#include <locale.h>
#include <limits.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-
#ifdef HAVE_GETOPT_H
#include <getopt.h>
#endif
#include <errno.h>
-#ifdef HAVE_FCNTL_H
-#include <fcntl.h>
-#endif
-
-#ifdef HAVE_SYS_STAT_H
-# include <sys/stat.h>
-#endif
-
-#ifdef HAVE_LIBZ
-#include <zlib.h> /* to get the libz version number */
-#endif
-
#ifndef HAVE_GETOPT_LONG
#include "wsutil/wsgetopt.h"
#endif
#include <wsutil/clopts_common.h>
#include <wsutil/cmdarg_err.h>
#include <wsutil/crash_info.h>
-#include <wsutil/privileges.h>
-#include <wsutil/file_util.h>
#include <wsutil/filesystem.h>
-#include <wsutil/report_err.h>
-#include <wsutil/ws_version_info.h>
+#include <wsutil/file_util.h>
+#include <wsutil/privileges.h>
+#include <wsutil/report_message.h>
+#include <ws_version_info.h>
#include "globals.h"
#include <epan/timestamp.h>
#include <epan/print.h>
#include <epan/addr_resolv.h>
#include "ui/util.h"
+#include "ui/decode_as_utils.h"
+#include "ui/dissect_opts.h"
#include "register.h"
#include <epan/epan_dissect.h>
#include <epan/tap.h>
#include <epan/stat_tap_ui.h>
#include <epan/ex-opt.h>
-#if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
-#include <epan/asn1.h>
-#include <epan/dissectors/packet-kerberos.h>
+#ifdef HAVE_EXTCAP
+#include "extcap.h"
#endif
#include <wiretap/wtap-int.h>
#include <wsutil/plugins.h>
#endif
-/*
- * This is the template for the decode as option; it is shared between the
- * various functions that output the usage for this parameter.
- */
-static const gchar decode_as_arg_template[] = "<layer_type>==<selector>,<decode_as_protocol>";
+#define INVALID_OPTION 1
+#define INIT_ERROR 2
+#define INVALID_FILTER 2
+#define OPEN_ERROR 2
static guint32 cum_bytes;
static const frame_data *ref;
static frame_data *prev_cap;
static frame_data prev_cap_frame;
-static const char* prev_display_dissector_name = NULL;
-
static gboolean perform_two_pass_analysis;
/*
/* The line separator used between packets, changeable via the -S option */
static const char *separator = "";
-static int load_cap_file(capture_file *, int, gint64);
-static gboolean process_packet(capture_file *cf, epan_dissect_t *edt, gint64 offset,
- struct wtap_pkthdr *whdr, const guchar *pd, guint tap_flags);
+static gboolean process_file(capture_file *, int, gint64);
+static gboolean process_packet_single_pass(capture_file *cf,
+ epan_dissect_t *edt, gint64 offset, struct wtap_pkthdr *whdr,
+ const guchar *pd, guint tap_flags);
static void show_print_file_io_error(int err);
static gboolean write_preamble(capture_file *cf);
static gboolean print_packet(capture_file *cf, epan_dissect_t *edt);
static const char *cf_open_error_message(int err, gchar *err_info,
gboolean for_writing, int file_type);
+static void failure_warning_message(const char *msg_format, va_list ap);
static void open_failure_message(const char *filename, int err,
gboolean for_writing);
-static void failure_message(const char *msg_format, va_list ap);
static void read_failure_message(const char *filename, int err);
static void write_failure_message(const char *filename, int err);
static void failure_message_cont(const char *msg_format, va_list ap);
/*fprintf(output, "\n");*/
fprintf(output, "Input file:\n");
- fprintf(output, " -r <infile> set the filename to read from (no pipes or stdin!)\n");
+ fprintf(output, " -r <infile> set the filename to read from (no pipes or stdin)\n");
fprintf(output, "\n");
fprintf(output, "Processing:\n");
fprintf(output, " -2 perform a two-pass analysis\n");
fprintf(output, " -R <read filter> packet Read filter in Wireshark display filter syntax\n");
+ fprintf(output, " (requires -2)\n");
fprintf(output, " -Y <display filter> packet displaY filter in Wireshark display filter\n");
fprintf(output, " syntax\n");
- fprintf(output, " -d %s ...\n", decode_as_arg_template);
+ fprintf(output, " -d %s ...\n", DECODE_AS_ARG_TEMPLATE);
fprintf(output, " \"Decode As\", see the man page for details\n");
fprintf(output, " Example: tcp.port==8888,http\n");
fprintf(output, "\n");
}
-/*
- * For a dissector table, print on the stream described by output,
- * its short name (which is what's used in the "-d" option) and its
- * descriptive name.
- */
-static void
-display_dissector_table_names(const char *table_name, const char *ui_name,
- gpointer output)
-{
- if ((prev_display_dissector_name == NULL) ||
- (strcmp(prev_display_dissector_name, table_name) != 0)) {
- fprintf((FILE *)output, "\t%s (%s)\n", table_name, ui_name);
- prev_display_dissector_name = table_name;
- }
-}
-
-/*
- * For a dissector handle, print on the stream described by output,
- * the filter name (which is what's used in the "-d" option) and the full
- * name for the protocol that corresponds to this handle.
- */
-static void
-display_dissector_names(const gchar *table _U_, gpointer handle, gpointer output)
-{
- int proto_id;
- const gchar *proto_filter_name;
- const gchar *proto_ui_name;
-
- proto_id = dissector_handle_get_protocol_index((dissector_handle_t)handle);
-
- if (proto_id != -1) {
- proto_filter_name = proto_get_protocol_filter_name(proto_id);
- proto_ui_name = proto_get_protocol_name(proto_id);
- g_assert(proto_filter_name != NULL);
- g_assert(proto_ui_name != NULL);
-
- if ((prev_display_dissector_name == NULL) ||
- (strcmp(prev_display_dissector_name, proto_filter_name) != 0)) {
- fprintf((FILE *)output, "\t%s (%s)\n",
- proto_filter_name,
- proto_ui_name);
- prev_display_dissector_name = proto_filter_name;
- }
- }
-}
-
-/*
- * The protocol_name_search structure is used by find_protocol_name_func()
- * to pass parameters and store results
- */
-struct protocol_name_search{
- gchar *searched_name; /* Protocol filter name we are looking for */
- dissector_handle_t matched_handle; /* Handle for a dissector whose protocol has the specified filter name */
- guint nb_match; /* How many dissectors matched searched_name */
-};
-typedef struct protocol_name_search *protocol_name_search_t;
-
-/*
- * This function parses all dissectors associated with a table to find the
- * one whose protocol has the specified filter name. It is called
- * as a reference function in a call to dissector_table_foreach_handle.
- * The name we are looking for, as well as the results, are stored in the
- * protocol_name_search struct pointed to by user_data.
- * If called using dissector_table_foreach_handle, we actually parse the
- * whole list of dissectors.
- */
-static void
-find_protocol_name_func(const gchar *table _U_, gpointer handle, gpointer user_data)
-
-{
- int proto_id;
- const gchar *protocol_filter_name;
- protocol_name_search_t search_info;
-
- g_assert(handle);
-
- search_info = (protocol_name_search_t)user_data;
-
- proto_id = dissector_handle_get_protocol_index((dissector_handle_t)handle);
- if (proto_id != -1) {
- protocol_filter_name = proto_get_protocol_filter_name(proto_id);
- g_assert(protocol_filter_name != NULL);
- if (strcmp(protocol_filter_name, search_info->searched_name) == 0) {
- /* Found a match */
- if (search_info->nb_match == 0) {
- /* Record this handle only if this is the first match */
- search_info->matched_handle = (dissector_handle_t)handle; /* Record the handle for this matching dissector */
- }
- search_info->nb_match++;
- }
- }
-}
-
-/*
- * Allow dissector key names to be sorted alphabetically
- */
-
-static gint
-compare_dissector_key_name(gconstpointer dissector_a, gconstpointer dissector_b)
-{
- return strcmp((const char*)dissector_a, (const char*)dissector_b);
-}
-
-/*
- * Print all layer type names supported.
- * We send the output to the stream described by the handle output.
- */
-
-static void
-fprint_all_layer_types(FILE *output)
-
-{
- prev_display_dissector_name = NULL;
- dissector_all_tables_foreach_table(display_dissector_table_names, (gpointer)output, (GCompareFunc)compare_dissector_key_name);
-}
-
-/*
- * Print all protocol names supported for a specific layer type.
- * table_name contains the layer type name in which the search is performed.
- * We send the output to the stream described by the handle output.
- */
-
-static void
-fprint_all_protocols_for_layer_types(FILE *output, gchar *table_name)
-
-{
- prev_display_dissector_name = NULL;
- dissector_table_foreach_handle(table_name,
- display_dissector_names,
- (gpointer)output);
-}
-
-/*
- * The function below parses the command-line parameters for the decode as
- * feature (a string pointer by cl_param).
- * It checks the format of the command-line, searches for a matching table
- * and dissector. If a table/dissector match is not found, we display a
- * summary of the available tables/dissectors (on stderr) and return FALSE.
- * If everything is fine, we get the "Decode as" preference activated,
- * then we return TRUE.
- */
-static gboolean
-add_decode_as(const gchar *cl_param)
-{
- gchar *table_name;
- guint32 selector, selector2;
- gchar *decoded_param;
- gchar *remaining_param;
- gchar *selector_str;
- gchar *dissector_str;
- dissector_handle_t dissector_matching;
- dissector_table_t table_matching;
- ftenum_t dissector_table_selector_type;
- struct protocol_name_search user_protocol_name;
- guint64 i;
- char op;
-
- /* The following code will allocate and copy the command-line options in a string pointed by decoded_param */
-
- g_assert(cl_param);
- decoded_param = g_strdup(cl_param);
- g_assert(decoded_param);
-
-
- /* The lines below will parse this string (modifying it) to extract all
- necessary information. Note that decoded_param is still needed since
- strings are not copied - we just save pointers. */
-
- /* This section extracts a layer type (table_name) from decoded_param */
- table_name = decoded_param; /* Layer type string starts from beginning */
-
- remaining_param = strchr(table_name, '=');
- if (remaining_param == NULL) {
- cmdarg_err("Parameter \"%s\" doesn't follow the template \"%s\"", cl_param, decode_as_arg_template);
- /* If the argument does not follow the template, carry on anyway to check
- if the table name is at least correct. If remaining_param is NULL,
- we'll exit anyway further down */
- }
- else {
- *remaining_param = '\0'; /* Terminate the layer type string (table_name) where '=' was detected */
- }
-
- /* Remove leading and trailing spaces from the table name */
- while ( table_name[0] == ' ' )
- table_name++;
- while ( table_name[strlen(table_name) - 1] == ' ' )
- table_name[strlen(table_name) - 1] = '\0'; /* Note: if empty string, while loop will eventually exit */
-
-/* The following part searches a table matching with the layer type specified */
- table_matching = NULL;
-
-/* Look for the requested table */
- if ( !(*(table_name)) ) { /* Is the table name empty, if so, don't even search for anything, display a message */
- cmdarg_err("No layer type specified"); /* Note, we don't exit here, but table_matching will remain NULL, so we exit below */
- }
- else {
- table_matching = find_dissector_table(table_name);
- if (!table_matching) {
- cmdarg_err("Unknown layer type -- %s", table_name); /* Note, we don't exit here, but table_matching will remain NULL, so we exit below */
- }
- }
-
- if (!table_matching) {
- /* Display a list of supported layer types to help the user, if the
- specified layer type was not found */
- cmdarg_err("Valid layer types are:");
- fprint_all_layer_types(stderr);
- }
- if (remaining_param == NULL || !table_matching) {
- /* Exit if the layer type was not found, or if no '=' separator was found
- (see above) */
- g_free(decoded_param);
- return FALSE;
- }
-
- if (*(remaining_param + 1) != '=') { /* Check for "==" and not only '=' */
- cmdarg_err("WARNING: -d requires \"==\" instead of \"=\". Option will be treated as \"%s==%s\"", table_name, remaining_param + 1);
- }
- else {
- remaining_param++; /* Move to the second '=' */
- *remaining_param = '\0'; /* Remove the second '=' */
- }
- remaining_param++; /* Position after the layer type string */
-
- /* This section extracts a selector value (selector_str) from decoded_param */
-
- selector_str = remaining_param; /* Next part starts with the selector number */
-
- remaining_param = strchr(selector_str, ',');
- if (remaining_param == NULL) {
- cmdarg_err("Parameter \"%s\" doesn't follow the template \"%s\"", cl_param, decode_as_arg_template);
- /* If the argument does not follow the template, carry on anyway to check
- if the selector value is at least correct. If remaining_param is NULL,
- we'll exit anyway further down */
- }
- else {
- *remaining_param = '\0'; /* Terminate the selector number string (selector_str) where ',' was detected */
- }
-
- dissector_table_selector_type = get_dissector_table_selector_type(table_name);
-
- switch (dissector_table_selector_type) {
-
- case FT_UINT8:
- case FT_UINT16:
- case FT_UINT24:
- case FT_UINT32:
- /* The selector for this table is an unsigned number. Parse it as such.
- There's no need to remove leading and trailing spaces from the
- selector number string, because sscanf will do that for us. */
- switch (sscanf(selector_str, "%u%c%u", &selector, &op, &selector2)) {
- case 1:
- op = '\0';
- break;
- case 3:
- if (op != ':' && op != '-') {
- cmdarg_err("Invalid selector numeric range \"%s\"", selector_str);
- g_free(decoded_param);
- return FALSE;
- }
- if (op == ':') {
- if ((selector2 == 0) || ((guint64)selector + selector2 - 1) > G_MAXUINT32) {
- cmdarg_err("Invalid selector numeric range \"%s\"", selector_str);
- g_free(decoded_param);
- return FALSE;
- }
- }
- else if (selector2 < selector) {
- /* We could swap them for the user, but maybe it's better to call
- * this out as an error in case it's not what was intended? */
- cmdarg_err("Invalid selector numeric range \"%s\"", selector_str);
- g_free(decoded_param);
- return FALSE;
- }
- break;
- default:
- cmdarg_err("Invalid selector number \"%s\"", selector_str);
- g_free(decoded_param);
- return FALSE;
- }
- break;
-
- case FT_STRING:
- case FT_STRINGZ:
- case FT_UINT_STRING:
- case FT_STRINGZPAD:
- /* The selector for this table is a string. */
- break;
-
- default:
- /* There are currently no dissector tables with any types other
- than the ones listed above. */
- g_assert_not_reached();
- }
-
- if (remaining_param == NULL) {
- /* Exit if no ',' separator was found (see above) */
- cmdarg_err("Valid protocols for layer type \"%s\" are:", table_name);
- fprint_all_protocols_for_layer_types(stderr, table_name);
- g_free(decoded_param);
- return FALSE;
- }
-
- remaining_param++; /* Position after the selector number string */
-
- /* This section extracts a protocol filter name (dissector_str) from decoded_param */
-
- dissector_str = remaining_param; /* All the rest of the string is the dissector (decode as protocol) name */
-
- /* Remove leading and trailing spaces from the dissector name */
- while ( dissector_str[0] == ' ' )
- dissector_str++;
- while ( dissector_str[strlen(dissector_str) - 1] == ' ' )
- dissector_str[strlen(dissector_str) - 1] = '\0'; /* Note: if empty string, while loop will eventually exit */
-
- dissector_matching = NULL;
-
- /* We now have a pointer to the handle for the requested table inside the variable table_matching */
- if ( ! (*dissector_str) ) { /* Is the dissector name empty, if so, don't even search for a matching dissector and display all dissectors found for the selected table */
- cmdarg_err("No protocol name specified"); /* Note, we don't exit here, but dissector_matching will remain NULL, so we exit below */
- }
- else {
- user_protocol_name.nb_match = 0;
- user_protocol_name.searched_name = dissector_str;
- user_protocol_name.matched_handle = NULL;
-
- dissector_table_foreach_handle(table_name, find_protocol_name_func, &user_protocol_name); /* Go and perform the search for this dissector in the this table's dissectors' names and shortnames */
-
- if (user_protocol_name.nb_match != 0) {
- dissector_matching = user_protocol_name.matched_handle;
- if (user_protocol_name.nb_match > 1) {
- cmdarg_err("WARNING: Protocol \"%s\" matched %u dissectors, first one will be used", dissector_str, user_protocol_name.nb_match);
- }
- }
- else {
- /* OK, check whether the problem is that there isn't any such
- protocol, or that there is but it's not specified as a protocol
- that's valid for that dissector table.
- Note, we don't exit here, but dissector_matching will remain NULL,
- so we exit below */
- if (proto_get_id_by_filter_name(dissector_str) == -1) {
- /* No such protocol */
- cmdarg_err("Unknown protocol -- \"%s\"", dissector_str);
- } else {
- cmdarg_err("Protocol \"%s\" isn't valid for layer type \"%s\"",
- dissector_str, table_name);
- }
- }
- }
-
- if (!dissector_matching) {
- cmdarg_err("Valid protocols for layer type \"%s\" are:", table_name);
- fprint_all_protocols_for_layer_types(stderr, table_name);
- g_free(decoded_param);
- return FALSE;
- }
-
-/* This is the end of the code that parses the command-line options.
- All information is now stored in the variables:
- table_name
- selector
- dissector_matching
- The above variables that are strings are still pointing to areas within
- decoded_parm. decoded_parm thus still needs to be kept allocated in
- until we stop needing these variables
- decoded_param will be deallocated at each exit point of this function */
-
-
- /* We now have a pointer to the handle for the requested dissector
- (requested protocol) inside the variable dissector_matching */
- switch (dissector_table_selector_type) {
-
- case FT_UINT8:
- case FT_UINT16:
- case FT_UINT24:
- case FT_UINT32:
- /* The selector for this table is an unsigned number. */
- if (op == '\0') {
- dissector_change_uint(table_name, selector, dissector_matching);
- } else if (op == ':') {
- for (i = selector; i < (guint64)selector + selector2; i++) {
- dissector_change_uint(table_name, (guint32)i, dissector_matching);
- }
- } else { /* op == '-' */
- for (i = selector; i <= selector2; i++) {
- dissector_change_uint(table_name, (guint32)i, dissector_matching);
- }
- }
- break;
-
- case FT_STRING:
- case FT_STRINGZ:
- case FT_UINT_STRING:
- case FT_STRINGZPAD:
- /* The selector for this table is a string. */
- dissector_change_string(table_name, selector_str, dissector_matching);
- break;
-
- default:
- /* There are currently no dissector tables with any types other
- than the ones listed above. */
- g_assert_not_reached();
- }
- g_free(decoded_param); /* "Decode As" rule has been successfully added */
- return TRUE;
-}
-
static void
tfshark_log_handler (const gchar *log_domain, GLogLevelFlags log_level,
const gchar *message, gpointer user_data)
}
}
-static void
-get_tfshark_compiled_version_info(GString *str)
-{
- /* LIBZ */
-#ifdef HAVE_LIBZ
- g_string_append(str, "with libz ");
-#ifdef ZLIB_VERSION
- g_string_append(str, ZLIB_VERSION);
-#else /* ZLIB_VERSION */
- g_string_append(str, "(version unknown)");
-#endif /* ZLIB_VERSION */
-#else /* HAVE_LIBZ */
- g_string_append(str, "without libz");
-#endif /* HAVE_LIBZ */
-}
-
static void
get_tfshark_runtime_version_info(GString *str)
{
- /* zlib */
-#if defined(HAVE_LIBZ) && !defined(_WIN32)
- g_string_append_printf(str, ", with libz %s", zlibVersion());
-#endif
-
/* stuff used by libwireshark */
epan_get_runtime_version_info(str);
}
char *init_progfile_dir_error;
int opt;
static const struct option long_options[] = {
- {(char *)"help", no_argument, NULL, 'h'},
- {(char *)"version", no_argument, NULL, 'v'},
+ {"help", no_argument, NULL, 'h'},
+ {"version", no_argument, NULL, 'v'},
{0, 0, 0, 0 }
};
gboolean arg_error = FALSE;
- char *gpf_path, *pf_path;
- char *gdp_path, *dp_path;
- int gpf_open_errno, gpf_read_errno;
- int pf_open_errno, pf_read_errno;
- int gdp_open_errno, gdp_read_errno;
- int dp_open_errno, dp_read_errno;
int err;
+ volatile gboolean success;
volatile int exit_status = 0;
gboolean quiet = FALSE;
gchar *volatile cf_name = NULL;
*
* Glibc and Solaris libc document that a leading + disables permutation
* of options, regardless of whether POSIXLY_CORRECT is set or not; *BSD
- * and OS X don't document it, but do so anyway.
+ * and macOS don't document it, but do so anyway.
*
* We do *not* use a leading - because the behavior of a leading - is
* platform-dependent.
/* Set the C-language locale to the native environment. */
setlocale(LC_ALL, "");
- cmdarg_err_init(failure_message, failure_message_cont);
+ cmdarg_err_init(failure_warning_message, failure_message_cont);
#ifdef _WIN32
arg_list_utf_16to8(argc, argv);
print_current_user();
/*
- * Attempt to get the pathname of the executable file.
+ * Attempt to get the pathname of the directory containing the
+ * executable file.
*/
init_progfile_dir_error = init_progfile_dir(argv[0], main);
if (init_progfile_dir_error != NULL) {
- fprintf(stderr, "tfshark: Can't get pathname of tfshark program: %s.\n",
+ fprintf(stderr,
+ "tfshark: Can't get pathname of directory containing the tfshark program: %s.\n",
init_progfile_dir_error);
+ g_free(init_progfile_dir_error);
}
initialize_funnel_ops();
/* Get the compile-time version information string */
- comp_info_str = get_compiled_version_info(get_tfshark_compiled_version_info,
- epan_get_compiled_version_info);
+ comp_info_str = get_compiled_version_info(NULL, epan_get_compiled_version_info);
/* Get the run-time version information string */
runtime_info_str = get_runtime_version_info(get_tfshark_runtime_version_info);
"\n"
"%s",
get_ws_vcs_version_info(), comp_info_str->str, runtime_info_str->str);
+ g_string_free(comp_info_str, TRUE);
+ g_string_free(runtime_info_str, TRUE);
/*
* In order to have the -X opts assigned before the wslua machine starts
(GLogLevelFlags)log_flags,
tfshark_log_handler, NULL /* user_data */);
- init_report_err(failure_message, open_failure_message, read_failure_message,
- write_failure_message);
+ init_report_message(failure_warning_message, failure_warning_message,
+ open_failure_message, read_failure_message,
+ write_failure_message);
timestamp_set_type(TS_RELATIVE);
timestamp_set_precision(TS_PREC_AUTO);
timestamp_set_seconds_type(TS_SECONDS_DEFAULT);
- init_open_routines();
+ wtap_init();
#ifdef HAVE_PLUGINS
/* Register all the plugin types we have. */
/* Scan for plugins. This does *not* call their registration routines;
that's done later. */
- scan_plugins();
+ scan_plugins(REPORT_LOAD_FAILURE);
#endif
"-G" flag, as the "-G" flag dumps information registered by the
dissectors, and we must do it before we read the preferences, in
case any dissectors register preferences. */
- epan_init(register_all_protocols, register_all_protocol_handoffs, NULL, NULL);
+ if (!epan_init(register_all_protocols, register_all_protocol_handoffs, NULL,
+ NULL)) {
+ exit_status = INIT_ERROR;
+ goto clean_exit;
+ }
/* Register all tap listeners; we do this before we parse the arguments,
as the "-z" argument can specify a registered tap. */
if (strcmp(argv[2], "column-formats") == 0)
column_dump_column_formats();
else if (strcmp(argv[2], "currentprefs") == 0) {
- read_prefs(&gpf_open_errno, &gpf_read_errno, &gpf_path,
- &pf_open_errno, &pf_read_errno, &pf_path);
+ epan_load_settings();
write_prefs(NULL);
}
else if (strcmp(argv[2], "decodes") == 0)
glossary_option_help();
else {
cmdarg_err("Invalid \"%s\" option for -G flag, enter -G ? for more help.", argv[2]);
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
}
- return 0;
+ goto clean_exit;
}
- prefs_p = read_prefs(&gpf_open_errno, &gpf_read_errno, &gpf_path,
- &pf_open_errno, &pf_read_errno, &pf_path);
- if (gpf_path != NULL) {
- if (gpf_open_errno != 0) {
- cmdarg_err("Can't open global preferences file \"%s\": %s.",
- pf_path, g_strerror(gpf_open_errno));
- }
- if (gpf_read_errno != 0) {
- cmdarg_err("I/O error reading global preferences file \"%s\": %s.",
- pf_path, g_strerror(gpf_read_errno));
- }
- }
- if (pf_path != NULL) {
- if (pf_open_errno != 0) {
- cmdarg_err("Can't open your preferences file \"%s\": %s.", pf_path,
- g_strerror(pf_open_errno));
- }
- if (pf_read_errno != 0) {
- cmdarg_err("I/O error reading your preferences file \"%s\": %s.",
- pf_path, g_strerror(pf_read_errno));
- }
- g_free(pf_path);
- pf_path = NULL;
- }
-
- /* Read the disabled protocols file. */
- read_disabled_protos_list(&gdp_path, &gdp_open_errno, &gdp_read_errno,
- &dp_path, &dp_open_errno, &dp_read_errno);
- if (gdp_path != NULL) {
- if (gdp_open_errno != 0) {
- cmdarg_err("Could not open global disabled protocols file\n\"%s\": %s.",
- gdp_path, g_strerror(gdp_open_errno));
- }
- if (gdp_read_errno != 0) {
- cmdarg_err("I/O error reading global disabled protocols file\n\"%s\": %s.",
- gdp_path, g_strerror(gdp_read_errno));
- }
- g_free(gdp_path);
- }
- if (dp_path != NULL) {
- if (dp_open_errno != 0) {
- cmdarg_err(
- "Could not open your disabled protocols file\n\"%s\": %s.", dp_path,
- g_strerror(dp_open_errno));
- }
- if (dp_read_errno != 0) {
- cmdarg_err(
- "I/O error reading your disabled protocols file\n\"%s\": %s.", dp_path,
- g_strerror(dp_read_errno));
- }
- g_free(dp_path);
- }
+ /* Load libwireshark settings from the current profile. */
+ prefs_p = epan_load_settings();
cap_file_init(&cfile);
/*
* To reset the options parser, set optreset to 1 on platforms that
- * have optreset (documented in *BSD and OS X, apparently present but
+ * have optreset (documented in *BSD and macOS, apparently present but
* not documented in Solaris - the Illumos repository seems to
* suggest that the first Solaris getopt_long(), at least as of 2004,
* was based on the NetBSD one, it had optreset) and set optind to 1,
case 'C':
/* already processed; just ignore it now */
break;
- case 'd': /* Decode as rule */
- if (!add_decode_as(optarg))
- return 1;
- break;
-#if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
- case 'K': /* Kerberos keytab file */
- read_keytab_file(optarg);
- break;
-#endif
case 'e':
/* Field entry */
output_fields_add(output_fields, optarg);
if (!output_fields_set_option(output_fields, optarg)) {
cmdarg_err("\"%s\" is not a valid field output option=value pair.", optarg);
output_fields_list_options(stderr);
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
break;
case 'h': /* Print help and exit */
printf("TFShark (Wireshark) %s\n"
"Dump and analyze network traffic.\n"
- "See http://www.wireshark.org for more information.\n",
+ "See https://www.wireshark.org for more information.\n",
get_ws_vcs_version_info());
print_usage(stdout);
- return 0;
+ goto clean_exit;
break;
case 'l': /* "Line-buffer" standard output */
- /* This isn't line-buffering, strictly speaking, it's just
- flushing the standard output after the information for
- each packet is printed; however, that should be good
- enough for all the purposes to which "-l" is put (and
- is probably actually better for "-V", as it does fewer
- writes).
-
- See the comment in "process_packet()" for an explanation of
- why we do that, and why we don't just use "setvbuf()" to
- make the standard output line-buffered (short version: in
- Windows, "line-buffered" is the same as "fully-buffered",
- and the output buffer is only flushed when it fills up). */
+ /* The ANSI C standard does not appear to *require* that a line-buffered
+ stream be flushed to the host environment whenever a newline is
+ written, it just says that, on such a stream, characters "are
+ intended to be transmitted to or from the host environment as a
+ block when a new-line character is encountered".
+
+ The Visual C++ 6.0 C implementation doesn't do what is intended;
+ even if you set a stream to be line-buffered, it still doesn't
+ flush the buffer at the end of every line.
+
+ The whole reason for the "-l" flag in either tcpdump or TShark
+ is to allow the output of a live capture to be piped to a program
+ or script and to have that script see the information for the
+ packet as soon as it's printed, rather than having to wait until
+ a standard I/O buffer fills up.
+
+ So, if the "-l" flag is specified, we flush the standard output
+ at the end of a packet. This will do the right thing if we're
+ printing packet summary lines, and, as we print the entire protocol
+ tree for a single packet without waiting for anything to happen,
+ it should be as good as line-buffered mode if we're printing
+ protocol trees - arguably even better, as it may do fewer
+ writes. */
line_buffered = TRUE;
break;
case 'o': /* Override preference from command line */
- switch (prefs_set_pref(optarg)) {
+ {
+ char *errmsg = NULL;
+
+ switch (prefs_set_pref(optarg, &errmsg)) {
case PREFS_SET_OK:
break;
case PREFS_SET_SYNTAX_ERR:
- cmdarg_err("Invalid -o flag \"%s\"", optarg);
+ cmdarg_err("Invalid -o flag \"%s\"%s%s", optarg,
+ errmsg ? ": " : "", errmsg ? errmsg : "");
+ g_free(errmsg);
return 1;
break;
case PREFS_SET_NO_SUCH_PREF:
case PREFS_SET_OBSOLETE:
cmdarg_err("-o flag \"%s\" specifies unknown preference", optarg);
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
break;
}
break;
+ }
case 'q': /* Quiet */
quiet = TRUE;
break;
case 'S': /* Set the line Separator to be printed between packets */
separator = g_strdup(optarg);
break;
- case 't': /* Time stamp type */
- if (strcmp(optarg, "r") == 0)
- timestamp_set_type(TS_RELATIVE);
- else if (strcmp(optarg, "a") == 0)
- timestamp_set_type(TS_ABSOLUTE);
- else if (strcmp(optarg, "ad") == 0)
- timestamp_set_type(TS_ABSOLUTE_WITH_YMD);
- else if (strcmp(optarg, "adoy") == 0)
- timestamp_set_type(TS_ABSOLUTE_WITH_YDOY);
- else if (strcmp(optarg, "d") == 0)
- timestamp_set_type(TS_DELTA);
- else if (strcmp(optarg, "dd") == 0)
- timestamp_set_type(TS_DELTA_DIS);
- else if (strcmp(optarg, "e") == 0)
- timestamp_set_type(TS_EPOCH);
- else if (strcmp(optarg, "u") == 0)
- timestamp_set_type(TS_UTC);
- else if (strcmp(optarg, "ud") == 0)
- timestamp_set_type(TS_UTC_WITH_YMD);
- else if (strcmp(optarg, "udoy") == 0)
- timestamp_set_type(TS_UTC_WITH_YDOY);
- else {
- cmdarg_err("Invalid time stamp type \"%s\"; it must be one of:", optarg);
- cmdarg_err_cont("\t\"a\" for absolute\n"
- "\t\"ad\" for absolute with YYYY-MM-DD date\n"
- "\t\"adoy\" for absolute with YYYY/DOY date\n"
- "\t\"d\" for delta\n"
- "\t\"dd\" for delta displayed\n"
- "\t\"e\" for epoch\n"
- "\t\"r\" for relative\n"
- "\t\"u\" for absolute UTC\n"
- "\t\"ud\" for absolute UTC with YYYY-MM-DD date\n"
- "\t\"udoy\" for absolute UTC with YYYY/DOY date");
- return 1;
- }
- break;
case 'T': /* printing Type */
if (strcmp(optarg, "text") == 0) {
output_action = WRITE_TEXT;
"\t packets, or a multi-line view of the details of each of the\n"
"\t packets, depending on whether the -V flag was specified.\n"
"\t This is the default.");
- return 1;
- }
- break;
- case 'u': /* Seconds type */
- if (strcmp(optarg, "s") == 0)
- timestamp_set_seconds_type(TS_SECONDS_DEFAULT);
- else if (strcmp(optarg, "hms") == 0)
- timestamp_set_seconds_type(TS_SECONDS_HOUR_MIN_SEC);
- else {
- cmdarg_err("Invalid seconds type \"%s\"; it must be one of:", optarg);
- cmdarg_err_cont("\t\"s\" for seconds\n"
- "\t\"hms\" for hours, minutes and seconds");
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
break;
case 'v': /* Show version and exit */
- {
+ comp_info_str = get_compiled_version_info(NULL, epan_get_compiled_version_info);
+ runtime_info_str = get_runtime_version_info(get_tfshark_runtime_version_info);
show_version("TFShark (Wireshark)", comp_info_str, runtime_info_str);
g_string_free(comp_info_str, TRUE);
g_string_free(runtime_info_str, TRUE);
- /* We don't really have to cleanup here, but it's a convenient way to test
- * start-up and shut-down of the epan library without any UI-specific
- * cruft getting in the way. Makes the results of running
- * $ ./tools/valgrind-wireshark -n
- * much more useful. */
- epan_cleanup();
- return 0;
- }
+ goto clean_exit;
case 'O': /* Only output these protocols */
/* already processed; just ignore it now */
break;
if (strcmp("help", optarg) == 0) {
fprintf(stderr, "tfshark: The available statistics for the \"-z\" option are:\n");
list_stat_cmd_args();
- return 0;
+ goto clean_exit;
}
if (!process_stat_cmd_arg(optarg)) {
cmdarg_err("Invalid -z argument \"%s\"; it must be one of:", optarg);
list_stat_cmd_args();
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
+ }
+ break;
+ case 'd': /* Decode as rule */
+ case 'K': /* Kerberos keytab file */
+ case 't': /* Time stamp type */
+ case 'u': /* Seconds type */
+ case LONGOPT_DISABLE_PROTOCOL: /* disable dissection of protocol */
+ case LONGOPT_ENABLE_HEURISTIC: /* enable heuristic dissection of protocol */
+ case LONGOPT_DISABLE_HEURISTIC: /* disable heuristic dissection of protocol */
+ case LONGOPT_ENABLE_PROTOCOL: /* enable dissection of protocol (that is disabled by default) */
+ if (!dissect_opts_handle_opt(opt, optarg)) {
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
break;
default:
case '?': /* Bad flag - print usage message */
print_usage(stderr);
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
break;
}
}
cmdarg_err("\"-Tfields\" was specified, but no fields were "
"specified with \"-e\".");
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
/* If no capture filter or display filter has been specified, and there are
if (dfilter != NULL) {
cmdarg_err("Display filters were specified both with \"-d\" "
"and with additional command-line arguments.");
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
dfilter = get_args_as_string(argc, argv, optind);
}
if (arg_error) {
print_usage(stderr);
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
if (print_hex) {
if (output_action != WRITE_TEXT) {
cmdarg_err("Raw packet hex data can only be printed as text or PostScript");
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
}
if (!print_details) {
cmdarg_err("-O requires -V");
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
output_only_tables = g_hash_table_new (g_str_hash, g_str_equal);
if (rfilter != NULL && !perform_two_pass_analysis) {
cmdarg_err("-R without -2 is deprecated. For single-pass filtering use -Y.");
- return 1;
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
/* Notify all registered modules that have had any of their preferences
have a tap filter with one of MATE's late-registered fields as part
of the filter. We can now process all the "-z" arguments. */
start_requested_stats();
-
- /* disabled protocols as per configuration file */
- if (gdp_path == NULL && dp_path == NULL) {
- set_disabled_protos_list();
+
+ /*
+ * Enabled and disabled protocols and heuristic dissectors as per
+ * command-line options.
+ */
+ if (!setup_enabled_and_disabled_protocols()) {
+ exit_status = INVALID_OPTION;
+ goto clean_exit;
}
/* Build the column format array */
if (!dfilter_compile(rfilter, &rfcode, &err_msg)) {
cmdarg_err("%s", err_msg);
g_free(err_msg);
- epan_cleanup();
- return 2;
+ exit_status = INVALID_FILTER;
+ goto clean_exit;
}
}
cfile.rfcode = rfcode;
if (!dfilter_compile(dfilter, &dfcode, &err_msg)) {
cmdarg_err("%s", err_msg);
g_free(err_msg);
- epan_cleanup();
- return 2;
+ exit_status = INVALID_FILTER;
+ goto clean_exit;
}
}
cfile.dfcode = dfcode;
/* TODO: if tfshark is ever changed to give the user a choice of which
open_routine reader to use, then the following needs to change. */
if (cf_open(&cfile, cf_name, WTAP_TYPE_AUTO, FALSE, &err) != CF_OK) {
- epan_cleanup();
- return 2;
+ exit_status = OPEN_ERROR;
+ goto clean_exit;
}
/* Process the packets in the file */
TRY {
/* XXX - for now there is only 1 packet */
- err = load_cap_file(&cfile, 1, 0);
+ success = process_file(&cfile, 1, 0);
}
CATCH(OutOfMemoryError) {
fprintf(stderr,
- "Out Of Memory!\n"
+ "Out Of Memory.\n"
"\n"
- "Sorry, but TFShark has to terminate now!\n"
+ "Sorry, but TFShark has to terminate now.\n"
"\n"
"Some infos / workarounds can be found at:\n"
- "http://wiki.wireshark.org/KnownBugs/OutOfMemory\n");
- err = ENOMEM;
+ "https://wiki.wireshark.org/KnownBugs/OutOfMemory\n");
+ success = FALSE;
}
ENDTRY;
- if (err != 0) {
+ if (!success) {
/* We still dump out the results of taps, etc., as we might have
read some packets; however, we exit with an error status. */
exit_status = 2;
draw_tap_listeners(TRUE);
funnel_dump_all_text_windows();
+
+clean_exit:
+ destroy_print_stream(print_stream);
epan_free(cfile.epan);
epan_cleanup();
+#ifdef HAVE_EXTCAP
+ extcap_cleanup();
+#endif
output_fields_free(output_fields);
output_fields = NULL;
+ col_cleanup(&cfile.cinfo);
+ wtap_cleanup();
return exit_status;
}
static gboolean
process_packet_first_pass(capture_file *cf, epan_dissect_t *edt,
- gint64 offset, struct wtap_pkthdr *whdr,
- const guchar *pd)
+ gint64 offset, struct wtap_pkthdr *whdr,
+ const guchar *pd)
{
frame_data fdlocal;
guint32 framenum;
/* If we're running a read filter, prime the epan_dissect_t with that
filter. */
if (cf->rfcode)
- epan_dissect_prime_dfilter(edt, cf->rfcode);
+ epan_dissect_prime_with_dfilter(edt, cf->rfcode);
+
+ /* This is the first pass, so prime the epan_dissect_t with the
+ hfids postdissectors want on the first pass. */
+ prime_epan_dissect_with_postdissector_wanted_hfids(edt);
frame_data_set_before_dissect(&fdlocal, &cf->elapsed_time,
&ref, prev_dis);
}
static gboolean
-process_packet_second_pass(capture_file *cf, epan_dissect_t *edt, frame_data *fdata,
- struct wtap_pkthdr *phdr, Buffer *buf,
- guint tap_flags)
+process_packet_second_pass(capture_file *cf, epan_dissect_t *edt,
+ frame_data *fdata, struct wtap_pkthdr *phdr,
+ Buffer *buf, guint tap_flags)
{
column_info *cinfo;
gboolean passed;
/* If we're running a display filter, prime the epan_dissect_t with that
filter. */
if (cf->dfcode)
- epan_dissect_prime_dfilter(edt, cf->dfcode);
+ epan_dissect_prime_with_dfilter(edt, cf->dfcode);
+
+ /* This is the first and only pass, so prime the epan_dissect_t
+ with the hfids postdissectors want on the first pass. */
+ prime_epan_dissect_with_postdissector_wanted_hfids(edt);
col_custom_prime_edt(edt, &cf->cinfo);
this packet. */
print_packet(cf, edt);
- /* The ANSI C standard does not appear to *require* that a line-buffered
- stream be flushed to the host environment whenever a newline is
- written, it just says that, on such a stream, characters "are
- intended to be transmitted to or from the host environment as a
- block when a new-line character is encountered".
-
- The Visual C++ 6.0 C implementation doesn't do what is intended;
- even if you set a stream to be line-buffered, it still doesn't
- flush the buffer at the end of every line.
-
- So, if the "-l" flag was specified, we flush the standard output
- at the end of a packet. This will do the right thing if we're
- printing packet summary lines, and, as we print the entire protocol
- tree for a single packet without waiting for anything to happen,
- it should be as good as line-buffered mode if we're printing
- protocol trees. (The whole reason for the "-l" flag in either
- tcpdump or TShark is to allow the output of a live capture to
- be piped to a program or script and to have that script see the
- information for the packet as soon as it's printed, rather than
- having to wait until a standard I/O buffer fills up. */
+ /* If we're doing "line-buffering", flush the standard output
+ after every packet. See the comment above, for the "-l"
+ option, for an explanation of why we do that. */
if (line_buffered)
fflush(stdout);
if (ferror(stdout)) {
show_print_file_io_error(errno);
- exit(2);
+ return FALSE;
}
}
prev_dis = fdata;
return passed || fdata->flags.dependent_of_displayed;
}
-gboolean
+static gboolean
local_wtap_read(capture_file *cf, struct wtap_pkthdr* file_phdr _U_, int *err, gchar **err_info _U_, gint64 *data_offset _U_, guint8** data_buffer)
{
/* int bytes_read; */
return TRUE; /* success */
}
-static int
-load_cap_file(capture_file *cf, int max_packet_count, gint64 max_byte_count)
+static gboolean
+process_file(capture_file *cf, int max_packet_count, gint64 max_byte_count)
{
guint32 framenum;
int err;
cf->frames = new_frame_data_sequence();
if (do_dissection) {
- gboolean create_proto_tree = FALSE;
+ gboolean create_proto_tree;
- /* If we're going to be applying a filter, we'll need to
- create a protocol tree against which to apply the filter. */
- if (cf->rfcode)
- create_proto_tree = TRUE;
+ /*
+ * Determine whether we need to create a protocol tree.
+ * We do if:
+ *
+ * we're going to apply a read filter;
+ *
+ * a postdissector wants field values or protocols
+ * on the first pass.
+ */
+ create_proto_tree =
+ (cf->rfcode != NULL || postdissectors_want_hfids());
/* We're not going to display the protocol tree on this pass,
so it's not going to be "visible". */
}
while (local_wtap_read(cf, &file_phdr, &err, &err_info, &data_offset, &raw_data)) {
if (process_packet_first_pass(cf, edt, data_offset, &file_phdr/*wtap_phdr(cf->wth)*/,
- wtap_buf_ptr(cf->wth))) {
+ wtap_buf_ptr(cf->wth))) {
/* Stop reading if we have the maximum number of packets;
* When the -c option has not been used, max_packet_count
if (do_dissection) {
gboolean create_proto_tree;
- if (cf->dfcode || print_details || filtering_tap_listeners ||
- (tap_flags & TL_REQUIRES_PROTO_TREE) || have_custom_cols(&cf->cinfo))
- create_proto_tree = TRUE;
- else
- create_proto_tree = FALSE;
+ /*
+ * Determine whether we need to create a protocol tree.
+ * We do if:
+ *
+ * we're going to apply a display filter;
+ *
+ * we're going to print the protocol tree;
+ *
+ * one of the tap listeners requires a protocol tree;
+ *
+ * we have custom columns (which require field values, which
+ * currently requires that we build a protocol tree).
+ */
+ create_proto_tree =
+ (cf->dfcode || print_details || filtering_tap_listeners ||
+ (tap_flags & TL_REQUIRES_PROTO_TREE) || have_custom_cols(&cf->cinfo));
/* The protocol tree will be "visible", i.e., printed, only if we're
printing packet details, which is true if we're printing stuff
process_packet_second_pass(cf, edt, fdata, &cf->phdr, &buf, tap_flags);
}
#else
- process_packet_second_pass(cf, edt, fdata, &cf->phdr, &buf, tap_flags);
+ if (!process_packet_second_pass(cf, edt, fdata, &cf->phdr, &buf,
+ tap_flags))
+ return FALSE;
#endif
}
if (do_dissection) {
gboolean create_proto_tree;
- if (cf->rfcode || cf->dfcode || print_details || filtering_tap_listeners ||
- (tap_flags & TL_REQUIRES_PROTO_TREE) || have_custom_cols(&cf->cinfo))
- create_proto_tree = TRUE;
- else
- create_proto_tree = FALSE;
+ /*
+ * Determine whether we need to create a protocol tree.
+ * We do if:
+ *
+ * we're going to apply a read filter;
+ *
+ * we're going to apply a display filter;
+ *
+ * we're going to print the protocol tree;
+ *
+ * one of the tap listeners is going to apply a filter;
+ *
+ * one of the tap listeners requires a protocol tree;
+ *
+ * a postdissector wants field values or protocols
+ * on the first pass;
+ *
+ * we have custom columns (which require field values, which
+ * currently requires that we build a protocol tree).
+ */
+ create_proto_tree =
+ (cf->rfcode || cf->dfcode || print_details || filtering_tap_listeners ||
+ (tap_flags & TL_REQUIRES_PROTO_TREE) || postdissectors_want_hfids() ||
+ have_custom_cols(&cf->cinfo));
/* The protocol tree will be "visible", i.e., printed, only if we're
printing packet details, which is true if we're printing stuff
framenum++;
- process_packet(cf, edt, data_offset, &file_phdr/*wtap_phdr(cf->wth)*/,
- raw_data, tap_flags);
+ if (!process_packet_single_pass(cf, edt, data_offset,
+ &file_phdr/*wtap_phdr(cf->wth)*/,
+ raw_data, tap_flags))
+ return FALSE;
- /* Stop reading if we have the maximum number of packets;
- * When the -c option has not been used, max_packet_count
- * starts at 0, which practically means, never stop reading.
- * (unless we roll over max_packet_count ?)
- */
- if ( (--max_packet_count == 0) || (max_byte_count != 0 && data_offset >= max_byte_count)) {
- err = 0; /* This is not an error */
- break;
- }
+ /* Stop reading if we have the maximum number of packets;
+ * When the -c option has not been used, max_packet_count
+ * starts at 0, which practically means, never stop reading.
+ * (unless we roll over max_packet_count ?)
+ */
+ if ( (--max_packet_count == 0) || (max_byte_count != 0 && data_offset >= max_byte_count)) {
+ err = 0; /* This is not an error */
+ break;
+ }
}
if (edt) {
wtap_close(cf->wth);
cf->wth = NULL;
- return err;
+ return (err != 0);
}
static gboolean
-process_packet(capture_file *cf, epan_dissect_t *edt, gint64 offset,
- struct wtap_pkthdr *whdr, const guchar *pd, guint tap_flags)
+process_packet_single_pass(capture_file *cf, epan_dissect_t *edt, gint64 offset,
+ struct wtap_pkthdr *whdr, const guchar *pd,
+ guint tap_flags)
{
frame_data fdata;
column_info *cinfo;
/* If we're running a filter, prime the epan_dissect_t with that
filter. */
if (cf->dfcode)
- epan_dissect_prime_dfilter(edt, cf->dfcode);
+ epan_dissect_prime_with_dfilter(edt, cf->dfcode);
col_custom_prime_edt(edt, &cf->cinfo);
this packet. */
print_packet(cf, edt);
- /* The ANSI C standard does not appear to *require* that a line-buffered
- stream be flushed to the host environment whenever a newline is
- written, it just says that, on such a stream, characters "are
- intended to be transmitted to or from the host environment as a
- block when a new-line character is encountered".
-
- The Visual C++ 6.0 C implementation doesn't do what is intended;
- even if you set a stream to be line-buffered, it still doesn't
- flush the buffer at the end of every line.
-
- So, if the "-l" flag was specified, we flush the standard output
- at the end of a packet. This will do the right thing if we're
- printing packet summary lines, and, as we print the entire protocol
- tree for a single packet without waiting for anything to happen,
- it should be as good as line-buffered mode if we're printing
- protocol trees. (The whole reason for the "-l" flag in either
- tcpdump or TShark is to allow the output of a live capture to
- be piped to a program or script and to have that script see the
- information for the packet as soon as it's printed, rather than
- having to wait until a standard I/O buffer fills up. */
+ /* If we're doing "line-buffering", flush the standard output
+ after every packet. See the comment above, for the "-l"
+ option, for an explanation of why we do that. */
if (line_buffered)
fflush(stdout);
if (ferror(stdout)) {
show_print_file_io_error(errno);
- exit(2);
+ return FALSE;
}
}
size_t buf_offset;
size_t column_len;
size_t col_len;
+ col_item_t* col_item;
line_bufp = get_line_buf(256);
buf_offset = 0;
*line_bufp = '\0';
for (i = 0; i < cf->cinfo.num_cols; i++) {
+ col_item = &cf->cinfo.columns[i];
/* Skip columns not marked as visible. */
if (!get_column_visible(i))
continue;
- switch (cf->cinfo.col_fmt[i]) {
+ switch (col_item->col_fmt) {
case COL_NUMBER:
- column_len = col_len = strlen(cf->cinfo.col_data[i]);
+ column_len = col_len = strlen(col_item->col_data);
if (column_len < 3)
column_len = 3;
line_bufp = get_line_buf(buf_offset + column_len);
- put_spaces_string(line_bufp + buf_offset, cf->cinfo.col_data[i], col_len, column_len);
+ put_spaces_string(line_bufp + buf_offset, col_item->col_data, col_len, column_len);
break;
case COL_CLS_TIME:
case COL_UTC_TIME:
case COL_UTC_YMD_TIME: /* XXX - wider */
case COL_UTC_YDOY_TIME: /* XXX - wider */
- column_len = col_len = strlen(cf->cinfo.col_data[i]);
+ column_len = col_len = strlen(col_item->col_data);
if (column_len < 10)
column_len = 10;
line_bufp = get_line_buf(buf_offset + column_len);
- put_spaces_string(line_bufp + buf_offset, cf->cinfo.col_data[i], col_len, column_len);
+ put_spaces_string(line_bufp + buf_offset, col_item->col_data, col_len, column_len);
break;
case COL_DEF_SRC:
case COL_DEF_NET_SRC:
case COL_RES_NET_SRC:
case COL_UNRES_NET_SRC:
- column_len = col_len = strlen(cf->cinfo.col_data[i]);
+ column_len = col_len = strlen(col_item->col_data);
if (column_len < 12)
column_len = 12;
line_bufp = get_line_buf(buf_offset + column_len);
- put_spaces_string(line_bufp + buf_offset, cf->cinfo.col_data[i], col_len, column_len);
+ put_spaces_string(line_bufp + buf_offset, col_item->col_data, col_len, column_len);
break;
case COL_DEF_DST:
case COL_DEF_NET_DST:
case COL_RES_NET_DST:
case COL_UNRES_NET_DST:
- column_len = col_len = strlen(cf->cinfo.col_data[i]);
+ column_len = col_len = strlen(col_item->col_data);
if (column_len < 12)
column_len = 12;
line_bufp = get_line_buf(buf_offset + column_len);
- put_string_spaces(line_bufp + buf_offset, cf->cinfo.col_data[i], col_len, column_len);
+ put_string_spaces(line_bufp + buf_offset, col_item->col_data, col_len, column_len);
break;
default:
- column_len = strlen(cf->cinfo.col_data[i]);
+ column_len = strlen(col_item->col_data);
line_bufp = get_line_buf(buf_offset + column_len);
- put_string(line_bufp + buf_offset, cf->cinfo.col_data[i], column_len);
+ put_string(line_bufp + buf_offset, col_item->col_data, column_len);
break;
}
buf_offset += column_len;
* even if we're only adding " ".
*/
line_bufp = get_line_buf(buf_offset + 4);
- switch (cf->cinfo.col_fmt[i]) {
+ switch (col_item->col_fmt) {
case COL_DEF_SRC:
case COL_RES_SRC:
case COL_UNRES_SRC:
- switch (cf->cinfo.col_fmt[i + 1]) {
+ switch (cf->cinfo.columns[i+1].col_fmt) {
case COL_DEF_DST:
case COL_RES_DST:
case COL_DEF_DL_SRC:
case COL_RES_DL_SRC:
case COL_UNRES_DL_SRC:
- switch (cf->cinfo.col_fmt[i + 1]) {
+ switch (cf->cinfo.columns[i+1].col_fmt) {
case COL_DEF_DL_DST:
case COL_RES_DL_DST:
case COL_DEF_NET_SRC:
case COL_RES_NET_SRC:
case COL_UNRES_NET_SRC:
- switch (cf->cinfo.col_fmt[i + 1]) {
+ switch (cf->cinfo.columns[i+1].col_fmt) {
case COL_DEF_NET_DST:
case COL_RES_NET_DST:
case COL_DEF_DST:
case COL_RES_DST:
case COL_UNRES_DST:
- switch (cf->cinfo.col_fmt[i + 1]) {
+ switch (cf->cinfo.columns[i+1].col_fmt) {
case COL_DEF_SRC:
case COL_RES_SRC:
case COL_DEF_DL_DST:
case COL_RES_DL_DST:
case COL_UNRES_DL_DST:
- switch (cf->cinfo.col_fmt[i + 1]) {
+ switch (cf->cinfo.columns[i+1].col_fmt) {
case COL_DEF_DL_SRC:
case COL_RES_DL_SRC:
case COL_DEF_NET_DST:
case COL_RES_NET_DST:
case COL_UNRES_NET_DST:
- switch (cf->cinfo.col_fmt[i + 1]) {
+ switch (cf->cinfo.columns[i+1].col_fmt) {
case COL_DEF_NET_SRC:
case COL_RES_NET_SRC:
static gboolean
print_packet(capture_file *cf, epan_dissect_t *edt)
{
- print_args_t print_args;
-
if (print_summary || output_fields_has_cols(output_fields)) {
/* Just fill in the columns. */
epan_dissect_fill_in_columns(edt, FALSE, TRUE);
switch (output_action) {
case WRITE_TEXT:
- /* Only initialize the fields that are actually used in proto_tree_print.
- * This is particularly important for .range, as that's heap memory which
- * we would otherwise have to g_free().
- print_args.to_file = TRUE;
- print_args.format = print_format;
- print_args.print_summary = print_summary;
- print_args.print_formfeed = FALSE;
- packet_range_init(&print_args.range, &cfile);
- */
- print_args.print_hex = print_hex;
- print_args.print_dissections = print_details ? print_dissections_expanded : print_dissections_none;
-
- if (!proto_tree_print(&print_args, edt, output_only_tables, print_stream))
+ if (!proto_tree_print(print_details ? print_dissections_expanded : print_dissections_none,
+ print_hex, edt, output_only_tables, print_stream))
return FALSE;
if (!print_hex) {
if (!print_line(print_stream, 0, separator))
break;
case WRITE_XML:
- write_pdml_proto_tree(edt, stdout);
+ write_pdml_proto_tree(NULL, NULL, PF_NONE, edt, stdout);
printf("\n");
return !ferror(stdout);
case WRITE_FIELDS:
}
/*
- * Open/create errors are reported with an console message in TFShark.
+ * General errors and warnings are reported with an console message
+ * in TFShark.
*/
static void
-open_failure_message(const char *filename, int err, gboolean for_writing)
+failure_warning_message(const char *msg_format, va_list ap)
{
fprintf(stderr, "tfshark: ");
- fprintf(stderr, file_open_error_message(err, for_writing), filename);
+ vfprintf(stderr, msg_format, ap);
fprintf(stderr, "\n");
}
-
/*
- * General errors are reported with an console message in TFShark.
+ * Open/create errors are reported with an console message in TFShark.
*/
static void
-failure_message(const char *msg_format, va_list ap)
+open_failure_message(const char *filename, int err, gboolean for_writing)
{
fprintf(stderr, "tfshark: ");
- vfprintf(stderr, msg_format, ap);
+ fprintf(stderr, file_open_error_message(err, for_writing), filename);
fprintf(stderr, "\n");
}
}
/*
- * Editor modelines - http://www.wireshark.org/tools/modelines.html
+ * Editor modelines - https://www.wireshark.org/tools/modelines.html
*
* Local variables:
* c-basic-offset: 2
git.samba.org / metze / wireshark / wip.git / blobdiff