Wireshark · Ethereal-dev: Re: [Ethereal-dev] information is display while filter, not otherwise

[Nina Pham <nina@xxxxxxxxxxx>]

Ulf Lamping wrote:

> Ethereal development <ethereal-dev@xxxxxxxxxxxx> schrieb am 01.04.05 01:35:18:
>  
>
> > Things are getting weird here. I wrote a plugin to capture one protocol. 
> > Some data I like to display on the information column wont be display 
> > when I did a filtering on a protocal name. Data disappears again when I 
> > clear the filter. Any idea will be appreciated.
> >
> >    
> That sounds really strange.
>
> In such cases, I tend to do a "rebuild all".
>
> Guesswork: Maybe you used the "tree" parameter the wrong way?
>
> Regards, ULFL
>
> ______________________________________________________________
> Verschicken Sie romantische, coole und witzige Bilder per SMS!
> Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>  
sorry to forgot the attachment

I thought I use tree parrameter in the wrong way. I created a tree then 
pass it in a function.  But then I don't know what  I suppose to do. I 
attached here part of the file in which I use tree parameter. In 
function dissect_KLATST,  I created a tree call reqrsp_tree and passed 
it to function parseData. Thanks

/* packet-TST.c
 *
 * Ethereal - Network traffic analyzer
 * By Gerald Combs <gerald@xxxxxxxxxxxx>
 * Copyright 1998 Gerald Combs
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

#ifdef HAVE_CONFIG_H
# include "config.h"
#endif

#include "plugins/plugin_api.h"
#include "moduleinfo.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <gmodule.h>
#include <glib.h>

#include "plugins/plugin_api_defs.h"

#include <epan/packet.h>

#include "mci.h"

#ifndef ENABLE_STATIC
G_MODULE_EXPORT const gchar version[] = VERSION; 
#endif

#define MCI_HEADER_SIZE     8 

#define SIGNATURE_OFFSET    0
#define TYPE_OFFSET         4
#define SIZE_OFFSET         6
#define DATA_OFFSET         8

/* IF PROTO exposes code to other dissectors, then it must be exported
   in a header file. If not, a header file is not needed at all. */

/* Initialize the protocol and registered fields */
static int proto_TST = -1;
static int hf_TST_request = -1;
static int hf_TST_name = -1;
static int hf_TST_size = -1;
static int hf_TST_type= -1;
static int hf_TST_response= -1;
static int hf_TST_offset= -1;

/* Initialize the subtree pointers */
static gint ett_TST= -1;
static gint ett_ReqRsp= -1;
static gint ett_Data = -1;

/* Initialze the mci request response table */
const MciReq mciReqItem[REQ_RSP_CNT] =
{
    /* Name and Type,                       reqDataType */
	NAME_CODE( TST_Request),                  COUNT,
	NAME_CODE( TST_Request_Test),             COUNT,
	NAME_CODE( TST_Request_Reset),            NONE,

    // There are more
    ...
};

/*********************************************************************************/

void tst_print_etc(packet_info *pinfo) 
/*
** This function print "..." in the information column
*/
{
    if (check_col(pinfo->cinfo, COL_INFO))
        col_append_str(pinfo->cinfo, COL_INFO, " ...");
}

/*********************************************************************************/

void parseData(tvbuff_t *tvb, packet_info *pinfo, 
                gboolean is_response, MciReq curMciReq, 
                guint16 dataSize, proto_tree *ReqRsp_tree)
/* 
** Parse data and print them in the info column 
*/
{
	proto_item *data_item;
	proto_tree *Data_tree;

    int             offset;
    REQ_DATA_TYPE   dataDisplay;
    guint16         dataType;
    int             i;
    int             j;
    guint16         halfWordOffset[4];

    // get packet length, this doesn't include tcp header
    if (tvb != NULL) {
        packetLength = tvb_length(tvb);
    } 

    dataDisplay = curMciReq.reqDataType;
    dataType = curMciReq.type;

    switch (dataDisplay) {
        case NONE:
            break;
        case COUNT:
                /*TST_Request
                TST_Request_Test
                TST_Data
                */
            // display first 2 and last 2 offset */
            // get the offsets which will be displayed
            for (i=0, j=0; j < dataSize; i++, j=j+4) {
                if ( j == 0 || j == 4 
                        || ((j==8 || j==12) && (dataSize <= 16) )) {
                    halfWordOffset[i] = DATA_OFFSET + j;
                }

                if ((j == (dataSize - 8)) || (j == (dataSize - 4))
                        && (dataSize > 16)) {
                    halfWordOffset[i] = DATA_OFFSET + j;
                }
            }

            // display size
            if (check_col(pinfo->cinfo, COL_INFO)) {
                col_append_fstr(pinfo->cinfo, COL_INFO, " size=%u", dataSize);
            }

            if (dataSize >0) {
                if (check_col(pinfo->cinfo, COL_INFO))
                    col_append_str(pinfo->cinfo, COL_INFO, " Data=");

                for (i=0, j=0; i < dataSize / 4; j=j+4, i++)
                {
                    // display first 2 and last 2 offset
                    if (check_col(pinfo->cinfo, COL_INFO))
                        col_append_fstr(pinfo->cinfo, COL_INFO, " %x",
                                tvb_get_letohs(tvb, halfWordOffset[i]));

                    if (dataSize > 16 && i==2)
                        tst_print_etc(pinfo);
                }
            }

            // display in summary display
            if (ReqRsp_tree) {
                proto_tree_add_item(ReqRsp_tree,
                    hf_TST_size, tvb, SIZE_OFFSET, 4, FALSE);
                data_item = proto_tree_add_text(ReqRsp_tree, 
                       tvb, DATA_OFFSET, dataSize, 
                        "Data (%u bytes)", dataSize);
                
                Data_tree = proto_item_add_subtree(data_item, ett_Data);
            } 

            break;
        case REGISTER:
            ...
            break;
        case POLTIMING:
            ...
            break;
        case RES_SEACQU:
            ...
            break;
        ... // there are more cases here
    }
}

/* Code to actually dissect the packets */
static void
dissect_KLATST(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
	
	proto_item *ti;
	proto_tree *KLATST_tree;
	proto_tree *ReqRsp_tree;

    gboolean    is_response;
	guint32     TST_signature;
    guint16     TST_type;
    guint16     TST_size;
    gboolean    is_data_packet = FALSE;
    guint       tvbLen;
    TSTReq      curTSTReq;
    
	tvbLen = tvb_length(tvb);

    /* Get the TST packet signature*/
    TST_signature = tvb_get_letohl(tvb, SIGNATURE_OFFSET);
    /* Get the TST type*/
    TST_type = tvb_get_letohs(tvb, TYPE_OFFSET);
    /* Get the TST size*/
    TST_size = tvb_get_letohs(tvb, SIZE_OFFSET);

    if (tvbLen) {
        /*
        ** check if request or response
        */
        if (pinfo->match_port == pinfo->destport)
            is_response = FALSE;
        else
            is_response = TRUE;
        
        /* Make entries in Protocol column and Info column on summary display */
        if (check_col(pinfo->cinfo, COL_PROTOCOL)) 
            col_set_str(pinfo->cinfo, COL_PROTOCOL, "KLATST");
            
        /* put request name into information colume */

        if (TST_signature == TST_PacketSignature) {
            int i;
            for (i=0; i < REQ_RSP_CNT; i++)
            {
				boolean found = FALSE;
               if (TST_type == TSTReqItem[i].type) {
                    if (check_col(pinfo->cinfo, COL_INFO)) 
                        col_add_fstr(pinfo->cinfo, COL_INFO, "%s: %s",
                                is_response ? "REPONSE" : "REQUEST", 
                                TSTReqItem[i].name);

                    curTSTReq = TSTReqItem[i];
                    found = TRUE;
               }
			   if (found)
				   break;
            }
        } else {
            is_data_packet = TRUE;
            if (check_col(pinfo->cinfo, COL_INFO)) 
                col_set_str(pinfo->cinfo, COL_INFO, "TST DATA Continuation");
        }

        if (tree) {
            /* create display subtree for the protocol */
            ti = proto_tree_add_item(tree, proto_KLATST, tvb, 0, -1, FALSE);

            KLATST_tree = proto_item_add_subtree(ti, ett_KLATST);

            /* add an item to the subtree */
            if (ti) {
                if (is_response) {
                    ti = proto_tree_add_text(KLATST_tree, 
                            tvb, 0, -1, "Response");
                } else {
                    ti = proto_tree_add_text(KLATST_tree, 
                            tvb, 0, -1, "Request");
                }
                
                ReqRsp_tree = proto_item_add_subtree(ti, ett_ReqRsp);

                // These ared used for filtering
                if (is_response) {
                    proto_tree_add_boolean_hidden(ReqRsp_tree,
                            hf_KLATST_response, tvb, 0,0,TRUE);
                    proto_tree_add_boolean_hidden(ReqRsp_tree,
                            hf_KLATST_request, tvb, 0,0,FALSE);
                } else {
                    proto_tree_add_boolean_hidden(ReqRsp_tree,
                            hf_KLATST_response, tvb, 0,0,FALSE);
                    proto_tree_add_boolean_hidden(ReqRsp_tree,
                            hf_KLATST_request, tvb, 0,0,TRUE);
                }

                if (ReqRsp_tree) {
                    // if data continuation packet or request/response
                    if (!is_data_packet){
                        proto_tree_add_string(ReqRsp_tree,
                            hf_KLATST_name, tvb, 0, 0, curTSTReq.name);
                    } else {
                        char *TSTName = "DATA Continuation";
                        proto_tree_add_string_hidden(ReqRsp_tree,
                            hf_KLATST_name, tvb, 0, 0, TSTName);
                    }
                }
            }

            /* parse data and put them in info column  and summary display*/
#if 1
            parseData(tvb, pinfo, is_response, curTSTReq, 
                                TST_size, ReqRsp_tree);
        }
#else
        }
		parseData(tvb, pinfo, is_response, curTSTReq, 
                                TST_size, ReqRsp_tree);
#endif
    }
}


/* Register the protocol with Ethereal */

/* this format is require because a script is used to build the C function
   that calls all the protocol registration.
*/

void
proto_register_KLATST(void)
{                 

/* Setup list of header fields  See Section 1.6.1 for details*/
	static hf_register_info hf[] = {
        { &hf_KLATST_request,
			{ "Request",           "klaTST.request",
			FT_BOOLEAN, BASE_NONE, NULL, 0x0,          
			"TRUE if kla request", HFILL }
		},
        { &hf_KLATST_response,
			{ "Response",           "klaTST.response",
			FT_BOOLEAN, BASE_NONE, NULL, 0x0,          
			"TRUE if kla response", HFILL }
		},
        { &hf_KLATST_name,
			{ "Name",           "klaTST.name",
			FT_STRING, BASE_NONE, NULL, 0x0,          
			"", HFILL }
		},
        { &hf_KLATST_size,
			{ "Size",           "klaTST.size",
			FT_UINT16, BASE_DEC, NULL, 0x0,          
			"Size", HFILL }
		},
        { &hf_KLATST_type,
			{ "Type",           "klaTST.type",
			FT_UINT16, BASE_HEX, NULL, 0x0,          
			"Type", HFILL }
		},
	};


/* Setup protocol subtree array */
	static gint *ett[] = {
		&ett_TST,
		&ett_ReqRsp,
        &ett_Data,
	};

/* Register the protocol name and description */
	proto_TST = proto_register_protocol("TST Protocal",
	    "TST", "TST");

/* Required function calls to register the header fields and subtrees used */
	proto_register_field_array(proto_TST, hf, array_length(hf));
	proto_register_subtree_array(ett, array_length(ett));
}


/* If this dissector uses sub-dissector registration add a registration routine.
   This format is required because a script is used to find these routines and
   create the code that calls these routines.
*/
void
proto_reg_handoff_TST(void)
{
	dissector_handle_t TST_handle;

	TST_handle = create_dissector_handle(dissect_TST,
	    proto_TST);
	dissector_add("tcp.port", MCIPort, TST_handle);
}

#ifndef ENABLE_STATIC
G_MODULE_EXPORT void 
plugin_init(plugin_address_table_t *pat) {
    plugin_address_table_init(pat);

    if (proto_TST == -1)
        proto_register_TST();
}

G_MODULE_EXPORT void 
plugin_reg_handoff(void) {
    proto_reg_handoff_TST();
}

#endif