diff options
| author | Anthony Coddington <anthony.coddington@endace.com> | 2017-06-01 20:34:25 +1200 |
|---|---|---|
| committer | Guy Harris <guy@alum.mit.edu> | 2017-07-17 02:08:52 +0000 |
| commit | f3181f706b39955a4f4bc26f1d6d75166a67c235 (patch) | |
| tree | 4d1d9d5ab2a17a05219211537ba15693d46cd9b4 /wiretap/file_access.c | |
| parent | 32ec45dc92a699e34e23197d2de48a043dfad426 (diff) | |
ERF_TYPE_META write and comment support
Support per-packet comments in ERF_TYPE_META through a new Anchor ID
extension header with per-Host unique 48-bit Anchor ID which links an
ERF_TYPE_META record with a packet record. There may be more than one
Anchor ID associated with a packet, where they are grouped by Host ID
extension header in the extension header list. Like other ERF_TYPE_META
existing comments should not be overwritten and instead a new record
generated. See erf_write_anchor_meta_update_phdr() for detailed comments
on the extension header stack required.
As Wireshark only supports one comment currently, use the one one with
the latest metadata generation time (gen_time). Do this for capture
comment too.
Write various wtap metadata in periodic per-second ERF_TYPE_META records
if non-WTAP_ENCAP_ERF or we have an updated capture comment.
Refactor erf_dump to create fake ERF header first then follow common
pseudoheadr and payload write code rather than two separate code paths.
Support an ERF_HOST_ID environment variable to define Wireshark's Host
ID when writing. Defaults to 0 for now.
ERF dissector updates to support Anchor ID extension header with basic
frame linking.
Update ERF_TYPE_META naming and descriptions to official name
(Provenance)
Core changes:
Add has_comment_changed to wtap_pkthdr, TRUE when a packet
opt_comment has unsaved changes by the user.
Add needs_reload to wtap_dumper which forces a full reload of the file
on save, otherwise wireshark gets confused by additional packets being
written.
Change-Id: I0bb04411548c7bcd2d6ed82af689fbeed104546c
Ping-Bug: 12303
Reviewed-on: https://code.wireshark.org/review/21873
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Stephen Donnelly <stephen.donnelly@endace.com>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Diffstat (limited to 'wiretap/file_access.c')
| -rw-r--r-- | wiretap/file_access.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/wiretap/file_access.c b/wiretap/file_access.c index 14f2e082cc..dc16efde5a 100644 --- a/wiretap/file_access.c +++ b/wiretap/file_access.c @@ -1312,7 +1312,7 @@ static const struct file_type_subtype_info dump_open_table_base[] = { /* WTAP_FILE_TYPE_SUBTYPE_ERF */ { "Endace ERF capture", "erf", "erf", NULL, - FALSE, FALSE, 0, + FALSE, TRUE, WTAP_COMMENT_PER_SECTION|WTAP_COMMENT_PER_INTERFACE|WTAP_COMMENT_PER_PACKET, erf_dump_can_write_encap, erf_dump_open, NULL }, /* WTAP_FILE_TYPE_SUBTYPE_EYESDN */ @@ -2619,6 +2619,10 @@ wtap_dump_set_addrinfo_list(wtap_dumper *wdh, addrinfo_lists_t *addrinfo_lists) return TRUE; } +gboolean wtap_dump_get_needs_reload(wtap_dumper *wdh) { + return wdh->needs_reload; +} + /* internally open a file for writing (compressed or not) */ #ifdef HAVE_ZLIB static WFILE_T |