Commit Graph

89 Commits (9eeffdc5eb4495446e4869d3b31306a930c44af4)

Author SHA1 Message Date
Jakub Zawadzki 005ddc1d8b sharkd: support for reference and previous displayed frame number
Change-Id: Iced96044a8fc414d4cb1c62bcc67f61cf44c4515
Petri-Dish: Jakub Zawadzki <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <>
Reviewed-by: Jakub Zawadzki <>
2017-12-28 17:08:02 +00:00
João Valverde 995812c5f1 Refactor plugin registration and loading
Put different types of plugins (libwiretap, libwireshark) in different
subdirectories, give libwiretap and libwireshark init routines that
load the plugins, and have them scan the appropriate subdirectories
so that we don't even *try* to, for example, load libwireshark plugins
in programs that only use libwiretap.

Compiled plugins are stored in subfolders of the plugin folders, with
the subfolder name being the Wireshark minor version number (X.Y). There is
another hierarchical level for each Wireshark library (libwireshark, libwscodecs
and libwiretap).

The folder names are respectively plugins/X.Y/{epan,codecs,wiretap}.

Currently we only distribute "epan" (libwireshark) plugins.

Change-Id: I3438787a6f45820d64ba4ca91cbe3c8864708acb
Petri-Dish: João Valverde <>
Tested-by: Petri Dish Buildbot
Reviewed-by: João Valverde <>
2017-12-14 08:43:57 +00:00
Guy Harris 8aa14236f8 Have the frame_tvbuff.c routines not use the global cfile.
Have the routines that create them take a pointer to a struct
packet_provider_data, store that in the tvbuff data, and use it to get
the wtap from which packets are being read.

While we're at it, don't include globals.h in any header files, and
include it in source files iff the source file actually uses cfile.  Add
whatever includes that requires.

Change-Id: I9f1ee391f951dc427ff62c80f67aa4877a37c229
Reviewed-by: Guy Harris <>
2017-12-08 08:31:41 +00:00
Guy Harris 48e65c4af4 Hand the packet provider functions to epan_new().
Have separate packet_provider_data structures and packet_provider_funcs
structures; the latter holds a table of functions that libwireshark can
call for information about packets, the latter holds the data that those
functions use.

This means we no longer need to expose the structure of an epan_t
outside epan/epan.c; get rid of epan/epan-int.h.

Change-Id: I381b88993aa19e55720ce02c42ad33738e3f51f4
Reviewed-by: Guy Harris <>
2017-12-08 04:33:55 +00:00
Guy Harris 797d2f6a87 Move the frame_set stuff back into the capture_file structure.
libwireshark now expects an epan_t to be created with a pointer to a
"packet provider" structure; that structure is opaque within
libwireshark, and a pointer to it is passed to the callbacks that
provide interface names, interface, descriptions, user comments, and
packet time stamps, and that set user comments.  The code that calls
epan_new() is expected to provide those callbacks, and to define the
structure, which can be used by the providers.  If none of the callbacks
need that extra information, the "packet provider" structure can be

Have a "file" packet provider for all the programs that provide packets
from a file.

Change-Id: I4b5709a3dd7b098ebd7d2a7d95bcdd7b5903c1a0
Reviewed-by: Guy Harris <>
2017-12-08 03:32:25 +00:00
Jakub Zawadzki 0baa4458c5 sharkd: add sharkd_get_frame() to get frame_data, optimize.
Add sharkd_get_frame() wrapper to limit number of cfile usage.
Don't get frame_data when not needed.

Change-Id: I24b96b5b184196e9dbf632c0891b2954c8281eed
Petri-Dish: Jakub Zawadzki <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2017-12-08 03:16:20 +00:00
Jakub Zawadzki b59c39b271 frame user comments: move to epan, add support for user comments in sharkd.
Change-Id: Id15edc60177b160fd09cae99de1c9e01e17d9421
Petri-Dish: Jakub Zawadzki <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <>
2017-12-06 19:54:30 +00:00
Guy Harris 1834dca365 Move the parts of a capture_file used by libwireshark to a new structure.
Embed one of those structures in a capture_file, and have a struct
epan_session point to that structure rather than to a capture_file.
Pass that structure to the routines that fetch data that libwireshark
uses when dissecting.

That separates the stuff that libwireshark expects from the stuff that
it doesn't look at.

Change-Id: Ia3cd28efb9622476437a2ce32204597fae720877
Reviewed-by: Guy Harris <>
2017-12-04 05:02:18 +00:00
Guy Harris 02944c412b Use cfile fields for some frame_data pointers.
Those fields weren't being used in TShark/TFShark/rawshark/sharkd, so we
can use them, instead of defining our own static variables.

This makes the non-Wireshark code paths a bit more like the Wireshark
code paths.

Change-Id: I55da4cf525e37598f314efca22f20d3e80cb547c
Reviewed-by: Guy Harris <>
2017-12-04 03:20:45 +00:00
Guy Harris eb8ffb74e2 Use cfile.h to define the capture_file type.
Have cfile-int.h declare the structure, and use it in files that
directly access the structure.

Have cfile.h just incompletely declare the structure and include it
rather than explicitly declaring it in source files or other header

Never directly refer to struct _capture_file except when typedeffing

Add #includes as necessary, now that cfile.h doesn't drag in a ton of

Change-Id: I7931c8039d75ff7c980b0f2a6e221f20e602a556
Reviewed-by: Guy Harris <>
2017-12-03 18:54:37 +00:00
Gerald Combs 28b6616ea0 Get rid of some void pointers.
Explictly struct _capture_file * in epan_session and its callbacks.

Change-Id: I63703015c661a08f3350a7448a7bcdaf98f119dc
Reviewed-by: Gerald Combs <>
Petri-Dish: Gerald Combs <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <>
2017-12-01 21:09:24 +00:00
João Valverde 7540ac6938 Move the protocol registration routines back into libwireshark
Follow-up to b695b3e2f7.

Change-Id: I7e36519f2c3806c1205d05437671325080974257
Petri-Dish: João Valverde <>
Tested-by: Petri Dish Buildbot
Reviewed-by: João Valverde <>
2017-11-21 20:21:50 +00:00
Gerald Combs 775bbbcded Start using SPDX license identifiers.
A while back Graham pointed out the SPDX project (, which is
working on standardizing license specifications:

Appendix V of the specification describes a short identifier
(SPDX-License-Identifier) that you can use in place of boilerplate in
your source files:

Start the conversion process with our top-level C and C++ files.

Change-Id: Iba1d835776714deb6285e2181e8ca17f95221878
Reviewed-by: Gerald Combs <>
Petri-Dish: Gerald Combs <>
Reviewed-by: Balint Reczey <>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <>
2017-11-09 20:03:51 +00:00
Peter Wu 1dea7f3dc1 Rename ui_util.h -> ws_ui_util.h
In preparation for possibly using AUTOUIC in CMake which treats "ui_*.h"
files specially, rename ui_util.h. No other changes.

Change-Id: Id026572c000b713ff0e9388dc7fff8d81d4df73e
Petri-Dish: Michael Mann <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Michael Mann <>
2017-10-15 01:14:26 +00:00
Jakub Zawadzki 3c9f440ac6 sharkd: export field filter string.
This extra parameter allows to use wireshark functionality like: prepare as filter,
and also apply quick filter in protocol tree (for instance show only TCP protocol fields: tcp.),

Change-Id: I1f380b79e3802e6aaf646fdd4770c903ee9f3781
Petri-Dish: Jakub Zawadzki <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Anders Broman <>
2017-10-05 04:18:27 +00:00
João Valverde a269ae1b6a Rename "ws_version_info.h", also .c
It's not installed so like most other files it doesn't need or benefit
from the prefix.

Change-Id: I01517e06f12b3101fee21b68cba3bc6842bbef5c
Petri-Dish: João Valverde <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: João Valverde <>
2017-09-26 17:32:08 +00:00
Guy Harris 60da2c96dd Just print the string color_filters_init() provides on an error.
It gives all the necessary details; no need to mention the name of a
routine the existence of which the user is probably unaware.

Change-Id: I66d372bc6650c84fbbc6be438be695eff1048413
Reviewed-by: Guy Harris <>
2017-06-09 22:38:35 +00:00
Guy Harris d0865fd619 Allow bigger snapshot lengths for D-Bus captures.
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except
for D-Bus captures.  Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for
them, because that's the largest possible D-Bus message size.  See

for an example of the problems caused by limiting the snapshot length to
256KB for D-Bus.

Have a snapshot length of 0 in a capture_file structure mean "there is
no snapshot length for the file"; we don't need the has_snap field in
that case, a value of 0 mean "no, we don't have a snapshot length".

In dumpcap, start out with a pipe buffer size of 2KB, and grow it as
necessary.  When checking for a too-big packet from a pipe, check
against the appropriate maximum - 128MB for DLT_DBUS, 256KB for
everything else.

Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20
Petri-Dish: Guy Harris <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Guy Harris <>
2017-06-05 05:28:26 +00:00
Guy Harris 9e9d284d91 Have separate routines for open-for-reading and open-for-writing errors.
Expand comments while we're at it.

Change-Id: I6dcc791eab1c9e323a9572f3d54720d223bdd64b
Reviewed-by: Guy Harris <>
2017-04-20 18:24:20 +00:00
Guy Harris 347a19ae96 Add common routines for command-line libwiretap error reporting.
These are similar to the routines added to ui/alert_box.c for dialog-box
libwiretap error reporting.

This centralizes the knowledge about what to say for various libwiretap
errors, removing some duplicate code, and giving more details in some

Change-Id: I737405c4edaa0e6c27840f78a8c587a8b3ee120b
Reviewed-by: Guy Harris <>
2017-04-20 02:21:58 +00:00
Jakub Zawadzki ca29ec9e77 sharkd: support for "downloading" decoded RTP stream in wave-like format.
Change-Id: Ic6b241f9b7ed302e7b11644e63230474d5933a85
Petri-Dish: Jakub Zawadzki <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Jakub Zawadzki <>
2017-04-17 07:29:31 +00:00
Guy Harris 407a2b07e5 Rename some routines and structure members.
They deal with sets of hfids, which can belong to protocols as well as
fields (I guess you could argue that a protocol is a field, but...).

Change-Id: Ibd103cfa26427ead4ef54be89f1251908004cfae
Reviewed-by: Guy Harris <>
2017-04-17 01:49:01 +00:00
Guy Harris 847c25c5a7 Prime the epan_dissect_t with postdissector wanted fields if necessary.
This makes sure that postdissectors that indicate that they need certain
fields in the first pass will get them.

While we're at it:

Fix the field-fetching code in TRANSUM not to assume it got any
instances of the field being fetched.

Rename process_packet_first_pass() in sharkd to process_packet(), as
it's the only routine in sharkd that processes packets.

Rename process_packet() in tshark and tfshark to
process_packet_single_pass(), as it's what's used if we're only doing
one-pass analysis.

Clean up comments and whitespace.

Change-Id: I3769af952c66f5ca4b68002ad6213858ab9cab9b
Reviewed-by: Guy Harris <>
2017-04-12 23:33:37 +00:00
Guy Harris 4d2d423106 Rename routines to clarify what they do.
XXX_prime_with_YYY makes it a bit clearer than does XXX_prime_YYY that
we're not priming YYY, we're priming XXX *using* YYY.

Change-Id: I1686b8b5469bc0f0bd6db8551fb6301776a1b133
Reviewed-by: Guy Harris <>
2017-04-12 04:56:49 +00:00
Guy Harris c079255539 Add an API to let a postdissector specify fields whose values it needs.
Currently, this is only used to determine whether a protocol tree needs
to be built on the first pass or not - if there are postdissectors that
need fields, it does - but eventually we should be able to use it to
prime the dissection to deliver those fields in cases where we don't
need the *entire* protocol tree (rather than using a hack such as
cooking up a fake tap with a fake filter to do that).

Update MATE and TRANSUM to use it.

Clean up code to check whether we need a protocol tree, and add comments
before that code indicating, in each case, what the criteria are.

The array of postdissectors includes a length, so we don't need to
separately keep track of the number of postdissectors.

Clean up indentation while we're at it.

Change-Id: I71d4025848206d144bc54cc82941089a50e80ab7
Reviewed-by: Guy Harris <>
2017-04-12 04:31:19 +00:00
Guy Harris 6b3714254d Pull all the "load settings" calls into a epan_load_settings() routine.
That way, nothing using libwireshark needs to know what settings need to
be loaded, they just call epan_load_settings().

Change-Id: I9390e259e286fc4f5acaeaac2767e4c3c4b656af
Petri-Dish: Guy Harris <>
Reviewed-by: Guy Harris <>
2017-04-09 22:40:30 +00:00
Guy Harris 7d5ce06cbe Pull the error reporting into {read,save}_filter_list.
Change-Id: I4d9582661f2f1728d400eeb2a1b1dea98f32ce7f
Reviewed-by: Guy Harris <>
2017-04-09 17:57:52 +00:00
Guy Harris 77cad8561c Move the filter file reading code to libui.
It doesn't belong in libwireshark, as it doesn't affect dissection, but
it *does* belong in libui, as it's helper code for the UIs.

Change-Id: I8a5e0640a299a08e9ec1917dd253197438ebfdbc
Reviewed-by: Guy Harris <>
2017-04-09 04:25:52 +00:00
Guy Harris 62b342443d Pull the error-reporting code for preference files into read_prefs().
No need to duplicate it in N different programs.

Update comments while we're at it.

Change-Id: I3096cbe5448a19363eff6303bdd54e522dae9336
Reviewed-by: Guy Harris <>
2017-04-09 03:03:25 +00:00
Guy Harris 23a7890b6a Pull the code to save enabled/disabled lists into libwireshark.
It's identical in the GTK+ and Qt UIs, and it should just be done in

Rename some routines to just speak of enabled_and_disabled_lists, so we
don't have to say enabled_and_disabled_protos_and_heuristic_dissectors
or something such as that.

Clean up indentation.

Change-Id: Ief2e612d9e1b60d8d0123b6bd3409dce5faf6495
Reviewed-by: Guy Harris <>
2017-04-09 02:00:37 +00:00
Guy Harris 2c44a7f930 Clean up handling of enabled/disabled protocols/heuristic dissectors.
Add a "report a warning message" routine to the "report_err" code in
libwsutil, and rename files and routines appropriately, as they don't
only handle errors any more.

Have a routine read_enabled_and_disabled_protos() that reads all the
files that enable or disable protocols or heuristic dissectors, enables
and disables them based on the contents of those files, and reports
errors itself (as warnings) using the new "report a warning message"
routine.  Fix that error reporting to report separately on the disabled
protocols, enabled protocols, and heuristic dissectors files.

Have a routine to set up the enabled and disabled protocols and
heuristic dissectors from the command-line arguments, so it's done the
same way in all programs.

If we try to enable or disable an unknown heuristic dissector via a
command-line argument, report an error.

Update a bunch of comments.

Update the name of disabled_protos_cleanup(), as it cleans up
information for disabled *and* enabled protocols and for heuristic

Support the command-line flags to enable and disable protocols and
heuristic dissectors in tfshark.

Change-Id: I9b8bd29947cccdf6dc34a0540b5509ef941391df
Reviewed-by: Guy Harris <>
2017-04-08 20:40:08 +00:00
Alexis La Goutte 99929f7274 sharkd: fix redundant redeclaration of ‘cfile’ [-Wredundant-decls]
Change-Id: I6ffe2d21cabfe326568b5f090c322d4dafd92d9d
Petri-Dish: Alexis La Goutte <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Michael Mann <>
2017-02-24 02:12:20 +00:00
Dario Lombardo 6d79055ba6 wsutil: remove leaks from filesystem and plugins code.
Change-Id: Iac2805c0130bd2ba6cdb3c9dd997050274d58d99
Reviewed-by: Michael Mann <>
2017-02-18 13:45:14 +00:00
Dario Lombardo 7c0c580c4b wiretap: add cleanup routine.
The cleanup routine has been added to exit section of the applications.
Those which required a exit restyle have been patched as well.

Change-Id: I3a8787f0718ac7fef00dc58176869c7510fda7b1
Petri-Dish: Dario Lombardo <>
Reviewed-by: Peter Wu <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Dario Lombardo <>
2017-02-14 10:22:20 +00:00
Dario Lombardo 9ced31a2d7 filter_list: add cleanup function and call it on exit.
Change-Id: I51d8074cc5a63d4fd3af8852df120d6b4163217f
Reviewed-by: Michael Mann <>
2017-02-10 13:34:56 +00:00
Dario Lombardo 59fc668845 Clean columns on exit.
Change-Id: I950295c35fc67193d9825ebc741da151ad99e077
Petri-Dish: Dario Lombardo <>
Reviewed-by: Michael Mann <>
2017-02-10 13:31:01 +00:00
Jim Young 520a1b2066 Make the capture file's interface description filterable
This patch introduces the frame.interface_description field.

While testing this new functionality it became obvious that we have
a non-optimal interaction between the existing cfile.c's
cap_file_get_interface_name(), the recently added frame.interface_name
field and this new frame.interface_description field.

The string returned from cap_file_get_interface_name() may in fact
come from one of three different sources: the idb's interface name
(if it exists) or the idb's interface description (if that exists)
or a default text of "unknown".  The string ultimately becomes the
rame.interface_name whether or not the idb had an interface name
option to begin with.  This behavior does not allow one to test for
the simple presence of frame.interface_name.  The new peer function
cap_file_get_interface_description() added by this patch returns
NULL instead of "unknown" if the idb does not have an interface
description.  Should cap_file_get_interface_name() be similarly
modified to return NULL if the idb does not have an interface name?

Bug: 9781
Change-Id: Ie479f373c5080c004dd22bd88919838feca71e95
Petri-Dish: Stig Bjørlykke <>
Tested-by: Petri Dish Buildbot <>
Petri-Dish: Alexis La Goutte <>
Reviewed-by: Alexis La Goutte <>
Reviewed-by: Anders Broman <>
2017-02-09 11:31:59 +00:00
Dario Lombardo bfe07161a5 sharkd: make the way it returns more similar to other apps.
The clean_exit block allows deallocation of memory on exit.

Change-Id: I52078f0e4e851b6aa5f34cbbd15eba0a4f37cae0
Petri-Dish: Dario Lombardo <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Michael Mann <>
2017-02-08 14:49:37 +00:00
Jakub Zawadzki e2930f3b78 Add sharkd - daemon variant
sharkd listens on UNIX socket and allows external clients
to run commands like: loading file, analysing frames or running TAP(s).

Change-Id: I443b2865e4adfd1c11f4f57d09ff7fce6b1e8766
Petri-Dish: Jakub Zawadzki <>
Tested-by: Petri Dish Buildbot <>
Reviewed-by: Peter Wu <>
Reviewed-by: Jakub Zawadzki <>
2017-01-25 07:19:05 +00:00