Commit Graph

2591 Commits

Author SHA1 Message Date
Gerald Combs 5a8977acd2 Docbook: wslua_util → wslua_utility.
3bb40a586d renamed wslua_util.c to wslua_utility.c. Update
docbook/wsluarm.adoc to match.
2022-07-24 18:09:50 +00:00
Gerald Combs 3bb40a586d wslua: Rename wslua_util.c to wslua_utility.c.
Rename wslua_util.c to wslua_utility.c so that our file name has the
form "wslua_<lower case lua module name>.c", which is the case for our
other modules.
2022-07-24 17:11:57 +00:00
Gerald Combs e68db21421 docbook: Add file comments to wsluarm.
Add a comment to each class and function noting which C file it is
defined in.
2022-07-24 17:11:57 +00:00
Gerald Combs 49dda8c71e Make Perl optional.
Update our documentation, build configuration, and setup scripts to make
Perl optional.
Closes #18152.
2022-07-23 21:12:25 +00:00
Gerald Combs a1c83a901b docbook: Port make-wsluarm to Python3
Port the script that creates docbook/wsluarm_src/*.adoc to Python3.
Ping #18152.
2022-07-23 20:51:24 +00:00
Jirka Novak 1e53e49a54 ciscodump: Added support for IOS XE and ASA
Changes:
- The tool now recognizes which software is running on a device - IOS, IOS XE
  or ASA. Based on it, it uses correct sequence of commands to setup
  capture, read captured packets and clear the capture.
- The tool reads packets on the fly so you don't have to wait till
  --remote-count of packets is reached.
- The tool reads timestamps from capture on the device for IOS and ASA (on
  IOS-XE, there is no timestamp in dump).
- Except Windows platform the tool handles early stop of capture on the device
  and clear of capture buffer on the device (it finish the capture).
- There are special interface names to allow the tool to generate
  specific capture types.
- Documentation updated.

Closes #17672.
2022-07-22 15:55:28 +00:00
Gerald Combs a113fd5c7b wslua: Remove unneeded empty lines from our markup. 2022-07-21 15:36:35 -07:00
Roland Knall 5991a75d78 ReleasNotes: Add minimum version requirements
Adding an explanation on minimum required versions to the release
notes, as well as bumping c-ares to version 1.14.0

The previous minimum (1.5.0) has been released in 2008. The new
version has been choosen to correlate with those distros, that
also provide a minimum version of Qt5 higher than 5.9, as 5.9
is no longer supported in the main branch
2022-07-21 12:37:17 +00:00
Gerald Combs fbadb8c785 wslua: Capitalize words in our markup.
Capitalize words in our markup instead of depending on make-wsluarm.pl.
Add a single space after "Mode:".
2022-07-20 14:52:40 -07:00
Ferry Huberts 0a42b0976b Locamation Interface Module dissector for IM1
Signed-off-by: Ferry Huberts <ferry.huberts@pelagic.nl>
2022-07-20 06:25:51 +00:00
Roland Knall 7935734d61 ReleaseNotes: add maxminddb improvement
Add note about the improvement for maxminddb

[skip ci]
2022-07-16 15:38:59 +00:00
João Valverde 7bea636cd4 WSUG: Add display filter arithmetic operators 2022-07-15 00:11:38 +01:00
João Valverde 97ce9845c3 WSUG: Fix a heading level 2022-07-14 23:36:39 +01:00
João Valverde d5ec420bb5 WSUG: Add a note about the changes to "!=" 2022-07-14 23:29:08 +01:00
João Valverde 4c975b770e dfilter: Improve compatibility of integer types
Before:

$ dftest '_ws.ftypes.int64 == _ws.ftypes.int8'
Filter: _ws.ftypes.int64 == _ws.ftypes.int8
dftest: _ws.ftypes.int64 and _ws.ftypes.int8 are not of compatible types.
	_ws.ftypes.int64 == _ws.ftypes.int8
	                    ^~~~~~~~~~~~~~~

After:

$ dftest '_ws.ftypes.int64 == _ws.ftypes.int8'
Filter: _ws.ftypes.int64 == _ws.ftypes.int8

Syntax tree:
 0 TEST_ANY_EQ:
   1 FIELD(_ws.ftypes.int64 <FT_INT64>)
   1 FIELD(_ws.ftypes.int8 <FT_INT8>)

Instructions:
00000 READ_TREE		_ws.ftypes.int64 <FT_INT64> -> reg#0
00001 IF_FALSE_GOTO	5
00002 READ_TREE		_ws.ftypes.int8 <FT_INT8> -> reg#1
00003 IF_FALSE_GOTO	5
00004 ANY_EQ		reg#0 === reg#1
00005 RETURN
2022-07-14 20:12:30 +00:00
Uli Heilmeier 51bf87a641 WSUG: Fix typo 2022-07-13 16:45:00 +00:00
Moshe Kaplan 87ca8c227a tools: Port make-version.pl to Python 2022-07-11 14:44:23 +00:00
Gerald Combs 75efbb1ac4 Rename Logwolf to Logray
Switch to the name "Logray" for the log analyzer. Rays are biological
cousins of sharks and more people like the name "Logray" in a completely
unscientific survey here. Apologies for any inconvenience this might
cause.
2022-07-06 15:04:25 +00:00
João Valverde a877f2d5f3 dfilter: Allow existence check for slices
Allow checking if a slice exists. The result is true if the
slice has length greater than zero.

The len() function is implemented as a DFVM instruction instead.
The semantics are the same.
2022-07-04 22:45:14 +00:00
Gerald Combs ff36056573 [Automatic update for 2022-07-03]
Update manuf, services enterprise numbers, translations, and other items.
2022-07-04 21:30:14 +00:00
João Valverde b10db887ce dfilter: Remove unparsed syntax type and RHS literal bias
This removes unparsed name resolution during the semantic
check because it feels like a hack to work around limitations
in the language syntax, that should be solved at the lexical
level instead.

We were interpreting unparsed differently on the LHS and RHS.
Now an unparsed value is always a field if it matches a
registered field name (this matches the implementation in 3.6
and before).

This requires tightening a bit the allowed filter names for
protocols to avoid some common and potentially weird conflicting
cases.

Incidentally this extends set grammar to accept all entities.
That is experimental and may be reverted in the future.
2022-07-02 11:18:20 +01:00
Roland Knall 799a033080 ReleaseNotes: Correct some spellings and wordings
Fixes #18161

[skip ci]
2022-06-29 10:19:20 +02:00
Gerald Combs 7c96053f3b Version: 3.7.1 → 3.7.2
[skip ci]
2022-06-27 12:10:57 -07:00
Gerald Combs 5ee0b97c96 Build: 3.7.1
[skip ci]
2022-06-27 10:05:04 -07:00
João Valverde aaff0d21ae dfilter: Add layer support for references
This adds support for using the layers filter
with field references.

Before:
    $ dftest 'ip.src != ${ip.src#2}'
    dftest: invalid character in macro name

After:
    $ dftest 'ip.src != ${ip.src#2}'
    Filter: ip.src != ${ip.src#2}

    Syntax tree:
     0 TEST_ALL_NE:
       1 FIELD(ip.src <FT_IPv4>)
       1 REFERENCE(ip.src#[2:1] <FT_IPv4>)

    Instructions:
    00000 READ_TREE		ip.src <FT_IPv4> -> reg#0
    00001 IF_FALSE_GOTO	5
    00002 READ_REFERENCE_R	${ip.src <FT_IPv4>} #[2:1] -> reg#1
    00003 IF_FALSE_GOTO	5
    00004 ALL_NE		reg#0 != reg#1
    00005 RETURN

This requires adding another level of complexity to references.
When loading references we need to copy the 'proto_layer_num'
and add the logic to filter on that.

The "layer" sttype is removed and replace by a new
field sttype with support for a range. This is a nice
cleanup for the semantic check and general simplification.
The grammar is better too with this design.

Range sttype is renamed to slice for clarity.
2022-06-25 14:57:40 +01:00
João Valverde e9e6431d7b dfilter: Change boolean string representation
Use "True" or "TRUE" instead of "true" and remove case insensivity.
Same for false. This should serve to differentiate booleans a bit
more from protocol names, which should be using lower-case.
2022-06-25 13:02:34 +01:00
Chuck Craft ff4663931c wsdg: docbook\README.adoc - filename 2022-06-22 16:27:21 +00:00
Gerald Combs 3d52693eaa Qt+docs: Capitalize JSON.
JSON is an abbreviation and should be displayed in all caps.
https://www.json.org/json-en.html
2022-06-21 17:24:27 +00:00
João Valverde 354e0d7edf dfilter: Add support for unicode escape sequences
Add support for entering unicode codepoints as \uNNNN or \uNNNNNNNN
for strings and charconsts (following the C standard).
2022-06-21 16:54:16 +01:00
João Valverde 47348ae598 dfilter: Add support for literal strings with null bytes
Before:
    Filter: frame matches "abc\x00def"
    dftest: \x00 (NUL byte) cannot be used with a regular string.
    	frame matches "abc\x00def"
    	                  ^~~~
    Filter: _ws.ftypes.string == "a string with a \0 byte"
    dftest: \0 (NUL byte) cannot be used with a regular string.
    	_ws.ftypes.string == "a string with a \0 byte"
    	                                      ^~

After:
    Filter: frame matches "abc\x00def"

    Syntax tree:
     0 TEST_MATCHES:
       1 FIELD(frame)
       1 PCRE(abc\0def)

    Instructions:
    00000 READ_TREE		frame -> reg#0
    00001 IF_FALSE_GOTO	3
    00002 ANY_MATCHES	reg#0 matches abc\0def
    00003 RETURN

    Filter: _ws.ftypes.string == "a string with a \0 byte"

    Syntax tree:
     0 TEST_ANY_EQ:
       1 FIELD(_ws.ftypes.string)
       1 FVALUE("a string with a \0 byte" <FT_STRING>)

    Instructions:
    00000 READ_TREE		_ws.ftypes.string -> reg#0
    00001 IF_FALSE_GOTO	3
    00002 ANY_EQ		reg#0 == "a string with a \0 byte" <FT_STRING>
    00003 RETURN

Fixes issue #16156.
2022-06-21 15:10:08 +00:00
Roland Knall 847795d381 Qt: Add stream number to conversations
Adding the stream id to UDP/TCP conversations and allowing
filtering on those values as well.

Fixes: #14184
2022-06-21 10:01:18 +02:00
Gerald Combs 058fe0dd09 [Automatic update for 2022-06-19]
Update manuf, services enterprise numbers, translations, and other items.
2022-06-19 16:40:16 +00:00
Roland Knall 2b4878d452 Qt: Hide columns for traffic tree
Allow columns to be hidden for the traffic tree dialogs
Conversations and Endpoints and store the information profile
specific
2022-06-19 16:39:35 +02:00
Gerald Combs efe8dc051c Prefs: Change the default UI layout to type "2".
Make the default UI layout "packet list on top, packet detail and bytes
side by side". This is more space efficient on modern displays and is
the first thing I change when using the default profile.
2022-06-18 12:36:18 +00:00
Roland Knall c5aa352ad4 docbook: Adapt releasenotes for openSafety and AT_NUMERIC
[skip ci]
2022-06-17 13:57:12 +02:00
Chuck Craft d008708552 editcap/mergecap: swap 'v'|'V' options to match other CLI utilities
Closes #18134
2022-06-16 02:13:50 +00:00
Gerald Combs 572e6b0c10 Docs: Add some protocols to the release notes. 2022-06-15 11:49:40 -07:00
Roland Knall 1272b62106 Docs: Update documentation for redesigned Traffic Tabs
Update the documentation to document the change of features
that happen during the redesign of the UI as well as fix some
wordings in the data model.
2022-06-14 21:33:26 +00:00
Chuck Craft 208cf56b75 ip: ip.flags field are 3 high bits not full byte
See https://ask.wireshark.org/question/27546/0x01-flag-on-last-of-fragmented-packets/
2022-06-14 20:28:17 +00:00
Roland Knall a4f25e5115 Qt: Redesign TrafficTree Dialogs UI
The new UI should better group functionality and as well as better
showing which taps are available and can be used.
2022-06-14 09:36:30 +00:00
Uli Heilmeier 9d17919f2a WSUG: Typo
Add a missing comma
2022-06-13 16:47:26 +00:00
Roland Knall 0cfe7a0d56 Qt: Better sorting for traffic dialogs
Allow the traffic columns to automatically sort on secondary columns if
applicable. e.g. the address and port column for TCP and UDP, or the
secondary address for conversations
2022-06-13 13:50:50 +02:00
Roland Knall bcb8558be2 Docs: Update release notes
Add note about the change for tap_packet_cb

[skip ci]
2022-06-10 21:05:47 +02:00
Gerald Combs d047a18e83 Docs: Update the release notes.
Rearrange and update a few items.

[skip ci]
2022-06-10 10:53:04 -07:00
Roland Knall cbed7f8013 docbook: Add Releasenotes for traffic column 2022-06-10 16:31:52 +02:00
Roland Knall 2cf938cfa8 tap: Adding flags for tap_packet
This allows flags to be passed by the registering listener
to the collection of information
2022-06-10 05:46:15 +00:00
Gerald Combs de1a4c3774 CMake: Update package target names.
Rename the rpm-package target to wireshark_rpm and the appimage target
to wireshark_appimage.
2022-06-08 17:56:21 +00:00
Jaap Keuter fe4210029a Qt: Reword menu item Seconds Since Beginning of Capture 2022-06-05 23:55:59 +00:00
Gerald Combs 2ac2b0670a Git+CMake: Add support for CMake presets.
CMake 3.19 added support for CMakePresets.json and
CMakeUserPresets.json, which let you prepopulate various configure,
build, and test options. Add CMakeUserPresets.json to .gitignore as
recommended by the documentation and add an example to the Developer's
Guide. CMake uses 2-space indentation; specify that for CMake*.json in
.editorconfig.
2022-06-05 13:04:07 -07:00
Roland Knall b06c1c451c Qt: Make TrafficTable detachable
Allow the endpoint and conversation dialogs to have detachable
tabs. At the same time move the tree functionality to a subclass
to better be able to handle the context menu when detached.

Right now, still a lot of tree stuff is in the tabwidget, but
could be moved to the tree for the future
2022-06-04 21:28:05 +02:00