Change NESN/SN check to detect retransmit pr. connection.
Frames with same SN in one direction is retransmit.
Ignore retransmit frames when doing reassembly (btle and l2cap).
Also ignore frames with incorrect CRC when doing reassembly.
This fix is related to g95e09a60.
Change-Id: I6386b42758ec3abada07ec1964d3e1b7ba7400e4
Reviewed-on: https://code.wireshark.org/review/23771
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Fix indent and spacing in if-statements to improve readability.
Change-Id: I3bd295d5d397e6e4b211c2d6fed25ab93e14142c
Reviewed-on: https://code.wireshark.org/review/22452
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Register all reassembly tables with a central unit, allowing the
central unit to have the callback that initializes and destroys
the reassembly tables, rather than have dissectors do it individually.
Change-Id: Ic92619c06fb5ba6f1c3012f613cae14982e101d4
Reviewed-on: https://code.wireshark.org/review/19834
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
This emphasizes that there is no such thing as *the* routine to
construct a subset tvbuff; you need to choose one of
tvb_new_subset_remaining() (if you want a new tvbuff that contains
everything past a certain point in an existing tvbuff),
tvb_new_subset_length() (if you want a subset that contains everything
past a certain point, for some number of bytes, in an existing tvbuff),
and tvb_new_subset_length_caplen() (for all other cases).
Many of the calls to tvb_new_subset_length_caplen() should really be
calling one of the other routines; that's the next step. (This also
makes it easier to find the calls that need fixing.)
Change-Id: Ieb3d676d8cda535451c119487d7cd3b559221f2b
Reviewed-on: https://code.wireshark.org/review/19597
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Many proto_item_append_text calls were just adding a unit string to a field.
There's a better way to do that now.
Change-Id: Id18d5ac1ea4d8ecdc4cbe7ebaec07fbd2eab6e78
Reviewed-on: https://code.wireshark.org/review/19289
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Values in psm_data structure used in reassembly must be initialized
to zero to ensure that the reassembly logic works.
Change-Id: I47c636dde60f28a8dcd9a366664fd23019a12323
Reviewed-on: https://code.wireshark.org/review/18633
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Otherwise a string shorter than 7 characters will trigger an out of bounds access
Bug: 12825
Change-Id: I54a7909d74838dcb56583374e5753f877ff74fe2
Reviewed-on: https://code.wireshark.org/review/17826
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Have all dissector tables have a "supports Decode As" flag, which
defaults to FALSE, and which is set to TRUE if a register_decode_as()
refers to it.
When adding a dissector to a dissector table with a given key, only add
it for Decode As if the dissector table supports it.
For non-FT_STRING dissector tables, always check for multiple entries
for the same protocol with different dissectors, and report an error if
we found them.
This means there's no need for the creator of a dissector table to
specify whether duplicates of that sort should be allowed - we always do
the check when registering something for "Decode As" (in a non-FT_STRING
dissector table), and just don't bother registering anything for "Decode
As" if the dissector table doesn't support "Decode As", so there's no
check done for those dissector tables.
Change-Id: I4a1fdea3bddc2af27a65cfbca23edc99b26c0eed
Reviewed-on: https://code.wireshark.org/review/17402
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
The payload in L2CAP is called SDU (Service Data Unit).
Change-Id: Ie18c6ef4a68f44a4099db518c50f6f9774470476
Reviewed-on: https://code.wireshark.org/review/16983
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This will make it easier to determine protocol dependencies.
Some LLC OUI dissector tables didn't have an associated protocol, so they were left without one (-1 used)
Change-Id: I6339f16476510ef3f393d6fb5d8946419bfb4b7d
Reviewed-on: https://code.wireshark.org/review/14446
Reviewed-by: Michael Mann <mmann78@netscape.net>
It's not tied to the frame_data structure any more, so it belongs by
itself.
Clean up some #includes while we're at it; in particular, frame_data.h
doesn't use anything related to tvbuffs, so don't have it gratuitiously
include tvbuff.h.
Change-Id: Ic32922d4a3840bac47007c5d4c546b8842245e0c
Reviewed-on: https://code.wireshark.org/review/13518
Reviewed-by: Guy Harris <guy@alum.mit.edu>
That removes most of the uses of the frame number field in the
frame_data structure.
Change-Id: Ie22e4533e87f8360d7c0a61ca6ffb796cc233f22
Reviewed-on: https://code.wireshark.org/review/13509
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Add TDS and OTS/OTP UUID, OTS PSM (I cannot find it, but
it seems to be linear), update CompanyIds and add three
EIR/AD codes: URI, Indoor Positioning and Transport Discovery Data.
Implementation of new "numbers" will be done later.
Change-Id: I8ad4d9c1d55c1824d87e88303c28e67dd445ec98
Reviewed-on: https://code.wireshark.org/review/13386
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Change-Id: Ie39ef054a4a942687bd079f3a4d8c2cc55d5f22c
Reviewed-on: https://code.wireshark.org/review/12485
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
ACL and L2CAP payload contain its length field.
Of course it may be broken for many reasons, so
there is need to check it and show expert info warning.
Bug: 11677
Change-Id: I1988faec9faef70c95161513049ec16ceb8fcf45
Reviewed-on: https://code.wireshark.org/review/11982
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Add Connect in frame/Disconnect in frame jump-fields or Service/PSM
is possible to know what current channel payload is.
Change-Id: I6a06baaec50c5e54a1990ec8f29cf386910acc28
Reviewed-on: https://code.wireshark.org/review/11977
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
The target here is the Decode As dialog where protocols have multiple registrations into a dissector table and that shows up as multiple entries in the Decode As dialog list with the same name so users are unsure which "dissector" they are choosing.
The "default" behavior (done in this commit) is to not allow duplicates for a dissector table, whether its part of Decode As or not. It's just ENFORCED for Decode As.
Bug: 3949
Change-Id: Ibe14fa61aaeca0881f9cc39b78799e314b5e8127
Reviewed-on: https://code.wireshark.org/review/11405
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Try to fix
packet-btl2cap.c: In function 'btl2cap_cid_value':
packet-btl2cap.c:425: warning: cast to pointer from integer of different size
packet-btl2cap.c: In function 'btl2cap_psm_value':
packet-btl2cap.c:448: warning: cast to pointer from integer of different size
packet-btrfcomm.c: In function 'btrfcomm_directed_channel_value':
packet-btrfcomm.c:287: warning: cast to pointer from integer of different size
packet-btobex.c: In function 'btobex_profile_value':
packet-btobex.c:1134: warning: cast to pointer from integer of different size
on the 32-bit OS X builder.
Change-Id: Ieb2fe6c31fdad0cf776c24bada7a6a83e8aa91ec
Reviewed-on: https://code.wireshark.org/review/9915
Reviewed-by: Gerald Combs <gerald@wireshark.org>
packet-btobex.c(1134): error C2220: warning treated as error - no 'object' file generated
packet-btobex.c(1134): warning C4312: 'type cast': conversion from 'gulong' to ' gpointer' of greater size
packet-btatt.c(1420): error C2220: warning treated as error - no 'object' file generated
packet-btatt.c(1420): warning C4312: 'type cast': conversion from 'gulong' to 'gpointer' of greater size
packet-btatt.c(1443): warning C4312: 'type cast': conversion from 'gulong' to 'gpointer' of greater size
packet-btl2cap.c(425): error C2220: warning treated as error - no 'object' file generated
packet-btl2cap.c(425): warning C4312: 'type cast': conversion from 'gulong' to 'gpointer' of greater size
packet-btl2cap.c(448): warning C4312: 'type cast': conversion from 'gulong' to 'gpointer' of greater size
packet-btrfcomm.c(287): error C2220: warning treated as error - no 'object' file generated
packet-btrfcomm.c(287): warning C4312: 'type cast': conversion from 'gulong' to 'gpointer' of greater size
Change-Id: Ie5b4fd1c47725b966f9b98d9480c1858b553efff
Reviewed-on: https://code.wireshark.org/review/9894
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Michal Labedzki <michal.labedzki@tieto.com>
code to what failed on the RC version *sigh*
Change-Id: I1b7f6d57da4cb71473a074291da7e5a0d5242c95
Reviewed-on: https://code.wireshark.org/review/9874
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Replace L2CAP Service, RFCOMM Service and AVCTP PID dissector table
by shared Bluetooth Service UUID table. It also supports UUID16,
UUID32 and UUID128 by hex-string, like for AVRCP: "110e".
Change-Id: I473bc73d10939e8ed6dd55a6a92387c7a1ec125a
Reviewed-on: https://code.wireshark.org/review/9678
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
This reverts commit 8d78077d0d.
Reverted as requested.
Change-Id: I99461820d28215a52cc6bae6792f2892018d28b8
Reviewed-on: https://code.wireshark.org/review/9609
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add ability to jumps to connect or disconnect frame from any frame
binded to specific PSM session, what should improves analyse by user.
Change-Id: Icdf6634bf128ba83721d39cf8986cf16bfb4e7a4
Reviewed-on: https://code.wireshark.org/review/7470
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Also start decoding next two profile attribute groups in SDP
(MPS and CTN) and add new two fields in EIR/AD.
Change-Id: I4dc13df2b3b13e8c2a2a5c4af2cabae9ee83d539
Reviewed-on: https://code.wireshark.org/review/6409
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Specifically:
- Set packet.h to be the first wireshark #include after
config.h and "system" #includes.
packet.h added as an #include in some cases when missing.
- Remove some #includes included (directly/indirectly) in
packet.h. E.g., glib.h.
(Done only for those files including packet.h).
- As needed, move "system" #includes to be after config.h and
before wireshark #includes.
- Rework various #include file specifications for consistency.
- Misc.
Change-Id: Ifaa1a14b50b69fbad38ea4838a49dfe595c54c95
Reviewed-on: https://code.wireshark.org/review/5923
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Bluetooth dissector is used to add ability to filter all bluetooth
payload from capture files (there are many transport like:
hci_h4, hci_h1, hci_usb, hci_mon, btle). Also it is used to placeholder for
all data tree used to store additional informations like bd_addrs, names, etc.
Finally it is used to be one point for Bluetooth
Endpoints/Conversation filtering what is enabled now.
Also add Master/Slave Role and Connection Mode tracking.
Change-Id: I67048080fb8ee16fa0f4ec429c1257de81ddd737
Reviewed-on: https://code.wireshark.org/review/5771
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
On every configuration request clean options before setting anything.
Then if configuration will be rejected options will not be set to
something that is not set in next configure request.
Change-Id: I5acedde96f7ff720e916256d683937acbcd13a48
Reviewed-on: https://code.wireshark.org/review/3765
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
There are two cases:
1. btl2cap -> btrfcomm -> btobex
2. btl2cap -> btobex
Case 2 is rare, so according to its name and to avoid confusion
I based on it.
Bug:10316
Change-Id: Ibeabeaf2f8376425460c56bad8fb980b460dd940
Reviewed-on: https://code.wireshark.org/review/3225
Reviewed-by: Evan Huus <eapache@gmail.com>
Some interfaces support multiple Bluetooth adapters with events like
add/remove. We must support that to distinquish adapters streams
in case that new adapter has the same id that old one.
Next one is create session for "Connection Handle", so
next layer will now when it is connected and disconnected.
This is also used to distinguish streams.
Change-Id: I9e062c8e4cc9c033b75f1a596e8351a215169843
Reviewed-on: https://code.wireshark.org/review/2548
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Session should be finished too on HCI Disconnect and Adapter disappear.
Change-Id: I0823872e60ec932fc0831975e54dc33d49fb5dbc
Reviewed-on: https://code.wireshark.org/review/1882
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Fix warnings and try to inform user about unknown values in
"Decode As".
Also use define instead of magic number for Unknown L2CAP CIDs.
Change-Id: Ie6f26a9e3330b84cef14bbf8861ffbdbdb789225
Reviewed-on: https://code.wireshark.org/review/1880
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Michal Labedzki <michal.labedzki@tieto.com>
Example: if there is Connection Request than field with CID always
is called SCID. If we Sent this packet, it is okay, but if we Receive
it, then it is not SCID for us, but DCID. If we receive
Connection Request (DCID) and than we want to make disconnection,
so we send Disconnection Request with DCID that is SCID in
Connection Request... etc.
I try to clarify this, so rename stored SCID to Local CID
and DCID to Remote CID.
Change-Id: Idde0939a03955d8f4a10d8c9f7c43fd364254460
Reviewed-on: https://code.wireshark.org/review/1879
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
To correctly resolve connections single "ID" value
like L2CAP PSM, is not enough, because next connection may use
the same PSM value. Solution is save frame number of frame that
make disconnection.
Conclusion:
Any session key values should be updated to pair:
{ID_1, disconnect_in_frame}, {ID_2, disconnect_in_frame}...
then we should check if "disconnect_in_frame" is greater then
current frame number, otherwise it is not valid session.
Change-Id: I3d760112b6e53358a93c994f4aae455ac1bf5de6
Reviewed-on: https://code.wireshark.org/review/1878
Tested-by: Michal Labedzki <michal.labedzki@tieto.com>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
The Stream is defined here as media stream that beginning on
AVDTP Start (ResponseAccept).
Also fix recognizing Channel streams by AVDTP according to the
specification that says:
1. First channel is always Signaling.
2. Second may be Media.
3. Third may be Reporting.
4. Fourth may be Recovery.
First and second will be supported right now.
Change-Id: Id6d4dae6be1b9df68382288c2d520b7ed3661237
Reviewed-on: https://code.wireshark.org/review/1053
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
CID has two roles: Source CID and Destination CID. This two roles
have another two different meanings: one if frame is received, another if frame
is sent (SCID is "DCID", etc). Then using information that PDU is "request"
or "response" we can correctly recognize CID.
This should fix unrecognized L2CAP payload while there were no valid
Disconnection Request.
Change-Id: Ibcbbb9e6966873b6af12c1e3c65c6a3983aa4163
Reviewed-on: https://code.wireshark.org/review/807
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add some command codes seen in Core 4.1 specification.
Also add some missing fields.
Change-Id: If3761744b1ada185027a560bceb66804d7eea8ec
Reviewed-on: https://code.wireshark.org/review/806
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Source/Destination BD_ADDRs and name are filterable.
Also simplify code around wmem trees, and enable commented "data"
field in unreassembled case and fix btl2cap offsets
(discovered by enabling "data" field).
Change-Id: Ic28c9bf19bcd6281b652be538b221da74df4bb76
Reviewed-on: https://code.wireshark.org/review/471
Reviewed-by: Evan Huus <eapache@gmail.com>
Interface ID should correspond to the Wireshark Interface Id
to avoid mixing data from various interfaces in dissectors.
Change-Id: Ibaa3ddab7f0ebd0985efea74439b94a5881145a7
Reviewed-on: https://code.wireshark.org/review/472
Reviewed-by: Evan Huus <eapache@gmail.com>
Stig Bjørlykke