a patch that adds support for
dissecting packets captured on ML-, LS- and AS PICs
using Multi-link PPP encapsulation,
running JUNOS 7.3 or higher;
additional there i did some clean-up in the
juniper dissector that makes future addition
of JUNIPER_DLTs easier;
svn path=/trunk/; revision=15081
The FC D_id and S_id fields in teh FC frame encapsulated inside iFCP unfortunately has "undefined" (semi-random) values so we can not use th S_/D_id matching in FC when transported atop iFCP.
Change iFCP to call a new fc_ifcp handler instead of the fc handler.
Add a new handler to FC specific to iFCP.
Only set the pinfo->src/dst fields to the S_id/D_id fields IFF the FC frame was NOT transported ontop of iFCP.
Othervise we just use the TCP/IP values that are already stored there.
Some Hosts use RelativeOffset fields for FC. We can only dissect the RelOff field with offset 0.
Change FC to only call the FCP subdissector if offset==0 when relative offsets are used.
Some hosts when using relative offsets do not specify a proper value for rxid in teh commands instead htey lkeave it as 0xffff
Change the FCP conversation matching to ignore RXID when searching for a conversation.
svn path=/trunk/; revision=15076
- bug fixes to the dissectors for the GENERALIZED_UNI and
LABEL objects
- improved dissector of flag field for the ERROR object
- improved LABEL_SET object dissector
- support for the new (proposed) ASSOCIATION object (see
draft-ietf-ccamp-gmpls-recovery-e2e-signaling).
Moveover find also attached a patch to OSPF that fixes a line
of source code lost in the TNA TLV (the code compiled anyway).
svn path=/trunk/; revision=15066
FD_NOT_MALLOCED set, has to be copied - all FD_NOT_MALLOCED means is
that the fragment's data is part of the old reassembled data, rather
than a malloced chunk of its own (this happens if, after reassembly, the
dissector says more reassembly is necessary, as can happen, for example,
in the case of HTTP and other protocols where reassembly continues until
a terminator is seen). Not copying the data means that the reassembled
data is, in part, whatever random junk happens to be in the
newly-allocated buffer.
Back out the change not to copy the data, but add some sanity checks, in
the hopes of preventing the crash that caused the change not to copy the
data to be added, and in the hopes of discovering the ultimate source of
that crash and fixing it.
svn path=/trunk/; revision=15057
Call "dissect_attribute_value_pairs()" regardless of whether we're
building a protocol tree, so the EAP subdissector is always called.
"dissect_attribute_value_pairs()" is only called when the length of AVPs
in the packet is non-zero; don't bother checking for a zero length.
Don't put two items in for each AVP - one is sufficient.
Add some more length checks when processing AVPs. Don't require AVPs to
be at least 3 bytes long - they might have just a type and length; let
an exception be thrown if that's a problem.
Don't require that the entire AVP be available in the tvbuff before
processing it; let an exception be thrown as we're processing the AVP if
we don't have all the data, so the stuff before the end is processed.
Give the tvbuff for the AVP data a length that reflects the length of
data left in the tvbuff, so that the appropriate exception is thrown if
the packet was cut short by a snapshot length.
Don't have a fixed-length buffer for reassembled EAP messages; grow it
as necessary.
Don't special-case the initial part of the processing of EAP messages;
put in the standard length item, as well as, for fragments, an item for
the fragment data.
Check for non-consecutive EAP-Message attributes.
Set the columns non-writable while dissecting the EAP message, so
Protocol and Info reflect the RADIUS packet.
Doing the reassembly by gluing together all the consecutive EAP-Message
attributes means we don't need help from the EAP dissector, returning
the total length of the EAP message. Get rid of the no-longer-needed
eap_fragment dissector; just call the regular EAP dissector.
svn path=/trunk/; revision=15046
(presumably-)harmless-but-otherwise-unremovable const-to-nonconst
warnings.
In the TACACS dissector, clean up the variables used in option parsing
to avoid some const-to-nonconst warnings.
Clean up some white space.
svn path=/trunk/; revision=15043
Use correct offsets to decode bssid in all cases:
Depending on the packet type the header contains
up to 4 addresses but may contain less. The position/
definition of the bssid changes as a result of this.
svn path=/trunk/; revision=15038
- use ep_alloc for reassemling eap fragments instead of a static buffer
- use ep_strdup_printf() instead of a static buffe to return the cosine's VP/VC AVP label
- add few TODO comments
svn path=/trunk/; revision=15028
syntax-tree.c to syntax-tree.h.
This fixes some warning of type
sttype-integer.c:33: warning: no previous declaration for
'sttype_register_integer'
svn path=/trunk/; revision=15011
Collapsed the control and data protocols into dissector to cope with commands and data over the same TCP connection. I've also prettified things a bit and now decoded a few more command parameters.
svn path=/trunk/; revision=15001
This offesr memory allocation with a packet scope making memory leaks less likely and memory management faster.
Add initialization calls for both tethereal and ethereal.
Convert the ip_to_str() function to use this and avoid doing the silly rotating buffers thing it previously did.
We also need an equivalent set of functions for allocation with capture file scope (free when next capture is loaded) but i dont know where to put the free_all call.
svn path=/trunk/; revision=14984
- Make sure every function that has an "add_string" argument, make sure
it isn't NULL before we write to it.
a null "add_string".
- Use "_U_" instead of "add_string = add_string" to squelch compiler
warnings.
- Fix other compiler warnings.
In packet-uma.c, pass NULL instead of "" for the add_string argument to
de_mid(). Fixes bug 287.
svn path=/trunk/; revision=14971
as FT_INT32 shows a negative number if appropriate.
Is there a better way to solve this?
Does this problem occur in other places too?
svn path=/trunk/; revision=14970
default, but the Cisco Redundant Link Management protocol can also use
that port; RLM packets are 8 bytes long, so we use this to distinguish
between them.
svn path=/trunk/; revision=14950
read the RADIUS directory.
The error string from "radius_load_dictionary()" is g_malloced; free it,
and g_strdup the "Could not find the radius directory" error, so we
don't have to worry about constant vs. g_malloced strings.
svn path=/trunk/; revision=14937
(the values are const because nobody's supposed to modify them once
they've been allocated, but they *can* be freed - by us - when we're
done with them).
svn path=/trunk/; revision=14936
Anders Broman