From: Victor Julien Date: Thu, 28 Apr 2016 06:44:10 +0000 (+0200) Subject: stream: make app_progress relative to STREAM_BASE_OFFSET X-Git-Tag: suricata-4.0.0-beta1~183 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fa2a832022829f64424418b9305c8123b5468c8e;p=thirdparty%2Fsuricata.git stream: make app_progress relative to STREAM_BASE_OFFSET --- diff --git a/src/stream-tcp-list.c b/src/stream-tcp-list.c index 6007bae85e..68dfab7af7 100644 --- a/src/stream-tcp-list.c +++ b/src/stream-tcp-list.c @@ -635,13 +635,13 @@ static inline uint64_t GetLeftEdge(TcpSession *ssn, TcpStream *stream) } if (use_app && use_raw) { - left_edge = MIN(stream->app_progress, stream->raw_progress); + left_edge = MIN(STREAM_APP_PROGRESS(stream), stream->raw_progress); SCLogDebug("left_edge %"PRIu64", using both app:%"PRIu64", raw:%"PRIu64, - left_edge, stream->app_progress, stream->raw_progress); + left_edge, STREAM_APP_PROGRESS(stream), stream->raw_progress); } else if (use_app) { - left_edge = stream->app_progress; + left_edge = STREAM_APP_PROGRESS(stream); SCLogDebug("left_edge %"PRIu64", using app:%"PRIu64, - left_edge, stream->app_progress); + left_edge, STREAM_APP_PROGRESS(stream)); } else if (use_raw) { left_edge = stream->raw_progress; SCLogDebug("left_edge %"PRIu64", using raw:%"PRIu64, @@ -732,6 +732,13 @@ void StreamTcpPruneSession(Flow *f, uint8_t flags) SCLogDebug("buffer sliding %u to offset %"PRIu64, slide, left_edge); StreamingBufferSlideToOffset(stream->sb, left_edge); stream->base_seq += slide; + + if (slide <= stream->app_progress_rel) { + stream->app_progress_rel -= slide; + } else { + stream->app_progress_rel = 0; + } + SCLogDebug("stream base_seq %u at stream offset %"PRIu64, stream->base_seq, STREAM_BASE_OFFSET(stream)); } diff --git a/src/stream-tcp-private.h b/src/stream-tcp-private.h index 448efba5ee..7e36063321 100644 --- a/src/stream-tcp-private.h +++ b/src/stream-tcp-private.h @@ -87,8 +87,9 @@ typedef struct TcpStream_ { /* reassembly */ uint32_t base_seq; /**< seq where we are left with reassebly. Matches STREAM_BASE_OFFSET below. */ + uint32_t app_progress_rel; /**< app-layer progress relative to STREAM_BASE_OFFSET */ + StreamingBuffer *sb; - uint64_t app_progress; uint64_t raw_progress; TcpSegment *seg_list; /**< list of TCP segments that are not yet (fully) used in reassembly */ @@ -99,6 +100,7 @@ typedef struct TcpStream_ { } TcpStream; #define STREAM_BASE_OFFSET(stream) ((stream)->sb ? (stream)->sb->stream_offset : 0) +#define STREAM_APP_PROGRESS(stream) (STREAM_BASE_OFFSET((stream)) + (stream)->app_progress_rel) /* from /usr/include/netinet/tcp.h */ enum diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index 979893d3c3..2cf1e2be6f 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -996,7 +996,7 @@ int StreamNeedsReassembly(TcpSession *ssn, int direction) SCLogDebug("%s: list %p app %"PRIu64" (use: %s), raw %"PRIu64" (use: %s). Stream right edge: %"PRIu64, dirstr, stream->seg_list, - stream->app_progress, use_app ? "yes" : "no", + STREAM_APP_PROGRESS(stream), use_app ? "yes" : "no", stream->raw_progress, use_raw ? "yes" : "no", right_edge); @@ -1007,7 +1007,7 @@ int StreamNeedsReassembly(TcpSession *ssn, int direction) } } if (use_app) { - if (right_edge > stream->app_progress) { + if (right_edge > STREAM_APP_PROGRESS(stream)) { SCLogDebug("%s: STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY", dirstr); return STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY; } @@ -1107,10 +1107,10 @@ static int ReassembleUpdateAppLayer (ThreadVars *tv, TcpSession *ssn, TcpStream *stream, Packet *p) { - const uint64_t app_progress = stream->app_progress; - uint64_t last_ack_abs = app_progress; /* absolute right edge of ack'd data */ + const uint64_t app_progress = STREAM_APP_PROGRESS(stream); + uint64_t last_ack_abs = 0; /* absolute right edge of ack'd data */ - SCLogDebug("app progress %"PRIu64, stream->app_progress); + SCLogDebug("app progress %"PRIu64, app_progress); SCLogDebug("last_ack %u, base_seq %u", stream->last_ack, stream->base_seq); if (STREAM_LASTACK_GT_BASESEQ(stream)) { @@ -1122,19 +1122,19 @@ static int ReassembleUpdateAppLayer (ThreadVars *tv, const uint8_t *mydata; uint32_t mydata_len; - GetAppBuffer(stream, &mydata, &mydata_len, stream->app_progress); + GetAppBuffer(stream, &mydata, &mydata_len, app_progress); //PrintRawDataFp(stdout, mydata, mydata_len); - SCLogDebug("stream %p data in buffer %p of len %u and offset %u", - stream, stream->sb, mydata_len, (uint)stream->app_progress); + SCLogDebug("stream %p data in buffer %p of len %u and offset %"PRIu64, + stream, stream->sb, mydata_len, app_progress); /* get window of data that is acked */ if (StreamTcpInlineMode() == 0 && (p->flags & PKT_PSEUDO_STREAM_END)) { // } else if (StreamTcpInlineMode() == 0) { /* see if the buffer contains unack'd data as well */ - if (stream->app_progress + mydata_len > last_ack_abs) { - mydata_len = last_ack_abs - stream->app_progress; + if (app_progress + mydata_len > last_ack_abs) { + mydata_len = last_ack_abs - app_progress; SCLogDebug("data len adjusted to %u to make sure only ACK'd " "data is considered", mydata_len); } @@ -1149,13 +1149,13 @@ static int ReassembleUpdateAppLayer (ThreadVars *tv, if (r == 0 && StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)) { if (mydata_len > 0) { SCLogDebug("app progress %"PRIu64" increasing with data len %u to %"PRIu64, - stream->app_progress, mydata_len, stream->app_progress + mydata_len); + app_progress, mydata_len, app_progress + mydata_len); - stream->app_progress += mydata_len; - SCLogDebug("app progress now %"PRIu64, stream->app_progress); + stream->app_progress_rel += mydata_len; + SCLogDebug("app progress now %"PRIu64, STREAM_APP_PROGRESS(stream)); } } else { - SCLogDebug("NOT UPDATED app progress now %"PRIu64, stream->app_progress); + SCLogDebug("NOT UPDATED app progress still %"PRIu64, app_progress); } SCReturnInt(0); @@ -1241,7 +1241,7 @@ int StreamTcpReassembleAppLayer (ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, * and state is beyond established, we send an empty msg */ TcpSegment *seg_tail = stream->seg_list_tail; if (seg_tail == NULL || - SEGMENT_BEFORE_OFFSET(stream, seg_tail, stream->app_progress)) + SEGMENT_BEFORE_OFFSET(stream, seg_tail, STREAM_APP_PROGRESS(stream))) { /* send an empty EOF msg if we have no segments but TCP state * is beyond ESTABLISHED */ @@ -3181,7 +3181,7 @@ static int StreamTcpReassembleTest40 (void) /* check is have the segment in the list and flagged or not */ if (ssn.client.seg_list == NULL || - SEGMENT_BEFORE_OFFSET(&ssn.client, ssn.client.seg_list, ssn.client.app_progress)) + SEGMENT_BEFORE_OFFSET(&ssn.client, ssn.client.seg_list, STREAM_APP_PROGRESS(&ssn.client))) // (ssn.client.seg_list->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED)) { printf("the list is NULL or the processed segment has not been flaged (7): "); @@ -4563,9 +4563,9 @@ static int StreamTcpReassembleInlineTest10(void) goto end; } - if (ssn.server.app_progress != 17) { + if (STREAM_APP_PROGRESS(&ssn.server) != 17) { printf("expected ssn.server.app_progress == 17got %"PRIu64": ", - ssn.server.app_progress); + STREAM_APP_PROGRESS(&ssn.server)); goto end; }