From d935a280e35055222e49299c47ecabdd820c5462 Mon Sep 17 00:00:00 2001 From: Evan Huus Date: Wed, 27 Mar 2013 17:14:42 +0000 Subject: From Hadriel Kaplan via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223 Add a 2-pass display-filter flag to tshark so that reassembly and other forward- looking dissections can be used with filters. It's a bit of a hack, but this entire area of 2-pass analysis etc. is a giant pile of hacks to begin with and needs cleaning up. For now just having this feature is a big enough win. svn path=/trunk/; revision=48589 --- tshark.c | 149 +++++++++++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 126 insertions(+), 23 deletions(-) (limited to 'tshark.c') diff --git a/tshark.c b/tshark.c index 855aaf8d51..b5fcc9e304 100644 --- a/tshark.c +++ b/tshark.c @@ -165,7 +165,7 @@ static void report_counts_siginfo(int); #endif /* _WIN32 */ #endif /* HAVE_LIBPCAP */ -static int load_cap_file(capture_file *, char *, int, gboolean, int, gint64); +static int load_cap_file(capture_file *, char *, int, gboolean, int, gint64, dfilter_t *dfcode); static gboolean process_packet(capture_file *cf, gint64 offset, struct wtap_pkthdr *whdr, const guchar *pd, gboolean filtering_tap_listeners, guint tap_flags); @@ -284,8 +284,9 @@ print_usage(gboolean print_ver) fprintf(output, "\n"); fprintf(output, "Processing:\n"); - fprintf(output, " -2 perform a two-pass analysis\n"); - fprintf(output, " -R packet filter in Wireshark display filter syntax\n"); + fprintf(output, " -2 perform a two-pass analysis (automatic if -Y used)\n"); + fprintf(output, " -R packet Read filter in Wireshark display filter syntax\n"); + fprintf(output, " -Y packet displaY filter in Wireshark display filter syntax\n"); fprintf(output, " -n disable all name resolutions (def: all enabled)\n"); fprintf(output, " -N enable specific name resolution(s): \"mntC\"\n"); fprintf(output, " -d %s ...\n", decode_as_arg_template); @@ -897,10 +898,12 @@ main(int argc, char *argv[]) volatile gboolean out_file_name_res = FALSE; gchar *volatile cf_name = NULL; gchar *rfilter = NULL; + gchar *dfilter = NULL; #ifdef HAVE_PCAP_OPEN_DEAD struct bpf_program fcode; #endif dfilter_t *rfcode = NULL; + dfilter_t *dfcode = NULL; e_prefs *prefs_p; char badopt; int log_flags; @@ -928,7 +931,7 @@ main(int argc, char *argv[]) #define OPTSTRING_I "" #endif -#define OPTSTRING "2a:" OPTSTRING_A "b:" OPTSTRING_B "c:C:d:De:E:f:F:gG:hH:i:" OPTSTRING_I "K:lLnN:o:O:pPqQr:R:s:S:t:T:u:vVw:W:xX:y:z:" +#define OPTSTRING "2a:" OPTSTRING_A "b:" OPTSTRING_B "c:C:d:De:E:f:F:gG:hH:i:" OPTSTRING_I "K:lLnN:o:O:pPqQr:R:s:S:t:T:u:vVw:W:xX:y:Y:z:" static const char optstring[] = OPTSTRING; @@ -1472,6 +1475,10 @@ main(int argc, char *argv[]) break; case 'X': break; + case 'Y': + dfilter = optarg; + perform_two_pass_analysis = TRUE; + break; case 'z': /* We won't call the init function for the stat this soon as it would disallow MATE's fields (which are registered @@ -1709,12 +1716,16 @@ main(int argc, char *argv[]) return 1; } } - /* Currently, we don't support read filters when capturing + /* Currently, we don't support read or display filters when capturing and saving the packets. */ if (rfilter != NULL) { cmdarg_err("Read filters aren't supported when capturing and saving the captured packets."); return 1; } + if (dfilter != NULL) { + cmdarg_err("Display filters aren't supported when capturing and saving the captured packets."); + return 1; + } } else { /* They didn't specify a "-w" flag, so we won't be saving to a capture file. Check for options that only make sense if @@ -1778,6 +1789,17 @@ main(int argc, char *argv[]) capture_opts_trim_ring_num_files(&global_capture_opts); #endif + /* If a display filter was set but no read filter, we'll make the read + * filter the same as the display filter; BUT we also set the cfile's + * dfilter string to it, as a hack - its existence tells later functions + * that the rfilter is really the dfilter too, and they need to know + * that because they need to include dependents if the rfilter is a dfilter. + */ + if (dfilter != NULL && rfilter == NULL) { + rfilter = dfilter; + cfile.dfilter = dfilter; + } + if (rfilter != NULL) { if (!dfilter_compile(rfilter, &rfcode)) { cmdarg_err("%s", dfilter_error_msg); @@ -1790,7 +1812,7 @@ main(int argc, char *argv[]) if (pc != NULL) { if (pcap_compile(pc, &fcode, rfilter, 0, 0) != -1) { cmdarg_err_cont( - " Note: That display filter code looks like a valid capture filter;"); + " Note: That read filter code looks like a valid capture filter;"); cmdarg_err_cont( " maybe you mixed them up?"); } @@ -1803,6 +1825,34 @@ main(int argc, char *argv[]) } cfile.rfcode = rfcode; + /* if a display filter is set, we test it as was done for read filter above, but + * instead of saving the compiled filter to the capture file, we'll pass it in the + * function call to the second pass. (no need to clutter up capture file info with it) + */ + if (dfilter != NULL) { + if (!dfilter_compile(dfilter, &dfcode)) { + cmdarg_err("%s", dfilter_error_msg); + epan_cleanup(); +#ifdef HAVE_PCAP_OPEN_DEAD + { + pcap_t *pc; + + pc = pcap_open_dead(DLT_EN10MB, MIN_PACKET_SIZE); + if (pc != NULL) { + if (pcap_compile(pc, &fcode, dfilter, 0, 0) != -1) { + cmdarg_err_cont( + " Note: That display filter code looks like a valid capture filter;"); + cmdarg_err_cont( + " maybe you mixed them up?"); + } + pcap_close(pc); + } + } +#endif + return 2; + } + } + if (print_packet_info) { /* If we're printing as text or PostScript, we have to create a print stream. */ @@ -1829,8 +1879,10 @@ main(int argc, char *argv[]) we're using a read filter on the packets; + we're using a display filter on the packets; + we're using any taps that need dissection. */ - do_dissection = print_packet_info || rfcode || tap_listeners_require_dissection(); + do_dissection = print_packet_info || rfcode || dfcode || tap_listeners_require_dissection(); if (cf_name) { /* @@ -1880,9 +1932,10 @@ main(int argc, char *argv[]) #ifdef HAVE_LIBPCAP err = load_cap_file(&cfile, global_capture_opts.save_file, out_file_type, out_file_name_res, global_capture_opts.has_autostop_packets ? global_capture_opts.autostop_packets : 0, - global_capture_opts.has_autostop_filesize ? global_capture_opts.autostop_filesize : 0); + global_capture_opts.has_autostop_filesize ? global_capture_opts.autostop_filesize : 0, + dfcode); #else - err = load_cap_file(&cfile, NULL, out_file_type, out_file_name_res, 0, 0); + err = load_cap_file(&cfile, NULL, out_file_type, out_file_name_res, 0, 0, dfcode); #endif } CATCH(OutOfMemoryError) { @@ -2615,8 +2668,13 @@ capture_cleanup(int signum _U_) #endif /* _WIN32 */ #endif /* HAVE_LIBPCAP */ +/* With a two-pass analysis, if the display filter is set, then we + * mark dependencies of reassembled packets in this first pass, and + * in the second pass only print/allow them if the packets match the + * display filter or are dependents of packets which matched the filter. + */ static gboolean -process_packet_first_pass(capture_file *cf, +process_packet_first_pass(capture_file *cf, dfilter_t *dfcode, gint64 offset, struct wtap_pkthdr *whdr, const guchar *pd) { @@ -2625,6 +2683,7 @@ process_packet_first_pass(capture_file *cf, gboolean create_proto_tree = FALSE; epan_dissect_t edt; gboolean passed; + gboolean as_display_filter = FALSE; /* The frame number of this packet is one more than the count of frames in this packet. */ @@ -2635,10 +2694,16 @@ process_packet_first_pass(capture_file *cf, that all packets can be marked as 'passed'. */ passed = TRUE; + /* If cfile's dfilter string is not NULL, it means we want to treat + * the rfcode filter as a display filter */ + if (cf->dfilter) { + as_display_filter = TRUE; + } + frame_data_init(&fdlocal, framenum, whdr, offset, cum_bytes); /* If we're going to print packet information, or we're going to - run a read filter, or we're going to process taps, set up to + run a read filter, or display filter, or we're going to process taps, set up to do a dissection and do so. */ if (do_dissection) { if (gbl_resolv_flags.mac_name || gbl_resolv_flags.network_name || @@ -2670,9 +2735,37 @@ process_packet_first_pass(capture_file *cf, passed = dfilter_apply_edt(cf->rfcode, &edt); } - if (passed) { + /* if the filter is actually a display filter, we add _all_ frames to the frame list, + * so that later frames which depend on them can include them in the second pass. + */ + if (passed || as_display_filter) { frame_data_set_after_dissect(&fdlocal, &cum_bytes); prev_cap = prev_dis = frame_data_sequence_add(cf->frames, &fdlocal); + + /* if the read filter is a real read filter, but we also have a display filter, + * we need to run the display filter now, and for those frames which + * pass it, we need to check if they depended on previous frames. + * If the read filter is in fact the display filter, we don't need to + * run it again, but just check if the passed ones have dependents + */ + if (passed && !as_display_filter && dfcode) { + epan_dissect_t edt2; + epan_dissect_init(&edt2, TRUE, FALSE); + epan_dissect_prime_dfilter(&edt2, dfcode); + epan_dissect_run(&edt2, whdr, pd, &fdlocal, NULL); + if (dfilter_apply_edt(dfcode, &edt2)) { + g_slist_foreach(edt.pi.dependent_frames, find_and_mark_frame_depended_upon, cf->frames); + } + epan_dissect_cleanup(&edt2); + } + else if (passed && as_display_filter) { + /* This frame passed the read filter which is also a display filter, and may depend on previous + * (potentially not displayed-later) frames. Find those frames and mark them + * as depended upon now, so in second pass we print them before this packet. + */ + g_slist_foreach(edt.pi.dependent_frames, find_and_mark_frame_depended_upon, cf->frames); + } + cf->count++; } else { /* if we don't add it to the frame_data_sequence, clean it up right now @@ -2693,19 +2786,29 @@ process_packet_first_pass(capture_file *cf, static gboolean process_packet_second_pass(capture_file *cf, frame_data *fdata, - struct wtap_pkthdr *phdr, const guchar *pd, + struct wtap_pkthdr *phdr, const guchar *pd, dfilter_t *dfcode, gboolean filtering_tap_listeners, guint tap_flags) { gboolean create_proto_tree; column_info *cinfo; epan_dissect_t edt; gboolean passed; + dfilter_t *fcode = NULL; /* If we're not running a display filter and we're not printing any packet information, we don't need to do a dissection. This means that all packets can be marked as 'passed'. */ passed = TRUE; + /* If cfile's dfilter string is not NULL, it means we want to treat + * the rfcode filter as a display filter */ + if (dfcode) { + fcode = dfcode; + } + else if (cf->rfcode) { + fcode = cf->rfcode; + } + /* If we're going to print packet information, or we're going to run a read filter, or we're going to process taps, set up to do a dissection and do so. */ @@ -2715,7 +2818,7 @@ process_packet_second_pass(capture_file *cf, frame_data *fdata, /* Grab any resolved addresses */ host_name_lookup_process(); - if (cf->rfcode || print_details || filtering_tap_listeners || + if (fcode || print_details || filtering_tap_listeners || (tap_flags & TL_REQUIRES_PROTO_TREE) || have_custom_cols(&cf->cinfo)) create_proto_tree = TRUE; else @@ -2729,8 +2832,8 @@ process_packet_second_pass(capture_file *cf, frame_data *fdata, /* If we're running a read filter, prime the epan_dissect_t with that filter. */ - if (cf->rfcode) - epan_dissect_prime_dfilter(&edt, cf->rfcode); + if (fcode) + epan_dissect_prime_dfilter(&edt, fcode); col_custom_prime_edt(&edt, &cf->cinfo); @@ -2747,9 +2850,9 @@ process_packet_second_pass(capture_file *cf, frame_data *fdata, epan_dissect_run_with_taps(&edt, phdr, pd, fdata, cinfo); - /* Run the read filter if we have one. */ - if (cf->rfcode) - passed = dfilter_apply_edt(cf->rfcode, &edt); + /* Run the read/display filter if we have one. */ + if (fcode) + passed = dfilter_apply_edt(fcode, &edt); } if (passed) { @@ -2795,12 +2898,12 @@ process_packet_second_pass(capture_file *cf, frame_data *fdata, if (do_dissection) { epan_dissect_cleanup(&edt); } - return passed; + return passed || fdata->flags.dependent_of_displayed; } static int load_cap_file(capture_file *cf, char *save_file, int out_file_type, - gboolean out_file_name_res, int max_packet_count, gint64 max_byte_count) + gboolean out_file_name_res, int max_packet_count, gint64 max_byte_count, dfilter_t *dfcode) { gint linktype; int snapshot_length; @@ -2912,7 +3015,7 @@ load_cap_file(capture_file *cf, char *save_file, int out_file_type, cf->frames = new_frame_data_sequence(); while (wtap_read(cf->wth, &err, &err_info, &data_offset)) { - if (process_packet_first_pass(cf, data_offset, wtap_phdr(cf->wth), + if (process_packet_first_pass(cf, dfcode, data_offset, wtap_phdr(cf->wth), wtap_buf_ptr(cf->wth))) { /* Stop reading if we have the maximum number of packets; * When the -c option has not been used, max_packet_count @@ -2940,7 +3043,7 @@ load_cap_file(capture_file *cf, char *save_file, int out_file_type, if (wtap_seek_read(cf->wth, fdata->file_off, &cf->phdr, cf->pd, fdata->cap_len, &err, &err_info)) { if (process_packet_second_pass(cf, fdata, - &cf->phdr, cf->pd, + &cf->phdr, cf->pd, dfcode, filtering_tap_listeners, tap_flags)) { /* Either there's no read filtering or this packet passed the filter, so, if we're writing to a capture file, write -- cgit v1.2.1