PcapPlusPlus  22.11
TcpReassembly.h
Go to the documentation of this file.
1 #ifndef PACKETPP_TCP_REASSEMBLY
2 #define PACKETPP_TCP_REASSEMBLY
3 
4 #include "Packet.h"
5 #include "IpAddress.h"
6 #include "PointerVector.h"
7 #include <map>
8 #include <list>
9 #include <time.h>
10 
11 
72 namespace pcpp
73 {
74 
80 {
86  uint16_t srcPort;
88  uint16_t dstPort;
90  uint32_t flowKey;
92  timeval startTime;
94  timeval endTime;
95 
99  ConnectionData() : srcPort(0), dstPort(0), flowKey(0), startTime(), endTime() {}
100 
105  void setStartTime(const timeval &startTime) { this->startTime = startTime; }
106 
111  void setEndTime(const timeval &endTime) { this->endTime = endTime; }
112 };
113 
114 
115 class TcpReassembly;
116 
117 
124 {
125 public:
134  TcpStreamData(const uint8_t* tcpData, size_t tcpDataLength, size_t missingBytes, const ConnectionData& connData, timeval timestamp)
135  : m_Data(tcpData), m_DataLen(tcpDataLength), m_MissingBytes(missingBytes), m_Connection(connData), m_Timestamp(timestamp)
136  {
137  }
138 
143  const uint8_t* getData() const { return m_Data; }
144 
149  size_t getDataLength() const { return m_DataLen; }
150 
155  size_t getMissingByteCount() const { return m_MissingBytes; }
156 
161  bool isBytesMissing() const { return getMissingByteCount() > 0; }
162 
167  const ConnectionData& getConnectionData() const { return m_Connection; }
168 
173  timeval getTimeStamp() const { return m_Timestamp; }
174 
175 private:
176  const uint8_t* m_Data;
177  size_t m_DataLen;
178  size_t m_MissingBytes;
179  const ConnectionData& m_Connection;
180  timeval m_Timestamp;
181 };
182 
183 
189 {
192 
197 
201  uint32_t maxNumToClean;
202 
207 
211 
220  TcpReassemblyConfiguration(bool removeConnInfo = true, uint32_t closedConnectionDelay = 5, uint32_t maxNumToClean = 30, uint32_t maxOutOfOrderFragments = 0,
221  bool enableBaseBufferClearCondition = true) : removeConnInfo(removeConnInfo), closedConnectionDelay(closedConnectionDelay), maxNumToClean(maxNumToClean), maxOutOfOrderFragments(maxOutOfOrderFragments), enableBaseBufferClearCondition(enableBaseBufferClearCondition)
222  {
223  }
224 };
225 
226 
232 {
233 public:
234 
239  {
243  TcpReassemblyConnectionClosedManually
244  };
245 
250  {
306  };
307 
311  typedef std::map<uint32_t, ConnectionData> ConnectionInfoList;
312 
320  typedef void (*OnTcpMessageReady)(int8_t side, const TcpStreamData& tcpData, void* userCookie);
321 
328  typedef void (*OnTcpConnectionStart)(const ConnectionData& connectionData, void* userCookie);
329 
337  typedef void (*OnTcpConnectionEnd)(const ConnectionData& connectionData, ConnectionEndReason reason, void* userCookie);
338 
347  TcpReassembly(OnTcpMessageReady onMessageReadyCallback, void* userCookie = NULL, OnTcpConnectionStart onConnectionStartCallback = NULL, OnTcpConnectionEnd onConnectionEndCallback = NULL, const TcpReassemblyConfiguration &config = TcpReassemblyConfiguration());
348 
355  ReassemblyStatus reassemblePacket(Packet& tcpData);
356 
363  ReassemblyStatus reassemblePacket(RawPacket* tcpRawData);
364 
370  void closeConnection(uint32_t flowKey);
371 
376  void closeAllConnections();
377 
382  const ConnectionInfoList& getConnectionInformation() const { return m_ConnectionInfo; }
383 
389  int isConnectionOpen(const ConnectionData& connection) const;
390 
396  uint32_t purgeClosedConnections(uint32_t maxNumToClean = 0);
397 
398 private:
399  struct TcpFragment
400  {
401  uint32_t sequence;
402  size_t dataLength;
403  uint8_t* data;
404  timeval timestamp;
405 
406  TcpFragment() : sequence(0), dataLength(0), data(NULL) {}
407  ~TcpFragment() { delete [] data; }
408  };
409 
410  struct TcpOneSideData
411  {
413  uint16_t srcPort;
414  uint32_t sequence;
415  PointerVector<TcpFragment> tcpFragmentList;
416  bool gotFinOrRst;
417 
418  TcpOneSideData() : srcPort(0), sequence(0), gotFinOrRst(false) {}
419  };
420 
421  struct TcpReassemblyData
422  {
423  bool closed;
424  int8_t numOfSides;
425  int8_t prevSide;
426  TcpOneSideData twoSides[2];
427  ConnectionData connData;
428 
429  TcpReassemblyData() : closed(false), numOfSides(0), prevSide(-1) {}
430  };
431 
432  typedef std::map<uint32_t, TcpReassemblyData> ConnectionList;
433  typedef std::map<time_t, std::list<uint32_t> > CleanupList;
434 
435  OnTcpMessageReady m_OnMessageReadyCallback;
436  OnTcpConnectionStart m_OnConnStart;
437  OnTcpConnectionEnd m_OnConnEnd;
438  void* m_UserCookie;
439  ConnectionList m_ConnectionList;
440  ConnectionInfoList m_ConnectionInfo;
441  CleanupList m_CleanupList;
442  bool m_RemoveConnInfo;
443  uint32_t m_ClosedConnectionDelay;
444  uint32_t m_MaxNumToClean;
445  size_t m_MaxOutOfOrderFragments;
446  time_t m_PurgeTimepoint;
447  bool m_EnableBaseBufferClearCondition;
448 
449  void checkOutOfOrderFragments(TcpReassemblyData* tcpReassemblyData, int8_t sideIndex, bool cleanWholeFragList);
450 
451  void handleFinOrRst(TcpReassemblyData* tcpReassemblyData, int8_t sideIndex, uint32_t flowKey, bool isRst);
452 
453  void closeConnectionInternal(uint32_t flowKey, ConnectionEndReason reason);
454 
455  void insertIntoCleanupList(uint32_t flowKey);
456 };
457 
458 }
459 
460 #endif /* PACKETPP_TCP_REASSEMBLY */
The main namespace for the PcapPlusPlus lib.
std::map< uint32_t, ConnectionData > ConnectionInfoList
Definition: TcpReassembly.h:311
Definition: TcpReassembly.h:284
ConnectionData()
Definition: TcpReassembly.h:99
timeval getTimeStamp() const
Definition: TcpReassembly.h:173
TcpReassemblyConfiguration(bool removeConnInfo=true, uint32_t closedConnectionDelay=5, uint32_t maxNumToClean=30, uint32_t maxOutOfOrderFragments=0, bool enableBaseBufferClearCondition=true)
Definition: TcpReassembly.h:220
const ConnectionInfoList & getConnectionInformation() const
Definition: TcpReassembly.h:382
uint16_t srcPort
Definition: TcpReassembly.h:86
ConnectionEndReason
Definition: TcpReassembly.h:238
const ConnectionData & getConnectionData() const
Definition: TcpReassembly.h:167
Definition: Packet.h:26
timeval endTime
Definition: TcpReassembly.h:94
IPAddress dstIP
Definition: TcpReassembly.h:84
Definition: TcpReassembly.h:188
Definition: RawPacket.h:252
Definition: TcpReassembly.h:231
Definition: TcpReassembly.h:299
const uint8_t * getData() const
Definition: TcpReassembly.h:143
uint16_t dstPort
Definition: TcpReassembly.h:88
uint32_t closedConnectionDelay
Definition: TcpReassembly.h:196
uint32_t maxNumToClean
Definition: TcpReassembly.h:201
bool enableBaseBufferClearCondition
Definition: TcpReassembly.h:210
TcpStreamData(const uint8_t *tcpData, size_t tcpDataLength, size_t missingBytes, const ConnectionData &connData, timeval timestamp)
Definition: TcpReassembly.h:134
uint32_t maxOutOfOrderFragments
Definition: TcpReassembly.h:206
Definition: TcpReassembly.h:294
ReassemblyStatus
Definition: TcpReassembly.h:249
void setEndTime(const timeval &endTime)
Definition: TcpReassembly.h:111
Definition: TcpReassembly.h:259
uint32_t flowKey
Definition: TcpReassembly.h:90
size_t getMissingByteCount() const
Definition: TcpReassembly.h:155
bool removeConnInfo
Definition: TcpReassembly.h:191
Definition: TcpReassembly.h:123
bool isBytesMissing() const
Definition: TcpReassembly.h:161
Definition: TcpReassembly.h:279
timeval startTime
Definition: TcpReassembly.h:92
size_t getDataLength() const
Definition: TcpReassembly.h:149
Definition: TcpReassembly.h:79
Definition: IpAddress.h:278
IPAddress srcIP
Definition: TcpReassembly.h:82
void setStartTime(const timeval &startTime)
Definition: TcpReassembly.h:105
Definition: TcpReassembly.h:289
Definition: TcpReassembly.h:273