This is an attempt to standardize display/handling of checksum fields for all dissectors.
The main target is for dissectors that do validation, but dissectors that just report the
checksum were also included just to make them easier to find in the future.
Bug: 10620
Bug: 12058
Ping-Bug: 8859
Change-Id: Ia8abd86e42eaf8ed50de6b173409e914b17993bf
Reviewed-on: https://code.wireshark.org/review/16380
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Also some other tricks to remove unnecessary tvb_get_string_enc calls.
Change-Id: I2f40d9175b6c0bb0b1364b4089bfaa287edf0914
Reviewed-on: https://code.wireshark.org/review/16158
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
This will make it easier to determine protocol dependencies.
Some LLC OUI dissector tables didn't have an associated protocol, so they were left without one (-1 used)
Change-Id: I6339f16476510ef3f393d6fb5d8946419bfb4b7d
Reviewed-on: https://code.wireshark.org/review/14446
Reviewed-by: Michael Mann <mmann78@netscape.net>
It is a typo on display field and fix also wrong comment...
Change-Id: Idb93641d6e4197b59e453e4ad629af4c0454c8d3
Reviewed-on: https://code.wireshark.org/review/14038
Reviewed-by: Michael Mann <mmann78@netscape.net>
Assign result of `register_dissector(..., func, proto)` to FOO_handle
and remove `FOO_handle = create_dissector_handle(func, proto)`.
Found by looking for files named packet-FOO.c having the above
create_dissector_handle pattern. Some files (with different dissect
routines for the two functions) remain unchanged.
Change-Id: Ifbed8202c6dbc63a1dae9acc03313980ffbbbb90
Reviewed-on: https://code.wireshark.org/review/13247
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Change-Id: I8512cfa1d424f82a873a0e0e1d22c7b075fdd7f3
Reviewed-on: https://code.wireshark.org/review/13069
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Also improve column info for unknown MH types.
Ping-Bug: 11728
Change-Id: I4e54ae56dbb76eaf9ea4f33eb0ff497a518dbd9a
Reviewed-on: https://code.wireshark.org/review/12513
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Change-Id: I1955a88025c26564e7dca4dfbb811cc7265632ea
Reviewed-on: https://code.wireshark.org/review/12518
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Change-Id: Ie39ef054a4a942687bd079f3a4d8c2cc55d5f22c
Reviewed-on: https://code.wireshark.org/review/12485
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Some of the ASN.1 dissectors still generate a new_create_dissector_handle from the tool itself, so leave those for now.
Change-Id: Ic6e5803b1444d7ac24070949f5fd557909a5641f
Reviewed-on: https://code.wireshark.org/review/12484
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Bug: 10627
Change-Id: Ia6940ef7624a92d453cada6693bcd7f4e145a5b6
Reviewed-on: https://code.wireshark.org/review/12453
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Picking off "easy" dissectors that only have one or two exit points at most.
Change-Id: I96aa9cf53533cbb07105aa400d42922baf3016b3
Reviewed-on: https://code.wireshark.org/review/11860
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Picking off "easy" dissectors that only have one or two exit points at most.
Change-Id: I25fe6a0aac93980333217d007702799d16946563
Reviewed-on: https://code.wireshark.org/review/11816
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
The target here is the Decode As dialog where protocols have multiple registrations into a dissector table and that shows up as multiple entries in the Decode As dialog list with the same name so users are unsure which "dissector" they are choosing.
The "default" behavior (done in this commit) is to not allow duplicates for a dissector table, whether its part of Decode As or not. It's just ENFORCED for Decode As.
Bug: 3949
Change-Id: Ibe14fa61aaeca0881f9cc39b78799e314b5e8127
Reviewed-on: https://code.wireshark.org/review/11405
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
It ends up dragging in libwireshark headers, which programs not linking
with libwireshark shouldn't do. In particular, including
<epan/address.h> causes some functions that refer to libwireshark
functions to be defined if the compiler doesn't handle "static inline"
the way GCC does, and you end up requiring libwireshark even though you
shouldn't require it.
Move plurality() to wsutil/str_util.h, so that non-libwireshark code can
get it without include epan/packet.h. Fix includes as necessary.
Change-Id: Ie4819719da4c2b349f61445112aa419e99b977d3
Reviewed-on: https://code.wireshark.org/review/11545
Reviewed-by: Guy Harris <guy@alum.mit.edu>
- Added support for Delegated Mobile Network Prefix as
defined in RFC 7148.
- Corrected the issue where GRE Key option with no key
was not displayed properly.
- Also added append-text for the HNP option to also
display the HNP value.
Change-Id: I42a4bc1627e9e764f10d96aa3988c1f430f00ceb
Reviewed-on: https://code.wireshark.org/review/10565
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Change-Id: I7a7778802c442b254626a7676cb74ca2855fa65e
Reviewed-on: https://code.wireshark.org/review/9977
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Based on packet-ip.c
Change-Id: Ibc561b58d5f4b3e3469e1c578e83b3abe3c206f8
Reviewed-on: https://code.wireshark.org/review/8008
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: If9ecbb6ff77fff8131adf526bfec2bb08aa644aa
Reviewed-on: https://code.wireshark.org/review/7642
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
No need to try to construct an IEEE floating-point number by hand, piece
by piece; just sign-extend the value to 32 bits, convert that integral
value to a floating-point value, and divide the result by 32768 to
properly scale the value.
(Yes, in practice, the chances are overwhelming that we'll be running on
a machine with IEEE floating point - people probably won't be running us
on a VAX, and the UN*Xes on which we're likely to run on a System/3x0 or
z/Architecture machine require, and use, the new IEEE floating-point
capabilities - but no need to be gratuitiously non-portable.)
Change-Id: Ie90a61847e68c3b849de2984139a97004a4ad659
Reviewed-on: https://code.wireshark.org/review/7444
Reviewed-by: Guy Harris <guy@alum.mit.edu>
This may fix a compile warning-turned-error on an old version of SLES that
Anders reported.
Change-Id: I72e5dec00bc0088cd77a206284221cb43ae89547
Reviewed-on: https://code.wireshark.org/review/7429
Petri-Dish: Jeff Morriss <jeff.morriss.ws@gmail.com>
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
Add a CF_FUNC macro to match VALS, TFS, etc. This should help us to avoid
the following warning:
warning: ISO C forbids initialization between function pointer and 'void *' [-Wpedantic]
We could start adding DIAG_OFF+DIAG_ON everywhere but this seems to be
more consistent with the other macros in proto.h. Update each instance
of BASE_CUSTOM to use CF_FUNC.
Adjust a dummy variable name generated by asn2wrs.py that was triggering
an invalid error in checkhf.pl.
Fix an encoding arguement in packet-elasticsearch.c found by
fix-encoding-args.pl.
Change-Id: Id0e75076c2d71736639d486f47b87bab84e07d22
Reviewed-on: https://code.wireshark.org/review/7150
Reviewed-by: Gerald Combs <gerald@wireshark.org>
The first packet is an IPv6 packet with Local Mobility Anchor Address mobility option with Option-Code=1. Wireshark parses its address as IPv4 address.
The second packet is an IPv6 packet with Local Mobility Anchor Address mobility option with Option-Code=2. Wireshark parses its address as IPv6 address.
According to RFC 5949 (https://tools.ietf.org/html/rfc5949#section-6.2.2), Option-Code=1 means IPv6 and Option-Code=2 means IPv4, exactly the opposite to what Wireshark does.
Bug: 10961
Change-Id: I03b76dda8beae211e67e6c9e1f40d122e851b1b5
Reviewed-on: https://code.wireshark.org/review/7113
Reviewed-by: Michael Mann <mmann78@netscape.net>
The authentication data in the AUTH option in attached IPv6 packet contains one byte too much. This byte is read beyond the option data.
In Wireshark, clicking on the AUTH shows that the option ends at 0xCE while clicking on the Authentication Data shows that it ends at 0xCF.
Reported by Boaz
Bug:10626
Change-Id: I0bcfd6331bc1de30f25d16590487c0e3bf5c002f
Reviewed-on: https://code.wireshark.org/review/7112
Reviewed-by: Michael Mann <mmann78@netscape.net>
RAI and SAI.
Change-Id: I2abcc868899b8752f66347b3a0fe190670c3ce3f
Reviewed-on: https://code.wireshark.org/review/6447
Reviewed-by: Anders Broman <a.broman58@gmail.com>
There's no requirement for "display" field values to have names
beginning with BASE_; use SEP_, to indicate that they're separators.
(And, yes, we should introduce SEP_NONE, with a value of 0, and use it.)
While we're at it, fix BASE_SEMICOLON - the separator is a colon, not a
semicolon - and document SEP_SPACE in doc/README.dissector.
Change-Id: I856aafda2c60b8320dffe287f0deb06a9604a2bf
Reviewed-on: https://code.wireshark.org/review/6486
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Mobility Header Link-Layer Address (MH-LLA) Option
to RFC 5268 e.g no special handling of length.
Bug:10043
Change-Id: Id32789fa5e34766c5734b0be13af015473ac257c
Reviewed-on: https://code.wireshark.org/review/6372
Reviewed-by: Anders Broman <a.broman58@gmail.com>
These "bases" will put a ".", "-", or ":" respectively between hexidecimal bytes in the field in packet view and display filter. FT_BYTES with BASE_NONE will have no separator in the packet view, but continue to have the ':' as a separator in the display filter.
Converted the "string" hf_ entries that used tvb_fc_to_str as a string to use proto_tree_add_item with FT_BYTES/BASE_DOT type.
Converted applicable tvb_bytes_to_ep_str_punct() calls to use the new BASE values.
Change-Id: I2442185bb314d04a3ff2ba57883652ecd738b5f9
Reviewed-on: https://code.wireshark.org/review/6098
Reviewed-by: Michael Mann <mmann78@netscape.net>
Fourth batch (packet-mac-lte.c -> packet-rtp.c).
Will look at cleaning up and committing script afterwards.
Change-Id: Id921f07f4b274f0cfb77ce81abe4a285fdb8b644
Reviewed-on: https://code.wireshark.org/review/6023
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
* Simplify the conversion of degrees from 24 bit fixed point to a float.
Avoids strict-aliasing warning by gcc 4.4.
* Add reference to RFC 6757.
* Correct spelling of 'convert' in degrees_convert_fixed_to_float().
Change-Id: Icb680d009fdd960e8668fa3020060799d6a74c2f
Reviewed-on: https://code.wireshark.org/review/5913
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
* Fix wrong length for Operator Identifier
* Display Latitude and longitude in Degrees
Bug:10712
Change-Id: Idf6ba63db3ff16710fd0de7a7fd2233148cbaf4a
Reviewed-on: https://code.wireshark.org/review/5473
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
* Add subtype Geo Location (2) and Operator Identifier (3)
* Use also offset to calculate the length
* Remove proto_tree_add_text
Issue reported by Ravindranath K M
Bug:10712
Change-Id: I9ad81ece856df134f3a706ad774d34e638cb5c94
Reviewed-on: https://code.wireshark.org/review/5397
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Bug: 10618
Change-Id: Ic4d52485a6bd96f906b4a0d61b75a31bfad4e8f8
Reviewed-on: https://code.wireshark.org/review/5276
Reviewed-by: Michael Mann <mmann78@netscape.net>
Bug: 10676
Change-Id: I5614c640d3fd23196984eb2bb013ba15fb318305
Reviewed-on: https://code.wireshark.org/review/5200
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Bug: 10676
Change-Id: I442aa2ce44309655190752e715279d7325647336
Reviewed-on: https://code.wireshark.org/review/5199
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: Ifafdc150c655caf4c7046e3038a6b5e4eeb3cf80
Reviewed-on: https://code.wireshark.org/review/5193
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
This should make it possible to add checkfiltername.pl to the pre-commit script.
Change-Id: Icdee7e4ea3381fa1467bb4b5caf0f60c255adec0
Reviewed-on: https://code.wireshark.org/review/5166
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Looking at RFC 5568 (http://tools.ietf.org/html/rfc5568#section-6.4.3)
It says that the Link-Layer Address (LLA) Option, should have an address right after the option code
Bug:10006
Bug:10627
Change-Id: I6fcd98a7c9896862e4c9547b945cf3848daaf474
Reviewed-on: https://code.wireshark.org/review/5075
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Most of this was found by Boaz Brickner, but to prevent a few more bug reports, I tried to find any remaining MIPv6 options that used -1 to read until "end of packet" instead of "end of option"
1. Option-Code and Reserved fields should be 1 byte, not 2 in Local Mobility Anchor Address mobility option
2. IPv6 AUTH mobility option parses Mobility SPI
3. IPv6 MESG-ID (should just be a timestamp field)
4. IPv6 Redirect Mobility Option K and N bits are parsed incorrectly
5. The following options had a field that read until the end of the packet instead of the end of the option:
DNS-UPDATE-TYPE
AUTH Authentication Data
Care Of Test
Permanent Home Keygen Token
CGA Parameters
Signature
Experimental Mobility Option
Bug: 10630
Bug: 10629
Bug: 10626
Bug: 10625
Bug: 10624
Bug: 10622
Bug: 10619
Change-Id: I14c984a237efc1d1a09618d9a4a1caef1eaf8df0
Reviewed-on: https://code.wireshark.org/review/4932
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
there's a single IPv6 packet with Mobile Node Link Layer Identifier mobility option.
The option's data length is 9 but and since the Reserved field takes 2 bytes, the Link Layer Identifier field should take 7 bytes.
However, the Link Layer Identifier field is read until the end of the packet, which is 519 bytes.
Bug:10578
Change-Id: I518de7f6b75e5b749cb029845fd4846954ca6d0e
Reviewed-on: https://code.wireshark.org/review/4818
Reviewed-by: Michael Mann <mmann78@netscape.net>
There's a single IPv6 packet with Binding Authorization Data for FMIPv6 mobility option.
The option's data length is 14 but and since the SPI takes 4 bytes, the Authenticator field should take 10 bytes.
However, the Authenticator field is read until the end of the packet, which is 178 bytes.
Found by boaz
Bug: 10577
Change-Id: Ia79c5131d8477c1a7c111c47c2a94e990bbeae4d
Reviewed-on: https://code.wireshark.org/review/4817
Reviewed-by: Michael Mann <mmann78@netscape.net>
One of the mobility options is the IPv6 Address/Prefix.
The prefix length of this option is 52.
Note that according to RFC 5568, the prefix length is in bits and not in bytes.
The IPv6 Address/Prefix field of this option marks 52 bytes.
In addition, I'm not sure that the IPv6 Address/Prefix field is a variable size field.
RFC 5568 section 6.4.2 has a diagram of this options that shows this field as if it always takes 128 bits, and the prefix length field just says the length of the prefix (not the length of the field).
Found by boaz
Bug:10576
Change-Id: I2a9a35cb7c537ec3b91c9a089f14fa31f41d8c80
Reviewed-on: https://code.wireshark.org/review/4816
Reviewed-by: Michael Mann <mmann78@netscape.net>
in the Diameter dissector.
This new API adds a filter for the MSISDN as well as a subtree and filter for
the Country Code.
Change-Id: Ibcbf4b5f72178b7e4af63efa7496188d608a9de7
Reviewed-on: https://code.wireshark.org/review/3760
Petri-Dish: Jeff Morriss <jeff.morriss.ws@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
Michael Mann