be done on flows from one address to another; reassembly for protocols
running atop TCP should be done on flows from one TCP endpoint to
another.
We do this by:
adding "reassembly table" as a data structure;
associating hash tables for both in-progress reassemblies and
completed reassemblies with that data structure (currently, not
all reassemblies use the latter; they might keep completed
reassemblies in the first table);
having functions to create and destroy keys in that table;
offering standard routines for doing address-based and
address-and-port-based flow processing, so that dissectors not
needing their own specialized flow processing can just use them.
This fixes some mis-reassemblies of NIS YPSERV YPALL responses (where
the second YPALL response is processed as if it were a continuation of
a previous response between different endpoints, even though said
response is already reassembled), and also allows the DCE RPC-specific
stuff to be moved out of epan/reassembly.c into the DCE RPC dissector.
svn path=/trunk/; revision=48491
epan/show_exception.c, as it's used outside
epan/dissectors/packet-frame.c. Update their callers to include
<epan/show_exception.h> to get their declaration.
Add a CATCH_NONFATAL_ERRORS macro that catches all exceptions that, if
there's more stuff in the packet to dissect after the dissector call
that threw the exception, doesn't mean you shouldn't go ahead and
dissect that stuff. Use it in all those cases, including ones where
BoundsError was inappropriately being caught (you want those passed up
to the top level, so that the packet is reported as having been cut
short in the capture process).
Add a CATCH_BOUNDS_ERRORS macro that catches all exceptions that
correspond to running past the end of the data for a tvbuff; use it
rather than explicitly catching those exceptions individually, and
rather than just catching all exceptions (the only place that
DissectorError should be caught, for example, is at the top level, so
dissector bugs show up in the protocol tree).
Don't catch and then immediately rethrow exceptions without doing
anything else; just let the exceptions go up to the final catcher.
Use show_exception() to report non-fatal errors, rather than doing it
yourself.
If a dissector is called from Lua, catch all non-fatal errors and use
show_exception() to report them rather than catching only
ReportedBoundsError and adding a proto_malformed item.
Don't catch exceptions when constructing a trailer tvbuff in
packet-ieee8023.c - just construct it after the payload has been
dissected, and let whatever exceptions that throws be handled at the top
level.
Avoid some TRY/CATCH/ENDTRY cases by using checks such as
tvb_bytes_exist() before even looking in the tvbuff.
svn path=/trunk/; revision=47924
tvbuff and runs to the end of the tvbuff? Let me count the ways....
Replace a bunch of different ways of doing that (some incorrect, in that
they're not properly handling tvbuffs where the captured and reported
lengths are different) with tvb_new_subset_remaining().
svn path=/trunk/; revision=47751
The reassembled fragments tree in the Packet Details view is awesome, but it
lacks one thing: a field that exposes the reassembled data.
tcp.data already exists for exposing a single TCP segment's payload as a byte
array. It would be handy to have something similar for a single application
layer PDU when TCP segment reassembly is involved. I propose
tcp.reassembled.data, named and placed after the already existing field
tcp.reassembled.length.
My primary use case for this feature is outputting tcp.reassembled.data with
tshark for further processing with a script.
The attached patch implements this very feature. Because the reassembled
fragment tree code is general purpose, i.e. not specific to just TCP, any
dissector that relies upon it can add a similar field very cheaply. In that
vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which
expose reassembled fragment data as a single byte stream for IPv4 and IPv6,
respectively. All other protocols that use the reassembly code have been left
alone, other than inserting NULL into their initializer lists for the newly
introduced struct field reassemble.h:fragment_items.hf_reassembled_data.
svn path=/trunk/; revision=44802
This is necessary in case a subdissector had changed it but was unable to
restore it (due to the exception).
Remove check_col().
svn path=/trunk/; revision=34436
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
These packet-g*.c files all have display filter issues:
1) packet-gryphon.c: PROTOABBREV is "gryphon", but display filter fields are
prefixed with only "gryph".
2) packet-gmrp.c: PROTOABBREV is "gmrp", but display filter fields are prefixed
with "garp".
3) packet-gssapi.c: PROTOABBREV is "gss-api", but display filter fields are
prefixed with "gssapi".
4) packet-gvrp.c: PROTOABBREV is "gvrp", but display filter fields are prefixed
with "garp", most of which conflict with packet-gmrp.c's display filter fields.
svn path=/trunk/; revision=24058
this fixes some issues with some really ancient cifs implementations where the previous tests and statemanagement would cause it to fail othervise.
svn path=/trunk/; revision=20136
we can add code to check that it looks sane (for better heuristics) when
we start adding GSS-KRB reassembly.
we need this for some transports such as SMB/SessionSetup that will transport GSS-KRB blobs inside multiple PDUs (multiple different SMB/SessionSetups) so we can reassemble the blobs before decoding them.
this probably only happens for SMB/SessionSetup but the design of that command is so "nice" that you can not tell whether the blob is fragmented or not or how big it is supposed to be by looking at the SMB layer itself, one needs to know the BER length field for the BER APPLICATION tag. :-(
to make things worse, the only way match multiple such fragments together one will need not just the fragments from the SessionSetup requests but also the UID that is returned in the response to the initial request.
perverse design.
lets assume that there will almost never be multiple sessionsetups on the same tcp session in real traces so to make things easier just ignore the UID for now when reassembling. (well reassembly is not added yet but will be)
svn path=/trunk/; revision=19112
we will need a conversation in more places once we start adding reassembly of gss-krb blobs that span multiple pdus (smb/sessionsetup)
svn path=/trunk/; revision=19110
create a new dissector table where MAC algorithms for dns/tsig can be registered.
register gssapi for the algorithm "gss.microsoft.com" since this is what w2k uses when performing dns updates.
svn path=/trunk/; revision=16895
fix bug251 and all other occurances where an oid string passed to packet_ber_object_identifier()
is not defined as foo[MAX_OID_STR_LEN]
svn path=/trunk/; revision=14720
