Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 19:48:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

BIT-1854: fix the 'tcp_excessive_data_without_further_acks' option

Browse source 
This previously checked against the amount of out-of-sequence data
being buffered by the reassembler.  It now checks against the total
size of all blocks being buffered in the reassembler, which, by nature
of still being buffered there, means it's not been acked yet.
This commit is contained in:
Jon Siwek 2018-01-31 21:09:12 -06:00
parent 44175e0992
commit c2af3daa9f
3 changed files with 31 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/Reassem.h
View file

@ -18,11 +18,16 @@ enum ReassemblerType {
REASSEM_NUM,
};
struct DataBlockListInfo {
uint64 totalSize;
};
class DataBlock {
public:
DataBlock(const u_char* data, uint64 size, uint64 seq,
DataBlock* prev, DataBlock* next,
ReassemblerType reassem_type = REASSEM_UNKNOWN);
DataBlock(DataBlockListInfo* list_info, const u_char* data,
uint64 size, uint64 seq,
DataBlock* prev, DataBlock* next,
ReassemblerType reassem_type = REASSEM_UNKNOWN);
~DataBlock();
@ -33,6 +38,7 @@ public:
uint64 seq, upper;
u_char* block;
ReassemblerType rtype;
DataBlockListInfo* info;
};
class Reassembler : public BroObj {
@ -86,6 +92,7 @@ protected:
void CheckOverlap(DataBlock *head, DataBlock *tail,
uint64 seq, uint64 len, const u_char* data);
DataBlockListInfo block_list_info;
DataBlock* blocks;
DataBlock* last_block;
@ -105,6 +112,7 @@ protected:
inline DataBlock::~DataBlock()
{
info->totalSize -= Size();
Reassembler::total_size -= pad_size(upper - seq) + padded_sizeof(DataBlock);
Reassembler::sizes[rtype] -= pad_size(upper - seq) + padded_sizeof(DataBlock);
delete [] block;