Commit Graph

180 Commits

Author SHA1 Message Date
Guy Harris ff9f9fc431 Don't include "file.h" if you don't need it.
It ends up dragging in libwireshark headers, which programs not linking
with libwireshark shouldn't do.  In particular, including
<epan/address.h> causes some functions that refer to libwireshark
functions to be defined if the compiler doesn't handle "static inline"
the way GCC does, and you end up requiring libwireshark even though you
shouldn't require it.

Move plurality() to wsutil/str_util.h, so that non-libwireshark code can
get it without include epan/packet.h.  Fix includes as necessary.

Change-Id: Ie4819719da4c2b349f61445112aa419e99b977d3
Reviewed-on: https://code.wireshark.org/review/11545
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-04 08:46:30 +00:00
João Valverde 3df2333155 Remaining ADDRESS macro to address function conversions
Change-Id: I8bc9af431e70243b05f4f0ce8c2b8ee451383788
Reviewed-on: https://code.wireshark.org/review/11463
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-03 12:20:34 +00:00
Gerald Combs 4f39c603c2 More ADDRESS macro to address function conversions.
Replace remaining calls to SET_ADDRESS, CMP_ADDRESS, ADDRESSES_EQUAL,
COPY_ADDRESS, and COPY_ADDRESS_SHALLOW with their lower-case
equivalents.

Replace all ADD_ADDRESS_TO_HASH calls with add_address_to_hash.

Change-Id: I4cff857d7a84085abe0bccd52d2605d2a468bf6f
Reviewed-on: https://code.wireshark.org/review/11229
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-10-24 01:44:24 +00:00
Gerald Combs 86fe2be4dc Use address functions instead of ADDRESS macros in asn1 and epan
Replace CMP_ADDRESS, COPY_ADDRESS, et al with their lower-case
equivalents in the asn1 and epan directories.

Change-Id: I4043b0931d4353d60cffbd829e30269eb8d08cf4
Reviewed-on: https://code.wireshark.org/review/11200
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-10-22 11:45:56 +00:00
Bradford Boyle 12fa38774a Correctly convert clfow.sysuptime to seconds
Change-Id: I4f2f90ab87eafda954f6161a319976b56c7c3cf1
Reviewed-on: https://code.wireshark.org/review/11081
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-10-16 06:43:54 +00:00
Peter Wu 6d7b29592a Allow use of variadic macros
Remove variadic macros restriction (c99, c++11 feature) from
README.developer. GCC, Clang, MSVC 2005 all support it.

Enable -Wno-variadic-macros in configure.ac and CMakeLists.txt when
-Wpedantic is enabled (which would enable -Wvariadic-macros).

For all files matching 'define\s*\w+[0-9]\(', replace "FOO[0-9]" by
"FOO" and adjust the macro definition accordingly. The nbap dissector
was regenerated after adjusting its template and .cnf file. The
generated code is the same since all files disabled the debug macros.

Discussed at:
https://www.wireshark.org/lists/wireshark-dev/201209/msg00142.html
https://www.wireshark.org/lists/wireshark-dev/201510/msg00012.html

Change-Id: I3b2e22487db817cbbaac774a592669a4f44314b2
Reviewed-on: https://code.wireshark.org/review/10781
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-10-05 07:57:14 +00:00
Martin Mathieson a63f841fec Netflow: Fix sequence analysis to work for different protocol versions
Change-Id: Iaf7cb50e88e81578f79f92a2387c29c71e0e1d9d
Reviewed-on: https://code.wireshark.org/review/9574
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-07-10 19:55:33 +00:00
Peter Wu 126e02cd58 Call reassembly_table_destroy and move g_hash_table_destroy
This patch moves g_hash_table_destroy calls from the init routine to
the cleanup routine. Besides that, the conditional check for the hash
table has been removed, assuming that init is always paired with a
cleanup call.

If reassembly_table_init is found, a reassembly_table_destroy call is
prepended to the cleanup function as well.

Comments have been removed from the init function as well as these did
not seem to have additional value ("destroy hash table" is clear from
the context).

The changes were automatically generated using
https://git.lekensteyn.nl/peter/wireshark-notes/diff/one-off/cleanup-rewrite.py?id=4d11f07180d9c115eb14bd860e9a47d82d3d1dcd
Manually edited files (for assignment auditing): dvbci, ositp, sccp,
tcp.

Other files that needed special attention due to the use of
register_postseq_cleanup_routine:

 - ipx: keep call, do not add another cleanup routine.
 - ncp: remove empty mncp_postseq_cleanup. mncp_hash_lookup is used
   even if a frame is visited before (see dissect_ncp_common), hence
   the hash table cannot be destroyed here. Do it in cleanup instead.
 - ndps: add cleanup routine to kill reassembly table, but do not
   destroy the hash table as it is already done in ndps_postseq_cleanup.

Change-Id: I95a72b3df2978b2c13fefff6bd6821442193d0ed
Reviewed-on: https://code.wireshark.org/review/9223
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-07-03 23:35:14 +00:00
Martin Mathieson ba5e0a3262 Netflow: fix typo (wrong time units for duration)
Bug: 11295
Change-Id: Id732dd77609bc453e81703595882b20f68742618
Reviewed-on: https://code.wireshark.org/review/9121
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-06-25 06:27:18 +00:00
Martin Mathieson 99ab5c9d38 netflow: cope with multiple duration types in one flow.
Bug: 11295
Change-Id: I71493e13989dbc29e3e3e7d518d3b6686fbec01a
Reviewed-on: https://code.wireshark.org/review/9063
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-06-23 20:44:19 +00:00
Guy Harris 2d63e58b47 Fix some more constants to be unsigned.
Change-Id: I714078683cff517c79a15abf29e1ae4a9a60271d
Reviewed-on: https://code.wireshark.org/review/8365
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-05-09 06:56:10 +00:00
Uli Heilmeier ef7e4c52f2 Netflow/Ipfix: Add Citrix Netscaler AppFlow
This commit adds dissection of Citrix Ntscaler Appflow
templates to Netflow/Ipfix.

The documenation for the templates was found at:
https://raw.githubusercontent.com/splunk/ipfix/master/app/Splunk_TA_IPFIX/bin/IPFIX/information-elements/5951.xml

Due to non-disclosure I can't provide any sample pcap.

Change-Id: I1d34ad4298a51c71986bc8565cc5f3802b0df3c2
Reviewed-on: https://code.wireshark.org/review/7740
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-03-19 14:27:24 +00:00
Gerald Combs 3f765b3ef9 Add a CF_FUNC macro for casting BASE_CUSTOM functions.
Add a CF_FUNC macro to match VALS, TFS, etc. This should help us to avoid
the following warning:

    warning: ISO C forbids initialization between function pointer and 'void *' [-Wpedantic]

We could start adding DIAG_OFF+DIAG_ON everywhere but this seems to be
more consistent with the other macros in proto.h. Update each instance
of BASE_CUSTOM to use CF_FUNC.

Adjust a dummy variable name generated by asn2wrs.py that was triggering
an invalid error in checkhf.pl.

Fix an encoding arguement in packet-elasticsearch.c found by
fix-encoding-args.pl.

Change-Id: Id0e75076c2d71736639d486f47b87bab84e07d22
Reviewed-on: https://code.wireshark.org/review/7150
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-02-18 00:05:38 +00:00
Martin Mathieson e36a2ad669 Netflow: rework how transport (port) resolution is done, adding support for SCTP
Change-Id: I09b2cc3739628b5de706659731e37fa345804254
Reviewed-on: https://code.wireshark.org/review/7043
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-02-09 14:12:22 +00:00
Bill Meier 5003654fe0 Cleanup:
Including:
  Remove dead initializers;
  Remove boilerplate comments;
  Localize some variables;
  tvb_length...() ==> tvb_reported_length...();
  Use TRUE/FALSE when assigning a value to a gboolean;
  whitespace/indentaion.

Change-Id: I09e1f15611011bbe393d23e1cb54568ddd3cebc6
Reviewed-on: https://code.wireshark.org/review/6771
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2015-01-25 16:02:32 +00:00
Bill Meier 8d1a9848e3 Remove incorrect 'if (tree)'
Incorrect because of one or both of the following:
- col_...()/expert...() called under 'if (tree)'
- vars set under 'if (tree)' used later (not under 'if (tree)'
   as args to col_...()/expert_...()

Change-Id: I89f7d453f2d6eaa40d51cbd794ed2c9be7e549de
Reviewed-on: https://code.wireshark.org/review/6754
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2015-01-23 05:30:55 +00:00
Michael Mann ada1eec702 SE_COPY_ADDRESS -> WMEM_COPY_ADDRESS
Copy addresses with wmem-scope instead of (forced) seasonal scope.  All existing instances were converted to wmem_file_scope, but the flexibility is there for other scopes.

Change-Id: I8e58837b9ef574ec7dd87e278470d7063ae8c1c2
Reviewed-on: https://code.wireshark.org/review/6564
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-01-16 15:25:18 +00:00
Alexis La Goutte e75dd98b3d NetFlow: Assign instead of compare (CID 1262419 & 1262420)
Change-Id: Idc2c2e02b973f65c6c2f22f2d1bfd8545cd23f63
Reviewed-on: https://code.wireshark.org/review/6554
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-15 19:04:47 +00:00
Martin Mathieson 0d9248e125 Netflow: Fix spelling of 'latitude'
Change-Id: Iaae40f4a191e458645263c8d7a114392cd063707
Reviewed-on: https://code.wireshark.org/review/6543
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-15 09:42:41 +00:00
Martin Mathieson 2219f78426 Netflow: do transport resolution on ports (if know they are UDP or TCP)
Change-Id: I8fc3675f03b7eaec6a9385638197067981762a70
Reviewed-on: https://code.wireshark.org/review/6474
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-10 21:52:46 +00:00
Martin Mathieson f5de0c45a3 Netflow: Fix some duplicate label names
Change-Id: I077bdd6394898a445c00a1e7aec1c4c11b3e9ec2
Reviewed-on: https://code.wireshark.org/review/6450
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-09 18:13:38 +00:00
Martin Mathieson c94192d5e6 Netflow: add (hidden) root filters for each vendor with supported 'pie' entries
Change-Id: I2bdca4c092c247ab253d6ceb3770ac7ea935cdad
Reviewed-on: https://code.wireshark.org/review/6414
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-08 16:12:27 +00:00
Michael Mann 9cfe67fde6 tvb_bytes_to_ep_str_punct -> tvb_bytes_to_str_punct
Also change bytestring_to_str to match bytes_to_ep_str_punct functionality (limiting byte string size)

Change-Id: Idb958c7f0c203d103629469302b81fa922714f7e
Reviewed-on: https://code.wireshark.org/review/6369
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-01-07 18:05:35 +00:00
Martin Mathieson f39366bb12 NetFlow: Add Ixia 'IxFlow' fields and make some general usability improvements
- Sequence number analysis using flow sequence within an observation domain.
- Link back from data set to template frame, if have seen
- Show more information (observation domain ID, set ID, etc) in Info column and protocol roots
- Look up protocol field from ip_proto

Change-Id: I3147387a3cd0d1fc33b879b3ba226753ed2cd8dd
Reviewed-on: https://code.wireshark.org/review/6331
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-01-06 20:17:23 +00:00
Michael Mann 3d3f97320b Replace ip_to_str with [ep_]address_to_str and tvb_ip_to_str.
Change-Id: I40d0c8253743183aecef252040b7dd6742ae5c71
Reviewed-on: https://code.wireshark.org/review/5934
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-12-26 21:17:10 +00:00
Bill Meier b5d7b7ab6e Cleanup use of #includes in non-generated epan/dissector/*.c
Specifically:
- Set packet.h to be the first wireshark #include after
   config.h and "system" #includes.
   packet.h added as an #include in some cases when missing.
- Remove some #includes included (directly/indirectly) in
   packet.h. E.g., glib.h.
   (Done only for those files including packet.h).
- As needed, move "system" #includes to be after config.h and
   before wireshark #includes.
- Rework various #include file specifications for consistency.
- Misc.

Change-Id: Ifaa1a14b50b69fbad38ea4838a49dfe595c54c95
Reviewed-on: https://code.wireshark.org/review/5923
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-12-21 05:46:22 +00:00
Michael Mann 301a5b7cea Eliminate proto_tree_add_text from some dissectors.
Change-Id: I44cc6b70ec4dfc565934da499f46fca60a4ded93
Reviewed-on: https://code.wireshark.org/review/5524
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-12-09 05:57:41 +00:00
Bill Meier 5517c42883 packet-netflow.c: Do various fixes and changes
- Allow integer & float fields to have "reduced size encoding";
   Fixes Bug #8846;
- Add a missing cflow field-type;
- Update the names of a few cflow field-types;
- Replace all-but-one use of proto_tree_add_text();
- Fix encoding-args as appropriate;
- Remove some obsolete comments;
- Adust whitespace/indentation/formatting.

Change-Id: I4271e3692288cef3ea0f1aa5eb44f5a0b05c29da
Reviewed-on: https://code.wireshark.org/review/4348
Petri-Dish: Bill Meier <wmeier@newsguy.com>
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-09-28 18:16:22 +00:00
Michael Mann 8a580b3e28 Make all "padding" fields filterable
Change-Id: Ic4e4d9142a9b05ef3b628fac2e8766014c5fccec
Reviewed-on: https://code.wireshark.org/review/4073
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-09-11 01:57:02 +00:00
Bill Meier 0164b75821 packet-netflow.c: fix bug: "top-of-stack" --> "bottom-of-stack"
Bug #10458
Change-Id: I733bb54b13da8dd5b96837b57c1893e14f9622ec
Reviewed-on: https://code.wireshark.org/review/4067
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-09-10 16:58:09 +00:00
Bill Meier 382815d6bd packet-netflow.c: Update "Information Elements" dissected based upon 08/13/2014 IANA IPFIX assignments document
Change-Id: Icfabdf5b77cdeef686620b75e649fc5bc270197a
Reviewed-on: https://code.wireshark.org/review/3996
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-09-04 22:21:55 +00:00
Bill Meier 9555c24740 packet-netflow.c: netflow v9: Allow options template with zero-length scope section
Fixes Bug #10432

   Also: rework several comments.

Change-Id: I292829f6dffaf5f500cb089cc8a45e1203a2e731
Reviewed-on: https://code.wireshark.org/review/3959
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-09-02 18:50:27 +00:00
Jeff Morriss 44698259b1 Fix the uninitialized-read error reported in bug 10370.
Fix apparent cut-n-pasteo: if offset_e is set then we should be looking
at offset_e (instead of offset_s) and ts_end (instead of ts_start).

Bug: 10370
Change-Id: I0683ad55ac782c7fd03b7dbdf3f34df713267de5
Reviewed-on: https://code.wireshark.org/review/3589
Reviewed-by: Evan Huus <eapache@gmail.com>
2014-08-14 02:09:13 +00:00
Michael Mann 93517043e9 convert to proto_tree_add_subtree[_format]
Change-Id: Idd1b20ab32c0960ea52c6f3bc5346462c37c5684
Reviewed-on: https://code.wireshark.org/review/2853
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-07-04 16:46:14 +00:00
Michael Mann b40cb1adea Apply found fix-encoding-args.pl errors in the dissector directory.
I coincidentally found a few files with errors, so I thought it might be time to run it on the whole directory again.

Change-Id: Ia32e54b3b1b94e5a418ed758ea79807c8bc7e798
Reviewed-on: https://code.wireshark.org/review/978
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-04-06 15:11:36 +00:00
Alexis La Goutte b7b33b54bd Continue to remove $Id$ from top of file
Last one $Id$ (remove by hand) to make checkAPI haapy !

Change-Id: I5adfdcac0629a36e08c5fe3ea7960bdbc251364f
Reviewed-on: https://code.wireshark.org/review/887
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-31 18:49:52 +00:00
Jakub Zawadzki deb2b236f2 Add missing includes
svn path=/trunk/; revision=54332
2013-12-21 17:23:17 +00:00
Evan Huus a6415ece0a Rename a couple of to_str functions to have ep_ in the name. This makes it
obvious that the returned string is ephemeral, and opens up the original names
in the API for versions that take a wmem pool (and thus can work in any scope).

svn path=/trunk/; revision=54249
2013-12-19 15:49:09 +00:00
Bill Meier 81a67cec58 Fix (I think) VS Code Analyzer warnings:
C6297: Arithmetic overflow: 32-bit value is shifted, then cast to 64-bit value.
   Results might not be an expected value


svn path=/trunk/; revision=54104
2013-12-14 18:50:23 +00:00
Jakub Zawadzki 715e2d6699 Fix [-Wmissing-prototypes]
svn path=/trunk/; revision=54095
2013-12-14 16:09:57 +00:00
Jakub Zawadzki e0e86bab5a Fix const warnings.
svn path=/trunk/; revision=54092
2013-12-14 14:33:46 +00:00
Jakub Zawadzki 7b89063243 Don't include <epan/strutil.h> when not needed.
svn path=/trunk/; revision=53194
2013-11-09 14:58:28 +00:00
Jakub Zawadzki 0b0bbf0965 Replace STRINGIFY with glib version.
svn path=/trunk/; revision=53193
2013-11-09 14:37:13 +00:00
Jeff Morriss 8601a75d51 Finish implementing https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7263 :
Change cflow.sysuptime from an FT_UINT32 (milliseconds since the router booted)
to an FT_RELATIVE_TIME (seconds since the router booted).  I don't imagine
anyone will care if we show them seconds or milliseconds and it satisfy the
user's request (in that bug) to compare cflow.sysuptime to cflow.timeend (which
is already an FT_RELATIVE_TIME).

(If someone does care, we could always display the field twice, once in
milliseconds and once in seconds.)

svn path=/trunk/; revision=52821
2013-10-24 20:52:00 +00:00
Pascal Quantin 7850883904 emem -> wmem
svn path=/trunk/; revision=52063
2013-09-15 15:11:11 +00:00
Michael Mann 9e3f9b449f expert_add_info_format_text -> expert_add_info_format
svn path=/trunk/; revision=51852
2013-09-09 00:44:09 +00:00
Michael Mann 17fbd9028a Batch of filterable expert info
svn path=/trunk/; revision=51823
2013-09-07 16:07:02 +00:00
Anders Broman 7e3922cf43 Use dissector_delete_uint_range/dissector_add_uint_range
svn path=/trunk/; revision=51540
2013-08-27 19:21:20 +00:00
Evan Huus d22919194a Switch on field length for the length_min/max fields of IPFix. Like several
other nearby fields, they are different lengths in different versions of the
spec.

Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8918

svn path=/trunk/; revision=50940
2013-07-26 23:16:16 +00:00
Guy Harris b0a94d2b98 ASes can now be 32-bits; make the fields for them 32-bit so that you can
filter on all possible values of them.

Fixes bug 8959.

#BACKPORT 1.10, 1.8

svn path=/trunk/; revision=50791
2013-07-22 16:56:56 +00:00