gfwleak/stellar-stellar
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rename session_direction to flow_direction

Browse Source
This commit is contained in:
luwenpeng
2024-05-09 14:57:12 +08:00
parent 37d12ebcfc
commit cc380d9271
21 changed files with 610 additions and 556 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
include/stellar/packet.h
View File

@@ -78,7 +78,30 @@ const struct packet_layer *packet_get_outermost_layer(const struct packet *pkt,
* Utils
******************************************************************************/
int8_t packet_get_layers(const struct packet *pkt);
#define MAX_SID_NUM 8
struct sid_list
{
uint16_t sid[MAX_SID_NUM];
int used;
};
enum packet_direction
{
PACKET_DIRECTION_OUTGOING = 0, // Internal -> External: 0
PACKET_DIRECTION_INCOMING = 1, // External -> Internal: 1
};
enum packet_action
{
PACKET_ACTION_FORWARD = 0,
PACKET_ACTION_DROP = 1,
};
enum packet_direction packet_get_direction(const struct packet *pkt);
uint64_t packet_get_session_id(const struct packet *pkt);
void packet_prepend_sid_list(struct packet *pkt, const struct sid_list *list);
int8_t packet_get_layers_number(const struct packet *pkt);
const struct packet_layer *packet_get_layer(const struct packet *pkt, int8_t idx);
const char *packet_get_data(const struct packet *pkt);
@@ -87,27 +110,8 @@ uint16_t packet_get_len(const struct packet *pkt);
const char *packet_get_payload(const struct packet *pkt);
uint16_t packet_get_payload_len(const struct packet *pkt);
int packet_need_drop(const struct packet *pkt);
void packet_set_drop(struct packet *pkt);
int packet_is_ctrl(const struct packet *pkt);
void packet_set_direction(struct packet *pkt, int dir);
int packet_get_direction(const struct packet *pkt); // 1: E2I, 0: I2E
void packet_set_session_id(struct packet *pkt, uint64_t sess_id);
uint64_t packet_get_session_id(const struct packet *pkt);
#define MAX_SID_NUM 8
struct sid_list
{
uint16_t sid[MAX_SID_NUM];
int used;
};
void packet_set_sid_list(struct packet *pkt, const struct sid_list *list);
void packet_get_sid_list(const struct packet *pkt, struct sid_list *list);
void packet_prepend_sid_list(struct packet *pkt, const struct sid_list *list);
void packet_append_sid_list(struct packet *pkt, const struct sid_list *list);
void packet_set_action(struct packet *pkt, enum packet_action action);
enum packet_action packet_get_action(const struct packet *pkt);
/*
******************************************************************************
@@ -138,7 +142,7 @@ void packet_append_sid_list(struct packet *pkt, const struct sid_list *list);
******************************************************************************
*
* // inorder
* int8_t layers = packet_get_layers(pkt);
* int8_t layers = packet_get_layers_number(pkt);
* for (int8_t i = 0; i < layers; i++)
* {
* const struct packet_layer *layer = packet_get_layer(pkt, i);

25
include/stellar/session.h
View File

@@ -29,10 +29,16 @@ enum session_type
enum session_direction
{
SESSION_DIRECTION_NONE = -1,
SESSION_DIRECTION_C2S = 0,
SESSION_DIRECTION_S2C = 1,
MAX_DIRECTION = 2,
SESSION_DIRECTION_INBOUND = 0,
SESSION_DIRECTION_OUTBOUND = 1,
};
enum flow_direction
{
FLOW_DIRECTION_NONE = -1,
FLOW_DIRECTION_C2S = 0,
FLOW_DIRECTION_S2C = 1,
MAX_FLOW_DIRECTION = 2,
};
enum closing_reason
@@ -118,18 +124,15 @@ int session_has_dup_traffic(const struct session *sess);
enum session_type session_get_type(const struct session *sess);
enum session_state session_get_state(const struct session *sess);
enum closing_reason session_get_closing_reason(const struct session *sess);
enum session_direction session_get_current_direction(const struct session *sess);
const struct packet *session_get_1st_packet(const struct session *sess, enum session_direction dir);
enum session_direction session_get_direction(const struct session *sess);
enum flow_direction session_get_flow_direction(const struct session *sess);
const struct packet *session_get_first_packet(const struct session *sess, enum flow_direction dir);
uint64_t session_get_id(const struct session *sess);
uint64_t session_get_timestamp(const struct session *sess, enum session_timestamp type);
uint64_t session_get_stat(const struct session *sess, enum session_direction dir, enum session_stat stat);
uint64_t session_get_stat(const struct session *sess, enum flow_direction dir, enum session_stat stat);
const char *session_get_tuple_str(const struct session *sess);
const char *session_type_to_str(enum session_type type);
const char *session_state_to_str(enum session_state state);
const char *session_direction_to_str(enum session_direction dir);
const char *closing_reason_to_str(enum closing_reason reason);
#ifdef __cplusplus
}

9
include/stellar/stellar.h
View File

@@ -11,12 +11,9 @@ extern "C"
uint16_t stellar_get_current_thread_index();
// return 0: success, -1: failed
int stellar_inject_icmp_unreach(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx);
int stellar_inject_tcp_rst(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx);
int stellar_inject_tcp_payload(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx, const char *payload, uint16_t len);
int stellar_inject_udp_payload(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx, const char *payload, uint16_t len);
int stellar_inject_ctrl_msg(const struct session *sess, uint16_t *sids, int nr_sid, uint16_t thr_idx, const char *msg, uint16_t len);
int stellar_inject_stateless_pkt(uint16_t link_id, uint16_t thr_idx, const char *packet, uint16_t len);
int stellar_inject_tcp_flags(const struct session *sess, enum flow_direction inject_dir, uint8_t flags);
int stellar_inject_payload(const struct session *sess, enum flow_direction inject_dir, const char *payload, uint16_t len);
int stellar_inject_ctrl_msg(const struct session *sess, const struct sid_list *sids, const char *msg, uint16_t len);
#ifdef __cplusplus
}

44
src/packet/packet_priv.h
View File

@@ -45,8 +45,8 @@ struct packet
const char *data_ptr;
uint16_t data_len;
int need_drop;
void *origin_ctx; // mbuff or pcap pointer
enum packet_action action;
enum packet_origin origin;
};
@@ -62,23 +62,6 @@ uint64_t packet_get_hash(const struct packet *pkt, enum ldbc_method method, int
* Utils
******************************************************************************/
void packet_set_origin(struct packet *pkt, enum packet_origin origin);
enum packet_origin packet_get_origin(const struct packet *pkt);
void packet_set_origin_ctx(struct packet *pkt, void *ctx);
void *packet_get_origin_ctx(const struct packet *pkt);
int packet_is_fragment(const struct packet *pkt);
void packet_set_ctrl(struct packet *pkt);
struct packet *packet_new(uint16_t pkt_len);
void packet_free(struct packet *pkt);
struct packet *packet_dup(const struct packet *pkt);
void packet_set_domain(struct packet *pkt, uint64_t domain);
uint64_t packet_get_domain(const struct packet *pkt);
#define MAX_ROUTE_CTX 64
struct route_ctx
{
@@ -88,6 +71,31 @@ struct route_ctx
void packet_set_route_ctx(struct packet *pkt, const struct route_ctx *ctx);
void packet_get_route_ctx(const struct packet *pkt, struct route_ctx *ctx);
void packet_set_origin(struct packet *pkt, enum packet_origin origin);
enum packet_origin packet_get_origin(const struct packet *pkt);
void packet_set_origin_ctx(struct packet *pkt, void *ctx);
void *packet_get_origin_ctx(const struct packet *pkt);
void packet_set_domain(struct packet *pkt, uint64_t domain);
uint64_t packet_get_domain(const struct packet *pkt);
void packet_set_ctrl(struct packet *pkt);
int packet_is_ctrl(const struct packet *pkt);
void packet_set_sid_list(struct packet *pkt, const struct sid_list *list);
void packet_get_sid_list(const struct packet *pkt, struct sid_list *list);
void packet_append_sid_list(struct packet *pkt, const struct sid_list *list);
struct packet *packet_new(uint16_t pkt_len);
void packet_free(struct packet *pkt);
struct packet *packet_dup(const struct packet *pkt);
void packet_set_session_id(struct packet *pkt, uint64_t sess_id);
void packet_set_direction(struct packet *pkt, enum packet_direction dir);
int packet_is_fragment(const struct packet *pkt);
#ifdef __cplusplus
}
#endif

22
src/packet/packet_utils.cpp
View File

@@ -19,7 +19,7 @@ enum packet_origin packet_get_origin(const struct packet *pkt)
return pkt->origin;
}
int8_t packet_get_layers(const struct packet *pkt)
int8_t packet_get_layers_number(const struct packet *pkt)
{
return pkt->layers_used;
}
@@ -61,14 +61,14 @@ uint16_t packet_get_payload_len(const struct packet *pkt)
return pkt->layers[pkt->layers_used - 1].pld_len;
}
int packet_need_drop(const struct packet *pkt)
void packet_set_action(struct packet *pkt, enum packet_action action)
{
return pkt->need_drop;
pkt->action = action;
}
void packet_set_drop(struct packet *pkt)
enum packet_action packet_get_action(const struct packet *pkt)
{
pkt->need_drop = 1;
return pkt->action;
}
void packet_set_origin_ctx(struct packet *pkt, void *ctx)
@@ -174,8 +174,7 @@ int packet_is_ctrl(const struct packet *pkt)
}
}
// 1: E2I, 0: I2E
void packet_set_direction(struct packet *pkt, int dir)
void packet_set_direction(struct packet *pkt, enum packet_direction dir)
{
if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
{
@@ -192,15 +191,14 @@ void packet_set_direction(struct packet *pkt, int dir)
}
}
// 1: E2I, 0: I2E
int packet_get_direction(const struct packet *pkt)
enum packet_direction packet_get_direction(const struct packet *pkt)
{
int direction = 0;
enum packet_direction dir = PACKET_DIRECTION_INCOMING;
if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
{
marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
assert(mbuff != NULL);
if (marsio_buff_get_metadata(mbuff, MR_BUFF_DIR, &direction, sizeof(direction)) <= 0)
if (marsio_buff_get_metadata(mbuff, MR_BUFF_DIR, &dir, sizeof(dir)) <= 0)
{
PACKET_LOG_ERROR("failed to get direction");
}
@@ -210,7 +208,7 @@ int packet_get_direction(const struct packet *pkt)
PACKET_LOG_ERROR("packet origin is not marsio, failed to get direction");
}
return direction;
return dir;
}
void packet_set_session_id(struct packet *pkt, uint64_t sess_id)

1
src/packet_io/dumpfile_io.cpp
View File

@@ -292,6 +292,7 @@ int dumpfile_io_ingress(struct dumpfile_io *handle, uint16_t thr_idx, struct pac
packet_parse(pkt, pcap_pkt->data, pcap_pkt->len);
packet_set_origin_ctx(pkt, pcap_pkt);
packet_set_origin(pkt, PACKET_ORIGIN_DUMPFILE);
packet_set_action(pkt, PACKET_ACTION_FORWARD);
nr_parsed++;
}
}

1
src/packet_io/marsio_io.cpp
View File

@@ -172,6 +172,7 @@ int marsio_io_ingress(struct marsio_io *handle, uint16_t thr_idx, struct packet
packet_parse(pkt, data, len);
packet_set_origin_ctx(pkt, mbuff);
packet_set_origin(pkt, PACKET_ORIGIN_MARSIO);
packet_set_action(pkt, PACKET_ACTION_FORWARD);
nr_parsed++;
if (marsio_buff_is_ctrlbuf(mbuff))

56
src/session/session.cpp
View File

@@ -50,12 +50,12 @@ const struct tuple6 *session_get_tuple(const struct session *sess)
return &sess->tuple;
}
void session_set_tuple_direction(struct session *sess, enum session_direction dir)
void session_set_tuple_direction(struct session *sess, enum flow_direction dir)
{
sess->tuple_dir = dir;
}
enum session_direction session_get_tuple_direction(const struct session *sess)
enum flow_direction session_get_tuple_direction(const struct session *sess)
{
return sess->tuple_dir;
}
@@ -65,14 +65,24 @@ const char *session_get_tuple_str(const struct session *sess)
return sess->tuple_str;
}
void session_set_current_direction(struct session *sess, enum session_direction dir)
void session_set_direction(struct session *sess, enum session_direction dir)
{
sess->cur_dir = dir;
sess->sess_dir = dir;
}
enum session_direction session_get_current_direction(const struct session *sess)
enum session_direction session_get_direction(const struct session *sess)
{
return sess->cur_dir;
return sess->sess_dir;
}
void session_set_flow_direction(struct session *sess, enum flow_direction dir)
{
sess->flow_dir = dir;
}
enum flow_direction session_get_flow_direction(const struct session *sess)
{
return sess->flow_dir;
}
void session_set_state(struct session *sess, enum session_state state)
@@ -115,12 +125,12 @@ enum closing_reason session_get_closing_reason(const struct session *sess)
return sess->reason;
}
void session_inc_stat(struct session *sess, enum session_direction dir, enum session_stat stat, uint64_t val)
void session_inc_stat(struct session *sess, enum flow_direction dir, enum session_stat stat, uint64_t val)
{
sess->stats[dir][stat] += val;
}
uint64_t session_get_stat(const struct session *sess, enum session_direction dir, enum session_stat stat)
uint64_t session_get_stat(const struct session *sess, enum flow_direction dir, enum session_stat stat)
{
return sess->stats[dir][stat];
}
@@ -135,42 +145,42 @@ uint64_t session_get_timestamp(const struct session *sess, enum session_timestam
return sess->timestamps[type];
}
void session_clear_sid_list(struct session *sess, enum session_direction dir)
void session_clear_sid_list(struct session *sess, enum flow_direction dir)
{
memset(&sess->sids[dir], 0, sizeof(struct sid_list));
}
void session_set_sid_list(struct session *sess, enum session_direction dir, const struct sid_list *list)
void session_set_sid_list(struct session *sess, enum flow_direction dir, const struct sid_list *list)
{
sess->sids[dir] = *list;
}
void session_get_sid_list(const struct session *sess, enum session_direction dir, struct sid_list *list)
void session_get_sid_list(const struct session *sess, enum flow_direction dir, struct sid_list *list)
{
*list = sess->sids[dir];
}
void session_clear_route_ctx(struct session *sess, enum session_direction dir)
void session_clear_route_ctx(struct session *sess, enum flow_direction dir)
{
memset(&sess->route_ctx[dir], 0, sizeof(struct route_ctx));
}
void session_set_route_ctx(struct session *sess, enum session_direction dir, const struct route_ctx *ctx)
void session_set_route_ctx(struct session *sess, enum flow_direction dir, const struct route_ctx *ctx)
{
sess->route_ctx[dir] = *ctx;
}
void session_get_route_ctx(const struct session *sess, enum session_direction dir, struct route_ctx *ctx)
void session_get_route_ctx(const struct session *sess, enum flow_direction dir, struct route_ctx *ctx)
{
*ctx = sess->route_ctx[dir];
}
void session_set_1st_packet(struct session *sess, enum session_direction dir, const struct packet *pkt)
void session_set_first_packet(struct session *sess, enum flow_direction dir, const struct packet *pkt)
{
sess->first_pkt[dir] = packet_dup(pkt);
}
const struct packet *session_get_1st_packet(const struct session *sess, enum session_direction dir)
const struct packet *session_get_first_packet(const struct session *sess, enum flow_direction dir)
{
return sess->first_pkt[dir];
}
@@ -197,7 +207,7 @@ void *session_get_user_data(const struct session *sess)
struct tcp_segment *session_get_tcp_segment(struct session *sess)
{
enum session_direction dir = session_get_current_direction(sess);
enum flow_direction dir = session_get_flow_direction(sess);
struct tcp_half *half = &sess->tcp_halfs[dir];
if (half->in_order.data != NULL && half->in_order.len > 0)
@@ -225,7 +235,7 @@ void session_free_tcp_segment(struct session *sess, struct tcp_segment *seg)
return;
}
enum session_direction dir = session_get_current_direction(sess);
enum flow_direction dir = session_get_flow_direction(sess);
struct tcp_half *half = &sess->tcp_halfs[dir];
if (seg == &half->in_order)
@@ -405,13 +415,13 @@ const char *session_type_to_str(enum session_type type)
}
}
const char *session_direction_to_str(enum session_direction dir)
const char *flow_direction_to_str(enum flow_direction dir)
{
switch (dir)
{
case SESSION_DIRECTION_C2S:
case FLOW_DIRECTION_C2S:
return "C2S";
case SESSION_DIRECTION_S2C:
case FLOW_DIRECTION_S2C:
return "S2C";
default:
return "unknown";
@@ -458,7 +468,7 @@ int session_to_json(struct session *sess, char *buff, int size)
used += snprintf(buff + used, size - used, "\"current_packet\":\"%p\",", session_get_current_packet(sess));
const char *str[] = {"c2s", "s2c"};
enum session_direction dir[] = {SESSION_DIRECTION_C2S, SESSION_DIRECTION_S2C};
enum flow_direction dir[] = {FLOW_DIRECTION_C2S, FLOW_DIRECTION_S2C};
for (int i = 0; i < 2; i++)
{
if (session_get_type(sess) == SESSION_TYPE_TCP)
@@ -486,7 +496,7 @@ int session_to_json(struct session *sess, char *buff, int size)
used += snprintf(buff + used, size - used, "\"%s_tcp_plds_released\":%" PRIu64 ",", str[i], session_get_stat(sess, dir[i], STAT_TCP_PLDS_RELEASED));
}
used += snprintf(buff + used, size - used, "\"%s_1st_pkt\":\"%p\",", str[i], session_get_1st_packet(sess, dir[i]));
used += snprintf(buff + used, size - used, "\"%s_1st_pkt\":\"%p\",", str[i], session_get_first_packet(sess, dir[i]));
used += snprintf(buff + used, size - used, "\"%s_raw_pkts_rx\":%" PRIu64 ",", str[i], session_get_stat(sess, dir[i], STAT_RAW_PKTS_RX));
used += snprintf(buff + used, size - used, "\"%s_raw_bytes_rx\":%" PRIu64 ",", str[i], session_get_stat(sess, dir[i], STAT_RAW_BYTES_RX));
used += snprintf(buff + used, size - used, "\"%s_raw_pkts_tx\":%" PRIu64 ",", str[i], session_get_stat(sess, dir[i], STAT_RAW_PKTS_TX));

104
src/session/session_manager.cpp
View File

@@ -227,15 +227,15 @@ static int check_options(const struct session_manager_options *opts)
static void tcp_clean(struct session_manager *mgr, struct session *sess)
{
struct tcp_reassembly *c2s_ssembler = sess->tcp_halfs[SESSION_DIRECTION_C2S].assembler;
struct tcp_reassembly *s2c_ssembler = sess->tcp_halfs[SESSION_DIRECTION_S2C].assembler;
struct tcp_reassembly *c2s_ssembler = sess->tcp_halfs[FLOW_DIRECTION_C2S].assembler;
struct tcp_reassembly *s2c_ssembler = sess->tcp_halfs[FLOW_DIRECTION_S2C].assembler;
struct tcp_segment *seg;
if (c2s_ssembler)
{
while ((seg = tcp_reassembly_expire(c2s_ssembler, UINT64_MAX)))
{
session_inc_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RELEASED, 1);
session_inc_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_RELEASED, seg->len);
session_inc_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_RELEASED, 1);
session_inc_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_RELEASED, seg->len);
mgr->stat.nr_tcp_seg_released++;
tcp_segment_free(seg);
}
@@ -245,8 +245,8 @@ static void tcp_clean(struct session_manager *mgr, struct session *sess)
{
while ((seg = tcp_reassembly_expire(s2c_ssembler, UINT64_MAX)))
{
session_inc_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RELEASED, 1);
session_inc_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_RELEASED, seg->len);
session_inc_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_RELEASED, 1);
session_inc_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_RELEASED, seg->len);
mgr->stat.nr_tcp_seg_released++;
tcp_segment_free(seg);
}
@@ -261,9 +261,9 @@ static int tcp_init(struct session_manager *mgr, struct session *sess)
return 0;
}
sess->tcp_halfs[SESSION_DIRECTION_C2S].assembler = tcp_reassembly_new(mgr->opts.tcp_reassembly_max_timeout, mgr->opts.tcp_reassembly_max_segments);
sess->tcp_halfs[SESSION_DIRECTION_S2C].assembler = tcp_reassembly_new(mgr->opts.tcp_reassembly_max_timeout, mgr->opts.tcp_reassembly_max_segments);
if (sess->tcp_halfs[SESSION_DIRECTION_C2S].assembler == NULL || sess->tcp_halfs[SESSION_DIRECTION_S2C].assembler == NULL)
sess->tcp_halfs[FLOW_DIRECTION_C2S].assembler = tcp_reassembly_new(mgr->opts.tcp_reassembly_max_timeout, mgr->opts.tcp_reassembly_max_segments);
sess->tcp_halfs[FLOW_DIRECTION_S2C].assembler = tcp_reassembly_new(mgr->opts.tcp_reassembly_max_timeout, mgr->opts.tcp_reassembly_max_segments);
if (sess->tcp_halfs[FLOW_DIRECTION_C2S].assembler == NULL || sess->tcp_halfs[FLOW_DIRECTION_S2C].assembler == NULL)
{
tcp_clean(mgr, sess);
return -1;
@@ -271,13 +271,13 @@ static int tcp_init(struct session_manager *mgr, struct session *sess)
SESSION_LOG_DEBUG("session %lu %s new c2s tcp assembler %p, s2c tcp assembler %p",
session_get_id(sess), session_get_tuple_str(sess),
sess->tcp_halfs[SESSION_DIRECTION_C2S].assembler,
sess->tcp_halfs[SESSION_DIRECTION_S2C].assembler);
sess->tcp_halfs[FLOW_DIRECTION_C2S].assembler,
sess->tcp_halfs[FLOW_DIRECTION_S2C].assembler);
return 0;
}
static void tcp_update(struct session_manager *mgr, struct session *sess, enum session_direction dir, const struct packet_layer *tcp_layer, uint64_t now)
static void tcp_update(struct session_manager *mgr, struct session *sess, enum flow_direction dir, const struct packet_layer *tcp_layer, uint64_t now)
{
struct tcp_segment *seg;
struct tcphdr *hdr = (struct tcphdr *)tcp_layer->hdr_ptr;
@@ -400,25 +400,25 @@ static void tcp_update(struct session_manager *mgr, struct session *sess, enum s
* Session Direction
******************************************************************************/
static enum session_direction identify_direction_by_port(uint16_t src_port, uint16_t dst_port)
static enum flow_direction identify_direction_by_port(uint16_t src_port, uint16_t dst_port)
{
// big port is client
if (src_port > dst_port)
{
return SESSION_DIRECTION_C2S;
return FLOW_DIRECTION_C2S;
}
else if (src_port < dst_port)
{
return SESSION_DIRECTION_S2C;
return FLOW_DIRECTION_S2C;
}
else
{
// if port is equal, first packet is C2S
return SESSION_DIRECTION_C2S;
return FLOW_DIRECTION_C2S;
}
}
static enum session_direction identify_direction_by_history(const struct session *sess, const struct tuple6 *key)
static enum flow_direction identify_direction_by_history(const struct session *sess, const struct tuple6 *key)
{
if (tuple6_cmp(session_get_tuple(sess), key) == 0)
{
@@ -426,7 +426,7 @@ static enum session_direction identify_direction_by_history(const struct session
}
else
{
return (session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S ? SESSION_DIRECTION_S2C : SESSION_DIRECTION_C2S);
return (session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S ? FLOW_DIRECTION_S2C : FLOW_DIRECTION_C2S);
}
}
@@ -471,7 +471,7 @@ static int duplicated_packet_bypass(struct session_manager *mgr, struct session
return 0;
}
enum session_direction dir = identify_direction_by_history(sess, key);
enum flow_direction dir = identify_direction_by_history(sess, key);
if (session_get_stat(sess, dir, STAT_RAW_PKTS_RX) < 3 || session_has_dup_traffic(sess))
{
if (duplicated_packet_filter_lookup(mgr->dup_pkt_filter, pkt, now))
@@ -507,7 +507,7 @@ static int duplicated_packet_bypass(struct session_manager *mgr, struct session
* Session Manager
******************************************************************************/
static void session_update(struct session *sess, enum session_state next_state, const struct packet *pkt, const struct tuple6 *key, enum session_direction dir)
static void session_update(struct session *sess, enum session_state next_state, const struct packet *pkt, const struct tuple6 *key, enum flow_direction dir)
{
struct timespec real;
clock_gettime(CLOCK_REALTIME, &real); // must be realtime
@@ -517,6 +517,32 @@ static void session_update(struct session *sess, enum session_state next_state,
session_set_id(sess, id_generator_alloc());
session_set_tuple(sess, key);
session_set_tuple_direction(sess, dir);
enum packet_direction pkt_dir = packet_get_direction(pkt);
if (dir == FLOW_DIRECTION_C2S)
{
if (pkt_dir == PACKET_DIRECTION_OUTGOING) // Internal -> External
{
session_set_direction(sess, SESSION_DIRECTION_OUTBOUND);
}
else
{
session_set_direction(sess, SESSION_DIRECTION_INBOUND);
}
}
else
{
if (pkt_dir == PACKET_DIRECTION_OUTGOING) // Internal -> External
{
session_set_direction(sess, SESSION_DIRECTION_INBOUND);
}
else
{
session_set_direction(sess, SESSION_DIRECTION_OUTBOUND);
}
}
tuple6_to_str(key, sess->tuple_str, sizeof(sess->tuple_str));
session_set_timestamp(sess, SESSION_TIMESTAMP_START, real.tv_sec);
switch (key->ip_proto)
@@ -536,20 +562,20 @@ static void session_update(struct session *sess, enum session_state next_state,
session_inc_stat(sess, dir, STAT_RAW_PKTS_RX, 1);
session_inc_stat(sess, dir, STAT_RAW_BYTES_RX, packet_get_len(pkt));
if (!session_get_1st_packet(sess, dir))
if (!session_get_first_packet(sess, dir))
{
struct route_ctx ctx = {0};
struct sid_list list = {0};
packet_get_route_ctx(pkt, &ctx);
packet_get_sid_list(pkt, &list);
session_set_1st_packet(sess, dir, pkt);
session_set_first_packet(sess, dir, pkt);
session_set_route_ctx(sess, dir, &ctx);
session_set_sid_list(sess, dir, &list);
}
session_set_current_packet(sess, pkt);
session_set_current_direction(sess, dir);
session_set_flow_direction(sess, dir);
session_set_timestamp(sess, SESSION_TIMESTAMP_LAST, real.tv_sec);
session_set_state(sess, next_state);
}
@@ -615,7 +641,7 @@ static struct session *session_manager_new_tcp_session(struct session_manager *m
session_manager_evicte_session(mgr, evic_sess, now);
}
enum session_direction dir = (flags & TH_ACK) ? SESSION_DIRECTION_S2C : SESSION_DIRECTION_C2S;
enum flow_direction dir = (flags & TH_ACK) ? FLOW_DIRECTION_S2C : FLOW_DIRECTION_C2S;
struct session *sess = session_pool_pop(mgr->sess_pool);
if (sess == NULL)
{
@@ -671,7 +697,7 @@ static struct session *session_manager_new_udp_session(struct session_manager *m
session_init(sess);
sess->mgr_stat = &mgr->stat;
enum session_direction dir = identify_direction_by_port(ntohs(key->src_port), ntohs(key->dst_port));
enum flow_direction dir = identify_direction_by_port(ntohs(key->src_port), ntohs(key->dst_port));
enum session_state next_state = session_transition_run(SESSION_STATE_INIT, UDP_DATA);
session_update(sess, next_state, pkt, key, dir);
session_transition_log(sess, SESSION_STATE_INIT, next_state, UDP_DATA);
@@ -690,7 +716,7 @@ static int session_manager_update_tcp_session(struct session_manager *mgr, struc
{
const struct packet_layer *tcp_layer = packet_get_innermost_layer(pkt, LAYER_TYPE_TCP);
const struct tcphdr *hdr = (const struct tcphdr *)tcp_layer->hdr_ptr;
enum session_direction dir = identify_direction_by_history(sess, key);
enum flow_direction dir = identify_direction_by_history(sess, key);
uint8_t flags = tcp_hdr_get_flags(hdr);
int inputs = 0;
inputs |= (flags & TH_SYN) ? TCP_SYN : NONE;
@@ -714,17 +740,17 @@ static int session_manager_update_tcp_session(struct session_manager *mgr, struc
{
if (flags & TH_FIN)
{
session_set_closing_reason(sess, (dir == SESSION_DIRECTION_C2S ? CLOSING_BY_CLIENT_FIN : CLOSING_BY_SERVER_FIN));
session_set_closing_reason(sess, (dir == FLOW_DIRECTION_C2S ? CLOSING_BY_CLIENT_FIN : CLOSING_BY_SERVER_FIN));
}
if (flags & TH_RST)
{
session_set_closing_reason(sess, (dir == SESSION_DIRECTION_C2S ? CLOSING_BY_CLIENT_RST : CLOSING_BY_SERVER_RST));
session_set_closing_reason(sess, (dir == FLOW_DIRECTION_C2S ? CLOSING_BY_CLIENT_RST : CLOSING_BY_SERVER_RST));
}
}
// update timeout
struct tcp_half *curr = &sess->tcp_halfs[dir];
struct tcp_half *peer = &sess->tcp_halfs[(dir == SESSION_DIRECTION_C2S ? SESSION_DIRECTION_S2C : SESSION_DIRECTION_C2S)];
struct tcp_half *peer = &sess->tcp_halfs[(dir == FLOW_DIRECTION_C2S ? FLOW_DIRECTION_S2C : FLOW_DIRECTION_C2S)];
uint64_t timeout = 0;
switch (next_state)
{
@@ -773,7 +799,7 @@ static int session_manager_update_tcp_session(struct session_manager *mgr, struc
static int session_manager_update_udp_session(struct session_manager *mgr, struct session *sess, const struct packet *pkt, const struct tuple6 *key, uint64_t now)
{
enum session_direction dir = identify_direction_by_history(sess, key);
enum flow_direction dir = identify_direction_by_history(sess, key);
enum session_state curr_state = session_get_state(sess);
enum session_state next_state = session_transition_run(curr_state, UDP_DATA);
session_update(sess, next_state, pkt, key, dir);
@@ -951,16 +977,16 @@ void session_manager_free_session(struct session_manager *mgr, struct session *s
}
session_free_all_ex_data(sess);
packet_free((struct packet *)session_get_1st_packet(sess, SESSION_DIRECTION_C2S));
packet_free((struct packet *)session_get_1st_packet(sess, SESSION_DIRECTION_S2C));
session_set_1st_packet(sess, SESSION_DIRECTION_C2S, NULL);
session_set_1st_packet(sess, SESSION_DIRECTION_S2C, NULL);
session_clear_route_ctx(sess, SESSION_DIRECTION_C2S);
session_clear_route_ctx(sess, SESSION_DIRECTION_S2C);
session_clear_sid_list(sess, SESSION_DIRECTION_C2S);
session_clear_sid_list(sess, SESSION_DIRECTION_S2C);
packet_free((struct packet *)session_get_first_packet(sess, FLOW_DIRECTION_C2S));
packet_free((struct packet *)session_get_first_packet(sess, FLOW_DIRECTION_S2C));
session_set_first_packet(sess, FLOW_DIRECTION_C2S, NULL);
session_set_first_packet(sess, FLOW_DIRECTION_S2C, NULL);
session_clear_route_ctx(sess, FLOW_DIRECTION_C2S);
session_clear_route_ctx(sess, FLOW_DIRECTION_S2C);
session_clear_sid_list(sess, FLOW_DIRECTION_C2S);
session_clear_sid_list(sess, FLOW_DIRECTION_S2C);
session_set_current_packet(sess, NULL);
session_set_current_direction(sess, SESSION_DIRECTION_NONE);
session_set_flow_direction(sess, FLOW_DIRECTION_NONE);
session_pool_push(mgr->sess_pool, sess);
sess = NULL;
}

50
src/session/session_priv.h
View File

@@ -43,9 +43,9 @@ struct tcp_half
struct session
{
uint64_t id;
uint64_t stats[MAX_DIRECTION][MAX_STAT];
uint64_t stats[MAX_FLOW_DIRECTION][MAX_STAT];
uint64_t timestamps[MAX_TIMESTAMP];
struct tcp_half tcp_halfs[MAX_DIRECTION];
struct tcp_half tcp_halfs[MAX_FLOW_DIRECTION];
struct timeout timeout;
struct list_head lru;
struct list_head free;
@@ -55,16 +55,17 @@ struct session
UT_hash_handle hh3;
struct tuple6 tuple;
char tuple_str[TUPLE6_STR_SIZE];
struct sid_list sids[MAX_DIRECTION];
struct route_ctx route_ctx[MAX_DIRECTION];
const struct packet *first_pkt[MAX_DIRECTION];
struct sid_list sids[MAX_FLOW_DIRECTION];
struct route_ctx route_ctx[MAX_FLOW_DIRECTION];
const struct packet *first_pkt[MAX_FLOW_DIRECTION];
const struct packet *curr_pkt;
void *ex_data[EX_DATA_MAX_COUNT];
void *user_data;
int is_symmetric;
int dup;
enum session_direction tuple_dir;
enum session_direction cur_dir;
enum session_direction sess_dir;
enum flow_direction tuple_dir;
enum flow_direction flow_dir;
enum session_type type;
enum session_state state;
enum closing_reason reason;
@@ -73,28 +74,37 @@ struct session
void session_init(struct session *sess);
void session_set_id(struct session *sess, uint64_t id);
void session_set_tuple(struct session *sess, const struct tuple6 *key);
const struct tuple6 *session_get_tuple(const struct session *sess);
void session_set_tuple_direction(struct session *sess, enum session_direction dir);
enum session_direction session_get_tuple_direction(const struct session *sess);
void session_set_current_direction(struct session *sess, enum session_direction dir);
void session_set_tuple_direction(struct session *sess, enum flow_direction dir);
enum flow_direction session_get_tuple_direction(const struct session *sess);
void session_set_direction(struct session *sess, enum session_direction dir);
void session_set_flow_direction(struct session *sess, enum flow_direction dir);
void session_set_state(struct session *sess, enum session_state state);
void session_set_type(struct session *sess, enum session_type type);
void session_set_dup_traffic(struct session *sess);
void session_set_closing_reason(struct session *sess, enum closing_reason reason);
void session_inc_stat(struct session *sess, enum session_direction dir, enum session_stat stat, uint64_t val);
void session_inc_stat(struct session *sess, enum flow_direction dir, enum session_stat stat, uint64_t val);
void session_set_timestamp(struct session *sess, enum session_timestamp type, uint64_t value);
void session_clear_sid_list(struct session *sess, enum session_direction dir);
void session_set_sid_list(struct session *sess, enum session_direction dir, const struct sid_list *list);
void session_get_sid_list(const struct session *sess, enum session_direction dir, struct sid_list *list);
void session_clear_route_ctx(struct session *sess, enum session_direction dir);
void session_set_route_ctx(struct session *sess, enum session_direction dir, const struct route_ctx *ctx);
void session_get_route_ctx(const struct session *sess, enum session_direction dir, struct route_ctx *ctx);
void session_set_1st_packet(struct session *sess, enum session_direction dir, const struct packet *pkt);
void session_clear_sid_list(struct session *sess, enum flow_direction dir);
void session_set_sid_list(struct session *sess, enum flow_direction dir, const struct sid_list *list);
void session_get_sid_list(const struct session *sess, enum flow_direction dir, struct sid_list *list);
void session_clear_route_ctx(struct session *sess, enum flow_direction dir);
void session_set_route_ctx(struct session *sess, enum flow_direction dir, const struct route_ctx *ctx);
void session_get_route_ctx(const struct session *sess, enum flow_direction dir, struct route_ctx *ctx);
void session_set_first_packet(struct session *sess, enum flow_direction dir, const struct packet *pkt);
void session_set_current_packet(struct session *sess, const struct packet *pkt);
const struct packet *session_get_current_packet(const struct session *sess);
void session_set_user_data(struct session *sess, void *user_data);
void *session_get_user_data(const struct session *sess);
struct tcp_segment *session_get_tcp_segment(struct session *sess);
void session_free_tcp_segment(struct session *sess, struct tcp_segment *seg);
@@ -133,6 +143,10 @@ void session_free_all_ex_data(struct session *sess);
* debug
******************************************************************************/
const char *session_type_to_str(enum session_type type);
const char *session_state_to_str(enum session_state state);
const char *flow_direction_to_str(enum flow_direction dir);
const char *closing_reason_to_str(enum closing_reason reason);
void session_print(struct session *sess);
int session_to_json(struct session *sess, char *buff, int size);

88
src/session/test/gtest_case_tcp_fast_open.cpp
View File

@@ -319,60 +319,60 @@ TEST(CASE, TCP_FAST_OPEN)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "2400:ac40:620:a4d8:484f:d2b0:d539:bd4c:51682 -> 2001:4860:4860::8844:853, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 280);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 280);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
// TCP Segment
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_RX) == 166);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_EXPIRED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_EXPIRED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RETRANSMIT) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_RETRANSMIT) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_OVERLAP) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_OVERLAP) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_NOSPACE) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_NOSPACE) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_INORDER) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_INORDER) == 166);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_REORDERED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_REORDERED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_BUFFERED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_BUFFERED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RELEASED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_RELEASED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_RX) == 166);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_EXPIRED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_EXPIRED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_RETRANSMIT) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_RETRANSMIT) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_OVERLAP) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_OVERLAP) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_NOSPACE) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_NOSPACE) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_INORDER) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_INORDER) == 166);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_REORDERED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_REORDERED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_BUFFERED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_BUFFERED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_RELEASED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_RELEASED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_EXPIRED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_EXPIRED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RETRANSMIT) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_RETRANSMIT) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_OVERLAP) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_OVERLAP) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_NOSPACE) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_NOSPACE) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_INORDER) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_INORDER) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_REORDERED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_REORDERED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_BUFFERED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_BUFFERED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RELEASED) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_RELEASED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_EXPIRED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_EXPIRED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_RETRANSMIT) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_RETRANSMIT) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_OVERLAP) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_OVERLAP) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_NOSPACE) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_NOSPACE) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_INORDER) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_INORDER) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_REORDERED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_REORDERED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_BUFFERED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_BUFFERED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_RELEASED) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_RELEASED) == 0);
session_print(sess);

80
src/session/test/gtest_state_tcp_active_to_closing.cpp
View File

@@ -117,21 +117,21 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_FIN_FIN)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat
@@ -203,21 +203,21 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_C2S_RST)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_RST);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
session_print(sess);
// check stat
@@ -289,21 +289,21 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_S2C_RST)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_SERVER_RST);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat
@@ -415,21 +415,21 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_C2S_HALF_CLOSED_TIMEOUT)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
session_print(sess);
// check stat
@@ -494,21 +494,21 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_S2C_HALF_CLOSED_TIMEOUT)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_SERVER_FIN);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat

128
src/session/test/gtest_state_tcp_init_to_opening.cpp
View File

@@ -76,21 +76,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
session_print(sess);
// check stat
@@ -153,21 +153,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYNACK)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) == NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) == NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat
@@ -241,21 +241,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN_SYNACK)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat
@@ -340,21 +340,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN_SYNACK_ACK)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat
@@ -435,21 +435,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN_RETRANSMISSION)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 78);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 78);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
session_print(sess);
// check stat
@@ -531,21 +531,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYNACK_RETRANSMISSION)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) == NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) == NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat
@@ -619,21 +619,21 @@ TEST(TCP_INIT_TO_OPENING, BY_C2S_ASMMETRIC)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
session_print(sess);
// check stat
@@ -707,21 +707,21 @@ TEST(TCP_INIT_TO_OPENING, BY_S2C_ASMMETRIC)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) == NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) == NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat

176
src/session/test/gtest_state_tcp_init_to_opening_to_active_to_closing_to_closed.cpp
View File

@@ -72,21 +72,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
// S2C SYNACK Packet
printf("\n=> Packet Parse: TCP S2C SYNACK packet\n");
@@ -103,21 +103,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
// C2S ACK Packet
printf("\n=> Packet Parse: TCP C2S ACK packet\n");
@@ -134,21 +134,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
// C2S REQ Packet
printf("\n=> Packet Parse: TCP C2S REQ packet\n");
@@ -165,21 +165,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
// S2C ACK Packet
printf("\n=> Packet Parse: TCP S2C ACK packet\n");
@@ -196,21 +196,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
// S2C HTTP Resp Packet1
printf("\n=> Packet Parse: TCP S2C Resp packet1\n");
@@ -227,21 +227,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
// S2C HTTP Resp Packet2
printf("\n=> Packet Parse: TCP S2C Resp packet2\n");
@@ -258,21 +258,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
// C2S ACK Packet
printf("\n=> Packet Parse: TCP C2S ACK packet\n");
@@ -289,21 +289,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
// C2S FIN Packet
printf("\n=> Packet Parse: TCP C2S FIN packet\n");
@@ -320,21 +320,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
// S2C FIN Packet
printf("\n=> Packet Parse: TCP S2C FIN packet\n");
@@ -351,21 +351,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
// C2S ACK Packet
printf("\n=> Packet Parse: TCP C2S ACK packet\n");
@@ -382,21 +382,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
memset(buffer, 0, sizeof(buffer));
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
// check stat
stat = session_manager_stat(mgr);

32
src/session/test/gtest_state_tcp_opening_to_active.cpp
View File

@@ -86,21 +86,21 @@ TEST(TCP_OPENING_TO_ACTIVE, BY_SYN_C2S_DATA)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
session_print(sess);
// check stat
@@ -174,21 +174,21 @@ TEST(TCP_OPENING_TO_ACTIVE, BY_SYNACK_S2C_DATA)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 1354);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 1354);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) == NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) == NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat

112
src/session/test/gtest_state_tcp_opening_to_closing.cpp
View File

@@ -98,21 +98,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_FIN_FIN)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat
@@ -192,21 +192,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_C2S_RST)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_RST);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
session_print(sess);
// check stat
@@ -286,21 +286,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_S2C_RST)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_SERVER_RST);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat
@@ -429,21 +429,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_HANDSHAKE_TIMEOUT)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat
@@ -528,21 +528,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_DATA_TIMEOUT)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat
@@ -616,21 +616,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_C2S_HALF_FIN)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
session_print(sess);
// check stat
@@ -703,21 +703,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_S2C_HALF_FIN)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_SERVER_FIN);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat

32
src/session/test/gtest_state_udp_init_to_opening_to_active_to_closing.cpp
View File

@@ -71,21 +71,21 @@ TEST(UDP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING, TEST)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:61099 -> 121.14.154.93:53, proto: 17, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
// S2C RESP Packet
printf("\n=> Packet Parse: UDP S2C RESP packet\n");
@@ -101,21 +101,21 @@ TEST(UDP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING, TEST)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:61099 -> 121.14.154.93:53, proto: 17, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 550);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 550);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat

32
src/session/test/gtest_state_udp_init_to_opening_to_closing.cpp
View File

@@ -76,21 +76,21 @@ TEST(UDP_INIT_TO_OPENING_TO_CLOSING, BY_C2S)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "192.168.38.105:61099 -> 121.14.154.93:53, proto: 17, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
session_print(sess);
// check stat
@@ -154,21 +154,21 @@ TEST(UDP_INIT_TO_OPENING_TO_CLOSING, BY_S2C)
EXPECT_TRUE(session_get_id(sess) != 0);
tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
EXPECT_STREQ(buffer, "121.14.154.93:53 -> 192.168.38.105:61099, proto: 17, domain: 0");
EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
EXPECT_TRUE(session_get_closing_reason(sess) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 550);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 550);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) == NULL);
EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) == NULL);
EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
session_print(sess);
// check stat

64
src/stellar/inject.cpp
View File

@@ -155,7 +155,7 @@ static void update_ip6_hdr(struct ip6_hdr *ip6hdr, int trim)
ipv6_hdr_set_payload_len(ip6hdr, len - trim);
}
static inline void calc_tcp_seq_and_ack(const struct session *sess, enum session_direction inj_dir, uint32_t *seq, uint32_t *ack)
static inline void calc_tcp_seq_and_ack(const struct session *sess, enum flow_direction inject_dir, uint32_t *seq, uint32_t *ack)
{
/*
* +--------+ current packet +---------+ C2S RST +--------+
@@ -175,9 +175,9 @@ static inline void calc_tcp_seq_and_ack(const struct session *sess, enum session
* ack = current_packet_seq + current_packet_payload_len
*/
enum session_direction curr_dir = session_get_current_direction(sess);
enum flow_direction curr_dir = session_get_flow_direction(sess);
const struct tcp_half *tcp_curr_half = &sess->tcp_halfs[curr_dir];
if (inj_dir == curr_dir)
if (inject_dir == curr_dir)
{
*seq = tcp_curr_half->seq;
*ack = tcp_curr_half->ack;
@@ -213,7 +213,7 @@ struct fingerprint
};
// return packet length
int build_tcp_packet(const struct packet *first, const struct fingerprint *finger,
static int build_tcp_packet(const struct packet *first, const struct fingerprint *finger,
uint32_t tcp_seq, uint32_t tcp_ack, uint8_t tcp_flags, char *tcp_pld, int pld_len, char *pkt_buff, int buff_size)
{
int trim = 0;
@@ -224,7 +224,7 @@ int build_tcp_packet(const struct packet *first, const struct fingerprint *finge
struct packet_layer *curr;
struct packet_layer *last;
int len = packet_get_len(first);
int8_t layers = packet_get_layers(first);
int8_t layers = packet_get_layers_number(first);
if ((tcp_pld == NULL && pld_len > 0) || (tcp_pld != NULL && pld_len <= 0))
{
@@ -302,50 +302,44 @@ int build_tcp_packet(const struct packet *first, const struct fingerprint *finge
}
// return 0: success, -1: failed
int stellar_inject_icmp_unreach(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx)
int stellar_inject_tcp_flags(const struct session *sess, enum flow_direction inject_dir, uint8_t flags)
{
// TODO
return -1;
}
uint16_t thr_idx = stellar_get_current_thread_index();
int stellar_inject_tcp_rst(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx)
{
if (session_get_type(sess) != SESSION_TYPE_TCP)
{
session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_PKTS_FAIL, 1);
INJECT_PACKET_LOG_ERROR("session %ld is not a TCP session, cannot inject TCP RST", session_get_id(sess));
return -1;
}
const struct packet *pkt = session_get_1st_packet(sess, inj_dir);
const struct packet *pkt = session_get_first_packet(sess, inject_dir);
if (pkt == NULL)
{
session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
INJECT_PACKET_LOG_ERROR("session %ld has no %s first packet, cannot inject TCP RST", session_get_id(sess), session_direction_to_str(inj_dir));
session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_PKTS_FAIL, 1);
INJECT_PACKET_LOG_ERROR("session %ld has no %s first packet, cannot inject TCP RST", session_get_id(sess), flow_direction_to_str(inject_dir));
return -1;
}
struct fingerprint finger = {0};
uint32_t tcp_seq = 0;
uint32_t tcp_ack = 0;
uint8_t tcp_flags = TH_RST | TH_ACK;
char buff[4096] = {0};
calc_tcp_seq_and_ack(sess, inj_dir, &tcp_seq, &tcp_ack);
calc_tcp_seq_and_ack(sess, inject_dir, &tcp_seq, &tcp_ack);
calc_ipid_ttl_win(&finger.ipid, &finger.ttl, &finger.win);
int len = build_tcp_packet(pkt, &finger, tcp_seq, tcp_ack, tcp_flags, NULL, 0, buff, sizeof(buff));
int len = build_tcp_packet(pkt, &finger, tcp_seq, tcp_ack, flags, NULL, 0, buff, sizeof(buff));
if (len <= 0)
{
INJECT_PACKET_LOG_ERROR("session %ld build TCP %s RST packet failed, %s", session_get_id(sess), session_direction_to_str(inj_dir), strerror(len));
session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
INJECT_PACKET_LOG_ERROR("session %ld build TCP %s RST packet failed, %s", session_get_id(sess), flow_direction_to_str(inject_dir), strerror(len));
session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_PKTS_FAIL, 1);
return -1;
}
struct inject_packet_meta meta = {0};
meta.session_id = session_get_id(sess);
session_get_route_ctx(sess, inj_dir, &meta.route);
session_get_sid_list(sess, inj_dir, &meta.sids);
session_get_route_ctx(sess, inject_dir, &meta.route);
session_get_sid_list(sess, inject_dir, &meta.sids);
struct packet inj_pkt;
packet_parse(&inj_pkt, buff, len);
@@ -353,37 +347,25 @@ int stellar_inject_tcp_rst(const struct session *sess, enum session_direction in
packet_set_origin_ctx(&inj_pkt, &meta);
if (packet_io_inject(runtime->packet_io, thr_idx, &inj_pkt, 1) == 1)
{
session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_SUSS, 1);
session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_BYTES_SUSS, len);
session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_PKTS_SUSS, 1);
session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_BYTES_SUSS, len);
return 0;
}
else
{
INJECT_PACKET_LOG_ERROR("session %ld inject TCP %s RST packet failed, packet I/O nospace", session_get_id(sess), session_direction_to_str(inj_dir));
session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
INJECT_PACKET_LOG_ERROR("session %ld inject TCP %s RST packet failed, packet I/O nospace", session_get_id(sess), flow_direction_to_str(inject_dir));
session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_PKTS_FAIL, 1);
return -1;
}
}
int stellar_inject_tcp_payload(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx, const char *payload, uint16_t len)
int stellar_inject_payload(const struct session *sess, enum flow_direction inject_dir, const char *payload, uint16_t len)
{
// TODO
return -1;
}
int stellar_inject_udp_payload(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx, const char *payload, uint16_t len)
{
// TODO
return -1;
}
int stellar_inject_ctrl_msg(const struct session *sess, uint16_t *sids, int nr_sid, uint16_t thr_idx, const char *msg, uint16_t len)
{
// TODO
return -1;
}
int stellar_inject_stateless_pkt(uint16_t link_id, uint16_t thr_idx, const char *packet, uint16_t len)
int stellar_inject_ctrl_msg(const struct session *sess, const struct sid_list *sids, const char *msg, uint16_t len)
{
// TODO
return -1;

23
src/stellar/stellar.cpp
View File

@@ -1,4 +1,5 @@
#include <errno.h>
#include <assert.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/prctl.h>
@@ -19,23 +20,27 @@ static void update_session_stat(struct session *sess, struct packet *pkt)
{
enum session_stat stat_pkt;
enum session_stat stat_byte;
enum session_direction dir = session_get_current_direction(sess);
enum flow_direction dir = session_get_flow_direction(sess);
int is_ctrl = packet_is_ctrl(pkt);
if (packet_need_drop(pkt))
switch (packet_get_action(pkt))
{
case PACKET_ACTION_DROP:
stat_pkt = is_ctrl ? STAT_CTRL_PKTS_DROP : STAT_RAW_PKTS_DROP;
stat_byte = is_ctrl ? STAT_CTRL_BYTES_DROP : STAT_RAW_BYTES_DROP;
}
else
{
break;
case PACKET_ACTION_FORWARD:
break;
stat_pkt = is_ctrl ? STAT_CTRL_PKTS_TX : STAT_RAW_PKTS_TX;
stat_byte = is_ctrl ? STAT_CTRL_BYTES_TX : STAT_RAW_BYTES_TX;
default:
assert(0);
break;
}
session_inc_stat(sess, dir, stat_pkt, 1);
session_inc_stat(sess, dir, stat_byte, packet_get_len(pkt));
session_set_current_packet(sess, NULL);
session_set_current_direction(sess, SESSION_DIRECTION_NONE);
session_set_flow_direction(sess, FLOW_DIRECTION_NONE);
}
}
@@ -167,11 +172,15 @@ static void *work_thread(void *arg)
goto fast_path;
}
}
if (packet_get_session_id(pkt) == 0)
{
packet_set_session_id(pkt, session_get_id(sess));
}
plugin_manager_dispatch_session(plug_mgr, sess, pkt);
fast_path:
update_session_stat(sess, pkt);
if (packet_need_drop(pkt))
if (packet_get_action(pkt) == PACKET_ACTION_DROP)
{
if (pkt == defraged_pkt)
{

35
src/stellar/test/gtest_inject_packet.cpp
View File

@@ -5,6 +5,7 @@
#include <string.h>
#include <signal.h>
#include <stdlib.h>
#include <netinet/tcp.h>
#include "config.h"
#include "timestamp.h"
@@ -15,7 +16,7 @@
#define GMOCK_PLUGIN_MANAGER_LOG_ERROR(format, ...) LOG_ERROR("gmock plugin manager", format, ##__VA_ARGS__)
#define GMOCK_PLUGIN_MANAGER_LOG_DEBUG(format, ...) LOG_DEBUG("gomck plugin manager", format, ##__VA_ARGS__)
static void inject_tcp_rst_condtion(struct session *sess, uint16_t thr_idx)
static void inject_tcp_rst(struct session *sess)
{
uint64_t session_num = sess->mgr_stat->total_nr_tcp_sess_used;
@@ -23,46 +24,46 @@ static void inject_tcp_rst_condtion(struct session *sess, uint16_t thr_idx)
{
case 1:
// recv SYN packet
if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0)
if (session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 && session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0)
{
EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == -1);
EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_C2S, TH_RST | TH_ACK) == 0);
EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_S2C, TH_RST | TH_ACK) == -1);
GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv SYN packet", session_get_id(sess), session_get_tuple_str(sess));
}
break;
case 2:
// recv SYN-ACK packet
if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1)
if (session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 && session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1)
{
EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_C2S, TH_RST | TH_ACK) == 0);
EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_S2C, TH_RST | TH_ACK) == 0);
GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv SYN-ACK packet", session_get_id(sess), session_get_tuple_str(sess));
}
break;
case 3:
// recv sub-ACK packet
if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 2 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1)
if (session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 2 && session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1)
{
EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_C2S, TH_RST | TH_ACK) == 0);
EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_S2C, TH_RST | TH_ACK) == 0);
GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv sub-ACK packet", session_get_id(sess), session_get_tuple_str(sess));
}
break;
case 4:
// recv C2S Payload
if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_INJ_PKTS_SUSS) == 0 && session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RX) == 1)
if (session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_INJ_PKTS_SUSS) == 0 && session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_RX) == 1)
{
EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_C2S, TH_RST | TH_ACK) == 0);
EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_S2C, TH_RST | TH_ACK) == 0);
GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv C2S first payload packet", session_get_id(sess), session_get_tuple_str(sess));
}
break;
case 5:
// recv S2C Payload
if (session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_INJ_PKTS_SUSS) == 0 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RX) == 1)
if (session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_INJ_PKTS_SUSS) == 0 && session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_RX) == 1)
{
EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_C2S, TH_RST | TH_ACK) == 0);
EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_S2C, TH_RST | TH_ACK) == 0);
GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv S2C first payload packet", session_get_id(sess), session_get_tuple_str(sess));
}
break;
@@ -123,7 +124,7 @@ void plugin_manager_dispatch_session(struct plugin_manager *mgr, struct session
{
session_free_tcp_segment(sess, seg);
}
inject_tcp_rst_condtion(sess, thr_idx);
inject_tcp_rst(sess);
break;
case SESSION_TYPE_UDP:
break;