Wireshark · Wireshark-dev: Re: [Wireshark-dev] Dissector lifecycle and per-file data

[Pascal Quantin <pascal@xxxxxxxxxxxxx>]

Hi Vincent,

Le lun. 29 mars 2021 à 18:24, Vincent Mallet <vmallet@xxxxxxxxx> a écrit :

I am hoping this is the right place to ask this question but if not please redirect me.

That's the right place :)

I am working on a custom C dissector and need to keep some data around for the lifetime of the current file. At the moment I allocate my structures using various wmem_ functions with a wmem_file_scope() scope and keep them in conversations with conversation_get_proto_data() and conversation_add_proto_data(). It works great for conversation-related data but is not ideal for file-related data. 

The wmem file scope is definitely the right memory pool.

Is there a way for a dissector to know a new file is being worked on and it’s time to reinitialize data structures? Or is there an equivalent to conversation_get_proto_data() but for a file? 

Did you look at the register_cleanup_routine() found in epan/packet.h? It seems to be what you are looking for. To quote the comments:

/**
 * Allows protocols to register "cleanup" routines which are called
 * after closing a capture file (or when preferences are changed, in
 * that case these routines are called before the init routines are
 * executed). It can be used to release resources that are allocated in
 * register_init_routine.
 */

You can find multiple dissectors using it in our code base that should give you plenty of examples.

Best regards,

Pascal.