Wireshark · Wireshark-dev: Re: [Wireshark-dev] Making oui_base_custom available more generally

[Richard Sharpe <realrichardsharpe@xxxxxxxxx>]

On Sat, Aug 19, 2017 at 8:10 AM, Michael Mann via Wireshark-dev
<wireshark-dev@xxxxxxxxxxxxx> wrote:
> I don't know exactly how far BASE_CUSTOM goes back, but it is for "custom"
> display of a field.  But if there are enough fields with the same "custom"
> formatting, it's probably time to make it a field type (or add BASE_ type)

OK, it does go back that far.

In looking at adding FT_OUI, some of it is obvious, but I am not sure
what this code is doing in proto_item_fill_label

                case FT_ETHER:
                        bytes = (guint8 *)fvalue_get(&fi->value);

                        addr.type = AT_ETHER;
                        addr.len  = 6;
                        addr.data = bytes;

                        addr_str =
(char*)address_with_resolution_to_str(NULL, &addr);
                        g_snprintf(label_str, ITEM_LABEL_LENGTH,
                                   "%s: %s", hfinfo->name, addr_str);
                        wmem_free(NULL, addr_str);
                        break;

and I suspect that the code I need to add is more like this:

                case FT_OID:
                        bytes = (guint8 *)fvalue_get(&fi->value);
                        name = oid_resolved_from_encoded(NULL, bytes,
fvalue_length(&fi->value));
                        tmp = oid_encoded2string(NULL, bytes,
fvalue_length(&fi->value));
                        if (name) {
                                label_fill_descr(label_str, 0, hfinfo,
tmp, name);
                                wmem_free(NULL, name);
                        } else {
                                label_fill(label_str, 0, hfinfo, tmp);
                        }
                        wmem_free(NULL, tmp);
                        break;

with oid_resolved_from_encoded etc replaced with
get_manuf_name_if_known and a few other changes.

Does that seem reasonable to you?

There's a couple of other places in there where I am not sure what is
going on, but I can stumble through ...



-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)