Commit graph

13598 commits

Author SHA1 Message Date
Martin Mathieson
fbf198ae9b Add expert info for timing adjustment control message, and tweak a label.
svn path=/trunk/; revision=34123
2010-09-15 15:52:30 +00:00
Jeff Morriss
4584a81149 Revert 34081 and 34093 in preparation for a cleaner fix.
svn path=/trunk/; revision=34121
2010-09-15 15:13:17 +00:00
Jeff Morriss
2b52159449 Follow up to bug 5209 and rev 34115:
%hh is C99 so remove it from packet-ssl-utils and add it to the banned list
(similar to %ll) in checkAPIs.pl .


svn path=/trunk/; revision=34120
2010-09-15 14:10:25 +00:00
Stephen Fisher
0583c64d8f Clean up the icmp info column per discussion in bug #4014.
Change to using new ENC_[BIG|LITTLE]_ENDIAN instead of FALSE and TRUE
in the proto_tree_add_item() calls for the identifier and sequence numbers.


svn path=/trunk/; revision=34119
2010-09-14 21:38:54 +00:00
Stephen Fisher
07c7d3046a Remove duplicate register_all_protocol_handoffs entry
svn path=/trunk/; revision=34117
2010-09-14 16:03:34 +00:00
Stephen Fisher
fe45005420 Bug #5211 from Guenter Strubreiter:
for writing a TCAP subdissector as a plugin some functions are needed in
libwireshark.def for export



svn path=/trunk/; revision=34116
2010-09-14 15:54:12 +00:00
Gerald Combs
436ab95472 From Cal Turney via bug 5209:
Decode of SETCLIENTID calls in the Windows x86 version fail with "[Dissector
bug, protocol NFS: STATUS_ACCESS_VIOLATION: dissector accessed an invalid
memory address]".  This error occurs in packet-nfs.c in
dissect_nfs_clientaddr4() where vars 'protocol' and 'universal_ip_address' get
stepped on following the call to scanf().  The b1-b10 vars are declared as
quint8.  While "hh" modifier used in the scanf() is documented in Linux to
correspond to an a signed/unsigned char arg, I cannot find a similar
designation in Windows (MSDN). The Windows C compiler interprets %hhu as
corresponding to a int16 rather than int8.

svn path=/trunk/; revision=34115
2010-09-14 15:43:19 +00:00
Anders Broman
97d69446ea From tieuthunhi:
Add new time source for Gigamon header.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5210

svn path=/trunk/; revision=34114
2010-09-14 14:43:56 +00:00
Anders Broman
14b9a4c56a From Vincent Helfre:
Incorrect decoding of List of ARFCN in BCCH frequency list.
When the range 1024 is selected, it can happen that 2 bytes need to be read for
W1, and also for W2. In the current version, when W1 ends on a byte boundary,
W2 will get an incorrect value, since it will be truncated by 1 bit.

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5214

svn path=/trunk/; revision=34113
2010-09-14 14:24:39 +00:00
Gerald Combs
4c74418400 Attempt to fix the stack overflow reported at
http://seclists.org/bugtraq/2010/Sep/87 .

Unfortunately no one from the NCNIPC pen test team has contacted us or
provided a sample capture so the fix hasn't been verified.

svn path=/trunk/; revision=34111
2010-09-13 18:49:55 +00:00
Anders Broman
5a28b5317e From Yaniv Kaul:
[PATCH] Add SSL cipher 'Transport Layer Security (TLS) Renegotiation Indication Extension' (RFC 5746)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5207

svn path=/trunk/; revision=34110
2010-09-13 16:51:10 +00:00
Anders Broman
6117e317c6 Remove deprecated check_col().
svn path=/trunk/; revision=34107
2010-09-12 19:29:05 +00:00
Gerald Combs
bc8ce9e9e3 [Automatic manuf and enterprise-numbers update for 2010-09-12]
svn path=/trunk/; revision=34102
2010-09-12 15:03:34 +00:00
Balint Reczey
cfbd48b785 Decode SLL payloads using a dissector table based on sll.ltype.
The idea and the original patch came from Sebastian Reichel
<elektranox@gmail.com> in
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=594390

svn path=/trunk/; revision=34101
2010-09-12 01:13:42 +00:00
Stig Bjørlykke
894941e532 Only check for 4 NOP in a row within a uint32 boundary.
svn path=/trunk/; revision=34100
2010-09-10 21:24:32 +00:00
Stig Bjørlykke
633e4e324b From Martin Peylo via bug 5198:
Added missing OIDs in CRMF (RFC 4211) dissector.

svn path=/trunk/; revision=34099
2010-09-10 21:22:29 +00:00
Stig Bjørlykke
f2e302eee0 Follow TCP and expand description for "NOP" and "EOL" options to "No-Operation (NOP)"
and "End of Options List (EOL)" respectively.

svn path=/trunk/; revision=34097
2010-09-10 16:48:00 +00:00
Stephen Fisher
0e0641f079 Put the ": %u (multiply by %u)" back on the TCP window scaling option, so
users don't have to expand the tree to see the details that were there 
before rev 34094.


svn path=/trunk/; revision=34096
2010-09-10 16:33:46 +00:00
Stephen Fisher
f2e2be709a Expand description for "NOP" and "EOL" options to "No-Operation (NOP)" and
"End of Options List (EOL)" respectively.


svn path=/trunk/; revision=34095
2010-09-10 16:23:58 +00:00
Stephen Fisher
8d3e472866 Enhance the TCP option display for window scaling.
svn path=/trunk/; revision=34094
2010-09-10 16:12:17 +00:00
Jeff Morriss
a81a10a63a From BBA via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5160 :
Followup to 34081: move libwsutil _all_ the way forward so that our inet_pton
is always linked in before wsock32's.  This means that our Windows-7 Win64
builds (on which there is a native inet_pton in wsock32) will still work on
pre-Vista Win64's.

svn path=/trunk/; revision=34093
2010-09-10 13:52:42 +00:00
Stig Bjørlykke
aca8a4d989 Update dsfield ECN according to RFC3168.
svn path=/trunk/; revision=34092
2010-09-10 11:16:29 +00:00
Jeff Morriss
11ee648da3 Add some hf blurbs (for fields whose description is an acronym)
svn path=/trunk/; revision=34091
2010-09-09 18:36:20 +00:00
Stephen Fisher
ff5cfee491 Turn the TCP timestamp option into a subtree to also show the option kind,
option length and values with proto_tree_add_item() intead of _add_text().
The options tree still shows the same information as before until the sub-
tree is expanded.

The goal is to do this with all TCP and IP options.


svn path=/trunk/; revision=34088
2010-09-08 23:10:52 +00:00
Stig Bjørlykke
d968bc8b61 Mask out the header length from th_flags.
svn path=/trunk/; revision=34087
2010-09-08 21:25:14 +00:00
Stephen Fisher
b17b2eb187 Make the Windows buildbot happy: guint8 -> guint16 for flags variable in
definition of tcp_analyze_sequence_number(). 


svn path=/trunk/; revision=34086
2010-09-08 21:11:45 +00:00
Stephen Fisher
e12fc91a33 Minor correction to SVN revision 34084: we better only try up to the 9
available values in flags[], so we don't run past the end of the array
if one of the reserved flags is set. 


svn path=/trunk/; revision=34085
2010-09-08 20:52:00 +00:00
Stephen Fisher
dfacac4421 Expand the TCP flags to include the low nibble of the byte that has
the header length in the high nibble.  The only new flag is nonce (NS);
the remaining three bits are still reserved.


svn path=/trunk/; revision=34084
2010-09-08 20:43:19 +00:00
Stephen Fisher
4c6864b29b From Frank Lahm via bug #5169: Provide initial support for the undocumented
AFP FPSpotlightRPC call. 


svn path=/trunk/; revision=34083
2010-09-08 19:01:41 +00:00
Stig Bjørlykke
e71daa1fc1 Revert revision 33780, because the checksum is only calculated
from the header and not the content.

svn path=/trunk/; revision=34080
2010-09-08 13:38:47 +00:00
Stig Bjørlykke
c1a591cd37 Support negative values when viewing seconds with hours and minutes.
svn path=/trunk/; revision=34079
2010-09-08 10:29:06 +00:00
Stig Bjørlykke
9562d30a13 Allow for proto_tree_add_item() with FT_ABSOLUTE_TIME and FT_RELATIVE_TIME
to have length == 4 (only seconds).

svn path=/trunk/; revision=34078
2010-09-08 09:33:53 +00:00
Stig Bjørlykke
bc11261a75 From Yaniv Kaul via bug 5193:
Dissect NTLMSSP type 0x5 (DNS Forest name).

svn path=/trunk/; revision=34077
2010-09-08 09:24:53 +00:00
Tomas Kukosa
eb503df011 Do not report undecoded message to expert info for ReturnResult without result filed
svn path=/trunk/; revision=34076
2010-09-08 09:02:16 +00:00
Stig Bjørlykke
4e4ee5e199 Fake proto_item_prepend_text() in reassemble_test.
svn path=/trunk/; revision=34075
2010-09-08 06:45:04 +00:00
Stig Bjørlykke
79ec447f8b Put the number of fragments/segments in front of the element to avoid
conflict when they are named fragments instead of segments and to avoid
duplicating the fragments/segments text.

svn path=/trunk/; revision=34074
2010-09-07 20:40:39 +00:00
Stig Bjørlykke
1af02462fd From Yaniv Kaul via bug 4550:
Show number of segments which were used in the desgementation.

svn path=/trunk/; revision=34072
2010-09-07 14:06:43 +00:00
Stig Bjørlykke
bd3906e8d6 From yami via bug 3310:
SMB2 create context response fix.

svn path=/trunk/; revision=34070
2010-09-06 19:59:15 +00:00
Stig Bjørlykke
ca111463e7 From Pascal Quantin via bug 5186:
Fix the decoding of the maximum/guaranteed bit rates for uplink/downlink.

svn path=/trunk/; revision=34069
2010-09-06 17:31:17 +00:00
Gerald Combs
5e686039a0 [Automatic manuf and enterprise-numbers update for 2010-09-05]
svn path=/trunk/; revision=34064
2010-09-05 15:03:42 +00:00
Stig Bjørlykke
42d0e5b2a8 Request-Line can contain an empty Request-URI.
I don't want to change get_token_len() to not skip multiple spaces,
because I don't know if other protocols depends on this behaviour.
We should maybe check this...

This fixes bug 5181.

svn path=/trunk/; revision=34063
2010-09-05 12:16:14 +00:00
Anders Broman
187baa00fa GTPv2: IMSI is decoded improperly.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5179

svn path=/trunk/; revision=34062
2010-09-03 17:10:52 +00:00
Martin Mathieson
4b5c69c0d9 Add bandwidth figures per UE.
svn path=/trunk/; revision=34061
2010-09-03 16:45:05 +00:00
Martin Mathieson
055d654cc2 Add bandwidth figures to RLC stats (per-UE and per-channel).
svn path=/trunk/; revision=34059
2010-09-03 15:22:28 +00:00
Tomas Kukosa
a974e115ce Fix start offset and length handling in SEQUNCE OF (caused Gtk crash for sequences at the end of frame)
svn path=/trunk/; revision=34058
2010-09-03 10:31:56 +00:00
Stig Bjørlykke
d2a3935fb7 Code cleanup: Remove Begin/End comments on each and every code block,
this only makes the code hard to read.

svn path=/trunk/; revision=34056
2010-09-03 09:10:32 +00:00
Stig Bjørlykke
16db2dd4f5 Check if using tree before adding the octet string.
svn path=/trunk/; revision=34055
2010-09-03 08:44:00 +00:00
Anders Broman
05642bcab3 Add doxygen coments.
svn path=/trunk/; revision=34053
2010-09-03 07:28:51 +00:00
Anders Broman
4e907d2a70 From Michael Lum:
ANSI-A dissector does not recognize service option 73
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5176

svn path=/trunk/; revision=34050
2010-09-03 06:18:29 +00:00
Anders Broman
956ddcb4b9 From Michael Lum:
The EVRC dissector does not handle service option 73 (EVRC-NW).
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5177

svn path=/trunk/; revision=34049
2010-09-03 05:50:55 +00:00
Stig Bjørlykke
67a4451239 Apply the quick fix from bug 2952.
And it's true, this dissector really needs an overhaul!

svn path=/trunk/; revision=34048
2010-09-02 21:30:54 +00:00
Jeff Morriss
7d20440ff0 Introduce 2 new environment variables: WIRESHARK_EP_VERIFY_POINTERS and
WIRESHARK_SE_VERIFY_POINTERS that control whether or not we verify if a given
pointer is ep_ or se_ allocated, respectively.

Turn the behavior off by default for speed reasons (the speed difference isn't
huge, but...).

Turn the behavior on when fuzz testing.

Document these two new variables in the man pages.

svn path=/trunk/; revision=34046
2010-09-02 18:02:06 +00:00
Jeff Morriss
8ffbb8ade8 Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5173 :
Don't call col_set_str() on a string returned from val_to_str() (which may be
ep_ allocated).

svn path=/trunk/; revision=34045
2010-09-02 17:13:36 +00:00
Stephen Fisher
de23882f07 Fix typo in comment: datat -> data
svn path=/trunk/; revision=34044
2010-09-02 17:11:48 +00:00
Anders Broman
136dec3980 From Pascal Quantin:
Patch that allows the dissection of the Feature Group Indicators bit string. I tested it with our UE and it works fine.

svn path=/trunk/; revision=34035
2010-08-31 20:03:46 +00:00
Stig Bjørlykke
afd6761f46 A GString has it's own length.
svn path=/trunk/; revision=34034
2010-08-31 18:28:59 +00:00
Stig Bjørlykke
f75b4ae02b Support space in list of hidden columns.
This fixes bug 5163.

svn path=/trunk/; revision=34033
2010-08-31 15:02:03 +00:00
Anders Broman
fc87f4a4c1 Add stub code for future dissection of featureGroupIndicators.
svn path=/trunk/; revision=34032
2010-08-31 10:50:54 +00:00
Stig Bjørlykke
85b4d16277 Update the header length after dissecting the header.
This fixes bug 5162.

svn path=/trunk/; revision=34031
2010-08-31 10:24:08 +00:00
Jeff Morriss
16653c5a6c Fix the crash reported in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5157 :
If get_unicode_or_ascii_string() returns a NULL pointer, return a pointer to an
empty string back to our caller.

svn path=/trunk/; revision=34018
2010-08-30 17:05:37 +00:00
Jeff Morriss
05f5bf510b Use the top-level isprint.h instead of redefining isprint ourselves.
svn path=/trunk/; revision=34016
2010-08-30 15:33:32 +00:00
Anders Broman
e17efa574d Doxygen fix.
svn path=/trunk/; revision=34013
2010-08-30 14:22:49 +00:00
Stig Bjørlykke
4382dcffad Call dfilter_macro_uat->post_update_cb instead of using cfile.
svn path=/trunk/; revision=34012
2010-08-30 09:31:52 +00:00
Stig Bjørlykke
835a43312f Always update the display filter when changing a display filter macro
and when changing profile.  Not sure why I have to invalidate cfile.dfilter
in macro_update(), because this will be done in macros_post_update(),
but unless this we get a crash when renaming a macro...

This is a fix for bug 5002.

svn path=/trunk/; revision=34011
2010-08-30 08:47:26 +00:00
Stig Bjørlykke
4f6e546d4d Always call post_update_cb() in uat_load_str().
svn path=/trunk/; revision=34010
2010-08-30 08:43:03 +00:00
Anders Broman
6d1a0a2e86 Doxygen related changes.
svn path=/trunk/; revision=34009
2010-08-30 05:39:02 +00:00
Bill Meier
7ebd25f59e Various:
1. Re-arrange proto_reg_handoff... code to follow the "standard idiom" for init/set of port prefs;
2. Define all fcns as static (except proto_register and proto_reg_handoff);
3. ethereal --> Wireshark;
4. Remove some uneeded/unused prototypes;
5. Fix a few function description comments.

svn path=/trunk/; revision=34006
2010-08-30 01:14:08 +00:00
Anders Broman
687eb5a2a6 Fix for Bug Packet details have errors when decode MAP V2 PRN_ACK msg
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5076

Use:
/*
 * Dissect Multiple Choice Message
 * This function is used to decode a message, when several encoding may be used.
 * For exemple, in the last MAP version, the Cancel Location is defined like this:
 * CancelLocationArg ::= [3] IMPLICIT SEQUENCE
 * But in the previous MAP version, it was a CHOICE between a SEQUENCE and an IMSI
 * As ASN1 encoders (or software) still uses the old encoding, this function allows
 * the decoding of both versions.
 * Moreover, some optimizations (or bad practice ?) in ASN1 encoder, removes the
 * SEQUENCE tag, when only one parameter is present in the SEQUENCE.
 * This explain why the function expects 3 parameters:
 * - a [3] SEQUENCE corresponding the recent ASN1 MAP encoding
 * - a SEQUENCE for old style
 * - and a single parameter, for old version or optimizations
 *
 * The analyze of the first ASN1 tag, indicate what kind of decoding should be used,
 * if the decoding function is provided (so not a NULL function)
 */

svn path=/trunk/; revision=34001
2010-08-29 17:34:44 +00:00
Sake Blok
93cfe5571b From Cal Turney (bug 5132):
TCP bytes_in flight becomes inflated with lost packets 

This patch suspends Bytes-in-Flight calculation when missing packets are detected.


svn path=/trunk/; revision=33994
2010-08-29 15:27:20 +00:00
Gerald Combs
0d6000b5ff [Automatic manuf and enterprise-numbers update for 2010-08-29]
svn path=/trunk/; revision=33992
2010-08-29 15:03:30 +00:00
Anders Broman
a009cc0605 Doxygen changes.
svn path=/trunk/; revision=33990
2010-08-29 10:47:38 +00:00
Gerald Combs
2f6dd574b7 Display 6to4 gateway IPv4 addresses and SLA IDs.
svn path=/trunk/; revision=33984
2010-08-28 20:55:32 +00:00
Bill Meier
b3ed77c1b0 #inlude <emem.h> not req'd;
Use tvb_strncmp to compare for "ESIO" string in packet;
Use consistent indentation conforming to the "editor modelines";
Minor other whitespce cleanup.

svn path=/trunk/; revision=33983
2010-08-28 19:50:00 +00:00
Gerald Combs
5fb37af39a De-obfuscate the Teredo client address and add a de-obfuscated port.
svn path=/trunk/; revision=33982
2010-08-28 19:46:20 +00:00
Anders Broman
a96e6b2047 Doxygen changes.
svn path=/trunk/; revision=33981
2010-08-28 19:27:19 +00:00
Gerasimos Dimitriadis
fe34e9a3fb Support for eMLPP Priority IE in BSSMAP
svn path=/trunk/; revision=33971
2010-08-27 21:30:12 +00:00
Guy Harris
43ae1a4b2b Update some links.
svn path=/trunk/; revision=33969
2010-08-27 21:28:24 +00:00
Guy Harris
add0764bc2 Allow Dissect As... to select the Ethernet-without-FCS dissector for a
given UDP port; this is to handle the output for the Cisco CMTS "cable
intercept" command - it encapsulates Ethernet frames in UDP packets, but
the UDP port is user-defined.

svn path=/trunk/; revision=33964
2010-08-27 21:13:26 +00:00
Gerasimos Dimitriadis
6f6fb2fd80 MNC, SANC, ISPC lists updated up to OB 960
svn path=/trunk/; revision=33963
2010-08-27 21:09:05 +00:00
Stig Bjørlykke
355e2bed0a From Owen Kirby via bug 5149:
Added a new dissector for SCoP.

svn path=/trunk/; revision=33962
2010-08-27 21:05:02 +00:00
Stig Bjørlykke
ec94791339 From Frank Lahm via bug 5136:
Correct volume flags for FPGetSrvrParms.

svn path=/trunk/; revision=33961
2010-08-27 20:54:21 +00:00
Gerald Combs
a3cbcbffb8 Display Teredo encapsulated IPv4 server and client addresses.
svn path=/trunk/; revision=33959
2010-08-27 19:52:17 +00:00
Stig Bjørlykke
1249a53f09 From Christian Durrer via bug 5155:
Added a new dissector for Ether-S-I/O protocol.

svn path=/trunk/; revision=33954
2010-08-27 17:18:28 +00:00
Stig Bjørlykke
551093a39a From Matthieu Lochegnies via bug 5153:
Show multiples DRDA commands from the same frame.

svn path=/trunk/; revision=33952
2010-08-27 16:30:38 +00:00
Martin Mathieson
31099a13aa Allow 3GPP release info to be displayed.
svn path=/trunk/; revision=33950
2010-08-27 13:54:05 +00:00
Stig Bjørlykke
598b89ab7f Added a check for constructed octet string to avoid a loop.
This fixes bug 5154.

svn path=/trunk/; revision=33949
2010-08-27 11:55:14 +00:00
Jaap Keuter
ccc74ae967 Take in updates from the TLS registery.
svn path=/trunk/; revision=33948
2010-08-27 06:28:17 +00:00
Anders Broman
a20bf7af0d Fix doxygen errors.
svn path=/trunk/; revision=33938
2010-08-26 19:40:08 +00:00
Stephen Fisher
36c2954387 Show a text string of the Windows version (if Windows 2000 or higher.)
svn path=/trunk/; revision=33936
2010-08-26 18:06:56 +00:00
Anders Broman
1c2b3b0eb9 Fix a number of doxygen directives.
svn path=/trunk/; revision=33930
2010-08-26 15:24:49 +00:00
Stig Bjørlykke
113fac8b77 From Juha Siltanen via bug 5144:
Added support for payload dissecting.

svn path=/trunk/; revision=33928
2010-08-26 13:49:23 +00:00
Anders Broman
48ac5f90ff - Try to fix a couple of doxygen comments.
- whitspace changes.

svn path=/trunk/; revision=33926
2010-08-26 06:46:30 +00:00
Gerald Combs
607b228df6 Add ws_load_library and ws_module_open, which respectively call
LoadLibrary and g_module_open only for the program directory and system
directory on Windows. Use them to replace a bunch of LoadLibrary and
g_module_open calls. Use the extension ".dll" for all the DLLs that we
load. Add comments about DLL loading in Python.

svn path=/trunk/; revision=33924
2010-08-25 20:30:59 +00:00
Tomas Kukosa
f5e1f23cac Fix wrong length of CSeq Method parameter
svn path=/trunk/; revision=33920
2010-08-25 14:10:58 +00:00
Martin Mathieson
c53d8b200b Let DCT2000 tree extend to end of ipprim or sctpprim bytes.
svn path=/trunk/; revision=33919
2010-08-25 13:27:27 +00:00
Martin Mathieson
3852415572 Show (again?) MAC-d PDUs inside MAC-es PDUs.
svn path=/trunk/; revision=33918
2010-08-25 13:01:00 +00:00
Stig Bjørlykke
ce99177a00 Display content entry (with length) in tree.
svn path=/trunk/; revision=33914
2010-08-24 15:47:10 +00:00
Stig Bjørlykke
98493ff110 Rewrote to fetch content_tvb from dissect_ber_octet_string().
Display eContent entry (with length) in tree.

svn path=/trunk/; revision=33912
2010-08-24 15:43:32 +00:00
Stig Bjørlykke
1a5f73299e Display octet string fragments for RTSE segment data.
svn path=/trunk/; revision=33911
2010-08-24 15:09:11 +00:00
Stig Bjørlykke
8b6c6a3dbf Display constructed octet strings with correct hf_id.
Show octet string fragments as for reassembly.

svn path=/trunk/; revision=33910
2010-08-24 15:08:07 +00:00