Commit Graph

33861 Commits

Author SHA1 Message Date
Nardi Ivan c38c83c38f GQUIC: add support for Q046
Even if Q046 is an old version, it is still used by the current QUICHE
implementation.
In this way, the latest Wireshark is able to dissect all GQUIC versions
supported by recent Chrome (Q043,46,50 and T050,51), i.e. all GQUIC versions
that you can find in live traffic right now.
Pcap examples are available in #15984 and in the attachment.
Some Q046 information are available in:
https://docs.google.com/document/d/1FcpCJGTDEMblAs-Bm5TYuqhHyUqeWpqrItw2vkMFsdY/edit#heading=h.32qkkficm7za

Close #15984
2020-09-14 03:44:44 +00:00
Gerald Combs 84deceaf1c DVB-S2-TABLE: Another spelling fix.
Fix

I: libwireshark0: spelling-error-in-binary usr/lib/x86_64-linux-gnu/libwireshark.so.0.0.0 Continous Continuous

found by lintian.
2020-09-14 01:29:05 +00:00
Gerald Combs bd9554543c DVB-S2-TABLE: Fix spelling.
Fix

I: libwireshark0: spelling-error-in-binary usr/lib/x86_64-linux-gnu/libwireshark.so.0.0.0 adress address

found by linitian.
2020-09-14 00:45:20 +00:00
Gerald Combs cc3c195a32 WASSP: Fix spelling.
Fix

I: libwireshark0: spelling-error-in-binary usr/lib/x86_64-linux-gnu/libwireshark.so.0.0.0 Mangement Management

found by lintian.
2020-09-14 00:04:45 +00:00
Guy Harris 2260fabbdb ncp: fix indentation. 2020-09-13 14:18:47 -07:00
Thiyagarajan P 78466d1046 Support to dissect beacon timing element
Added support for dissecting the beacon timing element.
IEEE80211-2016, section 9.4.2.105.
2020-09-13 20:16:07 +00:00
Gerald Combs 951837a644 A615a: Fix spelling.
Fix

I: libwireshark0: spelling-error-in-binary usr/lib/x86_64-linux-gnu/libwireshark.so.0.0.0 Ammendment Amendment

found by lintian.
2020-09-13 18:01:01 +00:00
Nardi Ivan 46456dcf1a TLS: add missing parameters in QUIC Transport Parameters 2020-09-13 13:07:46 +00:00
Martin Mathieson 82827278f7 More dissector string spelling fixes.
Finally, it is becoming difficult to find more.
2020-09-13 09:03:08 +01:00
Alexis La Goutte 2f89b8d62c SMB/NBT: Add support of SMB over QUIC
Using ALPN smb

Issue: #13881

Thanks to Graham for help to use directly nbt dissector
2020-09-13 06:15:29 +00:00
Guy Harris 272502790b Add FT_STRINGZTRUNC.
FT_STRINGZPAD is for null-*padded* strings, where the field is in an
area of specified length, and, if the string is shorter than that
length, all bytes past the end of the string are NULs.

FT_STRINGZTRUNC is for null-*truncated* strings, where the field is in
an area of specified length and, if the string is shorter than that
length, there's a null character (which might be more than one byte, for
UCS-2, UTF-16, or UTF-32), and anything after that is not guaranteed to
have any particular value.

Use IS_FT_STRING() in some places rather than enumerating all the string
types, so that those places get automatically changed if the set of
string types changes.
2020-09-12 14:16:12 -07:00
Pascal Quantin 7811c06272 PFCP: fix dissection of C-TAG and S-TAG IEs 2020-09-12 20:29:16 +00:00
Alexis La Goutte 889dd0cbfb QUIC: Update to draft-30
Update value_string version (0x000e)
Add AEAD_LIMIT_REACHED (0xf) Error (with conflict fix : https://github.com/quicwg/base-drafts/pull/4088)

Issue #13881
2020-09-12 09:26:33 +00:00
Ronnie Sahlberg 9182bb9c48 smb2: add NegotiateContext/Compression flags field
Signed-off-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
2020-09-12 07:39:58 +00:00
Guy Harris 1a410ef0b0 ncp: fix a copy-and-pasteo.
In process_multivalues(), we create a protocol item for the attribute
syntax, but we don't fetch its value, and don't pass it to
print_nds_values() as the syntax argument; instead, we pass a variable
that wee initialize to 0, but never set.  (One of the disadvantages of
preemptively initializing local variables is that data flow analyzers in
compilers and static analyzers can't point out that you didn't set the
variables in question to *useful* values.)

This fixes the dissection of NDS Read replies.
2020-09-11 23:23:47 -07:00
Harald Welte 13ac47ad4e Q.933: Fix decoding of PVC Status field
This field is actually a bitmask of four bits.  It's somewhat odd
to decode it using a value_string.  In any case, the values were
plain wrong (shifted to the left by '1').

See Figure A.3 of ITU-T Q.933

A related pcap file can be found at
https://people.osmocom.org/laforge/pcap/gsmtap-fr-q933-pvc_status.pcap
2020-09-11 23:42:00 +02:00
Harald Welte ee292b11a7 Q,933: Fix display of 'active' bit in PVC Status
The mask applied to the final octet of the PVC Status IE must be 0x0E,
not 0x0A.  The current code masks out the active bit, printing a '.'
instead of it.

See Figure A.3 of ITU-T Q.933

A related pcap file can be found at
https://people.osmocom.org/laforge/pcap/gsmtap-fr-q933-pvc_status.pcapc
2020-09-11 22:40:33 +02:00
Odysseus Yang 726e0ccb0a MBIM: dissect the commands of MBIM extended version 2.0
MBIM_CID_VERSION
MBIM_CID_REGISTER_STATE
MBIM_CID_PACKET_SERVICE
MBIM_CID_SIGNAL_STATE
2020-09-11 17:10:58 +00:00
robionekenobi 83b45f0c2e packet-mq: Improve Structure Display
FCNO Improve field display
FOPA Improve field display
FCMI Support new structure
GMO  Support version 4
LPOO Improve field display
ID   Initial Data Improve field display
PMO  Improve QName display in COL_INFO
CONN Improve field display
2020-09-11 08:12:24 +00:00
Guy Harris e32d2c7a7a gvsp: fix type of GenDC signature.
To quote the GenDC 1.1 specification, section 2.2.2 "GenDC Container
Header Description":

	Unique signature identifying a GenDC Container: a FourCC code
	encoded as 4 ASCII characters not null terminated ...

so it's FT_STRING, not FT_STRINGZ.

Give the URL for a page pointing to all GenICam standards, including the
GenDC standards, version 1.0 and 1.1.
2020-09-10 23:35:09 -07:00
Guy Harris b340dc8de8 SAP: make the Server Name field FT_STRINGZPAD.
According to the Novell IPX Router Specification, Chapter 4 "Service
Advertising Protocol (SAP)":

	Server Name

	This field contains the 48 byte character string name that is
	assigned to a server.  The Server Name, in combination with the
	Service Type, uniquely identifies a server on an internetwork.
	Although SAP response packets always include the full 48 bytes
	for this field, typical server names are usually less than 48
	characters long and are ASCII NULL terminated.  The contents of
	the unused bytes which follow the NULL terminator are undefined.

which seems to indicate that a full 48-byte name will not have a null
termintor.  It also indicates that the field isn't null-padded, just
"null-terminated if it's not terminated by the end of the field's fixed
length"; perhaps we need to distinguish between the former and the
latter, although it's not clear what would be a good short name for the
latter.

In any case, it sounds as if it's not guaranteed to be null-terminated.
2020-09-10 18:32:35 -07:00
Guy Harris 3fa8f42c76 bpdu: fix some string types.
As per IEEE Std 802.1Q-2016, section 13.8 "MST Configuration Identifier
(MCID)",

	The Configuration Name, a variable length text string encoded
	within a fixed field of 32 octets, conforming to IETF RFC 2271's
	definition of SnmpAdminString.  If the Configuration Name is
	less than 32 characters, the text string should be terminated by
	the NUL character, with the remainder of the 32-octet field
	filled with NUL characters.  Otherwise, the text string is
	encoded with no terminating NUL character.

so it's not FT_STRINGZ, it's FT_STRINGZPAD.

This applies to other configuration names as well.
2020-09-10 16:20:09 -07:00
Alexander Couzens f33e1c13fa gsm_a_rr: correct spare bits of Channel Description
ETSI 44.018: 10.5.2.5: spare bits are 3+4 and not 5+6. The counting
in the spec might be confusing, because bits start at 8 not at 1.
2020-09-10 22:37:41 +00:00
Guy Harris 5e1a302d9e afp: treat passwords as null-padded.
They're sent over the wire as an 8-octet field, with passwords shorter
than 8 octets padded with NULs.

Update some URLs while we're at it.
2020-09-10 14:28:29 -07:00
Aurelien Aptel fd922bc806 SMB2: add new RDMA transport negotiate context
From [MS-SMB2] version 61.
2020-09-10 20:26:22 +02:00
Aurelien Aptel 51a1765698 SMB2: add new transport negotiate context
From [MS-SMB2] version 61.
2020-09-10 20:26:22 +02:00
Aurelien Aptel 76229da61d SMB2: add new compression algorithm in negotiate context
From [MS-SMB2] version 61.
2020-09-10 20:26:22 +02:00
Nardi Ivan bb563317a1 GQUIC: fix endianess for Q050, T050 and T051 2020-09-10 15:02:19 +00:00
Alexis La Goutte b801e7c4a9 gQUIC: fix wrong encoding for client timestamp (ctim)
Closes #16839
2020-09-10 14:01:41 +00:00
robionekenobi 8893a0f311 packet-mq: code reformating
Reformat some code part to remove unneeeded spaces
2020-09-10 11:51:40 +00:00
Martin Mathieson a2a3e38fdb Fix some more dissector spellings. 2020-09-10 11:26:16 +00:00
Guy Harris b446e36471 aeron: the Error String in an Error Header is not null-terminated.
The Aeron specification says nothing about it being null-terminated, and
in at least some captures, it's not null terminated.

Make it an FT_STRING, rather than an FT_STRINGZ.

Clean up a comment so that more of the URL is visible in a narrower
window.
2020-09-10 11:02:22 +00:00
atul358 1b5be9bcba Issue 16683 - SIP - Dissection of Logme Marker in the Session ID header of the sip packet 2020-09-10 10:18:26 +00:00
Anders Broman c0f6f7a7c1 SDP: Handle fmpt:MCVideo
The dissector expect a numeral(PT) after fmtp: exept for listed strings,
add MCVideo to those strings.
2020-09-10 08:36:58 +00:00
RobiOne (Robert Grange) 106e686e45 packet_mq: Support V9.2, improve MultiSegment, improve some struct display
MQ V9.2 support
Improve disscetion for multi-segment MQGET_REPLY, MQPUT, MQPUT1, ASYNCH_GET
Improve display for some structure (ID, CONN) Some fixes
2020-09-10 07:41:25 +00:00
Alexis La Goutte a4319f3254 ieee80211: fix Wmissing-prototypes
no previous prototype for function 'add_ff_action_public_fields' [-Wmissing-prototypes]

Change-Id: I8be64454a21187cf60a04c903acfbb18f2a12095
2020-09-09 06:06:29 +00:00
Alexis La Goutte f75281cdd0 QUIC: Fix missing bit shift from KP (Key Phase) 2020-09-09 03:43:54 +00:00
Gerald Combs 08b5061733 Release notes: Miscellaneous cleanup.
Update a dissector name.
2020-09-08 22:01:14 +00:00
Georg Richter 2f1cf93174 MySQL: Added support for MariaDB protocol
MariaDB and MySQL are not longer drop-in compatible, they differ in very
different directions
for protocol and api. This patch contains support for MariaDB specific
commands and extensions:

- MariaDB specific character sets and collations (also updated MySQL
collations)
- MariaDB extended capabilities in greeting and login packets
- Support for MARIADB_STMT_BULK_EXECUTE command
- Removal of "5.5.5-" prefix in the version string.
2020-09-08 09:02:02 +02:00
Nardi Ivan 8bcf6783a5 TLS: add missing parameters in quic_transport_parameters extension
These parameters are used by latest GQUIC versions.
Pcap examples are available in #16825

I noticed that gquic::dissect_gquic_tag() and gquic::dissect_gquic_tags()
don't really need the gquic_info parameter: remove it
2020-09-08 03:37:58 +00:00
Pau Espin 5a874c5796 BSSMAP: Fix malformed packet exception on correct packet
Both osmocom and TTCN3 Titan are parsing Handover Request with an IPv6
Transport layer Address just fine, but wireshark was showing it as
malformed. Parsing the address similar to what is done in IPv4 fixes the
issue.
2020-09-07 18:48:15 +00:00
Pau Espin 28faecec7a BSSMAP: Fix used param marked as unused 2020-09-07 18:48:15 +00:00
Martin Mathieson d461bf3025 Yet more spelling fixes.
Includes small updates to the script and wireshark dictionary.
Probably the last spelling fixes from me for a while.
2020-09-07 16:35:13 +01:00
Alexis La Goutte 9fb13aaa9a SMB2: add missing cipher type for SMB2_ENCRYPTION_CAPABILITIES
From https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/16693be7-2b27-4d3b-804b-f605bde5bcdd
2020-09-05 19:59:33 +00:00
Pascal Quantin d541071dae E1AP: upgrade dissector to v16.2.0 2020-09-05 18:00:48 +02:00
Pascal Quantin 291c836392 F1AP: upgrade dissector to v16.2.0 2020-09-05 13:32:33 +02:00
Pascal Quantin 87521e8bf5 NGAP: fix a comment in the header file and add it to CMakeLists.txt 2020-09-05 11:52:37 +02:00
Gerald Combs 7ab6440416 Tools: Clean up checkAPI and add ui/qt.
Remove the --check-addtext and --build flags. They were used for
checkAddTextCalls, which was removed in e2735ecfdd.

Add the sources in ui/qt except for qcustomplot.{cpp,h}. Fix issues in
main.cpp, rtp_audio_stream.cpp, and wireshark_zip_helper.cpp.

Rename "index"es in packet-usb-hid.c.
2020-09-05 07:41:29 +00:00
Nardi Ivan a46b62fcab (G)QUIC: improve dissection capabilities (Q050, T050 and T051)
Fix support for Q050 and add support for T050 and T051.
For these 3 versions, add dissection of (at least) Initial Packets.

For salts and other info, see:
"A Guide to Parsing QUIC Client Hellos for Network Middlebox Vendors"
https://docs.google.com/document/d/1GV2j-PGl7YGFqmWbYvzu7-UNVIpFdbprtmN9tt6USG8/preview

Note these versions are actively used by Chrome right now.
Based on https://code.wireshark.org/review/#/c/37492/ done by @alagoutte
2020-09-05 07:02:04 +00:00
Martin Mathieson 51cbb47e1f Fix some detected spelling errors in ASN1 dissectors.
Done by scanning the asan1 template files. If there are spelling
mistakes in the specifications, we should ignore.  Note that for z3950, I had
already found and accidentally fixed the same errors in the generated
file (before I taught my script to ignore gnerated dissector files).
2020-09-05 00:51:48 +00:00