forked from wireshark/wireshark
-
Notifications
You must be signed in to change notification settings - Fork 0
/
file.c
5037 lines (4287 loc) · 155 KB
/
file.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* file.c
* File I/O routines
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#include <config.h>
#define WS_LOG_DOMAIN LOG_DOMAIN_CAPTURE
#include <time.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#include <errno.h>
#include <wsutil/file_util.h>
#include <wsutil/filesystem.h>
#include <wsutil/json_dumper.h>
#include <wsutil/wslog.h>
#include <wsutil/ws_assert.h>
#include <ui/version_info.h>
#include <wiretap/merge.h>
#include <epan/exceptions.h>
#include <epan/epan.h>
#include <epan/column.h>
#include <epan/packet.h>
#include <epan/column-utils.h>
#include <epan/expert.h>
#include <epan/prefs.h>
#include <epan/dfilter/dfilter.h>
#include <epan/epan_dissect.h>
#include <epan/tap.h>
#include <epan/timestamp.h>
#include <epan/dfilter/dfilter-macro.h>
#include <epan/strutil.h>
#include <epan/addr_resolv.h>
#include <epan/color_filters.h>
#include <epan/secrets.h>
#include "cfile.h"
#include "file.h"
#include "fileset.h"
#include "frame_tvbuff.h"
#include "ui/alert_box.h"
#include "ui/simple_dialog.h"
#include "ui/main_statusbar.h"
#include "ui/progress_dlg.h"
#include "ui/urls.h"
#include "ui/ws_ui_util.h"
/* Needed for addrinfo */
#include <sys/types.h>
#ifdef HAVE_SYS_SOCKET_H
#include <sys/socket.h>
#endif
#ifdef HAVE_NETINET_IN_H
# include <netinet/in.h>
#endif
#ifdef _WIN32
# include <winsock2.h>
# include <ws2tcpip.h>
#endif
static gboolean read_record(capture_file *cf, wtap_rec *rec, Buffer *buf,
dfilter_t *dfcode, epan_dissect_t *edt, column_info *cinfo, gint64 offset);
static void rescan_packets(capture_file *cf, const char *action, const char *action_item, gboolean redissect);
typedef enum {
MR_NOTMATCHED,
MR_MATCHED,
MR_ERROR
} match_result;
typedef match_result (*ws_match_function)(capture_file *, frame_data *,
wtap_rec *, Buffer *, void *);
static match_result match_protocol_tree(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static void match_subtree_text(proto_node *node, gpointer data);
static match_result match_summary_line(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_narrow_and_wide(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_narrow(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_wide(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_binary(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_regex(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_dfilter(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_marked(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static match_result match_time_reference(capture_file *cf, frame_data *fdata,
wtap_rec *, Buffer *, void *criterion);
static gboolean find_packet(capture_file *cf, ws_match_function match_function,
void *criterion, search_direction dir);
static void cf_rename_failure_alert_box(const char *filename, int err);
static void ref_time_packets(capture_file *cf);
/* Seconds spent processing packets between pushing UI updates. */
#define PROGBAR_UPDATE_INTERVAL 0.150
/* Show the progress bar after this many seconds. */
#define PROGBAR_SHOW_DELAY 0.5
/*
* Maximum number of records we support in a file.
*
* It is, at most, the maximum value of a guint32, as we use a guint32
* for the frame number.
*
* We allow it to be set to a lower value; see issue #16908 for why
* we're doing this. Thanks, Qt!
*/
static guint32 max_records = G_MAXUINT32;
void
cf_set_max_records(guint max_records_arg)
{
max_records = max_records_arg;
}
/*
* We could probably use g_signal_...() instead of the callbacks below but that
* would require linking our CLI programs to libgobject and creating an object
* instance for the signals.
*/
typedef struct {
cf_callback_t cb_fct;
gpointer user_data;
} cf_callback_data_t;
static GList *cf_callbacks = NULL;
static void
cf_callback_invoke(int event, gpointer data)
{
cf_callback_data_t *cb;
GList *cb_item = cf_callbacks;
/* there should be at least one interested */
ws_assert(cb_item != NULL);
while (cb_item != NULL) {
cb = (cf_callback_data_t *)cb_item->data;
cb->cb_fct(event, data, cb->user_data);
cb_item = g_list_next(cb_item);
}
}
void
cf_callback_add(cf_callback_t func, gpointer user_data)
{
cf_callback_data_t *cb;
cb = g_new(cf_callback_data_t,1);
cb->cb_fct = func;
cb->user_data = user_data;
cf_callbacks = g_list_prepend(cf_callbacks, cb);
}
void
cf_callback_remove(cf_callback_t func, gpointer user_data)
{
cf_callback_data_t *cb;
GList *cb_item = cf_callbacks;
while (cb_item != NULL) {
cb = (cf_callback_data_t *)cb_item->data;
if (cb->cb_fct == func && cb->user_data == user_data) {
cf_callbacks = g_list_remove(cf_callbacks, cb);
g_free(cb);
return;
}
cb_item = g_list_next(cb_item);
}
ws_assert_not_reached();
}
void
cf_timestamp_auto_precision(capture_file *cf)
{
int i;
/* don't try to get the file's precision if none is opened */
if (cf->state == FILE_CLOSED) {
return;
}
/* Set the column widths of those columns that show the time in
"command-line-specified" format. */
for (i = 0; i < cf->cinfo.num_cols; i++) {
if (col_has_time_fmt(&cf->cinfo, i)) {
packet_list_resize_column(i);
}
}
}
gulong
cf_get_computed_elapsed(capture_file *cf)
{
return cf->computed_elapsed;
}
static void compute_elapsed(capture_file *cf, gint64 start_time)
{
gint64 delta_time = g_get_monotonic_time() - start_time;
cf->computed_elapsed = (gulong) (delta_time / 1000); /* ms */
}
static const nstime_t *
ws_get_frame_ts(struct packet_provider_data *prov, guint32 frame_num)
{
if (prov->prev_dis && prov->prev_dis->num == frame_num)
return &prov->prev_dis->abs_ts;
if (prov->prev_cap && prov->prev_cap->num == frame_num)
return &prov->prev_cap->abs_ts;
if (prov->frames) {
frame_data *fd = frame_data_sequence_find(prov->frames, frame_num);
return (fd) ? &fd->abs_ts : NULL;
}
return NULL;
}
static epan_t *
ws_epan_new(capture_file *cf)
{
static const struct packet_provider_funcs funcs = {
ws_get_frame_ts,
cap_file_provider_get_interface_name,
cap_file_provider_get_interface_description,
cap_file_provider_get_modified_block
};
return epan_new(&cf->provider, &funcs);
}
cf_status_t
cf_open(capture_file *cf, const char *fname, unsigned int type, gboolean is_tempfile, int *err)
{
wtap *wth;
gchar *err_info;
wth = wtap_open_offline(fname, type, err, &err_info, TRUE);
if (wth == NULL)
goto fail;
/* The open succeeded. Close whatever capture file we had open,
and fill in the information for this file. */
cf_close(cf);
/* Initialize the record metadata. */
wtap_rec_init(&cf->rec);
/* XXX - we really want to initialize this after we've read all
the packets, so we know how much we'll ultimately need. */
ws_buffer_init(&cf->buf, 1514);
/* We're about to start reading the file. */
cf->state = FILE_READ_IN_PROGRESS;
cf->provider.wth = wth;
cf->f_datalen = 0;
/* Set the file name because we need it to set the follow stream filter.
XXX - is that still true? We need it for other reasons, though,
in any case. */
cf->filename = g_strdup(fname);
/* Indicate whether it's a permanent or temporary file. */
cf->is_tempfile = is_tempfile;
/* No user changes yet. */
cf->unsaved_changes = FALSE;
cf->computed_elapsed = 0;
cf->cd_t = wtap_file_type_subtype(cf->provider.wth);
cf->open_type = type;
cf->linktypes = g_array_sized_new(FALSE, FALSE, (guint) sizeof(int), 1);
cf->count = 0;
cf->packet_comment_count = 0;
cf->displayed_count = 0;
cf->marked_count = 0;
cf->ignored_count = 0;
cf->ref_time_count = 0;
cf->drops_known = FALSE;
cf->drops = 0;
cf->snap = wtap_snapshot_length(cf->provider.wth);
/* Allocate a frame_data_sequence for the frames in this file */
cf->provider.frames = new_frame_data_sequence();
nstime_set_zero(&cf->elapsed_time);
cf->provider.ref = NULL;
cf->provider.prev_dis = NULL;
cf->provider.prev_cap = NULL;
cf->cum_bytes = 0;
/* Create new epan session for dissection.
* (The old one was freed in cf_close().)
*/
cf->epan = ws_epan_new(cf);
packet_list_queue_draw();
cf_callback_invoke(cf_cb_file_opened, cf);
wtap_set_cb_new_ipv4(cf->provider.wth, add_ipv4_name);
wtap_set_cb_new_ipv6(cf->provider.wth, (wtap_new_ipv6_callback_t) add_ipv6_name);
wtap_set_cb_new_secrets(cf->provider.wth, secrets_wtap_callback);
return CF_OK;
fail:
cfile_open_failure_alert_box(fname, *err, err_info);
return CF_ERROR;
}
/*
* Add an encapsulation type to cf->linktypes.
*/
static void
cf_add_encapsulation_type(capture_file *cf, int encap)
{
guint i;
for (i = 0; i < cf->linktypes->len; i++) {
if (g_array_index(cf->linktypes, gint, i) == encap)
return; /* it's already there */
}
/* It's not already there - add it. */
g_array_append_val(cf->linktypes, encap);
}
/* Reset everything to a pristine state */
void
cf_close(capture_file *cf)
{
cf->stop_flag = FALSE;
if (cf->state == FILE_CLOSED)
return; /* Nothing to do */
/* Die if we're in the middle of reading a file. */
ws_assert(cf->state != FILE_READ_IN_PROGRESS);
ws_assert(!cf->read_lock);
cf_callback_invoke(cf_cb_file_closing, cf);
/* close things, if not already closed before */
color_filters_cleanup();
if (cf->provider.wth) {
wtap_close(cf->provider.wth);
cf->provider.wth = NULL;
}
/* We have no file open... */
if (cf->filename != NULL) {
/* If it's a temporary file, remove it. */
if (cf->is_tempfile)
ws_unlink(cf->filename);
g_free(cf->filename);
cf->filename = NULL;
}
/* ...which means we have no changes to that file to save. */
cf->unsaved_changes = FALSE;
/* no open_routine type */
cf->open_type = WTAP_TYPE_AUTO;
/* Clean up the record metadata. */
wtap_rec_cleanup(&cf->rec);
/* Clear the packet list. */
packet_list_freeze();
packet_list_clear();
packet_list_thaw();
/* Free up the packet buffer. */
ws_buffer_free(&cf->buf);
dfilter_free(cf->rfcode);
cf->rfcode = NULL;
if (cf->provider.frames != NULL) {
free_frame_data_sequence(cf->provider.frames);
cf->provider.frames = NULL;
}
if (cf->provider.frames_modified_blocks) {
g_tree_destroy(cf->provider.frames_modified_blocks);
cf->provider.frames_modified_blocks = NULL;
}
cf_unselect_packet(cf); /* nothing to select */
cf->first_displayed = 0;
cf->last_displayed = 0;
/* No frames, no frame selected, no field in that frame selected. */
cf->count = 0;
cf->current_frame = NULL;
cf->current_row = 0;
cf->finfo_selected = NULL;
/* No frame link-layer types, either. */
if (cf->linktypes != NULL) {
g_array_free(cf->linktypes, TRUE);
cf->linktypes = NULL;
}
cf->f_datalen = 0;
nstime_set_zero(&cf->elapsed_time);
reset_tap_listeners();
epan_free(cf->epan);
cf->epan = NULL;
/* We have no file open. */
cf->state = FILE_CLOSED;
cf_callback_invoke(cf_cb_file_closed, cf);
}
/*
* TRUE if the progress dialog doesn't exist and it looks like we'll
* take > 2s to load, FALSE otherwise.
*/
static inline gboolean
progress_is_slow(progdlg_t *progdlg, GTimer *prog_timer, gint64 size, gint64 pos)
{
double elapsed;
if (progdlg) return FALSE;
elapsed = g_timer_elapsed(prog_timer, NULL);
if ((elapsed / 2 > PROGBAR_SHOW_DELAY && (size / pos) > 2) /* It looks like we're going to be slow. */
|| elapsed > PROGBAR_SHOW_DELAY) { /* We are indeed slow. */
return TRUE;
}
return FALSE;
}
static float
calc_progbar_val(capture_file *cf, gint64 size, gint64 file_pos, gchar *status_str, gulong status_size)
{
float progbar_val;
progbar_val = (gfloat) file_pos / (gfloat) size;
if (progbar_val > 1.0) {
/* The file probably grew while we were reading it.
* Update file size, and try again.
*/
size = wtap_file_size(cf->provider.wth, NULL);
if (size >= 0)
progbar_val = (gfloat) file_pos / (gfloat) size;
/* If it's still > 1, either "wtap_file_size()" failed (in which
* case there's not much we can do about it), or the file
* *shrank* (in which case there's not much we can do about
* it); just clip the progress value at 1.0.
*/
if (progbar_val > 1.0f)
progbar_val = 1.0f;
}
g_snprintf(status_str, status_size,
"%" G_GINT64_MODIFIER "dKB of %" G_GINT64_MODIFIER "dKB",
file_pos / 1024, size / 1024);
return progbar_val;
}
cf_read_status_t
cf_read(capture_file *cf, gboolean reloading)
{
int err = 0;
gchar *err_info = NULL;
volatile gboolean too_many_records = FALSE;
gchar *name_ptr;
progdlg_t *volatile progbar = NULL;
GTimer *prog_timer = g_timer_new();
gint64 size;
gint64 start_time;
epan_dissect_t edt;
wtap_rec rec;
Buffer buf;
dfilter_t *dfcode;
column_info *cinfo;
volatile gboolean create_proto_tree;
guint tap_flags;
gboolean compiled _U_;
volatile gboolean is_read_aborted = FALSE;
/* The update_progress_dlg call below might end up accepting a user request to
* trigger redissection/rescans which can modify/destroy the dissection
* context ("cf->epan"). That condition should be prevented by callers, but in
* case it occurs let's fail gracefully.
*/
if (cf->read_lock) {
ws_warning("Failing due to recursive cf_read(\"%s\", %d) call!",
cf->filename, reloading);
return CF_READ_ERROR;
}
cf->read_lock = TRUE;
/* Compile the current display filter.
* We assume this will not fail since cf->dfilter is only set in
* cf_filter IFF the filter was valid.
*/
compiled = dfilter_compile(cf->dfilter, &dfcode, NULL);
ws_assert(!cf->dfilter || (compiled && dfcode));
/* Get the union of the flags for all tap listeners. */
tap_flags = union_of_tap_listener_flags();
/*
* Determine whether we need to create a protocol tree.
* We do if:
*
* we're going to apply a display filter;
*
* one of the tap listeners is going to apply a filter;
*
* one of the tap listeners requires a protocol tree;
*
* a postdissector wants field values or protocols on
* the first pass.
*/
create_proto_tree =
(dfcode != NULL || have_filtering_tap_listeners() ||
(tap_flags & TL_REQUIRES_PROTO_TREE) || postdissectors_want_hfids());
reset_tap_listeners();
name_ptr = g_filename_display_basename(cf->filename);
if (reloading)
cf_callback_invoke(cf_cb_file_reload_started, cf);
else
cf_callback_invoke(cf_cb_file_read_started, cf);
/* Record the file's compression type.
XXX - do we know this at open time? */
cf->compression_type = wtap_get_compression_type(cf->provider.wth);
/* The packet list window will be empty until the file is completly loaded */
packet_list_freeze();
cf->stop_flag = FALSE;
start_time = g_get_monotonic_time();
epan_dissect_init(&edt, cf->epan, create_proto_tree, FALSE);
/* If any tap listeners require the columns, construct them. */
cinfo = (tap_flags & TL_REQUIRES_COLUMNS) ? &cf->cinfo : NULL;
/* Find the size of the file. */
size = wtap_file_size(cf->provider.wth, NULL);
g_timer_start(prog_timer);
wtap_rec_init(&rec);
ws_buffer_init(&buf, 1514);
TRY {
guint32 count = 0;
gint64 file_pos;
gint64 data_offset;
float progbar_val;
gchar status_str[100];
while ((wtap_read(cf->provider.wth, &rec, &buf, &err, &err_info,
&data_offset))) {
if (size >= 0) {
if (cf->count == max_records) {
/*
* Quit if we've already read the maximum number of
* records allowed.
*/
too_many_records = TRUE;
break;
}
count++;
file_pos = wtap_read_so_far(cf->provider.wth);
/* Create the progress bar if necessary. */
if (progress_is_slow(progbar, prog_timer, size, file_pos)) {
progbar_val = calc_progbar_val(cf, size, file_pos, status_str, sizeof(status_str));
progbar = delayed_create_progress_dlg(cf->window, NULL, NULL, TRUE,
&cf->stop_flag, progbar_val);
}
/*
* Update the progress bar, but do it only after
* PROGBAR_UPDATE_INTERVAL has elapsed. Calling update_progress_dlg
* and packets_bar_update will likely trigger UI paint events, which
* might take a while depending on the platform and display. Reset
* our timer *after* painting.
*/
if (progbar && g_timer_elapsed(prog_timer, NULL) > PROGBAR_UPDATE_INTERVAL) {
progbar_val = calc_progbar_val(cf, size, file_pos, status_str, sizeof(status_str));
/* update the packet bar content on the first run or frequently on very large files */
update_progress_dlg(progbar, progbar_val, status_str);
compute_elapsed(cf, start_time);
packets_bar_update();
g_timer_start(prog_timer);
}
/*
* The previous GUI triggers should not have destroyed the running
* session. If that did happen, it could blow up when read_record tries
* to use the destroyed edt.session, so detect it right here.
*/
ws_assert(edt.session == cf->epan);
}
if (cf->state == FILE_READ_ABORTED) {
/* Well, the user decided to exit Wireshark. Break out of the
loop, and let the code below (which is called even if there
aren't any packets left to read) exit. */
is_read_aborted = TRUE;
break;
}
if (cf->stop_flag) {
/* Well, the user decided to abort the read. He/She will be warned and
it might be enough for him/her to work with the already loaded
packets.
This is especially true for very large capture files, where you don't
want to wait loading the whole file (which may last minutes or even
hours even on fast machines) just to see that it was the wrong file. */
break;
}
read_record(cf, &rec, &buf, dfcode, &edt, cinfo, data_offset);
}
}
CATCH(OutOfMemoryError) {
simple_message_box(ESD_TYPE_ERROR, NULL,
"More information and workarounds can be found at\n"
WS_WIKI_URL("KnownBugs/OutOfMemory"),
"Sorry, but Wireshark has run out of memory and has to terminate now.");
#if 0
/* Could we close the current capture and free up memory from that? */
#else
/* we have to terminate, as we cannot recover from the memory error */
exit(1);
#endif
}
ENDTRY;
/* We're done reading sequentially through the file. */
cf->state = FILE_READ_DONE;
/* Destroy the progress bar if it was created. */
if (progbar != NULL)
destroy_progress_dlg(progbar);
g_timer_destroy(prog_timer);
/* Free the display name */
g_free(name_ptr);
/* Cleanup and release all dfilter resources */
dfilter_free(dfcode);
epan_dissect_cleanup(&edt);
wtap_rec_cleanup(&rec);
ws_buffer_free(&buf);
/* Close the sequential I/O side, to free up memory it requires. */
wtap_sequential_close(cf->provider.wth);
/* Allow the protocol dissectors to free up memory that they
* don't need after the sequential run-through of the packets. */
postseq_cleanup_all_protocols();
/* compute the time it took to load the file */
compute_elapsed(cf, start_time);
/* Set the file encapsulation type now; we don't know what it is until
we've looked at all the packets, as we don't know until then whether
there's more than one type (and thus whether it's
WTAP_ENCAP_PER_PACKET). */
cf->lnk_t = wtap_file_encap(cf->provider.wth);
cf->current_frame = frame_data_sequence_find(cf->provider.frames, cf->first_displayed);
cf->current_row = 0;
packet_list_thaw();
if (reloading)
cf_callback_invoke(cf_cb_file_reload_finished, cf);
else
cf_callback_invoke(cf_cb_file_read_finished, cf);
/* If we have any displayed packets to select, select the first of those
packets by making the first row the selected row. */
if (cf->first_displayed != 0) {
packet_list_select_first_row();
}
/* It is safe again to execute redissections. */
ws_assert(cf->read_lock);
cf->read_lock = FALSE;
if (is_read_aborted) {
/*
* Well, the user decided to exit Wireshark while reading this *offline*
* capture file (Live captures are handled by something like
* cf_continue_tail). Clean up accordingly.
*/
cf_close(cf);
cf->redissection_queued = RESCAN_NONE;
return CF_READ_ABORTED;
}
if (cf->redissection_queued != RESCAN_NONE) {
/* Redissection was queued up. Clear the request and perform it now. */
gboolean redissect = cf->redissection_queued == RESCAN_REDISSECT;
rescan_packets(cf, NULL, NULL, redissect);
}
if (cf->stop_flag) {
simple_message_box(ESD_TYPE_WARN, NULL,
"The remaining packets in the file were discarded.\n"
"\n"
"As a lot of packets from the original file will be missing,\n"
"remember to be careful when saving the current content to a file.\n",
"File loading was cancelled.");
return CF_READ_ERROR;
}
if (err != 0) {
/* Put up a message box noting that the read failed somewhere along
the line. Don't throw out the stuff we managed to read, though,
if any. */
cfile_read_failure_alert_box(NULL, err, err_info);
return CF_READ_ERROR;
} else if (too_many_records) {
simple_message_box(ESD_TYPE_WARN, NULL,
"The remaining packets in the file were discarded.\n"
"\n"
"As a lot of packets from the original file will be missing,\n"
"remember to be careful when saving the current content to a file.\n"
"\n"
"The command-line utility editcap can be used to split "
"the file into multiple smaller files",
"The file contains more records than the maximum "
"supported number of records, %u.", max_records);
return CF_READ_ERROR;
} else
return CF_READ_OK;
}
#ifdef HAVE_LIBPCAP
cf_read_status_t
cf_continue_tail(capture_file *cf, volatile int to_read, wtap_rec *rec,
Buffer *buf, int *err)
{
gchar *err_info;
volatile int newly_displayed_packets = 0;
dfilter_t *dfcode;
epan_dissect_t edt;
gboolean create_proto_tree;
guint tap_flags;
gboolean compiled _U_;
/* Compile the current display filter.
* We assume this will not fail since cf->dfilter is only set in
* cf_filter IFF the filter was valid.
*/
compiled = dfilter_compile(cf->dfilter, &dfcode, NULL);
ws_assert(!cf->dfilter || (compiled && dfcode));
/* Get the union of the flags for all tap listeners. */
tap_flags = union_of_tap_listener_flags();
/*
* Determine whether we need to create a protocol tree.
* We do if:
*
* we're going to apply a display filter;
*
* one of the tap listeners is going to apply a filter;
*
* one of the tap listeners requires a protocol tree;
*
* a postdissector wants field values or protocols on
* the first pass.
*/
create_proto_tree =
(dfcode != NULL || have_filtering_tap_listeners() ||
(tap_flags & TL_REQUIRES_PROTO_TREE) || postdissectors_want_hfids());
*err = 0;
/* Don't freeze/thaw the list when doing live capture */
/*packet_list_freeze();*/
epan_dissect_init(&edt, cf->epan, create_proto_tree, FALSE);
TRY {
gint64 data_offset = 0;
column_info *cinfo;
/* If any tap listeners require the columns, construct them. */
cinfo = (tap_flags & TL_REQUIRES_COLUMNS) ? &cf->cinfo : NULL;
while (to_read != 0) {
wtap_cleareof(cf->provider.wth);
if (!wtap_read(cf->provider.wth, rec, buf, err, &err_info,
&data_offset)) {
break;
}
if (cf->state == FILE_READ_ABORTED) {
/* Well, the user decided to exit Wireshark. Break out of the
loop, and let the code below (which is called even if there
aren't any packets left to read) exit. */
break;
}
if (read_record(cf, rec, buf, dfcode, &edt, cinfo, data_offset)) {
newly_displayed_packets++;
}
to_read--;
}
}
CATCH(OutOfMemoryError) {
simple_message_box(ESD_TYPE_ERROR, NULL,
"More information and workarounds can be found at\n"
WS_WIKI_URL("KnownBugs/OutOfMemory"),
"Sorry, but Wireshark has run out of memory and has to terminate now.");
#if 0
/* Could we close the current capture and free up memory from that? */
return CF_READ_ABORTED;
#else
/* we have to terminate, as we cannot recover from the memory error */
exit(1);
#endif
}
ENDTRY;
/* Update the file encapsulation; it might have changed based on the
packets we've read. */
cf->lnk_t = wtap_file_encap(cf->provider.wth);
/* Cleanup and release all dfilter resources */
dfilter_free(dfcode);
epan_dissect_cleanup(&edt);
/* Don't freeze/thaw the list when doing live capture */
/*packet_list_thaw();*/
/* With the new packet list the first packet
* isn't automatically selected.
*/
if (!cf->current_frame && !packet_list_multi_select_active())
packet_list_select_first_row();
/* moving to the end of the packet list - if the user requested so and
we have some new packets. */
if (newly_displayed_packets && cf->count != 0)
packet_list_moveto_end();
if (cf->state == FILE_READ_ABORTED) {
/* Well, the user decided to exit Wireshark. Return CF_READ_ABORTED
so that our caller can kill off the capture child process;
this will cause an EOF on the pipe from the child, so
"cf_finish_tail()" will be called, and it will clean up
and exit. */
return CF_READ_ABORTED;
} else if (*err != 0) {
/* We got an error reading the capture file.
XXX - pop up a dialog box instead? */
if (err_info != NULL) {
ws_warning("Error \"%s\" while reading \"%s\" (\"%s\")",
wtap_strerror(*err), cf->filename, err_info);
g_free(err_info);
} else {
ws_warning("Error \"%s\" while reading \"%s\"",
wtap_strerror(*err), cf->filename);
}
return CF_READ_ERROR;
} else
return CF_READ_OK;
}
void
cf_fake_continue_tail(capture_file *cf) {
cf->state = FILE_READ_DONE;
}
cf_read_status_t
cf_finish_tail(capture_file *cf, wtap_rec *rec, Buffer *buf, int *err)
{
gchar *err_info;
gint64 data_offset;
dfilter_t *dfcode;
column_info *cinfo;
epan_dissect_t edt;
gboolean create_proto_tree;
guint tap_flags;
gboolean compiled _U_;
/* Compile the current display filter.
* We assume this will not fail since cf->dfilter is only set in
* cf_filter IFF the filter was valid.
*/
compiled = dfilter_compile(cf->dfilter, &dfcode, NULL);
ws_assert(!cf->dfilter || (compiled && dfcode));
/* Get the union of the flags for all tap listeners. */
tap_flags = union_of_tap_listener_flags();
/* If any tap listeners require the columns, construct them. */
cinfo = (tap_flags & TL_REQUIRES_COLUMNS) ? &cf->cinfo : NULL;
/*
* Determine whether we need to create a protocol tree.
* We do if:
*
* we're going to apply a display filter;
*
* one of the tap listeners is going to apply a filter;
*
* one of the tap listeners requires a protocol tree;
*
* a postdissector wants field values or protocols on
* the first pass.
*/
create_proto_tree =
(dfcode != NULL || have_filtering_tap_listeners() ||
(tap_flags & TL_REQUIRES_PROTO_TREE) || postdissectors_want_hfids());
if (cf->provider.wth == NULL) {
cf_close(cf);
return CF_READ_ERROR;
}
/* Don't freeze/thaw the list when doing live capture */
/*packet_list_freeze();*/
epan_dissect_init(&edt, cf->epan, create_proto_tree, FALSE);
while ((wtap_read(cf->provider.wth, rec, buf, err, &err_info, &data_offset))) {
if (cf->state == FILE_READ_ABORTED) {
/* Well, the user decided to abort the read. Break out of the
loop, and let the code below (which is called even if there
aren't any packets left to read) exit. */
break;
}
read_record(cf, rec, buf, dfcode, &edt, cinfo, data_offset);
}
/* Cleanup and release all dfilter resources */
dfilter_free(dfcode);
epan_dissect_cleanup(&edt);
/* Don't freeze/thaw the list when doing live capture */
/*packet_list_thaw();*/
if (cf->state == FILE_READ_ABORTED) {
/* Well, the user decided to abort the read. We're only called
when the child capture process closes the pipe to us (meaning
it's probably exited), so we can just close the capture
file; we return CF_READ_ABORTED so our caller can do whatever
is appropriate when that happens. */
cf_close(cf);
return CF_READ_ABORTED;
}
/* We're done reading sequentially through the file. */
cf->state = FILE_READ_DONE;
/* We're done reading sequentially through the file; close the
sequential I/O side, to free up memory it requires. */
wtap_sequential_close(cf->provider.wth);
/* Allow the protocol dissectors to free up memory that they
* don't need after the sequential run-through of the packets. */
postseq_cleanup_all_protocols();