| 1 | README: |
|---|
| 2 | ====== |
|---|
| 3 | |
|---|
| 4 | For each protocol layer: |
|---|
| 5 | - Dispatcher instanciates a new Dissector for this layer. |
|---|
| 6 | - Dispatcher asks Dissector to parse the captured packet. |
|---|
| 7 | - Dissector determines if packet must be reassembled. |
|---|
| 8 | - If reassembly is required, packet is tranfered to reassembly, |
|---|
| 9 | which may result in a complete packet |
|---|
| 10 | - If packet is complete, then dispatch filters are querried to |
|---|
| 11 | eliminate components for which this packet is not suitable |
|---|
| 12 | - Upper layer dispatcher is selected based on Dissector information |
|---|
| 13 | (Implicitely registered Upper Layers) or based on Upper Layer |
|---|
| 14 | Filters (Explicitely registered Upper Layers). Packet and component |
|---|
| 15 | list are transmitted to first available Upper Layer Dispatcher. |
|---|
| 16 | - If no Upper Layer Dispatcher is available, then payload and |
|---|
| 17 | component list are returned. |
|---|
| 18 | |
|---|
| 19 | |
|---|
| 20 | Dispatchers are Singletons, and all inherit from Dispatcher class. |
|---|
| 21 | |
|---|
| 22 | Dispatcher |
|---|
| 23 | ^---EthernetDispatcher |
|---|
| 24 | |---IpDispatcher |
|---|
| 25 | |---TcpDispatcher |
|---|
| 26 | |---UdpDispatcher |
|---|
| 27 | |---SipDispatcher |
|---|
| 28 | |---... |
|---|
| 29 | |
|---|
| 30 | Dispatcher instances can be retrieved via pseudo-factory DispatcherFactory |
|---|
| 31 | using method Get("<Layer>"). |
|---|
| 32 | Example: DispatcherFactory::Instance().Get("UDP"); |
|---|
| 33 | |
|---|
| 34 | |
|---|
| 35 | Dissectors all inherits from Dissectors |
|---|
| 36 | |
|---|
| 37 | Dissector |
|---|
| 38 | ^---EthernetDissector |
|---|
| 39 | |---IpDissector |
|---|
| 40 | |---TcpDissector |
|---|
| 41 | |---UdpDissector |
|---|
| 42 | |---SipDissector |
|---|
| 43 | |---... |
|---|
| 44 | |
|---|
| 45 | Dissectors are created via DissectorFactory using method Create(<Layer>). |
|---|
| 46 | Example: DissectorFactory::Instance().Create("Ethernet"); |
|---|
| 47 | |
|---|
| 48 | |
|---|
| 49 | TODO: |
|---|
| 50 | ==== |
|---|
| 51 | |
|---|
| 52 | * Implement Dispatch filters: |
|---|
| 53 | => Dispatch filters are created using Dispatcher's RegisterFilter() |
|---|
| 54 | method. |
|---|
| 55 | => Each Dispatch filter should be associated with a ComponentId. |
|---|
| 56 | => the Match() method should receive a Dissector as parameter. |
|---|
| 57 | => if none of a ComponentId filters matches, then this ComponentId |
|---|
| 58 | should be removed from Dispatcher's ComponentId list. |
|---|
| 59 | => if a ComponentId has no associated filter, then this ComponentId |
|---|
| 60 | remains in the list. |
|---|
| 61 | => if Dispatcher's ComponentId list gets empty, then it means that |
|---|
| 62 | captured packet does not match any Component filter... Oooops |
|---|
| 63 | => All filters are always processed, thus Dispatch filter |
|---|
| 64 | registration order has no impact. |
|---|
| 65 | => Example: |
|---|
| 66 | |
|---|
| 67 | Configuration: |
|---|
| 68 | Components: CompA, CompB, CompC |
|---|
| 69 | |
|---|
| 70 | Dispatcher: IP |
|---|
| 71 | Filters: |
|---|
| 72 | - CompA, addr, @1 |
|---|
| 73 | - CompB, addr, @1 |
|---|
| 74 | - CompB, addr, @2 |
|---|
| 75 | |
|---|
| 76 | Dispatcher: UDP/TCP |
|---|
| 77 | Filters: |
|---|
| 78 | b - CompA, port, 5060 |
|---|
| 79 | - CompB, port, 53 |
|---|
| 80 | - CompB, port, 5060 |
|---|
| 81 | - CompC, port, 80 |
|---|
| 82 | |
|---|
| 83 | |
|---|
| 84 | Captured Packets: |
|---|
| 85 | a/ SIP (addr=@1, port=5060) |
|---|
| 86 | b/ DNS (addr=@1, port=53) |
|---|
| 87 | c/ SIP (addr=@2, port=5060) |
|---|
| 88 | d/ HTTP (addr=@1, port=80) |
|---|
| 89 | |
|---|
| 90 | Results: |
|---|
| 91 | a/ Init: CompA, CompB, CompC |
|---|
| 92 | Eth: CompA, CompB, CompC |
|---|
| 93 | IP: CompA, CompB, CompC |
|---|
| 94 | UDP: CompA, CompB |
|---|
| 95 | Enqueued on CompA and CompB |
|---|
| 96 | |
|---|
| 97 | b/ Init: CompA, CompB, CompC |
|---|
| 98 | Eth: CompA, CompB, CompC |
|---|
| 99 | IP: CompA, CompB, CompC |
|---|
| 100 | UDP: CompB |
|---|
| 101 | Enqueued on CompB |
|---|
| 102 | |
|---|
| 103 | c/ Init: CompA, CompB, CompC |
|---|
| 104 | Eth: CompA, CompB, CompC |
|---|
| 105 | IP: CompB, CompC |
|---|
| 106 | UDP: CompB |
|---|
| 107 | Enqueued on CompB |
|---|
| 108 | |
|---|
| 109 | d/ Init: CompA, CompB, CompC |
|---|
| 110 | Eth: CompA, CompB, CompC |
|---|
| 111 | IP: CompA, CompB, CompC |
|---|
| 112 | TCP: CompC |
|---|
| 113 | |
|---|
| 114 | * Implement UpperLayer filters: |
|---|
| 115 | => Explicit Upper Layers are registered using Dispatcher's method |
|---|
| 116 | AddExplicitUpperLayer(). |
|---|
| 117 | => Upper Layers can be selected using Upper Layer filters |
|---|
| 118 | => Dispatcher will transmit current packet to first registered |
|---|
| 119 | Upper Layer having a matching UL filter. IMPORTANT: null filter |
|---|
| 120 | (=no filter) always match. As a consequence, registration order |
|---|
| 121 | is important |
|---|
| 122 | => Example 1: |
|---|
| 123 | |
|---|
| 124 | Configuration: |
|---|
| 125 | Dispatcher: Ethernet |
|---|
| 126 | Implicitely registered Upper Layers: IP |
|---|
| 127 | |
|---|
| 128 | Dispatcher: IP |
|---|
| 129 | Implicitely registered Upper Layers: TCP, UDP |
|---|
| 130 | |
|---|
| 131 | Captured Packets: |
|---|
| 132 | a/ Eth-IP-UDP-SIP |
|---|
| 133 | b/ Eth-IP-TCP-SIP |
|---|
| 134 | c/ Eth-IP-UDP-DNS |
|---|
| 135 | |
|---|
| 136 | Results: |
|---|
| 137 | a/ Dispatchers called: |
|---|
| 138 | - Eth |
|---|
| 139 | - IP |
|---|
| 140 | - UDP |
|---|
| 141 | SIP dispatcher no called! |
|---|
| 142 | |
|---|
| 143 | b/ Dispatchers called: |
|---|
| 144 | - Eth |
|---|
| 145 | - IP |
|---|
| 146 | - TCP |
|---|
| 147 | SIP dispatcher no called! |
|---|
| 148 | (SIP messages not Reassembled !!!) |
|---|
| 149 | |
|---|
| 150 | c/ Dispatchers called: |
|---|
| 151 | - Eth |
|---|
| 152 | - IP |
|---|
| 153 | - TCP |
|---|
| 154 | DNS dispatcher no called! |
|---|
| 155 | |
|---|
| 156 | => Example 2: |
|---|
| 157 | |
|---|
| 158 | Configuration: |
|---|
| 159 | Dispatcher: Ethernet |
|---|
| 160 | Implicitely registered Upper Layers: IP |
|---|
| 161 | |
|---|
| 162 | Dispatcher: IP |
|---|
| 163 | Implicitely registered Upper Layers: TCP, UDP |
|---|
| 164 | |
|---|
| 165 | Dispatcher: UDP |
|---|
| 166 | Explicitely registered Upper Layers: |
|---|
| 167 | - SIP (Filter: none) |
|---|
| 168 | - DNS (Filter: port=53) |
|---|
| 169 | |
|---|
| 170 | Dispatcher: TCP |
|---|
| 171 | Explicitely registered Upper Layers: |
|---|
| 172 | - SIP (Filter: none) |
|---|
| 173 | |
|---|
| 174 | Captured Packets: |
|---|
| 175 | a/ Eth-IP-UDP-SIP |
|---|
| 176 | b/ Eth-IP-TCP-SIP |
|---|
| 177 | c/ Eth-IP-UDP-DNS |
|---|
| 178 | |
|---|
| 179 | Results: |
|---|
| 180 | a/ Dispatchers called: |
|---|
| 181 | - Eth |
|---|
| 182 | - IP |
|---|
| 183 | - UDP |
|---|
| 184 | - SIP |
|---|
| 185 | |
|---|
| 186 | b/ Dispatchers called: |
|---|
| 187 | - Eth |
|---|
| 188 | - IP |
|---|
| 189 | - TCP |
|---|
| 190 | - SIP |
|---|
| 191 | SIP dispatcher called => SIP messages Reassembled !!! |
|---|
| 192 | |
|---|
| 193 | c/ Dispatchers called: |
|---|
| 194 | - Eth |
|---|
| 195 | - IP |
|---|
| 196 | - UDP |
|---|
| 197 | - SIP |
|---|
| 198 | DNS dispatcher no called! |
|---|
| 199 | SIP dispatcher called!!! |
|---|
| 200 | => first dispatcher with matching filter |
|---|
| 201 | has been called... Oooops |
|---|
| 202 | |
|---|
| 203 | |
|---|
| 204 | => Example 3: |
|---|
| 205 | |
|---|
| 206 | Configuration: |
|---|
| 207 | Dispatcher: Ethernet |
|---|
| 208 | Implicitely registered Upper Layers: IP |
|---|
| 209 | |
|---|
| 210 | Dispatcher: IP |
|---|
| 211 | Implicitely registered Upper Layers: TCP, UDP |
|---|
| 212 | |
|---|
| 213 | Dispatcher: UDP |
|---|
| 214 | Explicitely registered Upper Layers: |
|---|
| 215 | - SIP (Filter: none) |
|---|
| 216 | - DNS (Filter: port=53) |
|---|
| 217 | |
|---|
| 218 | Dispatcher: TCP |
|---|
| 219 | Explicitely registered Upper Layers: |
|---|
| 220 | - SIP (Filter: none) |
|---|
| 221 | |
|---|
| 222 | Captured Packets: |
|---|
| 223 | a/ Eth-IP-UDP-SIP |
|---|
| 224 | b/ Eth-IP-TCP-SIP |
|---|
| 225 | c/ Eth-IP-UDP-DNS |
|---|
| 226 | |
|---|
| 227 | Results: |
|---|
| 228 | a/ Dispatchers called: |
|---|
| 229 | - Eth |
|---|
| 230 | - IP |
|---|
| 231 | - UDP |
|---|
| 232 | - SIP |
|---|
| 233 | |
|---|
| 234 | b/ Dispatchers called: |
|---|
| 235 | - Eth |
|---|
| 236 | - IP |
|---|
| 237 | - TCP |
|---|
| 238 | - SIP |
|---|
| 239 | DNS dispatcher no called (filter does not match) |
|---|
| 240 | SIP dispatcher called => SIP messages Reassembled !!! |
|---|
| 241 | |
|---|
| 242 | c/ Dispatchers called: |
|---|
| 243 | - Eth |
|---|
| 244 | - IP |
|---|
| 245 | - UDP |
|---|
| 246 | - DNS |
|---|
| 247 | DNS dispatcher called, OK! |
|---|
| 248 | |
|---|
| 249 | * Implement Sip Dissector: |
|---|
| 250 | => SipDissector should be able to partially parse SIP message in |
|---|
| 251 | order to get its length and determine if it is complete or need |
|---|
| 252 | reassembly. |
|---|
| 253 | => Reassemble should proceed to SIP message reassembly (simple |
|---|
| 254 | concatenation, as TCP guaranties packet order). |
|---|
| 255 | => Refer to IpDissector for example of reassembly. |
|---|
| 256 | |
|---|
| 257 | |
|---|
