Wireshark can call extcap with empty multicheck argument

This issue was migrated from bug 15065 in our old bug tracker.

Original bug information:

Reporter: Tomasz Mon
Status: RESOLVED FIXED
Product: Wireshark
Component: Qt UI
OS: Windows 7
Platform: x86-64
Version: Git

Tomasz Mon said:

Build Information:

Version 2.9.0-1484-g62874e37 (v2.9.0rc0-1484-g62874e37)

Copyright 1998-2018 Gerald Combs <gerald@‍wireshark.org> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.9.5, with WinPcap (4_1_3), with GLib 2.52.2, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.4.11, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.14.0, with LZ4, with Snappy, with libxml2 2.9.4, with QtMultimedia, with AirPcap, with SBC, with SpanDSP, with bcg729.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with Intel(R) Core(TM) i7-4710HQ CPU @ 2.50GHz (with SSE4.2), with 7679 MB of physical memory, with locale Polish_Poland.1250, with WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008), with GnuTLS 3.4.11, with Gcrypt 1.8.3, without AirPcap, binary plugins supported (14 loaded). Built using Microsoft Visual C++ 14.12 build 25835

Wireshark is Open Source Software released under the GNU General Public License.

Check the man page and http://www.wireshark.org for more information.

Everything works fine in the Wireshark Legacy (GTK+) interface in 2.0.16.

In Wireshark 2.9.0-1484, an empty --devices parameter can be triggered by doing:
  1. Open Wireshark, select USBPcap interface, open options
  2. Expand any parent USB device, click on child device name (non-selectable - the child device doesn't start with the [X] in the name, where X is the USB device address)
  3. Start capture
  4. Click Stop capture button in the toolbar
  5. Click Start capture button in toolbar, continue without saving data
  6. Watch that no packets are being captured

In point 3 USBPcapCMD is executed with following parameters:
"C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --capture --extcap-interface \\.\USBPcap1 --fifo \\.\pipe\wireshark_extcap_\\.\USBPcap1_20180817111616 --capture-from-all-devices

In point 5 USBPcapCMD is executed with following parameters:
"C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --capture --extcap-interface \\.\USBPcap1 --fifo \\.\pipe\wireshark_extcap_\\.\USBPcap1_20180817111653 --snaplen 65535 --bufferlen 1048576 --capture-from-all-devices --capture-from-new-devices --devices " "

The commandline should be the same in point 5 and 3. In my opinion the commandline from point 3 is the correct one (do not include --devices if there isn't any selection).

added oswindows uiqt versiondev labels

Tomasz Mon said:

In fact, it looks that neither is correct as the argument list from point 3 does not include the "--capture-from-new-devices" which is enabled by default.

Tomasz Mon said:

(In reply to Tomasz Mon from comment #‍1)
> In fact, it looks that neither is correct as the argument list from point 3
> does not include the "--capture-from-new-devices" which is enabled by
> default.

This was fixed in https://code.wireshark.org/review/#/c/32848/

Tomasz Mon said:

Expanding on to previous comment, the extcap in point 3 is called with:

C:\Development\wsbuild64\run\RelWithDebInfo\extcap\USBPcapCMD.exe --capture --extcap-interface \\.\USBPcap1 --fifo \\.\pipe\wireshark_extcap_\\.\USBPcap1_20190415200526 --capture-from-all-devices --capture-from-new-devices

So only the "point 3" is now correct. However, after doing points 4 and 5, the extcap is called with:

C:\Development\wsbuild64\run\RelWithDebInfo\extcap\USBPcapCMD.exe --capture --extcap-interface \\.\USBPcap1 --fifo \\.\pipe\wireshark_extcap_\\.\USBPcap1_20190415200545 --snaplen 65535 --bufferlen 1048576 --capture-from-all-devices --capture-from-new-devices --devices " "

So the bug is still present.

Gerrit Code Review said:

Change 32887 had a related patch set uploaded by Tomasz Moń: Qt: Do not turn empty parameter values into spaces

https://code.wireshark.org/review/32887

Gerrit Code Review said:

Change 32887 merged by Anders Broman: Qt: Do not turn empty parameter values into spaces

https://code.wireshark.org/review/32887

Gerrit Code Review said:

Change 32891 had a related patch set uploaded by Pascal Quantin: Qt: Do not turn empty parameter values into spaces

https://code.wireshark.org/review/32891

Gerrit Code Review said:

Change 32891 merged by Pascal Quantin: Qt: Do not turn empty parameter values into spaces

https://code.wireshark.org/review/32891

closed