Add a colorsChanged signal/slot, more precise than the generic
preferencesChanged signal, and only call it when one of the
color related preferences have changed. Connect it to the
packetList::colorsChanged() function, instead of calling that
whenever preferencesChanged() is called. We could eventually
move the signals and slots some of the other GUI widgets to this.
Send that signal before handling preferences that change
dissection and freeze the packet list, so that when we
restore the column widths due to Qt bug 122109 it takes effect.
The packet_list_hover_style preference affects colors, not
the layout, despite its presence in the GUI layout module.
Enforce the requirement, already mentioned in the headers,
that preference and preference module effect flags must be
nonzero so that the application knows that a preference has changed.
(Lua, for example, needs this.)
Use this and avoid sending the PreferencesChanged signal when
preferences have not changed.
"extcap" by itself can be the name of a directory that stores
extcap programs, especially if the default profile is being
used. Add an extension to the default file name so it doesn't clash.
Follow up to 4fb2ef8af8
If writing a separate extcap preferences file fails, always write the
main preference file.
If there's a directory of the same name as a module, silently ignore it.
Followup to !14436
Continue to write the format-based hidden preference for now.
Read both preferences; if the index-based preference is read, use it.
If not, fall back to the format-based preference.
Followup to 41930060b0
If the capture.no_extcap preference is set, really don't load the
extcap interfaces. Previously, the extcap interfaces were loaded
before the preference was read, because otherwise the extcap
preferences wouldn't be registered and properly read out of the
configuration file.
Wait until after that preference is read to register the
extcap preferences and then re-read just the extcap module
preferences from the configuration files. Make sure to check
other times when the preference may be changed, such as
switching profiles.
Write extcap prefs to a separate file so that they don't get lost
if the extcap interfaces aren't loaded and the prefs are then
written out. Continue writing them to the main file for backwards
compability.
Related to #15295. Cuts ~100 ms off the loading time of Wireshark
in a normal situation if the capture.no_extcap preference is set,
more if an extcap has some kind of issue that makes it take a long
time to load.
Read the old obsolete hidden column preference and apply it.
This will convert it to the new value (and remove it) if preferences
are saved.
Follow up to 41930060b0
Similar to the -I option, but as a pref (defaulting to false,
which is current behavior) that sets the default for 802.11
devices to use monitor mode. (Note this depends on
commit c25e0f9084 being merged
to work properly.)
Also add the checkbox in capture options, only enabled if at
least one device supports monitor mode, that enables and disables
monitor mode on all devices that support it when toggled.
Fix#11011
Like the option to show the bytes, this isn't in a preference
dialog (other than Advanced preferences) because it's easiest to
change it from a Packet Dialog itself.
Fix#18731
Add support for command line parameters, rename the preference to match.
Use the correct `SSLKEYLOGFILE` environment variable name in the text.
Rename SSL to TLS, we are no longer in 1999. Clarify that applications
other than browsers can be selected. Various dialog text improvements.
Move the Launch button to the right to make it stand out more.
Relates to #19471
The GUI preferences don't affect dissection in general and shouldn't
require a costly redissection.
We used to have a PREF_EFFECT_GUI, but it seems that nothing needed
to check it because any changes were noticed in other ways, so it
was removed. (d95213afb0) Bring it
back, because the Lua set_preference assumes that *some* effect
flag is returned when a preference is changed.
We have to set this separately for each submodule too, because
the effect flags are reset to PREF_EFFECT_DISSECTION regardless
of the parent module. The changes to columns, fonts, and colors
are also handled separately without special effect flags; the
layout submodule does have its own effect flag.
Fix#17629
When a preference dialog is used, we don't want to write to each
frame data the value of the TCP sequence analysis override preference
immediately, because that means that the changes take effect even
if the dialog is Rejected. The redissection isn't triggered, but that's
worse in some ways, because it puts things in an inconsistent state.
Instead, stash the list of frame datas to possibly override in the
pref, and then override them when unstashing preferences. Delete
the least when cleaning the preferences. (Storing the pointers should be
fine, because the preference dialogs are modal.)
This also allows us to correctly have the TCP sequence analysis
override preference report whether or not any frame data's
override value was changed, and avoids doing a full redissection
any time the preference dialog is opened, even if nothing is changed.
The TCP sequence analysis override preference doesn't need to
be written to a file or read from the file or command line, because
it's different for every frame, and reset to default (0) for each
new frame when a file is read.
Related to #17629
Adds a new menu under Tools to launch a browser with the
SSLKEYLOGFILE environment variable set.
Adds a new GUI preference to store the browser path specific
to the SSL Keylog dialog (which may be different from the user's
preferred system browser).
Make whether or not we are autoscrolling a "recent" item.
Make the selection of automatically scrolling in the Capture
Options tab actually have an effect (right now it does nothing.)
Switching to a recent also means that the command line "-l" option
actually turns on automatic scrolling if the recent value is off
(currently it has no effect because it is always later overridden
by the preference value).
Document our behavior that autoscrolling, if turned on, temporarily
turns off when manually scrolling upwards or Go'ing directly to
a packet (so that a user can examine a chosen packet.) This temporary
effect does not change the "recent" status, which changes only when
the user directly turns the behavior on or off (through the capture
window, the button or menu item, or the -l command line option.)
Make the text of each registered column a FT_STRING field that can be
filtered, prefixed with _ws.col - these work in display filters, filters
in taps, coloring rules, Wireshark read filters, and in the -Y, -R, -e,
and -j options to tshark. Use them as the default "Apply as Filter" value
for the columns that aren't handled by anything else currently.
Because only the columns formats that actually correspond to columns
get filled in (invisible columns work), register and deregister the
fields when the columns change.
Use the lower case version of the rest of the COL_* define for each
column as the field name.
This adds a number of conditions to "when are the columns needed",
including when the main display filter or any filter on a tap is
using one of these fields.
Custom columns are currently not implemented. For custom columns, the
tree then has to be further primed with any fields used by the custom
columns as well. (Perhaps that should happen in epan_dissect_run() -
are there any cases where we construct the columns and don't want to
prime with any field that custom columns contains? Possibly in taps
that we know only use build in columns.)
Thus, for performance reasons, you're better off matching an ordinary
field if possible; it takes extra time to generate the columns and many
of them are numeric types. (Note that you can always convert a non-string
field to a string field if you want regex matching, consult the
*wireshark-filter(4)* man page.) It does save a bit on typing (especially
for a multifield custom column) and remembering the column title might
be easier in some cases.
The columns are set before the color filters, which means that you
can have a color filter that depends on a built-in column like Info or
Protocol.
Remove the special handling for the -e option to tshark. Note that
the behavior is a little different now, because fixed field names
are used instead of the titles (using the titles allowed illegal
filter names, because it wasn't going through the filter engine.)
For default names, this means that they're no longer capitalized,
so "_ws.col.info" instead of "_ws.col.Info" - hopefully a small
price in exchange for the filters working everywhere.
The output format for -T fields remains the same; all that special
handling is removed (except for remembering if someone asked for
a column field to know that columns should be constructed.)
They're also set before the postdissectors, so postdissectors can
have access.
Anything that depends on whether a packet and previous packets are
displayed (COL_DELTA_TIME_DIS or COL_CUMULATIVE_BYTES) doesn't work
the way most people expect, so don't register fields for those.
(The same is already true of color filters that use those, along with
color filters that use the color filter fields.)
Fix#16576. Fix#17971. Fix#4684. Fix#13491. Fix#13941.
Add default log column preferences. They're currently specific to the
Cloudtrail dissector and need to be generalized, but it's a good
starting point.
Don't clobber hard-coded custom column settings.
Sometimes you have a capture file that has many duplicate frames
because of how the capture was made, and its convenient to ignore
the duplicates so you can concentrate on the data and not all
the TCP warnings.
This adds a preference in the "Protocols" section to ignore
duplicates. This currently only works while reading a capture file
*not* during a live capture.
The Column prefs were moved to a submodule, so the name needs to
be obtained from the parent module instead of the module found,
unlike other modules.
The Column preference names themselves were also changed in addition
to the module. Wait until checking both the module name and the
preference name before printing a warning to the user that a preference
has been converted to a new name, so that the correct name is displayed.
This also means that we print the warning message now for the preferences
that just had their names changed, not the modules.
Fix#19043
Move the deprecated column check functions from the prefs
file to the (Wireshark internal use) column files. Make
them public so that the recent file checking can use them.
This keeps column handling in one place.
Make the recent file column width checking able to convert
a deprecated column to a custom column the same as the main
prefs file.
Allows the user to hide the legend of the IO Graph.
This becomes handy as the legend may hide some graphs and it is
unfortunately not very helpful in many cases.
Move MaxMind lookups to a global Name Resolution preference.
That's a bit of a misnomer (it's not name resolution, but it
is using external sources of data to update information about
a network object), but the MaxMind DB path location is already there.
This means that MaxMind lookups can be disabled with the '-n'
option, and enabled with a 'g' for the '-N' option. This is
significant for tshark, because MaxMind lookups are now synchronous.
Disabling the new global preference also keeps the Endpoints window
from doing MaxMind lookups; currently, even if the IPv4 and IPv6 GeoIP
prefs are disabled the data is still looked up and inserted in the
Endpoints window.
Fix#14692
Reduce the default update interval for dumpcap to notify its parent
of new packets (or to check if we've met file duration, etc.) from
500 ms to 100 ms, and put in the capture options.
This makes the GUI appear to update more in real time rather than
in visible batches of packets.
This also reduces the amount of ring buffer space needed in cases
where we're doing dissection, and dissection is able to keep up,
but the files can be deleted before tshark gets to them because of
the notification lag. (See #1650.)
Introduce a preference for the number of rows whose column text can
be cached, and allow sorting of the packet list only when the
number of displayed rows can fit in the cache. This preference only has
an effect for sorting based on columns that require dissection and
caching the column text. This reduces the number of dissections from
O(N log N) to N. Subsequent sorts are even faster.
Columns based on frame data are unaffected, as they sort much faster
as dissection is not required.
Set the size of the QCache introduced in 8c6854fb65 based
on this preference.
Send a temporary status message to the status bar if we try to sort
but there are too many rows, explaining why sorting did not happen and
that the layout preferences can be changed.
Ping #18741
This removes the last dependency of the logging subsystem on the
preferences module. The latter is started much later than the former
and this is an issue.
The Windows-only preference "gui.console_open" is stored in the
registry as HKEY_LOCAL_USER\Software\Wireshark\ConsoleOpen. The semantics
are exactly the same. The preference is read by the logging subsystem
for initialization and then again by the preferences (read/write) so
the user can configure it as before.
The code to store the preference also in the preferences file was
kept, for backward compatibility and because it is not incompatible
with using the Registry concurrently.
The elimination of the prefs dependency also allows moving the Windows
console logic to wsutil and add the functionality to wslog directly,
thereby eliminating the superfluous Wireshark/Logray custom log handler.
To be able to read the ws_log_console_open global variable from
libwireshark it becomes necessary to add a new export macro
symbol called WSUTIL_EXPORT.
Modernize the handling of experimental TCP options based on
RFC 6994. In particular use ExID instead of magic (which
in the context of RFC 6994 are the last two bytes of a
32-bit ExID) and add a desciption of ExID based on the
current state of the IANA registry.
Remove callback function from pref registrations for dissectors that
don't need a callback. In other dissectors, move registration that
only needs to be done once inside the check for initialization,
avoiding some console messages when preferences are changed
("Duplicate dissectors (anonymous) and (anonymous) for protocol...")
and the like.
Add a couple auto preferences for dissectors missed in previous waves.
Ping #14319
Convert SCTP port preferences in dissectors starting m-z.
Preferences that were already the name of the table can just
be removed from the dissector and they will migrate. Preferences
with a different name are added to deprecated_port_prefs in
epan/prefs.c (Since that function handles them there is no
need to mark them as obsolete.)
Also change a few TCP and UDP single ports reigstered with
preferences and callbacks that used the sample dissector as
a template.
Uses more auto preferences, makes more port preferences ranges,
and reduces the number of preference callbacks. Ping #14319
Similar to commit 2eb7b05b8c,
replace the RTP payload type preferences with automatic
dissectors.
This reduces the number of preference module callbacks.
prefs_find_module() looks up a module by module name, which is
the same as the protocol filter name, case-insensitively.
dissector_table_get_dissector_handle() looks up a dissector handle
in the table by the protocol short name (which is the module _title_)
deprecated_port_pref() used the same string for both lookups.
For some protocols this worked, because the short name is the same
as the filter name only with different capitalization. For others,
it either wouldn't find the module to add to the migrated preference,
or wouldn't find the dissector handle in order to set Decode As
properly.
Fix this, by using the module title for the second lookup, and
changing all the module_name values to be correct. For good
measure, change all the module names that happened to work because
they're differently-cased versions of the filter name in order
to avoid confusion when new entries are added.
Custom column expressions do not need to be limited to COL_MAX_LEN.
The size of the expression does not have any necessary relationship
to the size of the column contents, especially in the common case of
many semantically equivalent different fields from different protocols,
only one of which appears in any given frame.
The only place that actually does limit the length of custom
custom expressions is in reading the preferences. Use a GString
instead of allocating a buffer to COL_MAX_LEN when constructing
the string. In normal cases, this should decrease temporary
memory usage. Fix#16905
Make the default UI layout "packet list on top, packet detail and bytes
side by side". This is more space efficient on modern displays and is
the first thing I change when using the default profile.
John Thacker