2 * Routines for packet disassembly
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
41 #include "timestamp.h"
43 #include "atalk-utils.h"
44 #include "sna-utils.h"
45 #include "osi-utils.h"
48 #include "addr_resolv.h"
51 #include "epan_dissect.h"
54 #include "wmem/wmem.h"
56 #include <epan/exceptions.h>
57 #include <epan/reassemble.h>
58 #include <epan/stream.h>
59 #include <epan/expert.h>
61 static gint proto_malformed
= -1;
62 static dissector_handle_t frame_handle
= NULL
;
63 static dissector_handle_t data_handle
= NULL
;
67 * Has a tvbuff and a name.
77 * "hash_table" is a hash table, indexed by port number, supplying
78 * a "struct dtbl_entry"; it records what dissector is assigned to
79 * that uint or string value in that table.
81 * "dissector_handles" is a list of all dissectors that *could* be
82 * used in that table; not all of them are necessarily in the table,
83 * as they may be for protocols that don't have a fixed uint value,
84 * e.g. for TCP or UDP port number tables and protocols with no fixed
87 * "ui_name" is the name the dissector table has in the user interface.
89 * "type" is a field type giving the width of the uint value for that
90 * dissector table, if it's a uint dissector table.
92 * "base" is the base in which to display the uint value for that
93 * dissector table, if it's a uint dissector table.
95 struct dissector_table
{
96 GHashTable
*hash_table
;
97 GSList
*dissector_handles
;
103 static GHashTable
*dissector_tables
= NULL
;
106 * List of registered dissectors.
108 static GHashTable
*registered_dissectors
= NULL
;
110 static GHashTable
*heur_dissector_lists
= NULL
;
113 destroy_heuristic_dissector_entry(gpointer data
, gpointer user_data _U_
)
115 g_slice_free(heur_dtbl_entry_t
, data
);
119 destroy_heuristic_dissector_list(void *data
)
121 GSList
**list
= (GSList
**)data
;
123 g_slist_foreach(*list
, destroy_heuristic_dissector_entry
, NULL
);
129 destroy_dissector_table(void *data
)
131 struct dissector_table
*table
= (struct dissector_table
*)data
;
133 g_hash_table_destroy(table
->hash_table
);
134 g_slist_free(table
->dissector_handles
);
135 g_slice_free(struct dissector_table
, data
);
141 dissector_tables
= g_hash_table_new_full(g_str_hash
, g_str_equal
,
142 NULL
, destroy_dissector_table
);
144 registered_dissectors
= g_hash_table_new_full(g_str_hash
, g_str_equal
,
147 heur_dissector_lists
= g_hash_table_new_full(g_str_hash
, g_str_equal
,
148 NULL
, destroy_heuristic_dissector_list
);
152 packet_cache_proto_handles(void)
154 frame_handle
= find_dissector("frame");
155 g_assert(frame_handle
!= NULL
);
157 data_handle
= find_dissector("data");
158 g_assert(data_handle
!= NULL
);
160 proto_malformed
= proto_get_id_by_filter_name("_ws.malformed");
161 g_assert(proto_malformed
!= -1);
167 g_hash_table_destroy(dissector_tables
);
168 g_hash_table_destroy(registered_dissectors
);
169 g_hash_table_destroy(heur_dissector_lists
);
173 * Given a tvbuff, and a length from a packet header, adjust the length
174 * of the tvbuff to reflect the specified length.
177 set_actual_length(tvbuff_t
*tvb
, const guint specified_len
)
179 if (specified_len
< tvb_reported_length(tvb
)) {
180 /* Adjust the length of this tvbuff to include only the specified
183 The dissector above the one calling us (the dissector above is
184 probably us) may use that to determine how much of its packet
186 tvb_set_reported_length(tvb
, specified_len
);
190 /* Allow protocols to register "init" routines, which are called before
191 we make a pass through a capture file and dissect all its packets
192 (e.g., when we read in a new capture file, or run a "filter packets"
193 or "colorize packets" pass over the current capture file). */
194 static GSList
*init_routines
;
197 register_init_routine(void (*func
)(void))
199 init_routines
= g_slist_prepend(init_routines
, (gpointer
)func
);
202 typedef void (*void_func_t
)(void);
204 /* Initialize all data structures used for dissection. */
206 call_init_routine(gpointer routine
, gpointer dummy _U_
)
208 void_func_t func
= (void_func_t
)routine
;
213 * XXX - for now, these are the same; the "init" routines free whatever
214 * stuff is left over from any previous dissection, and then initialize
217 * We should probably split that into "init" and "cleanup" routines, for
221 init_dissection(void)
223 /* Reclaim and reinitialize all memory of seasonal scope */
226 wmem_enter_file_scope();
229 * Reinitialize resolution information. We do initialization here in
230 * case we need to resolve between captures.
232 host_name_lookup_init();
234 /* Initialize the table of conversations. */
235 epan_conversation_init();
237 /* Initialize the table of circuits. */
240 /* Initialize protocol-specific variables. */
241 g_slist_foreach(init_routines
, &call_init_routine
, NULL
);
243 /* Initialize the stream-handling tables */
246 /* Initialize the expert infos */
247 expert_packet_init();
251 cleanup_dissection(void)
253 /* Cleanup the table of conversations. Do this before freeing seasonal
254 * memory (at least until conversation's use of g_slist is changed).
256 epan_conversation_cleanup();
258 /* Reclaim all memory of seasonal scope */
261 /* Cleanup the table of circuits. */
262 epan_circuit_cleanup();
264 /* TODO: Introduce cleanup_routines */
265 /* Cleanup protocol-specific variables. */
266 g_slist_foreach(init_routines
, &call_init_routine
, NULL
);
268 /* Cleanup the stream-handling tables */
271 /* Initialize the expert infos */
272 expert_packet_cleanup();
274 wmem_leave_file_scope();
277 * Reinitialize resolution information. We do initialization here in
278 * case we need to resolve between captures.
280 host_name_lookup_cleanup();
283 /* Allow protocols to register a "cleanup" routine to be
284 * run after the initial sequential run through the packets.
285 * Note that the file can still be open after this; this is not
286 * the final cleanup. */
287 static GSList
*postseq_cleanup_routines
;
290 register_postseq_cleanup_routine(void_func_t func
)
292 postseq_cleanup_routines
= g_slist_prepend(postseq_cleanup_routines
,
296 /* Call all the registered "postseq_cleanup" routines. */
298 call_postseq_cleanup_routine(gpointer routine
, gpointer dummy _U_
)
300 void_func_t func
= (void_func_t
)routine
;
305 postseq_cleanup_all_protocols(void)
307 g_slist_foreach(postseq_cleanup_routines
,
308 &call_postseq_cleanup_routine
, NULL
);
312 * Add a new data source to the list of data sources for a frame, given
313 * the tvbuff for the data source and its name.
316 add_new_data_source(packet_info
*pinfo
, tvbuff_t
*tvb
, const char *name
)
318 struct data_source
*src
;
320 src
= g_slice_new(struct data_source
);
322 src
->name
= g_strdup(name
);
323 pinfo
->data_src
= g_slist_append(pinfo
->data_src
, src
);
327 get_data_source_name(const struct data_source
*src
)
329 guint length
= tvb_length(src
->tvb
);
331 return ep_strdup_printf("%s (%u byte%s)", src
->name
, length
,
332 plurality(length
, "", "s"));
336 get_data_source_tvb(const struct data_source
*src
)
342 * Free up a frame's list of data sources.
345 free_data_sources(packet_info
*pinfo
)
347 if (pinfo
->data_src
) {
350 for (l
= pinfo
->data_src
; l
; l
= l
->next
) {
351 struct data_source
*src
= (struct data_source
*)l
->data
;
354 g_slice_free(struct data_source
, src
);
356 g_slist_free(pinfo
->data_src
);
357 pinfo
->data_src
= NULL
;
362 mark_frame_as_depended_upon(packet_info
*pinfo
, guint32 frame_num
)
364 /* Don't mark a frame as dependent on itself */
365 if (frame_num
!= PINFO_FD_NUM(pinfo
)) {
366 pinfo
->dependent_frames
= g_slist_prepend(pinfo
->dependent_frames
, GUINT_TO_POINTER(frame_num
));
370 /* Allow dissectors to register a "final_registration" routine
371 * that is run like the proto_register_XXX() routine, but at the
372 * end of the epan_init() function; that is, *after* all other
373 * subsystems, like dfilters, have finished initializing. This is
374 * useful for dissector registration routines which need to compile
375 * display filters. dfilters can't initialize itself until all protocols
376 * have registered themselves. */
377 static GSList
*final_registration_routines
;
380 register_final_registration_routine(void (*func
)(void))
382 final_registration_routines
= g_slist_prepend(final_registration_routines
,
386 /* Call all the registered "final_registration" routines. */
388 call_final_registration_routine(gpointer routine
, gpointer dummy _U_
)
390 void_func_t func
= (void_func_t
)routine
;
396 final_registration_all_protocols(void)
398 g_slist_foreach(final_registration_routines
,
399 &call_final_registration_routine
, NULL
);
403 /* Creates the top-most tvbuff and calls dissect_frame() */
405 dissect_packet(epan_dissect_t
*edt
, struct wtap_pkthdr
*phdr
,
406 tvbuff_t
*tvb
, frame_data
*fd
, column_info
*cinfo
)
409 col_init(cinfo
, edt
->session
);
410 edt
->pi
.epan
= edt
->session
;
411 /* edt->pi.pool created in epan_dissect_init() */
412 edt
->pi
.current_proto
= "<Missing Protocol Name>";
413 edt
->pi
.cinfo
= cinfo
;
416 edt
->pi
.pseudo_header
= &phdr
->pseudo_header
;
417 edt
->pi
.dl_src
.type
= AT_NONE
;
418 edt
->pi
.dl_dst
.type
= AT_NONE
;
419 edt
->pi
.net_src
.type
= AT_NONE
;
420 edt
->pi
.net_dst
.type
= AT_NONE
;
421 edt
->pi
.src
.type
= AT_NONE
;
422 edt
->pi
.dst
.type
= AT_NONE
;
423 edt
->pi
.ctype
= CT_NONE
;
424 edt
->pi
.noreassembly_reason
= "";
425 edt
->pi
.ptype
= PT_NONE
;
426 edt
->pi
.p2p_dir
= P2P_DIR_UNKNOWN
;
427 edt
->pi
.dcetransporttype
= -1;
428 edt
->pi
.annex_a_used
= MTP2_ANNEX_A_USED_UNKNOWN
;
429 edt
->pi
.dcerpc_procedure_name
="";
430 edt
->pi
.link_dir
= LINK_DIR_UNKNOWN
;
431 edt
->pi
.layers
= wmem_list_new(edt
->pi
.pool
);
435 frame_delta_abs_time(edt
->session
, fd
, fd
->frame_ref_num
, &edt
->pi
.rel_ts
);
437 /* pkt comment use first user, later from phdr */
438 if (fd
->flags
.has_user_comment
)
439 edt
->pi
.pkt_comment
= epan_get_user_comment(edt
->session
, fd
);
440 else if (fd
->flags
.has_phdr_comment
)
441 edt
->pi
.pkt_comment
= phdr
->opt_comment
;
443 /* to enable decode as for ethertype=0x0000 (fix for bug 4721) */
444 edt
->pi
.ethertype
= G_MAXINT
;
446 EP_CHECK_CANARY(("before dissecting frame %d",fd
->num
));
449 /* Add this tvbuffer into the data_src list */
450 add_new_data_source(&edt
->pi
, edt
->tvb
, "Frame");
452 /* Even though dissect_frame() catches all the exceptions a
453 * sub-dissector can throw, dissect_frame() itself may throw
454 * a ReportedBoundsError in bizarre cases. Thus, we catch the exception
455 * in this function. */
456 call_dissector(frame_handle
, edt
->tvb
, &edt
->pi
, edt
->tree
);
460 g_assert_not_reached();
462 CATCH2(FragmentBoundsError
, ReportedBoundsError
) {
463 proto_tree_add_protocol_format(edt
->tree
, proto_malformed
, edt
->tvb
, 0, 0,
464 "[Malformed Frame: Packet Length]" );
468 EP_CHECK_CANARY(("after dissecting frame %d",fd
->num
));
470 fd
->flags
.visited
= 1;
473 /*********************** code added for sub-dissector lookup *********************/
476 * A dissector handle.
478 struct dissector_handle
{
479 const char *name
; /* dissector name */
480 gboolean is_new
; /* TRUE if new-style dissector */
483 new_dissector_t new_d
;
485 protocol_t
*protocol
;
488 /* This function will return
489 * old style dissector :
490 * length of the payload or 1 of the payload is empty
492 * >0 this protocol was successfully dissected and this was this protocol.
493 * 0 this packet did not match this protocol.
495 * The only time this function will return 0 is if it is a new style dissector
496 * and if the dissector rejected the packet.
499 call_dissector_through_handle(dissector_handle_t handle
, tvbuff_t
*tvb
,
500 packet_info
*pinfo
, proto_tree
*tree
, void *data
)
502 const char *saved_proto
;
505 saved_proto
= pinfo
->current_proto
;
507 if (handle
->protocol
!= NULL
) {
508 pinfo
->current_proto
=
509 proto_get_protocol_short_name(handle
->protocol
);
512 if (handle
->is_new
) {
513 EP_CHECK_CANARY(("before calling handle->dissector.new_d for %s",handle
->name
));
514 ret
= (*handle
->dissector
.new_d
)(tvb
, pinfo
, tree
, data
);
515 EP_CHECK_CANARY(("after calling handle->dissector.new_d for %s",handle
->name
));
517 EP_CHECK_CANARY(("before calling handle->dissector.old for %s",handle
->name
));
518 (*handle
->dissector
.old
)(tvb
, pinfo
, tree
);
519 EP_CHECK_CANARY(("after calling handle->dissector.old for %s",handle
->name
));
520 ret
= tvb_length(tvb
);
523 * XXX - a tvbuff can have 0 bytes of data in
524 * it, so we have to make sure we don't return
531 pinfo
->current_proto
= saved_proto
;
537 * Call a dissector through a handle.
538 * If the protocol for that handle isn't enabled, return 0 without
539 * calling the dissector.
540 * Otherwise, if the handle refers to a new-style dissector, call the
541 * dissector and return its return value, otherwise call it and return
542 * the length of the tvbuff pointed to by the argument.
546 call_dissector_work_error(dissector_handle_t handle
, tvbuff_t
*tvb
,
547 packet_info
*pinfo_arg
, proto_tree
*tree
, void *);
550 call_dissector_work(dissector_handle_t handle
, tvbuff_t
*tvb
, packet_info
*pinfo_arg
,
551 proto_tree
*tree
, gboolean add_proto_name
, void *data
)
553 packet_info
*pinfo
= pinfo_arg
;
554 const char *saved_proto
;
555 guint16 saved_can_desegment
;
557 guint saved_layers_len
= 0;
559 if (handle
->protocol
!= NULL
&&
560 !proto_is_protocol_enabled(handle
->protocol
)) {
562 * The protocol isn't enabled.
567 saved_proto
= pinfo
->current_proto
;
568 saved_can_desegment
= pinfo
->can_desegment
;
569 saved_layers_len
= wmem_list_count(pinfo
->layers
);
572 * can_desegment is set to 2 by anyone which offers the
573 * desegmentation api/service.
574 * Then everytime a subdissector is called it is decremented
576 * Thus only the subdissector immediately on top of whoever
577 * offers this service can use it.
578 * We save the current value of "can_desegment" for the
579 * benefit of TCP proxying dissectors such as SOCKS, so they
580 * can restore it and allow the dissectors they call to use
581 * the desegmentation service.
583 pinfo
->saved_can_desegment
= saved_can_desegment
;
584 pinfo
->can_desegment
= saved_can_desegment
-(saved_can_desegment
>0);
585 if (handle
->protocol
!= NULL
) {
586 pinfo
->current_proto
=
587 proto_get_protocol_short_name(handle
->protocol
);
590 * Add the protocol name to the layers
591 * if not told not to. Asn2wrs generated dissectors may be added multiple times otherwise.
593 if (add_proto_name
) {
594 pinfo
->curr_layer_num
++;
595 wmem_list_append(pinfo
->layers
, GINT_TO_POINTER(proto_get_id(handle
->protocol
)));
599 if (pinfo
->flags
.in_error_pkt
) {
600 ret
= call_dissector_work_error(handle
, tvb
, pinfo
, tree
, data
);
603 * Just call the subdissector.
605 ret
= call_dissector_through_handle(handle
, tvb
, pinfo
, tree
, data
);
609 * That dissector didn't accept the packet, so
610 * remove its protocol's name from the list
613 while (wmem_list_count(pinfo
->layers
) > saved_layers_len
) {
614 wmem_list_remove_frame(pinfo
->layers
, wmem_list_tail(pinfo
->layers
));
617 pinfo
->current_proto
= saved_proto
;
618 pinfo
->can_desegment
= saved_can_desegment
;
624 call_dissector_work_error(dissector_handle_t handle
, tvbuff_t
*tvb
,
625 packet_info
*pinfo_arg
, proto_tree
*tree
, void *data
)
627 packet_info
*pinfo
= pinfo_arg
;
628 const char *saved_proto
;
629 guint16 saved_can_desegment
;
630 volatile int ret
= 0;
631 gboolean save_writable
;
634 address save_net_src
;
635 address save_net_dst
;
640 * This isn't a packet being transported inside
641 * the protocol whose dissector is calling us,
642 * it's a copy of a packet that caused an error
643 * in some protocol included in a packet that
644 * reports the error (e.g., an ICMP Unreachable
649 * Save the current state of the writability of
650 * the columns, and restore them after the
651 * dissector returns, so that the columns
652 * don't reflect the packet that got the error,
653 * they reflect the packet that reported the
656 saved_proto
= pinfo
->current_proto
;
657 saved_can_desegment
= pinfo
->can_desegment
;
659 save_writable
= col_get_writable(pinfo
->cinfo
);
660 col_set_writable(pinfo
->cinfo
, FALSE
);
661 save_dl_src
= pinfo
->dl_src
;
662 save_dl_dst
= pinfo
->dl_dst
;
663 save_net_src
= pinfo
->net_src
;
664 save_net_dst
= pinfo
->net_dst
;
665 save_src
= pinfo
->src
;
666 save_dst
= pinfo
->dst
;
668 /* Dissect the contained packet. */
670 ret
= call_dissector_through_handle(handle
, tvb
,pinfo
, tree
, data
);
674 * Restore the column writability and addresses.
676 col_set_writable(pinfo
->cinfo
, save_writable
);
677 pinfo
->dl_src
= save_dl_src
;
678 pinfo
->dl_dst
= save_dl_dst
;
679 pinfo
->net_src
= save_net_src
;
680 pinfo
->net_dst
= save_net_dst
;
681 pinfo
->src
= save_src
;
682 pinfo
->dst
= save_dst
;
685 * Restore the current protocol, so any
686 * "Short Frame" indication reflects that
687 * protocol, not the protocol for the
688 * packet that got the error.
690 pinfo
->current_proto
= saved_proto
;
693 * Restore the desegmentability state.
695 pinfo
->can_desegment
= saved_can_desegment
;
698 * Rethrow the exception, so this will be
699 * reported as a short frame.
703 CATCH2(FragmentBoundsError
, ReportedBoundsError
) {
705 * "ret" wasn't set because an exception was thrown
706 * before "call_dissector_through_handle()" returned.
707 * As it called something, at least one dissector
708 * accepted the packet, and, as an exception was
709 * thrown, not only was all the tvbuff dissected,
710 * a dissector tried dissecting past the end of
711 * the data in some tvbuff, so we'll assume that
712 * the entire tvbuff was dissected.
714 ret
= tvb_length(tvb
);
718 col_set_writable(pinfo
->cinfo
, save_writable
);
719 pinfo
->dl_src
= save_dl_src
;
720 pinfo
->dl_dst
= save_dl_dst
;
721 pinfo
->net_src
= save_net_src
;
722 pinfo
->net_dst
= save_net_dst
;
723 pinfo
->src
= save_src
;
724 pinfo
->dst
= save_dst
;
725 pinfo
->want_pdu_tracking
= 0;
730 * An entry in the hash table portion of a dissector table.
733 dissector_handle_t initial
;
734 dissector_handle_t current
;
737 /* Finds a dissector table by table name. */
739 find_dissector_table(const char *name
)
741 return (dissector_table_t
)g_hash_table_lookup( dissector_tables
, name
);
744 /* Find an entry in a uint dissector table. */
745 static dtbl_entry_t
*
746 find_uint_dtbl_entry(dissector_table_t sub_dissectors
, const guint32 pattern
)
748 switch (sub_dissectors
->type
) {
755 * You can do a uint lookup in these tables.
761 * But you can't do a uint lookup in any other types
764 g_assert_not_reached();
770 return (dtbl_entry_t
*)g_hash_table_lookup(sub_dissectors
->hash_table
,
771 GUINT_TO_POINTER(pattern
));
776 dissector_add_uint_sanity_check(const char *name
, guint32 pattern
, dissector_handle_t handle
, dissector_table_t sub_dissectors
)
778 dtbl_entry_t
*dtbl_entry
;
781 g_warning("%s: %s registering using a pattern of 0",
782 name
, proto_get_protocol_filter_name(proto_get_id(handle
->protocol
)));
785 dtbl_entry
= g_hash_table_lookup(sub_dissectors
->hash_table
, GUINT_TO_POINTER(pattern
));
786 if (dtbl_entry
!= NULL
) {
787 g_warning("%s: %s registering using pattern %d already registered by %s",
788 name
, proto_get_protocol_filter_name(proto_get_id(handle
->protocol
)),
789 pattern
, proto_get_protocol_filter_name(proto_get_id(dtbl_entry
->initial
->protocol
)));
794 /* Add an entry to a uint dissector table. */
796 dissector_add_uint(const char *name
, const guint32 pattern
, dissector_handle_t handle
)
798 dissector_table_t sub_dissectors
;
799 dtbl_entry_t
*dtbl_entry
;
801 sub_dissectors
= find_dissector_table(name
);
804 * Make sure the dissector table exists.
806 if (sub_dissectors
== NULL
) {
807 fprintf(stderr
, "OOPS: dissector table \"%s\" doesn't exist\n",
809 fprintf(stderr
, "Protocol being registered is \"%s\"\n",
810 proto_get_protocol_long_name(handle
->protocol
));
811 if (getenv("WIRESHARK_ABORT_ON_DISSECTOR_BUG") != NULL
)
817 g_assert(handle
!=NULL
);
818 switch (sub_dissectors
->type
) {
825 * You can do a uint lookup in these tables.
831 * But you can't do a uint lookup in any other types
834 g_assert_not_reached();
838 dissector_add_uint_sanity_check(name
, pattern
, handle
, sub_dissectors
);
841 dtbl_entry
= (dtbl_entry_t
*)g_malloc(sizeof (dtbl_entry_t
));
842 dtbl_entry
->current
= handle
;
843 dtbl_entry
->initial
= dtbl_entry
->current
;
845 /* do the table insertion */
846 g_hash_table_insert( sub_dissectors
->hash_table
,
847 GUINT_TO_POINTER( pattern
), (gpointer
)dtbl_entry
);
850 * Now add it to the list of handles that could be used with this
851 * table, because it *is* being used with this table.
853 dissector_add_handle(name
, handle
);
858 void dissector_add_uint_range(const char *abbrev
, range_t
*range
,
859 dissector_handle_t handle
)
864 for (i
= 0; i
< range
->nranges
; i
++) {
865 for (j
= range
->ranges
[i
].low
; j
<= range
->ranges
[i
].high
; j
++)
866 dissector_add_uint(abbrev
, j
, handle
);
871 /* Delete the entry for a dissector in a uint dissector table
872 with a particular pattern. */
874 /* NOTE: this doesn't use the dissector call variable. It is included to */
875 /* be consistant with the dissector_add_uint and more importantly to be used */
876 /* if the technique of adding a temporary dissector is implemented. */
877 /* If temporary dissectors are deleted, then the original dissector must */
880 dissector_delete_uint(const char *name
, const guint32 pattern
,
881 dissector_handle_t handle _U_
)
883 dissector_table_t sub_dissectors
= find_dissector_table( name
);
884 dtbl_entry_t
*dtbl_entry
;
887 g_assert( sub_dissectors
);
892 dtbl_entry
= find_uint_dtbl_entry(sub_dissectors
, pattern
);
894 if (dtbl_entry
!= NULL
) {
898 g_hash_table_remove(sub_dissectors
->hash_table
,
899 GUINT_TO_POINTER(pattern
));
903 void dissector_delete_uint_range(const char *abbrev
, range_t
*range
,
904 dissector_handle_t handle
)
909 for (i
= 0; i
< range
->nranges
; i
++) {
910 for (j
= range
->ranges
[i
].low
; j
<= range
->ranges
[i
].high
; j
++)
911 dissector_delete_uint(abbrev
, j
, handle
);
917 dissector_delete_all_check (gpointer key _U_
, gpointer value
, gpointer user_data
)
919 dtbl_entry_t
*dtbl_entry
= (dtbl_entry_t
*) value
;
920 dissector_handle_t handle
= (dissector_handle_t
) user_data
;
922 return (proto_get_id (dtbl_entry
->current
->protocol
) == proto_get_id (handle
->protocol
));
925 /* Delete all entries from a dissector table. */
926 void dissector_delete_all(const char *name
, dissector_handle_t handle
)
928 dissector_table_t sub_dissectors
= find_dissector_table(name
);
929 g_assert (sub_dissectors
);
931 g_hash_table_foreach_remove (sub_dissectors
->hash_table
, dissector_delete_all_check
, handle
);
934 /* Change the entry for a dissector in a uint dissector table
935 with a particular pattern to use a new dissector handle. */
937 dissector_change_uint(const char *name
, const guint32 pattern
, dissector_handle_t handle
)
939 dissector_table_t sub_dissectors
= find_dissector_table( name
);
940 dtbl_entry_t
*dtbl_entry
;
943 g_assert( sub_dissectors
);
946 * See if the entry already exists. If so, reuse it.
948 dtbl_entry
= find_uint_dtbl_entry(sub_dissectors
, pattern
);
949 if (dtbl_entry
!= NULL
) {
950 dtbl_entry
->current
= handle
;
955 * Don't create an entry if there is no dissector handle - I.E. the
956 * user said not to decode something that wasn't being decoded
957 * in the first place.
962 dtbl_entry
= (dtbl_entry_t
*)g_malloc(sizeof (dtbl_entry_t
));
963 dtbl_entry
->initial
= NULL
;
964 dtbl_entry
->current
= handle
;
966 /* do the table insertion */
967 g_hash_table_insert( sub_dissectors
->hash_table
,
968 GUINT_TO_POINTER( pattern
), (gpointer
)dtbl_entry
);
971 /* Reset an entry in a uint dissector table to its initial value. */
973 dissector_reset_uint(const char *name
, const guint32 pattern
)
975 dissector_table_t sub_dissectors
= find_dissector_table( name
);
976 dtbl_entry_t
*dtbl_entry
;
979 g_assert( sub_dissectors
);
984 dtbl_entry
= find_uint_dtbl_entry(sub_dissectors
, pattern
);
986 if (dtbl_entry
== NULL
)
990 * Found - is there an initial value?
992 if (dtbl_entry
->initial
!= NULL
) {
993 dtbl_entry
->current
= dtbl_entry
->initial
;
995 g_hash_table_remove(sub_dissectors
->hash_table
,
996 GUINT_TO_POINTER(pattern
));
1000 /* Look for a given value in a given uint dissector table and, if found,
1001 call the dissector with the arguments supplied, and return TRUE,
1002 otherwise return FALSE. */
1005 dissector_try_uint_new(dissector_table_t sub_dissectors
, const guint32 uint_val
,
1006 tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
,
1007 const gboolean add_proto_name
, void *data
)
1009 dtbl_entry_t
*dtbl_entry
;
1010 struct dissector_handle
*handle
;
1011 guint32 saved_match_uint
;
1014 dtbl_entry
= find_uint_dtbl_entry(sub_dissectors
, uint_val
);
1015 if (dtbl_entry
!= NULL
) {
1017 * Is there currently a dissector handle for this entry?
1019 handle
= dtbl_entry
->current
;
1020 if (handle
== NULL
) {
1022 * No - pretend this dissector didn't exist,
1023 * so that other dissectors might have a chance
1024 * to dissect this packet.
1030 * Save the current value of "pinfo->match_uint",
1031 * set it to the uint_val that matched, call the
1032 * dissector, and restore "pinfo->match_uint".
1034 saved_match_uint
= pinfo
->match_uint
;
1035 pinfo
->match_uint
= uint_val
;
1036 ret
= call_dissector_work(handle
, tvb
, pinfo
, tree
, add_proto_name
, data
);
1037 pinfo
->match_uint
= saved_match_uint
;
1040 * If a new-style dissector returned 0, it means that
1041 * it didn't think this tvbuff represented a packet for
1042 * its protocol, and didn't dissect anything.
1044 * Old-style dissectors can't reject the packet.
1046 * 0 is also returned if the protocol wasn't enabled.
1048 * If the packet was rejected, we return FALSE, so that
1049 * other dissectors might have a chance to dissect this
1050 * packet, otherwise we return TRUE.
1058 dissector_try_uint(dissector_table_t sub_dissectors
, const guint32 uint_val
,
1059 tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
)
1062 return dissector_try_uint_new(sub_dissectors
, uint_val
, tvb
, pinfo
, tree
, TRUE
, NULL
);
1065 /* Look for a given value in a given uint dissector table and, if found,
1066 return the dissector handle for that value. */
1068 dissector_get_uint_handle(dissector_table_t
const sub_dissectors
, const guint32 uint_val
)
1070 dtbl_entry_t
*dtbl_entry
;
1072 dtbl_entry
= find_uint_dtbl_entry(sub_dissectors
, uint_val
);
1073 if (dtbl_entry
!= NULL
)
1074 return dtbl_entry
->current
;
1079 /* Find an entry in a string dissector table. */
1080 static dtbl_entry_t
*
1081 find_string_dtbl_entry(dissector_table_t
const sub_dissectors
, const gchar
*pattern
)
1083 switch (sub_dissectors
->type
) {
1088 * You can do a string lookup in these tables.
1094 * But you can't do a string lookup in any other types
1097 g_assert_not_reached();
1103 return (dtbl_entry_t
*)g_hash_table_lookup(sub_dissectors
->hash_table
, pattern
);
1106 /* Add an entry to a string dissector table. */
1108 dissector_add_string(const char *name
, const gchar
*pattern
,
1109 dissector_handle_t handle
)
1111 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1112 dtbl_entry_t
*dtbl_entry
;
1115 * Make sure the dissector table exists.
1117 if (sub_dissectors
== NULL
) {
1118 fprintf(stderr
, "OOPS: dissector table \"%s\" doesn't exist\n",
1120 fprintf(stderr
, "Protocol being registered is \"%s\"\n",
1121 proto_get_protocol_long_name(handle
->protocol
));
1122 if (getenv("WIRESHARK_ABORT_ON_DISSECTOR_BUG") != NULL
)
1128 g_assert(handle
!=NULL
);
1129 switch (sub_dissectors
->type
) {
1134 * You can do a string lookup in these tables.
1140 * But you can't do a string lookup in any other types
1143 g_assert_not_reached();
1146 dtbl_entry
= (dtbl_entry_t
*)g_malloc(sizeof (dtbl_entry_t
));
1147 dtbl_entry
->current
= handle
;
1148 dtbl_entry
->initial
= dtbl_entry
->current
;
1150 /* do the table insertion */
1151 g_hash_table_insert( sub_dissectors
->hash_table
, (gpointer
)g_strdup(pattern
),
1152 (gpointer
)dtbl_entry
);
1155 * Now add it to the list of handles that could be used with this
1156 * table, because it *is* being used with this table.
1158 dissector_add_handle(name
, handle
);
1161 /* Delete the entry for a dissector in a string dissector table
1162 with a particular pattern. */
1164 /* NOTE: this doesn't use the dissector call variable. It is included to */
1165 /* be consistant with the dissector_add_string and more importantly to */
1166 /* be used if the technique of adding a temporary dissector is */
1168 /* If temporary dissectors are deleted, then the original dissector must */
1171 dissector_delete_string(const char *name
, const gchar
*pattern
,
1172 dissector_handle_t handle _U_
)
1174 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1175 dtbl_entry_t
*dtbl_entry
;
1178 g_assert( sub_dissectors
);
1183 dtbl_entry
= find_string_dtbl_entry(sub_dissectors
, pattern
);
1185 if (dtbl_entry
!= NULL
) {
1187 * Found - remove it.
1189 g_hash_table_remove(sub_dissectors
->hash_table
, pattern
);
1193 /* Change the entry for a dissector in a string dissector table
1194 with a particular pattern to use a new dissector handle. */
1196 dissector_change_string(const char *name
, const gchar
*pattern
,
1197 dissector_handle_t handle
)
1199 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1200 dtbl_entry_t
*dtbl_entry
;
1203 g_assert( sub_dissectors
);
1206 * See if the entry already exists. If so, reuse it.
1208 dtbl_entry
= find_string_dtbl_entry(sub_dissectors
, pattern
);
1209 if (dtbl_entry
!= NULL
) {
1210 dtbl_entry
->current
= handle
;
1215 * Don't create an entry if there is no dissector handle - I.E. the
1216 * user said not to decode something that wasn't being decoded
1217 * in the first place.
1222 dtbl_entry
= (dtbl_entry_t
*)g_malloc(sizeof (dtbl_entry_t
));
1223 dtbl_entry
->initial
= NULL
;
1224 dtbl_entry
->current
= handle
;
1226 /* do the table insertion */
1227 g_hash_table_insert( sub_dissectors
->hash_table
, (gpointer
)g_strdup(pattern
),
1228 (gpointer
)dtbl_entry
);
1231 /* Reset an entry in a string sub-dissector table to its initial value. */
1233 dissector_reset_string(const char *name
, const gchar
*pattern
)
1235 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1236 dtbl_entry_t
*dtbl_entry
;
1239 g_assert( sub_dissectors
);
1244 dtbl_entry
= find_string_dtbl_entry(sub_dissectors
, pattern
);
1246 if (dtbl_entry
== NULL
)
1250 * Found - is there an initial value?
1252 if (dtbl_entry
->initial
!= NULL
) {
1253 dtbl_entry
->current
= dtbl_entry
->initial
;
1255 g_hash_table_remove(sub_dissectors
->hash_table
, pattern
);
1259 /* Look for a given string in a given dissector table and, if found, call
1260 the dissector with the arguments supplied, and return TRUE, otherwise
1263 dissector_try_string(dissector_table_t sub_dissectors
, const gchar
*string
,
1264 tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
, void *data
)
1266 dtbl_entry_t
*dtbl_entry
;
1267 struct dissector_handle
*handle
;
1269 const gchar
*saved_match_string
;
1271 /* XXX ASSERT instead ? */
1272 if (!string
) return FALSE
;
1273 dtbl_entry
= find_string_dtbl_entry(sub_dissectors
, string
);
1274 if (dtbl_entry
!= NULL
) {
1276 * Is there currently a dissector handle for this entry?
1278 handle
= dtbl_entry
->current
;
1279 if (handle
== NULL
) {
1281 * No - pretend this dissector didn't exist,
1282 * so that other dissectors might have a chance
1283 * to dissect this packet.
1289 * Save the current value of "pinfo->match_string",
1290 * set it to the string that matched, call the
1291 * dissector, and restore "pinfo->match_string".
1293 saved_match_string
= pinfo
->match_string
;
1294 pinfo
->match_string
= string
;
1295 ret
= call_dissector_work(handle
, tvb
, pinfo
, tree
, TRUE
, data
);
1296 pinfo
->match_string
= saved_match_string
;
1299 * If a new-style dissector returned 0, it means that
1300 * it didn't think this tvbuff represented a packet for
1301 * its protocol, and didn't dissect anything.
1303 * Old-style dissectors can't reject the packet.
1305 * 0 is also returned if the protocol wasn't enabled.
1307 * If the packet was rejected, we return FALSE, so that
1308 * other dissectors might have a chance to dissect this
1309 * packet, otherwise we return TRUE.
1316 /* Look for a given value in a given string dissector table and, if found,
1317 return the dissector handle for that value. */
1319 dissector_get_string_handle(dissector_table_t sub_dissectors
,
1320 const gchar
*string
)
1322 dtbl_entry_t
*dtbl_entry
;
1324 dtbl_entry
= find_string_dtbl_entry(sub_dissectors
, string
);
1325 if (dtbl_entry
!= NULL
)
1326 return dtbl_entry
->current
;
1332 dtbl_entry_get_handle (dtbl_entry_t
*dtbl_entry
)
1334 return dtbl_entry
->current
;
1338 dissector_compare_filter_name(gconstpointer dissector_a
, gconstpointer dissector_b
)
1340 const dissector_handle_t a
= (const dissector_handle_t
)dissector_a
;
1341 const dissector_handle_t b
= (const dissector_handle_t
)dissector_b
;
1342 const char *a_name
, *b_name
;
1345 if (a
->protocol
== NULL
)
1348 a_name
= proto_get_protocol_filter_name(proto_get_id(a
->protocol
));
1350 if (b
->protocol
== NULL
)
1353 b_name
= proto_get_protocol_filter_name(proto_get_id(b
->protocol
));
1355 ret
= strcmp(a_name
, b_name
);
1359 /* Add a handle to the list of handles that *could* be used with this
1360 table. That list is used by code in the UI. */
1362 dissector_add_handle(const char *name
, dissector_handle_t handle
)
1364 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1368 * Make sure the dissector table exists.
1370 if (sub_dissectors
== NULL
) {
1371 fprintf(stderr
, "OOPS: dissector table \"%s\" doesn't exist\n",
1373 fprintf(stderr
, "Protocol being registered is \"%s\"\n",
1374 proto_get_protocol_long_name(handle
->protocol
));
1375 if (getenv("WIRESHARK_ABORT_ON_DISSECTOR_BUG") != NULL
)
1380 /* Is it already in this list? */
1381 entry
= g_slist_find(sub_dissectors
->dissector_handles
, (gpointer
)handle
);
1382 if (entry
!= NULL
) {
1384 * Yes - don't insert it again.
1389 /* Add it to the list. */
1390 sub_dissectors
->dissector_handles
=
1391 g_slist_insert_sorted(sub_dissectors
->dissector_handles
, (gpointer
)handle
, (GCompareFunc
)dissector_compare_filter_name
);
1395 dtbl_entry_get_initial_handle (dtbl_entry_t
*dtbl_entry
)
1397 return dtbl_entry
->initial
;
1400 /**************************************************/
1402 /* Routines to walk dissector tables */
1404 /**************************************************/
1406 typedef struct dissector_foreach_info
{
1407 gpointer caller_data
;
1408 DATFunc caller_func
;
1410 const gchar
*table_name
;
1411 ftenum_t selector_type
;
1412 } dissector_foreach_info_t
;
1415 * Called for each entry in a dissector table.
1418 dissector_table_foreach_func (gpointer key
, gpointer value
, gpointer user_data
)
1420 dissector_foreach_info_t
*info
;
1421 dtbl_entry_t
*dtbl_entry
;
1424 g_assert(user_data
);
1426 dtbl_entry
= (dtbl_entry_t
*)value
;
1427 if (dtbl_entry
->current
== NULL
||
1428 dtbl_entry
->current
->protocol
== NULL
) {
1430 * Either there is no dissector for this entry, or
1431 * the dissector doesn't have a protocol associated
1434 * XXX - should the latter check be done?
1439 info
= (dissector_foreach_info_t
*)user_data
;
1440 info
->caller_func(info
->table_name
, info
->selector_type
, key
, value
,
1445 * Called for each entry in the table of all dissector tables.
1448 dissector_all_tables_foreach_func (gpointer key
, gpointer value
, gpointer user_data
)
1450 dissector_table_t sub_dissectors
;
1451 dissector_foreach_info_t
*info
;
1454 g_assert(user_data
);
1456 sub_dissectors
= (dissector_table_t
)value
;
1457 info
= (dissector_foreach_info_t
*)user_data
;
1458 info
->table_name
= (gchar
*) key
;
1459 info
->selector_type
= get_dissector_table_selector_type(info
->table_name
);
1460 g_hash_table_foreach(sub_dissectors
->hash_table
, info
->next_func
, info
);
1464 * Walk all dissector tables calling a user supplied function on each
1468 dissector_all_tables_foreach (DATFunc func
,
1471 dissector_foreach_info_t info
;
1473 info
.caller_data
= user_data
;
1474 info
.caller_func
= func
;
1475 info
.next_func
= dissector_table_foreach_func
;
1476 g_hash_table_foreach(dissector_tables
, dissector_all_tables_foreach_func
, &info
);
1480 * Walk one dissector table's hash table calling a user supplied function
1484 dissector_table_foreach (const char *name
,
1488 dissector_foreach_info_t info
;
1489 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1491 info
.table_name
= name
;
1492 info
.selector_type
= sub_dissectors
->type
;
1493 info
.caller_func
= func
;
1494 info
.caller_data
= user_data
;
1495 g_hash_table_foreach(sub_dissectors
->hash_table
, dissector_table_foreach_func
, &info
);
1499 * Walk one dissector table's list of handles calling a user supplied
1500 * function on each entry.
1503 dissector_table_foreach_handle(const char *name
,
1504 DATFunc_handle func
,
1507 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1510 for (tmp
= sub_dissectors
->dissector_handles
; tmp
!= NULL
;
1511 tmp
= g_slist_next(tmp
))
1512 func(name
, tmp
->data
, user_data
);
1516 * Called for each entry in a dissector table.
1519 dissector_table_foreach_changed_func (gpointer key
, gpointer value
, gpointer user_data
)
1521 dtbl_entry_t
*dtbl_entry
;
1522 dissector_foreach_info_t
*info
;
1525 g_assert(user_data
);
1527 dtbl_entry
= (dtbl_entry_t
*)value
;
1528 if (dtbl_entry
->initial
== dtbl_entry
->current
) {
1530 * Entry hasn't changed - don't call the function.
1535 info
= (dissector_foreach_info_t
*)user_data
;
1536 info
->caller_func(info
->table_name
, info
->selector_type
, key
, value
,
1541 * Walk all dissector tables calling a user supplied function only on
1542 * any entry that has been changed from its original state.
1545 dissector_all_tables_foreach_changed (DATFunc func
,
1548 dissector_foreach_info_t info
;
1550 info
.caller_data
= user_data
;
1551 info
.caller_func
= func
;
1552 info
.next_func
= dissector_table_foreach_changed_func
;
1553 g_hash_table_foreach(dissector_tables
, dissector_all_tables_foreach_func
, &info
);
1557 * Walk one dissector table calling a user supplied function only on
1558 * any entry that has been changed from its original state.
1561 dissector_table_foreach_changed (const char *name
,
1565 dissector_foreach_info_t info
;
1566 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1568 info
.table_name
= name
;
1569 info
.selector_type
= sub_dissectors
->type
;
1570 info
.caller_func
= func
;
1571 info
.caller_data
= user_data
;
1572 g_hash_table_foreach(sub_dissectors
->hash_table
,
1573 dissector_table_foreach_changed_func
, &info
);
1576 typedef struct dissector_foreach_table_info
{
1577 gpointer caller_data
;
1578 DATFunc_table caller_func
;
1579 } dissector_foreach_table_info_t
;
1582 * Called for each entry in the table of all dissector tables.
1585 dissector_all_tables_foreach_table_func (gpointer key
, const gpointer value
, const gpointer user_data
)
1587 dissector_table_t table
;
1588 dissector_foreach_table_info_t
*info
;
1590 table
= (dissector_table_t
)value
;
1591 info
= (dissector_foreach_table_info_t
*)user_data
;
1592 (*info
->caller_func
)((gchar
*)key
, table
->ui_name
, info
->caller_data
);
1596 * Called for each key in the table of all dissector tables.
1599 dissector_all_tables_foreach_list_func (gpointer key
, gpointer user_data
)
1601 dissector_table_t table
;
1602 dissector_foreach_table_info_t
*info
;
1604 table
= (dissector_table_t
)g_hash_table_lookup( dissector_tables
, key
);
1605 info
= (dissector_foreach_table_info_t
*)user_data
;
1606 (*info
->caller_func
)((gchar
*)key
, table
->ui_name
, info
->caller_data
);
1610 * Walk all dissector tables calling a user supplied function on each
1614 dissector_all_tables_foreach_table (DATFunc_table func
,
1616 GCompareFunc compare_key_func
)
1618 dissector_foreach_table_info_t info
;
1621 info
.caller_data
= user_data
;
1622 info
.caller_func
= func
;
1623 if (compare_key_func
!= NULL
)
1625 list
= g_hash_table_get_keys(dissector_tables
);
1626 list
= g_list_sort(list
, compare_key_func
);
1627 g_list_foreach(list
, dissector_all_tables_foreach_list_func
, &info
);
1632 g_hash_table_foreach(dissector_tables
, dissector_all_tables_foreach_table_func
, &info
);
1637 register_dissector_table(const char *name
, const char *ui_name
, const ftenum_t type
,
1640 dissector_table_t sub_dissectors
;
1642 /* Make sure the registration is unique */
1643 if(g_hash_table_lookup( dissector_tables
, name
)) {
1644 g_error("The filter name %s (%s) is already registered - do you use a buggy plugin?", name
, ui_name
);
1647 /* Create and register the dissector table for this name; returns */
1648 /* a pointer to the dissector table. */
1649 sub_dissectors
= g_slice_new(struct dissector_table
);
1657 * XXX - there's no "g_uint_hash()" or "g_uint_equal()",
1658 * so we use "g_direct_hash()" and "g_direct_equal()".
1660 sub_dissectors
->hash_table
= g_hash_table_new_full( g_direct_hash
,
1668 sub_dissectors
->hash_table
= g_hash_table_new_full( g_str_hash
,
1675 g_assert_not_reached();
1677 sub_dissectors
->dissector_handles
= NULL
;
1678 sub_dissectors
->ui_name
= ui_name
;
1679 sub_dissectors
->type
= type
;
1680 sub_dissectors
->base
= base
;
1681 g_hash_table_insert( dissector_tables
, (gpointer
)name
, (gpointer
) sub_dissectors
);
1682 return sub_dissectors
;
1686 get_dissector_table_ui_name(const char *name
)
1688 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1690 return sub_dissectors
->ui_name
;
1694 get_dissector_table_selector_type(const char *name
)
1696 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1698 return sub_dissectors
->type
;
1702 get_dissector_table_base(const char *name
)
1704 dissector_table_t sub_dissectors
= find_dissector_table( name
);
1706 return sub_dissectors
->base
;
1709 /* Finds a heuristic dissector table by table name. */
1710 static heur_dissector_list_t
*
1711 find_heur_dissector_list(const char *name
)
1713 return (heur_dissector_list_t
*)g_hash_table_lookup(heur_dissector_lists
, name
);
1717 heur_dissector_add(const char *name
, heur_dissector_t dissector
, const int proto
)
1719 heur_dissector_list_t
*sub_dissectors
= find_heur_dissector_list(name
);
1720 const char *proto_name
;
1721 heur_dtbl_entry_t
*hdtbl_entry
;
1724 * Make sure the dissector table exists.
1726 if (sub_dissectors
== NULL
) {
1727 fprintf(stderr
, "OOPS: dissector table \"%s\" doesn't exist\n",
1729 proto_name
= proto_get_protocol_name(proto
);
1730 if (proto_name
!= NULL
) {
1731 fprintf(stderr
, "Protocol being registered is \"%s\"\n",
1734 if (getenv("WIRESHARK_ABORT_ON_DISSECTOR_BUG") != NULL
)
1739 /* XXX: Should verify that sub-dissector is not already in the list ? */
1741 hdtbl_entry
= g_slice_new(heur_dtbl_entry_t
);
1742 hdtbl_entry
->dissector
= dissector
;
1743 hdtbl_entry
->protocol
= find_protocol_by_id(proto
);
1744 hdtbl_entry
->enabled
= TRUE
;
1746 /* do the table insertion */
1747 *sub_dissectors
= g_slist_prepend(*sub_dissectors
, (gpointer
)hdtbl_entry
);
1753 find_matching_heur_dissector( gconstpointer a
, gconstpointer b
) {
1754 const heur_dtbl_entry_t
*hdtbl_entry_a
= (const heur_dtbl_entry_t
*) a
;
1755 const heur_dtbl_entry_t
*hdtbl_entry_b
= (const heur_dtbl_entry_t
*) b
;
1757 return (hdtbl_entry_a
->dissector
== hdtbl_entry_b
->dissector
) &&
1758 (hdtbl_entry_a
->protocol
== hdtbl_entry_b
->protocol
) ? 0 : 1;
1762 heur_dissector_delete(const char *name
, heur_dissector_t dissector
, const int proto
) {
1763 heur_dissector_list_t
*sub_dissectors
= find_heur_dissector_list(name
);
1764 heur_dtbl_entry_t hdtbl_entry
;
1765 GSList
*found_entry
;
1768 g_assert(sub_dissectors
!= NULL
);
1770 hdtbl_entry
.dissector
= dissector
;
1772 hdtbl_entry
.protocol
= find_protocol_by_id(proto
);
1774 found_entry
= g_slist_find_custom(*sub_dissectors
, (gpointer
) &hdtbl_entry
, find_matching_heur_dissector
);
1777 g_slice_free(heur_dtbl_entry_t
, found_entry
->data
);
1778 *sub_dissectors
= g_slist_delete_link(*sub_dissectors
, found_entry
);
1783 heur_dissector_set_enabled(const char *name
, heur_dissector_t dissector
, const int proto
, const gboolean enabled
) {
1784 heur_dissector_list_t
*sub_dissectors
= find_heur_dissector_list(name
);
1785 GSList
*found_entry
;
1786 heur_dtbl_entry_t hdtbl_entry
;
1789 g_assert(sub_dissectors
!= NULL
);
1791 hdtbl_entry
.dissector
= dissector
;
1793 hdtbl_entry
.protocol
= find_protocol_by_id(proto
);
1795 found_entry
= g_slist_find_custom(*sub_dissectors
, (gpointer
) &hdtbl_entry
, find_matching_heur_dissector
);
1798 heur_dtbl_entry_t
*hdtbl_entry_p
;
1799 hdtbl_entry_p
= (heur_dtbl_entry_t
*)found_entry
->data
;
1800 hdtbl_entry_p
->enabled
= enabled
;
1805 dissector_try_heuristic(heur_dissector_list_t sub_dissectors
, tvbuff_t
*tvb
,
1806 packet_info
*pinfo
, proto_tree
*tree
, void *data
)
1809 const char *saved_proto
;
1811 heur_dtbl_entry_t
*hdtbl_entry
;
1812 guint16 saved_can_desegment
;
1813 guint saved_layers_len
= 0;
1815 /* can_desegment is set to 2 by anyone which offers this api/service.
1816 then everytime a subdissector is called it is decremented by one.
1817 thus only the subdissector immediately ontop of whoever offers this
1819 We save the current value of "can_desegment" for the
1820 benefit of TCP proxying dissectors such as SOCKS, so they
1821 can restore it and allow the dissectors they call to use
1822 the desegmentation service.
1824 saved_can_desegment
= pinfo
->can_desegment
;
1825 pinfo
->saved_can_desegment
= saved_can_desegment
;
1826 pinfo
->can_desegment
= saved_can_desegment
-(saved_can_desegment
>0);
1829 saved_proto
= pinfo
->current_proto
;
1831 saved_layers_len
= wmem_list_count(pinfo
->layers
);
1833 for (entry
= sub_dissectors
; entry
!= NULL
; entry
= g_slist_next(entry
)) {
1834 /* XXX - why set this now and above? */
1835 pinfo
->can_desegment
= saved_can_desegment
-(saved_can_desegment
>0);
1836 hdtbl_entry
= (heur_dtbl_entry_t
*)entry
->data
;
1838 if (hdtbl_entry
->protocol
!= NULL
&&
1839 (!proto_is_protocol_enabled(hdtbl_entry
->protocol
)||(hdtbl_entry
->enabled
==FALSE
))) {
1841 * No - don't try this dissector.
1846 if (hdtbl_entry
->protocol
!= NULL
) {
1847 pinfo
->current_proto
=
1848 proto_get_protocol_short_name(hdtbl_entry
->protocol
);
1851 * Add the protocol name to the layers; we'll remove it
1852 * if the dissector fails.
1854 wmem_list_append(pinfo
->layers
, GINT_TO_POINTER(proto_get_id(hdtbl_entry
->protocol
)));
1856 EP_CHECK_CANARY(("before calling heuristic dissector for protocol: %s",
1857 proto_get_protocol_filter_name(proto_get_id(hdtbl_entry
->protocol
))));
1858 if ((*hdtbl_entry
->dissector
)(tvb
, pinfo
, tree
, data
)) {
1859 EP_CHECK_CANARY(("after heuristic dissector for protocol: %s has accepted and dissected packet",
1860 proto_get_protocol_filter_name(proto_get_id(hdtbl_entry
->protocol
))));
1864 EP_CHECK_CANARY(("after heuristic dissector for protocol: %s has returned false",
1865 proto_get_protocol_filter_name(proto_get_id(hdtbl_entry
->protocol
))));
1868 * That dissector didn't accept the packet, so
1869 * remove its protocol's name from the list
1872 while (wmem_list_count(pinfo
->layers
) > saved_layers_len
) {
1873 wmem_list_remove_frame(pinfo
->layers
, wmem_list_tail(pinfo
->layers
));
1877 pinfo
->current_proto
= saved_proto
;
1878 pinfo
->can_desegment
=saved_can_desegment
;
1883 * Called for each entry in the table of all heuristic dissector tables.
1885 typedef struct heur_dissector_foreach_table_info
{
1886 gpointer caller_data
;
1887 DATFunc_heur_table caller_func
;
1888 } heur_dissector_foreach_table_info_t
;
1892 dissector_dump_heur_decodes_display(const gchar
*table_name
, const gpointer value
, const gpointer user_data _U_
)
1894 heur_dissector_list_t sub_dissectors
= *(heur_dissector_list_t
*)value
;
1896 heur_dtbl_entry_t
*hdtbl_entry
;
1898 for (entry
= sub_dissectors
; entry
!= NULL
; entry
= g_slist_next(entry
)) {
1899 hdtbl_entry
= (heur_dtbl_entry_t
*)entry
->data
;
1900 if (hdtbl_entry
->protocol
!= NULL
) {
1901 printf("%s\t%s\t%c\n",
1903 proto_get_protocol_filter_name(proto_get_id(hdtbl_entry
->protocol
)),
1904 (proto_is_protocol_enabled(hdtbl_entry
->protocol
) && hdtbl_entry
->enabled
) ? 'T' : 'F');
1911 dissector_all_heur_tables_foreach_table_func (gpointer key
, const gpointer value
, const gpointer user_data
)
1913 heur_dissector_foreach_table_info_t
*info
;
1915 info
= (heur_dissector_foreach_table_info_t
*)user_data
;
1916 (*info
->caller_func
)((gchar
*)key
, value
, info
->caller_data
);
1920 * Walk all heuristic dissector tables calling a user supplied function on each
1924 dissector_all_heur_tables_foreach_table (DATFunc_heur_table func
,
1927 heur_dissector_foreach_table_info_t info
;
1929 info
.caller_data
= user_data
;
1930 info
.caller_func
= func
;
1931 g_hash_table_foreach(heur_dissector_lists
, dissector_all_heur_tables_foreach_table_func
, &info
);
1935 * For each heuristic dissector table, dump list of dissectors (filter_names) for that table
1938 dissector_dump_heur_decodes(void)
1940 dissector_all_heur_tables_foreach_table(dissector_dump_heur_decodes_display
, NULL
);
1945 register_heur_dissector_list(const char *name
, heur_dissector_list_t
*sub_dissectors
)
1947 /* Make sure the registration is unique */
1948 g_assert(g_hash_table_lookup(heur_dissector_lists
, name
) == NULL
);
1950 *sub_dissectors
= NULL
; /* initially empty */
1951 g_hash_table_insert(heur_dissector_lists
, (gpointer
)name
,
1952 (gpointer
) sub_dissectors
);
1956 * Register dissectors by name; used if one dissector always calls a
1957 * particular dissector, or if it bases the decision of which dissector
1958 * to call on something other than a numerical value or on "try a bunch
1959 * of dissectors until one likes the packet".
1962 /* Get the long name of the protocol for a dissector handle, if it has
1965 dissector_handle_get_long_name(const dissector_handle_t handle
)
1967 if (handle
== NULL
|| handle
->protocol
== NULL
) {
1970 return proto_get_protocol_long_name(handle
->protocol
);
1973 /* Get the short name of the protocol for a dissector handle, if it has
1976 dissector_handle_get_short_name(const dissector_handle_t handle
)
1978 if (handle
->protocol
== NULL
) {
1980 * No protocol (see, for example, the handle for
1981 * dissecting the set of protocols where the first
1982 * octet of the payload is an OSI network layer protocol
1987 return proto_get_protocol_short_name(handle
->protocol
);
1990 /* Get the index of the protocol for a dissector handle, if it has
1993 dissector_handle_get_protocol_index(const dissector_handle_t handle
)
1995 if (handle
->protocol
== NULL
) {
1997 * No protocol (see, for example, the handle for
1998 * dissecting the set of protocols where the first
1999 * octet of the payload is an OSI network layer protocol
2004 return proto_get_id(handle
->protocol
);
2007 /* Find a registered dissector by name. */
2009 find_dissector(const char *name
)
2011 return (dissector_handle_t
)g_hash_table_lookup(registered_dissectors
, name
);
2014 /* Get a dissector name from handle. */
2016 dissector_handle_get_dissector_name(const dissector_handle_t handle
)
2018 if (handle
== NULL
) {
2021 return handle
->name
;
2024 /* Create an anonymous handle for a dissector. */
2026 create_dissector_handle(dissector_t dissector
, const int proto
)
2028 struct dissector_handle
*handle
;
2030 handle
= wmem_new(wmem_epan_scope(), struct dissector_handle
);
2031 handle
->name
= NULL
;
2032 handle
->is_new
= FALSE
;
2033 handle
->dissector
.old
= dissector
;
2034 handle
->protocol
= find_protocol_by_id(proto
);
2040 new_create_dissector_handle(new_dissector_t dissector
, const int proto
)
2042 struct dissector_handle
*handle
;
2044 handle
= wmem_new(wmem_epan_scope(), struct dissector_handle
);
2045 handle
->name
= NULL
;
2046 handle
->is_new
= TRUE
;
2047 handle
->dissector
.new_d
= dissector
;
2048 handle
->protocol
= find_protocol_by_id(proto
);
2053 /* Register a dissector by name. */
2055 register_dissector(const char *name
, dissector_t dissector
, const int proto
)
2057 struct dissector_handle
*handle
;
2059 /* Make sure the registration is unique */
2060 g_assert(g_hash_table_lookup(registered_dissectors
, name
) == NULL
);
2062 handle
= wmem_new(wmem_epan_scope(), struct dissector_handle
);
2063 handle
->name
= name
;
2064 handle
->is_new
= FALSE
;
2065 handle
->dissector
.old
= dissector
;
2066 handle
->protocol
= find_protocol_by_id(proto
);
2068 g_hash_table_insert(registered_dissectors
, (gpointer
)name
,
2075 new_register_dissector(const char *name
, new_dissector_t dissector
, const int proto
)
2077 struct dissector_handle
*handle
;
2079 /* Make sure the registration is unique */
2080 g_assert(g_hash_table_lookup(registered_dissectors
, name
) == NULL
);
2082 handle
= wmem_new(wmem_epan_scope(), struct dissector_handle
);
2083 handle
->name
= name
;
2084 handle
->is_new
= TRUE
;
2085 handle
->dissector
.new_d
= dissector
;
2086 handle
->protocol
= find_protocol_by_id(proto
);
2088 g_hash_table_insert(registered_dissectors
, (gpointer
)name
,
2094 /* Call a dissector through a handle but if the dissector rejected it
2098 call_dissector_only(dissector_handle_t handle
, tvbuff_t
*tvb
,
2099 packet_info
*pinfo
, proto_tree
*tree
, void *data
)
2103 g_assert(handle
!= NULL
);
2104 ret
= call_dissector_work(handle
, tvb
, pinfo
, tree
, TRUE
, data
);
2108 /* Call a dissector through a handle and if this fails call the "data"
2112 call_dissector_with_data(dissector_handle_t handle
, tvbuff_t
*tvb
,
2113 packet_info
*pinfo
, proto_tree
*tree
, void *data
)
2117 ret
= call_dissector_only(handle
, tvb
, pinfo
, tree
, data
);
2120 * The protocol was disabled, or the dissector rejected
2121 * it. Just dissect this packet as data.
2123 g_assert(data_handle
->protocol
!= NULL
);
2124 call_dissector_work(data_handle
, tvb
, pinfo
, tree
, TRUE
, NULL
);
2125 return tvb_length(tvb
);
2131 call_dissector(dissector_handle_t handle
, tvbuff_t
*tvb
,
2132 packet_info
*pinfo
, proto_tree
*tree
)
2134 return call_dissector_with_data(handle
, tvb
, pinfo
, tree
, NULL
);
2138 * Dumps the "layer type"/"decode as" associations to stdout, similar
2139 * to the proto_registrar_dump_*() routines.
2141 * There is one record per line. The fields are tab-delimited.
2143 * Field 1 = layer type, e.g. "tcp.port"
2144 * Field 2 = selector in decimal
2145 * Field 3 = "decode as" name, e.g. "http"
2150 dissector_dump_decodes_display(const gchar
*table_name
,
2151 ftenum_t selector_type _U_
, const gpointer key
, const gpointer value
,
2152 gpointer user_data _U_
)
2154 guint32 selector
= (guint32
)(unsigned long) key
;
2155 dissector_table_t sub_dissectors
= find_dissector_table(table_name
);
2156 dtbl_entry_t
*dtbl_entry
;
2157 dissector_handle_t handle
;
2159 const gchar
*decode_as
;
2161 g_assert(sub_dissectors
);
2162 switch (sub_dissectors
->type
) {
2168 dtbl_entry
= (dtbl_entry_t
*)value
;
2169 g_assert(dtbl_entry
);
2171 handle
= dtbl_entry
->current
;
2174 proto_id
= dissector_handle_get_protocol_index(handle
);
2176 if (proto_id
!= -1) {
2177 decode_as
= proto_get_protocol_filter_name(proto_id
);
2178 g_assert(decode_as
!= NULL
);
2179 printf("%s\t%u\t%s\n", table_name
, selector
, decode_as
);
2189 dissector_dump_decodes(void)
2191 dissector_all_tables_foreach(dissector_dump_decodes_display
, NULL
);
2194 static GPtrArray
* post_dissectors
= NULL
;
2195 static guint num_of_postdissectors
= 0;
2198 register_postdissector(dissector_handle_t handle
)
2200 if (!post_dissectors
)
2201 post_dissectors
= g_ptr_array_new();
2203 g_ptr_array_add(post_dissectors
, handle
);
2204 num_of_postdissectors
++;
2208 have_postdissector(void)
2211 dissector_handle_t handle
;
2213 for(i
= 0; i
< num_of_postdissectors
; i
++) {
2214 handle
= (dissector_handle_t
) g_ptr_array_index(post_dissectors
,i
);
2216 if (handle
->protocol
!= NULL
2217 && proto_is_protocol_enabled(handle
->protocol
)) {
2218 /* We have at least one enabled postdissector */
2226 call_all_postdissectors(tvbuff_t
*tvb
, packet_info
*pinfo
, proto_tree
*tree
)
2230 for(i
= 0; i
< num_of_postdissectors
; i
++) {
2231 call_dissector_only((dissector_handle_t
) g_ptr_array_index(post_dissectors
,i
),
2232 tvb
,pinfo
,tree
, NULL
);
2237 * Editor modelines - http://www.wireshark.org/tools/modelines.html
2242 * indent-tabs-mode: t
2245 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
2246 * :indentSize=8:tabSize=8:noTabs=false: