aboutsummaryrefslogtreecommitdiffstats
path: root/packet-netbios.c
Commit message (Collapse)AuthorAgeFilesLines
* If NBF reassembly isn't enabled, hand Data First Middle frames toGuy Harris2002-12-171-19/+14
| | | | | | | | | | subdissectors, so that we try to dissect the first frame of a multi-frame message as, for example, SMB, as that's the frame that contains the SMB header. (That also means we try to dissect middle frames, but that probably won't work unless one happens to begin with 0xff S M B.) svn path=/trunk/; revision=6791
* Make the fragment item table static and const.Guy Harris2002-12-031-17/+17
| | | | | | | | | Call the pieces of a multi-frame NetBIOS message fragments, not segments. Fix a typo. svn path=/trunk/; revision=6736
* Add a "fragment_add_seq_next()" to reassemble fragments that don't haveGuy Harris2002-10-241-73/+303
| | | | | | | | | | | | | | | | | | | | | | | | sequence numbers or offsets and are thus assumed to be received in order with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where 802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or dropped fragments). "show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the "fragment_items" to which the "fit" argument points, so make that argument a "const fragment_items *". Make all the "fragment_items" tables "static" (as they're not used outside the modules defining them) and "const" (as they're not modified). Add support for reassembly of NetBIOS fragmented requests and responses. Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS dissector, and make its table of dissection function pointers static. Fix some typos in the AppleTalk and NetBIOS dissectors. svn path=/trunk/; revision=6491
* Removed trailing whitespaces from .h and .c files using theJörg Mayer2002-08-281-22/+22
| | | | | | | winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
* Replace the types from sys/types.h and netinet/in.h by their glib.hJörg Mayer2002-08-021-8/+4
| | | | | | | | equivalents for the toplevel directory. The removal of winsock2.h will hopefully not cause any problems under MSVC++, as those files using struct timeval still include wtap.h, which still includes winsock2.h. svn path=/trunk/; revision=5932
* Remove trailing space characters between a netbios name and the name type.Tim Potter2002-07-221-1/+14
| | | | | | This makes the display look much nicer! svn path=/trunk/; revision=5903
* Mark unused arguments as such.Guy Harris2002-05-041-3/+4
| | | | svn path=/trunk/; revision=5384
* Add registered fields for more DATA1 and DATA2 values.Guy Harris2002-05-021-95/+103
| | | | | | | | | | | Add an "nb_data1()" routine to add DATA1 values to the protocol tree. Have "nb_data2()" take an hf_ value as an argument and add the field with "proto_tree_add_item()". Decode the values for "largest frame". svn path=/trunk/; revision=5342
* Use a value_string for NBF command names and for caller name types.Guy Harris2002-05-011-93/+128
| | | | | | | | | | | | | | | | | | | | | | Make the transmit and receive correlators unsigned quantities - they're just opaque hex packet IDs. "nb_data2()" always processes 16-bit quantities; get rid of the "len" argument to it. Make it use its "label" argument as a format. Show the data in an unknown command as "Unknown NetBIOS command data". Add routines to dissect TERMINATE TRACE and SESSION ALIVE commands. Note where we'd do reassembly were we to do that. Don't dissect the payload of the packet as NetBIOS payload unless the command was DATAGRAM, BROADCAST DATAGRAM, DATA FIRST MIDDLE, or DATA ONLY LAST. Fix up the lengths and names of some fields. svn path=/trunk/; revision=5338
* From Joerg Mayer: get rid of extra arguments to capture routines.Guy Harris2002-04-241-2/+2
| | | | svn path=/trunk/; revision=5233
* Include files from the "epan" directory and subdirectories thereof withGuy Harris2002-01-211-2/+2
| | | | | | | | | | | | | "epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
* Move the pointer to the "column_info" structure in the "frame_data"Guy Harris2001-12-101-9/+9
| | | | | | | | | | | | | | | structure to the "packet_info" structure; only stuff that's permanently stored with each frame should be in the "frame_data" structure, and the "column_info" structure is not guaranteed to hold the column values for that frame at all times - it was only in the "frame_data" structure so that it could be passed to dissectors, and, as all dissectors are now passed a pointer to a "packet_info" structure, it could just as well be put in the "packet_info" structure. That saves memory, by shrinking the "frame_data" structure (there's one of those per frame), and also lets us clean up the code a bit. svn path=/trunk/; revision=4370
* Make "dissector_add()", "dissector_delete()", and "dissector_change()"Guy Harris2001-12-031-2/+6
| | | | | | | | take a dissector handle as an argument, rather than a pointer to a dissector function and a protocol ID. Associate dissector handles with dissector table entries. svn path=/trunk/; revision=4308
* Moved from using dissect_data() to using call_dissector()Ed Warnicke2001-11-261-3/+6
| | | | svn path=/trunk/; revision=4269
* Make the capture routines take an additional argument giving the amountGuy Harris2001-11-201-2/+2
| | | | | | | | | | | of packet data captured. Make the "BYTES_ARE_IN_FRAME()" macro take a "captured length of the packet" argument. Add some length checks to capture routines. svn path=/trunk/; revision=4235
* Make the item for NetBIOS only as long as the NetBIOS header, so that itGuy Harris2001-09-291-2/+2
| | | | | | doesn't cover the payload. svn path=/trunk/; revision=3977
* Start the process of tvbuffifying the SMB dissector - give it aGuy Harris2001-09-291-25/+5
| | | | | | | | | | | tvbuffified heuristic-dissector interface, but have it immediately turn its arguments into an old-style buffer pointer and offset. Register the SMB dissector as a heuristic NetBIOS dissector, and have "dissect_netbios_payload()" just try the heuristics, as it no longer has to call the SMB dissector explicitly. svn path=/trunk/; revision=3973
* Have "dissect_netbios_payload()" take as an argument a tvbuff containingGuy Harris2001-09-291-14/+13
| | | | | | | | only the NetBIOS payload, and have the NBSS dissector construct tvbuffs of that sort (i.e., stop at the end of the NBSS session message, not at the end of the data handed to the NBSS dissector). svn path=/trunk/; revision=3972
* From Todd Sabin: dissect the auth info in connection oriented dcerpcGuy Harris2001-09-281-23/+39
| | | | | | | | | | | | | | | | | | | packets. Make a "dissect_netbios_payload()" routine, called from the NetBIOS-over-802.2 (NBF), NetBIOS-over-IPX, and NetBIOS-over-TCP dissectors. Take Todd Sabin's changes to add a heuristic dissector list to the NBSS dissector, and apply them to "dissect_netbios_payload()" instead. Make the SMB dissector heuristic, returning FALSE if it doesn't see 0xFF S M B at the beginning of the packet, and have "dissect_netbios_payload()" first try the heuristic dissector list, then try the SMB dissector if no other heuristic dissector claims the packet, then just dissect the payload as data. From Todd Sabin: have the DCE/RPC dissector register as a heuristic dissector for NetBIOS. svn path=/trunk/; revision=3969
* Make the resolution for time values be nanoseconds rather thanGuy Harris2001-09-141-8/+6
| | | | | | | | microseconds. Fix some "signed vs. unsigned" comparison warnings. svn path=/trunk/; revision=3934
* From Joerg Mayer: explicitly fill in all members of aGuy Harris2001-06-181-18/+18
| | | | | | | "header_field_info" structure, including the ones that are later set by the routines to register fields. svn path=/trunk/; revision=3561
* Don't use END_OF_FRAME in tvbuffified dissectors.Guy Harris2001-05-271-2/+2
| | | | svn path=/trunk/; revision=3468
* Tvbuffify a commented-out line.Guy Harris2001-02-261-2/+2
| | | | svn path=/trunk/; revision=3075
* Remove more "CHECK_DISPLAY_AS_DATA()" calls and "pinfo->current_proto ="Guy Harris2001-01-221-5/+1
| | | | | | | | | | | | | | | statements. Move the setting of the Protocol column in the Appletalk ARP and IPX dissectors before anything is fetched from the packet, and also clear the Info column at that point in those and some other dissectors, so that if an exception is thrown, the columns don't reflect the previous protocol. Fix the registration of the IPX RIP dissector to use the right protocol ID. svn path=/trunk/; revision=2928
* "get_netbios_name()" can never return a negative number as the nameGuy Harris2001-01-151-33/+11
| | | | | | | | | | | | | | | type, so "netbios_add_name()" doesn't need to check for it doing so (yes, the tvbuff stuff *does* catch "get_netbios_name()" running past the end of the packet, and causes an exception to be thrown). Get rid of the check, and get rid of "netbios_add_name()"s return value. In "dissect_nbipx_dg()", always call the SMB dissector if there's data left in the packet, regardless of whether the "tree" argument is null or not; subdissectors should always be called, so they can build any internal state on the first pass through the capture, and so that they can fill in the Protocol and Info columns. svn path=/trunk/; revision=2899
* Add an additional "protocol index" argument to "{old_}dissector_add()",Guy Harris2001-01-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | "{old_}heur_dissector_add()", "{old_}conv_dissector_add()", and "register_dissector()", so that an entry in those tables has associated with it the protocol index of the protocol the dissector handles (or -1, if there is no protocol index for it). This is for future use in a number of places. (Arguably, "proto_register_protocol()" should take a dissector pointer as an argument, but 1) it'd have to handle both regular and heuristic dissectors; 2) making it take either a "dissector_t" or a union of that and a "heur_dissector_t" introduces some painful header-file interdependencies so I'm punting on that for now. As with other Ethereal internal APIs, these APIs are subject to change in the future, at least until Ethereal 1.0 comes out....) svn path=/trunk/; revision=2849
* Have "proto_register_protocol()" build a list of data structures forGuy Harris2001-01-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | protocols, in addition to adding structures to the list of filterable fields. Give it an extra argument that specifies a "short name" for the protocol, for use in such places as pinfo->current_proto; the dialog box for constructing filters; the preferences tab for the protocol; and so on (although we're not yet using it in all those places). Make the preference name that appears in the preferences file and the command line for the DIAMETER protocol "diameter", not "Diameter"; the convention is that the name in question be all-lower-case. Make some routines and variables that aren't exported static. Update a comment in the ICP dissector to make it clear that the dissector won't see fragments other than the first fragment of a fragmented datagram. svn path=/trunk/; revision=2810
* Add the standard "CHECK_DISPLAY_AS_DATA()" call.Guy Harris2000-12-031-1/+4
| | | | svn path=/trunk/; revision=2736
* For each column, have both a buffer into which strings for that columnGuy Harris2000-11-191-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | can be put, and a pointer to the string for the column, which might or might not point to that buffer. Add a routine "col_set_str()", which sets the string for the column to the string passed to it as an argument; it should only be handed a static string (a string constant would be ideal). It doesn't do any copying, so it's faster than "col_add_str()". Make the routines that append to columns check whether the pointer to the string for the column points to the buffer for the column and, if not, copy the string for the column to the buffer for the column so that you can append to it (so you can use "col_set_str()" and then use "col_append_str()" or "col_append_fstr()"). Convert a bunch of "col_add_str()" calls that take a string constant as an argument to "col_set_str()" calls. Convert some "col_add_fstr()" calls that take a string constant as the only argument - i.e., the format string doesn't have any "%" slots into which to put strings for subsequent arguments to "col_set_str()" calls (those calls are just like "col_add_str()" calls). Replace an END_OF_FRAME reference in a tvbuffified dissector with a "tvb_length(tvb)" call. svn path=/trunk/; revision=2670
* - Fix the hex pane offsets for hf_netb_local_ses_no,Gerald Combs2000-11-131-6/+10
| | | | | | | | | | | hf_netb_remote_ses_no, and hf_netb_data2. - Change hf_netb_local_ses_no and hf_netb_remote_ses_no from FT_UINT16 to FT_UINT8. - Add hf_netb_data2 to hf_netb. svn path=/trunk/; revision=2626
* Fix the test for the first 10 bytes of a NetBIOS name being all zeroes.Guy Harris2000-11-111-2/+2
| | | | svn path=/trunk/; revision=2607
* tvbuffification by Jeff Foster.Gilbert Ramirez2000-11-101-330/+407
| | | | svn path=/trunk/; revision=2601
* Add the "Edit:Protocols..." feature which currently only implementsLaurent Deniel2000-08-131-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the following: It is now possible to enable/disable a particular protocol decoding (i.e. the protocol dissector is void or not). When a protocol is disabled, it is displayed as Data and of course, all linked sub-protocols are disabled as well. Disabling a protocol could be interesting: - in case of buggy dissectors - in case of wrong heuristics - for performance reasons - to decode the data as another protocol (TODO) Currently (if I am not wrong), all dissectors but NFS can be disabled (and dissectors that do not register protocols :-) I do not like the way the RPC sub-dissectors are disabled (in the sub-dissectors) since this could be done in the RPC dissector itself, knowing the sub-protocol hfinfo entry (this is why, I've not modified the NFS one yet). Two functions are added in proto.c : gboolean proto_is_protocol_enabled(int n); void proto_set_decoding(int n, gboolean enabled); and two MACROs which can be used in dissectors: OLD_CHECK_DISPLAY_AS_DATA(index, pd, offset, fd, tree) CHECK_DISPLAY_AS_DATA(index, tvb, pinfo, tree) See also the XXX in proto_dlg.c and proto.c around the new functions. svn path=/trunk/; revision=2267
* Allow either old-style (pre-tvbuff) or new-style (tvbuffified)Guy Harris2000-08-071-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dissectors to be registered as dissectors for particular ports, registered as heuristic dissectors, and registered as dissectors for conversations, and have routines to be used both by old-style and new-style dissectors to call registered dissectors. Have the code that calls those dissectors translate the arguments as necessary. (For conversation dissectors, replace "find_conversation_dissector()", which just returns a pointer to the dissector, with "old_try_conversation_dissector()" and "try_conversation_dissector()", which actually call the dissector, so that there's a single place at which we can do that translation. Also make "dissector_lookup()" static and, instead of calling it and, if it returns a non-null pointer, calling that dissector, just use "old_dissector_try_port()" or "dissector_try_port()", for the same reason.) This allows some dissectors that took old-style arguments and immediately translated them to new-style arguments to just take new-style arguments; make them do so. It also allows some new-style dissectors not to have to translate arguments before calling routines to look up and call dissectors; make them not do so. Get rid of checks for too-short frames in new-style dissectors - the tvbuff code does those checks for you. Give the routines to register old-style dissectors, and to call dissectors from old-style dissectors, names beginning with "old_", with the routines for new-style dissectors not having the "old_". Update the dissectors that use those routines appropriately. Rename "dissect_data()" to "old_dissect_data()", and "dissect_data_tvb()" to "dissect_data()". svn path=/trunk/; revision=2218
* Add routines for adding items to a protocol tree that take arguments ofGuy Harris2000-05-311-3/+3
| | | | | | | | | | | | | | | | | a particular type, rather than taking a varargs list, along the lines of the "proto_tree_add_XXX_format()" routines. Replace most calls to "proto_tree_add_item()" and "proto_tree_add_item_hidden()" with calls to those routines. Rename "proto_tree_add_item()" and "proto_tree_add_item_hidden()" to "proto_tree_add_item_old()" and "proto_tree_add_item_hidden_old()", and add new "proto_tree_add_item()" and "proto_tree_add_item_hidden()" routines that don't take the item to be added as an argument - instead, they fetch the argument from the packet whose tvbuff was handed to them, from the offset handed to them. svn path=/trunk/; revision=2031
* Add tvbuff class.Gilbert Ramirez2000-05-111-63/+63
| | | | | | | | | | | | | | | Add exceptions routines. Convert proto_tree_add_*() routines to require tvbuff_t* argument. Convert all dissectors to pass NULL argument ("NullTVB" macro == NULL) as the tvbuff_t* argument to proto_tree_add_*() routines. dissect_packet() creates a tvbuff_t, wraps the next dissect call in a TRY block, will print "Short Frame" on the proto_tree if a BoundsError exception is caught. The FDDI dissector is converted to use tvbuff's. svn path=/trunk/; revision=1939
* Register a "llc.dsap" dissector table for 802.2 LLC, and have dissectorsGuy Harris2000-04-171-2/+9
| | | | | | | | | | for protocols that run inside 802.2 LLC register themselves with it using "dissector_add()". Make various dissectors static if they can be, and remove from header files declarations of those dissectors. svn path=/trunk/; revision=1872
* Fix some "proto_tree_add_text()" calls.Guy Harris2000-03-071-2/+2
| | | | svn path=/trunk/; revision=1696
* Fix NetBIOS name types as per my understanding and the MS Knowledge baseRichard Sharpe2000-02-161-4/+4
| | | | | | article ... svn path=/trunk/; revision=1639
* Create a header file for every packet-*.c file. Prune the packet.h file.Gilbert Ramirez2000-02-151-1/+3
| | | | | | | | | | | | | This change allows you to add a new packet-*.c file and not cause a recompilation of everything that #include's packet.h Add the plugin_api.[ch] files ot the plugins/Makefile.am packaging list. Add #define YY_NO_UNPUT 1 to the lex source so that the yyunput symbol is not defined, squelching a compiler complaint when compiling the generated C file. svn path=/trunk/; revision=1637
* In "dissect_eth()", update "pi.len" and "pi.captured_len" regardless ofGuy Harris2000-01-231-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | whether we're building a protocol tree or not. Make "dissect_eth()" use "BYTES_ARE_IN_FRAME()" to see if we have a full Ethernet header - it can be called with a non-zero offset, if Ethernet frames are encapsulated inside other frames (e.g., ATM LANE). Make capture routines take an "offset" argument if the corresponding dissect routine takes one (for symmetry, and for Cisco ISL or any other protocol that encapsulates Ethernet or Token-Ring frames inside other frames). Pass the frame lengths to capture routines via the "pi" structure, rather than as an in-line argument, so that they can macros such as "BYTES_ARE_IN_FRAME()" the way the corresponding dissect routines do. Make capture routines update "pi.len" and "pi.captured_len" the same way the corresponding diseect routines do, if the capture routines then call other capture routines. Make "capture_vlan()" count as "other" frames that are too short, the way other capture routines do. svn path=/trunk/; revision=1525
* Get rid of the include of "util.h" that some dissectors do - it's notGuy Harris2000-01-161-2/+1
| | | | | | necessary. svn path=/trunk/; revision=1496
* Fixed small typo in hex printing.Gerald Combs2000-01-141-2/+2
| | | | svn path=/trunk/; revision=1475
* Make the NetBIOS dissecting routines all take a pointer to the beginningGuy Harris1999-11-301-177/+184
| | | | | | | | | | | of the frame, plus at most one offset from the beginning of the frame, to make it clearer what the offset is. Then use that offset in at least some places to do bounds checking. If a packet has no payload, don't hand it to the SMB dissector. svn path=/trunk/; revision=1165
* Replace the ETT_ "enum" members, declared in "packet.h", withGuy Harris1999-11-161-10/+22
| | | | | | | | | | | | | | | | | dynamically-assigned "ett_" integer values, assigned by "proto_register_subtree_array()"; this: obviates the need to update "packet.h" whenever you add a new subtree type - you only have to add a call to "proto_register_subtree_array()" to a "register" routine and an array of pointers to "ett_", if they're not already there, and add a pointer to the new "ett_" variable to the array, if they are there; would allow run-time-loaded dissectors to allocate subtree types when they're loaded. svn path=/trunk/; revision=1043
* added sap types, netbios name types, ipx socket namesNathan Neulinger1999-11-151-1/+5
| | | | svn path=/trunk/; revision=1038
* Add in a bunch of changes based on the IBM specification for the NetBIOSGuy Harris1999-09-031-192/+378
| | | | | | | | | | | | | | | | | | | | | Frame protocol (that being what this dissects). If you're cutting up something into bitfields, the bitfield dissection returned by "dissect_bitfield_XXX()" should be the first text on the line - if not, then if the text items that come before the various bitfields aren't all the same length, the bits don't line up. Cope with packets from one of Gilbert's captures, where the sender "name" in some NBF datagrams isn't a NetBIOS name, it's 10 octets of 0 followed by a MAC address! The "name type" in the "Data2" field of NBF frames is 0x00 for unique names and 0x01 for group names, not a "16th character of a NetBIOS name" name type. Fix up various other things. svn path=/trunk/; revision=633
* Add in a pile of additional packet formats fromGuy Harris1999-09-031-51/+218
| | | | | | | | http://ourworld.compuserve.com/homepages/TimothyDEvans/contents.htm Assorted minor cleanups. svn path=/trunk/; revision=632
* Use "process_netbios_name()", rather than "canonicalize_netbios_name()",Guy Harris1999-09-031-3/+11
| | | | | | | | | to turn NetBIOS names into a nice printable form. Put the description of NetBIOS name types into places where it fits; have "packet-netbios.c" export a routine to interpret them. svn path=/trunk/; revision=630
* Add a bunch more NetBIOS name types.Guy Harris1999-09-031-84/+89
| | | | | | | | | | | | | | | | | That makes the space of name types even more sparse; use "val_to_str()" to decode them, rather than an indexed table. Make a "process_netbios_name()" routine that shows non-printable characters in NetBIOS names as <XX>, where "XX" is the value of the character in hex (the way Network Monitor does), and have "get_netbios_name()" use it (NetBIOS-over-TCP will be made to use it in the future). When displaying NetBIOS names, include the name type character at the end, in angle brackets, the way Network Monitor does (show it in hex even if it *is* printable - 0x20 is 0x20, not "space", in that context). svn path=/trunk/; revision=628
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-27 08:21:05 +0000