Commit Graph

633 Commits

Author SHA1 Message Date
João Valverde cf8107eb2a Move ui/clopts_common.[ch] to wsutil 2023-02-10 20:59:22 +00:00
João Valverde 0cea64a632 Move ui/cmdarg_err.[ch] to wsutil 2023-02-10 20:59:22 +00:00
João Valverde 84f963dfa2 Move ui/version_info.[ch] to wsutil 2023-02-07 23:17:37 +00:00
Gerald Combs cb420c7911 Extcap: Create our fifo in a temporary directory.
Instead of creating a temp file, unlinking it, and creating a fifo with
the same name, add create_tempdir() so that we can create a temporary
directory and create a fifo inside that.

This should avoid a race condition in Carbon Black Cloud antivirus,
which if the timing is right, will stat the initial temporary *file*,
miss the fact that it's been replaced with a *fifo*, and open and steal
data^W^W read from it, leaving dumpcap to contend with the truncated

Adding the unexpected magic number to cap_pipe_open_live()'s error
message helped to debug this. Leave it in since it's handy to have in
that case.

Ping #15587
2022-12-12 18:34:21 +00:00
João Valverde 3949d289d1 Add log init message to main() 2022-10-08 15:33:47 +00:00
Chuck Craft 8064d9a721 dumpcap: typo in pcap_geterr() string comparison
Ping #18332
2022-09-09 22:46:32 -05:00
Gerald Combs c347b057a7 dumpcap: Count more block types as packets.
The Sysdig Event dissector handles BLOCK_TYPE_SYSDIG_EVENT_V2 and
BLOCK_TYPE_SYSDIG_EVENT_V2_LARGE blocks. Add them to dumpcap's packet
count so that we don't get a "No packets captured." error.
2022-03-20 17:04:58 +00:00
João Valverde 8cd49b2da0 dumpcap: Fix a TODO for Npcap test 2022-02-24 21:15:51 +00:00
David Perry e2fab18853 wsutil: New API to gather compile/runtime info 2022-02-24 13:27:08 +00:00
David Perry fc3f061829 Differentiate `-c` from `-a packets:` 2022-02-11 01:54:53 +00:00
David Perry 1e0d117eb7 Specify directory for temporary captures 2022-02-09 14:32:28 +00:00
John Thacker 3e2c79d924 dumpcap: Fix segfault when failing to create temporary file
g_file_open_tmp() does not set name_used unless the temp file
is successfully created (cf. to our old hand written library
pre commit 2925fb0850). Initialize it so that g_free doesn't
free a random memory location in that case, and don't use it
otherwise after failure. Fix #17828.
2022-01-19 13:57:08 +00:00
Gerald Combs c65f0a5a15 Update our Npcap URLs.
The official Npcap web site is now Update our URLs
to match. Fixes #17838.
2022-01-06 16:12:30 -08:00
João Valverde 3f27a830fc wslog: Use a wider type for line 2022-01-05 13:31:52 +00:00
Gerald Combs 87eca12c38 Docs: Document our diagnostic output options.
Add docs/diagnostic-options.adoc, which is a snippet that documents our
various --log-* options. Include it in the dumpcap, rawshark, and tshark
man pages.

Make the ws_log_print_usage output more consistent.
2021-12-27 08:04:25 +00:00
João Valverde 4448b6494e Add a ws_posix_compat.h header
Currently used to define ssize_t on platforms that lack it.

Fix some Windows build errors caused by moving the definition into a
separate header.

Fix some narrowing warnings on Windows x64 from changing the definition
of ssize_t from long int to int64_t.

The casts in dumpcap are ugly but necessary. The whole code needs
to be rewritten for portability, or the warnings disabled.
2021-12-21 01:30:06 +00:00
João Valverde ce1dc88173 Fix stdio.h conversions to use the scanf macros 2021-12-19 23:49:55 +00:00
João Valverde 0ccd69e530 Replace g_strdup_printf() with ws_strdup_printf()
Use macros from inttypes.h.
2021-12-19 21:21:58 +00:00
João Valverde fe5248717f Replace g_snprintf() with snprintf()
Use macros from inttypes.h with format strings.
2021-12-19 20:06:13 +00:00
João Valverde d443197097 Prefer the portable _Noreturn attribute (C11)
Use _Noreturn, available with C11, instead of vendor specific
attributes. It's not compatible with C++ so we we must keep
the old code for now.
2021-12-18 18:54:08 +00:00
João Valverde 81de22e81a wslog: 'struct timespec' is C11, use that 2021-12-15 15:00:59 +00:00
João Valverde c6825ccdf3 Fix capture with WIRESHARK_LOG_LEVEL=debug
Fix the dumpcap log handler to not pass debug messages as error messages
to parent process. Otherwise it is impossible to use dumpcap in debug
mode as a child process. Dumpcap will be in debug mode if it inherits
the environment variable WIRESHARK_LOG_LEVEL set to "debug" (or
"noisy") from the parent process.

Fixes dc7f0b88bb.

Fixes #17764.
2021-12-04 17:02:52 +00:00
João Valverde e921b804d0 Fix logging with extcaps
Extcaps require a log file when invoked in child mode. It also has
a specific flag to enable debugging, other that the wslog options.

Fix the logging to:
  1. Enable debug log level if --debug is used.
  2. Do not emit messages to the stderr if debug is enabled.

This brings extcap logging to the same feature level it had before
wslog replaced GLib logging.
2021-12-03 12:30:53 +00:00
Guy Harris 27990832cb dumpcap: don't tell users to bother the Npcap developers.
The issue in question is Npcap issue 250, for which work is being
considered in Npcap issue 506; this is all apparently due to Windows
tearing down and reassembling the networking stack in various sitations.
See @jtippet's comments in Npcap issue 250.

We just tell users that this is a known problem, work is being done on
it, so there's no need to report it.
2021-10-22 15:00:16 -07:00
Guy Harris 79920cbc5f dumpcap: do all packet counting in capture_loop_wrote_one_packet().
We need to update global_ld.inpkts_to_sync_pipe as soon as we've written
a packet to the current capture file.  If we're writing to multiple
files, then, if we delay counting until after we switch to another file,
the packet-count message we send to the parent before switching won't
include the packet, and the first packet-count message we send to the
parent *after* switching *will* include the packet, which could mean the
parent will try to read more packets than there are in the new file, in
which case it'll get an EOF and, at least in the case of TShark, treat
that as an error and stop capturing.

This should fix issue #17654.

While we're at it, don't send a "we have no packets" packet-count
message even for the packet-count message we send just before switching
2021-10-13 17:18:50 -07:00
Chuck Craft fefad2e7cf dumpcap: double received count when using threads
Closes #17089
2021-10-12 06:37:46 +00:00
João Valverde 5362d0c31b ws_getopt: Rename struct and macros
This is part of the API and should also be renamed to avoid conflicts.
2021-09-30 13:59:28 +00:00
João Valverde 8df2a73594 Use the musl in-tree getopt_long() everywhere
Besides the obvious limitation of being unavailable on Windows,
the standard is vague about getopt() and getopt_long() has many
non-portable pitfalls and buggy implementations, that increase
the maintainance cost a lot. Also the GNU libc code currently
in the tree is not suited for embedding and is unmaintainable.

Own maintainership for getopt_long() and use the musl implementation
everywhere. This way we don't need to worry if optreset is available,
or if the $OPERATING_SYSTEM version behaves in subtly different ways.

The API is under the Wireshark namespace to avoid conflicts with
system headers.

Side-note, the Mingw-w64 9.0 getopt_long() implementation is buggy
with opterr and known to crash. In my experience it's a headache to
use the embedded getopt implementation if the system provides one.
2021-09-17 00:43:54 +01:00
Juha Takala 8bc52f542b Add tshark ringbuffer option '-b nametimenum:value'
This is used to select ringbuffer savefile name template.  Choose one of two
savefile name templates:

If value is 1, make running file number part before start time part; this is
the original and default behaviour (e.g. log_00001_20210828164426.pcap).

If value is greater than 1, make start time part before running number part
(e.g. log_20210828164426_00001.pcap).

The latter makes alphabetical sortig order equal to creation time order, and
keeps related multiple file sets in same directory close to each other (e.g.
while browsing in wireshark "Open file" dialog).

Signed-off-by: Juha Takala <>
2021-09-14 04:52:09 +00:00
James Ko 3ebc8fd8fe dumpcap:Send SP_FILE after SHB passthru in child mode
When dumpcap is running as a capture child in passthrough mode, the
SP_FILE message should not be sent until after the source SHB is passed
through to the capture file. Fixes a race condition where the capture
parent attempts to read an SHB from the capture file, following the
SP_FILE message, but the file is empty.  Closes #17013.
2021-09-13 05:09:01 +00:00
Guy Harris 92f49886cc dumpcap: clean up capture device open errors.
1) Consistently say "capture device"; not all capture devices are
"interfaces" in the sense of "network interfaces' ("any" means "all
network interfaces", and capturing may be supported on a USB bus or on
D-Bus or....)

2) Use double quotes to quote the device specifier (it probably won't
have spaces in its name, but...).

3) Make sure that there's a space between "capture device" and the
quoted device name.
2021-07-26 01:32:23 -07:00
Guy Harris 0a9ef601d2 Clean up handling of --capture-comment.
Don't store the comments in a capture_options structure, because that's
available only if we're being built with capture support, and
--capture-comment can be used in TShark when reading a capture file and
writing another capture file, with no live capture taking place.

This means we don't handle that option in capture_opts_add_opt(); handle
it in the programs that support it.

Support writing multiple comments in dumpcap when capturing.

These changes also fix builds without pcap, and makes --capture-comment
work in Wireshark when a capture is started from the command line with

Update the help messages to indicate that --capture-comment adds a
capture comment, it doesn't change any comment (much less "the" comment,
as there isn't necessarily a single comment).

Update the man pages:

- not to presume that only pcapng files support file comments (even if
that's true now, it might not be true in the future);
- to note that multiple instances of --capture-comment are supported,
and that multiple comments will be written, whether capturing or reading
one file and writing another;
- clarify that Wireshark doesn't *discard* SHB comments other than the
first one, even though it only displays the first one;
2021-07-15 05:43:36 +00:00
The latter is what editcap calls --capture-comment, and the _NUM serves
no purpose whatsoever.  One #define name for it suffices.
2021-07-14 09:51:54 +00:00
João Valverde 100876337a Move version_info.[ch] to ui/
Version info is an aspect of UI implementation so move it to
a more appropriate place, such as ui/. This also helps declutter
the top-level.

A static library is appropriate to encapsulate the dependencies
as private and it is better supported by CMake than object libraries.

Also version_info.h should not be installed as a public header.
2021-07-04 10:37:49 +00:00
João Valverde 4124986a9c wslog: Prefer more modern time APIs
Functions clock_gettime() and timespec_get() cover all the platforms
we support with sub-second resolution in a a portable manner. Fallback
to using time().

Pass a struct timespec to the log writer callback for maximum
2021-06-29 14:19:55 +00:00
João Valverde c6a920686c wslog: Check environment initialization for errors
Initialiaze the cmdarg error stream earlier.

Dumpcap also needs to know earlier if it is running in capture
child mode.
2021-06-26 00:18:26 +01:00
Guy Harris 6d9b0646d8 If opening a capture device provides a warning, show it.
We start the capture anyway, but print a warning message or pop up a
warning dialog first.
2021-06-23 02:31:31 -07:00
João Valverde 759bb234d0 wslog: Check if we are initialized and add missing inits
Instead of receiving the program name from GLib, pass it explicitly
to ws_log_init() instead  and use that to initialize the GLib program

ws_log_parse_args() will now exit the program when it encounters an
argument error if exit_failure >= 0.
2021-06-21 16:03:29 +00:00
João Valverde 0e50979b3f Replace g_assert() with ws_assert() 2021-06-19 01:23:31 +00:00
Guy Harris 6eb3703379 Make various names match the name of the systemd journal export block.
The name of the block, in the pcapng specification is the systemd
Journal Export Block; add "export" after "journal" in various
variable/enum/define names.
2021-06-17 13:52:45 -07:00
João Valverde c5b3842639 wslog: Add more documentation 2021-06-17 12:00:10 +01:00
João Valverde 69a217b95b wslog: Use buffered I/O
Use standard buffered I/O instead of printing to a string.
This is more efficient, cleaner and allows custom output per stream.
2021-06-14 22:05:35 +00:00
João Valverde e86ac706ca wslog: Parse cmd line options in one pass 2021-06-14 22:05:35 +00:00
João Valverde 5ddc007023 wslog: Include pid in format 2021-06-14 14:18:38 +01:00
João Valverde 5a662ba3fb wslog: Add support for domain filtering
A domain filter can be given in the environment variable
'WS_LOG_DOMAINS' or in a command-line options "--log-domains".

The filter is specified as a comma separated case insensitive list,
for example:

    ./tshark  --log-domains=main,capture

Domain data type switches from an enum to a string. There is no
constaint on adding new domains, neither in code or at runtime.
The string format is arbitrary, only positive matches will produce
2021-06-14 13:13:12 +01:00
João Valverde 82739fc4f5 wslog: Improve code modularity and efficiency
Also tweak format for readability.
2021-06-14 13:13:12 +01:00
João Valverde dc7f0b88bb Refactor our logging and extend the wslog API
Experience has shown that:

  1. The current logging methods are not very reliable or practical.
A logging bitmask makes little sense as the user-facing interface (who
would want debug but not crtical messages for example?); it's
computer-friendly and user-unfriendly. More importantly the console
log level preference is initialized too late in the startup process
to be used for the logging subsystem and that fact raises a number
of annoying and hard-to-fix usability issues.

  2. Coding around G_MESSAGES_DEBUG to comply with our log level mask
and not clobber the user's settings or not create unexpected log misses
is unworkable and generally follows the principle of most surprise.
The fact that G_MESSAGES_DEBUG="all" can leak to other programs using
GLib is also annoying.

  3. The non-structured GLib logging API is very opinionated and lacks
configurability beyond replacing the log handler.

  4. Windows GUI has some special code to attach to a console,
but it would be nice to abstract away the rest under a single

  5. Using this logger seems to be noticeably faster.

Deprecate the console log level preference and extend our API to
implement a log handler in wsutil/wslog.h to provide easy-to-use,
flexible and dependable logging during all execution phases.

Log levels have a hierarchy, from most verbose to least verbose
(debug to error). When a given level is set everything above that
is also enabled.

The log level can be set with an environment variable or a command
line option (parsed as soon as possible but still later than the
environment). The default log level is "message".

Dissector logging is not included because it is not clear what log
domain they should use. An explosion to thousands of domains is
not desirable and putting everything in a single domain is probably
too coarse and noisy. For now I think it makes sense to let them do
their own thing using g_log_default_handler() and continue using the
G_MESSAGES_DEBUG mechanism with specific domains for each individual

In the future a mechanism may be added to selectively enable these
domains at runtime while trying to avoid the problems introduced
2021-06-11 09:40:28 +00:00
Guy Harris fcb56bd1d4 Clean up printing of interface information.
In dumpcap, if we're being run by TShark or Wireshark, if there are no
link-layer types, just provide an empty list to our caller; let them
construct an empty list of link-layer types when they read our output.

In the code that reads that list, don't report an error if the list is
empty, rely on the caller to do so.

Have capture_opts_print_if_capabilities() do more work, moving some
functions from its callers to it.
2021-04-13 23:14:09 -07:00
Guy Harris 60e339bba4 Don't handle -k in capture_opts_add_opt().
It's not a generic capture option also supported by TShark and dumpcap,
it's Wireshark-specific (dumpcap *always* starts a capture, and TShark
starts one iff it's passed one or more interfaces on which to capture;
only Wireshark needs it to start the capture immediately - that's a
relic of the days when Wireshark *itself* did what dumpcap now does for

Handle it in commandline_other_options(), rather than in

That lets us get rid of an argument to capture_opts_add_opt(), and dummy
variables in TShark and dumpcap used to work with that extra argument.
2021-04-13 12:38:06 -07:00
João Valverde 7fee50274f Merge the caputils/ and capchild/ directories
The distinction between the different kinds of capture utility
may not warrant a special subfolfer for each, and sometimes the
distinction is not be clear or some functions could stradle
multiple "categories" (like capture_ifinfo.[ch]).

Simplify by having only a generic 'capture' subfolder. The
separate CMake libraries are kept as a way to reuse object code
2021-03-29 06:08:02 +01:00