Added TCPStreamFollower class. It seems to be working right.

depends.d

@@ -1,7 +1,7 @@
 src/arp.o: src/arp.cpp include/arp.h include/pdu.h include/packetsender.h \
- include/ipaddress.h include/utils.h include/hwaddress.h \
- include/network_interface.h include/ip.h include/ethernetII.h \
- include/rawpdu.h include/utils.h include/constants.h
+ include/ipaddress.h include/endianness.h include/small_uint.h \
+ include/hwaddress.h include/network_interface.h include/ip.h \
+ include/ethernetII.h include/rawpdu.h include/constants.h
 
 include/arp.h:
 
@@ -11,7 +11,9 @@ include/packetsender.h:
 
 include/ipaddress.h:
 
-include/utils.h:
+include/endianness.h:
+
+include/small_uint.h:
 
 include/hwaddress.h:
 
@@ -23,12 +25,10 @@ include/ethernetII.h:
 
 include/rawpdu.h:
 
-include/utils.h:
-
 include/constants.h:
 src/bootp.o: src/bootp.cpp include/bootp.h include/pdu.h \
- include/packetsender.h include/utils.h include/ipaddress.h \
- include/hwaddress.h include/network_interface.h
+ include/packetsender.h include/endianness.h include/small_uint.h \
+ include/ipaddress.h include/hwaddress.h
 
 include/bootp.h:
 
@@ -36,40 +36,41 @@ include/pdu.h:
 
 include/packetsender.h:
 
-include/utils.h:
+include/endianness.h:
+
+include/small_uint.h:
 
 include/ipaddress.h:
 
 include/hwaddress.h:
+src/dhcp.o: src/dhcp.cpp include/endianness.h include/small_uint.h \
+ include/dhcp.h include/bootp.h include/pdu.h include/packetsender.h \
+ include/endianness.h include/ipaddress.h include/hwaddress.h \
+ include/ethernetII.h include/network_interface.h
 
-include/network_interface.h:
-src/dhcp.o: src/dhcp.cpp include/utils.h include/packetsender.h \
- include/pdu.h include/ipaddress.h include/hwaddress.h \
- include/network_interface.h include/dhcp.h include/bootp.h \
- include/utils.h include/ethernetII.h
+include/endianness.h:
 
-include/utils.h:
-
-include/packetsender.h:
-
-include/pdu.h:
-
-include/ipaddress.h:
-
-include/hwaddress.h:
-
-include/network_interface.h:
+include/small_uint.h:
 
 include/dhcp.h:
 
 include/bootp.h:
 
-include/utils.h:
+include/pdu.h:
+
+include/packetsender.h:
+
+include/endianness.h:
+
+include/ipaddress.h:
+
+include/hwaddress.h:
 
 include/ethernetII.h:
+
+include/network_interface.h:
 src/dns.o: src/dns.cpp include/dns.h include/pdu.h include/packetsender.h \
- include/utils.h include/ipaddress.h include/hwaddress.h \
- include/network_interface.h
+ include/endianness.h include/small_uint.h include/ipaddress.h
 
 include/dns.h:
 
@@ -77,18 +78,17 @@ include/pdu.h:
 
 include/packetsender.h:
 
-include/utils.h:
+include/endianness.h:
+
+include/small_uint.h:
 
 include/ipaddress.h:
-
-include/hwaddress.h:
-
-include/network_interface.h:
 src/dot11.o: src/dot11.cpp include/dot11.h include/pdu.h \
- include/packetsender.h include/utils.h include/ipaddress.h \
- include/hwaddress.h include/network_interface.h include/rawpdu.h \
- include/radiotap.h include/sniffer.h include/ethernetII.h \
- include/radiotap.h include/utils.h include/snap.h
+ include/packetsender.h include/endianness.h include/small_uint.h \
+ include/network_interface.h include/hwaddress.h include/ipaddress.h \
+ include/rawpdu.h include/radiotap.h include/sniffer.h \
+ include/ethernetII.h include/radiotap.h include/rsn_information.h \
+ include/snap.h
 
 include/dot11.h:
 
@@ -96,13 +96,15 @@ include/pdu.h:
 
 include/packetsender.h:
 
-include/utils.h:
+include/endianness.h:
 
-include/ipaddress.h:
+include/small_uint.h:
+
+include/network_interface.h:
 
 include/hwaddress.h:
 
-include/network_interface.h:
+include/ipaddress.h:
 
 include/rawpdu.h:
 
@@ -114,12 +116,13 @@ include/ethernetII.h:
 
 include/radiotap.h:
 
-include/utils.h:
+include/rsn_information.h:
 
 include/snap.h:
 src/eapol.o: src/eapol.cpp include/eapol.h include/pdu.h \
- include/packetsender.h include/utils.h include/ipaddress.h \
- include/hwaddress.h include/network_interface.h include/dot11.h
+ include/packetsender.h include/small_uint.h include/endianness.h \
+ include/dot11.h include/network_interface.h include/hwaddress.h \
+ include/ipaddress.h include/rsn_information.h
 
 include/eapol.h:
 
@@ -127,19 +130,23 @@ include/pdu.h:
 
 include/packetsender.h:
 
-include/utils.h:
+include/small_uint.h:
 
-include/ipaddress.h:
+include/endianness.h:
 
-include/hwaddress.h:
+include/dot11.h:
 
 include/network_interface.h:
 
-include/dot11.h:
+include/hwaddress.h:
+
+include/ipaddress.h:
+
+include/rsn_information.h:
 src/ethernetII.o: src/ethernetII.cpp include/ethernetII.h include/pdu.h \
- include/packetsender.h include/utils.h include/ipaddress.h \
- include/hwaddress.h include/network_interface.h include/rawpdu.h \
- include/ip.h include/arp.h include/utils.h
+ include/packetsender.h include/endianness.h include/small_uint.h \
+ include/hwaddress.h include/network_interface.h include/ipaddress.h \
+ include/rawpdu.h include/ip.h include/arp.h
 
 include/ethernetII.h:
 
@@ -147,25 +154,25 @@ include/pdu.h:
 
 include/packetsender.h:
 
-include/utils.h:
+include/endianness.h:
 
-include/ipaddress.h:
+include/small_uint.h:
 
 include/hwaddress.h:
 
 include/network_interface.h:
 
+include/ipaddress.h:
+
 include/rawpdu.h:
 
 include/ip.h:
 
 include/arp.h:
-
-include/utils.h:
 src/icmp.o: src/icmp.cpp include/icmp.h include/pdu.h \
- include/packetsender.h include/utils.h include/ipaddress.h \
- include/hwaddress.h include/network_interface.h include/rawpdu.h \
- include/utils.h
+ include/packetsender.h include/endianness.h include/small_uint.h \
+ include/rawpdu.h include/utils.h include/ipaddress.h include/hwaddress.h \
+ include/network_interface.h
 
 include/icmp.h:
 
@@ -173,6 +180,12 @@ include/pdu.h:
 
 include/packetsender.h:
 
+include/endianness.h:
+
+include/small_uint.h:
+
+include/rawpdu.h:
+
 include/utils.h:
 
 include/ipaddress.h:
@@ -180,14 +193,10 @@ include/ipaddress.h:
 include/hwaddress.h:
 
 include/network_interface.h:
-
-include/rawpdu.h:
-
-include/utils.h:
 src/ieee802_3.o: src/ieee802_3.cpp include/ieee802_3.h include/pdu.h \
- include/packetsender.h include/utils.h include/ipaddress.h \
- include/hwaddress.h include/network_interface.h include/llc.h \
- include/utils.h
+ include/packetsender.h include/endianness.h include/small_uint.h \
+ include/hwaddress.h include/network_interface.h include/ipaddress.h \
+ include/llc.h
 
 include/ieee802_3.h:
 
@@ -195,38 +204,30 @@ include/pdu.h:
 
 include/packetsender.h:
 
-include/utils.h:
+include/endianness.h:
 
-include/ipaddress.h:
+include/small_uint.h:
 
 include/hwaddress.h:
 
 include/network_interface.h:
 
+include/ipaddress.h:
+
 include/llc.h:
-
-include/utils.h:
-src/ipaddress.o: src/ipaddress.cpp include/ipaddress.h include/utils.h \
- include/packetsender.h include/pdu.h include/ipaddress.h \
- include/hwaddress.h include/network_interface.h
+src/ipaddress.o: src/ipaddress.cpp include/ipaddress.h \
+ include/endianness.h include/small_uint.h
 
 include/ipaddress.h:
 
-include/utils.h:
+include/endianness.h:
 
-include/packetsender.h:
-
-include/pdu.h:
-
-include/ipaddress.h:
-
-include/hwaddress.h:
-
-include/network_interface.h:
+include/small_uint.h:
 src/ip.o: src/ip.cpp include/ip.h include/pdu.h include/packetsender.h \
- include/ipaddress.h include/utils.h include/hwaddress.h \
- include/network_interface.h include/tcp.h include/udp.h include/icmp.h \
- include/rawpdu.h include/utils.h include/constants.h
+ include/small_uint.h include/ipaddress.h include/endianness.h \
+ include/tcp.h include/udp.h include/icmp.h include/rawpdu.h \
+ include/utils.h include/hwaddress.h include/network_interface.h \
+ include/constants.h
 
 include/ip.h:
 
@@ -234,13 +235,11 @@ include/pdu.h:
 
 include/packetsender.h:
 
+include/small_uint.h:
+
 include/ipaddress.h:
 
-include/utils.h:
-
-include/hwaddress.h:
-
-include/network_interface.h:
+include/endianness.h:
 
 include/tcp.h:
 
@@ -252,10 +251,13 @@ include/rawpdu.h:
 
 include/utils.h:
 
+include/hwaddress.h:
+
+include/network_interface.h:
+
 include/constants.h:
 src/llc.o: src/llc.cpp include/pdu.h include/packetsender.h include/pdu.h \
- include/llc.h include/utils.h include/ipaddress.h include/hwaddress.h \
- include/network_interface.h include/utils.h include/rawpdu.h
+ include/llc.h include/endianness.h include/small_uint.h include/rawpdu.h
 
 include/pdu.h:
 
@@ -265,21 +267,15 @@ include/pdu.h:
 
 include/llc.h:
 
-include/utils.h:
+include/endianness.h:
 
-include/ipaddress.h:
-
-include/hwaddress.h:
-
-include/network_interface.h:
-
-include/utils.h:
+include/small_uint.h:
 
 include/rawpdu.h:
 src/network_interface.o: src/network_interface.cpp \
  include/network_interface.h include/hwaddress.h include/ipaddress.h \
  include/utils.h include/packetsender.h include/pdu.h \
- include/network_interface.h
+ include/network_interface.h include/endianness.h include/small_uint.h
 
 include/network_interface.h:
 
@@ -294,6 +290,10 @@ include/packetsender.h:
 include/pdu.h:
 
 include/network_interface.h:
+
+include/endianness.h:
+
+include/small_uint.h:
 src/packetsender.o: src/packetsender.cpp include/packetsender.h \
  include/pdu.h include/packetsender.h
 
@@ -322,8 +322,9 @@ include/pdu.h:
 
 include/rawpdu.h:
 src/radiotap.o: src/radiotap.cpp include/radiotap.h include/pdu.h \
- include/packetsender.h include/network_interface.h include/hwaddress.h \
- include/ipaddress.h include/dot11.h include/utils.h include/utils.h
+ include/packetsender.h include/endianness.h include/small_uint.h \
+ include/network_interface.h include/hwaddress.h include/ipaddress.h \
+ include/dot11.h include/utils.h
 
 include/radiotap.h:
 
@@ -331,6 +332,10 @@ include/pdu.h:
 
 include/packetsender.h:
 
+include/endianness.h:
+
+include/small_uint.h:
+
 include/network_interface.h:
 
 include/hwaddress.h:
@@ -339,8 +344,6 @@ include/ipaddress.h:
 
 include/dot11.h:
 
-include/utils.h:
-
 include/utils.h:
 src/rawpdu.o: src/rawpdu.cpp include/rawpdu.h include/pdu.h \
  include/packetsender.h
@@ -350,10 +353,19 @@ include/rawpdu.h:
 include/pdu.h:
 
 include/packetsender.h:
+src/rsn_information.o: src/rsn_information.cpp include/rsn_information.h \
+ include/endianness.h include/small_uint.h
+
+include/rsn_information.h:
+
+include/endianness.h:
+
+include/small_uint.h:
 src/snap.o: src/snap.cpp include/snap.h include/pdu.h \
- include/packetsender.h include/utils.h include/ipaddress.h \
- include/hwaddress.h include/network_interface.h include/constants.h \
- include/arp.h include/ip.h include/eapol.h
+ include/packetsender.h include/endianness.h include/small_uint.h \
+ include/constants.h include/arp.h include/ipaddress.h \
+ include/hwaddress.h include/network_interface.h include/ip.h \
+ include/eapol.h
 
 include/snap.h:
 
@@ -361,7 +373,13 @@ include/pdu.h:
 
 include/packetsender.h:
 
-include/utils.h:
+include/endianness.h:
+
+include/small_uint.h:
+
+include/constants.h:
+
+include/arp.h:
 
 include/ipaddress.h:
 
@@ -369,17 +387,13 @@ include/hwaddress.h:
 
 include/network_interface.h:
 
-include/constants.h:
-
-include/arp.h:
-
 include/ip.h:
 
 include/eapol.h:
 src/sniffer.o: src/sniffer.cpp include/sniffer.h include/pdu.h \
- include/packetsender.h include/ethernetII.h include/utils.h \
- include/ipaddress.h include/hwaddress.h include/network_interface.h \
- include/radiotap.h
+ include/packetsender.h include/ethernetII.h include/endianness.h \
+ include/small_uint.h include/hwaddress.h include/network_interface.h \
+ include/ipaddress.h include/radiotap.h
 
 include/sniffer.h:
 
@@ -389,19 +403,21 @@ include/packetsender.h:
 
 include/ethernetII.h:
 
-include/utils.h:
+include/endianness.h:
 
-include/ipaddress.h:
+include/small_uint.h:
 
 include/hwaddress.h:
 
 include/network_interface.h:
 
+include/ipaddress.h:
+
 include/radiotap.h:
 src/tcp.o: src/tcp.cpp include/tcp.h include/pdu.h include/packetsender.h \
- include/utils.h include/ipaddress.h include/hwaddress.h \
- include/network_interface.h include/ip.h include/constants.h \
- include/rawpdu.h include/utils.h
+ include/small_uint.h include/endianness.h include/ip.h \
+ include/ipaddress.h include/constants.h include/rawpdu.h include/utils.h \
+ include/hwaddress.h include/network_interface.h
 
 include/tcp.h:
 
@@ -409,25 +425,60 @@ include/pdu.h:
 
 include/packetsender.h:
 
-include/utils.h:
+include/small_uint.h:
 
-include/ipaddress.h:
-
-include/hwaddress.h:
-
-include/network_interface.h:
+include/endianness.h:
 
 include/ip.h:
 
+include/ipaddress.h:
+
 include/constants.h:
 
 include/rawpdu.h:
 
 include/utils.h:
+
+include/hwaddress.h:
+
+include/network_interface.h:
+src/tcp_stream.o: src/tcp_stream.cpp include/rawpdu.h include/pdu.h \
+ include/packetsender.h include/tcp_stream.h include/sniffer.h \
+ include/ethernetII.h include/endianness.h include/small_uint.h \
+ include/hwaddress.h include/network_interface.h include/ipaddress.h \
+ include/radiotap.h include/tcp.h include/ip.h
+
+include/rawpdu.h:
+
+include/pdu.h:
+
+include/packetsender.h:
+
+include/tcp_stream.h:
+
+include/sniffer.h:
+
+include/ethernetII.h:
+
+include/endianness.h:
+
+include/small_uint.h:
+
+include/hwaddress.h:
+
+include/network_interface.h:
+
+include/ipaddress.h:
+
+include/radiotap.h:
+
+include/tcp.h:
+
+include/ip.h:
 src/udp.o: src/udp.cpp include/udp.h include/pdu.h include/packetsender.h \
+ include/endianness.h include/small_uint.h include/constants.h \
  include/utils.h include/ipaddress.h include/hwaddress.h \
- include/network_interface.h include/constants.h include/ip.h \
- include/rawpdu.h
+ include/network_interface.h include/ip.h include/rawpdu.h
 
 include/udp.h:
 
@@ -435,6 +486,12 @@ include/pdu.h:
 
 include/packetsender.h:
 
+include/endianness.h:
+
+include/small_uint.h:
+
+include/constants.h:
+
 include/utils.h:
 
 include/ipaddress.h:
@@ -443,15 +500,14 @@ include/hwaddress.h:
 
 include/network_interface.h:
 
-include/constants.h:
-
 include/ip.h:
 
 include/rawpdu.h:
 src/utils.o: src/utils.cpp include/utils.h include/packetsender.h \
  include/pdu.h include/ipaddress.h include/hwaddress.h \
- include/network_interface.h include/pdu.h include/ip.h include/utils.h \
- include/icmp.h include/arp.h
+ include/network_interface.h include/pdu.h include/ip.h \
+ include/small_uint.h include/endianness.h include/icmp.h include/arp.h \
+ include/endianness.h
 
 include/utils.h:
 
@@ -469,8 +525,12 @@ include/pdu.h:
 
 include/ip.h:
 
-include/utils.h:
+include/small_uint.h:
+
+include/endianness.h:
 
 include/icmp.h:
 
 include/arp.h:
+
+include/endianness.h:

examples/portscan.cpp

@@ -45,7 +45,7 @@ typedef std::pair<Sniffer*, std::string> sniffer_data;
  * the scanned port's status.
  */
 bool handler(PDU *pdu) {
-    TCP *tcp = pdu->find_inner_pdu<TCP>();
+    TCP *tcp = pdu->find_pdu<TCP>();
     if(tcp) {
         // Ok, it's a TCP PDU. Is RST flag on? Then port is closed.
         if(tcp->get_flag(TCP::RST)) {

examples/traceroute.cpp

@@ -93,15 +93,15 @@ private:
     }
 
     bool sniff_callback(PDU *pdu) {
-        IP *ip = pdu->find_inner_pdu<IP>();
-        RawPDU *raw = pdu->find_inner_pdu<RawPDU>();
+        IP *ip = pdu->find_pdu<IP>();
+        RawPDU *raw = pdu->find_pdu<RawPDU>();
         if(ip && raw) {
             ttl_map::const_iterator iter;
             IP inner_ip;
             // This will fail if its a corrupted packet
             try {
                 // Fetch the IP PDU attached to the ICMP response
-                inner_ip = IP(raw->payload(), raw->header_size());
+                inner_ip = IP(&raw->payload()[0], raw->payload_size());
             }
             catch(std::runtime_error &ex) {
                 return running;

include/rawpdu.h

@@ -105,6 +105,13 @@ namespace Tins {
          * \sa PDU::pdu_type
          */
         PDUType pdu_type() const { return PDU::RAW; }
+        
+        /**
+         * \sa PDU::clone_pdu
+         */
+        RawPDU *clone_pdu() const {
+            return new RawPDU(*this);
+        }
     private:
         void write_serialization(uint8_t *buffer, uint32_t total_sz, const PDU *parent);
 

include/tcp.h

@@ -407,8 +407,8 @@ namespace Tins {
         /**
          * \sa PDU::clone_pdu
          */
-        PDU *clone_pdu() const {
-            return do_clone_pdu<TCP>();
+        TCP *clone_pdu() const {
+            return new TCP(*this);
         }
     private:
         struct tcphdr {

include/tcp_stream.h

@@ -0,0 +1,173 @@
+/*
+ * libtins is a net packet wrapper library for crafting and
+ * interpreting sniffed packets.
+ *
+ * Copyright (C) 2011 Nasel
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef TINS_TCP_STREAM_H
+#define TINS_TCP_STREAM_H
+
+#include <map>
+#include <utility>
+#include <vector>
+#include <algorithm>
+#include <stdint.h>
+#include "sniffer.h"
+#include "tcp.h"
+#include "ip.h"
+#include "ipaddress.h"
+
+namespace Tins {
+class Sniffer;
+class RawPDU;
+
+class TCPSession {
+public:
+    struct SessionInfo {
+        IPv4Address client_addr, server_addr;
+        uint16_t client_port, server_port;
+        
+        SessionInfo() {}
+        
+        SessionInfo(IPv4Address client, IPv4Address server,
+            uint16_t cport, uint16_t sport);
+        
+        bool operator<(const SessionInfo &rhs) const;
+    };
+
+    typedef std::vector<uint8_t> payload_type;
+
+    TCPSession(IP *ip, TCP *tcp, uint64_t identifier);
+    TCPSession(const TCPSession &rhs);
+    TCPSession& operator=(const TCPSession &rhs);
+    ~TCPSession();
+    
+    const payload_type &client_payload() const {
+        return client_payload_;
+    }
+    
+    const payload_type &server_payload() const {
+        return server_payload_;
+    }
+    
+    uint64_t id() const {
+        return identifier;
+    }
+    
+    const SessionInfo &session_info() const {
+        return info;
+    }
+    
+    bool is_finished() const {
+        return fin_sent;
+    }
+    
+    bool update(IP *ip, TCP *tcp);
+    void clear_client_payload();
+    void clear_server_payload();
+
+    bool operator<(const TCPSession &rhs) const;
+private:
+    typedef std::map<uint32_t, RawPDU*> fragments_type;
+    
+    static void free_fragments(fragments_type &frags);
+    static fragments_type clone_fragments(const fragments_type &frags);
+    
+    bool generic_process(uint32_t &my_seq, uint32_t &other_seq, 
+      payload_type &pload, fragments_type &frags, TCP *tcp, RawPDU *raw);
+
+    uint32_t client_seq, server_seq;
+    SessionInfo info;
+    uint64_t identifier;
+    payload_type client_payload_, server_payload_;
+    fragments_type client_frags, server_frags;
+    bool fin_sent;
+};
+
+class TCPStreamFollower {
+public:
+    TCPStreamFollower();
+
+    template<typename DataFunctor, typename EndFunctor>
+    void follow_streams(Sniffer &sniffer, DataFunctor data_fun, EndFunctor end_fun);
+private:
+    typedef std::map<TCPSession::SessionInfo, TCPSession> sessions_type;
+    
+    template<typename DataFunctor, typename EndFunctor>
+    struct proxy_caller {
+        bool callback(PDU *pdu) {
+            return stream->callback(pdu, data_fun, end_fun);
+        }
+        
+        TCPStreamFollower *stream;
+        DataFunctor data_fun;
+        EndFunctor end_fun;
+    };
+    
+    template<typename DataFunctor, typename EndFunctor>
+    bool callback(PDU *pdu, const DataFunctor &fun, const EndFunctor &end_fun);
+    
+    sessions_type sessions;
+    uint64_t last_identifier;
+};
+
+template<typename DataFunctor, typename EndFunctor>
+void TCPStreamFollower::follow_streams(Sniffer &sniffer, DataFunctor data_fun, EndFunctor end_fun) {
+    typedef proxy_caller<DataFunctor, EndFunctor> proxy_type;
+    proxy_type proxy = { this, data_fun, end_fun };
+    sniffer.sniff_loop(make_sniffer_handler(&proxy, &proxy_type::callback));
+}
+
+template<typename DataFunctor, typename EndFunctor>
+bool TCPStreamFollower::callback(PDU *pdu, const DataFunctor &data_fun, const EndFunctor &end_fun) {
+    IP *ip = pdu->find_pdu<IP>();
+    TCP *tcp = pdu->find_pdu<TCP>();
+    if(ip && tcp) {
+        TCPSession::SessionInfo info = { 
+            ip->src_addr(), ip->dst_addr(),
+            tcp->sport(), tcp->dport()
+        };
+        sessions_type::iterator it = sessions.find(info);
+        if(it == sessions.end()) {
+            std::swap(info.client_addr, info.server_addr);
+            std::swap(info.client_port, info.server_port);
+            if((it = sessions.find(info)) == sessions.end()) {
+                if(tcp->get_flag(TCP::SYN) && !tcp->get_flag(TCP::ACK)) {
+                    sessions.insert(
+                        std::make_pair(
+                            info,
+                            TCPSession(ip, tcp, last_identifier++)
+                        )
+                    );
+                }
+                return true;
+            }
+        }
+        if(it->second.update(ip, tcp))
+            data_fun(it->second);
+        // We're done with this stream
+        if(it->second.is_finished()) {
+            end_fun(it->second);
+            sessions.erase(it);
+        }
+        return true;
+    }
+}
+}
+
+#endif // TINS_TCP_STREAM_H

include/tins.h

@@ -42,5 +42,6 @@
 #include "udp.h"
 #include "utils.h"
 #include "dns.h"
+#include "tcp_stream.h"
 
 #endif // TINS_TINS_H

src/tcp_stream.cpp

@@ -0,0 +1,162 @@
+/*
+ * libtins is a net packet wrapper library for crafting and
+ * interpreting sniffed packets.
+ *
+ * Copyright (C) 2011 Nasel
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include <iostream> //borrame
+#include "rawpdu.h"
+#include "tcp_stream.h"
+
+namespace Tins {
+
+TCPStreamFollower::TCPStreamFollower() : last_identifier(0) {
+    
+}
+
+
+
+TCPSession::SessionInfo::SessionInfo(IPv4Address client, 
+  IPv4Address server, uint16_t cport, uint16_t sport) 
+: client_addr(client), server_addr(server), client_port(cport), 
+  server_port(sport)
+{
+    
+}
+
+
+
+
+TCPSession::TCPSession(IP *ip, TCP *tcp, uint64_t identifier) 
+: client_seq(tcp->seq()), info(ip->src_addr(), ip->dst_addr(), 
+  tcp->sport(), tcp->dport()), identifier(identifier), fin_sent(false)
+{
+    
+}
+
+TCPSession::TCPSession(const TCPSession &rhs) {
+    *this = rhs;
+}
+
+TCPSession& TCPSession::operator=(const TCPSession &rhs) {
+    client_seq = rhs.client_seq;
+    server_seq = rhs.server_seq;
+    info = rhs.info;
+    identifier = rhs.identifier;
+    fin_sent = rhs.fin_sent;
+    client_payload_ = rhs.client_payload_;
+    server_payload_ = rhs.server_payload_;
+    client_frags = clone_fragments(rhs.client_frags);
+    server_frags = clone_fragments(rhs.server_frags);
+    return *this;
+}
+
+TCPSession::~TCPSession() {
+    free_fragments(client_frags);
+    free_fragments(server_frags);
+}
+
+void TCPSession::free_fragments(fragments_type &frags) {
+    for(fragments_type::iterator it = frags.begin(); it != frags.end(); ++it)
+        delete it->second;
+}
+
+TCPSession::fragments_type TCPSession::clone_fragments(const fragments_type &frags) {
+    fragments_type new_frags;
+    for(fragments_type::const_iterator it = frags.begin(); it != frags.end(); ++it)
+        new_frags.insert(std::make_pair(it->first, it->second->clone_pdu()));
+    return new_frags;
+}
+
+bool TCPSession::generic_process(uint32_t &my_seq, uint32_t &other_seq, 
+  payload_type &pload, fragments_type &frags, TCP *tcp, RawPDU *raw) 
+{
+    //std::cout << "Entre, my seq: " << std::hex << my_seq << std::endl;
+    bool added_some(false);
+    if(tcp->get_flag(TCP::SYN))
+        other_seq++;
+    if(tcp->get_flag(TCP::FIN))
+        fin_sent = true;
+    if(raw) {
+        frags[tcp->seq()] = static_cast<RawPDU*>(tcp->release_inner_pdu()); 
+        fragments_type::iterator it = frags.begin();
+        while(it != frags.end() && it->first == my_seq) {
+            //std::cout << "Consumo: " << my_seq << std::endl;
+            pload.insert(
+                pload.end(),
+                it->second->payload().begin(), 
+                it->second->payload().end()
+            );
+            //std::cout << "This size: " << it->second->payload_size() << std::endl;
+            my_seq += it->second->payload_size();
+            delete it->second;
+            frags.erase(it);
+            it = frags.begin();
+            added_some = true;
+        }
+    }
+    return added_some;
+}
+
+bool TCPSession::update(IP *ip, TCP *tcp) {
+    RawPDU *raw = tcp->find_pdu<RawPDU>();
+    if(tcp->get_flag(TCP::SYN) && tcp->get_flag(TCP::ACK)) {
+        server_seq = tcp->seq() + 1;
+    }
+    if(ip->src_addr() == info.client_addr)
+        return generic_process(client_seq, server_seq, client_payload_, client_frags, tcp, raw);
+    else
+        return generic_process(server_seq, client_seq, server_payload_, server_frags, tcp, raw);
+}
+
+void TCPSession::clear_client_payload() {
+    client_payload_.clear();
+}
+
+void TCPSession::clear_server_payload() {
+    server_payload_.clear();
+}
+
+bool TCPSession::SessionInfo::operator<(const SessionInfo &rhs) const {
+    if(client_addr == rhs.client_addr) {
+        if(server_addr == rhs.server_addr) {
+            if(client_port == rhs.client_port) {
+                return server_port < rhs.server_port;
+            }
+            else
+                return client_port < rhs.client_port;
+        }
+        else
+            return server_addr < rhs.server_addr;
+    }
+    else
+        return client_addr < rhs.client_addr;
+}
+
+bool TCPSession::operator<(const TCPSession &rhs) const {
+    if(client_seq == rhs.client_seq) {
+        if(server_seq == rhs.server_seq) {
+            return info < rhs.info;
+        }
+        else
+            return server_seq < rhs.server_seq;
+    }
+    else
+        return client_seq < rhs.client_seq;
+}
+}