feat: added header definitions for functions handling the stream reassembly in utils/pcap.h

2 files changed, 60 insertions, 1 deletions

diff --git a/analyzer/utils/pcap.c b/analyzer/utils/pcap.c
index 5e9b611..d9687b3 100644
--- a/analyzer/utils/pcap.c
+++ b/analyzer/utils/pcap.c
@@ -37,3 +37,21 @@ const unsigned char *get_payload_from_packet(const unsigned char *packet, const
     *payload_len = packet_data->caplen - total_header_len;
     return packet + total_header_len;
 }
+
+PendingPayload new_pending(const unsigned char *payload, int payload_len) {
+    // TODO: impement
+    PendingPayload tmp;
+    return tmp;
+}
+
+unsigned char *free_parsed_data(unsigned char *stream, uint32_t stream_seq, int stream_len, int parsed_len) {
+    // TODO: impement
+    return NULL;
+}
+
+int add_segment_to_stream(
+    unsigned char *stream, uint32_t stream_seq, int stream_len, const unsigned char *payload, uint32_t payload_seq, int payload_len, HashMap *pending
+) {
+    // TODO: impement
+    return 0;
+}
diff --git a/analyzer/utils/pcap.h b/analyzer/utils/pcap.h
index 16da7cd..a423083 100644
--- a/analyzer/utils/pcap.h
+++ b/analyzer/utils/pcap.h
@@ -1,8 +1,10 @@
 // utils/pcap.h
-// helper functions for usage of libpcap
+// helper functions for usage of libpcap and for handling TCP segments in general
 
 #include <pcap.h>
 
+#include "hashmap.h"
+
 // get payload from a TCP/IP packet
 // params:
 //      - packet - captured packet
@@ -12,3 +14,42 @@
 // returns:
 //      pointer to the payload or NULL if not a correct packet
 extern const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len, uint32_t *tcp_seq);
+
+// struct to persistently store pending payloads
+typedef struct {
+    unsigned char *payload;
+    int payload_len;
+} PendingPayload;
+
+// store persistently and return a PendingPayload, the payload is malloced and needs to be freed
+// params:
+//      - payload - payload to store
+//      - payload_len - length of the payload to store
+// returns:
+//      PendingPayload struct with stored payload
+extern PendingPayload new_pending(const unsigned char *payload, int payload_len);
+
+// remove parsed part of the stream from memory and return only unparsed part
+// params:
+//      - stream - stream to free a part of
+//      - stream_seq - pointer to the current TCP sequence number at the beginning of the stream, updated to the new one in the function
+//      - stream_len - pointer to the current stream length, updated to the new length in the function
+//      - parsed_len - count of n first bytes of the stream that were parsed
+// returns:
+//      pointer to the new, reduced stream
+extern unsigned char *free_parsed_data(unsigned char *stream, uint32_t stream_seq, int stream_len, int parsed_len);
+
+// add TCP segment to stream
+// params:
+//      - stream - current stream
+//      - stream_seq - TCP sequence number at the beginning of the stream
+//      - stream_len - current length of the stream
+//      - payload - payload to add to stream
+//      - payload_seq - payload TCP sequence number
+//      - payload_len - length of the payload
+//      - pending - hashmap (seq -> PendingPayload) of pending payloads to be added to stream
+// returns:
+//      1 if the payload was added to the stream, 0 if it was discarded or saved to pending
+extern int add_segment_to_stream(
+    unsigned char *stream, uint32_t stream_seq, int stream_len, const unsigned char *payload, uint32_t payload_seq, int payload_len, HashMap *pending
+);