195 static int get_ts(struct tcphdr * this_tcphdr, unsigned int * ts)  in get_ts()  argument
197   int len = 4 * this_tcphdr->th_off;  in get_ts()
199   unsigned char * options = (unsigned char*)(this_tcphdr + 1);  in get_ts()
222 static int get_wscale(struct tcphdr * this_tcphdr, unsigned int * ws)  in get_wscale()  argument
224   int len = 4 * this_tcphdr->th_off;  in get_wscale()
226   unsigned char * options = (unsigned char*)(this_tcphdr + 1);  in get_wscale()
256 add_new_tcp(struct tcphdr * this_tcphdr, struct ip * this_iphdr)  in add_new_tcp()  argument
263   addr.source = ntohs(this_tcphdr->th_sport);  in add_new_tcp()
264   addr.dest = ntohs(this_tcphdr->th_dport);  in add_new_tcp()
277       nids_params.syslog(NIDS_WARN_TCP, NIDS_WARN_TCP_TOOMUCH, ugly_iphdr, this_tcphdr);  in add_new_tcp()
292   a_tcp->client.seq = ntohl(this_tcphdr->th_seq) + 1;  in add_new_tcp()
294   a_tcp->client.window = ntohs(this_tcphdr->th_win);  in add_new_tcp()
295   a_tcp->client.ts_on = get_ts(this_tcphdr, &a_tcp->client.curr_ts);  in add_new_tcp()
296   a_tcp->client.wscale_on = get_wscale(this_tcphdr, &a_tcp->client.wscale);  in add_new_tcp()
493 tcp_queue(struct tcp_stream * a_tcp, struct tcphdr * this_tcphdr,  in tcp_queue()  argument
498   u_int this_seq = ntohl(this_tcphdr->th_seq);  in tcp_queue()
506     if (after(this_seq + datalen + (this_tcphdr->th_flags & TH_FIN), EXP_SEQ)) {  in tcp_queue()
508       get_ts(this_tcphdr, &snd->curr_ts);  in tcp_queue()
510 		   (this_tcphdr->th_flags & TH_FIN),  in tcp_queue()
511 		   (this_tcphdr->th_flags & TH_URG),  in tcp_queue()
512 		   ntohs(this_tcphdr->th_urp) + this_seq - 1);  in tcp_queue()
555     pakiet->fin = (this_tcphdr->th_flags & TH_FIN);  in tcp_queue()
570     pakiet->urg = (this_tcphdr->th_flags & TH_URG);  in tcp_queue()
571     pakiet->urg_ptr = ntohs(this_tcphdr->th_urp);  in tcp_queue()
599 prune_queue(struct half_stream * rcv, struct tcphdr * this_tcphdr)  in prune_queue()  argument
603   nids_params.syslog(NIDS_WARN_TCP, NIDS_WARN_TCP_BIGQUEUE, ugly_iphdr, this_tcphdr);  in prune_queue()
636 find_stream(struct tcphdr * this_tcphdr, struct ip * this_iphdr,  in find_stream()  argument
642   this_addr.source = ntohs(this_tcphdr->th_sport);  in find_stream()
643   this_addr.dest = ntohs(this_tcphdr->th_dport);  in find_stream()
651   reversed.source = ntohs(this_tcphdr->th_dport);  in find_stream()
652   reversed.dest = ntohs(this_tcphdr->th_sport);  in find_stream()
711   struct tcphdr *this_tcphdr = (struct tcphdr *)(data + 4 * this_iphdr->ip_hl);  in process_tcp()  local
722 		       this_tcphdr);  in process_tcp()
726   datalen = iplen - 4 * this_iphdr->ip_hl - 4 * this_tcphdr->th_off;  in process_tcp()
730 		       this_tcphdr);  in process_tcp()
736 		       this_tcphdr);  in process_tcp()
739   if (!(this_tcphdr->th_flags & TH_ACK))  in process_tcp()
742   if (my_tcp_check(this_tcphdr, iplen - 4 * this_iphdr->ip_hl,  in process_tcp()
745 		       this_tcphdr);  in process_tcp()
749   check_flags(this_iphdr, this_tcphdr);  in process_tcp()
752   if (!(a_tcp = find_stream(this_tcphdr, this_iphdr, &from_client))) {  in process_tcp()
753     if ((this_tcphdr->th_flags & TH_SYN) &&  in process_tcp()
754 	!(this_tcphdr->th_flags & TH_ACK) &&  in process_tcp()
755 	!(this_tcphdr->th_flags & TH_RST))  in process_tcp()
756       add_new_tcp(this_tcphdr, this_iphdr);  in process_tcp()
767   if ((this_tcphdr->th_flags & TH_SYN)) {  in process_tcp()
769       a_tcp->server.state != TCP_CLOSE || !(this_tcphdr->th_flags & TH_ACK))  in process_tcp()
771     if (a_tcp->client.seq != ntohl(this_tcphdr->th_ack))  in process_tcp()
774     a_tcp->server.seq = ntohl(this_tcphdr->th_seq) + 1;  in process_tcp()
776     a_tcp->server.ack_seq = ntohl(this_tcphdr->th_ack);  in process_tcp()
777     a_tcp->server.window = ntohs(this_tcphdr->th_win);  in process_tcp()
779     	a_tcp->server.ts_on = get_ts(this_tcphdr, &a_tcp->server.curr_ts);  in process_tcp()
784     	a_tcp->server.wscale_on = get_wscale(this_tcphdr, &a_tcp->server.wscale);  in process_tcp()
797   	! (  !datalen && ntohl(this_tcphdr->th_seq) == rcv->ack_seq  )  in process_tcp()
799   	( !before(ntohl(this_tcphdr->th_seq), rcv->ack_seq + rcv->window*rcv->wscale) ||  in process_tcp()
800           before(ntohl(this_tcphdr->th_seq) + datalen, rcv->ack_seq)    in process_tcp()
805   if ((this_tcphdr->th_flags & TH_RST)) {  in process_tcp()
818   if (rcv->ts_on && get_ts(this_tcphdr, &tmp_ts) &&   in process_tcp()
822   if ((this_tcphdr->th_flags & TH_ACK)) {  in process_tcp()
825       if (ntohl(this_tcphdr->th_ack) == a_tcp->server.seq) {  in process_tcp()
827 	a_tcp->client.ack_seq = ntohl(this_tcphdr->th_ack);  in process_tcp()
880   if ((this_tcphdr->th_flags & TH_ACK)) {  in process_tcp()
881     handle_ack(snd, ntohl(this_tcphdr->th_ack));  in process_tcp()
894   if (datalen + (this_tcphdr->th_flags & TH_FIN) > 0)  in process_tcp()
895     tcp_queue(a_tcp, this_tcphdr, snd, rcv,  in process_tcp()
896 	      (char *) (this_tcphdr) + 4 * this_tcphdr->th_off,  in process_tcp()
898   snd->window = ntohs(this_tcphdr->th_win);  in process_tcp()
900     prune_queue(rcv, this_tcphdr);  in process_tcp()