1998-09-16 02:39:15 +00:00
|
|
|
/* packet-udp.c
|
|
|
|
* Routines for UDP packet disassembly
|
|
|
|
*
|
2002-08-28 21:04:11 +00:00
|
|
|
* $Id: packet-udp.c,v 1.105 2002/08/28 21:00:36 jmayer Exp $
|
1998-09-16 03:22:19 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* Ethereal - Network traffic analyzer
|
2001-04-23 17:51:37 +00:00
|
|
|
* By Gerald Combs <gerald@ethereal.com>
|
1998-09-16 02:39:15 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
2002-08-28 21:04:11 +00:00
|
|
|
* Richard Sharpe, 13-Feb-1999, added dispatch table support and
|
1999-02-15 06:36:57 +00:00
|
|
|
* support for tftp.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
2002-08-28 21:04:11 +00:00
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
|
|
|
|
1999-03-23 03:14:46 +00:00
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
2000-11-05 09:26:47 +00:00
|
|
|
#include <string.h>
|
1999-03-23 03:14:46 +00:00
|
|
|
|
|
|
|
#include <glib.h>
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/packet.h>
|
|
|
|
#include <epan/resolv.h>
|
2001-04-23 17:51:37 +00:00
|
|
|
#include "ipproto.h"
|
2000-12-13 02:24:23 +00:00
|
|
|
#include "in_cksum.h"
|
2001-05-23 03:33:59 +00:00
|
|
|
#include "prefs.h"
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2000-04-16 22:46:25 +00:00
|
|
|
#include "packet-udp.h"
|
1999-12-09 20:43:38 +00:00
|
|
|
|
2000-04-16 22:46:25 +00:00
|
|
|
#include "packet-ip.h"
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/conversation.h>
|
2000-02-15 21:06:58 +00:00
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
static int proto_udp = -1;
|
1999-11-16 11:44:20 +00:00
|
|
|
static int hf_udp_srcport = -1;
|
|
|
|
static int hf_udp_dstport = -1;
|
|
|
|
static int hf_udp_port = -1;
|
|
|
|
static int hf_udp_length = -1;
|
|
|
|
static int hf_udp_checksum = -1;
|
2001-02-28 19:33:49 +00:00
|
|
|
static int hf_udp_checksum_bad = -1;
|
1999-11-16 11:44:20 +00:00
|
|
|
|
|
|
|
static gint ett_udp = -1;
|
1999-07-22 16:41:22 +00:00
|
|
|
|
2001-05-23 03:33:59 +00:00
|
|
|
/* Place UDP summary in proto tree */
|
|
|
|
static gboolean udp_summary_in_tree = TRUE;
|
|
|
|
|
1999-03-23 03:14:46 +00:00
|
|
|
/* UDP structs and definitions */
|
|
|
|
|
|
|
|
typedef struct _e_udphdr {
|
|
|
|
guint16 uh_sport;
|
|
|
|
guint16 uh_dport;
|
|
|
|
guint16 uh_ulen;
|
|
|
|
guint16 uh_sum;
|
|
|
|
} e_udphdr;
|
|
|
|
|
2000-04-03 09:24:12 +00:00
|
|
|
static dissector_table_t udp_dissector_table;
|
2000-07-14 12:53:00 +00:00
|
|
|
static heur_dissector_list_t heur_subdissector_list;
|
2001-11-26 04:52:51 +00:00
|
|
|
static dissector_handle_t data_handle;
|
1999-02-15 06:36:57 +00:00
|
|
|
|
2000-04-12 22:53:16 +00:00
|
|
|
/* Determine if there is a sub-dissector and call it. This has been */
|
|
|
|
/* separated into a stand alone routine to other protocol dissectors */
|
|
|
|
/* can call to it, ie. socks */
|
1999-10-02 16:58:41 +00:00
|
|
|
|
2000-04-17 02:39:55 +00:00
|
|
|
void
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
decode_udp_ports(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
|
|
proto_tree *tree, int uh_sport, int uh_dport)
|
Allow either old-style (pre-tvbuff) or new-style (tvbuffified)
dissectors to be registered as dissectors for particular ports,
registered as heuristic dissectors, and registered as dissectors for
conversations, and have routines to be used both by old-style and
new-style dissectors to call registered dissectors.
Have the code that calls those dissectors translate the arguments as
necessary. (For conversation dissectors, replace
"find_conversation_dissector()", which just returns a pointer to the
dissector, with "old_try_conversation_dissector()" and
"try_conversation_dissector()", which actually call the dissector, so
that there's a single place at which we can do that translation. Also
make "dissector_lookup()" static and, instead of calling it and, if it
returns a non-null pointer, calling that dissector, just use
"old_dissector_try_port()" or "dissector_try_port()", for the same
reason.)
This allows some dissectors that took old-style arguments and
immediately translated them to new-style arguments to just take
new-style arguments; make them do so. It also allows some new-style
dissectors not to have to translate arguments before calling routines to
look up and call dissectors; make them not do so.
Get rid of checks for too-short frames in new-style dissectors - the
tvbuff code does those checks for you.
Give the routines to register old-style dissectors, and to call
dissectors from old-style dissectors, names beginning with "old_", with
the routines for new-style dissectors not having the "old_". Update the
dissectors that use those routines appropriately.
Rename "dissect_data()" to "old_dissect_data()", and
"dissect_data_tvb()" to "dissect_data()".
svn path=/trunk/; revision=2218
2000-08-07 03:21:25 +00:00
|
|
|
{
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
tvbuff_t *next_tvb;
|
2002-06-08 21:54:52 +00:00
|
|
|
int low_port, high_port;
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
|
|
|
|
next_tvb = tvb_new_subset(tvb, offset, -1, -1);
|
|
|
|
|
2000-04-12 22:53:16 +00:00
|
|
|
/* determine if this packet is part of a conversation and call dissector */
|
|
|
|
/* for the conversation if available */
|
1999-07-22 16:41:22 +00:00
|
|
|
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
if (try_conversation_dissector(&pinfo->src, &pinfo->dst, PT_UDP,
|
|
|
|
uh_sport, uh_dport, next_tvb, pinfo, tree))
|
2001-01-28 21:17:29 +00:00
|
|
|
return;
|
1999-12-09 20:43:38 +00:00
|
|
|
|
2002-06-08 21:54:52 +00:00
|
|
|
/* Do lookups with the subdissector table.
|
|
|
|
We try the port number with the lower value first, followed by the
|
|
|
|
port number with the higher value. This means that, for packets
|
|
|
|
where a dissector is registered for *both* port numbers:
|
|
|
|
|
|
|
|
1) we pick the same dissector for traffic going in both directions;
|
|
|
|
|
|
|
|
2) we prefer the port number that's more likely to be the right
|
|
|
|
one (as that prefers well-known ports to reserved ports);
|
|
|
|
|
|
|
|
although there is, of course, no guarantee that any such strategy
|
|
|
|
will always pick the right port number.
|
|
|
|
|
|
|
|
XXX - we ignore port numbers of 0, as some dissectors use a port
|
|
|
|
number of 0 to disable the port, and as RFC 768 says that the source
|
|
|
|
port in UDP datagrams is optional and is 0 if not used. */
|
|
|
|
if (uh_sport > uh_dport) {
|
|
|
|
low_port = uh_dport;
|
|
|
|
high_port = uh_sport;
|
|
|
|
} else {
|
|
|
|
low_port = uh_sport;
|
|
|
|
high_port = uh_dport;
|
|
|
|
}
|
|
|
|
if (low_port != 0 &&
|
|
|
|
dissector_try_port(udp_dissector_table, low_port, next_tvb, pinfo, tree))
|
|
|
|
return;
|
|
|
|
if (high_port != 0 &&
|
|
|
|
dissector_try_port(udp_dissector_table, high_port, next_tvb, pinfo, tree))
|
2000-04-17 02:39:55 +00:00
|
|
|
return;
|
|
|
|
|
2000-07-14 12:53:00 +00:00
|
|
|
/* do lookup with the heuristic subdissector table */
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree))
|
2000-07-14 12:53:00 +00:00
|
|
|
return;
|
|
|
|
|
2001-11-26 04:52:51 +00:00
|
|
|
call_dissector(data_handle,next_tvb, pinfo, tree);
|
1998-09-16 02:39:15 +00:00
|
|
|
}
|
1999-07-22 16:41:22 +00:00
|
|
|
|
2000-04-12 22:53:16 +00:00
|
|
|
|
2000-04-20 07:05:58 +00:00
|
|
|
static void
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
dissect_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
2000-04-12 22:53:16 +00:00
|
|
|
e_udphdr uh;
|
|
|
|
guint16 uh_sport, uh_dport, uh_ulen, uh_sum;
|
|
|
|
proto_tree *udp_tree;
|
|
|
|
proto_item *ti;
|
2000-12-13 02:24:23 +00:00
|
|
|
guint len;
|
|
|
|
guint reported_len;
|
|
|
|
vec_t cksum_vec[4];
|
|
|
|
guint32 phdr[2];
|
|
|
|
guint16 computed_cksum;
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
int offset = 0;
|
2000-04-12 22:53:16 +00:00
|
|
|
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_PROTOCOL))
|
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "UDP");
|
|
|
|
if (check_col(pinfo->cinfo, COL_INFO))
|
|
|
|
col_clear(pinfo->cinfo, COL_INFO);
|
2000-04-12 22:53:16 +00:00
|
|
|
|
|
|
|
/* Avoids alignment problems on many architectures. */
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
tvb_memcpy(tvb, (guint8 *)&uh, offset, sizeof(e_udphdr));
|
2002-08-02 23:36:07 +00:00
|
|
|
uh_sport = g_ntohs(uh.uh_sport);
|
|
|
|
uh_dport = g_ntohs(uh.uh_dport);
|
|
|
|
uh_ulen = g_ntohs(uh.uh_ulen);
|
|
|
|
uh_sum = g_ntohs(uh.uh_sum);
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_INFO))
|
|
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "Source port: %s Destination port: %s",
|
2000-04-12 22:53:16 +00:00
|
|
|
get_udp_port(uh_sport), get_udp_port(uh_dport));
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2000-04-12 22:53:16 +00:00
|
|
|
if (tree) {
|
2001-05-23 03:33:59 +00:00
|
|
|
if (udp_summary_in_tree) {
|
|
|
|
ti = proto_tree_add_protocol_format(tree, proto_udp, tvb, offset, 8,
|
|
|
|
"User Datagram Protocol, Src Port: %s (%u), Dst Port: %s (%u)",
|
|
|
|
get_udp_port(uh_sport), uh_sport, get_udp_port(uh_dport), uh_dport);
|
|
|
|
} else {
|
|
|
|
ti = proto_tree_add_item(tree, proto_udp, tvb, offset, 8, FALSE);
|
|
|
|
}
|
2000-04-12 22:53:16 +00:00
|
|
|
udp_tree = proto_item_add_subtree(ti, ett_udp);
|
|
|
|
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_srcport, tvb, offset, 2, uh_sport,
|
2000-04-12 22:53:16 +00:00
|
|
|
"Source port: %s (%u)", get_udp_port(uh_sport), uh_sport);
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_dstport, tvb, offset + 2, 2, uh_dport,
|
2000-04-12 22:53:16 +00:00
|
|
|
"Destination port: %s (%u)", get_udp_port(uh_dport), uh_dport);
|
|
|
|
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
proto_tree_add_uint_hidden(udp_tree, hf_udp_port, tvb, offset, 2, uh_sport);
|
|
|
|
proto_tree_add_uint_hidden(udp_tree, hf_udp_port, tvb, offset+2, 2, uh_dport);
|
2000-04-12 22:53:16 +00:00
|
|
|
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
proto_tree_add_uint(udp_tree, hf_udp_length, tvb, offset + 4, 2, uh_ulen);
|
2000-12-13 02:24:23 +00:00
|
|
|
reported_len = tvb_reported_length(tvb);
|
|
|
|
len = tvb_length(tvb);
|
|
|
|
if (uh_sum == 0) {
|
|
|
|
/* No checksum supplied in the packet. */
|
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_checksum, tvb,
|
|
|
|
offset + 6, 2, uh_sum, "Checksum: 0x%04x (none)", uh_sum);
|
2001-09-27 10:19:14 +00:00
|
|
|
} else if (!pinfo->fragmented && len >= reported_len && len >= uh_ulen) {
|
2000-12-13 02:24:23 +00:00
|
|
|
/* The packet isn't part of a fragmented datagram and isn't
|
|
|
|
truncated, so we can checksum it.
|
|
|
|
XXX - make a bigger scatter-gather list once we do fragment
|
|
|
|
reassembly? */
|
|
|
|
|
|
|
|
/* Set up the fields of the pseudo-header. */
|
|
|
|
cksum_vec[0].ptr = pinfo->src.data;
|
|
|
|
cksum_vec[0].len = pinfo->src.len;
|
|
|
|
cksum_vec[1].ptr = pinfo->dst.data;
|
|
|
|
cksum_vec[1].len = pinfo->dst.len;
|
|
|
|
cksum_vec[2].ptr = (const guint8 *)&phdr;
|
|
|
|
switch (pinfo->src.type) {
|
|
|
|
|
|
|
|
case AT_IPv4:
|
2002-08-02 23:36:07 +00:00
|
|
|
phdr[0] = g_htonl((IP_PROTO_UDP<<16) + reported_len);
|
2000-12-13 02:24:23 +00:00
|
|
|
cksum_vec[2].len = 4;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case AT_IPv6:
|
2002-08-02 23:36:07 +00:00
|
|
|
phdr[0] = g_htonl(reported_len);
|
|
|
|
phdr[1] = g_htonl(IP_PROTO_UDP);
|
2000-12-13 02:24:23 +00:00
|
|
|
cksum_vec[2].len = 8;
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
/* TCP runs only atop IPv4 and IPv6.... */
|
|
|
|
g_assert_not_reached();
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
cksum_vec[3].ptr = tvb_get_ptr(tvb, offset, len);
|
|
|
|
cksum_vec[3].len = reported_len;
|
|
|
|
computed_cksum = in_cksum(&cksum_vec[0], 4);
|
|
|
|
if (computed_cksum == 0) {
|
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_checksum, tvb,
|
|
|
|
offset + 6, 2, uh_sum, "Checksum: 0x%04x (correct)", uh_sum);
|
|
|
|
} else {
|
2001-03-28 21:33:31 +00:00
|
|
|
proto_tree_add_boolean_hidden(udp_tree, hf_udp_checksum_bad, tvb,
|
2001-02-28 19:33:49 +00:00
|
|
|
offset + 6, 2, TRUE);
|
2000-12-13 02:24:23 +00:00
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_checksum, tvb,
|
|
|
|
offset + 6, 2, uh_sum,
|
|
|
|
"Checksum: 0x%04x (incorrect, should be 0x%04x)", uh_sum,
|
|
|
|
in_cksum_shouldbe(uh_sum, computed_cksum));
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
proto_tree_add_uint_format(udp_tree, hf_udp_checksum, tvb,
|
|
|
|
offset + 6, 2, uh_sum, "Checksum: 0x%04x", uh_sum);
|
|
|
|
}
|
2000-04-12 22:53:16 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Skip over header */
|
|
|
|
offset += 8;
|
|
|
|
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
pinfo->ptype = PT_UDP;
|
|
|
|
pinfo->srcport = uh_sport;
|
|
|
|
pinfo->destport = uh_dport;
|
2000-04-12 22:53:16 +00:00
|
|
|
|
|
|
|
/* call sub-dissectors */
|
Tvbuffify the IP, ICMP, TCP, UDP, OSI CLNP, OSI COTP, OSI CLTP, and OSI
ESIS dissectors.
Register the IP dissector and have dissectors that call it directly
(rather than through a port table) call it through a handle.
Add a routine "tvb_set_reported_length()" which a dissector can use if
it was handed a tvbuff that contains more data than is actually in its
part of the packet - for example, handing a padded Ethernet frame to IP;
the routine sets the reported length of the tvbuff (and also adjusts the
actual length, as appropriate). Then use it in IP.
Given that, "ethertype()" can determine how much of the Ethernet frame
was actually part of an IP datagram (and can do the same for other
protocols under Ethernet that use "tvb_set_reported_length()"; have it
return the actual length, and have "dissect_eth()" and "dissect_vlan()"
use that to mark trailer data in Ethernet II frames as well as in 802.3
frames.
svn path=/trunk/; revision=2658
2000-11-18 10:38:33 +00:00
|
|
|
decode_udp_ports( tvb, offset, pinfo, tree, uh_sport, uh_dport);
|
2000-04-12 22:53:16 +00:00
|
|
|
|
|
|
|
}
|
|
|
|
|
1999-07-22 16:41:22 +00:00
|
|
|
void
|
|
|
|
proto_register_udp(void)
|
|
|
|
{
|
2001-05-23 03:33:59 +00:00
|
|
|
module_t *udp_module;
|
1999-07-22 16:41:22 +00:00
|
|
|
static hf_register_info hf[] = {
|
|
|
|
{ &hf_udp_srcport,
|
1999-10-12 06:21:15 +00:00
|
|
|
{ "Source Port", "udp.srcport", FT_UINT16, BASE_DEC, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
1999-07-22 16:41:22 +00:00
|
|
|
|
|
|
|
{ &hf_udp_dstport,
|
1999-10-12 06:21:15 +00:00
|
|
|
{ "Destination Port", "udp.dstport", FT_UINT16, BASE_DEC, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
1999-07-22 16:41:22 +00:00
|
|
|
|
|
|
|
{ &hf_udp_port,
|
1999-10-12 06:21:15 +00:00
|
|
|
{ "Source or Destination Port", "udp.port", FT_UINT16, BASE_DEC, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
1999-07-22 16:41:22 +00:00
|
|
|
|
|
|
|
{ &hf_udp_length,
|
1999-10-12 06:21:15 +00:00
|
|
|
{ "Length", "udp.length", FT_UINT16, BASE_DEC, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
1999-07-22 16:41:22 +00:00
|
|
|
|
2001-02-28 19:33:49 +00:00
|
|
|
{ &hf_udp_checksum_bad,
|
|
|
|
{ "Bad Checksum", "udp.checksum_bad", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2001-02-28 19:33:49 +00:00
|
|
|
|
1999-07-22 16:41:22 +00:00
|
|
|
{ &hf_udp_checksum,
|
1999-10-12 06:21:15 +00:00
|
|
|
{ "Checksum", "udp.checksum", FT_UINT16, BASE_HEX, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
1999-07-22 16:41:22 +00:00
|
|
|
};
|
1999-11-16 11:44:20 +00:00
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_udp,
|
|
|
|
};
|
1999-07-22 16:41:22 +00:00
|
|
|
|
2001-01-03 06:56:03 +00:00
|
|
|
proto_udp = proto_register_protocol("User Datagram Protocol",
|
|
|
|
"UDP", "udp");
|
1999-07-22 16:41:22 +00:00
|
|
|
proto_register_field_array(proto_udp, hf, array_length(hf));
|
1999-11-16 11:44:20 +00:00
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
2000-04-03 09:41:31 +00:00
|
|
|
|
|
|
|
/* subdissector code */
|
2001-12-08 06:41:48 +00:00
|
|
|
udp_dissector_table = register_dissector_table("udp.port",
|
|
|
|
"UDP port", FT_UINT16, BASE_DEC);
|
2000-07-14 12:53:00 +00:00
|
|
|
register_heur_dissector_list("udp", &heur_subdissector_list);
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2001-05-23 03:33:59 +00:00
|
|
|
/* Register configuration preferences */
|
|
|
|
udp_module = prefs_register_protocol(proto_udp, NULL);
|
|
|
|
prefs_register_bool_preference(udp_module, "udp_summary_in_tree",
|
2002-08-28 21:04:11 +00:00
|
|
|
"Show UDP summary in protocol tree",
|
2001-05-23 03:33:59 +00:00
|
|
|
"Whether the UDP summary line should be shown in the protocol tree",
|
|
|
|
&udp_summary_in_tree);
|
1999-07-22 16:41:22 +00:00
|
|
|
}
|
2000-04-16 22:46:25 +00:00
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_udp(void)
|
|
|
|
{
|
2001-12-03 04:00:26 +00:00
|
|
|
dissector_handle_t udp_handle;
|
|
|
|
|
|
|
|
udp_handle = create_dissector_handle(dissect_udp, proto_udp);
|
|
|
|
dissector_add("ip.proto", IP_PROTO_UDP, udp_handle);
|
2001-11-26 04:52:51 +00:00
|
|
|
data_handle = find_dissector("data");
|
2000-04-16 22:46:25 +00:00
|
|
|
}
|