#include <fcntl.h>
#endif
-#include <epan/epan.h>
-#include <epan/filesystem.h>
+#include <wsutil/tempfile.h>
+#include <wsutil/file_util.h>
+#include <wsutil/filesystem.h>
-#include "color.h"
-#include "color_filters.h"
-#include "cfile.h"
+#include <wiretap/merge.h>
+
+#include <epan/exceptions.h>
+#include <epan/epan-int.h>
+#include <epan/epan.h>
#include <epan/column.h>
#include <epan/packet.h>
#include <epan/column-utils.h>
-#include "packet-range.h"
-#include "print.h"
-#include "file.h"
-#include "fileset.h"
-#include "tempfile.h"
-#include "merge.h"
-
+#include <epan/expert.h>
#include <epan/prefs.h>
#include <epan/dfilter/dfilter.h>
#include <epan/epan_dissect.h>
#include <epan/dissectors/packet-ber.h>
#include <epan/timestamp.h>
#include <epan/dfilter/dfilter-macro.h>
-#include <wsutil/file_util.h>
#include <epan/strutil.h>
#include <epan/addr_resolv.h>
+#include "color.h"
+#include "color_filters.h"
+#include "cfile.h"
+#include "file.h"
+#include "fileset.h"
+#include "frame_tvbuff.h"
+
#include "ui/alert_box.h"
#include "ui/simple_dialog.h"
#include "ui/main_statusbar.h"
#include "ui/progress_dlg.h"
#include "ui/ui_util.h"
-#ifdef HAVE_LIBPCAP
-gboolean auto_scroll_live;
+#include "version_info.h"
+
+/* Needed for addrinfo */
+#ifdef HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+
+#ifdef HAVE_NETINET_IN_H
+# include <netinet/in.h>
+#endif
+
+#ifdef HAVE_NETDB_H
+# include <netdb.h>
+#endif
+
+#ifdef HAVE_WINSOCK2_H
+# include <winsock2.h>
#endif
-static guint32 cum_bytes;
-static nstime_t first_ts;
-static frame_data *prev_dis;
-static frame_data *prev_cap;
+#if defined(_WIN32) && defined(INET6)
+# include <ws2tcpip.h>
+#endif
-static gulong computed_elapsed;
+#ifdef HAVE_LIBPCAP
+gboolean auto_scroll_live;
+#endif
static void cf_reset_state(capture_file *cf);
-static int read_packet(capture_file *cf, dfilter_t *dfcode,
- gboolean create_proto_tree, column_info *cinfo, gint64 offset);
+static int read_packet(capture_file *cf, dfilter_t *dfcode, epan_dissect_t *edt,
+ column_info *cinfo, gint64 offset);
static void rescan_packets(capture_file *cf, const char *action, const char *action_item, gboolean redissect);
static void match_subtree_text(proto_node *node, gpointer data);
static match_result match_summary_line(capture_file *cf, frame_data *fdata,
void *criterion);
-static match_result match_ascii_and_unicode(capture_file *cf, frame_data *fdata,
+static match_result match_narrow_and_wide(capture_file *cf, frame_data *fdata,
void *criterion);
-static match_result match_ascii(capture_file *cf, frame_data *fdata,
+static match_result match_narrow(capture_file *cf, frame_data *fdata,
void *criterion);
-static match_result match_unicode(capture_file *cf, frame_data *fdata,
+static match_result match_wide(capture_file *cf, frame_data *fdata,
void *criterion);
static match_result match_binary(capture_file *cf, frame_data *fdata,
void *criterion);
match_result (*match_function)(capture_file *, frame_data *, void *),
void *criterion, search_direction dir);
+static const char *cf_get_user_packet_comment(capture_file *cf, const frame_data *fd);
+
static void cf_open_failure_alert_box(const char *filename, int err,
gchar *err_info, gboolean for_writing,
int file_type);
g_assert(cb_item != NULL);
while (cb_item != NULL) {
- cb = cb_item->data;
+ cb = (cf_callback_data_t *)cb_item->data;
cb->cb_fct(event, data, cb->user_data);
cb_item = g_list_next(cb_item);
}
{
cf_callback_data_t *cb;
- cb = g_malloc(sizeof(cf_callback_data_t));
+ cb = g_new(cf_callback_data_t,1);
cb->cb_fct = func;
cb->user_data = user_data;
- cf_callbacks = g_list_append(cf_callbacks, cb);
+ cf_callbacks = g_list_prepend(cf_callbacks, cb);
}
void
GList *cb_item = cf_callbacks;
while (cb_item != NULL) {
- cb = cb_item->data;
+ cb = (cf_callback_data_t *)cb_item->data;
if (cb->cb_fct == func) {
cf_callbacks = g_list_remove(cf_callbacks, cb);
g_free(cb);
}
gulong
-cf_get_computed_elapsed(void)
+cf_get_computed_elapsed(capture_file *cf)
{
- return computed_elapsed;
-}
-
-static void reset_elapsed(void)
-{
- computed_elapsed = 0;
+ return cf->computed_elapsed;
}
/*
* GLIB_CHECK_VERSION(2,28,0) adds g_get_real_time which could minimize or
* replace this
*/
-static void compute_elapsed(GTimeVal *start_time)
+static void compute_elapsed(capture_file *cf, GTimeVal *start_time)
{
gdouble delta_time;
GTimeVal time_now;
delta_time = (time_now.tv_sec - start_time->tv_sec) * 1e6 +
time_now.tv_usec - start_time->tv_usec;
- computed_elapsed = (gulong) (delta_time / 1000); /* ms */
+ cf->computed_elapsed = (gulong) (delta_time / 1000); /* ms */
+}
+
+static const nstime_t *
+ws_get_frame_ts(void *data, guint32 frame_num)
+{
+ capture_file *cf = (capture_file *) data;
+
+ if (cf->prev_dis && cf->prev_dis->num == frame_num)
+ return &cf->prev_dis->abs_ts;
+
+ if (cf->prev_cap && cf->prev_cap->num == frame_num)
+ return &cf->prev_cap->abs_ts;
+
+ if (cf->frames) {
+ frame_data *fd = frame_data_sequence_find(cf->frames, frame_num);
+
+ return (fd) ? &fd->abs_ts : NULL;
+ }
+
+ return NULL;
+}
+
+static const char *
+ws_get_user_comment(void *data, const frame_data *fd)
+{
+ capture_file *cf = (capture_file *) data;
+
+ return cf_get_user_packet_comment(cf, fd);
+}
+
+static epan_t *
+ws_epan_new(capture_file *cf)
+{
+ epan_t *epan = epan_new();
+
+ epan->data = cf;
+ epan->get_frame_ts = ws_get_frame_ts;
+ epan->get_interface_name = cap_file_get_interface_name;
+ epan->get_user_comment = ws_get_user_comment;
+
+ return epan;
}
cf_status_t
and fill in the information for this file. */
cf_close(cf);
- /* Cleanup all data structures used for dissection. */
- cleanup_dissection();
- /* Initialize all data structures used for dissection. */
- init_dissection();
+ /* XXX - we really want to initialize this after we've read all
+ the packets, so we know how much we'll ultimately need. */
+ buffer_init(&cf->buf, 1500);
+
+ /* Create new epan session for dissection.
+ * (The old one was freed in cf_close().)
+ */
+ cf->epan = ws_epan_new(cf);
/* We're about to start reading the file. */
cf->state = FILE_READ_IN_PROGRESS;
/* No user changes yet. */
cf->unsaved_changes = FALSE;
- reset_elapsed();
+ cf->computed_elapsed = 0;
- cf->cd_t = wtap_file_type(cf->wth);
+ cf->cd_t = wtap_file_type_subtype(cf->wth);
cf->linktypes = g_array_sized_new(FALSE, FALSE, (guint) sizeof(int), 1);
cf->count = 0;
cf->packet_comment_count = 0;
cf->frames = new_frame_data_sequence();
nstime_set_zero(&cf->elapsed_time);
- nstime_set_unset(&first_ts);
- prev_dis = NULL;
- prev_cap = NULL;
- cum_bytes = 0;
+ cf->ref = NULL;
+ cf->prev_dis = NULL;
+ cf->prev_cap = NULL;
+ cf->cum_bytes = 0;
/* Adjust timestamp precision if auto is selected, col width will be adjusted */
cf_timestamp_auto_precision(cf);
packet_list_queue_draw();
cf_callback_invoke(cf_cb_file_opened, cf);
- if (cf->cd_t == WTAP_FILE_BER) {
+ if (cf->cd_t == WTAP_FILE_TYPE_SUBTYPE_BER) {
/* tell the BER dissector the file name */
ber_set_filename(cf->filename);
}
/*
* Add an encapsulation type to cf->linktypes.
*/
-void
+static void
cf_add_encapsulation_type(capture_file *cf, int encap)
{
guint i;
/* ...which means we have no changes to that file to save. */
cf->unsaved_changes = FALSE;
+ /* Free up the packet buffer. */
+ buffer_free(&cf->buf);
+
dfilter_free(cf->rfcode);
cf->rfcode = NULL;
if (cf->frames != NULL) {
cf->edited_frames = NULL;
}
#endif
+ if (cf->frames_user_comments) {
+ g_tree_destroy(cf->frames_user_comments);
+ cf->frames_user_comments = NULL;
+ }
cf_unselect_packet(cf); /* nothing to select */
cf->first_displayed = 0;
cf->last_displayed = 0;
/* close things, if not already closed before */
color_filters_cleanup();
cf_reset_state(cf);
- cleanup_dissection();
+ epan_free(cf->epan);
+ cf->epan = NULL;
cf_callback_invoke(cf_cb_file_closed, cf);
}
progdlg_t *progbar = NULL;
gboolean stop_flag;
GTimeVal start_time;
+ epan_dissect_t edt;
dfilter_t *dfcode;
- gboolean create_proto_tree;
+ volatile gboolean create_proto_tree;
guint tap_flags;
gboolean compiled;
stop_flag = FALSE;
g_get_current_time(&start_time);
+ epan_dissect_init(&edt, cf->epan, create_proto_tree, FALSE);
+
TRY {
#ifdef HAVE_LIBPCAP
int displayed_once = 0;
if (size >= 0) {
progbar_quantum = size/N_PROGBAR_UPDATES;
if (progbar_quantum < MIN_QUANTUM)
- progbar_quantum = MIN_QUANTUM;
+ progbar_quantum = MIN_QUANTUM;
}else
progbar_quantum = 0;
- /* Progress so far. */
- progbar_val = 0.0f;
while ((wtap_read(cf->wth, &err, &err_info, &data_offset))) {
if (size >= 0) {
- count++;
- file_pos = wtap_read_so_far(cf->wth);
-
- /* Create the progress bar if necessary.
- * Check whether it should be created or not every MIN_NUMBER_OF_PACKET
- */
- if ((progbar == NULL) && !(count % MIN_NUMBER_OF_PACKET)) {
- progbar_val = calc_progbar_val(cf, size, file_pos, status_str, sizeof(status_str));
- if (reloading)
- progbar = delayed_create_progress_dlg(cf->window, "Reloading", name_ptr,
- TRUE, &stop_flag, &start_time, progbar_val);
- else
- progbar = delayed_create_progress_dlg(cf->window, "Loading", name_ptr,
- TRUE, &stop_flag, &start_time, progbar_val);
- }
-
- /* Update the progress bar, but do it only N_PROGBAR_UPDATES times;
- when we update it, we have to run the GTK+ main loop to get it
- to repaint what's pending, and doing so may involve an "ioctl()"
- to see if there's any pending input from an X server, and doing
- that for every packet can be costly, especially on a big file. */
- if (file_pos >= progbar_nextstep) {
- if (progbar != NULL) {
- progbar_val = calc_progbar_val(cf, size, file_pos, status_str, sizeof(status_str));
- /* update the packet bar content on the first run or frequently on very large files */
+ count++;
+ file_pos = wtap_read_so_far(cf->wth);
+
+ /* Create the progress bar if necessary.
+ * Check whether it should be created or not every MIN_NUMBER_OF_PACKET
+ */
+ if ((progbar == NULL) && !(count % MIN_NUMBER_OF_PACKET)) {
+ progbar_val = calc_progbar_val(cf, size, file_pos, status_str, sizeof(status_str));
+ if (reloading)
+ progbar = delayed_create_progress_dlg(cf->window, "Reloading", name_ptr,
+ TRUE, &stop_flag, &start_time, progbar_val);
+ else
+ progbar = delayed_create_progress_dlg(cf->window, "Loading", name_ptr,
+ TRUE, &stop_flag, &start_time, progbar_val);
+ }
+
+ /* Update the progress bar, but do it only N_PROGBAR_UPDATES times;
+ when we update it, we have to run the GTK+ main loop to get it
+ to repaint what's pending, and doing so may involve an "ioctl()"
+ to see if there's any pending input from an X server, and doing
+ that for every packet can be costly, especially on a big file. */
+ if (file_pos >= progbar_nextstep) {
+ if (progbar != NULL) {
+ progbar_val = calc_progbar_val(cf, size, file_pos, status_str, sizeof(status_str));
+ /* update the packet bar content on the first run or frequently on very large files */
#ifdef HAVE_LIBPCAP
- if (progbar_quantum > 500000 || displayed_once == 0) {
- if ((auto_scroll_live || displayed_once == 0 || cf->displayed_count < 1000) && cf->count != 0) {
- displayed_once = 1;
- packets_bar_update();
- }
- }
+ if (progbar_quantum > 500000 || displayed_once == 0) {
+ if ((auto_scroll_live || displayed_once == 0 || cf->displayed_count < 1000) && cf->count != 0) {
+ displayed_once = 1;
+ packets_bar_update();
+ }
+ }
#endif /* HAVE_LIBPCAP */
- update_progress_dlg(progbar, progbar_val, status_str);
- }
- progbar_nextstep += progbar_quantum;
- }
+ update_progress_dlg(progbar, progbar_val, status_str);
+ }
+ progbar_nextstep += progbar_quantum;
+ }
}
if (stop_flag) {
- /* Well, the user decided to abort the read. He/She will be warned and
- it might be enough for him/her to work with the already loaded
- packets.
- This is especially true for very large capture files, where you don't
- want to wait loading the whole file (which may last minutes or even
- hours even on fast machines) just to see that it was the wrong file. */
- break;
+ /* Well, the user decided to abort the read. He/She will be warned and
+ it might be enough for him/her to work with the already loaded
+ packets.
+ This is especially true for very large capture files, where you don't
+ want to wait loading the whole file (which may last minutes or even
+ hours even on fast machines) just to see that it was the wrong file. */
+ break;
}
- read_packet(cf, dfcode, create_proto_tree, cinfo, data_offset);
- }
+ read_packet(cf, dfcode, &edt, cinfo, data_offset);
+ }
}
CATCH(OutOfMemoryError) {
simple_message_box(ESD_TYPE_ERROR, NULL,
dfilter_free(dfcode);
}
+ epan_dissect_cleanup(&edt);
+
/* We're done reading the file; destroy the progress bar if it was created. */
if (progbar != NULL)
destroy_progress_dlg(progbar);
postseq_cleanup_all_protocols();
/* compute the time it took to load the file */
- compute_elapsed(&start_time);
+ compute_elapsed(cf, &start_time);
/* Set the file encapsulation type now; we don't know what it is until
we've looked at all the packets, as we don't know until then whether
}
#ifdef HAVE_LIBPCAP
-cf_status_t
-cf_start_tail(capture_file *cf, const char *fname, gboolean is_tempfile, int *err)
-{
- cf_status_t cf_status;
-
- cf_status = cf_open(cf, fname, is_tempfile, err);
- return cf_status;
-}
-
cf_read_status_t
cf_continue_tail(capture_file *cf, volatile int to_read, int *err)
{
- gchar *err_info;
- int newly_displayed_packets = 0;
- dfilter_t *dfcode;
- gboolean create_proto_tree;
- guint tap_flags;
- gboolean compiled;
+ gchar *err_info;
+ int newly_displayed_packets = 0;
+ dfilter_t *dfcode;
+ epan_dissect_t edt;
+ gboolean create_proto_tree;
+ guint tap_flags;
+ gboolean compiled;
/* Compile the current display filter.
* We assume this will not fail since cf->dfilter is only set in
/*g_log(NULL, G_LOG_LEVEL_MESSAGE, "cf_continue_tail: %u new: %u", cf->count, to_read);*/
+ epan_dissect_init(&edt, cf->epan, create_proto_tree, FALSE);
+
TRY {
gint64 data_offset = 0;
column_info *cinfo;
while (to_read != 0) {
wtap_cleareof(cf->wth);
if (!wtap_read(cf->wth, err, &err_info, &data_offset)) {
- break;
+ break;
}
if (cf->state == FILE_READ_ABORTED) {
- /* Well, the user decided to exit Wireshark. Break out of the
- loop, and let the code below (which is called even if there
- aren't any packets left to read) exit. */
- break;
+ /* Well, the user decided to exit Wireshark. Break out of the
+ loop, and let the code below (which is called even if there
+ aren't any packets left to read) exit. */
+ break;
}
- if (read_packet(cf, dfcode, create_proto_tree, (column_info *) cinfo, data_offset) != -1) {
- newly_displayed_packets++;
+ if (read_packet(cf, dfcode, &edt, (column_info *) cinfo, data_offset) != -1) {
+ newly_displayed_packets++;
}
to_read--;
}
dfilter_free(dfcode);
}
+ epan_dissect_cleanup(&edt);
+
/*g_log(NULL, G_LOG_LEVEL_MESSAGE, "cf_continue_tail: count %u state: %u err: %u",
cf->count, cf->state, *err);*/
gint64 data_offset;
dfilter_t *dfcode;
column_info *cinfo;
+ epan_dissect_t edt;
gboolean create_proto_tree;
guint tap_flags;
gboolean compiled;
/* Don't freeze/thaw the list when doing live capture */
/*packet_list_freeze();*/
+ epan_dissect_init(&edt, cf->epan, create_proto_tree, FALSE);
+
while ((wtap_read(cf->wth, err, &err_info, &data_offset))) {
if (cf->state == FILE_READ_ABORTED) {
/* Well, the user decided to abort the read. Break out of the
aren't any packets left to read) exit. */
break;
}
- read_packet(cf, dfcode, create_proto_tree, cinfo, data_offset);
+ read_packet(cf, dfcode, &edt, cinfo, data_offset);
}
/* Cleanup and release all dfilter resources */
dfilter_free(dfcode);
}
+ epan_dissect_cleanup(&edt);
+
/* Don't freeze/thaw the list when doing live capture */
/*packet_list_thaw();*/
cf->rfcode = rfcode;
}
-static void
-find_and_mark_frame_depended_upon(gpointer data, gpointer user_data)
-{
- frame_data *dependent_fd;
- guint32 dependent_frame = GPOINTER_TO_UINT(data);
- capture_file *cf = (capture_file *)user_data;
-
- dependent_fd = frame_data_sequence_find(cf->frames, dependent_frame);
- dependent_fd->flags.dependent_of_displayed = 1;
-}
-
static int
add_packet_to_packet_list(frame_data *fdata, capture_file *cf,
- dfilter_t *dfcode, gboolean create_proto_tree, column_info *cinfo,
- struct wtap_pkthdr *phdr, const guchar *buf,
- gboolean add_to_packet_list)
+ epan_dissect_t *edt, dfilter_t *dfcode, column_info *cinfo,
+ struct wtap_pkthdr *phdr, const guint8 *buf, gboolean add_to_packet_list)
{
- epan_dissect_t edt;
gint row = -1;
frame_data_set_before_dissect(fdata, &cf->elapsed_time,
- &first_ts, prev_dis, prev_cap);
- prev_cap = fdata;
-
- /* Dissect the frame. */
- epan_dissect_init(&edt, create_proto_tree, FALSE);
+ &cf->ref, cf->prev_dis);
+ cf->prev_cap = fdata;
if (dfcode != NULL) {
- epan_dissect_prime_dfilter(&edt, dfcode);
+ epan_dissect_prime_dfilter(edt, dfcode);
}
- epan_dissect_run_with_taps(&edt, phdr, buf, fdata, cinfo);
+ /* Dissect the frame. */
+ epan_dissect_run_with_taps(edt, phdr, frame_tvbuff_new(fdata, buf), fdata, cinfo);
/* If we don't have a display filter, set "passed_dfilter" to 1. */
if (dfcode != NULL) {
- fdata->flags.passed_dfilter = dfilter_apply_edt(dfcode, &edt) ? 1 : 0;
+ fdata->flags.passed_dfilter = dfilter_apply_edt(dfcode, edt) ? 1 : 0;
if (fdata->flags.passed_dfilter) {
/* This frame passed the display filter but it may depend on other
* (potentially not displayed) frames. Find those frames and mark them
* as depended upon.
*/
- g_slist_foreach(edt.pi.dependent_frames, find_and_mark_frame_depended_upon, cf);
+ g_slist_foreach(edt->pi.dependent_frames, find_and_mark_frame_depended_upon, cf->frames);
}
} else
fdata->flags.passed_dfilter = 1;
if (add_to_packet_list) {
/* We fill the needed columns from new_packet_list */
- row = packet_list_append(cinfo, fdata, &edt.pi);
+ row = packet_list_append(cinfo, fdata);
}
if (fdata->flags.passed_dfilter || fdata->flags.ref_time)
{
- frame_data_set_after_dissect(fdata, &cum_bytes);
- prev_dis = fdata;
+ frame_data_set_after_dissect(fdata, &cf->cum_bytes);
+ cf->prev_dis = fdata;
/* If we haven't yet seen the first frame, this is it.
cf->last_displayed = fdata->num;
}
- epan_dissect_cleanup(&edt);
+ epan_dissect_reset(edt);
return row;
}
/* read in a new packet */
/* returns the row of the new packet in the packet list or -1 if not displayed */
static int
-read_packet(capture_file *cf, dfilter_t *dfcode,
- gboolean create_proto_tree, column_info *cinfo, gint64 offset)
+read_packet(capture_file *cf, dfilter_t *dfcode, epan_dissect_t *edt,
+ column_info *cinfo, gint64 offset)
{
struct wtap_pkthdr *phdr = wtap_phdr(cf->wth);
- const guchar *buf = wtap_buf_ptr(cf->wth);
+ const guint8 *buf = wtap_buf_ptr(cf->wth);
frame_data fdlocal;
guint32 framenum;
frame_data *fdata;
- int passed;
+ gboolean passed;
int row = -1;
/* Add this packet's link-layer encapsulation type to cf->linktypes, if
frames in the file so far. */
framenum = cf->count + 1;
- frame_data_init(&fdlocal, framenum, phdr, offset, cum_bytes);
+ frame_data_init(&fdlocal, framenum, phdr, offset, cf->cum_bytes);
passed = TRUE;
if (cf->rfcode) {
- epan_dissect_t edt;
- epan_dissect_init(&edt, TRUE, FALSE);
- epan_dissect_prime_dfilter(&edt, cf->rfcode);
- epan_dissect_run(&edt, phdr, buf, &fdlocal, NULL);
- passed = dfilter_apply_edt(cf->rfcode, &edt);
- epan_dissect_cleanup(&edt);
+ epan_dissect_t rf_edt;
+
+ epan_dissect_init(&rf_edt, cf->epan, TRUE, FALSE);
+ epan_dissect_prime_dfilter(&rf_edt, cf->rfcode);
+ epan_dissect_run(&rf_edt, phdr, frame_tvbuff_new(&fdlocal, buf), &fdlocal, NULL);
+ passed = dfilter_apply_edt(cf->rfcode, &rf_edt);
+ epan_dissect_cleanup(&rf_edt);
}
if (passed) {
fdata = frame_data_sequence_add(cf->frames, &fdlocal);
cf->count++;
- if (fdlocal.opt_comment != NULL)
+ if (phdr->opt_comment != NULL)
cf->packet_comment_count++;
cf->f_datalen = offset + fdlocal.cap_len;
if (!cf->redissecting) {
- row = add_packet_to_packet_list(fdata, cf, dfcode,
- create_proto_tree, cinfo,
- phdr, buf, TRUE);
+ row = add_packet_to_packet_list(fdata, cf, edt, dfcode,
+ cinfo, phdr, buf, TRUE);
}
}
* We need something similar when merging pcapng files possibly with an option to say
* the same interface(s) used in all in files. SHBs comments should be merged together.
*/
- if ((selected_frame_type == WTAP_ENCAP_PER_PACKET)&&(file_type == WTAP_FILE_PCAP)) {
+ if ((selected_frame_type == WTAP_ENCAP_PER_PACKET)&&(file_type == WTAP_FILE_TYPE_SUBTYPE_PCAP)) {
/* Write output in pcapng format */
wtapng_section_t *shb_hdr;
wtapng_iface_descriptions_t *idb_inf, *idb_inf_merge_file;
wtapng_if_descr_t int_data, *file_int_data;
GString *comment_gstr;
- int i;
fake_interface_ids = TRUE;
/* Create SHB info */
- shb_hdr = wtap_file_get_shb_info(in_files[0].wth);
+ shb_hdr = wtap_file_get_shb_info(in_files[0].wth);
comment_gstr = g_string_new("");
g_string_append_printf(comment_gstr, "%s \n",shb_hdr->opt_comment);
g_string_append_printf(comment_gstr, "File created by merging: \n");
- file_type = WTAP_FILE_PCAPNG;
+ file_type = WTAP_FILE_TYPE_SUBTYPE_PCAPNG;
for (i = 0; i < in_file_count; i++) {
g_string_append_printf(comment_gstr, "File%d: %s \n",i+1,in_files[i].filename);
break;
}
- /* If we have WTAP_ENCAP_PER_PACKETend the infiles are of type WTAP_FILE_PCAP
- * we need to set the interface id in the paket header = the interface index we used
- * in the IDBs interface description for this file(encapsulation type).
+ /* If we have WTAP_ENCAP_PER_PACKET and the infiles are of type
+ * WTAP_FILE_TYPE_SUBTYPE_PCAP, we need to set the interface id
+ * in the paket header = the interface index we used in the IDBs
+ * interface description for this file(encapsulation type).
*/
if (fake_interface_ids) {
struct wtap_pkthdr *phdr;
destroy_progress_dlg(progbar);
merge_close_in_files(in_file_count, in_files);
- if (!got_read_error && !got_write_error) {
+ if (!got_write_error) {
if (!wtap_dump_close(pdh, &write_err))
got_write_error = TRUE;
- } else
- wtap_dump_close(pdh, &close_err);
+ } else {
+ /*
+ * We already got a write error; no need to report another
+ * write error on close.
+ *
+ * Don't overwrite the earlier write error.
+ */
+ (void)wtap_dump_close(pdh, &close_err);
+ }
if (got_read_error) {
/*
case WTAP_ERR_UNSUPPORTED_ENCAP:
/*
- * This is a problem with the particular frame we're writing;
- * note that, and give the frame number.
+ * This is a problem with the particular frame we're writing and
+ * the file type and subtype we're writing; note that, and report
+ * the frame number and file type/subtype.
*/
display_basename = g_filename_display_basename(in_file->filename);
simple_error_message_box(
"Frame %u of \"%s\" has a network type that can't be saved in a \"%s\" file.",
in_file->packet_num, display_basename,
- wtap_file_type_string(file_type));
+ wtap_file_type_subtype_string(file_type));
+ g_free(display_basename);
+ break;
+
+ case WTAP_ERR_PACKET_TOO_LARGE:
+ /*
+ * This is a problem with the particular frame we're writing and
+ * the file type and subtype we're writing; note that, and report
+ * the frame number and file type/subtype.
+ */
+ display_basename = g_filename_display_basename(in_file->filename);
+ simple_error_message_box(
+ "Frame %u of \"%s\" is too large for a \"%s\" file.",
+ in_file->packet_num, display_basename,
+ wtap_file_type_subtype_string(file_type));
g_free(display_basename);
break;
void
cf_redissect_packets(capture_file *cf)
{
- rescan_packets(cf, "Reprocessing", "all packets", TRUE);
+ if (cf->state != FILE_CLOSED) {
+ rescan_packets(cf, "Reprocessing", "all packets", TRUE);
+ }
}
gboolean
-cf_read_frame_r(capture_file *cf, frame_data *fdata,
- struct wtap_pkthdr *phdr, guint8 *pd)
+cf_read_frame_r(capture_file *cf, const frame_data *fdata,
+ struct wtap_pkthdr *phdr, Buffer *buf)
{
int err;
gchar *err_info;
}
*phdr = frame->phdr;
- memcpy(pd, frame->pd, fdata->cap_len);
+ buffer_assure_space(buf, frame->phdr.caplen);
+ memcpy(buffer_start_ptr(buf), frame->pd, frame->phdr.caplen);
return TRUE;
}
#endif
- if (!wtap_seek_read(cf->wth, fdata->file_off, phdr, pd,
- fdata->cap_len, &err, &err_info)) {
+ if (!wtap_seek_read(cf->wth, fdata->file_off, phdr, buf, &err, &err_info)) {
display_basename = g_filename_display_basename(cf->filename);
switch (err) {
gboolean
cf_read_frame(capture_file *cf, frame_data *fdata)
{
- return cf_read_frame_r(cf, fdata, &cf->phdr, cf->pd);
+ return cf_read_frame_r(cf, fdata, &cf->phdr, &cf->buf);
}
/* Rescan the list of packets, reconstructing the CList.
gchar status_str[100];
int progbar_nextstep;
int progbar_quantum;
+ epan_dissect_t edt;
dfilter_t *dfcode;
column_info *cinfo;
gboolean create_proto_tree;
want to dissect those before their time. */
cf->redissecting = TRUE;
- /* Cleanup all data structures used for dissection. */
- cleanup_dissection();
- /* Initialize all data structures used for dissection. */
- init_dissection();
+ /* 'reset' dissection session */
+ epan_free(cf->epan);
+ cf->epan = ws_epan_new(cf);
/* We need to redissect the packets so we have to discard our old
* packet list store. */
/* Iterate through the list of frames. Call a routine for each frame
to check whether it should be displayed and, if so, add it to
the display list. */
- nstime_set_unset(&first_ts);
- prev_dis = NULL;
- prev_cap = NULL;
- cum_bytes = 0;
+ cf->ref = NULL;
+ cf->prev_dis = NULL;
+ cf->prev_cap = NULL;
+ cf->cum_bytes = 0;
/* Update the progress bar when it gets to this value. */
progbar_nextstep = 0;
selected_frame_seen = FALSE;
frames_count = cf->count;
+
+ epan_dissect_init(&edt, cf->epan, create_proto_tree, FALSE);
+
for (framenum = 1; framenum <= frames_count; framenum++) {
fdata = frame_data_sequence_find(cf->frames, framenum);
* as not visited, free the GSList referring to the state
* data (the per-frame data itself was freed by
* "init_dissection()"), and null out the GSList pointer. */
- fdata->flags.visited = 0;
- frame_data_cleanup(fdata);
+ frame_data_reset(fdata);
frames_count = cf->count;
}
preceding_frame_num = prev_frame_num;
preceding_frame = prev_frame;
}
- add_packet_to_packet_list(fdata, cf, dfcode, create_proto_tree,
- cinfo, &cf->phdr, cf->pd,
+
+ add_packet_to_packet_list(fdata, cf, &edt, dfcode,
+ cinfo, &cf->phdr,
+ buffer_start_ptr(&cf->buf),
add_to_packet_list);
/* If this frame is displayed, and this is the first frame we've
prev_frame = fdata;
}
+ epan_dissect_cleanup(&edt);
+
/* We are done redissecting the packet list. */
cf->redissecting = FALSE;
until it finishes. Should we just stick them with that? */
for (; framenum <= frames_count; framenum++) {
fdata = frame_data_sequence_find(cf->frames, framenum);
- fdata->flags.visited = 0;
- frame_data_cleanup(fdata);
+ frame_data_reset(fdata);
}
}
packet_list_recreate_visible_rows();
/* Compute the time it took to filter the file */
- compute_elapsed(&start_time);
+ compute_elapsed(cf, &start_time);
packet_list_thaw();
{
guint32 framenum;
frame_data *fdata;
+ nstime_t rel_ts;
- nstime_set_unset(&first_ts);
- prev_dis = NULL;
- cum_bytes = 0;
+ cf->ref = NULL;
+ cf->prev_dis = NULL;
+ cf->cum_bytes = 0;
for (framenum = 1; framenum <= cf->count; framenum++) {
fdata = frame_data_sequence_find(cf->frames, framenum);
/* just add some value here until we know if it is being displayed or not */
- fdata->cum_bytes = cum_bytes + fdata->pkt_len;
+ fdata->cum_bytes = cf->cum_bytes + fdata->pkt_len;
/*
*Timestamps
/* If we don't have the time stamp of the first packet in the
capture, it's because this is the first packet. Save the time
stamp of this packet as the time stamp of the first packet. */
- if (nstime_is_unset(&first_ts)) {
- first_ts = fdata->abs_ts;
- }
+ if (cf->ref == NULL)
+ cf->ref = fdata;
/* if this frames is marked as a reference time frame, reset
firstsec and firstusec to this frame */
- if (fdata->flags.ref_time) {
- first_ts = fdata->abs_ts;
- }
+ if (fdata->flags.ref_time)
+ cf->ref = fdata;
/* If we don't have the time stamp of the previous displayed packet,
it's because this is the first displayed packet. Save the time
stamp of this packet as the time stamp of the previous displayed
packet. */
- if (prev_dis == NULL) {
- prev_dis = fdata;
+ if (cf->prev_dis == NULL) {
+ cf->prev_dis = fdata;
}
/* Get the time elapsed between the first packet and this packet. */
- nstime_delta(&fdata->rel_ts, &fdata->abs_ts, &first_ts);
+ fdata->frame_ref_num = (fdata != cf->ref) ? cf->ref->num : 0;
+ nstime_delta(&rel_ts, &fdata->abs_ts, &cf->ref->abs_ts);
/* If it's greater than the current elapsed time, set the elapsed time
to it (we check for "greater than" so as not to be confused by
time moving backwards). */
- if ((gint32)cf->elapsed_time.secs < fdata->rel_ts.secs
- || ((gint32)cf->elapsed_time.secs == fdata->rel_ts.secs && (gint32)cf->elapsed_time.nsecs < fdata->rel_ts.nsecs)) {
- cf->elapsed_time = fdata->rel_ts;
+ if ((gint32)cf->elapsed_time.secs < rel_ts.secs
+ || ((gint32)cf->elapsed_time.secs == rel_ts.secs && (gint32)cf->elapsed_time.nsecs < rel_ts.nsecs)) {
+ cf->elapsed_time = rel_ts;
}
/* If this frame is displayed, get the time elapsed between the
previous displayed packet and this packet. */
if ( fdata->flags.passed_dfilter ) {
- fdata->prev_dis = prev_dis;
- prev_dis = fdata;
+ fdata->prev_dis_num = cf->prev_dis->num;
+ cf->prev_dis = fdata;
}
/*
even if they dont pass the display filter */
if (fdata->flags.ref_time) {
/* if this was a TIME REF frame we should reset the cum_bytes field */
- cum_bytes = fdata->pkt_len;
- fdata->cum_bytes = cum_bytes;
+ cf->cum_bytes = fdata->pkt_len;
+ fdata->cum_bytes = cf->cum_bytes;
} else {
/* increase cum_bytes with this packets length */
- cum_bytes += fdata->pkt_len;
+ cf->cum_bytes += fdata->pkt_len;
}
}
}
{
guint32 framenum;
frame_data *fdata;
- guint8 pd[WTAP_MAX_PACKET_SIZE+1];
+ Buffer buf;
psp_return_t ret = PSP_FINISHED;
progdlg_t *progbar = NULL;
range_process_e process_this;
struct wtap_pkthdr phdr;
+ memset(&phdr, 0, sizeof(struct wtap_pkthdr));
+ buffer_init(&buf, 1500);
+
/* Update the progress bar when it gets to this value. */
progbar_nextstep = 0;
/* When we reach the value that triggers a progress bar update,
}
/* Get the packet */
- if (!cf_read_frame_r(cf, fdata, &phdr, pd)) {
+ if (!cf_read_frame_r(cf, fdata, &phdr, &buf)) {
/* Attempt to get the packet failed. */
ret = PSP_FAILED;
break;
}
/* Process the packet */
- if (!callback(cf, fdata, &phdr, pd, callback_args)) {
+ if (!callback(cf, fdata, &phdr, buffer_start_ptr(&buf), callback_args)) {
/* Callback failed. We assume it reported the error appropriately. */
ret = PSP_FAILED;
break;
if (progbar != NULL)
destroy_progress_dlg(progbar);
+ buffer_free(&buf);
+
return ret;
}
typedef struct {
- gboolean construct_protocol_tree;
+ epan_dissect_t edt;
column_info *cinfo;
} retap_callback_args_t;
struct wtap_pkthdr *phdr, const guint8 *pd,
void *argsp)
{
- retap_callback_args_t *args = argsp;
- epan_dissect_t edt;
+ retap_callback_args_t *args = (retap_callback_args_t *)argsp;
- epan_dissect_init(&edt, args->construct_protocol_tree, FALSE);
- epan_dissect_run_with_taps(&edt, phdr, pd, fdata, args->cinfo);
- epan_dissect_cleanup(&edt);
+ epan_dissect_run_with_taps(&args->edt, phdr, frame_tvbuff_new(fdata, pd), fdata, args->cinfo);
+ epan_dissect_reset(&args->edt);
return TRUE;
}
{
packet_range_t range;
retap_callback_args_t callback_args;
+ gboolean construct_protocol_tree;
gboolean filtering_tap_listeners;
guint tap_flags;
+ psp_return_t ret;
/* Do we have any tap listeners with filters? */
filtering_tap_listeners = have_filtering_tap_listeners();
/* If any tap listeners have filters, or require the protocol tree,
construct the protocol tree. */
- callback_args.construct_protocol_tree = filtering_tap_listeners ||
- (tap_flags & TL_REQUIRES_PROTO_TREE);
+ construct_protocol_tree = filtering_tap_listeners ||
+ (tap_flags & TL_REQUIRES_PROTO_TREE);
/* If any tap listeners require the columns, construct them. */
callback_args.cinfo = (tap_flags & TL_REQUIRES_COLUMNS) ? &cf->cinfo : NULL;
/* Reset the tap listeners. */
reset_tap_listeners();
+ epan_dissect_init(&callback_args.edt, cf->epan, construct_protocol_tree, FALSE);
+
/* Iterate through the list of packets, dissecting all packets and
re-running the taps. */
packet_range_init(&range, cf);
packet_range_process_init(&range);
- switch (process_specified_packets(cf, &range, "Recalculating statistics on",
- "all packets", TRUE, retap_packet,
- &callback_args)) {
+
+ ret = process_specified_packets(cf, &range, "Recalculating statistics on",
+ "all packets", TRUE, retap_packet,
+ &callback_args);
+
+ epan_dissect_cleanup(&callback_args.edt);
+
+ switch (ret) {
case PSP_FINISHED:
/* Completed successfully. */
return CF_READ_OK;
gint *col_widths;
int num_visible_cols;
gint *visible_cols;
+ epan_dissect_t edt;
} print_callback_args_t;
static gboolean
struct wtap_pkthdr *phdr, const guint8 *pd,
void *argsp)
{
- print_callback_args_t *args = argsp;
- epan_dissect_t edt;
+ print_callback_args_t *args = (print_callback_args_t *)argsp;
int i;
char *cp;
int line_len;
int column_len;
int cp_off;
- gboolean proto_tree_needed;
char bookmark_name[9+10+1]; /* "__frameNNNNNNNNNN__\0" */
char bookmark_title[6+10+1]; /* "Frame NNNNNNNNNN__\0" */
- /* Create the protocol tree, and make it visible, if we're printing
- the dissection or the hex data.
- XXX - do we need it if we're just printing the hex data? */
- proto_tree_needed =
- args->print_args->print_dissections != print_dissections_none || args->print_args->print_hex || have_custom_cols(&cf->cinfo);
- epan_dissect_init(&edt, proto_tree_needed, proto_tree_needed);
-
/* Fill in the column information if we're printing the summary
information. */
if (args->print_args->print_summary) {
- col_custom_prime_edt(&edt, &cf->cinfo);
- epan_dissect_run(&edt, phdr, pd, fdata, &cf->cinfo);
- epan_dissect_fill_in_columns(&edt, FALSE, TRUE);
+ col_custom_prime_edt(&args->edt, &cf->cinfo);
+ epan_dissect_run(&args->edt, phdr, frame_tvbuff_new(fdata, pd), fdata, &cf->cinfo);
+ epan_dissect_fill_in_columns(&args->edt, FALSE, TRUE);
} else
- epan_dissect_run(&edt, phdr, pd, fdata, NULL);
+ epan_dissect_run(&args->edt, phdr, frame_tvbuff_new(fdata, pd), fdata, NULL);
if (args->print_formfeed) {
if (!new_page(args->print_args->stream))
g_snprintf(bookmark_name, sizeof bookmark_name, "__frame%u__", fdata->num);
if (args->print_args->print_summary) {
+ if (!args->print_args->print_col_headings)
+ args->print_header_line = FALSE;
if (args->print_header_line) {
if (!print_line(args->print_args->stream, 0, args->header_line_buf))
goto fail;
if (line_len > args->line_buf_len) {
cp_off = (int) (cp - args->line_buf);
args->line_buf_len = 2 * line_len;
- args->line_buf = g_realloc(args->line_buf, args->line_buf_len + 1);
+ args->line_buf = (char *)g_realloc(args->line_buf, args->line_buf_len + 1);
cp = args->line_buf + cp_off;
}
}
/* Print the information in that tree. */
- if (!proto_tree_print(args->print_args, &edt, args->print_args->stream))
+ if (!proto_tree_print(args->print_args, &args->edt, args->print_args->stream))
goto fail;
/* Print a blank line if we print anything after this (aka more than one packet). */
args->print_separator = TRUE;
/* Print a header line if we print any more packet summaries */
- args->print_header_line = TRUE;
+ if (args->print_args->print_col_headings)
+ args->print_header_line = TRUE;
}
if (args->print_args->print_hex) {
goto fail;
}
/* Print the full packet data as hex. */
- if (!print_hex_data(args->print_args->stream, &edt))
+ if (!print_hex_data(args->print_args->stream, &args->edt))
goto fail;
/* Print a blank line if we print anything after this (aka more than one packet). */
args->print_separator = TRUE;
/* Print a header line if we print any more packet summaries */
- args->print_header_line = TRUE;
+ if (args->print_args->print_col_headings)
+ args->print_header_line = TRUE;
} /* if (args->print_args->print_dissections != print_dissections_none) */
- epan_dissect_cleanup(&edt);
+ epan_dissect_reset(&args->edt);
/* do we want to have a formfeed between each packet from now on? */
if (args->print_args->print_formfeed) {
return TRUE;
fail:
- epan_dissect_cleanup(&edt);
+ epan_dissect_reset(&args->edt);
return FALSE;
}
psp_return_t ret;
GList *clp;
fmt_data *cfmt;
+ gboolean proto_tree_needed;
callback_args.print_args = print_args;
- callback_args.print_header_line = TRUE;
+ callback_args.print_header_line = print_args->print_col_headings;
callback_args.header_line_buf = NULL;
callback_args.header_line_buf_len = 256;
callback_args.print_formfeed = FALSE;
callback_args.num_visible_cols = 0;
callback_args.visible_cols = NULL;
- if (!print_preamble(print_args->stream, cf->filename)) {
+ if (!print_preamble(print_args->stream, cf->filename, wireshark_gitversion)) {
destroy_print_stream(print_args->stream);
return CF_PRINT_WRITE_ERROR;
}
if (print_args->print_summary) {
/* We're printing packet summaries. Allocate the header line buffer
and get the column widths. */
- callback_args.header_line_buf = g_malloc(callback_args.header_line_buf_len + 1);
+ callback_args.header_line_buf = (char *)g_malloc(callback_args.header_line_buf_len + 1);
/* Find the number of visible columns and the last visible column */
for (i = 0; i < prefs.num_cols; i++) {
if (line_len > callback_args.header_line_buf_len) {
cp_off = (int) (cp - callback_args.header_line_buf);
callback_args.header_line_buf_len = 2 * line_len;
- callback_args.header_line_buf = g_realloc(callback_args.header_line_buf,
+ callback_args.header_line_buf = (char *)g_realloc(callback_args.header_line_buf,
callback_args.header_line_buf_len + 1);
cp = callback_args.header_line_buf + cp_off;
}
/* Now start out the main line buffer with the same length as the
header line buffer. */
callback_args.line_buf_len = callback_args.header_line_buf_len;
- callback_args.line_buf = g_malloc(callback_args.line_buf_len + 1);
+ callback_args.line_buf = (char *)g_malloc(callback_args.line_buf_len + 1);
} /* if (print_summary) */
+ /* Create the protocol tree, and make it visible, if we're printing
+ the dissection or the hex data.
+ XXX - do we need it if we're just printing the hex data? */
+ proto_tree_needed =
+ callback_args.print_args->print_dissections != print_dissections_none ||
+ callback_args.print_args->print_hex ||
+ have_custom_cols(&cf->cinfo);
+ epan_dissect_init(&callback_args.edt, cf->epan, proto_tree_needed, proto_tree_needed);
+
/* Iterate through the list of packets, printing the packets we were
told to print. */
ret = process_specified_packets(cf, &print_args->range, "Printing",
"selected packets", TRUE, print_packet,
&callback_args);
-
+ epan_dissect_cleanup(&callback_args.edt);
g_free(callback_args.header_line_buf);
g_free(callback_args.line_buf);
g_free(callback_args.col_widths);
return CF_PRINT_OK;
}
+typedef struct {
+ FILE *fh;
+ epan_dissect_t edt;
+} write_packet_callback_args_t;
+
static gboolean
write_pdml_packet(capture_file *cf _U_, frame_data *fdata,
struct wtap_pkthdr *phdr, const guint8 *pd,
void *argsp)
{
- FILE *fh = argsp;
- epan_dissect_t edt;
+ write_packet_callback_args_t *args = (write_packet_callback_args_t *)argsp;
/* Create the protocol tree, but don't fill in the column information. */
- epan_dissect_init(&edt, TRUE, TRUE);
- epan_dissect_run(&edt, phdr, pd, fdata, NULL);
+ epan_dissect_run(&args->edt, phdr, frame_tvbuff_new(fdata, pd), fdata, NULL);
/* Write out the information in that tree. */
- proto_tree_write_pdml(&edt, fh);
+ proto_tree_write_pdml(&args->edt, args->fh);
- epan_dissect_cleanup(&edt);
+ epan_dissect_reset(&args->edt);
- return !ferror(fh);
+ return !ferror(args->fh);
}
cf_print_status_t
cf_write_pdml_packets(capture_file *cf, print_args_t *print_args)
{
+ write_packet_callback_args_t callback_args;
FILE *fh;
psp_return_t ret;
return CF_PRINT_WRITE_ERROR;
}
+ callback_args.fh = fh;
+ epan_dissect_init(&callback_args.edt, cf->epan, TRUE, TRUE);
+
/* Iterate through the list of packets, printing the packets we were
told to print. */
ret = process_specified_packets(cf, &print_args->range, "Writing PDML",
"selected packets", TRUE,
- write_pdml_packet, fh);
+ write_pdml_packet, &callback_args);
+
+ epan_dissect_cleanup(&callback_args.edt);
switch (ret) {
struct wtap_pkthdr *phdr, const guint8 *pd,
void *argsp)
{
- FILE *fh = argsp;
- epan_dissect_t edt;
- gboolean proto_tree_needed;
+ write_packet_callback_args_t *args = (write_packet_callback_args_t *)argsp;
- /* Fill in the column information, only create the protocol tree
- if having custom columns. */
- proto_tree_needed = have_custom_cols(&cf->cinfo);
- epan_dissect_init(&edt, proto_tree_needed, proto_tree_needed);
- col_custom_prime_edt(&edt, &cf->cinfo);
- epan_dissect_run(&edt, phdr, pd, fdata, &cf->cinfo);
- epan_dissect_fill_in_columns(&edt, FALSE, TRUE);
+ col_custom_prime_edt(&args->edt, &cf->cinfo);
+ epan_dissect_run(&args->edt, phdr, frame_tvbuff_new(fdata, pd), fdata, &cf->cinfo);
+ epan_dissect_fill_in_columns(&args->edt, FALSE, TRUE);
/* Write out the information in that tree. */
- proto_tree_write_psml(&edt, fh);
+ proto_tree_write_psml(&args->edt, args->fh);
- epan_dissect_cleanup(&edt);
+ epan_dissect_reset(&args->edt);
- return !ferror(fh);
+ return !ferror(args->fh);
}
cf_print_status_t
cf_write_psml_packets(capture_file *cf, print_args_t *print_args)
{
+ write_packet_callback_args_t callback_args;
FILE *fh;
psp_return_t ret;
+ gboolean proto_tree_needed;
+
fh = ws_fopen(print_args->file, "w");
if (fh == NULL)
return CF_PRINT_OPEN_ERROR; /* attempt to open destination failed */
return CF_PRINT_WRITE_ERROR;
}
+ callback_args.fh = fh;
+
+ /* Fill in the column information, only create the protocol tree
+ if having custom columns. */
+ proto_tree_needed = have_custom_cols(&cf->cinfo);
+ epan_dissect_init(&callback_args.edt, cf->epan, proto_tree_needed, proto_tree_needed);
+
/* Iterate through the list of packets, printing the packets we were
told to print. */
ret = process_specified_packets(cf, &print_args->range, "Writing PSML",
"selected packets", TRUE,
- write_psml_packet, fh);
+ write_psml_packet, &callback_args);
+
+ epan_dissect_cleanup(&callback_args.edt);
switch (ret) {
struct wtap_pkthdr *phdr, const guint8 *pd,
void *argsp)
{
- FILE *fh = argsp;
- epan_dissect_t edt;
- gboolean proto_tree_needed;
+ write_packet_callback_args_t *args = (write_packet_callback_args_t *)argsp;
- /* Fill in the column information, only create the protocol tree
- if having custom columns. */
- proto_tree_needed = have_custom_cols(&cf->cinfo);
- epan_dissect_init(&edt, proto_tree_needed, proto_tree_needed);
- col_custom_prime_edt(&edt, &cf->cinfo);
- epan_dissect_run(&edt, phdr, pd, fdata, &cf->cinfo);
- epan_dissect_fill_in_columns(&edt, FALSE, TRUE);
+ /* Fill in the column information */
+ col_custom_prime_edt(&args->edt, &cf->cinfo);
+ epan_dissect_run(&args->edt, phdr, frame_tvbuff_new(fdata, pd), fdata, &cf->cinfo);
+ epan_dissect_fill_in_columns(&args->edt, FALSE, TRUE);
/* Write out the information in that tree. */
- proto_tree_write_csv(&edt, fh);
+ proto_tree_write_csv(&args->edt, args->fh);
- epan_dissect_cleanup(&edt);
+ epan_dissect_reset(&args->edt);
- return !ferror(fh);
+ return !ferror(args->fh);
}
cf_print_status_t
cf_write_csv_packets(capture_file *cf, print_args_t *print_args)
{
+ write_packet_callback_args_t callback_args;
+ gboolean proto_tree_needed;
FILE *fh;
psp_return_t ret;
return CF_PRINT_WRITE_ERROR;
}
+ callback_args.fh = fh;
+
+ /* only create the protocol tree if having custom columns. */
+ proto_tree_needed = have_custom_cols(&cf->cinfo);
+ epan_dissect_init(&callback_args.edt, cf->epan, proto_tree_needed, proto_tree_needed);
+
/* Iterate through the list of packets, printing the packets we were
told to print. */
ret = process_specified_packets(cf, &print_args->range, "Writing CSV",
"selected packets", TRUE,
- write_csv_packet, fh);
+ write_csv_packet, &callback_args);
+
+ epan_dissect_cleanup(&callback_args.edt);
switch (ret) {
struct wtap_pkthdr *phdr,
const guint8 *pd, void *argsp)
{
- FILE *fh = argsp;
- epan_dissect_t edt;
+ write_packet_callback_args_t *args = (write_packet_callback_args_t *)argsp;
- epan_dissect_init(&edt, TRUE, TRUE);
- epan_dissect_run(&edt, phdr, pd, fdata, NULL);
- proto_tree_write_carrays(fdata->num, fh, &edt);
- epan_dissect_cleanup(&edt);
+ epan_dissect_run(&args->edt, phdr, frame_tvbuff_new(fdata, pd), fdata, NULL);
+ proto_tree_write_carrays(fdata->num, args->fh, &args->edt);
+ epan_dissect_reset(&args->edt);
- return !ferror(fh);
+ return !ferror(args->fh);
}
cf_print_status_t
cf_write_carrays_packets(capture_file *cf, print_args_t *print_args)
{
+ write_packet_callback_args_t callback_args;
FILE *fh;
psp_return_t ret;
return CF_PRINT_WRITE_ERROR;
}
+ callback_args.fh = fh;
+ epan_dissect_init(&callback_args.edt, cf->epan, TRUE, TRUE);
+
/* Iterate through the list of packets, printing the packets we were
told to print. */
ret = process_specified_packets(cf, &print_args->range,
"Writing C Arrays",
"selected packets", TRUE,
- write_carrays_packet, fh);
+ write_carrays_packet, &callback_args);
+
+ epan_dissect_cleanup(&callback_args.edt);
+
switch (ret) {
case PSP_FINISHED:
/* Completed successfully. */
static match_result
match_protocol_tree(capture_file *cf, frame_data *fdata, void *criterion)
{
- match_data *mdata = criterion;
+ match_data *mdata = (match_data *)criterion;
epan_dissect_t edt;
/* Load the frame's data. */
}
/* Construct the protocol tree, including the displayed text */
- epan_dissect_init(&edt, TRUE, TRUE);
+ epan_dissect_init(&edt, cf->epan, TRUE, TRUE);
/* We don't need the column information */
- epan_dissect_run(&edt, &cf->phdr, cf->pd, fdata, NULL);
+ epan_dissect_run(&edt, &cf->phdr, frame_tvbuff_new_buffer(fdata, &cf->buf), fdata, NULL);
/* Iterate through all the nodes, seeing if they have text that matches. */
mdata->cf = cf;
static match_result
match_summary_line(capture_file *cf, frame_data *fdata, void *criterion)
{
- match_data *mdata = criterion;
+ match_data *mdata = (match_data *)criterion;
const gchar *string = mdata->string;
size_t string_len = mdata->string_len;
epan_dissect_t edt;
}
/* Don't bother constructing the protocol tree */
- epan_dissect_init(&edt, FALSE, FALSE);
+ epan_dissect_init(&edt, cf->epan, FALSE, FALSE);
/* Get the column information */
- epan_dissect_run(&edt, &cf->phdr, cf->pd, fdata, &cf->cinfo);
+ epan_dissect_run(&edt, &cf->phdr, frame_tvbuff_new_buffer(fdata, &cf->buf), fdata,
+ &cf->cinfo);
/* Find the Info column */
for (colx = 0; colx < cf->cinfo.num_cols; colx++) {
size_t data_len;
} cbs_t; /* "Counted byte string" */
+
+/*
+ * The current match_* routines only support ASCII case insensitivity and don't
+ * convert UTF-8 inputs to UTF-16 for matching.
+ *
+ * We could modify them to use the GLib Unicode routines or the International
+ * Components for Unicode library but it's not apparent that we could do so
+ * without consuming a lot more CPU and memory or that searching would be
+ * significantly better.
+ */
+
gboolean
cf_find_packet_data(capture_file *cf, const guint8 *string, size_t string_size,
search_direction dir)
/* String search - what type of string? */
switch (cf->scs_type) {
- case SCS_ASCII_AND_UNICODE:
- return find_packet(cf, match_ascii_and_unicode, &info, dir);
+ case SCS_NARROW_AND_WIDE:
+ return find_packet(cf, match_narrow_and_wide, &info, dir);
- case SCS_ASCII:
- return find_packet(cf, match_ascii, &info, dir);
+ case SCS_NARROW:
+ return find_packet(cf, match_narrow, &info, dir);
- case SCS_UNICODE:
- return find_packet(cf, match_unicode, &info, dir);
+ case SCS_WIDE:
+ return find_packet(cf, match_wide, &info, dir);
default:
g_assert_not_reached();
}
static match_result
-match_ascii_and_unicode(capture_file *cf, frame_data *fdata, void *criterion)
+match_narrow_and_wide(capture_file *cf, frame_data *fdata, void *criterion)
{
- cbs_t *info = criterion;
+ cbs_t *info = (cbs_t *)criterion;
const guint8 *ascii_text = info->data;
size_t textlen = info->data_len;
match_result result;
guint32 buf_len;
+ guint8 *pd;
guint32 i;
guint8 c_char;
size_t c_match = 0;
result = MR_NOTMATCHED;
buf_len = fdata->cap_len;
+ pd = buffer_start_ptr(&cf->buf);
i = 0;
while (i < buf_len) {
- c_char = cf->pd[i];
+ c_char = pd[i];
if (cf->case_type)
c_char = toupper(c_char);
if (c_char != '\0') {
}
static match_result
-match_ascii(capture_file *cf, frame_data *fdata, void *criterion)
+match_narrow(capture_file *cf, frame_data *fdata, void *criterion)
{
- cbs_t *info = criterion;
+ guint8 *pd;
+ cbs_t *info = (cbs_t *)criterion;
const guint8 *ascii_text = info->data;
size_t textlen = info->data_len;
match_result result;
result = MR_NOTMATCHED;
buf_len = fdata->cap_len;
+ pd = buffer_start_ptr(&cf->buf);
i = 0;
while (i < buf_len) {
- c_char = cf->pd[i];
+ c_char = pd[i];
if (cf->case_type)
c_char = toupper(c_char);
if (c_char == ascii_text[c_match]) {
}
static match_result
-match_unicode(capture_file *cf, frame_data *fdata, void *criterion)
+match_wide(capture_file *cf, frame_data *fdata, void *criterion)
{
- cbs_t *info = criterion;
+ cbs_t *info = (cbs_t *)criterion;
const guint8 *ascii_text = info->data;
size_t textlen = info->data_len;
match_result result;
guint32 buf_len;
+ guint8 *pd;
guint32 i;
guint8 c_char;
size_t c_match = 0;
result = MR_NOTMATCHED;
buf_len = fdata->cap_len;
+ pd = buffer_start_ptr(&cf->buf);
i = 0;
while (i < buf_len) {
- c_char = cf->pd[i];
+ c_char = pd[i];
if (cf->case_type)
c_char = toupper(c_char);
if (c_char == ascii_text[c_match]) {
static match_result
match_binary(capture_file *cf, frame_data *fdata, void *criterion)
{
- cbs_t *info = criterion;
+ cbs_t *info = (cbs_t *)criterion;
const guint8 *binary_data = info->data;
size_t datalen = info->data_len;
match_result result;
guint32 buf_len;
+ guint8 *pd;
guint32 i;
size_t c_match = 0;
result = MR_NOTMATCHED;
buf_len = fdata->cap_len;
+ pd = buffer_start_ptr(&cf->buf);
i = 0;
while (i < buf_len) {
- if (cf->pd[i] == binary_data[c_match]) {
+ if (pd[i] == binary_data[c_match]) {
c_match += 1;
if (c_match == datalen) {
result = MR_MATCHED;
static match_result
match_dfilter(capture_file *cf, frame_data *fdata, void *criterion)
{
- dfilter_t *sfcode = criterion;
+ dfilter_t *sfcode = (dfilter_t *)criterion;
epan_dissect_t edt;
match_result result;
return MR_ERROR;
}
- epan_dissect_init(&edt, TRUE, FALSE);
+ epan_dissect_init(&edt, cf->epan, TRUE, FALSE);
epan_dissect_prime_dfilter(&edt, sfcode);
- epan_dissect_run(&edt, &cf->phdr, cf->pd, fdata, NULL);
+ epan_dissect_run(&edt, &cf->phdr, frame_tvbuff_new_buffer(fdata, &cf->buf), fdata, NULL);
result = dfilter_apply_edt(sfcode, &edt) ? MR_MATCHED : MR_NOTMATCHED;
epan_dissect_cleanup(&edt);
return result;
old_edt = cf->edt;
/* Create the logical protocol tree. */
/* We don't need the columns here. */
- cf->edt = epan_dissect_new(TRUE, TRUE);
+ cf->edt = epan_dissect_new(cf->epan, TRUE, TRUE);
tap_build_interesting(cf->edt);
- epan_dissect_run(cf->edt, &cf->phdr, cf->pd, cf->current_frame,
- NULL);
+ epan_dissect_run(cf->edt, &cf->phdr, frame_tvbuff_new_buffer(cf->current_frame, &cf->buf),
+ cf->current_frame, NULL);
dfilter_macro_build_ftv_cache(cf->edt->tree);
cf->unsaved_changes = TRUE;
}
-void
-cf_update_packet_comment(capture_file *cf, frame_data *fdata, gchar *comment)
+static const char *
+cf_get_user_packet_comment(capture_file *cf, const frame_data *fd)
{
- if (fdata->opt_comment != NULL) {
- /* OK, remove the old comment. */
- g_free(fdata->opt_comment);
- fdata->opt_comment = NULL;
- cf->packet_comment_count--;
+ if (cf->frames_user_comments)
+ return (const char *)g_tree_lookup(cf->frames_user_comments, fd);
+
+ /* g_warning? */
+ return NULL;
+}
+
+char *
+cf_get_comment(capture_file *cf, const frame_data *fd)
+{
+ /* fetch user comment */
+ if (fd->flags.has_user_comment)
+ return g_strdup(cf_get_user_packet_comment(cf, fd));
+
+ /* fetch phdr comment */
+ if (fd->flags.has_phdr_comment) {
+ struct wtap_pkthdr phdr; /* Packet header */
+ Buffer buf; /* Packet data */
+
+ phdr.opt_comment = NULL;
+
+ buffer_init(&buf, 1500);
+ if (!cf_read_frame_r(cf, fd, &phdr, &buf))
+ { /* XXX, what we can do here? */ }
+
+ buffer_free(&buf);
+ return phdr.opt_comment;
}
- if (comment != NULL) {
- /* Add the new comment. */
- fdata->opt_comment = comment;
- cf->packet_comment_count++;
+ return NULL;
+}
+
+static int
+frame_cmp(gconstpointer a, gconstpointer b, gpointer user_data _U_)
+{
+ const frame_data *fdata1 = (const frame_data *) a;
+ const frame_data *fdata2 = (const frame_data *) b;
+
+ return (fdata1->num < fdata2->num) ? -1 :
+ (fdata1->num > fdata2->num) ? 1 :
+ 0;
+}
+
+gboolean
+cf_set_user_packet_comment(capture_file *cf, frame_data *fd, const gchar *new_comment)
+{
+ char *pkt_comment = cf_get_comment(cf, fd);
+
+ /* Check if the comment has changed */
+ if (!g_strcmp0(pkt_comment, new_comment)) {
+ g_free(pkt_comment);
+ return FALSE;
}
+ g_free(pkt_comment);
+
+ if (pkt_comment)
+ cf->packet_comment_count--;
+
+ if (new_comment)
+ cf->packet_comment_count++;
+
+ fd->flags.has_user_comment = TRUE;
+
+ if (!cf->frames_user_comments)
+ cf->frames_user_comments = g_tree_new_full(frame_cmp, NULL, NULL, g_free);
+
+ /* insert new packet comment */
+ g_tree_replace(cf->frames_user_comments, fd, g_strdup(new_comment));
+
+ expert_update_comment_count(cf->packet_comment_count);
/* OK, we have unsaved changes. */
cf->unsaved_changes = TRUE;
+ return TRUE;
}
/*
- * Does this capture file have any comments?
+ * What types of comments does this capture file have?
*/
-gboolean
-cf_has_comments(capture_file *cf)
+guint32
+cf_comment_types(capture_file *cf)
{
- return (cf_read_shb_comment(cf) != NULL || cf->packet_comment_count != 0);
+ guint32 comment_types = 0;
+
+ if (cf_read_shb_comment(cf) != NULL)
+ comment_types |= WTAP_COMMENT_PER_SECTION;
+ if (cf->packet_comment_count != 0)
+ comment_types |= WTAP_COMMENT_PER_PACKET;
+ return comment_types;
}
typedef struct {
struct wtap_pkthdr *phdr, const guint8 *pd,
void *argsp)
{
- save_callback_args_t *args = argsp;
+ save_callback_args_t *args = (save_callback_args_t *)argsp;
struct wtap_pkthdr hdr;
int err;
gchar *display_basename;
+ const char *pkt_comment;
+
+ if (fdata->flags.has_user_comment)
+ pkt_comment = cf_get_user_packet_comment(cf, fdata);
+ else
+ pkt_comment = phdr->opt_comment;
/* init the wtap header for saving */
/* TODO: reuse phdr */
hdr.presence_flags = 0;
if (fdata->flags.has_ts)
hdr.presence_flags |= WTAP_HAS_TS;
- if (fdata->flags.has_if_id)
+ if (phdr->presence_flags & WTAP_HAS_INTERFACE_ID)
hdr.presence_flags |= WTAP_HAS_INTERFACE_ID;
+ if (phdr->presence_flags & WTAP_HAS_PACK_FLAGS)
+ hdr.presence_flags |= WTAP_HAS_PACK_FLAGS;
hdr.ts.secs = fdata->abs_ts.secs;
hdr.ts.nsecs = fdata->abs_ts.nsecs;
hdr.caplen = fdata->cap_len;
hdr.len = fdata->pkt_len;
hdr.pkt_encap = fdata->lnk_t;
/* pcapng */
- hdr.interface_id = fdata->interface_id; /* identifier of the interface. */
+ hdr.interface_id = phdr->interface_id; /* identifier of the interface. */
/* options */
- hdr.opt_comment = fdata->opt_comment; /* NULL if not available */
+ hdr.pack_flags = phdr->pack_flags;
+ hdr.opt_comment = g_strdup(pkt_comment);
+
/* pseudo */
hdr.pseudo_header = phdr->pseudo_header;
#if 0
case WTAP_ERR_UNSUPPORTED_ENCAP:
/*
- * This is a problem with the particular frame we're writing;
- * note that, and give the frame number.
+ * This is a problem with the particular frame we're writing and
+ * the file type and subtype we're writing; note that, and report
+ * the frame number and file type/subtype.
*/
simple_error_message_box(
"Frame %u has a network type that can't be saved in a \"%s\" file.",
- fdata->num, wtap_file_type_string(args->file_type));
+ fdata->num, wtap_file_type_subtype_string(args->file_type));
+ break;
+
+ case WTAP_ERR_PACKET_TOO_LARGE:
+ /*
+ * This is a problem with the particular frame we're writing and
+ * the file type and subtype we're writing; note that, and report
+ * the frame number and file type/subtype.
+ */
+ simple_error_message_box(
+ "Frame %u is larger than Wireshark supports in a \"%s\" file.",
+ fdata->num, wtap_file_type_subtype_string(args->file_type));
break;
default:
}
return FALSE;
}
+
+ g_free(hdr.opt_comment);
return TRUE;
}
gboolean
cf_can_write_with_wiretap(capture_file *cf)
{
- int ft;
-
- for (ft = 0; ft < WTAP_NUM_FILE_TYPES; ft++) {
- /* To save a file with Wiretap, Wiretap has to handle that format,
- and its code to handle that format must be able to write a file
- with this file's encapsulation types. */
- if (wtap_dump_can_write_encaps(ft, cf->linktypes)) {
- /* OK, we can write it out in this type. */
- return TRUE;
- }
+ /* We don't care whether we support the comments in this file or not;
+ if we can't, we'll offer the user the option of discarding the
+ comments. */
+ return wtap_dump_can_write(cf->linktypes, 0);
+}
+
+/*
+ * Should we let the user do a save?
+ *
+ * We should if:
+ *
+ * the file has unsaved changes, and we can save it in some
+ * format through Wiretap
+ *
+ * or
+ *
+ * the file is a temporary file and has no unsaved changes (so
+ * that "saving" it just means copying it).
+ *
+ * XXX - we shouldn't allow files to be edited if they can't be saved,
+ * so cf->unsaved_changes should be true only if the file can be saved.
+ *
+ * We don't care whether we support the comments in this file or not;
+ * if we can't, we'll offer the user the option of discarding the
+ * comments.
+ */
+gboolean
+cf_can_save(capture_file *cf)
+{
+ if (cf->unsaved_changes && wtap_dump_can_write(cf->linktypes, 0)) {
+ /* Saved changes, and we can write it out with Wiretap. */
+ return TRUE;
+ }
+
+ if (cf->is_tempfile && !cf->unsaved_changes) {
+ /*
+ * Temporary file with no unsaved changes, so we can just do a
+ * raw binary copy.
+ */
+ return TRUE;
+ }
+
+ /* Nothing to save. */
+ return FALSE;
+}
+
+/*
+ * Should we let the user do a "save as"?
+ *
+ * That's true if:
+ *
+ * we can save it in some format through Wiretap
+ *
+ * or
+ *
+ * the file is a temporary file and has no unsaved changes (so
+ * that "saving" it just means copying it).
+ *
+ * XXX - we shouldn't allow files to be edited if they can't be saved,
+ * so cf->unsaved_changes should be true only if the file can be saved.
+ *
+ * We don't care whether we support the comments in this file or not;
+ * if we can't, we'll offer the user the option of discarding the
+ * comments.
+ */
+gboolean
+cf_can_save_as(capture_file *cf)
+{
+ if (wtap_dump_can_write(cf->linktypes, 0)) {
+ /* We can write it out with Wiretap. */
+ return TRUE;
+ }
+
+ if (cf->is_tempfile && !cf->unsaved_changes) {
+ /*
+ * Temporary file with no unsaved changes, so we can just do a
+ * raw binary copy.
+ */
+ return TRUE;
}
- /* No, we couldn't save it in any format. */
+ /* Nothing to save. */
return FALSE;
}
+/*
+ * Does this file have unsaved data?
+ */
+gboolean
+cf_has_unsaved_data(capture_file *cf)
+{
+ /*
+ * If this is a temporary file, or a file with unsaved changes, it
+ * has unsaved data.
+ */
+ return cf->is_tempfile || cf->unsaved_changes;
+}
+
/*
* Quick scan to find packet offsets.
*/
/* No user changes yet. */
cf->unsaved_changes = FALSE;
- cf->cd_t = wtap_file_type(cf->wth);
+ cf->cd_t = wtap_file_type_subtype(cf->wth);
cf->linktypes = g_array_sized_new(FALSE, FALSE, (guint) sizeof(int), 1);
cf->snap = wtap_snapshot_length(cf->wth);
progbar_quantum = MIN_QUANTUM;
}else
progbar_quantum = 0;
- /* Progress so far. */
- progbar_val = 0.0f;
stop_flag = FALSE;
g_get_current_time(&start_time);
wtap_sequential_close(cf->wth);
/* compute the time it took to load the file */
- compute_elapsed(&start_time);
+ compute_elapsed(cf, &start_time);
/* Set the file encapsulation type now; we don't know what it is until
we've looked at all the packets, as we don't know until then whether
gboolean compressed, gboolean discard_comments,
gboolean dont_reopen)
{
- gchar *fname_new = NULL;
- int err;
- gchar *err_info;
+ gchar *err_info;
+ gchar *fname_new = NULL;
+ wtap_dumper *pdh;
+ frame_data *fdata;
+ addrinfo_lists_t *addr_lists;
+ guint framenum;
+ int err;
+#ifdef _WIN32
+ gchar *display_basename;
+#endif
enum {
SAVE_WITH_MOVE,
SAVE_WITH_COPY,
SAVE_WITH_WTAP
- } how_to_save;
- wtap_dumper *pdh;
+ } how_to_save;
save_callback_args_t callback_args;
-#ifdef _WIN32
- gchar *display_basename;
-#endif
- guint framenum;
- frame_data *fdata;
cf_callback_invoke(cf_cb_file_save_started, (gpointer)fname);
+ addr_lists = get_addrinfo_list();
+
if (save_format == cf->cd_t && compressed == cf->iscompressed
- && !discard_comments && !cf->unsaved_changes) {
+ && !discard_comments && !cf->unsaved_changes
+ && !(addr_lists && wtap_dump_has_name_resolution(save_format))) {
/* We're saving in the format it's already in, and we're
not discarding comments, and there are no changes we have
- in memory that aren't saved to the file, so we can just move
- or copy the raw data. */
+ in memory that aren't saved to the file, and we have no name
+ resolution blocks to write, so we can just move or copy the raw data. */
if (cf->is_tempfile) {
/* The file being saved is a temporary file from a live
}
/* Add address resolution */
- wtap_dump_set_addrinfo_list(pdh, get_addrinfo_list());
+ wtap_dump_set_addrinfo_list(pdh, addr_lists);
/* Iterate through the list of packets, processing all the packets. */
callback_args.pdh = pdh;
/* Remove SHB comment, if any. */
wtap_write_shb_comment(cf->wth, NULL);
- /* Remove packet comments. */
+ /* remove all user comments */
for (framenum = 1; framenum <= cf->count; framenum++) {
fdata = frame_data_sequence_find(cf->frames, framenum);
- if (fdata->opt_comment) {
- g_free(fdata->opt_comment);
- fdata->opt_comment = NULL;
- cf->packet_comment_count--;
- }
+
+ fdata->flags.has_phdr_comment = FALSE;
+ fdata->flags.has_user_comment = FALSE;
+ }
+
+ if (cf->frames_user_comments) {
+ g_tree_destroy(cf->frames_user_comments);
+ cf->frames_user_comments = NULL;
}
+
+ cf->packet_comment_count = 0;
}
}
return CF_WRITE_OK;
simple_error_message_box(
"The file \"%s\" is a pipe, and %s capture files can't be "
"written to a pipe.",
- display_basename, wtap_file_type_string(file_type));
+ display_basename, wtap_file_type_subtype_string(file_type));
break;
case WTAP_ERR_UNSUPPORTED_FILE_TYPE:
git.samba.org / metze / wireshark / wip.git / blobdiff