网络入侵检测系统之 Suricata(十一)--TCP 重组实现详解

/** tcp stream reassemble */... ...qnsm_list_for_each_prev_entry(tmp_tcp_data, &que->tcp_que, node) { same_dir = (dir == tmp_tcp_data->dir); sort1 = cur_tcp_data->seq; if (same_dir)    {  sort2 = tmp_tcp_data->seq;    }  else     {  sort2 = tmp_tcp_data->ack;    } diff = packet_sequence_diff(sort2, sort1); /* 根据diff进行链表insert */ ... ... QNSM_LIST_ADD_AFTER(&cur_tcp_data->node, &tmp_tcp_data->node); que->data_cnt++; cache->cur_pkt_num++;}... ...

if ( SEQ_GT(rcv->r_win_base, tdb->seq) ){ //Received data segment whose seq no is less than already ACKed bytes if(SEQ_GT(rcv->r_nxt_ack, tdb->seq))    { //We have already seen the data and this is a retransmission with  different packet size //Add the packet to seglist if the size is more than offset uint32_t offset = rcv->r_win_base - tdb->seq; if ( offset < p->dsize )        { tdb->seq += offset; p->data += offset; p->dsize -= (uint16_t)offset; StreamQueue(rcv, p, tdb, tcpssn);​ //Restore the original seq and dsize before the packet is egressed p->dsize += (uint16_t)offset; p->data -= offset; tdb->seq -= offset;        }    } else    { //We have NOT seen the data. Add it to stream queue StreamQueue(rcv, p, tdb, tcpssn);    }}else StreamQueue(rcv, p, tdb, tcpssn);

typedef struct _StreamTracker{ StreamTcpPolicy *tcp_policy; StreamSegment *seglist;       /* first queued segment */ StreamSegment *seglist_tail;  /* last queued segment */​ /* Local in the context of these variables means the local part * of the connection.  For example, if this particular StreamTracker * was tracking the client side of a connection, the l_unackd value * would represent the client side of the connection's last unacked * sequence number */ uint32_t l_unackd;     /* local unack'd seq number */ uint32_t l_nxt_seq;    /* local next expected sequence */ uint32_t l_window;     /* local receive window */​ uint32_t r_nxt_ack;    /* next expected ack from remote side */ uint32_t r_win_base;   /* remote side window base sequence number * (i.e. the last ack we got) */ uint32_t isn;          /* initial sequence number */ uint32_t ts_last;      /* last timestamp (for PAWS) */ uint32_t ts_last_pkt;  /* last packet timestamp we got */​ uint32_t seglist_base_seq;   /* seq of first queued segment */ uint32_t seg_count;          /* number of current queued segments */ uint32_t seg_bytes_total;    /* total bytes currently queued */ uint32_t seg_bytes_logical;  /* logical bytes queued (total - overlaps) */ uint32_t total_bytes_queued; /* total bytes queued (life of session) */ uint32_t total_segs_queued;  /* number of segments queued (life) */ uint32_t overlap_count;      /* overlaps encountered */ uint32_t small_seg_count;​ uint16_t reassembly_policy;​} StreamTracker;​typedef struct _StreamSegment{ uint8_t *data; uint8_t *payload;​ struct _StreamSegment *prev; struct _StreamSegment *next;​ struct timeval tv; uint32_t caplen; uint32_t pktlen;​ uint32_t ts; uint32_t seq;​ uint16_t orig_dsize; uint16_t size; } StreamSegment;​typedef struct _TcpSession{ StreamTracker client; StreamTracker server;    ...}