2011-05-27 03:06:50 +00:00
|
|
|
/* tvbuff-int.h
|
|
|
|
*
|
|
|
|
* Structures that most TVB users should not be accessing directly.
|
|
|
|
*
|
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
2018-02-08 16:59:17 +00:00
|
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
2011-05-27 03:06:50 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef __TVBUFF_INT_H__
|
|
|
|
#define __TVBUFF_INT_H__
|
|
|
|
|
2013-07-10 18:14:15 +00:00
|
|
|
struct tvbuff;
|
|
|
|
|
|
|
|
struct tvb_ops {
|
2013-08-04 22:02:42 +00:00
|
|
|
gsize tvb_size;
|
2013-07-10 18:14:15 +00:00
|
|
|
void (*tvb_free)(struct tvbuff *tvb);
|
|
|
|
guint (*tvb_offset)(const struct tvbuff *tvb, guint counter);
|
2013-07-10 18:25:24 +00:00
|
|
|
const guint8 *(*tvb_get_ptr)(struct tvbuff *tvb, guint abs_offset, guint abs_length);
|
|
|
|
void *(*tvb_memcpy)(struct tvbuff *tvb, void *target, guint offset, guint length);
|
2013-07-10 18:14:15 +00:00
|
|
|
|
|
|
|
gint (*tvb_find_guint8)(tvbuff_t *tvb, guint abs_offset, guint limit, guint8 needle);
|
2015-02-21 20:39:00 +00:00
|
|
|
gint (*tvb_ws_mempbrk_pattern_guint8)(tvbuff_t *tvb, guint abs_offset, guint limit, const ws_mempbrk_pattern* pattern, guchar *found_needle);
|
2013-07-13 17:53:33 +00:00
|
|
|
|
|
|
|
tvbuff_t *(*tvb_clone)(tvbuff_t *tvb, guint abs_offset, guint abs_length);
|
2013-07-10 18:14:15 +00:00
|
|
|
};
|
|
|
|
|
When we're dissecting the beginning of a fragmented packet that we
haven't reassembled, we're probably moving sequentially through the
packet, which means that we'll run past the end of the fragment rather
than past the end of what would have been the reassembled packet had we
reassembled it.
I.e., there's little reason to care whether we're past the end of the
fragment but not past the end of the packet, or whether we're past the
end of the packet; in either case, we're past the end of the fragment,
and if somebody wants to know whether the packet is malformed by
stopping short of certain fields, they should enable reassembly.
So we get rid of the explicit fragment length in tvbuffs and, instead,
have a "this is a fragment" flag; if that flag is set, we throw
FragmentBoundsError rather than ReportedBoundsError if we run past the
end of the reported data.
(This also means we could flag the tvbuff even if we don't know how
large the reassembled packet will be, e.g. when doing IP reassembly.)
Replace tvb_new_subset_length_fragment() with tvb_new_subset_length()
and a new "set the "this is a fragment flag"" routine.
svn path=/trunk/; revision=48940
2013-04-20 02:53:57 +00:00
|
|
|
/*
|
|
|
|
* Tvbuff flags.
|
|
|
|
*/
|
|
|
|
#define TVBUFF_FRAGMENT 0x00000001 /* this is a fragment */
|
|
|
|
|
2011-05-27 03:06:50 +00:00
|
|
|
struct tvbuff {
|
2011-12-21 17:39:02 +00:00
|
|
|
/* Doubly linked list pointers */
|
|
|
|
tvbuff_t *next;
|
|
|
|
|
2011-05-27 03:06:50 +00:00
|
|
|
/* Record-keeping */
|
2013-07-10 18:14:15 +00:00
|
|
|
const struct tvb_ops *ops;
|
2011-05-27 03:06:50 +00:00
|
|
|
gboolean initialized;
|
When we're dissecting the beginning of a fragmented packet that we
haven't reassembled, we're probably moving sequentially through the
packet, which means that we'll run past the end of the fragment rather
than past the end of what would have been the reassembled packet had we
reassembled it.
I.e., there's little reason to care whether we're past the end of the
fragment but not past the end of the packet, or whether we're past the
end of the packet; in either case, we're past the end of the fragment,
and if somebody wants to know whether the packet is malformed by
stopping short of certain fields, they should enable reassembly.
So we get rid of the explicit fragment length in tvbuffs and, instead,
have a "this is a fragment" flag; if that flag is set, we throw
FragmentBoundsError rather than ReportedBoundsError if we run past the
end of the reported data.
(This also means we could flag the tvbuff even if we don't know how
large the reassembled packet will be, e.g. when doing IP reassembly.)
Replace tvb_new_subset_length_fragment() with tvb_new_subset_length()
and a new "set the "this is a fragment flag"" routine.
svn path=/trunk/; revision=48940
2013-04-20 02:53:57 +00:00
|
|
|
guint flags;
|
2011-05-27 03:06:50 +00:00
|
|
|
struct tvbuff *ds_tvb; /**< data source top-level tvbuff */
|
|
|
|
|
2018-04-20 02:56:34 +00:00
|
|
|
/** Pointer to the data for this tvbuff.
|
|
|
|
* It might be null, which either means that 1) it's a
|
|
|
|
* zero-length tvbuff or 2) the tvbuff was lazily
|
|
|
|
* constructed, so that we don't allocate a buffer of
|
|
|
|
* backing data and fill it in unless we need that
|
|
|
|
* data, e.g. when tvb_get_ptr() is called.
|
2011-05-27 03:06:50 +00:00
|
|
|
*/
|
|
|
|
const guint8 *real_data;
|
|
|
|
|
2018-04-20 02:56:34 +00:00
|
|
|
/** Amount of data that's available from the capture
|
|
|
|
* file. This is the length of virtual buffer (and/or
|
|
|
|
* real_data). It may be less than the reported
|
|
|
|
* length if this is from a packet that was cut short
|
2018-04-20 03:18:10 +00:00
|
|
|
* by the capture process.
|
|
|
|
*
|
|
|
|
* This must never be > reported_length or contained_length. */
|
2011-05-27 03:06:50 +00:00
|
|
|
guint length;
|
|
|
|
|
2018-04-20 02:56:34 +00:00
|
|
|
/** Amount of data that was reported as being in
|
|
|
|
* the packet or other data that this represents.
|
|
|
|
* As indicated above, it may be greater than the
|
|
|
|
* amount of data that's available. */
|
2011-05-27 03:06:50 +00:00
|
|
|
guint reported_length;
|
|
|
|
|
2018-04-20 03:18:10 +00:00
|
|
|
/** If this was extracted from a parent tvbuff,
|
|
|
|
* this is the amount of extracted data that
|
|
|
|
* was reported as being in the parent tvbuff;
|
|
|
|
* if this represents a blob of data in that
|
|
|
|
* tvbuff that has a length specified by data
|
|
|
|
* in that tvbuff, it might be greater than
|
|
|
|
* the amount of data that was actually there
|
|
|
|
* to extract, so it could be greater than
|
|
|
|
* reported_length.
|
|
|
|
*
|
|
|
|
* If this wasn't extracted from a parent tvbuff,
|
|
|
|
* this is the same as reported_length.
|
|
|
|
*
|
|
|
|
* This must never be > reported_length. */
|
|
|
|
guint contained_length;
|
|
|
|
|
2018-04-20 02:56:34 +00:00
|
|
|
/* Offset from beginning of first "real" tvbuff. */
|
2011-05-27 03:06:50 +00:00
|
|
|
gint raw_offset;
|
2013-07-10 19:08:02 +00:00
|
|
|
};
|
|
|
|
|
2013-07-13 17:53:33 +00:00
|
|
|
WS_DLL_PUBLIC tvbuff_t *tvb_new(const struct tvb_ops *ops);
|
2013-07-10 19:08:02 +00:00
|
|
|
|
2013-07-14 14:42:05 +00:00
|
|
|
tvbuff_t *tvb_new_proxy(tvbuff_t *backing);
|
2013-07-14 08:41:04 +00:00
|
|
|
|
2013-07-14 07:42:19 +00:00
|
|
|
void tvb_add_to_chain(tvbuff_t *parent, tvbuff_t *child);
|
|
|
|
|
|
|
|
guint tvb_offset_from_real_beginning_counter(const tvbuff_t *tvb, const guint counter);
|
|
|
|
|
|
|
|
void tvb_check_offset_length(const tvbuff_t *tvb, const gint offset, gint const length_val, guint *offset_ptr, guint *length_ptr);
|
2011-05-27 03:06:50 +00:00
|
|
|
#endif
|