2001-04-01 04:50:42 +00:00
|
|
|
/* packet_info.h
|
|
|
|
* Definitions for packet info structures and routines
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
2001-04-01 04:50:42 +00:00
|
|
|
*
|
2006-05-21 05:12:17 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
2001-04-01 04:50:42 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
2002-08-28 20:41:00 +00:00
|
|
|
*
|
2001-04-01 04:50:42 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 20:41:00 +00:00
|
|
|
*
|
2001-04-01 04:50:42 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 20:41:00 +00:00
|
|
|
*
|
2001-04-01 04:50:42 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
2012-06-28 22:56:06 +00:00
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
2001-04-01 04:50:42 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef __PACKET_INFO_H__
|
|
|
|
#define __PACKET_INFO_H__
|
|
|
|
|
|
|
|
#include "frame_data.h"
|
|
|
|
#include "tvbuff.h"
|
2004-07-19 02:27:17 +00:00
|
|
|
#include "address.h"
|
2002-10-22 08:22:07 +00:00
|
|
|
|
2013-05-30 22:20:21 +00:00
|
|
|
/** @file
|
|
|
|
* Dissected packet data and metadata.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/** @defgroup packetinfo Packet Data and Metadata
|
|
|
|
*
|
|
|
|
* @{
|
|
|
|
*/
|
|
|
|
|
2009-02-16 07:24:04 +00:00
|
|
|
/* Also defined in wiretap/wtap.h */
|
2001-04-01 04:50:42 +00:00
|
|
|
#define P2P_DIR_UNKNOWN -1
|
|
|
|
#define P2P_DIR_SENT 0
|
|
|
|
#define P2P_DIR_RECV 1
|
|
|
|
|
2009-06-06 17:03:34 +00:00
|
|
|
/* Link direction */
|
|
|
|
#define LINK_DIR_UNKNOWN -1
|
|
|
|
#define P2P_DIR_UL 0
|
|
|
|
#define P2P_DIR_DL 1
|
|
|
|
|
2001-04-01 04:50:42 +00:00
|
|
|
typedef struct _packet_info {
|
2012-09-12 10:27:37 +00:00
|
|
|
const char *current_proto; /**< name of protocol currently being dissected */
|
|
|
|
column_info *cinfo; /**< Column formatting information */
|
2001-04-01 04:50:42 +00:00
|
|
|
frame_data *fd;
|
|
|
|
union wtap_pseudo_header *pseudo_header;
|
2012-10-16 21:50:57 +00:00
|
|
|
struct wtap_pkthdr *phdr;
|
2012-09-12 10:27:37 +00:00
|
|
|
GSList *data_src; /**< Frame data sources */
|
|
|
|
address dl_src; /**< link-layer source address */
|
|
|
|
address dl_dst; /**< link-layer destination address */
|
|
|
|
address net_src; /**< network-layer source address */
|
|
|
|
address net_dst; /**< network-layer destination address */
|
|
|
|
address src; /**< source address (net if present, DL otherwise )*/
|
|
|
|
address dst; /**< destination address (net if present, DL otherwise )*/
|
|
|
|
guint32 ipproto; /**< IP protocol, if this is an IP packet */
|
|
|
|
circuit_type ctype; /**< type of circuit, for protocols with a VC identifier */
|
|
|
|
guint32 circuit_id; /**< circuit ID, for protocols with a VC identifier */
|
|
|
|
const char *noreassembly_reason; /**< reason why reassembly wasn't done, if any */
|
|
|
|
gboolean fragmented; /**< TRUE if the protocol is only a fragment */
|
2011-11-08 17:25:22 +00:00
|
|
|
struct {
|
2012-09-12 10:27:37 +00:00
|
|
|
guint32 in_error_pkt:1; /**< TRUE if we're inside an {ICMP,CLNP,...} error packet */
|
|
|
|
guint32 in_gre_pkt:1; /**< TRUE if we're encapsulated inside a GRE packet */
|
2011-11-08 17:25:22 +00:00
|
|
|
} flags;
|
2012-09-12 10:27:37 +00:00
|
|
|
port_type ptype; /**< type of the following two port numbers */
|
|
|
|
guint32 srcport; /**< source port */
|
|
|
|
guint32 destport; /**< destination port */
|
|
|
|
guint32 match_uint; /**< matched uint for calling subdissector from table */
|
|
|
|
const char *match_string; /**< matched string for calling subdissector from table */
|
|
|
|
guint16 can_desegment; /**< >0 if this segment could be desegmented.
|
|
|
|
A dissector that can offer this API (e.g.
|
|
|
|
TCP) sets can_desegment=2, then
|
|
|
|
can_desegment is decremented by 1 each time
|
|
|
|
we pass to the next subdissector. Thus only
|
|
|
|
the dissector immediately above the
|
|
|
|
protocol which sets the flag can use it*/
|
|
|
|
guint16 saved_can_desegment; /**< Value of can_desegment before current
|
|
|
|
dissector was called. Supplied so that
|
|
|
|
dissectors for proxy protocols such as
|
|
|
|
SOCKS can restore it, allowing the
|
|
|
|
dissectors that they call to use the
|
|
|
|
TCP dissector's desegmentation (SOCKS
|
|
|
|
just retransmits TCP segments once it's
|
|
|
|
finished setting things up, so the TCP
|
|
|
|
desegmentor can desegment its payload). */
|
|
|
|
int desegment_offset; /**< offset to stuff needing desegmentation */
|
2006-09-10 14:03:08 +00:00
|
|
|
#define DESEGMENT_ONE_MORE_SEGMENT 0x0fffffff
|
|
|
|
#define DESEGMENT_UNTIL_FIN 0x0ffffffe
|
2012-09-12 10:27:37 +00:00
|
|
|
guint32 desegment_len; /**< requested desegmentation additional length
|
|
|
|
or
|
|
|
|
DESEGMENT_ONE_MORE_SEGMENT:
|
|
|
|
Desegment one more full segment
|
|
|
|
(warning! only partially implemented)
|
|
|
|
DESEGMENT_UNTIL_FIN:
|
|
|
|
Desgment all data for this tcp session
|
|
|
|
until the FIN segment.
|
|
|
|
*/
|
|
|
|
guint16 want_pdu_tracking; /**< >0 if the subdissector has specified
|
|
|
|
a value in 'bytes_until_next_pdu'.
|
|
|
|
When a dissector detects that the next PDU
|
|
|
|
will start beyond the start of the next
|
|
|
|
segment, it can set this value to 2
|
|
|
|
and 'bytes_until_next_pdu' to the number of
|
|
|
|
bytes beyond the next segment where the
|
|
|
|
next PDU starts.
|
|
|
|
|
|
|
|
If the protocol dissector below this
|
|
|
|
one is capable of PDU tracking it can
|
|
|
|
use this hint to detect PDUs that starts
|
|
|
|
unaligned to the segment boundaries.
|
|
|
|
The TCP dissector is using this hint from
|
|
|
|
(some) protocols to detect when a new PDU
|
|
|
|
starts in the middle of a tcp segment.
|
|
|
|
|
|
|
|
There is intelligence in the glue between
|
|
|
|
dissector layers to make sure that this
|
|
|
|
request is only passed down to the protocol
|
|
|
|
immediately below the current one and not
|
|
|
|
any further.
|
|
|
|
*/
|
2003-04-23 10:20:29 +00:00
|
|
|
guint32 bytes_until_next_pdu;
|
|
|
|
|
2012-09-12 10:27:37 +00:00
|
|
|
int p2p_dir; /**< Packet was captured as an
|
2009-05-20 19:29:39 +00:00
|
|
|
outbound (P2P_DIR_SENT)
|
|
|
|
inbound (P2P_DIR_RECV)
|
2005-06-03 06:35:44 +00:00
|
|
|
unknown (P2P_DIR_UNKNOWN) */
|
2005-03-08 09:43:36 +00:00
|
|
|
|
2012-09-12 10:27:37 +00:00
|
|
|
/**< Extra data for handling of decryption of GSSAPI wrapped tvbuffs.
|
2005-03-16 21:59:25 +00:00
|
|
|
Caller sets decrypt_gssapi_tvb if this service is requested.
|
2005-03-08 09:43:36 +00:00
|
|
|
If gssapi_encrypted_tvb is NULL, then the rest of the tvb data following
|
2005-03-16 21:59:25 +00:00
|
|
|
the gssapi blob itself is decrypted othervise the gssapi_encrypted_tvb
|
2005-03-08 09:43:36 +00:00
|
|
|
tvb will be decrypted (DCERPC has the data before the gssapi blob)
|
2005-03-16 21:59:25 +00:00
|
|
|
If, on return, gssapi_data_encrypted is FALSE, the wrapped tvbuff
|
|
|
|
was signed (i.e., an encrypted signature was present, to check
|
|
|
|
whether the data was modified by a man in the middle) but not sealed
|
|
|
|
(i.e., the data itself wasn't encrypted).
|
2005-03-08 09:43:36 +00:00
|
|
|
*/
|
2005-03-10 08:52:59 +00:00
|
|
|
#define DECRYPT_GSSAPI_NORMAL 1
|
|
|
|
#define DECRYPT_GSSAPI_DCE 2
|
|
|
|
guint16 decrypt_gssapi_tvb;
|
2005-03-08 09:43:36 +00:00
|
|
|
tvbuff_t *gssapi_wrap_tvb;
|
|
|
|
tvbuff_t *gssapi_encrypted_tvb;
|
|
|
|
tvbuff_t *gssapi_decrypted_tvb;
|
2005-03-16 21:59:25 +00:00
|
|
|
gboolean gssapi_data_encrypted;
|
2009-05-20 19:29:39 +00:00
|
|
|
|
2012-09-12 10:27:37 +00:00
|
|
|
void *private_data; /**< pointer to data passed from one dissector to another */
|
|
|
|
GHashTable *private_table; /**< a hash table passed from one dissector to another */
|
2013-04-23 17:17:56 +00:00
|
|
|
|
2013-11-05 17:48:48 +00:00
|
|
|
wmem_list_t *layers; /**< layers of each protocol */
|
2013-05-15 16:50:37 +00:00
|
|
|
guint8 curr_layer_num; /**< The current "depth" or layer number in the current frame */
|
2005-05-02 14:07:33 +00:00
|
|
|
guint16 link_number;
|
2013-11-05 17:48:48 +00:00
|
|
|
guint8 annex_a_used; /**< used in packet-mtp2.c
|
2012-09-12 10:27:37 +00:00
|
|
|
* defined in wtap.h
|
|
|
|
* MTP2_ANNEX_A_NOT_USED 0
|
|
|
|
* MTP2_ANNEX_A_USED 1
|
|
|
|
* MTP2_ANNEX_A_USED_UNKNOWN 2
|
|
|
|
*/
|
|
|
|
guint16 profinet_type; /**< the type of PROFINET packet (0: not a PROFINET packet) */
|
2007-02-21 20:21:11 +00:00
|
|
|
|
2007-03-21 00:48:46 +00:00
|
|
|
struct _sccp_msg_info_t* sccp_info;
|
2012-09-12 10:27:37 +00:00
|
|
|
guint16 clnp_srcref; /**< clnp/cotp source reference (can't use srcport, this would confuse tpkt) */
|
|
|
|
guint16 clnp_dstref; /**< clnp/cotp destination reference (can't use dstport, this would confuse tpkt) */
|
|
|
|
|
|
|
|
int link_dir; /**< 3GPP messages are sometime different UP link(UL) or Downlink(DL) */
|
2013-11-23 02:20:13 +00:00
|
|
|
|
|
|
|
GSList* proto_data; /**< Per packet proto data */
|
|
|
|
|
2012-09-12 10:27:37 +00:00
|
|
|
GSList* dependent_frames; /**< A list of frames which this one depends on */
|
2012-09-03 12:00:40 +00:00
|
|
|
|
2013-11-23 02:20:13 +00:00
|
|
|
GSList* frame_end_routines;
|
2012-12-02 17:01:04 +00:00
|
|
|
|
2013-11-05 17:48:48 +00:00
|
|
|
wmem_allocator_t *pool; /**< Memory pool scoped to the pinfo struct */
|
2013-07-21 20:48:30 +00:00
|
|
|
struct epan_session *epan;
|
2013-07-21 23:07:33 +00:00
|
|
|
nstime_t rel_ts; /**< Relative timestamp (yes, it can be negative) */
|
2013-08-01 20:59:38 +00:00
|
|
|
const gchar *pkt_comment; /**< NULL if not available */
|
2001-04-01 04:50:42 +00:00
|
|
|
} packet_info;
|
|
|
|
|
2013-05-30 22:20:21 +00:00
|
|
|
/** @} */
|
|
|
|
|
2001-04-01 04:50:42 +00:00
|
|
|
#endif /* __PACKET_INFO_H__ */
|