自学教程：C++ tvb_offset_exists函数代码示例

WSLUA_CONSTRUCTOR TvbRange_tvb (lua_State *L) {	/* Creates a (sub)Tvb from using a TvbRange */#define WSLUA_ARG_Tvb_new_subset_RANGE 1 /* The TvbRange from which to create the new Tvb. */    TvbRange tvbr = checkTvbRange(L,WSLUA_ARG_Tvb_new_subset_RANGE);    Tvb tvb;    if (! (tvbr && tvbr->tvb)) return 0;    if (tvbr->tvb->expired) {        luaL_error(L,"expired tvb");        return 0;    }    if (tvb_offset_exists(tvbr->tvb->ws_tvb,  tvbr->offset + tvbr->len -1 )) {        tvb = (Tvb)g_malloc(sizeof(struct _wslua_tvb));        tvb->expired = FALSE;        tvb->need_free = FALSE;        tvb->ws_tvb = tvb_new_subset(tvbr->tvb->ws_tvb,tvbr->offset,tvbr->len, tvbr->len);        PUSH_TVB(L, tvb);        return 1;    } else {        luaL_error(L,"Out Of Bounds");        return 0;    }}

static voidadd_dix_trailer(packet_info *pinfo, proto_tree *tree, proto_tree *fh_tree, int trailer_id,		tvbuff_t *tvb, tvbuff_t *next_tvb, int offset_after_etype,		guint length_before, gint fcs_len){	guint		 length;	tvbuff_t	*trailer_tvb;	/* OK, how much is there in that tvbuff now? */	length = tvb_reported_length(next_tvb);	/* If there's less than there was before, what's left is	   a trailer. */	if (length < length_before) {		/*		 * Is any of the padding present in the tvbuff?		 */		if (tvb_offset_exists(tvb, offset_after_etype + length)) {			/*			 * Yes - create a tvbuff for the padding.			 */			trailer_tvb = tvb_new_subset_remaining(tvb,							       offset_after_etype + length);		} else {			/*			 * No - don't bother showing the trailer.			 * XXX - show a Short Frame indication?			 */			trailer_tvb = NULL;		}	} else		trailer_tvb = NULL;	/* no trailer */	add_ethernet_trailer(pinfo, tree, fh_tree, trailer_id, tvb, trailer_tvb, fcs_len);}

static voiddissect_smtp_data(tvbuff_t *tvb, int offset, proto_tree *smtp_tree){  gint next_offset;  if (smtp_tree) {    while (tvb_offset_exists(tvb, offset)) {      /*       * Find the end of the line.       */      tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);      /*       * Put this line.       */      proto_tree_add_item(smtp_tree, hf_smtp_message, tvb,                          offset, next_offset - offset, ENC_ASCII|ENC_NA);      /*       * Step to the next line.       */      offset = next_offset;    }  }}

static voiddissect_msnms(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree){        proto_tree      *msnms_tree;	proto_item	*ti;	gint		offset = 0;	const guchar	*line;	gint		next_offset;	int		linelen;	/* int		tokenlen; */	/* const guchar	*next_token; */	col_set_str(pinfo->cinfo, COL_PROTOCOL, "MSNMS");	/*	 * Find the end of the first line.	 *	 * Note that "tvb_find_line_end()" will return a value that is	 * not longer than what's in the buffer, so the "tvb_get_ptr()"	 * call won't throw an exception.	 */	linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);	line = tvb_get_ptr(tvb, offset, linelen);	if (check_col(pinfo->cinfo, COL_INFO)) {		/*		 * Put the first line from the buffer into the summary.		 */		col_add_str(pinfo->cinfo, COL_INFO, 			    format_text(line, linelen));	}	if (tree) {		ti = proto_tree_add_item(tree, proto_msnms, tvb, offset, -1,		    FALSE);		msnms_tree = proto_item_add_subtree(ti, ett_msnms);		/*		 * Show the rest of the packet as text,		 * a line at a time.		 */		while (tvb_offset_exists(tvb, offset)) {			/*			 * Find the end of the line.			 */			linelen = tvb_find_line_end(tvb, offset, -1,			    &next_offset, FALSE);			/*			 * Put this line.			 */			proto_tree_add_text(msnms_tree, tvb, offset,			    next_offset - offset, "%s",			    tvb_format_text(tvb, offset, next_offset - offset));			offset = next_offset;		}	}}

static voiddissect_rsh(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree){	proto_tree	*rsh_tree;	proto_item	*ti, *hidden_item;	gint		offset = 0;	gint		next_offset;	int		linelen;	col_set_str(pinfo->cinfo, COL_PROTOCOL, "RSH");	if (check_col(pinfo->cinfo, COL_INFO)) {		/* Put the first line from the buffer into the summary. */		tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);		linelen = next_offset - offset;	/* include the line terminator */		/*		 * Make sure the line terminator isn't past the end of		 * the captured data in the packet, so we don't throw		 * an exception in the "tvb_get_ptr()" call.		 */		if (linelen > (int) tvb_length(tvb))			linelen = tvb_length(tvb);		col_add_str(pinfo->cinfo, COL_INFO,		    tvb_format_text(tvb, offset, linelen));	}	if (tree) {		ti = proto_tree_add_item(tree, proto_rsh, tvb, offset, -1,		    FALSE);		rsh_tree = proto_item_add_subtree(ti, ett_rsh);		/*		 * Process the packet data, a line at a time.		 */		while (tvb_offset_exists(tvb, offset)) {			/*			 * Find the end of the line.			 */			tvb_find_line_end(tvb, offset, -1, &next_offset,			    FALSE);			/*			 * Put this line.			 */			proto_tree_add_text(rsh_tree, tvb, offset,			    next_offset - offset, "%s",			    tvb_format_text(tvb, offset, next_offset - offset));			offset = next_offset;		}		if (pinfo->match_port == pinfo->destport) {			hidden_item = proto_tree_add_boolean(rsh_tree,			    hf_rsh_request, tvb, 0, 0, 1);                } else {			hidden_item = proto_tree_add_boolean(rsh_tree,			    hf_rsh_response, tvb, 0, 0, 1);                }                PROTO_ITEM_SET_HIDDEN(hidden_item);	}}

static void dissect_auto_rp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree){        guint8 ver_type, rp_count;        col_set_str(pinfo->cinfo, COL_PROTOCOL, "Auto-RP");        col_clear(pinfo->cinfo, COL_INFO);        ver_type = tvb_get_guint8(tvb, 0);        rp_count = tvb_get_guint8(tvb, 1);        if (check_col(pinfo->cinfo, COL_INFO))                col_add_fstr(pinfo->cinfo, COL_INFO, "%s (v%s) for %u RP%s",                             val_to_str(lo_nibble(ver_type), auto_rp_type_vals, "Unknown"),                             val_to_str(hi_nibble(ver_type), auto_rp_ver_vals, "Unknown"),                             rp_count, plurality(rp_count, "", "s"));        if (tree) {                proto_item *ti, *tv;                proto_tree *auto_rp_tree, *ver_type_tree;                int i, offset;                guint16 holdtime;                offset = 0;                ti = proto_tree_add_item(tree, proto_auto_rp, tvb, offset, -1, FALSE);                auto_rp_tree = proto_item_add_subtree(ti, ett_auto_rp);                tv = proto_tree_add_text(auto_rp_tree, tvb, offset, 1, "Version: %s, Packet type: %s",                                         val_to_str(hi_nibble(ver_type), auto_rp_ver_vals, "Unknown"),                                         val_to_str(lo_nibble(ver_type), auto_rp_type_vals, "Unknown"));                ver_type_tree = proto_item_add_subtree(tv, ett_auto_rp_ver_type);                proto_tree_add_uint(ver_type_tree, hf_auto_rp_version, tvb, offset, 1, ver_type);                proto_tree_add_uint(ver_type_tree, hf_auto_rp_type, tvb, offset, 1, ver_type);                offset++;                proto_tree_add_uint(auto_rp_tree, hf_auto_rp_count, tvb, offset, 1, rp_count);                offset++;                holdtime = tvb_get_ntohs(tvb, offset);                proto_tree_add_uint_format_value(auto_rp_tree, hf_auto_rp_holdtime, tvb, offset, 2, holdtime,                                           "%u second%s", holdtime, plurality(holdtime, "", "s"));                offset+=2;                proto_tree_add_text(auto_rp_tree, tvb, offset, 4, "Reserved: 0x%x", tvb_get_ntohs(tvb, offset));                offset+=4;                for (i = 0; i < rp_count; i++)                        offset = do_auto_rp_map(tvb, offset, auto_rp_tree);                if (tvb_offset_exists(tvb, offset))                        proto_tree_add_text(tree, tvb, offset, -1, "Trailing junk");        }        return;}

/* ---------------------------- */static voiddissect_nasdaq_soup(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree){    proto_item *ti;    proto_tree *nasdaq_soup_tree = NULL;    guint8 nasdaq_soup_type;    int  linelen;    gint next_offset;    int  offset = 0;    gint col_info;    gint counter = 0;    col_info = check_col(pinfo->cinfo, COL_INFO);    while (tvb_offset_exists(tvb, offset)) {        /* there's only a /n no /r */        linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, nasdaq_soup_desegment && pinfo->can_desegment);        if (linelen == -1) {            /*             * We didn't find a line ending, and we're doing desegmentation;             * tell the TCP dissector where the data for this message starts             * in the data it handed us, and tell it we need one more byte             * (we may need more, but we'll try again if what we get next             * isn't enough), and return.             */            pinfo->desegment_offset = offset;            pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;            return;        }        nasdaq_soup_type = tvb_get_guint8(tvb, offset);        if (counter == 0) {            col_set_str(pinfo->cinfo, COL_PROTOCOL, "Nasdaq-SOUP");            if (col_info)                col_clear(pinfo->cinfo, COL_INFO);        }        if (col_info ) {            if (counter) {                col_append_str(pinfo->cinfo, COL_INFO, "; ");                col_set_fence(pinfo->cinfo, COL_INFO);            }            col_append_str(pinfo->cinfo, COL_INFO, val_to_str(nasdaq_soup_type, message_types_val, "Unknown packet type (0x%02x)"));        }        counter++;        if (tree) {            ti = proto_tree_add_item(tree, proto_nasdaq_soup, tvb, offset, linelen +1, ENC_NA);            nasdaq_soup_tree = proto_item_add_subtree(ti, ett_nasdaq_soup);        }        dissect_nasdaq_soup_packet(tvb, pinfo, tree, nasdaq_soup_tree, offset, linelen);        offset = next_offset;    }}

static voiddissect_irc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree){    proto_tree *irc_tree, *ti;    gint        offset = 0;    gint        next_offset;    int         linelen;    col_set_str(pinfo->cinfo, COL_PROTOCOL, "IRC");    col_set_str(pinfo->cinfo, COL_INFO,        (pinfo->match_uint == pinfo->destport) ? "Request" : "Response");    ti = proto_tree_add_item(tree, proto_irc, tvb, 0, -1, ENC_NA);    irc_tree = proto_item_add_subtree(ti, ett_irc);    /*     * Process the packet data, a line at a time.     */    while (tvb_offset_exists(tvb, offset))    {        /*         * Find the end of the line.         */        linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);        if (next_offset == offset) {            /*             * XXX - we really want the "show data a             * line at a time" loops in various             * dissectors to do reassembly and to             * throw an exception if there's no             * line ending in the current packet             * and we're not doing reassembly.             */            break;        }        if (linelen != 0)        {            if (pinfo->match_uint == pinfo->destport)            {                dissect_irc_request(irc_tree, tvb, pinfo, offset, linelen);            }            else            {                dissect_irc_response(irc_tree, tvb, pinfo, offset, linelen);            }        }        offset = next_offset;    }}

/* Main dissection function. */static void dissect_sipfrag(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree){    proto_tree  *sipfrag_tree;    proto_item  *ti;    gint        offset = 0;    gint        next_offset;    int         linelen;    char        *string;    gint        lines = 0;    /* Append this protocol name rather than replace. */    col_append_str(pinfo->cinfo, COL_PROTOCOL, "/sipfrag");    /* Add mention of this protocol to info column */    col_append_str(pinfo->cinfo, COL_INFO, ", with Sipfrag");    /* Create sipfrag tree. */    ti = proto_tree_add_item(tree, proto_sipfrag, tvb, offset, -1, ENC_NA);    sipfrag_tree = proto_item_add_subtree(ti, ett_sipfrag);    /* Show the sipfrag message a line at a time. */    while (tvb_offset_exists(tvb, offset))    {        /* Find the end of the line. */        linelen = tvb_find_line_end_unquoted(tvb, offset, -1, &next_offset);        /* For now, add all lines as unparsed strings */        /* Extract & add the string. */        string = (char*)tvb_get_string(wmem_packet_scope(), tvb, offset, linelen);        proto_tree_add_string_format(sipfrag_tree, hf_sipfrag_line,                                     tvb, offset,                                     linelen, string,                                     "%s", string);        lines++;        /* Show first line in info column */        if (lines == 1) {            col_append_fstr(pinfo->cinfo, COL_INFO, "(%s", string);        }        /* Move onto next line. */        offset = next_offset;    }    /* Close off summary of sipfrag in info column */    col_append_str(pinfo->cinfo, COL_INFO, (lines > 1) ? "...)" : ")");}

/* * Unless the first boundary, subsequent boundaries include a line-end sequence * before the dashed boundary string. * * Return the offset to the 1st byte of the boundary delimiter line. * Set boundary_line_len to the length of the entire boundary delimiter. * Set last_boundary to TRUE if we've seen the last-boundary delimiter. */static gintfind_next_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary,                   gint boundary_len, gint *boundary_line_len, gboolean *last_boundary){    gint offset = start, next_offset, line_len, boundary_start;    while (tvb_offset_exists(tvb, offset + 2 + boundary_len)) {        line_len =  tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);        if (line_len == -1) {            return -1;        }        boundary_start = offset + line_len;        if (((tvb_strneql(tvb, next_offset, (const guint8 *)"--", 2) == 0)                && (tvb_strneql(tvb, next_offset + 2, boundary, boundary_len) == 0)))        {            /* Boundary string; now check if last */            if ((tvb_reported_length_remaining(tvb, next_offset + 2 + boundary_len + 2) >= 0)                    && (tvb_strneql(tvb, next_offset + 2 + boundary_len,                                    (const guint8 *)"--", 2) == 0)) {                *last_boundary = TRUE;            } else {                *last_boundary = FALSE;            }            /* Look for line end of the boundary line */            line_len =  tvb_find_line_end(tvb, next_offset, -1, &offset, FALSE);            if (line_len == -1) {                *boundary_line_len = -1;            } else {                *boundary_line_len = offset - boundary_start;            }            return boundary_start;            /* check if last before CRLF; some ignore the standard, so there is no CRLF before the boundary */        } else if ((tvb_strneql(tvb, boundary_start - 2, (const guint8 *)"--", 2) == 0)                   && (tvb_strneql(tvb, boundary_start - (2 + boundary_len), boundary, boundary_len) == 0)                   && (tvb_strneql(tvb, boundary_start - (2 + boundary_len + 2),                                   (const guint8 *)"--", 2) == 0)) {            boundary_start -= 2 + boundary_len + 2;            *boundary_line_len = next_offset - boundary_start;            *last_boundary = TRUE;            return boundary_start;        }        offset = next_offset;    }    return -1;}

static voidtftp_dissect_options(tvbuff_t *tvb, packet_info *pinfo, int offset,                     proto_tree *tree, guint16 opcode, tftp_conv_info_t *tftp_info){  int         option_len, value_len;  int         value_offset;  const char *optionname;  const char *optionvalue;  proto_tree *opt_tree;  while (tvb_offset_exists(tvb, offset)) {    /* option_len and value_len include the trailing 0 byte */    option_len = tvb_strsize(tvb, offset);    value_offset = offset + option_len;    value_len = tvb_strsize(tvb, value_offset);    /* use xxx_len-1 to exclude the trailing 0 byte, it would be       displayed as nonprinting character       tvb_format_text() creates a temporary 0-terminated buffer */    optionname = tvb_format_text(tvb, offset, option_len-1);    optionvalue = tvb_format_text(tvb, value_offset, value_len-1);    opt_tree = proto_tree_add_subtree_format(tree, tvb, offset, option_len+value_len,                                   ett_tftp_option, NULL, "Option: %s = %s", optionname, optionvalue);    proto_tree_add_item(opt_tree, hf_tftp_option_name, tvb, offset,                        option_len, ENC_ASCII|ENC_NA);    proto_tree_add_item(opt_tree, hf_tftp_option_value, tvb, value_offset,                        value_len, ENC_ASCII|ENC_NA);    offset += option_len + value_len;    col_append_fstr(pinfo->cinfo, COL_INFO, ", %s=%s",                    optionname, optionvalue);    /* Special code to handle individual options */    if (!g_ascii_strcasecmp((const char *)optionname, "blksize") &&        opcode == TFTP_OACK) {      gint blocksize = (gint)strtol((const char *)optionvalue, NULL, 10);      if (blocksize < 8 || blocksize > 65464) {        expert_add_info(pinfo, NULL, &ei_tftp_blocksize_range);      } else {        tftp_info->blocksize = blocksize;      }    }  }}

/* * Display the entire message as raw text. */static voidtvb_raw_text_add(tvbuff_t *tvb, proto_tree *tree){	int offset, next_offset, linelen;	offset = 0;	while (tvb_offset_exists(tvb, offset)) {		/* 'desegment' is FALSE so will set next_offset to beyond the end of		   the buffer if no line ending is found */		tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);		linelen = next_offset - offset;		if(tree) {			proto_tree_add_text(tree, tvb, offset, linelen,			                    "%s", tvb_format_text(tvb, offset, linelen));		}		offset = next_offset;	}}

/* * The first boundary does not implicitly contain the leading * line-end sequence. * * Return the offset to the 1st byte of the boundary delimiter line. * Set boundary_line_len to the length of the entire boundary delimiter. * Set last_boundary to TRUE if we've seen the last-boundary delimiter. */static gintfind_first_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary,                    gint boundary_len, gint *boundary_line_len, gboolean *last_boundary){    gint offset = start, next_offset, line_len, boundary_start;    while (tvb_offset_exists(tvb, offset + 2 + boundary_len)) {        boundary_start = offset;        if (((tvb_strneql(tvb, offset, (const guint8 *)"--", 2) == 0)                && (tvb_strneql(tvb, offset + 2, boundary,  boundary_len) == 0)))        {            /* Boundary string; now check if last */            if ((tvb_reported_length_remaining(tvb, offset + 2 + boundary_len + 2) >= 0)                    && (tvb_strneql(tvb, offset + 2 + boundary_len,                                    (const guint8 *)"--", 2) == 0)) {                *last_boundary = TRUE;            } else {                *last_boundary = FALSE;            }            /* Look for line end of the boundary line */            line_len =  tvb_find_line_end(tvb, offset, -1, &offset, FALSE);            if (line_len == -1) {                *boundary_line_len = -1;            } else {                *boundary_line_len = offset - boundary_start;            }            return boundary_start;        }        line_len =  tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);        if (line_len == -1) {            return -1;        }        offset = next_offset;    }    return -1;}

//.........这里部分代码省略.........             }        } else {            dissect_ncp_request(next_tvb, pinfo, nw_connection,                header.sequence, header.type, ncp_tree);        }        break;    case NCP_SERVICE_REPLY:        /* Server NCP Reply */        next_tvb = tvb_new_subset_remaining(tvb, commhdr);        nds_defrag(next_tvb, pinfo, nw_connection, header.sequence,            header.type, ncp_tree, &ncp_tap);        break;    case NCP_POSITIVE_ACK:        /* Positive Acknowledgement */        /*         * XXX - this used to call "nds_defrag()", which would         * clear out "frags".  Was that the right thing to         * do?         */        next_tvb = tvb_new_subset_remaining(tvb, commhdr);        dissect_ncp_reply(next_tvb, pinfo, nw_connection,            header.sequence, header.type, ncp_tree, &ncp_tap);        break;    case NCP_WATCHDOG:        /* Watchdog Packet */        /*         * XXX - should the completion code be interpreted as         * it is in "packet-ncp2222.inc"?  If so, this         * packet should be handled by "dissect_ncp_reply()".         */        proto_tree_add_item(ncp_tree, hf_ncp_completion_code,            tvb, commhdr + 6, 1, ENC_LITTLE_ENDIAN);        proto_tree_add_item(ncp_tree, hf_ncp_connection_status,            tvb, commhdr + 7, 1, ENC_LITTLE_ENDIAN);        proto_tree_add_item(ncp_tree, hf_ncp_slot,            tvb, commhdr + 8, 1, ENC_LITTLE_ENDIAN);        proto_tree_add_item(ncp_tree, hf_ncp_control_code,            tvb, commhdr + 9, 1, ENC_LITTLE_ENDIAN);        /*         * Display the rest of the packet as data.         */        if (tvb_offset_exists(tvb, commhdr + 10)) {            call_dissector(data_handle,                tvb_new_subset_remaining(tvb, commhdr + 10),                pinfo, ncp_tree);        }        break;    case NCP_BURST_MODE_XFER:    /* Packet Burst Packet */        if (flags & SYS) {            /*             * System packet; show missing fragments if there             * are any.             */            while (missing_fraglist_count != 0) {                proto_tree_add_item(ncp_tree, hf_ncp_missing_data_offset,                    tvb, offset, 4, ENC_BIG_ENDIAN);                offset += 4;                proto_tree_add_item(ncp_tree, hf_ncp_missing_data_count,                    tvb, offset, 2, ENC_BIG_ENDIAN);                offset += 2;                missing_fraglist_count--;            }        } else {            /*             * XXX - do this by using -1 and -1 as the length             * arguments to "tvb_new_subset()" and then calling             * "tvb_set_reported_length()"?  That'll throw an             * exception if "data_len" goes past the reported             * length of the packet, but that's arguably a             * feature in this case.             */            length_remaining = tvb_length_remaining(tvb, offset);            if (length_remaining > data_len)                length_remaining = data_len;            if (data_len != 0) {                call_dissector(data_handle,                    tvb_new_subset(tvb, offset,                    length_remaining, data_len),                    pinfo, ncp_tree);            }        }        break;    case NCP_LIP_ECHO:        /* LIP Echo Packet */        proto_tree_add_text(ncp_tree, tvb, commhdr, -1,            "Lip Echo Packet");        break;    default:        expert_item = proto_tree_add_text(ncp_tree, tvb, commhdr + 6, -1,            "%s packets not supported yet",            val_to_str(header.type, ncp_type_vals,                "Unknown type (0x%04x)"));        if (ncp_echo_err) {            expert_add_info_format(pinfo, expert_item, &ei_ncp_type, "%s packets not supported yet", val_to_str(header.type, ncp_type_vals, "Unknown type (0x%04x)"));        }        break;    }}

//.........这里部分代码省略.........	case NBIPX_SESSION_END_ACK:		col_set_str(pinfo->cinfo, COL_INFO,				val_to_str_const(packet_type, nbipx_data_stream_type_vals, "Unknown"));		dissect_conn_control(tvb, offset, nbipx_tree);		offset += 1;		proto_tree_add_uint(nbipx_tree, hf_nbipx_packettype, tvb, offset, 1, packet_type);		offset += 1;		proto_tree_add_item(nbipx_tree, hf_nbipx_session_src_conn_id, tvb, offset, 2, ENC_LITTLE_ENDIAN);		offset += 2;		proto_tree_add_item(nbipx_tree, hf_nbipx_session_dest_conn_id, tvb, offset, 2, ENC_LITTLE_ENDIAN);		offset += 2;		proto_tree_add_item(nbipx_tree, hf_nbipx_session_send_seq_number, tvb, offset, 2, ENC_LITTLE_ENDIAN);		offset += 2;		proto_tree_add_item(nbipx_tree, hf_nbipx_session_total_data_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);		offset += 2;		proto_tree_add_item(nbipx_tree, hf_nbipx_session_offset, tvb, offset, 2, ENC_LITTLE_ENDIAN);		offset += 2;		proto_tree_add_item(nbipx_tree, hf_nbipx_session_data_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);		offset += 2;		proto_tree_add_item(nbipx_tree, hf_nbipx_session_recv_seq_number, tvb, offset, 2, ENC_LITTLE_ENDIAN);		offset += 2;		proto_tree_add_item(nbipx_tree, hf_nbipx_session_bytes_received, tvb, offset, 2, ENC_LITTLE_ENDIAN);		offset += 2;		/*		 * We may have payload to dissect.		 */		has_payload = TRUE;		break;	case NBIPX_DIRECTED_DATAGRAM:		col_set_str(pinfo->cinfo, COL_INFO,				val_to_str_const(packet_type, nbipx_data_stream_type_vals, "Unknown"));		dissect_conn_control(tvb, offset, nbipx_tree);		offset += 1;		proto_tree_add_uint(nbipx_tree, hf_nbipx_packettype, tvb, offset, 1, packet_type);		offset += 1;		if (nbipx_tree)			netbios_add_name("Receiver's Name", tvb, offset,			    nbipx_tree);		offset += NETBIOS_NAME_LEN;		if (nbipx_tree)			netbios_add_name("Sender's Name", tvb, offset,			    nbipx_tree);		offset += NETBIOS_NAME_LEN;		/*		 * We may have payload to dissect.		 */		has_payload = TRUE;		break;	default:		col_set_str(pinfo->cinfo, COL_INFO,				val_to_str_const(packet_type, nbipx_data_stream_type_vals, "Unknown"));		/*		 * We don't know what the first byte is.		 */		offset += 1;		/*		 * The second byte is a data stream type byte.		 */		proto_tree_add_uint(nbipx_tree, hf_nbipx_packettype, tvb, offset, 1, packet_type);		offset += 1;		/*		 * We don't know what the rest of the packet is.		 */		has_payload = FALSE;	}	/*	 * Set the length of the NBIPX tree item.	 */	if (ti != NULL)		proto_item_set_len(ti, offset);	if (has_payload && tvb_offset_exists(tvb, offset)) {		next_tvb = tvb_new_subset_remaining(tvb, offset);		dissect_netbios_payload(next_tvb, pinfo, tree);	}	return tvb_captured_length(tvb);}

//.........这里部分代码省略.........      /*       * Put the whole packet into the tree as data.       */      call_dissector(data_handle,tvb, pinfo, pop_tree);        }    return;  }  /*   * Put the line into the protocol tree.   */  ti = proto_tree_add_string_format(pop_tree,                                    (is_request) ?                                        hf_pop_request :                                        hf_pop_response,                                    tvb, offset,                                    next_offset - offset,                                    "", "%s",                                    tvb_format_text(tvb, offset, next_offset - offset));  reqresp_tree = proto_item_add_subtree(ti, ett_pop_reqresp);  /*   * Extract the first token, and, if there is a first   * token, add it as the request or reply code.   */  tokenlen = get_token_len(line, line + linelen, &next_token);  if (tokenlen != 0) {    proto_tree_add_item(reqresp_tree,                        (is_request) ?                            hf_pop_request_command :                            hf_pop_response_indicator,                        tvb, offset, tokenlen, FALSE);    if (data_val) {      if (is_request) {        /* see if this is RETR or TOP command */        if (g_ascii_strncasecmp(line, "RETR", 4) == 0 ||           g_ascii_strncasecmp(line, "TOP", 3) == 0)          /* the next response will tell us how many bytes */          data_val->msg_request = TRUE;      } else {        if (data_val->msg_request) {          /* this is a response to a RETR or TOP command */          if (g_ascii_strncasecmp(line, "+OK ", 4) == 0) {            /* the message will be sent - work out how many bytes */            data_val->msg_read_len = 0;            data_val->msg_tot_len = atoi(line + 4);          }          data_val->msg_request = FALSE;        }      }    }    offset += (gint) (next_token - line);    linelen -= (int) (next_token - line);  }  if (tree) {     /*     * Add the rest of the first line as request or     * reply param/description.     */    if (linelen != 0) {      proto_tree_add_item(reqresp_tree,                          (is_request) ?                              hf_pop_request_parameter :                              hf_pop_response_description,                          tvb, offset, linelen, FALSE);    }    offset = next_offset;    /*     * Show the rest of the request or response as text,     * a line at a time.     */    while (tvb_offset_exists(tvb, offset)) {      /*       * Find the end of the line.       */      tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);      /*       * Put this line.       */      proto_tree_add_string_format(pop_tree,                                   (is_request) ?                                       hf_pop_request_data :                                       hf_pop_response_data,                                   tvb, offset,                                   next_offset - offset,                                   "", "%s",                                   tvb_format_text(tvb, offset, next_offset - offset));      offset = next_offset;    }  } }

static voiddissect_nntp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree){        const gchar     *type;	proto_tree	*nntp_tree;	proto_item	*ti;	gint		offset = 0;	gint		next_offset;	int		linelen;        if (pinfo->match_uint == pinfo->destport)        	type = "Request";        else        	type = "Response";	col_set_str(pinfo->cinfo, COL_PROTOCOL, "NNTP");	/*	 * Put the first line from the buffer into the summary	 * (but leave out the line terminator).	 *	 * Note that "tvb_find_line_end()" will return a value that	 * is not longer than what's in the buffer, so the	 * "tvb_get_ptr()" call won't throw an exception.	 */	linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);	col_add_fstr(pinfo->cinfo, COL_INFO, "%s: %s", type,		    tvb_format_text(tvb, offset, linelen));	if (tree) {		ti = proto_tree_add_item(tree, proto_nntp, tvb, offset, -1,		    ENC_NA);		nntp_tree = proto_item_add_subtree(ti, ett_nntp);		if (pinfo->match_uint == pinfo->destport) {			ti = proto_tree_add_boolean(nntp_tree,			    hf_nntp_request, tvb, 0, 0, TRUE);		} else {			ti = proto_tree_add_boolean(nntp_tree,			    hf_nntp_response, tvb, 0, 0, TRUE);		}		PROTO_ITEM_SET_HIDDEN(ti);		/*		 * Show the request or response as text, a line at a time.		 * XXX - for requests, we could display the stuff after the		 * first line, if any, based on what the request was, and		 * for responses, we could display it based on what the		 * matching request was, although the latter requires us to		 * know what the matching request was....		 */		while (tvb_offset_exists(tvb, offset)) {			/*			 * Find the end of the line.			 */			tvb_find_line_end(tvb, offset, -1, &next_offset,			    FALSE);			/*			 * Put this line.			 */			proto_tree_add_text(nntp_tree, tvb, offset,			    next_offset - offset, "%s",			    tvb_format_text(tvb, offset, next_offset - offset));			offset = next_offset;		}	}}

/* Dissect details of packet */static void rlogin_display(rlogin_hash_entry_t *hash_info,			   tvbuff_t *tvb,			   packet_info *pinfo,			   proto_tree *tree,			   struct tcpinfo *tcpinfo){	/* Display the proto tree */	int             offset = 0;	proto_tree      *rlogin_tree, *user_info_tree, *window_tree;	proto_item      *ti;	guint           length;	int             str_len;	gint            ti_offset;	proto_item      *user_info_item, *window_info_item;	/* Create rlogin subtree */	ti = proto_tree_add_item(tree, proto_rlogin, tvb, 0, -1, ENC_NA);	rlogin_tree = proto_item_add_subtree(ti, ett_rlogin);	/* Return if data empty */	length = tvb_captured_length(tvb);	if (length == 0)	{		return;	}	/*	 * XXX - this works only if the urgent pointer points to something	 * in this segment; to make it work if the urgent pointer points	 * to something past this segment, we'd have to remember the urgent	 * pointer setting for this conversation.	 */	if (tcpinfo && IS_TH_URG(tcpinfo->flags) &&      /* if urgent pointer set */	    length >= tcpinfo->urgent_pointer) /* and it's in this frame */	{		/* Get urgent byte into Temp */		int urgent_offset = tcpinfo->urgent_pointer - 1;		guint8 control_byte;		/* Check for text data in front */		if (urgent_offset > offset)		{			proto_tree_add_item(rlogin_tree, hf_data, tvb, offset, urgent_offset, ENC_ASCII|ENC_NA);		}		/* Show control byte */		proto_tree_add_item(rlogin_tree, hf_control_message, tvb,		                    urgent_offset, 1, ENC_BIG_ENDIAN);		control_byte = tvb_get_guint8(tvb, urgent_offset);		col_append_fstr(pinfo->cinfo, COL_INFO,			               " (%s)", val_to_str_const(control_byte, control_message_vals, "Unknown"));		offset = urgent_offset + 1; /* adjust offset */	}	else	if (tvb_get_guint8(tvb, offset) == '/0')	{		/* Startup */		if (pinfo->srcport == RLOGIN_PORT)   /* from server */		{			proto_tree_add_item(rlogin_tree, hf_startup_info_received_flag,			                    tvb, offset, 1, ENC_BIG_ENDIAN);		}		else		{			proto_tree_add_item(rlogin_tree, hf_client_startup_flag,			                    tvb, offset, 1, ENC_BIG_ENDIAN);		}		++offset;	}	if (!tvb_offset_exists(tvb, offset))	{		/* No more data to check */		return;	}	if (hash_info->info_framenum == pinfo->num)	{		gint info_len;		gint slash_offset;		/* First frame of conversation, assume user info... */		info_len = tvb_captured_length_remaining(tvb, offset);		if (info_len <= 0)			return;		/* User info tree */		user_info_item = proto_tree_add_string_format(rlogin_tree, hf_user_info, tvb,		                                              offset, info_len, FALSE,		                                              "User info (%s)",		                                              tvb_format_text(tvb, offset, info_len));		user_info_tree = proto_item_add_subtree(user_info_item,		                                        ett_rlogin_user_info);		/* Client user name. */		str_len = tvb_strsize(tvb, offset);		proto_tree_add_item(user_info_tree, hf_user_info_client_user_name,//.........这里部分代码省略.........

static voiddissect_icap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree){	proto_tree	*icap_tree = NULL;	proto_item	*ti = NULL;	proto_item	*hidden_item;	gint		offset = 0;	const guchar	*line;	gint		next_offset;	const guchar	*linep, *lineend;	int		linelen;	guchar		c;	icap_type_t     icap_type;	int		datalen;	col_set_str(pinfo->cinfo, COL_PROTOCOL, "ICAP");	/*	 * Put the first line from the buffer into the summary	 * if it's an ICAP header (but leave out the	 * line terminator).	 * Otherwise, just call it a continuation.	 *	 * Note that "tvb_find_line_end()" will return a value that	 * is not longer than what's in the buffer, so the	 * "tvb_get_ptr()" call won't throw an exception.	 */	linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);	line = tvb_get_ptr(tvb, offset, linelen);	icap_type = ICAP_OTHER;	/* type not known yet */	if (is_icap_message(line, linelen, &icap_type))		col_add_str(pinfo->cinfo, COL_INFO,		    format_text(line, linelen));	else		col_set_str(pinfo->cinfo, COL_INFO, "Continuation");	if (tree) {		ti = proto_tree_add_item(tree, proto_icap, tvb, offset, -1,		    ENC_NA);		icap_tree = proto_item_add_subtree(ti, ett_icap);	}	/*	 * Process the packet data, a line at a time.	 */	icap_type = ICAP_OTHER;	/* type not known yet */	while (tvb_offset_exists(tvb, offset)) {		gboolean is_icap = FALSE;		gboolean loop_done = FALSE;		/*		 * Find the end of the line.		 */		linelen = tvb_find_line_end(tvb, offset, -1, &next_offset,		    FALSE);		/*		 * Get a buffer that refers to the line.		 */		line = tvb_get_ptr(tvb, offset, linelen);		lineend = line + linelen;		/*		 * find header format		 */		if (is_icap_message(line, linelen, &icap_type)) {			goto is_icap_header;		}		/*		 * if it looks like a blank line, end of header perhaps?		 */		if (linelen == 0) {			goto is_icap_header;		}		/*		 * No.  Does it look like a header?		 */		linep = line;		loop_done = FALSE;		while (linep < lineend && (!loop_done)) {			c = *linep++;			/*			 * This must be a CHAR to be part of a token; that			 * means it must be ASCII.			 */			if (!isascii(c)) {				is_icap = FALSE;				break;	/* not ASCII, thus not a CHAR */			}			/*			 * This mustn't be a CTL to be part of a token.			 *			 * XXX - what about leading LWS on continuation			 * lines of a header?			 */			if (iscntrl(c)) {				is_icap = FALSE;//.........这里部分代码省略.........

//.........这里部分代码省略.........                if (ftp_nat) {                    if (tree) {                        proto_tree_add_boolean(reqresp_tree,                            hf_ftp_pasv_nat, tvb, 0, 0,                            ftp_nat);                    }                }                /*                 * We use "ftp_ip_address", so that if                 * we're NAT'd we look for the un-NAT'd                 * connection.                 *                 * XXX - should this call to                 * "find_conversation()" just use                 * "ftp_ip_address" and "server_port", and                 * wildcard everything else?                 */                conversation = find_conversation(pinfo->fd->num, &ftp_ip_address,                    &pinfo->dst, PT_TCP, ftp_port, 0,                    NO_PORT_B);                if (conversation == NULL) {                    /*                     * XXX - should this call to "conversation_new()"                     * just use "ftp_ip_address" and "server_port",                     * and wildcard everything else?                     *                     * XXX - what if we did find a conversation?  As                     * we create it only on the first pass through the                     * packets, if we find one, it's presumably an                     * unrelated conversation.  Should we remove the                     * old one from the hash table and put this one in                     * its place?  Can the conversation code handle                     * conversations not in the hash table?  Or should                     * we make conversations support start and end                     * frames, as circuits do, and treat this as an                     * indication that one conversation was closed and                     * a new one was opened?                     */                    conversation = conversation_new(                        pinfo->fd->num, &ftp_ip_address, &pinfo->dst,                        PT_TCP, ftp_port, 0, NO_PORT2);                    conversation_set_dissector(conversation, ftpdata_handle);                }            }        }    }    if (is_epasv_response) {        if (linelen != 0) {            /*             * This frame contains an  EPSV response; set up a             * conversation for the data.             */            if (parse_extended_pasv_response(line, linelen, &ftp_port)) {                /* Add port number to tree */                if (tree) {                    proto_tree_add_uint(reqresp_tree,                                        hf_ftp_pasv_port, tvb, 0, 0,                                        ftp_port);                }                /* Find/create conversation for data */                conversation = find_conversation(pinfo->fd->num, &pinfo->src,                                                 &pinfo->dst, PT_TCP, ftp_port, 0,                                                 NO_PORT_B);                if (conversation == NULL) {                    conversation = conversation_new(                        pinfo->fd->num, &pinfo->src, &pinfo->dst,                        PT_TCP, ftp_port, 0, NO_PORT2);                    conversation_set_dissector(conversation,                        ftpdata_handle);                }            }        }    }    if (tree) {        /*         * Show the rest of the request or response as text,         * a line at a time.         * XXX - only if there's a continuation indicator?         */        while (tvb_offset_exists(tvb, offset)) {            /*             * Find the end of the line.             */            tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);            /*             * Put this line.             */            proto_tree_add_text(ftp_tree, tvb, offset,                next_offset - offset, "%s",                tvb_format_text(tvb, offset, next_offset - offset));            offset = next_offset;        }    }}

/* Transfers happen in response to broadcasts, they are always TCP and are * used to send the file to the port mentioned in the broadcast. There are * 2 types of transfers: Pushes, which are direct responses to searches, * in which the peer that has the file connects to the peer that doesn't and * sends it, then disconnects. The other type of transfer is a pull, where * the peer that doesn't have the file connects to the peer that does and * requests it be sent. * * Pulls have a file request which identifies the desired file, * while pushes simply send the file. In practice this works because every * file the implementation sends searches for is on a different TCP port * on the searcher's machine. */static intdissect_ldss_transfer (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data){	conversation_t *transfer_conv;	ldss_transfer_info_t *transfer_info;	struct tcpinfo *transfer_tcpinfo;	proto_tree *ti, *line_tree = NULL, *ldss_tree = NULL;	nstime_t broadcast_response_time;	/* Reject the packet if data is NULL */	if (data == NULL)		return 0;	transfer_tcpinfo = (struct tcpinfo *)data;	col_set_str(pinfo->cinfo, COL_PROTOCOL, "LDSS");	/* Look for the transfer conversation; this was created during	 * earlier broadcast dissection (see prepare_ldss_transfer_conv) */	transfer_conv = find_conversation (pinfo->num, &pinfo->src, &pinfo->dst,					   PT_TCP, pinfo->srcport, pinfo->destport, 0);	transfer_info = (ldss_transfer_info_t *)conversation_get_proto_data(transfer_conv, proto_ldss);	/* For a pull, the first packet in the TCP connection is the file request.	 * First packet is identified by relative seq/ack numbers of 1.	 * File request only appears on a pull (triggered by an offer - see above	 * about broadcasts) */	if (transfer_tcpinfo->seq == 1 &&	    transfer_tcpinfo->lastackseq == 1 &&	    transfer_info->broadcast->message_id == MESSAGE_ID_WILLSEND) {		/* LDSS pull transfers look a lot like HTTP.		 * Sample request:		 * md5:01234567890123...		 * Size: 2550		 * Start: 0		 * Compression: 0		 * (remote end sends the file identified by the digest) */		guint offset = 0;		gboolean already_dissected = TRUE;		col_set_str(pinfo->cinfo, COL_INFO, "LDSS File Transfer (Requesting file - pull)");		if (highest_num_seen == 0 ||		    highest_num_seen < pinfo->num) {			already_dissected = FALSE;			transfer_info->req = wmem_new0(wmem_file_scope(), ldss_file_request_t);			transfer_info->req->file = wmem_new0(wmem_file_scope(), ldss_file_t);			highest_num_seen = pinfo->num;		}		if (tree) {			ti = proto_tree_add_item(tree, proto_ldss,						 tvb, 0, tvb_reported_length(tvb), ENC_NA);			ldss_tree = proto_item_add_subtree(ti, ett_ldss_transfer);		}		/* Populate digest data into the file struct in the request */		transfer_info->file = transfer_info->req->file;		/* Grab each line from the packet, there should be 4 but lets		 * not walk off the end looking for more. */		while (tvb_offset_exists(tvb, offset)) {			gint next_offset;			const guint8 *line;			int linelen;			gboolean is_digest_line;			guint digest_type_len;			linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);			/* Include new-line in line */			line = (guint8 *)tvb_memdup(NULL, tvb, offset, linelen+1); /* XXX - memory leak? */			line_tree = proto_tree_add_subtree(ldss_tree, tvb, offset, linelen,							 ett_ldss_transfer_req, NULL,							 tvb_format_text(tvb, offset, next_offset-offset));			/* Reduce code duplication processing digest lines.			 * There are too many locals to pass to a function - the signature			 * looked pretty ugly when I tried! */			is_digest_line = FALSE;			if (strncmp(line,"md5:",4)==0) {				is_digest_line = TRUE;				digest_type_len = 4;				transfer_info->file->digest_type = DIGEST_TYPE_MD5;			}			else if (strncmp(line, "sha1:", 5)==0) {//.........这里部分代码省略.........

static voiddissect_imap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree){  gboolean        is_request;  proto_tree      *imap_tree, *reqresp_tree;  proto_item      *ti, *hidden_item;  gint            offset = 0;  gint            uid_offset = 0;  gint            folder_offset = 0;  const guchar    *line;  const guchar    *uid_line;  const guchar    *folder_line;  gint            next_offset;  int             linelen;  int             tokenlen;  int             uid_tokenlen;  int             folder_tokenlen;  const guchar    *next_token;  const guchar    *uid_next_token;  const guchar    *folder_next_token;  guchar          *tokenbuf;  guchar          *command_token;  int             iter;  int             commandlen;  conversation_t *conversation;  imap_state_t   *session_state;  conversation = find_or_create_conversation(pinfo);  session_state = (imap_state_t *)conversation_get_proto_data(conversation, proto_imap);  if (!session_state) {    session_state = wmem_new0(wmem_file_scope(), imap_state_t);    session_state->ssl_requested = FALSE;    conversation_add_proto_data(conversation, proto_imap, session_state);  }  tokenbuf = (guchar *)wmem_alloc0(wmem_packet_scope(), MAX_BUFFER);  command_token = (guchar *)wmem_alloc0(wmem_packet_scope(), MAX_BUFFER);  commandlen = 0;  folder_offset = 0;  folder_tokenlen = 0;  folder_line = NULL;  col_set_str(pinfo->cinfo, COL_PROTOCOL, "IMAP");  if (pinfo->match_uint == pinfo->destport)    is_request = TRUE;  else    is_request = FALSE;  /*   * Put the first line from the buffer into the summary   * (but leave out the line terminator).   */  linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);  line = tvb_get_ptr(tvb, offset, linelen);  col_add_fstr(pinfo->cinfo, COL_INFO, "%s: %s", is_request ? "Request" : "Response", format_text(line, linelen));  {    ti = proto_tree_add_item(tree, proto_imap, tvb, offset, -1, ENC_NA);    imap_tree = proto_item_add_subtree(ti, ett_imap);    hidden_item = proto_tree_add_boolean(imap_tree, hf_imap_isrequest, tvb, 0, 0, is_request);    PROTO_ITEM_SET_HIDDEN(hidden_item);    while(tvb_offset_exists(tvb, offset)) {      /*       * Find the end of each line       *       * Note that "tvb_find_line_end()" will return a value that is       * not longer than what's in the buffer, so the "tvb_get_ptr()"       * call won't throw an exception.       */      linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);      line = tvb_get_ptr(tvb, offset, linelen);      /*       * Put the line into the protocol tree.       */      ti = proto_tree_add_item(imap_tree, hf_imap_line, tvb, offset, next_offset - offset, ENC_ASCII|ENC_NA);      reqresp_tree = proto_item_add_subtree(ti, ett_imap_reqresp);      /*       * Check that the line doesn't begin with '*', because that's a continuation line.       * Otherwise if a tag is present then extract tokens.       */      if ( (line) && ((line[0] != '*') || (TRUE == is_request)) ) {        /*         * Show each line as tags + requests or replies.         */        /*         * Extract the first token, and, if there is a first         * token, add it as the request or reply tag.         */        tokenlen = get_token_len(line, line + linelen, &next_token);        if (tokenlen != 0) {          proto_tree_add_item(reqresp_tree, (is_request) ? hf_imap_request_tag : hf_imap_response_tag, tvb, offset, tokenlen, ENC_ASCII|ENC_NA);//.........这里部分代码省略.........

static intparse_attributes(tvbuff_t *tvb, int offset, proto_tree *tree){    guint8       tag;    const gchar *tag_desc;    int          name_length, value_length;    proto_tree  *as_tree      = tree;    proto_item  *tas          = NULL;    int          start_offset = offset;    proto_tree  *attr_tree    = tree;    while (tvb_offset_exists(tvb, offset)) {        tag = tvb_get_guint8(tvb, offset);        tag_desc = val_to_str(tag, tag_vals, "Reserved (0x%02x)");        if (TAG_TYPE(tag) == TAG_TYPE_DELIMITER) {            /*             * If we had an attribute sequence we were             * working on, we're done with it; set its             * length to the length of all the stuff             * we've done so far.             */            if (tas != NULL)                proto_item_set_len(tas, offset - start_offset);            /*             * This tag starts a new attribute sequence;             * create a new tree under this tag when we see             * a non-delimiter tag, under which to put             * those attributes.             */            as_tree   = NULL;            attr_tree = tree;            /*             * Remember the offset at which this attribute             * sequence started, so we can use it to compute             * its length when it's finished.             */            start_offset = offset;            /*             * Now create a new item for this tag.             * XXX - should use proto_tree_add_subtree             */            tas = proto_tree_add_text(tree, tvb, offset, 1, "%s", tag_desc);            offset += 1;            if (tag == TAG_END_OF_ATTRIBUTES) {                /*                 * No more attributes.                 */                break;            }        } else {            /*             * Value tag - get the name length.             */            name_length = tvb_get_ntohs(tvb, offset + 1);            /*             * OK, get the value length.             */            value_length = tvb_get_ntohs(tvb, offset + 1 + 2 + name_length);            /*             * OK, does the value run past the end of the             * frame?             */            if (as_tree == NULL) {                /*                 * OK, there's an attribute to hang                 * under a delimiter tag, but we don't                 * have a tree for that tag yet; create                 * a tree.                 */                as_tree = proto_item_add_subtree(tas,                                                 ett_ipp_as);                attr_tree = as_tree;            }            switch (TAG_TYPE(tag)) {            case TAG_TYPE_INTEGER:                if (name_length != 0) {                    /*                     * This is an attribute, not                     * an additional value, so                     * start a tree for it.                     */                    attr_tree = add_integer_tree(as_tree,                                                 tvb, offset, name_length,                                                 value_length, tag);                }                add_integer_value(tag_desc, attr_tree, tvb,                                  offset, name_length, value_length, tag);                break;            case TAG_TYPE_OCTETSTRING:                if (name_length != 0) {                    /*                     * This is an attribute, not//.........这里部分代码省略.........

/* UA/UDP DISSECTOR */static void _dissect_uaudp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,                           e_ua_direction direction){    gint        offset = 0;    guint8      opcode;    proto_item *uaudp_item;    proto_tree *uaudp_tree;    col_set_str(pinfo->cinfo, COL_PROTOCOL, "UAUDP");    /* get the identifier; it means operation code */    opcode = tvb_get_guint8(tvb, offset);    offset += 1;    ua_tap_info.opcode = opcode;    ua_tap_info.expseq = 0;    ua_tap_info.sntseq = 0;    /* print in "INFO" column the type of UAUDP message */    col_add_fstr(pinfo->cinfo,                COL_INFO,                "%s",                val_to_str_ext(opcode, &uaudp_opcode_str_ext, "unknown (0x%02x)"));    uaudp_item = proto_tree_add_protocol_format(tree, proto_uaudp, tvb, 0, 5,                            "Universal Alcatel/UDP Encapsulation Protocol, %s",                            val_to_str_ext(opcode, &uaudp_opcode_str_ext, "unknown (0x%02x)"));    uaudp_tree = proto_item_add_subtree(uaudp_item, ett_uaudp);    /* print the identifier */    proto_tree_add_uint(uaudp_tree, hf_uaudp_opcode, tvb, 0, 1, opcode);    switch(opcode)    {    case UAUDP_CONNECT:    {        if (!tree)            break;        while (tvb_offset_exists(tvb, offset))        {            guint8 T = tvb_get_guint8(tvb, offset+0);            guint8 L = tvb_get_guint8(tvb, offset+1);            switch(T)            {            case UAUDP_CONNECT_VERSION:                rV(uaudp_tree, &hf_uaudp_version        , tvb, offset, L);                break;            case UAUDP_CONNECT_WINDOW_SIZE:                rV(uaudp_tree, &hf_uaudp_window_size    , tvb, offset, L);                break;            case UAUDP_CONNECT_MTU:                rV(uaudp_tree, &hf_uaudp_mtu            , tvb, offset, L);                break;            case UAUDP_CONNECT_UDP_LOST:                rV(uaudp_tree, &hf_uaudp_udp_lost       , tvb, offset, L);                break;            case UAUDP_CONNECT_UDP_LOST_REINIT:                rV(uaudp_tree, &hf_uaudp_udp_lost_reinit, tvb, offset, L);                break;            case UAUDP_CONNECT_KEEPALIVE:                rV(uaudp_tree, &hf_uaudp_keepalive      , tvb, offset, L);                break;            case UAUDP_CONNECT_QOS_IP_TOS:                rV(uaudp_tree, &hf_uaudp_qos_ip_tos     , tvb, offset, L);                break;            case UAUDP_CONNECT_QOS_8021_VLID:                rV(uaudp_tree, &hf_uaudp_qos_8021_vlid  , tvb, offset, L);                break;            case UAUDP_CONNECT_QOS_8021_PRI:                rV(uaudp_tree, &hf_uaudp_qos_8021_pri   , tvb, offset, L);                break;            }            offset += (2 + L);        }        break;    }    case UAUDP_NACK:    {        proto_tree_add_uint(uaudp_tree,                    hf_uaudp_expseq,                    tvb,                    offset,                    2,                    tvb_get_ntohs(tvb, offset));        break;    }    case UAUDP_DATA:    {        int datalen;        proto_tree_add_uint(uaudp_tree,                    hf_uaudp_expseq,                    tvb,                    offset+0,                    2,//.........这里部分代码省略.........

static intdissect_text_lines(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data){	proto_tree	*subtree;	proto_item	*ti;	gint		offset = 0, next_offset;	gint		len;	http_message_info_t *message_info;	const char	*data_name;	int length = tvb_captured_length(tvb);	/* Check if this is actually xml	 * If there is less than 38 characters this is not XML	 * <?xml version="1.0" encoding="UTF-8"?>	 */	if(length > 38){		if (tvb_strncaseeql(tvb, 0, "<?xml", 5) == 0){			call_dissector(xml_handle, tvb, pinfo, tree);			return length;		}	}	data_name = pinfo->match_string;	if (! (data_name && data_name[0])) {		/*		 * No information from "match_string"		 */		message_info = (http_message_info_t *)data;		if (message_info == NULL) {			/*			 * No information from dissector data			 */			data_name = NULL;		} else {			data_name = message_info->media_str;			if (! (data_name && data_name[0])) {				/*				 * No information from dissector data				 */				data_name = NULL;			}		}	}	if (data_name)		col_append_sep_fstr(pinfo->cinfo, COL_INFO, " ", "(%s)",				data_name);	if (tree) {		guint lines_read = 0;		ti = proto_tree_add_item(tree, proto_text_lines,				tvb, 0, -1, ENC_NA);		if (data_name)			proto_item_append_text(ti, ": %s", data_name);		subtree = proto_item_add_subtree(ti, ett_text_lines);		/* Read the media line by line */		while (tvb_offset_exists(tvb, offset)) {			/*			 * XXX - we need to be passed the parameters			 * of the content type via data parameter,			 * so that we know the character set.  We'd			 * have to handle that character set, which			 * might be a multibyte character set such			 * as "iso-10646-ucs-2", or might require other			 * special processing.			 */			len = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);			if (len == -1)				break;			/* We use next_offset - offset instead of len in the			 * call to proto_tree_add_format_text() so it will include the			 * line terminator(s) (/r and/or /n) in the display.			 */			proto_tree_add_format_text(subtree, tvb, offset, next_offset - offset);			lines_read++;			offset = next_offset;		}		proto_item_append_text(subtree, " (%u lines)", lines_read);	}	return length;}

//.........这里部分代码省略.........   * Is there any data attached to this frame?   */  spd_frame_data = p_get_proto_data(pinfo->fd, proto_smtp);  if (!spd_frame_data) {    /*     * No frame data.     */    if(request) {      /*       * Create a frame data structure and attach it to the packet.       */      spd_frame_data = se_alloc0(sizeof(struct smtp_proto_data));      spd_frame_data->conversation_id = conversation->index;      spd_frame_data->more_frags = TRUE;      p_add_proto_data(pinfo->fd, proto_smtp, spd_frame_data);    }    /*     * Get the first line from the buffer.     *     * Note that "tvb_find_line_end()" will, if it doesn't return     * -1, return a value that is not longer than what's in the buffer,     * and "tvb_find_line_end()" will always return a value that is not     * longer than what's in the buffer, so the "tvb_get_ptr()" call     * won't throw an exception.     */    loffset = offset;    while (tvb_offset_exists(tvb, loffset)) {      linelen = tvb_find_line_end(tvb, loffset, -1, &next_offset,                                  smtp_desegment && pinfo->can_desegment);      if (linelen == -1) {        if (offset == loffset) {          /*           * We didn't find a line ending, and we're doing desegmentation;           * tell the TCP dissector where the data for this message starts           * in the data it handed us, and tell it we need more bytes           */          pinfo->desegment_offset = loffset;          pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;          return;        } else {          linelen = tvb_length_remaining(tvb, loffset);          next_offset = loffset + linelen;        }      }      line = tvb_get_ptr(tvb, loffset, linelen);      /*       * Check whether or not this packet is an end of message packet       * We should look for CRLF.CRLF and they may be split.       * We have to keep in mind that we may see what we want on       * two passes through here ...       */      if (session_state->smtp_state == SMTP_STATE_READING_DATA) {        /*         * The order of these is important ... We want to avoid         * cases where there is a CRLF at the end of a packet and a         * .CRLF at the begining of the same packet.         */        if ((session_state->crlf_seen && tvb_strneql(tvb, loffset, "./r/n", 3) == 0) ||