aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/erf.c
AgeCommit message (Collapse)AuthorFilesLines
2016-11-08ERF: Fix issues with Host ID mappingAnthony Coddington1-18/+79
packet-erf: Fix Host ID/Source ID showing for all extension header types. Only show generated Host ID/Source ID when there is a Host ID extension header or there was not one on the record. Assumes there is only one Source ID if multiple Flow ID extension headers (unlikely) and that it matches the one in the Host ID header. This is consistent with other tools. Does support multiple Host ID extension headers though. Fix dag_version tag short name. Was clashing with another tag due to typo. ERF wiretap: Don't conflate Host ID 0 with implicit Host ID. While the implicit Host ID defaults to 0, it is not the same thing as seeing a packet with Host ID explicitly 0 in the extension header which means explicitly unknown source. Store the initial (unknown) implicit Host ID interface mapping in it's own special mapping table entry rather than 0. Noticed we can currently get duplicate interfaces in the unusual event of mixed implicit and explicit Host ID packet extension headers for the same ID before we discover that mapping. Consistently abandon the implicit version for consistency with the dissector linking behaviour and mark the interface as unmatched in the description. In 2 pass mode (including normal Wireshark file open) the abandoned interface ends up with no packets. In the common cases (all Host ID or no Host ID on packet records) this duplicate interface will not be created in the first place. Change-Id: Ic5d0b2ce9aae973f1693a247cf240ef1324ff70a Ping-Bug: 12303 Reviewed-on: https://code.wireshark.org/review/18704 Reviewed-by: Stephen Donnelly Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-28Use wtap_read_bytes() to skip over bytes when reading a record.Guy Harris1-11/+11
Allow file_read() to take a null pointer as a buffer argument; a null argument means "do everything except copy the bytes from the file to the user buffer". That means that wtap_read_bytes() and wtap_read_bytes_or_eof() also support a null pointer as a buffer argument. Use wtap_read_bytes() with a null buffer argument rather than file_skip() to skip forward over data. This fixes some places where files were mis-identified as ERF files, as the ERF open heuristics now get a short "read" error if they try to skip over more bytes than exist in the file. Change-Id: I4f73499d877c1f582e2bcf9b045034880cb09622 Reviewed-on: https://code.wireshark.org/review/17974 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-09-09erf: use ws_strtoi function.Dario Lombardo1-1/+2
Change-Id: I1d94deb547bd30076e0c171bf9e6b97aac98a545 Reviewed-on: https://code.wireshark.org/review/17556 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-15Use spaces rather than tabs for indentation.Guy Harris1-2/+2
Change-Id: I6028253f7c8c30804eaa4b23d2b09827aacb3c9d Reviewed-on: https://code.wireshark.org/review/16481 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-15Do a deep copy in wtap_block_add_custom_option().Guy Harris1-1/+3
That way, we don't have to worry about multiple instances of an option pointing to the same data. and having to worry about freeing data that's pointed to by another instance. Change-Id: I3470a9eebf346023713fd0d6ff2451d727c25089 Reviewed-on: https://code.wireshark.org/review/16471 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-14Redo the block options APIs.Guy Harris1-42/+57
A block can have zero or more instances of a given option. We distinguish between "one instance only" options, where a block can have zero or one instance, and "multiple instances allowed" options, where a block can have zero or more instances. For "one instance only" options: "add" routines add an instance if there isn't one already and fail if there is; "set" routines add an instance if there isn't one already and change the value of the existing instance if there is one; "set nth" routines fail; "get" routines return the value of the instance if there is one and fail if there isn't; "get nth" routines fail. For "multiple instances allowed" options: "add" routines add an instance; "set" routines fail; "set nth" routines set the value of the nth instance if there is one and fail otherwise; "get" routines fail; "get nth" routines get the value if the nth instance if there is one and fail otherwise. Rename "optionblock" to just "block"; it describes the contents of a block, including both mandatory items and options. Add some support for NRB options, including IPv4 and IPv6 option types. Change-Id: Iad184f668626c3d1498b2ed00c7f1672e4abf52e Reviewed-on: https://code.wireshark.org/review/16444 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-07ERF: Make ERF wiretap forwards compatible.Anthony Coddington1-8/+6
Dissector has always been able to cope with unknown record types so pass them through (and call the data dissector from the ERF dissector in this case). Previously was stopping processing on the first unrecognized record which is very unhelpful for otherwise valid files that have new types mixed in. Remove ERF type check altogether from open heuristic as ERF type could be past 48 in future and with more extension headers bit any byte value could be valid. Also allow setting ERF_RECORDS_TO_CHECK to 0 to force skipping the heuristic. Change-Id: I8331eef30ba2e949564f418b3100bd73b8f58116 Reviewed-on: https://code.wireshark.org/review/15361 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-06*_stdup_printf -> strdup for "single string only" formatting.Michael Mann1-1/+1
Done for performance improvements. This could probably be done in checkAPIs.pl, but this was just a quick manual check with grepping. Change-Id: I91ff102cb528bb00fa2f65489de53890e7e46f2d Reviewed-on: https://code.wireshark.org/review/15751 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2016-06-01Add data structures necessary to support multiple Section Header blocks.Michael Mann1-2/+3
This doesn't try to use any data from multiple Section Header blocks, it just converts single Section Header block usage into a GArray, so the potential is there to then use/support multiple Section Header blocks within a file format (like pcapng) Change-Id: I6ad1f7b8daf4b1ad7ba0eb1ecf2e170421505486 Reviewed-on: https://code.wireshark.org/review/15636 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-05-22Add wtap_optionblock_set_option_string_formatMichael Mann1-58/+21
Also add a length parameter to wtap_optionblock_set_option_string Change-Id: I8c7bbc48aa96b5c2a91ab9a17980928d6894f1ee Reviewed-on: https://code.wireshark.org/review/15505 Reviewed-by: Anthony Coddington <anthony.coddington@endace.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-05-22ERF: Fix and improve ERF_TYPE_META sanity checksAnthony Coddington1-3/+6
Fix sanity checking overflow in wiretap ERF_TYPE_META parsing segfault. Fix final tag of exactly 4 bytes not being dissected. Fix not setting bitfield tag subtree (was working due to proto.c internal behaviour). Add dissector expertinfo for truncated tags. Dissect type and length on error. Bug: 12352 Change-Id: I3fe6644f369e4d6f1f64270cb83c8d0f8a1f1a94 Reviewed-on: https://code.wireshark.org/review/15357 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-05-17opa: Add dissectors for Intel’s Omni-Path Architecture (OPA)Adam Goldman1-0/+2
Added dissectors for OPA Fabric Executive (FE) Header, OPA Snoop and Capture (SnC) MetaData Header, OPA 9B Packets, and OPA MAD Packets. Bug: 12114 Change-Id: I6acd3c9e266e4b638167abbdd275ec7c1d472b4f Reviewed-on: https://code.wireshark.org/review/13473 Reviewed-by: Adam Goldman <adam.goldman@intel.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-04-05[ERF] g_list_free_full () is glib >= 2.28, g_hash_table_add is >= 2.32AndersBroman1-5/+18
change to supported functions. Change-Id: Ic088b835d05dce4a1b9b7a102cab89be44da46d6 Reviewed-on: https://code.wireshark.org/review/14819 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-04-03Don't deref before NULL check on pointer (CID-1358044)Jaap Keuter1-2/+5
When the state pointer is NULL it's defensively coded against by a NULL pointer check. Variable initialization before should then not dereference that pointer. Change-Id: I0ed09e2f22be5651324f43fc3fd339d2f95684c0 Reviewed-on: https://code.wireshark.org/review/14776 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-04-01ERF: Add dissection and wiretap support for ERF_TYPE_META.Anthony Coddington1-13/+1136
ERF Dissector: Add dissection for ERF_TYPE_META, Host ID and Flow ID extension headers. Rename ERF extension header defines to ERF_EXT_HDR* and put in erf.h. The Flow ID extension header has an improved 32-bit Flow Hash with a Hash Type field describing what the hash was computed over. The Host ID extension header contains a 48-bit organizationally unique Host Identifier. Both extension headers contain the same 8-bit Source ID used for distinguishing records from multiple sources in the same file and for metadata linking to ERF_TYPE_META records. Host ID is used to identify the capturing host and can also be used to distinguish records from multiple hosts in the same file. ERF_TYPE_META records have a payload consisting of TLV metadata, divided into sections which define the context of the TLV tag. The dissector registers a field for each tag for each section type based on a template. ERF_TYPE_META records generally have a Host ID extension header used to link metadata to packet records with the same Host ID and Source ID. The associated Host ID can either be explicit on all records, or implicit where the Host ID extension header is only present on MetaERF records and other records are associated using only the Source ID in the Flow ID extension header. Includes per-record generated Source summary and frame linking. These have the 'correct' Host ID and Source IDs from either extension header, including applying the Implicit Host ID, and links to the most recent ERF_TYPE_META record. Relies on Wireshark doing more than one pass to associate the correct implicit Host ID tree items for records before the first ERF_TYPE_META record. The metadata is technically not associated at that point anyway. ERF Wiretap: Add per-HostID/per-SourceID wtap interfaces and basic ERF_TYPE_META support. Adds read support for displaying some fields of the 'first' ERF_TYPE_META record in the Capture File Properties screen. Concatenates and merges some summary fields to provide more useful information and attempt to combine ERF sources, streams and interfaces into wtap interfaces. Interface naming gracefully degrades when Host ID and Source ID are not present and is intended to be parseable for use by DAG software. Supports Implicit Host ID, but assumes it does not change. NOTE: Now only ERF interfaces that are present in the file are added. Only works with native ERF files for now. Written such that it is easily adapted for use by pcap dissector. Some support for setting REC_TYPE_FT_SPECIFIC_REPORT on MetaERF records. Disabled for now as this breaks pcapng_dump saving of ERF_TYPE_META and ft_specific_record_phdr clashes with erf_mc_phdr. Only when native ERF file (as uses wth->file_type_subtype). Register packet-erf as a dissector of WTAP_FILE_TYPE_SUBTYPE_ERF. Bug: 12303 Change-Id: I6a697cdc851319595da2852f3a977cef8a42431d Reviewed-on: https://code.wireshark.org/review/14510 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-23Making wiretap option blocks more generic.Michael Mann1-29/+35
This was inspired by https://code.wireshark.org/review/9729/, but takes it in a different direction where all options are put into an array, regardless of whether they are "standard" or "custom". It should be easier to add "custom" options in this design. Some, but not all blocks have been converted. Descriptions of some of the block options have been moved from wtap.h to pcapng.h as it seems to be the one that implements the description of the blocks. Also what could be added/refactored is registering block behavior. Change-Id: I3dffa38f0bb088f98749a4f97a3b7655baa4aa6a Reviewed-on: https://code.wireshark.org/review/13667 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-13Get rid of debugging printouts.Guy Harris1-5/+0
Change-Id: I78fd79ebf915e9066f9e2548dcceb3c9e6440551 Reviewed-on: https://code.wireshark.org/review/13255 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13Clean up handling of the data before the Ethernet packet in ERF files.Guy Harris1-8/+12
The data before the Ethernet packet isn't a 16-bit little-endian integer, it's two bytes, one byte of offset and one byte of padding. Change-Id: I327b88f058dda184b79d3c2c6cf0dea52c0d28b1 Reviewed-on: https://code.wireshark.org/review/13254 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13Dissect the MC and AAL2 headers as 32-bit words.Guy Harris1-1/+15
That's how they're extracted in the libwiretap module, and that's how they're shown in the ERF spec. This gets rid of some compiler warnings about type-punning. Merge some reserved bit fields to match what's in the ERF spec. Renumber others. Process the AAL2 and MC headers differently; yes, they're both big-endian 32-bit values, but that makes the code a bit clearer, and, heck, the optimizer may well combine the two sequences of code. Change-Id: Ief7f976e77e8f2fba1685ad5a50ee677a8070ae7 Reviewed-on: https://code.wireshark.org/review/13251 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-01-13Use g_ntoh* rather than g_hton*.Guy Harris1-5/+5
Stuff in an ERF file is big-endian, except for timestamps, so we want to convert from big-endian to host format. (The two functions do the same thing; this just makes it clearer what we're doing.) Change-Id: I28e27857dcf299085e8a55747ffd45ad8313789b Reviewed-on: https://code.wireshark.org/review/13248 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-19Add missing ERF types, mention another missing type, mention reserved space.Guy Harris1-0/+4
Add the TYPE_COLOR_HASH_POS and TYPE_COLOR_HASH_ETH types, note that type 26 has no #define, mention that types 28 through 31 are reserved for future record types. Change-Id: Ic828254599599c6bd7399d4682f9a3d4bff1f0f7 Reviewed-on: https://code.wireshark.org/review/12728 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-12-19ERF: Add basic no-break support for ERF_TYPE_META.Anthony Coddington1-5/+1
Update erf_open heuristic to not break when ERF_TYPE_META records are present. Remove check for maximum non-pad ERF type and add defines for reserved types. No dissection in this commit beyond record type name, this will come later. Change-Id: Ib64e450e26b2878b5519fb6afeafa2ce9477ac85 Reviewed-on: https://code.wireshark.org/review/12708 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-09Call the dumper routine to finish write a file the "finish" routine.Guy Harris1-1/+0
It doesn't actually *close* any handle, so it's best called a "finish" routine rather than a "close" routine. In libwiretap modules, don't bother setting the finish routine pointer to null - it's already initialized to null (it's probably best not to require modules to set it). Change-Id: I19554f3fb826db495f17b36600ae36222cbc21b0 Reviewed-on: https://code.wireshark.org/review/11659 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-01-03Remove unnecessary includes from wiretap folderMartin Mathieson1-2/+0
Change-Id: I10d3057801673bc1c8ea78f144215869cc4b1851 Reviewed-on: https://code.wireshark.org/review/6217 Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com> Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-02Add "Editor modelines"; Adjust whitespace as needed.Bill Meier1-0/+13
Change-Id: Ic5a5acb0f36d3aa144edbfb1ae71097b18426db4 Reviewed-on: https://code.wireshark.org/review/6216 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-12-18Rename WTAP_ERR_REC_TYPE_UNSUPPORTED to WTAP_ERR_UNWRITABLE_REC_TYPE.Guy Harris1-1/+1
That indicates that it's a problem specific to *writing* capture files; we've already converted some errors to that style, and added a new one in that style. Change-Id: I8268316fd8b1a9e301bf09ae970b4b1fbcb35c9d Reviewed-on: https://code.wireshark.org/review/5826 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-18Handle "I can't map this for that file format" better.Guy Harris1-1/+2
For cases where record (meta)data is something that can't be written out in a particular file format, return WTAP_ERR_UNWRITABLE_REC_DATA along with an err_info string. Report (and free) that err_info string in cases where WTAP_ERR_UNWRITABLE_REC_DATA is returned. Clean up some other error reporting cases, and flag with an XXX some cases where we aren't reporting errors at all, while we're at it. Change-Id: I91d02093af0d42c24ec4634c2c773b30f3d39ab3 Reviewed-on: https://code.wireshark.org/review/5823 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17Rename WTAP_ERR_UNSUPPORTED_FILE_TYPE to WTAP_ERR_UNWRITABLE_FILE_TYPE.Guy Harris1-1/+1
That makes it clearer what the problem is, and that it should only be returned by the dump code path, not by the read code path. Change-Id: I22d407efe3ae9fba7aa25f08f050317549866442 Reviewed-on: https://code.wireshark.org/review/5798 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17Rename WTAP_ERR_UNSUPPORTED_ENCAP to WTAP_ERR_UNWRITABLE_ENCAP.Guy Harris1-1/+1
That makes it clearer what the problem is, and that it should only be returned by the dump code path, not by the read code path. Change-Id: Icc5c9cff43be6c073f0467607555fa7138c5d074 Reviewed-on: https://code.wireshark.org/review/5797 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17Use WTAP_ERR_UNSUPPORTED for input file stuff we can't handle.Guy Harris1-1/+1
WTAP_ERR_UNSUPPORTED_ENCAP means "I can't *write* that particular encapsulation type to a file of this format", which mainly means "that file format simply can't handle packets of that type"; WTAP_ERR_UNSUPPORTED means "this file can't currently be supported by Wireshark, as there's some feature in the file - such as a file or per-packet encapsulation type - that we don't (yet) handle". Change-Id: I53cadf9913d20efb2bccb29f61877b71d53807be Reviewed-on: https://code.wireshark.org/review/5794 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-09Use an enum for the open-routine return value, as per Evan Huus's suggestion.Guy Harris1-21/+21
Clean up some things we ran across while making those changes. Change-Id: Ic0d8943d36e6e120d7af0a6148fad98015d1e83e Reviewed-on: https://code.wireshark.org/review/4581 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07Fix a comment, clean up some whitespace.Guy Harris1-2/+2
Change-Id: I5d3d518eee2d61dd896b44c2a61d66057f3c2f7f Reviewed-on: https://code.wireshark.org/review/4516 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07Whitespace cleanups.Guy Harris1-2/+2
Change-Id: I92f983b2e04defab30eb31c14c484b9f0f582413 Reviewed-on: https://code.wireshark.org/review/4513 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-07Add some higher-level file-read APIs and use them.Guy Harris1-41/+54
Add wtap_read_bytes(), which takes a FILE_T, a pointer, a byte count, an error number pointer, and an error string pointer as arguments, and that treats a short read of any sort, including a read that returns 0 bytes, as a WTAP_ERR_SHORT_READ error, and that returns the error number and string through its last two arguments. Add wtap_read_bytes_or_eof(), which is similar, but that treats a read that returns 0 bytes as an EOF, supplying an error number of 0 as an EOF indication. Use those in file readers; that simplifies the code and makes it less likely that somebody will fail to supply the error number and error string on a file read error. Change-Id: Ia5dba2a6f81151e87b614461349d611cffc16210 Reviewed-on: https://code.wireshark.org/review/4512 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-09-28Make the time stamp resolution per-packet.Guy Harris1-2/+2
Pcap-ng files don't have a per-file time stamp resolution, they have a per-interface time stamp resolution. Add new time stamp resolution types of "unknown" and "per-packet", add the time stamp resolution to struct wtap_pkthdr, have the libwiretap core initialize it to the per-file time stamp resolution, and have pcap-ng do the same thing with the resolution that it does with the packet encapsulation. Get rid of the TS_PREC_AUTO_XXX values; just have TS_PREC_AUTO, which means "use the packet's resolution to determine how many significant digits to display". Rename all the WTAP_FILE_TSPREC_XXX values to WTAP_TSPREC_XXX, as they're also used for per-packet values. Change-Id: If9fd8f799b19836a5104aaa0870a951498886c69 Reviewed-on: https://code.wireshark.org/review/4349 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-07-15Only one buffer.c, please.Guy Harris1-1/+1
Otherwise, if you link with both libwiretap and libfiletap, it's anybody's guess which one you get. That means you're wasting memory with two copies of its routines if they're identical, and means surprising behavior if they're not (which showed up when I was debugging a double-free crash - fixing libwiretap's buffer_free() didn't fix the problem, because Wireshark happened to be calling libfiletap' unfixed buffer_free()). There's nothing *tap-specific about Buffers, anyway, so it really belongs in wsutil. Change-Id: I91537e46917e91277981f8f3365a2c0873152870 Reviewed-on: https://code.wireshark.org/review/3066 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-24Allow wtap_read() and wtap_seek_read() to return records other than packets.Guy Harris1-0/+7
Add a "record type" field to "struct wtap_pkthdr"; currently, it can be REC_TYPE_PACKET, for a record containing a packet, or REC_TYPE_FILE_TYPE_SPECIFIC, for records containing file-type-specific data. Modify code that reads packets to be able to handle non-packet records, even if that just means ignoring them. Rename some routines to indicate that they handle more than just packets. We don't yet have any libwiretap code that supplies records other than REC_TYPE_PACKET or that supporting writing records other than REC_TYPE_PACKET, or any code to support plugins for handling REC_TYPE_FILE_TYPE_SPECIFIC records; this is just the first step for bug 8590. Change-Id: Idb40b78f17c2c3aea72031bcd252abf9bc11c813 Reviewed-on: https://code.wireshark.org/review/1773 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23Revert "Allow wtap_read() and wtap_seek_read() to return non-packet records."Guy Harris1-18/+16
This reverts commit c0c480d08c175eed4524ea9e73ec86298f468cf4. A better way to do this is to have the record type be part of struct wtap_pkthdr; that keeps the metadata for the record together and requires fewer API changes. That is in-progress. Change-Id: Ic558f163a48e2c6d0df7f55e81a35a5e24b53bc6 Reviewed-on: https://code.wireshark.org/review/1741 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-23Allow wtap_read() and wtap_seek_read() to return non-packet records.Guy Harris1-16/+18
This is the first step towards implementing the mechanisms requestd in bug 8590; currently, we don't return any records other than packet records from libwiretap, and just ignore non-packet records in the rest of Wireshark, but this at least gets the ball rolling. Change-Id: I34a45b54dd361f69fdad1a758d8ca4f42d67d574 Reviewed-on: https://code.wireshark.org/review/1736 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-17wiretap: remove unused code, drop number_of_interfacesPeter Wu1-5/+0
While investigating an ASAN issue (fixed in commit dcdd076ab0965c346efe90051678ba790eaf7a02), I got greatly confused by three different types having the same "interface_data" field name: * pcapng_t *pn stores an array of interface_data_t objects. * wtap *wth stores an array of wtapng_if_descr_t objects. * pcapng_dump_t should store an array of interface_data_t objects. pcapng_dump_t and friends are unused since commit c7f1a431d23e17a15777652b1252e139f182b0e6, so drop it. To fix the confusion, rename the interface_data_t type to interface_info_t type and use the local variable "iface_info" everywhere. Rename interface_data of pcapng_t to "interfaces" and add a comment what this exactly means (interfaces listed in the capture file). Drop the number_of_interfaces field for interfaces as the array length is already available from GArray. Now interface_data is always initialized for wth (which also gets copied to idb). s/int/guint/g and replace cast at some places. There are no regressions for the in-tree test suite. Change-Id: I2d5985c9f1e43f8230dbb4a73bd1e243c4858170 Reviewed-on: https://code.wireshark.org/review/1656 Reviewed-by: Evan Huus <eapache@gmail.com> Tested-by: Evan Huus <eapache@gmail.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-05-09Revert "Refactor Wiretap"Guy Harris1-46/+42
This reverts commit 1abeb277f5e6bd27fbaebfecc8184e37ba9d008a. This isn't building, and looks as if it requires significant work to fix. Change-Id: I622b1bb243e353e874883a302ab419532b7601f2 Reviewed-on: https://code.wireshark.org/review/1568 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-05-09Refactor WiretapMichael Mann1-42/+46
Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality. The "architectural" changes can be found in cfile.h, wtap.h, wtap-int.h and (new file) wftap-int.h. Most of the other (painstaking) changes were really just the result of compiling those new architecture changes. bug:9607 Change-Id: Ife858a61760d7a8a03be073546c0e7e582cab2ae Reviewed-on: https://code.wireshark.org/review/1485 Reviewed-by: Michael Mann <mmann78@netscape.net>
2014-03-04Fix warnings introduced in g2965913Pascal Quantin1-1/+1
Change-Id: I7b0fedf0c508404b3f2dea789f50b7b5db4e2eb7 Reviewed-on: https://code.wireshark.org/review/502 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Pascal Quantin <pascal.quantin@gmail.com>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-01-22Don't write out packets that have a "captured length" bigger than we'reGuy Harris1-4/+9
willing to read or that's bigger than will fit in the file format; instead, report an error. For the "I can't write a packet of that type in that file type" error, report the file type in question. svn path=/trunk/; revision=54882
2014-01-02No seek-read routines use the length argument, so eliminate it fromGuy Harris1-2/+2
wtap_seek_read(). svn path=/trunk/; revision=54570
2013-12-03wiretap: start using <wsutil/pint.h>Jakub Zawadzki1-4/+4
svn path=/trunk/; revision=53764
2013-11-08(Trivial) whitespace cleanup (mostly trailing whitespace).Bill Meier1-4/+4
svn path=/trunk/; revision=53172
2013-11-08The "file types" we have are actually combinations of types andGuy Harris1-3/+3
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2 are separate "file types", even though they both come from Network Monitor. Rename various functions, #defines, and variables appropriately. svn path=/trunk/; revision=53166
2013-08-15Original ERF file format documentation is still 404, link to bugzilla.Jakub Zawadzki1-0/+1
svn path=/trunk/; revision=51382
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-18 13:51:38 +0000