aboutsummaryrefslogtreecommitdiffstats
path: root/packet-syslog.c
AgeCommit message (Collapse)AuthorFilesLines
2002-05-30From Albert Chin: fix various non-GCC compiler warnings.Guy Harris1-2/+2
svn path=/trunk/; revision=5600
2002-05-15Make the message text an item in the protocol tree.Guy Harris1-8/+8
svn path=/trunk/; revision=5473
2002-02-02The syslog daemon parses a facility and level if the message begins withGuy Harris1-5/+6
a '<', regardless of whether it's followed by a digit; do the same. Use "tvb_bytes_exist()" rather than "tvb_length_remaining()" in the loop that scans those digits. Use "tvb_ensure_length_remaining()" to get the length of the message, so we throw an exception if we've gone past the end of the tvbuff. svn path=/trunk/; revision=4674
2002-01-24Replace a bunch of "tvb_length()" and "tvb_length_remaining()" calls inGuy Harris1-7/+5
arguments to "proto_tree_add_text()", and to "proto_tree_add_XXX()" calls that add FT_NONE or FT_PROTO items to the protocol tree, with -1. Replace some calls to "tvb_length()" or "tvb_length_remaining()" with calls to "tvb_reported_length()" and "tvb_reported_length_remaining()", as those give the actual length of the data in the packet, not just the data that happened to be captured. svn path=/trunk/; revision=4605
2002-01-21Include files from the "epan" directory and subdirectories thereof withGuy Harris1-2/+2
"epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
2001-12-10Move the pointer to the "column_info" structure in the "frame_data"Guy Harris1-8/+8
structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
2001-12-03Make "dissector_add()", "dissector_delete()", and "dissector_change()"Guy Harris1-5/+7
take a dissector handle as an argument, rather than a pointer to a dissector function and a protocol ID. Associate dissector handles with dissector table entries. svn path=/trunk/; revision=4308
2001-06-18From Joerg Mayer: explicitly fill in all members of aGuy Harris1-4/+4
"header_field_info" structure, including the ones that are later set by the routines to register fields. svn path=/trunk/; revision=3561
2001-01-25Remove more "CHECK_DISPLAY_AS_DATA()" calls and "pinfo->current_proto ="Guy Harris1-7/+6
statements. Move the setting of the Protocol column in various dissectors before anything is fetched from the packet, and also clear the Info column at that point in those and some other dissectors, so that if an exception is thrown, the columns don't reflect the previous protocol. "Tvbuffify" the Mobile IP dissector (it took old-style arguments, and then converted them into tvbuff arguments, so there wasn't much to do, other than to fix references to "fd" to refer to "pinfo->fd"). In the SCTP dissector, refer to the port type and source and destination ports through "pinfo" rather than through the global "pi", as it's a tvbuffified dissector. In the SMTP and Time Protocol dissectors, use "pinfo->match_port" rather than "TCP_PORT_SMTP" when checking whether the packet is a request or reply, just in case somebody makes a non-standard port be dissected as SMTP or Time. (Also, remove a bogus comment from the Time dissector; it was probably cut-and-pasted from the TFTP dissector.) svn path=/trunk/; revision=2938
2001-01-09Add an additional "protocol index" argument to "{old_}dissector_add()",Guy Harris1-2/+2
"{old_}heur_dissector_add()", "{old_}conv_dissector_add()", and "register_dissector()", so that an entry in those tables has associated with it the protocol index of the protocol the dissector handles (or -1, if there is no protocol index for it). This is for future use in a number of places. (Arguably, "proto_register_protocol()" should take a dissector pointer as an argument, but 1) it'd have to handle both regular and heuristic dissectors; 2) making it take either a "dissector_t" or a union of that and a "heur_dissector_t" introduces some painful header-file interdependencies so I'm punting on that for now. As with other Ethereal internal APIs, these APIs are subject to change in the future, at least until Ethereal 1.0 comes out....) svn path=/trunk/; revision=2849
2001-01-03Have "proto_register_protocol()" build a list of data structures forGuy Harris1-2/+2
protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
2000-11-19For each column, have both a buffer into which strings for that columnGuy Harris1-2/+2
can be put, and a pointer to the string for the column, which might or might not point to that buffer. Add a routine "col_set_str()", which sets the string for the column to the string passed to it as an argument; it should only be handed a static string (a string constant would be ideal). It doesn't do any copying, so it's faster than "col_add_str()". Make the routines that append to columns check whether the pointer to the string for the column points to the buffer for the column and, if not, copy the string for the column to the buffer for the column so that you can append to it (so you can use "col_set_str()" and then use "col_append_str()" or "col_append_fstr()"). Convert a bunch of "col_add_str()" calls that take a string constant as an argument to "col_set_str()" calls. Convert some "col_add_fstr()" calls that take a string constant as the only argument - i.e., the format string doesn't have any "%" slots into which to put strings for subsequent arguments to "col_set_str()" calls (those calls are just like "col_add_str()" calls). Replace an END_OF_FRAME reference in a tvbuffified dissector with a "tvb_length(tvb)" call. svn path=/trunk/; revision=2670
2000-08-13Add the "Edit:Protocols..." feature which currently only implementsLaurent Deniel1-1/+3
the following: It is now possible to enable/disable a particular protocol decoding (i.e. the protocol dissector is void or not). When a protocol is disabled, it is displayed as Data and of course, all linked sub-protocols are disabled as well. Disabling a protocol could be interesting: - in case of buggy dissectors - in case of wrong heuristics - for performance reasons - to decode the data as another protocol (TODO) Currently (if I am not wrong), all dissectors but NFS can be disabled (and dissectors that do not register protocols :-) I do not like the way the RPC sub-dissectors are disabled (in the sub-dissectors) since this could be done in the RPC dissector itself, knowing the sub-protocol hfinfo entry (this is why, I've not modified the NFS one yet). Two functions are added in proto.c : gboolean proto_is_protocol_enabled(int n); void proto_set_decoding(int n, gboolean enabled); and two MACROs which can be used in dissectors: OLD_CHECK_DISPLAY_AS_DATA(index, pd, offset, fd, tree) CHECK_DISPLAY_AS_DATA(index, tvb, pinfo, tree) See also the XXX in proto_dlg.c and proto.c around the new functions. svn path=/trunk/; revision=2267
2000-08-07Allow either old-style (pre-tvbuff) or new-style (tvbuffified)Guy Harris1-15/+1
dissectors to be registered as dissectors for particular ports, registered as heuristic dissectors, and registered as dissectors for conversations, and have routines to be used both by old-style and new-style dissectors to call registered dissectors. Have the code that calls those dissectors translate the arguments as necessary. (For conversation dissectors, replace "find_conversation_dissector()", which just returns a pointer to the dissector, with "old_try_conversation_dissector()" and "try_conversation_dissector()", which actually call the dissector, so that there's a single place at which we can do that translation. Also make "dissector_lookup()" static and, instead of calling it and, if it returns a non-null pointer, calling that dissector, just use "old_dissector_try_port()" or "dissector_try_port()", for the same reason.) This allows some dissectors that took old-style arguments and immediately translated them to new-style arguments to just take new-style arguments; make them do so. It also allows some new-style dissectors not to have to translate arguments before calling routines to look up and call dissectors; make them not do so. Get rid of checks for too-short frames in new-style dissectors - the tvbuff code does those checks for you. Give the routines to register old-style dissectors, and to call dissectors from old-style dissectors, names beginning with "old_", with the routines for new-style dissectors not having the "old_". Update the dissectors that use those routines appropriately. Rename "dissect_data()" to "old_dissect_data()", and "dissect_data_tvb()" to "dissect_data()". svn path=/trunk/; revision=2218
2000-06-18Get rid of string overrun.Gerald Combs1-6/+3
svn path=/trunk/; revision=2078
2000-06-15Convert IPX-and-friend dissectors in packet-ipx.c to useGilbert Ramirez1-4/+3
tvbuffs. In doing so, I realied that my recommendation for using tvb_new_subset(pi.compat_top_tvb, -1, -1) was incorrect, because some dissectors (ethernet!) change pi.len and pi.cap_len. So, I have to take those two variables into account instead of using -1 and -1. So, I provide a macro called tvb_create_from_top(offset), where offset is the name of your offset variable. It is a wrapper around tvb_new_subset(). I converted the lines that followed my suggestion to use tvb_create_from_top(). In proto.c I added proto_tree_add_debug_text(proto_tree*, const char*, ...) It's much like proto_tree_add_text(), except that it takes no offset or length; it's soley for temporarily putting debug text into the proto_tree while debugging a dissector. In making sure that its use is temporary, the funciton also prints the debug string to stdout to remind the programmer that the debug code needs to be removed before shipping the code. svn path=/trunk/; revision=2068
2000-06-11Add syslog support to randpkt.Gerald Combs1-45/+52
Fix problems revealed by randpkt, add OS-specific info. svn path=/trunk/; revision=2056
2000-06-11Add syslog message dissector.Gerald Combs1-0/+262
svn path=/trunk/; revision=2054