aboutsummaryrefslogtreecommitdiffstats
path: root/file.h
AgeCommit message (Collapse)AuthorFilesLines
2023-10-27Find: Matching multiple occurrences in Packet BytesJohn Thacker1-1/+4
Match multiple occurrence in Find Packet Bytes, both forwards and backwards. Also fix an issue highlighting wide strings properly reintroduced by commit c0885fe390f1fba32986806383dd38a437c7681f For backwards searching in string and binary searches, use the memrchr and backwards mempbrk implementations. For regex, use PCRE2_ANCHORED to transform the user's regex expression into one that is anchored at the start byte, and progressively search backwards. Fix #11269
2023-10-18Qt: Edit capture comments in separate dialogJohn Thacker1-0/+10
The capture file properties dialog already lists the section comments in the Details section, so it wastes some space to have them a second time in the edit box. Have an edit dialog for the capture comments. Have the edit dialog use tabs so that we can edit multiple comments in a section, and all sections. Allow adding new comments, removing comments, and reordering comments. Fix a few small leaks. Related to #14599, #16133.
2023-10-01Find: Update search frame for Finding multiple fieldsJohn Thacker1-1/+3
Add GUI support to turning on and off finding multiple occurrences in a frame. Also add a checkbox for searching backwards. This makes the number of controls large, so split it into two rows.
2023-10-01Find Packet: Find packet details multiple matches in a frameJohn Thacker1-1/+3
When searching packet details with Find Packet, step through each field that matches the search, using the currently selected field as a starting point for searching the current frame before going onto another frame. Handle both forwards and backwards, so that backwards searching initially finds the last match in each frame. Part of #11269. (Packet bytes searching should presumably also be handled.)
2023-06-26Don't include errno.h if we don't use errno or errno value definitions.Guy Harris1-2/+0
2023-06-09Add packet dedup support for live captures tooGilbert Ramirez1-2/+5
2023-06-09Add a preference for ignoring duplicate framesGilbert Ramirez1-2/+2
Sometimes you have a capture file that has many duplicate frames because of how the capture was made, and its convenient to ignore the duplicates so you can concentrate on the data and not all the TCP warnings. This adds a preference in the "Protocols" section to ignore duplicates. This currently only works while reading a capture file *not* during a live capture.
2023-03-25Fix leak in Find Packet searching tree detailsJohn Thacker1-5/+4
The string used to search the selected packet's protocol tree for the field we already found is leaked. The function prototype is prone to leaks; all the components of the match_data are filled in inside the function, and it only needs to return the field info. Restructure it so that the match_data is created (and the string freed) inside the function, and only the field_info is returned.
2023-02-17Qt: Ensure that add frame comments trigger recoloring, count updatesJohn Thacker1-0/+4
Add functions to PacketListRecord to invalidate a single record's colorization and column strings, used for a record is modified in a way that needs to trigger redrawing, but we don't need to redraw all packets. Move the functionality for adding, deleting, and setting frame comments into PacketListModel, operating on QModelIndexes (or on all physical rows in the case of deleting all comments from a file.) Trigger recolorization of any record with an updated comment. Only set a block as modified when deleting comments if we actually deleted comments. This avoids marking a file as modified if we delete all comments from all frames, or all comments from selected frames, when those comments do not actually have frames. If cf_set_modified_block is used to modify a block that is already modified, it can't update the comment count. In that case, return false and have the callers update the comment count. (It already has a return value, which is always true.) This avoids having the GUI warning about saving into a format that doesn't support comments when comments have been added and then removed. Note that, unlike with time references and time shifts, there are no fields (and hence no columns nor color filters) that depend on whether other fields have comments. If for some reason some were added, then the model data for all frames would have to be updated instead. Since there aren't, we don't need to redrawVisiblePackets, but we do need to drawCurrentPacket to ensure the packet details are redissected. Fix #12519
2022-06-28file: Fix documentationRoland Knall1-1/+0
2022-06-28Ui: Cleanup row number and select packetRoland Knall1-2/+3
Remove unneeded row number in capture file. The packet list is the only object that should know the correct number, propagating it further only complicates things. At the same time, rework cf_select_packet to select the packet based on frame_data not on the row (which can be unreliable).
2022-06-28Ui: Remove time column reformat callbackRoland Knall1-7/+0
The code can be placed directly to packet list model and does not need to be a generic callback
2022-02-20Remove editor modelines and .editorconfig exceptions from root filesDavid Perry1-13/+0
2022-02-10Qt: Allow omitting secondary data sources when printingJohn Thacker1-0/+1
Add a checkbox to the packet format group box to allow the hexdump to only have the main frame instead of secondary data sources as well, so that Print and Export Packet Dissections can be used for input to text2pcap.
2022-02-09Specify directory for temporary capturesDavid Perry1-1/+1
2021-12-12Add remaining header files to DoxygenMoshe Kaplan1-1/+2
Add @file markers for remaining header files so that Doxygen will generate documentation for them.
2021-10-04Qt: Handle errors when reloading Lua FileHandlerStig Bjørlykke1-1/+2
Reloading the capture file after reloading a Lua FileHandler may fail because of Lua errors. Handle this by closing the file. Related to #17615
2021-08-28capture file: remove redundant API ref_time_packets()Developer Alexander1-1/+2
Redundant API ref_time_packets() gets removed. cf_reftime_packets() gets a better dokumentation.
2021-08-22file: fix constness in declaration.Dario Lombardo1-1/+1
Ref: ee0dc72084
2021-07-08Consistently refer to blocks that have been modified as "modified".Guy Harris1-1/+1
"User" sounds as if the blocks belong to the user; at most, the current user might have modified them directly, but they might also have, for example, run a Lua script that, unknown to them, modified comments. Also, a file might have "user comments" added by a previous user, who them wrote the file and and provided it to the current user. "Modified" seems a bit clearer than "changed".
2021-07-07Use wtap_blocks for packet commentsDavid Perry1-8/+8
Mostly functioning proof of concept for #14329. This work is intended to allow Wireshark to support multiple packet comments per packet. Uses and expands upon the `wtap_block` API in `wiretap/wtap_opttypes.h`. It attaches a `wtap_block` structure to `wtap_rec` in place of its current `opt_comment` and `packet_verdict` members to hold OPT_COMMENT and OPT_PKT_VERDICT option values.
2020-10-26Impose limits on the number of records we read.Guy Harris1-0/+8
Start the limit at 2^32-1, as we use a guint32 to store the frame number. With Qt prior to Qt 6, lower the limit to 53 million packets; this should fix issue #16908.
2020-05-01Remove some single-SHB assumptions.Guy Harris1-9/+0
Make wtap_file_get_shb() take a section number argument, and update code that called it. In most cases, we convert the code to iterate over sections; in cases where a big code change would be required, we temporarily pass it 0 and mark the code as "needs to be updated for multiple sections". Eliminate cf_read_section_comment(); in calls outside file.c, other code directly calls the libwiretap routines it calls and, inside file.c, we just transplant the code and then fix it not to assume a single SHB. Change-Id: I85e94d0a4fc878e9d937088759be04cb004e019b Reviewed-on: https://code.wireshark.org/review/37000 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2020-02-28Qt: Do not display alerts on repeated failed readsTomasz Moń1-0/+5
If read from capture file fails, set a flag that result in subsequent read attempts to not display alert box on read failure. This solves endless "An error occurred while reading the capture file" error when the underlying trace file becomes unavailable. Now it is possible for the user to close the capture file. Bug: 4811 Change-Id: I411bbb3fb717bc994ab1f5e3805e2c8b4ee09c5e Reviewed-on: https://code.wireshark.org/review/36114 Petri-Dish: Tomasz Moń <desowin@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-08-14Wiretap: Fix temporary filename memory corruptionTomasz Moń1-1/+1
The pointer returned by create_tempfile() must not be freed. As the wtap_dump_open_tempfile() callers are freeing the returned filename, duplicate the string so it can be freed. Bug: 15377 Change-Id: Ib0b23aaee748ef67600ef3f7d40610ebbbec721c Reviewed-on: https://code.wireshark.org/review/34272 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2019-07-26HTTPS (almost) everywhere.Guy Harris1-1/+1
Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-15Hava a routine to read the currently-selected frome.Guy Harris1-5/+4
Have cf_read_current_record() take a capture_file as an argument and read, into its wtap_rec and Buffer for the currently-selected frame, information for the currently-selected frame. Rename cf_read_record_r() to cf_read_record(). That gives us 1) a routine that reads the currently-selected frame into the wtap_rec and Buffer for the currently-selected frame and 2) a routine that reads an arbitrary frame into the wtap_rec and Buffer supplied to it. If you *want* the currently-selected record, use the former, otherwise use the latter. Change-Id: If6bd5915dd5bc18334d7b89859822a19234153a4 Reviewed-on: https://code.wireshark.org/review/32858 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-08Use a single wtap_rec and Buffer for an entire capture session.Guy Harris1-2/+8
That way we aren't allocating memory, reading packets from a batch, and freeing the memory for each batch of packets delivered by dumpcap; we do the allocation when the capture starts and the freeing when it finishes. Change-Id: If012ab865f3a99d869535ad10827ad8680c1b10c Reviewed-on: https://code.wireshark.org/review/32766 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-04-06Revert "Get rid of the per-capture_file wtap_rec and Buffer."Peter Wu1-2/+13
This reverts commit 9445403f9558901dc54c88754ff21795ea1803f3. cf_select_packet frees the buffer backing the dissection result (cf->edt) which results in use-after-frees when callers try to access the contents. See for example this call trace: * PacketList::selectionChanged * cf_select_packet(cap_file_, row) * frameSelected(row) -> ByteViewTab::selectedFrameChanged * addTab(source_name, get_data_source_tvb(source)) get_data_source_tvb returns the buffer that backs the dissection and must remain valid even after dissection has completed. If this is not done, then a possibly expensive redissection must be done in order to populate the byte view. The temporary memory savings are not worth it. Bug: 15683 Change-Id: Ia5ec2c7736cdebbac3c5bf46a4e2470c9236262d Reviewed-on: https://code.wireshark.org/review/32758 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-05Get rid of the per-capture_file wtap_rec and Buffer.Guy Harris1-13/+2
Most code that reads from a capture_file already has its own wtap_rec and Buffer; change the remaining ones to do so as well. Change-Id: I9b7c136642bbb375848c37ebe23c9cdeffe830c3 Reviewed-on: https://code.wireshark.org/review/32732 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-01-25Fix memory ownership when using cf_get_packet_commentPeter Wu1-0/+1
cf_get_packet_comment already has one code path that returns duplicated memory. Be sure to document the requirement to free this memory and adjust Qt to avoid memory leaks. Be firm and assume that wth.opt_comment is owned by wth, so duplicate it before returning it from cf_get_packet_comment. Change-Id: I91f406296c9db5ea21b90fc2e108c37de4528527 Ping-Bug: 7515 Reviewed-on: https://code.wireshark.org/review/31712 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Vasil Velichkov <vvvelichkov@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-11-16Use an enum for compression types in various interfaces.Guy Harris1-4/+5
This: 1) means that we don't have to flag the compression argument with a comment to indicate what it means (FALSE doesn't obviously say "not compressed", WTAP_UNCOMPRESSED does); 2) leaves space in the interfaces in question for additional compression types. (No, this is not part 1 of an implementation of additional compression types, it's just an API cleanup. Implementing additional compression types involves significant work in libwiretap, as well as UI changes to replace "compress the file" checkboxes with something to indicate *how* to compress the file, or to always use some other form of compression). Change-Id: I1d23dc720be10158e6b34f97baa247ba8a537abf Reviewed-on: https://code.wireshark.org/review/30660 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-07-06Fix the calculation of a file's "basename".Guy Harris1-0/+11
Strip off only extensions that correspond to file types we know about; QFileInfo::baseName() strips off *all* extensions, where "extension" is "anything preceded by a .", so it turns foo.bar.pcap.gz into foo, not foo.bar. We don't want that; instead, we strip off only those extensions that correspond to file types we know how to read, so we'd strip off .pcap.gz in foo.bar.pcap.gz, and strip off .pcap in foo.bar.pcap, leaving foo.bar in both cases. Change-Id: I5385921ad2f0fef815d52e9902fef15735fd9dae Reviewed-on: https://code.wireshark.org/review/28636 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-04-18Remove trailing comma from enum list.Guy Harris1-1/+1
Change-Id: I3972458e6ede037a8080f34a154ca750a275f723 Reviewed-on: https://code.wireshark.org/review/27012 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-04-17Remove some GTK+-only code.Gerald Combs1-15/+1
Change-Id: Ic2498c7acd6a1a522be45094148402ee34a6b4d1 Reviewed-on: https://code.wireshark.org/review/26958 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-09Generalize wtap_pkthdr into a structure for packet and non-packet records.Guy Harris1-2/+2
Separate the stuff that any record could have from the stuff that only particular record types have; put the latter into a union, and put all that into a wtap_rec structure. Add some record-type checks as necessary. Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2 Reviewed-on: https://code.wireshark.org/review/25696 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-08replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.Dario Lombardo1-1/+1
The first is deprecated, as per https://spdx.org/licenses/. Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed Reviewed-on: https://code.wireshark.org/review/25661 Petri-Dish: Anders Broman <a.broman58@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-12-04Put the structure of a capture_file back in cfile.h.Guy Harris1-1/+0
The split isn't necessary now that epan no longer uses the capture_file structure. Change-Id: Ia232712a2fb5db511865805518e8d03509b2167f Reviewed-on: https://code.wireshark.org/review/24693 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-12-03Use cfile.h to define the capture_file type.Guy Harris1-2/+3
Have cfile-int.h declare the structure, and use it in files that directly access the structure. Have cfile.h just incompletely declare the structure and include it rather than explicitly declaring it in source files or other header files. Never directly refer to struct _capture_file except when typedeffing capture_file. Add #includes as necessary, now that cfile.h doesn't drag in a ton of Change-Id: I7931c8039d75ff7c980b0f2a6e221f20e602a556 Reviewed-on: https://code.wireshark.org/review/24686 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-11-24GTK: Remove packet editorJoão Valverde1-12/+0
Removes limited experimental feature for deprecated UI. Change-Id: Ib3ccfae89dd2a674ebbde346a442fa1cf6587f26 Reviewed-on: https://code.wireshark.org/review/24563 Petri-Dish: João Valverde <j@v6e.pt> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-11-09Start using SPDX license identifiers.Gerald Combs1-13/+1
A while back Graham pointed out the SPDX project (spdx.org), which is working on standardizing license specifications: https://www.wireshark.org/lists/wireshark-dev/201509/msg00119.html Appendix V of the specification describes a short identifier (SPDX-License-Identifier) that you can use in place of boilerplate in your source files: https://spdx.org/spdx-specification-21-web-version#h.twlc0ztnng3b Start the conversion process with our top-level C and C++ files. Change-Id: Iba1d835776714deb6285e2181e8ca17f95221878 Reviewed-on: https://code.wireshark.org/review/24302 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Reviewed-by: Balint Reczey <balint@balintreczey.hu> Tested-by: Petri Dish Buildbot Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-07-17Rename cf_get_comment() to reflect what comment it gets.Guy Harris1-1/+9
Change-Id: Id3b0430a1d462b29833259462536ed4cb0424f77 Reviewed-on: https://code.wireshark.org/review/22662 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-07-17Rename section comment get/set routines.Guy Harris1-2/+4
Rename cf_read_shb_comment() to cf_read_section_comment(); an SHB is a record type in a particular capture file format (pcapng), and not all files that have per-file or per-file-section comments have something called a Section Header Block. Rename cf_update_capture_comment() to cf_update_section_comment(); pcapng, at least, supports multiple sections, although we don't curently support that. This also gives them matching names. Change-Id: Idd8cb0f0fd9125b9626411274aebfb1ec0097665 Reviewed-on: https://code.wireshark.org/review/22659 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-19Update the capture file load time each time we update the progress bar.Jeff Morriss1-1/+1
The Qt UI doesn't have a popup that tells you how long your file has been loading. So let's set the load time each time we update the packets bar. (Obviously this is only useful when you're waiting a long time for a file to load...) Change-Id: I9da372800a12454888439e2baf3d2a848c611501 Reviewed-on: https://code.wireshark.org/review/22234 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-04-24Move UI-only stuff out of libwireshark.Guy Harris1-1/+26
Packet ranges are used only in the UI; move the packet range stuff into libui. Don't pass a print_args_t structure to libwireshark packet-printing routines, just pass the few parameters they need. Move the declaration of print_args_t into file.h. Change-Id: Icff5991eea7d7d56f33b4716105895263d275bcf Reviewed-on: https://code.wireshark.org/review/21308 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-01-21Qt: Show merge progress.Gerald Combs1-3/+6
Add "file merge" callback plumbing. Use it to display "Merging files" in the main statusbar. Make sure we have a usable window pointer when we merge files. Change-Id: I236b6edb30685f0b06703ab8304bc88ae592f83c Reviewed-on: https://code.wireshark.org/review/19716 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-12-16Rename packet-range.[ch] to packet_range.[ch]Michael Mann1-1/+1
The check*.pl scripts presume that files with the prefix "packet-" are dissector files and therefore have different rules than other files. Rather than trying to clarify that more with additional directory information, just make any non-dissector file with "packet-" filename prefix conform if it fails a "dissector specific" check from the scripts. Change-Id: I7cb52e1fad4ea62320492bb690904260f958aeb4 Reviewed-on: https://code.wireshark.org/review/19304 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-12-12Get rid of some GTK+-only routines in file.c.Guy Harris1-15/+0
Just directly call the packet_list_select_ routine from the GTK+ code. Change-Id: I9146fb968c407d6186b146a86aa34678765f7352 Reviewed-on: https://code.wireshark.org/review/19225 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-12-12Mark routines GTK+ only.Gerald Combs1-0/+1
Mark packet_list_select_last_row and cf_goto_bottom_frame GTK+ only. Change-Id: I158814c2fa8c5fa8021b7156dded0945535c978a Reviewed-on: https://code.wireshark.org/review/19223 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2016-12-04Have separate merge APIs for regular file/temporary file/standard output.Guy Harris1-6/+6
This is similar to what we have for opening a dump file - one API that uses the file name as specified, one that creates a temporary file and provides the file name, and one that uses the standard output. All of those APIs handle closing the output file. Change-Id: I56beea7be347402773460b9148ab31a8f8bc51e1 Reviewed-on: https://code.wireshark.org/review/19059 Reviewed-by: Guy Harris <guy@alum.mit.edu>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-24 07:12:01 +0000