aboutsummaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)AuthorFilesLines
2021-10-18dfilter: Add a thin encapsulation layer for REsJoão Valverde1-0/+4
2021-10-18dfilter: Improve error message for "matches"João Valverde1-1/+1
Should be more obvious that this error is caused by a string syntax error and not something else.
2021-10-17dfilter: Require double-quoted strings with "matches"João Valverde1-0/+12
Matches is a special case that looks on the RHS and tries to convert every unparsed value to a string, regardless of the LHS type. This is not how types work in the display filter. Require double-quotes to avoid ambiguity, because matches doesn't follow normal Wireshark display filter type rules. It doesn't need nor benefit from the flexibility provided by unparsed strings in the syntax. For matches the RHS is always a literal strings except if the RHS is also a field name, then it complains of an incompatible type. This is confusing. No type can be compatible because no type rules are ever considered. Every unparsed value is a text string except if it happens to coincide with a field name it also requires double-quoting or it throws a syntax error, just to be difficult. We could remove this odd quirk but requiring double-quotes for regular expressions is a better, more elegant fix. Before: Filter: tcp matches "udp" Constants: 00000 PUT_PCRE udp -> reg#1 Instructions: 00000 READ_TREE tcp -> reg#0 00001 IF-FALSE-GOTO 3 00002 ANY_MATCHES reg#0 matches reg#1 00003 RETURN Filter: tcp matches udp Constants: 00000 PUT_PCRE udp -> reg#1 Instructions: 00000 READ_TREE tcp -> reg#0 00001 IF-FALSE-GOTO 3 00002 ANY_MATCHES reg#0 matches reg#1 00003 RETURN Filter: tcp matches udp.srcport dftest: tcp and udp.srcport are not of compatible types. Filter: tcp matches udp.srcportt Constants: 00000 PUT_PCRE udp.srcportt -> reg#1 Instructions: 00000 READ_TREE tcp -> reg#0 00001 IF-FALSE-GOTO 3 00002 ANY_MATCHES reg#0 matches reg#1 00003 RETURN After: Filter: tcp matches "udp" Constants: 00000 PUT_PCRE udp -> reg#1 Instructions: 00000 READ_TREE tcp -> reg#0 00001 IF-FALSE-GOTO 3 00002 ANY_MATCHES reg#0 matches reg#1 00003 RETURN Filter: tcp matches udp dftest: "udp" was unexpected in this context. Filter: tcp matches udp.srcport dftest: "udp.srcport" was unexpected in this context. Filter: tcp matches udp.srcportt dftest: "udp.srcportt" was unexpected in this context. The error message could still be improved.
2021-10-17TCPCLv4: Update TCPCL dissector to include version 4 from dtn-wiresharkBrian Sipos3-0/+19
Some enhancements and visual fixes to version 3 dissector are also included.
2021-10-15tests: Accept a partial string in checkDFilterFail()João Valverde2-2/+2
2021-10-15tests: Fixup test namesJoão Valverde2-2/+2
2021-10-15dfilter: Don't try to parse byte arrays as stringsJoão Valverde1-2/+6
It won't work with embedded null bytes so don't try. This is not an additional restriction, it just removes a hidden failure mode. To support matching embedded NUL bytes we would have to use an internal string representation other than null-terminated C strings (which doesn't seem very onerous with GString). Before: Filter: http.user_agent == 41:42:00:43 Constants: 00000 PUT_FVALUE "AB" <FT_STRING> -> reg#1 Instructions: 00000 READ_TREE http.user_agent -> reg#0 00001 IF-FALSE-GOTO 3 00002 ANY_EQ reg#0 == reg#1 00003 RETURN After: Filter: http.user_agent == 41:42:00:43 Constants: 00000 PUT_FVALUE "41:42:00:43" <FT_STRING> -> reg#1 Instructions: 00000 READ_TREE http.user_agent -> reg#0 00001 IF-FALSE-GOTO 3 00002 ANY_EQ reg#0 == reg#1 00003 RETURN
2021-10-15dfilter: Use the same semantic rules for protocols and bytesJoão Valverde1-0/+7
FT_PROTOCOL and FT_BYTES are the same semantic type, but one is backed by a GByteArray and the other by a TVBuff. Use the same semantic rules to parse both. In particular unparsed strings are not converted to literal strings for protocols. Before: Filter: frame contains 0x0000 Constants: 00000 PUT_FVALUE 30:78:30:30:30:30 <FT_PROTOCOL> -> reg#1 Instructions: 00000 READ_TREE frame -> reg#0 00001 IF-FALSE-GOTO 3 00002 ANY_CONTAINS reg#0 contains reg#1 00003 RETURN Filter: frame[5:] contains 0x0000 dftest: "0x0000" is not a valid byte string. After: Filter: frame contains 0x0000 dftest: "0x0000" is not a valid byte string. Filter: frame[5:] contains 0x0000 dftest: "0x0000" is not a valid byte string. Related to #17634.
2021-10-10BPv7: Add Bundle Protocol version 7 and BPSec dissectors from dtn-wiresharkBrian Sipos5-0/+57
2021-10-08dfilter: Fix parsing of value stringsJoão Valverde2-0/+12
If we have a STRING value in an expression and a numeric comparison we must also check if it matches a value string before throwing a type error. Add appropriate tests to the test suite. Fixes 4d2f4692129b1953c8631d58036bd6ce8cde6d50.
2021-10-07dfilter: Skip equality test and add explanationJoão Valverde1-12/+15
Also fix a byte typo in the 'eth' filter expression.
2021-10-05dfilter: Add some more syntax testsJoão Valverde1-0/+28
2021-10-05dfilter: Strengthen sanity check for rangeJoão Valverde1-0/+12
Allow an entity in the grammar as range body. Perform a stronger sanity check during semantic analysis everywhere a range is used. This is both safer (unless we want to allow FIELD bodies only, but functions are allowed too) and also provides better error messages. Previously a range of range only compiled on the RHS. Now it can appear on both sides of a relation. This fixes a crash with STRING entities similar to #10690 for UNPARSED. This also adds back support for slicing functions that was removed in f3f833ccecce0e8611b2f1990d0fcf81959fcb78 (by accident presumably). Ping #10690
2021-10-01Test: Add external tests.Gerald Combs2-0/+173
Add test/suite_external.py, which can dynamically generate tests from a configuration file. This is intended to make happy-shark useful, but it should make it easy to add simple TShark tests elsewhere. The configuration file format must currently be JSON as described in the Developer's Guide.
2021-09-30dfilter: Add test for "deprecated" tokensJoão Valverde2-0/+45
Tokens that are (so-called) deprecated produce a warning/hint to the user in the UI.
2021-09-29COSE dissector from dtn-wireshark projectBrian Sipos16-0/+219
2021-09-27MSYS2: Test commands in pipes need quotingJoão Valverde1-3/+8
At least using MSYS2 python (that uses system() that uses CMD.EXE) we must quote every command in a pipe, otherwise the "'C:' is not recognized as an internal or external program" error occurs.
2021-09-27MSYS2: Fix detection of test suite binariesJoão Valverde1-1/+3
Fix hack to find test binaries. We must only search in run/<config> if using Visual Studio.
2021-09-13HTTP2, QUIC: fix "Follow Stream"Nardi Ivan3-0/+63
"Follow Stream" functionality assumes that all data in a single packet belongs to the same stream. That is not true for HTTP2 and QUIC, where we end up having data from unrelated streams. Filter out the unwanted data directly in the protocol dissector code with a custom `tap_handler` (as TCP already does). Close #16093
2021-09-10[#17517] capinfos: machine-readable filetype/encapDavid Perry1-19/+27
2021-08-30git: Add test casesJoey Salazar2-0/+25
Add git dissection test cases to existing testing suite for: finding git packets, finding the Git Protocol version, finding the right amount of Flush and Delimiter packets, not finding Malformed packets. Part of #17093
2021-07-19Carry drop count/packet ID/queue ID as options on packet blockDavid Perry1-1/+0
2021-07-12Carry EPB flags as an option on the packet blockDavid Perry1-1/+0
As requested by [this comment][1] on !2859, move `pack_flags` from a dedicated field in `wtap_rec` to a block option on the packet block in `wtap_rec.block`. [1]: https://gitlab.com/wireshark/wireshark/-/merge_requests/2859#note_615984624
2021-07-11wsutil: Start adding a test suiteJoão Valverde1-0/+6
2021-07-07Use wtap_blocks for packet commentsDavid Perry3-3/+1
Mostly functioning proof of concept for #14329. This work is intended to allow Wireshark to support multiple packet comments per packet. Uses and expands upon the `wtap_block` API in `wiretap/wtap_opttypes.h`. It attaches a `wtap_block` structure to `wtap_rec` in place of its current `opt_comment` and `packet_verdict` members to hold OPT_COMMENT and OPT_PKT_VERDICT option values.
2021-06-28Using col_append_sep_fstr() instead of prepending "NetPerfMeter" label.Thomas Dreibholz1-341/+341
2021-06-28NetPerfMeter display improvement:Thomas Dreibholz1-341/+341
Prepend protocol name "NetPerfMeter" with col_prepend_fence_fstr(), instead of overwriting the underlying Transport Layer protocol name.
2021-06-25Skip two protobuf dissector tests when LUA is not availableVasil Velichkov1-0/+4
Both tests are using LUA scripts and both fails when it is not avialble.
2021-06-21Lua: reconcile expert info groups; add PI_ASSUMPTIONChuck Craft1-0/+3
2021-06-21solved code conflicts pre rebasePaul Offord1-163/+276
2021-06-20tests: Remove duplicate testJoão Valverde1-6/+0
2021-06-14wslog: Update test suiteJoão Valverde1-1/+1
2021-06-09Updated unit test with relative sequence numbers.Thomas Dreibholz1-90/+90
2021-06-04file-pcapng: redo the way we dissect the data in blocks.Guy Harris1-2/+5
Create a tvbuff that covers the data portion of a block, and use that to dissect all data in the block, including but not limited to the options. Catch ReportedBoundsError exceptions and treat them as an indication that the block length was too short - add an expert info to the block length item indicating that. Have separate routines for each block type that dissects the data in that block type. While we're at it, check whether the trailing block length is equal to the header block length and, if not, report an error in the trailing block length. Fix the tests to match.
2021-06-04SCTP: Display basic TSN information with packetsThomas Dreibholz1-90/+90
2021-03-26Lua: add DissectorTable.try_heuristics() functionDaniel Dulaney2-0/+65
Add DissectorTable.try_heuristics(name, tvb, pinfo, tree). Previously, there was no way for a Lua plugin to run an existing heuristic dissector. Based on Gerrit change 18718. Closes #17220.
2021-03-25test: add missing raw string regex identifier.Dario Lombardo1-2/+2
2021-03-21dfilter, ftypes: get rid of FT_PCRE.Guy Harris1-1/+0
It's not a valid field type, it's only a hack to support regular expression matching in packet-matching expressions. Instead, in the packet-matching code, have a separate syntax tree type for Perl-compatible regular expressions, and a separate instruction to load one into a register, and have the "matching" operator for field types take a GRegex * as the second argument.
2021-03-16ieee80211: Support decrypting Fast BSS Transition with roamingMikael Kanstrup2-4/+30
Support decrypting captures with Fast BSS Transition roaming present by now also scanning (re)association frames for relevant information elements and feeding it into the dot11decrypt engine. Both (re)association request and response frames are scanned to allow for potentially missing one frame and still be able to derive PTKs needed for successful decryption. Closes #17145 Change-Id: I08436582e4f83695dc606ddb92ff442d6258ef9b
2021-03-11Qt: Copy->Value - don't zero pad hex valuesChuck Craft5-57/+57
Closes #17276 Update test scripts and datafiles for corrected output format.
2021-03-07NetPerfMeter: Drop "protocol" from the nameJoão Valverde1-346/+346
2021-03-04Replaced large NetPerfMeter captures by one small capture.Thomas Dreibholz5-83/+383
Changes: * Replaced large netperfmeter-dccp.pcapng.gz and netperfmeter.pcap.gz captures by one common small netperfmeter.pcapng.gz for the suites follow_dccp and netperfmeter. * Updated test suites "follow_dccp" and "netperfmeter".
2021-02-26tests: skip plugin count test if feature is disabledJoão Valverde2-1/+4
2021-02-22Added "Follow DCCP stream" feature.Thomas Dreibholz2-0/+71
This pull request includes: * The "Follow DCCP stream" feature. * Updated docbook documentation for the "Follow DCCP stream" feature. * Test for the feature. * Corresponding packet trace for the test.
2021-02-21Added NetPerfMeter test suite.Thomas Dreibholz1-0/+151
2021-02-21Added NetPerfMeter test trace.Thomas Dreibholz1-0/+0
2021-02-20tests: Look for softhsm2 in more placesJohn Thacker1-4/+4
Fedora and RHEL/CentOS put libsofthsm2.so in a different location than Debian/Ubuntu, so look there too. This causes test_tls_pkcs11 to pass instead of being skipped (if softhsm2 and the other prerequisites are installed.)
2021-02-04tests: Add argument to trim output to a reasonable sizeJoão Valverde2-7/+21
The output of the "values" tshark glossary has over 1.3M lines. Writing this to stdout with some test failures is problematic in a number of ways. Also it's not helpful because stderr is written after stdout (not interleaved) so there is no output context to the error message. The error/warning message (from stderr, that triggered the test failure) needs to be sufficient to provide a good understaning of the test failure. The output is trimmed to first+last N lines. Some lines are kept as informational and because it may be useful if the program aborts. Fixes #17203.
2021-01-20dot11decrypt: Add partial FT-EAP decryption supportMikael Kanstrup3-0/+12
Add partial support for decrypting captures with connections established using FT-EAP. To support deriving keys for FT-EAP the MSK is needed. This change adds MSK as a valid IEEE 802.11 protocol input key type preference as well. Note that FT-EAP support comes with the following imitations: - Keys can only be derived from the FT 4-way handshake messages. - Roaming is not supported.
2021-01-20dot11decrypt: Support decrypting FT initial mobility domainMikael Kanstrup2-0/+11
Add partial support for decrypting captures with connections established using FT BSS Transition (IEEE 802.11r). FT BSS Transition decryption comes with the following limitations: - Only FT-PSK is supported. - Keys can only be derived from the FT 4-way handshake messages. - Roaming is not supported.
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-26 15:14:20 +0000