path: root/packet-nbns.c
AgeCommit message (Collapse)AuthorFilesLines
2004-07-18Move dissectors to epan/dissectors directory.Gilbert Ramirez1-1926/+0
Also move ncp222.py, x11-fields, process-x11-fields.pl, make-reg-dotc, and make-reg-dotc.py. Adjust #include lines in files that include packet-*.h files. svn path=/trunk/; revision=11410
2004-07-18Set the svn:eol-style property on all text files to "native", so thatGuy Harris1-1/+1
they have LF at the end of the line on UN*X and CR/LF on Windows; hopefully this means that if a CR/LF version is checked in on Windows, the CRs will be stripped so that they show up only when checked out on Windows, not on UN*X. svn path=/trunk/; revision=11400
2004-02-24with the cahnges to when to call the heuristic dissectorRonnie Sahlberg1-1/+12
(and the fact that nbss does not register its conversation) this caused WANT_PDU_TRACKING to be decremented multiple times between the dissectors and thus ethereal could no longer reliably spot SMB PDUs that started in the middle of a tcp segment (unless we do reassembly which we dont do unless we have to since it eats soo many resources) FIX so that ethereal once again can spot SMB (and other) protocol PDUs that start in the middle of a segment. svn path=/trunk/; revision=10219
2004-01-06The error code in an NBDS error packet is 1 byte, not 2.Guy Harris1-2/+2
svn path=/trunk/; revision=9570
2004-01-05removed some MSVC warnings (level 3)Ulf Lamping1-5/+5
svn path=/trunk/; revision=9561
2002-09-12Display the error string in the COL_INFO field for an unsuccessfulTim Potter1-5/+10
NBNS name query. svn path=/trunk/; revision=6278
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-39/+39
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-07Display calling and called names in COL_INFO for session request.Tim Potter1-1/+13
Display error string in COL_INFO for negative session response. svn path=/trunk/; revision=5961
2002-08-02Replace the types from sys/types.h and netinet/in.h by their glib.hJörg Mayer1-13/+9
equivalents for the toplevel directory. The removal of winsock2.h will hopefully not cause any problems under MSVC++, as those files using struct timeval still include wtap.h, which still includes winsock2.h. svn path=/trunk/; revision=5932
2002-05-15Use registered fields for the subfields of the Flags field in DNS andGuy Harris1-106/+143
NBNS. svn path=/trunk/; revision=5475
2002-05-01From Joerg Mayer: get rid of an unused argument.Guy Harris1-10/+6
Make the loop to dissect NBSS packets run to the end of the reported data, so it throws an exception on a short frame. Use -1 rather than "tvb_length(tvb)" for the length of items that run to the end of the frame. svn path=/trunk/; revision=5336
2002-02-28Handle NBSS messages where the NBSS *header* is split across TCP segmentGuy Harris1-16/+50
boundaries. svn path=/trunk/; revision=4831
2002-02-18Add support for reassembling RPC-over-TCP fragments, and do that in bothGuy Harris1-5/+2
RPC and NDMP. Show the RPC-over-TCP fragment header as a tree with bitfields below it. Add a routine to show a reported bounds error as an "Unreassembled Packet" or a "Malformed Packet" depending on whether "pinfo->fragmented" is set, and have NBNS and RPC use that. Add "ett_ndmp_file_stats" to the list of ett_ values to be initialized (it wasn't in that list, and wasn't getting initialized). When freeing up various hash tables and memory chunks in the RPC dissector, zero out the pointers to them, just to make sure we don't try to free them again. Always destroy the TCP segment key and address memory chunks in "tcp_desegment_init()", regardless of whether TCP desegmentation is enabled - we don't *allocate* them if TCP desegmentation isn't enabled, but we should free them even if it's not enabled. Also, when we free them, set the pointers to them to null, so we don't double-free them. Supply to subdissectors called from the TCP dissector the sequence number of the first byte handed to the sub dissector. svn path=/trunk/; revision=4753
2002-01-21Include files from the "epan" directory and subdirectories thereof withGuy Harris1-2/+2
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-20Allow a length of -1 to be specified when adding FT_NONE and FT_PROTOCOLGuy Harris1-7/+7
items to the protocol tree; it's interpreted as "the rest of the data in the tvbuff". This can be used if 1) the item covers the entire packet or the remaining payload in the packet or 2) the item's length won't be known until it's dissected, and will be then set with "proto_item_set_len()" - if an exception is thrown in the dissection, it means the item ran *past* the end of the tvbuff, so saying it runs to the end of the tvbuff is reasonable. Convert a number of "proto_tree_add_XXX()" calls using "tvb_length_remaining()", values derived from the result of "tvb_length()", or 0 (in the case of items whose length is unknown) to use -1 instead (using 0 means that if an exception is thrown, selecting the item highlights nothing; using -1 means it highlights all the data for that item that's available). In some places where "tvb_length()" or "tvb_length_remaining()" was used to determine how large a packet is, use "tvb_reported_length()" or "tvb_reported_length_remaining()", instead - the first two calls indicate how much captured data was in the packet, the latter two calls indicate how large the packet actually was (and the fact that using the latter could cause BoundsError exceptions to be thrown is a feature - if such an exception is thrown, the frame really *was* short, and it should be tagged as such). Replace some "proto_tree_add_XXX()" calls with equivalent "proto_tree_add_item()" calls. Fix some indentation. svn path=/trunk/; revision=4578
2002-01-19We no longer do explicit checks in low-level routines for running pastGuy Harris1-11/+1
the end of the data in the packet, so we don't need to do those checks in the callers of those routines - and thus don't need to do those checks in the callers of *those* routines. svn path=/trunk/; revision=4574
2002-01-07Shuffle a comment, and clean up white space.Guy Harris1-11/+12
svn path=/trunk/; revision=4490
2002-01-07Catch ReportedBoundsError exceptions when dissecting the payload of anGuy Harris1-3/+30
NBSS session message, and report the error but don't re-throw the exception; that way, we can continue to dissect additional NBSS messages in the frame or reassembled chunk of data, even if one of them happens to be too short for what's in it. svn path=/trunk/; revision=4489
2001-12-10Move the pointer to the "column_info" structure in the "frame_data"Guy Harris1-45/+46
structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
2001-12-03Make "dissector_add()", "dissector_delete()", and "dissector_change()"Guy Harris1-5/+10
take a dissector handle as an argument, rather than a pointer to a dissector function and a protocol ID. Associate dissector handles with dissector table entries. svn path=/trunk/; revision=4308
2001-11-21Get rid of some unused variables.Guy Harris1-2/+3
svn path=/trunk/; revision=4241
2001-11-13Hopefully the last time I have to change my e-mail address.Gilbert Ramirez1-3/+2
svn path=/trunk/; revision=4199
2001-11-03Rename the "private" member of the "packet_info" structure toGuy Harris1-2/+2
"private_data", to keep C++ compilers from getting heartburn. svn path=/trunk/; revision=4130
2001-10-12Sigh. A MacOS X 10.1 appeared to have put out a malformed NetBIOSGuy Harris1-2/+10
session request with a length greater than 128 bytes; crank the length limitation up to 256. (Perhaps I've misread the DNS spec or the NetBIOS-over-TCP spec, but the request sure *looked* as if it had a bogus second-level-encoding in the calling machine name.) svn path=/trunk/; revision=4019
2001-09-30The length of an NBSS message can be bigger than 64K, so make theGuy Harris1-39/+143
variable that holds it an "int" rather than a "guint16". Further strengthen the heuristics the NBSS dissector uses to distinguish NBSS messages from continuations of NBSS messages. If an frame contains an NBSS continuation, put the protocol tree item for the continuation data under an NBSS protocol tree item. Have the TCP dissector supply information to subdissectors via a "struct tcpinfo" pointed to by "pinfo->private"; move the urgent pointer value from a global variable into that structure, and add a Boolean flag that indicates whether the data it's handing to a subdissector is reassembled data or not. Make the NBSS dissector check for continuations only in non-reassembled data. Fix the computation, in the TCP dissector, of the offset into the tvbuff handed to the subdissector of the first byte of stuff that needs further reassembly, and fix the computation of the sequence number corresponding to that byte. svn path=/trunk/; revision=3984
2001-09-29Start the process of tvbuffifying the SMB dissector - give it aGuy Harris1-2/+1
tvbuffified heuristic-dissector interface, but have it immediately turn its arguments into an old-style buffer pointer and offset. Register the SMB dissector as a heuristic NetBIOS dissector, and have "dissect_netbios_payload()" just try the heuristics, as it no longer has to call the SMB dissector explicitly. svn path=/trunk/; revision=3973
2001-09-29Have "dissect_netbios_payload()" take as an argument a tvbuff containingGuy Harris1-9/+14
only the NetBIOS payload, and have the NBSS dissector construct tvbuffs of that sort (i.e., stop at the end of the NBSS session message, not at the end of the data handed to the NBSS dissector). svn path=/trunk/; revision=3972
2001-09-29Re-strengthen the check for NBSS continuations, to avoid, for example,Guy Harris1-4/+10
session messages with a zero byte count. svn path=/trunk/; revision=3971
2001-09-28From Todd Sabin: dissect the auth info in connection oriented dcerpcGuy Harris1-30/+6
packets. Make a "dissect_netbios_payload()" routine, called from the NetBIOS-over-802.2 (NBF), NetBIOS-over-IPX, and NetBIOS-over-TCP dissectors. Take Todd Sabin's changes to add a heuristic dissector list to the NBSS dissector, and apply them to "dissect_netbios_payload()" instead. Make the SMB dissector heuristic, returning FALSE if it doesn't see 0xFF S M B at the beginning of the packet, and have "dissect_netbios_payload()" first try the heuristic dissector list, then try the SMB dissector if no other heuristic dissector claims the packet, then just dissect the payload as data. From Todd Sabin: have the DCE/RPC dissector register as a heuristic dissector for NetBIOS. svn path=/trunk/; revision=3969
2001-09-17Add support for desegmentation of DNS messages.Guy Harris1-5/+4
Make the default for NBSS and ONC RPC-over-TCP desegmentation "on", rather than "off"; the default for desegmentation in general is "off", so this won't change the default behavior, but it lets you turn desegmentation on by flipping only one switch (and turn it off for particular protocols if you desire). svn path=/trunk/; revision=3943
2001-09-13TCP desegmentation support, and changes to the ONC RPC and NBSSGuy Harris1-1/+32
dissectors to use it, from Ronnie Sahlberg, with additional changes to handle the case where a frame contains messages that don't run past the end followed by one that does and where a reassembled chunk has, at the end, a message that runs past the end of that chunk (because the reassembly was for an earlier message). svn path=/trunk/; revision=3923
2001-08-05Make some of the NBDS fields enumerated fields, and give the BooleanGuy Harris1-70/+102
fields "Yes" and "No" as their strings and give them new names, so we don't need to use "proto_tree_add_XXX_format" and so that the enumerated fields can be filtered symbolically. Set the length of the top-level NBDS item based on the packet type, and set it to cover only the header, not the SMB message inside the packet, for direct and broadcast datagrams. Set the length of the top-level NBSS header to cover only the header, not the SMB message, for session messages. svn path=/trunk/; revision=3825
2001-07-02Tvbuffify the DNS, NBNS, NBDS, and NBSS dissectors.Guy Harris1-443/+319
Add a "tvb_memeql()" routine, for doing "memcmp()"-style equality comparisons. svn path=/trunk/; revision=3631
2001-06-18From Joerg Mayer: explicitly fill in all members of aGuy Harris1-17/+17
"header_field_info" structure, including the ones that are later set by the routines to register fields. svn path=/trunk/; revision=3561
2001-01-22Remove more "CHECK_DISPLAY_AS_DATA()" calls and "pinfo->current_proto ="Guy Harris1-12/+12
statements. Move the setting of the Protocol column in various dissectors before anything is fetched from the packet, and also clear the Info column at that point in those and some other dissectors, so that if an exception is thrown, the columns don't reflect the previous protocol. Don't use col_add_fstr(..., "%s", string); Use col_add_str(..., string); as it does the same thing, but doesn't drag all the heavy *printf machinery in. Fix the DDTP dissector to set the Info column regardless of whether we're building a protocol tree or not, and to set it to "Encrypted payload" if the payload is encrypted. Also fix a typo in a field name. Register the FTP data dissector as being associated with the FTP data protocol, not the FTP protocol (the removed "CHECK_DISPLAY_AS_DATA()" call checked "proto_ftp_data", and the removed "pinfo->current_proto =" line set it to "FTP-DATA", so it should be associated with "proto_ftp_data"). Make the H1 dissector check whether the frame has at least 2 bytes in it before checking the first two bytes; heuristic dissectors must not throw exceptions until they've accepted the packet as one of theirs. Use "tvb_format_text()" rather than "tvb_get_ptr()" and "format_text()" in some dissectors where the result of "tvb_get_ptr()" is used only in the "format_text()" call. In the Quake dissector, don't check whether there are at least 4 bytes in the packet - if we return, the packet won't be dissected at all (it's not as if some other dissector will get to handle it), and, if we don't return, we'll throw an exception if there aren't at least 4 bytes in the packet, so the packet will be marked as short or malformed, as appropriate. In the RIPng dissector, associate the table of strings for the command field with the command field, so that the dissector doesn't have to format the string for the protocol tree entry itself, and so that the filter construction dialog box can let you select "Request" or "Response" from a list rather than requiring you to know the values for "Request" and "Response". Make "dissect_rpc()" static, as it's called only through a heuristic dissector list. Use "col_set_str()" to set the COL_PROTOCOL column for RPC protocols; the string used is from a table provided by the dissector, and is a string constant. Don't format the Info column for WSP into a buffer and then format that buffer into the column with "%s" - "col_add_fstr()" can do the formatting for you, without having to allocate your own buffer (or run through the *printf machinery twice). Don't fetch fields from the WTP packet until you're ready to use them, so that you don't throw an exception before you even set the Protocol column or clear the Info column. Use "pinfo->destport", not "pi.destport", in the Zebra dissector when checking whether the packet is a request or reply, and do the check by comparing with "pinfo->match_port" rather than TCP_PORT_ZEBRA (so that if the dissector is ever registered on another port, it still correctly determines whether the packet is a request or reply - the Network Monitor HTTP dissector has port 80 wired into its brain, which is a bit irritating if you're trying to get it to dissect HTTP proxy traffic on port 3128 or proxy administration UI traffic on port 3132). svn path=/trunk/; revision=2931
2001-01-09Add an additional "protocol index" argument to "{old_}dissector_add()",Guy Harris1-5/+5
"{old_}heur_dissector_add()", "{old_}conv_dissector_add()", and "register_dissector()", so that an entry in those tables has associated with it the protocol index of the protocol the dissector handles (or -1, if there is no protocol index for it). This is for future use in a number of places. (Arguably, "proto_register_protocol()" should take a dissector pointer as an argument, but 1) it'd have to handle both regular and heuristic dissectors; 2) making it take either a "dissector_t" or a union of that and a "heur_dissector_t" introduces some painful header-file interdependencies so I'm punting on that for now. As with other Ethereal internal APIs, these APIs are subject to change in the future, at least until Ethereal 1.0 comes out....) svn path=/trunk/; revision=2849
2001-01-03Have "proto_register_protocol()" build a list of data structures forGuy Harris1-4/+6
protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
2000-11-19Fix buffer overruns:Gerald Combs1-2/+4
- packet-afs.c: dissect_acl() didn't restrict the size of a string read with sscanf(). An exploit has been released. - packet-nbns.c: When passed an illegal name, get_nbns_name() would overrun nbname with an error message. This isn't exploitable AFAIK, but it could result in a crash. - packet-ntp.c: dissect_ntp() wasn't checking the length of the reference clock's host name. This is most likely exploitable. This fix simply lops off the end of the host name if it's too long. We should probably add an ellipsis (...) as we have done in other places in the code. svn path=/trunk/; revision=2671
2000-11-19For each column, have both a buffer into which strings for that columnGuy Harris1-6/+6
can be put, and a pointer to the string for the column, which might or might not point to that buffer. Add a routine "col_set_str()", which sets the string for the column to the string passed to it as an argument; it should only be handed a static string (a string constant would be ideal). It doesn't do any copying, so it's faster than "col_add_str()". Make the routines that append to columns check whether the pointer to the string for the column points to the buffer for the column and, if not, copy the string for the column to the buffer for the column so that you can append to it (so you can use "col_set_str()" and then use "col_append_str()" or "col_append_fstr()"). Convert a bunch of "col_add_str()" calls that take a string constant as an argument to "col_set_str()" calls. Convert some "col_add_fstr()" calls that take a string constant as the only argument - i.e., the format string doesn't have any "%" slots into which to put strings for subsequent arguments to "col_set_str()" calls (those calls are just like "col_add_str()" calls). Replace an END_OF_FRAME reference in a tvbuffified dissector with a "tvb_length(tvb)" call. svn path=/trunk/; revision=2670
2000-11-14Check for existence of COL_INFO before adding "Short xxx packet" toGilbert Ramirez1-2/+4
COL_INFO. svn path=/trunk/; revision=2641
2000-08-13Add the "Edit:Protocols..." feature which currently only implementsLaurent Deniel1-1/+7
the following: It is now possible to enable/disable a particular protocol decoding (i.e. the protocol dissector is void or not). When a protocol is disabled, it is displayed as Data and of course, all linked sub-protocols are disabled as well. Disabling a protocol could be interesting: - in case of buggy dissectors - in case of wrong heuristics - for performance reasons - to decode the data as another protocol (TODO) Currently (if I am not wrong), all dissectors but NFS can be disabled (and dissectors that do not register protocols :-) I do not like the way the RPC sub-dissectors are disabled (in the sub-dissectors) since this could be done in the RPC dissector itself, knowing the sub-protocol hfinfo entry (this is why, I've not modified the NFS one yet). Two functions are added in proto.c : gboolean proto_is_protocol_enabled(int n); void proto_set_decoding(int n, gboolean enabled); and two MACROs which can be used in dissectors: OLD_CHECK_DISPLAY_AS_DATA(index, pd, offset, fd, tree) CHECK_DISPLAY_AS_DATA(index, tvb, pinfo, tree) See also the XXX in proto_dlg.c and proto.c around the new functions. svn path=/trunk/; revision=2267
2000-08-07Allow either old-style (pre-tvbuff) or new-style (tvbuffified)Guy Harris1-6/+6
dissectors to be registered as dissectors for particular ports, registered as heuristic dissectors, and registered as dissectors for conversations, and have routines to be used both by old-style and new-style dissectors to call registered dissectors. Have the code that calls those dissectors translate the arguments as necessary. (For conversation dissectors, replace "find_conversation_dissector()", which just returns a pointer to the dissector, with "old_try_conversation_dissector()" and "try_conversation_dissector()", which actually call the dissector, so that there's a single place at which we can do that translation. Also make "dissector_lookup()" static and, instead of calling it and, if it returns a non-null pointer, calling that dissector, just use "old_dissector_try_port()" or "dissector_try_port()", for the same reason.) This allows some dissectors that took old-style arguments and immediately translated them to new-style arguments to just take new-style arguments; make them do so. It also allows some new-style dissectors not to have to translate arguments before calling routines to look up and call dissectors; make them not do so. Get rid of checks for too-short frames in new-style dissectors - the tvbuff code does those checks for you. Give the routines to register old-style dissectors, and to call dissectors from old-style dissectors, names beginning with "old_", with the routines for new-style dissectors not having the "old_". Update the dissectors that use those routines appropriately. Rename "dissect_data()" to "old_dissect_data()", and "dissect_data_tvb()" to "dissect_data()". svn path=/trunk/; revision=2218
2000-05-31Add routines for adding items to a protocol tree that take arguments ofGuy Harris1-15/+15
a particular type, rather than taking a varargs list, along the lines of the "proto_tree_add_XXX_format()" routines. Replace most calls to "proto_tree_add_item()" and "proto_tree_add_item_hidden()" with calls to those routines. Rename "proto_tree_add_item()" and "proto_tree_add_item_hidden()" to "proto_tree_add_item_old()" and "proto_tree_add_item_hidden_old()", and add new "proto_tree_add_item()" and "proto_tree_add_item_hidden()" routines that don't take the item to be added as an argument - instead, they fetch the argument from the packet whose tvbuff was handed to them, from the offset handed to them. svn path=/trunk/; revision=2031
2000-05-11Add tvbuff class.Gilbert Ramirez1-105/+105
Add exceptions routines. Convert proto_tree_add_*() routines to require tvbuff_t* argument. Convert all dissectors to pass NULL argument ("NullTVB" macro == NULL) as the tvbuff_t* argument to proto_tree_add_*() routines. dissect_packet() creates a tvbuff_t, wraps the next dissect call in a TRY block, will print "Short Frame" on the proto_tree if a BoundsError exception is caught. The FDDI dissector is converted to use tvbuff's. svn path=/trunk/; revision=1939
2000-04-12A further update from Mark Muhlestein.Guy Harris1-2/+10
svn path=/trunk/; revision=1835
2000-04-12Mark Muhlestein's code to support CIFS-atop-TCP (without the NetBIOSGuy Harris1-27/+66
Session Service). svn path=/trunk/; revision=1832
2000-04-08Move calls to "dissector_add()" out of the register routines for TCP andGuy Harris1-4/+16
UDP and into the handoff registration routines for the protocols in question. Make the dissectors for those protocols static if they're not called outside the dissector's source file. Get rid of header files if all they did was declare dissectors that are now static; remove declarations of now-static dissectors from header files that do more than just declare the dissector. svn path=/trunk/; revision=1823
2000-03-12Break proto_tree_add_item_format() into multiple functions:Gilbert Ramirez1-6/+6
proto_tree_add_protocol_format() proto_tree_add_uint_format() proto_tree_add_ipxnet_format() proto_tree_add_ipv4_format() proto_tree_add_ipv6_format() proto_tree_add_bytes_format() proto_tree_add_string_format() proto_tree_add_ether_format() proto_tree_add_time_format() proto_tree_add_double_format() proto_tree_add_boolean_format() If using GCC 2.x, we can check the print-format against the variable args passed in. Regardless of compiler, we can now check at run-time that the field type passed into the function corresponds to what that function expects (FT_UINT, FT_BOOLEAN, etc.) Note that proto_tree_add_protocol_format() does not require a value field, since the value of a protocol is always NULL. It's more intuitive w/o the vestigial argument. Fixed a proto_tree_add_item_format-related bug in packet-isis-hello.c Fixed a variable usage bug in packet-v120.c. (ett_* was used instead of hf_*) Checked in Guy's fix for the function declearation for proto_tree_add_text() and proto_tree_add_notext(). svn path=/trunk/; revision=1713
2000-02-15Create a header file for every packet-*.c file. Prune the packet.h file.Gilbert Ramirez1-1/+3
This change allows you to add a new packet-*.c file and not cause a recompilation of everything that #include's packet.h Add the plugin_api.[ch] files ot the plugins/Makefile.am packaging list. Add #define YY_NO_UNPUT 1 to the lex source so that the yyunput symbol is not defined, squelching a compiler complaint when compiling the generated C file. svn path=/trunk/; revision=1637
2000-01-22Fix files that had Gilbert's old e-mail address or that didn't have myGuy Harris1-3/+3
forwarding e-mail address. svn path=/trunk/; revision=1522