Commit Graph

41605 Commits

Author SHA1 Message Date
Thiyagarajan P cda11f813d Support to dissect Gate Announcement
Added support for dissecting the Gate Announcement element
IEEE80211-2016, section 9.4.2.111
2020-11-02 12:11:56 +00:00
Martin Kaiser 1db107a249 rx: simpler check for a known type
Call try_val_to_str to check if the type is listed in our value string of
known types.
2020-11-01 20:31:29 +00:00
Uli Heilmeier e07bb433b2 RTCP: Extended Reports: check for padding
Check if padding flag is set and alter length accordingly.
Display rtcp.xr.bl the same way as rtcp.length.

Fixes: wireshark/wireshark#16933
2020-11-01 20:08:06 +00:00
Nardi Ivan 9613c943e0 QUIC: fix connection lookup for Version Negotiation packets
VN packets don't have any real packet type, even if they have a long header
2020-10-31 15:54:12 +01:00
Nardi Ivan cafdab3967 QUIC: allow dissection of sessions forcing version negotiation
Right now, these sessions are not dissected as QUIC, let alone decrypted
2020-10-31 15:54:12 +01:00
Sylvain Munaut b6222766cc usbvideo: Fix dissection of PROBE infos structure
Refer to USB Device Class Definition for Video Devices
document revision 1.5.

 * bmFramingInfo is 1 byte
 * Cut & Paste error for bMaxVersion label

Change-Id: Ib1221886f864a6ab9dbab70a8e5fca6482bf4267
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
2020-10-31 12:33:07 +00:00
Martin Mathieson b925734fe2 GSM A: Uncertainty speed is only 1 byte. 2020-10-31 12:09:23 +00:00
Pedro Jose Marron cc4ad69366 IEEE 802154: Improve support for vendor specific IEs
Provide better dissection information for vendor specific IEs
and remove the expert warning displayed so far.
2020-10-30 22:15:12 +00:00
Martin Mathieson 5b3bce3b5a OAMPDU: Fix the length of an item. 2020-10-30 11:12:25 +00:00
Dieter Dobbelaere 9d6ebdc8a5 Dissect frame drop count if present. 2020-10-29 18:10:41 +00:00
Vadim Yanitskiy 732591237b GSM A RR: fix wrong cause value in gsm_a_rr_RR_cause_vals
Also, take a chance to correct the comment: section 6.11.0 does
not exit in 3GPP TS 44.018.  In version 15.4.0 Release 15 of
the referenced document it is 10.5.2.31 (table 10.5.2.31.1).
2020-10-29 09:27:13 +00:00
Jonas Falkevik 156f9e81fc lcsap: fix decode of plmnIdentity
Corretly decode MNC if it consists of 3 digits
Change to what is called big endinan MNC

   8   7   6   5   4   3   2   1
 +---+---+---+---+---+---+---+---+
 |  MCC digit 2  |  MCC digit 1  |  octet x
 +---------------+---------------+
 |    Filler     |  MCC digit 3  |  octet x+1
 +---------------+---------------+
 |  MNC digit 2  |  MNC digit 1  |  octet x+2
 +---------------+---------------+

 MNC of length 3:

   8   7   6   5   4   3   2   1
 +---+---+---+---+---+---+---+---+
 |  MCC digit 2  |  MCC digit 1  |  octet x
 +---------------+---------------+
 |  MNC digit 1  |  MCC digit 3  |  octet x+1
 +---------------+---------------+
 |  MNC digit 3  |  MNC digit 2  |  octet x+2
 +---------------+---------------+

From 3GPP TS 29.171
7.4.27 PLMN Identity

- digits 0 to 9, encoded 0000 to 1001,
- 1111 used as filler digit, two digits per octet,

- bits 4 to 1 of octet n encoding digit 2n-1
- bits 8 to 5 of octet n encoding digit 2n

The Selected PLMN identity consists of 3 digits from MCC followed by either
- a filler digit plus 2 digits from MNC (in case of 2 digit MNC) or
- 3 digits from MNC (in case of a 3 digit MNC).
2020-10-29 00:53:13 +01:00
Martin Mathieson 7c178d752f Bluetooth protocols: fix some protocol item lengths 2020-10-28 22:35:28 +00:00
John Thacker abf3eaace8 Encodings: Add FT_STRINGZ support for GB18030, EUC-KR 2020-10-28 22:05:17 +00:00
Dieter Dobbelaere 9b5d4945d0 DOCSIS/XRA: fix typos + cleanup. 2020-10-28 13:58:38 +00:00
Jaap Keuter 918db88055 Create protocols to the end of the TVB if length unknown upfront
Creating protocols with unknown length must be created to the end of the TVB
first and reined back using proto_set_len() once the length becomes known.
Not doing so can make indentification of problems harder and prevents analysis
engines like MATE from properly processing the generated protocol trees.
With this change the remaining offending dissectors are corrected for this.

Closes #16961
2020-10-28 12:40:44 +00:00
Arnout Vandecappelle (Essensium/Mind) af0c4203a0 ieee1905: fix endianness of fields
In IEEE1905.1, everything is encoded in network byte order (big endian).
However, the dissector has a lot of ENC_LITTLE_ENDIAN. Change these into
ENC_BIG_ENDIAN.

The IPv4 Type TLV is not changed in this commit, since I'm not able to
test that TLV with an actual IEEE1905.1a implementation.

Many other fields are currently encoded as ENC_NA put should probably be
ENC_BIG_ENDIAN as well. However, they seem to work with ENC_NA, so they
are also not changed.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2020-10-28 12:16:56 +00:00
Dieter Dobbelaere 7c9eb8b235 Fix typo: 'descriptionfor' -> 'description for'. 2020-10-28 11:00:12 +01:00
Huang Qiangxiong 1c5d577d63 Protobuf: fix bugs about field subdissector
Don't try to dissect bytes as string and show its value item if the
bytes field has a subdissector. And add field subdissector under field
item instead of value item.

close #16956
2020-10-28 08:54:30 +00:00
Dr. Lars Völker ecdd7f3ede TECMP: Adding support for two temps in Vendor Data
The TECMP vendor data format for the Status Capture Module message has
support for two temperatures (chassis and silicon). This patch allows
dissection of those temperatures.
2020-10-28 08:31:44 +00:00
Guy Harris 889e0d5cb6 Add a new record type REC_TYPE_SYSTEMD_JOURNAL.
Systemd journal entries aren't file-type-specific; they're found in both
systemd journal entry blocks in pcapng files and in systemd journal
export files.  Give it a record type, for use with both file types.

This fixes #16955.

It also means that you can open a systemd journal export file and save
it as a pcapng file.
2020-10-27 20:06:26 -07:00
Stig Bjørlykke edd71daa90 lte-rrc: Pluralize PagingRecord(s) 2020-10-27 15:51:11 +01:00
Stig Bjørlykke 5413331ed3 AT: Handle response without leading \r\n
The AT response may not contain a leading \r\n, so avoid checking
for this to determine if it's a response. This characters will be
removed as a part of white space removal anyway.
2020-10-27 07:22:09 +00:00
Antony Bridle cea3bdca9d ASTERIX: Bumped version of ASTERIX Category 004 to 1.11
Updated supported version of ASTERIX Category 004 from 1.7 to 1.11
2020-10-26 10:31:45 +00:00
Martin Mathieson 2fe6c3cd85 Fix some more item lengths. 2020-10-26 09:30:53 +00:00
Alexander Couzens fc1b478a55 packet-gsm_rlcmac: display TLLI as hex
In all other layer the TLLI is displayed as hex. The TLLI
is a 32-bit value which is quite unreadable in decimal form.
2020-10-25 14:35:18 +00:00
Ismael Pérez b694ad77e4 sv dissector: dissect optional field "gmIdentity"
The information regarding the VendorID in gmIdentity is also decoded.
2020-10-25 14:07:32 +00:00
Andre Luyer 6e35d38c2d DNS: change response time in statistics view to msec
Normal DNS response times are in the milli-seconds range, but are currently
listed as seconds.
It is more readable when msec unit is used instead.
Also the average display is hard coded (%.2f) so under normal conditions it
is currently shown as "0.00".
With this change the average value displayed is more useful and high response
times (retransmissions) stand out more clearly.
2020-10-25 13:22:24 +00:00
Uli Heilmeier ce47866a43 DNS: RFC8914 Extended DNS Errors
Add support for RFC8914 Extended DNS Errors
2020-10-24 21:56:32 +00:00
Martin Mathieson 84f89e97a2 DPNET: Make some 4-byte fields FT_UINT32.
None of these fields are likely to reach 2^16...
2020-10-24 14:32:16 +01:00
Peter Wu cad1785868 dns: detect DNS over UDP on non-standard ports using heuristics
While running a test suite of a DNS server, a lot of DNS messages on
non-standard ports were not recognized. Rather than manually discovering
and decoding every port using an iterative process of checking the
output of the `udp and not dns` filter, have some heuristics to detect
DNS messages automatically.

Enable these heuristics by default assuming that the checks are strong
enough, 8 bytes are essentially fixed to a low number of possibilities.
Should it cause issued, then the heuristics could be disabled (assuming
that non-standard DNS ports are uncommon) or strengthened.
2020-10-24 11:21:44 +00:00
Jeff Widman 08f521fb63 Fix typo: 'filed'->'field' 2020-10-23 21:35:58 -07:00
Gerald Combs 273eb06390 USB HID: Initialize a struct.
Initialize a variable caught by Valgrind. Fixes #16938.
2020-10-23 16:43:06 +00:00
Martin Mathieson e42cc6716e Openflow: fix some item lengths 2020-10-23 10:05:55 +00:00
Lorand Jakab 2663d49559 LISP: add support for vendor specific LCAF
Specified by the IETF LISP WG:

    https://tools.ietf.org/html/draft-ietf-lisp-vendor-lcaf
2020-10-23 09:36:04 +00:00
Stig Bjørlykke 17170ea1fe tls: Use Data dissector when no appdata dissector found
Use the Data dissector to show decrypted data if nothing else is used.
2020-10-23 04:41:33 +00:00
John Thacker 524a28c4b1 QT/CLI: Move max tree items and depth to prefs
Move the maximum number of tree items and maximum tree depth to
preferences instead of hardcoded values. Refer to issue #12584 for
an example VNC capture where real data exceeds the current limit.
2020-10-23 04:18:36 +00:00
Stig Bjørlykke 69b1ad68bc data: Enable DecodeAs tls and dtls as Data
Make it possible to DecodeAs tls and dtls traffic as Data.
2020-10-23 03:29:05 +00:00
Martin Mathieson 7e79d09fba UMTS FP: Fix the length of the DRT field. 2020-10-22 21:16:35 +00:00
Martin Mathieson a46bda17ef Lustre: Fix some item lengths. 2020-10-22 20:30:45 +00:00
Peter Wu 83f8767db9 dns: Improve SvcParam dissection, fix echconfig/odohconfig support
* Use parameter names from draft-ietf-dnsop-svcb-https-01 to match the
  presentation format. Use keyNNNNN for unknown names in the tree.
* Remove the SvcParams tree and directly display parameters under the
  resource record tree. Include the parameter value as well.
* Add odohconfig (draft-pauly-dprive-oblivious-doh-02) support.
* Use the presentation format (base64) for echconfig/odohconfig values.
2020-10-22 18:42:57 +00:00
Stig Bjørlykke 10e6cb5f37 wslua: Make pinfo.p2p_dir writable
Make pinfo.p2p_dir writeble from Lua to be able to set the direction
for sub-dissectors.
2020-10-22 14:18:58 +00:00
robionekenobi f267a0433d packet-mq: Improve and fix bugs
Improve MultiSegment display
Fix Option (endianess) in MQCLOSE
Add missing parsing for Q_MGR_STATUS_ATTRS
Some minor code reformatting
2020-10-22 12:04:27 +00:00
George Hopkins e16ef82d7c Elasticsearch: support for version >= 5 2020-10-22 08:23:10 +00:00
Nardi Ivan e6adc940ac QUIC: update to draft-32 2020-10-22 07:43:01 +00:00
aaptel fef3b86b38 SMB2: fix EaSize field in QUERY DIR responses
According to [MS-FSCC] if the file has the REPARSE_TAG attribute, the
EaSize field must be interpreted as a reparse tag for the following
info levels:

* FileFullDirectoryInfo
* FileBothDirectoryInfo
* FileIdFullDirectoryInfo
* FileIdBothDirectoryInfo
2020-10-22 06:48:26 +00:00
John Thacker e110da70a4 Update validate_single_byte_ascii_encoding with new encodings
Add various other encodings that differ from ASCII in the ISO/IEC 646
invariant region to the reject list for validate_single_byte_ascii_encoding()
2020-10-22 05:21:39 +00:00
Joakim Karlsson 0929eea9fc pfcp: Update to 3GPP TS 29.244 V16.4.0
Change-Id: I31d3123c948cf3f472a384143ca77b756e83c773
2020-10-22 04:58:52 +00:00
Martin Mathieson 27157055cf BSSGP: Make some item calls match field lengths.
From tools/check_typed_item_calls.py output:

epan/dissectors/packet-bssgp.c:655 proto_tree_add_item called for hf_bssgp_bss_area_ind  -  item type is FT_UINT8 but call has len  2
epan/dissectors/packet-bssgp.c:1468 proto_tree_add_item called for hf_bssgp_unit_val  -  item type is FT_UINT8 but call has len  3
epan/dissectors/packet-bssgp.c:1469 proto_tree_add_item called for hf_bssgp_gprs_timer  -  item type is FT_UINT8 but call has len  3
epan/dissectors/packet-bssgp.c:2606 proto_tree_add_item called for hf_bssgp_unit_val  -  item type is FT_UINT8 but call has len  3
epan/dissectors/packet-bssgp.c:2607 proto_tree_add_item called for hf_bssgp_gprs_timer  -  item type is FT_UINT8 but call has len  3
epan/dissectors/packet-bssgp.c:2635 proto_tree_add_item called for hf_bssgp_unit_val  -  item type is FT_UINT8 but call has len  3
epan/dissectors/packet-bssgp.c:2636 proto_tree_add_item called for hf_bssgp_gprs_timer  -  item type is FT_UINT8 but call has len  3
epan/dissectors/packet-bssgp.c:3276 proto_tree_add_item called for hf_bssgp_cell_acc_mode  -  item type is FT_UINT8 but call has len  4
2020-10-22 04:36:30 +00:00
Joakim Karlsson d1f0f08052 gprscdr: Update to 3GPP TS 32.298 V16.6.1
Change-Id: Id6e4504405b2d909d0ff9f044b4c1b1f99d3d407
2020-10-22 03:40:38 +00:00