The same hierarchy of protocols can appear multiple times in a frame,
for example if there are multiple PDUs for a protocol that begin in
that frame. Keep track of the last frame where we incremented our
stat node and use that to only increment it once per frame.
Add a "total number of PDUs with this hierarchy" statistic and
display it as a new final column in the GUI. Update the User Guide.
In the purpose of doing this, get rid of temporary variables and
increment the ph_stats_t members directly, since we pass that
into our functions already, and thus have access to the current
packet count.
Fix#17553. Fix#18034. Fix#12565.
In conversation_filter.h, add a separate log_conv_filter_list. Use it in
register_log_conversation_filter and add conversation_filter_from_log.
It looks like we no longer use find_conversation_filter externally, so
remove it from the API.
RTP dialogs can stay opened, therefore calls of its functions are
protected by locks. There was issue that same mutex was used during
construction of the dialog and calling functions. It created possible
deadlock.
Change separates lock used for dialog creation and lock for function calls.
When function call lock is locked, new calls are ignored and warning is
printed to STDERR. Showing a dialog with warning looks too intrusive to me.
Fixes#18025
Rename LogsharkApplication to LogwolfApplication. Rename other Logshark
references in ui/qt_logshark to Logwolf. Update our CMake target and
variable names.
Rename init_progfile_dir to configuration_init. Add an argument which
specifies our configuration namespace, which can be "Wireshark"
(default) or "Logwolf".
Rename the main_window class and UIC files to wireshark_main_window and
the MainWindow class to WiresharkMainWindow. Copy wireshark_main_window
/ WiresharkMainWindow to logwolf_main_window / LogwolfMainWindow.
Remove the Wireless menu from Logwolf.
Move WiresharkApplication.{cpp,h} to MainApplication.{cpp,h}. Add back
WiresharkApplication as a thin superclass of MainApplication, similar to
LogsharkApplication. Change all of our wsApp references to mainApp. We
will likely have to change many or most of them back, but that's a
commit for another time.
Add a separate UI application named "Logshark". It's currently a very
thin superclass of Wireshark, but that will change over time. Based on
work by Loris Degioanni.
Fix
ui/qt/models/filter_list_model.cpp:299:33: warning: implicit conversion loses integer precision: 'qsizetype' (aka 'long long') to 'int' [-Wshorten-64-to-32]
storage.move(strow, storeTo);
~~~~ ^~~~~~~
when building with Qt 5.
Fix
** (wireshark:77415) 10:53:35.149736 [GUI WARNING] -- QObject::connect: No such signal QComboBox::currentIndexChanged(QString) in ui/qt/about_dialog.cpp:352
** (wireshark:77415) 10:53:35.149760 [GUI WARNING] -- QObject::connect: (sender name: 'cmbType')
Use new-style connections everywhere in about_dialog.cpp.
Qt 5.10 added qsizetype, aka an ssize_t and Qt 6 makes extensive use of
it. Add a compatibility typedef and use it where we can. Cast it away
where we can't.
Fix
ui/qt/rtp_stream_dialog.cpp:708:26: error: 'type' is deprecated: Use typeId() or metaType(). [-Werror,-Wdeprecated-declarations]
} else if (v.type() == QVariant::String) {
^
and similar errors. Although the warnings recommend typeId() or
metaType(), userType() exists in both Qt 5 and 6 so use it instead.
Fix
ui/qt/tcp_stream_dialog.cpp:1669:31: error: 'globalPos' is deprecated: Use globalPosition() [-Werror,-Wdeprecated-declarations]
ctx_menu_.exec(event->globalPos());
^
and similar warnings.
This allows the "needs to be reloaded" indication to be set in the close
process, as is the case for ERF; having a routine that returns the value
of that indication is not useful if it gets seet in the close process,
as the handle for the wtap_dumper is no longer valid after
wtap_dump_close() finishes.
We also get rid of wtap_dump_get_needs_reload(), as callers should get
that information via the added argument to wtap_dump_close().
Fixes#17989.
Only set the Packet List scrollbar page step to be equal to the
height of the scrollbar when running on macOS. Qt on Linux and
Windows behaves different.
Add a separate menu for Strip Headers (similar to Export PDU, but exporting
to an encapsulation other than WIRESHARK_UPPER_PDU everything for
that encapsulation). Add to the usage output of tshark for the "-U"
option which encapsulation a export tap will produce.
Allow export PDU taps to be registered with a wiretap encapsulation
instead of always using WTAP_ENCAP_WIRESHARK_UPPER_PDU. This allows
creating normal capture files that aren't tied to wireshark without
having to do a "editcap -C -L -T", as well as creating files in
formats other than pcapng and pcap with tshark.
Provide a couple sample implementations in Ethernet (WTAP_ENCAP_ETHERNET)
and IP (v4 and v6, WTAP_ENCAP_RAW_IP) that are the most common use cases.
(I can imagine a few others; WTAP_ENCAP_MPEG_2_TS could probably be
useful, for example.) Fixes#15141
Calling setCurrentIndex with QItemSelectionModel::ClearAndSelect clears
the currentIndex, but not the selection, so it doesn't trigger
selectionChanged. However, highlighting depends on the selectionChanged
signal, not currentChanged(), and it's not emitted if we're still on the
same packet/row as the current selection (which can occur if searching
for something that occurs in exactly one packet in a capture.)
Since packet_list_select_row_from_data() cares about where the data
is within the packet, it needs to clear the selection. Fix#8269
Add a checkbox to the packet format group box to allow the
hexdump to only have the main frame instead of secondary data
sources as well, so that Print and Export Packet Dissections can
be used for input to text2pcap.
Apparently on Windows, if a dialog contains spaces it is not properly
opened via /select. But opening the file via QDesktopServices leads to
the file not being selected in the open explorer windows (expectation by
the user). Therefore the original change is restored, but with a
differenc call which should handle the space issue in most cases better
than before. See
https://stackoverflow.com/questions/3490336/how-to-reveal-in-finder-or-show-in-explorer-with-qt
for a short explanation (bottom of post)
Fixes#17927
inputMask populates the field with a space for each character
in the mask. Mouse people that click in the field may position
the cursor at the far right of the mask and not be able to enter
a value.
https://www.qtcentre.org/threads/7106-QLineEdit-and-input-mask
Remove the inputMask from the field definition and add a validator.
Don't use ZLib routines or data types if we're built without ZLib.
Don't support --compress-type=gzip, or a gzip check box in the Output
pane of the Capture Options dialog, if we're built without ZLib.
Fixes#17899.
g_file_open_tmp() does not set name_used unless the temp file
is successfully created (cf. to our old hand written library
pre commit 2925fb0850). Initialize it so that g_free doesn't
free a random memory location in that case, and don't use it
otherwise after failure. Fix#17828.
Since Import from Hex Dump creates a pcapng temporary file, use
the list of encapsulations we can write to pcapng instead of pcap.
In particular, this makes WTAP_ENCAP_SYSTEMD_JOURNAL possible, so make
text_import capable of writing that encapsulation by using the proper
rec_type and block. It's not clear why someone would have a binary
hex dump of this text based format, but it works.
This must match the base name of the .desktop file (without the .desktop suffix).
The implicit default is 'wireshark', which worked until the file got renamed in 42a09ad02e
Setting this is important for several desktop enviromnent features to work, for example the window icon on Plasma Wayland
In text2pcap and Import from Hex Dump, allow fake IP headers with
the appropriate versions when the Raw IP, Raw IPv4, and Raw IPv6
encapsulations are specified. In such cases, do not add a dummy
Ethernet header.
Continue to reject other encapsulations besides these, Ethernet,
and Wireshark Upper PDU when appropriate. Add some checks for the
encapsulation type in text_import as well, instead of just assuming
that the callers handle it correctly.
Move the list of encapsulation buttons to a QButtonGroup, which makes
it easy to tell which one of them is activated.
Use that to fix an issue where dummy headers impermissible for an
encapsulation type could be added if the radio button was selected
before switching the encapsulation type. (Only for encapsulations
that allow at least one type, i.e. Ethernet or Wireshark Upper PDU.)
qcustomplot.cpp:34001:37: warning: The left operand of '-' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:34001:37: warning: The right operand of '-' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:26643:9: warning: 1st function call argument is an uninitialized value [core.CallAndMessage]
qcustomplot.cpp:27752:11: warning: 1st function call argument is an uninitialized value [core.CallAndMessage]
qcustomplot.cpp:27779:11: warning: 1st function call argument is an uninitialized value [core.CallAndMessage]
qcustomplot.cpp:34087:7: warning: 2nd function call argument is an uninitialized value [core.CallAndMessage]
qcustomplot.cpp:22400:17: warning: The left operand of '>' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:22400:17: warning: The right operand of '>' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:35170:17: warning: The left operand of '>' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:35170:17: warning: The right operand of '>' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:21229:13: warning: The left operand of '==' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:21274:13: warning: The left operand of '==' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:35323:13: warning: The left operand of '==' is a garbage value [core.UndefinedBinaryOperatorResult]
qcustomplot.cpp:35349:13: warning: The left operand of '==' is a garbage value [core.UndefinedBinaryOperatorResult]
Add some default IPv6 addresses, used in place of the unspecified
address. These are unique local addresses as in RFC 4193 with
a global ID generated using the pseudo-random algorithm mentioned
therein.
Use nanosecond resolution pcapng files for "Import from Hex Dump"
by default (since we support that level of precision and that's
what text2pcap does).
Disable QAbstractItemView's alternatingRowColors in places where we have
that set. One of Wireshark's most heavily used features is packet
colorization; we use color in packet list and detail rows to convey
information. Simple alternating color rows doesn't do that, and as my
blatant appeal to authority^W^W^W^W^WEdward Tufte points out, "Strips
are merely bureaucratic or designer chartjunk; good typography can
always organize a table, no stripes needed."
https://www.edwardtufte.com/bboard/q-and-a-fetch-msg?msg_id=0001IV
Move the parameter setup to text_import, so that later it can
be called from the GUI, including the interface name. (This has
to be a separate function because these parameters need to be
set before the call to wtap_dump_open, which is different for
regular files vs temp files vs stdout.)
Remove the '-d' option from text2pcap, and move the two levels
of debug messages in text2pcap and text_import to either
LOG_LEVEL_DEBUG or LOG_LEVEL_NOISY as appropriate.
In "Import from Hex Dump", change the control that determines
IPv4 versus IPv6 to a QComboBox, and move it into the grid of
options, in the IP option section.
Only warn about the parser getting an unexpected offset when
using OFFSET_NONE the first time. Use log warnings for subsequent
messages.
Strip off the whitespace/newline/colon from the offset when adding
it to the message, only output the offset number.
text2pcap used 10.1.1.1 and 10.2.2.2 for default IPv4 addresses,
and "Import From Hex Dump" used 1.1.1.1 and 2.2.2.2. The former
are a little bit better for defaults since they're RFC 1918
private IP addresses, so let's use them for the common code.
Add the option to use IPv6 instead of IPv4 for dummy headers,
including custom source and destination address, to the
"Import from Hex Dump" GUI box. Related to #16724
Encapsulate the feature requirements for strptime() in a
portability wrapper.
Use _GNU_SOURCE to expose strptime. It should be enough on glibc
without the side-effect of selecting a particular SUS version,
which we don't need and might hide other definitions.
Add a checkbox for the extra detection for ASCII in a hex+ASCII
hexdump even when the text looks like hexbytes to Import from Hex
Dump. Save and restore it from the settings. Work towards #16724.
If we're in the no offset mode and we parse an offset,
warn the user and ignore. At the very beginning of the file try
adding it to the preamble, maybe there's something unfortunate
like an all numeric time stamp format (ISO-8601 Basic).
A bunch of the globals are simply copied from the input parameter
text_import_info_t, just use them directly.
Move the count for packets read and written into the info type,
so that callers like text2pcap can access them as results.
Don't exit in the middle with unexpected values. Report a failure
and return a failed exit status when something goes really wrong.
Use warnings when appropriate, like when a time code value couldn't
be parsed.
Includes allowing the string "ISO" in the format string text box
in the GUI, so this works in "Import from Hex Dump" as well as
being for the text2pcap transition. Part of #16724.
Use report_message and report wtap_dump failures. Pass in
the output filename and keep track of the frame numbers for
the message parameters.
Report failure to initialize the lex scanner in text_import
instead of in the GUI, so that it would be reported from text2pcap,
and because text_import might have other failure cases that are
not the scanner.
The regex parser returns a positive number of packets processed
on success; save that number in text_import, and return zero on
success to our callers.
This is the special check for canonical hex+ASCII textdump
files that looks for the edge case where the beginning of the
ASCII column has strings that can be mistaken by the parser for
additional hex bytes. Not implemented in the GUI yet. Preparing
for text2pcap switchover. Related to #16724.
Adjust the grammar to recognize two trailing hexadecimal characters
without a LF as a byte as well. Ported from text2pcap and commit
22cf80d30d which explains why this
is safe. More work for #16724.
Repeated words were found with:
egrep "(\b[a-zA-Z]+) +\1\b" . -Ir
and then manually reviewed.
Non-displayed strings (e.g., in comments)
were also corrected, to ease future review.
Add IPv6 handling to text_import, including the ability to
handle dummy IPv6 addresses instead of IPv4. GUI support is
still TBD. This further reduces the number of text2pcap features
that ui/text_import does not yet support. Related to #16724.
Add dummy IPv4 addresses to the text_import_info_t struct, and
use them if set in the same way text2pcap does. GUI support in
"Import from Hex Dump" is not added yet. This is also part of the
work for text2pcap to eventually call text_import. Related to #16724.
The encapsulation type that text_import expects and puts
directly into rec.rec_header.packet_header.pkt_encap is a
wiretap encap type, not a pcap link type. Fix the name and
comment appropriately.
Correctly handle when a minimum packet length forces fragmentation of
SCTP and we are generating dummy SCTP DATA chunk headers: mark fragmentation
in the chunk flags and set the transmission sequence number and
stream sequence number appropriately.
Port from text2pcap commit f8d48662c8
Part of #16724.
The "Import from Hex Dump" time delta for packets without a timestamp
was changed to be a nanosecond, but the time resolution for the file
created by import_text_dialog is the default, microseconds. Until
that is configurable, the time tick used needs to be microseconds like
it was before.
Clean up the code so that it's a little more consistent about when
and how the extra time tick is added, namely:
1. If there is no time format passed in.
2. If time format conversion for the packet fails for any reason.
We don't add an extra delta in other situations, e.g. if packets just
happen to have the same valid time value.
Fix#15562.
_parse_time, which uses g_strlcpy, expects that end_field points
to the position after the end of the field (such as the \0.)
text_import_regex handles this correctly, but when importing from
hex dumps the last character of the timestamp was being cut off,
which makes a big difference when fractional seconds are not used.
For historical reasons our logging inherited from GLib the logging of
some levels to stdout. Namely levels "info" and "debug" (to which we
added "noisy").
However this practice is discouraged because it mixes debug output
with application output for CLI tools and breaks many common usage
scenarios, like using tshark in pipes.
This change flips the logic on wslog to make logging to stderr the
default behavior.
Extcap subprocess have a hidden dependency on stdout so add that.
Some GUI users may also have a dependency on stdout. Because
GUI tools are unlikely to depend on stdout for programatic output
add another exception for wireshark GUI, to preserve backward
compatibility.
This lowers the level of this message from "message" to
"info". This has two side-effects:
- It is not displayed by default
- It is printed to stdout instead of stderr.
Some users were depending on this message. Restore this to
the level it had before 05ed76d4. Even though this output is
not considered a stable interface restoring the old behavior
helps them and has no meaningful usability downsides. The
changes in 05ed76d4 were experimental anyway.
Related to #17763.
Actually output the packet count for RTSP response status codes,
and align the columns between requests and response. (This CLI-only
stat is largely redundant with rtsp,tree but it might as well work.)
Actually output the packet count for HTTP response status codes,
and align the columns between requests and response. (This CLI-only
stat is largely redundant with http,tree but it might as well work.)
Without this, the simple stat tables default to sorting by the first
column in descending order. (An artifact of the QTreeWidget that they
inherit from.) The first column is generally a message type (integer or
string) and ascending order makes more sense.
Some of the stat tables intentionally insert rows in a preferred order
that is different than sorting by the first column (e.g, ANSI A I/F tables
are sorted by the second column), but we can't tell what that is.
QTreeWidget only allows the data to be shown in its original unsorted
order if the widget is marked unsortable, but then the user isn't allowed
to sort at all, and being able to sort by other columns (such as count)
is useful.
Extcaps require a log file when invoked in child mode. It also has
a specific flag to enable debugging, other that the wslog options.
Fix the logging to:
1. Enable debug log level if --debug is used.
2. Do not emit messages to the stderr if debug is enabled.
This brings extcap logging to the same feature level it had before
wslog replaced GLib logging.
There is some lose of detail in the group label but eliminates
the misleading information that comes from grabbing the
potentially modified summary of the first entry in the group.
Closes#14892#14425
Wireshark successfully compiles on Windows with Qt6.2 with following
cmake options:
-DUSE_qt6=ON -DDISABLE_ERROR=ON
QCustomPlot QT 6.2 patch is taken from QCustomPlot forum post by miccs.
Qt5 recommended to use QRegularExpression instead of QRegExp.
Qt6 deprecated QRegExp and provides it in Qt5 compatibility module.
QRegularExpression is generally faster and safer to use as the results
are returned in separate QRegularExpressionMatch instead of modifying
interal QRegExp object state.
This is basically applying c knowledge and Google to the compiler
error messages. There is basically no understanding involved into
what I was doing:
- No idea why lots of #includes needed to be added for Qt6
- No idea how to actually fix the remaining problems, but it's a start
Things that need to be done:
- The AudioDeviceInfo thingy needs to be replaced by something new (as
an interim solution another patch disables the audio player in Qt6).
- GRegExp eventually needs to be replaced by QRegularExpression
(available since Qt5.0, so development can be done in Qt5).
- Solutions for the other problems like some methods no longer
being available in Qt6 that have to sort of co-exist with Qt5.
In order to be able to defer solving all Qt6 API differences at once
I tried to reactivate the QT_MULTIMEDIA_LIB feature. I managed to fix
most problems but one problem remains in both Qt5 and Qt6 builds.
Without Qt[56]Multimedia, the following error exceeds my non-existing
C++ knowledge:
jmayer/work/wireshark/git/ui/qt/rtp_player_dialog.cpp:154:18: error: out-of-line definition of 'RtpPlayerDialog' does not match any declaration in 'RtpPlayerDialog'
RtpPlayerDialog::RtpPlayerDialog(QWidget &parent, CaptureFile &cf, bool capture_running) :
^~~~~~~~~~~~~~~
Of course it still fails in the compile phase, but only for some
of the ui/qt/ files.
Wireshark with Qt5 still compiles and runs.
To do the build invoke cmake with the following settings added:
export CMAKE_PREFIX_PATH=:${MY_QT6_PREFIX}/lib/cmake
cmake -DUSE_qt6=ON ...
Independently of this patch there is lots of Qt-stuff in
CMakeLists.txt that needs review/cleanup:
- Some of the stuff can probably be solved in a less hacky way:
+ There seemed to be a way for QT6 to provide the required c++-standard,
but in the end I could not find it.
+ Once we have a working Qt6 codebase, we may get rid of the USE_qt6
flag and just test for Qt6Core first and if not present check for
Qt5Core.
- All comments that match /qt ?[4-6]/i need reviewing/cleaning up.
- The changes in this patch have been tested to work on all machines
that are my mac (macos 12.0.1, XCode 13.1, Intel, GPL-Qt6.2.1 with only
the macos package selected, cmake 3.21.4)
Add ui/qt/qt6-migration-links.txt for some possibly helpful links
The column parameter in PacketListRecord::columnString() must be
below cap_file->cinfo.num_cols to be valid. An issue with this check
may be triggered when switching profile.
Pass the funnel operations ID to new_text_window and new_dialog so that
we can assign parent widgets when we create new FunnelTextDialogs and
FunnelStringDialog. This should ensure that they're destroyed properly.
Ping #17590.
This reverts commit c2edb44a9a.
While we should definitely avoid leaking memory, this runs up against
the Qt code's assumption that it will always have valid epan data.
Fixes#17590.
Fixes#17719.