Commit Graph

45331 Commits

Author SHA1 Message Date
Martin Mayer ffde66ea7c dissector: Open Control Protocol OCP.1/AES70 2022-08-24 14:20:18 +00:00
John Thacker fab27018b4 dtls: Handle invalid use_srtp protection profiles length
Handle a bad length, and set some expert infos if bad. Fix #18289
2022-08-24 08:30:03 -04:00
Guy Harris 2aeaf71fa5 Change names to reflect that it's an endpoint table.
More {host, hostlist} -> endpoint.
2022-08-23 22:15:45 -07:00
Chuck Craft 5399334ebc smpp: add NULL address_range to packet details
Sample capture attached to #6108
Account for all the bytes displayed in the packet bytes.
https://smpp.org/SMPP_v5.pdf - 4.7.3 address_range
2022-08-24 03:42:09 +00:00
Pau Espin e9618dccb1 BSSMAP: Show SAC in CellId tree
Similar is done for CGI, where LAC (%x)/CI (%u) is shown.
Let's do the same for SAI case, otherwise it's confusing since it first
looks as if LAC Cell Identifier was sent, but it is actually of type
SAI.
2022-08-24 03:01:50 +00:00
John Thacker 6da668d303 SMTP: Handle pipelining of DATA and BDAT
Handle RFC 2920 and RFC 3030 pipelining of DATA and BDAT. This
involves:

Instead of storing a single PDU type for each frame, storing
a linked list of PDUs (with end offsets), in order to handle
frames that switch between data and command state. This includes
handling other commands before or after a BDAT command, or handling
other commands after a DATA EOM. That means parsing the remaining
lines after BDAT and EOMs on the first pass instead of assuming that
the rest of the frame has a known type.

Also, RSET commands allow switching between BDAT transaction
and DATA transactions, per RFC 3030.

The case where more than one message is completed in a single frame
is not yet handled. RFC 2920 and 3030 imply that this is non-standard,
but it could work. To handle it, we would also have to track message
numbers in order to give fragment_add_seq_next unique frag IDs.
(It doesn't handle more than one fragment with the same ID ending in
the same frame.)

Fix #17269. Fix #17267.
2022-08-24 02:42:41 +00:00
Guy Harris 4b53f31d2d Fix comments to reflect reality.
It's an endpoint table, not a table of hosts.
2022-08-23 19:07:25 -07:00
Jérôme Pouiller ef513118f9 Update Wi-SUN FAN dissector with LBC-IE
The last specification of the Wi-SUN FAN (I have not checked when it
appeared, but it is present in 1.1v04) introduce LBC-IE (see
"6.3.2.3.1.17 LFN Broadcast Configuration Information Element
(LBC-IE)").
2022-08-23 19:54:17 +00:00
Jérôme Pouiller 3fc57d3f93 Update Wi-SUN FAN dissector with last LBS-IE specification
The last specification of the Wi-SUN FAN (I have not checked when it
appeared, but it is present in 1.1v04) introduce the field
broadcast_sync_period in LBS-IE (see "6.3.2.3.1.13 LFN Broadcast
Schedule Information Element (LBS-IE)").
2022-08-23 19:54:17 +00:00
Guy Harris ec6fd00518 Fix deprecation warning.
get_hostlist_packet_func() was not deprecated in favor of itself, it was
deprecated in favor of get_endpoint_packet_func().
2022-08-23 19:20:47 +00:00
Michael Tuexen 13a302da6e TCP: Improve consistency of reproting the SACK supported option
The =1 part does not make any sense in reporting SACK_PERM=1.
There is no value in the option and if it is not supported the
option is not there. So remove the =1 part.
2022-08-23 19:02:24 +00:00
João Valverde 3109ba9e57 epan: Add back missing public API declaration.
Follow-up to d9e662bc54.
2022-08-23 14:44:23 +01:00
Guy Harris d9e662bc54 Rename some functions and types for endpoint tables.
The "conversation table" mechanism supports two types of tables, one for
the "Conversations" menu item under "Statistics" and one for the
"Endpoints" menu item under "Statistics".  The first of them shows
statistics for conversations at various layers of the networking stack;
the second of them shows statistics for endpoints at various layers of
the networking stack.

The latter is *not* a table of hosts; an endpoint might be a host,
identified by an address at some network level (MAC, IP, etc.), or it
might be a port on a host, identified by an address/port pair.

Some data types, function names, etc. use "host" or "hostlist" or other
terms that imply that an endpoint is a host; change them to speak of
endpoints rather than hosts, using names similar to the corresponding
functions for conversations.

Provide wrapper functions and typedefs for backwards source and binary
compatibility; mark them as deprecated in favor of the new names.

Clean up some comment errors found in the process.
2022-08-23 09:55:14 +00:00
zhangzhilei 21d93f072a TLS:add error check for ssl_hmac_init
add error check for ssl_hmac_init
2022-08-23 02:20:53 +00:00
John Thacker cbe4cd926c HTTP: Send binary Continuation Data to Follow Stream
If we shortcut the HTTP header check because the file starts with
a non-ASCII character, but we think that it is Continuation Data
because we've seen real HTTP in the same conversation, mark the
data as file data and send it to the follow tap, just as we would
if it failed the more extensive checks for being a header. Deals
with cases where desegmentation isn't performed (whether because
of prefs, missing packets, bad checksums, etc.)

Related to #13918.
2022-08-22 03:58:30 +00:00
John Thacker 2617ff294f SMTP: Move the request handling into a function
This makes the code easier to read and will enable handling
multiple PDUs in a message easier (needed for full pipelining
support.)
2022-08-21 18:00:18 -04:00
John Thacker d6812621a0 SMTP: Move response handling into function
Make the code a little easier to read
2022-08-21 18:00:18 -04:00
Martin Mathieson 9a5029b364 DCT2000: Don't assign to tag unused value 2022-08-21 19:48:13 +00:00
Gerald Combs 70dbe58aea [Automatic update for 2022-08-21]
Update manuf, services enterprise numbers, translations, and other items.
2022-08-21 16:39:53 +00:00
John Thacker ccf720d95d epan: Handle subset tvbuffs with non-zero offets and length -1
According to tvbuff.h, tvb_new_subset_length() with length -1
should behave like tvb_new_subset_remaining(). That means that
the reported length should subtract off the offset into the
original tvb.
2022-08-21 15:21:24 +00:00
Chien Wong 5c216de8cc ieee80211: Improve A-MSDU dissecting
Fix subframe length issue.
Add padding.

Signed-off-by: Chien Wong <m@xv97.com>
2022-08-20 16:43:32 +00:00
Chien Wong 3b7c611be1 ieee80211: Add Transition Disable KDE dissecting
Signed-off-by: Chien Wong <m@xv97.com>
2022-08-20 06:14:29 +00:00
Stephen Hemminger 005169491e pcapng: add support displaying hash from pcapng
Add support for displaying one or more packet hashes that
have been recorded in EPB options.

A patch to add support for EPB hash option is pending for next
DPDK release.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
2022-08-20 06:12:28 +00:00
Gerald Combs 07c7ce6ad0 Windows: Upgrade libgcrypt to 1.10.1. 2022-08-19 18:30:16 -07:00
John Thacker 346c53b0b2 QUIC: In stateless reset only set from_server if token found
When calling quic_find_stateless_reset_token, only change the
from_server pointer is the reset token is actually found.
Fixes a few cases where a new Initial connection is sent with
client and server reversed. Also fixes an error failing to
dereference a pointer to a boolean.
2022-08-19 19:37:41 -04:00
David Perry d0c8efe889 Use `register_dissector()` for more protocols 2022-08-19 22:53:58 +00:00
Martin Mathieson b809e73f7c Fix some spelling errors 2022-08-19 17:46:34 +01:00
huangqiangxiong bb6fc5bb9a Protobuf: correct the starting offsets of the field name and type tree items 2022-08-19 15:14:09 +00:00
John Thacker 2007c929d2 QUIC: Add support for stateless reset
Fix #17938
2022-08-19 12:46:07 +00:00
zhangzhilei 034e48b500 TLS:support decrypt TLS_SM4_GCM_SM3 ciphersuite
ECC_SM4_GCM_SM3 is defined in RFC8998,and it defined how to use
SM3 and SM4 in tls1.3.
2022-08-19 18:08:39 +08:00
zhangzhilei 10b2e62a4a TLS:support decrypt ECC_SM4_GCM_SM3 ciphersuite
ECC_SM4_GCM_SM3 is defined in GB/T38636-2020
Information security technology-Transport layer cryptography protocol
which is a Chinese national standard.
the gcm behaviour of ECC_SM4_GCM_SM3 is the same as TLS1.2.
2022-08-19 08:28:40 +00:00
ismaelrti 066e80cb33 RTPS: Added new Security PIDs in Participant and Endpoint Discovery
Added dissections for the following PIDs:
- PID_PARTICIPANT_SECURITY_DIGITAL_SIGNATURE_ALGO
- PID_PARTICIPANT_SECURITY_KEY_ESTABLISHMENT_ALGO
- PID_PARTICIPANT_SECURITY_SYMMETRIC_CIPHER_ALGO
- PID_ENDPOINT_SECURITY_SYMMETRIC_CIPHER_ALGO
2022-08-19 07:55:05 +00:00
zhangzhilei 7b56170979 TLS:support decrypt ECC_SM4_CBC_SM3 ciphersuite
ECC_SM4_CBC_SM3 is defined in GB/T38636-2020
Information security technology-Transport layer cryptography protocol
which is a Chinese national standard.
prf alg of ciphersuites defined in GB/T 38636-2020 are the same as TLS1.2.
2022-08-19 07:25:51 +00:00
Dario Lombardo bd0949ba1e rdpudp: fix leaking copy_address.
Fix: #18224.
2022-08-19 04:21:45 +00:00
Michael Tuexen ecefcf8801 TCP: Implement AccECN
This work is based on
https://www.ietf.org/archive/id/draft-ietf-tcpm-accurate-ecn-20.html
In particular, add support for the AccECN option, the experimental
AccECN option, the AE flag and the ACE field.
2022-08-19 00:41:24 +00:00
Vadim Yanitskiy 2755cb7516 GSUP: add missing Number of Vectors Requested IE
This IE was introduced back in 2019, see:

https://gerrit.osmocom.org/q/Iaecc47280f8ce54f3e3a888c1cfc160735483d0f
https://cgit.osmocom.org/libosmocore/commit/?id=49ddef610a003f1000422284bf31a653249cf09e
2022-08-18 18:42:53 +00:00
Vadim Yanitskiy 9ca0193fed GSUP: add missing Supported/Current RAT Types IEs
These IEs were introduced back in 2018, see:

https://gerrit.osmocom.org/q/I93850710ab55a605bf61b95063a69682a2899bb1
https://cgit.osmocom.org/libosmocore/commit/?id=1b729ce106f474e29e7bbd57c01c3472e75a8b25

Below is an example PDU containing them:

GSUP SendAuthInfo Request, IMSI: 901700000043352
    Message Type: SendAuthInfo Request (8)
    IE: IMSI, 901700000043352
        Information Element Identifier: IMSI (1)
        Information Element Length: 8
        IMSI: 901700000043352
        [Association IMSI: 901700000043352]
            Mobile Country Code (MCC): International Mobile, shared code (901)
            Mobile Network Code (MNC): Clementvale Baltic OÜ (70)
    IE: Supported RAT Types
        Information Element Identifier: Supported RAT Types (41)
        Information Element Length: 1
        Supported RAT Type: EUTRAN (SGS) (3)
    IE: Current RAT Type
        Information Element Identifier: Current RAT Type (42)
        Information Element Length: 1
        Current RAT Type: EUTRAN (SGS) (3)
2022-08-18 18:42:53 +00:00
Michael Tuexen c2574b72f4 TCP: Add support for TARR option
Based on https://datatracker.ietf.org/doc/html/draft-gomez-tcpm-ack-rate-request-05.
2022-08-18 00:08:30 +02:00
Michael Tuexen 9cea2c26a1 TCP: Use RFC 6994 for experimental options
Modernize the handling of experimental TCP options based on
RFC 6994. In particular use ExID instead of magic (which
in the context of RFC 6994 are the last two bytes of a
32-bit ExID) and add a desciption of ExID based on the
current state of the IANA registry.
2022-08-17 21:33:31 +00:00
David Perry 3b36ae4b1a TCP tap: check if have seglen before using it 2022-08-17 19:41:05 +00:00
Michael Pergament bd6c21696a Add support for Addd Path in EVPN NLRI 2022-08-17 18:22:17 +00:00
Rubin Gerritsen 56817af9b5 Bluetooth: Decode LL_VERSION_IND packets with version 5.3
Bluetooth 5.3 was released 2021-07-13.

Signed-off-by: Rubin Gerritsen <rubin.gerritsen@nordicsemi.no>
2022-08-17 16:29:25 +02:00
John Thacker 704d6ff104 smb: Squash small leak in export object
After a free chunk is removed from the list of free chunks,
it should be freed.
2022-08-17 13:41:09 +00:00
Uli Heilmeier 117788f694 BTATT: Fix bitmask for btatt.battery_power_state
Fixes: #18267
2022-08-17 14:33:39 +02:00
John Thacker b3c7c31124 tiff(file): Don't add a proto item when heuristics fail
Don't add the protocol to the tree if heuristics fail.
Make sure that we have enough bytes to perform the heuristics.
If the magic number is wrong, don't go on to retrieve the ifd offset.
2022-08-17 07:52:39 +00:00
Tomasz Moń c6ef99f006
win32-utils: Explicitly list inherited handles
Windows processes inherit all inheritable handles when a new process is
created using CreateProcess() with bInheritHandles set to TRUE. This can
lead to undesired object lifetime extension. That is, the child process
will keep ineritable handles alive even if it does not use them. Up to
Windows Vista it was not possible explicitly list handles that should be
inherited. Wireshark no longer works on Windows releases earlier than
Vista, so use the new API without checking Windows version.

Require all callers to win32_create_process() to pass in the list of
handles to inherit. Set the listed handles as inheritable shortly before
calling CreateProcess() and set them as not inheritable shortly after
the process is created. This minimizes possibility for other callers
(especially in 3rd party libraries) to inherit handles by accident.

Do not terminate mmdbresolve process on exit. Instead rely on process
exit when EOF is received on standard input. Previously the EOF was
never received because mmdbresolve inherited both ends of standard input
pipe, i.e. the fact that Wireshark closed the write end was not observed
by mmdbresolve because mmdbresolve kept write handle the standard input
pipe open.
2022-08-16 20:53:22 +02:00
Trond Norbye fb0d271641 [Couchbase] Add support for new features
Add support for parsing RU and WU reported in flex header and
the new status codes.
2022-08-16 14:24:46 +00:00
Adrian Granados 9a560060ad ieee80211: Add dissector for Arista (Mojo) vendor specific IE
Dissector only supports type 6: AP Name.
2022-08-16 14:08:15 +00:00
Dieter Dobbelaere 321465db07 Corrected description of `wlan.fc.type_subtype`. 2022-08-16 12:19:48 +00:00
Anders Broman a47830e56f Increase number of preallocated fields. 2022-08-16 09:43:42 +02:00