As the comment says, this is a table of "File types that can be
identified by file extensions."; a file type that doesn't have an
extension that's used for files with that format obviously *can't* be
identified by a file extension and thus *doesn't* belong in this table.
Change-Id: Ic14dc55e6d9dbad4651e535cdf44293f8b449659
Reviewed-on: https://code.wireshark.org/review/30735
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Use the libwiretap APIs to get lists of all compressed file suffixes or
to get the compressed file suffix for a given compression type.
(The net effect is the same, as the only compression type supported is
gzip, but if any compression types are added in the future, that code
won't need to be changed.)
Change-Id: I7de3b764604d50c4c60b6f20dd16ee87fc00e5b2
Reviewed-on: https://code.wireshark.org/review/30734
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Added decodings for TLVs 46.10 and 46.11.
Fixed formatting of TLVs.
Change-Id: Iec8829929a8b6981e1760614f76d16400b94d05c
Reviewed-on: https://code.wireshark.org/review/30709
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add a new secrets API to the core, one that can outlive the lifetime of
a single capture file. Expose decryption secrets from wiretap through a
callback and let the secrets API route it to a dissector.
Bug: 15252
Change-Id: Ie2f1867bdfd265bad11fc58f1e8d8e7295c0d1e7
Reviewed-on: https://code.wireshark.org/review/30705
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add a new option to insert decryption secrets into a pcapng file.
Change-Id: I0e024585cac9a8a328e88d32f9eb03d37d350e2a
Ping-Bug: 15252
Reviewed-on: https://code.wireshark.org/review/30693
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Support reading and writing pcapng files with DSBs. A DSB may occur
multiple times but should appear before packets that need those
decryption secrets (so it cannot be moved to the end like NRB). The TLS
dissector will be updated in the future to make use of these secrets.
pcapng spec update: https://github.com/pcapng/pcapng/pull/54
As DSBs may be interleaved with packets, do not even try to read it in
pcapng_open (as is done for IDBs). Instead process them during the
sequential read, appending them to the 'wtap::dsbs' array.
Writing is more complicated, secrets may initially not be available when
'wtap_dumper' is created. As they may become available in 'wtap::dsbs'
as more packets are read, allow 'wtap_dumper::dsbs_growing' to reference
this array. This saves every user from checking/dumping DSBs.
If the wtap user needs to insert extra DSBs (while preserving existing
DSBs), they can set the 'wtap_dumper::dsbs_initial' field.
The test file was creating using a patched editcap (future patch) and
combined using mergecap (which required a change to preserve the DSBs).
Change-Id: I74e4ee3171bd852a89ea0f6fbae9e0f65ed6eda9
Ping-Bug: 15252
Reviewed-on: https://code.wireshark.org/review/30692
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
AppleClang 9.1.0.9020039 is complaining about a "missing initializer" in
dumpcap.c. Rather than doing ugly things like one of the following:
struct s x;
memset(&x, 0, sizeof(x));
struct s y = {.field=0};
just disable the warning (enabled via -Wextra) on broken compilers. The
minimum versions were determined using https://gcc.godbolt.org/
The special "universal zero initializer { 0 }" exception is explicitly
documented in the GCC manual (as shipped with GCC 8.2.1). Clang 6 does
not document it, but r314499 (as included with Clang 6) does implement
it and adds tests for it. (Xcode 10.0 seems based on Clang 6.0.1.)
Change-Id: I8e48d8c424a512ca36ef8c4f832ce81b3675232c
Reviewed-on: https://code.wireshark.org/review/30684
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The verbose config option has been replaced by an extcap base debug
option. Presenting verbose as an available option makes Wireshark
trying to retrieve the value of this option. As the option is not
really supported and invalid options after a recent change now
generate errors the androiddump tool does not start properly.
For reference the problem happens due the unfortunate combo of
these two patches:
v2.3.0rc0-1108-gb83ea46 ("extcap: put missed parameters into the help")
v2.9.0rc0-2431-g945d441 ("extcap: fix return value in extcap_base_parse_options().")
Fix by removing verbose as an available config option.
Change-Id: I894f599708a7160f50ca9ee1f9586022342705cb
Reviewed-on: https://code.wireshark.org/review/30716
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Already when selecting the extcap interface to use the encap type is
known. For some reason when adding packets the type is explicitly
checked for certain values and if not known type is set to
WTAP_ENCAP_WIRESHARK_UPPER_PDU.
This conversion break tcpdump function for all but ETHERNET interface
type. For example NLMON and 802.11 radiotap interfaces does not work.
This problem has probably been there since quite a while back but was not
seen (in the sense that current capture looked OK). Though when:
"3aec5e1 Catch attempts to write multiple encapsulation types if unsupported."
got applied the encap type mismatch is now detected and packet capture stops.
As encap type is known already when selecting the interface to use, fix
this by simply reusing the initial value when dumping the packets.
Change-Id: Ica9824e715c47b285c985ea48cbae0e10e18d542
Reviewed-on: https://code.wireshark.org/review/30715
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Implementing ICMP extended echo (RFC8335) for IPv6.
To dissect ICMP Extension objects we use the IPv4
implementation.
Bug: 14457
Change-Id: I5be59ccf9058466369c072cfed3ad1cd17bf243b
Reviewed-on: https://code.wireshark.org/review/30563
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
JSON-GLib was added in v2.9.0rc0-201-g511c2e166a, but is no longer
necessary since we have a home-grown JSON dumper (wsutil/json_dumper.h).
Remove the remaining traces and additionally remove GObject from
FindGLIB2.cmake since it was only added for JSON-GLib.
Change-Id: If9dfd2c60cec130f98109d100bdb6618bde06ba0
Reviewed-on: https://code.wireshark.org/review/30733
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The (optional) JSON-GLib library adds dependencies on GObject, GIO. For
statically linked oss-fuzz builds it also adds libffi and more. To avoid
these dependencies, replace JSON-GLib by some custom code. This allows
`tshark -G elastic-mapping` to be enabled by default without extra deps.
API design goals of the new JSON dumper library:
- Small interface without a lot of abstraction.
- Avoid memory allocations if possible (currently none, but maybe
json_puts_string will be replaced to improve UTF-8 support).
- Do not implement parsing, this is currently handled by jsmn.
Methods to open/close array/objects and to set members are inspired by
the JsonGlib interface. The interfaces to write values is inspired by
the sharkd code (json_puts_string is also borrowed from that).
The only observed differences in the tshark output:
- JSON-GLib ignores duplicates, json_dumper does not and may produce
duplicates and currently print two "ip.opt.sec_prot_auth_unassigned".
- JSON-GLib adds a space before a colon (unimportant formatting detail).
- (Not observed, but UTF-8 strings will be wrong like bug 14948.)
A test was added to catch changes in the tshark output. I also fuzzed
json_dumper with libFuzzer + UBSAN/ASAN and fixed an off-by-one error.
Change-Id: I0c85b18777b04d1e0f613a3d59935ec59be87ff4
Link: https://www.wireshark.org/lists/wireshark-dev/201811/msg00052.html
Reviewed-on: https://code.wireshark.org/review/30732
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Rename wsjson_unescape_json_string to json_decode_string_inplace
(inspired by the g_base64_decode_inplace name). Rename
wsjson_is_valid_json to json_validate (inspired by g_unichar_validate).
Ideally json_parse is inlined with its user (sharkd_session.c), but that
requires exporting the jsmn_init and jsmn_parse functions... Hence the
dependency on jsmn.h remains in wsjson.h.
Change-Id: I7ecfe3565f15516e9115cbd7e025362df2da5416
Reviewed-on: https://code.wireshark.org/review/30731
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The modelines says tabs, but the actual indentation is 8 spaces. Let's
change it to match the standard 4 spaces in the top-level .editorconfig.
Change-Id: I2b26b095f5e4f6f8d5d083d41ceaae98f9284fba
Reviewed-on: https://code.wireshark.org/review/30730
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Move all the compressed-file type stuff to wiretap/file_wrappers.c.
Rename wtap_compressed_file_extension() to
wtap_compression_type_extension() for consistency with the other
compression-type-extension routine names.
Move the declarations of the compression-type-extension routines in the
header file.
wtap_compression_type_extension() now returns NULL for
WTAP_UNCOMPRESSED; there's no need to special-case it.
Get rid of the now-unused wtap_compression_type_supported() and
WTAP_NUM_COMPRESSION_TYPES.
Change-Id: Ib93874079bea669a0c87104513dba0d21390455a
Reviewed-on: https://code.wireshark.org/review/30729
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
It *should* never happen, but just make sure of that by calling it only
for "open for writing" ("save") dialogs.
Change-Id: I1813f31537c0aa4efdf08c1622db9cb9e7f5ae83
Reviewed-on: https://code.wireshark.org/review/30726
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Using an enum type with the increment operator causes the following
error to be emitted by newer compilers:
"increment of enumeration value is invalid in C++ [-Werror=c++-compat]"
Numerical operations seem only allowed when taking their integer value.
Convert the loops involved to use integer and cast back to
wtap_compression_type when needed.
Change-Id: Ic96a6350c7d4db9ba2ba99df8b922649924c0e7a
Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Reviewed-on: https://code.wireshark.org/review/30722
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
With the addition of the IPv6 dummy header the logic to set the
correct ethernet protocol has become scattered across the code
and also poured into the actual packet writing code.
Once command line parsing is completed a consistent set of frame
generating parameters should be established.
This change consolidates the ethernet header protocol
determination to one point, with the added benefit of resolving
a possible duplicate IPv4 / IPv6 paramter setting in the same
manner as is done for other conflicting parameters.
Change-Id: I2c0d3ee8ad5a28b216a374dad807406113200fa2
Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Reviewed-on: https://code.wireshark.org/review/30691
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Vasil Velichkov <vvvelichkov@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add wtap_compressed_file_extension(), which returns NULL for
WTAP_UNCOMPRESSED and the appropriate file extension for other
compression types.
Add wtap_compression_type_supported(), which returns TRUE for
WTAP_UNCOMPRESSED and all supported compression types and FALSE
otherwise. ("Supported" means "the code can decompmress files in that
compression format and can write files in that compression format", so
WTAP_GAIP_COMPRESSED is supported iff libwiretap is built with zlib.)
In MainWindow::fileAddExtension, instead of checking for
WTAP_GZIP_COMPRESSED and using ".gz" as the extension, use the extension
returned by wtap_compressed_file_extension() for the compression type.
Change-Id: I47cb0eca8c887ada3562df30b54e76509008180f
Reviewed-on: https://code.wireshark.org/review/30707
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Buried at the end of the help text, in the Miscellaneous section,
is the '-n' option to write pcapng format files. This can hardly
be considered miscellaneous but rather an output option.
Move the option in the help text to the output section.
Change-Id: I3e39b75281091d6d5d9607891ef2f97ba031e48a
Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Reviewed-on: https://code.wireshark.org/review/30690
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Beside the standard NCK syntax id 0x82 the ids 0x83 and 0x84 are used
for values with metric and inch units.
Change-Id: I62bf2d2e583905c9fa90e4e7caa614a6fe6a7155
Signed-off-by: Juergen Kosel <juergen.kosel@gmx.de>
Reviewed-on: https://code.wireshark.org/review/30674
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
cmake_minimum_required() MUST be called even before project(), otherwise
some policies will not be correctly set. On the macOS build on Travis
for example, CMP0025 was accidentally set to "OLD" which resulted in
CMAKE_C_COMPILER_ID being reported as "Clang" instead of "AppleClang".
Change-Id: I20065e621628cde24946edb519d719f527936d87
Reviewed-on: https://code.wireshark.org/review/30685
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Using -4 or -6 to set an IP address pair to use in the dummy IP
header it is possible to generate a capture in which the next
layer protocol is undefined. Add a check that an next layer
protocol is always set.
Bug: 15275
Change-Id: Ifef54be7f708a0f168d2067f6f691e2611f25428
Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Reviewed-on: https://code.wireshark.org/review/30683
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
compressed_file_extension shouldn't include the ".", as we insert the
"." before it.
Use it when appending the extension, rather than hardwiring "gz" in two
places.
Change-Id: I89e3ed1df9a8457fdbb6e6386686176816f4671b
Reviewed-on: https://code.wireshark.org/review/30682
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
If the file is to be compressed, then:
if the type in which the file is to be written has a set of extensions
it uses, leave the file name alone if it ends with one of those
extensions followed by the extension for the compression type,
otherwise append the default extension for that file type followed by
the extension for the compression type;
if it doesn't, leave the file name alone if it ends with the extension
for the compression type, otherwise append the extension for the
compression type;
otherwise:
if the type in which the file is to be written has a set of extensions
it uses, leave the file name alone if it ends with one of those
extensions, otherwise append the default extension for that file type followed by
the extension for the compression type;
if it doesn't, leave the file name alone if it ends with the extension
for the compression type, otherwise append the extension for the
compression type.
Change-Id: I7c4093af28cc30d579a2ae9faa8f4164b4764001
Reviewed-on: https://code.wireshark.org/review/30681
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
The three merge_files routines (filename, tempfile, stdout) have exactly
the same code except for a single wtap_dump_open routine. Reduce code
duplication to ease further improvements to this file.
Change-Id: I4fa890730d54c11b3614e56cf4d3d3da1ae9f5fd
Reviewed-on: https://code.wireshark.org/review/30678
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Change-Id: I08d45c87c9232edcabfc69d25a773552fe9e0871
Fixes: v2.9.0rc0-2567-g43872a3a0e (""." in version numbers and file names isn't translated into other languages.")
Reviewed-on: https://code.wireshark.org/review/30680
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
"xxx.pcap.gz" is "xxx.pcap.gz" in any language. "3.0.1" is "3.0.1" in
any language.
Change-Id: I231a3f9bd21a3ea5d56a8e410d20b1bc3927540f
Reviewed-on: https://code.wireshark.org/review/30676
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Make sure the -i <pipe> documentation is consistent and correct.
Change-Id: I9019effb658f914ac754e4ae893eafbe7c4b4da1
Reviewed-on: https://code.wireshark.org/review/30675
Reviewed-by: Gerald Combs <gerald@wireshark.org>
If we have a single capture source and that capture source is pcapng and
we're writing a pcapng file, do the following:
- Pass its SHB and IDBs through unmodified. Don't save or write command
line interface IDBs.
- Save the most recent SHB and IDBs so that we can write them when we're
writing multiple output files.
If we have multiple capture sources, do the following:
- Write Dumpcap's SHB.
- Keep a global list of IDBs, consisting of both command line interfaces
and IDBs read from pcapng sources.
- When reading an EPB or ISB, remap its local interface number to its
corresponding global number.
Add Dumpcap pcapng section tests. Make the application IDs in the
"many_interfaces" captures unique.
Change-Id: I2005934c1f83d839727421960005f106d6c682dd
Reviewed-on: https://code.wireshark.org/review/30085
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Added dissection of field PID_DOMAIN_TAG. PID_DOMAIN_ID moved to
PID_RTI_DOMAIN_ID and PID_IS_RELIABLE moved to PID_DOMAIN_ID.
Change-Id: Ie189b2d2e66b705df202e7ee3e752aea5ddee271
Reviewed-on: https://code.wireshark.org/review/30664
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
When the LISP dissector was initially written, it followed a different
pattern for adding subtrees with a text label, which needs to be
modified while dissecting: proto_tree_add_item() +
proto_item_append_text() + proto_item_add_subtree().
This commit updates the code to use the more elegant
proto_tree_add_subtree_format() call.
Change-Id: Icb6424be3c9cdecbfe9bb5aa2d39f3ad3d1499e0
Signed-off-by: Lorand Jakab <ljakab@ac.upc.edu>
Reviewed-on: https://code.wireshark.org/review/30655
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Proper dependency tracking has been implemented such that tests that
require dumpcap are skipped when unavailable, let's enable tests again.
Use pytest for nicer traces.
Bug: 14949
Change-Id: I1751bed8bd62e1a69d6e19161f7517735ae96662
Reviewed-on: https://code.wireshark.org/review/30669
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Convert the old start_pinging routine to use pytest fixtures, rewriting
it to enable a different generator that uses (for example) UDP.
Remove the config module since it is no longer neded.
Change-Id: Ic4727157faab084b41144e8f16ea44f59c9037d8
Reviewed-on: https://code.wireshark.org/review/30659
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Add a new --capture-interface option to pytest, similar to test.py. It
will grab some Ethernet interface on Windows. An empty value overrides
this and disables capture tests. Remove the test.py --enable-capture
option since that is implied by the --capture-interface option.
Port the `test.py --program-path` option to pytest and additionally make
the pytest look in the current working directory if neither WS_BIN_PATH
nor --program-path are specified. Drop config.setProgramPath, this
allows tests to be run even if not all binaries are available.
With all capture tests converted to fixtures, it is now possible to run
tests when Wireshark is not built with libpcap as tests that depend on
cmd_dumpcap (or capture_interface) will be skipped.
Bug: 14949
Change-Id: Ie802c07904936de4cd30a4c68b6a5139e6680fbd
Reviewed-on: https://code.wireshark.org/review/30656
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
The test_tshark_io_direct_stdout test was failing because the command
"tshark -r test/captures/dhcp.pcap -w - > some.pcap" produced a corrupt
capture file which has the packet information appended at the end.
Change-Id: I1a79e98f1475c29d7dad3ff90d4cb689f46b0e57
Fixes: 57389a0c69 ("make tshark compile and work also when pcap is not available")
Reviewed-on: https://code.wireshark.org/review/30668
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Stig Bjørlykke