This prevents tshark from crashing when run with "-T fields -e data".
I5778b08c52119b5be1ec482be9417b3c4ba8ed62 mistakenly removed this line (this
'data' is a write_field_data_t rather than the print_data structure that
change was cleaning up).
Bug: 12616
Change-Id: I773e47f12f852e19a20ec29a43eb3a0953923173
Reviewed-on: https://code.wireshark.org/review/16415
Petri-Dish: Jeff Morriss <jeff.morriss.ws@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Description:
when -T json,ed or pdml used in conjunction with -e fields they would
always miss the last field.
in case of json and ek, if some fields in the middle are empty,
the generated json would be invalid.
sample for ek:
{ "_index": "packets-2016-06-30", "_type": "pcap_file",
"_score": null, "_source":
{ "layers": { "e212.mcc": ["255","262"] "frame.time_epoch":
["1426550400.004751510"], "e212.mnc": ["1","1"] } } }
command:
tshark -T ek -r C:\a.pcap -e e212.mcc -e frame.comment
-e frame.time_epoch -e e212.mnc > C:\test.json
note:
the comma is missing between e212.mcc and frame.time_epoch
Change-Id: I2efae0c48036cf6313e2a064453c8dbc49f38b09
Reviewed-on: https://code.wireshark.org/review/16226
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Martin Kacer <kacer.martin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
That makes failing to specify a format a compile-time error.
Change-Id: Iff0bda8be35b1e3acc97e4314657ceaff2b3d0be
Reviewed-on: https://code.wireshark.org/review/16218
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Rename write_fields_proto_tree() to write_specified_fields(), and make
it static. Make write_fields_proto_tree() a wrapper around
write_specified_fields() that sets the format to FORMAT_CSV. Have
write_specified_fields() fail with an assertion if fields->format isn't
one of the known formats, to catch problems such as this in the future.
Don't fill in the "data" structure if we're not going to use it.
Change-Id: I11dbf448d72ca389f0e5fb8558a41b7eecf7c9a4
Reviewed-on: https://code.wireshark.org/review/16210
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Some pcaps caused invalid json and ek files.
Bug: 11754
Change-Id: Id4c4d744b4d07fe4e8b6423688be1bb10a803844
Reviewed-on: https://code.wireshark.org/review/16152
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Change-Id: Ie7c55fb432b29abe689eed1968cfa30bd8e88e33
Reviewed-on: https://code.wireshark.org/review/16124
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Fixed json and ek escape function
Fixed -j protocol filter to do exact match
Fixed -T json to correctly close json
Added -j protocol filter also to pdml output
Bug: 11754
Change-Id: I02f274e4a5a02346922b37bbe946c10340c242ea
Reviewed-on: https://code.wireshark.org/review/16034
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Previous patches converted all fvalue_to_string_repr calls to expect
an allocated buffer (and not a passed in one). Now changing signature
to force an allocated buffer. Added wmem in case that can be taken
advantage of within epan (and since the function signature was changing
anyway).
Change-Id: Ica1ac4a9a182ce0e73303856329e198d9d525b7b
Reviewed-on: https://code.wireshark.org/review/15343
Reviewed-by: Michael Mann <mmann78@netscape.net>
This allows keeping the code-sharing with the static linking.
This "fixes" a hypothetical ABI mismatch with wsutil and avoids pulling more
external dependencies to wsutil than strictly necessary.
A nice side-effect is that libwsutil no longer depends on version.h.
Follow up to f95976eefc.
Change-Id: I8f0d6a557ab3f7ce6f0e2c269124c89f29d6ad23
Reviewed-on: https://code.wireshark.org/review/15002
Petri-Dish: João Valverde <j@v6e.pt>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: João Valverde <j@v6e.pt>
MSVC compiler does not support properly setting an enum being part of a bit field.
For example the following code:
pinfo->fd->flags.encoding = PACKET_CHAR_ENC_CHAR_EBCDIC;
changes pinfo->fd->flags.encoding from 0x0 to 0xfffffffe instead of 0x1
Let's put back an unsigned int definition (like it is in master-1.12 branch) and add explicit casts where required
Bug: 11787
Change-Id: Idae0140fb6c172f1b3dbf10baefc8cfb00128f4c
Reviewed-on: https://code.wireshark.org/review/12220
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Change-Id: Ib982662db6cf68730a7d121eac60d9bc5ae67429
Reviewed-on: https://code.wireshark.org/review/9195
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
I'm not 100% sure if this is really a good idea in all cases, but at least some
people want it.
Bug: 10906
Change-Id: I26e69a683781cdc6ba1cfcd6a41458bbca7ca2c0
Reviewed-on: https://code.wireshark.org/review/9108
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
Trust that the files in epan/ immediately (not dissectors) know what they're
doing so just blindly convert them to captured length.
Change-Id: I872f7d58b2e15ae82c75fd56f4873996fbc97be7
Reviewed-on: https://code.wireshark.org/review/9083
Reviewed-by: Evan Huus <eapache@gmail.com>
Change-Id: Ib3614431c3ff8f6e53fa0993e296ffea70926d03
Reviewed-on: https://code.wireshark.org/review/7911
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
the option parameter of output_fields_set_option() is always a
0-terminated string
therefore, option_value can't possibly be NULL, remove the NULL checks
if someone runs 'tshark ... -E header=', option_value is an empty
string, bail out in this case, don't parse *option_value and
*(option_value++) in the switch statements
Change-Id: I734b04aff653e8dbe990f546220595546e7503b0
Reviewed-on: https://code.wireshark.org/review/7904
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I45a4cbef7cb38a851c207fbe26ff412ffc502240
Reviewed-on: https://code.wireshark.org/review/7903
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Change-Id: I4ec48067e9ca2cbe88e1cf2e6c9dc1e382379221
Reviewed-on: https://code.wireshark.org/review/7767
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Change-Id: I57354c309ecf3a0c8f0c7cff485638027f30bb19
Reviewed-on: https://code.wireshark.org/review/5813
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Both clang and gcc define __GNUC__. Make sure we account for that when
defining diagnostic macros.
Use DIAG_OFF + DIAG_ON to suppress gcc -pedantic warnings about
frame_data.
Get rid of packet_char_enc casts.
Change-Id: Idbcc61bcdb35c1d20f185461c69451dcdf73bae9
Reviewed-on: https://code.wireshark.org/review/7106
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Found by MSVC2013 Code Analysis
Change-Id: I58063946dd558e98308c87b36eeac0ddbe1a6e79
Reviewed-on: https://code.wireshark.org/review/7045
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Change-Id: I973c672e9d573ad67e9b9fd82a5610aaf8a74efa
Reviewed-on: https://code.wireshark.org/review/6605
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
These "bases" will put a ".", "-", or ":" respectively between hexidecimal bytes in the field in packet view and display filter. FT_BYTES with BASE_NONE will have no separator in the packet view, but continue to have the ':' as a separator in the display filter.
Converted the "string" hf_ entries that used tvb_fc_to_str as a string to use proto_tree_add_item with FT_BYTES/BASE_DOT type.
Converted applicable tvb_bytes_to_ep_str_punct() calls to use the new BASE values.
Change-Id: I2442185bb314d04a3ff2ba57883652ecd738b5f9
Reviewed-on: https://code.wireshark.org/review/6098
Reviewed-by: Michael Mann <mmann78@netscape.net>
Give all routines in epan/print.c that write a particular format a name
beginning with write_{formatname}.
If routines write columns, rather than the raw protocol tree, don't give
it a name containing proto_tree.
Get rid of empty preamble/finale routines.
For CSV, the preamble routine writes out column titles, so call it
write_csv_column_titles().
For C arrays, the body routine writes out raw hex data, so call it
write_carrays_hex_data().
capture_file isn't a structure defined by libwireshark, so don't make it
an argument passed into libwireshark.
Change-Id: I5a7e04de9382cf51a59d9d9802f815b8b3558332
Reviewed-on: https://code.wireshark.org/review/5536
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Pass the "output only these protocols" hash table as an argument,
instead.
Change-Id: Id8540943037e7b9bbfe377120c3f60dbe54fe0f1
Reviewed-on: https://code.wireshark.org/review/5440
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Have write_psml_preamble() and write_csv_preamble() take a capture_file *
as an argument, so they can print the column titles themselves, rather
than having to defer it to the routine that prints packet data.
Change-Id: Ifd1b7a13062be8ad46846315976922a752778153
Reviewed-on: https://code.wireshark.org/review/5438
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Put the low-level print stream code from epan/print.c into
epan/print_stream.c, leaving the higher-level stuff in print.c
Change-Id: Iae961f168ec655a29f434257b1af0937fca9f025
Reviewed-on: https://code.wireshark.org/review/5436
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Revert gafa8c02 since it didn't work on Windows. Use a pragma to squelch
Visual C++ instead.
Qt's rich text renderer doesn't handle "'". Replace it with "'".
Remove a QDebug include.
Change-Id: I0e6308efda74a4bc0e67ce841a50a0a9b68f4a8b
Reviewed-on: https://code.wireshark.org/review/4511
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Otherwise glib throws an assertion since the array we pass it is NULL.
Change-Id: I9159c1f5ad99b280c040cd790df3cf352738601f
Reviewed-on: https://code.wireshark.org/review/2680
Reviewed-by: Evan Huus <eapache@gmail.com>
Add a routine get_ws_vcs_version_info() that, for builds from a tree
checked out from Wireshark's version control system, returns a string
that includes both the Wireshark version number and an indication of
what particular VCS version was checked out, and just returns
Wireshark's version number for other builds.
Use that routine rather than manually gluing VERSION and the Git version
number together.
("vcs", not "git", just in case we do something bizarre or mercurial
some day. :-))
Change-Id: Ie5c6dc83b9d3f56655eaef30fec3ec9916b6320d
Reviewed-on: https://code.wireshark.org/review/2529
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Jeff Morriss