Commit Graph

250 Commits

Author SHA1 Message Date
Gerald Combs 775bbbcded Start using SPDX license identifiers.
A while back Graham pointed out the SPDX project (spdx.org), which is
working on standardizing license specifications:

https://www.wireshark.org/lists/wireshark-dev/201509/msg00119.html

Appendix V of the specification describes a short identifier
(SPDX-License-Identifier) that you can use in place of boilerplate in
your source files:

https://spdx.org/spdx-specification-21-web-version#h.twlc0ztnng3b

Start the conversion process with our top-level C and C++ files.

Change-Id: Iba1d835776714deb6285e2181e8ca17f95221878
Reviewed-on: https://code.wireshark.org/review/24302
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Reviewed-by: Balint Reczey <balint@balintreczey.hu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-11-09 20:03:51 +00:00
Ahmad Fatoum 9d49e13166 Remove superfluous null-checks before strdup/free
NULL checks were removed for following free functions:

- g_free "If mem is NULL it simply returns"
  https://developer.gnome.org/glib/stable/glib-Memory-Allocation.html#g-free

- g_slist_free(_full)? "NULL is considered to be the empty list"
  https://developer.gnome.org/glib/stable/glib-Singly-Linked-Lists.html

- g_strfreev "If str_array is NULL, this function simply returns."
  https://developer.gnome.org/glib/stable/glib-String-Utility-Functions.html#g-strfreev

- g_slice_free "If mem is NULL, this macro does nothing."
  https://developer.gnome.org/glib/stable/glib-Memory-Slices.html#g-slice-free

- g_match_info_free "not NULL... otherwise does nothing"
  https://developer.gnome.org/glib/stable/glib-Perl-compatible-regular-expressions.html#g-match-info-free

- dfilter_free defined in Wireshark code. Returns early when passed NULL
  epan/dfilter/dfilter.c

They were also removed around calls to g_strdup where applicable:

- g_strdup "If str is NULL it returns NULL."
  https://developer.gnome.org/glib/stable/glib-String-Utility-Functions.html#g-strdup

Change-Id: Ie80c2db89bef531edc3aed7b7c9f654e1d654d04
Reviewed-on: https://code.wireshark.org/review/23406
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: João Valverde <j@v6e.pt>
2017-10-15 12:38:51 +00:00
Mikael Kanstrup 287221e8d9 Free interface_options elements on cleanup
At shutdown the array keeping all interface_options is freed.
The array elements however are not making valgrind and ASAN
complain. Make sure the elements are freed on cleanup.

Ping-Bug: 13864
Change-Id: If8b810ea5f4f11c5ce770a9ffa6c2c791bc561fe
Reviewed-on: https://code.wireshark.org/review/23265
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-08-28 16:53:38 +00:00
Mikael Kanstrup 3b16cc8b21 iface_lists: Access ifaces member by reference
Change access of ifaces elements from by val to by reference.
With this change unnecessary copying of the whole struct is avoided
but even more important is that elements no longer have to be
removed and inserted whenever data is updated.

This change aims to make it more clear that ifaces elements shall
never directly be removed from the array. Instead use function
capture_opts_del_iface

NOTE: Code for GTK UI not updated

Ping-Bug: 13864
Change-Id: I04b65d5ee36526b30d959b8e5a2a48a3c7c4f15b
Reviewed-on: https://code.wireshark.org/review/23204
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-28 14:43:13 +00:00
Mikael Kanstrup e26926432d Free interface elements on cleanup
At shutdown the array keeping all network interfaces is freed.
The array elements however are not making valgrind and ASAN
complain. Make sure the elements are freed on cleanup.

Ping-Bug: 13864
Change-Id: I1efeb03f42fb6f0b87dada8ef50d85f47f93e0dc
Reviewed-on: https://code.wireshark.org/review/23202
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-28 14:42:28 +00:00
Mikael Kanstrup 8873c7e494 iface_lists: Access all_ifaces member by reference
Change access of all_ifaces elements from by val to by reference.
With this change unnecessary copying of the whole struct is avoided
but even more important is that elements no longer have to be
removed and inserted whenever data is updated.

This change aims to make it more clear that all_ifaces elements
shall never be removed from the array without freeing resources
via the capture_opts_free_interface_t function.

NOTE: Code for GTK UI not updated

Ping-Bug: 13864
Change-Id: I36742cb1d5c8daa136c9d3732a044a7c8e5c7fe7
Reviewed-on: https://code.wireshark.org/review/23201
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-28 14:41:43 +00:00
Håkon Øye Amundsen 018f6bff18 extcap: Interface Toolbar support on Windows
Add support for extcap control pipes on Windows.
Improved read loop in InterfaceToolbarReader.
Delay opening control pipes until extcap has opened the fifo pipe.
Make extcap_example.py work on Windows.

Bug: 13833
Change-Id: I4b47d25452637759b8a3be53be48eee5365bc0e4
Reviewed-on: https://code.wireshark.org/review/23211
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-28 05:48:01 +00:00
Stig Bjørlykke 4540195025 extcap: Create unique pipe names for each interface
On Windows the pipe names does not get random characters appended.
Add the interface name and pipe type to make it unique.

This partly fixes the issue with capturing from multiple extcap
interfaces on Windows.

Ping-Bug: 13653
Ping-Bug: 13833
Change-Id: I4290b37cf789bf77608993682a803aca29513d28
Reviewed-on: https://code.wireshark.org/review/23158
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-23 07:26:18 +00:00
Ahmad Fatoum be69761c78 Fix requesting hardware timestamps without -k
The interface_options struct passed to dumpcap is populated
differently when running Wireshark with and without -k.

Previously, only with -k was there a valid pointer in
interface_opts.timestamp_type

Fixes: aca55a2 ("Add hardware timestamping support")
Signed-off-by: Ahmad Fatoum <ahmad.fatoum@siemens.com>
Change-Id: Ic7ecc5a1190c28197d6a7271f1b353f74d43ca61
Reviewed-on: https://code.wireshark.org/review/23160
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-08-22 12:18:12 +00:00
Ahmad Fatoum aca55a29f7 Add hardware timestamping support
pcap provides a pcap_set_tstamp_type function, which can be used to request
hardware timestamps from a supporting kernel.

This patch adds support for aforementioned function as well as two new
command line options to dumpcap, wireshark and tshark:

    --list-time-stamp-types
                             List time stamp types supported for the interface
    --time-stamp-type <type>
                             Change the interface's timestamp method

Name choice mimics those used by tcpdump(1), which already supports this
feature. However, unlike tcpdump, we provide both options unconditionally.
If Wireshark was configured without pcap_set_tstamp_type being available,
--list-time-stamp-types reports an empty list.

Change-Id: I418a4b2b84cb01949cd262aad0ad8427f5ac0652
Signed-off-by: Ahmad Fatoum <ahmad.fatoum@siemens.com>
Reviewed-on: https://code.wireshark.org/review/23113
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-22 07:55:26 +00:00
Sake Blok 3803e00367 Add option to use wall-clock intervals
Add the "interval" option to "-b". Each new capture starts at the
exact start of a time interval. For instance, using -b interval:3600
will start a new capture file at each whole hour.

Changed the duration option in the GUI interfaces to use the new
interval option.

Change-Id: I0180c43843f5d2f0c2f50153c9ce42ac7fa5aeae
Reviewed-on: https://code.wireshark.org/review/22428
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Sake Blok <sake.blok@SYN-bit.nl>
2017-07-03 16:41:37 +00:00
Guy Harris d0865fd619 Allow bigger snapshot lengths for D-Bus captures.
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except
for D-Bus captures.  Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for
them, because that's the largest possible D-Bus message size.  See

	https://bugs.freedesktop.org/show_bug.cgi?id=100220

for an example of the problems caused by limiting the snapshot length to
256KB for D-Bus.

Have a snapshot length of 0 in a capture_file structure mean "there is
no snapshot length for the file"; we don't need the has_snap field in
that case, a value of 0 mean "no, we don't have a snapshot length".

In dumpcap, start out with a pipe buffer size of 2KB, and grow it as
necessary.  When checking for a too-big packet from a pipe, check
against the appropriate maximum - 128MB for DLT_DBUS, 256KB for
everything else.

Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20
Reviewed-on: https://code.wireshark.org/review/21952
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-05 05:28:26 +00:00
Stig Bjørlykke 77751c94f1 Qt: Add interface toolbar support
An extcap utility can provide configuration for controls to use in a
GUI interface toolbar.  This controls are bidirectional and can be
used to control the extcap utility while capturing.

This is useful in scenarios where configuration can be done based on
findings in the capture process, setting temporary values or give other
inputs without restarting current capture.

Todo:
- Add support for Windows

Change-Id: Ie15fa67f92eb27d8b73df6bb36f66b9a7d81932d
Reviewed-on: https://code.wireshark.org/review/19982
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2017-04-25 06:19:39 +00:00
Guy Harris 77cad8561c Move the filter file reading code to libui.
It doesn't belong in libwireshark, as it doesn't affect dissection, but
it *does* belong in libui, as it's helper code for the UIs.

Change-Id: I8a5e0640a299a08e9ec1917dd253197438ebfdbc
Reviewed-on: https://code.wireshark.org/review/20974
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-09 04:25:52 +00:00
Dario Lombardo 7c0c580c4b wiretap: add cleanup routine.
The cleanup routine has been added to exit section of the applications.
Those which required a exit restyle have been patched as well.

Change-Id: I3a8787f0718ac7fef00dc58176869c7510fda7b1
Reviewed-on: https://code.wireshark.org/review/19949
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
2017-02-14 10:22:20 +00:00
Dario Lombardo 93a5c83f0a capture_opts: free memory on exit to avoid leak.
This required a restyle of the way the different apps exit.

Change-Id: Iedf728488954cc415b620ff0284d2e60f38f87d2
Reviewed-on: https://code.wireshark.org/review/19780
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
2017-02-02 22:04:14 +00:00
Guy Harris 8629e60922 More signed vs. unsigned argument cleanups.
Use the get.*guint32 routines to get unsigned values.

Change-Id: I75e83b2d21bdf08c7c995e36e4deb3b1c6d6959d
Reviewed-on: https://code.wireshark.org/review/17651
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-09-11 20:49:05 +00:00
Roland Knall c611eded22 extcap: Use stderr to print error message
This patch reads out the stderr messages from an extcap
utility and displays it to an user. It was tested on Qt
but not on GTK, but should work their as well.

On Mac OS/X and Windows the child_watch does not behave
as it was intended. Therefore in extcap_cleanup, the callbacks
are called manually, if and only if, they have not been
called already.

The reason why it displays two error messages is, that
by the time the first one is being displayed, glib has not
returned from the spawned process on Linux yet. So there
is no way to add the stderr correctly, and putting a handler
to stderr into interface_opts will lead to memory errors,
cause then the code tries to access memory outside of its
protection.

Bug: 11892
Change-Id: I2db60dd480fed3e01428b91a705057e4f088bd15
Reviewed-on: https://code.wireshark.org/review/12954
Reviewed-by: Roland Knall <rknall@gmail.com>
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-07-30 21:15:39 +00:00
Roland Knall f2786bc8ff extcap: Remove g_spawn_helper support
Move g_spawn to separate file and implement functions to
 use Windows based method of spawning, instead of the glib
 based version

Change-Id: Ibae03d834ec86531eba37dc8768fbf17ddadf57f
Reviewed-on: https://code.wireshark.org/review/16049
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
Reviewed-by: Roland Knall <rknall@gmail.com>
2016-07-05 11:54:43 +00:00
Guy Harris 3f49e897f6 Pull quit_after_cap out of the global capture options.
Really, all the GUI-related options should be pulled out, so they're not
cluttering up dumpcap and tshark.

Change-Id: I0276dee2be48bae3498a819d8c0c2747fe1352e7
Reviewed-on: https://code.wireshark.org/review/16180
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-28 00:21:53 +00:00
Mike78 ef752689da Allow/Create an option to use "capture filter" labels defined in wireshark GUI from CLI
Move ui/filters.[ch] to filter_files.[ch] because dumpcap is using functionality.

Bug: 8091
Change-Id: I195c82fc023f97d6f331b8718c45a2d83d30faea
Reviewed-on: https://code.wireshark.org/review/5925
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-27 13:40:24 +00:00
Mikael Kanstrup 3120d1f801 Fix memory leaks in all_ifaces when interface list changes
Valgrind report leaks of several allocations like these:
590 bytes in 50 blocks are possibly lost in loss record 29,818 of 31,670
   at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0xCB9C8A7: __vasprintf_chk (vasprintf_chk.c:82)
   by 0xA3D8DCA: g_vasprintf (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.4)
   by 0xA3B846C: g_strdup_vprintf (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.4)
   by 0xA3B850B: g_strdup_printf (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.4)
   by 0x6F4B51: scan_local_interfaces (iface_lists.c:254)
   by 0x6EF3D8: iface_mon_handler2 (iface_monitor.c:113)
   by 0xBE56F1D: ??? (in /lib/libnl-3.so.200.3.0)
   by 0xBA16F19: ??? (in /usr/lib/libnl-route-3.so.200.3.0)
   by 0xBE54E5E: nl_cache_parse (in /lib/libnl-3.so.200.3.0)
   by 0xBE585CA: nl_msg_parse (in /lib/libnl-3.so.200.3.0)
   by 0x6EF372: iface_mon_handler (iface_monitor.c:123)

When the list of network interfaces is updated allocations done
for global_capture_opts.all_ifaces elements leak memory. Fixed by
introducing a helper function to be used for removing an interface_t
element from all_ifaces array. While at it also fixed misc leaks when
updating individual allocated records of all_ifaces elements.

Change-Id: I035e6936a44edeef2ebe4780931c14cde99e93a4
Reviewed-on: https://code.wireshark.org/review/12209
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2015-12-11 10:38:32 +00:00
Guy Harris 0162e54075 Clean up includes of unistd.h, fcntl.h, and sys/stat.h.
Have wsutil/file_util.h include them on UN*X, just as it includes io.h
on Windows, so we can have a rule of "if you do file operations, include
<wsutil/file_util.h> and use the routines in it".

Remove includes of unistd.h, fcntl.h, and sys/stat.h that aren't
necessary (whether because of the addition of them to wsutil/file_util.h
or because they weren't needed in the first place).

Change-Id: Ie241dd74deff284e39a5f690a297dbb6e1dc485f
Reviewed-on: https://code.wireshark.org/review/11619
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-07 21:52:23 +00:00
Guy Harris 6704c8a5e9 Don't include stuff from libwireshark.
Dumpcap captures packets, and supports the usual capture options, so it
needs this, but it does *not* link with libwireshark (deliberately, so
that the libwireshark code isn't linked into a program that might run
with special privileges), so we must not depend on anything in
libwireshark.

Change-Id: Id975fd6a83a4b2a493c67493e41e69b784a050aa
Reviewed-on: https://code.wireshark.org/review/11546
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-04 09:13:32 +00:00
Guy Harris ff9f9fc431 Don't include "file.h" if you don't need it.
It ends up dragging in libwireshark headers, which programs not linking
with libwireshark shouldn't do.  In particular, including
<epan/address.h> causes some functions that refer to libwireshark
functions to be defined if the compiler doesn't handle "static inline"
the way GCC does, and you end up requiring libwireshark even though you
shouldn't require it.

Move plurality() to wsutil/str_util.h, so that non-libwireshark code can
get it without include epan/packet.h.  Fix includes as necessary.

Change-Id: Ie4819719da4c2b349f61445112aa419e99b977d3
Reviewed-on: https://code.wireshark.org/review/11545
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-04 08:46:30 +00:00
Pascal Quantin 3a220ed25d Fix extcap interface capture with tshark
Extcap parameters must be saved when doing the interface number/name matching,
otherwise extcap program is not launched and pipe is not created

Change-Id: Iaa0c9ad145049ee6e7a285dfca904ceb0baf417f
Reviewed-on: https://code.wireshark.org/review/8017
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-04-13 17:44:38 +00:00
Guy Harris 083f6b6e6d Have a #define for whether the capture buffer size can be set.
It can be set if either 1) this is Windows (where we're assumed to be
using WinPcap, which includes calls to set the buffer size) or 2) we
have pcap_create() (in which case we also have pcap_set_buffer_size(),
at least in a normal libpcap release).

Use that rather than testing "defined(_WIN32) ||
defined(HAVE_PCAP_CREATE)"; that makes it a bit more obvious what's
being tested.

Change-Id: Id9f8455019d19206b04dd6820a748cb97ae5ad12
Reviewed-on: https://code.wireshark.org/review/7816
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-03-25 03:22:33 +00:00
Guy Harris e3477bd136 Get rid of some no-longer-necessary casts.
g_ascii_isXXX() can be handed a char value safely; they won't try to use
it as an index into a table before checking it.

Change-Id: Icf80163fb5f9dccd0b97917e318b1db0bf3e0cf8
Reviewed-on: https://code.wireshark.org/review/4801
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-17 23:58:23 +00:00
Guy Harris a91799ebfa Don't use ctype.h routines.
That avoids locale dependency and handles possibly-signed chars(which
we weren't always doing before).

Change-Id: I89e50678abb8c3e535081c92ca25bc1bab672c68
Reviewed-on: https://code.wireshark.org/review/4798
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-17 23:43:09 +00:00
Bill Meier 1b8b2a8aa8 Add editor modelines; Adjust whitespace as needed.
Change-Id: I4da7b335d905dbca10bbce03aa88e1cdeeb1f8ad
Reviewed-on: https://code.wireshark.org/review/4626
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-10-12 18:58:32 +00:00
Tomasz Moń 20795925ff Update capture_opts in extcap_cleanup().
This fixes redundant extcap_pid handle close that could occur in
capture_opts_del_iface() which resulted in unhandled exception on
Windows.

Change-Id: I06b680fcb65cd6fd854a25fb1b01248dce3251a1
Reviewed-on: https://code.wireshark.org/review/4447
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-10-04 11:17:01 +00:00
Pascal Quantin 88a3b3027d Extcap: prevent a GLib assert when interface_opts.extcap_args is NULL
I was able to trigger it when trying to change the options of extcap_example.py interface

Change-Id: I9ecff51d47b3ef6e178637b31d49af46a1928acd
Reviewed-on: https://code.wireshark.org/review/3822
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-08-26 14:58:04 +00:00
Graham Bloice 97546165fa Modify includes of config.h so that out-of-tree builds, i.e. CMake
don't pick up the in-tree copy.

Change-Id: I7ec473876cdba1a025c52362d7f6adc62d24ce71
Reviewed-on: https://code.wireshark.org/review/3798
Petri-Dish: Graham Bloice <graham.bloice@trihedral.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
2014-08-24 08:04:08 +00:00
Roland Knall bed29af46d Extcap Capture Interface
Extcap is a plugin interface, which allows for the usage
 of external capture interfaces via pipes using a predefined
 configuration language which results in a graphical gui.

 This implementation seeks for a generic implementation,
 which results in a seamless integration with the current
 system, and does add all external interfaces as simple
 interfaces.

 Windows Note: Due to limitations with GTK and Windows,
 a gspawn-winXX-helper.exe, respective gspawn-winXX-helper-console.exe
 is needed, which is part of any GTK windows installation.

 The default installation directory from the build is an extcap
 subdirectory underneath the run directory. The folder used by
 extcap may be viewed in the folders tab of the about dialog.

 The default installation directory for extcap plugins with
 a pre-build or installer version of wireshark is the extcap
 subdirectory underneath the main wireshark directory.

 For more information see:

  http://youtu.be/Nn84T506SwU
  bug #9009

 Also take a look in doc/extcap_example.py for a Python-example
 and in extcap.pod for the arguments grammer.

 Todo:
   - Integrate with Qt - currently no GUI is generated, but
     the interfaces are still usable

Change-Id: I4f1239b2f1ebd8b2969f73af137915f5be1ce50f
Signed-off-by: Mike Ryan <mikeryan+wireshark@lacklustre.net>
Signed-off-by: Mike Kershaw <dragorn@kismetwireless.net>
Signed-off-by: Roland Knall <rknall@gmail.com>
Reviewed-on: https://code.wireshark.org/review/359
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-08-21 03:34:02 +00:00
Guy Harris f6ce0cdacd Get rid of NO_INTERFACES_FOUND - it's not an error.
It just means "pcap didn't give me any interfaces, and didn't report an
error".  Hopefully, in the future, there will be pcap APIs that
distinguish between the (admittedly unlikely, these days) case of "there
really *are* no interfaces on which *anybody* can capture" and "you
don't have sufficient permission to capture", and we can report the
latter as an error.  (Given that pcap supports more than just "regular
interfaces", though, there are cases where you don't have permission to
capture on those but you have permission to capture raw USB traffic, for
example, so perhaps what's really needed is per-interface indications of
permissions.)

Change-Id: I7b8abb0829e8502f5259c95e8af31655f79d36a1
Reviewed-on: https://code.wireshark.org/review/3169
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-07-22 23:53:49 +00:00
Graham Bloice e11db2ea03 Rename parameter if_index to stop clang warning:
capture_opts.c:1017:61: error: declaration of 'index' shadows a global declaration [-Werror=shadow]

Change-Id: Ie409b4fa7abeb85e460bea398735cdc98d9034b1
Reviewed-on: https://code.wireshark.org/review/3041
Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
2014-07-14 14:25:36 +00:00
Martin Kaiser 55733ea170 fix scan_local_interfaces()
when we delete an interface from all_ifaces, delete it from ifaces as well
remove its selected status if it was selected

at the moment, an interface that was used for capturing before will
never be removed from the list of interfaces even if it becomes
unavailable as it remains in ifaces and will be re-added to all_ifaces
in scan_local_interfaces()

new helper function capture_opts_del_iface() to delete an entry from ifaces and
free all its components

Change-Id: Ie3271a7ed086367e511d3a971f3b68cfc014115d
Reviewed-on: https://code.wireshark.org/review/2965
Reviewed-by: Evan Huus <eapache@gmail.com>
2014-07-12 14:06:03 +00:00
Guy Harris 9e6487f247 Move utility routines for capturing into a libcaputils static library.
Some of those routines are used only in dumpcap; others are used in
TShark and Wireshark as well.

Change-Id: I9d92483f2fcff57a7d8b6bf6bdf2870505d19fb7
Reviewed-on: https://code.wireshark.org/review/2841
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-07-04 07:25:26 +00:00
Guy Harris df5833723c Move capture_ui_utils.[ch] to libui.
Change-Id: Id0f3d4d60a1acc7aa64fd3737b8f16df5bca4e5a
Reviewed-on: https://code.wireshark.org/review/2708
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-06-30 01:36:56 +00:00
Guy Harris fe42762f23 Move some more stuff into wsutil.
Move the routines to parse numerical command-line arguments there.

Make cmdarg_err() and cmdarg_err_cont() routines in wsutil that just
call routines specified by a call to cmdarg_err_init(), and have
programs supply the appropriate routines to it.

Change-Id: Ic24fc758c0e647f4ff49eb91673529bcb9587b01
Reviewed-on: https://code.wireshark.org/review/2704
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-06-29 23:03:24 +00:00
Guy Harris adf6b1a8df For capchild headers, include <capchild/XXX.h>.
Change-Id: I780c69ee637dcd9846756a2e2d6a35baf02d826d
Reviewed-on: https://code.wireshark.org/review/2594
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-06-24 00:28:08 +00:00
Alexis La Goutte 296591399f Remove all $Id$ from top of file
(Using sed : sed -i '/^ \* \$Id\$/,+1 d')

Fix manually some typo (in export_object_dicom.c and crc16-plain.c)

Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8
Reviewed-on: https://code.wireshark.org/review/497
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-04 14:27:33 +00:00
Roland Knall 5f78d0f4f1 Fix ui/iface_lists.c - type attribute is not copied
temp is a clone of the local if_info, but the type
 attribute is not copied correctly

 Additionally, the if_type member is exposed via the 
 capture options

Change-Id: Id53f0dfd1e127921e1b89bbf78cb431ee257a96c
Reviewed-on: https://code.wireshark.org/review/404
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-03-02 09:53:40 +00:00
Jakub Zawadzki 65db82872c When including <epan/prefs.h> don't force inclusion of <epan/uat.h>
svn path=/trunk/; revision=53769
2013-12-03 22:16:49 +00:00
Chris Maynard 93f15d640c Specify SI units for the max filesize autostop condition. For now, keep the capture buffer size in IEC units, but document it as such.
#BACKPORT(1.10, 1.8(?))

svn path=/trunk/; revision=53728
2013-12-02 19:17:12 +00:00
Guy Harris 4558ff0ef2 Add a comment explaining what setting
capture_opts->default_options.linktype to -1 means.

svn path=/trunk/; revision=53591
2013-11-26 02:43:06 +00:00
Michael Mann 36e13a4c55 Bugfix "Restart the running live capture" when using multiple files makes a long filename. Bug 2274 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2274)
Yes this solution leaks memory, but I think the handful of bytes leaked is worth fixing this nuisance.  Won't backport until leak is fixed though.

svn path=/trunk/; revision=52793
2013-10-23 15:31:48 +00:00
Chris Maynard bc654875f0 Handle the 2GiB boundary case of the max filesize autostop condition properly so that we avoid overflow conditions and so that we ensure we don't capture more than 2GiB. Also, document the max filesize autostop value of 2GIB as well as indicating that it's truly GiB and not GB.
This fixes the problem reported on ask: http://ask.wireshark.org/questions/23891/wireshark-wont-run-with-multiple-capture-files

#BACKPORT(1.10) ... not sure about 1.8?

svn path=/trunk/; revision=51576
2013-08-29 18:15:13 +00:00
Martin Kaiser 8905991b67 only one --capture-comment option may be given to dumpcap
svn path=/trunk/; revision=50946
2013-07-27 16:28:03 +00:00
Martin Kaiser 82ea635aa6 command line option --capture-comment for dumpcap
svn path=/trunk/; revision=50945
2013-07-27 16:25:08 +00:00
Martin Kaiser e04a12af8c add capture_comment to the capture_options structure
svn path=/trunk/; revision=50943
2013-07-27 16:13:29 +00:00
Luis Ontanon c780d97411 forgot from the las commit...
svn path=/trunk/; revision=50191
2013-06-27 17:27:41 +00:00
Anders Broman 78e334b845 From Mike Garratt:
Friendly Names support causing unnecessary delay when Wireshark starts.

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8034

svn path=/trunk/; revision=49752
2013-06-04 04:36:19 +00:00
Guy Harris 8596d17d7f Pull the capture-session state information out of capture_opts and put
it into a separate capture_session structure.  capture_opts should
contain only user-specified option information (and stuff directly
derived from it, such as the "capturing from a pipe" flag).

svn path=/trunk/; revision=49493
2013-05-22 07:44:28 +00:00
Guy Harris 1ca63098ac Rename capture_opts_trim_iface() to
capture_opts_default_iface_if_necessary(), to reflect what it actually
does.

svn path=/trunk/; revision=49491
2013-05-22 04:49:31 +00:00
Guy Harris 13a80ce39f Don't fill in err_str if we're not going to use it.
(This helps flag capture_interface_list() calls that should perhaps be
checked to see whether an error should be reported if they fail.)

svn path=/trunk/; revision=49281
2013-05-13 23:23:33 +00:00
Guy Harris 1f1e288b42 Eliminate some includes of ui/simple_dialog.h by files that don't use
anything from it.

svn path=/trunk/; revision=49278
2013-05-13 22:52:46 +00:00
Guy Harris 39779a7bee Send the output of the -D and -L options to the standard output rather
than the standard error.

In Wireshark on Windows, create a console before doing so and destroy it
before exiting.  Don't do that in TShark or dumpcap, as those are
console-mode programs on Windows.

This should fix bug 8609 and still allow "wireshark -D" and "wireshark
-L" to work when the standard output isn't redirected.

svn path=/trunk/; revision=49025
2013-04-25 05:47:11 +00:00
Irene Rüngeler 44e6a88b13 Add interface options preferences.
svn path=/trunk/; revision=48275
2013-03-13 12:38:08 +00:00
Jeff Morriss d0992bf8cd Add a #define for the default capture buffer size and use it.
svn path=/trunk/; revision=47942
2013-02-28 15:27:56 +00:00
Anders Broman 6cbcb0d94d Increase the default buffer size to 2MB.
svn path=/trunk/; revision=47920
2013-02-27 20:38:43 +00:00
Guy Harris 8ed7a73e22 Fix a bunch of warnings.
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of
sizeof.

Cast away some implicit 64-bit-to-32-bit conversion errors due to use of
strtol() and strtoul().

Change some data types to avoid those implicit conversion warnings.

When assigning a constant to a float, make sure the constant isn't a
double, by appending "f" to the constant.

Constify a bunch of variables, parameters, and return values to
eliminate warnings due to strings being given const qualifiers.  Cast
away those warnings in some cases where an API we don't control forces
us to do so.

Enable a bunch of additional warnings by default.  Note why at least
some of the other warnings aren't enabled.

randpkt.c and text2pcap.c are used to build programs, so they don't need
to be in EXTRA_DIST.

If the user specifies --enable-warnings-as-errors, add -Werror *even if
the user specified --enable-extra-gcc-flags; assume they know what
they're doing and are willing to have the compile fail due to the extra
GCC warnings being treated as errors.

svn path=/trunk/; revision=46748
2012-12-26 05:57:06 +00:00
Jeff Morriss 20211340e5 Make the "-g" argument to tshark actually work (by passing it to dumpcap).
svn path=/trunk/; revision=46515
2012-12-12 03:25:35 +00:00
Guy Harris bd976ae6c0 On UN*X, if an interface has a description, use it as the "friendly
name".  If it doesn't have a description, on OS X, use the System
Configuration framework to attempt to get a "friendly name" for
interfaces.

If a loopback device doesn't have a friendly name, give it "Loopback" as
the friendly name.

Move the "turn a CFString into a mallocated C string" routine into
common code, as it's used in more than one place.

svn path=/trunk/; revision=46131
2012-11-22 06:02:49 +00:00
Guy Harris ca74add1c9 In capture_opts_add_iface_opt(), only *require* us to get the interface
list if the user specified a number; otherwise, if we couldn't get the
list, just use what the user specified, so they can specify interfaces
in order to test them to see why they're not showing up in the list.

svn path=/trunk/; revision=46112
2012-11-21 18:11:57 +00:00
Guy Harris 4c019d6807 If we don't find the specified interface name in the list, use it
anyway, so that, for example, if an interface doesn't show up in the
list for some reason, the user can try specifying it explicitly for
testing purposes.

svn path=/trunk/; revision=46109
2012-11-21 17:33:02 +00:00
Guy Harris d415d3d87c On error, have capture_opts_trim_iface() return the exit status that
should be used (on success, have it return 0).  Exit with that exit
status; if the problem is that we couldn't get the interface list or if
there are no interfaces in that list, return 2, as that's not a
command-line syntax error.

svn path=/trunk/; revision=46108
2012-11-21 17:14:54 +00:00
Guy Harris fbaac1330a We don't use get_windows_interface_friendlyname() in capture_opts.c, so
we don't need to include capture_win_ifnames.h.

Clean up white space.

svn path=/trunk/; revision=46095
2012-11-20 01:12:57 +00:00
Jeff Morriss 92aff2d548 Failure to find the interface should cause *shark to exit with a status of 1, not 2.
svn path=/trunk/; revision=46089
2012-11-19 21:41:40 +00:00
Jeff Morriss 89c33a8266 As suggested by Evan: just make the variable a size_t instead of casting away the warning.
svn path=/trunk/; revision=46088
2012-11-19 21:32:39 +00:00
Jeff Morriss 06efe50e5f I'm pretty confident the string length will fit in 32 bits; cast away the "possible loss of data" warning on the Win64 build.
svn path=/trunk/; revision=46087
2012-11-19 21:00:44 +00:00
Anders Broman 28474fe8ef From Mike Garratt:
Friendly Names for interfaces on Windows

Notes on the changes the patch covers:
* if_info_t struct: addition of friendly_name
* Dumpcap Interface list format changes:
  + Win32: "dumpcap -D" shows friendly_name in place of descript if known
  + All: machine interface "dumpcap -D -Z none" includes friendly_name in the
list in addition to the existing parameters
* interface_options struct: addition of console_display_name
  + When an interface name is displayed in a console, it will typically be the
console_display_name (instead of name). 
  + console_display_name is used as the basis of the autogenerated temp
filenames
  + console_display_name is typically set to the friendly_name if known,
otherwise it is set to the interface name
* Enhancements to capture_opts_add_iface_opt() (the function which process -i
options).
  + Can now specify the interface using its name and friendly_name
  + Interface name matching is case insenstive
  + Name matching first attempts exact matching, then falls back to prefix
matching
    (e.g. dumpcap -i local)
  + Validates interface names, instead of blindly sending them off to
winpcap/libpcap
  + Interface specification by number is still supported.
* capture_opts_trim_iface() has been refactored:
  + Instead of repeating a decent chunk of the cost in
capture_opts_add_iface_opt(), it calls capture_opts_trim_iface() to specify the
interface.
* introduction of capture_win_ifnames.[ch] (windows only code)
  + Implements static function GetInterfaceFriendlyNameFromDeviceGuid() - a
windows version independant function to convert an interface guid into its
friendly name.  Uses published api functions on windows vista and higher, but
falls back to unpublished API functions on older windows releases.
  + void get_windows_interface_friendlyname(/* IN */ char
*interface_devicename, /* OUT */char **interface_friendlyname); - extracts the
GUID from the interface_devicename, then uses
GetInterfaceFriendlyNameFromDeviceGuid() to do the resolution
* Auto temp filename generation:
  + Now uses wireshark_pcapng_* or  wireshark_pcap_* depending on file format
  + Basis temp filename format on console_display_name
  + Win32: if console_display_name is a windows interface guid, extracts
numbers from GUID here (instead of in interface option processing) 

GUI CHANGES:
* Dialog that displays when you click the "Manage Interfaces" button (within
Capture Options dialog) has been renamed from "Add new interfaces" to
"Interface Management"
* ui/gtk/capture_dlg.c: new_interfaces_w variable renamed to
interface_management_w
* Win32: Local Interfaces tab on Interface Management dialog, shows includes
friendly name as far left column
* Interface Management dialog defaults to larger size on win32 - so it fits
without resizing local interfaces tab
* Interface Management dialog now saves preferences when you click the apply
button (local hidden interfaces was not persisting across restarts)
* Tweaks: "Interface Details" dialog (Interface list->Capture Interfaces ->
Details):
  + "Friendly Name" renamed to "NDIS Friendly Name"
  + Added "OS Friendly Name" to the top of the list
* Win32: The "Capture Interfaces" dialog now shows the friendly name instead of
device guid
* Welcome screen:
  + The height of the interface list scrollbox dynamically adjusts & updates to
the number visible interfaces.
    Up to 10 interfaces can be listed without a scroll bar, the minimum height
is for 2 interfaces. 
  + Win32: now shows just the Friendly Name if known - in place of
"Interfacename_Guid:(Description)"

svn path=/trunk/; revision=46083
2012-11-19 20:07:27 +00:00
Jeff Morriss 3551a86c36 We always HAVE_CONFIG_H so don't bother checking whether we have it or not.
svn path=/trunk/; revision=45015
2012-09-20 01:29:52 +00:00
Irene Rüngeler bb1e018dc7 Fix for bug #7634. Print 'unspecified' in case a string is NULL.
svn path=/trunk/; revision=44512
2012-08-15 08:08:17 +00:00
Jakub Zawadzki bf81b42e1e Update Free Software Foundation address.
(COPYING will be updated in next commit)

svn path=/trunk/; revision=43536
2012-06-28 22:56:06 +00:00
ruengeler ea68381088 Remove lines that are not needed.
svn path=/trunk/; revision=42208
2012-04-23 13:47:45 +00:00
ruengeler 0819722ad8 Fix bug #7178 reported by aparan
svn path=/trunk/; revision=42206
2012-04-23 12:34:16 +00:00
Guy Harris fa64659e93 Closing a capture file has nothing to do with the list of interfaces on
which to do a live capture; don't clear the latter list when closing the
capture file.

collect_ifaces() should clear out the existing list of interfaces before
filling that list up with the interfaces selected by the user.  In
addition, when it frees up interfaces in that list, it should free up
the strings attached to those interfaces.

svn path=/trunk/; revision=41517
2012-03-13 03:48:27 +00:00
Guy Harris 3af7f28931 capture_opts_add_iface_opt() is not used outside capture_opts.c; make it
static.

svn path=/trunk/; revision=41494
2012-03-12 02:53:21 +00:00
Guy Harris 6f3ee54d62 Add a comment to indicate what collect_ifaces() does.
svn path=/trunk/; revision=41490
2012-03-11 20:01:11 +00:00
Guy Harris 1a5e1acdf3 Actually, you only have monitor mode support if you have pcap_create() -
without pcap_create() and pcap_activate() you don't have any API to turn
it on.

svn path=/trunk/; revision=40725
2012-01-25 19:40:22 +00:00
Jeff Morriss 91b873184f monitor_mode_enabled is only available on WIN32 or if we HAVE_PCAP_CREATE.
svn path=/trunk/; revision=40717
2012-01-25 14:29:09 +00:00
Michael Tüxen 14b1a44c0f Third try. This time pipes and stdin are supported and the
test scripts are passed.

Use a global list containing all interfaces and only change
properties of the entries when changes are made in the GUI.
Do not misuse the list of interfaces specified on the command
line anymore.

This patch does not provide any new functionality, it just
provides the base for future extensions like removing
remote interface, mulitple airpcap devices and multiple
pipes.

This patch was provided by Irene Ruengeler.

svn path=/trunk/; revision=40715
2012-01-25 13:04:32 +00:00
Michael Tüxen 4fece25e7f We need a 3rd try. (After learning how to run the testuite on Windows locally).
svn path=/trunk/; revision=40695
2012-01-24 17:12:56 +00:00
Michael Tüxen 08d6785412 Second try. This time pipes and stdin are supported.
Use a global list containing all interfaces and only change
properties of the entries when changes are made in the GUI.
Do not misuse the list of interfaces specified on the command
line anymore.

This patch does not provide any new functionality, it just
provides the base for future extensions like removing
remote interface, mulitple airpcap devices and multiple
pipes.

This patch was provided by Irene Ruengeler.


svn path=/trunk/; revision=40693
2012-01-24 16:05:26 +00:00
Guy Harris 3864d5d19d Add an additional DONT_HAVE_PCAP return value from get_interface_list()
and capture_interface_list().  Return it if, on Windows, we ask for the
interface list but don't have WinPcap installed.  Handle it like
CANT_GET_INTERFACE_LIST.

svn path=/trunk/; revision=40334
2011-12-29 22:49:49 +00:00
Michael Tüxen c219f2eea5 Back out infrastructure change. We missed supporting
stdin and pipes.




svn path=/trunk/; revision=39498
2011-10-20 19:44:40 +00:00
Michael Tüxen 95ae2fe13a Use a global list containing all interfaces and only change
properties of the entries when changes are made in the GUI.
Do not misuse the list of interfaces specified on the command
line anymore.

This patch does not provide any new functionality, it just
provides the base for future extensions like removing
remote interface, mulitple airpcap devices and multiple
pipes.

This patch was provided by Irene Ruengeler.

svn path=/trunk/; revision=39495
2011-10-20 18:17:54 +00:00
Gerald Combs db240c2b5e Replace "-Q" with "WIRESHARK_QUIT_AFTER_CAPTURE" as discussed in bug 6256.
svn path=/trunk/; revision=38784
2011-08-29 21:16:29 +00:00
Michael Tüxen f98587d686 Undo the checking of command line interfaces. It might the a pipe...
svn path=/trunk/; revision=38146
2011-07-21 17:30:42 +00:00
Michael Tüxen 91df20357a Make sure that the interfaces listed in ifaces really exist.
Some protection code in capture / options.
Obtained from Irene Ruengeler.


svn path=/trunk/; revision=38142
2011-07-21 15:23:46 +00:00
Gerald Combs 8cbaab380e Having a non-NULL capture_opts->save_file might make us crash less.
svn path=/trunk/; revision=37983
2011-07-11 22:51:46 +00:00
Gerald Combs 5467d67f2a In version_info.c, assume we always have the "matches" operator. In
capture_opts.c, assume our output filename has been passed through
arg_list_utf_16to8().

svn path=/trunk/; revision=37974
2011-07-11 19:15:57 +00:00
Guy Harris 4bdb1926c5 Oops, indented one of the "Promiscuous" ones.
svn path=/trunk/; revision=37850
2011-06-30 23:34:53 +00:00
Guy Harris 88f7858de3 Line up the colons.
svn path=/trunk/; revision=37849
2011-06-30 22:41:54 +00:00
Guy Harris bf89288f87 It's not made from semolina. :-)
svn path=/trunk/; revision=37848
2011-06-30 22:21:16 +00:00
Michael Tüxen 185305aea6 Cleanup.
svn path=/trunk/; revision=37840
2011-06-30 06:31:52 +00:00
Michael Tüxen 52abc59011 Code cleanup.
svn path=/trunk/; revision=37820
2011-06-28 16:57:42 +00:00
Michael Tüxen 421dafd2de Get rid of old non-interface specific settings which are now interface
specifc. This finalizes the change of the infrastructure.
This patch is based on work by Irene Ruengeler.

svn path=/trunk/; revision=37794
2011-06-27 00:09:03 +00:00
Gerald Combs 8d88f3a790 Make pcap-ng the default. Add a compile-time option to prefer pcap-ng or
pcap.  Add a "-P" capture option which tries to use pcap instead of
pcap-ng ("-P" seemed to be the best option but we may want to use a
different letter).

Update the documentation and release notes.

svn path=/trunk/; revision=37696
2011-06-17 17:52:31 +00:00