and a couple of SET_ADDRESS()s.
Use proto_tree_add_item() instead of proto_tree_add_ether() called with a
pointer into the TVB.
Leave a comment for a place where a bunch of code in several case statements
could probably be collapsed into much less code.
svn path=/trunk/; revision=46682
- Use/create extended value strings as appropriate;
- Reformat hf[] entries;
- Do whitespace, & etc changes to use a consistent formatting style;
- Reformat some long lines;
- Localize some variables; remove some unneeded initializers;
- expert...() shouldnt be called under 'if (tree)' (packet-wimaxasncp);
- Move proto_register...() & etc to the end of the file (packet-ieee80211);
- Misc.
svn path=/trunk/; revision=46489
are like the non-TVB versions except that they take a TVB and an offset
instead of (frequently) a pointer into the TVB.
Calling tvb_get_ptr() before modifying the rest of the fields should help fix
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7960 (though I can't
reproduce that problem).
Replace a bunch of calls like:
SET_ADDRESS(..., AT_XXX, length, tvb_get_ptr(tvb, offset, length));
with:
TVB_SET_ADDRESS(..., AT_XXX, tvb, offset, length);
svn path=/trunk/; revision=46324
There are a handful of fields in the IEEE802.11 dissector that are comprised of
a 16-bit value. The hf array for these fields has the necessary masks to
correctly parse a 16-bit value, yet some of the fields were being added as 1
byte. This patch corrects these fields with a proto_tree_add_item approach
(instead of proto_tree_add_[uint|boolean]).
svn path=/trunk/; revision=45828
The changes fix definite problems or
are done "just in case" for cases not esily determined
to be a problem by quick inspection.
Note: in some cases for loop index variables have been renamed
to ensure all required codes changes detected.
##backport
svn path=/trunk/; revision=45477
wlan_mgt.ht.capabilities bits 8-15 incorrectly decoded (from wrong packet offset)
The bug is that the code defines the bit fields as 16 bit, but increments the
offset in-between decoding B0-B7 and B8-B15 which causes the wrong bits to be
decoded.
Also fix to change "Capability" to "Capabilities" to match spec
From me : Fix wrong length for A-MPDU
svn path=/trunk/; revision=45431
The reassembled fragments tree in the Packet Details view is awesome, but it
lacks one thing: a field that exposes the reassembled data.
tcp.data already exists for exposing a single TCP segment's payload as a byte
array. It would be handy to have something similar for a single application
layer PDU when TCP segment reassembly is involved. I propose
tcp.reassembled.data, named and placed after the already existing field
tcp.reassembled.length.
My primary use case for this feature is outputting tcp.reassembled.data with
tshark for further processing with a script.
The attached patch implements this very feature. Because the reassembled
fragment tree code is general purpose, i.e. not specific to just TCP, any
dissector that relies upon it can add a similar field very cheaply. In that
vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which
expose reassembled fragment data as a single byte stream for IPv4 and IPv6,
respectively. All other protocols that use the reassembly code have been left
alone, other than inserting NULL into their initializer lists for the newly
introduced struct field reassemble.h:fragment_items.hf_reassembled_data.
svn path=/trunk/; revision=44802
TKIP dissection : wrong IS_TKIP macro
In [1] "11.4.2.2 TKIP MPDU formats", we could see below sentence.
"WEPSeed[1] is not used to construct the TSC, but is set to (TSC1 | 0x20) &
0x7f."
But the IS_TKIP macro only checks (WEPSeed[1] & 0x20).
So sometimes IS_TKIP macro mis-dissects a CCMP frame as a TKIP frame.
This patch changes IS_TKIP macro to do more better check.
[1] IEEE Std 802.11.-2012
#BACKPORT(1.8, 1.6)
svn path=/trunk/; revision=44790
Also (for a few files):
- create/use some extended value strings;
- remove unneeded #include files;
- remove unneeded variable initialization;
- re-order fcns slightly so prefs_reg_handoff...() at end, etc
svn path=/trunk/; revision=44438
it as appropriate in the code to read Network Instruments Observer
captures (rather than tweaking the "protected" flag in the packet data),
and use that flag in the 802.11 dissector.
Fix indentation while we're at it (tabs are not *ipso facto* 4 spaces).
svn path=/trunk/; revision=43795
implicitly by the #define name and string they were defined to; not all
UATs neatly fit into any of the categories, so some of them were put
into categories that weren't obviously correct for them, and one - the
display filter macro UAT - wasn't put into any category at all (which
caused crashes when editing them, as the GUI code that handled UAT
changes from a dialog assumed the category field was non-null).
The category was, in practice, used only to decide, in the
aforementioned GUI code, whether the packet summary pane needed to be
updated or not. It also offered no option of "don't update the packet
summary pane *and* don't redissect anything", which is what would be
appropriate for the display filter macro UAT.
Replace the category with a set of fields indicating what the UAT
affects; we currently offer "dissection", which applies to most UATs
(any UAT in libwireshark presumably affects dissection at a minimum) and
"the set of named fields that exist". Changing any UAT that affects
dissection requires a redissection; changing any UAT that affects the
set of named fields that exist requires a redissection *and* rebuilding
the packet summary pane.
Perhaps we also need "filtering", so that if you change a display filter
macro, we re-filter, in case the display is currently filtered with a
display filter that uses a macro that changed.
svn path=/trunk/; revision=43603
Wireshark > 1.4 does not correctly read Association ID for PS Poll packets
Wireless Frame with subtype 0x1a don't interpret the Association ID (always 0).
Fix :
proto_tree_add_uint() wasn't changed to proto_tree_add_item()
#BACKPORT
svn path=/trunk/; revision=43556
Look before we loop
Check the value of various key count parameters against the size of their
parent tag *before* we start looping on them.
Stick an expert error on the field and bound the loop at a sane point if the
count is bogus.
svn path=/trunk/; revision=42631
Add wlan.ra field value to wlan.addr
The (hidden) field wlan.addr==xx:xx:xx:xx:xx:xx currently matches wlan.da,
wlan.bssid, wlan.sa and wlan.da fields but not wlan.ra field.
svn path=/trunk/; revision=42597
802.11s Decoding Bug (Mesh Control Field)
Wrong offset use to dissector Mesh Extended Address(bug from the revision 39314)
svn path=/trunk/; revision=42105
registered OUIs from manuf and allow custom dissectors for
Organizationally Specific TLVs. Fixes bug 7080.
Use uint_get_manuf_name() and uint_get_manuf_name_if_known(), rather
than tvb_get_manuf_name() and tvb_get_manuf_name_if_known(), in cases
where we've fetched the OUI.
Have the ECP/VDP dissector also display registered OUIs from manuf.
Get rid of the OUI_CISCO_2 OUI from tlv_oui_subtype_vals, as that can
come from the manuf file. Leave in comments explaining why, for now, we
aren't using the manuf file for *all* the OUIs.
svn path=/trunk/; revision=42055
