Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 38476: /trunk/epan/dissectors/ /trun
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 11 Aug 2011 10:55:31 -0700
On Aug 11, 2011, at 1:17 AM, sahlberg@xxxxxxxxxxxxx wrote:

> http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=38476
> 
> User: sahlberg
> Date: 2011/08/11 01:17 AM
> 
> Log:
> Regenerate a new updated FRSRPC dissector.
> This dissectors now dissects a whole lot more of the FRS protocol.

...and violate one of the checks in checkapi, namely that you can't have leading white space in a field's long name.

The entry in the IDL that contains the offending field is

        /*****************/
        /* Function 0x01 */
        /* this function always return WERR_CALL_NOT_IMPLEMENTED */
        WERROR frsrpc_FrsVerifyPromotionParent(
                [in,unique,string,charset(UTF16)] uint16 *parent_account,
                [in,unique,string,charset(UTF16)] uint16 *parent_password,
                [in,unique,string,charset(UTF16)] uint16 *replica_set_name,
                [in,unique,string,charset(UTF16)] uint16 *replica_set_type,
                [in] frsrpc_PartnerAuthLevel partner_auth_level,
                [in] uint32 __ndr_guid_size
        );

I assume the generator script converts the IDL field name to a field's long name by replacing underscores with spaces and capitalizing each of the resulting tokens, hence "__ndr_guid_size" becomes "  Ndr Guid Size"; can the .cnf file be used to map it to "NDR GUID Size", for example, e.g. with an HF_FIELD entry?  (It'd be nice if there were a way to override just the name, without overriding any of the field's other attribues.)