Age | Commit message (Collapse) | Author | Files | Lines |
|
be done on flows from one address to another; reassembly for protocols
running atop TCP should be done on flows from one TCP endpoint to
another.
We do this by:
adding "reassembly table" as a data structure;
associating hash tables for both in-progress reassemblies and
completed reassemblies with that data structure (currently, not
all reassemblies use the latter; they might keep completed
reassemblies in the first table);
having functions to create and destroy keys in that table;
offering standard routines for doing address-based and
address-and-port-based flow processing, so that dissectors not
needing their own specialized flow processing can just use them.
This fixes some mis-reassemblies of NIS YPSERV YPALL responses (where
the second YPALL response is processed as if it were a continuation of
a previous response between different endpoints, even though said
response is already reassembled), and also allows the DCE RPC-specific
stuff to be moved out of epan/reassembly.c into the DCE RPC dissector.
svn path=/trunk/; revision=48491
|
|
remove C++ incompatibilities
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416
svn path=/trunk/; revision=48383
|
|
svn path=/trunk/; revision=47925
|
|
The misspellings were mostly in comments but some were
in text strings visible to the user.
svn path=/trunk/; revision=47899
|
|
svn path=/trunk/; revision=47891
|
|
unused hf[] entries (which I should have done in the first place).
svn path=/trunk/; revision=47391
|
|
by checkhf.
svn path=/trunk/; revision=47312
|
|
is an MPEG-2 transport packet, so don't treat it as one.
svn path=/trunk/; revision=46733
|
|
svn path=/trunk/; revision=45017
|
|
Add new parameter 'data' to heur_dissector_t and new_dissector_t, for now it's always NULL
svn path=/trunk/; revision=44860
|
|
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7683 :
The reassembled fragments tree in the Packet Details view is awesome, but it
lacks one thing: a field that exposes the reassembled data.
tcp.data already exists for exposing a single TCP segment's payload as a byte
array. It would be handy to have something similar for a single application
layer PDU when TCP segment reassembly is involved. I propose
tcp.reassembled.data, named and placed after the already existing field
tcp.reassembled.length.
My primary use case for this feature is outputting tcp.reassembled.data with
tshark for further processing with a script.
The attached patch implements this very feature. Because the reassembled
fragment tree code is general purpose, i.e. not specific to just TCP, any
dissector that relies upon it can add a similar field very cheaply. In that
vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which
expose reassembled fragment data as a single byte stream for IPv4 and IPv6,
respectively. All other protocols that use the reassembly code have been left
alone, other than inserting NULL into their initializer lists for the newly
introduced struct field reassemble.h:fragment_items.hf_reassembled_data.
svn path=/trunk/; revision=44802
|
|
misspelled as "adaption"
In MPEG-related dissectors, "adaption" is used instead of "adaptation" several
times. See patch (it also fixes an unrelated typo that happens to be on the
same line).
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7421
svn path=/trunk/; revision=43539
|
|
(COPYING will be updated in next commit)
svn path=/trunk/; revision=43536
|
|
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6967
svn path=/trunk/; revision=41645
|
|
Fix a few bugs in packet-mp2t
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6959
svn path=/trunk/; revision=41597
|
|
#include <styring.h> not req'd (in a few cases);
Minor reformating & whitespace cleanup.
svn path=/trunk/; revision=41374
|
|
svn path=/trunk/; revision=41002
|
|
could cause an unsigned length value to be reduced by more than its
value, turning it into a very large value.
I couldn't exactly reproduce bug 6833, but it was due to an attempt to
allocate 4294967110 bytes, and this bug caused remaining_len to equal
4294967110, and it would try to create a reassembled packet tvbuff of
that size, so I'm guessing this fixes 6833.
svn path=/trunk/; revision=41001
|
|
Remove some duplicate checks.
svn path=/trunk/; revision=40922
|
|
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6799 :
Ensure that the payload length handed to the reassembly routines doesn't go
negative/very-large-positive.
svn path=/trunk/; revision=40919
|
|
one case this looks like a logic bug and should be investigated.
svn path=/trunk/; revision=40914
|
|
Updated MP2T (MPEG2-TS) dissector
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6795
svn path=/trunk/; revision=40885
|
|
of https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2432 and closes the bug.
svn path=/trunk/; revision=40161
|
|
svn path=/trunk/; revision=39870
|
|
Also: remove trailing whitespace for a number of files.
svn path=/trunk/; revision=39503
|
|
(previously missed).
57 FT_BOOLEAN: FALSE-->ENC_BIG_ENDIAN
31 FT_BOOLEAN: TRUE-->ENC_LITTLE_ENDIAN
10 FT_BYTES: ENC_BIG_ENDIAN-->ENC_NA
1 FT_BYTES: ENC_LITTLE_ENDIAN-->ENC_NA
21 FT_BYTES: FALSE-->ENC_NA
2 FT_BYTES: TRUE-->ENC_NA
2 FT_IPXNET: ENC_BIG_ENDIAN-->ENC_NA
6 FT_IPv6: ENC_BIG_ENDIAN-->ENC_NA
1 FT_IPv6: FALSE-->ENC_NA
6 FT_NONE: ENC_BIG_ENDIAN-->ENC_NA
19 FT_NONE: FALSE-->ENC_NA
3 FT_NONE: TRUE-->ENC_NA
1 FT_STRING: ENC_BIG_ENDIAN-->ENC_ASCII|ENC_NA
1 FT_STRING: ENC_LITTLE_ENDIAN-->ENC_ASCII|ENC_NA
5 FT_STRING: FALSE-->ENC_ASCII|ENC_NA
1 FT_STRING: TRUE-->ENC_ASCII|ENC_NA
4 FT_STRINGZ: ENC_NA-->ENC_ASCII|ENC_NA
8 FT_STRINGZ: FALSE-->ENC_ASCII|ENC_NA
1 FT_INT32: FALSE-->ENC_BIG_ENDIAN
1 FT_INT32: TRUE-->ENC_LITTLE_ENDIAN
11 FT_UINT8: 0-->ENC_BIG_ENDIAN
111 FT_UINT8: FALSE-->ENC_BIG_ENDIAN
17 FT_UINT8: TRUE-->ENC_LITTLE_ENDIAN
1 FT_UINT16: 0-->ENC_BIG_ENDIAN
68 FT_UINT16: FALSE-->ENC_BIG_ENDIAN
18 FT_UINT16: TRUE-->ENC_LITTLE_ENDIAN
4 FT_UINT24: FALSE-->ENC_BIG_ENDIAN
70 FT_UINT32: FALSE-->ENC_BIG_ENDIAN
1 FT_UINT32: TRUE-->ENC_LITTLE_ENDIAN
4 FT_UINT64: FALSE-->ENC_BIG_ENDIAN
1 FT_UINT64: TRUE-->ENC_LITTLE_ENDIAN
1 FT_UINT_STRING: FALSE-->ENC_ASCII|ENC_BIG_ENDIAN
svn path=/trunk/; revision=39442
|
|
non-autogenerated epan/dissectors:
Specifically: Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
the encoding parameter for proto_tree_add_item() calls which directly reference
an item in hf[] which has a type of:
FT_UINT8
FT_UINT16
FT_UINT24
FT_UINT32
FT_UINT64
FT_INT8
FT_INT16
FT_INT24
FT_INT32
FT_INT64
FT_FLOAT
FT_DOUBLE
svn path=/trunk/; revision=39288
|
|
reference an hf item (in hf[] with types:
FT_NONE
FT_BYTES
FT_IPV6
FT_IPXNET
FT_OID
Note: Encoding field set to ENC_NA only if the field was previously TRUE|FALSE|ENC_LITTLE_ENDIAN|ENC_BIG_ENDIAN
svn path=/trunk/; revision=39260
|
|
svn path=/trunk/; revision=37335
|
|
Resolves bug 4814.
svn path=/trunk/; revision=37039
|
|
This fixes bug 5839.
svn path=/trunk/; revision=36681
|
|
svn path=/trunk/; revision=35705
|
|
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys. (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)
svn path=/trunk/; revision=35224
|
|
once in proto_register...()
svn path=/trunk/; revision=35151
|
|
This is necessary in case a subdissector had changed it but was unable to
restore it (due to the exception).
Remove check_col().
svn path=/trunk/; revision=34436
|
|
http://www.wireshark.org/lists/wireshark-dev/200809/msg00075.html
(as referenced in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2907 ) and
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3411 :
Write a new convenience routine for finding a conversation and, if it is not
found, create it. The frame number and addresses are taken from pinfo (as is
the common case).
Use this function in a bunch of dissectors.
svn path=/trunk/; revision=32790
|
|
svn path=/trunk/; revision=32410
|
|
svn path=/trunk/; revision=32367
|
|
Removed some check_col().
svn path=/trunk/; revision=31809
|
|
reassembly.
svn path=/trunk/; revision=31767
|
|
svn path=/trunk/; revision=31559
|
|
This enhancement implements dissector for Downstream DOCSIS (Data over Cable)
frames, embedded into MPEG packets and encapsulated into L2TPv3 over IP
(DEPI/D-MPT encapsulation). This type of encapsulation is used in Modular Cable
Modem Termination System (M-CMTS) architecture for head-end components that
comply with DOCSIS.
DEPI, the Downstream External PHY Interface, is the interface between the
M-CMTS Core and the EQAM. More specifically, it is an IP Tunnel between the MAC
and PHY in a Modular CMTS system.
L2TPv3 is described in RFC3931.
DOCSIS DEPI data packet transport mechanism is described CM-SP-DEPI-I03-060728
(Downstream External PHY Interface - CableLabs specification)
The format of MPEG packet carrying DOCSIS data is described in
CM-SP-DRFI-I07-081209 (Data-Over-Cable Service Interface Specifications -
CableLabs specification).
svn path=/trunk/; revision=30857
|
|
This patch set improves packet loss detection in for MPEG2 Transport Streams
(RFC 2250 / ISO/IEC 13818-1).
1. Improve loss detection by counting skipped TS frames (currently we only
detect a drop). (only store the info globally)
2. Introduce an analysis tree and record/count the info per TS frame.
svn path=/trunk/; revision=30789
|
|
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
|
|
function() -> function(void)
svn path=/trunk/; revision=28302
|
|
svn path=/trunk/; revision=27892
|
|
Also: whiule we're at it:
- fix hf[] blurbs as appropriate to use NULL;
- fix some indentation
svn path=/trunk/; revision=27890
|
|
be clobbered by 'longjmp' or 'vfork'"
Fixes Bug #3353
svn path=/trunk/; revision=27856
|
|
svn path=/trunk/; revision=27486
|
|
Reviewed-by: Martin Philip Topholm <mph@comx.dk>
Implement packet loss detection in for MPEG2 Transport Streams
Second Part of https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3227
svn path=/trunk/; revision=27381
|