| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Response is calculated in the same way as for oncrpc, dcerpc, smb...
requests where a reply has been matched will now have a
Reply In:<framenumber>
in the tree pane.
replies where the request has been seen will have
Request In:<framenumber>
Time since request:<seconds>
later tethereal and ethereal rtt stats will be implemented.
svn path=/trunk/; revision=7284
|
|
|
|
|
|
|
| |
with "proto_tree_add_uint()", which "OUT_UINT()" uses; use "OUT_INT()"
instead.
svn path=/trunk/; revision=7010
|
|
|
|
|
|
|
|
|
|
|
| |
seconds as well as for UNIX-style date/time stamps.
FT_ABSOLUTE_TIME fields don't have a base, so use BASE_NONE.
Make hf_afs_fs_callback_expires an FT_RELATIVE_TIME, as it's a relative
time not an absolute UNIX time.
svn path=/trunk/; revision=6937
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
pointers.
The first argument to "sscanf()" is a "const char *"; don't cast const
pointers to "char *" when passing them to "sscanf()".
Assign the result of "tvb_get_ptr()" to const pointers, not non-const
pointers.
Make the "pdata" argument to various DCE routines a const pointer.
svn path=/trunk/; revision=6688
|
|
|
|
| |
svn path=/trunk/; revision=6360
|
|
|
|
|
|
|
| |
winapi_cleanup tool written by Patrik Stridvall for the wine
project.
svn path=/trunk/; revision=6117
|
|
|
|
|
|
|
|
| |
equivalents for the toplevel directory. The removal of winsock2.h will
hopefully not cause any problems under MSVC++, as those files using
struct timeval still include wtap.h, which still includes winsock2.h.
svn path=/trunk/; revision=5932
|
|
|
|
|
|
|
|
| |
requests - the data part of the AFS authentication request
(hf_afs_kauth_data) is displayed as a string whilst declared as a binary
array in "packet-afs-register-info.h".
svn path=/trunk/; revision=5661
|
|
|
|
|
|
|
|
|
| |
static, and add a new "packet-data.h" to declare "proto_data".
Display escape sequences in octal in the IAPP dissector, as is now done
in the RADIUS dissector.
svn path=/trunk/; revision=5441
|
|
|
|
| |
svn path=/trunk/; revision=5404
|
|
|
|
| |
svn path=/trunk/; revision=5360
|
|
|
|
|
|
| |
dissection
svn path=/trunk/; revision=4711
|
|
|
|
| |
svn path=/trunk/; revision=4690
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
tvb_length_remaining() except that it throws BoundsError if 'offset'
is out-of-bounds.
Allow a length argument of -1 for FT_STRING and FT_BYTES fields
in proto_tree_add_item().
Change some dissectors to either use -1 for the length argument in
calls to proto_tree_add_item(), or call tvb_ensure_length_remaining()
instead of tvb_length_remaining(), or to check the return-value
of tvb_length_remaining(). Changes to more dissectors are necessary,
but will follow later.
svn path=/trunk/; revision=4656
|
|
|
|
|
|
|
|
|
|
|
|
| |
arguments to "proto_tree_add_text()", and to "proto_tree_add_XXX()" calls
that add FT_NONE or FT_PROTO items to the protocol tree, with -1.
Replace some calls to "tvb_length()" or "tvb_length_remaining()" with
calls to "tvb_reported_length()" and "tvb_reported_length_remaining()",
as those give the actual length of the data in the packet, not just the
data that happened to be captured.
svn path=/trunk/; revision=4605
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
"epan/..." pathnames, so as to avoid collisions with header files in any
of the directories in which we look (e.g., "proto.h", as some other
package has its own "proto.h" file which it installs in the top-level
include directory).
Don't add "-I" flags to search "epan", as that's no longer necessary
(and we want includes of "epan" headers to fail if the "epan/" is left
out, so that we don't re-introduce includes lacking "epan/").
svn path=/trunk/; revision=4586
|
|
|
|
| |
svn path=/trunk/; revision=4570
|
|
|
|
| |
svn path=/trunk/; revision=4569
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
structure to the "packet_info" structure; only stuff that's permanently
stored with each frame should be in the "frame_data" structure, and the
"column_info" structure is not guaranteed to hold the column values for
that frame at all times - it was only in the "frame_data" structure so
that it could be passed to dissectors, and, as all dissectors are now
passed a pointer to a "packet_info" structure, it could just as well be
put in the "packet_info" structure.
That saves memory, by shrinking the "frame_data" structure (there's one
of those per frame), and also lets us clean up the code a bit.
svn path=/trunk/; revision=4370
|
|
|
|
|
|
| |
"private_data", to keep C++ compilers from getting heartburn.
svn path=/trunk/; revision=4130
|
|
|
|
|
|
|
|
|
|
|
| |
of protocol-id-plus-datum pairs, so that multiple protocols can attach
information to the same conversation.
Dissectors that attach information to a conversation should not assume
that if they find a conversation it has one of its data attached to it;
the conversation might've been created by another dissector.
svn path=/trunk/; revision=3901
|
|
|
|
|
|
|
|
|
|
| |
"void *" that a dissector can set to point to such a structure; that
means that the stuff in the epan directory doesn't have to know anything
about the protocol-specific private data one dissector passes to
another, and that structure doesn't have to be changed if a dissector
wants to pass some new type of data to another dissector.
svn path=/trunk/; revision=3818
|
|
|
|
| |
svn path=/trunk/; revision=3560
|
|
|
|
|
|
| |
Update Gerald's e-mail address.
svn path=/trunk/; revision=3458
|
|
|
|
| |
svn path=/trunk/; revision=3454
|
|
|
|
| |
svn path=/trunk/; revision=3248
|
|
|
|
| |
svn path=/trunk/; revision=3190
|
|
|
|
|
|
|
| |
dissection. Will be more coming, but wanted to commit these before I headed
home.
svn path=/trunk/; revision=3172
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
protocols, in addition to adding structures to the list of filterable
fields. Give it an extra argument that specifies a "short name" for the
protocol, for use in such places as
pinfo->current_proto;
the dialog box for constructing filters;
the preferences tab for the protocol;
and so on (although we're not yet using it in all those places).
Make the preference name that appears in the preferences file and the
command line for the DIAMETER protocol "diameter", not "Diameter"; the
convention is that the name in question be all-lower-case.
Make some routines and variables that aren't exported static.
Update a comment in the ICP dissector to make it clear that the
dissector won't see fragments other than the first fragment of a
fragmented datagram.
svn path=/trunk/; revision=2810
|
|
|
|
| |
svn path=/trunk/; revision=2723
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- packet-afs.c: dissect_acl() didn't restrict the size of a string read
with sscanf(). An exploit has been released.
- packet-nbns.c: When passed an illegal name, get_nbns_name() would
overrun nbname with an error message. This isn't exploitable AFAIK,
but it could result in a crash.
- packet-ntp.c: dissect_ntp() wasn't checking the length of the
reference clock's host name. This is most likely exploitable.
This fix simply lops off the end of the host name if it's too long.
We should probably add an ellipsis (...) as we have done in other
places in the code.
svn path=/trunk/; revision=2671
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
can be put, and a pointer to the string for the column, which might or
might not point to that buffer.
Add a routine "col_set_str()", which sets the string for the column to
the string passed to it as an argument; it should only be handed a
static string (a string constant would be ideal). It doesn't do any
copying, so it's faster than "col_add_str()".
Make the routines that append to columns check whether the pointer to
the string for the column points to the buffer for the column and, if
not, copy the string for the column to the buffer for the column so that
you can append to it (so you can use "col_set_str()" and then use
"col_append_str()" or "col_append_fstr()").
Convert a bunch of "col_add_str()" calls that take a string constant as
an argument to "col_set_str()" calls.
Convert some "col_add_fstr()" calls that take a string constant as the
only argument - i.e., the format string doesn't have any "%" slots into
which to put strings for subsequent arguments to "col_set_str()" calls
(those calls are just like "col_add_str()" calls).
Replace an END_OF_FRAME reference in a tvbuffified dissector with a
"tvb_length(tvb)" call.
svn path=/trunk/; revision=2670
|
|
|
|
| |
svn path=/trunk/; revision=2556
|
|
|
|
| |
svn path=/trunk/; revision=2555
|
|
|
|
| |
svn path=/trunk/; revision=2554
|
|
|
|
|
|
|
| |
structures. Renamed decoding macros to get them more consistent and in
line with AFS data types wherever possible.
svn path=/trunk/; revision=2553
|
|
|
|
| |
svn path=/trunk/; revision=2551
|
|
|
|
| |
svn path=/trunk/; revision=2550
|
|
|
|
| |
svn path=/trunk/; revision=2549
|
|
|
|
|
|
| |
outside "packet-afs.c".
svn path=/trunk/; revision=2531
|
|
|
|
|
|
| |
Jeff Foster.
svn path=/trunk/; revision=2523
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
the following:
It is now possible to enable/disable a particular protocol decoding
(i.e. the protocol dissector is void or not). When a protocol
is disabled, it is displayed as Data and of course, all linked
sub-protocols are disabled as well.
Disabling a protocol could be interesting:
- in case of buggy dissectors
- in case of wrong heuristics
- for performance reasons
- to decode the data as another protocol (TODO)
Currently (if I am not wrong), all dissectors but NFS can be disabled
(and dissectors that do not register protocols :-)
I do not like the way the RPC sub-dissectors are disabled (in the
sub-dissectors) since this could be done in the RPC dissector itself,
knowing the sub-protocol hfinfo entry (this is why, I've not modified
the NFS one yet).
Two functions are added in proto.c :
gboolean proto_is_protocol_enabled(int n);
void proto_set_decoding(int n, gboolean enabled);
and two MACROs which can be used in dissectors:
OLD_CHECK_DISPLAY_AS_DATA(index, pd, offset, fd, tree)
CHECK_DISPLAY_AS_DATA(index, tvb, pinfo, tree)
See also the XXX in proto_dlg.c and proto.c around the new functions.
svn path=/trunk/; revision=2267
|
|
|
|
| |
svn path=/trunk/; revision=2083
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
a particular type, rather than taking a varargs list, along the lines of
the "proto_tree_add_XXX_format()" routines.
Replace most calls to "proto_tree_add_item()" and
"proto_tree_add_item_hidden()" with calls to those routines.
Rename "proto_tree_add_item()" and "proto_tree_add_item_hidden()" to
"proto_tree_add_item_old()" and "proto_tree_add_item_hidden_old()", and
add new "proto_tree_add_item()" and "proto_tree_add_item_hidden()"
routines that don't take the item to be added as an argument - instead,
they fetch the argument from the packet whose tvbuff was handed to them,
from the offset handed to them.
svn path=/trunk/; revision=2031
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Add exceptions routines.
Convert proto_tree_add_*() routines to require tvbuff_t* argument.
Convert all dissectors to pass NULL argument ("NullTVB" macro == NULL) as
the tvbuff_t* argument to proto_tree_add_*() routines.
dissect_packet() creates a tvbuff_t, wraps the next dissect call in
a TRY block, will print "Short Frame" on the proto_tree if a BoundsError
exception is caught.
The FDDI dissector is converted to use tvbuff's.
svn path=/trunk/; revision=1939
|
|
|
|
|
|
|
|
|
|
| |
to a type requiring 2-byte or better alignment and was then
dereferenced; doing that requires that the code generated by your
compiler not trap if it makes an unaligned reference, and on most RISC
processors the code generated by the compiler *will* trap on an
unaligned reference by default.
svn path=/trunk/; revision=1480
|
|
|
|
| |
svn path=/trunk/; revision=1437
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
routines, which are called before a dissection pass is made over all the
packets in a capture - the "init" routine would clear out any state
information that needs to be initialized before such a dissection pass.
Make the NCP, SMB, AFS, and ONC RPC dissectors register their "init"
routines with that mechanism, have the code that reads in a capture file
call the routine that calls all registered "init" routines rather than
calling a wired-in set of "init" routines, and also have the code that
runs a filtering or colorizing pass over all the packets call that
routine, as a filtering or colorizing pass is a dissection pass.
Have the ONC RPC "init" routine zero out the table of RPC calls, so that
it completely erases any state from the previous dissection pass (so
that, for example, if you run a filtering pass, it doesn't mark any
non-duplicate packets as duplicates because it remembers them from the
previous pass).
svn path=/trunk/; revision=1050
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
dynamically-assigned "ett_" integer values, assigned by
"proto_register_subtree_array()"; this:
obviates the need to update "packet.h" whenever you add a new
subtree type - you only have to add a call to
"proto_register_subtree_array()" to a "register" routine and an
array of pointers to "ett_", if they're not already there, and
add a pointer to the new "ett_" variable to the array, if they
are there;
would allow run-time-loaded dissectors to allocate subtree types
when they're loaded.
svn path=/trunk/; revision=1043
|
|
|
|
| |
svn path=/trunk/; revision=944
|