Commit Graph

7610 Commits

Author SHA1 Message Date
Guy Harris 50766c96ad Lump TCPIPtrace and UCX$TRACE together and add TCPtrace to the mix.
svn path=/trunk/; revision=7700
2003-05-20 20:26:05 +00:00
Guy Harris e634bd0856 From Martin Warnes: fix to check the "XXXtrace" part of the per-packet
line, not the "RCV packet" part, so that we recognize files even if they
don't have an "RCV packet" line in the first 200 lines.

svn path=/trunk/; revision=7699
2003-05-20 20:17:03 +00:00
Ronnie Sahlberg 49b51db7f2 Do not decode the full tcp header if the reported length is less than 20
or the reported tcp header length.
This is probably caused either by a very very short capture length or by
nmap or someone playing firewall fragment games to the tcp flags field.

svn path=/trunk/; revision=7698
2003-05-20 10:14:20 +00:00
Guy Harris 552b1bbe7f Clean "dissect_rpc_opaque_data()" up a bit; for example, there's no need
to do a "proto_tree_add_string_hidden()" to add the string data to the
protocol tree, given that we explicitly add it as a non-hidden item
(regardless of whether it's string data or binary data).

svn path=/trunk/; revision=7697
2003-05-20 07:56:46 +00:00
Guy Harris e1d0bb0329 Fix even more indentation.
svn path=/trunk/; revision=7696
2003-05-20 07:38:55 +00:00
Guy Harris 5b9c797797 Fix more indentation.
svn path=/trunk/; revision=7695
2003-05-20 07:37:37 +00:00
Guy Harris 3e9ae3f138 Fix indentation.
svn path=/trunk/; revision=7694
2003-05-20 07:35:09 +00:00
Gerald Combs 42d3c64449 Timo Sirainen pointed out a few problems with string handling in the
BGP code.  Replace many strings with GStrings.

svn path=/trunk/; revision=7693
2003-05-20 03:01:21 +00:00
Guy Harris f921aee54d From Martin Warnes: support for VMS UCX$TRACE output in wiretap.
svn path=/trunk/; revision=7692
2003-05-19 20:58:18 +00:00
Guy Harris 5ed9fd0ca9 From Motonori Shindo: update to support
draft-ietf-idr-bgp-ext-communities rather than
draft-ramachandra-bgp-ext-communities, and get rid of unused
MAX_SIZE_OF_EXT_COM_NAMES #define.

svn path=/trunk/; revision=7691
2003-05-19 20:36:49 +00:00
Guy Harris 1915f6ec0c From Olivier Biot: fix incorrect tvbuff definition in the WTP PDU
concatenation situation.  Now the WSP dissector wanting to display the
entire PDU will stick to the sub-tvbuff boundaries in the data highlight
pane.

svn path=/trunk/; revision=7690
2003-05-19 20:23:29 +00:00
Ronnie Sahlberg e02354fab2 Fix a -z io,users,ip calculations bug.
stats were calculated for the wrong direction.

From Martin Visser

svn path=/trunk/; revision=7689
2003-05-19 11:16:29 +00:00
Gerald Combs 7a132e5b48 More tvb_get_nstringz0() fixes. Timo Sirainen pointed out that Bad
Things can happen if we pass a zero buffer length to tvb_get_nstringz0().
Throw an exception if this happens.

In various dissectors make sure the tvb_get_nstringz0()'s buffer length
is greater than zero.

svn path=/trunk/; revision=7688
2003-05-19 03:23:12 +00:00
Gerald Combs a53a260f3c Note that the output format list is displayed by the "-h" flag.
svn path=/trunk/; revision=7687
2003-05-17 17:05:12 +00:00
Gerald Combs 11b8e719f5 Add the list of output file format specs to Tethereal's man page.
At some point we should probably add the list automatically, like we do
the filter fields.

svn path=/trunk/; revision=7686
2003-05-17 17:02:02 +00:00
Ronnie Sahlberg 926c61b11c Update the tcp sequence analysis to understand and decode properly
the rather brilliant keep-alive packets solaris use.

Solaris does not do RFC793 keepalives at all, instead they do a quite
brilliant workalike that gies them reliable keepalives.

svn path=/trunk/; revision=7685
2003-05-16 10:35:19 +00:00
Ronnie Sahlberg be8c81fc84 Tap SMB packets before we call the dissecotrs so that even if there
is an exception (i.e. short packet) the tap listener will still
be alled.

svn path=/trunk/; revision=7684
2003-05-16 10:24:13 +00:00
Guy Harris b66de3ff98 Updates to the TODO list.
svn path=/trunk/; revision=7683
2003-05-16 01:12:55 +00:00
Guy Harris 2689d287d4 Squelch some compiler complaints.
svn path=/trunk/; revision=7682
2003-05-16 00:48:26 +00:00
Guy Harris 11a979dd4c Fix a typo.
svn path=/trunk/; revision=7681
2003-05-16 00:34:33 +00:00
Guy Harris 185a1f1286 Not all platforms have "u_int32_t"; use "guint32" instead.
svn path=/trunk/; revision=7680
2003-05-16 00:30:54 +00:00
Guy Harris 4b57d88ab4 Change address for Tony Schene, at his request.
svn path=/trunk/; revision=7679
2003-05-15 22:11:15 +00:00
Laurent Deniel 3070b797d5 Implement a ring buffer switch duration:
when the new "Rotate capture file every n second(s)" checkbox or the
-b <# of file>[:<duration>] argument are used, [t]ethereal will skip to the
next ring buffer file if the specified duration has elapsed (even if the
specified capture size is not reached). This is useful when you want to have
separate capture files per hour or day for instance.

I let the autostop filesize parameter mandatory (i.e. the "rotate capture
file after n kilobytes") but this could be no longer strictly necessary when
that new feature is used ...

Another point: it might be interesting to really truncate the file at the
switch and not the closure ... According to user comments and my own real
case tests, I might plan to enhance this point and others (still ring buffer
related) in the future.

svn path=/trunk/; revision=7678
2003-05-15 13:40:20 +00:00
Guy Harris e1647e4504 From Richard Urwin:
add support for a system-wide color filter file;

	fix a bug where "read_filters()" didn't close the file handle.

Use the "get_datafile_path()" routine he added to construct the pathname
of the Diameter directory, the global preferences file, and the manuf
file.

svn path=/trunk/; revision=7677
2003-05-15 07:44:54 +00:00
Guy Harris 86f3c38c4a From Can Erkin Acar: OpenBSD is now using tcpdump.org-assigned DLT_
value for DLT_PFLOG, and that goes along with a change to the link-layer
header for DLT_PFLOG - support both the old and new values and format.

svn path=/trunk/; revision=7676
2003-05-15 07:14:46 +00:00
Guy Harris 64840abd9f From Laurent Rabret:
fix a bug where bad IPv4 and IPv6 prefix lengths could cause a
	buffer overflow;

	check the checksum in LSP packets.

svn path=/trunk/; revision=7675
2003-05-15 06:35:02 +00:00
Guy Harris d4c805ad33 From Didier Gautheron: add the right decoding for AFP3.1 FPCatSearchExt
call.

svn path=/trunk/; revision=7674
2003-05-15 05:53:43 +00:00
Guy Harris 21ad5d8067 Fix the call that adds the local preference to the tree.
svn path=/trunk/; revision=7673
2003-05-15 05:35:42 +00:00
Guy Harris 084b87c9c2 Move the value_string of platform ID values to "packet-dcerpc-nt.c", and
declare it in "packet-dcerpc-nt.h", as it's used both by the srvsvc and
wkssvc dissectors.

svn path=/trunk/; revision=7672
2003-05-15 05:24:19 +00:00
Guy Harris 50f2f2eca9 "tvb_get_nstringz0()" now expects, as an argument, a value 1 greater
than the number of bytes to copy, as the value includes the terminating
'\0' added on.

svn path=/trunk/; revision=7671
2003-05-15 05:18:17 +00:00
Tim Potter 2ef11527a3 Move dissection of NETLOGON secure channel auth verifier into
packet-dcerpc-netlogon.c

svn path=/trunk/; revision=7670
2003-05-15 04:58:53 +00:00
Tim Potter 180e410bd4 More work on dissecting generic and standard mappings for NT access masks.
Also, it turns out that there are three types of specific access permissions
for printing - printer, print server and job specific bits.

svn path=/trunk/; revision=7669
2003-05-15 02:15:13 +00:00
Tim Potter cabe2eebf8 More work on dissecting generic and standard mappings for NT access masks.
svn path=/trunk/; revision=7668
2003-05-15 02:14:00 +00:00
Tim Potter f6e347bbc5 Dissect authentication data for netlogon secure channel bind and bind acks.
svn path=/trunk/; revision=7667
2003-05-15 02:01:39 +00:00
Tim Potter 602a62e38a Dissect authentication data for netlogon secure channel bind and bind acks.
Also, recommit a change lost in the hardware failure which was to note the
type of a DCE/RPC fragment when noting it in COL_INFO.  A fragment can be
either a first, middle, last or whole (first+last) fragment.

svn path=/trunk/; revision=7666
2003-05-15 01:59:23 +00:00
Richard Sharpe 337963a73a Re-commit stuff that was lost...
This contains an initial break-out of the verifier for secure-channel and
maybe more ...

svn path=/trunk/; revision=7665
2003-05-14 22:09:52 +00:00
Laurent Deniel ea052d7d23 A correct programming practice is to save errno and restore its value
in all signal handlers that could modify it (i.e. by calling system
calls or worst standard C library functions).

Else the following code for instance is buggy if a signal arises between
the tests:

if (system_call() == -1) {
  if (errno == Exxx) {
   ...
  } else {
   ...
  }
}

And MANY (open source or not) programs are broken that way ...

svn path=/trunk/; revision=7664
2003-05-14 10:31:15 +00:00
Guy Harris d791827a65 "tvb_get_nstringz0()" now expects its third argument to be the maximum
number of bytes to put into the string, including the trailing '\0', not
the maximum number of real characters in the string; fix the call
appropriately (and make the buffer big enough to hold a null-terminated
string with MAX_BUDDYNAME_LENGTH characters).

svn path=/trunk/; revision=7663
2003-05-11 02:40:36 +00:00
Guy Harris 09811706b5 From Graeme Hewson: fix "eth_hdr" to put the destination and source
addresses in the right order.

svn path=/trunk/; revision=7662
2003-05-11 01:12:33 +00:00
Guy Harris fa51805340 Have "dissect_ndr_cvstring()" set the length of the top-level item to
cover all the parts of the item, rather than just making it be 0.

svn path=/trunk/; revision=7661
2003-05-10 02:29:44 +00:00
Guy Harris 9f089e90d8 A quantity dissected as 6 unknown bytes in a logon reply actually
appears to be a 4-byte aligned quantity, with the other 2 bytes
presumably seen by whoever added the code to dissect those 6 bytes
being, most likely, padding to align the 4-byte quantity.

svn path=/trunk/; revision=7660
2003-05-10 02:15:04 +00:00
Guy Harris 57958693a1 Expand some comments.
Do the "tvb_ensure_bytes_exist()" check, and the check for a zero-length
bit string, in the code to process a bit string.

svn path=/trunk/; revision=7659
2003-05-10 02:00:41 +00:00
Guy Harris 01e6542ed5 Use "tvb_ensure_bytes_exist()" to cause an exception to be thrown
*before* attempting to allocate a buffer for a string, if the copy into
the buffer will thrown an exception; that prevents us from

	1) leaking memory if we can allocate the buffer (we'd throw an
	   exception before we freed the buffer);

	2) crashing if we can't allocate the buffer because the length
	   is bogus and large.

svn path=/trunk/; revision=7658
2003-05-10 01:57:53 +00:00
Tim Potter 27607d89db Dissect a ntlmv2 response if found in a samlogon request.
svn path=/trunk/; revision=7657
2003-05-09 01:46:13 +00:00
Tim Potter 737936eef4 Add a dissect_ndr_counted_byte_array_cb function which can take a callback
to call when dissecting the array data.

svn path=/trunk/; revision=7656
2003-05-09 01:43:59 +00:00
Tim Potter 2b39831b5b Move the ntlmv2 response dissection out of packet-ntlmssp.c and in to
packet-smb-common.c so it can be used elsewhere.

Dissect a ntlmv2 response in a session setup SMB if detected.

svn path=/trunk/; revision=7655
2003-05-09 01:41:28 +00:00
Guy Harris d812376fe4 Based on a patch from Jean-Baptiste Marchand, mark stub data as
encrypted if appropriate; this change adds a "show_stub_data()" to
handle that, and that routine also cleans up the stub data display a bit
in some other ways.

svn path=/trunk/; revision=7654
2003-05-08 19:26:08 +00:00
Guy Harris a4e1c98b67 From Olivier Biot: fix WTP sub-PDU size presentation in the protocol
tree (display size in decimal instead of the highlighted bytes).

svn path=/trunk/; revision=7653
2003-05-08 18:49:20 +00:00
Guy Harris cec3fc0af8 The authentication data field in "simple password" authentication is 64
bits, or 8 bytes; that means that, if it's to be interpreted as a
string, it should be extracted into an 8+1 byte buffer, leaving room for
a trailing '\0', and that means the buffer size argument to
"tvb_get_nstringz0()" should be 8+1 as well.

svn path=/trunk/; revision=7652
2003-05-08 10:16:31 +00:00
Guy Harris 580e0f8e7b From Olivier Biot:
* Add decoding of Basic authentication scheme for the Authorization
  and Proxy-Authorization headers, and create a summary line
  with proto_item_append_text().
* Update Warning header decoding: warn code mapping to warn text,
  and create a summary line with proto_item_append_text().

svn path=/trunk/; revision=7651
2003-05-08 08:36:25 +00:00