summaryrefslogtreecommitdiff
path: root/wiretap/file_access.c
AgeCommit message (Collapse)AuthorFilesLines
2011-05-09Get rid of the fd member of a wth structure; the FILE_T's in thatGuy Harris1-5/+6
structure include a file descriptor. Add a wtap_fstat() for the file readers that use file times to generate time stamps (we really need a way to say "this file has no time stamps" or "this file has only relative time stamps). svn path=/trunk/; revision=37026
2011-05-09If a gzipped file's name ends in .caz, don't check the CRC - it'sGuy Harris1-9/+8
probably a compressed file from the Windows Sniffer, and they don't bother setting the CRC. svn path=/trunk/; revision=37024
2011-05-03From Tom Brezinski - fix for bug 5869:Guy Harris1-2/+2
This patch incorporates the following fixes from the patch attached to bug 5671 with changes as noted below: 1.) Files where the packet header and packet data are noncontiguous are handled improperly, resulting in read misalignment and ultimately the error message, "Observer: bad record: Invalid magic number 0xXXXXXXXX." This bug is caused by not obeying the packet_entry_header.offset_to_frame field. 2.) Daylight savings time is not properly accounted for in files using local time encoding. 3.) As of Observer/GigaStor v13.10 (bug 5671 incorrectly stated v14), timestamps in the file format changed from local time encoding to GMT encoding. Wiretap has been changed to support reading both formats. Patch submitted with bug 5671 added a separate file type to allow writing local format. This patch does not add the separate file type and always writes GMT. 4.) The wtap_dumper.bytes_dumped field is not being properly incremented as data is written to files. This patch also incorporates the following additional enhancements / fixes not in bug 5671: 1.) Support for reading BFR files which contain Fibre Channel captures. Test file Fibre_Channel_Capture.bfr attached. 2.) Support for modified file header used in upcoming v15. New header file format takes an unused byte from the version string to allow for a larger offset to the first packet to be specified. Test file V15_Lrg_Hdr_Test.bfr is attached, it is also a fuzz test as the number of TLV items given in the header is less then the actual. 3.) It was found that if the number of TLV items given in the header was larger then present it would fail to open the file. Test file V9_Num_TLVs_Too_Big.bfr is attached. svn path=/trunk/; revision=36970
2011-04-21In a dump_open routine, you don't need to seek to the beginning of theGuy Harris1-4/+4
file before doing any writes - it starts out at the beginning of the file. This means that you *can* write a Network Instruments capture file to a pipe, or write it out in compressed form, now that its dump_open routine no longer seeks. NetXRay format and K12 binary format, however, *do* require a seek when writing them. svn path=/trunk/; revision=36776
2011-04-20Sigh. The "data" element of a GArray is, alas, a "gchar *", not a "voidGuy Harris1-4/+4
*", and some compilers complain when you cast that pointer to something requiring stricter alignment. Maybe the intent is to nudge you into thinking about whether the pointer really is properly aligned, but.... svn path=/trunk/; revision=36739
2011-04-14Check for _setmode() failing, Just In Case. Squelches some MSVC staticGuy Harris1-10/+32
analyzer warnings. Return an actual error if we're failing because we're trying to write to the standard output in compressed mode. svn path=/trunk/; revision=36636
2011-04-12From Jakub Zawadzki: speed up random access to gzipped files, as per theGuy Harris1-4/+7
zran.c example in the zlib source. This means that problems in the file's contents might not be reported when a packet is read, as long as there's no problem in the contents of the file up to the last bit of compressed data for the packet; we now check for errors after finishing the sequential read of the file, at least in some programs, so that shouldn't be an issue (the other programs need to be changed to do so as well). This is necessary in order to be able to read all the packets we saw in the sequential pass; it also lets us get a few more packets from truncated files in some cases. svn path=/trunk/; revision=36577
2011-04-12"This file format can't be written to a pipe" and "this file formatGuy Harris1-22/+33
can't be saved in compress form" are both equivalent to "this file file format requires seeking when writing it". Change the "can compress" Boolean in the file format table to "writing requires seeking", give all the entries the proper value, and do the checks for attempting to write a file format to a pipe or write it in compressed format to common code. This means we don't need to pass the "can't seek" flag to the dump open routines. svn path=/trunk/; revision=36575
2011-04-11Don't use the zlib I/O routines for writing compressed files, either;Guy Harris1-21/+7
this frees us from worrying about zlib large file issues on the write side, and also lets us clean up a few other things. svn path=/trunk/; revision=36563
2011-04-10To fill in a ws_statb64, you must use ws_fstat64.Guy Harris1-1/+1
Declare ws_stdio_stat64, as that's its new name. svn path=/trunk/; revision=36549
2011-04-10Rename ws_stat to ws_stat64, and make it take a pointer to a ws_statb64Guy Harris1-2/+2
as an argument, along the lines of ws_fstat64, and, on Windows, make it use _wstati64, to handle 64-bit file sizes. svn path=/trunk/; revision=36547
2011-04-08Just make the fh member of a wtap_dumper_t a void * for now, and, in allGuy Harris1-9/+9
calls that use it, cast it to whatever it's supposed to be. Making it a gzFile means you can't use any stdio macros that reach inside the structure; making it a FILE *, as it used to be, amounts to trying to use a FILE * as a void * if we're writing a compressed file out. svn path=/trunk/; revision=36521
2011-04-08From Jakub Zawadzki:Guy Harris1-8/+8
Steal file_wrappers functions from zlib v2. svn path=/trunk/; revision=36513
2011-04-06From Jakub Zawadzki:Guy Harris1-2/+2
file-wrappers.[ch] is used only for reading files, and mode is always "rb". Attached patch removes 'mode' argument from file_open() & filed_open(). svn path=/trunk/; revision=36493
2011-03-24Add initial pcapng name resolution record support. Wireshark has readGerald Combs1-73/+86
support; TShark has read+write support. Additionally TShark can read a "hosts" file and write those records to a capture file. This uses "struct addrinfo" in many places and probably won't compile on some platforms. svn path=/trunk/; revision=36318
2011-02-16Fix errors found by the Visual C++ analyzer.Gerald Combs1-2/+2
svn path=/trunk/; revision=35954
2011-01-31Return a string (even though abort is called first) to pacify gcc.Martin Mathieson1-0/+1
svn path=/trunk/; revision=35724
2011-01-30Fix various instances of "unreachable code".Bill Meier1-1/+1
svn path=/trunk/; revision=35713
2010-10-20Fix a typo in a commentBill Meier1-1/+1
svn path=/trunk/; revision=34586
2010-10-20From Hadriel Kaplan: IPFIX file format support.Bill Meier1-4/+8
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5242 svn path=/trunk/; revision=34576
2010-06-06Rename wtap_dump_file_write_all() to wtap_dump_file_write(), and haveGuy Harris1-41/+41
everybody use it; the places using the old wtap_dump_file_write() were using it in the same way the old wtap_dump_file_write_all() did. That also lets us get rid of wtap_dump_file_ferror(). Also, have the new wtap_dump_file_write() check for errors from gzwrite() and fwrite() differently - the former returns 0 on error, the latter can return a short write on error. svn path=/trunk/; revision=33113
2010-06-05From Rolf Fiedler: support for writing EyeSDN trace files.Guy Harris1-2/+2
svn path=/trunk/; revision=33107
2010-02-27Fix some types, to squelch compiler warnings (this should introduceGuy Harris1-2/+2
another valid warning, if you've turned the warnings up high enough; we need to generate a zlib version of stdout). svn path=/trunk/; revision=32027
2010-02-26Move the definitions of all the private data structures out ofGuy Harris1-3/+4
wtap-int.h, and change the unions of pointers to those private data structures into just void *'s. Have the generic wtap close routine free up the private data, rather than the type-specific close routine, just as the wtap_dumper close routine does for its private data. Get rid of close routines that don't do anything any more. svn path=/trunk/; revision=32015
2010-02-23Squelch some compiler warnings (some of which indicate potentialGuy Harris1-13/+13
problems, and some of which are, at least, incorrect casts). svn path=/trunk/; revision=31957
2009-12-23The maker of *Peek is WildPackets, InterCap and all, not Wildpacket.Guy Harris1-3/+3
svn path=/trunk/; revision=31358
2009-10-17From Marton Nemeth:Stig Bjørlykke1-0/+5
Add the ability to open JPEG/JFIF files directly. From me: Some code cleanup + add new file to cmake. svn path=/trunk/; revision=30588
2009-06-15Rename all of the ascend files:Jörg Mayer1-1/+1
That way we hopefully won't need the runlex.sh hack any more. Also the ylwrap stuff is (hopefully) obsolete. ascend.[hc] -> ascendtext.[hc] ascend-scanner.l -> ascend_scanner.l ascend-grammar.y -> ascend.y svn path=/trunk/; revision=28744
2009-06-01From Ravi Kondamuru via bug 3457: Stig Bjørlykke1-2/+13
Add support to read citrix netscaler capture file format. From me: - Renamed packet-ns.c to packet-nstrace.c - Rewrote to not use "goto" in netscaler.c - Moved dissecting of coreid svn path=/trunk/; revision=28564
2009-05-24From Fred Fierling (bug 3486):Stig Bjørlykke1-1/+6
Added support for Daintree's Sensor Network Analyzer capture files. svn path=/trunk/; revision=28463
2009-05-22From Kovarththanan Rajaratnam via bug 2680:Gerald Combs1-1/+17
Currently Wireshark doesn't support saving WTAP_ENCAP_BLUETOOTH_H4_WITH_PHDR files as btsnoop files. svn path=/trunk/; revision=28442
2009-04-23Added PacketLogger to dump_open_table_base to be able to open pklg filesStig Bjørlykke1-1/+4
(and avoid crash). svn path=/trunk/; revision=28137
2009-03-09P64 fixes.Gerald Combs1-2/+2
svn path=/trunk/; revision=27683
2009-02-16Add support for reading Apple's Bluetooth PacketLogger capture files toStephen Fisher1-1/+4
wiretap. Modify various other locations to accommodate the fact that PacketLogger files do not specify the direction of packets. svn path=/trunk/; revision=27463
2009-01-07From Duncan Salerno:Jaap Keuter1-1/+6
Added LAPDm protocol dissector, GSM Um layer, and wiretap support for dct3trace captures, generated by gammu (many available at http://wiki.thc.org/gsm). svn path=/trunk/; revision=27176
2009-01-04Fix some indentationBill Meier1-13/+13
svn path=/trunk/; revision=27156
2008-11-27Added support for open TNEF files directly.Stig Bjørlykke1-1/+9
No we can decode those winmail.dat files. svn path=/trunk/; revision=26864
2008-09-15Fix for bug 2875:Jaap Keuter1-10/+21
Fix a final eth_fopen -> ws_fopen When configuring with --without-zlib these functions need to have some parameters tagged _U_ svn path=/trunk/; revision=26212
2008-05-22Move the file utility functions from wiretap to libwsutil so thatJeff Morriss1-29/+29
libwireshark (and the plugins using those functions) do not depend on wiretap on Windows. While doing that, rename the eth_* functions to ws_*. svn path=/trunk/; revision=25354
2008-02-03From Shane Kearns (bug 2237):Stig Bjørlykke1-2/+6
Added support for Symbian OS btsnoop. The bluetooth HCI layer in Symbian OS can be configured to log all packets to a file. The log format, "btsnoop" is based on the RFC1761 "snoop" format - but differences in the header make it incompatible. The btsnoop format supports logging of these formats: "H1" (raw HCI packets without framing) "H4" (HCI UART packets including packet type header) "H5" (HCI 3 wire UART packets including framing) "BCSP" (HCI bluecore serial protocol including framing) "H1" and "H4" are section numbers in the original v1 bluetooth specifications, but still used colloquially - wireshark's existing support for Linux bluez HCI logs uses the "H4" name. In practice, the "H1" format is used for H5,BCSP and USB HCI logs, as the HCI packet logs are mainly useful for debugging higher layers, bluetooth profiles and bluetooth applications. From me: Deleted some unused prototypes. Mark an unused parameter. svn path=/trunk/; revision=24263
2008-01-13add very experimental support for pcapng "PCAP Next Generation Dump File ↵Ulf Lamping1-1/+7
Format" - this is incomplete and buggy, be careful! svn path=/trunk/; revision=24079
2007-11-26Add writing support for the CommView file format.Stephen Fisher1-1/+1
svn path=/trunk/; revision=23594
2007-11-24Initial checkin of support to read TamoSoft's CommView packet capture filesStephen Fisher1-0/+6
per enhancement bug #1795. svn path=/trunk/; revision=23558
2007-08-17(http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1717)Sake Blok1-1/+11
This patch adds support for the Juniper NetScreen snoop output format. It takes a text-dump op the captured packets and parses the headers and hex-data. Since the snoop files on a Junpiper NetScreen can be saved to a tftp-server, this patch makes it quite easy to use the snoop function of the Juniper NetScreen firewalls. /* XXX TODO: * * o Create a wiki-page with instruction on how to make tracefiles * on Juniper NetScreen devices. Also put a few examples up * on the wiki (Done: wiki-page added 2007-08-03) * * o Use the interface names to properly detect the encapsulation * type (ie adsl packets are now not properly dissected) * (Done: adsl packets are now correctly seen as PPP, 2007-08-03) * * o Pass the interface names and the traffic direction to either * the frame-structure, a pseudo-header or use PPI. This needs * to be discussed on the dev-list first * (Posted a message to wireshark-dev abou this 2007-08-03) * */ svn path=/trunk/; revision=22533
2007-06-08From Stephen Donnelly of Endace:Guy Harris1-1/+1
The code for reading ERF files has not been significantly updated since 2004. This patch brings it up to date with a number of changes. 1) Increase number of decodable ERF types from 7 to 12. This covers newer DAG card models and firmware updates. 2) Fix timestamp conversion. Was calculating only microsecond precision, now displaying with nanosecond resolution. Hardware precision is 7.5 to 30 ns depending on model. 3) Allow the user to specify HDLC encapsulation as 'chdlc', 'ppp_serial', 'frelay' or 'mtp2'. This is needed because the ERF HDLC capture formats do not include information on what protocol is used at the next level. This is currently done via an environment variable 'ERF_HDLC_ENCAP' and is analagous to the existing 'ERF_ATM_ENCAP' variable. If the user does not specify an HDLC encapsulation it tries to guess, and falls back to MTP2 for backwards compatibility with Florent's existing behaviour. I know environment variables are ugly, suggestions are welcome. 4) When reading HDLC captures as MTP2, use WTAP_ENCAP_MTP2_WITH_PHDR rather than WTAP_ENCAP_MTP2. This allows us to put the 'Multi-Channel ERF' record 'channel number' field into the MTP2 pseudo header > 'link_number' field. This is then displayed in Frame information, and can be filtered on. (Would be nice if it could be made a display column?) Because the ERF record does not specify whether Annex A is used or not, we pass MTP2_ANNEX_A_USED_UNKNOWN and allow the existing user preference to decide. Move the MTP2_ANNEX_A_ definitions into Wiretap, make the annex_a_used field a guint8, and change MTP2_ANNEX_A_USED_UNKNOWN to 2 so it fits in a guint8. (This means that if you can save an ERF MTP2 file as a libpcap file, the pseudo-header will have MTP2_ANNEX_A_USED_UNKNOWN in it.) svn path=/trunk/; revision=22067
2007-06-06Actually implement wtap_register_file_type() and have it returning the ID of ↵Luis Ontanon1-11/+35
the new file type. Add few functions to wiretap's exported API. svn path=/trunk/; revision=22060
2007-05-05fix win32 build by using wtap_get_num_file_types() instead of direct ↵Ulf Lamping1-0/+5
variable access svn path=/trunk/; revision=21689
2007-05-04Add a plugin interface to wiretap.Luis Ontanon1-32/+41
So far I've done only regression testing (the new functionality and what's in wtap-plugins.c has not yet being tested). it is a first step in the way to have lua opening files. svn path=/trunk/; revision=21686
2007-05-02add support for the text export format of textronix k1[25]Luis Ontanon1-1/+6
svn path=/trunk/; revision=21651
2007-03-22From Shaun JackmanRonnie Sahlberg1-0/+5
Wiretap support to read MPEG files svn path=/trunk/; revision=21112
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-09 10:53:18 +0000