2 * Routines for building lists of packets that are part of a "conversation"
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998 Gerald Combs
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version 2
11 * of the License, or (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
31 #include "conversation.h"
33 /* define DEBUG_CONVERSATION for pretty debug printing */
34 /* #define DEBUG_CONVERSATION */
35 #include "conversation_debug.h"
37 #ifdef DEBUG_CONVERSATION
38 int _debug_conversation_indent = 0;
42 * Hash table for conversations with no wildcards.
44 static GHashTable *conversation_hashtable_exact = NULL;
47 * Hash table for conversations with one wildcard address.
49 static GHashTable *conversation_hashtable_no_addr2 = NULL;
52 * Hash table for conversations with one wildcard port.
54 static GHashTable *conversation_hashtable_no_port2 = NULL;
57 * Hash table for conversations with one wildcard address and port.
59 static GHashTable *conversation_hashtable_no_addr2_or_port2 = NULL;
63 typedef struct conversation_key {
64 struct conversation_key *next;
73 * Linked list of conversation keys, so we can, before freeing them all,
74 * free the address data allocations associated with them.
76 static conversation_key *conversation_keys;
78 static guint32 new_index;
81 * Protocol-specific data attached to a conversation_t structure - protocol
82 * index and opaque pointer.
84 typedef struct _conv_proto_data {
90 * Creates a new conversation with known endpoints based on a conversation
91 * created with the CONVERSATION_TEMPLATE option while keeping the
92 * conversation created with the CONVERSATION_TEMPLATE option so it can still
93 * match future connections.
95 * Passing a pointer to a conversation whose options mask does not include
96 * CONVERSATION_TEMPLATE or where the conversation's protocol type (ptype)
97 * indicates a non-connnection oriented protocol will return the conversation
100 * addr2 and port2 are used in the function if their respective conversation
101 * options bits are set (NO_ADDR2 and NO_PORT2).
103 static conversation_t *
104 conversation_create_from_template(conversation_t *conversation, const address *addr2, const guint32 port2)
107 * Add a new conversation and keep the conversation template only if the
108 * CONVERSATION_TEMPLATE bit is set for a connection oriented protocol.
110 if(conversation->options & CONVERSATION_TEMPLATE &&
111 conversation->key_ptr->ptype != PT_UDP)
114 * Set up a new options mask where the conversation template bit and the
115 * bits for absence of a second address and port pair have been removed.
117 conversation_t *new_conversation_from_template;
118 guint options = conversation->options & ~(CONVERSATION_TEMPLATE | NO_ADDR2 | NO_PORT2);
121 * Are both the NO_ADDR2 and NO_PORT2 wildcards set in the options mask?
123 if(conversation->options & NO_ADDR2 &&
124 conversation->options & NO_PORT2)
127 * The conversation template was created without knowledge of both
128 * the second address as well as the second port. Create a new
129 * conversation with new 2nd address and 2nd port.
131 new_conversation_from_template =
132 conversation_new(conversation->setup_frame,
133 &conversation->key_ptr->addr1, addr2,
134 conversation->key_ptr->ptype, conversation->key_ptr->port1,
137 else if(conversation->options & NO_PORT2)
140 * The conversation template was created without knowledge of port 2
141 * only. Create a new conversation with new 2nd port.
143 new_conversation_from_template =
144 conversation_new(conversation->setup_frame,
145 &conversation->key_ptr->addr1, &conversation->key_ptr->addr2,
146 conversation->key_ptr->ptype, conversation->key_ptr->port1,
149 else if(conversation->options & NO_ADDR2)
152 * The conversation template was created without knowledge of address
153 * 2. Create a new conversation with new 2nd address.
155 new_conversation_from_template =
156 conversation_new(conversation->setup_frame,
157 &conversation->key_ptr->addr1, addr2,
158 conversation->key_ptr->ptype, conversation->key_ptr->port1,
159 conversation->key_ptr->port2, options);
164 * The CONVERSATION_TEMPLATE bit was set, but no other bit that the
165 * CONVERSATION_TEMPLATE bit controls is active. Just return the old
172 * Set the protocol dissector used for the template conversation as
173 * the handler of the new conversation as well.
175 new_conversation_from_template->dissector_handle = conversation->dissector_handle;
177 return new_conversation_from_template;
186 * Compute the hash value for two given address/port pairs if the match
189 /* http://eternallyconfuzzled.com/tuts/algorithms/jsw_tut_hashing.aspx#existing
193 conversation_hash_exact(gconstpointer v)
195 const conversation_key *key = (const conversation_key *)v;
202 ADD_ADDRESS_TO_HASH(hash_val, &key->addr1);
204 tmp_addr.data = &key->port1;
205 ADD_ADDRESS_TO_HASH(hash_val, &tmp_addr);
207 ADD_ADDRESS_TO_HASH(hash_val, &key->addr2);
209 tmp_addr.data = &key->port2;
210 ADD_ADDRESS_TO_HASH(hash_val, &tmp_addr);
212 hash_val += ( hash_val << 3 );
213 hash_val ^= ( hash_val >> 11 );
214 hash_val += ( hash_val << 15 );
220 * Compare two conversation keys for an exact match.
223 conversation_match_exact(gconstpointer v, gconstpointer w)
225 const conversation_key *v1 = (const conversation_key *)v;
226 const conversation_key *v2 = (const conversation_key *)w;
228 if (v1->ptype != v2->ptype)
229 return 0; /* different types of port */
232 * Are the first and second port 1 values the same, the first and
233 * second port 2 values the same, the first and second address
234 * 1 values the same, and the first and second address 2 values
237 if (v1->port1 == v2->port1 &&
238 v1->port2 == v2->port2 &&
239 addresses_equal(&v1->addr1, &v2->addr1) &&
240 addresses_equal(&v1->addr2, &v2->addr2)) {
242 * Yes. It's the same conversation, and the two
243 * address/port pairs are going in the same direction.
249 * Is the first port 2 the same as the second port 1, the first
250 * port 1 the same as the second port 2, the first address 2
251 * the same as the second address 1, and the first address 1
252 * the same as the second address 2?
254 if (v1->port2 == v2->port1 &&
255 v1->port1 == v2->port2 &&
256 addresses_equal(&v1->addr2, &v2->addr1) &&
257 addresses_equal(&v1->addr1, &v2->addr2)) {
259 * Yes. It's the same conversation, and the two
260 * address/port pairs are going in opposite directions.
266 * The addresses or the ports don't match.
272 * Compute the hash value for two given address/port pairs if the match
273 * has a wildcard address 2.
276 conversation_hash_no_addr2(gconstpointer v)
278 const conversation_key *key = (const conversation_key *)v;
285 ADD_ADDRESS_TO_HASH(hash_val, &key->addr1);
287 tmp_addr.data = &key->port1;
288 ADD_ADDRESS_TO_HASH(hash_val, &tmp_addr);
290 tmp_addr.data = &key->port2;
291 ADD_ADDRESS_TO_HASH(hash_val, &tmp_addr);
293 hash_val += ( hash_val << 3 );
294 hash_val ^= ( hash_val >> 11 );
295 hash_val += ( hash_val << 15 );
301 * Compare two conversation keys, except for the address 2 value.
302 * We don't check both directions of the conversation - the routine
303 * doing the hash lookup has to do two searches, as the hash key
304 * will be different for the two directions.
307 conversation_match_no_addr2(gconstpointer v, gconstpointer w)
309 const conversation_key *v1 = (const conversation_key *)v;
310 const conversation_key *v2 = (const conversation_key *)w;
312 if (v1->ptype != v2->ptype)
313 return 0; /* different types of port */
316 * Are the first and second port 1 values the same, the first and
317 * second port 2 valuess the same, and the first and second
318 * address 1 values the same?
320 if (v1->port1 == v2->port1 &&
321 v1->port2 == v2->port2 &&
322 addresses_equal(&v1->addr1, &v2->addr1)) {
324 * Yes. It's the same conversation, and the two
325 * address/port pairs are going in the same direction.
331 * The addresses or the ports don't match.
337 * Compute the hash value for two given address/port pairs if the match
338 * has a wildcard port 2.
341 conversation_hash_no_port2(gconstpointer v)
343 const conversation_key *key = (const conversation_key *)v;
350 ADD_ADDRESS_TO_HASH(hash_val, &key->addr1);
352 tmp_addr.data = &key->port1;
353 ADD_ADDRESS_TO_HASH(hash_val, &tmp_addr);
355 ADD_ADDRESS_TO_HASH(hash_val, &key->addr2);
357 hash_val += ( hash_val << 3 );
358 hash_val ^= ( hash_val >> 11 );
359 hash_val += ( hash_val << 15 );
365 * Compare two conversation keys, except for the port 2 value.
366 * We don't check both directions of the conversation - the routine
367 * doing the hash lookup has to do two searches, as the hash key
368 * will be different for the two directions.
371 conversation_match_no_port2(gconstpointer v, gconstpointer w)
373 const conversation_key *v1 = (const conversation_key *)v;
374 const conversation_key *v2 = (const conversation_key *)w;
376 if (v1->ptype != v2->ptype)
377 return 0; /* different types of port */
380 * Are the first and second port 1 values the same, the first and
381 * second address 1 values the same, and the first and second
382 * address 2 values the same?
384 if (v1->port1 == v2->port1 &&
385 addresses_equal(&v1->addr1, &v2->addr1) &&
386 addresses_equal(&v1->addr2, &v2->addr2)) {
388 * Yes. It's the same conversation, and the two
389 * address/port pairs are going in the same direction.
395 * The addresses or the ports don't match.
401 * Compute the hash value for two given address/port pairs if the match
402 * has a wildcard address 2 and port 2.
405 conversation_hash_no_addr2_or_port2(gconstpointer v)
407 const conversation_key *key = (const conversation_key *)v;
414 ADD_ADDRESS_TO_HASH(hash_val, &key->addr1);
416 tmp_addr.data = &key->port1;
417 ADD_ADDRESS_TO_HASH(hash_val, &tmp_addr);
419 hash_val += ( hash_val << 3 );
420 hash_val ^= ( hash_val >> 11 );
421 hash_val += ( hash_val << 15 );
427 * Compare the address 1 and port 1 in the two conversation keys.
428 * We don't check both directions of the conversation - the routine
429 * doing the hash lookup has to do two searches, as the hash key
430 * will be different for the two directions.
433 conversation_match_no_addr2_or_port2(gconstpointer v, gconstpointer w)
435 const conversation_key *v1 = (const conversation_key *)v;
436 const conversation_key *v2 = (const conversation_key *)w;
438 if (v1->ptype != v2->ptype)
439 return 0; /* different types of port */
442 * Are the first and second port 1 values the same and the first
443 * and second address 1 values the same?
445 if (v1->port1 == v2->port1 &&
446 addresses_equal(&v1->addr1, &v2->addr1)) {
448 * Yes. It's the same conversation, and the two
449 * address/port pairs are going in the same direction.
455 * The addresses or the ports don't match.
461 * Free the proto_data. The conversation itself is wmem-allocated with
465 free_data_list(gpointer value)
467 conversation_t *conv = (conversation_t *)value;
469 /* TODO: file scoped wmem_list? There's no singly-linked wmem_ list */
470 g_slist_free(conv->data_list);
472 /* Not really necessary, but... */
473 conv->data_list = NULL;
478 * Destroy all existing conversations
481 conversation_cleanup(void)
483 /* Clean up the hash tables, but only after freeing any proto_data
484 * that may be hanging off the conversations.
485 * The conversation keys are wmem-allocated with file scope so we
486 * don't have to clean them up.
488 conversation_keys = NULL;
489 if (conversation_hashtable_exact != NULL) {
490 g_hash_table_destroy(conversation_hashtable_exact);
492 if (conversation_hashtable_no_addr2 != NULL) {
493 g_hash_table_destroy(conversation_hashtable_no_addr2);
495 if (conversation_hashtable_no_port2 != NULL) {
496 g_hash_table_destroy(conversation_hashtable_no_port2);
498 if (conversation_hashtable_no_addr2_or_port2 != NULL) {
499 g_hash_table_destroy(conversation_hashtable_no_addr2_or_port2);
502 conversation_hashtable_exact = NULL;
503 conversation_hashtable_no_addr2 = NULL;
504 conversation_hashtable_no_port2 = NULL;
505 conversation_hashtable_no_addr2_or_port2 = NULL;
509 * Initialize some variables every time a file is loaded or re-loaded.
510 * Create a new hash table for the conversations in the new file.
513 conversation_init(void)
516 * Free up any space allocated for conversation protocol data
519 * We can free the space, as the structures it contains are
520 * pointed to by conversation data structures that were freed
523 conversation_hashtable_exact =
524 g_hash_table_new_full(conversation_hash_exact,
525 conversation_match_exact, NULL, free_data_list);
526 conversation_hashtable_no_addr2 =
527 g_hash_table_new_full(conversation_hash_no_addr2,
528 conversation_match_no_addr2, NULL, free_data_list);
529 conversation_hashtable_no_port2 =
530 g_hash_table_new_full(conversation_hash_no_port2,
531 conversation_match_no_port2, NULL, free_data_list);
532 conversation_hashtable_no_addr2_or_port2 =
533 g_hash_table_new_full(conversation_hash_no_addr2_or_port2,
534 conversation_match_no_addr2_or_port2, NULL, free_data_list);
537 * Start the conversation indices over at 0.
543 * Does the right thing when inserting into one of the conversation hash tables,
544 * taking into account ordering and hash chains and all that good stuff.
546 * Mostly adapted from the old conversation_new().
549 conversation_insert_into_hashtable(GHashTable *hashtable, conversation_t *conv)
551 conversation_t *chain_head, *chain_tail, *cur, *prev;
553 chain_head = (conversation_t *)g_hash_table_lookup(hashtable, conv->key_ptr);
555 if (NULL==chain_head) {
559 g_hash_table_insert(hashtable, conv->key_ptr, conv);
560 DPRINT(("created a new conversation chain"));
563 /* There's an existing chain for this key */
564 DPRINT(("there's an existing conversation chain"));
566 chain_tail = chain_head->last;
568 if(conv->setup_frame >= chain_tail->setup_frame) {
569 /* This convo belongs at the end of the chain */
572 chain_tail->next = conv;
573 chain_head->last = conv;
576 /* Loop through the chain to find the right spot */
580 for (; (conv->setup_frame > cur->setup_frame) && cur->next; prev=cur, cur=cur->next)
584 /* Changing the head of the chain */
585 conv->next = chain_head;
586 conv->last = chain_tail;
587 chain_head->last = NULL;
588 g_hash_table_insert(hashtable, conv->key_ptr, conv);
591 /* Inserting into the middle of the chain */
601 * Does the right thing when removing from one of the conversation hash tables,
602 * taking into account ordering and hash chains and all that good stuff.
605 conversation_remove_from_hashtable(GHashTable *hashtable, conversation_t *conv)
607 conversation_t *chain_head, *cur, *prev;
609 chain_head = (conversation_t *)g_hash_table_lookup(hashtable, conv->key_ptr);
611 if (conv == chain_head) {
612 /* We are currently the front of the chain */
613 if (NULL == conv->next) {
614 /* We are the only conversation in the chain, no need to
615 * update next pointer, but do not call
616 * g_hash_table_remove() either because the conv data
617 * will be re-inserted. The memory is released when
618 * conversion_cleanup() is called. */
619 g_hash_table_steal(hashtable, conv->key_ptr);
622 /* Update the head of the chain */
623 chain_head = conv->next;
624 chain_head->last = conv->last;
626 if (conv->latest_found == conv)
627 chain_head->latest_found = NULL;
629 chain_head->latest_found = conv->latest_found;
631 g_hash_table_insert(hashtable, chain_head->key_ptr, chain_head);
635 /* We are not the front of the chain. Loop through to find us.
636 * Start loop at chain_head->next rather than chain_head because
637 * we already know we're not at the head. */
638 cur = chain_head->next;
641 for (; (cur != conv) && cur->next; prev=cur, cur=cur->next)
645 /* XXX: Conversation not found. Wrong hashtable? */
649 prev->next = conv->next;
651 if (NULL == conv->next) {
652 /* We're at the very end of the list. */
653 chain_head->last = prev;
656 if (chain_head->latest_found == conv)
657 chain_head->latest_found = prev;
662 * Given two address/port pairs for a packet, create a new conversation
663 * to contain packets between those address/port pairs.
665 * The options field is used to specify whether the address 2 value
666 * and/or port 2 value are not given and any value is acceptable
667 * when searching for this conversation.
670 conversation_new(const guint32 setup_frame, const address *addr1, const address *addr2, const port_type ptype,
671 const guint32 port1, const guint32 port2, const guint options)
674 DISSECTOR_ASSERT(!(options | CONVERSATION_TEMPLATE) || ((options | (NO_ADDR2 | NO_PORT2 | NO_PORT2_FORCE))) &&
675 "A conversation template may not be constructed without wildcard options");
677 GHashTable* hashtable;
678 conversation_t *conversation=NULL;
679 conversation_key *new_key;
681 DPRINT(("creating conversation for frame #%d: %s:%d -> %s:%d (ptype=%d)",
682 setup_frame, address_to_str(wmem_packet_scope(), addr1), port1,
683 address_to_str(wmem_packet_scope(), addr2), port2, ptype));
685 if (options & NO_ADDR2) {
686 if (options & (NO_PORT2|NO_PORT2_FORCE)) {
687 hashtable = conversation_hashtable_no_addr2_or_port2;
689 hashtable = conversation_hashtable_no_addr2;
692 if (options & (NO_PORT2|NO_PORT2_FORCE)) {
693 hashtable = conversation_hashtable_no_port2;
695 hashtable = conversation_hashtable_exact;
699 new_key = wmem_new(wmem_file_scope(), struct conversation_key);
700 new_key->next = conversation_keys;
701 conversation_keys = new_key;
702 WMEM_COPY_ADDRESS(wmem_file_scope(), &new_key->addr1, addr1);
703 WMEM_COPY_ADDRESS(wmem_file_scope(), &new_key->addr2, addr2);
704 new_key->ptype = ptype;
705 new_key->port1 = port1;
706 new_key->port2 = port2;
708 conversation = wmem_new(wmem_file_scope(), conversation_t);
709 memset(conversation, 0, sizeof(conversation_t));
711 conversation->index = new_index;
712 conversation->setup_frame = conversation->last_frame = setup_frame;
713 conversation->data_list = NULL;
715 /* clear dissector handle */
716 conversation->dissector_handle = NULL;
718 /* set the options and key pointer */
719 conversation->options = options;
720 conversation->key_ptr = new_key;
725 conversation_insert_into_hashtable(hashtable, conversation);
732 * Set the port 2 value in a key. Remove the original from table,
733 * update the options and port values, insert the updated key.
736 conversation_set_port2(conversation_t *conv, const guint32 port)
738 DISSECTOR_ASSERT_HINT(!(conv->options & CONVERSATION_TEMPLATE),
739 "Use the conversation_create_from_template function when the CONVERSATION_TEMPLATE bit is set in the options mask");
741 DPRINT(("called for port=%d", port));
744 * If the port 2 value is not wildcarded, don't set it.
746 if ((!(conv->options & NO_PORT2)) || (conv->options & NO_PORT2_FORCE))
750 if (conv->options & NO_ADDR2) {
751 conversation_remove_from_hashtable(conversation_hashtable_no_addr2_or_port2, conv);
753 conversation_remove_from_hashtable(conversation_hashtable_no_port2, conv);
755 conv->options &= ~NO_PORT2;
756 conv->key_ptr->port2 = port;
757 if (conv->options & NO_ADDR2) {
758 conversation_insert_into_hashtable(conversation_hashtable_no_addr2, conv);
760 conversation_insert_into_hashtable(conversation_hashtable_exact, conv);
766 * Set the address 2 value in a key. Remove the original from
767 * table, update the options and port values, insert the updated key.
770 conversation_set_addr2(conversation_t *conv, const address *addr)
773 DISSECTOR_ASSERT_HINT(!(conv->options & CONVERSATION_TEMPLATE),
774 "Use the conversation_create_from_template function when the CONVERSATION_TEMPLATE bit is set in the options mask");
776 addr_str = address_to_str(NULL, addr);
777 DPRINT(("called for addr=%s", addr_str));
778 wmem_free(NULL, addr_str);
781 * If the address 2 value is not wildcarded, don't set it.
783 if (!(conv->options & NO_ADDR2))
787 if (conv->options & NO_PORT2) {
788 conversation_remove_from_hashtable(conversation_hashtable_no_addr2_or_port2, conv);
790 conversation_remove_from_hashtable(conversation_hashtable_no_port2, conv);
792 conv->options &= ~NO_ADDR2;
793 WMEM_COPY_ADDRESS(wmem_file_scope(), &conv->key_ptr->addr2, addr);
794 if (conv->options & NO_PORT2) {
795 conversation_insert_into_hashtable(conversation_hashtable_no_port2, conv);
797 conversation_insert_into_hashtable(conversation_hashtable_exact, conv);
803 * Search a particular hash table for a conversation with the specified
804 * {addr1, port1, addr2, port2} and set up before frame_num.
806 static conversation_t *
807 conversation_lookup_hashtable(GHashTable *hashtable, const guint32 frame_num, const address *addr1, const address *addr2,
808 const port_type ptype, const guint32 port1, const guint32 port2)
810 conversation_t* convo=NULL;
811 conversation_t* match=NULL;
812 conversation_t* chain_head=NULL;
813 conversation_key key;
816 * We don't make a copy of the address data, we just copy the
817 * pointer to it, as "key" disappears when we return.
825 chain_head = (conversation_t *)g_hash_table_lookup(hashtable, &key);
827 if (chain_head && (chain_head->setup_frame <= frame_num)) {
830 if((chain_head->last)&&(chain_head->last->setup_frame<=frame_num))
831 return chain_head->last;
833 if((chain_head->latest_found)&&(chain_head->latest_found->setup_frame<=frame_num))
834 match = chain_head->latest_found;
836 for (convo = match; convo && convo->setup_frame <= frame_num; convo = convo->next) {
837 if (convo->setup_frame > match->setup_frame) {
844 chain_head->latest_found = match;
851 * Given two address/port pairs for a packet, search for a conversation
852 * containing packets between those address/port pairs. Returns NULL if
855 * We try to find the most exact match that we can, and then proceed to
856 * try wildcard matches on the "addr_b" and/or "port_b" argument if a more
857 * exact match failed.
859 * Either or both of the "addr_b" and "port_b" arguments may be specified as
860 * a wildcard by setting the NO_ADDR_B or NO_PORT_B flags in the "options"
861 * argument. We do only wildcard matches on addresses and ports specified
866 * if neither "addr_b" nor "port_b" were specified as wildcards, we
867 * do an exact match (addr_a/port_a and addr_b/port_b) and, if that
868 * succeeds, we return a pointer to the matched conversation;
870 * otherwise, if "port_b" wasn't specified as a wildcard, we try to
871 * match any address 2 with the specified port 2 (addr_a/port_a and
872 * {any}/port_b) and, if that succeeds, we return a pointer to the
873 * matched conversation;
875 * otherwise, if "addr_b" wasn't specified as a wildcard, we try to
876 * match any port 2 with the specified address 2 (addr_a/port_a and
877 * addr_b/{any}) and, if that succeeds, we return a pointer to the
878 * matched conversation;
880 * otherwise, we try to match any address 2 and any port 2
881 * (addr_a/port_a and {any}/{any}) and, if that succeeds, we return
882 * a pointer to the matched conversation;
884 * otherwise, we found no matching conversation, and return NULL.
887 find_conversation(const guint32 frame_num, const address *addr_a, const address *addr_b, const port_type ptype,
888 const guint32 port_a, const guint32 port_b, const guint options)
890 conversation_t *conversation;
893 * First try an exact match, if we have two addresses and ports.
895 if (!(options & (NO_ADDR_B|NO_PORT_B))) {
897 * Neither search address B nor search port B are wildcarded,
898 * start out with an exact match.
900 DPRINT(("trying exact match"));
902 conversation_lookup_hashtable(conversation_hashtable_exact,
903 frame_num, addr_a, addr_b, ptype,
905 /* Didn't work, try the other direction */
906 if (conversation == NULL) {
907 DPRINT(("trying opposite direction"));
909 conversation_lookup_hashtable(conversation_hashtable_exact,
910 frame_num, addr_b, addr_a, ptype,
913 if ((conversation == NULL) && (addr_a->type == AT_FC)) {
914 /* In Fibre channel, OXID & RXID are never swapped as
915 * TCP/UDP ports are in TCP/IP.
918 conversation_lookup_hashtable(conversation_hashtable_exact,
919 frame_num, addr_b, addr_a, ptype,
922 DPRINT(("exact match %sfound",conversation?"":"not "));
923 if (conversation != NULL)
928 * Well, that didn't find anything. Try matches that wildcard
929 * one of the addresses, if we have two ports.
931 if (!(options & NO_PORT_B)) {
933 * Search port B isn't wildcarded.
935 * First try looking for a conversation with the specified
936 * address A and port A as the first address and port, and
937 * with any address and the specified port B as the second
939 * ("addr_b" doesn't take part in this lookup.)
941 DPRINT(("trying wildcarded dest address"));
943 conversation_lookup_hashtable(conversation_hashtable_no_addr2,
944 frame_num, addr_a, addr_b, ptype, port_a, port_b);
945 if ((conversation == NULL) && (addr_a->type == AT_FC)) {
946 /* In Fibre channel, OXID & RXID are never swapped as
947 * TCP/UDP ports are in TCP/IP.
950 conversation_lookup_hashtable(conversation_hashtable_no_addr2,
951 frame_num, addr_b, addr_a, ptype,
954 if (conversation != NULL) {
956 * If search address B isn't wildcarded, and this is for a
957 * connection-oriented protocol, set the second address for this
958 * conversation to address B, as that's the address that matched the
959 * wildcarded second address for this conversation.
961 * (This assumes that, for all connection oriented protocols, the
962 * endpoints of a connection have only one address each, i.e. you
963 * don't get packets in a given direction coming from more than one
964 * address, unless the CONVERSATION_TEMPLATE option is set.)
966 DPRINT(("wildcarded dest address match found"));
967 if (!(conversation->options & NO_ADDR_B) && ptype != PT_UDP)
969 if(!(conversation->options & CONVERSATION_TEMPLATE))
971 conversation_set_addr2(conversation, addr_b);
976 conversation_create_from_template(conversation, addr_b, 0);
983 * Well, that didn't find anything.
984 * If search address B was specified, try looking for a
985 * conversation with the specified address B and port B as
986 * the first address and port, and with any address and the
987 * specified port A as the second address and port (this
988 * packet may be going in the opposite direction from the
989 * first packet in the conversation).
990 * ("addr_a" doesn't take part in this lookup.)
992 if (!(options & NO_ADDR_B)) {
993 DPRINT(("trying dest addr:port as source addr:port with wildcarded dest addr"));
995 conversation_lookup_hashtable(conversation_hashtable_no_addr2,
996 frame_num, addr_b, addr_a, ptype, port_b, port_a);
997 if (conversation != NULL) {
999 * If this is for a connection-oriented
1000 * protocol, set the second address for
1001 * this conversation to address A, as
1002 * that's the address that matched the
1003 * wildcarded second address for this
1006 DPRINT(("match found"));
1007 if (ptype != PT_UDP) {
1008 if(!(conversation->options & CONVERSATION_TEMPLATE))
1010 conversation_set_addr2(conversation, addr_a);
1015 conversation_create_from_template(conversation, addr_a, 0);
1018 return conversation;
1024 * Well, that didn't find anything. Try matches that wildcard
1025 * one of the ports, if we have two addresses.
1027 if (!(options & NO_ADDR_B)) {
1029 * Search address B isn't wildcarded.
1031 * First try looking for a conversation with the specified
1032 * address A and port A as the first address and port, and
1033 * with the specified address B and any port as the second
1035 * ("port_b" doesn't take part in this lookup.)
1037 DPRINT(("trying wildcarded dest port"));
1039 conversation_lookup_hashtable(conversation_hashtable_no_port2,
1040 frame_num, addr_a, addr_b, ptype, port_a, port_b);
1041 if ((conversation == NULL) && (addr_a->type == AT_FC)) {
1042 /* In Fibre channel, OXID & RXID are never swapped as
1043 * TCP/UDP ports are in TCP/IP
1046 conversation_lookup_hashtable(conversation_hashtable_no_port2,
1047 frame_num, addr_b, addr_a, ptype, port_a, port_b);
1049 if (conversation != NULL) {
1051 * If search port B isn't wildcarded, and this is for a connection-
1052 * oriented protocol, set the second port for this conversation to
1053 * port B, as that's the port that matched the wildcarded second port
1054 * for this conversation.
1056 * (This assumes that, for all connection oriented protocols, the
1057 * endpoints of a connection have only one port each, i.e. you don't
1058 * get packets in a given direction coming from more than one port,
1059 * unless the CONVERSATION_TEMPLATE option is set.)
1061 DPRINT(("match found"));
1062 if (!(conversation->options & NO_PORT_B) && ptype != PT_UDP)
1064 if(!(conversation->options & CONVERSATION_TEMPLATE))
1066 conversation_set_port2(conversation, port_b);
1071 conversation_create_from_template(conversation, 0, port_b);
1074 return conversation;
1078 * Well, that didn't find anything.
1079 * If search port B was specified, try looking for a
1080 * conversation with the specified address B and port B
1081 * as the first address and port, and with the specified
1082 * address A and any port as the second address and port
1083 * (this packet may be going in the opposite direction
1084 * from the first packet in the conversation).
1085 * ("port_a" doesn't take part in this lookup.)
1087 if (!(options & NO_PORT_B)) {
1088 DPRINT(("trying dest addr:port as source addr:port and wildcarded dest port"));
1090 conversation_lookup_hashtable(conversation_hashtable_no_port2,
1091 frame_num, addr_b, addr_a, ptype, port_b, port_a);
1092 if (conversation != NULL) {
1094 * If this is for a connection-oriented
1095 * protocol, set the second port for
1096 * this conversation to port A, as
1097 * that's the address that matched the
1098 * wildcarded second address for this
1101 DPRINT(("match found"));
1102 if (ptype != PT_UDP)
1104 if(!(conversation->options & CONVERSATION_TEMPLATE))
1106 conversation_set_port2(conversation, port_a);
1111 conversation_create_from_template(conversation, 0, port_a);
1114 return conversation;
1120 * Well, that didn't find anything. Try matches that wildcard
1121 * one address/port pair.
1123 * First try looking for a conversation with the specified address A
1124 * and port A as the first address and port.
1125 * (Neither "addr_b" nor "port_b" take part in this lookup.)
1127 DPRINT(("trying wildcarding dest addr:port"));
1129 conversation_lookup_hashtable(conversation_hashtable_no_addr2_or_port2,
1130 frame_num, addr_a, addr_b, ptype, port_a, port_b);
1131 if (conversation != NULL) {
1133 * If this is for a connection-oriented protocol:
1135 * if search address B isn't wildcarded, set the
1136 * second address for this conversation to address
1137 * B, as that's the address that matched the
1138 * wildcarded second address for this conversation;
1140 * if search port B isn't wildcarded, set the
1141 * second port for this conversation to port B,
1142 * as that's the port that matched the wildcarded
1143 * second port for this conversation.
1145 DPRINT(("match found"));
1146 if (ptype != PT_UDP)
1148 if(!(conversation->options & CONVERSATION_TEMPLATE))
1150 if (!(conversation->options & NO_ADDR_B))
1151 conversation_set_addr2(conversation, addr_b);
1152 if (!(conversation->options & NO_PORT_B))
1153 conversation_set_port2(conversation, port_b);
1158 conversation_create_from_template(conversation, addr_b, port_b);
1161 return conversation;
1165 * Well, that didn't find anything.
1166 * If search address and port B were specified, try looking for a
1167 * conversation with the specified address B and port B as the
1168 * first address and port, and with any second address and port
1169 * (this packet may be going in the opposite direction from the
1170 * first packet in the conversation).
1171 * (Neither "addr_a" nor "port_a" take part in this lookup.)
1173 DPRINT(("trying dest addr:port as source addr:port and wildcarding dest addr:port"));
1174 if (addr_a->type == AT_FC)
1176 conversation_lookup_hashtable(conversation_hashtable_no_addr2_or_port2,
1177 frame_num, addr_b, addr_a, ptype, port_a, port_b);
1180 conversation_lookup_hashtable(conversation_hashtable_no_addr2_or_port2,
1181 frame_num, addr_b, addr_a, ptype, port_b, port_a);
1182 if (conversation != NULL) {
1184 * If this is for a connection-oriented protocol, set the
1185 * second address for this conversation to address A, as
1186 * that's the address that matched the wildcarded second
1187 * address for this conversation, and set the second port
1188 * for this conversation to port A, as that's the port
1189 * that matched the wildcarded second port for this
1192 DPRINT(("match found"));
1193 if (ptype != PT_UDP)
1195 if(!(conversation->options & CONVERSATION_TEMPLATE))
1197 conversation_set_addr2(conversation, addr_a);
1198 conversation_set_port2(conversation, port_a);
1202 conversation = conversation_create_from_template(conversation, addr_a, port_a);
1205 return conversation;
1208 DPRINT(("no matches found"));
1211 * We found no conversation.
1217 p_compare(gconstpointer a, gconstpointer b)
1219 const conv_proto_data *ap = (const conv_proto_data *)a;
1220 const conv_proto_data *bp = (const conv_proto_data *)b;
1222 if (ap->proto > bp->proto)
1224 else if (ap->proto == bp->proto)
1231 conversation_add_proto_data(conversation_t *conv, const int proto, void *proto_data)
1233 conv_proto_data *p1 = wmem_new(wmem_file_scope(), conv_proto_data);
1236 p1->proto_data = proto_data;
1238 /* Add it to the list of items for this conversation. */
1240 conv->data_list = g_slist_insert_sorted(conv->data_list, (gpointer *)p1,
1245 conversation_get_proto_data(const conversation_t *conv, const int proto)
1247 conv_proto_data temp, *p1;
1251 temp.proto_data = NULL;
1253 item = g_slist_find_custom(conv->data_list, (gpointer *)&temp,
1257 p1 = (conv_proto_data *)item->data;
1258 return p1->proto_data;
1265 conversation_delete_proto_data(conversation_t *conv, const int proto)
1267 conv_proto_data temp;
1271 temp.proto_data = NULL;
1273 item = g_slist_find_custom(conv->data_list, (gpointer *)&temp,
1277 conv->data_list = g_slist_remove(conv->data_list, item->data);
1283 conversation_set_dissector(conversation_t *conversation, const dissector_handle_t handle)
1285 conversation->dissector_handle = handle;
1289 * Given two address/port pairs for a packet, search for a matching
1290 * conversation and, if found and it has a conversation dissector,
1291 * call that dissector and return TRUE, otherwise return FALSE.
1293 * This helper uses call_dissector_only which will NOT call the default
1294 * "data" dissector if the packet was rejected.
1295 * Our caller is responsible to call the data dissector explicitly in case
1296 * this function returns FALSE.
1299 try_conversation_dissector(const address *addr_a, const address *addr_b, const port_type ptype,
1300 const guint32 port_a, const guint32 port_b, tvbuff_t *tvb, packet_info *pinfo,
1301 proto_tree *tree, void* data)
1303 conversation_t *conversation;
1305 conversation = find_conversation(pinfo->fd->num, addr_a, addr_b, ptype, port_a,
1308 if (conversation != NULL) {
1310 if (conversation->dissector_handle == NULL)
1312 ret=call_dissector_only(conversation->dissector_handle, tvb, pinfo,
1315 /* this packet was rejected by the dissector
1316 * so return FALSE in case our caller wants
1317 * to do some cleaning up.
1326 /* A helper function that calls find_conversation() and, if a conversation is
1327 * not found, calls conversation_new().
1328 * The frame number and addresses are taken from pinfo.
1329 * No options are used, though we could extend this API to include an options
1333 find_or_create_conversation(packet_info *pinfo)
1335 conversation_t *conv=NULL;
1337 DPRINT(("called for frame #%d: %s:%d -> %s:%d (ptype=%d)",
1338 pinfo->fd->num, address_to_str(wmem_packet_scope(), &pinfo->src), pinfo->srcport,
1339 address_to_str(wmem_packet_scope(), &pinfo->dst), pinfo->destport, pinfo->ptype));
1342 /* Have we seen this conversation before? */
1343 if((conv = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst,
1344 pinfo->ptype, pinfo->srcport,
1345 pinfo->destport, 0)) != NULL) {
1346 DPRINT(("found previous conversation for frame #%d (last_frame=%d)",
1347 pinfo->fd->num, conv->last_frame));
1348 if (pinfo->fd->num > conv->last_frame) {
1349 conv->last_frame = pinfo->fd->num;
1352 /* No, this is a new conversation. */
1353 DPRINT(("did not find previous conversation for frame #%d",
1356 conv = conversation_new(pinfo->fd->num, &pinfo->src,
1357 &pinfo->dst, pinfo->ptype,
1358 pinfo->srcport, pinfo->destport, 0);
1368 get_conversation_hashtable_exact(void)
1370 return conversation_hashtable_exact;
1374 get_conversation_hashtable_no_addr2(void)
1376 return conversation_hashtable_no_addr2;
1380 get_conversation_hashtable_no_port2(void)
1382 return conversation_hashtable_no_port2;
1386 get_conversation_hashtable_no_addr2_or_port2(void)
1388 return conversation_hashtable_no_addr2_or_port2;
1392 * Editor modelines - http://www.wireshark.org/tools/modelines.html
1397 * indent-tabs-mode: t
1400 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
1401 * :indentSize=8:tabSize=8:noTabs=false: