Both dynamic and egfx channel had problems during the second pass.
For the dynamic the problem is that the reassembled packet usually contains multiple PDUs,
so the first pass works correctly, but given that there's multiple PDUs we can't attach
a single data to pinfo for the second pass. To fix that we compute a hash for the PDU and attach
the correct contextual info associated with this hash, that info will be used during the
second pass.
The patch fixes the same kind of bug in the egfx channel and zgfx uncompressed bits (the zgfx
compression is stateful so we need to save the uncompress buffer for the second pass).
In the dynamic channel, in capabilities packets some fields are present only after version 1
of the protocol.
Added some new EGFX version capabilities (also is listed the bogus 10.6 version that was
exposed in the previous specs).
The display of versions in EGFX capability message has been reworked to correctly show
a tree.
Fix the calculation of the ratio for converting a packet number
to the scrollbar value by accounting for the length of the slider.
maximum() does not correpond to the last packet; it corresponds to
the first packet shown when the scrollbar is at maximum. The last
packet is maximum() + pageStep().
(See https://doc.qt.io/qt-6/qscrollbar.html#details)
The quarter of a page padding should be subtracted, not added,
from the calculated position.
(Fix up 422c0f45d4)
This correctly makes clicking on the a line in the minimap scroll
the packet list so that the corresponding packet is 25% of the
way down the visible window. (Excepting the cases of packets at
the very beginning or end of the entire packet list.)
Fix#13989
Use ws_utf8_truncate to ensure that truncating the result of
tvb_format_text will not split a UTF-8 character. (50 bytes
is not necessarily 50 UTF-8 characters, but 50 UTF-8 characters
don't necessarily have a visible width of 50 characters anyway.)
Fix#18831
Just because a field's value is used in the string that's hashed to
compute a JA3 or JA3S hash, that doesn't mean it should be put into a
variable named "ja3_value", as that doesn't indicate what it *is*. Use
meaningful names instead.
PacketListRecords should only report themselves as colorized when
colorized with the latest version of the coloring rules. Otherwise,
ensureRowColorized will not recolorize rows when the rules have changed.
This makes the minimap/intelligent scrollbar correctly update
colors in the background when the rules have changed. (Rows that
were being displayed were being updated, because the columnStrings
were invalidated at the same time, and when fetching the columnStrings
the colors would be updated if the rules had changed.)
Fix#17621
You're Not Supposed To Do That, as per RFC 8446 section 4.1.2 "Client
Hello".
Also do the equivalent check for DTLS, as RFC 9147 Section 5.3 "Client
Hello" says You're Not Supposed To Do The Equivalent. We don't yet
handle DTLS 1.3, but if we ever do....
Fixes#18851.
While we're at it, improve two comments to clarify what
ssl_dissect_hnd_hello_common() does (and to fix one place where the old
comment was incorrect).
Increase the proto item size so that the ethertype is selected as part
of the cisco-metadata protocol.
Signed-off-by: Gabriel Ganne <gabriel.ganne@gmail.com>
The location of the next line should be based off one row larger
than the current row.
This fixes an issue where all the lines drawn in the intelligent
scrollbar are off by one - the color intended to be drawn for
the first packet never appears, the first packet corresponds to
the line for the second packet, etc., and there is a line at
the bottom that can never be colored in.
Fix#18850
Gtker