aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap
AgeCommit message (Collapse)AuthorFilesLines
2019-09-08erf: Use g_get_real_time() to get real timeStig Bjørlykke1-3/+3
Use g_get_real_time() to get real time because GTimeVal and g_get_current_time() was deprecated in glib 2.62. Change-Id: I78fee34e2f5b634c91c6420b01915cfc070f38a4 Reviewed-on: https://code.wireshark.org/review/34468 Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org> Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-09-04Put the year field of the timestamp out in little-endian byte order.Guy Harris1-2/+2
Change-Id: I9de300b05e8d66e71359241fddfe10d90f3f8d33 Reviewed-on: https://code.wireshark.org/review/34454 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-09-04Wiretap: Write commview files with valid headersJaap Keuter1-2/+2
When writing a capture as a commview file the header written is two bytes longer than the specification. Even though we count 24, we actually write 26. This makes the commview file corrupt, as is apparent when reading such file, eg., after using Save As... with this format. Replace writing 2 bytes for the last two fields in the header by 1 byte each, as per the header specification. Change-Id: I9436f7837b2e3617a389619884bf93ad146e95f3 Reviewed-on: https://code.wireshark.org/review/34450 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-09-03Strengthen the PacketLogger heuristics.Guy Harris1-20/+159
Check the time stamp microseconds field; it must be < 10^6. Check the first few packets, not just the first packet. Change-Id: I35a58a79d48db13daee937374caae40bc320e9e7 Ping-Bug: 16031 Reviewed-on: https://code.wireshark.org/review/34437 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-09-02What we're testing for is byte-swappedness, not raw endianness.Guy Harris1-17/+14
On a big-endian machine, if the upper 16 bits of the length are non-zero and the lower 16 bits are zero, that means that the length is *little*-endian. What we really care about is whether the file is in the reading host's native format, so we can just fetch integral values without swapping, or not in that format, in which case we have to byte-swap integral values. Rename the variable and redo the code to match. (This may have caused the PacketLogger reader to fail on big-endian machines.) Change-Id: Ie1a82a7d40e2c58c0b8d482d7c95ab60061ca980 Ping-Bug: 10861 Reviewed-on: https://code.wireshark.org/review/34434 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-09-02If we get a short read on the first packet in the open, don't check any more.Guy Harris1-37/+37
There's no point in trying to read more packets to check the file type. Change-Id: Ic2c5a7692b60fab8a0022503338a40befe00d358 Ping-Bug: 16031 Reviewed-on: https://code.wireshark.org/review/34433 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-09-02Strengthen the I4B heuristics.Guy Harris2-19/+89
Check some more field values, and fix some tests to check against the maximum possible value given in the i4b_trace.h file rather than against that value + 1. (> max, or >= max+1, are both reasonable, but > max+1 isn't.) Check the first few packets, not just the first packet. Make some header fields unsigned, as that's how we treat them in most cases; that way we treat them that way by default. Change-Id: I8c2d28af048c676a3dbae367bbb49c886e0dc566 Ping-Bug: 16031 Reviewed-on: https://code.wireshark.org/review/34432 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-08-26log3gpp: fix no previous prototype for functionAlexis La Goutte1-0/+6
log3gpp.c:459:10: warning: no previous prototype for function 'log3gpp_dump[|open|finish]' [-Wmissing-prototypes] Change-Id: I1d896f90d91dc04b68b12f48ae06526556a428d4 Reviewed-on: https://code.wireshark.org/review/33963 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-08-20Boost the maximum packet size for LINKTYPE_USBPCAP in pcap/pcapng.Guy Harris2-19/+34
Bug: 15985 Change-Id: I8e043431bbf874d640d4407335d525a44815ee73 Reviewed-on: https://code.wireshark.org/review/34327 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-08-14Wiretap: Fix temporary filename memory corruptionTomasz Moń1-1/+1
The pointer returned by create_tempfile() must not be freed. As the wtap_dump_open_tempfile() callers are freeing the returned filename, duplicate the string so it can be freed. Bug: 15377 Change-Id: Ib0b23aaee748ef67600ef3f7d40610ebbbec721c Reviewed-on: https://code.wireshark.org/review/34272 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2019-08-04Set tm_isdst before calling mktime().Guy Harris1-12/+14
You either have to set it to 1 or 0 if you know whether it's shifted time or set it to -1 if you don't. Should address Coverity CID 1452227. Change-Id: I7d435bb6b7dd8897b44bf5103578e3db1a30379e Reviewed-on: https://code.wireshark.org/review/34175 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-08-03wiretap: Add support for Busmaster log file formatMaksim Salau9-21/+1298
Only CAN protocol is supported. Extra information available in J1939 entries is ignored since the J1939 wireshark dissector works with raw CAN frames and makes no use of this extra information. The log format may also encapsulate LIN messages which are not supported by wireshark and thus are ignored. The only limitation is that relative timestamp format is not supported. If a file defines relative format of timestamps, packets are extracted, but timestamps are omitted, since random access deems impossible without reparsing the whole file up to the packet of interest. In order to support relative timestamps we need to parse the whole file at once on open and either dump into a temporary PCAP file or keep messages in a private list and provide access to them on read()/seek_read(). The change also creates a separate header for CAN frame structure definitions which are used by several file readers (candump and busmaster for now). Bug: 15939 Change-Id: I87c5555e4e5e1b142b9984b24544b2591d494fbc Reviewed-on: https://code.wireshark.org/review/34083 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-28HTTPS In Even More Places, update some links.Guy Harris19-32/+42
Fall back on the Wayback Machine for some links. Change-Id: I6a44a2caaeb4fa521c2f08196e7c36069e3bb842 Reviewed-on: https://code.wireshark.org/review/34103 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-07-27HTTPS In Still More Places, update more URLs.Guy Harris1-2/+2
Microsoft reshuffled their documentation - almost all of it moved from msdn.microsoft.com to docs.microsoft.com. Some blogs moved to devblogs.microsoft.com; the comments *didn't* move, so in one case we go to the Wayback Machine - the link isn't dead, but it formats horribly, at least on my browser, but the archived version formats OK. Use the Wayback Machine for some URLs, and update others. Update the sections for MS-ADTS. Point to the HTML versions of some RFCs and I-Ds. Change-Id: I344b20f880de63f1ae2a4e3f9ff98af78a7fe139 Reviewed-on: https://code.wireshark.org/review/34101 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-07-26HTTPS (almost) everywhere.Guy Harris72-74/+74
Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-07-25USBLL: Initial USB 2.0 Link Layer dissectorTomasz Moń3-0/+6
Dissect raw USB Packets. The actual USB packets to transaction conversion (which is needed to pass the data to existing USB URB dissector) is not implemented yet. Ping-Bug: 15908 Change-Id: Ia75d58882d770fdd8650622d318241743069ad8f Reviewed-on: https://code.wireshark.org/review/34006 Reviewed-by: Tomasz Moń <desowin@gmail.com> Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-21Remove ABI compliance checker code.João Valverde1-14/+0
It's broken, unmaintained, poorly implemented and obsoleted by saner debug-info methods. Note: To do the compliance check properly would require much more extensive work to clearly define public and private interfaces (without manual bookeeping of files or symbols either, of course, because who would want that...). Change-Id: Ib801f3c152ca2369f95ca1f4af4d37cd8cc7c47a Reviewed-on: https://code.wireshark.org/review/33928 Petri-Dish: João Valverde <j@v6e.pt> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: João Valverde <j@v6e.pt>
2019-07-20wiretap: candump: Don't generate a temporary PCAP fileMaksim Salau4-248/+149
It's preferable to parse text files and generate packets on demand, rather than generate a temporary PCAP file and dump all available packets into it. Parsing on the fly has a benefit of handling damaged files up to the point of damage, while the approach with a temporary file doesn't allow either to report that the original file is damaged or perform conversion in the first place. This version works faster than the previous one. Command: time ./run/tshark -r ./candump-2019-07-01_111120.log.gz > /dev/null The test file is attached to the bug 15889 The current version: real 0m0,597s user 0m0,533s sys 0m0,118s The previous version: real 0m2,176s user 0m1,966s sys 0m0,100s Bug: 15889 Change-Id: I862ce47752531c2e9d9459f5d865c1fc08f32fea Reviewed-on: https://code.wireshark.org/review/34007 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-12wiretap: do not pollute debug builds with candump debug messagesPascal Quantin3-5/+33
Change-Id: I2f7c4c3d23d5be27c1fac704272b9e581a4de0f7 Reviewed-on: https://code.wireshark.org/review/33912 Petri-Dish: Pascal Quantin <pascal@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Pascal Quantin <pascal@wireshark.org>
2019-07-11wiretap: candump: Reset error info and fix scanner warningsMaksim Salau2-0/+28
candump_open() may be called with non-empty error code and string. The error code is not reset upon success in run_candump_parser() which may mislead the caller function thus affecting opening the file. yy_fatal_error(), yy_alloc(), yy_realloc() and yy_free() make no use of the yyscanner argument, which results in warnings on OSX. In order to get rid of those warning we provide our own implementations of memory allocation functions and hack YY_EXIT_FAILURE macro in order to pretend using the argument. Change-Id: I672d374b26970b2699b9d789b6118e97ba660bdf Reviewed-on: https://code.wireshark.org/review/33892 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-07-11Candump_parser: fix implicit declaration warningUli Heilmeier1-0/+1
Include string.h to fix implicitly declaring library function 'memcpy' with type 'void *(void *, const void *, unsigned long)' Change-Id: Ia6796f1966db606f946e0935ed0e5b70702c88c9 Reviewed-on: https://code.wireshark.org/review/33891 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-11wiretap: Add support of candump logsMaksim Salau7-0/+889
The change adds ability to import text logs produced by the candump tool. E.g.: candump -L can0 -or- candump -l can0 The whole file is read and converted into a temporary PCAPNG file with Exported PDU packets containing SocketCAN frames. Bug: 15889 Change-Id: I5ad93dca96d6e955a4b21cf624f0553e60f060f6 Reviewed-on: https://code.wireshark.org/review/33800 Petri-Dish: Jim Young <jim.young.ws@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-08wiretap: Add a phone log reader.Anders Broman6-2/+931
Change-Id: I0b290df4783616f1eb15e6ad35fbd6d2b4c3dbdd Reviewed-on: https://code.wireshark.org/review/33865 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-01Pass the correct value to ascendlex_destroy().Guy Harris1-1/+1
It takes a yyscan_t as an argument, not a pointer to a yyscan_t; a yyscan_t is a pointer to the scanner state. (A pointer to it is passed to the init routine so that it can be set to point to the allocated state, not because it's a structure itself.) Change-Id: If80ca1caaa07d8a966df8d07f989b722869ac58b Reviewed-on: https://code.wireshark.org/review/33814 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-07-01wiretap: ascend: Destroy lexer state after parsingMaksim Salau1-0/+2
Lexer private structure is initialized but never destroyed or reused. Change-Id: I61d43b4cb14a2d3b3706267eb393e4562adb00f9 Reviewed-on: https://code.wireshark.org/review/33809 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-06-19Fix error message for an unknown pcapng version number.Guy Harris1-1/+1
We were using fields in the pcapng_t that weren't set yet to report the version number in question; use the variables we were checking. Change-Id: Ib03bafe62d8c7b1aa54b2ef22640e3b00722142a Ping-Bug: 15862 Reviewed-on: https://code.wireshark.org/review/33671 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-06-17Add support for embedding WireGuard keys in a pcapng filePeter Wu1-0/+1
pcapng spec update is here: https://github.com/pcapng/pcapng/pull/62 Bug: 15571 Change-Id: I2f1921b1da70ac0bab8c38dd5138a9dfe7843fea Reviewed-on: https://code.wireshark.org/review/33300 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-05-20wtap: Add support for 802.11ah and 802.11ax PHYs.Richard Sharpe1-0/+2
There may need to be more of these. Bug: 15740 Change-Id: I5d3a97ed50d66dfcb85df0ab7053e8a44c531134 Reviewed-on: https://code.wireshark.org/review/33280 Petri-Dish: Richard Sharpe <realrichardsharpe@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2019-05-20pcapng: fix the magic when bytes are swapped.Dario Lombardo1-1/+1
This value is used when checking if the file was generated on a machine with different endianess. The error message changes from "Unrecognized pcapng format or not pcapng data." to "dumpcap: Interface 0 is big endian but we're little endian." Fix dumpcap.c and pcapio.c. Ping-Bug: 15754 Change-Id: I3a31f873f01bcb3f1324410e70f29f285e56c715 Reviewed-on: https://code.wireshark.org/review/33274 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2019-05-173gpp_32_423: Fix dissection of changeTime.Anders Broman1-13/+15
Change-Id: I8d86f92a918044763a02d0ba9856ea97c3937bf1 Reviewed-on: https://code.wireshark.org/review/33240 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-05-16In pcapng_open(), don't use the local pcapng_t once we know it's a pcapng file.Guy Harris1-1/+1
Use the local one *only* while we're trying to determine whether we have a pcapng file or not; once we know we have a pcapng file, and have allocated a pcapng_t and attached it to the wtap structure, pass *that* one to pcapng_read_block(), so if it changes anything in the pcapng_t, it changes the one we're using. Change-Id: I53b32595276be97957a0b6056171471878fa40c4 Reviewed-on: https://code.wireshark.org/review/33226 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-05-16wtap: remove unneeded check (CID: 1441486).Dario Lombardo1-1/+1
wth has been already checked in line 315. Change-Id: Ib620e0b1e9262e5344feb934b024f7817cfda6fd Reviewed-on: https://code.wireshark.org/review/33178 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-05-16Keep and use per-interface, not per-file, FCS length information.Guy Harris1-6/+11
There is no FCS length information for a pcapng file; there's FCS length information for each interface. Change-Id: I3abb1a35b28475aa3ad6f126060140d0a524bbca Reviewed-on: https://code.wireshark.org/review/33215 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-05-10Fill in the packet flags for *Peek classic and tagged files.Guy Harris2-10/+29
Change-Id: I0f075c5bc7bb177a23be11e23e3701a7412a6e3d Reviewed-on: https://code.wireshark.org/review/33153 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-05-09Set packet flags for some link layers.Guy Harris1-7/+44
Change-Id: Ia46a639b241dcbd983205ee0118c51abf5604a15 Reviewed-on: https://code.wireshark.org/review/33124 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-061514 is a better initial Buffer size than 1500.Guy Harris1-1/+1
Ethernet packets without the CRC are 1514 bytes long, not 1500 bytes long; using 1514 bytes will avoid a reallocation for a full-sized Ethernet packet. Change-Id: Ie8da3f13bf3df07e23e4478b7dcf84f06dec6a9d Reviewed-on: https://code.wireshark.org/review/32761 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-05Have wtap_read() fill in a wtap_rec and Buffer.Guy Harris57-453/+417
That makes it - and the routines that implement it - work more like the seek-read routine. Change-Id: I0cace2d0e4c9ebfc21ac98fd1af1ec70f60a240d Reviewed-on: https://code.wireshark.org/review/32727 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-04iseries: ensure the buffer is null terminated.Dario Lombardo2-2/+9
Check buflen to prevent wrong scanf call as well. Bug: 15614 Change-Id: I58a2855d8b1beda067bf9b2d724229ab20249228 Reviewed-on: https://code.wireshark.org/review/32573 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu> Reviewed-by: João Valverde <j@v6e.pt> Reviewed-by: Dario Lombardo <lomato@gmail.com>
2019-03-24iseries: fix wrong indentation.Dario Lombardo1-32/+32
Change-Id: I4d6e145412037e4a3a40688139b12ada0f36e413 Reviewed-on: https://code.wireshark.org/review/32556 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Dario Lombardo <lomato@gmail.com>
2019-03-24Revert "iseries: stop scanning a unicode string when the null terminator is ↵Guy Harris1-1/+1
hit." This reverts commit c599e490281b523df23010ae25307ff002068e17. Reason for revert: This completely fails to recognize Unicode iSeries dumps. Change-Id: Ie31141879b1bc3608a5dfdcba6887bb6f0018a47 Reviewed-on: https://code.wireshark.org/review/32568 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-24iseries: stop scanning a unicode string when the null terminator is hit.Dario Lombardo1-1/+1
Bug: 15614 Change-Id: I1df4992dcd10e7d9a66fc88a0269b70fc065b079 Reviewed-on: https://code.wireshark.org/review/32514 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Dario Lombardo <lomato@gmail.com>
2019-03-23Clean up IPMB/I2C link-layer header types.Guy Harris3-35/+36
209 is LINKTYPE_IPMB_LINUX; add _LINUX/_linux to the WTAP_ENCAP_ name and function/structure names, to clarify that it's not I2C in general, it's I2C with a particular pseudo-header. 199 is now LINKTYPE_IPMB_KONTRON, not LINKTYPE_IPMB, as it doesn't have raw I2C packets, it has I2C packets with a pseudo-header. Change the WTAP_ENCAP_ name, and add a dissector for it. Change-Id: Ie097f4317b03d2b2adfd9b81a4b11caf6268399e Reviewed-on: https://code.wireshark.org/review/32539 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-17Treat erf_timestamp_t's as integral values.Guy Harris1-2/+2
That's what they are, and that's how other code in erf_open() treats them; just use assignment to initialize prevts and to set prevts to ts. Maybe this will keep the Clang static analyzer from calling prevts a garbage value when compared with ts. Change-Id: I2ee2376ced5c3efa6beab34276009a3177c94416 Reviewed-on: https://code.wireshark.org/review/32455 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-16Remove incorrectly-inserted "return FALSE;".Guy Harris1-1/+0
That made PACKET_DESCRIBE() do nothing, causing warnings from the Clang Static Humiliator. Change-Id: I6f433cd193b6398d89038e95c7bf5deb24aa186d Reviewed-on: https://code.wireshark.org/review/32437 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-16Fix up the checks in nspm_signature_version().Guy Harris1-36/+93
Move the read out of nspm_signature_version(), to make it a bit clearer what file I/O we do in the open process; have nspm_signature_version() just look for a signature in a single page. In the loop in nspm_signature_version(), make sure we have enough of the record header to look at the type and length fields in that header before looking at them and, when we can look at them, make sure the length of the record 1) fits in what remains of the page we're looking at and 2) is big enough to be the length of a signature record. Change-Id: I7d625859136e6f39c40b166067fc7efea806d9b0 Reviewed-on: https://code.wireshark.org/review/32426 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-15netscaler: add more sanity checks.Dario Lombardo1-0/+4
Fix more crashes found in the provided bug report. Bug: 15497 Change-Id: If84498fa879ad56c8677f8c1442a8dc0e5906003 Reviewed-on: https://code.wireshark.org/review/32333 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-03-14Ask, in a comment, whether we should do an exact match on signatures.Guy Harris1-0/+2
Change-Id: I3c6e904a2e8cc843687b69f633fd0dfbf0ec7937 Reviewed-on: https://code.wireshark.org/review/32407 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-14Fix the test for a NetScaler trace file.Guy Harris1-7/+21
When testing the signature field against a given version's signature: we require that the signature field's size (size, not C null-terminated string length) be at least the size of the signature string (otherwise, it can't possibly match); we check to make sure that the first N bytes of the signature field, where N is the size of the version's signature string (not including any terminating '\0' in that string), match the version's signature string. I.e., we require that the version's signature string is a prefix of the signature string in the file. This does not require that the signature string in the file be null-terminated. It also doesn't allow the file's signature string to be a substring of the version's signature string, as that's *NOT* sufficient to identify the file as a NetScaler trace file, especially if we forcibly null-terminate the file's signature string and we trucate it to be zero-length, as, in that case, it's *always* a prefix of the version's signature string, and the file is incorrectly identified as a NetScaler trace file. (While we're at it, we make the nspm_signature_isvXXX() routines return true if it *is* and false if it *isn't*, rather than the reverse; having a routine with a name containing "is", and not "isnt", return true if it *isn't* is confusing.) Change-Id: I3694773a71b8b63d280e42f146698c82a0f0c332 Ping-Bug: 15601 Reviewed-on: https://code.wireshark.org/review/32403 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-10Ask in a comment whether we should test HAVE_STRUCT_STAT_ST_BLKSIZE.Guy Harris1-1/+19
We're defining it now based on whether there's an st_blksize member of struct stat. We're currently testing _STATBUF_ST_BLKSIZE, but that's not guaranteed to be defined on platforms that have an st_blksize member of struct stat (it's not defined on macOS, for example). Change-Id: I4e6011a7668da94cf1ca6328e29c50924dd1d8b0 Reviewed-on: https://code.wireshark.org/review/32381 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-03Discard the upper bits of the "network" field in the file header.Guy Harris1-1/+44
Libpcap's done that for a while; we should do so as well. (Ideally, we should use those bits, but there's an issue with pcapng, where the FCS length in the IDB is described as being in units of bits, but where we're treating it as being in units of bytes, that I'd like to resolve first.) Change-Id: Ibcb82f1dcaa8baae5bba55636cea8852a6af814e Reviewed-on: https://code.wireshark.org/review/32303 Reviewed-by: Guy Harris <guy@alum.mit.edu>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-15 19:21:27 +0000