reassemble.h

Go to the documentation of this file.

 
/* make sure that all flags that are set in a fragment entry is also set for
 * the flags field of fd_head !!!
 */
#pragma once
#include <epan/packet_info.h>
#include <epan/proto.h>
#include "ws_symbol_export.h"
 
#ifdef __cplusplus
extern "C" {
#endif
 
/* in fd_head: packet is defragmented
 * in item: this item was used in defragmentation
 * (An item can have this set when the head does not if defragmentation
 * was reset due to changing the total length or partial reassembly.)
 */
#define FD_DEFRAGMENTED     0x0001
 
/* there are overlapping fragments */
#define FD_OVERLAP      0x0002
 
/* overlapping fragments contain different data */
#define FD_OVERLAPCONFLICT  0x0004
 
/* more than one fragment which indicates end-of data */
#define FD_MULTIPLETAILS    0x0008
 
/* fragment starts before the end of the datagram but extends
   past the end of the datagram */
#define FD_TOOLONGFRAGMENT  0x0010
 
/* fragment tvb is subset, don't tvb_free() it */
#define FD_SUBSET_TVB           0x0020
 
/* this flag is used to request fragment_add to continue the reassembly process */
#define FD_PARTIAL_REASSEMBLY   0x0040
 
/* fragment offset is indicated by sequence number and not byte offset
   into the defragmented packet */
#define FD_BLOCKSEQUENCE        0x0100
 
/* This flag is set in (only) fd_head to denote that datalen has been set to a valid value.
 * It's implied by FD_DEFRAGMENTED (we must know the total length of the
 * datagram if we have defragmented it...)
 */
#define FD_DATALEN_SET      0x0400
 
struct dissector_handle;

typedef struct _fragment_item {
    struct _fragment_item* next;      
    uint32_t  frame;                  
    uint32_t  offset;                 
    uint32_t  len;                    
    uint32_t  flags;                  
    tvbuff_t* tvb_data;               
} fragment_item;
 

typedef struct _fragment_head {
    struct _fragment_item* next;          
    struct _fragment_item* first_gap;     
    unsigned  ref_count;                  
    uint32_t  contiguous_len;             
    uint32_t  frame;                      
    uint32_t  len;                        
    uint32_t  fragment_nr_offset;         
    uint32_t  datalen;                    
    uint32_t  reassembled_in;             
    uint8_t   reas_in_layer_num;          
    uint32_t  flags;                      
    tvbuff_t* tvb_data;                   
    const char* error;                    
} fragment_head;
 
/*
 * Flags for fragment_add_seq_*
 */
 
/* we don't have any sequence numbers - fragments are assumed to appear in
 * order */
#define REASSEMBLE_FLAGS_NO_FRAG_NUMBER     0x0001
 
/* a special fudge for the 802.11 dissector */
#define REASSEMBLE_FLAGS_802_11_HACK        0x0002
 
/*
 * Flags for fragment_add_seq_single_*
 */
 
/* we want to age off old packets */
#define REASSEMBLE_FLAGS_AGING  0x0001
 
/*
 * Generates a fragment identifier based on the given parameters. "data" is an
 * opaque type whose interpretation is up to the caller of fragment_add*
 * functions and the fragment key function (possibly NULL if you do not care).
 *
 * Keys returned by this function are only used within this packet scope.
 */
typedef void * (*fragment_temporary_key)(const packet_info *pinfo,
    const uint32_t id, const void *data);
 
/*
 * Like fragment_temporary_key, but used for identifying reassembled fragments
 * which may persist through multiple packets.
 */
typedef void * (*fragment_persistent_key)(const packet_info *pinfo,
    const uint32_t id, const void *data);

typedef struct {
    GHashTable*             fragment_table;          
    GHashTable*             reassembled_table;       
    fragment_temporary_key  temporary_key_func;      
    fragment_persistent_key persistent_key_func;     
    GDestroyNotify          free_temporary_key_func; 
} reassembly_table;

typedef struct {
    GHashFunc hash_func;

    GEqualFunc equal_func;

    fragment_temporary_key temporary_key_func;

    fragment_persistent_key persistent_key_func;

    GDestroyNotify free_temporary_key_func;

    GDestroyNotify free_persistent_key_func;
} reassembly_table_functions;
 
/*
 * Tables of functions exported for the benefit of dissectors that
 * don't need special items in their keys.
 */
WS_DLL_PUBLIC const reassembly_table_functions
    addresses_reassembly_table_functions;       /* keys have endpoint addresses and an ID */
WS_DLL_PUBLIC const reassembly_table_functions
    addresses_ports_reassembly_table_functions; /* keys have endpoint addresses and ports and an ID */

WS_DLL_PUBLIC void
reassembly_table_register(reassembly_table *table,
              const reassembly_table_functions *funcs);

WS_DLL_PUBLIC void
reassembly_table_init(reassembly_table *table,
              const reassembly_table_functions *funcs);

WS_DLL_PUBLIC void
reassembly_table_destroy(reassembly_table *table);

WS_DLL_PUBLIC fragment_head *
fragment_add(reassembly_table *table, tvbuff_t *tvb, const int offset,
         const packet_info *pinfo, const uint32_t id, const void *data,
         const uint32_t frag_offset, const uint32_t frag_data_len,
         const bool more_frags);

WS_DLL_PUBLIC fragment_head *
fragment_add_multiple_ok(reassembly_table *table, tvbuff_t *tvb,
             const int offset, const packet_info *pinfo,
             const uint32_t id, const void *data,
             const uint32_t frag_offset,
             const uint32_t frag_data_len,
             const bool more_frags);

WS_DLL_PUBLIC fragment_head *
fragment_add_out_of_order(reassembly_table *table, tvbuff_t *tvb,
                          const int offset, const packet_info *pinfo,
                          const uint32_t id, const void *data,
                          const uint32_t frag_offset,
                          const uint32_t frag_data_len,
                          const bool more_frags, const uint32_t frag_frame);

WS_DLL_PUBLIC fragment_head *
fragment_add_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
           const packet_info *pinfo, const uint32_t id,
           const void *data, const uint32_t frag_offset,
           const uint32_t frag_data_len, const bool more_frags);

WS_DLL_PUBLIC fragment_head *
fragment_add_check_with_fallback(reassembly_table *table, tvbuff_t *tvb, const int offset,
           const packet_info *pinfo, const uint32_t id,
           const void *data, const uint32_t frag_offset,
           const uint32_t frag_data_len, const bool more_frags,
           const uint32_t fallback_frame);

WS_DLL_PUBLIC fragment_head *
fragment_add_check_next(reassembly_table *table, tvbuff_t *tvb, const int offset,
           const packet_info *pinfo, const uint32_t id,
           const void *data, const uint32_t frag_data_len,
           const bool more_frags);

WS_DLL_PUBLIC fragment_head *
fragment_add_seq(reassembly_table *table, tvbuff_t *tvb, const int offset,
         const packet_info *pinfo, const uint32_t id, const void *data,
         const uint32_t frag_number, const uint32_t frag_data_len,
         const bool more_frags, const uint32_t flags);

WS_DLL_PUBLIC fragment_head *
fragment_add_seq_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
               const packet_info *pinfo, const uint32_t id,
               const void *data,
               const uint32_t frag_number, const uint32_t frag_data_len,
               const bool more_frags);

WS_DLL_PUBLIC fragment_head *
fragment_add_seq_802_11(reassembly_table *table, tvbuff_t *tvb,
            const int offset, const packet_info *pinfo,
            const uint32_t id, const void *data,
            const uint32_t frag_number, const uint32_t frag_data_len,
            const bool more_frags);

WS_DLL_PUBLIC fragment_head *
fragment_add_seq_next(reassembly_table *table, tvbuff_t *tvb, const int offset,
              const packet_info *pinfo, const uint32_t id,
              const void *data, const uint32_t frag_data_len,
              const bool more_frags);

WS_DLL_PUBLIC fragment_head *
fragment_add_seq_single(reassembly_table *table, tvbuff_t *tvb,
            const int offset, const packet_info *pinfo, const uint32_t id,
            const void* data, const uint32_t frag_data_len,
            const bool first, const bool last,
            const uint32_t max_frags);

WS_DLL_PUBLIC fragment_head *
fragment_add_seq_single_aging(reassembly_table *table, tvbuff_t *tvb,
            const int offset, const packet_info *pinfo, const uint32_t id,
            const void* data, const uint32_t frag_data_len,
            const bool first, const bool last,
            const uint32_t max_frags, const uint32_t max_age);

WS_DLL_PUBLIC void
fragment_start_seq_check(reassembly_table *table, const packet_info *pinfo,
             const uint32_t id, const void *data,
             const uint32_t tot_len);

WS_DLL_PUBLIC fragment_head *
fragment_end_seq_next(reassembly_table *table, const packet_info *pinfo,
              const uint32_t id, const void *data);

WS_DLL_PUBLIC void
fragment_add_seq_offset(reassembly_table *table, const packet_info *pinfo, const uint32_t id,
                    const void *data, const uint32_t fragment_offset);

WS_DLL_PUBLIC void
fragment_set_tot_len(reassembly_table *table, const packet_info *pinfo,
             const uint32_t id, const void *data, const uint32_t tot_len);
 

WS_DLL_PUBLIC void
fragment_reset_tot_len(reassembly_table *table, const packet_info *pinfo,
               const uint32_t id, const void *data, const uint32_t tot_len);

WS_DLL_PUBLIC void
fragment_truncate(reassembly_table *table, const packet_info *pinfo,
               const uint32_t id, const void *data, const uint32_t tot_len);

WS_DLL_PUBLIC uint32_t
fragment_get_tot_len(reassembly_table *table, const packet_info *pinfo,
             const uint32_t id, const void *data);

WS_DLL_PUBLIC void
fragment_set_partial_reassembly(reassembly_table *table,
                const packet_info *pinfo, const uint32_t id,
                const void *data);

WS_DLL_PUBLIC fragment_head *
fragment_get(reassembly_table *table, const packet_info *pinfo,
         const uint32_t id, const void *data);
 
/* The same for the reassemble table */
WS_DLL_PUBLIC fragment_head *
fragment_get_reassembled_id(reassembly_table *table, const packet_info *pinfo,
                const uint32_t id);

WS_DLL_PUBLIC tvbuff_t *
fragment_delete(reassembly_table *table, const packet_info *pinfo,
        const uint32_t id, const void *data);

typedef struct _fragment_items {
    int* ett_fragment;                  
    int* ett_fragments;                 
 
    int* hf_fragments;                  
    int* hf_fragment;                   
    int* hf_fragment_overlap;           
    int* hf_fragment_overlap_conflict;  
    int* hf_fragment_multiple_tails;    
    int* hf_fragment_too_long_fragment; 
    int* hf_fragment_error;             
    int* hf_fragment_count;             
    int* hf_reassembled_in;             
    int* hf_reassembled_length;         
    int* hf_reassembled_data;           
 
    const char* tag;                    
} fragment_items;

WS_DLL_PUBLIC tvbuff_t *
process_reassembled_data(tvbuff_t *tvb, const int offset, packet_info *pinfo,
    const char *name, fragment_head *fd_head, const fragment_items *fit,
    bool *update_col_infop, proto_tree *tree);

WS_DLL_PUBLIC bool
show_fragment_tree(fragment_head *ipfd_head, const fragment_items *fit,
    proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);

WS_DLL_PUBLIC bool
show_fragment_seq_tree(fragment_head *ipfd_head, const fragment_items *fit,
    proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);

extern void reassembly_tables_init(void);

extern void
reassembly_table_cleanup(void);
 
/* ===================== Streaming data reassembly helper ===================== */
#define REASSEMBLE_ITEMS_DEFINE(var_prefix, name_prefix) \
    static int ett_##var_prefix##_fragment; \
    static int ett_##var_prefix##_fragments; \
    static int hf_##var_prefix##_fragments; \
    static int hf_##var_prefix##_fragment; \
    static int hf_##var_prefix##_fragment_overlap; \
    static int hf_##var_prefix##_fragment_overlap_conflicts; \
    static int hf_##var_prefix##_fragment_multiple_tails; \
    static int hf_##var_prefix##_fragment_too_long_fragment; \
    static int hf_##var_prefix##_fragment_error; \
    static int hf_##var_prefix##_fragment_count; \
    static int hf_##var_prefix##_reassembled_in; \
    static int hf_##var_prefix##_reassembled_length; \
    static int hf_##var_prefix##_reassembled_data; \
    static int hf_##var_prefix##_segment; \
    static const fragment_items var_prefix##_fragment_items = { \
        &ett_##var_prefix##_fragment, \
        &ett_##var_prefix##_fragments, \
        &hf_##var_prefix##_fragments, \
        &hf_##var_prefix##_fragment, \
        &hf_##var_prefix##_fragment_overlap, \
        &hf_##var_prefix##_fragment_overlap_conflicts, \
        &hf_##var_prefix##_fragment_multiple_tails, \
        &hf_##var_prefix##_fragment_too_long_fragment, \
        &hf_##var_prefix##_fragment_error, \
        &hf_##var_prefix##_fragment_count, \
        &hf_##var_prefix##_reassembled_in, \
        &hf_##var_prefix##_reassembled_length, \
        &hf_##var_prefix##_reassembled_data, \
        name_prefix " fragments" \
    }

#define REASSEMBLE_INIT_HF_ITEMS(var_prefix, name_prefix, abbrev_prefix) \
        { &hf_##var_prefix##_fragments, \
            { "Reassembled " name_prefix " fragments", abbrev_prefix ".fragments", \
                FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_fragment, \
            { name_prefix " fragment", abbrev_prefix ".fragment", \
                FT_FRAMENUM, BASE_NONE, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_fragment_overlap, \
            { name_prefix " fragment overlap", abbrev_prefix ".fragment.overlap", \
                FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_fragment_overlap_conflicts, \
            { name_prefix " fragment overlapping with conflicting data", abbrev_prefix ".fragment.overlap.conflicts", \
                FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_fragment_multiple_tails, \
            { name_prefix " has multiple tail fragments", abbrev_prefix ".fragment.multiple_tails", \
                FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_fragment_too_long_fragment, \
            { name_prefix " fragment too long", abbrev_prefix ".fragment.too_long_fragment", \
                FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_fragment_error, \
            { name_prefix " defragment error", abbrev_prefix ".fragment.error", \
                FT_FRAMENUM, BASE_NONE, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_fragment_count, \
            { name_prefix " fragment count", abbrev_prefix ".fragment.count", \
                FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_reassembled_in, \
            { "Reassembled in", abbrev_prefix ".reassembled.in", \
                FT_FRAMENUM, BASE_NONE, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_reassembled_length, \
            { "Reassembled length", abbrev_prefix ".reassembled.length", \
                FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_reassembled_data, \
            { "Reassembled data", abbrev_prefix ".reassembled.data", \
                FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } \
        }, \
        { &hf_##var_prefix##_segment, \
            { name_prefix " segment", abbrev_prefix ".segment", \
                FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL} \
        }

#define REASSEMBLE_INIT_ETT_ITEMS(var_prefix) \
        &ett_##var_prefix##_fragment, \
        &ett_##var_prefix##_fragments

typedef struct streaming_reassembly_info_t streaming_reassembly_info_t;

WS_DLL_PUBLIC streaming_reassembly_info_t*
streaming_reassembly_info_new(void);

WS_DLL_PUBLIC int
reassemble_streaming_data_and_call_subdissector(
    tvbuff_t* tvb, packet_info* pinfo, unsigned offset, int length,
    proto_tree* segment_tree, proto_tree* reassembled_tree, reassembly_table streaming_reassembly_table,
    streaming_reassembly_info_t* reassembly_info, uint64_t cur_frame_num,
    struct dissector_handle* subdissector_handle, proto_tree* subdissector_tree, void* subdissector_data,
    const char* label, const fragment_items* frag_hf_items, int hf_segment_data
);

static inline uint64_t
get_virtual_frame_num64(tvbuff_t* tvb, packet_info* pinfo, int offset)
{
    return (((uint64_t)pinfo->num) << 32) + (((uint64_t)pinfo->curr_layer_num) << 24)
        + ((uint64_t)tvb_raw_offset(tvb) + offset);
}

WS_DLL_PUBLIC int
additional_bytes_expected_to_complete_reassembly(streaming_reassembly_info_t* reassembly_info);
 
/* ========================================================================= */
 
#ifdef __cplusplus
}
#endif