Don't try to add a fragment to a reassembly operation if we don't have
all of the stub data (because the frame is short, or because it's part
of a packet fragmented at a layer below RPC and not reassembled).
Put an entry into the protocol tree for the fragment data of the last
fragment.
svn path=/trunk/; revision=5688
whether a connection-oriented PDU is fragmented or not.
Clean up the handling of fragmented connection-oriented PDUs (the code
to handle fragmented PDUs can assume that it is not the case that both
PFC_FIRST_FRAG and PFC_LAST_FRAG are set, as that's an unfragmented
PDU). Put an entry into the protocol tree for the fragment data in
fragmented PDUs.
For fragmented connectionless PDUs, don't hand the payload of any
fragment other than the first fragment to the subdissector.
svn path=/trunk/; revision=5687
allocate a buffer big enough to hold the ASCIIfied version of that
string, and then ASCIIfy the Unicode string into that buffer, rather
than ASCIIfying into a fixed-length buffer.
svn path=/trunk/; revision=5676
decimal, not hex; use decimal in the value_string tables for them, and
display them in decimal, not hex.
Clean up the names of the certificate types.
Add a routine to add text identifiers, use that routine rather than
doing similar things in several places in the code, and don't have that
routine extract the string contents into a buffer and add it with
"proto_tree_add_string()" - we can just use "proto_tree_add_item()",
which is simpler *and* removes worries about buffer overflows.
Use #defines rather than raw numerical values for identifier types in
switch-statement case clauses.
Fix a typo ("Unknow" -> "Unknown").
FT_NONE and FT_STRING fields can't have a base, so make them BASE_NONE.
svn path=/trunk/; revision=5675
If we had unreassebled DCERPC PDUs but had
decryption of MAPI enabled we would try to read too much data from the
tvbuff and ethereal would later dump core.
svn path=/trunk/; revision=5673
types and Wiretap encapsulations after the entries to map between
platform-independent libpcap link-layer types and those Wiretap
encapsulations, so that, when writing a libpcap-format file, we choose
the platform-independent link-layer types.
svn path=/trunk/; revision=5668
"tvb_get_nstringz0()" no larger than the space in "str" (not counting
the space for the trailing '\0').
Make "str" big enough to hold a maximum-length serial number string (the
length is 1 byte, hence the maximum length is 256 bytes plus 1 byte of
terminating '\0').
svn path=/trunk/; revision=5665
requests - the data part of the AFS authentication request
(hf_afs_kauth_data) is displayed as a string whilst declared as a binary
array in "packet-afs-register-info.h".
svn path=/trunk/; revision=5661
In libpcap.c, move wtap_pcap_encap_to_wtap_encap before libpcap_open
so that if HAVE_PCAP_H is not true, the file will still compile.
svn path=/trunk/; revision=5660
the source to an "ipxdump" utility from the Linux ncpfs package.
The NetworkAddress field in a 23/26 GetInternetAddress reply appears
to be big-endian; we assume it's big-endian in all messages.
The NetworkSocket field in that reply also appears to be big-endian;
it was already set up to be big-endian in other messages.
Put in comments noting other things seen in captures.
svn path=/trunk/; revision=5658
in TCP, UDP, and SCTP, try the lower port number first, and then the
higher port number; this means that, for packets where a dissector is
registered for *both* port numbers:
1) we pick the same dissector for traffic going in both directions;
2) we prefer the port number that's more likely to be the right
one (as that prefers well-known ports to reserved ports);
although there is, of course, no guarantee that any such strategy will
always pick the right port number.
Ignore port numbers of 0, as some dissectors use a port number of 0 to
disable the port, and as RFC 768 says that the source port in UDP
datagrams is optional and is 0 if not used.
svn path=/trunk/; revision=5656
interpret and show Value-Length fields bigger than a single byte.
allows the dissector to properly interpret and show
From: headers with a Value-Length field bigger than a single byte.
svn path=/trunk/; revision=5653
argument to copy a counted string, and use "tvb_strsize()" rather tan
"strlen()" with a "tvb_get_ptr()" argument to get the length of a
null-terminated string, so that we throw an exception if we go past the
end of the tvbuff, rather than processing bytes past the end.
svn path=/trunk/; revision=5649
having two different versions, both broken in different ways.
Bump the count of total packets in the capture-from-pipe routine.
svn path=/trunk/; revision=5647
but for stuff reassembled with "fragment_add_seq()" or
"fragment_add_seq_check()".
Add a "fragment tag" string to the "fragment_items", so that packets
with fragmentation errors can be properly flagged as having "Illegal
fragments" or "Illegal segments" depending on the term used with the
protocol in question.
Make all the dissectors that can use "show_fragment_tree()" or
"show_fragment_seq_tree()", and don't already use them, do so.
svn path=/trunk/; revision=5644
Have "wtap_open_offline()", if asked to open a FIFO, return that error
if it was asked to open the file for random access.
svn path=/trunk/; revision=5643
the internal z_err value for the stream if an "fseek()" call it makes
fails, so that if "gzerror()" is subsequently called, it returns Z_OK
rather than an error.
To work around this, we pass "file_seek()" an "int *err", and have the
with-zlib version of "file_seek()" check, if "gzseek()" fails, whether
the return value of "file_error()" is 0 and, if so, have it return
"errno" instead.
svn path=/trunk/; revision=5642
they are, in fact, WTAP_ENCAP_FRELAY. Support 11 as WTAP_ENCAP_FRELAY
if DLT_FR is defined and is equal to 11, and support 107 as
WTAP_ENCAP_FRELAY unconditionally.
Get rid of a comment indicating that 105 isn't used - it's been
supported as DLT_IEEE802_11 for a while.
svn path=/trunk/; revision=5640
Guy Harris