Add an optional argument to extcap-version, which tells the utilities
the wireshark version and therefore allows them to handle different
versions differently.
If no version is provided, the utility has to assume it is dealing
with a Wireshark 2.x version (default behavior).
Change-Id: I51658300f28f503ca8050d204b73749f1a54df16
Reviewed-on: https://code.wireshark.org/review/26752
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
Otherwise the utility no longer works for Python 2.
Change-Id: Ibe2f09d26887603a971185253aeaf2521875770d
Reviewed-on: https://code.wireshark.org/review/26751
Reviewed-by: Roland Knall <rknall@gmail.com>
Valgrind considers the "cpuid" instruction to always depend on inputs from eax
and ecx, even though it's only a subset of values of eax for which ecx is
relevant. If ecx is undefined when cpuid is executed, the outputs of cpuid
will be considered undefined.
Instead of suppressing the resulting uninitialised-value warning (the
suppression for which is now out-of-date anyway, now that
register_all_protocols is moved to a worker thread), let's simply set ecx to
zero in ws_cpuid.
Testing done: Built Wireshark on Linux amd64. Before this change, running
"tools/valgrind-wireshark.sh ./test/captures/dhcp.pcap" with
valgrind-3.12.0.SVN on Debian 9.4 amd64 would yield the following Valgrind
error:
==2416== Thread 2:
==2416== Conditional jump or move depends on uninitialised value(s)
==2416== at 0xACB8B22: ws_mempbrk_sse42_compile (ws_mempbrk_sse42.c:58)
==2416== by 0x74F4960: register_all_protocols_worker (register.c:37)
==2416== by 0xB1403D4: g_thread_proxy (gthread.c:784)
==2416== by 0xD438493: start_thread (pthread_create.c:333)
==2416== by 0xB4CAACE: clone (clone.S:97)
With the change, the above message is gone. Inspected the disassembly of
function ws_cpuid, and it looks sane -- just an added "xor ecx, ecx" at the
top.
Change-Id: I2fb382309cac234c400286a6e9fac7d922912c63
Reviewed-on: https://code.wireshark.org/review/26733
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
In lustre 2.10 the ability to freeze/thaw the filesystem for
snapshotting was added. This processes the new wire commands used.
Change-Id: Ie4d87b200078d2da1c983c9e8df2952c82c90d83
Signed-off-by: Nathaniel Clark <nathaniel.l.clark@intel.com>
Reviewed-on: https://code.wireshark.org/review/26692
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Support has been added to the EtherNet/IP (ENIP) CIP dissector (packet-cip.c)
to allow for the dissection of Programmable Controller Communication Commands
(PCCC). These commands are often seen in the traffic of Programmable Logic
Controllers (PLCs) communicating over the EtherNet/IP or DF1 protocols.
Dissection has been implemented directly in the packet-cip dissector,
following the structure put in place by other existing CIP classes such
as the Connection Manager.
Change-Id: Ia1e614fb7fd9fd36e79c0dac06cd5f1a9c1cea78
Reviewed-on: https://code.wireshark.org/review/26713
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Some clusters, for example the Smart Energy Metering cluster,
requires a different set of attributes for the ZCL client and
server but with overlapping IDs.
This change allows to specify a different set of attributes for
the ZCL client.
To avoid breaking existing clusters that might have client attributes
the same set of attributes are used for server and client when
zbee_zcl_init_cluster is called.
This new client attribute set is used in the Smart Energy Metering
cluster in this commit.
Change-Id: Ie25ad746dac1ccbb233ae8975ef9047d3fc6a170
Reviewed-on: https://code.wireshark.org/review/26694
Reviewed-by: Martin Boye Petersen <martinboyepetersen@gmail.com>
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Paul Zander <p.j.zander@lighting.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Added in a way to dissect the mgmt_nwk_enhanced_update_notify
(clusterID=0x8039). It still uses the same dissector as the non-enhanced
version (clusterID=0x8038) since it's payload is the same. Only difference
is the clusterID and it's name.
Change-Id: Icb3c5e895f5fbe2150325bd5e974406d18beb1c1
Reviewed-on: https://code.wireshark.org/review/26742
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Run 2to3. Convert our payload to bytes. Switch from tab to 4-space
indentation as described in PEP8, which fixes a "TabError" message.
Change-Id: Ic20b6bc1fc1a945758c8be1bb54435f3326fb605
Reviewed-on: https://code.wireshark.org/review/26744
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Allow for a higher flexibility of the arguments passed to extcap_foreach
Change-Id: I19708ac9d6c2aceecd88d0f691b5155bb8027675
Reviewed-on: https://code.wireshark.org/review/26736
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
Change the column info so that it will display "many-to-one route
request" if the many-to-one mask is found in the route options bitmap
Change-Id: Ia55d7bb6110d05040b7e52cc63b2f1cc592998da
Reviewed-on: https://code.wireshark.org/review/26725
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Dissect protocols like OVSDB which transfer JSON over TCP or UDP
Change-Id: I7c918b6a5fbef9568fc4258fd57bad39ff2d9203
Reviewed-on: https://code.wireshark.org/review/26726
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
yyin is initialized to stdin. When we're reading from files, we set it
so that it points to the FILE from which we're reading, but when we're
reading from a string, we don't set it, leaving it to point to stdin.
This means that, just as the "read from the input" routine has to be set
differently when reading from a file or a string, the "close the current
input" routine has to be set differently as well.
Bug: 14577
Change-Id: Ie05880775612867e9037ace2de0cd0a0dd2fabb5
Reviewed-on: https://code.wireshark.org/review/26719
Reviewed-by: Guy Harris <guy@alum.mit.edu>
The expand_dns_name() function is not used outside of the DNS dissector
(any more?). Remove the function declaration from the public header
file, make the function internal.
Change-Id: Ibba81fa68a0dfd195ca3bbfca3eca20c39cc01f4
Reviewed-on: https://code.wireshark.org/review/26698
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
according to 3gpp 36133v1404, nrsrq value ranges from -34db to 2.5db
according to 3gpp 36355v1404, nrsrq reporting value ranges from 0 to 74
Change-Id: Ie5cc9880526ba6919785a8e355178ac08b34a1a0
Reviewed-on: https://code.wireshark.org/review/26707
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Updated on 31st March 2018:
- UUIDs
- Company Ids
- links to Assign Numbers
- change of "Bond Management Feature" to (..) Features seems to be mistake,
so I ignore it, but fix btatt name of this characteristic
Change-Id: If76148c70276017647f5d3de000be112de102988
Reviewed-on: https://code.wireshark.org/review/26696
Petri-Dish: Michal Labedzki <michal.labedzki@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Devices names from Extended Inquiry Response should be displayed
for BD_ADDRs provided by EIR/AD attribute BD_ADDR, but also HCI layer.
Change-Id: I042960661c29f6a8df13b2dda87e5f9533f4da09
Reviewed-on: https://code.wireshark.org/review/26697
Petri-Dish: Michal Labedzki <michal.labedzki@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Add missing SPI VERB
Improve display some Fields in SPI OPEN
Change-Id: Ibe585d80ac7e3ddf1c85c972f0dd5cd50d64598c
Reviewed-on: https://code.wireshark.org/review/26686
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Remove an increment of the offset variable from after the last field.
Change-Id: Iee33caec4f58206e3e223390227907ae61092533
Reviewed-on: https://code.wireshark.org/review/26691
Petri-Dish: Richard Sharpe <realrichardsharpe@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Let's indicate the right payload length.
While we are at it, let's catch bounds errors as the erroneous payload
migth be malformed.
Change-Id: I360e8068f48e53cd5355f8c02b20d265df1fb2ff
Reviewed-on: https://code.wireshark.org/review/26689
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Add assert and remove some code from scan builds.
Change-Id: I32747d1a61f183e4c918d9f50ec8337eaef47f0d
Reviewed-on: https://code.wireshark.org/review/26483
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Refactor ieee802154_set_mac_key to return the number of keys set and
only try to decrypt with the alt_key if actually provided
Bug: 14522
Change-Id: I40802dff8c08f7f82b792fb16f5f91aa3b9e20cc
Reviewed-on: https://code.wireshark.org/review/26677
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Change-Id: If3544b57fac913e3c447910e35fc642651ac69e1
Reviewed-on: https://code.wireshark.org/review/26681
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This adds support for the HE-MU header as recently modified. It also
handles the unknown fields correctly, and has been subjected to some
captures as well.
Change-Id: Id0c6c3b4dd0f0a91722d0a1a2c1706270862d97e
Reviewed-on: https://code.wireshark.org/review/25479
Petri-Dish: Richard Sharpe <realrichardsharpe@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
QoS Queue Size is only applicable when To DS is true and for QoS Data,
QoS Null and QoS Data+CF-Ack frames.
Based on a reasonably careful reading of IEEE802.11-2016.
Change-Id: I16e7e7f4d0f3336e7d05c5f4f9c80179d514ec19
Reviewed-on: https://code.wireshark.org/review/26212
Petri-Dish: Richard Sharpe <realrichardsharpe@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
This patch adds support for sequencing HTTP Redirects. This enables
tracking of HTTP-based redirects, which may not have a Referer header.
As such, this patch also renames 'HTTP Referer statistics' to
'HTTP Request Sequences' to better reflect the more generic
functionality.
Note that this does not fully support RFC 3986. An external library like
uriparser.github.io may be a better option for efficient, full relative
HTTP URL resolution.
A Sample PCAP to test functionality is available here:
https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=http_redirects.pcapng
A sample PCAP to demonstrate usefulness is available here:
https://www.malware-traffic-analysis.net/2015/08/31/page2.html
(examine request to hxxp://lk2gaflsgh.jgy658snfyfnvh.com/service.php)
Change-Id: I9edd1a1de86228b0dcb1df9f6f30e24379684321
Reviewed-on: https://code.wireshark.org/review/26679
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
There is a typo on the attribute name for the ZCL OTA attribute 0x0000.
Change the attribute name to match the ZCL specification document.
Change-Id: I83f42128fb3fac8c75124f375dda392d6c8bdcab
Reviewed-on: https://code.wireshark.org/review/26678
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Roland Knall