produces some floating-point noise in the nanoseconds field; we've
required 64-bit integer support for a while, so use that.
svn path=/trunk/; revision=11754
- test for NULL conversation data to avoid a potential crash when
looking up stream setup info (as RTP dissector does);
- adds a heuristic function (like RTP, this is a preference
initially set to off).
svn path=/trunk/; revision=11748
byte - and a length of 1 is used to put the message digest into the
protocol tree, which agrees with that. Therefore, "tvb_get_guint8()"
should be used to fetch it.
svn path=/trunk/; revision=11746
(or, as that documentation calls it, the language name) is the database
name; mark it as such.
It also says there's some other stuff, such as a client MAC address,
after the database offset/length (and that the NTLMSSP message doesn't
come right after the database offset/length, there's an offset/length
for the NTLMSSP message). Put in a comment about that.
svn path=/trunk/; revision=11713
protocol "dhcpfo", to match the filter names of its fields; that - or
changing the long name or abbreviation of the protocol - fixes the core
dump (which was in a check for a name being legal).
svn path=/trunk/; revision=11631
ISC DHCP Server 3.0 failover protocol dissection
Note: I tried to make the port configurable via prefs
but failed to do so: It always cashed on startup so it
is commented out for now.
svn path=/trunk/; revision=11630
1. define new TDS packet type (17) - NTLM authentication packet. Call
the ntlmssp dissector to dissect it when needed.
2. define new TDS packet type (18) - donno what it is exactly, but it's
there. Will dissect it someday.
3. heuristic in netlib_check_login_pkt should also check port 2433.
4. unify the dissection of msg and err token. They have the same
structure.
5. improve the dissection of the above mentioned token.
svn path=/trunk/; revision=11616
include of <resolv.h> in any system header file gets the system
<resolv.h> (needed for builds on Tru64 with GTK+ 1.2[.x]).
svn path=/trunk/; revision=11615
NTLMSSP-related than SMB-related, and documents about NTLMSSP talk about
it, so it's a little more convenient to keep all that stuff together -
and export it through a packet-ntlmssp.h header.
svn path=/trunk/; revision=11585
"Negotiate 56", meaning that 56-bit encryption is supported - and that
"Negotiate 128" means that 128-bit encryption is supported, so note that
in the blurb for that flag.
It also says that the values for "Request Init Response", "Request Accept
Response", and 'Request Non-NT Session Key" are a factor of 16 away from
what our #defines say they are, and that 0x000[124]0000 are "Target Type
{Domain,Server,Share}". Note that in a comment.
svn path=/trunk/; revision=11582
Many people have recently reported many problems with the nmake build
process. It seems that these problems come from using
epan/makefile.nmake to compile the DISSECTOR_SUPPORT_SOURCES which are
located in /trunk.
Nmake from MSVC6 puts the object code of the DISSECTOR_SUPPORT_SOURCES
in /epan although Nmake expects the object code in /trunk when it
checkes dependencies. Thus DISSECTOR_SUPPORT_OBJECTS are built every
time even when they are already there.
Nmake Version 1.5 (MSVC 2003 Toolkit) puts the object code of the
DISSECTOR_SUPPORT_SOURCES in /trunk instead.
This makes it impossible to use epan/makefile.nmake for compiling the
DISSECTOR_SUPPORT_SOURCES and to make it work for both versions of nmake.
We have to use /trunk/makefile.nmake for compiling the
DISSECTOR_SUPPORT_SOURCES to solve these issues.
It should also be possible to build ethereal without libethereal.dll again.
Once we have moved all DISSECTOR_SUPPORT_SOURCES into a subdirectory of
epan we can get rid of this patchwork in the nmake makefiles.
svn path=/trunk/; revision=11562
There is still a problem with MSVC builds as 3 objects get built twice (once
at the top level, and once in epan: xmlstub.obj, print.obj and ps.obj).
This fix allows to compile again with MSVC if debug symbols are NOT enabled
while building Ethereal. Do this by editing config.nmake and replacing
"LOCAL_LDFLAGS=/DEBUG" with "LOCAL_LDFLAGS=". In other words: Ethereal CANNOT
be built right now with debug symbols in the object code, for MSVC builds.
svn path=/trunk/; revision=11557
check whether "match_strval()" returned a null pointer before
using its return value;
mark the end-of-burst packet.
Clean up white space.
svn path=/trunk/; revision=11551
clean up the message printed when building libethereal.dll;
have "make distclean" clean out the "dissectors" subdirectory.
Clean up indentation.
svn path=/trunk/; revision=11540
31A and 31B in the 2000 and later 802.3 specs. (Dissecting them is left
as an exercise for the student.)
Clean up whitespace a bit.
svn path=/trunk/; revision=11536
the distribution, as was the case in the past.
Arrange that RCS IDs be expanded, and that the EOL style be native, for
epan/dissectors/Makefile.{am,common,nmake}.
svn path=/trunk/; revision=11532
before running it (printing echo commands puts extra gunk into the
output), and remove some additional generated files when doing "make
distclean".
svn path=/trunk/; revision=11517
x509af is now virtually complete (the attribute userPassword still needs
an attribute dissector but after that, x509af is complete)
svn path=/trunk/; revision=11510
explicitly pass NULL as the tree argument to
"dissect_ndr_uint32()" - "tree", which was passed before, was
definitely null at that point, and the intent is that it not put
anything into the protocol tree;
use the correct offset when putting items into the protocol tree
(the offset has been advanced just past the end of the field at
the time the items are being put into the protocol tree).
svn path=/trunk/; revision=11506
use this and create a new tvbsubset so that
1, reading too much data is flagged as MALFORMED PACKET indicating a bug in the dissector (or a packet that IS malformed)
2, this also implicitely passes the length of the data through the ber.oid dissector handle in case we want to pick it up later.
svn path=/trunk/; revision=11490
(see how good it is to put markers for emacs macros in the files, it was pretty quick, wasnt it? i even tested the resulting code.)
svn path=/trunk/; revision=11481
Also implement the attribute organizationName which is of this type.
(Add magic comments so emacs-macros will be happy.)
svn path=/trunk/; revision=11479
in promiscuous mode, packets captured promiscuously show up as 802.11
packets encapsulated in Ethernet, with an Ethernet type of 0x2452.
svn path=/trunk/; revision=11451
to the ethereal build.
The dissections are semi-useful but incomplete.
The big problem still remaining is the x509if Name object not being
dissected properly thus causing the dissection to get out of sync/fail
halfway through the certificate structure.
work in progress but already semi-useful.
svn path=/trunk/; revision=11440
"epan/packet_info.h" and put it in "epan/address.h".
Use the AT_ values from "epan/address.h" for address types in the
interface lists rather than having our own FAM_ enums.
svn path=/trunk/; revision=11427
Also move ncp222.py, x11-fields, process-x11-fields.pl,
make-reg-dotc, and make-reg-dotc.py.
Adjust #include lines in files that include packet-*.h
files.
svn path=/trunk/; revision=11410
they have LF at the end of the line on UN*X and CR/LF on Windows;
hopefully this means that if a CR/LF version is checked in on Windows,
the CRs will be stripped so that they show up only when checked out on
Windows, not on UN*X.
svn path=/trunk/; revision=11400
on success, so we clear it before calling them.
Assign the value of "strtol()" to a "long" and assign the value of
"strtoul()" to an "unsigned long", as those are the return types for
those functions - "gint32" and "guint32" might not be large enough for
the return value on an LP64 platform.
Check for errno being EINVAL, as that can happen if the number isn't
valid.
Before assigning the value returned by "strtol()" or "strtoul()" to the
final destination, check whether it's in the right range for that
destination.
svn path=/trunk/; revision=11382
- conversation.[ch] - To support not setting port2 on matching a
conversation. This is used by protocols such as iSNS in which the client
registers a TCP/UDP port with the server for notifications and the server
sends notifications to this port from different source ports.
- packet-isns.c - Added support for handling zero-length TLVs and ESI & SCN
frames (when registering an SCN/ESI port, a conversation dissector is
setup).
svn path=/trunk/; revision=11320
strength for AVS headers.
Also add them for the Prism and Radiotap headers, and for the
pseudo-header from non-native captures.
svn path=/trunk/; revision=11316
"SLAB_ITEM_TYPE_DEFINE()" macro to define a union of the type of object
for the slab and a pointer to an object of that union type, and use that
type for items on the slab allocator free lists; that *should* avoid
having the compiler think two pointers to an item being added to or
removed from the free list don't point to the same object just because
they have different types.
svn path=/trunk/; revision=11306
object being allocated, rather than the name of the free list, as an
argument (with the name of the free list constructed from the name of
the type), and add macros to define and declare the free list, also
taking the type of the object being allocated.
svn path=/trunk/; revision=11305
It does not decompress the compressed message it only displays the
uploaded bytecode for the UDVM ( Universal Decompressor Virtual Machine )
svn path=/trunk/; revision=11261
- moved doxygen.cfg to doxygen.cfg.in and let configure to the substitution
on unix. Adapted the namke files accordingly.
- Don't add doxygen as a dependency for libethereal and libui: As doxygen is
an unconditional target, this would cause the applications to be rebuild
every time make was called, even when nothing changed in the meantime.
This means that by now we need to do "make doxygen" manually in case we
want updated documentation.
svn path=/trunk/; revision=11238
use to format 64-bit integers.
Fix the RSVP dissector to use that rather than hardcoding "%ll" in.
Remove the "only if G_HAVE_GINT64 is defined" bit from the discussion of
64-bit integers - we're too dependent on having them to support
compilers that don't have a 64-bit integral data type. Do, however,
note that neither "long" nor "long long" are acceptable, and also note
that you shouldn't assume "%ll" does the trick for printing them.
svn path=/trunk/; revision=11182
the parse finishes (forcing us to feed the parser an end-of-input even
after an error) is that we don't create a new parser object when we
start a new parse and don't destroy it when the parse finishes.
svn path=/trunk/; revision=11156
Add a #define to enable parser tracing.
Clean up parser state when finished parsing, even if we stopped
parsing due to a syntax error, so that there's nothing left
around to screw up the next parse.
svn path=/trunk/; revision=11152
Use gint32 instead of guint32 for node data.
Fix up some other signed-vs-unsigned issues in the display filter
parser and lexical analyzer.
svn path=/trunk/; revision=11085
Fix assertion failure when absolute value of negative slice
offset > field length.
Remove code for handling negative slice lengths.
svn path=/trunk/; revision=11084
Check slice lengths as well as offsets. Disallow negative/zero
lengths.
Range on RHS of display filter expression wasn't being checked in
every case.
svn path=/trunk/; revision=11083
Use gint32 instead of guint32 and strtol() instead of strtoul()
for signed integers.
Pathological slice specifications could cause Flex default rule
to be invoked, echoing characters to stdout.
Example: frame[0foo]==1
svn path=/trunk/; revision=11082
add a config.nmake option to control whether to build
libethereal.dll or not;
remove "./wiretap" from PATH to prevent problems due to
wrongly-loaded files;
build dissector.lib with MSVC;
move "print.c" and "ps.c" to the dissector helpers, as "print.c"
imports variables from packet-frame.c and packet-data.c, which
are in libethereal;
move "g711.c" out of the dissector helpers, as they're used only
by Ethereal in a tap, not in Tethereal or in any dissector;
add a .def file for libethereal;
arrange to declare global variables exported from libethereal
with "__declspec(dllimport)" when building programs that import
those variables;
update the NSIS installer.
Make the "configure" script define ETH_VAR_IMPORT as "extern".
svn path=/trunk/; revision=10834
Error if protocol specified on RHS of display filter comparison.
If user specified "fc", they probably intended a byte value rather than
the fibre channel protocol; fix makes mistake clear.
Fix assertion failure with range on LHS of display filter comparison
and field on RHS.
svn path=/trunk/; revision=10829
octal, as the maximum of 3 octal digits can be more than 0377, but not
necessary for hex, as the maximum of 2 hex digits can't be more than
0xff).
svn path=/trunk/; revision=10827
Fix the PROTO_ITEM_IS_XXX and PROTO_ITEM_SET_XXX macros by replacing
the if(x) with trigraphs so the macros can still be used in subsequent
conditional tests.
svn path=/trunk/; revision=10758
media dissector for a given media type (value of a Content-Type header)
must provide the logic to fall-back to this media dissector upon no match.
Note that you must set the pinfo->match_string to the media type name,
and if the media type is specified with parameters, then those parameters
can be added to pinfo->private_data. If there are no parameters, or the
parameter decoding is not implemented, you must set pinfo->private_data
to NULL.
Known TODOs:
- Fix the WSP parameter handling so it accompanies any media dissector.
Simplest approach is to retrieve the header field label from the WSP
Content-Type field and to search for a semicolon in it (or by using
the string length of the content type string representation).
- Verify that that subdissection always works in the WSP dissector,
even when the protocol tree is not being built.
- Implement the media dissector in the remaining dissectors that use the
media type string table.
svn path=/trunk/; revision=10743
Dissection of the EncryptedFileSystem dce/rpc interface.
This dissector also contains a complete and fully tested IDL definition for
the entire interface.
svn path=/trunk/; revision=10734
any non-printable character in hex, as "\xNN". We rely on isprint(), which
may not be the best solution because it is locale-specific.
svn path=/trunk/; revision=10707
ANSI and GSM MAP stats enhancements and cleanups;
enhanced parameter dissection related to SS for GSM A-interface
and MAP;
minor GSM SMS fix;
GSM SS enhancements for parameter dissection;
MTP3 statistics tap.
svn path=/trunk/; revision=10655
errors to the user. Use that, rather than "g_warning()", in the
Diameter dissector to report errors reading the dictionary.
Make the format argument to "simple_dialog()" a "const" pointer.
Fix up the read-error message in Tethereal to end with a newline.
If a simple dialog is requested before the main window or the
capture-control window is popped up, queue it up and pop the queued
messages up once the main or capture-control window is displayed.
svn path=/trunk/; revision=10616
support them.
From Ronnie Sahlberg: Kerberos updates with new constants from the
current draft, decryption and dissection of Kerberos blobs, and changes
to work with the changed BER dissector.
svn path=/trunk/; revision=10479
that dissectors should call to report file open and read errors, and
have "report_open_failure()" and "report_read_failure()" call through
those pointers, rather than being defined and exported by the
application using libethereal - instead, the application would define
those functions and pass pointers to them to 'epan_init()".
Move "report_err.h" to the epan directory, as the functions it declares
are now part of the libethereal API.
svn path=/trunk/; revision=10470
characters.
Some strings appear to be null-padded; add a "tvb_format_stringzpad()"
routine to handle them, so that we don't show the padding characters as
"\000".
svn path=/trunk/; revision=10461
GSM A facility element decoding;
make TCAP dissector export routines for use by various GSM
dissectors;
make GSM MAP dissector use exported TCAP routines/defines;
GSM Supplementary Services support.
svn path=/trunk/; revision=10409
As this is experimental and does not yet work reliably this feature is
off by default. Enable it by using --with-krb5 during configure.
Please do not yet make use of this feature (i.e. please do not *use* the
defines provided by this option), until it has received further testing
and fixing.
Please run and check what the configure says.
svn path=/trunk/; revision=10395
firewall/Symantec Enterprise Firewall. Thanks, Axent/Symantec, for not
asking us for a DLT_ value and not telling us about the link-layer type.
svn path=/trunk/; revision=10361
- Create epan/Makefile.common
- Move dissector_src and helper files from Makefile.common to
epan/Makefile.common
- Create register.c in epan/
- link all the files into libethereal
- put plugin_src into epan/Makefile.am
Try to make rpms build with rpm v4 again (sorry, I've forgotten who to
attribute this to).
svn path=/trunk/; revision=10273
support the ISUP CIC as a circuit ID;
add a preference option to control whether to put the CIC into
the Info column or not.
svn path=/trunk/; revision=10265
(and the fact that nbss does not register its conversation)
this caused WANT_PDU_TRACKING to be decremented multiple times between
the dissectors
and thus ethereal could no longer reliably spot SMB PDUs that started in the middle of a tcp segment (unless we do reassembly which we dont do unless we have to since it eats soo many resources)
FIX so that ethereal once again can spot SMB (and other) protocol PDUs that start in the middle of a segment.
svn path=/trunk/; revision=10219
where the values all have #defines or enum values and the corresponding
strings are just the #define or enum value names.
svn path=/trunk/; revision=10187
then make sure that the FIELD can participate in the relation that
is expressed in the display filter.
Note that tvbuff's *should* be able to participate in == comparisons, etc.,
but those functions need to be added to ftype-tvbuff.c first.
svn path=/trunk/; revision=10175
available if *any* forms of name resolution aren't enabled. (Well,
actually, it should probably affect only the item the mouse was over
when you selected it, and should be available if name resolution for
that type of name isn't enabled, but....)
svn path=/trunk/; revision=10056
analyzer on errors, and check for SCAN_FAILED from the lexical analyzer
and abort the parse if we see it; 0 means "end of input", and we want to
distinguish errors from end-of-input, so that we can report errors as
such.
If we see end-of-input while parsing a double-quoted string, report the
error (missing closing quote).
Fix the URL for the "Start conditions" section of the Flex manual.
svn path=/trunk/; revision=10044
check, in the semantics-checking phase, that we're testing a field, so
that we can give a better message than, for example, "Unexpected end of
filter string." for an existence test with a misspelled field name.
svn path=/trunk/; revision=10043
