This is initial support for reloading Lua plugins without
restarting the application.
Still todo:
- Deregister FileHandlers
- Support deregister ProtoField with existing abbrev (same_name_hfinfo)
- Add a progress dialog when reloading many plugins
- Search for memory leakages in wslua functions
Change-Id: I48870d8741251705ca15ffe1068613fcb0cb18c1
Reviewed-on: https://code.wireshark.org/review/5028
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
This pseudo field is a specific case that is not linked to any protocol (despite parent being set to -1).
This prevents a crash in Qt GUI when selecting a line added with proto_tree_add_subtree() or similar.
Change-Id: I3b1cc2e6c7e71a71898f2ee9a02e9158eccf6fac
Reviewed-on: https://code.wireshark.org/review/9845
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
ptvc->offset has already been incremented by the item length so don't use it as
the offset to test_length(); we need to use the original offset.
Problem introduced by Idfd258c734e7a946300b2564bebf6e4cb374c8d1 .
Change-Id: I0421539bde6e8eb7b5aa3e22dbb0ca8098e88d6f
Reviewed-on: https://code.wireshark.org/review/9779
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Ping-Bug: 11358
Change-Id: Idfd258c734e7a946300b2564bebf6e4cb374c8d1
Reviewed-on: https://code.wireshark.org/review/9655
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This dialog combines the "protocols" and heuristic dissectors (from GTK) into a single tree view where heuristic dissectors are children of their protocol.
Change-Id: I107656afd079c1d1c8a98161b736e4b4ad84f813
Reviewed-on: https://code.wireshark.org/review/9739
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Combine the GTK+ RTP Stream Analysis and RTP Graph Analysis dialogs into
one. Yell at the user less. Disable the Analyze RTP Stream menu item if
we don't have an RTP stream selected.
There are a *lot* of moving parts in this dialog. I've tested with the
few RTP captures I have but it's by no means complete.
"To do" items are listed at the top of rtp_analysis.cpp.
Change-Id: Id503977f069bebc46cc68bc749f0c9cbf4d37bf6
Reviewed-on: https://code.wireshark.org/review/9650
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
The hfinfo->strings pointer is used to store a ft_framenum_type_t
Bug: 11325
Change-Id: Ia6ee1bdd4f1e6ff93907e6107fcecab56c0320de
Reviewed-on: https://code.wireshark.org/review/9458
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
We still need to insert an empty g_byte_array
Bug: 11309
Change-Id: Idf2ed8ea81b3f612ef8d6ae1aed158108dcc4356
Reviewed-on: https://code.wireshark.org/review/9114
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
before hfinfo is actually used (coverity 1293631)
Change-Id: I270c30c4699cd6f831a38986e6c8024c2e9ef47a
Reviewed-on: https://code.wireshark.org/review/9061
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Otherwise numeric fields with BASE_EXT_STRING don't match anything and cause an
assertion failure.
Also fix indentation.
Change-Id: I2708be50a6c5aff5400ec44e6a141db39d2d94e7
Reviewed-on: https://code.wireshark.org/review/8391
Petri-Dish: Evan Huus <eapache@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Evan Huus <eapache@gmail.com>
The correct bit has to be set in the value passed in; create a
proto_tree_add_boolean64() that takes a 64-bit argument and use that.
Change-Id: I28eaab38308baa908bdc1b043b2f0b87a17afe0d
Reviewed-on: https://code.wireshark.org/review/8131
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Just pass 1 or 0 to proto_tree_add_boolean() depending on whether the
64-bit value is non-zero or zero.
Change-Id: I5b55c9aff4e559fb8e62bd96ae2b0b34e45189fa
Reviewed-on: https://code.wireshark.org/review/8129
Reviewed-by: Guy Harris <guy@alum.mit.edu>
In proto_item_add_bitmask_tree(), if use_value is true, base the routine
we use to add the item to the tree on the type of the field being added.
Also, use DISSECTOR_ASSERT_NOT_REACHED(), not g_assert_not_reached(), to
catch types that aren't integral or Boolean.
Change-Id: I6ff9867bddcae16ddf8b689b48fdc93c6f949105
Reviewed-on: https://code.wireshark.org/review/8127
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Add proto_tree_add_bitmask_value, proto_tree_add_bitmask_value_with_flags and proto_tree_add_bitmask_list to aid in the removal of proto_tree_add_boolean "groupings" as well as "groups" of fields that use proto_tree_add_item with the same offset/len.
This may be able to be optimized later, but the first step will be converting dissectors to use it. A sample conversion of each API is also included.
Change-Id: I53febc7450ad632482f82615a7fa62174f8472c9
Reviewed-on: https://code.wireshark.org/review/8038
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
PROTO_TREE_ADD_XXX_ITEM had a bug in it for int values. This was
fixed by adding proto_tree_set_ ## ctype ## to the macro, but not
all compilers support macros at the end of a function, so just
remove the macro entirely and just have the duplicate code.
Change-Id: Icf92a6786daa0e84305ba174ce155833f90b6463
Reviewed-on: https://code.wireshark.org/review/8006
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: I57e5dcfabc1c1b4c024b9e1cbfd8b9a34c79c330
Reviewed-on: https://code.wireshark.org/review/8003
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
works as proto_tree_add_item(), but also returns the value of (u)ints
of 8,16,24 and 32 bits length in a 32 bit variable. It's based on Hadriels
previous work.
Change-Id: If3b4b8588b63251f1ee9b954a202acde7c02ce86
Reviewed-on: https://code.wireshark.org/review/7230
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This "encourages" (forces) dissectors to use the bitmask field of the header_field_info structure to get "bitmask formatting" of a field.
other_decode_bitfield_value should be treated the same (eventually eliminated), but there are still replacements to be made in the dissectors.
Change-Id: I8a0d829c3fef2d5e5a588667a259e231bca559e6
Reviewed-on: https://code.wireshark.org/review/7736
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add the ability to set frame number types: none, request, or response.
Use the types to draw different related packet indicators in the packet
list.
Track the conversation in PacketListRecord. Use it to draw dashed lines
for unrelated frames.
Set frame number types for DNS and ICMP.
Instead of drawing a transparent QImage, alpha blend our foreground
color and draw directly in our painter. Blend more toward the foreground
color.
Add FRAMENUM_TYPE to checkAPIs.
Change-Id: I2495945bb436413e05d6ec697184a0b4fd5ad214
Reviewed-on: https://code.wireshark.org/review/7436
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Finish the job of handling integral values > 32 bits similarly to who we
handle values 32 bits or less.
In cases that "should not happen", and where we might *not* be executing
in the context of a dissector (filling in the field label can be done
lazily, being deferred to "print" time, and that doesn't happen in the
context of a dissector), use g_assert_not_reached() rather than
DISSECTOR_ASSERT_NOT_REACHED() - the latter throws an assertion that's
not caught if we're not doing dissection, so we crash anyway.
Bug: 10983
Change-Id: Ia81a0a4925394f99aa35193a333f3e9659a9b93d
Reviewed-on: https://code.wireshark.org/review/7307
Reviewed-by: Guy Harris <guy@alum.mit.edu>
As in "don't set it with proto_tree_set_uint64(), signed vs. unsigned
matters".
Change-Id: I23ef3d172fa40c0867dfb6a078ce292bd5282170
Reviewed-on: https://code.wireshark.org/review/7306
Reviewed-by: Guy Harris <guy@alum.mit.edu>
This fixes some crashes.
Change-Id: I47583777486486114675ba98cb58971adb8b1b10
Reviewed-on: https://code.wireshark.org/review/7305
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Change-Id: I57354c309ecf3a0c8f0c7cff485638027f30bb19
Reviewed-on: https://code.wireshark.org/review/5813
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add address_with_resolution_to_str API that returns address string + name resolution in the format %s (%s), first string is resolved name (if available) and second string is raw address string.
Convert AT_FCWWN to using proper name resolution format
First use of address_with_resolution_to_str with field types in proto.c
Change-Id: I2ae77c29a4ffc30bb919fbec00f06629830898c2
Reviewed-on: https://code.wireshark.org/review/7196
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
This squelches a compiler warning on some platforms.
Change-Id: Ibee5c2fe07fc58e22a860b4c4467a501c2b8a979
Reviewed-on: https://code.wireshark.org/review/7079
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Change name from proto_tree_add_new_bytes to
proto_tree_add_bytes_with_length and other tweaks
pointed by Peter Wu.
Change-Id: I6058c28a74a154e2882e4eb04558bedcede6f508
Reviewed-on: https://code.wireshark.org/review/7039
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
Found by MSVC2013 Code Analysis
Change-Id: I58063946dd558e98308c87b36eeac0ddbe1a6e79
Reviewed-on: https://code.wireshark.org/review/7045
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Now address types are setup just like field types and must be registered with a structure that provides its string representation (and more things in the future). Address types that are limited to a single dissector are registered by the dissector. More "common" ones are globally registered. There are still a few that really belong in a dissector, but have other dependencies currently not accounted for in the address type support.
Many of the "address to string" conversions that involved g_sprintf have be changed to use more "performance friendly" methods (some at the cost of needing to_str-int.h)
Leaving all comments regarding this "solution" in address_to_str.c in until all have been implemented
Change-Id: I494f413e016b22859c44675def11135f228796e0
Reviewed-on: https://code.wireshark.org/review/7019
Reviewed-by: Michael Mann <mmann78@netscape.net>
Version to add as generated field, without tvb offset, length.
Change-Id: If4c7aebcbf1b47faa483bcbd40995eff3ccb99f0
Reviewed-on: https://code.wireshark.org/review/6906
Tested-by: Michal Labedzki <michal.labedzki@tieto.com>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
This is mostly for GUI usage, but a few dissectors needed some "non-packet scope" conversions.
val_to_str officially now uses wmem_packet_scope()
Change-Id: Ic9413eeb3406d7a7683222b86709f3675d628d81
Reviewed-on: https://code.wireshark.org/review/6933
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
There are a few oid functions that are only called in oids_test.c. I'll presume the APIs are used in proprietary dissectors rather than just remove them.
Change-Id: I4595e00f93bf9ab8cf2493fe0432b91960f55a3f
Reviewed-on: https://code.wireshark.org/review/6592
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Michael Mann <mmann78@netscape.net>
They (should) all be strictly within the context of dissection, so can just
become packet_scope.
Change-Id: Iaaa733628132f3ee3f1597f3df956e44080734f6
Reviewed-on: https://code.wireshark.org/review/6631
Petri-Dish: Evan Huus <eapache@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Evan Huus <eapache@gmail.com>
Change-Id: I0338d0acda5e4b9957aad4825ca2cfd6fa506ead
Reviewed-on: https://code.wireshark.org/review/6596
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: I7a40c0996517aa71b4ddb764ce3a6e92a55260ad
Reviewed-on: https://code.wireshark.org/review/6589
Reviewed-by: Michael Mann <mmann78@netscape.net>
Most of the remaining ep_ uses are grouped with specific functionality.
Change-Id: I8fa64a17acc6bcdcf6891b2d28715ac0c58f1a4a
Reviewed-on: https://code.wireshark.org/review/6484
Reviewed-by: Michael Mann <mmann78@netscape.net>
There's no requirement for "display" field values to have names
beginning with BASE_; use SEP_, to indicate that they're separators.
(And, yes, we should introduce SEP_NONE, with a value of 0, and use it.)
While we're at it, fix BASE_SEMICOLON - the separator is a colon, not a
semicolon - and document SEP_SPACE in doc/README.dissector.
Change-Id: I856aafda2c60b8320dffe287f0deb06a9604a2bf
Reviewed-on: https://code.wireshark.org/review/6486
Reviewed-by: Guy Harris <guy@alum.mit.edu>
It's just like BASE_DOT, BASE_DASH and BASE_SEMICOLON, only its a space between bytes. Since this seems pretty specific to FT_BYTES, perhaps there is a better was to represent the functionality (like FT_BOOLEAN uses numeric values for number of bits)?
Change-Id: I1a8f1ab263ece2736a8012b66fdd6a9105db7282
Reviewed-on: https://code.wireshark.org/review/6451
Reviewed-by: Michael Mann <mmann78@netscape.net>
I think this can make fields more readable (for a small amount of bytes).
Converted DeviceNet dissector to use proto_tree_add_item for some FT_BYTES field as tvb_bytes_to_str_punct was used to create this effect "manually".
Change-Id: I59e2acf9b00a4eb1279e6c2b2b7bd8ecef20db9b
Reviewed-on: https://code.wireshark.org/review/6304
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: I57d2e435ac72ea07ec9a567e0b1ce4410966e3d2
Reviewed-on: https://code.wireshark.org/review/6419
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
There isn't a legitimate use for the API, all cases can be covered with proto_tree_add_item. As a bonus, a few more tvb_get_ptr calls can be removed.
Change-Id: I3bb86ba8f05ef3363407bcfe9b059ee27ebc135d
Reviewed-on: https://code.wireshark.org/review/6429
Reviewed-by: Michael Mann <mmann78@netscape.net>
Stig Bjørlykke