2 * Routines for building lists of packets that are part of a "conversation"
4 * $Id: conversation.c,v 1.5 2000/11/18 07:00:31 guy Exp $
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@zing.org>
8 * Copyright 1998 Gerald Combs
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
32 #ifdef HAVE_SYS_TYPES_H
33 # include <sys/types.h>
36 #ifdef HAVE_NETINET_IN_H
37 # include <netinet/in.h>
43 #include "conversation.h"
46 * Hash table for conversations with no wildcards.
48 static GHashTable *conversation_hashtable_exact = NULL;
51 * Hash table for conversations with wildcard destination address.
53 static GHashTable *conversation_hashtable_no_dst_addr = NULL;
56 * Hash table for conversations with wildcard destination port.
58 static GHashTable *conversation_hashtable_no_dst_port = NULL;
61 * Hash table for conversations with wildcard destination address and port.
63 static GHashTable *conversation_hashtable_no_dst = NULL;
65 static GMemChunk *conversation_key_chunk = NULL;
66 static GMemChunk *conversation_chunk = NULL;
69 typedef struct conversation_key {
70 struct conversation_key *next;
79 * Linked list of conversation keys, so we can, before freeing them all,
80 * free the address data allocations associated with them.
82 static conversation_key *conversation_keys;
84 static guint32 new_index;
86 static int conversation_init_count = 200;
89 * Compute the hash value for a given set of source and destination
90 * addresses and ports if the match is to be exact.
93 conversation_hash_exact(gconstpointer v)
95 conversation_key *key = (conversation_key *)v;
100 for (i = 0; i < key->src.len; i++)
101 hash_val += key->src.data[i];
103 hash_val += key->port_src;
105 for (i = 0; i < key->dst.len; i++)
106 hash_val += key->dst.data[i];
108 hash_val += key->port_dst;
114 * Compare two conversation keys for an exact match.
117 conversation_match_exact(gconstpointer v, gconstpointer w)
119 conversation_key *v1 = (conversation_key *)v;
120 conversation_key *v2 = (conversation_key *)w;
122 if (v1->ptype != v2->ptype)
123 return 0; /* different types of port */
126 * Are the first and second source ports the same, the first and
127 * second destination ports the same, the first and second source
128 * addresses the same, and the first and second destination
129 * addresses the same?
131 if (v1->port_src == v2->port_src &&
132 v1->port_dst == v2->port_dst &&
133 v1->src.type == v2->src.type &&
134 v1->src.len == v2->src.len &&
135 memcmp(v1->src.data, v2->src.data, v1->src.len) == 0 &&
136 v1->dst.type == v2->dst.type &&
137 v1->dst.type == v2->dst.type &&
138 v1->dst.len == v2->dst.len &&
139 memcmp(v1->dst.data, v2->dst.data, v1->dst.len) == 0) {
141 * Yes. It's the same conversation, and the two
142 * address/port pairs are going in the same direction.
148 * Is the first destination port the same as the second source
149 * port, the first source port the same as the second destination
150 * port, the first destination address the same as the second
151 * source address, and the first source address the same as the
152 * second destination address?
154 if (v1->port_dst == v2->port_src &&
155 v1->port_src == v2->port_dst &&
156 v1->dst.type == v2->src.type &&
157 v1->dst.len == v2->src.len &&
158 memcmp(v1->dst.data, v2->src.data, v1->dst.len) == 0 &&
159 v1->src.type == v2->dst.type &&
160 v1->src.len == v2->dst.len &&
161 memcmp(v1->src.data, v2->dst.data, v1->src.len) == 0) {
163 * Yes. It's the same conversation, and the two
164 * address/port pairs are going in opposite directions.
170 * The addresses or the ports don't match.
176 * Compute the hash value for a given set of source and destination
177 * addresses and ports if the match has a wildcard destination address.
180 conversation_hash_no_dst_addr(gconstpointer v)
182 conversation_key *key = (conversation_key *)v;
187 for (i = 0; i < key->src.len; i++)
188 hash_val += key->src.data[i];
190 hash_val += key->port_src;
192 hash_val += key->port_dst;
198 * Compare two conversation keys, except for the destination address.
199 * We don't check both directions of the conversation - the routine
200 * doing the hash lookup has to do two searches, as the hash key
201 * will be different for the two directions.
204 conversation_match_no_dst_addr(gconstpointer v, gconstpointer w)
206 conversation_key *v1 = (conversation_key *)v;
207 conversation_key *v2 = (conversation_key *)w;
209 if (v1->ptype != v2->ptype)
210 return 0; /* different types of port */
213 * Are the first and second source ports the same, the first and
214 * second destination ports the same, and the first and second
215 * source addresses the same?
217 if (v1->port_src == v2->port_src &&
218 v1->port_dst == v2->port_dst &&
219 v1->src.type == v2->src.type &&
220 v1->src.len == v2->src.len &&
221 memcmp(v1->src.data, v2->src.data, v1->src.len) == 0) {
223 * Yes. It's the same conversation, and the two
224 * address/port pairs are going in the same direction.
230 * The addresses or the ports don't match.
236 * Compute the hash value for a given set of source and destination
237 * addresses and ports if the match has a wildcard destination port.
240 conversation_hash_no_dst_port(gconstpointer v)
242 conversation_key *key = (conversation_key *)v;
247 for (i = 0; i < key->src.len; i++)
248 hash_val += key->src.data[i];
250 hash_val += key->port_src;
252 for (i = 0; i < key->dst.len; i++)
253 hash_val += key->dst.data[i];
259 * Compare two conversation keys, except for the destination port.
260 * We don't check both directions of the conversation - the routine
261 * doing the hash lookup has to do two searches, as the hash key
262 * will be different for the two directions.
265 conversation_match_no_dst_port(gconstpointer v, gconstpointer w)
267 conversation_key *v1 = (conversation_key *)v;
268 conversation_key *v2 = (conversation_key *)w;
270 if (v1->ptype != v2->ptype)
271 return 0; /* different types of port */
274 * Are the first and second source ports the same, the first and
275 * second source addresses the same, and the first and second
276 * destination addresses the same?
278 if (v1->port_src == v2->port_src &&
279 v1->src.type == v2->src.type &&
280 v1->src.len == v2->src.len &&
281 memcmp(v1->src.data, v2->src.data, v1->src.len) == 0 &&
282 v1->dst.type == v2->dst.type &&
283 v1->dst.type == v2->dst.type &&
284 v1->dst.len == v2->dst.len &&
285 memcmp(v1->dst.data, v2->dst.data, v1->dst.len) == 0) {
287 * Yes. It's the same conversation, and the two
288 * address/port pairs are going in the same direction.
294 * The addresses or the ports don't match.
300 * Compute the hash value for a given set of source and destination
301 * addresses and ports if the match has a wildcard destination.
304 conversation_hash_no_dst(gconstpointer v)
306 conversation_key *key = (conversation_key *)v;
311 for (i = 0; i < key->src.len; i++)
312 hash_val += key->src.data[i];
314 hash_val += key->port_src;
320 * Compare the source address and port in the two conversation keys.
321 * We don't check both directions of the conversation - the routine
322 * doing the hash lookup has to do two searches, as the hash key
323 * will be different for the two directions.
326 conversation_match_no_dst(gconstpointer v, gconstpointer w)
328 conversation_key *v1 = (conversation_key *)v;
329 conversation_key *v2 = (conversation_key *)w;
331 if (v1->ptype != v2->ptype)
332 return 0; /* different types of port */
335 * Are the first and second source ports the same and the first
336 * and second source addresses the same?
338 if (v1->port_src == v2->port_src &&
339 v1->src.type == v2->src.type &&
340 v1->src.len == v2->src.len &&
341 memcmp(v1->src.data, v2->src.data, v1->src.len) == 0) {
343 * Yes. It's the same conversation, and the two
344 * address/port pairs are going in the same direction.
350 * The addresses or the ports don't match.
356 * Initialize some variables every time a file is loaded or re-loaded.
357 * Destroy all existing conversations, and create a new hash table
358 * for the conversations in the new file.
361 conversation_init(void)
363 conversation_key *key;
366 * Free the addresses associated with the conversation keys.
368 for (key = conversation_keys; key != NULL; key = key->next) {
370 * Grr. I guess the theory here is that freeing
371 * something sure as heck modifies it, so you
372 * want to ban attempts to free it, but, alas,
373 * if we make the "data" field of an "address"
374 * structure not a "const", the compiler whines if
375 * we try to make it point into the data for a packet,
376 * as that's a "const" array (and should be, as dissectors
377 * shouldn't trash it).
379 * So we cast the complaint into oblivion, and rely on
380 * the fact that these addresses are known to have had
381 * their data mallocated, i.e. they don't point into,
382 * say, the middle of the data for a packet.
384 g_free((gpointer)key->src.data);
385 g_free((gpointer)key->dst.data);
387 conversation_keys = NULL;
388 if (conversation_hashtable_exact != NULL)
389 g_hash_table_destroy(conversation_hashtable_exact);
390 if (conversation_hashtable_no_dst_addr != NULL)
391 g_hash_table_destroy(conversation_hashtable_no_dst_addr);
392 if (conversation_hashtable_no_dst_port != NULL)
393 g_hash_table_destroy(conversation_hashtable_no_dst_port);
394 if (conversation_hashtable_no_dst != NULL)
395 g_hash_table_destroy(conversation_hashtable_no_dst);
396 if (conversation_key_chunk != NULL)
397 g_mem_chunk_destroy(conversation_key_chunk);
398 if (conversation_chunk != NULL)
399 g_mem_chunk_destroy(conversation_chunk);
401 conversation_hashtable_exact =
402 g_hash_table_new(conversation_hash_exact,
403 conversation_match_exact);
404 conversation_hashtable_no_dst_addr =
405 g_hash_table_new(conversation_hash_no_dst_addr,
406 conversation_match_no_dst_addr);
407 conversation_hashtable_no_dst_port =
408 g_hash_table_new(conversation_hash_no_dst_port,
409 conversation_match_no_dst_port);
410 conversation_hashtable_no_dst =
411 g_hash_table_new(conversation_hash_no_dst,
412 conversation_match_no_dst);
413 conversation_key_chunk = g_mem_chunk_new("conversation_key_chunk",
414 sizeof(conversation_key),
415 conversation_init_count * sizeof(struct conversation_key),
417 conversation_chunk = g_mem_chunk_new("conversation_chunk",
418 sizeof(conversation_t),
419 conversation_init_count * sizeof(conversation_t),
423 * Start the conversation indices over at 0.
429 * Copy an address, allocating a new buffer for the address data.
432 copy_address(address *to, address *from)
436 to->type = from->type;
438 data = g_malloc(from->len);
439 memcpy(data, from->data, from->len);
444 * Given source and destination addresses and ports for a packet,
445 * create a new conversation to contain packets between those address/port
446 * pairs. The options field is used to flag the destination address/port
447 * are not given and any value is acceptable.
451 conversation_new(address *src, address *dst, port_type ptype,
452 guint32 src_port, guint32 dst_port, void *data, guint options)
454 conversation_t *conversation;
455 conversation_key *new_key;
457 new_key = g_mem_chunk_alloc(conversation_key_chunk);
458 new_key->next = conversation_keys;
459 conversation_keys = new_key;
460 copy_address(&new_key->src, src);
461 copy_address(&new_key->dst, dst);
462 new_key->ptype = ptype;
463 new_key->port_src = src_port;
464 new_key->port_dst = dst_port;
466 conversation = g_mem_chunk_alloc(conversation_chunk);
467 conversation->index = new_index;
468 conversation->data = data;
470 /* clear dissector pointer */
471 conversation->dissector.new_d = NULL;
473 /* set the options and key pointer */
474 conversation->options = options;
475 conversation->key_ptr = new_key;
479 if (options & NO_DST_ADDR) {
480 if (options & NO_DST_PORT) {
481 g_hash_table_insert(conversation_hashtable_no_dst,
482 new_key, conversation);
484 g_hash_table_insert(conversation_hashtable_no_dst_addr,
485 new_key, conversation);
488 if (options & NO_DST_PORT) {
489 g_hash_table_insert(conversation_hashtable_no_dst_port,
490 new_key, conversation);
492 g_hash_table_insert(conversation_hashtable_exact,
493 new_key, conversation);
499 /* Set the destination port in a key. Remove the original from table,
500 update the options and port values, insert the updated key.
502 void conversation_set_port( conversation_t *conv, guint32 port){
505 * If the destination port has already been set, don't set it
508 if (!(conv->options & NO_DST_PORT))
511 if (conv->options & NO_DST_ADDR) {
512 g_hash_table_remove(conversation_hashtable_no_dst,
515 g_hash_table_remove(conversation_hashtable_no_dst_port,
518 conv->options &= ~NO_DST_PORT;
519 conv->key_ptr->port_dst = port;
520 if (conv->options & NO_DST_ADDR) {
521 g_hash_table_insert(conversation_hashtable_no_dst_addr,
522 conv->key_ptr, conv);
524 g_hash_table_insert(conversation_hashtable_exact,
525 conv->key_ptr, conv);
529 /* Set the destination address in a key. Remove the original from
530 table, update the options and port values, insert the updated key.
532 void conversation_set_addr( conversation_t *conv, address *addr){
535 * If the destination address has already been set, don't set it
538 if (!(conv->options & NO_DST_ADDR))
541 if (conv->options & NO_DST_PORT) {
542 g_hash_table_remove(conversation_hashtable_no_dst,
545 g_hash_table_remove(conversation_hashtable_no_dst_addr,
548 conv->options &= ~NO_DST_ADDR;
549 copy_address(&conv->key_ptr->dst, addr);
550 if (conv->options & NO_DST_PORT) {
551 g_hash_table_insert(conversation_hashtable_no_dst_port,
552 conv->key_ptr, conv);
554 g_hash_table_insert(conversation_hashtable_exact,
555 conv->key_ptr, conv);
559 static conversation_t *
560 conversation_match(GHashTable *hashtable, address *src, address *dst,
561 port_type ptype, guint32 src_port, guint32 dst_port)
563 conversation_key key;
566 * We don't make a copy of the address data, we just copy the
567 * pointer to it, as "key" disappears when we return.
572 key.port_src = src_port;
573 key.port_dst = dst_port;
574 return g_hash_table_lookup(hashtable, &key);
578 * Given source and destination addresses and ports for a packet,
579 * search for a conversation containing packets between those address/port
580 * pairs. Returns NULL if not found. If the NO_DEST_ADDR and/or NO_DEST_PORT
581 * flags are set in the conversation options field, that value will not
585 find_conversation(address *src, address *dst, port_type ptype,
586 guint32 src_port, guint32 dst_port, guint options)
588 conversation_t *conversation;
590 if (options & NO_DST_ADDR) {
591 if (options & NO_DST_PORT) {
593 * Wildcard the address and port - first try looking
594 * for a conversation with the specified source
595 * address and port, then try looking for one with a
596 * source address and port that's the specified
597 * *destination* address and port (this packet may be
598 * going in the opposite direction from the first
599 * packet in the conversation).
602 conversation_match(conversation_hashtable_no_dst,
603 src, dst, ptype, src_port, dst_port);
604 if (conversation != NULL)
606 return conversation_match(conversation_hashtable_no_dst,
607 dst, src, ptype, dst_port, src_port);
610 * Wildcard the address - first try looking for a
611 * conversation with the specified source address
612 * and port and destination port, then try looking
613 * for one with a source address and port that's
614 * the specified *destination* address and port and
615 * a destination port that's the specified *source*
616 * port (this packet may be going in the opposite
617 * direction from the first packet in the conversation).
620 conversation_match(conversation_hashtable_no_dst_addr,
621 src, dst, ptype, src_port, dst_port);
622 if (conversation != NULL)
624 return conversation_match(conversation_hashtable_no_dst_addr,
625 dst, src, ptype, dst_port, src_port);
628 if (options & NO_DST_PORT) {
630 * Wildcard the port - first try looking for a
631 * conversation with the specified source address
632 * and port and destination address, then try looking
633 * for one with a source address and port that's
634 * the specified *destination* address and port and
635 * a destination address that's the specified *source*
636 * address (this packet may be going in the opposite
637 * direction from the first packet in the conversation).
640 conversation_match(conversation_hashtable_no_dst_port,
641 src, dst, ptype, src_port, dst_port);
642 if (conversation != NULL)
644 return conversation_match(conversation_hashtable_no_dst_port,
645 dst, src, ptype, dst_port, src_port);
648 * Search for an exact match. That search checks both
651 return conversation_match(conversation_hashtable_exact,
652 src, dst, ptype, src_port, dst_port);
658 * Set the dissector for a conversation.
661 old_conversation_set_dissector(conversation_t *conversation,
662 old_dissector_t dissector)
664 conversation->is_old_dissector = TRUE;
665 conversation->dissector.old_d = dissector;
669 conversation_set_dissector(conversation_t *conversation,
670 dissector_t dissector)
672 conversation->is_old_dissector = FALSE;
673 conversation->dissector.new_d = dissector;
677 * Given source and destination addresses and ports for a packet,
678 * search for a conversational dissector.
679 * If found, call it and return TRUE, otherwise return FALSE.
681 * Will search for a exact match (src & dst), then search for wild
682 * card matches: try to match any port on the destination address first,
683 * then try to match any address on the port, then try to match any
684 * address and any port.
687 old_try_conversation_dissector(address *src, address *dst, port_type ptype,
688 guint32 src_port, guint32 dst_port, const u_char *pd, int offset,
689 frame_data *fd, proto_tree *tree)
691 conversation_t *conversation;
694 conversation = find_conversation(src, dst, ptype, src_port, dst_port, 0);
696 if (conversation == NULL)
697 conversation = find_conversation(src, dst, ptype, src_port, dst_port, NO_DST_ADDR);
699 if (conversation == NULL)
700 conversation = find_conversation(src, dst, ptype, src_port, dst_port, NO_DST_PORT);
702 if (conversation == NULL)
703 conversation = find_conversation(src, dst, ptype, src_port, dst_port,
704 NO_DST_PORT | NO_DST_ADDR);
706 if (conversation != NULL) {
707 if (conversation->is_old_dissector) {
708 if (conversation->dissector.old_d == NULL)
710 (*conversation->dissector.old_d)(pd, offset, fd, tree);
712 if (conversation->dissector.new_d == NULL)
716 * Old dissector calling new dissector; use
717 * "tvb_create_from_top()" to remap.
719 * XXX - what about the "pd" argument? Do
720 * any dissectors not just pass that along and
721 * let the "offset" argument handle stepping
722 * through the packet?
724 tvb = tvb_create_from_top(offset);
725 (*conversation->dissector.new_d)(tvb, &pi, tree);
733 * Given source and destination addresses and ports for a packet,
734 * search for a conversational dissector.
735 * If found, call it and return TRUE, otherwise return FALSE.
737 * Will search for a exact match (src & dst), then search for wild
738 * card matches: try to match any port on the destination address first,
739 * then try to match any address on the port, then try to match any
740 * address and any port.
743 try_conversation_dissector(address *src, address *dst, port_type ptype,
744 guint32 src_port, guint32 dst_port, tvbuff_t *tvb, packet_info *pinfo,
747 conversation_t *conversation;
751 conversation = find_conversation(src, dst, ptype, src_port, dst_port, 0);
753 if (conversation == NULL)
754 conversation = find_conversation(src, dst, ptype, src_port, dst_port, NO_DST_ADDR);
756 if (conversation == NULL)
757 conversation = find_conversation(src, dst, ptype, src_port, dst_port, NO_DST_PORT);
759 if (conversation == NULL)
760 conversation = find_conversation(src, dst, ptype, src_port, dst_port,
761 NO_DST_PORT | NO_DST_ADDR);
763 if (conversation != NULL) {
764 if (conversation->is_old_dissector) {
765 if (conversation->dissector.old_d == NULL)
769 * New dissector calling old dissector; use
770 * "tvb_compat()" to remap.
772 * "is_old_dissector" won't be set unless
773 * "dissector.old_d" is set.
775 tvb_compat(tvb, &pd, &offset);
776 (*conversation->dissector.old_d)(pd, offset, pinfo->fd,
779 if (conversation->dissector.new_d == NULL)
781 (*conversation->dissector.new_d)(tvb, pinfo, tree);