| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
equivalents for the toplevel directory. The removal of winsock2.h will
hopefully not cause any problems under MSVC++, as those files using
struct timeval still include wtap.h, which still includes winsock2.h.
svn path=/trunk/; revision=5932
|
|
but for stuff reassembled with "fragment_add_seq()" or
"fragment_add_seq_check()".
Add a "fragment tag" string to the "fragment_items", so that packets
with fragmentation errors can be properly flagged as having "Illegal
fragments" or "Illegal segments" depending on the term used with the
protocol in question.
Make all the dissectors that can use "show_fragment_tree()" or
"show_fragment_seq_tree()", and don't already use them, do so.
svn path=/trunk/; revision=5644
|
|
fregment trees.
svn path=/trunk/; revision=5627
|
|
in the "packet_info" structure instead, as we don't need a pointer for
every single frame in the capture file, just for each frame for which we
currently have an open "epan_dissect_t".
svn path=/trunk/; revision=5614
|
|
When this ption is enabled in Protocols/NFS displayfilters for fhandle fields
such as nfs.fh.{hash|name|full_name} will find both the request and matching
response packets even if the fhandle is only present in one of the packets.
The option supports all NFS and related protocols which use nfs fhandles
including async NLM.
The option will not work with nfs packets containing multiple fhandles in
one PDU, nor will it work if tcp collapses multiple segments/pdus into
one larger segment.
It only works for async NLM if one first enables the MSG/RES stateful
matching for async NLM.
svn path=/trunk/; revision=5515
|
|
protocol reply if:
we got anything other than SUCCESS for MSG_ACCEPTED;
we got MSG_DENIED;
we got anything other than MSG_ACCEPTED or MSG_DENIED;
as there isn't a protocol reply in there.
Just use "-1, -1" as arguments to "tvb_new_subset()" if you want the new
tvbuff to run to the end of the packet - there's no need to call
"tvb_reported_length_remaining()".
svn path=/trunk/; revision=5483
|
|
RPC-over-everything-else dissectors, one registered by name and one
anonymous, just fetch the handles for the registered dissectors.
svn path=/trunk/; revision=5445
|
|
When we see PRTOMAP GETPORT calls for UDP, make sure all further UDP packets to or from
this port goes to the ONC-RPC dissector regardless of the port on the other side.
We need this because if there is ONC-RPC traffic going between the ONC-RPC Program port to a port which has a normal ethereal dissector, ethereal would dissect the traffic as the protocol associated with the other port instead.
svn path=/trunk/; revision=5430
|
|
svn path=/trunk/; revision=5090
|
|
svn path=/trunk/; revision=5076
|
|
top-level item correspond to the reassembled data, and make the item for
each fragment/segment correspond to the part of that reassembled data
that came from that fragment/segment.
svn path=/trunk/; revision=5025
|
|
RPC and NDMP.
Show the RPC-over-TCP fragment header as a tree with bitfields below it.
Add a routine to show a reported bounds error as an "Unreassembled
Packet" or a "Malformed Packet" depending on whether "pinfo->fragmented"
is set, and have NBNS and RPC use that.
Add "ett_ndmp_file_stats" to the list of ett_ values to be initialized
(it wasn't in that list, and wasn't getting initialized).
When freeing up various hash tables and memory chunks in the RPC
dissector, zero out the pointers to them, just to make sure we don't try
to free them again.
Always destroy the TCP segment key and address memory chunks in
"tcp_desegment_init()", regardless of whether TCP desegmentation is
enabled - we don't *allocate* them if TCP desegmentation isn't enabled,
but we should free them even if it's not enabled. Also, when we free
them, set the pointers to them to null, so we don't double-free them.
Supply to subdissectors called from the TCP dissector the sequence
number of the first byte handed to the sub dissector.
svn path=/trunk/; revision=4753
|
|
whose length we set later.
svn path=/trunk/; revision=4660
|
|
"epan/..." pathnames, so as to avoid collisions with header files in any
of the directories in which we look (e.g., "proto.h", as some other
package has its own "proto.h" file which it installs in the top-level
include directory).
Don't add "-I" flags to search "epan", as that's no longer necessary
(and we want includes of "epan" headers to fail if the "epan/" is left
out, so that we don't re-introduce includes lacking "epan/").
svn path=/trunk/; revision=4586
|
|
items to the protocol tree; it's interpreted as "the rest of the data in
the tvbuff". This can be used if
1) the item covers the entire packet or the remaining payload in
the packet
or
2) the item's length won't be known until it's dissected, and
will be then set with "proto_item_set_len()" - if an
exception is thrown in the dissection, it means the item ran
*past* the end of the tvbuff, so saying it runs to the end of
the tvbuff is reasonable.
Convert a number of "proto_tree_add_XXX()" calls using
"tvb_length_remaining()", values derived from the result of
"tvb_length()", or 0 (in the case of items whose length is unknown) to
use -1 instead (using 0 means that if an exception is thrown, selecting
the item highlights nothing; using -1 means it highlights all the data
for that item that's available).
In some places where "tvb_length()" or "tvb_length_remaining()" was used
to determine how large a packet is, use "tvb_reported_length()" or
"tvb_reported_length_remaining()", instead - the first two calls
indicate how much captured data was in the packet, the latter two calls
indicate how large the packet actually was (and the fact that using the
latter could cause BoundsError exceptions to be thrown is a feature - if
such an exception is thrown, the frame really *was* short, and it should
be tagged as such).
Replace some "proto_tree_add_XXX()" calls with equivalent
"proto_tree_add_item()" calls.
Fix some indentation.
svn path=/trunk/; revision=4578
|
|
get rid of some dead code;
get rid of some unnecessary initializations of variables that
are set in all code paths;
get rid of some set-but-not-used variables;
if the data runs past the end of the tvbuff, throw the
appropriate exception, to stop the dissection and appropriately
mark the frame, after putting in the item for the truncated
data.
svn path=/trunk/; revision=4576
|
|
tree item for the entire array the amount of captured data remaining in
the tvbuff, rather than 0, so that if we run out of captured data and
throw an exception, the length is correct.
svn path=/trunk/; revision=4573
|
|
related protocols.
svn path=/trunk/; revision=4533
|
|
after the ENDTRY.
svn path=/trunk/; revision=4511
|
|
call/reply, and report the error but don't re-throw the exception; that
way, we can continue to dissect additional RPC messages in the frame or
reassembled chunk of data, even if one of them happens to be too short
for what's in it.
svn path=/trunk/; revision=4491
|
|
ONC RPC replies.
svn path=/trunk/; revision=4457
|
|
structure to the "packet_info" structure; only stuff that's permanently
stored with each frame should be in the "frame_data" structure, and the
"column_info" structure is not guaranteed to hold the column values for
that frame at all times - it was only in the "frame_data" structure so
that it could be passed to dissectors, and, as all dissectors are now
passed a pointer to a "packet_info" structure, it could just as well be
put in the "packet_info" structure.
That saves memory, by shrinking the "frame_data" structure (there's one
of those per frame), and also lets us clean up the code a bit.
svn path=/trunk/; revision=4370
|
|
than a pointer to a dissector function, as an argument.
This means that the conversation dissector is called through
"call_dissector()", so the dissector itself doesn't have to worry about
checking whether the protocol is enabled or setting
"pinfo->current_proto", so get rid of the code that does that in
conversation dissectors. Also, make the conversation dissectors static.
Get rid of some direct calls to dissectors; replace them with calls
through handles, and, again, get rid of code to check whether a protocol
is enabled and set "pinfo->current_proto" where that code isn't needed.
Make those dissectors static if they aren't already static.
Add a routine "create_dissector_handle()" to create a dissector handle
without registering it by name, if the dissector isn't used outside the
module in which it's defined.
svn path=/trunk/; revision=4281
|
|
svn path=/trunk/; revision=4269
|
|
without requiring compiler support for them, and updates to the
Diameter, L2TP, NFS, and NLM dissectors to use it and to the ONC RPC
dissector to allow ONC RPC subdissectors to use it.
svn path=/trunk/; revision=4099
|
|
svn path=/trunk/; revision=4098
|
|
Make the default for NBSS and ONC RPC-over-TCP desegmentation "on",
rather than "off"; the default for desegmentation in general is "off",
so this won't change the default behavior, but it lets you turn
desegmentation on by flipping only one switch (and turn it off for
particular protocols if you desire).
svn path=/trunk/; revision=3943
|
|
dissectors to use it, from Ronnie Sahlberg, with additional changes to
handle the case where a frame contains messages that don't run past the
end followed by one that does and where a reassembled chunk has, at the
end, a message that runs past the end of that chunk (because the
reassembly was for an earlier message).
svn path=/trunk/; revision=3923
|
|
"dissect_rpc_common()" check, every time it's about to return FALSE,
whether it's being used as a heuristic dissector and, if not, call
"dissect_rpc_continuation()" - we can just have the non-heuristic
dissector call it and, if it returned FALSE, call
"dissect_rpc_continuation()".
svn path=/trunk/; revision=3922
|
|
source and destination addresses if the transport is TCP (we use that,
for now, as a proxy for "if the transport is connection-oriented"), as
the endpoint addresses should be the same for all packets.
Have both a heuristic RPC dissector and a non-heuristic version, and
make the non-heuristic version the dissector for the conversations we
create; that version will, if the frame doesn't look like a call or
reply, mark it as continuation data.
svn path=/trunk/; revision=3921
|
|
of protocol-id-plus-datum pairs, so that multiple protocols can attach
information to the same conversation.
Dissectors that attach information to a conversation should not assume
that if they find a conversation it has one of its data attached to it;
the conversation might've been created by another dissector.
svn path=/trunk/; revision=3901
|
|
GSS-API but the RPCSEC_GSS procedure and service information isn't
available in the captured data.
svn path=/trunk/; revision=3892
|
|
available - just mark it as "authentication flavor unknown". Don't
dissect the next protocol if the authentication flavor is unknown.
This lets us get some more work done on short frames (although if you
really want to analyze ONC RPC traffic, you should make the snapshot
length large enough to capture enough of the frames).
svn path=/trunk/; revision=3891
|
|
svn path=/trunk/; revision=3884
|
|
throwing an exception before we've decided whether a packet is an RPC
packet or not - dissectors shouldn't, by and large, carefully avoid
having tvbuff accessors throw exceptions, they should let them throw
exceptions so that the frame is properly flagged as having been too
short.
svn path=/trunk/; revision=3641
|
|
packet isn't necessarily the first frame of the packet, so don't say
that a reply is to a request "starting in" a given frame, just say it's
in that frame.
Don't manually check whether the stuff we're about to fetch from the
tvbuff exists - just fetch it, and let the tvbuff accessors throw an
exception if we go past the end of the packet.
svn path=/trunk/; revision=3636
|
|
"header_field_info" structure, including the ones that are later set by
the routines to register fields.
svn path=/trunk/; revision=3561
|
|
rid of support for them, and remove the "_tvb" from the end of the names
of RPC type dissection routines.
Update Gerald's e-mail address.
svn path=/trunk/; revision=3477
|
|
dissectors.
svn path=/trunk/; revision=3469
|
|
svn path=/trunk/; revision=3453
|
|
"proto_tree_add_string_format()" to put in the protocol tree item for
the data, use "proto_tree_add_bytes_format()".
svn path=/trunk/; revision=3430
|
|
svn path=/trunk/; revision=3400
|
|
strings, with a field index, rather than as text, so they can be
filtered.
svn path=/trunk/; revision=3328
|
|
or new-style dissector for the reply, we can dissect the reply; there
doesn't have to be a new-style dissector.
svn path=/trunk/; revision=3009
|
|
dissector for indirect replies that looks up the call. Use them in the
portmapper/RPCBIND dissector.
svn path=/trunk/; revision=3008
|
|
specified program/version/procedure, and a "rpc_proc_name()" routine to
return the name of a specified program/version/procedure, and make the
callit dissector use those, rather than doing the work itself.
Un-export various routines and declarations that can again be private to
the RPC dissector.
svn path=/trunk/; revision=3007
|
|
dissection (dissection of V2 CALLIT calls; no V3/V4 stuff or reply
handling yet).
svn path=/trunk/; revision=2994
|
|
either with a table of old-style dissectors or a table of tvbuffified
dissectors, and have the RPC dissector pass the appropriate arguments to
the dissectors.
Finish tvbuffifying the NLM dissector, getting rid of the last traces of
old-style dissector code.
In those routines in the NFS dissector that take new-style arguments
(because they're called from the NLM dissector), make them take an
offset as an argument, so they don't assume that they're handed a tvbuff
starting at the stuff they're supposed to dissect, and make the versions
that take old-style arguments construct a tvbuff and call the versions
that take new-style arguments. Do the latter with the routines in
"packet-rpc.c" as well.
svn path=/trunk/; revision=2943
|
|
statements.
Move the setting of the Protocol column in various dissectors before
anything is fetched from the packet, and also clear the Info column at
that point in those and some other dissectors, so that if an exception
is thrown, the columns don't reflect the previous protocol.
Don't use
col_add_fstr(..., "%s", string);
Use
col_add_str(..., string);
as it does the same thing, but doesn't drag all the heavy *printf
machinery in.
Fix the DDTP dissector to set the Info column regardless of whether
we're building a protocol tree or not, and to set it to "Encrypted
payload" if the payload is encrypted. Also fix a typo in a field name.
Register the FTP data dissector as being associated with the FTP data
protocol, not the FTP protocol (the removed "CHECK_DISPLAY_AS_DATA()"
call checked "proto_ftp_data", and the removed "pinfo->current_proto ="
line set it to "FTP-DATA", so it should be associated with
"proto_ftp_data").
Make the H1 dissector check whether the frame has at least 2 bytes in it
before checking the first two bytes; heuristic dissectors must not throw
exceptions until they've accepted the packet as one of theirs.
Use "tvb_format_text()" rather than "tvb_get_ptr()" and "format_text()"
in some dissectors where the result of "tvb_get_ptr()" is used only in
the "format_text()" call.
In the Quake dissector, don't check whether there are at least 4 bytes
in the packet - if we return, the packet won't be dissected at all (it's
not as if some other dissector will get to handle it), and, if we don't
return, we'll throw an exception if there aren't at least 4 bytes in the
packet, so the packet will be marked as short or malformed, as
appropriate.
In the RIPng dissector, associate the table of strings for the command
field with the command field, so that the dissector doesn't have to
format the string for the protocol tree entry itself, and so that the
filter construction dialog box can let you select "Request" or
"Response" from a list rather than requiring you to know the values for
"Request" and "Response".
Make "dissect_rpc()" static, as it's called only through a heuristic
dissector list.
Use "col_set_str()" to set the COL_PROTOCOL column for RPC protocols;
the string used is from a table provided by the dissector, and is a
string constant.
Don't format the Info column for WSP into a buffer and then format that
buffer into the column with "%s" - "col_add_fstr()" can do the
formatting for you, without having to allocate your own buffer (or run
through the *printf machinery twice).
Don't fetch fields from the WTP packet until you're ready to use them,
so that you don't throw an exception before you even set the Protocol
column or clear the Info column.
Use "pinfo->destport", not "pi.destport", in the Zebra dissector when
checking whether the packet is a request or reply, and do the check by
comparing with "pinfo->match_port" rather than TCP_PORT_ZEBRA (so that
if the dissector is ever registered on another port, it still correctly
determines whether the packet is a request or reply - the Network
Monitor HTTP dissector has port 80 wired into its brain, which is a bit
irritating if you're trying to get it to dissect HTTP proxy traffic on
port 3128 or proxy administration UI traffic on port 3132).
svn path=/trunk/; revision=2931
|
|
dissector for a particular type of RPC request or reply.
Always call that dissector, regardless of whether we're building a
protocol tree or not.
svn path=/trunk/; revision=2914
|
