- Combine tvb_find_guint8() for comma, semicolon into one tvb_pbrk_guint8()
- Instead of fetching each character use tvb_pbrk_guint8() to fast
forward.
- Remove not needed tvb_find_guint8() call, as the result is discarded.
Change-Id: I38d6775b187146656d47cea9b64f8e0ccad18d36
Reviewed-on: https://code.wireshark.org/review/2384
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Separating the "try to guess whether there's a control word" type from
the "yes, there's a control word" and "no, there's not a control word"
types is just a huge UI botch.
Make it clearer that the default is "Ethernet pseudo-wire, try to guess
whether there's a control word".
Change-Id: I91cc526fc709ad102b22ca67f5a9d7c98fffa0cc
Reviewed-on: https://code.wireshark.org/review/2414
Reviewed-by: Guy Harris <guy@alum.mit.edu>
and will be verified by Jasper next week
Change-Id: I3cda397285e8174abb9c05b7aaf7c1bfabdfc71a
Reviewed-on: https://code.wireshark.org/review/2408
Reviewed-by: Jörg Mayer <jmayer@loplof.de>
Instead, explicitly allocate and free the address string.
Using packet scope was causing test failures.
Change-Id: Ie18d2da44d2eec8a92a6a86b0ba883a5525f49cd
Reviewed-on: https://code.wireshark.org/review/2387
Reviewed-by: Guy Harris <guy@alum.mit.edu>
This (if it works well) will let us do much more accurate out-of-order
detection, which is currently otherwise hardcoded to 3ms. Ask Jörg for details.
Change-Id: Ie0662723946edeaea1e43958bf7f5158f09dde71
Reviewed-on: https://code.wireshark.org/review/2367
Reviewed-by: Evan Huus <eapache@gmail.com>
Change-Id: Id292fd1b0fbff3a043e64296a88c78c1a5ac00d7
Reviewed-on: https://code.wireshark.org/review/2369
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I2274b97c74a845e6514e8acff136e55f721f11a8
Reviewed-on: https://code.wireshark.org/review/2354
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: Ie494a52fa73f7b91bc65da1bc36516f799ef4967
Reviewed-on: https://code.wireshark.org/review/2353
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
bit decoding for these values.
Change-Id: I7ab6c4badf5b66d6f434a47523e2b35730ecb65d
Reviewed-on: https://code.wireshark.org/review/2338
Reviewed-by: Jörg Mayer <jmayer@loplof.de>
this can happen and cause invalid memory accesses with incorrectly-large padding
values
Bug:10187
Change-Id: Ib9b2a2fa10766efb4d95d588f57354a56373c626
Reviewed-on: https://code.wireshark.org/review/2325
Reviewed-by: Evan Huus <eapache@gmail.com>
Using dissect_nt_64bit_time it is not possible to access the created proto_item afterwards, hence the new function.
Change-Id: I39aca92536a53841045c30b601b6ec1a7d8bfb4e
Reviewed-on: https://code.wireshark.org/review/2160
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Select an appropriate gcrypt cipher based on ISAKMP encryption ID and
key length attribute. Fixes bug 10128.
Bug:10128
Change-Id: Ie74fc51eb9bfe6d68340056d3ef2ef28c7677fb8
Signed-off-by: Alex Badea <abadea@ixiacom.com>
Reviewed-on: https://code.wireshark.org/review/2296
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
There is a check that disables decryption for non-PSK authentication. It
has been around ever since its introduction in commit acfe071e (svn
r17229). As suggested in bug 7951, remove this check to allow decryption
for e.g. certificates authentication.
Bug: 7951
Change-Id: I5e98407d0f8dbabac2cdaf632cf0af403192872b
Signed-off-by: Alex Badea <abadea@ixiacom.com>
Reviewed-on: https://code.wireshark.org/review/2297
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Also make repetition_coding_indications[] standard terminated.
Change-Id: Ice20e1f27f5ab4d111f893608a230b83899efc9f
Reviewed-on: https://code.wireshark.org/review/2288
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
As far as I can tell these calls were just missed in the first initial pass,
they're not in a weird scope.
Close review from somebody else please to verify that!
Change-Id: Ic3188879124dcb8fdf42e79d200d4f244200aa7b
Reviewed-on: https://code.wireshark.org/review/2266
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Found thanks to warning:
** (process:20239): WARNING **: Extended value string 'attributes' forced to fall back to linear search:
entry 53, value 32858 [0x805a] < previous entry, value 32861 [0x805d]
Change-Id: I12396380b42bbcb90dd139775c4b8d0bfdc79972
Reviewed-on: https://code.wireshark.org/review/2273
Reviewed-by: Evan Huus <eapache@gmail.com>
This appears to be a TLV architecture, not sure if the T and L should be broken up and filtered separately. Right now, just filtering on value.
Change-Id: Ic5853d2216b6b5f845587e4b789435bed5fe60ff
Reviewed-on: https://code.wireshark.org/review/2252
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: I24fe3cc4a3589dadc4528a77fe7ff13d06b1a983
Reviewed-on: https://code.wireshark.org/review/2245
Reviewed-by: Michael Mann <mmann78@netscape.net>
When a dict structure is passed by GlusterFS, the values are not encoded
normally. We now assume that the GFID in the dict is in network-order,
but this will be incorrect for Big Endian systems. The majority of
Gluster deployments are on Little Endian, and the GFID is displayed
correctly for this case. I am sorry for the few users on Big Endian
Gluster environments, they will see some GFIDs in Wireshark that don't
exist on the Gluster volume.
With this change, it is also made possible to filter on the GFID that is
contained inside of the dict.
Change-Id: I62a265eca34df23a507403397012cf652d43ca54
Reported-by: Vikhyat Umrao <vumrao@redhat.com>
Signed-off-by: Niels de Vos <ndevos@redhat.com>
Reviewed-on: https://code.wireshark.org/review/1856
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
No exceptions can be thrown when loading a key from a file, so it's safe.
Change-Id: I14ee8569bb516fcb45b72f07f76d28ef4b32065c
Reviewed-on: https://code.wireshark.org/review/2243
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: Ic133dd9440feb61964d197fa0aaacd86241f229d
Signed-off-by: Yan Burman <yanb@mellanox.com>
Reviewed-on: https://code.wireshark.org/review/2248
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: I78e487c14859b82d7e1d79f99a92c759c73fbda2
Signed-off-by: Yan Burman <yanb@mellanox.com>
Reviewed-on: https://code.wireshark.org/review/2246
Reviewed-by: Michael Mann <mmann78@netscape.net>
This makes it possible to dissect part of a package as ASN.1.
Change-Id: I53dd6bc916fa0d2c932d77fef437c2094fdd29ed
Reviewed-on: https://code.wireshark.org/review/2238
Reviewed-by: Evan Huus <eapache@gmail.com>
These fixes are superficial. Michael: Please review and either remove
the unneeded stuff or put in the correct use.
Change-Id: I15e0f8c746af5bd76f57965ddcbf06d9e4ac80ca
Reviewed-on: https://code.wireshark.org/review/2223
Reviewed-by: Jörg Mayer <jmayer@loplof.de>
Change-Id: I9769e1d93ff99c4081dd028d79c0cead75e0e36c
Reviewed-on: https://code.wireshark.org/review/2221
Reviewed-by: Michael Mann <mmann78@netscape.net>
Also did some minor cleanup noticed while doing the filter conversion
Change-Id: Iea61b395c0eeb6fbcaac4c09964da2cb3cdccda5
Reviewed-on: https://code.wireshark.org/review/2184
Reviewed-by: Dmitry Bazhenov <dima_b@pigeonpoint.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: Ia96bfb71449624ff75c694080fef30d57300b30d
Bug: 10174
Reviewed-on: https://code.wireshark.org/review/2131
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: Id3fc3f017c02c2df3b0578c28f187b106c3ad2ed
Reviewed-on: https://code.wireshark.org/review/2218
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: Ib7f57696e40df770f5ae21ca066b27d28c13b57b
Reviewed-on: https://code.wireshark.org/review/2217
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I39012cf467b27eb0be4c63bbc648a72f831d9068
Reviewed-on: https://code.wireshark.org/review/2216
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I2aadbde82b59ac0135230e5e370a9a3f81951365
Reviewed-on: https://code.wireshark.org/review/2215
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I3eaa39784be9c00de834325dbfe9be4c545dcec7
Reviewed-on: https://code.wireshark.org/review/2214
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I2cda4c90de1be774d80cc2cd044ce2609a350c3e
Reviewed-on: https://code.wireshark.org/review/2213
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: Ie3eb6f91a99e82c9068074aa20e99ca5b2525882
Reviewed-on: https://code.wireshark.org/review/2212
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: Idcae64accda9d812fdeb21b71bed35601cfbcd89
Reviewed-on: https://code.wireshark.org/review/2211
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
dissect_usbpcap_buffer_packet_header()
only process the generic part of the usbpcap pseudo header in this
function, the transfer-specific parts are handled in
dissect_usb_common()
Change-Id: I1e97db9905ef1d14f04b53624e82feed7270912f
Reviewed-on: https://code.wireshark.org/review/2210
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I605908619b5d87c846810016c15cccfce9da858e
Reviewed-on: https://code.wireshark.org/review/2209
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
and fill the conversation struct
Change-Id: I8917fae39458568ab980ece1e819cb83719e3baf
Reviewed-on: https://code.wireshark.org/review/2077
Reviewed-by: Michael Mann <mmann78@netscape.net>
Fixes Bug 10165. (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10165)
The condition that caused the bug is a non-standard URB where the
length of the tvb is less than the reported length. It will pass the
tvb_reported_length_remaining() != 0, but fail the assertion in
tvb_composite_append() (which checks the length value, not reported_length).
This condition appears in a few other locations (where the if statement checks
reported_length, but the code inside the if statement uses the length value).
This patch also fixes them.
Also removes depricated calls to tvb_length() & tvb_length_remaining()
with tvb_captured_length() & tvb_captured_length_remaining(), respectively.
Change-Id: Ie8d50cfb24af62558c905c23c37ec603ce76366f
Reviewed-on: https://code.wireshark.org/review/2011
Reviewed-by: Michael Mann <mmann78@netscape.net>
Bits in the byte was counted wrong direction;
bit0 should be LSB (0x01) and bit7 - MSB (0x80)
Also, all fields are interpreted as little-endian
Change-Id: I3485e8743a156e2e8cb84e726045211f1d332598
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Reviewed-on: https://code.wireshark.org/review/2138
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: I8b44e0d55701ba5d583e3e734e19d4d2aa024b25
Reviewed-on: https://code.wireshark.org/review/2049
Reviewed-by: Michael Mann <mmann78@netscape.net>
* Wireless data ieee80211 RSSI (dBm) is a signed integer. In the wireless radio the dBm value is negative.
* Wireless data ieee80211 Data Rate (Mbps) is a 100Kbps. You need divide this value by 10.
Issue found by Massimo Vellucci (SmartCAPWAP)
Change-Id: I04dd8a9e38a5f60ee5bf64cd304db1b11413c809
Reviewed-on: https://code.wireshark.org/review/2094
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This patch adds support for dissection of USB setup data contained
inside of MA USB data packets. The MAUSB Dissector calls the same
function used by the USB dissector to dissect the setup data.
This patch also (and a bit unintentionally) adds transfer following.
TransferReq & TransferAck packets now show a link & a time delta
to their TransferReq (ie [Request in: XXX] & [Time from request: XXX].
TransferReq packets have a [Response in: XXX] tag, but it erronously
points to the TransferAck, not the TransferResponse.
Change-Id: I01041de3c38ea6248e9d34506b0b012518a1e6d8
Reviewed-on: https://code.wireshark.org/review/1548
Reviewed-by: Evan Huus <eapache@gmail.com>
Change-Id: I9743a6fe57ff3197baa0c084dae428df8c31b24d
Reviewed-on: https://code.wireshark.org/review/2068
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
uninitialized in this function.
Change-Id: I92a344b8ec86fc71b64903c2e6edc74f8ed7a330
Reviewed-on: https://code.wireshark.org/review/2066
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Call the without-Atheros-padding dissector for the payload.
Fixes bug 10139.
Change-Id: I883bf4e58899aa78b07fae63d8c0376a31bda444
Reviewed-on: https://code.wireshark.org/review/2027
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Per MAUSB Spec (1.0), the SetDevAddrReq packet now contains data
in addition to the packet header.
Change-Id: I4d2c6bb2530edf5de33ef69c0e6af0441e197fa4
Reviewed-on: https://code.wireshark.org/review/2014
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Removed a check to see if the Packet is in DWORDs.
I misread section 6.2 of the spec, which states that all _headers_
mausb be DWORD-aligned, not all _packets_.
Change-Id: I11e320e6e2592930024ffa8143e4d8f470de13ba
Reviewed-on: https://code.wireshark.org/review/2013
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Moved code in usb_dissect_common() for getting/creating transfer
info into it's own function.
This is part of an effort to make dissect_usb_common() more modular
so that code can be shared between the USB & the MAUSB dissector.
Change-Id: I70f4f98536a6355e57b33eb01a9b5d8688183635
Reviewed-on: https://code.wireshark.org/review/1993
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
tvb_new_subset -> tvb_new_subset_remaining it appears that's what the intention is.
Change-Id: I2334bbf3f10475b3c22391392fc8b6864454de2d
Reviewed-on: https://code.wireshark.org/review/1999
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
I'm cheating a bit here, hf_media_loc_long & hf_media_loc_lat need a 5byte bitmask, but the bitmask field in hf is restricted to guint32
Change-Id: I7e044fc680bb947973e437fc66057488a8deee67
Signed-off-by: Anish Bhatt <anish@chelsio.com>
Reviewed-on: https://code.wireshark.org/review/2012
Reviewed-by: Evan Huus <eapache@gmail.com>
Dissection of all setup field types (standard & nonstandard) are
handled in a seperate function. Before, nonstandard dissection was
handled in dissect_usb_common.
This is part of an effort to make dissect_usb_common() more modular
so that code can be shared between the USB & the MAUSB dissector.
Change-Id: I15d7e3691afc29cd569aa5d3770d2aa569630b12
Reviewed-on: https://code.wireshark.org/review/1992
Reviewed-by: Evan Huus <eapache@gmail.com>
Packet info for all MAUSB packets in a single TCP packet is now displayed
in the info column. Before, only info on the last packet was displayed.
See conversation for change Ib20e5e30474d93270dd24e203ab96f64f5cc77ad.
Patch 3 had fencing, I messed up and left it out of patches 4-6. This
patch adds it back in.
Change-Id: I37f0e028a8f9b5a8500700f03ac36f8bf1c4f63c
Reviewed-on: https://code.wireshark.org/review/1958
Reviewed-by: Michael Mann <mmann78@netscape.net>
Added a helper function which handles all the USB-Specific tap data.
This is part of an effort to make dissect_usb_common() more modular
so that code can be shared between the USB & the MAUSB dissector.
Change-Id: If0f0b5542203ddaed28009d8a8a1bb8660fa5d70
Reviewed-on: https://code.wireshark.org/review/1990
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
packet-q931.c:2532:25: warning: Access to field 'message_type' results in a dereference of a null pointer (loaded from variable 'q931_pi')
Change-Id: I7533ff60c541e31efe4522e710f86175c1c0ccf4
Reviewed-on: https://code.wireshark.org/review/1997
Reviewed-by: Evan Huus <eapache@gmail.com>
usb_conv_info->usb_trans_info is set to the same thing regardless
of the branch taken, to pull it out of the condition.
Change-Id: Ieabf0a6e796b942d7bafedbeba18d9e0fa113e17
Reviewed-on: https://code.wireshark.org/review/1991
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Co-ordinate based LCI is untested, as the sample capture does not have this, could not find one anywhere.
Change-Id: Id0b52c234d6a36ee430ab9a7265bcd84f151c80c
Signed-off-by: Anish Bhatt <anish@chelsio.com>
Reviewed-on: https://code.wireshark.org/review/1929
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Added KCS and TMode protocol dissectors.
Request/response logic has been revised.
Saved request data logic has been revised.
Added Get Message command response dissector.
Added missing PICMG command dissectors.
Added new PICMG command dissectors.
Added new PPS OEM command entries.
Added VITA 46.11 command dissectors.
From: Bill Meier:
- refs to value_strings/range_strings in hf[] entries, by convention, should use VALS/RVALS macros;
- refs to true_false_strings should use TFS(&...) macro.
also: true_false_string definitions should not be defined as arrays.
- remove some unneeded #includes (packet-ipmi.c).
- Do some re-indentation.
- Add editor-modelines as needed.
bug: 10004
Change-Id: Ib269b35784c0b70892d1e0111bcfb483ea64092c
Reviewed-on: https://code.wireshark.org/review/1185
Reviewed-by: Anders Broman <a.broman58@gmail.com>
sip dissector when filtering spends ~5% of Ir in tvb_format_text(),
avoid calling.
Change-Id: I1de8e970b300354c0536aead65178401f140f509
Reviewed-on: https://code.wireshark.org/review/1974
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Standard USB setup responses are now handled by a seperate function.
Before, dissection was handled in the dissect_usb_common().
This is part of an effort to make dissect_usb_common() more modular
so that code can be shared between the USB & the MAUSB dissector.
Change-Id: Ibfbcd915d8cef881a6ae0f0312e5a8070984f465
Reviewed-on: https://code.wireshark.org/review/1968
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Standard USB setup requests are now handled by a seperate function.
Before, dissection was handled in the dissect_usb_common().
This is part of an effort to make dissect_usb_common() more modular
so that code can be shared between the USB & the MAUSB dissector.
Change-Id: I51944c688cc0715887abd4c8e5a7e3639c06821b
Reviewed-on: https://code.wireshark.org/review/1967
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
The data that is sent when downloading or uploading from a server is
sent in segments to the client.To clearly display all the segments
belonging together the splitted payload needs to be reassembled.
The behaviour is described in the powerlink specification 301 v1.2.0
chapter 6.3.2.4.1.1 Download Protocol and chapter 6.3.2.4.2 Upload
Protocol. The payload of the download/upload is now reassembled.
Signed-off-by: Lukas Emersberger <lukas.emersberger@gmail.com>
Change-Id: I17c30f15e75da47bcaba8f1fda1e412849ec268c
Reviewed-on: https://code.wireshark.org/review/1120
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
in that we now properly indicate the checksum and provide the wrapped token to
the LDAP dissector to dissect.
There is still a problem in that the wrong parts of the SASL packet can be
indicated when users click on some parts.
I am committing it for review and because it is much better than the current
code.
Bug:9398
Change-Id: I552fc249db26835b79abfc8793438a95f221663a
Signed-off-by: Richard Sharpe <realrichardsharpe@gmail.com>
Reviewed-on: https://code.wireshark.org/review/1905
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Parts of this dissector have TLV design, but the identifier is "hidden" by the field. I left that behavior in and used more proto_tree_add_uint than proto_tree_add_item because of it. But at least the fields themselves are more filterable.
Change-Id: I94f38d0063e32f6f3f682b380e0ce7bd051121c6
Reviewed-on: https://code.wireshark.org/review/1934
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The MAUSB dissector now prints the USB address for MAUSB data packets
in the Source & Destination columns. Before, the IP address was
printed.
All MAUSB data packets are now part of USB Conversations. Like the
USB dissector, all data to & from one endpoint are part of the same
conversation.
Issues that need to be resolved:
- In the case where multiple MAUSB packets exist in one TCP packet,
only one USB address can be printed.
- The USB conversations do not appear in the conversations window.
They should appear under the USB conversations tab.
Change-Id: I042daf7889cf70b3bbc450f9ccd974a0f93f4798
Reviewed-on: https://code.wireshark.org/review/1943
Reviewed-by: Evan Huus <eapache@gmail.com>
Added a helper function used to set the address fields for an urb.
The code functions the same as before, but is now more modular.
This change makes it easier for other dissectors to reuse the usb
addressing code (ex: MAUSB).
Change-Id: Idef3156a0fc9a9eda77ec7b2bbf3797b7a59e264
Reviewed-on: https://code.wireshark.org/review/1942
Reviewed-by: Evan Huus <eapache@gmail.com>
Fix warning: cast to pointer from integer of different size
Change-Id: Ieed19204cb3be469c1b12f6ff87168b217a2a33d
Reviewed-on: https://code.wireshark.org/review/1938
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Also, cleanup dissector being called only with tree and a few tvb_new_subset calls.
Change-Id: I1dab1b42ef1a27fc85b05d126f51f1582d7e5c58
Reviewed-on: https://code.wireshark.org/review/1932
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
While it compiles fine, hits an assert in add_string :
failed assertion "hfinfo->type == FT_STRING || hfinfo->type == FT_STRINGZ || hfinfo->type == FT_STRINGZPAD"
Fix takes care of this issue, but seems like we're losing the bitmask info here, is there a better way to do this ?
Change-Id: I7156d734f4b058113730d5dfbf6498e801c36770
Signed-off-by: Anish Bhatt <anish@chelsio.com>
Reviewed-on: https://code.wireshark.org/review/1915
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
- refs to value_strings in hf[] entries, by convention, should use VALS macro;
- add editor-modelines as needed; Fix some indentation.
Change-Id: Iaa0196bab6de066ed68a2755b69b07fadd33e498
Reviewed-on: https://code.wireshark.org/review/1927
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Add better reference to IANA list of all extensions.
Add newer "channel_id" extension (0x7550) as used by current Chrome versions.
Change-Id: Ia5b2515c557fbaf42d320ede918120f83b2e02dd
Reviewed-on: https://code.wireshark.org/review/1924
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Change-Id: I959729a8834054cf333ec2c47f9d93756eb94066
Reviewed-on: https://code.wireshark.org/review/1922
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I16e6fd4f2d9fb37539cfcb17c0ade1033aea2d6f
Reviewed-on: https://code.wireshark.org/review/1921
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
at first, read only the info required to fetch the conversation struct
Change-Id: I3becbb59bf6a55f07805ca9f3c24f015484fcd13
Reviewed-on: https://code.wireshark.org/review/1920
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
In the EIGRP packet dissector, the dissector routine for the Sequence TLV
dissected the TLV only up to the first address in the list. However, the
Sequence TLV contains a variably sized list of addresses. This patch
modifies the routine so that it processes the entire TLV, not just the
first address in the contained list.
Also, in the dissect_eigrp(), replaced calls to tvb_new_subset() with
the reported length set to -1 with the call to tvb_new_subset_length().
TLVs always carry information about their length. And this time,
correct truly ALL calls in the switch{} section.
Sample packet capture is available in BugZilla.
Bug: 10156
Change-Id: Idaaf182c05bcf799f770f23a2ce2b1e05a3d569a
Reviewed-on: https://code.wireshark.org/review/1911
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Change-Id: I8de7b63ca90803f8fc6333bbe43aeb94459e6363
Reviewed-on: https://code.wireshark.org/review/1918
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: I796138bab6d4b75ade047f0706e68f301e4559df
Reviewed-on: https://code.wireshark.org/review/1919
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
While we're at it, get rid of duplicate #defines for some OUIs, sort the
OUI #defines, and fix some routine names.
Change-Id: I8f4e5408b44896c3629a0014299b060ebc15bab6
Reviewed-on: https://code.wireshark.org/review/1906
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Decode the HTTP/2 header block using nghttp2 HPACK decoder
In this patch, We use nghttp2 HPACK decoder to decompress HTTP/2 header
block. To make HPACK decompressor work, we need to track down HTTP/2
connection from the beginning. If we see the HTTP/2 magic (connection
preface), we initialize HPACK decompressor objects. We actually use 2
HPACK decompressor for both client and server. HPACK decompressor
objects are stored in hash tables using TCP stream index as a key.
Most code by: Tatsuhiro Tsujikawa
Signed-off-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Signed-off-by: Pascal Quantin <pascal.quantin@gmail.com>
Change-Id: Idb4dd4b0a200924820cb0b34db664cc37518168d
Reviewed-on: https://code.wireshark.org/review/1527
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
in the linkage descriptor
Change-Id: I7ebca539076b2b881e82fd6baec5bb223e778a52
Reviewed-on: https://code.wireshark.org/review/1896
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I3381e1c35795ac33331cdddb8cefa8b0a16907cc
Reviewed-on: https://code.wireshark.org/review/1894
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Add a dissector table for the 802.3 "slow protocols" subtype, split the
dissectors for those protocols into separate files, and have them
register in that dissector table.
Remove some unnecessary #includes while we're at it.
Change-Id: Ic36c9c255efdd348055fa4f21fd6cc094f74e378
Reviewed-on: https://code.wireshark.org/review/1891
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Change-Id: I27656eacb698f8db7bfbe4f5502658c78b03fc13
Reviewed-on: https://code.wireshark.org/review/1890
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: Ief46b7b53ddecd649e54d3c23a3504c4165c812f
Reviewed-on: https://code.wireshark.org/review/1855
Reviewed-by: Michael Mann <mmann78@netscape.net>
Instead of X.509 certificates now also Raw public keys are supported
and shown correctly.
This is described in this draft:
https://tools.ietf.org/html/draft-ietf-tls-oob-pubkey-11
Change-Id: Ibe7610aace31a19791b02e71ccd8d9ceb8cf979d
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Reviewed-on: https://code.wireshark.org/review/1372
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
This analyses the certificate type extensions and then stores the
certificate type in the ssl session. This way we can later show the
certificate in the correct from.
This is described in this draft:
https://tools.ietf.org/html/draft-ietf-tls-oob-pubkey-11
Change-Id: Ifdda165807bc29f1fc138da000a9a538ecd18b6e
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Reviewed-on: https://code.wireshark.org/review/1371
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Change-Id: I007ff5215f52f80f25622cab6980128eabd39c5f
Reviewed-on: https://code.wireshark.org/review/1888
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I18c2b7992b237eaaacbec04d504fc293b03558a3
Reviewed-on: https://code.wireshark.org/review/1887
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: Icccc07706287df4b6a7481108f9921b939aae2d5
Reviewed-on: https://code.wireshark.org/review/1886
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Use the struct SslSession instead of passing the tls version and cipher
to each function.
Change-Id: I19b163913f8f6521a34d94d130e2ae74546a615a
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Reviewed-on: https://code.wireshark.org/review/1821
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Use the struct SslSession instead of passing the tls version and cipher
to each function.
Change-Id: I95ad8cb5857794608f0f8db5c2dfd4b16e6578d5
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Reviewed-on: https://code.wireshark.org/review/1820
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
This structure is used to store information about a SSL session which
is not only needed for decrypting the session, but also to show nice
dissection information.
In an other patch I will add some more members to the struct because
the old way of passing them to the function does not scale.
Change-Id: I88e7f2896e0364a41d4538752dad291de83bfbca
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Reviewed-on: https://code.wireshark.org/review/1819
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
The MN interprets the CMD layer data only if the CN increments
the Send-Sequence-Counter => new data. The MN interprets the
data only once, if the same frame is sent again the MN ignores
the data.
The behaviour is described in the powerlink specification 301 v1.2.0
chapter 6.3.2.3.2.3 Error: Duplication of Frame
Frames which duplicate previous sent data are now marked as
duplicated frames.
Signed-off-by: Lukas Emersberger <lukas.emersberger@gmail.com>
Change-Id: I9ef24b52712bfd3c735856b0cd5747c47aeef72a
Reviewed-on: https://code.wireshark.org/review/992
Reviewed-by: Evan Huus <eapache@gmail.com>
Puts a tag in the info column when multiple MAUSB packets are in a
single TCP packet.
Change-Id: Ib20e5e30474d93270dd24e203ab96f64f5cc77ad
Reviewed-on: https://code.wireshark.org/review/1658
Reviewed-by: Sean Onufer Stalley <sean.stalley@intel.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
packet-btavdtp.c: In function 'dissect_bta2dp':
packet-btavdtp.c:2796:36: error: 'sep_data.vendor_codec' may be used uninitialized in this function [-Werror=maybe-uninitialized]
packet-btavdtp.c:2799:12: error: 'sep_data.vendor_id' may be used uninitialized in this function [-Werror=maybe-uninitialized]
Change-Id: I5b9e22e7ec787430ee25d2cd7dbe13f854f9eaa2
Reviewed-on: https://code.wireshark.org/review/1884
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Session should be finished too on HCI Disconnect and Adapter disappear.
Change-Id: I0823872e60ec932fc0831975e54dc33d49fb5dbc
Reviewed-on: https://code.wireshark.org/review/1882
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Also add Service informations to Info column and service item.
Change-Id: I0a565df94d7980432c524bd675b291f0e80704e5
Reviewed-on: https://code.wireshark.org/review/1881
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Fix warnings and try to inform user about unknown values in
"Decode As".
Also use define instead of magic number for Unknown L2CAP CIDs.
Change-Id: Ie6f26a9e3330b84cef14bbf8861ffbdbdb789225
Reviewed-on: https://code.wireshark.org/review/1880
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Michal Labedzki <michal.labedzki@tieto.com>
Example: if there is Connection Request than field with CID always
is called SCID. If we Sent this packet, it is okay, but if we Receive
it, then it is not SCID for us, but DCID. If we receive
Connection Request (DCID) and than we want to make disconnection,
so we send Disconnection Request with DCID that is SCID in
Connection Request... etc.
I try to clarify this, so rename stored SCID to Local CID
and DCID to Remote CID.
Change-Id: Idde0939a03955d8f4a10d8c9f7c43fd364254460
Reviewed-on: https://code.wireshark.org/review/1879
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
To correctly resolve connections single "ID" value
like L2CAP PSM, is not enough, because next connection may use
the same PSM value. Solution is save frame number of frame that
make disconnection.
Conclusion:
Any session key values should be updated to pair:
{ID_1, disconnect_in_frame}, {ID_2, disconnect_in_frame}...
then we should check if "disconnect_in_frame" is greater then
current frame number, otherwise it is not valid session.
Change-Id: I3d760112b6e53358a93c994f4aae455ac1bf5de6
Reviewed-on: https://code.wireshark.org/review/1878
Tested-by: Michal Labedzki <michal.labedzki@tieto.com>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
The Stream is defined here as media stream that beginning on
AVDTP Start (ResponseAccept).
Also fix recognizing Channel streams by AVDTP according to the
specification that says:
1. First channel is always Signaling.
2. Second may be Media.
3. Third may be Reporting.
4. Fourth may be Recovery.
First and second will be supported right now.
Change-Id: Id6d4dae6be1b9df68382288c2d520b7ed3661237
Reviewed-on: https://code.wireshark.org/review/1053
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Music duration info can be used to detect underflow, what can
decrease music quality.
Change-Id: I8ea06655395d3e66473a09ee72b6833b894aa6e1
Reviewed-on: https://code.wireshark.org/review/1052
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
description
Change-Id: Ice06e257a72f3b4ce1229ff90129628f0e3bbcfb
Reviewed-on: https://code.wireshark.org/review/1873
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
For a number of protocols that encapsulate 802.11 frames inside packets,
whether the frame includes an FCS or not is specified by the protocol,
not by whether the link-layer frame carrying the packets *itself*
includes an FCS. As we've done with Ethernet, add "_withfcs" and
"_withoutfcs" dissectors, which *don't* check the pseudo-header FCS
length indication, and call those, rather than dissectors that check the
pseudo-header length indication, from the dissectors for those protocols.
Change-Id: Ib8c8ecdd872e1782fdfc66e7573415d91911a62e
Reviewed-on: https://code.wireshark.org/review/1866
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Change-Id: I8e20917ac08e2349caf330ee967d24d7c738bb71
Reviewed-on: https://code.wireshark.org/review/1815
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: Iaddd3c4847e803af855c847212ae822b2529ff06
Reviewed-on: https://code.wireshark.org/review/1860
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
filtering work, fix typos
Change-Id: I7ed989807826d1322dab00d13d998488caaf73ff
Reviewed-on: https://code.wireshark.org/review/1859
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: If8d35122ce096f52837bdff1c6599b47456697d5
Reviewed-on: https://code.wireshark.org/review/1858
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I8e442dff85ef856672f42e787feb88453eba6f0e
Reviewed-on: https://code.wireshark.org/review/1857
Reviewed-by: Michael Mann <mmann78@netscape.net>
This patch will solve the issue in LOOKUP procedure if filename itself will become <EMPTY>.
Change-Id: Ib983ac4f9325db040a6b4eb3fc63179b36103bf4
Reported-by: Pranith Kumar Karampuri <pkarampu@redhat.com>
Reviewed-by: Niels de Vos <ndevos@redhat.com>
Signed-off-by: Vikhyat Umrao <vumrao@redhat.com>
Reviewed-on: https://code.wireshark.org/review/1854
Reviewed-by: Michael Mann <mmann78@netscape.net>
as remove redundant stuff from the spnego.cnf file.
Signed-off-by: Richard Sharpe <realrichardsharpe@gmail.com>
Change-Id: I90a962a39dc4da0f13055c9b3893c26044f1fc97
Reviewed-on: https://code.wireshark.org/review/1809
Reviewed-by: Tomáš Kukosa <tomas.kukosa@unify.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: Ifbfca88469a6bc479072c921deba280e667c7087
Reviewed-on: https://code.wireshark.org/review/1804
Reviewed-by: Michael Mann <mmann78@netscape.net>
Also remove the reference to the original ID.
Change-Id: I51357fc04699a40af2d34ec2bd36518d09d3b180
Reviewed-on: https://code.wireshark.org/review/1848
Reviewed-by: Michael Tüxen <tuexen@wireshark.org>