summaryrefslogtreecommitdiff
path: root/wiretap/libpcap.c
AgeCommit message (Collapse)AuthorFilesLines
2014-08-24Fix trailing blank.Guy Harris1-1/+1
Change-Id: Ide4afb2fb78c80800f04a40031fa1f35804f6464 Reviewed-on: https://code.wireshark.org/review/3809 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-08-24Strengthen the heuristics for pcap subtypes.Guy Harris1-226/+205
When trying to guess what type of capture a file is, look for as many bogosities (caplen > len, microseconds >= 10^6/nanoseconds >= 10^9, too-high caplen, too-high original len, caplen > snapshort length), to increase the chances of guessing correctly. (Every time somebody uses 0xa1b2c3d4 as the magic number for a capture file that isn't standard pcap format, God kills a kitten. Please, think of the kittens.) Change-Id: I3f397d598ed61dc82e2832be30452ebe8ace98e8 Reviewed-on: https://code.wireshark.org/review/3808 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-08-02Rename buffer_ routines to ws_buffer_ to avoid name collisions.Guy Harris1-1/+1
In particular, epan/wslua/lrexlib.c has its own buffer_ routines, causing some linker warnings on some platforms, as reported in bug 10332. (Not to be backported to 1.12, as that would change the API and ABI of libwsutil and libwiretap. We should also make the buffer_ routines in epan/wslua/lrexlib.c static, which should also address this problem, but the name change avoids other potential namespace collisions.) Change-Id: I1d42c7d1778c7e4c019deb2608d476c52001ce28 Reviewed-on: https://code.wireshark.org/review/3351 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-07-15Only one buffer.c, please.Guy Harris1-1/+1
Otherwise, if you link with both libwiretap and libfiletap, it's anybody's guess which one you get. That means you're wasting memory with two copies of its routines if they're identical, and means surprising behavior if they're not (which showed up when I was debugging a double-free crash - fixing libwiretap's buffer_free() didn't fix the problem, because Wireshark happened to be calling libfiletap' unfixed buffer_free()). There's nothing *tap-specific about Buffers, anyway, so it really belongs in wsutil. Change-Id: I91537e46917e91277981f8f3365a2c0873152870 Reviewed-on: https://code.wireshark.org/review/3066 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-06-25Update a comment.Guy Harris1-13/+16
Also, make the block of code containing that comment intended consistently with spaces. Change-Id: I8e8eb346833662f15c53ece5869b12cc430bad11 Reviewed-on: https://code.wireshark.org/review/2661 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-24Allow wtap_read() and wtap_seek_read() to return records other than packets.Guy Harris1-0/+7
Add a "record type" field to "struct wtap_pkthdr"; currently, it can be REC_TYPE_PACKET, for a record containing a packet, or REC_TYPE_FILE_TYPE_SPECIFIC, for records containing file-type-specific data. Modify code that reads packets to be able to handle non-packet records, even if that just means ignoring them. Rename some routines to indicate that they handle more than just packets. We don't yet have any libwiretap code that supplies records other than REC_TYPE_PACKET or that supporting writing records other than REC_TYPE_PACKET, or any code to support plugins for handling REC_TYPE_FILE_TYPE_SPECIFIC records; this is just the first step for bug 8590. Change-Id: Idb40b78f17c2c3aea72031bcd252abf9bc11c813 Reviewed-on: https://code.wireshark.org/review/1773 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23Revert "Allow wtap_read() and wtap_seek_read() to return non-packet records."Guy Harris1-10/+8
This reverts commit c0c480d08c175eed4524ea9e73ec86298f468cf4. A better way to do this is to have the record type be part of struct wtap_pkthdr; that keeps the metadata for the record together and requires fewer API changes. That is in-progress. Change-Id: Ic558f163a48e2c6d0df7f55e81a35a5e24b53bc6 Reviewed-on: https://code.wireshark.org/review/1741 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23Allow wtap_read() and wtap_seek_read() to return non-packet records.Guy Harris1-8/+10
This is the first step towards implementing the mechanisms requestd in bug 8590; currently, we don't return any records other than packet records from libwiretap, and just ignore non-packet records in the rest of Wireshark, but this at least gets the ball rolling. Change-Id: I34a45b54dd361f69fdad1a758d8ca4f42d67d574 Reviewed-on: https://code.wireshark.org/review/1736 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09Revert "Refactor Wiretap"Guy Harris1-87/+82
This reverts commit 1abeb277f5e6bd27fbaebfecc8184e37ba9d008a. This isn't building, and looks as if it requires significant work to fix. Change-Id: I622b1bb243e353e874883a302ab419532b7601f2 Reviewed-on: https://code.wireshark.org/review/1568 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09Refactor WiretapMichael Mann1-82/+87
Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality. The "architectural" changes can be found in cfile.h, wtap.h, wtap-int.h and (new file) wftap-int.h. Most of the other (painstaking) changes were really just the result of compiling those new architecture changes. bug:9607 Change-Id: Ife858a61760d7a8a03be073546c0e7e582cab2ae Reviewed-on: https://code.wireshark.org/review/1485 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-02-06Make some routines take a struct wtap_pkthdr * as an argument.Guy Harris1-2/+1
For some routines that take multiple arguments that come from a struct wtap_pkthdr, pass a pointer to the struct wtap_pkthdr in question, rather than the separate arguments. Do this even if we're passing expressions that were earlier assigned to the struct wtap_pkthdr fields in question. This simplifies the calling sequences and ensures that the right values are picked up by the called routine; in at least one case we were *not* passing the right values (the code to handle Simple Packet Blocks in pcap-ng files). Also, call the byte-swapping routines for pseudo-header fields only if we need to do byte-swapping. Change-Id: I3a8badfcfeb0237dfc1d1014185a67f18c0f2ebe Reviewed-on: https://code.wireshark.org/review/119 Reviewed-by: Evan Huus <eapache@gmail.com> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-01-22Don't write out packets that have a "captured length" bigger than we'reGuy Harris1-0/+6
willing to read or that's bigger than will fit in the file format; instead, report an error. For the "I can't write a packet of that type in that file type" error, report the file type in question. svn path=/trunk/; revision=54882
2014-01-15Reject pcap files that claim on-the-wire packet sizes > 64MB. This fixes manyEvan Huus1-0/+18
heuristic cases broken in r49999 when we permitted packets > 64KB, since that relaxed so severely the definition of a valid packet header. 64MB is an arbitrary and perhaps suboptimal number, but it seems to do the right thing in all the examples I have handy. Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9634 svn path=/trunk/; revision=54812
2014-01-02No seek-read routines use the length argument, so eliminate it fromGuy Harris1-3/+2
wtap_seek_read(). svn path=/trunk/; revision=54570
2013-11-29Replace macros: BSWAP16, BSWAP32, BSWAP64 with glib-version.Jakub Zawadzki1-8/+8
XXX, people are not aware that expression of this macros might be evaluated multiple times, like: - BSWAP16(tvb_get_letohs(tvb, off)) : \ + GUINT16_SWAP_LE_BE(tvb_get_letohs(tvb, off)) : \ Should be tvb_get_ntohs() called? svn path=/trunk/; revision=53653
2013-11-08The "file types" we have are actually combinations of types andGuy Harris1-33/+33
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2 are separate "file types", even though they both come from Network Monitor. Rename various functions, #defines, and variables appropriately. svn path=/trunk/; revision=53166
2013-07-16Explain that we don't have to worry about fixed-length buffers whoseGuy Harris1-1/+6
size is based on the snapshot length. svn path=/trunk/; revision=50647
2013-07-15On the suggestion of Cal Turney, viaEvan Huus1-0/+6
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8937 Don't warn if a file has packets larger than the global snapshot length. svn path=/trunk/; revision=50646
2013-06-18Don't limit the on-the-wire length of packets to 64KB, there are larger packetsEvan Huus1-16/+3
out there (especially over USB) and we should be able to load them as long as they are snapped to a sane length. Also validate that packets do not specify a snapshot length larger than the one in the file header, though only make it a warning, as this is not necessarily a fatally corrupt packet. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8808 svn path=/trunk/; revision=49999
2013-06-17Merge "read record header" and "read packet data" routines into a singleGuy Harris1-36/+24
routine, used both by read and seek-read routines. svn path=/trunk/; revision=49988
2013-06-16Have the seek-read routines take a Buffer rather than a guint8 pointerGuy Harris1-44/+24
as the "where to put the packet data" argument. This lets more of the libwiretap code be common between the read and seek-read code paths, and also allows for more flexibility in the "fill in the data" path - we can expand the buffer as needed in both cases. svn path=/trunk/; revision=49949
2013-05-18Fix "set but not used" compile warning turning errorJörg Mayer1-2/+0
svn path=/trunk/; revision=49405
2013-05-18In libpcap_process_header(), fill in what phdr points to, not wth->phdr.Guy Harris1-3/+3
svn path=/trunk/; revision=49403
2013-05-18In the pcapng seek-read routine, *don't* fill in wth->phdr; seek-readGuy Harris1-60/+68
routines are passed a separate struct wtap_pkthdr to be filled in. Get rid of the pseudo_header member of the wblock structure - the pseudo-header is part of the struct wtap_pkthdr. Get rid of the union wtap_pseudo_header * argument to pcap_process_pseudo_header() - it's passed a pointer to a struct pcap_pkthdr, and that structure contains the union in question. Have libpcap_read_header() take a FILE_T argument, rather than using only the "sequential" handle of the wtap it's handed. Have the libpcap read routine return the offset of the beginning of the pcap record, and have the seek-read routine read the header and fill in the struct wtap_pkthdr handed to it. svn path=/trunk/; revision=49401
2013-03-25Wiretap file open routines should not free wth->priv on error, since thatEvan Huus1-9/+0
leads to a double-free in wtap_close. Fix all the instances I found via manual code review, and add a brief comment to the list of open routines in file_access.c Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8518 svn path=/trunk/; revision=48552
2012-12-27Do not call wtap_file_read_unknown_bytes() orGuy Harris1-4/+4
wtap_file_read_expected_bytes() from an open routine - open routines are supposed to return -1 on error, 0 if the file doesn't appear to be a file of the specified type, or 1 if the file does appear to be a file of the specified type, but those macros will cause the caller to return FALSE on errors (so that, even if there's an I/O error, it reports "the file isn't a file of the specified type" rather than "we got an error trying to read the file"). When doing reads in an open routine before we've concluded that the file is probably of the right type, return 0, rather than -1, if we get WTAP_ERR_SHORT_READ - if we don't have enough data to check whether a file is of a given type, we should keep trying other types, not give up. For reads done *after* we've concluded the file is probably of the right type, if a read doesn't return the number of bytes we asked for, but returns an error of 0, return WTAP_ERR_SHORT_READ - the file is apparently cut short. For NetMon and NetXRay/Windows Sniffer files, use a #define for the magic number size, and use that for both magic numbers. svn path=/trunk/; revision=46803
2012-10-16Add wtap_pseudo_header union to wtap_pkthdr structure.Jakub Zawadzki1-7/+8
Use pkthdr instead of pseudo_header as argument for dissecting. svn path=/trunk/; revision=45601
2012-09-20We always HAVE_CONFIG_H so don't bother checking whether we have it or not.Jeff Morriss1-2/+0
svn path=/trunk/; revision=45015
2012-07-19Addresses https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3895. Note ↵Michael Mann1-1/+3
that this doesn't write a Nokia file type properly, it just doesn't corrupt an existing one (read in by Wireshark) if resaved. svn path=/trunk/; revision=43815
2012-06-28Update Free Software Foundation address.Jakub Zawadzki1-1/+1
(COPYING will be updated in next commit) svn path=/trunk/; revision=43536
2012-05-28Interface lists currently have to be constructed in the open routineGuy Harris1-12/+17
(otherwise, nobody sees them); do so. Fix some cases where we weren't doing the proper post-processing after doing the heuristics for format changes that didn't involve magic-number changes (discovered because constructing the interface list is now being done as part of that post-processing). Fixes bug 7287. svn path=/trunk/; revision=42872
2012-05-24From Stephen Donnelly:Anders Broman1-0/+9
Add frame.interface_id support for pcap DLT_ERF file format https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7281 svn path=/trunk/; revision=42824
2012-05-04file_seek() used to be a wrapper around fseek() or gzseek(), both ofGuy Harris1-13/+10
which could use lseek() and were thus expensive due to system call overhead. To avoid making a system call for every packet on a sequential read, we maintained a data_offset field in the wtap structure for sequential reads. It's now a routine that just returns information from the FILE_T data structure, so it's cheap. Use it, rather than maintaining the data_offset field. Readers for some file formats need to maintain file offset themselves; have them do so in their private data structures. svn path=/trunk/; revision=42423
2012-04-13Remove doubled semicolons and semicolons outside function.Jakub Zawadzki1-1/+1
svn path=/trunk/; revision=42053
2012-02-25Add a presence flag field to the packet information structure filled inGuy Harris1-0/+2
by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2011-12-13Rename WTAP_ERR_BAD_RECORD to WTAP_ERR_BAD_FILE; it really reports anyGuy Harris1-5/+5
form of corruption/bogosity in a file, including in a file header as well as in records in the file. Change the error message wtap_strerror() returns for it to reflect that. Use it for some file header problems for which it wasn't already being used - WTAP_ERR_UNSUPPORTED shouldn't be used for that, it should only be used for files that we have no reason to believe are invalid but that have a version number we don't know about or some other non-link-layer-encapsulation-type value we don't know about. svn path=/trunk/; revision=40175
2011-09-01Merge pcap_fill_in_pseudo_header() into pcap_read_post_process().Guy Harris1-11/+5
svn path=/trunk/; revision=38844
2011-09-01Use guint8 rather than guchar for raw octets and pointers to arrays ofGuy Harris1-53/+13
same. Add to wiretap/pcap-common.c a routine to fill in the pseudo-header for ATM (by looking at the VPI, VCI, and packet data, and guessing) and Ethernet (setting the FCS length appropriately). Use it for both pcap and pcap-ng files. svn path=/trunk/; revision=38840
2011-06-09Make sure we don't write invalid record lengths.Gerald Combs1-0/+6
svn path=/trunk/; revision=37634
2011-04-21Add a new WTAP_ERR_DECOMPRESS error, and use that for errors discoveredGuy Harris1-9/+11
by the gunzipping code. Have it also supply a err_info string, and report it. Have file_error() supply an err_info string. Put "the file" - or, for WTAP_ERR_DECOMPRESS, "the compressed file", to suggest a decompression error - into the rawshark and tshark errors, along the lines of what other programs print. Fix a case in the Netscaler code where we weren't fetching the error code on a read failure. svn path=/trunk/; revision=36748
2011-04-12"This file format can't be written to a pipe" and "this file formatGuy Harris1-1/+1
can't be saved in compress form" are both equivalent to "this file file format requires seeking when writing it". Change the "can compress" Boolean in the file format table to "writing requires seeking", give all the entries the proper value, and do the checks for attempting to write a file format to a pipe or write it in compressed format to common code. This means we don't need to pass the "can't seek" flag to the dump open routines. svn path=/trunk/; revision=36575
2011-04-06From Jakub Zawadzki:Guy Harris1-4/+4
file_read(buf, bsize, count, file) macro is compilant with fread function and takes elements count+ size of each element, however to make it compilant with gzread() it always returns number of bytes. In wiretap file_read() this is not really used, file_read is called either with bsize set to 1 or count to 1. Attached patch remove bsize argument from macro. svn path=/trunk/; revision=36491
2010-06-06Rename wtap_dump_file_write_all() to wtap_dump_file_write(), and haveGuy Harris1-30/+4
everybody use it; the places using the old wtap_dump_file_write() were using it in the same way the old wtap_dump_file_write_all() did. That also lets us get rid of wtap_dump_file_ferror(). Also, have the new wtap_dump_file_write() check for errors from gzwrite() and fwrite() differently - the former returns 0 on error, the latter can return a short write on error. svn path=/trunk/; revision=33113
2010-04-21From Chris Maynard:Guy Harris1-4/+7
Support PPP-over-USB. Don't remove the USB pseudo-header from the packet data for Linux USB packets, just byte-swap it if necessary and have the USB dissector fetch the pseudo-header from the raw packet data. Update USB language ID values. svn path=/trunk/; revision=32534
2010-02-26Move the definitions of all the private data structures out ofGuy Harris1-21/+13
wtap-int.h, and change the unions of pointers to those private data structures into just void *'s. Have the generic wtap close routine free up the private data, rather than the type-specific close routine, just as the wtap_dumper close routine does for its private data. Get rid of close routines that don't do anything any more. svn path=/trunk/; revision=32015
2010-02-24Define the private data structures for some particular capture fileGuy Harris1-23/+49
types in the modules for those capture file types, not in wtap-int.h, so wtap-int.h doesn't have to change when the code to handle that particular capture type changes, or a new capture file type is added. (Ultimately, we should do this for all the private data structures.) svn path=/trunk/; revision=31974
2010-02-23Move the declarations of wtap_pcap_encap_to_wtap_encap() andGuy Harris1-0/+1
wtap_wtap_encap_to_pcap_encap() to wiretap/pcap-encap.h. Include it where it's needed; don't include other Wiretap headers where they're not needed. Include pcapng.h in pcapng.c, to declare the functions defined in pcapng.c. Add some casts to squelch some warnings, and add to a comment to indicate one of the problems. svn path=/trunk/; revision=31960
2010-01-27Fix a comment.Guy Harris1-4/+6
svn path=/trunk/; revision=31693
2009-09-25Treat 13 as if it came from OpenBSD except on BSD/OS, so that if thereGuy Harris1-27/+12
are any BSD/OS users still out there using Wireshark to read RFC 1483 ATM captures from BSD/OS, they can still do so, but all other users get to read OpenBSD DLT_ENC captures, not just users *on* OpenBSD. That also lets us simplify some hacks to deal with a link-layer type of 13 on Nokia IPSO captures. svn path=/trunk/; revision=30159
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-04 02:16:28 +0000