Age | Commit message (Collapse) | Author | Files | Lines |
|
Register all reassembly tables with a central unit, allowing the
central unit to have the callback that initializes and destroys
the reassembly tables, rather than have dissectors do it individually.
Change-Id: Ic92619c06fb5ba6f1c3012f613cae14982e101d4
Reviewed-on: https://code.wireshark.org/review/19834
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
|
|
This patch introduces new APIs to allow dissectors to have a preference for
a (TCP) port, but the underlying data is actually part of Decode As functionality.
For now the APIs are intentionally separate from the regular APIs that register a
dissector within a dissector table. It may be possible to eventually combine the
two so that all dissectors that register with a dissector table have an opportunity
to "automatically" have a preference to adjust the "table value" through the
preferences dialog.
The tcp.port dissector table was used as the guinea pig. This will eventually be
expanded to other dissector tables as well (most notably UDP ports). Some
dissectors that "shared" a TCP/UDP port preference were also converted. It also
removed the need for some preference callback functions (mostly when the callback
function was the proto_reg_handoff function) so there is cleanup around that.
Dissectors that has a port preference whose default was 0 were switched to using
the dissector_add_for_decode_as_with_preference API rather than dissector_add_uint_with_preference
Also added comments for TCP ports used that aren't IANA registered.
Change-Id: I99604f95d426ad345f4b494598d94178b886eb67
Reviewed-on: https://code.wireshark.org/review/17724
Reviewed-by: Michael Mann <mmann78@netscape.net>
|
|
If an ASN.1 dissector is calling register_dissector for itself in its proto_register_xxx
function and then calling find_dissector for itself in its proto_reg_handoff_xxx
function then just create a static handle for that dissector and use the return
value of register_dissector, so the find isn't necessary.
Change-Id: I911bdadc2fb4259601c141b955e741a2369cc447
Reviewed-on: https://code.wireshark.org/review/16233
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
|
|
Change-Id: I8f738b2e01d7f448b21cdc1b488b16b7dd581911
Reviewed-on: https://code.wireshark.org/review/16104
Reviewed-by: Anders Broman <a.broman58@gmail.com>
|
|
Change-Id: I1208fe3c2ba428995526f561e8f792b8d871e9a9
Reviewed-on: https://code.wireshark.org/review/14388
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: João Valverde <j@v6e.pt>
|
|
That removes most of the uses of the frame number field in the
frame_data structure.
Change-Id: Ie22e4533e87f8360d7c0a61ca6ffb796cc233f22
Reviewed-on: https://code.wireshark.org/review/13509
Reviewed-by: Guy Harris <guy@alum.mit.edu>
|
|
Change-Id: I7b794cba2feda2cae40411e2b1cb9fb091d08220
Reviewed-on: https://code.wireshark.org/review/12480
Reviewed-by: Michael Mann <mmann78@netscape.net>
|
|
It ends up dragging in libwireshark headers, which programs not linking
with libwireshark shouldn't do. In particular, including
<epan/address.h> causes some functions that refer to libwireshark
functions to be defined if the compiler doesn't handle "static inline"
the way GCC does, and you end up requiring libwireshark even though you
shouldn't require it.
Move plurality() to wsutil/str_util.h, so that non-libwireshark code can
get it without include epan/packet.h. Fix includes as necessary.
Change-Id: Ie4819719da4c2b349f61445112aa419e99b977d3
Reviewed-on: https://code.wireshark.org/review/11545
Reviewed-by: Guy Harris <guy@alum.mit.edu>
|
|
General approach:
1. Split allocation (e.g. g_hash_table_new) from deallocation
(g_hash_table_destroy) into functions named "init" and "cleanup".
2. Remove guards that test whether the hash tables are set as
init is always called before cleanup.
3. Remove setting hash tables to NULL after destruction.
4. Copy register_init_routine function call and change init to cleanup.
5. Add cleanup function that calls reassembly_table_destroy if there
is a reassembly_table_init function.
Some templates were modified as follows:
- snmp: split renew into init+cleanup, but keep renew for the uat_new
callback.
- ldap,ros: Rename init to cleanup as there was no initialization.
- camel: remove init function from header, make it static. Remove debug
print.
- tcap: remove unused ssn_range assignment.
Files in epan/ were regenerated using cmake && make asn1
Change-Id: Idac16ebf0ec304e0c8becaab5d32904e56eb69b9
Reviewed-on: https://code.wireshark.org/review/9136
Reviewed-by: Michael Mann <mmann78@netscape.net>
|
|
Change-Id: Ie46a86c696b6b8889032db0fc6678768f18e1fc1
Reviewed-on: https://code.wireshark.org/review/8682
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
|
|
Provide a way for Lua-based dissectors to invoke tcp_dissect_pdus()
to make TCP-based dissection easier.
Bug: 9851
Change-Id: I91630ebf1f1fc1964118b6750cc34238e18a8ad3
Reviewed-on: https://code.wireshark.org/review/6778
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
Tested-by: Hadriel Kaplan <hadrielk@yahoo.com>
|
|
Change-Id: I36b2731d67f9345d2fd0c23800bba7d2be94c387
Reviewed-on: https://code.wireshark.org/review/6008
Reviewed-by: Bill Meier <wmeier@newsguy.com>
|
|
This mostly involved adding expert info capabilities to many of the dissectors so that they could correctly flag error conditions.
Only remaining proto_tree_add_text calls are in H248.cnf, which has a convoluted way of using hf_ data to make its tree.
Change-Id: I6412150c2ec1977d7fa38f3f0ed416680bdfb141
Reviewed-on: https://code.wireshark.org/review/3500
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
|
|
Change-Id: I5e40df8af6841e3dad71c41d7e43c7971611b15f
Reviewed-on: https://code.wireshark.org/review/2473
Reviewed-by: Evan Huus <eapache@gmail.com>
|
|
https://www.wireshark.org/lists/wireshark-dev/201406/msg00131.html
This reverts commit 246fe2ca4c67d8c98caa84e2f57694f6322e2f96.
Change-Id: Ib24bae0198c13a84bd7f731bf4af921212109a8f
Reviewed-on: https://code.wireshark.org/review/2430
Reviewed-by: Michael Mann <mmann78@netscape.net>
|
|
Change-Id: I9209c1271967405c34c1b6fa43e1726a4d3a5a3f
Reviewed-on: https://code.wireshark.org/review/2377
Reviewed-by: Anders Broman <a.broman58@gmail.com>
|
|
Change-Id: Ie476c6f82f318188b41ed922b92c6fec119ea954
Reviewed-on: https://code.wireshark.org/review/244
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
Tested-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
|
|
svn path=/trunk/; revision=54201
|
|
svn path=/trunk/; revision=53876
|
|
"new" style dissectors.
Now that "bytes consumed" can be determined, should tcp_dissect_pdus() take advantage of that?
Should tcp_dissect_pdus return length (bytes consumed)? There are many dissectors that just call tcp_dissect_pdus() then return tvb_length(tvb). Seems like that could all be rolled into one.
svn path=/trunk/; revision=53198
|
|
variables), I converted the ASN.1 dissectors that use pinfo->private_data to exchange a SESSION_DATA_STRUCTURE to instead only exchange it in the context of ASN.1. This meant converting dissectors to the "new" style to pass the SESSION_DATA_STRUCTURE as well as providing a pointer to it in asn1_ctx_t.private_data. Yes, it's still "private data", but it's not used by all dissectors like pinfo->private data is.
svn path=/trunk/; revision=53090
|
|
svn path=/trunk/; revision=52054
|
|
the same structure.
This is begin of work to split fragment head and fragments items.
svn path=/trunk/; revision=50708
|
|
svn path=/trunk/; revision=49927
|
|
incompatible filters in ASN.1 dissectors
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2402
svn path=/trunk/; revision=49599
|
|
svn path=/trunk/; revision=48820
|
|
svn path=/trunk/; revision=48598
|
|
be done on flows from one address to another; reassembly for protocols
running atop TCP should be done on flows from one TCP endpoint to
another.
We do this by:
adding "reassembly table" as a data structure;
associating hash tables for both in-progress reassemblies and
completed reassemblies with that data structure (currently, not
all reassemblies use the latter; they might keep completed
reassemblies in the first table);
having functions to create and destroy keys in that table;
offering standard routines for doing address-based and
address-and-port-based flow processing, so that dissectors not
needing their own specialized flow processing can just use them.
This fixes some mis-reassemblies of NIS YPSERV YPALL responses (where
the second YPALL response is processed as if it were a continuation of
a previous response between different endpoints, even though said
response is already reassembled), and also allows the DCE RPC-specific
stuff to be moved out of epan/reassembly.c into the DCE RPC dissector.
svn path=/trunk/; revision=48491
|
|
svn path=/trunk/; revision=45110
|
|
svn path=/trunk/; revision=45017
|
|
svn path=/trunk/; revision=44845
|
|
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7683 :
The reassembled fragments tree in the Packet Details view is awesome, but it
lacks one thing: a field that exposes the reassembled data.
tcp.data already exists for exposing a single TCP segment's payload as a byte
array. It would be handy to have something similar for a single application
layer PDU when TCP segment reassembly is involved. I propose
tcp.reassembled.data, named and placed after the already existing field
tcp.reassembled.length.
My primary use case for this feature is outputting tcp.reassembled.data with
tshark for further processing with a script.
The attached patch implements this very feature. Because the reassembled
fragment tree code is general purpose, i.e. not specific to just TCP, any
dissector that relies upon it can add a similar field very cheaply. In that
vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which
expose reassembled fragment data as a single byte stream for IPv4 and IPv6,
respectively. All other protocols that use the reassembly code have been left
alone, other than inserting NULL into their initializer lists for the newly
introduced struct field reassemble.h:fragment_items.hf_reassembled_data.
svn path=/trunk/; revision=44802
|
|
(COPYING will be updated in next commit)
svn path=/trunk/; revision=43536
|
|
Reformat long lines;
Use consistent indentation;
Do some general whitespace changes.
svn path=/trunk/; revision=41589
|
|
svn path=/trunk/; revision=40460
|
|
Also: remove trailing whitespace for a number of files.
svn path=/trunk/; revision=39503
|
|
The only change in each file is in a comment showing the asn2wrs cmd used to build that file.
svn path=/trunk/; revision=39427
|
|
Specifically: Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
the encoding parameter for proto_tree_add_item() calls which directly reference
an item in hf[] which has a type of:
FT_BOOLEAN
FT_IPv4
FT_EUI64
FT_GUID
FT_UINT_STRING
Also: For type FT_IPv6 use ENC_NA. (This was missed in SVN #39260)
svn path=/trunk/; revision=39332
|
|
dissectors:
Specifically: Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
the encoding parameter for proto_tree_add_item() calls which directly reference
an item in hf[] which has a type of:
FT_UINT8
FT_UINT16
FT_UINT24
FT_UINT32
FT_UINT64
FT_INT8
FT_INT16
FT_INT24
FT_INT32
FT_INT64
FT_FLOAT
FT_DOUBLE
svn path=/trunk/; revision=39294
|
|
svn path=/trunk/; revision=37118
|
|
svn path=/trunk/; revision=35705
|
|
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys. (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)
svn path=/trunk/; revision=35224
|
|
proto_reg_handoff_*() as their prefs callback.)
svn path=/trunk/; revision=35138
|
|
svn path=/trunk/; revision=34292
|
|
svn path=/trunk/; revision=33189
|
|
svn path=/trunk/; revision=33188
|
|
svn path=/trunk/; revision=33187
|
|
unused.
svn path=/trunk/; revision=33186
|
|
declaration of return value of call_ros_oid_callback().
svn path=/trunk/; revision=33182
|
|
IDMP provides a mapping of request-response service elements directly onto the Internet TCP/IP protocol, bypassing the ACSE, Presentation, Session and Transport layers of the OSI model. It also supports the use of TLS services.
The DAP dissector has been updated to use the IDMP protocol.
svn path=/trunk/; revision=33177
|