http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=552
by enforcing that header fields have names of length > 0. This should fix
the display of those fields and also make them filterable (which was the
subject of the bug). Abbreviations are (still) optional: if they are empty
then the field is not filterable.
Update README.developer with this information.
Add header field names in several dissectors where they were missing.
In packet-arp.c give "packet-storm-detected" a name (as above) but also set it
as _GENERATED.
Also remove trailing white space from all the files checked in.
svn path=/trunk/; revision=21018
Here is an updated patch for proto_tree_add_item and the
range_string structure. The new macro RVALS() can be used as the macro
VALS() in the declaration of your hf_register_info with another
structure (range_string). Be aware that you *have to* ORed the value of
the field display with BASE_RANGE_STRING constant and it can 'only' be
used with FT_(U)INT* types in a header_field_info.
svn path=/trunk/; revision=20805
exception rather than aborting the program; using it means that
dissector bugs show up as such rather than as malformed packets.
svn path=/trunk/; revision=20532
32-bit numbers. Separate signed and unsigned accessors have been
added and used where appropriate.
Definitely not for 0.99.5.
svn path=/trunk/; revision=20472
if set, and if the program isn't running with additional privileges,
it'll treat the directory in which the program is found as the data
directory.
If, on Windows, the version-number subdirectory of {data
directory}\plugins doesn't exist (which is assumed to mean that the
program is being run from the build directory), or if, on UN*X,
WIRESHARK_RUN_FROM_BUILD_DIRECTORY is set, the plugin directory is the
"plugins" subdirectory of the data directory, and all subdirectories of
that directory are scanned for plugins, as the "plugins" subdirectory of
the build directory contains subdirectories for the plugins; this means
that if we're running from the build directory, we'll find the plugins
we built in the build tree.
When generating the wireshark-filter man page, run tshark with
WIRESHARK_RUN_FROM_BUILD_DIRECTORY set, so it uses the plugins from the
build to generate the list of filters.
svn path=/trunk/; revision=20261
This should mean that all fvalue_set() for FT_STRING[Z] are always with already_copied==FALSE
(funny that we never saw someone trying to g_free("[ Null ]") which might have happened before)
svn path=/trunk/; revision=20245
this primarily removes code and simplifies (==eliminates) the need to track the data that is allocated and should potentially be slightly faster than a slab allocator.
however these functions are called A LOT so there might be a performance hit when using emem with full debugging canary values and all the bells and whistles activated.
this change also makes any future attempt to parallellize dissection of frames easier if we just make the ep allocator allocate from a threads specific ep pool.
(something we would have to do anyway to make ep allocations multithreaded)
this works in all my tests so far but needs more test coverage.
svn path=/trunk/; revision=20194
proto_can_match_selected() routines, to more clearly separate the two
functions - but have them both call the same underlying routine, so
they both make the same decisions as to whether a match-selected string
can be constructed or not.
svn path=/trunk/; revision=19976
proto_construct_match_selected_string() to indicate what it does - and
have it return a Boolean indication of whether the string could be
built, returning the string through a pointer, and, if that pointer is
null, have it just return the Boolean and not construct the string.
Get rid of proto_can_match_selected() -
proto_construct_match_selected_string() can be used for that, which
means we have only one piece of code that knows whether a "match
selected" string can be constructed or not.
Have proto_construct_match_selected_string() support matching
zero-length FT_NONE (and FT_PCRE, but that shouldn't happen) fields even
if there's no epan_dissect_t, as such a match just checks whether the
field is present.
svn path=/trunk/; revision=19967
checks that we do when we try to construct the filter expression for
"match selected" - this means we don't just assert that all FT_NONEs are
filterable, as they aren't.
svn path=/trunk/; revision=19961
proto_construct_dfilter_string() the default, so you add explicit cases
only when the type needs to be treated specially, so we don't end up
with types where we forget to have a case.
svn path=/trunk/; revision=19959
pseudo-field by looking at the ID for hf_text_only. Apparently
some fields really don't have 'name' fields, but we still want
their info to be dumped out.
svn path=/trunk/; revision=19763
in last year by Gianluca Varenni.
Add partial support for reading from named pipes (currently disabled).
Move utf_8to16() and utf_16to8() to a separate module (unicode-utils.[ch])
so that we don't have to cut and paste code in dumpcap.c.
Fix up whitespace.
svn path=/trunk/; revision=19291
- register H.225.0 over TLS (configurable port 1300)
- register SIP over TLS (fixed port 5061)
- new function proto_tree_get_root()
svn path=/trunk/; revision=19059
Hi,
This patch allows FT_NONE items to be built into filter expressions
(i.e. testing for their presence or absence rather than comparing with a
value) using the Apply|Prepare a Filter menus. What drove me to add
this was having to type in !tcp.analysis.out_of_order.
Does this seem reasonable?
Regards,
Martin
svn path=/trunk/; revision=18782
This way we ensure that errors are displayed during protocol registration.
Use g_error instead of g_warning, if not allowed characters are used in display filter names for protocols. Extend the error message in this case.
svn path=/trunk/; revision=17248
"proto_tree_add_XXX_format()" routines except that the format doesn't
have to include the field name - the field name, followed by ": ", are
put into the representation string, followed by the result of the
formatting, so you just format the value with the format string, not the
entire representation.
svn path=/trunk/; revision=17221
proto.c uses the wrong pointer in error msg.
Me:
Be more verbose in case of illegal characters when
registering filter names.
svn path=/trunk/; revision=16986
While looking into bug 239 I found a type mismatch in proto.c. Even
though tree_is_expanded is defined as a (gboolean *) the memory
allocation is carried out using sizeof (gint *). The attached patch
fixes this.
svn path=/trunk/; revision=16877
print register numbers as unsigned (they're guint32);
when printing a PUT_FVALUE instruction, show the value as well
as the type of the value.
That requires that a bunch of types get to_repr methods; add them for
PCRE (FTREPR_DFILTER-only - show the regular expression as text),
tvbuffs (FTREPR_DFILTER_only - show the data as a hex string), integral
types, string types other than FT_STRING, and FT_IPv6.
That means we can use fvalue_to_string_repr() for FT_IPXNET and FT_IPv6
in proto_construct_dfilter_string(), and that we don't need to handle
integer and floating types specially in MATE.
Fix some problems with the PCRE execution code for tvbuff types.
svn path=/trunk/; revision=16369
FT_UINT_BYTES and FT_UINT_STRING correctly when the tree argument is
null (which involves carving proto_tree_add_item() into bits and having
both ptvcursor_add() and proto_tree_add_item() call those bits).
svn path=/trunk/; revision=16287
and not free the string to which it points. Pass to
REPORT_DISSECTOR_BUG() strings allocated with ep_strdup_printf(), so
that they're freed automatically.
svn path=/trunk/; revision=16039
will only process FT_PROTOCOL fields. As a result, proto_item_append_string()
calls may throw a dissector exception, as only a FT_STRING or FT_STRINGZ can be
appended to with this call.
In order to prevent these dissector assertions, silently return from the append
call if the field is a FT_PROTOCOL.
Note that when the tree is visible, the updates of the fields occur normally,
as expected.
svn path=/trunk/; revision=16035
and that extract IPv6 addresses into a "struct e_in6_addr", with
tvb_get_ipv4() and tvb_get_ipv6() calls - except for some that we
remove, by using proto_tree_add_item(), rather than replacing.
Have epan/tvbuff.h include epan/ipv6-utils.h, to define "struct
e_in6_addr" (not necessary to declare the tvbuff routines, but including
it there means "struct e_in6_addr" is guaranteed to be defined before
those declarations, so we don't get compiler complaints if we define it
*after* those declarations).
svn path=/trunk/; revision=15758
Please see: http://wiki.ethereal.com/Development/ExpertInfo for a complete overview of the intended feature and it's current state of implementation.
While I'm working on this, I've also added some more status result codes to the DCE/RPC and DCOM dissectors.
svn path=/trunk/; revision=15754
IPv6 addresses. Use "tvb_get_ipv4()" in the WINS Replication dissector,
so that it gets the right answer on little-endian *AND* big-endian
machines.
svn path=/trunk/; revision=15753
at the same time, make proto_construct_dfilter_string() return an emem allocated string.
This fixes a tiny memleak in print.c that never freed the string returned by this function.
svn path=/trunk/; revision=15651
proto_tree_add_ipv6(). Add tree items for the extended router source
and dest mask, and fix offsets. These changes appear to be correct,
but I don't have a valid capture with extended router data.
In proto.c, throw a dissector error if we try to pass a NULL value to
various proto_tree_set_*() routines.
Fixes bug 356.
svn path=/trunk/; revision=15375
-use g_snprintf instead of sprintf and snprintf
-use g_strdup_printf where appropriate
-remove #include "snprintf.h" (as only g_snprintf should be used)
-replace some more alloc/realloc/calloc/free with their glib pendants
svn path=/trunk/; revision=15264
(presumably-)harmless-but-otherwise-unremovable const-to-nonconst
warnings.
In the TACACS dissector, clean up the variables used in option parsing
to avoid some const-to-nonconst warnings.
Clean up some white space.
svn path=/trunk/; revision=15043
printing the blurb twice, like fields2 does.
Add a script, fsanity.py, to check sanity of FT definitions. Right now the
only check is for bitmasks for integer-like fields.
svn path=/trunk/; revision=14454
Add a comment to proto_item_append_string() explaining the "danger" and what needs to be done if one decides to use proto_item_append_string()
Add a small change to WSP so that it will disable this speed optimization so not to trigger a DISSECTOR_BUG in proto_item_append_string()
svn path=/trunk/; revision=14452
values that may not be valid (e.g. dissect_ber_octet_string()
in packet-ber.c). If the length is invalid, get_uint_value() or
get_int_value() will abort. Change them to throw an exception instead.
This keeps us from having to do a lot of extra work in the dissector.
Fixes bug 182.
svn path=/trunk/; revision=14437
Not all proto_item* fields have a subtree associated to it.
If it doesnt have a subtree fi will be NULL,
test fi for NULL before trying to dereference it to avoid a coredump.
svn path=/trunk/; revision=14134
It should not dump core as far as all my tests are concerned and Menu_Statistics/ProtocolHierStats work
It needs more testing and there might still be cases where it will crash that will need to be fixed but I feel it will be worth it since it will decrease the time to filter very large capture files dramatically.
Real significant performance boost for very large captures.
(If we cant fix all the problems we can just revert this patch)
svn path=/trunk/; revision=14051
optimization for COLUMNS to make ethereal faster when filtering
optimization to make the slow find_protocol_by_id() fast.
(idea from Didier, implementation modified by me to be less intrusive)
svn path=/trunk/; revision=14026
"PROTOABBREV A name for the protocol for use in filter expressions;
it should contain only lower-case letters, digits, and
hyphens."
In proto_register_protocol(), generate a warning if PROTOABBREV contains
invalid characters. Along with the list above, allow underscores and
periods. Fix up whitespace.
Lower-case PROTOABBREV in several dissectors.
svn path=/trunk/; revision=13967
length values (other than -1) as very large positive values, and for
values larger than the amount of data remaining in the tvbuff, clip the
value to the length of the tvbuff, so that dissectors don't have to
worry about doing that clipping themselves.
svn path=/trunk/; revision=13913
"alloc_field_info()", so the error report can include the field with the
problem. (The file and line number isn't interesting - the bug isn't in
"alloc_field_info()", it's in the dissector that called the routine
calling "alloc_field_info()" - but the field name/abbrevition is
interesting, as it'd help developers identify the place in the dissector
where we're passing in a bogus length.)
svn path=/trunk/; revision=13081
Add a DISSECTOR_ASSERT() macro, which is the usual type of assertion
macro, but throws a DissectorError exception with a message giving the
flien and line number and the failed test as a string. Use that macro
in "alloc_field_info()".
Report that exception in the Info column and the protocol tree, as well
as logging the exception failure with g_warning().
svn path=/trunk/; revision=13078
In the past: to prevent duplicate protocol names (and alike), each time a new protocol was registered, the list of protocols were iterated and the name compared with each existing name using strcasecmp, which is slow as we have >500 protocols right now.
Now: the protocol name to check against duplicates is first converted into a hashvalue and then only this value is checked and stored in a hashtable. This way the string to check for, has to be converted/compared only a single time!
svn path=/trunk/; revision=13007
Clean up indentation.
If we dissect an octet string and then re-dissect it as a particular
type of data, don't use the end offset from the re-dissection as the
offset of the end of the octet string - just use the result of
"dissect_per_octet_string()".
svn path=/trunk/; revision=12406
