The "conversation table" mechanism supports two types of tables, one for
the "Conversations" menu item under "Statistics" and one for the
"Endpoints" menu item under "Statistics". The first of them shows
statistics for conversations at various layers of the networking stack;
the second of them shows statistics for endpoints at various layers of
the networking stack.
The latter is *not* a table of hosts; an endpoint might be a host,
identified by an address at some network level (MAC, IP, etc.), or it
might be a port on a host, identified by an address/port pair.
Some data types, function names, etc. use "host" or "hostlist" or other
terms that imply that an endpoint is a host; change them to speak of
endpoints rather than hosts, using names similar to the corresponding
functions for conversations.
Provide wrapper functions and typedefs for backwards source and binary
compatibility; mark them as deprecated in favor of the new names.
Clean up some comment errors found in the process.
Linux builds were left behind on the Qt transition, presumably because
our Ubuntu CI image does not support Qt6.
Enable Qt6 by default and explicitly disable it for slower or more
conservative Linux distros.
Drop experimental status for Qt6, because we are using it to build
official Windows and macOS releases.
If display filter compilation fails and the expression has a syntax
error and associated location, it will be displayed in the filter
tooltip, using a textual underline.
As far as I can tell using a graphical squiggly underline seems extremely
difficult for an object inheriting from QLineEdit, so the tooltip
textual method was used instead.
If we shortcut the HTTP header check because the file starts with
a non-ASCII character, but we think that it is Continuation Data
because we've seen real HTTP in the same conversation, mark the
data as file data and send it to the follow tap, just as we would
if it failed the more extensive checks for being a header. Deals
with cases where desegmentation isn't performed (whether because
of prefs, missing packets, bad checksums, etc.)
Related to #13918.
According to tvbuff.h, tvb_new_subset_length() with length -1
should behave like tvb_new_subset_remaining(). That means that
the reported length should subtract off the offset into the
original tvb.
Call the Vector Informatik BLF format "Vector Informatik Binary Logging
Format (BLF) logfile", to give more details to people who don't
necessarily know what "BLF" means (British Lung Foundation?).
Note that in the introductory comments to blf.c and blf.h as well.
Note that we should perhaps report unknown flags/packet timestamp type
values as errors or warnings.
Note that we can, and should, report at least some 802.11 radio
information to our caller.
This patch adds the format 2 and 3 of the ObjectHeader, so that the blf
code does not stop reading the file, when one of these header formats is
present.
Minor refactoring was necessary.
Add support for displaying one or more packet hashes that
have been recorded in EPB options.
A patch to add support for EPB hash option is pending for next
DPDK release.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
When calling quic_find_stateless_reset_token, only change the
from_server pointer is the reset token is actually found.
Fixes a few cases where a new Initial connection is sent with
client and server reversed. Also fixes an error failing to
dereference a pointer to a boolean.
ECC_SM4_GCM_SM3 is defined in GB/T38636-2020
Information security technology-Transport layer cryptography protocol
which is a Chinese national standard.
the gcm behaviour of ECC_SM4_GCM_SM3 is the same as TLS1.2.
Added dissections for the following PIDs:
- PID_PARTICIPANT_SECURITY_DIGITAL_SIGNATURE_ALGO
- PID_PARTICIPANT_SECURITY_KEY_ESTABLISHMENT_ALGO
- PID_PARTICIPANT_SECURITY_SYMMETRIC_CIPHER_ALGO
- PID_ENDPOINT_SECURITY_SYMMETRIC_CIPHER_ALGO
ECC_SM4_CBC_SM3 is defined in GB/T38636-2020
Information security technology-Transport layer cryptography protocol
which is a Chinese national standard.
prf alg of ciphersuites defined in GB/T 38636-2020 are the same as TLS1.2.
These IEs were introduced back in 2018, see:
https://gerrit.osmocom.org/q/I93850710ab55a605bf61b95063a69682a2899bb1https://cgit.osmocom.org/libosmocore/commit/?id=1b729ce106f474e29e7bbd57c01c3472e75a8b25
Below is an example PDU containing them:
GSUP SendAuthInfo Request, IMSI: 901700000043352
Message Type: SendAuthInfo Request (8)
IE: IMSI, 901700000043352
Information Element Identifier: IMSI (1)
Information Element Length: 8
IMSI: 901700000043352
[Association IMSI: 901700000043352]
Mobile Country Code (MCC): International Mobile, shared code (901)
Mobile Network Code (MNC): Clementvale Baltic OÜ (70)
IE: Supported RAT Types
Information Element Identifier: Supported RAT Types (41)
Information Element Length: 1
Supported RAT Type: EUTRAN (SGS) (3)
IE: Current RAT Type
Information Element Identifier: Current RAT Type (42)
Information Element Length: 1
Current RAT Type: EUTRAN (SGS) (3)
libbrotlidec and libbrotlicommon show up in `otool -L` without any path
information on the macOS builders, similar to what's described at
https://github.com/google/brotli/issues/934
Try to work around this in osx-app.sh.
Modernize the handling of experimental TCP options based on
RFC 6994. In particular use ExID instead of magic (which
in the context of RFC 6994 are the last two bytes of a
32-bit ExID) and add a desciption of ExID based on the
current state of the IANA registry.
Set G_DEBUG=fatal-criticals environment variable when debugging with
Visual Studio. Setting the environment variable conveniently triggers
breakpoint whenever there is a programmer error.
Roland Knall
Vadim Yanitskiy