aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Stream engine memory handling update

Browse Source 
The stream engine memory handling needed updating as it didn't scale. Changes:

- pools can now be initialized to size 0, meaning unlimited
- stream engine uses a memcap setting. Sessions, segments and aldata is part
  of this, app layer state isn't.
- memory is accounted using a global int that is spinlocked.
- a counter for sessions that have not been picked up because of memcap was
  added.
- all reassembly errors are converted to debug msgs.
remotes/origin/master-1.0.x
Victor Julien 16 years ago
parent df4c642c70
commit 6a53ab9c5a
26 changed files with 675 additions and 175 deletions
Show Stats Download Patch File Download Diff File

19
src/app-layer-dcerpc.c
Unescape Escape View File

@ -16,6 +16,7 @@
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer-protos.h"
@ -1600,9 +1601,11 @@ int DCERPCParserTest01(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_START, dcerpcbind, bindlen);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
@ -1670,6 +1673,8 @@ int DCERPCParserTest01(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -1815,9 +1820,11 @@ int DCERPCParserTest02(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_START, dcerpcrequest, requestlen);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
@ -1858,6 +1865,8 @@ int DCERPCParserTest02(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -2003,9 +2012,11 @@ int DCERPCParserTest03(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_START, dcerpcrequest, requestlen);
if (r != 0) {
printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
@ -2039,6 +2050,8 @@ int DCERPCParserTest03(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

3
src/app-layer-detect-proto.c
Unescape Escape View File

@ -29,6 +29,7 @@
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer-protos.h"
@ -374,7 +375,7 @@ int AppLayerHandleMsg(AlpProtoDetectThreadCtx *dp_ctx, StreamMsg *smsg)
smsg->data.data, smsg->data.data_len, smsg->flags);
if (alproto != ALPROTO_UNKNOWN) {
/* store the proto and setup the L7 data array */
StreamL7DataPtrInit(ssn,StreamL7GetStorageSize());
StreamL7DataPtrInit(ssn);
ssn->alproto = alproto;
r = AppLayerParse(smsg->flow, alproto, smsg->flags,

33
src/app-layer-ftp.c
Unescape Escape View File

@ -17,6 +17,7 @@
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer-protos.h"
@ -277,9 +278,11 @@ int FTPParserTest01(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER|STREAM_EOF, ftpbuf, ftplen);
if (r != 0) {
SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -301,6 +304,8 @@ int FTPParserTest01(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -318,9 +323,11 @@ int FTPParserTest03(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER|STREAM_START, ftpbuf1, ftplen1);
if (r != 0) {
SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -356,6 +363,8 @@ int FTPParserTest03(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -369,10 +378,11 @@ int FTPParserTest06(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER|STREAM_START|STREAM_EOF, ftpbuf1, ftplen1);
if (r != 0) {
SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -394,6 +404,8 @@ int FTPParserTest06(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -409,10 +421,11 @@ int FTPParserTest07(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER|STREAM_START, ftpbuf1, ftplen1);
if (r != 0) {
SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -441,6 +454,8 @@ int FTPParserTest07(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -455,9 +470,11 @@ int FTPParserTest10(void) {
int r = 0;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
uint32_t u;
for (u = 0; u < ftplen1; u++) {
uint8_t flags = 0;
@ -488,6 +505,8 @@ int FTPParserTest10(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
#endif /* UNITTESTS */

40
src/app-layer-htp.c
Unescape Escape View File

@ -18,6 +18,7 @@
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer-protos.h"
@ -339,9 +340,11 @@ int HTPParserTest01(void) {
int r = 0;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
uint32_t u;
for (u = 0; u < httplen1; u++) {
uint8_t flags = 0;
@ -387,6 +390,8 @@ int HTPParserTest01(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -400,10 +405,11 @@ int HTPParserTest02(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_START|
STREAM_EOF, httpbuf1, httplen1);
if (r != 0) {
@ -434,6 +440,8 @@ int HTPParserTest02(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -448,9 +456,11 @@ int HTPParserTest03(void) {
int r = 0;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
uint32_t u;
for (u = 0; u < httplen1; u++) {
uint8_t flags = 0;
@ -493,6 +503,8 @@ int HTPParserTest03(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -507,9 +519,11 @@ int HTPParserTest04(void) {
int r = 0;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
r = AppLayerParse(&f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_START|
STREAM_EOF, httpbuf1, httplen1);
@ -538,6 +552,8 @@ int HTPParserTest04(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -563,10 +579,11 @@ int HTPParserTest05(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_START,
httpbuf1, httplen1);
if (r != 0) {
@ -648,6 +665,8 @@ int HTPParserTest05(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -702,10 +721,11 @@ int HTPParserTest06(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_START,
httpbuf1, httplen1);
if (r != 0) {
@ -757,6 +777,8 @@ int HTPParserTest06(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
#endif /* UNITTESTS */

8
src/app-layer-parser.c
Unescape Escape View File

@ -9,6 +9,7 @@
#include "util-print.h"
#include "util-pool.h"
#include "stream-tcp.h"
#include "stream-tcp-private.h"
#include "stream.h"
#include "stream-tcp-reassemble.h"
@ -896,6 +897,7 @@ void AppLayerParserCleanupState(TcpSession *ssn)
ssn->aldata[app_layer_sid] = NULL;
}
StreamTcpDecrMemuse((uint32_t)(StreamL7GetStorageSize() * sizeof(void *)));
free(ssn->aldata);
ssn->aldata = NULL;
}
@ -1047,7 +1049,6 @@ static int AppLayerParserTest01 (void)
TestProtocolStateFree);
ssn.alproto = ALPROTO_TEST;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
inet_pton(AF_INET, "1.2.3.4", &addr.s_addr);
@ -1062,6 +1063,9 @@ static int AppLayerParserTest01 (void)
f.dp = htons(40);
f.proto = IPPROTO_TCP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_TEST, STREAM_TOSERVER|STREAM_EOF, testbuf,
testlen);
if (r != -1) {
@ -1084,6 +1088,8 @@ static int AppLayerParserTest01 (void)
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

13
src/app-layer-smb.c
Unescape Escape View File

@ -16,6 +16,7 @@
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer-protos.h"
@ -1109,9 +1110,11 @@ int SMBParserTest01(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_SMB, STREAM_TOSERVER|STREAM_EOF, smbbuf, smblen);
if (r != 0) {
printf("smb header check returned %" PRId32 ", expected 0: ", r);
@ -1145,6 +1148,8 @@ int SMBParserTest01(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -1180,9 +1185,11 @@ int SMBParserTest02(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_SMB, STREAM_TOSERVER|STREAM_EOF, smbbuf, smblen);
if (r != 0) {
printf("smb header check returned %" PRId32 ", expected 0: ", r);
@ -1217,6 +1224,8 @@ int SMBParserTest02(void) {
printUUID("BIND", smb_state->dcerpc.dcerpcbindbindack.uuid_entry);
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
void SMBParserRegisterTests(void) {

8
src/app-layer-smb2.c
Unescape Escape View File

@ -15,6 +15,7 @@
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer-protos.h"
@ -440,9 +441,11 @@ int SMB2ParserTest01(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_SMB2, STREAM_TOSERVER|STREAM_EOF, smb2buf, smb2len);
if (r != 0) {
printf("smb2 header check returned %" PRId32 ", expected 0: ", r);
@ -475,8 +478,9 @@ int SMB2ParserTest01(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

49
src/app-layer-tls.c
Unescape Escape View File

@ -16,6 +16,7 @@
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer-protos.h"
@ -543,9 +544,11 @@ static int TLSParserTest01(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_TLS, STREAM_TOSERVER|STREAM_EOF, tlsbuf, tlslen);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -574,6 +577,8 @@ static int TLSParserTest01(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -589,9 +594,11 @@ static int TLSParserTest02(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -627,6 +634,8 @@ static int TLSParserTest02(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -644,9 +653,11 @@ static int TLSParserTest03(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -689,6 +700,8 @@ static int TLSParserTest03(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -708,9 +721,11 @@ static int TLSParserTest04(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -760,6 +775,8 @@ static int TLSParserTest04(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -774,9 +791,11 @@ static int TLSParserTest05(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -859,6 +878,8 @@ static int TLSParserTest05(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -874,9 +895,11 @@ static int TLSParserTest06(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -976,6 +999,8 @@ static int TLSParserTest06(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -1016,9 +1041,11 @@ static int TLSParserMultimsgTest01(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -1047,6 +1074,8 @@ static int TLSParserMultimsgTest01(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -1087,9 +1116,11 @@ static int TLSParserMultimsgTest02(void) {
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
int r = AppLayerParse(&f, ALPROTO_TLS, STREAM_TOCLIENT, tlsbuf1, tlslen1);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
@ -1118,6 +1149,8 @@ static int TLSParserMultimsgTest02(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

19
src/detect-dce-iface.c
Unescape Escape View File

@ -19,6 +19,7 @@
#include "util-debug.h"
#include "util-unittest.h"
#include "stream-tcp.h"
#define DETECT_DCE_IFACE_PCRE_PARSE_ARGS "^\\s*([0-9a-zA-Z]{8}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{12})(?:\\s*,(<|>|=|!)([0-9]{1,5}))?(?:\\s*,(any_frag))?\\s*$"
@ -749,12 +750,14 @@ static int DetectDceIfaceTestParse12(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -813,6 +816,8 @@ static int DetectDceIfaceTestParse12(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -953,12 +958,14 @@ static int DetectDceIfaceTestParse13(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -1101,6 +1108,8 @@ static int DetectDceIfaceTestParse13(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -1158,12 +1167,14 @@ static int DetectDceIfaceTestParse14(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -1222,6 +1233,8 @@ static int DetectDceIfaceTestParse14(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

37
src/detect-dce-opnum.c
Unescape Escape View File

@ -19,6 +19,7 @@
#include "util-debug.h"
#include "util-unittest.h"
#include "stream-tcp.h"
#define DETECT_DCE_OPNUM_PCRE_PARSE_ARGS "^\\s*([0-9]{1,5}(\\s*-\\s*[0-9]{1,5}\\s*)?)(,\\s*[0-9]{1,5}(\\s*-\\s*[0-9]{1,5})?\\s*)*$"
@ -1103,12 +1104,14 @@ static int DetectDceOpnumTestParse08(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -1175,6 +1178,8 @@ static int DetectDceOpnumTestParse08(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -1626,12 +1631,14 @@ static int DetectDceOpnumTestParse09(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -1677,6 +1684,8 @@ static int DetectDceOpnumTestParse09(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -1818,12 +1827,14 @@ static int DetectDceOpnumTestParse10(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -1963,6 +1974,8 @@ static int DetectDceOpnumTestParse10(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -2077,12 +2090,14 @@ static int DetectDceOpnumTestParse11(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -2206,6 +2221,8 @@ static int DetectDceOpnumTestParse11(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -2337,12 +2354,14 @@ static int DetectDceOpnumTestParse12(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -2494,6 +2513,8 @@ static int DetectDceOpnumTestParse12(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -2596,12 +2617,14 @@ static int DetectDceOpnumTestParse13(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -2733,6 +2756,8 @@ static int DetectDceOpnumTestParse13(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

26
src/detect-dce-stub-data.c
Unescape Escape View File

@ -20,6 +20,8 @@
#include "util-debug.h"
#include "util-unittest.h"
#include "stream-tcp.h"
int DetectDceStubDataMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t,
void *, Signature *, SigMatch *);
int DetectDceStubDataSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg);
@ -601,12 +603,14 @@ static int DetectDceStubDataTestParse02(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -682,6 +686,8 @@ static int DetectDceStubDataTestParse02(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -1133,12 +1139,14 @@ static int DetectDceStubDataTestParse03(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -1184,6 +1192,8 @@ static int DetectDceStubDataTestParse03(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -1321,12 +1331,14 @@ static int DetectDceStubDataTestParse04(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -1457,6 +1469,8 @@ static int DetectDceStubDataTestParse04(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -1567,12 +1581,14 @@ static int DetectDceStubDataTestParse05(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn, StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_DCERPC;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
@ -1689,6 +1705,8 @@ static int DetectDceStubDataTestParse05(void)
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

14
src/detect-ftpbounce.c
Unescape Escape View File

@ -24,6 +24,7 @@
#include "flow-var.h"
#include "threads.h"
#include "detect-ftpbounce.h"
#include "stream-tcp.h"
int DetectFtpbounceMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
@ -308,13 +309,14 @@ static int DetectFtpbounceTestALMatch02(void) {
p.payload = NULL;
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx =(void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_FTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -387,6 +389,8 @@ end:
DetectEngineThreadCtxDeinit(&th_v,(void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -427,12 +431,14 @@ static int DetectFtpbounceTestALMatch03(void) {
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx =(void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_FTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -507,6 +513,8 @@ end:
DetectEngineThreadCtxDeinit(&th_v,(void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

14
src/detect-http-cookie.c
Unescape Escape View File

@ -28,7 +28,7 @@
#include <htp/htp.h>
#include "app-layer-htp.h"
#include "detect-http-cookie.h"
#include "stream-tcp.h"
int DetectHttpCookieMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx,
Flow *f, uint8_t flags, void *state, Signature *s,
@ -388,12 +388,14 @@ static int DetectHttpCookieSigTest01(void) {
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -450,6 +452,8 @@ end:
if (de_ctx != NULL) SigCleanSignatures(de_ctx);
if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -476,12 +480,14 @@ static int DetectHttpCookieSigTest02(void) {
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -526,6 +532,8 @@ end:
if (de_ctx != NULL) SigCleanSignatures(de_ctx);
if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
#endif /* UNITTESTS */

19
src/detect-http-method.c
Unescape Escape View File

@ -28,6 +28,7 @@
#include <htp/htp.h>
#include "app-layer-htp.h"
#include "detect-http-method.h"
#include "stream-tcp.h"
int DetectHttpMethodMatch(ThreadVars *, DetectEngineThreadCtx *,
@ -384,12 +385,14 @@ static int DetectHttpMethodSigTest01(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -446,6 +449,8 @@ end:
if (de_ctx != NULL) SigCleanSignatures(de_ctx);
if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -475,12 +480,14 @@ static int DetectHttpMethodSigTest02(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -537,6 +544,8 @@ end:
if (de_ctx != NULL) SigCleanSignatures(de_ctx);
if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -564,12 +573,14 @@ static int DetectHttpMethodSigTest03(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -615,6 +626,8 @@ end:
if (de_ctx != NULL) SigCleanSignatures(de_ctx);
if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

19
src/detect-tls-version.c
Unescape Escape View File

@ -26,6 +26,7 @@
#include "app-layer-tls.h"
#include "detect-tls-version.h"
#include "stream-tcp.h"
/**
* \brief Regex for parsing "id" option, matching number or "number"
@ -305,12 +306,14 @@ static int DetectTlsVersionTestDetect01(void) {
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_TLS;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -384,6 +387,8 @@ end:
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -415,12 +420,14 @@ static int DetectTlsVersionTestDetect02(void) {
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_TLS;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -492,6 +499,8 @@ end:
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -523,12 +532,14 @@ static int DetectTlsVersionTestDetect03(void) {
p.payload_len = tlslen4;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_TLS;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -604,6 +615,8 @@ end:
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

38
src/detect-uricontent.c
Unescape Escape View File

@ -22,6 +22,7 @@
#include "threads.h"
#include "flow-alert-sid.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer-parser.h"
#include "app-layer-protos.h"
@ -586,9 +587,11 @@ static int HTTPUriTest01(void) {
int r = 0;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
r = AppLayerParse(&f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_START|
STREAM_EOF, httpbuf1, httplen1);
HtpState *htp_state = ssn.aldata[AlpGetStateIdx(ALPROTO_HTTP)];
@ -628,8 +631,9 @@ static int HTTPUriTest01(void) {
goto end;
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -645,9 +649,11 @@ static int HTTPUriTest02(void) {
int r = 0;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
r = AppLayerParse(&f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_START|
STREAM_EOF, httpbuf1, httplen1);
@ -690,6 +696,8 @@ static int HTTPUriTest02(void) {
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -705,9 +713,11 @@ static int HTTPUriTest03(void) {
int r = 0;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
r = AppLayerParse(&f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_START|
STREAM_EOF, httpbuf1, httplen1);
@ -749,6 +759,8 @@ static int HTTPUriTest03(void) {
}
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -765,9 +777,11 @@ static int HTTPUriTest04(void) {
int r = 0;
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
r = AppLayerParse(&f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_START|
STREAM_EOF, httpbuf1, httplen1);
@ -810,6 +824,8 @@ static int HTTPUriTest04(void) {
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -879,12 +895,14 @@ static int DetectUriSigTest02(void) {
p.payload_len = httplen1;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -948,6 +966,8 @@ end:
if (de_ctx != NULL) SigCleanSignatures(de_ctx);
if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
@ -978,12 +998,14 @@ static int DetectUriSigTest03(void) {
p.payload = httpbuf1;
p.payload_len = httplen1;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -1056,6 +1078,8 @@ end:
if (de_ctx != NULL) SigCleanSignatures(de_ctx);
if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

7
src/detect-urilen.c
Unescape Escape View File

@ -13,6 +13,7 @@
#include "detect-urilen.h"
#include "util-debug.h"
#include "util-byte.h"
#include "stream-tcp.h"
/**
* \brief Regex for parsing our urilen
@ -480,12 +481,14 @@ static int DetectUrilenSigTest01(void)
p.payload_len = 0;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -542,6 +545,8 @@ end:
if (de_ctx != NULL) SigCleanSignatures(de_ctx);
if (de_ctx != NULL) DetectEngineCtxFree(de_ctx);
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}

39
src/detect.c
Unescape Escape View File

@ -91,6 +91,8 @@
#include "conf.h"
#include "conf-yaml-loader.h"
#include "stream-tcp.h"
#include "util-classification-config.h"
#include "util-print.h"
#include "util-unittest.h"
@ -3271,12 +3273,14 @@ static int SigTest06Real (int mpm_type) {
p.payload = buf;
p.payload_len = buflen;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -3319,9 +3323,10 @@ static int SigTest06Real (int mpm_type) {
SigCleanSignatures(de_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
static int SigTest06B2g (void) {
@ -3360,12 +3365,14 @@ static int SigTest07Real (int mpm_type) {
p.payload = buf;
p.payload_len = buflen;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -3409,6 +3416,8 @@ static int SigTest07Real (int mpm_type) {
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
static int SigTest07B2g (void) {
@ -3447,12 +3456,14 @@ static int SigTest08Real (int mpm_type) {
p.payload = buf;
p.payload_len = buflen;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -3498,6 +3509,8 @@ static int SigTest08Real (int mpm_type) {
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
static int SigTest08B2g (void) {
@ -3536,12 +3549,14 @@ static int SigTest09Real (int mpm_type) {
p.payload = buf;
p.payload_len = buflen;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -3584,6 +3599,8 @@ static int SigTest09Real (int mpm_type) {
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
static int SigTest09B2g (void) {
@ -3617,12 +3634,14 @@ static int SigTest10Real (int mpm_type) {
p.payload = buf;
p.payload_len = buflen;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -3665,6 +3684,8 @@ static int SigTest10Real (int mpm_type) {
//PatternMatchDestroy(mpm_ctx);
DetectEngineCtxFree(de_ctx);
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
static int SigTest10B2g (void) {
@ -3698,12 +3719,14 @@ static int SigTest11Real (int mpm_type) {
p.payload = buf;
p.payload_len = buflen;
p.proto = IPPROTO_TCP;
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
f.protoctx = (void *)&ssn;
p.flow = &f;
p.flowflags |= FLOW_PKT_TOSERVER;
ssn.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
StreamL7DataPtrInit(&ssn);
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
@ -3736,6 +3759,8 @@ static int SigTest11Real (int mpm_type) {
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
end:
StreamL7DataPtrFree(&ssn);
StreamTcpFreeConfig(TRUE);
return result;
}
static int SigTest11B2g (void) {

115
src/stream-tcp-reassemble.c
Unescape Escape View File

@ -57,6 +57,9 @@ void StreamTcpCreateTestPacket(uint8_t *, uint8_t, uint8_t, uint8_t);
/** \brief alloc a tcp segment pool entry */
void *TcpSegmentPoolAlloc(void *payload_len) {
if (StreamTcpCheckMemcap((uint32_t)sizeof(TcpSegment) + *((uint16_t *) payload_len)) == 0)
return NULL;
TcpSegment *seg = malloc(sizeof (TcpSegment));
if (seg == NULL)
return NULL;
@ -79,6 +82,8 @@ void *TcpSegmentPoolAlloc(void *payload_len) {
SCLogDebug("segment_pool_memcnt %"PRIu64"", segment_pool_memcnt);
SCMutexUnlock(&segment_pool_memuse_mutex);
#endif
StreamTcpIncrMemuse((uint32_t)seg->pool_size + sizeof(TcpSegment));
return seg;
}
@ -89,9 +94,11 @@ void TcpSegmentPoolFree(void *ptr) {
TcpSegment *seg = (TcpSegment *) ptr;
StreamTcpDecrMemuse((uint32_t)seg->pool_size + sizeof(TcpSegment));
#ifdef DEBUG
SCMutexLock(&segment_pool_memuse_mutex);
segment_pool_memuse -= seg->payload_len;
segment_pool_memuse -= seg->pool_size;
segment_pool_memcnt--;
SCLogDebug("segment_pool_memcnt %"PRIu64"", segment_pool_memcnt);
SCMutexUnlock(&segment_pool_memuse_mutex);
@ -109,9 +116,15 @@ void TcpSegmentPoolFree(void *ptr) {
#define segment_pool_num 8
static uint16_t segment_pool_pktsizes[segment_pool_num] = {4, 16, 112, 248, 512,
768, 1448, 0xffff};
static uint16_t segment_pool_poolsizes[segment_pool_num] = {2048, 3072, 3072,
3072, 3072, 8192,
8192, 512};
//static uint16_t segment_pool_poolsizes[segment_pool_num] = {2048, 3072, 3072,
// 3072, 3072, 8192,
// 8192, 512};
static uint16_t segment_pool_poolsizes[segment_pool_num] = {0, 0, 0,
0, 0, 0,
0, 0};
static uint16_t segment_pool_poolsizes_prealloc[segment_pool_num] = {256, 512, 512,
512, 512, 1024,
1024, 128};
static Pool *segment_pool[segment_pool_num];
static SCMutex segment_pool_mutex[segment_pool_num];
#ifdef DEBUG
@ -131,7 +144,7 @@ int StreamTcpReassembleInit(char quiet)
for (u16 = 0; u16 < segment_pool_num; u16++)
{
segment_pool[u16] = PoolInit(segment_pool_poolsizes[u16],
segment_pool_poolsizes[u16] / 8,
segment_pool_poolsizes_prealloc[u16],
TcpSegmentPoolAlloc, (void *) &
segment_pool_pktsizes[u16],
TcpSegmentPoolFree);
@ -162,6 +175,8 @@ void StreamTcpReassembleFree(char quiet)
{
uint16_t u16 = 0;
for (u16 = 0; u16 < segment_pool_num; u16++) {
PoolPrintSaturation(segment_pool[u16]);
if (quiet == FALSE) {
PoolPrintSaturation(segment_pool[u16]);
SCLogDebug("segment_pool[u16]->empty_list_size %"PRIu32", "
@ -309,6 +324,8 @@ void PrintList(TcpSegment *seg)
* \param stream The given TCP stream to which this new segment belongs
* \param seg Newly arrived segment
* \param p received packet
* \retval 0 success
* \retval -1 error
*/
static int ReassembleInsertSegment(TcpStream *stream, TcpSegment *seg, Packet *p)
@ -381,8 +398,7 @@ static int ReassembleInsertSegment(TcpStream *stream, TcpSegment *seg, Packet *p
return_seg = TRUE;
goto end;
} else if (ret_value == -1) {
SCLogError(SC_ERR_REASSEMBLY_FAILED,
"HandleSegmentStartsBeforeListSegment failed");
SCLogDebug("HandleSegmentStartsBeforeListSegment failed");
ret_value = -1;
return_seg = TRUE;
goto end;
@ -396,8 +412,7 @@ static int ReassembleInsertSegment(TcpStream *stream, TcpSegment *seg, Packet *p
return_seg = TRUE;
goto end;
} else if (ret_value == -1) {
SCLogError(SC_ERR_REASSEMBLY_FAILED,
"HandleSegmentStartsAtSameListSegment failed");
SCLogDebug("HandleSegmentStartsAtSameListSegment failed");
ret_value = -1;
return_seg = TRUE;
goto end;
@ -426,8 +441,7 @@ static int ReassembleInsertSegment(TcpStream *stream, TcpSegment *seg, Packet *p
return_seg = TRUE;
goto end;
} else if (ret_value == -1) {
SCLogError(SC_ERR_REASSEMBLY_FAILED,
"HandleSegmentStartsAfterListSegment failed");
SCLogDebug("HandleSegmentStartsAfterListSegment failed");
ret_value = -1;
return_seg = TRUE;
goto end;
@ -444,7 +458,7 @@ end:
#ifdef DEBUG
PrintList(stream->seg_list);
#endif
SCReturnInt(0);
SCReturnInt(ret_value);
}
/**
@ -456,6 +470,9 @@ end:
* \param list_seg Original Segment in the stream
* \param seg Newly arrived segment
* \param prev_seg Previous segment in the stream segment list
* \retval 1 done
* \retval 0 not done yet
* \retval -1 error
*/
static int HandleSegmentStartsBeforeListSegment(TcpStream *stream,
@ -544,8 +561,7 @@ static int HandleSegmentStartsBeforeListSegment(TcpStream *stream,
TcpSegment *new_seg = StreamTcpGetSegment(packet_length);
if (new_seg == NULL) {
uint16_t idx = segment_pool_idx[packet_length];
SCLogError(SC_ERR_POOL_EMPTY, "segment_pool[%"PRIu16"] is"
" empty", idx);
SCLogDebug("segment_pool[%"PRIu16"] is empty", idx);
SCReturnInt(-1);
}
new_seg->payload_len = packet_length;
@ -608,8 +624,7 @@ static int HandleSegmentStartsBeforeListSegment(TcpStream *stream,
TcpSegment *new_seg = StreamTcpGetSegment(packet_length);
if (new_seg == NULL) {
uint16_t idx = segment_pool_idx[packet_length];
SCLogError(SC_ERR_POOL_EMPTY, "segment_pool[%"PRIu16"] is"
" empty", idx);
SCLogDebug("segment_pool[%"PRIu16"] is empty", idx);
SCReturnInt(-1);
}
@ -669,8 +684,7 @@ static int HandleSegmentStartsBeforeListSegment(TcpStream *stream,
TcpSegment *new_seg = StreamTcpGetSegment(packet_length);
if (new_seg == NULL) {
uint16_t idx = segment_pool_idx[packet_length];
SCLogError(SC_ERR_POOL_EMPTY, "segment_pool[%"PRIu16"] "
"is empty", idx);
SCLogDebug("segment_pool[%"PRIu16"] is empty", idx);
SCReturnInt(-1);
}
new_seg->payload_len = packet_length;
@ -776,6 +790,9 @@ static int HandleSegmentStartsBeforeListSegment(TcpStream *stream,
* \param list_seg Original Segment in the stream
* \param seg Newly arrived segment
* \param prev_seg Previous segment in the stream segment list
* \retval 1 done
* \retval 0 not done yet
* \retval -1 error
*/
static int HandleSegmentStartsAtSameListSegment(TcpStream *stream,
@ -873,8 +890,7 @@ static int HandleSegmentStartsAtSameListSegment(TcpStream *stream,
TcpSegment *new_seg = StreamTcpGetSegment(packet_length);
if (new_seg == NULL) {
uint16_t idx = segment_pool_idx[packet_length];
SCLogError(SC_ERR_POOL_EMPTY, "segment_pool[%"PRIu16"] is"
" empty", idx);
SCLogDebug("egment_pool[%"PRIu16"] is empty", idx);
return -1;
}
new_seg->payload_len = packet_length;
@ -954,6 +970,9 @@ static int HandleSegmentStartsAtSameListSegment(TcpStream *stream,
* \param list_seg Original Segment in the stream
* \param seg Newly arrived segment
* \param prev_seg Previous segment in the stream segment list
* \retval 1 done
* \retval 0 not done yet
* \retval -1 error
*/
static int HandleSegmentStartsAfterListSegment(TcpStream *stream,
@ -1055,8 +1074,7 @@ static int HandleSegmentStartsAfterListSegment(TcpStream *stream,
TcpSegment *new_seg = StreamTcpGetSegment(packet_length);
if (new_seg == NULL) {
uint16_t idx = segment_pool_idx[packet_length];
SCLogError(SC_ERR_POOL_EMPTY, "segment_pool[%"PRIu16"] is"
" empty", idx);
SCLogDebug("segment_pool[%"PRIu16"] is empty", idx);
SCReturnInt(-1);
}
new_seg->payload_len = packet_length;
@ -1122,12 +1140,13 @@ static int HandleSegmentStartsAfterListSegment(TcpStream *stream,
int StreamTcpReassembleHandleSegmentHandleData(TcpSession *ssn,
TcpStream *stream, Packet *p)
{
SCEnter();
TcpSegment *seg = StreamTcpGetSegment(p->payload_len);
if (seg == NULL) {
uint16_t idx = segment_pool_idx[p->payload_len];
SCLogError(SC_ERR_POOL_EMPTY, "segment_pool[%"PRIu16"] is empty", idx);
return -1;
SCLogDebug("segment_pool[%"PRIu16"] is empty", idx);
SCReturnInt(-1);
}
memcpy(seg->payload, p->payload, p->payload_len);
@ -1137,11 +1156,11 @@ int StreamTcpReassembleHandleSegmentHandleData(TcpSession *ssn,
seg->prev = NULL;
if (ReassembleInsertSegment(stream, seg, p) != 0) {
SCLogError(SC_ERR_REASSEMBLY_FAILED, "ReassembleInsertSegment failed");
return -1;
SCLogDebug("ReassembleInsertSegment failed");
SCReturnInt(-1);
}
return 0;
SCReturnInt(0);
}
static void StreamTcpSetupMsg(TcpSession *ssn, TcpStream *stream, Packet *p,
@ -1317,7 +1336,7 @@ int StreamTcpReassembleHandleSegmentUpdateACK (TcpReassemblyThreadCtx *ra_ctx,
if (smsg == NULL) {
smsg = StreamMsgGetFromPool();
if (smsg == NULL) {
SCLogError(SC_ERR_POOL_EMPTY, "stream_msg_pool is empty");
SCLogDebug("stream_msg_pool is empty");
return -1;
}
}
@ -1345,7 +1364,7 @@ int StreamTcpReassembleHandleSegmentUpdateACK (TcpReassemblyThreadCtx *ra_ctx,
if (smsg == NULL) {
smsg = StreamMsgGetFromPool();
if (smsg == NULL) {
SCLogError(SC_ERR_POOL_EMPTY, "stream_msg_pool is empty");
SCLogDebug("stream_msg_pool is empty");
return -1;
}
@ -1433,7 +1452,7 @@ int StreamTcpReassembleHandleSegmentUpdateACK (TcpReassemblyThreadCtx *ra_ctx,
XXX we need a setup function */
smsg = StreamMsgGetFromPool();
if (smsg == NULL) {
SCLogError(SC_ERR_POOL_EMPTY, "stream_msg_pool is empty");
SCLogDebug("stream_msg_pool is empty");
SCReturnInt(-1);
}
smsg_offset = 0;
@ -1561,15 +1580,13 @@ int StreamTcpReassembleHandleSegment(TcpReassemblyThreadCtx *ra_ctx,
/* handle ack received */
if (StreamTcpReassembleHandleSegmentUpdateACK(ra_ctx, ssn, opposing_stream, p) != 0)
{
SCLogError(SC_ERR_REASSEMBLY_FAILED,
"StreamTcpReassembleHandleSegmentUpdateACK error");
SCLogDebug("StreamTcpReassembleHandleSegmentUpdateACK error");
SCReturnInt(-1);
}
if (p->payload_len > 0) {
if (StreamTcpReassembleHandleSegmentHandleData(ssn, stream, p) != 0) {
SCLogError(SC_ERR_REASSEMBLY_FAILED,
"StreamTcpReassembleHandleSegmentHandleData error");
SCLogDebug("StreamTcpReassembleHandleSegmentHandleData error");
SCReturnInt(-1);
}
}
@ -1585,22 +1602,40 @@ int StreamTcpReassembleHandleSegment(TcpReassemblyThreadCtx *ra_ctx,
*
* \todo VJ use a pool?
*/
void StreamL7DataPtrInit(TcpSession *ssn, uint8_t cnt) {
if (cnt == 0)
void StreamL7DataPtrInit(TcpSession *ssn) {
if (ssn->aldata != NULL)
return;
if (ssn->aldata != NULL)
uint32_t size = (uint32_t)(sizeof (void *) * StreamL7GetStorageSize());
if (StreamTcpCheckMemcap(size) == 0)
return;
ssn->aldata = (void **) malloc(sizeof (void *) * cnt);
ssn->aldata = (void **) malloc(size);
if (ssn->aldata != NULL) {
StreamTcpIncrMemuse(size);
uint8_t u;
for (u = 0; u < cnt; u++) {
for (u = 0; u < StreamL7GetStorageSize(); u++) {
ssn->aldata[u] = NULL;
}
}
}
void StreamL7DataPtrFree(TcpSession *ssn) {
if (ssn == NULL)
return;
if (ssn->aldata == NULL)
return;
free(ssn->aldata);
ssn->aldata = NULL;
uint32_t size = (uint32_t)(sizeof (void *) * StreamL7GetStorageSize());
StreamTcpDecrMemuse(size);
}
/**
* \brief Function to replace the data from a specific point up to given length.
*
@ -1707,7 +1742,7 @@ TcpSegment* StreamTcpGetSegment(uint16_t len)
SCLogDebug("seg we return is %p", seg);
if (seg == NULL) {
SCLogError(SC_ERR_POOL_EMPTY, "segment_pool[%u]->empty_list_size %u, "
SCLogDebug("segment_pool[%u]->empty_list_size %u, "
"alloc %u", idx, segment_pool[idx]->empty_list_size,
segment_pool[idx]->allocated);
} else {

4
src/stream-tcp-reassemble.h
Unescape Escape View File

@ -47,7 +47,9 @@ int StreamTcpReassembleProcessAppLayer(TcpReassemblyThreadCtx *);
void StreamTcpCreateTestPacket(uint8_t *, uint8_t, uint8_t, uint8_t);
void StreamL7DataPtrInit(TcpSession *ssn, uint8_t cnt);
void StreamL7DataPtrInit(TcpSession *);
void StreamL7DataPtrFree(TcpSession *);
void StreamTcpSetSessionNoReassemblyFlag (TcpSession *, char );
void StreamTcpSetOSPolicy(TcpStream *, Packet *);

154
src/stream-tcp.c
Unescape Escape View File

@ -10,6 +10,8 @@
*/
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "debug.h"
#include "detect.h"
@ -41,6 +43,8 @@ typedef struct StreamTcpThread_ {
uint64_t pkts;
uint16_t counter_tcp_sessions;
/** sessions not picked up because memcap was reached */
uint16_t counter_tcp_ssn_memcap;
TcpReassemblyThreadCtx *ra_ctx; /**< tcp reassembly thread data */
} StreamTcpThread;
@ -59,13 +63,9 @@ int StreamTcpGetFlowState(void *);
static int ValidTimestamp(TcpSession * , Packet *);
void StreamTcpSetOSPolicy(TcpStream*, Packet*);
#ifndef UNITTESTS
#define STREAMTCP_DEFAULT_SESSIONS 262144
#else
#define STREAMTCP_DEFAULT_SESSIONS 32768
#endif
#define STREAMTCP_DEFAULT_PREALLOC 32768
#define STREAMTCP_DEFAULT_MEMCAP 64 * 1024 * 1024 /* 64mb */
#define STREAMTCP_NEW_TIMEOUT 60
#define STREAMTCP_EST_TIMEOUT 3600
@ -77,12 +77,14 @@ void StreamTcpSetOSPolicy(TcpStream*, Packet*);
static Pool *ssn_pool = NULL;
static SCMutex ssn_pool_mutex;
#ifdef DEBUG
static uint64_t ssn_pool_cnt = 0;
static SCMutex ssn_pool_cnt_mutex;
static uint64_t ssn_pool_cnt = 0; /** counts ssns, protected by ssn_pool_mutex */
#endif
static SCSpinlock stream_memuse_spinlock;
static uint32_t stream_memuse;
static uint32_t stream_memuse_max;
void TmModuleStreamTcpRegister (void)
{
tmm_modules[TMM_STREAMTCP].name = "StreamTcp";
@ -93,6 +95,38 @@ void TmModuleStreamTcpRegister (void)
tmm_modules[TMM_STREAMTCP].RegisterTests = StreamTcpRegisterTests;
}
void StreamTcpIncrMemuse(uint32_t size) {
SCSpinLock(&stream_memuse_spinlock);
stream_memuse += size;
if (stream_memuse > stream_memuse_max)
stream_memuse_max = stream_memuse;
SCSpinUnlock(&stream_memuse_spinlock);
}
void StreamTcpDecrMemuse(uint32_t size) {
SCSpinLock(&stream_memuse_spinlock);
if (size <= stream_memuse)
stream_memuse -= size;
else
stream_memuse = 0;
SCSpinUnlock(&stream_memuse_spinlock);
}
/** \retval 1 if in bounds
* \retval 0 if not in bounds
*/
int StreamTcpCheckMemcap(uint32_t size) {
SCEnter();
int ret = 0;
SCSpinLock(&stream_memuse_spinlock);
if (size + stream_memuse <= stream_config.memcap)
ret = 1;
SCSpinUnlock(&stream_memuse_spinlock);
SCReturnInt(ret);
}
void StreamTcpReturnStreamSegments (TcpStream *stream)
{
TcpSegment *seg = stream->seg_list;
@ -135,13 +169,10 @@ void StreamTcpSessionClear(void *ssnptr)
memset(ssn, 0, sizeof(TcpSession));
SCMutexLock(&ssn_pool_mutex);
PoolReturn(ssn_pool, ssn);
SCMutexUnlock(&ssn_pool_mutex);
#ifdef DEBUG
SCMutexLock(&ssn_pool_cnt_mutex);
ssn_pool_cnt--;
SCMutexUnlock(&ssn_pool_cnt_mutex);
#endif
SCMutexUnlock(&ssn_pool_mutex);
SCReturn;
}
@ -166,19 +197,6 @@ static void StreamTcpSessionPktFree (Packet *p)
StreamTcpReturnStreamSegments(&ssn->client);
StreamTcpReturnStreamSegments(&ssn->server);
/*
memset(ssn, 0, sizeof(TcpSession));
SCMutexLock(&ssn_pool_mutex);
PoolReturn(ssn_pool, p->flow->protoctx);
SCMutexUnlock(&ssn_pool_mutex);
p->flow->protoctx = NULL;
#ifdef DEBUG
SCMutexLock(&ssn_pool_cnt_mutex);
ssn_pool_cnt--;
SCMutexUnlock(&ssn_pool_cnt_mutex);
#endif
*/
SCReturn;
}
@ -189,11 +207,17 @@ static void StreamTcpSessionPktFree (Packet *p)
*/
void *StreamTcpSessionPoolAlloc(void *null)
{
if (StreamTcpCheckMemcap((uint32_t)sizeof(TcpSession)) == 0)
return NULL;
void *ptr = malloc(sizeof(TcpSession));
if (ptr == NULL)
return NULL;
memset(ptr, 0, sizeof(TcpSession));
StreamTcpIncrMemuse((uint32_t)sizeof(TcpSession));
return ptr;
}
@ -209,7 +233,11 @@ void StreamTcpSessionPoolFree(void *s)
StreamTcpReturnStreamSegments(&ssn->client);
StreamTcpReturnStreamSegments(&ssn->server);
StreamL7DataPtrFree(ssn);
free(ssn);
StreamTcpDecrMemuse((uint32_t)sizeof(TcpSession));
}
/** \brief To initialize the stream global configuration data
@ -220,29 +248,62 @@ void StreamTcpSessionPoolFree(void *s)
void StreamTcpInitConfig(char quiet)
{
SCLogDebug("Initializing Stream");
memset(&stream_config, 0, sizeof(stream_config));
/** set config defaults */
if ((ConfGetBool("stream.max_sessions", &stream_config.max_sessions)) == 0)
if ((ConfGetInt("stream.max_sessions", (intmax_t *)&stream_config.max_sessions)) == 0)
{
stream_config.max_sessions = STREAMTCP_DEFAULT_SESSIONS;
if (RunmodeIsUnittests())
stream_config.max_sessions = 1024;
else
stream_config.max_sessions = STREAMTCP_DEFAULT_SESSIONS;
}
if ((ConfGetBool("stream.prealloc_sessions",
&stream_config.prealloc_sessions)) == 0)
if (!quiet) {
SCLogInfo("stream \"max_sessions\": %"PRIu32"", stream_config.max_sessions);
}
if ((ConfGetInt("stream.prealloc_sessions",
(intmax_t *)&stream_config.prealloc_sessions)) == 0)
{
stream_config.prealloc_sessions = STREAMTCP_DEFAULT_PREALLOC;
if (RunmodeIsUnittests())
stream_config.prealloc_sessions = 128;
else
stream_config.prealloc_sessions = STREAMTCP_DEFAULT_PREALLOC;
}
if (!quiet) {
SCLogInfo("stream \"prealloc_sessions\": %"PRIu32"", stream_config.prealloc_sessions);
}
if ((ConfGetInt("stream.memcap", (intmax_t *)&stream_config.memcap)) == 0)
{
stream_config.memcap = STREAMTCP_DEFAULT_MEMCAP;
}
if (!quiet) {
SCLogInfo("stream \"memcap\": %"PRIu32"", stream_config.memcap);
}
if ((ConfGetBool("stream.midstream", &stream_config.midstream)) == 0) {
stream_config.midstream = FALSE;/*In the final patch it will be FALSE*/
}
if (!quiet) {
SCLogInfo("stream \"midstream\" session pickups: %s", stream_config.midstream ? "enabled" : "disabled");
}
if ((ConfGetBool("stream.async_oneside", &stream_config.async_oneside)) == 0)
{
stream_config.async_oneside = FALSE; /*In the final patch it will be FALSE*/
}
if (!quiet) {
SCLogInfo("stream \"async_oneside\": %s", stream_config.async_oneside ? "enabled" : "disabled");
}
/* init the memcap and it's lock */
stream_memuse = 0;
stream_memuse_max = 0;
SCSpinInit(&stream_memuse_spinlock, PTHREAD_PROCESS_PRIVATE);
ssn_pool = PoolInit(stream_config.max_sessions,
stream_config.prealloc_sessions,
StreamTcpSessionPoolAlloc, NULL,
@ -279,9 +340,9 @@ void StreamTcpFreeConfig(char quiet)
SCLogError(SC_ERR_POOL_EMPTY, "ssn_pool is NULL");
exit(EXIT_FAILURE);
}
SCLogInfo("ssn_pool_cnt %"PRIu64"", ssn_pool_cnt);
SCLogDebug("ssn_pool_cnt %"PRIu64"", ssn_pool_cnt);
SCLogInfo("Max memuse of stream engine %"PRIu32" (in use %"PRIu32")", stream_memuse_max, stream_memuse);
SCMutexDestroy(&ssn_pool_mutex);
}
@ -299,22 +360,20 @@ TcpSession *StreamTcpNewSession (Packet *p)
if (ssn == NULL) {
SCMutexLock(&ssn_pool_mutex);
p->flow->protoctx = PoolGet(ssn_pool);
#ifdef DEBUG
if (p->flow->protoctx != NULL)
ssn_pool_cnt++;
#endif
SCMutexUnlock(&ssn_pool_mutex);
ssn = (TcpSession *)p->flow->protoctx;
if (ssn == NULL) {
SCLogError(SC_ERR_POOL_EMPTY, "ssn_pool is empty");
SCLogDebug("ssn_pool is empty");
return NULL;
}
ssn->state = TCP_NONE;
ssn->aldata = NULL;
#ifdef DEBUG
SCMutexLock(&ssn_pool_cnt_mutex);
ssn_pool_cnt++;
SCMutexUnlock(&ssn_pool_cnt_mutex);
#endif
}
return ssn;
@ -406,8 +465,10 @@ static int StreamTcpPacketStateNone(ThreadVars *tv, Packet *p,
{
if (ssn == NULL) {
ssn = StreamTcpNewSession(p);
if (ssn == NULL)
if (ssn == NULL) {
SCPerfCounterIncr(stt->counter_tcp_ssn_memcap, tv->sc_perf_pca);
return -1;
}
SCPerfCounterIncr(stt->counter_tcp_sessions, tv->sc_perf_pca);
}
@ -454,8 +515,10 @@ static int StreamTcpPacketStateNone(ThreadVars *tv, Packet *p,
if (ssn == NULL) {
ssn = StreamTcpNewSession(p);
if (ssn == NULL)
if (ssn == NULL) {
SCPerfCounterIncr(stt->counter_tcp_ssn_memcap, tv->sc_perf_pca);
return -1;
}
SCPerfCounterIncr(stt->counter_tcp_sessions, tv->sc_perf_pca);
}
/* set the state */
@ -526,8 +589,10 @@ static int StreamTcpPacketStateNone(ThreadVars *tv, Packet *p,
break;
if (ssn == NULL) {
ssn = StreamTcpNewSession(p);
if (ssn == NULL)
if (ssn == NULL) {
SCPerfCounterIncr(stt->counter_tcp_ssn_memcap, tv->sc_perf_pca);
return -1;
}
SCPerfCounterIncr(stt->counter_tcp_sessions, tv->sc_perf_pca);
}
/* set the state */
@ -2446,6 +2511,9 @@ TmEcode StreamTcpThreadInit(ThreadVars *tv, void *initdata, void **data)
stt->counter_tcp_sessions = SCPerfTVRegisterCounter("tcp.sessions", tv,
SC_PERF_TYPE_UINT64,
"NULL");
stt->counter_tcp_ssn_memcap = SCPerfTVRegisterCounter("tcp.ssn_memcap_drop", tv,
SC_PERF_TYPE_UINT64,
"NULL");
tv->sc_perf_pca = SCPerfGetAllCountersArray(&tv->sc_perf_pctx);
SCPerfAddToClubbedTMTable(tv->name, &tv->sc_perf_pctx);

5
src/stream-tcp.h
Unescape Escape View File

@ -8,6 +8,7 @@
#define STREAM_VERBOSE FALSE
/*global flow data*/
typedef struct TcpStreamCnf_ {
uint32_t memcap; /** max stream mem usage */
int max_sessions;
int prealloc_sessions;
int midstream;
@ -20,5 +21,9 @@ void StreamTcpInitConfig (char);
void StreamTcpFreeConfig(char);
void StreamTcpRegisterTests (void);
void StreamTcpIncrMemuse(uint32_t);
void StreamTcpDecrMemuse(uint32_t);
int StreamTcpCheckMemcap(uint32_t);
#endif /* __STREAM_TCP_H__ */

7
src/suricata.c
Unescape Escape View File

@ -112,6 +112,13 @@ static uint8_t sigflags = 0;
/* Run mode selected */
int run_mode = MODE_UNKNOWN;
int RunmodeIsUnittests(void) {
if (run_mode == MODE_UNITTEST)
return 1;
return 0;
}
static void SignalHandlerSigint(/*@unused@*/ int sig) { sigint_count = 1; sigflags |= SURICATA_SIGINT; }
static void SignalHandlerSigterm(/*@unused@*/ int sig) { sigterm_count = 1; sigflags |= SURICATA_SIGTERM; }
static void SignalHandlerSighup(/*@unused@*/ int sig) { sighup_count = 1; sigflags |= SURICATA_SIGHUP; }

2
src/suricata.h
Unescape Escape View File

@ -65,5 +65,7 @@ uint8_t g_u8_lowercasetable[256];
void EngineStop(void);
void EngineKill(void);
int RunmodeIsUnittests(void);
#endif /* __SURICATA_H__ */

149
src/util-pool.c
Unescape Escape View File

@ -14,7 +14,7 @@ Pool *PoolInit(uint32_t size, uint32_t prealloc_size, void *(*Alloc)(void *), vo
goto error;
}
if (prealloc_size > size)
if (size != 0 && prealloc_size > size)
goto error;
/* setup the filter */
@ -45,19 +45,34 @@ Pool *PoolInit(uint32_t size, uint32_t prealloc_size, void *(*Alloc)(void *), vo
/* prealloc the buckets and requeue them to the alloc list */
for (u32 = 0; u32 < prealloc_size; u32++) {
PoolBucket *pb = p->empty_list;
if (pb == NULL)
goto error;
if (size == 0) { /* unlimited */
PoolBucket *pb = malloc(sizeof(PoolBucket));
if (pb == NULL)
goto error;
p->empty_list = pb->next;
p->empty_list_size--;
memset(pb, 0, sizeof(PoolBucket));
pb->data = p->Alloc(p->AllocData);
p->allocated++;
pb->data = p->Alloc(p->AllocData);
p->allocated++;
pb->next = p->alloc_list;
p->alloc_list = pb;
p->alloc_list_size++;
pb->next = p->alloc_list;
p->alloc_list = pb;
p->alloc_list_size++;
} else {
PoolBucket *pb = p->empty_list;
if (pb == NULL)
goto error;
p->empty_list = pb->next;
p->empty_list_size--;
pb->data = p->Alloc(p->AllocData);
p->allocated++;
pb->next = p->alloc_list;
p->alloc_list = pb;
p->alloc_list_size++;
}
}
return p;
@ -95,6 +110,8 @@ void PoolPrint(Pool *p) {
}
void *PoolGet(Pool *p) {
SCEnter();
PoolBucket *pb = p->alloc_list;
if (pb != NULL) {
/* pull from the alloc list */
@ -106,16 +123,17 @@ void *PoolGet(Pool *p) {
p->empty_list = pb;
p->empty_list_size++;
} else {
if (p->allocated < p->max_buckets) {
if (p->max_buckets == 0 || p->allocated < p->max_buckets) {
SCLogDebug("max_buckets %"PRIu32"", p->max_buckets);
p->allocated++;
p->outstanding++;
if (p->outstanding > p->max_outstanding)
p->max_outstanding = p->outstanding;
return p->Alloc(p->AllocData);
SCReturnPtr(p->Alloc(p->AllocData), "void");
} else {
return NULL;
SCReturnPtr(NULL, "void");
}
}
@ -124,14 +142,25 @@ void *PoolGet(Pool *p) {
p->outstanding++;
if (p->outstanding > p->max_outstanding)
p->max_outstanding = p->outstanding;
return ptr;
SCReturnPtr(ptr,"void");
}
void PoolReturn(Pool *p, void *data) {
SCEnter();
PoolBucket *pb = p->empty_list;
SCLogDebug("pb %p", pb);
if (pb == NULL) {
printf("ERROR: trying to return data %p to the pool %p, but no more buckets available.\n", data, p);
return;
p->allocated--;
p->outstanding--;
if (p->Free != NULL)
p->Free(data);
SCLogDebug("tried to return data %p to the pool %p, but no more "
"buckets available. Just freeing the data.", data, p);
SCReturn;
}
/* pull from the alloc list */
@ -145,7 +174,7 @@ void PoolReturn(Pool *p, void *data) {
pb->data = data;
p->outstanding--;
return;
SCReturn;
}
void PoolPrintSaturation(Pool *p) {
@ -404,6 +433,89 @@ end:
PoolFree(p);
return retval;
}
/** \test pool with unlimited size */
static int PoolTestInit07 (void) {
int retval = 0;
void *data = NULL;
void *data2 = NULL;
Pool *p = PoolInit(0,1,PoolTestAlloc,NULL,PoolTestFree);
if (p == NULL)
goto end;
if (p->max_buckets != 0) {
printf("p->max_buckets 0 != %" PRIu32 ": ", p->max_buckets);
retval = 0;
goto end;
}
if (p->allocated != 1) {
printf("p->allocated 1 != %" PRIu32 ": ", p->allocated);
retval = 0;
goto end;
}
data = PoolGet(p);
if (data == NULL) {
printf("PoolGet returned NULL: ");
retval = 0;
goto end;
}
if (p->allocated != 1) {
printf("(2) p->allocated 1 != %" PRIu32 ": ", p->allocated);
retval = 0;
goto end;
}
data2 = PoolGet(p);
if (data2 == NULL) {
printf("PoolGet returned NULL: ");
retval = 0;
goto end;
}
if (p->allocated != 2) {
printf("(3) p->allocated 2 != %" PRIu32 ": ", p->allocated);
retval = 0;
goto end;
}
PoolReturn(p,data);
data = NULL;
if (p->allocated != 2) {
printf("(4) p->allocated 2 != %" PRIu32 ": ", p->allocated);
retval = 0;
goto end;
}
if (p->alloc_list_size != 1) {
printf("p->alloc_list_size 1 != %" PRIu32 ": ", p->alloc_list_size);
retval = 0;
goto end;
}
PoolReturn(p,data2);
data2 = NULL;
if (p->allocated != 1) {
printf("(5) p->allocated 1 != %" PRIu32 ": ", p->allocated);
retval = 0;
goto end;
}
retval = 1;
end:
if (data != NULL)
free(data);
if (data2 != NULL)
free(data2);
if (p != NULL)
PoolFree(p);
return retval;
}
#endif /* UNITTESTS */
void PoolRegisterTests(void) {
@ -414,6 +526,7 @@ void PoolRegisterTests(void) {
UtRegisterTest("PoolTestInit04", PoolTestInit04, 1);
UtRegisterTest("PoolTestInit05", PoolTestInit05, 1);
UtRegisterTest("PoolTestInit06", PoolTestInit06, 1);
UtRegisterTest("PoolTestInit07", PoolTestInit07, 1);
#endif /* UNITTESTS */
}

9
suricata.yaml
Unescape Escape View File

@ -94,6 +94,15 @@ flow-timeouts:
emergency_new: 10
emergency_established: 100
# Stream engine settings.
# stream:
# memcap: 67108864 # 64mb memcap
# max_sessions: 262144 # 256k concurrent sessions
# prealloc_sessions: 32768 # 32k sessions prealloc'd
# midstream: false # don't allow midstream session pickups
# async_oneside: false # don't enable async stream handling
stream:
# Logging configuration. This is not about logging IDS alerts, but
# IDS output about what its doing, errors, etc.
logging:

Write Preview
Loading…
Cancel
Save