Remove unneeded prefs callback in prefs registration;
Remove 'if (!initialized)' test from proto_reg_handoff...();
Remove unneeded #include;
Do some whitespace cleanup.
svn path=/trunk/; revision=37327
the TVB.
Introduce and start using tvb_get_manuf_name() and tvb_get_manuf_name_if_known()
which do the same as the non-tvb versions but take a tvb and an offset instead
of (commonly) a pointer into a TVB.
svn path=/trunk/; revision=37317
names beginning with dissect_qspi_, and give some of them names with the
info level structure in them rather than the SNIA CIFS specification
section number.
Have separate routines for SMB_INFO_STANDARD and SMB_INFO_QUERY_EA_SIZE;
SMB_INFO_STANDARD is specified differently in the SNIA CIFS
specification and the MS-CIFS specification, and some captures have the
SNIA CIFS version, with the EA length and some have the MS-CIFS version
without it. The dissector for SMB_INFO_STANDARD will dissect it if it's
there and not say "this structure is truncated" if it's not there.
Rename dissect_qfi_SMB_FILE_ALTERNATE_NAME_INFO() to
dissect_qfi_SMB_FILE_NAME_INFO(), as it also dissects
SMB_QUERY_FILE_NAME_INFO.
Merge the dissectors for SMB_FILE_ALLOCATION_INFO and
SMB_SET_FILE_ALLOCATION_INFO, and for SMB_FILE_END_OF_FILE_INFO and
SMB_SET_FILE_END_OF_FILE_INFO, as the structures are the same.
Dissect some presumed "passthrough info levels" the same way the
corresponding official SMB infos are dissected.
Expand some comments for info level dissectors to give the MS-CIFS
section number and to give some other details.
If an info level is truncated, put in an expert info error.
If we don't know about a given info level, just dissect the body as
"Information level unknown", rather than having it dissected as an
"unknown information" trailer.
svn path=/trunk/; revision=37297
include packet-smb.h in packet-smb.c so that we check the declarations
against the definitions.
In query ops, info level 2 is Query EA Size, not Query EAs From List.
In set ops, info level 2 is Set EAs, not Query EA Size.
Expand the constants for the Trans2 subcodes to 16 bits.
The tvb argument to dissect_find_file_unix_info2() is used.
svn path=/trunk/; revision=37286
file. Found by Martin's patch on the -dev list.
Add a comment to answer the question of whether this file is autogenerated by
pointing to the IDL file.
svn path=/trunk/; revision=37261
* Fix a duplicate value_string in cp_version table
* Fix a typo error (Cersion => Version)
Also fix some whitespaces/4tab-spaces (Need more work...)
svn path=/trunk/; revision=37240
Further research shows that registering the dissector
to "tcp.port" and "udp.port" was explicitly removed in SVN #34969
and thus the code to create tcp and udp handles and the associated
dissect_reload_tcp() and dissect_reload_udp() code is no longer
needed.
svn path=/trunk/; revision=37231
if the preference is set.
Add %d to the "not found" string in val_to_str() calls.
Upgrade the "ITU address format seen in ANSI" expert info from NOTE to WARN.
svn path=/trunk/; revision=37218
digits.
Since we now have a subtree from which to hang things, make the generic (called
or calling) digits fields visible under this new subtree (one less hidden item).
Don't use add_string_format() to add the GT digits, let epan format it for us.
Use more descriptive field descriptions for these entries.
svn path=/trunk/; revision=37214
NULL-return check.
Use val_to_str_const instead of val_to_str() in a couple places where the string
is constant.
Use val_to_str() instead of blindly passing the return value from match_strval()
into a format routine (to ensure a non-NULL string pointer). A couple of these
were cases where it could not actually return NULL, but I changed it for
consistency.
Store the return value of match_strval() rather than calling it repeatedly.
svn path=/trunk/; revision=37204
NULL-return check.
Use val_to_str_const instead of val_to_str() in a couple places where the string
is constant.
Use val_to_str() instead of blindly passing the return value from match_strval()
into a format routine (to ensure a non-NULL string pointer).
svn path=/trunk/; revision=37202
present only if the NTLMSSP_NEGOTIATE_VERSION flag is set in the flags
field, and that appears to be true in at least one capture I've seen.
svn path=/trunk/; revision=37197
Get rid of null-pointer tests for t2i in the "not null" branch of an
earlier test whether it's null, as those tests are redundant.
Use a switch statement to check the subcommand for Trans2.
If t2i->info_level is -1, it means we don't know the info level, for
whatever reason (e.g., the request was cut short by the snapshot length
before the info level). Report it as such.
svn path=/trunk/; revision=37183
Read unchanged packets of v12 as v10 packets
Read unchanged packets of v13 as v11 packets
Use version in packet type definitions
svn path=/trunk/; revision=37142
and Set File.
Add Query and Set File Unix Info2; use common code to dissect the Unix
Info2 structure. Use common code for Unix Basic, while we're at it.
svn path=/trunk/; revision=37138
1. Reload framing protocol no longer encapsulates the Reload message, instead
the latter is in its own tree following Reload framing, much like IP, UDP, etc.
2. Similarly, DTLS no longer encapsulates its data payload if the payload can
be dissected. The recognized payload is in its own tree following the DTLS,
much like IP, UDP, etc.
4. DTLS now has its own heuristic table for dissecting its payload, and
reload-framing is added to this DTLS heuristic table.
6. DTLS will try to dissect its payload if the agreed upon cipher is
RSA-NULL-MD5 (0x0001) or RSA-NULL-SHA (0x0002), even when DTLS is not
configured with the client/server private keys.
Still to do: make DTLS a heuristic dissector on top of UDP (item 3 in the bug).
svn path=/trunk/; revision=37110
Fix compilation if we HAVE_LIBGNUTLS but we do not HAVE_LIBGCRYPT. (The
former can be built using libnettle instead of the latter.)
svn path=/trunk/; revision=37102
committed a variation of his patch that deleted unused variables rather than
#if 0'ing them out, and I also kept dissect_dnp3_al()'s return values, even if
it's not currently being checked, just in case the commented code is ever
uncommented and the return value ends up being checked later on. Lastly, I
also added what appeared to be some missing DNP3_AL_UNS's.
svn path=/trunk/; revision=37100
Add a new tap flag to indicate that a tap listener is just a "dissector helper",
that is, a tap which is used by a dissector to help it do its dissection but
does not, itself, require dissection.
Use this new flag in the dissectors which register taps.
Remove the (now-unused) have_tap_listeners() function.
svn path=/trunk/; revision=37069
5. A guaranteed null pointer access violation is fixed in packet-ssl-utils.c
when DTLS succeeded in dissecting its payload.
svn path=/trunk/; revision=37058
- Put back the hf_ variables removed from the last patch
- Change the verbose protocol name to the (now) official spelling "VLAN
Trunking Protocol" instead of "Virtual Trunk Protocol"
- Made the "Info" column more informative by placing the message type and
selected key information into it, instead of just the verbose protocol name
- Corrected an error in the handling of the Advert-Request message where the
Management Domain Name field was not parsed properly, resulting in wrong
parsing of the remainder of the entire Advert-Request message
svn path=/trunk/; revision=37056
Don't use "link destination" for file names in SMB_FIND_FILE_UNIX.
Link to the page for Microsoft's public protocol specifications and to
the Samba Wiki page for the UNIX extensions.
Fix a typo in a variable name.
svn path=/trunk/; revision=37023
LINKTYPE_USERn encapsulation with a protocol name - even if the protocol
name was valid at the time the entry was made, it might not be valid now
(e.g., if you no longer have a plugin), *and* the protocol lookup done
in the UI is case-insensitive but the lookup done later is
case-sensitive (this needs to be cleaned up somehow).
For now, just handle the case where encap->payload_proto is NULL.
svn path=/trunk/; revision=37020
* Remove proto_tree_add_eui64 function from 802.15.4 Dissector
* Replace print_eui64/print_eui64 by eui64_to_str/get_eui64_name
* Update Documentation (README.dev)
* Add new function in libwireshark.def
* Support of encoding for tvb_eui64_to_str
* Use FT_EUI64 for ICMPv6, CAPWAP, Zbee ... dissector
svn path=/trunk/; revision=37015
ASN.1 files in trunk/asn1/qsig contain syntax errors that prevent them from
being compiled by a standard ASN.1 compiler. A patch of modified files is
attached along with General-Error-List.asn which was missing completely.
From me: add the new asn file to the list of source files. Add SVN Id tag to
the new file.
svn path=/trunk/; revision=37005
Add support for VTP Join messages.
From me: rather than add the first and last VLANs with separate hf_ variables
and the masked ones with proto_tree_add_text(), use one hf_ variable for all the
VLAN IDs.
svn path=/trunk/; revision=37004
- Use "RELOAD" everywhere.
- Fix invalid variable name "reload_framing.probe_information.type".
- Fix various names to match the spec.
- Dissect the X.509 certificate embedded in RELOAD messages.
- Use tls_signature_algorithm and tls_hash_algorithm tables in
packet-ssl-utils.
From me: take out the tabs. Keep the long dissector name when registering the
protocols.
svn path=/trunk/; revision=37003
Add an expert check for the MS Classmark 2 decoding in UE EUTRA Capability message and a few missing message type display in the column text.
svn path=/trunk/; revision=36984
and without causing us to potentially run into bug 3834.
Add a couple hf entries for things that had been added with add_text().
svn path=/trunk/; revision=36946
the dissection of the UE capabilities when the RAT
type is set to geran-cs (the value part of Classmark 2 starts at the third byte).
Moreover it adds a subtree to enhance the display of Mobile Station Classmark 2 and 3 and MS Radio Access Capability IEs.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5867
svn path=/trunk/; revision=36943
Define all internal fcns as static;
fragment_table_init() & reassembled_table_init() need to be
called form a registered_init fcn;
proto_register... and proto_reg_handoff should be at the end of the file as
per Wireshark convention;
proto_reg_handoff .... doesn't need 'if (initialized)...';
proto_register... doesn't need 'if (proto_mux27010 == -1)...'
svn path=/trunk/; revision=36935
This patch registers a dissector table to allow other dissectors to register as
subdissectors for modbus/tcp data.
Additionally it registers the dissector, so it can be invoked by another
dissector by name.
Additionally this version of the patch adds the Data field not as a text field,
but rather as a field which can be selected and tested for by name.
svn path=/trunk/; revision=36925
This should not trigger with any Babel packets generated by the current
version of babeld, but could potentially do so with a future version
that performs more aggressive compression for IPv4 addresses.
svn path=/trunk/; revision=36920
calculate the rate is present.
Don't put the rate in for MCS indices in the Rate field - we need not
only the MCS index but the bandwidth (20 MHz vs. 40 MHz) and the length
of the guard interval. Note in a comment that those other items *might*
be available from some other radiotap fields.
Expand a comment on the hack to try to figure out whether a Rate field
with the 0x80 bit set is a FreeBSD MCS index or a high data rate.
svn path=/trunk/; revision=36916
Use #if 0/#endif to comment out some code instead of using /* */;
Use consistent indentation & do some whitespace cleanup.
svn path=/trunk/; revision=36914
Some fixes for 'set but not used' errors that GCC 4.6 emits.
From me:
Do some (minor) whitespace cleanup and re-formatting.
svn path=/trunk/; revision=36908
Some fixes for 'set but not used' errors that GCC 4.6 emits.
From me:
#include <stdlib.h> not req'd;
Do some whitespace cleanup.
svn path=/trunk/; revision=36906
Some fixes for 'set but not used' errors that GCC 4.6 emits.
From me:
Remove uneeded #include <stdlib.h>, <gmodule.h>;
Do some whitespace cleanup.
svn path=/trunk/; revision=36902
This patch adds support for getting the pre-master secret of a TLS
connection from a log file. Currently Wireshark can decrypt and TLS
connection only if it has the server's private key.
I commonly have a use case where I control the TLS client, but not the
server. In order to decrypt in this case, I've added support to NSS
(used by Chrome and Firefox) to log the keys to a file on disk:
https://bugzilla.mozilla.org/show_bug.cgi?id=536474
Given this file, Wireshark can then decrypt the resulting TLS connections.
The format is such that Wireshark opens and linearly scans the file each
time it sees a ClientKeyExchange. If the key log grows too large, this
is pretty inefficient. However, it's simple and the number of
interesting TLS connections when debugging is usually very small.
svn path=/trunk/; revision=36876