on it and check whether it returned EISDIR, not whether it returns 0 -
EISDIR means it's a directory, 0 means it isn't.
svn path=/trunk/; revision=3939
real problem, if "byte_span" were 0 - that would only happen if
"bitoffset" and "bitlength" were both 0, and "bitlength" should never be
0).
svn path=/trunk/; revision=3929
dissectors to use it, from Ronnie Sahlberg, with additional changes to
handle the case where a frame contains messages that don't run past the
end followed by one that does and where a reassembled chunk has, at the
end, a message that runs past the end of that chunk (because the
reassembly was for an earlier message).
svn path=/trunk/; revision=3923
"dissect_rpc_common()" check, every time it's about to return FALSE,
whether it's being used as a heuristic dissector and, if not, call
"dissect_rpc_continuation()" - we can just have the non-heuristic
dissector call it and, if it returned FALSE, call
"dissect_rpc_continuation()".
svn path=/trunk/; revision=3922
source and destination addresses if the transport is TCP (we use that,
for now, as a proxy for "if the transport is connection-oriented"), as
the endpoint addresses should be the same for all packets.
Have both a heuristic RPC dissector and a non-heuristic version, and
make the non-heuristic version the dissector for the conversations we
create; that version will, if the frame doesn't look like a call or
reply, mark it as continuation data.
svn path=/trunk/; revision=3921
being written, but the 2 bytes of data length and one byte of buffer
type preceding that data; use the data length (which doesn't count
itself or the buffer type byte), rather than the byte count, to
determine how much data is being written.
svn path=/trunk/; revision=3917
buffered data is written out to the file;
headers are written if the capture file header depends on the
number or sizes of the packets;
etc..
svn path=/trunk/; revision=3909
Add comments noting the IPv6 issues for PASV responses.
When adding the FTP dissector for the FTP port, give its protocol as
"proto_ftp", not "proto_ftp_data".
svn path=/trunk/; revision=3904
of protocol-id-plus-datum pairs, so that multiple protocols can attach
information to the same conversation.
Dissectors that attach information to a conversation should not assume
that if they find a conversation it has one of its data attached to it;
the conversation might've been created by another dissector.
svn path=/trunk/; revision=3901
have an unsigned integer as that argument; this squelches some compiler
warnings, and it's the right thing to do in any case.
Don't check whether an unsigned integer value is > 0 - that's the same
as checking whether it's != 0.
svn path=/trunk/; revision=3898
that look up conversations in hash tables, unless they are arguments
that will be ignored; if they're not being ignored, then if the argument
is a null pointer you may get a crash if it's dereferenced, and if it's
not a null pointer you'll only get a match if the conversation has
whatever stuff the arguments points to as its first address or port.
If you match a conversation with a wildcarded address and/or port, and
the address and/or port matched a non-wildcarded search argument, and
the conversation is for a connection-oriented transport protocol, set
the wildcarded address and/or port for the conversation to the value
that matched it.
svn path=/trunk/; revision=3897
rather than the address from which the PASV reply came when setting up a
conversation.
Don't compare the reply code with "227" unless the reply code is 3
characters long.
Set up the conversation for a PASV response only if we haven't already
processed the packet (and thus haven't already set up the conversation).
svn path=/trunk/; revision=3896
"try_conversation_dissector()" does - start with as exact matches as
possible, and then start doing wildcarding - so that it can find
conversations with wildcard addresses or ports even if both address and
port arguments are supplied to it.
svn path=/trunk/; revision=3893
available - just mark it as "authentication flavor unknown". Don't
dissect the next protocol if the authentication flavor is unknown.
This lets us get some more work done on short frames (although if you
really want to analyze ONC RPC traffic, you should make the snapshot
length large enough to capture enough of the frames).
svn path=/trunk/; revision=3891
Guy Harris