epan/dissectors/packet-tcp.h

   1 /* packet-tcp.h
   2  *
   3  * $Id$
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU General Public License
  11  * as published by the Free Software Foundation; either version 2
  12  * of the License, or (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  22  */
  23
  24 #ifndef __PACKET_TCP_H__
  25 #define __PACKET_TCP_H__
  26
  27 #ifdef __cplusplus
  28 extern "C" {
  29 #endif /* __cplusplus */
  30
  31 #include "ws_symbol_export.h"
  32
  33 #ifndef __CONVERSATION_H__
  34 #include <epan/conversation.h>
  35 #endif
  36
  37 #include <epan/wmem/wmem.h>
  38
  39 /* TCP flags */
  40 #define TH_FIN  0x0001
  41 #define TH_SYN  0x0002
  42 #define TH_RST  0x0004
  43 #define TH_PUSH 0x0008
  44 #define TH_ACK  0x0010
  45 #define TH_URG  0x0020
  46 #define TH_ECN  0x0040
  47 #define TH_CWR  0x0080
  48 #define TH_NS   0x0100
  49 #define TH_RES  0x0E00 /* 3 reserved bits */
  50 #define TH_MASK 0x0FFF
  51
  52 /* Idea for gt: either x > y, or y is much bigger (assume wrap) */
  53 #define GT_SEQ(x, y) ((gint32)((y) - (x)) < 0)
  54 #define LT_SEQ(x, y) ((gint32)((x) - (y)) < 0)
  55 #define GE_SEQ(x, y) ((gint32)((y) - (x)) <= 0)
  56 #define LE_SEQ(x, y) ((gint32)((x) - (y)) <= 0)
  57 #define EQ_SEQ(x, y) ((x) == (y))
  58
  59 /* the tcp header structure, passed to tap listeners */
  60 typedef struct tcpheader {
  61         guint32 th_seq;
  62         guint32 th_ack;
  63         gboolean th_have_seglen;        /* TRUE if th_seglen is valid */
  64         guint32 th_seglen;
  65         guint32 th_win;   /* make it 32 bits so we can handle some scaling */
  66         guint16 th_sport;
  67         guint16 th_dport;
  68         guint8  th_hlen;
  69         guint16 th_flags;
  70         guint32 th_stream; /* this stream index field is included to help differentiate when address/port pairs are reused */
  71         address ip_src;
  72         address ip_dst;
  73
  74         /* This is the absolute maximum we could find in TCP options (RFC2018, section 3) */
  75         #define MAX_TCP_SACK_RANGES 4
  76         guint8  num_sack_ranges;
  77         guint32 sack_left_edge[MAX_TCP_SACK_RANGES];
  78         guint32 sack_right_edge[MAX_TCP_SACK_RANGES];
  79 } tcp_info_t;
  80
  81 /*
  82  * Private data passed from the TCP dissector to subdissectors. Passed to the
  83  * subdissectors in pinfo->private_data
  84  */
  85 struct tcpinfo {
  86         guint32 seq;             /* Sequence number of first byte in the data */
  87         guint32 nxtseq;          /* Sequence number of first byte after data */
  88         guint32 lastackseq;      /* Sequence number of last ack */
  89         gboolean is_reassembled; /* This is reassembled data. */
  90         gboolean urgent;         /* TRUE if "urgent_pointer" is valid */
  91         guint16 urgent_pointer;  /* Urgent pointer value for the current packet. */
  92 };
  93
  94 /*
  95  * Loop for dissecting PDUs within a TCP stream; assumes that a PDU
  96  * consists of a fixed-length chunk of data that contains enough information
  97  * to determine the length of the PDU, followed by rest of the PDU.
  98  *
  99  * The first three arguments are the arguments passed to the dissector
 100  * that calls this routine.
 101  *
 102  * "proto_desegment" is the dissector's flag controlling whether it should
 103  * desegment PDUs that cross TCP segment boundaries.
 104  *
 105  * "fixed_len" is the length of the fixed-length part of the PDU.
 106  *
 107  * "get_pdu_len()" is a routine called to get the length of the PDU from
 108  * the fixed-length part of the PDU; it's passed "pinfo", "tvb" and "offset".
 109  *
 110  * "dissect_pdu()" is the routine to dissect a PDU.
 111  */
 112 WS_DLL_PUBLIC void
 113 tcp_dissect_pdus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 114                  gboolean proto_desegment, guint fixed_len,
 115                  guint (*get_pdu_len)(packet_info *, tvbuff_t *, int),
 116                  new_dissector_t dissect_pdu, void* dissector_data);
 117
 118 extern struct tcp_multisegment_pdu *
 119 pdu_store_sequencenumber_of_next_pdu(packet_info *pinfo, guint32 seq, guint32 nxtpdu, wmem_tree_t *multisegment_pdus);
 120
 121 typedef struct _tcp_unacked_t {
 122         struct _tcp_unacked_t *next;
 123         guint32 frame;
 124         guint32 seq;
 125         guint32 nextseq;
 126         nstime_t ts;
 127 } tcp_unacked_t;
 128
 129 struct tcp_acked {
 130         guint32 frame_acked;
 131         nstime_t ts;
 132
 133         guint32  rto_frame;
 134         nstime_t rto_ts;        /* Time since previous packet for
 135                                    retransmissions. */
 136         guint16 flags; /* see TCP_A_* in packet-tcp.c */
 137         guint32 dupack_num;     /* dup ack number */
 138         guint32 dupack_frame;   /* dup ack to frame # */
 139         guint32 bytes_in_flight; /* number of bytes in flight */
 140 };
 141
 142 /* One instance of this structure is created for each pdu that spans across
 143  * multiple tcp segments.
 144  */
 145 struct tcp_multisegment_pdu {
 146         guint32 seq;
 147         guint32 nxtpdu;
 148         guint32 first_frame;
 149         guint32 last_frame;
 150         nstime_t last_frame_time;
 151         guint32 flags;
 152 #define MSP_FLAGS_REASSEMBLE_ENTIRE_SEGMENT     0x00000001
 153 };
 154
 155 typedef struct _tcp_flow_t {
 156         guint32 base_seq;       /* base seq number (used by relative sequence numbers)
 157                                  * or 0 if not yet known.
 158                                  */
 159         tcp_unacked_t *segments;
 160         guint32 fin;            /* frame number of the final FIN */
 161         guint32 lastack;        /* last seen ack */
 162         nstime_t lastacktime;   /* Time of the last ack packet */
 163         guint32 lastnondupack;  /* frame number of last seen non dupack */
 164         guint32 dupacknum;      /* dupack number */
 165         guint32 nextseq;        /* highest seen nextseq */
 166         guint32 maxseqtobeacked;/* highest seen continuous seq number (without hole in the stream) from the fwd party,
 167                                  * this is the maximum seq number that can be acked by the rev party in normal case.
 168                                  * If the rev party sends an ACK beyond this seq number it indicates TCP_A_ACK_LOST_PACKET contition */
 169         guint32 nextseqframe;   /* frame number for segment with highest
 170                                  * sequence number
 171                                  */
 172         nstime_t nextseqtime;   /* Time of the nextseq packet so we can
 173                                  * distinguish between retransmission,
 174                                  * fast retransmissions and outoforder
 175                                  */
 176         guint32 window;         /* last seen window */
 177         gint16  win_scale;      /* -1 is we dont know, -2 is window scaling is not used */
 178         gint16  scps_capable;   /* flow advertised scps capabilities */
 179         guint16 maxsizeacked;   /* 0 if not yet known */
 180         gboolean valid_bif;     /* if lost pkts, disable BiF until ACK is recvd */
 181
 182 /* This tcp flow/session contains only one single PDU and should
 183  * be reassembled until the final FIN segment.
 184  */
 185 #define TCP_FLOW_REASSEMBLE_UNTIL_FIN   0x0001
 186         guint16 flags;
 187
 188         /* see TCP_A_* in packet-tcp.c */
 189         guint32 lastsegmentflags;
 190
 191         /* This tree is indexed by sequence number and keeps track of all
 192          * all pdus spanning multiple segments for this flow.
 193          */
 194         wmem_tree_t *multisegment_pdus;
 195
 196         /* Process info, currently discovered via IPFIX */
 197         guint32 process_uid;    /* UID of local process */
 198         guint32 process_pid;    /* PID of local process */
 199         gchar *username;        /* Username of the local process */
 200         gchar *command;         /* Local process name + path + args */
 201 } tcp_flow_t;
 202
 203
 204 struct tcp_analysis {
 205         /* These two structs are managed based on comparing the source
 206          * and destination addresses and, if they're equal, comparing
 207          * the source and destination ports.
 208          *
 209          * If the source is greater than the destination, then stuff
 210          * sent from src is in ual1.
 211          *
 212          * If the source is less than the destination, then stuff
 213          * sent from src is in ual2.
 214          *
 215          * XXX - if the addresses and ports are equal, we don't guarantee
 216          * the behavior.
 217          */
 218         tcp_flow_t      flow1;
 219         tcp_flow_t      flow2;
 220
 221         /* These pointers are set by get_tcp_conversation_data()
 222          * fwd point in the same direction as the current packet
 223          * and rev in the reverse direction
 224          */
 225         tcp_flow_t      *fwd;
 226         tcp_flow_t      *rev;
 227
 228         /* This pointer is NULL   or points to a tcp_acked struct if this
 229          * packet has "interesting" properties such as being a KeepAlive or
 230          * similar
 231          */
 232         struct tcp_acked *ta;
 233         /* This structure contains a tree containing all the various ta's
 234          * keyed by frame number.
 235          */
 236         wmem_tree_t     *acked_table;
 237
 238         /* Remember the timestamp of the first frame seen in this tcp
 239          * conversation to be able to calculate a relative time compared
 240          * to the start of this conversation
 241          */
 242         nstime_t        ts_first;
 243
 244         /* Remember the timestamp of the frame that was last seen in this
 245          * tcp conversation to be able to calculate a delta time compared
 246          * to previous frame in this conversation
 247          */
 248         nstime_t        ts_prev;
 249
 250         /* Keep track of tcp stream numbers instead of using the conversation
 251          * index (as how it was done before). This prevents gaps in the
 252          * stream index numbering
 253          */
 254         guint32         stream;
 255
 256         /* Remembers the server port on the SYN (or SYN|ACK) packet to
 257          * help determine which dissector to call
 258          */
 259         guint16 server_port;
 260 };
 261
 262 /* Structure that keeps per packet data. First used to be able
 263  * to calculate the time_delta from the last seen frame in this
 264  * TCP conversation. Can be extended for future use.
 265  */
 266 struct tcp_per_packet_data_t {
 267         nstime_t        ts_del;
 268 };
 269
 270
 271 extern void dissect_tcp_payload(tvbuff_t *tvb, packet_info *pinfo, int offset,
 272                                 guint32 seq, guint32 nxtseq, guint32 sport,
 273                                 guint32 dport, proto_tree *tree,
 274                                 proto_tree *tcp_tree,
 275                                 struct tcp_analysis *tcpd, struct tcpinfo *tcpinfo);
 276
 277 extern struct tcp_analysis *get_tcp_conversation_data(conversation_t *conv,
 278                                 packet_info *pinfo);
 279
 280 extern gboolean decode_tcp_ports(tvbuff_t *, int, packet_info *, proto_tree *, int, int, struct tcp_analysis *, struct tcpinfo *);
 281
 282 /** Associate process information with a given flow
 283  *
 284  * @param frame_num The frame number
 285  * @param local_addr The local IPv4 or IPv6 address of the process
 286  * @param remote_addr The remote IPv4 or IPv6 address of the process
 287  * @param local_port The local TCP port of the process
 288  * @param remote_port The remote TCP port of the process
 289  * @param uid The numeric user ID of the process
 290  * @param pid The numeric PID of the process
 291  * @param username Ephemeral string containing the full or partial process name
 292  * @param command Ephemeral string containing the full or partial process name
 293  */
 294 extern void add_tcp_process_info(guint32 frame_num, address *local_addr, address *remote_addr, guint16 local_port, guint16 remote_port, guint32 uid, guint32 pid, gchar *username, gchar *command);
 295
 296 /** Get the current number of TCP streams
 297  *
 298  * @return The number of TCP streams
 299  */
 300 WS_DLL_PUBLIC guint32 get_tcp_stream_count(void);
 301
 302 #ifdef __cplusplus
 303 }
 304 #endif /* __cplusplus */
 305
 306 #endif