Commit Graph

46 Commits

Author SHA1 Message Date
David Perry 70d432c357 Remove editor modelines and .editorconfig exceptions from root files 2022-02-20 19:39:37 +00:00
Guy Harris ce20c00049 Remove unnecessary inclues of wiretap/pcapng.h. 2021-03-15 15:29:40 -07:00
Guy Harris 20800366dd HTTPS (almost) everywhere.
Change all URLs to use https.

Fix some broken links while we're at it.

Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c
Reviewed-by: Guy Harris <>
2019-07-26 18:44:40 +00:00
Dario Lombardo 8cd389e161 replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.
The first is deprecated, as per

Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed
Petri-Dish: Anders Broman <>
Petri-Dish: Dario Lombardo <>
Reviewed-by: Anders Broman <>
2018-02-08 14:57:36 +00:00
Guy Harris ccc55bc80c Put the structure of a capture_file back in cfile.h.
The split isn't necessary now that epan no longer uses the capture_file

Change-Id: Ia232712a2fb5db511865805518e8d03509b2167f
Reviewed-by: Guy Harris <>
2017-12-04 05:35:36 +00:00
Guy Harris 1834dca365 Move the parts of a capture_file used by libwireshark to a new structure.
Embed one of those structures in a capture_file, and have a struct
epan_session point to that structure rather than to a capture_file.
Pass that structure to the routines that fetch data that libwireshark
uses when dissecting.

That separates the stuff that libwireshark expects from the stuff that
it doesn't look at.

Change-Id: Ia3cd28efb9622476437a2ce32204597fae720877
Reviewed-by: Guy Harris <>
2017-12-04 05:02:18 +00:00
Guy Harris eb8ffb74e2 Use cfile.h to define the capture_file type.
Have cfile-int.h declare the structure, and use it in files that
directly access the structure.

Have cfile.h just incompletely declare the structure and include it
rather than explicitly declaring it in source files or other header

Never directly refer to struct _capture_file except when typedeffing

Add #includes as necessary, now that cfile.h doesn't drag in a ton of

Change-Id: I7931c8039d75ff7c980b0f2a6e221f20e602a556
Reviewed-by: Guy Harris <>
2017-12-03 18:54:37 +00:00
Gerald Combs 28b6616ea0 Get rid of some void pointers.
Explictly struct _capture_file * in epan_session and its callbacks.

Change-Id: I63703015c661a08f3350a7448a7bcdaf98f119dc
Reviewed-by: Gerald Combs <>
Petri-Dish: Gerald Combs <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <>
2017-12-01 21:09:24 +00:00
Gerald Combs 775bbbcded Start using SPDX license identifiers.
A while back Graham pointed out the SPDX project (, which is
working on standardizing license specifications:

Appendix V of the specification describes a short identifier
(SPDX-License-Identifier) that you can use in place of boilerplate in
your source files:

Start the conversion process with our top-level C and C++ files.

Change-Id: Iba1d835776714deb6285e2181e8ca17f95221878
Reviewed-by: Gerald Combs <>
Petri-Dish: Gerald Combs <>
Reviewed-by: Balint Reczey <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <>
2017-11-09 20:03:51 +00:00
Guy Harris d0865fd619 Allow bigger snapshot lengths for D-Bus captures.
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except
for D-Bus captures.  Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for
them, because that's the largest possible D-Bus message size.  See

for an example of the problems caused by limiting the snapshot length to
256KB for D-Bus.

Have a snapshot length of 0 in a capture_file structure mean "there is
no snapshot length for the file"; we don't need the has_snap field in
that case, a value of 0 mean "no, we don't have a snapshot length".

In dumpcap, start out with a pipe buffer size of 2KB, and grow it as
necessary.  When checking for a too-big packet from a pipe, check
against the appropriate maximum - 128MB for DLT_DBUS, 256KB for
everything else.

Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Guy Harris <>
2017-06-05 05:28:26 +00:00
Jim Young 520a1b2066 Make the capture file's interface description filterable
This patch introduces the frame.interface_description field.

While testing this new functionality it became obvious that we have
a non-optimal interaction between the existing cfile.c's
cap_file_get_interface_name(), the recently added frame.interface_name
field and this new frame.interface_description field.

The string returned from cap_file_get_interface_name() may in fact
come from one of three different sources: the idb's interface name
(if it exists) or the idb's interface description (if that exists)
or a default text of "unknown".  The string ultimately becomes the
rame.interface_name whether or not the idb had an interface name
option to begin with.  This behavior does not allow one to test for
the simple presence of frame.interface_name.  The new peer function
cap_file_get_interface_description() added by this patch returns
NULL instead of "unknown" if the idb does not have an interface
description.  Should cap_file_get_interface_name() be similarly
modified to return NULL if the idb does not have an interface name?

Bug: 9781
Change-Id: Ie479f373c5080c004dd22bd88919838feca71e95
Petri-Dish: Stig Bjørlykke <>
Tested-by: Petri Dish Buildbot <>
Petri-Dish: Alexis La Goutte <>
Reviewed-by: Alexis La Goutte <>
Reviewed-by: Anders Broman <>
2017-02-09 11:31:59 +00:00
Guy Harris 3beab65515 No need to check for string option values being null.
A string option, if present, always has a value; it might be a null
*string*, but you won't get a null pointer (if the option isn't present,
it simply isn't present).

Fix some comments while we're at it.

Change-Id: I9c1420f56998a7d04de5c5cc2e92631b181f303a
Reviewed-by: Guy Harris <>
2016-07-21 00:28:18 +00:00
Guy Harris 1f8999bb96 Redo the block options APIs.
A block can have zero or more instances of a given option.  We
distinguish between "one instance only" options, where a block can have
zero or one instance, and "multiple instances allowed" options, where a
block can have zero or more instances.

For "one instance only" options:

	"add" routines add an instance if there isn't one already
	and fail if there is;

	"set" routines add an instance if there isn't one already
	and change the value of the existing instance if there is one;

	"set nth" routines fail;

	"get" routines return the value of the instance if there is one
	and fail if there isn't;

	"get nth" routines fail.

For "multiple instances allowed" options:

	"add" routines add an instance;

	"set" routines fail;

	"set nth" routines set the value of the nth instance if there is
	one and fail otherwise;

	"get" routines fail;

	"get nth" routines get the value if the nth instance if there is
	one and fail otherwise.

Rename "optionblock" to just "block"; it describes the contents of a
block, including both mandatory items and options.

Add some support for NRB options, including IPv4 and IPv6 option types.

Change-Id: Iad184f668626c3d1498b2ed00c7f1672e4abf52e
Reviewed-by: Guy Harris <>
2016-07-14 23:02:39 +00:00
Michael Mann 08d49ff2e0 Making wiretap option blocks more generic.
This was inspired by, but takes it in a different direction where all options are put into an array, regardless of whether they are "standard" or "custom".  It should be easier to add "custom" options in this design. Some, but not all blocks have been converted.
Descriptions of some of the block options have been moved from wtap.h to pcapng.h as it seems to be the one that implements the description of the blocks.

Also what could be added/refactored is registering block behavior.

Change-Id: I3dffa38f0bb088f98749a4f97a3b7655baa4aa6a
Petri-Dish: Michael Mann <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Michael Mann <>
2016-02-23 00:39:38 +00:00
Bill Meier 1b8b2a8aa8 Add editor modelines; Adjust whitespace as needed.
Change-Id: I4da7b335d905dbca10bbce03aa88e1cdeeb1f8ad
Reviewed-by: Bill Meier <>
2014-10-12 18:58:32 +00:00
Graham Bloice 97546165fa Modify includes of config.h so that out-of-tree builds, i.e. CMake
don't pick up the in-tree copy.

Change-Id: I7ec473876cdba1a025c52362d7f6adc62d24ce71
Petri-Dish: Graham Bloice <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Roland Knall <>
Reviewed-by: Graham Bloice <>
2014-08-24 08:04:08 +00:00
Peter Wu 3aee917058 wiretap: remove unused code, drop number_of_interfaces
While investigating an ASAN issue (fixed in
commit dcdd076ab0), I got greatly confused
by three different types having the same "interface_data" field name:

 * pcapng_t *pn stores an array of interface_data_t objects.
 * wtap *wth stores an array of wtapng_if_descr_t objects.
 * pcapng_dump_t should store an array of interface_data_t objects.

pcapng_dump_t and friends are unused since
commit c7f1a431d2, so drop it.

To fix the confusion, rename the interface_data_t type to
interface_info_t type and use the local variable "iface_info"
everywhere. Rename interface_data of pcapng_t to "interfaces" and
add a comment what this exactly means (interfaces listed in the capture

Drop the number_of_interfaces field for interfaces as the array
length is already available from GArray. Now interface_data is always
initialized for wth (which also gets copied to idb).

s/int/guint/g and replace cast at some places.

There are no regressions for the in-tree test suite.

Change-Id: I2d5985c9f1e43f8230dbb4a73bd1e243c4858170
Reviewed-by: Evan Huus <>
Tested-by: Evan Huus <>
Reviewed-by: Michael Mann <>
2014-05-17 12:41:50 +00:00
Guy Harris a1b1c8bed5 Revert "Refactor Wiretap"
This reverts commit 1abeb277f5.

This isn't building, and looks as if it requires significant work to fix.

Change-Id: I622b1bb243e353e874883a302ab419532b7601f2
Reviewed-by: Guy Harris <>
2014-05-09 05:21:01 +00:00
Michael Mann 1abeb277f5 Refactor Wiretap
Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality.

The "architectural" changes can be found in cfile.h, wtap.h, wtap-int.h and (new file) wftap-int.h. Most of the other (painstaking) changes were really just the result of compiling those new architecture changes.

Change-Id: Ife858a61760d7a8a03be073546c0e7e582cab2ae
Reviewed-by: Michael Mann <>
2014-05-09 03:04:39 +00:00
Anders Broman 0513b29b8b Revert "Allow pcapng interface options to be available to dissectors."
This patch causes Wireshark/tshark to segfault if the file is reread(open a file and press reload).
The test suite also fails on 
2.1.1 Step: Exit status for existing file: "/home/wireshark/builders/trunk/sol10sparc/build/test/captures/dhcp.pcap" must be 0/home/wireshark/builders/trunk/sol10sparc/build/test/ line 149:  6646 Segmentation Fault      (core dumped) $TSHARK -r "${CAPTURE_DIR}dhcp.pcap" > ./testout.txt 2>&1

OSX build bot chokes on
pcapng.c: In function 'pcapng_destroy_option_value':
pcapng.c:377: warning: implicit declaration of function 'g_byte_array_unref'
pcapng.c:379: warning: implicit declaration of function 'g_array_unref'
pcapng.c: In function 'pcapng_collect_block_option':
pcapng.c:419: warning: implicit declaration of function 'g_byte_array_new_take'
pcapng.c:419: warning: initialization makes pointer from integer without a cast

these functions are glib 2.22
This reverts commit 7b13a3b0f6.

Change-Id: Ia82fdb2d08287bc2cd2841e1e941ae68cbc2e009
Reviewed-by: Anders Broman <>
2014-03-20 12:25:21 +00:00
Christopher Kilgour 7b13a3b0f6 Allow pcapng interface options to be available to dissectors.
Interface options[1], and more generally pcapng options[2], are useful
information that can provide improved dissector output.

Prior to this change, only certain pcapng interface options were interpreted
and made available to dissectors, e.g. the interface name or description.
This change augments the situation by providing epan_get_interface_option( ),
which returns an array of byte arrays if the option code exists
(otherwise NULL).  Each element of the array is a byte buffer containing
the raw data of the option.  An array-of-buffers is used because pcapng
allows for multiple instances of the same option to be present in the file.
All interface options found in a pcapng file are thus made available to the

The implementation also provides infrastructure to collect options from
other pcapng blocks such as the section header.  Currently these options
are discarded, but could be retained in the future to support more features.


Change-Id: I944b6f0f03dde9b8e7d1348b76acde6f9d312f37
Reviewed-by: Anders Broman <>
2014-03-20 09:54:01 +00:00
Alexis La Goutte 296591399f Remove all $Id$ from top of file
(Using sed : sed -i '/^ \* \$Id\$/,+1 d')

Fix manually some typo (in export_object_dicom.c and crc16-plain.c)

Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8
Reviewed-by: Anders Broman <>
2014-03-04 14:27:33 +00:00
Jakub Zawadzki 7ec1a78fe8 Abuse epan_t more: add callback to get interface name.
svn path=/trunk/; revision=50794
2013-07-22 19:38:38 +00:00
Jeff Morriss 3551a86c36 We always HAVE_CONFIG_H so don't bother checking whether we have it or not.
svn path=/trunk/; revision=45015
2012-09-20 01:29:52 +00:00
Evan Huus b859ce0a44 Fix transposed memset parameters causing build failure with GCC.
svn path=/trunk/; revision=43834
2012-07-19 22:09:44 +00:00
Gerald Combs 0da59a0058 Pass {delayed_}create_progress_dlg a pointer the top level window
so that we can properly associate a widget with create, update, and
destroy events. Only used by Qt so far but it should be easy enough to
add to GTK+.

Rename ui/qt/progress_dialog.{h,cpp} to progress_bar.{h,cpp}. Show a
progress bar in the status bar of the main window instead of creating
a separate dialog. Note that we still need to add a "cancel" mechanism
and display the task and item titles somewhere.

Thus began the War Against Gratuitous Dialogs.

svn path=/trunk/; revision=43833
2012-07-19 21:49:52 +00:00
Jakub Zawadzki bf81b42e1e Update Free Software Foundation address.
(COPYING will be updated in next commit)

svn path=/trunk/; revision=43536
2012-06-28 22:56:06 +00:00
Guy Harris 4a9b825c49 Change the "user_saved" member of a capture_file structure to
"unsaved_changes", and have it be TRUE iff changes have been made to the
file since it was read - *not* if it's a temporary file from a live

Check the "is_tempfile" member, and the "unsaved_changes" member, when

Just have a set_toolbar_for_capture_file() routine that updates the
"save", "close", and "reload" toolbar as appropriate, given a
capture_file structure - absorb the function of
set_toolbar_for_unsaved_capture_file() into it.

svn path=/trunk/; revision=42721
2012-05-20 08:56:06 +00:00
Guy Harris c9b9dd690b Create a new frame_data_sequence data type; it represents a dense
sequence of frame_data structures, indexed by the frame number.  Extract
the relevant bits of the capture_file data structure and move them to
the frame_data_sequence, and move the relevant code from cfile.c and
tweak it to handle frame_data_sequence structures.

Have a possibly-null pointer to a frame_data_sequence structure in the
capture_file structure; if it's null, we aren't keeping a sequence of
frame_data structures (we don't keep that sequence when we're doing
one-pass processing in TShark).

Nothing in libwireshark should care about a capture_file structure; get
rid of some unnecessary includes of cfile.h.

svn path=/trunk/; revision=36881
2011-04-27 02:54:44 +00:00
Guy Harris 71b31d92fc Store the frame_data structures in a tree, rather than a linked list.
This lets us get rid of the per-frame_data-structure prev and next
pointers, saving memory (at least according to Activity Monitor's report
of the virtual address space size on my Snow Leopard machine, it's a
noticeable saving), and lets us look up frame_data structures by frame
number in O(log2(number of frames)) time rather than O(number of frames)
time.  It seems to take more CPU time when reading in the file, but
seems to go from "finished reading in all the packets" to "displaying
the packets" faster and seems to free up the frame_data structures
faster when closing the file.

It *is* doing more copying, currently, as we now don't allocate the
frame_data structure until after the packet has passed the read filter,
so that might account for the additional CPU time.

(Oh, and, for what it's worth, on an LP64 platform, a frame_data
structure is exactly 128 bytes long.  However, there's more stuff to
remove, so the power-of-2 size is not guaranteed to remain, and it's not
a power-of-2 size on an ILP32 platform.)

It also means we don't need GLib 2.10 or later for the two-pass mode in

It also means some code in the TCP dissector that was checking
pinfo->fd->next to see if it's NULL, in order to see if this is the last
packet in the file, no longer works, but that wasn't guaranteed to work

	we might be doing a one-pass read through the capture in TShark;

	we might be dissecting the frame while we're reading in the
	packets for the first time in Wireshark;

	we might be doing a live capture in Wireshark;

in which case packets might be prematurely considered "the last packet".
#if 0 the no-longer-working tests, pending figuring out a better way of
doing it.

svn path=/trunk/; revision=36849
2011-04-25 19:01:05 +00:00
Guy Harris 678be392f1 Make the packet count an unsigned value, as frame numbers are unsigned.
Make the loops that scan through all the packets do so by frame number,
to abstract away the "next" and "previous" pointers in the frame_data
structure.  Add a routine to cfile.c to map frame numbers to frame_data
structures, and put in some special case handling so scanning forward or
backward through the packets is O(N) rather than O(N^2).

svn path=/trunk/; revision=36846
2011-04-25 05:33:07 +00:00
Gerald Combs cc5d7670bd Keep a copy of the interface description and capture filter around so that
we can use it in the main window title during and after capture. Add a
"-X" option for providing a description for stdin.

svn path=/trunk/; revision=32357
2010-04-01 21:55:01 +00:00
Kovarththanan Rajaratnam 0ee2b7754d Rename init_cap_file() to cap_file_init()
svn path=/trunk/; revision=30073
2009-09-22 16:53:11 +00:00
Kovarththanan Rajaratnam 9398b679e8 Introduce cap_file_add_fdata() and start using it
svn path=/trunk/; revision=30071
2009-09-22 16:39:48 +00:00
Kovarththanan Rajaratnam da5b43c80c Don't include header files that are not required
svn path=/trunk/; revision=30050
2009-09-21 18:31:58 +00:00
Kovarththanan Rajaratnam 8b62ba243b Remove unused 'pstats' member in capture_file
svn path=/trunk/; revision=30048
2009-09-21 18:20:01 +00:00
Kovarththanan Rajaratnam 7ca137e294 Rename capture_file.plist to capture_file.plist_start to make it consistent with capture_file.plist_end
svn path=/trunk/; revision=30047
2009-09-21 18:09:19 +00:00
Bill Meier 6c47f763a3 Adjust some spacing ....
svn path=/trunk/; revision=27457
2009-02-15 21:55:03 +00:00
Sake Blok 2ce22e6bca From (Bug 2895):
We might receive new packets while redissecting and don't want to
dissect those before the packet-list is fully rebuilt.

svn path=/trunk/; revision=26309
2008-09-30 15:45:20 +00:00
Ronnie Sahlberg 1370d2f738 break out dfcode from the capture file structure and declare it locally where it is needed.
allocate and release the dfcode program as needed instead of having it hang around in the capture file structure.

this will ensure that dfcode will not have longer than se scope lifetime in case we need that property of it later

svn path=/trunk/; revision=20251
2007-01-01 10:23:37 +00:00
Ronnie Sahlberg 89f022b12b name change
svn path=/trunk/; revision=18197
2006-05-21 05:12:17 +00:00
Ulf Lamping 3a63719e38 another two steps towards privilege seperation:
move another two capture related fields (iface and cfilter) from cfile to capture_opts

also move the handling of capture related command line options from main.c to capture.c, that way a future privilege seperated capture program can use the same code to parse it's command line than Ethereal. 
It might be even possible to share this parser code even with Tethereal, didn't took a closer look at this.

svn path=/trunk/; revision=13320
2005-02-06 21:20:35 +00:00
Ulf Lamping dd71ad695f (some) redesign of capture data structures.
don't use global cfile at all but only an untpyed handle to call the cf_... functions in file.c
move the save_file member from capture_file to capture_opts, as it's only used while capturing and while preparing it

svn path=/trunk/; revision=13276
2005-02-04 01:29:29 +00:00
Ulf Lamping 9ff19a4c94 move capture_file_fd field from capture_file to capture_opts type, as this is the place where it should be
svn path=/trunk/; revision=13268
2005-02-03 22:48:20 +00:00
Guy Harris 8a8b883450 Set the svn:eol-style property on all text files to "native", so that
they have LF at the end of the line on UN*X and CR/LF on Windows;
hopefully this means that if a CR/LF version is checked in on Windows,
the CRs will be stripped so that they show up only when checked out on
Windows, not on UN*X.

svn path=/trunk/; revision=11400
2004-07-18 00:24:25 +00:00
Ronnie Sahlberg 8e876bf574 Forgot to add two files
svn path=/trunk/; revision=6204
2002-09-06 23:14:04 +00:00