| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
reassemble.h
Go to the documentation of this file.
1
10
11/* make sure that all flags that are set in a fragment entry is also set for
12 * the flags field of fd_head !!!
13 */
14#pragma once
15#include <epan/packet_info.h>
16#include <epan/proto.h>
17#include "ws_symbol_export.h"
18
19#ifdef __cplusplus
20 extern "C" {
21#endif
22
23/* in fd_head: packet is defragmented
24 * in item: this item was used in defragmentation
25 * (An item can have this set when the head does not if defragmentation
26 * was reset due to changing the total length or partial reassembly.)
27 */
28#define FD_DEFRAGMENTED 0x0001
29
30/* there are overlapping fragments */
31#define FD_OVERLAP 0x0002
32
33/* overlapping fragments contain different data */
34#define FD_OVERLAPCONFLICT 0x0004
35
36/* more than one fragment which indicates end-of data */
37#define FD_MULTIPLETAILS 0x0008
38
39/* fragment starts before the end of the datagram but extends
40 past the end of the datagram */
41#define FD_TOOLONGFRAGMENT 0x0010
42
43/* fragment tvb is subset, don't tvb_free() it */
44#define FD_SUBSET_TVB 0x0020
45
46/* this flag is used to request fragment_add to continue the reassembly process */
47#define FD_PARTIAL_REASSEMBLY 0x0040
48
49/* fragment offset is indicated by sequence number and not byte offset
50 into the defragmented packet */
51#define FD_BLOCKSEQUENCE 0x0100
52
53/* This flag is set in (only) fd_head to denote that datalen has been set to a valid value.
54 * It's implied by FD_DEFRAGMENTED (we must know the total length of the
55 * datagram if we have defragmented it...)
56 */
57#define FD_DATALEN_SET 0x0400
58
59 struct dissector_handle;
60
64 typedef struct _fragment_item {
65 struct _fragment_item* next;
66 uint32_t frame;
67 uint32_t offset;
68 uint32_t len;
69 uint32_t flags;
70 tvbuff_t* tvb_data;
71} fragment_item;
72
73
77 typedef struct _fragment_head {
78 struct _fragment_item* next;
79 struct _fragment_item* first_gap;
81 unsigned ref_count;
82 uint32_t contiguous_len;
83 uint32_t frame;
84 uint32_t len;
86 uint32_t fragment_nr_offset;
88 uint32_t datalen;
91 uint32_t reassembled_in;
93 uint8_t reas_in_layer_num;
96 uint32_t flags;
97 tvbuff_t* tvb_data;
98 const char* error;
100} fragment_head;
101
102/*
103 * Flags for fragment_add_seq_*
104 */
105
106/* we don't have any sequence numbers - fragments are assumed to appear in
107 * order */
108#define REASSEMBLE_FLAGS_NO_FRAG_NUMBER 0x0001
109
110/* a special fudge for the 802.11 dissector */
111#define REASSEMBLE_FLAGS_802_11_HACK 0x0002
112
113/*
114 * Flags for fragment_add_seq_single_*
115 */
116
117/* we want to age off old packets */
118#define REASSEMBLE_FLAGS_AGING 0x0001
119
120/*
121 * Generates a fragment identifier based on the given parameters. "data" is an
122 * opaque type whose interpretation is up to the caller of fragment_add*
123 * functions and the fragment key function (possibly NULL if you do not care).
124 *
125 * Keys returned by this function are only used within this packet scope.
126 */
127 typedef void * (*fragment_temporary_key)(const packet_info *pinfo,
128 const uint32_t id, const void *data);
129
130/*
131 * Like fragment_temporary_key, but used for identifying reassembled fragments
132 * which may persist through multiple packets.
133 */
134 typedef void * (*fragment_persistent_key)(const packet_info *pinfo,
135 const uint32_t id, const void *data);
136
140 typedef struct {
141 GHashTable* fragment_table;
142 GHashTable* reassembled_table;
143 fragment_temporary_key temporary_key_func;
144 fragment_persistent_key persistent_key_func;
145 GDestroyNotify free_temporary_key_func;
146} reassembly_table;
147
151 typedef struct {
155 GHashFunc hash_func;
156
160 GEqualFunc equal_func;
161
165 fragment_temporary_key temporary_key_func;
166
170 fragment_persistent_key persistent_key_func;
171
175 GDestroyNotify free_temporary_key_func;
176
180 GDestroyNotify free_persistent_key_func;
181} reassembly_table_functions;
182
183/*
184 * Tables of functions exported for the benefit of dissectors that
185 * don't need special items in their keys.
186 */
187WS_DLL_PUBLIC const reassembly_table_functions
188 addresses_reassembly_table_functions; /* keys have endpoint addresses and an ID */
189WS_DLL_PUBLIC const reassembly_table_functions
190 addresses_ports_reassembly_table_functions; /* keys have endpoint addresses and ports and an ID */
191
199WS_DLL_PUBLIC void
200 reassembly_table_register(reassembly_table *table,
201 const reassembly_table_functions *funcs);
202
212WS_DLL_PUBLIC void
213 reassembly_table_init(reassembly_table *table,
214 const reassembly_table_functions *funcs);
215
223WS_DLL_PUBLIC void
224 reassembly_table_destroy(reassembly_table *table);
225
262WS_DLL_PUBLIC fragment_head *
263 fragment_add(reassembly_table *table, tvbuff_t *tvb, const int offset,
264 const packet_info *pinfo, const uint32_t id, const void *data,
265 const uint32_t frag_offset, const uint32_t frag_data_len,
266 const bool more_frags);
267
286WS_DLL_PUBLIC fragment_head *
287 fragment_add_multiple_ok(reassembly_table *table, tvbuff_t *tvb,
288 const int offset, const packet_info *pinfo,
289 const uint32_t id, const void *data,
290 const uint32_t frag_offset,
291 const uint32_t frag_data_len,
292 const bool more_frags);
293
322WS_DLL_PUBLIC fragment_head *
323 fragment_add_out_of_order(reassembly_table *table, tvbuff_t *tvb,
324 const int offset, const packet_info *pinfo,
325 const uint32_t id, const void *data,
326 const uint32_t frag_offset,
327 const uint32_t frag_data_len,
328 const bool more_frags, const uint32_t frag_frame);
329
365WS_DLL_PUBLIC fragment_head *
366 fragment_add_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
367 const packet_info *pinfo, const uint32_t id,
368 const void *data, const uint32_t frag_offset,
369 const uint32_t frag_data_len, const bool more_frags);
370
394WS_DLL_PUBLIC fragment_head *
395 fragment_add_check_with_fallback(reassembly_table *table, tvbuff_t *tvb, const int offset,
396 const packet_info *pinfo, const uint32_t id,
397 const void *data, const uint32_t frag_offset,
398 const uint32_t frag_data_len, const bool more_frags,
399 const uint32_t fallback_frame);
400
427WS_DLL_PUBLIC fragment_head *
428 fragment_add_check_next(reassembly_table *table, tvbuff_t *tvb, const int offset,
429 const packet_info *pinfo, const uint32_t id,
430 const void *data, const uint32_t frag_data_len,
431 const bool more_frags);
432
478WS_DLL_PUBLIC fragment_head *
479 fragment_add_seq(reassembly_table *table, tvbuff_t *tvb, const int offset,
480 const packet_info *pinfo, const uint32_t id, const void *data,
481 const uint32_t frag_number, const uint32_t frag_data_len,
482 const bool more_frags, const uint32_t flags);
483
510WS_DLL_PUBLIC fragment_head *
511 fragment_add_seq_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
512 const packet_info *pinfo, const uint32_t id,
513 const void *data,
514 const uint32_t frag_number, const uint32_t frag_data_len,
515 const bool more_frags);
516
536WS_DLL_PUBLIC fragment_head *
537 fragment_add_seq_802_11(reassembly_table *table, tvbuff_t *tvb,
538 const int offset, const packet_info *pinfo,
539 const uint32_t id, const void *data,
540 const uint32_t frag_number, const uint32_t frag_data_len,
541 const bool more_frags);
542
566WS_DLL_PUBLIC fragment_head *
567 fragment_add_seq_next(reassembly_table *table, tvbuff_t *tvb, const int offset,
568 const packet_info *pinfo, const uint32_t id,
569 const void *data, const uint32_t frag_data_len,
570 const bool more_frags);
571
596WS_DLL_PUBLIC fragment_head *
597 fragment_add_seq_single(reassembly_table *table, tvbuff_t *tvb,
598 const int offset, const packet_info *pinfo, const uint32_t id,
599 const void* data, const uint32_t frag_data_len,
600 const bool first, const bool last,
601 const uint32_t max_frags);
602
623WS_DLL_PUBLIC fragment_head *
624 fragment_add_seq_single_aging(reassembly_table *table, tvbuff_t *tvb,
625 const int offset, const packet_info *pinfo, const uint32_t id,
626 const void* data, const uint32_t frag_data_len,
627 const bool first, const bool last,
628 const uint32_t max_frags, const uint32_t max_age);
629
639WS_DLL_PUBLIC void
640 fragment_start_seq_check(reassembly_table *table, const packet_info *pinfo,
641 const uint32_t id, const void *data,
642 const uint32_t tot_len);
643
659WS_DLL_PUBLIC fragment_head *
660 fragment_end_seq_next(reassembly_table *table, const packet_info *pinfo,
661 const uint32_t id, const void *data);
662
676WS_DLL_PUBLIC void
677 fragment_add_seq_offset(reassembly_table *table, const packet_info *pinfo, const uint32_t id,
678 const void *data, const uint32_t fragment_offset);
679
697WS_DLL_PUBLIC void
698 fragment_set_tot_len(reassembly_table *table, const packet_info *pinfo,
699 const uint32_t id, const void *data, const uint32_t tot_len);
700
701
720WS_DLL_PUBLIC void
721 fragment_reset_tot_len(reassembly_table *table, const packet_info *pinfo,
722 const uint32_t id, const void *data, const uint32_t tot_len);
723
743WS_DLL_PUBLIC void
744 fragment_truncate(reassembly_table *table, const packet_info *pinfo,
745 const uint32_t id, const void *data, const uint32_t tot_len);
746
759WS_DLL_PUBLIC uint32_t
760 fragment_get_tot_len(reassembly_table *table, const packet_info *pinfo,
761 const uint32_t id, const void *data);
762
778WS_DLL_PUBLIC void
779 fragment_set_partial_reassembly(reassembly_table *table,
780 const packet_info *pinfo, const uint32_t id,
781 const void *data);
782
795WS_DLL_PUBLIC fragment_head *
796 fragment_get(reassembly_table *table, const packet_info *pinfo,
797 const uint32_t id, const void *data);
798
799/* The same for the reassemble table */
808WS_DLL_PUBLIC fragment_head *
809 fragment_get_reassembled_id(reassembly_table *table, const packet_info *pinfo,
810 const uint32_t id);
811
828WS_DLL_PUBLIC tvbuff_t *
829 fragment_delete(reassembly_table *table, const packet_info *pinfo,
830 const uint32_t id, const void *data);
831
844 typedef struct _fragment_items {
845 int* ett_fragment;
846 int* ett_fragments;
847
848 int* hf_fragments;
849 int* hf_fragment;
850 int* hf_fragment_overlap;
851 int* hf_fragment_overlap_conflict;
852 int* hf_fragment_multiple_tails;
853 int* hf_fragment_too_long_fragment;
854 int* hf_fragment_error;
855 int* hf_fragment_count;
856 int* hf_reassembled_in;
857 int* hf_reassembled_length;
858 int* hf_reassembled_data;
859
860 const char* tag;
861} fragment_items;
862
876WS_DLL_PUBLIC tvbuff_t *
877 process_reassembled_data(tvbuff_t *tvb, const int offset, packet_info *pinfo,
878 const char *name, fragment_head *fd_head, const fragment_items *fit,
879 bool *update_col_infop, proto_tree *tree);
880
892WS_DLL_PUBLIC bool
893 show_fragment_tree(fragment_head *ipfd_head, const fragment_items *fit,
894 proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);
895
908WS_DLL_PUBLIC bool
909 show_fragment_seq_tree(fragment_head *ipfd_head, const fragment_items *fit,
910 proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);
911
918 extern void reassembly_tables_init(void);
919
926 extern void
927 reassembly_table_cleanup(void);
928
929/* ===================== Streaming data reassembly helper ===================== */
956#define REASSEMBLE_ITEMS_DEFINE(var_prefix, name_prefix) \
957 static int ett_##var_prefix##_fragment; \
958 static int ett_##var_prefix##_fragments; \
959 static int hf_##var_prefix##_fragments; \
960 static int hf_##var_prefix##_fragment; \
961 static int hf_##var_prefix##_fragment_overlap; \
962 static int hf_##var_prefix##_fragment_overlap_conflicts; \
963 static int hf_##var_prefix##_fragment_multiple_tails; \
964 static int hf_##var_prefix##_fragment_too_long_fragment; \
965 static int hf_##var_prefix##_fragment_error; \
966 static int hf_##var_prefix##_fragment_count; \
967 static int hf_##var_prefix##_reassembled_in; \
968 static int hf_##var_prefix##_reassembled_length; \
969 static int hf_##var_prefix##_reassembled_data; \
970 static int hf_##var_prefix##_segment; \
971 static const fragment_items var_prefix##_fragment_items = { \
972 &ett_##var_prefix##_fragment, \
973 &ett_##var_prefix##_fragments, \
974 &hf_##var_prefix##_fragments, \
975 &hf_##var_prefix##_fragment, \
976 &hf_##var_prefix##_fragment_overlap, \
977 &hf_##var_prefix##_fragment_overlap_conflicts, \
978 &hf_##var_prefix##_fragment_multiple_tails, \
979 &hf_##var_prefix##_fragment_too_long_fragment, \
980 &hf_##var_prefix##_fragment_error, \
981 &hf_##var_prefix##_fragment_count, \
982 &hf_##var_prefix##_reassembled_in, \
983 &hf_##var_prefix##_reassembled_length, \
984 &hf_##var_prefix##_reassembled_data, \
985 name_prefix " fragments" \
986 }
987
1035#define REASSEMBLE_INIT_HF_ITEMS(var_prefix, name_prefix, abbrev_prefix) \
1036 { &hf_##var_prefix##_fragments, \
1037 { "Reassembled " name_prefix " fragments", abbrev_prefix ".fragments", \
1038 FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL } \
1039 }, \
1040 { &hf_##var_prefix##_fragment, \
1041 { name_prefix " fragment", abbrev_prefix ".fragment", \
1042 FT_FRAMENUM, BASE_NONE, NULL, 0x0, NULL, HFILL } \
1043 }, \
1044 { &hf_##var_prefix##_fragment_overlap, \
1045 { name_prefix " fragment overlap", abbrev_prefix ".fragment.overlap", \
1046 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
1047 }, \
1048 { &hf_##var_prefix##_fragment_overlap_conflicts, \
1049 { name_prefix " fragment overlapping with conflicting data", abbrev_prefix ".fragment.overlap.conflicts", \
1050 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
1051 }, \
1052 { &hf_##var_prefix##_fragment_multiple_tails, \
1053 { name_prefix " has multiple tail fragments", abbrev_prefix ".fragment.multiple_tails", \
1054 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
1055 }, \
1056 { &hf_##var_prefix##_fragment_too_long_fragment, \
1057 { name_prefix " fragment too long", abbrev_prefix ".fragment.too_long_fragment", \
1058 FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } \
1059 }, \
1060 { &hf_##var_prefix##_fragment_error, \
1061 { name_prefix " defragment error", abbrev_prefix ".fragment.error", \
1062 FT_FRAMENUM, BASE_NONE, NULL, 0x0, NULL, HFILL } \
1063 }, \
1064 { &hf_##var_prefix##_fragment_count, \
1065 { name_prefix " fragment count", abbrev_prefix ".fragment.count", \
1066 FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } \
1067 }, \
1068 { &hf_##var_prefix##_reassembled_in, \
1069 { "Reassembled in", abbrev_prefix ".reassembled.in", \
1070 FT_FRAMENUM, BASE_NONE, NULL, 0x0, NULL, HFILL } \
1071 }, \
1072 { &hf_##var_prefix##_reassembled_length, \
1073 { "Reassembled length", abbrev_prefix ".reassembled.length", \
1074 FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } \
1075 }, \
1076 { &hf_##var_prefix##_reassembled_data, \
1077 { "Reassembled data", abbrev_prefix ".reassembled.data", \
1078 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } \
1079 }, \
1080 { &hf_##var_prefix##_segment, \
1081 { name_prefix " segment", abbrev_prefix ".segment", \
1082 FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL} \
1083 }
1084
1116#define REASSEMBLE_INIT_ETT_ITEMS(var_prefix) \
1117 &ett_##var_prefix##_fragment, \
1118 &ett_##var_prefix##_fragments
1119
1121 typedef struct streaming_reassembly_info_t streaming_reassembly_info_t;
1122
1126WS_DLL_PUBLIC streaming_reassembly_info_t*
1127 streaming_reassembly_info_new(void);
1128
1494WS_DLL_PUBLIC int
1495 reassemble_streaming_data_and_call_subdissector(
1496 tvbuff_t* tvb, packet_info* pinfo, unsigned offset, int length,
1497 proto_tree* segment_tree, proto_tree* reassembled_tree, reassembly_table streaming_reassembly_table,
1498 streaming_reassembly_info_t* reassembly_info, uint64_t cur_frame_num,
1499 struct dissector_handle* subdissector_handle, proto_tree* subdissector_tree, void* subdissector_data,
1500 const char* label, const fragment_items* frag_hf_items, int hf_segment_data
1501);
1502
1516 static inline uint64_t
1517get_virtual_frame_num64(tvbuff_t* tvb, packet_info* pinfo, int offset)
1518{
1519 return (((uint64_t)pinfo->num) << 32) + (((uint64_t)pinfo->curr_layer_num) << 24)
1520 + ((uint64_t)tvb_raw_offset(tvb) + offset);
1521}
1522
1530WS_DLL_PUBLIC int
1531 additional_bytes_expected_to_complete_reassembly(streaming_reassembly_info_t* reassembly_info);
1532
1533/* ========================================================================= */
1534
1535#ifdef __cplusplus
1536}
1537#endif
packet_info
struct _packet_info packet_info
Represents the metadata and indexing information for a single captured frame.
proto_item
proto_node proto_item
Definition proto.h:927
tvb_raw_offset
unsigned tvb_raw_offset(tvbuff_t *tvb)
Returns the offset from the first byte of real data.
Definition tvbuff.c:5514
packet_info.h
proto.h
fragment_add_seq_check
WS_DLL_PUBLIC fragment_head * fragment_add_seq_check(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_number, const uint32_t frag_data_len, const bool more_frags)
Adds a fragment to the reassembly table and checks for sequence correctness.
Definition reassemble.c:2464
fragment_end_seq_next
WS_DLL_PUBLIC fragment_head * fragment_end_seq_next(reassembly_table *table, const packet_info *pinfo, const uint32_t id, const void *data)
Adds a fragment with sequence numbering and sets an offset for subsequent fragments.
Definition reassemble.c:2846
streaming_reassembly_info_new
WS_DLL_PUBLIC streaming_reassembly_info_t * streaming_reassembly_info_new(void)
Definition reassemble.c:3293
fragment_add_seq_single
WS_DLL_PUBLIC fragment_head * fragment_add_seq_single(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_data_len, const bool first, const bool last, const uint32_t max_frags)
Adds a single fragment to a reassembly table.
Definition reassemble.c:2795
fragment_add_check
WS_DLL_PUBLIC fragment_head * fragment_add_check(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_offset, const uint32_t frag_data_len, const bool more_frags)
Adds a fragment to the reassembly table and checks for completeness.
Definition reassemble.c:1920
fragment_add_seq_802_11
WS_DLL_PUBLIC fragment_head * fragment_add_seq_802_11(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_number, const uint32_t frag_data_len, const bool more_frags)
Adds a fragment to an 802.11 reassembly table.
Definition reassemble.c:2476
fragment_add_seq_single_aging
WS_DLL_PUBLIC fragment_head * fragment_add_seq_single_aging(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_data_len, const bool first, const bool last, const uint32_t max_frags, const uint32_t max_age)
Start a reassembly, expecting "tot_len" as the number of given fragments (not the number of bytes)....
Definition reassemble.c:2808
fragment_add_seq_offset
WS_DLL_PUBLIC void fragment_add_seq_offset(reassembly_table *table, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t fragment_offset)
Adds a fragment with sequence numbering and sets an offset for subsequent fragments.
Definition reassemble.c:689
fragment_add_seq_next
WS_DLL_PUBLIC fragment_head * fragment_add_seq_next(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_data_len, const bool more_frags)
Adds a fragment to a reassembly table for protocols with no individual fragment numbers.
Definition reassemble.c:2489
show_fragment_seq_tree
WS_DLL_PUBLIC bool show_fragment_seq_tree(fragment_head *ipfd_head, const fragment_items *fit, proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi)
Display the sequence tree for fragmented data.
Definition reassemble.c:3156
reassembly_table_cleanup
void reassembly_table_cleanup(void)
Cleanup internal structures used for reassembly.
Definition reassemble.c:3250
fragment_head
struct _fragment_head fragment_head
Represents the head of a fragment reassembly chain, tracking overall reassembly state across all cont...
fragment_items
struct _fragment_items fragment_items
Bundles all protocol tree and header field handles needed to display a reassembled fragment tree in t...
fragment_add_check_next
WS_DLL_PUBLIC fragment_head * fragment_add_check_next(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_data_len, const bool more_frags)
Adds a fragment to a reassembly table for protocols where the total reassembled length in octets is k...
Definition reassemble.c:1930
reassembly_table_register
WS_DLL_PUBLIC void reassembly_table_register(reassembly_table *table, const reassembly_table_functions *funcs)
Register a reassembly table. By registering the table with epan, the creation and destruction of the ...
Definition reassemble.c:466
fragment_get
WS_DLL_PUBLIC fragment_head * fragment_get(reassembly_table *table, const packet_info *pinfo, const uint32_t id, const void *data)
Retrieves the partial or completed reassembly state for a packet.
Definition reassemble.c:664
fragment_add_seq
WS_DLL_PUBLIC fragment_head * fragment_add_seq(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_number, const uint32_t frag_data_len, const bool more_frags, const uint32_t flags)
Adds a fragment to the reassembly table and handles sequence-based reassembly.
Definition reassemble.c:2367
fragment_add_out_of_order
WS_DLL_PUBLIC fragment_head * fragment_add_out_of_order(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_offset, const uint32_t frag_data_len, const bool more_frags, const uint32_t frag_frame)
Adds an out-of-order fragment to a reassembly table and maintains a table for completed reassemblies.
Definition reassemble.c:1770
fragment_get_reassembled_id
WS_DLL_PUBLIC fragment_head * fragment_get_reassembled_id(reassembly_table *table, const packet_info *pinfo, const uint32_t id)
Get the reassembled data for a given ID.
Definition reassemble.c:671
fragment_set_tot_len
WS_DLL_PUBLIC void fragment_set_tot_len(reassembly_table *table, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t tot_len)
Sets the expected total length for reassembly of a PDU.
Definition reassemble.c:817
fragment_delete
WS_DLL_PUBLIC tvbuff_t * fragment_delete(reassembly_table *table, const packet_info *pinfo, const uint32_t id, const void *data)
Deletes a fragment from the reassembly table.
Definition reassemble.c:634
show_fragment_tree
WS_DLL_PUBLIC bool show_fragment_tree(fragment_head *ipfd_head, const fragment_items *fit, proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi)
Show the fragment tree for a sequence of fragments.
Definition reassemble.c:3105
reassembly_table_destroy
WS_DLL_PUBLIC void reassembly_table_destroy(reassembly_table *table)
Destroy a reassembly table.
Definition reassemble.c:532
fragment_add_check_with_fallback
WS_DLL_PUBLIC fragment_head * fragment_add_check_with_fallback(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_offset, const uint32_t frag_data_len, const bool more_frags, const uint32_t fallback_frame)
Adds a fragment to the reassembly table and checks for completeness.
Definition reassemble.c:1909
fragment_add
WS_DLL_PUBLIC fragment_head * fragment_add(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_offset, const uint32_t frag_data_len, const bool more_frags)
Adds a fragment to a reassembly table.
Definition reassemble.c:1735
additional_bytes_expected_to_complete_reassembly
WS_DLL_PUBLIC int additional_bytes_expected_to_complete_reassembly(streaming_reassembly_info_t *reassembly_info)
Definition reassemble.c:3617
reassembly_tables_init
void reassembly_tables_init(void)
Initialize internal structures used for reassembly.
Definition reassemble.c:3235
fragment_item
struct _fragment_item fragment_item
Represents a single fragment contributing to a reassembled PDU.
fragment_reset_tot_len
WS_DLL_PUBLIC void fragment_reset_tot_len(reassembly_table *table, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t tot_len)
Clears the state of previously reassembled fragments and allows new fragments to extend the result ag...
Definition reassemble.c:857
fragment_truncate
WS_DLL_PUBLIC void fragment_truncate(reassembly_table *table, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t tot_len)
Adjusts the length of a fragment and resets defragmentation if necessary.
Definition reassemble.c:890
fragment_set_partial_reassembly
WS_DLL_PUBLIC void fragment_set_partial_reassembly(reassembly_table *table, const packet_info *pinfo, const uint32_t id, const void *data)
Set the partial reassembly flag for a fragment head.
Definition reassemble.c:988
fragment_get_tot_len
WS_DLL_PUBLIC uint32_t fragment_get_tot_len(reassembly_table *table, const packet_info *pinfo, const uint32_t id, const void *data)
Get the total length of reassembled data.
Definition reassemble.c:965
fragment_start_seq_check
WS_DLL_PUBLIC void fragment_start_seq_check(reassembly_table *table, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t tot_len)
Starts a sequence check for reassembly.
Definition reassemble.c:2822
process_reassembled_data
WS_DLL_PUBLIC tvbuff_t * process_reassembled_data(tvbuff_t *tvb, const int offset, packet_info *pinfo, const char *name, fragment_head *fd_head, const fragment_items *fit, bool *update_col_infop, proto_tree *tree)
Process reassembled data and return a new tvbuff.
Definition reassemble.c:2913
reassemble_streaming_data_and_call_subdissector
WS_DLL_PUBLIC int reassemble_streaming_data_and_call_subdissector(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, int length, proto_tree *segment_tree, proto_tree *reassembled_tree, reassembly_table streaming_reassembly_table, streaming_reassembly_info_t *reassembly_info, uint64_t cur_frame_num, struct dissector_handle *subdissector_handle, proto_tree *subdissector_tree, void *subdissector_data, const char *label, const fragment_items *frag_hf_items, int hf_segment_data)
fragment_add_multiple_ok
WS_DLL_PUBLIC fragment_head * fragment_add_multiple_ok(reassembly_table *table, tvbuff_t *tvb, const int offset, const packet_info *pinfo, const uint32_t id, const void *data, const uint32_t frag_offset, const uint32_t frag_data_len, const bool more_frags)
Adds a fragment to a reassembly table, allowing for multiple tables.
Definition reassemble.c:1749
reassembly_table_init
WS_DLL_PUBLIC void reassembly_table_init(reassembly_table *table, const reassembly_table_functions *funcs)
Initialize a reassembly table.
Definition reassemble.c:486
_fragment_head
Represents the head of a fragment reassembly chain, tracking overall reassembly state across all cont...
Definition reassemble.h:77
_fragment_head::ref_count
unsigned ref_count
Definition reassemble.h:81
_fragment_head::flags
uint32_t flags
Definition reassemble.h:96
_fragment_head::error
const char * error
Definition reassemble.h:98
_fragment_head::first_gap
struct _fragment_item * first_gap
Definition reassemble.h:79
_fragment_head::len
uint32_t len
Definition reassemble.h:84
_fragment_head::contiguous_len
uint32_t contiguous_len
Definition reassemble.h:82
_fragment_head::datalen
uint32_t datalen
Definition reassemble.h:88
_fragment_head::reassembled_in
uint32_t reassembled_in
Definition reassemble.h:91
_fragment_head::fragment_nr_offset
uint32_t fragment_nr_offset
Definition reassemble.h:86
_fragment_head::next
struct _fragment_item * next
Definition reassemble.h:78
_fragment_head::reas_in_layer_num
uint8_t reas_in_layer_num
Definition reassemble.h:93
_fragment_head::frame
uint32_t frame
Definition reassemble.h:83
_fragment_head::tvb_data
tvbuff_t * tvb_data
Definition reassemble.h:97
_fragment_item
Represents a single fragment contributing to a reassembled PDU.
Definition reassemble.h:64
_fragment_item::frame
uint32_t frame
Definition reassemble.h:66
_fragment_item::tvb_data
tvbuff_t * tvb_data
Definition reassemble.h:70
_fragment_item::next
struct _fragment_item * next
Definition reassemble.h:65
_fragment_item::flags
uint32_t flags
Definition reassemble.h:69
_fragment_item::len
uint32_t len
Definition reassemble.h:68
_fragment_item::offset
uint32_t offset
Definition reassemble.h:67
_fragment_items
Bundles all protocol tree and header field handles needed to display a reassembled fragment tree in t...
Definition reassemble.h:844
_fragment_items::hf_reassembled_length
int * hf_reassembled_length
Definition reassemble.h:857
_fragment_items::hf_fragments
int * hf_fragments
Definition reassemble.h:848
_fragment_items::hf_fragment_multiple_tails
int * hf_fragment_multiple_tails
Definition reassemble.h:852
_fragment_items::ett_fragments
int * ett_fragments
Definition reassemble.h:846
_fragment_items::hf_fragment_overlap
int * hf_fragment_overlap
Definition reassemble.h:850
_fragment_items::tag
const char * tag
Definition reassemble.h:860
_fragment_items::hf_reassembled_in
int * hf_reassembled_in
Definition reassemble.h:856
_fragment_items::hf_fragment_count
int * hf_fragment_count
Definition reassemble.h:855
_fragment_items::hf_fragment_error
int * hf_fragment_error
Definition reassemble.h:854
_fragment_items::hf_reassembled_data
int * hf_reassembled_data
Definition reassemble.h:858
_fragment_items::hf_fragment
int * hf_fragment
Definition reassemble.h:849
_fragment_items::hf_fragment_too_long_fragment
int * hf_fragment_too_long_fragment
Definition reassemble.h:853
_fragment_items::hf_fragment_overlap_conflict
int * hf_fragment_overlap_conflict
Definition reassemble.h:851
_fragment_items::ett_fragment
int * ett_fragment
Definition reassemble.h:845
dissector_handle
Definition packet.c:867
reassembly_table_functions
Table of functions for a reassembly table.
Definition reassemble.h:151
reassembly_table_functions::hash_func
GHashFunc hash_func
Hash function for fragment table keys.
Definition reassemble.h:155
reassembly_table_functions::temporary_key_func
fragment_temporary_key temporary_key_func
Create a temporary (short-lived) fragment key.
Definition reassemble.h:165
reassembly_table_functions::equal_func
GEqualFunc equal_func
Equality function for fragment table keys.
Definition reassemble.h:160
reassembly_table_functions::free_temporary_key_func
GDestroyNotify free_temporary_key_func
Destroy a temporary fragment key.
Definition reassemble.h:175
reassembly_table_functions::free_persistent_key_func
GDestroyNotify free_persistent_key_func
Destroy a persistent fragment key.
Definition reassemble.h:180
reassembly_table_functions::persistent_key_func
fragment_persistent_key persistent_key_func
Create a persistent (long-lived) fragment key.
Definition reassemble.h:170
reassembly_table
Tracks all in-progress fragment chains and completed reassemblies for a single reassembly context.
Definition reassemble.h:140
reassembly_table::free_temporary_key_func
GDestroyNotify free_temporary_key_func
Definition reassemble.h:145
reassembly_table::temporary_key_func
fragment_temporary_key temporary_key_func
Definition reassemble.h:143
reassembly_table::reassembled_table
GHashTable * reassembled_table
Definition reassemble.h:142
reassembly_table::persistent_key_func
fragment_persistent_key persistent_key_func
Definition reassemble.h:144
reassembly_table::fragment_table
GHashTable * fragment_table
Definition reassemble.h:141
streaming_reassembly_info_t
Definition reassemble.c:3270