Allow "-U ?" as well as an empty argument; an empty argument is a bit
counterintuitive.
Simplify the introductory line of output - asking for a list of taps
isn't an error in which the user failed to supply a tap name, it's a
case where the user suplied a request for a list of tap names.
Just use fprintf() to print the list, and indent the elements of the
list, as we do with other lists of valid arguments.
List the valid arguments if the user specified an invalid argument as
well.
On Windows, a write to a pipe where the read side has been closed
apparently may return the Windows error ERROR_BROKEN_PIPE, which the
Visual Studio C library maps to EPIPE, or may return the Windows error
ERROR_NO_DATA, which the Visual Studio C library maps to EINVAL.
So, on Windows, for errors other than the ones for which we're reporting
a special error message, check for EINVAL with a *Windows* error of
ERROR_NO_DATA and, if that's what we have, don't print an error message;
otherwise, print an error message that reports a message based on the
Windows error (rather than a relatively uninformative "Invalid argument"
error).
This should fix issue #16192.
Clean up indentation while we're at it.
The right format to use is "%" G_GUINT64_FORMAT. A guint64 might be an
unsigned long or it might be an unsigned long long; do not assume which
one it will be on all platforms.
Add missing entries, regularize the descriptions, etc..
Note that pcap and pcapng are the native formats.
Fix various issues.
Update the editcap -F output to match urrent reality.
While we're at it, sort the libwiretap modules, putting observer.c in
the right place.
The default value for the CAN-ID Mask is currently 0. If no config is
present, all comparisons would be always true. This leads to all CAN
packets are being dissected by this dissector by default.
This is a huge performance problem and surely not intended.
This patch sets the default of the CAN-ID Mask to 0xffffffff, so that
in the unconfigured case, only the CAN-ID 0 would be dissected.
Since the intention is to add full decoding of the entire page, rewrite the function to use
add_tree_entries() and define decoding structures to avoid repeating the same code for
each decoded block.
Fetching the complete Wireshark repository in GitLab's CI currently
takes about 3.5 minutes. GitLab CI lets you do shallow cloning, but only
up to 1000 commits. This isn't sufficient for any of our jobs that might
need a reachable tag since it's currently about 1200 commits away in
master.
Set GIT_DEPTH to 1 (which appears to trigger the required shallow clone
logic in GitLab's CI), then deepen it by setting GIT_FETCH_EXTRA_FLAGS
to "--depth=5000". This is *should* be much faster than a full checkout
and still give us a reachable tag:
$ git rev-list --count v3.3.0rc0..v3.5.0rc0
2330
$ git rev-list --count v3.1.0rc0..v3.3.0rc0
2198
$ git rev-list --count v2.9.0rc0..v3.1.0rc0
3449
packet-ncsi.c:653:55: warning: Although the value stored to 'offset' is used in the enclosing expression, the value is never actually read from 'offset' [deadcode.DeadStores]
packet-mbim.c:2871:5: warning: Value stored to 'offset' is never read [deadcode.DeadStores]
packet-mbim.c:2976:5: warning: Value stored to 'offset' is never read [deadcode.DeadStores]
packet-mbim.c:4053:9: warning: Value stored to 'offset' is never read [deadcode.DeadStores]
Name the source to the code to read Observer files after the file
format, not the company that created it, got bought by JDSU, and then
ended up in Viavi when JDSU split.
Refer to the file format as "Viavi Observer" to reflect that.
Let individual file type/subtype modules register their
backwards-compatibility names, rather than having a centralized table
that would need to be updated along with the module.
We don't need to initialize first_section before calling
pcapng_read_section_header_block(); it doesn't depend on it being
initialized, and sets byte_swapped, version_major, and version_minor if
what it reads is a valid SHB, so we don't need to set those in
pcap_open().
We don't need to set shb_off until we've deemed this to be a pcapng
file, so do so at the same point that we initialize
We also don't need to initialize wblock until we call
pcapng_read_section_header_block(), so do so all in one place.
Added shortcuts:
- Mute/Unmute/Invert Mute
- Play/Pause/Stop
Removed outdated help in tooltip text. It makes no sense to use it, all
actions are available in context menu.
Instead of pcapng_open() calling pcap_block_read() to do all the work of
reading the initial SHB, have it do the read of the initial SHB itself,
by calling the same routines that pcap_block_read() calls.
That way, pcap_block_read() doesn't have to be prepared to be called to
read that block, so it can treat all issues with an SHB that it reads as
errors, rather than possibly reporting them as "not a pcapng file", and
it doesn't have to support being called without a pointer to the
pcapng_t for the file being read, as it no longer ever is. It can now
just return a gboolean success/failure indication.
That makes pcapng_open() a little more complicated but it makes
pcap_block_read() less complicated.
Fix some use of : as ' in comments while we're at it.
Show the first octet of the option, giving the filter type.
Only display the rest of the option as a string if the type is 0,
meaning it's a libpcap-style filter string.
While we're at it, clean up the dissection of the rest of the options:
* do more proto_tree_add_item_ret_XXX to get the option value;
* don't bother constructing a string for the value if we don't have to;
* use proto_tree_add_item_ret_display_string for string values, so we
know they're printable.
Currently organizational specific TLVs without payload cause an
exception which leads to a 'malformed packet' error. Add a check that
allows correctly parsing those TLVs.
Guy Harris