From Robert Bullen via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7683 :

The reassembled fragments tree in the Packet Details view is awesome, but it
lacks one thing: a field that exposes the reassembled data.

tcp.data already exists for exposing a single TCP segment's payload as a byte
array. It would be handy to have something similar for a single application
layer PDU when TCP segment reassembly is involved. I propose
tcp.reassembled.data, named and placed after the already existing field
tcp.reassembled.length.

My primary use case for this feature is outputting tcp.reassembled.data with
tshark for further processing with a script.

The attached patch implements this very feature. Because the reassembled
fragment tree code is general purpose, i.e. not specific to just TCP, any
dissector that relies upon it can add a similar field very cheaply. In that
vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which
expose reassembled fragment data as a single byte stream for IPv4 and IPv6,
respectively. All other protocols that use the reassembly code have been left
alone, other than inserting NULL into their initializer lists for the newly
introduced struct field reassemble.h:fragment_items.hf_reassembled_data.

svn path=/trunk/; revision=44802

1 files changed, 19 insertions, 17 deletions

diff --git a/epan/dissectors/packet-t38.c b/epan/dissectors/packet-t38.c
index a2553e42bb..3ebf58f765 100644
--- a/epan/dissectors/packet-t38.c
+++ b/epan/dissectors/packet-t38.c
@@ -44,10 +44,10 @@
  * http://www.itu.int/ITU-T/asn1/database/itu-t/t/t38/2002-Amd1/T38.html (Pre-Corrigendum=FALSE)
  */
 
-/* TO DO:  
- * - TCP desegmentation is currently not supported for T.38 IFP directly over TCP. 
+/* TO DO:
+ * - TCP desegmentation is currently not supported for T.38 IFP directly over TCP.
  * - H.245 dissectors should be updated to start conversations for T.38 similar to RTP.
- * - Sometimes the last octet is not high-lighted when selecting something in the tree. Bug in PER dissector? 
+ * - Sometimes the last octet is not high-lighted when selecting something in the tree. Bug in PER dissector?
  * - Add support for RTP payload audio/t38 (draft-jones-avt-audio-t38-03.txt), i.e. T38 in RTP packets.
  */
 
@@ -74,7 +74,7 @@
 #include <epan/emem.h>
 #include <epan/strutil.h>
 
-#define PORT_T38 6004  
+#define PORT_T38 6004
 static guint global_t38_tcp_port = PORT_T38;
 static guint global_t38_udp_port = PORT_T38;
 
@@ -86,7 +86,7 @@ static gboolean use_pre_corrigendum_asn1_specification = TRUE;
 /* dissect packets that looks like RTP version 2 packets as RTP     */
 /* instead of as T.38. This may result in that some T.38 UPTL       */
 /* packets with sequence number values higher than 32767 may be     */
-/* shown as RTP packets.                                            */ 
+/* shown as RTP packets.                                            */
 static gboolean dissect_possible_rtpv2_packets_as_rtp = FALSE;
 
 
@@ -214,6 +214,8 @@ static const fragment_items data_frag_items = {
 	&hf_t38_reassembled_in,
 	/* Reassembled length field */
 	&hf_t38_reassembled_length,
+	/* Reassembled data field */
+	NULL,
 	/* Tag */
 	"Data fragments"
 };
@@ -427,7 +429,7 @@ force_reassemble_seq(packet_info *pinfo, guint32 id,
 	fd_head->reassembled_in=pinfo->fd->num;
 
 	col_append_fstr(pinfo->cinfo, COL_INFO, " (t4-data Reassembled: %d pack lost, %d pack burst lost)", packet_lost, burst_lost);
-	
+
 	p_t38_packet_conv_info->packet_lost = packet_lost;
 	p_t38_packet_conv_info->burst_lost = burst_lost;
 
@@ -739,8 +741,8 @@ dissect_t38_T_field_data(tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_
 
             if (!frag_msg) { /* Not last packet of reassembled */
                 if (Data_Field_field_type_value == 0) {
-                    col_append_fstr(actx->pinfo->cinfo, COL_INFO," (HDLC fragment %u)", 
-                                                                     seq_number + (guint32)p_t38_packet_conv_info->additional_hdlc_data_field_counter 
+                    col_append_fstr(actx->pinfo->cinfo, COL_INFO," (HDLC fragment %u)",
+                                                                     seq_number + (guint32)p_t38_packet_conv_info->additional_hdlc_data_field_counter
                                                                        - (guint32)p_t38_packet_conv_info->reass_start_seqnum);
                 } else {
                     col_append_fstr(actx->pinfo->cinfo, COL_INFO," (t4-data fragment %u)", seq_number - (guint32)p_t38_packet_conv_info->reass_start_seqnum);
@@ -1000,11 +1002,11 @@ init_t38_info_conv(packet_info *pinfo)
 	t38_info->frame_num_first_t4_data = 0;
 
 
-	/* 
+	/*
 		p_t38_packet_conv hold the conversation info in each of the packets.
 		p_t38_conv hold the conversation info used to reassemble the HDLC packets, and also the Setup info (e.g SDP)
-		If we already have p_t38_packet_conv in the packet, it means we already reassembled the HDLC packets, so we don't 
-		need to use p_t38_conv 
+		If we already have p_t38_packet_conv in the packet, it means we already reassembled the HDLC packets, so we don't
+		need to use p_t38_conv
 	*/
 	p_t38_packet_conv = NULL;
 	p_t38_conv = NULL;
@@ -1193,10 +1195,10 @@ dissect_t38_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
 	if(t38_tpkt_usage == T38_TPKT_ALWAYS){
 		dissect_tpkt_encap(tvb,pinfo,tree,t38_tpkt_reassembly,t38_tcp_pdu_handle);
-	} 
+	}
 	else if((t38_tpkt_usage == T38_TPKT_NEVER) || (is_tpkt(tvb,1) == -1)){
 		dissect_t38_tcp_pdu(tvb, pinfo, tree);
-	} 
+	}
 	else {
 		dissect_tpkt_encap(tvb,pinfo,tree,t38_tpkt_reassembly,t38_tcp_pdu_handle);
 	}
@@ -1210,13 +1212,13 @@ dissect_t38(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 		dissect_t38_tcp(tvb, pinfo, tree);
 	}
 	else if(pinfo->ipproto == IP_PROTO_UDP)
-	{   
+	{
 		dissect_t38_udp(tvb, pinfo, tree);
 	}
 }
 
 /* Look for conversation info and display any setup info found */
-void 
+void
 show_setup_info(tvbuff_t *tvb, proto_tree *tree, t38_conv *p_t38_conversation)
 {
 	proto_tree *t38_setup_tree;
@@ -1356,7 +1358,7 @@ proto_register_t38(void)
 			FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } },
 		{&hf_t38_fragment_multiple_tails,
 			{"Message has multiple tail fragments",
-			"t38.fragment.multiple_tails", 
+			"t38.fragment.multiple_tails",
 			FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } },
 		{&hf_t38_fragment_too_long_fragment,
 			{"Message fragment too long", "t38.fragment.too_long_fragment",
@@ -1429,7 +1431,7 @@ proto_register_t38(void)
 	prefs_register_uint_preference(t38_module, "udp.port",
 		"T.38 UDP Port",
 		"Set the UDP port for T.38 messages",
-		10, &global_t38_udp_port);	
+		10, &global_t38_udp_port);
 	prefs_register_bool_preference(t38_module, "reassembly",
 		"Reassemble T.38 PDUs over TPKT over TCP",
 		"Whether the dissector should reassemble T.38 PDUs spanning multiple TCP segments "