Commit Graph

90 Commits

Author SHA1 Message Date
Martin Mathieson a190c936d7 Remove unnecessary includes from wiretap folder
Change-Id: I10d3057801673bc1c8ea78f144215869cc4b1851
Reviewed-on: https://code.wireshark.org/review/6217
Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com>
Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-03 21:06:36 +00:00
Bill Meier 454fd6e9eb Add "Editor modelines"; Adjust whitespace as needed.
Change-Id: Ic5a5acb0f36d3aa144edbfb1ae71097b18426db4
Reviewed-on: https://code.wireshark.org/review/6216
Reviewed-by: Bill Meier <wmeier@newsguy.com>
2015-01-02 00:49:09 +00:00
Guy Harris 51e58698d2 Get rid of packet data members of header structures.
Instead, have a special macro using the size of the header structure to
find the offset of the packet data.

This means that:

	1) you don't have to throw "-{size of data member}" into the
	   macros that calculate the sizes of the header structures;

	2) you don't have a bunch of randomly-chosen data field sizes;

	3) you don't have sizes of 0, which cause problems with
	   compilers that don't support zero-length arrays;

	4) you don't have some apparently-incorrect "-{size of data
	   member}" values (if they're correct, please fix the structure
	   definitions).

Change-Id: Iea368b83fa2d184bd6df453d51756e4749714e2c
Reviewed-on: https://code.wireshark.org/review/6082
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-27 20:56:42 +00:00
Guy Harris aa27e665b1 Rename WTAP_ERR_REC_TYPE_UNSUPPORTED to WTAP_ERR_UNWRITABLE_REC_TYPE.
That indicates that it's a problem specific to *writing* capture files;
we've already converted some errors to that style, and added a new one
in that style.

Change-Id: I8268316fd8b1a9e301bf09ae970b4b1fbcb35c9d
Reviewed-on: https://code.wireshark.org/review/5826
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-18 00:32:14 +00:00
Guy Harris 51522b3372 Handle "I can't map this for that file format" better.
For cases where record (meta)data is something that can't be written out
in a particular file format, return WTAP_ERR_UNWRITABLE_REC_DATA along
with an err_info string.

Report (and free) that err_info string in cases where
WTAP_ERR_UNWRITABLE_REC_DATA is returned.

Clean up some other error reporting cases, and flag with an XXX some
cases where we aren't reporting errors at all, while we're at it.

Change-Id: I91d02093af0d42c24ec4634c2c773b30f3d39ab3
Reviewed-on: https://code.wireshark.org/review/5823
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-18 00:03:26 +00:00
Guy Harris ddcc2aee3d Rename WTAP_ERR_UNSUPPORTED_FILE_TYPE to WTAP_ERR_UNWRITABLE_FILE_TYPE.
That makes it clearer what the problem is, and that it should only be
returned by the dump code path, not by the read code path.

Change-Id: I22d407efe3ae9fba7aa25f08f050317549866442
Reviewed-on: https://code.wireshark.org/review/5798
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17 08:31:49 +00:00
Guy Harris dbdcae80ba Rename WTAP_ERR_UNSUPPORTED_ENCAP to WTAP_ERR_UNWRITABLE_ENCAP.
That makes it clearer what the problem is, and that it should only be
returned by the dump code path, not by the read code path.

Change-Id: Icc5c9cff43be6c073f0467607555fa7138c5d074
Reviewed-on: https://code.wireshark.org/review/5797
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17 06:41:45 +00:00
Guy Harris 685d3034d5 Version 3 has only absolute timestamps; don't set nsg_creltime.
Version 3's time stamps are all absolute, so we can directly use the
value in the file; we don't need to keep track of the time in the
private data structure, and some compilers issue warnings due to setting
it and then not using the value to which we set it.

Change some names and indentation to match other file versions while
we're at it.

Change-Id: I97698d933b87a8ad58d9e88ceedd75004797df69
Reviewed-on: https://code.wireshark.org/review/4596
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-10 18:41:00 +00:00
Guy Harris 45e462985d Use an enum for the open-routine return value, as per Evan Huus's suggestion.
Clean up some things we ran across while making those changes.

Change-Id: Ic0d8943d36e6e120d7af0a6148fad98015d1e83e
Reviewed-on: https://code.wireshark.org/review/4581
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-09 23:45:30 +00:00
Guy Harris a566f617d8 No need for WTAP_ERR_CANT_READ.
Unlike the standard I/O routines, the code we introduced that supports
fast random seeking on gzipped files will always supply some specific
error code for read errors, so we don't need WTAP_ERR_CANT_READ.

Add WTAP_ERR_CANT_WRITE for writing, as we're still using the standard
I/O routines for that.  Set errno to WTAP_ERR_CANT_WRITE before calling
fwrite() in wtap_dump_file_write(), so that it's used if fwrite() fails
without setting errno.

Change-Id: I6bf066a6838284a532737aa65fd0c9bb3639ad63
Reviewed-on: https://code.wireshark.org/review/4540
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 23:19:56 +00:00
Guy Harris ffd48cefa6 Whitespace cleanups.
Change-Id: I92f983b2e04defab30eb31c14c484b9f0f582413
Reviewed-on: https://code.wireshark.org/review/4513
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 05:01:39 +00:00
Guy Harris 670ebda4a6 Add some higher-level file-read APIs and use them.
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an
error number pointer, and an error string pointer as arguments, and that
treats a short read of any sort, including a read that returns 0 bytes,
as a WTAP_ERR_SHORT_READ error, and that returns the error number and
string through its last two arguments.

Add wtap_read_bytes_or_eof(), which is similar, but that treats a read
that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF
indication.

Use those in file readers; that simplifies the code and makes it less
likely that somebody will fail to supply the error number and error
string on a file read error.

Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210
Reviewed-on: https://code.wireshark.org/review/4512
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07 01:01:59 +00:00
Guy Harris 54b733ce9a Make the time stamp resolution per-packet.
Pcap-ng files don't have a per-file time stamp resolution, they have a
per-interface time stamp resolution.  Add new time stamp resolution
types of "unknown" and "per-packet", add the time stamp resolution to
struct wtap_pkthdr, have the libwiretap core initialize it to the
per-file time stamp resolution, and have pcap-ng do the same thing with
the resolution that it does with the packet encapsulation.

Get rid of the TS_PREC_AUTO_XXX values; just have TS_PREC_AUTO, which
means "use the packet's resolution to determine how many significant
digits to display".  Rename all the WTAP_FILE_TSPREC_XXX values to
WTAP_TSPREC_XXX, as they're also used for per-packet values.

Change-Id: If9fd8f799b19836a5104aaa0870a951498886c69
Reviewed-on: https://code.wireshark.org/review/4349
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-09-28 18:38:18 +00:00
Guy Harris b8293f95ad If we don't find a NetScaler signature, don't report an error.
It's *NOT* an error; it's just a file that isn't a NetScaler file.
Otherwise, we report errors on files that should just be passed on to
other open routines.

Also, NetScaler files are *NOT* text files, and we should *NOT* use
".txt" as the suffix.

Change-Id: If001abbbbc3de3ea27439a44a47ce1d6071d38ae
Reviewed-on: https://code.wireshark.org/review/3678
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-08-18 00:32:59 +00:00
Guy Harris 0734ac385f Rename buffer_ routines to ws_buffer_ to avoid name collisions.
In particular, epan/wslua/lrexlib.c has its own buffer_ routines,
causing some linker warnings on some platforms, as reported in bug
10332.

(Not to be backported to 1.12, as that would change the API and ABI of
libwsutil and libwiretap.  We should also make the buffer_ routines in
epan/wslua/lrexlib.c static, which should also address this problem, but
the name change avoids other potential namespace collisions.)

Change-Id: I1d42c7d1778c7e4c019deb2608d476c52001ce28
Reviewed-on: https://code.wireshark.org/review/3351
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-08-02 11:01:29 +00:00
Guy Harris d4dab16a3f Only one buffer.c, please.
Otherwise, if you link with both libwiretap and libfiletap, it's
anybody's guess which one you get.  That means you're wasting memory
with two copies of its routines if they're identical, and means
surprising behavior if they're not (which showed up when I was debugging
a double-free crash - fixing libwiretap's buffer_free() didn't fix the
problem, because Wireshark happened to be calling libfiletap' unfixed
buffer_free()).

There's nothing *tap-specific about Buffers, anyway, so it really
belongs in wsutil.

Change-Id: I91537e46917e91277981f8f3365a2c0873152870
Reviewed-on: https://code.wireshark.org/review/3066
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-07-15 23:43:32 +00:00
Guy Harris 6db77b000f Allow wtap_read() and wtap_seek_read() to return records other than packets.
Add a "record type" field to "struct wtap_pkthdr"; currently, it can be
REC_TYPE_PACKET, for a record containing a packet, or
REC_TYPE_FILE_TYPE_SPECIFIC, for records containing file-type-specific
data.

Modify code that reads packets to be able to handle non-packet records,
even if that just means ignoring them.

Rename some routines to indicate that they handle more than just
packets.

We don't yet have any libwiretap code that supplies records other than
REC_TYPE_PACKET or that supporting writing records other than
REC_TYPE_PACKET, or any code to support plugins for handling
REC_TYPE_FILE_TYPE_SPECIFIC records; this is just the first step for bug
8590.

Change-Id: Idb40b78f17c2c3aea72031bcd252abf9bc11c813
Reviewed-on: https://code.wireshark.org/review/1773
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-24 18:31:25 +00:00
Guy Harris f8d7255e78 Get rid of extra trailing blank lines.
Change-Id: I161bdbf08b35bfbfa1a19fc4facc5b72ef2b0390
Reviewed-on: https://code.wireshark.org/review/1752
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23 17:57:53 +00:00
Guy Harris a344c9736e Revert "Allow wtap_read() and wtap_seek_read() to return non-packet records."
This reverts commit c0c480d08c.

A better way to do this is to have the record type be part of struct wtap_pkthdr; that keeps the metadata for the record together and requires fewer API changes.  That is in-progress.

Change-Id: Ic558f163a48e2c6d0df7f55e81a35a5e24b53bc6
Reviewed-on: https://code.wireshark.org/review/1741
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23 10:50:10 +00:00
Guy Harris c0c480d08c Allow wtap_read() and wtap_seek_read() to return non-packet records.
This is the first step towards implementing the mechanisms requestd in
bug 8590; currently, we don't return any records other than packet
records from libwiretap, and just ignore non-packet records in the rest
of Wireshark, but this at least gets the ball rolling.

Change-Id: I34a45b54dd361f69fdad1a758d8ca4f42d67d574
Reviewed-on: https://code.wireshark.org/review/1736
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23 03:02:32 +00:00
Guy Harris a1b1c8bed5 Revert "Refactor Wiretap"
This reverts commit 1abeb277f5.

This isn't building, and looks as if it requires significant work to fix.

Change-Id: I622b1bb243e353e874883a302ab419532b7601f2
Reviewed-on: https://code.wireshark.org/review/1568
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09 05:21:01 +00:00
Michael Mann 1abeb277f5 Refactor Wiretap
Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality.

The "architectural" changes can be found in cfile.h, wtap.h, wtap-int.h and (new file) wftap-int.h. Most of the other (painstaking) changes were really just the result of compiling those new architecture changes.

bug:9607
Change-Id: Ife858a61760d7a8a03be073546c0e7e582cab2ae
Reviewed-on: https://code.wireshark.org/review/1485
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-05-09 03:04:39 +00:00
Guy Harris 4342323c08 Support to version 3.0 of netscaler packet wire format.
From shekhar.chandra@citrix.com.  See bug 9280.

Change-Id: If3abbc653bb1f127b151976d4183af4c4f1e71eb
Reviewed-on: https://code.wireshark.org/review/658
Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-03-16 03:04:13 +00:00
Alexis La Goutte 296591399f Remove all $Id$ from top of file
(Using sed : sed -i '/^ \* \$Id\$/,+1 d')

Fix manually some typo (in export_object_dicom.c and crc16-plain.c)

Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8
Reviewed-on: https://code.wireshark.org/review/497
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-04 14:27:33 +00:00
Guy Harris 9d41c658fe No seek-read routines use the length argument, so eliminate it from
wtap_seek_read().

svn path=/trunk/; revision=54570
2014-01-02 20:47:21 +00:00
Guy Harris abda7cd1af Read the packet header in the seek-read routines as well as the read
routines.

svn path=/trunk/; revision=54547
2014-01-02 02:16:22 +00:00
Jakub Zawadzki 01e08ae582 wiretap: start using <wsutil/pint.h>
svn path=/trunk/; revision=53764
2013-12-03 20:35:50 +00:00
Jakub Zawadzki 288efa5128 Expand macros: htoles(), htolel(), htolell()
svn path=/trunk/; revision=53651
2013-11-29 18:44:00 +00:00
Bill Meier 5a0809c718 (Trivial) whitespace cleanup (mostly trailing whitespace).
svn path=/trunk/; revision=53172
2013-11-08 17:17:57 +00:00
Guy Harris 853da2eb9b The "file types" we have are actually combinations of types and
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2
are separate "file types", even though they both come from Network
Monitor.

Rename various functions, #defines, and variables appropriately.

svn path=/trunk/; revision=53166
2013-11-08 09:53:01 +00:00
Bill Meier 6697d30b72 Revert SVN #52914;
OSX-10.6-x64 buildbot still givs an error
(At least we now know which line of code gives the error).

svn path=/trunk/; revision=52915
2013-10-28 04:07:52 +00:00
Bill Meier 2c3ec284db From Shekhar Chandra: support for version 3.0 of netscaler packet wire format.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9280

(Revised patch: let's see if this version compiles w/o error
                on all the buildbots)


svn path=/trunk/; revision=52914
2013-10-28 03:16:31 +00:00
Guy Harris f86132a09a White space cleanups (thanks either to shekhar.chandra@citrix.com or
Bill Meier; see bug 9280).

svn path=/trunk/; revision=52677
2013-10-18 20:28:11 +00:00
Bill Meier 2197f291e5 Revert SVN #52665.
Compilation fails on (only the ?) OSX-10.6-x64 buildbot with error:

netscaler.c: In function 'nstrace_read_v30':
netscaler.c:1295: warning: implicit conversion shortens 64-bit value into a 32-bit value

(Life is too short for me to dig multiple levels deep into a set of macros to try to see which
 actual line of code is causing the problem.  Maybe the patch submitter can identify the problem).


svn path=/trunk/; revision=52666
2013-10-18 04:31:08 +00:00
Bill Meier c50b988807 From Shekhar Chandra: support for version 3.0 of netscaler packet wire format.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9280

From me: fix indentation(tabs->spaces) and trailing whitespace.


svn path=/trunk/; revision=52665
2013-10-18 03:36:04 +00:00
Guy Harris 52e9ee89fd Clarify (a V1.0 file might have a single zero byte at the end of the
page, which doesn't look like an "unused space" record because there
aren't two bytes of record type, just one byte).

svn path=/trunk/; revision=50027
2013-06-19 00:02:22 +00:00
Guy Harris 81b9276b24 Note that NetScaler trace files are page-oriented, with records not
split across page boundaries, rather than being a byte stream, and that
the last page may be short.

Fix some comments.

svn path=/trunk/; revision=50025
2013-06-18 23:37:30 +00:00
Guy Harris 8c9edf1280 Have the seek-read routines take a Buffer rather than a guint8 pointer
as the "where to put the packet data" argument.

This lets more of the libwiretap code be common between the read and
seek-read code paths, and also allows for more flexibility in the "fill
in the data" path - we can expand the buffer as needed in both cases.

svn path=/trunk/; revision=49949
2013-06-16 00:20:00 +00:00
Evan Huus 930d0c1ed6 From Ravi Kondamuru via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8637
Add support for version 2.6 of netscaler capture format.

svn path=/trunk/; revision=49250
2013-05-11 18:43:53 +00:00
Anders Broman 05a8c94ddf From beroset:
implemented wtap_dump_file_seek() and _tell()

implemented the previously declared but unimplemented wtap_dump_file_seek() and wtap_dump_file_tell() functions and used them in the seven files that had previously used a plain ftell or fseek and added error checking as appropriate.  I also added a new error WTAP_ERR_CANT_SEEK_COMPRESSED and put it next to WTAP_ERR_CANT_SEEK causing renumbering of two of the existing error codes.

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416

svn path=/trunk/; revision=48348
2013-03-17 09:20:13 +00:00
Guy Harris 88e9d1c1e5 Do not call wtap_file_read_unknown_bytes() or
wtap_file_read_expected_bytes() from an open routine - open routines are
supposed to return -1 on error, 0 if the file doesn't appear to be a
file of the specified type, or 1 if the file does appear to be a file of
the specified type, but those macros will cause the caller to return
FALSE on errors (so that, even if there's an I/O error, it reports "the
file isn't a file of the specified type" rather than "we got an error
trying to read the file").

When doing reads in an open routine before we've concluded that the file
is probably of the right type, return 0, rather than -1, if we get
WTAP_ERR_SHORT_READ - if we don't have enough data to check whether a
file is of a given type, we should keep trying other types, not give up.
For reads done *after* we've concluded the file is probably of the right
type, if a read doesn't return the number of bytes we asked for, but
returns an error of 0, return WTAP_ERR_SHORT_READ - the file is
apparently cut short.

For NetMon and NetXRay/Windows Sniffer files, use a #define for the
magic number size, and use that for both magic numbers.

svn path=/trunk/; revision=46803
2012-12-27 12:19:25 +00:00
Guy Harris 5996b49c53 Squelch implicit 64-bit-to-32-bit conversion warnings.
svn path=/trunk/; revision=46650
2012-12-21 03:32:16 +00:00
Guy Harris 0c0cec7e69 Have separate seek-read routines for V1.0 and V2.0.
Set the subtype_read and subtype_seek_read routines for the file type,
rather than having a common read routine that checks the file type each
time.

Make the macros used in the read and seek-read routines more similar,
and use them more similarly in both.

svn path=/trunk/; revision=45706
2012-10-22 11:38:57 +00:00
Guy Harris 5071e32079 Pull the length-and-caplen setting operations in the read routines into
the macros.

Note why we don't pull the time setting operations into the macros (it's
because that would mean the macros can't be used in the seek-read
routines, as calculating time stamps requires accumulating the time
stamps in a sequential pass through the packets, given that the records
have time stamps relative to the previous packet).

Fix what is probably a typo in the definitions of some macros (which
happen to work without the fix because "fp" and "pp" are both local
variable names as well as macro arguments).

svn path=/trunk/; revision=45705
2012-10-22 10:06:13 +00:00
Guy Harris 3f032cdd12 Pass a pointer to a struct wtap_pkthdr to a bunch of macros; this allows
us to avoid one redefinition of those macros that, in the one
definition, for the read routines, refer to the pseudo-header as
wth->phdr.pseudo_header and, in the next definition, for the seek-read
routine, refer to it as *pseudo_header - instead, we pass &wth->phdr in
the read routine and phdr in the seek-read routine.

svn path=/trunk/; revision=45704
2012-10-22 08:09:05 +00:00
Guy Harris a0227ab739 More white-space cleanups.
svn path=/trunk/; revision=45702
2012-10-21 22:47:32 +00:00
Guy Harris 720271dd08 Use phdr->pseudo_header in the seek-read routine, rather than putting
its address into a pseudo_header pointer and using that.

svn path=/trunk/; revision=45701
2012-10-21 22:45:27 +00:00
Guy Harris 7c8f5f852b Tabs -> spaces, and other whitespace cleanups.
svn path=/trunk/; revision=45700
2012-10-21 22:30:01 +00:00
Jakub Zawadzki 78631020b8 Add wtap_pseudo_header union to wtap_pkthdr structure.
Use pkthdr instead of pseudo_header as argument for dissecting.

svn path=/trunk/; revision=45601
2012-10-16 21:50:57 +00:00
Jeff Morriss 3551a86c36 We always HAVE_CONFIG_H so don't bother checking whether we have it or not.
svn path=/trunk/; revision=45015
2012-09-20 01:29:52 +00:00