add a generated field telling the user and add an expert info entry
This often happens when the capture misses the binding procedure at the beginning of a conversation "capture start too late".
svn path=/trunk/; revision=18687
packet-pktc.c:
Catch an underflow.
packet-ospf.c:
Don't burn CPU cycles unnecessarily.
packet-rpc.c:
Catch an overflow.
packet-mq.c:
Check a header size.
Fix up whitespace.
svn path=/trunk/; revision=18685
packet-diameter.c
- show vendor ID as a decimal number
diameter/chargecontrol.xml
- add more AVP entries from 3GPP TS 32.299 (6.6.0)
svn path=/trunk/; revision=18679
packet-mount.c:
Don't allocate a huge amount of memory.
packet-ntp.c:
Fix a possible format string bug.
packet-ndps.c:
packet-nmas.c:
Fix an off-by-one buffer error.
svn path=/trunk/; revision=18678
- changes the ISUP dissector preference to follow MTP3's preference
rather than having its own (similar to SCCP, M3UA, etc.). I did not
obsolete the old preference because it was never put out in a release
(only SVN users would have seen it). I can change that if desired.
- add dissection of ANSI CRM message
svn path=/trunk/; revision=18661
this also removes several small memory leaks through get_oid_name and get_oid_str_name where the callers nevber freed the data
svn path=/trunk/; revision=18647
packet-diameter.c
--------------------------
I completely reindented dissect_avps() before I made any changes, but
when ignoring white space (in tkdiff, -w plus checking 'Ignore blanks
when diffing'), its easy to see the small changes I've made:
- when fail to find AVP info, show code in tree parent in decimal (as
specs do)
- add an expert info (undecoded, note) to indicate unknown AVP codes
diameter/imscxdx.xml
-------------------------------
- added 'Associated-Identities'
svn path=/trunk/; revision=18641
activate_secondary_pdp_contex_acc - radio priority missing, QoS wrongly dekoded.
Fault in i detach_req: should be ELEM_OPT_TLV
identiy half-octeten ignored.
"Cause" written as "LLC SAPI"
Decoding of TFT.
svn path=/trunk/; revision=18640
attached a patch for the BGP dissector for correct display of
VPLS NLRIs as per the latest spec (draft-ietf-l2vpn-vpls-bgp-08).
svn path=/trunk/; revision=18638
this break old preference settings but as we havent shipped any win32 version with this feature yet it shouldnt be any drama
see wiki for updates on the new format
(we still need many many updates and cleanups to the code but the non-backward compatible preference change must go in asap)
svn path=/trunk/; revision=18609
This should fix some "differ in signedness" warnings (and maybe will raise new ones, which should be fixed at the calling places then)
svn path=/trunk/; revision=18605
Fix Bug 976
Looking at frame 170 in the trace, it looks like
tvb_get_ephemeral_text() struggles with the null character in the middle
of the 4th parameter (in the WWW-Authenticate header) and returns NULL.
The attached patch uses tvb_format_text() instead which also does a
better job of showing the string.
svn path=/trunk/; revision=18589
The patch avoids the crash for unknown messages, adds the Common Id
message dissection which caused it, and also add dissector name
registration for the 2 other protocols which this file can provide.
svn path=/trunk/; revision=18586
ifdef out a few lines of dead code for a feature that is not yet finished
remove two compiler warnings about uninitialized variables (they are not uninitialized, just gcc being dumb)
svn path=/trunk/; revision=18558
replace overly convoluted code with much simpler code.
stateid is a simple 16 byte structure and there is no need to make it more complex than it is.
svn path=/trunk/; revision=18555
1, (minor) the heuristics are too weak and everyting is always decoded either as netapp filehandles or one of the others even when just capturing ibetween say two classic unix boxens
2, (major) you can not filter on specific subfields of the filehandle
observation: 5 people or less in the world care about implementation specific storage of data inside an opaque blob.
remove the too weak heuristics for nfs filehandles.
make decoding of filehandles accorrding to specific implementations controlled by a preference setting.
default this setting to "unknown"
display unknown filehandles using proto_tree_add_item() FT_BYTES/BASE_HEX to make it fitlerable instead of a useless proto_tree_add_text()
wiki needs to be updated tomorrow
svn path=/trunk/; revision=18530
and the weak heuristics often cause wireshark to mistake some segment containing read/write data to be iscsi.
make the heuristics to check that a packet really is iscsi much stronger
svn path=/trunk/; revision=18523
This fixes a redefine of AF_INET6 on AIX 4.3.3. We pull in <sys/socket.h> so the OS can define it first, nullifying the #define in epan/inet_v6defs.h.
svn path=/trunk/; revision=18522
reuse the recent structure for fid->filename mappings since the problemspace is virtually the same
(go to tired of trying to find the sharename in 10mpacket traces with 1000s of shares)
svn path=/trunk/; revision=18516
This needs to be done for all other Create/Open calls as well but would notmally just be 6 lines tyo add.
I rarely see older methods to open files so others using older clients are encoraged to use these 6 lines to the other places where needed.
svn path=/trunk/; revision=18515
add an expansion to the fid that display which frame itr was opened in and when it was closed.
someone may want to add tracking of actual filenames here as well. i am not sure i need that feature myself so ...
svn path=/trunk/; revision=18512
this bug can not currently trigger but if someone would rename the module
in the future then this could potentially cause a null dereference.
svn path=/trunk/; revision=18494
we used the wrong size which caused emem to complain that the canary value had been stomped upon.
another win for the canary feature. thanks gerald
svn path=/trunk/; revision=18491
everytime a ndmp_[scsi|tape]_open is seen create a new itl
we need an itl structure to be able to know what commandset a certain device is using.
svn path=/trunk/; revision=18490
make dissect_scsi_cdb abort with an assert if called with a null pointer for itl.
This means scsi over ndmp will be aborted by an assert sicne ndmp passes a null pointer here always but at least is better than a segv since some cdb's require itl to decode properly.
next checkin will fix ndmp in this regard.
svn path=/trunk/; revision=18489
have neither. For those with MAP_ANON but not MAP_ANONYMOUS, use
MAP_ANON; for those with neither, add some code to use "/dev/zero".
svn path=/trunk/; revision=18488
HP-UX doesn't have MAP_ANON but it does have MAP_ANONYMOUS. Moreoever,
according to mmap(2) on RHEL:
MAP_ANONYMOUS
The mapping is not backed by any file; the fd and offset argu-
ments are ignored. This flag in conjunction with MAP_SHARED is
implemented since Linux 2.4.
MAP_ANON
Alias for MAP_ANONYMOUS. Deprecated.
svn path=/trunk/; revision=18486
to format into a buffer and then pass that buffer.
Make a count an "int" rather than a "size_t" to squelch a (valid)
compiler warning.
svn path=/trunk/; revision=18482
ldap and ldap+sasl
remove a recent ber length validation in packet-ber.c that cant work and breaks reassembly and also makes all ber pacvket sspanning multiple segments show up as malformed packets.
svn path=/trunk/; revision=18465
Check for libgcrypt 1.1.0 (note: I don't know which version
is required, so maybe the version number needs to be changed
for this test to work reliably).
packet-ipsec.c:
- Replace __USE_LIBGCRYPT__ by HAVE_LIBGCRYPT to follow
conventions.
- Warning fixes: signedness in sscanf (%i -> %u)
- Warning fixes: mixed declaration and code
svn path=/trunk/; revision=18460
make the display of the filters more similar to how the ldap c api represents
filters and how they are commonly represented in documentation and other texts.
svn path=/trunk/; revision=18449
Check for printable ASCII - 0x7F is >= 0x20, but it's not printable, and
0x80 through 0xFF aren't ASCII.
Note that we should perhaps be using RFC 2252-style schemas to figure
out which attribute and assertion values are text and which are binary.
svn path=/trunk/; revision=18447
So make the field "frame.marked" visible and tag it as generated.
Move both "time reference" and "marked frame" fields towards the end of the "frame" protocol fields.
Should be copied over to trunk-1.0
svn path=/trunk/; revision=18435
This patch:
- treats the variant field as a variable-length string field. This is
needed for some of the more complicated protocols where the variant
number of the embedded protocol is also represented
- the patch to Makefile.am was not applied from
http://www.wireshark.org/lists/wireshark-dev/200606/msg00009.html
svn path=/trunk/; revision=18427
Added option "ANSI MAP" in Preferences menu, that ansi_map protocol dissector can parse packets with non-standart SSN.
svn path=/trunk/; revision=18358
- shows profile-specific extension data at the end of SR/RR reports (if
packet length has not yet been reached after parsing normal data) and
advances offset (further packets were not recognised+dissected as this
data wasn't being skipped).
- checks that the length of the RTCP data in the whole frame matches the
combined length from the length fields (the last check in RFC 3550, "A.2
RTCP Header Validity Checks") with a generated field and expert info
when wrong.
- reports the length field in all of the message types consistently (the
length was confusingly shown multiplied by 4 only in APP packets...)
svn path=/trunk/; revision=18357
- while parsing fmtp lines, the dissector looks for the MPEG4 'profile-level-id' parameter. If there is no '=' present, it was throwing an exception and the frame marked as malformed (see e.g. the attached
capture)
- I've added a few comments where the code wasn't obvious to me...
svn path=/trunk/; revision=18332
Q.931:I
mprovesthe dissection of Q.931 Channel
Identification information elements, by using proper (filterable) header
fields rather than text tree items.
H253:
make the h.263 dissector dissect the group-of-block
number which comes after a GOB start code.
svn path=/trunk/; revision=18323
H225.cnf
I noticed is that the voip call flow graph does not have a label for the setupAck packet. I traced this to the empty frame_label.
voip_calls.c
It seems to me that in gtk/voip_calls.c tmp_h323info->guid is pointer itself, therefore:
memcmp(&tmp_h323info->guid
should in fact read:
memcmp(tmp_h323info->guid
svn path=/trunk/; revision=18304
if the interval spans the entire 32 bit range.
special case the two common cases when this may happen until a real fix is included.
if the range variable becomes 0 due to 32bit overflow do a g_assert_not_reached to prevent an infinite loop.
this function should be enhanced to work with 64 bit integers.
svn path=/trunk/; revision=18299
- shows profile-specific extension data at the end of SR/RR reports (if
packet length has not yet been reached after parsing normal data) and
advances offset (further packets were not recognised+dissected as this
data wasn't being skipped).
svn path=/trunk/; revision=18245
This version of the patch won't look for the authentication scheme (it
just skips that part for Authentication-Info headers). I tested it
using the enclosed file (pasted from the RFC and fed through
od/text2pcap, then messed around with so I could test the other new
parameters, even if they don't really belong in that header...).
svn path=/trunk/; revision=18244
- h245.asn renamed to MULTIMEDIA-SYSTEM-CONTROL.asn
- rollback changes in .asn sources to keep them in original ITU-T form and put necessary changes into .cnf files
- PER dissectors regenerated
svn path=/trunk/; revision=18238
While in 3GPP spec, the last two (Down/up nextPDCP-PDU seq. no.) would be 2
BYTES. So ethreal could not read the message correctly. We have to modify the
log to make Ethreal analysis it.
Add disection of TargetID.
svn path=/trunk/; revision=18228
doing the reassembly internally in acl instead of calling reassembly.c since the fragmentation is so simple and packets are so small anyway so full reassembly.c support would be overkill.
svn path=/trunk/; revision=18223
this dissector will not yet detect when ppp is passed over the rfcomm link
but the old code to detect and deescapt the ppp data is still in the dissector, though ifdeffed out to serve as inspiration when ppp over rfcomm captures are made available.
the only captures i have with rfcomm are for raw serial communications so they dont contain any ppp frames. :-(
svn path=/trunk/; revision=18221
higher layer protocols need the chandle, cid and direction (from pinfo) in order to identify packets for the same "conversation"
(it is not a conversation per se in bluetooth butn one unidirectional flow that we track)
svn path=/trunk/; revision=18220
acl chandle + direction + l2cap-CID to uniquely identify a single specific
flow of PDU packets.
So we need to pass the chandle upp from acl to l2cap at least.
It would have been nice to handle this using "conversations" but the bluetooth
stack does not eaily map to the idiom host:port<->host:port
instead in bluetooth you have unidirectional flows that are identified by ACL-chandle:L2CAP-CID:direction and additional state held inside l2cap would attach two such flows together into a "conversation".
Bluetooth packets themself only indentify "half" of the two way conversation.
svn path=/trunk/; revision=18218
The UMA-message Handover From UMAN Command includes the complete L3-message (and header) and not only the handover-IE's.
svn path=/trunk/; revision=18215
- Many DCT2000 protocols can be embedded within an IP primitive
message. Add a heuristic to see if we can find the protocol payload
within in IP primitive message, and look for an ethereal dissector
matching the DCT2000 protocol name (this is useful for simple protocol
testing where no physical links are involved)
- Make some more of these protocols (diameter, http, mgcp) findable by name
- Adds protocol 'variant' number to stub and dissector
- Break the duplicated writing of the stub header out into a separate
function
svn path=/trunk/; revision=18212
- step to new ASN.1 API - pass asn_ctx_t* through PER dissectors instead of packet_info*
- PER ALIGNED/UNALIGNED flag moved to asn_ctx_t
- PER created tree item pointer moved to asn_ctx_t
- add nbap into PER dissectors in asn1/Makefile.nmake
- use add_oid_str_name() instead of register_ber_oid_name() in H.225 and H.245
- export asn_ctx_init from library
- PER dissectors regenerated
svn path=/trunk/; revision=18209
buffer argument is a mallocated buffer, so sizeof doesn't return its
size, it returns the size of the pointer to the buffer. Fixes bug 907.
svn path=/trunk/; revision=18186
955 UMA: Handover Command message not decoded.
956 UMA: multirate-configuration not decoded correctly .
957 UMA: Received Signal Level List not decoded.
svn path=/trunk/; revision=18179
if the GetVersionEx() call fails, force the dwPlatformId to VER_PLATFORM_WIN32_WINDOWS so the return value from VirtualProtect() won't trigger an assert.
svn path=/trunk/; revision=18178
- complete dissector for greeting/login packets
- nearly complete dissector for requests, except:
+ parameters for COM_EXECUTE
+ requests from replication slave
- added some features to response dissectors
svn path=/trunk/; revision=18174
- adds application/xpidf+xml as a media type known to be xml
- appends /xml to the protocol column (as SDP does). It would be nice
to append the top-level element, or the name taken from a matching DTD,
but this will do for now (at least its a short name).
- corrects the help text for the preference. I can see that it is
registered as a heuristic for "http", "sip" and "media"
I've also included a slightly updated version of reginfo.dtd (RFC 3680)
for the dtds folder.
svn path=/trunk/; revision=18173
zero-length - oid_to_subid_buf() can be called when we're not in the
middle of a dissection, and throwing a "dissector bug" assertion in that
case is itself a bug.
svn path=/trunk/; revision=18164
bigger than an 8-bit value in it, and guint is too big as we pass
something based on it to a routine expecting a guint16.
svn path=/trunk/; revision=18152
the fragment reassembly from the old patch is commented out since it has to be redone completely using emem and se_trees the proper way.
but to do this i would need example captures of fragmented bluetooth traffic first.
svn path=/trunk/; revision=18149
we need this in order to be able to provide proper itlq structures to the scsi dissector so that response data from scsi is dissected properly.
svn path=/trunk/; revision=18104
Fix bug 833 (remove 'dead' code flagged by Coverity);
Update defines based upon current version of FreeTDS tds.h; Reformat defines for readability;
svn path=/trunk/; revision=18103
Make teh msb of the cmdset variable indicate whether we detected the commandset from the trace or whether we used the default value from preferences.
indicate in the dissection of the packet whether the command set is "known" or whether we are using the default one.
make scsi srt stats work even for when we are using the "default" dommandset. Previously scsi srt would ignore all pdus for itl sessions where the "default" command set was used.
svn path=/trunk/; revision=18098
Most of the time AssertionValue will contain an ascii string so make it always display as a string to make the display "correct" most of the time insterad of being "wrong" most of the time.
There are situations when AssertionValue contains binary data though and in those cases the display will be "wrong" (but not more wrong than the old dissector anyway)
What someone really should do (someone interested in ldap that is) to make it more correct would be to implement a dissector for AssertionValue in the template file and having the dissector check if any of the bytes of the octet string has a value <32 and if so display it in hex as 0x.....
It all bytes have values >=32 then it shoudlk display it as a string "...
instead.
Someone interested in ldap may spend time on this refinement.
svn path=/trunk/; revision=18089
Two more Kerberos error codes where it has been witnessed that the payload contains a PA-DATA structure with the magic salt containing an nt status code
svn path=/trunk/; revision=18088
authesserre samuel <sauthess@gmail.com> kindly pointed out an issue with session renegotiation in the current ssl decryption code.
Encrypted handshake message are decrypted, but the dissector try to interpret the encrypted code. Renegotiation messages are therefore ignored. The attached pcap trace and key can be used to trigger the issue.
The attached patch fix the problem storing the decrypted version of encrypted handshake message and dissecting it when available. The patch also fix bad issue with des cipher (alike the issue fixed in my previous post)
svn path=/trunk/; revision=18081
I attached patch to add preferences in SDP for RTP stream detection. By default SDP decodes RTP stream but now I can disable it.
svn path=/trunk/; revision=18080
structs/unions (GCC supports it "for compatibility with other
compilers"; presumably that's not for compatibility with the version of
Sun C that rejected it - was that a PCCism?).
svn path=/trunk/; revision=18072
programs, by reporting it with a dialog box that at least attempts to
indicate what the problem is, and by giving up early on running dumpcap.
svn path=/trunk/; revision=18051
"struct tcp_multisegment_pdu"; that lets it be used in one case where
the code in it was duplicated.
Make "desegment_tcp()" loop rather than recursing - not all compilers
will necessarily recognize the tail recursion.
Catch heuristic dissectors that reject a packet but also request
(whether deliberately or accidentally) that more data be added.
svn path=/trunk/; revision=18050
reassembly. UDP has no notion of reassembly - that's done at the IP
layer - and SCTP has its own notions of reassembly which it currently
doesn't provide. As such, TCP-style reassembly isn't possible for
JXTA-over-UDP or JXTA-over-SCTP.
As for TCP, a heuristic dissector for a TCP-based protocol can't request
more data if it's rejecting a packet; make it not do so. That should
fix the recent buildbot crash, although there are still some reassembly
problems with that capture (c05-http-reply-r1.pcap.gz in the menagerie
and on the SampleCaptures page of the Wiki) that aren't fixed yet.
svn path=/trunk/; revision=18049
use tcp_multisegment_pdu and se_tree_lookup32_le() to track pdu boundaries for tcp reassembly just as this structure is used for the same purpose when reassembly is not enabled.
get rid of a hashtable and two memchunks we no longer need
tcp_segment_table tcp_segment_key_chunk and tcp_segment_address_chunk
This makes tcp reassembly work for out-of-order segments as well as when reassembly completes in one segment and when the tail of the segment contains the head of the next pdu which we did not handle before.
tcp reassembly should be much better and efficient now modulo introduced regressions.
svn path=/trunk/; revision=18046
enough to have a non-BVLC packet from or to port 47808, we're likely to
reject it and let another dissector try it. Fixes bug 855 (in which an
MS Messenger packet was unlucky enough to have come from that port).
Add value_string tables to some fields, and just use
proto_tree_add_uint() to add them to the protocol tree, rather than
generating our own text for them.
svn path=/trunk/; revision=18033
Save the media encoding name in the transport_info_t structure rather
than in a global variable. Allocate it with tvb_get_ephemeral_string()
so it's released after the packet is completely processed. Do *NOT*
assume it's necessarily non-null in decode_sdp_fmtp(), as the code flow
doesn't guarantee that to be true.
proto_tree_add_string() now suffices for adding a particular SDP item -
strings are now displayed "safely", with escaping of non-printable
characters done.
Update a comment (we no longer have the Big Transfer Vector to allow
plugins to call dissector functions in Windows, we have those functions
in a DLL).
svn path=/trunk/; revision=18031
want to have a dissector capable of rejecting packets, you need to
reject the packet before you call tcp_dissect_pdus() - once you're doing
reassembly, etc., it's too late to reject the packet.)
svn path=/trunk/; revision=18029
now that we have se_tree_lookup32_le we can do the tracking of pdu boundaries much more efficiently.
track pdu boundaries by a new tcp_multisegment_pdu structure that is indexed by sequence numbers and let this structure replace the older tcp_next_pdu structure.
with se_tree_lookup32_le we no longer need to track segment by segment and can get rid of the two hash tables
tcp_pdu_tracking_table
tcp_pdu_skipping_table
Neither do we need the tree tcp_pdu_time_table anymore so that one is gone as well.
remove various other functions that are no longer needed due to removing the structure and the tables/tree
this part of the code shoul;d be much more readable now and also a bit faster
svn path=/trunk/; revision=18024
the amount of data left in the radiotap header after the fields we've
processed so far, not the total length of the header, so it couldn't be
used to skip past the radiotap header and get a tvbuff of the packet
data. Fix that.
svn path=/trunk/; revision=18020
The code was incorrectly bounds checking AndXOffset. AndXOffset is only
relevant when AndXCommand is not 0xFF. This patch corrects erroneous
"Malformed packet" exceptions.
svn path=/trunk/; revision=18015
rename the preference to DEFAULT protocol version to indicate it is only used for those conversation where we have not automatically detected the version used.
svn path=/trunk/; revision=18003
scsi_mmc_val DATA
scsi_sbc2_val DATA
scsi_ssc2_val DATA
BTW: these values should be renamed to ..._vals as in every other dissector I know!
svn path=/trunk/; revision=17989
update the comment in packet-scsi.c to reflect that it is the transport now that is responsible to track itl and itlq data
make scsi tapable
svn path=/trunk/; revision=17974
Clean up the checks for STP vs. RSTP vs. MSTP.
Show the version 3 length field as a separate field, rather than as the
top-level item for the MSTP stuff.
"Trust" the version 3 length field, so that if it doesn't agree with the
packet length, we report a malformed frame (as we should).
svn path=/trunk/; revision=17973
and, in particular, means we don't, for example, use tvb_get_ntohs() to
fetch a 4-byte quantity - that fixes bug 883.
The MST config name is either null-terminated or null-padded; mark it as
such.
svn path=/trunk/; revision=17972
library. If that's not done, it leaves to ethereal or other binaries
using it the job of linking adns within them. This behaviour is
unreliable and breaks when using the --as-needed flag for GNU ld
(version 2.16 or better 2.17).
svn path=/trunk/; revision=17969
structures for scsi.
we no longer need the scsi_task_id structure passed by pinfo->private_data so get rid of it.
we no longer need the (broken by design) scsi_task_data hash table since this has been replaced byt hte itl and itlq structures and tracking
svn path=/trunk/; revision=17952
remove the two fields opcode and devtype from the scsi_task_data structure since these are also part of the itlq and itl structures
svn path=/trunk/; revision=17949
I tried out the 0.99.0pre1 release and I noticed that all my SCCP management messages (on SSN==1) were getting decoded as TCAP. Turns out that the INAP dissector (due to a bug) registers to SSN==1 by default (instead of 106 and 241). Rather than just fix that bug, the attached patch modifies the INAP dissector to use a range preference (like GSM MAP, TCAP, etc.).
svn path=/trunk/; revision=17945
Using the attached patch, this file was generated via "File -> Export -> as XML
- "PDML" (packet details) file ...". As can be seen in the file, the 1st
packet now contains the value for the "media", whereas previously it did not.
svn path=/trunk/; revision=17943
and get rid of some breakage in the design
let the scsi transport keep track of itl (initiator, target, lun) matching
and let it pass a itl structure to scsi that is persistent across packets.
let scsi use this itl structure to track device type for a specific itl instead of the (must have been) broken hashtable.
update both iscsi and fc to track the itl structure for scsi and schange the scsi signature to accept itl as a parameter.
more to come.
svn path=/trunk/; revision=17942
883 checkIMEIres dissection Error in GSM MAP - branch needed for v1,v2 on Response as well
884 The "absentSubscriberParam" can not be dissected in gsm-map - missing IMPLICIT.
svn path=/trunk/; revision=17926
attached a patch to display LMP bandwith values in Mbps format
rather than the Byte/s format which is IMO a bit awkward to read.
svn path=/trunk/; revision=17923
Python versions, as it no longer makes only "register.c", it can also
make a "plugin.c" file for a plugin.
When making "plugin.c", there's no need to include "register.h", as it's
not defining any functions declared there.
svn path=/trunk/; revision=17919
While looking at bug 882 (which seems to have been fixed since 0.10.14) I noticed the RTCP heuristic dissector wasn't picking up the frame.
This patch fixes the parenthesis to test the packet-type properly.
svn path=/trunk/; revision=17914
The 'info'-part should display the invoke id of confirmed service as well, since it is much easier to match request and reply without typeing any filter rules or so.
svn path=/trunk/; revision=17913
Fix the Makefile.nmake files to pass the output type argument to
make-reg-dotc or make-reg-dotc.py.
Make tools/make-reg-dotc executable.
svn path=/trunk/; revision=17904
libetheral or a plugin.c for a plugin, rather than having plugin.c for a
dissector call the routines from register.c. This means we don't ahve
multiple register_all_protocols() and register_all_protocol_handoffs()
routines, and that all the plugin boilerplate is automatically
generated.
svn path=/trunk/; revision=17903
Currently, the filename IOR.txt is hardcoded into ethereal.
The patch allows the user to change it. Thanks for applying!
svn path=/trunk/; revision=17894
These patches:
- fix the bounds errors reported by coverity in bug 879
- fix a couple of other potential bounds errors (length checking 1st & 2nd lines in file)
- reorder catapult_dct2000_phdr so that normal protocol pseudo-header info is at the start. This means that the stub dissector can avoid the nasty
(overlapped) memcpy
- a little whitespace fixing
svn path=/trunk/; revision=17886
- allow DHCP option 43 suboption 8 (OUI) for CableLabs clients to be a 6-byte string (as required for DOCSIS CMs) to
account for inconsistencies in different CableLabs specifications
- add new DHCP option 60 fields 0x0d (IP Filters Support) and 0x0e (LLC Filters Support) for CableLabs DOCSIS 2.0 CMs
- rename PKT_CM_* variables to have a DOCS_CM prefix instead (overdue, as indicated by an existing comment)
- update specification references
svn path=/trunk/; revision=17884
the attached patch enables the explicit GIOP dissection. This fixes erronous decoding, if methods of two different CORBA interfaces have the same name, which happens frequently.
The generated GIOP plugins (CosEvent, CosNaming, Parlay, Tango) need to be re-generated to make use of the fix.
svn path=/trunk/; revision=17880
1) BACnet signed values were being decoded incorrectly for negative
values since BACnet tries to be clever and minimizes the number of bytes
sent on the wire and drops the leading FF on negative values. For
example, -200 is passed as FF 38 on the wire, but would display as 65336.
2) Since the BACnet unsigned values were decoded using a 64-bit entity,
I changed the decoding such that allows all 8 bytes to be decoded. The
function can now decode 5, 6, and 7 byte values.
3) Corrected warning about signed/unsigned in a pointer parameter.
svn path=/trunk/; revision=17877
patch and new files provide support for Catapult DCT2000
.out files to wiretap and ethereal.
This wiretap support (catapult_dct2000.c+h) appends a short header to
each packet giving some context, and a corresponding ethereal dissector
(packet-catapult-dct2000.c) parses this before passing the real payload
onto an existing ethereal dissector (for ethernet, ip, lapd, ppp,
frame-relay,...).
For now, there is only support for saving dct2000 files in their own
format, although I may add support for converting between dct2000 and
libpcap later.
updated version of these files and patch, now with support
for MTP2. Olivier's trace used the ANSI variant - the MTP2 and MTP3
decode fine with the right preferences set (although the ISUP dissector
reports a reserved/retired message type).
Witha a change to NOT to declare gboolean catapult_dct2000_board_ports_only;
as extern as MSVC choked on it.
svn path=/trunk/; revision=17862
I updated my previous patch of ESP :
* It now check authentication for (similar to the ICMP checksum):
- NULL Authentication
- HMAC-SHA1-96 [RFC2404]
- HMAC-SHA256
- HMAC-MD5-96 [RFC2403] (2)
I put aside AES-XCBC-MAC-96 [RFC3566] because I did not succeed to have
a working implementation.
I added a field for any authenticator of 12bytes length (without
authentication process)
* I also correct the printing of this authenticator field which was
decrypted :-[ .
Thus, with this patch if libgcrypt is linked withe ethereal you should
have the availability to :
- decrypt packets
- check authentication
at the same time or not.
If noone of these options are set (or libgcrypt is not available) you
also may use the previous heuristic.
svn path=/trunk/; revision=17858
- Add TCP reassembly to get the proper packet length
- Add "result = check_ucp(tvb, &endpkt);" in dissect_udp_commong to fill some variables used.
svn path=/trunk/; revision=17843
this finally allows us to have scsi.time for scsi transactions but we need to cleanup and refactor the other three scsi entrypoints before we should implement scsi srt to make the other three also take an exchange data structure as parameter from their transports (and get rid of the pinfo->private_data )
svn path=/trunk/; revision=17838
- fixes bug 863 (RTCP sender report's NTP time display incorrect - use using wrong bytes)
- makes NTP timestamp MSW and LSW proper filterable fields, displaying them in dec and hex
- when doing roundtrip calculations, rationalise fields added, add link to LSR frame whenever it matches
svn path=/trunk/; revision=17834
while reusing this structure for multi-purpose would make it berret suited to move the struct from packet-fc.h to packet-scsi.h
we would have to include packet-scsi.h for everyone that includes packet-fc.h and that are a few dependencies.
(would have to include it even in packet-llc.c)
so leave it as a fc structure for now.
svn path=/trunk/; revision=17833
use the pointer to iscsi_Session as conversation index for the exchange tracking for now, it works just as well and will be replaced with better exchange tracking shortly anyway
svn path=/trunk/; revision=17831
it is silly that scsi has to track these things itself when all the transports
already keep track of exchanges.
the scsi transports should all use the fc_exchange_data structure to pass lun to scsi and where scsi kan store the opcode between requests and data/response packets
svn path=/trunk/; revision=17829
this is semi-temporary though since FCP will always sit ontop of FC which also tracks the same conversations so there is no need to do a redundant conversation tracking in fcp itself.
svn path=/trunk/; revision=17822
dissect smb2 break responses used by a server to break an oplock
these unsolicited responses are sent with a commandseqnum of -1 so mark these in the header as unsolicited as well
svn path=/trunk/; revision=17820
The attached patch adds support for the Japan SS7 variants (TTC/NTT) to
the MTP3, MTP3MG, SCCP, and SCCPMG dissectors. It's not as thoroughly
implemented nor tested as I'd like, but it does a good job of at least
the basic dissection and I'm out of time for now.
It also fixes bug I found in the SCCP dissector where it would show an
End of Optional parameter even when the Optional pointer was 0.
svn path=/trunk/; revision=17815
call the scsi response dissector as well
(so that eventually we can do things like SRT for SCSI)
it doesnt work yet since fcp is using some incredibly broken logic to
track state between frames.
the cdata stuff can just not ever work exscept for single scan tethereal dissection.
is there noone at all looking at these protocols wioth ethereal?
has noone noticed it is completely broken yet?
sigh, soon i think i will be able to add the originally estimated trivial to implement SCSI SRT
svn path=/trunk/; revision=17811
add missing flags to the dissection and during refactoring fix several things that just can not have worked previously.
svn path=/trunk/; revision=17805
remove the port preference setting and replace it with strong heuristics instead
(attempt but fail to set a conversation dissector when the heuristics and the dissection match)
use tcp_dissect_pdus() for reassembly and pdu tracking and get rid of the try-to-step-through-the-pdu-to-find-where-the-next-pdu-starts thing.
svn path=/trunk/; revision=17804
issued by ms kdc contains a PA_DATA structure with a salt that contains an
nt_status code explaining why the client was not allowed to get a (tgt) ticket
svn path=/trunk/; revision=17796
add dissection of two additional bits and the respdataformat bitvield
add booleans for the filter fields
make all the fields filterable
svn path=/trunk/; revision=17787
instead of the allocation length from the data pdu since sometimes the datapdu will be completely empty and thus we cant extract it from the data pdu.
(unclear if this is really allowed by scsi but anyway)
this should make the scsi transfer length checking more correct.
update mmc getconfiguration and spc inquiry to use these macros
and flag these packets that are short due to a too small alloc_len
as truncated due to scsi and not being short/malformed packets.
at the same time, get rid of a few horrible offset+x in the inquiry dissector and replace with proper offset incrementation instead.
svn path=/trunk/; revision=17784
put useful info like type,mode,uid,gid on the expansion lines so we dont have to open the expansion to see these values.
allow it to push this info multiple expansion lines upward
and optionally (such as for GETATTR replies) put this info in the info column as well
svn path=/trunk/; revision=17783
Removes the use of the deprecated proto_tree_add_item_hidden() function
I was adding the 'msmms.command.unknown' field in lots of places (a
habit of mine in my own dissectors), but this probably isn't useful.
svn path=/trunk/; revision=17782
