Commit Graph

566 Commits

Author SHA1 Message Date
Guy Harris 6c810f9cdd The sent field of the p2p pseudo-header is a Boolean.
Either it's TRUE, meaning sent, or it's FALSE, meaning received.  Make
it a gboolean and get rid of the #defines for it.  ("Unknown" is handled
by the WTAP_ENCAP_ value not *having* a p2p pseudo-header.)

Change-Id: I650d7213523b49e7531d9555a98cde1be519a294
Reviewed-on: https://code.wireshark.org/review/29836
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-26 01:42:43 +00:00
Guy Harris c9f19e4af7 Rename the pseudo-header for X.25, V.120, and Frame Relay.
It's not just for X.25, it's for anything that has the notion of Data
Terminal Equipment and Data Communications Equipment; call it "dte_dce",
not "x25".

Change-Id: I3d51fec8b424e91ffd6d59895f50fc5ece791b08
Reviewed-on: https://code.wireshark.org/review/29834
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-26 00:15:26 +00:00
Gerald Combs 50b9da7bc2 Add a systemd Journal Export Format parser and dissector.
Add a file parser and dissector that can handle the output of
`journalctl -o export`. From here we can add a systemd journal extcap
and possibly support for the JSON and binary formats.

Change-Id: I01576959b2c347ce7ac9aa57cdb5c119c81d61e9
Reviewed-on: https://code.wireshark.org/review/29311
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-08-31 05:20:27 +00:00
Guy Harris 5e2e9de930 Pass zero-length PSDU type information to the radio dissector.
We call that dissector even for zero-length PSDUs, so the radio
information is shown.  We also show the zero-length PSDU type.

We don't call the 802.11 dissector for zero-length PSDU frames.

That way, you don't have to open up the radiotap information to find out
about zero-length PSDU frames, we can support zero-length PSDU
information for other pseudo-headers and file types if they support it,
and taps using the radio information can get zero-length PSDU frame
information.

Change-Id: I7d5da4ea978d8ca4889fc76160f11e3416b4d036
Reviewed-on: https://code.wireshark.org/review/29034
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-08-09 02:26:17 +00:00
Guy Harris 8d6e8f6498 RFC 7468 is PEM-inspired, but it's not PEM.
Do some renaming.

Change-Id: If8fa85370014f9618df38d97048dd1c52a4c389f
Reviewed-on: https://code.wireshark.org/review/28918
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-08-01 07:02:34 +00:00
Guy Harris 940775b948 Do most of the RFC 7468 file processing in the dissector.
Have the Wiretap code just do a heuristic test to see if the file looks
like a RFC 7468 file and just had the entire blob of raw file data to
the caller, with an encapsulation type of WTAP_ENCAP_RFC7468.

Have a file-rfc7468.c dissector that processes the lines of the file,
displaying all of them.  Have it extract the label from the
pre-encapsulation boundary line, and, after it's decoded the
base64-encoded data lines into a blob of data, try handing the tvbuff
with the blob to dissectors that have registered in the
"pem.preeb_label" dissector table with the appropriate label value, and
hand it to the raw BER dissector only if that fails.

This allows some files to have the content dissected as more than just a
raw blob of BER-encoded data.

Change-Id: I98db9f0beb86e5694fb8e886005a2df4fc96ba71
Reviewed-on: https://code.wireshark.org/review/28914
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-08-01 04:58:43 +00:00
Guy Harris aab5ad074e Fix the calculation of a file's "basename".
Strip off only extensions that correspond to file types we know about;
QFileInfo::baseName() strips off *all* extensions, where "extension" is
"anything preceded by a .", so it turns foo.bar.pcap.gz into foo, not
foo.bar.  We don't want that; instead, we strip off only those
extensions that correspond to file types we know how to read, so we'd
strip off .pcap.gz in foo.bar.pcap.gz, and strip off .pcap in
foo.bar.pcap, leaving foo.bar in both cases.

Change-Id: I5385921ad2f0fef815d52e9902fef15735fd9dae
Reviewed-on: https://code.wireshark.org/review/28636
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-07-06 09:07:52 +00:00
Guy Harris a277a520fc The "Ethernet offset" is 16 bits in the file; make it so in the pseudo-header.
This should squelch warnings from Ida7b98af8c44a52ddac2c4ab0702db2519a0c4af.

Change-Id: I6803001981c63ddf76a735341ab2cc8dccdb8ab0
Reviewed-on: https://code.wireshark.org/review/28573
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-07-03 02:33:03 +00:00
Guy Harris 7f3d7199fb Convert NetMon comment titles to UTF-8 when reading the file.
Fix indentation, and note that the comment "description" (contents) are
RTF (as opposed to plain text).

Change-Id: I668a08c06e39a32318454d2ee73933083c5cb516
Reviewed-on: https://code.wireshark.org/review/28279
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-06-15 01:22:12 +00:00
Dario Lombardo 24713511eb wiretap: add support for ruby marshal object files.
Change-Id: Iefba3b15c907966bb0b8d5c0ff9b6bb7097d326e
Reviewed-on: https://code.wireshark.org/review/27763
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-06-07 04:54:49 +00:00
Роман Донченко 3ba56ce586 wiretap: Add a reader for files in the PEM-like format specified by RFC 7468
Change-Id: I8109025120d01c915f3a9d5550aa9272ec83893a
Reviewed-on: https://code.wireshark.org/review/27334
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2018-05-15 12:47:06 +00:00
Dirk Eibach c430645b4d wiretap: DPA-400 logfile support
Wiretap support for reading the Unigraf DPA-400 DisplayPort
AUX channel monitor logfiles.

Bug: 14651
Change-Id: Ia8714a72a9439dd566ef604e001ebf45ecaab76d
Reviewed-on: https://code.wireshark.org/review/27415
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-05-10 22:33:24 +00:00
Dirk Eibach bfd51199e7 DisplayPort AUX channel protocol dissector
Dissector for the VESA DisplayPort AUX channel protocol.

Bug: 14651
Change-Id: I5c0c7668bda969086d9d6e5069aad87e929f6340
Reviewed-on: https://code.wireshark.org/review/27311
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-05-10 20:27:36 +00:00
Guy Harris 6e9c3438bc Revert "wiretap: DPA-400 logfile support"
This reverts commit dfd6eb5d68.

This change cannot be submitted without change I5c0c7668bda969086d9d6e5069aad87e929f6340.

Change-Id: Ieb22f4e9afa1742db861a291202a2790a4784e1b
Reviewed-on: https://code.wireshark.org/review/27387
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-05-07 17:46:35 +00:00
Dirk Eibach dfd6eb5d68 wiretap: DPA-400 logfile support
Wiretap support for reading the Unigraf DPA-400 DisplayPort
AUX channel monitor logfiles.

Bug: 14651
Change-Id: I8d3c50575c9806dd04b40053db45564404bad103
Reviewed-on: https://code.wireshark.org/review/27312
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-05-07 17:41:20 +00:00
Jaap Keuter ca7ac05cf0 Fix some source headers, reformat SPDX license lines in comment block.
Change-Id: Ibae6a64a9915003435a3fb17763535a3844143be
Reviewed-on: https://code.wireshark.org/review/25891
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
2018-02-18 22:50:37 +00:00
Bruno Verstuyft 6a910946cd Added dissector for Excentis DOCSIS31 XRA header. DLT 273. Builtin version.
Change-Id: I7d4a9cf094e8ae6af05d5599489fc609456c5645
Reviewed-on: https://code.wireshark.org/review/25768
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-13 20:32:58 +00:00
Guy Harris 228b122dc9 Rename ft_specific_data to reflect what we're actually using it for.
It's only being used as a working buffer to hold the raw options data we
read in.

Change-Id: I17b812e447f575ad92394b9f957658fc655cdf8e
Reviewed-on: https://code.wireshark.org/review/25701
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09 04:30:44 +00:00
Guy Harris 9425d6e901 Remove redundant members from wtap_syscall_header.
No need for len, and call caplen event_filelen and move it after
event_len.

Change-Id: I8b3825d4022ee083ee52f83f7a69f22829ed9fc4
Reviewed-on: https://code.wireshark.org/review/25698
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09 02:39:09 +00:00
Guy Harris 1f5f63f8ef Generalize wtap_pkthdr into a structure for packet and non-packet records.
Separate the stuff that any record could have from the stuff that only
particular record types have; put the latter into a union, and put all
that into a wtap_rec structure.

Add some record-type checks as necessary.

Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2
Reviewed-on: https://code.wireshark.org/review/25696
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09 00:29:51 +00:00
Dario Lombardo 8cd389e161 replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.
The first is deprecated, as per https://spdx.org/licenses/.

Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed
Reviewed-on: https://code.wireshark.org/review/25661
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-08 14:57:36 +00:00
Guy Harris 2385ec8776 Give an IDB and an NRB as examples of the third type of block.
There are events, there are reports, and there are "here's metadata that
doesn't correspond to something that happened at this point in the
capture"; IDBs and NRBs are the third type.

Change-Id: I89e4f9bf51dc1be5766e8df61c6337ed3e484577
Reviewed-on: https://code.wireshark.org/review/25587
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-04 02:26:53 +00:00
Dario Lombardo 9e3e02f5e5 wiretap: more SPDX license convertions.
Change-Id: I12695d0713b1d7fe58f09b2037303fab523085e9
Reviewed-on: https://code.wireshark.org/review/25394
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-01-20 17:17:58 +00:00
Guy Harris 9cc00c5623 Check for gzipped files even if we don't have libz.
If we aren't built with libz, report a new "decompression not supported"
error if the file is gzipped; the problem isn't that it's a new capture
file format we don't support, it's that a *compressed* capture file, in
some format, but we don't support the *compression* format used.

This can be extended if we add support for other compression formats.

Change-Id: I19239525d4e02357e3ca7189996556839af8fce2
Reviewed-on: https://code.wireshark.org/review/25315
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-01-14 21:08:18 +00:00
Pascal Quantin fc9af81a13 wiretap: add a parameter to wtap_init() indicating whether plugins must be loaded
g995812c5f1 moved wiretap plugins registration from applications to
wiretap library init function.
As we do not want to load plugins for all users of libwiretap, let's
make it configurable.

Bug: 14314
Change-Id: Id8fdcc484e2d0d31d3ab0bd357d3a6678570f700
Reviewed-on: https://code.wireshark.org/review/25194
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-01-09 21:25:06 +00:00
Guy Harris af0f49e80d Use pcapng as the name of the file format.
At one point, I remember a discussion resulting in the official name of
the next-generation replacement for pcap format being changed to
"pcapng", with no hyphen.

Make Wireshark reflect that.

Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a
Reviewed-on: https://code.wireshark.org/review/25214
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-01-09 00:38:51 +00:00
Guy Harris 9bf40d4a6e Do the right check for "no name resolution information to save".
The check that the pcapng code does is "do we have a non-null
addrinfo_lists_t * and, if so, does it have a non-null ipv4_addr_list or
ipv6_addr_list"?

The check that the file-save code was using was just "do we have a
non-null addrinfo_lists_t *", so sometimes it'd think we couldn't do a
"quick save" even though we had no name resolution information to write
out to the capture file.

Make a routine that does that check, and use it in *both* places.

Change-Id: Id4720f4fe4940354320b2b7621ca5e37e45ec1f3
Reviewed-on: https://code.wireshark.org/review/25055
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-12-29 04:59:13 +00:00
Anton Glukhov 00974e1dc4 Add IEEE 802.3br Frame Preemption Protocol dissector
Bug: 14280
Change-Id: I25444b069af4bb78db6ae5ff649596599eba2a0c
Signed-off-by: Anton Glukhov <anton.a.glukhov@gmail.com>
Reviewed-on: https://code.wireshark.org/review/24881
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-12-21 11:39:24 +00:00
João Valverde 995812c5f1 Refactor plugin registration and loading
Put different types of plugins (libwiretap, libwireshark) in different
subdirectories, give libwiretap and libwireshark init routines that
load the plugins, and have them scan the appropriate subdirectories
so that we don't even *try* to, for example, load libwireshark plugins
in programs that only use libwiretap.

Compiled plugins are stored in subfolders of the plugin folders, with
the subfolder name being the Wireshark minor version number (X.Y). There is
another hierarchical level for each Wireshark library (libwireshark, libwscodecs
and libwiretap).

The folder names are respectively plugins/X.Y/{epan,codecs,wiretap}.

Currently we only distribute "epan" (libwireshark) plugins.

Change-Id: I3438787a6f45820d64ba4ca91cbe3c8864708acb
Reviewed-on: https://code.wireshark.org/review/23983
Petri-Dish: João Valverde <j@v6e.pt>
Tested-by: Petri Dish Buildbot
Reviewed-by: João Valverde <j@v6e.pt>
2017-12-14 08:43:57 +00:00
Anders 1810801a68 Handle LINKTYPE_JUNIPER_ST 200.
Bug: 14195
Change-Id: Ic6be8e1f8169968c48376984c0d1a1a69c67f32a
Reviewed-on: https://code.wireshark.org/review/24415
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-11-15 03:40:10 +00:00
João Valverde 83a4eadc07 wtap.h: Replace literal buffer size with WS_INET_ADDRSTRLEN
Bug: 14149
Change-Id: Ib7d60f93373eb23f5c950607f4cf6fc832c79670
Reviewed-on: https://code.wireshark.org/review/24154
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-10-29 05:34:34 +00:00
João Valverde d0a91b27f2 plugins: config.h must not be included by public headers
For a sane plugin build environment. Include config.h as the first
header in the .c file instead.

Fix by moving required compiler attribute macros to a new
"ws_attributes.h" API header.

Change-Id: I34f58a927f68c1a0e59686c14d214825149749e1
Reviewed-on: https://code.wireshark.org/review/23400
Petri-Dish: João Valverde <j@v6e.pt>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: João Valverde <j@v6e.pt>
2017-09-06 08:10:56 +00:00
Michael Mann a2b084f6c5 Add support for WPFCapture "formats" from Microsoft Analyzer.
Normally a .cap file contains a network type that when masked with 0xFFF
will convert to a pcap LINKTYPE_ value.  However, Microsoft Analyzer
used 0xE080-0xE08A for their own purposes within a .cap file.

Add support for the WPFCapture formats and give a "not supported" error
message to the few left unsupported.

Bug: 10556
Change-Id: I321a75ce769fdec75bdc6b595936c25932950a97
Reviewed-on: https://code.wireshark.org/review/23386
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-09-04 18:41:46 +00:00
Michael Mann ed254720fe Add support for NetMon NetmonFilter and NetworkInfoEx frame types.
Bug: 4221
Change-Id: I59aff777c364af1a064e1e99ea9ac6692a4cedfa
Reviewed-on: https://code.wireshark.org/review/23333
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-09-01 03:42:05 +00:00
Michael Mann 52823805b2 Add support for reading comments in Network Monitor files
The NetMon wiretap reads the title and description comment fields from a
NetMon file and saves it in the wiretap private structure.  Then when
it's time to make a frame, the comment fields are added to a NetMon
pseudoheader with a new WTAP ENCAP type, with the potential for netmon
pseudoheader to contain pseudoheader data from "base" wiretap. Then the
netmon_header dissector displays the comment fields and passes any "base"
wiretap pseudoheader data when calling the wtap_encap dissector table
that the frame dissector normally calls.

Bug: 4225
Change-Id: I8f772bc9494364c98434c78b61eb5a64012ff3b9
Reviewed-on: https://code.wireshark.org/review/23210
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-30 06:10:17 +00:00
Michael Mann 8f3a3914fe Add Network Monitor Event Tracing event
Assigned a WTAP_ENCAP value (WTAP_ENCAP_NETMON_NET_NETEVENT) for the
dissection of Event Tracing records inside a NetworkMonitor file.

Ping-Bug: 6520
Ping-Bug: 6694
Change-Id: Ib100f3779095842e78f9b7741e80258aa866d818
Reviewed-on: https://code.wireshark.org/review/23278
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-08-29 19:50:16 +00:00
Stig Bjørlykke 9cd114fbe5 wiretap: Add WTAP_ENCAP_NORDIC_BLE
Use this for nordic_ble dissection.

Change-Id: I5323cbd8c244c4e3b645825c60d040e1ae8f3b81
Reviewed-on: https://code.wireshark.org/review/23219
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2017-08-26 09:22:48 +00:00
Anthony Coddington f3181f706b ERF_TYPE_META write and comment support
Support per-packet comments in ERF_TYPE_META through a new Anchor ID
extension header with per-Host unique 48-bit Anchor ID which links an
ERF_TYPE_META record with a packet record. There may be more than one
Anchor ID associated with a packet, where they are grouped by Host ID
extension header in the extension header list. Like other ERF_TYPE_META
existing comments should not be overwritten and instead a new record
generated. See erf_write_anchor_meta_update_phdr() for detailed comments
on the extension header stack required.

As Wireshark only supports one comment currently, use the one one with
the latest metadata generation time (gen_time). Do this for capture
comment too.

Write various wtap metadata in periodic per-second ERF_TYPE_META records
if non-WTAP_ENCAP_ERF or we have an updated capture comment.
Refactor erf_dump to create fake ERF header first then follow common
pseudoheadr and payload write code rather than two separate code paths.
Support an ERF_HOST_ID environment variable to define Wireshark's Host
ID when writing. Defaults to 0 for now.

ERF dissector updates to support Anchor ID extension header with basic
frame linking.
Update ERF_TYPE_META naming and descriptions to official name
(Provenance)

Core changes:
Add has_comment_changed to wtap_pkthdr, TRUE when a packet
opt_comment has unsaved changes by the user.
Add needs_reload to wtap_dumper which forces a full reload of the file
on save, otherwise wireshark gets confused by additional packets being
written.

Change-Id: I0bb04411548c7bcd2d6ed82af689fbeed104546c
Ping-Bug: 12303
Reviewed-on: https://code.wireshark.org/review/21873
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Stephen Donnelly <stephen.donnelly@endace.com>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-07-17 02:08:52 +00:00
Stefan Hajnoczi 41415aa444 vsock: add WTAP_ENCAP_VSOCK constant
A linktype was recently assigned to Linux vsock in libpcap commit
cfdded36ddcf5d01e1ed9f5d4db596b744a6cda5 ("added DLT_VSOCK for
http://qemu-project.org/Features/VirtioVsock").

The Wireshark vsock dissector can now be automatically applied when
wtap_encap matches the new WTAP_ENCAP_VSOCK constant.

This patch makes Wireshark dissect vsock packet captures without
manually specifying the dissector.

Change-Id: If252071499a61554f624c9ce0ce45a0ccfa88d7a
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-on: https://code.wireshark.org/review/22611
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2017-07-14 12:54:08 +00:00
Guy Harris a9c2697714 Add WTAP_ENCAP_3MB_ETHERNET for Xerox 3MB Ethernet.
It needed to be done:

	https://github.com/shirriff/pup-wireshark

(And, yes, there really *is* a DLT_/LINKTYPE_ for it!  The original DLT_
values were ARP hardware types, and 3MB Ethernet was assigned an ARP
hardware type of 2.)

Change-Id: I60d96c28e67854adcb28c7e3579ae5dd1f07df4b
Reviewed-on: https://code.wireshark.org/review/22336
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-22 02:02:18 +00:00
Guy Harris ed7e9c77db Add URL for link specifying D-Bus maximum message length.
Change-Id: I5797407a18fda674b2c9b2cc1c192c211c91c496
Reviewed-on: https://code.wireshark.org/review/22052
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-09 20:20:11 +00:00
Guy Harris d0865fd619 Allow bigger snapshot lengths for D-Bus captures.
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except
for D-Bus captures.  Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for
them, because that's the largest possible D-Bus message size.  See

	https://bugs.freedesktop.org/show_bug.cgi?id=100220

for an example of the problems caused by limiting the snapshot length to
256KB for D-Bus.

Have a snapshot length of 0 in a capture_file structure mean "there is
no snapshot length for the file"; we don't need the has_snap field in
that case, a value of 0 mean "no, we don't have a snapshot length".

In dumpcap, start out with a pipe buffer size of 2KB, and grow it as
necessary.  When checking for a too-big packet from a pipe, check
against the appropriate maximum - 128MB for DLT_DBUS, 256KB for
everything else.

Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20
Reviewed-on: https://code.wireshark.org/review/21952
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-05 05:28:26 +00:00
Erik de Jong 94847961cb LoRaTap DLT and dissector
Add support for handling LoRaTap (https://github.com/eriknl/LoRaTap) DLT in
wiretap and add dissector for LoRaTap headers.

Exposes Syncword for subdissectors to dissect frame payload.

Change-Id: Ie4ba2189964376938f45eb3da93f2c3376042e85
Reviewed-on: https://code.wireshark.org/review/21915
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2017-06-03 20:19:15 +00:00
Guy Harris 30c86f8b34 Don't keep the pcap/pcapng link-layer header type as interface data.
Either 1) it can be determined from the libwiretap encapsulation type,
in which case it's redundant information or 2) there *is* no pcap/pcapng
link-layer header type for that encapsulation type, in which case you
need to check for the attempt to determine it failing and handle that
failure appropriately.

Change-Id: Ie9557b513365c1fc8c6df74b9c8239e29aad46bc
Reviewed-on: https://code.wireshark.org/review/21924
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-03 19:59:08 +00:00
Simon Barber bb83fe4551 packet-ieee80211-radio.c: Minor refactor and whitespace cleanup
Change-Id: Idad8f7eeed968eeed9f553fef98d58453f328afb
Reviewed-on: https://code.wireshark.org/review/21421
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Tested-by: Michael Mann <mmann78@netscape.net>
2017-04-30 13:22:50 +00:00
Scott Deandrea 62d78199ee Add packet capture support for Darwin USB
Change-Id: Iec9e4ac2362cf8e88a3cf6ae3483cefe938967e5
Reviewed-on: https://code.wireshark.org/review/20814
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-31 23:24:28 +00:00
Dario Lombardo 67d8830f2f wiretap: add open_routines cleanup function.
Change-Id: Id88fe84189b8baa597eaa69159395cdc4bc56195
Reviewed-on: https://code.wireshark.org/review/19951
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-02-18 01:17:41 +00:00
Dario Lombardo 7c0c580c4b wiretap: add cleanup routine.
The cleanup routine has been added to exit section of the applications.
Those which required a exit restyle have been patched as well.

Change-Id: I3a8787f0718ac7fef00dc58176869c7510fda7b1
Reviewed-on: https://code.wireshark.org/review/19949
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
2017-02-14 10:22:20 +00:00
Guy Harris ab07f8e0f8 Have a routine to do all the work of initializing libwiretap.
Have programs that use libwiretap call that routine rather than
separately calling some or all of init_open_routines(),
wtap_register_plugin_types(), and wtap_opttypes_initialize().

Also don't have routines internal to libwiretap call those.  Yes, this
means doing some initialization work when it isn't necessary, but
scattering on-demand calls throughout the code is a great way to forget
to make those calls.

Change-Id: I5828e1c5591c9d94fbb3eb0a0e54591e8fc61710
Reviewed-on: https://code.wireshark.org/review/19069
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-12-04 21:42:44 +00:00
Peter Wu ba2a3b3626 wiretap: fix memory leak of interface_data for wtap_dumper
Mirrors the behavior of wtap_close.

Change-Id: I1a04878fdd0409fa74931737332f9b8a1ae77fb1
Reviewed-on: https://code.wireshark.org/review/17620
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-09-10 12:59:47 +00:00
Guy Harris 4a6dde12d6 Have "All Capture Files" match only capture files.
We support reading some types of files that aren't capture files, in
case we have a dissector for that file format (because, for example,
it's often transported over HTTP).  Don't include them in the set of
files "All Capture Files" matches; you can still look for them as they
have individual entries in the drop-down menu of file type patterns.

Ultimately, there should be Fileshark/TFileshark programs to read those
files - and other file types, and even capture files if the goal is to
look at the file structure rather than at the packets - and *that's* the
program that should offer the ability to load JPEGs and so on.

(No, this does not reduce the "All Capture Files" list down to a level
that makes the problem in bug 12837 go away.  The right way to fix
*that* is to arrange, somehow, that the "All Capture Files" entry not
actually list all the suffixes it matches.)

Change-Id: I705bff5fcd0694c6c6a11892621a195aa7cd0264
Reviewed-on: https://code.wireshark.org/review/17619
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-09-10 06:45:08 +00:00
Guy Harris c8157aa6b4 Go back to having only one SocketCAN LINKTYPE_ value.
Libpcap just backed out the "host-endian" SocketCAN LINKTYPE_ value; we
don't need it any more.

Change-Id: I33a7dc21207a0009e20b4abaefe1119eb649c39a
Reviewed-on: https://code.wireshark.org/review/17327
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-25 21:14:48 +00:00
Guy Harris 95c4c432c4 Handle the new LINKTYPE_CAN_SOCKETCAN_HOSTENDIAN.
Unfortunately, only one libpcap code path puts the CAN ID in the
SocketCAN header in network byte order; the others leave it in host byte
order.  Therefore, a new LINKTYPE_/DLT_ value was introduced, and
libpcap was changed to use that for the cases where the CAN ID is in
host byte order.  Support them both.

This means we need to, when reading pcap and pcapng files, fix up the
CAN ID if the host that wrote the file has a different byte order from
ours (as libpcap also now does).  This includes Linux "cooked" captures,
which can include CAN packets.

Change-Id: I75ff2d68d1fbdb42753ce85d18f04166f21736dd
Reviewed-on: https://code.wireshark.org/review/17155
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-19 01:42:06 +00:00
Guy Harris 996dcc038d Do a deep copy in wtap_block_add_custom_option().
That way, we don't have to worry about multiple instances of an option
pointing to the same data. and having to worry about freeing data that's
pointed to by another instance.

Change-Id: I3470a9eebf346023713fd0d6ff2451d727c25089
Reviewed-on: https://code.wireshark.org/review/16471
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-15 08:31:55 +00:00
Guy Harris 1f8999bb96 Redo the block options APIs.
A block can have zero or more instances of a given option.  We
distinguish between "one instance only" options, where a block can have
zero or one instance, and "multiple instances allowed" options, where a
block can have zero or more instances.

For "one instance only" options:

	"add" routines add an instance if there isn't one already
	and fail if there is;

	"set" routines add an instance if there isn't one already
	and change the value of the existing instance if there is one;

	"set nth" routines fail;

	"get" routines return the value of the instance if there is one
	and fail if there isn't;

	"get nth" routines fail.

For "multiple instances allowed" options:

	"add" routines add an instance;

	"set" routines fail;

	"set nth" routines set the value of the nth instance if there is
	one and fail otherwise;

	"get" routines fail;

	"get nth" routines get the value if the nth instance if there is
	one and fail otherwise.

Rename "optionblock" to just "block"; it describes the contents of a
block, including both mandatory items and options.

Add some support for NRB options, including IPv4 and IPv6 option types.

Change-Id: Iad184f668626c3d1498b2ed00c7f1672e4abf52e
Reviewed-on: https://code.wireshark.org/review/16444
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-14 23:02:39 +00:00
Rudra Rugge fa20f5cb5e Add support for Opencontrail virtual network
Change-Id: Ia6012e0f6425be069e222538eafb1191b398ec83
Reviewed-on: https://code.wireshark.org/review/15930
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-21 01:40:22 +00:00
Gerald Combs d25a60c1c1 More Sysdig / system event support.
Add REC_TYPE_SYSCALL to wiretap and use it for Sysdig events. Call the
Sysdig event dissector from the frame dissector. Create a "syscall"
protocol for system calls, but add "frame" items to it for now.

Add the ability to write Sysdig events. This lets us merge packet
capture and syscall capture files.

Change-Id: I12774ec69c89d8e329b6130c67f29aade4e3d778
Reviewed-on: https://code.wireshark.org/review/15078
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-15 13:39:29 +00:00
João Valverde f1ff3208a0 Move ip6_to_str_buf() to to_str.c and make it take the buffer length.
Also make it use ws_inet_ntop6() (rather than implementing the string
conversion ourselves).

Remove ip6_to_str_buf_len().

Change-Id: I1eff3a8941e00987c2ff0c4dcfda13476af86191
Reviewed-on: https://code.wireshark.org/review/15692
Reviewed-by: João Valverde <j@v6e.pt>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-06 22:00:41 +00:00
Michael Mann 614d09af13 Add data structures necessary to support multiple Name Resolution blocks.
This doesn't try to use any data from multiple Name Resolution blocks, it
just converts single Name Resolution block usage into a GArray, so the
potential is there to then use/support multiple Name Resolution blocks
within a file format (like pcapng)

Change-Id: Ib0b584af0bd263f183bd6d31ba18275ab0577d0c
Reviewed-on: https://code.wireshark.org/review/15684
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-01 22:58:06 +00:00
Michael Mann 6fa77a6acb Add data structures necessary to support multiple Section Header blocks.
This doesn't try to use any data from multiple Section Header blocks, it
just converts single Section Header block usage into a GArray, so the
potential is there to then use/support multiple Section Header blocks
within a file format (like pcapng)

Change-Id: I6ad1f7b8daf4b1ad7ba0eb1ecf2e170421505486
Reviewed-on: https://code.wireshark.org/review/15636
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-01 14:33:23 +00:00
Martin Kaiser fb39f102b9 wiretap: add support for the mplog capture file format
the mplog format is used by some commercial logging tools that capture
ISO 14443 traffic between a card reader and a contactless smartcard

Change-Id: If359b8f0f671eb2a7c6315e2b8960a5bd581a9e9
Reviewed-on: https://code.wireshark.org/review/14950
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
2016-04-18 09:39:42 +00:00
Petr Sumbera 5ca557c31e support for IP-over-Infiniband - pcap encapsulation
Bug: 12279
Change-Id: Ib6c54f8b86d95c5546bc800749f124cd0dbb8ff0
Reviewed-on: https://code.wireshark.org/review/14585
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-04-01 10:05:41 +00:00
Michael Mann 08d49ff2e0 Making wiretap option blocks more generic.
This was inspired by https://code.wireshark.org/review/9729/, but takes it in a different direction where all options are put into an array, regardless of whether they are "standard" or "custom".  It should be easier to add "custom" options in this design. Some, but not all blocks have been converted.
Descriptions of some of the block options have been moved from wtap.h to pcapng.h as it seems to be the one that implements the description of the blocks.

Also what could be added/refactored is registering block behavior.

Change-Id: I3dffa38f0bb088f98749a4f97a3b7655baa4aa6a
Reviewed-on: https://code.wireshark.org/review/13667
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-23 00:39:38 +00:00
Guy Harris f31449076c Initial support for FreeBSD USB captures.
(There's also work needed in libpcap; that's also in progress.)

Change-Id: Iff5a34c139a000865e2d78cc17a4af5ff24fb44b
Reviewed-on: https://code.wireshark.org/review/14025
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-20 11:12:48 +00:00
Guy Harris cee50b8c31 Put back a define to make the Lua build happy.
DO NOT USE THIS FOR ANYTHING NEW.

Change-Id: Iee2ddaa2eeb735b33aef9e81b32bb4a3535e3451
Reviewed-on: https://code.wireshark.org/review/14023
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-20 00:06:28 +00:00
Guy Harris ddeab2c1de Get rid of PCAP_ENCAP_USB.
It doesn't correspond to anything we support - and the old Linux USB
LINKTYPE_ value of 186 doesn't give enough information to dissect the
packets (it discards the event type, for example), so we drop the rest
of our support for it as well.

Change-Id: I6f537d9263174aba4320edf5140e1d1540e979c8
Reviewed-on: https://code.wireshark.org/review/14020
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-19 22:46:10 +00:00
Guy Harris 72a9a43933 Add A-MPDU reassembly information to the radio metadata.
Change-Id: I338e7fb60ff62d1d26ca0b32468ada4294d52d8d
Reviewed-on: https://code.wireshark.org/review/13594
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-29 07:56:28 +00:00
Guy Harris 4f4769adf6 Move structure definition outside another structure definition.
I guess the ability to define a structure inside another structure is a
C-ism discarded by C++, so it causes warnings if you disallow stuff that
can't be handled by a C++ compiler, as we do.

Change-Id: I8cf52af0424708eb663ab6dbfecbf317fe3bccdb
Reviewed-on: https://code.wireshark.org/review/13257
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13 09:41:04 +00:00
Guy Harris 24324a0263 Clean up handling of the data before the Ethernet packet in ERF files.
The data before the Ethernet packet isn't a 16-bit little-endian
integer, it's two bytes, one byte of offset and one byte of padding.

Change-Id: I327b88f058dda184b79d3c2c6cf0dea52c0d28b1
Reviewed-on: https://code.wireshark.org/review/13254
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13 08:11:19 +00:00
Guy Harris d286243d0d Dissect the MC and AAL2 headers as 32-bit words.
That's how they're extracted in the libwiretap module, and that's how
they're shown in the ERF spec.

This gets rid of some compiler warnings about type-punning.

Merge some reserved bit fields to match what's in the ERF spec.
Renumber others.

Process the AAL2 and MC headers differently; yes, they're both
big-endian 32-bit values, but that makes the code a bit clearer, and,
heck, the optimizer may well combine the two sequences of code.

Change-Id: Ief7f976e77e8f2fba1685ad5a50ee677a8070ae7
Reviewed-on: https://code.wireshark.org/review/13251
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13 05:22:12 +00:00
John A. Thacker 85fd9df235 GFP: Add support for Generic Framing Procedure (ITU-T G.7041/Y.1303)
Add support for Generic Framing Procedure. Generic Framing Procedure (GFP)
is used to map octet-aligned variable length payloads (e.g. Ethernet, MPLS,
octet-aligned PPP, IP) into octet-synchronous signals such as SONET/SDH
(ITU-T G.707) and OTN (ITU-T G.709). GFP is a telecommunications industry
standard defined in ITU-T G.7041/Y.1303.
(https://www.itu.int/rec/T-REC-G.7041/)

Bug: 11961
Change-Id: Idf5b311e82b051b1ee65bde5149b3de405537b02
Reviewed-on: https://code.wireshark.org/review/13043
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-01-05 05:20:13 +00:00
Simon Barber ffa9e938e2 Refactor 802.11 radio flags.
The use of a flag field here is aesthetically unpleasing when the flags
are referred to frequently. Convert these into bitfield entries.

Change-Id: I6f47e31558439dfd343ec7f856d04480366a1237
Reviewed-on: https://code.wireshark.org/review/12511
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-24 07:58:51 +00:00
Guy Harris 9418701909 Process the radio information internally for AiroPeek classic files.
Process it in libwiretap; no need to hand it to libwireshark for
dissection, it can just dissect the radio information pseudo-header with
the processed information.

Change-Id: I482697947eecbd3967cf1910ba2fa2bff805cd66
Reviewed-on: https://code.wireshark.org/review/12202
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-26 19:44:39 +00:00
Martin Kaiser 4fd711f338 use the official DLT for ISO14443
add DLT_ISO14443 to pcap_to_wtap_map[]
define WTAP_ENCAP_ISO14443, link it to the iso14443 dissector

Change-Id: Id837197c4d66071094f9336d60db36a371424807
Reviewed-on: https://code.wireshark.org/review/11959
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-11-19 13:39:55 +00:00
Guy Harris 75dc2051e8 Add wtap_dump_open_tempfile routines, to write to a temporary file.
It includes the temporary-file generation, so you don't have to do it
yourself.

Change-Id: I0798df95a5c5646224ec49612f50b423ed78547a
Reviewed-on: https://code.wireshark.org/review/11751
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-12 00:59:40 +00:00
Gerald Combs 0d497e8125 Initial Sysdig syscall (event) support.
Add a dissector for reading Sysdig event blocks. It only handles plain
events but it's usable for reading trace files on hand here.

Use a script to generate various parts of the dissector. As an experiment,
update parts in-place instead of using a template.

Ultimately there should probably be a top-level "Syscall" or "Event"
dissector alongside the "Frame" dissector, which could then call this.
You could then directly compare an executable's system calls alongside
its network traffic.

For now leverage the pcapng_block dissector and keep everything under
"Frame".

Next steps:
- Items listed at the top of packet-sysdig-event.c.

Change-Id: I17077e8d7f40d10a946d61189ebc077d81c4da37
Reviewed-on: https://code.wireshark.org/review/11103
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-11-10 20:59:53 +00:00
Guy Harris 827b7dd756 Skip only the actual file descriptor close when writing to stdout.
Have a "this is stdout" flag for a wtap_dumper, and have "open the
standard output for dumping" routines that set that flag.  When closing
a wtap_dumper, do most of the work regardless of whether we're writing
to the standard output or not (so that everything gets written out) and
only skip the closing of the underlying file descriptor.

Change-Id: I9f7e4d142b3bd598055d806b7ded1cb4c378de8e
Reviewed-on: https://code.wireshark.org/review/11673
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-10 10:11:50 +00:00
Guy Harris 58431e2f6a Don't include libwireshark headers from libwiretap.
Move the definitions of hashipv4_t and hashipv6_t to wiretap/wtap.h, as
that's the main place they're used.  Change them a bit not to depend on
other stuff from libwireshark, and change the code as required by those
changes.

This should fix the Solaris build; apparently, the Sun^WOracle compiler
is generating code for static inline functions even if they're never
called, so that libwiretap ends up including code that calls tvbuff and
wmem functions.

There's probably further cleanup that could be done here, but this
should at least fix the build, as well as getting rid of a dependency
between two libraries that are at least somewhat independent (libwiretap
should *not* depend on libwireshark, as some programs use libwiretap but
not libwireshark, and, ultimately, we probably want it to be possible to
use libwireshark without libwiretap but that'd be more work).

Change-Id: I91c745282f17d7c8bff7809aa277eab2b3cf47c1
Reviewed-on: https://code.wireshark.org/review/11537
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-04 00:56:44 +00:00
Richard Sharpe 296b9cf1fb Add some symbols to wtap.h so that we can correctly support 802.11ad.
Currently there are a lot of local hacks in the 802.11ad support and
better support can be provided.

Also add a structure to track 802.11ad (DMG) specific features in the phdr
structure as suggested by Guy Harris.

Also, respond to some suggestions by Guy Harris.

Change-Id: I8459e3986a134a08ee2e31f0158b8aa5c9b91d86
Signed-off-by: Richard Sharpe <realrichardsharpe@gmail.com>
Reviewed-on: https://code.wireshark.org/review/10204
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-08-24 06:01:56 +00:00
Hadriel Kaplan fab0e59c70 Fix memory leaks of dumper SHB and IDB infos
Change-Id: I6b81d3e853d503c6a81f9793957b48ab34c6808c
Reviewed-on: https://code.wireshark.org/review/10156
Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-21 04:55:20 +00:00
Hadriel Kaplan d64ad1de91 capinfos: add more info about file and interfaces
Add more information about the capture file, and about the interface
descriptions in it. Also remove long-unused g_options code.

Change-Id: I93cbd70fc7b09ec1b8b2fd6c85bb885c7f749543
Reviewed-on: https://code.wireshark.org/review/10073
Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-19 04:26:24 +00:00
Hadriel Kaplan 8fcdcb9c95 Improve file merging for mergecap and wireshark
Refactor the file merging code by removing the duplicate logic from mergecap.c
and file.c's cf_merge_files(), into a new merge_files() function in merge.c.
Also the following user-visible changes:

 * Removed the '-T' encap type option from mergecap, as it's illogical for
   mergecap and would complicate common merge code.

 * Input files with IDBs of different name, speed, tsprecision, etc., will produce
   an output PCAPNG file with separate IDBs, even if their encap types are the same.

 * Added a '-I' IDB merge mode option for mergecap, to control how IDBs are merged.

 * Changed Wireshark's drag-and-drop merging to use PCAPNG instead of PCAP.

Bug: 8795
Bug: 7381
Change-Id: Icc30d217e093d6f40114422204afd2e332834f71
Reviewed-on: https://code.wireshark.org/review/10058
Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-18 14:52:00 +00:00
Hadriel Kaplan e25562badd Pcapng: clean up Section Header Block handling
Change-Id: I8516d0c561ed0b63e49a3594027c9c15bb789258
Reviewed-on: https://code.wireshark.org/review/9726
Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-18 05:52:45 +00:00
Hadriel Kaplan 910438b17f Pcapng: support Name Resolution Block options
Make pcapng decode options in an NRB during read, and store the comment
option, and write it back out as well. Also make it handle plugin handlers
for unknown options in received NRB(s).

Change-Id: I81863ef8d85cb1c8b5ba6673ba0e562efe77714f
Reviewed-on: https://code.wireshark.org/review/9723
Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-06 03:32:13 +00:00
Guy Harris 53fcaabe66 Use the NSS provided by the Ixia Veriwave hardware.
It doesn't appear to provide the FEC type, although radiotap does, so
add a flag to indicate whether we have that.

Change-Id: I298d79bc6b640ee2408c3d70075c32bf331a210c
Reviewed-on: https://code.wireshark.org/review/9533
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-07-07 07:40:31 +00:00
Guy Harris 886c2d008f Update a comment.
Change-Id: I71e66a8f6faf3b213ab6db2856a36c1d31897166
Reviewed-on: https://code.wireshark.org/review/9527
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-07-06 21:54:46 +00:00
Guy Harris b9145bc836 "Short preamble" is 802.11[bg]-only, so put it in the PHY-specifc info.
We're already only setting it for 11b and 11g; this makes it a bit
cleaner, e.g. we don't need to say "oh, wait, we *don't* have short
preamble" for 11n and 11ac.

Change-Id: Idcf3e8c93d6a417f0319e4bd33247b98f07b6052
Reviewed-on: https://code.wireshark.org/review/9209
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-28 19:44:07 +00:00
Graham Bloice e4dc3321b1 Set 802.11.ac Partial AID field size
The assignment of a short to a guint8 in packet-ieee80211-radiotap.c line 1696
generates a narrowing warning.

In my reading of the spec which shows the field as 9 bits,
and looking at the hf fields for this item I think it should be a guint16.

Change-Id: Ic7785c2bfc66d72f7b1e914b1a46f32079fc99d9
Reviewed-on: https://code.wireshark.org/review/9197
Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
Petri-Dish: Graham Bloice <graham.bloice@trihedral.com>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-06-28 12:20:54 +00:00
Guy Harris 78adf17850 Fix handling of 11ac radio metadata.
Add more fields to the metadata to handle everything radiotap has, and
show them.

Call the FEC type field just "FEC", and have it be an integer field with
0 meaning BCC and 1 meaning LDPC, rather than a Boolean.

11ac doesn't have *an* MCS, it can have up to 4, one per user.

Label the 11ac bandwidth values the same way we do in the radiotap
dissector.

Change-Id: I2c2415baff3e5d68d49dda497980e8271d26b1f6
Reviewed-on: https://code.wireshark.org/review/9176
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-26 18:29:08 +00:00
Guy Harris f1bc598d87 Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else.  Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.

If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed.  If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.

Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.

Add a PHY type for 11 legacy DSSS and detect it if possible.

Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).

Set more fields when writing out Commview Wi-Fi files.

Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:15:56 +00:00
Guy Harris 8aa91b31b9 Provide PHY type and band information in the 802.11 pseudo-header.
Provide that information so that the "802.11 radio information" protocol
can indicate whether a packet was 802.11 legacy/11b/11a/11g/11n/11ac,
and possibly whether it's 2.4 GHz or 5 GHz 11n.  (Sometimes the center
frequency might not be supplied, so the band information can be useful.)

Also, provide some 11ac information, now that we can distinguish between
11n and 11ac.  Don't calculate the data rate from the MCS index unless
it's 11n; we don't yet have code to calculate it for 11ac.

For radiotap, only provide guard interval information for 11n and 11ac,
not for earlier standards.

Handle the 11ac flag in the Peek remote protocol.

For Peek tagged files, the "extension flags" are 11n/11ac flags, so we
don't have to check for the "MCS used" bit in order to decide that the
packet is 11n or 11ac or to decide whether to provide the "bandwidth" or
"short GI" information.

Change-Id: Ia8a1a9b11a35243ed84eb4e72c384cc77512b098
Reviewed-on: https://code.wireshark.org/review/9032
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-22 22:05:17 +00:00
Guy Harris 2895d58dc3 Call the "802.11 radio information" dissector for radio headers.
Have dissectors of various forms of radio information headers in the
packets fill in a struct ieee_802_11_phdr with radio information as
appropriate, and call the "802.11 radio information" dissector rather
than the raw 802.11 dissector.

This means that the radio information can be found in a
protocol-independent and encapsulation-independent form when you're
looking at the packet; that information can be presented in a form
somewhat easier to read than the raw metadata header format.

It also enables having a single "radio information" tap that allows
statistics to handle all different sorts of radio information
encapsulation.

In addition, it lets us clean up some of the arguments passed to the
common 802.11 dissector routine, by having it pull that information from
the struct ieee_802_11_phdr.

Ensure that the right structure gets passed to that routine, and that
all the appropriate parts of that structure are filled in.

Rename the 802.11 radio protocol to "wlan_radio", rather than just
"radio", as it's 802.11-specific.  Give all its fields "wlan_radio."
names rather than "wlan." names.

Change-Id: I78d79afece0ce0cf5fc17293c1e29596413b31c8
Reviewed-on: https://code.wireshark.org/review/8992
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-20 23:02:21 +00:00
Guy Harris d83f86aa56 Get rid of some unused members of struct ieee_802_11_phdr.
Remove some unused members, and move the presence flags after the
should-always-be-set fields, right before the fields to which it
applies.

Change-Id: I8d6f08e1d3d8de0c11a9e04de4e98408d6b90693
Reviewed-on: https://code.wireshark.org/review/8972
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-18 02:15:01 +00:00
Guy Harris 34124c857e Define XXX_phdr structures in the order in which they appear in the union.
Change-Id: Ia1fe1758998237a344889bdf8215ecfba7b871ee
Reviewed-on: https://code.wireshark.org/review/8942
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-15 21:10:35 +00:00
Guy Harris 560180b80a Move some structures used only in pcap-common.c there.
Those aren't pseudo-headers exported from libwiretap, they're just
structures corresponding to the pseudo-headers for some pcap/pcap-ng
link-layer header types.

Change-Id: Iec37cfc162b64adacdeb57e14e546bced7b673fa
Reviewed-on: https://code.wireshark.org/review/8941
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-15 21:03:18 +00:00
AndersBroman 2d8b4a233e Add the abillity to read 3GPP trace records with format accoding to
TS 32 423(XML)

Change-Id: I37895ec35797089a32c7d1695e735046d6aa979e
Reviewed-on: https://code.wireshark.org/review/8237
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-04-30 10:52:01 +00:00
anilkumar911 62a70e8a0b Support for new netscaler 3.5 trace format.
Change-Id: Ica74f3f9239a96486967cf248feb4313bc390734
Reviewed-on: https://code.wireshark.org/review/7751
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-04-13 14:27:46 +00:00
Guy Harris 65303efe4d Remove some unneeded includes of <sys/time.h>.
Change-Id: I9e4e6efa9f8c7dbff7627f8d5fc3278ab383618d
Reviewed-on: https://code.wireshark.org/review/7441
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-28 04:59:08 +00:00
Dario Lombardo bd911096bd Added JSON native file support.
libjsmn has also been moved from epan/ to wsutil/ to make it visible from wiretap.

Change-Id: I59abb3419acb1baa83194b38152d3651ed5c123c
Bug: 10878
Reviewed-on: https://code.wireshark.org/review/6716
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2015-02-17 11:08:51 +00:00
Guy Harris fea325d2ba Handle DLT_LOOP differently from DLT_NULL.
That's a little cleaner, and lets us preserve the LINKTYPE_ value for
DLT_LOOP captures.  ("Preserve" here doesn't mean "write files with a
link-layer header type of 12", as that's ambiguous; we write it with a
link-layer header type of LINKTYPE_LOOP, i.e. 108.  If programs on
OpenBSD don't recognize that as DLT_LOOP, that's a bug in OpenBSD's
libpcap or in the program.)

Change-Id: I48a2e04aed41c013823ffb5c588d2a8e8b376e15
Reviewed-on: https://code.wireshark.org/review/7143
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-15 22:47:03 +00:00