*
* $Id$
*
- * Ethereal - Network traffic analyzer
- * By Gerald Combs <gerald@ethereal.com>
+ * Wireshark - Network traffic analyzer
+ * By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* This program is free software; you can redistribute it and/or
* the flags field of fd_head !!!
*/
+#ifndef REASSEMBLE_H
+#define REASSEMBLE_H
+
/* only in fd_head: packet is defragmented */
#define FD_DEFRAGMENTED 0x0001
/* fragment contains data past the end of the datagram */
#define FD_TOOLONGFRAGMENT 0x0010
-/* fragment data not alloced, fd->data pointing to fd_head->data+fd->offset */
+/* fragment data not alloc'ed, fd->data pointing to fd_head->data+fd->offset */
#define FD_NOT_MALLOCED 0x0020
/* this flag is used to request fragment_add to continue the reassembly process */
into the defragmented packet */
#define FD_BLOCKSEQUENCE 0x0100
+/* if REASSEMBLE_FLAGS_CHECK_DATA_PRESENT is set, and the first fragment is
+ * incomplete, this flag is set in the flags word on the fd_head returned.
+ *
+ * It's all a fudge to preserve historical behaviour.
+ */
+#define FD_DATA_NOT_PRESENT 0x0200
+
+/* This flag is set in (only) fd_head to denote that datalen has been set to a valid value.
+ * It's implied by FD_DEFRAGMENTED (we must know the total length of the
+ * datagram if we have defragmented it...)
+ */
+#define FD_DATALEN_SET 0x0400
+
typedef struct _fragment_data {
struct _fragment_data *next;
guint32 frame;
guint32 offset;
guint32 len;
- guint32 datalen; /*Only valid in first item of list */
+ guint32 datalen; /* Only valid in first item of list and when
+ * flags&FD_DATALEN_SET is set;
+ * number of bytes or (if flags&FD_BLOCKSEQUENCE set)
+ * segments in the datagram */
guint32 reassembled_in; /* frame where this PDU was reassembled,
only valid in the first item of the list
and when FD_DEFRAGMENTED is set*/
unsigned char *data;
} fragment_data;
+
+/*
+ * Flags for fragment_add_seq_*
+ */
+
+/* we don't have any sequence numbers - fragments are assumed to appear in
+ * order */
+#define REASSEMBLE_FLAGS_NO_FRAG_NUMBER 0x0001
+
+/* a special fudge for the 802.11 dissector */
+#define REASSEMBLE_FLAGS_802_11_HACK 0x0002
+
+/* causes fragment_add_seq_key to check that all the fragment data is present
+ * in the tvb, and if not, do something a bit odd. */
+#define REASSEMBLE_FLAGS_CHECK_DATA_PRESENT 0x0004
+
+/* a function for copying hash keys */
+typedef void *(*fragment_key_copier)(const void *key);
+
/*
* Initialize a fragment table.
*/
*/
extern void reassembled_table_init(GHashTable **reassembled_table);
-/*
- * Free up all space allocated for fragment keys and data.
- */
-void reassemble_init(void);
-
/*
* This function adds a new fragment to the fragment hash table.
* If this is the first fragment seen for this datagram, a new entry
* Returns a pointer to the head of the fragment data list if we have all the
* fragments, NULL otherwise.
*/
-extern fragment_data *fragment_add(tvbuff_t *tvb, int offset, packet_info *pinfo,
- guint32 id, GHashTable *fragment_table, guint32 frag_offset,
- guint32 frag_data_len, gboolean more_frags);
-extern fragment_data *fragment_add_multiple_ok(tvbuff_t *tvb, int offset,
- packet_info *pinfo, guint32 id, GHashTable *fragment_table,
- guint32 frag_offset, guint32 frag_data_len, gboolean more_frags);
+extern fragment_data *fragment_add(tvbuff_t *tvb, const int offset, const packet_info *pinfo,
+ const guint32 id, GHashTable *fragment_table, const guint32 frag_offset,
+ guint32 const frag_data_len, const gboolean more_frags);
+extern fragment_data *fragment_add_multiple_ok(tvbuff_t *tvb, const int offset,
+ const packet_info *pinfo, const guint32 id, GHashTable *fragment_table,
+ const guint32 frag_offset, const guint32 frag_data_len, const gboolean more_frags);
-extern fragment_data *fragment_add_check(tvbuff_t *tvb, int offset,
- packet_info *pinfo, guint32 id, GHashTable *fragment_table,
- GHashTable *reassembled_table, guint32 frag_offset,
- guint32 frag_data_len, gboolean more_frags);
+/*
+ * This routine extends fragment_add to use a "reassembled_table".
+ *
+ * If, after processing this fragment, we have all the fragments, they
+ * remove that from the fragment hash table if necessary and add it
+ * to the table of reassembled fragments, and return a pointer to the
+ * head of the fragment list.
+ */
+extern fragment_data *fragment_add_check(tvbuff_t *tvb, const int offset,
+ const packet_info *pinfo, const guint32 id, GHashTable *fragment_table,
+ GHashTable *reassembled_table, const guint32 frag_offset,
+ const guint32 frag_data_len, const gboolean more_frags);
/* same as fragment_add() but this one assumes frag_number is a block
sequence number. note that frag_number is 0 for the first fragment. */
-extern fragment_data *fragment_add_seq(tvbuff_t *tvb, int offset, packet_info *pinfo,
- guint32 id, GHashTable *fragment_table, guint32 frag_number,
- guint32 frag_data_len, gboolean more_frags);
-
-extern fragment_data *
-fragment_add_dcerpc(tvbuff_t *tvb, int offset, packet_info *pinfo, guint32 id,
- void *act_id,
- GHashTable *fragment_table, guint32 frag_number,
- guint32 frag_data_len, gboolean more_frags);
/*
- * These functions add a new fragment to the fragment hash table.
+ * These functions add a new fragment to the fragment hash table,
+ * assuming that frag_number is a block sequence number (starting from zero for
+ * the first fragment of each datagram).
+ *
* If this is the first fragment seen for this datagram, a new
- * "fragment_data" structure is allocated to refer to the reassembled,
+ * "fragment_data" structure is allocated to refer to the reassembled
* packet, and:
*
- * in "fragment_add_seq_802_11()", if "more_frags" is false,
- * the structure is not added to the hash table, and not given
- * any fragments to refer to, but is just returned;
+ * if "more_frags" is false, and either we have no sequence numbers, or
+ * are using the 802.11 hack, it is assumed that this is the only fragment
+ * in the datagram. The structure is not added to the hash
+ * table, and not given any fragments to refer to, but is just returned.
*
- * otherwise, this fragment is added to the linked list of fragments
- * for this packet, and the "fragment_data" structure is put into
- * the hash table.
+ * In this latter case reassembly wasn't done (since there was only one
+ * fragment in the packet); dissectors can check the 'next' pointer on the
+ * returned list to see if this case was hit or not.
*
* Otherwise, this fragment is just added to the linked list of fragments
- * for this packet.
+ * for this packet; the fragment_data is also added to the fragment hash if
+ * necessary.
+ *
+ * If this packet completes assembly, these functions return the head of the
+ * fragment data; otherwise, they return null.
+ */
+
+/* "key" should be an arbitrary key used for indexing the fragment hash;
+ * "key_copier" is called to copy the key to a more appropriate store before
+ * inserting a new entry to the hash.
+ */
+extern fragment_data *
+fragment_add_seq_key(tvbuff_t *tvb, const int offset, const packet_info *pinfo,
+ void *key, fragment_key_copier key_copier,
+ GHashTable *fragment_table, guint32 frag_number,
+ const guint32 frag_data_len, const gboolean more_frags,
+ const guint32 flags);
+
+/* a wrapper for fragment_add_seq_key - uses a key of source, dest and id */
+extern fragment_data *fragment_add_seq(tvbuff_t *tvb, const int offset, const packet_info *pinfo,
+ const guint32 id, GHashTable *fragment_table, const guint32 frag_number,
+ const guint32 frag_data_len, const gboolean more_frags);
+
+/* another wrapper for fragment_add_seq_key - uses a key of source, dest, id
+ * and act_id */
+extern fragment_data *
+fragment_add_dcerpc_dg(tvbuff_t *tvb, const int offset, const packet_info *pinfo, const guint32 id,
+ void *act_id,
+ GHashTable *fragment_table, const guint32 frag_number,
+ const guint32 frag_data_len, const gboolean more_frags);
+
+/*
+ * These routines extend fragment_add_seq_key to use a "reassembled_table".
*
* If, after processing this fragment, we have all the fragments, they
* remove that from the fragment hash table if necessary and add it
* to the table of reassembled fragments, and return a pointer to the
* head of the fragment list.
- *
- * If this is the first fragment we've seen, and "more_frags" is false,
- * "fragment_add_seq_802_11()" does nothing to the fragment data list,
- * and returns a pointer to the head of that (empty) list. The other
- * routines return NULL.
- *
- * Otherwise, they return NULL.
- *
- * "fragment_add_seq_check()" and "fragment_add_seq_802_11()" assume
- * frag_number is a block sequence number.
- * The bsn for the first block is 0.
- *
- * "fragment_add_seq_next()" is for protocols with no sequence number,
- * and assumes fragments always appear in sequence.
*/
extern fragment_data *
-fragment_add_seq_check(tvbuff_t *tvb, int offset, packet_info *pinfo,
- guint32 id, GHashTable *fragment_table,
- GHashTable *reassembled_table, guint32 frag_number,
- guint32 frag_data_len, gboolean more_frags);
+fragment_add_seq_check(tvbuff_t *tvb, const int offset,
+ const packet_info *pinfo, const guint32 id,
+ GHashTable *fragment_table,
+ GHashTable *reassembled_table, const guint32 frag_number,
+ const guint32 frag_data_len, const gboolean more_frags);
extern fragment_data *
-fragment_add_seq_802_11(tvbuff_t *tvb, int offset, packet_info *pinfo,
- guint32 id, GHashTable *fragment_table,
- GHashTable *reassembled_table, guint32 frag_number,
- guint32 frag_data_len, gboolean more_frags);
+fragment_add_seq_802_11(tvbuff_t *tvb, const int offset,
+ const packet_info *pinfo, const guint32 id,
+ GHashTable *fragment_table,
+ GHashTable *reassembled_table,
+ const guint32 frag_number, const guint32 frag_data_len,
+ const gboolean more_frags);
extern fragment_data *
-fragment_add_seq_next(tvbuff_t *tvb, int offset, packet_info *pinfo, guint32 id,
- GHashTable *fragment_table, GHashTable *reassembled_table,
- guint32 frag_data_len, gboolean more_frags);
+fragment_add_seq_next(tvbuff_t *tvb, const int offset, const packet_info *pinfo,
+ const guint32 id, GHashTable *fragment_table,
+ GHashTable *reassembled_table,
+ const guint32 frag_data_len, const gboolean more_frags);
+
+extern void
+fragment_start_seq_check(const packet_info *pinfo, const guint32 id, GHashTable *fragment_table,
+ const guint32 tot_len);
+extern fragment_data *
+fragment_end_seq_next(const packet_info *pinfo, const guint32 id, GHashTable *fragment_table,
+ GHashTable *reassembled_table);
/* to specify how much to reassemble, for fragmentation where last fragment can not be
* identified by flags or such.
* note that for FD_BLOCKSEQUENCE tot_len is the index for the tail fragment.
*
*/
extern void
-fragment_set_tot_len(packet_info *pinfo, guint32 id, GHashTable *fragment_table,
- guint32 tot_len);
+fragment_set_tot_len(const packet_info *pinfo, const guint32 id, GHashTable *fragment_table,
+ const guint32 tot_len);
/* to resad whatever totlen previously set */
extern guint32
-fragment_get_tot_len(packet_info *pinfo, guint32 id, GHashTable *fragment_table);
+fragment_get_tot_len(const packet_info *pinfo, const guint32 id, GHashTable *fragment_table);
/*
* This function will set the partial reassembly flag(FD_PARTIAL_REASSEMBLY) for a fh.
* and if FD_DEFRAGMENTED is set, the reassembly process will be continued.
*/
extern void
-fragment_set_partial_reassembly(packet_info *pinfo, guint32 id, GHashTable *fragment_table);
+fragment_set_partial_reassembly(const packet_info *pinfo, const guint32 id, GHashTable *fragment_table);
/* This function is used to check if there is partial or completed reassembly state
* matching this packet. I.e. Are there reassembly going on or not for this packet?
*/
extern fragment_data *
-fragment_get(packet_info *pinfo, guint32 id, GHashTable *fragment_table);
+fragment_get(const packet_info *pinfo, const guint32 id, GHashTable *fragment_table);
+
+/* The same for the reassemble table */
+/* id *must* be the frame number for this to work! */
+extern fragment_data *
+fragment_get_reassembled(const guint32 id, GHashTable *reassembled_table);
+
+extern fragment_data *
+fragment_get_reassembled_id(const packet_info *pinfo, const guint32 id, GHashTable *reassembled_table);
/* This will free up all resources and delete reassembly state for this PDU.
* Except if the PDU is completely reassembled, then it would NOT deallocate the
* g_free() that buffer.
*/
extern unsigned char *
-fragment_delete(packet_info *pinfo, guint32 id, GHashTable *fragment_table);
+fragment_delete(const packet_info *pinfo, const guint32 id, GHashTable *fragment_table);
/* hf_fragment, hf_fragment_error, and hf_reassembled_in should be
FT_FRAMENUM, the others should be FT_BOOLEAN
int *hf_fragment_multiple_tails;
int *hf_fragment_too_long_fragment;
int *hf_fragment_error;
+ int *hf_fragment_count;
int *hf_reassembled_in;
+ int *hf_reassembled_length;
const char *tag;
} fragment_items;
extern tvbuff_t *
-process_reassembled_data(tvbuff_t *tvb, int offset, packet_info *pinfo,
+process_reassembled_data(tvbuff_t *tvb, const int offset, packet_info *pinfo,
const char *name, fragment_data *fd_head, const fragment_items *fit,
gboolean *update_col_infop, proto_tree *tree);
extern gboolean
show_fragment_seq_tree(fragment_data *ipfd_head, const fragment_items *fit,
proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);
+
+#endif
git.samba.org / obnox / wireshark / wip.git / blobdiff