aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/pcapng.c
AgeCommit message (Collapse)AuthorFilesLines
2018-05-14Use ws_g_warning() for plugin registration errors.Guy Harris1-4/+5
Those should always be reported, as they indicate that a block type plugin is trying to do something we don't allow. We should probably have a mechanism by which ws_g_warning() messages are logged to the standard error for command-line programs, logged to an error message window for GUI programs, and logged to some form of system log for daemons. For now, it's a good way to log non-fatal errors that should always be shown in *some* fashion, as well as to mark messages that should be handled in the form described in the previous sentence. Change-Id: Ieedf87fc2dd3184a4466ae69af01f799165c1b70 Reviewed-on: https://code.wireshark.org/review/27519 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-05-14wiretap: use pcapng_debug instead of g_warning.Dario Lombardo1-2/+2
Change-Id: Ibbfe3d1db8b4a7515e7eda194a76d3b0a624542e Reviewed-on: https://code.wireshark.org/review/27383 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Dario Lombardo <lomato@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2018-02-20pcapng: Free option_content on errorStig Bjørlykke1-0/+1
Change-Id: If36b92def61112f8ebe8cfda0edfb63a15c46af0 Reviewed-on: https://code.wireshark.org/review/25925 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2018-02-09Do the maximum block size check in pcap_read_block().Guy Harris1-75/+13
Do it before we even *try* to read the block, so that it's done in one place rather than having to be done in every routine to handle particular block types. The check was missing in the routine to read sysdig event blocks, so if we got a huge sysdig even block we'd try to allocate a huge amount of memory. Bug: 14403 Change-Id: Iff0fb0387e4499420598361be6d241f2832042d7 Reviewed-on: https://code.wireshark.org/review/25702 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Rename ft_specific_data to reflect what we're actually using it for.Guy Harris1-2/+2
It's only being used as a working buffer to hold the raw options data we read in. Change-Id: I17b812e447f575ad92394b9f957658fc655cdf8e Reviewed-on: https://code.wireshark.org/review/25701 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Remove redundant members from wtap_syscall_header.Guy Harris1-8/+7
No need for len, and call caplen event_filelen and move it after event_len. Change-Id: I8b3825d4022ee083ee52f83f7a69f22829ed9fc4 Reviewed-on: https://code.wireshark.org/review/25698 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Generalize wtap_pkthdr into a structure for packet and non-packet records.Guy Harris1-132/+133
Separate the stuff that any record could have from the stuff that only particular record types have; put the latter into a union, and put all that into a wtap_rec structure. Add some record-type checks as necessary. Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2 Reviewed-on: https://code.wireshark.org/review/25696 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-08replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.Dario Lombardo1-1/+1
The first is deprecated, as per https://spdx.org/licenses/. Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed Reviewed-on: https://code.wireshark.org/review/25661 Petri-Dish: Anders Broman <a.broman58@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-07Distinguish between "probably not pcapng" and "probably bad pcapng" errors.Guy Harris1-55/+85
Go back to having pcapng_read_block() and pcapng_read_section_header_block() treating SHB read errors that might be due to the file not being a pcapng file separately from other errors. This keeps us from treating pcapng files with malformed SHBs as not being pcapng files, making us dissect them using the pcapng file dissector rather than reporting the malformation. Change-Id: I1d92cc4ac521668b88638b2b3ed5257340451798 Ping-Bug: 14402 Reviewed-on: https://code.wireshark.org/review/25675 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-05Have block read routines indicate whether the block should be returned.Guy Harris1-37/+61
Some blocks should be returned by wtap_read(), others are just processed internally. Add a Boolean flag to wtapng_block_t, have the routines that read particular block types set it appropriately, and have the read and seek-read routines check that flag rather than checking for the block types that should be returned. Pass a pointer to the wtapng_block_t to packet type plugin read routines, rather than passing it some members of the wtapng_block_t. This means that 1) for new block types, we don't have to update any tests and 2) plugin handlers for block types can indicate whether they processed the block internally and the caller shouldn't see it or 2) the block should be provided to the caller. Bug: 14388 Change-Id: Iccc2031a277f55c7fa8b4f692c776b482b792b4f Reviewed-on: https://code.wireshark.org/review/25609 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-05pcapng_read_block() should just return a Boolean.Guy Harris1-40/+37
It either returns "OK" or "fail", so we might as well make it a Boolean. While we're at it, in pcapng_open(), handle EOF/short read and "invalid file" errors when trying to read the first block differently; for the first of those, we don't need to free *err_info, and this may be a bit safer in case *err_info didn't happen to be set to NULL somewhere along the line. Change-Id: If8135624e3efb7838dceeb28e30e5c8c4b064786 Reviewed-on: https://code.wireshark.org/review/25608 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-05pcapng_read_section_header_block() should just return a Boolean.Guy Harris1-19/+25
It either returns "OK" or "fail", so we might as well make it a Boolean, just as is the case with read routines for other block types. Update some comments while we're at it. Change-Id: I40b378d4e3c3cfb96687298b22a6f8f9f78d9240 Reviewed-on: https://code.wireshark.org/review/25607 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-04Check for read errors by checking for PCAPNG_BLOCK_ERROR.Guy Harris1-4/+4
Check for "is an error" rather than "isn't OK". Change-Id: Ib8f4ac44f70d71ff44658801e01807344032dd60 Reviewed-on: https://code.wireshark.org/review/25603 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-04Don't put knowledge about the "is this pcapng" test in the block-reading code.Guy Harris1-43/+20
Have pcapng_read_section_header_block(), pcapng_read_section_header_block(), and pcapng_read_block() just return errors when they get errors or get a non-SHB block; let pcap_open() turn EOF, short read, and "bad file" into "not a pcapng file" rather than "read error". Change-Id: If018d21ffe3de3fe7eb1f8f2973f80f685c89274 Reviewed-on: https://code.wireshark.org/review/25601 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-04Note that we should show ISBs in the "packet" list.Guy Harris1-1/+20
Change-Id: Id39712f9926f05528e4e6120d0feba7c319b3bb2 Reviewed-on: https://code.wireshark.org/review/25588 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-04Disallow registration of some block type values for plugins.Guy Harris1-0/+54
Don't allow overriding of the block types we support in libwiretap - it won't work anyway, as we check for those types first, and only look for plugins for types we don't support. Don't allow registering for any of the reserved types; if you aren't going to use a local type, you have to get your type registered. We *do* allow registering plugins for types that are registered but that we don't support natively. Change-Id: I2046d297b0503d3a77c83166b07ca226c0b18e82 Reviewed-on: https://code.wireshark.org/review/25583 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-01-20wiretap: use SPDX identifiers (partial work).Dario Lombardo1-13/+1
Change-Id: I28436e003ce7fe31d53e6663f3cc7aca00845e4b Reviewed-on: https://code.wireshark.org/review/25392 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-01-09Use pcapng as the name of the file format.Guy Harris1-25/+25
At one point, I remember a discussion resulting in the official name of the next-generation replacement for pcap format being changed to "pcapng", with no hyphen. Make Wireshark reflect that. Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a Reviewed-on: https://code.wireshark.org/review/25214 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-12-29Do the right check for "no name resolution information to save".Guy Harris1-1/+1
The check that the pcapng code does is "do we have a non-null addrinfo_lists_t * and, if so, does it have a non-null ipv4_addr_list or ipv6_addr_list"? The check that the file-save code was using was just "do we have a non-null addrinfo_lists_t *", so sometimes it'd think we couldn't do a "quick save" even though we had no name resolution information to write out to the capture file. Make a routine that does that check, and use it in *both* places. Change-Id: Id4720f4fe4940354320b2b7621ca5e37e45ec1f3 Reviewed-on: https://code.wireshark.org/review/25055 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-05Allow bigger snapshot lengths for D-Bus captures.Guy Harris1-14/+17
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for them, because that's the largest possible D-Bus message size. See https://bugs.freedesktop.org/show_bug.cgi?id=100220 for an example of the problems caused by limiting the snapshot length to 256KB for D-Bus. Have a snapshot length of 0 in a capture_file structure mean "there is no snapshot length for the file"; we don't need the has_snap field in that case, a value of 0 mean "no, we don't have a snapshot length". In dumpcap, start out with a pipe buffer size of 2KB, and grow it as necessary. When checking for a too-big packet from a pipe, check against the appropriate maximum - 128MB for DLT_DBUS, 256KB for everything else. Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20 Reviewed-on: https://code.wireshark.org/review/21952 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-03Don't keep the pcap/pcapng link-layer header type as interface data.Guy Harris1-8/+11
Either 1) it can be determined from the libwiretap encapsulation type, in which case it's redundant information or 2) there *is* no pcap/pcapng link-layer header type for that encapsulation type, in which case you need to check for the attempt to determine it failing and handle that failure appropriately. Change-Id: Ie9557b513365c1fc8c6df74b9c8239e29aad46bc Reviewed-on: https://code.wireshark.org/review/21924 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-05A bunch of "{Mac} OS X" -> "macOS" changes.Guy Harris1-1/+1
Avoid anachronisms, however; there was no "macOS 10.0" or even "OS X 10.0", for example. It was "Mac OS X" until 10.8 (although 10.7 was sometimes called "OS X" and sometimes called "Mac OS X"), and it was "OS X" from 10.8 to 10.11. Change-Id: Ie4a848997dcc6c45c2245c1fb84ec526032375c3 Reviewed-on: https://code.wireshark.org/review/20933 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-22pcapng: Fix reading OPT_IDB_FCSLEN blockStig Bjørlykke1-8/+8
Changed to use correct option_id when reading IDB. Change-Id: Id3a3b3cd95f9d7bcf51de001cfe246beb98590ad Reviewed-on: https://code.wireshark.org/review/20663 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-28Use wtap_read_bytes() to skip over bytes when reading a record.Guy Harris1-7/+7
Allow file_read() to take a null pointer as a buffer argument; a null argument means "do everything except copy the bytes from the file to the user buffer". That means that wtap_read_bytes() and wtap_read_bytes_or_eof() also support a null pointer as a buffer argument. Use wtap_read_bytes() with a null buffer argument rather than file_skip() to skip forward over data. This fixes some places where files were mis-identified as ERF files, as the ERF open heuristics now get a short "read" error if they try to skip over more bytes than exist in the file. Change-Id: I4f73499d877c1f582e2bcf9b045034880cb09622 Reviewed-on: https://code.wireshark.org/review/17974 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-29pcapng: do not leak blocksPeter Wu1-8/+8
pcapng_open and pcapng_read have 'wblock' allocated on the stack, so if they return, they do not have to set wblock.block to NULL. pcapng_read_block always sets wblock->block to NULL and may initialize it for SHB, IDB, NRB and ISB. Be sure to release the memory for IDB and ISB. It is better to have more wtap_block_free calls on a NULL value than missing them as this would be a memleak (on the other hand, do not release memory that is stored elsewhere such as SHB and NRB). Ping-Bug: 12790 Change-Id: I081f841addb36f16e3671095a919d357f4bc16c5 Reviewed-on: https://code.wireshark.org/review/17362 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-07-21Remove more string option value null checks.Guy Harris1-53/+38
Also, rename routines that write out an option write_wtap_XXb_option() from write_wtap_XXb_block(). Change-Id: I4884a2f5275a5e2e32137b47255fac6995f311ef Reviewed-on: https://code.wireshark.org/review/16566 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-15Do a deep copy in wtap_block_add_custom_option().Guy Harris1-2/+2
That way, we don't have to worry about multiple instances of an option pointing to the same data. and having to worry about freeing data that's pointed to by another instance. Change-Id: I3470a9eebf346023713fd0d6ff2451d727c25089 Reviewed-on: https://code.wireshark.org/review/16471 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-14Redo the block options APIs.Guy Harris1-300/+430
A block can have zero or more instances of a given option. We distinguish between "one instance only" options, where a block can have zero or one instance, and "multiple instances allowed" options, where a block can have zero or more instances. For "one instance only" options: "add" routines add an instance if there isn't one already and fail if there is; "set" routines add an instance if there isn't one already and change the value of the existing instance if there is one; "set nth" routines fail; "get" routines return the value of the instance if there is one and fail if there isn't; "get nth" routines fail. For "multiple instances allowed" options: "add" routines add an instance; "set" routines fail; "set nth" routines set the value of the nth instance if there is one and fail otherwise; "get" routines fail; "get nth" routines get the value if the nth instance if there is one and fail otherwise. Rename "optionblock" to just "block"; it describes the contents of a block, including both mandatory items and options. Add some support for NRB options, including IPv4 and IPv6 option types. Change-Id: Iad184f668626c3d1498b2ed00c7f1672e4abf52e Reviewed-on: https://code.wireshark.org/review/16444 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-07-14pcapng.c: Use preprocessor directive to compare G_BYTE_ORDER with ↵Michael Mann1-1/+5
G_LITTLE_ENDIAN. VS Code analysis considers them hardcoded values so the if statement is either always true or always false. Change-Id: Iabb8462b66f728195bf378ae26c79a783feddb03 Reviewed-on: https://code.wireshark.org/review/16422 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-15More Sysdig / system event support.Gerald Combs1-2/+124
Add REC_TYPE_SYSCALL to wiretap and use it for Sysdig events. Call the Sysdig event dissector from the frame dissector. Create a "syscall" protocol for system calls, but add "frame" items to it for now. Add the ability to write Sysdig events. This lets us merge packet capture and syscall capture files. Change-Id: I12774ec69c89d8e329b6130c67f29aade4e3d778 Reviewed-on: https://code.wireshark.org/review/15078 Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-10More comment clarification.Guy Harris1-2/+4
That's not "the biggest record we're willing to write", it's "the biggest record the pcapng format supports, as the record length is a 16-bit field". Change-Id: Icbd5e0cc4ed8e2a3a0d474245a9b9ed2c999d520 Reviewed-on: https://code.wireshark.org/review/15818 Reviewed-by: Guy Harris <guy@alum.mit.edu> (cherry picked from commit 09de28933f9a17d4472206e1ac4b7c92001e44f5) Reviewed-on: https://code.wireshark.org/review/15820
2016-06-10Make the IPv4 NRB code's comments match the IPv6 NRB code's comments.Guy Harris1-1/+8
The IPv6 comments gave more details. Change-Id: I4e4d865feadbabfd625cdf2b2b162b99c4f23efa Reviewed-on: https://code.wireshark.org/review/15815 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-06-08Support reading in and storing multiple Section Header and Name Resolution ↵Michael Mann1-14/+8
blocks. The data is not applied anywhere, just stored. The first Section Header block is still the only one that is used to read a pcapng file. Change-Id: If9546401101d2fe79b2325bacbd597b92127e86e Reviewed-on: https://code.wireshark.org/review/15705 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-06-06*_stdup_printf -> strdup for "single string only" formatting.Michael Mann1-3/+3
Done for performance improvements. This could probably be done in checkAPIs.pl, but this was just a quick manual check with grepping. Change-Id: I91ff102cb528bb00fa2f65489de53890e7e46f2d Reviewed-on: https://code.wireshark.org/review/15751 Reviewed-by: Michael Mann <mmann78@netscape.net> Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2016-06-01Add data structures necessary to support multiple Name Resolution blocks.Michael Mann1-2/+2
This doesn't try to use any data from multiple Name Resolution blocks, it just converts single Name Resolution block usage into a GArray, so the potential is there to then use/support multiple Name Resolution blocks within a file format (like pcapng) Change-Id: Ib0b584af0bd263f183bd6d31ba18275ab0577d0c Reviewed-on: https://code.wireshark.org/review/15684 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-06-01Add data structures necessary to support multiple Section Header blocks.Michael Mann1-7/+12
This doesn't try to use any data from multiple Section Header blocks, it just converts single Section Header block usage into a GArray, so the potential is there to then use/support multiple Section Header blocks within a file format (like pcapng) Change-Id: I6ad1f7b8daf4b1ad7ba0eb1ecf2e170421505486 Reviewed-on: https://code.wireshark.org/review/15636 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-05-26Remove write capabilities from wtap_optionblocks.Michael Mann1-7/+606
The write functionality was too PCAPNG-specific and the intention is to keep the option blocks as generic as possible. So moved the write functionality back to pcapng.c and added a wtap_opttype API to loop through all options in the block (wtap_optionblock_foreach_option) Change-Id: Iaf49126a1a3e2ed60ae02c52878ca22671dac335 Reviewed-on: https://code.wireshark.org/review/15525 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-05-22Add wtap_optionblock_set_option_string_formatMichael Mann1-11/+11
Also add a length parameter to wtap_optionblock_set_option_string Change-Id: I8c7bbc48aa96b5c2a91ab9a17980928d6894f1ee Reviewed-on: https://code.wireshark.org/review/15505 Reviewed-by: Anthony Coddington <anthony.coddington@endace.com> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-03-28Fix some warnings/errors of typeJoerg Mayer1-2/+11
git/epan/dissectors/packet-a21.c:478:25: error: 'item' was marked unused but was used [-Werror,-Wused-but-marked-unused] proto_item_append_text(item, "%s", val_to_str_const(event_id, a21_event_vals, "Unknown")); ^ Added manual change id because file-jpeg.c forced the use of commit -n Change-Id: Iffff53d6253758c8454d9583f0a11f317c8390cb Reviewed-on: https://code.wireshark.org/review/14666 Reviewed-by: Jörg Mayer <jmayer@loplof.de>
2016-03-06Improve wiretap block capabilities.Michael Mann1-806/+9
Make a more formal method for registering options within a block and do it all with a single function (wtap_optionblock_add_block). Add ability for block to be able to write itself, refactored out of pcapng.c. This was implemented for SHB, ISB, and IDB blocks. Name resolution (NRB), while possible, seemed a little messy for the moment. Change-Id: Ie855c8550c7c7d96cfc188c0cd90bfbc4d5f0ee8 Reviewed-on: https://code.wireshark.org/review/14357 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-03-01Prevent use-after-free issues with pcapng.c/wtap_opttypes.cMichael Mann1-0/+5
Bug: 12173 Change-Id: Ifff28491073d50e088b26847830a3bc8835f4282 Reviewed-on: https://code.wireshark.org/review/14180 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-26Ensure we have a name resolution block when parsing its block type.Michael Mann1-1/+6
Bug: 12174 Change-Id: I82eb0ac75f2e03f15c2f016e9b7ff72fdc7044f5 Reviewed-on: https://code.wireshark.org/review/14179 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-02-25An SHB with a magic of 0x1A2B3C4D isn't necessarily little-endian.Guy Harris1-2/+2
If it's 0x1A2B3C4D, that means it has the same byte order as the instruction set for which Wireshark was built[*]; if it's 0x4D3C2B1A, it means it has the opposite byte order. (We assume no "middle-endian" machines here; it's extremely unlikely that any of this code will ever work on a PDP-11.) Wireshark *does* work on big-endian machines (if there are any places where it doesn't, those are bugs that must be fixed), so we can't assume that "same byte order as our instruction set" means "little-endian". [*]If, for example, you run a PowerPC binary under Rosetta, it'll act as if big-endian is the native byte order, even though it's running on a little-endian machine. Change-Id: Ic438bd85c034f1fba276408ba30214d7078121d1 Reviewed-on: https://code.wireshark.org/review/14133 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-25For SHBs, always use the byte order from the byte-order magic.Guy Harris1-19/+36
Don't use the byte order from any previously-seen SHB, as it might be different. Bug: 12167 Change-Id: I19a81f81f2e8115938387487e2682b8b11a100fe Reviewed-on: https://code.wireshark.org/review/14131 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-25Fix allocation of option bocks in pcapng_read().Guy Harris1-2/+3
We don't need to allocate an WTAP_OPTION_BLOCK_IF_DESCR option block; don't use the value we allocated. We must not allocate an WTAP_OPTION_BLOCK_IF_STATS option block until we need it, as we may have to allocate *more than one* of them here! The old code would reuse the same block, adding it more than once, causing a "freeing already freed data"/"freeing non-allocated data" error on some platforms. Change-Id: I8582627c1f5deecfd4f6490dcdf8c31ee3809d12 Reviewed-on: https://code.wireshark.org/review/14130 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-02-23Making wiretap option blocks more generic.Michael Mann1-342/+323
This was inspired by https://code.wireshark.org/review/9729/, but takes it in a different direction where all options are put into an array, regardless of whether they are "standard" or "custom". It should be easier to add "custom" options in this design. Some, but not all blocks have been converted. Descriptions of some of the block options have been moved from wtap.h to pcapng.h as it seems to be the one that implements the description of the blocks. Also what could be added/refactored is registering block behavior. Change-Id: I3dffa38f0bb088f98749a4f97a3b7655baa4aa6a Reviewed-on: https://code.wireshark.org/review/13667 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-01-16Improve Error messages when failing to load pcapng filesMichael Mann1-20/+23
Include the pcapng block name in every error message to give user a better hint as to where the error is Bug: 8798 Change-Id: Idd80a8541ac37a42b9bd2e988fa8da1ce7bc91a0 Reviewed-on: https://code.wireshark.org/review/13310 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-27pcapng: Fix ISO C forbids conversion [-Wpedantic]João Valverde1-10/+17
pcapng.c:461:31: warning: ISO C forbids passing argument 3 of 'g_hash_table_insert' between function pointer and 'void *' [-Wpedantic] pcapng.c:1404:32: warning: ISO C forbids conversion of object pointer to function pointer type [-Wpedantic] pcapng.c:1918:32: warning: ISO C forbids conversion of object pointer to function pointer type [-Wpedantic] Change-Id: I535633098cc5d37442732dd92e8c9d3cda36631a Reviewed-on: https://code.wireshark.org/review/12161 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-11-17Misc minor issues caught by cppcheckEvan Huus1-1/+0
All trivial (unused variables, duplicate `break`s, etc). Change-Id: Idbfffae4f6c0b0119a90ae5849de2ed7a1180c9b Reviewed-on: https://code.wireshark.org/review/11886 Petri-Dish: Evan Huus <eapache@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Evan Huus <eapache@gmail.com>
2015-11-10Initial Sysdig syscall (event) support.Gerald Combs1-5/+113
Add a dissector for reading Sysdig event blocks. It only handles plain events but it's usable for reading trace files on hand here. Use a script to generate various parts of the dissector. As an experiment, update parts in-place instead of using a template. Ultimately there should probably be a top-level "Syscall" or "Event" dissector alongside the "Frame" dissector, which could then call this. You could then directly compare an executable's system calls alongside its network traffic. For now leverage the pcapng_block dissector and keep everything under "Frame". Next steps: - Items listed at the top of packet-sysdig-event.c. Change-Id: I17077e8d7f40d10a946d61189ebc077d81c4da37 Reviewed-on: https://code.wireshark.org/review/11103 Petri-Dish: Gerald Combs <gerald@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Gerald Combs <gerald@wireshark.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-24 04:26:06 +0000