Asterix CAT062 fix. Units for cartesian velocity of track were displayed with wrong units.

Change-Id: I716dfeb16b049544e691dcdf75c488758d9e1fa0
Reviewed-on: https://code.wireshark.org/review/707
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Revert de6bfa12b0c002e1930cfb9946078097d294acf8 (break Linux and Mac OS X buildbot...)

Change-Id: If5a6a77909b2d178052605cf2fc6fc0ef758553c
Reviewed-on: https://code.wireshark.org/review/706
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Fix build on my old Windows XP Buildbot (With VS2008EE)

../../asn1/atn-ulcs/packet-atn-ulcs-template.c(126) : fatal error C1083: Cannot
open include file: 'stdint.h': No such file or directory

Change-Id: I8825a2f0b6440ec5a4bbfb49ea5c183dd8cbf03f
Reviewed-on: https://code.wireshark.org/review/705
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Print a message in case we don't have an X11 SDK installed about where
to find xquartz.

Change-Id: I76548fba0b01f8274d12bbb55f4f16622d9a7eff
Reviewed-on: https://code.wireshark.org/review/704
Reviewed-by: Jörg Mayer <jmayer@loplof.de>

CMake updates:
- build by default
- update to 2.8.12.2 which actually builds on Mavericks

Change-Id: I60b539613e13d2cdccbd083b28f641ff1ce363c4
Reviewed-on: https://code.wireshark.org/review/703
Reviewed-by: Jörg Mayer <jmayer@loplof.de>

Add a #define for the stats block header length, and use it.

And rename to #define for the stats block trailer length to indicate
that it's the length of the trailer, not the length of the stats block
in its entirety.

Change-Id: Iec82c971b32f2d3f4a604fe75a91633e1813ebd5
Reviewed-on: https://code.wireshark.org/review/701
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Make the avp_str available to sub dissectors and Let the subdissector have
precedence filling in the avp_item string. Use that in a couple of places.

Change-Id: I1af7a1ca4c14fb56ddeaab336202e6c2a18e556b
Reviewed-on: https://code.wireshark.org/review/699
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Small updates to the setup process documentation

Change-Id: Ie6dc3a8254e30495945155f058f1ef10a75c4745
Reviewed-on: https://code.wireshark.org/review/700
Reviewed-by: Jörg Mayer <jmayer@loplof.de>

Remove Visual Studio solution and project files (and their existence from Makefiles)

There have been discussions on -dev about removing this and I believe I was the last holdout. Finally convinced that I should just have a local copy (ignored by git)

Change-Id: Ic72a22baf58e3412023cf851f0fce16eb07113b0
Reviewed-on: https://code.wireshark.org/review/681
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

NFS: We need to pass data through to the dissect_rpc_list() callback

Change-Id: Iace7c6dfb81f0a98bbae304346906a5e82c82812
Signed-off-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Reviewed-on: https://code.wireshark.org/review/679
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

[Automatic manuf, services and enterprise-numbers update for 2014-03-16]

Change-Id: I714e82b9ea319c2937460978f6feb119917f56f9
Reviewed-on: https://code.wireshark.org/review/696
Reviewed-by: Evan Huus <eapache@gmail.com>

Fix GTK3 detection (or more specific: the include paths) on Windows

Change-Id: Ia0aef096849d1935ca4a6d1d31aabd099087cf29
Reviewed-on: https://code.wireshark.org/review/694
Reviewed-by: Jörg Mayer <jmayer@loplof.de>

Fix
[  5%] Building C object epan/CMakeFiles/epan.dir/dissectors/packet-umts_fp.c.o
/home/jmayer/work/wireshark/git/epan/dissectors/packet-umts_fp.c: In function ‘umts_fp_init_protocol’:
/home/jmayer/work/wireshark/git/epan/dissectors/packet-umts_fp.c:4526:17: error: enum conversion in assignment is invalid in C++ [-Werror=c++-compat]
                 umts_fp_conversation_info->iface_type        = uat_umts_fp_ep_and_ch_records[i].interface_type;
                 ^
/home/jmayer/work/wireshark/git/epan/dissectors/packet-umts_fp.c:4527:17: error: enum conversion in assignment is invalid in C++ [-Werror=c++-compat]
                 umts_fp_conversation_info->division          = uat_umts_fp_ep_and_ch_records[i].division;
                 ^
/home/jmayer/work/wireshark/git/epan/dissectors/packet-umts_fp.c:4533:17: error: enum conversion in assignment is invalid in C++ [-Werror=c++-compat]
                 umts_fp_conversation_info->rlc_mode          = uat_umts_fp_ep_and_ch_records[i].rlc_mode;
                 ^
cc1: all warnings being treated as errors

Change-Id: Ie783a261c40d26ffd105822d5f45bd0513aa1914
Reviewed-on: https://code.wireshark.org/review/693
Reviewed-by: Jörg Mayer <jmayer@loplof.de>

And another warning fix.

Change-Id: Ibbf3366d0075f7b367383a2950c9f0bc54ae194c
Reviewed-on: https://code.wireshark.org/review/692
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Squelch some warnings by narrowing or widening some variables.

Change-Id: If3ad60532e8b7e74272683b254582d86653c777e
Reviewed-on: https://code.wireshark.org/review/691
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Get rid of unused #defines and no-longer-used structures.

The #defines came from Radiotap, but this isn't Radiotap (I see no
presence bits here), and Radiotap has to handle stuff that this code
doesn't (such as, for example, Atheros Wi-Fi adapters that, annoyingly,
pad the space between the 802.11 header and the 802.11 payload when in
monitor mode, hence the "datapad" flag).

Change-Id: I87ca3539e0f9254ab94cc8897bdf69e4574f0525
Reviewed-on: https://code.wireshark.org/review/690
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Reorganize the code.

Pull the packet data copying code into the routines that parse the rest
of the record data.  Have those routines directly fill in the metadata
headers in the packet data, without bothering to fill in a structure
first.

As a result, those routines no longer can set phdr->caplen to a value
different from phdr->len, so don't set WTAP_HAS_CAP_LEN.

Have the existing sanity checking code cause the read to fail if the
checks fail, and add some additional sanity checking.

Use #defines for some offsets into the statistics header and trailer.

Change-Id: Ie936683b96888961d6e2598131cc0eb6146b37e9
Reviewed-on: https://code.wireshark.org/review/689
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Support to version 3.0 of netscaler packet wire format.

From shekhar.chandra@citrix.com.  See bug 9280.

Change-Id: If3abbc653bb1f127b151976d4183af4c4f1e71eb
Reviewed-on: https://code.wireshark.org/review/658
Reviewed-by: Michael Mann <mmann78@netscape.net>

Add an UAT table to define endpoints and channel data to be able to
presetup conversations with FP dissection data.

Change-Id: Ibced63bf944d7268751f8055095eb26477664be1
Reviewed-on: https://code.wireshark.org/review/643
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: ronnie sahlberg <ronniesahlberg@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Clean up the setting of the len and caplen fields.

Always include the length of the metadata headers, as we're always
copying them.

Do a straightforward check to make sure the data length is >= 4 before
subtracting out the FCS (which appears not to actually be an FCS; at
least in the captures I've seen, it looks like random junk).

Improve the comments for that code.

Get rid of some tabs, in favor of spaces, while we're at it, and make
the 3 sections of code where that's done more alike.

Change-Id: Ica338cd492ac535833933a8b7cd5191217c5ab5b
Reviewed-on: https://code.wireshark.org/review/685
Reviewed-by: Guy Harris <guy@alum.mit.edu>

(Minor) prefs_register_protocol() callback not required; Therefore: simplify proto_reg_handoff...().

Change-Id: Ic09351d7b04d55814211618056e92430bc114f6f
Reviewed-on: https://code.wireshark.org/review/684
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Tested-by: Bill Meier <wmeier@newsguy.com>

Add a length-check to heuristic to prevent any exception during test; add editor modelines.

Change-Id: I8b4f565699c4d044cc3b64b22115a921b97b3d38
Reviewed-on: https://code.wireshark.org/review/683
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Tested-by: Bill Meier <wmeier@newsguy.com>

(Trivial): add editor modelines. use consistent indentation & do whirespace re-formatting.

Change-Id: Ic8378bf398bcabfe1f50f7f6ccbe10e2e84884d5
Reviewed-on: https://code.wireshark.org/review/682
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Tested-by: Bill Meier <wmeier@newsguy.com>

Remove unused const variables errors seen with recent Clang version

Fixes bug 9886

Change-Id: I8624ef1c5874aea5521d21c998510fc29c838936
Reviewed-on: https://code.wireshark.org/review/657
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

 #if 0 (with XXX comment) use of try_conversion(); Also: do misc cosmetic changes.

Change-Id: Ib31439cfaaf5c08113b87f0bbb0b75932ca06bc9
Reviewed-on: https://code.wireshark.org/review/680
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Tested-by: Bill Meier <wmeier@newsguy.com>

Fix -Wabsolute-value in TAP Compare stat (Found by Clang 3.5)

tap-comparestat.c:321:55: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
tap-comparestat.c:321:55: note: remove the call to 'abs' since unsigned values cannot be negative
tap-comparestat.c:347:56: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
tap-comparestat.c:347:56: note: remove the call to 'abs' since unsigned values cannot be negative

Change-Id: Ice950228d844373abcbd0cdc8ea05079b8b933d0
Reviewed-on: https://code.wireshark.org/review/676
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix -Wabsolute-value in GTK Compare stat (Found by Clang 3.5)

compare_stat.c:235:34: error: taking the absolute value of unsigned type 'guint32' (aka 'unsigned int') has no effect [-Werror,-Wabsolute-value]
compare_stat.c:235:34: note: remove the call to 'abs' since unsigned values cannot be negative
compare_stat.c:406:55: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
compare_stat.c:406:55: note: remove the call to 'abs' since unsigned values cannot be negative
compare_stat.c:432:56: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
compare_stat.c:432:56: note: remove the call to 'abs' since unsigned values cannot be negative

Change-Id: I03cc3136df3faf42c25986f52f015b8d87ce5774
Reviewed-on: https://code.wireshark.org/review/675
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix -Wabsolute-value in GTK SCTP Graph (Found by Clang 3.5)

sctp_graph_dlg.c:1562:18: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
sctp_graph_dlg.c:1562:18: note: remove the call to 'abs' since unsigned values cannot be negative
sctp_graph_dlg.c:1574:18: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
sctp_graph_dlg.c:1574:18: note: remove the call to 'abs' since unsigned values cannot be negative

Change-Id: If3cdce123256543a95fe0b596eee962e1d93d118
Reviewed-on: https://code.wireshark.org/review/674
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix -Wabsolute-value in ICMP dissector (found by Clang 3.5)

packet-icmp.c:1245:7: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
packet-icmp.c:1245:7: note: remove the call to 'abs' since unsigned values cannot be negative
packet-icmp.c:1245:30: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
packet-icmp.c:1245:30: note: remove the call to 'abs' since unsigned values cannot be negative
packet-icmp.c:1254:6: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
packet-icmp.c:1254:6: note: remove the call to 'abs' since unsigned values cannot be negative
packet-icmp.c:1254:29: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
packet-icmp.c:1254:29: note: remove the call to 'abs' since unsigned values cannot be negative
packet-icmp.c:1623:7: error: taking the absolute value of unsigned type 'guint32' (aka 'unsigned int') has no effect [-Werror,-Wabsolute-value]
packet-icmp.c:1623:7: note: remove the call to 'abs' since unsigned values cannot be negative
packet-icmp.c:1629:7: error: taking the absolute value of unsigned type 'guint32' (aka 'unsigned int') has no effect [-Werror,-Wabsolute-value]
packet-icmp.c:1629:7: note: remove the call to 'abs' since unsigned values cannot be negative

Change-Id: I6b344d01b8239fb93aedf95d954ef1243ba45a6b
Reviewed-on: https://code.wireshark.org/review/673
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Use constants instead of vwr->STATS_LEN in some cases.

In some cases, we know, based on the FPGA code, what vwr->STATS_LEN is,
so use that #define.

While we're at it, replace some hardcoded numbers that represent the
statistics trailer length with the appropriate #define.

Also, combine two identical case arms for Ethernet into one.

Change-Id: I0bdea8e5aab146094ad21fa7e67dca2913da688b
Reviewed-on: https://code.wireshark.org/review/672
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Fix setting of STATS_LEN - it's what's in the file, not what we *generate*.

vwr->STATS_LEN is the length of the statistics trailer at the end of the
packet, and it's the same for S2 and S3 versions of the WLAN card.  It
should *not* be set to the length of the metadata headers that we
*generate and put in front of the packet data that we hand to our
callers*.

Get rid of a debugging message while we're at it.

Change-Id: I465b5ba4dedb88f1f401d34439b44b16a4bb01cc
Reviewed-on: https://code.wireshark.org/review/671
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Clean up naming and get rid of unused and duplicate definitions.

The so-called "radiotap headers" bear no resemblance to actual
radiotap.org radiotap headers; there are no presence bits, for example.
Get rid of the words "radiotap" and "radio tap", get rid of #defines
that aren't used, get rid of duplicate definitions.

Change-Id: I0bb6abda5d13bf20810dc865a567f4ec51a38056
Reviewed-on: https://code.wireshark.org/review/670
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Fix indent (use 2 spaces)

Change-Id: If7872c510d20e9f04e44e3fdf09c023e5ac602d9
Reviewed-on: https://code.wireshark.org/review/648
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Fix compilation of packet-aruba-erm.c

Change-Id: I30bef3eb92e1bdf67e4a3019ef3542e14ac9505c
Reviewed-on: https://code.wireshark.org/review/669
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Enhance dissector Aruba ERM

Support type 0 (legacy), type 1 (peek), type 3 (pcap+radio) mode
via preference

type 2 (airmagnet) is no yet supported

Change-Id: I4f0d10e5d9b87bdcf5863d84e565201acaeee45b
Reviewed-on: https://code.wireshark.org/review/647
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix lrexlib.c clang static analyzer warning

This fixes a "Argument with 'nonnull' attribute passed null" warning
generated by the clang static analyzer.  It's a false positive, but
easy to remedy.

Change-Id: Id737d1ac29765ed26a416c5cd13bedafee478fb6
Reviewed-on: https://code.wireshark.org/review/661
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix README.heuristic wording to Bill Meier's correction

Change-Id: Ifeb61abdcc7aa049529d584ff3fe50b6fd79fe21
Reviewed-on: https://code.wireshark.org/review/662
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Better document the offset of the MPDU in the packet data.

In the S1 FPGA code, copy the "MPDU starts at 4 or 6" comment.

Get rid of misleading comment in the S2/S3 FPGA code; we're using the
MPDU_OFF field from the private data structure, so we're not calculating
*anything* at that point.  Put in comments indicating what's being done
at the point where those calculations are actually done.

Change-Id: Ifda709a6b2aa7edad964f639086012c72c0a71fe
Reviewed-on: https://code.wireshark.org/review/668
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Add a #define for the record header length, and use it.

Add a comment describing (some of) the record, while we're at it, and
update another comment to reflect reality.

Change-Id: Ia7f1432402b843b96983375c0e0842c030de0cee
Reviewed-on: https://code.wireshark.org/review/667
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Some records have two statistics blocks; clarify that.

Change-Id: I139cd73f6fff84528e105f9246a4207aa48a68df
Reviewed-on: https://code.wireshark.org/review/666
Reviewed-by: Guy Harris <guy@alum.mit.edu>

More use of vwr->STATS_LEN to clarify what code is doing.

Change-Id: I9292f7b054f7b71727409deb062200a0301db5ee
Reviewed-on: https://code.wireshark.org/review/665
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Get rid of duplicate code.

Change-Id: I39515c13f667a62445e3498cf90742dc271e390c
Reviewed-on: https://code.wireshark.org/review/664
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Use vwr->STATS_LEN instead of numbers, and eliminate redundant checks.

Instead of throwing in 48 and 64 as numbers, use vwr->STATS_LEN to
indicate what the lengths are.  Yeah, it has to be fetched at run time,
but big deal.

That also shows that, as we've already rejected records whose size is
less than vwr->STATS_LEN, we don't have to check for that, so eliminate
those checks.

Change-Id: Id4822b3e5a02abfffb2da96a50999e36548a4279
Reviewed-on: https://code.wireshark.org/review/663
Reviewed-by: Guy Harris <guy@alum.mit.edu>

len and caplen are derived independently, so set WTAP_HAS_CAP_LEN.

Fix presumed typo while we're at it.

Change-Id: Ic8ae6e6669e5c5fc618ec2516af98ba2390487ce
Reviewed-on: https://code.wireshark.org/review/660
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Remove more now-unused stuff.

Change-Id: I8f65ed38e0b5f8923b7c273c2fca4c2b57c5af9c
Reviewed-on: https://code.wireshark.org/review/659
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Get rid of a no-longer used preference.

We no longer need a preference to determine the byte order of the T and
L in the TLVs, as libpcap and libwiretap both, when reading a file,
translate from the file's byte order to the reading host's byte order
and, in fact, currently don't use the variable in which the preference
is stored; eliminate the preference.

Change-Id: Id06a6284960c1ac77028af07f3937eb4a7b0acaa
Reviewed-on: https://code.wireshark.org/review/656
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Fix indent (use 4 spaces) and add Modelines

Change-Id: I50c66638d48a6579b50204769bd27210d9d6c228
Reviewed-on: https://code.wireshark.org/review/655
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Fix Dead Store (Dead assignement/Dead increment) warning found by Clang

Change-Id: I688509fff7d5b663f2ff54b42a80c52592613213
Reviewed-on: https://code.wireshark.org/review/654
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Fix -Wunused-const-variable found by Clang 3.5

Change-Id: Idf5ac9e067a647d3e1be82df352d956c87d6050c
Reviewed-on: https://code.wireshark.org/review/653
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Use try_val_to_str() in heuristics test (intead of a loop); ensure no exception during test.

Change-Id: Ib55ccca4a025fb1cbef52ffa01888fef6d72156a
Reviewed-on: https://code.wireshark.org/review/651
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Tested-by: Bill Meier <wmeier@newsguy.com>

Fix two bugs & do various other changes.

Bugs fixed:
- Catch exceptions during heuristics test so that the sequence of
  dissector heuristics tests is not terminated abnormally;
  (Prevents incorrect tshark "one-pass" dissection);
- Comment out registration of heuristic for TCP; TCP dissection
  requires different code than for UDP. ("XXX: ToDo" added)

Misc:
- Create/use two extended value_strings;
- "UL" is not needed as a modifier for several constants;
- Remove some unneeded initializers;
- Localize some variables;
- Remove unneeded '#include <stdlib.h>
- Do some whitespace changes.

Change-Id: Ida11cb6b26911c0032155fde7491dd2a6f136c34
Reviewed-on: https://code.wireshark.org/review/650
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Tested-by: Bill Meier <wmeier@newsguy.com>

Ensure there's no exception during the initial heuristics test.

Change-Id: I7d7e8bf2d1d63b34659f6de506eb4b2693780cce
Reviewed-on: https://code.wireshark.org/review/649
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Tested-by: Bill Meier <wmeier@newsguy.com>

Add modelines information and peekremote register for futur use...

Change-Id: I81f726cd20878770a37d9489f40d473960714425
Reviewed-on: https://code.wireshark.org/review/646
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Display framed_ipv6_prefix as an IPv6 address even when it's not the full
16 bits.

Change-Id: I6cef08e2da9467cb54b5d08526c77c87e7afe1fa
Reviewed-on: https://code.wireshark.org/review/645
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Add Lua heuristic dissector support

This adds the ability for Lua scripts to register heuristic dissectors
for any protocol that has registered a heuristic dissector list, such
as UDP, TCP, and ~50 others. The Lua function can also establish a
conversation tied to its Proto dissector, to avoid having to check the
heuristics for the same flow. The example dissector in the testsuite
has also been enhanced to include a heuristic dissector, to verify
the functionality and provide an example implementation.

Change-Id: Ie232602779f43d3418fe8db09c61d5fc0b59597a
Reviewed-on: https://code.wireshark.org/review/576
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Bug 9704: GSM_MAP SendRoutingInfoForSM incomplete

Added the field information for Phase 1 for the Send Routing Info
For Sm message per request of ticket 9704. Code per the suggestion of
Anders Broman. Adding Phase 1 code to GSMMAP.asn.

Did not have any data to verify that the change worked.

Change-Id: Ic387e2e12e8893abb0f453f5010909ffbfd1808c
Reviewed-on: https://code.wireshark.org/review/147
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

MBIM: fix 3GPP SMS PDU record dissection

Change-Id: I232a12eb7f7ee49464bb45c6f284ca3a3825909c
Reviewed-on: https://code.wireshark.org/review/644
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Fix dissection of RDMA WRITE ONLY IMM packets.

Change-Id: Icdc4aaa243191dc85e067a75a068c175fa09296b
Reviewed-on: https://code.wireshark.org/review/637
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Enhance ZigBee Routing Table
Make field filterable and use value_string for status

Based from capture available in bug 9855

Need to continue... lot of enhance is possible in ZigBee dissector...

Change-Id: I0ac84e05a7b8b54e9879abbb7495034318188394
Reviewed-on: https://code.wireshark.org/review/631
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

add a test for SSL/TLS decryption using the master secret

rename the existing SSL test to clarify that it uses the server's
private key for decryption

Change-Id: I13598fc4cf724b144a8f27bfa7a3316acfc78728
Reviewed-on: https://code.wireshark.org/review/640
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>

Use dissector_try_uint_new() and include diam_sub_dis_inf when calling all
AVP sub dissectors.

Change-Id: I6dcc362ea755794d3e18d8d27ed2128b46bd887b
Reviewed-on: https://code.wireshark.org/review/642
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Add tfshark.rc.in to Makefile.am

Change-Id: I7d987534243a3e1575191f67d8b660c3c4c4731f
Reviewed-on: https://code.wireshark.org/review/641
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Rename and relabel some fields, as per emburey's comment.

Change-Id: I8e32672912bb202903182126613ce3394e0e1c35
Reviewed-on: https://code.wireshark.org/review/639
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Fix value_string checks in checkAPIs.pl.

Some strings contain semicolons, which meant g36db2df was terminating
our REs too early. Try terminating them with '}' followed by ';'.

Change-Id: I97f63351ef35c91e3123d9abd47576d47fea4b2b
Reviewed-on: https://code.wireshark.org/review/638
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Note that a dissector heuristic test *must not* cause an exception before returning FALSE.

Change-Id: I9f1ab000f7a2c554d1c20abf8ca4e4bab4b5ef27
Reviewed-on: https://code.wireshark.org/review/635
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Tested-by: Bill Meier <wmeier@newsguy.com>

Add a check for newlines in value_strings.

Update checkAPIs.pl to look for newlines in value_strings and
enum_val_t's. We now have to perform the check before we strip quoted
strings. Hopefully that won't cause a problem. Rename the check since
we do more than check for NULL termination.

Add modelines.

Fixes bug 9878.

Change-Id: I39dd910db60c7028ea4bdb58e8cfdb239c094748
Reviewed-on: https://code.wireshark.org/review/628
Reviewed-by: Gerald Combs <gerald@wireshark.org>

ULP: add UDP transport

and fix indent (use 2 spaces)

Change-Id: I558616e3030a55a845cd4ba31ac32f08bdf8376d
Reviewed-on: https://code.wireshark.org/review/634
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Pre-Commit Hook check to check for newer version

 Insert a short check to always check for newer versions
 in the tool directory of the pre-commit script

 So far, only a warning is being generated, allowing the
 developer to decide for him/herself

Change-Id: I6fce60e3de1d051757d0ed38eae8fdc94cec7662
Reviewed-on: https://code.wireshark.org/review/633
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Assorted cleanups of field names and descriptions.

The PeekRemote headers are 802.11, so "Dot80211" is redundant.

"Wep" really means "Protected" as there's also WPA/WPA2.

"FlagsN" means "802.11n", not "802.11ac", and the "n" in "flagsn"
indicates that.  Also, "Hz" stands for "Hertz", as in "Heinrich Hertz",
so the "H" is capitalized.

Change-Id: If46cc4859ae8d65a199c9ad1fd48d2f2128ccd3d
Reviewed-on: https://code.wireshark.org/review/630
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Add support for Aruba ERM Radio-Format

This adds support for a variant of the current Aruba ERM format,
a new format that provides rdio information. This addresses
enhancment bug 9880.

Change-Id: Ia38ff09d9f814193bdc544466dbd005123771262
Reviewed-on: https://code.wireshark.org/review/629
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Get rid of $Id$, add some comments.

Change-Id: I3f34484f18fba45b23b5acc924b56e5b62291114
Reviewed-on: https://code.wireshark.org/review/627
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Get rid of space-before-tab in indentation.

Change-Id: If747e7b2af34e27ca8558293140a74691a0113b4
Reviewed-on: https://code.wireshark.org/review/624
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Thou shalt not put newlines in the strings in value_string tables.

That just breaks too many things.

This catches the examples of that found in bug 9878.  There might be
others that my grepping didn't find.

We should also have the checkAPIs.pl script check for this, so this
isn't a full fix for bug 9878.

Change-Id: I3bf6f1fc0fe8654d0f54a995e72f1966ae012f5e
Reviewed-on: https://code.wireshark.org/review/623
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Consistently put -lm at the end of library lists.

I'm not sure why it's associated with GLIB_LIBS in most entries - at
some point, was it the case that we didn't use libmath routines but GLib
did? - but there's no guarantee that other libraries don't use them, so
put them at the end of the lists.  That also makes the lists a bit more
consistent.

(Yes, I know, the wireshark_ldadd list is followed by some other
libraries in the library lists that use it, so -lm isn't *really* at the
end everywhere.)

Change-Id: Ia2e0b295fdaae771fdee7d5eecdefaa83fae9992
Reviewed-on: https://code.wireshark.org/review/622
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Fix bug 9866: Qt 'Clearing filters does not seem to affect the packet list'

Clicking the "X" clear filter button now applies the clearing to the
displayed packet list.  This commit also adds tooltips for the display
filter display filter box's butons.

Change-Id: I827020a7705a32a4a9204d22e94942853e25bba6
Reviewed-on: https://code.wireshark.org/review/601
Reviewed-by: Evan Huus <eapache@gmail.com>

Add dissection of flags, status, flagsN for Omnipeek/Peek Remote dissector.

Information about value of flags from Emburey

Change-Id: Iba79fba8e95cd2fc80f6fba5fa937d5485fbb381
Closed-bugs: 9586
Reviewed-on: https://code.wireshark.org/review/595
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>

Fix bug 9021: 'RTP not decoded inside the conversation in v.1.10.1'

The behavior for SIP/SDP handling of RTP conversation tracking
changed in v1.10, with some unintended consequences.  The bugs did not
show up at the time because wireshark makes 2 passes of the packet list,
and so the problems auto-corrected themselves in most cases.  Unfortunately,
a change in r53641 modified how UDP behaves, making it always create
conversations for UDP packets, and that exposed the bugs inherent in the
SIP/SDP code changes.

This commit reverts the behavior of SIP/SDP to its pre-1.10 model, but
creates a new preference setting for "Delay SDP changes for tracking media",
which if enabled, will turn on the new (but buggy) model introduced in 1.10.
This preference is *disabled* by default, since for a majority of cases the
new behavior is worse than the previous behavior.

The preference, and this commit's fix, is not intended to last long. I intend
to re-write the SIP/SDP/RTP interaction model for release 1.11 - I think it's
too big a change for 1.10, however, which is why I submitted this commit.

Change-Id: Ic5601749d6c2344e952ced8206dd9296bfdc4b90
Reviewed-on: https://code.wireshark.org/review/543
Reviewed-by: Evan Huus <eapache@gmail.com>

MAC LTE: fix a typo in Buffer Size value_string

Change-Id: Ie38726fb51a74bbcdc630550e61fa0e934ffdd1e
Reviewed-on: https://code.wireshark.org/review/618
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Fix whitespace tabs to spaces, indent by 4, modelines

Change-Id: I8bb64a879d1aa779c9ac85db306cbd34d1188243
Reviewed-on: https://code.wireshark.org/review/617
Reviewed-by: Evan Huus <eapache@gmail.com>

Fix indent (Remove space and use tabs)

Change-Id: I9cc33a43e0f06dfad3f9fb53ad0df636f2ea7020
Reviewed-on: https://code.wireshark.org/review/615
Reviewed-by: Evan Huus <eapache@gmail.com>

Fix Bug 9873: 'Qt: right-clicking on toolbars only shows checkmarks'

Add the text descriptions for the two toolbars: "Main Toolbar" and
"Display Filter", so the right-click context menu shows what you're
removing/adding. And add a View->Toolbar sub-menu, with checkable
"Main Toolbar" and "Display Filter" entries, which enable you to
show/hide the toolbars via the menu.

If someone has/prefers better names for these things, I'm all ears.

Change-Id: I55b9fbaed2ef6dca3260fa9dfdddd7dad95d05c4
Reviewed-on: https://code.wireshark.org/review/608
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Fix a trivial typo

Change-Id: Ibb2609b865ebaca14572c480d06ecc6ae7ef73f5
Reviewed-on: https://code.wireshark.org/review/614
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

Fix Bug 9872: 'SIP status line in 200 OK for de-registration is misleading'

The status line of the 200 OK during a deregistration is (1 bindings), but it
should be (0 bindings). Wireshark should check the "expires=0" in the contact
header not just count the number of the contact lines. But since it's not
truly valid to have expires=o contacts in responses, this commit adds expert
info warning of such.

Also, the REGISTER request itself already says "(remove all bindings)"
in the Info column currently if the Contact was a '*', but it didn't
say something similar if only de-registering one or more explicit
contacts. This has been fixed as well.

Lastly, this fixes three other bugs I found while reading the code and testing:
(1) comma-separated Contact headers will be displayed as a single one if
the first one(s) don't have header params but a subsequent one does; and
(2) the last Contact header param is displayed with the trailing '\r\n'
header separator; and (3) the SIP REGISTER response code displayed contact
binding info for responses other than 2xx, which isn't logical.

Since all of these are in the same area and not critical, I'm lumping these
all together.

A test capture file used for testing is attached to the bug.

As an aside, the SIP header parsing code needs to be refactored. Most SIP
headers follow a common ABNF pattern, and should be parsed using a common
function(s) so these issues don't crop up for specific headers.

Change-Id: I16c531fcb244dc121fc0e8046908e475b41489f9
Reviewed-on: https://code.wireshark.org/review/612
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Enhance VXLAN dissector

* Fix modelines (no CR after modelines)
* Add UDP Port (Attributed in draft 04 Port 4789)
* Update link to last draft (no specify change)

Change-Id: I4cd89719ae00eb64ce4c234c39b9e18cdc1b8b93
Reviewed-on: https://code.wireshark.org/review/613
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>

Add Export PDU Dialog (Wireshark Qt)

Rebase with last change and add Logcat export

Change-Id: Idc9b444b1bf14b95ff60e8466e94f7eecd875b47
Reviewed-on: https://code.wireshark.org/review/14
Reviewed-by: Anders Broman <a.broman58@gmail.com>

fix the SSL decryption using the master secret
this was broken in 21aa7168c7565445ee544ee78fb6c836a63cd4ed

to be on the safe side, we assue that return value >= 0 means success,
< 0 means failure

Change-Id: I1d03000e6b6d70fac6bef8766d28990d953c8e27
Reviewed-on: https://code.wireshark.org/review/609
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>

GTK_STOCK_PRINT_ERROR was missing in GTK+ < 2.14, too

Change-Id: I1be141c58252b8bb0db2ffff2edbb80f92c69cd6
Reviewed-on: https://code.wireshark.org/review/606
Reviewed-by: Balint Reczey <balint@balintreczey.hu>
Tested-by: Balint Reczey <balint@balintreczey.hu>

Don't use some stock icons missing in old (< 2.16) versions in GTK+

Change-Id: I2716a8a25627de9c3945fbf5117edcb4859aa95f
Reviewed-on: https://code.wireshark.org/review/605
Reviewed-by: Anders Broman <a.broman58@gmail.com>

EPL: Support SyncReq and SyncResp Frames

  - For PollResponse-Chaining SyncReq and SyncResp frames were introduced.
    Those frame-types are not recognized by Wireshark yet.

  - Currently only the FeatureFlags 0-13 where interpreted by Wireshark.
    Flags 14-15 and all extended flags where missing.

    14 = SDO Read/Write All by Index
    15 = SDO Read/Write Multiple Parameter by Index
    16 = Multiple-ASend Support (TRUE = Device supports Multiple-ASend; FALSE = Device doesn’t support Multiple-ASend)
    17 = Ring Redundancy (TRUE = MN supports ring redundancy; FALSE = MN does not support ring redundancy)
    18 = PResChaining (TRUE = Device supports PResChaining; FALSE = Device does not support PResChaining)
    19 = Multiple PReq/PRes (TRUE = Device supports Multiple PReq/PRes; FALSE = Device does not support Multiple PReq/PRes)
    20 = Dynamic Node Allocation (TRUE = Device supports DNA; FALSE = Device does not support DNA)

Signed-off-by: Lukas Emersberger <lukas.emersberger@gmail.com>
Change-Id: I9ac19f8b71b1be1094f410141c0f806996b1cb25
Reviewed-on: https://code.wireshark.org/review/589
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

Migrate GTK icon handling to GTK 3.10 API

GtkStockItem usage is deprecated with all the GTK_STOCK_.* stock ids.
We keep a stock id based approach but without relying on GTK's
GtkStockItem system.

We create our own internal stock ids for {icon, label} tuples and keep
the original GTK stock id #define-s and values to preserve backward
compatibility.

Change-Id: Ia0b35a5903f079e92c8026e3df21bbf0be2d06b0
Reviewed-on: https://code.wireshark.org/review/302
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Replace (int)sizeof(guint*) by value
guint8 => 1
guint16 => 2
guint32 => 4
guint64 => 8

Change-Id: I23ae863115522779d99cfadeb698ed43ca626667
Reviewed-on: https://code.wireshark.org/review/597
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Add value string (type and data rate) from omnipeek

Change-Id: I1ed387f1cb8d207c32c5202b578bd452cef4401c
Reviewed-on: https://code.wireshark.org/review/594
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix incorrect file in epan/Makefile.am when build with ENABLE_STATIC

Change-Id: I7f76e3e3d2d6f3edd2a658fccd5953393ef74ed7
Closed-bug: 9871
Reviewed-on: https://code.wireshark.org/review/596
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix Bug 9870 'Lua: trying to call/get an invalid name results in a get-loop error'

Due to the change I made previously for how methods are accessed, if you try
to access one that doesn't exist (for example mistype it or whatever), you get
an internal Lua error about a loop in table get, as opposed to the right error
message about the field not existing.

That's because I had set the class' metatable __index metamethod to point to
the class table, which of course has the metatable with the __index
metamethod, causing a lookup loop.  Blech.

Change-Id: I20d3717feadd45f652c2640e1671846184e7082d
Reviewed-on: https://code.wireshark.org/review/593
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

packet-scsi.c minor changes - add WWN dissection and fix a typo
Change-Id: I0ef84e088988f1a40863ab54b722faace8bacc31
Reviewed-on: https://code.wireshark.org/review/592
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Try to fix -Wparentheses-equality errors.

Clang in XCode 5.0 currently fails with

    error: equality comparison with extraneous parentheses
    [-Werror,-Wparentheses-equality]

Change-Id: I7ca2e81959e777f923bdff1273aca6c56b100f6c
Reviewed-on: https://code.wireshark.org/review/600
Reviewed-by: Gerald Combs <gerald@wireshark.org>

dissect the CertificateVerify handshake message

Change-Id: I0f6887c86afeb5b4ae8b9910688863c7dc866a99
Reviewed-on: https://code.wireshark.org/review/599
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Martin Kaiser <wireshark@kaiser.cx>

SSL/TLS payload decryption:
don't make private key and keylog file mutually exclusive

if we find a private key that does not match or is not usable for
getting the pre-master secret (e.g. because we're using an ephemeral
cipher suite), don't give up and exit with an error

continue reading the keylog file and search for our master secret there

Change-Id: I59fb460339e3e606a077b3a902fa1f9777b5e118
Reviewed-on: https://code.wireshark.org/review/590
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>

Replace "see copyright notice in" message with full license

Should make the licensecheck buildbot happy.

Also add "Public domain MIT/X11 (BSD like)" to the list of permitted licenses,
since it is a combination of two permitted licenses.

Change-Id: Ibc4ead09af89e9225c4e0589a2b7d06dcee6a44e
Reviewed-on: https://code.wireshark.org/review/581
Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
Reviewed-by: Evan Huus <eapache@gmail.com>

Remove 1 duplicate #include and several unneeded #include's.

Change-Id: Iab434edd114082586cc13f05b38e6a9d256a74c5
Reviewed-on: https://code.wireshark.org/review/588
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Tested-by: Bill Meier <wmeier@newsguy.com>