| Wireshark 4.7.0 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
reassemble.h
Go to the documentation of this file.
1
11/* make sure that all flags that are set in a fragment entry is also set for
12 * the flags field of fd_head !!!
13 */
14
15#ifndef REASSEMBLE_H
16#define REASSEMBLE_H
17
18#include <epan/packet_info.h>
19#include <epan/proto.h>
20#include "ws_symbol_export.h"
21
22#ifdef __cplusplus
23 extern "C" {
24#endif
25
26/* in fd_head: packet is defragmented
27 * in item: this item was used in defragmentation
28 * (An item can have this set when the head does not if defragmentation
29 * was reset due to changing the total length or partial reassembly.)
30 */
31#define FD_DEFRAGMENTED 0x0001
32
33/* there are overlapping fragments */
34#define FD_OVERLAP 0x0002
35
36/* overlapping fragments contain different data */
37#define FD_OVERLAPCONFLICT 0x0004
38
39/* more than one fragment which indicates end-of data */
40#define FD_MULTIPLETAILS 0x0008
41
42/* fragment starts before the end of the datagram but extends
43 past the end of the datagram */
44#define FD_TOOLONGFRAGMENT 0x0010
45
46/* fragment tvb is subset, don't tvb_free() it */
47#define FD_SUBSET_TVB 0x0020
48
49/* this flag is used to request fragment_add to continue the reassembly process */
50#define FD_PARTIAL_REASSEMBLY 0x0040
51
52/* fragment offset is indicated by sequence number and not byte offset
53 into the defragmented packet */
54#define FD_BLOCKSEQUENCE 0x0100
55
56/* This flag is set in (only) fd_head to denote that datalen has been set to a valid value.
57 * It's implied by FD_DEFRAGMENTED (we must know the total length of the
58 * datagram if we have defragmented it...)
59 */
60#define FD_DATALEN_SET 0x0400
61
62 struct dissector_handle;
63
64 typedef struct _fragment_item {
65 struct _fragment_item *next;
66 uint32_t frame;
67 uint32_t offset;
69 uint32_t len;
70 uint32_t flags;
73 tvbuff_t *tvb_data;
74} fragment_item;
75
76 typedef struct _fragment_head {
77 struct _fragment_item *next;
78 struct _fragment_item *first_gap;
80 unsigned ref_count;
81 uint32_t contiguous_len;
82 uint32_t frame;
83 uint32_t len;
86 uint32_t fragment_nr_offset;
89 uint32_t datalen;
95 uint32_t reassembled_in;
97 uint8_t reas_in_layer_num;
101 uint32_t flags;
104 tvbuff_t *tvb_data;
109 const char *error;
110} fragment_head;
111
112/*
113 * Flags for fragment_add_seq_*
114 */
115
116/* we don't have any sequence numbers - fragments are assumed to appear in
117 * order */
118#define REASSEMBLE_FLAGS_NO_FRAG_NUMBER 0x0001
119
120/* a special fudge for the 802.11 dissector */
121#define REASSEMBLE_FLAGS_802_11_HACK 0x0002
122
123/*
124 * Flags for fragment_add_seq_single_*
125 */
126
127/* we want to age off old packets */
128#define REASSEMBLE_FLAGS_AGING 0x0001
129
130/*
131 * Generates a fragment identifier based on the given parameters. "data" is an
132 * opaque type whose interpretation is up to the caller of fragment_add*
133 * functions and the fragment key function (possibly NULL if you do not care).
134 *
135 * Keys returned by this function are only used within this packet scope.
136 */
137 typedef void * (*fragment_temporary_key)(const packet_info *pinfo,
138 const uint32_t id, const void *data);
139
140/*
141 * Like fragment_temporary_key, but used for identifying reassembled fragments
142 * which may persist through multiple packets.
143 */
144 typedef void * (*fragment_persistent_key)(const packet_info *pinfo,
145 const uint32_t id, const void *data);
146
147/*
148 * Data structure to keep track of fragments and reassemblies.
149 */
150 typedef struct {
151 GHashTable *fragment_table;
152 GHashTable *reassembled_table;
153 fragment_temporary_key temporary_key_func;
154 fragment_persistent_key persistent_key_func;
155 GDestroyNotify free_temporary_key_func; /* temporary key destruction function */
156} reassembly_table;
157
158/*
159 * Table of functions for a reassembly table.
160 */
161 typedef struct {
162 /* Functions for fragment table */
163 GHashFunc hash_func; /* hash function */
164 GEqualFunc equal_func; /* comparison function */
165 fragment_temporary_key temporary_key_func; /* temporary key creation function */
166 fragment_persistent_key persistent_key_func; /* persistent key creation function */
167 GDestroyNotify free_temporary_key_func; /* temporary key destruction function */
168 GDestroyNotify free_persistent_key_func; /* persistent key destruction function */
169} reassembly_table_functions;
170
171/*
172 * Tables of functions exported for the benefit of dissectors that
173 * don't need special items in their keys.
174 */
175WS_DLL_PUBLIC const reassembly_table_functions
176 addresses_reassembly_table_functions; /* keys have endpoint addresses and an ID */
177WS_DLL_PUBLIC const reassembly_table_functions
178 addresses_ports_reassembly_table_functions; /* keys have endpoint addresses and ports and an ID */
179
180/*
181 * Register a reassembly table. By registering the table with epan, the creation and
182 * destruction of the table can be managed by epan and not the dissector.
183 */
184WS_DLL_PUBLIC void
185reassembly_table_register(reassembly_table *table,
186 const reassembly_table_functions *funcs);
187
188/*
189 * Initialize/destroy a reassembly table.
190 *
191 * init: If table doesn't exist: create table;
192 * else: just remove any entries;
193 * destroy: remove entries and destroy table;
194 */
195WS_DLL_PUBLIC void
196reassembly_table_init(reassembly_table *table,
197 const reassembly_table_functions *funcs);
198WS_DLL_PUBLIC void
199reassembly_table_destroy(reassembly_table *table);
200
201/*
202 * This function adds a new fragment to the reassembly table
203 * If this is the first fragment seen for this datagram, a new entry
204 * is created in the table, otherwise this fragment is just added
205 * to the linked list of fragments for this packet.
206 * The list of fragments for a specific datagram is kept sorted for
207 * easier handling.
208 *
209 * Datagrams (messages) are identified by a key generated by
210 * fragment_temporary_key or fragment_persistent_key, based on the "pinfo", "id"
211 * and "data" pairs. (This is the sole purpose of "data".)
212 *
213 * Fragments are identified by "frag_offset".
214 *
215 * Returns a pointer to the head of the fragment data list if we have all the
216 * fragments, NULL otherwise. Note that the reassembled fragments list may have
217 * a non-zero fragment offset, the only guarantee is that no gaps exist within
218 * the list.
219 *
220 * @note Reused keys are assumed to refer to the same reassembled message
221 * (i.e., retransmission). If the same "id" is used more than once on a
222 * connection, then "data" and custom reassembly_table_functions should be
223 * used so that the keys hash differently.
224 */
225WS_DLL_PUBLIC fragment_head *
226fragment_add(reassembly_table *table, tvbuff_t *tvb, const int offset,
227 const packet_info *pinfo, const uint32_t id, const void *data,
228 const uint32_t frag_offset, const uint32_t frag_data_len,
229 const bool more_frags);
230/*
231 * Like fragment_add, except that the fragment may be added to multiple
232 * reassembly tables. This is needed when multiple protocol layers try
233 * to add the same packet to the reassembly table.
234 */
235WS_DLL_PUBLIC fragment_head *
236fragment_add_multiple_ok(reassembly_table *table, tvbuff_t *tvb,
237 const int offset, const packet_info *pinfo,
238 const uint32_t id, const void *data,
239 const uint32_t frag_offset,
240 const uint32_t frag_data_len,
241 const bool more_frags);
242
243/*
244 * Like fragment_add, except that the fragment may originate from a frame
245 * other than pinfo->num. For use when you are adding an out of order segment
246 * that arrived in an earlier frame, so that show_fragment_tree will display
247 * the correct fragment numbers.
248 *
249 * This is for protocols like TCP, where the correct reassembly to add a
250 * segment to cannot be determined without processing previous segments
251 * in sequence order, including handing them to subdissectors.
252 *
253 * Note that pinfo is still used to set reassembled_in if we have all the
254 * fragments, so that results on subsequent passes can be the same as the
255 * first pass.
256 */
257WS_DLL_PUBLIC fragment_head *
258fragment_add_out_of_order(reassembly_table *table, tvbuff_t *tvb,
259 const int offset, const packet_info *pinfo,
260 const uint32_t id, const void *data,
261 const uint32_t frag_offset,
262 const uint32_t frag_data_len,
263 const bool more_frags, const uint32_t frag_frame);
264/*
265 * Like fragment_add, but maintains a table for completed reassemblies.
266 *
267 * If the packet was seen before, return the head of the fully reassembled
268 * fragments list (NULL if there was none).
269 *
270 * Otherwise (if reassembly was not possible before), try to add the new
271 * fragment to the fragments table. If reassembly is now possible, remove all
272 * (reassembled) fragments from the fragments table and store it as a completed
273 * reassembly. The head of this reassembled fragments list is returned.
274 *
275 * Otherwise (if reassembly is still not possible after adding this fragment),
276 * return NULL.
277 *
278 * @note Completed reassemblies are removed from the in-progress table, so
279 * key can be reused to begin a new reassembled message. Conversely,
280 * dissectors SHOULD NOT call this with a retransmitted fragment of a
281 * completed reassembly. Dissectors atop a reliable protocol like TCP
282 * may assume that the lower layer dissector handles retransmission,
283 * but other dissectors (e.g., atop UDP or Ethernet) will have to handle
284 * that situation themselves.
285 */
286WS_DLL_PUBLIC fragment_head *
287fragment_add_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
288 const packet_info *pinfo, const uint32_t id,
289 const void *data, const uint32_t frag_offset,
290 const uint32_t frag_data_len, const bool more_frags);
291
292/*
293 * Like fragment_add_check, but handles retransmissions after reassembly.
294 *
295 * Start new reassembly only if there is no reassembly in progress and there
296 * is no completed reassembly reachable from fallback_frame. If there is
297 * completed reassembly (reachable from fallback_frame), simply links this
298 * packet into the list, updating the flags if necessary (however actual data
299 * and reassembled in frame won't be modified).
300 */
301WS_DLL_PUBLIC fragment_head *
302fragment_add_check_with_fallback(reassembly_table *table, tvbuff_t *tvb, const int offset,
303 const packet_info *pinfo, const uint32_t id,
304 const void *data, const uint32_t frag_offset,
305 const uint32_t frag_data_len, const bool more_frags,
306 const uint32_t fallback_frame);
307
308/*
309 * Like fragment_add, but fragments have a block sequence number starting from
310 * zero (for the first fragment of each datagram). This differs from
311 * fragment_add for which the fragment may start at any offset.
312 *
313 * If this is the first fragment seen for this datagram, a new
314 * "fragment_head" structure is allocated to refer to the reassembled
315 * packet, and:
316 *
317 * if "more_frags" is false, and either we have no sequence numbers, or
318 * are using the 802.11 hack (via fragment_add_seq_802_11), it is assumed that
319 * this is the only fragment in the datagram. The structure is not added to the
320 * hash table, and not given any fragments to refer to, but is just returned.
321 *
322 * In this latter case reassembly wasn't done (since there was only one
323 * fragment in the packet); dissectors can check the 'next' pointer on the
324 * returned list to see if this case was hit or not.
325 *
326 * Otherwise, this fragment is just added to the linked list of fragments
327 * for this packet; the fragment_item is also added to the fragment hash if
328 * necessary.
329 *
330 * If this packet completes assembly, these functions return the head of the
331 * fragment data; otherwise, they return null.
332 *
333 * @note Reused keys are assumed to refer to the same reassembled message
334 * (i.e., retransmission). If the same "id" is used more than once on a
335 * connection, then "data" and custom reassembly_table_functions should be
336 * used so that the keys hash differently.
337 */
338WS_DLL_PUBLIC fragment_head *
339fragment_add_seq(reassembly_table *table, tvbuff_t *tvb, const int offset,
340 const packet_info *pinfo, const uint32_t id, const void *data,
341 const uint32_t frag_number, const uint32_t frag_data_len,
342 const bool more_frags, const uint32_t flags);
343
344/*
345 * Like fragment_add_seq, but maintains a table for completed reassemblies
346 * just like fragment_add_check.
347 *
348 * @note Completed reassemblies are removed from the in-progress table, so
349 * key can be reused to begin a new reassembled message. Conversely,
350 * dissectors SHOULD NOT call this with a retransmitted fragment of a
351 * completed reassembly. Dissectors atop a reliable protocol like TCP
352 * may assume that the lower layer dissector handles retransmission,
353 * but other dissectors (e.g., atop UDP or Ethernet) will have to handle
354 * that situation themselves.
355 */
356WS_DLL_PUBLIC fragment_head *
357fragment_add_seq_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
358 const packet_info *pinfo, const uint32_t id,
359 const void *data,
360 const uint32_t frag_number, const uint32_t frag_data_len,
361 const bool more_frags);
362
363/*
364 * Like fragment_add_seq_check, but immediately returns a fragment list for a
365 * new fragment. This is a workaround specific for the 802.11 dissector, do not
366 * use it elsewhere.
367 */
368WS_DLL_PUBLIC fragment_head *
369fragment_add_seq_802_11(reassembly_table *table, tvbuff_t *tvb,
370 const int offset, const packet_info *pinfo,
371 const uint32_t id, const void *data,
372 const uint32_t frag_number, const uint32_t frag_data_len,
373 const bool more_frags);
374
375/*
376 * Like fragment_add_seq_check, but without explicit fragment number. Fragments
377 * are simply appended until no "more_frags" is false.
378 *
379 * @note Out of order fragments will not be reassembled correctly.
380 * Dissectors atop a reliable protocol like TCP may rely on the lower
381 * level dissector reordering out or order segments (if the appropriate
382 * out of order reassembly preference is enabled), but other dissectors
383 * will have to handle out of order fragments themselves, if possible.
384 */
385WS_DLL_PUBLIC fragment_head *
386fragment_add_seq_next(reassembly_table *table, tvbuff_t *tvb, const int offset,
387 const packet_info *pinfo, const uint32_t id,
388 const void *data, const uint32_t frag_data_len,
389 const bool more_frags);
390
391/*
392 * Like fragment_add_seq_check, but for protocols like PPP MP with a single
393 * sequence number that increments for each fragment, thus acting like the sum
394 * of the PDU sequence number and explicit fragment number in other protocols.
395 * See Appendix A of RFC 4623 (PWE3 Fragmentation and Reassembly) for a list
396 * of protocols that use this style, including PPP MP (RFC 1990), PWE3 MPLS
397 * (RFC 4385), L2TPv2 (RFC 2661), L2TPv3 (RFC 3931), ATM, and Frame Relay.
398 * It is guaranteed to reassemble a packet split up to "max_frags" in size,
399 * but may manage to reassemble more in certain cases.
400 */
401WS_DLL_PUBLIC fragment_head *
402fragment_add_seq_single(reassembly_table *table, tvbuff_t *tvb,
403 const int offset, const packet_info *pinfo, const uint32_t id,
404 const void* data, const uint32_t frag_data_len,
405 const bool first, const bool last,
406 const uint32_t max_frags);
407
408/*
409 * A variation on the above that ages off fragments that have not been
410 * reassembled. Useful if the sequence number loops to deal with leftover
411 * fragments from the beginning of the capture or missing fragments.
412 */
413WS_DLL_PUBLIC fragment_head *
414fragment_add_seq_single_aging(reassembly_table *table, tvbuff_t *tvb,
415 const int offset, const packet_info *pinfo, const uint32_t id,
416 const void* data, const uint32_t frag_data_len,
417 const bool first, const bool last,
418 const uint32_t max_frags, const uint32_t max_age);
419
420/*
421 * Start a reassembly, expecting "tot_len" as the number of given fragments (not
422 * the number of bytes). Data can be added later using fragment_add_seq_check.
423 */
424WS_DLL_PUBLIC void
425fragment_start_seq_check(reassembly_table *table, const packet_info *pinfo,
426 const uint32_t id, const void *data,
427 const uint32_t tot_len);
428
429/*
430 * Mark end of reassembly and returns the reassembled fragment (if completed).
431 * Use it when fragments were added with "more_flags" set while you discovered
432 * that no more fragments have to be added.
433 * This is for fragments added with add_seq_next; it doesn't check for gaps,
434 * and doesn't set datalen correctly for the fragment_add family.
435 */
436WS_DLL_PUBLIC fragment_head *
437fragment_end_seq_next(reassembly_table *table, const packet_info *pinfo,
438 const uint32_t id, const void *data);
439
440/* To specify the offset for the fragment numbering, the first fragment is added with 0, and
441 * afterwards this offset is set. All additional calls to off_seq_check will calculate
442 * the number in sequence in regards to the offset */
443WS_DLL_PUBLIC void
444fragment_add_seq_offset(reassembly_table *table, const packet_info *pinfo, const uint32_t id,
445 const void *data, const uint32_t fragment_offset);
446
447/*
448 * Sets the expected index for the last block (for fragment_add_seq functions)
449 * or the expected number of bytes (for fragment_add functions). A reassembly
450 * must already have started.
451 *
452 * Note that for FD_BLOCKSEQUENCE tot_len is the index for the tail fragment.
453 * i.e. since the block numbers start at 0, if we specify tot_len==2, that
454 * actually means we want to defragment 3 blocks, block 0, 1 and 2.
455 */
456WS_DLL_PUBLIC void
457fragment_set_tot_len(reassembly_table *table, const packet_info *pinfo,
458 const uint32_t id, const void *data, const uint32_t tot_len);
459
460/*
461 * Similar to fragment_set_tot_len, it sets the expected number of bytes (for
462 * fragment_add functions) for a previously started reassembly. If the specified
463 * length already matches the reassembled length, then nothing will be done.
464 *
465 * If the fragments were previously reassembled, then this state will be
466 * cleared, allowing new fragments to extend the reassembled result again.
467 */
468WS_DLL_PUBLIC void
469fragment_reset_tot_len(reassembly_table *table, const packet_info *pinfo,
470 const uint32_t id, const void *data, const uint32_t tot_len);
471
472/*
473 * Truncates the size of an already defragmented reassembly to tot_len,
474 * discarding past that point, including splitting any fragments in the
475 * middle as necessary. The specified length must be less than or equal
476 * to the reassembled length. (If it already matches the reassembled length,
477 * then nothing will be done.)
478 *
479 * Used for continuous streams like TCP, where the length of a segment cannot
480 * be determined without first reassembling and handing to a subdissector.
481 */
482WS_DLL_PUBLIC void
483fragment_truncate(reassembly_table *table, const packet_info *pinfo,
484 const uint32_t id, const void *data, const uint32_t tot_len);
485
486/*
487 * Return the expected index for the last block (for fragment_add_seq functions)
488 * or the expected number of bytes (for fragment_add functions).
489 */
490WS_DLL_PUBLIC uint32_t
491fragment_get_tot_len(reassembly_table *table, const packet_info *pinfo,
492 const uint32_t id, const void *data);
493
494/*
495 * This function will set the partial reassembly flag(FD_PARTIAL_REASSEMBLY) for a fh.
496 * When this function is called, the fh MUST already exist, i.e.
497 * the fh MUST be created by the initial call to fragment_add() before
498 * this function is called. Also note that this function MUST be called to indicate
499 * a fh will be extended (increase the already stored data). After calling this function,
500 * and if FD_DEFRAGMENTED is set, the reassembly process will be continued.
501 */
502WS_DLL_PUBLIC void
503fragment_set_partial_reassembly(reassembly_table *table,
504 const packet_info *pinfo, const uint32_t id,
505 const void *data);
506
507/* This function is used to check if there is partial or completed reassembly state
508 * matching this packet. I.e. Are there reassembly going on or not for this packet?
509 */
510WS_DLL_PUBLIC fragment_head *
511fragment_get(reassembly_table *table, const packet_info *pinfo,
512 const uint32_t id, const void *data);
513
514/* The same for the reassemble table */
515WS_DLL_PUBLIC fragment_head *
516fragment_get_reassembled_id(reassembly_table *table, const packet_info *pinfo,
517 const uint32_t id);
518
519/* This will free up all resources and delete reassembly state for this PDU.
520 * Except if the PDU is completely reassembled, then it would NOT deallocate the
521 * buffer holding the reassembled data but instead return the TVB
522 *
523 * So, if you call fragment_delete and it returns non-NULL, YOU are responsible to
524 * tvb_free() .
525 */
526WS_DLL_PUBLIC tvbuff_t *
527fragment_delete(reassembly_table *table, const packet_info *pinfo,
528 const uint32_t id, const void *data);
529
530/* This struct holds references to all the tree and field handles used when
531 * displaying the reassembled fragment tree in the packet details view. A
532 * dissector will populate this structure with its own tree and field handles
533 * and then invoke show_fragment_tree to have those items added to the packet
534 * details tree.
535 */
536 typedef struct _fragment_items {
537 int *ett_fragment;
538 int *ett_fragments;
539
540 int *hf_fragments; /* FT_NONE */
541 int *hf_fragment; /* FT_FRAMENUM */
542 int *hf_fragment_overlap; /* FT_BOOLEAN */
543 int *hf_fragment_overlap_conflict; /* FT_BOOLEAN */
544 int *hf_fragment_multiple_tails; /* FT_BOOLEAN */
545 int *hf_fragment_too_long_fragment; /* FT_BOOLEAN */
546 int *hf_fragment_error; /* FT_FRAMENUM */
547 int *hf_fragment_count; /* FT_UINT32 */
548 int *hf_reassembled_in; /* FT_FRAMENUM */
549 int *hf_reassembled_length; /* FT_UINT32 */
550 int *hf_reassembled_data; /* FT_BYTES */
551
552 const char *tag;
553} fragment_items;
554
555WS_DLL_PUBLIC tvbuff_t *
556process_reassembled_data(tvbuff_t *tvb, const int offset, packet_info *pinfo,
557 const char *name, fragment_head *fd_head, const fragment_items *fit,
558 bool *update_col_infop, proto_tree *tree);
559
560WS_DLL_PUBLIC bool
561show_fragment_tree(fragment_head *ipfd_head, const fragment_items *fit,
562 proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);
563
564WS_DLL_PUBLIC bool
565show_fragment_seq_tree(fragment_head *ipfd_head, const fragment_items *fit,
566 proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);
567
568/* Initialize internal structures
569 */
570 extern void reassembly_tables_init(void);
571
572/* Cleanup internal structures
573 */
574 extern void
575reassembly_table_cleanup(void);
576
577/* ===================== Streaming data reassembly helper ===================== */
604#define REASSEMBLE_ITEMS_DEFINE(var_prefix, name_prefix) \
605 static int ett_##var_prefix##_fragment; \
606 static int ett_##var_prefix##_fragments; \
607 static int hf_##var_prefix##_fragments; \
608 static int hf_##var_prefix##_fragment; \
609 static int hf_##var_prefix##_fragment_overlap; \
610 static int hf_##var_prefix##_fragment_overlap_conflicts; \
611 static int hf_##var_prefix##_fragment_multiple_tails; \
612 static int hf_##var_prefix##_fragment_too_long_fragment; \
613 static int hf_##var_prefix##_fragment_error; \
614 static int hf_##var_prefix##_fragment_count; \
615 static int hf_##var_prefix##_reassembled_in; \
616 static int hf_##var_prefix##_reassembled_length; \
617 static int hf_##var_prefix##_reassembled_data; \
618 static int hf_##var_prefix##_segment; \
619 static const fragment_items var_prefix##_fragment_items = { \
620 &ett_##var_prefix##_fragment, \
621 &ett_##var_prefix##_fragments, \
622 &hf_##var_prefix##_fragments, \
623 &hf_##var_prefix##_fragment, \
624 &hf_##var_prefix##_fragment_overlap, \
625 &hf_##var_prefix##_fragment_overlap_conflicts, \
626 &hf_##var_prefix##_fragment_multiple_tails, \
627 &hf_##var_prefix##_fragment_too_long_fragment, \
628 &hf_##var_prefix##_fragment_error, \
629 &hf_##var_prefix##_fragment_count, \
630 &hf_##var_prefix##_reassembled_in, \
631 &hf_##var_prefix##_reassembled_length, \
632 &hf_##var_prefix##_reassembled_data, \
633 name_prefix " fragments" \
634 }
635
683#define REASSEMBLE_INIT_HF_ITEMS(var_prefix, name_prefix, abbrev_prefix) \
684 { &hf_##var_prefix##_fragments, \
685 { "Reassembled " name_prefix " fragments", abbrev_prefix ".fragments", \
686 FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } \
687 }, \
688 { &hf_##var_prefix##_fragment, \
689 { name_prefix " fragment", abbrev_prefix ".fragment", \
690 FT_FRAMENUM, BASE_NONE, NULL, 0x0, NULL, HFILL } \
691 }, \
692 { &hf_##var_prefix##_fragment_overlap, \
693 { name_prefix " fragment overlap", abbrev_prefix ".fragment.overlap", \
694 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
695 }, \
696 { &hf_##var_prefix##_fragment_overlap_conflicts, \
697 { name_prefix " fragment overlapping with conflicting data", abbrev_prefix ".fragment.overlap.conflicts", \
698 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
699 }, \
700 { &hf_##var_prefix##_fragment_multiple_tails, \
701 { name_prefix " has multiple tail fragments", abbrev_prefix ".fragment.multiple_tails", \
702 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
703 }, \
704 { &hf_##var_prefix##_fragment_too_long_fragment, \
705 { name_prefix " fragment too long", abbrev_prefix ".fragment.too_long_fragment", \
706 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
707 }, \
708 { &hf_##var_prefix##_fragment_error, \
709 { name_prefix " defragment error", abbrev_prefix ".fragment.error", \
710 FT_FRAMENUM, BASE_NONE, NULL, 0x0, NULL, HFILL } \
711 }, \
712 { &hf_##var_prefix##_fragment_count, \
713 { name_prefix " fragment count", abbrev_prefix ".fragment.count", \
714 FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } \
715 }, \
716 { &hf_##var_prefix##_reassembled_in, \
717 { "Reassembled in", abbrev_prefix ".reassembled.in", \
718 FT_FRAMENUM, BASE_NONE, NULL, 0x0, NULL, HFILL } \
719 }, \
720 { &hf_##var_prefix##_reassembled_length, \
721 { "Reassembled length", abbrev_prefix ".reassembled.length", \
722 FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } \
723 }, \
724 { &hf_##var_prefix##_reassembled_data, \
725 { "Reassembled data", abbrev_prefix ".reassembled.data", \
726 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } \
727 }, \
728 { &hf_##var_prefix##_segment, \
729 { name_prefix " segment", abbrev_prefix ".segment", \
730 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL} \
731 }
732
764#define REASSEMBLE_INIT_ETT_ITEMS(var_prefix) \
765 &ett_##var_prefix##_fragment, \
766 &ett_##var_prefix##_fragments
767
769 typedef struct streaming_reassembly_info_t streaming_reassembly_info_t;
770
774WS_DLL_PUBLIC streaming_reassembly_info_t*
775 streaming_reassembly_info_new(void);
776
1142WS_DLL_PUBLIC int
1143 reassemble_streaming_data_and_call_subdissector(
1144 tvbuff_t* tvb, packet_info* pinfo, unsigned offset, int length,
1145 proto_tree* segment_tree, proto_tree* reassembled_tree, reassembly_table streaming_reassembly_table,
1146 streaming_reassembly_info_t* reassembly_info, uint64_t cur_frame_num,
1147 struct dissector_handle* subdissector_handle, proto_tree* subdissector_tree, void* subdissector_data,
1148 const char* label, const fragment_items* frag_hf_items, int hf_segment_data
1149);
1150
1164 static inline uint64_t
1165get_virtual_frame_num64(tvbuff_t* tvb, packet_info* pinfo, int offset)
1166{
1167 return (((uint64_t)pinfo->num) << 32) + (((uint64_t)pinfo->curr_layer_num) << 24)
1168 + ((uint64_t)tvb_raw_offset(tvb) + offset);
1169}
1170
1178WS_DLL_PUBLIC int
1179 additional_bytes_expected_to_complete_reassembly(streaming_reassembly_info_t* reassembly_info);
1180
1181/* ========================================================================= */
1182
1183#ifdef __cplusplus
1184}
1185#endif
1186
1187#endif
tvb_raw_offset
unsigned tvb_raw_offset(tvbuff_t *tvb)
Returns the offset from the first byte of real data.
Definition tvbuff.c:5377
packet_info.h
proto.h
streaming_reassembly_info_new
WS_DLL_PUBLIC streaming_reassembly_info_t * streaming_reassembly_info_new(void)
Definition reassemble.c:3213
additional_bytes_expected_to_complete_reassembly
WS_DLL_PUBLIC int additional_bytes_expected_to_complete_reassembly(streaming_reassembly_info_t *reassembly_info)
Definition reassemble.c:3537
reassemble_streaming_data_and_call_subdissector
WS_DLL_PUBLIC int reassemble_streaming_data_and_call_subdissector(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, int length, proto_tree *segment_tree, proto_tree *reassembled_tree, reassembly_table streaming_reassembly_table, streaming_reassembly_info_t *reassembly_info, uint64_t cur_frame_num, struct dissector_handle *subdissector_handle, proto_tree *subdissector_tree, void *subdissector_data, const char *label, const fragment_items *frag_hf_items, int hf_segment_data)
_fragment_head
Definition reassemble.h:76
_fragment_head::ref_count
unsigned ref_count
Definition reassemble.h:80
_fragment_head::flags
uint32_t flags
Definition reassemble.h:101
_fragment_head::error
const char * error
Definition reassemble.h:109
_fragment_head::first_gap
struct _fragment_item * first_gap
Definition reassemble.h:78
_fragment_head::len
uint32_t len
Definition reassemble.h:83
_fragment_head::contiguous_len
uint32_t contiguous_len
Definition reassemble.h:81
_fragment_head::datalen
uint32_t datalen
Definition reassemble.h:89
_fragment_head::reassembled_in
uint32_t reassembled_in
Definition reassemble.h:95
_fragment_head::fragment_nr_offset
uint32_t fragment_nr_offset
Definition reassemble.h:86
_fragment_head::reas_in_layer_num
uint8_t reas_in_layer_num
Definition reassemble.h:97
_fragment_head::frame
uint32_t frame
Definition reassemble.h:82
_fragment_item
Definition reassemble.h:64
_fragment_item::frame
uint32_t frame
Definition reassemble.h:66
_fragment_item::flags
uint32_t flags
Definition reassemble.h:70
_fragment_item::len
uint32_t len
Definition reassemble.h:69
_fragment_item::offset
uint32_t offset
Definition reassemble.h:67
_fragment_items
Definition reassemble.h:536
_packet_info
Definition packet_info.h:43
_packet_info::num
uint32_t num
Definition packet_info.h:47
_packet_info::curr_layer_num
uint8_t curr_layer_num
Definition packet_info.h:150
_proto_node
Definition proto.h:905
dissector_handle
Definition packet.c:852
reassembly_table_functions
Definition reassemble.h:161
reassembly_table
Definition reassemble.h:150
streaming_reassembly_info_t
Definition reassemble.c:3190
tvbuff
Definition tvbuff-int.h:36