summaryrefslogtreecommitdiff
path: root/wiretap/ngsniffer.c
AgeCommit message (Collapse)AuthorFilesLines
2017-06-05Allow bigger snapshot lengths for D-Bus captures.Guy Harris1-1/+1
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for them, because that's the largest possible D-Bus message size. See https://bugs.freedesktop.org/show_bug.cgi?id=100220 for an example of the problems caused by limiting the snapshot length to 256KB for D-Bus. Have a snapshot length of 0 in a capture_file structure mean "there is no snapshot length for the file"; we don't need the has_snap field in that case, a value of 0 mean "no, we don't have a snapshot length". In dumpcap, start out with a pipe buffer size of 2KB, and grow it as necessary. When checking for a too-big packet from a pipe, check against the appropriate maximum - 128MB for DLT_DBUS, 256KB for everything else. Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20 Reviewed-on: https://code.wireshark.org/review/21952 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-09-28Use wtap_read_bytes() to skip over bytes when reading a record.Guy Harris1-13/+11
Allow file_read() to take a null pointer as a buffer argument; a null argument means "do everything except copy the bytes from the file to the user buffer". That means that wtap_read_bytes() and wtap_read_bytes_or_eof() also support a null pointer as a buffer argument. Use wtap_read_bytes() with a null buffer argument rather than file_skip() to skip forward over data. This fixes some places where files were mis-identified as ERF files, as the ERF open heuristics now get a short "read" error if they try to skip over more bytes than exist in the file. Change-Id: I4f73499d877c1f582e2bcf9b045034880cb09622 Reviewed-on: https://code.wireshark.org/review/17974 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-24Fix shadow variable warnings.Michael Mann1-3/+3
Change-Id: I1e6bd722b3f04f171b462fc680ca080bb7ec03c7 Reviewed-on: https://code.wireshark.org/review/16625 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-06*_stdup_printf -> strdup for "single string only" formatting.Michael Mann1-2/+2
Done for performance improvements. This could probably be done in checkAPIs.pl, but this was just a quick manual check with grepping. Change-Id: I91ff102cb528bb00fa2f65489de53890e7e46f2d Reviewed-on: https://code.wireshark.org/review/15751 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2016-04-30Note some cases where we don't need to check the packet length.Guy Harris1-0/+5
These file formats have 16-bit packet lengths, so, even with some extra metadata added, the packet data length will never be bigger than WTAP_MAX_PACKET_SIZE. (No, we won't ever reduce WTAP_MAX_PACKET_SIZE.) Change-Id: I9e1b1d90971f91cc6e5d66d0aa93841445b2bc22 Reviewed-on: https://code.wireshark.org/review/15186 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-08Note that sometimes the packet time stamps are relative to the start time.Guy Harris1-2/+7
Change-Id: Ie248559cd924db611190a73e3f043e047421ab7f Reviewed-on: https://code.wireshark.org/review/13117 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-21Squelch another warning.Guy Harris1-1/+1
Change-Id: I7340954d9ca2fd11a6db2aa7cd5493d870181e23 Reviewed-on: https://code.wireshark.org/review/12765 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-21Squelch some compiler warnings.Guy Harris1-3/+3
Change-Id: Iee46c43498f42e19dfab0178e80743d35d843d2d Reviewed-on: https://code.wireshark.org/review/12762 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-21Rename some variables to make it a bit clearer what they are.Guy Harris1-31/+31
rec_length_remaining is the amount of data we haven't already read from the record; it starts out as the record length and gets decreased. It is not the length of data in the packet. Change-Id: I46cd78e29aee13a686f1f6c8efbe258277e15686 Reviewed-on: https://code.wireshark.org/review/12759 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-20Add bounds checks and fix a length argument.Guy Harris1-15/+34
Before reading the record header of a REC_FRAME{2,4,6} record, make sure the record length is >= the length of that header. Whe calling fix_pseudo_header(), pass the actual length of the packet data, not the remaining length of the record (which may include padding), so we don't read past the end of the packet data. Bug: 11827 Change-Id: I1c63a4cb014c4616ffdd202660e68c576f266872 Reviewed-on: https://code.wireshark.org/review/12756 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-17Misc minor issues caught by cppcheckEvan Huus1-2/+0
All trivial (unused variables, duplicate `break`s, etc). Change-Id: Idbfffae4f6c0b0119a90ae5849de2ed7a1180c9b Reviewed-on: https://code.wireshark.org/review/11886 Petri-Dish: Evan Huus <eapache@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Evan Huus <eapache@gmail.com>
2015-11-09Call the dumper routine to finish write a file the "finish" routine.Guy Harris1-3/+3
It doesn't actually *close* any handle, so it's best called a "finish" routine rather than a "close" routine. In libwiretap modules, don't bother setting the finish routine pointer to null - it's already initialized to null (it's probably best not to require modules to set it). Change-Id: I19554f3fb826db495f17b36600ae36222cbc21b0 Reviewed-on: https://code.wireshark.org/review/11659 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-01-03Remove unnecessary includes from wiretap folderMartin Mathieson1-2/+0
Change-Id: I10d3057801673bc1c8ea78f144215869cc4b1851 Reviewed-on: https://code.wireshark.org/review/6217 Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com> Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-02Add "Editor modelines"; Adjust whitespace as needed.Bill Meier1-0/+13
Change-Id: Ic5a5acb0f36d3aa144edbfb1ae71097b18426db4 Reviewed-on: https://code.wireshark.org/review/6216 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-12-18Rename WTAP_ERR_REC_TYPE_UNSUPPORTED to WTAP_ERR_UNWRITABLE_REC_TYPE.Guy Harris1-1/+1
That indicates that it's a problem specific to *writing* capture files; we've already converted some errors to that style, and added a new one in that style. Change-Id: I8268316fd8b1a9e301bf09ae970b4b1fbcb35c9d Reviewed-on: https://code.wireshark.org/review/5826 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-18Handle "I can't map this for that file format" better.Guy Harris1-2/+2
For cases where record (meta)data is something that can't be written out in a particular file format, return WTAP_ERR_UNWRITABLE_REC_DATA along with an err_info string. Report (and free) that err_info string in cases where WTAP_ERR_UNWRITABLE_REC_DATA is returned. Clean up some other error reporting cases, and flag with an XXX some cases where we aren't reporting errors at all, while we're at it. Change-Id: I91d02093af0d42c24ec4634c2c773b30f3d39ab3 Reviewed-on: https://code.wireshark.org/review/5823 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17Rename WTAP_ERR_UNSUPPORTED_ENCAP to WTAP_ERR_UNWRITABLE_ENCAP.Guy Harris1-1/+1
That makes it clearer what the problem is, and that it should only be returned by the dump code path, not by the read code path. Change-Id: Icc5c9cff43be6c073f0467607555fa7138c5d074 Reviewed-on: https://code.wireshark.org/review/5797 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17Use WTAP_ERR_UNSUPPORTED for input file stuff we can't handle.Guy Harris1-6/+6
WTAP_ERR_UNSUPPORTED_ENCAP means "I can't *write* that particular encapsulation type to a file of this format", which mainly means "that file format simply can't handle packets of that type"; WTAP_ERR_UNSUPPORTED means "this file can't currently be supported by Wireshark, as there's some feature in the file - such as a file or per-packet encapsulation type - that we don't (yet) handle". Change-Id: I53cadf9913d20efb2bccb29f61877b71d53807be Reviewed-on: https://code.wireshark.org/review/5794 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-11Use the wtap_read_bytes{_or_eof}() routines.Guy Harris1-77/+57
Change-Id: I4f707bc714b2643d0f6c568f3367e712ee635d8e Reviewed-on: https://code.wireshark.org/review/4612 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-09Use an enum for the open-routine return value, as per Evan Huus's suggestion.Guy Harris1-13/+13
Clean up some things we ran across while making those changes. Change-Id: Ic0d8943d36e6e120d7af0a6148fad98015d1e83e Reviewed-on: https://code.wireshark.org/review/4581 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-08Use WTAP_ERR_DECOMPRESS for decompression errors.Guy Harris1-4/+4
Distringuish "the compression data has a problem" from "the capture file (not compressed, or after decompression) data has a problem", with WTAP_ERR_DECOMPRESS used for the former (whether it's the gzipping decoded by our gunzip code or the Sniffer compression) and WTAP_ERR_BAD_FILE used for the latter. Change-Id: I8e6bff7edb480deba00c52a9e5afff607492e085 Reviewed-on: https://code.wireshark.org/review/4568 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-08Use WTAP_ERR_BAD_FILE for malformed compressed data in DOS Sniffer files.Guy Harris1-7/+13
Get rid of WTAP_ERR_UNC_TRUNCATED and WTAP_ERR_UNC_BAD_OFFSET, and lump them under WTAP_ERR_BAD_FILE, with an error string; they're just another form of "this file isn't a valid file of the type in question". Change-Id: I0e9ac7c2ee66c8d789234a301c1dc2173aef1312 Reviewed-on: https://code.wireshark.org/review/4562 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07No need for WTAP_ERR_CANT_READ.Guy Harris1-8/+0
Unlike the standard I/O routines, the code we introduced that supports fast random seeking on gzipped files will always supply some specific error code for read errors, so we don't need WTAP_ERR_CANT_READ. Add WTAP_ERR_CANT_WRITE for writing, as we're still using the standard I/O routines for that. Set errno to WTAP_ERR_CANT_WRITE before calling fwrite() in wtap_dump_file_write(), so that it's used if fwrite() fails without setting errno. Change-Id: I6bf066a6838284a532737aa65fd0c9bb3639ad63 Reviewed-on: https://code.wireshark.org/review/4540 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07Make the code a bit more like the pre-new-APIs code.Guy Harris1-3/+3
Change-Id: I40282d8825936d24480c9b77e2e7d9374b1de6b5 Reviewed-on: https://code.wireshark.org/review/4534 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07Add some higher-level file-read APIs and use them.Guy Harris1-47/+13
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an error number pointer, and an error string pointer as arguments, and that treats a short read of any sort, including a read that returns 0 bytes, as a WTAP_ERR_SHORT_READ error, and that returns the error number and string through its last two arguments. Add wtap_read_bytes_or_eof(), which is similar, but that treats a read that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF indication. Use those in file readers; that simplifies the code and makes it less likely that somebody will fail to supply the error number and error string on a file read error. Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210 Reviewed-on: https://code.wireshark.org/review/4512 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-04Use some macros to clean up the Snifer decompression code.Guy Harris1-92/+91
For code that's used in more than one place, use macros. This combines a bunch of checks into the output macros. Change-Id: Ic32dce75e1c531fd28bfed180856e230277bfe58 Reviewed-on: https://code.wireshark.org/review/4451 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-09-28Make the time stamp resolution per-packet.Guy Harris1-1/+1
Pcap-ng files don't have a per-file time stamp resolution, they have a per-interface time stamp resolution. Add new time stamp resolution types of "unknown" and "per-packet", add the time stamp resolution to struct wtap_pkthdr, have the libwiretap core initialize it to the per-file time stamp resolution, and have pcap-ng do the same thing with the resolution that it does with the packet encapsulation. Get rid of the TS_PREC_AUTO_XXX values; just have TS_PREC_AUTO, which means "use the packet's resolution to determine how many significant digits to display". Rename all the WTAP_FILE_TSPREC_XXX values to WTAP_TSPREC_XXX, as they're also used for per-packet values. Change-Id: If9fd8f799b19836a5104aaa0870a951498886c69 Reviewed-on: https://code.wireshark.org/review/4349 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-09-24Fix presumed cut-and-pasteo.Guy Harris1-3/+2
On errors *other* than a short read, we were driving on and processing the non-data that we didn't read. Change-Id: I6289ddf31ff7896918a030af9d1261bdc194e7d3 Reviewed-on: https://code.wireshark.org/review/4270 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-09-16Fix spelling: cant-->can't, wont-->won't, etcBill Meier1-1/+1
Change-Id: Ia6c3e7a25615bf8e052c3bacf096d76df775c9c2 Reviewed-on: https://code.wireshark.org/review/4126 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-09-11Add some additional checks in SnifferDecompress().Guy Harris1-10/+29
Check the input pointer in the while clause of the loop, so that we handle an empty input buffer. When reading a bit mask, check before fetching the bit mask that we have two bytes of bit mask and the byte after it. Before putting an uncompressed input byte into the output, make sure we wouldn't run past the end of the output buffer. Before copying an earlier string from the output buffer, make sure it doesn't run past the end of the data we've decompressed so far. Bug: 10461 Change-Id: I8bb8d0d291368ae8bf0ac26970ff54d3262a7e6e Reviewed-on: https://code.wireshark.org/review/4083 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-08-02Rename buffer_ routines to ws_buffer_ to avoid name collisions.Guy Harris1-3/+3
In particular, epan/wslua/lrexlib.c has its own buffer_ routines, causing some linker warnings on some platforms, as reported in bug 10332. (Not to be backported to 1.12, as that would change the API and ABI of libwsutil and libwiretap. We should also make the buffer_ routines in epan/wslua/lrexlib.c static, which should also address this problem, but the name change avoids other potential namespace collisions.) Change-Id: I1d42c7d1778c7e4c019deb2608d476c52001ce28 Reviewed-on: https://code.wireshark.org/review/3351 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-07-15Only one buffer.c, please.Guy Harris1-1/+1
Otherwise, if you link with both libwiretap and libfiletap, it's anybody's guess which one you get. That means you're wasting memory with two copies of its routines if they're identical, and means surprising behavior if they're not (which showed up when I was debugging a double-free crash - fixing libwiretap's buffer_free() didn't fix the problem, because Wireshark happened to be calling libfiletap' unfixed buffer_free()). There's nothing *tap-specific about Buffers, anyway, so it really belongs in wsutil. Change-Id: I91537e46917e91277981f8f3365a2c0873152870 Reviewed-on: https://code.wireshark.org/review/3066 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-24Allow wtap_read() and wtap_seek_read() to return records other than packets.Guy Harris1-0/+7
Add a "record type" field to "struct wtap_pkthdr"; currently, it can be REC_TYPE_PACKET, for a record containing a packet, or REC_TYPE_FILE_TYPE_SPECIFIC, for records containing file-type-specific data. Modify code that reads packets to be able to handle non-packet records, even if that just means ignoring them. Rename some routines to indicate that they handle more than just packets. We don't yet have any libwiretap code that supplies records other than REC_TYPE_PACKET or that supporting writing records other than REC_TYPE_PACKET, or any code to support plugins for handling REC_TYPE_FILE_TYPE_SPECIFIC records; this is just the first step for bug 8590. Change-Id: Idb40b78f17c2c3aea72031bcd252abf9bc11c813 Reviewed-on: https://code.wireshark.org/review/1773 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23Revert "Allow wtap_read() and wtap_seek_read() to return non-packet records."Guy Harris1-13/+13
This reverts commit c0c480d08c175eed4524ea9e73ec86298f468cf4. A better way to do this is to have the record type be part of struct wtap_pkthdr; that keeps the metadata for the record together and requires fewer API changes. That is in-progress. Change-Id: Ic558f163a48e2c6d0df7f55e81a35a5e24b53bc6 Reviewed-on: https://code.wireshark.org/review/1741 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23Allow wtap_read() and wtap_seek_read() to return non-packet records.Guy Harris1-13/+13
This is the first step towards implementing the mechanisms requestd in bug 8590; currently, we don't return any records other than packet records from libwiretap, and just ignore non-packet records in the rest of Wireshark, but this at least gets the ball rolling. Change-Id: I34a45b54dd361f69fdad1a758d8ca4f42d67d574 Reviewed-on: https://code.wireshark.org/review/1736 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09Revert "Refactor Wiretap"Guy Harris1-126/+123
This reverts commit 1abeb277f5e6bd27fbaebfecc8184e37ba9d008a. This isn't building, and looks as if it requires significant work to fix. Change-Id: I622b1bb243e353e874883a302ab419532b7601f2 Reviewed-on: https://code.wireshark.org/review/1568 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09Refactor WiretapMichael Mann1-123/+126
Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality. The "architectural" changes can be found in cfile.h, wtap.h, wtap-int.h and (new file) wftap-int.h. Most of the other (painstaking) changes were really just the result of compiling those new architecture changes. bug:9607 Change-Id: Ife858a61760d7a8a03be073546c0e7e582cab2ae Reviewed-on: https://code.wireshark.org/review/1485 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-01-26Drop support of Visual Studio 2005Alexis La Goutte1-8/+0
* Remove _MSC_VER < 1500 check * Cleanup config.nmake See http://www.wireshark.org/lists/wireshark-dev/201305/msg00159.html svn path=/trunk/; revision=54965
2014-01-22Don't write out packets that have a "captured length" bigger than we'reGuy Harris1-0/+7
willing to read or that's bigger than will fit in the file format; instead, report an error. For the "I can't write a packet of that type in that file type" error, report the file type in question. svn path=/trunk/; revision=54882
2014-01-02No seek-read routines use the length argument, so eliminate it fromGuy Harris1-4/+2
wtap_seek_read(). svn path=/trunk/; revision=54570
2014-01-02Process the packet header and data in common code, shared by the readGuy Harris1-297/+246
and seek-read routines. svn path=/trunk/; revision=54548
2014-01-01If the uncompression buffers are empty, they have no data; set the countGuy Harris1-0/+4
of bytes in them to 0, as there's no data in them, and set the offset in that buffer of the stream's current position, to 0, as we're currently at the beginning of the file in both streams. This fixes some tricky-to-reproduce errors (which show up only if the ngsniffer_t structure is allocated from data that's been allocated, written to in those variables, and freed). #BACKPORT 1.8, 1.10 svn path=/trunk/; revision=54544
2014-01-01Back out r54523 - more work is needed on it, and some testing found anGuy Harris1-12/+4
unrelated uninitialized-data bug that I want to fix in the next commit, and then backport. svn path=/trunk/; revision=54543
2013-12-31When reading sequentially, pass the packet data length toGuy Harris1-4/+12
ngsniffer_read_rec_data(), and separatelyskip extra data after that. When reading randomly, use the packet length read from the packet header. svn path=/trunk/; revision=54523
2013-12-20Change G_GINT64_CONSTANT(xxxxU) to G_GUINT64_CONSTANT(xxxx)Jakub Zawadzki1-4/+4
svn path=/trunk/; revision=54314
2013-12-03wiretap: start using <wsutil/pint.h>Jakub Zawadzki1-32/+32
svn path=/trunk/; revision=53764
2013-11-29Expand macros: htoles(), htolel(), htolell()Jakub Zawadzki1-7/+7
svn path=/trunk/; revision=53651
2013-11-08The "file types" we have are actually combinations of types andGuy Harris1-5/+5
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2 are separate "file types", even though they both come from Network Monitor. Rename various functions, #defines, and variables appropriately. svn path=/trunk/; revision=53166
2013-07-16The new frame-based tvbuff code found that the DOS Sniffer code forGuy Harris1-8/+51
compressed sniffer files failed if the very first read involves seeking past the first blob; fix that. svn path=/trunk/; revision=50679
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-17 07:46:04 +0000