aboutsummaryrefslogtreecommitdiffstats
path: root/file.c
AgeCommit message (Collapse)AuthorFilesLines
2011-12-27From Jim Young via bug 5580: Only update the time elapsed between the ↵Chris Maynard1-5/+6
previous displayed packet and this packet if the packet is actually displayed. Ref: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5580 svn path=/trunk/; revision=40304
2011-12-13Rename WTAP_ERR_BAD_RECORD to WTAP_ERR_BAD_FILE; it really reports anyGuy Harris1-4/+4
form of corruption/bogosity in a file, including in a file header as well as in records in the file. Change the error message wtap_strerror() returns for it to reflect that. Use it for some file header problems for which it wasn't already being used - WTAP_ERR_UNSUPPORTED shouldn't be used for that, it should only be used for files that we have no reason to believe are invalid but that have a version number we don't know about or some other non-link-layer-encapsulation-type value we don't know about. svn path=/trunk/; revision=40175
2011-12-09Export all data sources of a frame to a C array. Fixes ↵Chris Maynard1-2/+7
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4988 svn path=/trunk/; revision=40136
2011-11-21On an I/O error, merge_read_packet() and merge_append_read_packet() needGuy Harris1-2/+7
to return a pointer to the merge_in_file_t that got the error. Set *err to 0 on success and an error code on an err, treat a null return as an EOF indication, and if we don't get a null return check for a non-zero error code and treat that as an I/O error. svn path=/trunk/; revision=39964
2011-11-20Fix "'Closing File!' Dialog Hangs" bug 3046: ↵Chris Maynard1-2/+1
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3046 svn path=/trunk/; revision=39959
2011-11-19When reporting "sorry, *this* packet can't be written to a file of thatGuy Harris1-67/+100
type" when writing out a capture file (i.e., writing a per-packet-encapsulation capture to a file type that supports it but doesn't support one of the packet's encapsulations), report the packet number and, when doing this in a merge operation, report the file from which it came. When reporting "sorry, that file can't be written to a file of that type, period", show the file type rather than the input file link-layer type that causes the problem. (We could show both. We could be *really* ambitious and iterate through all possible file types and show the ones that will or at least might work....) file_write_error_message() is documented as handling only UNIX-style errnos, and libwireshark should be usable without libwiretap, so leave it up to its callers to handle Wiretap errors such as WTAP_ERR_SHORT_WRITE. Clean up indentation. svn path=/trunk/; revision=39949
2011-10-17From Michael Mann: Add cf_callback_invoke to cf_open to tidy up the ↵Chris Maynard1-0/+1
currently open file before opening a new one. Fixes bugs 5987 and 6457. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5987 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6457 svn path=/trunk/; revision=39445
2011-09-21Whitespace cleanup:Bill Meier1-3/+3
Use consistent indentation; Convert "4 space tabs" to spaces; Remove trailing whitespace. svn path=/trunk/; revision=39082
2011-09-21Fix ex "modeline" so it works;Bill Meier1-1/+1
See https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5748 svn path=/trunk/; revision=39081
2011-05-19From Dirk Jagdmann via bug 5875:Gerald Combs1-1/+1
My attachment adds a link to a XSLT file to the preamble of the PDML. The XSLT will transform the PDML to a HTML page, and the HTML page features a look similar to Wireshark. See http://cubic.org/~doj/ebay/a.pdml for an example. The patch also contains a small perl program which converts the Wireshark colortable into javascript code which is used in the XSLT file. If you want to use a different color scheme you would execute the perl program and insert the generated javascript function into your XSLT file. To view the HTML you could either place the PDML and XSLT file on your webserver and verify that your webserver sends the PDML file as "text/xml". Then your webbrowser will find the linked XSLT file, download that as well and convert the PDML to HTML on the fly. You could also use an XSLT processor like xsltproc to convert the PDML and XSLT into a static HTML file. From me: Minor fixups. svn path=/trunk/; revision=37298
2011-05-17More eradication of old-style function definitions.Guy Harris1-2/+2
svn path=/trunk/; revision=37216
2011-05-12Packet editor: support for saving changed frames.Jakub Zawadzki1-0/+22
svn path=/trunk/; revision=37099
2011-05-10When closing capture file, set number of frames to 0. It fix bug #5903.Jakub Zawadzki1-1/+2
svn path=/trunk/; revision=37040
2011-05-09From Jakub Zawadzki: for file read progress bars, use the raw offset inGuy Harris1-15/+7
the file, rather than the offset in the uncompressed data stream. That way we don't get the "hey, we're more than 100% into the file, better refigure this" surprise. svn path=/trunk/; revision=37025
2011-05-03TShark doesn't need column text attached to each frame; move col_textGuy Harris1-22/+0
and col_text_len from the frame_data structure to the PacketRecord structure. svn path=/trunk/; revision=36967
2011-04-27Restore updating packet bar while loading file (removed in r36851)Jakub Zawadzki1-0/+12
svn path=/trunk/; revision=36896
2011-04-27Don't free the frame_data_sequence unless we have one.Guy Harris1-2/+4
svn path=/trunk/; revision=36882
2011-04-27Create a new frame_data_sequence data type; it represents a denseGuy Harris1-10/+15
sequence of frame_data structures, indexed by the frame number. Extract the relevant bits of the capture_file data structure and move them to the frame_data_sequence, and move the relevant code from cfile.c and tweak it to handle frame_data_sequence structures. Have a possibly-null pointer to a frame_data_sequence structure in the capture_file structure; if it's null, we aren't keeping a sequence of frame_data structures (we don't keep that sequence when we're doing one-pass processing in TShark). Nothing in libwireshark should care about a capture_file structure; get rid of some unnecessary includes of cfile.h. svn path=/trunk/; revision=36881
2011-04-26Get rid of some code that's no longer relevant with the new treeGuy Harris1-12/+0
structure for frame_data items. svn path=/trunk/; revision=36862
2011-04-25from Jakub Zawadzki:Anders Broman1-16/+1
Don't thaw the packet list during file loading to speed up file loading. svn path=/trunk/; revision=36851
2011-04-25Store the frame_data structures in a tree, rather than a linked list. Guy Harris1-65/+31
This lets us get rid of the per-frame_data-structure prev and next pointers, saving memory (at least according to Activity Monitor's report of the virtual address space size on my Snow Leopard machine, it's a noticeable saving), and lets us look up frame_data structures by frame number in O(log2(number of frames)) time rather than O(number of frames) time. It seems to take more CPU time when reading in the file, but seems to go from "finished reading in all the packets" to "displaying the packets" faster and seems to free up the frame_data structures faster when closing the file. It *is* doing more copying, currently, as we now don't allocate the frame_data structure until after the packet has passed the read filter, so that might account for the additional CPU time. (Oh, and, for what it's worth, on an LP64 platform, a frame_data structure is exactly 128 bytes long. However, there's more stuff to remove, so the power-of-2 size is not guaranteed to remain, and it's not a power-of-2 size on an ILP32 platform.) It also means we don't need GLib 2.10 or later for the two-pass mode in TShark. It also means some code in the TCP dissector that was checking pinfo->fd->next to see if it's NULL, in order to see if this is the last packet in the file, no longer works, but that wasn't guaranteed to work anyway: we might be doing a one-pass read through the capture in TShark; we might be dissecting the frame while we're reading in the packets for the first time in Wireshark; we might be doing a live capture in Wireshark; in which case packets might be prematurely considered "the last packet". #if 0 the no-longer-working tests, pending figuring out a better way of doing it. svn path=/trunk/; revision=36849
2011-04-25Make the packet count an unsigned value, as frame numbers are unsigned.Guy Harris1-19/+30
Make the loops that scan through all the packets do so by frame number, to abstract away the "next" and "previous" pointers in the frame_data structure. Add a routine to cfile.c to map frame numbers to frame_data structures, and put in some special case handling so scanning forward or backward through the packets is O(N) rather than O(N^2). svn path=/trunk/; revision=36846
2011-04-24new_packet_list_find_row_from_data() is always used to select a packet,Guy Harris1-9/+26
so get rid of the select_flag argument, and rename it new_packet_list_select_row_from_data(). It's also always passed a frame_data *, so make its argument a frame_data *. Its return value is used only to detect whether the packet was found in the display or not, so make it a gboolean. Check it in *all* cases where it's called, and change the dialog message a bit (the most likely cause is that the user cancelled a redissection of the packets, so not all packets in the capture file are in the display. Also, in the find case, pass it the new packet we found. svn path=/trunk/; revision=36839
2011-04-21Add a new WTAP_ERR_DECOMPRESS error, and use that for errors discoveredGuy Harris1-0/+23
by the gunzipping code. Have it also supply a err_info string, and report it. Have file_error() supply an err_info string. Put "the file" - or, for WTAP_ERR_DECOMPRESS, "the compressed file", to suggest a decompression error - into the rawshark and tshark errors, along the lines of what other programs print. Fix a case in the Netscaler code where we weren't fetching the error code on a read failure. svn path=/trunk/; revision=36748
2011-04-12Now that wtap_read() checks for delayed errors on EOF, there's no needGuy Harris1-14/+5
to check for it on close. svn path=/trunk/; revision=36593
2011-04-12Allow wtap_sequential_close() and wtap_close() to return an error; thisGuy Harris1-5/+14
may happen if, when reading a compressed file, we find an error in the file's contents past the last packet (e.g., the file being cut short so that we can't get a full buffer worth of compressed data), and that reporting of that error is delayed (so that you can get all of the packets that we *can* decompress). Check for those errors, at least on the sequential read pass (the only errors we should see when closing the random stream are errors we've already seen in the sequential stream). svn path=/trunk/; revision=36576
2011-03-24Add initial pcapng name resolution record support. Wireshark has readGerald Combs1-0/+4
support; TShark has read+write support. Additionally TShark can read a "hosts" file and write those records to a capture file. This uses "struct addrinfo" in many places and probably won't compile on some platforms. svn path=/trunk/; revision=36318
2011-03-22Clarify a comment.Gerald Combs1-1/+5
svn path=/trunk/; revision=36270
2011-03-22Allocate correct size of fdata col_text and col_text_len.Stig Bjørlykke1-2/+2
Coverity 711 & 716. svn path=/trunk/; revision=36266
2011-03-22We have to initialize the elements of the fdata->col_text array to nullGuy Harris1-8/+1
pointers, as there's code that assumes that if they're not set to null pointers, they're set correctly, and doesn't bother setting them to the right value. svn path=/trunk/; revision=36252
2011-03-22When we allocate the col_text array, initialize it to a bunch ofGuy Harris1-14/+28
pointers to null strings, rather than a bunch of null pointers, so that if an exception is thrown before we set any of the columns, or some other problem occurs, we don't end up with null pointers that could later cause a crash. Fix indentation. svn path=/trunk/; revision=36234
2011-03-08Removal of the old packet-list in favor of the new packet list.Sake Blok1-746/+2
It compiles with "./configure without options" on my Mac. Let's see what the buildbots have to say about it :-) svn path=/trunk/; revision=36161
2011-02-18Fix some dead code and zero division issues found by Clang scan-build.Gerald Combs1-4/+3
In convert_string_case() use g_utf8_strup() instead of converting each character by hand. Hopefully this won't cause any unexpected changes in behavior. svn path=/trunk/; revision=36006
2011-02-04Clean up indentation.Guy Harris1-6/+6
svn path=/trunk/; revision=35813
2011-01-31From Cal Turney:Anders Broman1-8/+13
Bug 5621 - With String in Packet details searches, highlight row in tree https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5621 svn path=/trunk/; revision=35718
2011-01-19From Cal Turney via enhancement bug #5587: In hex or string searches of theStephen Fisher1-0/+3
packet data highlight the target rather than the entire field. svn path=/trunk/; revision=35584
2010-11-27Move main_statusbar.h to the top-level directory; none of its routinesGuy Harris1-6/+7
use GTK+ data types, so, at least in theory, it could be implemented atop another toolkit. Make statusbar_push_temporary_msg() take a format string and format arguments. Use it instead of simple_status(), and change one call to just take a format string and arguments rather than to take the result of using that format string and arguments with g_strdup_printf() and passing the result to statusbar_push_temporary_msg(). svn path=/trunk/; revision=35041
2010-10-23(Trivial) Fix a typo in a comment.Bill Meier1-1/+1
svn path=/trunk/; revision=34626
2010-10-18Fix the win64 buildJeff Morriss1-1/+1
svn path=/trunk/; revision=34564
2010-10-18Fix progress bar when loading compressed files.Jeff Morriss1-13/+32
Continue to use the data offset ((uncompressed) bytes read) as our progress indicator, at least until we get a progress value greater than 1.0. Then, in addition to checking if the size of the file changed, check our position in the file and use that as our progress indicator. This optimizes uncompressed file accesses (avoiding an lseek()) at the "expense" of switching progress measures (from data read to position in the file) while loading a file. Tests have shown that the progress bar never shows the data offset number when loading a compressed file, so this should be okay. svn path=/trunk/; revision=34563
2010-08-27(Trivial) Fix a typoBill Meier1-1/+1
svn path=/trunk/; revision=33951
2010-08-16From Cal Turney:Anders Broman1-0/+1
1. Restore the functionality of <Ctrl>A and <Ctrl>X to the filter textbox. 2. Assign intuitive shortcuts without consuming any new shortcut letters. 3. Add 'Un-Time Reference All Packets' to the menu. 4. Disallow the marking or ignoring of all packets in the capture. 5. Make the Mark/Ignore/Time Reference-related menu items context sensitive. 6. Add 'ref_time_count' to the capture_file structure 7. Utilize marked/ignored/ref_time_count vars to prevent needless looping thru the entire packet list by exiting the loop when it becomes zero. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5115 svn path=/trunk/; revision=33817
2010-08-15Fix compilation error when compiling for "old packet list".Bill Meier1-2/+0
svn path=/trunk/; revision=33802
2010-08-13Instead of using a Boolean for the search direction, use an enum, soGuy Harris1-240/+324
that you can tell from examination whether the search is forward or backward. Make the cf_find_packet routines take the direction as an explicit argument, rather than, in the cases where you don't want to permanently set the direction, saving the direction in the capture_file structure, changing it, doing the search, and restoring the saved direction. Give more information in the Doxygen comments for those routines. Add a cf_find_packet_dfilter_string() routine, which takes a filter string rather than a compiled filter as an argument. Replace find_previous_next_frame_with_filter() with it. Have cf_read_frame_r() and cf_read_frame() pop up the error dialog if the read fails, rather than leaving that up to its caller. That lets us eliminate cf_read_error_message(), by swallowing its code into cf_read_frame_r(). Add Doxygen comments for cf_read_frame_r() and cf_read_frame(). Don't have find_packet() read the packet before calling the callback routine; leave that up to the callback routine. Add cf_find_packet_marked(), to find the next or previous marked packet, and cf_find_packet_time_reference(), to find the next or previous time reference packet. Those routines do *not* need to read the packet data to see if it matches; that lets them run much faster. Clean up indentation. svn path=/trunk/; revision=33791
2010-07-16Make sure we call wtap_cleareof() before each read.Gerald Combs1-2/+5
svn path=/trunk/; revision=33555
2010-06-30RevertingAnders Broman1-5/+0
http://anonsvn.wireshark.org/viewvc?view=rev&revision=29861 seems to fix the scrolling in live captures issue. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4891 svn path=/trunk/; revision=33384
2010-06-26Increase the displayed_count before we add the packet to the packet list,Stig Bjørlykke1-2/+3
because we update the the packets bar when adding the packet. This fixes bug 4896. svn path=/trunk/; revision=33331
2010-05-27Add cf_fake_continue_tail() which is called when real-time captureGerald Combs1-0/+5
updates are off and which sets the capture file state to a value that won't cause an assertion when the user stops capturing. Fixes bug 4035. svn path=/trunk/; revision=33005
2010-05-26Another attempt at bug 4669: Properly set the previous-displayed-packetGerald Combs1-3/+11
timestamp when we're recalculating reference times. Remove an unused variable. Add whitespace & comment fixups. svn path=/trunk/; revision=32985
2010-05-26From Jakub Zawadzki:Anders Broman1-10/+20
New functions: cf_read_frame_r, cf_read_frame It's much easier to write: cf_read_frame (cf, fdata, &err, &err_info) Than: wtap_seek_read (cf->wth, fdata->file_off, &cf->pseudo_header, cf->pd, fdata->cap_len, &err, &err_info) svn path=/trunk/; revision=32980
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-30 17:12:39 +0000