fix the SSL decryption using the master secret
this was broken in 21aa7168c7565445ee544ee78fb6c836a63cd4ed

to be on the safe side, we assue that return value >= 0 means success,
< 0 means failure

Change-Id: I1d03000e6b6d70fac6bef8766d28990d953c8e27
Reviewed-on: https://code.wireshark.org/review/609
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Add Export PDU Dialog (Wireshark Qt)

Rebase with last change and add Logcat export

Change-Id: Idc9b444b1bf14b95ff60e8466e94f7eecd875b47
Reviewed-on: https://code.wireshark.org/review/14
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Enhance VXLAN dissector

* Fix modelines (no CR after modelines)
* Add UDP Port (Attributed in draft 04 Port 4789)
* Update link to last draft (no specify change)

Change-Id: I4cd89719ae00eb64ce4c234c39b9e18cdc1b8b93
Reviewed-on: https://code.wireshark.org/review/613
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
Fix Bug 9872: 'SIP status line in 200 OK for de-registration is misleading'

The status line of the 200 OK during a deregistration is (1 bindings), but it
should be (0 bindings). Wireshark should check the "expires=0" in the contact
header not just count the number of the contact lines. But since it's not
truly valid to have expires=o contacts in responses, this commit adds expert
info warning of such.

Also, the REGISTER request itself already says "(remove all bindings)"
in the Info column currently if the Contact was a '*', but it didn't
say something similar if only de-registering one or more explicit
contacts. This has been fixed as well.

Lastly, this fixes three other bugs I found while reading the code and testing:
(1) comma-separated Contact headers will be displayed as a single one if
the first one(s) don't have header params but a subsequent one does; and
(2) the last Contact header param is displayed with the trailing '\r\n'
header separator; and (3) the SIP REGISTER response code displayed contact
binding info for responses other than 2xx, which isn't logical.

Since all of these are in the same area and not critical, I'm lumping these
all together.

A test capture file used for testing is attached to the bug.

As an aside, the SIP header parsing code needs to be refactored. Most SIP
headers follow a common ABNF pattern, and should be parsed using a common
function(s) so these issues don't crop up for specific headers.

Change-Id: I16c531fcb244dc121fc0e8046908e475b41489f9
Reviewed-on: https://code.wireshark.org/review/612
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Fix a trivial typo

Change-Id: Ibb2609b865ebaca14572c480d06ecc6ae7ef73f5
Reviewed-on: https://code.wireshark.org/review/614
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Fix Bug 9873: 'Qt: right-clicking on toolbars only shows checkmarks'

Add the text descriptions for the two toolbars: "Main Toolbar" and
"Display Filter", so the right-click context menu shows what you're
removing/adding. And add a View->Toolbar sub-menu, with checkable
"Main Toolbar" and "Display Filter" entries, which enable you to
show/hide the toolbars via the menu.

If someone has/prefers better names for these things, I'm all ears.

Change-Id: I55b9fbaed2ef6dca3260fa9dfdddd7dad95d05c4
Reviewed-on: https://code.wireshark.org/review/608
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Fix indent (Remove space and use tabs)

Change-Id: I9cc33a43e0f06dfad3f9fb53ad0df636f2ea7020
Reviewed-on: https://code.wireshark.org/review/615
Reviewed-by: Evan Huus <eapache@gmail.com>
Fix whitespace tabs to spaces, indent by 4, modelines

Change-Id: I8bb64a879d1aa779c9ac85db306cbd34d1188243
Reviewed-on: https://code.wireshark.org/review/617
Reviewed-by: Evan Huus <eapache@gmail.com>
MAC LTE: fix a typo in Buffer Size value_string

Change-Id: Ie38726fb51a74bbcdc630550e61fa0e934ffdd1e
Reviewed-on: https://code.wireshark.org/review/618
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Fix bug 9021: 'RTP not decoded inside the conversation in v.1.10.1'

The behavior for SIP/SDP handling of RTP conversation tracking
changed in v1.10, with some unintended consequences.  The bugs did not
show up at the time because wireshark makes 2 passes of the packet list,
and so the problems auto-corrected themselves in most cases.  Unfortunately,
a change in r53641 modified how UDP behaves, making it always create
conversations for UDP packets, and that exposed the bugs inherent in the
SIP/SDP code changes.

This commit reverts the behavior of SIP/SDP to its pre-1.10 model, but
creates a new preference setting for "Delay SDP changes for tracking media",
which if enabled, will turn on the new (but buggy) model introduced in 1.10.
This preference is *disabled* by default, since for a majority of cases the
new behavior is worse than the previous behavior.

The preference, and this commit's fix, is not intended to last long. I intend
to re-write the SIP/SDP/RTP interaction model for release 1.11 - I think it's
too big a change for 1.10, however, which is why I submitted this commit.

Change-Id: Ic5601749d6c2344e952ced8206dd9296bfdc4b90
Reviewed-on: https://code.wireshark.org/review/543
Reviewed-by: Evan Huus <eapache@gmail.com>
Add dissection of flags, status, flagsN for Omnipeek/Peek Remote dissector.

Information about value of flags from Emburey

Change-Id: Iba79fba8e95cd2fc80f6fba5fa937d5485fbb381
Closed-bugs: 9586
Reviewed-on: https://code.wireshark.org/review/595
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
Fix bug 9866: Qt 'Clearing filters does not seem to affect the packet list'

Clicking the "X" clear filter button now applies the clearing to the
displayed packet list.  This commit also adds tooltips for the display
filter display filter box's butons.

Change-Id: I827020a7705a32a4a9204d22e94942853e25bba6
Reviewed-on: https://code.wireshark.org/review/601
Reviewed-by: Evan Huus <eapache@gmail.com>
Consistently put -lm at the end of library lists.

I'm not sure why it's associated with GLIB_LIBS in most entries - at
some point, was it the case that we didn't use libmath routines but GLib
did? - but there's no guarantee that other libraries don't use them, so
put them at the end of the lists.  That also makes the lists a bit more
consistent.

(Yes, I know, the wireshark_ldadd list is followed by some other
libraries in the library lists that use it, so -lm isn't *really* at the
end everywhere.)

Change-Id: Ia2e0b295fdaae771fdee7d5eecdefaa83fae9992
Reviewed-on: https://code.wireshark.org/review/622
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Thou shalt not put newlines in the strings in value_string tables.

That just breaks too many things.

This catches the examples of that found in bug 9878.  There might be
others that my grepping didn't find.

We should also have the checkAPIs.pl script check for this, so this
isn't a full fix for bug 9878.

Change-Id: I3bf6f1fc0fe8654d0f54a995e72f1966ae012f5e
Reviewed-on: https://code.wireshark.org/review/623
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Get rid of space-before-tab in indentation.

Change-Id: If747e7b2af34e27ca8558293140a74691a0113b4
Reviewed-on: https://code.wireshark.org/review/624
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Get rid of $Id$, add some comments.

Change-Id: I3f34484f18fba45b23b5acc924b56e5b62291114
Reviewed-on: https://code.wireshark.org/review/627
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Add support for Aruba ERM Radio-Format

This adds support for a variant of the current Aruba ERM format,
a new format that provides rdio information. This addresses
enhancment bug 9880.

Change-Id: Ia38ff09d9f814193bdc544466dbd005123771262
Reviewed-on: https://code.wireshark.org/review/629
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Assorted cleanups of field names and descriptions.

The PeekRemote headers are 802.11, so "Dot80211" is redundant.

"Wep" really means "Protected" as there's also WPA/WPA2.

"FlagsN" means "802.11n", not "802.11ac", and the "n" in "flagsn"
indicates that.  Also, "Hz" stands for "Hertz", as in "Heinrich Hertz",
so the "H" is capitalized.

Change-Id: If46cc4859ae8d65a199c9ad1fd48d2f2128ccd3d
Reviewed-on: https://code.wireshark.org/review/630
Reviewed-by: Guy Harris <guy@alum.mit.edu>