git.samba.org - metze/wireshark/wip.git/log

"#if 0" out an unused value_string table.

The field that uses it is also "#if 0"'ed out.

"#if 0" out, rather than commenting out, the variable for that field, for
consistency.

Change-Id: If3c6ba6c780f41b35d3f28adcf4d8a29117c4652
Reviewed-on: https://code.wireshark.org/review/11609
Reviewed-by: Guy Harris <guy@alum.mit.edu>

MPTCP: Use wmem_list instead of GSList

Change-Id: Idb4e4d6d19169d6cacd98664232fd1fbd2cc2dca
Reviewed-on: https://code.wireshark.org/review/11534
Reviewed-by: Evan Huus <eapache@gmail.com>
Petri-Dish: Evan Huus <eapache@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Add Nokia Intelligent Service Interface (ISI) dissector

From: https://github.com/shr-project/isi-wireshark-plugin/

Bug: 11676
Change-Id: If3f4d7e3e1dd674cb99e96eabdc3491dec76ea3a
Reviewed-on: https://code.wireshark.org/review/11580
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

No need to include io.h.

This includes wsutil/file_util.h, which includes io.h, so we don't need
to include it ourselves.

Change-Id: I96b111d2b5a4f27895c1e4b19c31eee2a4d5d554
Reviewed-on: https://code.wireshark.org/review/11595
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

[Dissector tables] DISSECTOR_TABLE_NOT_ALLOW_DUPLICATE -> DISSECTOR_TABLE_ALLOW_DUPLICATE

Change-Id: Id4d8d9a2d2befee7b82ac4e0e6f2f1b8f03b4532
Reviewed-on: https://code.wireshark.org/review/11603
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>

DCERPC: fix compilation with OSX buildbots and Ubuntu 15.10

Change-Id: I032874d0f023d99478be03c192cb529055a6c53e
Reviewed-on: https://code.wireshark.org/review/11601
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

packet-dcerpc: implement dissecting of rpc_sec_verification_trailer

See [MS-RPCE], https://msdn.microsoft.com/en-us/library/cc243559.aspx
and frame 34 in
https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=dcerpc-winreg-with-rpc-sec-verification-trailer.pcap

Change-Id: Ia96c1b220da5d22f2fbf216b9e6fa70b5e068deb
Signed-off-by: Gregor Beck <gbeck@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/11362
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Major Re-factoring of the dissector and some new features.

A change-list is as follows:
- Removed un-necessary dissector revision updates from the file header since GIT tracks these nicely.
- Added proper size detection of Modbus RTU messages (including exception responses), when dealing with partial TCP segment reassembly.
- Moved the 'register' decode preferences to the Modbus dissector as TCP vs. RTU granularity isn't needed in this case.
- Obsoleted un-unused 'address type format' user preferences
- Cleaned up dissect_modbus_data to remove proto_tree_set_text instances.
- For decoded register tree objects, use register 'address' instead of 'value' for the filter field to provide a more useful filter.
- Added in conversation support, to attempt to track responses back to matching requests.
- Use conversation support to attempt to populate proper register address offsets in the response messages. Currently each request is saved and each response looks for the last prior request that matches the function code.
- Re-factored Modbus dissector to split apart request vs. response decoding. This has led to cleaner code paths, but some duplication where replies and requests are identical format.

Change-Id: I0c86ae85b8ae4cc59b037e5f68f408833205fadd
Reviewed-on: https://code.wireshark.org/review/9914
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Another unnecessary include of io.h.

Change-Id: Ie4a8d79474ae61194b1ceaafad45cca9b2970b60
Reviewed-on: https://code.wireshark.org/review/11589
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Move -fno-delete-null-pointer-checks to optional

It is no longer supported on El Capitan's clang, which was causing my
cmake/osx/qt build to fail with:

clang: error: optimization flag '-fno-delete-null-pointer-checks' is not
supported

Change-Id: Idfac336758cdea9a34446d8281cd237ad3ee6823
Reviewed-on: https://code.wireshark.org/review/11571
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Evan Huus <eapache@gmail.com>

reassemble: Add key destroy function to g_hash_table

Fixes memleak in reassemble.c

480 bytes in 60 blocks are definitely lost in loss record 3,010 of 3,059
   at 0x4C28C10: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0xADA3328: g_malloc (in /usr/lib/libglib-2.0.so.0.4600.1)
   by 0xADBA512: g_slice_alloc (in /usr/lib/libglib-2.0.so.0.4600.1)
   by 0x6575C7D: fragment_reassembled (reassemble.c:804)
   by 0x6577785: fragment_add_seq_check_work (reassemble.c:2027)
   by 0x6577880: fragment_add_seq_next (reassemble.c:2068)
   by 0x6E614E6: dissect_sccp_message (packet-sccp.c:2875)
   by 0x6E63641: dissect_sccp (packet-sccp.c:3401)
   by 0x6546CF7: call_dissector_through_handle (packet.c:620)
   by 0x6546EA1: call_dissector_work (packet.c:706)
   by 0x6547A04: dissector_try_uint_new (packet.c:1163)
   by 0x6547A65: dissector_try_uint (packet.c:1189)

Change-Id: I0117b48e1e5d5688c49f264f24387dd6de1d6e08
Reviewed-on: https://code.wireshark.org/review/11541
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Don't include io.h in Flex scanners - they're not interactive.

We don't have any Flex scanners that support an interactive command-line
interface, so none of our scanners are, or need to be, interactive.
Mark text2pcap's scanner as not interactive.

That means none of our scanners should call isatty(), so they don't have
any need to include <io.h> on Windows; remove that include from the
Lucent/Ascent text capture scanner.

Update a comment to reflect that what matters isn't whether we can read
from a terminal or whether we actually do so, what matters is whether
they read *interactively* from a terminal (if you want to run text2pcap
reading from the standard input and type at it, be my guest).

Change-Id: I59979d1fdb37e1913125a400963ff7a3fa6b9bbd
Reviewed-on: https://code.wireshark.org/review/11587
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Qt: Check for a sane window geometry.

On Windows (and probably X11) it's possible to set an offscreen window
geometry. Add a rect_on_screen function to qt_ui_utils and use it as a
sanity check in MainWindow::loadWindowGeometry.

If this doesn't work well (e.g. if we end up with dueling Qt and GTK+
geometries) we might want to create separate Qt and GTK+ preferences.

Bug: 11568
Change-Id: Icde1181671770356e87f07d584894ec3148e1bd2
Reviewed-on: https://code.wireshark.org/review/11584
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Get rid of ws80211_frequency_to_channel().

Use ieee80211_mhz_to_chan() instead.

Change-Id: I1d9a3b9c3a5ad2b1a5bd3f8d10b7f8b1bbcba51d
Reviewed-on: https://code.wireshark.org/review/11586
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Match what most source say are the actual Japanese 4.9 GHz channels.

I don't know where Matthew Gast got his 4.9 GHz channels, but IEEE Std
802.11-2012 and ARIB STD T-71 have something different.

Change-Id: I5d86b12193e38422d3702f36cb106fe858daa4b5
Reviewed-on: https://code.wireshark.org/review/11585
Reviewed-by: Guy Harris <guy@alum.mit.edu>

docs: Windows CMake builds

Updated the WSDG Windows build instructions to use CMake.

Change-Id: I5006c07e09ec6f628e8bc44006a3f1086e831a3c
Reviewed-on: https://code.wireshark.org/review/11485
Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
Petri-Dish: Graham Bloice <graham.bloice@trihedral.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

dcerpc: add check for mutually exclusive function pointers

Found by clang analyzer.

Change-Id: Idb2e80edbb5b264fd257a7b4208ff75bd543df88
Reviewed-on: https://code.wireshark.org/review/10970
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

DNS: Register dissector by name

Change-Id: I0eb03f2452c4f7fef0f527c7ce7154d479fcc3fd
Reviewed-on: https://code.wireshark.org/review/11544
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

[IPsec] Hand the subdissector the payload data only,
not including the padding and auth data.

Change-Id: Ib883fcb44def8d6fbdde19729519b40b32d78577
Reviewed-on: https://code.wireshark.org/review/11563
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

extcap: Provide capture filter to extcap binary

Added the option --extcap-capture-filter to extcap to send the capture filter
from the main screen to the extcap binary.

Change-Id: I75f0d7dbec810551225377f9221053298488cdd5
Reviewed-on: https://code.wireshark.org/review/11423
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>

packet-dcerpc: let dcerpc_get_proto_name() handle unknown uuids

This fixes a regression in commit e0e574d16748313dd8903f886d1af9eb0821fee7.

Change-Id: I447001a84e17a76ec77c48f736bbfcd8cc6324a1
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/11574
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

packet-dcerpc: fix dissecting of decrypted payload

This fixes a regression in commit e0e574d16748313dd8903f886d1af9eb0821fee7.

Change-Id: Iccdeeb488ec70727fc637ca548637e5a5e54ef1c
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/11573
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

randpkt: code restyle.

Code has been restyled towards a more modular approach. This will allow
the split of the code into a core and an app. Once splitted the code can
be reused by other apps, useful for testing.

Change-Id: I96083a7cc1a3417d10961700e5c7c27d32e350e8
Reviewed-on: https://code.wireshark.org/review/11355
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

gssapi: add init in wrap_dissect_gssapi_payload().

Found by clang analyzer.

Change-Id: I1c5cb13e174df588c8834508b10790d3fd5b272a
Reviewed-on: https://code.wireshark.org/review/11564
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Declaring volatile pointers to functions is hard, let's go shopping!

Change-Id: I9686f0c2be43df7a00a00ad2f6aadf6db464d809
Reviewed-on: https://code.wireshark.org/review/11570
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Squelch a "setjmp/longjump may clobber" warning.

Clean up indentation while we're at it.

Change-Id: If2068fe17664d78c8fc9747b0ee63bac0213d174
Reviewed-on: https://code.wireshark.org/review/11567
Reviewed-by: Guy Harris <guy@alum.mit.edu>

SSL: fix SCTP port association so as to match what is done for UDP/TCP

Change-Id: I84f85b7b87ecd9e7801559f7eae2cc98f5a12ab7
Reviewed-on: https://code.wireshark.org/review/11560
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Skinny: fix dissector registration for SSL

Change-Id: Ia3f29b703b8271f52dfed9d8b46e18f405785d3a
Reviewed-on: https://code.wireshark.org/review/11559
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Don't allow DCE/RPC dissector table to have duplicates

Add "placeholders" in Profinet dissector to make that possible.

Change-Id: I000069ec72b5810c5675a30df1c121aa179000b3
Reviewed-on: https://code.wireshark.org/review/11557
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Diameter: fix a typo in dictionary.xml

Change-Id: I8a91c9303e9b650380d188be5028e238fc7f2890
Reviewed-on: https://code.wireshark.org/review/11561
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

(Temporarily) Allow DCE/RPC dissector table to have duplicates.

Change-Id: I0df81ce03b567e75566fc0969f49d54488604c16
Reviewed-on: https://code.wireshark.org/review/11555
Reviewed-by: Michael Mann <mmann78@netscape.net>

Refactor DCE/RPC dissection to include a real dissector table.

This is hopefully just the first step in getting DCE/RPC dissection to use "standard" APIs instead of homegrown ones.
For starters, it allows Decode As functionality to be less hacky (although incomplete in Qt)

Change-Id: Ia0923a3d8d514ab7acce32e26ee7e08f6e24feca
Reviewed-on: https://code.wireshark.org/review/11468
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Don't allow multiple registrations of a protocol in dissector tables.

The target here is the Decode As dialog where protocols have multiple registrations into a dissector table and that shows up as multiple entries in the Decode As dialog list with the same name so users are unsure which "dissector" they are choosing.

The "default" behavior (done in this commit) is to not allow duplicates for a dissector table, whether its part of Decode As or not. It's just ENFORCED for Decode As.

Bug: 3949
Change-Id: Ibe14fa61aaeca0881f9cc39b78799e314b5e8127
Reviewed-on: https://code.wireshark.org/review/11405
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Dictionary (diameter): fix indent (use tabs)

Follow gc7c33b0c8

Change-Id: I54d101f561d4f03dd6e972c8dda3cd6516128de5
Reviewed-on: https://code.wireshark.org/review/11553
Reviewed-by: Michael Mann <mmann78@netscape.net>

Fix AddressSanitizer (./configure --enable-asan) builds

"./configure --enable-asan" currently fails to detect installed libraries
because aclocal-fallback/* built programs have memory leaks in them.

configure:34516: checking for GTK+ - version >= 3.0.0
configure:34626: gcc -o conftest ...
...
configure:34626: $? = 0
configure:34626: ./conftest

=================================================================
==29007==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 6 byte(s) in 1 object(s) allocated from:
#0 0x7fa5c95dd9aa in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
#1 0x7fa5c8995578 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4f578)

SUMMARY: AddressSanitizer: 6 byte(s) leaked in 1 allocation(s).
configure:34626: $? = 23
configure: program exited with status 23
...
configure:34649: result: no
configure:34699: error: GTK+ 3 is not available

...

This system is running 64-bit Ubuntu Linux 15.10 with GCC 5.2.1
compiler.

The glib-2-0.m4 leak, and the gtk-3.0.m4 leak are fixed by updating
"glib-2.0.m4" to the latest upstream version.

Whitespace errors are fixed locally to keep the BuildBot happy.

Change-Id: I01a5f4c494a59ae6d0ee19cd2611fab163ebf9b4
Reviewed-on: https://code.wireshark.org/review/11283
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>

[OpenFlow] Use correct name for flag OFPMPF_REPLY_MORE in v5 dissector

Change-Id: Ia8cb88d4d884be95814f4a144a4c3b07b32ffca7
Reviewed-on: https://code.wireshark.org/review/11543
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Activate word wrap for hintLabel defined as QLabel

Without this, a long hint string (like a wrong protocol name in the SSL UAT preference) will resize the window to match the string.
With this change, instead the hintLabel string is continuing on a new line to match currently configured window size

Change-Id: Ib8fcc7bd96585717f122b0921165c4d916442cb0
Reviewed-on: https://code.wireshark.org/review/11529
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Updated Diameter dictionary.xml with AVP values.

Diameter dictionary has been updated with the following AVP values:
1031 Rule-Failure-Code: adden new enum codes.
1082 Credit-Management-Status
1091 TDF-IP-Address
1098 Application-Detection-Information

Change-Id: I2c5c438fa48b9deda4bdc2a046c19b583b5c7763
Reviewed-on: https://code.wireshark.org/review/11524
Reviewed-by: Anders Broman <a.broman58@gmail.com>

One more file that now needs wsutil/str_util.h for plurality().

Change-Id: I19ccff96d590002a170fb0e477d53acb71d1680d
Reviewed-on: https://code.wireshark.org/review/11547
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Don't include stuff from libwireshark.

Dumpcap captures packets, and supports the usual capture options, so it
needs this, but it does *not* link with libwireshark (deliberately, so
that the libwireshark code isn't linked into a program that might run
with special privileges), so we must not depend on anything in
libwireshark.

Change-Id: Id975fd6a83a4b2a493c67493e41e69b784a050aa
Reviewed-on: https://code.wireshark.org/review/11546
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Don't include "file.h" if you don't need it.

It ends up dragging in libwireshark headers, which programs not linking
with libwireshark shouldn't do. In particular, including
<epan/address.h> causes some functions that refer to libwireshark
functions to be defined if the compiler doesn't handle "static inline"
the way GCC does, and you end up requiring libwireshark even though you
shouldn't require it.

Move plurality() to wsutil/str_util.h, so that non-libwireshark code can
get it without include epan/packet.h. Fix includes as necessary.

Change-Id: Ie4819719da4c2b349f61445112aa419e99b977d3
Reviewed-on: https://code.wireshark.org/review/11545
Reviewed-by: Guy Harris <guy@alum.mit.edu>

MPTCP: Use copy_address_wmem() instead of copy_address()

Change-Id: I9f53ecf1971c96d06c1c8e3be6e5481cc453f96a
Reviewed-on: https://code.wireshark.org/review/11533
Reviewed-by: Michael Mann <mmann78@netscape.net>

Refactor some GSS-API dissectors to accept dissector data instead of using packet_info.

This can hopefully lead to the removal of the GSS-API specific members of the packet_info structure.

Change-Id: I7622d66e9f02c6e4cb76adcf0737b35c6ec88cdd
Reviewed-on: https://code.wireshark.org/review/11509
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Don't include libwireshark headers from libwiretap.

Move the definitions of hashipv4_t and hashipv6_t to wiretap/wtap.h, as
that's the main place they're used. Change them a bit not to depend on
other stuff from libwireshark, and change the code as required by those
changes.

This should fix the Solaris build; apparently, the Sun^WOracle compiler
is generating code for static inline functions even if they're never
called, so that libwiretap ends up including code that calls tvbuff and
wmem functions.

There's probably further cleanup that could be done here, but this
should at least fix the build, as well as getting rid of a dependency
between two libraries that are at least somewhat independent (libwiretap
should *not* depend on libwireshark, as some programs use libwiretap but
not libwireshark, and, ultimately, we probably want it to be possible to
use libwireshark without libwiretap but that'd be more work).

Change-Id: I91c745282f17d7c8bff7809aa277eab2b3cf47c1
Reviewed-on: https://code.wireshark.org/review/11537
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>

packetbb; display Addressblock Tail as Tail

when displaying the contents of a RFC5444 message containing an address block
with a tail, the tail's value is incorrectly displayed as:

Head: <value of tail>

while it should say:

Tail: <value of tail>

This commit fixes that.

Bug: 11673
Change-Id: Ibeb921cb712f98c9651970529e5240f871b85c0b
Reviewed-on: https://code.wireshark.org/review/11538
Reviewed-by: Michael Mann <mmann78@netscape.net>

Qt: Turn off WindowModified when closing a file.

When closing a capture file the main window will never be modified,
so ensure we turn this off when the file is closed.

Change-Id: I3e6a62c931330a75d32f46fc32524d8de8734485
Reviewed-on: https://code.wireshark.org/review/11497
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>

Include packet-dcerpc-witness.h, so it's in the source tarball.

Change-Id: I3b0cc7cec85fb94776fae66e8c8f20710b3508e8
Reviewed-on: https://code.wireshark.org/review/11531
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Update .mailmap with my new e-mail address

Change-Id: Ia3a0634e27db42373e491815a236e7a8ee002058
Reviewed-on: https://code.wireshark.org/review/11527
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

GTPv2: Fix Dead Store (Dead assignement/Dead increment) warning found by Clang

Change-Id: I6b2ddc2f84e954194260b956b6f46f0747d8a66a
Reviewed-on: https://code.wireshark.org/review/11504
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

[SIP] Rework how the length of the diagnostic string is determined, it did
not work with multiple SIP packages in one frame.

Change-Id: Ie142aeea0c6ad28cfdd6206738a6f147094c479f
Reviewed-on: https://code.wireshark.org/review/11516
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

packet-dcerpc-witness: initial implementation based on the idl file from samba

See [MS-SWN], https://msdn.microsoft.com/en-us/library/hh536748.aspx

Change-Id: Ie92dad2c229ec08e7f7e31be9422450305b3908a
Signed-off-by: Gregor Beck <gbeck@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-on: https://code.wireshark.org/review/11366
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

[Qt recent files menu] make sure that the "Clear Menu" item is retranslated

this item is created along with the list of recent files
it looks like our only option to update its translation is to rebuild the
list of recent files

Change-Id: If740571fb9c939d65ca4f1f432aadf22c38dcb27
Reviewed-on: https://code.wireshark.org/review/11462
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Remaining ADDRESS macro to address function conversions

Change-Id: I8bc9af431e70243b05f4f0ce8c2b8ee451383788
Reviewed-on: https://code.wireshark.org/review/11463
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Document dissector "Decode As" functionality in README.dissector

Change-Id: I82d97a9fb770455d57d47cef8c616d2d4ff41d3c
Reviewed-on: https://code.wireshark.org/review/11488
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Put a newline at the end of the file.

Change-Id: Ic04e9a4afdceb1e36ad8367dd0d7bf6bd0674844
Reviewed-on: https://code.wireshark.org/review/11514
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Revert the last two CMake changes.

get_filename_component returns "/regstry" if the query is unsuccessful.
We'll have to add a check for that if we query "Add Paths".

Revert "CMake: Pass ABSOLUTE to get_filename_component."

This reverts commit 4c03f4be000fd930a939b042e8d1b68c509ccebd.

Revert "CMake: Look for Python using the "App Paths" key."

This reverts commit 6d1b6cd39db80fe8dc77c250ae795d16ce08bf41.

Change-Id: Ida17608467fa3652f4219e4eaf01edfa48120b1d
Reviewed-on: https://code.wireshark.org/review/11512
Reviewed-by: Gerald Combs <gerald@wireshark.org>

CMake: Pass ABSOLUTE to get_filename_component.

Change-Id: Iecfc4aabe332cac930a7fa5bb6e342a55e7bc7b3
Reviewed-on: https://code.wireshark.org/review/11510
Reviewed-by: Gerald Combs <gerald@wireshark.org>

RADIUS: Fix length of display data for Ascend-Data-Filter

Change-Id: I5fd1f82ff193cfface0b5d1e5be227dfc3e04f9a
Ping-Bug:11630
Reviewed-on: https://code.wireshark.org/review/11292
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

CMake: Look for Python using the "App Paths" key.

Query HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Python.exe
and HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\Python.exe
first before trying other methods.

Change-Id: I83f54f6833149c68f1626c3c17f25ffe54d8ea5d
Reviewed-on: https://code.wireshark.org/review/11506
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Update my e-mail address in the AUTHORS file

(Source files all reference this file, so they don't need updating)

Change-Id: Ib78c081d00e093119eab7d4d97c74944b3a46cfd
Reviewed-on: https://code.wireshark.org/review/11507
Reviewed-by: Stephen Fisher <sfisher@panix.com>

PDCP LTE: fix dissection of signalling PDUs sent on common control channels

For those crazy enough to try to decode PDUs sent in transparent mode ;)

Change-Id: Iab0a1325a6764846e23d8f04bd3147625b970638
Reviewed-on: https://code.wireshark.org/review/11498
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

BER: Removed erroneous callback from dissect_ber_external_U

This callback was added by a mistake when adding support for
P3 over RTSE in commit 0a6d1f98.

Change-Id: Ifff0bed3b2a2a0fd2354f9c6b7072de3303dae27
Reviewed-on: https://code.wireshark.org/review/11500
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

packet-dcerpc: add proto_tree_add_dcerpc_drep()

Change-Id: I1d3515371f50454acbcbdde75f2f1a3e614a5512
Signed-off-by: Gregor Beck <gbeck@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/11495
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

packet(.h): fix api reference / -Wdocumentation

From api ref :
warning: argument 'uint_val' of command @param is not found in the argument list of dissector_get_guid_handle(dissector_table_t const sub_dissectors, guid_key *guid_val)
The following parameters of dissector_get_guid_handle(dissector_table_t const sub_dissectors, guid_key *guid_val) are not documented:
parameter 'guid_val'

From -Wdocumentation
parameter 'uint_val' not found in the function declaration [-Wdocumentation]

Change-Id: I9c7b82e4ecb5a126cb96c7d6c057440eb5d24bdd
Reviewed-on: https://code.wireshark.org/review/11499
Reviewed-by: Michael Mann <mmann78@netscape.net>

funnel_string_dialog(.h): fix extra ‘;’ [-Wpedantic]

Change-Id: Ia11bfa225327c1cd19da70878e69be60da073a79
Reviewed-on: https://code.wireshark.org/review/11489
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

[GTPv2] Dissect UTRAN F-Container content.

Change-Id: Idaf07e31876b453f88c5fd7e886c72dffcb35a96
Reviewed-on: https://code.wireshark.org/review/11492
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

wsgcrypt.h checks internally if we HAVE_LIBGCRYPT

we can #include <wsutils/wsgcrypt.h> without doing the check ourselves

Change-Id: I248431bdb6cfa1bd85b794ec04ce1e4fcd3a7d2d
Reviewed-on: https://code.wireshark.org/review/11483
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

srt_table(.h): fix api reference

The following parameters of register_srt_table(const int proto_id, const char *tap_listener, int max_tables, tap_packet_cb srt_packet_func, srt_init_cb init_cb, srt_param_handler_cb param_cb) are not documented:
parameter 'max_tables'

The following parameters of init_srt_table(const char *name, const char *short_name, GArray *srt_array, int num_procs, const char *proc_column_name, const char *filter_string, srt_gui_init_cb gui_callback, void *gui_data, void *table_specific_data) are not documented:
parameter 'table_specific_data'

Change-Id: I7c14a46c89c58985a5000b1760ba088d9f0da293
Reviewed-on: https://code.wireshark.org/review/11491
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

rtd_table(.h): fix api reference

The following parameters of register_rtd_table(const int proto_id, const char *tap_listener, guint num_tables, guint num_timestats, const value_string *vs_type, tap_packet_cb rtd_packet_func, rtd_filter_check_cb filter_check_cb) are not documented:
parameter 'num_tables'

Change-Id: I93e9297d0755077ad619839c44d2feb7b2a0c18d
Reviewed-on: https://code.wireshark.org/review/11490
Reviewed-by: Anders Broman <a.broman58@gmail.com>

RTPS: added new encoding to proto.c and used it in the rtps dissector

RTPS uses NTP encoding with a BASETIME equal to 0.

Also, changed "magic" by "Magic"

Change-Id: I2512176f2018396edaa6b2a1478facd26118cb13
Reviewed-on: https://code.wireshark.org/review/11184
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Update some WSUG screenshots and markup.

Updated the main window and main menu screenshots. Update the markup for
the File and Edit menus.

Change-Id: I31282e3913692895a35e749c54c77c8069c7167a
Reviewed-on: https://code.wireshark.org/review/11487
Reviewed-by: Gerald Combs <gerald@wireshark.org>

udp_dissect_pdus follow-up

Add heuristic support
Better documentation

Change-Id: I236c1f4d3613aa58d608aee0e5edc40c3b158d25
Reviewed-on: https://code.wireshark.org/review/10120
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

[bitcoin] don't THROW() an exception from a dissector

Change-Id: Ibdc7fec48cef53041c1791fb4f6decb0a4df0c89
Reviewed-on: https://code.wireshark.org/review/11458
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

[bitcoin] Convert commands into a dissector table

Change-Id: I30095150ea639d773b887f191e0028c765beba12
Reviewed-on: https://code.wireshark.org/review/11457
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

[iso7816] remove unnecessary initial values

Change-Id: Ibc370cf99b1f62745174709a35155aa25bc1b3b2
Reviewed-on: https://code.wireshark.org/review/11481
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>

Disable RTP player debug logs that were presumably left activated by mistake

Change-Id: Ieeca052bba14735447cdd6e53de8ed7cda69a27f
Reviewed-on: https://code.wireshark.org/review/11480
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

[Automatic update for 2015-11-01]

Update manuf, services enterprise-numbers, translations, and other items.

Change-Id: I2ed2f09a178a8c4a455d0ad8be90cf79d235e621
Reviewed-on: https://code.wireshark.org/review/11477
Reviewed-by: Gerald Combs <gerald@wireshark.org>

packet-dcerpc: improve dissection of bind time feature negotiation

Change-Id: I6bcc5538149e36eed31933897a95fa7592baa84a
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/11363
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

TDS: Register each login param in a separate field

Addition of several fields to cover all login parameters.

Bug: 11661
Change-Id: I1cb1620b0e1a8c40b311f4dd4b6eb91e6e55a74d
Reviewed-on: https://code.wireshark.org/review/11455
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Add GUID dissector table support.

It seems like DCE/RPC could benefit from a GUID dissector table, where a dissector can register it's GUID with a dissector handle. So here is a basic start.

Change-Id: Id407117687a1a648d87f6f99c2ecbf858d8c0911
Reviewed-on: https://code.wireshark.org/review/4718
Reviewed-by: Michael Mann <mmann78@netscape.net>

tools/pidl: avoid trailing tabs

Change-Id: I293dd6f2d7ff3b0e27bc3cc49e69977604f12260
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/11433
Reviewed-by: Anders Broman <a.broman58@gmail.com>

ISIS Hello: Restore correct dissection of SPB BVID

Commit 301a5b7ceac60d0569ce1717e839241d1072400 introduced a small
regression with the dissection of the BVID. BVID should be extracted
from the 12 most significant bits not the 12 least significant bits.
Make it so.

Change-Id: Idcf0492eea1f6cb7282641ae243aa7092e5a1418
Reviewed-on: https://code.wireshark.org/review/11472
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Qt: do not draw sequence analysis items with a display status set to false

Change-Id: Ieff9d6838fcf5329c16df8b7d6367a4c6c3a5ee5
Reviewed-on: https://code.wireshark.org/review/11467
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

VoIP Calls: fix SIP calls state

A request other than INVITE (like ACK for example) is not a call setup

Change-Id: I2e78ed0163822a278b82e250e78aa91e673404cf
Reviewed-on: https://code.wireshark.org/review/11466
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

voip_calls.c: add missing tap_draw callback to taps asking for a redraw

Otherwise the GUI does not get populated properly

Change-Id: I5e24ac5ab2909f3200c588405dbdc9c6bbb82a73
Reviewed-on: https://code.wireshark.org/review/11465
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>

bluetooth: Fix uninitialized value warning

Change-Id: Iee1d1cf3e24dacca3c1a353001a8af71e074a96b
Reviewed-on: https://code.wireshark.org/review/11454
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

TCP: replace some dissector asserts by a return

It prevents an assert in case of malformed packet

Bug: 11662
Change-Id: If5d7196c7e6ecd0ffe8ed97213dbd64bc1f69cbb
Reviewed-on: https://code.wireshark.org/review/11464
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

[ssh] don't THROW() an exception from a dissector

Change-Id: Ibdbdcf59d7d7d28a812e31c7d7b2123b035f80fa
Reviewed-on: https://code.wireshark.org/review/11461
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>

[ssh] remove some unnecessary if(tree) checks

Change-Id: Id335830e70a944dd5c26e66d7515d168725acf3f
Reviewed-on: https://code.wireshark.org/review/11460
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>

[lmp] don't THROW() an exception from a dissector

do the bounds check for obj_length before we use it

Change-Id: I9e15fae6de05c5833c6959239fcdc0a7d2ca59cb
Reviewed-on: https://code.wireshark.org/review/11459
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>

[bitcoin] remove two unnecessary return; statements

Change-Id: I97e9ac50b096c798c255227df5760523f623d4bd
Reviewed-on: https://code.wireshark.org/review/11456
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>

packet-dcerpc: add dissect_ndr_ucarray_block()

Change-Id: Ibfb49738ea35d1d02220d69187a6083d5ebbae25
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/11365
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

packet-dcerpc: pass dcerpc_info to dcerpc_dissect_fnct_blk_t

Change-Id: I92711ee39850f6710eaebf5c678496e7cd9b5f59
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-on: https://code.wireshark.org/review/11364
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Add some "protocol placeholders" to remove confusion with Decode As.

Change-Id: Icc4bf0149af81c35bc6b615add473168600468fb
Reviewed-on: https://code.wireshark.org/review/11429
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Remove build-qt-sdk.bat.

The buildbots have been using pre-built packages from The Qt Company for
a while now and it's unlikely we'll have to compile our own in the future.

Change-Id: Iee93ab05af46f40585256f991b176392f018727a
Reviewed-on: https://code.wireshark.org/review/11449
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Explain why Get-HardenFlags currently fails.

Change-Id: I4a956b2479a482a9262e6e67f6c7611fad9dde84
Reviewed-on: https://code.wireshark.org/review/11448
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Add a comment giving details on the Centrino stuff.

Change-Id: Ie65c106f62c8d783c1c53d7a9c3f213f49ae0c1b
Reviewed-on: https://code.wireshark.org/review/11445
Reviewed-by: Guy Harris <guy@alum.mit.edu>

STUN: register a new conversation dissector after receiving a ConnectionBind Success Response message

According to RFC 6062, once the connection is established, data is sent as-is
To stop the STUN dissector from interfering, add the ability to specify a starting
frame for a conversation dissector and use it

Bug: 11641
Change-Id: I65ca96bddacf70444009c0642ea22173fa68992e
Reviewed-on: https://code.wireshark.org/review/11372
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>