Handle TPKT packets split across segment boundaries, and multiple TPKT
authorguy <guy@f5534014-38df-0310-8fa8-9805f1628bb7>
Fri, 22 Feb 2002 08:56:48 +0000 (08:56 +0000)
committerguy <guy@f5534014-38df-0310-8fa8-9805f1628bb7>
Fri, 22 Feb 2002 08:56:48 +0000 (08:56 +0000)
packets per segment.

Instead of having a routine for dissectors such as the Q.931 dissector
to call to dissect the TPKT header, have a routine that does all the
reassembly and multiple-packets-per-segment work, and have the Q.931
dissector call it.  Export "is_tpkt()", and the new routine, to plugins.

Add preferences for TPKT and Q.931 reassembly.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4778 f5534014-38df-0310-8fa8-9805f1628bb7

epan/plugins.c
packet-q931.c
packet-tpkt.c
packet-tpkt.h
plugins/plugin_api.c
plugins/plugin_api.h
plugins/plugin_api_defs.h
plugins/plugin_table.h

index f2ee2d3f34f1497fab4adc616caa5e3bedc73d40..51bfecf50d353788a758fc84b1005826ee7204e3 100644 (file)
@@ -1,7 +1,7 @@
 /* plugins.c
  * plugin routines
  *
- * $Id: plugins.c,v 1.48 2002/02/20 08:24:51 guy Exp $
+ * $Id: plugins.c,v 1.49 2002/02/22 08:56:47 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -63,6 +63,7 @@
 #ifdef PLUGINS_NEED_ADDRESS_TABLE
 #include "conversation.h"
 #include "packet-giop.h"
+#include "packet-tpkt.h"
 #include "plugins/plugin_table.h"
 static plugin_address_table_t  patable;
 #endif
@@ -421,6 +422,9 @@ init_plugins(const char *plugin_dir)
        patable.p_get_CDR_enum                  = get_CDR_enum;
        patable.p_get_CDR_object                = get_CDR_object;
        patable.p_get_CDR_boolean               = get_CDR_boolean;
+
+       patable.p_is_tpkt                       = is_tpkt;
+       patable.p_dissect_tpkt_encap            = dissect_tpkt_encap;
 #endif
 
 #ifdef WIN32
index f9a483b5a9e9a0a40df37172dbee8d69fe6d3467..dcd66b16f215c8455802e7485256d56193bb05e7 100644 (file)
@@ -2,7 +2,7 @@
  * Routines for Q.931 frame disassembly
  * Guy Harris <guy@alum.mit.edu>
  *
- * $Id: packet-q931.c,v 1.37 2002/02/12 10:21:05 guy Exp $
+ * $Id: packet-q931.c,v 1.38 2002/02/22 08:56:45 guy Exp $
  *
  * Modified by Andreas Sikkema for possible use with H.323
  *
@@ -40,6 +40,7 @@
 #include <epan/strutil.h>
 #include "nlpid.h"
 #include "packet-q931.h"
+#include "prefs.h"
 
 #include "packet-tpkt.h"
 
@@ -64,7 +65,11 @@ static int hf_q931_message_type = -1;
 static gint ett_q931 = -1;
 static gint ett_q931_ie = -1;
 
+/* desegmentation of Q.931 over TPKT over TCP */
+static gboolean q931_desegment = TRUE;
+
 static dissector_handle_t h225_cs_handle;
+static dissector_handle_t q931_tpkt_pdu_handle;
 
 /*
  * Q.931 message types.
@@ -2095,9 +2100,10 @@ static const value_string q931_codeset_vals[] = {
 };
 
 static void
-dissect_q931_pdu(tvbuff_t *tvb, int offset, packet_info *pinfo,
-    proto_tree *tree, gboolean is_tpkt)
+dissect_q931_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
+    gboolean is_tpkt)
 {
+       int             offset = 0;
        proto_tree      *q931_tree = NULL;
        proto_item      *ti;
        proto_tree      *ie_tree = NULL;
@@ -2488,9 +2494,6 @@ dissect_q931_pdu(tvbuff_t *tvb, int offset, packet_info *pinfo,
 
 /*
  * Q.931-over-TPKT-over-TCP.
- *
- * XXX - this should do the usual TCP loop-over-everything-in-the-segment
- * stuff, and should also handle TPKT PDUs split across segment boundaries.
  */
 static gboolean
 dissect_q931_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
@@ -2539,28 +2542,24 @@ dissect_q931_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
        /*
         * OK, it looks like Q.931-over-TPKT.
-        *
-        * Dissect the TPKT header.
-        */
-       dissect_tpkt_header(tvb, offset, pinfo, tree);
-
-       offset = q931_offset;
-
-       /*
-        * Reset the current_proto variable because
-        * "dissect_tpkt_header()" messed with it.
+        * Call the "dissect TPKT over a TCP stream" routine.
         */
-       pinfo->current_proto = "Q.931";
-
-       dissect_q931_pdu(tvb, q931_offset, pinfo, tree, TRUE);
+       dissect_tpkt_encap(tvb, pinfo, tree, q931_desegment,
+           q931_tpkt_pdu_handle);
 
        return TRUE;
 }
 
+static void
+dissect_q931_tpkt_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
+{
+       dissect_q931_pdu(tvb, pinfo, tree, TRUE);
+}
+
 static void
 dissect_q931(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 {
-       dissect_q931_pdu(tvb, 0, pinfo, tree, FALSE);
+       dissect_q931_pdu(tvb, pinfo, tree, FALSE);
 }
 
 void
@@ -2582,25 +2581,31 @@ proto_register_q931(void)
                { &hf_q931_message_type,
                  { "Message type", "q931.message_type", FT_UINT8, BASE_HEX, VALS(q931_message_type_vals), 0x0,
                        "", HFILL }},
-
-           };
+       };
        static gint *ett[] = {
                &ett_q931,
                &ett_q931_ie,
        };
+       module_t *q931_module;
 
        proto_q931 = proto_register_protocol("Q.931", "Q.931", "q931");
        proto_register_field_array (proto_q931, hf, array_length(hf));
        proto_register_subtree_array(ett, array_length(ett));
 
        register_dissector("q931", dissect_q931, proto_q931);
+       q931_tpkt_pdu_handle = create_dissector_handle(dissect_q931_tpkt_pdu,
+           proto_q931);
+
+       q931_module = prefs_register_protocol(proto_q931, NULL);
+       prefs_register_bool_preference(q931_module, "desegment_h323_messages",
+           "Desegment all Q.931 messages spanning multiple TCP segments",
+           "Whether the Q.931 dissector should desegment all messages spanning multiple TCP segments",
+           &q931_desegment);
 }
 
 void
 proto_reg_handoff_q931(void)
 {
-       dissector_handle_t q931_tpkt_handle;
-
        /*
         * Attempt to get a handle for the H.225 Call Setup dissector.
         * If we can't, the handle we get is null.
index 270c7641c47860f2cf9c6d30b38d85738c992b9f..50e793f70e2ac952f7cb085c9d19f40fc913c44f 100644 (file)
@@ -7,7 +7,7 @@
  * Routine to dissect RFC 1006 TPKT packet containing OSI TP PDU
  * Copyright 2001, Martin Thomas <Martin_A_Thomas@yahoo.com>
  *
- * $Id: packet-tpkt.c,v 1.11 2002/02/02 02:51:20 guy Exp $
+ * $Id: packet-tpkt.c,v 1.12 2002/02/22 08:56:46 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -47,6 +47,7 @@
 #include <string.h>
 
 #include "packet-tpkt.h"
+#include "prefs.h"
 
 /* TPKT header fields             */
 static int proto_tpkt          = -1;
@@ -57,6 +58,9 @@ static int hf_tpkt_length      = -1;
 /* TPKT fields defining a sub tree */
 static gint ett_tpkt           = -1;
 
+/* desegmentation of OSI over TPKT over TCP */
+static gboolean tpkt_desegment = TRUE;
+
 #define TCP_PORT_TPKT  102
 
 /* find the dissector for OSI TP (aka COTP) */
@@ -81,7 +85,7 @@ is_tpkt( tvbuff_t *tvb, int *offset )
                return -1;
 
        /* There should at least be 4 bytes left in the frame */
-       if ( (*offset) + 4 > (int)tvb_length( tvb ) )
+       if (!tvb_bytes_exist(tvb, *offset, 4))
                return -1;      /* there aren't */
 
        /*
@@ -100,53 +104,125 @@ is_tpkt( tvbuff_t *tvb, int *offset )
 }
 
 /*
- * Dissect the TPKT header; called from the TPKT dissector, as well as
- * from dissectors such as the dissector for Q.931-over-TCP.
- *
- * Returns the PDU length from the TPKT header.
+ * Dissect TPKT-encapsulated data in a TCP stream.
  */
-int
-dissect_tpkt_header( tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree )
+void
+dissect_tpkt_encap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
+    gboolean desegment, dissector_handle_t subdissector_handle)
 {
-       proto_item *ti            = NULL;
-       proto_tree *tpkt_tree     = NULL;
-       guint16 data_len;
-
-       pinfo->current_proto = "TPKT";
-
-       if ( check_col( pinfo->cinfo, COL_PROTOCOL ) ) {
-               col_set_str( pinfo->cinfo, COL_PROTOCOL, "TPKT" );
-       }
-       
-       data_len = tvb_get_ntohs( tvb, offset + 2 );
-
-       if ( check_col( pinfo->cinfo, COL_INFO) ) {
-               col_add_fstr( pinfo->cinfo, COL_INFO, "TPKT Data length = %u",
-                   data_len );
-       }
-
-       if ( tree ) {
-               ti = proto_tree_add_item( tree, proto_tpkt, tvb, offset, 4,
-                   FALSE );
-               tpkt_tree = proto_item_add_subtree( ti, ett_tpkt );
-               /* Version 1st octet */
-               proto_tree_add_item( tpkt_tree, hf_tpkt_version, tvb,
-                   offset, 1, FALSE );
-               offset++;
-               /* Reserved octet*/
-               proto_tree_add_item( tpkt_tree, hf_tpkt_reserved, tvb,
-                   offset, 1, FALSE );
-               offset++;
-       }
-       else {
-               offset += 2;
+       proto_item *ti = NULL;
+       proto_tree *tpkt_tree = NULL;
+       int offset = 0;
+       int length_remaining;
+       int data_len;
+       int length;
+       tvbuff_t *next_tvb;
+       const char *saved_proto;
+
+       while (tvb_reported_length_remaining(tvb, offset) != 0) {
+               length_remaining = tvb_length_remaining(tvb, offset);
+
+               /*
+                * Can we do reassembly?
+                */
+               if (desegment && pinfo->can_desegment) {
+                       /*
+                        * Yes - is the TPKT header split across segment
+                        * boundaries?
+                        */
+                       if (length_remaining < 4) {
+                               /*
+                                * Yes.  Tell the TCP dissector where
+                                * the data for this message starts in
+                                * the data it handed us, and how many
+                                * more bytes we need, and return.
+                                */
+                               pinfo->desegment_offset = offset;
+                               pinfo->desegment_len = 4 - length_remaining;
+                               return;
+                       }
+               }
+
+               /*
+                * Dissect the TPKT header.
+                * Save and restore "pinfo->current_proto".
+                */
+               saved_proto = pinfo->current_proto;
+               pinfo->current_proto = "TPKT";
+
+               data_len = tvb_get_ntohs(tvb, offset + 2);
+
+               if (check_col(pinfo->cinfo, COL_PROTOCOL))
+                       col_set_str(pinfo->cinfo, COL_PROTOCOL, "TPKT");
+               if (check_col(pinfo->cinfo, COL_INFO)) {
+                       col_add_fstr(pinfo->cinfo, COL_INFO,
+                           "TPKT Data length = %u", data_len);
+               }
+
+               if (tree) {
+                       ti = proto_tree_add_item(tree, proto_tpkt, tvb,
+                           offset, 4, FALSE);
+                       tpkt_tree = proto_item_add_subtree(ti, ett_tpkt);
+
+                       /* Version */
+                       proto_tree_add_item(tpkt_tree, hf_tpkt_version, tvb,
+                           offset, 1, FALSE);
+
+                       /* Reserved octet*/
+                       proto_tree_add_item(tpkt_tree, hf_tpkt_reserved, tvb,
+                           offset + 1, 1, FALSE);
+
+                       /* Length */
+                       proto_tree_add_uint(tpkt_tree, hf_tpkt_length, tvb,
+                           offset + 2, 2, data_len);
+               }
+               pinfo->current_proto = saved_proto;
+
+               /*
+                * Can we do reassembly?
+                */
+               if (desegment && pinfo->can_desegment) {
+                       /*
+                        * Yes - is the payload split across segment
+                        * boundaries?
+                        */
+                       if (length_remaining < data_len + 4) {
+                               /*
+                                * Yes.  Tell the TCP dissector where
+                                * the data for this message starts in
+                                * the data it handed us, and how many
+                                * more bytes we need, and return.
+                                */
+                               pinfo->desegment_offset = offset;
+                               pinfo->desegment_len =
+                                   (data_len + 4) - length_remaining;
+                               return;
+                       }
+               }
+
+               /* Skip the TPKT header. */
+               offset += 4;
+
+               /*
+                * Construct a tvbuff containing the amount of the payload
+                * we have available.  Make its reported length the
+                * amount of data in this TPKT packet.
+                */
+               length = length_remaining - 4;
+               if (length > data_len)
+                       length = data_len;
+               next_tvb = tvb_new_subset(tvb, offset, length, data_len);
+
+               /*
+                * Call the subdissector.
+                */
+               call_dissector(subdissector_handle, next_tvb, pinfo, tree);
+
+               /*
+                * Skip the payload.
+                */
+               offset += length;
        }
-
-       if ( tree )
-               proto_tree_add_uint( tpkt_tree, hf_tpkt_length, tvb,
-                   offset, 2, data_len );
-
-       return data_len;
 }
 
 /*
@@ -154,30 +230,9 @@ dissect_tpkt_header( tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *
  * PDU.
  */
 static void
-dissect_tpkt( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
+dissect_tpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 {
-       int tpkt_len;
-       int offset = 0;
-       int length, reported_length;
-       tvbuff_t *next_tvb;
-
-       /* Dissect the TPKT header. */
-       tpkt_len = dissect_tpkt_header(tvb, offset, pinfo, tree);
-       offset += 4;
-
-       /*
-        * Now hand the minimum of (what's in this frame, what the TPKT
-        * header says is in the PDU) on to the OSI TP dissector.
-        */
-       length = tvb_length_remaining(tvb, offset);
-       reported_length = tvb_reported_length_remaining(tvb, offset);
-       if (length > tpkt_len)
-               length = tpkt_len;
-       if (reported_length > tpkt_len)
-               reported_length = tpkt_len;
-       next_tvb = tvb_new_subset(tvb, offset, length, reported_length);
-
-       call_dissector(osi_tp_handle, next_tvb, pinfo, tree);
+       dissect_tpkt_encap(tvb, pinfo, tree, tpkt_desegment, osi_tp_handle);
 }
 
 void
@@ -227,11 +282,17 @@ proto_register_tpkt(void)
        {
                &ett_tpkt,
        };
-
+       module_t *tpkt_module;
 
        proto_tpkt = proto_register_protocol("TPKT", "TPKT", "tpkt");
        proto_register_field_array(proto_tpkt, hf, array_length(hf));
        proto_register_subtree_array(ett, array_length(ett));
+
+       tpkt_module = prefs_register_protocol(proto_tpkt, NULL);
+       prefs_register_bool_preference(tpkt_module, "desegment",
+           "Desegment all TPKT messages spanning multiple TCP segments",
+           "Whether the TPKT dissector should desegment all messages spanning multiple TCP segments",
+           &tpkt_desegment);
 }
 
 void
index 9afc02a01a910b0228450c949d59605e39bb062a..780a4febadd16edeea96645fb3dde37132a425bf 100644 (file)
@@ -5,7 +5,7 @@
  * Copyright 2000, Philips Electronics N.V.
  * Andreas Sikkema <andreas.sikkema@philips.com>
  *
- * $Id: packet-tpkt.h,v 1.5 2002/02/02 02:51:20 guy Exp $
+ * $Id: packet-tpkt.h,v 1.6 2002/02/22 08:56:46 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
  * Sets "*offset" to the offset of the first byte past the TPKT header,
  * and returns the length from the TPKT header, if it is.
  */
-int is_tpkt( tvbuff_t *tvb, int *offset );
-
+extern int is_tpkt(tvbuff_t *tvb, int *offset);
 
 /*
- * Dissect the TPKT header; called from the TPKT dissector, as well as
- * from dissectors such as the dissector for Q.931-over-TCP.
- *
- * Returns -1 if TPKT isn't enabled, otherwise returns the PDU length
- * from the TPKT header.
+ * Dissect TPKT-encapsulated data in a TCP stream.
  */
-int dissect_tpkt_header( tvbuff_t *tvb, int offset, packet_info *pinfo,
-    proto_tree *tree );
+extern void dissect_tpkt_encap(tvbuff_t *tvb, packet_info *pinfo,
+    proto_tree *tree, gboolean desegment,
+    dissector_handle_t subdissector_handle);
index 95d6a945b656cfa05cc66dddb542ac60aaccddda..a76207d05c3bcad40ac2830c20b2a77bdae73fae 100644 (file)
@@ -1,7 +1,7 @@
 /* plugin_api.c
  * Routines for Ethereal plugins.
  *
- * $Id: plugin_api.c,v 1.36 2002/02/20 08:24:52 guy Exp $
+ * $Id: plugin_api.c,v 1.37 2002/02/22 08:56:48 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * Copyright 2000 by Gilbert Ramirez <gram@alumni.rice.edu>
@@ -168,4 +168,10 @@ plugin_address_table_init(plugin_address_table_t *pat)
 
        /* GIOP End */
 
+       /* TPKT Begin */
+
+       p_is_tpkt                               = pat->p_is_tpkt;
+       p_dissect_tpkt_encap                    = pat->p_dissect_tpkt_encap;
+
+       /* TPKT End */
 }
index 17ab3ccfdf04ba3f4913f71c08c23b02c6197df0..b23e42438fbdcb06836dc5c294fc566052b28a3f 100644 (file)
@@ -1,7 +1,7 @@
 /* plugin_api.h
  * Routines for Ethereal plugins.
  *
- * $Id: plugin_api.h,v 1.37 2002/02/20 08:24:52 guy Exp $
+ * $Id: plugin_api.h,v 1.38 2002/02/22 08:56:48 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * Copyright 2000 by Gilbert Ramirez <gram@alumni.rice.edu>
 #define prefs_register_enum_preference (*p_prefs_register_enum_preference)
 #define prefs_register_string_preference (*p_prefs_register_string_preference)
 
-
 /* GIOP entries Begin */
 
 #define register_giop_user             (*p_register_giop_user)
 
 /* GIOP entries End */
 
+/* TPKT entries Begin */
+
+#define is_tpkt                                (*p_is_tpkt)
+#define dissect_tpkt_encap             (*p_dissect_tpkt_encap)
+
+/* TPKT entries End */
 #endif
 
 #include <epan/packet.h>
 #include <epan/conversation.h>
 #include "prefs.h"
 #include "packet-giop.h"
+#include "packet-tpkt.h"
 
 #include "plugin_table.h"
 
index 3847af90c23676474368552ecb24bcb6fc093682..93fe80f598b3529f87343c4e9b0aa570cac6c970 100644 (file)
@@ -1,7 +1,7 @@
 /* plugin_api_defs.h
  * Define the variables that hold pointers to plugin API functions
  *
- * $Id: plugin_api_defs.h,v 1.12 2002/02/20 08:24:52 guy Exp $
+ * $Id: plugin_api_defs.h,v 1.13 2002/02/22 08:56:48 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * Copyright 2000 by Gilbert Ramirez <gram@alumni.rice.edu>
@@ -192,6 +192,9 @@ addr_get_CDR_ushort                 p_get_CDR_ushort;
 addr_get_CDR_wchar                     p_get_CDR_wchar;
 addr_get_CDR_wstring                   p_get_CDR_wstring;
 
+addr_is_tpkt                           p_is_tpkt;
+addr_dissect_tpkt_encap                        p_dissect_tpkt_encap;
+
 #endif /* PLUGINS_NEED_ADDRESS_TABLE */
 
 #endif /* PLUGIN_API_DEFS_H */
index 6c5715fbf2312f522c0410932ccd17b61ca2be6d..580df8e0b4bf164300f26c1a43d5277b90aea04f 100644 (file)
@@ -1,7 +1,7 @@
 /* plugin_table.h
  * Table of exported addresses for Ethereal plugins.
  *
- * $Id: plugin_table.h,v 1.40 2002/02/20 08:24:52 guy Exp $
+ * $Id: plugin_table.h,v 1.41 2002/02/22 08:56:48 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * Copyright 2000 by Gilbert Ramirez <gram@alumni.rice.edu>
@@ -221,6 +221,10 @@ typedef gint8 (*addr_get_CDR_wchar)(tvbuff_t *, gchar **, int *,
 typedef guint32 (*addr_get_CDR_wstring)(tvbuff_t *, gchar **, int *, gboolean,
                int, MessageHeader *);
 
+typedef int (*addr_is_tpkt)(tvbuff_t *, int *);
+typedef void (*addr_dissect_tpkt_encap)(tvbuff_t *, packet_info *,
+    proto_tree *, gboolean, dissector_handle_t);
+
 typedef struct  {
 
        addr_check_col                          p_check_col;
@@ -384,7 +388,12 @@ typedef struct  {
 
         /* GIOP End */
 
+        /* TPKT Begin */
+
+       addr_is_tpkt                            p_is_tpkt;
+       addr_dissect_tpkt_encap                 p_dissect_tpkt_encap;
 
+        /* GIOP End */
 } plugin_address_table_t;
 
 #else /* ! PLUGINS_NEED_ADDRESS_TABLE */