aboutsummaryrefslogtreecommitdiffstats
path: root/epan/packet.c
AgeCommit message (Collapse)AuthorFilesLines
2014-01-30Add remove_last_data_source and fix bug 9169Evan Huus1-0/+15
The OP asked 9169 to be reopened because the capture was spewing ~40GB of output when dissected with tshark. Investigation showed this was because the HTTP dissector was requesting ONE_MORE_PACKET reassembly a lot, and TCP was adding each step as a data-source which was being printed by tshark's hex dump. This was leading to O(n^2) of output. To fix, introduce function remove_last_data_source which removes the most recent data source from the list. If the subdissector in TCP reassembly asks for ONE_MORE_PACKET, assume it hasn't added any tree items (since it shouldn't have) and remove the data source since it is unnecessary. This may break dissectors which add tree items and *then* return ONE_MORE_PACKET, since they will have their data source removed out from under them. I believe those cases should be fixed to not add tree items until they're sure they have enough data. Change-Id: Iff07f959b8b8bd1acda9bff03f7c8684901ba8aa Reviewed-on: https://code.wireshark.org/review/38 Reviewed-by: Evan Huus <eapache@gmail.com> Tested-by: Evan Huus <eapache@gmail.com>
2014-01-08TFShark (Terminal Fileshark) v.001. Bug 9607 ↵Michael Mann1-0/+69
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9607) This is a VERY PRELIMINARY version of tfshark. It's an attempt to jumpstart FileShark and its architecture. Right now it's mostly just a very stripped down version of tshark with all of the necessary build modifications (including now building filetap library since tfshark depends on it) This code has helped me identify what I believe to be all of the necessary layers for a complete fileshark architecture. And those layers will slowly be added in time (patches always welcome!). svn path=/trunk/; revision=54646
2013-12-20Avoid including <epan/range.h> in dissectors.Jakub Zawadzki1-0/+1
svn path=/trunk/; revision=54315
2013-12-15Fix some const/ not const warnings.Jakub Zawadzki1-2/+2
svn path=/trunk/; revision=54114
2013-12-10Get the "Decode As" dialog working, albeit with a few warts. It differsGerald Combs1-3/+32
from the GTK flavor in two major ways: - The "Decode As" and "User Specified Decodes" dialog have been unified. - You can modify the decode as behavior at any time, not just when you have a packet selected. Revert part of 53498 so that we can move items marked /*** THE FOLLOWING SHOULD NOT BE USED BY ANY DISSECTORS!!! ***/ from epan/decode_as.h to ui/decode_as_utils.h. Move "save" code from decode_as_dlg.c to decode_as_utils.c as well. In packet-dcerpc.c don't register a table named "ethertype". We might want to add checks for duplicate table names. To do: - Add support for ranges? - Either add support for DCERPC or make DCERPC use a regular dissector table. - Fix string selectors (i.e. BER). svn path=/trunk/; revision=53910
2013-12-02Move most of the plugin code from epan to wsutil and remove allGuy Harris1-1/+0
knowledge of particular types of plugins. Instead, let particular types of plugins register with the common plugin code, giving a name and a routine to recognize that type of plugin. In particular applications, only process the relevant plugin types. Add a Makefile.common to the codecs directory. svn path=/trunk/; revision=53710
2013-11-25Move DCERPC data in packet_info needed for Decode As into packet scoped ↵Michael Mann1-1/+0
proto data. svn path=/trunk/; revision=53559
2013-11-24Move dceprc_procedure_name from packet_info to dcerpc_info. Doesn't appear ↵Michael Mann1-1/+0
to be "used" by dissectors, just stored (for help in debugging?). svn path=/trunk/; revision=53552
2013-11-22Move common "decode as" preference code to epan.Gerald Combs1-9/+21
We presumably want "decode as" behavior to be consistent across UIs so call load_decode_as_entries() from read_prefs(). svn path=/trunk/; revision=53498
2013-11-21Remove ethertype, mpls_label and ppids from packet_info structure.Michael Mann1-3/+0
The information was converted to "proto" data within their respective dissectors strictly for use in "Decode As". svn path=/trunk/; revision=53489
2013-11-10Add missing includes in order to remove exceptions.h from proto.h (next commit).Jakub Zawadzki1-0/+1
svn path=/trunk/; revision=53230
2013-11-05Replace pinfo->layer_names as a string with pinfo->layers as a wmem_list ofEvan Huus1-23/+12
protocol IDs. This is substantially more efficient, which means we can build it all the time rather than only if tree (in my benchmarks the extra time taken is not large enough to be statistically significant even over tens of thousands of packets). This fixes what was probably a bug in btobex that relied on layer_names for non-tree dissection. It also enables a much simpler fix for https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9303 svn path=/trunk/; revision=53089
2013-11-02Require dissector_try_string to pass a data parameter to its subdissectors. ↵Michael Mann1-57/+0
There weren't that many calls, so might as well modify the function than create a need for dissector_try_string_new. svn path=/trunk/; revision=53049
2013-10-30Allow string-based dissector tables to pass data between dissectors.Michael Mann1-0/+57
svn path=/trunk/; revision=52980
2013-10-30When adding an entry to a dissector string table, take a copy of the patternEvan Huus1-3/+3
string (and pass g_free to g_hash_table_new_full to free it). This means callers don't have to worry about the scope of the memory they pass in, and fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9296 svn path=/trunk/; revision=52977
2013-10-20Move resetting packet_info structure from dissect_packet() to ↵Jakub Zawadzki1-5/+1
epan_dissect_init() It'd be actually good idea to seperate packet_info data (packet.c) from epan_dissect_t (epan.c), but this rule is already violated. Strict seperation could allow for example allow multiple dissection on the same epan_dissect_t (I think it was idea behind it), but it's not working. svn path=/trunk/; revision=52705
2013-10-15g_slist_prepend() should be faster than g_slist_append() use it where the ↵Anders Broman1-4/+4
order shouldn't matter. svn path=/trunk/; revision=52626
2013-10-12Free the actual struct, not the typedef thereof, because the typedef is actuallyEvan Huus1-1/+1
a typedef of a *pointer* to the struct, not the struct itself, which are different sizes. This doesn't show up under valgrind because the length isn't checked in that case, everything gets subsumed in valgrind's malloc/free hooks. Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9264 svn path=/trunk/; revision=52560
2013-10-11Destroy dissector tables on shutdown and use epan scoped memory of handles.Evan Huus1-7/+18
Cleans up another 600KB of "still accessible" memory. svn path=/trunk/; revision=52531
2013-10-11Free all the heuristict dissector lists and their entries on shutdown, anotherEvan Huus1-6/+21
few KB of "still reachable" data down. svn path=/trunk/; revision=52528
2013-10-09Prefix all "Wireshark application specific" display filters with a "_ws." to ↵Michael Mann1-1/+1
distinguish them from dissector filters. This was committed now to get it into the 1.11 release so users can start getting used to the changed filter names. svn path=/trunk/; revision=52462
2013-09-09Yet another cast fix.Stig Bjørlykke1-1/+1
svn path=/trunk/; revision=51864
2013-09-09Added casts in dissector_delete_all_check().Stig Bjørlykke1-2/+2
svn path=/trunk/; revision=51861
2013-09-09Added dissector_delete_all() to remove all entries from a dissector table.Stig Bjørlykke1-0/+18
svn path=/trunk/; revision=51859
2013-08-29Fix some indentation to match mode-lines; Do some other minor reformatting.Bill Meier1-33/+34
svn path=/trunk/; revision=51571
2013-08-25Simplify adding and deletetion of port ranges by adding new methods.Anders Broman1-0/+28
If no one has any objection I'll edit the deocumentation later. svn path=/trunk/; revision=51517
2013-08-14Pre-emptively create the other two hash tables in packet.c for simplicity'sEvan Huus1-15/+5
sake. svn path=/trunk/; revision=51355
2013-08-13Create the dissector hash table in only one place, and specify that its valuesEvan Huus1-12/+7
should be freed when it is destroyed. This requires splitting packet_init in two: the hash table which must be created before protocol registration, and the caching of common protocol handles, which must happen after registration. svn path=/trunk/; revision=51329
2013-08-11Free a few hash tables in packet.c when we shutdown.Evan Huus1-40/+41
svn path=/trunk/; revision=51292
2013-08-07Ensure we have both _initialize() and a corresponding _cleanup() routines forJeff Morriss1-2/+0
the various name resolvers; put those two routines next to each other. Add generic addr_resolv_init() and addr_resolv_cleanup() routines which call all of those internal routines. Call the generic init/cleanup routine from epan_init() and epan_cleanup(). Create the hash tables for each name resolver in those initialization routines in order to avoid having to repeatedly check if the table is already created or not (and to avoid glib warnings if we neglected to perform that check): http://www.wireshark.org/lists/wireshark-dev/201308/msg00012.html Don't clean up hostnames in init_dissection(): it's done already in cleanup_dissection(). Don't initialize hostnames in cleanup_dissection(): it's done already in init_dissection(). svn path=/trunk/; revision=51191
2013-08-05Dissector handle after [new_]register_dissector can be get by ↵Jakub Zawadzki1-2/+6
find_dissector() so to avoid some extra calls just return it. svn path=/trunk/; revision=51154
2013-08-01Use opt_comment only when has_phdr_comment is set.Jakub Zawadzki1-1/+1
svn path=/trunk/; revision=51097
2013-08-01Remove fdata->opt_comment, add pkt_comment to pinfoJakub Zawadzki1-0/+6
Original (read from file) comments can be accessed by pkthdr->opt_comment Keep user comments in seperated BST, add new method for epan session to get it. svn path=/trunk/; revision=51090
2013-08-01Move some asserts to be triggered sooner.Jakub Zawadzki1-9/+8
svn path=/trunk/; revision=51082
2013-07-21Replace relative timestamp with reference frame number. Saves 16B per frame.Jakub Zawadzki1-0/+2
svn path=/trunk/; revision=50772
2013-07-21Add helper function to epan_session which can be used to get absolute ↵Jakub Zawadzki1-1/+2
timestamp of given frame. Remove ->prev_cap, for testing purpose also replace ->prev_dis with number of previously displayed frame number. This patch reduce size of frame_data by 8B (amd64) This is what (I think) was suggested by Guy in comment 13 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5821#c13) svn path=/trunk/; revision=50765
2013-07-11packet dissection now takes pointer to tvb instead of guint8 dataJakub Zawadzki1-27/+2
implement frame_tvbuff, right now almost a copy of 'real' tvb. svn path=/trunk/; revision=50497
2013-06-18Add ability to export decrypted SSL/DTLS PDUsPascal Quantin1-0/+10
svn path=/trunk/; revision=50001
2013-05-24Add expert info configuration framework. Bug 2412 ↵Michael Mann1-2/+2
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2412). Expert info "fields" can now be registered/addressed by name. Right now, the basic framework allows expert info fields to become "display filters". However more could be done, like user preferences overriding default severity level, speeding up expert info dialog load time by not needing to redissect a file, etc. Long term goal is to have all expert_info filterable and have the functionality of expert_add_info_format() include the "registered index". expert_add_info_format_text() is the workaround until all current calls to expert_add_info_format() have been updated with either expert_add_info() or expert_add_info_format_text(). Then the remaining expert_add_info_format_text() will be renamed to expert_add_info_format(). svn path=/trunk/; revision=49559
2013-05-16Use slice memory for data sources, since we never have to realloc it.Evan Huus1-2/+2
svn path=/trunk/; revision=49353
2013-04-23Add curr_layer_num which can be used to keep track of multiple occurances of ↵Anders Broman1-5/+8
the same protocol in a frame. svn path=/trunk/; revision=48997
2013-04-18Add to tvbuffs a "fragment length" field; if the tvbuff represents theGuy Harris1-2/+2
first fragment of a non-reassembled packet, and we know the length the packet would have if it were reassembled, this field holds the length of the fragment, and the "reported length" field shows the length the packet would have if it were reassembled, so going past the end of the fragment but staying within the length of the reassembled packet can be reported as "dissection would have worked if the packet had been reassembled" rather than "the packet is too short, so it was probably malformed". Add a FragmentBoundsError exception, thrown in the "dissection would have worked if the packet had been reassembled" case. Add a new tvb_new_subset_length_fragment() routine to create a new subset tvb with specified fragment and reported lengths. Use it in the CLNP dissector. Add some more sanity checks in the CLNP dissector. svn path=/trunk/; revision=48917
2013-03-24Add const casts and make local functions static.Anders Broman1-3/+3
svn path=/trunk/; revision=48521
2013-03-14From beroset:Anders Broman1-35/+35
changed implicit casts to explicit casts and changed name of field from new to new_d (new dissector) https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416 svn path=/trunk/; revision=48290
2013-03-06Fix the plurality of the length of a data source if it has only 1 byte (I'mJeff Morriss1-2/+5
looking at a "Bitstring tvb" that is only 1 byte long). svn path=/trunk/; revision=48127
2013-02-27Move show_exception() and show_reported_bounds_error() toGuy Harris1-6/+0
epan/show_exception.c, as it's used outside epan/dissectors/packet-frame.c. Update their callers to include <epan/show_exception.h> to get their declaration. Add a CATCH_NONFATAL_ERRORS macro that catches all exceptions that, if there's more stuff in the packet to dissect after the dissector call that threw the exception, doesn't mean you shouldn't go ahead and dissect that stuff. Use it in all those cases, including ones where BoundsError was inappropriately being caught (you want those passed up to the top level, so that the packet is reported as having been cut short in the capture process). Add a CATCH_BOUNDS_ERRORS macro that catches all exceptions that correspond to running past the end of the data for a tvbuff; use it rather than explicitly catching those exceptions individually, and rather than just catching all exceptions (the only place that DissectorError should be caught, for example, is at the top level, so dissector bugs show up in the protocol tree). Don't catch and then immediately rethrow exceptions without doing anything else; just let the exceptions go up to the final catcher. Use show_exception() to report non-fatal errors, rather than doing it yourself. If a dissector is called from Lua, catch all non-fatal errors and use show_exception() to report them rather than catching only ReportedBoundsError and adding a proto_malformed item. Don't catch exceptions when constructing a trailer tvbuff in packet-ieee8023.c - just construct it after the payload has been dissected, and let whatever exceptions that throws be handled at the top level. Avoid some TRY/CATCH/ENDTRY cases by using checks such as tvb_bytes_exist() before even looking in the tvbuff. svn path=/trunk/; revision=47924
2012-12-02Create a wmem pool in pinfo and use it for some address allocations.Evan Huus1-0/+4
A (better?) fix for https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8030 See also thread starting at: http://www.wireshark.org/lists/wireshark-dev/201212/msg00001.html svn path=/trunk/; revision=46331
2012-11-09Enter and leave wmem's file scope appropriately.Evan Huus1-0/+5
svn path=/trunk/; revision=45977
2012-10-20Move ep_free_all() *AFTER* packet dissection.Jakub Zawadzki1-3/+11
Use glib allocator for data_source. Thread on wireshark-dev: http://www.wireshark.org/lists/wireshark-dev/201210/msg00116.html svn path=/trunk/; revision=45673
2012-10-20Make data_source opqaue, add getter for tvb.Jakub Zawadzki1-9/+18
svn path=/trunk/; revision=45672
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-03 15:51:34 +0000