1998-09-16 02:39:15 +00:00
|
|
|
/* file.h
|
|
|
|
|
* Definitions for file structures and routines
|
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
1998-09-16 03:22:19 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* Ethereal - Network traffic analyzer
|
Enable "Match Selected" only if there's a field selected *and* we can do
a "Match Selected" on it - we can't do a "Match Selected" if the field
has no value (e.g., FT_NULL) and has a length of 0.
If we unselect the current packet, we don't have a protocol tree, so we
don't have a currently selected field - clear the "Match Selected" menu
item and the display in the status line of information about the
currently selected field.
Move the low-level statusbar manipulation into "gtk/main.c", in routines
whose API doesn't expose anything GTK+-ish.
"close_cap_file()" calls one of those routines to clear out the status
bar, so it doesn't need to take a pointer to the statusbar widget as an
argument.
"clear_tree_and_hex_views()" is purely a display-manipulating routine;
move it to "gtk/proto_draw.c".
Extract from "tree_view_unselect_row_cb()" an "unselect_field()" routine
to do all the work that needs to be done if the currently selected
protocol tree row is unselected, and call it if the currently selected
packet list row is unselected (if it's unselected, there *is* no
protocol tree, so no row can be selected), as well as from
"tree_view_unselect_row_cb()".
Before pushing a new field-description message onto the statusbar, pop
the old one off.
Get rid of an unused variable (set, but not used).
svn path=/trunk/; revision=3513
2001-06-05 07:39:31 +00:00
|
|
|
* By Gerald Combs <gerald@ethereal.com>
|
1998-09-16 02:39:15 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1998-09-16 02:39:15 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#ifndef __FILE_H__
|
|
|
|
|
#define __FILE_H__
|
|
|
|
|
|
2004-09-04 00:53:16 +00:00
|
|
|
#include <epan/packet-range.h>
|
1999-08-11 17:02:28 +00:00
|
|
|
#include "wiretap/wtap.h"
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/dfilter/dfilter.h>
|
1999-12-10 04:21:04 +00:00
|
|
|
#include "print.h"
|
1999-09-22 01:26:50 +00:00
|
|
|
#include <errno.h>
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/epan.h>
|
2000-10-06 10:11:40 +00:00
|
|
|
|
2002-09-06 22:45:44 +00:00
|
|
|
#include "cfile.h"
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2003-09-15 22:48:42 +00:00
|
|
|
/* Return values from "cf_read()", "cf_continue_tail()", and
|
|
|
|
|
"cf_finish_tail()". */
|
Add routines to Wiretap to allow a client of Wiretap to get:
a pointer to the "wtap_pkthdr" structure for an open capture
file;
a pointer to the "wtap_pseudo_header" union for an open capture
file;
a pointer to the packet buffer for an open capture file;
so that a program using "wtap_read()" in a loop can get at those items.
Keep, in a "capture_file" structure, an indicator of whether:
no file is open;
a file is open, and being read;
a file is open, and is being read, but the user tried to quit
out of reading the file (e.g., by doing "File/Quit");
a file is open, and has been completely read.
Abort if we try to close a capture that's being read if the user hasn't
tried to quit out of the read.
Have "File/Quit" check if a file is being read; if so, just set the
state indicator to "user tried to quit out of it", so that the code
reading the file can do what's appropriate to clean up, rather than
closing the file out from under that code and causing crashes.
Have "read_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
close the capture and return an indication that the read was aborted by
the user. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "continue_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
return an indication that the read was aborted by the user if that
happened. Otherwise, return an indication of whether the read
completely succeeded or failed in the middle (and, if it failed, return
the error code through a pointer).
Have "finish_tail_cap_file()" read the capture file with a loop using
"wtap_read()", rather than by using "wtap_loop()"; have it check after
reading each packet whether the user tried to abort the read and, if so,
quit the loop, and after the loop finishes (even if it read no packets),
close the capture and return an indication that the read was aborted by
the user if that happened. Otherwise, return an indication of whether
the read completely succeeded or failed in the middle (and, if it
failed, return the error code through a pointer).
Have their callers check whether the read was aborted or not and, if it
was, bail out in the appropriate fashion (exit if it's reading a file
specified by "-r" on the command line; exit the main loop if it's
reading a file specified with File->Open; kill the capture child if it's
"continue_tail_cap_file()"; exit the main loop if it's
"finish_tail_cap_file()".
svn path=/trunk/; revision=2095
2000-06-27 07:13:42 +00:00
|
|
|
typedef enum {
|
|
|
|
|
READ_SUCCESS, /* read succeeded */
|
|
|
|
|
READ_ERROR, /* read got an error */
|
|
|
|
|
READ_ABORTED /* read aborted by user */
|
|
|
|
|
} read_status_t;
|
|
|
|
|
|
2003-09-15 22:48:42 +00:00
|
|
|
int cf_open(char *, gboolean, capture_file *);
|
|
|
|
|
void cf_close(capture_file *);
|
2004-08-25 03:01:32 +00:00
|
|
|
void cf_reload();
|
Have the Wiretap open, read, and seek-and-read routines return, in
addition to an error code, an error info string, for
WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and
WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with
"g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed
strings returned as the error info string, and change the callers of
those routines to, for those errors, put the info string into the
printed message or alert box for the error.
Add messages for cases where those errors were returned without printing
an additional message.
Nobody uses the error code from "cf_read()" - "cf_read()" puts up the
alert box itself for failures; get rid of the error code, so it just
returns a success/failure indication.
Rename "file_read_error_message()" to "cf_read_error_message()", as it
handles read errors from Wiretap, and have it take an error info string
as an argument. (That handles a lot of the work of putting the info
string into the error message.)
Make some variables in "ascend-grammar.y" static.
Check the return value of "erf_read_header()" in "erf_seek_read()".
Get rid of an unused #define in "i4btrace.c".
svn path=/trunk/; revision=9852
2004-01-25 21:55:17 +00:00
|
|
|
read_status_t cf_read(capture_file *);
|
2003-09-15 22:48:42 +00:00
|
|
|
int cf_start_tail(char *, gboolean, capture_file *);
|
|
|
|
|
read_status_t cf_continue_tail(capture_file *, int, int *);
|
|
|
|
|
read_status_t cf_finish_tail(capture_file *, int *);
|
1998-09-16 02:39:15 +00:00
|
|
|
/* size_t read_frame_header(capture_file *); */
|
2003-12-29 20:05:59 +00:00
|
|
|
gboolean cf_save(char *fname, capture_file * cf, packet_range_t *range, guint save_format);
|
2003-09-15 22:16:08 +00:00
|
|
|
gchar *cf_get_display_name(capture_file *);
|
1998-09-16 02:39:15 +00:00
|
|
|
|
2004-02-23 22:48:52 +00:00
|
|
|
gboolean filter_packets(capture_file *cf, gchar *dfilter, gboolean force);
|
2003-09-12 02:48:23 +00:00
|
|
|
void reftime_packets(capture_file *);
|
1999-10-11 06:39:26 +00:00
|
|
|
void colorize_packets(capture_file *);
|
2000-07-09 03:29:42 +00:00
|
|
|
void redissect_packets(capture_file *cf);
|
2004-01-13 22:34:10 +00:00
|
|
|
int retap_packets(capture_file *cf);
|
2004-01-25 00:58:13 +00:00
|
|
|
typedef enum {
|
|
|
|
|
PP_OK,
|
|
|
|
|
PP_OPEN_ERROR,
|
|
|
|
|
PP_WRITE_ERROR
|
|
|
|
|
} pp_return_t;
|
|
|
|
|
pp_return_t print_packets(capture_file *cf, print_args_t *print_args);
|
2004-07-08 10:36:29 +00:00
|
|
|
pp_return_t write_pdml_packets(capture_file *cf, print_args_t *print_args);
|
|
|
|
|
pp_return_t write_psml_packets(capture_file *cf, print_args_t *print_args);
|
|
|
|
|
|
1999-06-22 03:39:07 +00:00
|
|
|
void change_time_formats(capture_file *);
|
Get rid of the EBCDIC stuff in the find dialog - it's not supported yet,
so we shouldn't torment the users by offering it.
Check the string type and convert it to an internal representation in
the GUI code; have the search code deal only with the internal
representation.
Save the case-sensitivity flag, and the indication of where string
searches look, along with other search parameters.
Upper-casify the string, for case-insensitive searches, in the GUI code;
don't save the upper-casified string, so it doesn't SHOUT at you when
you next pop up a "find" dialog.
Convert the hex value string to raw binary data in the GUI code, rather
than doing so in the search code. Check that it's a valid string.
Connect the signals to the radio buttons after the pointers have been
attached to various GUI items - the signal handlers expect some of those
pointers to be attached, and aren't happy if they're not.
Have "find_packet()" contain a framework for searching, but not contain
the matching code; instead, pass it a pointer to a matching routine and
an opaque pointer to be passed to the matching routine. Have all the
routines that do different types of searching have their own matching
routines, and use the common "find_packet()" code, rather than
duplicating that code.
Search for the Info column by column type, not by name (the user can
change the name).
When matching on the protocol tree, don't format the entire protocol
tree into a big buffer - just have a routine that matches the text
representation of a protocol tree item against a string, and, if it
finds a match, sets a "we found a match flag" and returns; have that
routine not bother doing any more work if that flag is set.
(Unfortunately, you can't abort "g_node_children_foreach()" in the
middle of a traversal.)
Free the generated display filter code after a find-by-display-filter
finishes.
svn path=/trunk/; revision=8306
2003-08-29 04:03:46 +00:00
|
|
|
|
|
|
|
|
gboolean find_packet_protocol_tree(capture_file *cf, const char *string);
|
|
|
|
|
gboolean find_packet_summary_line(capture_file *cf, const char *string);
|
|
|
|
|
gboolean find_packet_data(capture_file *cf, const guint8 *string,
|
|
|
|
|
size_t string_size);
|
|
|
|
|
gboolean find_packet_dfilter(capture_file *cf, dfilter_t *sfcode);
|
|
|
|
|
|
2003-07-22 23:08:48 +00:00
|
|
|
guint8 get_int_value(char char_val);
|
2003-08-05 00:01:27 +00:00
|
|
|
gboolean find_ascii(capture_file *cf, char *ascii_text, gboolean ascii_search, char *ftype, gboolean case_type);
|
2003-08-11 22:41:10 +00:00
|
|
|
gboolean find_in_gtk_data(capture_file *cf, gpointer *data, char *ascii_text, gboolean case_type, gboolean search_type);
|
2003-03-02 22:07:25 +00:00
|
|
|
gboolean goto_frame(capture_file *cf, guint fnumber);
|
2004-01-20 18:47:25 +00:00
|
|
|
gboolean goto_bottom_frame(capture_file *cf);
|
|
|
|
|
gboolean goto_top_frame(capture_file *cf);
|
2004-09-02 19:52:39 +00:00
|
|
|
void goto_framenum(capture_file *cf);
|
2004-01-20 18:47:25 +00:00
|
|
|
|
1999-11-30 07:27:37 +00:00
|
|
|
|
1999-07-24 03:22:50 +00:00
|
|
|
void select_packet(capture_file *, int);
|
Have "close_cap_file()" disable all menu items that make sense only if
you have a capture.
Leave the job of enabling and disabling menu items that make sense only
if you have a capture (except for "File/Save" and "File/Save As...", for
now) up to "load_cap_file()", "close_cap_file()", and the like - don't
scatter that stuff throughout the code.
Disable "File/Print Packet" if no packet is selected; enable it only if
a packet is selected.
If there's a selected packet, and a display filter is run:
if the selected packet passed the filter, re-select it;
if the selected packet didn't pass the filter, un-select it.
If we've opened a live "pcap" capture, but can't do the capture because
we can't get the netmask info, or can't parse the capture filter string,
or can't install the filter, close the live capture and the dump and
delete the dump file.
If we failed to open a live "pcap" capture, don't try to read the
capture file - it doesn't exist.
svn path=/trunk/; revision=384
1999-07-24 02:42:52 +00:00
|
|
|
void unselect_packet(capture_file *);
|
1999-06-19 01:14:51 +00:00
|
|
|
|
2003-09-24 00:47:37 +00:00
|
|
|
void unselect_field(capture_file *);
|
Enable "Match Selected" only if there's a field selected *and* we can do
a "Match Selected" on it - we can't do a "Match Selected" if the field
has no value (e.g., FT_NULL) and has a length of 0.
If we unselect the current packet, we don't have a protocol tree, so we
don't have a currently selected field - clear the "Match Selected" menu
item and the display in the status line of information about the
currently selected field.
Move the low-level statusbar manipulation into "gtk/main.c", in routines
whose API doesn't expose anything GTK+-ish.
"close_cap_file()" calls one of those routines to clear out the status
bar, so it doesn't need to take a pointer to the statusbar widget as an
argument.
"clear_tree_and_hex_views()" is purely a display-manipulating routine;
move it to "gtk/proto_draw.c".
Extract from "tree_view_unselect_row_cb()" an "unselect_field()" routine
to do all the work that needs to be done if the currently selected
protocol tree row is unselected, and call it if the currently selected
packet list row is unselected (if it's unselected, there *is* no
protocol tree, so no row can be selected), as well as from
"tree_view_unselect_row_cb()".
Before pushing a new field-description message onto the statusbar, pop
the old one off.
Get rid of an unused variable (set, but not used).
svn path=/trunk/; revision=3513
2001-06-05 07:39:31 +00:00
|
|
|
|
2001-12-06 02:21:26 +00:00
|
|
|
/*
|
|
|
|
|
* Mark a particular frame in a particular capture.
|
|
|
|
|
*/
|
|
|
|
|
void mark_frame(capture_file *, frame_data *);
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Unmark a particular frame in a particular capture.
|
|
|
|
|
*/
|
|
|
|
|
void unmark_frame(capture_file *, frame_data *);
|
|
|
|
|
|
Improve the alert boxes put up for file open/read/write errors. (Some
influence came from
http://developer.apple.com/techpubs/mac/HIGuidelines/HIGuidelines-232.html
which has a section on dialog box and alert box messages. However,
we're largely dealing with technoids, not with The Rest Of Us, so I
didn't go as far as one perhaps should.)
Unfortunately, it looks like it's a bit more work to arrange that, if
you give a bad file name to the "-r" flag, the dialog box pop up only
*after* the main window pops up - it has the annoying habit of popping
up *before* the main window pops up, and sometimes getting *obscured* by
it, when I do that. The removal of the dialog box stuff from
"load_cap_file()" was intended to facilitate that work. (It might also
be nice if, when an open from the "File/Open" menu item fails, we keep
the file selection box open, and give the user a chance to correct
typos, choose another file name, etc.)
svn path=/trunk/; revision=310
1999-06-12 09:10:20 +00:00
|
|
|
/* Moves or copies a file. Returns 0 on failure, 1 on success */
|
|
|
|
|
int file_mv(char *from, char *to);
|
|
|
|
|
|
|
|
|
|
/* Copies a file. Returns 0 on failure, 1 on success */
|
|
|
|
|
int file_cp(char *from, char *to);
|
|
|
|
|
|
Have the Wiretap open, read, and seek-and-read routines return, in
addition to an error code, an error info string, for
WTAP_ERR_UNSUPPORTED, WTAP_ERR_UNSUPPORTED_ENCAP, and
WTAP_ERR_BAD_RECORD errors. Replace the error messages logged with
"g_message()" for those errors with g_strdup()ed or g_strdup_printf()ed
strings returned as the error info string, and change the callers of
those routines to, for those errors, put the info string into the
printed message or alert box for the error.
Add messages for cases where those errors were returned without printing
an additional message.
Nobody uses the error code from "cf_read()" - "cf_read()" puts up the
alert box itself for failures; get rid of the error code, so it just
returns a success/failure indication.
Rename "file_read_error_message()" to "cf_read_error_message()", as it
handles read errors from Wiretap, and have it take an error info string
as an argument. (That handles a lot of the work of putting the info
string into the error message.)
Make some variables in "ascend-grammar.y" static.
Check the return value of "erf_read_header()" in "erf_seek_read()".
Get rid of an unused #define in "i4btrace.c".
svn path=/trunk/; revision=9852
2004-01-25 21:55:17 +00:00
|
|
|
char *cf_read_error_message(int, gchar *);
|
Improve the alert boxes put up for file open/read/write errors. (Some
influence came from
http://developer.apple.com/techpubs/mac/HIGuidelines/HIGuidelines-232.html
which has a section on dialog box and alert box messages. However,
we're largely dealing with technoids, not with The Rest Of Us, so I
didn't go as far as one perhaps should.)
Unfortunately, it looks like it's a bit more work to arrange that, if
you give a bad file name to the "-r" flag, the dialog box pop up only
*after* the main window pops up - it has the annoying habit of popping
up *before* the main window pops up, and sometimes getting *obscured* by
it, when I do that. The removal of the dialog box stuff from
"load_cap_file()" was intended to facilitate that work. (It might also
be nice if, when an open from the "File/Open" menu item fails, we keep
the file selection box open, and give the user a chance to correct
typos, choose another file name, etc.)
svn path=/trunk/; revision=310
1999-06-12 09:10:20 +00:00
|
|
|
|
1998-09-16 02:39:15 +00:00
|
|
|
#endif /* file.h */
|