From 11f213fb80a65a55a3710f807c8f70249dac2eac Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sun, 2 Sep 2018 11:34:42 +0200 Subject: [PATCH] stream/tcp: be more liberal in last_ack Don't set even if seq is before next_seq, as this could still be a valid packet that was sent before the state was reached. --- src/stream-tcp.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/src/stream-tcp.c b/src/stream-tcp.c index 5d9179cd8e..dcf6ad02c0 100644 --- a/src/stream-tcp.c +++ b/src/stream-tcp.c @@ -4023,14 +4023,6 @@ static int StreamTcpPacketStateLastAck(ThreadVars *tv, Packet *p, retransmission = 1; } - if (TCP_GET_SEQ(p) != ssn->client.next_seq && TCP_GET_SEQ(p) != ssn->client.next_seq + 1) { - SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" - " != %" PRIu32 " from stream", ssn, - TCP_GET_SEQ(p), ssn->client.next_seq); - StreamTcpSetEvent(p, STREAM_LASTACK_ACK_WRONG_SEQ); - return -1; - } - if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_LASTACK_INVALID_ACK); @@ -4038,9 +4030,19 @@ static int StreamTcpPacketStateLastAck(ThreadVars *tv, Packet *p, } if (!retransmission) { - StreamTcpPacketSetState(p, ssn, TCP_CLOSED); - SCLogDebug("ssn %p: state changed to TCP_CLOSED", ssn); + if (SEQ_LT(TCP_GET_SEQ(p), ssn->client.next_seq)) { + SCLogDebug("ssn %p: not updating state as packet is before next_seq", ssn); + } else if (TCP_GET_SEQ(p) != ssn->client.next_seq && TCP_GET_SEQ(p) != ssn->client.next_seq + 1) { + SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" + " != %" PRIu32 " from stream", ssn, + TCP_GET_SEQ(p), ssn->client.next_seq); + StreamTcpSetEvent(p, STREAM_LASTACK_ACK_WRONG_SEQ); + return -1; + } else { + StreamTcpPacketSetState(p, ssn, TCP_CLOSED); + SCLogDebug("ssn %p: state changed to TCP_CLOSED", ssn); + } ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; }