stream: don't use ssn timestamp flag in stream

The STREAMTCP_FLAG_TIMESTAMP flag is a ssn flag, however it was used in
the stream flag field. As it has the same value as
STREAMTCP_STREAM_FLAG_DEPTH_REACHED it's possible that stream reassembly
got confused by the timestamp.

diff --git a/src/stream-tcp-private.h b/src/stream-tcp-private.h
index bf16625862afeea03307aae19b0ab54001e566bf..396b4eba91240fe91b9bad19a7eb8e355e54044d 100644 (file)
--- a/src/stream-tcp-private.h
+++ b/src/stream-tcp-private.h
@@ -139,6 +139,9 @@ enum
 #define STREAMTCP_STREAM_FLAG_DEPTH_REACHED     0x08
 /** Stream has sent a FIN/RST */
 #define STREAMTCP_STREAM_FLAG_CLOSE_INITIATED   0x10
+/** Stream supports TIMESTAMP -- used to set ssn STREAMTCP_FLAG_TIMESTAMP
+ *  flag. */
+#define STREAMTCP_STREAM_FLAG_TIMESTAMP         0x20
 
 /*
  * Per SEGMENT flags

diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 53184f81c5fe4088f083c460b77f927b273bb268..273f08b6c814bbd3e8a871b956de9af206b146a5 100644 (file)
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -805,7 +805,7 @@ static int StreamTcpPacketStateNone(ThreadVars *tv, Packet *p,
                 ssn->client.flags |= STREAMTCP_FLAG_ZERO_TIMESTAMP;
 
             ssn->client.last_pkt_ts = p->ts.tv_sec;
-            ssn->client.flags |= STREAMTCP_FLAG_TIMESTAMP;
+            ssn->client.flags |= STREAMTCP_STREAM_FLAG_TIMESTAMP;
         }
 
         ssn->server.window = TCP_GET_WINDOW(p);
@@ -996,14 +996,13 @@ static int StreamTcpPacketStateSynSent(ThreadVars *tv, Packet *p,
 
             /* Set the timestamp values used to validate the timestamp of
              * received packets. */
-            if ((p->tcpvars.ts != NULL) && (ssn->server.flags &
-                        STREAMTCP_FLAG_TIMESTAMP))
+            if ((p->tcpvars.ts != NULL) &&
+                    (ssn->server.flags & STREAMTCP_STREAM_FLAG_TIMESTAMP))
             {
                 ssn->client.last_ts = TCP_GET_TSVAL(p);
                 SCLogDebug("ssn %p: 4WHS ssn->client.last_ts %" PRIu32" "
                         "ssn->server.last_ts %" PRIu32"", ssn,
                         ssn->client.last_ts, ssn->server.last_ts);
-                ssn->server.flags &= ~STREAMTCP_FLAG_TIMESTAMP;
                 ssn->flags |= STREAMTCP_FLAG_TIMESTAMP;
                 ssn->client.last_pkt_ts = p->ts.tv_sec;
                 if (ssn->client.last_ts == 0)
@@ -1011,7 +1010,6 @@ static int StreamTcpPacketStateSynSent(ThreadVars *tv, Packet *p,
             } else {
                 ssn->server.last_ts = 0;
                 ssn->client.last_ts = 0;
-                ssn->server.flags &= ~STREAMTCP_FLAG_TIMESTAMP;
                 ssn->server.flags &= ~STREAMTCP_FLAG_ZERO_TIMESTAMP;
             }
 
@@ -1082,13 +1080,12 @@ static int StreamTcpPacketStateSynSent(ThreadVars *tv, Packet *p,
         /* Set the timestamp values used to validate the timestamp of
          * received packets.*/
         if ((p->tcpvars.ts != NULL) &&
-                (ssn->client.flags & STREAMTCP_FLAG_TIMESTAMP))
+                (ssn->client.flags & STREAMTCP_STREAM_FLAG_TIMESTAMP))
         {
             ssn->server.last_ts = TCP_GET_TSVAL(p);
             SCLogDebug("ssn %p: ssn->server.last_ts %" PRIu32" "
                     "ssn->client.last_ts %" PRIu32"", ssn,
                     ssn->server.last_ts, ssn->client.last_ts);
-            ssn->client.flags &= ~STREAMTCP_FLAG_TIMESTAMP;
             ssn->flags |= STREAMTCP_FLAG_TIMESTAMP;
             ssn->server.last_pkt_ts = p->ts.tv_sec;
             if (ssn->server.last_ts == 0)
@@ -1096,7 +1093,6 @@ static int StreamTcpPacketStateSynSent(ThreadVars *tv, Packet *p,
         } else {
             ssn->client.last_ts = 0;
             ssn->server.last_ts = 0;
-            ssn->client.flags &= ~STREAMTCP_FLAG_TIMESTAMP;
             ssn->client.flags &= ~STREAMTCP_FLAG_ZERO_TIMESTAMP;
         }
 
@@ -1176,7 +1172,7 @@ static int StreamTcpPacketStateSynSent(ThreadVars *tv, Packet *p,
                 if (ssn->server.last_ts == 0)
                     ssn->server.flags |= STREAMTCP_FLAG_ZERO_TIMESTAMP;
                 ssn->server.last_pkt_ts = p->ts.tv_sec;
-                ssn->server.flags |= STREAMTCP_FLAG_TIMESTAMP;
+                ssn->server.flags |= STREAMTCP_STREAM_FLAG_TIMESTAMP;
             }
 
             ssn->server.window = TCP_GET_WINDOW(p);
@@ -1255,14 +1251,13 @@ static int StreamTcpPacketStateSynSent(ThreadVars *tv, Packet *p,
         /* Set the timestamp values used to validate the timestamp of
          * received packets.*/
         if (p->tcpvars.ts != NULL &&
-                (ssn->client.flags & STREAMTCP_FLAG_TIMESTAMP))
+                (ssn->client.flags & STREAMTCP_STREAM_FLAG_TIMESTAMP))
         {
             ssn->flags |= STREAMTCP_FLAG_TIMESTAMP;
-            ssn->client.flags &= ~STREAMTCP_FLAG_TIMESTAMP;
+            ssn->client.flags &= ~STREAMTCP_STREAM_FLAG_TIMESTAMP;
             ssn->client.last_pkt_ts = p->ts.tv_sec;
         } else {
             ssn->client.last_ts = 0;
-            ssn->client.flags &= ~STREAMTCP_FLAG_TIMESTAMP;
             ssn->client.flags &= ~STREAMTCP_FLAG_ZERO_TIMESTAMP;
         }
 
@@ -1374,13 +1369,14 @@ static int StreamTcpPacketStateSynRecv(ThreadVars *tv, Packet *p,
         }
 
         /* Check if the SYN/ACK packet SEQ the earlier
-         * received SYN packet. */
+         * received SYN/ACK packet. */
         if (!(SEQ_EQ(TCP_GET_SEQ(p), ssn->server.isn))) {
             SCLogDebug("ssn %p: SEQ mismatch, packet SEQ %" PRIu32 " != "
-                    "%" PRIu32 " from stream", ssn, TCP_GET_ACK(p),
-                    ssn->client.isn + 1);
+                    "%" PRIu32 " from stream", ssn, TCP_GET_SEQ(p),
+                    ssn->client.isn);
 
             StreamTcpSetEvent(p, STREAM_3WHS_SYNACK_RESEND_WITH_DIFF_SEQ);
+
             return -1;
         }