Ethereal-dev: RE: [ethereal-dev] TCP/UDP protcol dissector lookups

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jeff Foster <jfoste@xxxxxxxxxxxx>
Date: Fri, 17 Mar 2000 15:52:27 -0600
I have a working model of the protocol hashing code.  The context diff of
packet.h, packet.c, proto.h, and proto.c is attached.  These changes do NOT
break any of the 
current code.  

This code is based upon the assumption that a guint32 and gint are the same
size.
This assumption has been tested and found to be valid on my linux system.
If that assumption is not correct, there are two choices: change the
'pattern' value
to guint16 or the register_dissector routine must be changed replace the
'g_direct_hash'
and the 'g_direct_equal' in the g_hash_table_new call.  New routines must be
written
to do the key hashing and comparison.

The second assumption is that a dissector replaces the old dissector
pointer. The
old dissector pointer is lost.  If it is decided that the old dissector
pointer
must be save to be re-installed when a dissector is delete, the code must
change to
hold the original pointer.  The hash table 'value' will have to be a
structure that
holds the current dissector pointer and a link to the structure for the old
pointer.

This update requires changes to proto.h, proto.c, packet.h and packet.c.
Most of the
work is in packet.c.  The changes to proto.[ch] were required to add support
for 
the sub-dissector table in to the header_field_info structure.  In addition,
the
prototype for find_hfinfo_record moved from proto.c to proto.h so the
packet.c routines
could use the function.


A new field has been added to the header_field_info field -

typedef struct header_field_info {
	...
	dissector_table_t 	sub_dissectors; 	/* sub-dissector
table pointer */
}

It seemed to be the best place to add the dissector table pointer.  The
routine 
proto_register_protocol needs a patch clear this value for an new structure.

	hfinfo->sub_dissectors = NULL;

The routine find_hfinfo_record definition was moved from proto.c to proto.h
so the 
packet.c routines could use the function.

I have done some work on a replacement for make-req-doc to examine the
packet
dissector file and create a register.c file that will accommodate any
dependencies.
I'm still not happy with the script and haven't included it.

This is an example of how the code would be used to install a sub-dissector
to the
TCP code.


/************ Example with  TCP dissector code ***************/


/*****  in dissect_tcp ****/

/* lookup dissector and process it if found */

subdissector = dissector_lookup( proto_tcp, th.th_sport, th.th_dport );

if ( subdissector)
	(subdissector)( pd, offset, fd, tree);



/**** in proto_register_tcp ****/

register_dissector_table( proto_tcp);


/************ in sub-dissector code ***************/
/**** in proto_register_my_proto ****/

 dissector_add( "tcp", &my_dissector ); 


Good luck,

Jeff Foster
jfoste@xxxxxxxxxxxx

Attachment: proto_hash.diff
Description: Binary data