aboutsummaryrefslogtreecommitdiffstats
path: root/wiretap
AgeCommit message (Collapse)AuthorFilesLines
2014-12-19Get rid of some accidentally-checked-in debugging stuff.Guy Harris1-1/+1
Change-Id: Iea54df783cdff2424d23ecfba8f219dae42d0c83 Reviewed-on: https://code.wireshark.org/review/5888 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-18Bluetooth: Add generic Bluetooth dissectorMichal Labedzki2-4/+6
Bluetooth dissector is used to add ability to filter all bluetooth payload from capture files (there are many transport like: hci_h4, hci_h1, hci_usb, hci_mon, btle). Also it is used to placeholder for all data tree used to store additional informations like bd_addrs, names, etc. Finally it is used to be one point for Bluetooth Endpoints/Conversation filtering what is enabled now. Also add Master/Slave Role and Connection Mode tracking. Change-Id: I67048080fb8ee16fa0f4ec429c1257de81ddd737 Reviewed-on: https://code.wireshark.org/review/5771 Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2014-12-18Make sure err_info is always set, and print it iff it's non-null.Guy Harris2-0/+7
Change-Id: Ib5c600c491a3d8adcfa91c00fa9445283610545b Reviewed-on: https://code.wireshark.org/review/5830 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-18Rename WTAP_ERR_REC_TYPE_UNSUPPORTED to WTAP_ERR_UNWRITABLE_REC_TYPE.Guy Harris22-25/+25
That indicates that it's a problem specific to *writing* capture files; we've already converted some errors to that style, and added a new one in that style. Change-Id: I8268316fd8b1a9e301bf09ae970b4b1fbcb35c9d Reviewed-on: https://code.wireshark.org/review/5826 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-18Handle "I can't map this for that file format" better.Guy Harris25-48/+63
For cases where record (meta)data is something that can't be written out in a particular file format, return WTAP_ERR_UNWRITABLE_REC_DATA along with an err_info string. Report (and free) that err_info string in cases where WTAP_ERR_UNWRITABLE_REC_DATA is returned. Clean up some other error reporting cases, and flag with an XXX some cases where we aren't reporting errors at all, while we're at it. Change-Id: I91d02093af0d42c24ec4634c2c773b30f3d39ab3 Reviewed-on: https://code.wireshark.org/review/5823 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17Rename WTAP_ERR_UNSUPPORTED_FILE_TYPE to WTAP_ERR_UNWRITABLE_FILE_TYPE.Guy Harris10-17/+17
That makes it clearer what the problem is, and that it should only be returned by the dump code path, not by the read code path. Change-Id: I22d407efe3ae9fba7aa25f08f050317549866442 Reviewed-on: https://code.wireshark.org/review/5798 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17Rename WTAP_ERR_UNSUPPORTED_ENCAP to WTAP_ERR_UNWRITABLE_ENCAP.Guy Harris23-39/+39
That makes it clearer what the problem is, and that it should only be returned by the dump code path, not by the read code path. Change-Id: Icc5c9cff43be6c073f0467607555fa7138c5d074 Reviewed-on: https://code.wireshark.org/review/5797 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17Use WTAP_ERR_UNSUPPORTED for input file stuff we can't handle.Guy Harris14-30/+30
WTAP_ERR_UNSUPPORTED_ENCAP means "I can't *write* that particular encapsulation type to a file of this format", which mainly means "that file format simply can't handle packets of that type"; WTAP_ERR_UNSUPPORTED means "this file can't currently be supported by Wireshark, as there's some feature in the file - such as a file or per-packet encapsulation type - that we don't (yet) handle". Change-Id: I53cadf9913d20efb2bccb29f61877b71d53807be Reviewed-on: https://code.wireshark.org/review/5794 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-17Clean up handling of files without a known encapsulation.Guy Harris1-16/+24
Fail with an "unsupported encapsulation" error for MTP2 and SSCOP, rather than just returning "unknown encapsulation", and fail with that if the encapsulation isn't filled in as well, although that might be a deeper problem. (Not that people should be handing text output files from K12 analyzers anyway - they should hand us RF5 files and, if we can't handle their file, file a bug and give us the file so we can further reverse-engineer the format.) Change-Id: I6bbd5f81787d69bd3b41eaedf2893d179f11ad6a Reviewed-on: https://code.wireshark.org/review/5792 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-09Nothing to free there.Guy Harris1-1/+0
pcapng_read_block() never sets *err_info if it returns PCAPNG_BLOCK_NOT_SHB - that happens on an EOF, a short read, or on a successful read of something that doesn't look like an SHB. Change-Id: I23ad6aa1c95d800b068a798a4aad1d70d07ac281 Reviewed-on: https://code.wireshark.org/review/5686 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-09Don't try to look in a non-existent hash table.Guy Harris1-3/+3
We only create hash tables if somebody puts a handler in one, so we need to check whether the hash table exists first, to avoid run-time warnings. Change-Id: I739d2d808935e651b11bd44b258f168a42ca4b7c Reviewed-on: https://code.wireshark.org/review/5683 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-08Use correct expression in a "length too short" message.Guy Harris1-1/+1
Doesn't change the behavior of the code, but makes it more consistent. Change-Id: I6f07fbbb4c7d14d8a46ecfd1c419d951c356fd77 Reviewed-on: https://code.wireshark.org/review/5672 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-07Add checks for non-null-terminated strings.Guy Harris1-6/+14
Change-Id: Iaad2d2f76e5d554800ba2c79d5c01f4b9da6fa0b Reviewed-on: https://code.wireshark.org/review/5660 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-06Don't go past the end of the "extra data".Guy Harris1-69/+69
The "extra data", according to the RF5 API manual I have, is "hardware parameters", so change some names. Report an error if the variable parts of the configuration event record run past the record length. Report an error if the hardware parameters are too short. For the purportedly DS0 hardware parameters, don't assume they'll be long enough for the mask; they might not be. Change-Id: Ib63d042e4ede32216fb474c4ecdba84db1387abc Reviewed-on: https://code.wireshark.org/review/5638 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-05Fix some copy-and-pasteos in error messages.Guy Harris1-3/+3
Change-Id: I1fe3434e69a08aae3d7413067275b3d7ee1552f5 Reviewed-on: https://code.wireshark.org/review/5634 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-01Squelch another compiler warning.Guy Harris1-1/+1
Change-Id: Ib79bb30e67dacdda2e87f39438c4a836632d55bd Reviewed-on: https://code.wireshark.org/review/5552 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-01Squelch a compiler warning.Guy Harris1-2/+4
Change-Id: Ic904f9b8551353192e872cb896f198572da83e27 Reviewed-on: https://code.wireshark.org/review/5551 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-12-01Add a Buffer to wtap_pkthdr to hold file-type-specific packet metadata.Guy Harris4-58/+211
For example, this can be used for pcap-ng options not mapped to file-type-independent metadata values. Change-Id: I398b324c62c1cc1cc61eb5e9631de00481b4aadc Reviewed-on: https://code.wireshark.org/review/5549 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-11-30Change some names to make them the same in multiple lists.Guy Harris1-2/+2
Change-Id: I20ca39f69052b4134147577ae5be74c05b4d5e48 Reviewed-on: https://code.wireshark.org/review/5543 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-11-27Note that this document is a bit old.Guy Harris1-0/+5
Change-Id: Ie9a45acf1d3bc116d73b6430b058ffdcabead42b Reviewed-on: https://code.wireshark.org/review/5514 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-11-21Fix for very big pid and tid numbers in logcat_textMichał Orynicz1-1/+1
There can be no space after pid colon if tid is big enough in logcat long format. Change-Id: I8e03e78c88e4bef1a5fdb3a04b77f58fa7d055bc Reviewed-on: https://code.wireshark.org/review/5411 Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2014-11-21Move text logcat regex strings to shared headerMichał Orynicz2-10/+9
To avoid further duplication of work and bugfixing, move regex strings to wiretap/logcat_text.h and include this file in epan/dissectors/packet-logcat-text.c Change-Id: I82773cda0e3240844139b104c68738ec82788014 Reviewed-on: https://code.wireshark.org/review/5410 Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2014-11-20Fix text logcat for changes in android LMichał Orynicz1-1/+1
In L, in line "-- beginning of /<buffer>" the "/" was removed. This commit accomodates text logcat to that change. Change-Id: I4cbfadf5a8169589f2848ce1a5793cea593ba459 Reviewed-on: https://code.wireshark.org/review/5405 Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>
2014-11-19Wiretap: Added file_seek SEEK_END support.Stig Bjørlykke1-4/+13
This is needed for Lua File:seek("end"). Change-Id: I28fb23f2f29ca8083c77bf065db8816e039ae5a1 Reviewed-on: https://code.wireshark.org/review/4722 Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com> Tested-by: Michal Labedzki <michal.labedzki@tieto.com> Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
2014-11-02Fix typo: Intrustion -> IntrusionBalint Reczey1-1/+1
Change-Id: Iea95556a4d77ff54d46a505903e50134f51d563a Reviewed-on: https://code.wireshark.org/review/5082 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-10-30Dataflow analysis is hard, let's go shopping!Guy Harris1-0/+2
Another case where the compiler didn't figure out that the variables aren't used if they're not set. Change-Id: I70bfb06c6d86d41a266a087ece971c40cd697ee9 Reviewed-on: https://code.wireshark.org/review/4994 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Squelch some used-but-not-set warnings (one legitimate, others not).Guy Harris1-6/+6
Also, we don't care how much tagged value data we've read, we just care whether we've read any or not (EOF reading the first one means "end of file", EOF reading any of the subsequent ones means "short read"). Change-Id: I2edc54494967b3a88bcc2c79d97eedfded00150d Reviewed-on: https://code.wireshark.org/review/4993 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Use correct variable.Guy Harris1-1/+1
To check whether data_rate_or_mcs_index is set, check saw_data_rate_or_mcs_index; we might see a value of 0 for that field (it's a valid MCS index), so we can't use it as an out-of-band value meaning "not set". Change-Id: I75d7fdb4a90836538c82f56f2afb05c0603278a5 Reviewed-on: https://code.wireshark.org/review/4991 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Extract the center frequency from Peek tagged files.Guy Harris1-0/+2
Change-Id: I44bc278f563264ca20f0250fc3376b6741bdcbfa Reviewed-on: https://code.wireshark.org/review/4990 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Support the bandwidth and "short GI" fields from Peek tagged files.Guy Harris2-8/+76
Add a number of fields corresponding to components of the radiotap MCS field, add presence bits for them, and set and dissect the fields supported by Peek tagged files. Change-Id: I3fc801a3bc180e1c174d074a794af0f3d338f249 Reviewed-on: https://code.wireshark.org/review/4989 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-30Handle the MCS index in Peek tagged files.Guy Harris2-40/+51
Use the "MCS index used" extended flag bit to indicate whether the "data rate or MCS index" field is a data rate or MCS index. Display the MCS index value if it's present. (More to come - MCS indices, plus other information, should be used to calculate the data rate for 11n and beyond.) Get rid of the hdr_info_t structure while we're at it; just use local variables for each of the fields. Change-Id: I546f53a8ebd89078d5f23e1290557b97348aff38 Reviewed-on: https://code.wireshark.org/review/4988 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-29Expand the 802.11 pseudo-header and support new radio metadata.Guy Harris9-29/+139
Add a set of presence bits, so we can indicate which bits of radio metadata we do and don't have. Fill in more radio metadata from capture files, and display it. (More to come.) Change-Id: Idea2c05442c74af17c14c4d5a8d8025ab27fbd15 Reviewed-on: https://code.wireshark.org/review/4987 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-28Add a comment showing mapping to radiotap.Guy Harris1-0/+55
Useful if we try to provide some "standard" 802.11 metadata header that can support both radiotap and Peek tagged (and perhaps others). Change-Id: Ibac9829e3411670a439db7cb77e1694a5641b0a5 Reviewed-on: https://code.wireshark.org/review/4970 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-28Some additional information from bug 10637.Guy Harris1-9/+45
That bug includes a capture and a screendump of OmniPeek's dissection of the packet in that capture; this lets us identify some tags as the center frequency of the 802.11 channel and a set of extended flags used for 802.11n and 802.11ac. Show some flags from bug 9586, under the assumption that certain fields in the Peek tagged header correspond to certain fields in the remote Peek protocol. Change-Id: I0f3c2e6638d6cf5f6ec470d65bd574171a2d958d Reviewed-on: https://code.wireshark.org/review/4969 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-25Expand comments.Guy Harris1-6/+52
Change-Id: I92348f98cd04ff0e7fc05e472075315ca0fd260e Reviewed-on: https://code.wireshark.org/review/4931 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-25Get rid of a trailing blank.Guy Harris1-1/+1
Change-Id: I7963f05a78ec764a21d388fcdba618ffbcf935e4 Reviewed-on: https://code.wireshark.org/review/4930 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-25Update a comment.Guy Harris1-7/+6
Change-Id: I55002477a416710592a482725af68cdf2511e063 Reviewed-on: https://code.wireshark.org/review/4929 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-19PCAPNG (wiretap): Fix Dead Store (Dead assignement/Dead increment) warning ↵Alexis La Goutte1-5/+0
found by Clang Change-Id: I6337fe88bbfd76161abc3b51c70402e7e63a435e Reviewed-on: https://code.wireshark.org/review/4813 Reviewed-by: Evan Huus <eapache@gmail.com>
2014-10-17Get rid of unused includes of <ctype.h>.Guy Harris2-2/+0
Change-Id: Iab9eaeb0f5765748b2582177396264e4e69bc6d1 Reviewed-on: https://code.wireshark.org/review/4786 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-17Don't use ctype.h routines.Guy Harris8-47/+39
That avoids locale dependency and handles possibly-signed chars (which we weren't doing before). Change-Id: I70f3d993c9a8fbf870901f12b430d733968c3fa8 Reviewed-on: https://code.wireshark.org/review/4781 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-16Don't try to compute time stamps for files from Packet Builder.Guy Harris1-8/+18
I don't trust Packet Builder's ability to convert time stamps between Capsa format and pcap. Change-Id: I0ac2e14216e37127d81d5bf1c6d48a2c20841a8e Reviewed-on: https://code.wireshark.org/review/4721 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-16Fix a debugging printout.Guy Harris1-2/+2
Change-Id: I06bc40bece3ea98578a252217c9de4748276a440 Reviewed-on: https://code.wireshark.org/review/4720 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-16Get rid of some set-but-no-longer-used variables.Guy Harris1-6/+0
Change-Id: Iaf7267b6ee3d4ab288c8ffa487f5de736bc4aead Reviewed-on: https://code.wireshark.org/review/4719 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-16Make sure *err and *err_info are set when returning PCAPNG_BLOCK_NOT_SHB.Guy Harris1-5/+7
Clean up a comment and indentation while we're at it. Change-Id: Ia2b0a3f642849dcd464e04cdca13ff05c2fbe2e6 Reviewed-on: https://code.wireshark.org/review/4717 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-16The record offset block begins with a 1-byte(!) header.Guy Harris1-21/+19
Clean up the code to read the block according to that description. Change-Id: Icb332e293c4b41d91989aa17a7546f298068e908 Reviewed-on: https://code.wireshark.org/review/4716 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-16Get rid of another unused variable.Guy Harris1-2/+0
Change-Id: Id3e9bdd9308342460f84b5d4aeb13e9d6d52616c Reviewed-on: https://code.wireshark.org/review/4715 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-15Don't allocate the interfaces array until we've read the SHB.Guy Harris1-5/+4
Nothing from the SHB gets stored in the interfaces array - it's filled in from IDBs - so it doesn't need to exist when we read the first SHB, and thus doesn't need to be freed if the attempt to read the SHB gets an error or a "this isn't a pcap-ng file" indication. Update a comment while we're at it. Change-Id: Ie67edb52dcf13c974607e95e290661bf48be68ae Reviewed-on: https://code.wireshark.org/review/4711 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-15Clean up the read routines.Guy Harris1-191/+201
The block read routines don't need to return a "bytes read" amount any more. Have pcapng_read_block() just return an indication: PCAPNG_BLOCK_OK - the read succeeded; PCAPNG_BLOCK_NOT_SHB - the read failed in a fashion that indicates that we might just not be reading a pcap-ng file; PCAPNG_BLOCK_ERROR - the read failed in some other fashion (i.e., we already have concluded that the file is a pcap-ng file, or we got an I/O error). In the cases where it needs to know whether it's reading the first block for an open, have it check the shb_read flag, rather than being passed a separate Boolean argument. This means that pcapng_read_section_header_block() should return such an indication as well. Make the other block-reading routines return a Boolean success/failure indication. Change-Id: Id371457018a008ece9058d6042da44d631e51889 Reviewed-on: https://code.wireshark.org/review/4710 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-14We can't check the length of an SHB until we determine the byte order.Guy Harris1-16/+16
Don't check a possibly-byte-swapped length against the minimum SHB size; it'll probably look huge if it's byte-swapped, so the test won't fail even if it is too small, and a really huge SHB's length could look too small if it's byte-swapped. Do the check *after* we've read the fixed-length portion of the block; yes, that means we've read past the purported size of the block at that point, but if that read succeeds, that doesn't matter, and if that read fails, it just means we'll report "file cut short" rather than "bad SHB length", *both* of which are problems with the file. Change-Id: Ie3b5700662f2a6da40d373a84f00a8fc2cf0ce1b Reviewed-on: https://code.wireshark.org/review/4692 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-10-14Don't assume pcap_read_block() returns the number of bytes read.Guy Harris1-9/+2
Recent changes must have made it not do so in some cases, and our current version of file_tell(), unlike ftell() around which the older file_tell() was a wrapper, is known to be cheap (ftell() would make a system call to get the position). Just use file_tell() before each read. (Further cleanup is called for.) Bug: 10568 Change-Id: Ib92057b2b87ec6eb16fd612bc91baeb668d1e1c7 Reviewed-on: https://code.wireshark.org/review/4691 Reviewed-by: Guy Harris <guy@alum.mit.edu>
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-24 23:42:07 +0000