epan/reassemble.h

   1 /* reassemble.h
   2  * Declarations of outines for {fragment,segment} reassembly
   3  *
   4  * $Id$
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version 2
  13  * of the License, or (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  23  */
  24
  25 /* make sure that all flags that are set in a fragment entry is also set for
  26  * the flags field of fd_head !!!
  27  */
  28
  29 #ifndef REASSEMBLE_H
  30 #define REASSEMBLE_H
  31
  32 #include "ws_symbol_export.h"
  33
  34 /* only in fd_head: packet is defragmented */
  35 #define FD_DEFRAGMENTED         0x0001
  36
  37 /* there are overlapping fragments */
  38 #define FD_OVERLAP              0x0002
  39
  40 /* overlapping fragments contain different data */
  41 #define FD_OVERLAPCONFLICT      0x0004
  42
  43 /* more than one fragment which indicates end-of data */
  44 #define FD_MULTIPLETAILS        0x0008
  45
  46 /* fragment starts before the end of the datagram but extends
  47    past the end of the datagram */
  48 #define FD_TOOLONGFRAGMENT      0x0010
  49
  50 /* fragment tvb is subset, don't tvb_free() it */
  51 #define FD_SUBSET_TVB           0x0020
  52
  53 /* this flag is used to request fragment_add to continue the reassembly process */
  54 #define FD_PARTIAL_REASSEMBLY   0x0040
  55
  56 /* fragment offset is indicated by sequence number and not byte offset
  57    into the defragmented packet */
  58 #define FD_BLOCKSEQUENCE        0x0100
  59
  60 /* if REASSEMBLE_FLAGS_CHECK_DATA_PRESENT is set, and the first fragment is
  61  * incomplete, this flag is set in the flags word on the fd_head returned.
  62  *
  63  * It's all a fudge to preserve historical behaviour.
  64  */
  65 #define FD_DATA_NOT_PRESENT     0x0200
  66
  67 /* This flag is set in (only) fd_head to denote that datalen has been set to a valid value.
  68  * It's implied by FD_DEFRAGMENTED (we must know the total length of the
  69  * datagram if we have defragmented it...)
  70  */
  71 #define FD_DATALEN_SET          0x0400
  72
  73 typedef struct _fragment_item {
  74         struct _fragment_item *next;
  75         guint32 frame;  /* XXX - does this apply to reassembly heads? */
  76         guint32 offset; /* XXX - does this apply to reassembly heads? */
  77         guint32 len;    /* XXX - does this apply to reassembly heads? */
  78         guint32 fragment_nr_offset; /* offset for frame numbering, for sequences, where the
  79                                      * provided fragment number of the first fragment does
  80                                      * not start with 0
  81                                      * XXX - does this apply only to reassembly heads? */
  82         guint32 datalen; /* Only valid in first item of list and when
  83                           * flags&FD_DATALEN_SET is set;
  84                           * number of bytes or (if flags&FD_BLOCKSEQUENCE set)
  85                           * segments in the datagram */
  86         guint32 reassembled_in; /* frame where this PDU was reassembled,
  87                                    only valid in the first item of the list
  88                                    and when FD_DEFRAGMENTED is set*/
  89         guint32 flags;  /* XXX - do some of these apply only to reassembly
  90                            heads and others only to fragments within
  91                            a reassembly? */
  92         tvbuff_t *tvb_data;
  93
  94         /*
  95          * Null if the reassembly had no error; non-null if it had
  96          * an error, in which case it's the string for the error.
  97          *
  98          * XXX - this is wasted in all but the reassembly head; we
  99          * should probably have separate data structures for a
 100          * reassembly and for the fragments in a reassembly.
 101          */
 102         const char *error;
 103 } fragment_item, fragment_head;
 104
 105
 106 /*
 107  * Flags for fragment_add_seq_*
 108  */
 109
 110 /* we don't have any sequence numbers - fragments are assumed to appear in
 111  * order */
 112 #define REASSEMBLE_FLAGS_NO_FRAG_NUMBER         0x0001
 113
 114 /* a special fudge for the 802.11 dissector */
 115 #define REASSEMBLE_FLAGS_802_11_HACK            0x0002
 116
 117 /* causes fragment_add_seq_key to check that all the fragment data is present
 118  * in the tvb, and if not, do something a bit odd. */
 119 #define REASSEMBLE_FLAGS_CHECK_DATA_PRESENT     0x0004
 120
 121 /* a function for creating temporary hash keys */
 122 typedef gpointer (*fragment_temporary_key)(const packet_info *pinfo,
 123     const guint32 id, const void *data);
 124
 125 /* a function for creating persistent hash keys */
 126 typedef gpointer (*fragment_persistent_key)(const packet_info *pinfo,
 127     const guint32 id, const void *data);
 128
 129 /*
 130  * Data structure to keep track of fragments and reassemblies.
 131  */
 132 typedef struct {
 133         GHashTable *fragment_table;
 134         GHashTable *reassembled_table;
 135         fragment_temporary_key temporary_key_func;
 136         fragment_persistent_key persistent_key_func;
 137         GDestroyNotify free_temporary_key_func;         /* temporary key destruction function */
 138 } reassembly_table;
 139
 140 /*
 141  * Table of functions for a reassembly table.
 142  */
 143 typedef struct {
 144         /* Functions for fragment table */
 145         GHashFunc hash_func;                            /* hash function */
 146         GEqualFunc equal_func;                          /* comparison function */
 147         fragment_temporary_key temporary_key_func;      /* temporary key creation function */
 148         fragment_persistent_key persistent_key_func;    /* persistent key creation function */
 149         GDestroyNotify free_temporary_key_func;         /* temporary key destruction function */
 150         GDestroyNotify free_persistent_key_func;        /* persistent key destruction function */
 151 } reassembly_table_functions;
 152
 153 /*
 154  * Tables of functions exported for the benefit of dissectors that
 155  * don't need special items in their keys.
 156  */
 157 WS_DLL_PUBLIC const reassembly_table_functions
 158         addresses_reassembly_table_functions;           /* keys have endpoint addresses and an ID */
 159 WS_DLL_PUBLIC const reassembly_table_functions
 160         addresses_ports_reassembly_table_functions;     /* keys have endpoint addresses and ports and an ID */
 161
 162 /*
 163  * Initialize/destroy a reassembly table.
 164  *
 165  * init: If table doesn't exist: create table;
 166  *       else: just remove any entries;
 167  * destroy: remove entries and destroy table;
 168  */
 169 WS_DLL_PUBLIC void
 170 reassembly_table_init(reassembly_table *table,
 171                       const reassembly_table_functions *funcs);
 172 WS_DLL_PUBLIC void
 173 reassembly_table_destroy(reassembly_table *table);
 174
 175 /*
 176  * This function adds a new fragment to the reassembly table
 177  * If this is the first fragment seen for this datagram, a new entry
 178  * is created in the table, otherwise this fragment is just added
 179  * to the linked list of fragments for this packet.
 180  * The list of fragments for a specific datagram is kept sorted for
 181  * easier handling.
 182  *
 183  * Returns a pointer to the head of the fragment data list if we have all the
 184  * fragments, NULL otherwise.
 185  */
 186 WS_DLL_PUBLIC fragment_head *
 187 fragment_add(reassembly_table *table, tvbuff_t *tvb, const int offset,
 188              const packet_info *pinfo, const guint32 id, const void *data,
 189              const guint32 frag_offset, const guint32 frag_data_len,
 190              const gboolean more_frags);
 191 WS_DLL_PUBLIC fragment_head *
 192 fragment_add_multiple_ok(reassembly_table *table, tvbuff_t *tvb,
 193                          const int offset, const packet_info *pinfo,
 194                          const guint32 id, const void *data,
 195                          const guint32 frag_offset,
 196                          const guint32 frag_data_len,
 197                          const gboolean more_frags);
 198
 199 /*
 200  * This routine extends fragment_add to use a "reassembled_table"
 201  * included in the reassembly table.
 202  *
 203  * If, after processing this fragment, we have all the fragments, they
 204  * remove that from the fragment hash table if necessary and add it
 205  * to the table of reassembled fragments, and return a pointer to the
 206  * head of the fragment list.
 207  */
 208 WS_DLL_PUBLIC fragment_head *
 209 fragment_add_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
 210                    const packet_info *pinfo, const guint32 id,
 211                    const void *data, const guint32 frag_offset,
 212                    const guint32 frag_data_len, const gboolean more_frags);
 213
 214 /* same as fragment_add() but this one assumes frag_number is a block
 215    sequence number. note that frag_number is 0 for the first fragment. */
 216
 217 /*
 218  * These functions add a new fragment to the fragment hash table,
 219  * assuming that frag_number is a block sequence number (starting from zero for
 220  * the first fragment of each datagram).
 221  *
 222  * If this is the first fragment seen for this datagram, a new
 223  * "fragment_head" structure is allocated to refer to the reassembled
 224  * packet, and:
 225  *
 226  *      if "more_frags" is false, and either we have no sequence numbers, or
 227  *      are using the 802.11 hack, it is assumed that this is the only fragment
 228  *      in the datagram. The structure is not added to the hash
 229  *      table, and not given any fragments to refer to, but is just returned.
 230  *
 231  *      In this latter case reassembly wasn't done (since there was only one
 232  *      fragment in the packet); dissectors can check the 'next' pointer on the
 233  *      returned list to see if this case was hit or not.
 234  *
 235  * Otherwise, this fragment is just added to the linked list of fragments
 236  * for this packet; the fragment_item is also added to the fragment hash if
 237  * necessary.
 238  *
 239  * If this packet completes assembly, these functions return the head of the
 240  * fragment data; otherwise, they return null.
 241  */
 242 WS_DLL_PUBLIC fragment_head *
 243 fragment_add_seq(reassembly_table *table, tvbuff_t *tvb, const int offset,
 244                  const packet_info *pinfo, const guint32 id, const void *data,
 245                  const guint32 frag_number, const guint32 frag_data_len,
 246                  const gboolean more_frags, const guint32 flags);
 247
 248 /*
 249  * These routines extend fragment_add_seq to use the "reassembled_table".
 250  *
 251  * If, after processing this fragment, we have all the fragments, they
 252  * remove that from the fragment hash table if necessary and add it
 253  * to the table of reassembled fragments, and return a pointer to the
 254  * head of the fragment list.
 255  */
 256 WS_DLL_PUBLIC fragment_head *
 257 fragment_add_seq_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
 258                        const packet_info *pinfo, const guint32 id,
 259                        const void *data,
 260                        const guint32 frag_number, const guint32 frag_data_len,
 261                        const gboolean more_frags);
 262
 263 WS_DLL_PUBLIC fragment_head *
 264 fragment_add_seq_802_11(reassembly_table *table, tvbuff_t *tvb,
 265                         const int offset, const packet_info *pinfo,
 266                         const guint32 id, const void *data,
 267                         const guint32 frag_number, const guint32 frag_data_len,
 268                         const gboolean more_frags);
 269
 270 WS_DLL_PUBLIC fragment_head *
 271 fragment_add_seq_next(reassembly_table *table, tvbuff_t *tvb, const int offset,
 272                       const packet_info *pinfo, const guint32 id,
 273                       const void *data, const guint32 frag_data_len,
 274                       const gboolean more_frags);
 275
 276 WS_DLL_PUBLIC void
 277 fragment_start_seq_check(reassembly_table *table, const packet_info *pinfo,
 278                          const guint32 id, const void *data,
 279                          const guint32 tot_len);
 280
 281 WS_DLL_PUBLIC fragment_head *
 282 fragment_end_seq_next(reassembly_table *table, const packet_info *pinfo,
 283                       const guint32 id, const void *data);
 284
 285 /* To specify the offset for the fragment numbering, the first fragment is added with 0, and
 286  * afterwards this offset is set. All additional calls to off_seq_check will calculate
 287  * the number in sequence in regards to the offset */
 288 WS_DLL_PUBLIC void
 289 fragment_add_seq_offset(reassembly_table *table, const packet_info *pinfo, const guint32 id,
 290                     const void *data, const guint32 fragment_offset);
 291
 292 /* to specify how much to reassemble, for fragmentation where last fragment can not be
 293  * identified by flags or such.
 294  * note that for FD_BLOCKSEQUENCE tot_len is the index for the tail fragment.
 295  * i.e. since the block numbers start at 0, if we specify tot_len==2, that
 296  * actually means we want to defragment 3 blocks, block 0, 1 and 2.
 297  *
 298  */
 299 WS_DLL_PUBLIC void
 300 fragment_set_tot_len(reassembly_table *table, const packet_info *pinfo,
 301                      const guint32 id, const void *data, const guint32 tot_len);
 302
 303 /* to resad whatever totlen previously set */
 304 WS_DLL_PUBLIC guint32
 305 fragment_get_tot_len(reassembly_table *table, const packet_info *pinfo,
 306                      const guint32 id, const void *data);
 307
 308 /*
 309  * This function will set the partial reassembly flag(FD_PARTIAL_REASSEMBLY) for a fh.
 310  * When this function is called, the fh MUST already exist, i.e.
 311  * the fh MUST be created by the initial call to fragment_add() before
 312  * this function is called. Also note that this function MUST be called to indicate
 313  * a fh will be extended (increase the already stored data). After calling this function,
 314  * and if FD_DEFRAGMENTED is set, the reassembly process will be continued.
 315  */
 316 WS_DLL_PUBLIC void
 317 fragment_set_partial_reassembly(reassembly_table *table,
 318                                 const packet_info *pinfo, const guint32 id,
 319                                 const void *data);
 320
 321 /* This function is used to check if there is partial or completed reassembly state
 322  * matching this packet. I.e. Are there reassembly going on or not for this packet?
 323  */
 324 WS_DLL_PUBLIC fragment_head *
 325 fragment_get(reassembly_table *table, const packet_info *pinfo,
 326              const guint32 id, const void *data);
 327
 328 /* The same for the reassemble table */
 329 /* id *must* be the frame number for this to work! */
 330 WS_DLL_PUBLIC fragment_head *
 331 fragment_get_reassembled(reassembly_table *table, const guint32 id);
 332
 333 WS_DLL_PUBLIC fragment_head *
 334 fragment_get_reassembled_id(reassembly_table *table, const packet_info *pinfo,
 335                             const guint32 id);
 336
 337 /* This will free up all resources and delete reassembly state for this PDU.
 338  * Except if the PDU is completely reassembled, then it would NOT deallocate the
 339  * buffer holding the reassembled data but instead return the TVB
 340  *
 341  * So, if you call fragment_delete and it returns non-NULL, YOU are responsible to
 342  * tvb_free() .
 343  */
 344 WS_DLL_PUBLIC tvbuff_t *
 345 fragment_delete(reassembly_table *table, const packet_info *pinfo,
 346                 const guint32 id, const void *data);
 347
 348 /* This struct holds references to all the tree and field handles used when
 349  * displaying the reassembled fragment tree in the packet details view. A
 350  * dissector will populate this structure with its own tree and field handles
 351  * and then invoke show_fragement_tree to have those items added to the packet
 352  * details tree.
 353  */
 354 typedef struct _fragment_items {
 355     gint       *ett_fragment;
 356     gint       *ett_fragments;
 357
 358     int        *hf_fragments;                  /* FT_NONE     */
 359     int        *hf_fragment;                   /* FT_FRAMENUM */
 360     int        *hf_fragment_overlap;           /* FT_BOOLEAN  */
 361     int        *hf_fragment_overlap_conflict;  /* FT_BOOLEAN  */
 362     int        *hf_fragment_multiple_tails;    /* FT_BOOLEAN  */
 363     int        *hf_fragment_too_long_fragment; /* FT_BOOLEAN  */
 364     int        *hf_fragment_error;             /* FT_FRAMENUM */
 365     int        *hf_fragment_count;             /* FT_UINT32   */
 366     int        *hf_reassembled_in;             /* FT_FRAMENUM */
 367     int        *hf_reassembled_length;         /* FT_UINT32   */
 368     int        *hf_reassembled_data;           /* FT_BYTES    */
 369
 370     const char *tag;
 371 } fragment_items;
 372
 373 WS_DLL_PUBLIC tvbuff_t *
 374 process_reassembled_data(tvbuff_t *tvb, const int offset, packet_info *pinfo,
 375     const char *name, fragment_head *fd_head, const fragment_items *fit,
 376     gboolean *update_col_infop, proto_tree *tree);
 377
 378 WS_DLL_PUBLIC gboolean
 379 show_fragment_tree(fragment_head *ipfd_head, const fragment_items *fit,
 380     proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);
 381
 382 WS_DLL_PUBLIC gboolean
 383 show_fragment_seq_tree(fragment_head *ipfd_head, const fragment_items *fit,
 384     proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);
 385
 386 #endif