/* tethereal.c
*
- * $Id: tethereal.c,v 1.87 2001/07/05 00:34:39 guy Exp $
+ * $Id: tethereal.c,v 1.162 2002/10/23 03:49:10 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
* Copyright 1998 Gerald Combs
*
- * Text-mode variant, by Gilbert Ramirez <gram@xiexie.org>.
+ * Text-mode variant, by Gilbert Ramirez <gram@alumni.rice.edu>
+ * and Guy Harris <guy@alum.mit.edu>.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- *
*/
#ifdef HAVE_CONFIG_H
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
+#include <ctype.h>
#include <locale.h>
#include <limits.h>
#include <errno.h>
-#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-
-#ifdef HAVE_SYS_STAT_H
-#include <sys/stat.h>
-#endif
-
#ifdef HAVE_FCNTL_H
#include <fcntl.h>
#endif
#ifdef HAVE_LIBPCAP
#include <pcap.h>
+#include <setjmp.h>
#endif
#ifdef HAVE_LIBZ
# include "snprintf.h"
#endif
-#if defined(HAVE_UCD_SNMP_SNMP_H)
#ifdef HAVE_UCD_SNMP_VERSION_H
#include <ucd-snmp/version.h>
#endif /* HAVE_UCD_SNMP_VERSION_H */
-#elif defined(HAVE_SNMP_SNMP_H)
-#ifdef HAVE_SNMP_VERSION_H
-#include <snmp/version.h>
-#endif /* HAVE_SNMP_VERSION_H */
-#endif /* SNMP */
#ifdef NEED_STRERROR_H
#include "strerror.h"
#endif
#include <glib.h>
-#include <epan.h>
+#include <epan/epan.h>
+#include <epan/filesystem.h>
#include "globals.h"
-#include "timestamp.h"
-#include "packet.h"
+#include <epan/timestamp.h>
+#include <epan/packet.h>
#include "file.h"
#include "prefs.h"
#include "column.h"
#include "print.h"
-#include "resolv.h"
+#include <epan/resolv.h>
#include "util.h"
-#include "conversation.h"
-#include "reassemble.h"
-#include "plugins.h"
+#ifdef HAVE_LIBPCAP
+#include "pcap-util.h"
+#endif
+#include <epan/conversation.h>
+#include <epan/plugins.h>
#include "register.h"
+#include "conditions.h"
+#include "capture_stop_conditions.h"
+#include "ringbuffer.h"
+#include <epan/epan_dissect.h>
+#include "tap.h"
+#include "tap-rpcstat.h"
+#include "tap-rpcprogs.h"
+#include "packet-dcerpc.h"
+#include "tap-dcerpcstat.h"
+
+#ifdef HAVE_LIBPCAP
+#include <wiretap/wtap-capture.h>
+#endif
#ifdef WIN32
#include "capture-wpcap.h"
static guint32 firstsec, firstusec;
static guint32 prevsec, prevusec;
static GString *comp_info_str;
+static gboolean quiet;
+static gboolean decode;
static gboolean verbose;
static gboolean print_hex;
static gboolean line_buffered;
#ifdef HAVE_LIBPCAP
typedef struct _loop_data {
+ gboolean go; /* TRUE as long as we're supposed to keep capturing */
gint linktype;
pcap_t *pch;
wtap_dumper *pdh;
+ jmp_buf stopenv;
+ gboolean output_to_pipe;
+ int packet_count;
} loop_data;
static loop_data ld;
-static int capture(int, int);
-static void capture_pcap_cb(u_char *, const struct pcap_pkthdr *,
- const u_char *);
+static int capture(int);
+static void capture_pcap_cb(guchar *, const struct pcap_pkthdr *,
+ const guchar *);
+#ifdef _WIN32
+static BOOL WINAPI capture_cleanup(DWORD);
+#else /* _WIN32 */
static void capture_cleanup(int);
-#endif
+#endif /* _WIN32 */
+#endif /* HAVE_LIBPCAP */
typedef struct {
capture_file *cf;
} cb_args_t;
static int load_cap_file(capture_file *, int);
-static void wtap_dispatch_cb_write(u_char *, const struct wtap_pkthdr *, int,
- union wtap_pseudo_header *, const u_char *);
+static void wtap_dispatch_cb_write(guchar *, const struct wtap_pkthdr *, long,
+ union wtap_pseudo_header *, const guchar *);
static void show_capture_file_io_error(const char *, int, gboolean);
-static void wtap_dispatch_cb_print(u_char *, const struct wtap_pkthdr *, int,
- union wtap_pseudo_header *, const u_char *);
+static void wtap_dispatch_cb_print(guchar *, const struct wtap_pkthdr *, long,
+ union wtap_pseudo_header *, const guchar *);
-packet_info pi;
capture_file cfile;
-FILE *data_out_file = NULL;
ts_type timestamp_type = RELATIVE;
#ifdef HAVE_LIBPCAP
-static int promisc_mode = TRUE;
+typedef struct {
+ int snaplen; /* Maximum captured packet length */
+ int promisc_mode; /* Capture in promiscuous mode */
+ int autostop_count; /* Maximum packet count */
+ gboolean has_autostop_duration; /* TRUE if maximum capture duration
+ is specified */
+ gint32 autostop_duration; /* Maximum capture duration */
+ gboolean has_autostop_filesize; /* TRUE if maximum capture file size
+ is specified */
+ gint32 autostop_filesize; /* Maximum capture file size */
+ gboolean ringbuffer_on; /* TRUE if ring buffer in use */
+ guint32 ringbuffer_num_files; /* Number of ring buffer files */
+} capture_options;
+
+static capture_options capture_opts = {
+ WTAP_MAX_PACKET_SIZE, /* snapshot length - default is
+ infinite, in effect */
+ TRUE, /* promiscuous mode is the default */
+ 0, /* max packet count - default is 0,
+ meaning infinite */
+ FALSE, /* maximum capture duration not
+ specified by default */
+ 0, /* maximum capture duration */
+ FALSE, /* maximum capture file size not
+ specified by default */
+ 0, /* maximum capture file size */
+ FALSE, /* ring buffer off by default */
+ RINGBUFFER_MIN_NUM_FILES /* default number of ring buffer
+ files */
+};
#endif
-static void
-print_usage(void)
+static void
+print_usage(gboolean print_ver)
{
int i;
- fprintf(stderr, "This is GNU t%s %s, compiled %s\n", PACKAGE, VERSION,
+ if (print_ver) {
+ fprintf(stderr, "This is GNU t%s %s, compiled %s\n", PACKAGE, VERSION,
comp_info_str->str);
+ }
#ifdef HAVE_LIBPCAP
- fprintf(stderr, "t%s [ -DvVhlp ] [ -c <count> ] [ -f <capture filter> ]\n", PACKAGE);
- fprintf(stderr, "\t[ -F <capture file type> ] [ -i <interface> ] [ -n ] [ -N <resolving> ]\n");
+ fprintf(stderr, "\nt%s [ -DvVhqSlp ] [ -a <capture autostop condition> ] ...\n",
+ PACKAGE);
+ fprintf(stderr, "\t[ -b <number of ring buffer files> ] [ -c <count> ]\n");
+ fprintf(stderr, "\t[ -f <capture filter> ] [ -F <output file type> ]\n");
+ fprintf(stderr, "\t[ -i <interface> ] [ -n ] [ -N <resolving> ]\n");
fprintf(stderr, "\t[ -o <preference setting> ] ... [ -r <infile> ] [ -R <read filter> ]\n");
fprintf(stderr, "\t[ -s <snaplen> ] [ -t <time stamp format> ] [ -w <savefile> ] [ -x ]\n");
#else
- fprintf(stderr, "t%s [ -vVhl ] [ -F <capture file type> ] [ -n ] [ -N <resolving> ]\n", PACKAGE);
+ fprintf(stderr, "\nt%s [ -vVhl ] [ -F <output file type> ] [ -n ] [ -N <resolving> ]\n", PACKAGE);
fprintf(stderr, "\t[ -o <preference setting> ] ... [ -r <infile> ] [ -R <read filter> ]\n");
fprintf(stderr, "\t[ -t <time stamp format> ] [ -w <savefile> ] [ -x ]\n");
#endif
+ fprintf(stderr, "\t[ -Z <statistics string> ]\n");
fprintf(stderr, "Valid file type arguments to the \"-F\" flag:\n");
for (i = 0; i < WTAP_NUM_FILE_TYPES; i++) {
if (wtap_dump_can_open(i))
fprintf(stderr, "\tdefault is libpcap\n");
}
-int
+#ifdef HAVE_LIBPCAP
+static int
get_positive_int(const char *string, const char *name)
{
long number;
exit(1);
}
if (number < 0) {
- fprintf(stderr, "tethereal: The specified %s \"%s\" is a negative number\n",
- name, string);
+ fprintf(stderr, "tethereal: The specified %s is a negative number\n",
+ name);
+ exit(1);
+ }
+ if (number == 0) {
+ fprintf(stderr, "tethereal: The specified %s is zero\n",
+ name);
exit(1);
}
if (number > INT_MAX) {
- fprintf(stderr, "tethereal: The specified %s \"%s\" is too large (greater than %d)\n",
- name, string, INT_MAX);
+ fprintf(stderr, "tethereal: The specified %s is too large (greater than %d)\n",
+ name, INT_MAX);
exit(1);
}
return number;
}
+/*
+ * Given a string of the form "<autostop criterion>:<value>", as might appear
+ * as an argument to a "-a" option, parse it and set the criterion in
+ * question. Return an indication of whether it succeeded or failed
+ * in some fashion.
+ */
+static gboolean
+set_autostop_criterion(const char *autostoparg)
+{
+ guchar *p, *colonp;
+
+ colonp = strchr(autostoparg, ':');
+ if (colonp == NULL)
+ return FALSE;
+
+ p = colonp;
+ *p++ = '\0';
+
+ /*
+ * Skip over any white space (there probably won't be any, but
+ * as we allow it in the preferences file, we might as well
+ * allow it here).
+ */
+ while (isspace(*p))
+ p++;
+ if (*p == '\0') {
+ /*
+ * Put the colon back, so if our caller uses, in an
+ * error message, the string they passed us, the message
+ * looks correct.
+ */
+ *colonp = ':';
+ return FALSE;
+ }
+ if (strcmp(autostoparg,"duration") == 0) {
+ capture_opts.has_autostop_duration = TRUE;
+ capture_opts.autostop_duration = get_positive_int(p,"autostop duration");
+ } else if (strcmp(autostoparg,"filesize") == 0) {
+ capture_opts.has_autostop_filesize = TRUE;
+ capture_opts.autostop_filesize = get_positive_int(p,"autostop filesize");
+ } else {
+ return FALSE;
+ }
+ *colonp = ':'; /* put the colon back */
+ return TRUE;
+}
+#endif
+
int
main(int argc, char *argv[])
{
extern char *optarg;
gboolean arg_error = FALSE;
#ifdef HAVE_LIBPCAP
-#ifdef WIN32
- char pcap_version[] = WPCAP_STRING;
-#else
+#ifdef HAVE_PCAP_VERSION
extern char pcap_version[];
-#endif
-#endif
+#endif /* HAVE_PCAP_VERSION */
+#endif /* HAVE_LIBPCAP */
#ifdef WIN32
WSADATA wsaData;
-#endif
- char *gpf_path, *pf_path;
+# ifdef HAVE_UCD_SNMP
+ char *mib_path;
+# define MIB_PATH_APPEND "\\snmp\\mibs"
+# endif /* HAVE_UCD_SNMP */
+#endif /* WIN32 */
+
+ char *gpf_path;
+ char *pf_path;
int gpf_open_errno, pf_open_errno;
int err;
#ifdef HAVE_LIBPCAP
gboolean capture_filter_specified = FALSE;
- int packet_count = 0;
GList *if_list, *if_entry;
gchar err_str[PCAP_ERRBUF_SIZE];
#else
#endif
int out_file_type = WTAP_FILE_PCAP;
gchar *cf_name = NULL, *rfilter = NULL;
+#ifdef HAVE_LIBPCAP
+ gchar *if_text;
+#endif
dfilter_t *rfcode = NULL;
e_prefs *prefs;
char badopt;
/* Register all dissectors; we must do this before checking for the
- "-G" flag, as the "-G" flag dumps a list of fields registered
- by the dissectors, and we must do it before we read the preferences,
- in case any dissectors register preferences. */
+ "-G" flag, as the "-G" flag dumps information registered by the
+ dissectors, and we must do it before we read the preferences, in
+ case any dissectors register preferences. */
epan_init(PLUGIN_DIR,register_all_protocols,register_all_protocol_handoffs);
/* Now register the preferences for any non-dissector modules.
We must do that before we read the preferences as well. */
prefs_register_modules();
- /* If invoked with the "-G" flag, we dump out a glossary of
- display filter symbols.
+ /* If invoked with the "-G" flag, we dump out information based on
+ the argument to the "-G" flag; if no argument is specified,
+ for backwards compatibility we dump out a glossary of display
+ filter symbols.
We do this here to mirror what happens in the GTK+ version, although
it's not necessary here. */
if (argc >= 2 && strcmp(argv[1], "-G") == 0) {
- proto_registrar_dump();
+ if (argc == 2)
+ proto_registrar_dump_fields();
+ else {
+ if (strcmp(argv[2], "fields") == 0)
+ proto_registrar_dump_fields();
+ else if (strcmp(argv[2], "protocols") == 0)
+ proto_registrar_dump_protocols();
+ else {
+ fprintf(stderr, "tethereal: Invalid \"%s\" option for -G flag\n",
+ argv[2]);
+ exit(1);
+ }
+ }
exit(0);
}
if (pf_path != NULL) {
fprintf(stderr, "Can't open your preferences file \"%s\": %s.\n", pf_path,
strerror(pf_open_errno));
+ g_free(pf_path);
+ pf_path = NULL;
}
+ /* Set the name resolution code's flags from the preferences. */
+ g_resolv_flags = prefs->name_resolve;
+
#ifdef WIN32
/* Load Wpcap, if possible */
load_wpcap();
#endif
-
- /* Initialize the capture file struct */
- cfile.plist = NULL;
- cfile.plist_end = NULL;
- cfile.wth = NULL;
- cfile.filename = NULL;
- cfile.user_saved = FALSE;
- cfile.is_tempfile = FALSE;
- cfile.rfcode = NULL;
- cfile.dfilter = NULL;
- cfile.dfcode = NULL;
-#ifdef HAVE_LIBPCAP
- cfile.cfilter = g_strdup("");
-#endif
- cfile.iface = NULL;
- cfile.save_file = NULL;
- cfile.save_file_fd = -1;
- cfile.snap = WTAP_MAX_PACKET_SIZE;
- cfile.count = 0;
- col_init(&cfile.cinfo, prefs->num_cols);
+
+ init_cap_file(&cfile);
/* Assemble the compile-time options */
comp_info_str = g_string_new("");
#ifdef HAVE_LIBPCAP
g_string_append(comp_info_str, ", with libpcap ");
+#ifdef HAVE_PCAP_VERSION
g_string_append(comp_info_str, pcap_version);
-#else
+#else /* HAVE_PCAP_VERSION */
+ g_string_append(comp_info_str, "(version unknown)");
+#endif /* HAVE_PCAP_VERSION */
+#else /* HAVE_LIBPCAP */
g_string_append(comp_info_str, ", without libpcap");
-#endif
+#endif /* HAVE_LIBPCAP */
#ifdef HAVE_LIBZ
g_string_append(comp_info_str, ", with libz ");
#endif /* HAVE_LIBZ */
/* Oh, this is pretty */
-#if defined(HAVE_UCD_SNMP_SNMP_H)
+#ifdef HAVE_UCD_SNMP
g_string_append(comp_info_str, ", with UCD SNMP ");
#ifdef HAVE_UCD_SNMP_VERSION_H
g_string_append(comp_info_str, VersionInfo);
#else /* HAVE_UCD_SNMP_VERSION_H */
g_string_append(comp_info_str, "(version unknown)");
#endif /* HAVE_UCD_SNMP_VERSION_H */
-#elif defined(HAVE_SNMP_SNMP_H)
- g_string_append(comp_info_str, ", with CMU SNMP ");
-#ifdef HAVE_SNMP_VERSION_H
- g_string_append(comp_info_str, snmp_Version());
-#else /* HAVE_SNMP_VERSION_H */
- g_string_append(comp_info_str, "(version unknown)");
-#endif /* HAVE_SNMP_VERSION_H */
-#else /* no SNMP */
- g_string_append(comp_info_str, ", without SNMP");
+#else /* no SNMP library */
+ g_string_append(comp_info_str, ", without UCD SNMP");
#endif
-
+
/* Now get our args */
- while ((opt = getopt(argc, argv, "c:Df:F:hi:lnN:o:pr:R:s:t:vw:Vx")) != EOF) {
+ while ((opt = getopt(argc, argv, "a:b:c:Df:F:hi:lnN:o:pqr:R:s:St:vw:Vxz:")) != -1) {
switch (opt) {
+ case 'a': /* autostop criteria */
+#ifdef HAVE_LIBPCAP
+ if (set_autostop_criterion(optarg) == FALSE) {
+ fprintf(stderr, "ethereal: Invalid or unknown -a flag \"%s\"\n", optarg);
+ exit(1);
+ }
+#else
+ capture_option_specified = TRUE;
+ arg_error = TRUE;
+#endif
+ break;
+ case 'b': /* Ringbuffer option */
+#ifdef HAVE_LIBPCAP
+ capture_opts.ringbuffer_on = TRUE;
+ capture_opts.ringbuffer_num_files =
+ get_positive_int(optarg, "number of ring buffer files");
+#else
+ capture_option_specified = TRUE;
+ arg_error = TRUE;
+#endif
+ break;
case 'c': /* Capture xxx packets */
#ifdef HAVE_LIBPCAP
- packet_count = get_positive_int(optarg, "packet count");
+ capture_opts.autostop_count =
+ get_positive_int(optarg, "packet count");
#else
capture_option_specified = TRUE;
arg_error = TRUE;
case 'f':
#ifdef HAVE_LIBPCAP
capture_filter_specified = TRUE;
+ if (cfile.cfilter)
+ g_free(cfile.cfilter);
cfile.cfilter = g_strdup(optarg);
#else
capture_option_specified = TRUE;
}
break;
case 'h': /* Print help and exit */
- print_usage();
+ print_usage(TRUE);
exit(0);
break;
case 'i': /* Use interface xxx */
line_buffered = TRUE;
break;
case 'n': /* No name resolution */
- prefs->name_resolve = PREFS_RESOLV_NONE;
+ g_resolv_flags = RESOLV_NONE;
break;
case 'N': /* Select what types of addresses/port #s to resolve */
- if (prefs->name_resolve == PREFS_RESOLV_ALL)
- prefs->name_resolve = PREFS_RESOLV_NONE;
- badopt = string_to_name_resolve(optarg, &prefs->name_resolve);
+ if (g_resolv_flags == RESOLV_ALL)
+ g_resolv_flags = RESOLV_NONE;
+ badopt = string_to_name_resolve(optarg, &g_resolv_flags);
if (badopt != '\0') {
fprintf(stderr, "tethereal: -N specifies unknown resolving option '%c'; valid options are 'm', 'n', and 't'\n",
badopt);
break;
case PREFS_SET_NO_SUCH_PREF:
+ case PREFS_SET_OBSOLETE:
fprintf(stderr, "tethereal: -o flag \"%s\" specifies unknown preference\n",
optarg);
exit(1);
break;
case 'p': /* Don't capture in promiscuous mode */
#ifdef HAVE_LIBPCAP
- promisc_mode = 0;
+ capture_opts.promisc_mode = FALSE;
#else
capture_option_specified = TRUE;
arg_error = TRUE;
#endif
break;
+ case 'q': /* Quiet */
+ quiet = TRUE;
+ break;
case 'r': /* Read capture file xxx */
cf_name = g_strdup(optarg);
break;
break;
case 's': /* Set the snapshot (capture) length */
#ifdef HAVE_LIBPCAP
- cfile.snap = get_positive_int(optarg, "snapshot length");
+ capture_opts.snaplen = get_positive_int(optarg, "snapshot length");
#else
capture_option_specified = TRUE;
arg_error = TRUE;
#endif
break;
+ case 'S': /* show packets in real time */
+ decode = TRUE;
+ break;
case 't': /* Time stamp type */
if (strcmp(optarg, "r") == 0)
timestamp_type = RELATIVE;
case 'x': /* Print packet data in hex (and ASCII) */
print_hex = TRUE;
break;
+ case 'z':
+ if(!strncmp(optarg,"rpc,",4)){
+ if(!strncmp(optarg,"rpc,rtt,",8)){
+ int rpcprogram, rpcversion;
+ int pos=0;
+ if(sscanf(optarg,"rpc,rtt,%d,%d,%n",&rpcprogram,&rpcversion,&pos)==2){
+ if(pos){
+ rpcstat_init(rpcprogram,rpcversion,optarg+pos);
+ } else {
+ rpcstat_init(rpcprogram,rpcversion,NULL);
+ }
+ } else {
+ fprintf(stderr, "tethereal: invalid \"-z rpc,rtt,<program>,<version>[,<filter>]\" argument\n");
+ exit(1);
+ }
+ } else if(!strncmp(optarg,"rpc,programs",12)){
+ rpcprogs_init();
+ } else {
+ fprintf(stderr, "tethereal: invalid -z argument. Argument must be one of:\n");
+ fprintf(stderr, " \"-z rpc,rtt,<program>,<version>[,<filter>]\"\n");
+ fprintf(stderr, " \"-z rpc,programs\"\n");
+ exit(1);
+ }
+ } else if(!strncmp(optarg,"dcerpc,",7)){
+ if(!strncmp(optarg,"dcerpc,rtt,",11)){
+ e_uuid_t uuid;
+ int d1,d2,d3,d40,d41,d42,d43,d44,d45,d46,d47;
+ int major, minor;
+ int pos=0;
+ if(sscanf(optarg,"dcerpc,rtt,%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x,%d.%d%n", &d1,&d2,&d3,&d40,&d41,&d42,&d43,&d44,&d45,&d46,&d47,&major,&minor,&pos)==13){
+ uuid.Data1=d1;
+ uuid.Data2=d2;
+ uuid.Data3=d3;
+ uuid.Data4[0]=d40;
+ uuid.Data4[1]=d41;
+ uuid.Data4[2]=d42;
+ uuid.Data4[3]=d43;
+ uuid.Data4[4]=d44;
+ uuid.Data4[5]=d45;
+ uuid.Data4[6]=d46;
+ uuid.Data4[7]=d47;
+ if(pos){
+ dcerpcstat_init(&uuid,major,minor,optarg+pos);
+ } else {
+ dcerpcstat_init(&uuid,major,minor,NULL);
+ }
+ } else {
+ fprintf(stderr, "tethereal: invalid \"-z dcerpc,rtt,<uuid>,<major version>.<minor version>[,<filter>]\" argument\n");
+ exit(1);
+ }
+ } else {
+ fprintf(stderr, "tethereal: invalid -z argument. Argument must be one of:\n");
+ fprintf(stderr, " \"-z dcerpc,rtt,<uuid>,<major version>.<minor version>[,<filter>]\"\n");
+ exit(1);
+ }
+ } else {
+ fprintf(stderr, "tethereal: invalid -z argument. Argument must be one of:\n");
+ fprintf(stderr, " \"-z rpc,...\"\n");
+ fprintf(stderr, " \"-z dcerpc,...\"\n");
+ exit(1);
+ }
+ break;
+ default:
+ case '?': /* Bad flag - print usage message */
+ arg_error = TRUE;
+ break;
}
}
-
+
/* If no capture filter or read filter has been specified, and there are
still command-line arguments, treat them as the tokens of a capture
filter (if no "-r" flag was specified) or a read filter (if a "-r"
}
}
+ /* See if we're writing a capture file and the file is a pipe */
+#ifdef HAVE_LIBPCAP
+ ld.output_to_pipe = FALSE;
+#endif
+ if (cfile.save_file != NULL) {
+ if (!strcmp(cfile.save_file, "-")) {
+ /* stdout */
+ g_free(cfile.save_file);
+ cfile.save_file = g_strdup("");
+#ifdef HAVE_LIBPCAP
+ ld.output_to_pipe = TRUE;
+#endif
+ }
+#ifdef HAVE_LIBPCAP
+ else {
+ err = test_for_fifo(cfile.save_file);
+ switch (err) {
+
+ case ENOENT: /* it doesn't exist, so we'll be creating it,
+ and it won't be a FIFO */
+ case 0: /* found it, but it's not a FIFO */
+ break;
+
+ case ESPIPE: /* it is a FIFO */
+ ld.output_to_pipe = TRUE;
+ break;
+
+ default: /* couldn't stat it */
+ fprintf(stderr,
+ "tethereal: Error testing whether capture file is a pipe: %s\n",
+ strerror(errno));
+ exit(2);
+ }
+ }
+#endif
+ }
+
+#ifdef HAVE_LIBPCAP
+ /* If they didn't specify a "-w" flag, but specified a maximum capture
+ file size, tell them that this doesn't work, and exit. */
+ if (capture_opts.has_autostop_filesize && cfile.save_file == NULL) {
+ fprintf(stderr, "tethereal: Maximum capture file size specified, but "
+ "capture isn't being saved to a file.\n");
+ exit(2);
+ }
+
+ if (capture_opts.ringbuffer_on) {
+ /* Ring buffer works only under certain conditions:
+ a) ring buffer does not work if you're not saving the capture to
+ a file;
+ b) ring buffer only works if you're saving in libpcap format;
+ c) it makes no sense to enable the ring buffer if the maximum
+ file size is set to "infinite";
+ d) file must not be a pipe. */
+ if (cfile.save_file == NULL) {
+ fprintf(stderr, "tethereal: Ring buffer requested, but "
+ "capture isn't being saved to a file.\n");
+ exit(2);
+ }
+ if (out_file_type != WTAP_FILE_PCAP) {
+ fprintf(stderr, "tethereal: Ring buffer requested, but "
+ "capture isn't being saved in libpcap format.\n");
+ exit(2);
+ }
+ if (!capture_opts.has_autostop_filesize) {
+ fprintf(stderr, "tethereal: Ring buffer requested, but "
+ "no maximum capture file size was specified.\n");
+ exit(2);
+ }
+ if (ld.output_to_pipe) {
+ fprintf(stderr, "tethereal: Ring buffer requested, but "
+ "capture file is a pipe.\n");
+ exit(2);
+ }
+ }
+#endif
+
#ifdef WIN32
/* Start windows sockets */
WSAStartup( MAKEWORD( 1, 1 ), &wsaData );
-#endif
+
+# ifdef HAVE_UCD_SNMP
+ /* Set MIBDIRS so that the SNMP library can find its mibs. */
+ /* XXX - Should we set MIBS or MIBFILES as well? */
+
+ mib_path = g_malloc (strlen(get_datafile_dir()) + strlen(MIB_PATH_APPEND) + 20);
+ sprintf (mib_path, "MIBDIRS=%s\\%s", get_datafile_dir(), MIB_PATH_APPEND);
+ /* Amazingly enough, Windows does not provide setenv(). */
+ if (getenv("MIBDIRS") == NULL)
+ _putenv(mib_path);
+ g_free(mib_path);
+
+# endif /* HAVE_UCD_SNMP */
+#endif /* WIN32 */
/* Notify all registered modules that have had any of their preferences
changed either from one of the preferences file or from the command
- line that its preferences have changed. */
+ line that their preferences have changed. */
prefs_apply_all();
#ifndef HAVE_LIBPCAP
if (capture_option_specified)
fprintf(stderr, "This version of Tethereal was not built with support for capturing packets.\n");
#endif
- if (arg_error)
- print_usage();
+ if (arg_error) {
+ print_usage(FALSE);
+ exit(1);
+ }
- /* Build the column format array */
+ /* Build the column format array */
+ col_init(&cfile.cinfo, prefs->num_cols);
for (i = 0; i < cfile.cinfo.num_cols; i++) {
cfile.cinfo.col_fmt[i] = get_column_format(i);
cfile.cinfo.col_title[i] = g_strdup(get_column_title(i));
cfile.cinfo.col_buf[i] = (gchar *) g_malloc(sizeof(gchar) * COL_MAX_INFO_LEN);
else
cfile.cinfo.col_buf[i] = (gchar *) g_malloc(sizeof(gchar) * COL_MAX_LEN);
+
+ cfile.cinfo.col_expr[i] = (gchar *) g_malloc(sizeof(gchar) * COL_MAX_LEN);
+ cfile.cinfo.col_expr_val[i] = (gchar *) g_malloc(sizeof(gchar) * COL_MAX_LEN);
}
- if (cfile.snap < 1)
- cfile.snap = WTAP_MAX_PACKET_SIZE;
- else if (cfile.snap < MIN_PACKET_SIZE)
- cfile.snap = MIN_PACKET_SIZE;
-
+#ifdef HAVE_LIBPCAP
+ if (capture_opts.snaplen < 1)
+ capture_opts.snaplen = WTAP_MAX_PACKET_SIZE;
+ else if (capture_opts.snaplen < MIN_PACKET_SIZE)
+ capture_opts.snaplen = MIN_PACKET_SIZE;
+
+ /* Check the value range of the ringbuffer_num_files parameter */
+ if (capture_opts.ringbuffer_num_files < RINGBUFFER_MIN_NUM_FILES)
+ capture_opts.ringbuffer_num_files = RINGBUFFER_MIN_NUM_FILES;
+ else if (capture_opts.ringbuffer_num_files > RINGBUFFER_MAX_NUM_FILES)
+ capture_opts.ringbuffer_num_files = RINGBUFFER_MAX_NUM_FILES;
+#endif
+
if (rfilter != NULL) {
if (!dfilter_compile(rfilter, &rfcode)) {
fprintf(stderr, "tethereal: %s\n", dfilter_error_msg);
/* Yes; did the user specify an interface to use? */
if (cfile.iface == NULL) {
- /* No - pick the first one from the list of interfaces. */
- if_list = get_interface_list(&err, err_str);
- if (if_list == NULL) {
- switch (err) {
-
- case CANT_GET_INTERFACE_LIST:
- fprintf(stderr, "tethereal: Can't get list of interfaces: %s\n",
- err_str);
- break;
-
- case NO_INTERFACES_FOUND:
- fprintf(stderr, "tethereal: There are no interfaces on which a capture can be done\n");
- break;
+ /* No - is a default specified in the preferences file? */
+ if (prefs->capture_device != NULL) {
+ /* Yes - use it. */
+ if_text = strrchr(prefs->capture_device, ' ');
+ if (if_text == NULL) {
+ cfile.iface = g_strdup(prefs->capture_device);
+ } else {
+ cfile.iface = g_strdup(if_text + 1); /* Skip over space */
+ }
+ } else {
+ /* No - pick the first one from the list of interfaces. */
+ if_list = get_interface_list(&err, err_str);
+ if (if_list == NULL) {
+ switch (err) {
+
+ case CANT_GET_INTERFACE_LIST:
+ fprintf(stderr, "tethereal: Can't get list of interfaces: %s\n",
+ err_str);
+ break;
+
+ case NO_INTERFACES_FOUND:
+ fprintf(stderr, "tethereal: There are no interfaces on which a capture can be done\n");
+ break;
+ }
+ exit(2);
}
- exit(2);
+ if_text = strrchr(if_list->data, ' '); /* first interface */
+ if (if_text == NULL) {
+ cfile.iface = g_strdup(if_list->data);
+ } else {
+ cfile.iface = g_strdup(if_text + 1); /* Skip over space */
+ }
+ free_interface_list(if_list);
}
- cfile.iface = g_strdup(if_list->data); /* first interface */
- free_interface_list(if_list);
}
- capture(packet_count, out_file_type);
+ capture(out_file_type);
+
+ if (capture_opts.ringbuffer_on) {
+ ringbuf_free();
+ }
#else
/* No - complain. */
fprintf(stderr, "This version of Tethereal was not built with support for capturing packets.\n");
#endif
}
+ draw_tap_listeners(TRUE);
epan_cleanup();
return 0;
/* Do the low-level work of a capture.
Returns TRUE if it succeeds, FALSE otherwise. */
static int
-capture(int packet_count, int out_file_type)
+capture(int out_file_type)
{
- gchar err_str[PCAP_ERRBUF_SIZE];
+ gchar open_err_str[PCAP_ERRBUF_SIZE];
+ gchar lookup_net_err_str[PCAP_ERRBUF_SIZE];
bpf_u_int32 netnum, netmask;
struct bpf_program fcode;
void (*oldhandler)(int);
- int err, inpkts;
+ int err = 0;
+ int volatile volatile_err = 0;
+ int volatile inpkts = 0;
+ int pcap_cnt;
char errmsg[1024+1];
+ condition *volatile cnd_stop_capturesize = NULL;
+ condition *volatile cnd_stop_timeout = NULL;
#ifndef _WIN32
static const char ppamsg[] = "can't find PPA for ";
char *libpcap_warn;
#endif
struct pcap_stat stats;
+ gboolean write_err;
+ gboolean dump_ok;
- /* Initialize the table of conversations. */
- epan_conversation_init();
-
- /* Initialize protocol-specific variables */
- init_all_protocols();
-
- /* Initialize the common data structures for fragment reassembly.
- Must be done *after* "init_all_protocols()", as "init_all_protocols()"
- may free up space for fragments, which it finds by using the
- data structures that "reassemble_init()" frees. */
- reassemble_init();
+ /* Initialize all data structures used for dissection. */
+ init_dissection();
ld.linktype = WTAP_ENCAP_UNKNOWN;
ld.pdh = NULL;
- /* Open the network interface to capture from it. */
- ld.pch = pcap_open_live(cfile.iface, cfile.snap, promisc_mode, 1000, err_str);
+ /* Open the network interface to capture from it.
+ Some versions of libpcap may put warnings into the error buffer
+ if they succeed; to tell if that's happened, we have to clear
+ the error buffer, and check if it's still a null string. */
+ open_err_str[0] = '\0';
+ ld.pch = pcap_open_live(cfile.iface, capture_opts.snaplen,
+ capture_opts.promisc_mode, 1000, open_err_str);
if (ld.pch == NULL) {
/* Well, we couldn't start the capture. */
"Note that the driver Tethereal uses for packet capture on Windows\n"
"doesn't support capturing on Token Ring interfaces, and doesn't\n"
"support capturing on PPP/WAN interfaces in Windows NT/2000.\n",
- err_str);
+ open_err_str);
#else
/* If we got a "can't find PPA for XXX" message, warn the user (who
is running Ethereal on HP-UX) that they don't have a version
of libpcap that properly handles HP-UX (libpcap 0.6.x and later
versions, which properly handle HP-UX, say "can't find /dev/dlpi
PPA for XXX" rather than "can't find PPA for XXX"). */
- if (strncmp(err_str, ppamsg, sizeof ppamsg - 1) == 0)
+ if (strncmp(open_err_str, ppamsg, sizeof ppamsg - 1) == 0)
libpcap_warn =
"\n\n"
"You are running Tethereal with a version of the libpcap library\n"
snprintf(errmsg, sizeof errmsg,
"The capture session could not be initiated (%s).\n"
"Please check to make sure you have sufficient permissions, and that\n"
- "you have the proper interface specified.%s", err_str, libpcap_warn);
+ "you have the proper interface specified.%s", open_err_str, libpcap_warn);
#endif
goto error;
}
if (cfile.cfilter) {
/* A capture filter was specified; set it up. */
- if (pcap_lookupnet (cfile.iface, &netnum, &netmask, err_str) < 0) {
+ if (pcap_lookupnet(cfile.iface, &netnum, &netmask, lookup_net_err_str) < 0) {
/*
* Well, we can't get the netmask for this interface; it's used
* only for filters that check for broadcast IP addresses, so
* we just warn the user, and punt and use 0.
*/
- fprintf(stderr,
- "Warning: Couldn't obtain netmask info (%s)\n.", err_str);
+ fprintf(stderr,
+ "Warning: Couldn't obtain netmask info (%s).\n", lookup_net_err_str);
netmask = 0;
}
if (pcap_compile(ld.pch, &fcode, cfile.cfilter, 1, netmask) < 0) {
}
}
- ld.linktype = wtap_pcap_encap_to_wtap_encap(pcap_datalink(ld.pch));
+ ld.linktype = wtap_pcap_encap_to_wtap_encap(get_pcap_linktype(ld.pch,
+ cfile.iface));
if (cfile.save_file != NULL) {
/* Set up to write to the capture file. */
if (ld.linktype == WTAP_ENCAP_UNKNOWN) {
" that Tethereal doesn't support.");
goto error;
}
- ld.pdh = wtap_dump_open(cfile.save_file, out_file_type,
- ld.linktype, pcap_snapshot(ld.pch), &err);
+ if (capture_opts.ringbuffer_on) {
+ cfile.save_file_fd = ringbuf_init(cfile.save_file,
+ capture_opts.ringbuffer_num_files);
+ if (cfile.save_file_fd != -1) {
+ ld.pdh = ringbuf_init_wtap_dump_fdopen(out_file_type, ld.linktype,
+ pcap_snapshot(ld.pch), &err);
+ } else {
+ err = errno; /* "ringbuf_init()" failed */
+ ld.pdh = NULL;
+ }
+ } else {
+ ld.pdh = wtap_dump_open(cfile.save_file, out_file_type,
+ ld.linktype, pcap_snapshot(ld.pch), &err);
+ }
if (ld.pdh == NULL) {
- snprintf(errmsg, sizeof errmsg, file_open_error_message(errno, TRUE),
- cfile.save_file);
+ snprintf(errmsg, sizeof errmsg,
+ file_open_error_message(err, TRUE, out_file_type),
+ *cfile.save_file == '\0' ? "stdout" : cfile.save_file);
goto error;
}
}
+ /* Does "open_err_str" contain a non-empty string? If so, "pcap_open_live()"
+ returned a warning; print it, but keep capturing. */
+ if (open_err_str[0] != '\0')
+ fprintf(stderr, "tethereal: WARNING: %s.\n", open_err_str);
+
+#ifdef _WIN32
+ /* Catch a CTRL+C event and, if we get it, clean up and exit. */
+ SetConsoleCtrlHandler(capture_cleanup, TRUE);
+#else /* _WIN32 */
/* Catch SIGINT and SIGTERM and, if we get either of them, clean up
and exit.
- XXX - deal with signal semantics on various platforms. Or just
+ XXX - deal with signal semantics on various UNIX platforms. Or just
use "sigaction()" and be done with it? */
signal(SIGTERM, capture_cleanup);
signal(SIGINT, capture_cleanup);
-#if !defined(WIN32)
if ((oldhandler = signal(SIGHUP, capture_cleanup)) != SIG_DFL)
signal(SIGHUP, oldhandler);
-#endif
+#endif /* _WIN32 */
/* Let the user know what interface was chosen. */
fprintf(stderr, "Capturing on %s\n", cfile.iface);
- fflush(stderr);
- inpkts = pcap_loop(ld.pch, packet_count, capture_pcap_cb, (u_char *) &ld);
+ /* initialize capture stop conditions */
+ init_capture_stop_conditions();
+ /* create stop conditions */
+ if (capture_opts.has_autostop_filesize)
+ cnd_stop_capturesize = cnd_new((char*)CND_CLASS_CAPTURESIZE,
+ (long)capture_opts.autostop_filesize * 1000);
+ if (capture_opts.has_autostop_duration)
+ cnd_stop_timeout = cnd_new((char*)CND_CLASS_TIMEOUT,
+ (gint32)capture_opts.autostop_duration);
+
+ if (!setjmp(ld.stopenv))
+ ld.go = TRUE;
+ else
+ ld.go = FALSE;
+ ld.packet_count = 0;
+ while (ld.go) {
+ /* We need to be careful with automatic variables defined in the
+ outer scope which are changed inside the loop. Most compilers
+ don't try to roll them back to their original values after the
+ longjmp which causes the loop to finish, but all that the
+ standards say is that their values are indeterminate. If we
+ don't want them to be rolled back, we should define them with the
+ volatile attribute (paraphrasing W. Richard Stevens, Advanced
+ Programming in the UNIX Environment, p. 178).
+
+ The "err" variable causes a particular problem. If we give it
+ the volatile attribute, then when we pass a reference to it (as
+ in "&err") to a function, GCC warns: "passing arg <n> of
+ <function> discards qualifiers from pointer target type".
+ Therefore within the loop and just beyond we don't use "err".
+ Within the loop we define "loop_err", and assign its value to
+ "volatile_err", which is in the outer scope and is checked when
+ the loop finishes.
+
+ We also define "packet_count_prev" here to keep things tidy,
+ since it's used only inside the loop. If it were defined in the
+ outer scope, GCC would give a warning (unnecessary in this case)
+ that it might be clobbered, and we'd need to give it the volatile
+ attribute to suppress the warning. */
+
+ int loop_err = 0;
+ int packet_count_prev = 0;
+
+ if (cnd_stop_capturesize == NULL && cnd_stop_timeout == NULL) {
+ /* We're not stopping at a particular capture file size, and we're
+ not stopping after some particular amount of time has expired,
+ so either we have no stop condition or the only stop condition
+ is a maximum packet count.
+
+ If there's no maximum packet count, pass it -1, meaning "until
+ you run out of packets in the bufferful you read". Otherwise,
+ pass it the number of packets we have left to capture.
+
+ We don't call "pcap_loop()" as, if we're saving to a file that's
+ a FIFO, we want to flush the FIFO after we're done processing
+ this libpcap bufferful of packets, so that the program
+ reading the FIFO sees the packets immediately and doesn't get
+ any partial packet, forcing it to block in the middle of reading
+ that packet. */
+ if (capture_opts.autostop_count == 0)
+ pcap_cnt = -1;
+ else {
+ if (ld.packet_count >= capture_opts.autostop_count) {
+ /* XXX do we need this test here? */
+ /* It appears there's nothing more to capture. */
+ break;
+ }
+ pcap_cnt = capture_opts.autostop_count - ld.packet_count;
+ }
+ } else {
+ /* We need to check the capture file size or the timeout after
+ each packet. */
+ pcap_cnt = 1;
+ }
+ inpkts = pcap_dispatch(ld.pch, pcap_cnt, capture_pcap_cb, (guchar *) &ld);
+ if (inpkts < 0) {
+ /* Error from "pcap_dispatch()". */
+ ld.go = FALSE;
+ } else if (cnd_stop_timeout != NULL && cnd_eval(cnd_stop_timeout)) {
+ /* The specified capture time has elapsed; stop the capture. */
+ ld.go = FALSE;
+ } else if (inpkts > 0) {
+ if (capture_opts.autostop_count != 0 &&
+ ld.packet_count >= capture_opts.autostop_count) {
+ /* The specified number of packets have been captured and have
+ passed both any capture filter in effect and any read filter
+ in effect. */
+ ld.go = FALSE;
+ } else if (cnd_stop_capturesize != NULL &&
+ cnd_eval(cnd_stop_capturesize,
+ (guint32)wtap_get_bytes_dumped(ld.pdh))) {
+ /* We're saving the capture to a file, and the capture file reached
+ its maximum size. */
+ if (capture_opts.ringbuffer_on) {
+ /* Switch to the next ringbuffer file */
+ if (ringbuf_switch_file(&cfile, &ld.pdh, &loop_err)) {
+ /* File switch succeeded: reset the condition */
+ cnd_reset(cnd_stop_capturesize);
+ } else {
+ /* File switch failed: stop here */
+ volatile_err = loop_err;
+ ld.go = FALSE;
+ }
+ } else {
+ /* No ringbuffer - just stop. */
+ ld.go = FALSE;
+ }
+ }
+ if (ld.output_to_pipe) {
+ if (ld.packet_count > packet_count_prev) {
+ if (fflush(wtap_dump_file(ld.pdh))) {
+ volatile_err = errno;
+ ld.go = FALSE;
+ }
+ packet_count_prev = ld.packet_count;
+ }
+ }
+ } /* inpkts > 0 */
+ } /* while (ld.go) */
- if (cfile.save_file != NULL) {
+ /* delete stop conditions */
+ if (cnd_stop_capturesize != NULL)
+ cnd_delete(cnd_stop_capturesize);
+ if (cnd_stop_timeout != NULL)
+ cnd_delete(cnd_stop_timeout);
+
+ if ((cfile.save_file != NULL) && !quiet) {
/* We're saving to a file, which means we're printing packet counts
- to the standard output. Send a newline so that we move to the
- line after the packet count. */
+ to stderr if we are not running silent and deep.
+ Send a newline so that we move to the line after the packet count. */
fprintf(stderr, "\n");
}
pcap_geterr(ld.pch));
}
+ if (volatile_err == 0)
+ write_err = FALSE;
+ else {
+ show_capture_file_io_error(cfile.save_file, volatile_err, FALSE);
+ write_err = TRUE;
+ }
+
+ if (cfile.save_file != NULL) {
+ /* We're saving to a file or files; close all files. */
+ if (capture_opts.ringbuffer_on) {
+ dump_ok = ringbuf_wtap_dump_close(&cfile, &err);
+ } else {
+ dump_ok = wtap_dump_close(ld.pdh, &err);
+ }
+ /* If we've displayed a message about a write error, there's no point
+ in displaying another message about an error on close. */
+ if (!dump_ok && !write_err)
+ show_capture_file_io_error(cfile.save_file, err, TRUE);
+ }
+
/* Get the capture statistics, and, if any packets were dropped, report
that. */
if (pcap_stats(ld.pch, &stats) >= 0) {
fprintf(stderr, "tethereal: Can't get packet-drop statistics: %s\n",
pcap_geterr(ld.pch));
}
+ /* Report the number of captured packets if not reported during capture
+ and we are saving to a file. */
+ if (quiet && (cfile.save_file != NULL)) {
+ fprintf(stderr, "%u packets captured\n", ld.packet_count);
+ }
+
pcap_close(ld.pch);
return TRUE;
error:
+ if (capture_opts.ringbuffer_on) {
+ ringbuf_error_cleanup();
+ }
g_free(cfile.save_file);
cfile.save_file = NULL;
fprintf(stderr, "tethereal: %s\n", errmsg);
}
static void
-capture_pcap_cb(u_char *user, const struct pcap_pkthdr *phdr,
- const u_char *pd)
+capture_pcap_cb(guchar *user, const struct pcap_pkthdr *phdr,
+ const guchar *pd)
{
struct wtap_pkthdr whdr;
+ union wtap_pseudo_header pseudo_header;
loop_data *ld = (loop_data *) user;
cb_args_t args;
+ int err;
- whdr.ts.tv_sec = phdr->ts.tv_sec;
- whdr.ts.tv_usec = phdr->ts.tv_usec;
- whdr.caplen = phdr->caplen;
- whdr.len = phdr->len;
- whdr.pkt_encap = ld->linktype;
+ /* Convert from libpcap to Wiretap format.
+ If that fails, ignore the packet (wtap_process_pcap_packet has
+ written an error message). */
+ pd = wtap_process_pcap_packet(ld->linktype, phdr, pd, &pseudo_header,
+ &whdr, &err);
+ if (pd == NULL) {
+ return;
+ }
args.cf = &cfile;
args.pdh = ld->pdh;
if (ld->pdh) {
- wtap_dispatch_cb_write((u_char *)&args, &whdr, 0, NULL, pd);
- fprintf(stderr, "\r%u ", cfile.count);
- fflush(stdout);
+ wtap_dispatch_cb_write((guchar *)&args, &whdr, 0, &pseudo_header, pd);
+ /* Report packet capture count if not quiet */
+ if (!quiet) {
+ if (!decode) {
+ if (ld->packet_count != 0) {
+ fprintf(stderr, "\r%u ", ld->packet_count);
+ /* stderr could be line buffered */
+ fflush(stderr);
+ }
+ } else {
+ wtap_dispatch_cb_print((guchar *)&args, &whdr, 0,
+ &pseudo_header, pd);
+ }
+ }
} else {
- wtap_dispatch_cb_print((u_char *)&args, &whdr, 0, NULL, pd);
+ wtap_dispatch_cb_print((guchar *)&args, &whdr, 0, &pseudo_header, pd);
}
}
+#ifdef _WIN32
+static BOOL WINAPI
+capture_cleanup(DWORD ctrltype _U_)
+{
+ /* CTRL_C_EVENT is sort of like SIGINT, CTRL_BREAK_EVENT is unique to
+ Windows, CTRL_CLOSE_EVENT is sort of like SIGHUP, CTRL_LOGOFF_EVENT
+ is also sort of like SIGHUP, and CTRL_SHUTDOWN_EVENT is sort of
+ like SIGTERM at least when the machine's shutting down.
+
+ For now, we handle them all as indications that we should clean up
+ and quit, just as we handle SIGINT, SIGHUP, and SIGTERM in that
+ way on UNIX.
+
+ However, as handlers run in a new thread, we can't just longjmp
+ out; we have to set "ld.go" to FALSE, and must return TRUE so that
+ no other handler - such as one that would terminate the process -
+ gets called.
+
+ XXX - for some reason, typing ^C to Tethereal, if you run this in
+ a Cygwin console window in at least some versions of Cygwin,
+ causes Tethereal to terminate immediately; this routine gets
+ called, but the main loop doesn't get a chance to run and
+ exit cleanly, at least if this is compiled with Microsoft Visual
+ C++ (i.e., it's a property of the Cygwin console window or Bash;
+ it happens if Tethereal is not built with Cygwin - for all I know,
+ building it with Cygwin may make the problem go away). */
+ ld.go = FALSE;
+ return TRUE;
+}
+#else
static void
-capture_cleanup(int signum)
+capture_cleanup(int signum _U_)
{
- int err;
-
- fprintf(stderr, "\n");
- pcap_close(ld.pch);
- if (ld.pdh != NULL) {
- if (!wtap_dump_close(ld.pdh, &err)) {
- show_capture_file_io_error(cfile.save_file, err, TRUE);
- exit(2);
- }
- }
- exit(0);
+ /* Longjmp back to the starting point; "pcap_dispatch()", on many
+ UNIX platforms, just keeps looping if it gets EINTR, so if we set
+ "ld.go" to FALSE and return, we won't break out of it and quit
+ capturing. */
+ longjmp(ld.stopenv, 1);
}
+#endif /* _WIN32 */
#endif /* HAVE_LIBPCAP */
static int
load_cap_file(capture_file *cf, int out_file_type)
{
gint linktype;
+ int snapshot_length;
wtap_dumper *pdh;
int err;
int success;
linktype = wtap_file_encap(cf->wth);
if (cf->save_file != NULL) {
/* Set up to write to the capture file. */
+ snapshot_length = wtap_snapshot_length(cf->wth);
+ if (snapshot_length == 0) {
+ /* Snapshot length of input file not known. */
+ snapshot_length = WTAP_MAX_PACKET_SIZE;
+ }
pdh = wtap_dump_open(cf->save_file, out_file_type,
- linktype, wtap_snapshot_length(cf->wth), &err);
+ linktype, snapshot_length, &err);
if (pdh == NULL) {
/* We couldn't set up to write to the capture file. */
case WTAP_ERR_UNSUPPORTED_ENCAP:
case WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED:
fprintf(stderr,
-"tethereal: The capture file being read cannot be written in that format.\n");
+ "tethereal: The capture file being read cannot be written in "
+ "that format.\n");
break;
case WTAP_ERR_CANT_OPEN:
fprintf(stderr,
-"tethereal: The file \"%s\" couldn't be created for some unknown reason.\n",
- cf->save_file);
+ "tethereal: The file \"%s\" couldn't be created for some "
+ "unknown reason.\n",
+ *cf->save_file == '\0' ? "stdout" : cf->save_file);
break;
case WTAP_ERR_SHORT_WRITE:
fprintf(stderr,
-"tethereal: A full header couldn't be written to the file \"%s\".\n",
- cf->save_file);
+ "tethereal: A full header couldn't be written to the file \"%s\".\n",
+ *cf->save_file == '\0' ? "stdout" : cf->save_file);
break;
default:
- if (err < 0) {
- fprintf(stderr,
- "tethereal: The file \"%s\" could not be opened: Error %d.\n",
- cf->save_file, err);
- } else {
- fprintf(stderr,
- "tethereal: The file \"%s\" could not be opened: %s\n.",
- cf->save_file, strerror(err));
- }
+ fprintf(stderr,
+ "tethereal: The file \"%s\" could not be created: %s\n.",
+ *cf->save_file == '\0' ? "stdout" : cf->save_file,
+ wtap_strerror(err));
break;
}
goto out;
}
args.cf = cf;
args.pdh = pdh;
- success = wtap_loop(cf->wth, 0, wtap_dispatch_cb_write, (u_char *) &args,
+ success = wtap_loop(cf->wth, 0, wtap_dispatch_cb_write, (guchar *) &args,
&err);
+
+ /* Now close the capture file. */
+ if (!wtap_dump_close(pdh, &err))
+ show_capture_file_io_error(cfile.save_file, err, TRUE);
} else {
args.cf = cf;
args.pdh = NULL;
- success = wtap_loop(cf->wth, 0, wtap_dispatch_cb_print, (u_char *) &args,
+ success = wtap_loop(cf->wth, 0, wtap_dispatch_cb_print, (guchar *) &args,
&err);
}
if (!success) {
static void
fill_in_fdata(frame_data *fdata, capture_file *cf,
- const struct wtap_pkthdr *phdr,
- const union wtap_pseudo_header *pseudo_header, int offset)
+ const struct wtap_pkthdr *phdr, long offset)
{
- int i;
-
fdata->next = NULL;
fdata->prev = NULL;
fdata->pfd = NULL;
- fdata->data_src = NULL;
fdata->num = cf->count;
fdata->pkt_len = phdr->len;
fdata->cap_len = phdr->caplen;
fdata->file_off = offset;
- fdata->cinfo = NULL;
fdata->lnk_t = phdr->pkt_encap;
fdata->abs_secs = phdr->ts.tv_sec;
fdata->abs_usecs = phdr->ts.tv_usec;
/* If it's greater than the current elapsed time, set the elapsed time
to it (we check for "greater than" so as not to be confused by
time moving backwards). */
- if (cf->esec < fdata->rel_secs
- || (cf->esec == fdata->rel_secs && cf->eusec < fdata->rel_usecs)) {
+ if ((gint32)cf->esec < fdata->rel_secs
+ || ((gint32)cf->esec == fdata->rel_secs && (gint32)cf->eusec < fdata->rel_usecs)) {
cf->esec = fdata->rel_secs;
cf->eusec = fdata->rel_usecs;
}
-
+
/* Get the time elapsed between the previous displayed packet and
this packet. */
compute_timestamp_diff(&fdata->del_secs, &fdata->del_usecs,
fdata->abs_secs, fdata->abs_usecs, prevsec, prevusec);
prevsec = fdata->abs_secs;
prevusec = fdata->abs_usecs;
-
- fdata->cinfo = &cf->cinfo;
- for (i = 0; i < fdata->cinfo->num_cols; i++) {
- fdata->cinfo->col_buf[i][0] = '\0';
- fdata->cinfo->col_data[i] = fdata->cinfo->col_buf[i];
- }
}
/* Free up all data attached to a "frame_data" structure. */
{
if (fdata->pfd)
g_slist_free(fdata->pfd);
- if (fdata->data_src)
- g_slist_free(fdata->data_src);
}
static void
-wtap_dispatch_cb_write(u_char *user, const struct wtap_pkthdr *phdr, int offset,
- union wtap_pseudo_header *pseudo_header, const u_char *buf)
+wtap_dispatch_cb_write(guchar *user, const struct wtap_pkthdr *phdr,
+ long offset, union wtap_pseudo_header *pseudo_header, const guchar *buf)
{
cb_args_t *args = (cb_args_t *) user;
capture_file *cf = args->cf;
wtap_dumper *pdh = args->pdh;
frame_data fdata;
- proto_tree *protocol_tree;
int err;
gboolean passed;
epan_dissect_t *edt;
cf->count++;
if (cf->rfcode) {
- fill_in_fdata(&fdata, cf, phdr, pseudo_header, offset);
- protocol_tree = proto_tree_create_root();
- edt = epan_dissect_new(pseudo_header, buf, &fdata, protocol_tree);
+ fill_in_fdata(&fdata, cf, phdr, offset);
+ edt = epan_dissect_new(TRUE, FALSE);
+ epan_dissect_prime_dfilter(edt, cf->rfcode);
+ epan_dissect_run(edt, pseudo_header, buf, &fdata, NULL);
passed = dfilter_apply_edt(cf->rfcode, edt);
} else {
- protocol_tree = NULL;
passed = TRUE;
edt = NULL;
}
if (passed) {
+ /* The packet passed the read filter. */
+#ifdef HAVE_LIBPCAP
+ ld.packet_count++;
+#endif
if (!wtap_dump(pdh, phdr, pseudo_header, buf, &err)) {
#ifdef HAVE_LIBPCAP
- if (ld.pch != NULL) {
- /* We're capturing packets, so we're printing a count of packets
- captured; move to the line after the count. */
+ if (ld.pch != NULL && !quiet) {
+ /* We're capturing packets, so (if -q not specified) we're printing
+ a count of packets captured; move to the line after the count. */
fprintf(stderr, "\n");
}
#endif
exit(2);
}
}
- if (protocol_tree != NULL)
- proto_tree_free(protocol_tree);
if (edt != NULL)
epan_dissect_free(edt);
if (cf->rfcode)
static void
show_capture_file_io_error(const char *fname, int err, gboolean is_close)
{
+ if (*fname == '\0')
+ fname = "stdout";
+
switch (err) {
case ENOSPC:
}
static void
-wtap_dispatch_cb_print(u_char *user, const struct wtap_pkthdr *phdr, int offset,
- union wtap_pseudo_header *pseudo_header, const u_char *buf)
+wtap_dispatch_cb_print(guchar *user, const struct wtap_pkthdr *phdr,
+ long offset, union wtap_pseudo_header *pseudo_header, const guchar *buf)
{
cb_args_t *args = (cb_args_t *) user;
capture_file *cf = args->cf;
frame_data fdata;
- proto_tree *protocol_tree;
gboolean passed;
print_args_t print_args;
epan_dissect_t *edt;
+ gboolean create_proto_tree;
int i;
cf->count++;
- /* The protocol tree will be "visible", i.e., printed, only if we're
- not printing a summary. */
- proto_tree_is_visible = verbose;
-
- fill_in_fdata(&fdata, cf, phdr, pseudo_header, offset);
+ fill_in_fdata(&fdata, cf, phdr, offset);
passed = TRUE;
if (cf->rfcode || verbose)
- protocol_tree = proto_tree_create_root();
+ create_proto_tree = TRUE;
else
- protocol_tree = NULL;
- edt = epan_dissect_new(pseudo_header, buf, &fdata, protocol_tree);
- if (cf->rfcode)
+ create_proto_tree = FALSE;
+ /* The protocol tree will be "visible", i.e., printed, only if we're
+ not printing a summary.
+
+ We only need the columns if we're *not* verbose; in verbose mode,
+ we print the protocol tree, not the protocol summary. */
+ edt = epan_dissect_new(create_proto_tree, verbose);
+ if (cf->rfcode) {
+ epan_dissect_prime_dfilter(edt, cf->rfcode);
+ }
+
+ tap_queue_init(edt);
+ epan_dissect_run(edt, pseudo_header, buf, &fdata, verbose ? NULL : &cf->cinfo);
+ tap_push_tapped_queue(edt);
+
+ if (cf->rfcode) {
passed = dfilter_apply_edt(cf->rfcode, edt);
+ }
if (passed) {
/* The packet passed the read filter. */
+#ifdef HAVE_LIBPCAP
+ ld.packet_count++;
+#endif
if (verbose) {
/* Print the information in the protocol tree. */
print_args.to_file = TRUE;
print_args.print_summary = FALSE;
print_args.print_hex = print_hex;
print_args.expand_all = TRUE;
- proto_tree_print(FALSE, &print_args, (GNode *)protocol_tree,
- &fdata, stdout);
+ print_args.suppress_unmarked = FALSE;
+ proto_tree_print(&print_args, edt, stdout);
if (!print_hex) {
/* "print_hex_data()" will put out a leading blank line, as well
as a trailing one; print one here, to separate the packets,
}
} else {
/* Just fill in the columns. */
- fill_in_columns(&fdata);
+ epan_dissect_fill_in_columns(edt);
/* Now print them. */
for (i = 0; i < cf->cinfo.num_cols; i++) {
putchar('\n');
}
if (print_hex) {
- print_hex_data(stdout, print_args.format, &fdata);
+ print_hex_data(stdout, print_args.format, edt);
putchar('\n');
}
- fdata.cinfo = NULL;
}
/* The ANSI C standard does not appear to *require* that a line-buffered
having to wait until a standard I/O buffer fills up. */
if (line_buffered)
fflush(stdout);
- if (protocol_tree != NULL)
- proto_tree_free(protocol_tree);
epan_dissect_free(edt);
clear_fdata(&fdata);
-
- proto_tree_is_visible = FALSE;
}
char *
-file_open_error_message(int err, gboolean for_writing)
+file_open_error_message(int err, gboolean for_writing, int file_type)
{
char *errmsg;
static char errmsg_errno[1024+1];
errmsg = "The file \"%s\" is not a capture file in a format Tethereal understands.";
break;
+ case WTAP_ERR_CANT_WRITE_TO_PIPE:
+ /* Seen only when opening a capture file for writing. */
+ snprintf(errmsg_errno, sizeof(errmsg_errno),
+ "The file \"%%s\" is a pipe, and %s capture files cannot be "
+ "written to a pipe.", wtap_file_type_string(file_type));
+ errmsg = errmsg_errno;
+ break;
+
case WTAP_ERR_UNSUPPORTED_FILE_TYPE:
/* Seen only when opening a capture file for writing. */
errmsg = "Tethereal does not support writing capture files in that format.";
case WTAP_ERR_SHORT_READ:
errmsg = "The file \"%s\" appears to have been cut short"
- " in the middle of a packet.";
+ " in the middle of a packet or other data.";
break;
case WTAP_ERR_SHORT_WRITE:
default:
snprintf(errmsg_errno, sizeof(errmsg_errno),
- "The file \"%%s\" could not be opened: %s.",
+ "The file \"%%s\" could not be %s: %s.",
+ for_writing ? "created" : "opened",
wtap_strerror(err));
errmsg = errmsg_errno;
break;
{
wtap *wth;
int err;
- int fd;
- struct stat cf_stat;
char err_msg[2048+1];
wth = wtap_open_offline(fname, &err, FALSE);
if (wth == NULL)
goto fail;
- /* Find the size of the file. */
- fd = wtap_fd(wth);
- if (fstat(fd, &cf_stat) < 0) {
- err = errno;
- wtap_close(wth);
- goto fail;
- }
-
/* The open succeeded. Fill in the information for this file. */
- /* Initialize the table of conversations. */
- epan_conversation_init();
-
- /* Initialize protocol-specific variables */
- init_all_protocols();
-
- /* Initialize the common data structures for fragment reassembly.
- Must be done *after* "init_all_protocols()", as "init_all_protocols()"
- may free up space for fragments, which it finds by using the
- data structures that "reassemble_init()" frees. */
- reassemble_init();
+ /* Initialize all data structures used for dissection. */
+ init_dissection();
cf->wth = wth;
- cf->filed = fd;
- cf->f_len = cf_stat.st_size;
+ cf->filed = -1; /* not used, but set it anyway */
+ cf->f_len = 0; /* not used, but set it anyway */
/* Set the file name because we need it to set the follow stream filter.
XXX - is that still true? We need it for other reasons, though,
cf->esec = 0;
cf->eusec = 0;
cf->snap = wtap_snapshot_length(cf->wth);
+ if (cf->snap == 0) {
+ /* Snapshot length not known. */
+ cf->has_snap = FALSE;
+ cf->snap = WTAP_MAX_PACKET_SIZE;
+ } else
+ cf->has_snap = TRUE;
cf->progbar_quantum = 0;
cf->progbar_nextstep = 0;
firstsec = 0, firstusec = 0;
prevsec = 0, prevusec = 0;
-
+
return (0);
fail:
- snprintf(err_msg, sizeof err_msg, file_open_error_message(err, FALSE), fname);
+ snprintf(err_msg, sizeof err_msg, file_open_error_message(err, FALSE, 0),
+ fname);
fprintf(stderr, "tethereal: %s\n", err_msg);
return (err);
}
git.samba.org / obnox / wireshark / wip.git / blobdiff