Change the formatting strings used to create the Conversation Filter submenu

Bug: 11178
Change-Id: I4a5ae1399da8206efb29c059437d56da06a539a9
Reviewed-on: https://code.wireshark.org/review/8417
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Evan Huus <eapache@gmail.com>

Remove trailing whitespace.

Change-Id: I7be78c8759255f14efd1b794bfefad9a18428670
Reviewed-on: https://code.wireshark.org/review/8444
Reviewed-by: Guy Harris <guy@alum.mit.edu>

More cleanly handle 3-byte IPv4 addresses.

Make a union of the 4 bytes of the address and the address as a 32-bit
integer, and fill in the bytes differently based on whether it's an
interior or exterior route.  Rather than just casting a pointer to a
byte to a pointer to a 4-byte integer - which may not be safe, as the
byte array might not be properly aligned - just use the integer member
of the union.

Change-Id: Ic0e78a832cedb9a5a8d435a6c911409b17e41685
Reviewed-on: https://code.wireshark.org/review/8443
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Add casts to fix clang warnings.

Change-Id: I0059536cb68fb3ef313f3166bf18444a89b4eea3
Reviewed-on: https://code.wireshark.org/review/8442
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Fix check for NUL at the end of a string.

*seq[slength - 1] means *(seq[slength - 1]), where seq points to a
"const gchar *", so it fetches the pointer at an offset of slength - 1
from the pointer to which seq points, and dereferences that pointer.
What's wanted is (*seq)[slength - 1], i.e. fetch the pointer to which
seq points, and fetch the byte at an offset of slength - 1 from the byte
to which said pointer points.

Change-Id: I7246f5e6093d035bad59be530893f3fc54dad97e
Reviewed-on: https://code.wireshark.org/review/8441
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Qt: Display filter completion fixes.

Fixup the logic for adding field names to the list.

Connect our completer activation signal to its slot once, not twice.

Bug: 11187
Change-Id: Ife1879fe05c870094ee31e59dd62e3004f588bfc
Reviewed-on: https://code.wireshark.org/review/8440
Reviewed-by: Gerald Combs <gerald@wireshark.org>

OSPF: fix dissection of Router Address TLV

Bug: 11190
Change-Id: Ic6585e44767c1c80a7090dc94205eb33cf15c083
Reviewed-on: https://code.wireshark.org/review/8437
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Qt: Add packet list navigation checks.

Add sanity checks to go{First,Last,Next,Previous}Packet.

Bug: 11085
Change-Id: I6c33ea314720935aa1881257e9f32732134eec31
Reviewed-on: https://code.wireshark.org/review/8433
Reviewed-by: Gerald Combs <gerald@wireshark.org>

USB: allow to call sub dissectors for setup response packets without transaction available

This is useful when people export displayed packets of a USB sub dissector (like MBIM) without keeping
the USB setup requests and still expect to have "Decode As" functionality working

Change-Id: Iad32ddc7b87544ff568a091f03e393a106f38554
Reviewed-on: https://code.wireshark.org/review/8430
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

PIM: Add PIM IP version field for PIMv1 too

Change-Id: I455a4f81798c7a99a48551ae362dabf2b697cf88
Reviewed-on: https://code.wireshark.org/review/8427
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Overhaul the MEGACO dissector.

1. Have megaco dissector display fields as their are "interpreted", not as raw data with "interpretation" as a subtree
2. Replace/remove proto_tree_add_text
3. Convert some "numeric string fields" into numeric values.
4. Add some more dissection discovered while looking for sample captures.

Bug: 6732
Ping-Bug: 10909
Change-Id: Ie051a8a16ef2355681a24be8789bae0971632cd1
Reviewed-on: https://code.wireshark.org/review/8382
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

PIM: Remove trailing whitespace before comma

Change-Id: I7798ddd6db4a98cfe9cc96275f56837ef3bf0b1e
Reviewed-on: https://code.wireshark.org/review/8399
Reviewed-by: Anders Broman <a.broman58@gmail.com>

PIM: Enhance code

Use proto_tree_add_item when it is possible
Add display of reserved field...

Change-Id: Id47c237f06e28e7d5dfbd92848dc26a7496cf799
Reviewed-on: https://code.wireshark.org/review/8398
Reviewed-by: Anders Broman <a.broman58@gmail.com>

PIM: Remove proto_tree_add_text

rewrite display of PIM(v1) Address and remove last proto_tree_add_text call :)

Change-Id: I020970e80338d15dbe68e32713b8ada31fd0a4e2
Reviewed-on: https://code.wireshark.org/review/8397
Reviewed-by: Anders Broman <a.broman58@gmail.com>

PIM: Remove proto_tree_add_text

only 2 proto_tree_add_text calls, (it will be remove on another patch)

Change-Id: I670e37bbbe1cc3ae740a94cd620fa14f20cb9feb
Reviewed-on: https://code.wireshark.org/review/8396
Reviewed-by: Michael Mann <mmann78@netscape.net>

Fix Diameter reassembly when the captured tvb length is less than 5 bytes.

Since Diameter does heuristic checks before calling tcp_dissect_pdus() we
have to "manually" ask for more data if the tvb is too short for our
heuristics.

Bug: 11183
Change-Id: I14c36042306b532b53df80cc3971866b76094084
Reviewed-on: https://code.wireshark.org/review/8405
Reviewed-by: Evan Huus <eapache@gmail.com>
Petri-Dish: Jeff Morriss <jeff.morriss.ws@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>

Diameter: Add support for Sd interface

Bug: 11186
Change-Id: I3aed8818dd021c72b2cb1fb51adc717613c501ea
Reviewed-on: https://code.wireshark.org/review/8425
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>

MBIM: fix dissection of captures taken on a Linux host

- ensure that MBIM tree is not below URB setup one
- do not try to dissect an empty tvb

Change-Id: I8c6655727eec7df84882fd861d5581848340e0f3
Reviewed-on: https://code.wireshark.org/review/8410
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

USB COM: add dissection of ECM Management Element Notifications

Change-Id: I9395c5e7974526d9be5cceca479e840dca5ff71e
Reviewed-on: https://code.wireshark.org/review/8409
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>

In the name of God and all that is holy, don't do that.

http://www.bitterfilms.com/rejected.html

1) There is *NO* guarantee that you can safely dereference a misaligned
pointer.

2) There is *NO* guarantee that you are running on a little-endian
machine, so that an attempt to fetch a 32-bit integer through such a
pointer will fetch it in little-endian form.

Instead, fetch it using tvb_get_letohl(), which 1) doesn't care about
alignment and 2) always fetches in little-endian order.

Change-Id: I44721cbf3c4456797990cc741836c9dd8c6c3696
Reviewed-on: https://code.wireshark.org/review/8423
Reviewed-by: Guy Harris <guy@alum.mit.edu>

In the name of God and all that is holy, don't do that.

http://www.bitterfilms.com/rejected.html

1) There is *NO* guarantee that you can safely dereference a misaligned
pointer.

2) There is *NO* guarantee that you are running on a little-endian
machine, so that an attempt to fetch a 32-bit integer through such a
pointer will fetch it in little-endian form.

Instead, fetch it using tvb_letohl(), which 1) doesn't care about
alignment and 2) always fetches in little-endian order.

Change-Id: I30ad6607b7c6d5047245bfcfdcbe757b02d02172
Reviewed-on: https://code.wireshark.org/review/8422
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Qt: Expert info → Expert information.

Change-Id: I6cf87a1c63a4b34678667396d836d15766155b1a
Reviewed-on: https://code.wireshark.org/review/8420
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Don't cast pointers when they're assigned to the data field of an address.

That field is just a void *, so there's no need to cast them, and at
least one of those casts generates alignment warnings with -Wcast-align.

Change-Id: I88e22a794a8c990b01e7ed8f45951a2665febbc1
Reviewed-on: https://code.wireshark.org/review/8421
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Speed up display filter completion.

Don't loop over non-matching fields. This improves completion performance
considerably on Windows (where it was noticeable).

Change-Id: I7f526fe960c5c41da5ae847b04be25d65ca42bb1
Reviewed-on: https://code.wireshark.org/review/8418
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Get rid of now-empty and unneeded structure.

Change-Id: I4c557c49a6d6013dff129515cdfadb496529ff35
Reviewed-on: https://code.wireshark.org/review/8414
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Qt: Provide a hint about the current display filter field.

If the field under the DisplayFilterEdit cursor is valid, push its
description. In the main window this shows up in the status bar.

Change-Id: I7ba1255694941c64aa8cce896283a426b9a69f2c
Reviewed-on: https://code.wireshark.org/review/8413
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Do not assume the data field of an address structure is an aligned pointer.

There is *no* guarantee that it's aligned on a 4-byte boundary, and
there is *no* guarantee that you can safely dereference an unaligned
pointer.  See bug 11172 for a crash on Solaris/SPARC caused by those
assumptions both being false.

Change-Id: I30d97aebd42283545f5b8f6d50fa09c5b476ec47
Reviewed-on: https://code.wireshark.org/review/8412
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Pull the MIMO control code into the beamforming report code.

Hopefully, that'll convince Microsoft's static analyzer that nr will
always be >= 1, so you can safely subtract 1 from it and use it as an
array index.

Get rid of the vht_mimo_control_t structure in favor of a few variables
for the bitfields we actually use.

Make some tables static - no need to initialize them every time we enter
the routine.

Change-Id: Icde05a768ea1a9c897b69003afcab1dddeffaaf5
Reviewed-on: https://code.wireshark.org/review/8411
Reviewed-by: Guy Harris <guy@alum.mit.edu>

proto: use correct mask when checking display

Otherwise numeric fields with BASE_EXT_STRING don't match anything and cause an
assertion failure.

Also fix indentation.

Change-Id: I2708be50a6c5aff5400ec44e6a141db39d2d94e7
Reviewed-on: https://code.wireshark.org/review/8391
Petri-Dish: Evan Huus <eapache@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Evan Huus <eapache@gmail.com>

Update the release notes.

Change-Id: I7733ff823303f8e3a0dcef296e627540bf93fa1e
Reviewed-on: https://code.wireshark.org/review/8408
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Qt: Fix the main welcome banner.

Leave the text empty, otherwise it overwrites "Development Version" at
inopportune times. Remove a QDebug include.

Change-Id: I94060ef69cc3b42dda39adfe34d2c0bfbe564ec2
Reviewed-on: https://code.wireshark.org/review/8407
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Try to handle the executable being a libtool wrapper.

Change-Id: I8fd2b4445707029ea24ad3c02804c0bf8fcedd15
Reviewed-on: https://code.wireshark.org/review/8406
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Wireshark (Qt): The lower left status bar reports "Ready to load or capture" when a live capture is active

10947 Qt Wireshark - The lower left status bar reports "Ready to load or capture" when a live capture is active

Reported by Jim Young

Bug: 10947
Change-Id: I7dcd5081194bbeab43fef4d994220ac3ea23f536
Reviewed-on: https://code.wireshark.org/review/8067
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Transifex: Add also debian po file to translate

Change-Id: Ibacd7775e5e71dc30f1cfaaf022c22fc0b594fd0
Reviewed-on: https://code.wireshark.org/review/8321
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Remove trailing whitespace.

Change-Id: Ibdb899ddcaa88579aa2dc3c842d016a1ac164e2a
Reviewed-on: https://code.wireshark.org/review/8404
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Qt: Packet list fixes.

When updating the monospace font, don't apply it to PacketList itself.
On Windows and Linux here it sets the header font as well.

Add the item delegate width to the column size hint. This correctly
resizes column 0 on Windows. It seems to add extra space on OS X and
Linux, unfortunately.

Change-Id: I294cd9868fe00144b896636be65896e8557ab208
Reviewed-on: https://code.wireshark.org/review/8402
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Skip past env and its environment-variable arguments.

Change-Id: Ic0bec27e5884a1e5db8e98e6d84b677ae8b2d377
Reviewed-on: https://code.wireshark.org/review/8403
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Use setPlaceholderText in CaptureFilterEdit.

Matches a recent change in DisplayFilterEdit.

Change-Id: I22d0f4a327ecae0e2065302a003037d19162b74d
Reviewed-on: https://code.wireshark.org/review/8401
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Try to get a stack trace from core dumps.

Change-Id: I66d853391f29acfb026d3c246adba9bdf6a4dc36
Reviewed-on: https://code.wireshark.org/review/8400
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Qt: Add display filter completion.

Add completion to DisplayFilterEdit. Disable autocompletion in
DisplayFilterCombo.

New behavior: If we're at the beginning of the entry "recent" display
filters appear at the top of the list.

Start using QLineEdit::placeholderText while we're here.

Bug: 10923
Ping-Bug: 9254
Change-Id: Ic8dd37768abb83d50d4e6c849bb51095fc3742d2
Reviewed-on: https://code.wireshark.org/review/8360
Reviewed-by: Gerald Combs <gerald@wireshark.org>

MPLS PM: add timestamp2 field decoding

Bug: 11180
Change-Id: I28e8d72d80047a08f754593327bdd5900633574a
Signed-off-by: Francesco Fondelli <francesco.fondelli@gmail.com>
Reviewed-on: https://code.wireshark.org/review/8395
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

BGP: Remove proto_tree_add_text call

Part 1

Change-Id: Icbc73690370eba07e77b35d2815346f1d5a44347
Reviewed-on: https://code.wireshark.org/review/8386
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

giop: ignore NULL-terminator in CDR strings

CDR strings appear to be both counted *and* NULL-terminated in many cases,
which is rather weird, so if we see a NULL-terminator, ignore it in the count;
otherwise we print a trailing '\000' on all the strings we put in the tree.

Bug: 11126
Change-Id: I45b6b414683a6f646d37c2e2001b7319d5c80be5
Reviewed-on: https://code.wireshark.org/review/8390
Reviewed-by: Anders Broman <a.broman58@gmail.com>

packet-cipmotion.c: Modified CIP motion parser

Modified CIP Motion parser to include newly-defined Axis Safety related
fields in the status data set section.

Change-Id: I70c6dd345ae9353b87e6f7c1300b60687f41a1f6
Reviewed-on: https://code.wireshark.org/review/8342
Reviewed-by: Anders Broman <a.broman58@gmail.com>

HTTP2: Update to libnghttp2 0.7.14

Change-Id: Ib4cbe5cd876956bffeea81011a94296333ff1e9c
Reviewed-on: https://code.wireshark.org/review/8379
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Dicto (3gpp2): fix indent (use tabs)

Change-Id: I0f1d6a8501329857b1c38646e18b72cdae84a7c5
Reviewed-on: https://code.wireshark.org/review/8385
Reviewed-by: Anders Broman <a.broman58@gmail.com>

When piping tshark to something else, run it with run_and_catch_crashes.

That got the crash information in the WPA EAPOL Rekey test; use it for
all other tests where, otherwise, the crash information would be lost.

Change-Id: I230b7952b6d79ebf6dc003747dc05328616ef7c2
Reviewed-on: https://code.wireshark.org/review/8394
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Fix pathname used to run run_and_catch_crashes.

Change-Id: Ib8bbee1906c89decd16f3ea0ea5f78c9337e5f43
Reviewed-on: https://code.wireshark.org/review/8393
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Try wrapping some tshark invocations in a script to catch crashes.

Add a script that takes a command as an argument and runs it in a
subshell, so that said subshell will catch any signals from it and
report it.

This would be done for commands that aren't the last command in the
pipeline, as, given that the exit status of a pipeline is the exit
status of the last command in the pipeline, there's no guarantee that
the shell will bother to pick up the exit status of earlier commands in
the pipeline.

Use that for the tshark in the WPA EAPOL Rekey test, so it at least can
report the signal (on Solaris, SIGSEGV means, among other things,
"dereferenced a pointer pointing out of the address space" and SIGBUS
means, among other things, "dereferenced a misaligned pointer on
SPARC").  Maybe we can make the script also fire up a debugger if it
finds a core dump (and a debugger) and get a stack trace.

Change-Id: I4188190a1f1a4d3afc4719d886161ee56bd89d8b
Reviewed-on: https://code.wireshark.org/review/8392
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Copy PTK key in its dedicated array, and not at the address of the array

While we are at it, put back some debug logs that were removed in g1439eb6 (otherwise msgbuf is no more initialized)

Change-Id: Ie34c4f2e638bc3ee77a0565446de37a15385dc0d
Reviewed-on: https://code.wireshark.org/review/8389
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Don't initialize a variable that's unused before we later set it.

Change-Id: I944cac044a8b091cbe5d85cd63a8c698a82b8559
Reviewed-on: https://code.wireshark.org/review/8388
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Pick array sizes based on what they're supposed to hold.

In AirPDcapRsnaPwd2PskStep(), digest[] holds an SSID plus 4 bytes of
count, so the size is MAX_SSID_LENGTH plus 4, and digest1[] holds an
SHA-1 digest, so the size is SHA1_DIGEST_LEN.

That makes it a bit clearer why those are the sizes.

Change-Id: I58ed6643f57675375f7f369470d600382323315f
Reviewed-on: https://code.wireshark.org/review/8387
Reviewed-by: Guy Harris <guy@alum.mit.edu>

qt: minor string change in capture options

Replace "Capture in" with "Enable" for promiscuous mode; the checkbox doesn't
actually affect which interfaces get captured on, which is the way I wanted to
read the old text.

Change-Id: I35dd2c8f9523311cb267515804b1421e50e60e06
Reviewed-on: https://code.wireshark.org/review/8374
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Gerald Combs <gerald@wireshark.org>

mergecap: fix merge of files with different encapsulation types

Issue reported on https://ask.wireshark.org/questions/42061/merging-captures-on-1995

Change-Id: I0697a03221972f2d1616da52aecc6257f0bc5b88
Reviewed-on: https://code.wireshark.org/review/8293
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Evan Huus <eapache@gmail.com>

ZVT: show positive, negative completion in the info column

Change-Id: I2488a505e6634da5cbcaf2e86505414d34823b8e
Reviewed-on: https://code.wireshark.org/review/8381
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>

DVB-CI: remove some more proto_tree_add_text() calls

Change-Id: If2f5ee4629b48fe0ffbe76c49952de8fb14fb64e
Reviewed-on: https://code.wireshark.org/review/8380
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>

[Automatic update for 2015-05-10]

Update manuf, services enterprise-numbers, translations, and other items.

Change-Id: I9ee8a6cb84ceb23340af3562cfa9927357319ee6
Reviewed-on: https://code.wireshark.org/review/8376
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Q931: separate ett for each information element

Add separate ett for all possible information elements.
It's better to expand only necessary subtree but not all

Change-Id: If84359e28547ce5dcf753dc1bee691ece7f29ace
Reviewed-on: https://code.wireshark.org/review/8054
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>

Add some bounds checks.

Change-Id: I5b0405f814d439c1d5ce329a817475102be483af
Reviewed-on: https://code.wireshark.org/review/8373
Reviewed-by: Guy Harris <guy@alum.mit.edu>

new_key is used only for TKIP keys; set it only in that part of the code.

Change-Id: I64424731e4d5f94c7b69436b5318b67a14471171
Reviewed-on: https://code.wireshark.org/review/8372
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Allocate the unwrapped key in AES_unwrap().

Have it allocate the buffer for the unwrapped key and return a pointer
to it, rather than having it be handed a buffer for that key.

That makes it a bit easier to validate, in AES_unwrap, that we don't
write past the end of the buffer.

Change-Id: Id02852c23054b3ed33eeeb383e7aa6cf12d02ed9
Reviewed-on: https://code.wireshark.org/review/8371
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Define the SHA-1 digest length in wsutil/sha1.h and use it.

Hopefully that'll make it a little easier to make sure that we're not
overflowing arrays.

Change-Id: I770df045ef9a45fd486c1271ea424b3334bb39d2
Reviewed-on: https://code.wireshark.org/review/8370
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Make option_content a guint8 *.

It points to an array of bytes, not a character string.

Add some casts to squelch other Sun/Oracle C warnings.

Clean up some comments while we're at it.

Change-Id: Id0908178cb00d537e95569b9ce6f745c8fd6d716
Reviewed-on: https://code.wireshark.org/review/8369
Reviewed-by: Guy Harris <guy@alum.mit.edu>

ICMP: Fix Logically dead code (CID 1295678)

Mistake when remove proto_tree_add_text calls

Change-Id: I820264b7a90a2563f846b6e6472416cd3e3278a4
Reviewed-on: https://code.wireshark.org/review/8368
Reviewed-by: Michael Mann <mmann78@netscape.net>

PCEP: Update to last draft

- fix PLSP-ID parsing, is a 20 bits field
- fix SID parsing, is in network order on the wire
- fix PATH-SETUP-TYPE and SR-PCE-CAPABILITY code points

Change-Id: If26035181462a9cad77a4a594aab3c007b4d00a2
Signed-off-by: Francesco Fondelli <francesco.fondelli@gmail.com>
Reviewed-on: https://code.wireshark.org/review/8351
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Rename a variable to avoid a collision with the C++ keyword "template".

Change-Id: I27c5efc5586e97d19ef905921919e1385809eb9b
Reviewed-on: https://code.wireshark.org/review/8367
Reviewed-by: Guy Harris <guy@alum.mit.edu>

SSL: fix dissection of CertificateStatus message with OCSP_MULTI

Bug: 11181
Change-Id: I05769e254f2e276e1594d7ed5cb50496e16cfc2f
Reviewed-on: https://code.wireshark.org/review/8356
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Eliminate a couple of empty Diameter grouped AVP lists.

Use Session-ID as a place holder for grouped AVPs that can hold any AVP and
look up the contents of a couple grouped AVPs whose contents wasn't specified.

Also, update the DTD to allow vendors to not add any AVPs.

Change-Id: Id2852e31cecbcfaf64efb46918101b3a81ed5bdb
Reviewed-on: https://code.wireshark.org/review/8355
Reviewed-by: Anders Broman <a.broman58@gmail.com>

RRC: add domain and release cause information to the INFO column.

Change-Id: If0bee7f283d6c4dd44618221d528fb55e30f510a
Reviewed-on: https://code.wireshark.org/review/8353
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix some more constants to be unsigned.

Change-Id: I714078683cff517c79a15abf29e1ae4a9a60271d
Reviewed-on: https://code.wireshark.org/review/8365
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Fix definition of tnef_open().

Change-Id: I8d030ab48fc47e4948c9f6dcad08f0bd08ca5ff8
Reviewed-on: https://code.wireshark.org/review/8364
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Make everything unsigned.

The LHS of the & operation is unsigned; make the RHS unsigned as well.
That squelches a Sun/Oracle C warning.

Change-Id: I6983cc89603a512020b8e8b560c00632de6b2fb3
Reviewed-on: https://code.wireshark.org/review/8363
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Keep everything unsigned there.

This squelches a warning from Sun/Oracle C, and it's the right thing to
do in any case, as the LHS of the & operator is unsigned.

Change-Id: I824a82d945f8f2535282bbf466dcd65806c6f695
Reviewed-on: https://code.wireshark.org/review/8362
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Add some more warnings when building with Sun^WOracle's C compiler.

Change-Id: I696b0757ba7fece61f50ebcee79b576a4f15660f
Reviewed-on: https://code.wireshark.org/review/8361
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Fix indentation.

Change-Id: I90bddd1dd879706b95ab28539411e26fc29e61d8
Reviewed-on: https://code.wireshark.org/review/8359
Reviewed-by: Guy Harris <guy@alum.mit.edu>

airpdcap: ensure that buffer put on stack is big enough to hold the result of AirPDcapRsnaPwd2PskStep()

g1439eb6 changed AIRPDCAP_WPA_PSK_LEN from 64 bytes to 32 bytes, leading to a stack corruption in AirPDcapRsnaPwd2Psk() function

Change-Id: Ibf51f6749715055cd84906a144214ed44c85256b
Reviewed-on: https://code.wireshark.org/review/8358
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

GTPv2: fix unused parameter 'pinfo' warning

Change-Id: I41e9d429685752c10562e5255036c2b84390373c
Reviewed-on: https://code.wireshark.org/review/8354
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

[GTPv2] Add dissection of Throttling IE.

Change-Id: I9c71a9d6e276213eb43e4265578e57f87f1619fd
Reviewed-on: https://code.wireshark.org/review/8352
Reviewed-by: Anders Broman <a.broman58@gmail.com>

epan/nghttp2/nghttp2_net.h no longer exists, so don't list it.

Change-Id: I4a2f289a49edf10a62208dad186a9b6426b5af2b
Reviewed-on: https://code.wireshark.org/review/8344
Reviewed-by: Guy Harris <guy@alum.mit.edu>

A NULL is needed at the end of the argument list for g_object_set().

Change-Id: I086403275d596f19ef44374f956654cf94ac9a11
Reviewed-on: https://code.wireshark.org/review/8343
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Recent files: Disable mnemonic accelerator key for menu item

If recent file name contains underscore, menu item parses it as mnemonic accelerator. So disabled using underline for recent file menu item.

Change-Id: I1253a0103e750a14a69f0d064587e0eb56581b82
Reviewed-on: https://code.wireshark.org/review/8325
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Expert Info dialog.

Show all expert messages in a combined view. Group top-level items by a
(severity, group, protocol) tuple.

Let the user enable and disable messages via a check menu.

Add ProtoTree::goToField and expert_info_t.hf_index. Use them to jump to
what we hope is the afflicted item.

Enable the context menu only if the user has selected a packet item.

Add a free-form search field that matches expert summaries.

This differs from the GTK+ version but hopefully provides a smoother
workflow.

Bug: 10931
Change-Id: Ia12cb7c27cdea1634fa2798fb7e4c1b23bd16ad2
Reviewed-on: https://code.wireshark.org/review/8294
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

nghttp2: use g_ntoh[ls], g_hton[ls] from glib

Change-Id: I9e4278d469579022dd82bed4e40ff582fff266b6
Reviewed-on: https://code.wireshark.org/review/8328
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

IEEE 802.11: 802.1X (WPA-EAP) rekeying support

This patch extends the existing decryption support for WPA to also
handle rekeys by checking each decrypted packet for a 4-way-handshake.

Rekeys can be used for WPA-PSK, but are more common with WPA-Enterprise
(WPA-EAP).

For decrypting WPA-EAP secured packets the user must provide all used PMK's
of the connection (aka PSK's) as WPA-PSK 32 byte hex values to wireshark
via the existing interface.
(The capture must have all 4-way-handshakes included also, starting with
the first unencrypted one.)

Every decrypted unicast packet will habe the used PMK and TK shown in the
CCMP/TKIP section below the key index in the GUI. Group packets will display the
GTK instead.

Additionally this fixes a small issue with group rekey handling, so every packet
can be selected in the GUI in random order, removing the need to manually find
the correct group keying packets prior to that.

It was tested primary with WPA-CCMP, but TKIP is also working.

One section in the code touch bluetooth 802.1X support. It should do
exactly the same, but will now also examine all decypted packets for rekeys.

Ping-Bug: 11172
Change-Id: I19d055581fce6268df888da63485a48326046748
Reviewed-on: https://code.wireshark.org/review/8268
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Use the correct AVP type in a couple of places: IPAddress instead of Address.

(For whatever reason the Diameter dictionary calls it IPAddress rather than
Address--the latter is what's in the RFCs.)

Change-Id: I5efcffc2a9bced6ba841b09fd83cb3dcd128d440
Reviewed-on: https://code.wireshark.org/review/8341
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix several Starent enums that didn't have codes.

The codes were there but the strings got messed up somewhere along the way.

Change-Id: I41cc581dba0c00936737ea77e789cac1aecadf0f
Reviewed-on: https://code.wireshark.org/review/8340
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Add Float32 and Float64 types to the Diameter dictionary.

Change-Id: I74f7c37fc9b62ae0b9f29e4da0b1b3d5037b8192
Reviewed-on: https://code.wireshark.org/review/8339
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Update the Diameter DTD to reflect the fact that vendors are no longer defined
in base or applications.

(IOW update the DTD to reflect I5119f0dc7f8e3bbf59e2207046a8bb0f42ab0ca1.)

Change-Id: I459b3aac50ce4dabb552e674145d9097920e0a5d
Reviewed-on: https://code.wireshark.org/review/8338
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix Starent vendor definition: it's not an empty element.

Change-Id: Ib61b9be817bcfd2fbdc0ec57f69edda9052b588c
Reviewed-on: https://code.wireshark.org/review/8337
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Allow empty-element Diameter Applications and use that format.

This also fixes a couple of applications that weren't properly terminated
(as a result of some of my recent changes).

Change-Id: I9662017a81c63aceeb950d3b29cb17dde16d4f0c
Reviewed-on: https://code.wireshark.org/review/8335
Reviewed-by: Anders Broman <a.broman58@gmail.com>

ftypes: display 64 bits BASE_HEX fields as hexadecimal

Change-Id: Ie9bedf6c17c0a941ebaabd5144460a42eb4ca1ed
Reviewed-on: https://code.wireshark.org/review/8336
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Qt: Fix packet list column resizing.

The size hint changes in g5ab8490 broke packet list column resizing. Add
back a way to force the hinting necessary for sizeHintForColumn to work
properly.

Bug: 11067
Ping-Bug: 10924
Change-Id: Icd525200f7a88f2b6d22a3039cda98ad0527239e
Reviewed-on: https://code.wireshark.org/review/8334
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>

fix FT_INT64 fields output in tshark

Bug: 11170
Change-Id: Ife7f565d17b92cd5f84e92ce109f530e68d98cfa
Reviewed-on: https://code.wireshark.org/review/8333
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

SIGCOMP: Fix Dead Store (Dead assignement/Dead increment) warning found by Clang

Change-Id: I66e4e4735a16de5e50f86e29c34202e6668cd44e
Reviewed-on: https://code.wireshark.org/review/8329
Reviewed-by: Michael Mann <mmann78@netscape.net>

Revert "QCustomPlot: fix division(or modulo) by zero found by Clang and Coverity (CID 1159170 & 1159171)"

This reverts commit b394aa5f1e4ad030ab23d18b439e8f5c9eca9792.

The patch don't fix this issue...

Change-Id: I654933ec4ebebdef840f24ba20162f1f1a5321cc
Reviewed-on: https://code.wireshark.org/review/8332
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

packet-iec104: make object number filterable if SQ flag is set

Make object number filterable again if SQ flag is set which breaks my commit 785fab7f
Sample capture https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=IEC104_SQ.pcapng

Change-Id: I450b86452876fab26e1a9f1bfc2f729573c52124
Reviewed-on: https://code.wireshark.org/review/8313
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Fix detection of 'Write Multiple Registers' and 'Write Multiple Coils' function message 'direction'

Also did some refactoring of existing code to make it more readable for the various existing function code types.

** Commit amendment to not use depreciated tvb_length() function.

Change-Id: Ia4c9f3514968c2a7bebc404ca9185cf8d814dfca
Reviewed-on: https://code.wireshark.org/review/8301
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Reduce proto_tree_add_text calls in packet-sigcomp.c

Some other minor cleanup.

Change-Id: I267fe1512e57ce15f9e6be83ac1b55e6e897e7a1
Reviewed-on: https://code.wireshark.org/review/8322
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

fix FT_UINT64 fields output in tshark

Bug: 11170
Change-Id: Ica259867e2c8e0b4b680bca94970e13962a8dbb1
Reviewed-on: https://code.wireshark.org/review/8290
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Need to generate hf_ variable for aliases in structs.

Change-Id: I6bd995d42cf54aaf2ad90d0322056c7ff0830ea9
Ping-Bug: 11156
Reviewed-on: https://code.wireshark.org/review/8324
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>