2 * Routines for building lists of packets that are part of a "conversation"
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
35 #include "conversation.h"
38 * Hash table for conversations with no wildcards.
40 static GHashTable *conversation_hashtable_exact = NULL;
43 * Hash table for conversations with one wildcard address.
45 static GHashTable *conversation_hashtable_no_addr2 = NULL;
48 * Hash table for conversations with one wildcard port.
50 static GHashTable *conversation_hashtable_no_port2 = NULL;
53 * Hash table for conversations with one wildcard address and port.
55 static GHashTable *conversation_hashtable_no_addr2_or_port2 = NULL;
59 typedef struct conversation_key {
60 struct conversation_key *next;
69 * Linked list of conversation keys, so we can, before freeing them all,
70 * free the address data allocations associated with them.
72 static conversation_key *conversation_keys;
74 static guint32 new_index;
77 * Protocol-specific data attached to a conversation_t structure - protocol
78 * index and opaque pointer.
80 typedef struct _conv_proto_data {
86 * Creates a new conversation with known endpoints based on a conversation
87 * created with the CONVERSATION_TEMPLATE option while keeping the
88 * conversation created with the CONVERSATION_TEMPLATE option so it can still
89 * match future connections.
91 * Passing a pointer to a conversation whose options mask does not include
92 * CONVERSATION_TEMPLATE or where the conversation's protocol type (ptype)
93 * indicates a non-connnection oriented protocol will return the conversation
96 * addr2 and port2 are used in the function if their respective conversation
97 * options bits are set (NO_ADDR2 and NO_PORT2).
99 static conversation_t *
100 conversation_create_from_template(conversation_t *conversation, const address *addr2, const guint32 port2)
103 * Add a new conversation and keep the conversation template only if the
104 * CONVERSATION_TEMPLATE bit is set for a connection oriented protocol.
106 if(conversation->options & CONVERSATION_TEMPLATE &&
107 conversation->key_ptr->ptype != PT_UDP)
110 * Set up a new options mask where the conversation template bit and the
111 * bits for absence of a second address and port pair have been removed.
113 conversation_t *new_conversation_from_template;
114 guint options = conversation->options & ~(CONVERSATION_TEMPLATE | NO_ADDR2 | NO_PORT2);
117 * Are both the NO_ADDR2 and NO_PORT2 wildcards set in the options mask?
119 if(conversation->options & NO_ADDR2 &&
120 conversation->options & NO_PORT2)
123 * The conversation template was created without knowledge of both
124 * the second address as well as the second port. Create a new
125 * conversation with new 2nd address and 2nd port.
127 new_conversation_from_template =
128 conversation_new(conversation->setup_frame,
129 &conversation->key_ptr->addr1, addr2,
130 conversation->key_ptr->ptype, conversation->key_ptr->port1,
133 else if(conversation->options & NO_PORT2)
136 * The conversation template was created without knowledge of port 2
137 * only. Create a new conversation with new 2nd port.
139 new_conversation_from_template =
140 conversation_new(conversation->setup_frame,
141 &conversation->key_ptr->addr1, &conversation->key_ptr->addr2,
142 conversation->key_ptr->ptype, conversation->key_ptr->port1,
145 else if(conversation->options & NO_ADDR2)
148 * The conversation template was created without knowledge of address
149 * 2. Create a new conversation with new 2nd address.
151 new_conversation_from_template =
152 conversation_new(conversation->setup_frame,
153 &conversation->key_ptr->addr1, addr2,
154 conversation->key_ptr->ptype, conversation->key_ptr->port1,
155 conversation->key_ptr->port2, options);
160 * The CONVERSATION_TEMPLATE bit was set, but no other bit that the
161 * CONVERSATION_TEMPLATE bit controls is active. Just return the old
168 * Set the protocol dissector used for the template conversation as
169 * the handler of the new conversation as well.
171 new_conversation_from_template->dissector_handle = conversation->dissector_handle;
173 return new_conversation_from_template;
182 * Compute the hash value for two given address/port pairs if the match
186 conversation_hash_exact(gconstpointer v)
188 const conversation_key *key = (const conversation_key *)v;
192 ADD_ADDRESS_TO_HASH(hash_val, &key->addr1);
193 hash_val += key->port1;
194 ADD_ADDRESS_TO_HASH(hash_val, &key->addr2);
195 hash_val += key->port2;
201 * Compare two conversation keys for an exact match.
204 conversation_match_exact(gconstpointer v, gconstpointer w)
206 const conversation_key *v1 = (const conversation_key *)v;
207 const conversation_key *v2 = (const conversation_key *)w;
209 if (v1->ptype != v2->ptype)
210 return 0; /* different types of port */
213 * Are the first and second port 1 values the same, the first and
214 * second port 2 values the same, the first and second address
215 * 1 values the same, and the first and second address 2 values
218 if (v1->port1 == v2->port1 &&
219 v1->port2 == v2->port2 &&
220 ADDRESSES_EQUAL(&v1->addr1, &v2->addr1) &&
221 ADDRESSES_EQUAL(&v1->addr2, &v2->addr2)) {
223 * Yes. It's the same conversation, and the two
224 * address/port pairs are going in the same direction.
230 * Is the first port 2 the same as the second port 1, the first
231 * port 1 the same as the second port 2, the first address 2
232 * the same as the second address 1, and the first address 1
233 * the same as the second address 2?
235 if (v1->port2 == v2->port1 &&
236 v1->port1 == v2->port2 &&
237 ADDRESSES_EQUAL(&v1->addr2, &v2->addr1) &&
238 ADDRESSES_EQUAL(&v1->addr1, &v2->addr2)) {
240 * Yes. It's the same conversation, and the two
241 * address/port pairs are going in opposite directions.
247 * The addresses or the ports don't match.
253 * Compute the hash value for two given address/port pairs if the match
254 * has a wildcard address 2.
257 conversation_hash_no_addr2(gconstpointer v)
259 const conversation_key *key = (const conversation_key *)v;
263 ADD_ADDRESS_TO_HASH(hash_val, &key->addr1);
264 hash_val += key->port1;
265 hash_val += key->port2;
271 * Compare two conversation keys, except for the address 2 value.
272 * We don't check both directions of the conversation - the routine
273 * doing the hash lookup has to do two searches, as the hash key
274 * will be different for the two directions.
277 conversation_match_no_addr2(gconstpointer v, gconstpointer w)
279 const conversation_key *v1 = (const conversation_key *)v;
280 const conversation_key *v2 = (const conversation_key *)w;
282 if (v1->ptype != v2->ptype)
283 return 0; /* different types of port */
286 * Are the first and second port 1 values the same, the first and
287 * second port 2 valuess the same, and the first and second
288 * address 1 values the same?
290 if (v1->port1 == v2->port1 &&
291 v1->port2 == v2->port2 &&
292 ADDRESSES_EQUAL(&v1->addr1, &v2->addr1)) {
294 * Yes. It's the same conversation, and the two
295 * address/port pairs are going in the same direction.
301 * The addresses or the ports don't match.
307 * Compute the hash value for two given address/port pairs if the match
308 * has a wildcard port 2.
311 conversation_hash_no_port2(gconstpointer v)
313 const conversation_key *key = (const conversation_key *)v;
317 ADD_ADDRESS_TO_HASH(hash_val, &key->addr1);
318 hash_val += key->port1;
319 ADD_ADDRESS_TO_HASH(hash_val, &key->addr2);
325 * Compare two conversation keys, except for the port 2 value.
326 * We don't check both directions of the conversation - the routine
327 * doing the hash lookup has to do two searches, as the hash key
328 * will be different for the two directions.
331 conversation_match_no_port2(gconstpointer v, gconstpointer w)
333 const conversation_key *v1 = (const conversation_key *)v;
334 const conversation_key *v2 = (const conversation_key *)w;
336 if (v1->ptype != v2->ptype)
337 return 0; /* different types of port */
340 * Are the first and second port 1 values the same, the first and
341 * second address 1 values the same, and the first and second
342 * address 2 values the same?
344 if (v1->port1 == v2->port1 &&
345 ADDRESSES_EQUAL(&v1->addr1, &v2->addr1) &&
346 ADDRESSES_EQUAL(&v1->addr2, &v2->addr2)) {
348 * Yes. It's the same conversation, and the two
349 * address/port pairs are going in the same direction.
355 * The addresses or the ports don't match.
361 * Compute the hash value for two given address/port pairs if the match
362 * has a wildcard address 2 and port 2.
365 conversation_hash_no_addr2_or_port2(gconstpointer v)
367 const conversation_key *key = (const conversation_key *)v;
371 ADD_ADDRESS_TO_HASH(hash_val, &key->addr1);
372 hash_val += key->port1;
378 * Compare the address 1 and port 1 in the two conversation keys.
379 * We don't check both directions of the conversation - the routine
380 * doing the hash lookup has to do two searches, as the hash key
381 * will be different for the two directions.
384 conversation_match_no_addr2_or_port2(gconstpointer v, gconstpointer w)
386 const conversation_key *v1 = (const conversation_key *)v;
387 const conversation_key *v2 = (const conversation_key *)w;
389 if (v1->ptype != v2->ptype)
390 return 0; /* different types of port */
393 * Are the first and second port 1 values the same and the first
394 * and second address 1 values the same?
396 if (v1->port1 == v2->port1 &&
397 ADDRESSES_EQUAL(&v1->addr1, &v2->addr1)) {
399 * Yes. It's the same conversation, and the two
400 * address/port pairs are going in the same direction.
406 * The addresses or the ports don't match.
412 * Free the proto_data. The conversation itself is se_allocated.
415 free_data_list(gpointer key _U_, gpointer value, gpointer user_data _U_)
417 conversation_t *conv = value;
419 /* TODO: se_slist? */
420 g_slist_free(conv->data_list);
422 /* Not really necessary, but... */
423 conv->data_list = NULL;
428 * Destroy all existing conversations
431 conversation_cleanup(void)
433 /* Clean up the hash tables, but only after freeing any proto_data
434 * that may be hanging off the conversations.
435 * The conversation keys are se_ allocated so we don't have to clean them up.
437 conversation_keys = NULL;
438 if (conversation_hashtable_exact != NULL) {
439 g_hash_table_foreach(conversation_hashtable_exact, free_data_list, NULL);
440 g_hash_table_destroy(conversation_hashtable_exact);
442 if (conversation_hashtable_no_addr2 != NULL) {
443 g_hash_table_foreach(conversation_hashtable_no_addr2, free_data_list, NULL);
444 g_hash_table_destroy(conversation_hashtable_no_addr2);
446 if (conversation_hashtable_no_port2 != NULL) {
447 g_hash_table_foreach(conversation_hashtable_no_port2, free_data_list, NULL);
448 g_hash_table_destroy(conversation_hashtable_no_port2);
450 if (conversation_hashtable_no_addr2_or_port2 != NULL) {
451 g_hash_table_foreach(conversation_hashtable_no_addr2_or_port2, free_data_list, NULL);
452 g_hash_table_destroy(conversation_hashtable_no_addr2_or_port2);
455 conversation_hashtable_exact = NULL;
456 conversation_hashtable_no_addr2 = NULL;
457 conversation_hashtable_no_port2 = NULL;
458 conversation_hashtable_no_addr2_or_port2 = NULL;
462 * Initialize some variables every time a file is loaded or re-loaded.
463 * Create a new hash table for the conversations in the new file.
466 conversation_init(void)
469 * Free up any space allocated for conversation protocol data
472 * We can free the space, as the structures it contains are
473 * pointed to by conversation data structures that were freed
476 conversation_hashtable_exact =
477 g_hash_table_new(conversation_hash_exact,
478 conversation_match_exact);
479 conversation_hashtable_no_addr2 =
480 g_hash_table_new(conversation_hash_no_addr2,
481 conversation_match_no_addr2);
482 conversation_hashtable_no_port2 =
483 g_hash_table_new(conversation_hash_no_port2,
484 conversation_match_no_port2);
485 conversation_hashtable_no_addr2_or_port2 =
486 g_hash_table_new(conversation_hash_no_addr2_or_port2,
487 conversation_match_no_addr2_or_port2);
490 * Start the conversation indices over at 0.
496 * Given two address/port pairs for a packet, create a new conversation
497 * to contain packets between those address/port pairs.
499 * The options field is used to specify whether the address 2 value
500 * and/or port 2 value are not given and any value is acceptable
501 * when searching for this conversation.
504 conversation_new(const guint32 setup_frame, const address *addr1, const address *addr2, const port_type ptype,
505 const guint32 port1, const guint32 port2, const guint options)
508 DISSECTOR_ASSERT(!(options | CONVERSATION_TEMPLATE) || ((options | (NO_ADDR2 | NO_PORT2 | NO_PORT2_FORCE))) &&
509 "A conversation template may not be constructed without wildcard options");
511 GHashTable* hashtable;
512 conversation_t *conversation=NULL, *prev=NULL;
513 conversation_key existing_key;
514 conversation_key *new_key;
517 if (options & NO_ADDR2) {
518 if (options & (NO_PORT2|NO_PORT2_FORCE)) {
519 hashtable = conversation_hashtable_no_addr2_or_port2;
521 hashtable = conversation_hashtable_no_addr2;
524 if (options & (NO_PORT2|NO_PORT2_FORCE)) {
525 hashtable = conversation_hashtable_no_port2;
527 hashtable = conversation_hashtable_exact;
531 existing_key.addr1 = *addr1;
532 existing_key.addr2 = *addr2;
533 existing_key.ptype = ptype;
534 existing_key.port1 = port1;
535 existing_key.port2 = port2;
537 conversation = g_hash_table_lookup(hashtable, &existing_key);
538 if(NULL!=conversation)
541 new_key = se_alloc(sizeof(struct conversation_key));
542 new_key->next = conversation_keys;
543 conversation_keys = new_key;
544 SE_COPY_ADDRESS(&new_key->addr1, addr1);
545 SE_COPY_ADDRESS(&new_key->addr2, addr2);
546 new_key->ptype = ptype;
547 new_key->port1 = port1;
548 new_key->port2 = port2;
551 /* the list is ordered on setup_frame */
552 if(setup_frame>=conversation->last->setup_frame) {
553 /* add it to the end */
554 conversation->last->next=se_alloc(sizeof(conversation_t));
555 prev=conversation->last->next;
557 conversation->last=prev;
560 for (prev=NULL; (setup_frame>conversation->setup_frame) && conversation->next; prev=conversation, conversation = conversation->next)
563 prev->next = se_alloc(sizeof(conversation_t));
564 prev->next->next = conversation;
565 conversation = prev->next;
567 /* change the head of the list */
568 prev = se_alloc(sizeof(conversation_t));
569 prev->next = conversation;
570 prev->last = conversation->last;
571 conversation->last=NULL;
577 conversation = se_alloc(sizeof(conversation_t));
578 conversation->next = NULL;
579 conversation->last = conversation;
582 conversation->index = new_index;
583 conversation->setup_frame = setup_frame;
584 conversation->data_list = NULL;
586 /* clear dissector handle */
587 conversation->dissector_handle = NULL;
589 /* set the options and key pointer */
590 conversation->options = options;
591 conversation->key_ptr = new_key;
595 /* only insert a hash table entry if this
596 * is the first conversation with this key */
598 g_hash_table_insert(hashtable, new_key, conversation);
604 * Set the port 2 value in a key. Remove the original from table,
605 * update the options and port values, insert the updated key.
608 conversation_set_port2(conversation_t *conv, const guint32 port)
610 DISSECTOR_ASSERT(!(conv->options & CONVERSATION_TEMPLATE) &&
611 "Use the conversation_create_from_template function when the CONVERSATION_TEMPLATE bit is set in the options mask");
614 * If the port 2 value is not wildcarded, don't set it.
616 if ((!(conv->options & NO_PORT2)) || (conv->options & NO_PORT2_FORCE))
619 if (conv->options & NO_ADDR2) {
620 g_hash_table_remove(conversation_hashtable_no_addr2_or_port2,
623 g_hash_table_remove(conversation_hashtable_no_port2,
626 conv->options &= ~NO_PORT2;
627 conv->key_ptr->port2 = port;
628 if (conv->options & NO_ADDR2) {
629 g_hash_table_insert(conversation_hashtable_no_addr2,
630 conv->key_ptr, conv);
632 g_hash_table_insert(conversation_hashtable_exact,
633 conv->key_ptr, conv);
638 * Set the address 2 value in a key. Remove the original from
639 * table, update the options and port values, insert the updated key.
642 conversation_set_addr2(conversation_t *conv, const address *addr)
644 DISSECTOR_ASSERT(!(conv->options & CONVERSATION_TEMPLATE) &&
645 "Use the conversation_create_from_template function when the CONVERSATION_TEMPLATE bit is set in the options mask");
648 * If the address 2 value is not wildcarded, don't set it.
650 if (!(conv->options & NO_ADDR2))
653 if (conv->options & NO_PORT2) {
654 g_hash_table_remove(conversation_hashtable_no_addr2_or_port2,
657 g_hash_table_remove(conversation_hashtable_no_addr2,
660 conv->options &= ~NO_ADDR2;
661 SE_COPY_ADDRESS(&conv->key_ptr->addr2, addr);
662 if (conv->options & NO_PORT2) {
663 g_hash_table_insert(conversation_hashtable_no_port2,
664 conv->key_ptr, conv);
666 g_hash_table_insert(conversation_hashtable_exact,
667 conv->key_ptr, conv);
672 * Search a particular hash table for a conversation with the specified
673 * {addr1, port1, addr2, port2} and set up before frame_num.
675 static conversation_t *
676 conversation_lookup_hashtable(GHashTable *hashtable, const guint32 frame_num, const address *addr1, const address *addr2,
677 const port_type ptype, const guint32 port1, const guint32 port2)
679 conversation_t* conversation=NULL;
680 conversation_t* match=NULL;
681 conversation_key key;
685 * We don't make a copy of the address data, we just copy the
686 * pointer to it, as "key" disappears when we return.
694 match = g_hash_table_lookup(hashtable, &key);
696 if (match && (match->setup_frame > frame_num))
700 if(match->last->setup_frame<=frame_num)
702 for (conversation = match->next; conversation; conversation = conversation->next) {
703 if ((conversation->setup_frame <= frame_num)
704 && (conversation->setup_frame > match->setup_frame)) {
705 match = conversation;
707 } else if(conversation->setup_frame>frame_num)
708 /* we are past the frame_num */
720 * Given two address/port pairs for a packet, search for a conversation
721 * containing packets between those address/port pairs. Returns NULL if
724 * We try to find the most exact match that we can, and then proceed to
725 * try wildcard matches on the "addr_b" and/or "port_b" argument if a more
726 * exact match failed.
728 * Either or both of the "addr_b" and "port_b" arguments may be specified as
729 * a wildcard by setting the NO_ADDR_B or NO_PORT_B flags in the "options"
730 * argument. We do only wildcard matches on addresses and ports specified
735 * if neither "addr_b" nor "port_b" were specified as wildcards, we
736 * do an exact match (addr_a/port_a and addr_b/port_b) and, if that
737 * succeeds, we return a pointer to the matched conversation;
739 * otherwise, if "port_b" wasn't specified as a wildcard, we try to
740 * match any address 2 with the specified port 2 (addr_a/port_a and
741 * {any}/addr_b) and, if that succeeds, we return a pointer to the
742 * matched conversation;
744 * otherwise, if "addr_b" wasn't specified as a wildcard, we try to
745 * match any port 2 with the specified address 2 (addr_a/port_a and
746 * addr_b/{any}) and, if that succeeds, we return a pointer to the
747 * matched conversation;
749 * otherwise, we try to match any address 2 and any port 2
750 * (addr_a/port_a and {any}/{any}) and, if that succeeds, we return
751 * a pointer to the matched conversation;
753 * otherwise, we found no matching conversation, and return NULL.
756 find_conversation(const guint32 frame_num, const address *addr_a, const address *addr_b, const port_type ptype,
757 const guint32 port_a, const guint32 port_b, const guint options)
759 conversation_t *conversation;
762 * First try an exact match, if we have two addresses and ports.
764 if (!(options & (NO_ADDR_B|NO_PORT_B))) {
766 * Neither search address B nor search port B are wildcarded,
767 * start out with an exact match.
768 * Exact matches check both directions.
771 conversation_lookup_hashtable(conversation_hashtable_exact,
772 frame_num, addr_a, addr_b, ptype,
774 if ((conversation == NULL) && (addr_a->type == AT_FC)) {
775 /* In Fibre channel, OXID & RXID are never swapped as
776 * TCP/UDP ports are in TCP/IP.
779 conversation_lookup_hashtable(conversation_hashtable_exact,
780 frame_num, addr_b, addr_a, ptype,
783 if (conversation != NULL)
788 * Well, that didn't find anything. Try matches that wildcard
789 * one of the addresses, if we have two ports.
791 if (!(options & NO_PORT_B)) {
793 * Search port B isn't wildcarded.
795 * First try looking for a conversation with the specified
796 * address A and port A as the first address and port, and
797 * with any address and the specified port B as the second
799 * ("addr_b" doesn't take part in this lookup.)
802 conversation_lookup_hashtable(conversation_hashtable_no_addr2,
803 frame_num, addr_a, addr_b, ptype, port_a, port_b);
804 if ((conversation == NULL) && (addr_a->type == AT_FC)) {
805 /* In Fibre channel, OXID & RXID are never swapped as
806 * TCP/UDP ports are in TCP/IP.
809 conversation_lookup_hashtable(conversation_hashtable_no_addr2,
810 frame_num, addr_b, addr_a, ptype,
813 if (conversation != NULL) {
815 * If search address B isn't wildcarded, and this is for a
816 * connection-oriented protocol, set the second address for this
817 * conversation to address B, as that's the address that matched the
818 * wildcarded second address for this conversation.
820 * (This assumes that, for all connection oriented protocols, the
821 * endpoints of a connection have only one address each, i.e. you
822 * don't get packets in a given direction coming from more than one
823 * address, unless the CONVERSATION_TEMPLATE option is set.)
825 if (!(conversation->options & NO_ADDR_B) && ptype != PT_UDP)
827 if(!(conversation->options & CONVERSATION_TEMPLATE))
829 conversation_set_addr2(conversation, addr_b);
834 conversation_create_from_template(conversation, addr_b, 0);
841 * Well, that didn't find anything.
842 * If search address B was specified, try looking for a
843 * conversation with the specified address B and port B as
844 * the first address and port, and with any address and the
845 * specified port A as the second address and port (this
846 * packet may be going in the opposite direction from the
847 * first packet in the conversation).
848 * ("addr_a" doesn't take part in this lookup.)
850 if (!(options & NO_ADDR_B)) {
852 conversation_lookup_hashtable(conversation_hashtable_no_addr2,
853 frame_num, addr_b, addr_a, ptype, port_b, port_a);
854 if (conversation != NULL) {
856 * If this is for a connection-oriented
857 * protocol, set the second address for
858 * this conversation to address A, as
859 * that's the address that matched the
860 * wildcarded second address for this
863 if (ptype != PT_UDP) {
864 if(!(conversation->options & CONVERSATION_TEMPLATE))
866 conversation_set_addr2(conversation, addr_a);
871 conversation_create_from_template(conversation, addr_a, 0);
880 * Well, that didn't find anything. Try matches that wildcard
881 * one of the ports, if we have two addresses.
883 if (!(options & NO_ADDR_B)) {
885 * Search address B isn't wildcarded.
887 * First try looking for a conversation with the specified
888 * address A and port A as the first address and port, and
889 * with the specified address B and any port as the second
891 * ("port_b" doesn't take part in this lookup.)
894 conversation_lookup_hashtable(conversation_hashtable_no_port2,
895 frame_num, addr_a, addr_b, ptype, port_a, port_b);
896 if ((conversation == NULL) && (addr_a->type == AT_FC)) {
897 /* In Fibre channel, OXID & RXID are never swapped as
898 * TCP/UDP ports are in TCP/IP
901 conversation_lookup_hashtable(conversation_hashtable_no_port2,
902 frame_num, addr_b, addr_a, ptype, port_a, port_b);
904 if (conversation != NULL) {
906 * If search port B isn't wildcarded, and this is for a connection-
907 * oriented protocol, set the second port for this conversation to
908 * port B, as that's the port that matched the wildcarded second port
909 * for this conversation.
911 * (This assumes that, for all connection oriented protocols, the
912 * endpoints of a connection have only one port each, i.e. you don't
913 * get packets in a given direction coming from more than one port,
914 * unless the CONVERSATION_TEMPLATE option is set.)
916 if (!(conversation->options & NO_PORT_B) && ptype != PT_UDP)
918 if(!(conversation->options & CONVERSATION_TEMPLATE))
920 conversation_set_port2(conversation, port_b);
925 conversation_create_from_template(conversation, 0, port_b);
932 * Well, that didn't find anything.
933 * If search port B was specified, try looking for a
934 * conversation with the specified address B and port B
935 * as the first address and port, and with the specified
936 * address A and any port as the second address and port
937 * (this packet may be going in the opposite direction
938 * from the first packet in the conversation).
939 * ("port_a" doesn't take part in this lookup.)
941 if (!(options & NO_PORT_B)) {
943 conversation_lookup_hashtable(conversation_hashtable_no_port2,
944 frame_num, addr_b, addr_a, ptype, port_b, port_a);
945 if (conversation != NULL) {
947 * If this is for a connection-oriented
948 * protocol, set the second port for
949 * this conversation to port A, as
950 * that's the address that matched the
951 * wildcarded second address for this
956 if(!(conversation->options & CONVERSATION_TEMPLATE))
958 conversation_set_port2(conversation, port_a);
963 conversation_create_from_template(conversation, 0, port_a);
972 * Well, that didn't find anything. Try matches that wildcard
973 * one address/port pair.
975 * First try looking for a conversation with the specified address A
976 * and port A as the first address and port.
977 * (Neither "addr_b" nor "port_b" take part in this lookup.)
980 conversation_lookup_hashtable(conversation_hashtable_no_addr2_or_port2,
981 frame_num, addr_a, addr_b, ptype, port_a, port_b);
982 if (conversation != NULL) {
984 * If this is for a connection-oriented protocol:
986 * if search address B isn't wildcarded, set the
987 * second address for this conversation to address
988 * B, as that's the address that matched the
989 * wildcarded second address for this conversation;
991 * if search port B isn't wildcarded, set the
992 * second port for this conversation to port B,
993 * as that's the port that matched the wildcarded
994 * second port for this conversation.
998 if(!(conversation->options & CONVERSATION_TEMPLATE))
1000 if (!(conversation->options & NO_ADDR_B))
1001 conversation_set_addr2(conversation, addr_b);
1002 if (!(conversation->options & NO_PORT_B))
1003 conversation_set_port2(conversation, port_b);
1008 conversation_create_from_template(conversation, addr_b, port_b);
1011 return conversation;
1015 * Well, that didn't find anything.
1016 * If search address and port B were specified, try looking for a
1017 * conversation with the specified address B and port B as the
1018 * first address and port, and with any second address and port
1019 * (this packet may be going in the opposite direction from the
1020 * first packet in the conversation).
1021 * (Neither "addr_a" nor "port_a" take part in this lookup.)
1023 if (addr_a->type == AT_FC)
1025 conversation_lookup_hashtable(conversation_hashtable_no_addr2_or_port2,
1026 frame_num, addr_b, addr_a, ptype, port_a, port_b);
1029 conversation_lookup_hashtable(conversation_hashtable_no_addr2_or_port2,
1030 frame_num, addr_b, addr_a, ptype, port_b, port_a);
1031 if (conversation != NULL) {
1033 * If this is for a connection-oriented protocol, set the
1034 * second address for this conversation to address A, as
1035 * that's the address that matched the wildcarded second
1036 * address for this conversation, and set the second port
1037 * for this conversation to port A, as that's the port
1038 * that matched the wildcarded second port for this
1041 if (ptype != PT_UDP)
1043 if(!(conversation->options & CONVERSATION_TEMPLATE))
1045 conversation_set_addr2(conversation, addr_a);
1046 conversation_set_port2(conversation, port_a);
1050 conversation = conversation_create_from_template(conversation, addr_a, port_a);
1053 return conversation;
1057 * We found no conversation.
1063 p_compare(gconstpointer a, gconstpointer b)
1065 const conv_proto_data *ap = (const conv_proto_data *)a;
1066 const conv_proto_data *bp = (const conv_proto_data *)b;
1068 if (ap->proto > bp->proto)
1070 else if (ap->proto == bp->proto)
1077 conversation_add_proto_data(conversation_t *conv, const int proto, void *proto_data)
1079 conv_proto_data *p1 = se_alloc(sizeof(conv_proto_data));
1082 p1->proto_data = proto_data;
1084 /* Add it to the list of items for this conversation. */
1086 conv->data_list = g_slist_insert_sorted(conv->data_list, (gpointer *)p1,
1091 conversation_get_proto_data(const conversation_t *conv, const int proto)
1093 conv_proto_data temp, *p1;
1097 temp.proto_data = NULL;
1099 item = g_slist_find_custom(conv->data_list, (gpointer *)&temp,
1103 p1 = (conv_proto_data *)item->data;
1104 return p1->proto_data;
1111 conversation_delete_proto_data(conversation_t *conv, const int proto)
1113 conv_proto_data temp;
1117 temp.proto_data = NULL;
1119 item = g_slist_find_custom(conv->data_list, (gpointer *)&temp,
1123 conv->data_list = g_slist_remove(conv->data_list, item->data);
1129 conversation_set_dissector(conversation_t *conversation, const dissector_handle_t handle)
1131 conversation->dissector_handle = handle;
1135 * Given two address/port pairs for a packet, search for a matching
1136 * conversation and, if found and it has a conversation dissector,
1137 * call that dissector and return TRUE, otherwise return FALSE.
1139 * This helper uses call_dissector_only which will NOT call the default
1140 * "data" dissector if the packet was rejected.
1141 * Our caller is responsible to call the data dissector explicitely in case
1142 * this function returns FALSE.
1145 try_conversation_dissector(const address *addr_a, const address *addr_b, const port_type ptype,
1146 const guint32 port_a, const guint32 port_b, tvbuff_t *tvb, packet_info *pinfo,
1149 conversation_t *conversation;
1151 conversation = find_conversation(pinfo->fd->num, addr_a, addr_b, ptype, port_a,
1154 if (conversation != NULL) {
1156 if (conversation->dissector_handle == NULL)
1158 ret=call_dissector_only(conversation->dissector_handle, tvb, pinfo,
1161 /* this packet was rejected by the dissector
1162 * so return FALSE in case our caller wants
1163 * to do some cleaning up.
1172 /* A helper function that calls find_conversation() and, if a conversation is
1173 * not found, calls conversation_new().
1174 * The frame number and addresses are taken from pinfo.
1175 * No options are used, though we could extend this API to include an options
1179 find_or_create_conversation(packet_info *pinfo)
1181 conversation_t *conv=NULL;
1183 /* Have we seen this conversation before? */
1184 if((conv = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
1185 pinfo->ptype, pinfo->srcport,
1186 pinfo->destport, 0)) == NULL) {
1187 /* No, this is a new conversation. */
1188 conv = conversation_new(pinfo->fd->num, &pinfo->src,
1189 &pinfo->dst, pinfo->ptype,
1190 pinfo->srcport, pinfo->destport, 0);