aboutsummaryrefslogtreecommitdiffstats
path: root/packet-netbios.c
AgeCommit message (Collapse)AuthorFilesLines
2001-09-29Make the item for NetBIOS only as long as the NetBIOS header, so that itGuy Harris1-2/+2
doesn't cover the payload. svn path=/trunk/; revision=3977
2001-09-29Start the process of tvbuffifying the SMB dissector - give it aGuy Harris1-25/+5
tvbuffified heuristic-dissector interface, but have it immediately turn its arguments into an old-style buffer pointer and offset. Register the SMB dissector as a heuristic NetBIOS dissector, and have "dissect_netbios_payload()" just try the heuristics, as it no longer has to call the SMB dissector explicitly. svn path=/trunk/; revision=3973
2001-09-29Have "dissect_netbios_payload()" take as an argument a tvbuff containingGuy Harris1-14/+13
only the NetBIOS payload, and have the NBSS dissector construct tvbuffs of that sort (i.e., stop at the end of the NBSS session message, not at the end of the data handed to the NBSS dissector). svn path=/trunk/; revision=3972
2001-09-28From Todd Sabin: dissect the auth info in connection oriented dcerpcGuy Harris1-23/+39
packets. Make a "dissect_netbios_payload()" routine, called from the NetBIOS-over-802.2 (NBF), NetBIOS-over-IPX, and NetBIOS-over-TCP dissectors. Take Todd Sabin's changes to add a heuristic dissector list to the NBSS dissector, and apply them to "dissect_netbios_payload()" instead. Make the SMB dissector heuristic, returning FALSE if it doesn't see 0xFF S M B at the beginning of the packet, and have "dissect_netbios_payload()" first try the heuristic dissector list, then try the SMB dissector if no other heuristic dissector claims the packet, then just dissect the payload as data. From Todd Sabin: have the DCE/RPC dissector register as a heuristic dissector for NetBIOS. svn path=/trunk/; revision=3969
2001-09-14Make the resolution for time values be nanoseconds rather thanGuy Harris1-8/+6
microseconds. Fix some "signed vs. unsigned" comparison warnings. svn path=/trunk/; revision=3934
2001-06-18From Joerg Mayer: explicitly fill in all members of aGuy Harris1-18/+18
"header_field_info" structure, including the ones that are later set by the routines to register fields. svn path=/trunk/; revision=3561
2001-05-27Don't use END_OF_FRAME in tvbuffified dissectors.Guy Harris1-2/+2
svn path=/trunk/; revision=3468
2001-02-26Tvbuffify a commented-out line.Guy Harris1-2/+2
svn path=/trunk/; revision=3075
2001-01-22Remove more "CHECK_DISPLAY_AS_DATA()" calls and "pinfo->current_proto ="Guy Harris1-5/+1
statements. Move the setting of the Protocol column in the Appletalk ARP and IPX dissectors before anything is fetched from the packet, and also clear the Info column at that point in those and some other dissectors, so that if an exception is thrown, the columns don't reflect the previous protocol. Fix the registration of the IPX RIP dissector to use the right protocol ID. svn path=/trunk/; revision=2928
2001-01-15"get_netbios_name()" can never return a negative number as the nameGuy Harris1-33/+11
type, so "netbios_add_name()" doesn't need to check for it doing so (yes, the tvbuff stuff *does* catch "get_netbios_name()" running past the end of the packet, and causes an exception to be thrown). Get rid of the check, and get rid of "netbios_add_name()"s return value. In "dissect_nbipx_dg()", always call the SMB dissector if there's data left in the packet, regardless of whether the "tree" argument is null or not; subdissectors should always be called, so they can build any internal state on the first pass through the capture, and so that they can fill in the Protocol and Info columns. svn path=/trunk/; revision=2899
2001-01-09Add an additional "protocol index" argument to "{old_}dissector_add()",Guy Harris1-2/+2
"{old_}heur_dissector_add()", "{old_}conv_dissector_add()", and "register_dissector()", so that an entry in those tables has associated with it the protocol index of the protocol the dissector handles (or -1, if there is no protocol index for it). This is for future use in a number of places. (Arguably, "proto_register_protocol()" should take a dissector pointer as an argument, but 1) it'd have to handle both regular and heuristic dissectors; 2) making it take either a "dissector_t" or a union of that and a "heur_dissector_t" introduces some painful header-file interdependencies so I'm punting on that for now. As with other Ethereal internal APIs, these APIs are subject to change in the future, at least until Ethereal 1.0 comes out....) svn path=/trunk/; revision=2849
2001-01-03Have "proto_register_protocol()" build a list of data structures forGuy Harris1-2/+2
protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
2000-12-03Add the standard "CHECK_DISPLAY_AS_DATA()" call.Guy Harris1-1/+4
svn path=/trunk/; revision=2736
2000-11-19For each column, have both a buffer into which strings for that columnGuy Harris1-3/+3
can be put, and a pointer to the string for the column, which might or might not point to that buffer. Add a routine "col_set_str()", which sets the string for the column to the string passed to it as an argument; it should only be handed a static string (a string constant would be ideal). It doesn't do any copying, so it's faster than "col_add_str()". Make the routines that append to columns check whether the pointer to the string for the column points to the buffer for the column and, if not, copy the string for the column to the buffer for the column so that you can append to it (so you can use "col_set_str()" and then use "col_append_str()" or "col_append_fstr()"). Convert a bunch of "col_add_str()" calls that take a string constant as an argument to "col_set_str()" calls. Convert some "col_add_fstr()" calls that take a string constant as the only argument - i.e., the format string doesn't have any "%" slots into which to put strings for subsequent arguments to "col_set_str()" calls (those calls are just like "col_add_str()" calls). Replace an END_OF_FRAME reference in a tvbuffified dissector with a "tvb_length(tvb)" call. svn path=/trunk/; revision=2670
2000-11-13- Fix the hex pane offsets for hf_netb_local_ses_no,Gerald Combs1-6/+10
hf_netb_remote_ses_no, and hf_netb_data2. - Change hf_netb_local_ses_no and hf_netb_remote_ses_no from FT_UINT16 to FT_UINT8. - Add hf_netb_data2 to hf_netb. svn path=/trunk/; revision=2626
2000-11-11Fix the test for the first 10 bytes of a NetBIOS name being all zeroes.Guy Harris1-2/+2
svn path=/trunk/; revision=2607
2000-11-10tvbuffification by Jeff Foster.Gilbert Ramirez1-330/+407
svn path=/trunk/; revision=2601
2000-08-13Add the "Edit:Protocols..." feature which currently only implementsLaurent Deniel1-1/+3
the following: It is now possible to enable/disable a particular protocol decoding (i.e. the protocol dissector is void or not). When a protocol is disabled, it is displayed as Data and of course, all linked sub-protocols are disabled as well. Disabling a protocol could be interesting: - in case of buggy dissectors - in case of wrong heuristics - for performance reasons - to decode the data as another protocol (TODO) Currently (if I am not wrong), all dissectors but NFS can be disabled (and dissectors that do not register protocols :-) I do not like the way the RPC sub-dissectors are disabled (in the sub-dissectors) since this could be done in the RPC dissector itself, knowing the sub-protocol hfinfo entry (this is why, I've not modified the NFS one yet). Two functions are added in proto.c : gboolean proto_is_protocol_enabled(int n); void proto_set_decoding(int n, gboolean enabled); and two MACROs which can be used in dissectors: OLD_CHECK_DISPLAY_AS_DATA(index, pd, offset, fd, tree) CHECK_DISPLAY_AS_DATA(index, tvb, pinfo, tree) See also the XXX in proto_dlg.c and proto.c around the new functions. svn path=/trunk/; revision=2267
2000-08-07Allow either old-style (pre-tvbuff) or new-style (tvbuffified)Guy Harris1-3/+3
dissectors to be registered as dissectors for particular ports, registered as heuristic dissectors, and registered as dissectors for conversations, and have routines to be used both by old-style and new-style dissectors to call registered dissectors. Have the code that calls those dissectors translate the arguments as necessary. (For conversation dissectors, replace "find_conversation_dissector()", which just returns a pointer to the dissector, with "old_try_conversation_dissector()" and "try_conversation_dissector()", which actually call the dissector, so that there's a single place at which we can do that translation. Also make "dissector_lookup()" static and, instead of calling it and, if it returns a non-null pointer, calling that dissector, just use "old_dissector_try_port()" or "dissector_try_port()", for the same reason.) This allows some dissectors that took old-style arguments and immediately translated them to new-style arguments to just take new-style arguments; make them do so. It also allows some new-style dissectors not to have to translate arguments before calling routines to look up and call dissectors; make them not do so. Get rid of checks for too-short frames in new-style dissectors - the tvbuff code does those checks for you. Give the routines to register old-style dissectors, and to call dissectors from old-style dissectors, names beginning with "old_", with the routines for new-style dissectors not having the "old_". Update the dissectors that use those routines appropriately. Rename "dissect_data()" to "old_dissect_data()", and "dissect_data_tvb()" to "dissect_data()". svn path=/trunk/; revision=2218
2000-05-31Add routines for adding items to a protocol tree that take arguments ofGuy Harris1-3/+3
a particular type, rather than taking a varargs list, along the lines of the "proto_tree_add_XXX_format()" routines. Replace most calls to "proto_tree_add_item()" and "proto_tree_add_item_hidden()" with calls to those routines. Rename "proto_tree_add_item()" and "proto_tree_add_item_hidden()" to "proto_tree_add_item_old()" and "proto_tree_add_item_hidden_old()", and add new "proto_tree_add_item()" and "proto_tree_add_item_hidden()" routines that don't take the item to be added as an argument - instead, they fetch the argument from the packet whose tvbuff was handed to them, from the offset handed to them. svn path=/trunk/; revision=2031
2000-05-11Add tvbuff class.Gilbert Ramirez1-63/+63
Add exceptions routines. Convert proto_tree_add_*() routines to require tvbuff_t* argument. Convert all dissectors to pass NULL argument ("NullTVB" macro == NULL) as the tvbuff_t* argument to proto_tree_add_*() routines. dissect_packet() creates a tvbuff_t, wraps the next dissect call in a TRY block, will print "Short Frame" on the proto_tree if a BoundsError exception is caught. The FDDI dissector is converted to use tvbuff's. svn path=/trunk/; revision=1939
2000-04-17Register a "llc.dsap" dissector table for 802.2 LLC, and have dissectorsGuy Harris1-2/+9
for protocols that run inside 802.2 LLC register themselves with it using "dissector_add()". Make various dissectors static if they can be, and remove from header files declarations of those dissectors. svn path=/trunk/; revision=1872
2000-03-07Fix some "proto_tree_add_text()" calls.Guy Harris1-2/+2
svn path=/trunk/; revision=1696
2000-02-16Fix NetBIOS name types as per my understanding and the MS Knowledge baseRichard Sharpe1-4/+4
article ... svn path=/trunk/; revision=1639
2000-02-15Create a header file for every packet-*.c file. Prune the packet.h file.Gilbert Ramirez1-1/+3
This change allows you to add a new packet-*.c file and not cause a recompilation of everything that #include's packet.h Add the plugin_api.[ch] files ot the plugins/Makefile.am packaging list. Add #define YY_NO_UNPUT 1 to the lex source so that the yyunput symbol is not defined, squelching a compiler complaint when compiling the generated C file. svn path=/trunk/; revision=1637
2000-01-23In "dissect_eth()", update "pi.len" and "pi.captured_len" regardless ofGuy Harris1-3/+2
whether we're building a protocol tree or not. Make "dissect_eth()" use "BYTES_ARE_IN_FRAME()" to see if we have a full Ethernet header - it can be called with a non-zero offset, if Ethernet frames are encapsulated inside other frames (e.g., ATM LANE). Make capture routines take an "offset" argument if the corresponding dissect routine takes one (for symmetry, and for Cisco ISL or any other protocol that encapsulates Ethernet or Token-Ring frames inside other frames). Pass the frame lengths to capture routines via the "pi" structure, rather than as an in-line argument, so that they can macros such as "BYTES_ARE_IN_FRAME()" the way the corresponding dissect routines do. Make capture routines update "pi.len" and "pi.captured_len" the same way the corresponding diseect routines do, if the capture routines then call other capture routines. Make "capture_vlan()" count as "other" frames that are too short, the way other capture routines do. svn path=/trunk/; revision=1525
2000-01-16Get rid of the include of "util.h" that some dissectors do - it's notGuy Harris1-2/+1
necessary. svn path=/trunk/; revision=1496
2000-01-14Fixed small typo in hex printing.Gerald Combs1-2/+2
svn path=/trunk/; revision=1475
1999-11-30Make the NetBIOS dissecting routines all take a pointer to the beginningGuy Harris1-177/+184
of the frame, plus at most one offset from the beginning of the frame, to make it clearer what the offset is. Then use that offset in at least some places to do bounds checking. If a packet has no payload, don't hand it to the SMB dissector. svn path=/trunk/; revision=1165
1999-11-16Replace the ETT_ "enum" members, declared in "packet.h", withGuy Harris1-10/+22
dynamically-assigned "ett_" integer values, assigned by "proto_register_subtree_array()"; this: obviates the need to update "packet.h" whenever you add a new subtree type - you only have to add a call to "proto_register_subtree_array()" to a "register" routine and an array of pointers to "ett_", if they're not already there, and add a pointer to the new "ett_" variable to the array, if they are there; would allow run-time-loaded dissectors to allocate subtree types when they're loaded. svn path=/trunk/; revision=1043
1999-11-15added sap types, netbios name types, ipx socket namesNathan Neulinger1-1/+5
svn path=/trunk/; revision=1038
1999-09-03Add in a bunch of changes based on the IBM specification for the NetBIOSGuy Harris1-192/+378
Frame protocol (that being what this dissects). If you're cutting up something into bitfields, the bitfield dissection returned by "dissect_bitfield_XXX()" should be the first text on the line - if not, then if the text items that come before the various bitfields aren't all the same length, the bits don't line up. Cope with packets from one of Gilbert's captures, where the sender "name" in some NBF datagrams isn't a NetBIOS name, it's 10 octets of 0 followed by a MAC address! The "name type" in the "Data2" field of NBF frames is 0x00 for unique names and 0x01 for group names, not a "16th character of a NetBIOS name" name type. Fix up various other things. svn path=/trunk/; revision=633
1999-09-03Add in a pile of additional packet formats fromGuy Harris1-51/+218
http://ourworld.compuserve.com/homepages/TimothyDEvans/contents.htm Assorted minor cleanups. svn path=/trunk/; revision=632
1999-09-03Use "process_netbios_name()", rather than "canonicalize_netbios_name()",Guy Harris1-3/+11
to turn NetBIOS names into a nice printable form. Put the description of NetBIOS name types into places where it fits; have "packet-netbios.c" export a routine to interpret them. svn path=/trunk/; revision=630
1999-09-03Add a bunch more NetBIOS name types.Guy Harris1-84/+89
That makes the space of name types even more sparse; use "val_to_str()" to decode them, rather than an indexed table. Make a "process_netbios_name()" routine that shows non-printable characters in NetBIOS names as <XX>, where "XX" is the value of the character in hex (the way Network Monitor does), and have "get_netbios_name()" use it (NetBIOS-over-TCP will be made to use it in the future). When displaying NetBIOS names, include the name type character at the end, in angle brackets, the way Network Monitor does (show it in hex even if it *is* printable - 0x20 is 0x20, not "space", in that context). svn path=/trunk/; revision=628
1999-09-02Have the IPX code set "pi.len" and "pi.captured_len" based on the lengthGuy Harris1-2/+3
in the IPX header, and have the dissectors it calls use it rather than being passed the length as an argument. Treat both packet type 20 ("WAN Broadcast") and 4 ("IPX", although 3 is also "IPX", according to Network Monitor) as potentially being NetBIOS packets. The packet types for the IPX NetBIOS socket (0x0455) and the NWLink sockets (0x0551 and 0x0553) are different (perhaps because there's one socket for the 0x0455 NBIPX, so you have to do name service and datagram service and have the packet types distinguish them, but NWLink has separate sockets for name service and datagram service). The packet type for name service and for datagram service are at *different locations* in the packet, which is unfortunate if you want to use the packet type to distinguish name service and datagram service packets. Use the packet length, for now, to distinguish them, with socket 0x0455. Dissect datagram packets differently from name service packets. Export "packet-netbios.c"'s "netbios_add_name()" routine, and use it when dissecting NBIPX packets as well. Label NBIPX packets as "NBIPX" rather than "NetBIOS". svn path=/trunk/; revision=627
1999-08-24Fixed the array problem in packet-netbios.Gilbert Ramirez1-2/+2
Fixed the default case in the packet-cdp while() statement to look for non-zero offsets. I should fix the other cases where offset += length. Meanwhile, however, I added cdp.tlv.type and cdp.tlv.len as two filterable fields so that one can use "cdp.tlv.len == 0" as a display filter to find the packet that was causing problems. svn path=/trunk/; revision=568
1999-08-18Changes to compile in win32.Gilbert Ramirez1-6/+6
svn path=/trunk/; revision=515
1999-08-10Jeff Foster's changes to add support for NetBEUI/NBF (NetBIOS atop 802.2Guy Harris1-0/+693
LLC, the original NetBIOS encapsulation). svn path=/trunk/; revision=466
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-07 22:39:43 +0000