Don't put the NTLMv2 ChallengeFromClient into the protocol tree twice.

It's already put there by dissect_ntlmv2_response(); no need to do it
again.

Also, rename "NTLM Client Challenge" to "LMv2 Client Challenge", as
that's what it is (ChallengeFromClient from 2.2.2.4 LMv2_RESPONSE), and
rename "Client Challenge" to "NTLMv2 Client Challenge", as that's what
*it* is (ChallengeFromClient from 2.2.2.7 NTLM v2:
NTLMv2_CLIENT_CHALLENGE).

Change-Id: If95e2c77323cb597df7e400bf9ffc045d94c60e2
Reviewed-on: https://code.wireshark.org/review/8524
Reviewed-by: Guy Harris <guy@alum.mit.edu>

1 files changed, 4 insertions, 10 deletions

diff --git a/epan/dissectors/packet-ntlmssp.c b/epan/dissectors/packet-ntlmssp.c
index b4561e161d..c05c1d5d9e 100644
--- a/epan/dissectors/packet-ntlmssp.c
+++ b/epan/dissectors/packet-ntlmssp.c
@@ -1034,13 +1034,7 @@ dissect_ntlmssp_blob (tvbuff_t *tvb, packet_info *pinfo,
        * by an NTLMv2_CLIENT_CHALLENGE; an NTLMv2_CLIENT_CHALLENGE
        * is at least 32 bytes, so an NTLMv2_RESPONSE is at least
        * 48 bytes long.
-       *
-       * XXX - the following item is the same as
-       * hf_ntlmssp_ntlmv2_response_chal; do we really need two of them?
        */
-      proto_tree_add_item (ntlmssp_tree,
-                           hf_ntlmssp_ntlm_client_challenge,
-                           tvb, blob_offset+32, 8, ENC_NA);
       dissect_ntlmv2_response(tvb, pinfo, tree, blob_offset, blob_length);
     }
   }
@@ -2890,9 +2884,9 @@ proto_register_ntlmssp(void)
         NULL, HFILL }
     },
     { &hf_ntlmssp_ntlm_client_challenge,
-      { "NTLM Client Challenge", "ntlmssp.ntlmclientchallenge",
+      { "LMv2 Client Challenge", "ntlmssp.ntlmclientchallenge",
         FT_BYTES, BASE_NONE, NULL, 0x0,
-        NULL, HFILL }
+        "The 8-byte LMv2 challenge message generated by the client", HFILL }
     },
     { &hf_ntlmssp_ntlm_server_challenge,
       { "NTLM Server Challenge", "ntlmssp.ntlmserverchallenge",
@@ -3236,9 +3230,9 @@ proto_register_ntlmssp(void)
         "The 8-byte little-endian time in UTC", HFILL }
     },
     { &hf_ntlmssp_ntlmv2_response_chal,
-      { "Client Challenge", "ntlmssp.ntlmv2_response.chal",
+      { "NTLMv2 Client Challenge", "ntlmssp.ntlmv2_response.chal",
         FT_BYTES, BASE_NONE, NULL, 0x0,
-        "The 8-byte challenge message generated by the client", HFILL }
+        "The 8-byte NTLMv2 challenge message generated by the client", HFILL }
     },
   };