-            ((DAQ_PktHdr_t*)s5_pkt->pkth)->ts.tv_usec = st->seglist_next->tv.tv_usec;
-
             sfBase.iStreamFlushes++;
             bytes_processed += s5_pkt->dsize;