Move the list of encapsulation buttons to a QButtonGroup, which makes
it easy to tell which one of them is activated.
Use that to fix an issue where dummy headers impermissible for an
encapsulation type could be added if the radio button was selected
before switching the encapsulation type. (Only for encapsulations
that allow at least one type, i.e. Ethernet or Wireshark Upper PDU.)
qcustomplot.cpp:34001:37: warning: The left operand of '-' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:34001:37: warning: The right operand of '-' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:26643:9: warning: 1st function call argument is an uninitialized value [core.CallAndMessage]
qcustomplot.cpp:27752:11: warning: 1st function call argument is an uninitialized value [core.CallAndMessage]
qcustomplot.cpp:27779:11: warning: 1st function call argument is an uninitialized value [core.CallAndMessage]
qcustomplot.cpp:34087:7: warning: 2nd function call argument is an uninitialized value [core.CallAndMessage]
qcustomplot.cpp:22400:17: warning: The left operand of '>' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:22400:17: warning: The right operand of '>' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:35170:17: warning: The left operand of '>' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:35170:17: warning: The right operand of '>' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:21229:13: warning: The left operand of '==' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:21274:13: warning: The left operand of '==' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:35323:13: warning: The left operand of '==' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:35349:13: warning: The left operand of '==' is a garbage value [core.UndefinedBinaryOperatorResult]
Add some default IPv6 addresses, used in place of the unspecified
address. These are unique local addresses as in RFC 4193 with
a global ID generated using the pseudo-random algorithm mentioned
therein.
Use nanosecond resolution pcapng files for "Import from Hex Dump"
by default (since we support that level of precision and that's
what text2pcap does).
Disable QAbstractItemView's alternatingRowColors in places where we have
that set. One of Wireshark's most heavily used features is packet
colorization; we use color in packet list and detail rows to convey
information. Simple alternating color rows doesn't do that, and as my
blatant appeal to authority^W^W^W^W^WEdward Tufte points out, "Strips
are merely bureaucratic or designer chartjunk; good typography can
always organize a table, no stripes needed."
https://www.edwardtufte.com/bboard/q-and-a-fetch-msg?msg_id=0001IV
Move the parameter setup to text_import, so that later it can
be called from the GUI, including the interface name. (This has
to be a separate function because these parameters need to be
set before the call to wtap_dump_open, which is different for
regular files vs temp files vs stdout.)
Remove the '-d' option from text2pcap, and move the two levels
of debug messages in text2pcap and text_import to either
LOG_LEVEL_DEBUG or LOG_LEVEL_NOISY as appropriate.
In "Import from Hex Dump", change the control that determines
IPv4 versus IPv6 to a QComboBox, and move it into the grid of
options, in the IP option section.
Only warn about the parser getting an unexpected offset when
using OFFSET_NONE the first time. Use log warnings for subsequent
messages.
Strip off the whitespace/newline/colon from the offset when adding
it to the message, only output the offset number.
text2pcap used 10.1.1.1 and 10.2.2.2 for default IPv4 addresses,
and "Import From Hex Dump" used 1.1.1.1 and 2.2.2.2. The former
are a little bit better for defaults since they're RFC 1918
private IP addresses, so let's use them for the common code.
Add the option to use IPv6 instead of IPv4 for dummy headers,
including custom source and destination address, to the
"Import from Hex Dump" GUI box. Related to #16724
Encapsulate the feature requirements for strptime() in a
portability wrapper.
Use _GNU_SOURCE to expose strptime. It should be enough on glibc
without the side-effect of selecting a particular SUS version,
which we don't need and might hide other definitions.
Add a checkbox for the extra detection for ASCII in a hex+ASCII
hexdump even when the text looks like hexbytes to Import from Hex
Dump. Save and restore it from the settings. Work towards #16724.
If we're in the no offset mode and we parse an offset,
warn the user and ignore. At the very beginning of the file try
adding it to the preamble, maybe there's something unfortunate
like an all numeric time stamp format (ISO-8601 Basic).
A bunch of the globals are simply copied from the input parameter
text_import_info_t, just use them directly.
Move the count for packets read and written into the info type,
so that callers like text2pcap can access them as results.
Don't exit in the middle with unexpected values. Report a failure
and return a failed exit status when something goes really wrong.
Use warnings when appropriate, like when a time code value couldn't
be parsed.
Includes allowing the string "ISO" in the format string text box
in the GUI, so this works in "Import from Hex Dump" as well as
being for the text2pcap transition. Part of #16724.
Use report_message and report wtap_dump failures. Pass in
the output filename and keep track of the frame numbers for
the message parameters.
Report failure to initialize the lex scanner in text_import
instead of in the GUI, so that it would be reported from text2pcap,
and because text_import might have other failure cases that are
not the scanner.
The regex parser returns a positive number of packets processed
on success; save that number in text_import, and return zero on
success to our callers.
This is the special check for canonical hex+ASCII textdump
files that looks for the edge case where the beginning of the
ASCII column has strings that can be mistaken by the parser for
additional hex bytes. Not implemented in the GUI yet. Preparing
for text2pcap switchover. Related to #16724.
Adjust the grammar to recognize two trailing hexadecimal characters
without a LF as a byte as well. Ported from text2pcap and commit
22cf80d30d which explains why this
is safe. More work for #16724.
Repeated words were found with:
egrep "(\b[a-zA-Z]+) +\1\b" . -Ir
and then manually reviewed.
Non-displayed strings (e.g., in comments)
were also corrected, to ease future review.
Add IPv6 handling to text_import, including the ability to
handle dummy IPv6 addresses instead of IPv4. GUI support is
still TBD. This further reduces the number of text2pcap features
that ui/text_import does not yet support. Related to #16724.
Add dummy IPv4 addresses to the text_import_info_t struct, and
use them if set in the same way text2pcap does. GUI support in
"Import from Hex Dump" is not added yet. This is also part of the
work for text2pcap to eventually call text_import. Related to #16724.
The encapsulation type that text_import expects and puts
directly into rec.rec_header.packet_header.pkt_encap is a
wiretap encap type, not a pcap link type. Fix the name and
comment appropriately.
Correctly handle when a minimum packet length forces fragmentation of
SCTP and we are generating dummy SCTP DATA chunk headers: mark fragmentation
in the chunk flags and set the transmission sequence number and
stream sequence number appropriately.
Port from text2pcap commit f8d48662c8
Part of #16724.
The "Import from Hex Dump" time delta for packets without a timestamp
was changed to be a nanosecond, but the time resolution for the file
created by import_text_dialog is the default, microseconds. Until
that is configurable, the time tick used needs to be microseconds like
it was before.
Clean up the code so that it's a little more consistent about when
and how the extra time tick is added, namely:
1. If there is no time format passed in.
2. If time format conversion for the packet fails for any reason.
We don't add an extra delta in other situations, e.g. if packets just
happen to have the same valid time value.
Fix#15562.
_parse_time, which uses g_strlcpy, expects that end_field points
to the position after the end of the field (such as the \0.)
text_import_regex handles this correctly, but when importing from
hex dumps the last character of the timestamp was being cut off,
which makes a big difference when fractional seconds are not used.
For historical reasons our logging inherited from GLib the logging of
some levels to stdout. Namely levels "info" and "debug" (to which we
added "noisy").
However this practice is discouraged because it mixes debug output
with application output for CLI tools and breaks many common usage
scenarios, like using tshark in pipes.
This change flips the logic on wslog to make logging to stderr the
default behavior.
Extcap subprocess have a hidden dependency on stdout so add that.
Some GUI users may also have a dependency on stdout. Because
GUI tools are unlikely to depend on stdout for programatic output
add another exception for wireshark GUI, to preserve backward
compatibility.
This lowers the level of this message from "message" to
"info". This has two side-effects:
- It is not displayed by default
- It is printed to stdout instead of stderr.
Some users were depending on this message. Restore this to
the level it had before 05ed76d4. Even though this output is
not considered a stable interface restoring the old behavior
helps them and has no meaningful usability downsides. The
changes in 05ed76d4 were experimental anyway.
Related to #17763.
Actually output the packet count for RTSP response status codes,
and align the columns between requests and response. (This CLI-only
stat is largely redundant with rtsp,tree but it might as well work.)
Actually output the packet count for HTTP response status codes,
and align the columns between requests and response. (This CLI-only
stat is largely redundant with http,tree but it might as well work.)
Without this, the simple stat tables default to sorting by the first
column in descending order. (An artifact of the QTreeWidget that they
inherit from.) The first column is generally a message type (integer or
string) and ascending order makes more sense.
Some of the stat tables intentionally insert rows in a preferred order
that is different than sorting by the first column (e.g, ANSI A I/F tables
are sorted by the second column), but we can't tell what that is.
QTreeWidget only allows the data to be shown in its original unsorted
order if the widget is marked unsortable, but then the user isn't allowed
to sort at all, and being able to sort by other columns (such as count)
is useful.
Extcaps require a log file when invoked in child mode. It also has
a specific flag to enable debugging, other that the wslog options.
Fix the logging to:
1. Enable debug log level if --debug is used.
2. Do not emit messages to the stderr if debug is enabled.
This brings extcap logging to the same feature level it had before
wslog replaced GLib logging.
There is some lose of detail in the group label but eliminates
the misleading information that comes from grabbing the
potentially modified summary of the first entry in the group.
Closes#14892#14425
Wireshark successfully compiles on Windows with Qt6.2 with following
cmake options:
-DUSE_qt6=ON -DDISABLE_ERROR=ON
QCustomPlot QT 6.2 patch is taken from QCustomPlot forum post by miccs.
Qt5 recommended to use QRegularExpression instead of QRegExp.
Qt6 deprecated QRegExp and provides it in Qt5 compatibility module.
QRegularExpression is generally faster and safer to use as the results
are returned in separate QRegularExpressionMatch instead of modifying
interal QRegExp object state.
This is basically applying c knowledge and Google to the compiler
error messages. There is basically no understanding involved into
what I was doing:
- No idea why lots of #includes needed to be added for Qt6
- No idea how to actually fix the remaining problems, but it's a start
Things that need to be done:
- The AudioDeviceInfo thingy needs to be replaced by something new (as
an interim solution another patch disables the audio player in Qt6).
- GRegExp eventually needs to be replaced by QRegularExpression
(available since Qt5.0, so development can be done in Qt5).
- Solutions for the other problems like some methods no longer
being available in Qt6 that have to sort of co-exist with Qt5.
In order to be able to defer solving all Qt6 API differences at once
I tried to reactivate the QT_MULTIMEDIA_LIB feature. I managed to fix
most problems but one problem remains in both Qt5 and Qt6 builds.
Without Qt[56]Multimedia, the following error exceeds my non-existing
C++ knowledge:
jmayer/work/wireshark/git/ui/qt/rtp_player_dialog.cpp:154:18: error: out-of-line definition of 'RtpPlayerDialog' does not match any declaration in 'RtpPlayerDialog'
RtpPlayerDialog::RtpPlayerDialog(QWidget &parent, CaptureFile &cf, bool capture_running) :
^~~~~~~~~~~~~~~
Of course it still fails in the compile phase, but only for some
of the ui/qt/ files.
Wireshark with Qt5 still compiles and runs.
To do the build invoke cmake with the following settings added:
export CMAKE_PREFIX_PATH=:${MY_QT6_PREFIX}/lib/cmake
cmake -DUSE_qt6=ON ...
Independently of this patch there is lots of Qt-stuff in
CMakeLists.txt that needs review/cleanup:
- Some of the stuff can probably be solved in a less hacky way:
+ There seemed to be a way for QT6 to provide the required c++-standard,
but in the end I could not find it.
+ Once we have a working Qt6 codebase, we may get rid of the USE_qt6
flag and just test for Qt6Core first and if not present check for
Qt5Core.
- All comments that match /qt ?[4-6]/i need reviewing/cleaning up.
- The changes in this patch have been tested to work on all machines
that are my mac (macos 12.0.1, XCode 13.1, Intel, GPL-Qt6.2.1 with only
the macos package selected, cmake 3.21.4)
Add ui/qt/qt6-migration-links.txt for some possibly helpful links
The column parameter in PacketListRecord::columnString() must be
below cap_file->cinfo.num_cols to be valid. An issue with this check
may be triggered when switching profile.
Pass the funnel operations ID to new_text_window and new_dialog so that
we can assign parent widgets when we create new FunnelTextDialogs and
FunnelStringDialog. This should ensure that they're destroyed properly.
Ping #17590.
This reverts commit c2edb44a9a.
While we should definitely avoid leaking memory, this runs up against
the Qt code's assumption that it will always have valid epan data.
Fixes#17590.
Fixes#17719.
Do not keep epan_dissect_t instance hanging until FrameInformation
destructor is called. Simply copy the tvb data into local buffer and
cleanup epan_dissect_t instance as soon as possible.
Fixes#17590
Add uat_set_default_values, which lets us provide default values for
fields that might be missing from the end of a UAT line. Set a default
value for the I/O Graph dialog's Y Axis Factor. Fixes the backward
compatibility issue described in #17623
If an ftype can participate in equala assume it can also participate in
not equals. Use fvalue_can_eq() instead of fvalue_can_ne().
If it can participate in one order comparison it can participate in all.
Replace any comparison with fvalue_can_cmp().
As searching the list of protocols takes a noticeable amount
of time and so would introduce significant lag while typing a string
into the Search box, we instead debounce the call to
updateSearchLineEdit(), so that it doesn't run until a set amount of
time has elapsed with no updates to the Search field.
If the user types something before the timer elapses, the timer restarts
the countdown.
The first call to Follow Stream forgot to disable the arrow
button. Reverse the precedence between the display filter edition
and the display filter success now gives the expected GUI behavior.
Closes#10774
Wireshark defines the relation of equality A == B as
A any_eq B <=> An == Bn for at least one An, Bn.
More accurately I think this is (formally) an equivalence
relation, not true equality.
Whichever definition for "==" we choose we must keep the
definition of "!=" as !(A == B), otherwise it will
lead to logical contradictions like (A == B) AND (A != B)
being true.
Fix the '!=' relation to match the definition of equality:
A != B <=> !(A == B) <=> A all_ne B <=> An != Bn, for
every n.
This has been the recomended way to write "not equal" for a
long time in the documentation, even to the point where != was
deprecated, but it just wasn't implemented consistently in the
language, which has understandably been a persistent source
of confusion. Even a field that is normally well-behaved
with "!=" like "ip.src" or "ip.dst" will produce unexpected
results with encapsulations like IP-over-IP.
The opcode ALL_NE could have been implemented in the compiler
instead using NOT and ANY_EQ but I chose to implement it in
bytecode. It just seemed more elegant and efficient
but the difference was not very significant.
Keep around "~=" for any_ne relation, in case someone depends
on that, and because we don't have an operator for true equality:
A strict_equal B <=> A all_eq B <=> !(A any_ne B).
If there is only one value then any_ne and all_ne are the same
comparison operation.
Implementing this change did not require fixing any tests so it
is unlikely the relation "~=" (any_ne) will be very useful.
Note that the behaviour of the '<' (less than) comparison relation
is a separate, more subtle issue. In the general case the definition
of '<' that is used is only a partial order.
To enhance the Merge 4644, the isReadRunning variable scope is
changed to reduce the header footprint and make the code compliant
to the usual coding rules.
When changing one of the selection parameters in the Follow Stream
dialog while a filtering task is already running, the result is
inaccurate.
While a filtering task is already running in the Follow Stream
dialog, any filter change which triggers a new filtering gives a
wrong result. Both the displayed data and the Save As functions
are impacted. Closes#15637
The statistics that use the stats_tree API parse the -z option
without expecting a comma separator between the statistics name
and the filter. This is contrary to both the man pages and how
all the other options work. Fix that so it's consistent.
Fix#17656
For #16186. Proposed changes to the tooltips which appear when a filter
expression is potentially problematic.
Rename references to "User's Guide" to "Help" since the link to the
User's Guide in the Help menu is just called *Contents*.
Name specific sections within the help which pertain to the warning
tooltip being shown. Gives first-time users some help in finding the
right part of the sizeable User's Guide.
Q_OBJECT is only needed for signals+slots, translations, and other
meta-object services. Remove it in some classes, since having it means
we're generating and compiling code unnecessarily.
Improve reload Lua plugins to handle fieldsChanged before calling
the preferences apply callback, because a proto.prefs_changed()
function may call reload_packets() or redissect_packets(), and this
requires the fields to be updated.
Changing profile during capture may change the capture_opts->show_info
setting. Always init cap_session->wtap and check if valid before doing
capture_info_new_packets(). Always close dialog and cap_session->wtap
in capture_input_closed().
This will not bring up the Capture Information dialog when switching
to a profile having this enabled.
Fixes#17622
Support reloading a Lua FileHandler when this is in use for a
loaded capture file. Prompt to save the file if having unsaved
changes because the file must be reloaded.
Fixes#17615
Profile files which is only used in Qt is not automatically registered
during startup and must be explicit registered.
Add profile_register_persconffile() to handle this registration.
Adds a checkbox 'Automatic Update' to the IO Graph to enable or disable
rescans and recalculation of graph data temporarily. This is useful when
you want to modify settings of multiple graphs without triggering a rescan
with every change of a single setting. This becomes useful for large trace
files in particular.
Rescan or recalculation events are queued while 'Automatic Update' is not
active. Checking 'Automatic Update' triggers the queued updates.
The setting for 'Automatic Update' is stored in a preference.
A german translation for 'Automatic Update' is included.
Mingw-w64 has this function. We may have to define some extra symbols
for API visibility but on my system the config check is working out
of the box.
POSIX systems come in many flavours, remove the "save time" if()
condition in this case.
Fix code to check if we have clock_gettime() on Windows as well.
The locale information can be excessively verbose. Cut down the
number of categories displayed to one, arguably the most relevant
for troubleshooting purposes.
Store all user specified values from the "Import from Hex Dump"
dialog in a profile import_hexdump.json file.
Set default ExportPDU dissector to "data".
Fixed a minor typo in a help text.
Besides the obvious limitation of being unavailable on Windows,
the standard is vague about getopt() and getopt_long() has many
non-portable pitfalls and buggy implementations, that increase
the maintainance cost a lot. Also the GNU libc code currently
in the tree is not suited for embedding and is unmaintainable.
Own maintainership for getopt_long() and use the musl implementation
everywhere. This way we don't need to worry if optreset is available,
or if the $OPERATING_SYSTEM version behaves in subtly different ways.
The API is under the Wireshark namespace to avoid conflicts with
system headers.
Side-note, the Mingw-w64 9.0 getopt_long() implementation is buggy
with opterr and known to crash. In my experience it's a headache to
use the embedded getopt implementation if the system provides one.
Allow the hover selection to be either configured via context menu
or by pressing the Ctrl key while moving the mouse. The configuration
is stored via profile
"Follow Stream" functionality assumes that all data in a single packet
belongs to the same stream. That is not true for HTTP2 and QUIC, where
we end up having data from unrelated streams.
Filter out the unwanted data directly in the protocol dissector code with
a custom `tap_handler` (as TCP already does).
Close#16093
The related-packet drawing code currently intermingles the selection and the
drawing of the conversation "trace" lines and the indicators. Separating them
out -- so we make the decisions upfront and then do the drawing -- will help
with any future work in this area.
The Ubuntu build commented on some spelling errors in executable code
files. Fix the errors that don't come from external files containing
the spelling errors (USB product and vendor IDs, PCI IDs, ASN.1
specifications), and fix some errors that don't show up in the
executable code files (e.g., in comments and variable names).
Allow the user to select multiple packets, and
* add the same comment to all selected packets
* remove all comments from selected packets
A new comment is added to each packet, now that we support multiple
comments per packet.
This is one potential way to address #8713.
Save a list of all user options that were specified on the Wireshark
command line using the `-o` option. Reapply those preferences after
reloading Lua plugins. Fixes the behaviour given in #12331 wherein such
prefs were reset to the defaults, not the command-line values, when
reloading Lua plugins.
When the user changes a preference in the Wireshark UI, remove that
preference from the stored command line options, so it doesn't get reset
when Lua plugins are reloaded again.
If a graph is added it should be a single operation, not multiple setData operations
leading to a myriad of dataChanged signals to be fired, which in turn can hinder redissection.
Wireshark/tshark may be built without Lua support. This patch adds an
error message if the user specifies the `-X lua_script` command-line
argument to a program built without Lua support, so the user is not left
wondering why their script isn't working.
Without that, you could add a comment to a record in a file format the
reading code for which doesn't allocate blocks, but the comment doesn't
get saved, as there's no block in which to save the comment option.
This simplifies some code paths, as we're either using the record's
modified block or we're using the block as read from the file, there's
no third possibility.
If we attempt to read a record, and we get an error, and a block was
allocated for the record, unreference it, so the individual file readers
don't have to worry about it.
Set PacketDiagram as parent of QGraphicsScene so the scene is destroyed
together with PacketDiagram.
Dynamically allocate WiresharkApplication and explicitly call its
destructor when no longer needed. This results in deletion of
FunnelAction objects created in register_menu_cb() and QAction objects
created in TapParameterDialog::registerDialog(). For some reason, when
breakpoint was set inside WiresharkApplication destructor it would not
get triggered on exit, and so the child objects would get reported as
memory leaks.
Delete main window and application only after epan_cleanup(). This makes
lua plugins actually call ops during cleanup (e.g. destroy_text_window)
and makes it possible to free the memory allocated in FunnelStatistics
constructor.
Instead of creating endless loop and synchronizing using QWaitCondition,
execute the syntax worker check in its thread by emitting signal. The
syntax worker thread affinity is set to worker thread so the slots
handling takes place within the worker thread context.
This patch allows the profile importer to recover from a file too large
to import as well as adjusts the maximum allowed config file size.
Closes: #17504
When capture was longer (e.g. 800s), audio was decoded correctly, but
visual waveform was shown incorrectly. Reason was exceeding range of
guint32 during calculation. Calculation is now made in guint64 and then
put back to guint32.
Bug 17478 was caused by `wtap_rec.block` being allocated for each
packet, but not freed when it was done being used -- typically at the
end of a loop.
Rather than requiring each caller of `wtap_read()` to know to free a
member of `rec`, I added a new function `wtap_rec_reset()` for a
slightly cleaner API. Added calls to it everywhere that seemed to make
sense.
Fixes#17478
This header was installed incorrectly to epan/wmem_scopes.h.
Instead of creating additional installation rules for a single
header in a subfolder (kept for backward compatibility) just
rename the standard "epan/wmem/wmem.h" include to
"epan/wmem_scopes.h" and fix the documentation.
Now the header is installed *correctly* to epan/wmem_scopes.h.
Those routines can't add an option if there's no block to add it to;
this meant that neither the direction nor the sequence number would be
set when importing a packet.
Automated find/replace of wmem_packet_scope() with pinfo->pool in all
files where it didn't cause a build failure.
I also tweaked a few of the docs which got caught up.
John Thacker