Let our TCP-based application analyzers operate without any TCP parent analyzer.

Conceptually, a TCP-based application analyzer should not need any
knowledge about the underlying TCP analysis; it's supposed to just
process its reassembled input stream as it's handed over. But our
analyzers break that assumption at a few places because sometimes
knowledge about the TCP state of the connection can be helpful for
heuristics. This is fine as long as there actually *is* a TCP parent
analyzer available. Sometimes, however, there isn't: if the payload
stream is encapsulated inside another application-layer protocol, the
semantic link to TCP is broken. And if the outer connection is even
UDP, then we don't have a TCP analyzer at all.

We didn't handle this situation well so far. Most analyzers needing
TCP state would just crash if there's no TCP analyzer (in debug mode
with an `assert`, in release mode with a null pointer deref ...). Only
HTTP did the right thing already: check if TCP is available and adapt
accordingly.

We know extend that check to all other analyzers as well: all accesses
to `TCP()` are guarded, with reasonable defaults if not available.
It's actually a pretty small change overall, which is evidence for how
little this layering violation actually matters.

The existing behavior is what's causing
https://github.com/corelight/zeek-spicy-openvpn/issues/3.

src/analyzer/protocol/bittorrent/BitTorrent.cc

@@ -36,10 +36,7 @@ void BitTorrent_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-
-	if ( TCP()->IsPartial() )
-		// punt on partial.
 		return;
 
 	if ( this_stop )

src/analyzer/protocol/bittorrent/BitTorrentTracker.cc

@@ -80,10 +80,7 @@ void BitTorrentTracker_Analyzer::DeliverStream(int len, const u_char* data, bool
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-
-	if ( TCP()->IsPartial() )
-		// punt on partial.
 		return;
 
 	if ( orig )

src/analyzer/protocol/dce-rpc/DCE_RPC.cc

@@ -50,8 +50,6 @@ void DCE_RPC_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
-
 	if ( had_gap )
 		// If only one side had a content gap, we could still try to
 		// deliver data to the other side if the script layer can handle this.

src/analyzer/protocol/ftp/FTP.cc

@@ -45,11 +45,14 @@ void FTP_Analyzer::Done()
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::Done();
 
-	if ( nvt_orig->HasPartialLine() &&
+	if ( TCP() )
-	     (TCP()->OrigState() == analyzer::tcp::TCP_ENDPOINT_CLOSED ||
+		{
-	      TCP()->OrigPrevState() == analyzer::tcp::TCP_ENDPOINT_CLOSED) )
+		if ( nvt_orig->HasPartialLine() &&
-		// ### should include the partial text
+		     (TCP()->OrigState() == analyzer::tcp::TCP_ENDPOINT_CLOSED ||
-		Weird("partial_ftp_request");
+		      TCP()->OrigPrevState() == analyzer::tcp::TCP_ENDPOINT_CLOSED) )
+			// ### should include the partial text
+			Weird("partial_ftp_request");
+		}
 	}
 
 static uint32_t get_reply_code(int len, const char* line)

src/analyzer/protocol/gssapi/GSSAPI.cc

@@ -38,8 +38,6 @@ void GSSAPI_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
-
 	try
 		{
 		interp->NewData(orig, data, data + len);

src/analyzer/protocol/imap/IMAP.cc

@@ -47,8 +47,7 @@ void IMAP_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 		return;
 		}
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-	if ( TCP()->IsPartial() )
 		return;
 
 	if ( had_gap )

src/analyzer/protocol/krb/KRB_TCP.cc

@@ -39,8 +39,7 @@ void KRB_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-	if ( TCP()->IsPartial() )
 		return;
 
 	if ( had_gap )

src/analyzer/protocol/login/Login.cc

@@ -123,8 +123,8 @@ void Login_Analyzer::NewLine(bool orig, char* line)
 
 	if ( state == LOGIN_STATE_AUTHENTICATE )
 		{
-		if ( TCP()->OrigState() == analyzer::tcp::TCP_ENDPOINT_PARTIAL ||
+		if ( TCP() && (TCP()->OrigState() == analyzer::tcp::TCP_ENDPOINT_PARTIAL ||
-		     TCP()->RespState() == analyzer::tcp::TCP_ENDPOINT_PARTIAL )
+		               TCP()->RespState() == analyzer::tcp::TCP_ENDPOINT_PARTIAL) )
 			state = LOGIN_STATE_CONFUSED; // unknown login state
 		else
 			{

src/analyzer/protocol/login/RSH.cc

@@ -34,10 +34,13 @@ Contents_Rsh_Analyzer::~Contents_Rsh_Analyzer() { }
 
 void Contents_Rsh_Analyzer::DoDeliver(int len, const u_char* data)
 	{
-	auto* tcp = static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(Parent())->TCP();
+	int endp_state;
-	assert(tcp);
 
-	int endp_state = IsOrig() ? tcp->OrigState() : tcp->RespState();
+	if ( auto* tcp = static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(Parent())->TCP() )
+		endp_state = IsOrig() ? tcp->OrigState() : tcp->RespState();
+	else
+		endp_state = tcp::TCP_ENDPOINT_ESTABLISHED; // no TCP parent, assume somebody's feeding us a
+		                                            // legitimate stream
 
 	for ( ; len > 0; --len, ++data )
 		{

src/analyzer/protocol/login/Rlogin.cc

@@ -30,10 +30,13 @@ Contents_Rlogin_Analyzer::~Contents_Rlogin_Analyzer() { }
 
 void Contents_Rlogin_Analyzer::DoDeliver(int len, const u_char* data)
 	{
-	auto* tcp = static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(Parent())->TCP();
+	int endp_state;
-	assert(tcp);
 
-	int endp_state = IsOrig() ? tcp->OrigState() : tcp->RespState();
+	if ( auto* tcp = static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(Parent())->TCP() )
+		endp_state = IsOrig() ? tcp->OrigState() : tcp->RespState();
+	else
+		endp_state = tcp::TCP_ENDPOINT_ESTABLISHED; // no TCP parent, assume somebody's feeding us a
+		                                            // legitimate stream
 
 	for ( ; len > 0; --len, ++data )
 		{

src/analyzer/protocol/mqtt/MQTT.cc

@@ -37,8 +37,6 @@ void MQTT_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
-
 	try
 		{
 		interp->NewData(orig, data, data + len);

src/analyzer/protocol/mysql/MySQL.cc

@@ -38,8 +38,7 @@ void MySQL_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-	if ( TCP()->IsPartial() )
 		return;
 
 	if ( had_gap )

src/analyzer/protocol/ncp/NCP.cc

@@ -180,8 +180,12 @@ void Contents_NCP_Analyzer::DeliverStream(int len, const u_char* data, bool orig
 	if ( ! resync_set )
 		{
 		resync_set = true;
-		resync = (IsOrig() ? tcp->OrigState() : tcp->RespState()) !=
+
-		         analyzer::tcp::TCP_ENDPOINT_ESTABLISHED;
+		if ( tcp )
+			resync = (IsOrig() ? tcp->OrigState() : tcp->RespState()) !=
+			         analyzer::tcp::TCP_ENDPOINT_ESTABLISHED;
+		else
+			resync = false;
 		}
 
 	if ( tcp && tcp->HadGap(orig) )

src/analyzer/protocol/ntlm/NTLM.cc

@@ -37,8 +37,6 @@ void NTLM_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
-
 	try
 		{
 		interp->NewData(orig, data, data + len);

src/analyzer/protocol/rdp/RDP.cc

@@ -39,8 +39,7 @@ void RDP_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-	if ( TCP()->IsPartial() )
 		return;
 
 	if ( had_gap )

src/analyzer/protocol/rfb/RFB.cc

@@ -36,8 +36,8 @@ void RFB_Analyzer::EndpointEOF(bool is_orig)
 void RFB_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
-	assert(TCP());
+
-	if ( TCP()->IsPartial() )
+	if ( TCP() && TCP()->IsPartial() )
 		return;
 
 	if ( had_gap )

src/analyzer/protocol/rpc/RPC.cc

@@ -446,16 +446,16 @@ bool Contents_RPC::CheckResync(int& len, const u_char*& data, bool orig)
 		// is fully established we are in sync (since it's the first chunk
 		// of data after the SYN if its not established we need to
 		// resync.
-		auto* tcp = static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(Parent())->TCP();
+		resync_state = INSYNC;
-		assert(tcp);
 
-		if ( (IsOrig() ? tcp->OrigState() : tcp->RespState()) !=
+		if ( auto* tcp = static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(Parent())->TCP() )
-		     analyzer::tcp::TCP_ENDPOINT_ESTABLISHED )
 			{
-			NeedResync();
+			if ( (IsOrig() ? tcp->OrigState() : tcp->RespState()) !=
+			     analyzer::tcp::TCP_ENDPOINT_ESTABLISHED )
+				{
+				NeedResync();
+				}
 			}
-		else
-			resync_state = INSYNC;
 		}
 
 	if ( resync_state == INSYNC )

src/analyzer/protocol/sip/SIP_TCP.cc

@@ -41,8 +41,7 @@ void SIP_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-	if ( TCP()->IsPartial() )
 		return;
 
 	if ( had_gap )

src/analyzer/protocol/smb/SMB.cc

@@ -61,8 +61,6 @@ void SMB_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
-
 	// It we need to resync and we don't have an SMB header, bail!
 	if ( need_sync && ! HasSMBHeader(len, data) )
 		return;

src/analyzer/protocol/socks/SOCKS.cc

@@ -46,10 +46,7 @@ void SOCKS_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-
-	if ( TCP()->IsPartial() )
-		// punt on partial.
 		return;
 
 	if ( orig_done && resp_done )

src/analyzer/protocol/ssh/SSH.cc

@@ -44,8 +44,7 @@ void SSH_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-	if ( TCP()->IsPartial() )
 		return;
 
 	if ( had_gap )

src/analyzer/protocol/syslog/Syslog.cc

@@ -79,10 +79,7 @@ void Syslog_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, uint
 //	{
 //	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 //
-//	assert(TCP());
+//	if ( TCP() && TCP()->IsPartial() )
-//
-//	if ( TCP()->IsPartial() || TCP()->HadGap(orig) )
-//		// punt-on-partial or stop-on-gap.
 //		return;
 //
 //	interp->NewData(orig, data, data + len);

src/analyzer/protocol/tcp/ContentLine.cc

@@ -331,9 +331,7 @@ void ContentLine_Analyzer::CheckNUL()
 	// had been an initial SYN, so we check for whether
 	// the connection has at most two bytes so far.
 
-	auto* tcp = static_cast<TCP_ApplicationAnalyzer*>(Parent())->TCP();
+	if ( auto* tcp = static_cast<TCP_ApplicationAnalyzer*>(Parent())->TCP() )
-
-	if ( tcp )
 		{
 		TCP_Endpoint* endp = IsOrig() ? tcp->Orig() : tcp->Resp();
 		if ( endp->state == TCP_ENDPOINT_PARTIAL && endp->LastSeq() - endp->StartSeq() <= 2 )

src/analyzer/protocol/tcp/TCP.cc

@@ -36,12 +36,13 @@ void TCP_ApplicationAnalyzer::Init()
 
 void TCP_ApplicationAnalyzer::AnalyzerViolation(const char* reason, const char* data, int len)
 	{
-	auto* tcp = TCP();
+	if ( auto* tcp = TCP() )
-
+		{
-	if ( tcp && (tcp->IsPartial() || tcp->HadGap(false) || tcp->HadGap(true)) )
+		if ( tcp->IsPartial() || tcp->HadGap(false) || tcp->HadGap(true) )
-		// Filter out incomplete connections.  Parsing them is
+			// Filter out incomplete connections.  Parsing them is
-		// too unreliable.
+			// too unreliable.
-		return;
+			return;
+		}
 
 	Analyzer::AnalyzerViolation(reason, data, len);
 	}

src/analyzer/protocol/xmpp/XMPP.cc

@@ -44,8 +44,7 @@ void XMPP_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 		return;
 		}
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-	if ( TCP()->IsPartial() )
 		return;
 
 	if ( had_gap )

testing/btest/plugins/binpac-flowbuffer-frame-length-plugin/src/FOO.cc

@@ -38,8 +38,7 @@ void FOO_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-	if ( TCP()->IsPartial() )
 		return;
 
 	if ( had_gap )

testing/btest/plugins/protocol-plugin/src/Foo.cc

@@ -36,10 +36,7 @@ void Foo::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	zeek::analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	assert(TCP());
+	if ( TCP() && TCP()->IsPartial() )
-
-	if ( TCP()->IsPartial() )
-		// punt on partial.
 		return;
 
 	try