aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/netscaler.c
AgeCommit message (Collapse)AuthorFilesLines
2023-06-26Don't include errno.h if we don't use errno or errno value definitions.Guy Harris1-1/+0
2023-06-04netscaler: clean up the way we read pages.Guy Harris1-42/+74
It appears that the last page of a file can be shorter than the regular page size. Rename nstrace_read_buf() to nstrace_read_page(), and have it succeed on a short read - only an I/O error or an EOF should cause it to fail - and have it set nstrace->nstrace_buflen to the number of bytes it read. Have the private data structure contain the page size. Clean up some other stuff.
2023-05-19netscaler: add more checks to make sure the record is within the page.Guy Harris1-5/+10
Whie we're at it, restructure some other checks to test-before-casting - it's OK to test afterwards, but testing before makes it follow the pattern used elsewhere. Fixes #19081.
2023-03-21wiretap: rename the wtap_dumper field "encap" to "file_encap".Guy Harris1-1/+1
That indicates that it's a *per-file* encapsulation, not just some unspecified type of encapsulation such as per-packet or per-interface.
2023-03-21netscaler: don't allow multiple encapsulations.Guy Harris1-0/+9
All packets in a NetScaler nstrace file must have the encapsulation appropriate to the version of the file.
2021-08-29wiretap: always allocate a block for a record.Guy Harris1-0/+6
Without that, you could add a comment to a record in a file format the reading code for which doesn't allocate blocks, but the comment doesn't get saved, as there's no block in which to save the comment option. This simplifies some code paths, as we're either using the record's modified block or we're using the block as read from the file, there's no third possibility. If we attempt to read a record, and we get an error, and a block was allocated for the record, unreference it, so the individual file readers don't have to worry about it.
2021-06-06Replace g_assert() with ws_assert() in placesJoão Valverde1-5/+6
2021-05-23netscaler: plug a memory leak.Guy Harris1-0/+1
Free the read buffer if the first read fails.
2021-04-30Cast away the return value of g_strlcpy() and g_strlcat().Guy Harris1-1/+1
Most of the time, the return value tells us nothing useful, as we've already decided that we're perfectly willing to live with string truncation. Hopefully this keeps Coverity from whining that those routines could return an error code (NARRATOR: They don't) and thus that we're ignoring the possibility of failure (as indicated, we've already decided that we can live with string truncation, so truncation is *NOT* a failure).
2021-04-16Wiretap: Fix some compiler warnings.Gerald Combs1-5/+5
Make various _dump_can_write_encap and _dump_open routines static. Add a couple of casts.
2021-02-23wiretap: rename wtap_register_file_type_subtypes().Guy Harris1-4/+4
It only registers one file type/subtype, so rename it to wtap_register_file_type_subtype(). That will also force plugins to be recompiled; that will produce compile errors for some plugins that didn't change to match the new contents of the file_type_subtype_info structure. Also check to make sure that the registered file type/subtype supports at least one type of block; a file type/subtype that doesn't return *any* blocks and doesn't permit *any* block types to be written is not very useful. That should also catch most if not all other plugins that didn't change to match the new contents of the file_type_subtype_info structure. Don't make errors registering a file type/subtype fatal; just complain, don't register the bogus file type/subtype, and drive on.
2021-02-21wiretap: have file handlers advertise blocks and options supported.Guy Harris1-4/+32
Instead of a "supports name resolution" Boolean and bitflags for types of comments supported, provide a list of block types that the file type/subtype supports, with each block type having a list of options supported. Indicate whether "supported" means "one instance" or "multiple instances". "Supports" doesn't just mean "can be written", it also means "could be read". Rename WTAP_BLOCK_IF_DESCRIPTION to WTAP_BLOCK_IF_ID_AND_INFO, to indicate that it provides, in addition to information about the interface, an ID (implicitly, in pcapng files, by its ordinal number) that is associated with every packet in the file. Emphasize that in comments - just because your capture file format can list the interfaces on which a capture was done, that doesn't mean it supports this; it doesn't do so if the file doesn't indicate, for every packet, on which of those interfaces it was captured (I'm looking at *you*, Microsoft Network Monitor...). Use APIs to query that information to do what the "does this file type/subtype support name resolution information", "does this file type/subtype support all of these comment types", and "does this file type/subtype support - and require - interface IDs" APIs did. Provide backwards compatibility for Lua. This allows us to eliminate the WTAP_FILE_TYPE_SUBTYPE_ values for IBM's iptrace; do so.
2021-02-17netscaler: fix a comment.Guy Harris1-1/+1
2021-02-17wiretap: more work on file type/subtypes.Guy Harris1-8/+17
Provide a wiretap routine to get an array of all savable file type/subtypes, sorted with pcap and pcapng at the top, followed by the other types, sorted either by the name or the description. Use that routine to list options for the -F flag for various commands Rename wtap_get_savable_file_types_subtypes() to wtap_get_savable_file_types_subtypes_for_file(), to indicate that it provides an array of all file type/subtypes in which a given file can be saved. Have it sort all types, other than the default type/subtype and, if there is one, the "other" type (both of which are put at the top), by the name or the description. Don't allow wtap_register_file_type_subtypes() to override any existing registrations; have them always register a new type. In that routine, if there are any emply slots in the table, due to an entry being unregistered, use it rather than allocating a new slot. Don't allow unregistration of built-in types. Rename the "dump open table" to the "file type/subtype table", as it has entries for all types/subtypes, even if we can't write them. Initialize that table in a routine that pre-allocates the GArray before filling it with built-in types/subtypes, so it doesn't keep getting reallocated. Get rid of wtap_num_file_types_subtypes - it's just a copy of the size of the GArray. Don't have wtap_file_type_subtype_description() crash if handed an file type/subtype that isn't a valid array index - just return NULL, as we do with wtap_file_type_subtype_name(). In wtap_name_to_file_type_subtype(), don't use WTAP_FILE_TYPE_SUBTYPE_ names for the backwards-compatibility names - map those names to the current names, and then look them up. This reduces the number of uses of hardwired WTAP_FILE_TYPE_SUBTYPE_ values. Clean up the type of wtap_module_count - it has no need to be a gulong. Have built-in wiretap file handlers register names to be used for their file type/subtypes, rather than building the table in init.lua. Add a new Lua C function get_wtap_filetypes() to construct the wtap_filetypes table, based on the registered names, and use it in init.lua. Add a #define WSLUA_INTERNAL_FUNCTION to register functions intended only for internal use in init.lua, so they can be made available from Lua without being documented. Get rid of WTAP_NUM_FILE_TYPES_SUBTYPES - most code has no need to use it, as it can just request arrays of types, and the space of type/subtype codes can be sparse due to registration in any case, so code has to be careful using it. wtap_get_num_file_types_subtypes() is no longer used, so remove it. It returns the number of elements in the file type/subtype array, which is not necessarily the name of known file type/subtypes, as there may have been some deregistered types, and those types do *not* get removed from the array, they just get cleared so that they're available for future allocation (we don't want the indices of any registered types to changes if another type is deregistered, as those indicates are the type/subtype values, so we can't shrink the array). Clean up white space and remove some comments that shouldn't have been added.
2021-02-14wiretap: register most built-in file types from its module.Guy Harris1-47/+136
Remove most of the built-in file types from the table in wiretap/file_access.c and, instead, have the file types register themselves, using wtap_register_file_type_subtypes(). This reduces the source code changes needed to add a new file type from three (add the handler, add the file type to the table in file_access.c, add a #define for the file type in wiretap/wtap.h) to one (add the handler). (It also requires adding the handler's source file to wiretap/CMakeLists.txt, but that's required in both cases.) A few remain because the WTAP_FILE_TYPE_SUBTYPE_ #define is used elsewhere; that needs to be fixed. Fix the wiretap/CMakefile.txt file to scan k12text.l, as that now contains a registration routine. In the process, avoid scanning files that don't implement a file type and won't ever have a registration routine. Add a Lua routine to fetch the total number of file types; we use that in some code to construct the wtap_filetypes table, which we need to do in order to continue to have all the values that used to come from the WTAP_FILE_TYPE_SUBTYPE_ types. While we're at it, add modelines to a file that lacked them.
2020-12-22Detect and replace bad allocation patternsMoshe Kaplan1-2/+2
Adds a pre-commit hook for detecting and replacing occurrences of `g_malloc()` and `wmem_alloc()` with `g_new()` and `wmem_new()`, to improve the readability of Wireshark's code, and occurrences of `g_malloc(sizeof(struct myobj) * foo)` with `g_new(struct myobj, foo)` to prevent integer overflows Also fixes all existing occurrences across the codebase.
2020-12-17Update comments: From wtap_pkthdr to wtap_rec.Jim Young1-1/+1
Fixup some overlooked comments to reflect refactoring made back in 2018 with commit 1f5f63f8ef98bfe9c4d734674cee0df64855555d.
2020-10-14Have WTAP_ERR_INTERNAL include an err_info string giving details.Guy Harris1-1/+1
That way, users won't just see "You got an internal error", the details will be given, so they can report them in a bug.
2020-10-11Fix many spelling errorsРоман Донченко1-1/+1
2020-07-29wiretap: generate fake IDBs for more capture file types.Guy Harris1-0/+9
That makes them work as input to a mergecap that writes pcapng files. File types that don't have a single per-file encapsulation type need more work, with multiple fake IDBs, one for each packet encapsulation type seen in the file, unless we can generate real IDBs. Change-Id: I2859e4f7fb15ec0c0f31a4044dc15638e5db7826 Reviewed-on: https://code.wireshark.org/review/37983 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2020-01-16netscaler: fix nstrace_ensure_buflen call.Dario Lombardo1-1/+1
The call must ensure enough bytes are in the buffer for subsequent casts. Next cast is for nspr_pktracefull_v20_t. Change-Id: I8b77aa243f528f82786af1047e8d26100f306a07 Reviewed-on: https://code.wireshark.org/review/35837 Reviewed-by: Dario Lombardo <lomato@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-07-26HTTPS (almost) everywhere.Guy Harris1-1/+1
Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-05Have wtap_read() fill in a wtap_rec and Buffer.Guy Harris1-55/+56
That makes it - and the routines that implement it - work more like the seek-read routine. Change-Id: I0cace2d0e4c9ebfc21ac98fd1af1ec70f60a240d Reviewed-on: https://code.wireshark.org/review/32727 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-16Remove incorrectly-inserted "return FALSE;".Guy Harris1-1/+0
That made PACKET_DESCRIBE() do nothing, causing warnings from the Clang Static Humiliator. Change-Id: I6f433cd193b6398d89038e95c7bf5deb24aa186d Reviewed-on: https://code.wireshark.org/review/32437 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-16Fix up the checks in nspm_signature_version().Guy Harris1-36/+93
Move the read out of nspm_signature_version(), to make it a bit clearer what file I/O we do in the open process; have nspm_signature_version() just look for a signature in a single page. In the loop in nspm_signature_version(), make sure we have enough of the record header to look at the type and length fields in that header before looking at them and, when we can look at them, make sure the length of the record 1) fits in what remains of the page we're looking at and 2) is big enough to be the length of a signature record. Change-Id: I7d625859136e6f39c40b166067fc7efea806d9b0 Reviewed-on: https://code.wireshark.org/review/32426 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-15netscaler: add more sanity checks.Dario Lombardo1-0/+4
Fix more crashes found in the provided bug report. Bug: 15497 Change-Id: If84498fa879ad56c8677f8c1442a8dc0e5906003 Reviewed-on: https://code.wireshark.org/review/32333 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-03-14Ask, in a comment, whether we should do an exact match on signatures.Guy Harris1-0/+2
Change-Id: I3c6e904a2e8cc843687b69f633fd0dfbf0ec7937 Reviewed-on: https://code.wireshark.org/review/32407 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-14Fix the test for a NetScaler trace file.Guy Harris1-7/+21
When testing the signature field against a given version's signature: we require that the signature field's size (size, not C null-terminated string length) be at least the size of the signature string (otherwise, it can't possibly match); we check to make sure that the first N bytes of the signature field, where N is the size of the version's signature string (not including any terminating '\0' in that string), match the version's signature string. I.e., we require that the version's signature string is a prefix of the signature string in the file. This does not require that the signature string in the file be null-terminated. It also doesn't allow the file's signature string to be a substring of the version's signature string, as that's *NOT* sufficient to identify the file as a NetScaler trace file, especially if we forcibly null-terminate the file's signature string and we trucate it to be zero-length, as, in that case, it's *always* a prefix of the version's signature string, and the file is incorrectly identified as a NetScaler trace file. (While we're at it, we make the nspm_signature_isvXXX() routines return true if it *is* and false if it *isn't*, rather than the reverse; having a routine with a name containing "is", and not "isnt", return true if it *isn't* is confusing.) Change-Id: I3694773a71b8b63d280e42f146698c82a0f0c332 Ping-Bug: 15601 Reviewed-on: https://code.wireshark.org/review/32403 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-02-26netscaler: fix multiple out-of-bounds reads.Dario Lombardo1-6/+60
Multiple bugs have been found in the provided bug. Some of them have been fixed in gefe920a, others here. The main problem is when malformed files give wrong lenghts to the code, that casts and dereference it without checking, causing oob reads. The fix introduces a check function that prevents to go beyond the limits, early returning with a malformed file message. Other bugs have been fixed by forcing the string terminator that allows the use of strlen() and MIN() that prevent wrong reads. Bug: 15497 Change-Id: I8411208b5ea0f1a0720a17b882f704d03296d1c4 Reviewed-on: https://code.wireshark.org/review/32194 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2019-02-20netscaler: fix crash when reading malformed packets.Dario Lombardo1-0/+6
When reading a malformed packet, it can occur that we go close to the end of the buffer. We need to check if we have 2 bytes before reading a uint16. Bug: 15497 Change-Id: I2b00f44933ca11b925ffbf05b9855684feebcda5 Reviewed-on: https://code.wireshark.org/review/32028 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-09Generalize wtap_pkthdr into a structure for packet and non-packet records.Guy Harris1-274/+278
Separate the stuff that any record could have from the stuff that only particular record types have; put the latter into a union, and put all that into a wtap_rec structure. Add some record-type checks as necessary. Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2 Reviewed-on: https://code.wireshark.org/review/25696 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-08replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.Dario Lombardo1-1/+1
The first is deprecated, as per https://spdx.org/licenses/. Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed Reviewed-on: https://code.wireshark.org/review/25661 Petri-Dish: Anders Broman <a.broman58@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-01-20wiretap: use SPDX identifiers (partial work).Dario Lombardo1-13/+1
Change-Id: I28436e003ce7fe31d53e6663f3cc7aca00845e4b Reviewed-on: https://code.wireshark.org/review/25392 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2017-06-05Allow bigger snapshot lengths for D-Bus captures.Guy Harris1-4/+4
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for them, because that's the largest possible D-Bus message size. See https://bugs.freedesktop.org/show_bug.cgi?id=100220 for an example of the problems caused by limiting the snapshot length to 256KB for D-Bus. Have a snapshot length of 0 in a capture_file structure mean "there is no snapshot length for the file"; we don't need the has_snap field in that case, a value of 0 mean "no, we don't have a snapshot length". In dumpcap, start out with a pipe buffer size of 2KB, and grow it as necessary. When checking for a too-big packet from a pipe, check against the appropriate maximum - 128MB for DLT_DBUS, 256KB for everything else. Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20 Reviewed-on: https://code.wireshark.org/review/21952 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-29Fix problem found by Coverity.Guy Harris1-1/+5
The loop was using bytes_read, but wasn't setting it. Go back to something similar to the previous loop condition, but don't lose the error tests. Fixes Coverity CID 1403388. Change-Id: I557cbfa6e9ad81491af4fc90e85ce87c71fec8aa Reviewed-on: https://code.wireshark.org/review/20776 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-27netscaler.c: use dynamic memory for temporary buffer in nstrace_read_v30.Michael Mann1-1/+9
Makes Windows vscodeanalysis a little happier. Change-Id: Ie744e91ab3f2a9744ae21c932ab6ea25467ad2fa Reviewed-on: https://code.wireshark.org/review/20724 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-12Catch read errors and zero-length records, as opposed to short reads/EOF.Guy Harris1-22/+50
Also, if we return WTAP_OPEN_ERROR from an open routine after we've set our close routine, that routine is called, which frees up our private data structures; don't free them ourselves before returning WTAP_OPEN_ERROR. Change-Id: I03eebe1a1677e2161fdacec8de14668093cf03a3 Reviewed-on: https://code.wireshark.org/review/20522 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-12netscaler: Sanity check record sizeMichael Mann1-1/+5
Bug: 13478 Change-Id: I6be2972979ff7cabf27e70d236c581d539d6ddac Reviewed-on: https://code.wireshark.org/review/20515 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-10Don't cast to a too-large size.Guy Harris1-1/+1
The maximum record length is 255*128 + 127 = 32767; that fits in a guint32, which is large enough to support the biggest packet we'd ever support without stretching several size values to 64 bits. It's not a size of an object in memory, so it doesn't have to be a size_t, and a size_t could be too large to fit in the record sizes we're using. Just cast to guint32. Change-Id: Ie664fda3ce9945893fd992bbb9a81a5d632a3fcb Reviewed-on: https://code.wireshark.org/review/20479 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-10nstrace: fix size of vmnamesAnil Kumar1-2/+2
When vmnames are included in the header of a netscaler packet trace, number of bytes equal to the size of vmnames is omitted from the packet, by the dissector. Bug: 13459 Change-Id: I0f907e9c2e08c1cbebd47f7e50d8284a6aaade59 Reviewed-on: https://code.wireshark.org/review/20446 Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-02Make sure nspr_getv20recordsize() returns an unsigned value.Guy Harris1-1/+1
The record size fields are guint8, but NSPR_V20RECORDSIZE_2BYTES was 0x80, which has type int, promoting the result to int. Make it 0x80U, which means everything is unsigned. This squelches a compiler warning. Change-Id: I1c63e485352a90c7f675ab0dacaaeba794235b35 Reviewed-on: https://code.wireshark.org/review/20344 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-02Do more record length checks.Guy Harris1-15/+45
Do the check early in the process of processing the record, and do it for all record types. Bug: 13429 Change-Id: Id7f4d12415c6740241850d8f873cff52909e7110 Reviewed-on: https://code.wireshark.org/review/20330 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-02Don't go past the end of a page in a NetScaler file.Guy Harris1-16/+69
Records in a properly formatted NetScaler file shouldn't go past the end of a page, but nothing guarantees that a NetScaler file will be properly formatted. NetScaler 3.x files allow record bodies to go past the end of a page, but 1.x and 2.x files don't, so treat record headers that go past the end of a page, and record bodies in 1.x and 2.x files that go past the end of a page, as errors. Clean up some stuff while we're at it. Bug: 13430 Change-Id: I3b1d56086e3bb14b246406f306e3d730df337561 Reviewed-on: https://code.wireshark.org/review/20326 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-04-30Note some cases where we don't need to check the packet length.Guy Harris1-0/+13
These file formats have 16-bit packet lengths, so, even with some extra metadata added, the packet data length will never be bigger than WTAP_MAX_PACKET_SIZE. (No, we won't ever reduce WTAP_MAX_PACKET_SIZE.) Change-Id: I9e1b1d90971f91cc6e5d66d0aa93841445b2bc22 Reviewed-on: https://code.wireshark.org/review/15186 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-03-06Fix indentation.Guy Harris1-23/+23
Change-Id: I78fd1d8e91443fa878e6c4ae05839d8a49849830 Reviewed-on: https://code.wireshark.org/review/14367 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-11nstrace: Allow opening of files that are not multiples of 16kBanilkumar9111-5/+14
in size. Wireshark/Tshark hangs when netscaler trace file smaller than 16KB is opened. It also hangs when a gzipped trace file is opened. With this fix, Files with sizes that are not multiple of 16KB and gzipped files can be opened. Bug: 12083 Change-Id: I26b2fc406edafcb2f1f6161d69064ba5662ddf29 Reviewed-on: https://code.wireshark.org/review/13721 Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-12-18Removed local definitions of offsetof().Stig Bjørlykke1-4/+2
The offsetof() macro is an ANSI C library feature. Change-Id: I2ac91b0b4c94c6f6baf14133b076fdc5ed2e182b Reviewed-on: https://code.wireshark.org/review/12707 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-06-03Netscaler: Fix issue where packets were lost when selected packets were exportedanilkumar9111-5/+21
Only this issue with a netscaler trace file Bug: 11248 Change-Id: I2bc2cae5c988eeff7bdd08471bf421faafcd4e73 Reviewed-on: https://code.wireshark.org/review/8672 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2015-04-13Support for new netscaler 3.5 trace format.anilkumar9111-5/+121
Change-Id: Ica74f3f9239a96486967cf248feb4313bc390734 Reviewed-on: https://code.wireshark.org/review/7751 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-03-01Call TIMEDEFVn macros in all PACKET_DESCRIBE() macros.Guy Harris1-46/+70
Create TIMEDEFV10() and, for it and for V20, V21, and V22, undefine the ones used for the read routine and define dummy ones for the read-seek routines (as those record formats have relative, not absolute, times). Have all of them set presence_flags. That way: 1) if we *can* set the time stamps in the seek-read routine, we do; 2) we always set presence_flags in read and seek-read routines. Change-Id: I837507245e8a0cbc68c7c5fd8365f474d085488e Reviewed-on: https://code.wireshark.org/review/7445 Reviewed-by: Guy Harris <guy@alum.mit.edu>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-11 17:09:11 +0000