aboutsummaryrefslogtreecommitdiffstats
path: root/epan/follow.h
AgeCommit message (Collapse)AuthorFilesLines
2019-10-04QUIC: Add Follow QUIC Stream support to Qt and tsharkPeter Wu1-1/+2
The QUIC transport protocol provides a stream, similar to HTTP/2. Make it possible to look at the stream contents. This can be helpful while HTTP/3 support is not yet complete. Known issues that will be addressed in the future: - If a single packet contains multiple streams, then Follow QUIC Stream will wrongly include data from streams other than the selected one. This is tracked by bug 16093 and affects HTTP/2 as well. - The Substream index menu does not properly filter for available stream numbers. If a non-existing stream is selected, then changing to another (potentially valid) index results in the "Capture file invalid." error. As workaround, clear the display filter first. - Follow Stream always selects Stream ID 0 instead of the first or currently selected stream field in a packet. Users should manually update the stream index as needed. Change-Id: I5866be380d58c96f0a71a29abdbd1be20ae3534a Ping-Bug: 13881 Reviewed-on: https://code.wireshark.org/review/34694 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-09-22Qt, http2: Add Follow HTTP/2 Stream functionalityAlexander Gryanko1-3/+4
The HTTP/2 protocol multiplexes a single TCP connection into multiple independent streams. The Follow TCP output can interleave multiple HTTP/2 streams, making it harder to analyze a single HTTP/2 stream. Add the ability to select HTTP/2 Streams within a TCP stream. Internally, the HTTP/2 dissector now stores the known Stream IDs in a set for every TCP session which allows an amortized O(n) lookup time for the previous/next/max Stream ID. [Peter: make the dissector responsible for clamping the HTTP/2 Stream ID instead of the Qt code, that should permit future optimizations.] Change-Id: I5d78f29904ae8f227ae36e1a883155c0ed719200 Reviewed-on: https://code.wireshark.org/review/32221 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Alexander Gryanko <xpahos@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2019-03-02Support unsigned stream identifiers for Follow StreamPeter Wu1-2/+2
tcp.stream and udp.stream are already unsigned identifiers. An upcoming http2.hashed_stream identifier can exercise the full unsigned 32-bit number space, so be sure not to treat the stream identifier as signed integer. Change-Id: Ic5d398b2bda7eba7555e385ef3fcd44b490f78c9 Reviewed-on: https://code.wireshark.org/review/32287 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Alexander Gryanko <xpahos@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2019-01-01Add a "failed" return for tap packet routines.Guy Harris1-5/+5
This allows taps that can fail to report an error and fail; a failed tap's packet routine won't be called again, so they don't have to keep track of whether they've failed themselves. We make the return value from the packet routine an enum. Don't have a separate type for the per-packet routine for "follow" taps; they're expected to act like tap packet routines, so just use the type for tap packet routines. One tap packet routine returned -1; that's not a valid return value, and wasn't one before this change (the return value was a boolean), so presume the intent was "don't redraw". Another tap routine's early return, without doing any work, returned TRUE; this is presumably an error (no work done, no need to redraw), so presumably it should be "don't redraw". Clean up some white space while we're at it. Change-Id: Ia7d2b717b2cace4b13c2b886e699aa4d79cc82c8 Reviewed-on: https://code.wireshark.org/review/31283 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-13Start renaming SSL to TLS.Gerald Combs1-1/+1
Rename the "ssl" protocol to "tls" and add an "ssl" alias. Prefer "TLS" over "SSL" in user interface text and in the documentation. Fix the test_tls_master_secret test while we're here. Bug: 14922 Change-Id: Iab6ba2c7c4c0f8f6dd0f6d5d90fac5e9486612f8 Reviewed-on: https://code.wireshark.org/review/29649 Petri-Dish: Gerald Combs <gerald@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-07-06Follow Stream: ensure linear performance with many packetsPeter Wu1-1/+1
Reverse the payload chunks list to achieve a running time of O(n) rather than O(n²) for insertion of all chunks. Executing a RelWithDebInfo+ASAN build with `tshark -r chargen-session.pcapng.gz -qz follow,tcp,hex,0` previously took 11m5s to complete, but now finishes in 16 seconds. Tested using a capture file with 152k TCP packets (from bug 11777). Backport note: must update ui/gtk/follow_stream.c too. Change-Id: Icf70d45f33d4399e53209fb6199d3809608c8d99 Reviewed-on: https://code.wireshark.org/review/28595 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-08epan: use SPDX indentifiers.Dario Lombardo1-13/+1
Skipping dissectors dir for now. Change-Id: I717b66bfbc7cc81b83f8c2cbc011fcad643796aa Reviewed-on: https://code.wireshark.org/review/25694 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-10-26Add a ws_in6_addr typedef for struct e_in6_addr.Guy Harris1-1/+1
That allows a parallel typedef of ws_in4_addr for guint32. Change-Id: I03b230247065e0e3840eb87635315a8e523ef562 Reviewed-on: https://code.wireshark.org/review/24073 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-02-08Switch follow (tables) to use wmem_tree_t instead of (sorted) GSList.Michael Mann1-5/+2
Change-Id: Iabf354d2533ae429c002b115c5de33b592019997 Reviewed-on: https://code.wireshark.org/review/20018 Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-01-20follow-stream: add cleanup function.Dario Lombardo1-0/+4
Change-Id: Icfe7de118bc49da57f537601c2f256e4a028b4e2 Reviewed-on: https://code.wireshark.org/review/19680 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-11-10tcp: Fix Follow TCP tap data and when its tapped.Michael Mann1-0/+10
Use the model from the 2.0 branch and earlier that only "tapped" the follow data in a single location. This fixes duplicate data for reassembled data and handles out-of-order packets. Bug: 12855 Change-Id: I5268f13e3c08e9271acf026b859de693ad794c94 Reviewed-on: https://code.wireshark.org/review/18368 Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-06-03Qt: Add UTF-16 output to Follow Stream.Gerald Combs1-1/+2
Add an option to display the "follow" data as UTF-16. Bug: 237 Change-Id: Id95ffc014b8ef718f3b6e9f3415806ada309c3a2 Reviewed-on: https://code.wireshark.org/review/15702 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2016-01-12Refactor "Follow Stream" functionality on all GUI interfaces.Michael Mann1-45/+138
Create a "registration" system for Follow functionality so most of the work can be abstracted into a dissector and GUI can just be responsible for "display". This also removes the global variables in follow.c to open up multithreading possibilities. TCP, UDP and HTTP all have the same "tap interface" for Follow functionality (passing a tvb with byte data to "follow"). SSL still has it's own behavior, so Follow structures have to take that into account. TShark through the Follow registration now has support for HTTP. The only thing possibly missing is dynamic menu generation to further reduce explicit knowledge of Follow "type" (and rely on registration) Bug: 11988 Change-Id: I559d9ee1312406ad0986d4dce9fa67ea2103b339 Reviewed-on: https://code.wireshark.org/review/13161 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-07Remove some unnecessary dependencies and cleanup some codeJoão Valverde1-7/+11
No need for the GTK dependency on dissectors/packet-ipv6.h. Add the stream_addr typedef in follow.h to make some code simpler. Change-Id: I1cf906f58734a90263141362f2da33a140f93533 Reviewed-on: https://code.wireshark.org/review/13063 Reviewed-by: João Valverde <j@v6e.pt> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-06KISS the Follow TCP functionality.Michael Mann1-6/+1
[KISS - Keep It Simple, Stupid] Convert the Follow TCP functionality to use a tap from the TCP dissector that passes the tvb of the payload. This makes things A LOT simpler, but relies on the TCP dissector to make all decisions. The "tap" logic passes tvb data 1. Before calls to process_tcp_payload 2. Before hf_tcp_segment_data fields (that aren't retransmissions or otherwise handled) Follow up patches will be necessary to clean up all of the supporting "follow" functionality that is now useless. Bug: 6925 Bug: 9780 Change-Id: I4e7f5d453519be839de39a109bafa899b9987139 Reviewed-on: https://code.wireshark.org/review/13038 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-03Add HTTP Follow streamMichael Mann1-1/+2
This automatically detects and decompresses HTTP along a TCP stream through the use of taps. Bug: 3528 Change-Id: I8ab832d509700d0da8eabf3c3e514d8511c598d3 Reviewed-on: https://code.wireshark.org/review/13009 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-04-29follow.h: fix api reference warningAlexis La Goutte1-0/+1
The following parameters of follow_index(stream_type stream, guint32 addr) are not documented: parameter 'stream' Change-Id: I983a82e297d2e794c225ce1c3986f9752cad81e6 Reviewed-on: https://code.wireshark.org/review/8228 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-12-29Add ability to follow UDP stream by indexPascal Quantin1-10/+19
-z "follow,udp" tshark cli command now supports a stream index It is now possible to select the UDP stream displayed in Qt GUI (like for TCP) Change-Id: Ia367f36ea4f60db0fddb997a7e0903c09e172f2d Reviewed-on: https://code.wireshark.org/review/6083 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2013-12-02Fix (-W)documentation error found by ClangAlexis La Goutte1-4/+4
error: parameter '...' not found in the function declaration [-Werror,-Wdocumentation] svn path=/trunk/; revision=53722
2013-11-14Add packet information and selection to the Follow Stream dialog.Gerald Combs1-1/+2
Collect packet numbers when following streams so that we can correlate text positions with packets. Add a FollowStreamText class so that we can track mouse events. Add a hint label that shows the packet under the cursor along with packet counts and the number of "turns". Add the packet number to the C array dump. Note that dumping to YAML might be useful for Scapy users. svn path=/trunk/; revision=53314
2013-11-13Highlight selected sequence diagram items.Gerald Combs1-1/+32
Create a new dialog each time the user follows a stream. A lot of the follow code seems to assume one and only one dialog so there are likely outstanding bugs. Don't use the global cfile (should we deprecate its usage?). We want to move closer to multiple documents, not further away. Clean up after ourselves. Free our payload list and unlink our temp file. Make a bunch of gchar*s QStrings. Make sure our destructor gets called and use it. Make member variable and method names more consistent. svn path=/trunk/; revision=53306
2013-07-23From Thomas ERSFELD (GSoC13) Prepare inclusion of Follow (TCP/UDP/SSL) ↵Alexis La Goutte1-0/+8
feature in Qtshark svn path=/trunk/; revision=50819
2013-03-01Export libwireshark symbols using WS_DLL_PUBLIC defineBalint Reczey1-2/+8
Also remove old WS_VAR_IMPORT define and related Makefile magic everywhere in the project. svn path=/trunk/; revision=47992
2012-12-26Fix a bunch of warnings.Guy Harris1-1/+1
Cast away some implicit 64-bit-to-32-bit conversion errors due to use of sizeof. Cast away some implicit 64-bit-to-32-bit conversion errors due to use of strtol() and strtoul(). Change some data types to avoid those implicit conversion warnings. When assigning a constant to a float, make sure the constant isn't a double, by appending "f" to the constant. Constify a bunch of variables, parameters, and return values to eliminate warnings due to strings being given const qualifiers. Cast away those warnings in some cases where an API we don't control forces us to do so. Enable a bunch of additional warnings by default. Note why at least some of the other warnings aren't enabled. randpkt.c and text2pcap.c are used to build programs, so they don't need to be in EXTRA_DIST. If the user specifies --enable-warnings-as-errors, add -Werror *even if the user specified --enable-extra-gcc-flags; assume they know what they're doing and are willing to have the compile fail due to the extra GCC warnings being treated as errors. svn path=/trunk/; revision=46748
2012-06-28Update Free Software Foundation address.Jakub Zawadzki1-1/+1
(COPYING will be updated in next commit) svn path=/trunk/; revision=43536
2012-02-05From QA Cafe:Anders Broman1-0/+2
Add support to follow UDP and TCP streams like wireshark does. UDP streams are selected with IP address/port pairs. TCP stream are selected with either the stream index or IP address/port pairs. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6684 svn path=/trunk/; revision=40852
2009-12-13Fix for bug 3955 and 4288. When doing Follow TCP stream, there was no Sake Blok1-2/+2
check whether a packet belonged to the correct tcp stream (when there are multiple streams in the tracefile with the samen ip addresses and tcp ports. svn path=/trunk/; revision=31252
2007-12-15Fixes the "follow tcp stream" output when there are frames missing in theSake Blok1-1/+1
capture file that were actually on the wire. The reassembly code waited for the gaps to be filled in by retransmissions, which would never come. With this fix all acknowledged data will be output with "[xxx bytes missing in capture file]" inserted in every gap. svn path=/trunk/; revision=23878
2007-11-03- Future improve/clean up the now generic follow stream codeStephen Fisher1-3/+3
- Add "Follow UDP Stream" feature svn path=/trunk/; revision=23346
2007-05-22Have the follow code keep track of whether there's any data in the TCPGuy Harris1-0/+1
stream, and, if there isn't, pop up a dialog indicating that there isn't any data in the stream. This fixes bug 1604. svn path=/trunk/; revision=21870
2006-06-20Change ETH_VAR_IMPORT to WS_VAR_IMPORT. Try to fix a duplicate variableGerald Combs1-1/+1
definition in the Catapult DCT2000 code. svn path=/trunk/; revision=18524
2006-05-21name changeRonnie Sahlberg1-3/+3
svn path=/trunk/; revision=18197
2005-02-09Move the following files from /trunk to /trunk/epan:Lars Roland1-0/+57
asn1.[ch] follow.[ch] ptvcursor.[ch] reassemble.[ch] xmlstub.[ch] fix #include statements accordingly. svn path=/trunk/; revision=13366
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-26 15:35:46 +0000