Age | Commit message (Collapse) | Author | Files | Lines |
|
number of fragments, and add an extra bounds check.
Fixes
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8540
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8541
svn path=/trunk/; revision=48644
|
|
be done on flows from one address to another; reassembly for protocols
running atop TCP should be done on flows from one TCP endpoint to
another.
We do this by:
adding "reassembly table" as a data structure;
associating hash tables for both in-progress reassemblies and
completed reassemblies with that data structure (currently, not
all reassemblies use the latter; they might keep completed
reassemblies in the first table);
having functions to create and destroy keys in that table;
offering standard routines for doing address-based and
address-and-port-based flow processing, so that dissectors not
needing their own specialized flow processing can just use them.
This fixes some mis-reassemblies of NIS YPSERV YPALL responses (where
the second YPALL response is processed as if it were a continuation of
a previous response between different endpoints, even though said
response is already reassembled), and also allows the DCE RPC-specific
stuff to be moved out of epan/reassembly.c into the DCE RPC dissector.
svn path=/trunk/; revision=48491
|
|
Use explicit casts.
svn path=/trunk/; revision=48338
|
|
(found by checkhf)
svn path=/trunk/; revision=47389
|
|
Bug 8231 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8231)
svn path=/trunk/; revision=47295
|
|
svn path=/trunk/; revision=47125
|
|
missing
this fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8222
svn path=/trunk/; revision=47123
|
|
useless sentinel in.
Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8213
svn path=/trunk/; revision=47098
|
|
svn path=/trunk/; revision=47095
|
|
svn path=/trunk/; revision=45017
|
|
Add new parameter 'data' to heur_dissector_t and new_dissector_t, for now it's always NULL
svn path=/trunk/; revision=44860
|
|
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7683 :
The reassembled fragments tree in the Packet Details view is awesome, but it
lacks one thing: a field that exposes the reassembled data.
tcp.data already exists for exposing a single TCP segment's payload as a byte
array. It would be handy to have something similar for a single application
layer PDU when TCP segment reassembly is involved. I propose
tcp.reassembled.data, named and placed after the already existing field
tcp.reassembled.length.
My primary use case for this feature is outputting tcp.reassembled.data with
tshark for further processing with a script.
The attached patch implements this very feature. Because the reassembled
fragment tree code is general purpose, i.e. not specific to just TCP, any
dissector that relies upon it can add a similar field very cheaply. In that
vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which
expose reassembled fragment data as a single byte stream for IPv4 and IPv6,
respectively. All other protocols that use the reassembly code have been left
alone, other than inserting NULL into their initializer lists for the newly
introduced struct field reassemble.h:fragment_items.hf_reassembled_data.
svn path=/trunk/; revision=44802
|
|
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7566 :
Don't try to reassemble a message of length 0 (fixes a later divide-by-zero
error but I don't see why we'd want to do any work for message whose length
we think is 0).
svn path=/trunk/; revision=44247
|
|
svn path=/trunk/; revision=43538
|
|
svn path=/trunk/; revision=40163
|
|
Also: remove trailing whitespace for a number of files.
svn path=/trunk/; revision=39503
|
|
(previously missed).
57 FT_BOOLEAN: FALSE-->ENC_BIG_ENDIAN
31 FT_BOOLEAN: TRUE-->ENC_LITTLE_ENDIAN
10 FT_BYTES: ENC_BIG_ENDIAN-->ENC_NA
1 FT_BYTES: ENC_LITTLE_ENDIAN-->ENC_NA
21 FT_BYTES: FALSE-->ENC_NA
2 FT_BYTES: TRUE-->ENC_NA
2 FT_IPXNET: ENC_BIG_ENDIAN-->ENC_NA
6 FT_IPv6: ENC_BIG_ENDIAN-->ENC_NA
1 FT_IPv6: FALSE-->ENC_NA
6 FT_NONE: ENC_BIG_ENDIAN-->ENC_NA
19 FT_NONE: FALSE-->ENC_NA
3 FT_NONE: TRUE-->ENC_NA
1 FT_STRING: ENC_BIG_ENDIAN-->ENC_ASCII|ENC_NA
1 FT_STRING: ENC_LITTLE_ENDIAN-->ENC_ASCII|ENC_NA
5 FT_STRING: FALSE-->ENC_ASCII|ENC_NA
1 FT_STRING: TRUE-->ENC_ASCII|ENC_NA
4 FT_STRINGZ: ENC_NA-->ENC_ASCII|ENC_NA
8 FT_STRINGZ: FALSE-->ENC_ASCII|ENC_NA
1 FT_INT32: FALSE-->ENC_BIG_ENDIAN
1 FT_INT32: TRUE-->ENC_LITTLE_ENDIAN
11 FT_UINT8: 0-->ENC_BIG_ENDIAN
111 FT_UINT8: FALSE-->ENC_BIG_ENDIAN
17 FT_UINT8: TRUE-->ENC_LITTLE_ENDIAN
1 FT_UINT16: 0-->ENC_BIG_ENDIAN
68 FT_UINT16: FALSE-->ENC_BIG_ENDIAN
18 FT_UINT16: TRUE-->ENC_LITTLE_ENDIAN
4 FT_UINT24: FALSE-->ENC_BIG_ENDIAN
70 FT_UINT32: FALSE-->ENC_BIG_ENDIAN
1 FT_UINT32: TRUE-->ENC_LITTLE_ENDIAN
4 FT_UINT64: FALSE-->ENC_BIG_ENDIAN
1 FT_UINT64: TRUE-->ENC_LITTLE_ENDIAN
1 FT_UINT_STRING: FALSE-->ENC_ASCII|ENC_BIG_ENDIAN
svn path=/trunk/; revision=39442
|
|
FT_STRINGZ, FT_UINT_STRING as follows:
1. If there's no character encoding (ENC_ASCII, ...) specified
then use ENC_ASCII.
2. For all but FT_UINT_STRING, always use ENC_NA
(replacing any existing True/1/FALSE/0
/ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN).
svn path=/trunk/; revision=39426
|
|
reference an hf item (in hf[] with types:
FT_NONE
FT_BYTES
FT_IPV6
FT_IPXNET
FT_OID
Note: Encoding field set to ENC_NA only if the field was previously TRUE|FALSE|ENC_LITTLE_ENDIAN|ENC_BIG_ENDIAN
svn path=/trunk/; revision=39260
|
|
svn path=/trunk/; revision=39149
|
|
This time keep the tvb routines in epan.
Now we can use common crc routines outside epan.
svn path=/trunk/; revision=38810
|
|
svn path=/trunk/; revision=38803
|
|
This way we can use the crc routines in wiretap.
svn path=/trunk/; revision=38800
|
|
Also: misc minor cleanup: unneeded #include; whitespace, tvb_length-->tvb_reported_length
svn path=/trunk/; revision=37757
|
|
svn path=/trunk/; revision=37132
|
|
svn path=/trunk/; revision=35705
|
|
of going through a temporary variable). This just makes it more obvious which
add_bytes_format() calls are or are not being given pointers into the TVB.
Use tvb_ip_to_str() and tvb_ip6_to_str() in a couple spots.
svn path=/trunk/; revision=35593
|
|
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys. (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)
svn path=/trunk/; revision=35224
|
|
Removed some check_col().
svn path=/trunk/; revision=31809
|
|
reassembly.
svn path=/trunk/; revision=31767
|
|
check_col.diff
Remove redundant calls to check_col() if it guards only one columns function with one parameter after the column type.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4394
svn path=/trunk/; revision=31519
|
|
svn path=/trunk/; revision=29446
|
|
svn path=/trunk/; revision=29346
|
|
svn path=/trunk/; revision=29345
|
|
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
|
|
http://wiki.wireshark.org/Development/Optimization
svn path=/trunk/; revision=28356
|
|
Use consistent indentation.
svn path=/trunk/; revision=28307
|
|
svn path=/trunk/; revision=27062
|
|
svn path=/trunk/; revision=27053
|
|
not accepting packages shorter than 10 bytes in the heuristic(min header length).
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2860
svn path=/trunk/; revision=26311
|
|
svn path=/trunk/; revision=26280
|
|
minor cleanup
svn path=/trunk/; revision=26081
|
|
Fix some spacing in packet-dcom.c
svn path=/trunk/; revision=25618
|
|
svn path=/trunk/; revision=23463
|
|
tvb_get_ephemeral_string(). 2 of the 3 replacements fix memory leaks.
svn path=/trunk/; revision=22542
|
|
many compilers do not support the nonstandard feature to declare variables in the middle of a block.
svn path=/trunk/; revision=21012
|
|
I've refactored the offending code branch and added some comments so
hopefully the intent is a bit clearer. The loop termination conditions
are now obviously independent of the content on the wire (they were
meant to be before, but I admit it was obscure). I've tried using the
ephemeral memory routines.
Add a check for a maximum fragment count, and bail out of reassembly instead
of triggering an ep_alloc exception. Add Julian to AUTHORS. Update the
release notes.
svn path=/trunk/; revision=21007
|
|
svn path=/trunk/; revision=20559
|
|
svn path=/trunk/; revision=20553
|
|
New dissector for ETSI DCP (ETSI TS 102 821).
Code rearranged to look more like other Wireshark dissectors and some warnings/errors
on Windows fixed.
svn path=/trunk/; revision=19981
|