aboutsummaryrefslogtreecommitdiffstats
path: root/packet-tcp.c
Commit message (Collapse)AuthorAgeFilesLines
* Add routines for adding items to a protocol tree that take arguments ofGuy Harris2000-05-311-14/+14
| | | | | | | | | | | | | | | | | a particular type, rather than taking a varargs list, along the lines of the "proto_tree_add_XXX_format()" routines. Replace most calls to "proto_tree_add_item()" and "proto_tree_add_item_hidden()" with calls to those routines. Rename "proto_tree_add_item()" and "proto_tree_add_item_hidden()" to "proto_tree_add_item_old()" and "proto_tree_add_item_hidden_old()", and add new "proto_tree_add_item()" and "proto_tree_add_item_hidden()" routines that don't take the item to be added as an argument - instead, they fetch the argument from the packet whose tvbuff was handed to them, from the offset handed to them. svn path=/trunk/; revision=2031
* Add tvbuff class.Gilbert Ramirez2000-05-111-29/+29
| | | | | | | | | | | | | | | Add exceptions routines. Convert proto_tree_add_*() routines to require tvbuff_t* argument. Convert all dissectors to pass NULL argument ("NullTVB" macro == NULL) as the tvbuff_t* argument to proto_tree_add_*() routines. dissect_packet() creates a tvbuff_t, wraps the next dissect call in a TRY block, will print "Short Frame" on the proto_tree if a BoundsError exception is caught. The FDDI dissector is converted to use tvbuff's. svn path=/trunk/; revision=1939
* Add routines to:Guy Harris2000-05-051-18/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | register lists of "heuristic" dissectors, which are handed a frame that may or may contain a payload for the protocol they dissect, and that return FALSE if it's not or dissect the packet and return TRUE if it is; add a dissector to such a list; go through such a list, calling each dissector until either a dissector returns TRUE, in which case the routine returns TRUE, or it runs out of entries in the list, in which case the routine returns FALSE. Have lists of heuristic dissectors for TCP and for COTP when used with the Inactive Subset of CLNP, and add the GIOP and Yahoo Messenger dissectors to the first list and the Sinec H1 dissector to the second list. Make the dissector name argument to "dissector_add()" and "dissector_delete()" a "const char *" rarther than just a "char *". Add "heur_dissector_add()", the routine to add a heuristic dissector to a list of heuristic dissectors, to the set of routines we can export to plugins through a table on platforms where dynamically-loaded code can't call stuff in the main program, and initialize the element in the table in question for "dissector_add()" (which we'd forgotten to do). svn path=/trunk/; revision=1909
* Have the IPv6 dissector use the same dissector table as the IPv4Guy Harris2000-04-201-2/+2
| | | | | | | | | dissector. Don't dissect the payload of any fragmented IPv6 packet unless it's the initial fragment (that's what we do for IPv4). svn path=/trunk/; revision=1882
* Make "decode_tcp_ports()" and "decode_udp_ports()" more closely resembleGuy Harris2000-04-171-39/+38
| | | | | | | one another, put the comments that explain what they do in front of them, and clean up the indentation. svn path=/trunk/; revision=1874
* Register an "ip.proto" dissector table for IPv4, and have dissectors forGuy Harris2000-04-161-1/+8
| | | | | | | | | | protocols that run inside IPv4 register themselves with it using "dissector_add()". Make various dissectors static if they can be, and get rid of any header files that no longer contain any information as a result of that change. svn path=/trunk/; revision=1870
* Change dfilter_apply() to 4-argument function. 4th argument is not yet used,Gilbert Ramirez2000-04-141-2/+2
| | | | | | | | | | but will be in the future, and it's easier for me to keep my local branch in sync with the source with the calls to dfilter_apply() already modified tothe 4-arg format. Add a CPP macro to ipv4.h to define ipv4_addr_ne(). Use it in dfilter.c svn path=/trunk/; revision=1854
* Change the sub-dissector handoff registration routines so that theGilbert Ramirez2000-04-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sub-dissector table is not stored in the header_field_info struct, but in a separate namespace. Dissector tables are now registered by name and not by field ID. For example: udp_dissector_table = register_dissector_table("udp.port"); Because of this different namespace, dissector tables can have names that are not field names. This is useful for ethertype, since multiple fields are "ethertypes". packet-ethertype.c replaces ethertype.c (the name was changed so that it would be named in the same fashion as all the filenames passed to make-reg-dotc) Although it registers no protocol or field, it registers one dissector table: ethertype_dissector_table = register_dissector_table("ethertype"); All protocols that can be called because of an ethertype field now register that fact with dissector_add() calls. In this way, one dissector_table services all ethertype fields (hf_eth_type, hf_llc_type, hf_null_etype, hf_vlan_etype) Furthermore, the code allows for names of protocols to exist in the etype_vals, yet a dissector for that protocol doesn't exist. The name of the dissector is printed in COL_INFO. You're welcome, Richard. :-) svn path=/trunk/; revision=1848
* Jeff Foster's SOCKS dissector, support for associating dissectorsGuy Harris2000-04-121-54/+73
| | | | | | | | | | with conversations and having TCP and UDP check whether a packet is part of a conversation with a dissector and, if so, using that dissector on the conversation, and "ethertype()"-style support for allowing a dissector to call a sub-dissector via the same path that the TCP and UDP dissectors use, based on port numbers supplied by that dissector. svn path=/trunk/; revision=1837
* Move calls to "dissector_add()" out of the register routines for TCP andGuy Harris2000-04-081-70/+1
| | | | | | | | | | | | | | UDP and into the handoff registration routines for the protocols in question. Make the dissectors for those protocols static if they're not called outside the dissector's source file. Get rid of header files if all they did was declare dissectors that are now static; remove declarations of now-static dissectors from header files that do more than just declare the dissector. svn path=/trunk/; revision=1823
* Jeff Foster's rlogin dissector, and changes to the TCP dissector toGuy Harris2000-04-081-2/+8
| | | | | | export the urgent pointer (as the rlogin dissector needs it). svn path=/trunk/; revision=1822
* Add a test to check if there is at least one enabled plugin before searchingOlivier Abad2000-04-041-2/+2
| | | | | | the plugin list. svn path=/trunk/; revision=1798
* Make a routine that takes a dissector table, a port number, andGuy Harris2000-04-041-15/+5
| | | | | | | | | | | | | | | | | | | | | | | | pd/offset/fd/tree arguments, looks up the port number in the dissector table, and: if it finds it, call the corresponding dissector routine with the pd/offset/fd/tree arguments, and return TRUE; if it doesn't find it, return FALSE. Use that in the TCP and UDP dissectors. Don't add arbitrary UDP ports for which a dissector is found in the table as ports that should be dissected as TFTP; this should only be done if we find a packet going from port XXX to the official TFTP port. Don't register TFTP in UDP's dissector table, as it has to be handled specially (i.e., we have to add the source port as a TFTP port, although we really should register the source port *and* IP address); eventually, we should move that registration to the TFTP dissector itself, at which point we can register TFTP normally. svn path=/trunk/; revision=1785
* Fix a compile error introduced by the previous checkin, which also movedGuy Harris2000-04-031-11/+12
| | | | | | | | | the check for plugins after the check for ONC RPC protocols, so that we do the checks in the same order for TCP and UDP (ONC RPC first, as we expect the RPC heuristics not to get false hits, and ONC RPC protocols could well use ports that are nominally assigned to other protocols). svn path=/trunk/; revision=1780
* Jeff Foster's patch to support attaching a hash table to a protocolGuy Harris2000-04-031-81/+70
| | | | | | | | | | | | | | | | | | | | | field, to allow dissectors to register their dissection routine in a particular field's hash table with a particular "port" value, and to make the TCP and UDP dissectors support that for their "port" field and to look up ports in that hash table. This replaces the hash table that the UDP dissector was using. There's still more work needed to make this useful - right now, the hash tables are attached to the protocol field in the register routines for the TCP and UDP protocols, which means that the register routines for protocols that run atop TCP and UDP can't use this unless their register routines happen to be called after those for TCP and/or UDP, and several other protocols need to attach hash tables to fields, and there's no single global field for Ethernet types so we can't even attach a hash table to such a field to allow protocols to register themselves with a particular Ethertype - but it's a start. svn path=/trunk/; revision=1779
* Break proto_tree_add_item_format() into multiple functions:Gilbert Ramirez2000-03-121-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | proto_tree_add_protocol_format() proto_tree_add_uint_format() proto_tree_add_ipxnet_format() proto_tree_add_ipv4_format() proto_tree_add_ipv6_format() proto_tree_add_bytes_format() proto_tree_add_string_format() proto_tree_add_ether_format() proto_tree_add_time_format() proto_tree_add_double_format() proto_tree_add_boolean_format() If using GCC 2.x, we can check the print-format against the variable args passed in. Regardless of compiler, we can now check at run-time that the field type passed into the function corresponds to what that function expects (FT_UINT, FT_BOOLEAN, etc.) Note that proto_tree_add_protocol_format() does not require a value field, since the value of a protocol is always NULL. It's more intuitive w/o the vestigial argument. Fixed a proto_tree_add_item_format-related bug in packet-isis-hello.c Fixed a variable usage bug in packet-v120.c. (ett_* was used instead of hf_*) Checked in Guy's fix for the function declearation for proto_tree_add_text() and proto_tree_add_notext(). svn path=/trunk/; revision=1713
* In the TCP stream following code, we don't use the time stamp field inGuy Harris2000-03-121-4/+2
| | | | | | | | | | the stuff we write to the temporary file, so don't bother writing it. Keep track of the two sides of the TCP stream by keeping track of the source address *and* port, so that we correctly handle connections between two ports on the same machine. svn path=/trunk/; revision=1712
* Fred Reimer's patch to put the TCP segment length in the TCP packetGuy Harris2000-02-281-5/+5
| | | | | | summary. svn path=/trunk/; revision=1669
* Create a header file for every packet-*.c file. Prune the packet.h file.Gilbert Ramirez2000-02-151-4/+24
| | | | | | | | | | | | | This change allows you to add a new packet-*.c file and not cause a recompilation of everything that #include's packet.h Add the plugin_api.[ch] files ot the plugins/Makefile.am packaging list. Add #define YY_NO_UNPUT 1 to the lex source so that the yyunput symbol is not defined, squelching a compiler complaint when compiling the generated C file. svn path=/trunk/; revision=1637
* Get rid of the include of "util.h" that some dissectors do - it's notGuy Harris2000-01-161-2/+1
| | | | | | necessary. svn path=/trunk/; revision=1496
* Merge in the final code to make Ethereal run on Win32, compiledGilbert Ramirez2000-01-151-4/+2
| | | | | | | | | | | | | | | | with MSVC 6.0 and 'nmake', the make tool that comes with MSVC. It compiles, links, and runs. It doesn't run correctly. There's a problem when reading files. I'm getting short reads. I'm not linking in zlib or libsnmp because it first needs to be debugged. I changed the plugin code to use gmodule instead of libltdl, but the Unix build still links ethereal against libltdl. I'll fix that tonight; sorry about leaving it in such a sad state, but I wanted to check in this code before I left work on a Friday night. Ethereal still works, but the building is less than optimal. svn path=/trunk/; revision=1479
* Dissect port 3128 as HTTP, as per Jamie Coe's patch and Squid andGuy Harris1999-12-091-25/+29
| | | | | | | NetCache's use of it as a proxy port, and dissect port 3132 as HTTP, as per NetCache's use of it for its HTTP-based administrative UI. svn path=/trunk/; revision=1266
* plugins support (i.e. Dynamically loadable dissectors)Olivier Abad1999-12-091-2/+22
| | | | | | depends on dlopen() being available on the target platform svn path=/trunk/; revision=1263
* added ldap dissector placeholder, just does request/response for now, until ↵Nathan Neulinger1999-12-091-1/+5
| | | | | | I have a chance to figure out ASN.1 svn path=/trunk/; revision=1254
* James Coe's patch to add SRVLOC and NCP-over-IP support.Guy Harris1999-12-071-1/+9
| | | | svn path=/trunk/; revision=1234
* added simple irc dissectorNathan Neulinger1999-12-061-1/+5
| | | | svn path=/trunk/; revision=1232
* added skeletal tacplus/xtacacs dissectorNathan Neulinger1999-12-031-1/+5
| | | | svn path=/trunk/; revision=1191
* added start of tns dissectorNathan Neulinger1999-11-291-1/+5
| | | | svn path=/trunk/; revision=1155
* Add code to colorize TCP streams.Gerald Combs1999-11-281-2/+4
| | | | svn path=/trunk/; revision=1131
* Fixed the problem causing a SIGSEGV, and fixed problems withRichard Sharpe1999-11-261-2/+2
| | | | | | | | | | | | UNICODE strings in transact SMBs. Added decode of NetShareEnum transact request. Will have to clean that all up and use the decode engine when I get it done. Still more fix ups to be done, but the book is calling, and I have to write some stuff after an interview with LinuxCare. svn path=/trunk/; revision=1113
* Added Uwe's update to RPC.Gilbert Ramirez1999-11-191-2/+2
| | | | svn path=/trunk/; revision=1069
* Replace the ETT_ "enum" members, declared in "packet.h", withGuy Harris1999-11-161-17/+29
| | | | | | | | | | | | | | | | | dynamically-assigned "ett_" integer values, assigned by "proto_register_subtree_array()"; this: obviates the need to update "packet.h" whenever you add a new subtree type - you only have to add a call to "proto_register_subtree_array()" to a "register" routine and an array of pointers to "ett_", if they're not already there, and add a pointer to the new "ett_" variable to the array, if they are there; would allow run-time-loaded dissectors to allocate subtree types when they're loaded. svn path=/trunk/; revision=1043
* Uwe Girlich's patches for nfs,mount,portmap and addition of nlm.Nathan Neulinger1999-11-151-1/+10
| | | | svn path=/trunk/; revision=1034
* added minimalist MAPI dissector - only determines request/replyNathan Neulinger1999-11-111-1/+5
| | | | svn path=/trunk/; revision=1017
* Added imap dissector, pretty much a simple translation of the popNathan Neulinger1999-11-101-1/+5
| | | | | | dissector. svn path=/trunk/; revision=995
* Make the TCP header length field more closely resemble the IP headerGuy Harris1999-11-021-5/+6
| | | | | | length field. svn path=/trunk/; revision=964
* Make a bunch of the TCP header fields filterable items.Guy Harris1999-11-021-32/+81
| | | | svn path=/trunk/; revision=962
* Generalize the "ip_src" and "ip_dst" members of the "packet_info"Guy Harris1999-10-221-11/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | structure to "dl_src"/"dl_dst", "net_src"/"net_dst", and "src"/"dst" addresses, where an address is an address type, an address length in bytes, and a pointer to that many bytes. "dl_{src,dst}" are the link-layer source/destination; "net_{src,dst}" are the network-layer source/destination; "{src,dst}" are the source/destination from the highest of those two layers that we have in the packet. Add a port type to "packet_info" as well, specifying whether it's a TCP or UDP port. Don't set the address and port columns in the dissector functions; just set the address and port members of the "packet_info" structure. Set the columns in "fill_in_columns()"; this means that if we're showing COL_{DEF,RES,UNRES}_SRC" or "COL_{DEF,RES,UNRES}_DST", we only generate the string from "src" or "dst", we don't generate a string for the link-layer address and then overwrite it with a string for the network-layer address (generating those strings costs CPU). Add support for "conversations", where a "conversation" is (at present) a source and destination address and a source and destination port. (In the future, we may support "conversations" above the transport layer, e.g. a TFTP conversation, where the first packet goes from the client to the TFTP server port, but the reply comes back from a different port, and all subsequent packets go between the client address/port and the server address/new port, or an NFS conversation, which might include lock manager, status monitor, and mount packets, as well as NFS packets.) Currently, all we support is a call that takes the source and destination address/port pairs, looks them up in a hash table, and: if nothing is found, creates a new entry in the hash table, and assigns it a unique 32-bit conversation ID, and returns that conversation ID; if an entry is found, returns its conversation ID. Use that in the SMB and AFS code to keep track of individual SMB or AFS conversations. We need to match up requests and replies, as, for certain replies, the operation code for the request to which it's a reply doesn't show up in the reply - you have to find the request with a matching transaction ID. Transaction IDs are per-conversation, so the hash table for requests should include a conversation ID and transaction ID as the key. This allows SMB and AFS decoders to handle IPv4 or IPv6 addresses transparently (and should allow the SMB decoder to handle NetBIOS atop other protocols as well, if the source and destination address and port values in the "packet_info" structure are set appropriately). In the "Follow TCP Connection" code, check to make sure that the addresses are IPv4 addressses; ultimately, that code should be changed to use the conversation code instead, which will let it handle IPv6 transparently. svn path=/trunk/; revision=909
* BGP decoding. more attributes and NLRIs needs to be added.Jun-ichiro itojun Hagino1999-10-151-2/+6
| | | | | | | as BGP is a protocol on top of TCP, it may have trouble parsing out-of-sync data (in most cases data is aligned on packet, it seems). svn path=/trunk/; revision=843
* Nathan Neulinger's NTP dissector.Guy Harris1999-10-141-1/+5
| | | | svn path=/trunk/; revision=828
* Nathan Neulinger's dissector for the Yahoo messenger and pagerGuy Harris1999-10-141-1/+7
| | | | | | protocols. svn path=/trunk/; revision=824
* New proto_tree header_field_info stuff. Header_field_infos now containGilbert Ramirez1999-10-121-6/+11
| | | | | | | | | | | | | | | | | | | | | the base for numbers to be displayed in, bitmasks for bitfields, and blurbs (which are one or two sentences describing the field). proto_tree_add*() routines now automatically handle bitfields. You tell it which header field you are adding, and just pass it the value of the entire field, and the proto_tree routines will do the masking and shifting for you. This means that bitfields are more naturally filtered via dfilter now. Added Phil Techau's support for signed integers in dfilters/proto_tree. Added the beginning of the SNA dissector. It's not complete, but I'm committing it now because it has example after example of how to use bitfields with the new header_field_info struct and proto_tree routines. It was the impetus to change how header_field_info works. svn path=/trunk/; revision=815
* Add a "BYTES_ARE_IN_FRAME()" macro, to test whether there are aGuy Harris1999-09-171-2/+3
| | | | | | | | | | | specified number of bytes of captured data in the frame at the specified offset, and a "IS_DATA_IN_FRAME()" macro, to test whether there are any bytes of captured data in the frame at the specified offset, and convert some bounds checks to use them. Add a dissector for the Internet Printing Protocol. svn path=/trunk/; revision=685
* PPP options in LCP, IPCP, etc. are like IP and TCP options - one octetGuy Harris1999-08-281-23/+35
| | | | | | | | | | | | | | | | | | | of option code, one octet of length (which includes the two option code and length bytes), followed by 0 or more octets of option data, with some options being fixed-length and some being variable-length. Put some stuff from the PPP control protocol option parsing code into the IP-and-TCP option parsing code, and use the latter instead of the former. (That code might also be usable for CDP as well, with some stuff added to it.) Shuffle the arguments to "dissect_ip_tcp_options()" to resemble those of various other dissectors (i.e., with the "proto_tree *" at the end). Add in code to dissect a pile of PPP options documented in various RFCs. svn path=/trunk/; revision=601
* Fix up the call to "reassemble_tcp()" to use "pi.len" andGuy Harris1999-08-181-6/+6
| | | | | | | "pi.captured_len" to compute the total amount of TCP payload and the captured amount of TCP payload. svn path=/trunk/; revision=508
* Declare the "packet_info" structure "pi" in "packet.h", rather than in aGuy Harris1999-08-181-12/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | bunch of source files. Replace the "payload" field of a "packet_info" structure with "len" and "captured_len" fields, which contain the total packet length and total captured packet length (including all headers) at the current protocol layer (i.e., if a given layer has a length field, and that length field says its shorter than the length we got from the capture, reduce the "pi.len" and "pi.captured_len" values appropriately). Those fields can be used in the future if we add checks to make sure a field we're extracting from a packet doesn't go past the end of the packet, or past the captured part of the packet. Get rid of the additional payload argument to some dissection functions; use "pi.captured_len - offset" instead. Have the END_OF_FRAME macro use "pi.captured_len" rather than "fd->cap_len", so that "dissect the rest of the frame" becomes "dissect the rest of the packet", and doesn't dissect end-of-frame padding such as padding added to make an Ethernet frame 60 or more octets long. (We might want to rename it END_OF_PACKET; if we ever want to label the end-of-frame padding for the benefit of people curious what that extra gunk is, we could have a separate END_OF_FRAME macro that uses "fd->cap_len".) svn path=/trunk/; revision=506
* Fix TCP follow stream feature:Laurent Deniel1999-07-311-2/+5
| | | | | | | | - call reset_tcp_reassembly before build_follow_filter - modify reassemble_tcp so that packet validity is checked before processing it. svn path=/trunk/; revision=410
* Label the TCP sequence number as "Sequence number", not "SequenceGuy Harris1999-07-311-2/+2
| | | | | | | number" - other fields (including "Acknowledgment number") capitalize only the first word. svn path=/trunk/; revision=407
* Added just enough fields to TCP to support "Follow TCP Stream". It works now.Gilbert Ramirez1999-07-171-11/+42
| | | | | | Added the protocol IDs for ipx and IGMP, but not their fields. svn path=/trunk/; revision=365
* Created a new protocol tree implementation and a new display filterGilbert Ramirez1999-07-071-35/+31
| | | | | | | mechanism that is built into ethereal. Wiretap is now used to read all file formats. Libpcap is used only for capturing. svn path=/trunk/; revision=342
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-26 13:01:05 +0000