Wireshark · Wireshark-users: Re: [Wireshark-users] tshark Export HTTP Objects with unopenable file names

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

On Mon, Sep 25, 2017 at 3:35 PM, <wireshark-users@xxxxxxxxxxxx> wrote:

Hi, I was recently exporting some HTTP objects via
tshark --export-objects "http,destdir" , and ran into a scenario where the
objects were not written seemingly because the chosen filename for the
object was unopenable (the error message I got was "Export objects
(http): Some files could not be saved"). An strace told me that the
filename was too long. It would be nice if it were possible to simply
truncate the filename (and possibly add a number or some sort onto the
end to avoid overwrites). This seems worth addressing to me, possibly as
some kind of argument to the export command similar to the destdir.

1) Did I miss(use) existing functionality here, or
2) Is this something that a patch would be preferred for? Also,
3) I noticed that, despite the error in the output, the exit code was 0,
which was counterintuitive to me.

If no one else wants to pick this up, and a patch would likely be
accepted, it would be greatly appreciated if a pointer to a relevant
part of the source tree could be given.

It certainly seems like a bug (or two).  I'd suggest reporting it on https://bugs.wireshark.org .

If you want to take a crack at it, great!  I'd still suggest tracking it with a bug.

It's been a while but I think a good place to start might be eo_massage_str() in epan/export_object.c and the places that call that code (e.g., ui/cli/tap-exportobject.c).