ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 1503] SSLv2 record length and version shown wrong

Date: Sun, 1 Apr 2007 20:35:24 +0000 (GMT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1503





------- Comment #2 from sake@xxxxxxxxxx  2007-04-01 20:35 GMT -------
Created an attachment (id=600)
 --> (http://bugs.wireshark.org/bugzilla/attachment.cgi?id=600&action=view)
fix-bug1503.patch

This patch "fixes" the following:

- changed hf_ssl_handshake_client_version and hf_ssl_handshake_server_version
to hf_ssl_handshake_version. Since both were added with the field
ssl.handshake.version, it was only possible to filter on the first one
registered (which was hf_ssl_handshake_client_version). Now
ssl.handshake.version shows both client and server handshake messages

- changed dissect_ssl2_hnd_client_hello to use hf_ssl_handshake_version instead
of hf_ssl_record_version. SSLv2 client hello's did not display when the filter
ssl.handshake.version == 0x0002 was used, only SSLv2 server hello's were
displayed. Now they are both displayed

- Added generated hf_ssl_record_version to SSLv2 handshake. Since the SSLv2
does not include a record layer version field (unlike SSLv3), this field is
generated so that all packets with a SSLv2 record layer can be filtered out.
[this is actually what bug 1503 was all about]

- changed hf_ssl2_record to hf_ssl_record. Both hf_ssl2_record and
hf_ssl_record pointed to the field ssl.record, which resulted in only SSLv3
packets being shown with the filter ssl.record (because hf_ssl_record was
registered first).


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.