rtsp_create_conversation was modified significantly:
- ignore non response calls => process only the complete information
- distinguish between UDP, TCP and RTSP interlaced media
- supports ED137 recording with RTP/UDP or RTP/TCP
It was tested on many samples from bugzilla and from my library.
Tests noted in bug 13257
Bug: 13257
Change-Id: I054505bcb9334c3abfff6d61c18c9cb6d2a6d56e
Reviewed-on: https://code.wireshark.org/review/19341
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
1. CIP Safety: SERCOS Safety Network Number attribute should be 6 bytes. Don't just use all remaining bytes
2. Remove cip_byte_array type. The last remaining usage was #1 above and it really shouldn't be used in the future. Any attribute that would eat up all remaining bytes would have issues with Get Attribute List responses and Set Attribute List requests.
3. Optional Attribute List: Display the attribute name if known.
4. Port: Display Port Number name
5. Port: Associated Communication Objects attribute
Change-Id: I94d99bb1f07aa4b8c44949b2ffb5d75e72483459
Reviewed-on: https://code.wireshark.org/review/19374
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
When a Reply chunk is not present, selecting the "Reply chunk" in
the protocol tree should also select the four bytes of zeroes in
the header. This should work the same way as for the Read list and
Write list.
Change-Id: I0a9b7f927cad21e39189cfc1f2b619537ba26a30
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-on: https://code.wireshark.org/review/19376
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: I70ccf182160086a4c04467eec214857a461a2869
Reviewed-on: https://code.wireshark.org/review/19373
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
the last one
Change-Id: I8b279d11b61645a19b0b356d52cf66eed0180700
Reviewed-on: https://code.wireshark.org/review/19372
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: I4d1cf878245b03665207a500fb7593be1435c3d3
Reviewed-on: https://code.wireshark.org/review/19371
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Part 2...
Change-Id: Id219bd2b04de2003b5bfa4a33893d0310856275d
Reviewed-on: https://code.wireshark.org/review/19368
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The "short_name" parameter of heur_dissector_add is defined as const
(and was assumed to be a string literal). This was no longer the case
though since a change in Lua where "short_name" is a dynamically
allocated string.
This "simple" fix clones the memory for internal use to avoid a
heap-use-after-free when heur_dissector_delete tries to access
"short_name".
An alternative option is to make Proto_register_heuristic track the
memory, but since there are multiple possible heuristics lists for a
protocol, the Proto (struct _wslua_field_t) structure is not
appropriate. A possible working alternative is to store the string into
lua_heur_dissectors_table_ref (replacing the value (function) by a tuple
{function,short_name}).
Change-Id: I6c6b393f4d304dd847e864da6ad17b54c8cd80e2
Fixes: v2.3.0rc0-1474-g7f2a838922 ("lua: Allow proto:register_heuristic to be used on multiple list names")
Reviewed-on: https://code.wireshark.org/review/19365
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Franklin Mathieu <snaipe@diacritic.io>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
This commit introduces a new dissector aimed at decoding the USB
protocol used by X-Rite i1 Display Pro (and derivatives) colorimeter. It
is based on reverse engineering work by Graeme Gill from the ArgyllCMS
project.
Change-Id: Icdfd0c3f75499d0df4360c6eb6856078de30ba56
Reviewed-on: https://code.wireshark.org/review/18901
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Add preference in Infiniband dissector to distinguish between
heuristic and non-heuristic dissection (that uses Decode As).
Remove all of the preferences in the Infiniband subdissectors that
tried to put in "manual" heuristics and direct users to just use
Decode As. Most subdissectors still kept some basic heuristics in
their heuristic functions, but now also register with the Infiniband
dissector table for "manually" forcing dissection with Decode As.
Ping-Bug: 13259
Change-Id: I20d56eee38887664b439e52ec5f5b8f962c45ef1
Reviewed-on: https://code.wireshark.org/review/19362
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
This decouples EAPOL from the few dissectors it needs to call based
on packet type and moves registration to the dissectors themselves.
Change-Id: Ia8412fe33370f4aeece52c2c80cda7f140a950cf
Reviewed-on: https://code.wireshark.org/review/19328
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Ping-Bug: 12759
Change-Id: Ic4d47155168978541fb8c3670fcabaf3c35f8aad
Reviewed-on: https://code.wireshark.org/review/19187
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Resolves truncation warnings on the x86 clang build
Change-Id: I14ebbe39b8235bd1b909c488c0402b77deb6dde1
Reviewed-on: https://code.wireshark.org/review/19354
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Add WinSparkle can_shutdown and shutdown_request callbacks which are
called prior to running the installer. Reject updates when we have
unsaved information. Add notes about possible improvements.
Ping-Bug: 9687
Ping-Bug: 12989
Change-Id: Ia126244b311417aa3105ea8136f186adc2745445
Reviewed-on: https://code.wireshark.org/review/19244
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add handling of STR_ASCII and STR_UNICODE as base types for string
and stringz. Add handling of SEP_DOT, SEP_DASH, SEP_COLON and
SEP_SPACE for bytes and uint_bytes. Add SEP_NONE for completeness.
Change-Id: Ida46c215fee7ec7132ec91ab5dd6cb3de4628920
Reviewed-on: https://code.wireshark.org/review/19337
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
Fixes Lua on macOS, tested with an out-of-tree build:
WS_BIN_PATH=$PWD/run ../wireshark/test/test.sh -s wslua
Previously programs that were ran from the build directory would load
data files (radius/, diameter/, init.lua) from the source directory.
Then in the case of Lua, files were loaded from the program directory
($BUILDDIR/run/init.lua on Linux) or source directory
(sSOURCEDIR/epan/wslua/console.lua).
On macOS, this does not work for Lua since files are installed into
$BUILDDIR/run/Wireshark.app/Contents/Resources/share/wireshark/init.lua
instead. Since CMake always copies data files (radius, console.lua,
etc.) into the build directory, make get_datafile_dir() return this
"run" directory instead.
Change-Id: If97d2f5686271caf9ad4d4e4fc58e902dc592a98
Reviewed-on: https://code.wireshark.org/review/19330
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Add support for using unit names in ProtoField integer types by
using base.UNIT_STRING.
Add unit name table argument in ProtoField.float() and
ProtoField.double() (and made backward compatibility).
The use of base.UNIT_STRING is not really the best API for adding
unit names in Lua, but is the simples solution without adding new
arguments to ProtoField.
Change-Id: Ib5d064480cffd970a41db1764440642f6c593bb2
Reviewed-on: https://code.wireshark.org/review/19313
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
They've been set to the manpage of the local filesystem.
Ping-Bug: 13218
Change-Id: Iacd5d2ba7ae39ee1718b59747c245d1c07785e8f
Reviewed-on: https://code.wireshark.org/review/19179
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Add a convenience btle.length field for easier filtering of BTLE
packets without data and with specific length ranges.
Change-Id: If56eac9c86ccf40741a6ceb50d13a1733132f448
Reviewed-on: https://code.wireshark.org/review/19348
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michal Labedzki <michal.tomasz.labedzki@gmail.com>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
This will have to be done differently with xlc if it's necessary.
While we're at it, fix the spelling of "Cygwin" (no InterCaps).
Bug: 13262
Change-Id: If3084cfb58f4abd9048afafecdd24c13645c2776
Reviewed-on: https://code.wireshark.org/review/19355
Reviewed-by: Guy Harris <guy@alum.mit.edu>
The introduction of pcap_list_datalinks() predates the introduction of
PCAP_ERROR, so the presence of pcap_list_datalinks() doesn't guarantee
that PCAP_ERROR is defined. Change the use of PCAP_ERROR when checking
the result of pcap_list_datalinks() to just check for -1.
Change-Id: Id8229b7aebd02eaf3701983f9343503397af4fb3
Reviewed-on: https://code.wireshark.org/review/19351
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Also added a note above field_display_e enum to indicate that this
values are parsed in make-init-lua.pl to build init.lua.
Change-Id: Ibd125684f9a68e1b8116fae0ccbc72147825d75d
Reviewed-on: https://code.wireshark.org/review/19336
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
1. Convert the Mellanox encapsulation header into a heuristic dissector.
2. Convert EtherType header dissection into a heuristic dissector.
3. Convert "heuristic preferences" to use deprecated_heur_dissector_pref.
Ping-Bug: 5061
Ping-Bug: 2672
Change-Id: Iabcac1af8e07f3f6f25f825ed56b2036c3285783
Reviewed-on: https://code.wireshark.org/review/19317
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: I9d9ffdb7d32a940dbe155e82946d59f649cafe09
Reviewed-on: https://code.wireshark.org/review/19345
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
BDAT handling takes the whole packet to add to its count of necessary
bytes, but wasn't updating the offset, so if a BDAT "data packet" had
multiple CRLF segments in it, the BDAT byte counter became inaccurate.
Bug: 13030
Change-Id: Idd44ccb95a8f4710db4546a918661c63a343260c
Reviewed-on: https://code.wireshark.org/review/19343
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
This script mimics tools/debian-setup.sh for RPM based systems.
It installs all the required and optional packages to compile
Wireshark. Tested on Centos 7, Fedora 25, openSUSE Leap 42.1.
Change-Id: Ifc55f45608e5f5a74188d4fb5612bedb6437fcb1
Reviewed-on: https://code.wireshark.org/review/19088
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Set STAT_FLAG_WRONG_TIMESTAMP for RTP sequence when newer packet has lower timestamp than previous one.
Change-Id: Ib18830eea33ddb3dbbdf3beba279131c0fc5a948
Reviewed-on: https://code.wireshark.org/review/19292
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Problem is in 2.0 and master. It is probably in 2.2 too.
Change-Id: Iaa8adea788dcd5da7cff32d56d483a1e7d52d226
Reviewed-on: https://code.wireshark.org/review/19340
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The time-based moving average code should use a constant window size
as the denominator when calculating throughput.
Added QDoubleSpinbox widget to choose the time-based moving average size.
Also added (optional) ability to select ACK (reverse) packets as well as data
packets when clicking on the base graph.
(useful, for example, when examining SACK or DSACK packets)
Added CheckBox widget (with tooltip) for user to choose ACK selection
Change-Id: Ib3ba4f9be9e30aa8f3088b0b2d48b4ca214f7cc3
Reviewed-on: https://code.wireshark.org/review/19108
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Change-Id: I93b24285443d99799f83c40f61f413c2d106c85f
Reviewed-on: https://code.wireshark.org/review/19338
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Because luaL_argerror() does a longjmp all memory free must be done
before calling this.
Also rewrote true_false_string_from_table() to be a bit simpler
and to give argument error when too many strings in the table.
Change-Id: Ied0fa468f1274155c746fe2e086dacf1a8582b08
Reviewed-on: https://code.wireshark.org/review/19325
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
But is observed in 2.0 and later branches.
Change-Id: I46fcbb33824d30bac1999e1b61d9c249972d17f0
Reviewed-on: https://code.wireshark.org/review/19316
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add "LE Set Extended Advertising Data",
"LE Set Extended Scan Response Data", and
"LE Set Extended Advertising Enable" command parser.
Change-Id: I3027dc9c213c15f503fa5495829726db3a207300
Reviewed-on: https://code.wireshark.org/review/19251
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Burst 4 and Burst 5 values are now properly decoded.
Change-Id: I6232a19eb849a419825be69435069e4be721cbc1
Reviewed-on: https://code.wireshark.org/review/19327
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Jiri Novak