Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 03:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixing productive connections with missing SYN still considered partial after flipping direction.

Browse source 
In https://github.com/zeek/zeek/pull/2191, we added endpoint flipping
for cases where a connection starts with a SYN/ACK followed by ACK or
data. The goal was to treat the connection as productive and go ahead
and parse it. But the TCP analyzer could continue to consider it
partial after flipping, meaning that app layers would bail out. #2426
shows such a case: HTTP gets correctly activated after flipping
through content inspection, but it won't process anything because
`IsPartial()` returns true. As the is-partial state reflects
whether we saw the first packets each in direction, this patch now
overrides that state for the originally missing SYN after flipping.

We actually had the same problem at a couple of other locations already
as well. One of that only happened to work because of the originally
inconsistent state flipping that was fixed in the previous commit. The
corresponding unit test now broke after that change. This commit
updates that logic as well to override the state.

This fix is a bit of a hack, but the best solution I could think of
without introducing larger changes.

Closes #2426.
This commit is contained in:
Robin Sommer 2022-11-08 13:25:59 +01:00
parent 0ef709ae7c
commit 6fbebc5e94
No known key found for this signature in database
GPG key ID: D8187293B3FFE5D0
6 changed files with 27 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/analyzer/protocol/tcp/TCP_Endpoint.cc
View file

@ -275,9 +275,11 @@ bool TCP_Endpoint::CheckHistory(uint32_t mask, char code)
// since if those elicit anything, it should be a RST.
//
// Thus, at this stage we go ahead and flip the connection.
// We then fix up the history (which will initially be "H^").
// We then fix up the history (which will initially be "H^") and
// pretend we have actually seen that missing first packet.
conn->FlipRoles();
conn->ReplaceHistory("^h");
tcp_analyzer->SetFirstPacketSeen(true);
}
if ( ! IsOrig() )