2 * Routines for building lists of packets that are part of a "conversation"
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998 Gerald Combs
8 * SPDX-License-Identifier: GPL-2.0-or-later
17 #include <wiretap/wtap.h>
18 #include <wsutil/array.h>
22 #include "conversation.h"
24 // The conversation database is a map of maps that contain conversation_t's.
25 // Top-level map keys are strings that describe each conversation type.
26 // Second-level map keys are conversation_element_t arrays.
29 // [ { type: CE_ADDR, addr_val: 10.20.30.40}, { type: CE_PORT, uint_val: 80 } ... ]: <conversation_t>
30 // [ { type: CE_ADDR, addr_val: 1.1.1.1}, { type: CE_PORT, uint_val: 53 } ... ]: <conversation_t>
33 // Instead of using strings as keys we could bit-shift conversation endpoint types
34 // into a uint64_t, e.g. 0x0000000102010200 for CE_ADDRESS,CE_PORT,CE_ADDRESS,CE_PORT,CE_CONVERSATION_TYPE.
35 // We could also use this to prepend a type+length indicator for element arrays.
37 /* define DEBUG_CONVERSATION for pretty debug printing */
38 /* #define DEBUG_CONVERSATION */
39 #include "conversation_debug.h"
41 #ifdef DEBUG_CONVERSATION
42 int _debug_conversation_indent
;
46 * We could use an element list here, but this is effectively a parameter list
47 * for find_conversation and is more compact.
49 struct conversation_addr_port_endpoints
{
54 conversation_type ctype
;
57 /* Element offsets for address+port conversations */
65 ADDRS_IDX_COUNT
= PORT2_IDX
,
66 PORT2_NO_ADDR2_IDX
= ADDR2_IDX
,
67 ENDP_NO_ADDR2_IDX
= PORT2_IDX
,
68 ENDP_NO_PORT2_IDX
= PORT2_IDX
,
69 ENDP_NO_ADDR2_PORT2_IDX
= ADDR2_IDX
,
70 NO_ADDR2_IDX_COUNT
= ENDP_EXACT_IDX
,
71 NO_PORT2_IDX_COUNT
= ENDP_EXACT_IDX
,
72 NO_ADDR2_PORT2_IDX_COUNT
= PORT2_IDX
,
73 ENDP_NO_PORTS_IDX
= ADDR2_IDX
76 /* Element offsets for the deinterlacer conversations */
86 /* Element offsets for the deinterlaced conversations */
92 DEINTD_ENDP_EXACT_IDX
,
93 DEINTD_EXACT_IDX_COUNT
,
94 DEINTD_ADDRS_IDX_COUNT
= DEINTD_PORT2_IDX
,
95 DEINTD_ENDP_NO_PORTS_IDX
= DEINTD_PORT1_IDX
98 /* Names for conversation_element_type values. */
99 static const char *type_names
[] = {
112 * Hash table of hash tables for conversations identified by element lists.
114 static wmem_map_t
*conversation_hashtable_element_list
;
117 * Hash table for conversations based on addresses only
119 static wmem_map_t
*conversation_hashtable_exact_addr
;
122 * Hash table for conversations with no wildcards.
124 static wmem_map_t
*conversation_hashtable_exact_addr_port
;
127 * Hash table for conversations with one wildcard address.
129 static wmem_map_t
*conversation_hashtable_no_addr2
;
132 * Hash table for conversations with one wildcard port.
134 static wmem_map_t
*conversation_hashtable_no_port2
;
137 * Hash table for conversations with one wildcard address and port.
139 static wmem_map_t
*conversation_hashtable_no_addr2_or_port2
;
142 * Hash table for conversations with a single unsigned ID number.
144 static wmem_map_t
*conversation_hashtable_id
;
147 * Hash table for conversations with no wildcards, and an anchor
149 static wmem_map_t
*conversation_hashtable_exact_addr_port_anc
= NULL
;
152 * Hash table for conversations based on addresses only, and an anchor
154 static wmem_map_t
*conversation_hashtable_exact_addr_anc
= NULL
;
157 * Hash table for deinterlacing conversations (typically L1 or L2)
159 static wmem_map_t
*conversation_hashtable_deinterlacer
= NULL
;
161 static uint32_t new_index
;
164 * Placeholder for address-less conversations.
166 static address null_address_
= ADDRESS_INIT_NONE
;
169 /* Element count including the terminating CE_CONVERSATION_TYPE */
170 #define MAX_CONVERSATION_ELEMENTS 8 // Arbitrary.
172 conversation_element_count(conversation_element_t
*elements
)
175 while (elements
[count
].type
!= CE_CONVERSATION_TYPE
) {
177 DISSECTOR_ASSERT(count
< MAX_CONVERSATION_ELEMENTS
);
180 // Keying on the endpoint type alone isn't very useful.
181 DISSECTOR_ASSERT(count
> 1);
185 static conversation_type
186 conversation_get_key_type(conversation_element_t
*elements
)
189 while (elements
[count
].type
!= CE_CONVERSATION_TYPE
) {
191 DISSECTOR_ASSERT(count
< MAX_CONVERSATION_ELEMENTS
);
193 return elements
[count
].conversation_type_val
;
196 /* Create a string based on element types. */
198 conversation_element_list_name(wmem_allocator_t
*allocator
, conversation_element_t
*elements
) {
200 wmem_strbuf_t
*conv_hash_group
= wmem_strbuf_new(allocator
, "");
201 size_t element_count
= conversation_element_count(elements
);
202 for (size_t i
= 0; i
< element_count
; i
++) {
203 conversation_element_t
*cur_el
= &elements
[i
];
204 DISSECTOR_ASSERT(cur_el
->type
< array_length(type_names
));
205 wmem_strbuf_append_printf(conv_hash_group
, "%s%s", sep
, type_names
[cur_el
->type
]);
208 return wmem_strbuf_finalize(conv_hash_group
);
212 static char* conversation_element_list_values(conversation_element_t
*elements
) {
214 GString
*value_str
= g_string_new("");
215 size_t element_count
= conversation_element_count(elements
);
216 for (size_t i
= 0; i
< element_count
; i
++) {
217 conversation_element_t
*cur_el
= &elements
[i
];
218 g_string_append_printf(value_str
, "%s%s=", sep
, type_names
[cur_el
->type
]);
220 switch (cur_el
->type
) {
221 case CE_CONVERSATION_TYPE
:
222 g_string_append_printf(value_str
, "%d", cur_el
->conversation_type_val
);
226 char *as
= address_to_str(NULL
, &cur_el
->addr_val
);
227 g_string_append(value_str
, as
);
232 g_string_append_printf(value_str
, "%u", cur_el
->port_val
);
235 g_string_append(value_str
, cur_el
->str_val
);
238 g_string_append_printf(value_str
, "%u", cur_el
->uint_val
);
241 g_string_append_printf(value_str
, "%" PRIu64
, cur_el
->uint64_val
);
244 g_string_append_printf(value_str
, "%d", cur_el
->int_val
);
247 g_string_append_printf(value_str
, "%" PRId64
, cur_el
->int64_val
);
253 for (l
= cur_el
->blob
.len
, p
= cur_el
->blob
.val
; l
> 0; l
--, p
++)
254 g_string_append_printf(value_str
, "%02x", *p
);
259 return g_string_free(value_str
, FALSE
);
264 is_no_addr2_key(conversation_element_t
*key
)
266 if (key
[ADDR1_IDX
].type
== CE_ADDRESS
&& key
[PORT1_IDX
].type
== CE_PORT
267 && key
[PORT2_NO_ADDR2_IDX
].type
== CE_PORT
&& key
[ENDP_NO_ADDR2_IDX
].type
== CE_CONVERSATION_TYPE
) {
274 is_no_port2_key(conversation_element_t
*key
)
276 if (key
[ADDR1_IDX
].type
== CE_ADDRESS
&& key
[PORT1_IDX
].type
== CE_PORT
277 && key
[ADDR2_IDX
].type
== CE_ADDRESS
&& key
[ENDP_NO_PORT2_IDX
].type
== CE_CONVERSATION_TYPE
) {
284 is_no_addr2_port2_key(conversation_element_t
*key
)
286 if (key
[ADDR1_IDX
].type
== CE_ADDRESS
&& key
[PORT1_IDX
].type
== CE_PORT
287 && key
[ENDP_NO_ADDR2_PORT2_IDX
].type
== CE_CONVERSATION_TYPE
) {
294 * Creates a new conversation with known endpoints based on a conversation
295 * created with the CONVERSATION_TEMPLATE option while keeping the
296 * conversation created with the CONVERSATION_TEMPLATE option so it can still
297 * match future connections.
299 * Passing a pointer to a conversation whose options mask does not include
300 * CONVERSATION_TEMPLATE or where the conversation's protocol type (ptype)
301 * indicates a non-connnection oriented protocol will return the conversation
304 * addr2 and port2 are used in the function if their respective conversation
305 * options bits are set (NO_ADDR2 and NO_PORT2).
307 static conversation_t
*
308 conversation_create_from_template(conversation_t
*conversation
, const address
*addr2
, const uint32_t port2
)
310 conversation_type ctype
= conversation_get_key_type(conversation
->key_ptr
);
312 * Add a new conversation and keep the conversation template only if the
313 * CONVERSATION_TEMPLATE bit is set for a connection oriented protocol.
315 if (conversation
->options
& CONVERSATION_TEMPLATE
&& ctype
!= CONVERSATION_UDP
)
318 * Set up a new options mask where the conversation template bit and the
319 * bits for absence of a second address and port pair have been removed.
321 conversation_t
*new_conversation_from_template
;
322 unsigned options
= conversation
->options
& ~(CONVERSATION_TEMPLATE
| NO_ADDR2
| NO_PORT2
);
325 * Are both the NO_ADDR2 and NO_PORT2 wildcards set in the options mask?
327 if (conversation
->options
& NO_ADDR2
&& conversation
->options
& NO_PORT2
328 && is_no_addr2_port2_key(conversation
->key_ptr
))
331 * The conversation template was created without knowledge of both
332 * the second address as well as the second port. Create a new
333 * conversation with new 2nd address and 2nd port.
335 new_conversation_from_template
=
336 conversation_new(conversation
->setup_frame
,
337 &conversation
->key_ptr
[ADDR1_IDX
].addr_val
, addr2
,
338 ctype
, conversation
->key_ptr
[PORT1_IDX
].port_val
,
341 else if (conversation
->options
& NO_PORT2
&& is_no_port2_key(conversation
->key_ptr
))
344 * The conversation template was created without knowledge of port 2
345 * only. Create a new conversation with new 2nd port.
347 new_conversation_from_template
=
348 conversation_new(conversation
->setup_frame
,
349 &conversation
->key_ptr
[ADDR1_IDX
].addr_val
, &conversation
->key_ptr
[ADDR2_IDX
].addr_val
,
350 ctype
, conversation
->key_ptr
[PORT1_IDX
].port_val
,
353 else if (conversation
->options
& NO_ADDR2
&& is_no_addr2_key(conversation
->key_ptr
))
356 * The conversation template was created without knowledge of address
357 * 2. Create a new conversation with new 2nd address.
359 new_conversation_from_template
=
360 conversation_new(conversation
->setup_frame
,
361 &conversation
->key_ptr
[ADDR1_IDX
].addr_val
, addr2
,
362 ctype
, conversation
->key_ptr
[PORT1_IDX
].port_val
,
363 conversation
->key_ptr
[PORT2_NO_ADDR2_IDX
].port_val
, options
);
368 * The CONVERSATION_TEMPLATE bit was set, but no other bit that the
369 * CONVERSATION_TEMPLATE bit controls is active. Just return the old
376 * Set the protocol dissector used for the template conversation as
377 * the handler of the new conversation as well.
379 new_conversation_from_template
->dissector_tree
= conversation
->dissector_tree
;
381 return new_conversation_from_template
;
390 * Compute the hash value for two given element lists if the match
393 /* https://web.archive.org/web/20070615045827/http://eternallyconfuzzled.com/tuts/algorithms/jsw_tut_hashing.aspx#existing
394 * (formerly at http://eternallyconfuzzled.com/tuts/algorithms/jsw_tut_hashing.aspx#existing)
398 conversation_hash_element_list(const void *v
)
400 const conversation_element_t
*element
= (const conversation_element_t
*)v
;
401 unsigned hash_val
= 0;
404 // XXX We could use a hash_arbitrary_bytes routine. Abuse add_address_to_hash in the mean time.
406 switch (element
->type
) {
408 hash_val
= add_address_to_hash(hash_val
, &element
->addr_val
);
411 tmp_addr
.len
= (int) sizeof(element
->port_val
);
412 tmp_addr
.data
= &element
->port_val
;
413 hash_val
= add_address_to_hash(hash_val
, &tmp_addr
);
416 tmp_addr
.len
= (int) strlen(element
->str_val
);
417 tmp_addr
.data
= element
->str_val
;
418 hash_val
= add_address_to_hash(hash_val
, &tmp_addr
);
421 tmp_addr
.len
= (int) sizeof(element
->uint_val
);
422 tmp_addr
.data
= &element
->uint_val
;
423 hash_val
= add_address_to_hash(hash_val
, &tmp_addr
);
426 tmp_addr
.len
= (int) sizeof(element
->uint64_val
);
427 tmp_addr
.data
= &element
->uint64_val
;
428 hash_val
= add_address_to_hash(hash_val
, &tmp_addr
);
431 tmp_addr
.len
= (int) sizeof(element
->int_val
);
432 tmp_addr
.data
= &element
->int_val
;
433 hash_val
= add_address_to_hash(hash_val
, &tmp_addr
);
436 tmp_addr
.len
= (int) sizeof(element
->int64_val
);
437 tmp_addr
.data
= &element
->int64_val
;
438 hash_val
= add_address_to_hash(hash_val
, &tmp_addr
);
441 tmp_addr
.len
= (int) element
->blob
.len
;
442 tmp_addr
.data
= element
->blob
.val
;
443 hash_val
= add_address_to_hash(hash_val
, &tmp_addr
);
445 case CE_CONVERSATION_TYPE
:
446 tmp_addr
.len
= (int) sizeof(element
->conversation_type_val
);
447 tmp_addr
.data
= &element
->conversation_type_val
;
448 hash_val
= add_address_to_hash(hash_val
, &tmp_addr
);
456 hash_val
+= ( hash_val
<< 3 );
457 hash_val
^= ( hash_val
>> 11 );
458 hash_val
+= ( hash_val
<< 15 );
464 * Compare two conversation keys for an exact match.
467 conversation_match_element_list(const void *v1
, const void *v2
)
469 const conversation_element_t
*element1
= (const conversation_element_t
*)v1
;
470 const conversation_element_t
*element2
= (const conversation_element_t
*)v2
;
473 if (element1
->type
!= element2
->type
) {
477 switch (element1
->type
) {
479 if (!addresses_equal(&element1
->addr_val
, &element2
->addr_val
)) {
484 if (element1
->port_val
!= element2
->port_val
) {
489 if (strcmp(element1
->str_val
, element2
->str_val
)) {
494 if (element1
->uint_val
!= element2
->uint_val
) {
499 if (element1
->uint64_val
!= element2
->uint64_val
) {
504 if (element1
->int_val
!= element2
->int_val
) {
509 if (element1
->int64_val
!= element2
->int64_val
) {
514 if (element1
->blob
.len
!= element2
->blob
.len
||
515 (element1
->blob
.len
> 0 && memcmp(element1
->blob
.val
, element2
->blob
.val
, element1
->blob
.len
) != 0)) {
519 case CE_CONVERSATION_TYPE
:
520 if (element1
->conversation_type_val
!= element2
->conversation_type_val
) {
531 // Everything matched so far.
536 * Create a new hash tables for conversations.
539 conversation_init(void)
542 * Free up any space allocated for conversation protocol data
545 * We can free the space, as the structures it contains are
546 * pointed to by conversation data structures that were freed
549 conversation_hashtable_element_list
= wmem_map_new(wmem_epan_scope(), wmem_str_hash
, g_str_equal
);
551 conversation_element_t exact_elements
[EXACT_IDX_COUNT
] = {
552 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
553 { CE_PORT
, .port_val
= 0 },
554 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
555 { CE_PORT
, .port_val
= 0 },
556 { CE_CONVERSATION_TYPE
, .conversation_type_val
= CONVERSATION_NONE
}
558 char *exact_map_key
= conversation_element_list_name(wmem_epan_scope(), exact_elements
);
559 conversation_hashtable_exact_addr_port
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(),
560 conversation_hash_element_list
,
561 conversation_match_element_list
);
562 wmem_map_insert(conversation_hashtable_element_list
, wmem_strdup(wmem_epan_scope(), exact_map_key
),
563 conversation_hashtable_exact_addr_port
);
565 conversation_element_t addrs_elements
[ADDRS_IDX_COUNT
] = {
566 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
567 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
568 { CE_CONVERSATION_TYPE
, .conversation_type_val
= CONVERSATION_NONE
}
570 char *addrs_map_key
= conversation_element_list_name(wmem_epan_scope(), addrs_elements
);
571 conversation_hashtable_exact_addr
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(),
572 conversation_hash_element_list
,
573 conversation_match_element_list
);
574 wmem_map_insert(conversation_hashtable_element_list
, wmem_strdup(wmem_epan_scope(), addrs_map_key
),
575 conversation_hashtable_exact_addr
);
577 conversation_element_t no_addr2_elements
[NO_ADDR2_IDX_COUNT
] = {
578 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
579 { CE_PORT
, .port_val
= 0 },
580 { CE_PORT
, .port_val
= 0 },
581 { CE_CONVERSATION_TYPE
, .conversation_type_val
= CONVERSATION_NONE
}
583 char *no_addr2_map_key
= conversation_element_list_name(wmem_epan_scope(), no_addr2_elements
);
584 conversation_hashtable_no_addr2
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(),
585 conversation_hash_element_list
,
586 conversation_match_element_list
);
587 wmem_map_insert(conversation_hashtable_element_list
, wmem_strdup(wmem_epan_scope(), no_addr2_map_key
),
588 conversation_hashtable_no_addr2
);
590 conversation_element_t no_port2_elements
[NO_PORT2_IDX_COUNT
] = {
591 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
592 { CE_PORT
, .port_val
= 0 },
593 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
594 { CE_CONVERSATION_TYPE
, .conversation_type_val
= CONVERSATION_NONE
}
596 char *no_port2_map_key
= conversation_element_list_name(wmem_epan_scope(), no_port2_elements
);
597 conversation_hashtable_no_port2
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(),
598 conversation_hash_element_list
,
599 conversation_match_element_list
);
600 wmem_map_insert(conversation_hashtable_element_list
, wmem_strdup(wmem_epan_scope(), no_port2_map_key
),
601 conversation_hashtable_no_port2
);
603 conversation_element_t no_addr2_or_port2_elements
[NO_ADDR2_PORT2_IDX_COUNT
] = {
604 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
605 { CE_PORT
, .port_val
= 0 },
606 { CE_CONVERSATION_TYPE
, .conversation_type_val
= CONVERSATION_NONE
}
608 char *no_addr2_or_port2_map_key
= conversation_element_list_name(wmem_epan_scope(), no_addr2_or_port2_elements
);
609 conversation_hashtable_no_addr2_or_port2
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(),
610 conversation_hash_element_list
,
611 conversation_match_element_list
);
612 wmem_map_insert(conversation_hashtable_element_list
, wmem_strdup(wmem_epan_scope(), no_addr2_or_port2_map_key
),
613 conversation_hashtable_no_addr2_or_port2
);
615 conversation_element_t id_elements
[2] = {
616 { CE_UINT
, .uint_val
= 0 },
617 { CE_CONVERSATION_TYPE
, .conversation_type_val
= CONVERSATION_NONE
}
619 char *id_map_key
= conversation_element_list_name(wmem_epan_scope(), id_elements
);
620 conversation_hashtable_id
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(),
621 conversation_hash_element_list
,
622 conversation_match_element_list
);
623 wmem_map_insert(conversation_hashtable_element_list
, wmem_strdup(wmem_epan_scope(), id_map_key
),
624 conversation_hashtable_id
);
627 * Initialize the "deinterlacer" table, which is used as the basis for the
628 * deinterlacing process, and in conjunction with the "anchor" tables
630 * Typically the elements are:
637 * By the time of implementation, these table is invoked through the
638 * conversation_deinterlacing_key user preference.
640 conversation_element_t deinterlacer_elements
[EXACT_IDX_COUNT
+1] = {
641 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
642 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
643 { CE_UINT
, .port_val
= 0 },
644 { CE_UINT
, .port_val
= 0 },
645 { CE_UINT
, .uint_val
= 0 },
646 { CE_CONVERSATION_TYPE
, .conversation_type_val
= CONVERSATION_NONE
}
648 char *deinterlacer_map_key
= conversation_element_list_name(wmem_epan_scope(), deinterlacer_elements
);
649 conversation_hashtable_deinterlacer
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(),
650 conversation_hash_element_list
,
651 conversation_match_element_list
);
652 wmem_map_insert(conversation_hashtable_element_list
, wmem_strdup(wmem_epan_scope(), deinterlacer_map_key
),
653 conversation_hashtable_deinterlacer
);
656 * Initialize the "_anc" tables, which are very similar to their standard counterparts
657 * but contain an additional "anchor" materialized as an integer. This value is supposed
658 * to indicate a stream ID of the underlying protocol, thus attaching two conversations
659 * of two protocols together.
661 * By the time of implementation, these table is invoked through the
662 * conversation_deinterlacing_key user preference.
664 conversation_element_t exact_elements_anc
[EXACT_IDX_COUNT
+1] = {
665 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
666 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
667 { CE_PORT
, .port_val
= 0 },
668 { CE_PORT
, .port_val
= 0 },
669 { CE_UINT
, .uint_val
= 0 },
670 { CE_CONVERSATION_TYPE
, .conversation_type_val
= CONVERSATION_NONE
}
672 char *exact_anc_map_key
= conversation_element_list_name(wmem_epan_scope(), exact_elements_anc
);
673 conversation_hashtable_exact_addr_port_anc
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(),
674 conversation_hash_element_list
,
675 conversation_match_element_list
);
676 wmem_map_insert(conversation_hashtable_element_list
, wmem_strdup(wmem_epan_scope(), exact_anc_map_key
),
677 conversation_hashtable_exact_addr_port_anc
);
679 conversation_element_t addrs_elements_anc
[ADDRS_IDX_COUNT
+1] = {
680 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
681 { CE_ADDRESS
, .addr_val
= ADDRESS_INIT_NONE
},
682 { CE_UINT
, .uint_val
= 0 },
683 { CE_CONVERSATION_TYPE
, .conversation_type_val
= CONVERSATION_NONE
}
685 char *addrs_anc_map_key
= conversation_element_list_name(wmem_epan_scope(), addrs_elements_anc
);
686 conversation_hashtable_exact_addr_anc
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(),
687 conversation_hash_element_list
,
688 conversation_match_element_list
);
689 wmem_map_insert(conversation_hashtable_element_list
, wmem_strdup(wmem_epan_scope(), addrs_anc_map_key
),
690 conversation_hashtable_exact_addr_anc
);
695 * Initialize some variables every time a file is loaded or re-loaded.
698 conversation_epan_reset(void)
701 * Start the conversation indices over at 0.
707 * Does the right thing when inserting into one of the conversation hash tables,
708 * taking into account ordering and hash chains and all that good stuff.
710 * Mostly adapted from the old conversation_new().
713 conversation_insert_into_hashtable(wmem_map_t
*hashtable
, conversation_t
*conv
)
715 conversation_t
*chain_head
, *chain_tail
, *cur
, *prev
;
717 chain_head
= (conversation_t
*)wmem_map_lookup(hashtable
, conv
->key_ptr
);
719 if (NULL
==chain_head
) {
724 wmem_map_insert(hashtable
, conv
->key_ptr
, conv
);
725 DPRINT(("created a new conversation chain"));
728 /* There's an existing chain for this key */
729 DPRINT(("there's an existing conversation chain"));
731 chain_tail
= chain_head
->last
;
733 if (conv
->setup_frame
>= chain_tail
->setup_frame
) {
734 /* This convo belongs at the end of the chain */
737 chain_tail
->next
= conv
;
738 chain_head
->last
= conv
;
741 /* Loop through the chain to find the right spot */
745 for (; (conv
->setup_frame
> cur
->setup_frame
) && cur
->next
; prev
=cur
, cur
=cur
->next
)
749 /* Changing the head of the chain */
750 conv
->next
= chain_head
;
751 conv
->last
= chain_tail
;
752 chain_head
->last
= NULL
;
753 wmem_map_insert(hashtable
, conv
->key_ptr
, conv
);
756 /* Inserting into the middle of the chain */
766 * Does the right thing when removing from one of the conversation hash tables,
767 * taking into account ordering and hash chains and all that good stuff.
770 conversation_remove_from_hashtable(wmem_map_t
*hashtable
, conversation_t
*conv
)
772 conversation_t
*chain_head
, *cur
, *prev
;
774 chain_head
= (conversation_t
*)wmem_map_lookup(hashtable
, conv
->key_ptr
);
776 if (conv
== chain_head
) {
777 /* We are currently the front of the chain */
778 if (NULL
== conv
->next
) {
779 /* We are the only conversation in the chain, no need to
780 * update next pointer, but do not call
781 * wmem_map_remove() either because the conv data
782 * will be re-inserted. */
783 wmem_map_steal(hashtable
, conv
->key_ptr
);
786 /* Update the head of the chain */
787 chain_head
= conv
->next
;
788 chain_head
->last
= conv
->last
;
790 if (conv
->latest_found
== conv
)
791 chain_head
->latest_found
= NULL
;
793 chain_head
->latest_found
= conv
->latest_found
;
795 wmem_map_insert(hashtable
, chain_head
->key_ptr
, chain_head
);
799 /* We are not the front of the chain. Loop through to find us.
800 * Start loop at chain_head->next rather than chain_head because
801 * we already know we're not at the head. */
802 cur
= chain_head
->next
;
805 for (; (cur
!= conv
) && cur
->next
; prev
=cur
, cur
=cur
->next
)
809 /* XXX: Conversation not found. Wrong hashtable? */
813 prev
->next
= conv
->next
;
815 if (NULL
== conv
->next
) {
816 /* We're at the very end of the list. */
817 chain_head
->last
= prev
;
820 if (chain_head
->latest_found
== conv
)
821 chain_head
->latest_found
= prev
;
825 conversation_t
*conversation_new_full(const uint32_t setup_frame
, conversation_element_t
*elements
)
827 DISSECTOR_ASSERT(elements
);
829 char *el_list_map_key
= conversation_element_list_name(wmem_epan_scope(), elements
);
830 wmem_map_t
*el_list_map
= (wmem_map_t
*) wmem_map_lookup(conversation_hashtable_element_list
, el_list_map_key
);
832 el_list_map
= wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(), conversation_hash_element_list
,
833 conversation_match_element_list
);
834 wmem_map_insert(conversation_hashtable_element_list
, wmem_strdup(wmem_epan_scope(), el_list_map_key
), el_list_map
);
837 size_t element_count
= conversation_element_count(elements
);
838 conversation_element_t
*conv_key
= wmem_memdup(wmem_file_scope(), elements
, sizeof(conversation_element_t
) * element_count
);
839 for (size_t i
= 0; i
< element_count
; i
++) {
840 if (conv_key
[i
].type
== CE_ADDRESS
) {
841 copy_address_wmem(wmem_file_scope(), &conv_key
[i
].addr_val
, &elements
[i
].addr_val
);
842 } else if (conv_key
[i
].type
== CE_STRING
) {
843 conv_key
[i
].str_val
= wmem_strdup(wmem_file_scope(), elements
[i
].str_val
);
844 } else if (conv_key
[i
].type
== CE_BLOB
) {
845 conv_key
[i
].blob
.val
= wmem_memdup(wmem_file_scope(), elements
[i
].blob
.val
, elements
[i
].blob
.len
);
849 conversation_t
*conversation
= wmem_new0(wmem_file_scope(), conversation_t
);
850 conversation
->conv_index
= new_index
;
851 conversation
->setup_frame
= conversation
->last_frame
= setup_frame
;
855 conversation
->key_ptr
= conv_key
;
856 conversation_insert_into_hashtable(el_list_map
, conversation
);
861 * Given two address/port pairs for a packet, create a new conversation
862 * to contain packets between those address/port pairs.
864 * The options field is used to specify whether the address 2 value
865 * and/or port 2 value are not given and any value is acceptable
866 * when searching for this conversation.
869 conversation_new(const uint32_t setup_frame
, const address
*addr1
, const address
*addr2
,
870 const conversation_type ctype
, const uint32_t port1
, const uint32_t port2
, const unsigned options
)
873 DISSECTOR_ASSERT(!(options | CONVERSATION_TEMPLATE) || ((options | (NO_ADDR2 | NO_PORT2 | NO_PORT2_FORCE))) &&
874 "A conversation template may not be constructed without wildcard options");
876 wmem_map_t
* hashtable
;
877 conversation_t
*conversation
= NULL
;
879 * Verify that the correct options are used, if any.
881 DISSECTOR_ASSERT_HINT(!(options
& NO_MASK_B
), "Use NO_ADDR2 and/or NO_PORT2 or NO_PORT2_FORCE as option");
883 #ifdef DEBUG_CONVERSATION
884 char *addr1_str
, *addr2_str
;
889 if (options
& NO_ADDR2
) {
891 * Neither address 1 nor address 2.
893 if (options
& NO_PORT2
) {
895 * Port 1 but not port 2.
897 DPRINT(("creating conversation for frame #%u: ID %u (ctype=%d)",
898 setup_frame
, port1
, ctype
));
903 DPRINT(("creating conversation for frame #%u: %u -> %u (ctype=%d)",
904 setup_frame
, port1
, port2
, ctype
));
908 * Address 2 but not address 1.
910 addr2_str
= address_to_str(NULL
, addr2
);
911 if (options
& NO_PORT2
) {
913 * Port 1 but not port 2.
915 DPRINT(("creating conversation for frame #%u: ID %u, address %s (ctype=%d)",
916 setup_frame
, port1
, addr2_str
, ctype
));
921 DPRINT(("creating conversation for frame #%u: %u -> %s:%u (ctype=%d)",
922 setup_frame
, port1
, addr2_str
, port2
, ctype
));
924 wmem_free(NULL
, addr2_str
);
930 addr1_str
= address_to_str(NULL
, addr1
);
931 if (options
& NO_ADDR2
) {
933 * Address 1 but no address 2.
935 if (options
& NO_PORT2
) {
937 * Port 1 but not port 2.
939 DPRINT(("creating conversation for frame #%u: %s:%u (ctype=%d)",
940 setup_frame
, addr1_str
, port1
, ctype
));
945 DPRINT(("creating conversation for frame #%u: %s:%u -> %u (ctype=%d)",
946 setup_frame
, addr1_str
, port1
, port2
, ctype
));
952 addr2_str
= address_to_str(NULL
, addr2
);
953 if (options
& NO_PORT2
) {
955 * Port 1 but not port 2.
957 DPRINT(("creating conversation for frame #%u: %s:%u -> %s (ctype=%d)",
958 setup_frame
, addr1_str
, port1
, addr2_str
, ctype
));
959 } else if (options
& NO_PORTS
) {
963 DPRINT(("creating conversation for frame #%u: %s -> %s (ctype=%d)",
964 setup_frame
, addr1_str
, addr2_str
, ctype
));
969 DPRINT(("creating conversation for frame #%u: %s:%u -> %s:%u (ctype=%d)",
970 setup_frame
, addr1_str
, port1
, addr2_str
, port2
, ctype
));
972 wmem_free(NULL
, addr2_str
);
974 wmem_free(NULL
, addr1_str
);
978 // Always allocate an "exact"-sized key in case we call conversation_set_port2
979 // or conversation_set_addr2 later.
980 conversation_element_t
*new_key
= wmem_alloc(wmem_file_scope(), sizeof(conversation_element_t
) * EXACT_IDX_COUNT
);
981 size_t addr2_idx
= 0;
982 size_t port2_idx
= 0;
985 new_key
[ADDR1_IDX
].type
= CE_ADDRESS
;
987 copy_address_wmem(wmem_file_scope(), &new_key
[ADDR1_IDX
].addr_val
, addr1
);
989 clear_address(&new_key
[ADDR1_IDX
].addr_val
);
992 if (!(options
& NO_PORTS
)) {
993 new_key
[PORT1_IDX
].type
= CE_PORT
;
994 new_key
[PORT1_IDX
].port_val
= port1
;
997 if (options
& NO_ADDR2
) {
998 if (options
& (NO_PORT2
|NO_PORT2_FORCE
)) {
999 hashtable
= conversation_hashtable_no_addr2_or_port2
;
1000 endp_idx
= ENDP_NO_ADDR2_PORT2_IDX
;
1002 hashtable
= conversation_hashtable_no_addr2
;
1003 port2_idx
= PORT2_NO_ADDR2_IDX
;
1004 endp_idx
= ENDP_NO_ADDR2_IDX
;
1007 if (options
& (NO_PORT2
|NO_PORT2_FORCE
)) {
1008 hashtable
= conversation_hashtable_no_port2
;
1009 addr2_idx
= ADDR2_IDX
;
1010 endp_idx
= ENDP_NO_PORT2_IDX
;
1011 } else if (options
& NO_PORTS
) {
1012 hashtable
= conversation_hashtable_exact_addr
;
1013 addr2_idx
= PORT1_IDX
;
1014 endp_idx
= ENDP_NO_PORTS_IDX
;
1016 hashtable
= conversation_hashtable_exact_addr_port
;
1017 addr2_idx
= ADDR2_IDX
;
1018 port2_idx
= PORT2_IDX
;
1019 endp_idx
= ENDP_EXACT_IDX
;
1024 new_key
[addr2_idx
].type
= CE_ADDRESS
;
1025 if (addr2
!= NULL
) {
1026 copy_address_wmem(wmem_file_scope(), &new_key
[addr2_idx
].addr_val
, addr2
);
1028 clear_address(&new_key
[addr2_idx
].addr_val
);
1033 new_key
[port2_idx
].type
= CE_PORT
;
1034 new_key
[port2_idx
].port_val
= port2
;
1037 new_key
[endp_idx
].type
= CE_CONVERSATION_TYPE
;
1038 new_key
[endp_idx
].conversation_type_val
= ctype
;
1040 conversation
= wmem_new0(wmem_file_scope(), conversation_t
);
1042 conversation
->conv_index
= new_index
;
1043 conversation
->setup_frame
= conversation
->last_frame
= setup_frame
;
1045 /* set the options and key pointer */
1046 conversation
->options
= options
;
1047 conversation
->key_ptr
= new_key
;
1052 conversation_insert_into_hashtable(hashtable
, conversation
);
1055 return conversation
;
1059 conversation_new_strat(packet_info
*pinfo
, const conversation_type ctype
, const unsigned options
)
1061 conversation_t
*conversation
= NULL
;
1062 bool is_ordinary_conv
= true;
1064 /* deinterlacing is only supported for the Ethernet wtap for now */
1065 if( (pinfo
->pseudo_header
!= NULL
)
1066 && (pinfo
->rec
->rec_header
.packet_header
.pkt_encap
== WTAP_ENCAP_ETHERNET
)
1067 && (prefs
.conversation_deinterlacing_key
>0)) {
1068 conversation_t
*underlying_conv
= find_conversation_deinterlacer_pinfo(pinfo
);
1069 if(underlying_conv
) {
1070 is_ordinary_conv
= false;
1071 conversation
= conversation_new_deinterlaced(pinfo
->num
, &pinfo
->src
, &pinfo
->dst
, ctype
,
1072 pinfo
->srcport
, pinfo
->destport
, underlying_conv
->conv_index
, options
);
1076 if(is_ordinary_conv
) {
1077 conversation
= conversation_new(pinfo
->num
, &pinfo
->src
, &pinfo
->dst
, ctype
, pinfo
->srcport
, pinfo
->destport
, options
);
1080 return conversation
;
1084 conversation_new_by_id(const uint32_t setup_frame
, const conversation_type ctype
, const uint32_t id
)
1086 conversation_t
*conversation
= wmem_new0(wmem_file_scope(), conversation_t
);
1087 conversation
->conv_index
= new_index
;
1088 conversation
->setup_frame
= conversation
->last_frame
= setup_frame
;
1092 conversation_element_t
*elements
= wmem_alloc(wmem_file_scope(), sizeof(conversation_element_t
) * 2);
1093 elements
[0].type
= CE_UINT
;
1094 elements
[0].uint_val
= id
;
1095 elements
[1].type
= CE_CONVERSATION_TYPE
;
1096 elements
[1].conversation_type_val
= ctype
;
1097 conversation
->key_ptr
= elements
;
1098 conversation_insert_into_hashtable(conversation_hashtable_id
, conversation
);
1100 return conversation
;
1104 conversation_new_deinterlacer(const uint32_t setup_frame
, const address
*addr1
, const address
*addr2
,
1105 const conversation_type ctype
, const uint32_t key1
, const uint32_t key2
, const uint32_t key3
)
1108 conversation_t
*conversation
= wmem_new0(wmem_file_scope(), conversation_t
);
1109 conversation
->conv_index
= new_index
;
1110 conversation
->setup_frame
= conversation
->last_frame
= setup_frame
;
1112 conversation_element_t
*new_key
= wmem_alloc(wmem_file_scope(), sizeof(conversation_element_t
) * (DEINTR_ENDP_IDX
+1));
1114 new_key
[DEINTR_ADDR1_IDX
].type
= CE_ADDRESS
;
1115 if (addr1
!= NULL
) {
1116 copy_address_wmem(wmem_file_scope(), &new_key
[DEINTR_ADDR1_IDX
].addr_val
, addr1
);
1119 clear_address(&new_key
[DEINTR_ADDR1_IDX
].addr_val
);
1122 new_key
[DEINTR_ADDR2_IDX
].type
= CE_ADDRESS
;
1123 if (addr2
!= NULL
) {
1124 copy_address_wmem(wmem_file_scope(), &new_key
[DEINTR_ADDR2_IDX
].addr_val
, addr2
);
1127 clear_address(&new_key
[DEINTR_ADDR2_IDX
].addr_val
);
1130 new_key
[DEINTR_KEY1_IDX
].type
= CE_UINT
;
1131 new_key
[DEINTR_KEY1_IDX
].uint_val
= key1
;
1133 new_key
[DEINTR_KEY2_IDX
].type
= CE_UINT
;
1134 new_key
[DEINTR_KEY2_IDX
].uint_val
= key2
;
1136 new_key
[DEINTR_KEY3_IDX
].type
= CE_UINT
;
1137 new_key
[DEINTR_KEY3_IDX
].uint_val
= key3
;
1139 new_key
[DEINTR_ENDP_IDX
].type
= CE_CONVERSATION_TYPE
;
1140 new_key
[DEINTR_ENDP_IDX
].conversation_type_val
= ctype
;
1142 conversation
->key_ptr
= new_key
;
1146 conversation_insert_into_hashtable(conversation_hashtable_deinterlacer
, conversation
);
1148 return conversation
;
1152 conversation_new_deinterlaced(const uint32_t setup_frame
, const address
*addr1
, const address
*addr2
,
1153 const conversation_type ctype
, const uint32_t port1
, const uint32_t port2
, const uint32_t anchor
, const unsigned options
)
1156 conversation_t
*conversation
= wmem_new0(wmem_file_scope(), conversation_t
);
1157 conversation
->conv_index
= new_index
;
1158 conversation
->setup_frame
= conversation
->last_frame
= setup_frame
;
1160 if (options
& NO_PORTS
) {
1161 conversation_element_t
*new_key
= wmem_alloc(wmem_file_scope(), sizeof(conversation_element_t
) * (DEINTD_ENDP_NO_PORTS_IDX
+2));
1163 new_key
[DEINTD_ADDR1_IDX
].type
= CE_ADDRESS
;
1164 if (addr1
!= NULL
) {
1165 copy_address_wmem(wmem_file_scope(), &new_key
[DEINTD_ADDR1_IDX
].addr_val
, addr1
);
1168 clear_address(&new_key
[DEINTD_ADDR1_IDX
].addr_val
);
1171 new_key
[DEINTD_ADDR2_IDX
].type
= CE_ADDRESS
;
1172 if (addr2
!= NULL
) {
1173 copy_address_wmem(wmem_file_scope(), &new_key
[DEINTD_ADDR2_IDX
].addr_val
, addr2
);
1176 clear_address(&new_key
[DEINTD_ADDR2_IDX
].addr_val
);
1179 new_key
[DEINTD_ENDP_NO_PORTS_IDX
].type
= CE_UINT
;
1180 new_key
[DEINTD_ENDP_NO_PORTS_IDX
].uint_val
= anchor
;
1182 new_key
[DEINTD_ENDP_NO_PORTS_IDX
+ 1].type
= CE_CONVERSATION_TYPE
;
1183 new_key
[DEINTD_ENDP_NO_PORTS_IDX
+ 1].conversation_type_val
= ctype
;
1185 // set the options and key pointer
1186 conversation
->options
= options
;
1187 conversation
->key_ptr
= new_key
;
1191 conversation_insert_into_hashtable(conversation_hashtable_exact_addr_anc
, conversation
);
1193 return conversation
;
1196 conversation_element_t
*new_key
= wmem_alloc(wmem_file_scope(), sizeof(conversation_element_t
) * (DEINTD_EXACT_IDX_COUNT
+2));
1198 new_key
[DEINTD_ADDR1_IDX
].type
= CE_ADDRESS
;
1199 if (addr1
!= NULL
) {
1200 copy_address_wmem(wmem_file_scope(), &new_key
[DEINTD_ADDR1_IDX
].addr_val
, addr1
);
1203 clear_address(&new_key
[DEINTD_ADDR1_IDX
].addr_val
);
1206 new_key
[DEINTD_ADDR2_IDX
].type
= CE_ADDRESS
;
1207 if (addr2
!= NULL
) {
1208 copy_address_wmem(wmem_file_scope(), &new_key
[DEINTD_ADDR2_IDX
].addr_val
, addr2
);
1211 clear_address(&new_key
[DEINTD_ADDR2_IDX
].addr_val
);
1214 new_key
[DEINTD_PORT1_IDX
].type
= CE_PORT
;
1215 new_key
[DEINTD_PORT1_IDX
].port_val
= port1
;
1217 new_key
[DEINTD_PORT2_IDX
].type
= CE_PORT
;
1218 new_key
[DEINTD_PORT2_IDX
].port_val
= port2
;
1220 new_key
[DEINTD_ENDP_EXACT_IDX
].type
= CE_UINT
;
1221 new_key
[DEINTD_ENDP_EXACT_IDX
].uint_val
= anchor
;
1223 new_key
[DEINTD_ENDP_EXACT_IDX
+ 1].type
= CE_CONVERSATION_TYPE
;
1224 new_key
[DEINTD_ENDP_EXACT_IDX
+ 1].conversation_type_val
= ctype
;
1226 // set the options and key pointer
1227 conversation
->options
= options
;
1228 conversation
->key_ptr
= new_key
;
1232 conversation_insert_into_hashtable(conversation_hashtable_exact_addr_port_anc
, conversation
);
1234 return conversation
;
1239 * Set the port 2 value in a key. Remove the original from table,
1240 * update the options and port values, insert the updated key.
1243 conversation_set_port2(conversation_t
*conv
, const uint32_t port
)
1245 DISSECTOR_ASSERT_HINT(!(conv
->options
& CONVERSATION_TEMPLATE
),
1246 "Use the conversation_create_from_template function when the CONVERSATION_TEMPLATE bit is set in the options mask");
1248 DPRINT(("called for port=%d", port
));
1251 * If the port 2 value is not wildcarded, don't set it.
1253 if ((!(conv
->options
& NO_PORT2
)) || (conv
->options
& NO_PORT2_FORCE
))
1257 if (conv
->options
& NO_ADDR2
) {
1258 conversation_remove_from_hashtable(conversation_hashtable_no_addr2_or_port2
, conv
);
1260 conversation_remove_from_hashtable(conversation_hashtable_no_port2
, conv
);
1263 // Shift our endpoint element over and set our port. We assume that conv->key_ptr
1264 // was created with conversation_new and that we have enough element slots.
1265 conv
->options
&= ~NO_PORT2
;
1266 if (conv
->options
& NO_ADDR2
) {
1267 // addr1,port1,endp -> addr1,port1,port2,endp
1268 conv
->key_ptr
[ENDP_NO_ADDR2_IDX
] = conv
->key_ptr
[ENDP_NO_ADDR2_PORT2_IDX
];
1269 conv
->key_ptr
[PORT2_NO_ADDR2_IDX
].type
= CE_PORT
;
1270 conv
->key_ptr
[PORT2_NO_ADDR2_IDX
].port_val
= port
;
1271 conversation_insert_into_hashtable(conversation_hashtable_no_addr2
, conv
);
1273 // addr1,port1,addr2,endp -> addr1,port1,addr2,port2,endp
1274 conv
->key_ptr
[ENDP_EXACT_IDX
] = conv
->key_ptr
[ENDP_NO_PORT2_IDX
];
1275 conv
->key_ptr
[PORT2_IDX
].type
= CE_PORT
;
1276 conv
->key_ptr
[PORT2_IDX
].port_val
= port
;
1277 conversation_insert_into_hashtable(conversation_hashtable_exact_addr_port
, conv
);
1283 * Set the address 2 value in a key. Remove the original from
1284 * table, update the options and port values, insert the updated key.
1287 conversation_set_addr2(conversation_t
*conv
, const address
*addr
)
1290 DISSECTOR_ASSERT_HINT(!(conv
->options
& CONVERSATION_TEMPLATE
),
1291 "Use the conversation_create_from_template function when the CONVERSATION_TEMPLATE bit is set in the options mask");
1293 addr_str
= address_to_str(NULL
, addr
);
1294 DPRINT(("called for addr=%s", addr_str
));
1295 wmem_free(NULL
, addr_str
);
1298 * If the address 2 value is not wildcarded, don't set it.
1300 if (!(conv
->options
& NO_ADDR2
))
1304 if (conv
->options
& NO_PORT2
) {
1305 conversation_remove_from_hashtable(conversation_hashtable_no_addr2_or_port2
, conv
);
1307 conversation_remove_from_hashtable(conversation_hashtable_no_addr2
, conv
);
1310 // Shift our endpoint and, if needed, our port element over and set our address.
1311 // We assume that conv->key_ptr was created with conversation_new and that we have
1312 // enough element slots.
1313 conv
->options
&= ~NO_ADDR2
;
1314 wmem_map_t
*hashtable
;
1315 if (conv
->options
& NO_PORT2
) {
1316 // addr1,port1,endp -> addr1,port1,addr2,endp
1317 conv
->key_ptr
[ENDP_NO_PORT2_IDX
] = conv
->key_ptr
[ENDP_NO_ADDR2_PORT2_IDX
];
1318 hashtable
= conversation_hashtable_no_port2
;
1320 // addr1,port1,port2,endp -> addr1,port1,addr2,port2,endp
1321 conv
->key_ptr
[ENDP_EXACT_IDX
] = conv
->key_ptr
[ENDP_NO_ADDR2_IDX
];
1322 conv
->key_ptr
[PORT2_IDX
] = conv
->key_ptr
[PORT2_NO_ADDR2_IDX
];
1323 hashtable
= conversation_hashtable_exact_addr_port
;
1325 conv
->key_ptr
[ADDR2_IDX
].type
= CE_ADDRESS
;
1326 copy_address_wmem(wmem_file_scope(), &conv
->key_ptr
[ADDR2_IDX
].addr_val
, addr
);
1327 conversation_insert_into_hashtable(hashtable
, conv
);
1331 static conversation_t
*conversation_lookup_hashtable(wmem_map_t
*conversation_hashtable
, const uint32_t frame_num
, conversation_element_t
*conv_key
)
1333 conversation_t
* convo
= NULL
;
1334 conversation_t
* match
= NULL
;
1335 conversation_t
* chain_head
= NULL
;
1336 chain_head
= (conversation_t
*)wmem_map_lookup(conversation_hashtable
, conv_key
);
1338 if (chain_head
&& (chain_head
->setup_frame
<= frame_num
)) {
1341 if (chain_head
->last
&& (chain_head
->last
->setup_frame
<= frame_num
))
1342 return chain_head
->last
;
1344 if (chain_head
->latest_found
&& (chain_head
->latest_found
->setup_frame
<= frame_num
))
1345 match
= chain_head
->latest_found
;
1347 for (convo
= match
; convo
&& convo
->setup_frame
<= frame_num
; convo
= convo
->next
) {
1348 if (convo
->setup_frame
> match
->setup_frame
) {
1355 chain_head
->latest_found
= match
;
1361 conversation_t
*find_conversation_full(const uint32_t frame_num
, conversation_element_t
*elements
)
1363 char *el_list_map_key
= conversation_element_list_name(NULL
, elements
);
1364 wmem_map_t
*el_list_map
= (wmem_map_t
*) wmem_map_lookup(conversation_hashtable_element_list
, el_list_map_key
);
1365 g_free(el_list_map_key
);
1370 return conversation_lookup_hashtable(el_list_map
, frame_num
, elements
);
1374 * Search a particular hash table for a conversation with the specified
1375 * {addr1, port1, addr2, port2} and set up before frame_num.
1377 static conversation_t
*
1378 conversation_lookup_exact(const uint32_t frame_num
, const address
*addr1
, const uint32_t port1
,
1379 const address
*addr2
, const uint32_t port2
, const conversation_type ctype
)
1381 conversation_element_t key
[EXACT_IDX_COUNT
] = {
1382 { CE_ADDRESS
, .addr_val
= *addr1
},
1383 { CE_PORT
, .port_val
= port1
},
1384 { CE_ADDRESS
, .addr_val
= *addr2
},
1385 { CE_PORT
, .port_val
= port2
},
1386 { CE_CONVERSATION_TYPE
, .conversation_type_val
= ctype
},
1388 return conversation_lookup_hashtable(conversation_hashtable_exact_addr_port
, frame_num
, key
);
1392 * Search a particular hash table for a conversation with the specified
1393 * {addr1, port1, port2} and set up before frame_num.
1395 static conversation_t
*
1396 conversation_lookup_no_addr2(const uint32_t frame_num
, const address
*addr1
, const uint32_t port1
,
1397 const uint32_t port2
, const conversation_type ctype
)
1399 conversation_element_t key
[NO_ADDR2_IDX_COUNT
] = {
1400 { CE_ADDRESS
, .addr_val
= *addr1
},
1401 { CE_PORT
, .port_val
= port1
},
1402 { CE_PORT
, .port_val
= port2
},
1403 { CE_CONVERSATION_TYPE
, .conversation_type_val
= ctype
},
1405 return conversation_lookup_hashtable(conversation_hashtable_no_addr2
, frame_num
, key
);
1409 * Search a particular hash table for a conversation with the specified
1410 * {addr1, port1, addr2} and set up before frame_num.
1412 static conversation_t
*
1413 conversation_lookup_no_port2(const uint32_t frame_num
, const address
*addr1
, const uint32_t port1
,
1414 const address
*addr2
, const conversation_type ctype
)
1416 conversation_element_t key
[NO_PORT2_IDX_COUNT
] = {
1417 { CE_ADDRESS
, .addr_val
= *addr1
},
1418 { CE_PORT
, .port_val
= port1
},
1419 { CE_ADDRESS
, .addr_val
= *addr2
},
1420 { CE_CONVERSATION_TYPE
, .conversation_type_val
= ctype
},
1422 return conversation_lookup_hashtable(conversation_hashtable_no_port2
, frame_num
, key
);
1426 * Search a particular hash table for a conversation with the specified
1427 * {addr1, port1, addr2} and set up before frame_num.
1429 static conversation_t
*
1430 conversation_lookup_no_addr2_or_port2(const uint32_t frame_num
, const address
*addr1
, const uint32_t port1
,
1431 const conversation_type ctype
)
1433 conversation_element_t key
[NO_ADDR2_PORT2_IDX_COUNT
] = {
1434 { CE_ADDRESS
, .addr_val
= *addr1
},
1435 { CE_PORT
, .port_val
= port1
},
1436 { CE_CONVERSATION_TYPE
, .conversation_type_val
= ctype
},
1438 return conversation_lookup_hashtable(conversation_hashtable_no_addr2_or_port2
, frame_num
, key
);
1442 * Search a particular hash table for a conversation with the specified
1443 * {addr1, addr2} and set up before frame_num.
1445 static conversation_t
*
1446 conversation_lookup_no_ports(const uint32_t frame_num
, const address
*addr1
,
1447 const address
*addr2
, const conversation_type ctype
)
1449 conversation_element_t key
[ADDRS_IDX_COUNT
] = {
1450 { CE_ADDRESS
, .addr_val
= *addr1
},
1451 { CE_ADDRESS
, .addr_val
= *addr2
},
1452 { CE_CONVERSATION_TYPE
, .conversation_type_val
= ctype
},
1454 return conversation_lookup_hashtable(conversation_hashtable_exact_addr
, frame_num
, key
);
1458 * Search a particular hash table for a conversation with the specified
1459 * {addr1, port1, addr2, port2, anchor} and set up before frame_num.
1461 static conversation_t
*
1462 conversation_lookup_exact_anc(const uint32_t frame_num
, const address
*addr1
, const uint32_t port1
,
1463 const address
*addr2
, const uint32_t port2
, const conversation_type ctype
,
1464 const uint32_t anchor
)
1466 conversation_element_t key
[DEINTD_EXACT_IDX_COUNT
+1] = {
1467 { CE_ADDRESS
, .addr_val
= *addr1
},
1468 { CE_ADDRESS
, .addr_val
= *addr2
},
1469 { CE_PORT
, .port_val
= port1
},
1470 { CE_PORT
, .port_val
= port2
},
1471 { CE_UINT
, .uint_val
= anchor
},
1472 { CE_CONVERSATION_TYPE
, .conversation_type_val
= ctype
},
1474 return conversation_lookup_hashtable(conversation_hashtable_exact_addr_port_anc
, frame_num
, key
);
1478 * Search a particular hash table for a conversation with the specified
1479 * {addr1, addr2, anchor} and set up before frame_num.
1481 static conversation_t
*
1482 conversation_lookup_no_ports_anc(const uint32_t frame_num
, const address
*addr1
,
1483 const address
*addr2
, const conversation_type ctype
, const uint32_t anchor
)
1485 conversation_element_t key
[DEINTD_ADDRS_IDX_COUNT
+1] = {
1486 { CE_ADDRESS
, .addr_val
= *addr1
},
1487 { CE_ADDRESS
, .addr_val
= *addr2
},
1488 { CE_UINT
, .uint_val
= anchor
},
1489 { CE_CONVERSATION_TYPE
, .conversation_type_val
= ctype
},
1491 return conversation_lookup_hashtable(conversation_hashtable_exact_addr_anc
, frame_num
, key
);
1494 static conversation_t
*
1495 conversation_lookup_no_anc_anc(const uint32_t frame_num
, const address
*addr1
,
1496 const address
*addr2
, const conversation_type ctype
)
1498 conversation_element_t key
[ADDRS_IDX_COUNT
] = {
1499 { CE_ADDRESS
, .addr_val
= *addr1
},
1500 { CE_ADDRESS
, .addr_val
= *addr2
},
1501 { CE_CONVERSATION_TYPE
, .conversation_type_val
= ctype
},
1503 return conversation_lookup_hashtable(conversation_hashtable_exact_addr_anc
, frame_num
, key
);
1507 * Search a particular hash table for a conversation with the specified
1508 * {addr1, addr2, key1, key2, key3} and set up before frame_num.
1509 * At this moment only the deinterlace table is likely to be called.
1511 static conversation_t
*
1512 conversation_lookup_deinterlacer(const uint32_t frame_num
, const address
*addr1
,
1513 const address
*addr2
, const conversation_type ctype
,
1514 const uint32_t key1
, const uint32_t key2
, const uint32_t key3
)
1516 conversation_element_t key
[DEINTR_ENDP_IDX
+1] = {
1517 { CE_ADDRESS
, .addr_val
= *addr1
},
1518 { CE_ADDRESS
, .addr_val
= *addr2
},
1519 { CE_UINT
, .uint_val
= key1
},
1520 { CE_UINT
, .uint_val
= key2
},
1521 { CE_UINT
, .uint_val
= key3
},
1522 { CE_CONVERSATION_TYPE
, .conversation_type_val
= ctype
},
1524 return conversation_lookup_hashtable(conversation_hashtable_deinterlacer
, frame_num
, key
);
1528 * Given two address/port pairs for a packet, search for a conversation
1529 * containing packets between those address/port pairs. Returns NULL if
1532 * We try to find the most exact match that we can, and then proceed to
1533 * try wildcard matches on the "addr_b" and/or "port_b" argument if a more
1534 * exact match failed.
1536 * Either or both of the "addr_b" and "port_b" arguments may be specified as
1537 * a wildcard by setting the NO_ADDR_B or NO_PORT_B flags in the "options"
1538 * argument. We do only wildcard matches on addresses and ports specified
1543 * if neither "addr_b" nor "port_b" were specified as wildcards, we
1544 * do an exact match (addr_a/port_a and addr_b/port_b) and, if that
1545 * succeeds, we return a pointer to the matched conversation;
1547 * otherwise, if "port_b" wasn't specified as a wildcard, we try to
1548 * match any address 2 with the specified port 2 (addr_a/port_a and
1549 * {any}/port_b) and, if that succeeds, we return a pointer to the
1550 * matched conversation;
1552 * otherwise, if "addr_b" wasn't specified as a wildcard, we try to
1553 * match any port 2 with the specified address 2 (addr_a/port_a and
1554 * addr_b/{any}) and, if that succeeds, we return a pointer to the
1555 * matched conversation;
1557 * otherwise, we try to match any address 2 and any port 2
1558 * (addr_a/port_a and {any}/{any}) and, if that succeeds, we return
1559 * a pointer to the matched conversation;
1561 * otherwise, we found no matching conversation, and return NULL.
1564 find_conversation(const uint32_t frame_num
, const address
*addr_a
, const address
*addr_b
, const conversation_type ctype
,
1565 const uint32_t port_a
, const uint32_t port_b
, const unsigned options
)
1567 conversation_t
*conversation
, *other_conv
;
1570 addr_a
= &null_address_
;
1574 addr_b
= &null_address_
;
1577 DINSTR(char *addr_a_str
= address_to_str(NULL
, addr_a
));
1578 DINSTR(char *addr_b_str
= address_to_str(NULL
, addr_b
));
1580 * Verify that the correct options are used, if any.
1582 DISSECTOR_ASSERT_HINT((options
== 0) || (options
& NO_MASK_B
), "Use NO_ADDR_B and/or NO_PORT_B as option");
1584 * First try an exact match, if we have two addresses and ports.
1586 if (!(options
& (NO_ADDR_B
|NO_PORT_B
|NO_PORTS
))) {
1588 * Neither search address B nor search port B are wildcarded,
1589 * start out with an exact match.
1591 DPRINT(("trying exact match: %s:%d -> %s:%d",
1592 addr_a_str
, port_a
, addr_b_str
, port_b
));
1593 conversation
= conversation_lookup_exact(frame_num
, addr_a
, port_a
, addr_b
, port_b
, ctype
);
1595 * Look for an alternate conversation in the opposite direction, which
1596 * might fit better. Note that using the helper functions such as
1597 * find_conversation_pinfo and find_or_create_conversation will finally
1598 * call this function and look for an orientation-agnostic conversation.
1599 * If oriented conversations had to be implemented, amend this code or
1600 * create new functions.
1603 DPRINT(("trying exact match: %s:%d -> %s:%d",
1604 addr_b_str
, port_b
, addr_a_str
, port_a
));
1605 other_conv
= conversation_lookup_exact(frame_num
, addr_b
, port_b
, addr_a
, port_a
, ctype
);
1606 if (other_conv
!= NULL
) {
1607 if (conversation
!= NULL
) {
1608 if(other_conv
->conv_index
> conversation
->conv_index
) {
1609 conversation
= other_conv
;
1613 conversation
= other_conv
;
1616 if ((conversation
== NULL
) && (addr_a
->type
== AT_FC
)) {
1617 /* In Fibre channel, OXID & RXID are never swapped as
1618 * TCP/UDP ports are in TCP/IP.
1620 DPRINT(("trying exact match: %s:%d -> %s:%d",
1621 addr_b_str
, port_a
, addr_a_str
, port_b
));
1622 conversation
= conversation_lookup_exact(frame_num
, addr_b
, port_a
, addr_a
, port_b
, ctype
);
1624 DPRINT(("exact match %sfound",conversation
?"":"not "));
1625 if (conversation
!= NULL
)
1630 * Well, that didn't find anything. Try matches that wildcard
1631 * one of the addresses, if we have two ports.
1633 if (!(options
& (NO_PORT_B
|NO_PORTS
))) {
1635 * Search port B isn't wildcarded.
1637 * First try looking for a conversation with the specified
1638 * address A and port A as the first address and port, and
1639 * with any address and the specified port B as the second
1641 * ("addr_b" doesn't take part in this lookup.)
1643 DPRINT(("trying wildcarded match: %s:%d -> *:%d",
1644 addr_a_str
, port_a
, port_b
));
1645 conversation
= conversation_lookup_no_addr2(frame_num
, addr_a
, port_a
, port_b
, ctype
);
1646 if ((conversation
== NULL
) && (addr_a
->type
== AT_FC
)) {
1647 /* In Fibre channel, OXID & RXID are never swapped as
1648 * TCP/UDP ports are in TCP/IP.
1650 DPRINT(("trying wildcarded match: %s:%d -> *:%d",
1651 addr_b_str
, port_a
, port_b
));
1652 conversation
= conversation_lookup_no_addr2(frame_num
, addr_b
, port_a
, port_b
, ctype
);
1654 if (conversation
!= NULL
) {
1656 * If search address B isn't wildcarded, and this is for a
1657 * connection-oriented protocol, set the second address for this
1658 * conversation to address B, as that's the address that matched the
1659 * wildcarded second address for this conversation.
1661 * (This assumes that, for all connection oriented protocols, the
1662 * endpoints of a connection have only one address each, i.e. you
1663 * don't get packets in a given direction coming from more than one
1664 * address, unless the CONVERSATION_TEMPLATE option is set.)
1666 DPRINT(("wildcarded dest address match found"));
1667 if (!(conversation
->options
& NO_ADDR2
) && ctype
!= CONVERSATION_UDP
)
1669 if (!(conversation
->options
& CONVERSATION_TEMPLATE
))
1671 conversation_set_addr2(conversation
, addr_b
);
1676 conversation_create_from_template(conversation
, addr_b
, 0);
1683 * Well, that didn't find anything.
1684 * If search address B was specified, try looking for a
1685 * conversation with the specified address B and port B as
1686 * the first address and port, and with any address and the
1687 * specified port A as the second address and port (this
1688 * packet may be going in the opposite direction from the
1689 * first packet in the conversation).
1690 * ("addr_a" doesn't take part in this lookup.)
1692 if (!(options
& NO_ADDR_B
)) {
1693 DPRINT(("trying wildcarded match: %s:%d -> *:%d",
1694 addr_b_str
, port_b
, port_a
));
1695 conversation
= conversation_lookup_no_addr2(frame_num
, addr_b
, port_b
, port_a
, ctype
);
1696 if (conversation
!= NULL
) {
1698 * If this is for a connection-oriented
1699 * protocol, set the second address for
1700 * this conversation to address A, as
1701 * that's the address that matched the
1702 * wildcarded second address for this
1705 DPRINT(("match found"));
1706 if (ctype
!= CONVERSATION_UDP
) {
1707 if (!(conversation
->options
& CONVERSATION_TEMPLATE
))
1709 conversation_set_addr2(conversation
, addr_a
);
1714 conversation_create_from_template(conversation
, addr_a
, 0);
1723 * Well, that didn't find anything. Try matches that wildcard
1724 * one of the ports, if we have two addresses.
1726 if (!(options
& (NO_ADDR_B
|NO_PORTS
))) {
1728 * Search address B isn't wildcarded.
1730 * First try looking for a conversation with the specified
1731 * address A and port A as the first address and port, and
1732 * with the specified address B and any port as the second
1734 * ("port_b" doesn't take part in this lookup.)
1736 DPRINT(("trying wildcarded match: %s:%d -> %s:*",
1737 addr_a_str
, port_a
, addr_b_str
));
1738 conversation
= conversation_lookup_no_port2(frame_num
, addr_a
, port_a
, addr_b
, ctype
);
1739 if ((conversation
== NULL
) && (addr_a
->type
== AT_FC
)) {
1740 /* In Fibre channel, OXID & RXID are never swapped as
1741 * TCP/UDP ports are in TCP/IP
1743 DPRINT(("trying wildcarded match: %s:%d -> %s:*", addr_b_str
, port_a
, addr_a_str
));
1744 conversation
= conversation_lookup_no_port2(frame_num
, addr_b
, port_a
, addr_a
, ctype
);
1746 if (conversation
!= NULL
) {
1748 * If search port B isn't wildcarded, and this is for a connection-
1749 * oriented protocol, set the second port for this conversation to
1750 * port B, as that's the port that matched the wildcarded second port
1751 * for this conversation.
1753 * (This assumes that, for all connection oriented protocols, the
1754 * endpoints of a connection have only one port each, i.e. you don't
1755 * get packets in a given direction coming from more than one port,
1756 * unless the CONVERSATION_TEMPLATE option is set.)
1758 DPRINT(("match found"));
1759 if (!(conversation
->options
& NO_PORT2
) && ctype
!= CONVERSATION_UDP
)
1761 if (!(conversation
->options
& CONVERSATION_TEMPLATE
))
1763 conversation_set_port2(conversation
, port_b
);
1768 conversation_create_from_template(conversation
, 0, port_b
);
1775 * Well, that didn't find anything.
1776 * If search port B was specified, try looking for a
1777 * conversation with the specified address B and port B
1778 * as the first address and port, and with the specified
1779 * address A and any port as the second address and port
1780 * (this packet may be going in the opposite direction
1781 * from the first packet in the conversation).
1782 * ("port_a" doesn't take part in this lookup.)
1784 if (!(options
& NO_PORT_B
)) {
1785 DPRINT(("trying wildcarded match: %s:%d -> %s:*",
1786 addr_b_str
, port_b
, addr_a_str
));
1787 conversation
= conversation_lookup_no_port2(frame_num
, addr_b
, port_b
, addr_a
, ctype
);
1788 if (conversation
!= NULL
) {
1790 * If this is for a connection-oriented
1791 * protocol, set the second port for
1792 * this conversation to port A, as
1793 * that's the address that matched the
1794 * wildcarded second address for this
1797 DPRINT(("match found"));
1798 if (ctype
!= CONVERSATION_UDP
)
1800 if (!(conversation
->options
& CONVERSATION_TEMPLATE
))
1802 conversation_set_port2(conversation
, port_a
);
1807 conversation_create_from_template(conversation
, 0, port_a
);
1816 * Well, that didn't find anything. Try matches that wildcard
1817 * one address/port pair.
1819 * First try looking for a conversation with the specified address A
1820 * and port A as the first address and port.
1821 * (Neither "addr_b" nor "port_b" take part in this lookup.)
1823 DPRINT(("trying wildcarded match: %s:%d -> *:*", addr_a_str
, port_a
));
1824 conversation
= conversation_lookup_no_addr2_or_port2(frame_num
, addr_a
, port_a
, ctype
);
1825 if (conversation
!= NULL
) {
1827 * If this is for a connection-oriented protocol:
1829 * if search address B isn't wildcarded, set the
1830 * second address for this conversation to address
1831 * B, as that's the address that matched the
1832 * wildcarded second address for this conversation;
1834 * if search port B isn't wildcarded, set the
1835 * second port for this conversation to port B,
1836 * as that's the port that matched the wildcarded
1837 * second port for this conversation.
1839 DPRINT(("match found"));
1840 if (ctype
!= CONVERSATION_UDP
)
1842 if (!(conversation
->options
& CONVERSATION_TEMPLATE
))
1844 if (!(conversation
->options
& NO_ADDR2
))
1845 conversation_set_addr2(conversation
, addr_b
);
1846 if (!(conversation
->options
& NO_PORT2
))
1847 conversation_set_port2(conversation
, port_b
);
1852 conversation_create_from_template(conversation
, addr_b
, port_b
);
1857 /* for Infiniband, don't try to look in addresses of reverse
1858 * direction, because it could be another different
1859 * valid conversation than what is being searched using
1862 if (ctype
!= CONVERSATION_IBQP
)
1866 * Well, that didn't find anything.
1867 * If search address and port B were specified, try looking for a
1868 * conversation with the specified address B and port B as the
1869 * first address and port, and with any second address and port
1870 * (this packet may be going in the opposite direction from the
1871 * first packet in the conversation).
1872 * (Neither "addr_a" nor "port_a" take part in this lookup.)
1874 if (addr_a
->type
== AT_FC
) {
1875 DPRINT(("trying wildcarded match: %s:%d -> *:*",
1876 addr_b_str
, port_a
));
1877 conversation
= conversation_lookup_no_addr2_or_port2(frame_num
, addr_b
, port_a
, ctype
);
1879 DPRINT(("trying wildcarded match: %s:%d -> *:*",
1880 addr_b_str
, port_b
));
1881 conversation
= conversation_lookup_no_addr2_or_port2(frame_num
, addr_b
, port_b
, ctype
);
1883 if (conversation
!= NULL
) {
1885 * If this is for a connection-oriented protocol, set the
1886 * second address for this conversation to address A, as
1887 * that's the address that matched the wildcarded second
1888 * address for this conversation, and set the second port
1889 * for this conversation to port A, as that's the port
1890 * that matched the wildcarded second port for this
1893 DPRINT(("match found"));
1894 if (ctype
!= CONVERSATION_UDP
)
1896 if (!(conversation
->options
& CONVERSATION_TEMPLATE
))
1898 conversation_set_addr2(conversation
, addr_a
);
1899 conversation_set_port2(conversation
, port_a
);
1903 conversation
= conversation_create_from_template(conversation
, addr_a
, port_a
);
1910 if (options
& NO_PORT_X
) {
1912 * Search for conversations between two addresses, strictly
1914 DPRINT(("trying exact match: %s -> %s",
1915 addr_a_str
, addr_b_str
));
1916 conversation
= conversation_lookup_no_ports(frame_num
, addr_a
, addr_b
, ctype
);
1918 if (conversation
!= NULL
) {
1919 DPRINT(("match found"));
1923 conversation
= conversation_lookup_no_ports(frame_num
, addr_b
, addr_a
, ctype
);
1924 if (conversation
!= NULL
) {
1925 DPRINT(("match found"));
1931 DPRINT(("no matches found"));
1934 * We found no conversation.
1936 conversation
= NULL
;
1939 DINSTR(wmem_free(NULL
, addr_a_str
));
1940 DINSTR(wmem_free(NULL
, addr_b_str
));
1941 return conversation
;
1945 find_conversation_deinterlaced(const uint32_t frame_num
, const address
*addr_a
, const address
*addr_b
, const conversation_type ctype
,
1946 const uint32_t port_a
, const uint32_t port_b
, const uint32_t anchor
, const unsigned options
)
1948 conversation_t
*conversation
, *other_conv
;
1950 if (!(options
& (NO_ADDR_B
|NO_PORT_B
|NO_PORT_X
|NO_ANC
))) {
1951 conversation
= conversation_lookup_exact_anc(frame_num
, addr_a
, port_a
, addr_b
, port_b
, ctype
, anchor
);
1953 other_conv
= conversation_lookup_exact_anc(frame_num
, addr_b
, port_b
, addr_a
, port_a
, ctype
, anchor
);
1954 if (other_conv
!= NULL
) {
1955 if (conversation
!= NULL
) {
1956 if(other_conv
->conv_index
> conversation
->conv_index
) {
1957 conversation
= other_conv
;
1961 conversation
= other_conv
;
1966 else { /* typically : IP protocols */
1967 if (!(options
& NO_ANC
)) {
1968 conversation
= conversation_lookup_no_ports_anc(frame_num
, addr_a
, addr_b
, ctype
, anchor
);
1969 other_conv
= conversation_lookup_no_ports_anc(frame_num
, addr_b
, addr_a
, ctype
, anchor
);
1970 if (other_conv
!= NULL
) {
1971 if (conversation
!= NULL
) {
1972 if(other_conv
->conv_index
> conversation
->conv_index
) {
1973 conversation
= other_conv
;
1977 conversation
= other_conv
;
1982 conversation
= conversation_lookup_no_anc_anc(frame_num
, addr_a
, addr_b
, ctype
);
1983 other_conv
= conversation_lookup_no_anc_anc(frame_num
, addr_b
, addr_a
, ctype
);
1984 if (other_conv
!= NULL
) {
1985 if (conversation
!= NULL
) {
1986 if(other_conv
->conv_index
> conversation
->conv_index
) {
1987 conversation
= other_conv
;
1991 conversation
= other_conv
;
1997 return conversation
;
2001 find_conversation_deinterlacer(const uint32_t frame_num
, const address
*addr_a
, const address
*addr_b
,
2002 const conversation_type ctype
, const uint32_t key_a
, const uint32_t key_b
, const uint32_t key_c
)
2004 conversation_t
*conversation
, *other_conv
;
2006 conversation
= conversation_lookup_deinterlacer(frame_num
, addr_a
, addr_b
, ctype
, key_a
, key_b
, key_c
);
2008 other_conv
= conversation_lookup_deinterlacer(frame_num
, addr_b
, addr_a
, ctype
, key_a
, key_b
, key_c
);
2009 if (other_conv
!= NULL
) {
2010 if (conversation
!= NULL
) {
2011 if(other_conv
->conv_index
> conversation
->conv_index
) {
2012 conversation
= other_conv
;
2016 conversation
= other_conv
;
2020 return conversation
;
2024 find_conversation_deinterlacer_pinfo(const packet_info
*pinfo
)
2026 conversation_t
*conv
=NULL
;
2027 unsigned dr_conv_type
; /* deinterlacer conv type */
2028 uint32_t dtlc_iface
= 0;
2029 uint32_t dtlc_vlan
= 0;
2031 /* evaluate the execution context: user pref, interface, VLAN */
2032 if(prefs
.conversation_deinterlacing_key
>0) {
2033 if(prefs
.conversation_deinterlacing_key
&CONV_DEINT_KEY_INTERFACE
&&
2034 pinfo
->rec
->presence_flags
& WTAP_HAS_INTERFACE_ID
) {
2036 if(prefs
.conversation_deinterlacing_key
&CONV_DEINT_KEY_VLAN
&&
2039 dr_conv_type
= CONVERSATION_ETH_IV
;
2040 dtlc_vlan
= pinfo
->vlan_id
;
2043 dr_conv_type
= CONVERSATION_ETH_IN
;
2045 dtlc_iface
= pinfo
->rec
->rec_header
.packet_header
.interface_id
;
2048 if(prefs
.conversation_deinterlacing_key
&CONV_DEINT_KEY_VLAN
&&
2051 dr_conv_type
= CONVERSATION_ETH_NV
;
2052 dtlc_vlan
= pinfo
->vlan_id
;
2055 dr_conv_type
= CONVERSATION_ETH_NN
;
2059 conv
= find_conversation_deinterlacer(pinfo
->num
, &pinfo
->dl_src
, &pinfo
->dl_dst
, dr_conv_type
, dtlc_iface
, dtlc_vlan
, 0);
2066 find_conversation_by_id(const uint32_t frame
, const conversation_type ctype
, const uint32_t id
)
2068 conversation_element_t elements
[2] = {
2069 { CE_UINT
, .uint_val
= id
},
2070 { CE_CONVERSATION_TYPE
, .conversation_type_val
= ctype
}
2073 return conversation_lookup_hashtable(conversation_hashtable_id
, frame
, elements
);
2077 conversation_add_proto_data(conversation_t
*conv
, const int proto
, void *proto_data
)
2080 REPORT_DISSECTOR_BUG("%s: Can't add proto data to a NULL conversation.", proto_get_protocol_name(proto
));
2082 /* Add it to the list of items for this conversation. */
2083 if (conv
->data_list
== NULL
)
2084 conv
->data_list
= wmem_tree_new(wmem_file_scope());
2086 wmem_tree_insert32(conv
->data_list
, proto
, proto_data
);
2090 conversation_get_proto_data(const conversation_t
*conv
, const int proto
)
2093 REPORT_DISSECTOR_BUG("%s: Can't get proto from a NULL conversation.", proto_get_protocol_name(proto
));
2095 /* No tree created yet */
2096 if (conv
->data_list
== NULL
) {
2100 return wmem_tree_lookup32(conv
->data_list
, proto
);
2104 conversation_delete_proto_data(conversation_t
*conv
, const int proto
)
2107 REPORT_DISSECTOR_BUG("%s: Can't delete a NULL conversation.", proto_get_protocol_name(proto
));
2109 if (conv
->data_list
!= NULL
)
2110 wmem_tree_remove32(conv
->data_list
, proto
);
2114 conversation_set_dissector_from_frame_number(conversation_t
*conversation
,
2115 const uint32_t starting_frame_num
, const dissector_handle_t handle
)
2117 if (!conversation
->dissector_tree
) {
2118 conversation
->dissector_tree
= wmem_tree_new(wmem_file_scope());
2120 wmem_tree_insert32(conversation
->dissector_tree
, starting_frame_num
, (void *)handle
);
2124 conversation_set_dissector(conversation_t
*conversation
, const dissector_handle_t handle
)
2126 conversation_set_dissector_from_frame_number(conversation
, 0, handle
);
2130 conversation_get_dissector(conversation_t
*conversation
, const uint32_t frame_num
)
2132 if (!conversation
->dissector_tree
) {
2135 return (dissector_handle_t
)wmem_tree_lookup32_le(conversation
->dissector_tree
, frame_num
);
2139 try_conversation_call_dissector_helper(conversation_t
*conversation
, bool* dissector_success
,
2140 tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void* data
)
2142 if (!conversation
->dissector_tree
) {
2147 dissector_handle_t handle
= (dissector_handle_t
)wmem_tree_lookup32_le(
2148 conversation
->dissector_tree
, pinfo
->num
);
2149 if (handle
== NULL
) {
2153 ret
= call_dissector_only(handle
, tvb
, pinfo
, tree
, data
);
2155 /* Let the caller decide what to do with success or rejection */
2156 (*dissector_success
) = (ret
!= 0);
2162 * Given two address/port pairs for a packet, search for a matching
2163 * conversation and, if found and it has a conversation dissector,
2164 * call that dissector and return true, otherwise return false.
2166 * This helper uses call_dissector_only which will NOT call the default
2167 * "data" dissector if the packet was rejected.
2168 * Our caller is responsible to call the data dissector explicitly in case
2169 * this function returns false.
2172 try_conversation_dissector(const address
*addr_a
, const address
*addr_b
, const conversation_type ctype
,
2173 const uint32_t port_a
, const uint32_t port_b
, tvbuff_t
*tvb
, packet_info
*pinfo
,
2174 proto_tree
*tree
, void* data
, const unsigned options
)
2176 conversation_t
*conversation
;
2177 bool dissector_success
;
2180 * Verify that the correct options are used, if any.
2182 DISSECTOR_ASSERT_HINT((options
== 0) || (options
& NO_MASK_B
), "Use NO_ADDR_B and/or NO_PORT_B as option");
2184 /* Try each mode based on option flags */
2185 conversation
= find_conversation(pinfo
->num
, addr_a
, addr_b
, ctype
, port_a
, port_b
, 0);
2186 if (conversation
!= NULL
) {
2187 if (try_conversation_call_dissector_helper(conversation
, &dissector_success
, tvb
, pinfo
, tree
, data
))
2188 return dissector_success
;
2191 if (options
& NO_ADDR_B
) {
2192 conversation
= find_conversation(pinfo
->num
, addr_a
, addr_b
, ctype
, port_a
, port_b
, NO_ADDR_B
);
2193 if (conversation
!= NULL
) {
2194 if (try_conversation_call_dissector_helper(conversation
, &dissector_success
, tvb
, pinfo
, tree
, data
))
2195 return dissector_success
;
2199 if (options
& NO_PORT_B
) {
2200 conversation
= find_conversation(pinfo
->num
, addr_a
, addr_b
, ctype
, port_a
, port_b
, NO_PORT_B
);
2201 if (conversation
!= NULL
) {
2202 if (try_conversation_call_dissector_helper(conversation
, &dissector_success
, tvb
, pinfo
, tree
, data
))
2203 return dissector_success
;
2207 if (options
& (NO_ADDR_B
|NO_PORT_B
)) {
2208 conversation
= find_conversation(pinfo
->num
, addr_a
, addr_b
, ctype
, port_a
, port_b
, NO_ADDR_B
|NO_PORT_B
);
2209 if (conversation
!= NULL
) {
2210 if (try_conversation_call_dissector_helper(conversation
, &dissector_success
, tvb
, pinfo
, tree
, data
))
2211 return dissector_success
;
2219 try_conversation_dissector_by_id(const conversation_type ctype
, const uint32_t id
, tvbuff_t
*tvb
,
2220 packet_info
*pinfo
, proto_tree
*tree
, void* data
)
2222 conversation_t
*conversation
;
2224 conversation
= find_conversation_by_id(pinfo
->num
, ctype
, id
);
2226 if (conversation
!= NULL
) {
2227 if (!conversation
->dissector_tree
) {
2232 dissector_handle_t handle
= (dissector_handle_t
)wmem_tree_lookup32_le(conversation
->dissector_tree
, pinfo
->num
);
2234 if (handle
== NULL
) {
2238 ret
= call_dissector_only(handle
, tvb
, pinfo
, tree
, data
);
2240 /* this packet was rejected by the dissector
2241 * so return false in case our caller wants
2242 * to do some cleaning up.
2251 /* identifies a conversation ("classic" or deinterlaced) */
2253 find_conversation_strat(const packet_info
*pinfo
, const conversation_type ctype
, const unsigned options
)
2255 conversation_t
*conv
=NULL
;
2257 /* deinterlacing is only supported for the Ethernet wtap for now */
2258 if( (pinfo
->pseudo_header
!= NULL
)
2259 && (pinfo
->rec
->rec_header
.packet_header
.pkt_encap
== WTAP_ENCAP_ETHERNET
)
2260 && (prefs
.conversation_deinterlacing_key
>0)) {
2261 conversation_t
*underlying_conv
= find_conversation_deinterlacer_pinfo(pinfo
);
2262 if(underlying_conv
) {
2263 conv
= find_conversation_deinterlaced(pinfo
->num
, &pinfo
->src
, &pinfo
->dst
, ctype
, pinfo
->srcport
, pinfo
->destport
, underlying_conv
->conv_index
, options
);
2267 conv
= find_conversation(pinfo
->num
, &pinfo
->src
, &pinfo
->dst
, ctype
, pinfo
->srcport
, pinfo
->destport
, options
);
2273 /** A helper function that calls find_conversation() using data from pinfo
2274 * The frame number and addresses are taken from pinfo.
2277 find_conversation_pinfo(const packet_info
*pinfo
, const unsigned options
)
2279 conversation_t
*conv
= NULL
;
2281 DINSTR(char *src_str
= address_to_str(NULL
, &pinfo
->src
));
2282 DINSTR(char *dst_str
= address_to_str(NULL
, &pinfo
->dst
));
2283 DPRINT(("called for frame #%u: %s:%d -> %s:%d (ptype=%d)",
2284 pinfo
->num
, src_str
, pinfo
->srcport
,
2285 dst_str
, pinfo
->destport
, pinfo
->ptype
));
2287 DINSTR(wmem_free(NULL
, src_str
));
2288 DINSTR(wmem_free(NULL
, dst_str
));
2290 /* Have we seen this conversation before? */
2291 if (pinfo
->use_conv_addr_port_endpoints
) {
2292 DISSECTOR_ASSERT(pinfo
->conv_addr_port_endpoints
);
2293 if ((conv
= find_conversation(pinfo
->num
, &pinfo
->conv_addr_port_endpoints
->addr1
, &pinfo
->conv_addr_port_endpoints
->addr2
,
2294 pinfo
->conv_addr_port_endpoints
->ctype
, pinfo
->conv_addr_port_endpoints
->port1
,
2295 pinfo
->conv_addr_port_endpoints
->port2
, 0)) != NULL
) {
2296 DPRINT(("found previous conversation for frame #%u (last_frame=%d)",
2297 pinfo
->num
, conv
->last_frame
));
2298 if (pinfo
->num
> conv
->last_frame
) {
2299 conv
->last_frame
= pinfo
->num
;
2302 } else if (pinfo
->conv_elements
) {
2303 if ((conv
= find_conversation_full(pinfo
->num
, pinfo
->conv_elements
)) != NULL
) {
2304 DPRINT(("found previous conversation elements for frame #%u (last_frame=%d)",
2305 pinfo
->num
, conv
->last_frame
));
2306 if (pinfo
->num
> conv
->last_frame
) {
2307 conv
->last_frame
= pinfo
->num
;
2311 if ((conv
= find_conversation(pinfo
->num
, &pinfo
->src
, &pinfo
->dst
,
2312 conversation_pt_to_conversation_type(pinfo
->ptype
), pinfo
->srcport
,
2313 pinfo
->destport
, options
)) != NULL
) {
2314 DPRINT(("found previous conversation for frame #%u (last_frame=%d)",
2315 pinfo
->num
, conv
->last_frame
));
2316 if (pinfo
->num
> conv
->last_frame
) {
2317 conv
->last_frame
= pinfo
->num
;
2327 /** A helper function that calls find_conversation() using data from pinfo,
2328 * as above, but somewhat simplified for being accessed from packet_list.
2329 * The frame number and addresses are taken from pinfo.
2332 find_conversation_pinfo_ro(const packet_info
*pinfo
, const unsigned options
)
2334 conversation_t
*conv
= NULL
;
2336 DINSTR(char *src_str
= address_to_str(NULL
, &pinfo
->src
));
2337 DINSTR(char *dst_str
= address_to_str(NULL
, &pinfo
->dst
));
2338 DPRINT(("called for frame #%u: %s:%d -> %s:%d (ptype=%d)",
2339 pinfo
->num
, src_str
, pinfo
->srcport
,
2340 dst_str
, pinfo
->destport
, pinfo
->ptype
));
2342 DINSTR(wmem_free(NULL
, src_str
));
2343 DINSTR(wmem_free(NULL
, dst_str
));
2345 /* Have we seen this conversation before? */
2346 if (pinfo
->use_conv_addr_port_endpoints
) {
2347 DISSECTOR_ASSERT(pinfo
->conv_addr_port_endpoints
);
2348 if ((conv
= find_conversation(pinfo
->num
, &pinfo
->conv_addr_port_endpoints
->addr1
, &pinfo
->conv_addr_port_endpoints
->addr2
,
2349 pinfo
->conv_addr_port_endpoints
->ctype
, pinfo
->conv_addr_port_endpoints
->port1
,
2350 pinfo
->conv_addr_port_endpoints
->port2
, 0)) != NULL
) {
2351 DPRINT(("found previous conversation for frame #%u (last_frame=%d)",
2352 pinfo
->num
, conv
->last_frame
));
2354 } else if (pinfo
->conv_elements
) {
2355 if ((conv
= find_conversation_full(pinfo
->num
, pinfo
->conv_elements
)) != NULL
) {
2356 DPRINT(("found previous conversation elements for frame #%u (last_frame=%d)",
2357 pinfo
->num
, conv
->last_frame
));
2360 if ((conv
= find_conversation_strat(pinfo
, conversation_pt_to_conversation_type(pinfo
->ptype
), options
)) != NULL
) {
2361 DPRINT(("found previous conversation for frame #%u (last_frame=%d)",
2362 pinfo
->num
, conv
->last_frame
));
2364 /* else: something is either not implemented or not handled,
2365 * ICMP Type 3/11 are good examples. */
2373 /* A helper function that calls find_conversation() and, if a conversation is
2374 * not found, calls conversation_new().
2375 * The frame number and addresses are taken from pinfo.
2376 * No options are used, though we could extend this API to include an options
2380 find_or_create_conversation(packet_info
*pinfo
)
2382 conversation_t
*conv
=NULL
;
2384 /* Have we seen this conversation before? */
2385 if ((conv
= find_conversation_pinfo(pinfo
, 0)) == NULL
) {
2386 /* No, this is a new conversation. */
2387 DPRINT(("did not find previous conversation for frame #%u",
2390 if (pinfo
->use_conv_addr_port_endpoints
) {
2391 conv
= conversation_new(pinfo
->num
, &pinfo
->conv_addr_port_endpoints
->addr1
, &pinfo
->conv_addr_port_endpoints
->addr2
,
2392 pinfo
->conv_addr_port_endpoints
->ctype
, pinfo
->conv_addr_port_endpoints
->port1
,
2393 pinfo
->conv_addr_port_endpoints
->port2
, 0);
2394 } else if (pinfo
->conv_elements
) {
2395 conv
= conversation_new_full(pinfo
->num
, pinfo
->conv_elements
);
2397 conv
= conversation_new(pinfo
->num
, &pinfo
->src
,
2398 &pinfo
->dst
, conversation_pt_to_conversation_type(pinfo
->ptype
),
2399 pinfo
->srcport
, pinfo
->destport
, 0);
2408 find_or_create_conversation_by_id(packet_info
*pinfo
, const conversation_type ctype
, const uint32_t id
)
2410 conversation_t
*conv
=NULL
;
2412 /* Have we seen this conversation before? */
2413 if ((conv
= find_conversation_by_id(pinfo
->num
, ctype
, id
)) == NULL
) {
2414 /* No, this is a new conversation. */
2415 DPRINT(("did not find previous conversation for frame #%u",
2418 conv
= conversation_new_by_id(pinfo
->num
, ctype
, id
);
2426 conversation_set_conv_addr_port_endpoints(struct _packet_info
*pinfo
, address
* addr1
, address
* addr2
,
2427 conversation_type ctype
, uint32_t port1
, uint32_t port2
)
2429 pinfo
->conv_addr_port_endpoints
= wmem_new0(pinfo
->pool
, struct conversation_addr_port_endpoints
);
2431 if (addr1
!= NULL
) {
2432 copy_address_wmem(pinfo
->pool
, &pinfo
->conv_addr_port_endpoints
->addr1
, addr1
);
2434 if (addr2
!= NULL
) {
2435 copy_address_wmem(pinfo
->pool
, &pinfo
->conv_addr_port_endpoints
->addr2
, addr2
);
2438 pinfo
->conv_addr_port_endpoints
->ctype
= ctype
;
2439 pinfo
->conv_addr_port_endpoints
->port1
= port1
;
2440 pinfo
->conv_addr_port_endpoints
->port2
= port2
;
2442 pinfo
->use_conv_addr_port_endpoints
= true;
2446 conversation_set_elements_by_id(struct _packet_info
*pinfo
, conversation_type ctype
, uint32_t id
)
2448 pinfo
->conv_elements
= wmem_alloc0(pinfo
->pool
, sizeof(conversation_element_t
) * 2);
2449 pinfo
->conv_elements
[0].type
= CE_UINT
;
2450 pinfo
->conv_elements
[0].uint_val
= id
;
2451 pinfo
->conv_elements
[1].type
= CE_CONVERSATION_TYPE
;
2452 pinfo
->conv_elements
[1].conversation_type_val
= ctype
;
2456 conversation_get_id_from_elements(struct _packet_info
*pinfo
, conversation_type ctype
, const unsigned options
)
2458 if (pinfo
->conv_elements
== NULL
) {
2462 if (pinfo
->conv_elements
[0].type
!= CE_UINT
|| pinfo
->conv_elements
[1].type
!= CE_CONVERSATION_TYPE
) {
2466 if ((pinfo
->conv_elements
[1].conversation_type_val
!= ctype
) && ((options
& USE_LAST_ENDPOINT
) != USE_LAST_ENDPOINT
)) {
2470 return pinfo
->conv_elements
[0].uint_val
;
2474 get_conversation_hashtables(void)
2476 return conversation_hashtable_element_list
;
2480 conversation_key_addr1(const conversation_element_t
*key
)
2482 const address
*addr
= &null_address_
;
2483 if (key
[ADDR1_IDX
].type
== CE_ADDRESS
) {
2484 addr
= &key
[ADDR1_IDX
].addr_val
;
2490 conversation_key_port1(const conversation_element_t
* key
)
2493 if (key
[ADDR1_IDX
].type
== CE_ADDRESS
&& key
[PORT1_IDX
].type
== CE_PORT
) {
2494 port
= key
[PORT1_IDX
].port_val
;
2500 conversation_key_addr2(const conversation_element_t
* key
)
2502 const address
*addr
= &null_address_
;
2503 if (key
[ADDR1_IDX
].type
== CE_ADDRESS
&& key
[PORT1_IDX
].type
== CE_PORT
&& key
[ADDR2_IDX
].type
== CE_ADDRESS
) {
2504 addr
= &key
[ADDR2_IDX
].addr_val
;
2510 conversation_key_port2(const conversation_element_t
* key
)
2513 if (key
[ADDR1_IDX
].type
== CE_ADDRESS
&& key
[PORT1_IDX
].type
== CE_PORT
) {
2514 if (key
[ADDR2_IDX
].type
== CE_ADDRESS
&& key
[PORT2_IDX
].type
== CE_PORT
) {
2516 port
= key
[PORT2_IDX
].port_val
;
2517 } else if (key
[PORT2_NO_ADDR2_IDX
].type
== CE_PORT
) {
2519 port
= key
[PORT2_NO_ADDR2_IDX
].port_val
;
2526 conversation_type
conversation_pt_to_conversation_type(port_type pt
)
2531 return CONVERSATION_NONE
;
2533 return CONVERSATION_SCTP
;
2535 return CONVERSATION_TCP
;
2537 return CONVERSATION_UDP
;
2539 return CONVERSATION_DCCP
;
2541 return CONVERSATION_IPX
;
2543 return CONVERSATION_DDP
;
2545 return CONVERSATION_IDP
;
2547 return CONVERSATION_USB
;
2549 /* XXX - this doesn't currently have conversations */
2550 return CONVERSATION_I2C
;
2552 return CONVERSATION_IBQP
;
2554 return CONVERSATION_BLUETOOTH
;
2556 return CONVERSATION_IWARP_MPA
;
2558 return CONVERSATION_MCTP
;
2561 DISSECTOR_ASSERT(false);
2562 return CONVERSATION_NONE
;
2566 endpoint_type
conversation_pt_to_endpoint_type(port_type pt
)
2571 return ENDPOINT_NONE
;
2573 return ENDPOINT_SCTP
;
2575 return ENDPOINT_TCP
;
2577 return ENDPOINT_UDP
;
2579 return ENDPOINT_DCCP
;
2581 return ENDPOINT_IPX
;
2583 return ENDPOINT_DDP
;
2585 return ENDPOINT_IDP
;
2587 return ENDPOINT_USB
;
2589 /* XXX - this doesn't have ports */
2590 return ENDPOINT_I2C
;
2592 return ENDPOINT_IBQP
;
2594 return ENDPOINT_BLUETOOTH
;
2596 return ENDPOINT_IWARP_MPA
;
2598 return ENDPOINT_MCTP
;
2601 DISSECTOR_ASSERT(false);
2602 return ENDPOINT_NONE
;
2606 * Editor modelines - https://www.wireshark.org/tools/modelines.html
2611 * indent-tabs-mode: nil
2614 * vi: set shiftwidth=4 tabstop=8 expandtab:
2615 * :indentSize=4:tabSize=8:noTabs=true: