I'd like to share my enhancements to the TDS dissector with everyone.
The list of improvements follows:
- nearly complete dissection of RPC calls,
- detection and dissection of the ALL_HEADERS rule,
- corrected some existing proto_tree fields to support filters,
- other minor fixes where the interpretation of data conflicted with the
  official documentation from MS.

I tested the new code on a variety of different TDS captures with many diverse
RPC calls. The code compiles and works on 32-bit Linux, I didn't check those
changes on other platforms though.

From me:

- terminate all value_strings
- change ++*offset to *offset += 1 (I think that's more readable)
- replace all the dissector assertions which could be caused by malformed
  packets with expert infos
- Don't throw ReportedBoundsError when the packets have unexpected data in
  them, just report an expert info and continue on

svn path=/trunk/; revision=35007
This commit is contained in:
Jeff Morriss 2010-11-22 18:48:54 +00:00
parent cf794aea59
commit 1b04b1b765
2 changed files with 1066 additions and 122 deletions

View File

@ -3202,6 +3202,10 @@ Stéphane Bryant <stephane [AT] glycon.org> {
RELOAD Framing dissector
}
Emil Wojak <emil [AT] wojak.eu>
TDS dissector improvements
}
and by:
Pavel Roskin <proski [AT] gnu.org>

File diff suppressed because it is too large Load Diff