aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap/systemd_journal.c
AgeCommit message (Collapse)AuthorFilesLines
2021-12-19Replace g_strdup_printf() with ws_strdup_printf()João Valverde1-2/+2
Use macros from inttypes.h.
2021-08-29wiretap: always allocate a block for a record.Guy Harris1-0/+1
Without that, you could add a comment to a record in a file format the reading code for which doesn't allocate blocks, but the comment doesn't get saved, as there's no block in which to save the comment option. This simplifies some code paths, as we're either using the record's modified block or we're using the block as read from the file, there's no third possibility. If we attempt to read a record, and we get an error, and a block was allocated for the record, unreference it, so the individual file readers don't have to worry about it.
2021-06-17Make various names match the name of the systemd journal export block.Guy Harris1-3/+3
The name of the block, in the pcapng specification is the systemd Journal Export Block; add "export" after "journal" in various variable/enum/define names.
2021-02-24wiretap: add a block type for systemd journal entries.Guy Harris1-2/+2
Those are used by more than one file type, so we should provide a block type for them. (We don't *currently* use that block type, or the packet block type, but this makes them available for future use.)
2021-02-23wiretap: rename wtap_register_file_type_subtypes().Guy Harris1-1/+1
It only registers one file type/subtype, so rename it to wtap_register_file_type_subtype(). That will also force plugins to be recompiled; that will produce compile errors for some plugins that didn't change to match the new contents of the file_type_subtype_info structure. Also check to make sure that the registered file type/subtype supports at least one type of block; a file type/subtype that doesn't return *any* blocks and doesn't permit *any* block types to be written is not very useful. That should also catch most if not all other plugins that didn't change to match the new contents of the file_type_subtype_info structure. Don't make errors registering a file type/subtype fatal; just complain, don't register the bogus file type/subtype, and drive on.
2021-02-21wiretap: have file handlers advertise blocks and options supported.Guy Harris1-1/+8
Instead of a "supports name resolution" Boolean and bitflags for types of comments supported, provide a list of block types that the file type/subtype supports, with each block type having a list of options supported. Indicate whether "supported" means "one instance" or "multiple instances". "Supports" doesn't just mean "can be written", it also means "could be read". Rename WTAP_BLOCK_IF_DESCRIPTION to WTAP_BLOCK_IF_ID_AND_INFO, to indicate that it provides, in addition to information about the interface, an ID (implicitly, in pcapng files, by its ordinal number) that is associated with every packet in the file. Emphasize that in comments - just because your capture file format can list the interfaces on which a capture was done, that doesn't mean it supports this; it doesn't do so if the file doesn't indicate, for every packet, on which of those interfaces it was captured (I'm looking at *you*, Microsoft Network Monitor...). Use APIs to query that information to do what the "does this file type/subtype support name resolution information", "does this file type/subtype support all of these comment types", and "does this file type/subtype support - and require - interface IDs" APIs did. Provide backwards compatibility for Lua. This allows us to eliminate the WTAP_FILE_TYPE_SUBTYPE_ values for IBM's iptrace; do so.
2021-02-19wiretap: eliminate two WTAP_FILE_TYPE_SUBTYPE_ values.Guy Harris1-1/+23
Eliminate WTAP_FILE_TYPE_SUBTYPE_ERF and WTAP_FILE_TYPE_SUBTYPE_SYSTEMD_JOURNAL - instead, fetch the values by name, using wtap_name_to_file_type_subtype(). This requires that wtap_init() be called before epan_init(); that's currently the case, but put in comments to indicate why it must continue to be the case.
2020-10-27Add a new record type REC_TYPE_SYSTEMD_JOURNAL.Guy Harris1-3/+2
Systemd journal entries aren't file-type-specific; they're found in both systemd journal entry blocks in pcapng files and in systemd journal export files. Give it a record type, for use with both file types. This fixes #16955. It also means that you can open a systemd journal export file and save it as a pcapng file.
2020-08-03wiretap: Adjust the pcapng systemd Journal length check.Gerald Combs1-0/+5
Reduce the minimum systemd journal block size from 212 to 35. The larger minimum was based on the Journal Export Format file reader, but we don't need to be as strict here. Update some comments. Bug: 16734 Change-Id: Iad7227f29ff22f908e2fd49be0f11c9ad03fa7b9 Reviewed-on: https://code.wireshark.org/review/38035 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2020-07-29wiretap: generate fake IDBs for more capture file types.Guy Harris1-0/+9
That makes them work as input to a mergecap that writes pcapng files. File types that don't have a single per-file encapsulation type need more work, with multiple fake IDBs, one for each packet encapsulation type seen in the file, unless we can generate real IDBs. Change-Id: I2859e4f7fb15ec0c0f31a4044dc15638e5db7826 Reviewed-on: https://code.wireshark.org/review/37983 Petri-Dish: Guy Harris <gharris@sonic.net> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <gharris@sonic.net>
2019-07-26HTTPS (almost) everywhere.Guy Harris1-1/+1
Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-04-05Have wtap_read() fill in a wtap_rec and Buffer.Guy Harris1-5/+5
That makes it - and the routines that implement it - work more like the seek-read routine. Change-Id: I0cace2d0e4c9ebfc21ac98fd1af1ec70f60a240d Reviewed-on: https://code.wireshark.org/review/32727 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-09-26Make systemd journal entries events.Gerald Combs1-16/+13
Treat systemd journal entries filetype-specific events instead of packets. Add support for reading and writing systemd journal entries to pcapng. Note that pcapng IDBs should be optional. Add support for REC_TYPE_FT_SPECIFIC_EVENT where needed. Change-Id: Ided999b1732108f480c6c75323a0769a9d9ef09f Reviewed-on: https://code.wireshark.org/review/29611 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-09-07systemd Journal: Add a cast.Gerald Combs1-1/+1
Fixes compilation on 32-bit Windows. Change-Id: I03241d305569c1719f100950bbcabee01b6f192c Reviewed-on: https://code.wireshark.org/review/29475 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-08-31Add a systemd Journal Export Format parser and dissector.Gerald Combs1-0/+236
Add a file parser and dissector that can handle the output of `journalctl -o export`. From here we can add a systemd journal extcap and possibly support for the JSON and binary formats. Change-Id: I01576959b2c347ce7ac9aa57cdb5c119c81d61e9 Reviewed-on: https://code.wireshark.org/review/29311 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-03 05:15:00 +0000