Make the argument to the events a non-memory object
Change-Id: I46d8c24415aa2bc48b2a2d3b1fccffa6956d08b5
Reviewed-on: https://code.wireshark.org/review/26671
Reviewed-by: Roland Knall <rknall@gmail.com>
Rename packet_list_enable_color() to packet_list_recolor_packets()
to reflect what it does.
Remove the call from where it's not needed.
Change-Id: I55dd1a9af8f5b1dbd83b06136a5bbcfddea06cdb
Reviewed-on: https://code.wireshark.org/review/26959
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This stops the main source from being buildable by Qt 4.x
Change-Id: I61edbae04ac2b3bf0ae8ee8e09d335083945c176
Reviewed-on: https://code.wireshark.org/review/26756
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
This patch adds support for sequencing HTTP Redirects. This enables
tracking of HTTP-based redirects, which may not have a Referer header.
As such, this patch also renames 'HTTP Referer statistics' to
'HTTP Request Sequences' to better reflect the more generic
functionality.
Note that this does not fully support RFC 3986. An external library like
uriparser.github.io may be a better option for efficient, full relative
HTTP URL resolution.
A Sample PCAP to test functionality is available here:
https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=http_redirects.pcapng
A sample PCAP to demonstrate usefulness is available here:
https://www.malware-traffic-analysis.net/2015/08/31/page2.html
(examine request to hxxp://lk2gaflsgh.jgy658snfyfnvh.com/service.php)
Change-Id: I9edd1a1de86228b0dcb1df9f6f30e24379684321
Reviewed-on: https://code.wireshark.org/review/26679
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
If no stream is given to FollowStreamDialog::follow(), then it
overwrites the display filter with a conversation filter for the first
packet in the capture file.
Pass an explicit stream number and the "Follow stream" button will set a
correct display filter.
Test: open pcap with three TCP streams. Statistics -> Conversations.
Select last TCP conversation (expect "tcp.stream eq 2"). Select the
second conversation (expect "tcp.stream eq 1") and activate "Filter Out"
button (expect "!(tcp.stream eq 1)" and not "!(tcp.stream eq 2) and
!(tcp.stream eq 1)").
Bug: 14254
Change-Id: I28744d7f76f5034b07ea5660b45399566e3a7d2c
Reviewed-on: https://code.wireshark.org/review/26520
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Otherwise dialogs could be opened multiple times
Change-Id: I19f9c11395b5f5ba41c00ff78ab9794064562d29
Reviewed-on: https://code.wireshark.org/review/26221
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
Use QFrames instead of QActions as separators in the filter expression
toolbar. This keeps them from showing up in the overflow menu.
Change-Id: I60f6f0434fe5ba88fe1b4221e9e70640eed840bb
Reviewed-on: https://code.wireshark.org/review/25860
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Try hiding and showing the filter expression toolbar in order to update
its layout. This is a bit ham-fisted but seems to be the only way to get
it to work properly after clearing and inserting buttons.
Bug: 14121
Change-Id: Iea851c029c1586abfdb01c639914f6fe97ea29b3
Reviewed-on: https://code.wireshark.org/review/25840
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
I've noticed at SharkFest and other places that people sometimes put
square brackets around their filter expression names so that it's easier
to distinguish one button from another.
Add separators between buttons so that this shouldn't be necessary.
Change-Id: I3b1ca42f6417d2045781fc14d594faba4fd00fd5
Reviewed-on: https://code.wireshark.org/review/25820
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Take a hint from the QToolButton sources and update the filter
expression toolbar using updateGeometry instead of adjustSize. This
appears to do the layout updates and other changes required to draw the
dropdown in the correct place.
Bug: 14121
Change-Id: I45d5a1173703f9c16d89841a57f651935da43d92
Reviewed-on: https://code.wireshark.org/review/25784
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The first is deprecated, as per https://spdx.org/licenses/.
Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed
Reviewed-on: https://code.wireshark.org/review/25661
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Petri-Dish: Dario Lombardo <lomato@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The main benefit of this feature is that it enables users to see the
succession of HTTP requests that led to a specific request.
A sample PCAP is available here:
https://bugs.wireshark.org/bugzilla/attachment.cgi?id=16085
Change-Id: I7c521315b848fbce659fdc01e43f261d804a3a48
Reviewed-on: https://code.wireshark.org/review/25319
Reviewed-by: Moshe Kaplan <me@moshekaplan.com>
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Convert Advanced view and Modules view to use a single base model,
loading the preferences once and then filter and display what they
need with QSortFilterProxyModel derived classes.
Convert the PreferencePane "types" to just strings. This allows
a more straightforward relationship between the "special" modules
that need custom widgets for preference manipulation and it also
removes dependency on preferences_dialog.h for many files.
Change-Id: I091deb3061564aa4d1564e9ca1c792715961b083
Reviewed-on: https://code.wireshark.org/review/25134
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
Fix an error introduced in signal/slot redesign in gd5d81518.
This error disabled all capture file menu items after doing a rescan,
like when adding a display filter.
Change-Id: Ib468051c15b9f1a15faa2ed07b958340b82a662b
Reviewed-on: https://code.wireshark.org/review/25116
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Reviewed-by: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
Remove the final copy actions from MainWindow and use DataPrinter instead.
This way, MainWindow no longer is involved in copying data, and the actions
purely are defined by DataPrinter
Change-Id: Ib70ad6394dee501bb2c8d58c9d174a0eb04b47de
Reviewed-on: https://code.wireshark.org/review/25031
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
Change-Id: I4be2c83755be95ab0deec15f066dd3e89b96a240
Reviewed-on: https://code.wireshark.org/review/25005
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
This is in preparation to make it easier for other classes
to get the right signals from the capture file. Also the decision
on what signals to listen to now resides with the final classes,
not main window, and it no longer needs to be changed if the
statusbar or wsapp needs additional signals.
Change-Id: If366d42b07dc822636404ac44ba2306ec4418b4e
Reviewed-on: https://code.wireshark.org/review/24941
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
This item is missing from the Qt port.
Change-Id: Iacc18a7c2eb2368d6566622788a4e900868d446e
Reviewed-on: https://code.wireshark.org/review/24879
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add a ProtoTreeModel and use it in ProtoTree. This should make the UI
more responsive when we have lots of items in the tree.
Change-Id: Id26e6bcff84663867a8da17fd9ae86ff639b633f
Reviewed-on: https://code.wireshark.org/review/24774
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Qt 5.4 introduced qUtf8Printable, a convenience macro for converting
QString to a UTF-8 const char *. Add a compatibility definition and
start using it.
Change-Id: I3cf88611b1ed1a34082cb2ba82394954e2e6c461
Reviewed-on: https://code.wireshark.org/review/24828
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
With the model (and proxy), the following features were added/fixed.
1. Expert severities can be filtered by type
2. Search filter expanded to include summary, protocol and column info
3. Expert info starts with all items collapsed.
4. Context menus for collapse/expand all
Bug: 11753
Bug: 13831
Bug: 13842
Change-Id: I8e89c7be441e1f08e18915ef8805609e5c5d0bd1
Reviewed-on: https://code.wireshark.org/review/22458
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
libwireshark now expects an epan_t to be created with a pointer to a
"packet provider" structure; that structure is opaque within
libwireshark, and a pointer to it is passed to the callbacks that
provide interface names, interface, descriptions, user comments, and
packet time stamps, and that set user comments. The code that calls
epan_new() is expected to provide those callbacks, and to define the
structure, which can be used by the providers. If none of the callbacks
need that extra information, the "packet provider" structure can be
null.
Have a "file" packet provider for all the programs that provide packets
from a file.
Change-Id: I4b5709a3dd7b098ebd7d2a7d95bcdd7b5903c1a0
Reviewed-on: https://code.wireshark.org/review/24731
Reviewed-by: Guy Harris <guy@alum.mit.edu>
The split isn't necessary now that epan no longer uses the capture_file
structure.
Change-Id: Ia232712a2fb5db511865805518e8d03509b2167f
Reviewed-on: https://code.wireshark.org/review/24693
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Embed one of those structures in a capture_file, and have a struct
epan_session point to that structure rather than to a capture_file.
Pass that structure to the routines that fetch data that libwireshark
uses when dissecting.
That separates the stuff that libwireshark expects from the stuff that
it doesn't look at.
Change-Id: Ia3cd28efb9622476437a2ce32204597fae720877
Reviewed-on: https://code.wireshark.org/review/24692
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Have cfile-int.h declare the structure, and use it in files that
directly access the structure.
Have cfile.h just incompletely declare the structure and include it
rather than explicitly declaring it in source files or other header
files.
Never directly refer to struct _capture_file except when typedeffing
capture_file.
Add #includes as necessary, now that cfile.h doesn't drag in a ton of
Change-Id: I7931c8039d75ff7c980b0f2a6e221f20e602a556
Reviewed-on: https://code.wireshark.org/review/24686
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Bug: 14186
Change-Id: I8793078ea50379b2f9697787e6b7a8ab2d9e3e0e
Reviewed-on: https://code.wireshark.org/review/24558
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
Cleanup adding a filter and implement some
sanity checks in the drop code
Change-Id: I1778be16abdea3f93ed11fc610962c4a23f10a2f
Reviewed-on: https://code.wireshark.org/review/24505
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
If two elements existed with the same filter expression, the first
element got selected allways. This is much more secure, as it only
takes the label into account. If the user by accident created two
buttons with the same filter expression, but different label and
wants to remove the second button, the first one no longer will be
removed instead of the second one.
Change-Id: I16130aa69cb853aedb9a5c9b0bbbb3eb64b467d1
Reviewed-on: https://code.wireshark.org/review/24399
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
Bug: 14185
Change-Id: I9f52999339d3c34502d4e046e22f05a83fa773bb
Reviewed-on: https://code.wireshark.org/review/24330
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
Select the title text and give focus to the title when Edit Column.
Bug: 14191
Change-Id: I04fc5f6bcc830a15ef43fa2d06a1a729df52e370
Reviewed-on: https://code.wireshark.org/review/24305
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
This further separates ByteView and the rest of the system.
Using FieldInformation and DataPrinter, this is the final cleanup
of the ByteViewTab
Change-Id: If41521167527cf5664c2564cdd0d45fea0f3f612
Reviewed-on: https://code.wireshark.org/review/22783
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
Drag and Drop a field from the packet tree to the displayfilteredit
or the toolbar and drop it there to either apply the filter (or prepare
it by holding down the Shift key) or create a new toolbar button
Change-Id: I42645a02223c71315e91e0d58eb1b54ebab4fd58
Reviewed-on: https://code.wireshark.org/review/24280
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Roland Knall <rknall@gmail.com>
A plugin can register an initialisation function to be called each time
Wireshark opens a new capture file. If plugin_if_get_ws_info(...) is
called from within the initialisation function it does not return the
name of the file being opened. This is because
plugin_if_get_ws_info(...), through calls to a number of other
functions, gets the file name details from a capture_file structure. At
the time of the call to the plugins initialisation function, the
capture_file structure in question has not yet been created.
This change ensures that if plugin_if_get_ws_info(...) is called from a
plugin's initialisation function, the name of the file to be open is
correctly returned. The change also fixes a bug where
plugin_if_ws_get(...) returns an incorrect file state if called from a
plugin initialisation function.
Bug: 14165
Change-Id: I28c85e480db96852e11bbaa14fb1f434b457ed52
Reviewed-on: https://code.wireshark.org/review/24251
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Remove all dependancy for the byte_view_text from the epan system,
and therefore cleanly separate data and display for further separation
of dissection and view
Change-Id: Id1ee91b93da4511afa95f24da4cbbf39cbb89b1f
Reviewed-on: https://code.wireshark.org/review/24050
Petri-Dish: Roland Knall <rknall@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Roland Knall <rknall@gmail.com>
Add a button to apply currently selected color as the display filter.
Bug: 14100
Change-Id: Ife3edeb577075f1fe30b649a5655ef5887684d8a
Reviewed-on: https://code.wireshark.org/review/24012
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
In preparation for possibly using AUTOUIC in CMake which treats "ui_*.h"
files specially, rename ui_util.h. No other changes.
Change-Id: Id026572c000b713ff0e9388dc7fff8d81d4df73e
Reviewed-on: https://code.wireshark.org/review/23916
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Some dialogs are allocated on heap but not freed when the dialog
boxes are closed. This means one dialog instance is leaked each
time opened/closed. Also dialogs being subclasses of
GeometryStateDialog means they might lack a parent reference and
are not automatically freed on application shutdown either.
Fix these leaks by letting the dialogs automatically destroy
themselves on close (via WA_DeleteOnClose).
Capture filter, display filter and capture interfaces dialogs are
also leaked on application shutdown. These dialogs are protected by
a NULL check that at least prevent multiple instances. Though
none of them are freed on application shutdown. Fix leaks by
freeing when main window is destroyed.
Bug: 14071
Change-Id: I8c5c5a75ad3c89abb5996941875ba5d616a22d9c
Reviewed-on: https://code.wireshark.org/review/23747
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Reduce all of the code duplication and just register the sequence
analysis functionality in LBM dissector.
Change-Id: I6cb5a7f0a92b04357334bbae301fa2d730a21994
Reviewed-on: https://code.wireshark.org/review/23630
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
The refactored DecodeAsDialog class has no setCaptureFile slot any more.
It seems it's always in the foreground and there's no way to change the
capture file while the DecodeAsDialog is active.
The dangling connection caused a warning
QObject::connect: No such slot
DecodeAsDialog::setCaptureFile(capture_file*)
in ../ui/qt/main_window_slots.cpp:2881
QObject::connect: (sender name: 'MainWindow')
QObject::connect: (receiver name: 'DecodeAsDialog')
Change-Id: Ibb12b9cdded3c6b7cca40ce08874bc4f1af4eec7
Reviewed-on: https://code.wireshark.org/review/23623
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
capture_file structure is not populated with "fixed" captures. Qt menu
presumes it has a populated capture_file structure. Just have menu
items be disabled until capture file is reloaded for display.
Bug: 13024
Change-Id: I9dfb5355c5d421f5344f97e1e9d5b4dd08b11c6e
Reviewed-on: https://code.wireshark.org/review/23095
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
SequenceDialog no longer emits goToPacket as of g7fe45cc0ec. Don't try
to connect it in MainWindow.
Change-Id: I0f3e47a3cf7c1e29a64da7462c85179e29828c49
Reviewed-on: https://code.wireshark.org/review/23501
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Change access of ifaces elements from by val to by reference.
With this change unnecessary copying of the whole struct is avoided
but even more important is that elements no longer have to be
removed and inserted whenever data is updated.
This change aims to make it more clear that ifaces elements shall
never directly be removed from the array. Instead use function
capture_opts_del_iface
NOTE: Code for GTK UI not updated
Ping-Bug: 13864
Change-Id: I04b65d5ee36526b30d959b8e5a2a48a3c7c4f15b
Reviewed-on: https://code.wireshark.org/review/23204
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Add support for extcap control pipes on Windows.
Improved read loop in InterfaceToolbarReader.
Delay opening control pipes until extcap has opened the fifo pipe.
Make extcap_example.py work on Windows.
Bug: 13833
Change-Id: I4b47d25452637759b8a3be53be48eee5365bc0e4
Reviewed-on: https://code.wireshark.org/review/23211
Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Roland Knall