Commit Graph

86484 Commits

Author SHA1 Message Date
João Valverde 1400d92724 dfilter: Add compilation warning for ambiguous syntax
$ dfilter 'frame contains fc'
    Filter: frame contains fc

    Warning: Interpreting "fc" as "Fibre Channel". Consider writing :fc or .fc.
    (...)
2022-12-29 23:48:56 +00:00
John Thacker ba7917309a charsets: Optimize ENC_ASCII by appending valid bytes at once
For ASCII encoding, most bytes are copied directly. Count consecutive
valid bytes in an accumulator and append them all at once when we
get an invalid character with the high bit set, or at the end.
This reduces the number of reallocations and allows larger, more
optimized memcpys.
2022-12-29 21:02:12 +00:00
Gerald Combs afe5ed0aa5 epan: Initialize variables in various dissectors
Fix the following valgrind warnings:

==15172== Conditional jump or move depends on uninitialised value(s)
==15172==    at 0x78B0849: unescape_and_tvbuffify_telnet_option (epan/dissectors/packet-telnet.c:1043)

==15172== Conditional jump or move depends on uninitialised value(s)
==15172==    at 0x76917C8: dissect_rohc_ir_rtp_profile_dynamic (epan/dissectors/packet-rohc.c:1667)

==15172== Conditional jump or move depends on uninitialised value(s)
==15172==    at 0x70DCBF1: dissect_gsm_rlcmac_downlink (epan/dissectors/packet-gsm_rlcmac.c:9770)

==15172== Conditional jump or move depends on uninitialised value(s)
==15172==    at 0x6C7958E: set_mime_hdr_flags (epan/dissectors/packet-beep.c:392)

Fixes #18742
2022-12-29 19:27:16 +00:00
João Valverde af22c743bd dfilter: Refactor error location for expressions
Underline the whole expression for errors, not just the token.
Implement it for all expressions.
2022-12-29 18:28:54 +00:00
João Valverde 77ef21f86e dfilter: Replace unparsed lexical type and simplify grammar
Remove unparsed lexical type and replace it with identifier
and constant. This separation is still necessary to differentiate
names (fields and function) from literals that look like names
but it has some advantages to do it at the lexical level.

The main advantage is a much cleaner and simplified grammar,
because we only have a single token type for field names, without
any loss of generality (the same name is valid for fields and
function names for example).

The CONSTANT token type is necessary to be different from literal
to provide errors for function rules.
2022-12-29 18:28:54 +00:00
João Valverde bdd00edac8 dfilter: Rename grammar rules 2022-12-29 18:28:54 +00:00
João Valverde b577b8a37f Add WS_WARN_UNUSED function attribute 2022-12-29 18:28:54 +00:00
João Valverde 508a4011ac tests: Rename test group 2022-12-29 18:28:54 +00:00
João Valverde 0fbf65f48b dftest: Add elapsed time 2022-12-29 18:28:54 +00:00
Martin Mathieson 92a81b1361 Enable checks for proto_tree_add_bits APIs 2022-12-29 17:35:18 +00:00
Bernhard Dick fefc28a743 DECT-NWK: Fix BCD encoded non byte aligned strings
As proto_tree_add_bits_item does not support FT_STRING header fields
dissection of non byte aligned fields containing BCD values has been
rewritten using explicit reading of the BCD values and usage of
proto_tree_add_string
2022-12-29 09:05:29 +00:00
Bernhard Dick 4a0d7e9bbb DECT-NWK: Fix hf types for bitfields
Bitfields are neither allowed to be of type FT_NONE or FT_UINT_BYTES.
This commit fixes this for padding fields (being max 7 bits of zeroes,
thus FT_UINT8) and one field currently named as FT_UINT_BYTES that can
just be represented as FT_BYTES
2022-12-29 09:05:29 +00:00
Chuck Craft 1d6cf2f513 prefs: report load error in gui popup
ws_warning logs to console which most users will never see.
https://ask.wireshark.org/question/30035/new-computer-setup-custom-columns/
2022-12-29 04:02:15 +00:00
João Valverde 95f705dd8b dfilter: Improve error location for functions
Underline the whole expression if the error is for the function.

Before:

    Filter: frame.number == abs(1, 2)
    dftest: Function abs can only accept 1 arguments.
    	frame.number == abs(1, 2)
    	                ^~~
After:

    Filter: frame.number == abs(1, 2)
    dftest: Function abs can only accept 1 arguments.
    	frame.number == abs(1, 2)
    	                ^~~~~~~~~
2022-12-28 20:26:00 +00:00
Kevin Albertson bdb1616cf0 fix size_t cast warnings on Windows 2022-12-28 05:00:45 +00:00
Kevin Albertson 611eae17c8 add mongo zstd test to suite_dissection.py 2022-12-28 05:00:45 +00:00
Kevin Albertson eca4655a48 use uncompress_zstd in Kafka 2022-12-28 05:00:45 +00:00
Kevin Albertson f5c400c6e7 mongo: support zstd
use tvb_child_uncompress_zstd from packet-mongo
2022-12-28 05:00:45 +00:00
Kevin Albertson 8dd82ff741 add zstd_tests 2022-12-28 05:00:45 +00:00
Kevin Albertson 0ea91fc6fa error on extra data 2022-12-28 05:00:45 +00:00
Kevin Albertson a9037f45c7 do not create composite buffer with empty data
This results in an exception on tvb_composite_finalize.
2022-12-28 05:00:45 +00:00
Kevin Albertson 2f9fd85ae9 add tvbuff_zstd.c 2022-12-28 05:00:45 +00:00
Gerald Combs e93989c56a Qt: Fix an IAX2 Analysis dialog memory leak.
Fix

*** CID 1517838:  Resource leaks  (RESOURCE_LEAK)
/builds/wireshark/wireshark/ui/qt/iax2_analysis_dialog.cpp: 311 in Iax2AnalysisDialog::Iax2AnalysisDialog(QWidget &, CaptureFile &)()
305         }
306
307         if (!cap_file_.capFile() || !cap_file_.capFile()->current_frame) {
308             err_str_ = tr("Please select an IAX2 packet.");
309             save_payload_error_ = TAP_IAX2_NO_PACKET_SELECTED;
310             updateWidgets();
>>>     CID 1517838:  Resource leaks  (RESOURCE_LEAK)
>>>     Variable "sfcode" going out of scope leaks the storage it points to.
311             return;
312         }
313
314         if (!cf_read_current_record(cap_file_.capFile())) close();
315
316         frame_data *fdata = cap_file_.capFile()->current_frame;
2022-12-27 22:58:05 +00:00
João Valverde 6c1ee11172 dfilter: Allow compatible types to be compared in min/max 2022-12-27 21:09:04 +00:00
João Valverde e85f8d4cf1 dfilter: Do not jump when generating function arguments
Instead of "jumping" with length zero to the next sequential
instruction skip generating the no-op jump instruction entirely.
2022-12-27 21:09:04 +00:00
João Valverde f6a02a1e4a dfilter: Preserve function argument order when printing
Instead of printing back to front (from the top of the stack
print them front to back as a user would type them.
2022-12-27 21:09:04 +00:00
Guy Harris 0df8a7a872 SRT: expand comments to give more detail on the string encoding. 2022-12-27 10:38:44 -08:00
João Valverde 3c411657d5 SRT: Validate UTF-8 encoding
Fixes #18754.
2022-12-27 14:34:12 +00:00
Joakim Karlsson 939677f16e pfcp: Update to 3GPP TS 29.244 V18.0.0 2022-12-27 13:20:48 +00:00
Martin Mathieson 5bbe533244 WIP: Check types for _add_bits_ functions, and ensure no mask 2022-12-27 12:10:03 +00:00
João Valverde b19bed43d1 dfilter: Allow constants as the first or only argument to min/max
The strategy here is to delay resolving literals to values until
we have looked at the entire argument list.

Also we will try to commute the relation in a comparison if
we do not have a type for the return value of the function,
like any other constant.

Before:

    Filter: max(1,_ws.ftypes.int8) == 1
    dftest: Argument '1' is not valid for max()
    	max(1,_ws.ftypes.int8) == 1
    	    ^

After:

    Filter: max(1,_ws.ftypes.int8) == 1

    Syntax tree:
     0 TEST_ANY_EQ:
       1 FUNCTION(max#2):
         2 FVALUE(1 <FT_INT8>)
         2 FIELD(_ws.ftypes.int8 <FT_INT8>)
       1 FVALUE(1 <FT_INT8>)

    Instructions:
    00000 STACK_PUSH	1 <FT_INT8>
    00001 READ_TREE		_ws.ftypes.int8 <FT_INT8> -> reg#1
    00002 IF_FALSE_GOTO	3
    00003 STACK_PUSH	reg#1
    00004 CALL_FUNCTION	max(reg#1, 1 <FT_INT8>) -> reg#0
    00005 STACK_POP	2
    00006 IF_FALSE_GOTO	8
    00007 ANY_EQ		reg#0 == 1 <FT_INT8>
    00008 RETURN
2022-12-27 02:21:06 +00:00
João Valverde 6399f724d9 dfilter: Fix crash with min/max literal argument
Filter: max(1,_ws.ftypes.int8) == 1
     ** (dftest:64938) 01:43:25.950180 [DFilter ERROR] epan/dfilter/sttype-field.c:117 -- sttype_field_ftenum(): Magic num is 0x5cf30031, but should be 0xfc2002cf
2022-12-27 01:54:57 +00:00
Gerald Combs 6c8cdebe87 epan: Add a bounds check to get_utf_8_string
Check our current buffer position as well as our length.
Fixes #18758.
2022-12-27 01:54:23 +00:00
João Valverde 540b71d738 dfilter: Fix crash with a constant arithmetic expression 2022-12-26 23:55:27 +00:00
João Valverde 3ddb017a88 dfilter: Allow arithmetic expression to commute
Allow an arithmetic expression like 1 + some.field. If we
cannot assign a type to the LHS commute the terms and
try again.

Before:

    Filter: _ws.ftypes.int32 + 1 == 10

    Syntax tree:
     0 TEST_ANY_EQ:
       1 OP_ADD:
         2 FIELD(_ws.ftypes.int32 <FT_INT32>)
         2 FVALUE(1 <FT_INT32>)
       1 FVALUE(10 <FT_INT32>)

    Instructions:
    00000 READ_TREE		_ws.ftypes.int32 <FT_INT32> -> reg#0
    00001 IF_FALSE_GOTO	4
    00002 ADD		reg#0 + 1 <FT_INT32> -> reg#1
    00003 ANY_EQ		reg#1 == 10 <FT_INT32>
    00004 RETURN

    Filter: 1 + _ws.ftypes.int32 == 10
    dftest: Constant arithmetic expression on the LHS is invalid.
    	1 + _ws.ftypes.int32 == 10
    	^

After:

    Filter: _ws.ftypes.int32 + 1 == 10

    Syntax tree:
     0 TEST_ANY_EQ:
       1 OP_ADD:
         2 FIELD(_ws.ftypes.int32 <FT_INT32>)
         2 FVALUE(1 <FT_INT32>)
       1 FVALUE(10 <FT_INT32>)

    Instructions:
    00000 READ_TREE		_ws.ftypes.int32 <FT_INT32> -> reg#0
    00001 IF_FALSE_GOTO	4
    00002 ADD		reg#0 + 1 <FT_INT32> -> reg#1
    00003 ANY_EQ		reg#1 == 10 <FT_INT32>
    00004 RETURN

    Filter: 1 + _ws.ftypes.int32 == 10

    Syntax tree:
     0 TEST_ANY_EQ:
       1 OP_ADD:
         2 FVALUE(1 <FT_INT32>)
         2 FIELD(_ws.ftypes.int32 <FT_INT32>)
       1 FVALUE(10 <FT_INT32>)

    Instructions:
    00000 READ_TREE		_ws.ftypes.int32 <FT_INT32> -> reg#0
    00001 IF_FALSE_GOTO	4
    00002 ADD		1 <FT_INT32> + reg#0 -> reg#1
    00003 ANY_EQ		reg#1 == 10 <FT_INT32>
    00004 RETURN
2022-12-26 20:50:44 +00:00
João Valverde c37552c43c dfilter: Fix an assertion macro 2022-12-26 20:22:21 +00:00
João Valverde 1d544c2077 dfilter: Fix grammar memory leak 2022-12-26 18:48:54 +00:00
John Thacker f0f72927b4 epan: Allow FT_IPv4, FT_IPv6 custom columns to be resolved or not.
Similar to commit dbb9fe2a37, proto_item_fill_display_label
now uses address_to_display for FT_IPv4, FT_IPv6, and FT_FCWWN,
the other three address types that double as field types and which
have optional name resolution.

Add these to the list of types that, if present in a custom column,
has the GUI enable the checkbox to switch between "resolved" (names)
and not (values).

This allows adding custom columns with these field types with both
resolved and non resolved text. Note that the appropriate Name
Resolution preference settings must be enabled for the type as well.
2022-12-26 16:12:19 +00:00
João Valverde 079ef9a165 dfilter: Allow comparison relation to commute
Comparison relations should be allowed to commute but they can not
because we need type information to resolve literals to fvalues. For
that reason an expression like "1 == some.field"  is invalid. Solve
that by commuting the relation if the first try did not succeed in
assigning a type to the LHS.

After the second try give up, that means we have a relation with
constants on both sides and that is not semantically valid.

Other relations like "matches" and "contains" are not symmetric and
should not commute anyway.

Before:

    Filter: _ws.ftypes.int32 == 10

    Syntax tree:
     0 TEST_ANY_EQ:
       1 FIELD(_ws.ftypes.int32 <FT_INT32>)
       1 FVALUE(10 <FT_INT32>)

    Instructions:
    00000 READ_TREE		_ws.ftypes.int32 <FT_INT32> -> reg#0
    00001 IF_FALSE_GOTO	3
    00002 ANY_EQ		reg#0 == 10 <FT_INT32>
    00003 RETURN

    Filter: 10 == _ws.ftypes.int32
    dftest: Left side of "==" expression must be a field or function, not 10.
    	10 == _ws.ftypes.int32
    	^~

After:

    Filter: _ws.ftypes.int32 == 10

    Syntax tree:
     0 TEST_ANY_EQ:
       1 FIELD(_ws.ftypes.int32 <FT_INT32>)
       1 FVALUE(10 <FT_INT32>)

    Instructions:
    00000 READ_TREE		_ws.ftypes.int32 <FT_INT32> -> reg#0
    00001 IF_FALSE_GOTO	3
    00002 ANY_EQ		reg#0 == 10 <FT_INT32>
    00003 RETURN

    Filter: 10 == _ws.ftypes.int32

    Syntax tree:
     0 TEST_ANY_EQ:
       1 FVALUE(10 <FT_INT32>)
       1 FIELD(_ws.ftypes.int32 <FT_INT32>)

    Instructions:
    00000 READ_TREE		_ws.ftypes.int32 <FT_INT32> -> reg#0
    00001 IF_FALSE_GOTO	3
    00002 ANY_EQ		10 <FT_INT32> == reg#0
    00003 RETURN
2022-12-26 15:29:50 +00:00
João Valverde 49ec151a7a dfilter: Allow the first DFVM argument to be an fvalue
Do not assert that arg1 must be a register, allow passing constants
as the first argument to allow the arguments to commute freely.
2022-12-26 12:40:23 +00:00
João Valverde 596e0b41d1 dfilter: Change two scanner patterns to camel case 2022-12-26 07:27:40 +00:00
João Valverde 7742b22be4 dfilter: Minor fixups 2022-12-26 04:24:55 +00:00
João Valverde eda80ed336 dfilter: Improve error location for parenthesized expressions 2022-12-26 03:20:30 +00:00
John Thacker b1d93f7952 charsets: Optimize getting UTF-8 strings with an accumulator
Add all the valid bytes at once when we get to the end of the
length (or hit an invalid sequence) instead of one byte or character
at a time. This makes for a considerable speedup.
2022-12-25 20:42:28 +00:00
Gerald Combs 274a6c9d64 [Automatic update for 2022-12-25]
Update manuf, services enterprise numbers, translations, and other items.

services failed.
2022-12-25 16:46:13 +00:00
Eric Anderson d91cd30855 BACnet: Fix dissection of Notification Parameters
When the new-value element of the change-of-discrete choice contains context
tag zero, the tag content should be decoded as a BACnetDateTime. Closes #18747.
2022-12-24 19:59:24 +00:00
João Valverde 816005fc23 dfilter: Reformat grammar code
Use a consistent style for grammar rules.

Remove a comment that is too generic. The current code should
conform to how Python operates and does not need additional error
checking.
2022-12-24 18:25:11 +00:00
João Valverde b9a5009cb2 dfilter: Clean up scanner code
Clean up some issues flagged by a linter.

Remove hyphen from pattern names and remove an unused start condition.
2022-12-24 15:51:36 +00:00
Jianwei Mao d9a09aa622 IPv6: Support dissecting IETF APN6 option.
IETF APN6: Application-Aware IPv6 Networking (APN6)

APN6 option is a new option including in IPv6 Destination Options Header.

APN6 makes use of IPv6 encapsulation to convey the APN Attribute along with
data packets and make the network aware of data flow requirements at different
granularity levels. The APN attribute can be encapsulated in the APN header.

References:
1. https://datatracker.ietf.org/wg/apn/about/
2. https://datatracker.ietf.org/doc/draft-li-apn-header/
3. https://datatracker.ietf.org/doc/draft-li-apn-ipv6-encap/
2022-12-24 08:15:27 +00:00
Guy Harris 13f3ebc4e5 Add a routine to get the path of an executable given the program name.
That reduces the number of get_progfile_dir() calls, leaving only the
calls that are done either to 1) get the pathname in order to display it
or 2) get the pathname in order to reset the library path.

That makes it easier to figure out which get_progfile_dir() calls are
made to find the directory in which (non-extcap) binaries from Wireshark
are installed and which - if any - are made to figure out the directory
in which *the currently-running executable* are stored.  (Currently,
get_progfile_dir() attemps to get the former, not the latter, so
extcaps in an extcap subdirectory, for example, will get the parent
directory of that subdirectory, *not* the directory in which they weere
installed.)
2022-12-23 23:20:22 +00:00