CSE2410 Fall 2014 the Passive Aggressors

Refactor "common" hostlist/endpoint table functionality.

This is very similar in architecture to the changes made to the Conversation table functionality. Since all conversations have endpoints/hostlists, the "registered" list is shared for both.

Change-Id: Ie8c6910a68a1b3f27c5b18c4494f49b9404a7b31...

Rename buffer_ routines to ws_buffer_ to avoid name collisions.

In particular, epan/wslua/lrexlib.c has its own buffer_ routines,
causing some linker warnings on some platforms, as reported in bug
10332.

(Not to be backported to 1.12, as that would change the API and ABI of...

Refactor "common" Conversation table functionality.

Refactor (non-GUI) conversation table functionality from gtk/Qt to epan. Also refactor "common GUI" conversation table functionality.

The idea is to not have to modify the GUI when a dissector adds a new "conversation type"...

Clean up indentation (get rid of tabs).

Change-Id: I14917737db30c80af2d40e40efd79ceb6aea79f8
Reviewed-on: https://code.wireshark.org/review/3170
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Reset state when cycling ring-buffer files in tshark.

This has several implications:
- we match user expectations that a ring-buffered tshark capture will run
forever without running out of resources (except where we still have leaks)
- we lose reassembly and request/response matching when the relevant packets...

Include <sys/capaibility.h> to get _LINUX_CAPABILITY_VERSION defined.

It's no longer used in version_info.c, but is used in the main source
files of TShark and Wireshark (it's already included in dumpcap).

Change-Id: I2169a2bbed678baf26fc8711d7c13d95cce3ee2a...

Get rid of an extra blank line.

Change-Id: I321ef1404e37ebb13a456d18eeb81285b7ba477f
Reviewed-on: https://code.wireshark.org/review/2796
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Regularize the help output of programs.

Only print to the standard output, and only give the version
information, if a "print help" command-line option is specified.
Otherwise, leave out the version information, and print to the standard
error.

Leave out the copyright information; it's extra cruft, and...

Drop privileges even earlier.

Do it at the same point at which Wireshark does so. Do some other
things in the same order as well.

Change-Id: I2925366d49d14271ceffa1a938b5e3450337c772
Reviewed-on: https://code.wireshark.org/review/2743
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Move capture_session.h to capchild; what it declares is defined there.

Change-Id: I8b1407839390b7ac0b45bf6f583c1a509073f002
Reviewed-on: https://code.wireshark.org/review/2709
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Move some more stuff into wsutil.

Move the routines to parse numerical command-line arguments there.

Make cmdarg_err() and cmdarg_err_cont() routines in wsutil that just
call routines specified by a call to cmdarg_err_init(), and have
programs supply the appropriate routines to it....

Indicate tshark can read (-r) from stdin and named pipes now.

(Though it works only with certain formats.) As requested in:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2874#c4

Change-Id: I2ce0509d8750b21ae0167d12459074ba0f9506f8
Reviewed-on: https://code.wireshark.org/review/2646...

Load WinPcap before we get the run-time information string.

That way, we can include the WinPcap version in that string.

Change-Id: I01fa0defce158e122d1c602fdfbc81916a9e80ef
Reviewed-on: https://code.wireshark.org/review/2625
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Have individual programs get libpcap and libz version info.

That way, the code that constructs the runtime version string doesn't
itself have to call libpcap and libz, and could be usable in programs
that don't call them.

While we're at it, add "with" to the run-time version information for...

Move get_os_major_version() to wsutil and rename it to get_windows_major_version().

It's Windows-specific, so name it appropriately.

Change-Id: Ic518cbfabebf95757f6b308a4d547a6cabed6a5e
Reviewed-on: https://code.wireshark.org/review/2528
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Move the "capture-comment" long option to LONGOPT_CAPTURE_COMMON.

Change-Id: I55884d48911de307cde52accfebbda69f2989526
Reviewed-on: https://code.wireshark.org/review/2505
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Fix builds without pcap.

Change-Id: I6c67f9ea9d115a8396af0904ef9a73d2c528dcaa
Reviewed-on: https://code.wireshark.org/review/2498
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Define OPTSTRING_CAPTURE_COMMON as nothing if we don't have pcap.

No capturing, no capture options.

Change-Id: I0023184b9c358d5876f19a098590f34d641c8649
Reviewed-on: https://code.wireshark.org/review/2493
Reviewed-by: Guy Harris <guy@alum.mit.edu>

Add --help and --version long options.

Also, make the convention for long-only options be that their
case-statement values start at 128, so they avoid colliding with any
ASCII code points, including control characters.

Make the tables of long options "static const" while we're at it, and...

tshark.c: Change "Live captures can only be saved in libpcap format" to "[...] in pcap or pcapng format"

Change-Id: I18dd0d15e261ecbc1ec086b4870a994afc7665ee
Reviewed-on: https://code.wireshark.org/review/1953
Reviewed-by: Bill Meier <wmeier@newsguy.com>

Revert "Allow wtap_read() and wtap_seek_read() to return non-packet records."

This reverts commit c0c480d08c175eed4524ea9e73ec86298f468cf4.

A better way to do this is to have the record type be part of struct wtap_pkthdr; that keeps the metadata for the record together and requires fewer API changes. That is in-progress....

Fix some white space issues.

Change-Id: I3b4f57c2d1ceffeea1770494fe19a0eee8717a76
Reviewed-on: https://code.wireshark.org/review/1737
Reviewed-by: Guy Harris <guy@alum.mit.edu>

wiretap: remove unused code, drop number_of_interfaces

While investigating an ASAN issue (fixed in
commit dcdd076ab0965c346efe90051678ba790eaf7a02), I got greatly confused
by three different types having the same "interface_data" field name:

• pcapng_t *pn stores an array of interface_data_t objects....

Refactor Wiretap

Start of refactoring Wiretap and breaking structures down into "generally useful fields for dissection" and "capture specific". Since this in intended as a "base" for Wiretap and Filetap, the "wft" prefix is used for "common" functionality....

Fix tshark.c to pass checkAPIs script

Since tshark.c was using strdup, perror, and g_main_quit, changes to
the file won't pass checkAPIs; so this commit replaces those with
the approved functions; except strdup, which was unecessary.

Change-Id: I031aa44594f2b96960a45f48537ab4e9a10d34b1...

Fix bug9931 'Encapsulated ethernet packets sometimes show invalid FCS'

This fixes part-1 of bug9931: the uninitialized use of a wtap_pkthdr
struct. The second part of the bug deals with dissectors calling
the Ethernet dissector for ecnapsulated Ethernet packets but using...

Add command-line arg for input file format for tshark/wireshark

Now that we have the ability to choose input file format type
in the GUI, we might as well have it in the command-line too.
Plus it would help me in test-stuies if we had a commandline.
So I've added a '-X read_format:Foo' for this. Using just...

Wireshark: Add option to choose format type of capture file

The best heuristic can fail, so add possibility to manually choose
capture file format type, so not correctly recognize file format can be
loaded in Wireshark.

On the other side now it is possible to open capture file...

Fix crash when doing "tshark -2 -r file -w newfile".

We were using cf->buf in some places and a local variable buf in others;
consistenly use the local variable.

Have a local variable for the struct wtap_pkthdr while we're at it; with
some work we may be able to get rid of the struct wtap_pkthdr and the...

allow tshark reading from pipes

Change-Id: If20a14b949667911df44f09c6a705b7645d4c49e
Reviewed-on: https://code.wireshark.org/review/85
Reviewed-by: Evan Huus <eapache@gmail.com>
Tested-by: Evan Huus <eapache@gmail.com>

In a source file that defines external functions, the header file that
declares the functions must be included, in order to make sure the
declarations match the function signature. Make it so.

Said header declares pipe_input_cb_t, so we don't have to do it...

No seek-read routines use the length argument, so eliminate it from
wtap_seek_read().

svn path=/trunk/; revision=54570

Initialize the error-reporting routines before scanning for plugins, as
the code to scan for them uses those routines.

This means epan_init() no longer takes those routines as arguments -
which is just as well, given that the mechanism in question is no longer...

Wrap usage text at column 80.

svn path=/trunk/; revision=53761

Move most of the plugin code from epan to wsutil and remove all
knowledge of particular types of plugins. Instead, let particular types
of plugins register with the common plugin code, giving a name and a
routine to recognize that type of plugin.

In particular applications, only process the relevant plugin types....

Move the epan/filesystem.c routines to wsutil; they're not specific to
packet dissection, they're specific to the entire Wireshark suite of
programs.

svn path=/trunk/; revision=53377

The "file types" we have are actually combinations of types and
subtypes, e.g. Network Monitor version 1 and Network Monitor version 2
are separate "file types", even though they both come from Network
Monitor.

Rename various functions, #defines, and variables appropriately....

Display the frame number on the packet summary line if it's one of the configured columns. Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9317

#BACKPORT

svn path=/trunk/; revision=52838

From Ed Beroset via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9272

Add tshark -G column-formats report and document the missing ftypes, heuristic-decodes and plugins reports.

From me: Sort the reports. Add modelines to epan/column.c. Minor whitespace changes....

Fix the core dump reported in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9258 :

After calling wtap_close(), set the wth to NULL so we don't try to close it
again later. (The core only happens when tshark isn't keeping up with dumpcap's
file rotation.)...

Fix one small memory leak.

svn path=/trunk/; revision=51747

Output a warning about kernel BPF JIT compiler beeing activated.

svn path=/trunk/; revision=51488

Don't look at packet or byte limits during the second pass of two-pass analysis.
The limits are enforced during the first pass, and frames that get dropped from
the first pass for this reason aren't available to the second pass at all, so
checking again is redundant....

As suggested in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9033

Make epan_free a no-op if the pointer is NULL. This fixes 99% of the cases
causing problems for wmem_leave_file_scope() - remove that XXX comment and add
back the assertion.

Remove the cleanup_dissection call from epan_cleanup, it doesn't make sense...

Now that we're using getopt_long(), and have some options available only
as long options, and thus identified with numbers rather than option
letters as the return value of getopt_long(), we now have to include
capture_opts.h even if we're not building with libpcap, to provide...

pass --capture-comment from tshark to dumpcap
handle error cases in tshark

svn path=/trunk/; revision=51094

Remove fdata->opt_comment, add pkt_comment to pinfo

Original (read from file) comments can be accessed by pkthdr->opt_comment
Keep user comments in seperated BST, add new method for epan session to get it.

svn path=/trunk/; revision=51090

use getopt_long() in tshark

svn path=/trunk/; revision=51087

Make some functions not used outside tshark.c static.

svn path=/trunk/; revision=50858

Replace relative timestamp with reference frame number. Saves 16B per frame.

svn path=/trunk/; revision=50772