metze/wireshark/wip.git
6 years agoRADIUS: sync with FreeRADIUS
Alexis La Goutte [Tue, 9 May 2017 19:28:18 +0000 (19:28 +0000)]
RADIUS: sync with FreeRADIUS

commit d4e9cc75313f05678d0f2ac41962f46c99751e1f
Author: Alan T. DeKok <aland@freeradius.org>
Date:   Sun May 7 12:56:57 2017 -0400

    added one more attribute

Change-Id: I5821076c2d4f02d82c393a768edd0c77da582a2d
Reviewed-on: https://code.wireshark.org/review/21576
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agonge: add modelines info
Alexis La Goutte [Tue, 9 May 2017 16:56:33 +0000 (18:56 +0200)]
nge: add modelines info

Change-Id: Ib75f637c36be575a85e75fee6282d1a16455bfd6
Reviewed-on: https://code.wireshark.org/review/21572
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Charlie Lenahan <clenahan@sonicbison.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agonge: fix no previous prototype for ‘proto_register_nge/handoff_nge’ [-Wmissing-protot...
Alexis La Goutte [Tue, 9 May 2017 16:56:01 +0000 (18:56 +0200)]
nge: fix no previous prototype for ‘proto_register_nge/handoff_nge’ [-Wmissing-prototypes]

Change-Id: I2e7cecad96390f709c6a135b6059c01712971dfe
Reviewed-on: https://code.wireshark.org/review/21571
Reviewed-by: Charlie Lenahan <clenahan@sonicbison.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agomate (grammar): fix no previous prototype for function 'MateParser/Alloc/Free' [...
Alexis La Goutte [Tue, 9 May 2017 18:05:10 +0000 (20:05 +0200)]
mate (grammar): fix no previous prototype for function 'MateParser/Alloc/Free' [-Wmissing-prototypes]

Change-Id: I87ff11b7c04cb3b6963d4c8c16df2c3d60a0aec8
Reviewed-on: https://code.wireshark.org/review/21574
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoYou can't have a field be both integer and string.
Guy Harris [Tue, 9 May 2017 22:07:26 +0000 (15:07 -0700)]
You can't have a field be both integer and string.

For an inter-frame gap that couldn't be determined, just add it with
proto_tree_add_uint_format_value() and "Cannot be determined" as the way
the value is displayed.

(But why add it *at all* if it couldn't be determined?)

Change-Id: I491f9a6fe430141a15568e9a7dec3253a1c78cf5
Reviewed-on: https://code.wireshark.org/review/21582
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoGive fields better names than ".bitN".
Guy Harris [Tue, 9 May 2017 21:46:24 +0000 (14:46 -0700)]
Give fields better names than ".bitN".

".bitN" names 1) don't indicate what the bit actually *means* and 2) run
the risk of collisions if the bit in question has a different meaning in
different bitsets.

Combine the "receive case" and "transmit case" bitsets in some cases
where the only difference between the two sets is that some bits are
present only in one set, but if a bit is present in both sets, it has
the same meaning.

Change-Id: Ie1cb9d076e431b30b64ef05acab39efe38193d33
Reviewed-on: https://code.wireshark.org/review/21581
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoDe-capitalize "error" - it's not capitalized in other field names.
Guy Harris [Tue, 9 May 2017 21:39:47 +0000 (14:39 -0700)]
De-capitalize "error" - it's not capitalized in other field names.

Change-Id: I6f5aaaba47ab8d36124aa10c63ceec7cf1f70867
Reviewed-on: https://code.wireshark.org/review/21580
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoFix various field names and types.
Guy Harris [Tue, 9 May 2017 21:28:57 +0000 (14:28 -0700)]
Fix various field names and types.

Make some names used for multiple fields more stylistically consistent.

If a bitfield has more than one bit, it's not Boolean - the extra bits
mean it has more values than "true" or "false".

If a bitfield has only one bit, and indicates that something is
true/false, or enabled/disabled, or present/absent, or on/off, or
something else obviously Boolean, it's Boolean.

Change-Id: I89d5e214eb5c4e7f72eb59a78757f0f49fec3dbf
Reviewed-on: https://code.wireshark.org/review/21579
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agodebian-setup: Always install Libgcrypt
Björn Ruytenberg [Tue, 9 May 2017 18:04:27 +0000 (20:04 +0200)]
debian-setup: Always install Libgcrypt

Libgcrypt is mandatory to build. Do not mark as optional.

Change-Id: Iafbe1cd93f4185e2a9492bb0a21c30a26d8883ce
Reviewed-on: https://code.wireshark.org/review/21575
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
6 years agoSet nss and rate_mcs_index in more arms of the Series II PLCP switch.
Guy Harris [Tue, 9 May 2017 17:51:01 +0000 (10:51 -0700)]
Set nss and rate_mcs_index in more arms of the Series II PLCP switch.

For HT mixed, set it the same way it's set for HT greenfield.

For pre-HT, set it to 0.

Also, for the "unknown" case, set rate_mcs_index to 0.
This should obviate the need to initialize either of those variables,
don't initialize them, so that failing to set them in an arm of the
switch statement shows up as an error if the compiler's dataflow
analysis actually bothers to check this.

Change-Id: I92703770dd5000a579b53609fb93a2085fd9fca3
Reviewed-on: https://code.wireshark.org/review/21573
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoua3g: fix conflicting entry in its value_string
Alexis La Goutte [Tue, 9 May 2017 12:08:40 +0000 (14:08 +0200)]
ua3g: fix conflicting entry in its value_string

Field 'Audio Env.' (ua3g.ip.set_param_req.parameter.audio_env) has a conflicting entry in its value_string: 2 is at indices 2 (Open Space) and 3 (Meeting Room))

Field 'Audio Env.' (ua3g.ip.set_param_req.parameter.audio_env) has a conflicting entry in its value_string: 2 is at indices 2 (Open Space) and 4 (Noisy))

Field 'Audio Env.' (ua3g.ip.set_param_req.parameter.audio_env) has a conflicting entry in its value_string: 2 is at indices 3 (Meeting Room) and 4 (Noisy))

Change-Id: I495f183dd52e59ec64e6eea0df15a5b243d8b87c
Reviewed-on: https://code.wireshark.org/review/21568
Reviewed-by: Nicolas BERTIN <nicolas.bertin@al-enterprise.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agodocsis: DCC-REQ TLV 2.7 support
Adrian Simionov [Tue, 9 May 2017 13:16:16 +0000 (23:16 +1000)]
docsis: DCC-REQ TLV 2.7 support

Change-Id: I40724306d5facd0f4a5a9ca2354330577857d27f
Reviewed-on: https://code.wireshark.org/review/21563
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoDon't have epan_dissect_init() return anything.
Michael Mann [Tue, 9 May 2017 14:11:27 +0000 (10:11 -0400)]
Don't have epan_dissect_init() return anything.

It manipulates the epan_dissect_t structure passed into it and then
returns that.
Callers can (and have been) just using the passed in epan_dissect_t
structure anyway.

Change-Id: Ia19d360a7347ff473654eeb553756f59a38f95bd
Reviewed-on: https://code.wireshark.org/review/21570
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoMore fields, more pre-allocated memory for fields.
Graham Bloice [Tue, 9 May 2017 12:19:55 +0000 (13:19 +0100)]
More fields, more pre-allocated memory for fields.

Change-Id: I36469fad59d28a1fbf15d3fd99544a3a6b0ef015
Reviewed-on: https://code.wireshark.org/review/21569
Petri-Dish: Graham Bloice <graham.bloice@trihedral.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
6 years agotshark: Fix Dead Store (Dead assignement/Dead increment) Warning found by Clang
Alexis La Goutte [Tue, 9 May 2017 09:36:29 +0000 (11:36 +0200)]
tshark: Fix Dead Store (Dead assignement/Dead increment) Warning found by Clang

Change-Id: I4425be3bbee0e781dff59a07d7de65f5eba81bdd
Reviewed-on: https://code.wireshark.org/review/21564
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agonm: Uninitialized argument value Warning found by Clang Analyzer
Alexis La Goutte [Tue, 9 May 2017 12:42:18 +0000 (14:42 +0200)]
nm: Uninitialized argument value Warning found by Clang Analyzer

false positive

Change-Id: I8aa2537328a04a64b06142a04ee76705d0df5443
Reviewed-on: https://code.wireshark.org/review/21566
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agovwr (wiretap): fix Assigned value is garbage or undefined Warning found by Clang...
Alexis La Goutte [Tue, 9 May 2017 09:41:32 +0000 (11:41 +0200)]
vwr (wiretap): fix Assigned value is garbage or undefined Warning found by Clang Analyzer

Change-Id: I45766c7e89a009176ae56fe9e9f5a8dd63b2995b
Reviewed-on: https://code.wireshark.org/review/21567
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agonm: Fix Dead Store (Dead assignement/Dead increment) Warning found by Clang
Alexis La Goutte [Tue, 9 May 2017 09:37:02 +0000 (11:37 +0200)]
nm: Fix Dead Store (Dead assignement/Dead increment) Warning found by Clang

Change-Id: I7592737477e105870ef43118f40c0ab552c81626
Reviewed-on: https://code.wireshark.org/review/21565
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years ago[GSM RLCMAC] Add comments.
AndersBroman [Tue, 9 May 2017 08:46:57 +0000 (10:46 +0200)]
[GSM RLCMAC] Add comments.

Change-Id: I2d98d8f318fdbe160974a69f50c456683669e57e
Reviewed-on: https://code.wireshark.org/review/21562
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agoBring DOCSIS Mac Management "dissectors" into modernity.
Michael Mann [Tue, 9 May 2017 00:32:56 +0000 (20:32 -0400)]
Bring DOCSIS Mac Management "dissectors" into modernity.

1. Use proto_tree_add_item_ret_uint to remove separate "gets"
2. Remove if (tree)s that prevented expert_info
3. Apply consistent whitespace
4. Apply consistent TLV behavior, making T and L always filterable
5. Remove T name (of TLV) from field name itself (where applicable)
6. Use BASE_UNIT_STRING and BASE_NO_DISPLAY_VALUE

Tested with capture generated from https://github.com/AdrianSimionov/docsis-generator

Change-Id: I9987397ccb3248b2a26d850af468740f94b28a63
Reviewed-on: https://code.wireshark.org/review/21561
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agoqsig: fix conflicting entry in its value_string
Alexis La Goutte [Tue, 2 May 2017 10:21:49 +0000 (12:21 +0200)]
qsig: fix conflicting entry in its value_string

Field 'Error' (qsig.error) has a conflicting entry in its value_string: 43 is at indices 12 (proceduralError) and 42 (notActivated))

Change-Id: I17fcebc677495033dedad57dd0c3d87631152290
Reviewed-on: https://code.wireshark.org/review/21456
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agoceph: fix conflicting entry in its value_string
Alexis La Goutte [Wed, 3 May 2017 15:21:02 +0000 (17:21 +0200)]
ceph: fix conflicting entry in its value_string

Field 'Type' (ceph.type) has a conflicting entry in its value_string: 64 is at indices 39 (C_CEPH_MSG_PRIO_LOW) and 40 (C_MSG_MON_SCRUB))

Change-Id: I69e6bd56d928c20b6262999e057c92f0d325e96d
Reviewed-on: https://code.wireshark.org/review/21509
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years ago[GSM RLCMAC] Update : PACKET RESOURCE REQUEST to Release 14.0.0
AndersBroman [Mon, 8 May 2017 15:21:58 +0000 (17:21 +0200)]
[GSM RLCMAC] Update : PACKET RESOURCE REQUEST to Release 14.0.0

Change-Id: I41e6ebf862f0bd9523778053d40f18ae7385a5bd
Reviewed-on: https://code.wireshark.org/review/21560
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agoQt: try harder to find a working monospace font
Peter Wu [Sun, 7 May 2017 19:50:00 +0000 (21:50 +0200)]
Qt: try harder to find a working monospace font

QFont::toString returned the default font (which might be unavailable),
leading to use of non-monospace fonts in the bytes view. Detect the
effective font instead and apply it to avoid this issue.

Add additional logic to invoke font detection when the configured font
is bad (for example, because of the bug or because a font has been
removed in meantime).

Bug: 13638
Change-Id: I8a625cf365c90119caebe8c4deada0df7426e53a
Reviewed-on: https://code.wireshark.org/review/21551
Reviewed-by: Jörg Mayer <jmayer@loplof.de>
Petri-Dish: Jörg Mayer <jmayer@loplof.de>
Tested-by: Jörg Mayer <jmayer@loplof.de>
Reviewed-by: Ahmad Fatoum <ahmad@a3f.at>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoNote that the HT MCS index macros can't return all possible MCS values.
Guy Harris [Mon, 8 May 2017 02:39:19 +0000 (19:39 -0700)]
Note that the HT MCS index macros can't return all possible MCS values.

I don't know whether this is a bug in the software or a lack of support
in the hardware.

This at least notes the issue in CID 1405905.

Change-Id: I481454bc38842a0f877cb8b52b73e1156fd362b5
Reviewed-on: https://code.wireshark.org/review/21558
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoFix handling of 20 MHz VHT with MCS = 9.
Guy Harris [Sun, 7 May 2017 21:18:46 +0000 (14:18 -0700)]
Fix handling of 20 MHz VHT with MCS = 9.

That's valid only for 3 or 6 spatial streams; return 0 as the bitrate
for all other values.  Also, handle the 6 spatial streams case.

Give the conversion tables explicit sizes, to make it clear what
subscripts are valid.

Return 0 for an MCS > 9, for consistency with the other error return,
and to mark it as clearly wrong.

Fixes CID 1405908.

Change-Id: Icbf655c63c0e88fd6cec7c66bae85fd887a3bd9c
Reviewed-on: https://code.wireshark.org/review/21557
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoRegenerate header.
Guy Harris [Sun, 7 May 2017 21:13:48 +0000 (14:13 -0700)]
Regenerate header.

Change-Id: Ie77c182b0ee61f84f505b0f40a171d5afef59811
Reviewed-on: https://code.wireshark.org/review/21556
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agogif: fix the version detection
Martin Kaiser [Sun, 7 May 2017 20:59:08 +0000 (22:59 +0200)]
gif: fix the version detection

tvb_strneql() returns 0 if the two strings are equal.
Thanks to Ahmad Fatoum for reporting this bug.

Change-Id: Id6cde56623e18fe0a28f37b108dc1848cc58e1c3
Reviewed-on: https://code.wireshark.org/review/21554
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
6 years agoUMTS Iub: Refactored U-RNTI resolving logic for dedicated channels
S. Shapira [Thu, 4 May 2017 15:09:42 +0000 (18:09 +0300)]
UMTS Iub: Refactored U-RNTI resolving logic for dedicated channels

Instead of mapping Scrambling codes to U-RNTIs, now mapping CRNC communication context IDs to U-RNTIs.

Change-Id: Id81b7764d2941b742f21094dac391f8658061a80
Reviewed-on: https://code.wireshark.org/review/21495
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agoixveriwave: Fix maybe-uninitialized warning
Uli Heilmeier [Sun, 7 May 2017 20:20:10 +0000 (22:20 +0200)]
ixveriwave: Fix maybe-uninitialized warning

Fix maybe-uninitialized warning:
packet-ixveriwave.c:2508:16: error: 'rate_mcs_index' may be used uninitialized in this function [-Werror=maybe-uninitialized]
             if (rate_mcs_index < 4)

Change-Id: I878f8d68104cf4f01990eebea85cfbb2a170a5bd
Reviewed-on: https://code.wireshark.org/review/21553
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
6 years agogif: start cleaning up the dissection code
Martin Kaiser [Sat, 6 May 2017 17:37:07 +0000 (19:37 +0200)]
gif: start cleaning up the dissection code

Remove the global if(tree). We should not throw exceptions under if
(tree). Buf we may get exceptions while parsing the gif file.

Process the version string once as we go through the file. (Ok, we
already had to look at it to figure out that we have a gif file.)

Use tvb_reported_length_remaining() in the main loop.

Change-Id: Ie00594eebffc715676ffd5df8cbf7d43034aa68d
Reviewed-on: https://code.wireshark.org/review/21545
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
6 years agoClean up various things.
Guy Harris [Sun, 7 May 2017 19:51:37 +0000 (12:51 -0700)]
Clean up various things.

Sort the hf_ definitions, and the entries for them, as much as possible
by the order in which they're put into the protocol tree.

Indicate which if statement branches are for pre-OCTO hardware and which
are for OCTO hardware.

Pre-HT PHYs don't have an MCS index; the "MCS index" is, rather, an
index into a table of bit rates, so call it a "rate index".

Fill in some more 802.11 radio pseudoheader fields.

Use proto_item_append_text to indicate the direction in the entry for
the L1 information.

Don't show irrelevant fields, such as the preamble length for HT and
VHT.

Change-Id: Ibd2baff09fd4ec6e4a84dc0ae2e4615631a2d15e
Reviewed-on: https://code.wireshark.org/review/21550
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agogif: refactor the detection of a gif file
Martin Kaiser [Sat, 6 May 2017 17:34:24 +0000 (19:34 +0200)]
gif: refactor the detection of a gif file

Generally, we should not throw an exception before we know that this is
our file/packet. Use tvb_strneql() to get the version string. This
function does not throw an exception if there are fewer bytes left than
we requested.

(I know that we check for reported len < 20. However, for captured
length > 6 and reported length < 20, the current code does not work.)

Change-Id: I5214c5c9dc9da616a94ae96269ec1c9e6f412e8e
Reviewed-on: https://code.wireshark.org/review/21544
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
6 years agogif: remove pointless coments, unused debug macro
Martin Kaiser [Sun, 7 May 2017 11:53:22 +0000 (13:53 +0200)]
gif: remove pointless coments, unused debug macro

Change-Id: Id4ac23a7e5164e40ddc0ee22ddb62f7121b74ad9
Reviewed-on: https://code.wireshark.org/review/21543
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
6 years agogif: (trivial) fix a typo
Martin Kaiser [Sat, 6 May 2017 18:25:50 +0000 (20:25 +0200)]
gif: (trivial) fix a typo

The trailer byte is 0x3b, not 0xb3.

Change-Id: I9b2d21f369957fc0c4eb5ff376c4aa7fbdc28c9e
Reviewed-on: https://code.wireshark.org/review/21542
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
6 years ago[Automatic update for 2017-05-07]
Gerald Combs [Sun, 7 May 2017 15:18:57 +0000 (08:18 -0700)]
[Automatic update for 2017-05-07]

Update manuf, services enterprise-numbers, translations, and other items.

Change-Id: Iae34b6ae74e4b6f891756732107aa1fdfa9ffa51
Reviewed-on: https://code.wireshark.org/review/21541
Reviewed-by: Gerald Combs <gerald@wireshark.org>
6 years agoFix kafka build error by casting
Martin Mathieson [Sun, 7 May 2017 15:16:16 +0000 (16:16 +0100)]
Fix kafka build error by casting

Change-Id: I34a5f60c49d09a8cec4a2c9ab49ea48ef67527cd
Reviewed-on: https://code.wireshark.org/review/21540
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
6 years agoKafka: show decompressed messages more clearly
Martin Mathieson [Sat, 6 May 2017 11:35:13 +0000 (12:35 +0100)]
Kafka: show decompressed messages more clearly

Change-Id: I8edf251d9ab26f93bf54d8032706ac7b9e4f6dd1
Reviewed-on: https://code.wireshark.org/review/21538
Reviewed-by: Evan Huus <eapache@gmail.com>
Petri-Dish: Evan Huus <eapache@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
6 years agonetgear: tree is used, remove the _U_
Martin Kaiser [Sat, 6 May 2017 15:57:01 +0000 (17:57 +0200)]
netgear: tree is used, remove the _U_

Change-Id: I17d058cf7949e7513241dec0248896bd9883dd11
Reviewed-on: https://code.wireshark.org/review/21539
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
6 years agocan: remove duplicated can_identifier struct.
Jakub Zawadzki [Sat, 6 May 2017 09:35:23 +0000 (11:35 +0200)]
can: remove duplicated can_identifier struct.

Change-Id: Ib6f0bcd1bec9a1fc5cbcd797a1f418270ae74a0e
Reviewed-on: https://code.wireshark.org/review/21537
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoua3g: updated GET_PARAM_RESPONSE message decoding (freeseating and ethernet config)
Nicolas BERTIN [Thu, 4 May 2017 21:50:31 +0000 (23:50 +0200)]
ua3g: updated GET_PARAM_RESPONSE message decoding (freeseating and ethernet config)

Change-Id: Ie67c2e61c031de5b48310d1fc8940808481b725b
Reviewed-on: https://code.wireshark.org/review/21504
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoixveriwave: Fix Dead Store (Dead assignement/Dead increment) Warning found by Clang
Alexis La Goutte [Wed, 3 May 2017 16:44:17 +0000 (18:44 +0200)]
ixveriwave: Fix Dead Store (Dead assignement/Dead increment) Warning found by Clang

Change-Id: Ia4ff13fb9ab57ad6749ffdcb4a2b2243c98747b6
Reviewed-on: https://code.wireshark.org/review/21515
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoFixed the column info when displaying VP8 sub protocol to RTP.
Robert Jonbgloed [Thu, 4 May 2017 15:29:48 +0000 (16:29 +0100)]
Fixed the column info when displaying VP8 sub protocol to RTP.

The RTP header information was no longer displayed, and this is very useful
information. It certainly looked like the VP8 information was supposed to
be extra to the existing info (the dash in the text), and should have been
tacked on the end.

Change-Id: I1cbefac109a7de7fbc78ac2c274071e20261dd4f
Reviewed-on: https://code.wireshark.org/review/21496
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoSet some variables in the "RF only" code path.
Guy Harris [Sat, 6 May 2017 02:33:01 +0000 (19:33 -0700)]
Set some variables in the "RF only" code path.

That should remove the need to initialize them, make it clearer what
values are being used in the "RF only" case, and catch any cases where
they don't get set in the "not just RF" case in the future.

Change-Id: I10c3ecef608ed2f481111fb7bc32bb8494b68d27
Reviewed-on: https://code.wireshark.org/review/21536
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agopacket-pcep.c: Fix infinite loop
Michael Mann [Fri, 5 May 2017 20:49:36 +0000 (16:49 -0400)]
packet-pcep.c: Fix infinite loop

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1363
Bug: 13687
Change-Id: I11d9736db945857fdcf2c23826a3acf5f6fd08a7
Reviewed-on: https://code.wireshark.org/review/21528
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoAdd decodes for Gigamon IPFIX information elements
Andrew Feren [Fri, 5 May 2017 15:33:31 +0000 (11:33 -0400)]
Add decodes for Gigamon IPFIX information elements

-- Elements to be decoded described in IE-doctor format (RFC 7013 section 10)
httprequrl(26866/1)<string>
httprspstatus(26866/2)<unsigned16>{identifier}
sslcertificateissuercommonname(26866/101)<string>
sslcertificatesubjectcommonname(26866/102)<string>
sslcertificateissuer(26866/103)<string>
sslcertificatesubject(26866/104)<string>
sslcertificatevalidnotbefore(26866/105)<string>
sslcertificatevalidnotafter(26866/106)<string>
sslcetificateserialnumber(26866/107)<octetArray>
sslcertificatesignaturealgorithm(26866/108)<octetArray>
sslcertificatesubjectpubalgorithm(26866/109)<octetArray>
sslcertificatesubjectpubkeysize(26866/110)<unsigned16>
sslcertificatesubjectaltname(26866/111)<string>
sslservernameindication(26866/112)<string>
sslserverversion(26866/113)<unsigned16>
sslservercipher(26866/114)<unsigned16>
sslservercompressionmethod(26866/115)<unsigned8>
sslserversessionid(26866/116)<octetArray>
dnsidentifier(26866/201)<unsigned16>{identifier}
dnsopcode(26866/202)<unsigned8>{identifier}
dnsresponsecode(26866/203)<unsigned8>{identifier}
dnsqueryname(26866/204)<string>
dnsresponsename(26866/205)<string>
dnsresponsettl(26866/206)<unsigned32>
dnsresponseipv4address(26866/207)<ipv4Address>
dnsresponseipv6address(26866/208)<ipv6Address>
dnsbits(26866/209)<string>
dnsqdcount(26866/210)<unsigned16>
dnsancount(26866/211)<unsigned16>
dnsnscount(26866/212)<unsigned16>
dnsarcount(26866/213)<unsigned16>
dnsquerytype(26866/214)<unsigned16>
dnsqueryclass(26866/215)<unsigned16>
dnsresponsetype(26866/216)<unsigned16>
dnsresponseclass(26866/217)<unsigned16>
dnsresponserdlength(26866/218)<unsigned16>
dnsresponserdata(26866/219)<string>
dnsauthorityname(26866/220)<string>
dnsauthoritytype(26866/221)<unsigned16>
dnsauthorityclass(26866/222)<unsigned16>
dnsauthorityttl(26866/223)<unsigned32>
dnsauthorityrdlength(26866/224)<unsigned16>
dnsauthorityrdata(26866/225)<string>
dnsadditionalname(26866/226)<string>
dnsadditionaltype(26866/227)<unsigned16>
dnsadditionalclass(26866/228)<unsigned16>
dnsadditionalttl(26866/229)<unsigned32>
dnsadditionalrdlength(26866/230)<unsigned16>
dnsadditionalrdata(26866/231)<string>

Bug: 13688
Change-Id: I4a2472d9bb86d195851edd3a1f5e688ba31dde89
Reviewed-on: https://code.wireshark.org/review/21519
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoComments to indicate which bits of the header we're looking at.
Guy Harris [Sat, 6 May 2017 02:25:26 +0000 (19:25 -0700)]
Comments to indicate which bits of the header we're looking at.

Change-Id: I7b1c924af9d23894ff79767bbb1290b60d36e298
Reviewed-on: https://code.wireshark.org/review/21533
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agopacket-dcm.c: Fix infinite loop
Michael Mann [Fri, 5 May 2017 21:23:59 +0000 (17:23 -0400)]
packet-dcm.c: Fix infinite loop

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1329
Bug: 13685
Change-Id: Ic70cf8185beeb4cfa9417c287cf963e1c56bf86c
Reviewed-on: https://code.wireshark.org/review/21529
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agopacket-ipv6.c: dissect_routing6_rpl must have IPv6 addresses.
Michael Mann [Fri, 5 May 2017 20:37:35 +0000 (16:37 -0400)]
packet-ipv6.c: dissect_routing6_rpl must have IPv6 addresses.

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1303
Bug: 13675
Change-Id: Icadf8a57a25bbf9abaa9685f9e9c7a803204b7e5
Reviewed-on: https://code.wireshark.org/review/21527
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoAdd Netgear Ensemble protocol
Charlie Lenahan [Fri, 5 May 2017 20:56:41 +0000 (16:56 -0400)]
Add Netgear Ensemble protocol

Bug: 13689
Change-Id: I9573d0106a1639cfc2d416a4146f558047cfd67e
Reviewed-on: https://code.wireshark.org/review/21524
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agopacket-mle.c: Fix infinite loop
Michael Mann [Fri, 5 May 2017 20:22:01 +0000 (16:22 -0400)]
packet-mle.c: Fix infinite loop

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1359
Bug: 13686
Change-Id: Ibc08b6e79200264d821e755ef1e4b5da74b8cf97
Reviewed-on: https://code.wireshark.org/review/21526
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agovwr.c: Initialize some local variables
Michael Mann [Fri, 28 Apr 2017 00:25:26 +0000 (20:25 -0400)]
vwr.c: Initialize some local variables

Prevents some compiler warnings

Change-Id: I9d62d0f3e6b7794c5ed43f37d52f86d81344a33c
Reviewed-on: https://code.wireshark.org/review/21531
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoSmall cleanups.
Guy Harris [Fri, 5 May 2017 22:12:36 +0000 (15:12 -0700)]
Small cleanups.

Add some parentheses to make an expression clearer to people who haven't
memorized the table of C operator precedences.

Don't fiddle the nss variable in place; explicitly combine it with the
IS_TX value when we put it in the header, to make it clearer what's in
that header byte.

Change-Id: I870b892fb9dab2bc210956f923e0183f4e147989
Reviewed-on: https://code.wireshark.org/review/21530
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agotnef: fix conflicting entry in its value_string
Alexis La Goutte [Wed, 3 May 2017 15:48:40 +0000 (17:48 +0200)]
tnef: fix conflicting entry in its value_string

Field 'Type' (tnef.property.tag.type) has a conflicting entry in its value_string: 4126 is at indices 24 (PT_MV_STRING8) and 25 (PT_MV_TSTRING))

Change-Id: I306ba69b954f22781bbafe4400993d73c9be5811
Reviewed-on: https://code.wireshark.org/review/21511
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agomapi: fix conflicting entry in its value_string
Alexis La Goutte [Wed, 3 May 2017 15:24:41 +0000 (17:24 +0200)]
mapi: fix conflicting entry in its value_string

Field 'Value' (mapi.SPropValue.value) has a conflicting entry in its value_string: 4126 is at indices 24 (PT_MV_STRING8) and 25 (PT_MV_TSTRING))

Field 'Value' (nspi.SPropValue.value) has a conflicting entry in its value_string: 4126 is at indices 24 (PT_MV_STRING8) and 25 (PT_MV_TSTRING))

Change-Id: Icc1060804ced2887a34ffe81cf473fbe8154ce18
Reviewed-on: https://code.wireshark.org/review/21510
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agodcerpc pn io (profinet) fix conflicting entry in its value_string
Alexis La Goutte [Wed, 3 May 2017 16:20:41 +0000 (18:20 +0200)]
dcerpc pn io (profinet) fix conflicting entry in its value_string

Field 'Index' (pn_io.index) has a conflicting entry in its value_string: 45057 is at indices 82 (Sync-Log / RTA SyncID 1 (GSY)) and 114 (reserved for profiles))

Change-Id: Ic3e6f6db0631a9337861cd697b4d7bf17fba0c36
Reviewed-on: https://code.wireshark.org/review/21513
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agolempar: set ParseInit/ParseFinalize static
Alexis La Goutte [Wed, 3 May 2017 16:50:48 +0000 (18:50 +0200)]
lempar: set ParseInit/ParseFinalize static

grammar.c:471:6: warning: no previous prototype for ‘DfilterInit’ [-Wmissing-prototypes]
grammar.c:646:6: warning: no previous prototype for ‘DfilterFinalize’ [-Wmissing-prototypes]
dtd_grammar.c:502:6: warning: no previous prototype for ‘DtdParseInit’ [-Wmissing-prototypes]
dtd_grammar.c:637:6: warning: no previous prototype for ‘DtdParseFinalize’ [-Wmissing-prototypes]

Change-Id: I9c43fb4d5ad50992e8e55163333793b20319aa74
Reviewed-on: https://code.wireshark.org/review/21516
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoAssume the Series II does the same with NSS for VHT that the Series III does.
Guy Harris [Fri, 5 May 2017 21:13:30 +0000 (14:13 -0700)]
Assume the Series II does the same with NSS for VHT that the Series III does.

The packet-ixveriwave.c dissector appears to do so.

Change-Id: Ie02c4611ef18e83abcd3b625bbc40014080ffca1
Reviewed-on: https://code.wireshark.org/review/21525
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoNSS != (MCS / 8) + 1 for MCS >= 32.
Guy Harris [Fri, 5 May 2017 20:06:16 +0000 (13:06 -0700)]
NSS != (MCS / 8) + 1 for MCS >= 32.

Do the MCS -> NSS mapping for HT by a table lookup.

For VHT with Series II, do it the old way for now, under the assumption
that the MCS index and NSS are bit fields, but note that the MCS index
and NSS bit fields would overlap.

Change-Id: Ibc89590faf15900171b2a1b4ac1e50793ed70c32
Reviewed-on: https://code.wireshark.org/review/21523
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoSeries I only handles pre-HT, so rename and remove variables.
Guy Harris [Fri, 5 May 2017 18:40:22 +0000 (11:40 -0700)]
Series I only handles pre-HT, so rename and remove variables.

Change-Id: Id9f086983544647267854446932a3ffe2ec2cc55
Reviewed-on: https://code.wireshark.org/review/21522
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoHave separate routines for calculating pre-HT/HT/VHT data rates.
Guy Harris [Fri, 5 May 2017 18:31:58 +0000 (11:31 -0700)]
Have separate routines for calculating pre-HT/HT/VHT data rates.

That maeks the code a little clearer.

It also makes it clearer that the "MCS index" is, for pre-HT, a rate
index, so rename some variables and macros.

Change-Id: I64b7bca073df0f837e5d968682345187000207fc
Reviewed-on: https://code.wireshark.org/review/21521
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agogsm_sms: fix no previous prototype for ‘proto_reg_handoff_gsm_sms’ [-Wmissing-prototypes]
Alexis La Goutte [Wed, 3 May 2017 16:52:08 +0000 (18:52 +0200)]
gsm_sms: fix no previous prototype for ‘proto_reg_handoff_gsm_sms’ [-Wmissing-prototypes]

Change-Id: If580b059d6aae1d69ac32578674491205a7ae21d
Reviewed-on: https://code.wireshark.org/review/21517
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agopn dcp (profinet): fix conflicting entry in its value_string
Alexis La Goutte [Wed, 3 May 2017 16:12:15 +0000 (18:12 +0200)]
pn dcp (profinet): fix conflicting entry in its value_string

Field 'BlockQualifier: ResettoFactory' (pn_dcp.block_qualifier_reset) has a conflicting entry in its value_string: 9 is at indices 7 (Resets all stored data) and 12 (Reserved))

Change-Id: I9d43fc44899d47eaafb50a76511dda69560a75da
Reviewed-on: https://code.wireshark.org/review/21512
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agonetlink (nl80211) fix no previous prototype for ‘proto_register_netlink_nl80211/hando...
Alexis La Goutte [Wed, 3 May 2017 16:53:42 +0000 (18:53 +0200)]
netlink (nl80211) fix no previous prototype for ‘proto_register_netlink_nl80211/handoff_netlink_nl80211’ [-Wmissing-prototypes]

Change-Id: Ife84b7865f7646b3ae8ad0dd3bbf10a679868fce
Reviewed-on: https://code.wireshark.org/review/21518
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoextcap: Update example help text
Stig Bjørlykke [Fri, 5 May 2017 13:40:02 +0000 (15:40 +0200)]
extcap: Update example help text

Change-Id: I1240af78664d6066650be67b95f0423a5353c711
Reviewed-on: https://code.wireshark.org/review/21508
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
6 years agoAdding support for the NM protocol.
Dr. Lars Voelker [Mon, 1 May 2017 03:31:26 +0000 (23:31 -0400)]
Adding support for the NM protocol.

UDP-NM is an automotive communication protocol as standardized by
AUTOSAR and is specified in AUTOSAR_SWS_UDPNetworkManagement.pdf,
which can be accessed on:
autosar.org -> Classic Platform -> Software Arch -> Comm Stack.

It can run over UDP or CAN, which is why "UDP" is not in any user
exposed strings.

Change-Id: I68adfd941c193588a6c8ef0fe1cb7271f921623e
Reviewed-on: https://code.wireshark.org/review/21437
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years ago[docsis->dccrsp] Resolve confirmation code
Adrian Simionov [Sun, 30 Apr 2017 12:10:12 +0000 (22:10 +1000)]
[docsis->dccrsp] Resolve confirmation code

Change-Id: I1f863eea427529537df004e9782311d5c69ed4bd
Reviewed-on: https://code.wireshark.org/review/21505
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoNew Lua function TreeItem:referenced(ProtoField | Dissector).
Rado Radoulov [Thu, 27 Apr 2017 17:06:24 +0000 (13:06 -0400)]
New Lua function TreeItem:referenced(ProtoField | Dissector).

This function returns TRUE/FALSE depending whether the specified ProtoField/Dissector
needs to be dissected. By using this function in conjunction with the TreeItem.visible
attribute, Lua dissectors can be significantly sped up by making less C interop calls
which are relatively slow in terms of dissection especially when using sub-protocols
where the dissection of an entire protocol can be skipped.

Added tests for TreeItem:referenced to protofield.lua

Change-Id: I44feacb91a2a5b0e3c28c0ccd8d6b04cccd67261
Reviewed-on: https://code.wireshark.org/review/21387
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
6 years agonsh: fix stack overflow due to missing length checks
Peter Wu [Thu, 4 May 2017 18:03:35 +0000 (20:03 +0200)]
nsh: fix stack overflow due to missing length checks

After v2.3.0rc0-3167-ge6f944d632, the NSH dissector could call itself
recursively and since the minimum header length was not validated, it
could result in a stack overflow due to infinite recursion.

Add checks based on the text from
https://tools.ietf.org/html/draft-ietf-sfc-nsh-12#section-3.2

This patch also fixes a regression since v2.3.0rc0-3171-g2273cf0e7b
where the wrong tvb was passed to subdissectors. Tested with the two
captures from bug 11490.

Bug: 13612
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1156
Change-Id: I8cacfa267557e8373ff8134f4b020d927e37842f
Reviewed-on: https://code.wireshark.org/review/21499
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agoFix previous change.
Guy Harris [Fri, 5 May 2017 01:18:20 +0000 (18:18 -0700)]
Fix previous change.

Change-Id: I6093d9f5d498c003d14e4f3cec4220eb191d550e
Reviewed-on: https://code.wireshark.org/review/21506
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoAuto reset epan session
Hessam Jalali [Mon, 24 Apr 2017 13:01:00 +0000 (17:31 +0430)]
Auto reset epan session

Automatically resets intarnal epan session after reaching to
specified number of packets, for example
-M 1000
will reset the session every 1000 packets.

this is more like a proposal since the usage is very specific
it is useful for 24/7 live capture with dissection and sending
data directly to another application.

example:

tshark -Y "gtp" -M 100000 -T fields -e gtp.message -e gtp.teid

Change-Id: I8ee8b0380017c684120a93cb3fb43f41615a9c04
Reviewed-on: https://code.wireshark.org/review/21312
Reviewed-by: Evan Huus <eapache@gmail.com>
Petri-Dish: Evan Huus <eapache@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoQt: Inhibit Disable Protocol when applicable
Jaap Keuter [Thu, 4 May 2017 12:21:27 +0000 (14:21 +0200)]
Qt: Inhibit Disable Protocol when applicable

The packet details context menu allows you, through the Protocol
Preferences sub menu to manipulate (disable) the protocol dissection
through the Disable <protocol>... option. This opens up the appropriate
dialog and select the applicable protocol.
This fails for protocols which have their can_toggle flag reset (e.g.
the frame protocol). The dialog opens, but the protocol can't be found,
hence the top item is selected.

Instead disable the menu option for protocols which can't have their
enabled state toggled.

Change-Id: Ifa83f656a8ab747f379d3ca0114520e5efed4b67
Reviewed-on: https://code.wireshark.org/review/21494
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoUse proto_tree_add_item_ret_uint() for the RFID.
Guy Harris [Thu, 4 May 2017 21:02:08 +0000 (14:02 -0700)]
Use proto_tree_add_item_ret_uint() for the RFID.

Do some whitespace cleanup while we're at it.

Change-Id: I1c55ce916b6d8344736f5732130613f63cf4d60f
Reviewed-on: https://code.wireshark.org/review/21502
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agobootp: fix potential buffer overflow (read)
Peter Wu [Thu, 4 May 2017 16:45:55 +0000 (18:45 +0200)]
bootp: fix potential buffer overflow (read)

The Vendor class Identifier is a string (used with strncmp). Be sure to
obtain a null-terminated string.

Bug: 13628
Change-Id: Ic6457da171fbfa1bd18366d965d22e942fb080d6
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1183
Bug: 13609
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1153
Reviewed-on: https://code.wireshark.org/review/21498
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
6 years agodfilter: fix memleak when using value_string values
Peter Wu [Thu, 4 May 2017 15:57:23 +0000 (17:57 +0200)]
dfilter: fix memleak when using value_string values

When using a filter such as "ncp.alloc_reply_lvl2 == FALSE", a memory
leak would occur as follows:

 1. dfilter_fvalue_from_unparsed is called and
 2. ends up calling _uint64_from_unparsed
 3. which fails with error message "\"FALSE\" is not a valid number.".
 4. Next, mk_fvalue_from_val_string is called which maps "FALSE" to 0
 5. and the filter is successfully compiled.
 6. dfwork_free deliberately does not free the error message (since
    there should be none at this point) and we have a memleak (from 3).

Fix this memleak by clearing the error message when a successful
value_string mapping is found.

Change-Id: I78d59a4336342b09dc5448ea994b2e1d199d7f3f
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1302
Reviewed-on: https://code.wireshark.org/review/21497
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
6 years agoua3g: added SET_SIP_PARAMETERS and FREESEATING messages decoding
Nicolas BERTIN [Wed, 3 May 2017 22:22:28 +0000 (00:22 +0200)]
ua3g: added SET_SIP_PARAMETERS and FREESEATING messages decoding

Change-Id: I6e00edfa09dea6f9f8c24b72769257ce428bfc61
Reviewed-on: https://code.wireshark.org/review/21481
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agoAnother comment explaining why a packet size check isn't necessary.
Guy Harris [Thu, 4 May 2017 07:20:37 +0000 (00:20 -0700)]
Another comment explaining why a packet size check isn't necessary.

Change-Id: Id7494823f9af69c6185b41983ca78ead2dae24dd
Reviewed-on: https://code.wireshark.org/review/21492
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoDo packet length checks iff they're necessary.
Guy Harris [Thu, 4 May 2017 07:12:07 +0000 (00:12 -0700)]
Do packet length checks iff they're necessary.

They're not necessary for most hardware; remove the unnecessary checks,
and add comments indicating why they're not necessary (or fix the
"maximum value of actual_octets is" part of the comment).

They *are* necessary for Series III hardware; put in the check.

Change-Id: Idd64a74099d5cf7398a2ddb850442e53c9206724
Reviewed-on: https://code.wireshark.org/review/21491
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoAdd a comment.
Guy Harris [Thu, 4 May 2017 04:51:12 +0000 (21:51 -0700)]
Add a comment.

Change-Id: Ia60a0cdac3d70862aa5941487af142bd26ab2b80
Reviewed-on: https://code.wireshark.org/review/21489
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoAdd g_get_monotonic_time() to glib-compat and use
Martin Mathieson [Wed, 3 May 2017 21:56:55 +0000 (22:56 +0100)]
Add g_get_monotonic_time() to glib-compat and use

Change-Id: If41dab19692516270e8b4bcf1a8a954bb8dc3ccc
Reviewed-on: https://code.wireshark.org/review/21480
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agoClean up whitespace and a #define.
Guy Harris [Thu, 4 May 2017 03:28:29 +0000 (20:28 -0700)]
Clean up whitespace and a #define.

Add some additional blank lines, remove some extra, blank lines, fix
indentation.

Make vVW510024_E_IS_VLAN 32-bits, to match the other flags.

Change-Id: Id1cd63ff2b75764907a44e9f8525b1537666fde1
Reviewed-on: https://code.wireshark.org/review/21488
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoUpdate comments.
Guy Harris [Thu, 4 May 2017 02:55:39 +0000 (19:55 -0700)]
Update comments.

There's only a 17-byte PLCP header with the Series III hardware.

Change-Id: Ice8dfbbc5daa0578ee4eb6588fc8a8b597806d0d
Reviewed-on: https://code.wireshark.org/review/21487
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoUse a #define for the PLCP type.
Guy Harris [Thu, 4 May 2017 02:50:11 +0000 (19:50 -0700)]
Use a #define for the PLCP type.

That makes it clearer that the Series I hardware doesn't do HT or VHT.

Change-Id: Ibeccfcba997555bef06098828f01951dc32a6d2c
Reviewed-on: https://code.wireshark.org/review/21486
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoRemove an unnecessary comment, fix another comment.
Guy Harris [Thu, 4 May 2017 02:12:03 +0000 (19:12 -0700)]
Remove an unnecessary comment, fix another comment.

Change-Id: Id20517c99663c624b6bfd58d7475284db450e003
Reviewed-on: https://code.wireshark.org/review/21485
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoRemove trailing white space.
Guy Harris [Thu, 4 May 2017 01:53:00 +0000 (18:53 -0700)]
Remove trailing white space.

Change-Id: I8cdbde058c7ebb9aaaac4739e9a5c206e0d2c919
Reviewed-on: https://code.wireshark.org/review/21484
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoMore description of stats headers.
Guy Harris [Thu, 4 May 2017 01:45:11 +0000 (18:45 -0700)]
More description of stats headers.

Change-Id: I21ee8b39b96dd58ea1dfeb502e8734b33aa298c1
Reviewed-on: https://code.wireshark.org/review/21483
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoFix some comments, shuffle some code, change a constant in an assignment.
Guy Harris [Thu, 4 May 2017 01:32:31 +0000 (18:32 -0700)]
Fix some comments, shuffle some code, change a constant in an assignment.

Fix "VHTPPDU" to be "VHT PPDU".

Move the code that processes the RSSI values before the code that
processes the next two bytes of the header, so it's done in order; that
makes it a bit easier to see the layout of that header (although 2 bytes
of it are processed below).

Fix the comment describing what the first 16 bytes of the record data
after the stats are.  Don't use vVW510021_W_STATS_HEADER_LEN - that's
for the Series II hardware.

Fix some indentation.

Change-Id: If47c4a44fd5e72971a28daf6af88d5e19c53abbe
Reviewed-on: https://code.wireshark.org/review/21482
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoPut back the null terminator in the list of handles.
Guy Harris [Wed, 3 May 2017 21:23:54 +0000 (14:23 -0700)]
Put back the null terminator in the list of handles.

The code to scan the list has always required a null terminator, but
change 96f517647a8f8b22c66eacf6e3d8bea9d8b8c68f got rid of the null
terminator.

Change-Id: I13c1553114e08e8617adaf8874ffb5e7c7c4b2d3
Reviewed-on: https://code.wireshark.org/review/21477
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoExtcap: use glib-compat for g_list_free_full()
Martin Mathieson [Wed, 3 May 2017 16:44:33 +0000 (17:44 +0100)]
Extcap: use glib-compat for g_list_free_full()

Change-Id: I13e6a465b0e169f2f4ce134df3c873c416737b33
Reviewed-on: https://code.wireshark.org/review/21476
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years ago[DOCSIS] Use expert info instead of THROWing bounds errors for bad lengths
Michael Mann [Wed, 3 May 2017 13:38:29 +0000 (09:38 -0400)]
[DOCSIS] Use expert info instead of THROWing bounds errors for bad lengths

Also adjust whitespace for a few places where if (tree) would mess up
expert_info use.

Change-Id: I79b8f7105515fb9ce220a46f3e875be466ee1044
Reviewed-on: https://code.wireshark.org/review/21474
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
6 years agoAdd support for TCP over UDP.
Michael Tuexen [Wed, 3 May 2017 08:47:54 +0000 (10:47 +0200)]
Add support for TCP over UDP.

Add support to configure a port number for encapsulating TCP
packets in UDP.

Change-Id: I9aea1eda4537b05e76e76ed0417acb34705bad9e
Reviewed-on: https://code.wireshark.org/review/21473
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Tüxen <tuexen@wireshark.org>
6 years agoua3g: updated SET_PARAM_REQ message decoding
Nicolas BERTIN [Tue, 2 May 2017 20:57:56 +0000 (22:57 +0200)]
ua3g: updated SET_PARAM_REQ message decoding

Change-Id: Ic20286111b39539b5c423cc2442be0533d0b631e
Reviewed-on: https://code.wireshark.org/review/21468
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years ago[mbtcp] Separate conversation and per-packet data, build ppd on first
AndersBroman [Wed, 5 Apr 2017 11:29:25 +0000 (13:29 +0200)]
[mbtcp] Separate conversation and per-packet data, build ppd on first
pass.

Change-Id: I741824b239476a3eafa481344a3f699f986a03c8
Reviewed-on: https://code.wireshark.org/review/20927
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agoTLS13: update HKDF-Expand-Label for draft -20
Peter Wu [Tue, 2 May 2017 16:19:46 +0000 (18:19 +0200)]
TLS13: update HKDF-Expand-Label for draft -20

This is needed for decryption to work in draft -20. Since lots of
implementations are still at draft -18, maintain decryption support for
older draft versions. Tested with tls13.pcapng (attachment 15156).

Change-Id: Ieb7d85136221573007b529b40e4eadc60eac174f
Ping-Bug: 12779
Reviewed-on: https://code.wireshark.org/review/21467
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
6 years agoTLS13: update Certificate dissection for draft -20
Peter Wu [Tue, 2 May 2017 15:54:49 +0000 (17:54 +0200)]
TLS13: update Certificate dissection for draft -20

RawPublicKey (RFC 7250) has been incorporated in the Certificate
message, update the definition and restructure the code accordingly.

No functional change for X.509 certs, but RPK types will now be
correctly handled for TLS 1.3 (including the context and extensions).
Ran the test suite and tested for regressions using
rpk-certficate-message.pcapng from bug 11480.

Change-Id: If551a30344851313430201cb6d6198b2091efc2d
Ping-Bug: 12779
Reviewed-on: https://code.wireshark.org/review/21466
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
6 years agoUSB: prevent array bounds overflow from invalid Darwin transfer type
Jaap Keuter [Tue, 2 May 2017 22:19:03 +0000 (00:19 +0200)]
USB: prevent array bounds overflow from invalid Darwin transfer type

During 'Darwin' transfer type conversion the network data is taken
as-is, without checking validity. This results in indexing errors.
Add validation before using as array index.

Bug: 13676
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1307
Change-Id: I24ca49bb21ba36a8d6a3c078ac2c05ded7b8d382
Reviewed-on: https://code.wireshark.org/review/21470
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
6 years agoua3g: updated START_RECORD_RTP message decoding
Nicolas BERTIN [Tue, 2 May 2017 21:36:05 +0000 (23:36 +0200)]
ua3g: updated START_RECORD_RTP message decoding

Change-Id: I98d2aa5098d3019f829e75e46a0842a9d87786aa
Reviewed-on: https://code.wireshark.org/review/21469
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
6 years agopdcp-lte: add preference to ignore Set Security Algorithm
Binh Trinh [Mon, 1 May 2017 03:17:14 +0000 (23:17 -0400)]
pdcp-lte: add preference to ignore Set Security Algorithm

Useful when captures are already deciphered

Change-Id: Ie0f57efa6dccd21d7bd0f25851cbdc8887d7fbbf
Reviewed-on: https://code.wireshark.org/review/21443
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
6 years agoFix handling of Header IEs.
Guy Harris [Wed, 3 May 2017 07:23:33 +0000 (00:23 -0700)]
Fix handling of Header IEs.

Add the tree for the type/length/element ID for *all* IEs, whether we
know the IE type or not.

The total length of the IE is 2 + the value of the length field; always
advance by that much.  This prevents infinite loops.

Fix the name of a field.

Bug: 13678
Change-Id: Iadc537653999a4a796c6689b180cf1b75e175035
Reviewed-on: https://code.wireshark.org/review/21472
Reviewed-by: Guy Harris <guy@alum.mit.edu>
6 years agoAdd terminating NULL to lists for proto_tree_add_bitmask().
Guy Harris [Wed, 3 May 2017 02:52:05 +0000 (19:52 -0700)]
Add terminating NULL to lists for proto_tree_add_bitmask().

Those lists require null terminators; fix the script to add them, and
re-run the script (with the current tip of the master branch for
xcbproto and mesa).

Change-Id: I76c156521e79753f5c19cae16e9caa031abd2496
Reviewed-on: https://code.wireshark.org/review/21471
Reviewed-by: Guy Harris <guy@alum.mit.edu>