6 #include <unordered_map>
118 void setStartTime(
const std::chrono::time_point<std::chrono::high_resolution_clock>& startTimeValue);
122 void setEndTime(
const std::chrono::time_point<std::chrono::high_resolution_clock>& endTimeValue);
141 std::chrono::time_point<std::chrono::high_resolution_clock> timestamp)
142 : m_Data(tcpData), m_DataLen(tcpDataLength), m_MissingBytes(missingBytes), m_Connection(connData),
143 m_Timestamp(timestamp)
164 return m_MissingBytes;
191 const uint8_t* m_Data;
193 size_t m_MissingBytes;
195 std::chrono::time_point<std::chrono::high_resolution_clock> m_Timestamp;
385 return m_ConnectionInfo;
406 std::chrono::time_point<std::chrono::high_resolution_clock> timestamp;
408 TcpFragment() : sequence(0), dataLength(0), data(nullptr)
416 struct TcpOneSideData
421 PointerVector<TcpFragment> tcpFragmentList;
424 TcpOneSideData() : srcPort(0), sequence(0), gotFinOrRst(false)
428 struct TcpReassemblyData
433 TcpOneSideData twoSides[2];
434 ConnectionData connData;
436 TcpReassemblyData() : closed(false), numOfSides(0), prevSide(-1)
440 class OutOfOrderProcessingGuard
446 explicit OutOfOrderProcessingGuard(
bool& flag) : m_Flag(flag)
451 ~OutOfOrderProcessingGuard()
457 OutOfOrderProcessingGuard(
const OutOfOrderProcessingGuard&) =
delete;
458 OutOfOrderProcessingGuard& operator=(
const OutOfOrderProcessingGuard&) =
delete;
461 typedef std::unordered_map<uint32_t, TcpReassemblyData> ConnectionList;
462 typedef std::map<time_t, std::list<uint32_t>> CleanupList;
468 ConnectionList m_ConnectionList;
470 CleanupList m_CleanupList;
471 bool m_RemoveConnInfo;
472 uint32_t m_ClosedConnectionDelay;
473 uint32_t m_MaxNumToClean;
474 size_t m_MaxOutOfOrderFragments;
475 time_t m_PurgeTimepoint;
476 bool m_EnableBaseBufferClearCondition;
477 bool m_ProcessingOutOfOrder =
false;
479 void checkOutOfOrderFragments(TcpReassemblyData* tcpReassemblyData, int8_t sideIndex,
bool cleanWholeFragList);
481 void handleFinOrRst(TcpReassemblyData* tcpReassemblyData, int8_t sideIndex, uint32_t flowKey,
bool isRst);
485 void insertIntoCleanupList(uint32_t flowKey);
Definition: IpAddress.h:276
Definition: RawPacket.h:259
Definition: TcpReassembly.h:247
ReassemblyStatus reassemblePacket(RawPacket *tcpRawData)
int isConnectionOpen(const ConnectionData &connection) const
TcpReassembly(OnTcpMessageReady onMessageReadyCallback, void *userCookie=nullptr, OnTcpConnectionStart onConnectionStartCallback=nullptr, OnTcpConnectionEnd onConnectionEndCallback=nullptr, const TcpReassemblyConfiguration &config=TcpReassemblyConfiguration())
ReassemblyStatus
An enum for providing reassembly status for each processed packet.
Definition: TcpReassembly.h:260
@ NonIpPacket
Definition: TcpReassembly.h:299
@ FIN_RSTWithNoData
Definition: TcpReassembly.h:284
@ Error_PacketDoesNotMatchFlow
Definition: TcpReassembly.h:306
@ Ignore_PacketOfClosedFlow
Definition: TcpReassembly.h:293
@ NonTcpPacket
Definition: TcpReassembly.h:302
@ Ignore_Retransimission
Definition: TcpReassembly.h:296
@ TcpMessageHandled
Definition: TcpReassembly.h:270
@ OutOfOrderTcpMessageBuffered
Definition: TcpReassembly.h:280
@ Ignore_PacketWithNoData
Definition: TcpReassembly.h:288
const ConnectionInfoList & getConnectionInformation() const
Definition: TcpReassembly.h:383
void(* OnTcpConnectionStart)(const ConnectionData &connectionData, void *userCookie)
Definition: TcpReassembly.h:326
uint32_t purgeClosedConnections(uint32_t maxNumToClean=0)
void closeAllConnections()
ReassemblyStatus reassemblePacket(Packet &tcpData)
std::unordered_map< uint32_t, ConnectionData > ConnectionInfoList
The type for storing the connection information.
Definition: TcpReassembly.h:310
void(* OnTcpMessageReady)(int8_t side, const TcpStreamData &tcpData, void *userCookie)
Definition: TcpReassembly.h:319
void closeConnection(uint32_t flowKey)
ConnectionEndReason
An enum for connection end reasons.
Definition: TcpReassembly.h:251
@ TcpReassemblyConnectionClosedByFIN_RST
Connection ended because of FIN or RST packet.
Definition: TcpReassembly.h:253
@ TcpReassemblyConnectionClosedManually
Connection ended manually by the user.
Definition: TcpReassembly.h:255
void(* OnTcpConnectionEnd)(const ConnectionData &connectionData, ConnectionEndReason reason, void *userCookie)
Definition: TcpReassembly.h:335
Definition: TcpReassembly.h:132
bool isBytesMissing() const
Definition: TcpReassembly.h:169
size_t getDataLength() const
Definition: TcpReassembly.h:155
timeval getTimeStamp() const
size_t getMissingByteCount() const
Definition: TcpReassembly.h:162
TcpStreamData(const uint8_t *tcpData, size_t tcpDataLength, size_t missingBytes, const ConnectionData &connData, std::chrono::time_point< std::chrono::high_resolution_clock > timestamp)
Definition: TcpReassembly.h:140
std::chrono::time_point< std::chrono::high_resolution_clock > getTimeStampPrecise() const
Definition: TcpReassembly.h:185
const uint8_t * getData() const
Definition: TcpReassembly.h:148
const ConnectionData & getConnectionData() const
Definition: TcpReassembly.h:176
The main namespace for the PcapPlusPlus lib.
Definition: TcpReassembly.h:92
IPAddress srcIP
Source IP address.
Definition: TcpReassembly.h:94
IPAddress dstIP
Destination IP address.
Definition: TcpReassembly.h:96
std::chrono::time_point< std::chrono::high_resolution_clock > startTimePrecise
Start timestamp of the connection with nanosecond precision.
Definition: TcpReassembly.h:108
timeval endTime
End timestamp of the connection with microsecond precision.
Definition: TcpReassembly.h:106
timeval startTime
Start timestamp of the connection with microsecond precision.
Definition: TcpReassembly.h:104
void setStartTime(const std::chrono::time_point< std::chrono::high_resolution_clock > &startTimeValue)
std::chrono::time_point< std::chrono::high_resolution_clock > endTimePrecise
End timestamp of the connection with nanosecond precision.
Definition: TcpReassembly.h:110
uint16_t dstPort
Destination TCP/UDP port.
Definition: TcpReassembly.h:100
uint16_t srcPort
Source TCP/UDP port.
Definition: TcpReassembly.h:98
ConnectionData()
A c'tor for this struct that basically zeros all members.
Definition: TcpReassembly.h:113
uint32_t flowKey
A 4-byte hash key representing the connection.
Definition: TcpReassembly.h:102
void setEndTime(const std::chrono::time_point< std::chrono::high_resolution_clock > &endTimeValue)
Definition: TcpReassembly.h:201
uint32_t closedConnectionDelay
Definition: TcpReassembly.h:208
uint32_t maxNumToClean
Definition: TcpReassembly.h:213
uint32_t maxOutOfOrderFragments
Definition: TcpReassembly.h:218
TcpReassemblyConfiguration(bool removeConnInfo=true, uint32_t closedConnectionDelay=5, uint32_t maxNumToClean=30, uint32_t maxOutOfOrderFragments=0, bool enableBaseBufferClearCondition=true)
Definition: TcpReassembly.h:234
bool enableBaseBufferClearCondition
To enable to clear buffer once packet contains data from a different side than the side seen before.
Definition: TcpReassembly.h:221
bool removeConnInfo
The flag indicating whether to remove the connection data after a connection is closed.
Definition: TcpReassembly.h:203