parse EPSV response
from me
- no expert info under if(tree)
- use hf_ftp_epsv_port instead of hf_ftp_pasv_port
- don't use isdigit(), this is C99
- use temporary variable for IPv4 address
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7729
svn path=/trunk/; revision=45778
tvb_length_remaining -> tvb_reported_length_remaining.
Check return value of tvb_reported_length_remaining > 0.
Use tvb_reported_length to skip past all the bytes in the tvb.
svn path=/trunk/; revision=45776
structure definition of struct _wmem_allocator_t; have wmem_allocator.h
give the complete structure definition. That avoids complaints about
the typedef being redefined.
svn path=/trunk/; revision=45750
during fuzz testing or randpkt testing; somebody might be putting bad
packets on the wire to try to, for example, crash or break into your
protocol implementation.
svn path=/trunk/; revision=45749
Note that, if you want EUI-64's to resolve the OUI in the display,
hacking individual dissectors to do it themselves and use AT_STRINGZ is
*not* the right way to do it.
svn path=/trunk/; revision=45743
Add a dissector for the America Online protocol (not the AIM protocol).
From me: always use ENC_NA for FT_UINT8 types.
svn path=/trunk/; revision=45731
- Ethereal --> Wireshark;
- gerald@ethereal.com --> gerald@wireshark.org;
- update FSF address;
- remove unneeded #includes;
- Fix ENC args for proto_tree_add_item() & etc;
- simplify/remove proto_reg_handoff...() as appropriate;
- remove some boilerplate comments;
- move proto_register...() and proto_reg_handoff...() to
the end of the file as per convention;
- remove some unneeded initializers.
- simplify some code;
- replace "" in hf[] blurb by NULL.
svn path=/trunk/; revision=45728
wireshark/svn/trunk/epan/dissectors/packet-bthci_cmd.c:2611:13: error: format ‘%g’ expects argument of type ‘double’, but argument 3 has type ‘int’ [-Werror=format]
wireshark/svn/trunk/epan/dissectors/packet-bthci_cmd.c:2617:13: error: format ‘%g’ expects argument of type ‘double’, but argument 3 has type ‘int’ [-Werror=format]
svn path=/trunk/; revision=45711
../../../epan/dissectors/packet-btatt.c:299:25: error: too many arguments for format [-Werror=format-extra-args]
../../../epan/dissectors/packet-btatt.c:254:12: error: unused variable 'col_info' [-Werror=unused-variable]
svn path=/trunk/; revision=45710
Add support for HCI 3.0+HS and v4.0, Bluetooth Low Energy. This includes
dissection of additional HCI commands and events, Attribute Protocol and
Security Manager Protocol.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7872
svn path=/trunk/; revision=45709
- initialize edt once in few places, and later reset it after dissecting
(add_packet_to_packet_list),
- revert r45667, probably no longer needed.
svn path=/trunk/; revision=45669
2) Use proto_item_append_text instead of proto_item_set_text, since this is
called within a loop.
3) Increment the offset correctly using blocklen-4 instead of
tvb_length_remaining, which makes no sense.
svn path=/trunk/; revision=45657
- revert incorrect replacement of FALSE by ENC_BIG_ENDIAN
done a while back;
[The incorrect use of ENC_BIG_ENDIAN was benign since
ENC_BIG_ENDIAN is currently defined as 0x0000000];
svn path=/trunk/; revision=45651
Implement DICOM, HTTP, and SMB object exports. Rename the GTK+ export
files. C++-ize epan/tap.h. Fix an apparent memory leak in
eo_save_all_clicked_cb.
The Qt dialog has an indeterminate progress bar. I tried adding
something similar to the GTK+ dialog but event processing led down a
rabbit hole.
svn path=/trunk/; revision=45647
increment offset to point to the first byte after the options
(the code used to set an absolute position, if that was 0, we were stuck
in an endless loop)
svn path=/trunk/; revision=45646
- revert incorrect replacement of FALSE by ENC_BIG_ENDIAN
done a while back (9 instances);
[The incorrect use of ENC_BIG_ENDIAN was benign since
ENC_BIG_ENDIAN is currently defined as 0x0000000];
- remove some unneeded initializers;
- unsigned --> guint;
- remove unneeded #includes.
- whitespace changes.
svn path=/trunk/; revision=45642
- revert incorrect replacement of FALSE by ENC_BIG_ENDIAN
done a while back (10 instances);
[The incorrect use of ENC_BIG_ENDIAN was benign since
ENC_BIG_ENDIAN is currently defined as 0x0000000];
- Remove unneeded #includes;
- whitespace (e.g., use consistent indentation).
svn path=/trunk/; revision=45641
- Fix incorrect use of ENC_BIG_ENDIAN instead
of FALSE (3 instances);
[The incorrect use of ENC_BIG_ENDIAN was benign since
ENC_BIG_ENDIAN is currently defined as 0x0000000];
- use proper ENC arg for a proto_tree_add_item();
- whitespace.
svn path=/trunk/; revision=45640
- revert incorrect replacement of FALSE by ENC_BIG_ENDIAN
done a while back (10 instances);
[The incorrect use of ENC_BIG_ENDIAN was benign since
ENC_BIG_ENDIAN is currently defined ad 0x0000000];
- create/use extended value strings as appropriate;
- remove unneeded initializers;
- reformat hf[] entries;
- whitespace.
svn path=/trunk/; revision=45638
- revert incorrect replacement of FALSE by ENC_BIG_ENDIAN
done a while back (3 cases);
[The incorrect use of ENC_BIG_ENDIAN was benign since
ENC_BIG_ENDIAN is currently defined ad 0x0000000];
- Remove 'if(tree)' around calls to subdissector;
- whitespace & formatting.
svn path=/trunk/; revision=45635
- revert incorrect replacement of FALSE by ENC_BIG_ENDIAN
done a while back (2 cases);
[The incorrect use of ENC_BIG_ENDIAN was benign since
ENC_BIG_ENDIAN is currently defined ad 0x0000000];
- use proto_tree_add_item() instead of proto_tree_add_uint() when appropriate;
- move proto_register...() to just before proto_reg_handoff..()
as per convention;
- proto_reg_handoff...() doesn't need 'if (!initialized)'
- remove unneeded #includes;
- remove some "boilerplate" comments;
- remove unneeded forward declaration;
- whitespace.
svn path=/trunk/; revision=45631
indentation, whitespace, long-lines, etc.
Also;
- replace two usages of fprintf(stderr,...) by g_warning();
- revert incorrect replacement of FALSE by ENC_BIG_ENDIAN
done a while back (2 cases);
[The incorrect use of ENC_BIG_ENDIAN was benign since
ENC_BIG_ENDIAN is currently defined ad 0x0000000]
svn path=/trunk/; revision=45625
should be shared by TShark and Wireshark, so the preference directory
path should be independent of the program name. Program-specific or
GUI-toolkit-specific preferences should be kept in separate files, or
ignored but preserved by programs to which they don't apply.
svn path=/trunk/; revision=45618
- Revmove 'if (tree...)'; col_...() shouldn't be called under same;
- Add an XXX comment;
- Remove not req'd #include <epan/prefs.h>;
- Address cppcheck msg: "Clarify calculation precedence for >> and ?";
- Localize certain variables & remove unneeded initializers;
- Do some whitespace changes.
svn path=/trunk/; revision=45617
and it apparently either has the value 0x00000044 or 0x00000041. If
those bytes aren't the magic number for an AVS header and aren't one of
those "message code" values, assume there's no Prism header, just an
802.11 frame - that fixes at least one capture where some packets have
AVS radio headers and other packets have no radio header.
Note that this might also let us handle big-endian Prism headers (see
which byte order the message code is in, and assume everything else is
in the same byte order).
Display the message code in hex, not decimal.
svn path=/trunk/; revision=45609
- Calls to expert...() and col_...() should not be under 'if (tree)'
- Move proto_reg_handoff...() to the end of the file as per convention;
- Localize a few variables
- Fix some whitespace (e.g., convert what appear to be '4 space tabs' to spaces)
svn path=/trunk/; revision=45591
tvb_length_remaining() may return -1
if that happens in dissect_rdp_fields(), return an error
the caller that calls dissect_rdp_fields() from a for loop detects the error
and exits (others should handle the error as well, this is missing for now)
svn path=/trunk/; revision=45566
http://home.martin.cc/linux/prism
there's a set of DID type values different from the ones we were using,
and there are captures out there that use values from both sets.
Support both sets.
That page also says that a "status" value of 0 means "supplied"; treat
zero as meaning "supplied", and, if it's not zero for a field, don't
include it.
The "Mac Time" is, according to that page, the lower 32 bits of the MAC
timestamp; report it as such.
Fix some field names that were copied-and-pasted but not changed.
The RSSI and signal quality values are numbers, so show them in decimal.
The "signal" and "noise" values appear to be signed numbers, so make
them signed rather than unsigned and show them in decimal.
Show the data rate in the same style as it's shown in the radiotap
dissector.
Show the frame length in decimal; we probably have relatively few users
with 16 fingers.
svn path=/trunk/; revision=45545
extensions were incorrectly made ephemeral, rather than seasonal, in
r44662. They need to be seasonal, as they're used for dissecting all
packets in the X session.
Redo a couple of loops as for loops to make it a little clearer what
they're doing.
svn path=/trunk/; revision=45539
- Init COL_PROTOCOL before fetching from tvb;
- Remove some unneeded variable initializers;
- Localize some variables;
- Misc including whitespace revisions.
svn path=/trunk/; revision=45537
- Dissection of monitors config message (SPICE_DISPLAY_MONITORS_CONFIG message)
- Better dissection of capabilities (added several more capabilities for main
and display channels)
From me:
- Remove (now) unused variables.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7859
svn path=/trunk/; revision=45534
Label the data sources for reassembled fragments as "Reassembled
6LoWPAN".
Fix the capitalization of "6LoWPAN".
Also, label the data sources for decompressed fragments as "Decompressed
6LoWPAN xxx".
svn path=/trunk/; revision=45529
Label the data sources for them as "6LoWPAN xxx", where "xxx" is the
type of compression, and label the data sources for reassembled
fragments as "Reassembled 6LoWPAN".
Fix the capitalization of "6LoWPAN".
Note that if reassembly fails, continuing dissection is not the right
thing to do, at least not if it failed because we don't *yet* have all
the fragments.
svn path=/trunk/; revision=45527
Interface Information object for ICMP is *NOT* null-terminated. Use
tvb_format_text() for now, to properly null-terminate the display string
and to cope with non-ASCII data. (It should ultimately be a named field
with an encoding of UTF-8.)
svn path=/trunk/; revision=45525
Use a full 32-bit literal instead of just a 16-bit one. Fixes case where
the value we're &-ing with just slips over 2^16, making us get stuck
in an infinite loop.
I'm not sure this matches the iscsi spec anymore, the comment in the code
about padding bytes is ambiguous as to whether they're leading or trailing.
svn path=/trunk/; revision=45524
resolution information between capture files so that we don't leak host
entries from one file to another (e.g. embarassing-host-name.example.com
from file1.pcapng into a name resolution block in file2.pcapng).
host_name_lookup_cleanup and host_name_lookup_init must now be called
after each call to se_free_all. As a result we now end up reading our
various name resolution files much more than we should.
svn path=/trunk/; revision=45511
IPsec ESP: allow filtering by ICV verification result
Add hf_esp_icv_good and hf_esp_icv_bad (similar to IP checksums), to allow
filtering based on the ICV check results.
svn path=/trunk/; revision=45483
packet-smb.c does not handle truncated frames well when dealing with TRANS2 FIND_{FIRST/NEXT} responses
The current code simply throws an exception if any of the expected data is
missing, even though there might be several file's worth of data available.
I will attach a patch that does a better job of handling truncated frames in
such cases.
svn path=/trunk/; revision=45480
packet-smb.c does not correctly dissect INFO_QUERY_EAS_FROM_LIST
[MS-CIFS].pdf makes it clear that, contrary to what packet-smb.c says, handling
the response to a TRANS2/FIND_{FIRST,NEXT} with a level of
INFO_QUERY_EAS_FROM_LIST is not the same as handling INFO_QUERY_EA_SIZE.
svn path=/trunk/; revision=45479
Done on general principles altho upon inspection
none of the cases changed would have actually
resulted in an infinite loop.
svn path=/trunk/; revision=45478
The changes fix definite problems or
are done "just in case" for cases not esily determined
to be a problem by quick inspection.
Note: in some cases for loop index variables have been renamed
to ensure all required codes changes detected.
##backport
svn path=/trunk/; revision=45477
The changes fix possibly problematical cases
(not clear upon quick inspection).
Also: fix several bugs wherein an inner 'for' loop used
the same index variable name as an outer loop thus
messing up the outerloop.
##backport
svn path=/trunk/; revision=45476
../../../epan/dissectors/packet-giop.c: In function 'get_CDR_typeCode':
../../../epan/dissectors/packet-giop.c:3341:15: warning: variable 'ti' set but not used [-Wunused-but-set-variable]
../../../epan/dissectors/packet-giop.c: In function 'decode_ServiceContextList':
../../../epan/dissectors/packet-giop.c:3871:7: warning: variable 'temp_offset' set but not used [-Wunused-but-set-variable]
../../../epan/dissectors/packet-giop.c: In function 'dissect_giop_request_1_2':
../../../epan/dissectors/packet-giop.c:4443:10: warning: variable 'response_flags' set but not used [-Wunused-but-set-variable]
../../../epan/dissectors/packet-giop.c: In function 'get_giop_pdu_len':
../../../epan/dissectors/packet-giop.c:4837:81: error: unused parameter 'offset' [-Werror=unused-parameter]
svn path=/trunk/; revision=45473
Updated wireshark_gen.py to generate hf_ variables for all of the IDL "types". The "simple" types use proto_tree_add_* (not text), while the "complex" types use the GIOP dissector API. checkhf.pl generates some warnings because (some of) the hf_ variables are being generated for the "complex" types, but are not being used. That will be done in Part 2.
expert_add_info_format now linked to a real item instead of being attached to a duplicative proto_tree_add_text(). This cleaned up literally thousands of unnecessary proto_tree_add_text()s
svn path=/trunk/; revision=45472
I also did a small bit of cleanup dissection while I was there, but it could definitely use more. I just want to fix the fuzztest crash I discovered before the buildbots get a hold of it.
svn path=/trunk/; revision=45469
Done on general principles altho none of the cases
changed would have actually resulted in an infinite
loop because a Bounds error would eventually occur.
svn path=/trunk/; revision=45462
not "for (i = 1; i < N+1; i++)".
Even if it weren't the idiom, it'd be safer, at least for unsigned
values, as, if i and N are the same width, and N has the maximum
possible value for that width, the first of those runs i from 0 to N-1,
all of which fit in a variable of that width, and the second of those
runs i from 1 to N, the latter of which doesn't fit into a variable of
that width, so modulo arithmetic turns it into 0 and the loop keeps
running forever.
Fixes bug 7844.
svn path=/trunk/; revision=45459
*regardless* of whether errno is non-zero, so we at least report the
failure.
In the standalone test program built if TEST_DIAM_DICT_STANDALONE is
defined, check for ddict_scan() failing.
Part of fix for bug 7824.
svn path=/trunk/; revision=45452
wlan_mgt.ht.capabilities bits 8-15 incorrectly decoded (from wrong packet offset)
The bug is that the code defines the bit fields as 16 bit, but increments the
offset in-between decoding B0-B7 and B8-B15 which causes the wrong bits to be
decoded.
Also fix to change "Capability" to "Capabilities" to match spec
From me : Fix wrong length for A-MPDU
svn path=/trunk/; revision=45431
col_append_str(pinfo->cinfo, COL_INFO, ", with session description"); is redundant if some one has a different opinion fel free to revert.
svn path=/trunk/; revision=45428
Minor bugfixes to packet-msrp.c and packet-mrp-mvrp.c
Major updates to packet-ieee17221.c
Changes to ieee17221.c update dissector from draft revision 18 / 19 code to
draft revision 21.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7779
svn path=/trunk/; revision=45419
used for - it represents a memory pool that parcels out memory from
larger allocated chunks (reducing the number of individual malloc-style
calls that are made) and that can be freed in its entirety.
svn path=/trunk/; revision=45400
freeing the allocated array of pointers, not what the pointers ported
to, so it should free col_data. Note that it does that, and put it
after col_init() in the source file and header file.
Put in a comment explaining the MSVC bug that we're working around with
the casts.
svn path=/trunk/; revision=45393
and, if it is, it might be set to point to col_buf, which gets g_free()d
in the next statement, so we shouldn't g_free() it.
svn path=/trunk/; revision=45391
Cleans up the mask used for the "High" part of the sub-carrier modulation
to match (modulus the 4-bits shifting) the one used for the "Low" part.
svn path=/trunk/; revision=45382
Fix bug #7772: dissect only the number of active HomePlug AV subcarriers
The dissector currently dissects all 1156 sub-carriers available in the Tone
Map Characteristisc Confirmation frame no matter what is the number of active
ones.
This is not valid, because the frame only contains the number of active
sub-carriers, even though it is padded to 1156 sub-carriers. This is also an
issue for newest HomePlug AV devices with a 500Mbits/sec PHY rate, because
those will have up to 2690 sub-carriers, and we would only dissect the first
1156 active ones.
svn path=/trunk/; revision=45381
- ipv6.traffic_class.dscp use ext string so and need BASE_EXT_STRING flag (fix SIGSEGV)
- dscp_vals was removed from .h file, so make it static
- export dscp_vals_ext
svn path=/trunk/; revision=45380
Currently, when Wireshark encounters the first entropy-coded segment in a JPEG
file it stops dissection.
However, the design of the JPEG format allows to find the next marker even if
the entropy-coded segment is not decoded. Thus, a better strategy for Wireshark
would be to skip the entropy-coded segment and continue dissection at the next
marker.
svn path=/trunk/; revision=45363
state of errno. Don't treat it as a fatal parse error because it isn't,
so we keep parsing the rest of the dictionaries even if one is missing.
svn path=/trunk/; revision=45361
- If it's something as simple as a missing $INCLUDE then we probably still want
whatever we could parse
- We weren't doing it consistently anyways
- There were a whole bunch of places where we were using it regardless of
whether or not the parse failed, leading to read-after-free errors.
svn path=/trunk/; revision=45360
replaced in the key-set of the hash table. This doesn't really provide proper
behaviour, it just stops us from accessing freed memory.
Also, add modelines.
svn path=/trunk/; revision=45354
- proto_reg_handoff...() called only once: simplify;
- move proto_register...() to just before proto_reg_handoff...() as per convention;
- misc.
svn path=/trunk/; revision=45345
Change icmp request/response matching to be more aligned to other matching
strategies and use two tables. One table for first time we visit a packet
and a second table to track all confirmed matches.
svn path=/trunk/; revision=45343
variable because we were passing the address of a single guint8 as a
char*. Work around it by making the guint8 an array and filling the last
element with 0 as if it were a null-terminated string.
svn path=/trunk/; revision=45339
Ensure that the sub-type length is at least 2 (for sub-type and length fields).
Prevents an infinite loop when the length equals 0.
svn path=/trunk/; revision=45337
address type value of 0, and with zero bytes of address; handle it
explicitly, and don't treat it as an error.
In the sFlow dissectors, do all the checks for "is this an sFlow
packet?" *before* we do anything to the columns and the protocol tree.
svn path=/trunk/; revision=45329
in dissect_sflow_245_address_type(), don't reset the offset to 0 when
the address family is unkown
bring up an expert info instead and increment offset by the number of
bytes processed
svn path=/trunk/; revision=45324