diff options
author | John Thacker <johnthacker@gmail.com> | 2023-02-04 13:49:10 -0500 |
---|---|---|
committer | John Thacker <johnthacker@gmail.com> | 2023-02-07 13:33:20 +0000 |
commit | ca230a59e05b1a2b89faeaec33e6396c9344c81f (patch) | |
tree | ef7409420ccd840505114a776bbadf931ca71d95 /tshark.c | |
parent | e8db896c624ca142c13eaac3ba96afa91b67d9db (diff) |
wiretap, pcapng: Distinguish WTAP_ENCAP_UNKNOWN and _NONE
WTAP_ENCAP_UNKNOWN is used for two different cases:
1. Encapsulation type values that are unsupported by libwiretap or
bogus values (and thus "unknown" to libwiretap).
2. An initial state where the encapsulation type is "not yet" known
for a file type like pcapng without a single encapsulation type in the
header, before any packets or interfaces that set the encapsulation type
have been read. (If the file has no packets, this may be the value after
the file is entirely read in.) This can be the value when an output file
is written out simultaneously with reading an input file, rather than
reading the entire input file first, and, e.g., there is a custom block
before any IDBs.
The first case can never be handled when writing out a file, but the
second case can possibly be handled, so long as (for pcapng) IDBs
are available to write when they become necessary, or (for file
types like pcap with a single link-layer type in the header) the
writer waits until a link-layer type is seen to create the output
header. (It is possible, of course, that writing would fail in the
middle if an unsupported encapsulation type appears, or if the
encapsulation becomes per-packet for file types that don't support that,
but that is an unavoidable risk when writing without reading the entire
input file(s).)
Introduce WTAP_ENCAP_NONE for the second case, and use it for pcapng,
where we guarantee that any necessary IDBs will be passed along.
Continue to use WTAP_ENCAP_UNKNOWN for the first case.
Allow pcapng files to open a file for writing with WTAP_ENCAP_NONE.
There are some other file types that support per-packet link-types,
and could also use WTAP_ENCAP_NONE, but they require more work to
generate IDBs. (Note that all of them currently are impossible to
write to pcapng when they have multiple encapsulations, even if
the encapsulations are all supported by pcapng, because they don't
properly generate IDBs.)
Remove the workaround in ef43fd48b4f981392a0c61b5e9a804e8f9c85eb4
for tshark writing to pcapng when the source file is WTAP_ENCAP_UNKNOWN,
since now such files will be WTAP_ENCAP_NONE and work properly (and
also work in editcap, mergcap, etc.)
Along with 8cddc32d35e36d9962495c3d4358842ea88aac41, fix #18449.
Diffstat (limited to 'tshark.c')
-rw-r--r-- | tshark.c | 18 |
1 files changed, 0 insertions, 18 deletions
@@ -3623,24 +3623,11 @@ process_cap_file(capture_file *cf, char *save_file, int out_file_type, wtap_dump_params params = WTAP_DUMP_PARAMS_INIT; char *shb_user_appl; pass_status_t first_pass_status, second_pass_status; - gboolean pcapng_pcapng_workaround = false; - wtapng_iface_descriptions_t if_tmp; if (save_file != NULL) { /* Set up to write to the capture file. */ wtap_dump_params_init_no_idbs(¶ms, cf->provider.wth); - /* workaround for pcapng -> pcapng (e.g., when pcapng starts with a custom block) */ - if (out_file_type == wtap_pcapng_file_type_subtype() && params.encap == WTAP_ENCAP_UNKNOWN) { - pcapng_pcapng_workaround = true; - params.encap = WTAP_ENCAP_PER_PACKET; - params.dont_copy_idbs = true; /* make sure this stay true */ - if (params.idb_inf->interface_data != NULL) { - /* lets fake an interface, which is not copied anyway */ - g_array_insert_val(params.idb_inf->interface_data, 0, if_tmp); - } - } - /* If we don't have an application name add TShark */ if (wtap_block_get_string_option_value(g_array_index(params.shb_hdrs, wtap_block_t, 0), OPT_SHB_USERAPPL, &shb_user_appl) != WTAP_OPTTYPE_SUCCESS) { /* this is free'd by wtap_block_unref() later */ @@ -3664,11 +3651,6 @@ process_cap_file(capture_file *cf, char *save_file, int out_file_type, &err, &err_info); } - if (pcapng_pcapng_workaround) { - /* remove the fake interface before it will be used */ - g_array_remove_index((params.idb_inf->interface_data), 0); - } - g_free(params.idb_inf); params.idb_inf = NULL; |