Improve ACK value validation, timestamp checking code. Overall layout.

src/decode-events.h

@@ -139,9 +139,12 @@ enum {
     STREAM_4WHS_SYNACK_WITH_WRONG_ACK,
     STREAM_4WHS_SYNACK_WITH_WRONG_SYN,
     STREAM_4WHS_WRONG_SEQ,
+    STREAM_4WHS_INVALID_ACK,
     STREAM_CLOSEWAIT_ACK_OUT_OF_WINDOW,
     STREAM_CLOSEWAIT_FIN_OUT_OF_WINDOW,
+    STREAM_CLOSEWAIT_INVALID_ACK,
     STREAM_CLOSING_ACK_WRONG_SEQ,
+    STREAM_CLOSING_INVALID_ACK,
     STREAM_EST_PACKET_OUT_OF_WINDOW,
     STREAM_EST_PKT_BEFORE_LAST_ACK,
     STREAM_EST_SYNACK_RESEND,
@@ -151,15 +154,23 @@ enum {
     STREAM_EST_SYN_RESEND,
     STREAM_EST_SYN_RESEND_DIFF_SEQ,
     STREAM_EST_SYN_TOCLIENT,
+    STREAM_EST_INVALID_ACK,
+    STREAM_FIN_INVALID_ACK,
     STREAM_FIN1_ACK_WRONG_SEQ,
     STREAM_FIN1_FIN_WRONG_SEQ,
+    STREAM_FIN1_INVALID_ACK,
     STREAM_FIN2_ACK_WRONG_SEQ,
     STREAM_FIN2_FIN_WRONG_SEQ,
+    STREAM_FIN2_INVALID_ACK,
     STREAM_FIN_BUT_NO_SESSION,
     STREAM_FIN_OUT_OF_WINDOW,
     STREAM_LASTACK_ACK_WRONG_SEQ,
+    STREAM_LASTACK_INVALID_ACK,
     STREAM_RST_BUT_NO_SESSION,
     STREAM_TIMEWAIT_ACK_WRONG_SEQ,
+    STREAM_TIMEWAIT_INVALID_ACK,
+    STREAM_PKT_INVALID_TIMESTAMP,
+    STREAM_PKT_INVALID_ACK,
 
     /* should always be last! */
     DECODE_EVENT_MAX,

src/stream-tcp-private.h

@@ -27,8 +27,8 @@
 #include "decode.h"
 typedef struct TcpSegment_ {
     uint8_t *payload;
-    uint16_t payload_len; /* actual size of the payload */
+    uint16_t payload_len;       /**< actual size of the payload */
-    uint16_t pool_size; /* size of the memory */
+    uint16_t pool_size;         /**< size of the memory */
     uint32_t seq;
     struct TcpSegment_ *next;
     struct TcpSegment_ *prev;