https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15910
--- Comment #20 from Pascal Quantin <pas...@wireshark.org> ---
(In reply to Christopher Maynard from comment #19)
> (In reply to Gerrit Code Review from comment #11)
> > Change 34987 had a related patch set uploaded by Pascal Quantin:
> > CoAP: fixes for TCP transport
> >
> > https://code.wireshark.org/review/34987
>
> I believe this patch has broken some CoAP parsing. For example, if you load
> the capture file from Bug 14591 and apply the MQTT Message Decoding as
> follows:
>
> Match criteria Topic pattern Decoding Payload protocol
> Ends with /c.z compressed coap
>
> then the CoAP payload is malformed. Perhaps this isn't the patch that broke
> it, but in any case, this worked properly with 3.0.7 but no longer works
> properly with 3.2.0 (or master Version 3.3.0 (v3.3.0rc0-340-gb6ce60afbb12)).
This is not this patch, but https://code.wireshark.org/review/#/c/34001/
The issue comes from the way we identify whether this is CoAP over TCP or not:
static int
dissect_coap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data
_U_)
{
if (pinfo->ptype != PT_TCP) {
/* Assume UDP */
return dissect_coap_message(tvb, pinfo, tree, FALSE, FALSE);
} else if (proto_is_frame_protocol(pinfo->layers, "websocket")) {
/* WebSockets */
return dissect_coap_message(tvb, pinfo, tree, TRUE, TRUE);
} else {
return dissect_coap_message(tvb, pinfo, tree, TRUE, FALSE);
}
}
In your case pinfo->ptype == PT_TCP but this is MQTT that runs over TCP, not
CoAP. Forcing the call to dissect_coap_message(tvb, pinfo, tree, FALSE, FALSE)
gives a dissection that seems meaningful.
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
