While running a test suite of a DNS server, a lot of DNS messages on
non-standard ports were not recognized. Rather than manually discovering
and decoding every port using an iterative process of checking the
output of the `udp and not dns` filter, have some heuristics to detect
DNS messages automatically.
Enable these heuristics by default assuming that the checks are strong
enough, 8 bytes are essentially fixed to a low number of possibilities.
Should it cause issued, then the heuristics could be disabled (assuming
that non-standard DNS ports are uncommon) or strengthened.
The macOS installer works differently from the way it did when that
message was written (it's now a drag-install for Wireshark, with
separate installers for ChmodBPF and for files to add the Wireshark
binary directory to the default $PATH), and the macOS main screen now
offers a "click this to install" link, running the ChmodBPF installer,
if the user doesn't have permissions to capture. Update the message
to reflect that (although that's wrong if you directly run dumpcap or
run it via TShark - this needs to be cleaned up in some fashion).
Fix a capitalization error while we're at it.
In the code that generates the main screen message to which the dumpcap
message refers, add a comment saying that, if the main screen message
changes, dumpcap's message should also be updated.
Move the maximum number of tree items and maximum tree depth to
preferences instead of hardcoded values. Refer to issue #12584 for
an example VNC capture where real data exceeds the current limit.
* Use parameter names from draft-ietf-dnsop-svcb-https-01 to match the
presentation format. Use keyNNNNN for unknown names in the tree.
* Remove the SvcParams tree and directly display parameters under the
resource record tree. Include the parameter value as well.
* Add odohconfig (draft-pauly-dprive-oblivious-doh-02) support.
* Use the presentation format (base64) for echconfig/odohconfig values.
Instead of grabbing the set of IDBs found at open time, have a loop
using wtap_get_next_interface_description() to read all unread IDBs run
after opening the input file, after reading a packet from the input
file, and after getting an EOF on the input file.
Add a routine wtap_uses_interface_ids() to check whether the file type
and subtype for a dump file uses interface IDs and requires IDBs. If
so, in the aforementioned loop, add the IDBs to the dump stream.
Add a routine wtap_dump_add_idb() to add IDBs to a dump stream. Have it
call a file-format-specific routine to add the IDBs; the only file type
that supports it is pcapng, and it 1) writes out the IDB and 2) adds it
to the set of IDBs for the stream.
Add a wtap_dump_params_init_no_idbs() routine that prevents the IDBs
from the input file from being used to initialize the output file; use
it in cases where we're using the aforementioned loop to copy over IDBs.
Don't require any IDBs to be present when opening a pcapng file for
writing; 1) the simplest pcapng file has just an SHB in it, 2) that
requirement causes dumps that don't provide IDBs at open time to fail,
and 3) the real issue is that we don't want packets with an interface ID
not corresponding to a known IDB, and we already have a check for that.
(There are some hacks here; eventually, when everything processes the
IDBs in such a loop, we may be able to get rid of the "two favors of
dump parameter initialization" hack.)
Fixes#15844.
Addresses the same issue in #15502, but there are other issues there
that also need to be addressed.
In addition, the merge code also needs to be changed to handle this.
Fix Qt 5.15 deprecation warnings in QCustomPlot, similar to 76d92ba7e7.
Use default flags constructors instead of 0.
Use QWheelEvent::angleDelta() instead of QWheelEvent::angle().
Use QWheelEvent::position() instead of QWheelEvent::pos().
Use date::startOfDay() instead of QDateTime(date).
Use QMultiMap instead of QMap where needed.
According to [MS-FSCC] if the file has the REPARSE_TAG attribute, the
EaSize field must be interpreted as a reparse tag for the following
info levels:
* FileFullDirectoryInfo
* FileBothDirectoryInfo
* FileIdFullDirectoryInfo
* FileIdBothDirectoryInfo
From tools/check_typed_item_calls.py output:
epan/dissectors/packet-bssgp.c:655 proto_tree_add_item called for hf_bssgp_bss_area_ind - item type is FT_UINT8 but call has len 2
epan/dissectors/packet-bssgp.c:1468 proto_tree_add_item called for hf_bssgp_unit_val - item type is FT_UINT8 but call has len 3
epan/dissectors/packet-bssgp.c:1469 proto_tree_add_item called for hf_bssgp_gprs_timer - item type is FT_UINT8 but call has len 3
epan/dissectors/packet-bssgp.c:2606 proto_tree_add_item called for hf_bssgp_unit_val - item type is FT_UINT8 but call has len 3
epan/dissectors/packet-bssgp.c:2607 proto_tree_add_item called for hf_bssgp_gprs_timer - item type is FT_UINT8 but call has len 3
epan/dissectors/packet-bssgp.c:2635 proto_tree_add_item called for hf_bssgp_unit_val - item type is FT_UINT8 but call has len 3
epan/dissectors/packet-bssgp.c:2636 proto_tree_add_item called for hf_bssgp_gprs_timer - item type is FT_UINT8 but call has len 3
epan/dissectors/packet-bssgp.c:3276 proto_tree_add_item called for hf_bssgp_cell_acc_mode - item type is FT_UINT8 but call has len 4
It currently wraps wtap_block_create() and wtap_block_copy(); if there
are no remaining use cases for wtap_block_copy() at some point, it can
just *replace* wtap_block_copy().
In a wtap, keep track of the first interface description not yet fetched
with wtap_get_next_interface_description() and, when
wtap_get_next_interface_description() is called, have it return that
description, as a wtap_block_t for its IDB. If there are no
as-yet-unfetched interface descriptions, return NULL; there may, in the
future, be more interface descriptions for the file, so this should be
called:
* after the file is opened;
* after wtap_read() returns TRUE, indicating that it's returned a
record (and *before* you process the record that wtap_read()
returns, as it might be the interface description for the
interface on which the packet in that record arrived);
* after wtap_read() returns FALSE, indicating an EOF or an error
return (as there might have been interfaces at the end of the
file or before the error point).
At each of those points, the caller should loop until
wtap_get_next_interface_description() returns NULL.
Not used yet (but tested with capinfos, which found a reason why you
have to wait until the end of the file before processing the interface
information - there's now a comment in the code giving that reason).
This will probably be used in the future.
Add support internally to using iconv (always present with glib) to convert
strings from various encodings to UTF-8 (using REPLACEMENT CHARACTER as
recommended), and use that to support GB 18030 and EUC-KR. Replace call
directly to iconv in ANSI 637 for EUC-KR to new API. Update comments
and documentation around character encodings. It is possible to replace
the calls to iconv with an internal decoder later. Tested on Linux and
on Windows (including with illegal characters). Closes#16630.
For WPA security association (SA) entries are created on sucessful
PTK derivation from 4-way handshake frames. WEP though don't use
4-way handshake frames for key derivation and therefore no SA entry
is created. Still WEP decryption implementaton expects to find
an SA otherwise the decryption is skipped.
Fix broken WEP decryption by removing the check for an existing SA
entry and instead form the SA on first successful decryption.
Add also a test for WEP decryption.
Fixes: v3.3.0rc0-1263-g099d241046 ("dot11decrypt: Avoid allocating SA on packet decryption")
The SOCKS dissector temporarily changes the pinfo values for destport
or srcport, so it should get the tcp_conversation_data after doing so
before recursively calling the TCP dissector again. Otherwise the TCP
dissector will be confused about whether a TCP multisegment PDU is in
progress or not, causing failure to lookup and store fragments correctly,
including both failed desegmentation and failed asserts (when it expects
an entry in the table which isn't there, as it was stored under a different
port number.) Fixes#16646.
In captures where a lot of packets are missing, requests and ACKs are
sometimes incorrectly paired. With this improvement, ACKs must arrive in
a reasonable time to be paired with a request.
What we care about here is the packet type, not the file type, as we
care what's at the beginning of the packet. This should have no effect
in practice, but it makes it clearer what we're testing for.
Currently, the only file types that use them are pcapng and IBM's
iptrace; we don't support writing the latter, so this is mainly of
interest for pcapng.
This makes it a bit more obvious what some "is this pcapng?" tests are
really trying to determine, and allows them to automatically support any
new file types that use them.
(With regard to interface descriptions, tere are three types of file:
1) files that contain no interface information;
2) files that contain "just FYI" interface information but that don't
tie packets or other records to particular interfaces;
3) files that contain interface information and tie all packets (and
possibly other records) to an interface.
This tests for files of type 3.)
A previous change initialized the k_connection_handle, so we don't
compare random data with remote_bdaddr->chandle, but perhaps we
shouldn't compare it at all if we didn't find a handle pair.
Moshe Kaplan