proto.[hc]
define new APIs to allow delayed registration of protocol fields,
so that dissectors with "flexible" fields like xml, radius, diameter,
snmp do not have to load their files at startup but can do so as late as possible.
gtk/dfilter_expr_dlg.c :
have the expression dialog registering all prefixes so that all fileds appear in the dialog
tshark.c
register all prefixes when called with -G
epan/radius_dict.l
epan/dissectors/packet-radius.c
epan/dissectors/packet-radius.h
refactor registration to delay dictionary loading as long as possible
svn path=/trunk/; revision=24762
configure and use more than one set of preferences and configuration files.
This can be found in the "Configuration Profiles..." menu item from the Edit
menu, or by pressing Shift-Ctrl-A. It's also possible to start wireshark
and tshark with a named profile by using the "-C ProfileName" option.
A new status pane in the main window will show the current profile.
The configuration files currently stored in the Profiles are:
- Preferences
- Capture Filters
- Display Filters
- Coloring Rules
- Disabled Protocols
- User Accessible Tables
The recent data are by design not added to the profile.
Planned future enhancements:
- make a more convenient function to switch between profiles
- add a "clone profile" button to copy an existing profile
- make the profiles list active and accept return as OK
- save users "Decode as" in the profile
- make new, clone and deletion of profiles more secure
- make some of the recent values available in the profile
This patch also fixes:
- setting default status pane sizes
- a bug setting status pane for packets when not having main lower pane.
svn path=/trunk/; revision=24089
packets that doesnt look like valid radius.
verify that a packet is radius by checking that the command code is
known and also that the length is between 20 and 4096 bytes
move the tap data to be ep_allocated instead of a static global variable
dont use tvb_memcpy() to read a structure off the wiredata
use tvb_get_... to unmarshall the fields explicitely
this fixes bug 1634
svn path=/trunk/; revision=23039
routines and routines using those routines. GLib might use different
modifiers for 64-bit quantities than the platform's C library does.
svn path=/trunk/; revision=21990
to work around the "data" field of a GArray being a guint8 *, and
defines a g_array_data() macro to extract that field and cast it to void
*.
Use that header where needed.
svn path=/trunk/; revision=21627
remaining that I'm not sure exactly what to do with at the moment:
the one in packet-frame probably should be there, the others probably
shouldn't but they also should never fail unless there's a compile or build
problem (AFAICS).
svn path=/trunk/; revision=21367
Mikus. Add a buf_len parameter to ip_to_str_buf(), and make sure it's
enforced. Copy the release notes over from the 0.99.5 trunk and add a
note about the ISUP dissector (which is affected by the overrun).
svn path=/trunk/; revision=20607
packet-ntp.c: Rather confused and incorrect use of g_snprintf return value
packet-pim.c: whitespace change
packet-icmpv6.c: g_snprintf takes trailing \0 into account, fix off by 1 error
packet-clnp.c: Fix incorrect use of g_snprintf return value
packet-isakmp.c: g_snprintf takes trailing \0 into account
packet-tr.c: Fix incorrect use of g_snprintf return value
packet-radius.c: Fix incorrect use of g_snprintf return value
packet-radius.h: constify a string variable
packet-ldap.c: The return value isn't needed, so don't use it incorrectly
packet-tcp.c: Fix incorrect use of g_snprintf return value
packet-windows-common.c: Remove unneeded DISSECTOR_ASSERT
packet-smb-sidsnooping.c: g_snprintf takes trailing \0 into account
packet-pvfs2.c: g_snprintf takes trailing \0 into account
packet-ptp.c: Remove #include snprintf
packet-ppp.c: Fix incorrect use of g_snprintf return value
packet-ospf.c: Fix incorrect use of g_snprintf return value
packet-mip6.c: snprintf -> g_snprintf
packet-bootp.c: Remove a commented out bad use of g_snprintf
packet-ber.c: snprintf -> g_snprintf, g_snprintf takes trailing \0 into account
2do:
52 packet-ieee80211.c: 2DO
2 packet-nfs.c: 2DO - too many side effects
33 packet-bgp.c: 2DO
18 packet-dns.c: 2DO
14 packet-dcm.c: 2DO
13 packet-x11.c: 2DO
11 packet-kerberos.c: 2DO
10 packet-diameter.c: 2DO
9 packet-snmp.c: 2DO
9 packet-pgm.c: 2DO
7 packet-nbns.c: 2DO
6 packet-fcswils.c: 2DO
5 packet-wccp.c: 2DO
5 packet-cops.c: 2DO
4 packet-wtp.c: 2DO
svn path=/trunk/; revision=17038
Fix a memory leak found by valgrind:
Although dir isn't a directory it may still use memory
packet-xml.c:
Reformat the relevant function in packet-xml.c to be readable on systems
where a tab is 8 spaces.
svn path=/trunk/; revision=16865
shorter than 2 bytes, and make the item for an AVP with a length < 2 a
generated item.
Put the top-level item for an AVP into the tree the same way regardless
of whether it's Vendor-Specific or not, and skip past the type and
length right after that, before we check for Vendor-Specific. (This
means we no longer treat "vendor ID = 0" as an indication that this
isn't Vendor-Specific - nothing prevents a packet from getting onto the
wire with a vendor ID of 0; this fixes bug 485.)
Don't require a Vendor-Specific AVP to be at least 6 bytes long; it
might not be particularly useful to have one that has a vendor ID and
nothing else, but we might as well dissect the vendor ID portion.
Do some other cleanups.
svn path=/trunk/; revision=16015
numbers. (Currently, we don't have any dictionary entries with that
type, although we have an attribute with special code to handle it that
uses that type.)
Specially handle Framed-IP-Address, Login-IP-Host, and
Framed-IPX-Network, so that the special values are displayed specially.
Clean up indentation.
Don't specify a number base for IPv4 or IPv6 addresses; the number base
is ignored.
svn path=/trunk/; revision=16008
calls to "tvb_get_ipv4()" and "tvb_get_ipv6()".
Fix a call in the BGP dissector to properly fetch an IEEE floating-point
number.
Update some I-D info.
svn path=/trunk/; revision=15774
Call "dissect_attribute_value_pairs()" regardless of whether we're
building a protocol tree, so the EAP subdissector is always called.
"dissect_attribute_value_pairs()" is only called when the length of AVPs
in the packet is non-zero; don't bother checking for a zero length.
Don't put two items in for each AVP - one is sufficient.
Add some more length checks when processing AVPs. Don't require AVPs to
be at least 3 bytes long - they might have just a type and length; let
an exception be thrown if that's a problem.
Don't require that the entire AVP be available in the tvbuff before
processing it; let an exception be thrown as we're processing the AVP if
we don't have all the data, so the stuff before the end is processed.
Give the tvbuff for the AVP data a length that reflects the length of
data left in the tvbuff, so that the appropriate exception is thrown if
the packet was cut short by a snapshot length.
Don't have a fixed-length buffer for reassembled EAP messages; grow it
as necessary.
Don't special-case the initial part of the processing of EAP messages;
put in the standard length item, as well as, for fragments, an item for
the fragment data.
Check for non-consecutive EAP-Message attributes.
Set the columns non-writable while dissecting the EAP message, so
Protocol and Info reflect the RADIUS packet.
Doing the reassembly by gluing together all the consecutive EAP-Message
attributes means we don't need help from the EAP dissector, returning
the total length of the EAP message. Get rid of the no-longer-needed
eap_fragment dissector; just call the regular EAP dissector.
svn path=/trunk/; revision=15046
(presumably-)harmless-but-otherwise-unremovable const-to-nonconst
warnings.
In the TACACS dissector, clean up the variables used in option parsing
to avoid some const-to-nonconst warnings.
Clean up some white space.
svn path=/trunk/; revision=15043
- use ep_alloc for reassemling eap fragments instead of a static buffer
- use ep_strdup_printf() instead of a static buffe to return the cosine's VP/VC AVP label
- add few TODO comments
svn path=/trunk/; revision=15028
read the RADIUS directory.
The error string from "radius_load_dictionary()" is g_malloced; free it,
and g_strdup the "Could not find the radius directory" error, so we
don't have to worry about constant vs. g_malloced strings.
svn path=/trunk/; revision=14937
add a "match_strval_idx()" routine that does the same thing, and have
"match_strval()" call it.
Make those routines, and "val_to_str()", return a "const" pointer.
Update dissectors as necessary to squelch compiler warnings produced by
that.
Use "val_to_str()" rather than using "match_strval()" and then, if the
result is null, substituting a specific string. Clean up some other
"match_strval()"/"val_to_str()" usages.
Add a null pointer check in the NDPS dissector's "attribute_value()"
routine, as it's not clear that "global_attribute_name" won't be null at
that point.
Make some global variables in the AFS4INT dissector local.
Make some routines not used outside the module they're in static.
Make some tables "static const".
Clean up white space.
Fix Gerald's address in some files.
svn path=/trunk/; revision=14786
in a simple approach, I've replaced all g_assert() and g_assert_not_reached() calls by their exception throwing counterparts DISSECTOR_ASSERT() and DISSECTOR_ASSERT_NOT_REACHED()
this will replace application crash by showing a dissector bug, which is the desired behaviour
there were some g_assert calls in the protocol registering functions, which might not be acting as expected now, but to be able to simply search for g_assert in the future I've replaced that calls too
one g_assert remained, the one when someone throws an unknown exception "into" packet_frame.c, but IMHO this one should remain.
svn path=/trunk/; revision=14608
- remove duplicate fields from VSAs (every defined field in VSAs was set twice)
- dissect radius packet with avplen == 0 (did not decode authenticator when no AVPs were present)
svn path=/trunk/; revision=13216
least 3 - 2 for type+length and 1 for the tag - so treat a "tagged
string" field as bad if there isn't at least one byte of data. (It's a
bit odd that the RFC says that the tag must be in the range 0x01-0x1F -
that sounds suspiciously as if they're saying "printable characters
aren't valid tags", to allow untagged strings, which might suggest that
a field with a length of 2 should be interpreted as an empty string.)
svn path=/trunk/; revision=12817
is >= 0 (if it's not, that's a bug), and make the buffer index and total
length variables int as well, to match the length.
svn path=/trunk/; revision=12811
case branches up, so the case branches are in the same order as the
elements of the enum are, and add length checks to RADIUS_TIMESTAMP and
RADIUS_INTEGER4_TAGGED.
svn path=/trunk/; revision=12810
we're fetching from the AVP.
In the case of a tagged string, if the length is 2 (meaning the data
length is 0), assume there's no tag.
svn path=/trunk/; revision=12808
for organizations to an <epan/sminmpec.h> header, and add in the ones
that were used (without #defines) in the Diameter dissector.
Merge the value_string tables for them from the Diameter and Radius
dissectors into epan/sminmpec.c and merge them.
Use that value_string table in the Diameter and Radius dissectors.
Constify some stuff in the Diameter dissector.
svn path=/trunk/; revision=12159
make the source files all include the corresponding header files (so
that the declarations in the headers have to match the definitions in
the source files in order for compilation to succeed).
svn path=/trunk/; revision=12116
if that pointer is non-null, put the field in question into the protocol
tree under the top-level item for that attribute/value pair, rather than
hardcoding particular fields for particular attribute codes.
Use BASE_NONE, not BASE_DEC, for FT_STRING, FT_BYTES, and FT_IPv4
fields.
svn path=/trunk/; revision=12048
Jörg Mayer