summaryrefslogtreecommitdiff
path: root/wiretap
AgeCommit message (Collapse)AuthorFilesLines
2012-10-22Have separate seek-read routines for V1.0 and V2.0.Guy Harris1-161/+211
Set the subtype_read and subtype_seek_read routines for the file type, rather than having a common read routine that checks the file type each time. Make the macros used in the read and seek-read routines more similar, and use them more similarly in both. svn path=/trunk/; revision=45706
2012-10-22Pull the length-and-caplen setting operations in the read routines intoGuy Harris1-33/+47
the macros. Note why we don't pull the time setting operations into the macros (it's because that would mean the macros can't be used in the seek-read routines, as calculating time stamps requires accumulating the time stamps in a sequential pass through the packets, given that the records have time stamps relative to the previous packet). Fix what is probably a typo in the definitions of some macros (which happen to work without the fix because "fp" and "pp" are both local variable names as well as macro arguments). svn path=/trunk/; revision=45705
2012-10-22Pass a pointer to a struct wtap_pkthdr to a bunch of macros; this allowsGuy Harris1-143/+117
us to avoid one redefinition of those macros that, in the one definition, for the read routines, refer to the pseudo-header as wth->phdr.pseudo_header and, in the next definition, for the seek-read routine, refer to it as *pseudo_header - instead, we pass &wth->phdr in the read routine and phdr in the seek-read routine. svn path=/trunk/; revision=45704
2012-10-21More white-space cleanups.Guy Harris1-23/+23
svn path=/trunk/; revision=45702
2012-10-21Use phdr->pseudo_header in the seek-read routine, rather than puttingGuy Harris1-4/+3
its address into a pseudo_header pointer and using that. svn path=/trunk/; revision=45701
2012-10-21Tabs -> spaces, and other whitespace cleanups.Guy Harris1-952/+952
svn path=/trunk/; revision=45700
2012-10-19Pass parse_vms_hex_dump() a pointer to a wtap_pkthdr structure and haveGuy Harris1-37/+30
it always fill it in. Have the seek-read routine pass its phdr argument in. Have it just return a success/failure indication; do the check for the packet size in the seek-read routine by looking at the caplen field of the wtap_pkthdr structure. svn path=/trunk/; revision=45663
2012-10-19Mark unused variable with _U_Jakub Zawadzki1-4/+1
svn path=/trunk/; revision=45656
2012-10-19Hoist the code to set the wtap_pkthdr into a routine, and call it inGuy Harris1-8/+15
both the read and the seek-read routine, now that a pointer to the wtap_pkthdr is passed to the seek-read routine. svn path=/trunk/; revision=45655
2012-10-18Wrap lines a little differently.Guy Harris1-2/+3
svn path=/trunk/; revision=45654
2012-10-18Get rid of unnecessary block braces, clean up white space.Guy Harris1-18/+12
svn path=/trunk/; revision=45653
2012-10-18Move some arguments up a line.Guy Harris1-5/+4
svn path=/trunk/; revision=45649
2012-10-18Handle the fractions-of-a-second part of the time stamp correctly. Guy Harris1-17/+39
Extract it as a string, not a number, and determine the resolution based on the length of the string, i.e. on the number of digits presented. (If you base it on the numerical value, leading zeroes will not be taken into account, but they aren't any different from other digits when determining the resolution.) The resolution is 1/10^ndigits seconds, so we have to multiply it by 10^(9-ndigits) to convert the number to nanoseconds. svn path=/trunk/; revision=45627
2012-10-18Redo the processing of lines in iSeries text packet dumps.Guy Harris1-311/+208
Process several different flavors of header lines the same: "IP Header", "IPv6 Header", "ARP Header", "TCP Header", "UDP Header", "ICMP Header", "ICMPv6 Hdr", "Option Hdr" - the hex data for all of them should be included in the packet data. Process continuation lines if those headers wrap over more than one line. Do not assume, or require, that *any* of those be present; there is no guarantee that "IP Header" or "IPv6 Header" will be present (there's at least one IBM page showing a packet with "ARP Header" in a trace), and there is no guarantee that "TCP Header" will be present (there are traces with "UDP Header" and "ICMPv6 Hdr"). Do not impose limits, other than the overall line limit, on the amount of hex data in header or data lines; there is no guarantee that, for example, a TCP header is 20 bytes long (if there are TCP options, it *will* have more than 20 bytes). Make sure we have an even number of hex digits. Set "caplen" to the actual number of bytes we've read, even if that's less than the purported packet length. svn path=/trunk/; revision=45626
2012-10-17Fill some phdr values also when doing random readJakub Zawadzki8-159/+133
svn path=/trunk/; revision=45619
2012-10-16Add wtap_pseudo_header union to wtap_pkthdr structure.Jakub Zawadzki50-237/+259
Use pkthdr instead of pseudo_header as argument for dissecting. svn path=/trunk/; revision=45601
2012-10-12Use seasonal allocation for name resolution. This effectively scrubs ourGerald Combs2-4/+4
resolution information between capture files so that we don't leak host entries from one file to another (e.g. embarassing-host-name.example.com from file1.pcapng into a name resolution block in file2.pcapng). host_name_lookup_cleanup and host_name_lookup_init must now be called after each call to se_free_all. As a result we now end up reading our various name resolution files much more than we should. svn path=/trunk/; revision=45511
2012-10-12And that also means that we need to split the data rate from theGuy Harris1-1/+2
pseudo-header into two bytes and fill in both the rate and direction fields when writing CommView NCF files out. svn path=/trunk/; revision=45507
2012-10-12The "rate" field in the CommView NCF format is 1 byte long, not 2 bytesGuy Harris1-2/+3
long; that means we read only one byte into our structure, so make its "rate" element one byte long, so we don't fill in half the "rate" element with the read - and the *wrong* half on big-endian machines - and leave the other half un-set and thus containing some random possibly non-zero data. In addition, that's not the full data rate for faster networks; for Wi-Fi, the one-byte "direction" field is actually the upper 8 bits of the data rate, so combine them when we fill in the data rate in the pseudo-header. #BACKPORT svn path=/trunk/; revision=45504
2012-10-12If we see an SHB after we've read the first SHB, report that as anGuy Harris1-79/+113
unsupported feature. If we see an IDB after all the IDBs at the beginning of the file, process it. Fixes bug 7851. Get rid of unused read_idbs flag in pcapng_t structure. (Also, as per the above, just because we've read all the IDBs at the beginning of the section, that doesn't necessarily mean we've read all the IDBs in the section.) Fix some places where we reject SPBs. svn path=/trunk/; revision=45495
2012-10-10From Bill Parker: fix typo.Guy Harris1-1/+1
svn path=/trunk/; revision=45457
2012-10-10From Bill Parker: check for ws_fopen() failing.Guy Harris1-5/+11
From me: instead of logging the error with a macro that requires dbg_out to be set, and giving up, set dbg_out to stderr, log the message (which now notes that logging will be done to the standard error), and drive on. Part of fix for bug 7824. svn path=/trunk/; revision=45454
2012-10-06Remove unused variable caught by cppcheck.Evan Huus1-2/+1
svn path=/trunk/; revision=45344
2012-10-01Stop defining HAVE_CONFIG_H on Windows builds too.Jeff Morriss1-1/+1
svn path=/trunk/; revision=45231
2012-09-24Some improvements after looking at profile of large reordercap run.Martin Mathieson1-18/+89
- speed up writing timestamp by avoiding g_snprintf() - avoid call to strstr() - don't use g_snprintf() for writing a liternal string - avoid atio() for single-digit strings - avoid some strcmp() calls where the release number at the end wasn't important svn path=/trunk/; revision=45091
2012-09-20Shouldn't set the time in seek_read() after all. At least the pcapMartin Mathieson1-8/+0
support doesn't. svn path=/trunk/; revision=45022
2012-09-20We always HAVE_CONFIG_H so don't bother checking whether we have it or not.Jeff Morriss3-6/+0
svn path=/trunk/; revision=45016
2012-09-20We always HAVE_CONFIG_H so don't bother checking whether we have it or not.Jeff Morriss50-100/+0
svn path=/trunk/; revision=45015
2012-09-19Fix a couple of dumping issues seen while working on 'reorder'.Martin Mathieson1-4/+21
svn path=/trunk/; revision=45003
2012-09-14Create a common libui using CMake similar to what we do with Autotools.Gerald Combs3-0/+29
Move the GTK+ text import code to the common UI directory. Create wtap_encap_requires_phdr() from code in file_import_dlg.c. svn path=/trunk/; revision=44904
2012-09-14From Nikhil Kalu:Anders Broman3-11/+86
Enhancement to add more trace record fields in Citrix NetScaler capture file format. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7713 svn path=/trunk/; revision=44895
2012-09-07From Stephen Donnelly via ↵Jeff Morriss1-3/+5
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7266 : Since we have to 'downconvert' the ERF time stamps to Wireshark's internal representation anyway, we may as well report the resolution which we convert to, rather than the original native resolution. svn path=/trunk/; revision=44800
2012-08-21Avoid some calls to strlen() by remembering return value fromMartin Mathieson1-10/+11
g_strlcpy(). svn path=/trunk/; revision=44608
2012-08-11Ignore '\r' which will be found at the end of a line when a windows hostMartin Mathieson1-27/+32
writes a log. Also re-line-up args under function definitions. svn path=/trunk/; revision=44444
2012-08-06Create (fake)interface information when loading a libpcap file it might be ↵Anders Broman1-1/+27
needed when wrinting the file if the format is converted to pcapng. Should we do this for other file formats as well? A pcapng file with per packet encapsulation will need an IDB per encapsulation as the EPB does not have a linktype indicator only a interface index. svn path=/trunk/; revision=44281
2012-08-02From Richard Stearn: support for AX.25, including support forGuy Harris3-0/+5
LINKTYPE_AX25. svn path=/trunk/; revision=44211
2012-08-02From Richard Stearn: AX.25 KISS protocol support.Guy Harris3-1/+7
Part 1 of the fix for bug 7529. svn path=/trunk/; revision=44202
2012-07-30Avoid a division by zero due to overflow.Michael Tüxen1-2/+2
This should fix the crash in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7266 svn path=/trunk/; revision=44141
2012-07-30Added missing entry for WTAP_ENCAP_SDH.Stig Bjørlykke1-0/+3
svn path=/trunk/; revision=44138
2012-07-27Some more debug info.Michael Tüxen1-0/+5
svn path=/trunk/; revision=44076
2012-07-27It seems that the length should unsigned, not signed.Michael Tüxen1-1/+1
This fixes part of https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7533 which deals with Crash in vwr.c while reading the capture file. svn path=/trunk/; revision=44075
2012-07-27Handle the case where no IDB follows the SHB. This fixes part ofMichael Tüxen1-34/+30
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7533 which deals with Div by 0 crash in pcapng_read_packet_block(). svn path=/trunk/; revision=44074
2012-07-26Fix another uninitialised bug (the same bug in _read() I fixedMartin Mathieson1-1/+1
yesterday, also in _seek_read()). Spotted by running 'valgrind-wireshark.sh -2'. svn path=/trunk/; revision=44043
2012-07-25Initialize a byte to avoid more valgrind warnings.Martin Mathieson1-1/+1
svn path=/trunk/; revision=44019
2012-07-25Don't write one payload byte too many. Spotted by valgrind!Martin Mathieson1-2/+2
svn path=/trunk/; revision=44016
2012-07-20Add a routine that, given a set of packet encapsulation types, returnsGuy Harris3-13/+39
the per-file encapsulation type needed to write out a set of packets with all those encapsulation types. If there's only one such encapsulation type, that's the type, otherwise WTAP_ENCAP_PER_PACKET is needed. Use that in wtap_dump_can_write_encaps(). Also use it in cf_save_packets() and cf_export_specified_packets(), so that we can write out files with WTAP_ENCAP_PER_PACKET as the file encapsulation type and only one actual per-packet encapsulation type in some cases where that failed before. This fixes the case that showed up in bug 7505, although there are other cases where we *could* write out a capture in a given file format but won't be able to do so; fixing those will take more work. #BACKPORT (Note: this adds a routine to libwiretap, so, when backported, the *minor* version of the library should be increased. Code that worked with the version of the library prior to this change will continue to work, so there's no need to change the *major* version of the library.) svn path=/trunk/; revision=43847
2012-07-19Addresses https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3895. Note ↵Michael Mann3-1/+57
that this doesn't write a Nokia file type properly, it just doesn't corrupt an existing one (read in by Wireshark) if resaved. svn path=/trunk/; revision=43815
2012-07-18Set the 802.11 "already decrypted" flag to FALSE for file formats otherGuy Harris6-0/+9
than Network Instruments Observer files, as we don't know whether they are already decrypted. svn path=/trunk/; revision=43796
2012-07-18Add to the 802.11 pseudo-header a "this is already decrypted" flag, setGuy Harris2-22/+11
it as appropriate in the code to read Network Instruments Observer captures (rather than tweaking the "protected" flag in the packet data), and use that flag in the 802.11 dissector. Fix indentation while we're at it (tabs are not *ipso facto* 4 spaces). svn path=/trunk/; revision=43795
2012-07-15From Network Instruments by Tom Brezinski When a Network Instruments ↵Anders Broman2-8/+30
wireless capture is decrypted a flag is set on the packet in the BFR file indicating that the packet is decrypted instead of modifying the protected flag in the frame control flags of the packet header. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7478 svn path=/trunk/; revision=43727
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-08 06:22:10 +0000