Commit Graph

57058 Commits

Author SHA1 Message Date
Bill Meier 9c866ff971 Replace tabs by spaces when editor modelines has "expandtab"
Change-Id: If7a6f2697be732ae4f94ed8b845fd293c32510f7
Also: tabs-stops should be 8
Reviewed-on: https://code.wireshark.org/review/7100
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2015-02-13 17:34:53 +00:00
Gerald Combs 936f685af5 Qt: Allow shift-double-clicking on a frame link.
You can open a new packet window in the GTK+ UI by holding down the
shift key and double-clicking on a frame link in the protocol tree. Add
this behavior to the Qt UI. Document the different ways of opening a new
packet window and update the image.

Change-Id: I55caf6cc8089a6c305fafd47b4870e7c69dbfb10
Reviewed-on: https://code.wireshark.org/review/7101
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-13 17:30:26 +00:00
Richard Sharpe 4d5bdf4256 A dissector for the RSVD Protocol (see [MS-RSVD].pdf).
There is still a little more work to do here, especially we should call the
SCSI dissector for handling SCSI CDBs etc ...

This is a potential fix for bug 10913.

Ping-Bug: 10913.

Change-Id: Ia8ff1a8207bb5b1cd18079086ff8c472ae3f8736
Signed-off-by: Richard Sharpe <realrichardsharpe@gmail.com>
Reviewed-on: https://code.wireshark.org/review/7022
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-02-13 16:08:34 +00:00
Gerald Combs 8843606666 Qt: Try to make some dialogs behave like windows.
Initialize WiresharkDialog with a NULL parent. This should make its
subclasses behave like independent windows.

Change-Id: If84609eeba53a92780c0873a1243888998d2b26b
Reviewed-on: https://code.wireshark.org/review/7094
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-02-13 16:07:00 +00:00
Jeff Morriss 48a95dea4f Register the Mongo dissector by name so it can be used with TLS.
Change-Id: Ic9d688603747312aa29e5af038363f70c3cbae33
Reviewed-on: https://code.wireshark.org/review/7097
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
2015-02-13 14:03:24 +00:00
AndersBroman c1610c7bd8 Micro optimization, only do tvb_get_ptr() once for dst and src
respectivly.

Change-Id: I1cdc5742057830a47ea71769fb54ab8dfdd3de14
Reviewed-on: https://code.wireshark.org/review/7096
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-13 13:42:41 +00:00
Vincenzo Reale 91a6e5eb25 Italian translation update
Change-Id: Ibf66f25a257051ba12c3fb9687ac57377117138f
Reviewed-on: https://code.wireshark.org/review/7036
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2015-02-13 10:35:45 +00:00
Gerald Combs f0b4b72158 Qt: Revert g6e88978 for main_status_bar.
It made some slot signatures unusable.

Change-Id: I0f7cdad9e84a5ffb2bdfe4042ac93b3ea19b4893
Reviewed-on: https://code.wireshark.org/review/7095
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-13 04:22:02 +00:00
Gerald Combs 80342e43e8 Qt: Make WiresharkDialog act like a window.
Set Qt::Window when we initialize QDialog. This should add a minimize
button to most of the dialogs that need one.

Change-Id: I8595dee9c6a28a4e0a8518213176ba10a6d8dcc6
Reviewed-on: https://code.wireshark.org/review/7093
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-13 03:07:32 +00:00
Gerald Combs a0498f177a Qt: Double clicking a packet opens the packet window.
Connect the packet list's doubleClicked signal to the main window's
openPacketDialog slot.

Change-Id: I5bc20c113fb1f22e2257fc1dbdef76c9920e05d0
Reviewed-on: https://code.wireshark.org/review/7092
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-13 03:02:47 +00:00
Gerald Combs 6e88978fd9 Qt: More #include → forward declarations.
Change-Id: Ib6de71f801cd3053374b6c867370acd594dcd396
Reviewed-on: https://code.wireshark.org/review/7089
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-13 02:31:16 +00:00
Gerald Combs a5652c7257 Qt: ElidedLabel doesn't support rich text / HTML.
Change-Id: Ia5ca9784c60325c01ba5e6378997008f8ef1dd6e
Reviewed-on: https://code.wireshark.org/review/7091
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-13 00:50:20 +00:00
Gerald Combs f1d1354b83 Try to fix compilation on OS X.
Change-Id: I63d1f639bf5fd56aeaea112c797efedca8c0bf6e
Reviewed-on: https://code.wireshark.org/review/7090
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-13 00:12:01 +00:00
Gerald Combs 931807ea61 Qt: Add the "new packet" window^Wdialog^Wwindow.
Allow persistence across files. Preserve the use of "window" even
though we're really a dialog.

Update ByteViewTab and ProtoTree to support multiple instances.

Remove the need for a cast in frame_data.

Add more forward declarations.

Change-Id: I50d3d9d1455b8ecc158a37218f9e41fe696d5ae2
Reviewed-on: https://code.wireshark.org/review/7086
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-12 23:32:54 +00:00
Gerald Combs b3e2c568b0 Docbook: Don't build PDF release notes by default.
Move the release-notes-*.pdf targets to a release_notes_pdf metatarget
which must be built manually.

Change-Id: I067a4e248e6e68d1ff60aafad5d75c1180536e0f
Reviewed-on: https://code.wireshark.org/review/7088
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-12 21:56:30 +00:00
Gerald Combs d2aa2c610d WSDG: Start adding Qt material.
Move some text from README.qt to the Developer's Guide. Add an overview.

Change-Id: Ia20ed837939e34871b157566c38cd0c6e590bc38
Reviewed-on: https://code.wireshark.org/review/7087
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-12 20:38:34 +00:00
Pascal Quantin bdcac172ea Fix crash at startup in SSE4.2 code when running a 32 bits Windows build
There is no guarantee that a g_malloc'ed memory block will be aligned on a 128 bits boundary
Instead use a static variable definition (at the cost of exposing the HAVE_SSE4_2 compilation flag in ws_mempbrk.h)

Change-Id: I661bf479a9d458d64c96bafc940c519d29a4780b
Reviewed-on: https://code.wireshark.org/review/7070
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-02-12 16:37:55 +00:00
Pascal Quantin 678a9b6463 BT ATT: memory given to add_new_data_source() must be allocated in pinfo scope
Bug: 10952
Change-Id: I0eb8e6891c35c70c9d405db87824c442caaa2f30
Reviewed-on: https://code.wireshark.org/review/7085
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-02-12 16:27:24 +00:00
Pascal Quantin ef21740e25 Gryphon: do not use col_set_str with non constant strings
Fixes an ASAN failure reported by Alexis

Change-Id: I68e5c55ec4090766ef5f003f44093ce3c268a82a
Reviewed-on: https://code.wireshark.org/review/7082
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-02-12 15:19:03 +00:00
Roland Knall 7594d96e7d nmake: Allow Cygwin path to be provided
I have installed cygwin at a different location then the default
location. Therefore the nmake steps tend to fail, and I will have
to adapt the config.nmake script every time.

This patch allows the CYGWIN_PATH variable to be set outside
the build-script

Change-Id: Iaecdd2aa72a0529574fab7e6aeae18fbfd621721
Reviewed-on: https://code.wireshark.org/review/7078
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-12 14:16:49 +00:00
Anish Bhatt 34acb73df1 [IS-IS-LSP] Add support for Prefix-SID subTLV
Bug: 10679
Change-Id: I4f2627aa22c64593258121a7e70b3f341e025d2e
Reviewed-on: https://code.wireshark.org/review/7048
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-02-12 12:49:07 +00:00
Dario Lombardo 60cc8b4fd8 Support for looking for incomplete dissectors.
Change-Id: I03e592dd3d54fc0e1c4af09d5d5336dda93f950e
Reviewed-on: https://code.wireshark.org/review/6978
Reviewed-by: Evan Huus <eapache@gmail.com>
Petri-Dish: Evan Huus <eapache@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-02-12 11:14:24 +00:00
Guy Harris 207b52a988 tvb_length is a macro wrapper for tvb_captured_length; use tvbuff_length.
This squelches a compiler warning on some platforms.

Change-Id: Ibee5c2fe07fc58e22a860b4c4467a501c2b8a979
Reviewed-on: https://code.wireshark.org/review/7079
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-12 10:26:00 +00:00
Michal Labedzki 707522396c Little tuning of proto_tree_add_bytes_with_length
Change name from proto_tree_add_new_bytes to
proto_tree_add_bytes_with_length and other tweaks
pointed by Peter Wu.

Change-Id: I6058c28a74a154e2882e4eb04558bedcede6f508
Reviewed-on: https://code.wireshark.org/review/7039
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2015-02-12 09:22:55 +00:00
Anders Broman 4359cb8478 Revert ""Hide" hashether_t structure."
This reverts commit 297ef07b9b.

Change-Id: Id47f5fd221b631c95ca71e3f9315f5263bab22de
Reviewed-on: https://code.wireshark.org/review/7077
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-12 08:34:30 +00:00
Anders Broman 53228c4bd8 Revert "Make get_manuf_name return a const string."
This reverts commit 797ea88aef.

Change-Id: I9bc2cef0051d88c6374c6f1868b0250cba3edbd4
Reviewed-on: https://code.wireshark.org/review/7076
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-12 08:34:05 +00:00
Michael Mann 797ea88aef Make get_manuf_name return a const string.
Model get_manuf_name after get_ether_name so that a string (either name resolved or colon-separated bytes) is always stored in a hash table.  This will make name resolution of addresses perform a little better because it doesn't have to work about the wmem_allocator.

Change-Id: I80f465ae0845290255a659ab63310ac3cc35506e
Reviewed-on: https://code.wireshark.org/review/7075
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-12 07:36:20 +00:00
Michael Mann 297ef07b9b "Hide" hashether_t structure.
One use in a GUI function isn't really enough to justify making the structure public.

Change-Id: I6d70b9bacbc0fa1898150f59c0c69779a6cd5d51
Reviewed-on: https://code.wireshark.org/review/7074
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-12 07:31:05 +00:00
Guy Harris d3d0a0a802 Fix SSE 4.2 checks.
CMake has "normal" and "cache" variables, and unexpected things happen
if you have a normal and a cache variable with the same name.
Apparently, check_c_compiler_flag() currently sets its result variable
as a cache variable, and set(), by default, sets it as a normal
variable.

This means that there are two different HAVE_SSE4_2 variables, and the
top-level CMakeLists.txt looks at the cache variable when it creates
config.h; this means that if the nmmintrin.h test fails, config.h still
says we have SSE 4.2.

Instead, use separate variables for the "compiler can be made to
generate SSE 4.2 code" test and the "nmmintr.h works" test; that way we
don't have to worry about normal vs.  cache variables (and don't have to
worry about CMake changing what type of variable particular
functions/macros set).

Change-Id: I618ad402b248f35fffd822974b6a569d4e5d6398
Reviewed-on: https://code.wireshark.org/review/7073
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-11 22:21:19 +00:00
Jiří Engelthaler 0dbf741865 packet-iec104: fix packet information text
Change I6abc157368a78e1abfde672728b88a36ba6e76cc adds break in "switch case" but there was missing break deliberately. Code modified to let break on his place - copied code from the following condition.

Change-Id: Id008955fbc122c0f8cfe06af2b96f0b643e9417f
Reviewed-on: https://code.wireshark.org/review/7066
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-11 21:02:06 +00:00
Bill Meier 0cd2582e8d Prevent two false positive MSVC2013 Code Analysis warnings
Message: "Using uninitialized memory"

Change-Id: Ib7d381beb9f9c1f3ec19a376c0c8c0d5ef85f373
Reviewed-on: https://code.wireshark.org/review/7069
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2015-02-11 17:10:12 +00:00
Bill Meier 3c9c9bc299 capture_dlg.c: Fix (possibly valid) "Using uninitialized memory" MSVC2013 Code Analysis warning
Change-Id: I849b731420d779b68ab4335eb8d06482ecd649e7
Reviewed-on: https://code.wireshark.org/review/7068
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2015-02-11 17:03:53 +00:00
Michael Mann 9db51dfc70 Remove address_to_str_buf from hsrp dissector "heuristics" as its much faster to just compare the IPv4 address as a 32-bit value.
Change-Id: If5a819b74112e92636d036509cb30ea15b2d5e3d
Reviewed-on: https://code.wireshark.org/review/7067
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-02-11 14:54:42 +00:00
AndersBroman a822d85e04 Try to fix the debian symbols
Change-Id: I234f42e5488d2044d0c68f499814fe9a51b220dd
Reviewed-on: https://code.wireshark.org/review/7064
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-11 11:30:09 +00:00
Hadriel Kaplan a837570d02 Combine SSE and pre-compiled patterns for faster pbrk
This combines the SSE4.2 instructions usage, with pre-compiled
pattern searching usage, for a faster pbrk search method.

Testing against large files of HTTP and SIP, there is about
a 5% performance improvement by using pre-"compiled" patterns
for guint8_pbrk() instead of passing it the search string and
having it build the match array every time.
Similar to regular expressions, "compiling" the pattern match array
in advance only once and using the "compiled" patterns for
the searches is faster than compiling it every time.

Change-Id: Ifcbc14a6c93f32d15663a10d974bacdca5119a8e
Ping-Bug: 10798
Reviewed-on: https://code.wireshark.org/review/6990
Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-11 09:14:50 +00:00
Pascal Quantin a618f1c0d6 USB: put back interface class when dissecting URB_CONTROL
Also ensure that USB COM dissection is done with the parent tree and not setup one

Change-Id: Iae9f933ff29b3854879375df320a23e623ea785f
Reviewed-on: https://code.wireshark.org/review/7051
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>
2015-02-10 20:33:29 +00:00
Gerald Combs c34ded4ae2 Qt/C++: Change a bunch of includes to forward declarations.
In theory this this should reduce compilation times. On my particular
system it makes no difference but hopefully it will elsewhere.

Change-Id: I570177d3ca4eec691c82d46b4dbbce74092aac1d
Reviewed-on: https://code.wireshark.org/review/7060
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-10 19:59:43 +00:00
Martin Mathieson 88d62dffe8 Remove unneeded includes from plugins folder
Change-Id: Ifdad0fb786a97a6f84a64d442fcca0c20116552f
Reviewed-on: https://code.wireshark.org/review/7059
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-02-10 17:53:28 +00:00
Martin Mathieson d5f0df44fb Add script to automatically remove includes that appear not be needed
Change-Id: I5474d8a906e96c688020737ca4bd4c3319ae279f
Reviewed-on: https://code.wireshark.org/review/7058
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-02-10 16:00:06 +00:00
Pascal Quantin e915db7cc8 Do not iterate over reported length when using tvb_find_line_end
if captured length < reported length, this will trigger an infinite loop

Change-Id: I6557b455e7bbff12658a934e5bb13a42c023e133
Reviewed-on: https://code.wireshark.org/review/7053
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-02-10 14:02:20 +00:00
Pascal Quantin 7369c25ad4 IMAP: do not iterate over reported length when using tvb_find_line_end
This function can only search in captured length buffer
This fixes an ASAN failure reported by Alexis

Change-Id: Ib936f918e057423d63ff34a5fc79fed602e56dfc
Reviewed-on: https://code.wireshark.org/review/7052
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-02-10 13:24:59 +00:00
Pascal Quantin 29be26c4b3 FTAM: get rid of an evil global variable
Fixes an ASAN failure reported by Alexis

Change-Id: Id0ddad6451e22ffc53d42985e9b2071c7388d15b
Reviewed-on: https://code.wireshark.org/review/7049
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-10 12:35:37 +00:00
Kevin Grigorenko 3b2954208a Add a "Sum" column to the Service Response Time (SRT) window.
The Service Response Time (SRT) window currently provides the
columns: Index, Procedure, Calls, Min SRT, Max SRT, and Avg SRT.
A Sum column has been found useful in some customer situations
to understand the total time spent doing a set of procedures.
For example, in one case we were trying to isolate whether most
time was being spent on a client thread or in the act of making
outbound calls. We knew the start and end time of the client call,
so with the "Sum" of time spent in that period, we could isolate
a particular set of procedures driving the slow down.

Additional changes made in this patch:
* Add " (s)" to Min, Max, Avg, and Sum columns to make it clear
  that times are in seconds.
* Refactor out width and height constants used in calls to
  gtk_window_set_default_size in most of the SRT users into
  #define SRT_PREFERRED_WIDTH and SRT_PREFERRED_HEIGHT. Also
  increase the common width of 550 to 650 to account for the
  additional column.

Change-Id: I20f152eecbcd0bbf69f71c6c6b9f9463e8867e23
Reviewed-on: https://code.wireshark.org/review/7047
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-02-10 06:18:41 +00:00
Guy Harris 895b0130de Use G_GINT64_MODIFIER when formatting g{u}int64 values.
Remove extra trailing blank from output while we're at it.

Change-Id: Ie415afa76a3eaba630ee3d59b177b44de75413a4
Reviewed-on: https://code.wireshark.org/review/7046
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-09 19:32:54 +00:00
Bill Meier e88a11f5c9 (Trivial) Fix printf-related 'Mismatch on sign' warnings
Found by MSVC2013 Code Analysis

Change-Id: I58063946dd558e98308c87b36eeac0ddbe1a6e79
Reviewed-on: https://code.wireshark.org/review/7045
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2015-02-09 18:57:14 +00:00
Peter Wu 2078a95e93 pgsql,imap: add STARTTLS support
The PGSQL "STARTTLS" protocol is documented at
http://www.postgresql.org/docs/9.4/static/protocol-flow.html
While at it, convert some tvb_length[_remaining] users.

Tested against pgsql-ssl.pcapng,
Tested against imap-ssl.pcapng,
http://wiki.wireshark.org/SampleCaptures#SSL_with_decryption_keys

Change-Id: I1a00a6daa7f03de93339c2c13b07b4cfb8cdbd86
Reviewed-on: https://code.wireshark.org/review/6821
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-02-09 16:26:28 +00:00
Martin Mathieson a58cf528fc file-jpeg: Allow 'Exif' as identification in first App block, but flag as expert info warning if seen
Change-Id: Id16e0b4fbca3b29b01138a9aea758b8beb8d9ed8
Reviewed-on: https://code.wireshark.org/review/7042
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-02-09 14:19:36 +00:00
Martin Mathieson e36a2ad669 Netflow: rework how transport (port) resolution is done, adding support for SCTP
Change-Id: I09b2cc3739628b5de706659731e37fa345804254
Reviewed-on: https://code.wireshark.org/review/7043
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-02-09 14:12:22 +00:00
Peter Wu 929a4f253c ldap: simplify Start TLS handling
RFC 2830 describes the Start TLS operation as follows:

 1. ExtendedRequest is sent by client with the requestName OID set to
    "1.3.6.1.4.1.1466.20037".
 2. Server responds with an ExtendedResponse having a resultCode and
    optionally a responseName (OID).

The text mentions that the field *must* be set but the definition allows
it to be optional. The previous code then made assumption that once (1)
was seen, then any ExtendedResponse signals an acknowledgement.

That is not entirely correct, a server could reject the request. This
patch corrects that by checking the ExtendedResponse_resultCode for
success, and then uses the new ssl_starttls_ack() helper to kick off
SSL. This simplifies the code a bit.

Tested against ldap-ssl.pcapng (which has no responseName) from
http://wiki.wireshark.org/SampleCaptures#SSL_with_decryption_keys
The result is the same as before, except that "Protocols in frame"
changed from "...:ldap:ssl:ldap" to "...:ssl:ldap".

Change-Id: Id7e40c5a50a217c4d3d46f08241d704f19d195dd
Reviewed-on: https://code.wireshark.org/review/6982
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-02-09 14:08:18 +00:00
Peter Wu e190253478 Fix STARTTLS handling in various dissectors
This patch lets a dissector hand over control to the SSL dissector which
simplifies dissector code ("TCP | App | SSL | App" becomes
"TCP | SSL | App").

After this patch, all of the affected dissectors will now be dissected
as SSL with its Application Data being treated as the protocol before
STARTTLS. This was previously not the case because the port was not
registered for dissection via ssl_dissector_add.

The desegmentation issue within the MySQL dissector is now also gone.
Convert some tvb_length[_remaining] users in pop and smtp as well.

Tested against mysql-ssl.pcapng and mysql-ssl-larger.pcapng(*1),
Tested against pop-ssl.pcapng (note: only first stream is decrypted,
either the key after negotiation is wrong or there is a bug),
Tested against smtp-ssl.pcapng and smtp2525-ssl.pcapng (with Decode As)
and smtp-ssl.pcapng with filter "tcp.len>0",
Tested against xmpp-ssl.pcapng,
http://wiki.wireshark.org/SampleCaptures#SSL_with_decryption_keys

 *1) mysql-ssl-larger has MySQL dissector errors for the fragmented
     SSL packet, but reassembly seems to work. Needs further
     investigation.

Bug: 9515
Change-Id: I408ef8ff30d9edc8954dab9b3615900666dfa932
Reviewed-on: https://code.wireshark.org/review/6981
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-02-09 14:03:34 +00:00