Commit Graph

7586 Commits

Author SHA1 Message Date
Guy Harris 86f3c38c4a From Can Erkin Acar: OpenBSD is now using tcpdump.org-assigned DLT_
value for DLT_PFLOG, and that goes along with a change to the link-layer
header for DLT_PFLOG - support both the old and new values and format.

svn path=/trunk/; revision=7676
2003-05-15 07:14:46 +00:00
Guy Harris 64840abd9f From Laurent Rabret:
fix a bug where bad IPv4 and IPv6 prefix lengths could cause a
	buffer overflow;

	check the checksum in LSP packets.

svn path=/trunk/; revision=7675
2003-05-15 06:35:02 +00:00
Guy Harris d4c805ad33 From Didier Gautheron: add the right decoding for AFP3.1 FPCatSearchExt
call.

svn path=/trunk/; revision=7674
2003-05-15 05:53:43 +00:00
Guy Harris 21ad5d8067 Fix the call that adds the local preference to the tree.
svn path=/trunk/; revision=7673
2003-05-15 05:35:42 +00:00
Guy Harris 084b87c9c2 Move the value_string of platform ID values to "packet-dcerpc-nt.c", and
declare it in "packet-dcerpc-nt.h", as it's used both by the srvsvc and
wkssvc dissectors.

svn path=/trunk/; revision=7672
2003-05-15 05:24:19 +00:00
Guy Harris 50f2f2eca9 "tvb_get_nstringz0()" now expects, as an argument, a value 1 greater
than the number of bytes to copy, as the value includes the terminating
'\0' added on.

svn path=/trunk/; revision=7671
2003-05-15 05:18:17 +00:00
Tim Potter 2ef11527a3 Move dissection of NETLOGON secure channel auth verifier into
packet-dcerpc-netlogon.c

svn path=/trunk/; revision=7670
2003-05-15 04:58:53 +00:00
Tim Potter 180e410bd4 More work on dissecting generic and standard mappings for NT access masks.
Also, it turns out that there are three types of specific access permissions
for printing - printer, print server and job specific bits.

svn path=/trunk/; revision=7669
2003-05-15 02:15:13 +00:00
Tim Potter cabe2eebf8 More work on dissecting generic and standard mappings for NT access masks.
svn path=/trunk/; revision=7668
2003-05-15 02:14:00 +00:00
Tim Potter f6e347bbc5 Dissect authentication data for netlogon secure channel bind and bind acks.
svn path=/trunk/; revision=7667
2003-05-15 02:01:39 +00:00
Tim Potter 602a62e38a Dissect authentication data for netlogon secure channel bind and bind acks.
Also, recommit a change lost in the hardware failure which was to note the
type of a DCE/RPC fragment when noting it in COL_INFO.  A fragment can be
either a first, middle, last or whole (first+last) fragment.

svn path=/trunk/; revision=7666
2003-05-15 01:59:23 +00:00
Richard Sharpe 337963a73a Re-commit stuff that was lost...
This contains an initial break-out of the verifier for secure-channel and
maybe more ...

svn path=/trunk/; revision=7665
2003-05-14 22:09:52 +00:00
Laurent Deniel ea052d7d23 A correct programming practice is to save errno and restore its value
in all signal handlers that could modify it (i.e. by calling system
calls or worst standard C library functions).

Else the following code for instance is buggy if a signal arises between
the tests:

if (system_call() == -1) {
  if (errno == Exxx) {
   ...
  } else {
   ...
  }
}

And MANY (open source or not) programs are broken that way ...

svn path=/trunk/; revision=7664
2003-05-14 10:31:15 +00:00
Guy Harris d791827a65 "tvb_get_nstringz0()" now expects its third argument to be the maximum
number of bytes to put into the string, including the trailing '\0', not
the maximum number of real characters in the string; fix the call
appropriately (and make the buffer big enough to hold a null-terminated
string with MAX_BUDDYNAME_LENGTH characters).

svn path=/trunk/; revision=7663
2003-05-11 02:40:36 +00:00
Guy Harris 09811706b5 From Graeme Hewson: fix "eth_hdr" to put the destination and source
addresses in the right order.

svn path=/trunk/; revision=7662
2003-05-11 01:12:33 +00:00
Guy Harris fa51805340 Have "dissect_ndr_cvstring()" set the length of the top-level item to
cover all the parts of the item, rather than just making it be 0.

svn path=/trunk/; revision=7661
2003-05-10 02:29:44 +00:00
Guy Harris 9f089e90d8 A quantity dissected as 6 unknown bytes in a logon reply actually
appears to be a 4-byte aligned quantity, with the other 2 bytes
presumably seen by whoever added the code to dissect those 6 bytes
being, most likely, padding to align the 4-byte quantity.

svn path=/trunk/; revision=7660
2003-05-10 02:15:04 +00:00
Guy Harris 57958693a1 Expand some comments.
Do the "tvb_ensure_bytes_exist()" check, and the check for a zero-length
bit string, in the code to process a bit string.

svn path=/trunk/; revision=7659
2003-05-10 02:00:41 +00:00
Guy Harris 01e6542ed5 Use "tvb_ensure_bytes_exist()" to cause an exception to be thrown
*before* attempting to allocate a buffer for a string, if the copy into
the buffer will thrown an exception; that prevents us from

	1) leaking memory if we can allocate the buffer (we'd throw an
	   exception before we freed the buffer);

	2) crashing if we can't allocate the buffer because the length
	   is bogus and large.

svn path=/trunk/; revision=7658
2003-05-10 01:57:53 +00:00
Tim Potter 27607d89db Dissect a ntlmv2 response if found in a samlogon request.
svn path=/trunk/; revision=7657
2003-05-09 01:46:13 +00:00
Tim Potter 737936eef4 Add a dissect_ndr_counted_byte_array_cb function which can take a callback
to call when dissecting the array data.

svn path=/trunk/; revision=7656
2003-05-09 01:43:59 +00:00
Tim Potter 2b39831b5b Move the ntlmv2 response dissection out of packet-ntlmssp.c and in to
packet-smb-common.c so it can be used elsewhere.

Dissect a ntlmv2 response in a session setup SMB if detected.

svn path=/trunk/; revision=7655
2003-05-09 01:41:28 +00:00
Guy Harris d812376fe4 Based on a patch from Jean-Baptiste Marchand, mark stub data as
encrypted if appropriate; this change adds a "show_stub_data()" to
handle that, and that routine also cleans up the stub data display a bit
in some other ways.

svn path=/trunk/; revision=7654
2003-05-08 19:26:08 +00:00
Guy Harris a4e1c98b67 From Olivier Biot: fix WTP sub-PDU size presentation in the protocol
tree (display size in decimal instead of the highlighted bytes).

svn path=/trunk/; revision=7653
2003-05-08 18:49:20 +00:00
Guy Harris cec3fc0af8 The authentication data field in "simple password" authentication is 64
bits, or 8 bytes; that means that, if it's to be interpreted as a
string, it should be extracted into an 8+1 byte buffer, leaving room for
a trailing '\0', and that means the buffer size argument to
"tvb_get_nstringz0()" should be 8+1 as well.

svn path=/trunk/; revision=7652
2003-05-08 10:16:31 +00:00
Guy Harris 580e0f8e7b From Olivier Biot:
* Add decoding of Basic authentication scheme for the Authorization
  and Proxy-Authorization headers, and create a summary line
  with proto_item_append_text().
* Update Warning header decoding: warn code mapping to warn text,
  and create a summary line with proto_item_append_text().

svn path=/trunk/; revision=7651
2003-05-08 08:36:25 +00:00
Guy Harris 0bb9b054b5 From Stephen Shelley: the unit ID and function code fields in the Modbus
header are unsigned - make them so.

While we're at it, make them "guint8" rather than "guchar", to make it
explicit that they're one byte long.

svn path=/trunk/; revision=7650
2003-05-08 00:42:28 +00:00
Guy Harris 4159b91980 From Olivier Biot: if we have PYTHON defined, use the Python script
rather than the shell script to make "register.c".

svn path=/trunk/; revision=7649
2003-05-08 00:18:47 +00:00
Tim Potter 04c95838a0 Whoops - had that test reversed.
svn path=/trunk/; revision=7648
2003-05-07 07:12:50 +00:00
Tim Potter f7c07ddbae Don't try and dissect a zero length NTLM response as a NTLMv2 response.
svn path=/trunk/; revision=7647
2003-05-07 04:32:59 +00:00
Tim Potter c7cf9a4207 Parse a NTLMv2 response blob as documented in
http://ubiqx.org/cifs/SMB.html#8, para 2.8.5.3

Convert some magic numbers to constants in dissect_ntlmssp_address_list()

svn path=/trunk/; revision=7646
2003-05-07 04:07:45 +00:00
Guy Harris f4119ebe85 From Yaniv Kaul: show MBZ flags as either OK if 0 or incorrect if not 0.
svn path=/trunk/; revision=7645
2003-05-07 03:00:32 +00:00
Guy Harris 48de87a3cd Declare "host_name_lookup_process()" regardless of whether HAVE_GNU_ADNS
is defined (as it's defined, and called, regardless of whether
HAVE_GNU_ADNS is defined), and get rid of the extra declarations of the
ADNS support routines.

svn path=/trunk/; revision=7644
2003-05-05 08:20:01 +00:00
Guy Harris b22ecdab25 From Yaniv Kaul: handle DNSSEC DO/OK bit in OPT pseudo-RR.
svn path=/trunk/; revision=7643
2003-05-05 08:14:31 +00:00
Guy Harris fe42cc9dd8 From Mark C. Brown:
Following fixes for nettl (HP-UX):

	1) Fixed 11.X timestamp issue
	      there is no difference in 10.X/11.X timestamps, so no
	      need to shift 11.X timestamps
	2) Fixed NS_LS_DRIVER trace record handling
	      now works rather than throwing "...network type that
	      Ethereal doesn't support" error
	3) Fixed handling of traces with sliced packets (nettl -m xx)
	      now uses correct packet and capture lengths
	4) Additional ethernet card support
	      now handles btlan[1,3-6],gelan,igelan,intl100 driver
	      trace records

svn path=/trunk/; revision=7642
2003-05-05 01:01:36 +00:00
Guy Harris 6d6a37b5d2 Provide stub versions of "host_name_lookup_init()",
"host_name_lookup_process()", and "host_name_lookup_cleanup()" if we
don't have GNU ADNS, so that Ethereal compiles without GNU ADNS.

Declare the argument lists of "host_name_lookup_init()" and
"host_name_lookup_cleanup()" as empty, C89-style, rather than as
unknown.

svn path=/trunk/; revision=7641
2003-05-05 00:53:06 +00:00
Gerald Combs 1d9b54fc07 Add support for asynchronous DNS updates using the GNU ADNS library.
Support can be enabled at configure time by using "--with-adns=DIR".
If support is enabled, async queries happen whenever host name resolution
is enabled.  Do we need a separate preference for async queries?

Currently, only IPv4 reverse queries are supported.  I can add IPv4 forward
lookup support, but I don't have any way to test IPv6 queries.

svn path=/trunk/; revision=7640
2003-05-04 18:50:56 +00:00
Michael Tüxen 5cc92eeb86 Updated the version 06 of the ID support to version 08. Therefore versions
02 and 08 are now supported.

svn path=/trunk/; revision=7639
2003-05-04 09:43:49 +00:00
Michael Tüxen 37c5fedb3f fixed a bug in te handling of the message type field for version 06 of the ID.
svn path=/trunk/; revision=7638
2003-05-04 09:33:15 +00:00
Laurent Deniel d896d69930 SNMP dissector enhancements:
- display OID in info column

- preference added to disable such a display

- add new function new_format_oid to retrieve both
  decoded and non decoded OID strings

- add OID display filter for both decoded and non decoded strings

- add Error Status display filter

svn path=/trunk/; revision=7637
2003-05-03 15:23:15 +00:00
Guy Harris 5105311cb1 Add a note about the "val_to_string_repr" and "string_repr_len" for
ftypes, and how to add them to more types and use them in more places.

svn path=/trunk/; revision=7636
2003-05-03 01:11:29 +00:00
Guy Harris ca318813a4 Rename "proto_alloc_dfilter_string()" to
"proto_construct_dfilter_string()", to more accurately reflect what it
does.

Give it, and "proto_can_match_selected()", an "epan_dissect_t *"
argument, which replaces the raw data pointer argument to
"proto_construct_dfilter_string()".

For fields that don't have a type we can directly filter on, we don't
support filtering on the field as raw data if:

	the "epan_dissect_t *" argument is null;

	the data source tvbuff for the field isn't the tvbuff for the
	"epan_dissect_t" in question (i.e., it's in the result of a
	reassembly, and "frame[N:M]" can't get at it).

Trim the length the raw data in the case of such a field to the length
of the tvbuff for the "epan_dissect_t" in question, so we don't go past
it.  Fetch the raw data bytes to match from that tvbuff.

Have "proto_construct_dfilter_string()" return a null pointer if it
can't construct the filter string, and have "protocolinfo_packet()" in
the tap-protocolinfo tap ignore a field if
"proto_construct_dfilter_string()" can't construct a filter string for
it - and have it pass NULL as the "epan_dissect_t *", for now.  If
somebody decides it makes sense to dump out a "frame[N:M] =" value for
non-registered fields, it can be changed to pass "edt".

svn path=/trunk/; revision=7635
2003-05-03 00:48:37 +00:00
Guy Harris a8f171f2ff From Tony Schene: AUTH_GSSAPI support.
Replace "proto_item_set_len()" with "proto_item_set_end()", and get rid
of the "old_offset" variables the "proto_item_set_len()" calls required.

svn path=/trunk/; revision=7634
2003-05-02 21:58:23 +00:00
Guy Harris bf10523c44 From Greg Morris: change the endianness of CCFilehandle to match other
NCP's.

svn path=/trunk/; revision=7633
2003-05-02 21:26:47 +00:00
Gerald Combs 057716942d Final changes for 0.9.12.
svn path=/trunk/; revision=7631
2003-05-02 00:46:18 +00:00
Guy Harris f159d43773 From Jeff Morriss: clean up some column setting calls (as a result of
the recent changes to use the column fence stuff?).

svn path=/trunk/; revision=7630
2003-05-01 21:42:56 +00:00
Guy Harris 6ebe97393b From Jeff Morriss: fetch both bytes of the message type in V2 and V6
headers.

svn path=/trunk/; revision=7629
2003-05-01 21:38:43 +00:00
Guy Harris f9037afd44 From Matthijs Melchior: don't export functions also implemented as
macros, and do export "except_pop()" and "except_setup_try()".

svn path=/trunk/; revision=7628
2003-05-01 21:10:43 +00:00
Richard Sharpe 687128c3f0 Fix up the name of NetWkstaUserEnum and add NetWkstaTransportEnum
svn path=/trunk/; revision=7627
2003-05-01 19:51:37 +00:00
Guy Harris 72cc048ae1 From Olivier Biot:
* Support correct processing of code page switches
* Provide a new datatype containing scarce array of
  const value_string arrays (value_valuestring)
  allowing an efficient support for WBXML code pages.
* Minor fix (XML PI was always decoded without
  mapping known tokens)
* Add support for decoding of more WBXML content
  types (SyncML 1.0, SyncML 1.1, CHANNEL 1.0, EMN 1.0).

svn path=/trunk/; revision=7626
2003-05-01 18:18:20 +00:00