forked from wireshark/wireshark
-
Notifications
You must be signed in to change notification settings - Fork 0
/
file.c
6048 lines (5230 loc) · 204 KB
/
file.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* file.c
* File I/O routines
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#include <config.h>
#define WS_LOG_DOMAIN LOG_DOMAIN_CAPTURE
#include <time.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#include <errno.h>
#include <wsutil/file_util.h>
#include <wsutil/filesystem.h>
#include <wsutil/json_dumper.h>
#include <wsutil/wslog.h>
#include <wsutil/ws_assert.h>
#include <wsutil/version_info.h>
#include <wiretap/merge.h>
#include <epan/exceptions.h>
#include <epan/epan.h>
#include <epan/column.h>
#include <epan/packet.h>
#include <epan/column-utils.h>
#include <epan/expert.h>
#include <epan/prefs.h>
#include <epan/dfilter/dfilter.h>
#include <epan/epan_dissect.h>
#include <epan/tap.h>
#include <epan/timestamp.h>
#include <epan/strutil.h>
#include <epan/addr_resolv.h>
#include <epan/color_filters.h>
#include <epan/secrets.h>
#include "cfile.h"
#include "file.h"
#include "fileset.h"
#include "frame_tvbuff.h"
#include "ui/alert_box.h"
#include "ui/simple_dialog.h"
#include "ui/main_statusbar.h"
#include "ui/progress_dlg.h"
#include "ui/urls.h"
#include "ui/ws_ui_util.h"
#include "ui/packet_list_utils.h"
/* Needed for addrinfo */
#include <sys/types.h>
#ifdef HAVE_SYS_SOCKET_H
#include <sys/socket.h>
#endif
#ifdef HAVE_NETINET_IN_H
# include <netinet/in.h>
#endif
#ifdef _WIN32
# include <winsock2.h>
# include <ws2tcpip.h>
#endif
static gboolean read_record(capture_file *cf, wtap_rec *rec, Buffer *buf,
dfilter_t *dfcode, epan_dissect_t *edt, column_info *cinfo, gint64 offset,
fifo_string_cache_t *frame_dup_cache, GChecksum *frame_cksum);
static void rescan_packets(capture_file *cf, const char *action, const char *action_item, gboolean redissect);
typedef enum {
MR_NOTMATCHED,
MR_MATCHED,
MR_ERROR
} match_result;
typedef match_result (*ws_match_function)(capture_file *, frame_data *,
wtap_rec *, Buffer *, void *);
static match_result match_protocol_tree(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static void match_subtree_text(proto_node *node, gpointer data);
static void match_subtree_text_reverse(proto_node *node, gpointer data);
static match_result match_summary_line(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_narrow_and_wide(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_narrow_and_wide_reverse(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_narrow_and_wide_case(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_narrow_and_wide_case_reverse(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_narrow_case(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_narrow_case_reverse(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_wide(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_wide_reverse(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_wide_case(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_wide_case_reverse(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_binary(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_binary_reverse(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_regex(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_regex_reverse(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_dfilter(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_marked(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_time_reference(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static gboolean find_packet(capture_file *cf, ws_match_function match_function,
void *criterion, search_direction dir);
static void cf_rename_failure_alert_box(const char *filename, int err);
/* Seconds spent processing packets between pushing UI updates. */
#define PROGBAR_UPDATE_INTERVAL 0.150
/* Show the progress bar after this many seconds. */
#define PROGBAR_SHOW_DELAY 0.5
/*
* Maximum number of records we support in a file.
*
* It is, at most, the maximum value of a guint32, as we use a guint32
* for the frame number.
*
* We allow it to be set to a lower value; see issue #16908 for why
* we're doing this. Thanks, Qt!
*/
static guint32 max_records = G_MAXUINT32;
void
cf_set_max_records(guint max_records_arg)
{
max_records = max_records_arg;
}
/*
* We could probably use g_signal_...() instead of the callbacks below but that
* would require linking our CLI programs to libgobject and creating an object
* instance for the signals.
*/
typedef struct {
cf_callback_t cb_fct;
gpointer user_data;
} cf_callback_data_t;
static GList *cf_callbacks = NULL;
static void
cf_callback_invoke(int event, gpointer data)
{
cf_callback_data_t *cb;
GList *cb_item = cf_callbacks;
/* there should be at least one interested */
ws_assert(cb_item != NULL);
while (cb_item != NULL) {
cb = (cf_callback_data_t *)cb_item->data;
cb->cb_fct(event, data, cb->user_data);
cb_item = g_list_next(cb_item);
}
}
void
cf_callback_add(cf_callback_t func, gpointer user_data)
{
cf_callback_data_t *cb;
cb = g_new(cf_callback_data_t,1);
cb->cb_fct = func;
cb->user_data = user_data;
cf_callbacks = g_list_prepend(cf_callbacks, cb);
}
void
cf_callback_remove(cf_callback_t func, gpointer user_data)
{
cf_callback_data_t *cb;
GList *cb_item = cf_callbacks;
while (cb_item != NULL) {
cb = (cf_callback_data_t *)cb_item->data;
if (cb->cb_fct == func && cb->user_data == user_data) {
cf_callbacks = g_list_remove(cf_callbacks, cb);
g_free(cb);
return;
}
cb_item = g_list_next(cb_item);
}
ws_assert_not_reached();
}
gulong
cf_get_computed_elapsed(capture_file *cf)
{
return cf->computed_elapsed;
}
static void
compute_elapsed(capture_file *cf, gint64 start_time)
{
gint64 delta_time = g_get_monotonic_time() - start_time;
cf->computed_elapsed = (gulong) (delta_time / 1000); /* ms */
}
static const nstime_t *
ws_get_frame_ts(struct packet_provider_data *prov, guint32 frame_num)
{
const frame_data *fd = NULL;
if (prov->prev_dis && prov->prev_dis->num == frame_num) {
fd = prov->prev_dis;
} else if (prov->prev_cap && prov->prev_cap->num == frame_num) {
fd = prov->prev_cap;
} else if (prov->frames) {
fd = frame_data_sequence_find(prov->frames, frame_num);
}
return (fd && fd->has_ts) ? &fd->abs_ts : NULL;
}
static epan_t *
ws_epan_new(capture_file *cf)
{
static const struct packet_provider_funcs funcs = {
ws_get_frame_ts,
cap_file_provider_get_interface_name,
cap_file_provider_get_interface_description,
cap_file_provider_get_modified_block
};
return epan_new(&cf->provider, &funcs);
}
cf_status_t
cf_open(capture_file *cf, const char *fname, unsigned int type, gboolean is_tempfile, int *err)
{
wtap *wth;
gchar *err_info;
wth = wtap_open_offline(fname, type, err, &err_info, TRUE);
if (wth == NULL)
goto fail;
/* The open succeeded. Close whatever capture file we had open,
and fill in the information for this file. */
cf_close(cf);
/* Initialize the record metadata. */
wtap_rec_init(&cf->rec);
/* XXX - we really want to initialize this after we've read all
the packets, so we know how much we'll ultimately need. */
ws_buffer_init(&cf->buf, 1514);
/* We're about to start reading the file. */
cf->state = FILE_READ_IN_PROGRESS;
cf->provider.wth = wth;
cf->f_datalen = 0;
/* Set the file name because we need it to set the follow stream filter.
XXX - is that still true? We need it for other reasons, though,
in any case. */
cf->filename = g_strdup(fname);
/* Indicate whether it's a permanent or temporary file. */
cf->is_tempfile = is_tempfile;
/* No user changes yet. */
cf->unsaved_changes = FALSE;
cf->computed_elapsed = 0;
cf->cd_t = wtap_file_type_subtype(cf->provider.wth);
cf->open_type = type;
cf->linktypes = g_array_sized_new(FALSE, FALSE, (guint) sizeof(int), 1);
cf->count = 0;
cf->packet_comment_count = 0;
cf->displayed_count = 0;
cf->marked_count = 0;
cf->ignored_count = 0;
cf->ref_time_count = 0;
cf->drops_known = FALSE;
cf->drops = 0;
cf->snap = wtap_snapshot_length(cf->provider.wth);
/* Allocate a frame_data_sequence for the frames in this file */
cf->provider.frames = new_frame_data_sequence();
nstime_set_zero(&cf->elapsed_time);
cf->provider.ref = NULL;
cf->provider.prev_dis = NULL;
cf->provider.prev_cap = NULL;
cf->cum_bytes = 0;
/* Create new epan session for dissection.
* (The old one was freed in cf_close().)
*/
cf->epan = ws_epan_new(cf);
packet_list_queue_draw();
cf_callback_invoke(cf_cb_file_opened, cf);
wtap_set_cb_new_ipv4(cf->provider.wth, add_ipv4_name);
wtap_set_cb_new_ipv6(cf->provider.wth, (wtap_new_ipv6_callback_t) add_ipv6_name);
wtap_set_cb_new_secrets(cf->provider.wth, secrets_wtap_callback);
return CF_OK;
fail:
cfile_open_failure_alert_box(fname, *err, err_info);
return CF_ERROR;
}
/*
* Add an encapsulation type to cf->linktypes.
*/
static void
cf_add_encapsulation_type(capture_file *cf, int encap)
{
guint i;
for (i = 0; i < cf->linktypes->len; i++) {
if (g_array_index(cf->linktypes, gint, i) == encap)
return; /* it's already there */
}
/* It's not already there - add it. */
g_array_append_val(cf->linktypes, encap);
}
/* Reset everything to a pristine state */
void
cf_close(capture_file *cf)
{
cf->stop_flag = FALSE;
if (cf->state == FILE_CLOSED || cf->state == FILE_READ_PENDING)
return; /* Nothing to do */
/* Die if we're in the middle of reading a file. */
ws_assert(cf->state != FILE_READ_IN_PROGRESS);
ws_assert(!cf->read_lock);
cf_callback_invoke(cf_cb_file_closing, cf);
/* close things, if not already closed before */
color_filters_cleanup();
if (cf->provider.wth) {
wtap_close(cf->provider.wth);
cf->provider.wth = NULL;
}
/* We have no file open... */
if (cf->filename != NULL) {
/* If it's a temporary file, remove it. */
if (cf->is_tempfile)
ws_unlink(cf->filename);
g_free(cf->filename);
cf->filename = NULL;
}
/* ...which means we have no changes to that file to save. */
cf->unsaved_changes = FALSE;
/* no open_routine type */
cf->open_type = WTAP_TYPE_AUTO;
/* Clean up the record metadata. */
wtap_rec_cleanup(&cf->rec);
/* Clear the packet list. */
packet_list_freeze();
packet_list_clear();
packet_list_thaw();
/* Free up the packet buffer. */
ws_buffer_free(&cf->buf);
dfilter_free(cf->rfcode);
cf->rfcode = NULL;
if (cf->provider.frames != NULL) {
free_frame_data_sequence(cf->provider.frames);
cf->provider.frames = NULL;
}
if (cf->provider.frames_modified_blocks) {
g_tree_destroy(cf->provider.frames_modified_blocks);
cf->provider.frames_modified_blocks = NULL;
}
cf_unselect_packet(cf); /* nothing to select */
cf->first_displayed = 0;
cf->last_displayed = 0;
/* No frames, no frame selected, no field in that frame selected. */
cf->count = 0;
cf->current_frame = NULL;
cf->finfo_selected = NULL;
/* No frame link-layer types, either. */
if (cf->linktypes != NULL) {
g_array_free(cf->linktypes, TRUE);
cf->linktypes = NULL;
}
cf->f_datalen = 0;
nstime_set_zero(&cf->elapsed_time);
reset_tap_listeners();
epan_free(cf->epan);
cf->epan = NULL;
/* We have no file open. */
cf->state = FILE_CLOSED;
cf_callback_invoke(cf_cb_file_closed, cf);
}
/*
* TRUE if the progress dialog doesn't exist and it looks like we'll
* take > PROGBAR_SHOW_DELAY (500ms) to load, FALSE otherwise.
*/
static inline gboolean
progress_is_slow(progdlg_t *progdlg, GTimer *prog_timer, gint64 size, gint64 pos)
{
double elapsed;
if (progdlg) return FALSE;
elapsed = g_timer_elapsed(prog_timer, NULL);
/* This only gets checked between reading records, which doesn't help if
* a single record takes a very long time, e.g., the first TLS packet if
* the SSLKEYLOGFILE is very large. (#17051) */
if ((elapsed * 2 > PROGBAR_SHOW_DELAY && (size / pos) >= 2) /* It looks like we're going to be slow. */
|| elapsed > PROGBAR_SHOW_DELAY) { /* We are indeed slow. */
return TRUE;
}
return FALSE;
}
static float
calc_progbar_val(capture_file *cf, gint64 size, gint64 file_pos, gchar *status_str, gulong status_size)
{
float progbar_val;
progbar_val = (gfloat) file_pos / (gfloat) size;
if (progbar_val > 1.0) {
/* The file probably grew while we were reading it.
* Update file size, and try again.
*/
size = wtap_file_size(cf->provider.wth, NULL);
if (size >= 0)
progbar_val = (gfloat) file_pos / (gfloat) size;
/* If it's still > 1, either "wtap_file_size()" failed (in which
* case there's not much we can do about it), or the file
* *shrank* (in which case there's not much we can do about
* it); just clip the progress value at 1.0.
*/
if (progbar_val > 1.0f)
progbar_val = 1.0f;
}
snprintf(status_str, status_size,
"%" PRId64 "KB of %" PRId64 "KB",
file_pos / 1024, size / 1024);
return progbar_val;
}
cf_read_status_t
cf_read(capture_file *cf, gboolean reloading)
{
int err = 0;
gchar *err_info = NULL;
volatile gboolean too_many_records = FALSE;
gchar *name_ptr;
progdlg_t *volatile progbar = NULL;
GTimer *prog_timer = g_timer_new();
gint64 size;
gint64 start_time;
epan_dissect_t edt;
wtap_rec rec;
Buffer buf;
dfilter_t *dfcode = NULL;
column_info *cinfo;
volatile gboolean create_proto_tree;
guint tap_flags;
gboolean compiled _U_;
volatile gboolean is_read_aborted = FALSE;
/* The update_progress_dlg call below might end up accepting a user request to
* trigger redissection/rescans which can modify/destroy the dissection
* context ("cf->epan"). That condition should be prevented by callers, but in
* case it occurs let's fail gracefully.
*/
if (cf->read_lock) {
ws_warning("Failing due to recursive cf_read(\"%s\", %d) call!",
cf->filename, reloading);
return CF_READ_ERROR;
}
cf->read_lock = TRUE;
/* Compile the current display filter.
* We assume this will not fail since cf->dfilter is only set in
* cf_filter IFF the filter was valid.
*/
if (cf->dfilter) {
compiled = dfilter_compile(cf->dfilter, &dfcode, NULL);
ws_assert(compiled && dfcode);
}
/* Get the union of the flags for all tap listeners. */
tap_flags = union_of_tap_listener_flags();
/*
* Determine whether we need to create a protocol tree.
* We do if:
*
* we're going to apply a display filter;
*
* one of the tap listeners is going to apply a filter;
*
* one of the tap listeners requires a protocol tree;
*
* a postdissector wants field values or protocols on
* the first pass.
*/
create_proto_tree =
(dfcode != NULL || have_filtering_tap_listeners() ||
(tap_flags & TL_REQUIRES_PROTO_TREE) || postdissectors_want_hfids());
reset_tap_listeners();
name_ptr = g_filename_display_basename(cf->filename);
if (reloading)
cf_callback_invoke(cf_cb_file_reload_started, cf);
else
cf_callback_invoke(cf_cb_file_read_started, cf);
/* Record the file's compression type.
XXX - do we know this at open time? */
cf->compression_type = wtap_get_compression_type(cf->provider.wth);
/* The packet list window will be empty until the file is completely loaded */
packet_list_freeze();
cf->stop_flag = FALSE;
start_time = g_get_monotonic_time();
epan_dissect_init(&edt, cf->epan, create_proto_tree, FALSE);
/* If the display filter or any tap listeners require the columns,
* construct them. */
cinfo = (tap_listeners_require_columns() ||
dfilter_requires_columns(dfcode)) ? &cf->cinfo : NULL;
/* Find the size of the file. */
size = wtap_file_size(cf->provider.wth, NULL);
/* If we are to ignore duplicate frames, we need a container to store
* hashes frame contents */
fifo_string_cache_t frame_dup_cache;
GChecksum *volatile cksum = NULL;
if (prefs.ignore_dup_frames) {
fifo_string_cache_init(&frame_dup_cache, prefs.ignore_dup_frames_cache_entries, g_free);
cksum = g_checksum_new(G_CHECKSUM_SHA256);
}
g_timer_start(prog_timer);
wtap_rec_init(&rec);
ws_buffer_init(&buf, 1514);
TRY {
gint64 file_pos;
gint64 data_offset;
float progbar_val;
gchar status_str[100];
while ((wtap_read(cf->provider.wth, &rec, &buf, &err, &err_info,
&data_offset))) {
if (size >= 0) {
if (cf->count == max_records) {
/*
* Quit if we've already read the maximum number of
* records allowed.
*/
too_many_records = TRUE;
break;
}
file_pos = wtap_read_so_far(cf->provider.wth);
/* Create the progress bar if necessary. */
if (progress_is_slow(progbar, prog_timer, size, file_pos)) {
progbar_val = calc_progbar_val(cf, size, file_pos, status_str, sizeof(status_str));
progbar = delayed_create_progress_dlg(cf->window, NULL, NULL, TRUE,
&cf->stop_flag, progbar_val);
}
/*
* Update the progress bar, but do it only after
* PROGBAR_UPDATE_INTERVAL has elapsed. Calling update_progress_dlg
* and packets_bar_update will likely trigger UI paint events, which
* might take a while depending on the platform and display. Reset
* our timer *after* painting.
*/
if (progbar && g_timer_elapsed(prog_timer, NULL) > PROGBAR_UPDATE_INTERVAL) {
progbar_val = calc_progbar_val(cf, size, file_pos, status_str, sizeof(status_str));
/* update the packet bar content on the first run or frequently on very large files */
update_progress_dlg(progbar, progbar_val, status_str);
compute_elapsed(cf, start_time);
packets_bar_update();
g_timer_start(prog_timer);
}
/*
* The previous GUI triggers should not have destroyed the running
* session. If that did happen, it could blow up when read_record tries
* to use the destroyed edt.session, so detect it right here.
*/
ws_assert(edt.session == cf->epan);
}
if (cf->state == FILE_READ_ABORTED) {
/* Well, the user decided to exit Wireshark. Break out of the
loop, and let the code below (which is called even if there
aren't any packets left to read) exit. */
is_read_aborted = TRUE;
break;
}
if (cf->stop_flag) {
/* Well, the user decided to abort the read. He/She will be warned and
it might be enough for him/her to work with the already loaded
packets.
This is especially true for very large capture files, where you don't
want to wait loading the whole file (which may last minutes or even
hours even on fast machines) just to see that it was the wrong file. */
break;
}
read_record(cf, &rec, &buf, dfcode, &edt, cinfo, data_offset, &frame_dup_cache, cksum);
wtap_rec_reset(&rec);
}
}
CATCH(OutOfMemoryError) {
simple_message_box(ESD_TYPE_ERROR, NULL,
"More information and workarounds can be found at\n"
WS_WIKI_URL("KnownBugs/OutOfMemory"),
"Sorry, but Wireshark has run out of memory and has to terminate now.");
#if 0
/* Could we close the current capture and free up memory from that? */
#else
/* we have to terminate, as we cannot recover from the memory error */
exit(1);
#endif
}
ENDTRY;
// If we're ignoring duplicate frames, clear the data structures.
// We really could look at prefs.ignore_dup_frames here, but it's even
// safer to check if we had allocated 'cksum'.
if (cksum != NULL) {
fifo_string_cache_free(&frame_dup_cache);
g_checksum_free(cksum);
}
/* We're done reading sequentially through the file. */
cf->state = FILE_READ_DONE;
/* Destroy the progress bar if it was created. */
if (progbar != NULL)
destroy_progress_dlg(progbar);
g_timer_destroy(prog_timer);
/* Free the display name */
g_free(name_ptr);
/* Cleanup and release all dfilter resources */
dfilter_free(dfcode);
epan_dissect_cleanup(&edt);
wtap_rec_cleanup(&rec);
ws_buffer_free(&buf);
/* Close the sequential I/O side, to free up memory it requires. */
wtap_sequential_close(cf->provider.wth);
/* Allow the protocol dissectors to free up memory that they
* don't need after the sequential run-through of the packets. */
postseq_cleanup_all_protocols();
/* compute the time it took to load the file */
compute_elapsed(cf, start_time);
/* Set the file encapsulation type now; we don't know what it is until
we've looked at all the packets, as we don't know until then whether
there's more than one type (and thus whether it's
WTAP_ENCAP_PER_PACKET). */
cf->lnk_t = wtap_file_encap(cf->provider.wth);
cf->current_frame = frame_data_sequence_find(cf->provider.frames, cf->first_displayed);
packet_list_thaw();
/* It is safe again to execute redissections or sort. */
ws_assert(cf->read_lock);
cf->read_lock = FALSE;
if (reloading)
cf_callback_invoke(cf_cb_file_reload_finished, cf);
else
cf_callback_invoke(cf_cb_file_read_finished, cf);
/* If we have any displayed packets to select, select the first of those
packets by making the first row the selected row. */
if (cf->first_displayed != 0) {
packet_list_select_row_from_data(NULL);
}
if (is_read_aborted) {
/*
* Well, the user decided to exit Wireshark while reading this *offline*
* capture file (Live captures are handled by something like
* cf_continue_tail). Clean up accordingly.
*/
cf_close(cf);
cf->redissection_queued = RESCAN_NONE;
return CF_READ_ABORTED;
}
if (cf->redissection_queued != RESCAN_NONE) {
/* Redissection was queued up. Clear the request and perform it now. */
gboolean redissect = cf->redissection_queued == RESCAN_REDISSECT;
rescan_packets(cf, NULL, NULL, redissect);
}
if (cf->stop_flag) {
simple_message_box(ESD_TYPE_WARN, NULL,
"The remaining packets in the file were discarded.\n"
"\n"
"As a lot of packets from the original file will be missing,\n"
"remember to be careful when saving the current content to a file.\n",
"File loading was cancelled.");
return CF_READ_ERROR;
}
if (err != 0) {
/* Put up a message box noting that the read failed somewhere along
the line. Don't throw out the stuff we managed to read, though,
if any. */
cfile_read_failure_alert_box(NULL, err, err_info);
return CF_READ_ERROR;
} else if (too_many_records) {
simple_message_box(ESD_TYPE_WARN, NULL,
"The remaining packets in the file were discarded.\n"
"\n"
"As a lot of packets from the original file will be missing,\n"
"remember to be careful when saving the current content to a file.\n"
"\n"
"The command-line utility editcap can be used to split "
"the file into multiple smaller files",
"The file contains more records than the maximum "
"supported number of records, %u.", max_records);
return CF_READ_ERROR;
} else
return CF_READ_OK;
}
#ifdef HAVE_LIBPCAP
cf_read_status_t
cf_continue_tail(capture_file *cf, volatile int to_read, wtap_rec *rec,
Buffer *buf, int *err, fifo_string_cache_t *frame_dup_cache, GChecksum *frame_cksum)
{
gchar *err_info;
volatile int newly_displayed_packets = 0;
dfilter_t *dfcode = NULL;
epan_dissect_t edt;
gboolean create_proto_tree;
guint tap_flags;
gboolean compiled _U_;
/* Compile the current display filter.
* We assume this will not fail since cf->dfilter is only set in
* cf_filter IFF the filter was valid.
*/
if (cf->dfilter) {
compiled = dfilter_compile(cf->dfilter, &dfcode, NULL);
ws_assert(compiled && dfcode);
}
/* Get the union of the flags for all tap listeners. */
tap_flags = union_of_tap_listener_flags();
/*
* Determine whether we need to create a protocol tree.
* We do if:
*
* we're going to apply a display filter;
*
* one of the tap listeners is going to apply a filter;
*
* one of the tap listeners requires a protocol tree;
*
* a postdissector wants field values or protocols on
* the first pass.
*/
create_proto_tree =
(dfcode != NULL || have_filtering_tap_listeners() ||
(tap_flags & TL_REQUIRES_PROTO_TREE) || postdissectors_want_hfids());
*err = 0;
/* Don't freeze/thaw the list when doing live capture */
/*packet_list_freeze();*/
epan_dissect_init(&edt, cf->epan, create_proto_tree, FALSE);
TRY {
gint64 data_offset = 0;
column_info *cinfo;
/* If the display filter or any tap listeners require the columns,
* construct them. */
cinfo = (tap_listeners_require_columns() ||
dfilter_requires_columns(dfcode)) ? &cf->cinfo : NULL;
while (to_read != 0) {
wtap_cleareof(cf->provider.wth);
if (!wtap_read(cf->provider.wth, rec, buf, err, &err_info,
&data_offset)) {
break;
}
if (cf->state == FILE_READ_ABORTED) {
/* Well, the user decided to exit Wireshark. Break out of the
loop, and let the code below (which is called even if there
aren't any packets left to read) exit. */
break;
}
if (read_record(cf, rec, buf, dfcode, &edt, cinfo, data_offset, frame_dup_cache, frame_cksum)) {
newly_displayed_packets++;
}
to_read--;
}
wtap_rec_reset(rec);
}
CATCH(OutOfMemoryError) {
simple_message_box(ESD_TYPE_ERROR, NULL,
"More information and workarounds can be found at\n"
WS_WIKI_URL("KnownBugs/OutOfMemory"),
"Sorry, but Wireshark has run out of memory and has to terminate now.");
#if 0
/* Could we close the current capture and free up memory from that? */
return CF_READ_ABORTED;
#else
/* we have to terminate, as we cannot recover from the memory error */
exit(1);
#endif
}
ENDTRY;
/* Update the file encapsulation; it might have changed based on the
packets we've read. */
cf->lnk_t = wtap_file_encap(cf->provider.wth);
/* Cleanup and release all dfilter resources */
dfilter_free(dfcode);
epan_dissect_cleanup(&edt);
/* Don't freeze/thaw the list when doing live capture */
/*packet_list_thaw();*/
/* With the new packet list the first packet
* isn't automatically selected.
*/
if (!cf->current_frame && !packet_list_multi_select_active())
packet_list_select_row_from_data(NULL);
if (cf->state == FILE_READ_ABORTED) {
/* Well, the user decided to exit Wireshark. Return CF_READ_ABORTED
so that our caller can kill off the capture child process;
this will cause an EOF on the pipe from the child, so
"cf_finish_tail()" will be called, and it will clean up
and exit. */
return CF_READ_ABORTED;
} else if (*err != 0) {
/* We got an error reading the capture file.
XXX - pop up a dialog box instead? */
if (err_info != NULL) {
ws_warning("Error \"%s\" while reading \"%s\" (\"%s\")",
wtap_strerror(*err), cf->filename, err_info);
g_free(err_info);
} else {
ws_warning("Error \"%s\" while reading \"%s\"",
wtap_strerror(*err), cf->filename);
}
return CF_READ_ERROR;
} else
return CF_READ_OK;
}
void
cf_fake_continue_tail(capture_file *cf)
{
if (cf->state == FILE_CLOSED) {
cf->state = FILE_READ_PENDING;
}
}
cf_read_status_t
cf_finish_tail(capture_file *cf, wtap_rec *rec, Buffer *buf, int *err,
fifo_string_cache_t *frame_dup_cache, GChecksum *frame_cksum)
{
gchar *err_info;
gint64 data_offset;
dfilter_t *dfcode = NULL;
column_info *cinfo;
epan_dissect_t edt;
gboolean create_proto_tree;
guint tap_flags;
gboolean compiled _U_;
/* Compile the current display filter.
* We assume this will not fail since cf->dfilter is only set in
* cf_filter IFF the filter was valid.
*/
if (cf->dfilter) {
compiled = dfilter_compile(cf->dfilter, &dfcode, NULL);
ws_assert(compiled && dfcode);
}
/* Get the union of the flags for all tap listeners. */
tap_flags = union_of_tap_listener_flags();
/* If the display filter or any tap listeners require the columns,
* construct them. */
cinfo = (tap_listeners_require_columns() ||
dfilter_requires_columns(dfcode)) ? &cf->cinfo : NULL;
/*
* Determine whether we need to create a protocol tree.
* We do if:
*
* we're going to apply a display filter;
*
* one of the tap listeners is going to apply a filter;
*
* one of the tap listeners requires a protocol tree;
*
* a postdissector wants field values or protocols on
* the first pass.
*/
create_proto_tree =
(dfcode != NULL || have_filtering_tap_listeners() ||
(tap_flags & TL_REQUIRES_PROTO_TREE) || postdissectors_want_hfids());
if (cf->provider.wth == NULL) {
cf_close(cf);
return CF_READ_ERROR;
}
/* Don't freeze/thaw the list when doing live capture */
/*packet_list_freeze();*/
epan_dissect_init(&edt, cf->epan, create_proto_tree, FALSE);
while ((wtap_read(cf->provider.wth, rec, buf, err, &err_info, &data_offset))) {
if (cf->state == FILE_READ_ABORTED) {
/* Well, the user decided to abort the read. Break out of the
loop, and let the code below (which is called even if there
aren't any packets left to read) exit. */
break;
}
read_record(cf, rec, buf, dfcode, &edt, cinfo, data_offset, frame_dup_cache, frame_cksum);
wtap_rec_reset(rec);
}