defrag.h File Reference
#include "tree.h"
#include "util-pool.h"
Include dependency graph for defrag.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  DefragContext_
struct  Frag_
struct  DefragTracker_


typedef struct DefragContext_ DefragContext
typedef struct Frag_ Frag
typedef struct DefragTracker_ DefragTracker


int DefragRbFragCompare (struct Frag_ *a, struct Frag_ *b)
 RB_PROTOTYPE (IP_FRAGMENTS, Frag_, rb, DefragRbFragCompare)
void DefragInit (void)
void DefragDestroy (void)
void DefragReload (void)
uint8_t DefragGetOsPolicy (Packet *)
 Get the defrag policy based on the destination address of the packet. More...
void DefragTrackerFreeFrags (DefragTracker *)
 Free all frags associated with a tracker. More...
PacketDefrag (ThreadVars *, DecodeThreadVars *, Packet *, PacketQueue *)
 Entry point for IPv4 and IPv6 fragments. More...
void DefragRegisterTests (void)

Detailed Description

Endace Technology Limited, Jason Ish

Definition in file defrag.h.

Typedef Documentation

typedef struct DefragContext_ DefragContext

A context for an instance of a fragmentation re-assembler, in case we ever need more than one.

typedef struct DefragTracker_ DefragTracker

A defragmentation tracker. Used to track fragments that make up a single packet.

typedef struct Frag_ Frag

Storage for an individual fragment.

Function Documentation

Packet* Defrag ( ThreadVars tv,
DecodeThreadVars dtv,
Packet p,
PacketQueue pq 

Entry point for IPv4 and IPv6 fragments.

tvThreadVars for the calling decoder.
pThe packet fragment.
Return values
Anew Packet resembling the re-assembled packet if the most recent fragment allowed the packet to be re-assembled, otherwise NULL is returned.

Definition at line 999 of file defrag.c.

References af, DecodeThreadVars_::counter_defrag_ipv4_fragments, DecodeThreadVars_::counter_defrag_ipv6_fragments, DefragTrackerRelease(), IPV4_GET_IPOFFSET, IPV4_GET_MF, IPV6_EXTHDR_GET_FH_FLAG, IPV6_EXTHDR_GET_FH_OFFSET, PKT_IS_IPV4, PKT_IS_IPV6, and StatsIncr().

Referenced by DecodeIPV4(), and DecodeIPV6().

Here is the call graph for this function:

Here is the caller graph for this function:

void DefragDestroy ( void  )

Definition at line 1067 of file defrag.c.

References DefragHashShutdown(), and DefragTreeDestroy().

Referenced by DecodeIPV4(), DecodeIPV6(), and PostRunDeinit().

Here is the call graph for this function:

Here is the caller graph for this function:

void DefragInit ( void  )

Definition at line 1045 of file defrag.c.

References ConfGetInt(), DEFAULT_DEFRAG_HASH_SIZE, DefragInitConfig(), DefragPolicyLoadFromConfig(), DefragSetDefaultTimeout(), FALSE, SC_ERR_MEM_ALLOC, SCLogError, and DefragContext_::timeout.

Referenced by DecodeIPV4(), DecodeIPV6(), and PreRunInit().

Here is the call graph for this function:

Here is the caller graph for this function:

int DefragRbFragCompare ( struct Frag_ a,
struct Frag_ b 

The RB_TREE compare function for fragments.

When it comes to adding fragments, we want subsequent ones with the same offset to be treated as greater than, so we don't have an equal return value here.

Definition at line 499 of file defrag.c.

References DefragTracker_::af, af, DecodeThreadVars_::counter_defrag_ipv4_reassembled, DecodeThreadVars_::counter_defrag_ipv6_reassembled, Frag_::data_len, DecodeIPV4(), DecodeIPV6(), DEFRAG_POLICY_BSD, DEFRAG_POLICY_FIRST, DEFRAG_POLICY_LAST, DEFRAG_POLICY_LINUX, DEFRAG_POLICY_SOLARIS, DEFRAG_POLICY_WINDOWS, ENGINE_SET_EVENT, IPV6ExtHdrs_::fh_data_len, IPV6ExtHdrs_::fh_data_offset, IPV6ExtHdrs_::fh_header_offset, IPV6ExtHdrs_::fh_prev_hdr_offset, DefragContext_::frag_pool, DefragContext_::frag_pool_lock, DefragTracker_::fragment_tree, GET_PKT_DATA, GET_PKT_LEN, DefragTracker_::host_timeout, Packet_::ip4h, Packet_::ip6eh, Packet_::ip6h, IPV4_FRAG_IGNORED, IPV4_FRAG_OVERLAP, IPV4_FRAG_PKT_TOO_LARGE, IPV4_GET_HLEN, IPV4_GET_IPLEN, IPV4_GET_IPOFFSET, IPV4_GET_MF, IPV4_HEADER_LEN, IPV4_MAXPACKET_LEN, IPV6_EXTHDR_GET_FH_FLAG, IPV6_EXTHDR_GET_FH_NH, IPV6_EXTHDR_GET_FH_OFFSET, IPV6_FRAG_IGNORED, IPV6_FRAG_OVERLAP, IPV6_FRAG_PKT_TOO_LARGE, IPV6_GET_PLEN, IPV6_HEADER_LEN, IPV6_MAXPACKET, Frag_::ltrim, next, Frag_::offset, offset, PacketDefragPktSetupParent(), Packet_::pcap_cnt, DefragTracker_::policy, PoolGet(), PoolReturn(), RB_EMPTY, RB_MIN, RB_NFIND, RB_REMOVE, Packet_::root, SC_ERR_INVALID_ARGUMENT, SCLogDebug, SCLogWarning, SCMalloc, SCMutexLock, SCMutexUnlock, DefragTracker_::seen_last, Frag_::skip, StatsIncr(), DefragTracker_::timeout, TM_ECODE_OK, TmqhOutputPacketpool(), Packet_::ts, and UNSET_TUNNEL_PKT.

Here is the call graph for this function:

void DefragRegisterTests ( void  )

Definition at line 2461 of file defrag.c.

References UtRegisterTest().

Here is the call graph for this function:

void DefragReload ( void  )

use only in unittests

Frag_  ,
rb  ,