src/preprocessors/spp_stream4.c File Reference

 { 1280, 2176, 1895, 1303, 2402, 2211, 1340, 1298,
                                              2500, 2320, 1413, 1313, 1444, 1776, 2015, 1305,
                                              2130, 1190, 1377, 1492, 1380, 2100, 1373, 1029,
                                              750, 444, 874, 551, 401, 390, 1801, 1898,
                                              2260, 2601, 642, 485, 619, 929, 794, 340,
                                              445, 1911, 497, 883, 399, 2201, 2431, 2145,
                                              433, 735, 543, 658, 1174, 2042, 1200, 1800,
                                              2015, 1142, 1530, 487, 673, 899, 743, 2101 }


Defines
#define	INLINE inline
#define	CLOSED 0
#define	LISTEN 1
#define	SYN_RCVD 2
#define	SYN_SENT 3
#define	ESTABLISHED 4
#define	CLOSE_WAIT 5
#define	LAST_ACK 6
#define	FIN_WAIT_1 7
#define	CLOSING 8
#define	FIN_WAIT_2 9
#define	TIME_WAIT 10
#define	NMAP_FINGERPRINT_2S 30
#define	NMAP_FINGERPRINT_NULL 31
#define	NMAP_FINGERPRINT_UPSF 32
#define	NMAP_FINGERPRINT_ZERO_ACK 33
#define	ACTION_NOTHING 0x00000000
#define	ACTION_FLUSH_SERVER_STREAM 0x00000001
#define	ACTION_FLUSH_CLIENT_STREAM 0x00000002
#define	ACTION_DROP_SESSION 0x00000004
#define	ACTION_ACK_SERVER_DATA 0x00000008
#define	ACTION_ACK_CLIENT_DATA 0x00000010
#define	ACTION_DATA_ON_SYN 0x00000020
#define	ACTION_SET_SERVER_ISN 0x00000040
#define	ACTION_COMPLETE_TWH 0x00000080
#define	ACTION_ALERT_NMAP_FINGERPRINT 0x00000100
#define	ACTION_INC_PORT 0x00000200
#define	FROM_SERVER 0
#define	FROM_CLIENT 1
#define	PRUNE_QUANTA 30
#define	STREAM4_MEMORY_CAP 8388608
#define	STREAM4_MAX_SESSIONS 8192
#define	STREAM4_CLEANUP 5
#define	STREAM4_CACHE_PERCENT 0.1
#define	STREAM4_TTL_LIMIT 5
#define	DEFAULT_STREAM_TRACKERS 256000
#define	STATS_HUMAN_READABLE 1
#define	STATS_MACHINE_READABLE 2
#define	STATS_BINARY 3
#define	STATS_MAGIC 0xDEAD029A
#define	REVERSE 0
#define	NO_REVERSE 1
#define	METHOD_FAVOR_NEW 0x01
#define	METHOD_FAVOR_OLD 0x02
#define	UNESTABLISHED_MAX_PCOUNT 300
#define	MAX_STREAM_SIZE (IP_MAXPACKET - IP_HEADER_LEN - TCP_HEADER_LEN - ETHERNET_HEADER_LEN)
#define	SEQ_LT(a, b) ((int)((a) - (b)) < 0)
#define	SEQ_LEQ(a, b) ((int)((a) - (b)) <= 0)
#define	SEQ_GT(a, b) ((int)((a) - (b)) > 0)
#define	SEQ_GEQ(a, b) ((int)((a) - (b)) >= 0)
#define	SEQ_EQ(a, b) ((int)((a) - (b)) == 0)
#define	NO_CHK_SEQ 0
#define	CHK_SEQ 1
#define	S4I
#define	SPARC_TWIDDLE 0
#define	SELF_PRES_THRESHOLD 50
#define	SELF_PRES_PERIOD 90
#define	SUSPEND_THRESHOLD 200
#define	SUSPEND_PERIOD 30
#define	OPS_NORMAL 0
#define	OPS_SELF_PRESERVATION 1
#define	OPS_SUSPEND 2
#define	MAXSIZE_IP 65535
#define	MAX_TRACKER_AMOUNT (MAX_STREAM_SIZE + 4000)
#define	FCOUNT 64
#define	STREAM4_FLUSH_BASE 512
#define	STREAM4_FLUSH_RANGE 1213
#define	FLUSH_BEHAVIOR_RANDOM -1
#define	FLUSH_BEHAVIOR_DEFAULT 0
#define	FLUSH_BEHAVIOR_LARGE 1
Typedefs
typedef _OverlapData	OverlapData
typedef _BuildData	BuildData
typedef _BinStats	BinStats
typedef _StatsLog	StatsLog
typedef _StatsLogHeader	StatsLogHeader
typedef _S4Emergency	S4Emergency
typedef _StreamKey	STREAM_KEY
typedef Session *	SessionPtr
Functions
void *	SafeAlloc (unsigned long, int, Session *)
void	ParseStream4Args (char *)
void	Stream4InitReassembler (u_char *)
void	ReassembleStream4 (Packet , void )
Session *	CreateNewSession (Packet *, u_int32_t, u_int32_t)
void	DropSession (Session *)
void	DeleteSession (Session *, u_int32_t)
void	DeleteSpd (ubi_trRootPtr)
int	GetDirection (Session , Packet )
void	Stream4ShutdownFunction (int, void *)
void	Stream4CleanExitFunction (int, void *)
void	Stream4RestartFunction (int, void *)
void	PrintSessionCache ()
int	CheckRst (Session , int, u_int32_t, Packet )
int	PruneSessionCache (u_int32_t, int, Session *)
void	StoreStreamPkt (Session , Packet , u_int32_t)
void	FlushStream (Stream , Packet , int)
void	InitStream4Pkt ()
int	BuildPacket (Stream , u_int32_t, Packet , int)
int	CheckPorts (u_int16_t, u_int16_t)
void	PortscanWatch (Session *, u_int32_t)
void	PortscanDeclare (Packet *)
void	AddNewTarget (ubi_trRootPtr, u_int32_t, u_int16_t, u_int8_t)
void	AddNewPort (ubi_trRootPtr, u_int16_t, u_int8_t)
int	LogStream (Stream *)
void	WriteSsnStats (BinStats *)
void	OpenStatsFile ()
static int	RetransTooFast (struct timeval old, struct timeval new)
void	Stream4Init (u_char *)
void	PreprocFunction (Packet *)
void	PreprocRestartFunction (int)
void	PreprocCleanExitFunction (int)
static INLINE int	isBetween (u_int32_t low, u_int32_t high, u_int32_t cur)
static INLINE int	NotForStream4 (Packet *p)
static INLINE int	SetFinSent (Packet p, Session ssn, int direction)
static INLINE int	WithinSessionLimits (Packet p, Stream stream)
static INLINE void	StreamSegmentSub (Stream *stream, u_int16_t sub)
static INLINE void	StreamSegmentAdd (Stream *stream, u_int16_t add)
int	UpdateState (Session , Packet , u_int32_t)
int	UpdateState2 (Session , Packet , u_int32_t)
int	UpdateStateAsync (Session , Packet , u_int32_t)
static void	TcpAction (Session ssn, Packet p, int action, int direction, u_int32_t pkt_seq, u_int32_t pkt_ack)
static void	TcpActionAsync (Session ssn, Packet p, int action, int direction, u_int32_t pkt_seq, u_int32_t pkt_ack)
int	LoadStateTable (const u_int32_t thetime, const char *path)
static int	DataCompareFunc (ubi_trItemPtr ItemPtr, ubi_trNodePtr NodePtr)
static int	OverlapCompareFunc (ubi_trItemPtr ItemPtr, void *data)
static void	KillSpd (ubi_trNodePtr NodePtr)
static void	TraverseFunc (ubi_trNodePtr NodePtr, void *build_data)
void	SegmentCleanTraverse (Stream *s)
void	DirectLogTcpdump (struct pcap_pkthdr , u_int8_t )
static void	LogTraverse (ubi_trNodePtr NodePtr, void *foo)
void	SetupStream4 ()
void	DisplayStream4Config (void)
static INLINE void	PruneCheck (Packet *p)
void INLINE	QueueState (u_int8_t transition, Stream *sptr, u_int8_t expected_flags, u_int32_t seq_num, u_int8_t chk_seq)
int INLINE	EvalStateQueue (Stream *sptr, u_int8_t flags, u_int32_t ack)
void	FlushDeletedStream (Session ssn, Stream s)
static u_int32_t	GetTcpTimestamp (Packet p, u_int32_t ts)
int	AlertFlushStream (Packet *p)
static void	InitFakePkt (Packet *p)
static char	parse_one_v1 (u_int32_t thetime, Packet fakep, struct parse_v1_file parse)
Variables
char *	file_name
int *	file_line
int	opdsize
static u_int32_t	old_flush_points [FCOUNT]
static u_int32_t	new_flush_points [FCOUNT]
StatsLog *	stats_log
u_int32_t	safe_alloc_faults
Packet *	stream_pkt
int	do_detect
FILE *	session_log
Stream4Data	s4data
u_int32_t	stream4_memory_usage
u_int32_t	ps_memory_usage
S4Emergency	s4_emergency
u_int32_t	flush_points [FCOUNT]

spp_stream4.c File Reference

Defines

Typedefs

Functions

Variables

Define Documentation

Typedef Documentation

Function Documentation

Variable Documentation