aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/peektagged.c
AgeCommit message (Collapse)AuthorFilesLines
2016-09-29Replace some seeks forward with wtap_read_bytes() with a null buffer pointer.Guy Harris1-2/+3
If the seek forward is just skipping record content that's not (currently) interesting, use wtap_read_bytes() with a null buffer pointer; it catches short "reads" and requires less seeking, so it may work better when reading from a pipe. Change-Id: Ifb07d20e0391a8ed97da85149d971b4e9ef093a8 Reviewed-on: https://code.wireshark.org/review/17976 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-09-28Use wtap_read_bytes() to skip over bytes when reading a record.Guy Harris1-1/+1
Allow file_read() to take a null pointer as a buffer argument; a null argument means "do everything except copy the bytes from the file to the user buffer". That means that wtap_read_bytes() and wtap_read_bytes_or_eof() also support a null pointer as a buffer argument. Use wtap_read_bytes() with a null buffer argument rather than file_skip() to skip forward over data. This fixes some places where files were mis-identified as ERF files, as the ERF open heuristics now get a short "read" error if they try to skip over more bytes than exist in the file. Change-Id: I4f73499d877c1f582e2bcf9b045034880cb09622 Reviewed-on: https://code.wireshark.org/review/17974 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-06*_stdup_printf -> strdup for "single string only" formatting.Michael Mann1-1/+1
Done for performance improvements. This could probably be done in checkAPIs.pl, but this was just a quick manual check with grepping. Change-Id: I91ff102cb528bb00fa2f65489de53890e7e46f2d Reviewed-on: https://code.wireshark.org/review/15751 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2015-12-24Refactor 802.11 radio flags.Simon Barber1-29/+20
The use of a flag field here is aesthetically unpleasing when the flags are referred to frequently. Convert these into bitfield entries. Change-Id: I6f47e31558439dfd343ec7f856d04480366a1237 Reviewed-on: https://code.wireshark.org/review/12511 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-07-06Add some comments.Guy Harris1-0/+5
OK, where's NSS for the presumably-one-and-only user hiding for 11ac? Change-Id: I53eb216c5d209dc5bb46c1d0aca7f8a200161e3e Reviewed-on: https://code.wireshark.org/review/9512 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-07-05Use space indentation consistently.Guy Harris1-7/+7
Change-Id: I1af52157a8c7383981c514d9dddea3b7186dbe6d Reviewed-on: https://code.wireshark.org/review/9509 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-07-02Zero out the nss array when we don't have the 802.11ac information we need.Guy Harris1-0/+3
Change-Id: I576be8c1a1badf6befe90a226f83e8d03f8326a7 Reviewed-on: https://code.wireshark.org/review/9470 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-26Fix handling of 11ac radio metadata.Guy Harris1-5/+6
Add more fields to the metadata to handle everything radiotap has, and show them. Call the FEC type field just "FEC", and have it be an integer field with 0 meaning BCC and 1 meaning LDPC, rather than a Boolean. 11ac doesn't have *an* MCS, it can have up to 4, one per user. Label the 11ac bandwidth values the same way we do in the radiotap dissector. Change-Id: I2c2415baff3e5d68d49dda497980e8271d26b1f6 Reviewed-on: https://code.wireshark.org/review/9176 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25If we don't have both frequency and channel, try to calculate the other.Guy Harris1-0/+45
Just for completeness' sake. Change-Id: I1ed609431c8bc62a79ebbf837fa2fc62f627a002 Reviewed-on: https://code.wireshark.org/review/9157 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25Squelch a compiler warning.Guy Harris1-0/+2
Change-Id: I7a833915173248cda68857493f2000a71052ec53 Reviewed-on: https://code.wireshark.org/review/9151 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25Clean up 802.11 radio information handling.Guy Harris1-49/+78
Have a field that holds the PHY type but nothing else. Have a union with structures holding PHY-type-specific information, as a bunch of attributes are PHY-specific. If we have a channel and band, but don't have the frequency, attempt to calculate the frequency, and add that to the radio information if we succeed. If we have the frequency, but don't have the channel, attempt to calculate the channel, and add that to the radio information if we succeed. Handle FHSS information, 11a "half/quarter-clocked" and turbo information, 11g normal vs. Super G, additional 11n and 11ac information, and the "short preamble" flag for 11b and 11g. Add a PHY type for 11 legacy DSSS and detect it if possible. Clean up the AVS dissector - make all fields wlancap. fields (if you want generic fields, use the wlan_radio. fields). Set more fields when writing out Commview Wi-Fi files. Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69 Reviewed-on: https://code.wireshark.org/review/9146 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-22Provide PHY type and band information in the 802.11 pseudo-header.Guy Harris1-119/+102
Provide that information so that the "802.11 radio information" protocol can indicate whether a packet was 802.11 legacy/11b/11a/11g/11n/11ac, and possibly whether it's 2.4 GHz or 5 GHz 11n. (Sometimes the center frequency might not be supplied, so the band information can be useful.) Also, provide some 11ac information, now that we can distinguish between 11n and 11ac. Don't calculate the data rate from the MCS index unless it's 11n; we don't yet have code to calculate it for 11ac. For radiotap, only provide guard interval information for 11n and 11ac, not for earlier standards. Handle the 11ac flag in the Peek remote protocol. For Peek tagged files, the "extension flags" are 11n/11ac flags, so we don't have to check for the "MCS used" bit in order to decide that the packet is 11n or 11ac or to decide whether to provide the "bandwidth" or "short GI" information. Change-Id: Ia8a1a9b11a35243ed84eb4e72c384cc77512b098 Reviewed-on: https://code.wireshark.org/review/9032 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-20Call the "802.11 radio information" dissector for radio headers.Guy Harris1-0/+1
Have dissectors of various forms of radio information headers in the packets fill in a struct ieee_802_11_phdr with radio information as appropriate, and call the "802.11 radio information" dissector rather than the raw 802.11 dissector. This means that the radio information can be found in a protocol-independent and encapsulation-independent form when you're looking at the packet; that information can be presented in a form somewhat easier to read than the raw metadata header format. It also enables having a single "radio information" tap that allows statistics to handle all different sorts of radio information encapsulation. In addition, it lets us clean up some of the arguments passed to the common 802.11 dissector routine, by having it pull that information from the struct ieee_802_11_phdr. Ensure that the right structure gets passed to that routine, and that all the appropriate parts of that structure are filled in. Rename the 802.11 radio protocol to "wlan_radio", rather than just "radio", as it's 802.11-specific. Give all its fields "wlan_radio." names rather than "wlan." names. Change-Id: I78d79afece0ce0cf5fc17293c1e29596413b31c8 Reviewed-on: https://code.wireshark.org/review/8992 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-05-06WildPackets → Savvius.Gerald Combs1-6/+6
Change-Id: I2494c2b1dcc9e324535b3f659b51b44059c478bd Reviewed-on: https://code.wireshark.org/review/8304 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-04-21Calculate *Peek tagged timestamps in fixed-point.Guy Harris1-17/+7
Add a variant of filetime_to_nstime() that takes a value that's like a FILETIME but in units of nanoseconds rather than tenths of a microsecond, and use that. (It looks as if they might just get FILETIME values from the OS and multiply them by 100, as the nanosecond-FILETIME values appear to be multiples of 100 in the captures I've seen, but they might have chosen nanosecond resolution in case they need to support a higher-resolution time stamp source, so we don't assume that the values will always be a multiple of 100.) Change-Id: If6a1cb2cb673688b042eb113b79cfd267f5454a5 Reviewed-on: https://code.wireshark.org/review/8150 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-01-24Get Wireshark to compile with afl-gcc.Gerald Combs1-1/+1
Fix errors found by American Fuzzy Lop's afl-gcc (http://lcamtuf.coredump.cx/afl/): peektagged.c: error: 'fileVersion' may be used uninitialized in this function packet-h223.c: error: variable 'circuit_id' might be clobbered by 'longjmp' or 'vfork' wslua_proto.c: error: variable 'd' might be clobbered by 'longjmp' or 'vfork' wslua_proto.c: error: variable 'dt' might be clobbered by 'longjmp' or 'vfork' Change-Id: Idd74a3ad7b236d3a8756c1e7e917b1c74143f381 Reviewed-on: https://code.wireshark.org/review/6767 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2015-01-03Remove unnecessary includes from wiretap folderMartin Mathieson1-1/+0
Change-Id: I10d3057801673bc1c8ea78f144215869cc4b1851 Reviewed-on: https://code.wireshark.org/review/6217 Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com> Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-02Add "Editor modelines"; Adjust whitespace as needed.Bill Meier1-376/+389
Change-Id: Ic5a5acb0f36d3aa144edbfb1ae71097b18426db4 Reviewed-on: https://code.wireshark.org/review/6216 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-12-17Use WTAP_ERR_UNSUPPORTED for input file stuff we can't handle.Guy Harris1-1/+1
WTAP_ERR_UNSUPPORTED_ENCAP means "I can't *write* that particular encapsulation type to a file of this format", which mainly means "that file format simply can't handle packets of that type"; WTAP_ERR_UNSUPPORTED means "this file can't currently be supported by Wireshark, as there's some feature in the file - such as a file or per-packet encapsulation type - that we don't (yet) handle". Change-Id: I53cadf9913d20efb2bccb29f61877b71d53807be Reviewed-on: https://code.wireshark.org/review/5794 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Dataflow analysis is hard, let's go shopping!Guy Harris1-0/+2
Another case where the compiler didn't figure out that the variables aren't used if they're not set. Change-Id: I70bfb06c6d86d41a266a087ece971c40cd697ee9 Reviewed-on: https://code.wireshark.org/review/4994 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Squelch some used-but-not-set warnings (one legitimate, others not).Guy Harris1-6/+6
Also, we don't care how much tagged value data we've read, we just care whether we've read any or not (EOF reading the first one means "end of file", EOF reading any of the subsequent ones means "short read"). Change-Id: I2edc54494967b3a88bcc2c79d97eedfded00150d Reviewed-on: https://code.wireshark.org/review/4993 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Use correct variable.Guy Harris1-1/+1
To check whether data_rate_or_mcs_index is set, check saw_data_rate_or_mcs_index; we might see a value of 0 for that field (it's a valid MCS index), so we can't use it as an out-of-band value meaning "not set". Change-Id: I75d7fdb4a90836538c82f56f2afb05c0603278a5 Reviewed-on: https://code.wireshark.org/review/4991 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Extract the center frequency from Peek tagged files.Guy Harris1-0/+2
Change-Id: I44bc278f563264ca20f0250fc3376b6741bdcbfa Reviewed-on: https://code.wireshark.org/review/4990 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Support the bandwidth and "short GI" fields from Peek tagged files.Guy Harris1-0/+49
Add a number of fields corresponding to components of the radiotap MCS field, add presence bits for them, and set and dissect the fields supported by Peek tagged files. Change-Id: I3fc801a3bc180e1c174d074a794af0f3d338f249 Reviewed-on: https://code.wireshark.org/review/4989 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Handle the MCS index in Peek tagged files.Guy Harris1-38/+49
Use the "MCS index used" extended flag bit to indicate whether the "data rate or MCS index" field is a data rate or MCS index. Display the MCS index value if it's present. (More to come - MCS indices, plus other information, should be used to calculate the data rate for 11n and beyond.) Get rid of the hdr_info_t structure while we're at it; just use local variables for each of the fields. Change-Id: I546f53a8ebd89078d5f23e1290557b97348aff38 Reviewed-on: https://code.wireshark.org/review/4988 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-29Expand the 802.11 pseudo-header and support new radio metadata.Guy Harris1-4/+11
Add a set of presence bits, so we can indicate which bits of radio metadata we do and don't have. Fill in more radio metadata from capture files, and display it. (More to come.) Change-Id: Idea2c05442c74af17c14c4d5a8d8025ab27fbd15 Reviewed-on: https://code.wireshark.org/review/4987 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-28Add a comment showing mapping to radiotap.Guy Harris1-0/+55
Useful if we try to provide some "standard" 802.11 metadata header that can support both radiotap and Peek tagged (and perhaps others). Change-Id: Ibac9829e3411670a439db7cb77e1694a5641b0a5 Reviewed-on: https://code.wireshark.org/review/4970 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-28Some additional information from bug 10637.Guy Harris1-9/+45
That bug includes a capture and a screendump of OmniPeek's dissection of the packet in that capture; this lets us identify some tags as the center frequency of the 802.11 channel and a set of extended flags used for 802.11n and 802.11ac. Show some flags from bug 9586, under the assumption that certain fields in the Peek tagged header correspond to certain fields in the remote Peek protocol. Change-Id: I0f3c2e6638d6cf5f6ec470d65bd574171a2d958d Reviewed-on: https://code.wireshark.org/review/4969 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-10wtap_file_read_till_separator() can return values other than 1 on success.Guy Harris1-1/+1
It returns the length of the string it read, so only treat 0 and -1 as errors. (0 either means "EOF" or "string is zero length", but this is only in the code that reads numbers, and a number needs at least 1 digit, so both EOF and "zero-length string" mean "this isn't a valid Peek tagged file".) Change-Id: Ib83eb2f1e53d912a2138be01480e2b464cf936db Reviewed-on: https://code.wireshark.org/review/4591 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-10Don't treat int return values as valid wtap_open_return_val values.Guy Harris1-8/+10
They happen to be, at least now, but that's not valid in C++, and it's probably unwise in any case. Change-Id: Ifd49920cfaa376e5e7788329ee83db3956a7cdff Reviewed-on: https://code.wireshark.org/review/4585 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-09Use an enum for the open-routine return value, as per Evan Huus's suggestion.Guy Harris1-18/+18
Clean up some things we ran across while making those changes. Change-Id: Ic0d8943d36e6e120d7af0a6148fad98015d1e83e Reviewed-on: https://code.wireshark.org/review/4581 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07Add some higher-level file-read APIs and use them.Guy Harris1-18/+8
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an error number pointer, and an error string pointer as arguments, and that treats a short read of any sort, including a read that returns 0 bytes, as a WTAP_ERR_SHORT_READ error, and that returns the error number and string through its last two arguments. Add wtap_read_bytes_or_eof(), which is similar, but that treats a read that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF indication. Use those in file readers; that simplifies the code and makes it less likely that somebody will fail to supply the error number and error string on a file read error. Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210 Reviewed-on: https://code.wireshark.org/review/4512 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-09-28Make the time stamp resolution per-packet.Guy Harris1-1/+1
Pcap-ng files don't have a per-file time stamp resolution, they have a per-interface time stamp resolution. Add new time stamp resolution types of "unknown" and "per-packet", add the time stamp resolution to struct wtap_pkthdr, have the libwiretap core initialize it to the per-file time stamp resolution, and have pcap-ng do the same thing with the resolution that it does with the packet encapsulation. Get rid of the TS_PREC_AUTO_XXX values; just have TS_PREC_AUTO, which means "use the packet's resolution to determine how many significant digits to display". Rename all the WTAP_FILE_TSPREC_XXX values to WTAP_TSPREC_XXX, as they're also used for per-packet values. Change-Id: If9fd8f799b19836a5104aaa0870a951498886c69 Reviewed-on: https://code.wireshark.org/review/4349 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-07-15Only one buffer.c, please.Guy Harris1-1/+1
Otherwise, if you link with both libwiretap and libfiletap, it's anybody's guess which one you get. That means you're wasting memory with two copies of its routines if they're identical, and means surprising behavior if they're not (which showed up when I was debugging a double-free crash - fixing libwiretap's buffer_free() didn't fix the problem, because Wireshark happened to be calling libfiletap' unfixed buffer_free()). There's nothing *tap-specific about Buffers, anyway, so it really belongs in wsutil. Change-Id: I91537e46917e91277981f8f3365a2c0873152870 Reviewed-on: https://code.wireshark.org/review/3066 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-24Allow wtap_read() and wtap_seek_read() to return records other than packets.Guy Harris1-0/+1
Add a "record type" field to "struct wtap_pkthdr"; currently, it can be REC_TYPE_PACKET, for a record containing a packet, or REC_TYPE_FILE_TYPE_SPECIFIC, for records containing file-type-specific data. Modify code that reads packets to be able to handle non-packet records, even if that just means ignoring them. Rename some routines to indicate that they handle more than just packets. We don't yet have any libwiretap code that supplies records other than REC_TYPE_PACKET or that supporting writing records other than REC_TYPE_PACKET, or any code to support plugins for handling REC_TYPE_FILE_TYPE_SPECIFIC records; this is just the first step for bug 8590. Change-Id: Idb40b78f17c2c3aea72031bcd252abf9bc11c813 Reviewed-on: https://code.wireshark.org/review/1773 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23Revert "Allow wtap_read() and wtap_seek_read() to return non-packet records."Guy Harris1-10/+10
This reverts commit c0c480d08c175eed4524ea9e73ec86298f468cf4. A better way to do this is to have the record type be part of struct wtap_pkthdr; that keeps the metadata for the record together and requires fewer API changes. That is in-progress. Change-Id: Ic558f163a48e2c6d0df7f55e81a35a5e24b53bc6 Reviewed-on: https://code.wireshark.org/review/1741 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23Allow wtap_read() and wtap_seek_read() to return non-packet records.Guy Harris1-10/+10
This is the first step towards implementing the mechanisms requestd in bug 8590; currently, we don't return any records other than packet records from libwiretap, and just ignore non-packet records in the rest of Wireshark, but this at least gets the ball rolling. Change-Id: I34a45b54dd361f69fdad1a758d8ca4f42d67d574 Reviewed-on: https://code.wireshark.org/review/1736 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09Revert "Refactor Wiretap"Guy Harris1-115/+112
This reverts commit 1abeb277f5e6bd27fbaebfecc8184e37ba9d008a. This isn't building, and looks as if it requires significant work to fix. Change-Id: I622b1bb243e353e874883a302ab419532b7601f2 Reviewed-on: https://code.wireshark.org/review/1568 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09Refactor WiretapMichael Mann1-112/+115
Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality. The "architectural" changes can be found in cfile.h, wtap.h, wtap-int.h and (new file) wftap-int.h. Most of the other (painstaking) changes were really just the result of compiling those new architecture changes. bug:9607 Change-Id: Ife858a61760d7a8a03be073546c0e7e582cab2ae Reviewed-on: https://code.wireshark.org/review/1485 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-01-02No seek-read routines use the length argument, so eliminate it fromGuy Harris1-4/+2
wtap_seek_read(). svn path=/trunk/; revision=54570
2013-12-26Add some new tags seen.Guy Harris1-1/+48
svn path=/trunk/; revision=54460
2013-12-03wiretap: start using <wsutil/pint.h>Jakub Zawadzki1-8/+8
svn path=/trunk/; revision=53764
2013-11-08(Trivial) whitespace cleanup (mostly trailing whitespace).Bill Meier1-1/+1
svn path=/trunk/; revision=53172
2013-11-08The "file types" we have are actually combinations of types andGuy Harris1-1/+1
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2 are separate "file types", even though they both come from Network Monitor. Rename various functions, #defines, and variables appropriately. svn path=/trunk/; revision=53166
2013-06-17Merge "read record header" and "read packet data" routines into a singleGuy Harris1-17/+17
routine, used both by read and seek-read routines. svn path=/trunk/; revision=49988
2013-06-16Have the seek-read routines take a Buffer rather than a guint8 pointerGuy Harris1-15/+11
as the "where to put the packet data" argument. This lets more of the libwiretap code be common between the read and seek-read code paths, and also allows for more flexibility in the "fill in the data" path - we can expand the buffer as needed in both cases. svn path=/trunk/; revision=49949
2013-06-03Initialize the whole hdr_info structure to please gcc 4.3.2Pascal Quantin1-2/+1
svn path=/trunk/; revision=49710
2013-06-03Initialize some variables that GCC 4.7 complains about. I'm not 100% sureEvan Huus1-0/+3
that the complaints are valid, or that simply zeroing them is the right fix if they are, but at least it builds now. Should we be erroring if we don't see a sliceLength header? svn path=/trunk/; revision=49705
2013-06-02Move code to fill in the wtap_pkthdr into peektagged_process_header(),Guy Harris1-102/+87
so that it's filled in by both the read and seek-read routines. svn path=/trunk/; revision=49701
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-20 19:38:47 +0000