packet-tcp.c

   1 /* packet-tcp.c
   2  * Routines for TCP packet disassembly
   3  *
   4  * $Id: packet-tcp.c,v 1.206 2003/09/12 05:52:38 sahlberg Exp $
   5  *
   6  * Ethereal - Network traffic analyzer
   7  * By Gerald Combs <gerald@ethereal.com>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version 2
  13  * of the License, or (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  23  */
  24
  25 #ifdef HAVE_CONFIG_H
  26 # include "config.h"
  27 #endif
  28
  29 #include <stdio.h>
  30 #include <string.h>
  31 #include <glib.h>
  32 #include "in_cksum.h"
  33
  34 #include <epan/packet.h>
  35 #include <epan/resolv.h>
  36 #include "ipproto.h"
  37 #include "ip_opts.h"
  38 #include "follow.h"
  39 #include "prefs.h"
  40 #include "packet-tcp.h"
  41 #include "packet-ip.h"
  42 #include "packet-frame.h"
  43 #include <epan/conversation.h>
  44 #include <epan/strutil.h>
  45 #include "reassemble.h"
  46 #include "tap.h"
  47
  48 static int tcp_tap = -1;
  49
  50 /* Place TCP summary in proto tree */
  51 static gboolean tcp_summary_in_tree = TRUE;
  52
  53 /*
  54  * Flag to control whether to check the TCP checksum.
  55  *
  56  * In at least some Solaris network traces, there are packets with bad
  57  * TCP checksums, but the traffic appears to indicate that the packets
  58  * *were* received; the packets were probably sent by the host on which
  59  * the capture was being done, on a network interface to which
  60  * checksumming was offloaded, so that DLPI supplied an un-checksummed
  61  * packet to the capture program but a checksummed packet got put onto
  62  * the wire.
  63  */
  64 static gboolean tcp_check_checksum = TRUE;
  65
  66 extern FILE* data_out_file;
  67
  68 static int proto_tcp = -1;
  69 static int hf_tcp_srcport = -1;
  70 static int hf_tcp_dstport = -1;
  71 static int hf_tcp_port = -1;
  72 static int hf_tcp_seq = -1;
  73 static int hf_tcp_nxtseq = -1;
  74 static int hf_tcp_ack = -1;
  75 static int hf_tcp_hdr_len = -1;
  76 static int hf_tcp_flags = -1;
  77 static int hf_tcp_flags_cwr = -1;
  78 static int hf_tcp_flags_ecn = -1;
  79 static int hf_tcp_flags_urg = -1;
  80 static int hf_tcp_flags_ack = -1;
  81 static int hf_tcp_flags_push = -1;
  82 static int hf_tcp_flags_reset = -1;
  83 static int hf_tcp_flags_syn = -1;
  84 static int hf_tcp_flags_fin = -1;
  85 static int hf_tcp_window_size = -1;
  86 static int hf_tcp_checksum = -1;
  87 static int hf_tcp_checksum_bad = -1;
  88 static int hf_tcp_len = -1;
  89 static int hf_tcp_urgent_pointer = -1;
  90 static int hf_tcp_analysis_flags = -1;
  91 static int hf_tcp_analysis_acks_frame = -1;
  92 static int hf_tcp_analysis_ack_rtt = -1;
  93 static int hf_tcp_analysis_retransmission = -1;
  94 static int hf_tcp_analysis_lost_packet = -1;
  95 static int hf_tcp_analysis_ack_lost_packet = -1;
  96 static int hf_tcp_analysis_keep_alive = -1;
  97 static int hf_tcp_analysis_keep_alive_ack = -1;
  98 static int hf_tcp_analysis_duplicate_ack = -1;
  99 static int hf_tcp_analysis_duplicate_ack_num = -1;
 100 static int hf_tcp_analysis_duplicate_ack_frame = -1;
 101 static int hf_tcp_analysis_zero_window = -1;
 102 static int hf_tcp_analysis_zero_window_probe = -1;
 103 static int hf_tcp_analysis_zero_window_violation = -1;
 104 static int hf_tcp_reassembled_in = -1;
 105 static int hf_tcp_segments = -1;
 106 static int hf_tcp_segment = -1;
 107 static int hf_tcp_segment_overlap = -1;
 108 static int hf_tcp_segment_overlap_conflict = -1;
 109 static int hf_tcp_segment_multiple_tails = -1;
 110 static int hf_tcp_segment_too_long_fragment = -1;
 111 static int hf_tcp_segment_error = -1;
 112 static int hf_tcp_option_mss = -1;
 113 static int hf_tcp_option_mss_val = -1;
 114 static int hf_tcp_option_wscale = -1;
 115 static int hf_tcp_option_wscale_val = -1;
 116 static int hf_tcp_option_sack_perm = -1;
 117 static int hf_tcp_option_sack = -1;
 118 static int hf_tcp_option_sack_sle = -1;
 119 static int hf_tcp_option_sack_sre = -1;
 120 static int hf_tcp_option_echo = -1;
 121 static int hf_tcp_option_echo_reply = -1;
 122 static int hf_tcp_option_time_stamp = -1;
 123 static int hf_tcp_option_cc = -1;
 124 static int hf_tcp_option_ccnew = -1;
 125 static int hf_tcp_option_ccecho = -1;
 126 static int hf_tcp_option_md5 = -1;
 127
 128 static gint ett_tcp = -1;
 129 static gint ett_tcp_flags = -1;
 130 static gint ett_tcp_options = -1;
 131 static gint ett_tcp_option_sack = -1;
 132 static gint ett_tcp_analysis = -1;
 133 static gint ett_tcp_analysis_faults = -1;
 134 static gint ett_tcp_segments = -1;
 135 static gint ett_tcp_segment  = -1;
 136
 137
 138 /* not all of the hf_fields below make sense for TCP but we have to provide
 139    them anyways to comply with the api (which was aimed for ip fragment
 140    reassembly) */
 141 static const fragment_items tcp_segment_items = {
 142         &ett_tcp_segment,
 143         &ett_tcp_segments,
 144         &hf_tcp_segments,
 145         &hf_tcp_segment,
 146         &hf_tcp_segment_overlap,
 147         &hf_tcp_segment_overlap_conflict,
 148         &hf_tcp_segment_multiple_tails,
 149         &hf_tcp_segment_too_long_fragment,
 150         &hf_tcp_segment_error,
 151         &hf_tcp_reassembled_in,
 152         "Segments"
 153 };
 154
 155 static dissector_table_t subdissector_table;
 156 static heur_dissector_list_t heur_subdissector_list;
 157 static dissector_handle_t data_handle;
 158
 159 /* TCP structs and definitions */
 160
 161
 162 /* **************************************************************************
 163  * stuff to analyze TCP sequencenumbers for retransmissions, missing segments,
 164  * RTT and reltive sequence numbers.
 165  * **************************************************************************/
 166 static gboolean tcp_analyze_seq = FALSE;
 167 static gboolean tcp_relative_seq = FALSE;
 168
 169 static GMemChunk *tcp_unacked_chunk = NULL;
 170 static int tcp_unacked_count = 500;     /* one for each packet until it is acked*/
 171 struct tcp_unacked {
 172         struct tcp_unacked *next;
 173         guint32 frame;
 174         guint32 seq;
 175         guint32 nextseq;
 176         nstime_t ts;
 177
 178         /* these are used for detection of duplicate acks and nothing else */
 179         guint32 ack_frame;
 180         guint32 ack;
 181         guint32 num_acks;
 182
 183         /* this is to keep track of zero window and zero window probe */
 184         guint32 window;
 185
 186         guint32 flags;
 187 };
 188
 189 /* Idea for gt: either x > y, or y is much bigger (assume wrap) */
 190 #define GT_SEQ(x, y) ((gint32)((y) - (x)) < 0)
 191 #define LT_SEQ(x, y) ((gint32)((x) - (y)) < 0)
 192 #define GE_SEQ(x, y) ((gint32)((y) - (x)) <= 0)
 193 #define LE_SEQ(x, y) ((gint32)((x) - (y)) <= 0)
 194 #define EQ_SEQ(x, y) ((x) == (y))
 195
 196 static GMemChunk *tcp_acked_chunk = NULL;
 197 static int tcp_acked_count = 5000;      /* one for almost every other segment in the capture */
 198 #define TCP_A_RETRANSMISSION            0x0001
 199 #define TCP_A_LOST_PACKET               0x0002
 200 #define TCP_A_ACK_LOST_PACKET           0x0004
 201 #define TCP_A_KEEP_ALIVE                0x0008
 202 #define TCP_A_DUPLICATE_ACK             0x0010
 203 #define TCP_A_ZERO_WINDOW               0x0020
 204 #define TCP_A_ZERO_WINDOW_PROBE         0x0040
 205 #define TCP_A_ZERO_WINDOW_VIOLATION     0x0080
 206 #define TCP_A_KEEP_ALIVE_ACK            0x0100
 207 struct tcp_acked {
 208         guint32 frame_acked;
 209         nstime_t ts;
 210         guint16 flags;
 211         guint32 dupack_num;     /* dup ack number */
 212         guint32 dupack_frame;   /* dup ack to frame # */
 213 };
 214 static GHashTable *tcp_analyze_acked_table = NULL;
 215
 216 static GMemChunk *tcp_rel_seq_chunk = NULL;
 217 static int tcp_rel_seq_count = 10000; /* one for each segment in the capture */
 218 struct tcp_rel_seq {
 219         guint32 seq_base;
 220         guint32 ack_base;
 221         gint16  win_scale;
 222 };
 223 static GHashTable *tcp_rel_seq_table = NULL;
 224
 225 static GMemChunk *tcp_analysis_chunk = NULL;
 226 static int tcp_analysis_count = 20;     /* one for each conversation */
 227 struct tcp_analysis {
 228         /* These two structs are managed based on comparing the source
 229          * and destination addresses and, if they're equal, comparing
 230          * the source and destination ports.
 231          *
 232          * If the source is greater than the destination, then stuff
 233          * sent from src is in ual1.
 234          *
 235          * If the source is less than the destination, then stuff
 236          * sent from src is in ual2.
 237          *
 238          * XXX - if the addresses and ports are equal, we don't guarantee
 239          * the behavior.
 240          */
 241         struct tcp_unacked *ual1;       /* UnAcked List 1*/
 242         guint32 base_seq1;
 243         struct tcp_unacked *ual2;       /* UnAcked List 2*/
 244         guint32 base_seq2;
 245         gint16 win_scale1;
 246         gint16 win_scale2;
 247
 248         /* these two lists are used to track when PDUs may start
 249            inside a segment.
 250         */
 251         struct tcp_next_pdu *pdu_seq1;
 252         struct tcp_next_pdu *pdu_seq2;
 253 };
 254
 255
 256 static GMemChunk *tcp_next_pdu_chunk = NULL;
 257 static int tcp_next_pdu_count = 20;
 258 struct tcp_next_pdu {
 259         struct tcp_next_pdu *next;
 260         guint32 seq;
 261 };
 262 static GHashTable *tcp_pdu_tracking_table = NULL;
 263
 264
 265 static struct tcp_analysis *
 266 get_tcp_conversation_data(packet_info *pinfo)
 267 {
 268         conversation_t *conv=NULL;
 269         struct tcp_analysis *tcpd=NULL;
 270
 271         /* Have we seen this conversation before? */
 272         if( (conv=find_conversation(&pinfo->src, &pinfo->dst, pinfo->ptype, pinfo->srcport, pinfo->destport, 0)) == NULL){
 273                 /* No this is a new conversation. */
 274                 conv=conversation_new(&pinfo->src, &pinfo->dst, pinfo->ptype, pinfo->srcport, pinfo->destport, 0);
 275         }
 276
 277         /* check if we have any data for this conversation */
 278         tcpd=conversation_get_proto_data(conv, proto_tcp);
 279         if(!tcpd){
 280                 /* No no such data yet. Allocate and init it */
 281                 tcpd=g_mem_chunk_alloc(tcp_analysis_chunk);
 282                 tcpd->ual1=NULL;
 283                 tcpd->base_seq1=0;
 284                 tcpd->win_scale1=-1;
 285                 tcpd->ual2=NULL;
 286                 tcpd->base_seq2=0;
 287                 tcpd->win_scale2=-1;
 288
 289                 tcpd->pdu_seq1=NULL;
 290                 tcpd->pdu_seq2=NULL;
 291
 292                 conversation_add_proto_data(conv, proto_tcp, tcpd);
 293         }
 294
 295         return tcpd;
 296 }
 297
 298 /* This function is called from the tcp analysis code to provide
 299    clues on how the seq and ack numbers are changed.
 300    To prevent the next_pdu lists from growing uncontrollable in size we
 301    use this function to do the following :
 302    IF we see an ACK then we assume that the left edge of the window has changed
 303       at least to this point and assuming it is rare with reordering and
 304       trailing duplicate/retransmitted segments, we just assume that after
 305       we have seen the ACK we will not see any more segments prior to the
 306       ACK value.
 307       If we will not see any segments prior to the ACK value then we can just
 308       delete all next_pdu entries that describe pdu's starting prior to the
 309       ACK.
 310       If this heuristics is prooved to be too simplistic we can just enhance it
 311       later.
 312 */
 313 /* XXX this function should be ehnanced to handle sequence number wrapping */
 314 /* XXX to handle retransmissions and reordered packets maybe we should only
 315        discard entries that are more than (guesstimate) 50kb older than the
 316        specified sequence number ?
 317 */
 318 static void
 319 prune_next_pdu_list(struct tcp_next_pdu **tnp, guint32 seq)
 320 {
 321         struct tcp_next_pdu *tmptnp;
 322
 323         if(*tnp == NULL){
 324                 return;
 325         }
 326
 327         for(tmptnp=*tnp;tmptnp;tmptnp=tmptnp->next){
 328                 if(tmptnp->seq<=seq){
 329                         struct tcp_next_pdu *oldtnp;
 330                         oldtnp=tmptnp;
 331
 332                         if(tmptnp==*tnp){
 333                                 tmptnp=tmptnp->next;
 334                                 *tnp=tmptnp;
 335                                 g_mem_chunk_free(tcp_next_pdu_chunk, oldtnp);
 336                                 if(!tmptnp){
 337                                         return;
 338                                 }
 339                                 continue;
 340                         } else {
 341                                 for(tmptnp=*tnp;tmptnp;tmptnp=tmptnp->next){
 342                                         if(tmptnp->next==oldtnp){
 343                                                 tmptnp->next=oldtnp->next;
 344                                                 g_mem_chunk_free(tcp_next_pdu_chunk, oldtnp);
 345                                                 break;
 346                                         }
 347                                 }
 348                                 if(!tmptnp){
 349                                         return;
 350                                 }
 351                         }
 352                 }
 353         }
 354 }
 355
 356
 357 /* if we know that a PDU starts inside this segment, return the adjusted
 358    offset to where that PDU starts or just return offset back
 359    and let TCP try to find out what it can about this segment
 360 */
 361 static int
 362 scan_for_next_pdu(packet_info *pinfo, int offset, guint32 seq, guint32 nxtseq)
 363 {
 364         struct tcp_analysis *tcpd=NULL;
 365         struct tcp_next_pdu *tnp=NULL;
 366         int direction;
 367
 368         if(!pinfo->fd->flags.visited){
 369                 /* find(or create if needed) the conversation for this tcp session */
 370                 tcpd=get_tcp_conversation_data(pinfo);
 371                 /* check direction and get pdu start lists */
 372                 direction=CMP_ADDRESS(&pinfo->src, &pinfo->dst);
 373                 /* if the addresses are equal, match the ports instead */
 374                 if(direction==0) {
 375                         direction= (pinfo->srcport > pinfo->destport)*2-1;
 376                 }
 377                 if(direction>=0){
 378                         tnp=tcpd->pdu_seq1;
 379                 } else {
 380                         tnp=tcpd->pdu_seq2;
 381                 }
 382
 383                 /* scan and see if we find any pdus starting inside this tvb */
 384                 for(;tnp;tnp=tnp->next){
 385                         /* XXX here we should also try to handle sequence number
 386                            wrapping
 387                         */
 388                         if(seq<tnp->seq && nxtseq>tnp->seq){
 389                                 g_hash_table_insert(tcp_pdu_tracking_table,
 390                                         (void *)pinfo->fd->num, (void *)tnp->seq);
 391                                 offset+=tnp->seq-seq;
 392                                 break;
 393                         }
 394                 }
 395         } else {
 396                 guint32 pduseq;
 397
 398                 pduseq=(guint32)g_hash_table_lookup(tcp_pdu_tracking_table, (void *)pinfo->fd->num);
 399                 if(pduseq){
 400                         offset+=pduseq-seq;
 401                 }
 402         }
 403
 404         return offset;
 405 }
 406
 407 /* if we saw a PDU that extended beyond the end of the segment,
 408    use this function to remember where the next pdu starts
 409 */
 410 static void
 411 pdu_store_sequencenumber_of_next_pdu(packet_info *pinfo, guint32 nxtpdu)
 412 {
 413         struct tcp_analysis *tcpd=NULL;
 414         struct tcp_next_pdu *tnp=NULL;
 415         int direction;
 416
 417         /* find(or create if needed) the conversation for this tcp session */
 418         tcpd=get_tcp_conversation_data(pinfo);
 419
 420         tnp=g_mem_chunk_alloc(tcp_next_pdu_chunk);
 421         tnp->seq=nxtpdu;
 422
 423         /* check direction and get pdu start list */
 424         direction=CMP_ADDRESS(&pinfo->src, &pinfo->dst);
 425         /* if the addresses are equal, match the ports instead */
 426         if(direction==0) {
 427                 direction= (pinfo->srcport > pinfo->destport)*2-1;
 428         }
 429         if(direction>=0){
 430                 tnp->next=tcpd->pdu_seq1;
 431                 tcpd->pdu_seq1=tnp;
 432         } else {
 433                 tnp->next=tcpd->pdu_seq2;
 434                 tcpd->pdu_seq2=tnp;
 435         }
 436         /*QQQ
 437           Add check for ACKs and purge list of sequence numbers
 438           already acked.
 439         */
 440 }
 441
 442 /* if we saw a window scaling option, store it for future reference
 443 */
 444 static void
 445 pdu_store_window_scale_option(packet_info *pinfo, guint8 ws)
 446 {
 447         struct tcp_analysis *tcpd=NULL;
 448         int direction;
 449
 450         /* find(or create if needed) the conversation for this tcp session */
 451         tcpd=get_tcp_conversation_data(pinfo);
 452
 453         /* check direction and get pdu start list */
 454         direction=CMP_ADDRESS(&pinfo->src, &pinfo->dst);
 455         /* if the addresses are equal, match the ports instead */
 456         if(direction==0) {
 457                 direction= (pinfo->srcport > pinfo->destport)*2-1;
 458         }
 459         if(direction>=0){
 460                 tcpd->win_scale1=ws;
 461         } else {
 462                 tcpd->win_scale2=ws;
 463         }
 464 }
 465
 466 static void
 467 tcp_get_relative_seq_ack(guint32 frame, guint32 *seq, guint32 *ack, guint32 *win)
 468 {
 469         struct tcp_rel_seq *trs;
 470
 471         trs=g_hash_table_lookup(tcp_rel_seq_table, (void *)frame);
 472         if(!trs){
 473                 return;
 474         }
 475
 476         (*seq) -= trs->seq_base;
 477         (*ack) -= trs->ack_base;
 478         if(trs->win_scale!=-1){
 479                 (*win)<<=trs->win_scale;
 480         }
 481 }
 482
 483 static struct tcp_acked *
 484 tcp_analyze_get_acked_struct(guint32 frame, gboolean createflag)
 485 {
 486         struct tcp_acked *ta;
 487
 488         ta=g_hash_table_lookup(tcp_analyze_acked_table, (void *)frame);
 489         if((!ta) && createflag){
 490                 ta=g_mem_chunk_alloc(tcp_acked_chunk);
 491                 ta->frame_acked=0;
 492                 ta->ts.secs=0;
 493                 ta->ts.nsecs=0;
 494                 ta->flags=0;
 495                 ta->dupack_num=0;
 496                 ta->dupack_frame=0;
 497                 g_hash_table_insert(tcp_analyze_acked_table, (void *)frame, ta);
 498         }
 499         return ta;
 500 }
 501
 502 static void
 503 tcp_analyze_sequence_number(packet_info *pinfo, guint32 seq, guint32 ack, guint32 seglen, guint8 flags, guint16 window)
 504 {
 505         struct tcp_analysis *tcpd=NULL;
 506         int direction;
 507         struct tcp_unacked *ual1=NULL;
 508         struct tcp_unacked *ual2=NULL;
 509         struct tcp_unacked *ual=NULL;
 510         guint32 base_seq=0;
 511         guint32 base_ack=0;
 512         gint16  win_scale=-1;
 513         struct tcp_next_pdu **tnp=NULL;
 514
 515         /* find(or create if needed) the conversation for this tcp session */
 516         tcpd=get_tcp_conversation_data(pinfo);
 517
 518         /* check direction and get ua lists */
 519         direction=CMP_ADDRESS(&pinfo->src, &pinfo->dst);
 520         /* if the addresses are equal, match the ports instead */
 521         if(direction==0) {
 522                 direction= (pinfo->srcport > pinfo->destport)*2-1;
 523         }
 524         if(direction>=0){
 525                 ual1=tcpd->ual1;
 526                 ual2=tcpd->ual2;
 527                 tnp=&tcpd->pdu_seq2;
 528                 base_seq=tcpd->base_seq1;
 529                 win_scale=tcpd->win_scale1;
 530                 base_ack=tcpd->base_seq2;
 531         } else {
 532                 ual1=tcpd->ual2;
 533                 ual2=tcpd->ual1;
 534                 tnp=&tcpd->pdu_seq1;
 535                 base_seq=tcpd->base_seq2;
 536                 win_scale=tcpd->win_scale2;
 537                 base_ack=tcpd->base_seq1;
 538         }
 539
 540         if(tcp_relative_seq){
 541                 if(base_seq==0){
 542                         base_seq=seq;
 543                 }
 544                 if(base_ack==0){
 545                         base_ack=ack;
 546                 }
 547         }
 548
 549         /* To handle FIN, just add 1 to the length.
 550            else the ACK following the FIN-ACK will look like it was
 551            outside the window. */
 552         if( flags&TH_FIN ){
 553                 seglen+=1;
 554         }
 555
 556         /* handle the sequence numbers */
 557         /* if this was a SYN packet, then remove existing list and
 558          * put SEQ+1 first the list */
 559         if(flags&TH_SYN){
 560                 for(ual=ual1;ual1;ual1=ual){
 561                         ual=ual1->next;
 562                         g_mem_chunk_free(tcp_unacked_chunk, ual1);
 563                 }
 564                 ual1=g_mem_chunk_alloc(tcp_unacked_chunk);
 565                 ual1->next=NULL;
 566                 ual1->frame=pinfo->fd->num;
 567                 ual1->ack_frame=0;
 568                 ual1->ack=0;
 569                 ual1->num_acks=0;
 570                 ual1->seq=seq+1;
 571                 ual1->nextseq=seq+1;
 572                 ual1->ts.secs=pinfo->fd->abs_secs;
 573                 ual1->ts.nsecs=pinfo->fd->abs_usecs*1000;
 574                 ual1->window=window;
 575                 ual1->flags=0;
 576                 if(tcp_relative_seq){
 577                         base_seq=seq;
 578                         base_ack=ack;
 579                 }
 580                 goto seq_finished;
 581         }
 582
 583         /* if this is the first segment we see then just add it */
 584         if( !ual1 ){
 585                 ual1=g_mem_chunk_alloc(tcp_unacked_chunk);
 586                 ual1->next=NULL;
 587                 ual1->frame=pinfo->fd->num;
 588                 ual1->ack_frame=0;
 589                 ual1->ack=0;
 590                 ual1->num_acks=0;
 591                 ual1->seq=seq;
 592                 ual1->nextseq=seq+seglen;
 593                 ual1->ts.secs=pinfo->fd->abs_secs;
 594                 ual1->ts.nsecs=pinfo->fd->abs_usecs*1000;
 595                 ual1->window=window;
 596                 ual1->flags=0;
 597                 if(tcp_relative_seq){
 598                         base_seq=seq;
 599                         base_ack=ack;
 600                 }
 601                 goto seq_finished;
 602         }
 603
 604         /* if we get past here we know that ual1 points to a segment */
 605
 606
 607         /* if seq is beyond ual1->nextseq we have lost a segment */
 608         if (GT_SEQ(seq, ual1->nextseq)) {
 609                 struct tcp_acked *ta;
 610
 611                 ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 612                 ta->flags|=TCP_A_LOST_PACKET;
 613
 614                 /* just add the segment to the beginning of the list */
 615                 ual=g_mem_chunk_alloc(tcp_unacked_chunk);
 616                 ual->next=ual1;
 617                 ual->frame=pinfo->fd->num;
 618                 ual->ack_frame=0;
 619                 ual->ack=0;
 620                 ual->num_acks=0;
 621                 ual->seq=seq;
 622                 ual->nextseq=seq+seglen;
 623                 ual->ts.secs=pinfo->fd->abs_secs;
 624                 ual->ts.nsecs=pinfo->fd->abs_usecs*1000;
 625                 ual->window=window;
 626                 ual->flags=0;
 627                 ual1=ual;
 628                 goto seq_finished;
 629         }
 630
 631         /* keep-alives are empty segments with a sequence number -1 of what
 632          * we would expect.
 633          *
 634          * Solaris is an exception, Solaris does not really use KeepAlives
 635          * according to RFC793, instead they move the left window edge one
 636          * byte to the left and makes up a fake byte to fill in this position
 637          * of the enlarged window.
 638          * This means that Solaris will do "weird" KeepAlives that actually
 639          * contains a one-byte segment with "random" junk data which the
 640          * Solaris host then will try to transmit, and posisbly retransmit
 641          * to the other side. Of course the other side will ignore this junk
 642          * byte since it is outside (left of) the window.
 643          * This is actually a brilliant trick that gives them, for free,
 644          * semi-reliable KeepAlives.
 645          * (since normal retransmission will handle any lost keepalive segments
 646          * , brilliant)
 647          */
 648         if( (seglen<=1) && EQ_SEQ(seq, (ual1->nextseq-1)) ){
 649                 if(!(flags&TH_FIN)){ /* FIN segments are not keepalives */
 650                         struct tcp_acked *ta;
 651
 652                         ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 653                         ta->flags|=TCP_A_KEEP_ALIVE;
 654                         ual1->flags|=TCP_A_KEEP_ALIVE;
 655                         goto seq_finished;
 656                 }
 657         }
 658
 659
 660         /* if this is an empty segment, just skip it all */
 661         if( !seglen ){
 662                 goto seq_finished;
 663         }
 664
 665         /* check if the sequence number is lower than expected, i.e. retransmission */
 666         if( LT_SEQ(seq, ual1->nextseq )){
 667                 struct tcp_acked *ta;
 668
 669                 ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 670                 ta->flags|=TCP_A_RETRANSMISSION;
 671
 672                 /* did this segment contain any more data we havent seen yet?
 673                  * if so we can just increase nextseq
 674                  */
 675                 if(GT_SEQ((seq+seglen), ual1->nextseq)){
 676                         ual1->nextseq=seq+seglen;
 677                         ual1->frame=pinfo->fd->num;
 678                         ual1->ts.secs=pinfo->fd->abs_secs;
 679                         ual1->ts.nsecs=pinfo->fd->abs_usecs*1000;
 680                 }
 681                 goto seq_finished;
 682         }
 683
 684         /* just add the segment to the beginning of the list */
 685         ual=g_mem_chunk_alloc(tcp_unacked_chunk);
 686         ual->next=ual1;
 687         ual->frame=pinfo->fd->num;
 688         ual->ack_frame=0;
 689         ual->ack=0;
 690         ual->num_acks=0;
 691         ual->seq=seq;
 692         ual->nextseq=seq+seglen;
 693         ual->ts.secs=pinfo->fd->abs_secs;
 694         ual->ts.nsecs=pinfo->fd->abs_usecs*1000;
 695         ual->window=window;
 696         ual->flags=0;
 697         ual1=ual;
 698
 699 seq_finished:
 700
 701
 702         /* handle the ack numbers */
 703
 704         /* if we dont have the ack flag its not much we can do */
 705         if( !(flags&TH_ACK)){
 706                 goto ack_finished;
 707         }
 708
 709         /* if we havent seen anything yet in the other direction we dont
 710          * know what this one acks */
 711         if( !ual2 ){
 712                 goto ack_finished;
 713         }
 714
 715         /* if we dont have any real segments in the other direction not
 716          * acked yet (as we see from the magic frame==0 entry)
 717          * then there is no point in continuing
 718          */
 719         if( !ual2->frame ){
 720                 goto ack_finished;
 721         }
 722
 723         /* if we get here we know ual2 is valid */
 724
 725         /* if we are acking beyong what we have seen in the other direction
 726          * we must have lost packets. Not much point in keeping the segments
 727          * in the other direction either.
 728          */
 729         if( GT_SEQ(ack, ual2->nextseq )){
 730                 struct tcp_acked *ta;
 731
 732                 ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 733                 ta->flags|=TCP_A_ACK_LOST_PACKET;
 734                 for(ual=ual2;ual2;ual2=ual){
 735                         ual=ual2->next;
 736                         g_mem_chunk_free(tcp_unacked_chunk, ual2);
 737                 }
 738                 prune_next_pdu_list(tnp, ack-base_ack);
 739                 goto ack_finished;
 740         }
 741
 742
 743         /* does this ACK ack all semgents we have seen in the other direction?*/
 744         if( EQ_SEQ(ack, ual2->nextseq )){
 745                 struct tcp_acked *ta;
 746
 747                 ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 748                 ta->frame_acked=ual2->frame;
 749                 ta->ts.secs=pinfo->fd->abs_secs-ual2->ts.secs;
 750                 ta->ts.nsecs=pinfo->fd->abs_usecs*1000-ual2->ts.nsecs;
 751                 if(ta->ts.nsecs<0){
 752                         ta->ts.nsecs+=1000000000;
 753                         ta->ts.secs--;
 754                 }
 755
 756                 /* its all been ACKed so we dont need to keep them anymore */
 757                 for(ual=ual2;ual2;ual2=ual){
 758                         ual=ual2->next;
 759                         g_mem_chunk_free(tcp_unacked_chunk, ual2);
 760                 }
 761                 prune_next_pdu_list(tnp, ack-base_ack);
 762                 goto ack_finished;
 763         }
 764
 765         /* ok it only ACKs part of what we have seen. Find out how much
 766          * update and remove the ACKed segments
 767          */
 768         for(ual=ual2;ual->next;ual=ual->next){
 769                 if( GE_SEQ(ack, ual->next->nextseq)){
 770                         break;
 771                 }
 772         }
 773         if(ual->next){
 774                 struct tcp_unacked *tmpual=NULL;
 775                 struct tcp_unacked *ackedual=NULL;
 776                 struct tcp_acked *ta;
 777
 778                 /* XXX normal ACK*/
 779                 ackedual=ual->next;
 780
 781                 ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 782                 ta->frame_acked=ackedual->frame;
 783                 ta->ts.secs=pinfo->fd->abs_secs-ackedual->ts.secs;
 784                 ta->ts.nsecs=pinfo->fd->abs_usecs*1000-ackedual->ts.nsecs;
 785                 if(ta->ts.nsecs<0){
 786                         ta->ts.nsecs+=1000000000;
 787                         ta->ts.secs--;
 788                 }
 789
 790                 /* just delete all ACKed segments */
 791                 tmpual=ual->next;
 792                 ual->next=NULL;
 793                 for(ual=tmpual;ual;ual=tmpual){
 794                         tmpual=ual->next;
 795                         g_mem_chunk_free(tcp_unacked_chunk, ual);
 796                 }
 797                 prune_next_pdu_list(tnp, ack-base_ack);
 798         }
 799
 800 ack_finished:
 801         /* we might have deleted the entire ual2 list, if this is an ACK,
 802            make sure ual2 at least has a dummy entry for the current ACK */
 803         if( (!ual2) && (flags&TH_ACK) ){
 804                 ual2=g_mem_chunk_alloc(tcp_unacked_chunk);
 805                 ual2->next=NULL;
 806                 ual2->frame=0;
 807                 ual2->ack_frame=0;
 808                 ual2->ack=0;
 809                 ual2->num_acks=0;
 810                 ual2->seq=ack;
 811                 ual2->nextseq=ack;
 812                 ual2->ts.secs=0;
 813                 ual2->ts.nsecs=0;
 814                 ual2->window=window;
 815                 ual2->flags=0;
 816         }
 817
 818         /* update the ACK counter and check for
 819            duplicate ACKs*/
 820         /* go to the oldest segment in the list of segments
 821            in the other direction */
 822         /* XXX we should guarantee ual2 to always be non NULL here
 823            so we can skip the ual/ual2 tests */
 824         for(ual=ual2;ual&&ual->next;ual=ual->next)
 825                 ;
 826         if(ual2){
 827                 /* we only consider this being a potential duplicate ack
 828                    if the segment length is 0 (ack only segment)
 829                    and if it acks something previous to oldest segment
 830                    in the other direction */
 831                 if((!seglen)&&LE_SEQ(ack,ual->seq)){
 832                         /* if this is the first ack to keep track of, it is not
 833                            a duplicate */
 834                         if(ual->num_acks==0){
 835                                 ual->ack=ack;
 836                                 ual->ack_frame=pinfo->fd->num;
 837                                 ual->num_acks=1;
 838                         /* if this ack is different, store this one
 839                            instead and forget the previous one(s) */
 840                         } else if(ual->ack!=ack){
 841                                 ual->ack=ack;
 842                                 ual->ack_frame=pinfo->fd->num;
 843                                 ual->num_acks=1;
 844                         /* this has to be a duplicate ack */
 845                         } else {
 846                                 ual->num_acks++;
 847                         }
 848
 849                         /* is this an ACK to a KeepAlive? */
 850                         if( (ual->flags&TCP_A_KEEP_ALIVE)
 851                         && (ack==ual->seq) ){
 852                                 struct tcp_acked *ta;
 853                                 ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 854                                 ta->flags|=TCP_A_KEEP_ALIVE_ACK;
 855                                 ual->flags^=TCP_A_KEEP_ALIVE;
 856                         } else if(ual->num_acks>1) {
 857                         /* ok we have found a potential duplicate ack */
 858                                 struct tcp_acked *ta;
 859                                 ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 860                                 /* keepalives are not dupacks */
 861                                 if( (!(ta->flags&TCP_A_KEEP_ALIVE)) ){
 862                                         ta->flags|=TCP_A_DUPLICATE_ACK;
 863                                         ta->dupack_num=ual->num_acks-1;
 864                                         ta->dupack_frame=ual->ack_frame;
 865                                 }
 866                         }
 867                 }
 868
 869         }
 870
 871
 872         /* check for zero window probes
 873            a zero window probe is when a TCP tries to write 1 byte segments
 874            where the remote side has advertised a window of 0 bytes.
 875            We only do this check if we actually have seen anything from the
 876            other side of this connection.
 877
 878            We also assume ual still points to the last entry in the ual2
 879            list from the section above.
 880
 881            At the same time, check for violations, i.e. attempts to write >1
 882            byte to a zero-window.
 883         */
 884         /* XXX we should not need to do the ual->frame check here?
 885            might be a bug somewhere. look for it later .
 886         */
 887         if(ual2&&(ual->frame)){
 888                 if((seglen==1)&&(ual->window==0)){
 889                         struct tcp_acked *ta;
 890                         ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 891                         ta->flags|=TCP_A_ZERO_WINDOW_PROBE;
 892                 }
 893                 if((seglen>1)&&(ual->window==0)){
 894                         struct tcp_acked *ta;
 895                         ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 896                         ta->flags|=TCP_A_ZERO_WINDOW_VIOLATION;
 897                 }
 898         }
 899
 900         /* check for zero window */
 901         if(!window){
 902                 struct tcp_acked *ta;
 903                 ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
 904                 ta->flags|=TCP_A_ZERO_WINDOW;
 905         }
 906
 907
 908         /* store the lists back in our struct */
 909         if(direction>=0){
 910                 /*
 911                  * XXX - if direction == 0, that'll be true for packets
 912                  * from both sides of the connection, so this won't
 913                  * work.
 914                  *
 915                  * That'd be a connection from a given port on a machine
 916                  * to that same port on the same machine; does that ever
 917                  * happen?
 918                  */
 919                 tcpd->ual1=ual1;
 920                 tcpd->ual2=ual2;
 921                 tcpd->base_seq1=base_seq;
 922         } else {
 923                 tcpd->ual1=ual2;
 924                 tcpd->ual2=ual1;
 925                 tcpd->base_seq2=base_seq;
 926         }
 927
 928
 929         if(tcp_relative_seq){
 930                 struct tcp_rel_seq *trs;
 931                 /* remember relative seq/ack number base for this packet */
 932                 trs=g_mem_chunk_alloc(tcp_rel_seq_chunk);
 933                 trs->seq_base=base_seq;
 934                 trs->ack_base=base_ack;
 935                 trs->win_scale=win_scale;
 936                 g_hash_table_insert(tcp_rel_seq_table, (void *)pinfo->fd->num, trs);
 937         }
 938 }
 939
 940 static void
 941 tcp_print_sequence_number_analysis(packet_info *pinfo, tvbuff_t *tvb, proto_tree *parent_tree)
 942 {
 943         struct tcp_acked *ta;
 944         proto_item *item;
 945         proto_tree *tree;
 946
 947         ta=tcp_analyze_get_acked_struct(pinfo->fd->num, FALSE);
 948         if(!ta){
 949                 return;
 950         }
 951
 952         item=proto_tree_add_text(parent_tree, tvb, 0, 0, "SEQ/ACK analysis");
 953         tree=proto_item_add_subtree(item, ett_tcp_analysis);
 954
 955         /* encapsulate all proto_tree_add_xxx in ifs so we only print what
 956            data we actually have */
 957         if(ta->frame_acked){
 958                 proto_tree_add_uint(tree, hf_tcp_analysis_acks_frame,
 959                         tvb, 0, 0, ta->frame_acked);
 960         }
 961         if( ta->ts.secs || ta->ts.nsecs ){
 962                 proto_tree_add_time(tree, hf_tcp_analysis_ack_rtt,
 963                 tvb, 0, 0, &ta->ts);
 964         }
 965
 966         if(ta->flags){
 967                 proto_item *flags_item=NULL;
 968                 proto_tree *flags_tree=NULL;
 969
 970                 flags_item = proto_tree_add_item(tree, hf_tcp_analysis_flags, tvb, 0, -1, FALSE);
 971                 flags_tree=proto_item_add_subtree(flags_item, ett_tcp_analysis);
 972                 if( ta->flags&TCP_A_RETRANSMISSION ){
 973                         proto_tree_add_none_format(flags_tree, hf_tcp_analysis_retransmission, tvb, 0, 0, "This frame is a (suspected) retransmission");
 974                         if(check_col(pinfo->cinfo, COL_INFO)){
 975                                 col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP Retransmission] ");
 976                         }
 977                 }
 978                 if( ta->flags&TCP_A_LOST_PACKET ){
 979                         proto_tree_add_none_format(flags_tree, hf_tcp_analysis_lost_packet, tvb, 0, 0, "A segment before this frame was lost");
 980                         if(check_col(pinfo->cinfo, COL_INFO)){
 981                                 col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP Previous segment lost] ");
 982                         }
 983                 }
 984                 if( ta->flags&TCP_A_ACK_LOST_PACKET ){
 985                         proto_tree_add_none_format(flags_tree, hf_tcp_analysis_ack_lost_packet, tvb, 0, 0, "This frame ACKs a segment we have not seen (lost?)");
 986                         if(check_col(pinfo->cinfo, COL_INFO)){
 987                                 col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP ACKed lost segment] ");
 988                         }
 989                 }
 990                 if( ta->flags&TCP_A_KEEP_ALIVE ){
 991                         proto_tree_add_none_format(flags_tree, hf_tcp_analysis_keep_alive, tvb, 0, 0, "This is a TCP keep-alive segment");
 992                         if(check_col(pinfo->cinfo, COL_INFO)){
 993                                 col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP Keep-Alive] ");
 994                         }
 995                 }
 996                 if( ta->flags&TCP_A_KEEP_ALIVE_ACK ){
 997                         proto_tree_add_none_format(flags_tree, hf_tcp_analysis_keep_alive_ack, tvb, 0, 0, "This is an ACK to a TCP keep-alive segment");
 998                         if(check_col(pinfo->cinfo, COL_INFO)){
 999                                 col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP Keep-Alive ACK] ");
1000                         }
1001                 }
1002                 if( ta->dupack_num){
1003                         if( ta->flags&TCP_A_DUPLICATE_ACK ){
1004                                 proto_tree_add_none_format(flags_tree, hf_tcp_analysis_duplicate_ack, tvb, 0, 0, "This is a TCP duplicate ack");
1005                                 if(check_col(pinfo->cinfo, COL_INFO)){
1006                                         col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP Dup ACK %d#%d] ", ta->dupack_frame, ta->dupack_num);
1007                                 }
1008                         }
1009                         proto_tree_add_uint(tree, hf_tcp_analysis_duplicate_ack_num,
1010                                 tvb, 0, 0, ta->dupack_num);
1011                         proto_tree_add_uint(tree, hf_tcp_analysis_duplicate_ack_frame,
1012                                 tvb, 0, 0, ta->dupack_frame);
1013                 }
1014                 if( ta->flags&TCP_A_ZERO_WINDOW_PROBE ){
1015                         proto_tree_add_none_format(flags_tree, hf_tcp_analysis_zero_window_probe, tvb, 0, 0, "This is a TCP zero-window-probe");
1016                         if(check_col(pinfo->cinfo, COL_INFO)){
1017                                 col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP ZeroWindowProbe] ");
1018                         }
1019                 }
1020                 if( ta->flags&TCP_A_ZERO_WINDOW ){
1021                         proto_tree_add_none_format(flags_tree, hf_tcp_analysis_zero_window, tvb, 0, 0, "This is a ZeroWindow segment");
1022                         if(check_col(pinfo->cinfo, COL_INFO)){
1023                                 col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP ZeroWindow] ");
1024                         }
1025                 }
1026                 if( ta->flags&TCP_A_ZERO_WINDOW_VIOLATION ){
1027                         proto_tree_add_none_format(flags_tree, hf_tcp_analysis_zero_window_violation, tvb, 0, 0, "This is a ZeroWindow violation, attempts to write >1 byte of data to a zero-window");
1028                         if(check_col(pinfo->cinfo, COL_INFO)){
1029                                 col_prepend_fstr(pinfo->cinfo, COL_INFO, "[TCP ZeroWindowViolation] ");
1030                         }
1031                 }
1032         }
1033
1034 }
1035
1036
1037 /* Do we still need to do this ...remove_all() even though we dont need
1038  * to do anything special?  The glib docs are not clear on this and
1039  * its better safe than sorry
1040  */
1041 static gboolean
1042 free_all_acked(gpointer key_arg _U_, gpointer value _U_, gpointer user_data _U_)
1043 {
1044         return TRUE;
1045 }
1046
1047 static guint
1048 tcp_acked_hash(gconstpointer k)
1049 {
1050         guint32 frame = (guint32)k;
1051
1052         return frame;
1053 }
1054 static gint
1055 tcp_acked_equal(gconstpointer k1, gconstpointer k2)
1056 {
1057         guint32 frame1 = (guint32)k1;
1058         guint32 frame2 = (guint32)k2;
1059
1060         return frame1==frame2;
1061 }
1062
1063 static void
1064 tcp_analyze_seq_init(void)
1065 {
1066         /* first destroy the tables */
1067         if( tcp_analyze_acked_table ){
1068                 g_hash_table_foreach_remove(tcp_analyze_acked_table,
1069                         free_all_acked, NULL);
1070                 g_hash_table_destroy(tcp_analyze_acked_table);
1071                 tcp_analyze_acked_table = NULL;
1072         }
1073         if( tcp_rel_seq_table ){
1074                 g_hash_table_foreach_remove(tcp_rel_seq_table,
1075                         free_all_acked, NULL);
1076                 g_hash_table_destroy(tcp_rel_seq_table);
1077                 tcp_rel_seq_table = NULL;
1078         }
1079         if( tcp_pdu_tracking_table ){
1080                 g_hash_table_foreach_remove(tcp_pdu_tracking_table,
1081                         free_all_acked, NULL);
1082                 g_hash_table_destroy(tcp_pdu_tracking_table);
1083                 tcp_pdu_tracking_table = NULL;
1084         }
1085
1086         /*
1087          * Now destroy the chunk from which the conversation table
1088          * structures were allocated.
1089          */
1090         if (tcp_next_pdu_chunk) {
1091                 g_mem_chunk_destroy(tcp_next_pdu_chunk);
1092                 tcp_next_pdu_chunk = NULL;
1093         }
1094         if (tcp_analysis_chunk) {
1095                 g_mem_chunk_destroy(tcp_analysis_chunk);
1096                 tcp_analysis_chunk = NULL;
1097         }
1098         if (tcp_unacked_chunk) {
1099                 g_mem_chunk_destroy(tcp_unacked_chunk);
1100                 tcp_unacked_chunk = NULL;
1101         }
1102         if (tcp_acked_chunk) {
1103                 g_mem_chunk_destroy(tcp_acked_chunk);
1104                 tcp_acked_chunk = NULL;
1105         }
1106         if (tcp_rel_seq_chunk) {
1107                 g_mem_chunk_destroy(tcp_rel_seq_chunk);
1108                 tcp_rel_seq_chunk = NULL;
1109         }
1110
1111         if(tcp_analyze_seq){
1112                 tcp_analyze_acked_table = g_hash_table_new(tcp_acked_hash,
1113                         tcp_acked_equal);
1114                 tcp_rel_seq_table = g_hash_table_new(tcp_acked_hash,
1115                         tcp_acked_equal);
1116                 tcp_pdu_tracking_table = g_hash_table_new(tcp_acked_hash,
1117                         tcp_acked_equal);
1118                 tcp_next_pdu_chunk = g_mem_chunk_new("tcp_next_pdu_chunk",
1119                         sizeof(struct tcp_next_pdu),
1120                         tcp_next_pdu_count * sizeof(struct tcp_next_pdu),
1121                         G_ALLOC_ONLY);
1122                 tcp_analysis_chunk = g_mem_chunk_new("tcp_analysis_chunk",
1123                         sizeof(struct tcp_analysis),
1124                         tcp_analysis_count * sizeof(struct tcp_analysis),
1125                         G_ALLOC_ONLY);
1126                 tcp_unacked_chunk = g_mem_chunk_new("tcp_unacked_chunk",
1127                         sizeof(struct tcp_unacked),
1128                         tcp_unacked_count * sizeof(struct tcp_unacked),
1129                         G_ALLOC_ONLY);
1130                 tcp_acked_chunk = g_mem_chunk_new("tcp_acked_chunk",
1131                         sizeof(struct tcp_acked),
1132                         tcp_acked_count * sizeof(struct tcp_acked),
1133                         G_ALLOC_ONLY);
1134                 if(tcp_relative_seq){
1135                         tcp_rel_seq_chunk = g_mem_chunk_new("tcp_rel_seq_chunk",
1136                                 sizeof(struct tcp_rel_seq),
1137                                 tcp_rel_seq_count * sizeof(struct tcp_rel_seq),
1138                                 G_ALLOC_ONLY);
1139                 }
1140         }
1141
1142 }
1143
1144 /* **************************************************************************
1145  * End of tcp sequence number analysis
1146  * **************************************************************************/
1147
1148
1149
1150
1151 /* Minimum TCP header length. */
1152 #define TCPH_MIN_LEN    20
1153
1154 /*
1155  *      TCP option
1156  */
1157
1158 #define TCPOPT_NOP              1       /* Padding */
1159 #define TCPOPT_EOL              0       /* End of options */
1160 #define TCPOPT_MSS              2       /* Segment size negotiating */
1161 #define TCPOPT_WINDOW           3       /* Window scaling */
1162 #define TCPOPT_SACK_PERM        4       /* SACK Permitted */
1163 #define TCPOPT_SACK             5       /* SACK Block */
1164 #define TCPOPT_ECHO             6
1165 #define TCPOPT_ECHOREPLY        7
1166 #define TCPOPT_TIMESTAMP        8       /* Better RTT estimations/PAWS */
1167 #define TCPOPT_CC               11
1168 #define TCPOPT_CCNEW            12
1169 #define TCPOPT_CCECHO           13
1170 #define TCPOPT_MD5              19      /* RFC2385 */
1171
1172 /*
1173  *     TCP option lengths
1174  */
1175
1176 #define TCPOLEN_MSS            4
1177 #define TCPOLEN_WINDOW         3
1178 #define TCPOLEN_SACK_PERM      2
1179 #define TCPOLEN_SACK_MIN       2
1180 #define TCPOLEN_ECHO           6
1181 #define TCPOLEN_ECHOREPLY      6
1182 #define TCPOLEN_TIMESTAMP      10
1183 #define TCPOLEN_CC             6
1184 #define TCPOLEN_CCNEW          6
1185 #define TCPOLEN_CCECHO         6
1186 #define TCPOLEN_MD5            18
1187
1188
1189
1190 /* Desegmentation of TCP streams */
1191 /* table to hold defragmented TCP streams */
1192 static GHashTable *tcp_fragment_table = NULL;
1193 static void
1194 tcp_fragment_init(void)
1195 {
1196         fragment_table_init(&tcp_fragment_table);
1197 }
1198
1199 /* functions to trace tcp segments */
1200 /* Enable desegmenting of TCP streams */
1201 static gboolean tcp_desegment = FALSE;
1202
1203 static GHashTable *tcp_segment_table = NULL;
1204 static GMemChunk *tcp_segment_key_chunk = NULL;
1205 static int tcp_segment_init_count = 200;
1206 static GMemChunk *tcp_segment_address_chunk = NULL;
1207 static int tcp_segment_address_init_count = 500;
1208
1209 typedef struct _tcp_segment_key {
1210         /* for own bookkeeping inside packet-tcp.c */
1211         address *src;
1212         address *dst;
1213         guint32 seq;
1214         /* xxx */
1215         guint16 sport;
1216         guint16 dport;
1217         guint32 start_seq;
1218         guint32 tot_len;
1219         guint32 first_frame;
1220 } tcp_segment_key;
1221
1222 static gboolean
1223 free_all_segments(gpointer key_arg, gpointer value _U_, gpointer user_data _U_)
1224 {
1225         tcp_segment_key *key = key_arg;
1226
1227         if((key->src)&&(key->src->data)){
1228                 g_free((gpointer)key->src->data);
1229                 key->src->data=NULL;
1230         }
1231
1232         if((key->dst)&&(key->dst->data)){
1233                 g_free((gpointer)key->dst->data);
1234                 key->dst->data=NULL;
1235         }
1236
1237         return TRUE;
1238 }
1239
1240 static guint
1241 tcp_segment_hash(gconstpointer k)
1242 {
1243         const tcp_segment_key *key = (const tcp_segment_key *)k;
1244
1245         return key->seq+key->sport;
1246 }
1247
1248 static gint
1249 tcp_segment_equal(gconstpointer k1, gconstpointer k2)
1250 {
1251         const tcp_segment_key *key1 = (const tcp_segment_key *)k1;
1252         const tcp_segment_key *key2 = (const tcp_segment_key *)k2;
1253
1254         return ( ( (key1->seq==key2->seq)
1255                  &&(ADDRESSES_EQUAL(key1->src, key2->src))
1256                  &&(ADDRESSES_EQUAL(key1->dst, key2->dst))
1257                  &&(key1->sport==key2->sport)
1258                  &&(key1->dport==key2->dport)
1259                  ) ? TRUE:FALSE);
1260 }
1261
1262 static void
1263 tcp_desegment_init(void)
1264 {
1265         /*
1266          * Free this before freeing any memory chunks; those
1267          * chunks contain data we'll look at in "free_all_segments()".
1268          */
1269         if(tcp_segment_table){
1270                 g_hash_table_foreach_remove(tcp_segment_table,
1271                         free_all_segments, NULL);
1272                 g_hash_table_destroy(tcp_segment_table);
1273                 tcp_segment_table = NULL;
1274         }
1275
1276         if(tcp_segment_key_chunk){
1277                 g_mem_chunk_destroy(tcp_segment_key_chunk);
1278                 tcp_segment_key_chunk = NULL;
1279         }
1280         if(tcp_segment_address_chunk){
1281                 g_mem_chunk_destroy(tcp_segment_address_chunk);
1282                 tcp_segment_address_chunk = NULL;
1283         }
1284
1285         /* dont allocate any hash table or memory chunks unless the user
1286            really uses this option
1287         */
1288         if(!tcp_desegment){
1289                 return;
1290         }
1291
1292         tcp_segment_table = g_hash_table_new(tcp_segment_hash,
1293                 tcp_segment_equal);
1294
1295         tcp_segment_key_chunk = g_mem_chunk_new("tcp_segment_key_chunk",
1296                 sizeof(tcp_segment_key),
1297                 tcp_segment_init_count*sizeof(tcp_segment_key),
1298                 G_ALLOC_ONLY);
1299
1300         tcp_segment_address_chunk = g_mem_chunk_new("tcp_segment_address_chunk",
1301                 sizeof(address),
1302                 tcp_segment_address_init_count*sizeof(address),
1303                 G_ALLOC_ONLY);
1304 }
1305
1306 static void
1307 desegment_tcp(tvbuff_t *tvb, packet_info *pinfo, int offset,
1308                 guint32 seq, guint32 nxtseq,
1309                 guint32 sport, guint32 dport,
1310                 proto_tree *tree, proto_tree *tcp_tree)
1311 {
1312         struct tcpinfo *tcpinfo = pinfo->private_data;
1313         fragment_data *ipfd_head=NULL;
1314         tcp_segment_key old_tsk, *tsk;
1315         gboolean must_desegment = FALSE;
1316         gboolean called_dissector = FALSE;
1317         int deseg_offset;
1318         guint32 deseg_seq;
1319         gint nbytes;
1320
1321         /*
1322          * Initialize these to assume no desegmentation.
1323          * If that's not the case, these will be set appropriately
1324          * by the subdissector.
1325          */
1326         pinfo->desegment_offset = 0;
1327         pinfo->desegment_len = 0;
1328
1329         /*
1330          * Initialize this to assume that this segment will just be
1331          * added to the middle of a desegmented chunk of data, so
1332          * that we should show it all as data.
1333          * If that's not the case, it will be set appropriately.
1334          */
1335         deseg_offset = offset;
1336
1337         /* First we must check if this TCP segment should be desegmented.
1338            This is only to check if we should desegment this packet,
1339            so we dont spend time doing COPY_ADDRESS/g_free.
1340            We just "borrow" some address structures from pinfo instead. Cheaper.
1341         */
1342         old_tsk.src = &pinfo->src;
1343         old_tsk.dst = &pinfo->dst;
1344         old_tsk.sport = sport;
1345         old_tsk.dport = dport;
1346         old_tsk.seq = seq;
1347         tsk = g_hash_table_lookup(tcp_segment_table, &old_tsk);
1348
1349         if(tsk){
1350                 /* OK, this segment was found, which means it continues
1351                    a higher-level PDU. This means we must desegment it.
1352                    Add it to the defragmentation lists.
1353                 */
1354                 ipfd_head = fragment_add(tvb, offset, pinfo, tsk->first_frame,
1355                         tcp_fragment_table,
1356                         seq - tsk->start_seq,
1357                         nxtseq - seq,
1358                         (LT_SEQ (nxtseq,tsk->start_seq + tsk->tot_len)) );
1359
1360                 if(!ipfd_head){
1361                         /* fragment_add() returned NULL, This means that
1362                            desegmentation is not completed yet.
1363                            (its like defragmentation but we know we will
1364                             always add the segments in order).
1365                            XXX - no, we don't; there is no guarantee that
1366                            TCP segments are in order on the wire.
1367
1368                            we must add next segment to our table so we will
1369                            find it later.
1370                         */
1371                         tcp_segment_key *new_tsk;
1372
1373                         new_tsk = g_mem_chunk_alloc(tcp_segment_key_chunk);
1374                         memcpy(new_tsk, tsk, sizeof(tcp_segment_key));
1375                         new_tsk->seq=nxtseq;
1376                         g_hash_table_insert(tcp_segment_table,new_tsk,new_tsk);
1377                 }
1378         } else {
1379                 /* This segment was not found in our table, so it doesn't
1380                    contain a continuation of a higher-level PDU.
1381                    Call the normal subdissector.
1382                 */
1383                 decode_tcp_ports(tvb, offset, pinfo, tree,
1384                                 sport, dport, 0);
1385                 called_dissector = TRUE;
1386
1387                 /* Did the subdissector ask us to desegment some more data
1388                    before it could handle the packet?
1389                    If so we have to create some structures in our table but
1390                    this is something we only do the first time we see this
1391                    packet.
1392                 */
1393                 if(pinfo->desegment_len) {
1394                         if (!pinfo->fd->flags.visited)
1395                                 must_desegment = TRUE;
1396
1397                         /*
1398                          * Set "deseg_offset" to the offset in "tvb"
1399                          * of the first byte of data that the
1400                          * subdissector didn't process.
1401                          */
1402                         deseg_offset = offset + pinfo->desegment_offset;
1403                 }
1404
1405                 /* Either no desegmentation is necessary, or this is
1406                    segment contains the beginning but not the end of
1407                    a higher-level PDU and thus isn't completely
1408                    desegmented.
1409                 */
1410                 ipfd_head = NULL;
1411         }
1412
1413         /* is it completely desegmented? */
1414         if(ipfd_head){
1415                 fragment_data *ipfd;
1416
1417                 /*
1418                  * Yes, we think it is.
1419                  * We only call subdissector for the last segment.
1420                  * Note that the last segment may include more than what
1421                  * we needed.
1422                  */
1423                 if(GE_SEQ(nxtseq, tsk->start_seq + tsk->tot_len)){
1424                         /*
1425                          * OK, this is the last segment.
1426                          * Let's call the subdissector with the desegmented
1427                          * data.
1428                          */
1429                         tvbuff_t *next_tvb;
1430                         int old_len;
1431
1432                         /* create a new TVB structure for desegmented data */
1433                         next_tvb = tvb_new_real_data(ipfd_head->data,
1434                                         ipfd_head->datalen, ipfd_head->datalen);
1435
1436                         /* add this tvb as a child to the original one */
1437                         tvb_set_child_real_data_tvbuff(tvb, next_tvb);
1438
1439                         /* add desegmented data to the data source list */
1440                         add_new_data_source(pinfo, next_tvb, "Desegmented");
1441
1442                         /*
1443                          * Supply the sequence number of the first of the
1444                          * reassembled bytes.
1445                          */
1446                         tcpinfo->seq = tsk->start_seq;
1447
1448                         /* indicate that this is reassembled data */
1449                         tcpinfo->is_reassembled = TRUE;
1450
1451                         /* call subdissector */
1452                         decode_tcp_ports(next_tvb, 0, pinfo, tree,
1453                                 sport, dport, 0);
1454                         called_dissector = TRUE;
1455
1456                         /*
1457                          * OK, did the subdissector think it was completely
1458                          * desegmented, or does it think we need even more
1459                          * data?
1460                          */
1461                         old_len=(int)(tvb_reported_length(next_tvb)-tvb_reported_length_remaining(tvb, offset));
1462                         if(pinfo->desegment_len &&
1463                             pinfo->desegment_offset<=old_len){
1464                                 tcp_segment_key *new_tsk;
1465
1466                                 /*
1467                                  * "desegment_len" isn't 0, so it needs more
1468                                  * data for something - and "desegment_offset"
1469                                  * is before "old_len", so it needs more data
1470                                  * to dissect the stuff we thought was
1471                                  * completely desegmented (as opposed to the
1472                                  * stuff at the beginning being completely
1473                                  * desegmented, but the stuff at the end
1474                                  * being a new higher-level PDU that also
1475                                  * needs desegmentation).
1476                                  */
1477                                 fragment_set_partial_reassembly(pinfo,tsk->first_frame,tcp_fragment_table);
1478                                 tsk->tot_len = tvb_reported_length(next_tvb) + pinfo->desegment_len;
1479
1480                                 /*
1481                                  * Update tsk structure.
1482                                  * Can ask ->next->next because at least there's a hdr and one
1483                                  * entry in fragment_add()
1484                                  */
1485                                 for(ipfd=ipfd_head->next; ipfd->next; ipfd=ipfd->next){
1486                                         old_tsk.seq = tsk->start_seq + ipfd->offset;
1487                                         new_tsk = g_hash_table_lookup(tcp_segment_table, &old_tsk);
1488                                         new_tsk->tot_len = tsk->tot_len;
1489                                 }
1490
1491                                 /* this is the next segment in the sequence we want */
1492                                 new_tsk = g_mem_chunk_alloc(tcp_segment_key_chunk);
1493                                 memcpy(new_tsk, tsk, sizeof(tcp_segment_key));
1494                                 new_tsk->seq = nxtseq;
1495                                 g_hash_table_insert(tcp_segment_table,new_tsk,new_tsk);
1496                         } else {
1497                                 /*
1498                                  * Show the stuff in this TCP segment as
1499                                  * just raw TCP segment data.
1500                                  */
1501                                 nbytes =
1502                                     tvb_reported_length_remaining(tvb, offset);
1503                                 proto_tree_add_text(tcp_tree, tvb, offset, -1,
1504                                     "TCP segment data (%u byte%s)", nbytes,
1505                                     plurality(nbytes, "", "s"));
1506
1507                                 /*
1508                                  * The subdissector thought it was completely
1509                                  * desegmented (although the stuff at the
1510                                  * end may, in turn, require desegmentation),
1511                                  * so we show a tree with all segments.
1512                                  */
1513                                 show_fragment_tree(ipfd_head, &tcp_segment_items,
1514                                         tcp_tree, pinfo, next_tvb);
1515
1516                                 /* Did the subdissector ask us to desegment
1517                                    some more data?  This means that the data
1518                                    at the beginning of this segment completed
1519                                    a higher-level PDU, but the data at the
1520                                    end of this segment started a higher-level
1521                                    PDU but didn't complete it.
1522
1523                                    If so, we have to create some structures
1524                                    in our table, but this is something we
1525                                    only do the first time we see this packet.
1526                                 */
1527                                 if(pinfo->desegment_len) {
1528                                         if (!pinfo->fd->flags.visited)
1529                                                 must_desegment = TRUE;
1530
1531                                         /* The stuff we couldn't dissect
1532                                            must have come from this segment,
1533                                            so it's all in "tvb".
1534
1535                                            "pinfo->desegment_offset" is
1536                                            relative to the beginning of
1537                                            "next_tvb"; we want an offset
1538                                            relative to the beginning of "tvb".
1539
1540                                            First, compute the offset relative
1541                                            to the *end* of "next_tvb" - i.e.,
1542                                            the number of bytes before the end
1543                                            of "next_tvb" at which the
1544                                            subdissector stopped.  That's the
1545                                            length of "next_tvb" minus the
1546                                            offset, relative to the beginning
1547                                            of "next_tvb, at which the
1548                                            subdissector stopped.
1549                                         */
1550                                         deseg_offset =
1551                                             ipfd_head->datalen - pinfo->desegment_offset;
1552
1553                                         /* "tvb" and "next_tvb" end at the
1554                                            same byte of data, so the offset
1555                                            relative to the end of "next_tvb"
1556                                            of the byte at which we stopped
1557                                            is also the offset relative to
1558                                            the end of "tvb" of the byte at
1559                                            which we stopped.
1560
1561                                            Convert that back into an offset
1562                                            relative to the beginninng of
1563                                            "tvb", by taking the length of
1564                                            "tvb" and subtracting the offset
1565                                            relative to the end.
1566                                         */
1567                                         deseg_offset=tvb_reported_length(tvb) - deseg_offset;
1568                                 }
1569                         }
1570                 }
1571         }
1572
1573         if (must_desegment) {
1574             tcp_segment_key *tsk, *new_tsk;
1575
1576             /*
1577              * The sequence number at which the stuff to be desegmented
1578              * starts is the sequence number of the byte at an offset
1579              * of "deseg_offset" into "tvb".
1580              *
1581              * The sequence number of the byte at an offset of "offset"
1582              * is "seq", i.e. the starting sequence number of this
1583              * segment, so the sequence number of the byte at
1584              * "deseg_offset" is "seq + (deseg_offset - offset)".
1585              */
1586             deseg_seq = seq + (deseg_offset - offset);
1587
1588             /*
1589              * XXX - how do we detect out-of-order transmissions?
1590              * We can't just check for "nxtseq" being greater than
1591              * "tsk->start_seq"; for now, we check for the difference
1592              * being less than a megabyte, but this is a really
1593              * gross hack - we really need to handle out-of-order
1594              * transmissions correctly.
1595              */
1596             if ((nxtseq - deseg_seq) <= 1024*1024) {
1597                 /* OK, subdissector wants us to desegment
1598                    some data before it can process it. Add
1599                    what remains of this packet and set
1600                    up next packet/sequence number as well.
1601
1602                    We must remember this segment
1603                 */
1604                 tsk = g_mem_chunk_alloc(tcp_segment_key_chunk);
1605                 tsk->src = g_mem_chunk_alloc(tcp_segment_address_chunk);
1606                 COPY_ADDRESS(tsk->src, &pinfo->src);
1607                 tsk->dst = g_mem_chunk_alloc(tcp_segment_address_chunk);
1608                 COPY_ADDRESS(tsk->dst, &pinfo->dst);
1609                 tsk->seq = deseg_seq;
1610                 tsk->start_seq = tsk->seq;
1611                 tsk->tot_len = nxtseq - tsk->start_seq + pinfo->desegment_len;
1612                 tsk->first_frame = pinfo->fd->num;
1613                 tsk->sport=sport;
1614                 tsk->dport=dport;
1615                 g_hash_table_insert(tcp_segment_table, tsk, tsk);
1616
1617                 /* Add portion of segment unprocessed by the subdissector
1618                    to defragmentation lists */
1619                 fragment_add(tvb, deseg_offset, pinfo, tsk->first_frame,
1620                     tcp_fragment_table,
1621                     tsk->seq - tsk->start_seq,
1622                     nxtseq - tsk->start_seq,
1623                     LT_SEQ (nxtseq, tsk->start_seq + tsk->tot_len));
1624
1625                 /* this is the next segment in the sequence we want */
1626                 new_tsk = g_mem_chunk_alloc(tcp_segment_key_chunk);
1627                 memcpy(new_tsk, tsk, sizeof(tcp_segment_key));
1628                 new_tsk->seq = nxtseq;
1629                 g_hash_table_insert(tcp_segment_table,new_tsk,new_tsk);
1630             }
1631         }
1632
1633         if (!called_dissector || pinfo->desegment_len != 0) {
1634                 if (ipfd_head != NULL && ipfd_head->reassembled_in != 0) {
1635                         /*
1636                          * We know what frame this PDU is reassembled in;
1637                          * let the user know.
1638                          */
1639                         proto_tree_add_uint(tcp_tree, hf_tcp_reassembled_in,
1640                             tvb, 0, 0, ipfd_head->reassembled_in);
1641                 }
1642
1643                 /*
1644                  * Either we didn't call the subdissector at all (i.e.,
1645                  * this is a segment that contains the middle of a
1646                  * higher-level PDU, but contains neither the beginning
1647                  * nor the end), or the subdissector couldn't dissect it
1648                  * all, as some data was missing (i.e., it set
1649                  * "pinfo->desegment_len" to the amount of additional
1650                  * data it needs).
1651                  */
1652                 if (pinfo->desegment_offset == 0) {
1653                         /*
1654                          * It couldn't, in fact, dissect any of it (the
1655                          * first byte it couldn't dissect is at an offset
1656                          * of "pinfo->desegment_offset" from the beginning
1657                          * of the payload, and that's 0).
1658                          * Just mark this as TCP.
1659                          */
1660                         if (check_col(pinfo->cinfo, COL_PROTOCOL)){
1661                                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "TCP");
1662                         }
1663                         if (check_col(pinfo->cinfo, COL_INFO)){
1664                                 col_set_str(pinfo->cinfo, COL_INFO, "[Desegmented TCP]");
1665                         }
1666                 }
1667
1668                 /*
1669                  * Show what's left in the packet as just raw TCP segment
1670                  * data.
1671                  * XXX - remember what protocol the last subdissector
1672                  * was, and report it as a continuation of that, instead?
1673                  */
1674                 nbytes = tvb_reported_length_remaining(tvb, deseg_offset);
1675                 proto_tree_add_text(tcp_tree, tvb, deseg_offset, -1,
1676                     "TCP segment data (%u byte%s)", nbytes,
1677                     plurality(nbytes, "", "s"));
1678         }
1679         pinfo->can_desegment=0;
1680         pinfo->desegment_offset = 0;
1681         pinfo->desegment_len = 0;
1682 }
1683
1684 /*
1685  * Loop for dissecting PDUs within a TCP stream; assumes that a PDU
1686  * consists of a fixed-length chunk of data that contains enough information
1687  * to determine the length of the PDU, followed by rest of the PDU.
1688  *
1689  * The first three arguments are the arguments passed to the dissector
1690  * that calls this routine.
1691  *
1692  * "proto_desegment" is the dissector's flag controlling whether it should
1693  * desegment PDUs that cross TCP segment boundaries.
1694  *
1695  * "fixed_len" is the length of the fixed-length part of the PDU.
1696  *
1697  * "get_pdu_len()" is a routine called to get the length of the PDU from
1698  * the fixed-length part of the PDU; it's passed "tvb" and "offset".
1699  *
1700  * "dissect_pdu()" is the routine to dissect a PDU.
1701  */
1702 void
1703 tcp_dissect_pdus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1704                  gboolean proto_desegment, guint fixed_len,
1705                  guint (*get_pdu_len)(tvbuff_t *, int),
1706                  void (*dissect_pdu)(tvbuff_t *, packet_info *, proto_tree *))
1707 {
1708   volatile int offset = 0;
1709   int offset_before;
1710   guint length_remaining;
1711   guint plen;
1712   guint length;
1713   tvbuff_t *next_tvb;
1714
1715   while (tvb_reported_length_remaining(tvb, offset) != 0) {
1716     /*
1717      * We use "tvb_ensure_length_remaining()" to make sure there actually
1718      * *is* data remaining.  The protocol we're handling could conceivably
1719      * consists of a sequence of fixed-length PDUs, and therefore the
1720      * "get_pdu_len" routine might not actually fetch anything from
1721      * the tvbuff, and thus might not cause an exception to be thrown if
1722      * we've run past the end of the tvbuff.
1723      *
1724      * This means we're guaranteed that "length_remaining" is positive.
1725      */
1726     length_remaining = tvb_ensure_length_remaining(tvb, offset);
1727
1728     /*
1729      * Can we do reassembly?
1730      */
1731     if (proto_desegment && pinfo->can_desegment) {
1732       /*
1733        * Yes - is the fixed-length part of the PDU split across segment
1734        * boundaries?
1735        */
1736       if (length_remaining < fixed_len) {
1737         /*
1738          * Yes.  Tell the TCP dissector where the data for this message
1739          * starts in the data it handed us, and how many more bytes we
1740          * need, and return.
1741          */
1742         pinfo->desegment_offset = offset;
1743         pinfo->desegment_len = fixed_len - length_remaining;
1744         return;
1745       }
1746     }
1747
1748     /*
1749      * Get the length of the PDU.
1750      */
1751     plen = (*get_pdu_len)(tvb, offset);
1752     if (plen < fixed_len) {
1753       /*
1754        * The PDU length from the fixed-length portion probably didn't
1755        * include the fixed-length portion's length, and was probably so
1756        * large that the total length overflowed.
1757        *
1758        * Report this as an error.
1759        */
1760       show_reported_bounds_error(tvb, pinfo, tree);
1761       return;
1762     }
1763
1764     /*
1765      * Can we do reassembly?
1766      */
1767     if (proto_desegment && pinfo->can_desegment) {
1768       /*
1769        * Yes - is the PDU split across segment boundaries?
1770        */
1771       if (length_remaining < plen) {
1772         /*
1773          * Yes.  Tell the TCP dissector where the data for this message
1774          * starts in the data it handed us, and how many more bytes we
1775          * need, and return.
1776          */
1777         pinfo->desegment_offset = offset;
1778         pinfo->desegment_len = plen - length_remaining;
1779         return;
1780       }
1781     }
1782
1783     /*
1784      * Construct a tvbuff containing the amount of the payload we have
1785      * available.  Make its reported length the amount of data in the PDU.
1786      *
1787      * XXX - if reassembly isn't enabled. the subdissector will throw a
1788      * BoundsError exception, rather than a ReportedBoundsError exception.
1789      * We really want a tvbuff where the length is "length", the reported
1790      * length is "plen", and the "if the snapshot length were infinite"
1791      * length is the minimum of the reported length of the tvbuff handed
1792      * to us and "plen", with a new type of exception thrown if the offset
1793      * is within the reported length but beyond that third length, with
1794      * that exception getting the "Unreassembled Packet" error.
1795      */
1796     length = length_remaining;
1797     if (length > plen)
1798         length = plen;
1799     next_tvb = tvb_new_subset(tvb, offset, length, plen);
1800
1801     /*
1802      * Dissect the PDU.
1803      *
1804      * Catch the ReportedBoundsError exception; if this particular message
1805      * happens to get a ReportedBoundsError exception, that doesn't mean
1806      * that we should stop dissecting PDUs within this frame or chunk of
1807      * reassembled data.
1808      *
1809      * If it gets a BoundsError, we can stop, as there's nothing more to
1810      * see, so we just re-throw it.
1811      */
1812     TRY {
1813       (*dissect_pdu)(next_tvb, pinfo, tree);
1814     }
1815     CATCH(BoundsError) {
1816       RETHROW;
1817     }
1818     CATCH(ReportedBoundsError) {
1819       show_reported_bounds_error(tvb, pinfo, tree);
1820     }
1821     ENDTRY;
1822
1823     /*
1824      * Step to the next PDU.
1825      * Make sure we don't overflow.
1826      */
1827     offset_before = offset;
1828     offset += plen;
1829     if (offset <= offset_before)
1830       break;
1831   }
1832 }
1833
1834 static void
1835 tcp_info_append_uint(packet_info *pinfo, const char *abbrev, guint32 val)
1836 {
1837   if (check_col(pinfo->cinfo, COL_INFO))
1838     col_append_fstr(pinfo->cinfo, COL_INFO, " %s=%u", abbrev, val);
1839 }
1840
1841 static void
1842 dissect_tcpopt_maxseg(const ip_tcp_opt *optp, tvbuff_t *tvb,
1843     int offset, guint optlen, packet_info *pinfo, proto_tree *opt_tree)
1844 {
1845   guint16 mss;
1846
1847   mss = tvb_get_ntohs(tvb, offset + 2);
1848   proto_tree_add_boolean_hidden(opt_tree, hf_tcp_option_mss, tvb, offset,
1849                                 optlen, TRUE);
1850   proto_tree_add_uint_format(opt_tree, hf_tcp_option_mss_val, tvb, offset,
1851                              optlen, mss, "%s: %u bytes", optp->name, mss);
1852   tcp_info_append_uint(pinfo, "MSS", mss);
1853 }
1854
1855 static void
1856 dissect_tcpopt_wscale(const ip_tcp_opt *optp, tvbuff_t *tvb,
1857     int offset, guint optlen, packet_info *pinfo, proto_tree *opt_tree)
1858 {
1859   guint8 ws;
1860
1861   ws = tvb_get_guint8(tvb, offset + 2);
1862   proto_tree_add_boolean_hidden(opt_tree, hf_tcp_option_wscale, tvb,
1863                                 offset, optlen, TRUE);
1864   proto_tree_add_uint_format(opt_tree, hf_tcp_option_wscale_val, tvb,
1865                              offset, optlen, ws, "%s: %u (multiply by %u)",
1866                              optp->name, ws, 1 << ws);
1867   tcp_info_append_uint(pinfo, "WS", ws);
1868   if(!pinfo->fd->flags.visited){
1869     pdu_store_window_scale_option(pinfo, ws);
1870   }
1871 }
1872
1873 static void
1874 dissect_tcpopt_sack(const ip_tcp_opt *optp, tvbuff_t *tvb,
1875     int offset, guint optlen, packet_info *pinfo, proto_tree *opt_tree)
1876 {
1877   proto_tree *field_tree = NULL;
1878   proto_item *tf;
1879   guint leftedge, rightedge;
1880
1881   tf = proto_tree_add_text(opt_tree, tvb, offset,      optlen, "%s:", optp->name);
1882   offset += 2;  /* skip past type and length */
1883   optlen -= 2;  /* subtract size of type and length */
1884   while (optlen > 0) {
1885     if (field_tree == NULL) {
1886       /* Haven't yet made a subtree out of this option.  Do so. */
1887       field_tree = proto_item_add_subtree(tf, *optp->subtree_index);
1888       proto_tree_add_boolean_hidden(field_tree, hf_tcp_option_sack, tvb,
1889                                     offset, optlen, TRUE);
1890     }
1891     if (optlen < 4) {
1892       proto_tree_add_text(field_tree, tvb, offset,      optlen,
1893         "(suboption would go past end of option)");
1894       break;
1895     }
1896     leftedge = tvb_get_ntohl(tvb, offset);
1897     proto_tree_add_uint_format(field_tree, hf_tcp_option_sack_sle, tvb,
1898                                offset, 4, leftedge,
1899                                "left edge = %u", leftedge);
1900     optlen -= 4;
1901     if (optlen < 4) {
1902       proto_tree_add_text(field_tree, tvb, offset,      optlen,
1903         "(suboption would go past end of option)");
1904       break;
1905     }
1906     /* XXX - check whether it goes past end of packet */
1907     rightedge = tvb_get_ntohl(tvb, offset + 4);
1908     optlen -= 4;
1909     proto_tree_add_uint_format(field_tree, hf_tcp_option_sack_sre, tvb,
1910                                offset+4, 4, rightedge,
1911                                "right edge = %u", rightedge);
1912     tcp_info_append_uint(pinfo, "SLE", leftedge);
1913     tcp_info_append_uint(pinfo, "SRE", rightedge);
1914     offset += 8;
1915   }
1916 }
1917
1918 static void
1919 dissect_tcpopt_echo(const ip_tcp_opt *optp, tvbuff_t *tvb,
1920     int offset, guint optlen, packet_info *pinfo, proto_tree *opt_tree)
1921 {
1922   guint32 echo;
1923
1924   echo = tvb_get_ntohl(tvb, offset + 2);
1925   proto_tree_add_boolean_hidden(opt_tree, hf_tcp_option_echo, tvb, offset,
1926                                 optlen, TRUE);
1927   proto_tree_add_text(opt_tree, tvb, offset,      optlen,
1928                         "%s: %u", optp->name, echo);
1929   tcp_info_append_uint(pinfo, "ECHO", echo);
1930 }
1931
1932 static void
1933 dissect_tcpopt_timestamp(const ip_tcp_opt *optp, tvbuff_t *tvb,
1934     int offset, guint optlen, packet_info *pinfo, proto_tree *opt_tree)
1935 {
1936   guint32 tsv, tser;
1937
1938   tsv = tvb_get_ntohl(tvb, offset + 2);
1939   tser = tvb_get_ntohl(tvb, offset + 6);
1940   proto_tree_add_boolean_hidden(opt_tree, hf_tcp_option_time_stamp, tvb,
1941                                 offset, optlen, TRUE);
1942   proto_tree_add_text(opt_tree, tvb, offset,      optlen,
1943     "%s: tsval %u, tsecr %u", optp->name, tsv, tser);
1944   tcp_info_append_uint(pinfo, "TSV", tsv);
1945   tcp_info_append_uint(pinfo, "TSER", tser);
1946 }
1947
1948 static void
1949 dissect_tcpopt_cc(const ip_tcp_opt *optp, tvbuff_t *tvb,
1950     int offset, guint optlen, packet_info *pinfo, proto_tree *opt_tree)
1951 {
1952   guint32 cc;
1953
1954   cc = tvb_get_ntohl(tvb, offset + 2);
1955   proto_tree_add_boolean_hidden(opt_tree, hf_tcp_option_cc, tvb, offset,
1956                                 optlen, TRUE);
1957   proto_tree_add_text(opt_tree, tvb, offset,      optlen,
1958                         "%s: %u", optp->name, cc);
1959   tcp_info_append_uint(pinfo, "CC", cc);
1960 }
1961
1962 static const ip_tcp_opt tcpopts[] = {
1963   {
1964     TCPOPT_EOL,
1965     "EOL",
1966     NULL,
1967     NO_LENGTH,
1968     0,
1969     NULL,
1970   },
1971   {
1972     TCPOPT_NOP,
1973     "NOP",
1974     NULL,
1975     NO_LENGTH,
1976     0,
1977     NULL,
1978   },
1979   {
1980     TCPOPT_MSS,
1981     "Maximum segment size",
1982     NULL,
1983     FIXED_LENGTH,
1984     TCPOLEN_MSS,
1985     dissect_tcpopt_maxseg
1986   },
1987   {
1988     TCPOPT_WINDOW,
1989     "Window scale",
1990     NULL,
1991     FIXED_LENGTH,
1992     TCPOLEN_WINDOW,
1993     dissect_tcpopt_wscale
1994   },
1995   {
1996     TCPOPT_SACK_PERM,
1997     "SACK permitted",
1998     NULL,
1999     FIXED_LENGTH,
2000     TCPOLEN_SACK_PERM,
2001     NULL,
2002   },
2003   {
2004     TCPOPT_SACK,
2005     "SACK",
2006     &ett_tcp_option_sack,
2007     VARIABLE_LENGTH,
2008     TCPOLEN_SACK_MIN,
2009     dissect_tcpopt_sack
2010   },
2011   {
2012     TCPOPT_ECHO,
2013     "Echo",
2014     NULL,
2015     FIXED_LENGTH,
2016     TCPOLEN_ECHO,
2017     dissect_tcpopt_echo
2018   },
2019   {
2020     TCPOPT_ECHOREPLY,
2021     "Echo reply",
2022     NULL,
2023     FIXED_LENGTH,
2024     TCPOLEN_ECHOREPLY,
2025     dissect_tcpopt_echo
2026   },
2027   {
2028     TCPOPT_TIMESTAMP,
2029     "Time stamp",
2030     NULL,
2031     FIXED_LENGTH,
2032     TCPOLEN_TIMESTAMP,
2033     dissect_tcpopt_timestamp
2034   },
2035   {
2036     TCPOPT_CC,
2037     "CC",
2038     NULL,
2039     FIXED_LENGTH,
2040     TCPOLEN_CC,
2041     dissect_tcpopt_cc
2042   },
2043   {
2044     TCPOPT_CCNEW,
2045     "CC.NEW",
2046     NULL,
2047     FIXED_LENGTH,
2048     TCPOLEN_CCNEW,
2049     dissect_tcpopt_cc
2050   },
2051   {
2052     TCPOPT_CCECHO,
2053     "CC.ECHO",
2054     NULL,
2055     FIXED_LENGTH,
2056     TCPOLEN_CCECHO,
2057     dissect_tcpopt_cc
2058   },
2059   {
2060     TCPOPT_MD5,
2061     "TCP MD5 signature",
2062     NULL,
2063     FIXED_LENGTH,
2064     TCPOLEN_MD5,
2065     NULL
2066   }
2067 };
2068
2069 #define N_TCP_OPTS      (sizeof tcpopts / sizeof tcpopts[0])
2070
2071 /* Determine if there is a sub-dissector and call it.  This has been */
2072 /* separated into a stand alone routine to other protocol dissectors */
2073 /* can call to it, ie. socks    */
2074
2075 static gboolean try_heuristic_first = FALSE;
2076
2077 void
2078 decode_tcp_ports(tvbuff_t *tvb, int offset, packet_info *pinfo,
2079         proto_tree *tree, int src_port, int dst_port, guint32 nxtseq)
2080 {
2081   tvbuff_t *next_tvb;
2082   int low_port, high_port;
2083
2084 /*qqq   see if it is an unaligned PDU */
2085   if(nxtseq && tcp_analyze_seq && (!tcp_desegment)){
2086     guint32 seq;
2087     seq=nxtseq-tvb_reported_length_remaining(tvb, offset);
2088     offset=scan_for_next_pdu(pinfo, offset, seq, nxtseq);
2089   }
2090
2091   next_tvb = tvb_new_subset(tvb, offset, -1, -1);
2092
2093 /* determine if this packet is part of a conversation and call dissector */
2094 /* for the conversation if available */
2095
2096   if (try_conversation_dissector(&pinfo->src, &pinfo->dst, PT_TCP,
2097                 src_port, dst_port, next_tvb, pinfo, tree))
2098     goto end_decode_tcp_ports;
2099
2100   if (try_heuristic_first) {
2101     /* do lookup with the heuristic subdissector table */
2102     if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree))
2103        goto end_decode_tcp_ports;
2104   }
2105
2106   /* Do lookups with the subdissector table.
2107      We try the port number with the lower value first, followed by the
2108      port number with the higher value.  This means that, for packets
2109      where a dissector is registered for *both* port numbers:
2110
2111         1) we pick the same dissector for traffic going in both directions;
2112
2113         2) we prefer the port number that's more likely to be the right
2114            one (as that prefers well-known ports to reserved ports);
2115
2116      although there is, of course, no guarantee that any such strategy
2117      will always pick the right port number.
2118
2119      XXX - we ignore port numbers of 0, as some dissectors use a port
2120      number of 0 to disable the port. */
2121   if (src_port > dst_port) {
2122     low_port = dst_port;
2123     high_port = src_port;
2124   } else {
2125     low_port = src_port;
2126     high_port = dst_port;
2127   }
2128   if (low_port != 0 &&
2129       dissector_try_port(subdissector_table, low_port, next_tvb, pinfo, tree))
2130     goto end_decode_tcp_ports;
2131   if (high_port != 0 &&
2132       dissector_try_port(subdissector_table, high_port, next_tvb, pinfo, tree))
2133     goto end_decode_tcp_ports;
2134
2135   if (!try_heuristic_first) {
2136     /* do lookup with the heuristic subdissector table */
2137     if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree))
2138        goto end_decode_tcp_ports;
2139   }
2140
2141   /* Oh, well, we don't know this; dissect it as data. */
2142   call_dissector(data_handle,next_tvb, pinfo, tree);
2143   return;
2144
2145 end_decode_tcp_ports:
2146   /* if !visited, check want_pdu_tracking and store it in table */
2147   /* XXX fix nxtseq so that it always has valid content and skip the ==0 check */
2148   if((!pinfo->fd->flags.visited) && nxtseq && tcp_analyze_seq && pinfo->want_pdu_tracking){
2149     pdu_store_sequencenumber_of_next_pdu(pinfo, nxtseq+pinfo->bytes_until_next_pdu);
2150   }
2151
2152 }
2153
2154
2155 static void
2156 dissect_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2157 {
2158   guint8  th_off_x2; /* combines th_off and th_x2 */
2159   guint16 th_sum;
2160   guint16 th_urp;
2161   proto_tree *tcp_tree = NULL, *field_tree = NULL;
2162   proto_item *ti = NULL, *tf;
2163   int        offset = 0;
2164   gchar      flags[64] = "<None>";
2165   gchar     *fstr[] = {"FIN", "SYN", "RST", "PSH", "ACK", "URG", "ECN", "CWR" };
2166   gint       fpos = 0, i;
2167   guint      bpos;
2168   guint      optlen;
2169   guint32    nxtseq = 0;
2170   guint      reported_len;
2171   vec_t      cksum_vec[4];
2172   guint32    phdr[2];
2173   guint16    computed_cksum;
2174   guint      length_remaining;
2175   gboolean   desegment_ok;
2176   struct tcpinfo tcpinfo;
2177   gboolean   save_fragmented;
2178   static struct tcpheader tcphstruct[4], *tcph;
2179   static int tcph_count=0;
2180
2181   tcph_count++;
2182   if(tcph_count>=4){
2183      tcph_count=0;
2184   }
2185   tcph=&tcphstruct[tcph_count];
2186   SET_ADDRESS(&tcph->ip_src, pinfo->src.type, pinfo->src.len, pinfo->src.data);
2187   SET_ADDRESS(&tcph->ip_dst, pinfo->dst.type, pinfo->dst.len, pinfo->dst.data);
2188
2189   if (check_col(pinfo->cinfo, COL_PROTOCOL))
2190     col_set_str(pinfo->cinfo, COL_PROTOCOL, "TCP");
2191
2192   /* Clear out the Info column. */
2193   if (check_col(pinfo->cinfo, COL_INFO))
2194     col_clear(pinfo->cinfo, COL_INFO);
2195
2196   tcph->th_sport = tvb_get_ntohs(tvb, offset);
2197   tcph->th_dport = tvb_get_ntohs(tvb, offset + 2);
2198   if (check_col(pinfo->cinfo, COL_INFO)) {
2199     col_append_fstr(pinfo->cinfo, COL_INFO, "%s > %s",
2200       get_tcp_port(tcph->th_sport), get_tcp_port(tcph->th_dport));
2201   }
2202   if (tree) {
2203     if (tcp_summary_in_tree) {
2204             ti = proto_tree_add_protocol_format(tree, proto_tcp, tvb, 0, -1,
2205                 "Transmission Control Protocol, Src Port: %s (%u), Dst Port: %s (%u)",
2206                 get_tcp_port(tcph->th_sport), tcph->th_sport,
2207                 get_tcp_port(tcph->th_dport), tcph->th_dport);
2208     }
2209     else {
2210             ti = proto_tree_add_item(tree, proto_tcp, tvb, 0, -1, FALSE);
2211     }
2212     tcp_tree = proto_item_add_subtree(ti, ett_tcp);
2213     proto_tree_add_uint_format(tcp_tree, hf_tcp_srcport, tvb, offset, 2, tcph->th_sport,
2214         "Source port: %s (%u)", get_tcp_port(tcph->th_sport), tcph->th_sport);
2215     proto_tree_add_uint_format(tcp_tree, hf_tcp_dstport, tvb, offset + 2, 2, tcph->th_dport,
2216         "Destination port: %s (%u)", get_tcp_port(tcph->th_dport), tcph->th_dport);
2217     proto_tree_add_uint_hidden(tcp_tree, hf_tcp_port, tvb, offset, 2, tcph->th_sport);
2218     proto_tree_add_uint_hidden(tcp_tree, hf_tcp_port, tvb, offset + 2, 2, tcph->th_dport);
2219   }
2220
2221   /* Set the source and destination port numbers as soon as we get them,
2222      so that they're available to the "Follow TCP Stream" code even if
2223      we throw an exception dissecting the rest of the TCP header. */
2224   pinfo->ptype = PT_TCP;
2225   pinfo->srcport = tcph->th_sport;
2226   pinfo->destport = tcph->th_dport;
2227
2228   tcph->th_seq = tvb_get_ntohl(tvb, offset + 4);
2229   tcph->th_ack = tvb_get_ntohl(tvb, offset + 8);
2230   th_off_x2 = tvb_get_guint8(tvb, offset + 12);
2231   tcph->th_flags = tvb_get_guint8(tvb, offset + 13);
2232   tcph->th_win = tvb_get_ntohs(tvb, offset + 14);
2233   tcph->th_hlen = hi_nibble(th_off_x2) * 4;  /* TCP header length, in bytes */
2234
2235   /*
2236    * If we've been handed an IP fragment, we don't know how big the TCP
2237    * segment is, so don't do anything that requires that we know that.
2238    *
2239    * The same applies if we're part of an error packet.  (XXX - if the
2240    * ICMP and ICMPv6 dissectors could set a "this is how big the IP
2241    * header says it is" length in the tvbuff, we could use that; such
2242    * a length might also be useful for handling packets where the IP
2243    * length is bigger than the actual data available in the frame; the
2244    * dissectors should trust that length, and then throw a
2245    * ReportedBoundsError exception when they go past the end of the frame.)
2246    *
2247    * We also can't determine the segment length if the reported length
2248    * of the TCP packet is less than the TCP header length.
2249    */
2250   reported_len = tvb_reported_length(tvb);
2251
2252   if (!pinfo->fragmented && !pinfo->in_error_pkt) {
2253     if (reported_len < tcph->th_hlen) {
2254       proto_tree_add_text(tcp_tree, tvb, offset, 0,
2255         "Short segment. Segment/fragment does not contain a full TCP header"
2256         " (might be NMAP or someone else deliberately sending unusual packets)");
2257       tcph->th_have_seglen = FALSE;
2258     } else {
2259       /* Compute the length of data in this segment. */
2260       tcph->th_seglen = reported_len - tcph->th_hlen;
2261       tcph->th_have_seglen = TRUE;
2262
2263       if (tree) { /* Add the seglen as an invisible field */
2264
2265         proto_tree_add_uint_hidden(ti, hf_tcp_len, tvb, offset, 4, tcph->th_seglen);
2266
2267       }
2268
2269       /* handle TCP seq# analysis parse all new segments we see */
2270       if(tcp_analyze_seq){
2271           if(!(pinfo->fd->flags.visited)){
2272               tcp_analyze_sequence_number(pinfo, tcph->th_seq, tcph->th_ack, tcph->th_seglen, tcph->th_flags, tcph->th_win);
2273           }
2274           if(tcp_relative_seq){
2275               tcp_get_relative_seq_ack(pinfo->fd->num, &(tcph->th_seq), &(tcph->th_ack), &(tcph->th_win));
2276           }
2277       }
2278
2279       /* Compute the sequence number of next octet after this segment. */
2280       nxtseq = tcph->th_seq + tcph->th_seglen;
2281     }
2282   } else
2283     tcph->th_have_seglen = FALSE;
2284
2285   if (check_col(pinfo->cinfo, COL_INFO) || tree) {
2286     for (i = 0; i < 8; i++) {
2287       bpos = 1 << i;
2288       if (tcph->th_flags & bpos) {
2289         if (fpos) {
2290           strcpy(&flags[fpos], ", ");
2291           fpos += 2;
2292         }
2293         strcpy(&flags[fpos], fstr[i]);
2294         fpos += 3;
2295       }
2296     }
2297     flags[fpos] = '\0';
2298   }
2299
2300   if (check_col(pinfo->cinfo, COL_INFO)) {
2301     col_append_fstr(pinfo->cinfo, COL_INFO, " [%s] Seq=%u Ack=%u Win=%u",
2302       flags, tcph->th_seq, tcph->th_ack, tcph->th_win);
2303   }
2304
2305   if (tree) {
2306     if (tcp_summary_in_tree) {
2307       proto_item_append_text(ti, ", Seq: %u", tcph->th_seq);
2308     }
2309     proto_tree_add_uint(tcp_tree, hf_tcp_seq, tvb, offset + 4, 4, tcph->th_seq);
2310   }
2311
2312   if (tcph->th_hlen < TCPH_MIN_LEN) {
2313     /* Give up at this point; we put the source and destination port in
2314        the tree, before fetching the header length, so that they'll
2315        show up if this is in the failing packet in an ICMP error packet,
2316        but it's now time to give up if the header length is bogus. */
2317     if (check_col(pinfo->cinfo, COL_INFO))
2318       col_append_fstr(pinfo->cinfo, COL_INFO, ", bogus TCP header length (%u, must be at least %u)",
2319         tcph->th_hlen, TCPH_MIN_LEN);
2320     if (tree) {
2321       proto_tree_add_uint_format(tcp_tree, hf_tcp_hdr_len, tvb, offset + 12, 1, tcph->th_hlen,
2322        "Header length: %u bytes (bogus, must be at least %u)", tcph->th_hlen,
2323        TCPH_MIN_LEN);
2324     }
2325     return;
2326   }
2327
2328   if (tree) {
2329     if (tcp_summary_in_tree) {
2330       proto_item_append_text(ti, ", Ack: %u", tcph->th_ack);
2331       if (tcph->th_have_seglen)
2332         proto_item_append_text(ti, ", Len: %u", tcph->th_seglen);
2333     }
2334     proto_item_set_len(ti, tcph->th_hlen);
2335     if (tcph->th_have_seglen) {
2336       if (nxtseq != tcph->th_seq) {
2337         proto_tree_add_uint(tcp_tree, hf_tcp_nxtseq, tvb, offset, 0, nxtseq);
2338       }
2339     }
2340     if (tcph->th_flags & TH_ACK)
2341       proto_tree_add_uint(tcp_tree, hf_tcp_ack, tvb, offset + 8, 4, tcph->th_ack);
2342     proto_tree_add_uint_format(tcp_tree, hf_tcp_hdr_len, tvb, offset + 12, 1, tcph->th_hlen,
2343         "Header length: %u bytes", tcph->th_hlen);
2344     tf = proto_tree_add_uint_format(tcp_tree, hf_tcp_flags, tvb, offset + 13, 1,
2345         tcph->th_flags, "Flags: 0x%04x (%s)", tcph->th_flags, flags);
2346     field_tree = proto_item_add_subtree(tf, ett_tcp_flags);
2347     proto_tree_add_boolean(field_tree, hf_tcp_flags_cwr, tvb, offset + 13, 1, tcph->th_flags);
2348     proto_tree_add_boolean(field_tree, hf_tcp_flags_ecn, tvb, offset + 13, 1, tcph->th_flags);
2349     proto_tree_add_boolean(field_tree, hf_tcp_flags_urg, tvb, offset + 13, 1, tcph->th_flags);
2350     proto_tree_add_boolean(field_tree, hf_tcp_flags_ack, tvb, offset + 13, 1, tcph->th_flags);
2351     proto_tree_add_boolean(field_tree, hf_tcp_flags_push, tvb, offset + 13, 1, tcph->th_flags);
2352     proto_tree_add_boolean(field_tree, hf_tcp_flags_reset, tvb, offset + 13, 1, tcph->th_flags);
2353     proto_tree_add_boolean(field_tree, hf_tcp_flags_syn, tvb, offset + 13, 1, tcph->th_flags);
2354     proto_tree_add_boolean(field_tree, hf_tcp_flags_fin, tvb, offset + 13, 1, tcph->th_flags);
2355     proto_tree_add_uint(tcp_tree, hf_tcp_window_size, tvb, offset + 14, 2, tcph->th_win);
2356   }
2357
2358   /* Supply the sequence number of the first byte. */
2359   tcpinfo.seq = tcph->th_seq;
2360
2361   /* Assume we'll pass un-reassembled data to subdissectors. */
2362   tcpinfo.is_reassembled = FALSE;
2363
2364   pinfo->private_data = &tcpinfo;
2365
2366   /*
2367    * Assume, initially, that we can't desegment.
2368    */
2369   pinfo->can_desegment = 0;
2370   th_sum = tvb_get_ntohs(tvb, offset + 16);
2371   if (!pinfo->fragmented && tvb_bytes_exist(tvb, 0, reported_len)) {
2372     /* The packet isn't part of an un-reassembled fragmented datagram
2373        and isn't truncated.  This means we have all the data, and thus
2374        can checksum it and, unless it's being returned in an error
2375        packet, are willing to allow subdissectors to request reassembly
2376        on it. */
2377
2378     if (tcp_check_checksum) {
2379       /* We haven't turned checksum checking off; checksum it. */
2380
2381       /* Set up the fields of the pseudo-header. */
2382       cksum_vec[0].ptr = pinfo->src.data;
2383       cksum_vec[0].len = pinfo->src.len;
2384       cksum_vec[1].ptr = pinfo->dst.data;
2385       cksum_vec[1].len = pinfo->dst.len;
2386       cksum_vec[2].ptr = (const guint8 *)&phdr;
2387       switch (pinfo->src.type) {
2388
2389       case AT_IPv4:
2390         phdr[0] = g_htonl((IP_PROTO_TCP<<16) + reported_len);
2391         cksum_vec[2].len = 4;
2392         break;
2393
2394       case AT_IPv6:
2395         phdr[0] = g_htonl(reported_len);
2396         phdr[1] = g_htonl(IP_PROTO_TCP);
2397         cksum_vec[2].len = 8;
2398         break;
2399
2400       default:
2401         /* TCP runs only atop IPv4 and IPv6.... */
2402         g_assert_not_reached();
2403         break;
2404       }
2405       cksum_vec[3].ptr = tvb_get_ptr(tvb, offset, reported_len);
2406       cksum_vec[3].len = reported_len;
2407       computed_cksum = in_cksum(&cksum_vec[0], 4);
2408       if (computed_cksum == 0) {
2409         proto_tree_add_uint_format(tcp_tree, hf_tcp_checksum, tvb,
2410           offset + 16, 2, th_sum, "Checksum: 0x%04x (correct)", th_sum);
2411
2412         /* Checksum is valid, so we're willing to desegment it. */
2413         desegment_ok = TRUE;
2414       } else {
2415         proto_tree_add_boolean_hidden(tcp_tree, hf_tcp_checksum_bad, tvb,
2416            offset + 16, 2, TRUE);
2417         proto_tree_add_uint_format(tcp_tree, hf_tcp_checksum, tvb,
2418            offset + 16, 2, th_sum,
2419            "Checksum: 0x%04x (incorrect, should be 0x%04x)", th_sum,
2420            in_cksum_shouldbe(th_sum, computed_cksum));
2421
2422         /* Checksum is invalid, so we're not willing to desegment it. */
2423         desegment_ok = FALSE;
2424         pinfo->noreassembly_reason = " (incorrect TCP checksum)";
2425       }
2426     } else {
2427       proto_tree_add_uint_format(tcp_tree, hf_tcp_checksum, tvb,
2428          offset + 16, 2, th_sum, "Checksum: 0x%04x", th_sum);
2429
2430       /* We didn't check the checksum, and don't care if it's valid,
2431          so we're willing to desegment it. */
2432       desegment_ok = TRUE;
2433     }
2434   } else {
2435     /* We don't have all the packet data, so we can't checksum it... */
2436     proto_tree_add_uint_format(tcp_tree, hf_tcp_checksum, tvb,
2437        offset + 16, 2, th_sum, "Checksum: 0x%04x", th_sum);
2438
2439     /* ...and aren't willing to desegment it. */
2440     desegment_ok = FALSE;
2441   }
2442
2443   if (desegment_ok) {
2444     /* We're willing to desegment this.  Is desegmentation enabled? */
2445     if (tcp_desegment) {
2446       /* Yes - is this segment being returned in an error packet? */
2447       if (!pinfo->in_error_pkt) {
2448         /* No - indicate that we will desegment.
2449            We do NOT want to desegment segments returned in error
2450            packets, as they're not part of a TCP connection. */
2451         pinfo->can_desegment = 2;
2452       }
2453     }
2454   }
2455
2456   if (tcph->th_flags & TH_URG) {
2457     th_urp = tvb_get_ntohs(tvb, offset + 18);
2458     /* Export the urgent pointer, for the benefit of protocols such as
2459        rlogin. */
2460     tcpinfo.urgent = TRUE;
2461     tcpinfo.urgent_pointer = th_urp;
2462     if (check_col(pinfo->cinfo, COL_INFO))
2463       col_append_fstr(pinfo->cinfo, COL_INFO, " Urg=%u", th_urp);
2464     if (tcp_tree != NULL)
2465       proto_tree_add_uint(tcp_tree, hf_tcp_urgent_pointer, tvb, offset + 18, 2, th_urp);
2466   } else
2467     tcpinfo.urgent = FALSE;
2468
2469   if (tcph->th_have_seglen) {
2470     if (check_col(pinfo->cinfo, COL_INFO))
2471       col_append_fstr(pinfo->cinfo, COL_INFO, " Len=%u", tcph->th_seglen);
2472   }
2473
2474   /* Decode TCP options, if any. */
2475   if (tree && tcph->th_hlen > TCPH_MIN_LEN) {
2476     /* There's more than just the fixed-length header.  Decode the
2477        options. */
2478     optlen = tcph->th_hlen - TCPH_MIN_LEN; /* length of options, in bytes */
2479     tf = proto_tree_add_text(tcp_tree, tvb, offset +  20, optlen,
2480       "Options: (%u bytes)", optlen);
2481     field_tree = proto_item_add_subtree(tf, ett_tcp_options);
2482     dissect_ip_tcp_options(tvb, offset + 20, optlen,
2483       tcpopts, N_TCP_OPTS, TCPOPT_EOL, pinfo, field_tree);
2484   }
2485
2486   /* Skip over header + options */
2487   offset += tcph->th_hlen;
2488
2489   /* Check the packet length to see if there's more data
2490      (it could be an ACK-only packet) */
2491   length_remaining = tvb_length_remaining(tvb, offset);
2492
2493   if (tcph->th_have_seglen) {
2494     if( data_out_file ) {
2495       reassemble_tcp( tcph->th_seq,             /* sequence number */
2496           tcph->th_seglen,                      /* data length */
2497           tvb_get_ptr(tvb, offset, length_remaining),   /* data */
2498           length_remaining,             /* captured data length */
2499           ( tcph->th_flags & TH_SYN ),          /* is syn set? */
2500           &pinfo->net_src,
2501           &pinfo->net_dst,
2502           pinfo->srcport,
2503           pinfo->destport);
2504     }
2505   }
2506
2507   /*
2508    * XXX - what, if any, of this should we do if this is included in an
2509    * error packet?  It might be nice to see the details of the packet
2510    * that caused the ICMP error, but it might not be nice to have the
2511    * dissector update state based on it.
2512    * Also, we probably don't want to run TCP taps on those packets.
2513    */
2514   if (length_remaining != 0) {
2515     if (tcph->th_flags & TH_RST) {
2516       /*
2517        * RFC1122 says:
2518        *
2519        *        4.2.2.12  RST Segment: RFC-793 Section 3.4
2520        *
2521        *          A TCP SHOULD allow a received RST segment to include data.
2522        *
2523        *          DISCUSSION
2524        *               It has been suggested that a RST segment could contain
2525        *               ASCII text that encoded and explained the cause of the
2526        *               RST.  No standard has yet been established for such
2527        *               data.
2528        *
2529        * so for segments with RST we just display the data as text.
2530        */
2531       proto_tree_add_text(tcp_tree, tvb, offset, length_remaining,
2532                             "Reset cause: %s",
2533                             tvb_format_text(tvb, offset, length_remaining));
2534     } else {
2535       /* Can we desegment this segment? */
2536       if (pinfo->can_desegment) {
2537         /* Yes. */
2538         desegment_tcp(tvb, pinfo, offset, tcph->th_seq, nxtseq, tcph->th_sport, tcph->th_dport, tree, tcp_tree);
2539       } else {
2540         /* No - just call the subdissector.
2541            Mark this as fragmented, so if somebody throws an exception,
2542            we don't report it as a malformed frame. */
2543         save_fragmented = pinfo->fragmented;
2544         pinfo->fragmented = TRUE;
2545         decode_tcp_ports(tvb, offset, pinfo, tree, tcph->th_sport, tcph->th_dport, nxtseq);
2546         pinfo->fragmented = save_fragmented;
2547       }
2548     }
2549   }
2550
2551   /* handle TCP seq# analysis, print any extra SEQ/ACK data for this segment*/
2552   if(tcp_analyze_seq){
2553       tcp_print_sequence_number_analysis(pinfo, tvb, tcp_tree);
2554   }
2555   tap_queue_packet(tcp_tap, pinfo, tcph);
2556 }
2557
2558 void
2559 proto_register_tcp(void)
2560 {
2561         static hf_register_info hf[] = {
2562
2563                 { &hf_tcp_srcport,
2564                 { "Source Port",                "tcp.srcport", FT_UINT16, BASE_DEC, NULL, 0x0,
2565                         "", HFILL }},
2566
2567                 { &hf_tcp_dstport,
2568                 { "Destination Port",           "tcp.dstport", FT_UINT16, BASE_DEC, NULL, 0x0,
2569                         "", HFILL }},
2570
2571                 { &hf_tcp_port,
2572                 { "Source or Destination Port", "tcp.port", FT_UINT16, BASE_DEC, NULL, 0x0,
2573                         "", HFILL }},
2574
2575                 { &hf_tcp_seq,
2576                 { "Sequence number",            "tcp.seq", FT_UINT32, BASE_DEC, NULL, 0x0,
2577                         "", HFILL }},
2578
2579                 { &hf_tcp_nxtseq,
2580                 { "Next sequence number",       "tcp.nxtseq", FT_UINT32, BASE_DEC, NULL, 0x0,
2581                         "", HFILL }},
2582
2583                 { &hf_tcp_ack,
2584                 { "Acknowledgement number",     "tcp.ack", FT_UINT32, BASE_DEC, NULL, 0x0,
2585                         "", HFILL }},
2586
2587                 { &hf_tcp_hdr_len,
2588                 { "Header Length",              "tcp.hdr_len", FT_UINT8, BASE_DEC, NULL, 0x0,
2589                         "", HFILL }},
2590
2591                 { &hf_tcp_flags,
2592                 { "Flags",                      "tcp.flags", FT_UINT8, BASE_HEX, NULL, 0x0,
2593                         "", HFILL }},
2594
2595                 { &hf_tcp_flags_cwr,
2596                 { "Congestion Window Reduced (CWR)",                    "tcp.flags.cwr", FT_BOOLEAN, 8, TFS(&flags_set_truth), TH_CWR,
2597                         "", HFILL }},
2598
2599                 { &hf_tcp_flags_ecn,
2600                 { "ECN-Echo",                   "tcp.flags.ecn", FT_BOOLEAN, 8, TFS(&flags_set_truth), TH_ECN,
2601                         "", HFILL }},
2602
2603                 { &hf_tcp_flags_urg,
2604                 { "Urgent",                     "tcp.flags.urg", FT_BOOLEAN, 8, TFS(&flags_set_truth), TH_URG,
2605                         "", HFILL }},
2606
2607                 { &hf_tcp_flags_ack,
2608                 { "Acknowledgment",             "tcp.flags.ack", FT_BOOLEAN, 8, TFS(&flags_set_truth), TH_ACK,
2609                         "", HFILL }},
2610
2611                 { &hf_tcp_flags_push,
2612                 { "Push",                       "tcp.flags.push", FT_BOOLEAN, 8, TFS(&flags_set_truth), TH_PUSH,
2613                         "", HFILL }},
2614
2615                 { &hf_tcp_flags_reset,
2616                 { "Reset",                      "tcp.flags.reset", FT_BOOLEAN, 8, TFS(&flags_set_truth), TH_RST,
2617                         "", HFILL }},
2618
2619                 { &hf_tcp_flags_syn,
2620                 { "Syn",                        "tcp.flags.syn", FT_BOOLEAN, 8, TFS(&flags_set_truth), TH_SYN,
2621                         "", HFILL }},
2622
2623                 { &hf_tcp_flags_fin,
2624                 { "Fin",                        "tcp.flags.fin", FT_BOOLEAN, 8, TFS(&flags_set_truth), TH_FIN,
2625                         "", HFILL }},
2626
2627                 /* 32 bits so we can present some values adjusted to window scaling */
2628                 { &hf_tcp_window_size,
2629                 { "Window size",                "tcp.window_size", FT_UINT32, BASE_DEC, NULL, 0x0,
2630                         "", HFILL }},
2631
2632                 { &hf_tcp_checksum,
2633                 { "Checksum",                   "tcp.checksum", FT_UINT16, BASE_HEX, NULL, 0x0,
2634                         "", HFILL }},
2635
2636                 { &hf_tcp_checksum_bad,
2637                 { "Bad Checksum",               "tcp.checksum_bad", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2638                         "", HFILL }},
2639
2640                 { &hf_tcp_analysis_flags,
2641                 { "TCP Analysis Flags",         "tcp.analysis.flags", FT_NONE, BASE_NONE, NULL, 0x0,
2642                         "This frame has some of the TCP analysis flags set", HFILL }},
2643
2644                 { &hf_tcp_analysis_retransmission,
2645                 { "Retransmission",             "tcp.analysis.retransmission", FT_NONE, BASE_NONE, NULL, 0x0,
2646                         "This frame is a suspected TCP retransmission", HFILL }},
2647
2648                 { &hf_tcp_analysis_lost_packet,
2649                 { "Previous Segment Lost",              "tcp.analysis.lost_segment", FT_NONE, BASE_NONE, NULL, 0x0,
2650                         "A segment before this one was lost from the capture", HFILL }},
2651
2652                 { &hf_tcp_analysis_ack_lost_packet,
2653                 { "ACKed Lost Packet",          "tcp.analysis.ack_lost_segment", FT_NONE, BASE_NONE, NULL, 0x0,
2654                         "This frame ACKs a lost segment", HFILL }},
2655
2656                 { &hf_tcp_analysis_keep_alive,
2657                 { "Keep Alive",         "tcp.analysis.keep_alive", FT_NONE, BASE_NONE, NULL, 0x0,
2658                         "This is a keep-alive segment", HFILL }},
2659
2660                 { &hf_tcp_analysis_keep_alive_ack,
2661                 { "Keep Alive ACK",             "tcp.analysis.keep_alive_ack", FT_NONE, BASE_NONE, NULL, 0x0,
2662                         "This is an ACK to a keep-alive segment", HFILL }},
2663
2664                 { &hf_tcp_analysis_duplicate_ack,
2665                 { "Duplicate ACK",              "tcp.analysis.duplicate_ack", FT_NONE, BASE_NONE, NULL, 0x0,
2666                         "This is a duplicate ACK", HFILL }},
2667
2668                 { &hf_tcp_analysis_duplicate_ack_num,
2669                 { "Duplicate ACK #",            "tcp.analysis.duplicate_ack_num", FT_UINT32, BASE_DEC, NULL, 0x0,
2670                         "This is duplicate ACK number #", HFILL }},
2671
2672                 { &hf_tcp_analysis_duplicate_ack_frame,
2673                 { "Duplicate to the ACK in frame",              "tcp.analysis.duplicate_ack_frame", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
2674                         "This is a duplicate to the ACK in frame #", HFILL }},
2675
2676                 { &hf_tcp_analysis_zero_window_violation,
2677                 { "Zero Window Violation",              "tcp.analysis.zero_window_violation", FT_NONE, BASE_NONE, NULL, 0x0,
2678                         "This is a zero-window violation, an attempt to write >1 byte to a zero-window", HFILL }},
2679
2680                 { &hf_tcp_analysis_zero_window_probe,
2681                 { "Zero Window Probe",          "tcp.analysis.zero_window_probe", FT_NONE, BASE_NONE, NULL, 0x0,
2682                         "This is a zero-window-probe", HFILL }},
2683
2684                 { &hf_tcp_analysis_zero_window,
2685                 { "Zero Window",                "tcp.analysis.zero_window", FT_NONE, BASE_NONE, NULL, 0x0,
2686                         "This is a Zero-Window", HFILL }},
2687
2688                 { &hf_tcp_len,
2689                   { "TCP Segment Len",            "tcp.len", FT_UINT32, BASE_DEC, NULL, 0x0,
2690                     "", HFILL}},
2691
2692                 { &hf_tcp_analysis_acks_frame,
2693                   { "This is an ACK to the segment in frame",            "tcp.analysis.acks_frame", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
2694                     "Which previous segment is this an ACK for", HFILL}},
2695
2696                 { &hf_tcp_analysis_ack_rtt,
2697                   { "The RTT to ACK the segment was",            "tcp.analysis.ack_rtt", FT_RELATIVE_TIME, BASE_NONE, NULL, 0x0,
2698                     "How long time it took to ACK the segment (RTT)", HFILL}},
2699
2700                 { &hf_tcp_urgent_pointer,
2701                 { "Urgent pointer",             "tcp.urgent_pointer", FT_UINT16, BASE_DEC, NULL, 0x0,
2702                         "", HFILL }},
2703
2704                 { &hf_tcp_segment_overlap,
2705                 { "Segment overlap",    "tcp.segment.overlap", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2706                         "Segment overlaps with other segments", HFILL }},
2707
2708                 { &hf_tcp_segment_overlap_conflict,
2709                 { "Conflicting data in segment overlap",        "tcp.segment.overlap.conflict", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2710                         "Overlapping segments contained conflicting data", HFILL }},
2711
2712                 { &hf_tcp_segment_multiple_tails,
2713                 { "Multiple tail segments found",       "tcp.segment.multipletails", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2714                         "Several tails were found when desegmenting the pdu", HFILL }},
2715
2716                 { &hf_tcp_segment_too_long_fragment,
2717                 { "Segment too long",   "tcp.segment.toolongfragment", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2718                         "Segment contained data past end of the pdu", HFILL }},
2719
2720                 { &hf_tcp_segment_error,
2721                 { "Desegmentation error", "tcp.segment.error", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
2722                         "Desegmentation error due to illegal segments", HFILL }},
2723
2724                 { &hf_tcp_segment,
2725                 { "TCP Segment", "tcp.segment", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
2726                         "TCP Segment", HFILL }},
2727
2728                 { &hf_tcp_segments,
2729                 { "TCP Segments", "tcp.segments", FT_NONE, BASE_NONE, NULL, 0x0,
2730                         "TCP Segments", HFILL }},
2731
2732                 { &hf_tcp_reassembled_in,
2733                 { "Reassembled PDU in frame", "tcp.reassembled_in", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
2734                         "The PDU that starts but doesn't end in this segment is reassembled in this frame", HFILL }},
2735
2736                 { &hf_tcp_option_mss,
2737                   { "TCP MSS Option", "tcp.options.mss", FT_BOOLEAN,
2738                     BASE_NONE, NULL, 0x0, "TCP MSS Option", HFILL }},
2739
2740                 { &hf_tcp_option_mss_val,
2741                   { "TCP MSS Option Value", "tcp.options.mss_val", FT_UINT16,
2742                     BASE_DEC, NULL, 0x0, "TCP MSS Option Value", HFILL}},
2743
2744                 { &hf_tcp_option_wscale,
2745                   { "TCP Window Scale Option", "tcp.options.wscale",
2746                     FT_BOOLEAN,
2747                     BASE_NONE, NULL, 0x0, "TCP Window Option", HFILL}},
2748
2749                 { &hf_tcp_option_wscale_val,
2750                   { "TCP Windows Scale Option Value", "tcp.options.wscale_val",
2751                     FT_UINT8, BASE_DEC, NULL, 0x0, "TCP Window Scale Value",
2752                     HFILL}},
2753
2754                 { &hf_tcp_option_sack_perm,
2755                   { "TCP Sack Perm Option", "tcp.options.sack_perm",
2756                     FT_BOOLEAN,
2757                     BASE_NONE, NULL, 0x0, "TCP Sack Perm Option", HFILL}},
2758
2759                 { &hf_tcp_option_sack,
2760                   { "TCP Sack Option", "tcp.options.sack", FT_BOOLEAN,
2761                     BASE_NONE, NULL, 0x0, "TCP Sack Option", HFILL}},
2762
2763                 { &hf_tcp_option_sack_sle,
2764                   {"TCP Sack Left Edge", "tcp.options.sack_le", FT_UINT32,
2765                    BASE_DEC, NULL, 0x0, "TCP Sack Left Edge", HFILL}},
2766
2767                 { &hf_tcp_option_sack_sre,
2768                   {"TCP Sack Right Edge", "tcp.options.sack_re", FT_UINT32,
2769                    BASE_DEC, NULL, 0x0, "TCP Sack Right Edge", HFILL}},
2770
2771                 { &hf_tcp_option_echo,
2772                   { "TCP Echo Option", "tcp.options.echo", FT_BOOLEAN,
2773                     BASE_NONE, NULL, 0x0, "TCP Sack Echo", HFILL}},
2774
2775                 { &hf_tcp_option_echo_reply,
2776                   { "TCP Echo Reply Option", "tcp.options.echo_reply",
2777                     FT_BOOLEAN,
2778                     BASE_NONE, NULL, 0x0, "TCP Echo Reply Option", HFILL}},
2779
2780                 { &hf_tcp_option_time_stamp,
2781                   { "TCP Time Stamp Option", "tcp.options.time_stamp",
2782                     FT_BOOLEAN,
2783                     BASE_NONE, NULL, 0x0, "TCP Time Stamp Option", HFILL}},
2784
2785                 { &hf_tcp_option_cc,
2786                   { "TCP CC Option", "tcp.options.cc", FT_BOOLEAN, BASE_NONE,
2787                     NULL, 0x0, "TCP CC Option", HFILL}},
2788
2789                 { &hf_tcp_option_ccnew,
2790                   { "TCP CC New Option", "tcp.options.ccnew", FT_BOOLEAN,
2791                     BASE_NONE, NULL, 0x0, "TCP CC New Option", HFILL}},
2792
2793                 { &hf_tcp_option_ccecho,
2794                   { "TCP CC Echo Option", "tcp.options.ccecho", FT_BOOLEAN,
2795                     BASE_NONE, NULL, 0x0, "TCP CC Echo Option", HFILL}},
2796
2797                 { &hf_tcp_option_md5,
2798                   { "TCP MD5 Option", "tcp.options.md5", FT_BOOLEAN, BASE_NONE,
2799                     NULL, 0x0, "TCP MD5 Option", HFILL}},
2800         };
2801         static gint *ett[] = {
2802                 &ett_tcp,
2803                 &ett_tcp_flags,
2804                 &ett_tcp_options,
2805                 &ett_tcp_option_sack,
2806                 &ett_tcp_analysis_faults,
2807                 &ett_tcp_analysis,
2808                 &ett_tcp_segments,
2809                 &ett_tcp_segment
2810         };
2811         module_t *tcp_module;
2812
2813         proto_tcp = proto_register_protocol("Transmission Control Protocol",
2814             "TCP", "tcp");
2815         proto_register_field_array(proto_tcp, hf, array_length(hf));
2816         proto_register_subtree_array(ett, array_length(ett));
2817
2818         /* subdissector code */
2819         subdissector_table = register_dissector_table("tcp.port",
2820             "TCP port", FT_UINT16, BASE_DEC);
2821         register_heur_dissector_list("tcp", &heur_subdissector_list);
2822
2823         /* Register configuration preferences */
2824         tcp_module = prefs_register_protocol(proto_tcp, NULL);
2825         prefs_register_bool_preference(tcp_module, "summary_in_tree",
2826             "Show TCP summary in protocol tree",
2827             "Whether the TCP summary line should be shown in the protocol tree",
2828             &tcp_summary_in_tree);
2829         prefs_register_bool_preference(tcp_module, "check_checksum",
2830             "Check the validity of the TCP checksum when possible",
2831             "Whether to check the validity of the TCP checksum",
2832             &tcp_check_checksum);
2833         prefs_register_bool_preference(tcp_module, "desegment_tcp_streams",
2834             "Allow subdissector to desegment TCP streams",
2835             "Whether subdissector can request TCP streams to be desegmented",
2836             &tcp_desegment);
2837         prefs_register_bool_preference(tcp_module, "analyze_sequence_numbers",
2838             "Analyze TCP sequence numbers",
2839             "Make the TCP dissector analyze TCP sequence numbers to find and flag segment retransmissions, missing segments and RTT",
2840             &tcp_analyze_seq);
2841         prefs_register_bool_preference(tcp_module, "relative_sequence_numbers",
2842             "Relative Seq nums and Window Scaling",
2843             "Make the TCP dissector use relative sequence numbers instead of absolute ones. To use this option you must also enable \"Analyze TCP sequence numbers\". This option will also try to track and adjust the window field according to any seen tcp window scaling options.",
2844             &tcp_relative_seq);
2845         prefs_register_bool_preference(tcp_module, "try_heuristic_first",
2846             "Try heuristic sub-dissectors first",
2847             "Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port",
2848             &try_heuristic_first);
2849
2850         register_init_routine(tcp_analyze_seq_init);
2851         register_init_routine(tcp_desegment_init);
2852         register_init_routine(tcp_fragment_init);
2853 }
2854
2855 void
2856 proto_reg_handoff_tcp(void)
2857 {
2858         dissector_handle_t tcp_handle;
2859
2860         tcp_handle = create_dissector_handle(dissect_tcp, proto_tcp);
2861         dissector_add("ip.proto", IP_PROTO_TCP, tcp_handle);
2862         data_handle = find_dissector("data");
2863         tcp_tap = register_tap("tcp");
2864 }