Commit Graph

90987 Commits

Author SHA1 Message Date
Anders Broman 40c420ab9b MMAS: Add a preference to dissect as iec61850 2024-04-06 17:30:05 +02:00
Eugène Adell c56a81d41c TCP: Add a flow counter to the statistics 2024-04-06 14:59:10 +00:00
Darius Davis 3b034815a2 Asterix: "const"-ify all the data structures.
In addition to moving about 100 kBytes from a read-write data section to
read-only, this change also allows us to eliminate some typecasts (which
dropped "const" qualifiers) and hence stop suppressing some compiler
diagnostics (i.e. remove some DIAG_OFF_PEDANTIC/DIAG_ON_PEDANTIC pairs).
2024-04-06 17:47:03 +10:00
John Thacker 4606845990 Qt: Rescale IO Graph axes before getting the x axis range
We want to get the value of the x axis range after rescaling,
in order to properly center when using ResetAxes. Also it's the
y-axis, not the x-axis, that might be logarithmic. This correctly
centers graphs after the initial retap without having to reset
again.
2024-04-06 07:18:59 +00:00
Gerald Combs 8f889b5833 Qt: Remove the URL code from the profile model & view
The profile dialog used to have a COL_PATH column which showed the path
to a profile and let you open that path in your system's file explorer.
That column was removed and we now have an auto switch filter column in
the same place. Remove the old (and formerly dead) URL code so that we
don't try to open display filters as file paths.
2024-04-06 07:17:18 +00:00
John Thacker 748e482dc7 Qt: Add Apply to Preferences Dialog
Add an Apply button to the preferences dialog.

Change the app signals from being queued to emitted. There was
a Qt bug on MacOS with nested event loops and processEvents (see
issues #11448, #11361) that existed in various versions starting
with 5.3.0. After a number of attempts to solve it, it was finally
resolved in 5.7.1 and 5.8.0:
https://bugreports.qt.io/browse/QTBUG-56746

We require versions of Qt later than that. We also don't exec() the
PreferencesDialog after commit f67eccedd9
so there isn't a nested event loop, removing the trigger for the bug
even if it did somehow reappear in Qt.

Remove the duplicate connections from the buttonBox accepted and
rejected signals that are created in the .ui file. It doesn't
seem to cause problems here currently, but connecting the same signal
to multiple slots can lead to some race conditions in some
circumstances. (See commit 06ba704058)
Just call accept and reject at the end of the other functions.

Fix #12566
2024-04-06 07:16:26 +00:00
John Thacker b63d6d3bb0 Qt: Fix IO Graph startOffset when packets aren't added
We don't always add certain zero points to the graph, even moreso
after hasItemToShow was introduced.

For currentOffset (which is used to determine start_time_ of the
entire IOGraphDialog, not just one IOGraph), we want the necessary
conversion between relative and absolute time so that absolute time
of day works for CSV output (#13717) and for packet selection with
Time of Day (#10922) when some items aren't added to the graph.
2024-04-05 18:43:19 -04:00
John Thacker 2ae6c42ce2 Qt: Fix IO Graph currentActiveGraph
The description for currentActiveGraph says that it applies to
the "currently selected, visible graph" but it doesn't currently
check if the graph is visible, only that the index is valid.
(It checked before IO Graphs were converted to a UAT.)

We check visibility in a few other places, but this switches us
to an displayed graph in a few cases instead of having the tracer
appear on an invisible graph or the hovering fail to find a graph
to match to a packet.
2024-04-05 18:05:36 -04:00
John Thacker 5d8fcce4d6 Qt: Enable IO Graph Crosshairs context menu action
Pressing the Space key works to toggle crosshairs, but
the menu action has done nothing. Enable it.
2024-04-05 22:04:06 +00:00
Darius Davis a3e7a7fb29 fix: "const"-ify most of fix_fields.
Only the hf_id field in fix_fields is ever modified; This change separates out
hf_id and makes the rest of that structure "const", moving about 26 kBytes of
data from a read-write data section to a read-only data section, moving another
6 kBytes of read-write data (formerly field hf_id) to .bss -- and reclaiming
another 6 kBytes of read-write data space which was being entirely wasted due
to field packing in the struct in 64-bit builds.
2024-04-05 21:39:39 +00:00
Stig Bjørlykke d0b143bbec Remove init to zero for static variables
The C standard requires that objects with static storage duration
is initialized to zero.
2024-04-05 21:38:28 +00:00
Cal Turney c47011890a HTTP: Incorrect request/response matching
Commented out the 'dfilter = "_ws.expert"' test because the
dissector no longer has expert Chat output.
2024-04-05 21:37:05 +00:00
Cal Turney f291ea8f30 HTTP: corrected request/response matching
Matching was not compliant with RFC9110 when requests were sent
in a asynchronously ordered fashion. Asynchrously (yet ordered)
requests and replies were matched according to LIFO rather than
FIFO. A new matching method has been implemented to handle cases
where packets are missing from the capture.
2024-04-05 21:37:05 +00:00
Cal Turney 1e591a35db # This is a combination of 3 commits.
# This is the 1st commit message:

HTTP: corrected request/response matching

Matching was not compliant with RFC9110 when requests were sent
in a asynchronously ordered fashion. Asynchrously (yet ordered)
requests and replies were matched according to LIFO rather than
FIFO. A new matching method has been implemented to handle cases
where packets are missing from the capture.

# This is the commit message #2:

HTTP: Change to Ubuntu pipeline test

The Ubuntu pipeline test is failing because it is expecting
something that my MR has changed.

 This is a modification of the test file that accomodates
 the new output.

# This is the commit message #3:

HTTP: Fixed indentaion error

Fixed indentation error in the script at line 545
2024-04-05 21:37:05 +00:00
Cal Turney 4e4897423b HTTP: Incorrect request/response matching
This is a rebase with upstream master
2024-04-05 21:37:05 +00:00
Cal Turney 4f8343feb7 HTTP: Change to TestDecryptTLS.test_tls13_rfc8446
The HTTP change in this MR changes the output of the Ubuntu
pipeline test. This commit hopefully fixes  that error.
2024-04-05 21:37:05 +00:00
Cal Turney 447023d544 HTTP: Fixed indentaion error
Fixed indentation error in the script at line 545
2024-04-05 21:37:05 +00:00
Cal Turney 18a1e3294f HTTP: Change to Ubuntu pipeline test
The Ubuntu pipeline test is failing because it is expecting
something that my MR has changed.

 This is a modification of the test file that accomodates
 the new output.
2024-04-05 21:37:05 +00:00
Cal Turney 49b3fb60b2 HTTP: Incorrect request/response matching
This has been corrected using wmem_map() fucnctions.
The full method is in the comments.

HTTP: removed unused function declaration

HTTP: Ranges are used to match reqs/resps

This does NOT fix incorrect URI matching in asynchronously ordered
GETS with a status of 206.

HTTP: Request-response matching corrected

/*
*  Unlike protocols such as NFS and SMB, the HTTP protocol (RFC 9110) does not
*  provide an identifier with which to match requests and responses. Instead,
*  matching is solely based upon the order in which responses are received.
*  HTTP I/O is asynchronously ordered such that, for example, the first of four
*  GET responses is matched with the first outstanding request, the next
*  response with the second oldest outstanding request and so on (FIFO).
*  The previous method instead matched responses with the last of several
*  async requests rather than the first (LIFO), and did not handle requests
*  with no responses such as the case where one or more HTTP packets were
*  not captured. Whenever there were multiple outstanding requests, the SRT
*  (RTT) stats were incorrect, in some cases massively so.
*
*  While RFC 9110 expressly prohibits matching via byte ranges because, among
*  other things, the server may return fewer bytes than requested, the first
*  number of the range does not change. Unlike HTTP implementations, Wireshark
*  has the problem of requests/responses missing from the capture file.
*  In such cases resumption of correct matching was virtually impossible and
*  all matching was incorrect from that point on.
*
*  The method of matching used herein is able to recover from packet loss,
*  any nummber of missing frames, and duplicate range requests. The
*  method used is explaned within the comments.

HTTP: Fixed no resp_in

When a GET request has a range and the response does not,
"Response in" was not being displayed in the request.although
that frame number was available.

HTTP: Fixed error in last commit

HTTP: corrected request/response

Matching was not compliant with RFC9110 when requests were sent
asynchronously ordered fashion. A new matching method has been
added to handle cases where packets are missing from the capture.

HTTP: correct req/resp matching without comments

This is the same code with the commented out code removed.

HTTP: Fix request/reply matching

When asynchrously (yet ordered) requests and replies were matched
according to LIFO rather than FIFO. Next and previous request
and response has been eliminated because there is no use case for
them and they bloat the Packet Detail.

HTTP: Fix request/reply matching

Fixed clang errors
2024-04-05 21:37:05 +00:00
Cal Turney 84c0e00130 HTTP: Fix request/reply matching
Fixed clang errors
2024-04-05 21:37:05 +00:00
Cal Turney 4751c4a9da HTTP: Fix request/reply matching
When asynchrously (yet ordered) requests and replies were matched
according to LIFO rather than FIFO. Next and previous request
and response has been eliminated because there is no use case for
them and they bloat the Packet Detail.
2024-04-05 21:37:05 +00:00
Cal Turney 40f57684d9 HTTP: correct req/resp matching without comments
This is the same code with the commented out code removed.
2024-04-05 21:37:05 +00:00
Cal Turney f97a8a5b58 HTTP: corrected request/response
Matching was not compliant with RFC9110 when requests were sent
asynchronously ordered fashion. A new matching method has been
added to handle cases where packets are missing from the capture.
2024-04-05 21:37:05 +00:00
Cal Turney 437fd1dacd HTTP: Fixed error in last commit 2024-04-05 21:37:05 +00:00
Cal Turney 2670533eb5 HTTP: Fixed incorrect request/response matching
Matching of requests and responses were being done using LIFO rather than
FIFO.

The method of matching used in this change is able to recover from packet
loss, any nummber of missing frames, and duplicate range requests. The
method is explained within the comments.
2024-04-05 21:37:05 +00:00
Cal Turney 211c3034e7 HTTP: Request-response matching corrected
/*
*  Unlike protocols such as NFS and SMB, the HTTP protocol (RFC 9110) does not
*  provide an identifier with which to match requests and responses. Instead,
*  matching is solely based upon the order in which responses are received.
*  HTTP I/O is asynchronously ordered such that, for example, the first of four
*  GET responses is matched with the first outstanding request, the next
*  response with the second oldest outstanding request and so on (FIFO).
*  The previous method instead matched responses with the last of several
*  async requests rather than the first (LIFO), and did not handle requests
*  with no responses such as the case where one or more HTTP packets were
*  not captured. Whenever there were multiple outstanding requests, the SRT
*  (RTT) stats were incorrect, in some cases massively so.
*
*  While RFC 9110 expressly prohibits matching via byte ranges because, among
*  other things, the server may return fewer bytes than requested, the first
*  number of the range does not change. Unlike HTTP implementations, Wireshark
*  has the problem of requests/responses missing from the capture file.
*  In such cases resumption of correct matching was virtually impossible and
*  all matching was incorrect from that point on.
*
*  The method of matching used herein is able to recover from packet loss,
*  any nummber of missing frames, and duplicate range requests. The
*  method used is explaned within the comments.
2024-04-05 21:37:05 +00:00
Cal Turney bf57ada43f HTTP: Ranges are used to match reqs/resps
This does NOT fix incorrect URI matching in asynchronously ordered
GETS with a status of 206.
2024-04-05 21:37:05 +00:00
Cal Turney 6649fa88c1 HTTP: removed unused function declaration 2024-04-05 21:37:05 +00:00
Cal Turney 33ab83081d HTTP: Incorrect request/response matching
This has been corrected using wmem_map() fucnctions.
The full method is in the comments.
2024-04-05 21:37:05 +00:00
Stig Bjørlykke 24307ccdbe wslua: Add missing @since tag
DissectorTable.heuristic_new() was added to 4.2.0.
2024-04-05 21:29:41 +00:00
Guy Harris f650b22bb4 busmaster: update a URL to HTTPS.
[skip ci]
2024-04-05 14:23:26 -07:00
Stig Bjørlykke d17e3a2842 wslua: Improve documentation
Rename `desc` and `descr` to description in the documentation to
make the name more self explaining.

Added and fixed some @since tags.
2024-04-05 15:44:37 +02:00
John Thacker f3e4237af7 Qt: Expand on a comment
Expand on a comment about the issues, apparently now solved,
with nested event loops and processEvents.

[skip ci]
2024-04-05 13:21:35 +00:00
Pascal Quantin d6d6053716 LTE RRC: upgrade dissector to v17.8.0 2024-04-05 12:51:26 +00:00
Pascal Quantin 475661b597 F1AP: upgrade dissector to v17.8.0 2024-04-05 13:57:44 +02:00
John Thacker 07f68d0d15 http: Initialize a variable
Initialize len if it's going to be used in the return.
In certain cases we don't enter the loop and call
dissectr_http_message at all.

Fixup 76879a480a

Fix #19739
2024-04-05 11:08:28 +00:00
Darius Davis cc4f989805 Telnet: vSPC: Track the "vMotion conversation".
Fully dissect the VMOTION-PEER message, even in a one-pass dissection or when
the VMOTION-PEER-OK message was not captured.  This requires that we correlate
this Telnet conversation with the earlier one carrying the VMOTION-GOAHEAD
message, and extracting the length of the sequence number from there.
2024-04-05 11:07:05 +00:00
Darius Davis ca4f217083 conversation: Add support for a "blob" conversation-element type.
The new CE_BLOB is similar to CE_STRING, but can include zeros within its
value, is not NUL-terminated, and -- because it likely isn't printable text --
is displayed as hexadecimal.
2024-04-05 11:07:05 +00:00
Darius Davis d63bac4d77 Telnet: vSPC: Dissect "sequence" and "secret" in easy cases.
For a VMOTION-GOAHEAD message, it is likely that we can use an earlier message
in the same conversation to determine the length of the "sequence" field,
allowing us to fully dissect that message.  In a two-pass analysis, even the
length from the VMOTION-PEER-OK message allows for dissection of the preceding
VMOTION-PEER message.

For decoding the VMOTION-PEER message in one pass, it's going to require a bit
more work -- i.e. tracking the "vMotion conversation" across the two Telnet
conversations.
2024-04-05 11:07:05 +00:00
Stig Bjørlykke d6bc7d969d wslua: Add integer atttribute setter/getter macros
Use Lua Integer instead of Number for integer values to get the
correct type. This is needed when using Lua 5.3 and 5.4.
2024-04-05 11:05:27 +00:00
Darius Davis 0cbdec7f71 fix: Migrate packet-fix.h changes back to source files.
Changes were made to the generated packet-fix.h without making corresponding
changes to the underlying source material and scripts.

e0300eae: Changed "SYTLE" -> "STYLE", "CORRESPONDANT" -> "CORRESPONDENT"
5cd53414: Change the list terminator to "{ 0, NULL }"

Note that we have already made some modifications to the source .xml files
(in, for example, 23eac7dc and 78c05162), so I don't feel any qualms about
modifying them further here.

With these changes, the generated packet-fix.h is once again byte-for-byte
identical to the one in the repository.
2024-04-05 11:04:42 +00:00
Pascal Quantin 410b435fd7 E1AP: upgrade dissector to v17.8.0 2024-04-05 12:19:29 +02:00
Pascal Quantin 4fd6630d9b XnAP: upgrade dissector to v17.8.0 2024-04-05 09:58:35 +00:00
Stig Bjørlykke c84115f881 wslua: Add ProtoField attributes
Add read only ProtoField attributes for type, abbr, name, base,
valuestring, mask and desc.

This can be used for generic Lua field handling.
2024-04-05 09:20:12 +00:00
Stig Bjørlykke c48b750be9 wslua: Fix type conversion macro names
Change the name of type conversion macros after the convert
to C99 types.

Ping #19116
2024-04-05 09:17:58 +00:00
Darius Davis 600d66f1ac MSWSP: const-ify "GuidPropertySet".
There is no need for GuidPropertySet to be modifiable.  const-ifying it moves
about 8 kBytes of data to a read-only section.
2024-04-05 09:12:44 +00:00
John Thacker dc03f8790c IO Graph: Use a larger maximum index size
Switch from an int to an int64_t for the index size (where -1
is failure) for get_io_graph_index.

This allows more room to switch to a small minimum interval
(#13682) without overflow causing unexpected results (i.e.
packet much later in time mapping back to an earlier index.)
2024-04-05 09:11:19 +00:00
John Thacker fc77bd3ee9 Qt: Enable min/max button on GeometryStateDialogs by default
GeometryStateDialog is used when we want to remember user-set
geometry for a window. If we want the user to be able to control
the geometry, we probably want to allow minimization and maximization.

Pass Qt::Window as the default WindowFlag to GeometryStateDialog
(which is what WiresharkDialogs already do). This on most platforms
defaults to adding minimize and maximize buttons. (On some platforms,
like recent GNOME, we're at the mercy of various settings like

gsettings get org.gnome.desktop.wm.preferences button-layout

but the user can access minimize and maximize actions via right-clicking
the window title bar. Unfortunately it won't stop user confusion.)

Fix #18980. Part of #12566.
2024-04-05 09:10:13 +00:00
Alexis La Goutte 0a636a636c QUIC: Remove support of old draft-deconnick-quic-multipath 2024-04-05 09:08:28 +00:00
Darius Davis 9de88ef317 fix: Use bsearch for tag lookup.
Eliminate another manually-coded binary search routine in favor of letting the
bsearch library function do the work for us.
2024-04-05 13:22:23 +10:00