aboutsummaryrefslogtreecommitdiffstats
path: root/epan/epan.h
AgeCommit message (Collapse)AuthorFilesLines
2017-02-10Convert conversation hash tables to use wmem.Michael Mann1-1/+0
Simplifies cleanup because wmem can handle the memory cleanup. Change-Id: Idc6a9bfe5f23c83b59a5278a64b9fb706862342d Reviewed-on: https://code.wireshark.org/review/20042 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-02-09Make the capture file's interface description filterableJim Young1-1/+3
This patch introduces the frame.interface_description field. While testing this new functionality it became obvious that we have a non-optimal interaction between the existing cfile.c's cap_file_get_interface_name(), the recently added frame.interface_name field and this new frame.interface_description field. The string returned from cap_file_get_interface_name() may in fact come from one of three different sources: the idb's interface name (if it exists) or the idb's interface description (if that exists) or a default text of "unknown". The string ultimately becomes the rame.interface_name whether or not the idb had an interface name option to begin with. This behavior does not allow one to test for the simple presence of frame.interface_name. The new peer function cap_file_get_interface_description() added by this patch returns NULL instead of "unknown" if the idb does not have an interface description. Should cap_file_get_interface_name() be similarly modified to return NULL if the idb does not have an interface name? Bug: 9781 Change-Id: Ie479f373c5080c004dd22bd88919838feca71e95 Reviewed-on: https://code.wireshark.org/review/19861 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-01-25Move the proto data stuff out of frame_data.[ch].Guy Harris1-1/+2
It's not tied to the frame_data structure any more, so it belongs by itself. Clean up some #includes while we're at it; in particular, frame_data.h doesn't use anything related to tvbuffs, so don't have it gratuitiously include tvbuff.h. Change-Id: Ic32922d4a3840bac47007c5d4c546b8842245e0c Reviewed-on: https://code.wireshark.org/review/13518 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-04Don't walk the entire protocol tree to extract the value of one field.Guy Harris1-1/+6
Instead, prime the epan_dissect_t's tree to look for rtp.ssrc, and extract that value with proto_get_finfo_ptr_array(). Also, have the filter used to check whether the packet is a candidate for RTP analysis to check for RTPv2 (and add a check for IPv4 or IPv6 back to the Qt version), and get rid of an unnecessary extra level of indirection for that string. In the Qt version, if findStreams() set the error string, don't overwrite it with a "No streams found." indication, and fix error handling for the "filter didn't compile" case. Change-Id: I09d0ea37ccd4806d99e3b6394f2a8a376e974705 Reviewed-on: https://code.wireshark.org/review/13045 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-10-28Catch REPORT_DISSECTOR_BUG() calls in dissector registration routines.Guy Harris1-4/+10
Have epan_init() return a success/failure Boolean indication. Catch exceptions when calling the dissector registration routines and, if we get one, report the error and return a failure indication. If epan_init() fails, quit, but first make sure the reported error is displayed. Change-Id: I0300cbb1f66a5644f857a205235124909d684c50 Reviewed-on: https://code.wireshark.org/review/11340 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-02-07Bluetooth/GUI: ATT: Add Server Attribute TableMichal Labedzki1-1/+1
It is a GUI+QT feature that introduce Bluetooth menu and "ATT Server Attributes" that present all handle+UUID pairs as table. User may copy cell value, row, selected rows or whole table within header. On activate user will go to packet that introduce UUID for specified handle. Change-Id: If17e53aff5feb89ededc740a595ba5882b90be5e Reviewed-on: https://code.wireshark.org/review/6911 Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2015-01-02Remove pkt_comment member from packet_info structure.Michael Mann1-1/+1
Change-Id: Ifd3d201a09944e3fc36188f891ea8a584886101d Reviewed-on: https://code.wireshark.org/review/5884 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-12-18Add support for multifields in custom columnMichal Labedzki1-1/+1
You can now add column with Custom type with more than one field by using OR "||" splitter. Bug: 9695 Change-Id: Ia82a91e7a35b867647d36cb9626e3870f46c0d85 Reviewed-on: https://code.wireshark.org/review/5804 Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2014-05-25Add support for dissecting non-packet records.Guy Harris1-4/+6
Add a dissector table indexed by the file type, and, for the file-type-specific records, have the frame dissector skip the usual pseudo-header processing, as the pseudo-header has a file-type-specific record subtype in it, and call the dissector for that file type's records. Change-Id: Ibe97cf6340ffb0dabc08f355891bc346391b91f9 Reviewed-on: https://code.wireshark.org/review/1782 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-03-20Revert "Allow pcapng interface options to be available to dissectors."Anders Broman1-3/+2
This patch causes Wireshark/tshark to segfault if the file is reread(open a file and press reload). The test suite also fails on 2.1.1 Step: Exit status for existing file: "/home/wireshark/builders/trunk/sol10sparc/build/test/captures/dhcp.pcap" must be 0/home/wireshark/builders/trunk/sol10sparc/build/test/suite-clopts.sh: line 149: 6646 Segmentation Fault (core dumped) $TSHARK -r "${CAPTURE_DIR}dhcp.pcap" > ./testout.txt 2>&1 OSX build bot chokes on pcapng.c: In function 'pcapng_destroy_option_value': pcapng.c:377: warning: implicit declaration of function 'g_byte_array_unref' pcapng.c:379: warning: implicit declaration of function 'g_array_unref' pcapng.c: In function 'pcapng_collect_block_option': pcapng.c:419: warning: implicit declaration of function 'g_byte_array_new_take' pcapng.c:419: warning: initialization makes pointer from integer without a cast these functions are glib 2.22 This reverts commit 7b13a3b0f6a5617e0e352f87cc5a20afea226aa8. Change-Id: Ia82fdb2d08287bc2cd2841e1e941ae68cbc2e009 Reviewed-on: https://code.wireshark.org/review/749 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-20Allow pcapng interface options to be available to dissectors.Christopher Kilgour1-2/+3
Interface options[1], and more generally pcapng options[2], are useful information that can provide improved dissector output. Prior to this change, only certain pcapng interface options were interpreted and made available to dissectors, e.g. the interface name or description. This change augments the situation by providing epan_get_interface_option( ), which returns an array of byte arrays if the option code exists (otherwise NULL). Each element of the array is a byte buffer containing the raw data of the option. An array-of-buffers is used because pcapng allows for multiple instances of the same option to be present in the file. All interface options found in a pcapng file are thus made available to the dissector. The implementation also provides infrastructure to collect options from other pcapng blocks such as the section header. Currently these options are discarded, but could be retained in the future to support more features. [1] http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionidb [2] http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionopt Change-Id: I944b6f0f03dde9b8e7d1348b76acde6f9d312f37 Reviewed-on: https://code.wireshark.org/review/331 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-02-25Fix bug 6357: Lua all_field_infos() broken within tap/listenerHadriel Kaplan1-0/+12
The current API for Lua provides a global function "all_field_infos()" which returns all the populated field_info nodes in the current proto_tree. By default all_field_infos() "works", in the literal sense: it returns exactly the fields the previous dissectors of the packet have populated at that instant of time. But of course dissectors don't populate all the applicable fields most of the time, because of the TRY_TO_FAKE_THIS_ITEM optimization where they don't fill in things that aren't needed at the time by a display, color, or tap's dfilter. So this commit offers a way to force the dissectors to populate all the applicable field_infos in the tree, by setting the proto_tree to be visible. Obviously that is going to impact performance, since it basically bypasses the TRY_TO_FAKE_THIS_ITEM optimization; so the patch only does this if the Lua script author told it to explicitly, by adding an argument to Listener.new() and register_postdissector(). Change-Id: I11d3559fbe8c14fbadf1b51415a3701dc1200b7b Reviewed-on: https://code.wireshark.org/review/286 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-01-08TFShark (Terminal Fileshark) v.001. Bug 9607 ↵Michael Mann1-0/+11
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9607) This is a VERY PRELIMINARY version of tfshark. It's an attempt to jumpstart FileShark and its architecture. Right now it's mostly just a very stripped down version of tshark with all of the necessary build modifications (including now building filetap library since tfshark depends on it) This code has helped me identify what I believe to be all of the necessary layers for a complete fileshark architecture. And those layers will slowly be added in time (patches always welcome!). svn path=/trunk/; revision=54646
2013-12-22Avoid including definition of column_info structure in dissectors.Jakub Zawadzki1-3/+3
Move COL_* enum to <epan/column-utils.h> XXX Later we can rename epan/column-info.h to column-int.h (or smth like this) svn path=/trunk/; revision=54352
2013-12-05Initialize the error-reporting routines before scanning for plugins, asGuy Harris1-6/+1
the code to scan for them uses those routines. This means epan_init() no longer takes those routines as arguments - which is just as well, given that the mechanism in question is no longer part of libwireshark, but is part of libwsutil. This should fix bug 9508. svn path=/trunk/; revision=53796
2013-12-03Rename struct _epan_dissect_t to epan_dissect.Jakub Zawadzki1-1/+1
svn path=/trunk/; revision=53770
2013-12-03Dissectors should not use dfilter.h, don't include it.Jakub Zawadzki1-2/+2
XXX ncp2222 dissector is using dfilter_compile(), why? svn path=/trunk/; revision=53766
2013-12-02Move most of the plugin code from epan to wsutil and remove allGuy Harris1-0/+10
knowledge of particular types of plugins. Instead, let particular types of plugins register with the common plugin code, giving a name and a routine to recognize that type of plugin. In particular applications, only process the relevant plugin types. Add a Makefile.common to the codecs directory. svn path=/trunk/; revision=53710
2013-10-20Reintroduce back epan_dissect_reset(), proto_tree_reset()Jakub Zawadzki1-0/+4
This time it makes more sense, cause for each dissection we need two wmem allocators. Reseting wmem allocator is much faster than destroy & create. svn path=/trunk/; revision=52706
2013-10-18After looking for something in the column-*.h files andJörg Mayer1-1/+1
not finding it, I finally found it in column_info.h Renamed column_info.h to column-info.h to have consistency with the column*h files. svn path=/trunk/; revision=52667
2013-08-01Remove fdata->opt_comment, add pkt_comment to pinfoJakub Zawadzki1-0/+2
Original (read from file) comments can be accessed by pkthdr->opt_comment Keep user comments in seperated BST, add new method for epan session to get it. svn path=/trunk/; revision=51090
2013-07-22Abuse epan_t more: add callback to get interface name.Jakub Zawadzki1-0/+2
svn path=/trunk/; revision=50794
2013-07-21Add helper function to epan_session which can be used to get absolute ↵Jakub Zawadzki1-0/+2
timestamp of given frame. Remove ->prev_cap, for testing purpose also replace ->prev_dis with number of previously displayed frame number. This patch reduce size of frame_data by 8B (amd64) This is what (I think) was suggested by Guy in comment 13 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5821#c13) svn path=/trunk/; revision=50765
2013-07-21Some work on multi file dissectionJakub Zawadzki1-7/+4
- make init_dissection/cleanup_dissection private for libwireshark - implement epan_new(), epan_free() - pass epan_t to epan_dissect* svn path=/trunk/; revision=50761
2013-07-11packet dissection now takes pointer to tvb instead of guint8 dataJakub Zawadzki1-2/+2
implement frame_tvbuff, right now almost a copy of 'real' tvb. svn path=/trunk/; revision=50497
2013-05-22Turn "packet_is_ssl()" into a general "does the packet whose dissectionGuy Harris1-0/+6
is in this epan_dissect_t contain the field whose name is passed as an argument" routine in libwireshark, and use it where we used packet_is_ssl(). (We should check to see if anything *else* could use it.) svn path=/trunk/; revision=49530
2013-04-30A few more doxygen fix-ups.Evan Huus1-1/+0
svn path=/trunk/; revision=49092
2013-03-01Export libwireshark symbols using WS_DLL_PUBLIC defineBalint Reczey1-1/+15
Also remove old WS_VAR_IMPORT define and related Makefile magic everywhere in the project. svn path=/trunk/; revision=47992
2012-11-03Manually revert r45669Jakub Zawadzki1-4/+0
svn path=/trunk/; revision=45884
2012-10-20Introduce epan_dissect_run_with_taps() which run dissection with taps.Jakub Zawadzki1-0/+4
unexport tap_queue_init, tap_push_tapped_queue svn path=/trunk/; revision=45670
2012-10-20- Allow reseting edt with new function epan_dissect_reset(),Jakub Zawadzki1-0/+4
- initialize edt once in few places, and later reset it after dissecting (add_packet_to_packet_list), - revert r45667, probably no longer needed. svn path=/trunk/; revision=45669
2012-10-18Move ui-independent object export routines to the common ui directory.Gerald Combs1-8/+8
Implement DICOM, HTTP, and SMB object exports. Rename the GTK+ export files. C++-ize epan/tap.h. Fix an apparent memory leak in eo_save_all_clicked_cb. The Qt dialog has an indeterminate progress bar. I tried adding something similar to the GTK+ dialog but event processing led down a rabbit hole. svn path=/trunk/; revision=45647
2012-10-16Add wtap_pseudo_header union to wtap_pkthdr structure.Jakub Zawadzki1-1/+1
Use pkthdr instead of pseudo_header as argument for dissecting. svn path=/trunk/; revision=45601
2012-06-28Update Free Software Foundation address.Jakub Zawadzki1-1/+1
(COPYING will be updated in next commit) svn path=/trunk/; revision=43536
2011-12-29Add 'extern "C"' wrappers and #include guards to various header files.Gerald Combs1-0/+8
svn path=/trunk/; revision=40321
2011-09-11From Pascal Quantin:Anders Broman1-0/+44
Update of 3GPP RRC and LTE RRC dissectors. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6333 svn path=/trunk/; revision=38964
2011-06-16Constify a return value, to squelch a compiler warning.Guy Harris1-1/+1
svn path=/trunk/; revision=37680
2010-09-23Revert 34191 and add some casts insteadJeff Morriss1-1/+1
svn path=/trunk/; revision=34193
2010-09-23Use gsize (size_t) in a couple of places to make the Win64 build happy.Jeff Morriss1-2/+2
svn path=/trunk/; revision=34191
2010-09-22When using a custom column, make it possible to select which occurrence to ↵Sake Blok1-1/+1
show if the field has multiple occurrences. svn path=/trunk/; revision=34186
2010-08-29Doxygen changes.Anders Broman1-17/+18
svn path=/trunk/; revision=33990
2010-07-15Move the code to get version information for libraries used byGuy Harris1-1/+13
libwireshark into libwireshark, and call it only in programs linked with libwireshark. That way, programs that don't link with libwireshark don't have to link with libgcrypt or libgnutls solely so that they can say that they're linked with a particular version of libgcrypt or libgnutls. Don't link dumpcap with libgcrypt or libgnutls any more. svn path=/trunk/; revision=33531
2010-04-03 From Yaniv Kaul: constify parametersBill Meier1-5/+5
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4422 From me: Fix a number of instances where the function prototype or the function definition wasn't changed so there was a mismatch thus causing Windows (but not gcc) compilation errors. svn path=/trunk/; revision=32365
2010-04-02Revert SVN #32360 until Windows compilation errors corrected.Bill Meier1-5/+5
svn path=/trunk/; revision=32361
2010-04-02From Yaniv Kaul: constify parametersBill Meier1-5/+5
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4422 svn path=/trunk/; revision=32360
2010-01-28Fix various gcc -Wshadow warnings.Bill Meier1-4/+4
svn path=/trunk/; revision=31720
2009-09-08Add an option to col_fill_in() to allow us to disable column expression ↵Kovarththanan Rajaratnam1-1/+1
processing. This is rarely needed. It's only needed when the user right clicks on the packet list view to generate a display filter. svn path=/trunk/; revision=29806
2009-09-08From : Didier GautheronAnders Broman1-1/+1
speed up a little proto_custom_set. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3972 svn path=/trunk/; revision=29789
2009-09-06Split a bunch of init routines into init() and cleanup(). This allows us to ↵Kovarththanan Rajaratnam1-0/+2
free memory properly on shutdown. This is an initial step. There's still some work to do. svn path=/trunk/; revision=29754
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-03 14:32:43 +0000