aboutsummaryrefslogtreecommitdiffstats
path: root/packet-rpc.c
AgeCommit message (Collapse)AuthorFilesLines
2002-12-31Make the "rpc.fragment" and "rpc.fragment.error" fields FT_FRAMENUMs, asGuy Harris1-3/+3
they're put into the tree with "proto_tree_add_uint_format()", with the frame number as the value. svn path=/trunk/; revision=6824
2002-12-19Add a new field type FT_FRAMENUM; an FT_FRAMENUM is a 32-bit unsignedGuy Harris1-3/+13
frame number, which is always decimal. If you select an FT_FRAMENUM field, there are menu items that let you go to the frame whose frame number appears in that field. Add FT_FRAMENUM fields for the ONC RPC "matching request is in this frame" and "matching reply is in this frame" protocol tree items. svn path=/trunk/; revision=6802
2002-12-06When we have tretransmissions of TCP for a RPC/(NFS) session weRonnie Sahlberg1-5/+29
often get TCP to collapse multiple RPC PDUs into a MSS TCP segment. This changes the RPC dissector so that it will put one entry on COL_INFO for each PDU in the segment, (as the SMB dissector does for multiple AndX calls in one SMB PDU) and just one entry for the first/last RPC PDU. svn path=/trunk/; revision=6751
2002-12-02Don't cast away constness, and fix variable and structure memberGuy Harris1-13/+13
qualifiers as necessary to ensure that we don't have to. "strcmp()", "strcasecmp()", and "memcmp()" don't return booleans; don't test their results as if they did. Use "guint8", not "guchar", for a pointer to (one or more) 8-bit bytes. Update Michael Tuexen's e-mail address. svn path=/trunk/; revision=6726
2002-11-23From Mike Frisch: fix the display of the nickname in an ONC RPC AUTH_DHGuy Harris1-2/+2
header. svn path=/trunk/; revision=6667
2002-11-18Since packet-rpc.c 1.56 (ethereal 0.8.18), we store inUwe Girlich1-3/+3
dissect_rpc_opaque_data() the actual bytes into the dissector data tree (improves searching). But if we only give the string "<DATA>" to the proto_tree_add_* functions and tell it at the same time, that we have indeed string_length_copy bytes, this leads to problems. Correction: give the pointer into the real data and not the pointer to the print string to the proto_tree_add_string_format() and proto_tree_add_bytes_format() functions. The correction was found by Martin Regner. svn path=/trunk/; revision=6655
2002-11-13From Brian Ginsbach: add a new "dissect_rpc_bytes()" routine to allowGuy Harris1-8/+40
fixed-length opaque data to be dissected, and add support for SGI's variant of the ONC RPC mount protocol. svn path=/trunk/; revision=6620
2002-10-24Add a "fragment_add_seq_next()" to reassemble fragments that don't haveGuy Harris1-2/+2
sequence numbers or offsets and are thus assumed to be received in order with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where 802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or dropped fragments). "show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the "fragment_items" to which the "fit" argument points, so make that argument a "const fragment_items *". Make all the "fragment_items" tables "static" (as they're not used outside the modules defining them) and "const" (as they're not modified). Add support for reassembly of NetBIOS fragmented requests and responses. Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS dissector, and make its table of dissection function pointers static. Fix some typos in the AppleTalk and NetBIOS dissectors. svn path=/trunk/; revision=6491
2002-10-24Check whether the array of procedure hf values has an element for theGuy Harris1-2/+9
given version before fetching that value. svn path=/trunk/; revision=6490
2002-10-23Add an extra argument to "rpc_init_proc_table()" that can specify an hf_Guy Harris1-5/+27
value for a field to be used for the procedure number for that version of the protocol; use that field, if specified, instead of just putting in a generic "rpc.procedure" field. Have the ypserv dissector register those fields and supply them to "rpc_init_proc_table()". Supply -1 for other RPC programs (for now), meaning "no such field exists". svn path=/trunk/; revision=6486
2002-09-04Tap api. tap is a simple api that can be used for arbitrary extensions.Ronnie Sahlberg1-25/+7
One example extension is rpcstat. Try -Z rpc,rtt,100003,3 as argument to tethereal when reading a capture containing NFSv3 packets. tap-rpcstat.[ch] is intended to demonstrate the api and can be used to base other extensions on. svn path=/trunk/; revision=6175
2002-08-28Removed trailing whitespaces from .h and .c files using theJörg Mayer1-44/+44
winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
2002-08-22The "GSS Data" is not a GSS token, it's a sequence number followed byGuy Harris1-4/+1
(unencrypted) request data. svn path=/trunk/; revision=6068
2002-08-22Use the GSSAPI token dissector on what are presumed to be GSSAPI tokens.Guy Harris1-24/+61
For the "GSS Data", put the un-rounded length into the protocol tree, as that's the value extracted from the packet. svn path=/trunk/; revision=6067
2002-08-21Make a common routine for dissecting GSS-API tokens, and call it forGuy Harris1-4/+9
GSS-API tokens in RPCSEC_GSS_INIT and RPCSEC_GSS_CONTINUE_INIT arguments and results. svn path=/trunk/; revision=6051
2002-08-21Note that, as we now have a GSS-API token dissector, we should perhapsGuy Harris1-1/+7
call that for GSS-API tokens in ONC RPC calls. svn path=/trunk/; revision=6050
2002-08-02Replace the types from sys/types.h and netinet/in.h by their glib.hJörg Mayer1-5/+1
equivalents for the toplevel directory. The removal of winsock2.h will hopefully not cause any problems under MSVC++, as those files using struct timeval still include wtap.h, which still includes winsock2.h. svn path=/trunk/; revision=5932
2002-06-07Add "show_fragment_seq_tree()", which is like "show_fragment_tree()",Guy Harris1-2/+3
but for stuff reassembled with "fragment_add_seq()" or "fragment_add_seq_check()". Add a "fragment tag" string to the "fragment_items", so that packets with fragmentation errors can be properly flagged as having "Illegal fragments" or "Illegal segments" depending on the term used with the protocol in question. Make all the dissectors that can use "show_fragment_tree()" or "show_fragment_seq_tree()", and don't already use them, do so. svn path=/trunk/; revision=5644
2002-06-05Updated NDMP and ONC RPC services to use the new function to displayRonnie Sahlberg1-16/+52
fregment trees. svn path=/trunk/; revision=5627
2002-06-04Get rid of the "data_src" member of the "frame_data" structure; put itGuy Harris1-2/+2
in the "packet_info" structure instead, as we don't need a pointer for every single frame in the capture file, just for each frame for which we currently have an open "epan_dissect_t". svn path=/trunk/; revision=5614
2002-05-21Option to make filtering on nfs fhandles stateful.Ronnie Sahlberg1-1/+32
When this ption is enabled in Protocols/NFS displayfilters for fhandle fields such as nfs.fh.{hash|name|full_name} will find both the request and matching response packets even if the fhandle is only present in one of the packets. The option supports all NFS and related protocols which use nfs fhandles including async NLM. The option will not work with nfs packets containing multiple fhandles in one PDU, nor will it work if tcp collapses multiple segments/pdus into one larger segment. It only works for async NLM if one first enables the MSG/RES stateful matching for async NLM. svn path=/trunk/; revision=5515
2002-05-15Don't dissect the stuff after the RPC information in an RPC reply as aGuy Harris1-5/+47
protocol reply if: we got anything other than SUCCESS for MSG_ACCEPTED; we got MSG_DENIED; we got anything other than MSG_ACCEPTED or MSG_DENIED; as there isn't a protocol reply in there. Just use "-1, -1" as arguments to "tvb_new_subset()" if you want the new tvbuff to run to the end of the packet - there's no need to call "tvb_reported_length_remaining()". svn path=/trunk/; revision=5483
2002-05-11Instead of creating two handles for the RPC-over-TCP andGuy Harris1-3/+3
RPC-over-everything-else dissectors, one registered by name and one anonymous, just fetch the handles for the registered dissectors. svn path=/trunk/; revision=5445
2002-05-09Added parsing of PORTMAP GETPORT functions.Ronnie Sahlberg1-23/+35
When we see PRTOMAP GETPORT calls for UDP, make sure all further UDP packets to or from this port goes to the ONC-RPC dissector regardless of the port on the other side. We need this because if there is ONC-RPC traffic going between the ONC-RPC Program port to a port which has a normal ethereal dissector, ethereal would dissect the traffic as the protocol associated with the other port instead. svn path=/trunk/; revision=5430
2002-04-03Removed many senseless pinfo parameters in RPC dissection and the layers above.Uwe Girlich1-46/+45
svn path=/trunk/; revision=5090
2002-04-01Make some routines not used outside "packet-rpc.c" static.Guy Harris1-8/+8
svn path=/trunk/; revision=5076
2002-03-27In the protocol tree entries for lists of fragments/segments, make theGuy Harris1-3/+3
top-level item correspond to the reassembled data, and make the item for each fragment/segment correspond to the part of that reassembled data that came from that fragment/segment. svn path=/trunk/; revision=5025
2002-02-18Add support for reassembling RPC-over-TCP fragments, and do that in bothGuy Harris1-135/+604
RPC and NDMP. Show the RPC-over-TCP fragment header as a tree with bitfields below it. Add a routine to show a reported bounds error as an "Unreassembled Packet" or a "Malformed Packet" depending on whether "pinfo->fragmented" is set, and have NBNS and RPC use that. Add "ett_ndmp_file_stats" to the list of ett_ values to be initialized (it wasn't in that list, and wasn't getting initialized). When freeing up various hash tables and memory chunks in the RPC dissector, zero out the pointers to them, just to make sure we don't try to free them again. Always destroy the TCP segment key and address memory chunks in "tcp_desegment_init()", regardless of whether TCP desegmentation is enabled - we don't *allocate* them if TCP desegmentation isn't enabled, but we should free them even if it's not enabled. Also, when we free them, set the pointers to them to null, so we don't double-free them. Supply to subdissectors called from the TCP dissector the sequence number of the first byte handed to the sub dissector. svn path=/trunk/; revision=4753
2002-02-01Use -1 rather than "tvb_length_remaining(tvb, offset)" in an itemGuy Harris1-2/+2
whose length we set later. svn path=/trunk/; revision=4660
2002-01-21Include files from the "epan" directory and subdirectories thereof withGuy Harris1-3/+3
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2002-01-20Allow a length of -1 to be specified when adding FT_NONE and FT_PROTOCOLGuy Harris1-13/+11
items to the protocol tree; it's interpreted as "the rest of the data in the tvbuff". This can be used if 1) the item covers the entire packet or the remaining payload in the packet or 2) the item's length won't be known until it's dissected, and will be then set with "proto_item_set_len()" - if an exception is thrown in the dissection, it means the item ran *past* the end of the tvbuff, so saying it runs to the end of the tvbuff is reasonable. Convert a number of "proto_tree_add_XXX()" calls using "tvb_length_remaining()", values derived from the result of "tvb_length()", or 0 (in the case of items whose length is unknown) to use -1 instead (using 0 means that if an exception is thrown, selecting the item highlights nothing; using -1 means it highlights all the data for that item that's available). In some places where "tvb_length()" or "tvb_length_remaining()" was used to determine how large a packet is, use "tvb_reported_length()" or "tvb_reported_length_remaining()", instead - the first two calls indicate how much captured data was in the packet, the latter two calls indicate how large the packet actually was (and the fact that using the latter could cause BoundsError exceptions to be thrown is a feature - if such an exception is thrown, the frame really *was* short, and it should be tagged as such). Replace some "proto_tree_add_XXX()" calls with equivalent "proto_tree_add_item()" calls. Fix some indentation. svn path=/trunk/; revision=4578
2002-01-20In "dissect_rpc_opaque_data()":Guy Harris1-56/+62
get rid of some dead code; get rid of some unnecessary initializations of variables that are set in all code paths; get rid of some set-but-not-used variables; if the data runs past the end of the tvbuff, throw the appropriate exception, to stop the dissection and appropriately mark the frame, after putting in the item for the truncated data. svn path=/trunk/; revision=4576
2002-01-19When dissecting an RPC array, make the initial length of the protocolGuy Harris1-2/+2
tree item for the entire array the amount of captured data remaining in the tvbuff, rather than 0, so that if we run out of captured data and throw an exception, the length is correct. svn path=/trunk/; revision=4573
2002-01-12From Ronnie Sahlberg: file handle to file name resolution in NFS andGuy Harris1-21/+9
related protocols. svn path=/trunk/; revision=4533
2002-01-10Don't break out of a loop from inside TRY clause; set a flag and breakGuy Harris1-4/+15
after the ENDTRY. svn path=/trunk/; revision=4511
2002-01-07Catch ReportedBoundsError exceptions when dissecting an RPC-over-TCPGuy Harris1-8/+39
call/reply, and report the error but don't re-throw the exception; that way, we can continue to dissect additional RPC messages in the frame or reassembled chunk of data, even if one of them happens to be too short for what's in it. svn path=/trunk/; revision=4491
2001-12-28From Ronnie Sahlberg: add time between request and reply as a field toGuy Harris1-1/+22
ONC RPC replies. svn path=/trunk/; revision=4457
2001-12-10Move the pointer to the "column_info" structure in the "frame_data"Guy Harris1-21/+21
structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
2001-11-27Change "conversation_set_dissector()" to take a dissector handle, ratherGuy Harris1-3/+7
than a pointer to a dissector function, as an argument. This means that the conversation dissector is called through "call_dissector()", so the dissector itself doesn't have to worry about checking whether the protocol is enabled or setting "pinfo->current_proto", so get rid of the code that does that in conversation dissectors. Also, make the conversation dissectors static. Get rid of some direct calls to dissectors; replace them with calls through handles, and, again, get rid of code to check whether a protocol is enabled and set "pinfo->current_proto" where that code isn't needed. Make those dissectors static if they aren't already static. Add a routine "create_dissector_handle()" to create a dissector handle without registering it by name, if the dissector isn't used outside the module in which it's defined. svn path=/trunk/; revision=4281
2001-11-26Moved from using dissect_data() to using call_dissector()Ed Warnicke1-2/+5
svn path=/trunk/; revision=4269
2001-10-29From Ronnie Sahlberg: FT_UINT64 support, code to handle 64-bit integersGuy Harris1-13/+6
without requiring compiler support for them, and updates to the Diameter, L2TP, NFS, and NLM dissectors to use it and to the ONC RPC dissector to allow ONC RPC subdissectors to use it. svn path=/trunk/; revision=4099
2001-10-29Updates from Mike Frisch to reflect NFSv4 protocol changes.Guy Harris1-2/+2
svn path=/trunk/; revision=4098
2001-09-17Add support for desegmentation of DNS messages.Guy Harris1-2/+2
Make the default for NBSS and ONC RPC-over-TCP desegmentation "on", rather than "off"; the default for desegmentation in general is "off", so this won't change the default behavior, but it lets you turn desegmentation on by flipping only one switch (and turn it off for particular protocols if you desire). svn path=/trunk/; revision=3943
2001-09-13TCP desegmentation support, and changes to the ONC RPC and NBSSGuy Harris1-22/+148
dissectors to use it, from Ronnie Sahlberg, with additional changes to handle the case where a frame contains messages that don't run past the end followed by one that does and where a reassembled chunk has, at the end, a message that runs past the end of that chunk (because the reassembly was for an earlier message). svn path=/trunk/; revision=3923
2001-09-12Clean up the previous checkin a bit - there's no need to haveGuy Harris1-22/+6
"dissect_rpc_common()" check, every time it's about to return FALSE, whether it's being used as a heuristic dissector and, if not, call "dissect_rpc_continuation()" - we can just have the non-heuristic dissector call it and, if it returned FALSE, call "dissect_rpc_continuation()". svn path=/trunk/; revision=3922
2001-09-12When establishing or searching for a conversation for ONC RPC, use bothGuy Harris1-33/+190
source and destination addresses if the transport is TCP (we use that, for now, as a proxy for "if the transport is connection-oriented"), as the endpoint addresses should be the same for all packets. Have both a heuristic RPC dissector and a non-heuristic version, and make the non-heuristic version the dissector for the conversations we create; that version will, if the frame doesn't look like a call or reply, mark it as continuation data. svn path=/trunk/; revision=3921
2001-09-03Instead of having a single datum attached to a conversation, have a listGuy Harris1-3/+3
of protocol-id-plus-datum pairs, so that multiple protocols can attach information to the same conversation. Dissectors that attach information to a conversation should not assume that if they find a conversation it has one of its data attached to it; the conversation might've been created by another dissector. svn path=/trunk/; revision=3901
2001-09-02Handle, as best we can, the case where the authentication flavor isGuy Harris1-27/+72
GSS-API but the RPCSEC_GSS procedure and service information isn't available in the captured data. svn path=/trunk/; revision=3892
2001-09-02Don't attempt to fetch the authentication flavor from a call if it's notGuy Harris1-8/+35
available - just mark it as "authentication flavor unknown". Don't dissect the next protocol if the authentication flavor is unknown. This lets us get some more work done on short frames (although if you really want to analyze ONC RPC traffic, you should make the snapshot length large enough to capture enough of the frames). svn path=/trunk/; revision=3891
2001-08-30RPCSEC_GSS fixes, from Mike Frisch.Guy Harris1-8/+10
svn path=/trunk/; revision=3884
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-12 14:57:40 +0000