From 3cb302f05b0b8e16b97d4ada5c3027641d9b4a3c Mon Sep 17 00:00:00 2001 From: Nardi Ivan Date: Mon, 28 Jun 2021 13:58:36 +0200 Subject: HTTP2, QUIC: fix "Follow Stream" "Follow Stream" functionality assumes that all data in a single packet belongs to the same stream. That is not true for HTTP2 and QUIC, where we end up having data from unrelated streams. Filter out the unwanted data directly in the protocol dissector code with a custom `tap_handler` (as TCP already does). Close #16093 --- epan/follow.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'epan/follow.h') diff --git a/epan/follow.h b/epan/follow.h index 2ac4d66e3a..94111465a0 100644 --- a/epan/follow.h +++ b/epan/follow.h @@ -78,6 +78,8 @@ struct _follow_info; typedef gboolean (*follow_print_line_func)(char *, size_t, gboolean, void *); typedef frs_return_t (*follow_read_stream_func)(struct _follow_info *follow_info, follow_print_line_func follow_print, void *arg); +#define SUBSTREAM_UNUSED G_GUINT64_CONSTANT(0xFFFFFFFFFFFFFFFF) + typedef struct { gboolean is_server; guint32 packet_num; @@ -98,6 +100,7 @@ typedef struct _follow_info { address client_ip; address server_ip; void* gui_data; + guint64 substream_id; /**< Sub-stream; used only by HTTP2 and QUIC */ } follow_info_t; struct register_follow; -- cgit v1.2.3