epan/packet.h

   1 /** @file
   2  * Definitions for packet disassembly structures and routines
   3  *
   4  * Wireshark - Network traffic analyzer
   5  * By Gerald Combs <gerald@wireshark.org>
   6  * Copyright 1998 Gerald Combs
   7  *
   8  * SPDX-License-Identifier: GPL-2.0-or-later
   9  */
  10
  11 #ifndef __PACKET_H__
  12 #define __PACKET_H__
  13
  14 #include <wsutil/array.h>
  15 #include <wiretap/wtap_opttypes.h>
  16 #include "proto.h"
  17 #include "tvbuff.h"
  18 #include "epan.h"
  19 #include "frame_data.h"
  20 #include "packet_info.h"
  21 #include "column-utils.h"
  22 #include "guid-utils.h"
  23
  24 #ifdef __cplusplus
  25 extern "C" {
  26 #endif /* __cplusplus */
  27
  28 struct epan_range;
  29
  30 /** @defgroup packet General Packet Dissection
  31  *
  32  * @{
  33  */
  34
  35 #define hi_nibble(b) (((b) & 0xf0) >> 4)
  36 #define lo_nibble(b) ((b) & 0x0f)
  37
  38 /* Check whether the "len" bytes of data starting at "offset" is
  39  * entirely inside the captured data for this packet. */
  40 #define BYTES_ARE_IN_FRAME(offset, captured_len, len) \
  41         ((unsigned)(offset) + (unsigned)(len) > (unsigned)(offset) && \
  42          (unsigned)(offset) + (unsigned)(len) <= (unsigned)(captured_len))
  43
  44 /* 0 is case insensitive for backwards compatibility with tables that
  45  * used false or BASE_NONE for case sensitive, which was the default.
  46  */
  47 #define STRING_CASE_SENSITIVE 0
  48 #define STRING_CASE_INSENSITIVE 1
  49
  50 extern void packet_init(void);
  51 extern void packet_cache_proto_handles(void);
  52 extern void packet_all_tables_sort_handles(void);
  53 extern void packet_cleanup(void);
  54
  55 /* Handle for dissectors you call directly or register with "dissector_add_uint()".
  56    This handle is opaque outside of "packet.c". */
  57 struct dissector_handle;
  58 typedef struct dissector_handle *dissector_handle_t;
  59
  60 /* Hash table for matching unsigned integers, or strings, and dissectors;
  61    this is opaque outside of "packet.c". */
  62 struct dissector_table;
  63 typedef struct dissector_table *dissector_table_t;
  64
  65 /*
  66  * Dissector that returns:
  67  *
  68  *      The amount of data in the protocol's PDU, if it was able to
  69  *      dissect all the data;
  70  *
  71  *      0, if the tvbuff doesn't contain a PDU for that protocol;
  72  *
  73  *      The negative of the amount of additional data needed, if
  74  *      we need more data (e.g., from subsequent TCP segments) to
  75  *      dissect the entire PDU.
  76  */
  77 typedef int (*dissector_t)(tvbuff_t *, packet_info *, proto_tree *, void *);
  78
  79 /* Same as dissector_t with an extra parameter for callback pointer */
  80 typedef int (*dissector_cb_t)(tvbuff_t *, packet_info *, proto_tree *, void *, void *);
  81
  82 /** Type of a heuristic dissector, used in heur_dissector_add().
  83  *
  84  * @param tvb the tvbuff with the (remaining) packet data
  85  * @param pinfo the packet info of this packet (additional info)
  86  * @param tree the protocol tree to be build or NULL
  87  * @return true if the packet was recognized by the sub-dissector (stop dissection here)
  88  */
  89 typedef bool (*heur_dissector_t)(tvbuff_t *tvb, packet_info *pinfo,
  90         proto_tree *tree, void *);
  91
  92 typedef enum {
  93     HEURISTIC_DISABLE,
  94     HEURISTIC_ENABLE
  95 } heuristic_enable_e;
  96
  97 typedef void (*DATFunc) (const char *table_name, ftenum_t selector_type,
  98     void *key, void *value, void *user_data);
  99 typedef void (*DATFunc_handle) (const char *table_name, void *value,
 100     void *user_data);
 101 typedef void (*DATFunc_table) (const char *table_name, const char *ui_name,
 102     void *user_data);
 103
 104 /* Opaque structure - provides type checking but no access to components */
 105 typedef struct dtbl_entry dtbl_entry_t;
 106
 107 WS_DLL_PUBLIC dissector_handle_t dtbl_entry_get_handle (dtbl_entry_t *dtbl_entry);
 108 WS_DLL_PUBLIC dissector_handle_t dtbl_entry_get_initial_handle (dtbl_entry_t * entry);
 109
 110 /** Iterate over dissectors in a table with non-default "decode as" settings.
 111  *
 112  * Walk one dissector table calling a user supplied function only on
 113  * any entry that has been changed from its original state.
 114  *
 115  * @param[in] table_name The name of the dissector table, e.g. "ip.proto".
 116  * @param[in] func The function to call for each dissector.
 117  * @param[in] user_data User data to pass to the function.
 118  */
 119 void dissector_table_foreach_changed (const char *table_name, DATFunc func,
 120     void *user_data);
 121
 122 /** Iterate over dissectors in a table.
 123  *
 124  * Walk one dissector table's hash table calling a user supplied function
 125  * on each entry.
 126  *
 127  * @param[in] table_name The name of the dissector table, e.g. "ip.proto".
 128  * @param[in] func The function to call for each dissector.
 129  * @param[in] user_data User data to pass to the function.
 130  */
 131 WS_DLL_PUBLIC void dissector_table_foreach (const char *table_name, DATFunc func,
 132     void *user_data);
 133
 134 /** Iterate over dissectors with non-default "decode as" settings.
 135  *
 136  * Walk all dissector tables calling a user supplied function only on
 137  * any "decode as" entry that has been changed from its original state.
 138  *
 139  * @param[in] func The function to call for each dissector.
 140  * @param[in] user_data User data to pass to the function.
 141  */
 142 WS_DLL_PUBLIC void dissector_all_tables_foreach_changed (DATFunc func,
 143     void *user_data);
 144
 145 /** Iterate over dissectors in a table by handle.
 146  *
 147  * Walk one dissector table's list of handles calling a user supplied
 148  * function on each entry.
 149  *
 150  * @param[in] table_name The name of the dissector table, e.g. "ip.proto".
 151  * @param[in] func The function to call for each dissector.
 152  * @param[in] user_data User data to pass to the function.
 153  */
 154 WS_DLL_PUBLIC void dissector_table_foreach_handle(const char *table_name, DATFunc_handle func,
 155     void *user_data);
 156
 157 /** Iterate over all dissector tables.
 158  *
 159  * Walk the set of dissector tables calling a user supplied function on each
 160  * table.
 161  * @param[in] func The function to call for each table.
 162  * @param[in] user_data User data to pass to the function.
 163  * @param[in] compare_key_func Function used to sort the set of tables before
 164  * calling the function.  No sorting is done if NULL. */
 165 WS_DLL_PUBLIC void dissector_all_tables_foreach_table (DATFunc_table func,
 166     void *user_data, GCompareFunc compare_key_func);
 167
 168 /* a protocol uses the function to register a sub-dissector table
 169  *
 170  * 'param' is the display base for integer tables, STRING_CASE_SENSITIVE
 171  * or STRING_CASE_INSENSITIVE for string tables, and ignored for other
 172  * table types.
 173  */
 174 WS_DLL_PUBLIC dissector_table_t register_dissector_table(const char *name,
 175     const char *ui_name, const int proto, const ftenum_t type, const int param);
 176
 177 /*
 178  * Similar to register_dissector_table, but with a "custom" hash function
 179  * to store subdissectors.
 180  */
 181 WS_DLL_PUBLIC dissector_table_t register_custom_dissector_table(const char *name,
 182     const char *ui_name, const int proto, GHashFunc hash_func, GEqualFunc key_equal_func,
 183     GDestroyNotify key_destroy_func);
 184
 185 /** Register a dissector table alias.
 186  * This is for dissectors whose original name has changed, e.g. SSL to TLS.
 187  * @param dissector_table dissector table returned by register_dissector_table.
 188  * @param alias_name alias for the dissector table name.
 189  */
 190 WS_DLL_PUBLIC void register_dissector_table_alias(dissector_table_t dissector_table,
 191     const char *alias_name);
 192
 193 /** Deregister the dissector table by table name. */
 194 void deregister_dissector_table(const char *name);
 195
 196 /* Find a dissector table by table name. */
 197 WS_DLL_PUBLIC dissector_table_t find_dissector_table(const char *name);
 198
 199 /* Get the UI name for a sub-dissector table, given its internal name */
 200 WS_DLL_PUBLIC const char *get_dissector_table_ui_name(const char *name);
 201
 202 /* Get the field type for values of the selector for a dissector table,
 203    given the table's internal name */
 204 WS_DLL_PUBLIC ftenum_t get_dissector_table_selector_type(const char *name);
 205
 206 /* Get the param set for the sub-dissector table,
 207    given the table's internal name */
 208 WS_DLL_PUBLIC int get_dissector_table_param(const char *name);
 209
 210 /* Dump all dissector tables to the standard output (not the entries,
 211    just the information about the tables) */
 212 WS_DLL_PUBLIC void dissector_dump_dissector_tables(void);
 213
 214 /* Add an entry to a uint dissector table. */
 215 WS_DLL_PUBLIC void dissector_add_uint(const char *name, const uint32_t pattern,
 216     dissector_handle_t handle);
 217
 218 /* Add an entry to a uint dissector table with "preference" automatically added. */
 219 WS_DLL_PUBLIC void dissector_add_uint_with_preference(const char *name, const uint32_t pattern,
 220     dissector_handle_t handle);
 221
 222 /* Add an range of entries to a uint dissector table. */
 223 WS_DLL_PUBLIC void dissector_add_uint_range(const char *abbrev, struct epan_range *range,
 224     dissector_handle_t handle);
 225
 226 /* Add an range of entries to a uint dissector table with "preference" automatically added. */
 227 WS_DLL_PUBLIC void dissector_add_uint_range_with_preference(const char *abbrev, const char* range_str,
 228     dissector_handle_t handle);
 229
 230 /* Delete the entry for a dissector in a uint dissector table
 231    with a particular pattern. */
 232 WS_DLL_PUBLIC void dissector_delete_uint(const char *name, const uint32_t pattern,
 233     dissector_handle_t handle);
 234
 235 /* Delete an range of entries from a uint dissector table. */
 236 WS_DLL_PUBLIC void dissector_delete_uint_range(const char *abbrev, struct epan_range *range,
 237     dissector_handle_t handle);
 238
 239 /* Delete all entries from a dissector table. */
 240 WS_DLL_PUBLIC void dissector_delete_all(const char *name, dissector_handle_t handle);
 241
 242 /* Change the entry for a dissector in a uint dissector table
 243    with a particular pattern to use a new dissector handle. */
 244 WS_DLL_PUBLIC void dissector_change_uint(const char *abbrev, const uint32_t pattern,
 245     dissector_handle_t handle);
 246
 247 /* Reset an entry in a uint dissector table to its initial value. */
 248 WS_DLL_PUBLIC void dissector_reset_uint(const char *name, const uint32_t pattern);
 249
 250 /* Return true if an entry in a uint dissector table is found and has been
 251  * changed (i.e. dissector_change_uint() has been called, such as from
 252  * Decode As, prefs registered via dissector_add_uint_[range_]with_preference),
 253  * etc.), otherwise return false.
 254  */
 255 WS_DLL_PUBLIC bool dissector_is_uint_changed(dissector_table_t const sub_dissectors, const uint32_t uint_val);
 256
 257 /* Look for a given value in a given uint dissector table and, if found,
 258    call the dissector with the arguments supplied, and return the number
 259    of bytes consumed, otherwise return 0. */
 260 WS_DLL_PUBLIC int dissector_try_uint(dissector_table_t sub_dissectors,
 261     const uint32_t uint_val, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 262
 263 /* Look for a given value in a given uint dissector table and, if found,
 264    call the dissector with the arguments supplied, and return the number
 265    of bytes consumed, otherwise return 0. */
 266 WS_DLL_PUBLIC int dissector_try_uint_new(dissector_table_t sub_dissectors,
 267     const uint32_t uint_val, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data);
 268
 269 /** Look for a given value in a given uint dissector table and, if found,
 270  * return the current dissector handle for that value.
 271  *
 272  * @param[in] sub_dissectors Dissector table to search.
 273  * @param[in] uint_val Value to match, e.g. the port number for the TCP dissector.
 274  * @return The matching dissector handle on success, NULL if no match is found.
 275  */
 276 WS_DLL_PUBLIC dissector_handle_t dissector_get_uint_handle(
 277     dissector_table_t const sub_dissectors, const uint32_t uint_val);
 278
 279 /** Look for a given value in a given uint dissector table and, if found,
 280  * return the default dissector handle for that value.
 281  *
 282  * @param[in] name Dissector table name.
 283  * @param[in] uint_val Value to match, e.g. the port number for the TCP dissector.
 284  * @return The matching dissector handle on success, NULL if no match is found.
 285  */
 286 WS_DLL_PUBLIC dissector_handle_t dissector_get_default_uint_handle(
 287     const char *name, const uint32_t uint_val);
 288
 289 /* Add an entry to a string dissector table. */
 290 WS_DLL_PUBLIC void dissector_add_string(const char *name, const char *pattern,
 291     dissector_handle_t handle);
 292
 293 /* Delete the entry for a dissector in a string dissector table
 294    with a particular pattern. */
 295 WS_DLL_PUBLIC void dissector_delete_string(const char *name, const char *pattern,
 296         dissector_handle_t handle);
 297
 298 /* Change the entry for a dissector in a string dissector table
 299    with a particular pattern to use a new dissector handle. */
 300 WS_DLL_PUBLIC void dissector_change_string(const char *name, const char *pattern,
 301     dissector_handle_t handle);
 302
 303 /* Reset an entry in a string sub-dissector table to its initial value. */
 304 WS_DLL_PUBLIC void dissector_reset_string(const char *name, const char *pattern);
 305
 306 /* Return true if an entry in a string dissector table is found and has been
 307  * changed (i.e. dissector_change_string() has been called, such as from
 308  * Decode As), otherwise return false.
 309  */
 310 WS_DLL_PUBLIC bool dissector_is_string_changed(dissector_table_t const subdissectors, const char *string);
 311
 312 /* Look for a given string in a given dissector table and, if found, call
 313    the dissector with the arguments supplied, and return the number of
 314    bytes consumed, otherwise return 0. */
 315 WS_DLL_PUBLIC int dissector_try_string(dissector_table_t sub_dissectors,
 316     const char *string, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data);
 317
 318 /* Look for a given string in a given dissector table and, if found, call
 319    the dissector with the arguments supplied, and return the number of
 320    bytes consumed, otherwise return 0. */
 321 WS_DLL_PUBLIC int dissector_try_string_new(dissector_table_t sub_dissectors,
 322     const char *string, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name,void *data);
 323
 324 /** Look for a given value in a given string dissector table and, if found,
 325  * return the current dissector handle for that value.
 326  *
 327  * @param[in] sub_dissectors Dissector table to search.
 328  * @param[in] string Value to match, e.g. the OID for the BER dissector.
 329  * @return The matching dissector handle on success, NULL if no match is found.
 330  */
 331 WS_DLL_PUBLIC dissector_handle_t dissector_get_string_handle(
 332     dissector_table_t sub_dissectors, const char *string);
 333
 334 /** Look for a given value in a given string dissector table and, if found,
 335  * return the default dissector handle for that value.
 336  *
 337  * @param[in] name Dissector table name.
 338  * @param[in] string Value to match, e.g. the OID for the BER dissector.
 339  * @return The matching dissector handle on success, NULL if no match is found.
 340  */
 341 WS_DLL_PUBLIC dissector_handle_t dissector_get_default_string_handle(
 342     const char *name, const char *string);
 343
 344 /* Add an entry to a "custom" dissector table. */
 345 WS_DLL_PUBLIC void dissector_add_custom_table_handle(const char *name, void *pattern,
 346     dissector_handle_t handle);
 347
 348 /** Look for a given key in a given "custom" dissector table and, if found,
 349  * return the current dissector handle for that key.
 350  *
 351  * @param[in] sub_dissectors Dissector table to search.
 352  * @param[in] key Value to match, e.g. RPC key for its subdissectors
 353  * @return The matching dissector handle on success, NULL if no match is found.
 354  */
 355 WS_DLL_PUBLIC dissector_handle_t dissector_get_custom_table_handle(
 356     dissector_table_t sub_dissectors, void *key);
 357 /* Key for GUID dissector tables.  This is based off of DCE/RPC needs
 358    so some dissector tables may not need the ver portion of the hash
 359  */
 360 typedef struct _guid_key {
 361     e_guid_t guid;
 362     uint16_t ver;
 363 } guid_key;
 364
 365 /* Add an entry to a guid dissector table. */
 366 WS_DLL_PUBLIC void dissector_add_guid(const char *name, guid_key* guid_val,
 367     dissector_handle_t handle);
 368
 369 /* Look for a given value in a given guid dissector table and, if found,
 370    call the dissector with the arguments supplied, and return true,
 371    otherwise return false. */
 372 WS_DLL_PUBLIC int dissector_try_guid(dissector_table_t sub_dissectors,
 373     guid_key* guid_val, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 374
 375 /* Look for a given value in a given guid dissector table and, if found,
 376    call the dissector with the arguments supplied, and return true,
 377    otherwise return false. */
 378 WS_DLL_PUBLIC int dissector_try_guid_new(dissector_table_t sub_dissectors,
 379     guid_key* guid_val, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data);
 380
 381 /* Delete a GUID from a dissector table. */
 382 WS_DLL_PUBLIC void dissector_delete_guid(const char *name, guid_key* guid_val,
 383     dissector_handle_t handle);
 384
 385 /** Look for a given value in a given guid dissector table and, if found,
 386  * return the current dissector handle for that value.
 387  *
 388  * @param[in] sub_dissectors Dissector table to search.
 389  * @param[in] guid_val Value to match, e.g. the GUID number for the GUID dissector.
 390  * @return The matching dissector handle on success, NULL if no match is found.
 391  */
 392 WS_DLL_PUBLIC dissector_handle_t dissector_get_guid_handle(
 393     dissector_table_t const sub_dissectors, guid_key* guid_val);
 394
 395 /* Use the currently assigned payload dissector for the dissector table and,
 396    if any, call the dissector with the arguments supplied, and return the
 397    number of bytes consumed, otherwise return 0. */
 398 WS_DLL_PUBLIC int dissector_try_payload(dissector_table_t sub_dissectors,
 399     tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 400
 401 /* Use the currently assigned payload dissector for the dissector table and,
 402    if any, call the dissector with the arguments supplied, and return the
 403    number of bytes consumed, otherwise return 0. */
 404 WS_DLL_PUBLIC int dissector_try_payload_new(dissector_table_t sub_dissectors,
 405     tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data);
 406
 407 /* Change the entry for a dissector in a payload (FT_NONE) dissector table
 408    with a particular pattern to use a new dissector handle. */
 409 WS_DLL_PUBLIC void dissector_change_payload(const char *abbrev, dissector_handle_t handle);
 410
 411 /* Reset payload (FT_NONE) dissector table to its initial value. */
 412 WS_DLL_PUBLIC void dissector_reset_payload(const char *name);
 413
 414 /* Given a payload dissector table (type FT_NONE), return the handle of
 415    the dissector that is currently active, i.e. that was selected via
 416    Decode As. */
 417 WS_DLL_PUBLIC dissector_handle_t dissector_get_payload_handle(
 418         dissector_table_t const dissector_table);
 419
 420 /* Add a handle to the list of handles that *could* be used with this
 421    table.  That list is used by the "Decode As"/"-d" code in the UI. */
 422 WS_DLL_PUBLIC void dissector_add_for_decode_as(const char *name,
 423     dissector_handle_t handle);
 424
 425 /* Same as dissector_add_for_decode_as, but adds preference for dissector table value */
 426 WS_DLL_PUBLIC void dissector_add_for_decode_as_with_preference(const char *name,
 427     dissector_handle_t handle);
 428
 429 /** Get the list of handles for a dissector table
 430  */
 431 WS_DLL_PUBLIC GSList *dissector_table_get_dissector_handles(dissector_table_t dissector_table);
 432
 433 /** Get a handle to dissector out of a dissector table given the description
 434  * of what the dissector dissects.
 435  */
 436 WS_DLL_PUBLIC dissector_handle_t dissector_table_get_dissector_handle(dissector_table_t dissector_table, const char* description);
 437
 438 /** Get a dissector table's type
 439  */
 440 WS_DLL_PUBLIC ftenum_t dissector_table_get_type(dissector_table_t dissector_table);
 441
 442 /** Mark a dissector table as allowing "Decode As"
 443  */
 444 WS_DLL_PUBLIC void dissector_table_allow_decode_as(dissector_table_t dissector_table);
 445
 446 /** Returns true if dissector table allows "Decode As"
 447  */
 448 WS_DLL_PUBLIC bool dissector_table_supports_decode_as(dissector_table_t dissector_table);
 449
 450 /* List of "heuristic" dissectors (which get handed a packet, look at it,
 451    and either recognize it as being for their protocol, dissect it, and
 452    return true, or don't recognize it and return false) to be called
 453    by another dissector.
 454
 455    This is opaque outside of "packet.c". */
 456 struct heur_dissector_list;
 457 typedef struct heur_dissector_list *heur_dissector_list_t;
 458
 459
 460 typedef struct heur_dtbl_entry {
 461         heur_dissector_t dissector;
 462         protocol_t *protocol; /* this entry's protocol */
 463         char *list_name;     /* the list name this entry is in the list of */
 464         const char *display_name;     /* the string used to present heuristic to user */
 465         char *short_name;     /* string used for "internal" use to uniquely identify heuristic */
 466         bool enabled;
 467         bool enabled_by_default;
 468 } heur_dtbl_entry_t;
 469
 470 /** A protocol uses this function to register a heuristic sub-dissector list.
 471  *  Call this in the parent dissectors proto_register function.
 472  *
 473  * @param name a unique short name for the list
 474  * @param ui_name the name used in the user interface
 475  * @param proto the value obtained when registering the protocol
 476  */
 477 WS_DLL_PUBLIC heur_dissector_list_t register_heur_dissector_list_with_description(const char *name, const char *ui_name, const int proto);
 478
 479 /** Get description of heuristic sub-dissector list.
 480  *
 481  * @param list the dissector list
 482  */
 483 WS_DLL_PUBLIC const char *heur_dissector_list_get_description(heur_dissector_list_t list);
 484
 485 /** A protocol uses this function to register a heuristic sub-dissector list.
 486  *  Call this in the parent dissectors proto_register function.
 487  *
 488  * @param name the name of this protocol
 489  * @param proto the value obtained when registering the protocol
 490  */
 491 WS_DLL_PUBLIC heur_dissector_list_t register_heur_dissector_list(const char *name, const int proto);
 492
 493 /** Deregister a heuristic dissector list by unique short name. */
 494 void deregister_heur_dissector_list(const char *name);
 495
 496 typedef void (*DATFunc_heur) (const char *table_name,
 497     struct heur_dtbl_entry *entry, void *user_data);
 498 typedef void (*DATFunc_heur_table) (const char *table_name,
 499     struct heur_dissector_list *table, void *user_data);
 500
 501 /** Iterate over heuristic dissectors in a table.
 502  *
 503  * Walk one heuristic dissector table's list calling a user supplied function
 504  * on each entry.
 505  *
 506  * @param[in] table_name The name of the dissector table, e.g. "tcp".
 507  * @param[in] func The function to call for each dissector.
 508  * @param[in] user_data User data to pass to the function.
 509  */
 510 WS_DLL_PUBLIC void heur_dissector_table_foreach(const char *table_name,
 511     DATFunc_heur func, void *user_data);
 512
 513 /** Iterate over all heuristic dissector tables.
 514  *
 515  * Walk the set of heuristic dissector tables calling a user supplied function
 516  * on each table.
 517  * @param[in] func The function to call for each table.
 518  * @param[in] user_data User data to pass to the function.
 519  * @param[in] compare_key_func Function used to sort the set of tables before
 520  * calling the function.  No sorting is done if NULL. */
 521 WS_DLL_PUBLIC void dissector_all_heur_tables_foreach_table (DATFunc_heur_table func,
 522     void *user_data, GCompareFunc compare_key_func);
 523
 524 /* true if a heur_dissector list of that name exists to be registered into */
 525 WS_DLL_PUBLIC bool has_heur_dissector_list(const char *name);
 526
 527 /** Try all the dissectors in a given heuristic dissector list. This is done,
 528  *  until we find one that recognizes the protocol.
 529  *  Call this while the parent dissector running.
 530  *
 531  * @param sub_dissectors the sub-dissector list
 532  * @param tvb the tvbuff with the (remaining) packet data
 533  * @param pinfo the packet info of this packet (additional info)
 534  * @param tree the protocol tree to be build or NULL
 535  * @param hdtbl_entry returns the last tried dissectors hdtbl_entry.
 536  * @param data parameter to pass to subdissector
 537  * @return true if the packet was recognized by the sub-dissector (stop dissection here)
 538  */
 539 WS_DLL_PUBLIC bool dissector_try_heuristic(heur_dissector_list_t sub_dissectors,
 540     tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, heur_dtbl_entry_t **hdtbl_entry, void *data);
 541
 542 /** Find a heuristic dissector table by table name.
 543  *
 544  * @param name name of the dissector table
 545  * @return pointer to the table on success, NULL if no such table exists
 546  */
 547 WS_DLL_PUBLIC heur_dissector_list_t find_heur_dissector_list(const char *name);
 548
 549 /** Find a heuristic dissector by the unique short protocol name provided during registration.
 550  *
 551  * @param short_name short name of the protocol to look at
 552  * @return pointer to the heuristic dissector entry, NULL if not such dissector exists
 553  */
 554 WS_DLL_PUBLIC heur_dtbl_entry_t* find_heur_dissector_by_unique_short_name(const char *short_name);
 555
 556 /** Add a sub-dissector to a heuristic dissector list.
 557  *  Call this in the proto_handoff function of the sub-dissector.
 558  *
 559  * @param name the name of the heuristic dissector table into which to register the dissector, e.g. "tcp"
 560  * @param dissector the sub-dissector to be registered
 561  * @param display_name the string used to present heuristic to user, e.g. "HTTP over TCP"
 562  * @param internal_name the string used for "internal" use to identify heuristic, e.g. "http_tcp"
 563  * @param proto the protocol id of the sub-dissector
 564  * @param enable initially enabled or not
 565  */
 566 WS_DLL_PUBLIC void heur_dissector_add(const char *name, heur_dissector_t dissector,
 567     const char *display_name, const char *internal_name, const int proto, heuristic_enable_e enable);
 568
 569 /** Remove a sub-dissector from a heuristic dissector list.
 570  *  Call this in the prefs_reinit function of the sub-dissector.
 571  *
 572  * @param name the name of the "parent" protocol, e.g. "tcp"
 573  * @param dissector the sub-dissector to be unregistered
 574  * @param proto the protocol id of the sub-dissector
 575  */
 576 WS_DLL_PUBLIC void heur_dissector_delete(const char *name, heur_dissector_t dissector, const int proto);
 577
 578 /** Register a new dissector. */
 579 WS_DLL_PUBLIC dissector_handle_t register_dissector(const char *name, dissector_t dissector, const int proto);
 580
 581 /** Register a new dissector with a description. */
 582 WS_DLL_PUBLIC dissector_handle_t register_dissector_with_description(const char *name, const char *description, dissector_t dissector, const int proto);
 583
 584 /** Register a new dissector with a callback pointer. */
 585 WS_DLL_PUBLIC dissector_handle_t register_dissector_with_data(const char *name, dissector_cb_t dissector, const int proto, void *cb_data);
 586
 587 /** Deregister a dissector. */
 588 void deregister_dissector(const char *name);
 589
 590 /** Get the long name of the protocol for a dissector handle. */
 591 WS_DLL_PUBLIC const char *dissector_handle_get_protocol_long_name(const dissector_handle_t handle);
 592
 593 /** Get the short name of the protocol for a dissector handle. */
 594 WS_DLL_PUBLIC const char *dissector_handle_get_protocol_short_name(const dissector_handle_t handle);
 595
 596 /* For backwards source and binary compatibility */
 597 G_DEPRECATED_FOR(dissector_handle_get_protocol_short_name)
 598 WS_DLL_PUBLIC const char *dissector_handle_get_short_name(const dissector_handle_t handle);
 599
 600 /** Get the description for what the dissector for a dissector handle dissects. */
 601 WS_DLL_PUBLIC const char *dissector_handle_get_description(const dissector_handle_t handle);
 602
 603 /** Get the index of the protocol for a dissector handle. */
 604 WS_DLL_PUBLIC int dissector_handle_get_protocol_index(const dissector_handle_t handle);
 605
 606 /** Get a GList of all registered dissector names. */
 607 WS_DLL_PUBLIC GList* get_dissector_names(void);
 608
 609 /** Find a dissector by name. */
 610 WS_DLL_PUBLIC dissector_handle_t find_dissector(const char *name);
 611
 612 /** Find a dissector by name and add parent protocol as a dependency. */
 613 WS_DLL_PUBLIC dissector_handle_t find_dissector_add_dependency(const char *name, const int parent_proto);
 614
 615 /** Get a dissector name from handle. */
 616 WS_DLL_PUBLIC const char *dissector_handle_get_dissector_name(const dissector_handle_t handle);
 617
 618 WS_DLL_PUBLIC const char *dissector_handle_get_pref_suffix(const dissector_handle_t handle);
 619
 620 /** Create an anonymous, unregistered dissector handle. Unregistered means that
 621  * other dissectors can't find the dissector through this API. The typical use
 622  * case is dissectors added to dissector tables that shouldn't be called by other
 623  * dissectors, perhaps if some data structure must be passed to the dissector.
 624  *
 625  * @param dissector The dissector the handle will call
 626  * @param proto The value obtained when registering the protocol
 627  *
 628  * @note The protocol short name will be used as the user-visible description.
 629  */
 630 WS_DLL_PUBLIC dissector_handle_t create_dissector_handle(dissector_t dissector,
 631     const int proto);
 632
 633 /** Create an named, unregistered dissector handle.
 634  * A non-NULL name is needed for dissector_add_for_decode_add_with_preference().
 635  *
 636  * @param dissector The dissector the handle will call
 637  * @param proto The value obtained when registering the protocol
 638  * @param name a short, machine-friendly name for the dissector. Does not have
 639  * to be globally unique, but should be unique for any table the handle will be
 640  * registered to. Can be NULL, which creates an anonymous dissector.
 641  *
 642  * @note The protocol short name will be used as the user-visible description.
 643  */
 644 WS_DLL_PUBLIC dissector_handle_t create_dissector_handle_with_name(dissector_t dissector,
 645     const int proto, const char* name);
 646
 647 /** Create an named, unregistered handle dissector handle with a description.
 648  * A non-NULL name is needed for dissector_add_for_decode_add_with_preference().
 649  * The description is used to allow a user to distinguish dissectors for the
 650  * same protocol, e.g. when registered to the same table.
 651  *
 652  * @param dissector The dissector the handle will call
 653  * @param proto The value obtained when registering the protocol
 654  * @param name a short, machine-friendly name for the dissector. Does not have
 655  * to be globally unique, but should be unique for any table the handle will be
 656  * registered to. Can be NULL, which creates an anonymous dissector.
 657  * @param description Freeform text designed to be shown to a user. Must be
 658  * unique for any table the dissector is registered in. Can be NULL, in which
 659  * case the protocol short name is used as the user-visible description.
 660  */
 661 WS_DLL_PUBLIC dissector_handle_t create_dissector_handle_with_name_and_description(dissector_t dissector,
 662     const int proto, const char* name, const char* description);
 663 WS_DLL_PUBLIC dissector_handle_t create_dissector_handle_with_data(dissector_cb_t dissector,
 664     const int proto, void* cb_data);
 665
 666 /* Dump all registered dissectors to the standard output */
 667 WS_DLL_PUBLIC void dissector_dump_dissectors(void);
 668
 669 /** Call a dissector through a handle and if no dissector was found
 670  * pass it over to the "data" dissector instead.
 671  *
 672  *   @param handle The dissector to call.
 673  *   @param  tvb The buffer to dissect.
 674  *   @param  pinfo Packet Info.
 675  *   @param  tree The protocol tree.
 676  *   @param  data parameter to pass to dissector
 677  *   @return  If the protocol for that handle isn't enabled call the data
 678  *   dissector. Otherwise, if the handle refers to a new-style
 679  *   dissector, call the dissector and return its return value, otherwise call
 680  *   it and return the length of the tvbuff pointed to by the argument.
 681  */
 682 WS_DLL_PUBLIC int call_dissector_with_data(dissector_handle_t handle, tvbuff_t *tvb,
 683     packet_info *pinfo, proto_tree *tree, void *data);
 684 WS_DLL_PUBLIC int call_dissector(dissector_handle_t handle, tvbuff_t *tvb,
 685     packet_info *pinfo, proto_tree *tree);
 686
 687 WS_DLL_PUBLIC int call_data_dissector(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 688
 689 /** Call a dissector through a handle but if no dissector was found
 690  * just return 0 and do not call the "data" dissector instead.
 691  *
 692  *   @param handle The dissector to call.
 693  *   @param  tvb The buffer to dissect.
 694  *   @param  pinfo Packet Info.
 695  *   @param  tree The protocol tree.
 696  *   @param  data parameter to pass to dissector
 697  *   @return  If the protocol for that handle isn't enabled, return 0 without
 698  *   calling the dissector. Otherwise, if the handle refers to a new-style
 699  *   dissector, call the dissector and return its return value, otherwise call
 700  *   it and return the length of the tvbuff pointed to by the argument.
 701  */
 702 WS_DLL_PUBLIC int call_dissector_only(dissector_handle_t handle, tvbuff_t *tvb,
 703     packet_info *pinfo, proto_tree *tree, void *data);
 704
 705 /**
 706  *   @param heur_dtbl_entry The heur_dtbl_entry of the dissector to call.
 707  *   @param  tvb The buffer to dissect.
 708  *   @param  pinfo Packet Info.
 709  *   @param  tree The protocol tree.
 710  *   @param  data parameter to pass to dissector
 711  */
 712
 713 WS_DLL_PUBLIC void call_heur_dissector_direct(heur_dtbl_entry_t *heur_dtbl_entry, tvbuff_t *tvb,
 714     packet_info *pinfo, proto_tree *tree, void *data);
 715
 716 /* This is opaque outside of "packet.c". */
 717 struct depend_dissector_list;
 718 typedef struct depend_dissector_list *depend_dissector_list_t;
 719
 720 /** Register a protocol dependency
 721  * This is done automatically when registering with a dissector or
 722  * heuristic table.  This is for "manual" registration when a dissector
 723  * ends up calling another through call_dissector (or similar) so
 724  * dependencies can be determined
 725  *
 726  *   @param parent "Parent" protocol short name
 727  *   @param dependent "Dependent" protocol short name
 728  *   @return  return true if dependency was successfully registered
 729  */
 730 WS_DLL_PUBLIC bool register_depend_dissector(const char* parent, const char* dependent);
 731
 732 /** Unregister a protocol dependency
 733  * This is done automatically when removing from a dissector or
 734  * heuristic table.  This is for "manual" deregistration for things
 735  * like Lua.
 736  *
 737  *   @param parent "Parent" protocol short name
 738  *   @param dependent "Dependent" protocol short name
 739  *   @return  return true if dependency was successfully unregistered
 740  */
 741 WS_DLL_PUBLIC bool deregister_depend_dissector(const char* parent, const char* dependent);
 742
 743 /** Find the list of protocol dependencies
 744  *
 745  *   @param name Protocol short name to search for
 746  *   @return  return list of dependent was successfully registered
 747  */
 748 WS_DLL_PUBLIC depend_dissector_list_t find_depend_dissector_list(const char* name);
 749
 750
 751 /* Do all one-time initialization. */
 752 extern void dissect_init(void);
 753
 754 extern void dissect_cleanup(void);
 755
 756 /*
 757  * Given a tvbuff, and a length from a packet header, adjust the length
 758  * of the tvbuff to reflect the specified length.
 759  */
 760 WS_DLL_PUBLIC void set_actual_length(tvbuff_t *tvb, const unsigned specified_len);
 761
 762 /**
 763  * Allow protocols to register "init" routines, which are called before
 764  * we make a pass through a capture file and dissect all its packets
 765  * (e.g., when we read in a new capture file, or run a "filter packets"
 766  * or "colorize packets" pass over the current capture file or when the
 767  * preferences are changed).
 768  */
 769 WS_DLL_PUBLIC void register_init_routine(void (*func)(void));
 770
 771 /**
 772  * Allows protocols to register "cleanup" routines, which are called
 773  * after closing a capture file (or when preferences are changed, in
 774  * that case these routines are called before the init routines are
 775  * executed). It can be used to release resources that are allocated in
 776  * an "init" routine.
 777  */
 778 WS_DLL_PUBLIC void register_cleanup_routine(void (*func)(void));
 779
 780 /*
 781  * Allows protocols to register "shutdown" routines, which are called
 782  * once, just before program exit
 783  */
 784 WS_DLL_PUBLIC void register_shutdown_routine(void (*func)(void));
 785
 786 /* Initialize all data structures used for dissection. */
 787 void init_dissection(void);
 788
 789 /* Free data structures allocated for dissection. */
 790 void cleanup_dissection(void);
 791
 792 /* Allow protocols to register a "cleanup" routine to be
 793  * run after the initial sequential run through the packets.
 794  * Note that the file can still be open after this; this is not
 795  * the final cleanup. */
 796 WS_DLL_PUBLIC void register_postseq_cleanup_routine(void (*func)(void));
 797
 798 /* Call all the registered "postseq_cleanup" routines. */
 799 WS_DLL_PUBLIC void postseq_cleanup_all_protocols(void);
 800
 801 /* Allow dissectors to register a "final_registration" routine
 802  * that is run like the proto_register_XXX() routine, but the end
 803  * end of the epan_init() function; that is, *after* all other
 804  * subsystems, liked dfilters, have finished initializing. This is
 805  * useful for dissector registration routines which need to compile
 806  * display filters. dfilters can't initialize itself until all protocols
 807  * have registered themselves. */
 808 WS_DLL_PUBLIC void
 809 register_final_registration_routine(void (*func)(void));
 810
 811 /* Call all the registered "final_registration" routines. */
 812 extern void
 813 final_registration_all_protocols(void);
 814
 815 /*
 816  * Add a new data source to the list of data sources for a frame, given
 817  * the tvbuff for the data source and its name.
 818  */
 819 WS_DLL_PUBLIC void add_new_data_source(packet_info *pinfo, tvbuff_t *tvb,
 820     const char *name);
 821 /* Removes the last-added data source, if it turns out it wasn't needed */
 822 WS_DLL_PUBLIC void remove_last_data_source(packet_info *pinfo);
 823
 824 /*
 825  * Return the data source name, tvb.
 826  */
 827 struct data_source;
 828 WS_DLL_PUBLIC char *get_data_source_name(const struct data_source *src);
 829 WS_DLL_PUBLIC tvbuff_t *get_data_source_tvb(const struct data_source *src);
 830 WS_DLL_PUBLIC tvbuff_t *get_data_source_tvb_by_name(packet_info *pinfo, const char *name);
 831
 832 /*
 833  * Free up a frame's list of data sources.
 834  */
 835 extern void free_data_sources(packet_info *pinfo);
 836
 837 /* Mark another frame as depended upon by the current frame.
 838  *
 839  * This information is used to ensure that the depended-upon frame is saved
 840  * if the user does a File->Save-As of only the Displayed packets and the
 841  * current frame passed the display filter.
 842  */
 843 WS_DLL_PUBLIC void mark_frame_as_depended_upon(frame_data *fd, uint32_t frame_num);
 844
 845 /* Structure passed to the frame dissector */
 846 typedef struct frame_data_s
 847 {
 848     int file_type_subtype;
 849     wtap_block_t pkt_block;         /**< NULL if not available */
 850     struct epan_dissect *color_edt; /** Used strictly for "coloring rules" */
 851
 852 } frame_data_t;
 853
 854 /* Structure passed to the file dissector */
 855 typedef struct file_data_s
 856 {
 857     wtap_block_t pkt_block;         /**< NULL if not available */
 858     struct epan_dissect *color_edt; /** Used strictly for "coloring rules" */
 859
 860 } file_data_t;
 861
 862 /*
 863  * Dissectors should never modify the record data.
 864  */
 865 extern void dissect_record(struct epan_dissect *edt, int file_type_subtype,
 866     wtap_rec *rec, tvbuff_t *tvb, frame_data *fd, column_info *cinfo);
 867
 868 /*
 869  * Dissectors should never modify the packet data.
 870  */
 871 extern void dissect_file(struct epan_dissect *edt,
 872     wtap_rec *rec, tvbuff_t *tvb, frame_data *fd, column_info *cinfo);
 873
 874 /* Structure passed to the ethertype dissector */
 875 typedef struct ethertype_data_s
 876 {
 877     uint16_t etype;
 878     int payload_offset;
 879     proto_tree *fh_tree;
 880     int trailer_id;
 881     int fcs_len;
 882 } ethertype_data_t;
 883
 884 /*
 885  * Dump layer/selector/dissector records in a fashion similar to the
 886  * proto_registrar_dump_* routines.
 887  */
 888 WS_DLL_PUBLIC void dissector_dump_decodes(void);
 889
 890 /*
 891  * For each heuristic dissector table, dump list of dissectors (filter_names) for that table
 892  */
 893 WS_DLL_PUBLIC void dissector_dump_heur_decodes(void);
 894
 895 /*
 896  * postdissectors are to be called by packet-frame.c after every other
 897  * dissector has been called.
 898  */
 899
 900 /*
 901  * Register a postdissector; the argument is the dissector handle for it.
 902  */
 903 WS_DLL_PUBLIC void register_postdissector(dissector_handle_t handle);
 904
 905 /*
 906  * Specify a set of hfids that the postdissector will need.
 907  * The GArray is an array of hfids (type int) and should be NULL to clear the
 908  * list. This function will take ownership of the memory.
 909  */
 910 WS_DLL_PUBLIC void set_postdissector_wanted_hfids(dissector_handle_t handle,
 911     GArray *wanted_hfids);
 912
 913 /*
 914  * Deregister a postdissector.  Not for use in (post)dissectors or
 915  * applications; only to be used by libwireshark itself.
 916  */
 917 void deregister_postdissector(dissector_handle_t handle);
 918
 919 /*
 920  * Return true if we have at least one postdissector, false if not.
 921  * Not for use in (post)dissectors or applications; only to be used
 922  * by libwireshark itself.
 923  */
 924 extern bool have_postdissector(void);
 925
 926 /*
 927  * Call all postdissectors, handing them the supplied arguments.
 928  * Not for use in (post)dissectors or applications; only to be used
 929  * by libwireshark itself.
 930  */
 931 extern void call_all_postdissectors(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 932
 933 /*
 934  * Return true if at least one postdissector needs at least one hfid,
 935  * false otherwise.
 936  */
 937 WS_DLL_PUBLIC bool postdissectors_want_hfids(void);
 938
 939 /*
 940  * Prime an epan_dissect_t with all the hfids wanted by postdissectors.
 941  */
 942 WS_DLL_PUBLIC void
 943 prime_epan_dissect_with_postdissector_wanted_hfids(epan_dissect_t *edt);
 944
 945 /** Increment the dissection depth.
 946  * This should be used to limit recursion outside the tree depth checks in
 947  * call_dissector and dissector_try_heuristic.
 948  * @param pinfo Packet Info.
 949  */
 950
 951 WS_DLL_PUBLIC void increment_dissection_depth(packet_info *pinfo);
 952
 953 /** Decrement the dissection depth.
 954  * @param pinfo Packet Info.
 955  */
 956
 957 WS_DLL_PUBLIC void decrement_dissection_depth(packet_info *pinfo);
 958
 959 /** @} */
 960
 961 #ifdef __cplusplus
 962 }
 963 #endif /* __cplusplus */
 964
 965 #endif /* packet.h */