Commit Graph

54 Commits

Author SHA1 Message Date
João Valverde 71cfbd81b3 Remove wspcap.h and use config.h instead
Forcing the use of a dedicated header to replace pcap.h is
unnecessary code and mental overhead in this case. We can
use config.h instead for the same purpose of defining a
macro symbol before including pcap.h.
2023-02-06 15:05:36 +00:00
João Valverde ab0d190450 CMake: Fix libnl unused link dependencies 2023-02-06 15:04:46 +00:00
João Valverde d70e174ca0 Remove wsutil/netlink.h workaround 2023-02-06 15:04:46 +00:00
João Valverde b07ab25a1c CMake: Cleanup unnecessary linking with shared libraries 2023-02-06 15:04:46 +00:00
Gerald Combs 894e8c46c6 Revert "Enable rpathification and working relocation on Linux"
This reverts commit 7a346c398a.
2023-01-30 22:30:56 +00:00
João Valverde 7a346c398a Enable rpathification and working relocation on Linux
Dumpcap depends on The path to the shared library
is encoded in the RPATH (or RUNPATH) property of ELF binaries.
This is currently an absolute path on most Unixy systems.

Dumpcap could not be made to work with a relative RPATH because it
uses elevated privileges and some loaders will ignore relative
RPATHs and non-standard paths under those circumstances, because of
(justified) security concerns.

To enable relocation of the program we link dumpcap statically
with wsutil instead.

This provides a fully working relocatable installation on Linux
and other platforms that support relative RPATHs.
2023-01-29 23:38:00 +00:00
João Valverde dfc992466e MinGW: Fix -Wstrict-aliasing
capture-pcap-util.c:561:23: error: dereferencing type-punned pointer will break strict-aliasing rules [-Werror=strict-aliasing]
  561 |                     *((guint32 *)&(ai->sin_addr.s_addr));
      |                      ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-01-13 22:41:04 +00:00
João Valverde b487b7fcfe MinGW: Fix -Wparentheses 2023-01-13 22:41:04 +00:00
João Valverde 846056cf46 MinGW: Fix -Wunused-function 2023-01-13 22:41:04 +00:00
João Valverde 10d197c64d MinGW: Fix -Wstrict-prototypes 2023-01-13 22:41:04 +00:00
João Valverde d902cabd3f MinGW: Fix -Wformat 2023-01-13 15:48:03 +00:00
João Valverde f2218ae5f0 Lemon: Update code and remove cruft
Remove some unused historical files.

Aggressively disable warnings to keep the lemon source
pristine and avoid the maintenance burden for lemon itself.

Lemon has its own lax policy for warnings that doesn't match our
own and they won't accept external patches to remove the
warnings, so just ignore them. Lemon is just executed to generate
code for the Wireshark build and the minor code issues it has
have no influence at runtime.

For lemon generated code we selectively disable some linting

Remove patches for lemon and lempar, they are no longer required
with these changes to silence warnings.
2023-01-01 18:18:06 +00:00
Guy Harris 13f3ebc4e5 Add a routine to get the path of an executable given the program name.
That reduces the number of get_progfile_dir() calls, leaving only the
calls that are done either to 1) get the pathname in order to display it
or 2) get the pathname in order to reset the library path.

That makes it easier to figure out which get_progfile_dir() calls are
made to find the directory in which (non-extcap) binaries from Wireshark
are installed and which - if any - are made to figure out the directory
in which *the currently-running executable* are stored.  (Currently,
get_progfile_dir() attemps to get the former, not the latter, so
extcaps in an extcap subdirectory, for example, will get the parent
directory of that subdirectory, *not* the directory in which they weere
2022-12-23 23:20:22 +00:00
Gerald Combs fd92228e54 capture: Remove an unused variable.

capture/ws80211_utils.c:328:6: error: variable 'bandidx' set but not used [-Werror,-Wunused-but-set-variable]
        int bandidx = 1;
2022-11-07 11:24:27 -08:00
Tomasz Moń 0e7c240897
capture: Convert sync pipe to GIOChannel
Reduce the amount of platform specific Wireshark code by using
GIOChannel watch, i.e. do not use UNIX specific GLib functionality and
do not peek into pipe every 100 ms on Windows.
2022-10-23 13:17:10 +02:00
Gerald Combs 74ec0f0816 Qt+extcap: Make our capture error dialog less noisy.
Strip the timestamps and function names from extcap errors before
displaying them in a dialog. This keeps us from spewing

Error by extcap pipe: ** (falcodump:24913) 15:08:20.263535 [falcodump
WARNING] extcap/falcodump.cpp:593 -- main(): cloudtrail plugin error:
failed to list objects: ExpiredToken: The provided token has expired.
status code: 400, request id: M2PYJOT4JGVAA6B9, host id:

at the user.

Check for warning messages and set our dialog type accordingly.
2022-09-08 10:20:48 -07:00
Tomasz Moń c6ef99f006
win32-utils: Explicitly list inherited handles
Windows processes inherit all inheritable handles when a new process is
created using CreateProcess() with bInheritHandles set to TRUE. This can
lead to undesired object lifetime extension. That is, the child process
will keep ineritable handles alive even if it does not use them. Up to
Windows Vista it was not possible explicitly list handles that should be
inherited. Wireshark no longer works on Windows releases earlier than
Vista, so use the new API without checking Windows version.

Require all callers to win32_create_process() to pass in the list of
handles to inherit. Set the listed handles as inheritable shortly before
calling CreateProcess() and set them as not inheritable shortly after
the process is created. This minimizes possibility for other callers
(especially in 3rd party libraries) to inherit handles by accident.

Do not terminate mmdbresolve process on exit. Instead rely on process
exit when EOF is received on standard input. Previously the EOF was
never received because mmdbresolve inherited both ends of standard input
pipe, i.e. the fact that Wireshark closed the write end was not observed
by mmdbresolve because mmdbresolve kept write handle the standard input
pipe open.
2022-08-16 20:53:22 +02:00
Tomasz Moń d0a9de2af1
capture: Stop extcaps before dumpcap
Send SIGTERM on UNIX systems to all extcap processes when user requests
capture stop. Wait up to 30 seconds for extcaps to finish. If extcaps do
not finish in time, send SIGKILL to remaining extcaps.

Do not call TerminateProcess() on Windows in the same place where UNIX
SIGTERM is sent. Instead schedule extcap termination timeout to happen
as soon as control returns back to the event loop.

There is no universally agreed replacement for SIGTERM on Windows, so
just keep things simple (forcefully terminate like always) until we
have agreed on something.
2022-08-13 20:23:51 +02:00
Tomasz Moń 0bca2419d6
extcap: Do not drain stderr on process exit
Extcap child watch callback assumed that the stderr pipe is broken.
However the stdout and stderr pipes are not necessarily broken if the
child process spawned new processes that inherited standard handles.

Do not drain stderr in busy loop to prevent UI freeze. Stop capture
session only when all extcap watches are removed. Remove stdout and
stderr watches on capture stop timer (30 seconds) expiration, even if
the pipes are not broken.

Do not rely only on 0 bytes read to cease reading stdout and stderr.
Stop reading if the status is anything else than G_IO_STATUS_NORMAL
(especially it can be G_IO_STATUS_EOF).
2022-08-12 06:50:09 +02:00
Tomasz Moń 7316b16e1d
extcap: Read stdout and stderr during capture
Read extcap stdout/stderr data when available to prevent extcap hang on
stdout/stderr write. Discard stdout data as it was not used earlier.
Store up to 1024 bytes of stderr and display it to user after capture

Fixes #17827
2022-08-10 06:18:25 +02:00
Tomasz Moń c1861ad1cc
extcap: Close capture session after extcap finishes
Wait up to 30 seconds for extcap process to finish after closing pipes.
The wait is achieved in non-blocking fashion, i.e. the UI is completely
responsive during the wait. Only actions related to capture process like
capture control, file open, save, export are inactive during the wait.

On Windows extcap child watch callback gets called immediately as the
process is forcefully terminated. Prior to this change the extcap was
forcefully terminated on Windows anyway.

The wait is possible on UNIX systems if extcap does handle SIGPIPE and
SIGTERM signals. The defaults handlers for SIGPIPE and SIGTERM simply
terminate the process so for large number of extcaps there is no change.
If extcap does not finish within 30 seconds, it is forcefully terminated
using SIGKILL signal.
2022-08-10 06:18:15 +02:00
Tomasz Moń 2d1380ae5b
capture: Move capture pipe polling out of UI
Both CLI and Qt interfaces spin GLib mainloop. Move the capture pipe
polling into common code to reduce code duplication.
2022-07-30 16:42:12 +02:00
Tomasz Moń df7f3e76b5 tshark: Run GLib mainloop during capture
Use the timer polling approach on Windows. GLib timer callbacks execute
in main thread. Remove useless mutex as there is no point in protecting
resources if only can thread can access the resources. Simply wait on
capture child handle instead of periodically checking process state.

On Unix systems, register the pipe fd for polling inside GLib mainloop.
2022-07-28 17:42:11 +00:00
Tomasz Moń 1323544f65 Win32: Fix child process pipe handle leaks
Close pipe handles when spawning asynchronous processes, so only the
child process holds handle to the other end of the pipe. Closing the
handles makes it possible to use pipes the same way as on other OS, that
is to rely on blocking read() to end when child process finishes.

Do not call CloseHandle() on signal pipe in capture sync after the
handle ownership was transferred to file descriptor. Close the file
descriptor instead.
2022-07-16 14:55:22 +00:00
Gisle Vanem 992e9f93aa Revert "A small for for the Doxygen warning:"
This reverts commit 2faa7bc3132a4a0b5679231f2f9ac5a988d45084
2022-06-20 09:56:54 +00:00
Gisle Vanem 1aa9a52a44 A small for for the Doxygen warning:
capture/airpcap.h:906: warning: end of file while inside a group

Since the syntax should be `/**@}*/` (or `/*!@}*/` works too.
2022-06-20 09:56:54 +00:00
João Valverde 8cd49b2da0 dumpcap: Fix a TODO for Npcap test 2022-02-24 21:15:51 +00:00
João Valverde ac6cbbcda3 Windows: Fix build
For some reason this was not caught by the CI.
2022-02-24 20:29:04 +00:00
David Perry e2fab18853 wsutil: New API to gather compile/runtime info 2022-02-24 13:27:08 +00:00
David Perry fc3f061829 Differentiate `-c` from `-a packets:` 2022-02-11 01:54:53 +00:00
David Perry 1e0d117eb7 Specify directory for temporary captures 2022-02-09 14:32:28 +00:00
Gerald Combs c65f0a5a15 Update our Npcap URLs.
The official Npcap web site is now Update our URLs
to match. Fixes #17838.
2022-01-06 16:12:30 -08:00
Moshe Kaplan 69d54d6f8e Corrects repeated words throughout the code.
Repeated words were found with:
egrep "(\b[a-zA-Z]+) +\1\b" . -Ir
and then manually reviewed.
Non-displayed strings (e.g., in comments)
were also corrected, to ease future review.
2021-12-22 11:01:11 +00:00
João Valverde 0ccd69e530 Replace g_strdup_printf() with ws_strdup_printf()
Use macros from inttypes.h.
2021-12-19 21:21:58 +00:00
João Valverde fe5248717f Replace g_snprintf() with snprintf()
Use macros from inttypes.h with format strings.
2021-12-19 20:06:13 +00:00
Moshe Kaplan 65a651d5b9 capture: Add header files to Doxygen
Add @file markers for capture
headers so that Doxygen will
generate documentation for them.

Additionally, update the doxygen
config file per
merging the caputils and capchild
2021-11-30 06:27:26 +00:00
João Valverde edf1e72d0c capture: Lower log level for debug output 2021-11-16 12:47:54 +00:00
João Valverde 59c082c046 Add new global header wireshark.h with guideline
Remove ws_diag_control.h from config.h because that was a workaround
for the lack of a public global header. Fix the resultant build errors.
2021-10-22 06:41:44 +00:00
João Valverde 443f05bc92 Windows: Fix build without libpcap
wireshark\capture\capture-wpcap.c:901:42: error: expected ';', ',' or ')' before '_U_'
 get_runtime_caplibs_version(GString *str _U_)
2021-09-23 12:17:20 +01:00
Juha Takala 8bc52f542b Add tshark ringbuffer option '-b nametimenum:value'
This is used to select ringbuffer savefile name template.  Choose one of two
savefile name templates:

If value is 1, make running file number part before start time part; this is
the original and default behaviour (e.g. log_00001_20210828164426.pcap).

If value is greater than 1, make start time part before running number part
(e.g. log_20210828164426_00001.pcap).

The latter makes alphabetical sortig order equal to creation time order, and
keeps related multiple file sets in same directory close to each other (e.g.
while browsing in wireshark "Open file" dialog).

Signed-off-by: Juha Takala <>
2021-09-14 04:52:09 +00:00
Guy Harris 0a9ef601d2 Clean up handling of --capture-comment.
Don't store the comments in a capture_options structure, because that's
available only if we're being built with capture support, and
--capture-comment can be used in TShark when reading a capture file and
writing another capture file, with no live capture taking place.

This means we don't handle that option in capture_opts_add_opt(); handle
it in the programs that support it.

Support writing multiple comments in dumpcap when capturing.

These changes also fix builds without pcap, and makes --capture-comment
work in Wireshark when a capture is started from the command line with

Update the help messages to indicate that --capture-comment adds a
capture comment, it doesn't change any comment (much less "the" comment,
as there isn't necessarily a single comment).

Update the man pages:

- not to presume that only pcapng files support file comments (even if
that's true now, it might not be true in the future);
- to note that multiple instances of --capture-comment are supported,
and that multiple comments will be written, whether capturing or reading
one file and writing another;
- clarify that Wireshark doesn't *discard* SHB comments other than the
first one, even though it only displays the first one;
2021-07-15 05:43:36 +00:00
David Perry 67b54e8b66 tshark: allow --capture-comment when reading a file
Allows adding one or more capture comments to a new pcapng file when
tshark is reading from a file. Currently, tshark only allows setting one
capture comment, and that only when doing a live capture.

The use case for this feature is given in bug #15005.
I decided to allow multiple capture comments to match the same ability
in `editcap`.

To allow this change, I changed the function signature of
`process_cap_file()` so it takes a `capture_options` struct instead of
individual parameters that affect the capture.
2021-07-14 04:34:52 +00:00
Gerald Combs ff60fcf92d CMake: Adjust wsutil includes and linking.
Mark wsutil's includes SYSTEM PRIVATE. This exposed a lot of targets
that were indirectly picking up include paths via the wsutil target, so
add direct includes where needed. The G.722 and G.726 codecs were
implicilty including tiffio.h; find it explicitly instead.

Mark some of wsutil's libraries PRIVATE, but leave commonly-used ones

Ping #17477.
2021-07-14 03:56:05 +00:00
Guy Harris 6d9b0646d8 If opening a capture device provides a warning, show it.
We start the capture anyway, but print a warning message or pop up a
warning dialog first.
2021-06-23 02:31:31 -07:00
João Valverde 7dea683bf1 wslog: Shorten ws_log_message_is_active() name 2021-06-21 00:07:21 +00:00
João Valverde 0e50979b3f Replace g_assert() with ws_assert() 2021-06-19 01:23:31 +00:00
João Valverde a6738d72a0 wslog: Add support for inverted debug matches
The --log-debug and --log-noisy now accepts a '!' to invert the
match and disable the debug (noisy respectively) log level for
the listed domains.

Note this is different from --log-domains, that option
enables/disables the entire log domain itself, regardless of log
2021-06-18 10:43:39 +01:00
João Valverde dd78347a7e capture: Lower priority for some status messages 2021-06-14 22:05:35 +00:00
João Valverde dc7f0b88bb Refactor our logging and extend the wslog API
Experience has shown that:

  1. The current logging methods are not very reliable or practical.
A logging bitmask makes little sense as the user-facing interface (who
would want debug but not crtical messages for example?); it's
computer-friendly and user-unfriendly. More importantly the console
log level preference is initialized too late in the startup process
to be used for the logging subsystem and that fact raises a number
of annoying and hard-to-fix usability issues.

  2. Coding around G_MESSAGES_DEBUG to comply with our log level mask
and not clobber the user's settings or not create unexpected log misses
is unworkable and generally follows the principle of most surprise.
The fact that G_MESSAGES_DEBUG="all" can leak to other programs using
GLib is also annoying.

  3. The non-structured GLib logging API is very opinionated and lacks
configurability beyond replacing the log handler.

  4. Windows GUI has some special code to attach to a console,
but it would be nice to abstract away the rest under a single

  5. Using this logger seems to be noticeably faster.

Deprecate the console log level preference and extend our API to
implement a log handler in wsutil/wslog.h to provide easy-to-use,
flexible and dependable logging during all execution phases.

Log levels have a hierarchy, from most verbose to least verbose
(debug to error). When a given level is set everything above that
is also enabled.

The log level can be set with an environment variable or a command
line option (parsed as soon as possible but still later than the
environment). The default log level is "message".

Dissector logging is not included because it is not clear what log
domain they should use. An explosion to thousands of domains is
not desirable and putting everything in a single domain is probably
too coarse and noisy. For now I think it makes sense to let them do
their own thing using g_log_default_handler() and continue using the
G_MESSAGES_DEBUG mechanism with specific domains for each individual

In the future a mechanism may be added to selectively enable these
domains at runtime while trying to avoid the problems introduced
2021-06-11 09:40:28 +00:00
João Valverde 9dbe29e2ec Minor style change to libpcap version string 2021-05-27 17:40:01 +00:00