aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make stream inline use the chunk size settings.

Browse Source
remotes/origin/master-1.1.x
Victor Julien 15 years ago
parent 2dc057d1b1
commit 892a8a4985
2 changed files with 41 additions and 30 deletions
Show Stats Download Patch File Download Diff File

27
src/stream-tcp-reassemble.c
Unescape Escape View File

@ -2274,9 +2274,13 @@ static int StreamTcpReassembleInlineRaw (TcpReassemblyThreadCtx *ra_ctx,
uint32_t next_seq = ra_base_seq + 1; uint32_t next_seq = ra_base_seq + 1;
int gap = 0; int gap = 0;
uint16_t chunk_size = PKT_IS_TOSERVER(p) ?
stream_config.reassembly_toserver_chunk_size :
stream_config.reassembly_toclient_chunk_size;
/* determine the left edge and right edge */ /* determine the left edge and right edge */
uint32_t right_edge = TCP_GET_SEQ(p) + p->payload_len; uint32_t right_edge = TCP_GET_SEQ(p) + p->payload_len;
uint32_t left_edge = right_edge - stream_config.reassembly_inline_window; uint32_t left_edge = right_edge - chunk_size;
/* shift the window to the right if the left edge doesn't cover segments */ /* shift the window to the right if the left edge doesn't cover segments */
if (SEQ_GT(seg->seq,left_edge)) { if (SEQ_GT(seg->seq,left_edge)) {
@ -2299,7 +2303,7 @@ static int StreamTcpReassembleInlineRaw (TcpReassemblyThreadCtx *ra_ctx,
seg->payload_len, seg->seq+seg->payload_len, right_edge); seg->payload_len, seg->seq+seg->payload_len, right_edge);
/* Remove the segments which are completely before the ra_base_seq */ /* Remove the segments which are completely before the ra_base_seq */
if (SEQ_LT((seg->seq + seg->payload_len), (ra_base_seq - stream_config.reassembly_inline_window))) if (SEQ_LT((seg->seq + seg->payload_len), (ra_base_seq - chunk_size)))
{ {
SCLogDebug("removing pre ra_base_seq %"PRIu32" seg %p seq %"PRIu32"" SCLogDebug("removing pre ra_base_seq %"PRIu32" seg %p seq %"PRIu32""
" len %"PRIu16"", ra_base_seq, seg, seg->seq, " len %"PRIu16"", ra_base_seq, seg, seg->seq,
@ -2513,7 +2517,7 @@ static int StreamTcpReassembleInlineRaw (TcpReassemblyThreadCtx *ra_ctx,
TcpSegment *next_seg = seg->next; TcpSegment *next_seg = seg->next;
next_seq = seg->seq + seg->payload_len; next_seq = seg->seq + seg->payload_len;
if (SEQ_LT((seg->seq + seg->payload_len), (ra_base_seq - stream_config.reassembly_inline_window))) { if (SEQ_LT((seg->seq + seg->payload_len), (ra_base_seq - chunk_size))) {
if (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED) { if (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED) {
StreamTcpRemoveSegmentFromStream(stream, seg); StreamTcpRemoveSegmentFromStream(stream, seg);
SCLogDebug("removing seg %p, seg->next %p", seg, seg->next); SCLogDebug("removing seg %p, seg->next %p", seg, seg->next);
@ -2533,7 +2537,7 @@ static int StreamTcpReassembleInlineRaw (TcpReassemblyThreadCtx *ra_ctx,
} }
/* see if we can clean up some segments */ /* see if we can clean up some segments */
left_edge = (ra_base_seq + 1) - stream_config.reassembly_inline_window; left_edge = (ra_base_seq + 1) - chunk_size;
SCLogDebug("left_edge %"PRIu32", ra_base_seq %"PRIu32, left_edge, ra_base_seq); SCLogDebug("left_edge %"PRIu32", ra_base_seq %"PRIu32, left_edge, ra_base_seq);
/* loop through the segments to remove unneeded segments */ /* loop through the segments to remove unneeded segments */
@ -7904,7 +7908,7 @@ static int StreamTcpReassembleInlineTest03(void) {
StreamTcpUTSetupStream(&ssn.client, 1); StreamTcpUTSetupStream(&ssn.client, 1);
FLOW_INITIALIZE(&f); FLOW_INITIALIZE(&f);
stream_config.reassembly_inline_window = 15; stream_config.reassembly_toserver_chunk_size = 15;
uint8_t stream_payload1[] = "AAAAABBBBBCCCCC"; uint8_t stream_payload1[] = "AAAAABBBBBCCCCC";
uint8_t stream_payload2[] = "BBBBBCCCCCDDDDD"; uint8_t stream_payload2[] = "BBBBBCCCCCDDDDD";
@ -7916,6 +7920,7 @@ static int StreamTcpReassembleInlineTest03(void) {
} }
p->tcph->th_seq = htonl(12); p->tcph->th_seq = htonl(12);
p->flow = &f; p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) {
printf("failed to add segment 1: "); printf("failed to add segment 1: ");
@ -8016,7 +8021,7 @@ static int StreamTcpReassembleInlineTest04(void) {
StreamTcpUTSetupStream(&ssn.client, 1); StreamTcpUTSetupStream(&ssn.client, 1);
FLOW_INITIALIZE(&f); FLOW_INITIALIZE(&f);
stream_config.reassembly_inline_window = 16; stream_config.reassembly_toserver_chunk_size = 16;
uint8_t stream_payload1[] = "AAAAABBBBBCCCCC"; uint8_t stream_payload1[] = "AAAAABBBBBCCCCC";
uint8_t stream_payload2[] = "ABBBBBCCCCCDDDDD"; uint8_t stream_payload2[] = "ABBBBBCCCCCDDDDD";
@ -8028,6 +8033,7 @@ static int StreamTcpReassembleInlineTest04(void) {
} }
p->tcph->th_seq = htonl(12); p->tcph->th_seq = htonl(12);
p->flow = &f; p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) {
printf("failed to add segment 1: "); printf("failed to add segment 1: ");
@ -8342,7 +8348,7 @@ static int StreamTcpReassembleInlineTest07(void) {
StreamTcpUTSetupStream(&ssn.client, 1); StreamTcpUTSetupStream(&ssn.client, 1);
FLOW_INITIALIZE(&f); FLOW_INITIALIZE(&f);
stream_config.reassembly_inline_window = 16; stream_config.reassembly_toserver_chunk_size = 16;
uint8_t stream_payload1[] = "ABBBBB"; uint8_t stream_payload1[] = "ABBBBB";
uint8_t stream_payload2[] = "DDDDD"; uint8_t stream_payload2[] = "DDDDD";
@ -8355,6 +8361,7 @@ static int StreamTcpReassembleInlineTest07(void) {
} }
p->tcph->th_seq = htonl(12); p->tcph->th_seq = htonl(12);
p->flow = &f; p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) {
printf("failed to add segment 1: "); printf("failed to add segment 1: ");
@ -8473,7 +8480,7 @@ static int StreamTcpReassembleInlineTest08(void) {
StreamTcpUTSetupStream(&ssn.client, 1); StreamTcpUTSetupStream(&ssn.client, 1);
FLOW_INITIALIZE(&f); FLOW_INITIALIZE(&f);
stream_config.reassembly_inline_window = 15; stream_config.reassembly_toserver_chunk_size = 15;
ssn.client.flags |= STREAMTCP_STREAM_FLAG_GAP; ssn.client.flags |= STREAMTCP_STREAM_FLAG_GAP;
uint8_t stream_payload1[] = "AAAAABBBBBCCCCC"; uint8_t stream_payload1[] = "AAAAABBBBBCCCCC";
@ -8486,6 +8493,7 @@ static int StreamTcpReassembleInlineTest08(void) {
} }
p->tcph->th_seq = htonl(12); p->tcph->th_seq = htonl(12);
p->flow = &f; p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) {
printf("failed to add segment 1: "); printf("failed to add segment 1: ");
@ -8602,7 +8610,7 @@ static int StreamTcpReassembleInlineTest09(void) {
StreamTcpUTSetupStream(&ssn.client, 1); StreamTcpUTSetupStream(&ssn.client, 1);
FLOW_INITIALIZE(&f); FLOW_INITIALIZE(&f);
stream_config.reassembly_inline_window = 20; stream_config.reassembly_toserver_chunk_size = 20;
ssn.client.flags |= STREAMTCP_STREAM_FLAG_GAP; ssn.client.flags |= STREAMTCP_STREAM_FLAG_GAP;
uint8_t stream_payload1[] = "AAAAABBBBBCCCCC"; uint8_t stream_payload1[] = "AAAAABBBBBCCCCC";
@ -8616,6 +8624,7 @@ static int StreamTcpReassembleInlineTest09(void) {
} }
p->tcph->th_seq = htonl(17); p->tcph->th_seq = htonl(17);
p->flow = &f; p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) {
printf("failed to add segment 1: "); printf("failed to add segment 1: ");

44
src/stream-tcp.c
Unescape Escape View File

@ -65,7 +65,6 @@
#define STREAMTCP_DEFAULT_PREALLOC 32768 #define STREAMTCP_DEFAULT_PREALLOC 32768
#define STREAMTCP_DEFAULT_MEMCAP 32 * 1024 * 1024 /* 32mb */ #define STREAMTCP_DEFAULT_MEMCAP 32 * 1024 * 1024 /* 32mb */
#define STREAMTCP_DEFAULT_REASSEMBLY_MEMCAP 64 * 1024 * 1024 /* 64mb */ #define STREAMTCP_DEFAULT_REASSEMBLY_MEMCAP 64 * 1024 * 1024 /* 64mb */
#define STREAMTCP_DEFAULT_REASSEMBLY_WINDOW 3000
#define STREAMTCP_DEFAULT_TOSERVER_CHUNK_SIZE 2560 #define STREAMTCP_DEFAULT_TOSERVER_CHUNK_SIZE 2560
#define STREAMTCP_DEFAULT_TOCLIENT_CHUNK_SIZE 2560 #define STREAMTCP_DEFAULT_TOCLIENT_CHUNK_SIZE 2560
@ -383,24 +382,9 @@ void StreamTcpInitConfig(char quiet)
SCLogInfo("stream \"async_oneside\": %s", stream_config.async_oneside ? "enabled" : "disabled"); SCLogInfo("stream \"async_oneside\": %s", stream_config.async_oneside ? "enabled" : "disabled");
} }
if ((ConfGetInt("stream.reassembly.memcap", &value)) == 1) {
stream_config.reassembly_memcap = (uint32_t)value;
} else {
stream_config.reassembly_memcap = STREAMTCP_DEFAULT_REASSEMBLY_MEMCAP;
}
if (!quiet) {
SCLogInfo("stream.reassembly \"memcap\": %"PRIu32"", stream_config.reassembly_memcap);
}
if ((ConfGetInt("stream.reassembly.depth", &value)) == 1) {
stream_config.reassembly_depth = (uint32_t)value;
} else {
stream_config.reassembly_depth = 0;
}
char *csum = NULL; char *csum = NULL;
if ((ConfGet("stream.checksum_validation", &csum)) == 1) { if ((ConfGet("stream.checksum_validation", &csum)) == 1) {
if (strncmp(csum, "yes", 3) == 0) { if (strcmp(csum, "yes") == 0) {
stream_config.flags |= STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION; stream_config.flags |= STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION;
} }
/* Default is that we validate the checksum of all the packets */ /* Default is that we validate the checksum of all the packets */
@ -409,7 +393,9 @@ void StreamTcpInitConfig(char quiet)
} }
if (!quiet) { if (!quiet) {
SCLogInfo("stream.reassembly \"depth\": %"PRIu32"", stream_config.reassembly_depth); SCLogInfo("stream \"checksum_validation\": %s",
stream_config.flags & STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION ?
"enabled" : "disabled");
} }
char *inl = NULL; char *inl = NULL;
@ -423,6 +409,25 @@ void StreamTcpInitConfig(char quiet)
SCLogInfo("stream.\"inline\": %s", stream_inline ? "enabled" : "disabled"); SCLogInfo("stream.\"inline\": %s", stream_inline ? "enabled" : "disabled");
} }
if ((ConfGetInt("stream.reassembly.memcap", &value)) == 1) {
stream_config.reassembly_memcap = (uint32_t)value;
} else {
stream_config.reassembly_memcap = STREAMTCP_DEFAULT_REASSEMBLY_MEMCAP;
}
if (!quiet) {
SCLogInfo("stream.reassembly \"memcap\": %"PRIu32"", stream_config.reassembly_memcap);
}
if ((ConfGetInt("stream.reassembly.depth", &value)) == 1) {
stream_config.reassembly_depth = (uint32_t)value;
} else {
stream_config.reassembly_depth = 0;
}
if (!quiet) {
SCLogInfo("stream.reassembly \"depth\": %"PRIu32"", stream_config.reassembly_depth);
}
if ((ConfGetInt("stream.reassembly.toserver_chunk_size", &value)) == 1) { if ((ConfGetInt("stream.reassembly.toserver_chunk_size", &value)) == 1) {
stream_config.reassembly_toserver_chunk_size = (uint16_t)value; stream_config.reassembly_toserver_chunk_size = (uint16_t)value;
} else { } else {
@ -448,9 +453,6 @@ void StreamTcpInitConfig(char quiet)
stream_config.reassembly_toclient_chunk_size); stream_config.reassembly_toclient_chunk_size);
} }
/** \todo yaml part */
stream_config.reassembly_inline_window = STREAMTCP_DEFAULT_REASSEMBLY_WINDOW;
/* init the memcap and it's lock */ /* init the memcap and it's lock */
stream_memuse = 0; stream_memuse = 0;
stream_memuse_max = 0; stream_memuse_max = 0;

Write Preview
Loading…
Cancel
Save