When dissecting an eDonkey "Request Parts" message, Wireshark incorrectly reads
3 offset start/end pairs when the actual number can be 1-3 pairs.
svn path=/trunk/; revision=31071
epan\dissectors\packet-edonkey.c
In the fuction dissect_emule_sourceOBFU(): the line
ti = proto_tree_add_item(tree, hf_emule_sourceOBFU, tvb, offset, 7 + ((settings & 0x08) ? 16 : 0), FALSE);
should be
ti = proto_tree_add_item(tree, hf_emule_sourceOBFU, tvb, offset, 7 + ((settings & 0x80) ? 16 : 0), FALSE);
and, the line:
if (settings & 0x08)
should be:
if (settings & 0x80)
That is, 0x08 should be revised to 0x80.
reference: the eMule0.49c source code, file PartFile.cpp, line 2730, in the
function CPartFile::AddSources().
svn path=/trunk/; revision=29957
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
changes:
- fixed: display of kademlia hash (bug #2348)
- added: information on the meaning of the values of kad version, parameter of
message types KADEMLIA_REQ and KADEMLIA2_REQ, metatag sourcetype and metatag
encryption
- added: peer id, target id, recipients id, file id, keyword hash as variants
of kademlia hash (searchable as string now)
- added: xor between target id and recipients id
- fixed: ip adresses in taglist now displayed in dotted-decimal (instead of
int)
- fixed: some values in taglist were displayed in octal, it's hex now
- fixed: message type KADEMLIA2_BOOTSTRAP_REQ was wrongly marked as malformed
- added: differences in dissecting peer list 1.0 and peer list 2.0
- fixed: dissection of KADEMLIA2_SEARCH_KEY_REQ and KADEMLIA2_SEARCH_RES
- added: source-publishing and keyword-publishing in KADEMLIA_PUBLISH_REQ
- fixed: decompressed data are not displayed in a subtree anymore
svn path=/trunk/; revision=26063
members to be const pointers when that's possible, and throw in some
casts when the GLib API fails to have properly consted arguments.
Use ep_strdup_printf() in some cases.
svn path=/trunk/; revision=25596
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
Makes more fields searchable
Also fixes some typos and indentation errors
Fixes bug http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1802 for edonkey
dissector: every field defined by the dissector is now contained under the
PROTOABBREV=edonkey "root" key
svn path=/trunk/; revision=23315
- if offset is 0, tvb_length is the same as tvb_length_remaining, just faster.
Replace
- col_append_fstr() with faster col_append_str()
- col_add_str() with col_set_str()
when it's safe
svn path=/trunk/; revision=23252
Sometimes edonkey packets comes joined, and wireshark display only last
one on column Info. Now everyone is displayed.
svn path=/trunk/; revision=22143
I added 5 new packets to packet-edonkey.c and improve 2. Diffs in
attachment. This part of wireshark (decoding emule packets) it's not
finish as I see :) I try to do it, meybe... :)
svn path=/trunk/; revision=22128
routines and routines using those routines. GLib might use different
modifiers for 64-bit quantities than the platform's C library does.
svn path=/trunk/; revision=21990
there are many reasons why some protocols actually need to be able to access the pinfo structure while determining the pdu size
svn path=/trunk/; revision=19751
while this should improve performance by unmeasurably little it does have the sideeffect that once we finish the rewrite tcp analysis might actually work and work well even for tcp over tcp tunnelling.
this also means that if you include packet-tcp.h you also need to include emem.h .
svn path=/trunk/; revision=17681
Version 0.47a of eMule extends the eDonkey protocol to support files up to 256GB in length. This patch adds support for the new packet types, and changes to existing packets, used to support this.
In addition, it seems to be getting more common to use compression on the index server connection. The packets used are just like the uncompressed versions, except transmitted as a zlib compressed stream, so I've added dissection for the contents of those too.
Plus a couple of bugfixes to the UDP packet dissection.
svn path=/trunk/; revision=17475
Three patches here:
eth-ed-2.diff
-------------
1) The handling of HashSet Answer messages was wrong
2) Add dissection of some more eMule extension packets to do with
error recovery
eth-bt-1.diff
-------------
New versions of the Azureus BitTorrent client implement a new extension to the protocol, which is effectively a text based encapsulation of the binary BitTorrent protocol, embedded within the BitTorrent protocol. Who knows why they thought that was a good idea, but this patch can pick apart their new headers.
eth-bt-2.diff
-------------
By registering a normal dissector as well as the heuristic one, BitTorrent shows up on the Decode As... list so you can manually override its mistake.
svn path=/trunk/; revision=16856
The current ethereal eDonkey dissector fails to handle a number of valid packet types - in particular the normal server<->client communication between current eserver and eMule versions (from both
sides) produces packets which ethereal incorrectly claims to be malformed.
This patch fills in these holes.
svn path=/trunk/; revision=16107
add a "match_strval_idx()" routine that does the same thing, and have
"match_strval()" call it.
Make those routines, and "val_to_str()", return a "const" pointer.
Update dissectors as necessary to squelch compiler warnings produced by
that.
Use "val_to_str()" rather than using "match_strval()" and then, if the
result is null, substituting a specific string. Clean up some other
"match_strval()"/"val_to_str()" usages.
Add a null pointer check in the NDPS dissector's "attribute_value()"
routine, as it's not clear that "global_attribute_name" won't be null at
that point.
Make some global variables in the AFS4INT dissector local.
Make some routines not used outside the module they're in static.
Make some tables "static const".
Clean up white space.
Fix Gerald's address in some files.
svn path=/trunk/; revision=14786
Also move ncp222.py, x11-fields, process-x11-fields.pl,
make-reg-dotc, and make-reg-dotc.py.
Adjust #include lines in files that include packet-*.h
files.
svn path=/trunk/; revision=11410