From: Russ Combs <rucombs@cisco.com>
Date: Wed, 12 Nov 2014 18:06:42 +0000 (-0500)
Subject: flush available data for atom splitter
X-Git-Tag: 3.0.0-233~1232
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d1f7ea366dd841df08096098ce3f90a6cf86f10f;p=thirdparty%2Fsnort3.git

flush available data for atom splitter
---

diff --git a/ChangeLog b/ChangeLog
index f565228a3..2453af6b7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,6 +20,7 @@
 -- josh fixed a decoding issue affecting fragged packets
 -- fixed byte_test config of compare value
 -- fixed byte_test endian
+-- flush available data for non-paf splitters
 
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug
diff --git a/src/stream/tcp/stream_paf.cc b/src/stream/tcp/stream_paf.cc
index 0d041c7d2..c22dbdf09 100644
--- a/src/stream/tcp/stream_paf.cc
+++ b/src/stream/tcp/stream_paf.cc
@@ -291,10 +291,7 @@ uint32_t s5_paf_check (
         if ( ft != FT_NOP )
         {
             fp = s5_paf_flush(ss, ps, ft, flags);
-
-            ps->pos += fp;
-            ps->seq = ps->pos;
-
+            s5_paf_jump(ps, fp);
             return fp;
         }
         if ( !cont )
@@ -315,10 +312,7 @@ uint32_t s5_paf_check (
     if ( (ps->paf != StreamSplitter::FLUSH) && (s5_len > ss->max()+fuzz) )
     {
         uint32_t fp = s5_paf_flush(ss, ps, FT_MAX, flags);
-
-        ps->pos += fp;
-        ps->seq = ps->pos;
-
+        s5_paf_jump(ps, fp);
         return fp;
     }
     return 0;
diff --git a/src/stream/tcp/stream_paf.h b/src/stream/tcp/stream_paf.h
index 68296a607..bf6b72146 100644
--- a/src/stream/tcp/stream_paf.h
+++ b/src/stream/tcp/stream_paf.h
@@ -69,6 +69,12 @@ static inline uint32_t s5_paf_active (PAF_State* ps)
     return ( ps->paf != StreamSplitter::ABORT );
 }
 
+static inline void s5_paf_jump(PAF_State* ps, uint32_t n)
+{
+    ps->pos += n;
+    ps->seq = ps->pos;
+}
+
 // called on each in order segment
 uint32_t s5_paf_check(
     StreamSplitter* paf_config, PAF_State*, Flow* ssn,
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index dd64fde95..3fd119a48 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -5908,13 +5908,13 @@ static inline uint32_t flush_pdu_ips (
         if ( flush_pt > 0 )
         {
             MODULE_PROFILE_END(s5TcpPAFPerfStats);
-#if 0
-            // for non-paf splitters, flush_pt > 0 means we reached
-            // the minimum required, but we flush what is available 
-            // instead of creating more, but smaller, packets
+
+            // see flush_pdu_ackd()
             if ( !trk->splitter->is_paf() && avail > flush_pt )
+            {
+                s5_paf_jump(&trk->paf_state, avail - flush_pt);
                 return avail;
-#endif
+            }
             return flush_pt;
         }
         seg = seg->next;
@@ -6071,17 +6071,20 @@ static inline uint32_t flush_pdu_ackd (
         if ( flush_pt > 0 )
         {
             MODULE_PROFILE_END(s5TcpPAFPerfStats);
-#if 0
+
             // for non-paf splitters, flush_pt > 0 means we reached
             // the minimum required, but we flush what is available 
             // instead of creating more, but smaller, packets
             if ( !trk->splitter->is_paf() )
             {
-                uint32_t avail = get_q_footprint(trk);
+                // get_q_footprint() w/o side effects
+                uint32_t avail = (trk->r_win_base - trk->seglist_base_seq);
                 if ( avail > flush_pt )
+                {
+                    s5_paf_jump(&trk->paf_state, avail - flush_pt);
                     return avail;
+                }
             }
-#endif
             return flush_pt;
         }
         seg = seg->next;