ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Making sure a dissector correctly interprets the extra data pass

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 18 Apr 2016 17:23:32 -0700
On Apr 17, 2016, at 5:33 AM, Peter Wu (Code Review) <code-review-do-not-reply@xxxxxxxxxxxxx> wrote:

> Peter Wu has posted comments on this change.
> 
> Change subject: Don't assume the HTTP dissector is being called from the TCP dissector.
> ......................................................................
> 
> 
> Patch Set 2:
> 
> This internal detail unnecessarily changes the external interface. Can't we just check for the parent protocol in the dissect_http?
> 
> Change Ib5138d3a082f1017b7ef190e5128a21eb9a49e92 is an example of a test that was adjusted, but I believe that is the wrong fix as it will break all existing configurations.

There is a problem with the current "extra data" mechanism - there's no enforcement.  Nothing in the Wireshark core checks whether dissector A is getting the extra data it expects to be passed.

If we decide not to support polymorphism, we need to have some way to ensure that, if dissector A expects to be handled the sort of extra data that dissector B passes to its subdissectors, dissector A is *not* called by any dissectors that *don't* do that.

If we *do* decide to support polymorphism, we should have a standard and convenient way to allow dissector A to determine what type of extra data is being passed to it.

It sounds as if you're advocating polymorphism here.  Are you saying that a standard and convenient way to allow a dissector to determine what sort of extra data is being passed to it, by checking the parent protocol?  If so, what is it?