mirror of
https://github.com/zeek/zeek.git
synced 2025-10-13 03:58:20 +00:00
Fix issue w/ TCP reassembler not delivering some segments.
For example, if we have a connection between TCP "A" and TCP "B" and "A" sends segments "1" and "2", but we don't see the first and then the next acknowledgement from "B" is for everything up to, and including, "2", the gap would be reported to include both segments instead of just the first and then delivering the second. Put generally: any segments that weren't yet delivered because they're waiting for an earlier gap to be filled would be dropped when an ACK comes in that includes the gap as well as those pending segments. (If a distinct ACK was seen for just the gap, that situation would have worked). Addresses BIT-1246.
This commit is contained in:
parent
f97f58e9db
commit
f1cef9d2a9
7 changed files with 96 additions and 39 deletions
24
testing/btest/scripts/base/protocols/http/entity-gap2.bro
Normal file
24
testing/btest/scripts/base/protocols/http/entity-gap2.bro
Normal file
|
@ -0,0 +1,24 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/http/entity_gap2.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff entity_data
|
||||
# @TEST-EXEC: btest-diff extract_files/file0
|
||||
|
||||
global f = open("entity_data");
|
||||
global fn = 0;
|
||||
|
||||
event http_entity_data(c: connection, is_orig: bool, length: count,
|
||||
data: string)
|
||||
{
|
||||
print f, data;
|
||||
}
|
||||
|
||||
event content_gap(c: connection, is_orig: bool, seq: count, length: count)
|
||||
{
|
||||
print f, fmt("<%d byte gap>", length);
|
||||
}
|
||||
|
||||
event file_new(f: fa_file)
|
||||
{
|
||||
Files::add_analyzer(f, Files::ANALYZER_EXTRACT,
|
||||
[$extract_filename=fmt("file%d", fn)]);
|
||||
++fn;
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue