1998-09-16 02:39:15 +00:00
|
|
|
/* packet-udp.c
|
|
|
|
* Routines for UDP packet disassembly
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
1998-09-16 03:22:19 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* Ethereal - Network traffic analyzer
|
2001-04-23 17:51:37 +00:00
|
|
|
* By Gerald Combs <gerald@ethereal.com>
|
1998-09-16 02:39:15 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
2002-08-28 21:04:11 +00:00
|
|
|
* Richard Sharpe, 13-Feb-1999, added dispatch table support and
|
1999-02-15 06:36:57 +00:00
|
|
|
* support for tftp.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
2002-08-28 21:04:11 +00:00
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
|
|
|
|
1999-03-23 03:14:46 +00:00
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
2000-11-05 09:26:47 +00:00
|
|
|
#include <string.h>
|
1999-03-23 03:14:46 +00:00
|
|
|
|
|
|
|
#include <glib.h>
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/packet.h>
|
2004-08-06 19:57:49 +00:00
|
|
|
#include <epan/addr_resolv.h>
|
2001-04-23 17:51:37 +00:00
|
|
|
#include "ipproto.h"
|
2000-12-13 02:24:23 +00:00
|
|
|
#include "in_cksum.h"
|
2001-05-23 03:33:59 +00:00
|
|
|
#include "prefs.h"
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2000-04-16 22:46:25 +00:00
|
|
|
#include "packet-udp.h"
|
1999-12-09 20:43:38 +00:00
|
|
|
|
2000-04-16 22:46:25 +00:00
|
|
|
#include "packet-ip.h"
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/conversation.h>
|
2003-03-03 23:46:50 +00:00
|
|
|
#include "tap.h"
|
|
|
|
|
|
|
|
static int udp_tap = -1;
|
2000-02-15 21:06:58 +00:00
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
static int proto_udp = -1;
|
1999-11-16 11:44:20 +00:00
|
|
|
static int hf_udp_srcport = -1;
|
|
|
|
static int hf_udp_dstport = -1;
|
|
|
|
static int hf_udp_port = -1;
|
|
|
|
static int hf_udp_length = -1;
|
|
|
|
static int hf_udp_checksum = -1;
|
2001-02-28 19:33:49 +00:00
|
|
|
static int hf_udp_checksum_bad = -1;
|
1999-11-16 11:44:20 +00:00
|
|
|
|
|
|
|
static gint ett_udp = -1;
|
1999-07-22 16:41:22 +00:00
|
|
|
|
2001-05-23 03:33:59 +00:00
|
|
|
/* Place UDP summary in proto tree */
|
|
|
|
static gboolean udp_summary_in_tree = TRUE;
|
|
|
|
|
2000-04-03 09:24:12 +00:00
|
|
|
static dissector_table_t udp_dissector_table;
|
2000-07-14 12:53:00 +00:00
|
|
|
static heur_dissector_list_t heur_subdissector_list;
|
2001-11-26 04:52:51 +00:00
|
|
|
static dissector_handle_t data_handle;
|
1999-02-15 06:36:57 +00:00
|
|
|
|
2000-04-12 22:53:16 +00:00
|
|
|
/* Determine if there is a sub-dissector and call it. This has been */
|
|
|
|
/* separated into a stand alone routine to other protocol dissectors */
|
|
|
|
/* can call to it, ie. socks */
|
1999-10-02 16:58:41 +00:00
|
|
|
|
2003-07-24 21:11:20 +00:00
|
|
|
static gboolean try_heuristic_first = FALSE;
|
|
|
|
|
2000-04-17 02:39:55 +00:00
|
|
|
void
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
decode_udp_ports(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
2004-01-22 20:43:17 +00:00
|
|
|
proto_tree *tree, int uh_sport, int uh_dport, int uh_ulen)
|
Allow either old-style (pre-tvbuff) or new-style (tvbuffified)
dissectors to be registered as dissectors for particular ports,
registered as heuristic dissectors, and registered as dissectors for
conversations, and have routines to be used both by old-style and
new-style dissectors to call registered dissectors.
Have the code that calls those dissectors translate the arguments as
necessary. (For conversation dissectors, replace
"find_conversation_dissector()", which just returns a pointer to the
dissector, with "old_try_conversation_dissector()" and
"try_conversation_dissector()", which actually call the dissector, so
that there's a single place at which we can do that translation. Also
make "dissector_lookup()" static and, instead of calling it and, if it
returns a non-null pointer, calling that dissector, just use
"old_dissector_try_port()" or "dissector_try_port()", for the same
reason.)
This allows some dissectors that took old-style arguments and
immediately translated them to new-style arguments to just take
new-style arguments; make them do so. It also allows some new-style
dissectors not to have to translate arguments before calling routines to
look up and call dissectors; make them not do so.
Get rid of checks for too-short frames in new-style dissectors - the
tvbuff code does those checks for you.
Give the routines to register old-style dissectors, and to call
dissectors from old-style dissectors, names beginning with "old_", with
the routines for new-style dissectors not having the "old_". Update the
dissectors that use those routines appropriately.
Rename "dissect_data()" to "old_dissect_data()", and
"dissect_data_tvb()" to "dissect_data()".
svn path=/trunk/; revision=2218
2000-08-07 03:21:25 +00:00
|
|
|
{
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
tvbuff_t *next_tvb;
|
2002-06-08 21:54:52 +00:00
|
|
|
int low_port, high_port;
|
2004-01-22 20:43:17 +00:00
|
|
|
gint len, reported_len;
|
|
|
|
|
|
|
|
len = tvb_length_remaining(tvb, offset);
|
|
|
|
reported_len = tvb_reported_length_remaining(tvb, offset);
|
|
|
|
if (uh_ulen != -1) {
|
|
|
|
/* This is the length from the UDP header; the payload should be cut
|
|
|
|
off at that length.
|
|
|
|
XXX - what if it's *greater* than the reported length? */
|
|
|
|
if (uh_ulen < len)
|
|
|
|
len = uh_ulen;
|
|
|
|
if (uh_ulen < reported_len)
|
|
|
|
reported_len = uh_ulen;
|
|
|
|
}
|
|
|
|
next_tvb = tvb_new_subset(tvb, offset, len, reported_len);
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
|
2000-04-12 22:53:16 +00:00
|
|
|
/* determine if this packet is part of a conversation and call dissector */
|
|
|
|
/* for the conversation if available */
|
1999-07-22 16:41:22 +00:00
|
|
|
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
if (try_conversation_dissector(&pinfo->src, &pinfo->dst, PT_UDP,
|
|
|
|
uh_sport, uh_dport, next_tvb, pinfo, tree))
|
2001-01-28 21:17:29 +00:00
|
|
|
return;
|
1999-12-09 20:43:38 +00:00
|
|
|
|
2003-07-24 21:11:20 +00:00
|
|
|
if (try_heuristic_first) {
|
|
|
|
/* do lookup with the heuristic subdissector table */
|
|
|
|
if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree))
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2002-06-08 21:54:52 +00:00
|
|
|
/* Do lookups with the subdissector table.
|
|
|
|
We try the port number with the lower value first, followed by the
|
|
|
|
port number with the higher value. This means that, for packets
|
|
|
|
where a dissector is registered for *both* port numbers:
|
|
|
|
|
|
|
|
1) we pick the same dissector for traffic going in both directions;
|
|
|
|
|
|
|
|
2) we prefer the port number that's more likely to be the right
|
|
|
|
one (as that prefers well-known ports to reserved ports);
|
|
|
|
|
|
|
|
although there is, of course, no guarantee that any such strategy
|
|
|
|
will always pick the right port number.
|
|
|
|
|
|
|
|
XXX - we ignore port numbers of 0, as some dissectors use a port
|
|
|
|
number of 0 to disable the port, and as RFC 768 says that the source
|
|
|
|
port in UDP datagrams is optional and is 0 if not used. */
|
|
|
|
if (uh_sport > uh_dport) {
|
|
|
|
low_port = uh_dport;
|
|
|
|
high_port = uh_sport;
|
|
|
|
} else {
|
|
|
|
low_port = uh_sport;
|
|
|
|
high_port = uh_dport;
|
|
|
|
}
|
|
|
|
if (low_port != 0 &&
|
|
|
|
dissector_try_port(udp_dissector_table, low_port, next_tvb, pinfo, tree))
|
|
|
|
return;
|
|
|
|
if (high_port != 0 &&
|
|
|
|
dissector_try_port(udp_dissector_table, high_port, next_tvb, pinfo, tree))
|
2000-04-17 02:39:55 +00:00
|
|
|
return;
|
|
|
|
|
2003-07-24 21:11:20 +00:00
|
|
|
if (!try_heuristic_first) {
|
|
|
|
/* do lookup with the heuristic subdissector table */
|
|
|
|
if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree))
|
|
|
|
return;
|
|
|
|
}
|
2000-07-14 12:53:00 +00:00
|
|
|
|
2001-11-26 04:52:51 +00:00
|
|
|
call_dissector(data_handle,next_tvb, pinfo, tree);
|
1998-09-16 02:39:15 +00:00
|
|
|
}
|
1999-07-22 16:41:22 +00:00
|
|
|
|
2000-04-12 22:53:16 +00:00
|
|
|
|
2000-04-20 07:05:58 +00:00
|
|
|
static void
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
dissect_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
2000-04-12 22:53:16 +00:00
|
|
|
proto_tree *udp_tree;
|
|
|
|
proto_item *ti;
|
2000-12-13 02:24:23 +00:00
|
|
|
guint len;
|
|
|
|
guint reported_len;
|
|
|
|
vec_t cksum_vec[4];
|
|
|
|
guint32 phdr[2];
|
|
|
|
guint16 computed_cksum;
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
int offset = 0;
|
2003-03-03 23:46:50 +00:00
|
|
|
static e_udphdr udphstruct[4], *udph;
|
|
|
|
static int udph_count=0;
|
|
|
|
|
|
|
|
udph_count++;
|
|
|
|
if(udph_count>=4){
|
|
|
|
udph_count=0;
|
|
|
|
}
|
|
|
|
udph=&udphstruct[udph_count];
|
2003-08-23 09:09:35 +00:00
|
|
|
SET_ADDRESS(&udph->ip_src, pinfo->src.type, pinfo->src.len, pinfo->src.data);
|
|
|
|
SET_ADDRESS(&udph->ip_dst, pinfo->dst.type, pinfo->dst.len, pinfo->dst.data);
|
2000-04-12 22:53:16 +00:00
|
|
|
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_PROTOCOL))
|
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "UDP");
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO))
|
|
|
|
col_clear(pinfo->cinfo, COL_INFO);
|
2000-04-12 22:53:16 +00:00
|
|
|
|
2003-03-03 23:46:50 +00:00
|
|
|
udph->uh_sport=tvb_get_ntohs(tvb, offset);
|
|
|
|
udph->uh_dport=tvb_get_ntohs(tvb, offset+2);
|
|
|
|
udph->uh_ulen=tvb_get_ntohs(tvb, offset+4);
|
|
|
|
udph->uh_sum=tvb_get_ntohs(tvb, offset+6);
|
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_INFO))
|
|
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "Source port: %s Destination port: %s",
|
2003-03-03 23:46:50 +00:00
|
|
|
get_udp_port(udph->uh_sport), get_udp_port(udph->uh_dport));
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2000-04-12 22:53:16 +00:00
|
|
|
if (tree) {
|
2001-05-23 03:33:59 +00:00
|
|
|
if (udp_summary_in_tree) {
|
|
|
|
ti = proto_tree_add_protocol_format(tree, proto_udp, tvb, offset, 8,
|
|
|
|
"User Datagram Protocol, Src Port: %s (%u), Dst Port: %s (%u)",
|
2003-03-03 23:46:50 +00:00
|
|
|
get_udp_port(udph->uh_sport), udph->uh_sport, get_udp_port(udph->uh_dport), udph->uh_dport);
|
2001-05-23 03:33:59 +00:00
|
|
|
} else {
|
|
|
|
ti = proto_tree_add_item(tree, proto_udp, tvb, offset, 8, FALSE);
|
|
|
|
}
|
2000-04-12 22:53:16 +00:00
|
|
|
udp_tree = proto_item_add_subtree(ti, ett_udp);
|
|
|
|
|
2003-03-03 23:46:50 +00:00
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_srcport, tvb, offset, 2, udph->uh_sport,
|
|
|
|
"Source port: %s (%u)", get_udp_port(udph->uh_sport), udph->uh_sport);
|
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_dstport, tvb, offset + 2, 2, udph->uh_dport,
|
|
|
|
"Destination port: %s (%u)", get_udp_port(udph->uh_dport), udph->uh_dport);
|
2000-04-12 22:53:16 +00:00
|
|
|
|
2003-03-03 23:46:50 +00:00
|
|
|
proto_tree_add_uint_hidden(udp_tree, hf_udp_port, tvb, offset, 2, udph->uh_sport);
|
|
|
|
proto_tree_add_uint_hidden(udp_tree, hf_udp_port, tvb, offset+2, 2, udph->uh_dport);
|
2000-04-12 22:53:16 +00:00
|
|
|
|
2004-01-22 20:43:17 +00:00
|
|
|
if (udph->uh_ulen < 8) {
|
|
|
|
/* Bogus length - it includes the header, so it must be >= 8. */
|
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_length, tvb, offset + 4, 2,
|
|
|
|
udph->uh_ulen, "Length: %u (bogus, must be >= 8)", udph->uh_ulen);
|
|
|
|
return;
|
|
|
|
}
|
2003-03-03 23:46:50 +00:00
|
|
|
proto_tree_add_uint(udp_tree, hf_udp_length, tvb, offset + 4, 2, udph->uh_ulen);
|
2000-12-13 02:24:23 +00:00
|
|
|
reported_len = tvb_reported_length(tvb);
|
|
|
|
len = tvb_length(tvb);
|
2003-03-03 23:46:50 +00:00
|
|
|
if (udph->uh_sum == 0) {
|
2000-12-13 02:24:23 +00:00
|
|
|
/* No checksum supplied in the packet. */
|
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_checksum, tvb,
|
2003-03-03 23:46:50 +00:00
|
|
|
offset + 6, 2, udph->uh_sum, "Checksum: 0x%04x (none)", udph->uh_sum);
|
2004-01-22 20:43:17 +00:00
|
|
|
} else if (!pinfo->fragmented && len >= reported_len &&
|
|
|
|
len >= udph->uh_ulen && reported_len >= udph->uh_ulen) {
|
2000-12-13 02:24:23 +00:00
|
|
|
/* The packet isn't part of a fragmented datagram and isn't
|
|
|
|
truncated, so we can checksum it.
|
|
|
|
XXX - make a bigger scatter-gather list once we do fragment
|
|
|
|
reassembly? */
|
|
|
|
|
|
|
|
/* Set up the fields of the pseudo-header. */
|
|
|
|
cksum_vec[0].ptr = pinfo->src.data;
|
|
|
|
cksum_vec[0].len = pinfo->src.len;
|
|
|
|
cksum_vec[1].ptr = pinfo->dst.data;
|
|
|
|
cksum_vec[1].len = pinfo->dst.len;
|
|
|
|
cksum_vec[2].ptr = (const guint8 *)&phdr;
|
|
|
|
switch (pinfo->src.type) {
|
|
|
|
|
|
|
|
case AT_IPv4:
|
2004-01-22 20:43:17 +00:00
|
|
|
phdr[0] = g_htonl((IP_PROTO_UDP<<16) + udph->uh_ulen);
|
2000-12-13 02:24:23 +00:00
|
|
|
cksum_vec[2].len = 4;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case AT_IPv6:
|
2004-01-22 20:43:17 +00:00
|
|
|
phdr[0] = g_htonl(udph->uh_ulen);
|
2002-08-02 23:36:07 +00:00
|
|
|
phdr[1] = g_htonl(IP_PROTO_UDP);
|
2000-12-13 02:24:23 +00:00
|
|
|
cksum_vec[2].len = 8;
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
/* TCP runs only atop IPv4 and IPv6.... */
|
|
|
|
g_assert_not_reached();
|
|
|
|
break;
|
|
|
|
}
|
2004-01-22 20:43:17 +00:00
|
|
|
cksum_vec[3].ptr = tvb_get_ptr(tvb, offset, udph->uh_ulen);
|
|
|
|
cksum_vec[3].len = udph->uh_ulen;
|
2000-12-13 02:24:23 +00:00
|
|
|
computed_cksum = in_cksum(&cksum_vec[0], 4);
|
|
|
|
if (computed_cksum == 0) {
|
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_checksum, tvb,
|
2003-03-03 23:46:50 +00:00
|
|
|
offset + 6, 2, udph->uh_sum, "Checksum: 0x%04x (correct)", udph->uh_sum);
|
2000-12-13 02:24:23 +00:00
|
|
|
} else {
|
2001-03-28 21:33:31 +00:00
|
|
|
proto_tree_add_boolean_hidden(udp_tree, hf_udp_checksum_bad, tvb,
|
2001-02-28 19:33:49 +00:00
|
|
|
offset + 6, 2, TRUE);
|
2000-12-13 02:24:23 +00:00
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_checksum, tvb,
|
2003-03-03 23:46:50 +00:00
|
|
|
offset + 6, 2, udph->uh_sum,
|
|
|
|
"Checksum: 0x%04x (incorrect, should be 0x%04x)", udph->uh_sum,
|
|
|
|
in_cksum_shouldbe(udph->uh_sum, computed_cksum));
|
2000-12-13 02:24:23 +00:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_checksum, tvb,
|
2003-03-03 23:46:50 +00:00
|
|
|
offset + 6, 2, udph->uh_sum, "Checksum: 0x%04x", udph->uh_sum);
|
2000-12-13 02:24:23 +00:00
|
|
|
}
|
2000-04-12 22:53:16 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Skip over header */
|
|
|
|
offset += 8;
|
|
|
|
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
pinfo->ptype = PT_UDP;
|
2003-03-03 23:46:50 +00:00
|
|
|
pinfo->srcport = udph->uh_sport;
|
|
|
|
pinfo->destport = udph->uh_dport;
|
2000-04-12 22:53:16 +00:00
|
|
|
|
2003-09-03 09:52:07 +00:00
|
|
|
tap_queue_packet(udp_tap, pinfo, udph);
|
2003-06-04 08:43:30 +00:00
|
|
|
/*
|
|
|
|
* Call sub-dissectors.
|
|
|
|
*
|
|
|
|
* XXX - should we do this if this is included in an error packet?
|
|
|
|
* It might be nice to see the details of the packet that caused the
|
|
|
|
* ICMP error, but it might not be nice to have the dissector update
|
|
|
|
* state based on it.
|
|
|
|
* Also, we probably don't want to run UDP taps on those packets.
|
|
|
|
*
|
|
|
|
* We definitely don't want to do it for an error packet if there's
|
|
|
|
* nothing left in the packet.
|
|
|
|
*/
|
|
|
|
if (!pinfo->in_error_pkt || tvb_length_remaining(tvb, offset) > 0)
|
2004-01-22 20:43:17 +00:00
|
|
|
decode_udp_ports(tvb, offset, pinfo, tree, udph->uh_sport, udph->uh_dport,
|
|
|
|
udph->uh_ulen);
|
2000-04-12 22:53:16 +00:00
|
|
|
}
|
|
|
|
|
1999-07-22 16:41:22 +00:00
|
|
|
void
|
|
|
|
proto_register_udp(void)
|
|
|
|
{
|
2001-05-23 03:33:59 +00:00
|
|
|
module_t *udp_module;
|
1999-07-22 16:41:22 +00:00
|
|
|
static hf_register_info hf[] = {
|
|
|
|
{ &hf_udp_srcport,
|
1999-10-12 06:21:15 +00:00
|
|
|
{ "Source Port", "udp.srcport", FT_UINT16, BASE_DEC, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
1999-07-22 16:41:22 +00:00
|
|
|
|
|
|
|
{ &hf_udp_dstport,
|
1999-10-12 06:21:15 +00:00
|
|
|
{ "Destination Port", "udp.dstport", FT_UINT16, BASE_DEC, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
1999-07-22 16:41:22 +00:00
|
|
|
|
|
|
|
{ &hf_udp_port,
|
1999-10-12 06:21:15 +00:00
|
|
|
{ "Source or Destination Port", "udp.port", FT_UINT16, BASE_DEC, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
1999-07-22 16:41:22 +00:00
|
|
|
|
|
|
|
{ &hf_udp_length,
|
1999-10-12 06:21:15 +00:00
|
|
|
{ "Length", "udp.length", FT_UINT16, BASE_DEC, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
1999-07-22 16:41:22 +00:00
|
|
|
|
2001-02-28 19:33:49 +00:00
|
|
|
{ &hf_udp_checksum_bad,
|
|
|
|
{ "Bad Checksum", "udp.checksum_bad", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2001-02-28 19:33:49 +00:00
|
|
|
|
1999-07-22 16:41:22 +00:00
|
|
|
{ &hf_udp_checksum,
|
1999-10-12 06:21:15 +00:00
|
|
|
{ "Checksum", "udp.checksum", FT_UINT16, BASE_HEX, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
1999-07-22 16:41:22 +00:00
|
|
|
};
|
1999-11-16 11:44:20 +00:00
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_udp,
|
|
|
|
};
|
1999-07-22 16:41:22 +00:00
|
|
|
|
2001-01-03 06:56:03 +00:00
|
|
|
proto_udp = proto_register_protocol("User Datagram Protocol",
|
|
|
|
"UDP", "udp");
|
1999-07-22 16:41:22 +00:00
|
|
|
proto_register_field_array(proto_udp, hf, array_length(hf));
|
1999-11-16 11:44:20 +00:00
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
2000-04-03 09:41:31 +00:00
|
|
|
|
|
|
|
/* subdissector code */
|
2001-12-08 06:41:48 +00:00
|
|
|
udp_dissector_table = register_dissector_table("udp.port",
|
|
|
|
"UDP port", FT_UINT16, BASE_DEC);
|
2000-07-14 12:53:00 +00:00
|
|
|
register_heur_dissector_list("udp", &heur_subdissector_list);
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2001-05-23 03:33:59 +00:00
|
|
|
/* Register configuration preferences */
|
|
|
|
udp_module = prefs_register_protocol(proto_udp, NULL);
|
2003-01-28 23:56:40 +00:00
|
|
|
prefs_register_bool_preference(udp_module, "summary_in_tree",
|
2003-07-24 21:11:20 +00:00
|
|
|
"Show UDP summary in protocol tree",
|
|
|
|
"Whether the UDP summary line should be shown in the protocol tree",
|
|
|
|
&udp_summary_in_tree);
|
|
|
|
prefs_register_bool_preference(udp_module, "try_heuristic_first",
|
|
|
|
"Try heuristic sub-dissectors first",
|
|
|
|
"Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port",
|
|
|
|
&try_heuristic_first);
|
1999-07-22 16:41:22 +00:00
|
|
|
}
|
2000-04-16 22:46:25 +00:00
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_udp(void)
|
|
|
|
{
|
2001-12-03 04:00:26 +00:00
|
|
|
dissector_handle_t udp_handle;
|
|
|
|
|
|
|
|
udp_handle = create_dissector_handle(dissect_udp, proto_udp);
|
|
|
|
dissector_add("ip.proto", IP_PROTO_UDP, udp_handle);
|
2001-11-26 04:52:51 +00:00
|
|
|
data_handle = find_dissector("data");
|
2003-03-03 23:46:50 +00:00
|
|
|
udp_tap = register_tap("udp");
|
2000-04-16 22:46:25 +00:00
|
|
|
}
|