osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

epan: Allow nested dependent packets 

Save all dependent frames when there are multiple levels
of reassembly.
This commit is contained in:
Sake Blok 2022-02-27 15:35:58 +01:00 committed by Gerald Combs
parent 1d2a8bff3c
commit be915d7374
15 changed files with 35 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
epan/dissectors/packet-erf.c
View File

@ -1879,7 +1879,7 @@ static void dissect_host_anchor_id(tvbuff_t *tvb, packet_info *pinfo, proto_tree
proto_item_set_generated(pi);
/* XXX: Need to do this each time because pinfo is discarded. Filtering does not reset visited as it does not do a full redissect.
We also might not catch all frames in the first pass (e.g. comment after record). */
mark_frame_as_depended_upon(pinfo, anchored_info->frame_num);
mark_frame_as_depended_upon(pinfo->fd, anchored_info->frame_num);
}
frame = wmem_list_frame_next(frame);
}
@ -1925,12 +1925,12 @@ dissect_host_id_source_id(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g
pi = proto_tree_add_uint(hostid_tree, hf_erf_source_next, tvb, 0, 0, fnum_next);
proto_item_set_generated(pi);
/* XXX: Save the surrounding nearest periodic records when we do a filtered save so we keep native ERF metadata */
mark_frame_as_depended_upon(pinfo, fnum_next);
mark_frame_as_depended_upon(pinfo->fd, fnum_next);
}
if (fnum != G_MAXUINT32) {
pi = proto_tree_add_uint(hostid_tree, hf_erf_source_prev, tvb, 0, 0, fnum);
proto_item_set_generated(pi);
mark_frame_as_depended_upon(pinfo, fnum);
mark_frame_as_depended_upon(pinfo->fd, fnum);
}
}
}

12
epan/dissectors/packet-sctp.c
View File

@ -2912,7 +2912,7 @@ fragment_reassembly(tvbuff_t *tvb, sctp_fragment *fragment,
frag_i->frame_num, offset, offset + frag_i->len - 1, frag_i->len);
offset += frag_i->len;
mark_frame_as_depended_upon(pinfo, frag_i->frame_num);
mark_frame_as_depended_upon(pinfo->fd, frag_i->frame_num);
}
for (frag_i = msg->fragments;
@ -2924,7 +2924,7 @@ fragment_reassembly(tvbuff_t *tvb, sctp_fragment *fragment,
frag_i->frame_num, offset, offset + frag_i->len - 1, frag_i->len);
offset += frag_i->len;
mark_frame_as_depended_upon(pinfo, frag_i->frame_num);
mark_frame_as_depended_upon(pinfo->fd, frag_i->frame_num);
}
} else {
for (frag_i = find_fragment(message->begin, stream_id, stream_seq_num, u_bit);
@ -2936,7 +2936,7 @@ fragment_reassembly(tvbuff_t *tvb, sctp_fragment *fragment,
frag_i->frame_num, offset, offset + frag_i->len - 1, frag_i->len);
offset += frag_i->len;
mark_frame_as_depended_upon(pinfo, frag_i->frame_num);
mark_frame_as_depended_upon(pinfo->fd, frag_i->frame_num);
}
}
@ -3151,7 +3151,7 @@ fragment_reassembly(tvbuff_t *tvb, sctp_fragment *fragment,
frag_i->frame_num, offset, offset + frag_i->len - 1, frag_i->len);
offset += frag_i->len;
mark_frame_as_depended_upon(pinfo, frag_i->frame_num);
mark_frame_as_depended_upon(pinfo->fd, frag_i->frame_num);
}
for (frag_i = msg->fragments;
@ -3163,7 +3163,7 @@ fragment_reassembly(tvbuff_t *tvb, sctp_fragment *fragment,
frag_i->frame_num, offset, offset + frag_i->len - 1, frag_i->len);
offset += frag_i->len;
mark_frame_as_depended_upon(pinfo, frag_i->frame_num);
mark_frame_as_depended_upon(pinfo->fd, frag_i->frame_num);
}
} else {
for (frag_i = find_fragment(message->begin, stream_id, stream_seq_num, u_bit);
@ -3175,7 +3175,7 @@ fragment_reassembly(tvbuff_t *tvb, sctp_fragment *fragment,
frag_i->frame_num, offset, offset + frag_i->len - 1, frag_i->len);
offset += frag_i->len;
mark_frame_as_depended_upon(pinfo, frag_i->frame_num);
mark_frame_as_depended_upon(pinfo->fd, frag_i->frame_num);
}
}

2
epan/dissectors/packet-umts_rlc.c
View File

@ -611,7 +611,7 @@ tree_add_fragment_list(struct rlc_sdu *sdu, tvbuff_t *tvb,packet_info *pinfo, pr
sdufrag->frame_num, sdufrag->seq);
}
mark_frame_as_depended_upon(pinfo, sdufrag->frame_num);
mark_frame_as_depended_upon(pinfo->fd, sdufrag->frame_num);
offset += sdufrag->len;
sdufrag = sdufrag->next;

2
epan/epan.c
View File

@ -565,7 +565,6 @@ epan_dissect_reset(epan_dissect_t *edt)
wtap_block_unref(edt->pi.rec->block);
g_slist_free(edt->pi.proto_data);
g_slist_free(edt->pi.dependent_frames);
/* Free the data sources list. */
free_data_sources(&edt->pi);
@ -676,7 +675,6 @@ epan_dissect_cleanup(epan_dissect_t* edt)
g_slist_foreach(epan_plugins, epan_plugin_dissect_cleanup, edt);
g_slist_free(edt->pi.proto_data);
g_slist_free(edt->pi.dependent_frames);
/* Free the data sources list. */
free_data_sources(&edt->pi);

11
epan/frame_data.c
View File

@ -161,6 +161,7 @@ frame_data_init(frame_data *fdata, guint32 num, const wtap_rec *rec,
fdata->subnum = 0;
fdata->passed_dfilter = 0;
fdata->dependent_of_displayed = 0;
fdata->dependent_frames = NULL;
fdata->encoding = PACKET_CHAR_ENC_CHAR_ASCII;
fdata->visited = 0;
fdata->marked = 0;
@ -296,6 +297,11 @@ frame_data_reset(frame_data *fdata)
g_slist_free(fdata->pfd);
fdata->pfd = NULL;
}
if (fdata->dependent_frames) {
g_slist_free(fdata->dependent_frames);
fdata->dependent_frames = NULL;
}
}
void
@ -305,6 +311,11 @@ frame_data_destroy(frame_data *fdata)
g_slist_free(fdata->pfd);
fdata->pfd = NULL;
}
if (fdata->dependent_frames) {
g_slist_free(fdata->dependent_frames);
fdata->dependent_frames = NULL;
}
}
/*

1
epan/frame_data.h
View File

@ -77,6 +77,7 @@ typedef struct _frame_data {
are 32 bits. */
unsigned int passed_dfilter : 1; /**< 1 = display, 0 = no display */
unsigned int dependent_of_displayed : 1; /**< 1 if a displayed frame depends on this frame */
GSList *dependent_frames; /**< A list of frames which this one depends on */
/* Do NOT use packet_char_enc enum here: MSVC compiler does not handle an enum in a bit field properly */
unsigned int encoding : 1; /**< Character encoding (ASCII, EBCDIC...) */
unsigned int visited : 1; /**< Has this packet been visited yet? 1=Yes,0=No*/

1
epan/frame_data_sequence.c
View File

@ -321,6 +321,7 @@ find_and_mark_frame_depended_upon(gpointer data, gpointer user_data)
if (dependent_frame && frames) {
dependent_fd = frame_data_sequence_find(frames, dependent_frame);
dependent_fd->dependent_of_displayed = 1;
g_slist_foreach(dependent_fd->dependent_frames, find_and_mark_frame_depended_upon, frames);
}
}

6
epan/packet.c
View File

@ -444,11 +444,11 @@ free_data_sources(packet_info *pinfo)
}
void
mark_frame_as_depended_upon(packet_info *pinfo, guint32 frame_num)
mark_frame_as_depended_upon(frame_data *fd, guint32 frame_num)
{
/* Don't mark a frame as dependent on itself */
if (frame_num != pinfo->num) {
pinfo->dependent_frames = g_slist_prepend(pinfo->dependent_frames, GUINT_TO_POINTER(frame_num));
if (frame_num != fd->num) {
fd->dependent_frames = g_slist_prepend(fd->dependent_frames, GUINT_TO_POINTER(frame_num));
}
}

2
epan/packet.h
View File

@ -754,7 +754,7 @@ extern void free_data_sources(packet_info *pinfo);
* if the user does a File->Save-As of only the Displayed packets and the
* current frame passed the display filter.
*/
WS_DLL_PUBLIC void mark_frame_as_depended_upon(packet_info *pinfo, guint32 frame_num);
WS_DLL_PUBLIC void mark_frame_as_depended_upon(frame_data *fd, guint32 frame_num);
/* Structure passed to the frame dissector */
typedef struct frame_data_s

2
epan/packet_info.h
View File

@ -146,8 +146,6 @@ typedef struct _packet_info {
GSList* proto_data; /**< Per packet proto data */
GSList* dependent_frames; /**< A list of frames which this one depends on */
GSList* frame_end_routines;
wmem_allocator_t *pool; /**< Memory pool scoped to the pinfo struct */

2
epan/reassemble.c
View File

@ -2697,7 +2697,7 @@ show_fragment(fragment_item *fd, const int offset, const fragment_items *fit,
plurality(fd->len, "", "s"));
}
proto_item_set_generated(fei);
mark_frame_as_depended_upon(pinfo, fd->frame);
mark_frame_as_depended_upon(pinfo->fd, fd->frame);
if (fd->flags & (FD_OVERLAP|FD_OVERLAPCONFLICT
|FD_MULTIPLETAILS|FD_TOOLONGFRAGMENT) ) {
/* this fragment has some flags set, create a subtree

2
file.c
View File

@ -1228,7 +1228,7 @@ add_packet_to_packet_list(frame_data *fdata, capture_file *cf,
* (potentially not displayed) frames. Find those frames and mark them
* as depended upon.
*/
g_slist_foreach(edt->pi.dependent_frames, find_and_mark_frame_depended_upon, cf->provider.frames);
g_slist_foreach(edt->pi.fd->dependent_frames, find_and_mark_frame_depended_upon, cf->provider.frames);
}
} else
fdata->passed_dfilter = 1;

4
sharkd.c
View File

@ -306,14 +306,14 @@ process_packet(capture_file *cf, epan_dissect_t *edt,
cf->provider.prev_cap = cf->provider.prev_dis = frame_data_sequence_add(cf->provider.frames, &fdlocal);
/* If we're not doing dissection then there won't be any dependent frames.
* More importantly, edt.pi.dependent_frames won't be initialized because
* More importantly, edt.pi.fd.dependent_frames won't be initialized because
* epan hasn't been initialized.
* if we *are* doing dissection, then mark the dependent frames, but only
* if a display filter was given and it matches this packet.
*/
if (edt && cf->dfcode) {
if (dfilter_apply_edt(cf->dfcode, edt)) {
g_slist_foreach(edt->pi.dependent_frames, find_and_mark_frame_depended_upon, cf->provider.frames);
g_slist_foreach(edt->pi.fd->dependent_frames, find_and_mark_frame_depended_upon, cf->provider.frames);
}
}

4
tfshark.c
View File

@ -1047,11 +1047,11 @@ process_packet_first_pass(capture_file *cf, epan_dissect_t *edt,
cf->provider.prev_cap = cf->provider.prev_dis = frame_data_sequence_add(cf->provider.frames, &fdlocal);
/* If we're not doing dissection then there won't be any dependent frames.
* More importantly, edt.pi.dependent_frames won't be initialized because
* More importantly, edt.pi.fd.dependent_frames won't be initialized because
* epan hasn't been initialized.
*/
if (edt) {
g_slist_foreach(edt->pi.dependent_frames, find_and_mark_frame_depended_upon, cf->provider.frames);
g_slist_foreach(edt->pi.fd->dependent_frames, find_and_mark_frame_depended_upon, cf->provider.frames);
}
cf->count++;

4
tshark.c
View File

@ -3120,14 +3120,14 @@ process_packet_first_pass(capture_file *cf, epan_dissect_t *edt,
cf->provider.prev_cap = cf->provider.prev_dis = frame_data_sequence_add(cf->provider.frames, &fdlocal);
/* If we're not doing dissection then there won't be any dependent frames.
* More importantly, edt.pi.dependent_frames won't be initialized because
* More importantly, edt.pi.fd.dependent_frames won't be initialized because
* epan hasn't been initialized.
* if we *are* doing dissection, then mark the dependent frames, but only
* if a display filter was given and it matches this packet.
*/
if (edt && cf->dfcode) {
if (dfilter_apply_edt(cf->dfcode, edt)) {
g_slist_foreach(edt->pi.dependent_frames, find_and_mark_frame_depended_upon, cf->provider.frames);
g_slist_foreach(edt->pi.fd->dependent_frames, find_and_mark_frame_depended_upon, cf->provider.frames);
}
}