aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/pcapng.c
AgeCommit message (Collapse)AuthorFilesLines
2019-10-24wiretap: no "drop_count" in pcapng formatMichal Ruprich1-0/+15
When using wiretap to create a pcapng file, the drop_count field from the wtap_packet_header in wiretap/wtap.h is not being dumped to the file in pcapng_write_enhanced_packet_block function. Bug: 16062 Change-Id: Id9b8dbd1f7406e019fab00ff7a4167ab27543f62 Reviewed-on: https://code.wireshark.org/review/34836 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-06-19Fix error message for an unknown pcapng version number.Guy Harris1-1/+1
We were using fields in the pcapng_t that weren't set yet to report the version number in question; use the variables we were checking. Change-Id: Ib03bafe62d8c7b1aa54b2ef22640e3b00722142a Ping-Bug: 15862 Reviewed-on: https://code.wireshark.org/review/33671 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-05-16In pcapng_open(), don't use the local pcapng_t once we know it's a pcapng file.Guy Harris1-1/+1
Use the local one *only* while we're trying to determine whether we have a pcapng file or not; once we know we have a pcapng file, and have allocated a pcapng_t and attached it to the wtap structure, pass *that* one to pcapng_read_block(), so if it changes anything in the pcapng_t, it changes the one we're using. Change-Id: I53b32595276be97957a0b6056171471878fa40c4 Reviewed-on: https://code.wireshark.org/review/33226 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-05-16Keep and use per-interface, not per-file, FCS length information.Guy Harris1-6/+11
There is no FCS length information for a pcapng file; there's FCS length information for each interface. Change-Id: I3abb1a35b28475aa3ad6f126060140d0a524bbca Reviewed-on: https://code.wireshark.org/review/33215 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-05Have wtap_read() fill in a wtap_rec and Buffer.Guy Harris1-6/+7
That makes it - and the routines that implement it - work more like the seek-read routine. Change-Id: I0cace2d0e4c9ebfc21ac98fd1af1ec70f60a240d Reviewed-on: https://code.wireshark.org/review/32727 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-02-13Add macros for the pack_flags field.Guy Harris1-2/+2
Add macros to extract the direction, reception type, and FCS length fields of the pack_flags field, and add definitions for different directions and reception types. Add a macro to construct a pack_flags field value from subfields; this is for use by non-pcapng file readers (the pack_flags field is just a copy of the EPB flags option, so that's not needed for pcapng). Move some #defines for that field from packet-frame.c to wtap.h, and rename them to match the new macros. Use the macros rather than rolling our own code. Fix a variable name in text2pcap.c that apparently had the wrong name, given the value that was being tested. Change-Id: Ia788ca4e9f5fabd8d24e6ead5ff1817509f54827 Reviewed-on: https://code.wireshark.org/review/32010 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-01-25wiretap: fix memleaks with wtap_rec::opt_commentPeter Wu1-0/+3
The memory ownership of wtap_rec::opt_comment was not clear. Users of wtap were leaking memory (editcap.c). wtap readers were not sure about freeing old comments (erf) or simply ignored memleaks (pcapng). To fix this, ensure opt_comment is owned by wtap_rec and free it with wtap_rec_cleanup. The erf issue was already addressed since cf_get_packet_comment properly duplicates wth.opt_comment memory. - wtap file formats (readers): - Should allocate memory for new comments. - Should free a comment from an earlier read before writing a new one. - Users of wth: - Can only assume that opt_comment remains valid until the next read. - Can assume that wtap_dump does not modify the comment. - For random access (wtap_seek_read): should call wtap_rec_cleanup to free the comment. The test_tshark_z_expert_comment and test_text2pcap_sip_pcapng tests now pass when built with ASAN. This change was created by carefully looking at all users opt "opt_comment" and cf_get_packet_comment. Thanks to Vasil Velichkov for an initial patch which helped validating this version. Bug: 7515 Change-Id: If3152d1391e7e0d9860f04f3bc2ec41a1f6cc54b Reviewed-on: https://code.wireshark.org/review/31713 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Vasil Velichkov <vvvelichkov@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-01-24wiretap: fix leak of options_buf and document memory handlingPeter Wu1-1/+5
Manually checked all callers of wtap_seek_read to ensure that wtap_rec_cleanup is called. Added missing wtap_rec_cleanup to: - Completion of sequential read: wtap_sequential_close - Callers of wtap_seek_read: - users of cf_read_record_r: - PacketListRecord::dissect This fixes one of the two ASAN memleak reports while running test_tshark_z_expert_comment and test_text2pcap_sip_pcapng (the other is about opt_comment which is still unfixed). Vasil Velichkov also found this issue and came up with a similar fix. Change-Id: I54a6aa70bfdb42a816d03ad4861d0ad821d0ef88 Reviewed-on: https://code.wireshark.org/review/31709 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-01-18wiretap,file.c: ensure DSBs are reapplied on redissectionPeter Wu1-5/+1
After redissection, the TLS dissector did not remember the DSB secrets anymore. Since the secrets callback is only invoked on the sequential read in wtap, be sure to reapply the existing DSBs to the new session. Bug: 15252 Change-Id: I125f095acb8d577c2439a10e3e65c8b3cfd976b9 Reviewed-on: https://code.wireshark.org/review/31584 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-01-09Clarify the name and description for a link-layer encapsulation type.Guy Harris1-5/+5
What we were calling the "name" is actually a description to show to users; what were calling the "short name" is just the name to use on the command line. Rename some routines and structure members, and put the name first and description second in the table. Expand some descriptions to give more details (e.g., to be more than just a capitalized version of the name). Fix the CamelCase capitalization of InfiniBand. Change-Id: I060b8bd86573880efd0fab044401b449469563eb Reviewed-on: https://code.wireshark.org/review/31472 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-01-04wiretap: fix code according to clang-tidy.Dario Lombardo1-1/+1
Change-Id: I7f539968e9dce3a49112b7aeaa052b8cdb7501a6 Reviewed-on: https://code.wireshark.org/review/31364 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-11-20Add new Secrets API and allow TLS to use pcapng decryption secretsPeter Wu1-0/+6
Add a new secrets API to the core, one that can outlive the lifetime of a single capture file. Expose decryption secrets from wiretap through a callback and let the secrets API route it to a dissector. Bug: 15252 Change-Id: Ie2f1867bdfd265bad11fc58f1e8d8e7295c0d1e7 Reviewed-on: https://code.wireshark.org/review/30705 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-11-20wiretap: add read/write support for Decryption Secrets Block (DSB)Peter Wu1-1/+148
Support reading and writing pcapng files with DSBs. A DSB may occur multiple times but should appear before packets that need those decryption secrets (so it cannot be moved to the end like NRB). The TLS dissector will be updated in the future to make use of these secrets. pcapng spec update: https://github.com/pcapng/pcapng/pull/54 As DSBs may be interleaved with packets, do not even try to read it in pcapng_open (as is done for IDBs). Instead process them during the sequential read, appending them to the 'wtap::dsbs' array. Writing is more complicated, secrets may initially not be available when 'wtap_dumper' is created. As they may become available in 'wtap::dsbs' as more packets are read, allow 'wtap_dumper::dsbs_growing' to reference this array. This saves every user from checking/dumping DSBs. If the wtap user needs to insert extra DSBs (while preserving existing DSBs), they can set the 'wtap_dumper::dsbs_initial' field. The test file was creating using a patched editcap (future patch) and combined using mergecap (which required a change to preserve the DSBs). Change-Id: I74e4ee3171bd852a89ea0f6fbae9e0f65ed6eda9 Ping-Bug: 15252 Reviewed-on: https://code.wireshark.org/review/30692 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-10-01pcapng: Fix a buffer length.Gerald Combs1-0/+1
In pcapng_read_systemd_journal_export_block, increase our buffer length before appending to it. Change-Id: I7e0f695c9bf1a6f80bc7e65661bfd5c70cda7d31 Reviewed-on: https://code.wireshark.org/review/29964 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-10-01Add a systemd Journal Export extcap.Gerald Combs1-3/+3
Add an sdjournal extcap, which reads journal entries using the sd-journal API and dumps them as journal Export Format records. Change-Id: I17ccfa88ab5d053c16c869cd26e580d84022502e Reviewed-on: https://code.wireshark.org/review/29479 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-09-28pcapng: Fix a copy/paste error.Gerald Combs1-2/+0
We shouldn't set any rec_header.syscall_header fields in pcapng_read_systemd_journal_export_block. Change-Id: I920accdbcdcdbf6d71324c8d9d6d562511f6a9d1 Reviewed-on: https://code.wireshark.org/review/29895 Petri-Dish: Gerald Combs <gerald@wireshark.org> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-09-26Make systemd journal entries events.Gerald Combs1-4/+202
Treat systemd journal entries filetype-specific events instead of packets. Add support for reading and writing systemd journal entries to pcapng. Note that pcapng IDBs should be optional. Add support for REC_TYPE_FT_SPECIFIC_EVENT where needed. Change-Id: Ided999b1732108f480c6c75323a0769a9d9ef09f Reviewed-on: https://code.wireshark.org/review/29611 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-09-26Get rid of unnecessary check.Guy Harris1-8/+0
Either pcap_process_pseudo_header() returns -1, in which case we fail, or it returns the exact same value as pcap_get_phdr_size(). If we don't fail, don't bother to check whether the values are the same. Change-Id: I18191cc3de2a1c2144ca9b508ed17b2f593fc835 Reviewed-on: https://code.wireshark.org/review/29879 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-26pcapng: Free option_content on errorGuy Harris1-0/+1
Change-Id: If95c6858370fdff795f5e568d0300fedb1a611ea Reviewed-on: https://code.wireshark.org/review/29874 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-26pcapng: Free option_content on errorStig Bjørlykke1-0/+1
Change-Id: I5a406ecf4e495d0224473d01af4144479ceaf9c3 Reviewed-on: https://code.wireshark.org/review/29863 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2018-09-26Don't update a variable that's not used at that point.Guy Harris1-1/+0
Change-Id: I978caa84f31fa39d4538f73b8c6788c5592b3228 Reviewed-on: https://code.wireshark.org/review/29848 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-25Get rid of unused flag argument.Guy Harris1-2/+0
We always tell pcap_process_pseudo_header() to check to make sure the pseudo-header isn't bigger than the captured data; no need for a flag argument to tell it to do so. Change-Id: I8310bb06a390a7f4a7a232ad140ae07955d52da1 Reviewed-on: https://code.wireshark.org/review/29833 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-19Try to discourage the use of APIs via counting.Gerald Combs1-2/+2
Add the ability to specify maximum function counts for each group to checkAPIs. Add maximum counts for the "termoutput" and "abort" groups where needed. Show summaries in various checkAPI targets. Switch uses of ws_g_warning back to plain g_warning. Change-Id: I5cbddc8c671729e424eed8551f69116d16491976 Reviewed-on: https://code.wireshark.org/review/29721 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2018-09-17Make the maximum block size big enough for max-size D-Bus packets.Guy Harris1-12/+15
Change-Id: I352db07084294629160f16f6cf1e07f902a2844f Reviewed-on: https://code.wireshark.org/review/29711 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-08-11Add support for reading and writing the new if_hardware IDB option.Guy Harris1-0/+13
Support for writing it in live captures will come later; this change, but not that one, will be backported so older versions of Wireshark won't remove it when writing a file out. Change-Id: I9fd4067991acfd2d18c03d0a373ce8337a9f3a76 Reviewed-on: https://code.wireshark.org/review/29064 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-05-14Use ws_g_warning() for plugin registration errors.Guy Harris1-4/+5
Those should always be reported, as they indicate that a block type plugin is trying to do something we don't allow. We should probably have a mechanism by which ws_g_warning() messages are logged to the standard error for command-line programs, logged to an error message window for GUI programs, and logged to some form of system log for daemons. For now, it's a good way to log non-fatal errors that should always be shown in *some* fashion, as well as to mark messages that should be handled in the form described in the previous sentence. Change-Id: Ieedf87fc2dd3184a4466ae69af01f799165c1b70 Reviewed-on: https://code.wireshark.org/review/27519 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-05-14wiretap: use pcapng_debug instead of g_warning.Dario Lombardo1-2/+2
Change-Id: Ibbfe3d1db8b4a7515e7eda194a76d3b0a624542e Reviewed-on: https://code.wireshark.org/review/27383 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Dario Lombardo <lomato@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2018-02-20pcapng: Free option_content on errorStig Bjørlykke1-0/+1
Change-Id: If36b92def61112f8ebe8cfda0edfb63a15c46af0 Reviewed-on: https://code.wireshark.org/review/25925 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2018-02-09Do the maximum block size check in pcap_read_block().Guy Harris1-75/+13
Do it before we even *try* to read the block, so that it's done in one place rather than having to be done in every routine to handle particular block types. The check was missing in the routine to read sysdig event blocks, so if we got a huge sysdig even block we'd try to allocate a huge amount of memory. Bug: 14403 Change-Id: Iff0fb0387e4499420598361be6d241f2832042d7 Reviewed-on: https://code.wireshark.org/review/25702 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Rename ft_specific_data to reflect what we're actually using it for.Guy Harris1-2/+2
It's only being used as a working buffer to hold the raw options data we read in. Change-Id: I17b812e447f575ad92394b9f957658fc655cdf8e Reviewed-on: https://code.wireshark.org/review/25701 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Remove redundant members from wtap_syscall_header.Guy Harris1-8/+7
No need for len, and call caplen event_filelen and move it after event_len. Change-Id: I8b3825d4022ee083ee52f83f7a69f22829ed9fc4 Reviewed-on: https://code.wireshark.org/review/25698 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-09Generalize wtap_pkthdr into a structure for packet and non-packet records.Guy Harris1-132/+133
Separate the stuff that any record could have from the stuff that only particular record types have; put the latter into a union, and put all that into a wtap_rec structure. Add some record-type checks as necessary. Change-Id: Id6b3486858f826fce4b096c59231f463e44bfaa2 Reviewed-on: https://code.wireshark.org/review/25696 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-08replace SPDX identifier GPL-2.0+ with GPL-2.0-or-later.Dario Lombardo1-1/+1
The first is deprecated, as per https://spdx.org/licenses/. Change-Id: I8e21e1d32d09b8b94b93a2dc9fbdde5ffeba6bed Reviewed-on: https://code.wireshark.org/review/25661 Petri-Dish: Anders Broman <a.broman58@gmail.com> Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-07Distinguish between "probably not pcapng" and "probably bad pcapng" errors.Guy Harris1-55/+85
Go back to having pcapng_read_block() and pcapng_read_section_header_block() treating SHB read errors that might be due to the file not being a pcapng file separately from other errors. This keeps us from treating pcapng files with malformed SHBs as not being pcapng files, making us dissect them using the pcapng file dissector rather than reporting the malformation. Change-Id: I1d92cc4ac521668b88638b2b3ed5257340451798 Ping-Bug: 14402 Reviewed-on: https://code.wireshark.org/review/25675 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-05Have block read routines indicate whether the block should be returned.Guy Harris1-37/+61
Some blocks should be returned by wtap_read(), others are just processed internally. Add a Boolean flag to wtapng_block_t, have the routines that read particular block types set it appropriately, and have the read and seek-read routines check that flag rather than checking for the block types that should be returned. Pass a pointer to the wtapng_block_t to packet type plugin read routines, rather than passing it some members of the wtapng_block_t. This means that 1) for new block types, we don't have to update any tests and 2) plugin handlers for block types can indicate whether they processed the block internally and the caller shouldn't see it or 2) the block should be provided to the caller. Bug: 14388 Change-Id: Iccc2031a277f55c7fa8b4f692c776b482b792b4f Reviewed-on: https://code.wireshark.org/review/25609 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-05pcapng_read_block() should just return a Boolean.Guy Harris1-40/+37
It either returns "OK" or "fail", so we might as well make it a Boolean. While we're at it, in pcapng_open(), handle EOF/short read and "invalid file" errors when trying to read the first block differently; for the first of those, we don't need to free *err_info, and this may be a bit safer in case *err_info didn't happen to be set to NULL somewhere along the line. Change-Id: If8135624e3efb7838dceeb28e30e5c8c4b064786 Reviewed-on: https://code.wireshark.org/review/25608 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-05pcapng_read_section_header_block() should just return a Boolean.Guy Harris1-19/+25
It either returns "OK" or "fail", so we might as well make it a Boolean, just as is the case with read routines for other block types. Update some comments while we're at it. Change-Id: I40b378d4e3c3cfb96687298b22a6f8f9f78d9240 Reviewed-on: https://code.wireshark.org/review/25607 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-04Check for read errors by checking for PCAPNG_BLOCK_ERROR.Guy Harris1-4/+4
Check for "is an error" rather than "isn't OK". Change-Id: Ib8f4ac44f70d71ff44658801e01807344032dd60 Reviewed-on: https://code.wireshark.org/review/25603 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-04Don't put knowledge about the "is this pcapng" test in the block-reading code.Guy Harris1-43/+20
Have pcapng_read_section_header_block(), pcapng_read_section_header_block(), and pcapng_read_block() just return errors when they get errors or get a non-SHB block; let pcap_open() turn EOF, short read, and "bad file" into "not a pcapng file" rather than "read error". Change-Id: If018d21ffe3de3fe7eb1f8f2973f80f685c89274 Reviewed-on: https://code.wireshark.org/review/25601 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-04Note that we should show ISBs in the "packet" list.Guy Harris1-1/+20
Change-Id: Id39712f9926f05528e4e6120d0feba7c319b3bb2 Reviewed-on: https://code.wireshark.org/review/25588 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-04Disallow registration of some block type values for plugins.Guy Harris1-0/+54
Don't allow overriding of the block types we support in libwiretap - it won't work anyway, as we check for those types first, and only look for plugins for types we don't support. Don't allow registering for any of the reserved types; if you aren't going to use a local type, you have to get your type registered. We *do* allow registering plugins for types that are registered but that we don't support natively. Change-Id: I2046d297b0503d3a77c83166b07ca226c0b18e82 Reviewed-on: https://code.wireshark.org/review/25583 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-01-20wiretap: use SPDX identifiers (partial work).Dario Lombardo1-13/+1
Change-Id: I28436e003ce7fe31d53e6663f3cc7aca00845e4b Reviewed-on: https://code.wireshark.org/review/25392 Petri-Dish: Dario Lombardo <lomato@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-01-09Use pcapng as the name of the file format.Guy Harris1-25/+25
At one point, I remember a discussion resulting in the official name of the next-generation replacement for pcap format being changed to "pcapng", with no hyphen. Make Wireshark reflect that. Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a Reviewed-on: https://code.wireshark.org/review/25214 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-12-29Do the right check for "no name resolution information to save".Guy Harris1-1/+1
The check that the pcapng code does is "do we have a non-null addrinfo_lists_t * and, if so, does it have a non-null ipv4_addr_list or ipv6_addr_list"? The check that the file-save code was using was just "do we have a non-null addrinfo_lists_t *", so sometimes it'd think we couldn't do a "quick save" even though we had no name resolution information to write out to the capture file. Make a routine that does that check, and use it in *both* places. Change-Id: Id4720f4fe4940354320b2b7621ca5e37e45ec1f3 Reviewed-on: https://code.wireshark.org/review/25055 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-05Allow bigger snapshot lengths for D-Bus captures.Guy Harris1-14/+17
Use WTAP_MAX_PACKET_SIZE_STANDARD, set to 256KB, for everything except for D-Bus captures. Use WTAP_MAX_PACKET_SIZE_DBUS, set to 128MB, for them, because that's the largest possible D-Bus message size. See https://bugs.freedesktop.org/show_bug.cgi?id=100220 for an example of the problems caused by limiting the snapshot length to 256KB for D-Bus. Have a snapshot length of 0 in a capture_file structure mean "there is no snapshot length for the file"; we don't need the has_snap field in that case, a value of 0 mean "no, we don't have a snapshot length". In dumpcap, start out with a pipe buffer size of 2KB, and grow it as necessary. When checking for a too-big packet from a pipe, check against the appropriate maximum - 128MB for DLT_DBUS, 256KB for everything else. Change-Id: Ib2ce7a0cf37b971fbc0318024fd011e18add8b20 Reviewed-on: https://code.wireshark.org/review/21952 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-06-03Don't keep the pcap/pcapng link-layer header type as interface data.Guy Harris1-8/+11
Either 1) it can be determined from the libwiretap encapsulation type, in which case it's redundant information or 2) there *is* no pcap/pcapng link-layer header type for that encapsulation type, in which case you need to check for the attempt to determine it failing and handle that failure appropriately. Change-Id: Ie9557b513365c1fc8c6df74b9c8239e29aad46bc Reviewed-on: https://code.wireshark.org/review/21924 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-04-05A bunch of "{Mac} OS X" -> "macOS" changes.Guy Harris1-1/+1
Avoid anachronisms, however; there was no "macOS 10.0" or even "OS X 10.0", for example. It was "Mac OS X" until 10.8 (although 10.7 was sometimes called "OS X" and sometimes called "Mac OS X"), and it was "OS X" from 10.8 to 10.11. Change-Id: Ie4a848997dcc6c45c2245c1fb84ec526032375c3 Reviewed-on: https://code.wireshark.org/review/20933 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-22pcapng: Fix reading OPT_IDB_FCSLEN blockStig Bjørlykke1-8/+8
Changed to use correct option_id when reading IDB. Change-Id: Id3a3b3cd95f9d7bcf51de001cfe246beb98590ad Reviewed-on: https://code.wireshark.org/review/20663 Petri-Dish: Stig Bjørlykke <stig@bjorlykke.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-09-28Use wtap_read_bytes() to skip over bytes when reading a record.Guy Harris1-7/+7
Allow file_read() to take a null pointer as a buffer argument; a null argument means "do everything except copy the bytes from the file to the user buffer". That means that wtap_read_bytes() and wtap_read_bytes_or_eof() also support a null pointer as a buffer argument. Use wtap_read_bytes() with a null buffer argument rather than file_skip() to skip forward over data. This fixes some places where files were mis-identified as ERF files, as the ERF open heuristics now get a short "read" error if they try to skip over more bytes than exist in the file. Change-Id: I4f73499d877c1f582e2bcf9b045034880cb09622 Reviewed-on: https://code.wireshark.org/review/17974 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-29pcapng: do not leak blocksPeter Wu1-8/+8
pcapng_open and pcapng_read have 'wblock' allocated on the stack, so if they return, they do not have to set wblock.block to NULL. pcapng_read_block always sets wblock->block to NULL and may initialize it for SHB, IDB, NRB and ISB. Be sure to release the memory for IDB and ISB. It is better to have more wtap_block_free calls on a NULL value than missing them as this would be a memleak (on the other hand, do not release memory that is stored elsewhere such as SHB and NRB). Ping-Bug: 12790 Change-Id: I081f841addb36f16e3671095a919d357f4bc16c5 Reviewed-on: https://code.wireshark.org/review/17362 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-21 21:20:49 +0000