aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/erf.c
AgeCommit message (Collapse)AuthorFilesLines
2013-06-16Have the seek-read routines take a Buffer rather than a guint8 pointerGuy Harris1-10/+7
as the "where to put the packet data" argument. This lets more of the libwiretap code be common between the read and seek-read code paths, and also allows for more flexibility in the "fill in the data" path - we can expand the buffer as needed in both cases. svn path=/trunk/; revision=49949
2013-06-04From Anthony Coddington:Anders Broman1-4/+12
ERF wiretap export multiple extension header fix. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8765 svn path=/trunk/; revision=49749
2013-01-06When writing an ERF record, the case where the encapsulation type isGuy Harris1-71/+68
"ERF record" is very different from, and much simpler than, the case where it's not; tweak the code to more clearly separate the "we're being handed ERF records" case from the "we're being handed packets" case. svn path=/trunk/; revision=46984
2013-01-06Fix some Dead Store (Dead assignement/Dead increment) Warning found by ClangAlexis La Goutte1-1/+0
svn path=/trunk/; revision=46980
2012-12-27Do not call wtap_file_read_unknown_bytes() orGuy Harris1-1/+4
wtap_file_read_expected_bytes() from an open routine - open routines are supposed to return -1 on error, 0 if the file doesn't appear to be a file of the specified type, or 1 if the file does appear to be a file of the specified type, but those macros will cause the caller to return FALSE on errors (so that, even if there's an I/O error, it reports "the file isn't a file of the specified type" rather than "we got an error trying to read the file"). When doing reads in an open routine before we've concluded that the file is probably of the right type, return 0, rather than -1, if we get WTAP_ERR_SHORT_READ - if we don't have enough data to check whether a file is of a given type, we should keep trying other types, not give up. For reads done *after* we've concluded the file is probably of the right type, if a read doesn't return the number of bytes we asked for, but returns an error of 0, return WTAP_ERR_SHORT_READ - the file is apparently cut short. For NetMon and NetXRay/Windows Sniffer files, use a #define for the magic number size, and use that for both magic numbers. svn path=/trunk/; revision=46803
2012-12-21Squelch implicit 64-bit-to-32-bit conversion warnings.Guy Harris1-1/+1
svn path=/trunk/; revision=46650
2012-10-17Fill some phdr values also when doing random readJakub Zawadzki1-8/+6
svn path=/trunk/; revision=45619
2012-10-16Add wtap_pseudo_header union to wtap_pkthdr structure.Jakub Zawadzki1-4/+5
Use pkthdr instead of pseudo_header as argument for dissecting. svn path=/trunk/; revision=45601
2012-09-20We always HAVE_CONFIG_H so don't bother checking whether we have it or not.Jeff Morriss1-2/+0
svn path=/trunk/; revision=45015
2012-09-07From Stephen Donnelly via ↵Jeff Morriss1-3/+5
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7266 : Since we have to 'downconvert' the ERF time stamps to Wireshark's internal representation anyway, we may as well report the resolution which we convert to, rather than the original native resolution. svn path=/trunk/; revision=44800
2012-06-02Try to squelch warningsAnders Broman1-1/+1
svn path=/trunk/; revision=43000
2012-05-24From Stephen Donnelly:Anders Broman1-35/+49
Add frame.interface_id support for pcap DLT_ERF file format https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7281 svn path=/trunk/; revision=42824
2012-05-23From Stephen Donnelly:Anders Broman1-1/+39
Add frame.interface_id support for ERF file format https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7266 svn path=/trunk/; revision=42807
2012-05-04file_seek() used to be a wrapper around fseek() or gzseek(), both ofGuy Harris1-5/+1
which could use lseek() and were thus expensive due to system call overhead. To avoid making a system call for every packet on a sequential read, we maintained a data_offset field in the wtap structure for sequential reads. It's now a routine that just returns information from the FILE_T data structure, so it's cheap. Use it, rather than maintaining the data_offset field. Readers for some file formats need to maintain file offset themselves; have them do so in their private data structures. svn path=/trunk/; revision=42423
2012-03-02AFAIKT there's no reason to #include <wsutil/crc32.c>; Include crc32.h like ↵Bill Meier1-183/+186
everyone else... Also: Do some whitespace and indentation cleanup. svn path=/trunk/; revision=41281
2012-02-25Add a presence flag field to the packet information structure filled inGuy Harris1-0/+1
by Wiretap, to indicate whether certain fields in that structure actually have data in them. Use the "time stamp present" flag to omit showing time stamp information for packets (and "packets") that don't have time stamps; don't bother working very hard to "fake" a time stamp for data files. Use the "interface ID present" flag to omit the interface ID for packets that don't have an interface ID. We don't use the "captured length, separate from packet length, present" flag to omit the captured length; that flag might be present but equal to the packet length, and if you want to know if a packet was cut short by a snapshot length, comparing the values would be the way to do that. More work is needed to have wiretap/pcapng.c properly report the flags, e.g. reporting no time stamp being present for a Simple Packet Block. svn path=/trunk/; revision=41185
2012-02-14TYPE_PAD records can have zero bytes of payload; don't treat them asGuy Harris1-4/+6
errors. svn path=/trunk/; revision=41030
2011-12-13Rename WTAP_ERR_BAD_RECORD to WTAP_ERR_BAD_FILE; it really reports anyGuy Harris1-3/+3
form of corruption/bogosity in a file, including in a file header as well as in records in the file. Change the error message wtap_strerror() returns for it to reflect that. Use it for some file header problems for which it wasn't already being used - WTAP_ERR_UNSUPPORTED shouldn't be used for that, it should only be used for files that we have no reason to believe are invalid but that have a version number we don't know about or some other non-link-layer-encapsulation-type value we don't know about. svn path=/trunk/; revision=40175
2011-11-17Rename pletonll() to reflect what it actually does, namely convert aGuy Harris1-1/+1
host-byte-order 64-bit integral quantity to little-endian byte order. svn path=/trunk/; revision=39900
2011-10-21From Huzaifa Sidhpurwala of Red Hat Security Response Team:Gerald Combs1-0/+20
I found a heap-based buffer overflow, when parsing ERF file format. The overflow seems to be controlled by the values read from the file, and hence seems exploitable to me. svn path=/trunk/; revision=39508
2011-10-14Removed newencap as it's unused.Stig Bjørlykke1-2/+1
svn path=/trunk/; revision=39419
2011-10-04From Andrew Kampjes:Anders Broman1-18/+29
Allows the saving of packets with snapped length to ERF. Prevents the adding of automatic CRC and rounds down to the nearest 8 bytes instead of up, adding zeros. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6409 svn path=/trunk/; revision=39247
2011-09-06Don't synthesize a CRC if the packet already has one.Guy Harris1-5/+17
svn path=/trunk/; revision=38905
2011-09-03Check return value from wtap_dump_file_write.Stig Bjørlykke1-1/+2
This fixes CID 1272. svn path=/trunk/; revision=38876
2011-09-01Use guint8 rather than guchar for raw octets and pointers to arrays ofGuy Harris1-3/+3
same. Add to wiretap/pcap-common.c a routine to fill in the pseudo-header for ATM (by looking at the VPI, VCI, and packet data, and guessing) and Ethernet (setting the FCS length appropriately). Use it for both pcap and pcap-ng files. svn path=/trunk/; revision=38840
2011-08-31Not ideal, but OK for now - alignbytes, at that point, is < 8, so weGuy Harris1-3/+2
know it'll fit in a gint16. (alignbytes really shouldn't need to be 64 bits, as if we have 2^63-1 bytes of alignment, We Have A Problem; fixing that may involve calculating it differently earlier in that routine.) svn path=/trunk/; revision=38828
2011-08-31Try using gint64 for alignbytes.Stig Bjørlykke1-1/+1
svn path=/trunk/; revision=38827
2011-08-31From Andrew Kampjes via bug 6260:Stig Bjørlykke1-1/+211
Added support for saving ERF files. From me: Use crc routines from libwsutil. svn path=/trunk/; revision=38826
2011-04-21Add a new WTAP_ERR_DECOMPRESS error, and use that for errors discoveredGuy Harris1-11/+16
by the gunzipping code. Have it also supply a err_info string, and report it. Have file_error() supply an err_info string. Put "the file" - or, for WTAP_ERR_DECOMPRESS, "the compressed file", to suggest a decompression error - into the rawshark and tshark errors, along the lines of what other programs print. Fix a case in the Netscaler code where we weren't fetching the error code on a read failure. svn path=/trunk/; revision=36748
2011-04-20pntohll() takes a guint8 * as an argument; there's no need to cast to aGuy Harris1-1/+1
guint64 *, and it causes clang to complain. svn path=/trunk/; revision=36738
2011-04-06From Jakub Zawadzki:Guy Harris1-5/+5
file_read(buf, bsize, count, file) macro is compilant with fread function and takes elements count+ size of each element, however to make it compilant with gzread() it always returns number of bytes. In wiretap file_read() this is not really used, file_read is called either with bsize set to 1 or count to 1. Attached patch remove bsize argument from macro. svn path=/trunk/; revision=36491
2010-11-04From Alexis La Goutte:Jaap Keuter1-4/+1
Replace all *_min()/*_max() by MIN() and MAX(). svn path=/trunk/; revision=34770
2010-10-28From Stephen Donnelly:Anders Broman1-7/+11
Wireshark tools do not detect and read some ERF files correctly https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5344 svn path=/trunk/; revision=34665
2010-04-08From Stephen Donnelly:Anders Broman1-2/+3
InfiniBand Link Packet (flow control) dissector. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4656 svn path=/trunk/; revision=32425
2010-02-02From Stephen Donnelly:Anders Broman1-1/+3
Endace ATM and AAL2 enhancements. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4447 svn path=/trunk/; revision=31766
2009-11-09Removed an unused variable.Stig Bjørlykke1-2/+1
svn path=/trunk/; revision=30891
2009-08-10Update a comment - a bad packet size could also be the result of a fileGuy Harris1-2/+3
not actually being an ERF file. Don't compute the packet size until you know that rlen is valid. svn path=/trunk/; revision=29366
2009-08-10Don't try to allocate more than WTAP_MAX_PACKET_SIZE. Fixes a crashGerald Combs1-0/+7
reported in bug 3849. svn path=/trunk/; revision=29364
2009-04-22Clean up some 64-bit issues.Guy Harris1-18/+18
svn path=/trunk/; revision=28117
2008-09-29From Francesco Fusco:Anders Broman1-9/+45
Endace ERFII (extension header) support. svn path=/trunk/; revision=26287
2008-07-14From Stephen Donnelly:Jaap Keuter1-3/+6
ERF files can contain records of type TYPE_PAD. These records are not related to captured packets, have a zero timestamp value and no associated packet data. Normally TYPE_PAD records are stripped out during capture, but in rare cases unstripped files may exist. Previously wiretap/erf.c generated an 'unknown record encapsulation' error when encountering TYPE_PAD records. With this patch Wireshark skips over any TYPE_PAD records within ERF traces files without reporting an error. TYPE_PAD records are not counted, displayed or decoded. svn path=/trunk/; revision=25733
2008-04-12From Stephen Donnelly (bug 2359):Sake Blok1-43/+39
- add support for ERF files created with a snaplength - tighten heuristics (rlen>=16, time_delta < 1 week) svn path=/trunk/; revision=24929
2008-03-14From Stephen Donnelly via bug 2235:Gerald Combs1-2/+9
This plugin implements a dissector for Infiniband. It is released under the GPL v2. Rather than using say libpcap to capture raw (unframed) IP packets from near the top of an IPoIB stack, this plugin dissects link level Infiniband frames. Infiniband trace files can be read from Endace ERF format trace files, or from libpcap DLT_ERF files containing ERF TYPE_INFINIBAND records. There is currently no native DLT_INFINIBAND in libpcap. Each record contains a hardware timestamp, capture metadata such as port Id, and a complete link level Infiniband frame starting from the Local Route Header. svn path=/trunk/; revision=24628
2008-02-07Removed some "statement not reached" warnings.Stig Bjørlykke1-1/+0
svn path=/trunk/; revision=24282
2008-01-10Get rid of extra blank lines at the end of the file.Guy Harris1-2/+0
svn path=/trunk/; revision=24054
2008-01-10Use WTAP_ENCAP_ERF as the file encapsulation, as that's what we'dGuy Harris1-38/+9
otherwise use as the per-packet encapsulation. The close routine does nothing; get rid of it - you don't *need* a close routine (by default, the subtype_close pointer is null, which means that nothing per-file-type is done when the file is closed). Make the code to handle the length fields in the ERF header common, rather than copying it to each group of record types. svn path=/trunk/; revision=24053
2008-01-09From Florent Drouin:Jeff Morriss1-14/+41
fix http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1727 (pppd format file incorrectly detected as being an ERF file) by: The file_seek() call has been replaced by a call to file_read(), so, when the end of the file is reached and the current record is truncated, we have got an error. This solves the problem of bad file format detection. Additionaly, the ERF heuristic has been improved. svn path=/trunk/; revision=24051
2007-11-19Get the number of captured bytes from "rlen" instead of "wlen". This shouldGerald Combs1-41/+41
fix bug #1983. svn path=/trunk/; revision=23500
2007-11-06From Florent Drouin:Anders Broman1-6/+11
Fix bug Some Toshiba format files with LAPD cannot be open http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1711 svn path=/trunk/; revision=23379
2007-11-05Strengthen BER and ERF heuristics to solve:Anders Broman1-0/+8
Fail to load I4B traces http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1972 svn path=/trunk/; revision=23367
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-25 18:17:22 +0000