in src/filtration/filtration_processor.h [188:263]
void reassemble(PacketInfo& info)
{
uint32_t seq{info.tcp->seq()};
uint32_t len{info.dlen};
if(sequence == 0) // this is the first time we have seen this src's sequence number
{
sequence = seq + len;
if(info.tcp->is(tcp_header::SYN))
{
sequence++;
}
if(len > 0)
{
reader.push(info); // write out the packet data
}
return;
}
// if we are here, we have already seen this src, let's
// try and figure out if this packet is in the right place
if(LT_SEQ(seq, sequence))
{
// this sequence number seems dated, but
// check the end to make sure it has no more
// info than we have already seen
uint32_t newseq{seq + len};
if(GT_SEQ(newseq, sequence))
{
// this one has more than we have seen. let's get the
// payload that we have not seen
uint32_t new_len{sequence - seq};
if(info.dlen <= new_len)
{
info.data = nullptr;
info.dlen = 0;
}
else
{
assert(info.dlen >= new_len);
info.data += new_len;
info.dlen -= new_len;
}
seq = sequence;
len = newseq - sequence;
// this will now appear to be right on time :)
}
}
if(EQ_SEQ(seq, sequence)) // right on time
{
sequence += len;
if(info.tcp->is(tcp_header::SYN)) sequence++;
if(info.data && info.dlen > 0)
{
reader.push(info);
}
// done with the packet, see if it caused a fragment to fit
while(check_fragments(0))
;
}
else // out of order packet
{
if(info.dlen > 0 && GT_SEQ(seq, sequence))
{
//TRACE("ADD FRAGMENT seq: %u dlen: %u sequence: %u", seq, info.dlen, sequence);
fragments = Packet::create(info, fragments);
}
}
}