aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap
diff options
context:
space:
mode:
authorGuy Harris <gharris@sonic.net>2022-09-10 22:37:11 -0700
committerGuy Harris <gharris@sonic.net>2022-09-10 22:37:11 -0700
commite5951765d88dd6f534187fce9c6f2e6043aea0fc (patch)
treeab36d8cd0a64afe6e8e38ea2efe08dccf2aa0d70 /wiretap
parent8f34e3df98d1beb9593a614fd1a6a683d7916165 (diff)
Dissector names are not protocol names.
A given protocol's packet format may depend, for example, on which lower-level protocol is transporting the protocol in question. For example, protocols that run atop both byte-stream protocols such as TCP and TLS, and packet-oriented protocols such as UDP or DTLS, might begin the packet with a length when running atop a byte-stream protocol, to indicate where this packet ends and the next packet begins in the byte stream, but not do so when running atop a packet-oriented protocol. Dissectors can handle this in various ways: For example, the dissector could attempt to determine the protocol over which the packet was transported. Unfortunately, many of those mechanisms do so by fetching data from the packet_info structure, and many items in that structure act as global variables, so that, for example, if there are two two PDUs for protocol A inside a TCP segment, and the first protocol for PDU A contains a PDU for protocol B, and protocol B's dissector, or a dissector it calls, modifies the information in the packet_info structure so that it no longer indicates that the parent protocol is TCP, the second PDU for protocol A might not be correctly dissected. Another such mechanism is to query the previous element in the layers structure of the packet_info structure, which is a list of protocol IDs. Unfortunately, that is not a list of earlier protocols in the protocol stack, it's a list of earlier protocols in the dissection, which means that, in the above example, when the second PDU for protocol A is dissected, the list is {...,TCP,A,B,...,A}, which means that the previous element in the list is not TCP, so, again, the second PDU for protocol A will not be correctly dissected. An alternative is to have multiple dissectors for the same protocol, with the part of the protocol that's independent of the protocol transporting the PDU being dissected by common code. Protocol B might have an "over a byte-stream transport" dissector and an "over a packet transport" dissector, with the first dissector being registered for use over TCP and TLS and the other dissector being registered for use over packet protocols. This mechanism, unlike the other mechanisms, is not dependent on information in the packet_info structure that might be affected by dissectors other than the one for the protocol that transports protocol B. Furthermore, in a LINKTYPE_WIRESHARK_UPPER_PDU pcap or pcapng packet for protocol B, there might not be any information to indicate the protocol that transports protocol B, so there would have to be separate dissectors for protocol B, with separate names, so that a tag giving the protocol name would differ for B-over-byte-stream and B-over-packets. So: We rename EXP_PDU_TAG_PROTO_NAME and EXP_PDU_TAG_HEUR_PROTO_NAME to EXP_PDU_TAG_DISSECTOR_NAME and EXP_PDU_TAG_HEUR_DISSECTOR_NAME, to emphasize that they are *not* protocol names, they are dissector names (which has always been the case - if there's a protocol with that name, but no dissector with that name, Wireshark will not be able to handle the packet, as it will try to look up a dissector given that name and fail). We fix that exported PDU dissector to refer to those tags as dissector names, not protocol names. We update documentation to refer to them as DISSECTOR_NAME tags, not PROTO_NAME tags. (If there is any documentation for this outside the Wireshark source, it should be updated as well.) We add comments for calls to dissector_handle_get_dissector_name() where the dissector name is shown to the user, to indicate that it might be that the protocol name should be used. We update the TLS and DTLS dissectors to show the encapsulated protocol as the string returned by dissector_handle_get_long_name(); as the default is "Application Data", it appeaers that a descriptive name, rather than a short API name, should be used. (We continue to use the dissector name in debugging messages, to indicate which dissector was called.)
Diffstat (limited to 'wiretap')
-rw-r--r--wiretap/busmaster.c2
-rw-r--r--wiretap/candump.c2
-rw-r--r--wiretap/nettrace_3gpp_32_423.c2
3 files changed, 3 insertions, 3 deletions
diff --git a/wiretap/busmaster.c b/wiretap/busmaster.c
index c98b9d96aa..6da79fe357 100644
--- a/wiretap/busmaster.c
+++ b/wiretap/busmaster.c
@@ -85,7 +85,7 @@ busmaster_gen_packet(wtap_rec *rec, Buffer *buf,
memset(buf_data, 0, packet_length);
- phton16(buf_data + 0, EXP_PDU_TAG_PROTO_NAME);
+ phton16(buf_data + 0, EXP_PDU_TAG_DISSECTOR_NAME);
phton16(buf_data + 2, proto_name_length);
memcpy(buf_data + 4, proto_name, strlen(proto_name));
diff --git a/wiretap/candump.c b/wiretap/candump.c
index 28fda91107..1317393c6f 100644
--- a/wiretap/candump.c
+++ b/wiretap/candump.c
@@ -59,7 +59,7 @@ candump_write_packet(wtap_rec *rec, Buffer *buf, const msg_t *msg)
memset(buf_data, 0, packet_length);
- phton16(buf_data + 0, EXP_PDU_TAG_PROTO_NAME);
+ phton16(buf_data + 0, EXP_PDU_TAG_DISSECTOR_NAME);
phton16(buf_data + 2, proto_name_length);
memcpy(buf_data + 4, proto_name, strlen(proto_name));
diff --git a/wiretap/nettrace_3gpp_32_423.c b/wiretap/nettrace_3gpp_32_423.c
index 7bf214514b..f85321d0b7 100644
--- a/wiretap/nettrace_3gpp_32_423.c
+++ b/wiretap/nettrace_3gpp_32_423.c
@@ -496,7 +496,7 @@ nettrace_msg_to_packet(nettrace_3gpp_32_423_file_info_t *file_info, wtap_rec *re
/* Fill packet buff */
if (use_proto_table == FALSE) {
- phton16(packet_buf, EXP_PDU_TAG_PROTO_NAME);
+ phton16(packet_buf, EXP_PDU_TAG_DISSECTOR_NAME);
packet_buf += 2;
phton16(packet_buf, tag_str_len);
packet_buf += 2;