CSE2410 Fall 2014 the Passive Aggressors

Modify includes of config.h so that out-of-tree builds, i.e. CMake
don't pick up the in-tree copy.

Change-Id: I7ec473876cdba1a025c52362d7f6adc62d24ce71
Reviewed-on: https://code.wireshark.org/review/3798
Petri-Dish: Graham Bloice <graham.bloice@trihedral.com>...

Squelch a warning.

In at least some versions of GLib, g_array_free() warns if passed a null
pointer, rather than just silently returning.

Change-Id: I1bfc0a81faa1eeebe288f6e0cc58ebfb64784958
Reviewed-on: https://code.wireshark.org/review/3068
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Strip some trailing whitespace; Fix some indentation; Add editor-modelines as needed.

Change-Id: I943153e28f468070d86535abad7be032e1386118
Reviewed-on: https://code.wireshark.org/review/2994
Reviewed-by: Bill Meier <wmeier@newsguy.com>

Add support for dissecting non-packet records.

Add a dissector table indexed by the file type, and, for the
file-type-specific records, have the frame dissector skip the usual
pseudo-header processing, as the pseudo-header has a file-type-specific
record subtype in it, and call the dissector for that file type's...

Revert "Allow wtap_read() and wtap_seek_read() to return non-packet records."

This reverts commit c0c480d08c175eed4524ea9e73ec86298f468cf4.

A better way to do this is to have the record type be part of struct wtap_pkthdr; that keeps the metadata for the record together and requires fewer API changes. That is in-progress....

wiretap: remove unused code, drop number_of_interfaces

While investigating an ASAN issue (fixed in
commit dcdd076ab0965c346efe90051678ba790eaf7a02), I got greatly confused
by three different types having the same "interface_data" field name:

• pcapng_t *pn stores an array of interface_data_t objects....

Refactor Wiretap

Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality....

Fix "might be clobbered by 'longjmp' or 'vfork' [-Werror=clobbered]" warning from gcc 4.9.

Change-Id: I8495d746f47c0e2528f88295771f86197d22d159
Reviewed-on: https://code.wireshark.org/review/1166
Reviewed-by: Bill Meier <wmeier@newsguy.com>
Tested-by: Bill Meier <wmeier@newsguy.com>

Fix bug9931 'Encapsulated ethernet packets sometimes show invalid FCS'

This fixes part-1 of bug9931: the uninitialized use of a wtap_pkthdr
struct. The second part of the bug deals with dissectors calling
the Ethernet dissector for ecnapsulated Ethernet packets but using...

Revert "Allow pcapng interface options to be available to dissectors."
This patch causes Wireshark/tshark to segfault if the file is reread(open a file and press reload).
The test suite also fails on
2.1.1 Step: Exit status for existing file: "/home/wireshark/builders/trunk/sol10sparc/build/test/captures/dhcp.pcap" must be 0/home/wireshark/builders/trunk/sol10sparc/build/test/suite-clopts.sh: line 149: 6646 Segmentation Fault (core dumped) $TSHARK -r "${CAPTURE_DIR}dhcp.pcap" > ./testout.txt 2>&1...

Remove all $Id$ from top of file

(Using sed : sed -i '/^ \* \$Id\$/,+1 d')

Fix manually some typo (in export_object_dicom.c and crc16-plain.c)

Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8
Reviewed-on: https://code.wireshark.org/review/497
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Wireshark: Add option to choose format type of capture file

The best heuristic can fail, so add possibility to manually choose
capture file format type, so not correctly recognize file format can be
loaded in Wireshark.

On the other side now it is possible to open capture file...

Don't write out packets that have a "captured length" bigger than we're
willing to read or that's bigger than will fit in the file format;
instead, report an error.

For the "I can't write a packet of that type in that file type" error,
report the file type in question....

Fix crash when exporting to CSV file

svn path=/trunk/; revision=54722

int -> gboolean

svn path=/trunk/; revision=53800

Move the epan/filesystem.c routines to wsutil; they're not specific to
packet dissection, they're specific to the entire Wireshark suite of
programs.

svn path=/trunk/; revision=53377

The "file types" we have are actually combinations of types and
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2
are separate "file types", even though they both come from Network
Monitor.

Rename various functions, #defines, and variables appropriately....

wireshark: use epan_dissect_reset(), rawshark: fix missing epan_dissect_cleanup()

svn path=/trunk/; revision=52711

g_list_prepend() is faster.

svn path=/trunk/; revision=52475

Try to fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9106 :
Intialize phdr structure to avoid an invalid access to phdr->opt_comment

svn path=/trunk/; revision=51791

Only rescan packets if we have packets to rescan. Fixes at least the surface
problem in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9033

The underlying scoping issues may not be fully resolved yet.

svn path=/trunk/; revision=51327

use explicit cast to squelch compiler warning

svn path=/trunk/; revision=51093

Remove interface_id, pack_flags from frame_data structure.

This patch assumes that wtap_phdr interface_id, pack_flags both from initial read and seek read will contain same values.
Please fix if it's not.

svn path=/trunk/; revision=51041

Abuse epan_t more: add callback to get interface name.

svn path=/trunk/; revision=50794

Replace relative timestamp with reference frame number. Saves 16B per frame.

svn path=/trunk/; revision=50772

Some work on multi file dissection

- make init_dissection/cleanup_dissection private for libwireshark
- implement epan_new(), epan_free()
- pass epan_t to epan_dissect*

svn path=/trunk/; revision=50761

Move the print modules into epan.

svn path=/trunk/; revision=50526

packet dissection now takes pointer to tvb instead of guint8 data
implement frame_tvbuff, right now almost a copy of 'real' tvb.

svn path=/trunk/; revision=50497

Move tempfile.{h,c} into wsutil.

svn path=/trunk/; revision=50163

inform expert info layer about the current number of packet comments
when the last comment is removed and we have no other expert info,
the maximum severity is changed from comment to none

svn path=/trunk/; revision=50091

Have the seek-read routines take a Buffer rather than a guint8 pointer
as the "where to put the packet data" argument.

This lets more of the libwiretap code be common between the read and
seek-read code paths, and also allows for more flexibility in the "fill...

Rename cf_not_saved() to cf_has_unsaved_data() to clarify what it
indicates. (Note: "unsaved data" is more than just "unsaved changes";
it could also mean "temporary file that hasn't been saved anywhere".)

svn path=/trunk/; revision=48709

Add a wtap_dump_can_write() routine that indicates whether Wiretap
supports writing files with a given set of encapsulations and comment
types. Use it, rather than asking for a list of file formats that
support the given set of encapsulation and comment types and checking...

From Hadriel Kaplan via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223

Add a 2-pass display-filter flag to tshark so that reassembly and other forward-
looking dissections can be used with filters.

It's a bit of a hack, but this entire area of 2-pass analysis etc. is a giant...

From beroset:
remove C++ incompatibilities
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416 attachment #10397

svn path=/trunk/; revision=48438

Use explicit casts.

svn path=/trunk/; revision=48137

Rename the search type menu items to more accurately reflect what we're
actually doing and what users are likely to want to do. Rename the
search enum values and functions to reflect what we're actually doing
and add a comment explaining why making searches more correct might make...

Make a few variables volatile to satisfy gcc.

svn path=/trunk/; revision=45886

volatile fixes.

svn path=/trunk/; revision=45729

Make progbar_quantum volatile to suppress setjmp/longjmp warnings.

svn path=/trunk/; revision=45723

1) Allow for the possibility for both packet summary and packet details to be
printed when either -T is not specified or "-T text" or "-T ps" is selected.

2) Allow for packet hex/ascii to be printed without necessarily requiring that
either packet summary or packet details also be printed. This just means that...

I don't understand how this variable might be clobbered, but mark it volatile to silent gcc warning.

svn path=/trunk/; revision=45671

- Allow reseting edt with new function epan_dissect_reset(),
- initialize edt once in few places, and later reset it after dissecting
(add_packet_to_packet_list),
- revert r45667, probably no longer needed.

svn path=/trunk/; revision=45669

Pass create_proto_tree, cinfo directly to add_packet_to_packet_list

svn path=/trunk/; revision=45666

Only cap_len (not pkt_len) bytes of buffer are valid.

svn path=/trunk/; revision=45621

Add wtap_pseudo_header union to wtap_pkthdr structure.
Use pkthdr instead of pseudo_header as argument for dissecting.

svn path=/trunk/; revision=45601

Add a capture_file * element to packet_range_t and pass it explicitly in
packet_range_init(). Get rid of global cfile references in
packet-range.c. C++-ize packet-range.h. Shuffle some includes around.

svn path=/trunk/; revision=45333

Revert r45182, add better fix for bug #6208: Status bar count of displayed packets wrong

cf_read() is already checking for cf->redissecting variable and if set it don't add packets to packet_list.
Rename it to cf->rescanning and set it always in rescan_packets() [not only when redissecting]....

Call fileset_file_closed from cf_cb_file_closed.

svn path=/trunk/; revision=45163

Store pointers to previously displayed and captured packet, not nstime_t deltas.

This commit reduces size (from 144B to 128B on AMD64) of frame_data structure.

Part of bug 5821: Reduce per-packet memory requirements.

svn path=/trunk/; revision=45071