which can be used to call the found heuristic dissector on the next pass.
Introduce call_heur_dissector_direct() to be used to call a heuristic
dissector which accepted the frame on the first pass.
Change-Id: I524edd717b7d92b510bd60acfeea686d5f2b4582
Reviewed-on: https://code.wireshark.org/review/1697
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Always call $(top_srcdir)/tools/checkAPIs.pl with -sourcedir=$(srcdir)
from Makefile.am to allow out-of-source 'make checkapi'.
Change-Id: I60d7e0079984a8ededdacf4517a0738486fa7973
Reviewed-on: https://code.wireshark.org/review/1294
Reviewed-by: Anders Broman <a.broman58@gmail.com>
(Using sed : sed -i '/^\# \$Id\$/,+1 d') (start with dash)
Change-Id: Ia4b5a6c2302f6a531f6a86c1ec3a2f8205c8c2dd
Reviewed-on: https://code.wireshark.org/review/881
Reviewed-by: Anders Broman <a.broman58@gmail.com>
(Using sed : sed -i '/^\$Id\$/,+1 d') (No space or star before $Id$)
Change-Id: I0801bd7cf234d32487008a8b6dcee64875b07688
Reviewed-on: https://code.wireshark.org/review/876
Reviewed-by: Evan Huus <eapache@gmail.com>
Added DCP decoding of reset to factory
removed unused value_strings
corrected decoding of PDSubFrameBlock
most of the length display added a dec_hex display
Signed-off-by: Widok <kellingwido@aol.com>
Change-Id: I17b59b45eff37b65047a7a3e5e275f01a37ee616
Reviewed-on: https://code.wireshark.org/review/517
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
(Using sed : sed -i '/^ \* \$Id\$/,+1 d')
Fix manually some typo (in export_object_dicom.c and crc16-plain.c)
Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8
Reviewed-on: https://code.wireshark.org/review/497
Reviewed-by: Anders Broman <a.broman58@gmail.com>
I'm not sold on the name or module the proto_data functions live in, but I believe the function arguments are solid and gives us the most flexibility for the future. And search/replace of a function name is easy enough to do.
The big driving force for getting this in sooner rather than later is the saved memory on ethernet packets (and IP packets soon), that used to have file_scope() proto data when all it needed was packet_scope() data (technically packet_info->pool scoped), strictly for Decode As.
All dissectors that use p_add_proto_data() only for Decode As functionality have been converted to using packet_scope(). All other dissectors were converted to using file_scope() which was the original scope for "proto" data.
svn path=/trunk/; revision=53520
All "generated" source was manually modified (with the power of search/replace), but I believe the "source input" files have been adjusted (checked into revs 53098 and 53099) to reflect the necessary changes (with possible whitespace formatting differences).
The Microsoft compiler doesn't flag "unused function parameters", so I apologize in advance if I may have missed a few. The "dcerpc_info* di" parameter is used in almost every function.
svn path=/trunk/; revision=53100
- when the text parameter is constant col_add_str() and col_set_str() are equivalent but col_set_str() is faster.
- same for replace col_append_fstr and col_append_str
- remove col_clear() when it's redundant:
+ before a col_set/col_add if the dissector can't throw an exception.
- replace col_append() after a col_clear() with faster col_add... or col_set
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9344
svn path=/trunk/; revision=52948
NOTE: Some of the expert group values may need to be checked, PI_UNDECODED doesn't always seem like the right choice. I thought PI_PROTOCOL should be used more.
This concludes the conversion expert_add_info_format for all dissectors (where the function isn't commented or #defined out). Onto the "internal" (epan/lua) uses of the call.
svn path=/trunk/; revision=51841
fragment or reassembled data, not a pointer to the data itself; instead
of having to construct a tvbuffs for the reassembled data, we can now
just use the existing tvbuff.
Spell out "fragment" and "fragmentation" in comments while we're at it.
svn path=/trunk/; revision=50584
my assumption is that this was a typo
check should be for u8BlockVersionLow>2
there's code to handle u8BlockVersionLow 0, 1 and 2
svn path=/trunk/; revision=48805
be done on flows from one address to another; reassembly for protocols
running atop TCP should be done on flows from one TCP endpoint to
another.
We do this by:
adding "reassembly table" as a data structure;
associating hash tables for both in-progress reassemblies and
completed reassemblies with that data structure (currently, not
all reassemblies use the latter; they might keep completed
reassemblies in the first table);
having functions to create and destroy keys in that table;
offering standard routines for doing address-based and
address-and-port-based flow processing, so that dissectors not
needing their own specialized flow processing can just use them.
This fixes some mis-reassemblies of NIS YPSERV YPALL responses (where
the second YPALL response is processed as if it were a continuation of
a previous response between different endpoints, even though said
response is already reassembled), and also allows the DCE RPC-specific
stuff to be moved out of epan/reassembly.c into the DCE RPC dissector.
svn path=/trunk/; revision=48491
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of
sizeof.
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of
strtol() and strtoul().
Change some data types to avoid those implicit conversion warnings.
When assigning a constant to a float, make sure the constant isn't a
double, by appending "f" to the constant.
Constify a bunch of variables, parameters, and return values to
eliminate warnings due to strings being given const qualifiers. Cast
away those warnings in some cases where an API we don't control forces
us to do so.
Enable a bunch of additional warnings by default. Note why at least
some of the other warnings aren't enabled.
randpkt.c and text2pcap.c are used to build programs, so they don't need
to be in EXTRA_DIST.
If the user specifies --enable-warnings-as-errors, add -Werror *even if
the user specified --enable-extra-gcc-flags; assume they know what
they're doing and are willing to have the compile fail due to the extra
GCC warnings being treated as errors.
svn path=/trunk/; revision=46748
- Don't call expert...() under 'if (tree)';
- Make some functions static;
- Localize some variables; remove some uneeded initializers;
- Reformat some hf[] entries;
- Do whitespace fixes (including "4 space tabs").
svn path=/trunk/; revision=46523
(with a few minor fixes by me).
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8002
major change:
reassembling of PNIO fragments (only works if OpenSafty dissector is disabled)
minor changes:
improved handling of DFP Frames
added / updated
MRP Block decoding
ARServerBlock
ARVendorBlock
PDInterfaceDataReal
PDInterfaceAdjust
PDPortStatistic
SubdirFrameData corrected display and subblocks added
PDIRGlobalData complete dissection
decoding of FrameDataProperties and ARTypes updated to conform the STD
removed now usuported RTC2 ranges
svn path=/trunk/; revision=46522
Also:
- remove some uneeded variable initializers;
- reformat some long lines;
- do some whitespace and formatting changes to use a consistent style.
svn path=/trunk/; revision=46272
looks like the worong variables may be used in the for loops.
../../../plugins/profinet/packet-dcerpc-pn-io.c: In function 'dissect_PDInterfaceMrpDataAdjust_block':
../../../plugins/profinet/packet-dcerpc-pn-io.c:4420:12: warning: variable 'u8MrpInstance' set but not used [-Wunused-but-set-variable]
../../../plugins/profinet/packet-dcerpc-pn-io.c: In function 'dissect_PDInterfaceMrpDataReal_block':
../../../plugins/profinet/packet-dcerpc-pn-io.c:4542:5: error: suggest parentheses around assignment used as truth value [-Werror=parentheses]
../../../plugins/profinet/packet-dcerpc-pn-io.c:4491:12: warning: variable 'u8MrpInstance' set but not used [-Wunused-but-set-variable]
../../../plugins/profinet/packet-dcerpc-pn-io.c: In function 'dissect_PDInterfaceMrpDataCheck_block':
../../../plugins/profinet/packet-dcerpc-pn-io.c:4570:12: warning: variable 'u8MrpInstance' set but not used [-Wunused-but-set-variable]
../../../plugins/profinet/packet-dcerpc-pn-io.c: In function 'dissect_MrpInstanceDataCheck_block':
../../../plugins/profinet/packet-dcerpc-pn-io.c:5426:160: error: unused parameter 'u16BodyLength' [-Werror=unused-parameter]
../../../plugins/profinet/packet-dcerpc-pn-io.c: In function 'dissect_ARBlockReq_block':
../../../plugins/profinet/packet-dcerpc-pn-io.c:6873:9: error: format '%x' expects a matching 'unsigned int' argument [-Werror=format]
../../../plugins/profinet/packet-dcerpc-pn-io.c:6811:13: warning: variable 'u16ARDevAccess' set but not used [-Wunused-but-set-variable]
../../../plugins/profinet/packet-dcerpc-pn-io.c: At top level:
../../../plugins/profinet/packet-dcerpc-pn-io.c:7628:1: error: 'dissect_IRTFrameBlock_block' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
svn path=/trunk/; revision=46142
Updates to conform IEC 61158.
major change:
reassembling of PNIO fragments (only works if OpenSafty dissector is disabled)
see Bug 7997
minor changes:
improved handling of DFP Frames
added / updated
MRP Block decoding
ARServerBlock
ARVendorBlock
PDInterfaceDataReal
PDInterfaceAdjust
PDPortStatistic
SubdirFrameData corrected display and subblocks added
PDIRGlobalData complete dissection
decoding of FrameDataProperties and ARTypes updated to conform the STD
removed now usuported RTC2 ranges
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8002
svn path=/trunk/; revision=46140
Add Dissector for SuboptionDeviceInstance under DevicePropertiesOption in PROFINET DCP
In PROFINET DCP dissector, current build didn't have SuboptionDeviceInstance
(0x07) under DevicePropertiesOption (0x02). This patch add the support of
SuboptionDeviceInstance
svn path=/trunk/; revision=45218
from makefiles (and thus from the buildbot).
The intention is to be able to tell when a human is running the tool so we
can provide more code-review guidance.
As a starter, enable the "too many proto_tree_add_text() calls" check when
a human is running the tool.
svn path=/trunk/; revision=41943
trunk/plugins/profinet/packet-pn-rt.c: In function ‘IsDFP_Frame’:
trunk/plugins/profinet/packet-pn-rt.c:182:9: error: ‘u8SFCycleCounter’ undeclared (first use in this function)
trunk/plugins/profinet/packet-pn-rt.c:182:9: note: each undeclared identifier is reported only once for each function it appears in
svn path=/trunk/; revision=40063
packet-dcerpc-pn-io.c:8438:17: warning: Although the value
stored to 'prm_flag2' is used in the enclosing expression, the
value is never actually read from 'prm_flag2'
OK, thanks for telling me that, technically,
prm_flag1 = prm_flag2 = 0;
can be implemented by storing the 0 into prm_flag1 directly rather than
storing 0 into prm_flag2 and copying it to prm_flag1. Yes, you can haz
cheeseburger.
I guess it would matter if we were actually depending on some
side-effect of fetching prm_flag2, but we're not. Rewrite this one to
squelch the complaint.
svn path=/trunk/; revision=39841
Specifically: Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
the encoding parameter for proto_tree_add_item() calls which directly reference
an item in hf[] which has a type of:
FT_UINT8
FT_UINT16
FT_UINT24
FT_UINT32
FT_UINT64
FT_INT8
FT_INT16
FT_INT24
FT_INT32
FT_INT64
FT_FLOAT
FT_DOUBLE
svn path=/trunk/; revision=39292
FT_NONE
FT_BYTES
FT_IPV6
FT_IPXNET
FT_OID
Note: Encoding field set to ENC_NA only if the field was previously TRUE|FALSE|1|0|ENC_LITTLE_ENDIAN|ENC_BIG_ENDIAN
svn path=/trunk/; revision=39262
We need the PDU length to find stuff at the end; use
tvb_reported_length(), *not* tvb_length(), to get it, so we're not
confused by a snapshot length. Rename it "pdu_len" to make that clear.
svn path=/trunk/; revision=39162
Get rid of the code that attempts to deal with the FCS; if the
link-layer dissector hasn't removed the FCS, either:
1) the link-layer dissector is buggy and should be fixed;
or
2) the link-layer dissector doesn't know whether there's an FCS
and you have to tell it by setting a preference (and if there
is no such preference, one needs to be added).
The code in question was causing errors when the link-layer dissector
was removing the FCS when it's known to be present, as it should do.
Get rid of 4-space tabs in favor of spaces.
svn path=/trunk/; revision=39158
representation. Use it rather than a raw 0x10.
Add a DREP_ENC_INTEGER() macro that takes a pointer to the data
representation and returns either ENC_LITTLE_ENDIAN or ENC_BIG_ENDIAN;
use it for the encoding argument to proto_tree_add_item(), rather than
just the AND of drep[0] and DREP_LITTLE_ENDIAN, as it's not a boolean
any more, and for string values we'll be supporting character encodings
as well and thus won't be able to trust that the 0x10 bit will mean
"little endian".
Use ENC_NA for some other encoding values, i.e. for FT_BYTES and the
like.
Fix a couple of places in the DCOM dissector where we were passing the
byte-order bit rather than the field value to
proto_tree_add_uint_format().
Clean up white space.
svn path=/trunk/; revision=38128
implement a named dissector for the PN/IO sub-protocol for
Profinet, as well as a heuristic dissector ("pn_io"), other protocols can
attach too.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6062
svn path=/trunk/; revision=37882
- Define macros for certain CFLAGS in config.nmake iso of having defs in each makefile;
a. -DHAVE_CONFIG_H and -D_U_="" are now part of a macro named STANDARD_CFLAGS;
b. -WX has been replaced by WARNINGS_ARE_ERRORS (defined as -WX in config.nmake)
(This allows disabling "Warnings as Errors" by just changing config.nmake)
c. CVARSDLL definitions (not usage) have been removed from the various makefiles.
XXX: It appears the usage of CVARSDLL can also be removed (not yet done) since:
-DWIN32 and -DNULL=0 do not appear to be needed (any more);
-D_MT and _D_DLL are not needed since /MP causes these definitions.
d. Define a macro WARNINGS_CFLAGS with additional specific compiler (level4) warnings to be enabled.
E.G., 4295: array is too small to include a terminating null character
- config.nmake: reformat some long lines for readability;
- plugins\Makefile.nmake: clean-deps does nothing: remove it (and usage in top-level makefile);
- dissectors/Makefile.nmake: test to enable packet-rrc.obj target needs to include MSVC2010 ...
svn path=/trunk/; revision=35747
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys. (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)
svn path=/trunk/; revision=35224
In the profinet plugin, the decoding of the MRP LinkUp and MRP LinkDown
messages is missing the MRP_SA field which garbles the decode of the rest of
the packet.
This fix adds the decoding of the MRP_SA field to the MRP LinkUp and MRP
LinkDown dissectors.
svn path=/trunk/; revision=34524
In profinet plugin, there is a dissection based on whether the read data
returned is expected to contain a single or multiple blocks. Currently, the
I&M0FilterData case assumes only a single block is returned. Profinet specifies
two optional additional blocks.
This change moves I&M0FilterData to expect multiple blocks to correct decode
the optional information.
svn path=/trunk/; revision=34523
1) don't set thei SOVERSION - run-time-loaded modules don't have
an SOVERSION;
2) build them with link mode MODULE, not SHARED, on all
platforms.
(Fixing 1) also fixes the problem with building them as MODULE on OS X.)
svn path=/trunk/; revision=34243
I try to configure Wireshark with cmake on macosx 10.6.
It fails with : set_target_properties called with incorrect number of arguments.
Attached a patch to fix this issue.
svn path=/trunk/; revision=34201
- Add checking for linker flags
- Install plugins with the name including the Wireshark version.
This will make it easier to find matching plugin versions if
files get just copied over.
svn path=/trunk/; revision=32231
AndersBroman