Wireshark mailing list archives
Requesting feedback and help on a WIP merge request
From: David Perry <boolean263 () gmail com>
Date: Wed, 23 Jun 2021 10:45:38 -0400
Hello all! I'm writing to request fresh eyes, and possibly hands, on a somewhat significant potential change to Wireshark.
There's an old bug, 14329, requesting support for multiple comments per packet. I've got a proposed solution in merge request #2859: Instead of creating new fields on wtap_rec for every block option type we want to know (currently comments, packet verdicts, and most recently added, custom packet options), act on the code comment in wiretap/wtap.h that suggests "this should become a full set of options", and carry a stripped down wtap_block that can be queried for its options with existing methods that act on wtap_blocks.
Bug: https://gitlab.com/wireshark/wireshark/-/issues/14329 MR: https://gitlab.com/wireshark/wireshark/-/merge_requests/2859I've done nearly as much as I can on this over the past month or so, and it's maybe 85% complete. It currently supports:
* Loading and saving pcapng files with multiple packet comments * Editing existing comments in the GUI * Adding new comments in the GUI and in editcap * Removing specific comments in the GUI * Handles packet verdicts as pcapng options* Handles custom packet options (currently untested; that code was new to me this morning)
Issues that still need resolution: * Memory leak on multi-pass analysis * sharkd's role is a mystery to me * Other file formats that support comments (I did what I could with ERF) * Lua support for multiple comments * The Lua API in general for this revised approach... and of course, whether this approach would even be accepted into Wireshark. I personally think this is a natural evolution of the code, and I've worked to try and demonstrate how that would look.
I unfortunately have not been able to get it to 100% on my own, but I hope that I've done enough to start a conversation. I'd be grateful for any help to address the issues above, and anything I may have missed.
Thanks in advance for your time and consideration, David ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Requesting feedback and help on a WIP merge request David Perry (Jun 23)