aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/libpcap.c
AgeCommit message (Collapse)AuthorFilesLines
2023-11-01pcapng: convert FCS lengths between bytes and bits.Guy Harris1-1/+2
The FCS length in a pcapng IDB is in bits, but the length in an EPB is in bytes; convert the latter to bits. The FCS length in the Ethernet pseudo-header is in bytes; convert the length-in-bits to a length-in-bytes before using it to set the FCS length in the pseudo-header. While we're at it, note, in a comment, that we convert the length in pcap files, which is in units of 16 bits, to bits. Fixes #19174.
2023-06-26Don't include errno.h if we don't use errno or errno value definitions.Guy Harris1-1/+0
2023-03-30wiretap dump: automatically increase bytes_dumpedDavid Perry1-4/+0
For writing capture files, increment `wdh->bytes_dumped` within `wtap_dump_file_write()` so the caller doesn't have to manually track it. Fixes the most common case of writing a file in sequence, leaving the code clearer. A small number of file formats effectively leave the header blank, write the packets, then seek back up to the header to fill it in. In such cases, save `wdh->bytes_dumped` before filling in the header and restore it once done, so the value doesn't double-count the size of the header.
2023-03-21wiretap: rename the wtap_dumper field "encap" to "file_encap".Guy Harris1-6/+6
That indicates that it's a *per-file* encapsulation, not just some unspecified type of encapsulation such as per-packet or per-interface.
2022-08-16libpcap: don't allow out-of-range time stamps.Guy Harris1-0/+54
This should squelch Coverity CID 1509363.
2022-03-04pcap: fix the handling of the reserved field.Guy Harris1-21/+18
Don't commit to it being a "class" field. Fix the bitfield for it.
2022-03-04pcap: process the subfields of the link-layer-type-plus-stuff field.Guy Harris1-41/+91
Extract the FCS length information from that field, and reject captures that have a non-zero "class" field (the 10-bit reserved field that was once intended to allow other "classes" of link layer type, with class 0 being "LINKTYPE_ values", but the original use case doesn't appear ever to have been used).
2022-02-13libpcap(wiretap): Fix unreachable-codeAlexis La Goutte1-1/+1
libpcap.c:1007:19: warning: code will never be executed [-Wunreachable-code]
2022-01-16libpcap: set wth->priv to the libpcap_t before returning errors.Guy Harris1-6/+6
That ensures that it'll be freed on an error, fixing Coverity CID 1497311.
2022-01-16libpcap (wiretap): reorganize the file open code.Guy Harris1-345/+386
2022-01-13libpcap: remove definition of unused structure.Guy Harris1-4/+0
We don't allocate a per-dumper private data structure, so there's no need to define a structure type.
2021-12-19Replace g_strdup_printf() with ws_strdup_printf()João Valverde1-3/+3
Use macros from inttypes.h.
2021-08-29wiretap: always allocate a block for a record.Guy Harris1-0/+1
Without that, you could add a comment to a record in a file format the reading code for which doesn't allocate blocks, but the comment doesn't get saved, as there's no block in which to save the comment option. This simplifies some code paths, as we're either using the record's modified block or we're using the block as read from the file, there's no third possibility. If we attempt to read a record, and we get an error, and a block was allocated for the record, unreference it, so the individual file readers don't have to worry about it.
2021-06-18erf: handle errors in some routines more completely.Guy Harris1-1/+1
Have them take error code and error information string arguments and, for various failures, fill them in as "internal error" indications. Check their return codes to see if they got an error.
2021-06-18libpcap: don't generate a fake interface for LINKTYPE_ERF files.Guy Harris1-17/+8
The ERF code will generate interfaces based on the ERF records in the file, so don't bother adding an additional dummy interface.
2021-06-06Replace g_assert() with ws_assert() in placesJoão Valverde1-2/+3
2021-04-16Wiretap: Fix some compiler warnings.Gerald Combs1-1/+1
Make various _dump_can_write_encap and _dump_open routines static. Add a couple of casts.
2021-03-11libwiretap: don't have a central table of file type/subtype name mappings.Guy Harris1-1/+17
Let individual file type/subtype modules register their backwards-compatibility names, rather than having a centralized table that would need to be updated along with the module.
2021-02-23wiretap: rename wtap_register_file_type_subtypes().Guy Harris1-7/+7
It only registers one file type/subtype, so rename it to wtap_register_file_type_subtype(). That will also force plugins to be recompiled; that will produce compile errors for some plugins that didn't change to match the new contents of the file_type_subtype_info structure. Also check to make sure that the registered file type/subtype supports at least one type of block; a file type/subtype that doesn't return *any* blocks and doesn't permit *any* block types to be written is not very useful. That should also catch most if not all other plugins that didn't change to match the new contents of the file_type_subtype_info structure. Don't make errors registering a file type/subtype fatal; just complain, don't register the bogus file type/subtype, and drive on.
2021-02-23wiretap: eliminate the pcap/nspcap/pcapng WTAP_FILE_TYPE_SUBTYPE_ values.Guy Harris1-192/+461
Register the pcap and pcapng file types/subtypes rather than hardwiring them into the table. Call the registration routines for them directly, rather than through a generated table; they're always supposed to be there, as some code in Wireshark either writes only one of those formats or defaults to writing one of those formats. Don't run their source code through the registration-routine-finder script. Have the file type/subtype codes for them be directly exported to the libwiretap core, and provide routines to return each of them, to be used by the aforementioned code. When reporting errors with cfile_write_failure_message(), use wtap_dump_file_type_subtype() to get the file type/subtype value for the wtap_dumper to which we're writing, rather than hardcoding it. Have the "export PDU" code capable of supporting arbitrary file types/subtypes, although we currently only use pcapng. Get rid of declarations of now-static can_write_encap and dump_open routines in various headers.
2020-12-22Detect and replace bad allocation patternsMoshe Kaplan1-1/+1
Adds a pre-commit hook for detecting and replacing occurrences of `g_malloc()` and `wmem_alloc()` with `g_new()` and `wmem_new()`, to improve the readability of Wireshark's code, and occurrences of `g_malloc(sizeof(struct myobj) * foo)` with `g_new(struct myobj, foo)` to prevent integer overflows Also fixes all existing occurrences across the codebase.
2020-10-14Have WTAP_ERR_INTERNAL include an err_info string giving details.Guy Harris1-2/+4
That way, users won't just see "You got an internal error", the details will be given, so they can report them in a bug.
2020-10-03Update URLs pointing to the bug database.Guy Harris1-1/+1
Switch from bugs.wireshark.org to the GitLab issues list.
2020-07-29wiretap: generate fake IDBs for more capture file types.Guy Harris1-6/+9
That makes them work as input to a mergecap that writes pcapng files. File types that don't have a single per-file encapsulation type need more work, with multiple fake IDBs, one for each packet encapsulation type seen in the file, unless we can generate real IDBs. Change-Id: I2859e4f7fb15ec0c0f31a4044dc15638e5db7826 Reviewed-on: https://code.wireshark.org/review/37983 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2020-07-29wiretap: add a routine to add a "fake" IDB.Guy Harris1-18/+1
It generates a fake IDB for files that don't have interface information and that have a per-file encapsulation type, snapshot length, and time stamp precision, and adds it to the file's list of IDBs. Use it for libpcap. We will use it later for other file formats, so that code such as the mergecap code to merge into a pcapng file can handle input files that don't have interface information. (We should have a way to indicate whether the IDBs are real or fake, so that capinfos and Statistics > Capture File Properties don't report meaningless IDB information and make it look as if it's known that the capture was done on one interface with the properties in question.) Change-Id: Iec124bf3c7cbd4c69ec2ac7d0dd776e5287f8576 Reviewed-on: https://code.wireshark.org/review/37982 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2020-05-02wiretap: move the "fake an IDB for pcap files" code to libpcap.c.Guy Harris1-0/+41
That can just be done at the end of libpcap_open(), rather than in wtap_open_offline() immediately after the open routine - which, in this case, would be libpcap_open() - returns. That's cleaner, as it puts capture-file-type-dependent code in the capture-file-type-specific code. Note, though, that it's a bit weird for LINKTYPE_ERF files (and it was equally weird before this change), and that other capture file types should be doing this as well. Change-Id: Ida94779a2e1021c81314f82655ec1d0f2f14e960 Reviewed-on: https://code.wireshark.org/review/37022 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2020-05-02ERF: split wiretap/erf.h into three files.Guy Harris1-1/+1
wiretap/erf_record.h has declarations for records in ERF files and in LINKTYPE_ERF packets in pcap and pcapng files. wiretap/erf-common.h has declarations of routines to be called by pcap/pcapng reader code when processing LINKTYPE_ERF packets. wiretap/erf.h is what's left, for use by wiretap/erf.c and the code with the tables of file readers and writers. Change-Id: Ia982e79b14a025a80dcbc7c812fb3b2cdb9c6aaa Reviewed-on: https://code.wireshark.org/review/37021 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2019-07-26HTTPS (almost) everywhere.Guy Harris1-1/+1
Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-05Have wtap_read() fill in a wtap_rec and Buffer.Guy Harris1-6/+5
That makes it - and the routines that implement it - work more like the seek-read routine. Change-Id: I0cace2d0e4c9ebfc21ac98fd1af1ec70f60a240d Reviewed-on: https://code.wireshark.org/review/32727 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-03Discard the upper bits of the "network" field in the file header.Guy Harris1-1/+44
Libpcap's done that for a while; we should do so as well. (Ideally, we should use those bits, but there's an issue with pcapng, where the FCS length in the IDB is described as being in units of bits, but where we're treating it as being in units of bytes, that I'd like to resolve first.) Change-Id: Ibcb82f1dcaa8baae5bba55636cea8852a6af814e Reviewed-on: https://code.wireshark.org/review/32303 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-11-14Catch attempts to write multiple encapsulation types if unsupported.Guy Harris1-0/+9
If, in the process of opening the input file, we determine that it has packets of more than one link-layer type, we can catch attempts to write that file to a file of a format that doesn't support more than one link-layer type at the time we try to open the output file. If, however, we don't discover that the file has more than one link-layer type until we've already created the output file - for example, if we have a pcapng file with a new IDB, with a different link-layer type from previous IDBs, after packet blocks for the earlier interfces - we can't catch that until we try to write the packet. Currently, that causes the packet's data to be written out as is, so the output file claims it's of the file's link-layer type, causing programs reading the file to misdissect the packet. Report WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED on the write attempt instead, and have a nicer error message for WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED on a write. Change-Id: Ic41f2e4367cfe5667eb30c88cc6d3bfe422462f6 Reviewed-on: https://code.wireshark.org/review/30617 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-25Get rid of unused flag argument.Guy Harris1-1/+1
We always tell pcap_process_pseudo_header() to check to make sure the pseudo-header isn't bigger than the captured data; no need for a flag argument to tell it to do so. Change-Id: I8310bb06a390a7f4a7a232ad140ae07955d52da1 Reviewed-on: https://code.wireshark.org/review/29833 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-04-24Clean up EOF/short read/hard error handling in heuristics.Guy Harris1-93/+72
Do all the per-record processing in a libpcap_try_record() routine. EOF on the header is OK, but a short read on the header *might* be due to the format being tested not being the format of the file rather than due to the file having been cut short. Change-Id: I5748ed550fa1079dc9c746fd93ee5c59187b80a1 Reviewed-on: https://code.wireshark.org/review/27135 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-04-24Strengthen the heuristcs that check for "alternate" pcap formats.Guy Harris1-17/+67
Try to read up to 3 pcap records, making the value a #define so that we can crank it up if necessary. Bug: 14595 Change-Id: Ie9d62a1763fe7d1d46fdd8781691ea975770f3d7 Reviewed-on: https://code.wireshark.org/review/27111 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Generalize wtap_pkthdr into a structure for packet and non-packet records.Guy Harris1-38/+38
Separate the stuff that any record could have from the stuff that only particular record types have; put the latter into a union, and put all that into a wtap_rec structure. Add some record-type checks as necessary. Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2 Reviewed-on: https://code.wireshark.org/review/25696 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-08replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.Dario Lombardo1-1/+1
The first is deprecated, as per https://spdx.org/licenses/. Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed Reviewed-on: https://code.wireshark.org/review/25661 Petri-Dish: Anders Broman <a.broman58@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-01-20wiretap: use SPDX identifiers (partial work).Dario Lombardo1-13/+1
Change-Id: I28436e003ce7fe31d53e6663f3cc7aca00845e4b Reviewed-on: https://code.wireshark.org/review/25392 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-01-19Don't do pcap heuristics on a pipe.Guy Harris1-44/+78
Instead, just: assume a file with the regular pcap magic number is a regular pcap file, not an unhelpfully-modified-without-changing-the-magic-number format such as one of the (fortunately, short-lived) memory-mapped capture formats or the Nokia format; reject a file with the memory-mapped-capture-finally-changed-the- magic-number magic number, as they then changed the *new* format without changing its magic number; and don't even leave a provision for multiple formats using the "nanosecond pcap" magic number - not even when reading from a file - so we can punish bad behavior (which is what changing the format without changing the magic number is). This should get rid of the last place where, when reading a pcap file from a pipe, the first packet isn't displayed as soon as it arrives. Bug: 14345 Change-Id: I2fcb3354dc84cdd2d8ec749a0db883e56971c4b4 Reviewed-on: https://code.wireshark.org/review/25383 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-09-19IXIA lcap supportJoerg Mayer1-0/+12
IXIA^WKeysight Technologies's vitual IxNetwork version 8.30 will create capture files in a modified format: It uses a different magic and adds the total size of all records, i.e. the filesize minus the headersize. Add support for this. v2: Different file types use different magic numbers. Not yet tested/supported: The default fileending is .lcap Bug: 14073 Change-Id: Ida90b188ca66a78ff22dca237e4fd6b22e02dc14 Reviewed-on: https://code.wireshark.org/review/23614 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-19Put the definition of BIT_SWAPPED_MAC_ADDRS in the file where it's used.Guy Harris1-5/+0
In change 18a3b0659c209a2e0121eacd640b75e6c1c3b87d, I moved the table that uses it, but not the actual definition, from libpcap.c to pcap-common.c; they both should have been moved. Make it so. Change-Id: I266fce455df3848b873cdfadb12cecdbf9c8d4d3 Reviewed-on: https://code.wireshark.org/review/22216 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-05Allow bigger snapshot lengths for D-Bus captures.Guy Harris1-16/+17
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for them, because that's the largest possible D-Bus message size. See https://bugs.freedesktop.org/show_bug.cgi?id=100220 for an example of the problems caused by limiting the snapshot length to 256KB for D-Bus. Have a snapshot length of 0 in a capture_file structure mean "there is no snapshot length for the file"; we don't need the has_snap field in that case, a value of 0 mean "no, we don't have a snapshot length". In dumpcap, start out with a pipe buffer size of 2KB, and grow it as necessary. When checking for a too-big packet from a pipe, check against the appropriate maximum - 128MB for DLT_DBUS, 256KB for everything else. Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20 Reviewed-on: https://code.wireshark.org/review/21952 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-18Eliminate an unneded member of a wtap_dumper.Guy Harris1-9/+13
The only place the time stamp precision is used is in the libpcap code, where it determines whether to write out microsecond-precision or nanosecond-precision time stamps; we can determine that by looking at the type/subtype field, which is also part of that structure, so do that. We weren't setting it consistently - we were only setting it in libpcap and a few other capture file writers, and not in other capture file writers - and none of the writers other than libpcap used it. Change-Id: If53779cf4823ca936b8bf3e8a7dbcfea5850e652 Reviewed-on: https://code.wireshark.org/review/21171 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-09-29Replace some seeks forward with wtap_read_bytes() with a null buffer pointer.Guy Harris1-1/+1
If the seek forward is just skipping record content that's not (currently) interesting, use wtap_read_bytes() with a null buffer pointer; it catches short "reads" and requires less seeking, so it may work better when reading from a pipe. Change-Id: Ifb07d20e0391a8ed97da85149d971b4e9ef093a8 Reviewed-on: https://code.wireshark.org/review/17976 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-09-28Use wtap_read_bytes() to skip over bytes when reading a record.Guy Harris1-1/+1
Allow file_read() to take a null pointer as a buffer argument; a null argument means "do everything except copy the bytes from the file to the user buffer". That means that wtap_read_bytes() and wtap_read_bytes_or_eof() also support a null pointer as a buffer argument. Use wtap_read_bytes() with a null buffer argument rather than file_skip() to skip forward over data. This fixes some places where files were mis-identified as ERF files, as the ERF open heuristics now get a short "read" error if they try to skip over more bytes than exist in the file. Change-Id: I4f73499d877c1f582e2bcf9b045034880cb09622 Reviewed-on: https://code.wireshark.org/review/17974 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-21pcap: ERF per-Host ID/Source ID interface supportAnthony Coddington1-7/+31
Add encap_priv pointer to libpcap_t. Initialize erf_priv when ENCAP_ERF. Use erf_populate_interface_from_header() to dynamically create interfaces. Free encap_priv on pcap_close. Ping-Bug: 12303 Change-Id: Ieda425ef3e50a124d9c38ee4538aa3644128ce60 Reviewed-on: https://code.wireshark.org/review/15362 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-11-09Call the dumper routine to finish write a file the "finish" routine.Guy Harris1-1/+0
It doesn't actually *close* any handle, so it's best called a "finish" routine rather than a "close" routine. In libwiretap modules, don't bother setting the finish routine pointer to null - it's already initialized to null (it's probably best not to require modules to set it). Change-Id: I19554f3fb826db495f17b36600ae36222cbc21b0 Reviewed-on: https://code.wireshark.org/review/11659 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-01-03Remove unnecessary includes from wiretap folderMartin Mathieson1-1/+0
Change-Id: I10d3057801673bc1c8ea78f144215869cc4b1851 Reviewed-on: https://code.wireshark.org/review/6217 Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com> Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-02Add "Editor modelines"; Adjust whitespace as needed.Bill Meier1-16/+29
Change-Id: Ic5a5acb0f36d3aa144edbfb1ae71097b18426db4 Reviewed-on: https://code.wireshark.org/review/6216 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-12-18Rename WTAP_ERR_REC_TYPE_UNSUPPORTED to WTAP_ERR_UNWRITABLE_REC_TYPE.Guy Harris1-1/+1
That indicates that it's a problem specific to *writing* capture files; we've already converted some errors to that style, and added a new one in that style. Change-Id: I8268316fd8b1a9e301bf09ae970b4b1fbcb35c9d Reviewed-on: https://code.wireshark.org/review/5826 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-18Handle "I can't map this for that file format" better.Guy Harris1-2/+2
For cases where record (meta)data is something that can't be written out in a particular file format, return WTAP_ERR_UNWRITABLE_REC_DATA along with an err_info string. Report (and free) that err_info string in cases where WTAP_ERR_UNWRITABLE_REC_DATA is returned. Clean up some other error reporting cases, and flag with an XXX some cases where we aren't reporting errors at all, while we're at it. Change-Id: I91d02093af0d42c24ec4634c2c773b30f3d39ab3 Reviewed-on: https://code.wireshark.org/review/5823 Reviewed-by: Guy Harris <guy@alum.mit.edu>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-23 03:47:29 +0000