| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
svn path=/trunk/; revision=2458
|
|
Remove tvb_get_stringz from quake dissector and add tvb_get_nstringz,
tvb_get_nstringz0, and tvb_strnlen to tvbuff.c.
Remove multiple definitions of pntohl and friends from various places
(except for wiretap) and put into pint.h
Consolidate duplicate code for turning FT_* enums into strings (ala the
glossary).
svn path=/trunk/; revision=2382
|
|
cleanup functions for the cases in which an exception is thrown but not
caught in a region where cleanup needs to occur.
Use these macros in proto_tree_add_item, where we need to free the field_info*
in case an exception is thrown when accessing the tvbuff.
svn path=/trunk/; revision=2355
|
|
to proto_tree_add_item() will indicate if the length of the string is
indicated by an UINT8, UINT16, UINT24, or UINT32.
Change NCP dissector-maker to produce FT_UINT_STRING.
Fix off-by-one in dissection of some NCP reply packets.
svn path=/trunk/; revision=2334
|
|
the following:
It is now possible to enable/disable a particular protocol decoding
(i.e. the protocol dissector is void or not). When a protocol
is disabled, it is displayed as Data and of course, all linked
sub-protocols are disabled as well.
Disabling a protocol could be interesting:
- in case of buggy dissectors
- in case of wrong heuristics
- for performance reasons
- to decode the data as another protocol (TODO)
Currently (if I am not wrong), all dissectors but NFS can be disabled
(and dissectors that do not register protocols :-)
I do not like the way the RPC sub-dissectors are disabled (in the
sub-dissectors) since this could be done in the RPC dissector itself,
knowing the sub-protocol hfinfo entry (this is why, I've not modified
the NFS one yet).
Two functions are added in proto.c :
gboolean proto_is_protocol_enabled(int n);
void proto_set_decoding(int n, gboolean enabled);
and two MACROs which can be used in dissectors:
OLD_CHECK_DISPLAY_AS_DATA(index, pd, offset, fd, tree)
CHECK_DISPLAY_AS_DATA(index, tvb, pinfo, tree)
See also the XXX in proto_dlg.c and proto.c around the new functions.
svn path=/trunk/; revision=2267
|
|
- add <stdarg.h> or <varargs.h> in snprintf.h
and remove those inclusions in the other #ifdef NEED_SNPRINTF_H codes
- remove the check of multiple inclusions in source (.c) code
(there is a bit loss of _cpp_ performance, but I prefer the gain of
code reading and maintenance; and nowadays, disk caches and VM are
correctly optimized ;-).
- protect all (well almost) header files against multiple inclusions
- add header (i.e. GPL license) in some include files
- reorganize a bit the way header files are included:
First:
#include <system_include_files>
#include <external_package_include_files (e.g. gtk, glib etc.)>
Then
#include "ethereal_include_files"
with the correct HAVE_XXX or NEED_XXX protections.
- add some HAVE_XXX checks before including some system header files
- add the same HAVE_XXX in wiretap as in ethereal
Please forgive me, if I break something (I've only compiled and regression
tested on Linux).
svn path=/trunk/; revision=2254
|
|
<stdarg.h> is now included by "proto.h", so we must include "snprintf.h"
after including "proto.h".
svn path=/trunk/; revision=2246
|
|
- remove stdarg.h include in proto.c and add a more correct one in proto.h
- fix esis_dissect_unknown and isis_dissect_unknown
svn path=/trunk/; revision=2245
|
|
svn path=/trunk/; revision=2175
|
|
a framework for the dissector; of the more than 400 NCP packet types, only
a handful are defined. But this dissector framework is much better than
the previous one.
svn path=/trunk/; revision=2173
|
|
indicating the string length. It's available only with proto_tree_add_item().
Add proto_item_get_len(), so that dissectors can find out how long
the FT_NSTRING_UINT8 turned out to be.
In proto_tree_add_item(), don't add a proto_item to the proto_tree until
*after* the attempt to pull data from the tvbuff. That way, if the tvbuff
raises an exception, an item with garbage data won't be left in the
proto_tree.
svn path=/trunk/; revision=2167
|
|
the proto tree. Now, proto_get_finfo_ptr_array() can easily be used by
any routine, not just display filter code, to get values from the proto
tree. This might be useful if one were to allow columns in the packet list
to show the value of an arbitrary field.
Fixed a memleak when filtering on a byte arrays.
Fixed erroneous asserts in dfilter-grammar.y, where I used '=' instead of '=='.
They had to do with byte-arrays, too.
svn path=/trunk/; revision=2152
|
|
tvbuffs.
In doing so, I realied that my recommendation for using
tvb_new_subset(pi.compat_top_tvb, -1, -1) was incorrect, because
some dissectors (ethernet!) change pi.len and pi.cap_len. So, I have
to take those two variables into account instead of using -1 and -1.
So, I provide a macro called tvb_create_from_top(offset), where
offset is the name of your offset variable. It is a wrapper around
tvb_new_subset().
I converted the lines that followed my suggestion to use
tvb_create_from_top().
In proto.c I added
proto_tree_add_debug_text(proto_tree*, const char*, ...)
It's much like proto_tree_add_text(), except that it takes no offset
or length; it's soley for temporarily putting debug text into the
proto_tree while debugging a dissector. In making sure that its
use is temporary, the funciton also prints the debug string to stdout
to remind the programmer that the debug code needs to be removed
before shipping the code.
svn path=/trunk/; revision=2068
|
|
proto_tree_add_item_hidden_old(), and get rid of the functions as well.
Also remove a static function in proto.c that is no longer used
(it was used by proto_tree_add_item()).
svn path=/trunk/; revision=2033
|
|
a particular type, rather than taking a varargs list, along the lines of
the "proto_tree_add_XXX_format()" routines.
Replace most calls to "proto_tree_add_item()" and
"proto_tree_add_item_hidden()" with calls to those routines.
Rename "proto_tree_add_item()" and "proto_tree_add_item_hidden()" to
"proto_tree_add_item_old()" and "proto_tree_add_item_hidden_old()", and
add new "proto_tree_add_item()" and "proto_tree_add_item_hidden()"
routines that don't take the item to be added as an argument - instead,
they fetch the argument from the packet whose tvbuff was handed to them,
from the offset handed to them.
svn path=/trunk/; revision=2031
|
|
Convert ethertype() and dissect_null() to use tvbuff.
svn path=/trunk/; revision=1979
|
|
doing something that requires that the text for protocol tree entries be
generated, i.e.
1) initialize it to FALSE;
2) have every routine that sets it clear it when it's done;
3) when printing packets, set it to TRUE only if we're not just
printing packet summary lines;
and then get rid of settings to FALSE made unnecessary as a result of
those changes.
This makes sure it's not set when it doesn't have to be (which causes
the protocol tree code to format the text when it doesn't have to,
wasting CPU time).
svn path=/trunk/; revision=1973
|
|
Add exceptions routines.
Convert proto_tree_add_*() routines to require tvbuff_t* argument.
Convert all dissectors to pass NULL argument ("NullTVB" macro == NULL) as
the tvbuff_t* argument to proto_tree_add_*() routines.
dissect_packet() creates a tvbuff_t, wraps the next dissect call in
a TRY block, will print "Short Frame" on the proto_tree if a BoundsError
exception is caught.
The FDDI dissector is converted to use tvbuff's.
svn path=/trunk/; revision=1939
|
|
svn path=/trunk/; revision=1889
|
|
sub-dissector table is not stored in the header_field_info struct, but
in a separate namespace. Dissector tables are now registered by name
and not by field ID. For example:
udp_dissector_table = register_dissector_table("udp.port");
Because of this different namespace, dissector tables can have names
that are not field names. This is useful for ethertype, since multiple
fields are "ethertypes".
packet-ethertype.c replaces ethertype.c (the name was changed so that it
would be named in the same fashion as all the filenames passed to make-reg-dotc)
Although it registers no protocol or field, it registers one dissector table:
ethertype_dissector_table = register_dissector_table("ethertype");
All protocols that can be called because of an ethertype field now register
that fact with dissector_add() calls.
In this way, one dissector_table services all ethertype fields
(hf_eth_type, hf_llc_type, hf_null_etype, hf_vlan_etype)
Furthermore, the code allows for names of protocols to exist in the
etype_vals, yet a dissector for that protocol doesn't exist. The name
of the dissector is printed in COL_INFO. You're welcome, Richard. :-)
svn path=/trunk/; revision=1848
|
|
bit shifting is handled correctly.
svn path=/trunk/; revision=1829
|
|
svn path=/trunk/; revision=1794
|
|
routine, which calls all routines found in the dissector source files
with names that match " proto_reg_handoff_[a-z_0-9A-Z]*".
Call "register_all_protocol_handoffs()" after calling
"register_all_protocols()" - "register_all_protocols()" needs to be
called first, so that all protocols can register their fields, because
registering a dissector as being called if field "proto.port" is equal
to N requires that "proto.port" be a registered field.
Give DNS a handoff registration routine, and register its dissector to
be called if "udp.port" is UDP_PORT_DNS; remove the registration of DNS
from "packet-udp.c", and make "dissect_dns()" static (as nobody else
need know that it exists).
svn path=/trunk/; revision=1788
|
|
all the other public functions in proto.c start with "proto_".
svn path=/trunk/; revision=1783
|
|
field, to allow dissectors to register their dissection routine in a
particular field's hash table with a particular "port" value, and to
make the TCP and UDP dissectors support that for their "port" field and
to look up ports in that hash table.
This replaces the hash table that the UDP dissector was using.
There's still more work needed to make this useful - right now, the hash
tables are attached to the protocol field in the register routines for
the TCP and UDP protocols, which means that the register routines for
protocols that run atop TCP and UDP can't use this unless their register
routines happen to be called after those for TCP and/or UDP, and several
other protocols need to attach hash tables to fields, and there's no
single global field for Ethernet types so we can't even attach a hash
table to such a field to allow protocols to register themselves with a
particular Ethertype - but it's a start.
svn path=/trunk/; revision=1779
|
|
cross-checking, and by replacing "proto_tree_add_item_format()" by
multiple routines to add items of various types.
Make the arguments of "proto_tree_add_bytes_format()" and
"proto_tree_add_string_format()" that specify the bytes or the string be
"const" pointers, so that one can pass a "const" pointer without
complaints from the compiler.
Squelch a (bogus, but the compiler isn't in a position to know that)
complaint about an uninitialized variable.
svn path=/trunk/; revision=1716
|
|
proto_tree_add_protocol_format()
proto_tree_add_uint_format()
proto_tree_add_ipxnet_format()
proto_tree_add_ipv4_format()
proto_tree_add_ipv6_format()
proto_tree_add_bytes_format()
proto_tree_add_string_format()
proto_tree_add_ether_format()
proto_tree_add_time_format()
proto_tree_add_double_format()
proto_tree_add_boolean_format()
If using GCC 2.x, we can check the print-format against the variable args
passed in. Regardless of compiler, we can now check at run-time that the
field type passed into the function corresponds to what that function
expects (FT_UINT, FT_BOOLEAN, etc.)
Note that proto_tree_add_protocol_format() does not require a value field,
since the value of a protocol is always NULL. It's more intuitive w/o the
vestigial argument.
Fixed a proto_tree_add_item_format-related bug in packet-isis-hello.c
Fixed a variable usage bug in packet-v120.c. (ett_* was used instead of hf_*)
Checked in Guy's fix for the function declearation for proto_tree_add_text()
and proto_tree_add_notext().
svn path=/trunk/; revision=1713
|
|
later check the format string against the arguments.
svn path=/trunk/; revision=1698
|
|
svn path=/trunk/; revision=1605
|
|
existing protocol tree item.
Add "proto_tree_add_notext()"; it's just like "proto_tree_add_text()",
but without the text, and it sets the "representation" field to NULL;
that field would be set later with "proto_item_set_text()".
Those routines let you construct, for example, an interior node of the
protocol tree whose text can't be determined until all the nodes under
it have been dissected - it's similar to "proto_item_set_len()" in that
fashion.
Use that when dissecting address TLVs in the CDP dissector - create the
item for an address in an "Addresses" TLV with no text, and then fill in
the items under it one at a time; if we get cut off before we get to the
actual address, set the text to "Truncated address", otherwise set it to
a description of the address.
Also, set the length of the item for the entire address TLV correctly.
svn path=/trunk/; revision=1520
|
|
there are no SNMP libraries to use in a real dissector; this means that
other dissectors don't have to care if there are SNMP libraries, they
can just call "dissect_snmp()" - and this also simplifies "Makefile.am"
and "configure.in" a bit, as they just treat "packet-snmp.c" and
"packet-snmp.h" the same way they treat other dissector source files.
svn path=/trunk/; revision=1214
|
|
and a $HOME/.ethereal/ipxnets file. get_ipxnet_name() and other functions,
similar to get_ether_name() and friends, have been added.
svn path=/trunk/; revision=1085
|
|
dynamically-assigned "ett_" integer values, assigned by
"proto_register_subtree_array()"; this:
obviates the need to update "packet.h" whenever you add a new
subtree type - you only have to add a call to
"proto_register_subtree_array()" to a "register" routine and an
array of pointers to "ett_", if they're not already there, and
add a pointer to the new "ett_" variable to the array, if they
are there;
would allow run-time-loaded dissectors to allocate subtree types
when they're loaded.
svn path=/trunk/; revision=1043
|
|
We now store IPv4 addresses in host order, allowing non-equivalence
comparisons. That is, display filters with lt, le, gt, and ge will work
on big-endian and little-endian machines.
CIDR notation is now supported for IPv4 addresses in display filters.
You can test to see if an IPv4 address is on a certain subnet by using
this notation. For example, to test for IPv4 packets on a Class-C network:
ip.addr == 192.168.1.0/24
svn path=/trunk/; revision=1032
|
|
Added proto_registrar_get_name routine to proto.c to retrieve the name
of particular proto_tree field.
Added dissect_rpc_string_item to packet-rpc.c. This routine does the same
thing as dissect_rpc_string, except it takes a hfindex of a
proto_tree item instead of a name. It uses the p_r_get_name call
to get the name, and adds the actual string content as a hidden
field (so that the subtree highlights the entire data area - length,
data, and padding). There is only one call to dissect_rpc_string, so
I believe that this routine should replace it.
svn path=/trunk/; revision=1011
|
|
protocols (idea shamelessly stolen from GDB). We require that the
register routines
1) be located in "packet.c" or in one of the "packet-XXX.c"
files;
2) have a name of the form "proto_register_XXX";
3) take no argument, and return no value;
4) have their names appear in the source file either at the
beginning of the line, or preceded only by "void " at the
beginning of the line;
and we require that "packet-XXX.c" files be added to "DISSECTOR_SOURCES"
in "Makefile.am".
svn path=/trunk/; revision=891
|
|
- add display filters
svn path=/trunk/; revision=872
|
|
description of fields in man page is correct.
svn path=/trunk/; revision=859
|
|
svn path=/trunk/; revision=853
|
|
svn path=/trunk/; revision=828
|
|
protocols.
svn path=/trunk/; revision=824
|
|
well.
Add some more protocols to the list of value/string pairs for IP
protocol types.
svn path=/trunk/; revision=822
|
|
svn path=/trunk/; revision=820
|
|
and RIPng decoding.
svn path=/trunk/; revision=818
|
|
svn path=/trunk/; revision=817
|
|
svn path=/trunk/; revision=816
|
|
the base for numbers to be displayed in, bitmasks for bitfields, and blurbs
(which are one or two sentences describing the field).
proto_tree_add*() routines now automatically handle bitfields. You tell
it which header field you are adding, and just pass it the value of the
entire field, and the proto_tree routines will do the masking and shifting
for you.
This means that bitfields are more naturally filtered via dfilter now.
Added Phil Techau's support for signed integers in dfilters/proto_tree.
Added the beginning of the SNA dissector. It's not complete, but I'm
committing it now because it has example after example of how to use
bitfields with the new header_field_info struct and proto_tree routines.
It was the impetus to change how header_field_info works.
svn path=/trunk/; revision=815
|
|
the packet boundary. Now the field boundary is honored. The frame boundary
is ignored, but of course we put proper field lengths in the proto_tree,
right? :)
Implemented negative offsets in byte-strings:
frame[-4:4] will read the last 4 bytes of a frame.
Implemented "offset-only" byte-string comparisons, since the dfilter
compiler knows the length of the byte-string you supplied. These are
now legal:
frame[-4] == 0.0.0.1
tr.dst[0] == 00:06:29
Implemented the use of integers if you're comparing one byte. These are
legal:
llc[0] == 0xaa
llc[0:1] == 0xaa
All these forms check against the length of the field, so these will be
reported as bad to the user:
eth.src[5] == 00:06:29 (goes beyond field boundary)
eth.dst == 1.2.3.4.5.6.7 (too long, goes beyond field boundary)
Thes is also reported as bad:
eth.dst[0:3] == 1.2 (incorrect number of bytes specified)
eth.dst[0:1] == eth.src[0:2] (disparate lengths)
I had to add a new function, proto_registrar_get_length() in proto.c, which
reports the length of a field as can be determined at registration time.
There are some shift/reduce errors in the grammar that I need to get rid of.
svn path=/trunk/; revision=811
|
|
there is still some work to do in resolv.c (get_host_ipaddr6)
- add display filters of this kind in packet-ipv6.c just
for testing (display filtering is incomplete)
svn path=/trunk/; revision=808
|
|
svn path=/trunk/; revision=790
|
