aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/netmon.c
AgeCommit message (Collapse)AuthorFilesLines
2021-12-19Replace g_strdup_printf() with ws_strdup_printf()João Valverde1-19/+19
Use macros from inttypes.h.
2021-08-29wiretap: always allocate a block for a record.Guy Harris1-0/+1
Without that, you could add a comment to a record in a file format the reading code for which doesn't allocate blocks, but the comment doesn't get saved, as there's no block in which to save the comment option. This simplifies some code paths, as we're either using the record's modified block or we're using the block as read from the file, there's no third possibility. If we attempt to read a record, and we get an error, and a block was allocated for the record, unreference it, so the individual file readers don't have to worry about it.
2021-04-02netmon: fill in all of the 802.11 pseudo-header in the dissector.Guy Harris1-20/+5
All the NetMon reading code does is initialize the pseudo-header; the bulk of the work is done in the dissector. Give the dissector its own pseudo-header structure, and do the initialization there. That's the way other packet formats in which the 802.11 radio metadata is a header at the beginning of the packet data, such as radiotap, work.
2021-02-23wiretap: rename wtap_register_file_type_subtypes().Guy Harris1-2/+2
It only registers one file type/subtype, so rename it to wtap_register_file_type_subtype(). That will also force plugins to be recompiled; that will produce compile errors for some plugins that didn't change to match the new contents of the file_type_subtype_info structure. Also check to make sure that the registered file type/subtype supports at least one type of block; a file type/subtype that doesn't return *any* blocks and doesn't permit *any* block types to be written is not very useful. That should also catch most if not all other plugins that didn't change to match the new contents of the file_type_subtype_info structure. Don't make errors registering a file type/subtype fatal; just complain, don't register the bogus file type/subtype, and drive on.
2021-02-21wiretap: have file handlers advertise blocks and options supported.Guy Harris1-2/+16
Instead of a "supports name resolution" Boolean and bitflags for types of comments supported, provide a list of block types that the file type/subtype supports, with each block type having a list of options supported. Indicate whether "supported" means "one instance" or "multiple instances". "Supports" doesn't just mean "can be written", it also means "could be read". Rename WTAP_BLOCK_IF_DESCRIPTION to WTAP_BLOCK_IF_ID_AND_INFO, to indicate that it provides, in addition to information about the interface, an ID (implicitly, in pcapng files, by its ordinal number) that is associated with every packet in the file. Emphasize that in comments - just because your capture file format can list the interfaces on which a capture was done, that doesn't mean it supports this; it doesn't do so if the file doesn't indicate, for every packet, on which of those interfaces it was captured (I'm looking at *you*, Microsoft Network Monitor...). Use APIs to query that information to do what the "does this file type/subtype support name resolution information", "does this file type/subtype support all of these comment types", and "does this file type/subtype support - and require - interface IDs" APIs did. Provide backwards compatibility for Lua. This allows us to eliminate the WTAP_FILE_TYPE_SUBTYPE_ values for IBM's iptrace; do so.
2021-02-17wiretap: more work on file type/subtypes.Guy Harris1-6/+11
Provide a wiretap routine to get an array of all savable file type/subtypes, sorted with pcap and pcapng at the top, followed by the other types, sorted either by the name or the description. Use that routine to list options for the -F flag for various commands Rename wtap_get_savable_file_types_subtypes() to wtap_get_savable_file_types_subtypes_for_file(), to indicate that it provides an array of all file type/subtypes in which a given file can be saved. Have it sort all types, other than the default type/subtype and, if there is one, the "other" type (both of which are put at the top), by the name or the description. Don't allow wtap_register_file_type_subtypes() to override any existing registrations; have them always register a new type. In that routine, if there are any emply slots in the table, due to an entry being unregistered, use it rather than allocating a new slot. Don't allow unregistration of built-in types. Rename the "dump open table" to the "file type/subtype table", as it has entries for all types/subtypes, even if we can't write them. Initialize that table in a routine that pre-allocates the GArray before filling it with built-in types/subtypes, so it doesn't keep getting reallocated. Get rid of wtap_num_file_types_subtypes - it's just a copy of the size of the GArray. Don't have wtap_file_type_subtype_description() crash if handed an file type/subtype that isn't a valid array index - just return NULL, as we do with wtap_file_type_subtype_name(). In wtap_name_to_file_type_subtype(), don't use WTAP_FILE_TYPE_SUBTYPE_ names for the backwards-compatibility names - map those names to the current names, and then look them up. This reduces the number of uses of hardwired WTAP_FILE_TYPE_SUBTYPE_ values. Clean up the type of wtap_module_count - it has no need to be a gulong. Have built-in wiretap file handlers register names to be used for their file type/subtypes, rather than building the table in init.lua. Add a new Lua C function get_wtap_filetypes() to construct the wtap_filetypes table, based on the registered names, and use it in init.lua. Add a #define WSLUA_INTERNAL_FUNCTION to register functions intended only for internal use in init.lua, so they can be made available from Lua without being documented. Get rid of WTAP_NUM_FILE_TYPES_SUBTYPES - most code has no need to use it, as it can just request arrays of types, and the space of type/subtype codes can be sparse due to registration in any case, so code has to be careful using it. wtap_get_num_file_types_subtypes() is no longer used, so remove it. It returns the number of elements in the file type/subtype array, which is not necessarily the name of known file type/subtypes, as there may have been some deregistered types, and those types do *not* get removed from the array, they just get cleared so that they're available for future allocation (we don't want the indices of any registered types to changes if another type is deregistered, as those indicates are the type/subtype values, so we can't shrink the array). Clean up white space and remove some comments that shouldn't have been added.
2021-02-14wiretap: register most built-in file types from its module.Guy Harris1-60/+66
Remove most of the built-in file types from the table in wiretap/file_access.c and, instead, have the file types register themselves, using wtap_register_file_type_subtypes(). This reduces the source code changes needed to add a new file type from three (add the handler, add the file type to the table in file_access.c, add a #define for the file type in wiretap/wtap.h) to one (add the handler). (It also requires adding the handler's source file to wiretap/CMakeLists.txt, but that's required in both cases.) A few remain because the WTAP_FILE_TYPE_SUBTYPE_ #define is used elsewhere; that needs to be fixed. Fix the wiretap/CMakefile.txt file to scan k12text.l, as that now contains a registration routine. In the process, avoid scanning files that don't implement a file type and won't ever have a registration routine. Add a Lua routine to fetch the total number of file types; we use that in some code to construct the wtap_filetypes table, which we need to do in order to continue to have all the values that used to come from the WTAP_FILE_TYPE_SUBTYPE_ types. While we're at it, add modelines to a file that lacked them.
2020-12-22Detect and replace bad allocation patternsMoshe Kaplan1-2/+2
Adds a pre-commit hook for detecting and replacing occurrences of `g_malloc()` and `wmem_alloc()` with `g_new()` and `wmem_new()`, to improve the readability of Wireshark's code, and occurrences of `g_malloc(sizeof(struct myobj) * foo)` with `g_new(struct myobj, foo)` to prevent integer overflows Also fixes all existing occurrences across the codebase.
2020-10-14Have WTAP_ERR_INTERNAL include an err_info string giving details.Guy Harris1-3/+5
That way, users won't just see "You got an internal error", the details will be given, so they can report them in a bug.
2020-10-11Fix many spelling errorsРоман Донченко1-2/+2
2020-08-07netmon: handle non-monitor-mode 802.11 packets differently.Guy Harris1-0/+6
Microsoft Network Monitor lets you capture on an 802.11 adapter either in monitor mode or in non-monitor mode; frames captured in non-monitor mode may have the Protected bit set in the 802.11 header, but are decrypted and don't incclude encryption information, and may have the A-MSDU Present flag set in the QoS Control field, but have just a regular frame payload, not a sequence of A-MSDUs, in the payload field. Dissect those frames correctly. Bug: 16758 Change-Id: I42b7e9ce52faa80222692403fa7276c039644343 Reviewed-on: https://code.wireshark.org/review/38082 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2019-07-27HTTPS In Still More Places, update more URLs.Guy Harris1-2/+2
Microsoft reshuffled their documentation - almost all of it moved from msdn.microsoft.com to docs.microsoft.com. Some blogs moved to devblogs.microsoft.com; the comments *didn't* move, so in one case we go to the Wayback Machine - the link isn't dead, but it formats horribly, at least on my browser, but the archived version formats OK. Use the Wayback Machine for some URLs, and update others. Update the sections for MS-ADTS. Point to the HTML versions of some RFCs and I-Ds. Change-Id: I344b20f880de63f1ae2a4e3f9ff98af78a7fe139 Reviewed-on: https://code.wireshark.org/review/34101 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-07-26HTTPS (almost) everywhere.Guy Harris1-1/+1
Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-05Have wtap_read() fill in a wtap_rec and Buffer.Guy Harris1-6/+6
That makes it - and the routines that implement it - work more like the seek-read routine. Change-Id: I0cace2d0e4c9ebfc21ac98fd1af1ec70f60a240d Reviewed-on: https://code.wireshark.org/review/32727 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-06-22Declare lead_surrogate only in the block where it's used.Guy Harris1-3/+5
That makes it a bit clearer that we don't need to initialize it to zero before the loop. This fixes a Dead Store (Dead assignement/Dead increment) Warning found by Clang. Change-Id: Iabfc4b47a3c6300814492c37ccfb321afd0c54ea Reviewed-on: https://code.wireshark.org/review/28374 Petri-Dish: Guy Harris <guy@alum.mit.edu> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-06-15Just extract the title length once.Guy Harris1-4/+4
Extract it into title_length before checking it, and then check the value of title_length. Change-Id: I7f2c334dbce5eeaa12cd5d8bb8e289852fd15c4f Reviewed-on: https://code.wireshark.org/review/28282 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-06-15Fix some "bad file" messages.Guy Harris1-2/+2
The number being compared against is the amount of data *remaining* in the comment information, not the *size* of the comment information. And it's unsigned, so format it with %u. Change-Id: I5f02302ad4acbc3b27655ff5518e6e56d464020d Reviewed-on: https://code.wireshark.org/review/28280 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-06-15Convert NetMon comment titles to UTF-8 when reading the file.Guy Harris1-10/+24
Fix indentation, and note that the comment "description" (contents) are RTF (as opposed to plain text). Change-Id: I668a08c06e39a32318454d2ee73933083c5cb516 Reviewed-on: https://code.wireshark.org/review/28279 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-06-15No need to check for a UTF-16 string's length being a multiple of 2.Guy Harris1-15/+9
utf_16_to_utf_8() just ignores the extra octet. Change-Id: I7bf003b674e5d9b0fb0265b0e8c6c142107084e3 Reviewed-on: https://code.wireshark.org/review/28277 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-06-14Fix indentation.Guy Harris1-2/+2
Change-Id: I6a3db704c9046ff696820ce157423c5867c2c2e8 Reviewed-on: https://code.wireshark.org/review/28275 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-06-14Fix the handling of paths in the process information.Guy Harris1-7/+203
Pathnames are not limited to 260 characters in recent versions of Windows; boost the limit to handle up to 32767 UTF-16 octet pairs worth of path. The pathname is in UTF-16-encoded Unicode; convert it to UTF-8 for our internal use. Bug: 14876 Change-Id: I4ef19fd47c7dbdd74dcaf31a7a80f432d57dbb0d Reviewed-on: https://code.wireshark.org/review/28273 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-03-13Get rid of TestBigEndian and AC_C_BIGENDIAN.Gerald Combs1-2/+2
Get rid of CMake's TestBigEndian and Autotools' AC_C_BIGENDIAN checks in favor of G_BYTE_ORDER. We use G_BYTE_ORDER elsewhere and TestBigEndian is noticeably slow on Windows. Change-Id: Idc1326294db9cbee8f6b6b11c2028fc4d19acbf0 Reviewed-on: https://code.wireshark.org/review/26462 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-02-09Generalize wtap_pkthdr into a structure for packet and non-packet records.Guy Harris1-61/+61
Separate the stuff that any record could have from the stuff that only particular record types have; put the latter into a union, and put all that into a wtap_rec structure. Add some record-type checks as necessary. Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2 Reviewed-on: https://code.wireshark.org/review/25696 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-08replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.Dario Lombardo1-1/+1
The first is deprecated, as per https://spdx.org/licenses/. Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed Reviewed-on: https://code.wireshark.org/review/25661 Petri-Dish: Anders Broman <a.broman58@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-07netmon: Initialize struct netmonrec_comment on allocStig Bjørlykke1-1/+1
This avoids an illegal pointer to free() on error. Bug: 14397 Change-Id: Id6e535141c7a3ee7b3d1822875b571e2199a5387 Reviewed-on: https://code.wireshark.org/review/25660 Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2018-01-20wiretap: use SPDX identifiers (partial work).Dario Lombardo1-13/+1
Change-Id: I28436e003ce7fe31d53e6663f3cc7aca00845e4b Reviewed-on: https://code.wireshark.org/review/25392 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-01-09Use pcapng as the name of the file format.Guy Harris1-2/+2
At one point, I remember a discussion resulting in the official name of the next-generation replacement for pcap format being changed to "pcapng", with no hyphen. Make Wireshark reflect that. Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a Reviewed-on: https://code.wireshark.org/review/25214 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-10-26Add a ws_in6_addr typedef for struct e_in6_addr.Guy Harris1-1/+1
That allows a parallel typedef of ws_in4_addr for guint32. Change-Id: I03b230247065e0e3840eb87635315a8e523ef562 Reviewed-on: https://code.wireshark.org/review/24073 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-09-24Don't look at the comment or process table with pre-2.2 files.Guy Harris1-6/+17
NetMon apparently didn't zero out the file header, so those fields have random values in pre-2.2. Change-Id: I3aeede6ab273d57ca937a5e18e67223fb4ed18da Reviewed-on: https://code.wireshark.org/review/23666 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-09-07More [-Wmaybe-uninitialized] fixes with -OgJoão Valverde1-0/+3
There may be some amount of bogosity involved but initialize the variables and add a default case to prevent the noise and the build from breaking with -Werror. Change-Id: I20432ea74a1e5edc28be75a97077c9aa7bc87a35 Reviewed-on: https://code.wireshark.org/review/23426 Petri-Dish: João Valverde <j@v6e.pt> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: João Valverde <j@v6e.pt>
2017-09-06NetMon: Add support for WiFi MessageMichael Mann1-0/+2
It's just a WTAP_ENCAP_IEEE_802_11 Change-Id: I7369fac06a7d63812bb7ce7b3c16b9fe606f544c Reviewed-on: https://code.wireshark.org/review/23418 Petri-Dish: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-09-05Ensure process info offset is "seek"ed when process info exists in NetMon file.Michael Mann1-0/+5
Change-Id: I85fd990781a47e738c22bff0218aabdc04122e15 Reviewed-on: https://code.wireshark.org/review/23403 Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-09-04Add support for WPFCapture "formats" from Microsoft Analyzer.Michael Mann1-1/+35
Normally a .cap file contains a network type that when masked with 0xFFF will convert to a pcap LINKTYPE_ value. However, Microsoft Analyzer used 0xE080-0xE08A for their own purposes within a .cap file. Add support for the WPFCapture formats and give a "not supported" error message to the few left unsupported. Bug: 10556 Change-Id: I321a75ce769fdec75bdc6b595936c25932950a97 Reviewed-on: https://code.wireshark.org/review/23386 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-09-01Add support for NetMon NetmonFilter and NetworkInfoEx frame types.Michael Mann1-2/+6
Bug: 4221 Change-Id: I59aff777c364af1a064e1e99ea9ac6692a4cedfa Reviewed-on: https://code.wireshark.org/review/23333 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-31Read process info table from Netmon filesMichael Mann1-20/+214
There isn't a place at the moment that uses it, but prepare that use by parsing out the process info table and placing it the netmon private data. Bug: 4224 Ping-Bug: 1184 Change-Id: I6186b3dce0333042357089d8517c8b47b5ff7f70 Reviewed-on: https://code.wireshark.org/review/23316 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-30Add support for reading comments in Network Monitor filesMichael Mann1-22/+253
The NetMon wiretap reads the title and description comment fields from a NetMon file and saves it in the wiretap private structure. Then when it's time to make a frame, the comment fields are added to a NetMon pseudoheader with a new WTAP ENCAP type, with the potential for netmon pseudoheader to contain pseudoheader data from "base" wiretap. Then the netmon_header dissector displays the comment fields and passes any "base" wiretap pseudoheader data when calling the wtap_encap dissector table that the frame dissector normally calls. Bug: 4225 Change-Id: I8f772bc9494364c98434c78b61eb5a64012ff3b9 Reviewed-on: https://code.wireshark.org/review/23210 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-29Add Network Monitor Event Tracing eventMichael Mann1-1/+2
Assigned a WTAP_ENCAP value (WTAP_ENCAP_NETMON_NET_NETEVENT) for the dissection of Event Tracing records inside a NetworkMonitor file. Ping-Bug: 6520 Ping-Bug: 6694 Change-Id: Ib100f3779095842e78f9b7741e80258aa866d818 Reviewed-on: https://code.wireshark.org/review/23278 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-06-05Allow bigger snapshot lengths for D-Bus captures.Guy Harris1-3/+3
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for them, because that's the largest possible D-Bus message size. See https://bugs.freedesktop.org/show_bug.cgi?id=100220 for an example of the problems caused by limiting the snapshot length to 256KB for D-Bus. Have a snapshot length of 0 in a capture_file structure mean "there is no snapshot length for the file"; we don't need the has_snap field in that case, a value of 0 mean "no, we don't have a snapshot length". In dumpcap, start out with a pipe buffer size of 2KB, and grow it as necessary. When checking for a too-big packet from a pipe, check against the appropriate maximum - 128MB for DLT_DBUS, 256KB for everything else. Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20 Reviewed-on: https://code.wireshark.org/review/21952 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-06*_stdup_printf -> strdup for "single string only" formatting.Michael Mann1-1/+1
Done for performance improvements. This could probably be done in checkAPIs.pl, but this was just a quick manual check with grepping. Change-Id: I91ff102cb528bb00fa2f65489de53890e7e46f2d Reviewed-on: https://code.wireshark.org/review/15751 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2015-12-24Refactor 802.11 radio flags.Simon Barber1-1/+1
The use of a flag field here is aesthetically unpleasing when the flags are referred to frequently. Convert these into bitfield entries. Change-Id: I6f47e31558439dfd343ec7f856d04480366a1237 Reviewed-on: https://code.wireshark.org/review/12511 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-11-09Call the dumper routine to finish write a file the "finish" routine.Guy Harris1-3/+3
It doesn't actually *close* any handle, so it's best called a "finish" routine rather than a "close" routine. In libwiretap modules, don't bother setting the finish routine pointer to null - it's already initialized to null (it's probably best not to require modules to set it). Change-Id: I19554f3fb826db495f17b36600ae36222cbc21b0 Reviewed-on: https://code.wireshark.org/review/11659 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25Clean up 802.11 radio information handling.Guy Harris1-0/+1
Have a field that holds the PHY type but nothing else. Have a union with structures holding PHY-type-specific information, as a bunch of attributes are PHY-specific. If we have a channel and band, but don't have the frequency, attempt to calculate the frequency, and add that to the radio information if we succeed. If we have the frequency, but don't have the channel, attempt to calculate the channel, and add that to the radio information if we succeed. Handle FHSS information, 11a "half/quarter-clocked" and turbo information, 11g normal vs. Super G, additional 11n and 11ac information, and the "short preamble" flag for 11b and 11g. Add a PHY type for 11 legacy DSSS and detect it if possible. Clean up the AVS dissector - make all fields wlancap. fields (if you want generic fields, use the wlan_radio. fields). Set more fields when writing out Commview Wi-Fi files. Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69 Reviewed-on: https://code.wireshark.org/review/9146 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-20Call the "802.11 radio information" dissector for radio headers.Guy Harris1-1/+2
Have dissectors of various forms of radio information headers in the packets fill in a struct ieee_802_11_phdr with radio information as appropriate, and call the "802.11 radio information" dissector rather than the raw 802.11 dissector. This means that the radio information can be found in a protocol-independent and encapsulation-independent form when you're looking at the packet; that information can be presented in a form somewhat easier to read than the raw metadata header format. It also enables having a single "radio information" tap that allows statistics to handle all different sorts of radio information encapsulation. In addition, it lets us clean up some of the arguments passed to the common 802.11 dissector routine, by having it pull that information from the struct ieee_802_11_phdr. Ensure that the right structure gets passed to that routine, and that all the appropriate parts of that structure are filled in. Rename the 802.11 radio protocol to "wlan_radio", rather than just "radio", as it's 802.11-specific. Give all its fields "wlan_radio." names rather than "wlan." names. Change-Id: I78d79afece0ce0cf5fc17293c1e29596413b31c8 Reviewed-on: https://code.wireshark.org/review/8992 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-04-20Have a common routine to convert FILETIME to nstime_t.Guy Harris1-42/+5
We had several copies of that code; put it into a filetime_to_nstime() routine in wsutil, and call that common routine instead. Change-Id: I1eb5579c36c129ff8d23f9212285ab3f63be0f43 Reviewed-on: https://code.wireshark.org/review/8142 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-04-07ieee80211.c: "IEEE 802.11 plus Network Monitor radio header" encap: Fix ↵Bill Meier1-3/+8
dissection Specifically: Management/Control frames saved by Microsoft Netmon (3.4?) with "IEEE 802.11 plus Network Monitor radio header" encapsulation may or may not be saved with an FCS. See Bug 11105. Fix: Use "check fcs" preference to specify whether Management & Control frames have an fcs for this encapsulation. Change-Id: Ibd0be7b4765c2df2b959cb2234aeed027266246b Reviewed-on: https://code.wireshark.org/review/7939 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-01-03Remove unnecessary includes from wiretap folderMartin Mathieson1-1/+0
Change-Id: I10d3057801673bc1c8ea78f144215869cc4b1851 Reviewed-on: https://code.wireshark.org/review/6217 Petri-Dish: Martin Mathieson <martin.r.mathieson@googlemail.com> Reviewed-by: Martin Mathieson <martin.r.mathieson@googlemail.com>
2015-01-02Add "Editor modelines"; Adjust whitespace as needed.Bill Meier1-0/+13
Change-Id: Ic5a5acb0f36d3aa144edbfb1ae71097b18426db4 Reviewed-on: https://code.wireshark.org/review/6216 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-12-18Rename WTAP_ERR_REC_TYPE_UNSUPPORTED to WTAP_ERR_UNWRITABLE_REC_TYPE.Guy Harris1-1/+1
That indicates that it's a problem specific to *writing* capture files; we've already converted some errors to that style, and added a new one in that style. Change-Id: I8268316fd8b1a9e301bf09ae970b4b1fbcb35c9d Reviewed-on: https://code.wireshark.org/review/5826 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-18Handle "I can't map this for that file format" better.Guy Harris1-2/+2
For cases where record (meta)data is something that can't be written out in a particular file format, return WTAP_ERR_UNWRITABLE_REC_DATA along with an err_info string. Report (and free) that err_info string in cases where WTAP_ERR_UNWRITABLE_REC_DATA is returned. Clean up some other error reporting cases, and flag with an XXX some cases where we aren't reporting errors at all, while we're at it. Change-Id: I91d02093af0d42c24ec4634c2c773b30f3d39ab3 Reviewed-on: https://code.wireshark.org/review/5823 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17Rename WTAP_ERR_UNSUPPORTED_FILE_TYPE to WTAP_ERR_UNWRITABLE_FILE_TYPE.Guy Harris1-3/+3
That makes it clearer what the problem is, and that it should only be returned by the dump code path, not by the read code path. Change-Id: I22d407efe3ae9fba7aa25f08f050317549866442 Reviewed-on: https://code.wireshark.org/review/5798 Reviewed-by: Guy Harris <guy@alum.mit.edu>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-21 01:27:55 +0000