obnox/wireshark/wip.git
22 years agoGet rid of the "len" and "captured_len" members of the "packet_info"
guy [Tue, 20 Nov 2001 22:29:07 +0000 (22:29 +0000)]
Get rid of the "len" and "captured_len" members of the "packet_info"
structure; they're no longer used.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4236 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoMake the capture routines take an additional argument giving the amount
guy [Tue, 20 Nov 2001 21:59:18 +0000 (21:59 +0000)]
Make the capture routines take an additional argument giving the amount
of packet data captured.

Make the "BYTES_ARE_IN_FRAME()" macro take a "captured length of the
packet" argument.

Add some length checks to capture routines.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4235 f5534014-38df-0310-8fa8-9805f1628bb7

22 years ago"END_OF_FRAME" and "IS_DATA_IN_FRAME()" are no longer used; get rid of
guy [Tue, 20 Nov 2001 20:57:10 +0000 (20:57 +0000)]
"END_OF_FRAME" and "IS_DATA_IN_FRAME()" are no longer used; get rid of
them.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4234 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoHave a routine to add all the hex dump tabs to the hex dump notebook,
guy [Tue, 20 Nov 2001 10:37:16 +0000 (10:37 +0000)]
Have a routine to add all the hex dump tabs to the hex dump notebook,
and call it both from "select_packet()" and "create_new_window()",
rather than having two similar loops in both places.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4233 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoIf bytes in a hex dump view are selected, the field in the corresponding
guy [Tue, 20 Nov 2001 10:10:45 +0000 (10:10 +0000)]
If bytes in a hex dump view are selected, the field in the corresponding
text view should be selected, rather than always selecting a field in
the main text view.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4232 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAllow the tvbuff pointer to various "proto_tree_add" routines to be null
guy [Tue, 20 Nov 2001 09:07:34 +0000 (09:07 +0000)]
Allow the tvbuff pointer to various "proto_tree_add" routines to be null
if (and only if) the length of the item being added is 0 (so that it has
no data backing it).

This means the data stream name pointer for the item in question is
null; make sure we handle that.

Use that for some "uses the value from the matching request" fields in
the SMB Pipe protocol.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4231 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFrom Ronnie Sahlberg: handle transaction continuations the way we handle
guy [Tue, 20 Nov 2001 08:18:01 +0000 (08:18 +0000)]
From Ronnie Sahlberg: handle transaction continuations the way we handle
NT Cancel, as transaction continuations don't get a response, either.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4230 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoDissect the rest of the named pipe protocol. Export from "packet-smb.c"
guy [Tue, 20 Nov 2001 07:47:42 +0000 (07:47 +0000)]
Dissect the rest of the named pipe protocol.  Export from "packet-smb.c"
routines used for that.

Rename some named pipe functions as per the SNIA CIFS spec.

Label the "number of files moved" field of the reply to a Move SMB as
such, rather than as an unspecified "Count".

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4229 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoSave the function code and FID for pipe requests, and use it for the
guy [Tue, 20 Nov 2001 06:24:20 +0000 (06:24 +0000)]
Save the function code and FID for pipe requests, and use it for the
matching responses.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4228 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFrom Frank Singleton:
guy [Mon, 19 Nov 2001 23:00:12 +0000 (23:00 +0000)]
From Frank Singleton:

- accept struct and union lists passed in via ethereal_be.py
- these lists are unused until I add the templates for struct
  and union helper functions. So code generation is unchanged
  for the moment.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4227 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFrom Frank Singleton:
guy [Mon, 19 Nov 2001 22:58:49 +0000 (22:58 +0000)]
From Frank Singleton:

- find all union/struct references and store in lists.
  This includes embedded unions and structs.
- pass the struct and union lists onto ethereal_gen.py
- print all found nodes at DEBUG

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4226 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoWhen reading the preferences file, if the "module.preference" string
gram [Mon, 19 Nov 2001 19:53:14 +0000 (19:53 +0000)]
When reading the preferences file, if the "module.preference" string
references an unknown module, check the "preference" part to see if
another "." is found; iterate until a known module is found, or until
nor more "."'s are found.

Needed for the new "x.25.non_q_bit_is_sna" preference.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4225 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoIf we know the pipe function code, put the function into the Info
guy [Mon, 19 Nov 2001 12:34:51 +0000 (12:34 +0000)]
If we know the pipe function code, put the function into the Info
column.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4224 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoDissect the setup words in pipe transactions that have them; that
guy [Mon, 19 Nov 2001 11:41:51 +0000 (11:41 +0000)]
Dissect the setup words in pipe transactions that have them; that
obviates the need to have a protocol tree item for "MSRPC-over-SMB", as
the setup words for it are just standard TransactNmPipe setup words
(0x26 is the TransactNmPipe function code, and the next setup word is
the FID for the pipe in question.)

Pass to the pipe dissector tvbuffs for setup-words-plus-pipe (which is
the data for the pipe protocol) and parameters-plus-data (which is the
data for the protocol running atop the pipe protocol); use the former
for the top-level protocol tree item for the pipe protocol, and the
latter for the top-level protocol tree item for the LANMAN protocol.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4223 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoMake the register routines for the mailslot, pipe, browser, and
guy [Mon, 19 Nov 2001 10:23:39 +0000 (10:23 +0000)]
Make the register routines for the mailslot, pipe, browser, and
mailslot-based logon protocols just be regular register routines,
detected by the script that generates the "register.c" file, rather than
special stuff known to the SMB dissector.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4222 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoPass, as the first tvbuff argument to "dissect_mailslot_smb()" and
guy [Mon, 19 Nov 2001 10:06:42 +0000 (10:06 +0000)]
Pass, as the first tvbuff argument to "dissect_mailslot_smb()" and
"dissect_pipe_smb()", a tvbuff containing the setup words and the
pipe/mailslot pathname, as those are arguably the part of the packet
that contains the "mailslot protocol" and the "pipe protocol", as
opposed to the protocol running atop mailslots or pipes.

Pass a setup tvbuff to "dissect_pipe_smb()" for it to pass on to the
MSRPC-over-named-pipe dissector, and have the setup tvbuff passed to it
and "dissect_mailslot_smb()" contain *only* the setup words; don't
extract anything other than the setup words from it.

Declare "register_proto_smb_mailslot()" in "packet-smb-mailslot.h"
rather than "packet-smb.c", and declare "register_proto_smb_pipe()" in
"packet-smb-pipe.h" rather than "packet-smb.c".

Add a protocol for MSRPC-over-named-pipes.

Move the stuff to handle the FID in the setup words of
MSRPC-over-named-pipe transactions out of the SMB Transaction dissector
into the MSRPC dissector.  Add a routine to "packet-smb.c", callable
from outside "packet-smb.c", to put an "smb.fid" field into the protocol
tree, and to add ", FID: XXXX" to the Info column, for use by the
MSRPC-over-named-pipe dissector; use it in the SMB dissector as well, in
all the places where we put a FID into the protocol tree.

Move the stuff to check whether the LANMAN protocol is enabled, and to
set "pinfo->current_proto" to "LANMAN" if it is, into the LANMAN
API-over-named-pipe dissector out of the named pipe protocol dissector.

If we didn't dissect a Transaction request or reply as a named pipe or
mailslot message, put any setup words, parameters, and data it has into
the protocol tree as separate items.

Don't put a "Response in" item into the protocol tree for an NT Cancel
request, as there are no responses to NT Cancel requests.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4221 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFrom Tim Potter: use the FID, for DCE RPC-over-SMB, as part of the
guy [Sun, 18 Nov 2001 22:44:08 +0000 (22:44 +0000)]
From Tim Potter: use the FID, for DCE RPC-over-SMB, as part of the
conversation matching.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4220 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFrom Tim Potter:
guy [Sun, 18 Nov 2001 22:12:46 +0000 (22:12 +0000)]
From Tim Potter:

display the returned FID in the Info column for NT Create And X
replies;

display the setup words, and treat the second word as a FID in
Transaction requests presumed to contain DCE RPC-over-SMB.

Add the FID to the Info column for other open/create replies while we're
at it.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4219 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoPass in the "smb_info" structure a pointer to the "smb_saved_info_t"
guy [Sun, 18 Nov 2001 02:51:20 +0000 (02:51 +0000)]
Pass in the "smb_info" structure a pointer to the "smb_saved_info_t"
structure, so that it can be updated by subdissectors; this way the
updates affect the structure immediately, and don't get lost if the
subdissector later throws an exception.

Use "tvb_reported_length()" to check for an interim mailslot reply;
"tvb_length()" could give the wrong answer if a short snapshot length
was given in the capture.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4218 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAdded hooks to allow the registration of heuristic subdissectors of
hagbard [Sun, 18 Nov 2001 02:28:15 +0000 (02:28 +0000)]
Added hooks to allow the registration of heuristic subdissectors of
http.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4217 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoHave only the request and response frame numbers, and a "void *", in an
guy [Sun, 18 Nov 2001 01:46:51 +0000 (01:46 +0000)]
Have only the request and response frame numbers, and a "void *", in an
"smb_saved_info_t".  Put all the information needed to dissect NT
Transaction replies, Transaction2 replies, or Transaction replies into
separate data structures, allocated separately, and put a pointer to
that data structure in the "void *" in question.

Use the return value of "dissect_pipe_smb()" and
"dissect_mailslot_smb()" to control whether to display as data the stuff
those routines were asked to dissect.

If we've seen a request before, but its "smb_saved_info_t" isn't in the
"matched" hash table, look in the "unmatched" hash table - perhaps we
haven't seen the reply yet.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4216 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAdd some bits in the Write AndX write mode as per "Microsoft Networks
guy [Fri, 16 Nov 2001 10:19:35 +0000 (10:19 +0000)]
Add some bits in the Write AndX write mode as per "Microsoft Networks
SMB FILE SHARING PROTOCOL EXTENSIONS, SMB File Sharing Protocol
Extensions Version 2.0, Document Version 3.3".

Fix the test for the "connectionless mode" to test the correct bit.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4215 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoNever put an entry into the hash table for an NT Cancel request, even if
guy [Fri, 16 Nov 2001 09:52:29 +0000 (09:52 +0000)]
Never put an entry into the hash table for an NT Cancel request, even if
we didn't find the request it's cancelling.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4214 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoDon't save a full "smb_info" structure in the hash tables for requests
guy [Fri, 16 Nov 2001 09:27:03 +0000 (09:27 +0000)]
Don't save a full "smb_info" structure in the hash tables for requests
and replies, just save a structure holding that information that can't
be derived from the contents of one of the SMBs.

Don't save anything at all for NT Cancel requests - they have the same
TID/PID/MID/UID as the SMB being cancelled, and you want the information
for that request used when dissecting the NT Cancel (so it gets the
number of the frame containing the request being cancelled) and when
dissecting the reply to the request being cancelled.

Get rid of an unused routine.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4213 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoCleanup of request/response matching, from Ronnie Sahlberg.
guy [Fri, 16 Nov 2001 07:56:28 +0000 (07:56 +0000)]
Cleanup of request/response matching, from Ronnie Sahlberg.

Get rid of "Response to" stuff in the LANMAN dissector, as that's now
done in the SMB dissector.

Add a routine for dissecting unknown SMBs (gets the word and byte
counts, and just adds text entries for the word and byte parameters, if
any), and replace null pointers in the dissector table with pointers to
that routine.  Get rid of the check for a null dissector pointer.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4212 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoResponses to queries for stream information can return more than one
guy [Fri, 16 Nov 2001 02:53:11 +0000 (02:53 +0000)]
Responses to queries for stream information can return more than one
piece of information in the reply, as a file can have more than one
stream; show all of them.

Don't use the "File Name" field for stream names.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4211 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoUse "hf_smb_t2_stream_size", not "hf_smb_t2_stream_name_length", when
guy [Fri, 16 Nov 2001 01:52:27 +0000 (01:52 +0000)]
Use "hf_smb_t2_stream_size", not "hf_smb_t2_stream_name_length", when
adding the stream size.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4210 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAdd "packet-qllc.c".
guy [Thu, 15 Nov 2001 21:50:02 +0000 (21:50 +0000)]
Add "packet-qllc.c".

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4209 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoUpdate Gerald's e-mail address.
guy [Thu, 15 Nov 2001 21:32:18 +0000 (21:32 +0000)]
Update Gerald's e-mail address.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4208 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAdd support for SNA-over-X.25. Add QLLC dissector. I still need to
gram [Thu, 15 Nov 2001 21:11:01 +0000 (21:11 +0000)]
Add support for SNA-over-X.25. Add QLLC dissector. I still need to
work on dissecting the Information frame of QLLC packets.
Thanks to mario.ferreira@hsbc.com.br for lots of information on SNA
over X.25.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4207 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAdd some packet-*.h files to noinst_HEADERS.
gram [Thu, 15 Nov 2001 20:35:23 +0000 (20:35 +0000)]
Add some packet-*.h files to noinst_HEADERS.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4206 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoGet rid of NullTVB, the "compat_top_tvb" member of the "packet_info"
guy [Thu, 15 Nov 2001 10:58:51 +0000 (10:58 +0000)]
Get rid of NullTVB, the "compat_top_tvb" member of the "packet_info"
structure, the check for a null tvbuff pointer in "alloc_field_info()",
and the "tvb_create_from_top()" macro; they're no longer needed, as
there's no non-tvbuffified dissector code remaining.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4205 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoTvbuffification of Transaction requests, from Ronnie Sahlberg.
guy [Thu, 15 Nov 2001 10:41:53 +0000 (10:41 +0000)]
Tvbuffification of Transaction requests, from Ronnie Sahlberg.

"Send buffer pointer" and "send buffer length" items appear not to be
sent over the wire.

Add support for Write And X.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4204 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoMake the RADIUS dissector handle bogus AVPs (AVPs with a length less
guy [Wed, 14 Nov 2001 23:10:12 +0000 (23:10 +0000)]
Make the RADIUS dissector handle bogus AVPs (AVPs with a length less
than the size of the AVP header) a bit better.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4203 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoBack the previous hack out - the padding is often zero, but it's not
guy [Wed, 14 Nov 2001 22:54:26 +0000 (22:54 +0000)]
Back the previous hack out - the padding is often zero, but it's not
*always* zero, so it won't always work, and it's somewhat gross.  The
right answer is "don't use Digital/Tru64 UNIX's tcpdump, use
tcpdump.org's".

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4202 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoThrow in a hack to try to detect FDDI captures from Digital UNIX's
guy [Wed, 14 Nov 2001 22:34:41 +0000 (22:34 +0000)]
Throw in a hack to try to detect FDDI captures from Digital UNIX's
tcpdump and, if we think we've found one, strip off the 3 padding bytes
they put in front of the frame.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4201 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoUpdate two values for XAUTH (XAUTH-NEXT-PIN, XAUTH-ANSWER), in
gram [Wed, 14 Nov 2001 20:02:23 +0000 (20:02 +0000)]
Update two values for XAUTH (XAUTH-NEXT-PIN, XAUTH-ANSWER), in
accordance with http://www.vpnc.org/draft-beaulieu-ike-xauth.
From Yaniv Kaul <ykaul@checkpoint.com>

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4200 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoHopefully the last time I have to change my e-mail address.
gram [Tue, 13 Nov 2001 23:55:44 +0000 (23:55 +0000)]
Hopefully the last time I have to change my e-mail address.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4199 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoSquelch an MSVC++ complaint.
guy [Tue, 13 Nov 2001 06:17:07 +0000 (06:17 +0000)]
Squelch an MSVC++ complaint.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4198 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoThe hash table merely associates data structures with conversations,
guy [Tue, 13 Nov 2001 04:34:38 +0000 (04:34 +0000)]
The hash table merely associates data structures with conversations,
but you can do that directly, so eliminate the hash table and just
attach the data structures to the conversation directly.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4197 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoInclude the sync I/O alert and nonalert bits.
guy [Mon, 12 Nov 2001 21:43:49 +0000 (21:43 +0000)]
Include the sync I/O alert and nonalert bits.

Put in comments about some of the other bits.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4196 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFrom Tim Potter: added code to call request and reply subdissectors in DCE
guy [Mon, 12 Nov 2001 09:04:11 +0000 (09:04 +0000)]
From Tim Potter: added code to call request and reply subdissectors in DCE
RPC.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4195 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoSupport for DCE RPC atop SMB, and support for several Microsoft DCE RPC
guy [Mon, 12 Nov 2001 08:58:45 +0000 (08:58 +0000)]
Support for DCE RPC atop SMB, and support for several Microsoft DCE RPC
services used with SMB, from Tim Potter.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4194 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoTransaction2 tvbuffified, and support added for many Transaction2 SMBs,
guy [Mon, 12 Nov 2001 08:46:14 +0000 (08:46 +0000)]
Transaction2 tvbuffified, and support added for many Transaction2 SMBs,
from Ronnie Sahlberg.

Various other bug fixes, cleanups, and other improvements.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4193 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoDissect the NT create option bits. (Well, some of them, anyway.)
guy [Sun, 11 Nov 2001 02:27:06 +0000 (02:27 +0000)]
Dissect the NT create option bits.  (Well, some of them, anyway.)

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4192 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoChange from Tim Potter to show the error status in the Info column for
guy [Sat, 10 Nov 2001 22:23:11 +0000 (22:23 +0000)]
Change from Tim Potter to show the error status in the Info column for
SMBs that got errors.

Add some additional access mask bits, and the URL of another spec.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4191 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoMicrosoft calls it "Dfs", not "DFS", perhaps to avoid confusion with the
guy [Fri, 9 Nov 2001 22:58:10 +0000 (22:58 +0000)]
Microsoft calls it "Dfs", not "DFS", perhaps to avoid confusion with the
OSF's DCE DFS (which is completely unrelated to Dfs).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4190 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoNT Create and X support, from Ronnie Sahlberg.
guy [Fri, 9 Nov 2001 22:45:22 +0000 (22:45 +0000)]
NT Create and X support, from Ronnie Sahlberg.

"#if 0" out an unused routine, pending determination of whether there's
any place that would use it.

Fix some typos.

Display the NT create options in hex, as they appear to be a bitmask.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4189 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoRemove "text2pcap-scanner.obj" and "tools\lemon\lemon.obj" when a "nmake
guy [Fri, 9 Nov 2001 09:22:07 +0000 (09:22 +0000)]
Remove "text2pcap-scanner.obj" and "tools\lemon\lemon.obj" when a "nmake
clean" is done.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4188 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFix a couple of comments.
guy [Fri, 9 Nov 2001 08:36:56 +0000 (08:36 +0000)]
Fix a couple of comments.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4187 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFixes from Kazushi Sugyo:
guy [Fri, 9 Nov 2001 08:16:25 +0000 (08:16 +0000)]
Fixes from Kazushi Sugyo:

1) print the payload length in AH headers correctly (the field's
   value is length of the payload, minus 2, divided by 2, so we
   have to add 2 before multiplying by 2);

2) correctly handle, in an SIOCGIFCONF list, entries whose
   address has an "sa_len" field less than the size of a "struct
   sockaddr" (the length of the address in an entry is the
   maximum of the real length and the size of a "struct
   sockaddr").

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4186 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoPut in an XXX note indicating that if we conclude we're using the AIX
guy [Fri, 9 Nov 2001 07:51:01 +0000 (07:51 +0000)]
Put in an XXX note indicating that if we conclude we're using the AIX
libpcap, we may also want to return a flag indicating that we have to
map seconds/nanoseconds in the packet header to seconds/microseconds.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4185 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoWrap calls to "pcap_datalink()" in a routine that attempts to compensate
guy [Fri, 9 Nov 2001 07:44:51 +0000 (07:44 +0000)]
Wrap calls to "pcap_datalink()" in a routine that attempts to compensate
for AIX 5.x's non-standard libpcap, where "pcap_datalink()" doesn't
return DLT_ values, it returns RFC 1573 ifType values.

Put that wrapper, and the routine to get the interface list, in a
separate file, for packet-capture utility routines, so not everybody who
includes "util.h" needs to include <pcap.h>.

Fix up the Wiretap hack for dealing with said incompatibility to use the
correct ifType value for Token Ring.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4184 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoTvbuffification of SMB print commands, from Ronnie Sahlberg.
guy [Fri, 9 Nov 2001 06:43:38 +0000 (06:43 +0000)]
Tvbuffification of SMB print commands, from Ronnie Sahlberg.

Fix up some SMBs I missed when adding the byte-count checks.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4183 f5534014-38df-0310-8fa8-9805f1628bb7

22 years ago2^n is 1 << n, not 2 << n.
guy [Fri, 9 Nov 2001 02:04:35 +0000 (02:04 +0000)]
2^n is 1 << n, not 2 << n.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4182 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFrom <a.stockmeier[AT]avm.de>: fix the file dialog box code to use
guy [Fri, 9 Nov 2001 00:08:30 +0000 (00:08 +0000)]
From <a.stockmeier[AT]avm.de>: fix the file dialog box code to use
"g_strdup()", not "strdup()" to copy strings.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4181 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoPrint the create flags with 8 hex digits.
guy [Thu, 8 Nov 2001 10:57:09 +0000 (10:57 +0000)]
Print the create flags with 8 hex digits.

Add some checks of the return value of
"get_unicode_or_ascii_string_tvb()" - if a null terminator is missing,
it might well run past the end of the byte parameters - and add some
code to keep the byte count updated so that the right byte count is
passed to "get_unicode_or_ascii_string_tvb()".

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4180 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoPut the stuff to handle file data in read and write requests into a
guy [Thu, 8 Nov 2001 10:34:11 +0000 (10:34 +0000)]
Put the stuff to handle file data in read and write requests into a
common subroutine.

Label the "total data length" field in Write Raw and Write Multiplexed
requests as such.

Dissect the IPC State/Device State field of Open and X requests and NT
Create and X requests ass per the stuff on page 67 of

ftp://ftp.microsoft.com/developr/drg/CIFS/dosextp.txt

Make a variable that doesn't need to be static not static.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4179 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoNT Transact dissection, from Ronnie Sahlberg.
guy [Thu, 8 Nov 2001 08:21:13 +0000 (08:21 +0000)]
NT Transact dissection, from Ronnie Sahlberg.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4178 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAllow periods in module names.
gram [Thu, 8 Nov 2001 02:54:31 +0000 (02:54 +0000)]
Allow periods in module names.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4177 f5534014-38df-0310-8fa8-9805f1628bb7

22 years ago"dissect_open_print_file_smb()" was defined but not used; put it into
guy [Wed, 7 Nov 2001 20:30:43 +0000 (20:30 +0000)]
"dissect_open_print_file_smb()" was defined but not used; put it into
the appropriate entry in the "dissect[]" table.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4176 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoMPLS support for handling either IPv4 or IPv6 as the payload protocol
guy [Wed, 7 Nov 2001 20:26:38 +0000 (20:26 +0000)]
MPLS support for handling either IPv4 or IPv6 as the payload protocol
type, from Hamish Moffatt.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4175 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoUpdate the URL for Cygwin.
guy [Wed, 7 Nov 2001 18:49:57 +0000 (18:49 +0000)]
Update the URL for Cygwin.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4174 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoExpand on the comments about AIX libpcap.
guy [Wed, 7 Nov 2001 08:16:26 +0000 (08:16 +0000)]
Expand on the comments about AIX libpcap.

No, Nokia *weren't* kind enough to change the major or minor version
number in the capture file when they changed the format, just as they
weren't kind enough to change the magic number.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4173 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFurther tvbuffication from Ronnie Sahlberg.
guy [Wed, 7 Nov 2001 08:05:04 +0000 (08:05 +0000)]
Further tvbuffication from Ronnie Sahlberg.

Get rid of a bunch of stuff for which said tvbuffication removes the
need.

When dissecting byte parameters, make sure you don't consume more bytes
than the byte count, and handle captures where the last string in the
byte parameters area isn't properly null-terminated (I think I've seen
that in packets from various versions of Windows NT).

Make various bitfields given as decimal in SMB specs decimal.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4172 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agocode cleanup
girlich [Wed, 7 Nov 2001 07:05:58 +0000 (07:05 +0000)]
code cleanup
AUTH reply dissector added

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4171 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoIEEE 802.1x, a/k/a EAPOL, and PPP/EAPOL EAP support, from Pekka
guy [Tue, 6 Nov 2001 20:30:40 +0000 (20:30 +0000)]
IEEE 802.1x, a/k/a EAPOL, and PPP/EAPOL EAP support, from Pekka
Nikander.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4170 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAUTH call dissected. It includes XOR encoded user name/passwords. I did
girlich [Tue, 6 Nov 2001 18:32:30 +0000 (18:32 +0000)]
AUTH call dissected. It includes XOR encoded user name/passwords. I did
a decode on the fly.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4169 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoPCNFSD added for Uwe Girlich
girlich [Tue, 6 Nov 2001 13:44:08 +0000 (13:44 +0000)]
PCNFSD added for Uwe Girlich

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4168 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoPCNFSD dissector file packet-pcnfsd.c added to source list
girlich [Tue, 6 Nov 2001 13:43:44 +0000 (13:43 +0000)]
PCNFSD dissector file packet-pcnfsd.c added to source list

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4167 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agostart of a PCNFSD dissector, header file
girlich [Tue, 6 Nov 2001 13:42:35 +0000 (13:42 +0000)]
start of a PCNFSD dissector, header file

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4166 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoStart of a PCNFSD dissector as the RPC dissector 150001.
girlich [Tue, 6 Nov 2001 13:42:04 +0000 (13:42 +0000)]
Start of a PCNFSD dissector as the RPC dissector 150001.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4165 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAdd in some heuristics to try to detect AIX libpcap format. (This works
guy [Tue, 6 Nov 2001 01:55:14 +0000 (01:55 +0000)]
Add in some heuristics to try to detect AIX libpcap format.  (This works
with one capture I've seen, but perhaps that was done with an old
version of AIX, and newer versions use a minor version number, in the
file, of 4.

However, libpcap hasn't used a minor version of 2 for ages, so perhaps
AIX hasn't updated their libpcap in ages, and aren't about to do so
soon.  If they do, let's hope they change the magic number.  The capture
file in question *does* have the capture length and real length in the
old, pre-2.3, order, so it really looks as if it's an old version,
rather than IBM trying to be "helpful" by using a different minor
version number so that you can distinguish between normal libpcap and
AIX libpcap formats.)

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4164 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFrom Tom Uijldert: have an non-heuristic UCP dissector, and register it
guy [Mon, 5 Nov 2001 21:41:33 +0000 (21:41 +0000)]
From Tom Uijldert: have an non-heuristic UCP dissector, and register it
as a TCP conversation dissector, so that it can be selected in the
"Decode As" dialog box.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4163 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoIPCOMP transformation and ID_IPV4_ADDR_SUBNET for ISAKMP, from
guy [Mon, 5 Nov 2001 21:36:07 +0000 (21:36 +0000)]
IPCOMP transformation and ID_IPV4_ADDR_SUBNET for ISAKMP, from
<a.stockmeier[AT]avm.de>.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4162 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFix the previous change to handle SMBs with tvbuffified dissectors.
guy [Mon, 5 Nov 2001 07:58:33 +0000 (07:58 +0000)]
Fix the previous change to handle SMBs with tvbuffified dissectors.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4161 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoPut andX commands at the same level as the first command.
guy [Mon, 5 Nov 2001 07:46:01 +0000 (07:46 +0000)]
Put andX commands at the same level as the first command.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4160 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoPut in some references.
guy [Mon, 5 Nov 2001 05:39:31 +0000 (05:39 +0000)]
Put in some references.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4159 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFurther tvbuffication, from Ronnie Sahlberg.
guy [Mon, 5 Nov 2001 05:24:17 +0000 (05:24 +0000)]
Further tvbuffication, from Ronnie Sahlberg.

Convert a bunch of "proto_tree_add_XXX" calls to "proto_tree_add_item"
calls.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4158 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFuther tvbuffification from Ronnie Sahlberg.
guy [Mon, 5 Nov 2001 01:44:17 +0000 (01:44 +0000)]
Futher tvbuffification from Ronnie Sahlberg.

Do more sanity checking on DOS dates and times.

Convert a bunch of "proto_tree_add_XXX" calls to "proto_tree_add_item"
calls.

Put the word and byte data for untvbuffified SMBs under a subtree just
as is done for tvbuffified SMBs.

Get rid of some no-longer-used routines.

Fix some displays in untvbuffified SMBs to resemble the way those fields
are displayed for tvbuffified SMBs.

Display timesouts as seconds and milliseconds when they're in units of
milliseconds.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4157 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoSUA dissector, from Michael Tuexen, replacing (and subsuming) the SUA
guy [Sun, 4 Nov 2001 22:19:23 +0000 (22:19 +0000)]
SUA dissector, from Michael Tuexen, replacing (and subsuming) the SUA
Light dissector.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4156 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoInclude "conversation.h", as the plugin API now includes the routines to
guy [Sun, 4 Nov 2001 22:14:43 +0000 (22:14 +0000)]
Include "conversation.h", as the plugin API now includes the routines to
create and find conversations.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4155 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFurther tvbuffication, from Ronnie Sahlberg.
guy [Sun, 4 Nov 2001 12:44:02 +0000 (12:44 +0000)]
Further tvbuffication, from Ronnie Sahlberg.

Make it possible for a non-tvbuffied dissector for an andX SMB to call a
tvbuffified dissector for the andX command, and fix the non-tvbuffified
dissectors in question to do so.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4154 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoCBCP support in PPP, from Motonori Shindo.
guy [Sun, 4 Nov 2001 04:50:12 +0000 (04:50 +0000)]
CBCP support in PPP, from Motonori Shindo.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4153 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoInclude protocols for TCP conversation dissectors in the list of
guy [Sun, 4 Nov 2001 04:12:03 +0000 (04:12 +0000)]
Include protocols for TCP conversation dissectors in the list of
protocols that can be used to decode stuff.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4152 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoDeclare routines exported to plugins through the plugin API table as
guy [Sun, 4 Nov 2001 03:55:52 +0000 (03:55 +0000)]
Declare routines exported to plugins through the plugin API table as
extern, so that "plugin_api_defs.h" works on platforms where you have to
use the plugin API table.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4151 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAdditional routines made available to plugins, from Tomas Kukosa.
guy [Sun, 4 Nov 2001 03:37:29 +0000 (03:37 +0000)]
Additional routines made available to plugins, from Tomas Kukosa.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4150 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoIn "plugin_api_defs.h", just do
guy [Sun, 4 Nov 2001 03:16:47 +0000 (03:16 +0000)]
In "plugin_api_defs.h", just do

addr_XXX p_XXX;

for all the declarations, to simplify things, as per Tomas Kukosa's
suggestion.

Fix a couple of comments.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4149 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoAllow a dissector to register preferences that it no longer supports as
guy [Sun, 4 Nov 2001 02:50:21 +0000 (02:50 +0000)]
Allow a dissector to register preferences that it no longer supports as
obsolete; we silently ignore attempts to set those in a preferences
file, so that we don't spam the user with error messages caused by them
having saved preferences in an earlier release that contained those
preferences.

Make the Diameter and iSCSI dissectors register obsolete preferences.

Crash if some code tries to register a preferences module with a name
that contains something other than lower-case ASCII letters, numbers, or
underscores, or that has already been registered, or if some code tries
to register a preference with a name that contains something other than
lower-case ASCII letters, numbers, underscores, or periods, or that has
already been registered, so that we don't put code like that in a
release and have to shovel code into "prefs.c" to fix it up later.  (The
problem with multiple modules or preferences with the same name should
be obvious; the problem with names with blanks, or upper-case letters,
or punctuation, is that they're a pain to type on the command line.)

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4148 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoUpdates from Mark Burton.
guy [Sun, 4 Nov 2001 00:58:23 +0000 (00:58 +0000)]
Updates from Mark Burton.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4147 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoMore tvbuffication, from Ronnie Sahlberg.
guy [Sun, 4 Nov 2001 00:53:46 +0000 (00:53 +0000)]
More tvbuffication, from Ronnie Sahlberg.

When converting DOS-date years to "struct tm" years, add 1980 and
subtract 1900, to make it clearer what the conversion involves (DOS-date
years are (year - 1980); "struct tm" years are (year - 1900)).

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4146 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoCheck for a zero word count in LogoffandX requests and replies.
guy [Sat, 3 Nov 2001 23:53:48 +0000 (23:53 +0000)]
Check for a zero word count in LogoffandX requests and replies.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4145 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoClean up the Info column, by leaving the ": " that separates bad
guy [Sat, 3 Nov 2001 23:13:03 +0000 (23:13 +0000)]
Clean up the Info column, by leaving the ": " that separates bad
packet/flag information from the PDU type if there's no bad packet or
flag informatin.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4144 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoCrash if a dissector tries to create more than one preference with the
guy [Sat, 3 Nov 2001 21:37:00 +0000 (21:37 +0000)]
Crash if a dissector tries to create more than one preference with the
same name; if that happens, there's no way to tell to which of them a
line in a preferences file, or an option supplied with "-o", refers, so
it's clearly a bug in the code.  This has happened in the past, and
fixing that required some preference renaming *and* code in the
preferences-file-reading code to try to preserve the user's settings and
not spew warnings when starting Ethereal or Tethereal; let's try to
catch it *before* the code gets into the code base.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4143 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoCooperative Route Filtering Capability support, and Route Refresh
guy [Sat, 3 Nov 2001 21:25:12 +0000 (21:25 +0000)]
Cooperative Route Filtering Capability support, and Route Refresh
Message bug fix, in BGP, from Motonori Shindo.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4142 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoSupport for desegmentation of Diameter-over-TCP, from David Frascone.
guy [Sat, 3 Nov 2001 12:19:56 +0000 (12:19 +0000)]
Support for desegmentation of Diameter-over-TCP, from David Frascone.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4141 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoClean up the display of the Flags and Flags2 fields, and add a missing
guy [Sat, 3 Nov 2001 12:10:34 +0000 (12:10 +0000)]
Clean up the display of the Flags and Flags2 fields, and add a missing
bit to Flags2.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4140 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoTvbuffification of Negotiate Protocol, from Ronnie Sahlberg.
guy [Sat, 3 Nov 2001 11:42:50 +0000 (11:42 +0000)]
Tvbuffification of Negotiate Protocol, from Ronnie Sahlberg.

Fix up Info column to put "Request" or "Response" *after* the name of
the request.

Give the Negotiate Protocol request its full name.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4139 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoFirst tvbuffication change, from Ronnie Sahlberg. Also changes SMB
guy [Sat, 3 Nov 2001 06:56:56 +0000 (06:56 +0000)]
First tvbuffication change, from Ronnie Sahlberg.  Also changes SMB
command names to match later SMB specs.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4138 f5534014-38df-0310-8fa8-9805f1628bb7

22 years agoIn "addStaticAVP()", add the new entry to the list of AVP types after
guy [Sat, 3 Nov 2001 04:09:46 +0000 (04:09 +0000)]
In "addStaticAVP()", add the new entry to the list of AVP types after
it's filled in.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@4137 f5534014-38df-0310-8fa8-9805f1628bb7