draft-ietf-ipsec-udp-encaps-06 says "The UDP port numbers are the same
as used by IKE traffic, as defined in [Kiv05]", and "[Kiv05]" is
draft-ietf-ipsec-nat-t-ike-05, which has been superseded by
draft-ietf-ipsec-nat-t-ike-07; the latter appears to imply that it goes
over port 4500, not port 500.
We already have a draft-ietf-ipsec-udp-encaps-06 dissector for port
4500 (packet-ipsec-udp.c), and it's not entirely clear to me how, if
draft-ietf-ipsec-udp-encaps-06 traffic *did* go over port 500, you'd
distinguish it from regular ISAKMP traffic.
svn path=/trunk/; revision=8882
the version-independent part of the draft ID for "Negotiation of
NAT-Traversal in the IKE" rather than giving a URL for the draft (the
URL in question was out-of-date, and a future one runs the risk of
becoming out of date, given that the -07 draft expired a few days
ago...).
svn path=/trunk/; revision=8644
1. Add NAT-D and NAT-OA to the known payloads (does not dissect NAT-D
yet, though),
2. Add types 3 and 4 as enapsulated tunnel and transport.
svn path=/trunk/; revision=6947
1. Add parsing of group description attribute (donno why it was
missed so far).
2. Enumeration of # of transforms and # of payloads (just makes
it easier to look at).
3. Parsing of Vendor ID:
3.1 Identify several vendors' Vendor ID string (Microsoft,
CyberGuard, SafeNet, Check Point at the moment) - if
anyone has more VendorID strings, I'd be more than
happy to add them.
3.2 Identify Vendor ID string of draft_ietf_ipsec_nat_t_ike_03
(NAT traversal RFC draft).
3.3 Further parsing of Check Point's Vendor ID string, to
include Check Point product and version. If anyone has
other vendors' parsing knowledge, again, I'd be happy
to add it.
svn path=/trunk/; revision=6033
1. Proper extraction of data from packet (removed bad
tvb_get_ptr() and casting the resulting pointer to a
structure method).
2. Printout of Initator and Responder cookies (per request from
VPNC organization).
svn path=/trunk/; revision=6013
equivalents for the toplevel directory. The removal of winsock2.h will
hopefully not cause any problems under MSVC++, as those files using
struct timeval still include wtap.h, which still includes winsock2.h.
svn path=/trunk/; revision=5932
"epan/..." pathnames, so as to avoid collisions with header files in any
of the directories in which we look (e.g., "proto.h", as some other
package has its own "proto.h" file which it installs in the top-level
include directory).
Don't add "-I" flags to search "epan", as that's no longer necessary
(and we want includes of "epan" headers to fail if the "epan/" is left
out, so that we don't re-introduce includes lacking "epan/").
svn path=/trunk/; revision=4586
structure to the "packet_info" structure; only stuff that's permanently
stored with each frame should be in the "frame_data" structure, and the
"column_info" structure is not guaranteed to hold the column values for
that frame at all times - it was only in the "frame_data" structure so
that it could be passed to dissectors, and, as all dissectors are now
passed a pointer to a "packet_info" structure, it could just as well be
put in the "packet_info" structure.
That saves memory, by shrinking the "frame_data" structure (there's one
of those per frame), and also lets us clean up the code a bit.
svn path=/trunk/; revision=4370
take a dissector handle as an argument, rather than a pointer to a
dissector function and a protocol ID. Associate dissector handles with
dissector table entries.
svn path=/trunk/; revision=4308
pass -1 in the cases where it's not called from "dissect_proposal()",
i.e. where there *is* no protocol ID to pass it, and have it dissect
the transform ID only as a number if the protocol ID isn't one of the
ones we know about.
Give the payload dissectors other than "dissect_transform()" an extra
"int" argument, so that their signature is the same as that of
"dissect_transform()", put "dissect_transform()" back in the
"strfuncs[]" table, and get rid of the special-casing of
"dissect_transform()" in "dissect_payloads()".
svn path=/trunk/; revision=4086
common routine that loops over payloads.
Have that routine check for a payload of type "None", which means that
there's extra data after a payload that claimed to be the last one (by
virtue of having a next payload type of "None").
When dissecting a Security Association payload, make sure we have enough
data for the Domain of Interpretation field before putting it into the
tree, dissect the situation as a 4-byte quantity followed by a set of
sub-payloads only of the DOI is "IPSEC" (otherwise dissect it as raw
data), and make sure we have enough data for the 4-byte situation field
before putting it into the tree.
When dissecting a Proposal payload, show the raw bytes of the SPI.
svn path=/trunk/; revision=4081
room, it might return -1 in some versions of glibc; check for that, and
quit if that happens.
It might also return the number of characters that would've been printed
had there been enough room; this means that a loop that does
n += snprintf (buf + n, BUF_LENGTH - n, ...);
may end up making "n" bigger than BUF_LENGTH, and "snprintf()" might not
sanely handle being passed a negative length, so if "n" isn't less than
the total length of the string buffer, don't add stuff to it.
The "capabilitiesStart" variable in "add_capabilities()" in the WSP
dissector is an offset into the PDU data; there's no guarantee that said
offet is < 256, and, even if there were, there's no point in making it
an 8-bit variable.
Add some additional buffer overflow checks to the WSP dissector.
svn path=/trunk/; revision=3953
(the minimum) if it's less than 4; also, add code to put a note that the
payload length is bogus into the protocol tree.
svn path=/trunk/; revision=3253
Handle the payloads iteratively rather than recursively, so that the
code that knows how to iterate over payloads is confined to a small
number of places rather than being in every single payload dissector.
Pull the code to dissect the generic payload header into a single
routine, and do it in the code that iterates over payloads rather than
in the dissectors for each payload.
Clean up some other things.
svn path=/trunk/; revision=3085
"{old_}heur_dissector_add()", "{old_}conv_dissector_add()", and
"register_dissector()", so that an entry in those tables has associated
with it the protocol index of the protocol the dissector handles (or -1,
if there is no protocol index for it).
This is for future use in a number of places.
(Arguably, "proto_register_protocol()" should take a dissector pointer
as an argument, but
1) it'd have to handle both regular and heuristic dissectors;
2) making it take either a "dissector_t" or a union of that and
a "heur_dissector_t" introduces some painful header-file
interdependencies
so I'm punting on that for now. As with other Ethereal internal APIs,
these APIs are subject to change in the future, at least until Ethereal
1.0 comes out....)
svn path=/trunk/; revision=2849
protocols, in addition to adding structures to the list of filterable
fields. Give it an extra argument that specifies a "short name" for the
protocol, for use in such places as
pinfo->current_proto;
the dialog box for constructing filters;
the preferences tab for the protocol;
and so on (although we're not yet using it in all those places).
Make the preference name that appears in the preferences file and the
command line for the DIAMETER protocol "diameter", not "Diameter"; the
convention is that the name in question be all-lower-case.
Make some routines and variables that aren't exported static.
Update a comment in the ICP dissector to make it clear that the
dissector won't see fragments other than the first fragment of a
fragmented datagram.
svn path=/trunk/; revision=2810
can be put, and a pointer to the string for the column, which might or
might not point to that buffer.
Add a routine "col_set_str()", which sets the string for the column to
the string passed to it as an argument; it should only be handed a
static string (a string constant would be ideal). It doesn't do any
copying, so it's faster than "col_add_str()".
Make the routines that append to columns check whether the pointer to
the string for the column points to the buffer for the column and, if
not, copy the string for the column to the buffer for the column so that
you can append to it (so you can use "col_set_str()" and then use
"col_append_str()" or "col_append_fstr()").
Convert a bunch of "col_add_str()" calls that take a string constant as
an argument to "col_set_str()" calls.
Convert some "col_add_fstr()" calls that take a string constant as the
only argument - i.e., the format string doesn't have any "%" slots into
which to put strings for subsequent arguments to "col_set_str()" calls
(those calls are just like "col_add_str()" calls).
Replace an END_OF_FRAME reference in a tvbuffified dissector with a
"tvb_length(tvb)" call.
svn path=/trunk/; revision=2670
the following:
It is now possible to enable/disable a particular protocol decoding
(i.e. the protocol dissector is void or not). When a protocol
is disabled, it is displayed as Data and of course, all linked
sub-protocols are disabled as well.
Disabling a protocol could be interesting:
- in case of buggy dissectors
- in case of wrong heuristics
- for performance reasons
- to decode the data as another protocol (TODO)
Currently (if I am not wrong), all dissectors but NFS can be disabled
(and dissectors that do not register protocols :-)
I do not like the way the RPC sub-dissectors are disabled (in the
sub-dissectors) since this could be done in the RPC dissector itself,
knowing the sub-protocol hfinfo entry (this is why, I've not modified
the NFS one yet).
Two functions are added in proto.c :
gboolean proto_is_protocol_enabled(int n);
void proto_set_decoding(int n, gboolean enabled);
and two MACROs which can be used in dissectors:
OLD_CHECK_DISPLAY_AS_DATA(index, pd, offset, fd, tree)
CHECK_DISPLAY_AS_DATA(index, tvb, pinfo, tree)
See also the XXX in proto_dlg.c and proto.c around the new functions.
svn path=/trunk/; revision=2267
- add <stdarg.h> or <varargs.h> in snprintf.h
and remove those inclusions in the other #ifdef NEED_SNPRINTF_H codes
- remove the check of multiple inclusions in source (.c) code
(there is a bit loss of _cpp_ performance, but I prefer the gain of
code reading and maintenance; and nowadays, disk caches and VM are
correctly optimized ;-).
- protect all (well almost) header files against multiple inclusions
- add header (i.e. GPL license) in some include files
- reorganize a bit the way header files are included:
First:
#include <system_include_files>
#include <external_package_include_files (e.g. gtk, glib etc.)>
Then
#include "ethereal_include_files"
with the correct HAVE_XXX or NEED_XXX protections.
- add some HAVE_XXX checks before including some system header files
- add the same HAVE_XXX in wiretap as in ethereal
Please forgive me, if I break something (I've only compiled and regression
tested on Linux).
svn path=/trunk/; revision=2254
dissectors to be registered as dissectors for particular ports,
registered as heuristic dissectors, and registered as dissectors for
conversations, and have routines to be used both by old-style and
new-style dissectors to call registered dissectors.
Have the code that calls those dissectors translate the arguments as
necessary. (For conversation dissectors, replace
"find_conversation_dissector()", which just returns a pointer to the
dissector, with "old_try_conversation_dissector()" and
"try_conversation_dissector()", which actually call the dissector, so
that there's a single place at which we can do that translation. Also
make "dissector_lookup()" static and, instead of calling it and, if it
returns a non-null pointer, calling that dissector, just use
"old_dissector_try_port()" or "dissector_try_port()", for the same
reason.)
This allows some dissectors that took old-style arguments and
immediately translated them to new-style arguments to just take
new-style arguments; make them do so. It also allows some new-style
dissectors not to have to translate arguments before calling routines to
look up and call dissectors; make them not do so.
Get rid of checks for too-short frames in new-style dissectors - the
tvbuff code does those checks for you.
Give the routines to register old-style dissectors, and to call
dissectors from old-style dissectors, names beginning with "old_", with
the routines for new-style dissectors not having the "old_". Update the
dissectors that use those routines appropriately.
Rename "dissect_data()" to "old_dissect_data()", and
"dissect_data_tvb()" to "dissect_data()".
svn path=/trunk/; revision=2218
name, and add the RFC number for ISAKMP to it.
Fix the structures for headers to treat all multi-byte quantities as
arrays of bytes; the certificate request header needs to be done that
way, so that it's *not* padded to a multiple of the size of the longest
integral element (the longest integral element is 2 bytes, but the size
of the header is 5 bytes, so certificate requests were being
misdissected), and other structures might require this as well - it also
catches code that doesn't use "pntohl()" or "pntohs()" to get the values
of integral fields bigger than 1 byte.
In fact, it *did* catch some; the configuration attribute header's
"identifier" field was being used without being put in host byte order.
In addition, that field required padding to be aligned on its natural
boundary, but the padding wasn't given as a structure member; given that
the length field was specified as one byte but extracted with
"pntohs()", and that the length field is 2 bytes in the other headers,
it probably should be 2 bytes in this header as well - make it so.
svn path=/trunk/; revision=2101
Guy Harris