Wireshark-dev: Re: [Wireshark-dev] New dissector: TNEF
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Graeme Lunt" <graeme.lunt@xxxxxxxxx>
Date: Wed, 25 Jul 2007 09:03:53 +0200
Stig,

On 23/07/07, Stig Bjørlykke <stig.bjorlykke@xxxxxxxxx> wrote:

Den 15. jul. 2007 kl. 13.10 skrev Graeme Lunt:

> Stig - can you check what I've checked in still decodes your X.400
> encoded  TNEF?

Works perfect for my X.400 captures.


Thanks.


But the multipart dissector is trying to decode as TNEF if the
"Remove base64 encoding from body" is turned off, which obviously
will fail.  Should this decoding also be turned off?


Not removing the content transfer encoding before passing to the
media-type dissector was the old behaviour.
Whilst I couldn't see a media-type dissector undoing the encoding
itself (or even being given information about the encoding), I hadn't
verified all the media-type dissectors to see if they did actually
handle it.
Consequently I left the behaviour as it was if removing the base64
encoding wasn't selected.
However, I think that the multi-part dissector should probably be
removing all the different content-transfer-encoding and passing the
raw data to the media-type dissector. As you point out, there is then
no point passing the still-encoded media-types to the sub-dissector.

It is something I have on my list to verify.

Graeme