summaryrefslogtreecommitdiff
path: root/wiretap/merge.c
AgeCommit message (Collapse)AuthorFilesLines
2017-06-05Allow bigger snapshot lengths for D-Bus captures.Guy Harris1-3/+3
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for them, because that's the largest possible D-Bus message size. See https://bugs.freedesktop.org/show_bug.cgi?id=100220 for an example of the problems caused by limiting the snapshot length to 256KB for D-Bus. Have a snapshot length of 0 in a capture_file structure mean "there is no snapshot length for the file"; we don't need the has_snap field in that case, a value of 0 mean "no, we don't have a snapshot length". In dumpcap, start out with a pipe buffer size of 2KB, and grow it as necessary. When checking for a too-big packet from a pipe, check against the appropriate maximum - 128MB for DLT_DBUS, 256KB for everything else. Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20 Reviewed-on: https://code.wireshark.org/review/21952 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-03Don't keep the pcap/pcapng link-layer header type as interface data.Guy Harris1-8/+0
Either 1) it can be determined from the libwiretap encapsulation type, in which case it's redundant information or 2) there *is* no pcap/pcapng link-layer header type for that encapsulation type, in which case you need to check for the attempt to determine it failing and handle that failure appropriately. Change-Id: Ie9557b513365c1fc8c6df74b9c8239e29aad46bc Reviewed-on: https://code.wireshark.org/review/21924 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-20Take the error message generation out of the merge_files routines.Guy Harris1-206/+36
Have them just return the information needed for the caller to produce an error message, and have the callers use the new cfile_ routines for reporting errors. This requires that the "write failure alert box" routine take the *input* file name as an argument, so that, on a merge, if the problem is that a record from a given input file can't be written out to the type of output file we're generating, the input file name can be given, along with the record number in that file. Change-Id: If5a5e00539e7e652008a523dec92c0b359a48e71 Reviewed-on: https://code.wireshark.org/review/21257 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-12-04Have separate merge APIs for regular file/temporary file/standard output.Guy Harris1-88/+304
This is similar to what we have for opening a dump file - one API that uses the file name as specified, one that creates a temporary file and provides the file name, and one that uses the standard output. All of those APIs handle closing the output file. Change-Id: I56beea7be347402773460b9148ab31a8f8bc51e1 Reviewed-on: https://code.wireshark.org/review/19059 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-12-04Remove unnecessary cast (gchar = char) that removes const.Guy Harris1-1/+1
Change-Id: I3924c2b4a525c0ae5ab57b7f9867296586d78509 Reviewed-on: https://code.wireshark.org/review/19061 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-10-27merge.c: do not give a NULL pointer when saving SHB comment optionPascal Quantin1-1/+3
Bug: 13060 Change-Id: Ib3dd019f73305e4006b312d324502e4a138c6a16 Reviewed-on: https://code.wireshark.org/review/18514 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-27If we don't get any OS information, remove the old OS information.Guy Harris1-0/+5
The old information is copied over from one of the input files; if we don't have information about the OS on the machine writing the *output* file, just throw the old information away. (We need a better way to preserve information from the input files; perhaps this: http://www.winpcap.org/pipermail/pcap-ng-format/2016-June/000362.html might work.) Change-Id: Ia25771736d267173f2b6949a91e81e217ee7d16f Reviewed-on: https://code.wireshark.org/review/16730 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-26Ensure to have a valid string pointer when writing OS SHB optionPascal Quantin1-2/+7
Change-Id: Ib0b6dcdf1700e88383d30bf43739312fce10e1c7 Reviewed-on: https://code.wireshark.org/review/16696 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-07-21Don't pass NULL to wtap_block_set_string_option_value().Guy Harris1-4/+2
To remove OPT_SHB_HARDWARE, use wtap_block_remove_option(). To get the string value from a GString, use g_string_free(string, FALSE), not g_string_free(string, TRUE) - the latter will free the string value and return NULL. Change-Id: I0c5a9f818543f6752f455f04fb3c024208e23954 Reviewed-on: https://code.wireshark.org/review/16567 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-21No need to check for string option values being null.Guy Harris1-1/+1
A string option, if present, always has a value; it might be a null *string*, but you won't get a null pointer (if the option isn't present, it simply isn't present). Fix some comments while we're at it. Change-Id: I9c1420f56998a7d04de5c5cc2e92631b181f303a Reviewed-on: https://code.wireshark.org/review/16564 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-15Fix the snapshot length part of the "same interface?" check.Guy Harris1-12/+24
Fix a typo - compare for unequal snapshot lengths, not equal snapshot lengths. Also, move the debug messages about checks right above the checks. Change-Id: If6f5e125f05f3788b63e9f75d98f55e27830870b Reviewed-on: https://code.wireshark.org/review/16470 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-14Redo the block options APIs.Guy Harris1-85/+156
A block can have zero or more instances of a given option. We distinguish between "one instance only" options, where a block can have zero or one instance, and "multiple instances allowed" options, where a block can have zero or more instances. For "one instance only" options: "add" routines add an instance if there isn't one already and fail if there is; "set" routines add an instance if there isn't one already and change the value of the existing instance if there is one; "set nth" routines fail; "get" routines return the value of the instance if there is one and fail if there isn't; "get nth" routines fail. For "multiple instances allowed" options: "add" routines add an instance; "set" routines fail; "set nth" routines set the value of the nth instance if there is one and fail otherwise; "get" routines fail; "get nth" routines get the value if the nth instance if there is one and fail otherwise. Rename "optionblock" to just "block"; it describes the contents of a block, including both mandatory items and options. Add some support for NRB options, including IPv4 and IPv6 option types. Change-Id: Iad184f668626c3d1498b2ed00c7f1672e4abf52e Reviewed-on: https://code.wireshark.org/review/16444 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-15Don't map the interface ID for records that don't pertain to an interface.Guy Harris1-5/+11
And revert to the previous behavior of map_phdr_interface_id(); that change broke the mergecap tests when it was merging pcap files into a pcapng file. Change-Id: I2e079b0e87dce06e98faa9ab7615f9b9b2701b77 Reviewed-on: https://code.wireshark.org/review/15932 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-15More Sysdig / system event support.Gerald Combs1-1/+4
Add REC_TYPE_SYSCALL to wiretap and use it for Sysdig events. Call the Sysdig event dissector from the frame dissector. Create a "syscall" protocol for system calls, but add "frame" items to it for now. Add the ability to write Sysdig events. This lets us merge packet capture and syscall capture files. Change-Id: I12774ec69c89d8e329b6130c67f29aade4e3d778 Reviewed-on: https://code.wireshark.org/review/15078 Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-01Add data structures necessary to support multiple Section Header blocks.Michael Mann1-8/+10
This doesn't try to use any data from multiple Section Header blocks, it just converts single Section Header block usage into a GArray, so the potential is there to then use/support multiple Section Header blocks within a file format (like pcapng) Change-Id: I6ad1f7b8daf4b1ad7ba0eb1ecf2e170421505486 Reviewed-on: https://code.wireshark.org/review/15636 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-05-22Add wtap_optionblock_set_option_string_formatMichael Mann1-4/+7
Also add a length parameter to wtap_optionblock_set_option_string Change-Id: I8c7bbc48aa96b5c2a91ab9a17980928d6894f1ee Reviewed-on: https://code.wireshark.org/review/15505 Reviewed-by: Anthony Coddington <anthony.coddington@endace.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-25Clean up modelines and indentation.Guy Harris1-3/+3
HT tab stops are set every 8 spaces on UN*X; UN*X tools that treat an HT character as tabbing to 4-space tab stops, or that even are configurable but *default* to 4-space tab stops (I'm looking at *you*, Xcode!) are broken. tab-width: 4, tabstop=4, and tabSize=4 are errors if you ever expect anybody to look at your file with a UN*X tool, and every text file will probably be looked at by a UN*X tool at some point, so Don't Do That. Adjust indentation to reflect the mode lines. Change-Id: Icf0831717de10fc615971fa1cf75af2f1ea2d03d Reviewed-on: https://code.wireshark.org/review/14150 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-23Making wiretap option blocks more generic.Michael Mann1-85/+116
This was inspired by https://code.wireshark.org/review/9729/, but takes it in a different direction where all options are put into an array, regardless of whether they are "standard" or "custom". It should be easier to add "custom" options in this design. Some, but not all blocks have been converted. Descriptions of some of the block options have been moved from wtap.h to pcapng.h as it seems to be the one that implements the description of the blocks. Also what could be added/refactored is registering block behavior. Change-Id: I3dffa38f0bb088f98749a4f97a3b7655baa4aa6a Reviewed-on: https://code.wireshark.org/review/13667 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-11Make file indices consistently unsigned in the merge code.Guy Harris1-6/+6
Change-Id: Ie531e5c24c32ca86abbe0c2b5d3526014e5fb831 Reviewed-on: https://code.wireshark.org/review/13897 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-11Avoid undefined behavior in overflow checkMichael McConville1-1/+1
Signed overflow is undefined, so testing for overflow with "if (i + 1 < i)" is itself undefined. Because this instance is an increment, we can just test against G_MAXINT. Change-Id: Ib8b7c23ec362d5637125fcf6457ea9423fedf0e1 Reviewed-on: https://code.wireshark.org/review/13896 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-23merge: fix parameter 'in_files/in_count_files' not found in the function ↵Alexis La Goutte1-6/+6
declaration [-Wdocumentation] Change-Id: Ib3d9b7df5f1396179645456ea7359e711c26b8ef Reviewed-on: https://code.wireshark.org/review/12003 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-11-11Make routines used only within wiretap/merge.c static.Guy Harris1-43/+46
We just export some UI helpers and the Big Merge Engine. Change-Id: I60bc8ab167e7100189a9ce60d84c0e4db27b6bda Reviewed-on: https://code.wireshark.org/review/11689 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-10Fix typo.Guy Harris1-1/+1
Change-Id: I417de6124925dbfd9599ec7e90e287eb971457a3 Reviewed-on: https://code.wireshark.org/review/11687 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-10-05Allow use of variadic macrosPeter Wu1-34/+28
Remove variadic macros restriction (c99, c++11 feature) from README.developer. GCC, Clang, MSVC 2005 all support it. Enable -Wno-variadic-macros in configure.ac and CMakeLists.txt when -Wpedantic is enabled (which would enable -Wvariadic-macros). For all files matching 'define\s*\w+[0-9]\(', replace "FOO[0-9]" by "FOO" and adjust the macro definition accordingly. The nbap dissector was regenerated after adjusting its template and .cnf file. The generated code is the same since all files disabled the debug macros. Discussed at: https://www.wireshark.org/lists/wireshark-dev/201209/msg00142.html https://www.wireshark.org/lists/wireshark-dev/201510/msg00012.html Change-Id: I3b2e22487db817cbbaac774a592669a4f44314b2 Reviewed-on: https://code.wireshark.org/review/10781 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-08-21Fix memory leaks of dumper SHB and IDB infosHadriel Kaplan1-5/+15
Change-Id: I6b81d3e853d503c6a81f9793957b48ab34c6808c Reviewed-on: https://code.wireshark.org/review/10156 Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-19Pcap: wtap does not set interface timestamp precision when reading pcapHadriel Kaplan1-1/+1
Like bug 11447, when wiretap reads a legacy PCAP file it needs to set the interface description's tsprecision member. And like bug 11447, I'm wondering why we have the field to begin with. But I'm fixing this so that the Windows buildbots can get going again. Change-Id: I71d0fe2e999ee7d11f1f5cc424681a99e17b1b1b Reviewed-on: https://code.wireshark.org/review/10139 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
2015-08-19Add more debug infor for windows buildbot test suite failureHadriel Kaplan1-0/+27
Down the rabbit hole we go... Change-Id: I8371b95b85128209b56960eb6e54648a6babbb84 Reviewed-on: https://code.wireshark.org/review/10137 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
2015-08-19Try to debug merge test suite failure on windows buildbotHadriel Kaplan1-0/+30
This change will be undone once the problem is found. Change-Id: Ica9cfe31b4e30fad2bb9de508af61baa1c455cc1 Reviewed-on: https://code.wireshark.org/review/10136 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
2015-08-18Improve file merging for mergecap and wiresharkHadriel Kaplan1-6/+704
Refactor the file merging code by removing the duplicate logic from mergecap.c and file.c's cf_merge_files(), into a new merge_files() function in merge.c. Also the following user-visible changes: * Removed the '-T' encap type option from mergecap, as it's illogical for mergecap and would complicate common merge code. * Input files with IDBs of different name, speed, tsprecision, etc., will produce an output PCAPNG file with separate IDBs, even if their encap types are the same. * Added a '-I' IDB merge mode option for mergecap, to control how IDBs are merged. * Changed Wireshark's drag-and-drop merging to use PCAPNG instead of PCAP. Bug: 8795 Bug: 7381 Change-Id: Icc30d217e093d6f40114422204afd2e332834f71 Reviewed-on: https://code.wireshark.org/review/10058 Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-08-14Ident the merge.c/h files by 4 spacesHadriel Kaplan1-141/+141
Using 2 spaces for indent is way past its prime. Change-Id: I80caf89f15e576f9aeb25754576a9f18215ccb3c Reviewed-on: https://code.wireshark.org/review/10032 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com>
2015-02-28Remove some unneeded includes of <sys/time.h>.Guy Harris1-4/+0
Change-Id: I9e4e6efa9f8c7dbff7627f8d5fc3278ab383618d Reviewed-on: https://code.wireshark.org/review/7441 Petri-Dish: Guy Harris <guy@alum.mit.edu> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-01-03Remove unnecessary includes from wiretap folderMartin Mathieson1-2/+0
Change-Id: I10d3057801673bc1c8ea78f144215869cc4b1851 Reviewed-on: https://code.wireshark.org/review/6217 Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com> Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-02Add "Editor modelines"; Adjust whitespace as needed.Bill Meier1-0/+13
Change-Id: Ic5a5acb0f36d3aa144edbfb1ae71097b18426db4 Reviewed-on: https://code.wireshark.org/review/6216 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-09-22Try to fix some buildbot warningsMichal Labedzki1-2/+3
Most interesting are: warning: cannot optimize loop, the loop counter may overflow [-Wunsafe-loop-optimizations] warning: ISO C forbids zero-size array [-Wpedantic] warning: ISO C90 doesn't support unnamed structs/unions [-Wpedantic] warning: cast discards '__attribute__((const))' qualifier from pointer target type [-Wcast-qual warning: initializer element is not computable at load time [enabled by default] Change-Id: I5573c6bdca856a304877d9bef643f8c0fa93cdaf Reviewed-on: https://code.wireshark.org/review/3174 Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2014-05-09Revert "Refactor Wiretap"Guy Harris1-14/+13
This reverts commit 1abeb277f5e6bd27fbaebfecc8184e37ba9d008a. This isn't building, and looks as if it requires significant work to fix. Change-Id: I622b1bb243e353e874883a302ab419532b7601f2 Reviewed-on: https://code.wireshark.org/review/1568 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09Refactor WiretapMichael Mann1-13/+14
Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality. The "architectural" changes can be found in cfile.h, wtap.h, wtap-int.h and (new file) wftap-int.h. Most of the other (painstaking) changes were really just the result of compiling those new architecture changes. bug:9607 Change-Id: Ife858a61760d7a8a03be073546c0e7e582cab2ae Reviewed-on: https://code.wireshark.org/review/1485 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-02-25Wireshark: Add option to choose format type of capture fileMichal Labedzki1-1/+1
The best heuristic can fail, so add possibility to manually choose capture file format type, so not correctly recognize file format can be loaded in Wireshark. On the other side now it is possible to open capture file as file format to be dissected. Change-Id: I5a9f662b32ff7e042f753a92eaaa86c6e41f400a Reviewed-on: https://code.wireshark.org/review/16 Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com> Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com> Reviewed-by: Evan Huus <eapache@gmail.com> Tested-by: Evan Huus <eapache@gmail.com>
2013-11-09Replace wtap_nstime with nstime_t, remove wtap_nstime_to_sec.Jakub Zawadzki1-2/+3
After r50154 nstime_t is inside wsutil/ so wiretap don't need it's own copy. svn path=/trunk/; revision=53184
2013-07-16Move merge.{h,c} into wiretap: these modules use wiretap to merge files.Jeff Morriss1-0/+286
svn path=/trunk/; revision=50656
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-18 22:06:04 +0000