pretty horrible hack to store an ntlmssp blob inside an ldap string
the info column is not entirely pretty but the payload is at least decoded
svn path=/trunk/; revision=19490
I did improve the OID management in the tcap dissector.
Now, when a tcap message is reveived, without upper layer, the ACN is saved in the TCAP context, and can be used for the next messages of the dialogue. It is used only when the upper layer session is opened with Tcap only messages.
svn path=/trunk/; revision=19414
few things to be fixed:
- // comments,
- not every hf_xxx used might be registered
some packages from the current h248 dissector are still missing.
svn path=/trunk/; revision=19407
This is used to display the field underlined and to allow the user to double-click on it (like FT_FRAMENUM) to open the URL in the configured browser.
Example usage in the x509ce and logotype certificate extensions.
svn path=/trunk/; revision=19383
Here are some patches and a new module to introduce the notion of Tcap context for a Tcap transaction. For each Tcap transaction, several parameters, like session identifier, start time or OID, will be saved in a hash table, to keep these informations available for the next messages. This context is then given to the upper layer, and can be used, for example, to generate transaction-associated statistics.
Moreover, the Upper protocol, detected in the Begin of the TCAP transaction ( according to the OID ), is saved in the context, and will be reused for the next messages of the transaction. This help the decoding of SS7 messages, without any SSN configuration in the "wireshark preferences".
You will have too, the possibility to apply a filter to see only the messages related to a TCAP transaction. (tcap.srt.session_id=XXX)
To enable the use of the Tcap context, you have 2 new parameters in the preferences,
- SRT, enable search for a Tcap context for any TCAP messages
- persistentSRT, keep the Tcap context, even after the transaction has been closed. This is mandatory with Wireshark, to have a clean display of the stats.
There is 2 new timers in the preferences for the statistics, to tune the retransmission timeout, and messages lost timeout.
svn path=/trunk/; revision=19341
This patch makes the the maximum valid LDAP PDU size a preference. The default value for this new preference is 65535 for backwards compatibility.
svn path=/trunk/; revision=19288
In dissect_geographical_description the longitude is multiplied by 260
and should be by 360(degrees).
Also it would be good to display to 5 decimal places.
svn path=/trunk/; revision=19260
This patch will add the following functionality to the H.248
dissector:
1. Dissection of properties from Annex C.11 SDP equivalents.
2. Dissection of EventNames and SignalNames from Annex E Basic
Packages.
3. Dissection of event and signal parameters from Annex E.9 Analog
Line Supervision Package.
4. Dissection of statistics from Annex E.11 Network Package and
Annex E.12 RTP Package.
svn path=/trunk/; revision=19136
patch to implement the decoding of the GPRS reference. The specific oid for the CAP-GPRS-ReferenceNumber is attached to a decoding function in the camel module.
svn path=/trunk/; revision=19108
- register H.225.0 over TLS (configurable port 1300)
- register SIP over TLS (fixed port 5061)
- new function proto_tree_get_root()
svn path=/trunk/; revision=19059
make mms bitstrings easier to read
--
Hi, this is my new mms with some changes in order to display some data in
binary instead of hex.
Excuse me because is not a diff from the repository, but I don't know how to
create a diff.
I also have the compiled packet-mms.c and packet-mms.h if you want it only
mail me.
svn path=/trunk/; revision=18974
use tcp_dissect_pdus() which works insterad of trying to do the pdu tracking and signalling for reassembly manually.
This makes ldap pdu tracking and reassembly work properly for cases when hosts are streaming lpad over tcp and there is little or none alignlemt of pdus to the start of a segment
svn path=/trunk/; revision=18965
provided by markdrago@mail.com.
Me: Patch template files instead and regenerate the dissector files.
Fix Makefiles to use the correct asn filenames.
svn path=/trunk/; revision=18866
also change the name of one of the strings we keep around since it is more generic than just used for attributeassertions
svn path=/trunk/; revision=18841
fix for h450 to prevent an assertion for uninitialized hffields
Thanks for the capture, Keith. The problem was with h450 hf fields that
weren't initialised sucessfully (at all in one case, or with non-unique
filter strings in several others) - it was hitting an assertion in proto.c
when an attempt was made to use those fields.
I was able to test by editing packet-h450.c directly, I couldn't regenerate
it from packet-h450-template.c. I'm attaching a patch to
packet-h450-template.c that hopefully does the same thing. If someone can
generate and check it packet-h450.c in for me I'll retest.
svn path=/trunk/; revision=18804
special case some common special attributes such as DomainSid and DomainGuid
and dissect them as SIDs and GUIDs
examples of these special attributes can be seen in Xiaoguang Liu's email to wireshark dev
svn path=/trunk/; revision=18719
Fix a bug introduced recently in packet-rpc.c.
Replace DISSECTOR_ASSERT() with THROW(ReportedBoundsError) in my recent
checkins, since fuzz-test.sh sets WIRESHARK_ABORT_ON_DISSECTOR_BUG.
svn path=/trunk/; revision=18693
this also removes several small memory leaks through get_oid_name and get_oid_str_name where the callers nevber freed the data
svn path=/trunk/; revision=18647
ldap and ldap+sasl
remove a recent ber length validation in packet-ber.c that cant work and breaks reassembly and also makes all ber pacvket sspanning multiple segments show up as malformed packets.
svn path=/trunk/; revision=18465
make the display of the filters more similar to how the ldap c api represents
filters and how they are commonly represented in documentation and other texts.
svn path=/trunk/; revision=18449
Check for printable ASCII - 0x7F is >= 0x20, but it's not printable, and
0x80 through 0xFF aren't ASCII.
Note that we should perhaps be using RFC 2252-style schemas to figure
out which attribute and assertion values are text and which are binary.
svn path=/trunk/; revision=18447
H225.cnf
I noticed is that the voip call flow graph does not have a label for the setupAck packet. I traced this to the empty frame_label.
voip_calls.c
It seems to me that in gtk/voip_calls.c tmp_h323info->guid is pointer itself, therefore:
memcmp(&tmp_h323info->guid
should in fact read:
memcmp(tmp_h323info->guid
svn path=/trunk/; revision=18304
- h245.asn renamed to MULTIMEDIA-SYSTEM-CONTROL.asn
- rollback changes in .asn sources to keep them in original ITU-T form and put necessary changes into .cnf files
- PER dissectors regenerated
svn path=/trunk/; revision=18238
While in 3GPP spec, the last two (Down/up nextPDCP-PDU seq. no.) would be 2
BYTES. So ethreal could not read the message correctly. We have to modify the
log to make Ethreal analysis it.
Add disection of TargetID.
svn path=/trunk/; revision=18228
- step to new ASN.1 API - pass asn_ctx_t* through PER dissectors instead of packet_info*
- PER ALIGNED/UNALIGNED flag moved to asn_ctx_t
- PER created tree item pointer moved to asn_ctx_t
- add nbap into PER dissectors in asn1/Makefile.nmake
- use add_oid_str_name() instead of register_ber_oid_name() in H.225 and H.245
- export asn_ctx_init from library
- PER dissectors regenerated
svn path=/trunk/; revision=18209
- remove obsolete -X option from makefiles
- not generate enumerated map table for BER
dissector will be regenerated later
svn path=/trunk/; revision=18199
zero-length - oid_to_subid_buf() can be called when we're not in the
middle of a dissection, and throwing a "dissector bug" assertion in that
case is itself a bug.
svn path=/trunk/; revision=18164
Most of the time AssertionValue will contain an ascii string so make it always display as a string to make the display "correct" most of the time insterad of being "wrong" most of the time.
There are situations when AssertionValue contains binary data though and in those cases the display will be "wrong" (but not more wrong than the old dissector anyway)
What someone really should do (someone interested in ldap that is) to make it more correct would be to implement a dissector for AssertionValue in the template file and having the dissector check if any of the bytes of the octet string has a value <32 and if so display it in hex as 0x.....
It all bytes have values >=32 then it shoudlk display it as a string "...
instead.
Someone interested in ldap may spend time on this refinement.
svn path=/trunk/; revision=18089
Change "cd.." to "cd .." - I don't know whether they're equivalent, but,
if they're not, the former probably won't work.
svn path=/trunk/; revision=17997
I tried out the 0.99.0pre1 release and I noticed that all my SCCP management messages (on SSN==1) were getting decoded as TCAP. Turns out that the INAP dissector (due to a bug) registers to SSN==1 by default (instead of 106 and 241). Rather than just fix that bug, the attached patch modifies the INAP dissector to use a range preference (like GSM MAP, TCAP, etc.).
svn path=/trunk/; revision=17945
883 checkIMEIres dissection Error in GSM MAP - branch needed for v1,v2 on Response as well
884 The "absentSubscriberParam" can not be dissected in gsm-map - missing IMPLICIT.
svn path=/trunk/; revision=17926
Here is a patch for gsm_map dissector that adds USSD string decoding (mainly used in processUnstructuredSS-Request, UnstructuredSS-Request, UnstructuredSS-Notify). For now, it assumes that it will be GSM 7 bits.
It re-use packet-gsm_sms.c "gsm_sms_char_7bit_unpack" and "gsm_sms_char_ascii_decode" functions, as well as packet-smpp.c "smpp_handle_dcs" function.
svn path=/trunk/; revision=17739
while this should improve performance by unmeasurably little it does have the sideeffect that once we finish the rewrite tcp analysis might actually work and work well even for tcp over tcp tunnelling.
this also means that if you include packet-tcp.h you also need to include emem.h .
svn path=/trunk/; revision=17681
of 16 bytes. Use "sizeof" for the size of e_guid_t's, and use structure
assignment to copy GUID values.
Make functions such as append_h225ras_call() and new_h225ras_call() take
pointers to e_guid_t's as arguments.
Define GUID_LEN in epan/guid-utils.h and use it as the length of a GUID
in a packet. (Note that "sizeof e_guid_t" is not guaranteed to be 16,
although it is guaranteed to be the size of an e_guid_t.)
When constructing a display filter that matches a GUID, use
guid_to_str() to construct the string for the GUID.
svn path=/trunk/; revision=17676
(you don't have to worry about comments in #if 0'ed otu code), and it
also fixes an unclosed comment (the commenting-out ended with /* rather
than */).
Fix up some indentation as well.
svn path=/trunk/; revision=17434
a patch for the VoipCalls to fix a couple of issues:
- a problem with the RTP Events (RFC2833) not been handle correctly
- Display the RTP stream in time order when the setup frame is after the
RTP stream.
- fix a init issue that caused the H245 packet to not been displayed
correctly.
svn path=/trunk/; revision=17384
Add the same workaround used in packet-ftam.c for the bad handling of the asn "IMPLICIT SEQUENCE", in the packet-gsm_map-template.c. This patch concerns Map V3 messages, not correctly decoded with the previous workaround "offset=offset+2".
Change a parameter for Provide Roaming Number decoding.
Add a decoding fonction for "Channel needed" parameter to avoid a decoding error for Paging messages
with a change to actually dissct channel needed.
svn path=/trunk/; revision=17350
The attached patch should fix bug 742.
The issue is (at least, I think so...) in the packet-x509af dissector
A null pointer is passes as parameter of a " %s " format string.
svn path=/trunk/; revision=17317
separate buffer. Fixes the current Buildbot failure.
Don't let the sprint_realloc_* functions reallocate ep_allocated memory.
Add comments warning against this in the future.
In emem.c, make sure we don't use an extra 100k every stinkin' time
someone wants to allocate memory when debugging is enabled.
Fixup whitespace.
svn path=/trunk/; revision=17051
Here is a patch that:
- Replaces the arrow labels by the beginning of the COLINFO column if available (usually containing message names/types).
- Change the comment area to be "protocol: colinfo_content"
From Anders
Added ID tag
Camel
Use col_set_str to remove TCAP info in col_info
svn path=/trunk/; revision=16975
- Keep track of terminations (link wildcarded ones to real ones)
- Keep termination info and link aal2 terminations to alcap legs
svn path=/trunk/; revision=16914
- Editcap
Mikko Tiihonen filed bug 379 including a patch for editcap. This wasn't picked up so far. I've ported the patch to svn 16820 and included a documentation patch.
-packet-ieee80211.c
Radek Vokal of RedHat filed a bug found by Vladimir Kondratiev of Intel in the 802.11 dissector. Radek provided a sample capture and Vladimir a oneliner patch. I've ported the patch to svn 16820 and tested it against the provided capture. Works well.
-From Kan Sasaki
A patch for packet-ospf.c is attached:
- Fix the handling of the DN-bit of options field.
- Add a new function dissect_ospf_bitfield() to dissect a bitfield
such as options, flags. The following functions are merged by
using this function.
- dissect_ospf_lls_extended_options()
- dissect_ospf_dbd()
- dissect_ospf_options()
- dissect_ospf_v3_prefix_options()
- dissect the flags and prefix-options bitfield.
- lldp Bugfix Bug 596 LLDP TIA Network Policy Decode is not correct
- Camel make it possible to dissect based on OID.
svn path=/trunk/; revision=16822
* DOP - This has now been successfully tested and so is now enabled by default and workaround code removed.
Also now uses the correct EXPORTs from the other modules/dissectors.
* X509SAT - Most of the selected attributes are now supported in addition to the DirectoryString syntax attributes. This includes restoring the correct DirectoryString syntax and also providing the basic syntaxes (e.g. OBJECT IDENTIFIER, PrintableString). The latter requires a sed line in the Makefile which I assume should be OK? Not all the SAT can be defined in x509sat - so some have been included in x509if and x509af - though x509sat.cnf contains the master list and references the other dissectors where appropriate.
(I still prefer a syntax registration approach but I don't think that is going to be agreed in the short term.)
* X509IF - a mechanism to register some formating, based upon the hf_index, that is used in the cnf file.
* A couple of fixes identified by Stig.
svn path=/trunk/; revision=16814
Attached is a patch that updates -
* DOP - This has now been successfully tested and so is now enabled by default and workaround code removed.
Also now uses the correct EXPORTs from the other modules/dissectors.
* X509SAT - Most of the selected attributes are now supported in addition to the DirectoryString syntax attributes. This includes restoring the correct DirectoryString syntax and also providing the basic syntaxes (e.g. OBJECT IDENTIFIER, PrintableString). The latter requires a sed line in the Makefile which I assume should be OK? Not all the SAT can be defined in x509sat - so some have been included in x509if and x509af - though x509sat.cnf contains the master list and references the other dissectors where appropriate.
(I still prefer a syntax registration approach but I don't think that is going to be agreed in the short term.)
* X509IF - a mechanism to register some formating, based upon the hf_index, that is used in the cnf file.
* A couple of fixes identified by Stig.
Note the patc for dop did not apply don't regenerate dissectors yet.
svn path=/trunk/; revision=16799
