Commit Graph

118 Commits

Author SHA1 Message Date
Michael Mann bb5d0317d6 Fix merge cruft from release-notes.adoc
Change-Id: Id33135d82f30f0d88910b994492b4a64ac170d84
Reviewed-on: https://code.wireshark.org/review/38105
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-08-10 04:52:21 +00:00
Alexis La Goutte f5a8c08b12 Add FSSO (Fortinet Single Sign-On) Dissector
It is send from DCAgent to FSSO collector using UDP 8002 packet
It is based on analysis of protocol (and log)

Bug: 16657
Change-Id: I2e23a403a103c25820d714446d4e3245af04e876
Reviewed-on: https://code.wireshark.org/review/37547
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-08-08 09:56:03 +00:00
Dario Lombardo a60bc4da84 sshdump: allow for multiple instances.
sshdump can now be copied in multiple instances. Each instance will
show up a different interface and will have its own profile.

This will help users connecting to different hosts. Instead of changing
profiles, sshdump can be cloned, and each instance will be used for a
single host.

Change-Id: If4fb42cf78021c6f16213ae91cbf41ec7f61ca77
Reviewed-on: https://code.wireshark.org/review/37883
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-07-18 04:04:59 +00:00
Dr. Lars Völker 916550de96 TECMP: Adding support for the TECMP protocol
The Technically Enhanced Capture Module Protocol (TECMP) allows the
transport of data recorded on different technologies (e.g. Ethernet,
CAN, LIN, FlexRay). A typical usage scenario is data recording in
vehicles, e.g. for validating and testing autonomous driving.

Bug: 16661
Change-Id: If7c08529049cc1d30d9a5640b4216eac83546800
Reviewed-on: https://code.wireshark.org/review/37610
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-07-02 06:20:27 +00:00
Stig Bjørlykke 9a1a5fd22a Qt: Add copy from another profile for Decode As
Add a new button to the Decode As dialog to copy entries from
another profile.

Change-Id: Ia04edd063bd2eba14b2b14acfd53b03111646f7e
Reviewed-on: https://code.wireshark.org/review/37616
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2020-07-02 06:13:27 +00:00
Jeffrey Nichols 526a9a64ee New dissector: Asphodel Protocol
Add a dissector for Asphodel (https://bitbucket.org/suprocktech/asphodel).
Asphodel is a protocol for streaming real-time data from sensors in industrial
environments. This protocol dissector supports complete dissection of the UDP
advertisment packets, and simple dissection of the TCP command and stream data.

Sample Capture:
https://wiki.wireshark.org/SampleCaptures#Asphodel_Protocol

Change-Id: I6a7f730a4ce5349ac48b4fd86e61429983af5bf9
Reviewed-on: https://code.wireshark.org/review/37318
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2020-06-15 19:18:14 +00:00
Indraneel Guha 5634eb64b6 LBMSRS: Dissector for LBMSRS protocol dissector
This is the dissector for the LBMSRS protocol which
comes under the 29West protocol suite

Bug: 16466 - LBMSRS sample capture file uploaded in this bug
Change-Id: I7458783f8cff5179064fbd68e910c162db1c5fd7
Reviewed-on: https://code.wireshark.org/review/36917
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-04 18:00:50 +00:00
Uli Heilmeier 99ecab4122 New dissector: Dynamic Link Exchange Protocol
Code based on https://github.com/mit-ll/dlep-wireshark-dissector
authored by Jeffrey Wildman <jeffrey.wildman@ll.mit.edu>

Updated types according to
https://www.iana.org/assignments/dlep-parameters/dlep-parameters.xhtml

Changed:
* removed some tvb_get_*() calls
* updated expert info handling
* changed registering the dissector

Sample capture:
https://wiki.wireshark.org/SampleCaptures#Dynamic_Link_Exchange_Protocol_.28DLEP.29

Change-Id: I13e0c918f46af036c1be4acf34acab838aeaf342
Reviewed-on: https://code.wireshark.org/review/36901
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-04-28 06:13:10 +00:00
Piotr Sarna 6d0863eecb dissectors: add ScyllaDB dissector
This commit adds a basic dissector for ScyllaDB RPC protocol.
ScyllaDB (www.scylladb.com) is a No-SQL database serving multiple
client protocols (e.g. CQL). The newly introduced dissector
provides a way to inspect Scylla's internal protocol, used by
the nodes to communicate with each other - share data, gossip
the cluster state, update the schemas, etc.
This dissector implements only a shallow dissection of most packets,
i.e. recognizing the packet type. Two requests with deeper dissection
are MUTATION and READ_DATA, used by I/O operations in the database.

Bug: 16471
Change-Id: Ibba8262bd4e5a637b24b3e7846c42c6534ef811b
Signed-off-by: Piotr Sarna <sarna@scylladb.com>
Reviewed-on: https://code.wireshark.org/review/36633
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2020-04-27 14:06:05 +00:00
Eugene Adell 3a42f536ed JDWP dissector for TCP transport
Bug: 16479
Change-Id: I2618bb4b664c1dd7b4663c368b6ca99ec0533dd5
Reviewed-on: https://code.wireshark.org/review/36636
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-04-22 07:23:37 +00:00
Martin Kaiser 778555795e Add a dissector for the USB printer class.
Start dissecting the class-specific control messages.

Change-Id: I21e97777c9fc0396a8c0c575ba21909f58bbb577
Reviewed-on: https://code.wireshark.org/review/36539
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-03-26 09:05:17 +00:00
Mikael Kanstrup c583304dd5 Add TEAP dissector
Initial support for TEAP (Tunnel Extensible Authentication Protocol)
defined in RFC7170.

Only partial support implemented. Mainly the parts needed to discover
the carried EAP payload when establishing IEEE802.11 EAP-TEAP
connections.

Bug: 16379
Change-Id: Ic2b31d0b871b430792a371cd09926811e350c32b
Reviewed-on: https://code.wireshark.org/review/36104
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-02-27 04:28:49 +00:00
Orgad Shaneh 32679c14be Introduce AudioCodes Debug Recording (ACDR) dissector
ACDR is a protocol over UDP that is used by AudioCodes devices for
recording traffic to and from the device.

It adds a header to each packet that contains extra data about the packet.

For some packet types (like SIP), it also appends the IP and UDP/TCP
headers of the sent/received packet.

The dissector unwraps the ACDR header, and displays the packets with the
original type (and when available, with the original addresses).

Bug: 16275
Change-Id: I19ad90053a2ef73da80881dc5e94aa362de23ea3
Reviewed-on: https://code.wireshark.org/review/35417
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2020-02-13 23:26:15 +00:00
Martin Mathieson 26be041184 Add dissector for OBSAI UDPCP protocol
Change-Id: I6ca615207ca3a8f52f9886b2da74dcc6d5777987
Reviewed-on: https://code.wireshark.org/review/36036
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-02-06 07:24:17 +00:00
Jirka Novak 12a13a6926 RTP: decode iLBC payload
It is possible to decode iLBC payload. It uses libilbc library (https://github.com/TimothyGu/libilbc).

Bug: 16314
Change-Id: Id4cad7ae32305a0e94ef32beb24e07733d7f834e
Reviewed-on: https://code.wireshark.org/review/35686
Reviewed-by: João Valverde <j@v6e.pt>
Petri-Dish: Pascal Quantin <pascal@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-01-20 07:50:08 +00:00
Joerg Mayer 3f17a8948f Add Cisco Miscabling Protocol
Change-Id: Iab98bfeb2ab8aa2314e74ff4330b85e7f6533a48
Reviewed-on: https://code.wireshark.org/review/35116
Petri-Dish: Jörg Mayer <jmayer@loplof.de>
Tested-by: Petri Dish Buildbot
Reviewed-by: Jörg Mayer <jmayer@loplof.de>
2020-01-11 16:49:21 +00:00
Gerald Combs 3c5480a2c0 Docbook: Fix some file permissions.
Make the release notes and some PNGs non-executable.

Change-Id: Iecd52e782258f6d7a485138f8f965b7dce52a0dc
Reviewed-on: https://code.wireshark.org/review/35689
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2020-01-07 23:39:51 +00:00
Huang Qiangxiong 623b347d1e Protobuf: add dissecting protobuf fields as wireshark fields preferences, etc.
Two enhancements and one fixed bug:

1. Add dissecting protobuf fields as wireshark (header) fields preferences. User
can input the full names of protobuf fields or messages in Filter toolbar for
searching.

2. Add 'protobuf_field' dissector table. Dissector based on protobuf can register
itself to 'protobuf_field' keyed with the full names of fields of BYETS or STRING
types.

3. A bug about search MESSAGE or ENUM type in context is fixed.

4. Another small enhancement is adding prefs_set_preference_effect_fields() which
can mark a preference that affects fields change (triggering FieldsChanged event).

See the linked bug for sample capture file and .proto files.

Ping-Bug: 16209
Change-Id: Ibc3c45a6d596a8bb983b0d847dd6a22801af7e04
Reviewed-on: https://code.wireshark.org/review/35111
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-12-19 05:04:17 +00:00
Gerald Combs 2cbd844bd1 Release notes: Bump the next version.
Change-Id: If5b947aff4031957347f946486bbdab043ec4532
Reviewed-on: https://code.wireshark.org/review/35495
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-12-18 18:30:58 +00:00
Gerald Combs 451a241e50 Add c-ares to the required library list.
Although c-ares support was techically optional, it was either on by
default or required in all of our packaging. Go ahead and require it
globally. C-ares is widely available and synchronous name resolution can
easily result in a horrific user experience.

Change-Id: Id67c797316ed6b8a0ab5052e55a43a1b9e2a2464
Reviewed-on: https://code.wireshark.org/review/35188
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-11-23 22:45:59 +00:00
Jirka Novak 37f3c65ca5 rtp_analysis_dialog.cpp: save any supported codec as .au
Change improves Wireshark ability to save rtp streams. It allows a user
to save any supported codec with 8 kHz rate. In real, it means G.711 and
G.729 for now.
There is no hardcoded codec limitation during save anymore. If code detects
unsupported codec or rate during save, it replaces samples with silence and
reports it. Therefore any added codec in future will be supported.

Note to RTP saving:
RTP streams (there can be up to two of them for save) can contain multiple
codecs in each direction - some of it can be supported and some
unsupported. What should be exported then?
Till my patch save do not run and a user received nothing even part of stream
was OK/encoded with supported codec.
Therefore I managed the code to start with export and do its best.
Unknown codec/part is replaced with silence and user is warned after
export. Therefore a user will get:
a) audio - when all codecs are supported (no warning)
b) mix audio/silence - when some codecs are supported (warning)
c) only silence - when no codec is supported (warning)

BTW same output user sees/gets in RTP player for years.

Change-Id: Id938d419f5841af46d2d2d3ddfaf1ec9a0235bcc
Reviewed-on: https://code.wireshark.org/review/35105
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
2019-11-21 16:06:49 +00:00
Gerald Combs beb1fee658 3.1.0 → 3.3.0.
Change-Id: Ia6217b00741f824b1f6805eb406408802dd5b5a8
Reviewed-on: https://code.wireshark.org/review/35167
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-11-20 23:33:02 +00:00
Gerald Combs f2ca15bfa2 Release notes: Update the new protocol list.
Update the new protocol list and clarify our Qt versions.

Change-Id: If4d5e591b4419cc3171616825201375fdc5401aa
Reviewed-on: https://code.wireshark.org/review/35165
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-11-20 18:59:15 +00:00
Roland Knall 6d8355e7de ReleaseNotes: Add info about "Expressions"
They no longer reside to the right of the display filter toolbar, but
have been moved to Analyze->Display Filter Expressions... as well as
the context menu of the display filter edit

Change-Id: I5afb87a483838204be33f5b8b965643c2c95e306
Reviewed-on: https://code.wireshark.org/review/35151
Reviewed-by: Roland Knall <rknall@gmail.com>
2019-11-20 08:56:05 +00:00
Tomasz Moń 4e77ca61d9 docbook: Add USB 2.0 Link Layer to release notes
Change-Id: Ifb87e70b89f63fc633660924b730b73156872580
Reviewed-on: https://code.wireshark.org/review/35139
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2019-11-20 06:39:05 +00:00
Gerald Combs ae58402e14 3.1.1 → 3.1.2.
Change-Id: Id89e46103f61392653cfdc60ef16d11123fe0928
Reviewed-on: https://code.wireshark.org/review/35128
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-11-18 20:12:27 +00:00
Gerald Combs 5169b9f3bc Build 3.1.1.
Change-Id: I007d9e6c6b0562e727673787e6c27efd6a2f6269
Reviewed-on: https://code.wireshark.org/review/35125
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-11-18 19:03:24 +00:00
Roland Knall 1ddd30856d ReleaseNotes: Multi-selection of packets
Change-Id: I0003b0785aec17d6cb86f1020836f5caf07c9d08
Reviewed-on: https://code.wireshark.org/review/35089
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Reviewed-by: Roland Knall <rknall@gmail.com>
2019-11-17 12:21:28 +00:00
Gerald Combs 02057200fd macOS: Add support for automatic updates using Sparkle.
Add support for automatic updates using the Sparkle framework. Add
FindSparkle.cmake and associated CMake plumbing. Add a public key and
other info to Info.plist.in. Add ui/macosx/sparkle_bridge.{h,m}, which
wraps the Sparkle API. Make code that's specific to WinSparkle
Windows-only.

Add Sparkle installation steps to the macos-setup scripts. Sparkle
prints a warning if your bundle is unsigned (which is the case during
development) so disable installing it by default.

Updating here takes a long time. We might be able to fix that by
shipping our DSYMs separately.

Change-Id: I6cc6671db5657dadc514bda6bf6e1c8bbc9468a5
Reviewed-on: https://code.wireshark.org/review/35090
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-11-15 18:39:04 +00:00
Gerald Combs 766f231da6 Release notes: Add an item about following HTTP/2 and QUIC.
Change-Id: If3078136aa6996fda04eb4f18f36f142f7d18b1f
Reviewed-on: https://code.wireshark.org/review/35075
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-11-13 05:19:39 +00:00
Roland Knall 0e64e9f3ca extcap: Allow loading of extcap files from personal directory
Allow the storage of extcap plugins in the personal directory and
enable loading from there. It will also take precedence of any
system-wide extcaps with an identical name

Change-Id: Ib88e09a26c4f99cf5e793327f2808c7445c6b1b5
Reviewed-on: https://code.wireshark.org/review/34988
Reviewed-by: Roland Knall <rknall@gmail.com>
2019-11-05 16:57:09 +00:00
Roland Knall a802000a2e Qt: Allow action buttons to be left-aligned
Buttons can be left-aligned in the display filter edit bar, by selecting
the corresponding option from the context menu

Bug: 14123
Change-Id: I18b48bb0ea43a598b2e309dcad9210463be06414
Reviewed-on: https://code.wireshark.org/review/34980
Reviewed-by: Roland Knall <rknall@gmail.com>
2019-11-05 16:56:33 +00:00
Roland Knall a218460e22 Qt: IOGraph display filter graph added
Add a graph for the currently display filter if none exists, upon
opening IOGraph

Change-Id: Ic25b014484898dd1917b13f2616fd519e2e8183b
Reviewed-on: https://code.wireshark.org/review/34984
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
2019-11-05 15:50:50 +00:00
Huang Qiangxiong 0b0bbb8060 HTTP2/gRPC: Support streaming mode reassembly
If working in streaming RPC mode, many grpc messages will be
contained in one http2 stream, the stream will end very late
(for example ETCD watch stream).

So we could not rely on old http2 reassembly mode which call
sub-dissector only END_STREAM appeared. We need a reassembly
mode that call subdissector which support streaming mode as
soon as the message in STREAM is available.

Please refer to comments of
reassemble_http2_data_according_to_subdissector() function
of epan/dissectors/packet-http2.c for more detail.

See the linked bug for streaming mode gRPC capture files.

Ping-Bug: 16160
Change-Id: Id9e5337a0e3ca9f8c8119d74d2c1fe4cc263afc3
Reviewed-on: https://code.wireshark.org/review/23988
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2019-11-03 16:43:39 +00:00
Gerald Combs 530c30e8a8 Docs: Try to make our "drag and drop" usage more consistent.
Apple uses "drag and drop" and "drag-and-drop":
https://developer.apple.com/design/human-interface-guidelines/macos/user-interaction/drag-and-drop/
https://support.apple.com/guide/mac-help/drag-and-drop-items-mh35852/mac
https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/DragandDrop/DragandDrop.html

So does Microsoft:
https://docs.microsoft.com/en-us/windows/win32/com/drag-and-drop

Qt and KDE use "drag and drop":
https://doc.qt.io/qt-5/dnd.html
https://docs.kde.org/stable5/en/applications/konsole/drag-and-drop.html

GTK+ and GNOME uses "drag-and-drop"
https://developer.gnome.org/gtk-tutorial/stable/c1899.html

Wikipedia uses "drag and drop" and "drag-and-drop"
https://en.wikipedia.org/wiki/Drag_and_drop

Let's go with "drag and drop" (and "dragging and dropping") in the
release notes and User's Guide.

Change-Id: I5010478e5d15928a3a8a7528296c3f5cdc98f3ab
Reviewed-on: https://code.wireshark.org/review/34921
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
2019-11-03 13:15:33 +00:00
Gerald Combs dc3cdf87a5 Release notes: We're building with VS 2019 on Windows.
Change-Id: I5fd3f6546419aa5906cbc3def2be175989fa0e4b
Reviewed-on: https://code.wireshark.org/review/34858
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-10-25 16:11:32 +00:00
Gerald Combs e76f518913 Release notes: Remove an item.
The recent macOS installer changes were backported to master-3.0, so
they're no longer new in master.

Change-Id: I357e0f8facbc2266c3780bcf8d696b5c2b00602d
Reviewed-on: https://code.wireshark.org/review/34745
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-10-08 18:04:32 +00:00
Huang Qiangxiong 5750c4981c protobuf: add support for Protocol Buffers Language (*.proto) files
1. A C-style Protocol Buffers Language (PBL) parser for *.proto file is added.
It contains protobuf_lang_scanner.l (lex scanner), epan/protobuf_lang.y (grammar
parser), and protobuf_lang_tree.h/c (grammar tree implementation).

2. The protobuf-helper.h/cpp is an interface wrapper layer. If one day C++ is allowed,
we can create a protobuf-helper.cpp file, which using offical protobuf C++
library, to replace protobuf-helper.c. That keeps packet-protobuf.c unchanged.

3. User can specify protobuf search paths, and the UDP ports to protobuf message type
maps at the Protobuf protocol preferences.

4. Other dissectors can pass the message type to Protobuf dissector by data parameter
or pinfo->private_table["pb_msg_type"] (pinfo.private["pb_msg_type"] in lua).

Some Sample of GRPC with Protobuf captures can be found in Bug: 13932.

Bug: 13932
Change-Id: Ife16c2f7b381296f8db4740dabe5f8362a456f48
Reviewed-on: https://code.wireshark.org/review/22892
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-10-07 10:35:52 +00:00
Dr. Lars Völker 3aeaf5c6fc SOMEIP: Adding support for the SOME/IP protocol.
The Scalable service-Oriented MiddlewarE over IP (SOME/IP) is the
standard communication middleware for IP and Ethernet based
communication. It supports Service Discovery, RPC, Pub/Sub, and more.

Bug: 16014
Change-Id: Ifd6549818ccc87f376a5fb9ba1d6c335818c6e00
Signed-off-by: Dr. Lars Völker <lars.voelker@bmw.de>
Reviewed-on: https://code.wireshark.org/review/34497
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-09-26 04:01:33 +00:00
Gerald Combs ac4f3c0f4d macOS: Make Wireshark.app drag-installable.
Create ChmodBPF installer and uninstaller packages using pkgbuild and
productbuild. Place them in Wireshark.app/Resources/Extras.

Add a path_helper installer and uninstaller which respectively add and
remove /etc/*paths.d/Wireshark.

Remove the PackageMaker and utility-launcher assets and build targets.

Show a message in the main welcome screen if we don't have capture
permissions. Add an link which launches the ChmodBPF installer.

Add a "macOS Extras" item to About → Folders.

Migrate "Read me first" from RTF to Asciidoctor, which lets us add links
and looks like our other documentation.

Rename dmg_set_style.scpt to arrange_dmg.applescript and make it plain
text. Always run it in osx-dmg.sh.

Bug: 6991
Bug: 12593
Bug: 11399
Ping-Bug: 16074
Change-Id: I7b6aa89aae2be522b4141b0d44e8142dec749e90
Reviewed-on: https://code.wireshark.org/review/31047
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-09-25 16:26:31 +00:00
Gerald Combs 72eb4e5b26 WSUG: Packet list and detail context menu updates.
Update some of the packet list and detail context menu items.

Add a release note entry noting the new Apply/Prepare behavior and
update some other items.

Change-Id: I3c2336a3f438f2d97bdb4df764e2af78a3499d81
Reviewed-on: https://code.wireshark.org/review/34543
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-09-16 22:40:30 +00:00
Dr. Lars Völker d963b312d0 DLT: Adding support for the DLT protocol
The Diagnostic Log and Trace protocol (DLT) is a commonly used and
standardized protocol in the automotive industry used to retrieve
log data. This patch adds the protocol to Wireshark. Keep in mind
that ports have to be configured before the dissector can be used.

Change-Id: I24592705476fb0c3bb83a1cc10b3dae8867523f4
Signed-off-by: Dr. Lars Völker <lars.voelker@bmw.de>
Reviewed-on: https://code.wireshark.org/review/34462
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-09-10 03:56:28 +00:00
Roland Knall d56ad090fb Qt: in EnabledProtocolsDialog handle protocol type
Allow a selection of the list based on the protocol type. That way
one can easily enable/disable for instance just heuristic protocols

Change-Id: I1ee8df5d9887c764272ec55b33703855c0c91f5a
Reviewed-on: https://code.wireshark.org/review/34442
Reviewed-by: Roland Knall <rknall@gmail.com>
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-09-04 06:45:00 +00:00
Ido Schimmel a94a860c06 net_dm: Add dissector for drop monitor netlink packets
The Linux kernel includes a module called drop monitor which -
unsurprisingly - monitors packet drops.

Once enabled, the module will periodically send netlink notifications to
user space over generic netlink. Historically, these notifications only
included the program counter where the drop occurred and the number of
packets that were dropped in this location in the last interval.

Patches in net-next (queued for Linux kernel 5.4) extend drop monitor
with another mode of operation where the dropped packets themselves are
sent to user space along with relevant metadata as netlink
notifications. This allows users to perform a more detailed analysis of
the dropped packets.

This patch adds a dissector for these netlink packets. The dissector is
expected to be invoked by the generic netlink dissector and during its
hand off routine it adds an entry in the 'genl.family' dissector table.

The various netlink attributes are dissected by calling
dissect_netlink_attributes(), in a similar fashion to the rtnetlink
dissector. The dropped packet itself is encoded in the netlink attribute
'NET_DM_ATTR_PAYLOAD' and dissected by invoking a dissector from the
'sll.ltype' dissector table based on the packet's protocol which is
encoded in the 'NET_DM_ATTR_PROTO' attribute.

Bug: 16018
Change-Id: I10bfa4b9c9d8f5e82769c250f929f74693142a23
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reviewed-on: https://code.wireshark.org/review/34351
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-09-01 09:03:37 +00:00
Roland Knall 6e240e6727 Qt: Apply Invert/Enable/Disable only to selected list
Also, put the search field on top, as this is the default for search
fields and apply the change of enable/disable and invert-all only to
the selected items, instead of all items.

Bug: 16013
Change-Id: If4ef1c5ce63eef6fa72db679cdcbf52dcb0e8fb6
Reviewed-on: https://code.wireshark.org/review/34393
Reviewed-by: Roland Knall <rknall@gmail.com>
2019-08-29 10:26:02 +00:00
Harald Welte b1412ab11d Add dissector for OsmoTRX protocol
This protocol is a non-standard, ad-hoc protocol to pass baseband GSM
bursts between the modem (osmo-trx) and the encoder / decoder
(osmo-bts-trx). Osmocom inherited this when forking OsmoTRX off the
OpenBTS "Transceiver" program.

Change-Id: I31f5071d08eff1731f1d602886e204c87eed107c
Related: OS#4081 (https://osmocom.org/issues/4081)
Bug: 14814
Reviewed-on: https://code.wireshark.org/review/26796
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
2019-08-14 10:00:34 +00:00
Gerald Combs 545a3986fe Docbook: Document using middle-click to mark packets.
Add an item about marking packets using the middle mouse button to the
release notes.

Update the "Marking Packets" section of the User's Guide accordingly.

Use "menu:...[]" to mark up menu items in a bunch of places. It looks
like we need to a add a "guimenu" class to ws.css.

Change-Id: Ide99112f7643e509d8af8a4aa6ddb4287f3585cf
Reviewed-on: https://code.wireshark.org/review/34182
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-08-05 08:26:43 +00:00
Gerald Combs 12e8b4edd3 3.1.0 > 3.1.1.
Change-Id: Idc7ab6cfe38cffa4053d0d8ce710cb95b33aa6ac
Reviewed-on: https://code.wireshark.org/review/34084
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-07-25 20:03:30 +00:00
Gerald Combs 414ca80b21 Build 3.1.0.
Change-Id: Iced73e36e00018ace596b671959bc087b3541765
Reviewed-on: https://code.wireshark.org/review/34082
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-07-25 18:47:24 +00:00
Gerald Combs 7122a8a53e Update the release notes for 3.1.0.
Change-Id: I85b2a8088e1968bd8e2fb707fe269e11fb2e0c90
Reviewed-on: https://code.wireshark.org/review/34078
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-07-24 22:50:25 +00:00
Roland Knall 3a62b1bc75 Qt: Allow profile import from directory
To allow for easy import of profiles, one can select a directory
to import profiles from

Change-Id: I12f66e3dc6bd272d34baa76093152dce412b0158
Reviewed-on: https://code.wireshark.org/review/34038
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
2019-07-21 16:41:13 +00:00
Peter Wu c88e525168 Documentation: convert http URLS to https
Remove some dead links or point them to archive.org while at it. All
updated links have been verified.

Change-Id: Icf02167a13d5fe9dfce39ea57525b3f185554c9d
Reviewed-on: https://code.wireshark.org/review/34028
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-20 20:51:30 +00:00
Gerald Combs 8147af211d Editcap: Allow floating point split intervals.
Update the `-i` option to allow floating point values as suggested at
https://stackoverflow.com/questions/57004719/split-wireshark-to-miliseconds

Change-Id: I24028d409bc441ed3b45ac2179f7c42b2bc424bc
Reviewed-on: https://code.wireshark.org/review/33938
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-16 06:43:09 +00:00
Jeremy Kerr eae522d9cc ncsi: Add NCSI dissector
This change adds a basic dissector for the Network Controller Sideband
Interface (NCSI), as described by DMTF specification DSP0222.

Change-Id: I4e98361bfb7315c524f9c90db38507892adeeebe
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Reviewed-on: https://code.wireshark.org/review/33818
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-03 08:55:02 +00:00
Dario Lombardo 1af6e1f860 tap: add credentials tap.
This new tap collects credentials (username and paassword)
from the dissectors.

So far, few dissectors have been instrumented:
- http (basic auth)
- http (header auth)
- ftp
Others can be instrumented as well using the same technique.

Tshark has a new option (-z credentials) and Wireshark a new
"tools" menu: the documentation has been updated accordingly.

Change-Id: I2d0d96598c85bb3ea4fb5ec090dd8dc28b481fc9
Reviewed-on: https://code.wireshark.org/review/33453
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Dario Lombardo <lomato@gmail.com>
2019-06-26 07:09:54 +00:00
Anders Broman c1c0a2911b NRPPa: Add dissector for TS 38.455 V15.2.1
Change-Id: I66da8ced410163c872af1d4161f2c9fc38f72ff8
Reviewed-on: https://code.wireshark.org/review/33590
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-06-17 13:12:20 +00:00
Peter Wu 94b211977a Add support for embedding WireGuard keys in a pcapng file
pcapng spec update is here: https://github.com/pcapng/pcapng/pull/62

Bug: 15571
Change-Id: I2f1921b1da70ac0bab8c38dd5138a9dfe7843fea
Reviewed-on: https://code.wireshark.org/review/33300
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-06-17 00:48:29 +00:00
Gerald Combs 178e7ce9a5 Qt: Filter expression toolbar dark mode updates.
Move plus-8.png to stock_icons/8x8 and rename it list-add.template.png
which conforms to the Freedesktop icon naming specifications and makes
it a template icon.

Update our style sheet when we recive a QEvent::PaletteChange.

Ping-Bug: 15511
Change-Id: I4b8ddcb4eb64f11faec21d5df4a3fd7fdc5cf488
Reviewed-on: https://code.wireshark.org/review/33626
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-06-17 00:46:21 +00:00
Jon Dennis de44630666 CL3DCW: Added Dual Channel Wi-Fi Dissectors
Initial go at adding the CableLabs Dual Channel Wi-Fi dissector.
Changes:
  . New dissector for CableLabs Layer-3 Protocol ("CL3") IEEE EtherType 0xB4E3
  . New dissector for Dual Channel Wi-Fi (Subprotocol of CL3)
  . Defined EtherType macro for CL3 + description

Bug: 15818
Change-Id: I6edf99d40883c1890659185cc3f0524a2218a6c4
Reviewed-on: https://code.wireshark.org/review/33440
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-06-11 20:26:56 +00:00
Tomasz Moń 8219ff2ed2 Add FTDI FT dissector to release notes
Change-Id: I89335813a5ec0a0748741bd8fb2f1ee77369bfe4
Reviewed-on: https://code.wireshark.org/review/33554
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2019-06-11 16:33:34 +00:00
Slava Bacherikov 9fa13ff70d [packet-gelf.c] Add dissector for GELF protocol
Add dissection for Graylog Extended Log Format (GELF) over UDP.

Bug: 15776
Change-Id: Ie976a1dee8d3441532f209061aef5c804219f289
Reviewed-on: https://code.wireshark.org/review/33184
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-05-28 03:38:13 +00:00
Solganik Alexander b06dcb32c7 nvme-tcp: Add nvme-tcp dissector
This patch adds support of NVMe/TCP (NVM Express over Fabrics for TCP).
to wireshark.

NVM Express is high speed interface for accessing solid state drives.
NVM Express specifications are maintained by NVM Express industry
association at https://nvmexpress.org/.

NVMe/TCP is the TCP transport binding specification
which recently ratified (Technical Proposal 8000) and is a part
of NVMe-oF spec version 1.1.

Reference can be found here:
https://lwn.net/Articles/772556/
and protocol specification:
https://nvmexpress.org/welcome-nvme-tcp-to-the-nvme-of-family-of-transports/

Supported commands are
*) NVMe/TCP ICREQ, ICRESP.
*) NVMe Fabrics commands
*) NVMe commands that are supported by packet-nvme dissector.

Testing is done with Linux 5.0 nvme-tcp host and target drivers.
H2C and C2H termination PDU`s are not supported as Linux NVMe/TCP driver
does not support them as well in kernel 5.0

Bug: 15735
Change-Id: I63ae7aa2a42ff843b9832110830fd345f30d9170
Reviewed-on: https://code.wireshark.org/review/32640
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2019-05-13 06:11:52 +00:00
Harald Welte aa8d948cf4 3GPP CBSP (Cell Broadcast Service Protocol) dissector
This protocol is spoken between the BSC (Base Station Controller) and
the CBC (Cell Broadcast Centre).  It runs over TCP Port 48049 and is
specified in 3GPP TS 48.049.

Change-Id: I183e4741e2db5b9cc4dfe2b89f7920a32af67971
Reviewed-on: https://code.wireshark.org/review/29745
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-05-08 10:15:34 +00:00
João Valverde 186f985793 CMake: Check for and use system SpeexDSP library
Change-Id: I8443379d23a2946dd21c12e5e0bd5464ab73ca25
Reviewed-on: https://code.wireshark.org/review/31857
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: João Valverde <j@v6e.pt>
2019-05-02 21:12:01 +00:00
Dániel Bakai 9ce60b173b Add brotli decompression support for HTTP and HTTP2 dissectors.
Change-Id: I9c09f55673187f6fee723fcd72798fb6b9958b03
Reviewed-on: https://code.wireshark.org/review/32745
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2019-04-22 15:24:46 +00:00
Joel Colledge 39299a13cb DRBD: Add dissector for the Distributed Replicated Block Device protocol
Bug: 15589
Change-Id: Iab2284f79130b0ab024e7ab00c0774d1907077db
Reviewed-on: https://code.wireshark.org/review/32332
Tested-by: Petri Dish Buildbot
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2019-04-11 23:37:01 +00:00
Maximilian Kohler 334f7e1fd9 eCPRI: added new dissector
evolved Common Public Radio Interface (eCPRI) is a protocol, which will
be used in fronthaul transport network. It will be included in standard
ethernet frames and UDP frames.
There are 8 Message Types to decode with eCPRI Specification V1.2.

Bug: 15510
Change-Id: I2bb74c1e95e89f0b812492509a05395d6b86eb54
Reviewed-on: https://code.wireshark.org/review/32004
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-02-19 18:50:48 +00:00
Gerald Combs b658de2fa7 Rename our .asciidoc files to .adoc
As noted in "AsciiDoc Recommended Practices" at
https://asciidoctor.org/docs/asciidoc-recommended-practices/, the
AsciiDoc/Asciidoctor community seems to have settled on ".adoc" as a
file extension and that's the one preferred by the Asciidoctor project.
Update our filenames to match.

Change-Id: I2d352623d42d65d950b64310c3655b0fd177ee8c
Reviewed-on: https://code.wireshark.org/review/32037
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-02-15 05:17:26 +00:00