TCP reassembly - support closing connection with FIN + RST on one side (

#1496)
seladb · Sep 25, 2024 · c0e4de6 · c0e4de6
1 parent bd7884b
commit c0e4de6
Show file tree

Hide file tree

Showing 5 changed files with 27 additions and 0 deletions.
diff --git a/Packet++/src/TcpReassembly.cpp b/Packet++/src/TcpReassembly.cpp
@@ -232,8 +232,15 @@ namespace pcpp
 		// if this side already got FIN or RST packet before, ignore this packet as this side is considered closed
 		if (tcpReassemblyData->twoSides[sideIndex].gotFinOrRst)
 		{
+			if (!tcpReassemblyData->twoSides[1 - sideIndex].gotFinOrRst && isRst)
+			{
+				handleFinOrRst(tcpReassemblyData, 1 - sideIndex, flowKey, isRst);
+				return FIN_RSTWithNoData;
+			}
+
 			PCPP_LOG_DEBUG("Got a packet after FIN or RST were already seen on this side ("
 			               << static_cast<int>(sideIndex) << "). Ignoring this packet");
+
 			return Ignore_PacketOfClosedFlow;
 		}
 

diff --git a/Tests/Pcap++Test/PcapExamples/one_tcp_stream_fin_rst_close_packet.pcap b/Tests/Pcap++Test/PcapExamples/one_tcp_stream_fin_rst_close_packet.pcap
diff --git a/Tests/Pcap++Test/TestDefinition.h b/Tests/Pcap++Test/TestDefinition.h
@@ -78,6 +78,7 @@ PTF_TEST_CASE(TestTcpReassemblyMaxOOOFrags);
 PTF_TEST_CASE(TestTcpReassemblyMaxSeq);
 PTF_TEST_CASE(TestTcpReassemblyDisableOOOCleanup);
 PTF_TEST_CASE(TestTcpReassemblyTimeStamps);
+PTF_TEST_CASE(TestTcpReassemblyFinReset);
 
 // Implemented in IPFragmentationTests.cpp
 PTF_TEST_CASE(TestIPFragmentationSanity);

diff --git a/Tests/Pcap++Test/Tests/TcpReassemblyTests.cpp b/Tests/Pcap++Test/Tests/TcpReassemblyTests.cpp
@@ -1263,3 +1263,21 @@ PTF_TEST_CASE(TestTcpReassemblyTimeStamps)
 	packetStream.clear();
 	tcpReassemblyResults.clear();
 }  // TestTcpReassemblyTimeStamps
+
+PTF_TEST_CASE(TestTcpReassemblyFinReset)
+{
+	std::string errMsg;
+
+	std::vector<pcpp::RawPacket> packetStream;
+	PTF_ASSERT_TRUE(
+	    readPcapIntoPacketVec("PcapExamples/one_tcp_stream_fin_rst_close_packet.pcap", packetStream, errMsg));
+
+	TcpReassemblyMultipleConnStats tcpReassemblyResults;
+	tcpReassemblyTest(packetStream, tcpReassemblyResults, true, false);
+
+	TcpReassemblyMultipleConnStats::Stats& stats = tcpReassemblyResults.stats;
+	PTF_ASSERT_EQUAL(stats.size(), 1);
+	PTF_ASSERT_TRUE(stats.begin()->second.connectionsStarted);
+	PTF_ASSERT_TRUE(stats.begin()->second.connectionsEnded);
+	PTF_ASSERT_FALSE(stats.begin()->second.connectionsEndedManually);
+}  // TestTcpReassemblyFinReset
diff --git a/Tests/Pcap++Test/main.cpp b/Tests/Pcap++Test/main.cpp
@@ -289,6 +289,7 @@ int main(int argc, char* argv[])
 	PTF_RUN_TEST(TestTcpReassemblyMaxSeq, "no_network;tcp_reassembly");
 	PTF_RUN_TEST(TestTcpReassemblyDisableOOOCleanup, "no_network;tcp_reassembly");
 	PTF_RUN_TEST(TestTcpReassemblyTimeStamps, "no_network;tcp_reassembly");
+	PTF_RUN_TEST(TestTcpReassemblyFinReset, "no_network;tcp_reassembly");
 
 	PTF_RUN_TEST(TestIPFragmentationSanity, "no_network;ip_frag");
 	PTF_RUN_TEST(TestIPFragOutOfOrder, "no_network;ip_frag");