Commit Graph

84214 Commits

Author SHA1 Message Date
Odysseus Yang 36e834b6b7 ETW: Extract IP packets from Windows event trace
With this change, Wireshark will be enhanced to display IP packets from an event trace logfile
or an event trace live session.
2022-05-05 13:35:47 +00:00
Dr. Lars Völker 0f5025eae4 SOME/IP: Adding string fields for easier filtering 2022-05-05 05:48:35 +00:00
Gerald Combs 4fa373400f Tools: Add trailing periods to our bug notes if needed.
[skip ci]
2022-05-04 10:39:18 -07:00
Martin Mathieson ca5b095b38 .gitlab-ci.yml: more checks from tools/check_typed_item_calls.py 2022-05-04 09:36:19 +00:00
Gerald Combs f85d4a5763 Falco Bridge: Fix a couple of bugs.
Make sure a pointer is valid and only initialize our sinsp span once.
2022-05-03 19:29:51 -07:00
Martin Mathieson 000e4ec75e PDCP-LTE: Allow updated keys to be found by frame number 2022-05-03 22:02:23 +00:00
Dylan Ulis 7261eb0f09 CIP Safety: Fix SERCOS III attributes 2022-05-03 20:30:55 +00:00
Dylan Ulis a14e35a440 CIP Safety: Detect Cancel Propose/Apply TUNID 2022-05-03 20:13:55 +00:00
Karsten Graul 0ab1cbdb40 SMC: show translated MTU and buffer size
Additionally append the translated/uncompressed MTU and
buffer size.

Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
2022-05-03 19:12:18 +00:00
Karsten Graul 341e625249 SMC: support for SMC-Rv2 LLC messages
Add the support for SMC-Rv2 Link Level Control (LLC) messages which
flow over Infiniband.

Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
2022-05-03 19:12:18 +00:00
Karsten Graul 7c70af016f SMC: improve SMC-Rv2 CLC message support
More fine tuning of the SMC-Rv2 support, and add the support to show
the GID list in a CLC proposal message.

Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
2022-05-03 19:12:18 +00:00
Guvenc Gulce b66b07a786 SMC: Add support for SMCRv2
Add SMCRv2 clc proposal/accept/confirm and decline support.
Proposal and decline parsing routines are used by SMC-R(v2) and SMC-D(v2).

Enhance the existing SMC protocol dissector in such
a generic way that it supports both SMC-R(v2) and SMC-D(v2)
protocols. These two protocols are similar to each other.
SMC-D and SMC-R has a version 1 and version 2.

Signed-off-by: Guvenc Gulce <guvenc@linux.ibm.com>
2022-05-03 19:12:18 +00:00
Dylan Ulis edfef021e7 CIP Safety: Increase error detection diagnostics to PI_ERROR 2022-05-03 15:06:50 +00:00
Roland Knall e43501cf9e qcustomsplot: revert for fix Clang Warnings[core.UndefinedBinaryOperatorResult]
The commit prevents compilation for Qt 6.3.0

This reverts commit 3afa8264cb.
2022-05-03 15:46:03 +02:00
Gerald Combs e8bcaad686 Tools: Show elapsed time when fuzzing. 2022-05-02 22:38:31 +00:00
Gerald Combs 925daf665c GitLab CI: Switch back to Clang 14. 2022-05-02 13:57:12 -07:00
Gerald Combs 3b6734389d tools: Show recent commits in fuzz output.
Show commits from the past 48 hours instead of the most recent commit.
2022-05-02 11:17:24 -07:00
Alexander Clouter e75f6800ca EAP: fix packet leak caused by ce087027ef
Caught and flagged in https://gitlab.com/wireshark/wireshark/-/merge_requests/6838#note_932484809
2022-05-02 17:12:24 +01:00
Gerald Combs 2f31c09045 [Automatic update for 2022-05-01]
Update manuf, services enterprise numbers, translations, and other items.
2022-05-01 17:26:48 +00:00
Gerald Combs 0cce93d76a Tools: Fix make-no-reassembly-profile.py.
Update our path to match fc2cc05dde.

[skip ci]
2022-05-01 09:50:40 -07:00
Guy Harris 69e956d792 conversations, endpoints: sort resolved addresses as text.
If name resolution is enabled in the conversations and endpoints
dialogs, sort address columns by the resolved names, not by the
addresses; sorting them by address will give *very* unexpected results,
and not make it easier to look for addresses by name.
2022-04-30 19:37:50 -07:00
Martin Mathieson 7fbfea9d68 IEEE80211: Fix a couple of filters 2022-04-30 21:56:21 +00:00
Alexander Clouter ce087027ef EAP: massage pinfo for EAPOL so the TLS decoder does not get lost 2022-04-30 13:30:20 +00:00
Alexander Clouter 6843ca2463 EAP: decode TEAP Outer-TLVs 2022-04-30 13:30:20 +00:00
Alexander Clouter 914d8bc756 EAP: add PEAP decoder
The existing PEAP support does not decode the inner attributes, this
commit adds that support by introducing packet-peap.c which recreates
a 'pseudo' EAP header before looping the TVB back into the EAP dissector.
2022-04-30 13:30:20 +00:00
Alexander Clouter 49c730cc23 EAP: use enum for pdata instead of magic numbers
Later for packet-peap.c, need to use pdata to pick into the parent
dissector so here we set up packet-eap.c to use enum.
2022-04-30 13:30:20 +00:00
Alexander Clouter b9681002c5 EAP: add MSAUTH-TLV decoder 2022-04-30 13:30:20 +00:00
Alexander Clouter f694e70771 EAP: improve EAP-TLS flag decoding
Decode TEAP's O-flag.

We also update the diagram and references as PEAPv0 has a different view
of how the flags are used compared to the RFCs and drafts.
2022-04-30 13:30:20 +00:00
Gerald Combs 76660922e1 Tools: Add a timestamp to our fuzz test error header.
Print the UTC date and time.
2022-04-29 17:01:40 -07:00
Gerald Combs 7bccf9e2aa GitLab CI: Revert back to Clang 12.
Revert commits bc29ce61d5 and
3dd5ccbe7d in case Clang 14 is causing our
recent fuzz failures. Ping #18045.
2022-04-29 15:54:13 -07:00
Gerald Combs 3336ec24ac Falco Bridge: Add typed address fields.
libsinsp currently only supports string and unsigned 64-bit integer
field types. For string fields that might contain a parseable address,
add ".v4" and ".v6" subtree items with a corresponding field type.

For example, the ct.srcip field now dissects as

Sysdig Event 1: 880 bytes
Falco Bridge
cloudtrail Plugin
    [ ... ]
    Source IP: 3.92.225.50
        [Source IP (IPv4): 3.92.225.50]
2022-04-29 12:13:34 -07:00
Gerald Combs 70bd130379 Fix "generated by" comments in configuration files.
Add get_configuration_namespace() and use it in code that writes
"generated by" comments at the top of various configuration files.

Update our Logwolf colorfilters.
2022-04-29 18:00:21 +00:00
Joakim Karlsson b244db8f3c pfcp: Update to 3GPP TS 29.244 V17.4.0 2022-04-29 11:29:19 +00:00
Dylan Ulis 482794ff2e CIP Safety: Fix TBD bytes expert info 2022-04-29 11:28:01 +00:00
John Thacker 536c685ea5 docs: Update reference to minimum versions of GLib and Qt 2022-04-28 23:12:24 -04:00
Roland Knall f595f3b6ad sshdump: Update doc for openssh key note
Add a note, that the key value pair format has to be openssh format

Fixes #18063
2022-04-28 19:59:07 +02:00
John Thacker 1e0f579952 docs: Remove references to configure
Remove some leftover references to configure in the INSTALL file
and README.* files in root directory.
2022-04-28 16:19:13 +00:00
Moshe Kaplan 7e04ea3202 .gitlab-ci.yml: Disable security-code-scan
Disable security-code-scan, a .NET scanner which
is not applicable to Wireshark.
2022-04-28 13:34:00 +00:00
John Thacker 84515e3175 Packaging: Only preserve a tarball if the commit ID matches
Tarballs created by git archive have the commit ID stored in their
header. Only preserve a preexisting tarball if that commit ID matches
that of the current commit, even if the versions match.

Fix the creation of a temporary commit for when the working directory
does not match the tree. (When git diff-index is called without
--quiet or --exit-code, the exit code is success even when there
are differences). Use git stash create, as it is intended for scripts
like this; it creates a temporary stash not stored in the ref namespace
which does not require being popped later, and does nothing and outputs
the empty string instead of a commit ID if there are no local changes.

This helps when generating tarballs or building rpm packages repeatedly
out of a changing working tree.
2022-04-28 02:02:39 +00:00
Gerald Combs 52db7e88bc Falco Bridge: Fix building on Windows.
Fix Falco plugin installation in multi-config environments. Fix FindSinsp
on Windows.  Ignore a couple of warnings for now.
2022-04-27 22:01:17 +00:00
Gerald Combs 0f695875ac Falco Bridge: Switch to the sinsp capabilities API.
falcosecurity/libs 448c380e switched from a plugin type to a more
generic capabilities enum.
2022-04-27 22:01:17 +00:00
Gerald Combs b104af1c7d Tools: Update our fuzz test error header.
Add the GitLab job URL and reorder other items.
2022-04-27 21:45:09 +00:00
Dario Lombardo a6dcf70f68 debian: add missing symbol. 2022-04-27 20:58:11 +00:00
Dirk Ziegelmeier c27d8bbedd Profinet plugin: Add severity according to PA Profile 4.02 2022-04-27 20:29:57 +00:00
Joakim Karlsson b75b8ca72e dfilter: fix may be used uninitialized in this function [-Wmaybe-uninitialized] 2022-04-27 13:36:43 +02:00
Jonas Falkevik 7284ee091f Diameter: Decode GMLC-Number AVP
Add decoding of the GMLC-Number AVP.
3GPP TS 29.272 GMLC-Number
Encoded as a TBCD-string.
2022-04-27 09:15:45 +00:00
Jonas Falkevik bfdb4c558e epan: refactor dissector E.164 MSISDN number name
Prepare for adding reusing code where only descriptive name differs.
But the numbers are encoded using the same rules.
"E.164 number (MSISDN)" & "E.164 number (ISDN)" for example.
2022-04-27 09:15:45 +00:00
Moshe Kaplan c3249701b5 .gitlab-ci.yml: Disable semgrep
Disable semgrep SAST scanner because it cannot properly
handle macros used in Wireshark dissectors and other code.
2022-04-27 00:26:18 +00:00
Joakim Karlsson c2444370f4 GTP': correction of Release Identifier Extension 2022-04-26 19:40:28 +00:00
easonweii b72b4cf512 LLDP: Fix malformed packets when EndOfLLDPDU TLV missing
The End of LLDPDU TLV is optional, should not as malformed even if missing.
Resolve it by checking whether the total length of each TLV reaches the total length of TVB.
Close #18029
2022-04-26 19:27:15 +00:00