be done on flows from one address to another; reassembly for protocols
running atop TCP should be done on flows from one TCP endpoint to
another.
We do this by:
adding "reassembly table" as a data structure;
associating hash tables for both in-progress reassemblies and
completed reassemblies with that data structure (currently, not
all reassemblies use the latter; they might keep completed
reassemblies in the first table);
having functions to create and destroy keys in that table;
offering standard routines for doing address-based and
address-and-port-based flow processing, so that dissectors not
needing their own specialized flow processing can just use them.
This fixes some mis-reassemblies of NIS YPSERV YPALL responses (where
the second YPALL response is processed as if it were a continuation of
a previous response between different endpoints, even though said
response is already reassembled), and also allows the DCE RPC-specific
stuff to be moved out of epan/reassembly.c into the DCE RPC dissector.
svn path=/trunk/; revision=48491
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of
sizeof.
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of
strtol() and strtoul().
Change some data types to avoid those implicit conversion warnings.
When assigning a constant to a float, make sure the constant isn't a
double, by appending "f" to the constant.
Constify a bunch of variables, parameters, and return values to
eliminate warnings due to strings being given const qualifiers. Cast
away those warnings in some cases where an API we don't control forces
us to do so.
Enable a bunch of additional warnings by default. Note why at least
some of the other warnings aren't enabled.
randpkt.c and text2pcap.c are used to build programs, so they don't need
to be in EXTRA_DIST.
If the user specifies --enable-warnings-as-errors, add -Werror *even if
the user specified --enable-extra-gcc-flags; assume they know what
they're doing and are willing to have the compile fail due to the extra
GCC warnings being treated as errors.
svn path=/trunk/; revision=46748
The reassembled fragments tree in the Packet Details view is awesome, but it
lacks one thing: a field that exposes the reassembled data.
tcp.data already exists for exposing a single TCP segment's payload as a byte
array. It would be handy to have something similar for a single application
layer PDU when TCP segment reassembly is involved. I propose
tcp.reassembled.data, named and placed after the already existing field
tcp.reassembled.length.
My primary use case for this feature is outputting tcp.reassembled.data with
tshark for further processing with a script.
The attached patch implements this very feature. Because the reassembled
fragment tree code is general purpose, i.e. not specific to just TCP, any
dissector that relies upon it can add a similar field very cheaply. In that
vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which
expose reassembled fragment data as a single byte stream for IPv4 and IPv6,
respectively. All other protocols that use the reassembly code have been left
alone, other than inserting NULL into their initializer lists for the newly
introduced struct field reassemble.h:fragment_items.hf_reassembled_data.
svn path=/trunk/; revision=44802
Also (for a few files):
- create/use some extended value strings;
- remove unneeded #include files;
- remove unneeded variable initialization;
- re-order fcns slightly so prefs_reg_handoff...() at end, etc
svn path=/trunk/; revision=44438
The BACnet GetEnrollmentSummary-ACK has an optional parameter Notification
Class. The Wireshark decoding does not correctly decode when this parameter is
missing.
The fix is to verify the context exists before attempting to decode this
parameter.
From me: replace the few remaining tabs in the file with spaces.
svn path=/trunk/; revision=44207
Attached is a patch which corrects the string construction issue in the
PropertyStates method. This patch also corrects a spelling error for
'utcTimeSyncronization' and adds decode support for this property.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6475#c8
svn path=/trunk/; revision=43868
Another case where a ridiculously large length field was causing a loop counter
to overflow. Had to pass pinfo all over the place to add expert info, but the
meat of the fix is on line 4960 (after patch applied).
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7121
svn path=/trunk/; revision=42203
The attached (trivial) patch adds some missing breaks in switch-case blocks.
This fixes coverity defects #445, #446, #1316 and #1380.
svn path=/trunk/; revision=41727
packet-bacapp.c:6154: error: stray '\250' in program
packet-bacapp.c:7137: warning: cast to pointer from integer of different size
svn path=/trunk/; revision=39680
I found many new properties in BACnet that were not decoded correctly in
Wireshark. I have attached a patch that adds decoding to the following
properties:
Fixed the following properties to decode:
In the Accumulator Object:
scale (187)
prescale (185)
logging-record (184)
In Access Door Object:
door-members (228)
masked-alarm-values (234)
In the Pulse Converter Object:
input-reference (181)
In the Group Object:
list-of-group-members (53)
In the Event Enrollment Object:
object-property-reference (78)
In the Command Object:
action (2)
In the Trend Log Multiple object:
log-buffer (131)
In the Event Log Object:
log-buffer (131)
In the Structured View object:
subordinate-list (211)
Added decoding for the following enumeration type properties:
Logging-type (197)
event-state (36)
reliability (103)
notify-type (208)
door-status (231)
lock-status (233)
secured-status (235)
maintenance-required (158)
program-state (92)
program-change (90)
reason-for-halt (100)
mode (160)
silenced (163)
operation-expected (161)
tracking-value (164)
file-access-method (41)
The above fixes also fixed the log-buffer decoding of the old trend log
recorded as Wireshark bug: #6458
I believe this patch also fixes bug: #6235. But the original bug did not
contain a capture file so I am not positive my capture represents the
originators issue.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6475
svn path=/trunk/; revision=39676
Specifically: Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
the encoding parameter for proto_tree_add_item() calls which directly reference
an item in hf[] which has a type of:
FT_BOOLEAN
FT_IPv4
FT_EUI64
FT_GUID
FT_UINT_STRING
Also: For type FT_ITv6 use ENC_NA. (This was missed in SVN #39260)
svn path=/trunk/; revision=39328
Specifically: Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as
the encoding parameter for proto_tree_add_item() calls which directly reference
an item in hf[] which has a type of:
FT_UINT8
FT_UINT16
FT_UINT24
FT_UINT32
FT_UINT64
FT_INT8
FT_INT16
FT_INT24
FT_INT32
FT_INT64
FT_FLOAT
FT_DOUBLE
svn path=/trunk/; revision=39288
Fix problem with the decoding of the exception schedule. It was eating one
too many closing tags before exiting and causing the rest of the information to
fail to decode correctly.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6178
svn path=/trunk/; revision=38919
Fixes log-status and status-flags plus other BACnet decoding bugs
This patch fixes the log-status and status-flag decoding issues described in
this bug report. This patch also fixes the following items:
1) date-list decoding
2) time-synchronization-recipients decoding
3) decoding of UTF-8 character strings (when using character set 0)
4) event-parameter decoding
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5120
svn path=/trunk/; revision=38914
Error: Found non-ASCII characters on line 4135 of packet-bacapp.c
Error: Found non-ASCII characters on line 4163 of packet-bacapp.c
Error: Found non-ASCII characters on line 4198 of packet-bacapp.c
svn path=/trunk/; revision=38681
(Yes, that means that all but one call uses ENC_LITTLE_ENDIAN, and one
uses ENC_BIG_ENDIAN. I guess that's how the protocol works....)
svn path=/trunk/; revision=38106
This patch adds the capability to create BACnet statistics trees.
Find the respective menu items under 'Statistics->BACnet'.
Packets can be sorted by different criteria:
- Src/Dst IP adresses
- Instance ID
- Object Type
- Service
From me:
- Don't use C++/C99-style comments.
- Name variables for tick_stat_node() don't need to be static.
- Change updateBacnetInfoValue() to require 'data' to be ep_ allocated. Change
the couple of calls that did not send in ep_ allocated data to do so.
- Change one or two functions to be static.
- Do not use (memory-unsafe) g_sprintf().
- Use ep_strconcat() instead of leaking memory with g_strconcat().
- Put back one if(tree) that doesn't appear to do any harm.
- Remove variable declarations and #includes from the header file.
svn path=/trunk/; revision=36468
keys to have _uint in their names, to match the routines that handle
dissector tables with string keys. (Using _port can confuse people into
thinking they're intended solely for use with TCP/UDP/etc. ports when,
in fact, they work better for things such as Ethernet types, where the
binding of particular values to particular protocols are a lot
stronger.)
svn path=/trunk/; revision=35224
Enhancements to BACnet's bacapp dissector
Details:
1) Added the low and high instance parameters of the who-is command to the
summary view, if present.
2) Added dissecting of the property active-cov-subscriptions.
3) Added tag details to the decoded view of ProcessId.
4) Fixed the indent levels of the recipientProcess decoding.
5) Fixed the indent tree levels for ReadPropertyMultiple-ACK when decoding
error response.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5473
svn path=/trunk/; revision=35170
Guy Harris