aboutsummaryrefslogtreecommitdiffstats
path: root/plugins
AgeCommit message (Collapse)AuthorFilesLines
2023-02-25Change some `wmem_packet_scope()` to `pinfo->pool`David Perry2-5/+5
As requested [here][1] by @eapache, help with removing calls to `wmem_packet_scope()` in favour of references to `pinfo->pool`. * Plugins chosen semi-randomly. * When a calling function already has a `pinfo` argument, use that. * Remove `_U_` from its signature if it was there. * If a function seems narrowly focused on getting and (possibly) returning memory, change the function signature to take a `wmem_allocator_t *`. * If it seems more focused on packet-based operations, pass in a `packet_info *` instead and use `pinfo->pool` within. * If there are several functions defined with the same call signature, add `pinfo _U_` to the argument list of similar functions in order to maintain clarity/symmetry. [1]: https://www.wireshark.org/lists/wireshark-dev/202107/msg00052.html
2023-02-21gryphon: fix handling the ioctl code in a response.Guy Harris1-5/+9
It's not in the response message, it's taken from the request message, so display it with a zero offset and length, so it doesn't match any bytes in the packet. It's a 32-bit field, so make it an FT_UINT32.
2023-02-20Check that value_string values fit into field widthMartin Mathieson1-0/+2
2023-02-17profinet: fix conflictAlexis La Goutte2-2/+2
2023-02-09Fix some spelling errorsMartin Mathieson1-1/+1
2023-02-07PROFINET: Add strings with proto_tree_add_itemJohn Thacker1-30/+6
Add strings with proto_tree_add_item instead of tvb_memcpy, appending a null, and a proto_tree_add_string so that the strings are validated for encoding, trailing nulls, etc. Fix #18847
2023-01-31More fussing with items and calls.Martin Mathieson1-12/+6
2023-01-19Falco bridge+falcodump: Scan for personal pluginsGerald Combs1-5/+24
2023-01-17ECATMB: Get filename with encoding when adding to columnJohn Thacker1-7/+7
When retrieving a string, don't just use tvb_memcpy, even if expected to be ASCII (because it might have errors.) This doesn't get truncated, even if all replacement characters, because the eventual returned buffer is 200 octets long and the max filename is 49. Fix #18800
2023-01-16Fix various issues seen with tools/check_typed_item_calls.pyMartin Mathieson4-38/+43
2023-01-12CMake: Rename SINSP_PLUGINS to FALCO_PLUGINSGerald Combs1-1/+1
2023-01-11CMake: Specify Falco plugins manually.Gerald Combs1-1/+9
Falco plugins don't yet have a standard installation location, and even when they do we might not want to install all of them. Remove plugin detection from FindSinsp.cmake and note that you should just pass the paths to your plugins in SINSP_PLUGINS.
2023-01-04fixes #18777 wrong decoding order in parseDiagnosticInfoMatthias Isele1-4/+4
2022-12-15tools/check_typed_item_calls: check FT_BOOLEAN mask lengthMartin Mathieson1-1/+1
2022-11-20Add macros to control lemon diagnosticsJoão Valverde3-7/+9
Rename flex macros using parenthesis (mostly a style issue): DIAG_OFF_FLEX -> DIAG_OFF_FLEX() DIAG_ON_FLEX -> DIAG_ON_FLEX() Use the same kind of construct with lemon generated code using DIAG_OFF_LEMON() and DIAG_ON_LEMON(). Use %include and %code directives to enforce the desired order with generated code in the middle in between pragmas. Fix a clang-specific pragma to use DIAG_OFF_CLANG(). DIAG_OFF(unreachable-code) -> DIAG_OFF_CLANG(unreachable-code). Apparently GCC is ignoring the -Wunreachable flag, that's why it did not trigger an unknown pragma warning. From [1}: The -Wunreachable-code has been removed, because it was unstable: it relied on the optimizer, and so different versions of gcc would warn about different code. The compiler still accepts and ignores the command line option so that existing Makefiles are not broken. In some future release the option will be removed entirely. - Ian [1] https://gcc.gnu.org/legacy-ml/gcc-help/2011-05/msg00360.html
2022-11-18Fix some cppcheck issuesMartin Mathieson1-1/+1
2022-11-17CMake: Disable -Werror for flex generated filesJoão Valverde2-2/+3
2022-11-17CMake: Move clang warningsJoão Valverde1-0/+3
Move clang warnings to normal set. Let the CMake compatibility check control the warning. Fix or work-around -Wunreachable warnings in the code.
2022-11-15opcua: Quiet a Coverity warningJohn Thacker1-1/+8
It really shouldn't be possible to have a fragment head with no fragment items here, but quiet Coverity CID 1516904 here.
2022-11-14epan: Separate fragment_head and fragment_itemJohn Thacker1-2/+3
Separate fragment_head and fragment_item into two different types of structs. Remove "offset" from fragment_head, which was unused, making fragment heads 4 bytes smaller. Remove fragment_nr_offset, datalen, reassembled_in, reas_in_layer_num, and error from fragment_item, making them 24 bytes smaller. Change a few dissectors which were using fragment_head and fragment_item indistinguishably. Ping #17311
2022-10-13wimaxasncp: Fix dissection of message type in packet headerTim Potter1-6/+6
It looks like there was a cut&paste error a long time ago resulting in the wimaxasncp.message_type field being incorrectly detected as unused and commented out. Closes #18424.
2022-10-11Fix issue #18391Dirk Ziegelmeier1-2/+4
Profinet PNIO-CM Connect Response Error Decode Incorrect
2022-10-10transum: expert infos are not Boolean fields.Guy Harris3-4/+39
They're of type FT_NONE, meaning that they do not have values, they're just present or not. Handle the TCP analysis fields "tcp.analysis.retransmission" and "tcp.analysis.keep_alive", both of which are expert infos, by just seeing if they're present or not. Fixes a problem mentioned in a comment in merge request !8412.
2022-10-08esl_eth: support nanosecond timestampsDavid Perry1-0/+1
Applies the patch from #18308, in lieu of original commenter doing so. Closes #18308
2022-10-05TRANSUM: fix fetching of Boolean values.Guy Harris1-1/+2
As of a change many years ago, Boolean values are stored as 64-bit (the change was made to handle Boolean bitfields in 64-bit fields). Fix the extractor for Boolean values to fetch from the 64-bit unsigned integer field, and, while we're at it, add a change that the field in question really *is* a Boolean field (the functions used to fetch the value in the other extractors do such a check).
2022-09-29TRANSUM: claim 0 bytes of packet dataDavid Perry1-1/+1
The TRANSUM post-dissector performs timing analysis, and does not dissect any of the packet data; all its calls to `proto_tree_add_foo()` claim 0 bytes. So this fix claims 0 bytes for the overall TRANSUM protocol tree as well. Fixes #18241
2022-09-29Replace the last of PROTO_ITEM_ macro calls with function callsJaap Keuter1-1/+1
2022-09-07opcua: Squelch a couple of warnings by adding casts.Anders Broman1-7/+7
2022-08-25Rename a bunch of things with "conversation".Guy Harris7-46/+46
A conversation in Wireshark might have two endpoints or might have no endpoints; few if any have one endpoint. Distinguish between conversations and endpoints.
2022-08-19Falco Bridge: Add a NULL check.Gerald Combs1-1/+1
2022-08-15Falco Bridge: Update to match falcosecurity-libs 0.8.0.Gerald Combs3-8/+7
Update sinsp-span to use the current Falco libs APIs. Update the FindSinsp CMake module to use pkg-config.
2022-08-15pluginifdemo: Qt5->Qt6; bump version to 0.0.2Chuck Craft2-6/+6
2022-08-09Use `register_dissector()` for more protocolsDavid Perry3-11/+8
2022-08-02epan: Refactor floating point display typesJoão Valverde1-1/+1
Remove the redundant BASE_FLOAT field display type. The name BASE_FLOAT is meaningless and the value aliased to BASE_NONE. Require BASE_NONE instead of BASE_FLOAT (corresponding to the printf() %g format). Add new float display types using BASE_DEC, BASE_HEX and BASE_EXP corresponfing to %f, %a and %e respectively. Add support for BASE_CUSTOM with floats.
2022-07-23ECATMB: Add SDO Information to CANopenTypeUli Heilmeier1-0/+1
Fixes #18220
2022-07-06Rename Logwolf to LograyGerald Combs1-1/+1
Switch to the name "Logray" for the log analyzer. Rays are biological cousins of sharks and more people like the name "Logray" in a completely unscientific survey here. Apologies for any inconvenience this might cause.
2022-07-06Fix some spellings.Martin Mathieson2-2/+2
2022-06-16ethercat: Fix EEPROM Ctrl/Status bitmask fieldsJohn Thacker1-8/+9
When the field width was corrected by commit b240d5baa062a475ff0943b91205eb2aee2a0471, the masks got messed up. There's 4 reserved bits that don't have fields and the bits are in Little Endian order. Fix #18132.
2022-06-10tap: Adding flags for tap_packetRoland Knall1-9/+9
This allows flags to be passed by the registering listener to the collection of information
2022-06-09irda: Use correct conversation_new() optionsStig Bjørlykke1-1/+1
Fix conversation_new() options after they was changed/improved in commit 709593ee.
2022-05-31Profinet plugin: Dissect writing I&M1 and I&M2, tooDirk Ziegelmeier1-0/+2
2022-05-31Profinet plugin: Decode more error codesDirk Ziegelmeier1-3/+47
according to PN Protocol 2.4MU3 April 2022
2022-05-23epan: Allow conversations based on arbitrary element lists.Gerald Combs1-6/+38
Add conversation_new_full and find_conversation_full, which take arbitrary element lists instead of fixed addresses and ports. Update the comments in conversation.h to be more Doxygen-conformant. Update README.dissector. Use the new functionality to add initial conversation support to the Falco Bridge dissector.
2022-05-21Use proto_tree_add_item where possibleMatthias Dietrich1-7/+8
2022-05-21Add PA Profile 4.02 diagnostics codesMatthias Dietrich1-0/+362
2022-05-21Dissect PA Profile IO dataMatthias Dietrich3-6/+238
2022-05-21Resolve PA Profile 4.02 submodule namesMatthias Dietrich2-0/+354
2022-05-19Falco Bridge: API updates.Gerald Combs3-11/+12
Update to the current (c02ae4b6) API.
2022-05-19Falco Bridge: Fix address field registration.Gerald Combs1-1/+2
2022-05-03Falco Bridge: Fix a couple of bugs.Gerald Combs1-4/+3
Make sure a pointer is valid and only initialize our sinsp span once.
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-10 18:09:42 +0000