aboutsummaryrefslogtreecommitdiffstats
path: root/test
AgeCommit message (Collapse)AuthorFilesLines
2021-07-12Carry EPB flags as an option on the packet blockDavid Perry1-1/+0
As requested by [this comment][1] on !2859, move `pack_flags` from a dedicated field in `wtap_rec` to a block option on the packet block in `wtap_rec.block`. [1]: https://gitlab.com/wireshark/wireshark/-/merge_requests/2859#note_615984624
2021-07-11wsutil: Start adding a test suiteJoão Valverde1-0/+6
2021-07-07Use wtap_blocks for packet commentsDavid Perry3-3/+1
Mostly functioning proof of concept for #14329. This work is intended to allow Wireshark to support multiple packet comments per packet. Uses and expands upon the `wtap_block` API in `wiretap/wtap_opttypes.h`. It attaches a `wtap_block` structure to `wtap_rec` in place of its current `opt_comment` and `packet_verdict` members to hold OPT_COMMENT and OPT_PKT_VERDICT option values.
2021-06-28Using col_append_sep_fstr() instead of prepending "NetPerfMeter" label.Thomas Dreibholz1-341/+341
2021-06-28NetPerfMeter display improvement:Thomas Dreibholz1-341/+341
Prepend protocol name "NetPerfMeter" with col_prepend_fence_fstr(), instead of overwriting the underlying Transport Layer protocol name.
2021-06-25Skip two protobuf dissector tests when LUA is not availableVasil Velichkov1-0/+4
Both tests are using LUA scripts and both fails when it is not avialble.
2021-06-21Lua: reconcile expert info groups; add PI_ASSUMPTIONChuck Craft1-0/+3
2021-06-21solved code conflicts pre rebasePaul Offord1-163/+276
2021-06-20tests: Remove duplicate testJoão Valverde1-6/+0
2021-06-14wslog: Update test suiteJoão Valverde1-1/+1
2021-06-09Updated unit test with relative sequence numbers.Thomas Dreibholz1-90/+90
2021-06-04file-pcapng: redo the way we dissect the data in blocks.Guy Harris1-2/+5
Create a tvbuff that covers the data portion of a block, and use that to dissect all data in the block, including but not limited to the options. Catch ReportedBoundsError exceptions and treat them as an indication that the block length was too short - add an expert info to the block length item indicating that. Have separate routines for each block type that dissects the data in that block type. While we're at it, check whether the trailing block length is equal to the header block length and, if not, report an error in the trailing block length. Fix the tests to match.
2021-06-04SCTP: Display basic TSN information with packetsThomas Dreibholz1-90/+90
2021-03-26Lua: add DissectorTable.try_heuristics() functionDaniel Dulaney2-0/+65
Add DissectorTable.try_heuristics(name, tvb, pinfo, tree). Previously, there was no way for a Lua plugin to run an existing heuristic dissector. Based on Gerrit change 18718. Closes #17220.
2021-03-25test: add missing raw string regex identifier.Dario Lombardo1-2/+2
2021-03-21dfilter, ftypes: get rid of FT_PCRE.Guy Harris1-1/+0
It's not a valid field type, it's only a hack to support regular expression matching in packet-matching expressions. Instead, in the packet-matching code, have a separate syntax tree type for Perl-compatible regular expressions, and a separate instruction to load one into a register, and have the "matching" operator for field types take a GRegex * as the second argument.
2021-03-16ieee80211: Support decrypting Fast BSS Transition with roamingMikael Kanstrup2-4/+30
Support decrypting captures with Fast BSS Transition roaming present by now also scanning (re)association frames for relevant information elements and feeding it into the dot11decrypt engine. Both (re)association request and response frames are scanned to allow for potentially missing one frame and still be able to derive PTKs needed for successful decryption. Closes #17145 Change-Id: I08436582e4f83695dc606ddb92ff442d6258ef9b
2021-03-11Qt: Copy->Value - don't zero pad hex valuesChuck Craft5-57/+57
Closes #17276 Update test scripts and datafiles for corrected output format.
2021-03-07NetPerfMeter: Drop "protocol" from the nameJoão Valverde1-346/+346
2021-03-04Replaced large NetPerfMeter captures by one small capture.Thomas Dreibholz5-83/+383
Changes: * Replaced large netperfmeter-dccp.pcapng.gz and netperfmeter.pcap.gz captures by one common small netperfmeter.pcapng.gz for the suites follow_dccp and netperfmeter. * Updated test suites "follow_dccp" and "netperfmeter".
2021-02-26tests: skip plugin count test if feature is disabledJoão Valverde2-1/+4
2021-02-22Added "Follow DCCP stream" feature.Thomas Dreibholz2-0/+71
This pull request includes: * The "Follow DCCP stream" feature. * Updated docbook documentation for the "Follow DCCP stream" feature. * Test for the feature. * Corresponding packet trace for the test.
2021-02-21Added NetPerfMeter test suite.Thomas Dreibholz1-0/+151
2021-02-21Added NetPerfMeter test trace.Thomas Dreibholz1-0/+0
2021-02-20tests: Look for softhsm2 in more placesJohn Thacker1-4/+4
Fedora and RHEL/CentOS put libsofthsm2.so in a different location than Debian/Ubuntu, so look there too. This causes test_tls_pkcs11 to pass instead of being skipped (if softhsm2 and the other prerequisites are installed.)
2021-02-04tests: Add argument to trim output to a reasonable sizeJoão Valverde2-7/+21
The output of the "values" tshark glossary has over 1.3M lines. Writing this to stdout with some test failures is problematic in a number of ways. Also it's not helpful because stderr is written after stdout (not interleaved) so there is no output context to the error message. The error/warning message (from stderr, that triggered the test failure) needs to be sufficient to provide a good understaning of the test failure. The output is trimmed to first+last N lines. Some lines are kept as informational and because it may be useful if the program aborts. Fixes #17203.
2021-01-20dot11decrypt: Add partial FT-EAP decryption supportMikael Kanstrup3-0/+12
Add partial support for decrypting captures with connections established using FT-EAP. To support deriving keys for FT-EAP the MSK is needed. This change adds MSK as a valid IEEE 802.11 protocol input key type preference as well. Note that FT-EAP support comes with the following imitations: - Keys can only be derived from the FT 4-way handshake messages. - Roaming is not supported.
2021-01-20dot11decrypt: Support decrypting FT initial mobility domainMikael Kanstrup2-0/+11
Add partial support for decrypting captures with connections established using FT BSS Transition (IEEE 802.11r). FT BSS Transition decryption comes with the following limitations: - Only FT-PSK is supported. - Keys can only be derived from the FT 4-way handshake messages. - Roaming is not supported.
2020-12-27Protobuf: fix bugs that parsing complex syntax .proto filesHuang Qiangxiong5-0/+801
Some .proto files contain complex syntax that does not be described in protobuf official site (https://developers.google.com/protocol-buffers/docs/reference/proto3-spec). 1. Update 'epan/protobuf_lang_parser.lemon' to: 1) Support complex option names format (EBNF): optionName = ( ident | "(" fullIdent ")" ) { "." ( ident | "(" fullIdent ")" ) } for example, "option (complex_opt2).(grault) = 654;". 2) Make enum body support 'reserved' section (EBNF): enumBody = "{" { reserved | option | enumField | emptyStatement } "}" 3) Allow the value of field or enumValue option to be "{ ... }" other than constant: enumValueOption = optionName "=" ( constant | customOptionValue ) ";" fieldOption = optionName "=" ( constant | customOptionValue ) ";" 4) Allow 'group' section missing 'label' (for example, in 'oneof' section). 5) Make 'oneof' section support 'option' and 'group' sections (BNF): oneof = "oneof" oneofName "{" { oneofField | option | group | emptyStatement } "}" 6) Ignore unused 'extend' section. 7) Fix the bug of one string being splitted into multi-lines. 2. Update 'epan/protobuf_lang_tree.c' to: 8) Fix the bug of parsing repeated option. 3. Update 'test/suite_dissection.py' to add test case for parsing complex syntax .proto files: test/protobuf_lang_files/complex_proto_files/unittest_custom_options.proto test/protobuf_lang_files/complex_proto_files/complex_syntax.proto and dependency files: test/protobuf_lang_files/well_know_types/google/protobuf/any.proto test/protobuf_lang_files/well_know_types/google/protobuf/descriptor.proto Refer to issue #17046
2020-12-08Lua: Add get_preference() and set_preference() utility functions.Stig Bjørlykke2-0/+127
Support uint, bool, enum, string, range, filename and directory preferences. Added apply_preferences() to write to file and apply changes.
2020-12-02Lua: make TvbRange:raw() return a subset #12046 v2David Perry1-1/+95
My initial fix caused several double-offset errors in TvbRange_raw() because I was adjusting for the TvbRange's offset too early in the process. The proper fix is to only adjust for it in the final call to get the data. I also simplified some of the bounds checks to be based on the values in the TvbRange instead of calling `tvb_captured_length()` and the like, because its bounds are already checked against the backing Tvb when it's first taken. Massively expanded the lua test suite to account for every combination of passing offsets and lengths to a Tvb or TvbRange and to the subsequent `:raw()` call.
2020-12-01Protobuf/gRPC: add test cases for Protobuf and gRPCHuang Qiangxiong17-0/+382
Add case_dissect_protobuf and case_dissect_grpc in test/suite_dissection.py. Add *.proto into the sub directories of test/protobuf_lang_files/. Run command like 'pytest --program-path .\run\Debug\ -k "grpc or protobuf"' in build directory (in windows) to test these cases only.
2020-11-21Avoid python deprecation warningJaap Keuter1-1/+1
Fixes ad69ec2e118cbe23230378f2895416ceee398f9b
2020-11-19QT+epan: Set FI_BITS_OFFSET and FI_BITS_SIZE flags on [u]ints and bitmasksJohn Thacker2-12/+12
Set the FI_BITS_OFFSET and FI_BITS_SIZE flags appropriately on [u]int[64] (and thus chars and booleans) where the bitmask is passed in on the header_field_info. Also set the flags on bitmask items by ORing the bitmasks from the constituent fields. These flags are only used right now in the packet diagram. This makes the packet diagram display those types of fields correctly without having to use proto_item_set_bits_offset_len(), so long as the bitmask is correct and the field width of the type matches the octet length. (If it doesn't match, that's a dissector bug.) split bit items are a more complicated case and still not handled correctly.
2020-11-05Tools+test: Call python3 explicitly.Gerald Combs25-32/+4
PEP 394[1] says, "In cases where the script is expected to be executed outside virtual environments, developers will need to be aware of the following discrepancies across platforms and installation methods: * Older Linux distributions will provide a python command that refers to Python 2, and will likely not provide a python2 command. * Some newer Linux distributions will provide a python command that refers to Python 3. * Some Linux distributions will not provide a python command at all by default, but will provide a python3 command by default." Debian has forced the issue by choosing the third option[2]: "NOTE: Debian testing (bullseye) has removed the "python" package and the '/usr/bin/python' symlink due to the deprecation of Python 2." Switch our shebang from "#!/usr/bin/env python" to "#!/usr/bin/env python3" in some places. Remove some 2/3 version checks if we know we're running under Python 3. Remove the "coding: utf-8" in a bunch of places since that's the default in Python 3. [1]https://www.python.org/dev/peps/pep-0394/#for-python-script-publishers [2]https://wiki.debian.org/Python
2020-10-21dot11decrypt: Fix WEP decryptionMikael Kanstrup3-0/+11
For WPA security association (SA) entries are created on sucessful PTK derivation from 4-way handshake frames. WEP though don't use 4-way handshake frames for key derivation and therefore no SA entry is created. Still WEP decryption implementaton expects to find an SA otherwise the decryption is skipped. Fix broken WEP decryption by removing the check for an existing SA entry and instead form the SA on first successful decryption. Add also a test for WEP decryption. Fixes: v3.3.0rc0-1263-g099d241046 ("dot11decrypt: Avoid allocating SA on packet decryption")
2020-10-19Lua: base64_decode: handle unpadded dataDavid Perry1-1/+7
As noted in bug #16386, glib's `g_base64_decode_inplace()` aborts decoding of base64 strings that aren't padded. This addresses that by adding padding "=" characters if needed to the buffer which will be decoded. I added the test case from the bug report to the test suite, though the location therein may not be ideal. Closes #16386
2020-10-02Clean up URLs.Guy Harris2-6/+5
Add ui/urls.h to define some URLs on various of our websites. Use the GitLab URL for the wiki. Add a macro to generate wiki URLs. Update wiki URLs in comments etc. Use the #defined URL for the docs page in WelcomePage::on_helpLabel_clicked; that removes the last user of topic_online_url(), so get rid of it and swallow it up into topic_action_url().
2020-09-26Fix issues discovered by common python lintersJeff Widman4-5/+5
Fix some issues discovered by common python linters including: * switch `None` comparisons to use `is` rather than `==`. Identity != equality, and I've spent 40+ hours before tracking down a subtle bug caused by exactly this issue. Note that this may introduce a problem if one of the scripts is depending on this behavior, in which case the comparison should be changed to `True`/`False` rather than `None`. * Use `except Exception:` as bare `except:` statements have been discouraged for years. Ideally for some of these we'd examine if there were specific exceptions that should be caught, but for now I simply caught all. Again, this could introduce very subtle behavioral changes under Python 2, but IIUC, that was all fixed in Python 3, so safe to move to `except Exception:`. * Use more idiomatic `if not x in y`--> `if x not in y` * Use more idiomatic 2 blank lines. I only did this at the beginning, until I realized how overwhelming this was going to be to apply, then I stopped. * Add a TODO where an undefined function name is called, so will fail whenever that code is run. * Add more idiomatic spacing around `:`. This is also only partially cleaned up, as I gave up when I saw how `asn2wrs.py` was clearly infatuated with the construct. * Various other small cleanups, removed some trailing whitespace and improper indentation that wasn't a multiple of 4, etc. There is still _much_ to do, but I haven't been heavily involved with this project before, so thought this was a sufficient amount to put up and see what the feedback is. Linters that I have enabled which highlighted some of these issues include: * `pylint` * `flake8` * `pycodestyle`
2020-09-26SMB2: add tests for chained compression and pattern_v1Aurelien Aptel2-0/+16
2020-09-17Test: Normalize the line endings everywhere.Gerald Combs1-6/+3
Convert CRLF to LF in subprocess output everywhere, not just on Windows. Note that we normalize output in the Developer's Guide.
2020-09-16Test: Normalize the line endings of subprocess output.Gerald Combs4-10/+13
On Windows, replace CRLF line endings in subprocess output with LFs. Stop doing so in individual tests.
2020-09-16A Community ID implementation for Wireshark.Christian Kreibich4-0/+147
This adds a protocol post-dissector for Community ID support to Wireshark/tshark: https://github.com/corelight/community-id-spec The protocol is disabled by default. It establishes one new filter value, "communityid". Includes test cases and baselines to verify correct Community ID strings based on similar testsuites in the existing Zeek and Python implementations.
2020-09-16Update our issue tracker URL in some places.Gerald Combs2-9/+9
Replace bugs.wireshark.org links with their equivalent gitlab.com/wireshark/wireshark/issues links in the AsciiDoctor buglink macro and the please_report_bug function. Update the bug URLs in comments in the tools and test directories.
2020-08-10Qt: Add a packet diagram view.Gerald Combs3-12/+13
Add a new top-level view that shows each packet as a series of diagrams similar to what you'd find in a networking textook or an RFC. Add proto_item_set_bits_offset_len so that we can display some diagram fields correctly. Bugs / to do: - Make this a separate dialog instead of a main window view? - Handle bitfields / flags Change-Id: Iba4897a5bf1dcd73929dde6210d5483cf07f54df Reviewed-on: https://code.wireshark.org/review/37497 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-07-08Test: Remove an unused routine.Gerald Combs1-11/+0
dump_failed_output didn't do anything, so remove it. Change-Id: If2c1c48ff38987bcd535e95585784eb9981a0f4e Reviewed-on: https://code.wireshark.org/review/37752 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-06-01dot11decrypt: Support decryption using TK user inputMikael Kanstrup3-0/+118
Add support for TK user input keys. With this Wireshark can decrypt packet captures where 4WHS frames are missing and packet captures with non-supported AKMS, for example 802.11r / Fast BSS Transitioning. Decryption using user TK works as a backup if the normal decryption flow does not succeed. Having TK decryption keys added will affect general IEEE 802.11 dissector performance as each encrypted packet will be tested with every TK. Worst case scenario is plenty of TKs where none of them matches encrypted frames. On successful user TK decryption an SA is formed based on parameters used to decrypt the frame. This SA is similar to what is formed when Wireshark detects and derive keys from 4WHS messages. With the SA entry in place the decryption performance (success case) should be on par with "normal" decryption flow. Bug: 16579 Change-Id: I72c2c1e2c6693131d3ba07f8ddb8ff772c1b54a9 Reviewed-on: https://code.wireshark.org/review/37217 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-05-09sll: add support for LINKTYPE_LINUX_SLL2.Guy Harris1-1/+1
Different header, with a different size, an additional field, and with fields being in a different order. Distinguish between V1 and V2 by giving the version. That means we can no longer use the "ethertype" dissector as it stands, because the packet type field isn't at the end of the header, right before the payload; pull the "add the type field to the protocol tree" functionality out of the "ethertype" dissector and leave it up to the dissector calling it. Change-Id: I72b8a2483c0a539919fbe5d35fd7e60bff4bf75a Reviewed-on: https://code.wireshark.org/review/37169 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2020-04-11test: fix invalid escape sequence warningsPeter Wu1-4/+4
pytest and `pycodestyle test/suite_*.py --select=W605` warned about it. Change-Id: I015351d1c00d17aa9f04ab17abed00586ee09e89 Reviewed-on: https://code.wireshark.org/review/36771 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2020-03-23dot11decrypt: Fix decryption of MFP enabled connectionsMikael Kanstrup2-0/+13
MFP enabled connections with SHA-256 key management (IEEE 802.11w) use EAPOL key version == 3. This case was missing making decryption of such connections fail. Allow key version 3 to handle these too. Change-Id: If9e3fcc5c3bbfb46e82b39dfed5b2a74787a4f16 Reviewed-on: https://code.wireshark.org/review/36534 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-13 01:07:08 +0000