Wireshark 2.9.0-477-g68ec514b The Wireshark network protocol analyzer

- Main Page
- Related Pages
- Modules
- Namespaces
- Classes
- Files

- File List
- File Members

reassemble.h
1 /* reassemble.h
2 * Declarations of routines for {fragment,segment} reassembly
3 *
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998 Gerald Combs
7 *
8 * SPDX-License-Identifier: GPL-2.0-or-later
9 */
10
11 /* make sure that all flags that are set in a fragment entry is also set for
12 * the flags field of fd_head !!!
13 */
14
15 #ifndef REASSEMBLE_H
16 #define REASSEMBLE_H
17
18 #include "ws_symbol_export.h"
19
20 /* only in fd_head: packet is defragmented */
21 #define FD_DEFRAGMENTED 0x0001
22
23 /* there are overlapping fragments */
24 #define FD_OVERLAP 0x0002
25
26 /* overlapping fragments contain different data */
27 #define FD_OVERLAPCONFLICT 0x0004
28
29 /* more than one fragment which indicates end-of data */
30 #define FD_MULTIPLETAILS 0x0008
31
32 /* fragment starts before the end of the datagram but extends
33 past the end of the datagram */
34 #define FD_TOOLONGFRAGMENT 0x0010
35
36 /* fragment tvb is subset, don't tvb_free() it */
37 #define FD_SUBSET_TVB 0x0020
38
39 /* this flag is used to request fragment_add to continue the reassembly process */
40 #define FD_PARTIAL_REASSEMBLY 0x0040
41
42 /* fragment offset is indicated by sequence number and not byte offset
43 into the defragmented packet */
44 #define FD_BLOCKSEQUENCE 0x0100
45
46 /* This flag is set in (only) fd_head to denote that datalen has been set to a valid value.
47 * It's implied by FD_DEFRAGMENTED (we must know the total length of the
48 * datagram if we have defragmented it...)
49 */
50 #define FD_DATALEN_SET 0x0400
51
52 typedef struct _fragment_item {
53 struct _fragment_item *next;
54 guint32 frame; /* XXX - does this apply to reassembly heads? */
55 guint32 offset; /* XXX - does this apply to reassembly heads? */
56 guint32 len; /* XXX - does this apply to reassembly heads? */
57 guint32 fragment_nr_offset;
61 guint32 datalen;
67 guint32 reassembled_in;
70 guint8 reas_in_layer_num;
73 guint32 flags;
76 tvbuff_t *tvb_data;
85 const char *error;
86 } fragment_item, fragment_head;
87
88
89 /*
90 * Flags for fragment_add_seq_*
91 */
92
93 /* we don't have any sequence numbers - fragments are assumed to appear in
94 * order */
95 #define REASSEMBLE_FLAGS_NO_FRAG_NUMBER 0x0001
96
97 /* a special fudge for the 802.11 dissector */
98 #define REASSEMBLE_FLAGS_802_11_HACK 0x0002
99
100 /*
101 * Flags for fragment_add_seq_single_*
102 */
103
104 /* we want to age off old packets */
105 #define REASSEMBLE_FLAGS_AGING 0x0001
106
107 /*
108 * Generates a fragment identifier based on the given parameters. "data" is an
109 * opaque type whose interpretation is up to the caller of fragment_add*
110 * functions and the fragment key function (possibly NULL if you do not care).
111 *
112 * Keys returned by this function are only used within this packet scope.
113 */
114 typedef gpointer (*fragment_temporary_key)(const packet_info *pinfo,
115 const guint32 id, const void *data);
116
117 /*
118 * Like fragment_temporary_key, but used for identifying reassembled fragments
119 * which may persist through multiple packets.
120 */
121 typedef gpointer (*fragment_persistent_key)(const packet_info *pinfo,
122 const guint32 id, const void *data);
123
124 /*
125 * Data structure to keep track of fragments and reassemblies.
126 */
127 typedef struct {
128 GHashTable *fragment_table;
129 GHashTable *reassembled_table;
130 fragment_temporary_key temporary_key_func;
131 fragment_persistent_key persistent_key_func;
132 GDestroyNotify free_temporary_key_func; /* temporary key destruction function */
133 } reassembly_table;
134
135 /*
136 * Table of functions for a reassembly table.
137 */
138 typedef struct {
139 /* Functions for fragment table */
140 GHashFunc hash_func; /* hash function */
141 GEqualFunc equal_func; /* comparison function */
142 fragment_temporary_key temporary_key_func; /* temporary key creation function */
143 fragment_persistent_key persistent_key_func; /* persistent key creation function */
144 GDestroyNotify free_temporary_key_func; /* temporary key destruction function */
145 GDestroyNotify free_persistent_key_func; /* persistent key destruction function */
146 } reassembly_table_functions;
147
148 /*
149 * Tables of functions exported for the benefit of dissectors that
150 * don't need special items in their keys.
151 */
152 WS_DLL_PUBLIC const reassembly_table_functions
153 addresses_reassembly_table_functions; /* keys have endpoint addresses and an ID */
154 WS_DLL_PUBLIC const reassembly_table_functions
155 addresses_ports_reassembly_table_functions; /* keys have endpoint addresses and ports and an ID */
156
157 /*
158 * Register a reassembly table. By registering the table with epan, the creation and
159 * destruction of the table can be managed by epan and not the dissector.
160 */
161 WS_DLL_PUBLIC void
162 reassembly_table_register(reassembly_table *table,
163 const reassembly_table_functions *funcs);
164
165 /*
166 * Initialize/destroy a reassembly table.
167 *
168 * init: If table doesn't exist: create table;
169 * else: just remove any entries;
170 * destroy: remove entries and destroy table;
171 */
172 WS_DLL_PUBLIC void
173 reassembly_table_init(reassembly_table *table,
174 const reassembly_table_functions *funcs);
175 WS_DLL_PUBLIC void
176 reassembly_table_destroy(reassembly_table *table);
177
178 /*
179 * This function adds a new fragment to the reassembly table
180 * If this is the first fragment seen for this datagram, a new entry
181 * is created in the table, otherwise this fragment is just added
182 * to the linked list of fragments for this packet.
183 * The list of fragments for a specific datagram is kept sorted for
184 * easier handling.
185 *
186 * Datagrams (messages) are identified by a key generated by
187 * fragment_temporary_key or fragment_persistent_key, based on the "pinfo", "id"
188 * and "data" pairs. (This is the sole purpose of "data".)
189 *
190 * Fragments are identified by "frag_offset".
191 *
192 * Returns a pointer to the head of the fragment data list if we have all the
193 * fragments, NULL otherwise. Note that the reassembled fragments list may have
194 * a non-zero fragment offset, the only guarantee is that no gaps exist within
195 * the list.
196 */
197 WS_DLL_PUBLIC fragment_head *
198 fragment_add(reassembly_table *table, tvbuff_t *tvb, const int offset,
199 const packet_info *pinfo, const guint32 id, const void *data,
200 const guint32 frag_offset, const guint32 frag_data_len,
201 const gboolean more_frags);
202 /*
203 * Like fragment_add, except that the fragment may be added to multiple
204 * reassembly tables. This is needed when multiple protocol layers try
205 * to add the same packet to the reassembly table.
206 */
207 WS_DLL_PUBLIC fragment_head *
208 fragment_add_multiple_ok(reassembly_table *table, tvbuff_t *tvb,
209 const int offset, const packet_info *pinfo,
210 const guint32 id, const void *data,
211 const guint32 frag_offset,
212 const guint32 frag_data_len,
213 const gboolean more_frags);
214
215 /*
216 * Like fragment_add, but maintains a table for completed reassemblies.
217 *
218 * If the packet was seen before, return the head of the fully reassembled
219 * fragments list (NULL if there was none).
220 *
221 * Otherwise (if reassembly was not possible before), try to to add the new
222 * fragment to the fragments table. If reassembly is now possible, remove all
223 * (reassembled) fragments from the fragments table and store it as a completed
224 * reassembly. The head of this reassembled fragments list is returned.
225 *
226 * Otherwise (if reassembly is still not possible after adding this fragment),
227 * return NULL.
228 */
229 WS_DLL_PUBLIC fragment_head *
230 fragment_add_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
231 const packet_info *pinfo, const guint32 id,
232 const void *data, const guint32 frag_offset,
233 const guint32 frag_data_len, const gboolean more_frags);
234
235 /*
236 * Like fragment_add, but fragments have a block sequence number starting from
237 * zero (for the first fragment of each datagram). This differs from
238 * fragment_add for which the fragment may start at any offset.
239 *
240 * If this is the first fragment seen for this datagram, a new
241 * "fragment_head" structure is allocated to refer to the reassembled
242 * packet, and:
243 *
244 * if "more_frags" is false, and either we have no sequence numbers, or
245 * are using the 802.11 hack (via fragment_add_seq_802_11), it is assumed that
246 * this is the only fragment in the datagram. The structure is not added to the
247 * hash table, and not given any fragments to refer to, but is just returned.
248 *
249 * In this latter case reassembly wasn't done (since there was only one
250 * fragment in the packet); dissectors can check the 'next' pointer on the
251 * returned list to see if this case was hit or not.
252 *
253 * Otherwise, this fragment is just added to the linked list of fragments
254 * for this packet; the fragment_item is also added to the fragment hash if
255 * necessary.
256 *
257 * If this packet completes assembly, these functions return the head of the
258 * fragment data; otherwise, they return null.
259 */
260 WS_DLL_PUBLIC fragment_head *
261 fragment_add_seq(reassembly_table *table, tvbuff_t *tvb, const int offset,
262 const packet_info *pinfo, const guint32 id, const void *data,
263 const guint32 frag_number, const guint32 frag_data_len,
264 const gboolean more_frags, const guint32 flags);
265
266 /*
267 * Like fragment_add_seq, but maintains a table for completed reassemblies
268 * just like fragment_add_check.
269 */
270 WS_DLL_PUBLIC fragment_head *
271 fragment_add_seq_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
272 const packet_info *pinfo, const guint32 id,
273 const void *data,
274 const guint32 frag_number, const guint32 frag_data_len,
275 const gboolean more_frags);
276
277 /*
278 * Like fragment_add_seq_check, but immediately returns a fragment list for a
279 * new fragment. This is a workaround specific for the 802.11 dissector, do not
280 * use it elsewhere.
281 */
282 WS_DLL_PUBLIC fragment_head *
283 fragment_add_seq_802_11(reassembly_table *table, tvbuff_t *tvb,
284 const int offset, const packet_info *pinfo,
285 const guint32 id, const void *data,
286 const guint32 frag_number, const guint32 frag_data_len,
287 const gboolean more_frags);
288
289 /*
290 * Like fragment_add_seq_check, but without explicit fragment number. Fragments
291 * are simply appended until no "more_frags" is false.
292 */
293 WS_DLL_PUBLIC fragment_head *
294 fragment_add_seq_next(reassembly_table *table, tvbuff_t *tvb, const int offset,
295 const packet_info *pinfo, const guint32 id,
296 const void *data, const guint32 frag_data_len,
297 const gboolean more_frags);
298
299 /*
300 * Like fragment_add_seq_check, but for protocols like PPP MP with a single
301 * sequence number that increments for each fragment, thus acting like the sum
302 * of the PDU sequence number and explicit fragment number in other protocols.
303 * See Appendix A of RFC 4623 (PWE3 Fragmentation and Reassembly) for a list
304 * of protocols that use this style, including PPP MP (RFC 1990), PWE3 MPLS
305 * (RFC 4385), L2TPv2 (RFC 2661), L2TPv3 (RFC 3931), ATM, and Frame Relay.
306 * It is guaranteed to reassemble a packet split up to "max_frags" in size,
307 * but may manage to reassemble more in certain cases.
308 */
309 WS_DLL_PUBLIC fragment_head *
310 fragment_add_seq_single(reassembly_table *table, tvbuff_t *tvb,
311 const int offset, const packet_info *pinfo, const guint32 id,
312 const void* data, const guint32 frag_data_len,
313 const gboolean first, const gboolean last,
314 const guint32 max_frags);
315
316 /*
317 * A variation on the above that ages off fragments that have not been
318 * reassembled. Useful if the sequence number loops to deal with leftover
319 * fragments from the beginning of the capture or missing fragments.
320 */
321 WS_DLL_PUBLIC fragment_head *
322 fragment_add_seq_single_aging(reassembly_table *table, tvbuff_t *tvb,
323 const int offset, const packet_info *pinfo, const guint32 id,
324 const void* data, const guint32 frag_data_len,
325 const gboolean first, const gboolean last,
326 const guint32 max_frags, const guint32 max_age);
327
328 /*
329 * Start a reassembly, expecting "tot_len" as the number of given fragments (not
330 * the number of bytes). Data can be added later using fragment_add_seq_check.
331 */
332 WS_DLL_PUBLIC void
333 fragment_start_seq_check(reassembly_table *table, const packet_info *pinfo,
334 const guint32 id, const void *data,
335 const guint32 tot_len);
336
337 /*
338 * Mark end of reassembly and returns the reassembled fragment (if completed).
339 * Use it when fragments were added with "more_flags" set while you discovered
340 * that no more fragments have to be added.
341 * XXX rename to fragment_finish as it works also for fragment_add?
342 */
343 WS_DLL_PUBLIC fragment_head *
344 fragment_end_seq_next(reassembly_table *table, const packet_info *pinfo,
345 const guint32 id, const void *data);
346
347 /* To specify the offset for the fragment numbering, the first fragment is added with 0, and
348 * afterwards this offset is set. All additional calls to off_seq_check will calculate
349 * the number in sequence in regards to the offset */
350 WS_DLL_PUBLIC void
351 fragment_add_seq_offset(reassembly_table *table, const packet_info *pinfo, const guint32 id,
352 const void *data, const guint32 fragment_offset);
353
354 /*
355 * Sets the expected index for the last block (for fragment_add_seq functions)
356 * or the expected number of bytes (for fragment_add functions). A reassembly
357 * must already have started.
358 *
359 * Note that for FD_BLOCKSEQUENCE tot_len is the index for the tail fragment.
360 * i.e. since the block numbers start at 0, if we specify tot_len==2, that
361 * actually means we want to defragment 3 blocks, block 0, 1 and 2.
362 */
363 WS_DLL_PUBLIC void
364 fragment_set_tot_len(reassembly_table *table, const packet_info *pinfo,
365 const guint32 id, const void *data, const guint32 tot_len);
366
367 /*
368 * Return the expected index for the last block (for fragment_add_seq functions)
369 * or the expected number of bytes (for fragment_add functions).
370 */
371 WS_DLL_PUBLIC guint32
372 fragment_get_tot_len(reassembly_table *table, const packet_info *pinfo,
373 const guint32 id, const void *data);
374
375 /*
376 * This function will set the partial reassembly flag(FD_PARTIAL_REASSEMBLY) for a fh.
377 * When this function is called, the fh MUST already exist, i.e.
378 * the fh MUST be created by the initial call to fragment_add() before
379 * this function is called. Also note that this function MUST be called to indicate
380 * a fh will be extended (increase the already stored data). After calling this function,
381 * and if FD_DEFRAGMENTED is set, the reassembly process will be continued.
382 */
383 WS_DLL_PUBLIC void
384 fragment_set_partial_reassembly(reassembly_table *table,
385 const packet_info *pinfo, const guint32 id,
386 const void *data);
387
388 /* This function is used to check if there is partial or completed reassembly state
389 * matching this packet. I.e. Are there reassembly going on or not for this packet?
390 */
391 WS_DLL_PUBLIC fragment_head *
392 fragment_get(reassembly_table *table, const packet_info *pinfo,
393 const guint32 id, const void *data);
394
395 /* The same for the reassemble table */
396 /* id *must* be the frame number for this to work! */
397 WS_DLL_PUBLIC fragment_head *
398 fragment_get_reassembled(reassembly_table *table, const guint32 id);
399
400 WS_DLL_PUBLIC fragment_head *
401 fragment_get_reassembled_id(reassembly_table *table, const packet_info *pinfo,
402 const guint32 id);
403
404 /* This will free up all resources and delete reassembly state for this PDU.
405 * Except if the PDU is completely reassembled, then it would NOT deallocate the
406 * buffer holding the reassembled data but instead return the TVB
407 *
408 * So, if you call fragment_delete and it returns non-NULL, YOU are responsible to
409 * tvb_free() .
410 */
411 WS_DLL_PUBLIC tvbuff_t *
412 fragment_delete(reassembly_table *table, const packet_info *pinfo,
413 const guint32 id, const void *data);
414
415 /* This struct holds references to all the tree and field handles used when
416 * displaying the reassembled fragment tree in the packet details view. A
417 * dissector will populate this structure with its own tree and field handles
418 * and then invoke show_fragement_tree to have those items added to the packet
419 * details tree.
420 */
421 typedef struct _fragment_items {
422 gint *ett_fragment;
423 gint *ett_fragments;
424
425 int *hf_fragments; /* FT_NONE */
426 int *hf_fragment; /* FT_FRAMENUM */
427 int *hf_fragment_overlap; /* FT_BOOLEAN */
428 int *hf_fragment_overlap_conflict; /* FT_BOOLEAN */
429 int *hf_fragment_multiple_tails; /* FT_BOOLEAN */
430 int *hf_fragment_too_long_fragment; /* FT_BOOLEAN */
431 int *hf_fragment_error; /* FT_FRAMENUM */
432 int *hf_fragment_count; /* FT_UINT32 */
433 int *hf_reassembled_in; /* FT_FRAMENUM */
434 int *hf_reassembled_length; /* FT_UINT32 */
435 int *hf_reassembled_data; /* FT_BYTES */
436
437 const char *tag;
438 } fragment_items;
439
440 WS_DLL_PUBLIC tvbuff_t *
441 process_reassembled_data(tvbuff_t *tvb, const int offset, packet_info *pinfo,
442 const char *name, fragment_head *fd_head, const fragment_items *fit,
443 gboolean *update_col_infop, proto_tree *tree);
444
445 WS_DLL_PUBLIC gboolean
446 show_fragment_tree(fragment_head *ipfd_head, const fragment_items *fit,
447 proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);
448
449 WS_DLL_PUBLIC gboolean
450 show_fragment_seq_tree(fragment_head *ipfd_head, const fragment_items *fit,
451 proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);
452
453 /* Initialize internal structures
454 */
455 extern void reassembly_tables_init(void);
456
457 /* Cleanup internal structures
458 */
459 extern void
460 reassembly_table_cleanup(void);
461
462 #endif
_fragment_items
Definition: reassemble.h:421
_packet_info
Definition: packet_info.h:44
reassembly_table
Definition: reassemble.h:127
tvbuff
Definition: tvbuff-int.h:35
_fragment_item::flags
guint32 flags
Definition: reassemble.h:73
reassembly_table_functions
Definition: reassemble.h:138
_fragment_item::reassembled_in
guint32 reassembled_in
Definition: reassemble.h:67
_fragment_item::error
const char * error
Definition: reassemble.h:85
_fragment_item
Definition: reassemble.h:52
_fragment_item::fragment_nr_offset
guint32 fragment_nr_offset
Definition: reassemble.h:57
_fragment_item::reas_in_layer_num
guint8 reas_in_layer_num
Definition: reassemble.h:70
_proto_node
Definition: proto.h:759
_fragment_item::datalen
guint32 datalen
Definition: reassemble.h:61