网络入侵检测系统之Suricata(十一)--TCP重组实现详解

/** tcp stream reassemble */
... ...
qnsm_list_for_each_prev_entry(tmp_tcp_data, &que->tcp_que, node) 
{
 same_dir = (dir == tmp_tcp_data->dir);
 sort1 = cur_tcp_data->seq;
 if (same_dir)
    {
  sort2 = tmp_tcp_data->seq;
    } 
 else 
    {
  sort2 = tmp_tcp_data->ack;
    }
 diff = packet_sequence_diff(sort2, sort1);
 /* 根据diff进行链表insert */
 ... ...
 QNSM_LIST_ADD_AFTER(&cur_tcp_data->node, &tmp_tcp_data->node);
 que->data_cnt++;
 cache->cur_pkt_num++;
}
... ...

if ( SEQ_GT(rcv->r_win_base, tdb->seq) )
{
 //Received data segment whose seq no is less than already ACKed bytes
 if(SEQ_GT(rcv->r_nxt_ack, tdb->seq))
    {
 //We have already seen the data and this is a retransmission with  different packet size
 //Add the packet to seglist if the size is more than offset
 uint32_t offset = rcv->r_win_base - tdb->seq;
 if ( offset < p->dsize )
        {
 tdb->seq += offset;
 p->data += offset;
 p->dsize -= (uint16_t)offset;
 StreamQueue(rcv, p, tdb, tcpssn);
​
 //Restore the original seq and dsize before the packet is egressed
 p->dsize += (uint16_t)offset;
 p->data -= offset;
 tdb->seq -= offset;
        }
    }
 else
    {
 //We have NOT seen the data. Add it to stream queue
 StreamQueue(rcv, p, tdb, tcpssn);
    }
}
else
 StreamQueue(rcv, p, tdb, tcpssn);

typedef struct _StreamTracker
{
 StreamTcpPolicy *tcp_policy;
 StreamSegment *seglist;       /* first queued segment */
 StreamSegment *seglist_tail;  /* last queued segment */
​
 /* Local in the context of these variables means the local part
 * of the connection.  For example, if this particular StreamTracker
 * was tracking the client side of a connection, the l_unackd value
 * would represent the client side of the connection's last unacked
 * sequence number
 */
 uint32_t l_unackd;     /* local unack'd seq number */
 uint32_t l_nxt_seq;    /* local next expected sequence */
 uint32_t l_window;     /* local receive window */
​
 uint32_t r_nxt_ack;    /* next expected ack from remote side */
 uint32_t r_win_base;   /* remote side window base sequence number
 * (i.e. the last ack we got) */
 uint32_t isn;          /* initial sequence number */
 uint32_t ts_last;      /* last timestamp (for PAWS) */
 uint32_t ts_last_pkt;  /* last packet timestamp we got */
​
 uint32_t seglist_base_seq;   /* seq of first queued segment */
 uint32_t seg_count;          /* number of current queued segments */
 uint32_t seg_bytes_total;    /* total bytes currently queued */
 uint32_t seg_bytes_logical;  /* logical bytes queued (total - overlaps) */
 uint32_t total_bytes_queued; /* total bytes queued (life of session) */
 uint32_t total_segs_queued;  /* number of segments queued (life) */
 uint32_t overlap_count;      /* overlaps encountered */
 uint32_t small_seg_count;
​
 uint16_t reassembly_policy;
​
} StreamTracker;
​
typedef struct _StreamSegment
{
 uint8_t *data;
 uint8_t *payload;
​
 struct _StreamSegment *prev;
 struct _StreamSegment *next;
​
 struct timeval tv;
 uint32_t caplen;
 uint32_t pktlen;
​
 uint32_t ts;
 uint32_t seq;
​
 uint16_t orig_dsize;
 uint16_t size;
 
} StreamSegment;
​
typedef struct _TcpSession
{
 StreamTracker client;
 StreamTracker server;
    ...
}