[Wireshark-bugs] [Bug 16423] Can't have duplicate personal and global profile names

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16423

Stig Bjørlykke  changed:

   What|Removed |Added

 Ever confirmed|0   |1
 CC||rkn...@gmail.com,
   ||s...@bjorlykke.org
 Status|UNCONFIRMED |CONFIRMED

--- Comment #1 from Stig Bjørlykke  ---
This is a regression issue from the profile dialog refactoring in August 2019.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16424] New: Buildbot crash output: randpkt-2020-03-04-18423.pcap

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16424

Bug ID: 16424
   Summary: Buildbot crash output: randpkt-2020-03-04-18423.pcap
   Product: Wireshark
   Version: unspecified
  Hardware: x86-64
OS: Ubuntu
Status: CONFIRMED
  Severity: Major
  Priority: High
 Component: Dissection engine (libwireshark)
  Assignee: bugzilla-ad...@wireshark.org
  Reporter: buildbot-do-not-re...@wireshark.org
  Target Milestone: ---

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/randpkt-2020-03-04-18423.pcap

stderr:
Input file: 

Build host information:
Linux build6 4.15.0-88-generic #88-Ubuntu SMP Tue Feb 11 20:11:34 UTC 2020
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID: Ubuntu
Description:Ubuntu 18.04.4 LTS
Release:18.04
Codename:   bionic

Buildbot information:
BUILDBOT_WORKERNAME=clang-code-analysis
BUILDBOT_BUILDNUMBER=5192
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_URL=http://buildbot.wireshark.org/wireshark-master/
BUILDBOT_REPOSITORY=ssh://wireshark-build...@code.wireshark.org:29418/wireshark
BUILDBOT_GOT_REVISION=1ed9ddd26a0fb0e9098668f1046975334b859cc0

Return value:  134

Dissector bug:  0

Valgrind error count:  0



Git commit
commit 1ed9ddd26a0fb0e9098668f1046975334b859cc0
Author: Guy Harris 
Date:   Wed Feb 26 21:32:36 2020 -0800

Fix some typoes in comments.

Change-Id: I951e183e24bf77e0f2f09266e2dc5db7a4caf0ec
Reviewed-on: https://code.wireshark.org/review/36211
Reviewed-by: Guy Harris 


Command and args:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.asan/bin/tshark
-nVxr

../epan/proto.c:11637: field isis.hello.reverse_metric.flags is not of type
FT_CHAR or an FT_{U}INTn type

[ no debug trace ]

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16423] Can't have duplicate personal and global profile names

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16423

Rasmus Jonsson  changed:

   What|Removed |Added

 CC||was...@zom.bi
   Severity|Major   |Normal
   Hardware|x86 |x86-64

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16423] New: Can't have duplicate personal and global profile names

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16423

Bug ID: 16423
   Summary: Can't have duplicate personal and global profile names
   Product: Wireshark
   Version: Git
  Hardware: x86
OS: Linux
Status: UNCONFIRMED
  Severity: Major
  Priority: Low
 Component: Qt UI
  Assignee: bugzilla-ad...@wireshark.org
  Reporter: was...@zom.bi
  Target Milestone: ---

Build Information:
Version 3.3.0 (v3.3.0rc0-608-gf8f6ce55defa) 
Copyright 1998-2020 Gerald Combs  and contributors.
License GPLv2+: GNU GPL version 2 or later
 This is free software; see the
source for copying conditions. There is NO warranty; not even for
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
Compiled (64-bit) with Qt 5.11.3, with libpcap, with POSIX capabilities
(Linux), with libnl 3, with GLib 2.58.3, with zlib 1.2.11, with SMI 0.4.8, with
c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.6.7 and PKCS #11 support, with
Gcrypt 1.8.4, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.36.0,
without brotli, with LZ4, without Zstandard, with Snappy, with libxml2 2.9.4,
with QtMultimedia, without automatic updates, with SpeexDSP (using bundled
resampler). 
Running on Linux 4.19.0-8-amd64, with Intel(R) Core(TM) i5-5300U CPU @ 2.30GHz
(with SSE4.2), with 7678 MB of physical memory, with locale en_US.UTF-8, with
light display mode, without HiDPI, with libpcap version 1.8.1, with GnuTLS
3.6.7, with Gcrypt 1.8.4, with zlib 1.2.11, binary plugins supported (18
loaded). Built using gcc 8.3.0. 

--

On my git master build I tried to do this:

1. Edit > Configuration Profiles...
2. Select Bluetooth (global) and click ok. (This one is stored in my
wireshark-build directory)
3. Edit > Configuration Profiles...
4. There is a new profile named Bluetooth (personal) stored in
~/.config/wireshark/profiles/Bluetooth
5. Try to change the name of the new Bluetooth to "Test".
6. The Ok button is greyed out.

Alternative steps:
1. Create new profile named Bluetooth. (+ button)
2. Hit Ok.
3. Open dialog again.
4. Change the name.
5. Ok is greyed out.

On Version 2.6.8 (Git v2.6.8 packaged as 2.6.8-1.1) from Debian Buster this
works fine.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 11221] Cannot re-set manually resolved address

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11221

Dylan  changed:

   What|Removed |Added

 Resolution|--- |FIXED
 Status|CONFIRMED   |RESOLVED

--- Comment #13 from Dylan  ---
The main issues for this bug have been fixed. You can now a) change, and b)
delete a custom defined name

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16420] LINKTYPE_WIRESHARK_UPPER_PDU packets aren't readable by non-Wireshark programs

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16420

--- Comment #8 from Guy Harris  ---
LINKTYPE_WIRESHARK_UPPER_PDU, as the name suggests, is really a special
link-layer type intended primarily for Wireshark's use.

As such, some place such as the Wireshark Wiki should document it; the
tcpdump.org link-layer header types page should just point to the Wireshark
page that documents it.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16422] Add support to decode Ver 1 F5ethtrailer Type 2 TLS trailers

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16422

--- Comment #1 from Jason Cohen  ---
https://code.wireshark.org/review/#/c/36266/

$ tshark -r ../test-caps/quic-test.pcap -Y
f5ethtrailer.tls.early_traffic_secret -T fields -e frame.number -e
f5ethtrailer.tls.early_traffic_secret
2   2de4e9e5a7bcee96eec21472bc31865154de01f3b5a0d2f0abaf5b2a7bc9fbf9
3   2de4e9e5a7bcee96eec21472bc31865154de01f3b5a0d2f0abaf5b2a7bc9fbf9
4   2de4e9e5a7bcee96eec21472bc31865154de01f3b5a0d2f0abaf5b2a7bc9fbf9
5   2de4e9e5a7bcee96eec21472bc31865154de01f3b5a0d2f0abaf5b2a7bc9fbf9

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16422] Add support to decode Ver 1 F5ethtrailer Type 2 TLS trailers

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16422

Jason Cohen  changed:

   What|Removed |Added

   Assignee|bugzilla-ad...@wireshark.or |kryojen...@gmail.com
   |g   |

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16422] New: Add support to decode Ver 1 F5ethtrailer Type 2 TLS trailers

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16422

Bug ID: 16422
   Summary: Add support to decode Ver 1 F5ethtrailer Type 2 TLS
trailers
   Product: Wireshark
   Version: Git
  Hardware: x86
OS: macOS 10.14
Status: UNCONFIRMED
  Severity: Enhancement
  Priority: Low
 Component: Dissection engine (libwireshark)
  Assignee: bugzilla-ad...@wireshark.org
  Reporter: kryojen...@gmail.com
  Target Milestone: ---

Build Information:
tshark -v
TShark (Wireshark) 3.3.0 (v3.3.0rc0-652-g9db2be107f02)

Copyright 1998-2020 Gerald Combs  and contributors.
License GPLv2+: GNU GPL version 2 or later

This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, without POSIX capabilities, with GLib 2.62.5,
with zlib 1.2.11, without SMI, with c-ares 1.15.0, without Lua, without GnuTLS,
with Gcrypt 1.8.5, with MIT Kerberos, without MaxMind DB resolver, without
nghttp2, without brotli, without LZ4, without Zstandard, without Snappy, with
libxml2 2.9.4.

Running on Mac OS X 10.15.3, build 19D76 (Darwin 19.3.0), with Intel(R)
Core(TM)
i7-7920HQ CPU @ 3.10GHz (with SSE4.2), with 16384 MB of physical memory, with
locale en_US.UTF-8, with libpcap version 1.9.1, with Gcrypt 1.8.5, with zlib
1.2.11, binary plugins supported (0 loaded).

Built using clang 4.2.1 Compatible Apple LLVM 11.0.0 (clang-1100.0.33.17).
--
Add ability to decode Version 1 F5ethtrailer Type TLS

This includes the Early Traffic Secret if diagnostic options are specified when
capturing with tcpdump on system.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16364] ISAKMP: IKEv2 transforms and proposal have critical bit (BUG)

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16364

Anders Broman  changed:

   What|Removed |Added

 Resolution|--- |FIXED
 Status|IN_PROGRESS |RESOLVED

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16371] BT ATT dissector doesn't call subdissector when not registered with BT UUID

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16371

Anders Broman  changed:

   What|Removed |Added

 Status|UNCONFIRMED |RESOLVED
 Resolution|--- |FIXED

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16392] RTP over TCP (RFC 4571) not fully dissected

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16392

Anders Broman  changed:

   What|Removed |Added

 Resolution|--- |FIXED
 Status|IN_PROGRESS |RESOLVED

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16402] goose.test field in IECGoosePdu shall be renamed to goose.simulation

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16402

Anders Broman  changed:

   What|Removed |Added

 Status|IN_PROGRESS |RESOLVED
 Resolution|--- |FIXED

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16420] LINKTYPE_WIRESHARK_UPPER_PDU packets aren't readable by non-Wireshark programs

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16420

--- Comment #7 from Guy Harris  ---
(In reply to jgh from comment #5)
> The use-case is:
> 
> - an existing utility which reads pcaps and interprets TCP flows for display
>   and analysis:  tcptrace
> - a need to investigate an ipsec-wrapped TCP flow
> - de-wrap the ipsec from the flow using wireshark, and write a pcap with
>   the IP/TCP only
> 
> 
> If the solution is to re-code the utility, that's ok (for this utility, as
> I have source).  But we need documentation to do that; the existing
> documentation
> implies that you can just call pcap_datalink() and get handed a packet and a
> link type which is one of the documented values.  That appears to have
> changed;
> it no longer functions.

It has never been the case that pcap_datalink() only returns a documented
value; there was a time when the page that documents some of the values didn't
even exist.

> If the link-type of 252 now being returned is valid,
> then a) the documentation needs to say so, and b) the documentation needs to
> say what the format of the packet returned for that case is.
> It would also be useful to know what API returns the "dissector name", if
> that has to be looked it; it's not obvious from the list at
>  https://www.tcpdump.org/manpages/

There isn't, and there never will be, a libpcap API to do that.  It is *not*,
and never will be, libpcap's job to parse the payload, including any metadata
headers in the payload, so there are, and will continue to be, no libpcap APIs
to parse the DLT_WIRESHARK_UPPER_PDU metadata, just as there are, and will
continue to be, no libpcap APIs to parse radiotap headers - or, for that
matter, Ethernet headers.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13881] Add (IETF) QUIC Dissector

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13881

--- Comment #295 from Gerrit Code Review  ---
Change 36264 had a related patch set uploaded by Alexis La Goutte:
QUIC: define QUIC Transport Parameter on Hexadecimal (like spec)

https://code.wireshark.org/review/36264

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 13881] Add (IETF) QUIC Dissector

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13881

--- Comment #296 from Gerrit Code Review  ---
Change 36265 had a related patch set uploaded by Alexis La Goutte:
QUIC: Add missing extension link (Delayed ACK, Loss Bit)

https://code.wireshark.org/review/36265

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16420] LINKTYPE_WIRESHARK_UPPER_PDU packets aren't readable by non-Wireshark programs

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16420

--- Comment #6 from Anders Broman  ---
(In reply to jgh from comment #5)
> The use-case is:
> 
> - an existing utility which reads pcaps and interprets TCP flows for display
>   and analysis:  tcptrace
> - a need to investigate an ipsec-wrapped TCP flow
> - de-wrap the ipsec from the flow using wireshark, and write a pcap with
>   the IP/TCP only
> 
> 
> If the solution is to re-code the utility, that's ok (for this utility, as
> I have source).  But we need documentation to do that; the existing
> documentation
> implies that you can just call pcap_datalink() and get handed a packet and a
> link type which is one of the documented values.  That appears to have
> changed;

? 
https://github.com/the-tcpdump-group/libpcap/blob/master/pcap/dlt.h
As Guy pointed out not all DLTs are documented on the HTML page.

> it no longer functions.  If the link-type of 252 now being returned is valid,
> then a) the documentation needs to say so, and b) the documentation needs to
> say what the format of the packet returned for that case is.
> It would also be useful to know what API returns the "dissector name", if
> that has to be looked it; it's not obvious from the list at
>  https://www.tcpdump.org/manpages/

This sounds lika tcpdump/libpcap questions and should be rasied with them
rather than the Wireshark project. That said I pointed you to the documentation
of the format...

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16420] LINKTYPE_WIRESHARK_UPPER_PDU packets aren't readable by non-Wireshark programs

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16420

--- Comment #5 from j...@wizmail.org ---
The use-case is:

- an existing utility which reads pcaps and interprets TCP flows for display
  and analysis:  tcptrace
- a need to investigate an ipsec-wrapped TCP flow
- de-wrap the ipsec from the flow using wireshark, and write a pcap with
  the IP/TCP only


If the solution is to re-code the utility, that's ok (for this utility, as
I have source).  But we need documentation to do that; the existing
documentation
implies that you can just call pcap_datalink() and get handed a packet and a
link type which is one of the documented values.  That appears to have changed;
it no longer functions.  If the link-type of 252 now being returned is valid,
then a) the documentation needs to say so, and b) the documentation needs to
say what the format of the packet returned for that case is.
It would also be useful to know what API returns the "dissector name", if
that has to be looked it; it's not obvious from the list at
 https://www.tcpdump.org/manpages/

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 16420] LINKTYPE_WIRESHARK_UPPER_PDU packets aren't readable by non-Wireshark programs

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16420

Anders Broman  changed:

   What|Removed |Added

 Status|UNCONFIRMED |RESOLVED
 Resolution|--- |NOTABUG

--- Comment #4 from Anders Broman  ---
> So the need is one of
> 
> - a way of writing a pcap file that older libpcap-based utilities understand,
>   presumably by stripping the EXPORTED_PDU layer

If your utility does not read the exported PDU format why use exported PDU in
the first place? Not knowing the use case makes it hard to recomend something.
But I think you need to adopt your utility to undersand the exported PDU format
to the extent you are using it for. E.G handle the protocol name of "ip"(?).

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe