Commit graph

866 commits

Author SHA1 Message Date
Gilbert Ramirez
46420eee18 Update man page with new bytestring methods (negative offsets, implied
byte-string lengths).

svn path=/trunk/; revision=834
1999-10-14 17:21:12 +00:00
Jun-ichiro itojun Hagino
d856a9cee2 add string IP protocol name into info field of fragmented packet.
svn path=/trunk/; revision=833
1999-10-14 16:46:55 +00:00
Guy Harris
154265bd94 Put back the "%expect 4" that I accidentally deleted.
svn path=/trunk/; revision=832
1999-10-14 08:05:51 +00:00
Guy Harris
1655671f9a Include <arpa/inet.h>, so we get a declaration of "inet_ntop()" on
systems that declare it there.

svn path=/trunk/; revision=831
1999-10-14 07:39:44 +00:00
Guy Harris
ae276ffe20 Make it build on systems lacking "inet_pton()", "inet_ntop()", and a
definition of "AF_INET6".  Declare those functions and, if it's not
defined, define "AF_INET6" in "inet_v6defs.h", and arrange to include
it if "inet_ntop()" is missing.  (Systems will probably have both of
them or lack both of them, and we may choose not to use the system's
"inet_pton()" because it's buggy, so base the decision on whether to
include "inet_v6defs.h" on whether we're using the system's
"inet_ntop()" or not.)  Fix some macro references in "Makefile.am" and
"configure.in".

svn path=/trunk/; revision=830
1999-10-14 06:55:11 +00:00
Jun-ichiro itojun Hagino
831497b33e use inet_pton() and inet_ntop(), which are RFC2553 standard function
for converting IPv[46] numeric notation to/from binary form.
recent BIND includes those functions so fallback is not necessary on
most of the platforms.
sorry if it raises any portability problem on other platforms.

remove partial inclusion of inet_ntop() in packet-ipv6.c.

move ip6_to_str() to packet.c, it fits better there than packet-ipv6.c.

svn path=/trunk/; revision=829
1999-10-14 05:41:33 +00:00
Guy Harris
5ed4011c30 Nathan Neulinger's NTP dissector.
svn path=/trunk/; revision=828
1999-10-14 05:10:33 +00:00
Jun-ichiro itojun Hagino
810a67a6d0 implement ipprotostr() in ipproto.c, which basically does ipprotobynumber()
for ip.ip_p and ip6.ip6_nxt (and other IPv6 header chain).

use val_to_str() as much as possible in dissect_{ipv6,pim,ripng}().

make --disable-zlib a default for netbsd (temporary workaround).

svn path=/trunk/; revision=827
1999-10-14 03:50:51 +00:00
Guy Harris
92907001c3 Updates from Nathan Neulinger.
svn path=/trunk/; revision=826
1999-10-14 03:12:32 +00:00
Guy Harris
8b592e44a5 Include "snprintf.h" on systems that don't declare "snprintf()" in a
system header file.

svn path=/trunk/; revision=825
1999-10-14 01:39:47 +00:00
Guy Harris
364274edf3 Nathan Neulinger's dissector for the Yahoo messenger and pager
protocols.

svn path=/trunk/; revision=824
1999-10-14 01:29:07 +00:00
Gilbert Ramirez
a5d9095528 Move tunnelled protocols up a few trees to co-exist with the
other protocols.

svn path=/trunk/; revision=823
1999-10-13 15:25:21 +00:00
Guy Harris
93d58bf824 Jun-ichiro itojun Hagino's code for PIM, and some fixes from him as
well.

Add some more protocols to the list of value/string pairs for IP
protocol types.

svn path=/trunk/; revision=822
1999-10-13 06:47:49 +00:00
Guy Harris
98ce0fcfab Fix the
Field "XXX" has N byte[s] being compared, but M byte[s] were
	supplied.

and the

	The "XXX" field is only N byte[s] wide, but M byte[s] were
	supplied.

messages to have "was supplied" if M is 1.

svn path=/trunk/; revision=821
1999-10-13 06:01:04 +00:00
Gilbert Ramirez
c00955d8fb Use %d to sprintf FT_INT* into proto_tree instead of %u.
svn path=/trunk/; revision=820
1999-10-13 03:07:30 +00:00
Guy Harris
3c543a4db7 Some fixes from Jun-ichiro itojun Hagino.
svn path=/trunk/; revision=819
1999-10-13 02:04:04 +00:00
Guy Harris
66d84f1093 Jun-ichiro itojun Hagino's changes for IPv6 extension header decoding
and RIPng decoding.

svn path=/trunk/; revision=818
1999-10-12 23:12:06 +00:00
Gilbert Ramirez
d92cf5c84b Add FT_UINT24 and FT_INT24 to a spot where they were missing.
svn path=/trunk/; revision=817
1999-10-12 22:51:58 +00:00
Gilbert Ramirez
7cffbb1bad Fix byte-count of IPv6 addresses.
svn path=/trunk/; revision=816
1999-10-12 19:47:44 +00:00
Gilbert Ramirez
bacb9d5bae New proto_tree header_field_info stuff. Header_field_infos now contain
the base for numbers to be displayed in, bitmasks for bitfields, and blurbs
(which are one or two sentences describing the field).

proto_tree_add*() routines now automatically handle bitfields. You tell
it which header field you are adding, and just pass it the value of the
entire field, and the proto_tree routines will do the masking and shifting
for you.

This means that bitfields are more naturally filtered via dfilter now.

Added Phil Techau's support for signed integers in dfilters/proto_tree.

Added the beginning of the SNA dissector. It's not complete, but I'm
committing it now because it has example after example of how to use
bitfields with the new header_field_info struct and proto_tree routines.
It was the impetus to change how header_field_info works.

svn path=/trunk/; revision=815
1999-10-12 06:21:15 +00:00
Gilbert Ramirez
10c4bab8e1 The 4 shift/reduce conflicts have to do with the associativity of the
logical operators, e.g.:
	NOT expression AND expression
	expression AND expression AND expression

etc. The shift/reduce conflicts _are_resolved (according to the output
from bison -v), so the conflicts seem to be benign.

Right now I marked the 4 shift/reduce conflicts as expected, but perhaps
someone more knowledgable about yacc grammars could take a look at it?

svn path=/trunk/; revision=814
1999-10-12 05:21:07 +00:00
Guy Harris
99e8c65674 In "string_to_value()", make sure the number is valid.
svn path=/trunk/; revision=813
1999-10-12 05:13:32 +00:00
Guy Harris
f3da72ef2f Have "dfilter_compile()" return 0 on success and 1 on failure, and
return the pointer to the compiled filter through a pointer argument.

Have it check whether the filter is a null filter and, if so, free up
the filter and supply a filter pointer, rather than obliging its callers
to check whether the filter actually has any code.  (Well, they may want
to check if the filter is null, so that they don't save a pointer to the
filter text, e.g. so that the display filter displays as "none" rather
than as a blank string in the summary box.)

In the process, fix the check in "gtk/file_dlg.c" that tests whether the
read filter compiled successfully.

svn path=/trunk/; revision=812
1999-10-12 05:01:07 +00:00
Gilbert Ramirez
1efcb7b2cf Re-implemented fix to keep display filter from reading data from outside
the packet boundary. Now the field boundary is honored. The frame boundary
is ignored, but of course we put proper field lengths in the proto_tree,
right? :)

Implemented negative offsets in byte-strings:
	frame[-4:4] will read the last 4 bytes of a frame.

Implemented "offset-only" byte-string comparisons, since the dfilter
compiler knows the length of the byte-string you supplied. These are
now legal:
	frame[-4] == 0.0.0.1
	tr.dst[0] == 00:06:29

Implemented the use of integers if you're comparing one byte. These are
legal:
	llc[0] == 0xaa
	llc[0:1] == 0xaa

All these forms check against the length of the field, so these will be
reported as bad to the user:
	eth.src[5] == 00:06:29      (goes beyond field boundary)
	eth.dst == 1.2.3.4.5.6.7    (too long, goes beyond field boundary)

Thes is also reported as bad:
	eth.dst[0:3] == 1.2          (incorrect number of bytes specified)
	eth.dst[0:1] == eth.src[0:2] (disparate lengths)

I had to add a new function, proto_registrar_get_length() in proto.c, which
reports the length of a field as can be determined at registration time.

There are some shift/reduce errors in the grammar that I need to get rid of.

svn path=/trunk/; revision=811
1999-10-12 04:21:13 +00:00
Guy Harris
0faf733914 The answer to the question
(Is there a better way to force a parse to fail from arbitrary
	places in routines called by the parser?)

asked in an earlier checkin is "yes", which would've been obvious had I
seen the code that handles MAC addresses, as it returns NULL on an
error, and the YACC clause checks for a null return value and, if the
return value is null, uses YYERROR to make the parse fail.

Use that for IPv4 and IPv6 errors.

Also, use "dfilter_fail()" for the MAC address code.

svn path=/trunk/; revision=810
1999-10-11 19:39:29 +00:00
Guy Harris
817465175d Oops! Forgot to commit the change that adds Christophe Tronche to the
list of authors.

svn path=/trunk/; revision=809
1999-10-11 18:04:48 +00:00
Laurent Deniel
2e08b800b4 - add handling of FT_IPv6 variables
there is still some work to do in resolv.c (get_host_ipaddr6)

- add display filters of this kind in packet-ipv6.c just
  for testing (display filtering is incomplete)

svn path=/trunk/; revision=808
1999-10-11 17:05:49 +00:00
Gilbert Ramirez
c6d6deee3c Fixed bug reported by Laurent regarding byte-string filters not
checking the length of the packet before copying bytes from the packet.

svn path=/trunk/; revision=807
1999-10-11 14:58:04 +00:00
Laurent Deniel
a2bfe213c5 Add display filters
svn path=/trunk/; revision=806
1999-10-11 12:37:50 +00:00
Guy Harris
fa489de71b Solaris 7 doesn't have "inet_aton()", either; supply our own version on
OSes that don't have it.

(Yes, this is BSD code, not GPLed code.  I tried getting it from Glibc,
but the glibc version is just the BSD version, so I guess it's OK to mix
BSD code in with GPLed code, or, at least, with LGPLed code....)

svn path=/trunk/; revision=805
1999-10-11 07:38:21 +00:00
Guy Harris
6b5159e8de Solaris 7 (and perhaps other OSes) lack INADDR_NONE; it doesn't matter
what we set "node->value.numeric" to if we failed to convert a string to
an IP address (that failure means "dfilter_compile()" will throw the
filter away and return NULL), so just set it to 0.

svn path=/trunk/; revision=804
1999-10-11 07:06:43 +00:00
Guy Harris
3b9013d393 When a new display filter is to be applied, don't set "cf.dfilter" or
"cf.dfcode" if the new filter doesn't compile, because the filter
currently in effect will be the one that was last applied - just free up
the text of the new filter, and whatever memory was allocated for the
new filter code.

This means we allocate a new dfilter when a new filter is to be applied,
rather than recycling stuff from the old filter, as we want the old
filter code to remain around if the new filter doesn't compile.

This means that "cf.dfilter" and "cf.dfcode" will be null if there's no
filter in effect.

svn path=/trunk/; revision=803
1999-10-11 06:39:26 +00:00
Guy Harris
29b9c8a285 Have "get_host_ipaddr()" return a Boolean indicating whether it
succeeded or failed, and, if it succeeded, have it fill in the IP
address if found through a pointer passed as the second argument.

Have it first try interpreting its first argument as a dotted-quad IP
address, with "inet_aton()", and, if that fails, have it try to
interpret it as a host name with "gethostbyname()"; don't bother with
"gethostbyaddr()", as we should be allowed to filter on IP addresses
even if there's no host name associated with them (there's no guarantee
that "gethostbyaddr()" will succeed if handed an IP address with no
corresponding name - and it looks as if FreeBSD 3.2, at least, may not
succeed in that case).

Add a "dfilter_fail()" routine that takes "printf()"-like arguments and
uses them to set an error message for the parse; doing so means that
even if the filter expression is syntactically valid, we treat it as
being invalid.  (Is there a better way to force a parse to fail from
arbitrary places in routines called by the parser?)

Use that routine in the lexical analyzer.

If that error message was set, use it as is as the failure message,
rather than adding "Unable to parse filter string XXX" to it.

Have the code to handle IP addresses and host names in display filters
check whether "get_host_ipaddr()" succeeded or failed and, if it failed,
arrange that the parse fail with an error message indicating the source
of the problem.

svn path=/trunk/; revision=802
1999-10-11 03:03:12 +00:00
Guy Harris
5779d0b754 The #defines to turn "yy{lex,error}" into names specific to the
parser/lexical analyzer in question are needed only in the ".c" files
for the generated parser and lexical analyzer, and Flex and Byacc/Bison
put them there; don't bother putting them in a header file, just
directly declare the functions with the right names.

svn path=/trunk/; revision=801
1999-10-10 18:16:43 +00:00
Laurent Deniel
79019e8369 Add reference to tcpdump manual page for capture filter syntax.
svn path=/trunk/; revision=800
1999-10-10 16:25:28 +00:00
Laurent Deniel
a7e879775e Add display filters.
svn path=/trunk/; revision=799
1999-10-10 16:09:33 +00:00
Richard Sharpe
42b64a7584 Big bunch of fixes to packet-smb.c for things I need.
Also added first pass of state keeping. I am using glib's hash
functions.

Modelled after packet-ncp.c.

We will need to standardize the <proto>_init_protocol functions called in
file.c at some stage ...

I will have a couple of more goes at the state keeping before I am finished.
At the moment, the infrastructure is there but I do nothing with it.

svn path=/trunk/; revision=798
1999-10-10 11:50:45 +00:00
Gilbert Ramirez
8cdaeb0adc Changed the macro XDLC_HAS_PAYLOAD(control) to look at only the first
bit of 'control' to check to see if it's an information frame:

#define XDLC_HAS_PAYLOAD(control) \
        (((control) & 0x1) == XDLC_I || (control) == (XDLC_UI|XDLC_U))

I had erroneously AND'ed with 0x3 when I first put the AND in there.

svn path=/trunk/; revision=797
1999-10-10 03:59:29 +00:00
Laurent Deniel
8333e3b3cf Fix a typo in error message.
svn path=/trunk/; revision=796
1999-10-09 14:14:53 +00:00
Laurent Deniel
69cc7f5b6b - fix a segmentation violation with big "match selected" filters.
- fix a memory leak.

svn path=/trunk/; revision=795
1999-10-09 14:05:04 +00:00
Laurent Deniel
d140e8d7c7 Add display filters.
svn path=/trunk/; revision=794
1999-10-09 13:31:30 +00:00
Laurent Deniel
30a10446da - dissect data if type unknown
- add display filters

svn path=/trunk/; revision=793
1999-10-09 13:05:55 +00:00
Laurent Deniel
bedd4c9d82 - correct bound checkings in string parsing
- add display filters

svn path=/trunk/; revision=792
1999-10-09 11:56:15 +00:00
Guy Harris
73729dd8b8 The abbreviation for a protocol is generally all-lower-case, as it's
used as a display filter to match all packets that contain data for that
protocol.

svn path=/trunk/; revision=791
1999-10-08 21:20:23 +00:00
Guy Harris
93b7dfe367 Christophe Tronche's BPDU dissector.
svn path=/trunk/; revision=790
1999-10-08 20:50:39 +00:00
Laurent Deniel
0b88b72377 Add display filters.
svn path=/trunk/; revision=789
1999-10-08 13:57:31 +00:00
Guy Harris
05af0607de Move some definitions of stuff not used outside the Lucent/Ascend
capture file reading code from "ascend.h" to "ascend-int.h".

svn path=/trunk/; revision=788
1999-10-08 07:45:31 +00:00
Guy Harris
21f0e54e7f Add an "ascend-int.h" file, to declare routines used by more than one of
the files in the Lucent/Ascend capture file code.

svn path=/trunk/; revision=787
1999-10-08 07:41:33 +00:00
Guy Harris
50f137829c Include "main.h", to pull in the external declarations of several
routines defined in this file.

svn path=/trunk/; revision=786
1999-10-08 07:31:10 +00:00
Guy Harris
07790d8e19 Fix the include-guard #define to be "__MAIN_H__", matching the name of
the file.

svn path=/trunk/; revision=785
1999-10-08 07:29:42 +00:00