TcpReassembly.h

Go to the documentation of this file.

#ifndef PACKETPP_TCP_REASSEMBLY
#define PACKETPP_TCP_REASSEMBLY
 
#include "Packet.h"
#include "IpAddress.h"
#include "PointerVector.h"
#include <map>
#include <list>
#include <time.h>
 
 
namespace pcpp
{
 
struct ConnectionData
{
    IPAddress* srcIP;
    IPAddress* dstIP;
    uint16_t srcPort;
    uint16_t dstPort;
    uint32_t flowKey;
    timeval startTime;
    timeval endTime;
 
    ConnectionData() : srcIP(NULL), dstIP(NULL), srcPort(0), dstPort(0), flowKey(0), startTime(), endTime()  {}
 
    ~ConnectionData();
 
    ConnectionData(const ConnectionData& other);
 
    ConnectionData& operator=(const ConnectionData& other);
 
    void setSrcIpAddress(const IPAddress* sourceIP) { srcIP = sourceIP->clone(); }
 
    void setDstIpAddress(const IPAddress* destIP) { dstIP = destIP->clone(); }
 
    void setStartTime(const timeval &startTime) { this->startTime = startTime; }
 
    void setEndTime(const timeval &endTime) { this->endTime = endTime; }
 
private:
 
    void copyData(const ConnectionData& other);
};
 
 
class TcpReassembly;
 
 
class TcpStreamData
{
public:
    TcpStreamData(const uint8_t* tcpData, size_t tcpDataLength, const ConnectionData& connData)
        : m_Data(tcpData), m_DataLen(tcpDataLength), m_Connection(connData)
    {
    }
 
    const uint8_t* getData() const { return m_Data; }
 
    size_t getDataLength() const { return m_DataLen; }
 
    const ConnectionData& getConnectionData() const { return m_Connection; }
 
private:
    const uint8_t* m_Data;
    size_t m_DataLen;
    const ConnectionData& m_Connection;
};
 
 
struct TcpReassemblyConfiguration
{
    bool removeConnInfo;
 
    uint32_t closedConnectionDelay;
 
    uint32_t maxNumToClean;
 
    TcpReassemblyConfiguration(bool removeConnInfo = true, uint32_t closedConnectionDelay = 5, uint32_t maxNumToClean = 30) :
        removeConnInfo(removeConnInfo), closedConnectionDelay(closedConnectionDelay), maxNumToClean(maxNumToClean)
    {
    }
};
 
 
class TcpReassembly
{
public:
 
    enum ConnectionEndReason
    {
        TcpReassemblyConnectionClosedByFIN_RST,
        TcpReassemblyConnectionClosedManually
    };
 
    typedef std::map<uint32_t, ConnectionData> ConnectionInfoList;
 
    typedef void (*OnTcpMessageReady)(int side, const TcpStreamData& tcpData, void* userCookie);
 
    typedef void (*OnTcpConnectionStart)(const ConnectionData& connectionData, void* userCookie);
 
    typedef void (*OnTcpConnectionEnd)(const ConnectionData& connectionData, ConnectionEndReason reason, void* userCookie);
 
    TcpReassembly(OnTcpMessageReady onMessageReadyCallback, void* userCookie = NULL, OnTcpConnectionStart onConnectionStartCallback = NULL, OnTcpConnectionEnd onConnectionEndCallback = NULL, const TcpReassemblyConfiguration &config = TcpReassemblyConfiguration());
 
    ~TcpReassembly();
 
    void reassemblePacket(Packet& tcpData);
 
    void reassemblePacket(RawPacket* tcpRawData);
 
    void closeConnection(uint32_t flowKey);
 
    void closeAllConnections();
 
    const ConnectionInfoList& getConnectionInformation() const { return m_ConnectionInfo; }
 
    int isConnectionOpen(const ConnectionData& connection) const;
 
    uint32_t purgeClosedConnections(uint32_t maxNumToClean = 0);
 
private:
    struct TcpFragment
    {
        uint32_t sequence;
        size_t dataLength;
        uint8_t* data;
 
        TcpFragment() { sequence = 0; dataLength = 0; data = NULL; }
        ~TcpFragment() { if (data != NULL) delete [] data; }
    };
 
    struct TcpOneSideData
    {
        IPAddress* srcIP;
        uint16_t srcPort;
        uint32_t sequence;
        PointerVector<TcpFragment> tcpFragmentList;
        bool gotFinOrRst;
 
        void setSrcIP(IPAddress* sourrcIP);
 
        TcpOneSideData() { srcIP = NULL; srcPort = 0; sequence = 0; gotFinOrRst = false; }
 
        ~TcpOneSideData() { if (srcIP != NULL) delete srcIP; }
    };
 
    struct TcpReassemblyData
    {
        int numOfSides;
        int prevSide;
        TcpOneSideData twoSides[2];
        ConnectionData connData;
 
        TcpReassemblyData() { numOfSides = 0; prevSide = -1; }
    };
    
    typedef std::map<uint32_t, TcpReassemblyData *> ConnectionList;
    typedef std::map<time_t, std::list<uint32_t> > CleanupList;
 
    OnTcpMessageReady m_OnMessageReadyCallback;
    OnTcpConnectionStart m_OnConnStart;
    OnTcpConnectionEnd m_OnConnEnd;
    void* m_UserCookie;
    ConnectionList m_ConnectionList;
    ConnectionInfoList m_ConnectionInfo;
    CleanupList m_CleanupList;
    bool m_RemoveConnInfo;
    uint32_t m_ClosedConnectionDelay;
    uint32_t m_MaxNumToClean;
    time_t m_PurgeTimepoint;
 
    void checkOutOfOrderFragments(TcpReassemblyData* tcpReassemblyData, int sideIndex, bool cleanWholeFragList);
 
    std::string prepareMissingDataMessage(uint32_t missingDataLen);
 
    void handleFinOrRst(TcpReassemblyData* tcpReassemblyData, int sideIndex, uint32_t flowKey);
 
    void closeConnectionInternal(uint32_t flowKey, ConnectionEndReason reason);
 
    void insertIntoCleanupList(uint32_t flowKey);
};
 
}
 
#endif /* PACKETPP_TCP_REASSEMBLY */