Commit Graph

222 Commits

Author SHA1 Message Date
Masaru Tsuchiyama c14ea41233 add support for compression of capture file 2020-10-30 00:25:22 +00:00
David Perry e4379f0ea1 Dumpcap: print closed ring-buffer file names
This proposal adds a new option '-b printname:<filename>' to dumpcap. If
used, dumpcap will print the name of each ring buffer file it creates
after it is closed. Allows the use of '-'/'stdout' and 'stderr'.

Use case: Since the file name is printed after the file is closed for
writing, an automated capture process can do something like the
following with the guarantee that the file in question will not be
changed.

    dumpcap -i eth0 -b files:2 -b printname:stdout [-b ...] | \
    while read cap_file_name ; do
        # Do something with $cap_file_name
    done

This sort of scripting is difficult in dumpcap's current form. Dumpcap
prints the names of new files to stderr as it *opens* them, so a script
attempting to use this must sleep for "-b duration:value" seconds plus
some fudge time to be sure it's getting a closed, unchanging file.

Change-Id: Idb288cc7c8c30443256d35c8cd4460a2e3f0861c
Reviewed-on: https://code.wireshark.org/review/37994
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-08-08 08:04:13 +00:00
Guy Harris 7f9f781d32 Warn, in a comment, that an interface name could be a valid decimal number.
Our current assumption that a numeric argument to -i must be an index
interface is not valid on Linux; see

	https://github.com/the-tcpdump-group/tcpdump/issues/522

Change-Id: Ieb6e17e6ceb23095a463336f0c88182373503aa6
Reviewed-on: https://code.wireshark.org/review/37369
Reviewed-by: Guy Harris <gharris@sonic.net>
2020-06-02 22:20:26 +00:00
Peter Wu ef717da61a CMake: remove ENABLE_PCAP_NG_DEFAULT option
pcapng has been the compile-time default since 2011. If there are any
users who would like to use the libpcap format, then they should use
runtime options instead (e.g. `tshark -P` or `editcap -F pcap`).

Change-Id: I54b70368cdc3ca78bc8617bc488cc687740a1eb9
Reviewed-on: https://code.wireshark.org/review/36721
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <gharris@sonic.net>
2020-04-06 01:29:37 +00:00
Guy Harris fd88bfa348 Write the if_hardware option, if available, to pcapng files when capturing.
Change-Id: Ib9ff78d148a2364c84d84b4a9b020b3d783654a3
Reviewed-on: https://code.wireshark.org/review/36602
Petri-Dish: Guy Harris <gharris@sonic.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <gharris@sonic.net>
2020-03-28 03:34:18 +00:00
Guy Harris 20800366dd HTTPS (almost) everywhere.
Change all wireshark.org URLs to use https.

Fix some broken links while we're at it.

Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c
Reviewed-on: https://code.wireshark.org/review/34089
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-07-26 18:44:40 +00:00
Stig Bjørlykke 1df39d65f5 Qt: Fix removal of "Capture to a permanent file" setting
Make it possible to remove the "Capture to a permanent file" setting
in Capture Interfaces Output dialog by turning off saving_to_file in
updateInterfaces().

Also make sure to free the old values for save_file and orig_save_file
to avoid memory leaks.

Set orig_save_file to the same as save_file from the '-w' option to
fill in the current "Capture to a permanent file" value correctly.

Change-Id: I1f4df8cfa279f934eff028f32838b9734b627af1
Reviewed-on: https://code.wireshark.org/review/32111
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-02-20 04:22:51 +00:00
Guy Harris ba589a4e44 Move some command-line-oriented routines from wsutil to ui.
cmdarg_err() is for reporting errors for command-line programs and
command-line errors in GUI programs; it's not something for any of the
Wireshark libraries to use.

The various routines for parsing numerical command-line arguments are
not for general use, they're just for use when parsing arguments.

Change-Id: I100bd4a55ab8ee4497f41d9651b0c5670e6c1e7f
Reviewed-on: https://code.wireshark.org/review/31281
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-01-01 02:07:06 +00:00
Gerald Combs 11a9a501fb Dumpcap+Qt: Add support for `-a packets:NUM` and `-b packets:NUM`.
Add the ability to rotate files after a specified number of packets (`-b
packets:NUM`). Move some condition checks to capture_loop_write_packet_cb.

Add `-a packets:NUM` in order to be consistent. It is functionally
equivalent to the `-c` flag.

Add a corresponding "packets" option to the Capture Interfaces dialog
Output tab.

Add initial tests for autostop and ringbuffer conditions.

Change-Id: I66eb968927ed287deb8edb96db96d7c73526c257
Reviewed-on: https://code.wireshark.org/review/30534
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-11-09 05:55:11 +00:00
Pascal Quantin 81178537cd Use ws_pipe_close() in one more place
Change-Id: I584df2c7ae8041a29d9941995883c232abb040d6
Reviewed-on: https://code.wireshark.org/review/30452
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2018-11-01 08:47:57 +00:00
Gerald Combs 8b977a43d6 Move condition logic to dumpcap.c
Move the condition logic from capture_stop_conditions.c to dumpcap.c.
Remove capture_stop_conditions.[ch] and conditions.[ch].

Switch duration values to doubles.

Change-Id: Ifa74fb13ec8fc923b0721597a6cf071d72069ea0
Reviewed-on: https://code.wireshark.org/review/30440
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-11-01 05:09:10 +00:00
Vasil Velichkov 787d61c0a4 tshark: free exp_pdu_filename and capture_opts->save_file
valgrind --tool=memcheck --leak-check=full ./run/tshark -r sctp.pcap -U "OSI layer 3" -w exported.pcap

13 bytes in 1 blocks are definitely lost in loss record 20 of 93
   at 0x4C2EBAB: malloc (vg_replace_malloc.c:299)
   by 0xB27B3C5: g_malloc (gmem.c:99)
   by 0xB294D22: g_strdup (gstrfuncs.c:363)
   by 0x117B5D: capture_opts_add_opt (capture_opts.c:889)
   by 0x118C0E: main (tshark.c:1112)

Change-Id: I9b794015aa4d2626b43a5743864c2d732c6acaa1
Reviewed-on: https://code.wireshark.org/review/29125
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-08-17 22:20:54 +00:00
Guy Harris 102538ea7b Move common code into a routine.
Change-Id: Ia3b7e35e469a3231bb749025debe11d3ba2de99a
Reviewed-on: https://code.wireshark.org/review/29148
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-08-15 07:52:51 +00:00
Guy Harris 149e74b70d Put the interface descrptions into the IDB when capturing to pcapng.
capture_opts_add_iface_opt(), when called in a program acting as a
capture child, will fetch the description for the interface, and will
also generate a "display name" for the interface.

In the process, we clean up capture_opts_add_iface_opt() a bit,
combining duplicate code.

We rename console_display_name to just display_name, as it may also be
used in the title bar of Wireshark when capturing.

Change-Id: Ifd18955bb3cb41df4c0ed4362d4854068c825b96
Reviewed-on: https://code.wireshark.org/review/29117
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-08-13 04:37:00 +00:00
Anders 25a337cdb0 glib: Use g_slist_free_full() in a couple of places.
Change-Id: Iff833bf5c197959c8decb62d6ce794c6d0415fb7
Reviewed-on: https://code.wireshark.org/review/26978
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-04-17 15:01:24 +00:00
Gerald Combs 80d652f06e More spawned process handling updates.
Document ws_pipe.h. Define invalid PIDs in one place.

Extcap didn't use stdin before 1a0987904f. Make sure we close it.

Change-Id: I7a69cd9b5137ae82435e64628a22e4d812d58f89
Reviewed-on: https://code.wireshark.org/review/26226
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-03-02 18:07:58 +00:00
Gerald Combs 1a0987904f Generalize our process spawning code.
Move the contents of extcap_spawn to ws_pipe. Rename various extcap_*
prefixes to ws_pipe_*. Open stdin when we spawn processes.

Change-Id: I9286295443ee955bb6328b0ed6f945ee0bb2a798
Reviewed-on: https://code.wireshark.org/review/26216
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-03-02 05:22:20 +00:00
Dario Lombardo 8cd389e161 replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.
The first is deprecated, as per https://spdx.org/licenses/.

Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed
Reviewed-on: https://code.wireshark.org/review/25661
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-08 14:57:36 +00:00
Guy Harris af0f49e80d Use pcapng as the name of the file format.
At one point, I remember a discussion resulting in the official name of
the next-generation replacement for pcap format being changed to
"pcapng", with no hyphen.

Make Wireshark reflect that.

Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a
Reviewed-on: https://code.wireshark.org/review/25214
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-01-09 00:38:51 +00:00
Dario Lombardo e80b40adbe extcap: remove conditional compilation.
Change-Id: Ia54bba388755cf27a343fe6d69d244bf1ab897f9
Reviewed-on: https://code.wireshark.org/review/25186
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-01-08 05:50:15 +00:00
Gerald Combs 34b62c60bf Revert "Move fill_in_local_interfaces to a thread."
Calling scan_local_interfaces ends up calling fork via extcap. Doing so
from a thread is ill-adivsed:

https://rachelbythebay.com/w/2014/08/16/forkenv/
http://www.linuxprogrammingblog.com/threads-and-fork-think-twice-before-using-them

This reverts commit 5b4894b795.

Revert "fix compilation without pcap." as well.
This reverts commit 51300b3c83.

Change-Id: Ic80582b52398c44af73c6d74dbb3216c4d1b37fc
Reviewed-on: https://code.wireshark.org/review/24772
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2017-12-11 23:29:00 +00:00
Dario Lombardo 51300b3c83 fix compilation without pcap.
Fix a regression introduced by I09beab751c9c2917f017b6c082166d86ca693544.

Change-Id: I57b971086470e836f4147500143c35494118e754
Reviewed-on: https://code.wireshark.org/review/24765
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-12-11 16:49:20 +00:00
Gerald Combs 775bbbcded Start using SPDX license identifiers.
A while back Graham pointed out the SPDX project (spdx.org), which is
working on standardizing license specifications:

https://www.wireshark.org/lists/wireshark-dev/201509/msg00119.html

Appendix V of the specification describes a short identifier
(SPDX-License-Identifier) that you can use in place of boilerplate in
your source files:

https://spdx.org/spdx-specification-21-web-version#h.twlc0ztnng3b

Start the conversion process with our top-level C and C++ files.

Change-Id: Iba1d835776714deb6285e2181e8ca17f95221878
Reviewed-on: https://code.wireshark.org/review/24302
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Reviewed-by: Balint Reczey <balint@balintreczey.hu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-11-09 20:03:51 +00:00
Ahmad Fatoum 9d49e13166 Remove superfluous null-checks before strdup/free
NULL checks were removed for following free functions:

- g_free "If mem is NULL it simply returns"
  https://developer.gnome.org/glib/stable/glib-Memory-Allocation.html#g-free

- g_slist_free(_full)? "NULL is considered to be the empty list"
  https://developer.gnome.org/glib/stable/glib-Singly-Linked-Lists.html

- g_strfreev "If str_array is NULL, this function simply returns."
  https://developer.gnome.org/glib/stable/glib-String-Utility-Functions.html#g-strfreev

- g_slice_free "If mem is NULL, this macro does nothing."
  https://developer.gnome.org/glib/stable/glib-Memory-Slices.html#g-slice-free

- g_match_info_free "not NULL... otherwise does nothing"
  https://developer.gnome.org/glib/stable/glib-Perl-compatible-regular-expressions.html#g-match-info-free

- dfilter_free defined in Wireshark code. Returns early when passed NULL
  epan/dfilter/dfilter.c

They were also removed around calls to g_strdup where applicable:

- g_strdup "If str is NULL it returns NULL."
  https://developer.gnome.org/glib/stable/glib-String-Utility-Functions.html#g-strdup

Change-Id: Ie80c2db89bef531edc3aed7b7c9f654e1d654d04
Reviewed-on: https://code.wireshark.org/review/23406
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: João Valverde <j@v6e.pt>
2017-10-15 12:38:51 +00:00
Mikael Kanstrup 287221e8d9 Free interface_options elements on cleanup
At shutdown the array keeping all interface_options is freed.
The array elements however are not making valgrind and ASAN
complain. Make sure the elements are freed on cleanup.

Ping-Bug: 13864
Change-Id: If8b810ea5f4f11c5ce770a9ffa6c2c791bc561fe
Reviewed-on: https://code.wireshark.org/review/23265
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2017-08-28 16:53:38 +00:00
Mikael Kanstrup 3b16cc8b21 iface_lists: Access ifaces member by reference
Change access of ifaces elements from by val to by reference.
With this change unnecessary copying of the whole struct is avoided
but even more important is that elements no longer have to be
removed and inserted whenever data is updated.

This change aims to make it more clear that ifaces elements shall
never directly be removed from the array. Instead use function
capture_opts_del_iface

NOTE: Code for GTK UI not updated

Ping-Bug: 13864
Change-Id: I04b65d5ee36526b30d959b8e5a2a48a3c7c4f15b
Reviewed-on: https://code.wireshark.org/review/23204
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-28 14:43:13 +00:00
Mikael Kanstrup e26926432d Free interface elements on cleanup
At shutdown the array keeping all network interfaces is freed.
The array elements however are not making valgrind and ASAN
complain. Make sure the elements are freed on cleanup.

Ping-Bug: 13864
Change-Id: I1efeb03f42fb6f0b87dada8ef50d85f47f93e0dc
Reviewed-on: https://code.wireshark.org/review/23202
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-28 14:42:28 +00:00
Mikael Kanstrup 8873c7e494 iface_lists: Access all_ifaces member by reference
Change access of all_ifaces elements from by val to by reference.
With this change unnecessary copying of the whole struct is avoided
but even more important is that elements no longer have to be
removed and inserted whenever data is updated.

This change aims to make it more clear that all_ifaces elements
shall never be removed from the array without freeing resources
via the capture_opts_free_interface_t function.

NOTE: Code for GTK UI not updated

Ping-Bug: 13864
Change-Id: I36742cb1d5c8daa136c9d3732a044a7c8e5c7fe7
Reviewed-on: https://code.wireshark.org/review/23201
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-28 14:41:43 +00:00
Håkon Øye Amundsen 018f6bff18 extcap: Interface Toolbar support on Windows
Add support for extcap control pipes on Windows.
Improved read loop in InterfaceToolbarReader.
Delay opening control pipes until extcap has opened the fifo pipe.
Make extcap_example.py work on Windows.

Bug: 13833
Change-Id: I4b47d25452637759b8a3be53be48eee5365bc0e4
Reviewed-on: https://code.wireshark.org/review/23211
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-28 05:48:01 +00:00
Stig Bjørlykke 4540195025 extcap: Create unique pipe names for each interface
On Windows the pipe names does not get random characters appended.
Add the interface name and pipe type to make it unique.

This partly fixes the issue with capturing from multiple extcap
interfaces on Windows.

Ping-Bug: 13653
Ping-Bug: 13833
Change-Id: I4290b37cf789bf77608993682a803aca29513d28
Reviewed-on: https://code.wireshark.org/review/23158
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-23 07:26:18 +00:00
Ahmad Fatoum be69761c78 Fix requesting hardware timestamps without -k
The interface_options struct passed to dumpcap is populated
differently when running Wireshark with and without -k.

Previously, only with -k was there a valid pointer in
interface_opts.timestamp_type

Fixes: aca55a2 ("Add hardware timestamping support")
Signed-off-by: Ahmad Fatoum <ahmad.fatoum@siemens.com>
Change-Id: Ic7ecc5a1190c28197d6a7271f1b353f74d43ca61
Reviewed-on: https://code.wireshark.org/review/23160
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-08-22 12:18:12 +00:00
Ahmad Fatoum aca55a29f7 Add hardware timestamping support
pcap provides a pcap_set_tstamp_type function, which can be used to request
hardware timestamps from a supporting kernel.

This patch adds support for aforementioned function as well as two new
command line options to dumpcap, wireshark and tshark:

    --list-time-stamp-types
                             List time stamp types supported for the interface
    --time-stamp-type <type>
                             Change the interface's timestamp method

Name choice mimics those used by tcpdump(1), which already supports this
feature. However, unlike tcpdump, we provide both options unconditionally.
If Wireshark was configured without pcap_set_tstamp_type being available,
--list-time-stamp-types reports an empty list.

Change-Id: I418a4b2b84cb01949cd262aad0ad8427f5ac0652
Signed-off-by: Ahmad Fatoum <ahmad.fatoum@siemens.com>
Reviewed-on: https://code.wireshark.org/review/23113
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-22 07:55:26 +00:00
Sake Blok 3803e00367 Add option to use wall-clock intervals
Add the "interval" option to "-b". Each new capture starts at the
exact start of a time interval. For instance, using -b interval:3600
will start a new capture file at each whole hour.

Changed the duration option in the GUI interfaces to use the new
interval option.

Change-Id: I0180c43843f5d2f0c2f50153c9ce42ac7fa5aeae
Reviewed-on: https://code.wireshark.org/review/22428
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Sake Blok <sake.blok@SYN-bit.nl>
2017-07-03 16:41:37 +00:00
Guy Harris d0865fd619 Allow bigger snapshot lengths for D-Bus captures.
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except
for D-Bus captures.  Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for
them, because that's the largest possible D-Bus message size.  See

	https://bugs.freedesktop.org/show_bug.cgi?id=100220

for an example of the problems caused by limiting the snapshot length to
256KB for D-Bus.

Have a snapshot length of 0 in a capture_file structure mean "there is
no snapshot length for the file"; we don't need the has_snap field in
that case, a value of 0 mean "no, we don't have a snapshot length".

In dumpcap, start out with a pipe buffer size of 2KB, and grow it as
necessary.  When checking for a too-big packet from a pipe, check
against the appropriate maximum - 128MB for DLT_DBUS, 256KB for
everything else.

Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20
Reviewed-on: https://code.wireshark.org/review/21952
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-05 05:28:26 +00:00
Stig Bjørlykke 77751c94f1 Qt: Add interface toolbar support
An extcap utility can provide configuration for controls to use in a
GUI interface toolbar.  This controls are bidirectional and can be
used to control the extcap utility while capturing.

This is useful in scenarios where configuration can be done based on
findings in the capture process, setting temporary values or give other
inputs without restarting current capture.

Todo:
- Add support for Windows

Change-Id: Ie15fa67f92eb27d8b73df6bb36f66b9a7d81932d
Reviewed-on: https://code.wireshark.org/review/19982
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2017-04-25 06:19:39 +00:00
Guy Harris 77cad8561c Move the filter file reading code to libui.
It doesn't belong in libwireshark, as it doesn't affect dissection, but
it *does* belong in libui, as it's helper code for the UIs.

Change-Id: I8a5e0640a299a08e9ec1917dd253197438ebfdbc
Reviewed-on: https://code.wireshark.org/review/20974
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-09 04:25:52 +00:00
Dario Lombardo 7c0c580c4b wiretap: add cleanup routine.
The cleanup routine has been added to exit section of the applications.
Those which required a exit restyle have been patched as well.

Change-Id: I3a8787f0718ac7fef00dc58176869c7510fda7b1
Reviewed-on: https://code.wireshark.org/review/19949
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
2017-02-14 10:22:20 +00:00
Dario Lombardo 93a5c83f0a capture_opts: free memory on exit to avoid leak.
This required a restyle of the way the different apps exit.

Change-Id: Iedf728488954cc415b620ff0284d2e60f38f87d2
Reviewed-on: https://code.wireshark.org/review/19780
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
2017-02-02 22:04:14 +00:00
Guy Harris 8629e60922 More signed vs. unsigned argument cleanups.
Use the get.*guint32 routines to get unsigned values.

Change-Id: I75e83b2d21bdf08c7c995e36e4deb3b1c6d6959d
Reviewed-on: https://code.wireshark.org/review/17651
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-09-11 20:49:05 +00:00
Roland Knall c611eded22 extcap: Use stderr to print error message
This patch reads out the stderr messages from an extcap
utility and displays it to an user. It was tested on Qt
but not on GTK, but should work their as well.

On Mac OS/X and Windows the child_watch does not behave
as it was intended. Therefore in extcap_cleanup, the callbacks
are called manually, if and only if, they have not been
called already.

The reason why it displays two error messages is, that
by the time the first one is being displayed, glib has not
returned from the spawned process on Linux yet. So there
is no way to add the stderr correctly, and putting a handler
to stderr into interface_opts will lead to memory errors,
cause then the code tries to access memory outside of its
protection.

Bug: 11892
Change-Id: I2db60dd480fed3e01428b91a705057e4f088bd15
Reviewed-on: https://code.wireshark.org/review/12954
Reviewed-by: Roland Knall <rknall@gmail.com>
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-07-30 21:15:39 +00:00
Roland Knall f2786bc8ff extcap: Remove g_spawn_helper support
Move g_spawn to separate file and implement functions to
 use Windows based method of spawning, instead of the glib
 based version

Change-Id: Ibae03d834ec86531eba37dc8768fbf17ddadf57f
Reviewed-on: https://code.wireshark.org/review/16049
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
Reviewed-by: Roland Knall <rknall@gmail.com>
2016-07-05 11:54:43 +00:00
Guy Harris 3f49e897f6 Pull quit_after_cap out of the global capture options.
Really, all the GUI-related options should be pulled out, so they're not
cluttering up dumpcap and tshark.

Change-Id: I0276dee2be48bae3498a819d8c0c2747fe1352e7
Reviewed-on: https://code.wireshark.org/review/16180
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-28 00:21:53 +00:00
Mike78 ef752689da Allow/Create an option to use "capture filter" labels defined in wireshark GUI from CLI
Move ui/filters.[ch] to filter_files.[ch] because dumpcap is using functionality.

Bug: 8091
Change-Id: I195c82fc023f97d6f331b8718c45a2d83d30faea
Reviewed-on: https://code.wireshark.org/review/5925
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-27 13:40:24 +00:00
Mikael Kanstrup 3120d1f801 Fix memory leaks in all_ifaces when interface list changes
Valgrind report leaks of several allocations like these:
590 bytes in 50 blocks are possibly lost in loss record 29,818 of 31,670
   at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0xCB9C8A7: __vasprintf_chk (vasprintf_chk.c:82)
   by 0xA3D8DCA: g_vasprintf (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.4)
   by 0xA3B846C: g_strdup_vprintf (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.4)
   by 0xA3B850B: g_strdup_printf (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.4)
   by 0x6F4B51: scan_local_interfaces (iface_lists.c:254)
   by 0x6EF3D8: iface_mon_handler2 (iface_monitor.c:113)
   by 0xBE56F1D: ??? (in /lib/libnl-3.so.200.3.0)
   by 0xBA16F19: ??? (in /usr/lib/libnl-route-3.so.200.3.0)
   by 0xBE54E5E: nl_cache_parse (in /lib/libnl-3.so.200.3.0)
   by 0xBE585CA: nl_msg_parse (in /lib/libnl-3.so.200.3.0)
   by 0x6EF372: iface_mon_handler (iface_monitor.c:123)

When the list of network interfaces is updated allocations done
for global_capture_opts.all_ifaces elements leak memory. Fixed by
introducing a helper function to be used for removing an interface_t
element from all_ifaces array. While at it also fixed misc leaks when
updating individual allocated records of all_ifaces elements.

Change-Id: I035e6936a44edeef2ebe4780931c14cde99e93a4
Reviewed-on: https://code.wireshark.org/review/12209
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2015-12-11 10:38:32 +00:00
Guy Harris 0162e54075 Clean up includes of unistd.h, fcntl.h, and sys/stat.h.
Have wsutil/file_util.h include them on UN*X, just as it includes io.h
on Windows, so we can have a rule of "if you do file operations, include
<wsutil/file_util.h> and use the routines in it".

Remove includes of unistd.h, fcntl.h, and sys/stat.h that aren't
necessary (whether because of the addition of them to wsutil/file_util.h
or because they weren't needed in the first place).

Change-Id: Ie241dd74deff284e39a5f690a297dbb6e1dc485f
Reviewed-on: https://code.wireshark.org/review/11619
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-07 21:52:23 +00:00
Guy Harris 6704c8a5e9 Don't include stuff from libwireshark.
Dumpcap captures packets, and supports the usual capture options, so it
needs this, but it does *not* link with libwireshark (deliberately, so
that the libwireshark code isn't linked into a program that might run
with special privileges), so we must not depend on anything in
libwireshark.

Change-Id: Id975fd6a83a4b2a493c67493e41e69b784a050aa
Reviewed-on: https://code.wireshark.org/review/11546
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-04 09:13:32 +00:00
Guy Harris ff9f9fc431 Don't include "file.h" if you don't need it.
It ends up dragging in libwireshark headers, which programs not linking
with libwireshark shouldn't do.  In particular, including
<epan/address.h> causes some functions that refer to libwireshark
functions to be defined if the compiler doesn't handle "static inline"
the way GCC does, and you end up requiring libwireshark even though you
shouldn't require it.

Move plurality() to wsutil/str_util.h, so that non-libwireshark code can
get it without include epan/packet.h.  Fix includes as necessary.

Change-Id: Ie4819719da4c2b349f61445112aa419e99b977d3
Reviewed-on: https://code.wireshark.org/review/11545
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-04 08:46:30 +00:00
Pascal Quantin 3a220ed25d Fix extcap interface capture with tshark
Extcap parameters must be saved when doing the interface number/name matching,
otherwise extcap program is not launched and pipe is not created

Change-Id: Iaa0c9ad145049ee6e7a285dfca904ceb0baf417f
Reviewed-on: https://code.wireshark.org/review/8017
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-04-13 17:44:38 +00:00
Guy Harris 083f6b6e6d Have a #define for whether the capture buffer size can be set.
It can be set if either 1) this is Windows (where we're assumed to be
using WinPcap, which includes calls to set the buffer size) or 2) we
have pcap_create() (in which case we also have pcap_set_buffer_size(),
at least in a normal libpcap release).

Use that rather than testing "defined(_WIN32) ||
defined(HAVE_PCAP_CREATE)"; that makes it a bit more obvious what's
being tested.

Change-Id: Id9f8455019d19206b04dd6820a748cb97ae5ad12
Reviewed-on: https://code.wireshark.org/review/7816
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-03-25 03:22:33 +00:00
Guy Harris e3477bd136 Get rid of some no-longer-necessary casts.
g_ascii_isXXX() can be handed a char value safely; they won't try to use
it as an index into a table before checking it.

Change-Id: Icf80163fb5f9dccd0b97917e318b1db0bf3e0cf8
Reviewed-on: https://code.wireshark.org/review/4801
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-17 23:58:23 +00:00