Commit Graph

39962 Commits

Author SHA1 Message Date
Fabian Bäumer 19ddbcaaae feat(ssh): Add SSH extension dissection support (RFC8308) 2024-01-27 00:12:33 +00:00
Thibaut Vandervelden a3900a5d5e change display order of IEEE802154 address fields
This patch changes the display order of the IEEE802154 address fields
only for the IEEE802154 tree root. The order of the address fields
for the other trees is not changed. The order is now source address
first. This is not the same as the order in the frame, where the
destination address is first. However, reading it from left to right
makes more sense when the source address is first.
2024-01-26 14:12:47 +00:00
Uli Heilmeier 08956f6d13 DNS: Add expert info for missing response 2024-01-26 14:04:30 +00:00
Maxim Sharabayko 864c212b51 SRT: Parse the Group HS extension
Added parsing of the Group handshake extension of the SRT protocol.

Internet-Draft: https://haivision.github.io/srt-rfc/draft-sharabayko-srt.html#section-3.2.1.4
2024-01-26 08:19:47 +00:00
Riya Dixit 1e3a1d7118 Adding PLDM dissector for Platform Specification
This commit implemements PLDM dissector
for the Platform specification of the protocol
which is done following DMTF guideline
documentation -
https://www.dmtf.org/sites/default/files/standards/documents/DSP0248_1.2.0.pdf

Testing : For verification of dissector
pcap file collected during host poweron
is used as well as used custom pcaps.

Signed-off-by: Riya Dixit <riyadixitagra@gmail.com>
2024-01-26 07:19:53 +00:00
Martin Mathieson 4571d9f194 Fix more FT_BOOLEAN items with no mask - set len to BASE_NONE 2024-01-25 22:01:03 +00:00
Martin Mathieson fa84f7541e Check that FT_BOOLEAN items with zero-mask use BASE_NONE 2024-01-25 19:32:47 +00:00
Antonio Vázquez Blanco bf30e483c0 bthci_vendor: Add broadcom read mem and refactor writemem 2024-01-25 11:40:21 +01:00
John Thacker 5a28b01e86 rtmpt: Don't allow chunk_size to be zero or negative
There's a number of variables that are lengths that should probably
be unsigned, but at least make sure negative values don't get assigned
to the chunk size, which can lead to an infinite loop. (It's read from
the packet as an unsigned 32 bit integer, but it should never in
practice have a value in the top half of that range.)

Fix #19617
2024-01-24 23:10:37 -05:00
Anders Broman 4d6a8c85b5 Fix base for FT_BOOLEAN without bitmask(BASE_NONE) 2024-01-24 21:58:02 +01:00
Anders Broman cf74fae3d9 HTTP2: Heuristicly detect application/json 2024-01-24 11:44:08 +00:00
Timo Warns 5c972dd075 GNSS: fix formatting of SBAS MT25 velocities
Fix the formatting of SBAS MT25 velocities: Cast constant to int64 type
to ensure that arithmetics for formatting are performed using int64.
2024-01-23 21:40:38 +00:00
Chaitanya Tata 72e83ae49a ieee80211: Add decode as Wi-Fi for UDP payload
If Wi-Fi packet is encapsulated in an UDP payload (IPIP tunneling),
then we can use this functionality to decode it as 802.11.

This is intended primarily for [1].

[1] - https://docs.zephyrproject.org/latest/samples/net/capture/README.html

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
2024-01-23 20:18:41 +00:00
Anders Broman 457764fce3 HTTP2: Heuristically detect multipart/mixed
For dissection purposes I think all the multipart types in rfc1341
https://www.w3.org/Protocols/rfc1341/7_2_Multipart.html can be treated
as multipart/mixed.
ping #19424
2024-01-23 15:23:25 +00:00
Christian Krump 808d9d39f7 openSAFETY: adapted verification of ID fields in sub frames
The verification of the ID fields fails if the address field in sub frame 2 takes more than 8 bit
2024-01-23 15:32:51 +01:00
Martin Mathieson b6a9c48eb5 E2AP CCC: Clarify that V1 has been added 2024-01-23 14:12:21 +00:00
pespin.shar@gmail.com de98508497 gsup: Fix decoding of empty IEs 2024-01-23 11:01:04 +00:00
Cole Wu 0926a98b30 Zigbee ZDP dissector field parsing fix
Fixed dissector cannot parse `zbee_zdp.assoc_device_count`
field error. Thanks to Mohammed Suhel mhs@exegin.com for
original implementation.

Change-Id: I3f65aee3d5cc156b8512b3e877746522439b823b
2024-01-22 20:45:52 -08:00
Alexis La Goutte 4a27b7e3e8 someip: Fix Dead Store found by Clang Analyzer 2024-01-22 16:52:06 +00:00
Gerald Combs 6e474d1af1 [Automatic update for 2024-01-21]
Update manuf, services enterprise numbers, translations, and other items.

services failed.
2024-01-21 18:05:20 +00:00
John Thacker c3e98efd5b http2: Use our own process_reassembled_data
This avoids a problem with the layer number being unstable

Fix #19609
2024-01-20 13:34:14 +00:00
Jie Han 9a97bf2216 Add support for attributes defined in NAN Spec R4
Add support for DCEA, NIRA, and NPBA
2024-01-19 14:40:48 +00:00
Martin Mathieson d0bb6b3dfe Dissectors: remove accidental double-colons 2024-01-19 10:38:41 +00:00
Chloe Pelling 1058293e78 X11: ConfigureWindow: Fix 'window' and bitmask fields.
Only 1 of the 4 bytes comprising the window field was actually
being read, causing the value to be incorrect. The offset pointer
was correctly increased by 4 on the following line, so this is
clearly just an oversight.

The configure-window-mask field was being dissected using the
"window value mask" bitmasks. It was interpreted correctly when
dissecting the actual fields, though, so this is clearly just
another minor oversight.

Before:

  window: 0x00000001
  configure-window-mask: 0x0003, background-pixmap, background-pixel
  x: 448
  y: 156

After:

  window: 0x03800001
  configure-window-mask: 0x0003, x, y
  x: 448
  y: 156
2024-01-19 10:03:03 +00:00
John Thacker 87f06bfd58 netflow: Handle variable length fields with zero length
If a variable length field has length zero, skip to the next field.

Fix #19605
2024-01-18 20:00:00 +00:00
Nico 256c9bebac Adding dissecator version 4 for GICI protocol 2024-01-18 19:33:11 +00:00
Gerald Combs f67b74550b ISUP: Add recursion checks 2024-01-18 16:41:24 +00:00
John Thacker 0cca51a61b UCP: Handle alphanumeric OAdC
This is a little annoying because the OTOA field that determines the
encoding is many fields after the OAdC field. Also annoying because
the encoding is faintly absurd, and not the same as the other
"IRAString" encoding; that one is also a hex string, but uses
*unpacked* GSM 7 bit encoding. Here we have a hex string encoding of
a SMS-like "number of used semi-octets" followed by packed GSM 7 bit
encoding.

Fix #19599
2024-01-18 16:40:01 +00:00
Vadim Yanitskiy 577d8313fc GSM A DTAP: use proper tree for spare bits in de_bearer_cap() 2024-01-18 21:35:49 +07:00
Martin Mathieson 2640465545 tools/check_val_to_str.py: add option to test generated files 2024-01-18 13:20:24 +00:00
Martin Mathieson b411905eb9 NRPPA: trivial cleanups 2024-01-18 13:19:45 +00:00
Martin Mathieson 2d6310f4f8 SMB2: make a function static 2024-01-18 10:22:36 +00:00
John Thacker 79c6e9db9d HTTP3: Huffman decoding
Add Huffman decoding from libngttp2 library (MIT licensed),
and use it in HTTP/3 to display the decoded QPACK bytes.
(HTTP/2 and HTTP/3 use the same Huffman encoding.) These
files are not part of the public libnghttp2 library but
normally internal.

Note that libnghttp3 does not supply a function to inflate
headers like nghttp2_hd_inflate_h2.

Related to #16761
2024-01-18 09:46:24 +00:00
Adedeji Adeloye c3c0fb7263 SMB2: dissect FSCTL, Query info, and Server notification
Add dissection for FSCTL_SET_INTEGRITY_INFORMATION_EX control code
Add dissection for SMB2 SERVER_TO_CLIENT notification
Update QueryInfo flags for FileFullEaInformation query code
Update file_info_levels list.
2024-01-18 06:27:35 +00:00
Yaniv Kaul 73ece5e8c8 epan/dissectors/packet-cql.c: fix few typos
Signed-off-by: Yaniv Kaul <yaniv.kaul@scylladb.com>
2024-01-17 16:37:37 +00:00
Martin Mathieson 84cf907fcb WSMP: Set correct length of N and T headers 2024-01-17 13:49:53 +00:00
Joakim Karlsson 05e1338d61 GTPv2: correction of IE Monitoring Event Information
Correcting offset miss in !13077
Due to offset for octet 4 is skipped earlier, the remaining lenght becomes wrongly.
To correct the fault, offset for octet 4 is need to be added after IE has been decoded
2024-01-17 13:26:12 +00:00
Pascal Quantin 524621ca21 NRPPa: upgrade dissector to v17.6.0 2024-01-17 08:43:10 +00:00
David Perry bf909bf93e Add descriptions for heur dissector tables
Build on !13975 to add human-readable descriptions for all heuristic
dissector tables in Wireshark.

Chosen names are meant to give some info on when a heuristic dissector
lookup will be made. Terms like 'fallback' are used when the heuristic
is only consulted if other checks do not result in dissection, for
example.

People with more intimate knowledge of the protocols and dissectors
involved are encouraged to suggest or implement better descriptions.
2024-01-17 08:35:43 +00:00
Gerald Combs 9703cf23a8 TLS: Update the follow tap name to match other dissectors 2024-01-17 08:33:55 +00:00
Timo Warns 7983d70203 GNSS: SBAS dissection improvements 2024-01-17 08:33:08 +00:00
John Thacker 75d79e5d7d rdpudp: Fix leak
The cloned tvbs stored for reassembly purposes need to be freed
when the file scoped trees holding them are freed.

Fix #19598
2024-01-16 23:41:24 +00:00
James Ring 85aeaf1f34 Adds a dissector for SANE (Scanner Access Now Easy). 2024-01-16 21:13:50 +00:00
Pascal Quantin d302ff5b42 F1AP: upgrade dissector to v17.7.0 2024-01-16 17:33:54 +01:00
David Perry 893a68e6d9 [#19585] Add description for heur dissector tables
Add a field to `struct heur_dissector_list` to hold a human-readable
description of the heuristic dissector list. The field is named
`ui_name` to parallel `struct dissector_table`.

Add `register_heur_dissector_list_with_description()` to register a new heuristic
dissector list with a description as well as a name. Change
`register_heur_dissector_list()` to be a thin wrapper which passes a
null description.

Add `heur_dissector_list_get_description()` to get the description from
a `heur_dissector_list_t` (which is an opaque type).

Modify the Qt user interface so that heuristic tables listed in *View →
Internals → Dissector Tables* show the description in the left column
and the short name in the right column, as is the case for other
dissector table types. For heuristic dissector lists which do not have a
description, repeat the short name in the left column to resemble how
the dialog was presented before this change.

Revise function name based on feedback
2024-01-16 15:53:55 +00:00
Pascal Quantin 7919c374d7 E1AP: upgrade dissector to v17.7.0 2024-01-16 16:19:16 +01:00
Pascal Quantin 1295d416ed XnAP: upgrade dissector to v17.7.0 2024-01-16 16:05:56 +01:00
Pascal Quantin e31f805c81 NGAP: upgrade dissector to v17.7.0 2024-01-16 15:49:20 +01:00
Pascal Quantin 28c7e0cce3 NR RRC: upgrade dissector to v17.7.0 2024-01-16 15:36:15 +01:00
Pascal Quantin feff9a8b80 LTE RRC: upgrade dissector to v17.7.0 2024-01-16 15:22:26 +01:00
Pascal Quantin 87dfdbb915 LPP: upgrade dissector to v17.7.0 2024-01-16 15:00:36 +01:00
Guy Harris e0811c1aa0 x75: don't register for WTAP_ENCAP_LAPB.
X.75 is not the same thing as LAPB, and we already *have* a LAPB
dissector that registers for WTAP_ENCAP_LAPB.  Two dissectors
registering for a value in the wtap_encap table means one of them will
lose, so it does not work; in this case, the LAPB dissector loses.

Fixes #19595.
2024-01-15 16:37:05 -08:00
John Thacker eeb818f5e7 TLS: Display minimum supported version when version unknown in Client Hello
If the supported_versions extension is provided in the Client Hello,
display the mimimum supported version given in the extension in the
Protocol column if the session TLS version is unknown. Use the minimum
version because we don't know what the server will agree to, but it
must be at least this version.

This only affects when the Server Hello or other authoritative
messages haven't been seen, so in first-pass dissection (live
capture or one pass tshark) or a capture that doesn't contain
authoritative messages at all.

Fix #16114
2024-01-15 08:03:36 +00:00
John Thacker 91e75f3e46 NBSS: Handle short packets
If we have a packet that isn't long enough to fit an entire header,
but the first byte does look like a message type, and we can do
reassembly, ask for reassembly.

Fix #19593
2024-01-14 11:25:12 -05:00
Jaap Keuter f5615dd9f9 IPv4/v6: fix field offset calculation for GeoIP entries 2024-01-14 15:00:11 +00:00
John Thacker c413d81967 rtmpt: Add a default chunksize preference
For RTMP connections where we get the handshake, continue to use
the initial value of 128 as done in the protocol; we should get
any Set Chunk Size messages.

For connections where we don't get the initial handshake, i.e.
the connection is already in progress when the capture is started,
allow setting a different default chunksize. Note that both too
large and too small values will cause problems, but the since the
initial bytes of chunks can have any value, it's very difficult
to do this heuristically.

Fix #12403 (by setting the preference to a large value, e.g. 60000,
everything is dissected correctly in that capture.)
2024-01-14 00:51:10 +00:00
Martin Mathieson 664b858d44 SOMEIP-SD: call val_to_str_const() 2024-01-12 12:59:26 +00:00
John Thacker 2c9b66d14a RTP: Use the same extended seqno / timestamp cycle for a new setup msg
Some systems repeatedly send out SDP setup information for the same
RTP conversation. We end up setting up multiple conversations
(it's not clear we need to, since most of the information we copy
to per-packet info for subsequent passes.)

When doing so, copy the per-SSRC number space information that
determines what cycle number we're on for extended sequence numbers
and timestamps (since those fields can and do wrap.)

This doesn't hurt at all if the setup information is for different
conversations, even ones using the same SSRC; it aligns the cycle
number but that's fine. It helps a lot in cases where the RTP
sequence number has already overflowed and then we get a duplicate
SETUP message; we need to stay on the same cycle.

Fix #19592
2024-01-12 21:56:30 -05:00
Zackhardtoname 6c26a3c7dc Fix uintptr_t not found error 2024-01-12 23:42:33 +00:00
Anders Broman 490d0514d9 Parlay: Retire the dissector.
Removing the generated Parlay dissecor on the assumtion it is now
obsolete. Leaving the IDL files in the repo for a while longer.
https://en.m.wikipedia.org/wiki/Parlay_Group
https://en.m.wikipedia.org/wiki/Parlay_X
2024-01-12 16:39:53 +00:00
John Thacker 846fae3141 rtmpt: Mark depended upon frames
RTMPT doesn't use the native reassembly API, so store the frames that
are involved in reassembly of a packet and mark the depended upon
frames itself so that exporting selected packets doesn't omit them.
2024-01-12 09:33:27 -05:00
Timo Warns 73e5eeae50 GNSS: add dissectors for further UBX messages 2024-01-12 09:20:13 +00:00
Guy Harris 2d04c10741 tftp: fix a typo.
The mode string for a Net-ASCII transfer is "netascii", not "netscii".

Fixes #19589.
2024-01-11 23:29:42 -08:00
Martin Mathieson 821fa78fee Fix some spelling errors 2024-01-11 19:32:32 +00:00
John Thacker 7ce05b9dd7 opcua: X.509 Certificate dissection
Dissect the X.509 v3 Certificates used in OPC UA.

Use proto_tree_add_bytes_with_length for adding NULL bytes to
the tree with a (0) length different than the length taken up
in the tvb. It's somewhat nicer than changing the item length later.
2024-01-11 10:30:30 -05:00
Gerald Combs 10a77d7b46 Parlay: Add a recursion check 2024-01-11 14:58:27 +00:00
Xiaofeng Wang 610e5f0543 Support enhanced-RTMP ExVideoTagHeader 2024-01-11 09:38:47 +00:00
Frostie314159 65c04f2886 Fill gaps in AWDL DataPathStateTLV. 2024-01-11 09:36:02 +00:00
Dr. Lars Völker 53e180491c SOME/IP-SD: Improve handling of ANY values and unknown entries 2024-01-11 09:30:33 +00:00
Joakim Karlsson 5d2bcdd377 pfcp: Update to 3GPP TS 29.244 V18.4.0 2024-01-11 09:29:36 +00:00
Martin Mathieson 9aff6a9314 netlink: show padding between short attributes 2024-01-11 09:24:41 +00:00
Dr. Lars Völker 27857b268e ISO15765: Cleanup and fix incomplete dissector warnings
Dissector is improved as follows:
- Code cleanup
- Added comments
- Offset calculations more obvious
- Segment data is put into segment hf instead of data dissector
- Padding is calculated and shown to fix incomplete dissector warnings
2024-01-11 09:20:13 +00:00
Martin Mathieson c8281ec58a netlink-netfilter: Show padding bytes 2024-01-10 20:07:44 +00:00
Jeff Dyer 885e638a03 NAS 5GS: set subdissector for SMS NAS messages in HTTP2 2024-01-10 12:58:54 -06:00
Yaniv Kaul 624ba9311c packet-cql.c: add support (partial) for custom payload result response
This add (partially) decoding of a custom payload result response

Signed-off-by: Yaniv Kaul <yaniv.kaul@scylladb.com>
2024-01-10 17:07:16 +00:00
Martin Mathieson 579aa4117c WMIO: Fix an infinite loop spotted by coverity 2024-01-10 13:41:37 +00:00
Martin Mayer 7eaf8bcba2 ATLDF: Remove unused macro 2024-01-10 09:49:09 +00:00
Martin Mathieson 66c607f118 Document discontinuities in OSPF and IRDA dissectors 2024-01-09 16:55:33 +00:00
Martin Mathieson ae3afe910b Infiniband: fix a couple of item offsets 2024-01-09 15:13:33 +00:00
Martin Mathieson a195204327 ORAN FH CUS: fix an offset and a length 2024-01-09 13:13:48 +00:00
Dr. Lars Völker 4b04c3fd05 ISO15765/UDS: Clean up of Address Handling
This patch does:
- clean up the address handling and limit to guint16 (see UDS)
- add address length to the data exchanged to UDS
- make UDS show the correct length in the protocol line instead of 2
- show address in UDS as generated as they are passed to UDS
2024-01-09 08:47:42 +00:00
Gerald Combs 218db31955 asn2wrs: Fix our recursion checks
Don't subtract our cycle size when resetting our proto depth.

Fixes #19580
2024-01-08 11:10:45 -08:00
Pascal Quantin b4c07ac165 NAS 5GS: upgrade dissector to v17.13.0 2024-01-08 10:55:00 +01:00
Sergio de Paula 0c923da588 [RF4CE] Fix for RF4CE NWK heuristics
RF4CE NWK heuristics should not attempt to verify the command ID from a command frame type when security is enabled, since in such case the command ID will be encrypted
2024-01-08 02:37:10 -03:00
Martin Mathieson e1efe33c0b WMIO: make a variable static 2024-01-07 22:10:40 +00:00
Evan Huus d52dc11ae4 cbor: add recursion depth check 2024-01-07 19:47:44 +00:00
Martin Mathieson 352ad96b57 Fix some spelling errors 2024-01-07 17:16:10 +00:00
Gerald Combs 1d6c7eecb0 [Automatic update for 2024-01-07]
Update manuf, services enterprise numbers, translations, and other items.
2024-01-07 17:14:06 +00:00
Hiddencodes Sec 5b87714ec8 Add parsing support for IWbemServices and WMIO 2024-01-07 16:48:40 +00:00
Dexter Gerig b8e7db6600 QUIC: Fix running dissectors on 0-RTT data 2024-01-07 14:11:18 +00:00
Dr. Lars Völker ec232d03d3 SOME/IP: Do not ignore messages with empty payload
Before stats would only get informed about SOME/IP messages only if a
payload would be present. This is fixed now.
2024-01-07 01:24:24 +00:00
John Thacker d3b5f367e9 T38: Fully initialize t38_conv struct, part 2
Same as d44e171cee but in
a different location.

Fix #19578
2024-01-06 19:43:43 -05:00
John Thacker 4232cb5575 rtmpt: Limit initial allocation size instead of max packet size
A problem with the RTMP dissector is that it allocates space up
front for messages based on a 24 bit message length field, and if
that length is bogus (e.g., fuzzed data), that can easily lead to
memory exhaustion. (#6898) However, the real value can be quite large,
and limiting the value with a preference causes real data to fail to
dissect and report as malformed (#3790).

An ideal solution would be to use the standard reassembly API, possibly
by having the TCP dissector do it via setting pinfo->desegment_offset
or pinfo->desegment_len, or possibly by having reassembly tables within
the dissector. Quirks about the protocol make this a bit difficult.

In the meantime, instead of allocating all the memory for a reassembled
packet upfront upon reading the message length, limit the initial
allocation size, and call wmem_realloc if needed. In the cases where
the length is bogus and we don't actually get message bytes later,
we don't allocate nearly as much memory, but in the cases where the
message really is that large, dissection will work without having to
fiddle with a preference.

Mark the preference as obsolete, because users shouldn't need to change it.
(We can reduce the initial max allocation size from this if need be
with little penalty, saving some memory when there's bogus values in
exchange for more reallocation for legitimate large messages.)

Fix #3790.
2024-01-06 19:44:25 +00:00
John Thacker 822a95d156 rtmpt: Fix iteration check
This check should be for when the maximum number of iterations
reaches zero, rather than declaring a loop the first time it is reached.
AMF dissection is being aborted and never succeeding.

Fixup 24403a9a35
2024-01-06 08:53:01 -05:00
John Thacker 1a81a7cacf RSVP: Support Capability Object
Support Capability Object (134) from RFC 5063 and RFC 8370.

Fix #19564
2024-01-05 15:46:18 +00:00
John Thacker 4f3b03b72a NTLMSSP: Zero out the session key at the start of creating a v1 key
A zeroed sessionkey is the failure state that is checked, but we
can return early from the function if there are problems with
the challenge response. Move the memset to the top of the function,
as is already done with v2.

Fix #19570
2024-01-05 08:59:54 -05:00
Martin Mathieson b1e900496c E2AP: Check whether table entry was found 2024-01-04 17:53:50 +00:00
John Thacker 75fa97e7f2 RSVP: Fix typo
The variable type is being passed for the encoding instead of
ENC_BIG_ENDIAN
2024-01-04 13:49:13 +00:00
Eugène Adell 75fc7e11e8 TCP: Duplicate ACKs hidden by Window Update and SACK presence 2024-01-04 13:48:49 +00:00
Giovanni Musto 25fb6c316c SocketCAN: Add hidden CAN item to protocol tree in case of CANFD 2024-01-04 09:42:06 +00:00
Simon Steinmann 8f7f7cd7de s4607: Add to "decode as"
Fix #19566
2024-01-04 02:17:38 +00:00
John Thacker ca02798714 RTPS: Don't leak in the guid hash
If hashing a newly created GBytes, unref the GBytes after computing
the hash (and before returning it.)

Fix #19558 (in combination with 45b929a1b6
and 6f17dcd67d)
2024-01-03 19:56:19 -05:00
pranay nag 69c9e06dae Thread: Update for Thread version 1.2 and 1.3 along with TREL 2024-01-03 15:41:47 +00:00
Jaap Keuter c550e9f26a SSH: don't hide signature types you don't dissect 2024-01-03 15:01:13 +00:00
Jaap Keuter 5816b3c75c SSH: We don't use Gerrit for a while now, remove its port from defaults 2024-01-03 15:01:13 +00:00
John Thacker 0e9ea401f7 TCP: Prefer full checksum over partial if the same
If the full checksum and partial checksum are the same (because
the contribution from the TCP payload doesn't change it), don't
call it a partial checksum.

This is already done in UDP.
2024-01-03 08:46:20 -05:00
Ismael Mendez Matamoros 6f17dcd67d RTPS: Fixed User Data Dissection feature
Function rtps_strlcpy broke the User Data dissection feature because it
overwites beyond the size of the string
2024-01-03 09:35:23 +00:00
John Thacker 329523afee TCPCL: Do not call g_int64_hash on a gint
Do not call g_int64_hash on a pointer to a gint (which might
be 32 bit). Call g_int_hash instead.

Fixes use of unitialized value.
2024-01-02 21:29:38 -05:00
Martin Mathieson 370e5db90a E2AP: check table pointers when adding ranFunction 2024-01-03 01:52:00 +00:00
John Thacker d44e171cee T38: Fully initialize t38_conv struct
Fix #19563
2024-01-03 00:37:47 +00:00
John Thacker 9f05d77cec sctp: Fully initialize tmpinfo struct 2024-01-02 19:02:05 -05:00
Gerald Combs 8f797db63c asn2wrs: Add recursion checks
Add a recursion depth check whenever we have cyclic dependencies.
Regenerate our dissectors.

Fixes #19501
2024-01-02 09:23:40 -08:00
John Thacker c9c40514d8 MLE: Don't call tvb_bytes_to_str with zero length
It causes an dissector bug assertion.

Related to #19557
2024-01-02 14:48:19 +00:00
John Thacker 1229ee0468 COSE: Fix some leaks in cose_header_context_t
If we're replacing the principal, unref the current one, if it
exists.

Push a cleanup function to free the principal and label in case
of hitting an exception dissecting the packet.

Related to #19557
2024-01-02 14:34:17 +00:00
Eugène Adell fdaba24262 Ethernet: Implementation of conversations with stream identifiers 2024-01-02 07:40:49 +00:00
John Thacker 77b0583568 DOCSIS: Extended EH Elements are not recursive
Extended EH Elements, which are still not defined as of DOCSIS 4.0
and must be ignored (CM-SP-MULPIv4.0-I08-231211), are not recursive
but instead have a full byte each for type and length instead of
a nibble, allowing specifying more than 15 extended header types or
extended header types with length longer than 15.

Increment the position for the first type/length byte to make the
logic more straightforward.

Part of #19557
2024-01-02 07:36:06 +00:00
Joakim Karlsson 7fcc15cb54 pfcp: Add Service Response Time statistics
Add a Service Response Time table for PFCP, similar to that
for GTPv2. Update the tshark docs to mention it.
2024-01-02 07:33:04 +00:00
Gerald Combs 45b929a1b6 RTPS: Fully initialize a struct
Make sure we fully initialize an endpoint_guid struct. Blind attempt
at fixing

```
==23447== Use of uninitialised value of size 8
==23447==    at 0xDAF0816: wmem_map_lookup (wsutil/wmem/wmem_map.c:264)
==23447==    by 0x7DE388C: get_domain_id_from_tcp_discovered_participants (epan/dissectors/packet-rtps.c:6518)
==23447==    by 0x7DE33AB: dissect_rtps (epan/dissectors/packet-rtps.c:13741)
```

in #19558.
2024-01-01 19:22:36 -08:00
John Thacker b67b86059e IAX2: Unknown HF is now 0, not -1
Update IAX2 handling for 2a9bc63325
and b61c0ac536.
Since a non-existent header field in the array is now 0 instead of -1,
change the test.

Fixes warnings like:

** (tshark:166575) 04:45:49.318472 [Epan WARNING] -- Dissector bug, protocol IAX2, in packet 4903: epan/proto.c:10972: failed assertion "n > 0 && (guint)n < gpa_hfinfo.len" (Unregistered hf!)

Related to #19557
2024-01-01 07:36:53 -05:00
Martin Mathieson 2bf14f5fe6 JSON-3GPP: fix a (presumed) typo 2023-12-31 20:28:19 +00:00
Tomasz Moń 4f46ed269f USB: Dissect protocol also at interface level
Try dissecting with usb.protocol both using device class triple and
interface class triple. This allows dissecting Bluetooth requests on
composite devices and/or when Device Descriptor class code is not one
of the Bluetooth codes.

Set URB transfer type in USB conversation info when handling control
requests. Set endpoint to magic NO_ENDPOINT8 value when control request
is directed to interface to prevent using whatever value was last stored
there (do not set endpoint to 0 to prevent clear_usb_conv_tmp_data()
from clearing interface class, subclass and protocol values).
2023-12-31 18:30:15 +00:00
Evan Huus c08e6e56fd Remove packet scope usage from a few dissectors
Mostly just passing pinfo around a little bit more, but in rf4ce-nwk we
weren't doing anything with the allocated value anyway, so just use the
regular proto_tree_add_item.
2023-12-31 10:42:11 -05:00
Stig Bjørlykke 17fcdb4735 pcap: Update link_type_vals 2023-12-31 12:58:33 +01:00
Martin Mathieson 1b9d95d6b5 Look into some cases where 1 value_string value is missing 2023-12-30 21:15:12 +00:00
Topi Miettinen ef2eb13350 netfilter: improve nftables dissection 2023-12-30 15:03:20 +00:00
Dr. Lars Völker af5a53efc0 ISO15765: clean up code and fix typo 2023-12-30 13:06:52 +00:00
Dr. Lars Völker fe3b55d85d ISO10681: Code Cleanup 2023-12-30 12:47:32 +00:00
Dr. Lars Völker 35fa4fa36d SOME/IP: remove empty line 2023-12-30 12:44:13 +00:00
John Thacker 97d59fc20f CFM: Fix check for Management Address [Domain] when Chassis ID Len is 0
According to IEEE 802.1Q 21.5.3.2, if the Chassis ID Length field is 0,
then the Chassis ID Subtype is not present. Thus the number of octets
used for the Chassis ID is 1 (the length field itself) if the length is
0, and 2 plus the length value if the length is > 0.

According to 21.5.3.6, the Management Address Length field should not
be present if the Management Address Domain Length has the value zero.
If it is present anyway (as in the file provided in #13720), handle it
but add an expert info.

Fix #13720
2023-12-29 19:55:44 -05:00
lizhengqiang 4e6484600d LLDP: fix return value of lldp dissector
Do not handle the return value of dissect_lldp_end_of_lldpdu() specially
to avoid the dissector returning an error value.
2023-12-29 09:19:00 +00:00
Timo Warns 42e85b29e1 GNSS: fix SBAS MT1 - MT5 field lengths
The length values given to proto_tree_add_item for SBAS MT1 - MT5
dissection did not always correctly match the bitmask in
hf_register_info causing a retrieval of wrong values. Align the length
values and bitmasks for a correct retrieval of field values.
2023-12-29 08:42:19 +00:00
Ferry Huberts 1ccbc482a0 packet-sv: fix the seqData validity
Update to the latest specification, which specifies the currently used
value for 'invalid' as 'backward compatible (do not use)'.

See
  IEC 61850-9-2 Edition 2.1 2020-02,
  Section 8.6 Definitions for basic data types – Presentation layer functionality,
  Table 21

Be aware that in the specification the bits are numbered in reverse (it
specifies the least significant bit as bit 31 instead of as bit 0)!

Signed-off-by: Ferry Huberts <ferry.huberts@pelagic.nl>
2023-12-29 08:19:15 +00:00
Giovanni Musto 84ddc8c446 LIN: Don't process payload if the frame has an error
Add error indication to the Info column
2023-12-28 16:04:23 +00:00
Jaap Keuter 1d6abf627c Bluetooth: update UUID and Company ID registry
Pull current values from the Bluetooth SIG registry, while keeping
old values around. Don't be afraid for UTF-8.
2023-12-28 15:54:18 +00:00
Timo Warns 9bb31318fe GNSS: add dissector for SBAS L1 MT24
Add dissector for SBAS L1 MT24 (mixed fast/long-term satellite error
correction message)
2023-12-28 09:48:30 +00:00
Jaap Keuter 64b9bad199 BTL2CAP: Switch to using more efficient bluetooth_uuid_vals_ext 2023-12-27 21:24:24 +00:00
Jaap Keuter 2dae7c2d79 BT_ATT: Adjust ranges for protocol registration
With the growth of the member registry they became part of the
protocol registrations for use with decode as.
Extend the code space reserved for member registrations, to
exclude these and new members for the foreseeable future.
2023-12-27 20:51:09 +01:00
Martin Mathieson 1243b49c49 tools/check_static.py: make script more readable 2023-12-27 01:03:28 +00:00
Gerald Combs bfad74780a [Automatic update for 2023-12-24]
Update manuf, services enterprise numbers, translations, and other items.
2023-12-25 08:38:26 +00:00
John Thacker 922d1f6219 SCTP: Use hashmaps for association indexing
Instead of storing all found SCTP associations in one linked list,
use maps.

Store associations where only one vtag is known in one map, hashed
by the ports. (This effectively is a list indexed by the ports.) Store
associations where both vtags are known in another map, hashed by the
vtags. After an association has been setup, most lookups should be
fast, using the vtags. This should be much faster than searching the
entire list of associations each time for captures with many
associations.

Assume vtag collisions are rare. When we have INIT ACK packets, the only
packets that have both vtags in a single packet, do not require that
addresses match. Otherwise, when matching two half associations into
a full association, require that addresses match as well as ports.
Requiring address matching for cases lacking INIT ACK packets (such as
a stream of DATA frames back and forth) prevents false positives
(especially in cases where ephemeral ports are not used and source and
destination ports are the same.)

Eventually we ought to track the additional addresses given in INIT,
INIT ACK, and ASCONF packets and use those as well.

Fix #19544
2023-12-23 08:33:04 +00:00
John Thacker 9b4c2ffb33 ICMPv4: Mark formally deprecated types
Mark with an expert info the ICMPv4 types formally deprecated
by RFCs 6633 and 6918
2023-12-23 08:29:59 +00:00
John Thacker 52c1ebb4e1 SCTP: Send sctp_info to the tap even if there's an exception
Always send the association information to the SCTP tap, if
we've filled in at least one tvb. Always add it to the tree
as well, by using the association index calculated for the
first chunk.

Note in a comment that we should only need to calculate the
association index for the first chunk of bundled chunks; while
there are some chunk types with exception verification tag
handling (RFC 9260 8.5.1), they shouldn't be bundled with other
chunk types. We should have an expert info for that situation.
(Previously, we were calculating the association index for all
chunks and using for the packet the last one calculated.)

Initialize the association index and direction when beginning
dissection, in case we throw an exception when getting the
chunk type to see if RFC 9260 8.5.1 applies.

Part of #19544
2023-12-23 00:08:36 +00:00
Dr. Lars Völker 87d749d2fe ISO15765: added a bit of documentation
- Added some information how the CAN ID Mappings work.
- Made formatting a bit more consistent.
2023-12-23 00:12:19 +01:00
Martin Mathieson f863b276c3 JSON-3GPP: Fix label for mapdu item 2023-12-22 13:12:26 +00:00
Martin Mathieson 5f870017f7 E2AP: fix range check while registering RAN-function dissectors 2023-12-22 11:13:11 +00:00
Martin Mathieson 5de1a339c4 Fix some spelling errors 2023-12-21 16:37:45 +00:00
John Thacker db28c15aeb DTLS: Initial support for adding DTLSv1.3 to the Protocol column
A minor piece of #18071, taken from !11408
2023-12-21 15:45:39 +00:00
Martin Mathieson 60dd24f701 E2AP: Add stats counter to Telephony menu 2023-12-21 15:35:41 +00:00
Joakim Karlsson af408571e5 JSON 3GPP: add TS 29.502 ch6.1.8 Feature negotiation support 2023-12-21 09:49:31 +01:00
John Thacker 50bf11fd8c IPv4: Mark deprecated option types
Mark the IPv4 option types deprecated by RFC 6814 as deprecated,
at least the ones that we support. (Many were never implemented.)
2023-12-20 17:09:02 -05:00
Alexis La Goutte e293a19071 usb-audio: Fix Dead Store found by Clang Analyzer
Value stored to 'ti' is never read
2023-12-20 21:49:39 +00:00
Alexis La Goutte 0b9c79598b radiotap: Fix Dead Store found by Clang Analyzer
Value stored to 'offset' is never read
2023-12-20 21:49:39 +00:00
Alexis La Goutte 4d3475223a bgp: fix Dead Store found by Clang Analyzer
Value stored to 'arch_spec_byte' is never read
2023-12-20 21:49:39 +00:00
Alexis La Goutte 6b837c6f28 QUIC: fix Dead Store warnings found by Clang 2023-12-20 21:49:39 +00:00
Martin Mathieson a09c648670 E2AP: When updating mapping from OID, take care over pointers 2023-12-20 21:47:47 +00:00
Pau Espin 2a33688291 packet-gtp: Avoid dissect MS Network Capability when len = 0
Otherwise the dissected fields shown up are really misleading.

It is totally fine sending len=0, as explained in TS 29.060 sec 7.7.28:
"If MS Network Capability is not included, its Length field value shall
be set to 0."
2023-12-20 21:25:04 +00:00
Anders Broman 8bb3d89065 ITS: Use CAM Version 2.1 ASN code 2023-12-20 21:21:31 +00:00
John Thacker 2634e62b70 SCTP: Add chunks as FT_NONE instead of text-only node
This allows a few more natural filters, like count(sctp.chunk).

Related to #19544
2023-12-20 10:39:05 -05:00
Max Schrötter 95a9fc5c0f QUIC: handle connection migrations for zero length CIDs
In Quic Connection Migrations are possible even without source
connection IDs. Currently, after connection migration Wireshark fails to
associate answers with zero length CIDs for the new address to the
original connection.

After migration when the client sends data from the new IP
the connection data needs to be associated with the new conversation.
So when the server answers and the connection is identified by the
conversation a connection is found.
2023-12-20 15:20:00 +01:00
Cal Turney acf419cfc9 iscsi: display number of bytes to Write
Hopefully these changes will have addressed the issues.
Rebased and fixed a merge conflict.
2023-12-20 10:45:37 +01:00
Cal Turney 999f9f65c7 iscsi: display number of bytes to Write
Fixed issue that caused pipeline to fail
2023-12-20 10:45:37 +01:00
Cal Turney ecdb67b4a0 ISCSI: Add R2T time and bytes transferred in List
Add R2T time
Display bytes sent in Packet list
Add set generated on Data Ins/Outs etc.

Conflict resolved
2023-12-20 10:45:37 +01:00
Cal Turney f699b10405 Display number of bytes to Write
Display the number of bytes for Writes to transmit in the
Packet Detail and List
2023-12-20 10:45:37 +01:00
Simon Steinmann c1ecdb49b3 s4607 - Fix Dwell Mask 2023-12-20 07:34:12 +00:00
Martin Mathieson a7d5c07a13 E2AP: In E2Setup message, read/use OID outside of shortName 2023-12-18 22:38:53 +00:00
Liam Kearney e2594ef0e4 ieee80211: Allow RPS IE dissector to parse multiple raw assignments 2023-12-19 09:46:45 +00:00
Guy Harris 08eb1d87c7 wol: use the Wayback Machine for a now-dead link.
[skip ci]
2023-12-18 15:55:08 -08:00
Zoran Bošnjak b8bad2c745 asterix: 'number' upstream change adjustment
Minor structure change in upstream asterix-specs repository.
2023-12-18 18:46:44 +00:00
Joakim Karlsson 3a7169a5f9 GTP: Correction of IE RFSP Index
Index was faulty increased by 1
2023-12-18 14:40:16 +01:00
Martin Mathieson 05d9608dbd NR Taps: more fixes 2023-12-18 09:24:57 +00:00
Liam Kearney 71da5f72b5 ieee80211: Fix RPS IE (802.11ah / S1G) dissector for RAW slot definition.
Fix slot definition subfield format to give an 8 bit slot duration if set to 0, update the 11 bit mask to be 11 bits,
and add a custom formatter to print the slot duration in uS
2023-12-18 08:23:07 +00:00
Gerald Combs a3467677cf [Automatic update for 2023-12-17]
Update manuf, services enterprise numbers, translations, and other items.

manuf failed.
2023-12-17 17:43:38 +00:00
snicket2100 9b6c116324 bitcoin: code simplification by using `proto_item_set_end(...)`
Used `proto_item_set_end()` instead of `proto_item_set_len(...)`
in two places.
2023-12-16 21:57:15 +00:00
Alexis La Goutte 03d59b1458 DNS: fix warning 2023-12-15 08:42:28 +00:00
Jaap Keuter ed0a777776 RTCP: extend list of transport layer feedback formats 2023-12-15 08:40:58 +00:00
Alexis La Goutte d43c1754b6 RDPUDP: fix conflict about incompatible types
epan/proto.c:9468 -- proto_register_field_init(): 'rdpudp.flags.ack' exists multiple times with incompatible types: FT_UINT16 and FT_BOOLEAN
epan/proto.c:9468 -- proto_register_field_init(): 'rdpudp.flags.data' exists multiple times with incompatible types: FT_UINT16 and FT_BOOLEAN
2023-12-15 08:40:15 +00:00
Alexis La Goutte 974e09b0c6 scsi-sbc: fix checkAPI warning about shadow variable (index) 2023-12-15 08:39:13 +00:00
Alexis La Goutte 34edc1a3be bitcoin: fix checkAPI warning about shadow variable (index) 2023-12-15 08:39:13 +00:00
Yuya Kusakabe f10ca976ab
BGP: Add Source Address to Type 1 Session Transformed Route
See https://www.ietf.org/archive/id/draft-mpmz-bess-mup-safi-03.html#section-3.1.3.1
2023-12-15 15:56:47 +09:00
Christian Krump 9c2959b483 EPLv2: textual decoding of ASnd error code
Additional decoding (textual) of possible error code within ASnd frame.
2023-12-14 08:33:12 +01:00
Alexis La Goutte 00be42a1f2 tls-utils(ECH): fix Dead Store found by Clang Analyzer 2023-12-14 07:17:23 +00:00
Joakim Karlsson e9d4f4f846 GTPv2: Dissect IE Group ID 2023-12-13 16:02:36 +01:00
Joakim Karlsson 4a9214b12d GTPv2: Dissect IE PGW Set FQDN Extendable 2023-12-13 09:10:22 +01:00
Jaap Keuter c0bfd405b5 Resolve GCC clobbered variable warnings
Building with GCC 13.2.0 exposes even more clobbered variable warnings.
Mark these volatile to circumvent those.
2023-12-13 01:22:58 +00:00
Maxim Sharabayko 0d52ed247e srt: Parse Key Material message. 2023-12-12 19:53:17 +00:00
Chris Brandson 4158fd0115 Zigbee improved Smart Energy time format and display
Similar to other changes to the dissection and display of UTC Time, changed
Smart Energy time fields to display both UTC text time and UTC Time as a
number with the number as the field value for t-shark. As UTC Time is used
elsewhere, broke that functionality out into the main ZCL file, but Smart
Energy applies a special meaning where the value 0 means 'now' independant
of the actual time, this is restricted to Smart Energy uses of UTC Time.

Thanks to Cole Wu <colewu9712@gmail.com> for the original implementation and
support.
2023-12-11 21:28:32 +00:00
Martin Mathieson 6b7664bfd3 Fix some broken dissector URLs 2023-12-11 21:16:21 +00:00
Gerald Combs 04165f8536 Monero: Use col_add_str
Our info column string might be dynamically allocated, so use
col_add_str.

Fixes #19526
2023-12-11 20:08:27 +00:00
Martin Mathieson 807413ea33 ORAN FH CUS: Update some value_strings for v13.0 2023-12-11 17:12:47 +00:00
Martin Mathieson a57069a7ca CIP & PLDM: make some functions static 2023-12-11 13:56:26 +00:00
Martin Mathieson 2936f5c026 E2AP: add support for CCC RAN Function 2023-12-11 12:30:26 +00:00
Martin Mathieson 79d26352f2 GSM-MAP: use common tfs.c true_false_string 2023-12-11 12:29:23 +00:00
Martin Mathieson 66c4987948 RLC Graph: some improvements 2023-12-11 12:15:35 +00:00
Joakim Karlsson 3d5ac61f29 GTPv2: Dissect IE PGW Change Info Extendable 2023-12-11 08:30:02 +01:00
John Thacker 719ca70130 HTTP3: Use BASE_SHOW_ASCII_PRINTABLE for QPACK
The non-Huffman encoded QPACK bytes are added to the tree as
FT_BYTES, and they are expected to be probably printable
ASCII but treated as opaque data if not. That's
BASE_SHOW_ASCII_PRINTABLE, which makes the values a little more
useful in the tree.
2023-12-10 22:32:53 -05:00
John Thacker 88e5ae3d14 HTTP3: Use the Wireshark logging system
Move some of the less useful messages to ws_noisy, the rest to
ws_debug. (A few of the errors could be ws_info, which isn't
displayed by default either.)

Part of #19519
2023-12-10 23:43:10 +00:00
Gerald Combs ccb8a79bc2 [Automatic update for 2023-12-10]
Update manuf, services enterprise numbers, translations, and other items.
2023-12-10 16:24:43 +00:00
John Thacker 2e5f5ab645 HTTP3, QUIC: Desegment HTTP3 QPACK Encoder Streams
Return the number of bytes decoded and placed in the tree and
set pinfo->desegment_offset and desegment_len so that the QUIC
disssector can desegment the HTTP3 Encoder stream.

Pass that number of bytes to the nghttp3 decoder so that we don't
end up passing the same bytes twice with reassembly.

Make it so the QUIC data stream desegmenting code puts a link
to the frame data was reassembled in for segments that begin
an MSP as well in more cases, as the TCP dissector does.
(There are a few more cases TODO to produce results similar to
TCP.)

Fix #19475
2023-12-10 07:36:41 -05:00
Guy Harris 17d479f876 nflog: time stamps are in seconds/microseconds, not seconds/nanoseconds.
See

1. https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html

2. The `nla_put(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts))`
   call in net/netfilter/nfnetlink_log.c in the Linux kernel source.

Add support for 16-byte and 12-byte seconds/microseconds time stamp, to
match what we already have for seconds/nanoseconds time stamps, in
`proto_tree_add_item()` etc., and use that.

Fixes #19525.
2023-12-09 12:15:50 -08:00
John Thacker 2e288ae393 HTTP/3: Only decode a QPACK encoder stream on the first pass
Store the QPACK encoder stream state, such as the number of insertions
in the current segment and the total so far, and retrieve it on subsequent
passes. Passing the data to the nghttp3_qpack_decoder on subquent
dissections creates confusion and inaccurate results.

We don't have to memdup the buffer unless we're actually doing the
decoding.

We can later use this information in order to defragment QPACK
table insertion instructions that are split across QUIC packets.

Related to #19475
2023-12-09 13:10:37 +00:00
John Thacker 7a6338c60c QUIC: Don't desegment and call app handles for 0-length stream segments
Don't bother trying to desegment and calling the subdissector indicated
by the app handle / ALPN for a zero length stream payload segment. It
won't work, and it messes up our methods of determining if desegmentation
is needed.

Revisit this is there ever is a protocol on top of QUIC that must
be called with a zero length payload segment.

Fix #19497
2023-12-08 20:42:14 -05:00
Martin Mathieson 8db858b667 RLC-NR: Further fixes to tapping NACK_SN + ranges 2023-12-08 12:17:45 +00:00
David Fort e0acd7ef1e rdp: add dissecting of relative mouse moves
Last MS-RDPBCGR spec contains new messages to send relative mouse moves in fastpath
packets. The patch add the dissecting of these new messages.
2023-12-08 10:55:53 +00:00
Martin Mathieson bfda80d230 check_typed_item_calls.py: Improve checks around items in bitmask calls 2023-12-08 09:20:02 +00:00
Martin Mathieson 8cda6390de Fix some issues around tapping RLC NR ACKs 2023-12-08 09:18:22 +00:00
John Thacker 5e370aa748 assa_r3: Dissect UPSTREAMFIELD_NOTUSED as an unknown type
Space is set aside in an array of hfs for UPSTREAMFIELD_NOTUSED (0),
presumably because that's easier than applying an offset to the
type value. However, an hf is never registered.

On 4.2 and earlier it ends up adding an empty "text only" field to
the tree, because the hfindex is initialized to zero (as a static
array). Since the hfindex 0 no longer corresponds to the text only
field (but means an unregistered field), the bug has been exposed.

There's already a FT_NONE field for an unknown type greater than
the maximum value. Let's use that for this type, which is also
contrary to spec.

Seen in fuzzed data (#19522)
2023-12-08 01:01:46 +00:00
Anders Broman 158e104569 ITS: CAMv2 uses "pld" PathHistory defenition.
Add PathHistoryV2 to CPM-PDU-Descriptions for bacward compabillity.
Closes #19511
2023-12-07 16:58:48 +00:00
Dr. Lars Völker f5e25421a8 SOME/IP-SD: Adding expert info for StopSub/Sub combination
SOME/IP-SD sends out a StopSubscribe entry followed by a Subscribe
entry, if the previous Subscribe was not answered. This patch adds an
expert info to show that.
2023-12-07 15:44:39 +00:00
Dr. Lars Völker c512da8b8b SOME/IP-SD: Adding expert info for Offer Service without Endpoints
Offer Service entries are the only entries that need to always reference
1 or 2 endpoints. Show expert info, if this is not the case!
2023-12-07 12:33:35 +00:00
Dr. Lars Völker 5b2533af87 TECMP: Adding support for ILaS data
Adding support for ILaS data.

Thanks to Mr. Hoffmann of Inova for approving the publishing of the code.
2023-12-07 12:32:34 +00:00
Martin Mathieson dd9e07ae6d MAC 3GPP Stats: treat all CRC errors as generic failures 2023-12-07 12:30:19 +00:00
Martin Mathieson e17a22df89 Fix some spelling errors 2023-12-07 09:38:27 +00:00
Chris Brandson 866de7bcde Zigbee display Smart Energy Fast Poll End Time as numeric and string
Thanks to Cole Wu <colewu9712@gmail.com> for the original implementation
2023-12-07 06:33:14 +00:00
John Thacker 8ebde1309d Improve interface displaying and writing with multiple sections
Update the functions that get an interface name or description
to also take the section number in the record (0 if not present.)

Store a mapping of SHB number and interface number to global
interface number, and provide a function to access it. Use the
function to display the correct interface name and description
when there are multiple SHBs.

Use this information to rewrite interface numbers when writing a
pcapng file through wtap dumper, since we don't write additional
SHBs to a file when dumping. We could, but we'd have to store
exactly when to write the extra SHB when reading the file in
sequentially (unlike the other internal blocks, IDB, NRB, and
DSBs, that we intentionally move to the start.)

Since we're changing the number of sections, perhaps we should edit
the SHB options more?

Merging handles interface numbers in its own manner, but also needs
to know about the per-SHB interface ID to global ID mapping when
doing so.

Capinfos and capture file properties still require a bit more work
for proper output.

Fix #16531, fix #18049
2023-12-07 01:00:42 +00:00
John Thacker 577cc97f32 HTTP3: Improve QPACK dissection split across packets, prevent crash
Pass the tvbuff and offset into read_qpack_prefixed_integer
instead of raw pointers, and call tvb_get_ptr before doing
the pointer arithmetic. This throws a ReportedBoundsError if
we're trying to get something at an illegal offset, instead of
crashing.

Catch the ReportedBoundsError there and when adding the opcode
to the tree in order to break out of the loop instead of having
malformed packets and failing to pass information to the qpack
decoder.

Pass the entire stream buffer to the nghttp3 qpack decoder,
not just what is decoded; it saves state and doing so is
necessary in order to handle QPACK instructions that are split
across QUIC packet boundaries.

We don't properly put the QPACK information into the proto
tree when it's split across boundaries still, but it at least
is processed by the decoder so that the HEADERS are now properly
displayed.

The QPACK information is also still passed to the decoder every time
a packet is dissected, which eventually results in the decoder erring
out (especially with random packet access.)

Fix #19502. Related to #19475.
2023-12-07 00:47:26 +00:00
snicket2100 52eb0cab5b Added dissector for the Monero wire protocol 2023-12-06 22:12:24 +00:00
Stig Bjørlykke b14d9c963c Remove init of tap variables
A tap_id is never 0, so initializing tap variables to -1 is not
necessary.
2023-12-06 13:07:05 +00:00
Martin Mathieson 3644aa86a4 Draft: Make LTE Uu stats and graph work for NR too 2023-12-06 12:50:28 +00:00
John Thacker 71fd16605c RDP: copy_address considered leaky
When copying an address to a struct declared on the stack
used as a temporary lookup key, use copy_address_shallow.
When copying an address to a wmem_file_scope()d conversation
data, use copy_address_wmem(wmem_file_scope(), ...)
2023-12-06 00:15:38 +00:00
liu0hy d069a39c89 Busmirroring: Add expert item for invalid value 2023-12-05 14:42:52 +00:00
Riya Dixit 6230344148 Adding PLDM dissector for Base Specification
This commit implemements PLDM dissector
for the base specification of the  protocol
which is done following DMTF guideline
documentation -
https://www.dmtf.org/sites/default/files/standards/documents/DSP0240_1.1.0.pdf

Testing : For verification of dissector
pcap file collected during host poweron
is used.

Signed-off-by: Riya Dixit <riyadixitagra@gmail.com>
2023-12-05 14:40:16 +00:00
Dylan Ulis dc148e0ea5 CIP: Improve Connection Analysis 2023-12-05 14:36:48 +00:00
Eugène Adell 01796d6f2e IPv4: Implementation of conversations with stream identifiers 2023-12-05 14:36:01 +00:00
John Thacker 0e01240e78 SDP: Don't look past the fmtp parameter tokenlen for equals
Fixes an issue with SDP media format parameters that aren't in the
"parameter=value" format being followed by parameters that are.

Fix #19518
2023-12-05 08:53:20 -05:00
Gerald Combs 98a8a9787b ZigBee TLV: Add a recursion check
Blind attempt at fixing #19504.
2023-12-05 01:49:04 +00:00
Gerald Combs fedc96177f [Automatic update for 2023-12-04]
Update manuf, services enterprise numbers, translations, and other items.
2023-12-04 20:39:59 +00:00
Martin Mathieson 412f184af2 PDCP-NR (trivial): show calculated digest preceded with 0x 2023-12-02 03:31:32 +00:00
Giovanni Musto 369651d618 BLF: Fix BLF_OBJTYPE_SYS_VARIABLE dissection 2023-12-04 11:14:36 +01:00
snicket2100 87ec22e63d bitcoin: implemented dissecting `addrv2` messages 2023-12-03 19:44:31 +00:00
Martin Mathieson 64723c6fdc check_tfs.py: show more clearly how to use tfs i.s.o. value_string 2023-12-01 23:16:15 +00:00
Martin Mathieson 6f38651c3f Fix some spelling errors 2023-12-01 23:10:29 +00:00
Cal Turney 0a68875657 TCP: Show the frame in which a PDU is reassembled
Change "[TCP segment of a reassembled PDU]" to
       "[TCP PDU reassembled in <frame #>]" in the Packet List.

This fixes a bug where the former message was displayed in cases
where the PDU was not in fact reassembled such as when a frame is
missing from the capture.

TCP: Show the frame in which a PDU is reassembled

Added six checks for "'[TCP PDU reassembled in'" which are necessary
to prevent the display of that info from breaking the testing
commits of others.

These commits are squashed.
2023-12-01 10:00:48 +00:00
Dr. Lars Völker 363e0a7447 DNS: Reduce false positives of the DNS heuristic
Reducing false positives:
- DNS with no query and no answer does not make sense
- DNS packet has to have a minimum size for questions and RRs
2023-11-29 19:28:34 +00:00
Petr Špaček 8aea8c2156 DNS: fix typo in DNSSEC algorithm name ECDSAP386SHA386 -> ECDSAP384SHA384 2023-11-29 16:15:39 +00:00
Dr. Lars Völker fc0f96477e TECMP: Make ASAM CMP detection backward compatible (Bugfix)
TECMP 1.7 states that the first byte of the Device ID is always 0x00, so
we can detect ASAM CMP on this. The older TECMP versions allowed that
byte to 0xff for user-defined Device IDs. Since traces with TECMP 1.6
and before still exist, the ASAM CMP Detection is updated to allow the
first byte to be 0xff in TECMP too.
2023-11-29 13:10:19 +00:00
Maxim Sharabayko 52c9976bba srt: Show rejection reason name for internal codes. 2023-11-29 13:09:04 +00:00
Timo Warns 2cab4226ef GNSS: add dissector for SBAS L1 MT26
Add dissector for SBAS L1 MT26 (ionospheric delay message).
2023-11-29 05:34:40 +00:00
Dylan Ulis f4883589eb CIP: Update Safety Application Reply handling 2023-11-29 05:34:07 +00:00
Pascal Quantin 78383d6784 ZigBee ZCL: fix a memory leak introduced in be881f4 (CID 1558103) 2023-11-28 15:36:12 +01:00
Chris Brandson be881f404b Zigbee make the formatting of Zigbee UTC Time more readable and usable
zbee_zcl.attr.utc is a string representation of the time. This time is based on an uncommon epoch.
Someimes the numerical value for UTCTime is convenient (e.g. sorting by numbers rather than
string represenations of time). This numerical value is now both displayed in the UTC Time field
and a second filter field utc_raw has been added for when the numerical value is needed,
for example when using t-shark.

Thanks to Cole Wu <colewu9712@gmail.com> for the original implementation and support validating
this update.
2023-11-28 10:50:26 +00:00
WFA-achuang 3b8fb201a0 ieee80211: Fix two issues
1. Check if there are elements after SAE confirm paramter
2. Fix wrong MIC length in FT element for AKM FT_FILS_SAH256
2023-11-28 09:40:17 +00:00
Noan 8873aba1a0 Fix parse number of scalability structures in VP9 2023-11-28 09:36:44 +00:00
John Thacker 860c3e0ba3 QUIC: Short Header packets can't be coalesced with Initial or 0-RTT
If the first QUIC packet in a frame is an Initial or 0-RTT packet,
then we know that the handshake cannot be completed until the other
side responds. Thus it is impossible for subsequent packets in the
same frame to be Short Header packets on the same connection (which
is what check_dcid_on_coalesced_packet() tests), as the 1-RTT keys
cannot have been negotiated. This is true even with GSO/GRO.

It is possible for Initial packets to be coalesced with 0-RTT or
Handshake packets, and it might be possible for a frame to have
a first QUIC packet be a Handshake packet and subsequent packets
be 1-RTT short header packets.

Fix #19503
2023-11-27 23:29:10 +00:00
Jaap Keuter 55a1f8b602 BACapp: Update BACnet vendor ID's 2023-11-27 23:09:36 +00:00
Tomasz Moń 7bc7cd788c
USB Audio: Initial control transfers dissection support
There is no need to use parsed class version from descriptor, simply use
the interface protocol to determine USB Audio class version. Repurpose
the audio class data to store Entity ID to type mapping. The mapping is
necessary to determine control selectors that depend on entity type.
2023-11-27 18:07:38 +01:00
Stig Bjørlykke 83c94249b4 icmpv6: Make ND_RA_FLAG_RSV the two last bits
The two last bits in Router Advertisement flags are reserved.
2023-11-27 15:32:43 +00:00
David Fort 653d79ef09 rdp: add preliminary RDPEAR channel support
Add the basic parsing for the redirected authentication channel also called
remote credential guard.
2023-11-27 09:59:00 +01:00
David Fort ea259b8841 rdp: various fix for the dynamic channel
The packet reassembly was not always done correctly and was sometime making wireshark
to segfault. The patch reworks packet reassembly, making it a little simpler. It also
tracks first and last packet of reassembly, so if needed we could add links to these frame
in the future.
Also the progress information used to also be erronous in some intermediate packets, the
patch fixes that.
2023-11-27 09:59:00 +01:00
Martin Kaiser 34cc9b2e1a ipars: eomtype should not be global
The eomtype variable is used only inside dissect_ipars. Make it a local
variable. It's always set before it's used, there's no need for an
initial value.
2023-11-26 18:13:20 +00:00
Martin Kaiser d27c0adb5a ipars: don't throw an exception under if (tree)
Always parse the complete packet. We want to see parsing errors (exceptions
from the proto_* functions) in any case, not just if we have a tree.
2023-11-26 18:13:20 +00:00