Wireshark 4.5.0
The Wireshark network protocol analyzer
Loading...
Searching...
No Matches
stream.h
Go to the documentation of this file.
1
14#ifndef STREAM_H
15#define STREAM_H
16
17#include <epan/tvbuff.h>
18#include <epan/reassemble.h>
19#include "ws_symbol_export.h"
20
21struct _fragment_items;
22
23/* A stream represents the concept of an arbitrary stream of data,
24 divided up into frames for transmission, where the frames have
25 little or no correspondence to the PDUs of the protocol being
26 streamed, and those PDUs are just delineated by a magic number.
27
28 For example, we stream H.223 over IAX2. IAX2 has no concept of
29 H.223 PDUs and just divides the H.223 stream into 160-byte
30 frames. H.223 PDUs are delineated by two-byte magic numbers (which
31 may, of course, straddle an IAX2 frame boundary).
32
33 Essentially we act as a wrapper to reassemble.h, by making up
34 PDU ids and keeping some additional data on fragments to allow the
35 PDUs to be defragmented again.
36*/
37
38
39/* A stream_t represents a stream. There might be one or two streams
40 in a circuit, depending on whether that circuit is mono- or bi-directional.
41*/
42typedef struct stream stream_t;
43
44/* Fragments in a PDU are represented using a stream_pdu_fragment_t,
45 and placed in a linked-list with other fragments in the PDU.
46
47 (They're also placed in a hash so we can find them again later)
48*/
50
51
52struct conversation;
53
54/* initialise a new stream. Call this when you first identify a distinct
55 * stream. The conversation pointer is just used as a key to look up the stream.
56 */
57WS_DLL_PUBLIC stream_t *stream_new ( const struct conversation *conv, int p2p_dir );
58
59/* retrieve a previously-created stream.
60 *
61 * Returns null if no matching stream was found.
62 */
63WS_DLL_PUBLIC stream_t *find_stream ( const struct conversation *conv, int p2p_dir );
64
65
66
67/* see if we've seen this fragment before.
68
69 The framenum and offset are just hash keys, so can be any values unique
70 to this frame, but the idea is that you use the number of the frame being
71 disassembled, and the byte-offset within that frame.
72*/
73WS_DLL_PUBLIC stream_pdu_fragment_t *stream_find_frag( stream_t *stream, uint32_t framenum, uint32_t offset );
74
75/* add a new fragment to the fragment tables for the stream. The framenum and
76 * offset are keys allowing future access with stream_find_frag(), tvb is the
77 * fragment to be added, and pinfo is the information for the frame containing
78 * this fragment. more_frags should be set if this is the final fragment in the
79 * PDU.
80 *
81 * * the fragment must be later in the stream than any previous fragment
82 * (ie, framenum.offset must be greater than those passed on the previous
83 * call)
84 *
85 * This essentially means that you can only add fragments on the first pass
86 * through the stream.
87 */
88WS_DLL_PUBLIC stream_pdu_fragment_t *stream_add_frag( stream_t *stream, uint32_t framenum, uint32_t offset,
89 tvbuff_t *tvb, packet_info *pinfo, bool more_frags );
90
91/* Get the length of a fragment previously found by stream_find_frag().
92 */
93extern uint32_t stream_get_frag_length( const stream_pdu_fragment_t *frag);
94
95/* Get a handle on the top of the chain of fragment_datas underlying this PDU
96 * frag can be any fragment within a PDU, and it will always return the head of
97 * the chain
98 *
99 * Returns NULL until the last fragment is added.
100 */
101extern fragment_head *stream_get_frag_data( const stream_pdu_fragment_t *frag);
102
103/*
104 * Process reassembled data; if this is the last fragment, put the fragment
105 * information into the protocol tree, and construct a tvbuff with the
106 * reassembled data, otherwise just put a "reassembled in" item into the
107 * protocol tree.
108 */
109WS_DLL_PUBLIC tvbuff_t *stream_process_reassembled(
110 tvbuff_t *tvb, int offset, packet_info *pinfo,
111 const char *name, const stream_pdu_fragment_t *frag,
112 const struct _fragment_items *fit,
113 bool *update_col_infop, proto_tree *tree);
114
115/* Get the PDU number. PDUs are numbered from zero within a stream.
116 * frag can be any fragment within a PDU.
117 */
118extern uint32_t stream_get_pdu_no( const stream_pdu_fragment_t *frag);
119
120/* initialise the stream routines */
121void stream_init( void );
122void stream_cleanup( void );
123
124#endif /* STREAM_H */
Definition reassemble.h:64
Definition reassemble.h:524
Definition packet_info.h:43
Definition proto.h:901
Definition conversation.h:223
Definition stream.c:35
Definition stream.c:41
Definition tvbuff-int.h:35