1 | README: |
---|
2 | ====== |
---|
3 | |
---|
4 | For each protocol layer: |
---|
5 | - Dispatcher instanciates a new Dissector for this layer. |
---|
6 | - Dispatcher asks Dissector to parse the captured packet. |
---|
7 | - Dissector determines if packet must be reassembled. |
---|
8 | - If reassembly is required, packet is tranfered to reassembly, |
---|
9 | which may result in a complete packet |
---|
10 | - If packet is complete, then dispatch filters are querried to |
---|
11 | eliminate components for which this packet is not suitable |
---|
12 | - Upper layer dispatcher is selected based on Dissector information |
---|
13 | (Implicitely registered Upper Layers) or based on Upper Layer |
---|
14 | Filters (Explicitely registered Upper Layers). Packet and component |
---|
15 | list are transmitted to first available Upper Layer Dispatcher. |
---|
16 | - If no Upper Layer Dispatcher is available, then payload and |
---|
17 | component list are returned. |
---|
18 | |
---|
19 | |
---|
20 | Dispatchers are Singletons, and all inherit from Dispatcher class. |
---|
21 | |
---|
22 | Dispatcher |
---|
23 | ^---EthernetDispatcher |
---|
24 | |---IpDispatcher |
---|
25 | |---TcpDispatcher |
---|
26 | |---UdpDispatcher |
---|
27 | |---SipDispatcher |
---|
28 | |---... |
---|
29 | |
---|
30 | Dispatcher instances can be retrieved via pseudo-factory DispatcherFactory |
---|
31 | using method Get("<Layer>"). |
---|
32 | Example: DispatcherFactory::Instance().Get("UDP"); |
---|
33 | |
---|
34 | |
---|
35 | Dissectors all inherits from Dissectors |
---|
36 | |
---|
37 | Dissector |
---|
38 | ^---EthernetDissector |
---|
39 | |---IpDissector |
---|
40 | |---TcpDissector |
---|
41 | |---UdpDissector |
---|
42 | |---SipDissector |
---|
43 | |---... |
---|
44 | |
---|
45 | Dissectors are created via DissectorFactory using method Create(<Layer>). |
---|
46 | Example: DissectorFactory::Instance().Create("Ethernet"); |
---|
47 | |
---|
48 | |
---|
49 | TODO: |
---|
50 | ==== |
---|
51 | |
---|
52 | * Implement Dispatch filters: |
---|
53 | => Dispatch filters are created using Dispatcher's RegisterFilter() |
---|
54 | method. |
---|
55 | => Each Dispatch filter should be associated with a ComponentId. |
---|
56 | => the Match() method should receive a Dissector as parameter. |
---|
57 | => if none of a ComponentId filters matches, then this ComponentId |
---|
58 | should be removed from Dispatcher's ComponentId list. |
---|
59 | => if a ComponentId has no associated filter, then this ComponentId |
---|
60 | remains in the list. |
---|
61 | => if Dispatcher's ComponentId list gets empty, then it means that |
---|
62 | captured packet does not match any Component filter... Oooops |
---|
63 | => All filters are always processed, thus Dispatch filter |
---|
64 | registration order has no impact. |
---|
65 | => Example: |
---|
66 | |
---|
67 | Configuration: |
---|
68 | Components: CompA, CompB, CompC |
---|
69 | |
---|
70 | Dispatcher: IP |
---|
71 | Filters: |
---|
72 | - CompA, addr, @1 |
---|
73 | - CompB, addr, @1 |
---|
74 | - CompB, addr, @2 |
---|
75 | |
---|
76 | Dispatcher: UDP/TCP |
---|
77 | Filters: |
---|
78 | b - CompA, port, 5060 |
---|
79 | - CompB, port, 53 |
---|
80 | - CompB, port, 5060 |
---|
81 | - CompC, port, 80 |
---|
82 | |
---|
83 | |
---|
84 | Captured Packets: |
---|
85 | a/ SIP (addr=@1, port=5060) |
---|
86 | b/ DNS (addr=@1, port=53) |
---|
87 | c/ SIP (addr=@2, port=5060) |
---|
88 | d/ HTTP (addr=@1, port=80) |
---|
89 | |
---|
90 | Results: |
---|
91 | a/ Init: CompA, CompB, CompC |
---|
92 | Eth: CompA, CompB, CompC |
---|
93 | IP: CompA, CompB, CompC |
---|
94 | UDP: CompA, CompB |
---|
95 | Enqueued on CompA and CompB |
---|
96 | |
---|
97 | b/ Init: CompA, CompB, CompC |
---|
98 | Eth: CompA, CompB, CompC |
---|
99 | IP: CompA, CompB, CompC |
---|
100 | UDP: CompB |
---|
101 | Enqueued on CompB |
---|
102 | |
---|
103 | c/ Init: CompA, CompB, CompC |
---|
104 | Eth: CompA, CompB, CompC |
---|
105 | IP: CompB, CompC |
---|
106 | UDP: CompB |
---|
107 | Enqueued on CompB |
---|
108 | |
---|
109 | d/ Init: CompA, CompB, CompC |
---|
110 | Eth: CompA, CompB, CompC |
---|
111 | IP: CompA, CompB, CompC |
---|
112 | TCP: CompC |
---|
113 | |
---|
114 | * Implement UpperLayer filters: |
---|
115 | => Explicit Upper Layers are registered using Dispatcher's method |
---|
116 | AddExplicitUpperLayer(). |
---|
117 | => Upper Layers can be selected using Upper Layer filters |
---|
118 | => Dispatcher will transmit current packet to first registered |
---|
119 | Upper Layer having a matching UL filter. IMPORTANT: null filter |
---|
120 | (=no filter) always match. As a consequence, registration order |
---|
121 | is important |
---|
122 | => Example 1: |
---|
123 | |
---|
124 | Configuration: |
---|
125 | Dispatcher: Ethernet |
---|
126 | Implicitely registered Upper Layers: IP |
---|
127 | |
---|
128 | Dispatcher: IP |
---|
129 | Implicitely registered Upper Layers: TCP, UDP |
---|
130 | |
---|
131 | Captured Packets: |
---|
132 | a/ Eth-IP-UDP-SIP |
---|
133 | b/ Eth-IP-TCP-SIP |
---|
134 | c/ Eth-IP-UDP-DNS |
---|
135 | |
---|
136 | Results: |
---|
137 | a/ Dispatchers called: |
---|
138 | - Eth |
---|
139 | - IP |
---|
140 | - UDP |
---|
141 | SIP dispatcher no called! |
---|
142 | |
---|
143 | b/ Dispatchers called: |
---|
144 | - Eth |
---|
145 | - IP |
---|
146 | - TCP |
---|
147 | SIP dispatcher no called! |
---|
148 | (SIP messages not Reassembled !!!) |
---|
149 | |
---|
150 | c/ Dispatchers called: |
---|
151 | - Eth |
---|
152 | - IP |
---|
153 | - TCP |
---|
154 | DNS dispatcher no called! |
---|
155 | |
---|
156 | => Example 2: |
---|
157 | |
---|
158 | Configuration: |
---|
159 | Dispatcher: Ethernet |
---|
160 | Implicitely registered Upper Layers: IP |
---|
161 | |
---|
162 | Dispatcher: IP |
---|
163 | Implicitely registered Upper Layers: TCP, UDP |
---|
164 | |
---|
165 | Dispatcher: UDP |
---|
166 | Explicitely registered Upper Layers: |
---|
167 | - SIP (Filter: none) |
---|
168 | - DNS (Filter: port=53) |
---|
169 | |
---|
170 | Dispatcher: TCP |
---|
171 | Explicitely registered Upper Layers: |
---|
172 | - SIP (Filter: none) |
---|
173 | |
---|
174 | Captured Packets: |
---|
175 | a/ Eth-IP-UDP-SIP |
---|
176 | b/ Eth-IP-TCP-SIP |
---|
177 | c/ Eth-IP-UDP-DNS |
---|
178 | |
---|
179 | Results: |
---|
180 | a/ Dispatchers called: |
---|
181 | - Eth |
---|
182 | - IP |
---|
183 | - UDP |
---|
184 | - SIP |
---|
185 | |
---|
186 | b/ Dispatchers called: |
---|
187 | - Eth |
---|
188 | - IP |
---|
189 | - TCP |
---|
190 | - SIP |
---|
191 | SIP dispatcher called => SIP messages Reassembled !!! |
---|
192 | |
---|
193 | c/ Dispatchers called: |
---|
194 | - Eth |
---|
195 | - IP |
---|
196 | - UDP |
---|
197 | - SIP |
---|
198 | DNS dispatcher no called! |
---|
199 | SIP dispatcher called!!! |
---|
200 | => first dispatcher with matching filter |
---|
201 | has been called... Oooops |
---|
202 | |
---|
203 | |
---|
204 | => Example 3: |
---|
205 | |
---|
206 | Configuration: |
---|
207 | Dispatcher: Ethernet |
---|
208 | Implicitely registered Upper Layers: IP |
---|
209 | |
---|
210 | Dispatcher: IP |
---|
211 | Implicitely registered Upper Layers: TCP, UDP |
---|
212 | |
---|
213 | Dispatcher: UDP |
---|
214 | Explicitely registered Upper Layers: |
---|
215 | - SIP (Filter: none) |
---|
216 | - DNS (Filter: port=53) |
---|
217 | |
---|
218 | Dispatcher: TCP |
---|
219 | Explicitely registered Upper Layers: |
---|
220 | - SIP (Filter: none) |
---|
221 | |
---|
222 | Captured Packets: |
---|
223 | a/ Eth-IP-UDP-SIP |
---|
224 | b/ Eth-IP-TCP-SIP |
---|
225 | c/ Eth-IP-UDP-DNS |
---|
226 | |
---|
227 | Results: |
---|
228 | a/ Dispatchers called: |
---|
229 | - Eth |
---|
230 | - IP |
---|
231 | - UDP |
---|
232 | - SIP |
---|
233 | |
---|
234 | b/ Dispatchers called: |
---|
235 | - Eth |
---|
236 | - IP |
---|
237 | - TCP |
---|
238 | - SIP |
---|
239 | DNS dispatcher no called (filter does not match) |
---|
240 | SIP dispatcher called => SIP messages Reassembled !!! |
---|
241 | |
---|
242 | c/ Dispatchers called: |
---|
243 | - Eth |
---|
244 | - IP |
---|
245 | - UDP |
---|
246 | - DNS |
---|
247 | DNS dispatcher called, OK! |
---|
248 | |
---|
249 | * Implement Sip Dissector: |
---|
250 | => SipDissector should be able to partially parse SIP message in |
---|
251 | order to get its length and determine if it is complete or need |
---|
252 | reassembly. |
---|
253 | => Reassemble should proceed to SIP message reassembly (simple |
---|
254 | concatenation, as TCP guaranties packet order). |
---|
255 | => Refer to IpDissector for example of reassembly. |
---|
256 | |
---|
257 | |
---|