numeric values using strtoul and casting it the result to a guint32.
Hopefully no user or session IDs are negative or greater than 32 bits.
svn path=/trunk/; revision=54100
suspect, the change to handle VWR files with no packets); shuffle it
after all the types we've seen misidentified as VWR files.
svn path=/trunk/; revision=54012
knowledge of particular types of plugins. Instead, let particular types
of plugins register with the common plugin code, giving a name and a
routine to recognize that type of plugin.
In particular applications, only process the relevant plugin types.
Add a Makefile.common to the codecs directory.
svn path=/trunk/; revision=53710
From İbrahim Can Yüce
From me: Update to new tcp_dissect_pdus format, minor whitespace issues noticed in wiretap files.
svn path=/trunk/; revision=53669
XXX, people are not aware that expression of this macros might be evaluated multiple times, like:
- BSWAP16(tvb_get_letohs(tvb, off)) : \
+ GUINT16_SWAP_LE_BE(tvb_get_letohs(tvb, off)) : \
Should be tvb_get_ntohs() called?
svn path=/trunk/; revision=53653
handle that file not ending with a 2-byte 0xffff end-of-file record.
This fixes bug 9455, although it doesn't add support for reading an
"index" file for a capture that's in multiple .rf5 files, which is a
separate issue noted in that bug.
It also doesn't attempt to figure out what the data in the new record
type following the data that appears to be the same as that in the other
data record format but preceding the actual packet data is.
svn path=/trunk/; revision=53452
in a source description record, including the stack. Dump some other
fields in those records as well.
Attach separate sequential and random read buffers to the private data
structure, rather than allocating them in various routines (and not
always freeing them) and, in at least one case, allocating a single
*common* buffer for all wth's to use.
Fix some comments (the DS0 mask is 32 bytes long, but gets turned into a
bitmask).
Put in a description of what a "stack file"'s contents look like. Much
of it may be useless to us (for example, we have the notion that TCP has
protocol number 6 built-in...), but the RELATION entries that map from
"BASE" to a protocol could obviate the need to have the user specify a
map from stack file names to starting protocols, and we might be able to
use, for example, entries that map TCP/UDP/SCTP port numbers to
protocols to obviate the need for the user to explicitly use Decode As
or otherwise configure port-to-protocol mappings themselves.
Add a bunch of record length checks before we fetch data from records.
svn path=/trunk/; revision=53450
Dump the raw contents of records as hex and ASCII, not just hex.
Sort the record types, and add a new one for a type we've seen in a k18
file and about which we know nothing.
For unknown record types, print the type in hex.
svn path=/trunk/; revision=53441
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2
are separate "file types", even though they both come from Network
Monitor.
Rename various functions, #defines, and variables appropriately.
svn path=/trunk/; revision=53166
.cap, for example, doesn't refer to a particular file type - a whole
bunch of file types use .cap.
Also offer, in addition to "All Files", "All Capture Files", which
matches all the extensions we know about.
svn path=/trunk/; revision=53156
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8818
Add support for dissection ELF files. It opens as a "capture" file via wiretap
at the moment for simplicity's sake, but the intention is eventually to have
this (and other file types we dissect) open through some other program sharing
much of the libwireshark infrastructure.
svn path=/trunk/; revision=52775
Compilation fails on (only the ?) OSX-10.6-x64 buildbot with error:
netscaler.c: In function 'nstrace_read_v30':
netscaler.c:1295: warning: implicit conversion shortens 64-bit value into a 32-bit value
(Life is too short for me to dig multiple levels deep into a set of macros to try to see which
actual line of code is causing the problem. Maybe the patch submitter can identify the problem).
svn path=/trunk/; revision=52666
We read a two-byte length field and add a constant number of header
bytes to this length, so we could in theory be larger than guint16.
svn path=/trunk/; revision=52619
range check for array index
don't assign the result of pntohs() to a gint16
range check for the values stored in phdr.(cap)len
svn path=/trunk/; revision=52618
don't assign the output of pntoh24() to a gint16
unfortunately, vwr detection does not work reliably and many pdf files
are recognized as vwr - this commit should prevent wireshark from
crashing when it tries to load the USB 2.0 spec as pdf ;-)
svn path=/trunk/; revision=52599
whether the (zero-based) interface ID is < the number of interface IDs,
so we don't need to do so in pcapng_read().
Unions are tricky - if the compiler doesn't ensure that the right
component of the union is being used at any given time, various problems
can happen.
Remove some members from the "data" union in the wtapng_block_t
structure, and use a local variable of the specified type.
svn path=/trunk/; revision=52262
the number of bytes available for packet data in the block;
the packet length;
*and* the snapshot length for the interface.
One more fix for bug 9200, so it should *now* be fixed.
svn path=/trunk/; revision=52250
subtract out the minimum SPB size, which includes the length of
*everything* except for the packet data.
Fixes one problem found by the file in bug 9200.
svn path=/trunk/; revision=52244
minus the lengths of the two length fields and the packet length field,
it's the minimum of that and the packet length, as there might be
padding.
Fixes one problem found by the file in bug 9200.
While we're at it, pcapng_read_packet_block() and
pcapng_read_simple_packet_block() return an integer, not a Boolean;
return 0, not FALSE (they have the same value, but returning 0 makes it
clearer that the return value isn't restricted to TRUE or FALSE).
svn path=/trunk/; revision=52241
include only extensions used mostly by capture files (i.e., not ".txt"
or ".xml"), and list each extension set only once (it's silly to have,
for example, separate entries for NetMon, Shomiti Surveyor, and
NetScaler with ".cap" when you get all those types no matter which entry
you choose).
svn path=/trunk/; revision=51547
the "All Files" entry (the current UI guidelines from Microsoft say to
do so, and that's what Paint does, at least), and add an "All Capture
Files" entry with all the file extensions for the file types we support
(it'll pick up all text files, but there's not much we can do about
that, and it won't pick up files with *no* extension or weird
extensions, such as you might get from UN*X systems or from WinDump
commands, but at least it'll filter out some other crud).
Fix what appear to be memory leaks; that should be backported unless
I've missed something and they aren't leaks.
Fix an out-of-date comment, and add an additional comment.
svn path=/trunk/; revision=51481
------------------------------------------------------------------------
r51462 | guy | 2013-08-21 20:21:47 -0700 (Wed, 21 Aug 2013) | 8 lines
What was I thinking? ".caz" is used for compressed *Windows* Sniffer
files (which are just gzipped uncompressed Windows Sniffer files, albeit
with the checksum computed differently in some fashion, or perhaps just
being computed incorrectly), not compressed *DOS* Sniffer files (which
use their own form of compression, which doesn't compress the entire
file, just most of it, and which use the same extensions as uncompressed
DOS Sniffer files).
svn path=/trunk/; revision=51465
files (which are just gzipped uncompressed Windows Sniffer files, albeit
with the checksum computed differently in some fashion, or perhaps just
being computed incorrectly), not compressed *DOS* Sniffer files (which
use their own form of compression, which doesn't compress the entire
file, just most of it, and which use the same extensions as uncompressed
DOS Sniffer files).
svn path=/trunk/; revision=51462
With gcc :
pcapng.c: In function 'pcapng_read_packet_block':
pcapng.c:1147:9: error: request for member 'pseudo_header' in something not a structure or union
With clang :
pcapng.c:1150:86: error: member reference type 'struct wtap_pkthdr *' is a pointer; maybe you meant to use '->'?
pcap_get_phdr_size(int_data.wtap_encap, &wblock->packet_header.pseudo_header));
~~~~~~~~~~~~~~~~~~~~~^
->
(Error message from clang is better...)
svn path=/trunk/; revision=51317
and assign float constants, not double constants, to float variables.
Floating-point constants are double by default; you have to add "f" to
the end to make them float.
This squelches 64-bit-to-32-bit warnings.
svn path=/trunk/; revision=51289
This was the 4th patch, but also:
- use gmalloc0() to allocate vwr struct. Otherwise, valgrind says that
many of fields were still uninitialised when parse_s1_W_stats later
read them
- whitespace tidyup, got rid of remaining tabs and trailing whitespace
Did a fair bit of fuzz-testing without seeing any problems.
svn path=/trunk/; revision=51248
------------------------------------------------------------------------
r51049 | guy | 2013-07-30 22:00:28 -0700 (Tue, 30 Jul 2013) | 5 lines
If no target OS version was specified, default to the major version on
which we're running, so we *always* build against an SDK. (The "10" in
"10.x.y" is not *really* part of the version number, so the "major
version" includes the "10" and the major version number following it.)
svn path=/trunk/; revision=51050
mktime(). That eliminates the need for casts.
It should *also* be part of a per-wtap-structure private data structure,
not a global variable; make it so.
svn path=/trunk/; revision=51000
argument to the -F flag for pcap format is "libpcap", not "pcap", we
have a problem. Make it "pcap", and add a backwards-compatibility hack
to support using "libpcap" as well.
Update the man pages to refer to it as pcap as well, and fix the
capitalization of "WinPcap" (see http://www.winpcap.org) while we're at
it.
Also, refer to http://www.tcpdump.org/linktypes.html for the list of
link-layer header types for pcap and pcap-ng.
svn path=/trunk/; revision=50989
split across page boundaries, rather than being a byte stream, and that
the last page may be short.
Fix some comments.
svn path=/trunk/; revision=50025
out there (especially over USB) and we should be able to load them as long as
they are snapped to a sane length.
Also validate that packets do not specify a snapshot length larger than the one
in the file header, though only make it a warning, as this is not necessarily a
fatally corrupt packet.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8808
svn path=/trunk/; revision=49999
as the "where to put the packet data" argument.
This lets more of the libwiretap code be common between the read and
seek-read code paths, and also allows for more flexibility in the "fill
in the data" path - we can expand the buffer as needed in both cases.
svn path=/trunk/; revision=49949
artificial 16MB limit on blocks.
Do some sanity checks when reading options, to make sure we don't read
past the end of the block.
Make some variables unsigned so as not to get inappropriate
sign-extension (which, in practice, should never happen due to the 16MB
block size limit, although if the limit is raised above 2^31-1, the
limit won't protect you).
Fixes bug 8752.
svn path=/trunk/; revision=49833
visual_process_packet_header() and call it in both the read and
seek-read routines.
Pull the post-processing code that guesses the encapsulation based on
the first few bytes in the packet into
visual_fill_in_chdlc_encapsulation() and call it in both the read and
seek-routines. Add some length checks.
svn path=/trunk/; revision=49812
Check that the record length we got out of the file is at least as big as
stats block trailer; if not, declare the file bad.
svn path=/trunk/; revision=49739
seek offset is after calling it, they can use file_tell(). (Some
routines were already assuming it returned a gboolean.)
svn path=/trunk/; revision=49733
that the complaints are valid, or that simply zeroing them is the right fix
if they are, but at least it builds now. Should we be erroring if we don't
see a sliceLength header?
svn path=/trunk/; revision=49705
frame_table field to NULL before trying to allocate the frame table, so
that if we fail before we allocate the frame table, the attempt to free
the private data doesn't crash due to the frame_table field containing a
bogus pointer.
svn path=/trunk/; revision=49697
and fail with ENOMEM if that fails (and the frame table is not empty -
g_try_malloc() will return NULL if you ask it to allocate zero bytes).
Have an error message for ENOMEM on an open that attempts to tell the
user what the problem is without making their head explode.
svn path=/trunk/; revision=49673
routines are passed a separate struct wtap_pkthdr to be filled in.
Get rid of the pseudo_header member of the wblock structure - the
pseudo-header is part of the struct wtap_pkthdr.
Get rid of the union wtap_pseudo_header * argument to
pcap_process_pseudo_header() - it's passed a pointer to a struct
pcap_pkthdr, and that structure contains the union in question.
Have libpcap_read_header() take a FILE_T argument, rather than using
only the "sequential" handle of the wtap it's handed. Have the libpcap
read routine return the offset of the beginning of the pcap record, and
have the seek-read routine read the header and fill in the struct
wtap_pkthdr handed to it.
svn path=/trunk/; revision=49401
both the read and the seek-read routines. Have the read routine return
the offset of the record header as the record's offset, so that the
seek-read routine can read that header.
svn path=/trunk/; revision=49397
globals directly. If we ever manage to make them *not* globals (which
might only be possible with newer versions of Flex), then we can do
better.
Get rid of an unused variable.
Squelch a 64-bit-to-32-bit conversion warning.
svn path=/trunk/; revision=49396
doesn't need to return the number of bytes of captured packet data (it
can just stuff that into the struct wtap_pkthdr), so have it return a
Boolean success/failure indication.
svn path=/trunk/; revision=49376
have it return -1 for errors or EOF, and have iseries_read() check for a
negative return value and return FALSE. That simplifies it a bit, and
handles the "no more records in the file" case
(iseries_seek_next_packet() will hit EOF and return -1 with *err set to
0, which is what the callers of a read routine expect at EOF).
Get rid of duplicate (and incorrect before the change) comment.
svn path=/trunk/; revision=49375
ipfix_read_and_process_message_header() call it and then fill in the
wtap_pkthdr structure, and use the latter routine in the read and
seek-read routines.
Expand a comment, and fix indentation.
svn path=/trunk/; revision=49369
not a wtap *, and have it fill in the specified struct wtap_pkthdr.
That makes the seek-read routine do the right thing.
svn path=/trunk/; revision=49358
routine.
Rename daintree_sna_hex_char() to daintree_sna_process_hex_data() (to
more clearly indicate what it does - it doesn't process a single
character, it processes a whole bunch of them), and have it do some
error checking and fill in the length field in the wtap_pkthdr.
svn path=/trunk/; revision=49356
the same point at which the rest of the wtap_pkthdr is filled in (so
it's done in seek-read routines).
parse_cosine_hex_dump()'s return value is used as the return value of
read routines, so it should be Boolean. Make it so (and have it stuff
the actual length of packet data read into a wtap_pkthdr, which also
ensure that this is done in seek-read routines).
svn path=/trunk/; revision=49352
routine, for use both by the seek and read routines, and move some
common code there.
Make the delta between Symbian and UNIX time a static value.
Make the prefix for all routine names "btsnoop" rather than "snoop".
svn path=/trunk/; revision=49348
for read and seek-read.
Clarify a comment. (wtap_open_offline() only rewinds the file before
calling each open routine; once one of those routines has decided the
file belongs to it, the seek offset belongs to it, so it needs to do all
the seeking necessary - files with a file header *don't* want a rewind,
they want to leave the seek offset positioned *past* the file header so
it can read the records that follow the file header.)
svn path=/trunk/; revision=49347
used in both the seek and seek_read routines.
(And, yes, the time stamp *is* supposed to be filled in by seek_read
routines.)
Pull some now-used-only-once routines into the new routine.
svn path=/trunk/; revision=49335
of the binary dir. Fixed that.
NOTE: It fails with and without this patch for out of tree builds:
jmayer@egg:~/work/wireshark/svn/build/qt-gtk3> make dumpabi
[ 1%] Built target wsutil
[ 1%] Generating libwsutil.abi.tar.gz
ERROR: can't find modules
cp: cannot stat `abi_dumps/libwsutil/libwsutil_*': No such file or directory
make[3]: *** [wsutil/libwsutil.abi.tar.gz] Error 1
make[2]: *** [wsutil/CMakeFiles/dumpabi-libwsutil.dir/all] Error 2
make[1]: *** [CMakeFiles/dumpabi.dir/rule] Error 2
make: *** [dumpabi] Error 2
jmayer@egg:~/work/wireshark/svn/build/qt-gtk3>
svn path=/trunk/; revision=49014
is supported before trying to open for writing - the attempt to open for
writing will do the check for you. Instead, check for specific errors
if the attempt to open for writing fails, and use somewhat more specific
error messages for certain error codes. (We should perhaps check for
even more error codes in those cases.)
That gets rid of all external calls to wtap_dump_can_write_encap(), so
remove it from wtap.h and make it static.
svn path=/trunk/; revision=48691
supports writing files with a given set of encapsulations and comment
types. Use it, rather than asking for a list of file formats that
support the given set of encapsulation and comment types and checking
whether we got back such a list, or duplicating its logic.
Having file.c use it means that nobody's using
wtap_dump_can_write_encaps() any more; get rid of it. Instead, have a
private routine that checks whether a given file format supports a given
set of encapsulations *and* comment types, and use that internally.
svn path=/trunk/; revision=48690
For each capture file type, have a bitset of comment types supported by
that capture file type.
Add a Wiretap routine that, for a given file type, returns the bitset of
comment types it supports.
Have wtap_get_savable_file_types() take a bitset of comment types that
need to be supported by the file types it returns.
Replace cf_has_comments() with a routine that returns a bitset of
capture file comment types in the capture file.
Use those routines in the capture file dialogs; don't wire in the notion
that pcap-NG supports all comment types and no other file formats
support any comment types. (That's currently true, but we don't want to
wire that in as being forever true.)
svn path=/trunk/; revision=48689
leads to a double-free in wtap_close. Fix all the instances I found via
manual code review, and add a brief comment to the list of open routines in
file_access.c
Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8518
svn path=/trunk/; revision=48552
implemented wtap_dump_file_seek() and _tell()
implemented the previously declared but unimplemented wtap_dump_file_seek() and wtap_dump_file_tell() functions and used them in the seven files that had previously used a plain ftell or fseek and added error checking as appropriate. I also added a new error WTAP_ERR_CANT_SEEK_COMPRESSED and put it next to WTAP_ERR_CANT_SEEK causing renumbering of two of the existing error codes.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416
svn path=/trunk/; revision=48348
input() routine and thus don't need to have it generated - and as it
produces warnings of a routine defined but not used, we don't want to
have it generated.
Squelch a casting-const-away warning.
svn path=/trunk/; revision=47613
"ERF record" is very different from, and much simpler than, the case
where it's not; tweak the code to more clearly separate the "we're being
handed ERF records" case from the "we're being handed packets" case.
svn path=/trunk/; revision=46984
indicate what it means, and use an enum for the compression types.
Note that file_getc() returns a byte, not a character.
svn path=/trunk/; revision=46983
support pcap-NG we might have a better way of doing the third item (more
stuff is needed, but that stuff belongs there for pcap-NG, too).
When parsing hex dump lines, skip leading white space, and skip lines
that have nothing but white space, rather than guessing where the hex
dump information ends based on the line length. Parse the hex bytes
manually.
svn path=/trunk/; revision=46905
return an "EOF or error" indication - an EOF without an error will
return 0.
In iseries_seek_next_packet(), return an error code of WTAP_ERR_BAD_FILE
and an appropriate error message if we don't find a packet header within
the next ISERIES_MAX_TRACE_LEN lines, don't just return -1 and leave the
error information unchanged.
Setting an argument variable before returning has no effect, so don't do
it (so that we don't leave the mistaken impression that it *is* doing
something).
Clean up indentation.
svn path=/trunk/; revision=46819
wtap_file_read_expected_bytes() from an open routine - open routines are
supposed to return -1 on error, 0 if the file doesn't appear to be a
file of the specified type, or 1 if the file does appear to be a file of
the specified type, but those macros will cause the caller to return
FALSE on errors (so that, even if there's an I/O error, it reports "the
file isn't a file of the specified type" rather than "we got an error
trying to read the file").
When doing reads in an open routine before we've concluded that the file
is probably of the right type, return 0, rather than -1, if we get
WTAP_ERR_SHORT_READ - if we don't have enough data to check whether a
file is of a given type, we should keep trying other types, not give up.
For reads done *after* we've concluded the file is probably of the right
type, if a read doesn't return the number of bytes we asked for, but
returns an error of 0, return WTAP_ERR_SHORT_READ - the file is
apparently cut short.
For NetMon and NetXRay/Windows Sniffer files, use a #define for the
magic number size, and use that for both magic numbers.
svn path=/trunk/; revision=46803
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of
sizeof.
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of
strtol() and strtoul().
Change some data types to avoid those implicit conversion warnings.
When assigning a constant to a float, make sure the constant isn't a
double, by appending "f" to the constant.
Constify a bunch of variables, parameters, and return values to
eliminate warnings due to strings being given const qualifiers. Cast
away those warnings in some cases where an API we don't control forces
us to do so.
Enable a bunch of additional warnings by default. Note why at least
some of the other warnings aren't enabled.
randpkt.c and text2pcap.c are used to build programs, so they don't need
to be in EXTRA_DIST.
If the user specifies --enable-warnings-as-errors, add -Werror *even if
the user specified --enable-extra-gcc-flags; assume they know what
they're doing and are willing to have the compile fail due to the extra
GCC warnings being treated as errors.
svn path=/trunk/; revision=46748
Martin Kaiser