Commit Graph

257 Commits

Author SHA1 Message Date
Luis Ontanon 9865b6346f As per Ulf's request add ${proto.field} macros that will use the value of the given field has in the last selected packet.
svn path=/trunk/; revision=22427
2007-07-30 23:32:47 +00:00
Guy Harris 5a43799a17 Use G_GINT64_MODIFIER, rather than the PRI[douxX]64 macros, for GLib
routines and routines using those routines.  GLib might use different
modifiers for 64-bit quantities than the platform's C library does.

svn path=/trunk/; revision=21990
2007-05-29 18:52:42 +00:00
Guy Harris d2ac4f7133 Check for G_GINT64_MODIFIER in Wireshark as we do in Wiretap.
In all the places where a cast to "long long" or "unsigned long long"
was done, use G_GINT64_MODIFIER and get rid of the cast, as

	1) there's no guarantee that "%ll" works

and

	2) there's no guarantee that "long long" works

(the latter definitely does *NOT* work with MSVC++; the former doesn't
work with regular printf in MSVC++, but it might work with the GLib
printf-based functions).

svn path=/trunk/; revision=21978
2007-05-29 06:56:07 +00:00
Sebastien Tandel 76729e5d0f From David Howells :
Fix compilation failures when building wireshark-0.99.6-SVN-21916 on an
x86_64-unknown-linux-gnu target with gcc version 4.1.2 20070403 (Red Hat
4.1.2-8).

The failures fall into two categories:
  (1) Casts between pointers and 32-bit integers without an intermediary cast
via 'long' or 'unsigned long'.  This results in a compiler warning complaining
about casts between a pointer and an integer of a different size.
  (2) Passing values to "%lld" or similar printf-style format options that the
compiler thinks are a different size.  Such values need to be cast to 'long
long' or 'unsigned long long'.

svn path=/trunk/; revision=21975
2007-05-29 02:43:18 +00:00
Luis Ontanon 11f06217ce Have editcap and capinfos loading the wiretap plugins.
epan/filesystem.c
   have get_plugin_dir() calling init_plugin_dir() if necessary

epan/epan.c and epan/report_err.c
   move the report_failure family into the new report_err.c file, have epan_init() calling the initializer

epan/plugins.h and epan/proto.c
   do not have init_plugins() calling the proto_reg functions instead do it in init_proto()

gtk/main.c and tshark.c
   init_plugin_dir() has become suprefluous

capinfos.c and editcap.c
   load the wiretap plugins

Makefiles
   do what's needed to build withe the above changes.




svn path=/trunk/; revision=21935
2007-05-25 17:22:32 +00:00
Ronnie Sahlberg bded91f43d make proto.c compile again after the recent changes
svn path=/trunk/; revision=21853
2007-05-21 02:36:33 +00:00
Anders Broman b688f9154a Split tvb_get_bits64 into tvb_get_bits8 tvb_get_bits16 tvb_get_bits32 and tvb_get_bits64
and use them in proto_tree_add_bits_ret_val().

svn path=/trunk/; revision=21828
2007-05-18 16:46:35 +00:00
Graeme Lunt cf56e76be9 Updated splash screen for Wireshark that shows the initialisation progress.
The splash screen shows a progress bar and a percentage complete - like the progress dialog.
As dissectors are initialised and handed off the name is shown. However, the names of plugin dissectors are not shown.
The update to the make-dissector-reg shell script has been tested, though I think generally the python version is used.


svn path=/trunk/; revision=21716
2007-05-07 17:55:42 +00:00
Anders Broman 43bb2aea51 Add:
proto_tree_add_bits_ret_val()
tvb_get_bits()
And modify
proto_tree_add_bits() not to return a value.
little endian is not yet implemented.

svn path=/trunk/; revision=21607
2007-04-28 12:13:25 +00:00
Anders Broman ccac0e7983 Change the signature of proto_tree_add_bits() and add proto_tree_add_bits_ret_val()
which will hopefully be more acceptable.
Change name of tvb_get_bits() in ansi_801

svn path=/trunk/; revision=21594
2007-04-26 06:39:29 +00:00
Anders Broman fea883ebec Add a new proto function proto_tree_add_bits() which adds bits to the tree
starting at the bit offset given for the number of bits indicated which wll also return
the value of the bits.
Experimental and for review, documentation to be updated.

svn path=/trunk/; revision=21556
2007-04-24 19:24:14 +00:00
Sebastien Tandel 0ca67aef30 - new ptvcursor subtrees management functions :
* ptvcursor_push_subtree(), ptvcursor_pop_subtree() for pushing/popping
    subtrees. Multiple levels of subtrees (256 max.), allocation per 8 levels.
  * Two new functions creating an item in the tree and pushing a subtree at the
    same time. These two functions accept an undefined length
    (SUBTREE_UNDEFINED_LENGTH). The length of the item is set at the next pop.
        1) ptvcursor_add_with_subtree
	2) ptvcursor_add_text_with_subtree
- get rid of potential memory leaks with g_new in ptvcursor_new().

- Documentation of the new ptvcursor functions in README.developer


svn path=/trunk/; revision=21276
2007-03-30 00:21:39 +00:00
Stephen Fisher 8fd3ee0560 Remove almost all of the casts I committed recently and in place of
them, add -Wno-pointer-sign to CFLAGS when gcc will accept it.


svn path=/trunk/; revision=21253
2007-03-28 21:55:11 +00:00
Stephen Fisher 46b8669566 Fix a bunch more warnings. Add -Werror when using --with-warnings-as-errors
under gcc to tools/lemon, plugins/mate and epan/


svn path=/trunk/; revision=21204
2007-03-26 06:10:52 +00:00
Jeff Morriss 62596bffb3 Fix bug 552:
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=552

by enforcing that header fields have names of length > 0.  This should fix
the display of those fields and also make them filterable (which was the
subject of the bug).  Abbreviations are (still) optional: if they are empty
then the field is not filterable.

Update README.developer with this information.

Add header field names in several dissectors where they were missing.

In packet-arp.c give "packet-storm-detected" a name (as above) but also set it
as _GENERATED.

Also remove trailing white space from all the files checked in.

svn path=/trunk/; revision=21018
2007-03-11 06:16:00 +00:00
Stephen Fisher aa897723ff From Sebastien Tandel:
Here is an updated patch for proto_tree_add_item and the
range_string structure. The new macro RVALS() can be used as the macro
VALS() in the declaration of your hf_register_info with another
structure (range_string).  Be aware that you *have to* ORed the value of
the field display with BASE_RANGE_STRING constant and it can 'only' be
used with FT_(U)INT* types in a header_field_info.


svn path=/trunk/; revision=20805
2007-02-14 00:39:48 +00:00
Guy Harris 10778a6ab1 DISSECTOR_ASSERT_NOT_REACHED() now, by default, throws a Wireshark
exception rather than aborting the program; using it means that
dissector bugs show up as such rather than as malformed packets.

svn path=/trunk/; revision=20532
2007-01-23 18:31:26 +00:00
Martin Mathieson 997e5415f9 Add separate union entries to fvalue.value for signed and unsigned
32-bit numbers.  Separate signed and unsigned accessors have been
added and used where appropriate.

Definitely not for 0.99.5.

svn path=/trunk/; revision=20472
2007-01-18 11:02:26 +00:00
Ronnie Sahlberg 3e9ac49497 check if we have a finfo before dereferencing it later in PROTO_ITEM_IS_HIDDEN()
this prevents wireshark from crashing on X Liu's kerberos capture files


svn path=/trunk/; revision=20464
2007-01-17 21:05:44 +00:00
Tomas Kukosa 92d8d4e9b4 do not ignore invisible tree, it can break tree creation for coloring/filtering
svn path=/trunk/; revision=20404
2007-01-12 10:21:02 +00:00
Jaap Keuter f8422ab7db Extending true_false_string support
- Separate tfs.[ch]
- Add larger sample collection
- Properly export DATA

svn path=/trunk/; revision=20373
2007-01-10 07:47:00 +00:00
Guy Harris 44c0624bd9 Add a WIRESHARK_RUN_FROM_BUILD_DIRECTORY environment variable on UN*X;
if set, and if the program isn't running with additional privileges,
it'll treat the directory in which the program is found as the data
directory.

If, on Windows, the version-number subdirectory of {data
directory}\plugins doesn't exist (which is assumed to mean that the
program is being run from the build directory), or if, on UN*X,
WIRESHARK_RUN_FROM_BUILD_DIRECTORY is set, the plugin directory is the
"plugins" subdirectory of the data directory, and all subdirectories of
that directory are scanned for plugins, as the "plugins" subdirectory of
the build directory contains subdirectories for the plugins; this means
that if we're running from the build directory, we'll find the plugins
we built in the build tree.

When generating the wireshark-filter man page, run tshark with
WIRESHARK_RUN_FROM_BUILD_DIRECTORY set, so it uses the plugins from the
build to generate the list of filters.

svn path=/trunk/; revision=20261
2007-01-02 06:49:40 +00:00
Ronnie Sahlberg b7817c4e37 proto_tree_set_string() no longer needs an already_allocated parameter since it is now always FALSE.
This should mean that all fvalue_set() for FT_STRING[Z] are always with already_copied==FALSE

(funny that we never saw someone trying to g_free("[ Null ]") which might have happened before)



svn path=/trunk/; revision=20245
2006-12-30 00:41:41 +00:00
Ronnie Sahlberg 62040d3638 make the FT_STRINGZ case in proto_tree_new_item() use ep allocated memory
svn path=/trunk/; revision=20244
2006-12-30 00:36:29 +00:00
Ronnie Sahlberg ee4ceb8947 make proto_tree_set_string_tvb use ep allocated memory and thus push the memory allocation/free for this field down into ftype-string.c
svn path=/trunk/; revision=20243
2006-12-30 00:27:33 +00:00
Ronnie Sahlberg 459d5f66a4 use ep allocated memory for the string in proto_item_append_string and let ftype-string.c handle the allocation/freeing of storage by setting already_copied to FALSE
svn path=/trunk/; revision=20240
2006-12-29 23:05:55 +00:00
Ronnie Sahlberg 8fc740a53e hmm
best to revert this for a while.



revert all changes from previous patch.



svn path=/trunk/; revision=20195
2006-12-22 09:01:12 +00:00
Ronnie Sahlberg 8433f6d589 change some slab allocated memory into ep/emem allocated structures instead.
this primarily removes code and simplifies (==eliminates) the need to track the data that is allocated and should potentially be slightly faster than a slab allocator.
however these functions are called A LOT so there might be a performance hit when using emem with full debugging canary values and all the bells and whistles activated.


this change also makes any future attempt to parallellize dissection of frames easier if we just make the ep allocator allocate from a threads specific ep pool.
(something we would have to do anyway to make ep allocations multithreaded)



this works in all my tests so far but needs more test coverage.



svn path=/trunk/; revision=20194
2006-12-22 08:35:43 +00:00
Ronnie Sahlberg 41c258daf3 create a nice helper to dissect bitmasks and implement some test useage of it in the scsi dissector
svn path=/trunk/; revision=20002
2006-11-27 14:50:23 +00:00
Guy Harris d3fed959bc Have separate proto_construct_match_selected_string() and
proto_can_match_selected() routines, to more clearly separate the two
functions - but have them both call the same underlying routine, so
they both make the same decisions as to whether a match-selected string
can be constructed or not.

svn path=/trunk/; revision=19976
2006-11-24 18:25:23 +00:00
Guy Harris 37a6c02697 Rename proto_construct_dfilter_string() to
proto_construct_match_selected_string() to indicate what it does - and
have it return a Boolean indication of whether the string could be
built, returning the string through a pointer, and, if that pointer is
null, have it just return the Boolean and not construct the string.

Get rid of proto_can_match_selected() -
proto_construct_match_selected_string() can be used for that, which
means we have only one piece of code that knows whether a "match
selected" string can be constructed or not.

Have proto_construct_match_selected_string() support matching
zero-length FT_NONE (and FT_PCRE, but that shouldn't happen) fields even
if there's no epan_dissect_t, as such a match just checks whether the
field is present.

svn path=/trunk/; revision=19967
2006-11-23 21:16:46 +00:00
Guy Harris 621c7fe650 When checking whether a field supports "match selected", do the same
checks that we do when we try to construct the filter expression for
"match selected" - this means we don't just assert that all FT_NONEs are
filterable, as they aren't.

svn path=/trunk/; revision=19961
2006-11-23 00:15:49 +00:00
Guy Harris 8532eef3c6 Make the "standard" case in proto_can_match_selected() and
proto_construct_dfilter_string() the default, so you add explicit cases
only when the type needs to be treated specially, so we don't end up
with types where we forget to have a case.

svn path=/trunk/; revision=19959
2006-11-22 22:11:38 +00:00
Martin Mathieson 268a3dff57 Make FT_STRINGZ items work as apply/prepare as filter menu items
svn path=/trunk/; revision=19936
2006-11-20 14:53:22 +00:00
Gerald Combs fe557f6296 Throw an exception if we try to add more than a million items to the tree.
svn path=/trunk/; revision=19767
2006-11-01 20:32:23 +00:00
Gilbert Ramirez 63ec12f392 When processing '-G fields', ignore the "proto_tree_add_text"
pseudo-field by looking at the ID for hf_text_only. Apparently
some fields really don't have 'name' fields, but we still want
their info to be dumped out.

svn path=/trunk/; revision=19763
2006-10-31 22:00:41 +00:00
Gerald Combs 9e23f31e5f Add support for reading from stdin under Windows. Based on a patch sent
in last year by Gianluca Varenni.

Add partial support for reading from named pipes (currently disabled).

Move utf_8to16() and utf_16to8() to a separate module (unicode-utils.[ch])
so that we don't have to cut and paste code in dumpcap.c.

Fix up whitespace.

svn path=/trunk/; revision=19291
2006-09-22 21:14:54 +00:00
Tomas Kukosa 539102ca60 - new function ssl_dissector_delete()
- register H.225.0 over TLS (configurable port 1300)
- register SIP over TLS (fixed port 5061)
- new function proto_tree_get_root()

svn path=/trunk/; revision=19059
2006-08-28 07:05:02 +00:00
Martin Mathieson f8aadddf70 Make apply-as-filter strings work for FT_UINT_STRING (rather than using frame[...])
svn path=/trunk/; revision=18969
2006-08-21 11:45:37 +00:00
Martin Mathieson 0669def03d Fix for bug 1023 (problem with 'apply as filter' strings)
svn path=/trunk/; revision=18817
2006-08-02 09:14:31 +00:00
Ronnie Sahlberg 64fba459da from martin m
Hi,

This patch allows FT_NONE items to be built into filter expressions
(i.e. testing for their presence or absence rather than comparing with a
value) using the Apply|Prepare a Filter menus.  What drove me to add
this was having to type in !tcp.analysis.out_of_order.

Does this seem reasonable?

Regards,
Martin




svn path=/trunk/; revision=18782
2006-07-22 03:24:28 +00:00
Gerald Combs 20093fdaa4 snprintf -> g_snprintf. Fix up whitespace.
svn path=/trunk/; revision=18776
2006-07-20 21:29:45 +00:00
Guy Harris f6f7bd756d The joys of the C switch statement - you have to remember to use
"break;" between cases except in those rare situations where you *want*
fallthrough.

svn path=/trunk/; revision=18550
2006-06-22 21:55:24 +00:00
Anders Broman 996d4db495 Ethereal->Wireshark
svn path=/trunk/; revision=18234
2006-05-28 19:49:07 +00:00
Ronnie Sahlberg 89f022b12b name change
svn path=/trunk/; revision=18197
2006-05-21 05:12:17 +00:00
Guy Harris 3b34a4f260 Squelch a compiler warning (for a problem that doesn't actually occur).
svn path=/trunk/; revision=17758
2006-03-29 21:53:26 +00:00
Luis Ontanon 850dfe8fa2 add proto_all_finfos() that will return a GPtrArray containing every finfo found in a tree.
svn path=/trunk/; revision=17741
2006-03-27 19:28:02 +00:00
Tomas Kukosa 923855bb20 new FT_GUID handling - big/little endian supported
svn path=/trunk/; revision=17566
2006-03-10 11:58:22 +00:00
Lars Roland e271ba9a3c Display g_error messages in the console window unconditionally, if preferences aren't loaded yet.
This way we ensure that errors are displayed during protocol registration.

Use g_error instead of g_warning, if not allowed characters are used in display filter names for protocols. Extend the error message in this case.

svn path=/trunk/; revision=17248
2006-02-11 03:50:25 +00:00
Guy Harris 55c64cec5e Add "proto_tree_add_XXX_format_value()" routines, which are like the
"proto_tree_add_XXX_format()" routines except that the format doesn't
have to include the field name - the field name, followed by ": ", are
put into the representation string, followed by the result of the
formatting, so you just format the value with the format string, not the
entire representation.

svn path=/trunk/; revision=17221
2006-02-09 04:18:23 +00:00