aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Force stream reassembly on streams where we didn't yet detect the protocol if the stream is closing.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 15 years ago
parent cbebc44fb2
commit 66dee577d7
1 changed files with 27 additions and 23 deletions
Show Stats Download Patch File Download Diff File

50
src/stream-tcp-reassemble.c
Unescape Escape View File

@ -1526,31 +1526,35 @@ int StreamTcpReassembleHandleSegmentUpdateACK (TcpReassemblyThreadCtx *ra_ctx,
/* check if we have detected the app layer protocol or not. If it has been /* check if we have detected the app layer protocol or not. If it has been
detected then, process data normally, as we have sent one smsg from detected then, process data normally, as we have sent one smsg from
toserver side already to the app layer */ toserver side already to the app layer */
if (!(ssn->flags & STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED)) { if (ssn->state <= TCP_ESTABLISHED) {
/* Do not perform reassembling of data from server, until the app layer if (!(ssn->flags & STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED)) {
proto has been detected and we have sent atleast one smsg from client /* Do not perform reassembling of data from server, until the app layer
data to app layer */ proto has been detected and we have sent atleast one smsg from client
if (PKT_IS_TOSERVER(p)) { data to app layer */
SCLogDebug("we didn't detected the app layer protocol till " if (PKT_IS_TOSERVER(p)) {
"yet, so not doing toclient reassembling"); SCLogDebug("we didn't detected the app layer protocol till "
SCReturnInt(0); "yet, so not doing toclient reassembling");
/* unset the queue init flag, as app layer protocol has not been SCReturnInt(0);
detected till yet and we need to send the initial smsg again to app /* unset the queue init flag, as app layer protocol has not been
layer */ detected till yet and we need to send the initial smsg again to app
} if (PKT_IS_TOCLIENT(p)) { layer */
} if (PKT_IS_TOCLIENT(p)) {
ra_ctx->stream_q->flags &= ~STREAMQUEUE_FLAG_INIT;
}
/* initialize the tmp_ra_base_seq for each new run */
stream->tmp_ra_base_seq = stream->ra_base_seq;
ra_base_seq = stream->tmp_ra_base_seq;
/* if app layer protocol has been detected, then restore the reassembled
seq. to the value till reassembling has been done and unset the queue
init flag permanently for this tcp session */
} else if (stream->tmp_ra_base_seq > stream->ra_base_seq) {
stream->ra_base_seq = stream->tmp_ra_base_seq;
ra_ctx->stream_q->flags &= ~STREAMQUEUE_FLAG_INIT; ra_ctx->stream_q->flags &= ~STREAMQUEUE_FLAG_INIT;
ra_base_seq = stream->ra_base_seq;
SCLogDebug("the app layer protocol has been detected");
} else {
ra_base_seq = stream->ra_base_seq;
} }
/* initialize the tmp_ra_base_seq for each new run */
stream->tmp_ra_base_seq = stream->ra_base_seq;
ra_base_seq = stream->tmp_ra_base_seq;
/* if app layer protocol has been detected, then restore the reassembled
seq. to the value till reassembling has been done and unset the queue
init flag permanently for this tcp session */
} else if (stream->tmp_ra_base_seq > stream->ra_base_seq) {
stream->ra_base_seq = stream->tmp_ra_base_seq;
ra_ctx->stream_q->flags &= ~STREAMQUEUE_FLAG_INIT;
ra_base_seq = stream->ra_base_seq;
SCLogDebug("the app layer protocol has been detected");
/* set the ra_bas_seq to stream->ra_base_seq as now app layer protocol /* set the ra_bas_seq to stream->ra_base_seq as now app layer protocol
has been detected */ has been detected */
} else { } else {

Write Preview
Loading…
Cancel
Save