Wireshark-dev: [Wireshark-dev] Two-level PDU reassembly

From: Jérôme Hamm <jerome.hamm@xxxxxxxxxxxxxxxxxxxx>
Date: Fri, 04 Feb 2022 09:15:55 +0100
Hi,

I am working on ssh dissection. I am now trying to reassemble packets.
Actually there are two levels of fragmentation when you use sftp.
The first level are multiple tcp packets which contain data that must be decrypted (when you have the right crypto byte count, for example 32kiB). And then the decrypted data contains the sftp data (for example 32kiB worth of read file, which do not fit in the previously mentioned 32kiB because there are headers for sftp framing, leading to for example [not the real value] 32778 bytes), which need to be reassembled separately from the crypted data.

How can I achieve this?

If I am not mistaken, the packet_info structure is not recreated in my subdissector, so when I change the pinfo->desegment_offset I am actually overwriting the value I previously set for tcp reassembly, and all hell breaks loose.

Cheers.