stream-tcp: fix stream depth computation

The stream depth computation was partly done with the stream_config
depth instead of using the value in the TCP session. As a result,
some configuration were resulting in abnormal behavior.

In particular, when stream depth was 0 and the file store depth was
not 0, Suricata was stopping the streaming on the flow as soon as
the filestore was started.

Reported-by: Pascal Delalande <pdl35@free.fr>
pull/3538/head
Eric Leblond 7 years ago committed by Victor Julien
parent 076c02a223
commit 778e0d1fa7

@ -532,21 +532,21 @@ static uint32_t StreamTcpReassembleCheckDepth(TcpSession *ssn, TcpStream *stream
* wraps as well */
SCLogDebug("seq + size %u, base %u, seg_depth %"PRIu64" limit %u", (seq + size),
stream->base_seq, seg_depth,
stream_config.reassembly_depth);
ssn->reassembly_depth);
if (seg_depth > (uint64_t)stream_config.reassembly_depth) {
if (seg_depth > (uint64_t)ssn->reassembly_depth) {
SCLogDebug("STREAMTCP_STREAM_FLAG_DEPTH_REACHED");
stream->flags |= STREAMTCP_STREAM_FLAG_DEPTH_REACHED;
SCReturnUInt(0);
}
SCLogDebug("NOT STREAMTCP_STREAM_FLAG_DEPTH_REACHED");
SCLogDebug("%"PRIu64" <= %u", seg_depth, stream_config.reassembly_depth);
SCLogDebug("%"PRIu64" <= %u", seg_depth, ssn->reassembly_depth);
#if 0
SCLogDebug("full depth not yet reached: %"PRIu64" <= %"PRIu32,
(stream->base_seq_offset + stream->base_seq + size),
(stream->isn + stream_config.reassembly_depth));
(stream->isn + ssn->reassembly_depth));
#endif
if (SEQ_GEQ(seq, stream->isn) && SEQ_LT(seq, (stream->isn + stream_config.reassembly_depth))) {
if (SEQ_GEQ(seq, stream->isn) && SEQ_LT(seq, (stream->isn + ssn->reassembly_depth))) {
/* packet (partly?) fits the depth window */
if (SEQ_LEQ((seq + size),(stream->isn + 1 + ssn->reassembly_depth))) {

Loading…
Cancel
Save