Pull request #5099: stream_tcp: default to overwrite upon zwp mismatch instead of...

Merge in SNORT/snort3 from ~JALIIMRA/snort3:zwp_mismatch to master

Squashed commit of the following:

commit 9888d121ef1596f5c26466f0510f36480566d56b
Author: Juweria Ali Imran <jaliimra@cisco.com>
Date:   Thu Jan 15 11:31:30 2026 -0500

    stream_tcp: default to overwrite upon zwp mismatch instead of session block

diff --git a/src/stream/tcp/tcp_normalizer.cc b/src/stream/tcp/tcp_normalizer.cc
index 2d8a5172e9a7166309413225028c9cd3bdaccf11..e9ad47d14a908f38d91fe6c5f8a605b464dc0319 100644 (file)
--- a/src/stream/tcp/tcp_normalizer.cc
+++ b/src/stream/tcp/tcp_normalizer.cc
@@ -169,17 +169,6 @@ bool TcpNormalizer::strip_tcp_timestamp(
     return false;
 }
 
-void TcpNormalizer::session_blocker(
-    TcpNormalizerState&, TcpSegmentDescriptor& tsd)
-{
-    Packet *p = tsd.get_pkt();
-    DetectionEngine::disable_all(p);
-    p->active->block_session(p, true);
-    p->active->set_drop_reason("stream");
-    if (PacketTracer::is_active())
-        PacketTracer::log("stream_tcp: TCP normalizer - Zero Window Probe byte data mismatch\n");
-}
-
 bool TcpNormalizer::packet_dropper(
     TcpNormalizerState& tns, TcpSegmentDescriptor& tsd, NormFlags f)
 {

diff --git a/src/stream/tcp/tcp_normalizer.h b/src/stream/tcp/tcp_normalizer.h
index f09abc800d812736d0aa3ec4ee0d39ae9db4d3bd..eeaf420789e8155e34f3a880d1cf15fd8764c45e 100644 (file)
--- a/src/stream/tcp/tcp_normalizer.h
+++ b/src/stream/tcp/tcp_normalizer.h
@@ -74,7 +74,6 @@ public:
 
     virtual NormStatus apply_normalizations(
         State&, TcpSegmentDescriptor&, uint32_t seq, bool stream_is_inorder);
-    virtual void session_blocker(State&, TcpSegmentDescriptor&);
     virtual bool packet_dropper(State&, TcpSegmentDescriptor&, NormFlags);
     virtual bool trim_syn_payload(State&, TcpSegmentDescriptor&, uint32_t max = 0);
     virtual void trim_rst_payload(State&, TcpSegmentDescriptor&, uint32_t max = 0);

diff --git a/src/stream/tcp/tcp_normalizers.h b/src/stream/tcp/tcp_normalizers.h
index addb4b3ae91d8236bdabbf76b231b37409bce99b..d628f686f38e018c08f3898d196722a2b09ad701 100644 (file)
--- a/src/stream/tcp/tcp_normalizers.h
+++ b/src/stream/tcp/tcp_normalizers.h
@@ -51,9 +51,6 @@ public:
     TcpNormalizer::NormStatus apply_normalizations(TcpSegmentDescriptor& tsd, uint32_t seq, bool stream_is_inorder)
     { return norm->apply_normalizations(tns, tsd, seq, stream_is_inorder); }
 
-    void session_blocker(TcpSegmentDescriptor& tsd)
-    { norm->session_blocker(tns, tsd); }
-
     bool packet_dropper(TcpSegmentDescriptor& tsd, NormFlags nflags)
     { return norm->packet_dropper(tns, tsd, nflags); }
 

diff --git a/src/stream/tcp/tcp_overlap_resolver.cc b/src/stream/tcp/tcp_overlap_resolver.cc
index d482c3bc296f1577355360470bb92fe7896db28a..7081ed838d440ff4defd27755739287188d510c4 100644 (file)
--- a/src/stream/tcp/tcp_overlap_resolver.cc
+++ b/src/stream/tcp/tcp_overlap_resolver.cc
@@ -335,13 +335,6 @@ void TcpOverlapResolver::full_right_overlap_truncate_new(TcpOverlapState& tos)
     if ( tos.tcp_ips_data == NORM_MODE_ON )
     {
         unsigned offset = tos.right->start_seq() - tos.tsd->get_seq();
-        if ( !offset && zwp_data_mismatch(tos, *tos.tsd, tos.right->length))
-        {
-            tos.seglist.tracker->normalizer.session_blocker(*tos.tsd);
-            tos.keep_segment = false;
-            return;
-        }
-
         tos.tsd->rewrite_payload(offset, tos.right->payload(), tos.right->length);
     }
 
@@ -435,18 +428,6 @@ void TcpOverlapResolver::full_right_overlap_os5(TcpOverlapState& tos)
     full_right_overlap_truncate_new(tos);
 }
 
-bool TcpOverlapResolver::zwp_data_mismatch(TcpOverlapState& tos, TcpSegmentDescriptor& tsd, uint32_t overlap)
-{
-    if ( overlap == MAX_ZERO_WIN_PROBE_LEN
-        and tos.right->start_seq() == tos.seglist.tracker->normalizer.get_zwp_seq()
-        and (tos.right->data[0] != tsd.get_pkt()->data[0]) )
-    {
-        return tsd.is_nap_policy_inline();
-    }
-
-    return false;
-}
-
 class TcpOverlapResolverFirst : public TcpOverlapResolver
 {
 public:

diff --git a/src/stream/tcp/tcp_overlap_resolver.h b/src/stream/tcp/tcp_overlap_resolver.h
index 5ae6560aac9dcafdaeaadd83dfb228ae8e2ee523..1e114f84241ee7233fed0c7e4cf1bdde5829f451 100644 (file)
--- a/src/stream/tcp/tcp_overlap_resolver.h
+++ b/src/stream/tcp/tcp_overlap_resolver.h
@@ -83,7 +83,6 @@ public:
 protected:
     virtual bool is_segment_retransmit(TcpOverlapState&, bool*);
     virtual void drop_old_segment(TcpOverlapState&);
-    virtual bool zwp_data_mismatch(TcpOverlapState&, TcpSegmentDescriptor&, uint32_t);
 
     virtual void left_overlap_keep_first(TcpOverlapState&);
     virtual void left_overlap_trim_first(TcpOverlapState&);