Commit Graph

90389 Commits

Author SHA1 Message Date
Jeff Layton 4508a77bbc NFS: add support for dissecting GET_DIR_DELEGATION operations
Add support for dissecting the NFSv4.1 GET_DIR_DELEGATION operation:

    https://www.rfc-editor.org/rfc/rfc8881.html#name-operation-46-get_dir_delega

Change-Id: I05c722db2178488eceb86960b7e87f2ac8268469
Signed-off-by: Jeff Layton <jlayton@kernel.org>
2024-02-11 16:22:23 +00:00
Jeff Layton 55c75998ce NFS: rename the "notification" fields in the dissector
The notifications that were added are for pNFS deviceid's, which
generally have a name in the spec like "notify_deviceid_type4". The
generic "notify" name is used for the directory change notifications.

Rename the old deviceid notifier functions and variables to a more
appropriate name.

Change-Id: Ibf80a41c7e2369bdd8ce669265cd549772a56338
Signed-off-by: Jeff Layton <jlayton@kernel.org>
2024-02-11 16:22:23 +00:00
John Thacker 41930060b0 prefs: Use column index, not format, for hidden state
Obsolete the existing column hidden preference, and use the
column index instead of the format for remembering the hidden
state.

Fix #15529
2024-02-11 09:47:58 +00:00
John Thacker b9c2ffd180 column: Split custom column formats from the right
Instead of using g_strsplit, split the custom column format string
from the right. The ocurrence and "show resolved" tokens appear at
the end, but there could be a ':' internal to the filter, if we
later update what custom column filter strings are allowed in
order to support slices.

Necessary (but not sufficent) for #10154
2024-02-11 09:47:21 +00:00
Gerald Combs 9fbff8d554 Qt: Stats tree dialog speedup
Don't resize our columns every packet.
2024-02-11 09:46:24 +00:00
John Thacker 938192ca9c TCP: Fix location of Timestamp Option values
When syn cookie support was added, a new tree was added under
the TCP timestamp option TSVal. Unfortunately, it was done
so by reusing the proto_item pointer that was pointing to the
tree item for the top level of the option, before it was done
having text appended to it.

Add a new proto_item pointer so that the text gets appended
to the original place.

Fixup acc0260c84
2024-02-11 09:45:28 +00:00
Gerald Combs 93c79e2bfd [Automatic update for 2024-02-11]
Update manuf, services enterprise numbers, translations, and other items.
2024-02-11 09:43:24 +00:00
Guy Harris 8f670352df blf: if there are no log containers, return FALSE when pulling one.
blf_pull_next_logcontainer() shuld check, aftre calling
blf_find_next_logcontainer() to see if the size of the
GArray of log containers is 0; if so, that means no log container was
found, probably because there aren't any to find.

This fixes a case where attempting to read a file with no log containers
causes a crash.
2024-02-10 19:31:24 -08:00
Guy Harris e5c519ba45 socketcan: provide more information in the Info column for CAN XL.
Put the priority and VCID into the Info column - and the top-level
protocol item.

And, again, don't fetch values in advance and set the Info column and
top-level protocol item text early.  Instead, add each field to the Info
column and top-level protocol item when we add the field to the protocol
tree, so that if the frame is cut short, we dissect as much of it as we
can and put as much of it as we can into the Info column and top-level
protocol item.
2024-02-10 18:21:51 -08:00
Guy Harris 825f27723c socketcan: append text only after putting the value into the tree.
Don't fetch values in advance and set the Info column and top-level
protocol item text early.  Instead, add each field to the Info column
and top-level protocol item when we add the field to the protocol tree,
so that if the frame is cut short, we dissect as much of it as we can
and put as much of it as we can into the Info column and top-level
protocol item.
2024-02-10 17:47:52 -08:00
John Thacker 214a744bb7 dfilter: Return the register containing fvalues
When generating DVFM code, tell the return function what
register has the final set of fvalues for filters that are
functions, arithmetic, or slices (that is, that compare one
or more fvalues to see if they are all zero.) Make sure
that these functions return an empty ptr array, unlike
tests that return a null ptr array.

For fields, we could return the fvalues, but currently we
don't bother loading the fvalues into registers since display
filters that just have a field test existence, so the generated
code would have to change. It's also a little more complicated
because there can be multiple fields that have different types
(sometimes not commensurable, which is an error noted by some of
the checks.) The logic in custom columns handles the field cases
currently.
2024-02-10 19:44:04 -05:00
Guy Harris b96747823d socketcan: show more unsigned values with %u. 2024-02-10 15:49:12 -08:00
Guy Harris c713f7260a socketcan: show all relevant digits in Info column and top-level item.
Show all 8 hex digits for extended IDs, show all 3 hex digits for
standard IDs.

Also, show the length with %u, not %d, as it's unsigned (it won't be
bigger than 2^32-1, so that doesn't affect the output, but it's a better
type match.
2024-02-10 15:12:59 -08:00
Guy Harris 7d6f2b182b socketcan: clean up some variable names.
The "flags" field in CAN classic and CAN FD is relly a "flags and ID"
field; rename appropriatey.

Rename can_..._flags_id_fd fields to canfd_..._flags_id, so as not to
mix up "flags_id" and "fd" - the latter refers to CAN FD, the former
refers to the two values in the item.
2024-02-10 14:45:11 -08:00
Guy Harris 2c40e6c903 socketcan: add a CAN XL SDU type subdissector table.
Allow subdissectors to register for particular CAN XL SDU types, e.g.
some Ethernet dissector (which one - the "always with FCS" one or the
"never with FCS done" - would depends on whether the FCS is included in
the tunneled frame; lacking access to the spec, I don't know which is
the case) would register in that table with the two tunneling types.

Provide SDU type #defines in packet-socketcan.h.
2024-02-10 12:10:04 -08:00
Martin Mathieson bb495a512c SOCKETCAN: Fix a couple of spellings and use XL length field 2024-02-10 19:54:20 +00:00
John Thacker f2fae54a58 recent: Don't use format info at all
We don't need to read or use the column format string in
the recent settings column width info, because now they're
in sync with the indices used in prefs.col_list.

Continue to write it when writing out the recent settings for
backwards compatibility with older version.

We can also remove the workaround for #14177 from
commit c62dadd31f as it's
not needed.

This solves the width and alignment part of #15529. Hidden
states are still to do.
2024-02-10 17:10:39 +00:00
Martin Mathieson 07b8a53361 Add & use tfs_should_be_traced_should_not_be_traced 2024-02-10 13:34:14 +00:00
Darius Davis 4aa91006d0 GTP: const-ify some big data structures.
This moves about 76 kBytes of data to a read-only section.
2024-02-10 13:18:09 +00:00
Guy Harris 9989fd2830 Add Stack Overflow links for showing file in folder.
Those links are to questions with  answers that indicate how to show a
folder window with a particular file selected using system APIs rather
than firing up programs.
2024-02-09 18:41:21 -08:00
Gerald Combs 319101f544 Falco bridge: Make sure our strings are UTF-8 2024-02-09 17:46:40 -08:00
Gerald Combs 5e10272450 Falco bridge: Add container I/O stats 2024-02-09 13:59:46 -08:00
Gerald Combs 57a1be8873 Falco bridge: Skip some more syscall fields 2024-02-09 13:32:23 -08:00
Guy Harris 6f0c9d4f0b socketcan: work around libpcap bug, add CAN XL support.
Change the "fd" gboolean in can_info_t to a guint, and give it a value
of 2 for CAN XL.  That preserves source and binary compatiility, at
least in the case where a plugin would never be handed a CAN XL frame.
Update code to treat it as such, to make it clearer what that code is
doing.

Add CAN XL support to the SocketCAN dissector - and to the
LINKTYPE_LINUX_SLL detector.  Note that the fields in the
LINKTYPE_CAN_SOCKETCAN header for CAN XL frames are *little-endian*, as
most if not all existing captures were probably done on little-endian
machines - libpcap does that so that LINKTYPE_CAN_SOCKETCAN doesn't
become one of those annoying link-layer types with *host-endian* (as in
"the byte order of the host that last processed this file") fields
(which require special processing in pcap/pcapng file readers *and* in
rpcap clients).

If the CANFD_FDF flag isn't set, treat the frame as CAN FD if it's
exactly 72 bytes long; this works around a libpcap 1.10.{2,3,4} bug
(which should be fixed in the next libpcap release) that inadvertantly
cleared that flag for CAN FD frames.
2024-02-09 11:08:08 -08:00
John Thacker 127548227e recent: Keep recent column width in sync with prefs
Keep the recent column width list in sync with the order of the
prefs.col_list by appending, inserting, and moving the recent
column width list at the same time, instead of allowing them
to get out of sync (as we use the format for a key.)

Fix an issue where column_prefs_add_custom did not always return
the position of the column added (when a column number was passed
in that was less than the maximum number of columns.)

Preparation for the width and alignment part of #15529
2024-02-09 09:53:52 -05:00
John Thacker 2574d5b9c6 Qt: Add width and alignment to column preferences
Add the ability to change the width and alignment of columns
from the Column Preferences.

This also makes it easier to eventually fix #15529 by having all
the column-relevant details edited at once. In order to properly
solve that issue, the column indices from the preferences and the
recent settings need to be kept in sync, instead of using the format
as the unique key.

Related to #15529
2024-02-09 06:51:27 -05:00
Gerald Combs eebe0a38be Qt: Fix the FilterExpressionToolBar context menu position
When we open a FilterExpressionToolBar menu and right click on it, make
sure we open our context menu using coordinates relative to the toolbar.
2024-02-08 18:21:34 -08:00
Gerald Combs d3c837f6e0 Falco bridge: Fix a couple of integer casts 2024-02-08 13:17:21 -08:00
Gerald Combs 4ec1ae4523 wsutil: Add null checks to wmem_map
Check for a valid wmem_map pointer in each of our lookup routines. This
keeps us from having to do so in various dissectors.

Fixes #19642
2024-02-08 09:50:34 -08:00
Sergio de Paula e967a3ecc3 Fixed Zigbee NWK GP dissector heuristics
Heuristics should not filter out packets that have destinationPAN ID != IEEE802154_BCAST_PAN, since GPD frames MAY inform PAN ID - GPD spec v1.1.1 section A.1.7.1.2 MAC addressing fields
2024-02-08 07:54:18 +00:00
Jan Wiesemann cd33794373 Fix: formatting 2024-02-08 07:36:49 +00:00
Jan Wiesemann 9b36918071 Qt: added preference for hiding 'Welcom page' -> 'Open'
This commit adds a additional preference to hide the 'Open' (recently opened
files) section on the welcome page.
2024-02-08 07:36:49 +00:00
Darius Davis b571c553b4 DCM: const-ify some big data structures.
The DCM tag/status/uid lookup tables are only ever read.  const-ifying them
moves about 220 kBytes of data to a read-only data section.

packet-dcm.h was regenerated using the make-packet-dcm.py script.
2024-02-08 13:22:22 +10:00
Darius Davis c0c2cac89e DCM: Update from 2021b release to 2024a.
The Well-Known Frames of Reference data have moved to Table A-2, so the script
is updated to integrate the data from that table into the UID list.

Ran "tools/make-packet-dcm.py > epan/dissectors/packet-dcm.h".
2024-02-08 03:00:59 +00:00
Darius Davis 3f69f2a0f8 Tools: Expand licence-check horizon to 160 lines.
MR !14295 ran into trouble with the license checker because three added lines
in tools/make-packet-dcm.py moved the important piece of text outside the
150-line window in which it was checking.

This change maintains the status quo by expanding the window to 160 lines.
2024-02-08 11:35:36 +10:00
Gerald Combs 1d16a8fb89 Frame: Use "System Event"
Use "System Event" instead of "Sysdig Event". It's more generic and
avoids duplicate top-level "Sysdig Event" tree items.
2024-02-07 16:55:09 -08:00
Gerald Combs 98ebebec80 Sysdig Event+Falco Bridge: Highlight I/O data
Pass the sysdig.param.asyncevent.data start and offset to the Falco Bridge
dissector, and use that to highlight the evt.buffer and fd fields.

Pass the data to the ELF dissector if we find an ELF magic ID.
2024-02-07 16:55:04 -08:00
Gerald Combs b7ae4f2eb7 Qt: Add null checks to the protocol tree
eab4734a0d removed actionAnalyzeDecodeAs and actionFileExportPacketBytes
from Logray.
2024-02-07 15:00:14 -08:00
Martin Mathieson b8999a383c Fix some more spelling errors 2024-02-07 21:51:34 +00:00
Joakim Karlsson 754a16258c LI5G: update column protocol and filter name
Lawful Interception (LI) is the main area and should be located first
in name, which will be more easy of use for new user when want to
filter messages
2024-02-07 10:14:38 +01:00
John Thacker 75a64a96b7 Qt: Only save the filtered rows to the Map
Be a little more careful in TrafficTab about whether we
want the Proxy Model or the Source Model, since the tap
filter doesn't exclude rows from the source model (since
the non-displayed rows are used to as part of the percentages
of the total.)

When we want to respect the display filtering or the sorting,
use the proxy model.

In the tap data model, only claim we have GeoIPData (which makes
the map available) if a row that isn't filtered out has data.

Fix #18530
2024-02-07 08:17:15 +00:00
Timo Warns 7fbff7a381 GNSS: add dissector for UBX-RXM-RAWX messages of u-blox GNSS receivers
Add dissector for UBX-RXM-RAWX messages of u-blox GNSS receivers.
2024-02-07 08:15:26 +00:00
Timo Warns 59d56d7520 Move unit string for cycles to unit_strings.h
Move unit string for cycles to unit_strings.h from packet-usb-i1d3.c to
allow for usage by other dissectors.
2024-02-07 08:15:26 +00:00
Timo Warns 5a761cf95c GNSS: use proto_tree_add_bitmask() for UBX bitmask fields
Use proto_tree_add_bitmask() for bitmask fields of UBX messages.
2024-02-07 08:15:26 +00:00
Timo Warns 54fa2250bd GNSS: replace usage of "^2" by UTF8_SUPERSCRIPT_TWO
Replace usage of "^2" by UTF8_SUPERSCRIPT_TWO in value_strings
2024-02-07 08:15:26 +00:00
Timo Warns 44bcfa9f0a GNSS: add dissector for UBX-NAV-SBAS messages
Add dissector for UBX-NAV-SBAS messages of u-blox GNSS receivers.
2024-02-07 08:15:26 +00:00
Timo Warns f1463bbd32 GNSS: Map GNSS ID in UBX-NAV-SAT SV info subtrees
Map the GNSS ID in the UBX-NAV-SAT SV info subtrees
2024-02-07 08:15:26 +00:00
Timo Warns d66973d947 GNSS: reduce ett_ubx_nav_sat_sv_info length
Reduce ett_ubx_nav_sat_sv_info length to 255 entries as a UBX-NAV-SAT
message may include 255 SV infos at most.
2024-02-07 08:15:26 +00:00
Timo Warns 48a5255a25 GNSS: make available SBAS UDREI mapping to other files
Make available SBAS UDREI mapping to other files to enable usage in
other dissectors (e.g. UBX).
2024-02-07 08:15:26 +00:00
Timo Warns c3305a4bd1 GNSS: add dissector for UBX-NAV-TIMEUTC messages
Add dissector for UBX-NAV-TIMEUTC messages of u-blox GNSS receivers.
2024-02-07 08:15:26 +00:00