ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Capture filename not available at plugin init time

From: Paul Offord <Paul.Offord@xxxxxxxxxxxx>
Date: Fri, 3 Nov 2017 13:49:08 +0000

I have a dissector that needs the capture file name at the time my dissector’s init function is called.  I attempt to get the name with plugin_if_get_ws_info(…), not an unreasonable request I think you’ll agree, but unfortunately the filename comes back as a NULL pointer.

 

I’ve traced through the code and this is what happens:

 

  • We pass through the MainWindow signal and slot stuff and eventually call cf_open(…) in file.c with the filename as one of the parameters
  • cf_open(…) opens the file to test the validity of the filename and then closes with cf_close(cf)
  • cf_close(cf) frees the memory holding the filename and NULLs the filename pointer in the cf structure
  • cf_open then creates a new epan session with ws_epan_new(cf)
  • ws_epan_new(cf) calls epan_new() which calls init_dissection() and this is where eventually my dissector’s init function gets called
  • My dissector calls plugin_if_get_ws_info(…) which attempts to get the filename info from the cf structure, which due to the above returns a NULL filename pointer
  • Eventually we return back to cf_open(…) and a little later we set up the file name in the cf structure – all too late for my dissector’s init function

 

So my questions are:

 

  • Can I raise this as a bug?
  • If not, would a solution that made the filename available to plugin_if_get_ws_info(…) at init time be accepted?
  • What would be an acceptable solution?

 

Thanks and regards…Paul


______________________________________________________________________

This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.

Any views or opinions expressed are solely those of the author and do not necessarily represent those of Advance Seven Ltd. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission.

Advance Seven Ltd. Registered in England & Wales numbered 2373877 at Endeavour House, Coopers End Lane, Stansted, Essex CM24 1SJ

______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________