Commit graph

3 commits

Author SHA1 Message Date
Robin Sommer
7344052b50 Changing what's escaped when printing.
With this patch the model is:

    - "print" cleans the data so that non-printable characters get
      escaped. This is not necessarily reversible.

    - to print in a reversible way, one can go through
      escape_string(); this escapes backslashes as well to make the
      decoding non-ambigious.

    - Logging always escapes similar to escape_string(), making it
      reversible.

Compared to master, we also change the escaping as follows:

    - We now only escape with "\xXX", no more "^X" or "\0". Exception:
      backslashes.

    - We escape backlashes as "\\".

    - There's no "alternative" output style anymore, i.e., fmt() '%A'
      qualifier is gone.

Baselines in testing/btest are updated, external tests not yet.

Addresses BIT-1333.
2015-04-15 16:59:50 -07:00
Jon Siwek
b933184b25 Changes related to ICMPv6 Neighbor Discovery messages.
- The 'icmp_conn' record now contains an 'hlim' field since hop limit
  in the IP header is an interesting field for at least these ND
  messages.

- Changed 'icmp_router_advertisement' event parameters.
  'router_lifetime' is now an interval. Fix 'reachable_time' and
  'retrans_timer' using wrong internal Val type for intervals.
  Made more of the known router advertisement flags available through
  boolean parameters.

- Changed 'icmp_neighbor_advertisement' event parameters to add
  more of the known boolean flags.
2012-04-18 13:13:56 -05:00
Jon Siwek
51bad73e1e Fixes for IPv6 truncation and ICMP/ICMP6 analysis.
- Add more guards against trying to analyze captured packets with a
  truncated IPv6 static header or extension header chain.

- Add back in the ICMP payload tracking for ICMP "connections".

- Fix 'icmp_context' record construction.  Some field assignments
  were mismatched for ICMP and ICMP6.  Source and destination
  addresses were set incorrectly for context packets that don't
  contain a full IP header.  Some fields for ICMP6 weren't filled out.

- Changed ICMP Time Exceeded packets to raise the 'icmp_time_exceeded'
  event instead of 'icmp_error_message'.

- Add unit tests for truncation and the main types of ICMP/ICMP6
  that have specific events.

- Documentation clarifications.
2012-04-11 16:27:31 -05:00