Commit Graph

89 Commits (9eeffdc5eb4495446e4869d3b31306a930c44af4)

Author SHA1 Message Date
João Valverde 7fd4e2e542 Move ui/filter_files.[ch] to wsutil 2023-02-10 20:59:22 +00:00
João Valverde cf8107eb2a Move ui/clopts_common.[ch] to wsutil 2023-02-10 20:59:22 +00:00
João Valverde 0cea64a632 Move ui/cmdarg_err.[ch] to wsutil 2023-02-10 20:59:22 +00:00
João Valverde 84f963dfa2 Move ui/version_info.[ch] to wsutil 2023-02-07 23:17:37 +00:00
João Valverde c62aa67d2c Move ui/exit_codes.h to include/ 2023-02-07 10:12:08 +00:00
Tomasz Moń e7d5c49fe1
epan: Use hash table for dependent frames
Dependent frames list order does not matter and thus significantly
faster data structure can be used. Replace the list with hash table to
avoid excessive CPU usage when opening files containing reassembled
packets consisting of large number of fragments.
2023-01-28 15:17:42 +01:00
Sake Blok f870c6085d epan: Allow nested dependent packets
Save all dependent frames when there are multiple levels
of reassembly.

This is a retry of !6329, combined with the fix in !6509 which
were reverted in !6545.

epan: fix a segfault, introduced in !6329
2023-01-06 23:15:48 +00:00
João Valverde a0d77e9329 dfilter: Return an error object instead of string
Return an struct containing error information. This simplifies
the interface to more easily provide richer diagnostics in the future.

Add an error code besides a human-readable error string to allow
checking programmatically for errors in a robust manner. Currently
there is only a generic error code, it is expected to increase
in the future.

Move error location information to the struct. Change callers and
implementation to use the new interface.
2022-11-28 15:46:44 +00:00
João Valverde 3949d289d1 Add log init message to main() 2022-10-08 15:33:47 +00:00
Gerald Combs 3086774fa6 wsutil: Add configuration namespaces.
Rename init_progfile_dir to configuration_init. Add an argument which
specifies our configuration namespace, which can be "Wireshark"
(default) or "Logwolf".
2022-04-04 09:39:27 -07:00
João Valverde 842f53c329 Revert "epan: Allow nested dependent packets"
This reverts commit 2d8607e7e0.

This reverts commit be915d7374.

Introduces a segmentation fault, needs more work.
2022-03-28 12:40:21 +00:00
Sake Blok be915d7374 epan: Allow nested dependent packets
Save all dependent frames when there are multiple levels
of reassembly.
2022-03-06 23:43:03 +00:00
David Perry e2fab18853 wsutil: New API to gather compile/runtime info 2022-02-24 13:27:08 +00:00
David Perry 70d432c357 Remove editor modelines and .editorconfig exceptions from root files 2022-02-20 19:39:37 +00:00
Guy Harris 3cb6403a4c wiretap: always allocate a block for a record.
Without that, you could add a comment to a record in a file format the
reading code for which doesn't allocate blocks, but the comment doesn't
get saved, as there's no block in which to save the comment option.

This simplifies some code paths, as we're either using the record's
modified block or we're using the block as read from the file, there's
no third possibility.

If we attempt to read a record, and we get an error, and a block was
allocated for the record, unreference it, so the individual file readers
don't have to worry about it.
2021-08-29 19:12:13 -07:00
David Perry 6e12643f19 [#17478] free blocks in more places
Bug 17478 was caused by `wtap_rec.block` being allocated for each
packet, but not freed when it was done being used -- typically at the
end of a loop.

Rather than requiring each caller of `wtap_read()` to know to free a
member of `rec`, I added a new function `wtap_rec_reset()` for a
slightly cleaner API. Added calls to it everywhere that seemed to make

Fixes #17478
2021-08-10 00:08:15 +00:00
Guy Harris c4731738fc sharkd: various cleanups.
Extend sharkd_dissect_request() so that it can replace

Have it return a status indicating success, invalid frame number, or
read error, so that the caller knows what the problem is.

Pass it pointers to the wtap_rec and Buffer to use when reading packets
from the file, so that if it's called in a loop iterating over all
frames, those structures can be initialized once, before the loop, and
cleaned up once, after the loop, rather than doing both once per loop

Pass pointers to the read error code and additional read error
information string pointer, so that, on a file read error, that
information is available to the caller.

Get rid of sharkd_dissect_columns(); instead, use
sharkd_dissect_request(), with code from the loop body pulled into a
callback routine.  Fix that code to correctly determine whether the
current frame has any comments, rather than just treating all frames
that have blocks as having comments.

Use _U_ to mark arguments as unused, rather than throwing in a

	(void) variablename;


Move some variables used only within a loop into the for() statement or
the loop body.
2021-07-11 03:06:10 -07:00
Guy Harris dd5907d2a3 Consistently refer to blocks that have been modified as "modified".
"User" sounds as if the blocks belong to the user; at most, the current
user might have modified them directly, but they might also have, for
example, run a Lua script that, unknown to them, modified comments.
Also, a file might have "user comments" added by a previous user, who
them wrote the file and and provided it to the current user.

"Modified" seems a bit clearer than "changed".
2021-07-08 00:05:35 -07:00
David Perry 73087d6fb4 Use wtap_blocks for packet comments
Mostly functioning proof of concept for #14329. This work is intended to
allow Wireshark to support multiple packet comments per packet.

Uses and expands upon the `wtap_block` API in `wiretap/wtap_opttypes.h`.
It attaches a `wtap_block` structure to `wtap_rec` in place of its
current `opt_comment` and `packet_verdict` members to hold OPT_COMMENT
and OPT_PKT_VERDICT option values.
2021-07-07 18:40:24 +00:00
João Valverde 100876337a Move version_info.[ch] to ui/
Version info is an aspect of UI implementation so move it to
a more appropriate place, such as ui/. This also helps declutter
the top-level.

A static library is appropriate to encapsulate the dependencies
as private and it is better supported by CMake than object libraries.

Also version_info.h should not be installed as a public header.
2021-07-04 10:37:49 +00:00
João Valverde 47d2afd990 sharkd: Prefer version_info.h instead of version.h 2021-07-04 10:37:49 +00:00
João Valverde c6a920686c wslog: Check environment initialization for errors
Initialiaze the cmdarg error stream earlier.

Dumpcap also needs to know earlier if it is running in capture
child mode.
2021-06-26 00:18:26 +01:00
João Valverde 759bb234d0 wslog: Check if we are initialized and add missing inits
Instead of receiving the program name from GLib, pass it explicitly
to ws_log_init() instead  and use that to initialize the GLib program

ws_log_parse_args() will now exit the program when it encounters an
argument error if exit_failure >= 0.
2021-06-21 16:03:29 +00:00
João Valverde e86ac706ca wslog: Parse cmd line options in one pass 2021-06-14 22:05:35 +00:00
João Valverde 5ddc007023 wslog: Include pid in format 2021-06-14 14:18:38 +01:00
João Valverde 5a662ba3fb wslog: Add support for domain filtering
A domain filter can be given in the environment variable
'WS_LOG_DOMAINS' or in a command-line options "--log-domains".

The filter is specified as a comma separated case insensitive list,
for example:

    ./tshark  --log-domains=main,capture

Domain data type switches from an enum to a string. There is no
constaint on adding new domains, neither in code or at runtime.
The string format is arbitrary, only positive matches will produce
2021-06-14 13:13:12 +01:00
João Valverde dc7f0b88bb Refactor our logging and extend the wslog API
Experience has shown that:

  1. The current logging methods are not very reliable or practical.
A logging bitmask makes little sense as the user-facing interface (who
would want debug but not crtical messages for example?); it's
computer-friendly and user-unfriendly. More importantly the console
log level preference is initialized too late in the startup process
to be used for the logging subsystem and that fact raises a number
of annoying and hard-to-fix usability issues.

  2. Coding around G_MESSAGES_DEBUG to comply with our log level mask
and not clobber the user's settings or not create unexpected log misses
is unworkable and generally follows the principle of most surprise.
The fact that G_MESSAGES_DEBUG="all" can leak to other programs using
GLib is also annoying.

  3. The non-structured GLib logging API is very opinionated and lacks
configurability beyond replacing the log handler.

  4. Windows GUI has some special code to attach to a console,
but it would be nice to abstract away the rest under a single

  5. Using this logger seems to be noticeably faster.

Deprecate the console log level preference and extend our API to
implement a log handler in wsutil/wslog.h to provide easy-to-use,
flexible and dependable logging during all execution phases.

Log levels have a hierarchy, from most verbose to least verbose
(debug to error). When a given level is set everything above that
is also enabled.

The log level can be set with an environment variable or a command
line option (parsed as soon as possible but still later than the
environment). The default log level is "message".

Dissector logging is not included because it is not clear what log
domain they should use. An explosion to thousands of domains is
not desirable and putting everything in a single domain is probably
too coarse and noisy. For now I think it makes sense to let them do
their own thing using g_log_default_handler() and continue using the
G_MESSAGES_DEBUG mechanism with specific domains for each individual

In the future a mechanism may be added to selectively enable these
domains at runtime while trying to avoid the problems introduced
2021-06-11 09:40:28 +00:00
Guy Harris ce20c00049 Remove unnecessary inclues of wiretap/pcapng.h. 2021-03-15 15:29:40 -07:00
Guy Harris c33e2f7b51 Add more error-reporting routines that call through a function pointer.
Have routines to report capture-file errors, using libwireshark error
codes and strings, that call through a pointer, so they can pop up
dialogs in GUI apps, print a message to the standard error on
command-line apps, and possibly do something different on server

Have init_report_message() take a pointer to structure containing those
function pointers, rather than the function pointers themselves, as

Make other API changes to make that work.
2021-03-15 12:17:59 -07:00
Guy Harris c80c16759b wiretap: eliminate two WTAP_FILE_TYPE_SUBTYPE_ values.
WTAP_FILE_TYPE_SUBTYPE_SYSTEMD_JOURNAL - instead, fetch the values by
name, using wtap_name_to_file_type_subtype().

This requires that wtap_init() be called before epan_init(); that's
currently the case, but put in comments to indicate why it must continue
to be the case.
2021-02-19 23:20:24 +00:00
Paul Offord 69df23fc40 sharkd: Add configuration profile and other options
This change adds code to allow the selection of a configuration
profile during sharkd start by adding a -C command line option.
A new -a option has been added to specify the api service
endpoint e.g. tcp:

The change also adds version display (-v) and help display (-h) options.
These additions have been made in a way to ensure that the original
command line options still work correctly to maintain backward

The new options have been added using the getopt_long(...) function
that is used by tshark to simplify the addition of further command
line options.

Closes #17222
2021-02-08 10:27:18 +00:00
João Valverde 63af1da7e7 Kill libwscodecs plugin library, just use plugins
Change-Id: I085d04840acb53b0b7681787429a2b4e10547cd5
Reviewed-by: Anders Broman <>
2019-06-11 20:59:39 +00:00
Guy Harris 937ec02581 1514 is a better initial Buffer size than 1500.
Ethernet packets without the CRC are 1514 bytes long, not 1500 bytes
long; using 1514 bytes will avoid a reallocation for a full-sized
Ethernet packet.

Change-Id: Ie8da3f13bf3df07e23e4478b7dcf84f06dec6a9d
Reviewed-by: Guy Harris <>
2019-04-06 21:04:02 +00:00
Guy Harris 58afae4bd0 Pass Buffer pointers rather than packet data pointers in some more cases.
Change-Id: I35299464560aff2785a52217d4052da3ffedcd6a
Reviewed-by: Guy Harris <>
2019-04-05 03:31:26 +00:00
Guy Harris 8a5b26efb1 Have wtap_read() fill in a wtap_rec and Buffer.
That makes it - and the routines that implement it - work more like the
seek-read routine.

Change-Id: I0cace2d0e4c9ebfc21ac98fd1af1ec70f60a240d
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2019-04-05 02:49:43 +00:00
Guy Harris ba589a4e44 Move some command-line-oriented routines from wsutil to ui.
cmdarg_err() is for reporting errors for command-line programs and
command-line errors in GUI programs; it's not something for any of the
Wireshark libraries to use.

The various routines for parsing numerical command-line arguments are
not for general use, they're just for use when parsing arguments.

Change-Id: I100bd4a55ab8ee4497f41d9651b0c5670e6c1e7f
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2019-01-01 02:07:06 +00:00
Guy Harris 7eb3e47fa4 Try to squeeze some bytes out of the frame_data structure.
Make the time stamp precision a 4-bit bitfield, so, when combined with
the other bitfields, we have 32 bits.  That means we put the flags at
the same structure level as the time stamp precision, so they can be
combined; that gets rid of an extra "flags." for references to the flags.

Put the two pointers next to each other, and after a multiple of 8 bytes
worth of other fields, so that there's no padding before or between them.

It's still not down to 64 bytes, which is the next lower power of 2, so
there's more work to do.

Change-Id: I6f3e9d9f6f48137bbee8f100c152d2c42adb8fbe
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2018-12-27 04:34:29 +00:00
Guy Harris 43dfd45faa Move more version-info-related stuff to version_info.c.
Have a ws_init_version_info() routine that, given an application name

	constructs the app-name-and-version-information string, and
	saves it;

	adds the initial crash information on platforms that support it,
	and saves it.

Have show_version() use the saved information and take no arguments.

Add a show_help_header() routine to print the header for --help
command-line options, given a description of the application; it prints
the application name and version information, the description, and the
"See { URL}" line.

Use those routines in various places, including providing the
"application name" string in pcapng SHBs.

Change-Id: I0042a8fcc91aa919ad5c381a8b8674a007ce66df
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2018-12-13 03:16:13 +00:00
Peter Wu df7af28f39 Add new Secrets API and allow TLS to use pcapng decryption secrets
Add a new secrets API to the core, one that can outlive the lifetime of
a single capture file. Expose decryption secrets from wiretap through a
callback and let the secrets API route it to a dissector.

Bug: 15252
Change-Id: Ie2f1867bdfd265bad11fc58f1e8d8e7295c0d1e7
Petri-Dish: Peter Wu <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <>
2018-11-20 05:14:35 +00:00
Jakub Zawadzki 988b14ad72 sharkd: free initalized wtap_rec when wtap failed to read frame.
Change-Id: I564a3704c0ea1b0df85f3cafacf790ed24591232
Petri-Dish: Jakub Zawadzki <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Jakub Zawadzki <>
2018-10-08 21:40:14 +00:00
João Valverde ff1e16055f epan: Add argument to epan_init() to disable plugins
Change-Id: I8dc76e6bf8c4d5a3081cbdc1d47b88e857415d29
Petri-Dish: João Valverde <>
Tested-by: Petri Dish Buildbot
Reviewed-by: João Valverde <>
2018-09-09 02:27:34 +00:00
Jakub Zawadzki 3ce847e39e sharkd: Fix frames request for empty "" filter
For empty filters dfilter_compile() return success but with NULL dfcode,
still if used dfilter_prime_proto_tree() crashed cause of NULL df pointer.

Change-Id: I0684abf8ef766a24d0c8150fef4e113813c490ea
Petri-Dish: Jakub Zawadzki <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michal Labedzki <>
Tested-by: Michal Labedzki <>
2018-09-02 11:23:30 +00:00
João Valverde 8eddb1650d epan: Remove unnecessary all protocols registration callback
We are exporting a registration function from libwireshark just
to have it passed back as a callback. Seems unnecessary.

Change-Id: I7621005c9be11691d319102326824c5e3520a6f3
Petri-Dish: João Valverde <>
Tested-by: Petri Dish Buildbot
Reviewed-by: João Valverde <>
2018-08-29 23:22:44 +00:00
Adam Morrison 11b3663004 Fixed a bug related to epan initialization
In various places, <program>_epan_new was called before setting the
provider, so the wth field was null. This fix is necessary for the
next commit, adding Secrets Description Block, as it uses this field.

Change-Id: Ice8ee01c56b3e04fc71d7b2c659d9635cb366951
Petri-Dish: Anders Broman <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <>
2018-08-22 06:18:11 +00:00
Michał Łabędzki a0814af296 sharkd: Return frame's color-filter colors
Return color-filter bg/fg colors for single frame if requested.
Also return marked/ignored fields for frame.

Change-Id: I4480b733f54991c72bea1664fa6e7337812e6231
Petri-Dish: Michal Labedzki <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michal Labedzki <>
2018-08-04 13:26:05 +00:00
Jakub Zawadzki 5cdff26107 sharkd: support for MaxMindDB.
Call maxmind_db_lookup_process() [via host_name_lookup_process()] before processing request.
It's still buggy, webshark needs a refresh to show endpoint or conversation ipmap,
but it's better than nothing.

It seems to need refresh, cause maxmind_db_lookup_ipv[46] works only for cached entries.

Also cause mmdbresolve is pipe-based, every sharkd need to have it own mmdbresolve process.

Change-Id: I3d588d1fa9e9ba645cc3d0bff3d276b202159d21
Petri-Dish: Jakub Zawadzki <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Jakub Zawadzki <>
2018-05-06 09:22:25 +00:00
Guy Harris 15cfc41e94 Don't use dladdr() to get a pathname for the current executable().
Change-Id: I24ad11a659c2cb936f873339dc2b36ac9944280a
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2018-05-05 08:06:35 +00:00
Guy Harris 1f5f63f8ef Generalize wtap_pkthdr into a structure for packet and non-packet records.
Separate the stuff that any record could have from the stuff that only
particular record types have; put the latter into a union, and put all
that into a wtap_rec structure.

Add some record-type checks as necessary.

Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2
Reviewed-by: Guy Harris <>
2018-02-09 00:29:51 +00:00
Dario Lombardo 8cd389e161 replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.
The first is deprecated, as per

Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed
Petri-Dish: Anders Broman <>
Petri-Dish: Dario Lombardo <>
Reviewed-by: Anders Broman <>
2018-02-08 14:57:36 +00:00
Pascal Quantin fc9af81a13 wiretap: add a parameter to wtap_init() indicating whether plugins must be loaded
g995812c5f1 moved wiretap plugins registration from applications to
wiretap library init function.
As we do not want to load plugins for all users of libwiretap, let's
make it configurable.

Bug: 14314
Change-Id: Id8fdcc484e2d0d31d3ab0bd357d3a6678570f700
Reviewed-by: Dario Lombardo <>
Petri-Dish: Dario Lombardo <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <>
2018-01-09 21:25:06 +00:00