handed looks as if it contains only a TPKT header (4 bytes long, and
those 4 bytes look like a TPKT header according to "is_tpkt()"), call
the "dissect TPKT over a TCP stream" routine. If we're doing
reassembly, that routine will force a reassembly because the TPKT
payload isn't in that segment, and the various heuristic XXX-over-TPKT
dissectors will be called again, this time with enough data for them to
say whether the TPKT payload is for them or not; if we're not doing
reassembly, we'll dissect the TPKT header and then call the "dissect a
Q.931 PDU" routine, which will throw an exception because there isn't
any payload from which to fetch data (and that's what we want to
happen).
In the "dissect TPKT over a TCP stream" routine, if reassembly is
enabled, do the check to see if we need to do reassembly to get the
payload before dissecting the TPKT header, so that we don't dissect the
TPKT header and then decide "oops, we need some more data to get the
TPKT payload".
svn path=/trunk/; revision=4792
have a TPKT header at the beginning, so there's not need for it to have
an offset as an argument; its callers don't have to know how big the
TPKT header is (or we can put a #define in "packet-tpkt.h" for it). Get
rid of the second argument.
svn path=/trunk/; revision=4791
packets per segment.
Instead of having a routine for dissectors such as the Q.931 dissector
to call to dissect the TPKT header, have a routine that does all the
reassembly and multiple-packets-per-segment work, and have the Q.931
dissector call it. Export "is_tpkt()", and the new routine, to plugins.
Add preferences for TPKT and Q.931 reassembly.
svn path=/trunk/; revision=4778
Have the Q.931 PDU dissector, if it's Q.931-over-TPKT, check for
user-user IEs with a protocol discriminator of "X.208 and X.209 coded
user information" and, if it sees one, call an H.225.0 Call Setup
dissector if it could find the handle for it.
svn path=/trunk/; revision=4723
dissector, it's looking for Q.931 encapsulated inside TPKT, so it
shouldn't check whether the first byte is NLPID_Q_931 or not, as it
*won't* be NLPID_Q_931, it'll be 3, for the TPKT version. It should
first check whether "is_tpkt()" thinks it's a TPKT packet, and then
check that the packet has at least 3 bytes past the TPKT header, then
check the first byte in the payload to see whether it's NLPID_Q_931. If
that all succeeds, treat it as Q.931 inside TPKT.
Make "is_tpkt()" return the length from the TPKT header on success, and
-1 on failure, and return the offset past the TPKT header via a pointer
(so clients don't have to know that the TPKT header is 4 bytes long).
svn path=/trunk/; revision=4669
arguments to "proto_tree_add_text()", and to "proto_tree_add_XXX()" calls
that add FT_NONE or FT_PROTO items to the protocol tree, with -1.
Replace some calls to "tvb_length()" or "tvb_length_remaining()" with
calls to "tvb_reported_length()" and "tvb_reported_length_remaining()",
as those give the actual length of the data in the packet, not just the
data that happened to be captured.
svn path=/trunk/; revision=4605
"epan/..." pathnames, so as to avoid collisions with header files in any
of the directories in which we look (e.g., "proto.h", as some other
package has its own "proto.h" file which it installs in the top-level
include directory).
Don't add "-I" flags to search "epan", as that's no longer necessary
(and we want includes of "epan" headers to fail if the "epan/" is left
out, so that we don't re-introduce includes lacking "epan/").
svn path=/trunk/; revision=4586
structure to the "packet_info" structure; only stuff that's permanently
stored with each frame should be in the "frame_data" structure, and the
"column_info" structure is not guaranteed to hold the column values for
that frame at all times - it was only in the "frame_data" structure so
that it could be passed to dissectors, and, as all dissectors are now
passed a pointer to a "packet_info" structure, it could just as well be
put in the "packet_info" structure.
That saves memory, by shrinking the "frame_data" structure (there's one
of those per frame), and also lets us clean up the code a bit.
svn path=/trunk/; revision=4370
containing OSI transport layer PDUs).
Enable the Q.931-inside-TPKT code (but not the H.225 stuff, as that
requires Andreas Sikkema's H.225 dissector). Update it to match his
current modified Q.931 dissector.
svn path=/trunk/; revision=3199
protocols, in addition to adding structures to the list of filterable
fields. Give it an extra argument that specifies a "short name" for the
protocol, for use in such places as
pinfo->current_proto;
the dialog box for constructing filters;
the preferences tab for the protocol;
and so on (although we're not yet using it in all those places).
Make the preference name that appears in the preferences file and the
command line for the DIAMETER protocol "diameter", not "Diameter"; the
convention is that the name in question be all-lower-case.
Make some routines and variables that aren't exported static.
Update a comment in the ICP dissector to make it clear that the
dissector won't see fragments other than the first fragment of a
fragmented datagram.
svn path=/trunk/; revision=2810
can be put, and a pointer to the string for the column, which might or
might not point to that buffer.
Add a routine "col_set_str()", which sets the string for the column to
the string passed to it as an argument; it should only be handed a
static string (a string constant would be ideal). It doesn't do any
copying, so it's faster than "col_add_str()".
Make the routines that append to columns check whether the pointer to
the string for the column points to the buffer for the column and, if
not, copy the string for the column to the buffer for the column so that
you can append to it (so you can use "col_set_str()" and then use
"col_append_str()" or "col_append_fstr()").
Convert a bunch of "col_add_str()" calls that take a string constant as
an argument to "col_set_str()" calls.
Convert some "col_add_fstr()" calls that take a string constant as the
only argument - i.e., the format string doesn't have any "%" slots into
which to put strings for subsequent arguments to "col_set_str()" calls
(those calls are just like "col_add_str()" calls).
Replace an END_OF_FRAME reference in a tvbuffified dissector with a
"tvb_length(tvb)" call.
svn path=/trunk/; revision=2670
string formatter, like "format_text()", and, as "tvbuff.c" now calls it
(*vide infra*), we don't want to have to make "tvbuff.c" drag "packet.h"
in just to declare "bytes_to_str()". It's now declared in "strutil.h",
so include it in modules that use "bytes_to_str()" and weren't already
including it.
Add a "tvb_bytes_to_str()" wrapper that calls "tvb_get_ptr()" to get a
pointer to a chunk of N bytes at a given offset in a tvbuff and then
hands that chunk to "bytes_to_str()". Convert the code that was doing
that to use "tvb_bytes_to_str()" instead (which caught what I suspect is
a bug in the Q.2931 dissector, where it was handing an offset of 0 to
"tvb_get_ptr()" - a cut-and-pasteo, I think).
Tvbuffify the ARP dissector.
svn path=/trunk/; revision=2634
the following:
It is now possible to enable/disable a particular protocol decoding
(i.e. the protocol dissector is void or not). When a protocol
is disabled, it is displayed as Data and of course, all linked
sub-protocols are disabled as well.
Disabling a protocol could be interesting:
- in case of buggy dissectors
- in case of wrong heuristics
- for performance reasons
- to decode the data as another protocol (TODO)
Currently (if I am not wrong), all dissectors but NFS can be disabled
(and dissectors that do not register protocols :-)
I do not like the way the RPC sub-dissectors are disabled (in the
sub-dissectors) since this could be done in the RPC dissector itself,
knowing the sub-protocol hfinfo entry (this is why, I've not modified
the NFS one yet).
Two functions are added in proto.c :
gboolean proto_is_protocol_enabled(int n);
void proto_set_decoding(int n, gboolean enabled);
and two MACROs which can be used in dissectors:
OLD_CHECK_DISPLAY_AS_DATA(index, pd, offset, fd, tree)
CHECK_DISPLAY_AS_DATA(index, tvb, pinfo, tree)
See also the XXX in proto_dlg.c and proto.c around the new functions.
svn path=/trunk/; revision=2267
a particular type, rather than taking a varargs list, along the lines of
the "proto_tree_add_XXX_format()" routines.
Replace most calls to "proto_tree_add_item()" and
"proto_tree_add_item_hidden()" with calls to those routines.
Rename "proto_tree_add_item()" and "proto_tree_add_item_hidden()" to
"proto_tree_add_item_old()" and "proto_tree_add_item_hidden_old()", and
add new "proto_tree_add_item()" and "proto_tree_add_item_hidden()"
routines that don't take the item to be added as an argument - instead,
they fetch the argument from the packet whose tvbuff was handed to them,
from the offset handed to them.
svn path=/trunk/; revision=2031
(i.e., the amount of data that was in the packet, even if not all of it
was captured), for use when dissecting packets containing data that
fills the packet (we want the dissector to try to dissect all of it; if
it runs past the end of the captured data, we want it to throw an
exception so that we'll put a "Short Frame" note in the protocol tree).
This means we always want a tvbuff to have a real reported length value,
so we make it an unsigned integer, and don't bother checking it for -1,
as it should never be -1.
If the reported length passed in to "tvb_set_subset()" is -1, set the
reported length to the reported length of the tvbuff of which the new
tvbuff will be a subset minus the offset in that tvbuff of the subset,
so that "-1" means "what's left of the packet after we chop off the
header". This is necessary in order to ensure that all tvbuffs have a
real reported length value.
Have "dissect_packet()" set the reported length of the top-level tvbuff
to the reported length of the frame, so that we start out with a tvbuff
with a real reported length value.
Have "tvb_offset_exists()" return FALSE if the offset is past the end of
the tvbuff.
If the offset passed to it is postitive, have "compute_offset_length()"
check for that it's not more than one byte past the end of the tvbuff -
if it's just past the end, we don't want the check to fail, as we don't
want attempts to create a subset tvbuff containing zero bytes to fail;
that would be done if a captured packet was all header and no payload,
and we'd want the dissector of the payload, not the dissector of the
header, to throw an exception, as the problem isn't with the protocol
for the header, it's with the protocol for the payload.
Convert the ATM dissector, the SSCOP dissector, the Q.2931 dissector,
and the Q.931 dissector to use tvbuffs.
Make the LAPD dissector set up a tvbuff for the Q.931 dissector (it's
not converted yet).
svn path=/trunk/; revision=2023
Add exceptions routines.
Convert proto_tree_add_*() routines to require tvbuff_t* argument.
Convert all dissectors to pass NULL argument ("NullTVB" macro == NULL) as
the tvbuff_t* argument to proto_tree_add_*() routines.
dissect_packet() creates a tvbuff_t, wraps the next dissect call in
a TRY block, will print "Short Frame" on the proto_tree if a BoundsError
exception is caught.
The FDDI dissector is converted to use tvbuff's.
svn path=/trunk/; revision=1939
In Q.931 and Q.2931, the TR 9577 values are NLPIDs, so use "nlpid_vals"
to dissect them, and values from "nlpid.h" to refer to them.
svn path=/trunk/; revision=1461
1) fix the check for the IE identifier to check all bits,
including the topmost bit;
2) print all fields in the Date IE as 2 digits.
svn path=/trunk/; revision=1335
Export some functions from the Q.931 dissector, so the Q.2931 dissector
can use them.
Add a pile of information element dissection to the Q.2931 dissector.
svn path=/trunk/; revision=1104
dynamically-assigned "ett_" integer values, assigned by
"proto_register_subtree_array()"; this:
obviates the need to update "packet.h" whenever you add a new
subtree type - you only have to add a call to
"proto_register_subtree_array()" to a "register" routine and an
array of pointers to "ett_", if they're not already there, and
add a pointer to the new "ett_" variable to the array, if they
are there;
would allow run-time-loaded dissectors to allocate subtree types
when they're loaded.
svn path=/trunk/; revision=1043
Guy Harris