void ReactAction::send(Packet* p)
{
- EncodeFlags df = (p->packet_flags & PKT_FROM_SERVER) ? ENC_FLAG_FWD : 0;
+ EncodeFlags df = (p->is_from_server()) ? ENC_FLAG_FWD : 0;
EncodeFlags sent = config->buf_len;
if ( p->packet_flags & PKT_STREAM_EST )
if (proto_ordinal > 0)
{
- if (p->packet_flags & PKT_FROM_SERVER) /* to cli */
+ if (p->is_from_server()) /* to cli */
{
DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_server\n");
file = snort_conf->sopgTable->get_port_group(proto, false, SNORT_PROTO_FILE);
}
- if (p->packet_flags & PKT_FROM_CLIENT) /* to srv */
+ if (p->is_from_client()) /* to srv */
{
DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_client\n");
{
// at present stream connection events are the only internal
// events and these require: src -> client, dst -> server.
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
{
return SFRF_TestThreshold(
snort_conf->rate_filter_config, gid, sid, dip, sip,
inline void enable_internal_event(RateFilterConfig* config, uint32_t sid)
{
- if (config == NULL)
+ if (config == nullptr)
return;
config->internal_event_mask |= (1 << sid);
inline bool is_internal_event_enabled(RateFilterConfig* config, uint32_t sid)
{
- if (config == NULL)
+ if (config == nullptr)
return false;
return (config->internal_event_mask & (1 << sid));
if (fcd->from_client)
{
{
- if (!p->from_client() && p->from_server())
+ if (!p->is_from_client() && p->is_from_server())
{
// No match on from_client
return DETECTION_OPTION_NO_MATCH;
if (fcd->from_server)
{
{
- if (!p->from_server() && p->from_client())
+ if (!p->is_from_server() && p->is_from_client())
{
// No match on from_server
return DETECTION_OPTION_NO_MATCH;
{
const char* dir;
- if ( a.pkt->packet_flags & PKT_FROM_CLIENT )
+ if ( a.pkt->is_from_client() )
dir = "C2S";
- else if ( a.pkt->packet_flags & PKT_FROM_SERVER )
+ else if ( a.pkt->is_from_server() )
dir = "S2C";
else
dir = "UNK";
/*
if(!(p->ptrs.tcph->th_flags & TH_RST) &&
!(p->packet_flags & (PKT_STREAM_EST)) &&
- (p->packet_flags & PKT_FROM_SERVER))
+ (p->is_from_server()))
{
return 1;
}
/*
** Check if the packet is reversed
*/
- if ((p->packet_flags & PKT_FROM_SERVER))
+ if ((p->is_from_server()))
{
reverse_pkt = 1;
}
/*
** RST packet on unestablished streams
*/
- else if ((p->packet_flags & PKT_FROM_SERVER) &&
+ else if ((p->is_from_server()) &&
(p->ptrs.tcph && (p->ptrs.tcph->th_flags & TH_RST)) &&
(!(p->packet_flags & PKT_STREAM_EST) ||
(session_flags & SSNFLAG_MIDSTREAM)))
** That's why we use the sp, because that's the port that is
** open.
*/
- else if ((p->packet_flags & PKT_FROM_SERVER) &&
+ else if ((p->is_from_server()) &&
!(p->packet_flags & PKT_STREAM_EST))
{
if (scanned)
ptrs.reset();
}
- bool from_client()
+ bool is_from_client() const
{ return (packet_flags & PKT_FROM_CLIENT) != 0; }
- bool from_server()
+ bool is_from_server() const
{ return (packet_flags & PKT_FROM_SERVER) != 0; }
bool is_portscan()
if ( !p->flow )
return 0;
- if ( p->packet_flags & PKT_FROM_CLIENT )
+ if ( p->is_from_client() )
dir = forward ? FROM_CLIENT : FROM_SERVER;
else
dir = forward ? FROM_SERVER : FROM_CLIENT;
inline int DCE2_SsnFromServer(Packet* p)
{
- return p->from_server();
+ return p->is_from_server();
}
inline int DCE2_SsnFromClient(Packet* p)
{
- return p->from_client();
+ return p->is_from_client();
}
inline DCE2_Policy DCE2_SsnGetPolicy(DCE2_SsnData* sd)
if ((DceRpcCoVersMaj(co_hdr) == DCERPC_PROTO_MAJOR_VERS__5)
&& (DceRpcCoVersMin(co_hdr) == DCERPC_PROTO_MINOR_VERS__0)
- && ((p->from_client()
+ && ((p->is_from_client()
&& DceRpcCoPduType(co_hdr) == DCERPC_PDU_TYPE__BIND)
|| (DCE2_SsnFromServer(p)
&& DceRpcCoPduType(co_hdr) == DCERPC_PDU_TYPE__BIND_ACK))
return true;
}
}
- else if ((*p->data == DCERPC_PROTO_MAJOR_VERS__5) && p->from_client())
+ else if ((*p->data == DCERPC_PROTO_MAJOR_VERS__5) && p->is_from_client())
{
return true;
}
p->packet_flags |= PKT_ALLOW_MULTIPLE_DETECT;
/* Set reassembly direction */
- if (p->packet_flags & PKT_FROM_CLIENT)
+ if (p->is_from_client())
dnp3_sess->direction = DNP3_CLIENT;
else
dnp3_sess->direction = DNP3_SERVER;
}
// Get the direction of the packet.
- bool from_server = ( (p->packet_flags & PKT_FROM_SERVER ) ? true : false );
+ bool from_server = ( (p->is_from_server() ) ? true : false );
// Attempt to get a previously allocated DNS block.
}
else
{
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
{
iInspectMode = FTPP_SI_SERVER_MODE;
}
- else if ( p->packet_flags & PKT_FROM_CLIENT )
+ else if ( p->is_from_client() )
{
iInspectMode = FTPP_SI_CLIENT_MODE;
}
* session, so we can still assume that the initial packet is the client
* talking.
*/
- iServerDip = (p->packet_flags & PKT_FROM_CLIENT);
- iServerSip = (p->packet_flags & PKT_FROM_SERVER);
+ iServerDip = (p->is_from_client());
+ iServerSip = (p->is_from_server());
/*
* We default to the no FTP traffic case
{
SiInput->pdir = FTPP_SI_NO_MODE;
}
- else if (p->packet_flags & PKT_FROM_SERVER)
+ else if (p->is_from_server())
{
SiInput->pdir = FTPP_SI_SERVER_MODE;
}
- else if (p->packet_flags & PKT_FROM_CLIENT)
+ else if (p->is_from_client())
{
SiInput->pdir = FTPP_SI_CLIENT_MODE;
}
}
else
{
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
{
iInspectMode = FTPP_SI_SERVER_MODE;
}
- else if ( p->packet_flags & PKT_FROM_CLIENT )
+ else if ( p->is_from_client() )
{
iInspectMode = FTPP_SI_CLIENT_MODE;
}
{
SiInput->pdir = HI_SI_NO_MODE;
}
- else if (p->packet_flags & PKT_FROM_SERVER)
+ else if (p->is_from_server())
{
SiInput->pdir = HI_SI_SERVER_MODE;
}
- else if (p->packet_flags & PKT_FROM_CLIENT)
+ else if (p->is_from_client())
{
SiInput->pdir = HI_SI_CLIENT_MODE;
}
** session, so we can still assume that the initial packet is the client
** talking.
*/
- iServerSip = (p->packet_flags & PKT_FROM_SERVER);
- iServerDip = (p->packet_flags & PKT_FROM_CLIENT);
+ iServerSip = (p->is_from_server());
+ iServerDip = (p->is_from_client());
/*
** We default to the no HTTP traffic case
int pkt_dir;
/* Get the direction of the packet. */
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
pkt_dir = IMAP_PKT_FROM_SERVER;
else
pkt_dir = IMAP_PKT_FROM_CLIENT;
/* Read the Modbus payload and check lengths against the expected length for
each function. */
- if (p->packet_flags & PKT_FROM_CLIENT)
+ if (p->is_from_client())
ModbusCheckRequestLengths(&mfd->ssn_data, p);
else
ModbusCheckResponseLengths(&mfd->ssn_data, p);
if (session_data == nullptr)
return;
- assert((p->packet_flags & PKT_FROM_CLIENT) || (p->packet_flags & PKT_FROM_SERVER));
- assert(!((p->packet_flags & PKT_FROM_CLIENT) && (p->packet_flags & PKT_FROM_SERVER)));
- SourceId source_id = (p->packet_flags & PKT_FROM_CLIENT) ? SRC_CLIENT : SRC_SERVER;
+ assert((p->is_from_client()) || (p->is_from_server()));
+ assert(!((p->is_from_client()) && (p->is_from_server())));
+ SourceId source_id = (p->is_from_client()) ? SRC_CLIENT : SRC_SERVER;
if (session_data->transaction[source_id] == nullptr)
return;
int pkt_dir;
/* Get the direction of the packet. */
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
pkt_dir = POP_PKT_FROM_SERVER;
else
pkt_dir = POP_PKT_FROM_CLIENT;
// If no 3 way, then the packet flags won't be set, so don't look at it
// since we won't be able to determeine who's the client and who's the
// server.
- if ( !p->from_client() )
+ if ( !p->is_from_client() )
return;
RpcSsnData* rsdata = nullptr;
int pkt_dir;
/* Get the direction of the packet. */
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
pkt_dir = SMTP_PKT_FROM_SERVER;
else
pkt_dir = SMTP_PKT_FROM_CLIENT;
uint32_t search_dir_keyinit;
// Get the direction of the packet.
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
{
direction = SSH_DIR_FROM_SERVER;
search_dir_ver = SSH_FLG_SERV_IDSTRING_SEEN;
/* Need to negate the application flags from the opposing side. */
- if (packet->packet_flags & PKT_FROM_CLIENT)
+ if (packet->is_from_client())
return ssn_flags & ~SSL_SAPP_FLAG;
- else if (packet->packet_flags & PKT_FROM_SERVER)
+ else if (packet->is_from_server())
return ssn_flags & ~SSL_CAPP_FLAG;
return ssn_flags;
SSL_CLEAR_TEMPORARY_FLAGS(sd->ssn_flags);
- uint8_t dir = (p->packet_flags & PKT_FROM_SERVER) ? 1 : 0;
+ uint8_t dir = (p->is_from_server()) ? 1 : 0;
uint8_t index = (p->packet_flags & PKT_REBUILT_STREAM) ? 2 : 0;
uint8_t heartbleed_type = 0;
return;
Wand wand;
- reset(wand, false, p->packet_flags & PKT_FROM_CLIENT);
+ reset(wand, false, p->is_from_client());
if ( cast_spell(wand, p->flow, p->data, p->dsize) )
++tstats.udp_hits;
if ( !(lws->ssn_state.session_flags & SSNFLAG_ESTABLISHED) )
{
- if ( p->packet_flags & PKT_FROM_CLIENT )
+ if ( p->is_from_client() )
{
DebugMessage(DEBUG_STREAM_STATE,
"Stream: Updating on packet from client\n");
bool is_packet_from_server(void)
{
- return pkt->packet_flags & PKT_FROM_SERVER;
+ return pkt->is_from_server();
}
void slide_segment_in_rcv_window(int32_t offset)
#include "stream_tcp_unit_test.h"
#endif
-TcpStateHandler::TcpStateHandler(TcpStreamTracker::TcpState state, TcpStateMachine& tsm,
- TcpStreamSession& ssn) : tsm(&tsm), tcp_state(state), session(ssn)
+TcpStateHandler::TcpStateHandler(TcpStreamTracker::TcpState state, TcpStateMachine& tsm)
+ : tsm(&tsm), tcp_state(state)
{
tsm.register_state_handler(state, *this);
}
// TODO Auto-generated destructor stub
}
-bool TcpStateHandler::do_pre_sm_packet_actions(TcpSegmentDescriptor&)
+bool TcpStateHandler::do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&)
{
return true;
}
-bool TcpStateHandler::do_post_sm_packet_actions(TcpSegmentDescriptor&)
+bool TcpStateHandler::do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&)
{
return true;
}
#include "protocols/tcp.h"
#include "tcp_segment_descriptor.h"
-#include "tcp_stream_session.h"
#include "tcp_stream_tracker.h"
class TcpStateMachine;
class TcpStateHandler
{
public:
- TcpStateHandler(TcpStreamTracker::TcpState, TcpStateMachine&, TcpStreamSession&);
+ TcpStateHandler(TcpStreamTracker::TcpState, TcpStateMachine&);
virtual ~TcpStateHandler();
virtual bool eval(TcpSegmentDescriptor&, TcpStreamTracker&);
this->tsm = tsm;
}
- virtual bool do_pre_sm_packet_actions(TcpSegmentDescriptor&);
- virtual bool do_post_sm_packet_actions(TcpSegmentDescriptor&);
+ virtual bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&);
+ virtual bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&);
protected:
virtual bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&);
const TcpStateMachine* tsm;
TcpStreamTracker::TcpState tcp_state;
- TcpStreamSession& session;
TcpStreamTracker::TcpEvent tcp_event = TcpStreamTracker::TCP_MAX_EVENTS;
};
TcpStreamTracker::TcpState tcp_state = talker.get_tcp_state( );
talker.set_tcp_event(tsd);
- if ( tcp_state_handlers[ tcp_state ]->do_pre_sm_packet_actions(tsd) )
+ if ( tcp_state_handlers[ tcp_state ]->do_pre_sm_packet_actions(tsd, talker) )
{
if ( tcp_state_handlers[ tcp_state ]->eval(tsd, talker) )
{
tcp_state = listener.get_tcp_state( );
listener.set_tcp_event(tsd);
tcp_state_handlers[ tcp_state ]->eval(tsd, listener);
- tcp_state_handlers[ tcp_state ]->do_post_sm_packet_actions(tsd);
+ tcp_state_handlers[ tcp_state ]->do_post_sm_packet_actions(tsd, listener);
return true;
}
class TcpStateMachine
{
public:
- TcpStateMachine(void);
virtual ~TcpStateMachine(void);
virtual void register_state_handler(TcpStreamTracker::TcpState, TcpStateHandler&);
virtual bool eval(TcpSegmentDescriptor&, TcpStreamTracker&, TcpStreamTracker&);
-private:
+protected:
+ TcpStateMachine(void);
TcpStateHandler* tcp_state_handlers[ TcpStreamTracker::TCP_MAX_STATES ];
};
egress_index = p->pkth->egress_index;
egress_group = p->pkth->egress_group;
}
- else if ( p->packet_flags & PKT_FROM_CLIENT )
+ else if ( p->is_from_client() )
{
ingress_index = p->pkth->ingress_index;
ingress_group = p->pkth->ingress_group;
bool talker;
const tcp::TCPHdr* tcph = tsd.get_tcph();
- if ( tsd.get_pkt()->packet_flags & PKT_FROM_CLIENT )
+ if ( tsd.get_pkt()->is_from_client() )
talker = ( client_tracker ) ? true : false;
else
talker = ( client_tracker ) ? false : true;
class TcpNormalizer;
class TcpReassembler;
+class TcpSession;
class TcpStreamTracker
{
bool rst_pkt_sent = false;
// FIXIT - make these non-public
-
public:
uint32_t r_nxt_ack = 0; /* next expected ack from remote side */
uint32_t r_win_base = 0; /* remote side window base sequence number
StreamSplitter* splitter = nullptr;
TcpNormalizer* normalizer = nullptr;
TcpReassembler* reassembler = nullptr;
+ TcpSession* session = nullptr;
uint32_t small_seg_count = 0;
uint8_t alert_count = 0;
{
uint8_t max = snort_conf->max_responses;
- if ( p->packet_flags & PKT_FROM_CLIENT )
+ if ( p->is_from_client() )
lwssn->session_state |= STREAM_STATE_DROP_CLIENT;
else
lwssn->session_state |= STREAM_STATE_DROP_SERVER;
return false;
if (
- ((p->packet_flags & PKT_FROM_SERVER) &&
+ ((p->is_from_server()) &&
(flow->ssn_state.session_flags & SSNFLAG_DROP_SERVER)) ||
- ((p->packet_flags & PKT_FROM_CLIENT) &&
+ ((p->is_from_client()) &&
(flow->ssn_state.session_flags & SSNFLAG_DROP_CLIENT)) )
{
DebugFormat(DEBUG_STREAM_STATE,
"Blocking %s packet as session was blocked\n",
- p->packet_flags & PKT_FROM_SERVER ? "server" : "client");
+ p->is_from_server() ? "server" : "client");
DisableDetect();
Active::drop_packet(p);
bool Stream::ignored_session(Flow* flow, Packet* p)
{
- if (((p->packet_flags & PKT_FROM_SERVER) &&
+ if (((p->is_from_server()) &&
(flow->ssn_state.ignore_direction & SSN_DIR_FROM_CLIENT)) ||
- ((p->packet_flags & PKT_FROM_CLIENT) &&
+ ((p->is_from_client()) &&
(flow->ssn_state.ignore_direction & SSN_DIR_FROM_SERVER)) )
{
DebugFormat(DEBUG_STREAM_STATE,
"Stream Ignoring packet from %d. Session marked as ignore\n",
- p->packet_flags & PKT_FROM_CLIENT ? "sender" : "responder");
+ p->is_from_client() ? "sender" : "responder");
DisableInspection();
return true;
tcp_state_syn_recv.h
tcp_state_syn_sent.h
tcp_state_time_wait.h
+ tcp_stream_state_machine.cc
+ tcp_stream_state_machine.h
ips_stream_reassemble.cc
ips_stream_size.cc
)
tcp_tracker.h \
tcp_session.cc \
tcp_session.h \
+tcp_stream_state_machine.cc \
+tcp_stream_state_machine.h \
tcp_state_closed.cc \
tcp_state_close_wait.cc \
tcp_state_closing.cc \
const char* cdir = "?", * sdir = "?";
uint32_t txd = 0, rxd = 0;
- if (p->packet_flags & PKT_FROM_SERVER)
+ if (p->is_from_server())
{
sdir = "SRV>";
cdir = "CLI<";
txd = srv->get_iss();
rxd = srv->get_irs();
}
- else if ( p->packet_flags & PKT_FROM_CLIENT )
+ else if ( p->is_from_client() )
{
sdir = "SRV<";
cdir = "CLI>";
#include "tcp_module.h"
#include "tcp_normalizers.h"
+
class TcpNormalizerFirst : public TcpNormalizer
{
public:
int handle_repeated_syn(TcpSegmentDescriptor&) override;
};
-TcpNormalizer* TcpNormalizerFactory::create(TcpSession* session, StreamPolicy os_policy,
- TcpStreamTracker* tracker, TcpStreamTracker* peer)
-{
- TcpNormalizer* normalizer;
-
- switch (os_policy)
- {
- case StreamPolicy::OS_FIRST:
- normalizer = new TcpNormalizerFirst(session, tracker);
- break;
-
- case StreamPolicy::OS_LAST:
- normalizer = new TcpNormalizerLast(session, tracker);
- break;
-
- case StreamPolicy::OS_LINUX:
- normalizer = new TcpNormalizerLinux(session, tracker);
- break;
-
- case StreamPolicy::OS_OLD_LINUX:
- normalizer = new TcpNormalizerOldLinux(session, tracker);
- break;
-
- case StreamPolicy::OS_BSD:
- normalizer = new TcpNormalizerBSD(session, tracker);
- break;
-
- case StreamPolicy::OS_MACOS:
- normalizer = new TcpNormalizerMacOS(session, tracker);
- break;
-
- case StreamPolicy::OS_SOLARIS:
- normalizer = new TcpNormalizerSolaris(session, tracker);
- break;
-
- case StreamPolicy::OS_IRIX:
- normalizer = new TcpNormalizerIrix(session, tracker);
- break;
-
- case StreamPolicy::OS_HPUX11:
- normalizer = new TcpNormalizerHpux11(session, tracker);
- break;
-
- case StreamPolicy::OS_HPUX10:
- normalizer = new TcpNormalizerHpux10(session, tracker);
- break;
-
- case StreamPolicy::OS_WINDOWS:
- normalizer = new TcpNormalizerWindows(session, tracker);
- break;
-
- case StreamPolicy::OS_WINDOWS2K3:
- normalizer = new TcpNormalizerWindows2K3(session, tracker);
- break;
-
- case StreamPolicy::OS_VISTA:
- normalizer = new TcpNormalizerVista(session, tracker);
- break;
-
- case StreamPolicy::OS_PROXY:
- normalizer = new TcpNormalizerProxy(session, tracker);
- break;
-
- default:
- normalizer = new TcpNormalizerBSD(session, tracker);
- break;
- }
-
- normalizer->set_peer_tracker(peer);
- return normalizer;
-}
static inline int handle_repeated_syn_mswin(TcpStreamTracker* talker, TcpStreamTracker* listener,
TcpSegmentDescriptor& tsd, TcpSession* session)
return ACTION_NOTHING;
}
+TcpNormalizer* TcpNormalizerFactory::create(TcpSession* session, StreamPolicy os_policy,
+ TcpStreamTracker* tracker, TcpStreamTracker* peer)
+{
+ TcpNormalizer* normalizer;
+
+ switch (os_policy)
+ {
+ case StreamPolicy::OS_FIRST:
+ normalizer = new TcpNormalizerFirst(session, tracker);
+ break;
+
+ case StreamPolicy::OS_LAST:
+ normalizer = new TcpNormalizerLast(session, tracker);
+ break;
+
+ case StreamPolicy::OS_LINUX:
+ normalizer = new TcpNormalizerLinux(session, tracker);
+ break;
+
+ case StreamPolicy::OS_OLD_LINUX:
+ normalizer = new TcpNormalizerOldLinux(session, tracker);
+ break;
+
+ case StreamPolicy::OS_BSD:
+ normalizer = new TcpNormalizerBSD(session, tracker);
+ break;
+
+ case StreamPolicy::OS_MACOS:
+ normalizer = new TcpNormalizerMacOS(session, tracker);
+ break;
+
+ case StreamPolicy::OS_SOLARIS:
+ normalizer = new TcpNormalizerSolaris(session, tracker);
+ break;
+
+ case StreamPolicy::OS_IRIX:
+ normalizer = new TcpNormalizerIrix(session, tracker);
+ break;
+
+ case StreamPolicy::OS_HPUX11:
+ normalizer = new TcpNormalizerHpux11(session, tracker);
+ break;
+
+ case StreamPolicy::OS_HPUX10:
+ normalizer = new TcpNormalizerHpux10(session, tracker);
+ break;
+
+ case StreamPolicy::OS_WINDOWS:
+ normalizer = new TcpNormalizerWindows(session, tracker);
+ break;
+
+ case StreamPolicy::OS_WINDOWS2K3:
+ normalizer = new TcpNormalizerWindows2K3(session, tracker);
+ break;
+
+ case StreamPolicy::OS_VISTA:
+ normalizer = new TcpNormalizerVista(session, tracker);
+ break;
+
+ case StreamPolicy::OS_PROXY:
+ normalizer = new TcpNormalizerProxy(session, tracker);
+ break;
+
+ default:
+ normalizer = new TcpNormalizerBSD(session, tracker);
+ break;
+ }
+
+ normalizer->set_peer_tracker(peer);
+ return normalizer;
+}
+
else
{
// reverse
- if (p->packet_flags & PKT_FROM_CLIENT)
+ if (p->is_from_client())
s5_pkt->packet_flags |= PKT_FROM_SERVER;
else
s5_pkt->packet_flags |= PKT_FROM_CLIENT;
* is the ACK from the talker and we're flushing packets
* that actually came from the listener.
*/
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
return PKT_FROM_CLIENT;
- else if ( p->packet_flags & PKT_FROM_CLIENT )
+ else if ( p->is_from_client() )
return PKT_FROM_SERVER;
return 0;
uint32_t TcpReassembler::get_forward_packet_dir(const Packet* p)
{
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
return PKT_FROM_SERVER;
- else if ( p->packet_flags & PKT_FROM_CLIENT )
+ else if ( p->is_from_client() )
return PKT_FROM_CLIENT;
return 0;
#include "tcp_module.h"
#include "tcp_event_logger.h"
#include "tcp_debug_trace.h"
-
-#include "tcp_state_none.h"
-#include "tcp_state_closed.h"
-#include "tcp_state_listen.h"
-#include "tcp_state_syn_sent.h"
-#include "tcp_state_syn_recv.h"
-#include "tcp_state_established.h"
-#include "tcp_state_close_wait.h"
-#include "tcp_state_closing.h"
-#include "tcp_state_fin_wait1.h"
-#include "tcp_state_fin_wait2.h"
-#include "tcp_state_last_ack.h"
-#include "tcp_state_time_wait.h"
-
#include "tcp_normalizers.h"
#include "tcp_reassemblers.h"
+#include "tcp_stream_state_machine.h"
#include "tcp_session.h"
DEBUG_WRAP(const char* t_name = NULL; const char* l_name = NULL; )
TcpSession::TcpSession(Flow* flow) : TcpStreamSession(flow)
{
- client = new TcpTracker(true);
- server = new TcpTracker(false);
-
- // initialize stream tracker state machine...
- new TcpStateNone(tsm, *this);
- new TcpStateClosed(tsm, *this);
- new TcpStateListen(tsm, *this);
- new TcpStateSynSent(tsm, *this);
- new TcpStateSynRecv(tsm, *this);
- new TcpStateEstablished(tsm, *this);
- new TcpStateFinWait1(tsm, *this);
- new TcpStateFinWait2(tsm, *this);
- new TcpStateClosing(tsm, *this);
- new TcpStateCloseWait(tsm, *this);
- new TcpStateLastAck(tsm, *this);
- new TcpStateTimeWait(tsm, *this);
+ tsm = TcpStreamStateMachine::get_instance();
+ client = new TcpTracker(true, this);
+ server = new TcpTracker(false, this);
}
TcpSession::~TcpSession(void)
TcpStreamTracker* talker, * listener;
- if (p->packet_flags & PKT_FROM_SERVER)
+ if (p->is_from_server())
{
talker = server;
listener = client;
if ( t_hijack )
{
- if ( p->packet_flags & PKT_FROM_CLIENT )
+ if ( p->is_from_client() )
event_code |= EVENT_SESSION_HIJACK_CLIENT;
else
event_code |= EVENT_SESSION_HIJACK_SERVER;
if ( l_hijack )
{
- if ( p->packet_flags & PKT_FROM_CLIENT )
+ if ( p->is_from_client() )
event_code |= EVENT_SESSION_HIJACK_SERVER;
else
event_code |= EVENT_SESSION_HIJACK_CLIENT;
pkt_action_mask |= ACTION_BAD_PKT;
return true;
}
- else if ((tsd.get_pkt()->packet_flags & PKT_FROM_CLIENT)
+ else if ((tsd.get_pkt()->is_from_client())
&& (tsd.get_seg_wnd() <= SLAM_MAX)
&& (tsd.get_seg_ack() == listener->get_iss() + 1)
&& !( tsd.get_tcph()->is_fin() | tsd.get_tcph()->is_rst() )
/* figure out direction of this packet -- we should've already
* looked at it, so the packet_flags are already set. */
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
{
DebugMessage(DEBUG_STREAM_STATE, "Flushing listener on packet from server\n");
listener = client;
/* dir of flush is the data from the opposite side */
dir = PKT_FROM_SERVER;
}
- else if ( p->packet_flags & PKT_FROM_CLIENT )
+ else if ( p->is_from_client() )
{
DebugMessage(DEBUG_STREAM_STATE, "Flushing listener on packet from client\n");
listener = server;
/* figure out direction of this packet -- we should've already
* looked at it, so the packet_flags are already set. */
- if ( p->packet_flags & PKT_FROM_SERVER )
+ if ( p->is_from_server() )
{
DebugMessage(DEBUG_STREAM_STATE, "Flushing talker on packet from server\n");
talker = server;
/* dir of flush is the data from the opposite side */
dir = PKT_FROM_CLIENT;
}
- else if ( p->packet_flags & PKT_FROM_CLIENT )
+ else if ( p->is_from_client() )
{
DebugMessage(DEBUG_STREAM_STATE, "Flushing talker on packet from client\n");
talker = client;
DebugFormat(DEBUG_STREAM_STATE,
"Stream Ignoring packet from %d. Session marked as ignore\n",
- p->packet_flags & PKT_FROM_SERVER ? "server" : "client");
+ p->is_from_server() ? "server" : "client");
}
}
pkt_action_mask = ACTION_NOTHING;
tel.clear_tcp_events();
// process thru state machine...talker first
- if (p->packet_flags & PKT_FROM_CLIENT)
+ if (p->is_from_client())
{
update_session_on_client_packet(tsd);
DEBUG_WRAP(t_name = "Server"; l_name = "Client");
{
Profile profile(s5TcpStatePerfStats);
- if ( tsm.eval(tsd, *talker, *listener) )
+ if ( tsm->eval(tsd, *talker, *listener) )
{
do_packet_analysis_post_checks(p);
S5TraceTCP(p, flow, &tsd, 0);
class TcpEventLogger;
-// FIXIT-L session tracking must be split from reassembly
-// into a separate module a la ip_session.cc and ip_defrag.cc
-// (of course defrag should also be cleaned up)
class TcpSession : public TcpStreamSession
{
public:
void do_packet_analysis_post_checks(Packet*);
- TcpStateMachine tsm;
+ TcpStateMachine* tsm;
};
#endif
#include "catch/catch.hpp"
#endif
-TcpStateCloseWait::TcpStateCloseWait(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_CLOSE_WAIT, tsm, ssn)
+TcpStateCloseWait::TcpStateCloseWait(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_CLOSE_WAIT, tsm)
{
}
{
}
-bool TcpStateCloseWait::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_on_fin_sent(tsd);
trk.set_tcp_state(TcpStreamTracker::TCP_LAST_ACK);
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
if ( SEQ_GEQ(tsd.get_seg_seq(), trk.get_fin_final_seq() ) )
{
DebugMessage(DEBUG_STREAM_STATE, "FIN beyond previous, ignoring\n");
- session.tel.set_tcp_event(EVENT_BAD_FIN);
+ trk.session->tel.set_tcp_event(EVENT_BAD_FIN);
trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
- session.set_pkt_action_flag(ACTION_BAD_PKT);
+ trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
}
else
{
if ( !flow->two_way_traffic() )
trk.set_tf_flags(TF_FORCE_FLUSH);
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
}
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.update_on_rst_recv(tsd) )
{
- session.update_session_on_rst(tsd, true);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
- session.set_pkt_action_flag(ACTION_RST);
+ trk.session->update_session_on_rst(tsd, true);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->set_pkt_action_flag(ACTION_RST);
}
else
{
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
return default_state_action(tsd, trk);
}
-bool TcpStateCloseWait::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateCloseWait::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- return session.validate_packet_established_session(tsd);
+ return trk.session->validate_packet_established_session(tsd);
}
-bool TcpStateCloseWait::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateCloseWait::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- session.update_paws_timestamps(tsd);
- session.check_for_window_slam(tsd);
+ trk.session->update_paws_timestamps(tsd);
+ trk.session->check_for_window_slam(tsd);
return true;
}
class TcpStateCloseWait : public TcpStateHandler
{
public:
- TcpStateCloseWait(TcpStateMachine&, TcpSession&);
+ TcpStateCloseWait(TcpStateMachine&);
virtual ~TcpStateCloseWait(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
- bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
- bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+ bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+ bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
};
#endif
#include "stream/libtcp/stream_tcp_unit_test.h"
#endif
-TcpStateClosed::TcpStateClosed(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_CLOSED, tsm, ssn)
+TcpStateClosed::TcpStateClosed(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_CLOSED, tsm)
{
}
{
auto& trk = static_cast< TcpStreamTracker& >( tracker );
- session.check_for_repeated_syn(tsd);
+ trk.session->check_for_repeated_syn(tsd);
return default_state_action(tsd, trk);
}
auto& trk = static_cast< TcpStreamTracker& >( tracker );
Flow* flow = tsd.get_flow();
- flow->set_expire(tsd.get_pkt(), session.config->session_timeout);
+ flow->set_expire(tsd.get_pkt(), trk.session->config->session_timeout);
return default_state_action(tsd, trk);
}
if ( flow->get_session_flags() & SSNFLAG_RESET )
{
if ( trk.is_rst_pkt_sent() )
- session.tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
+ trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
else
- session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+ trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
}
else
- session.tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
+ trk.session->tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
- session.mark_packet_for_drop(tsd);
+ trk.session->mark_packet_for_drop(tsd);
return default_state_action(tsd, trk);
}
if( tsd.get_seg_len() > 0 )
{
if ( trk.is_rst_pkt_sent() )
- session.tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
+ trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
else
- session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+ trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
}
return default_state_action(tsd, trk);
if ( trk.update_on_rst_recv(tsd) )
{
- session.update_session_on_rst(tsd, false);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
- session.set_pkt_action_flag(ACTION_RST);
+ trk.session->update_session_on_rst(tsd, false);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->set_pkt_action_flag(ACTION_RST);
}
else
{
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
return default_state_action(tsd, trk);
}
-bool TcpStateClosed::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateClosed::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- return session.validate_packet_established_session(tsd);
+ return trk.session->validate_packet_established_session(tsd);
}
-bool TcpStateClosed::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateClosed::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- session.update_paws_timestamps(tsd);
- session.check_for_window_slam(tsd);
+ trk.session->update_paws_timestamps(tsd);
+ trk.session->check_for_window_slam(tsd);
if ( tcp_event != TcpStreamTracker::TCP_FIN_RECV_EVENT )
{
- TcpStreamTracker::TcpState talker_state = session.get_talker_state();
+ TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
Flow* flow = tsd.get_flow();
if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT ) || !flow->two_way_traffic() )
{
// The last ACK is a part of the session. Delete the session after processing is
// complete.
- session.clear_session(false, true, false, tsd.get_pkt() );
+ trk.session->clear_session(false, true, false, tsd.get_pkt() );
flow->session_state |= STREAM_STATE_CLOSED;
- session.set_pkt_action_flag(ACTION_LWSSN_CLOSED);
+ trk.session->set_pkt_action_flag(ACTION_LWSSN_CLOSED);
}
}
class TcpStateClosed : public TcpStateHandler
{
public:
- TcpStateClosed(TcpStateMachine&, TcpSession&);
+ TcpStateClosed(TcpStateMachine&);
virtual ~TcpStateClosed(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
- bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
- bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+ bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+ bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
};
#endif
#include "catch/catch.hpp"
#endif
-TcpStateClosing::TcpStateClosing(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_CLOSING, tsm, ssn)
+TcpStateClosing::TcpStateClosing(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_CLOSING, tsm)
{
}
{
}
-bool TcpStateClosing::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- session.check_for_repeated_syn(tsd);
+ trk.session->check_for_repeated_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
if ( SEQ_GEQ(tsd.get_end_seq(), trk.r_nxt_ack) )
trk.set_tcp_state(TcpStreamTracker::TCP_TIME_WAIT);
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
if ( SEQ_GEQ(tsd.get_end_seq(), trk.r_nxt_ack) )
trk.set_tcp_state(TcpStreamTracker::TCP_TIME_WAIT);
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
if ( SEQ_GEQ(tsd.get_seg_seq(), trk.get_fin_final_seq() ) )
{
DebugMessage(DEBUG_STREAM_STATE, "FIN beyond previous, ignoring\n");
- session.tel.set_tcp_event(EVENT_BAD_FIN);
+ trk.session->tel.set_tcp_event(EVENT_BAD_FIN);
trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
- session.set_pkt_action_flag(ACTION_BAD_PKT);
+ trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
}
if ( !flow->two_way_traffic() )
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.update_on_rst_recv(tsd) )
{
- session.update_session_on_rst(tsd, true);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
- session.set_pkt_action_flag(ACTION_RST);
+ trk.session->update_session_on_rst(tsd, true);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->set_pkt_action_flag(ACTION_RST);
}
else
{
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
return default_state_action(tsd, trk);
}
-bool TcpStateClosing::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateClosing::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- return session.validate_packet_established_session(tsd);
+ return trk.session->validate_packet_established_session(tsd);
}
-bool TcpStateClosing::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateClosing::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- session.update_paws_timestamps(tsd);
- session.check_for_window_slam(tsd);
+ trk.session->update_paws_timestamps(tsd);
+ trk.session->check_for_window_slam(tsd);
return true;
}
class TcpStateClosing : public TcpStateHandler
{
public:
- TcpStateClosing(TcpStateMachine&, TcpSession&);
+ TcpStateClosing(TcpStateMachine&);
virtual ~TcpStateClosing(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
- bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
- bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+ bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+ bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
};
#endif
#include "tcp_normalizer.h"
#include "tcp_state_established.h"
-TcpStateEstablished::TcpStateEstablished(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_ESTABLISHED, tsm, ssn)
+TcpStateEstablished::TcpStateEstablished(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_ESTABLISHED, tsm)
{
}
{
}
-bool TcpStateEstablished::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- session.check_for_repeated_syn(tsd);
+ trk.session->check_for_repeated_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- session.check_for_repeated_syn(tsd);
+ trk.session->check_for_repeated_syn(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt()) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt()) )
{
- session.update_session_on_syn_ack( );
+ trk.session->update_session_on_syn_ack( );
}
if ( trk.is_server_tracker() )
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_on_fin_sent(tsd);
- session.eof_handle(tsd.get_pkt());
+ trk.session->eof_handle(tsd.get_pkt());
trk.set_tcp_state(TcpStreamTracker::TCP_FIN_WAIT1);
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
if ( tsd.get_seg_len() > 0 )
{
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
trk.flush_data_on_fin_recv(tsd);
}
trk.update_on_fin_recv(tsd);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
trk.set_tcp_state(TcpStreamTracker::TCP_CLOSE_WAIT);
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.update_on_rst_recv(tsd) )
{
- session.update_session_on_rst(tsd, false);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
- session.set_pkt_action_flag(ACTION_RST);
+ trk.session->update_session_on_rst(tsd, false);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->set_pkt_action_flag(ACTION_RST);
}
else
{
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
// FIXIT - might be good to create alert specific to RST with data
if ( tsd.get_seg_len() > 0 )
- session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+ trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
return default_state_action(tsd, trk);
}
-bool TcpStateEstablished::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateEstablished::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- return session.validate_packet_established_session(tsd);
+ return trk.session->validate_packet_established_session(tsd);
}
-bool TcpStateEstablished::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateEstablished::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- session.update_paws_timestamps(tsd);
-
- session.check_for_window_slam(tsd);
+ trk.session->update_paws_timestamps(tsd);
+ trk.session->check_for_window_slam(tsd);
return true;
}
class TcpStateEstablished : public TcpStateHandler
{
public:
- TcpStateEstablished(TcpStateMachine&, TcpSession&);
+ TcpStateEstablished(TcpStateMachine&);
virtual ~TcpStateEstablished(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
- bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
- bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+ bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+ bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
};
#endif
#include "catch/catch.hpp"
#endif
-TcpStateFinWait1::TcpStateFinWait1(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_FIN_WAIT1, tsm, ssn)
+TcpStateFinWait1::TcpStateFinWait1(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_FIN_WAIT1, tsm)
{
}
{
}
-bool TcpStateFinWait1::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- session.check_for_repeated_syn(tsd);
+ trk.session->check_for_repeated_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
check_for_window_slam(tsd, trk);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
if ( check_for_window_slam(tsd, trk) )
{
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
}
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
{
//session.handle_fin_recv_in_fw1(tsd);
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
if ( !flow->two_way_traffic() )
trk.set_tf_flags(TF_FORCE_FLUSH);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait1::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.update_on_rst_recv(tsd) )
{
- session.update_session_on_rst(tsd, true);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
- session.set_pkt_action_flag(ACTION_RST);
+ trk.session->update_session_on_rst(tsd, true);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->set_pkt_action_flag(ACTION_RST);
}
else
{
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
// FIXIT - might be good to create alert specific to RST with data
if ( tsd.get_seg_len() > 0 )
- session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+ trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
return default_state_action(tsd, trk);
}
if ( (trk.normalizer->get_os_policy() == StreamPolicy::OS_WINDOWS)
&& (tsd.get_seg_wnd() == 0))
{
- session.tel.set_tcp_event(EVENT_WINDOW_SLAM);
+ trk.session->tel.set_tcp_event(EVENT_WINDOW_SLAM);
inc_tcp_discards();
if (trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK))
{
- session.set_pkt_action_flag(ACTION_BAD_PKT);
+ trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
return false;
}
}
return true;
}
-bool TcpStateFinWait1::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateFinWait1::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- return session.validate_packet_established_session(tsd);
+ return trk.session->validate_packet_established_session(tsd);
}
-bool TcpStateFinWait1::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateFinWait1::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- session.update_paws_timestamps(tsd);
- session.check_for_window_slam(tsd);
+ trk.session->update_paws_timestamps(tsd);
+ trk.session->check_for_window_slam(tsd);
return true;
}
class TcpStateFinWait1 : public TcpStateHandler
{
public:
- TcpStateFinWait1(TcpStateMachine&, TcpSession&);
+ TcpStateFinWait1(TcpStateMachine&);
virtual ~TcpStateFinWait1(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
- bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
- bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+ bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+ bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
private:
bool check_for_window_slam(TcpSegmentDescriptor&, TcpStreamTracker&);
#include "catch/catch.hpp"
#endif
-TcpStateFinWait2::TcpStateFinWait2(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_FIN_WAIT2, tsm, ssn)
+TcpStateFinWait2::TcpStateFinWait2(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_FIN_WAIT2, tsm)
{
}
{
}
-bool TcpStateFinWait2::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- session.check_for_repeated_syn(tsd);
+ trk.session->check_for_repeated_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( SEQ_GT(tsd.get_seg_ack(), trk.get_snd_nxt() ) )
{
trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
- session.tel.set_tcp_event(EVENT_BAD_ACK);
- session.set_pkt_action_flag(ACTION_BAD_PKT);
+ trk.session->tel.set_tcp_event(EVENT_BAD_ACK);
+ trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
}
else
trk.update_tracker_ack_recv(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
// data on a segment when we shouldn't be sending data any more alert!
- session.tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
- session.mark_packet_for_drop(tsd);
+ trk.session->tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
+ trk.session->mark_packet_for_drop(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( SEQ_GT(tsd.get_seg_ack(), trk.get_snd_nxt() ) )
{
trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
- session.tel.set_tcp_event(EVENT_BAD_ACK);
- session.set_pkt_action_flag(ACTION_BAD_PKT);
+ trk.session->tel.set_tcp_event(EVENT_BAD_ACK);
+ trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
}
else
{
trk.update_tracker_ack_recv(tsd);
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
}
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
trk.update_on_fin_recv(tsd);
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
if ( !flow->two_way_traffic() )
trk.set_tf_flags(TF_FORCE_FLUSH);
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.update_on_rst_recv(tsd) )
{
- session.update_session_on_rst(tsd, true);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
- session.set_pkt_action_flag(ACTION_RST);
+ trk.session->update_session_on_rst(tsd, true);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->set_pkt_action_flag(ACTION_RST);
}
else
{
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
return default_state_action(tsd, trk);
}
-bool TcpStateFinWait2::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateFinWait2::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- return session.validate_packet_established_session(tsd);
+ return trk.session->validate_packet_established_session(tsd);
}
-bool TcpStateFinWait2::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateFinWait2::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- session.update_paws_timestamps(tsd);
- session.check_for_window_slam(tsd);
+ trk.session->update_paws_timestamps(tsd);
+ trk.session->check_for_window_slam(tsd);
return true;
}
class TcpStateFinWait2 : public TcpStateHandler
{
public:
- TcpStateFinWait2(TcpStateMachine&, TcpSession&);
+ TcpStateFinWait2(TcpStateMachine&);
virtual ~TcpStateFinWait2(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
- bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
- bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+ bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+ bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
};
#endif
#include "catch/catch.hpp"
#endif
-TcpStateLastAck::TcpStateLastAck(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_LAST_ACK, tsm, ssn)
+TcpStateLastAck::TcpStateLastAck(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_LAST_ACK, tsm)
{
}
{
}
-bool TcpStateLastAck::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- session.check_for_repeated_syn(tsd);
+ trk.session->check_for_repeated_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
if ( SEQ_EQ(tsd.get_seg_ack(), trk.get_snd_nxt() ) )
trk.set_tcp_state(TcpStreamTracker::TCP_CLOSED);
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
if ( SEQ_EQ(tsd.get_seg_ack(), trk.get_snd_nxt() ) )
trk.set_tcp_state(TcpStreamTracker::TCP_CLOSED);
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.update_on_rst_recv(tsd) )
{
- session.update_session_on_rst(tsd, false);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
- session.set_pkt_action_flag(ACTION_RST);
+ trk.session->update_session_on_rst(tsd, false);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->set_pkt_action_flag(ACTION_RST);
}
else
{
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
// FIXIT - might be good to create alert specific to RST with data
if ( tsd.get_seg_len() > 0 )
- session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+ trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
return default_state_action(tsd, trk);
}
-bool TcpStateLastAck::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateLastAck::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- return session.validate_packet_established_session(tsd);
+ return trk.session->validate_packet_established_session(tsd);
}
-bool TcpStateLastAck::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateLastAck::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- session.update_paws_timestamps(tsd);
- session.check_for_window_slam(tsd);
+ trk.session->update_paws_timestamps(tsd);
+ trk.session->check_for_window_slam(tsd);
- if ( ( session.get_listener_state() == TcpStreamTracker::TCP_CLOSED ) &&
+ if ( ( trk.session->get_listener_state() == TcpStreamTracker::TCP_CLOSED ) &&
( tcp_event != TcpStreamTracker::TCP_FIN_RECV_EVENT ) )
{
- TcpStreamTracker::TcpState talker_state = session.get_talker_state();
+ TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
Flow* flow = tsd.get_flow();
if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT )
{
// The last ACK is a part of the session. Delete the session after processing is
// complete.
- session.clear_session(false, true, false, tsd.get_pkt() );
+ trk.session->clear_session(false, true, false, tsd.get_pkt() );
flow->session_state |= STREAM_STATE_CLOSED;
- session.set_pkt_action_flag(ACTION_LWSSN_CLOSED);
+ trk.session->set_pkt_action_flag(ACTION_LWSSN_CLOSED);
}
}
class TcpStateLastAck : public TcpStateHandler
{
public:
- TcpStateLastAck(TcpStateMachine&, TcpSession&);
+ TcpStateLastAck(TcpStateMachine&);
virtual ~TcpStateLastAck(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
- bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
- bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+ bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+ bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
};
#endif
#include "tcp_normalizer.h"
#include "tcp_state_listen.h"
-TcpStateListen::TcpStateListen(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_LISTEN, tsm, ssn)
+TcpStateListen::TcpStateListen(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_LISTEN, tsm)
{
}
{
}
-bool TcpStateListen::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->require_3whs() || tsd.has_wscale() || ( tsd.get_seg_len() > 0 ) )
+ if ( trk.session->config->require_3whs() || tsd.has_wscale() || ( tsd.get_seg_len() > 0 ) )
{
// FIXIT - do we need this check? only server goes into Listen state...
- if ( tsd.get_pkt()->packet_flags & PKT_FROM_SERVER )
- session.tel.set_tcp_event(EVENT_4WHS);
+ if ( tsd.get_pkt()->is_from_server() )
+ trk.session->tel.set_tcp_event(EVENT_4WHS);
}
return default_state_action(tsd, trk);
}
-bool TcpStateListen::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.init_on_syn_recv(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
- session.set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
+ trk.session->set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
if ( tsd.get_seg_len() > 0 )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateListen::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
Flow* flow = tsd.get_flow();
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
flow->session_state |= ( STREAM_STATE_SYN | STREAM_STATE_SYN_ACK );
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
trk.init_on_synack_sent(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
- session.init_new_tcp_session(tsd);
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
+ trk.session->init_new_tcp_session(tsd);
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateListen::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( !session.config->require_3whs() || session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( !trk.session->config->require_3whs() || trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
trk.init_on_synack_recv(tsd);
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateListen::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
- ( tsd.get_seg_len() > 0 ) ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() )
+ && ( tsd.has_wscale() || ( tsd.get_seg_len() > 0 ) ) )
{
Flow* flow = tsd.get_flow();
flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_SYN_ACK |
STREAM_STATE_ESTABLISHED );
trk.init_on_3whs_ack_sent(tsd);
- session.init_new_tcp_session(tsd);
- session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+ trk.session->init_new_tcp_session(tsd);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateListen::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
- ( tsd.get_seg_len() > 0 ) ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() )
+ && ( tsd.has_wscale() || ( tsd.get_seg_len() > 0 ) ) )
{
Flow* flow = tsd.get_flow();
if ( !tsd.get_tcph()->is_rst() && ( flow->session_state & STREAM_STATE_SYN_ACK ) )
{
trk.init_on_3whs_ack_recv(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
}
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateListen::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
Flow* flow = tsd.get_flow();
flow->set_session_flags(SSNFLAG_MIDSTREAM);
trk.init_on_data_seg_sent(tsd);
- session.init_new_tcp_session(tsd);
+ trk.session->init_new_tcp_session(tsd);
if ( flow->session_state & STREAM_STATE_ESTABLISHED )
- session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateListen::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
Flow* flow = tsd.get_flow();
flow->session_state |= STREAM_STATE_MIDSTREAM;
flow->set_session_flags(SSNFLAG_MIDSTREAM);
trk.init_on_data_seg_recv(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
- session.handle_data_segment(tsd);
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
+ trk.session->handle_data_segment(tsd);
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateListen::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateListen::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
// FIXIT - handle this
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateListen::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
}
return default_state_action(tsd, trk);
}
-bool TcpStateListen::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.normalizer->trim_rst_payload(tsd);
return default_state_action(tsd, trk);
class TcpStateListen : public TcpStateHandler
{
public:
- TcpStateListen(TcpStateMachine&, TcpSession&);
+ TcpStateListen(TcpStateMachine&);
virtual ~TcpStateListen(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
#include "stream/libtcp/stream_tcp_unit_test.h"
#endif
-TcpStateNone::TcpStateNone(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_STATE_NONE, tsm, ssn)
+TcpStateNone::TcpStateNone(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_STATE_NONE, tsm)
{
}
{
}
-bool TcpStateNone::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
Flow* flow = tsd.get_flow();
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
flow->ssn_state.direction = FROM_CLIENT;
flow->session_state |= STREAM_STATE_SYN;
trk.init_on_syn_sent(tsd);
- session.init_new_tcp_session(tsd);
+ trk.session->init_new_tcp_session(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateNone::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
// FIXIT - syn received on undefined client, figure this out and do the right thing
return default_state_action(tsd, trk);
}
-bool TcpStateNone::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
Flow* flow = tsd.get_flow();
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
- if ( !session.config->require_3whs() || session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( !trk.session->config->require_3whs() || trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
flow->session_state |= ( STREAM_STATE_SYN | STREAM_STATE_SYN_ACK );
trk.init_on_synack_sent(tsd);
- session.init_new_tcp_session(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.session->init_new_tcp_session(tsd);
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateNone::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
trk.init_on_synack_recv(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateNone::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
( tsd.get_seg_len() > 0 ) ) )
{
Flow* flow = tsd.get_flow();
flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_SYN_ACK |
STREAM_STATE_ESTABLISHED );
trk.init_on_3whs_ack_sent(tsd);
- session.init_new_tcp_session(tsd);
- session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+ trk.session->init_new_tcp_session(tsd);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateNone::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
( tsd.get_seg_len() > 0 ) ) )
{
Flow* flow = tsd.get_flow();
if ( !tsd.get_tcph()->is_rst() && ( flow->session_state & STREAM_STATE_SYN_ACK ) )
{
trk.init_on_3whs_ack_recv(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
}
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateNone::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
Flow* flow = tsd.get_flow();
flow->set_session_flags(SSNFLAG_MIDSTREAM);
trk.init_on_data_seg_sent(tsd);
- session.init_new_tcp_session(tsd);
+ trk.session->init_new_tcp_session(tsd);
if ( flow->session_state & STREAM_STATE_ESTABLISHED )
- session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateNone::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
Flow* flow = tsd.get_flow();
flow->set_session_flags(SSNFLAG_MIDSTREAM);
trk.init_on_data_seg_recv(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
- session.handle_data_segment(tsd);
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
+ trk.session->handle_data_segment(tsd);
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateNone::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
// FIXIT - handle this
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateNone::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
// FIXIT - handle this
}
- else if ( session.config->require_3whs() )
+ else if ( trk.session->config->require_3whs() )
{
- session.generate_no_3whs_event();
+ trk.session->generate_no_3whs_event();
return false;
}
return default_state_action(tsd, trk);
}
-bool TcpStateNone::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
{
// FIXIT - handle this
}
return default_state_action(tsd, trk);
}
-bool TcpStateNone::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.update_on_rst_recv(tsd) )
{
- session.update_session_on_rst(tsd, false);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
- session.set_pkt_action_flag(ACTION_RST);
+ trk.session->update_session_on_rst(tsd, false);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->set_pkt_action_flag(ACTION_RST);
}
else
{
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
return default_state_action(tsd, trk);
class TcpStateNone : public TcpStateHandler
{
public:
- TcpStateNone(TcpStateMachine&, TcpSession&);
+ TcpStateNone(TcpStateMachine&);
virtual ~TcpStateNone(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
#include "tcp_normalizer.h"
#include "tcp_state_syn_recv.h"
-TcpStateSynRecv::TcpStateSynRecv(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_SYN_RECV, tsm, ssn)
+TcpStateSynRecv::TcpStateSynRecv(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_SYN_RECV, tsm)
{
}
{
}
-bool TcpStateSynRecv::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
Flow* flow = tsd.get_flow();
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
trk.finish_server_init(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
- session.update_timestamp_tracking(tsd);
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
+ trk.session->update_timestamp_tracking(tsd);
if ( tsd.get_tcph()->are_flags_set(TH_ECE) &&
( flow->get_session_flags() & SSNFLAG_ECN_CLIENT_QUERY ) )
flow->set_session_flags(SSNFLAG_ECN_SERVER_REPLY);
- if ( tsd.get_pkt()->packet_flags & PKT_FROM_SERVER )
+ if ( tsd.get_pkt()->is_from_server() )
{
flow->set_session_flags(SSNFLAG_SEEN_SERVER);
- session.tel.set_tcp_event(EVENT_4WHS);
+ trk.session->tel.set_tcp_event(EVENT_4WHS);
}
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
Flow* flow = tsd.get_flow();
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
// FIXIT - verify ack being sent is valid...
trk.finish_server_init(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
flow->session_state |= STREAM_STATE_SYN_ACK;
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.is_ack_valid(tsd.get_seg_ack() ) )
{
Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
flow->set_session_flags(SSNFLAG_ESTABLISHED);
flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_ESTABLISHED );
- session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
trk.set_tcp_state(TcpStreamTracker::TCP_ESTABLISHED);
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
}
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- if ( session.config->midstream_allowed(tsd.get_pkt()) )
+ if ( trk.session->config->midstream_allowed(tsd.get_pkt()) )
{
- session.update_session_on_ack( );
+ trk.session->update_session_on_ack( );
}
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.is_ack_valid(tsd.get_seg_ack() ) )
{
Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
- session.set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
+ trk.session->set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
tsd.get_pkt()->packet_flags |= PKT_STREAM_TWH;
flow->set_session_flags(SSNFLAG_ESTABLISHED);
flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_ESTABLISHED );
- session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
trk.set_tcp_state(TcpStreamTracker::TCP_ESTABLISHED);
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
else
- session.check_for_window_slam(tsd);
+ trk.session->check_for_window_slam(tsd);
}
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.is_ack_valid(tsd.get_seg_ack() ) )
{
trk.update_tracker_ack_recv(tsd);
tsd.get_pkt()->packet_flags |= PKT_STREAM_TWH;
- session.set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
- session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+ trk.session->set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
trk.set_tcp_state(TcpStreamTracker::TCP_ESTABLISHED);
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
}
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
if ( tsd.get_tcph()->is_ack() )
{
Flow* flow = tsd.get_flow();
trk.update_tracker_ack_recv(tsd);
- session.set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
+ trk.session->set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
flow->session_state |= STREAM_STATE_ACK;
if ( tsd.get_seg_len() > 0 )
{
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
trk.flush_data_on_fin_recv(tsd);
}
trk.update_on_fin_recv(tsd);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
trk.set_tcp_state(TcpStreamTracker::TCP_CLOSE_WAIT);
}
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.normalizer->trim_rst_payload(tsd);
if ( trk.normalizer->validate_rst(tsd) )
{
DebugMessage(DEBUG_STREAM_STATE, "Received RST with bad sequence number\n");
inc_tcp_discards();
trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
// FIXIT - might be good to create alert specific to RST with data
if ( tsd.get_seg_len() > 0 )
- session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+ trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
return default_state_action(tsd, trk);
}
-bool TcpStateSynRecv::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateSynRecv::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- session.check_for_window_slam(tsd);
+ trk.session->check_for_window_slam(tsd);
return true;
}
class TcpStateSynRecv : public TcpStateHandler
{
public:
- TcpStateSynRecv(TcpStateMachine&, TcpSession&);
+ TcpStateSynRecv(TcpStateMachine&);
virtual ~TcpStateSynRecv(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
- bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+ bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
};
#endif
#include "catch/catch.hpp"
#endif
-TcpStateSynSent::TcpStateSynSent(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_SYN_SENT, tsm, ssn)
+TcpStateSynSent::TcpStateSynSent(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_SYN_SENT, tsm)
{
}
{
}
-bool TcpStateSynSent::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- session.check_for_repeated_syn(tsd);
+ trk.session->check_for_repeated_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.finish_client_init(tsd);
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
trk.set_tcp_state(TcpStreamTracker::TCP_SYN_RECV);
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.update_on_3whs_ack(tsd) )
{
- session.update_timestamp_tracking(tsd);
+ trk.session->update_timestamp_tracking(tsd);
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
}
else
- session.set_pkt_action_flag(ACTION_BAD_PKT);
+ trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
Flow* flow = tsd.get_flow();
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
// FIXIT - verify ack being sent is valid...
trk.update_tracker_ack_sent(tsd);
flow->set_session_flags(SSNFLAG_ESTABLISHED);
flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_ESTABLISHED );
- session.update_timestamp_tracking(tsd);
- session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+ trk.session->update_timestamp_tracking(tsd);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
trk.set_tcp_state(TcpStreamTracker::TCP_ESTABLISHED);
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
Flow* flow = tsd.get_flow();
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
// FIXIT - verify ack being sent is valid...
trk.update_tracker_ack_sent(tsd);
flow->set_session_flags(SSNFLAG_ESTABLISHED);
flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_ESTABLISHED );
- session.update_timestamp_tracking(tsd);
- session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+ trk.session->update_timestamp_tracking(tsd);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
trk.set_tcp_state(TcpStreamTracker::TCP_ESTABLISHED);
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateSynSent::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.update_on_rst_recv(tsd) )
{
- session.update_session_on_rst(tsd, false);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
- session.set_pkt_action_flag(ACTION_RST);
+ trk.session->update_session_on_rst(tsd, false);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->set_pkt_action_flag(ACTION_RST);
}
else
{
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
// FIXIT - might be good to create alert specific to RST with data
if ( tsd.get_seg_len() > 0 )
- session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+ trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
return default_state_action(tsd, trk);
}
class TcpStateSynSent : public TcpStateHandler
{
public:
- TcpStateSynSent(TcpStateMachine&, TcpSession&);
+ TcpStateSynSent(TcpStateMachine&);
virtual ~TcpStateSynSent(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
#include "catch/catch.hpp"
#endif
-TcpStateTimeWait::TcpStateTimeWait(TcpStateMachine& tsm, TcpSession& ssn) :
- TcpStateHandler(TcpStreamTracker::TCP_TIME_WAIT, tsm, ssn)
+TcpStateTimeWait::TcpStateTimeWait(TcpStateMachine& tsm) :
+ TcpStateHandler(TcpStreamTracker::TCP_TIME_WAIT, tsm)
{
}
{
}
-bool TcpStateTimeWait::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
- session.check_for_repeated_syn(tsd);
+ trk.session->check_for_repeated_syn(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
-{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
- trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+
+bool TcpStateTimeWait::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
+{
+ trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
if ( tsd.get_seg_len() )
- session.handle_data_on_syn(tsd);
+ trk.session->handle_data_on_syn(tsd);
return true;
}
-bool TcpStateTimeWait::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_sent(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
// data on a segment when we shouldn't be sending data any more alert!
- session.tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
- session.mark_packet_for_drop(tsd);
+ trk.session->tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
+ trk.session->mark_packet_for_drop(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
trk.update_tracker_ack_recv(tsd);
if ( SEQ_GEQ(tsd.get_seg_seq(), trk.get_fin_final_seq() ) )
{
DebugMessage(DEBUG_STREAM_STATE, "FIN beyond previous, ignoring\n");
- session.tel.set_tcp_event(EVENT_BAD_FIN);
+ trk.session->tel.set_tcp_event(EVENT_BAD_FIN);
trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
- session.set_pkt_action_flag(ACTION_BAD_PKT);
+ trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
}
else if ( tsd.get_seg_len() > 0 )
- session.handle_data_segment(tsd);
+ trk.session->handle_data_segment(tsd);
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
if ( trk.update_on_rst_recv(tsd) )
{
- session.update_session_on_rst(tsd, false);
- session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
- session.set_pkt_action_flag(ACTION_RST);
+ trk.session->update_session_on_rst(tsd, false);
+ trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+ trk.session->set_pkt_action_flag(ACTION_RST);
}
else
{
- session.tel.set_tcp_event(EVENT_BAD_RST);
+ trk.session->tel.set_tcp_event(EVENT_BAD_RST);
}
// FIXIT - might be good to create alert specific to RST with data
if ( tsd.get_seg_len() > 0 )
- session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+ trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
return default_state_action(tsd, trk);
}
-bool TcpStateTimeWait::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateTimeWait::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- return session.validate_packet_established_session(tsd);
+ return trk.session->validate_packet_established_session(tsd);
}
-bool TcpStateTimeWait::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateTimeWait::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
{
- session.update_paws_timestamps(tsd);
- session.check_for_window_slam(tsd);
+ trk.session->update_paws_timestamps(tsd);
+ trk.session->check_for_window_slam(tsd);
if ( tcp_event != TcpStreamTracker::TCP_FIN_RECV_EVENT )
{
- TcpStreamTracker::TcpState talker_state = session.get_talker_state();
+ TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
Flow* flow = tsd.get_flow();
if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT )
{
// The last ACK is a part of the session. Delete the session after processing is
// complete.
- session.clear_session(false, true, false, tsd.get_pkt() );
+ trk.session->clear_session(false, true, false, tsd.get_pkt() );
flow->session_state |= STREAM_STATE_CLOSED;
- session.set_pkt_action_flag(ACTION_LWSSN_CLOSED);
+ trk.session->set_pkt_action_flag(ACTION_LWSSN_CLOSED);
}
}
return true;
class TcpStateTimeWait : public TcpStateHandler
{
public:
- TcpStateTimeWait(TcpStateMachine&, TcpSession&);
+ TcpStateTimeWait(TcpStateMachine&);
virtual ~TcpStateTimeWait(void);
bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
- bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
- bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+ bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+ bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
};
#endif
--- /dev/null
+//--------------------------------------------------------------------------
+// Copyright (C) 2015-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation. You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+//--------------------------------------------------------------------------
+
+// tcp_stream_state_machine.cc author davis mcpherson <davmcphe@@cisco.com>
+// Created on: Apr 1, 2016
+
+#include "tcp_state_none.h"
+#include "tcp_state_closed.h"
+#include "tcp_state_listen.h"
+#include "tcp_state_syn_sent.h"
+#include "tcp_state_syn_recv.h"
+#include "tcp_state_established.h"
+#include "tcp_state_close_wait.h"
+#include "tcp_state_closing.h"
+#include "tcp_state_fin_wait1.h"
+#include "tcp_state_fin_wait2.h"
+#include "tcp_state_last_ack.h"
+#include "tcp_state_time_wait.h"
+
+#include "tcp_stream_state_machine.h"
+
+TcpStreamStateMachine::TcpStreamStateMachine()
+{
+ // TODO Auto-generated destructor stub
+}
+
+TcpStreamStateMachine::~TcpStreamStateMachine()
+{
+ // TODO Auto-generated destructor stub
+}
+
+void TcpStreamStateMachine::initialize_tsm(void)
+{
+ // initialize stream tracker state machine with handler for each state...
+ new TcpStateNone(*this);
+ new TcpStateClosed(*this);
+ new TcpStateListen(*this);
+ new TcpStateSynSent(*this);
+ new TcpStateSynRecv(*this);
+ new TcpStateEstablished(*this);
+ new TcpStateFinWait1(*this);
+ new TcpStateFinWait2(*this);
+ new TcpStateClosing(*this);
+ new TcpStateCloseWait(*this);
+ new TcpStateLastAck(*this);
+ new TcpStateTimeWait(*this);
+}
+
--- /dev/null
+//--------------------------------------------------------------------------
+// Copyright (C) 2015-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation. You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+//--------------------------------------------------------------------------
+
+// tcp_stream_state_machine.h author davis mcpherson <davmcphe@@cisco.com>
+// Created on: Apr 1, 2016
+
+#ifndef TCP_STREAM_STATE_MACHINE_H_
+#define TCP_STREAM_STATE_MACHINE_H_
+
+#include "stream/libtcp/tcp_state_machine.h"
+
+class TcpStreamStateMachine: public TcpStateMachine
+{
+public:
+ virtual ~TcpStreamStateMachine();
+
+
+ static TcpStateMachine* get_instance( void )
+ {
+ static TcpStreamStateMachine* tsm = nullptr;
+
+ if( !tsm )
+ {
+ tsm = new TcpStreamStateMachine;
+ tsm->initialize_tsm();
+ }
+
+ return tsm;
+ }
+
+private:
+ TcpStreamStateMachine();
+ void initialize_tsm(void);
+
+};
+#endif
+
#include "tcp_module.h"
#include "tcp_normalizers.h"
#include "tcp_reassemblers.h"
+#include "tcp_session.h"
-TcpTracker::TcpTracker(bool client) :
+TcpTracker::TcpTracker(bool client, TcpSession* ssn) :
TcpStreamTracker(client)
{
+ session = ssn;
}
TcpTracker::~TcpTracker(void)
{
if ( splitter == nullptr )
flush_policy = STREAM_FLPOLICY_IGNORE;
- else if ( !normalizer->is_tcp_ips_enabled() )
- flush_policy = STREAM_FLPOLICY_ON_ACK;
- else
+ else if ( normalizer->is_tcp_ips_enabled() )
flush_policy = STREAM_FLPOLICY_ON_DATA;
+ else
+ flush_policy = STREAM_FLPOLICY_ON_ACK;
}
void TcpTracker::set_splitter(StreamSplitter* ss)
class TcpNormalizer;
class TcpReassembler;
+class TcpSession;
class TcpTracker : public TcpStreamTracker
{
public:
- TcpTracker(bool);
+ TcpTracker(bool, TcpSession*);
virtual ~TcpTracker(void);
void init_tcp_state(void) override;
return 0;
/* if both seen, mark established */
- if (p->packet_flags & PKT_FROM_SERVER)
+ if (p->is_from_server())
{
DebugMessage(DEBUG_STREAM_STATE,
"Stream: Updating on packet from responder\n");
if ( !(flow->ssn_state.session_flags & SSNFLAG_ESTABLISHED) )
{
- if ( p->packet_flags & PKT_FROM_CLIENT )
+ if ( p->is_from_client() )
flow->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT;
else
flow->ssn_state.session_flags |= SSNFLAG_SEEN_SERVER;
void UserSession::restart(Packet* p)
{
- bool c2s = p->packet_flags & PKT_FROM_CLIENT;
+ bool c2s = p->is_from_client();
UserTracker& ut = c2s ? server : client;
std::list<UserSegment*>::iterator it;
ut.total = 0;
update(p, flow);
- UserTracker& ut = p->from_client() ? server : client;
+ UserTracker& ut = p->is_from_client() ? server : client;
if ( p->ptrs.decode_flags & DECODE_SOF or !ut.splitter )
start(p, flow);
projects / thirdparty / snort3.git / commitdiff
