aboutsummaryrefslogtreecommitdiffstats
path: root/epan/dissectors/packet-erf.c
AgeCommit message (Collapse)AuthorFilesLines
2024-02-25Fix lots of spellingsMartin Mathieson1-2/+2
2024-02-02ERF: ignore a non-contigous maskMartin Mathieson1-2/+2
2024-02-02Updated to use new PI_RECEIVE and PI_INTERFACE extert Info categoriesStephen Donnelly1-10/+10
2024-02-02Separate ERF Expert Info fieldsStephen Donnelly1-353/+327
Separate out distinct expert info fields Remove obsolete if(tree) tests
2024-02-02ERF Interface Id ExtensionStephen Donnelly1-21/+8
Move common #defines to erf_record.h Add macro for erf_interface_id_from_flags() Fix duplicate proto fields Replace int with gboolean
2024-02-02Endace ERF Interface Id extensionStephen Donnelly1-17/+30
The Endace ERF format has extended the 'Interface Id' from 2 bits (interface 0-3) to 3 bits (interface 0-7). The Interface Id high order bit is not adjacent in the flags field. Extend wtap handling for ERF records. Extend epan dissection and display of ERF format. The existing erf.flags.cap field is retained and extended to 0-7. A new erf.flags.if_raw field is added for the unformatted value. Note proto_tree_add_split_bits_item_ret_val() cannot be used here because it only supports input from the tvb and not from a non-tvb value.
2024-01-19Dissectors: remove accidental double-colonsMartin Mathieson1-1/+1
2023-11-20Remove init of proto variablesStig Bjørlykke1-173/+173
Remove init of proto, header field, expert info and subtree variables. This will reduces the binary size by approximate 1266320 bytes due to using .bss to zero-initialize the fields. The conversion is done using the tools/convert-proto-init.py script.
2023-10-27Added ERF FlowID Hash Type inner bitStephen Donnelly1-2/+32
The ERF record Flow ID extension header Hash Type field has been split in two: - The MSB indicates the FlowID Hash is calculated over a tunnel inner tuple. - The low 7 bits indicate the Hash Type as before.
2023-06-26dflter: Fix semantics of fvalue lengthJoão Valverde1-2/+2
Do not mix wire size, a protocol property, with fvalue length, a property of certain types of objects (sequences). Rename ftype_length() to ftype_wire_size(). Do not return wire_size with fvalue_length() (use ftype_wire_size() instead). Make the semantic check reject taking the len() of objects that are not arrays or lists. If the (fixed) len() of a number is somehow useful we can add a different function for that.
2023-06-20ftypes: Rename IS_FT_* macrosJoão Valverde1-3/+3
Rename IS_FT_*() to FT_IS_*(). I find it to be more natural and a better namespace for a public interface.
2023-06-08Don't have every dissector include wtap.hJohn Thacker1-1/+3
The header for frame_data can forward declare an incomplete type for wtap_rec, since it only takes a pointer to it. This prevents every dissector from automatically including wiretap/wtap.h Add wiretap/wtap.h to some dissectors that need it. Remove it from some other dissectors that had the explicit include but don't actually need it. A few other dissectors actually need wsutil/inet_addr.h but were getting that via wtap.h - include what they actually need. This reduces the number of files that are recompiled when wiretap/wtap.h is touched from ~2500 to ~800. Note that most of the dissectors that still include wiretap/wtap.h really only need to use a WTAP_ENCAP_ value, and most of the rest just need a pseudoheader. Those could be moved into another wiretap include to further reduce recompilation. Related to #19127
2023-05-26Update Endace ERF ProvenanceStephen Donnelly1-7/+70
Updated ERF Provenance field list Added Provenance Section names to Info column
2023-04-23Fix more calls to val_to_str() and related functionsMartin Mathieson1-2/+2
2023-01-06epan: Allow nested dependent packetsSake Blok1-3/+3
Save all dependent frames when there are multiple levels of reassembly. This is a retry of !6329, combined with the fix in !6509 which were reverted in !6545. epan: fix a segfault, introduced in !6329
2022-11-30wmem: Remove wmem_strbuf_new_label()João Valverde1-1/+1
Only dissectors are using this function and there is no use case, as far as I know, that requires its use. Any limitation of length is imposed transparently by the UI backend. This function is problematic because it is not Unicode aware and will truncate a string on an arbitrary byte boundary for multibyte strings. Replace its use with a normal strbuf without a length limite and remove the function because it is not useful and the ITEM_LABEL_LENGTH parameter does not belong in wmem anyway.
2022-03-28Revert "epan: Allow nested dependent packets"João Valverde1-3/+3
This reverts commit 2d8607e7e039db2b189403e9941ab8cbd0a9d466. This reverts commit be915d7374be9d64b6fd85819fcd98b300f511af. Introduces a segmentation fault, needs more work.
2022-03-06epan: Allow nested dependent packetsSake Blok1-3/+3
Save all dependent frames when there are multiple levels of reassembly.
2021-12-19Replace g_snprintf() with snprintf() (dissectors)João Valverde1-5/+5
Use macros from inttypes.h with format strings.
2021-11-29wsutil: Split format_size() enumJoão Valverde1-2/+2
Use an enum to select units and a bit flag for the other options, currently only prefix type.
2021-07-21First pass pinfo->pool conversion, part 2Evan Huus1-2/+2
Automated find/replace of wmem_packet_scope() with pinfo->pool in all files where it didn't cause a build failure.
2021-02-19wiretap: eliminate two WTAP_FILE_TYPE_SUBTYPE_ values.Guy Harris1-1/+5
Eliminate WTAP_FILE_TYPE_SUBTYPE_ERF and WTAP_FILE_TYPE_SUBTYPE_SYSTEMD_JOURNAL - instead, fetch the values by name, using wtap_name_to_file_type_subtype(). This requires that wtap_init() be called before epan_init(); that's currently the case, but put in comments to indicate why it must continue to be the case.
2020-08-07Find and fix dissectors that should be using a default tfs.Martin Mathieson1-5/+1
Found using tools/check_tfs.py, included in this commit. Here are the reports that were fixed here: Examining: All dissector modules epan/dissectors/packet-assa_r3.c tfs_mortisepins_flags - could have used tfs_high_low from tfs.c instead: {High,Low} epan/dissectors/packet-btle.c tfs_present_bit - could have used tfs_present_not_present from tfs.c instead: {Present,Not Present} epan/dissectors/packet-dhcp.c tfs_fqdn_s - could have used tfs_server_client from tfs.c instead: {Server,Client} epan/dissectors/packet-docsis-macmgmt.c mdd_tfs_on_off - could have used tfs_on_off from tfs.c instead: {On,Off} epan/dissectors/packet-docsis-macmgmt.c mdd_tfs_en_dis - could have used tfs_enabled_disabled from tfs.c instead: {Enabled,Disabled} epan/dissectors/packet-docsis-macmgmt.c req_not_req_tfs - could have used tfs_requested_not_requested from tfs.c instead: {Requested,Not Requested} epan/dissectors/packet-docsis-tlv.c on_off_tfs - could have used tfs_on_off from tfs.c instead: {On,Off} epan/dissectors/packet-docsis-tlv.c activation_tfs - could have used tfs_active_inactive from tfs.c instead: {Active,Inactive} epan/dissectors/packet-docsis.c ena_dis_tfs - could have used tfs_enabled_disabled from tfs.c instead: {Enabled,Disabled} epan/dissectors/packet-ecmp.c tfs_not_expected_expected - could have used tfs_odd_even from tfs.c instead: {Odd,Even} epan/dissectors/packet-erf.c erf_link_status_tfs - could have used tfs_up_down from tfs.c instead: {Up,Down} epan/dissectors/packet-h263.c on_off_flg - could have used tfs_on_off from tfs.c instead: {On,Off} epan/dissectors/packet-h263.c cpm_flg - could have used tfs_on_off from tfs.c instead: {On,Off} epan/dissectors/packet-interlink.c flags_set_notset - could have used tfs_set_notset from tfs.c instead: {Set,Not set} epan/dissectors/packet-ip.c tos_set_low - could have used tfs_low_normal from tfs.c instead: {Low,Normal} epan/dissectors/packet-ip.c tos_set_high - could have used tfs_high_normal from tfs.c instead: {High,Normal} epan/dissectors/packet-isakmp.c flag_r - could have used tfs_response_request from tfs.c instead: {Response,Request} epan/dissectors/packet-isis-lsp.c tfs_metric_supported_not_supported - could have used tfs_no_yes from tfs.c instead: {No,Yes} epan/dissectors/packet-kerberos.c supported_tfs - could have used tfs_supported_not_supported from tfs.c instead: {Supported,Not supported} epan/dissectors/packet-kerberos.c set_tfs - could have used tfs_set_notset from tfs.c instead: {Set,Not set} epan/dissectors/packet-mac-lte.c mac_lte_scell_status_vals - could have used tfs_activated_deactivated from tfs.c instead: {Activated,Deactivated} epan/dissectors/packet-p_mul.c no_yes - could have used tfs_no_yes from tfs.c instead: {No,Yes} epan/dissectors/packet-pgm.c opts_present - could have used tfs_present_not_present from tfs.c instead: {Present,Not Present} epan/dissectors/packet-rsl.c rsl_ms_fpc_epc_mode_vals - could have used tfs_inuse_not_inuse from tfs.c instead: {In use,Not in use} epan/dissectors/packet-sita.c tfs_sita_on_off - could have used tfs_on_off from tfs.c instead: {On,Off} epan/dissectors/packet-vines.c tfs_vine_rtp_no_yes - could have used tfs_no_yes from tfs.c instead: {No,Yes} epan/dissectors/packet-vnc.c button_mask_tfs - could have used tfs_pressed_not_pressed from tfs.c instead: {Pressed,Not pressed} 27 issues found Change-Id: I7e53b491f20289955c9e9caa8357197d9010a5aa Reviewed-on: https://code.wireshark.org/review/38087 Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-06-19Fix the type of arrays of pointers to hf_ values for bitfield routines.Guy Harris1-3/+2
The static arrays are supposed to be arrays of const pointers to int, not arrays of non-const pointers to const int. Fixing that means some bugs (scribbling on what's *supposed* to be a const array) will be caught (see packet-ieee80211-radiotap.c for examples, the first of which inspired this change and the second of which was discovered while testing compiles with this change), and removes the need for some annoying casts. Also make some of those arrays static while we're at it. Update documentation and dissector-generator tools. Change-Id: I789da5fc60aadc15797cefecfd9a9fbe9a130ccc Reviewed-on: https://code.wireshark.org/review/37517 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-02ERF: split wiretap/erf.h into three files.Guy Harris1-1/+1
wiretap/erf_record.h has declarations for records in ERF files and in LINKTYPE_ERF packets in pcap and pcapng files. wiretap/erf-common.h has declarations of routines to be called by pcap/pcapng reader code when processing LINKTYPE_ERF packets. wiretap/erf.h is what's left, for use by wiretap/erf.c and the code with the tables of file readers and writers. Change-Id: Ia982e79b14a025a80dcbc7c812fb3b2cdb9c6aaa Reviewed-on: https://code.wireshark.org/review/37021 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2019-07-26HTTPS (almost) everywhere.Guy Harris1-1/+1
Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-04epan: Convert our PROTO_ITEM_ macros to inline functions.Gerald Combs1-9/+9
Convert our various PROTO_ITEM_ macros to inline functions and document them. Change-Id: I070b15d4f70d2189217a177ee8ba2740be36327c Reviewed-on: https://code.wireshark.org/review/32706 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-12-20erf: Add support for attribute and sensor Provenance tagsAnthony Coddington1-5/+16
Add temperature and power tags, represented using millidegrees/milliwatts. Add attribute tag, allows generic reprsentation of dynamic path like key-value pairs in the format namespace.path.to.name=value where value can be a JSON-escaped string or an integer/float number. Also fix a few implicit floating point conversions (confirmed values are the same). Change-Id: Id8a858abfa8a56b44e9e7200b11adc562e67fb3b Reviewed-on: https://code.wireshark.org/review/31136 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-26Rename the pseudo-header for X.25, V.120, and Frame Relay.Guy Harris1-1/+1
It's not just for X.25, it's for anything that has the notion of Data Terminal Equipment and Data Communications Equipment; call it "dte_dce", not "x25". Change-Id: I3d51fec8b424e91ffd6d59895f50fc5ece791b08 Reviewed-on: https://code.wireshark.org/review/29834 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-20erf: do not use VALS to cast a void pointerPeter Wu1-4/+8
No functional change, but makes gcc -Wc++-compat happy. Change-Id: I3e90b6b1fdc6d558dfd410dffff3abc7cc3df10e Reviewed-on: https://code.wireshark.org/review/29759 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-04-19Fix cppcheck 1.83 warningsAlexandr Savca1-1/+1
[packet-ber.c:2687]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour [packet-erf.c:2475]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour [packet-fmp.c:378]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour [packet-http2.c:2050]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour [packet-obd-ii.c:643]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour [packet-yami.c:244]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour Change-Id: Ie71f9f7c8f863d1e9c693bd56444f00bdad48042 Reviewed-on: https://code.wireshark.org/review/27019 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot
2018-03-18Make a function not used outside this file static.Guy Harris1-1/+2
Change-Id: I8e1a2b0655083403ee0e7efccc976a1a27db8fa4 Reviewed-on: https://code.wireshark.org/review/26540 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-27ERF: Add support for new extension header and Provenance tagsAnthony Coddington1-5/+293
Add support for Entropy Extension header, currently with one field. Uses a conversion function to convert representation to bits. Add various entropy and tap mode Provenance (ERF_TYPE_META) tags. The only complex tag is ext_hdrs_added/removed. This tag consist of up to 4 big endian uint32 bitfields, with each bit representing an extension header number. ehdr_type_vals and a new ehdr_type_vals_short are used to generate the tags. Custom printing is used for the header line to display unknown values as integer and support the special case of <All>: all supplied bits 1 meaning all extension headers removed. Storage for the up to 4 subtree header_field id entries is in the first 4 extra hf_values[] for now, the ett value is reused. Increase erfmeta_tag_info_ext_t ERF_HF_VALUES_PER_TAG to 32. A better solution is needed sooner rather than later but the structure is only allocated for tags that need it. Change-Id: I9e359f044131bce2afc189bebc21239eed429b21 Reviewed-on: https://code.wireshark.org/review/26111 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-12dissectors: use SPDX identifiers.Dario Lombardo1-13/+1
Change-Id: I92c94448e6641716d03158a5f332c8b53709423a Reviewed-on: https://code.wireshark.org/review/25756 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-01-09Use pcapng as the name of the file format.Guy Harris1-1/+1
At one point, I remember a discussion resulting in the official name of the next-generation replacement for pcap format being changed to "pcapng", with no hyphen. Make Wireshark reflect that. Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a Reviewed-on: https://code.wireshark.org/review/25214 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-07-17ERF_TYPE_META write and comment supportAnthony Coddington1-30/+271
Support per-packet comments in ERF_TYPE_META through a new Anchor ID extension header with per-Host unique 48-bit Anchor ID which links an ERF_TYPE_META record with a packet record. There may be more than one Anchor ID associated with a packet, where they are grouped by Host ID extension header in the extension header list. Like other ERF_TYPE_META existing comments should not be overwritten and instead a new record generated. See erf_write_anchor_meta_update_phdr() for detailed comments on the extension header stack required. As Wireshark only supports one comment currently, use the one one with the latest metadata generation time (gen_time). Do this for capture comment too. Write various wtap metadata in periodic per-second ERF_TYPE_META records if non-WTAP_ENCAP_ERF or we have an updated capture comment. Refactor erf_dump to create fake ERF header first then follow common pseudoheadr and payload write code rather than two separate code paths. Support an ERF_HOST_ID environment variable to define Wireshark's Host ID when writing. Defaults to 0 for now. ERF dissector updates to support Anchor ID extension header with basic frame linking. Update ERF_TYPE_META naming and descriptions to official name (Provenance) Core changes: Add has_comment_changed to wtap_pkthdr, TRUE when a packet opt_comment has unsaved changes by the user. Add needs_reload to wtap_dumper which forces a full reload of the file on save, otherwise wireshark gets confused by additional packets being written. Change-Id: I0bb04411548c7bcd2d6ed82af689fbeed104546c Ping-Bug: 12303 Reviewed-on: https://code.wireshark.org/review/21873 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Stephen Donnelly <stephen.donnelly@endace.com> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-05-29Fix up dissector tables' UI names.Jeff Morriss1-1/+1
This was inspired by using the Decode-As UI to decode Field "SSL TCP Dissector" Value (port) XXX as YYY. "SSL Port" makes more sense as the UI name. Change-Id: Id6398a5dc79e32bddc4f1bfcf0a468ae1364808f Reviewed-on: https://code.wireshark.org/review/19573 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-28Fix up time encodings.Guy Harris1-1/+1
Add some new encodings for absolute time stamps, and use them as appropriate; this fixes some cases where the time stamps in question were being dissected incorrectly. For the encodings with seconds and 1/2^32s of a second, don't arbitrarily give only microsecond resolution; 2^32 is greater than 1 million, and, in fact, at least some NTP RFCs explicitly talk about time resolution greater than 1 microsecond. Update references in the RELOAD dissector to reflect the documents in question having been updated and published as RFCs. Change-Id: Icbe0b696d65eb622978eb71e99ddf699b84e4fca Reviewed-on: https://code.wireshark.org/review/20759 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-13erf: fix this condition has identical branches [-Werror=duplicated-branches] ↵Alexis La Goutte1-1/+1
found by gcc7 Change-Id: I1634b0a7b0fa35ea59ef2fc7fbe0b81f77aad978 Reviewed-on: https://code.wireshark.org/review/20508 Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-03-05erf: fix this statement may fall through [-Werror=implicit-fallthrough=] ↵Alexis La Goutte1-0/+3
found by gcc7 Change-Id: I377a62a2702b89242a0abfb51f5617f265f698f3 Reviewed-on: https://code.wireshark.org/review/20403 Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-03erf: Fix Dead Store (Dead assignement/Dead increment) Warning found by ClangAlexis La Goutte1-1/+1
Change-Id: I7214adc58362902790c006e1e22f77104be5df2e Reviewed-on: https://code.wireshark.org/review/20341 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-02-28Some ERF pseudo-headers have color instead of lctr valuesfd1-3/+26
Don't report expert-info warnings for lctr when it is actually color. Change-Id: I689ec84dd8f1cafa1ec7e8740f9bc4091339929a Reviewed-on: https://code.wireshark.org/review/20306 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-20Cast larger types to time_tYour Name1-1/+1
Resolves truncation warnings on the x86 clang build Change-Id: I14ebbe39b8235bd1b909c488c0402b77deb6dde1 Reviewed-on: https://code.wireshark.org/review/19354 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-11-08ERF: Fix issues with Host ID mappingAnthony Coddington1-45/+37
packet-erf: Fix Host ID/Source ID showing for all extension header types. Only show generated Host ID/Source ID when there is a Host ID extension header or there was not one on the record. Assumes there is only one Source ID if multiple Flow ID extension headers (unlikely) and that it matches the one in the Host ID header. This is consistent with other tools. Does support multiple Host ID extension headers though. Fix dag_version tag short name. Was clashing with another tag due to typo. ERF wiretap: Don't conflate Host ID 0 with implicit Host ID. While the implicit Host ID defaults to 0, it is not the same thing as seeing a packet with Host ID explicitly 0 in the extension header which means explicitly unknown source. Store the initial (unknown) implicit Host ID interface mapping in it's own special mapping table entry rather than 0. Noticed we can currently get duplicate interfaces in the unusual event of mixed implicit and explicit Host ID packet extension headers for the same ID before we discover that mapping. Consistently abandon the implicit version for consistency with the dissector linking behaviour and mark the interface as unmatched in the description. In 2 pass mode (including normal Wireshark file open) the abandoned interface ends up with no packets. In the common cases (all Host ID or no Host ID on packet records) this duplicate interface will not be created in the first place. Change-Id: Ic5d0b2ce9aae973f1693a247cf240ef1324ff70a Ping-Bug: 12303 Reviewed-on: https://code.wireshark.org/review/18704 Reviewed-by: Stephen Donnelly Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-02ERF: Fix dissector abort on short meta tags and typosAnthony Coddington1-37/+107
Fix dissector abort on short tags. Fix value typo in hash mode enum. Differentiate unexpectedly short value, zero length (deliberate invalid) and off-end-of-record tags through expertinfo. Continue to use proto_tree_add_*() length mismatch warnings for unxepectedly long tags for now. Change WWN tags to FT_BYTES for now as they are 16 not 8 byte WWN. Not currently implemented outside Wireshark anyway. Ping-Bug: 12303 Change-Id: I79fe4332f0c1f2aed726c69acdbc958eb9e08816 Reviewed-on: https://code.wireshark.org/review/17382 Reviewed-by: Anthony Coddington <anthony.coddington@endace.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-31Don't do any Decode As stuff for dissector tables not used with Decode As.Guy Harris1-1/+1
Have all dissector tables have a "supports Decode As" flag, which defaults to FALSE, and which is set to TRUE if a register_decode_as() refers to it. When adding a dissector to a dissector table with a given key, only add it for Decode As if the dissector table supports it. For non-FT_STRING dissector tables, always check for multiple entries for the same protocol with different dissectors, and report an error if we found them. This means there's no need for the creator of a dissector table to specify whether duplicates of that sort should be allowed - we always do the check when registering something for "Decode As" (in a non-FT_STRING dissector table), and just don't bother registering anything for "Decode As" if the dissector table doesn't support "Decode As", so there's no check done for those dissector tables. Change-Id: I4a1fdea3bddc2af27a65cfbca23edc99b26c0eed Reviewed-on: https://code.wireshark.org/review/17402 Petri-Dish: Guy Harris <guy@alum.mit.edu> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-18ERF: fix no previous prototype for ↵Alexis La Goutte1-3/+3
'erf_ts_to_nstime/dissect_relative_time/dissect_ptp_timeinterval' [-Wmissing-prototypes] Change-Id: I21ee4f8850f63de3a7fa91ed9e8a426c82a9d62e Reviewed-on: https://code.wireshark.org/review/17143 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-07-31packet-erf.c: Pacify OS X buildbot.Michael Mann1-1/+1
Change-Id: I6ec30e77eac91d1b02eaddada75741b2063426f2 Reviewed-on: https://code.wireshark.org/review/16812 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-07-31ERF: Add ERF_TYPE_META clock tagsAnthony Coddington1-152/+380
Adds various clock configuration related tags. Uses ptp_v2 value strings exported from packet-ptp. Refactor out common ERF_TYPE_META bitfield code. Also clean up field registration a bit. Add flow_hash_mode enum, other minor wording cleanup. Manually display relative timestamps as nanoseconds for <1ms. Fix ns_host_* tag subtree summary field name duplication. Ping-Bug: 12303 Change-Id: I76264d141f1c4a3590627637daa5dcd4fdfd2e93 Reviewed-on: https://code.wireshark.org/review/16782 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-07ERF: Make ERF wiretap forwards compatible.Anthony Coddington1-0/+1
Dissector has always been able to cope with unknown record types so pass them through (and call the data dissector from the ERF dissector in this case). Previously was stopping processing on the first unrecognized record which is very unhelpful for otherwise valid files that have new types mixed in. Remove ERF type check altogether from open heuristic as ERF type could be past 48 in future and with more extension headers bit any byte value could be valid. Also allow setting ERF_RECORDS_TO_CHECK to 0 to force skipping the heuristic. Change-Id: I8331eef30ba2e949564f418b3100bd73b8f58116 Reviewed-on: https://code.wireshark.org/review/15361 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>