Create capture dissector tables.

They are modeled after dissection dissector tables, but for the moment, don't have/need the flexibility.  They are intended to be much simpler/faster than full dissection.
The two most used/needed are "wtap_encap" and "ethertype", so they were the basis of starting to use and test capture dissector table API.  Others may be added in the future.

The "capture dissector" function signature needed a bit of tweeking to handling "claiming" of a packet.
The current application of this is capture functions returning TRUE if they affected a "type" of packet count.  Returning FALSE ends up considering the packet an "other" type.

Change-Id: I81d06a6ccb2c03665f087258a46b9d78d513d6cd
Reviewed-on: https://code.wireshark.org/review/12607
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

1 files changed, 9 insertions, 5 deletions

diff --git a/epan/dissectors/packet-ip.c b/epan/dissectors/packet-ip.c
index 894a461409..77debead48 100644
--- a/epan/dissectors/packet-ip.c
+++ b/epan/dissectors/packet-ip.c
@@ -28,6 +28,7 @@
 #include "config.h"
 
 #include <epan/packet.h>
+#include <epan/capture_dissectors.h>
 #include <epan/addr_resolv.h>
 #include <epan/ipproto.h>
 #include <epan/expert.h>
@@ -566,12 +567,11 @@ ip_defragment_cleanup(void)
   reassembly_table_destroy(&ip_reassembly_table);
 }
 
-void
+gboolean
 capture_ip(const guchar *pd, int offset, int len, packet_counts *ld, const union wtap_pseudo_header *pseudo_header _U_) {
-  if (!BYTES_ARE_IN_FRAME(offset, len, IPH_MIN_LEN)) {
-    ld->other++;
-    return;
-  }
+  if (!BYTES_ARE_IN_FRAME(offset, len, IPH_MIN_LEN))
+    return FALSE;
+
   switch (pd[offset + 9]) {
     case IP_PROTO_TCP:
       ld->tcp++;
@@ -599,6 +599,9 @@ capture_ip(const guchar *pd, int offset, int len, packet_counts *ld, const union
     default:
       ld->other++;
   }
+
+  /* We're incrementing "other", so consider this our packet */
+  return TRUE;
 }
 
 #ifdef HAVE_GEOIP
@@ -3215,6 +3218,7 @@ proto_reg_handoff_ip(void)
   dissector_add_uint("wtap_encap", WTAP_ENCAP_RAW_IP4, ip_handle);
 
   heur_dissector_add("tipc", dissect_ip_heur, "IP over TIPC", "ip_tipc", proto_ip, HEURISTIC_ENABLE);
+  register_capture_dissector("ethertype", ETHERTYPE_IP, capture_ip, proto_ip);
 }
 
 /*