aboutsummaryrefslogtreecommitdiffstats
path: root/epan/dissectors/packet-ssh.c
AgeCommit message (Collapse)AuthorFilesLines
2016-01-24Add the packet number to the packet_info structure, and use it.Guy Harris1-12/+12
That removes most of the uses of the frame number field in the frame_data structure. Change-Id: Ie22e4533e87f8360d7c0a61ca6ffb796cc233f22 Reviewed-on: https://code.wireshark.org/review/13509 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-09new_register_dissector -> register_dissector for dissector directory.Michael Mann1-1/+1
Change-Id: Ie39ef054a4a942687bd079f3a4d8c2cc55d5f22c Reviewed-on: https://code.wireshark.org/review/12485 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-23register_dissector -> new_register_dissectorMichael Mann1-5/+5
Change-Id: Ifc8208e1b96e2a3bf297912500a5f252bfa8eed9 Reviewed-on: https://code.wireshark.org/review/12073 Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-10-31[ssh] don't THROW() an exception from a dissectorMartin Kaiser1-2/+5
Change-Id: Ibdbdcf59d7d7d28a812e31c7d7b2123b035f80fa Reviewed-on: https://code.wireshark.org/review/11461 Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
2015-10-31[ssh] remove some unnecessary if(tree) checksMartin Kaiser1-20/+8
Change-Id: Id335830e70a944dd5c26e66d7515d168725acf3f Reviewed-on: https://code.wireshark.org/review/11460 Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
2015-08-27Remove calls of tvb_ensure_length_remaining.Michael Mann1-6/+6
The remaining calls seem to fall into 3 categories: 1. passing it to tvb_find_line_end when -1 (for length) will do. 2. duplicating the checking of tvb_reported_length_remaining, which is already in use near the tvb_ensure_length_remaining call. 3. Those that (probably) need tvb_ensure_capture_length_remaining Change-Id: I1e77695251e055644bcbbb89f3c181c65d1671ca Reviewed-on: https://code.wireshark.org/review/10268 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-12-25Deleting unnecessary #includes from dissectors.Martin Mathieson1-1/+0
Fifth batch (packet-rtp.c -> end). Will look at cleaning up and committing script afterwards. Change-Id: I8ed61dc941d98d3f7259a9d1f74e214eb7b4bfa2 Reviewed-on: https://code.wireshark.org/review/6052 Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2014-12-21Cleanup use of #includes in non-generated epan/dissector/*.cBill Meier1-3/+0
Specifically: - Set packet.h to be the first wireshark #include after config.h and "system" #includes. packet.h added as an #include in some cases when missing. - Remove some #includes included (directly/indirectly) in packet.h. E.g., glib.h. (Done only for those files including packet.h). - As needed, move "system" #includes to be after config.h and before wireshark #includes. - Rework various #include file specifications for consistency. - Misc. Change-Id: Ifaa1a14b50b69fbad38ea4838a49dfe595c54c95 Reviewed-on: https://code.wireshark.org/review/5923 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-12-13Use ENC_BIG_ENDIAN when fetching FT_U?INT8 fields ...Bill Meier1-4/+4
(for some dissectors which fetch all other integral fields using ENC_BIG_ENDIAN). Change-Id: Ic18e3172aad76af12b12d6732c88497be22aed56 Reviewed-on: https://code.wireshark.org/review/5748 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-10-06Convert (what appear to be) "4 space tabs"; Adjust editor-modelines; Do some ↵Bill Meier1-1117/+1117
minor reformatting. Change-Id: Ie078c826ed38a0d682f61fb3e95450b47a9d2c31 Reviewed-on: https://code.wireshark.org/review/4499 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-08-10ssh.dh_gex.nbits: there's only one numberРоман Донченко1-1/+1
Change-Id: Ia3bd392b2223cf666828d65a61e069c465d3894a Reviewed-on: https://code.wireshark.org/review/3536 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-08-10SSH: don't display "Payload" if it's emptyРоман Донченко1-1/+3
The "Payload" field only makes sense for packets that have unknown type or are unexpectedly long. For normal traces, it will always be empty, so hide it. Note: this length check used to be implicitly performed by ssh_proto_tree_add_item before 2aa66aa2b2daf0693e405371a5f9037a43896441, so this just restores the former behaviour. Change-Id: I948935bce660018377a004c661b829a19eb0a53b Reviewed-on: https://code.wireshark.org/review/3535 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-07-09convert to proto_tree_add_subtree[_format]Michael Mann1-19/+9
Change-Id: I8d66b1bc7dbdfee3d4bf6fd3b3c21c6323b66f44 Reviewed-on: https://code.wireshark.org/review/2946 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-06-19Revert "Fixup: tvb_ensure_length_remaining -> ↵Michael Mann1-6/+6
tvb_ensure_captured_length_remaining" See https://www.wireshark.org/lists/wireshark-dev/201406/msg00131.html This reverts commit 021e7afc9fcba09094d0e2143cc434a34e3b09dc. Change-Id: I0640eabce5ce8c4ff3a88ebf848b499f8bb8ed2f Reviewed-on: https://code.wireshark.org/review/2429 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-06-18Fixup: tvb_ensure_length_remaining -> tvb_ensure_captured_length_remainingDario Lombardo1-6/+6
Change-Id: I0228f3b6b7067bc0ce51f9d359f99fd18feb2b66 Reviewed-on: https://code.wireshark.org/review/2378 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-06-18Fixup: tvb_get_string(z) -> tvb_get_string(z)_encDario Lombardo1-1/+1
Change-Id: I63a3704effe3fcab01a193dc39b6a22e9f1cf3fe Reviewed-on: https://code.wireshark.org/review/2376 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-05-05SSH Dissector : Remove ssh_proto_tree_add_item (No longer needed)Alexis La Goutte1-27/+16
Change-Id: I6d227ad7a4ddfab9d2cf18a3148700a6bd6dd321 Reviewed-on: https://code.wireshark.org/review/1512 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-05-05SSH dissector: fix MAC length calculation for recent OpenSSH featuresJan Seda1-9/+61
Also, show the packet length part of the encrypted packet. The length may be encrypted (typical) or not (-etm modes and GCM mode). When not encrypted, show as a number. Bug:10066 Change-Id: I8c3a943b1b527b326b662e71f07ac6157684d5d9 Reviewed-on: https://code.wireshark.org/review/1462 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Evan Huus <eapache@gmail.com>
2014-05-02Add modelines infoAlexis La Goutte1-0/+13
Change-Id: I82f841e0ee9e00c69894d8c4c67f581278c87546 Reviewed-on: https://code.wireshark.org/review/1469 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-02-07Register SSH dissector by namePascal Quantin1-4/+4
Change-Id: Ia9ad45ce9196486129897cd616707d622778e9dd Reviewed-on: https://code.wireshark.org/review/137 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2013-12-10- Forward declaration of register functions.Anders Broman1-0/+3
svn path=/trunk/; revision=53918
2013-11-10Add missing includes in order to remove exceptions.h from proto.h (next commit).Jakub Zawadzki1-0/+1
svn path=/trunk/; revision=53230
2013-09-22emem -> wmem conversion:Pascal Quantin1-1/+1
- ep_tvb_get_bits() -> wmem_packet_tvb_get_bits() - tvb_g_memdup()/ep_tvb_memdup() -> tvb_memdup() - tvb_fake_unicode()/tvb_get_ephemeral_faked_unicode() -> tvb_get_faked_unicode() - tvb_get_g_string()/tvb_get_ephemeral_string()/tvb_get_seasonal_string() -> tvb_get_string() - tvb_get_g_unicode_string()/tvb_get_ephemeral_unicode_string() -> tvb_get_unicode_string() - tvb_get_ephemeral_string_enc() -> tvb_get_string_enc() - update docs accordingly svn path=/trunk/; revision=52172
2013-09-14emem -> wmemJörg Mayer1-10/+10
svn path=/trunk/; revision=52038
2013-09-09expert_add_info_format_text -> expert_add_info_formatMichael Mann1-1/+1
svn path=/trunk/; revision=51852
2013-08-07From Роман Донченко via ↵Jeff Morriss1-67/+180
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9018 : This patch enables Wireshark to correctly decode messages specific to the selected key exchange method by determining and remembering that method. It's a little incomplete in that it doesn't support the case where first_kex_packet_follows is true, but then the current implementation doesn't either. It also adds/fixes dissection for the plain Diffie-Hellman key exchange and DH group exchange messages that were broken/missing, completing support for both of these key exchange methods. svn path=/trunk/; revision=51197
2013-08-05From Роман Донченко via ↵Jeff Morriss1-17/+21
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9010 : This patch fixes a bug where if the client identifies itself first, both of the protocol version messages are misidentified as encrypted data. svn path=/trunk/; revision=51151
2013-08-02From Роман Донченко via ↵Jeff Morriss1-172/+173
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9006 : Currently, Wireshark only dissects one side's Key Exchange Init message, which, in particular, means that the encryption, MAC and compression algorithms it infers are bogus. This patch fixes that. From me: Don't use a macro which confused checkhf (it only saved a small amount of visible code). Fix up some more white space. Use macros for a couple array indexes. svn path=/trunk/; revision=51126
2013-08-02From ?\208?\160?\208?\190?\208?\188?\208?\176?\208?\189 ↵Jeff Morriss1-88/+73
?\208?\148?\208?\190?\208?\189?\209?\135?\208?\181?\208?\189?\208?\186?\208?\190 via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9004 : This patch makes the SSH dissector able to display multiple messages in the Info column. As a side effect, it changes the formatting of some messages to be more uniform. I've also removed a dubious chunk of code that hardcodes a 16-byte MAC after a SSH_MSG_KEX_DH_GEX_REPLY message. There can't be a MAC before key exchange is over, and in my sample capture, this actually eats the second message that follows. From me: some white space cleanup. svn path=/trunk/; revision=51117
2013-07-26From Роман Донченко via ↵Jeff Morriss1-6/+10
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8977 : In SSH, the protocol version message is terminated by CR LF. Wireshark, in the info column, strips out the LF, but not the CR. Attaching a patch to rectify that. Also, as requested, update the contributor's email address in AUTHORS. svn path=/trunk/; revision=50902
2013-05-27Batch of filterable expert infosMichael Mann1-1/+11
svn path=/trunk/; revision=49600
2013-03-07From Ed Beroset via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416 :Pascal Quantin1-3/+3
Remove C++ incompatibilities from ssl and ssh files svn path=/trunk/; revision=48174
2013-02-17Improve SSH state machine so IGNORED messages don't upset the dissection by ↵Michael Mann1-232/+162
throwing the "packet count" off. Bug 5064 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5064) svn path=/trunk/; revision=47723
2013-02-10Add support for IGNORE message type to SSH2 dissector + some minor cleanupMichael Mann1-47/+40
I was hoping this would fix bug 5064 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5064), but all it did was fix the malformed part of the dissector. svn path=/trunk/; revision=47601
2012-09-20We always HAVE_CONFIG_H so don't bother checking whether we have it or not.Jeff Morriss1-3/+1
svn path=/trunk/; revision=45017
2012-08-15convert GStrings to more "ephemeral friendly" use.Michael Mann1-7/+6
svn path=/trunk/; revision=44515
2012-06-28Update Free Software Foundation address.Jakub Zawadzki1-1/+1
(COPYING will be updated in next commit) svn path=/trunk/; revision=43536
2012-06-02From Evan Huus Useless null check in packet-ssh.c ↵Anders Broman1-1/+1
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7319 svn path=/trunk/; revision=42996
2012-04-09Add missing const attribute to some char *Jakub Zawadzki1-1/+1
Fix some "assignment discards qualifiers from pointer target type", etc svn path=/trunk/; revision=41996
2012-03-15Add support for SSH over SCTP.Michael Tüxen1-0/+2
svn path=/trunk/; revision=41556
2012-02-26Dissect SSH over SCTP when using the IANA assigned SCTP port 22.Michael Tüxen1-0/+2
svn path=/trunk/; revision=41197
2011-10-27Fix some proto_tree_add_item() encoding args;Bill Meier1-268/+266
In some files: Remove a few unneeded #includes; Do some whitespace/indentation cleanup svn path=/trunk/; revision=39635
2011-10-21For proto_tree_add_item(..., proto_xxx, ...)use ENC_NA as the encoding arg.Bill Meier1-1/+1
Also: remove trailing whitespace for a number of files. svn path=/trunk/; revision=39503
2011-10-15Convert proto_tree_add_item() 'encoding' arg for field types FT_STRING, ↵Bill Meier1-1/+1
FT_STRINGZ, FT_UINT_STRING as follows: 1. If there's no character encoding (ENC_ASCII, ...) specified then use ENC_ASCII. 2. For all but FT_UINT_STRING, always use ENC_NA (replacing any existing True/1/FALSE/0 /ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN). svn path=/trunk/; revision=39426
2011-10-06Convert 'encoding' parameter of certain proto_tree_add_item() calls in ↵Bill Meier1-1/+1
non-autogenerated epan/dissectors: Specifically: Replace FALSE|0 and TRUE|1 by ENC_BIG_ENDIAN|ENC_LITTLE_ENDIAN as the encoding parameter for proto_tree_add_item() calls which directly reference an item in hf[] which has a type of: FT_UINT8 FT_UINT16 FT_UINT24 FT_UINT32 FT_UINT64 FT_INT8 FT_INT16 FT_INT24 FT_INT32 FT_INT64 FT_FLOAT FT_DOUBLE svn path=/trunk/; revision=39288
2011-10-04Use ENC_NA as encoding for proto_tree_add_item() calls which directly ↵Bill Meier1-11/+11
reference an hf item (in hf[] with types: FT_NONE FT_BYTES FT_IPV6 FT_IPXNET FT_OID Note: Encoding field set to ENC_NA only if the field was previously TRUE|FALSE|ENC_LITTLE_ENDIAN|ENC_BIG_ENDIAN svn path=/trunk/; revision=39260
2011-04-18Removed some unneeded assignments.Stig Bjørlykke1-1/+1
Found by clang. svn path=/trunk/; revision=36698
2011-03-25From Didier via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3055 :Jeff Morriss1-2/+32
Apply rev 25869 to most of the rest of the TCP-desegmenting dissectors. (The SSL dissector was already updated in one of two spots with bug 4535/rev 32456.) A couple of the patches had to be manually applied. From me: Fix the comments to match the change (including in the TCP and SSL dissectors.) svn path=/trunk/; revision=36332
2010-12-22Add #define and value_string entries for the remaining SSH message typeStephen Fisher1-41/+82
numbers as defined in RFC 4250. svn path=/trunk/; revision=35246
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-24 11:18:00 +0000