2 * Definitions for file structures and routines
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
28 #include "packet-range.h"
29 #include "wiretap/wtap.h"
30 #include <epan/dfilter/dfilter.h>
33 #include <epan/epan.h>
38 /** Return values from functions that only can succeed or fail. */
40 CF_OK, /**< operation succeeded */
41 CF_ERROR /**< operation got an error (function may provide err with details) */
44 /** Return values from functions that read capture files. */
46 CF_READ_OK, /**< operation succeeded */
47 CF_READ_ERROR, /**< operation got an error (function may provide err with details) */
48 CF_READ_ABORTED /**< operation aborted by user */
51 /** Return values from functions that print sets of packets. */
53 CF_PRINT_OK, /**< print operation succeeded */
54 CF_PRINT_OPEN_ERROR, /**< print operation failed while opening printer */
55 CF_PRINT_WRITE_ERROR /**< print operation failed while writing to the printer */
61 cf_cb_file_read_started,
62 cf_cb_file_read_finished,
63 cf_cb_packet_selected,
64 cf_cb_packet_unselected,
65 cf_cb_field_unselected,
66 cf_cb_file_save_started,
67 cf_cb_file_save_finished,
68 cf_cb_file_save_reload_finished,
69 cf_cb_file_save_failed
72 typedef void (*cf_callback_t) (gint event, gpointer data, gpointer user_data);
78 gboolean frame_matched;
83 cf_callback_add(cf_callback_t func, gpointer user_data);
86 cf_callback_remove(cf_callback_t func);
89 * Open a capture file.
91 * @param cf the capture file to be opened
92 * @param fname the filename to be opened
93 * @param is_tempfile is this a temporary file?
94 * @param err error code
95 * @return one of cf_status_t
97 cf_status_t cf_open(capture_file *cf, const char *fname, gboolean is_tempfile, int *err);
100 * Close a capture file.
102 * @param cf the capture file to be closed
104 void cf_close(capture_file *cf);
107 * Reload a capture file.
109 * @param cf the capture file to be reloaded
111 void cf_reload(capture_file *cf);
114 * Read all packets of a capture file into the internal structures.
116 * @param cf the capture file to be read
117 * @param from_save reread asked from cf_save
118 * @return one of cf_read_status_t
120 cf_read_status_t cf_read(capture_file *cf, gboolean from_save);
123 * Read the pseudo-header and raw data for a packet. It will pop
124 * up an alert box if there's an error.
126 * @param cf the capture file from which to read the packet
127 * @param fdata the frame_data structure for the packet in question
128 * @param pseudo_header pointer to a wtap_pseudo_header union into
129 * which to read the packet's pseudo-header
130 * @param pd a guin8 array into which to read the packet's raw data
131 * @return TRUE if the read succeeded, FALSE if there was an error
133 gboolean cf_read_frame_r(capture_file *cf, frame_data *fdata,
134 union wtap_pseudo_header *pseudo_header, guint8 *pd);
137 * Read the pseudo-header and raw data for a packet into a
138 * capture_file structure's pseudo_header and pd members.
139 * It will pop up an alert box if there's an error.
141 * @param cf the capture file from which to read the packet
142 * @param fdata the frame_data structure for the packet in question
143 * @return TRUE if the read succeeded, FALSE if there was an error
145 gboolean cf_read_frame(capture_file *cf, frame_data *fdata);
148 * Start reading from the end of a capture file.
149 * This is used in "Update list of packets in Real-Time".
151 * @param cf the capture file to be read from
152 * @param fname the filename to be read from
153 * @param is_tempfile is this a temporary file?
154 * @param err the error code, if an error had occured
155 * @return one of cf_status_t
157 cf_status_t cf_start_tail(capture_file *cf, const char *fname, gboolean is_tempfile, int *err);
160 * Read packets from the "end" of a capture file.
162 * @param cf the capture file to be read from
163 * @param to_read the number of packets to read
164 * @param err the error code, if an error had occured
165 * @return one of cf_read_status_t
167 cf_read_status_t cf_continue_tail(capture_file *cf, volatile int to_read, int *err);
170 * Fake reading packets from the "end" of a capture file.
172 * @param cf the capture file to be read from
174 void cf_fake_continue_tail(capture_file *cf);
177 * Finish reading from "end" of a capture file.
179 * @param cf the capture file to be read from
180 * @param err the error code, if an error had occured
181 * @return one of cf_read_status_t
183 cf_read_status_t cf_finish_tail(capture_file *cf, int *err);
186 * Determine whether this capture file (or a range of it) can be saved
187 * (except by copying the raw file data).
189 * @param cf the capture file to check
190 * @return TRUE if it can be saved, FALSE if it can't
192 gboolean cf_can_save_as(capture_file *cf);
195 * Save a capture file (or a range of it).
197 * @param cf the capture file to save to
198 * @param fname the filename to save to
199 * @param range the range of packets to save
200 * @param save_format the format of the file to save (libpcap, ...)
201 * @param compressed whether to gzip compress the file
202 * @return one of cf_status_t
204 cf_status_t cf_save(capture_file * cf, const char *fname, packet_range_t *range, guint save_format, gboolean compressed);
207 * Get a displayable name of the capture file.
209 * @param cf the capture file
210 * @return the displayable name (don't have to be g_free'd)
212 const gchar *cf_get_display_name(capture_file *cf);
215 * Set the source of the capture data for temporary files, e.g.
216 * "Interface eth0" or "Pipe from Pong"
218 * @param cf the capture file
219 * @param source the source description. this will be copied internally.
221 void cf_set_tempfile_source(capture_file *cf, gchar *source);
224 * Get the source of the capture data for temporary files. Guaranteed to
225 * return a non-null value. The returned value should not be freed.
227 * @param cf the capture file
229 const gchar *cf_get_tempfile_source(capture_file *cf);
232 * Get the number of packets in the capture file.
234 * @param cf the capture file
235 * @return the number of packets in the capture file
237 int cf_get_packet_count(capture_file *cf);
240 * Set the number of packets in the capture file.
242 * @param cf the capture file
243 * @param packet_count the number of packets in the capture file
245 void cf_set_packet_count(capture_file *cf, int packet_count);
248 * Is this capture file a temporary file?
250 * @param cf the capture file
251 * @return TRUE if it's a temporary file, FALSE otherwise
253 gboolean cf_is_tempfile(capture_file *cf);
256 * Set flag, that this file is a tempfile.
258 void cf_set_tempfile(capture_file *cf, gboolean is_tempfile);
261 * Set flag, if the number of packet drops while capturing are known or not.
263 * @param cf the capture file
264 * @param drops_known TRUE if the number of packet drops are known, FALSE otherwise
266 void cf_set_drops_known(capture_file *cf, gboolean drops_known);
269 * Set the number of packet drops while capturing.
271 * @param cf the capture file
272 * @param drops the number of packet drops occured while capturing
274 void cf_set_drops(capture_file *cf, guint32 drops);
277 * Get flag state, if the number of packet drops while capturing are known or not.
279 * @param cf the capture file
280 * @return TRUE if the number of packet drops are known, FALSE otherwise
282 gboolean cf_get_drops_known(capture_file *cf);
285 * Get the number of packet drops while capturing.
287 * @param cf the capture file
288 * @return the number of packet drops occured while capturing
290 guint32 cf_get_drops(capture_file *cf);
293 * Set the read filter.
294 * @todo this shouldn't be required, remove it somehow
296 * @param cf the capture file
297 * @param rfcode the readfilter
299 void cf_set_rfcode(capture_file *cf, dfilter_t *rfcode);
302 * "Display Filter" packets in the capture file.
304 * @param cf the capture file
305 * @param dfilter the display filter
306 * @param force TRUE if do in any case, FALSE only if dfilter changed
307 * @return one of cf_status_t
309 cf_status_t cf_filter_packets(capture_file *cf, gchar *dfilter, gboolean force);
312 * At least one "Refence Time" flag has changed, rescan all packets.
314 * @param cf the capture file
316 void cf_reftime_packets(capture_file *cf);
319 * Return the time it took to load the file
321 gulong cf_get_computed_elapsed(void);
324 * "Something" has changed, rescan all packets.
326 * @param cf the capture file
328 void cf_redissect_packets(capture_file *cf);
331 * Rescan all packets and just run taps - don't reconstruct the display.
333 * @param cf the capture file
334 * @return one of cf_read_status_t
336 cf_read_status_t cf_retap_packets(capture_file *cf);
339 * Adjust timestamp precision if auto is selected.
341 * @param cf the capture file
343 void cf_timestamp_auto_precision(capture_file *cf);
346 * Print the capture file.
348 * @param cf the capture file
349 * @param print_args the arguments what and how to print
350 * @return one of cf_print_status_t
352 cf_print_status_t cf_print_packets(capture_file *cf, print_args_t *print_args);
355 * Print (export) the capture file into PDML format.
357 * @param cf the capture file
358 * @param print_args the arguments what and how to export
359 * @return one of cf_print_status_t
361 cf_print_status_t cf_write_pdml_packets(capture_file *cf, print_args_t *print_args);
364 * Print (export) the capture file into PSML format.
366 * @param cf the capture file
367 * @param print_args the arguments what and how to export
368 * @return one of cf_print_status_t
370 cf_print_status_t cf_write_psml_packets(capture_file *cf, print_args_t *print_args);
373 * Print (export) the capture file into CSV format.
375 * @param cf the capture file
376 * @param print_args the arguments what and how to export
377 * @return one of cf_print_status_t
379 cf_print_status_t cf_write_csv_packets(capture_file *cf, print_args_t *print_args);
382 * Print (export) the capture file into C Arrays format.
384 * @param cf the capture file
385 * @param print_args the arguments what and how to export
386 * @return one of cf_print_status_t
388 cf_print_status_t cf_write_carrays_packets(capture_file *cf, print_args_t *print_args);
391 * Find packet with a protocol tree item that contains a specified text string.
393 * @param cf the capture file
394 * @param string the string to find
395 * @param dir direction in which to search
396 * @return TRUE if a packet was found, FALSE otherwise
398 gboolean cf_find_packet_protocol_tree(capture_file *cf, const char *string,
399 search_direction dir);
402 * Find field with a label that contains text string cfile->sfilter.
404 * @param cf the capture file
405 * @param tree the protocol tree
406 * @param mdata the first field (mdata->finfo) that matched the string
407 * @return TRUE if a packet was found, FALSE otherwise
409 extern gboolean cf_find_string_protocol_tree(capture_file *cf, proto_tree *tree,
413 * Find packet whose summary line contains a specified text string.
415 * @param cf the capture file
416 * @param string the string to find
417 * @param dir direction in which to search
418 * @return TRUE if a packet was found, FALSE otherwise
420 gboolean cf_find_packet_summary_line(capture_file *cf, const char *string,
421 search_direction dir);
424 * Find packet whose data contains a specified byte string.
426 * @param cf the capture file
427 * @param string the string to find
428 * @param string_size the size of the string to find
429 * @param dir direction in which to search
430 * @return TRUE if a packet was found, FALSE otherwise
432 gboolean cf_find_packet_data(capture_file *cf, const guint8 *string,
433 size_t string_size, search_direction dir);
436 * Find packet that matches a compiled display filter.
438 * @param cf the capture file
439 * @param sfcode the display filter to match
440 * @param dir direction in which to search
441 * @return TRUE if a packet was found, FALSE otherwise
443 gboolean cf_find_packet_dfilter(capture_file *cf, dfilter_t *sfcode,
444 search_direction dir);
447 * Find packet that matches a display filter given as a text string.
449 * @param cf the capture file
450 * @param filter the display filter to match
451 * @param dir direction in which to search
452 * @return TRUE if a packet was found, FALSE otherwise
455 cf_find_packet_dfilter_string(capture_file *cf, const char *filter,
456 search_direction dir);
459 * Find marked packet.
461 * @param cf the capture file
462 * @param dir direction in which to search
463 * @return TRUE if a packet was found, FALSE otherwise
465 gboolean cf_find_packet_marked(capture_file *cf, search_direction dir);
468 * Find time-reference packet.
470 * @param cf the capture file
471 * @param dir direction in which to search
472 * @return TRUE if a packet was found, FALSE otherwise
474 gboolean cf_find_packet_time_reference(capture_file *cf, search_direction dir);
477 * GoTo Packet in first row.
479 * @return TRUE if the first row exists, FALSE otherwise
481 gboolean cf_goto_top_frame();
484 * GoTo Packet in last row.
486 * @return TRUE if last row exists, FALSE otherwise
488 gboolean cf_goto_bottom_frame();
491 * GoTo Packet with the given row.
493 * @param cf the capture file
494 * @param row the row to go to
495 * @return TRUE if this row exists, FALSE otherwise
497 gboolean cf_goto_frame(capture_file *cf, guint row);
500 * Go to frame specified by currently selected protocol tree field.
501 * (Go To Corresponding Packet)
502 * @todo this is ugly and should be improved!
504 * @param cf the capture file
505 * @return TRUE if this packet exists, FALSE otherwise
507 gboolean cf_goto_framenum(capture_file *cf);
510 * Select the packet in the given row.
512 * @param cf the capture file
513 * @param row the row to select
515 void cf_select_packet(capture_file *cf, int row);
518 * Unselect all packets, if any.
520 * @param cf the capture file
522 void cf_unselect_packet(capture_file *cf);
525 * Unselect all protocol tree fields, if any.
527 * @param cf the capture file
529 void cf_unselect_field(capture_file *cf);
532 * Mark a particular frame in a particular capture.
534 * @param cf the capture file
535 * @param frame the frame to be marked
537 void cf_mark_frame(capture_file *cf, frame_data *frame);
540 * Unmark a particular frame in a particular capture.
542 * @param cf the capture file
543 * @param frame the frame to be unmarked
545 void cf_unmark_frame(capture_file *cf, frame_data *frame);
548 * Ignore a particular frame in a particular capture.
550 * @param cf the capture file
551 * @param frame the frame to be ignored
553 void cf_ignore_frame(capture_file *cf, frame_data *frame);
556 * Unignore a particular frame in a particular capture.
558 * @param cf the capture file
559 * @param frame the frame to be unignored
561 void cf_unignore_frame(capture_file *cf, frame_data *frame);
564 * Merge two (or more) capture files into one.
565 * @todo is this the right place for this function? It doesn't have to do a lot with capture_file.
567 * @param out_filename pointer to output filename; if output filename is
568 * NULL, a temporary file name is generated and *out_filename is set
569 * to point to the generated file name
570 * @param in_file_count the number of input files to merge
571 * @param in_filenames array of input filenames
572 * @param file_type the output filetype
573 * @param do_append FALSE to merge chronologically, TRUE simply append
574 * @return one of cf_status_t
577 cf_merge_files(char **out_filename, int in_file_count,
578 char *const *in_filenames, int file_type, gboolean do_append);
580 #if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
581 void read_keytab_file(const char *);