tcp.options.sack_perm not being used as a field

This issue was migrated from bug 4609 in our old bug tracker.

Original bug information:

Reporter: Martin Visser
Status: RESOLVED FIXED
Product: Wireshark
Component: GTK+ UI
OS: Windows Vista
Platform: x86
Version: 1.2.6

Attachments:

tcp-sack-perm-option-set.pcap: The attached pcap file, if this bug is fixed, would be displayed if the following display filter, "tcp.options.sack_perm==1" was applied. Currently it does not.

Martin Visser said:

Created attachment 4442 The attached pcap file, if this bug is fixed, would be displayed if the following display filter, "tcp.options.sack_perm==1" was applied. Currently it does not.

Build Information: Version 1.2.6 (SVN Rev 31702)

Copyright 1998-2010 Gerald Combs <gerald@‍wireshark.org> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.18.5, with GLib 2.22.3, with WinPcap (version unknown), with libz 1.2.3, without POSIX capabilities, without libpcre, with SMI 0.4.8, with c-ares 1.7.0, with Lua 5.1, with GnuTLS 2.8.5, with Gcrypt 1.4.5, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built Jan 27 2010), with AirPcap.

Running on 32-bit Windows Vista Service Pack 2, build 6002, with WinPcap version 4.1.1 (packet.dll version 4.1.0.1753), based on libpcap version 1.0 branch 1_0_rel0b (20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.

Built using Microsoft Visual C++ 9.0 build 30729

Wireshark is Open Source Software released under the GNU General Public License.

Check the man page and http://www.wireshark.org for more information.

TCP packets that are sent during the initial SYN-SYN/ACK handshake often, though not always, have TCP Option set to permit the other end to use Selective Acknowledgment (SACK). While this appears to correctly decoded by the current TCP dissector, it is only displayed as a text item on the tcp.options field. From the display filter list there appears to be a defined field called "tcp.options.sack_perm" that is set aside for this purpose, but is not used.

Please change the dissector so that TCP packets that have the "SACK permitted" option set (as per the text field, it probably is the hex sequence 0x04 0x02 in TCP options) set the "tcp.options.sack_perm" field to 1.

The attached pcap file, if this bug is fixed, would be displayed if the following display filter, "tcp.options.sack_perm==1" was applied. Currently it does not.

added oswindows uigtk version1.2 labels

Martin Visser said:

Hi, I have had a bit of read through the code, and come up with a patch that I have built and tested on Linux (Ubuntu using WS 1.2.6 base).

--- packet-tcp.c	2010-03-23 06:36:44.865686812 -0700
+++ packet-tcp-fix-sack_perm.mv.c	2010-03-23 06:20:33.501483019 -0700
@@ -2135,6 +2135,17 @@
     col_append_fstr(pinfo->cinfo, COL_INFO, " %s[%s]", abbrev, val);
 }

+
+static void
+dissect_tcpopt_sack_perm(const ip_tcp_opt *optp, tvbuff_t *tvb,
+    int offset, guint optlen, packet_info *pinfo, proto_tree *opt_tree)
+{
+  proto_item *hidden_item;
+  hidden_item = proto_tree_add_boolean(opt_tree, hf_tcp_option_sack_perm, tvb, offset,
+				optlen, TRUE);
+  tcp_info_append_uint(pinfo, "SACK_PERM", TRUE);
+}
+
 static void
 dissect_tcpopt_maxseg(const ip_tcp_opt *optp, tvbuff_t *tvb,
     int offset, guint optlen, packet_info *pinfo, proto_tree *opt_tree)
@@ -2644,7 +2655,7 @@
     NULL,
     FIXED_LENGTH,
     TCPOLEN_SACK_PERM,
-    NULL,
+    dissect_tcpopt_sack_perm,
   },
   {
     TCPOPT_SACK,
@@ -3913,7 +3924,7 @@
 		    HFILL}},

 		{ &hf_tcp_option_sack_perm,
-		  { "TCP Sack Perm Option", "tcp.options.sack_perm",
+		  { "SACK permitted", "tcp.options.sack_perm",
 		    FT_BOOLEAN,
 		    BASE_NONE, NULL, 0x0, "TCP Sack Perm Option", HFILL}},

Jaap Keuter said:

Committed revision 32273.

closed