2 * Definitions for file structures and routines
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998 Gerald Combs
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version 2
11 * of the License, or (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
26 #include "wiretap/wtap.h"
28 #include <epan/epan.h>
30 #include <epan/print.h>
31 #include <ui/packet_range.h>
35 #endif /* __cplusplus */
37 /** Return values from functions that only can succeed or fail. */
39 CF_OK, /**< operation succeeded */
40 CF_ERROR /**< operation got an error (function may provide err with details) */
43 /** Return values from functions that read capture files. */
45 CF_READ_OK, /**< operation succeeded */
46 CF_READ_ERROR, /**< operation got an error (function may provide err with details) */
47 CF_READ_ABORTED /**< operation aborted by user */
50 /** Return values from functions that write out packets. */
52 CF_WRITE_OK, /**< operation succeeded */
53 CF_WRITE_ERROR, /**< operation got an error (function may provide err with details) */
54 CF_WRITE_ABORTED /**< operation aborted by user */
57 /** Return values from functions that print sets of packets. */
59 CF_PRINT_OK, /**< print operation succeeded */
60 CF_PRINT_OPEN_ERROR, /**< print operation failed while opening printer */
61 CF_PRINT_WRITE_ERROR /**< print operation failed while writing to the printer */
68 cf_cb_file_read_started,
69 cf_cb_file_read_finished,
70 cf_cb_file_reload_started,
71 cf_cb_file_reload_finished,
72 cf_cb_file_rescan_started,
73 cf_cb_file_rescan_finished,
74 cf_cb_file_retap_started,
75 cf_cb_file_retap_finished,
76 cf_cb_file_merge_started, /* Qt only */
77 cf_cb_file_merge_finished, /* Qt only */
78 cf_cb_file_fast_save_finished, /* GTK+ only? */
79 cf_cb_packet_selected, /* GTK+ only. */
80 cf_cb_packet_unselected, /* GTK+ only. */
81 cf_cb_field_unselected, /* GTK+ only. */
82 cf_cb_file_save_started,
83 cf_cb_file_save_finished,
84 cf_cb_file_save_failed,
85 cf_cb_file_save_stopped,
86 cf_cb_file_export_specified_packets_started, /* GTK+ only. */
87 cf_cb_file_export_specified_packets_finished, /* GTK+ only. */
88 cf_cb_file_export_specified_packets_failed, /* GTK+ only. */
89 cf_cb_file_export_specified_packets_stopped /* GTK+ only. */
92 typedef void (*cf_callback_t) (gint event, gpointer data, gpointer user_data);
98 gboolean frame_matched;
103 * Add a capture file event callback.
105 * @param func The function to be called for each event.
106 * The function will be passed three parameters: The event type (event),
107 * event-dependent data (data), and user-supplied data (user_data).
108 * Event-dependent data may be a capture_file pointer, character pointer,
110 * @param user_data User-supplied data to pass to the callback. May be NULL.
114 cf_callback_add(cf_callback_t func, gpointer user_data);
117 * Remove a capture file event callback.
119 * @param func The function to be removed.
120 * @param user_data User-supplied data. Must be the same value supplied to cf_callback_add.
124 cf_callback_remove(cf_callback_t func, gpointer user_data);
127 * Open a capture file.
129 * @param cf the capture file to be opened
130 * @param fname the filename to be opened
131 * @param type WTAP_TYPE_AUTO for automatic or index to direct open routine
132 * @param is_tempfile is this a temporary file?
133 * @param err error code
134 * @return one of cf_status_t
136 cf_status_t cf_open(capture_file *cf, const char *fname, unsigned int type, gboolean is_tempfile, int *err);
139 * Close a capture file.
141 * @param cf the capture file to be closed
143 void cf_close(capture_file *cf);
146 * Reload a capture file.
148 * @param cf the capture file to be reloaded
150 void cf_reload(capture_file *cf);
153 * Read all packets of a capture file into the internal structures.
155 * @param cf the capture file to be read
156 * @param from_save reread asked from cf_save_records
157 * @return one of cf_read_status_t
159 cf_read_status_t cf_read(capture_file *cf, gboolean from_save);
162 * Read the metadata and raw data for a record. It will pop
163 * up an alert box if there's an error.
165 * @param cf the capture file from which to read the record
166 * @param fdata the frame_data structure for the record in question
167 * @param phdr pointer to a wtap_pkthdr structure to contain the
169 * @param buf a Buffer into which to read the record's raw data
170 * @return TRUE if the read succeeded, FALSE if there was an error
172 gboolean cf_read_record_r(capture_file *cf, const frame_data *fdata,
173 struct wtap_pkthdr *phdr, Buffer *buf);
176 * Read the metadata and raw data for a record into a
177 * capture_file structure's phdr and buf members.
178 * It will pop up an alert box if there's an error.
180 * @param cf the capture file from which to read the record
181 * @param fdata the frame_data structure for the record in question
182 * @return TRUE if the read succeeded, FALSE if there was an error
184 gboolean cf_read_record(capture_file *cf, frame_data *fdata);
187 * Read packets from the "end" of a capture file.
189 * @param cf the capture file to be read from
190 * @param to_read the number of packets to read
191 * @param err the error code, if an error had occurred
192 * @return one of cf_read_status_t
194 cf_read_status_t cf_continue_tail(capture_file *cf, volatile int to_read, int *err);
197 * Fake reading packets from the "end" of a capture file.
199 * @param cf the capture file to be read from
201 void cf_fake_continue_tail(capture_file *cf);
204 * Finish reading from "end" of a capture file.
206 * @param cf the capture file to be read from
207 * @param err the error code, if an error had occurred
208 * @return one of cf_read_status_t
210 cf_read_status_t cf_finish_tail(capture_file *cf, int *err);
213 * Determine whether this capture file (or a range of it) can be written
214 * in any format using Wiretap rather than by copying the raw data.
216 * @param cf the capture file to check
217 * @return TRUE if it can be written, FALSE if it can't
219 gboolean cf_can_write_with_wiretap(capture_file *cf);
222 * Determine whether this capture file can be saved with a "save" operation;
223 * if there's nothing unsaved, it can't.
225 * @param cf the capture file to check
226 * @return TRUE if it can be saved, FALSE if it can't
228 gboolean cf_can_save(capture_file *cf);
231 * Determine whether this capture file can be saved with a "save as" operation.
233 * @param cf the capture file to check
234 * @return TRUE if it can be saved, FALSE if it can't
236 gboolean cf_can_save_as(capture_file *cf);
239 * Determine whether this capture file has unsaved data.
241 * @param cf the capture file to check
242 * @return TRUE if it has unsaved data, FALSE if it doesn't
244 gboolean cf_has_unsaved_data(capture_file *cf);
247 * Save all packets in a capture file to a new file, and, if that succeeds,
248 * make that file the current capture file. If there's already a file with
249 * that name, do a "safe save", writing to a temporary file in the same
250 * directory and, if the write succeeds, renaming the new file on top of the
251 * old file, so that if the write fails, the old file is still intact.
253 * @param cf the capture file to save to
254 * @param fname the filename to save to
255 * @param save_format the format of the file to save (libpcap, ...)
256 * @param compressed whether to gzip compress the file
257 * @param discard_comments TRUE if we should discard comments if the save
258 * succeeds (because we saved in a format that doesn't support
260 * @param dont_reopen TRUE if it shouldn't reopen and make that file the
261 * current capture file
262 * @return one of cf_write_status_t
264 cf_write_status_t cf_save_records(capture_file * cf, const char *fname,
265 guint save_format, gboolean compressed,
266 gboolean discard_comments,
267 gboolean dont_reopen);
270 * Export some or all packets from a capture file to a new file. If there's
271 * already a file with that name, do a "safe save", writing to a temporary
272 * file in the same directory and, if the write succeeds, renaming the new
273 * file on top of the old file, so that if the write fails, the old file is
276 * @param cf the capture file to write to
277 * @param fname the filename to write to
278 * @param range the range of packets to write
279 * @param save_format the format of the file to write (libpcap, ...)
280 * @param compressed whether to gzip compress the file
281 * @return one of cf_write_status_t
283 cf_write_status_t cf_export_specified_packets(capture_file *cf,
285 packet_range_t *range,
287 gboolean compressed);
290 * Get a displayable name of the capture file.
292 * @param cf the capture file
293 * @return the displayable name (must be g_free'd)
295 gchar *cf_get_display_name(capture_file *cf);
298 * Set the source of the capture data for temporary files, e.g.
299 * "Interface eth0" or "Pipe from Pong"
301 * @param cf the capture file
302 * @param source the source description. this will be copied internally.
304 void cf_set_tempfile_source(capture_file *cf, gchar *source);
307 * Get the source of the capture data for temporary files. Guaranteed to
308 * return a non-null value. The returned value should not be freed.
310 * @param cf the capture file
312 const gchar *cf_get_tempfile_source(capture_file *cf);
315 * Get the number of packets in the capture file.
317 * @param cf the capture file
318 * @return the number of packets in the capture file
320 int cf_get_packet_count(capture_file *cf);
323 * Is this capture file a temporary file?
325 * @param cf the capture file
326 * @return TRUE if it's a temporary file, FALSE otherwise
328 gboolean cf_is_tempfile(capture_file *cf);
331 * Set flag, that this file is a tempfile.
333 void cf_set_tempfile(capture_file *cf, gboolean is_tempfile);
336 * Set flag, if the number of packet drops while capturing are known or not.
338 * @param cf the capture file
339 * @param drops_known TRUE if the number of packet drops are known, FALSE otherwise
341 void cf_set_drops_known(capture_file *cf, gboolean drops_known);
344 * Set the number of packet drops while capturing.
346 * @param cf the capture file
347 * @param drops the number of packet drops occurred while capturing
349 void cf_set_drops(capture_file *cf, guint32 drops);
352 * Get flag state, if the number of packet drops while capturing are known or not.
354 * @param cf the capture file
355 * @return TRUE if the number of packet drops are known, FALSE otherwise
357 gboolean cf_get_drops_known(capture_file *cf);
360 * Get the number of packet drops while capturing.
362 * @param cf the capture file
363 * @return the number of packet drops occurred while capturing
365 guint32 cf_get_drops(capture_file *cf);
368 * Set the read filter.
369 * @todo this shouldn't be required, remove it somehow
371 * @param cf the capture file
372 * @param rfcode the readfilter
374 void cf_set_rfcode(capture_file *cf, dfilter_t *rfcode);
377 * "Display Filter" packets in the capture file.
379 * @param cf the capture file
380 * @param dfilter the display filter
381 * @param force TRUE if do in any case, FALSE only if dfilter changed
382 * @return one of cf_status_t
384 cf_status_t cf_filter_packets(capture_file *cf, gchar *dfilter, gboolean force);
387 * At least one "Refence Time" flag has changed, rescan all packets.
389 * @param cf the capture file
391 void cf_reftime_packets(capture_file *cf);
394 * Return the time it took to load the file (in msec).
396 gulong cf_get_computed_elapsed(capture_file *cf);
399 * "Something" has changed, rescan all packets.
401 * @param cf the capture file
403 void cf_redissect_packets(capture_file *cf);
406 * Rescan all packets and just run taps - don't reconstruct the display.
408 * @param cf the capture file
409 * @return one of cf_read_status_t
411 cf_read_status_t cf_retap_packets(capture_file *cf);
414 * Adjust timestamp precision if auto is selected.
416 * @param cf the capture file
418 void cf_timestamp_auto_precision(capture_file *cf);
420 /* print_range, enum which frames should be printed */
422 print_range_selected_only, /* selected frame(s) only (currently only one) */
423 print_range_marked_only, /* marked frames only */
424 print_range_all_displayed, /* all frames currently displayed */
425 print_range_all_captured /* all frames in capture */
429 print_stream_t *stream; /* the stream to which we're printing */
430 print_format_e format; /* plain text or PostScript */
431 gboolean to_file; /* TRUE if we're printing to a file */
432 char *file; /* file output pathname */
433 char *cmd; /* print command string (not win32) */
434 packet_range_t range;
436 gboolean print_summary; /* TRUE if we should print summary line. */
437 gboolean print_col_headings; /* TRUE if we should print column headings */
438 print_dissections_e print_dissections;
439 gboolean print_hex; /* TRUE if we should print hex data;
440 * FALSE if we should print only if not dissected. */
441 gboolean print_formfeed; /* TRUE if a formfeed should be printed before
446 * Print the capture file.
448 * @param cf the capture file
449 * @param print_args the arguments what and how to print
450 * @param show_progress_bar TRUE if a progress bar is to be shown
451 * @return one of cf_print_status_t
453 cf_print_status_t cf_print_packets(capture_file *cf, print_args_t *print_args,
454 gboolean show_progress_bar);
457 * Print (export) the capture file into PDML format.
459 * @param cf the capture file
460 * @param print_args the arguments what and how to export
461 * @return one of cf_print_status_t
463 cf_print_status_t cf_write_pdml_packets(capture_file *cf, print_args_t *print_args);
466 * Print (export) the capture file into PSML format.
468 * @param cf the capture file
469 * @param print_args the arguments what and how to export
470 * @return one of cf_print_status_t
472 cf_print_status_t cf_write_psml_packets(capture_file *cf, print_args_t *print_args);
475 * Print (export) the capture file into CSV format.
477 * @param cf the capture file
478 * @param print_args the arguments what and how to export
479 * @return one of cf_print_status_t
481 cf_print_status_t cf_write_csv_packets(capture_file *cf, print_args_t *print_args);
484 * Print (export) the capture file into C Arrays format.
486 * @param cf the capture file
487 * @param print_args the arguments what and how to export
488 * @return one of cf_print_status_t
490 cf_print_status_t cf_write_carrays_packets(capture_file *cf, print_args_t *print_args);
493 * Print (export) the capture file into JSON format.
495 * @param cf the capture file
496 * @param print_args the arguments what and how to export
497 * @return one of cf_print_status_t
499 cf_print_status_t cf_write_json_packets(capture_file *cf, print_args_t *print_args);
502 * Find packet with a protocol tree item that contains a specified text string.
504 * @param cf the capture file
505 * @param string the string to find
506 * @param dir direction in which to search
507 * @return TRUE if a packet was found, FALSE otherwise
509 gboolean cf_find_packet_protocol_tree(capture_file *cf, const char *string,
510 search_direction dir);
513 * Find field with a label that contains text string cfile->sfilter.
515 * @param cf the capture file
516 * @param tree the protocol tree
517 * @param mdata the first field (mdata->finfo) that matched the string
518 * @return TRUE if a packet was found, FALSE otherwise
520 extern gboolean cf_find_string_protocol_tree(capture_file *cf, proto_tree *tree,
524 * Find packet whose summary line contains a specified text string.
526 * @param cf the capture file
527 * @param string the string to find
528 * @param dir direction in which to search
529 * @return TRUE if a packet was found, FALSE otherwise
531 gboolean cf_find_packet_summary_line(capture_file *cf, const char *string,
532 search_direction dir);
535 * Find packet whose data contains a specified byte string.
537 * @param cf the capture file
538 * @param string the string to find
539 * @param string_size the size of the string to find
540 * @param dir direction in which to search
541 * @return TRUE if a packet was found, FALSE otherwise
543 gboolean cf_find_packet_data(capture_file *cf, const guint8 *string,
544 size_t string_size, search_direction dir);
547 * Find packet that matches a compiled display filter.
549 * @param cf the capture file
550 * @param sfcode the display filter to match
551 * @param dir direction in which to search
552 * @return TRUE if a packet was found, FALSE otherwise
554 gboolean cf_find_packet_dfilter(capture_file *cf, dfilter_t *sfcode,
555 search_direction dir);
558 * Find packet that matches a display filter given as a text string.
560 * @param cf the capture file
561 * @param filter the display filter to match
562 * @param dir direction in which to search
563 * @return TRUE if a packet was found, FALSE otherwise
566 cf_find_packet_dfilter_string(capture_file *cf, const char *filter,
567 search_direction dir);
570 * Find marked packet.
572 * @param cf the capture file
573 * @param dir direction in which to search
574 * @return TRUE if a packet was found, FALSE otherwise
576 gboolean cf_find_packet_marked(capture_file *cf, search_direction dir);
579 * Find time-reference packet.
581 * @param cf the capture file
582 * @param dir direction in which to search
583 * @return TRUE if a packet was found, FALSE otherwise
585 gboolean cf_find_packet_time_reference(capture_file *cf, search_direction dir);
588 * GoTo Packet with the given row.
590 * @param cf the capture file
591 * @param row the row to go to
592 * @return TRUE if this row exists, FALSE otherwise
594 gboolean cf_goto_frame(capture_file *cf, guint row);
597 * Go to frame specified by currently selected protocol tree field.
598 * (Go To Corresponding Packet)
599 * @todo this is ugly and should be improved!
601 * @param cf the capture file
602 * @return TRUE if this packet exists, FALSE otherwise
604 gboolean cf_goto_framenum(capture_file *cf);
607 * Select the packet in the given row.
609 * @param cf the capture file
610 * @param row the row to select
612 void cf_select_packet(capture_file *cf, int row);
615 * Unselect all packets, if any.
617 * @param cf the capture file
619 void cf_unselect_packet(capture_file *cf);
622 * Unselect all protocol tree fields, if any.
624 * @param cf the capture file
626 void cf_unselect_field(capture_file *cf);
629 * Mark a particular frame in a particular capture.
631 * @param cf the capture file
632 * @param frame the frame to be marked
634 void cf_mark_frame(capture_file *cf, frame_data *frame);
637 * Unmark a particular frame in a particular capture.
639 * @param cf the capture file
640 * @param frame the frame to be unmarked
642 void cf_unmark_frame(capture_file *cf, frame_data *frame);
645 * Ignore a particular frame in a particular capture.
647 * @param cf the capture file
648 * @param frame the frame to be ignored
650 void cf_ignore_frame(capture_file *cf, frame_data *frame);
653 * Unignore a particular frame in a particular capture.
655 * @param cf the capture file
656 * @param frame the frame to be unignored
658 void cf_unignore_frame(capture_file *cf, frame_data *frame);
661 * Merge two or more capture files into a temporary file.
662 * @todo is this the right place for this function? It doesn't have to do a lot with capture_file.
664 * @param pd_window Window pointer suitable for use by delayed_create_progress_dlg.
665 * @param out_filenamep Points to a pointer that's set to point to the
666 * pathname of the temporary file; it's allocated with g_malloc()
667 * @param in_file_count the number of input files to merge
668 * @param in_filenames array of input filenames
669 * @param file_type the output filetype
670 * @param do_append FALSE to merge chronologically, TRUE simply append
671 * @return one of cf_status_t
674 cf_merge_files_to_tempfile(gpointer pd_window, char **out_filenamep,
675 int in_file_count, char *const *in_filenames,
676 int file_type, gboolean do_append);
680 * Get the comment on a capture from the SHB data block
681 * XXX - should support multiple sections.
683 * @param cf the capture file
685 const gchar* cf_read_section_comment(capture_file *cf);
688 * Update(replace) the comment on a capture from the SHB data block
689 * XXX - should support multiple sections.
691 * @param cf the capture file
692 * @param comment the string replacing the old comment
694 void cf_update_section_comment(capture_file *cf, gchar *comment);
697 * Get the comment on a packet (record).
698 * If the comment has been edited, it returns the result of the edit,
699 * otherwise it returns the comment from the file.
701 * @param cf the capture file
702 * @param fd the frame_data structure for the frame
704 char *cf_get_packet_comment(capture_file *cf, const frame_data *fd);
707 * Update(replace) the comment on a capture from a frame
709 * @param cf the capture file
710 * @param fd the frame_data structure for the frame
711 * @param new_comment the string replacing the old comment
713 gboolean cf_set_user_packet_comment(capture_file *cf, frame_data *fd, const gchar *new_comment);
716 * What types of comments does this file have?
718 * @param cf the capture file
719 * @return bitset of WTAP_COMMENT_ values
721 guint32 cf_comment_types(capture_file *cf);
724 * Add a resolved address to this file's list of resolved addresses.
726 * @param cf the capture file
727 * @param addr a string representing an IPv4 or IPv6 address
728 * @param name a string containing a name corresponding to that address
729 * @return TRUE if it succeeds, FALSE if not
731 gboolean cf_add_ip_name_from_string(capture_file *cf, const char *addr, const char *name);
733 #ifdef WANT_PACKET_EDITOR
735 * Give a frame new, edited data.
737 * @param cf the capture file
738 * @param fd frame_data structure for the frame
739 * @param phdr the struct wtap_pkthdr for the frame
740 * @param pd the raw packet data for the frame
742 void cf_set_frame_edited(capture_file *cf, frame_data *fd, struct wtap_pkthdr *phdr, guint8 *pd);
747 #endif /* __cplusplus */
752 * Editor modelines - http://www.wireshark.org/tools/modelines.html
757 * indent-tabs-mode: nil
760 * vi: set shiftwidth=4 tabstop=8 expandtab:
761 * :indentSize=4:tabSize=8:noTabs=true: