The heuristic dissector doesn't always work. It is convenient to have
DVB-S2 in the "decode as" menu as well.
The heuristic dissector does not dissect packets where the modeadapt
cannot be detected (CRC errors or other problems). The "decode as"
dissector, on the other hand, will attempt decoding anyway, using the
preferred mode adaptation set in preferences.
It violates the tvb_composite API to create composite TVBs if
they're not going to have at least one TVB put in them. Prevent
dissector bug failed assertions in the case of packets incorrectly
identified as DVB Baseband frames carrying TS by the heuristic
dissector.
Add the mode adaptation protocol to the tree even when it is L.1
(no actual bytes), just with no subtree in that case. This is necessary
in order to access the preferences.
The circuit API was removed and replaced with the conversation
"_by_id" API that uses a single uint32 value by commit
800b26edbe
Remove the lingering references to circuits from the stream API,
since it's just used with conversations now.
There's no reason to limit the tvb offset input parameter of this CRC8
function to a guint8, particularly now that the User Packet CRCs
later in the Base Band Frame are being checked.
Add support for Transport Streams carried over DVB Base Band Frames,
passing them to the MP2T dissector. Add an endpoint type for the ISI.
Update comments. Use standard true false strings in a couple cases.
Create a header file for MP2T, since the BBFrame dissector needs to
know about the MPEG2 TS packet size and sync byte.
DVB Baseband Frames have four possible mode adaptation formats, and
the check to distinguish them depends on only a CRC-8, so it's possible
to have ambiguity, particularly in a large capture. Add a preference to
for preferred format, defaulting to the SatLabs L.3 mode, since that's
the most common format I've seen in captures or in datasheets for
BBFrames over UDP or RTP. Also make L.3 the second highest preference
when something else is set to the default.
Fix several issues with GSE reassembly:
Use the Input Stream Identifier (ISI) to distinguish packets on
different input streams, when present.
Take into account the label, if present, when reassembling. Also
don't send partially reassembled packets to subdissectors, but show
the bytes as undecoded PDU data in the fragment if reassembly did
not complete. (All this fixes #17403.)
Also include the Total Length field when reassembling, since it is
included in the CRC32 calculation. Check the CRC32 in completed
reassemblies.
Deal with reassembly issues arising from pinfo->src, dst, etc. changing
from subdissectors (since GSE oft carries IP.)
Require that reassemblies begin with Start packets, and don't add
Start packets to in progress reassemblies but rather start a new one.
Commit 4bf4ee88f0 removed an else
statement that broke out of the BBFrame processing loop. Without
it, infinite loops might be possible if the GSE frames have bit errors
in the length field.
Change dissect_dvb_s2_bb to take a tvb_subset of the appropriate size
and offset instead of being passed in an offset and length. Rearrange the
parameters so that it has the dissector_t signature. This is a little
cleaner, and also allows in the future creating dissector handles that
call the GSE dissector directly for GSE frames not carried within a
BBFrame.
Change dissect_dvb_s2_bb to take a tvb_subset instead of being
passed in an offset. Rearrange the parameters so that it has the
dissector_t signature. This is a little cleaner, and also allows
in the future creating dissector handles that point directly to
baseband frames (if we know we have L.1/ out of band mode adaptation.)
For Ethertype, use etype_vals (don't know how likely types not named as
examples in specs are likely to be seen).
Fixes warnings from previous range_string that tried to cover both types, but
where "not implemented" catch-all ranges preceded and hid individual types.
** (process:24396): WARNING **: 21:24:48.760: value_range_string error: Protocol (dvb-s2_gse.proto) hidden by earlier entry (prev="not implemented": 0 0x0 -> 255 0xff) (this="NCR": 129 0x81 -> 129 0x81)
** (process:24396): WARNING **: 21:24:48.760: value_range_string error: Protocol (dvb-s2_gse.proto) hidden by earlier entry (prev="not implemented": 0 0x0 -> 255 0xff) (this="Signaling Table": 130 0x82 -> 130 0x82)
** (process:24396): WARNING **: 21:24:48.760: value_range_string error: Protocol (dvb-s2_gse.proto) hidden by earlier entry (prev="not implemented": 2049 0x801 -> 34524 0x86dc) (this="VLAN": 33024 0x8100 -> 33024 0x8100)
Tested with dvb-s2_bb_example.pcap (where the only Protocol Type value set is for IPv4).
Change-Id: I7c8d8669c3f3e76974db8472783284975e063c12
Reviewed-on: https://code.wireshark.org/review/37711
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
We refer to part 1 of ETSI TS 102 606, i.e. to ETSI TS 102 606-1. Add
other parts if appropriate.
That ultimately ends up pointing to RFC 4326, which, in turn, mentions
two IANA registries.
Change-Id: Ief3ff36bd4c92ab6b94f07f0a6b6a3aeacb2fa12
Reviewed-on: https://code.wireshark.org/review/37716
Reviewed-by: Guy Harris <gharris@sonic.net>
The URL no longer works; use the Wayback Machine.
Change-Id: I80223dc675d0f578dd4f1d58848bc0eea17426c8
Reviewed-on: https://code.wireshark.org/review/37712
Reviewed-by: Guy Harris <gharris@sonic.net>
Large data (for example big DVB-RCS2 tables) can be fragmented at the
GSE level. Reassembly is required to properly decode the data.
Change-Id: I555148e99d43e610208bd87fc64a4bc212fea4b2
Reviewed-on: https://code.wireshark.org/review/37592
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Since bbframes can contain ethernet packets, it is sometimes a bit
annoying to write filters handling multiple layers of ethernet/ip/...
This option allows disabling dissection of the inner packets to focus
only on the outside layers.
Change-Id: I9409d5b671b616477fe7cfcfaabe1f33f0d528c1
Reviewed-on: https://code.wireshark.org/review/37585
Reviewed-by: Anders Broman <a.broman58@gmail.com>
DVB-RCS specifies an NCR (Network Clock Reference) which can be included
in the GSE stream and used to synchronize the return channel.
Change-Id: Ie9c99c8964e44245258a4a446755b2c59379088f
Reviewed-on: https://code.wireshark.org/review/37584
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The static arrays are supposed to be arrays of const pointers to int,
not arrays of non-const pointers to const int.
Fixing that means some bugs (scribbling on what's *supposed* to be a
const array) will be caught (see packet-ieee80211-radiotap.c for
examples, the first of which inspired this change and the second of
which was discovered while testing compiles with this change), and
removes the need for some annoying casts.
Also make some of those arrays static while we're at it.
Update documentation and dissector-generator tools.
Change-Id: I789da5fc60aadc15797cefecfd9a9fbe9a130ccc
Reviewed-on: https://code.wireshark.org/review/37517
Petri-Dish: Guy Harris <gharris@sonic.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Change all wireshark.org URLs to use https.
Fix some broken links while we're at it.
Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c
Reviewed-on: https://code.wireshark.org/review/34089
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Support all four mode adaptation input and output interfaces defined in
SatLabs reference document sl_561, "Mode Adaptation Input and Output
Interfaces for DVB-S2 equipment", instead of only the two modes that use
a sync byte.
There is nothing in the packet format that specifies which format is in
use, so we have to guess based on the possible occurrence of a sync byte
and the CRC-protected BBHEADER that follows the mode adaptation header,
which is a different length for each format. This is a heuristic dissector,
so if none of the four formats match, we just return.
Unfortunately, the BBHEADER CRC is only 8 bits, so there can be false
matches rather often. We detect when the packet matches more than one format,
and issue an expert info diagnostic. It is also possible for a UDP packet
that isn't DVB-S2 at all to match spuriously, with probability around 1%
(assuming random data). This is acceptable for a heuristic dissector,
especially one that is initially disabled.
Standardize spelling per sl_561: adaption -> adaptation
Change-Id: Iffc73ed01c72d1247e2378d648ffe0d7c1f21612
Reviewed-on: https://code.wireshark.org/review/19708
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Interpret packet contents according to the descriptive fields contained
in the BB header. Instead of always assuming a Generic Stream frame format,
use the TS/GS field to detect Generic Stream, Generic Packetized, Transport
Stream, or (reserved) frame formats and decode accordingly.
In the case of Generic Stream frames, check the validity of header fields
ISSYI, NPD, and UPL, and issue expert info if they are invalid for Generic
Stream frames. Then dissect as GSE (as before).
For other frame formats, just dump them as bytes for now.
Change-Id: I6b040207f83369110eb704c543861c887f77baa7
Reviewed-on: https://code.wireshark.org/review/19634
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Change-Id: I1a4b50873a183c0f6051dc0db3fecf5e62c92cbb
Reviewed-on: https://code.wireshark.org/review/19633
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
GSE Padding is outside of any GSE Packet and continues to the end of the
Baseband Frame, per 4.2.1 of ETSI TS 102 606-1.
Added dvb-s2_gse.padding as an integer representing the length in bytes
of the padding field.
Change-Id: I9ed22c37a1969059a09ba44d9e3473cb9d0a1880
Reviewed-on: https://code.wireshark.org/review/19579
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Fix problem with baseband header CRC check that caused almost all
baseband frames to show a spurious CRC error, introduced with
proto_tree_add_checksum.
Change-Id: I6b2f9680507eeb79e59b825f3ac9e4cee1033976
Reviewed-on: https://code.wireshark.org/review/19567
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Supporting all MA modes this way makes the dissector useless as a heuristic dissector; it always matches. I just didn't understand about heuristic dissectors, and will look for a better solution.
The fragmentation edge cases were also misunderstood. On closer reading of the spec, these are not valid edge cases to be handled smoothly, but packet formatting errors to be diagnosed.
The BB CRC fix is valid AFAIK, and will be resubmitted separately.
This reverts commit 2563503301.
Change-Id: I842f4eca59193b24f41a67ce7d081c681b70f449
Reviewed-on: https://code.wireshark.org/review/19449
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Support all four mode adaptation interface formats. Add a user preference to
specify which format is in use, or to request that the format be guessed.
Guessing is improved, but can never be reliable.
Fix problem with baseband header CRC check that caused almost all packets to
show a spurious CRC error, introduced with proto_tree_add_checksum.
Fix problem with GSE PDU fragmentation CRC beginning in one fragment and
ending in another. Any GSE frames following the fragment containing the
end of the CRC would be parsed at the wrong offset.
Fix problem with IPv4 or IPv6 starting exactly on a fragmentation boundary,
so that one baseband frame contains the complete GSE header but zero bytes
of the IP payload. Trying to further dissect the zero-length payload led to
a "malformed packet" display.
Standardize spelling per governing document: adaption -> adaptation
Change-Id: I69e64e74e4b4f02515411471e1d76b0eeb02fef1
Reviewed-on: https://code.wireshark.org/review/19421
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Fill in the "gaps" so that all dissectors that verify checksums have both a
status and expert info field.
Also address comments from original proto_tree_add_checksum patch that didn't make it.
Ping-Bug: 8859
Change-Id: I2e6640108fd6bb218cb959fe9e4ba98a13e43a2f
Reviewed-on: https://code.wireshark.org/review/16590
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This is an attempt to standardize display/handling of checksum fields for all dissectors.
The main target is for dissectors that do validation, but dissectors that just report the
checksum were also included just to make them easier to find in the future.
Bug: 10620
Bug: 12058
Ping-Bug: 8859
Change-Id: Ia8abd86e42eaf8ed50de6b173409e914b17993bf
Reviewed-on: https://code.wireshark.org/review/16380
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Started by grepping call_dissector_with_data, call_dissector_only and call_dissector and traced the handles passed into them to a find_dissector within the dissector. Then replaced find_dissector with find_dissector_add_dependency and added the protocol id from the dissector.
"data" dissector was not considered to be a dependency.
Change-Id: I15d0d77301306587ef8e7af5876e74231816890d
Reviewed-on: https://code.wireshark.org/review/14509
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
'ieee17221.clock_source_id' exists multiple times with NOT compatible types: FT_UINT16 and FT_UINT64
'ieee17221.stream_format' exists multiple times with NOT compatible types: FT_NONE and FT_UINT64
'afp.unknown' exists multiple times with NOT compatible types: FT_UINT16 and FT_BYTES
'afp.toc_offset' exists multiple times with NOT compatible types: FT_NONE and FT_UINT64
'bootp.client_id.iaid' exists multiple times with NOT compatible types: FT_UINT32 and FT_STRING
'bthfp.chld.mode' exists multiple times with NOT compatible types: FT_STRING and FT_UINT8
'canopen.pdo.data' exists multiple times with NOT compatible types: FT_STRINGZ and FT_BYTES
'canopen.sdo.data' exists multiple times with NOT compatible types: FT_UINT32 and FT_BYTES
'ceph.msg.' exists multiple times with NOT compatible types: FT_UINT32 and FT_UINT64
'ceph.version' exists multiple times with NOT compatible types: FT_UINT16 and FT_UINT64
'cip.linkaddress' exists multiple times with NOT compatible types: FT_STRING and FT_UINT8
'dnp3.al.ana' exists multiple times with NOT compatible types: FT_FLOAT and FT_INT32
'dnp3.al.anaout' exists multiple times with NOT compatible types: FT_FLOAT and FT_INT32
'dtls.handshake.cert_url.url_hash_len' exists multiple times with NOT compatible types: FT_STRING and FT_UINT16
'ssl.handshake.cert_url.url_hash_len' exists multiple times with NOT compatible types: FT_STRING and FT_UINT16
'dvb-s2_gse.label' exists multiple times with NOT compatible types: FT_UINT24 and FT_ETHER
'fcdns.rply.fc4type' exists multiple times with NOT compatible types: FT_NONE and FT_UINT8
'fcdns.req.fc4type' exists multiple times with NOT compatible types: FT_NONE and FT_UINT8
'icmp.int_info.name' exists multiple times with NOT compatible types: FT_STRING and FT_BOOLEAN
'icmpv6.ilnp.nb_locs' exists multiple times with NOT compatible types: FT_UINT64 and FT_UINT8
'icmpv6.ilnp.nb_locs' exists multiple times with NOT compatible types: FT_UINT32 and FT_UINT64
'mausb.clear_transfers.status' exists multiple times with NOT compatible types: FT_BOOLEAN and FT_NONE
'mikey.v' exists multiple times with NOT compatible types: FT_BOOLEAN and FT_NONE
'mswsp.rangeboundry.ultype' exists multiple times with NOT compatible types: FT_STRING and FT_UINT32
'mswsp.arrayvector.address64' exists multiple times with NOT compatible types: FT_UINT32 and FT_UINT64
'nlm.lock.l_offset' exists multiple times with NOT compatible types: FT_UINT32 and FT_UINT64
'nlm.lock.l_len' exists multiple times with NOT compatible types: FT_UINT32 and FT_UINT64
'pflog.saddr' exists multiple times with NOT compatible types: FT_IPv6 and FT_IPv4
'pflog.daddr' exists multiple times with NOT compatible types: FT_IPv6 and FT_IPv4
'pflog.saddr' exists multiple times with NOT compatible types: FT_BYTES and FT_IPv6
'pflog.daddr' exists multiple times with NOT compatible types: FT_BYTES and FT_IPv6
'pgm.spm.path' exists multiple times with NOT compatible types: FT_IPv6 and FT_IPv4
'pgm.nak.src' exists multiple times with NOT compatible types: FT_IPv6 and FT_IPv4
'pgm.nak.grp' exists multiple times with NOT compatible types: FT_IPv6 and FT_IPv4
'pgm.poll.path' exists multiple times with NOT compatible types: FT_IPv6 and FT_IPv4
'pgm.opts.ccdata.acker' exists multiple times with NOT compatible types: FT_IPv6 and FT_IPv4
'pgm.opts.ccdata.acker' exists multiple times with NOT compatible types: FT_IPv4 and FT_IPv6
'pgm.opts.ccdata.acker' exists multiple times with NOT compatible types: FT_IPv6 and FT_IPv4
'pgm.opts.redirect.dlr' exists multiple times with NOT compatible types: FT_IPv6 and FT_IPv4
Change-Id: Iaf694699d108a12db172da8dd9fbab211adb329d
Reviewed-on: https://code.wireshark.org/review/14070
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
The preferences are still supported for backwards compatibility, but the heuristic_protos file has final say on the "preference" to enable/disable a heuristic dissector.
Also add parameter to heur_dissector_add() for the "default" enable/disable of a heuristic dissector. With this parameter, a few more (presumably weak) heuristic dissectors have been "registered" but of course default to being disabled.
Change-Id: I51bebb2146ef3fbb8418d4f5c7f2cb2b58003a22
Reviewed-on: https://code.wireshark.org/review/9610
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
This allows better presentation of heuristic dissectors to the end user.
Change-Id: I2ff3985ab914e83c2989880cc0c7b9904045b3f6
Reviewed-on: https://code.wireshark.org/review/9602
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Specifically:
- Set packet.h to be the first wireshark #include after
config.h and "system" #includes.
packet.h added as an #include in some cases when missing.
- Remove some #includes included (directly/indirectly) in
packet.h. E.g., glib.h.
(Done only for those files including packet.h).
- As needed, move "system" #includes to be after config.h and
before wireshark #includes.
- Rework various #include file specifications for consistency.
- Misc.
Change-Id: Ifaa1a14b50b69fbad38ea4838a49dfe595c54c95
Reviewed-on: https://code.wireshark.org/review/5923
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Adrien Destugues