| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
asn1.[ch]
follow.[ch]
ptvcursor.[ch]
reassemble.[ch]
xmlstub.[ch]
fix #include statements accordingly.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@13366 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
Also move ncp222.py, x11-fields, process-x11-fields.pl,
make-reg-dotc, and make-reg-dotc.py.
Adjust #include lines in files that include packet-*.h
files.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11410 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
they have LF at the end of the line on UN*X and CR/LF on Windows;
hopefully this means that if a CR/LF version is checked in on Windows,
the CRs will be stripped so that they show up only when checked out on
Windows, not on UN*X.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11400 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
From Richard van der Hoff
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11232 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
update to reassembly of dg style dcerpc
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11227 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
the protocol tree for the fragment, regardless of whether the fragment
has any flags set or not, and, in that common code, handle fragments
with 0 bytes of data specially (at least in NDS, you can get zero-length
fragments - including the last fragment, so you can't just ignore those
fragments; the last fragment has to be added to finish off the
reassembly).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@11198 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
as this info can be derived from the presence of the FT_FRAMENUM field
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10900 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
a doubleclick will follow the link
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10897 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@10680 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
after it, treat it as the only fragment" stuff for
"fragment_add_seq_next()" as well, so we handle non-fragmented packets.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9405 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
treat it as a reassembled frame" hack *only* for 802.11, as that's the
only protocol we know of that requires it.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@9367 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
look a bit nicer. Also separate frame and payload data by a comma.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8538 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8296 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
being complete and for fragmentation being trivial (i.e., the packet in
question is both the first and last fragment). Have its callers *not*
do that check - this lets "process_reassembled_data()" put in the
"Reassembled in" item for fragments other than the last fragment.
Add a "Reassembled in" field to TDS.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8295 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
fragment.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@8117 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
multiple NetBIOS-over-TCP session service messages in a TCP segment, and
they can contain the final portions of different DCERPC calls. Don't
assume a frame number is sufficient to identify DCE RPC calls.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7777 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
fully-reassembled packets.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7615 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
null) to the "fragment_items" structure, and don't pass that value into
"process_reassembled_data()", just have it use the value in the
"fragment_items" structure passed to it.
Make "process_reassembled_data()" capable of handling reassembly done by
"fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors;
give them "reassembled_in" fields. Make "process_reassembled_data()"
handle only the case of a completed reassembly (fd_head != NULL) so that
we can use it in those dissectors without gunking the code up too much.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7513 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
all of the frames that make it up, so Ethereal can show, for all but the
final frame, the frame in which it was reassembled. (Tethereal can't,
as it's a one-pass program.)
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7511 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
into a subroutine, for use in other dissectors.
Use it in the IPv6 and CLNP dissectors.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7510 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
fragment having been added already. In protocols using the ONC
RPC-over-TCP record-marking mechanism (RPC-over-TCP and NDMP), there can
be more than one record-marking-layer fragment in a single TCP segment,
and thus can be more than one fragment in a frame being added to a given
higher-level packet.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7508 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
for reassembled frames - in Tethereal, there's only one frame_data
structure used for all frames. Instead, use the frame number itself as
the key.
Add a "fragment_add_check()" routine, for fragments where there's a
fragment offset rather than a fragment sequence number, which does the
same sort of thing as "fragment_add_seq_check()" - i.e., once reassembly
is done, it puts the reassembled fragment into a separate hash table, so
that there're only incomplete reassemblies in the fragment hash table.
That's necessary in order to handle cases where the packet ID field can
be reused.
Use that routine for IPv4 fragment reassembly - IP IDs can be reused (in
fact, RFC 791 suggests that doing so might be a feature:
It is appropriate for some higher level protocols to choose the
identifier. For example, TCP protocol modules may retransmit an
identical TCP segment, and the probability for correct reception
would be enhanced if the retransmission carried the same identifier
as the original transmission since fragments of either datagram
could be used to construct a correct TCP segment.
and RFC 1122 says that it's permitted to do so, although it also says
"we believe that retransmitting the same Identification field is not
useful":
3.2.1.5 Identification: RFC-791 Section 3.2
When sending an identical copy of an earlier datagram, a
host MAY optionally retain the same Identification field in
the copy.
DISCUSSION:
Some Internet protocol experts have maintained that
when a host sends an identical copy of an earlier
datagram, the new copy should contain the same
Identification value as the original. There are two
suggested advantages: (1) if the datagrams are
fragmented and some of the fragments are lost, the
receiver may be able to reconstruct a complete datagram
from fragments of the original and the copies; (2) a
congested gateway might use the IP Identification field
(and Fragment Offset) to discard duplicate datagrams
from the queue.
However, the observed patterns of datagram loss in the
Internet do not favor the probability of retransmitted
fragments filling reassembly gaps, while other
mechanisms (e.g., TCP repacketizing upon
retransmission) tend to prevent retransmission of an
identical datagram [IP:9]. Therefore, we believe that
retransmitting the same Identification field is not
useful. Also, a connectionless transport protocol like
UDP would require the cooperation of the application
programs to retain the same Identification value in
identical datagrams.
and, in any case, I've seen that in at least one capture, and it
confuses the current reassembly code).
Unfortunately, that means that fragments other than the last fragment
can't be tagged with the frame number in which the reassembly was done;
see the comment in packet-ip.c for a discussion of that problem.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7506 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
entry for the reassembled packet; don't look at it when checking to see
if we've already seen a fragment (its "frame" field isn't initialized,
so we shouldn't check it in any case).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7498 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
This solves a problem introduced by the recent rewrite of dcerpc-over-smb
reassembly which caused the last fragment for each dcerpc pdu to be duplicated and flagged as overlapping fragment.
This
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7478 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
This field gets set to the frame number when this pdu was first completely reassembled.
This is useful since it will allow us to do reassembly properly in say packet-ip.c
instead of printing the full pdu for every fragment and thus making NFSoverUDP rpc-rtt statistics less than useful.
A dissector using fragment_add() can tehn choose to only dissect the reassembled PDU only for the frame where it was first reassembled.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7427 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
attempt reassembly of a higher-level packet that includes the
lower-level packet, use "tvb_bytes_exist()" to check whether all the
data that's to be included in the reassembly is available, rather than
by checking whether the packet is short.
Add some checks of that sort that were missing.
Use the reported length of the packet when doing reassembly.
Make the "iphdrlen" field of a "packet_info" structure be the length of
the IP header in bytes, not in 4-byte words.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@7274 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
list of packets corresponding to a reassembled pdu
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6807 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
qualifiers as necessary to ensure that we don't have to.
"strcmp()", "strcasecmp()", and "memcmp()" don't return booleans; don't
test their results as if they did.
Use "guint8", not "guchar", for a pointer to (one or more) 8-bit bytes.
Update Michael Tuexen's e-mail address.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6726 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
sequence numbers or offsets and are thus assumed to be received in order
with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where
802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or
dropped fragments).
"show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the
"fragment_items" to which the "fit" argument points, so make that
argument a "const fragment_items *".
Make all the "fragment_items" tables "static" (as they're not used
outside the modules defining them) and "const" (as they're not
modified).
Add support for reassembly of NetBIOS fragmented requests and responses.
Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS
dissector, and make its table of dissection function pointers static.
Fix some typos in the AppleTalk and NetBIOS dissectors.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6491 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
when displaying the fragment tree for reassembly based on sequence
number, show the correct offset.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6448 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
check for bogus dfpos values before using the value.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6447 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
winapi_cleanup tool written by Patrik Stridvall for the wine
project.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@6117 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
that lets us get rid of a variable.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5689 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
column, and to return TRUE or FALSE, depending on whether there were any
reassembly errors, in a common routine.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5645 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
but for stuff reassembled with "fragment_add_seq()" or
"fragment_add_seq_check()".
Add a "fragment tag" string to the "fragment_items", so that packets
with fragmentation errors can be properly flagged as having "Illegal
fragments" or "Illegal segments" depending on the term used with the
protocol in question.
Make all the dissectors that can use "show_fragment_tree()" or
"show_fragment_seq_tree()", and don't already use them, do so.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5644 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
task of creating a fregment tree for the fragmented packets.
Having this identical code to create this tree in every dissector that does
PDU reassembly is a huge waste and duplication of code.
Updated IP, SMB and DCERPC to use the new function.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5626 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5548 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
have it return FALSE, not NULL.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5249 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5221 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
regardless of whether they're the first frame we see in a reassembly or
not - put all but the last fragment into the hash table (so subsequent
frames with the same reassembly ID don't get misdissected as
unfragmented frames), return the head of the fragment list for the first
fragment and NULL for all other fragments (so the first fragment gets
dissected as a fragmented packet), and unhash the fragment head from the
reassembly hash table when we see the last fragment.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5189 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
least some of the reassembly mechanism, so we can deal with both bogus
and real last fragment (display the bogus ones as unfragmented frames,
treat the real ones as fragments).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5186 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"frame_data" structure for the frame as the key structure, and use the
frame number in that field as the key. (We could be even cheesier and
use the frame number as the key, with casts.)
When we move an entry from the hash table of reassemblies to the hash
table of reassembled packets, free the key structure for the first hash
table. (This doesn't plug a leak, as they get freed when you
reinitialize the data structures, but it does reduce the memory needed
for them to the amount needed for in-progress reassemblies rather than
the amount needed for all reassemblies.)
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5180 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
packets, using the reassembly ID and the frame number of the final frame
as the key. There is no guarantee that reassembly IDs won't be reused,
even when talking between the same source and destination address; if,
once reassembly is complete, the "fragment_data" structure is moved to
the latter hash table, this will keep reused reassembly IDs from causing
mis-reassembly.
Add a routine "fragment_add_seq_check()", which
if a fragment has the "more fragments" flag not set but is the
first fragment of a reassembly, treats that as a non-fragmented
frame, allocating a "fragment_data" structure for the reassembly
but not attaching any fragment to it, and adding it to a
reassembled packet list;
if a packet has been reassembled, removes it from the table of
reassemblies and moves it to the table of reassembled packets;
if the frame's been seen already, looks it up in the table of
reassembled packets rather than the table of reassemblies.
Add reassembly support for fragmented 802.11 frames. Use
"fragment_add_seq_check()" to cope with the fact that some
hardware+drivers apparently hands us reassembled frames with a non-zero
fragment number and the "more fragments" bit clear (as if it puts the
802.11 header of the *last* fragment onto the reassembled data).
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5177 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"frag_number", to make it clearer that it's not a byte offset but a
sequence number.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5175 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5052 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
reassembled TCP data being able to indicate that they need still more
reassembly, so that, for example, a dissector can indicate that it needs
reassembly in order to dissect a header that says how long the PDU is
and, when that reassembly is done and it dissects the header, it can
then indicate that it needs more reassembly to get the entire PDU.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4694 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
"epan/..." pathnames, so as to avoid collisions with header files in any
of the directories in which we look (e.g., "proto.h", as some other
package has its own "proto.h" file which it installs in the top-level
include directory).
Don't add "-I" flags to search "epan", as that's no longer necessary
(and we want includes of "epan" headers to fail if the "epan/" is left
out, so that we don't re-introduce includes lacking "epan/").
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4586 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4480 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
fragments are identified by block sequence numbers and not byte offsets.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4398 f5534014-38df-0310-8fa8-9805f1628bb7
|
|
Add a few small functions to reassemble.c to cope with protocols
where the total length of defragmented PDUs are specified in the
first fragment (all previous uses of reassembly has been for
PDUs where the last fragment is signalled by a flag in the
header for the last fragment).
Add a few small functions to reassemble.c to abort-and-delete
defragmentation of PDUs and also detect IF a PDU is currently
being defragmented. (Useful for PDUs where the "unique"
identifier is rather ununique, or may be reused often enough so
it can be a problem for Ethereal.)
Change where NT Cancel presents its Cancelation-to output, and
makes the three trans secondary requests also output similar
information.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4255 f5534014-38df-0310-8fa8-9805f1628bb7
|
