1 概述

为了便于内存管理, 以及降低内存泄漏的可能性, Wireshark 有自己的内存管理机制:

  • WMEM
    Wireshark 内存管理框架, epan/wmem/
  • Buffer
    wsutil/buffer.h
  • tvbuff
    epan/tvbuff.h

本文首先解读 doc/README.wmem, 然后再分析它们的主要实现原理, 为方便分析有时候会编写一些代码. 这些代码见 github.com/zzqcn/wsdev, 提及的时候会给出相对路径.

2 doc/README.wmem

见 https://www.yuque.com/zzqcn/wireshark/gv8cfc

3 wmem

有关 wmem, 本文第 2 章已经说了很多了, 这里主要结合源码分析, 代码调用等进行额外阐述.

3.1 概述

wmem 使用面向对象设计, 相当于实现了 4 个内存池类:

  • simple_allocator
  • block_allocator
  • block_fast_allocator
  • strick_allocator

并且在内部根据这些类创建了 3 个内存池对象, 解析器等代码可直接调用:

  • wmem_file_scope(), block_allocator 对象
  • wmem_epan_scope(), block_allocator 对象
  • wmem_packet_scope(), block_fast_allocator 对象

Wireshark原理: 内存管理 - 图1

wmem_allocator_new() 实现了工厂模式, 通过传入的参数不同来创建不同的 allocator.

  1. // epan/wmem/wmem_core.c
  2. wmem_allocator_t *
  3. wmem_allocator_new(const wmem_allocator_type_t type)
  4. {
  5.     wmem_allocator_t      *allocator;
  6.     wmem_allocator_type_t  real_type;
  8.     if (do_override) {
  9.         real_type = override_type;
  10.     }
  11.     else {
  12.         real_type = type;
  13.     }
  15.     allocator = wmem_new(NULL, wmem_allocator_t);
  16.     allocator->type      = real_type;
  17.     allocator->callbacks = NULL;
  18.     allocator->in_scope  = TRUE;
  20.     switch (real_type) {
  21.         case WMEM_ALLOCATOR_SIMPLE:
  22.             wmem_simple_allocator_init(allocator);
  23.             break;
  24.         case WMEM_ALLOCATOR_BLOCK:
  25.             wmem_block_allocator_init(allocator);
  26.             break;
  27.         case WMEM_ALLOCATOR_BLOCK_FAST:
  28.             wmem_block_fast_allocator_init(allocator);
  29.             break;
  30.         case WMEM_ALLOCATOR_STRICT:
  31.             wmem_strict_allocator_init(allocator);
  32.             break;
  33.         default:
  34.             g_assert_not_reached();
  35.             /* This is necessary to squelch MSVC errors; is there
  36.                any way to tell it that g_assert_not_reached()
  37.                never returns? */
  38.             return NULL;
  39.     };
  41.     return allocator;
  42. }

3.x block allocator

3.x wmem数据结构

// TODO

历史

Version 1 of this allocator was embedded in the original emem framework. It
didn’t have to handle realloc or free, so it was very simple: it just grabbed
a block from the OS and served allocations sequentially out of that until it
ran out, then allocated a new block. The old block was never revisited, so
it generally had a bit of wasted space at the end, but the waste was
small enough that it was simply ignored. This allocator provided very fast
constant-time allocation for any request that didn’t require a new block from
the OS, and that cost could be amortized away.

Version 2 of this allocator was prompted by the need to support realloc and
free in wmem. The original version simply didn’t save enough metadata to do
this, so I added a layer on top to make it possible. The primary principle
was the same (allocate sequentially out of big blocks) with a bit of extra
magic. Allocations were still fast constant-time, and frees were as well.
Large parts of that design are still present in this one, but for more
details see older versions of this file from git or svn.

Version 3 of this allocator was written to address some issues that
eventually showed up with version 2 under real-world usage. Specifically,
version 2 dealt very poorly with memory fragmentation, almost never reusing
freed blocks and choosing to just keep allocating from the master block
instead. This led to particularly poor behaviour under the tick-tock loads
(alloc/free/alloc/free or alloc/alloc/free/alloc/alloc/free/ or …) that
showed up in a couple of different protocol dissectors (TCP, Kafka).

block & chunk

As in previous versions, allocations typically happen sequentially out of
large OS-level blocks. Each block has a short embedded header used to
maintain a doubly-linked list of all blocks (used or not) currently owned by
the allocator. Each block is divided into chunks, which represent allocations
and free sections (a block is initialized with one large, free, chunk). Each
chunk is prefixed with a wmem_block_chunk_t structure, which is a short
metadata header (8 bytes, regardless of 32 or 64-bit architecture unless
alignment requires it to be padded) that contains the length of the chunk,
the length of the previous chunk, a flag marking the chunk as free or used,
and a flag marking the last chunk in a block. This serves to implement an
inline sequential doubly-linked list of all the chunks in each block. A block
with three chunks might look something like this:

  1.          0                    _________________________
  2.          ^      ___________  /        ______________   \       __________
  3. ||---||--|-----/-----------||--------/--------------||--\-----/----------||
  4. ||hdr|| prv | len |  body  || prv | len |   body    || prv | len | body  ||
  5. ||---||--------------------||--/--------------------||-------------------||
  6.        \______________________/
  1. /* See section "4. Internal Design" of doc/README.wmem for details
  2.  * on this structure */
  3. struct _wmem_allocator_t {
  4.     /* Consumer functions */
  5.     void *(*walloc)(void *private_data, const size_t size);
  6.     void  (*wfree)(void *private_data, void *ptr);
  7.     void *(*wrealloc)(void *private_data, void *ptr, const size_t size);
  9.     /* Producer/Manager functions */
  10.     void  (*free_all)(void *private_data);
  11.     void  (*gc)(void *private_data);
  12.     void  (*cleanup)(void *private_data);
  14.     /* Callback List */
  15.     struct _wmem_user_cb_container_t *callbacks;
  17.     /* Implementation details */
  18.     void                        *private_data;
  19.     enum _wmem_allocator_type_t  type;
  20.     gboolean                     in_scope;
  21. };
  23. typedef struct _wmem_block_allocator_t {
  24.     wmem_block_hdr_t   *block_list;
  25.     wmem_block_chunk_t *master_head;
  26.     wmem_block_chunk_t *recycler_head;
  27. } wmem_block_allocator_t;
  29. /* The header for an entire OS-level 'block' of memory */
  30. typedef struct _wmem_block_hdr_t {
  31.     struct _wmem_block_hdr_t *prev, *next;
  32. } wmem_block_hdr_t;
  34. /* The header for a single 'chunk' of memory as returned from alloc/realloc.
  35.  * The 'jumbo' flag indicates an allocation larger than a normal-sized block
  36.  * would be capable of serving. If this is set, it is the only chunk in the
  37.  * block and the other chunk header fields are irrelevant.
  38.  */
  39. typedef struct _wmem_block_chunk_t {
  40.     guint32 prev;
  42.     /* flags */
  43.     guint32 last:1;
  44.     guint32 used:1;
  45.     guint32 jumbo:1;
  47.     guint32 len:29;
  48. } wmem_block_chunk_t;
  50. /* This is what the 'data' section of a chunk contains if it is free. */
  51. typedef struct _wmem_block_free_t {
  52.     wmem_block_chunk_t *prev, *next;
  53. } wmem_block_free_t;

When allocating, a free chunk is found (more on that later) and split into
two chunks: the first of the requested size and the second containing any
remaining free. The first is marked used and returned to the caller.

When freeing, the chunk in question is marked as free. Its neighbouring
chunks are then checked; if either of them are free, the consecutive free
chunks are merged into a single larger free chunk. Induction can show that
applying this operation consistently prevents us ever having consecutive
free chunks.

Free chunks (because they are not being used for anything else) each store an
additional pair of pointers (see the wmem_block_free_t structure) that form
the backbone of the data structures used to track free chunks.

管理与回收

The extra pair of pointers in free chunks are used to build two doubly-linked
lists: the master and the recycler. The recycler is circular, the master is
a stack.

The master stack is only populated by chunks from new OS-level blocks,
so every chunk in this list is guaranteed to be able to serve any allocation
request (the allocator will not serve requests larger than its block size).
The chunk at the head of the master list shrinks as it serves requests. When
it is too small to serve the current request, it is popped and inserted into
the recycler. If the master list is empty, a new OS-level block is allocated,
and its chunk is pushed onto the master stack.

The recycler is populated by ‘leftovers’ from the master, as well as any
chunks that were returned to the allocator via a call to free(). Although the
recycler is circular, we will refer to the element referenced from the
allocator as the ‘head’ of the list for convenience. The primary operation on
the recycler is called cycling it. In this operation, the head is compared
with its clockwise neighbour. If the neighbour is as large or larger, it
becomes the head (the list rotates counter-clockwise). If the neighbour is
smaller, then it is removed from its location and inserted as the counter-
clockwise neighbour of the head (the list still rotates counter-clockwise,
but the head element is held fixed while the rest of the list spins). This
operation has the following properties:

  • fast constant time
  • once the largest chunk is at the head, it remains at the head
  • more iterations increases the probability that the largest chunk will be
    the head (for a list with n items, n iterations guarantees that the
    largest chunk will be the head).

    分配

    When an allocation request is received, the allocator first attempts tosatisfy it with the chunk at the head of the recycler. If that does not
    succeed, the request is satisfied by the master list instead. Regardless of
    which chunk satisfied the request, the recycler is always cycled.

    3.x 使用wmem

    allocator

    下面的实际代码演示了如何简单调用 wmem allocator (代码见我的 wsdev wmem/allocator): ```c

    include

    include “epan/epan.h”

    include “epan/wmem/wmem.h”

int main(int argc, char* argv) { wmem_allocator_t pool; char* buf;

  1. wmem_init();
  3. pool = wmem_allocator_new(WMEM_ALLOCATOR_SIMPLE);
  4. if (NULL == pool) {
  5.     g_print("create simple pool failed\n");
  6.     return -1;
  7. }
  8. buf = wmem_alloc(pool, 64);
  9. g_print("buf: %p\n", buf);
  10. wmem_destroy_allocator(pool);
  12. // error code below, will cause segment fault
  13. // buf = wmem_alloc(pool, 64);
  14. // g_print("buf: %p\n", buf);
  16. pool = wmem_allocator_new(WMEM_ALLOCATOR_BLOCK);
  17. if (NULL == pool) {
  18.     g_print("create block pool failed\n");
  19.     return -1;
  20. }
  21. buf = wmem_alloc(pool, 64);
  22. g_print("buf: %p\n", buf);
  23. wmem_destroy_allocator(pool);
  25. wmem_cleanup();
  27. return 0;

}

  1. :::warning
  2. 在调用任何 wmem 函数之前应先调用 wmem_init() 初始化 wmem 子模块, 最后调用 wmem_cleanup() 反初始化, 当然 wireshark/tshark 已在合适的地方调用了这两个函数
  3. :::
  4. <a name="nyabb"></a>
  5. ### scope
  6. 下面的实际代码演示了如何简单调用 wmem allocator (代码见[我的 wsdev](https://github.com/zzqcn/wsdev) wmem/allocator):
  7. ```c
  8. #include <glib.h>
  9. #include "epan/epan.h"
  10. #include "epan/wmem/wmem.h"
  12. int main(int argc, char **argv)
  13. {
  14.     wmem_allocator_t *epan_pool;
  15.     wmem_allocator_t *file_pool;
  16.     wmem_allocator_t *packet_pool;
  17.     char *epan_buf, *file_buf, *packet_buf;
  18.     int i;
  20.     // error code below, will cause assertion failed,
  21.     // must call wmem_init() first
  22.     // epan_pool = wmem_epan_scope();
  24.     wmem_init();
  26.     epan_pool = wmem_epan_scope();
  27.     if (NULL == epan_pool) {
  28.         g_print("epan_pool is NOT inited\n");
  29.         return -1;
  30.     }
  31.     file_pool = wmem_file_scope();
  32.     packet_pool = wmem_packet_scope();
  34.     epan_buf = wmem_alloc(epan_pool, 64);
  35.     if (NULL == epan_buf) {
  36.         g_print("alloc in epan pool failed\n");
  37.         goto end;
  38.     }
  39.     g_snprintf(epan_buf, 64, "epan string");
  40.     g_print("epan_buf: %s\n", epan_buf);
  42.     wmem_enter_file_scope();
  44.     file_buf = wmem_alloc(file_pool, 64);
  45.     if (NULL == file_buf) {
  46.         g_print("alloc in file pool failed\n");
  47.         goto end;
  48.     }
  49.     g_snprintf(file_buf, 64, "file string");
  50.     g_print("file_buf: %s\n", file_buf);
  52.     for (i = 0; i < 5; i++) {
  53.         wmem_enter_packet_scope();
  54.         packet_buf = wmem_alloc(packet_pool, 32);
  55.         g_snprintf(packet_buf, 16, "packet string %d", i + 1);
  56.         g_print("packet_buf: %s\n", packet_buf);
  57.         wmem_leave_packet_scope();
  58.         g_print("packet_buf: %s\n", packet_buf);
  59.     }
  61.     wmem_leave_file_scope();
  63.     // error code below, will cause segment fault,
  64.     // because we have leave file scope
  65.     // g_print("file_buf: %s\n", file_buf);
  67.     g_print("epan_buf: %s\n", epan_buf);
  68.     // no wmem_leave_epan_scope() API,
  69.     // it will auto-destroyed when wmem_cleanup() is called
  71. end:
  72.     wmem_cleanup();
  74.     return 0;
  75. }

4 tvbuff

4.1 概述

即 Testy, Virtual Buffer. 这样命名有两个含义:

  • Testy (易怒的): 尝试越界访问数据时将抛出异常
  • Virtualizable: 可以通过已有 tvbuff 创建新的 tvbuff, 而仅有原始 tvbuff 持有数据, 新 tvbuff 并不真的持有数据

在 epan 中, 通常是把多个 tvbuff 构成链表(或栈)来使用的. 当解析一个 frame 时:
packet.c 中的上游解析器将最初的 tvb (包含完整 frame) 放到链表中, 并调用下游解析器, 下游解析器再调用下游, 如此往复. 每个下游解析器把新的 tvb 链到传给它的 tvb 中. 解析完成后, 控制权回到上游解析器, (在epan_dissect_cleanup()中) tvb 链表通过 tvb_free_chain() 调用被释放.

tvbuff 有三种类型:

  • real
    包含指向实际数据的 guint8* 指针, 其缓冲区是被分配和连续的.
  • subset
    subset tvbuff 对应一个底层(backing) tvbuff, 它类似于一个窗口, 通过它只能看到底层 tvbuff 的一部分
  • composite
    composite tvbuff 由多个 tvbuff 组合而成, 形成一个更大的 byte array

tvbuff 实现了一种面向对象机制, struct tvbuff 相当于基类, 而 real/subset/composite 等 tvbuff 相当于 struct tvbuff 的派生类, 它们的不同行为是通过 struct tvb_ops 来特化的.

任何类型的 tvbuff 都做为 subset tvbuff 的底层 tvbuff, 或做为 composite tvbuff 的成员. composite tvbuff 可包含不同类型的 tvbuff. tvbuff 一旦被创建/初始化/反初始后, 就是只读的, 即不能指向其他数据. 要想指向其他数据, 就必须创建一个新的 tvbuff. tvbuff 一般连在一起以便高效地释放.

:::info 下文中 tvbuff 也简称为 tvb :::

4.2 数据结构

  1. // epan/tvbuff-int.h
  2. struct tvb_ops {
  3.     gsize tvb_size;
  4.     void (*tvb_free)(struct tvbuff *tvb);
  5.     guint (*tvb_offset)(const struct tvbuff *tvb, guint counter);
  6.     const guint8 *(*tvb_get_ptr)(struct tvbuff *tvb, guint abs_offset, guint abs_length);
  7.     void *(*tvb_memcpy)(struct tvbuff *tvb, void *target, guint offset, guint length);
  9.     gint (*tvb_find_guint8)(tvbuff_t *tvb, guint abs_offset, guint limit, guint8 needle);
  10.     gint (*tvb_ws_mempbrk_pattern_guint8)(tvbuff_t *tvb, guint abs_offset, guint limit, const ws_mempbrk_pattern* pattern, guchar *found_needle);
  12.     tvbuff_t *(*tvb_clone)(tvbuff_t *tvb, guint abs_offset, guint abs_length);
  13. };
  15. struct tvbuff {
  16.     tvbuff_t        *next;
  17.     const struct tvb_ops   *ops;
  18.     gboolean        initialized;
  19.     guint            flags;
  20.     struct tvbuff    *ds_tvb;
  21.     const guint8    *real_data;
  22.     guint            length;
  23.     guint            reported_length;
  24.     guint            contained_length;
  25.     gint            raw_offset;
  26. };

tvbuff 的成员:

  • next 用于构造双向链表
  • ops 操作函数集, 这实现了某种面向对象特性
  • initialized 是否初始化
  • flags 标志位, 目前仅支持 TVBUFF_FRAGMENT
  • ds_tvb 作为数据源的顶层 tvb
  • real_data 实际数据指针. 当为 null 时可表示: 1)数据长度为0; 2)使用了延迟创建机制, 即直到需要使用数据时才分配内存并填充数据
  • length 实际数据长度, 可能会<reported_length, 比如被抓包进程截短的报文. 绝不会大于 reported_length 或 contained_length
  • reported_length 上报数据长度
  • contained_length 有两份种情况: 1)如果是从父 tvb 解出的, 则表示解出的数据长度或所含数据本身表明的长度, 它可能 >reported_length; 2)如果不是从父 tvb 解出的, 则 =reported_length. 它绝不会 >reported_length
  • raw_offset 相对第一个 real tvb 开头的偏移

:::warning 源代码中对于 contained_length 的注释让我迷惑, 需要后续分析代码确定其真实含义 :::

struct tvbuff 是基本数据结构, 在实际使用时一般对其进行封装, 来实现类似派生类的特定行为, 如 real tvb, subset tvb, frame tvb 等, 不同 tvb 有不同的操作函数(ops).

4.3 一般操作

tvb_new()

实际创建和初始化 tvb.

  1. // epan/tvbuff.c
  2. tvbuff_t *
  3. tvb_new(const struct tvb_ops *ops)
  4. {
  5.     tvbuff_t *tvb;
  6.     gsize     size = ops->tvb_size;
  7.     ...
  8.     // 这里只是分配ops指定大小的内存, 可能是封装了tvbuff的另一结构体的大小,
  9.     // 而不包含实际数据的长度.
  10.     // g_slice_alloc 使用了优化的内存分配方式, 参考:
  11.     // developer.gnome.org/glib/stable/glib-Memory-Slices.html
  12.     tvb = (tvbuff_t *) g_slice_alloc(size);
  14.     tvb->next         = NULL;
  15.     // 传入特化的ops, 就定义了特化的行为
  16.     tvb->ops         = ops;
  17.     tvb->initialized     = FALSE;
  18.     tvb->flags         = 0;
  19.     tvb->length         = 0;
  20.     tvb->reported_length     = 0;
  21.     tvb->contained_length     = 0;
  22.     tvb->real_data         = NULL;
  23.     tvb->raw_offset         = -1;
  24.     tvb->ds_tvb         = NULL;
  26.     return tvb;
  27. }

tvb_add_to_chain()

链接两个 tvb, 把 child tvb 链接到 parent tvb 末尾. 

  1. // epan/tvbuff.c
  2. // 将子tvb链到父tvb之后
  3. void
  4. tvb_add_to_chain(tvbuff_t *parent, tvbuff_t *child)
  5. {
  6.     tvbuff_t *tmp = child;
  7.     ...
  8.     while (child) {
  9.         tmp   = child;
  10.         child = child->next;
  12.         tmp->next    = parent->next;
  13.         parent->next = tmp;
  14.     }
  15. }

经过这个操作后, 原 parent tvb 的尾端(parent->next)和原 child tvb 的链表项顺序都会变化. 如下代码, 先链接 b, c, 再链接 a, b, 那么上一次链接时 b, c 的位置会改变(tvb/base/main.c):

  1. tvb_add_to_chain(b, c);
  2. // b -> c
  3. tvb_add_to_chain(a, b);
  4. // a -> c -> b

tvb_new_chain()

// TODO

  1. // epan/tvbuff_subset.c
  2. tvbuff_t *
  3. tvb_new_proxy(tvbuff_t *backing)
  4. {
  5.     tvbuff_t *tvb;
  7.     if (backing)
  8.         tvb = tvb_new_with_subset(backing, backing->reported_length, 0, backing->length);
  9.     else
  10.         tvb = tvb_new_real_data(NULL, 0, 0);
  12.     tvb->ds_tvb = tvb;
  14.     return tvb;
  15. }
  17. // epan/tvbuff.c
  18. tvbuff_t *
  19. tvb_new_chain(tvbuff_t *parent, tvbuff_t *backing)
  20. {
  21.     tvbuff_t *tvb = tvb_new_proxy(backing);
  23.     tvb_add_to_chain(parent, tvb);
  24.     return tvb;
  25. }

tvb_free()

tvb_free() 直接调用 tvb_free_chain(), 会释放整个 tvb 链表上所有的 tvb.

  1. // epan/tvbuff.c
  2. void
  3. tvb_free(tvbuff_t *tvb)
  4. {
  5.     tvb_free_chain(tvb);
  6. }
  8. void
  9. tvb_free_chain(tvbuff_t  *tvb)
  10. {
  11.     tvbuff_t *next_tvb;
  12.     DISSECTOR_ASSERT(tvb);
  13.     while (tvb) {
  14.         next_tvb = tvb->next;
  15.         tvb_free_internal(tvb);
  16.         tvb  = next_tvb;
  17.     }
  18. }
  20. static void
  21. tvb_free_internal(tvbuff_t *tvb)
  22. {
  23.     gsize     size;
  25.     DISSECTOR_ASSERT(tvb);
  27.     if (tvb->ops->tvb_free)
  28.         tvb->ops->tvb_free(tvb);
  30.     size = tvb->ops->tvb_size;
  32.     g_slice_free1(size, tvb);
  33. }

tvb_get_ptr()

// TODO

4.4 real tvb

real tvb 可以”看到”完整的一块真实数据. real tvb 的封装比较简单, 仅添加了释放内存回调函数, 操作函数也仅实现了 free 和 offset.
Wireshark原理: 内存管理 - 图2
数据结构:

  1. // epan/tvbuff_real.c
  2. struct tvb_real {
  3.     struct tvbuff tvb;
  5.     /** Func to call when actually freed */
  6.     tvbuff_free_cb_t    free_cb;
  7. };
  9. static const struct tvb_ops tvb_real_ops = {
  10.     sizeof(struct tvb_real), /* size */
  12.     real_free,            /* free */
  13.     real_offset,          /* offset */
  14.     NULL,                 /* get_ptr */
  15.     NULL,                 /* memcpy */
  16.     NULL,                 /* find_guint8 */
  17.     NULL,                 /* pbrk_guint8 */
  18.     NULL,                 /* clone */
  19. };

创建 real tvb:

  1. epan/tvbuff_real.c
  2. tvbuff_t *
  3. tvb_new_real_data(const guint8* data, const guint length, const gint reported_length)
  4. {
  5.     tvbuff_t *tvb;
  6.     struct tvb_real *real_tvb;
  8.     THROW_ON(reported_length < -1, ReportedBoundsError);
  10.     tvb = tvb_new(&tvb_real_ops);
  12.     tvb->real_data           = data;
  13.     tvb->length              = length;
  14.     tvb->reported_length     = reported_length;
  15.     tvb->contained_length    = reported_length;
  16.     tvb->initialized         = TRUE;
  18.     /*
  19.      * This is the top-level real tvbuff for this data source,
  20.      * so its data source tvbuff is itself.
  21.      */
  22.     tvb->ds_tvb = tvb;
  24.     real_tvb = (struct tvb_real *) tvb;
  25.     real_tvb->free_cb = NULL;
  27.     return tvb;
  28. }

4.5 subset tvb

subset tvb 只能”看到”真实数据的一部分, 它必须引用一个底层 tvb.
Wireshark原理: 内存管理 - 图3
数据结构:

  1. // epan/tvbuff_subset.c
  2. typedef struct {
  3.     /** The backing tvbuff_t */
  4.     struct tvbuff    *tvb;
  6.     /** The offset of 'tvb' to which I'm privy */
  7.     guint        offset;
  8.     /** The length of 'tvb' to which I'm privy */
  9.     guint        length;
  11. } tvb_backing_t;
  13. struct tvb_subset {
  14.     struct tvbuff tvb;
  16.     tvb_backing_t    subset;
  17. };
  19. static const struct tvb_ops tvb_subset_ops = {
  20.     sizeof(struct tvb_subset), /* size */
  22.     NULL,                 /* free */
  23.     subset_offset,        /* offset */
  24.     subset_get_ptr,       /* get_ptr */
  25.     subset_memcpy,        /* memcpy */
  26.     subset_find_guint8,   /* find_guint8 */
  27.     subset_pbrk_guint8,   /* pbrk_guint8 */
  28.     subset_clone,         /* clone */
  29. };

创建 subset tvb, 有几种方式, 这里以 tvb_new_subset_length_caplen() 为例:

  1. // epan/tvbuff_subset.c
  2. static tvbuff_t *
  3. tvb_new_with_subset(tvbuff_t *backing, const guint reported_length,
  4.     const guint subset_tvb_offset, const guint subset_tvb_length)
  5. {
  6.     tvbuff_t *tvb = tvb_new(&tvb_subset_ops);
  7.     struct tvb_subset *subset_tvb = (struct tvb_subset *) tvb;
  9.     subset_tvb->subset.offset = subset_tvb_offset;
  10.     subset_tvb->subset.length = subset_tvb_length;
  12.     subset_tvb->subset.tvb         = backing;
  13.     tvb->length             = subset_tvb_length;
  14.     /*
  15.      * The contained length must not exceed what remains in the
  16.      * backing tvbuff.
  17.      */
  18.     tvb->contained_length        = MIN(reported_length, backing->contained_length - subset_tvb_offset);
  19.     tvb->flags             = backing->flags;
  21.     tvb->reported_length         = reported_length;
  22.     tvb->initialized         = TRUE;
  24.     /* Optimization. If the backing buffer has a pointer to contiguous, real data,
  25.      * then we can point directly to our starting offset in that buffer */
  26.     if (backing->real_data != NULL) {
  27.         tvb->real_data = backing->real_data + subset_tvb_offset;
  28.     }
  30.     /*
  31.      * The top-level data source of this tvbuff is the top-level
  32.      * data source of its parent.
  33.      */
  34.     tvb->ds_tvb = backing->ds_tvb;
  36.     return tvb;
  37. }
  39. tvbuff_t *
  40. tvb_new_subset_length_caplen(tvbuff_t *backing, const gint backing_offset, const gint backing_length, const gint reported_length)
  41. {
  42.     tvbuff_t *tvb;
  43.     guint      subset_tvb_offset;
  44.     guint      subset_tvb_length;
  45.     guint      actual_reported_length;
  47.     DISSECTOR_ASSERT(backing && backing->initialized);
  49.     THROW_ON(reported_length < -1, ReportedBoundsError);
  51.     tvb_check_offset_length(backing, backing_offset, backing_length,
  52.                     &subset_tvb_offset,
  53.                     &subset_tvb_length);
  55.     if (reported_length == -1)
  56.         actual_reported_length = backing->reported_length - subset_tvb_offset;
  57.     else
  58.         actual_reported_length = (guint)reported_length;
  60.     tvb = tvb_new_with_subset(backing, actual_reported_length,
  61.         subset_tvb_offset, subset_tvb_length);
  63.     tvb_add_to_chain(backing, tvb);
  65.     return tvb;
  66. }

backing_offset 是可以 <0 的, 表示反向偏移; backing_length 可以 =-1, 表示直到末尾; reported_length 可以 =-1, 表示取可能的最大值. 对这些情况, 函数内部都会(由`tvb_check_offset_length()`)计算出合适的正值. 新创建的 subset tvb 被链接到底层原始 tvb 的末尾.

4.6 composite tvb

composite tvb 是多个 tvb 的组合, 它引用的一个或多个 tvb 都必须在同一个 tvb 链上, 否则会引发释放后使用, 双重释放等内存使用问题.
Wireshark原理: 内存管理 - 图4

数据结构:

  1. // epan/tvbuff_composite.c
  2. typedef struct {
  3.     GSList        *tvbs;
  5.     /* Used for quick testing to see if this
  6.      * is the tvbuff that a COMPOSITE is
  7.      * interested in. */
  8.     guint        *start_offsets;
  9.     guint        *end_offsets;
  11. } tvb_comp_t;
  13. struct tvb_composite {
  14.     struct tvbuff tvb;
  16.     tvb_comp_t    composite;
  17. };
  19. static const struct tvb_ops tvb_composite_ops = {
  20.     sizeof(struct tvb_composite), /* size */
  22.     composite_free,       /* free */
  23.     composite_offset,     /* offset */
  24.     composite_get_ptr,    /* get_ptr */
  25.     composite_memcpy,     /* memcpy */
  26.     NULL,                 /* find_guint8 XXX */
  27.     NULL,                 /* pbrk_guint8 XXX */
  28.     NULL,                 /* clone */
  29. };

这里用到了 glib 单向链表 GSList:

  1. // glib-2.0/glib/gslist.h
  2. typedef struct _GSList GSList;
  4. struct _GSList
  5. {
  6.   gpointer data;
  7.   GSList *next;
  8. };

创建 composite tvb.

  1. // epan/tvbuff_composite.c
  2. tvbuff_t *
  3. tvb_new_composite(void)
  4. {
  5.     tvbuff_t *tvb = tvb_new(&tvb_composite_ops);
  6.     struct tvb_composite *composite_tvb = (struct tvb_composite *) tvb;
  7.     tvb_comp_t *composite = &composite_tvb->composite;
  9.     composite->tvbs         = NULL;
  10.     composite->start_offsets = NULL;
  11.     composite->end_offsets     = NULL;
  13.     return tvb;
  14. }

追加 tvb 成员:

  1. // epan/tvbuff_composite.c
  2. void
  3. tvb_composite_append(tvbuff_t *tvb, tvbuff_t *member)
  4. {
  5.     struct tvb_composite *composite_tvb = (struct tvb_composite *) tvb;
  6.     tvb_comp_t *composite;
  8.     DISSECTOR_ASSERT(tvb && !tvb->initialized);
  9.     DISSECTOR_ASSERT(tvb->ops == &tvb_composite_ops);
  11.     /* Don't allow zero-length TVBs: composite_memcpy() can't handle them
  12.      * and anyway it makes no sense.
  13.      */
  14.     DISSECTOR_ASSERT(member->length);
  16.     composite       = &composite_tvb->composite;
  17.     composite->tvbs = g_slist_append(composite->tvbs, member);
  19.     /* Attach the composite TVB to the first TVB only. */
  20.     if (!composite->tvbs->next) {
  21.         tvb_add_to_chain((tvbuff_t *)composite->tvbs->data, tvb);
  22.     }
  23. }

composite 在组合完成后, 转换为可用 tvb. 转换之后不能再进行成员 tvb 添加操作, 而且调用者才可使用其中的数据:

  1. // epan/tvbuff_composite.c
  2. void
  3. tvb_composite_finalize(tvbuff_t *tvb)
  4. {
  5.     ...
  6.     composite->start_offsets = g_new(guint, num_members);
  7.     composite->end_offsets = g_new(guint, num_members);
  9.     // 遍历链表, 计算每个tvb成员的可用范围, 并更新composite tvb
  10.     for (slist = composite->tvbs; slist != NULL; slist = slist->next) {
  11.         DISSECTOR_ASSERT((guint) i < num_members);
  12.         member_tvb = (tvbuff_t *)slist->data;
  13.         composite->start_offsets[i] = tvb->length;
  14.         tvb->length += member_tvb->length;
  15.         tvb->reported_length += member_tvb->reported_length;
  16.         tvb->contained_length += member_tvb->contained_length;
  17.         composite->end_offsets[i] = tvb->length - 1;
  18.         i++;
  19.     }
  21.     tvb->initialized = TRUE;
  22.     tvb->ds_tvb = tvb;
  23. }

memcpy: // TODO

4.7 frame tvb

// TODO

4.x 报文解析过程中的tvbuff

顶层tvb

原始报文 tvb (即顶层 tvb) 创建过程:

  1. process_cap_file_single_pass ->
  2. process_packet_single_pass ->
  3. epan_dissect_run_with_taps ->
  4. frame_tvbuff_new_buffer ->
  5. frame_tvbuff_new ->
  6. tvb_new

process_cap_file_single_pass()
此函数中使用了 wsutil 中实现的 Buffer, 把报文读取到其中. Buffer 会分配内存.

  1. // tshark.c
  2. static pass_status_t
  3. process_cap_file_single_pass(capture_file *cf, wtap_dumper *pdh,
  4.                              int max_packet_count, gint64 max_byte_count,
  5.                              int *err, gchar **err_info,
  6.                              volatile guint32 *err_framenum)
  7. {
  8.   wtap_rec        rec;
  9.   Buffer          buf;
  10.   ...
  11.   wtap_rec_init(&rec);
  12.   // 初始化Buffer, 这里会实际分配内存, 具体细节见本文Buffer分析
  13.   ws_buffer_init(&buf, 1514);
  14.   ...
  15.   // 逐个读取报文
  16.   while (wtap_read(cf->provider.wth, &rec, &buf, err, err_info, &data_offset)) {
  17.     ...
  18.     if (process_packet_single_pass(cf, edt, data_offset, &rec, &buf, tap_flags)) {
  19.       ...
  20.     }
  21.     ...
  22.   }
  23.   ...
  24.   ws_buffer_free(&buf);
  25.   wtap_rec_cleanup(&rec);
  27.   return status;
  28. }

对于 pcap 报文, wtap_read() 最终会调用 libpcap_read_packet():

  1. // wiretap/libpcap.c
  2. static gboolean
  3. libpcap_read_packet(wtap *wth, FILE_T fh, wtap_rec *rec,
  4.     Buffer *buf, int *err, gchar **err_info)
  5. {
  6.     ...
  7.     // packet_size是从pcap frame首部读取到的
  8.     if (!libpcap_read_header(wth, fh, err, err_info, &hdr))
  9.         return FALSE;
  10.     ...
  11.     packet_size = hdr.hdr.incl_len;
  12.     ...
  13.     if (!wtap_read_packet_bytes(fh, buf, packet_size, err, err_info))
  14.         return FALSE;    /* failed */
  15.     ...
  16. }
  18. // -->
  19. // wiretap/wtap.c
  20. /*
  21.  * Read packet data into a Buffer, growing the buffer as necessary.
  22.  *
  23.  * This returns an error on a short read, even if the short read hit
  24.  * the EOF immediately.  (The assumption is that each packet has a
  25.  * header followed by raw packet data, and that we've already read the
  26.  * header, so if we get an EOF trying to read the packet data, the file
  27.  * has been cut short, even if the read didn't read any data at all.)
  28.  */
  29. gboolean
  30. wtap_read_packet_bytes(FILE_T fh, Buffer *buf, guint length, int *err,
  31.     gchar **err_info)
  32. {
  33.     ws_buffer_assure_space(buf, length);
  34.     return wtap_read_bytes(fh, ws_buffer_start_ptr(buf), length, err,
  35.         err_info);
  36. }
  38. // -->
  39. gboolean
  40. wtap_read_bytes(FILE_T fh, void *buf, unsigned int count, int *err,
  41.     gchar **err_info)
  42. {
  43.     int    bytes_read;
  45.     bytes_read = file_read(buf, count, fh);
  46.     ...
  47.     return TRUE;
  48. }

这里 buf 里只包含报文实际数据(如Ether->IP->..), 不包含 libpcap 帧首部等.

process_packet_single_pass()
这里调用 frame_tvbuff_new_buffer(), 根据之前的 Buffer 创建了顶层 tvb, 然后交给 EPAN 进行解析.

  1. // tshark.c
  2. static gboolean
  3. process_packet_single_pass(capture_file *cf, epan_dissect_t *edt, gint64 offset,
  4.                            wtap_rec *rec, Buffer *buf, guint tap_flags)
  5. {
  6.   frame_data      fdata;
  7.   ...
  8.   frame_data_init(&fdata, cf->count, rec, offset, cum_bytes);
  9.   ...
  10.   if (edt) {
  11.     ...
  12.     frame_data_set_before_dissect(&fdata, &cf->elapsed_time,
  13.                                   &cf->provider.ref, cf->provider.prev_dis);
  14.     ...
  15.     epan_dissect_run_with_taps(edt, cf->cd_t, rec,
  16.                                frame_tvbuff_new_buffer(&cf->provider, &fdata, buf),
  17.                                &fdata, cinfo);
  18.     ...
  19.   }
  20.   ...
  21.   if (edt) {
  22.     epan_dissect_reset(edt);
  23.     frame_data_destroy(&fdata);
  24.   }
  25.   return passed;
  26. }

frame_tvbuff_new_buffer()
这里使用另一个数据结构 tvb_frame 封装 tvbuff, 这样创建的 tvbuff 有特定的操作函数集. 这是常见用法.

  1. // frame_tvbuff.c
  2. struct tvb_frame {
  3.     struct tvbuff tvb;
  4.     Buffer *buf;         /* Packet data */
  5.     const struct packet_provider_data *prov;    /* provider of packet information */
  6.     gint64 file_off;     /**< File offset */
  7.     guint offset;
  8. };
  10. static const struct tvb_ops tvb_frame_ops = {
  11.     sizeof(struct tvb_frame), /* size */
  13.     frame_free,           /* free */
  14.     frame_offset,         /* offset */
  15.     frame_get_ptr,        /* get_ptr */
  16.     frame_memcpy,         /* memcpy */
  17.     frame_find_guint8,    /* find_guint8 */
  18.     frame_pbrk_guint8,    /* pbrk_guint8 */
  19.     frame_clone,          /* clone */
  20. };
  22. tvbuff_t *
  23. frame_tvbuff_new_buffer(const struct packet_provider_data *prov,
  24.     const frame_data *fd, Buffer *buf)
  25. {
  26.     // ws_buffer_start_ptr()返回Buffer中的数据指针
  27.     return frame_tvbuff_new(prov, fd, ws_buffer_start_ptr(buf));
  28. }
  30. /* based on tvb_new_real_data() */
  31. tvbuff_t *
  32. frame_tvbuff_new(const struct packet_provider_data *prov, const frame_data *fd,
  33.     const guint8 *buf)
  34. {
  35.     struct tvb_frame *frame_tvb;
  36.     tvbuff_t *tvb;
  38.     // 使用特定的frame操作函数集tvb_frame_ops
  39.     tvb = tvb_new(&tvb_frame_ops);
  40.     // buf指向Buffer中的内存, 该内存是Buffer之前分配的,
  41.     // 所以这个tvb实际并没有分配内存和拷贝, 只是引用
  42.     tvb->real_data        = buf;
  43.     // fd->cap_len是实际抓包抓到的数据长度, 而fd->pkt_len是所谓的上报长度
  44.     tvb->length           = fd->cap_len;
  45.     tvb->reported_length  = fd->pkt_len > G_MAXINT ? G_MAXINT : fd->pkt_len;
  46.     tvb->contained_length = tvb->reported_length;
  47.     tvb->initialized      = TRUE;
  49.     // 这个tvb是顶层real tvb, 它的数据源就是它自己
  50.     tvb->ds_tvb = tvb;
  52.     frame_tvb = (struct tvb_frame *) tvb;
  53.     // frame_tvb->buf不为NULL时tvb_frame_ops->frame_free会释放内存,
  54.     // 但process_cap_file_single_pass()中会自己释放buffer,
  55.     // 所以这里设为NULL表示不需要调用frame_free自动释放
  56.     frame_tvb->buf = NULL;
  58.     return tvb;
  59. }

解析器交接时的tvb

epan 结构体中包含 tvb 成员:

  1. struct epan_dissect {
  2.     struct epan_session *session;
  3.     tvbuff_t    *tvb;
  4.     proto_tree    *tree;
  5.     packet_info    pi;
  6. };

在解析过程中, 如 dissect_record() (epan/packet.c) 中, 设置 epan->tvb.

  1. // epan/epan.c
  2. void
  3. epan_dissect_run_with_taps(epan_dissect_t *edt, int file_type_subtype,
  4.     wtap_rec *rec, tvbuff_t *tvb, frame_data *fd,
  5.     column_info *cinfo)
  6. {
  7.     wmem_enter_packet_scope();
  8.     tap_queue_init(edt);
  9.     dissect_record(edt, file_type_subtype, rec, tvb, fd, cinfo);
  10.     tap_push_tapped_queue(edt);
  12.     /* free all memory allocated */
  13.     wmem_leave_packet_scope();
  14. }

把 tvb 添加到 packet info 的 data source 链表中, 并开始协议解析.

  1. /* Creates the top-most tvbuff and calls dissect_frame() */
  2. void
  3. dissect_record(epan_dissect_t *edt, int file_type_subtype,
  4.     wtap_rec *rec, tvbuff_t *tvb, frame_data *fd, column_info *cinfo)
  5. {
  6.   ...
  7.     /* Add this tvbuffer into the data_src list */
  8.     add_new_data_source(&edt->pi, edt->tvb, record_type);
  9.     ...
  10.     call_dissector_with_data(frame_handle, edt->tvb, &edt->pi, edt->tree, &frame_dissector_data);
  11.   ...
  12. }

这里的 frame_handle 就是伪协议”frame”对应的解析器句柄.

  1. // epan/packet.c
  2. /* Call a dissector through a handle and if this fails call the "data"
  3.  * dissector.
  4.  */
  5. int
  6. call_dissector_with_data(dissector_handle_t handle, tvbuff_t *tvb,
  7.                      packet_info *pinfo, proto_tree *tree, void *data)
  8. {
  9.     int ret;
  11.     ret = call_dissector_only(handle, tvb, pinfo, tree, data);
  12.     if (ret == 0) {
  13.         /*
  14.          * The protocol was disabled, or the dissector rejected
  15.          * it.  Just dissect this packet as data.
  16.          */
  17.         DISSECTOR_ASSERT(data_handle->protocol != NULL);
  18.         call_dissector_work(data_handle, tvb, pinfo, tree, TRUE, NULL);
  19.         return tvb_captured_length(tvb);
  20.     }
  21.     return ret;
  22. }
  24. // -->
  25. /* Call a dissector through a handle but if the dissector rejected it
  26.  * return 0.
  27.  */
  28. int
  29. call_dissector_only(dissector_handle_t handle, tvbuff_t *tvb,
  30.             packet_info *pinfo, proto_tree *tree, void *data)
  31. {
  32.     int ret;
  34.     DISSECTOR_ASSERT(handle != NULL);
  35.     ret = call_dissector_work(handle, tvb, pinfo, tree, TRUE, data);
  36.     return ret;
  37. }
  39. // -->
  40. static int
  41. call_dissector_work(dissector_handle_t handle, tvbuff_t *tvb, packet_info *pinfo_arg,
  42.             proto_tree *tree, gboolean add_proto_name, void *data)
  43. {
  44.     packet_info *pinfo = pinfo_arg;
  45.     const char  *saved_proto;
  46.     guint16      saved_can_desegment;
  47.     int          len;
  48.     guint        saved_layers_len = 0;
  49.     int          saved_tree_count = tree ? tree->tree_data->count : 0;
  50. ...
  51.     saved_proto = pinfo->current_proto;
  52.     saved_can_desegment = pinfo->can_desegment;
  53.     saved_layers_len = wmem_list_count(pinfo->layers);
  54.     DISSECTOR_ASSERT(saved_layers_len < PINFO_LAYER_MAX_RECURSION_DEPTH);
  55. ...
  56.     pinfo->saved_can_desegment = saved_can_desegment;
  57.     pinfo->can_desegment = saved_can_desegment-(saved_can_desegment>0);
  58.     if ((handle->protocol != NULL) && (!proto_is_pino(handle->protocol))) {
  59.         pinfo->current_proto =
  60.             proto_get_protocol_short_name(handle->protocol);
  61. ...
  62.         /* XXX Should we check for a duplicate layer here? */
  63.         if (add_proto_name) {
  64.             pinfo->curr_layer_num++;
  65.             wmem_list_append(pinfo->layers, GINT_TO_POINTER(proto_get_id(handle->protocol)));
  66.         }
  67.     }
  69.     if (pinfo->flags.in_error_pkt) {
  70.         len = call_dissector_work_error(handle, tvb, pinfo, tree, data);
  71.     } else {
  72.         /*
  73.          * Just call the subdissector.
  74.          */
  75.         len = call_dissector_through_handle(handle, tvb, pinfo, tree, data);
  76.     }
  77.     if (handle->protocol != NULL && !proto_is_pino(handle->protocol) && add_proto_name &&
  78.         (len == 0 || (tree && saved_tree_count == tree->tree_data->count))) {
  79. ...
  80.         while (wmem_list_count(pinfo->layers) > saved_layers_len) {
  81.             if (len == 0) {
  82. ...
  83.                 pinfo->curr_layer_num--;
  84.             }
  85.             wmem_list_remove_frame(pinfo->layers, wmem_list_tail(pinfo->layers));
  86.         }
  87.     }
  88.     pinfo->current_proto = saved_proto;
  89.     pinfo->can_desegment = saved_can_desegment;
  90.     return len;
  91. }
  93. // -->
  94. static int
  95. call_dissector_through_handle(dissector_handle_t handle, tvbuff_t *tvb,
  96.                   packet_info *pinfo, proto_tree *tree, void *data)
  97. {
  98.     const char *saved_proto;
  99.     int         len;
  101.     saved_proto = pinfo->current_proto;
  103.     if ((handle->protocol != NULL) && (!proto_is_pino(handle->protocol))) {
  104.         pinfo->current_proto =
  105.             proto_get_protocol_short_name(handle->protocol);
  106.     }
  108.     if (handle->dissector_type == DISSECTOR_TYPE_SIMPLE) {
  109.         len = ((dissector_t)handle->dissector_func)(tvb, pinfo, tree, data);
  110.     }
  111.     else if (handle->dissector_type == DISSECTOR_TYPE_CALLBACK) {
  112.         len = ((dissector_cb_t)handle->dissector_func)(tvb, pinfo, tree, data, handle->dissector_data);
  113.     }
  114.     else {
  115.         g_assert_not_reached();
  116.     }
  117.     pinfo->current_proto = saved_proto;
  119.     return len;
  120. }

接下来调用协议 frame 的解析器 ():

  1. // epan/dissectors/packet-frame.c
  2. ...
  3. case REC_TYPE_PACKET:
  4.     if ((force_docsis_encap) && (docsis_handle)) {
  5.         dissector_handle = docsis_handle;
  6.     } else {
  7. ...
  8.         dissector_handle =
  9.             dissector_get_uint_handle(wtap_encap_dissector_table,
  10.                                       pinfo->rec->rec_header.packet_header.pkt_encap);
  11.     }
  12.     if (dissector_handle != NULL) {
  13.         guint32 save_match_uint = pinfo->match_uint;
  15.         pinfo->match_uint =
  16.             pinfo->rec->rec_header.packet_header.pkt_encap;
  17.         call_dissector_only(dissector_handle,
  18.                             tvb, pinfo, parent_tree,
  19.                             (void *)pinfo->pseudo_header);
  20.         pinfo->match_uint = save_match_uint;
  21.     } else {
  22.         col_set_str(pinfo->cinfo, COL_PROTOCOL, "UNKNOWN");
  23.         col_add_fstr(pinfo->cinfo, COL_INFO, "WTAP_ENCAP = %d",
  24.                      pinfo->rec->rec_header.packet_header.pkt_encap);
  25.         call_data_dissector(tvb, pinfo, parent_tree);
  26.     }
  27.     break;
  28. ...

当找到下游解析器时, 又调用 call_dissector_only() , 所以形成了递归调用. frame 解析器并没有修改 tvb, 因为 frame 只是一个伪协议, tvb 中并不包含它的实际数据.

对于 Ethernet 报文, 下游是 eth 解析器, 而且对于普通 Ethrnet 报文, 它也没有修改 tvb. 下游是 ethertype 解析器.
ethertype 创建了 next_tvb, 把它传递给下游解析器, 此 tvb 不包含 ethernet 首部. ethertype 解析函数返回时, 仍返回原 tvb 长度.

  1. // epan/dissectors/packet-ethertype.c
  2. static int
  3. dissect_ethertype(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
  4. {
  5.     /* Get the captured length and reported length of the data
  6.        after the Ethernet type. */
  7.     captured_length = tvb_captured_length_remaining(tvb, ethertype_data->payload_offset);
  8.     reported_length = tvb_reported_length_remaining(tvb,
  9.                             ethertype_data->payload_offset);
  10. ...
  11.     next_tvb = tvb_new_subset_length_caplen(tvb, ethertype_data->payload_offset, captured_length,
  12.                   reported_length);
  13. ...
  14.     dissector_found = dissector_try_uint(ethertype_dissector_table,
  15.                              ethertype_data->etype, next_tvb, pinfo, tree);
  16. ...
  17.     return tvb_captured_length(tvb);
  18. }

设下层是 Ipv4:

  1. // epan/dissectors/packet-ip.c
  2. static int
  3. dissect_ip_v4(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void* data _U_)
  4. {
  5.   ...
  6.   /* If ip_defragment is on, this is a fragment, we have all the data
  7.    * in the fragment, and the header checksum is valid, then just add
  8.    * the fragment to the hashtable.
  9.    */
  10.   save_fragmented = pinfo->fragmented;
  11.   if (ip_defragment && (iph->ip_off & (IP_MF|IP_OFFSET)) &&
  12.       iph->ip_len > hlen &&
  13.       tvb_bytes_exist(tvb, offset, iph->ip_len - hlen) &&
  14.       ipsum == 0) {
  15.     ipfd_head = fragment_add_check(&ip_reassembly_table, tvb, offset,
  16.                                    pinfo,
  17.                                    iph->ip_proto ^ iph->ip_id ^ src32 ^ dst32 ^ pinfo->vlan_id,
  18.                                    NULL,
  19.                                    (iph->ip_off & IP_OFFSET) * 8,
  20.                                    iph->ip_len - hlen,
  21.                                    iph->ip_off & IP_MF);
  23.     next_tvb = process_reassembled_data(tvb, offset, pinfo, "Reassembled IPv4",
  24.                                         ipfd_head, &ip_frag_items,
  25.                                         &update_col_info, ip_tree);
  26.   } else {
  27.     /* If this is the first fragment, dissect its contents, otherwise
  28.        just show it as a fragment.
  30.        XXX - if we eventually don't save the reassembled contents of all
  31.        fragmented datagrams, we may want to always reassemble. */
  32.     if (iph->ip_off & IP_OFFSET) {
  33.       /* Not the first fragment - don't dissect it. */
  34.       next_tvb = NULL;
  35.     } else {
  36.       /* First fragment, or not fragmented.  Dissect what we have here. */
  38.       /* Get a tvbuff for the payload. */
  39.       next_tvb = tvb_new_subset_remaining(tvb, offset);
  41.       /*
  42.        * If this is the first fragment, but not the only fragment,
  43.        * tell the next protocol that.
  44.        */
  45.       if (iph->ip_off & IP_MF)
  46.         pinfo->fragmented = TRUE;
  47.       else
  48.         pinfo->fragmented = FALSE;
  49.     }
  50.   }
  52.   if (next_tvb == NULL) {
  53.     /* Just show this as a fragment. */
  54.     col_add_fstr(pinfo->cinfo, COL_INFO,
  55.                  "Fragmented IP protocol (proto=%s %u, off=%u, ID=%04x)",
  56.                  ipprotostr(iph->ip_proto), iph->ip_proto,
  57.                  (iph->ip_off & IP_OFFSET) * 8, iph->ip_id);
  58.     if ( ipfd_head && ipfd_head->reassembled_in != pinfo->num ) {
  59.       col_append_frame_number(pinfo, COL_INFO, " [Reassembled in #%u]",
  60.                       ipfd_head->reassembled_in);
  61.     }
  63.     call_data_dissector(tvb_new_subset_remaining(tvb, offset), pinfo,
  64.                    parent_tree);
  65.     pinfo->fragmented = save_fragmented;
  66.     return tvb_captured_length(tvb);
  67.   }
  69.   if (tvb_reported_length(next_tvb) > 0) {
  70.     /* Hand off to the next protocol.
  72.      XXX - setting the columns only after trying various dissectors means
  73.      that if one of those dissectors throws an exception, the frame won't
  74.      even be labeled as an IP frame; ideally, if a frame being dissected
  75.      throws an exception, it'll be labeled as a mangled frame of the
  76.      type in question. */
  77.     if (!ip_try_dissect(try_heuristic_first, iph->ip_proto, next_tvb, pinfo,
  78.                         parent_tree, iph)) {
  79.       /* Unknown protocol */
  80.       if (update_col_info) {
  81.         col_add_fstr(pinfo->cinfo, COL_INFO, "%s (%u)",
  82.                    ipprotostr(iph->ip_proto), iph->ip_proto);
  83.       }
  84.       call_data_dissector(next_tvb, pinfo, parent_tree);
  85.     }
  86.   }
  87.   pinfo->fragmented = save_fragmented;
  88.   return tvb_captured_length(tvb);
  89. }

一般条件下, 会创建一个 subset tvb, 传递给下游. 设下层是 udp, 最终调用 decode_udp_ports() 函数:

  1. void
  2. decode_udp_ports(tvbuff_t *tvb, int offset, packet_info *pinfo,
  3.                  proto_tree *udp_tree, int uh_sport, int uh_dport, int uh_ulen)
  4. {
  5.   ...
  6.   next_tvb = tvb_new_subset_length_caplen(tvb, offset, len, reported_len);
  7.   ...
  8.   if ((low_port != 0) &&
  9.       dissector_try_uint(udp_dissector_table, low_port, next_tvb, pinfo, tree)) {
  10.     handle_export_pdu_dissection_table(pinfo, next_tvb, low_port);
  11.     return;
  12.   }
  13.   if ((high_port != 0) &&
  14.       dissector_try_uint(udp_dissector_table, high_port, next_tvb, pinfo, tree)) {
  15.     handle_export_pdu_dissection_table(pinfo, next_tvb, high_port);
  16.     return;
  17.   }
  18.   ...
  19.   call_data_dissector(next_tvb, pinfo, tree);
  20.   ...
  21. }

如果下游是 DNS, 直接在 dissector_try_uint() 调用中结束, 最终调用 dissect_dns_common() , 其中正常流程没有创建 tvb, 也没有递交后下游.

所有协议层解析完毕后, 调用栈回退, 回到调用起点, 如 epan_dissect_run_with_taps(), 其中调用 wmem_leave_packet_scope(), 释放在当前报文作用域内存池中分配 的内存. 再回退, 如 process_packet_single_pass(), 会释放 epan_dissect_t 相关资源:

  1. // tshark.c, process_packet_single_pass()
  2.   if (edt) {
  3.     epan_dissect_reset(edt);
  4.     frame_data_destroy(&fdata);
  5.   }
  7. // epan/epan.c
  8. void
  9. epan_dissect_reset(epan_dissect_t *edt)
  10. {
  11.     ...
  12.     /* Free the data sources list. */
  13.     free_data_sources(&edt->pi);
  15.     if (edt->tvb) {
  16.         /* Free all tvb's chained from this tvb */
  17.         tvb_free_chain(edt->tvb);
  18.         edt->tvb = NULL;
  19.     }
  21.     if (edt->tree)
  22.         proto_tree_reset(edt->tree);
  24.     tmp = edt->pi.pool;
  25.     wmem_free_all(tmp);
  27.     memset(&edt->pi, 0, sizeof(edt->pi));
  28.     edt->pi.pool = tmp;
  29. }
  31. // epan/frame_data.c
  32. void
  33. frame_data_destroy(frame_data *fdata)
  34. {
  35.   if (fdata->pfd) {
  36.     g_slist_free(fdata->pfd);
  37.     fdata->pfd = NULL;
  38.   }
  39. }

其中, 调用 tvb_free_chain() 释放了各协议(可能)创建的 tvb. 不少情况下这些 tvb 没有对报文进行重组或拷贝, 这样的话实际上只是 free 掉 tvb 对象本身.

报文重组时的tvb

// TODO

5 Buffer

Buffer 实现了简单的内存块管理, 仅用于 wiretap.

5.1 数据结构

  1. typedef struct Buffer {
  2.     guint8    *data;
  3.     gsize    allocated;
  4.     gsize    start;
  5.     gsize    first_free;
  6. } Buffer;

其中:

  • data: 分配的内存块起始地址
  • allocated: 分配的内存块大小
  • start: 当前数据区起始位置
  • first_free: 当前数据区结束位置, 或者说空闲内存块的起始位置

除以上结构体成员外, Buffer 还有一些用宏或函数表示的属性:

  • length: 当前数据区大小
  • start_ptr: 当前数据区起始指针
  • end_ptr: 当前数据区结束位置

这里我特意区分了”内存块”与”数据区”:

  • 内存块指分配的大块堆内存; 而数据区则指的是这块内存上当前实际存储的用户数据
  • 内存块仅在空间不足时重新分配(更大的空间), 一般不变; 而数据区则是可能经常变化的, 可增大,缩小,清空等, 相当于内存块的一个滑动窗口

Buffer 的结构如下图所示:

Wireshark原理: 内存管理 - 图5

5.2 接口

init

初始化 Buffer. Buffer 内存块分配的最小单位是 2KB, 请求分配的大小小于 2KB 时, 仍分配 2KB. 不大于 2KB 的小内存块由指针数组 small_buffers 缓存.

  1. #define SMALL_BUFFER_SIZE (2 * 1024) /* Everyone still uses 1500 byte frames, right? */
  2. static GPtrArray *small_buffers = NULL; /* Guaranteed to be at least SMALL_BUFFER_SIZE */
  3. /* XXX - Add medium and large buffers? */
  5. /* Initializes a buffer with a certain amount of allocated space */
  6. void
  7. ws_buffer_init(Buffer* buffer, gsize space)
  8. {
  9.     g_assert(buffer);
  10.     if (G_UNLIKELY(!small_buffers)) small_buffers = g_ptr_array_sized_new(1024);
  12.     if (space <= SMALL_BUFFER_SIZE) {
  13.         if (small_buffers->len > 0) {
  14.             buffer->data = (guint8*) g_ptr_array_remove_index(small_buffers, small_buffers->len - 1);
  15.             g_assert(buffer->data);
  16.         } else {
  17.             buffer->data = (guint8*)g_malloc(SMALL_BUFFER_SIZE);
  18.         }
  19.         buffer->allocated = SMALL_BUFFER_SIZE;
  20.     } else {
  21.         buffer->data = (guint8*)g_malloc(space);
  22.         buffer->allocated = space;
  23.     }
  24.     buffer->start = 0;
  25.     buffer->first_free = 0;
  26. }

首次初始化一个 Buffer 时, 会创建空的 small_buffers 数组;
small_buffers 中缓存被回收的小 Buffer, 见后续 free 流程;
后续再初始化 Buffer 且请求大小 <= 2KB 时, 如果 small_buffers 数组中有缓存的内存块, 就直接使用它, 而不是调用 g_malloc 分配新的内存块, 这可提升性能.

free

释放 Buffer. 如果是小内存块, 则不调用实际的堆内存释放接口(g_free), 而是将它的内存块指针缓存到 small_buffers 数组, 以备之后使用.

  1. /* Frees the memory used by a buffer */
  2. void
  3. ws_buffer_free(Buffer* buffer)
  4. {
  5.     g_assert(buffer);
  6.     if (buffer->allocated == SMALL_BUFFER_SIZE) {
  7.         g_assert(buffer->data);
  8.         g_ptr_array_add(small_buffers, buffer->data);
  9.     } else {
  10.         g_free(buffer->data);
  11.     }
  12.     buffer->allocated = 0;
  13.     buffer->data = NULL;
  14. }

remove_start

将起始位置往后挪动若干个位置. 当挪动后的位置正好是当前内存块结束位置时, 相当于清空了内存块, 这将导致起始位置和结束位置都清零.

  1. void
  2. ws_buffer_remove_start(Buffer* buffer, gsize bytes)
  3. {
  4.     g_assert(buffer);
  5.     if (buffer->start + bytes > buffer->first_free) {
  6.         g_error("ws_buffer_remove_start ...
  7.     }
  8.     buffer->start += bytes;
  10.     if (buffer->start == buffer->first_free) {
  11.         buffer->start = 0;
  12.         buffer->first_free = 0;
  13.     }
  14. }

clean

清空内存块. 清空之后 Buffer 又回到了初始状态.

  1. # define ws_buffer_clean(buffer) ws_buffer_remove_start((buffer), ws_buffer_length(buffer))

assure_space

确保仍有指定大小的空闲块可用. 检查步骤如下:

  1. 首先检查尾部有没有可用空间, 如果有就返回;
  2. 否则, 如果已经使用了部分空间, 则把当前实际数据移动到内存块起始处. 这里也检查了首部有没有可用空间, 做数据移动只是为了把原有数据尽可能存放在靠前位置;
  3. 如果首部有可用空间, 返回;

  4. 至此, 已知首部和尾部都没有可用空间, 只能重新分配更大的内存块. 注意, 调用 realloc 成功后, 原内存块中的数据会被拷贝到新内存块中.

    1. /* Assures that there are 'space' bytes at the end of the used space
    2.  so that another routine can copy directly into the buffer space. After
    3.  doing that, the routine will also want to run
    4.  ws_buffer_increase_length(). */
    5. void
    6. ws_buffer_assure_space(Buffer* buffer, gsize space)
    7. {
    8.  g_assert(buffer);
    9.  gsize available_at_end = buffer->allocated - buffer->first_free;
    10.  gsize space_used;
    11.  gboolean space_at_beginning;
    13.  /* If we've got the space already, good! */
    14.  if (space <= available_at_end) {
    15.      return;
    16.  }
    18.  /* Maybe we don't have the space available at the end, but we would
    19.      if we moved the used space back to the beginning of the
    20.      allocation. The buffer could have become fragmented through lots
    21.      of calls to ws_buffer_remove_start(). I'm using buffer->start as the
    22.      same as 'available_at_start' in this comparison. */
    24.  /* or maybe there's just no more room. */
    26.  space_at_beginning = buffer->start >= space;
    27.  if (space_at_beginning || buffer->start > 0) {
    28.      space_used = buffer->first_free - buffer->start;
    29.      /* this memory copy better be safe for overlapping memory regions! */
    30.      memmove(buffer->data, buffer->data + buffer->start, space_used);
    31.      buffer->start = 0;
    32.      buffer->first_free = space_used;
    33.  }
    34.  /*if (buffer->start >= space) {*/
    35.  if (space_at_beginning) {
    36.      return;
    37.  }
    39.  /* We'll allocate more space */
    40.  buffer->allocated += space + 1024;
    41.  buffer->data = (guint8*)g_realloc(buffer->data, buffer->allocated);
    42. }

    append

    在当前内存块后面添加一段数据. 注意首先会调用 assure_space 确保有足够的空间, 然后再进行数据拷贝. 另外注意拷贝的目的地址是 data+first_free, 即当前空闲内存块起始地址 .

    1. void
    2. ws_buffer_append(Buffer* buffer, guint8 *from, gsize bytes)
    3. {
    4.  g_assert(buffer);
    5.  ws_buffer_assure_space(buffer, bytes);
    6.  memcpy(buffer->data + buffer->first_free, from, bytes);
    7.  buffer->first_free += bytes;
    8. }

    cleanup

    清理 small buffers 数组.

    1. void
    2. ws_buffer_cleanup(void)
    3. {
    4.  if (small_buffers) {
    5.      g_ptr_array_set_free_func(small_buffers, g_free);
    6.      g_ptr_array_free(small_buffers, TRUE);
    7.      small_buffers = NULL;
    8.  }
    9. }

6 frame_data

// TODO

参考