Revert "TODO SMB2 NegotiateContext...."

This reverts commit df732a47f554f3ba5ce004405089d0d7fbbaf586.

TODO SMB2 NegotiateContext....

Change-Id: Iff854f2d3824c8bf9f85ce7f160979bc707df222

packet-smb2: implement SMB2 NegotiateContexts

Change-Id: I0a2c7ffa2490196989dce96b659337b4fee92c7e
Signed-off-by: Stefan Metzmacher <metze@samba.org>

packet-smb2: fix getting the dataoffset in dissect_smb2_write_request()

It's 2 byte only so we need to use tvb_get_letohs().

Change-Id: Idbab6428f4242abbbff089d7e1d1bf4cc86930b1
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Fix problems with decryption of GSSAPI-KRB5 encrypted DCE-RPC

rerun pidl

Change-Id: I3c5cb5dccbcf13d7f0c55c47545fe4acd70947dc

witness: FIX for tvb_get_unicode_string -> tvb_get_string_enc

Witness: move packet-dcerpc-witness-cnf.c to witness.cnf

witness: cast to avoid C++ warnings

witness fix for new tvb_get_unicode_string() interface using wmem

FIXUP: add parameter dcerpc_info to functions defined in cnf file

add parameter dcerpc_info to PIDL_dissect_ipv?address()

add parameter dcerpc_info to functions defined in cnf file

run master pidl

Witness: V2 RegisterEx()

Witness: start to implement V2

Witness: fix notify change

Witness: add pidl output

Witness: fix whitespace

Witness: PIDL_dissect_ipv6address()

Witness: fix compiler warnings

Witness: set col_info for interfaceInfo_state

Witness: cleanup cnf

Witness: add move ip to tree_item

Witness: working witness.cnf

Witness: WIP

Witness: track context handles

Witness: enum witness_notifyResponse_type

Witness: bitmap witness_interfaceInfo_flags

FIXUP

Witness: enum witness_interface_state

Witness: interfaceInfo_group_name + ipv4address

Witness: first guess

sq dissect_verification_trailer

TODO: quick fix

TMP: parse with (wrong) lenght as multiple of 2

sq rpc_sec_veritication_trailer

sq dissect_verification_trailer

dcerpc sec_vt guid_to_ep_str

epan/dissectors/packet-dcerpc.c fix warnings

sec_vt_header: dissect cont_id + opnum

sec_vt_header: dissect call_id

sec_vt_header: dissect drep

DCERPC: factor out proto_tree_add_dcerpc_drep()

WIP: rpc_sec_vt

sec_vt_pcontext

FIXUP: WIP: verification_trailer

FIXUP: sec_vt_command bitmask

sec_vt_bitmask

FIXUP: give names to sec_vt_command's

header field for sec_vt_command_length

give names to sec_vt_command's

add bitmask for sec_vt_command

WIP: verification_trailer

Move Auth padding to the right tree

add WERR_INVALID_STATE

add WERR_TIMEOUT

Add dissector for SMB2_FSCTL_OFFLOAD_READ

Fix dissector of SMB2_FSCTL_PIPE_WAIT

packet-smb2: pass smb2_info via private_data

sq FSCTL_PIPE_WAIT

sq epan/dissectors/packet-smb2.c no check_col => fsctl_pipe_wait

WIP: fsctl_pipe_wait

WIP: FSCTL_PIPE_WAIT

TODO needed??? packet-ntlmssp: fix possible segfault and set blob->length so the max value

Add a HACK patch for building a patched kerberos library

Signed-off-by: Matthieu Patou <mat@matws.net>

MIT krb5-1.6 HACK patch

Apply this patch to krb5-1.6.x and build it
with a special prefix that only wireshark will use!

Then start wireshark with a script like this:

-----
metze@SERNOX:~/devel/wireshark/wireshark.git$ cat ~/bin/mxwrap.wireshark.krb5

export LD_LIBRARY_PATH="/home/metze/prefix/mit-krb5-1-6/lib/:$LD_LIBRARY_PATH"
exec /home/metze/devel/prefix/wireshark/bin/wireshark $@
gdb --args /home/metze/devel/prefix/wireshark/bin/wireshark $@
------

The LD_PRELOAD only works if the krb5 library version your system one,
then you just need to replace "libk5crypto.so", otherwise wireshark
needs to all of the custom libraries.

metze

fix for netmon 3.x captures

metze

Revert "HACK setup decryption keys for kerberos session setups smbclient..."

This reverts commit e701801b515a28b997e9013fd1bdfd4c5dbbea26.

HACK setup decryption keys for kerberos session setups smbclient...

Change-Id: I573e44de014ec318998e1bb612c95d877136594f

Added a new DSR dissector

Added a new dissector for the Dynamic Source Routing (DSR) protocol (RFC 4728)
It should correctly dissect all DSR packets, including the "Flow State
Extension" DSR packets.

See Bug #10499 for capture file

Change-Id: Ie33a1a2fe095cab19d5abfbfa8e1c79fec664a35
Reviewed-on: https://code.wireshark.org/review/4251
Reviewed-by: Bill Meier <wmeier@newsguy.com>

Qt: Fix preference bugs.

Make sure we set the "resolved" member of the column fmt_data struct.

Emitting WiresharkApplication::AppSignals from a modal dialog can cause
event loop problems on OS X. Queue them up in PreferencesDialog and emit
them after closing.

Change-Id: I2de77778a0448db3b87d402e431b8e5f325cbbda
Reviewed-on: https://code.wireshark.org/review/4274
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Allow the HandoverPreparationInfoPDU dissector to be looked up by name and called.

Change-Id: I9c22b74d5c3329b6c7d74547d26e940c84ffc66c
Reviewed-on: https://code.wireshark.org/review/4247
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Fix presumed cut-and-pasteo.

On errors *other* than a short read, we were driving on and processing
the non-data that we didn't read.

Change-Id: I6289ddf31ff7896918a030af9d1261bdc194e7d3
Reviewed-on: https://code.wireshark.org/review/4270
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Qt: Add zoom and column resize actions.

Plumb signals and slots for changing the text size in the main window.
Remove the bold font code from WiresharkApplication. It was only used in
ByteViewText. Adjust the icons a bit.

Bug: When we change the font preferences the packet list stops drawing
cached strings. I haven't been able to track down the cause.

Change-Id: I609d740c9f26265628fa4b7de1b75b0e56651387
Reviewed-on: https://code.wireshark.org/review/4269
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Add decoding of part of access network identifier option
fixes Bug 10492.

Change-Id: Ib01f457b74825e6c2a7aa1dc1d0f43ff4b104dea
Reviewed-on: https://code.wireshark.org/review/4267
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Qt: Add the colorization action.

Change-Id: I846a48c35c4ef3bbbcf17d03885acc5be8c9a6b5
Reviewed-on: https://code.wireshark.org/review/4259
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>

pcapng: ensure the values we now free are initialized

Should fix the remaining test suite failures.

Change-Id: I50a6cb1bf57bd6a973d4777349708b75aeb41620
Reviewed-on: https://code.wireshark.org/review/4264
Reviewed-by: Evan Huus <eapache@gmail.com>

Try to fix dist.

Change-Id: I73d269c67a0ad5bb6f67fef8da5fc4ca86f169e3
Reviewed-on: https://code.wireshark.org/review/4263
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Qt: Re-enable menu icons.

The GNOME HIG says "Where a corresponding toolbar icon exists, a menu
icon should mirror its design." The Windows and OS X HIGs say that you
should use them for common or familiar actions but otherwise avoid
clutter. I think icons in the "File" menu look like crap. Try to strike
a balance.

Use the 16x16 application icon for both the main web site and the wiki
since that's the favicon used on both sites.

Assume that "Reload" isn't used very often and remove it from the
toolbar.

Don't use a menu icon for the about box.

Other minor fixups.

Change-Id: I855211c218d266c2e9ed5acbe05a08750ab6d157
Reviewed-on: https://code.wireshark.org/review/4246
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Make peekclassic_read_packet_v56() more like the _v7 version.

We can't use wtap_file_read_expected_bytes() in the _v7 version, as that
version returns an int, not a Boolean; just expand
wtap_file_read_expected_bytes() in the _v56 version, to make it look
similar to the _v7 version.

Change-Id: Id907bac265c123ad5821591c1cf081b5747724d8
Reviewed-on: https://code.wireshark.org/review/4262
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Remove misuse of wtap_file_read_expected_bytes().

wtap_file_read_expected_bytes() is a macro that can return a Boolean
FALSE; it should not be used in routines that don't return a Boolean.

In addition, both EOF *and* a short read, in that routine, should be
treated as a "not an IPFIX file" indication.

While we're at it, a seek failure should be treated as an error.

Change-Id: I97815bc9e78169ded567b60835cc7bcf6a0e6f0c
Reviewed-on: https://code.wireshark.org/review/4261
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Make sure the option string pointers are set before freeing them.

Change-Id: If86327a02e4fac7d3ed2d02b2a0c95906209dea0
Reviewed-on: https://code.wireshark.org/review/4260
Reviewed-by: Guy Harris <guy@alum.mit.edu>

packet-openflow_v1.c: Rename "Padding" fields & filter-names to be consistent with those in packet-openflow_v5.c

Change-Id: Idd78b49cad86db6f63b4f14edbf4d954120665e3
Also: remove some commented-out "Padding" hf[] entries.
Reviewed-on: https://code.wireshark.org/review/4257
Reviewed-by: Bill Meier <wmeier@newsguy.com>

packet-openflow_v1.c: Fix a bug in dissection of openflow_features_reply_v1

Fixes Bug #10493

Change-Id: Ia330a7b087ea184865fc437d77ee6ca57b1f2e44
Reviewed-on: https://code.wireshark.org/review/4256
Reviewed-by: Bill Meier <wmeier@newsguy.com>

Ensure pcapng application name is dynamically allocated

I was hasty with my original fix...

Change-Id: I339994c1afc34274a5d73eff98c4ebbf030e0f36
Reviewed-on: https://code.wireshark.org/review/4255
Reviewed-by: Evan Huus <eapache@gmail.com>

Ensure pcapng application name is always dynamically allocated

Change-Id: I408944dfb0fa35bae6019ed0d6d810525b2ffcae
Reviewed-on: https://code.wireshark.org/review/4254
Reviewed-by: Evan Huus <eapache@gmail.com>

pcapng: don't leak block option strings

I *think* I got all the cases; I got most of them, at any rate, and enough to
shut up valgrind in all the test cases I ran.

Change-Id: I393bac0756f577b65e400b792f6719fa6ec4056a
Reviewed-on: https://code.wireshark.org/review/4244
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Evan Huus <eapache@gmail.com>

Make style more consistent.

Change-Id: I4ba40504d8cc308f7c13b465fcfaa9ff5eeebcf2
Reviewed-on: https://code.wireshark.org/review/4252
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Consistently use tab indentation.

(If somebody wants to convert the entire file to 4-space indentation, go
ahead.)

Change-Id: I1e3829289ac67db79eea2eb16e6a4ba40c449a8d
Reviewed-on: https://code.wireshark.org/review/4250
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Fix dist.

Change-Id: I68963f000dc927398d7d41193674e55050e7c634
Reviewed-on: https://code.wireshark.org/review/4248
Reviewed-by: Gerald Combs <gerald@wireshark.org>

Qt: Use wsiconcap while we're capturing.

Set the main window icon to the "wsiconcap" version while we're capturing
similar to the GTK+ version. Verified on Windows. Not sure if this will
do anything on other platforms.

Change-Id: I9b082601a2c47e5f52cc38ac8d9b4d9f5fb9a4d9
Reviewed-on: https://code.wireshark.org/review/4230
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>

fix-encoding-args.pl: Don't use a feature available only starting with perl 5.14

Specifically: Window msys git uses an earlier version of Perl (5.8) and thus
      invoking fix-encoding-args.pl in the pre-commit hook script
      gives a Perl syntax error.

See https://code.wireshark.org/review/4172 for details

(Also see following for Perl info:
 http://www.perl.com/pub/2011/05/new-features-of-perl-514-non-destructive-substitution.html)

Change-Id: I95a222eaa31942cc6e873ffbde57c5fa5bd2a625
Reviewed-on: https://code.wireshark.org/review/4245
Reviewed-by: Bill Meier <wmeier@newsguy.com>

Bluetooth: Handle LE ACL session

Low Energy use LE Meta event for creating connection so add session
when it occur.

Change-Id: I6fad42651a3dc6a45cfb1cf679660de5955e76b0
Reviewed-on: https://code.wireshark.org/review/4168
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>

extcap: Always create extcap/ dir in run/

Change-Id: I5d0a2591b9086a138cefb0019f710ffb34a34c52
Reviewed-on: https://code.wireshark.org/review/3876
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>

Try to fix some buildbot warnings

Most interesting are:
 warning: cannot optimize loop, the loop counter may overflow [-Wunsafe-loop-optimizations]
 warning: ISO C forbids zero-size array [-Wpedantic]
 warning: ISO C90 doesn't support unnamed structs/unions [-Wpedantic]
 warning: cast discards '__attribute__((const))' qualifier from pointer target type [-Wcast-qual
 warning: initializer element is not computable at load time [enabled by default]

Change-Id: I5573c6bdca856a304877d9bef643f8c0fa93cdaf
Reviewed-on: https://code.wireshark.org/review/3174
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>

Clean up reading code.

The only place where a short read should be treated as an EOF is if the
read of the block header reads 0 bytes.  All other short reads,
including reads of the block header returning at least 1 byte but not
enough for a complete block header, and any reads of the stuff
*following* the block header even if they return 0 bytes, should be
treated as "short read" errors.

If the option length is bigger than the option buffer size, treat that
as a bad file (I'm not sure that can happen, so maybe it should be
treated as an internal error instead).

Use file_skip() rather than file_seek() when skipping forward N bytes.
If it fails, treat that as an error under all circumstances.

When reading the first section header block in the open routine, have
pcap_read_block() return -2 if it doesn't look like an SHB (too short,
wrong block type, bad block length, unknown byte-order magic number), as
that means the file isn't a pcap-ng file and the open should return 0.

Return -1, not 0, for all errors in various block-reading routines.

file_seek() returning 0 is *not* an error.  file_seek() returning -1 (or
any other negative number *is* an error; its return value is signed, so
don't assign it to an unsigned variable.

This might fix the test errors for the Lua file format handler tests.

Change-Id: Ifa7d9834c38bf238461c9cc9625a2aa761cb6ff2
Reviewed-on: https://code.wireshark.org/review/4238
Reviewed-by: Guy Harris <guy@alum.mit.edu>

packet-infiniband: added support for RoCE-v2 (RRocE)

    Added support for the new Routable RDMA over Converged Ethernet.
    (NEW PATCH)

Change-Id: I857a27c4f29cc78fcea8efa113e3c7e968eb041b
Reviewed-on: https://code.wireshark.org/review/4156
Reviewed-by: Evan Huus <eapache@gmail.com>

dcerpc: correctly initialize certain struct fields

Bug: 10482
Change-Id: I4d39d6a79d4ab89685a17a0c622c6181e4fada3d
Reviewed-on: https://code.wireshark.org/review/4233
Reviewed-by: Evan Huus <eapache@gmail.com>

Fix up formatting (bring function names over to column 0).

Change-Id: I054f3ec13fd5907c8f1e0546292777a5596fc029
Reviewed-on: https://code.wireshark.org/review/4232
Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>