forked from osmocom/wireshark
0853ddd1cb
This adds new syntax to read a field from the tree as bytes, instead
of the actual type. This is a useful extension for example to match
matformed strings that contain unicode replacement characters. In
this case it is not possible to match the raw value of the malformed
string field. This extension fills this need and is generic enough
that it should be useful in many other situations.
The syntax used is to prefix the field name with "@". The following
artificial example tests if the HTTP user agent contains a particular
invalid UTF-8 sequence:
@http.user_agent == "Mozill\xAA"
Where simply using "http.user_agent" won't work because the invalid byte
sequence will have been replaced with U+FFFD.
Considering the following programs:
$ dftest '_ws.ftypes.string == "ABC"'
Filter: _ws.ftypes.string == "ABC"
Syntax tree:
0 TEST_ANY_EQ:
1 FIELD(_ws.ftypes.string <FT_STRING>)
1 FVALUE("ABC" <FT_STRING>)
Instructions:
00000 READ_TREE _ws.ftypes.string <FT_STRING> -> reg#0
00001 IF_FALSE_GOTO 3
00002 ANY_EQ reg#0 == "ABC" <FT_STRING>
00003 RETURN
$ dftest '@_ws.ftypes.string == "ABC"'
Filter: @_ws.ftypes.string == "ABC"
Syntax tree:
0 TEST_ANY_EQ:
1 FIELD(_ws.ftypes.string <RAW>)
1 FVALUE(41:42:43 <FT_BYTES>)
Instructions:
00000 READ_TREE @_ws.ftypes.string <FT_BYTES> -> reg#0
00001 IF_FALSE_GOTO 3
00002 ANY_EQ reg#0 == 41:42:43 <FT_BYTES>
00003 RETURN
In the second case the field has a "raw" type, that equates directly to
FT_BYTES, and the field value is read from the protocol raw data.
|
||
|---|---|---|
| .. | ||
| arp.pcap | ||
| c1222_std_example8.pcap | ||
| communityid.pcap.gz | ||
| cose_encrypt0_tagged.cbordiag | ||
| cose_encrypt0_tagged.pcap | ||
| cose_encrypt_tagged.cbordiag | ||
| cose_encrypt_tagged.pcap | ||
| cose_keyset.cbordiag | ||
| cose_keyset.pcap | ||
| cose_mac0_tagged.cbordiag | ||
| cose_mac0_tagged.pcap | ||
| cose_mac_tagged.cbordiag | ||
| cose_mac_tagged.pcap | ||
| cose_sign1_tagged.cbordiag | ||
| cose_sign1_tagged.pcap | ||
| cose_sign_tagged.cbordiag | ||
| cose_sign_tagged.pcap | ||
| dhcp-nanosecond.pcap | ||
| dhcp-nanosecond.pcapng | ||
| dhcp.pcap | ||
| dhcp.pcapng | ||
| dhe1.pcapng.gz | ||
| dmgr.pcapng | ||
| dns+icmp.pcapng.gz | ||
| dns-ooo.pcap | ||
| dns_port.pcap | ||
| dtls12-aes128ccm8-dsb.pcapng | ||
| dtls12-aes128ccm8.pcap | ||
| dtn_tcpclv3_bpv6_transfer.pcapng | ||
| dtn_tcpclv4_bpv7_transfer.pcapng | ||
| dtn_udpcl_bpv7_bpsec_bcb_admin.cbordiag | ||
| dtn_udpcl_bpv7_bpsec_bcb_admin.pcapng | ||
| dtn_udpcl_bpv7_bpsec_bib_admin.cbordiag | ||
| dtn_udpcl_bpv7_bpsec_bib_admin.pcapng | ||
| dvb-ci_UV1_0000.pcap | ||
| empty.pcap | ||
| esp-bug-12671.pcapng.gz | ||
| gitOverTCP.pcap | ||
| grpc_person_search_json_with_image.pcapng.gz | ||
| grpc_person_search_protobuf_with_image-missing_headers.pcapng.gz | ||
| grpc_person_search_protobuf_with_image.pcapng.gz | ||
| grpc_stream_reassembly_sample.pcapng.gz | ||
| grpc_web.pcapng.gz | ||
| http-brotli.pcapng | ||
| http-ooo.pcap | ||
| http-ooo2.pcap | ||
| http.pcap | ||
| http2-brotli.pcapng | ||
| http2-data-reassembly.pcap | ||
| http2_follow_multistream.pcapng | ||
| icmp.pcapng.gz | ||
| ikev1-bug-12610.pcapng.gz | ||
| ikev1-bug-12620.pcapng.gz | ||
| ikev1-certs.pcap | ||
| ikev2-decrypt-3des-sha1_160.pcap | ||
| ikev2-decrypt-aes128ccm12-2.pcap | ||
| ikev2-decrypt-aes128ccm12.pcap | ||
| ikev2-decrypt-aes192ctr.pcap | ||
| ikev2-decrypt-aes256cbc.pcapng | ||
| ikev2-decrypt-aes256ccm16.pcapng | ||
| ikev2-decrypt-aes256gcm8.pcap | ||
| ikev2-decrypt-aes256gcm16.pcap | ||
| ipoipoip.pcap | ||
| ipv6.pcap | ||
| ipx_rip.pcap | ||
| knxip_DataSec.pcap | ||
| knxip_SecureWrapper.pcap | ||
| knxip_TimerNotify.pcap | ||
| krb-816.pcap.gz | ||
| many_interfaces.pcapng.1 | ||
| many_interfaces.pcapng.2 | ||
| many_interfaces.pcapng.3 | ||
| netperfmeter.pcapng.gz | ||
| nfs.pcap | ||
| ntp.pcap | ||
| owe.pcapng.gz | ||
| packet-h2-14_headers.pcapng | ||
| protobuf_tcp_addressbook.pcapng.gz | ||
| protobuf_test_default_value.pcapng | ||
| protobuf_test_leading_dot.pcapng | ||
| protobuf_test_map_and_oneof_types.pcapng | ||
| protobuf_udp_addressbook_with_image_ts.pcapng | ||
| quic-fragmented-handshakes.pcapng.gz | ||
| quic_follow_multistream.pcapng | ||
| retrans-tls.pcap | ||
| rsa-p-lt-q.pcap | ||
| rsasnakeoil2.pcap | ||
| s7comm-fuzz.pcapng.gz | ||
| sample_control4_2012-03-24.pcap | ||
| segmented_fpm.pcap | ||
| sip.pcapng | ||
| sipmsg.log | ||
| smb300-aes-128-ccm.pcap.gz | ||
| smb311-aes-128-ccm.pcap.gz | ||
| smb311-aes-128-gcm.pcap.gz | ||
| smb311-aes-256-ccm.pcap.gz | ||
| smb311-aes-256-gcm.pcap.gz | ||
| smb311-chained-patternv1-lznt1.pcapng.gz | ||
| smb311-lz77-lz77huff-lznt1.pcap.gz | ||
| snakeoil-dtls.pcap | ||
| tcp-badsegments.pcap | ||
| tcp-exp-option-tarr.pcap.gz | ||
| text2pcap_hash_eol.txt | ||
| tftp.pcap | ||
| tls-fragmented-handshakes.pcap.gz | ||
| tls-renegotiation.pcap | ||
| tls12-aes128ccm.pcap | ||
| tls12-aes256gcm.pcap | ||
| tls12-chacha20poly1305.pcap | ||
| tls12-dsb.pcapng | ||
| tls13-20-chacha20poly1305.pcap | ||
| tls13-rfc8446.pcap | ||
| udt-dtls.pcapng.gz | ||
| wep.pcapng.gz | ||
| wireguard-ping-tcp-dsb.pcapng | ||
| wireguard-ping-tcp.pcap | ||
| wireguard-psk.pcap | ||
| wpa-Induction.pcap.gz | ||
| wpa-ccmp-256.pcapng.gz | ||
| wpa-eap-tls.pcap.gz | ||
| wpa-gcmp-256.pcapng.gz | ||
| wpa-gcmp.pcapng.gz | ||
| wpa-test-decode-mgmt.pcap.gz | ||
| wpa-test-decode-tdls.pcap.gz | ||
| wpa-test-decode.pcap.gz | ||
| wpa1-gtk-rekey.pcapng.gz | ||
| wpa2-ft-eap.pcapng.gz | ||
| wpa2-ft-psk.pcapng.gz | ||
| wpa2-psk-mfp.pcapng.gz | ||
| wpa3-sae.pcapng.gz | ||
| wpa3-suiteb-192.pcapng.gz | ||
| wpa_ptk_extended_key_id.pcap.gz | ||