From bf284da2eef917f8bf55be3aad15bb296072bb77 Mon Sep 17 00:00:00 2001
From: Michael Mann <mmann78@netscape.net>
Date: Wed, 8 Jan 2014 04:35:28 +0000
Subject: TFShark (Terminal Fileshark) v.001.  Bug 9607
 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9607)

This is a VERY PRELIMINARY version of tfshark.  It's an attempt to jumpstart FileShark and its architecture.  Right now it's mostly just a very stripped down version of tshark with all of the necessary build modifications (including now building filetap library since tfshark depends on it)

This code has helped me identify what I believe to be all of the necessary layers for a complete fileshark architecture.  And those layers will slowly be added in time (patches always welcome!).

svn path=/trunk/; revision=54646
---
 frame_tvbuff.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

(limited to 'frame_tvbuff.c')

diff --git a/frame_tvbuff.c b/frame_tvbuff.c
index acecd0945d..7682f10d2a 100644
--- a/frame_tvbuff.c
+++ b/frame_tvbuff.c
@@ -270,3 +270,71 @@ frame_clone(tvbuff_t *tvb, guint abs_offset, guint abs_length)
 
 	return cloned_tvb;
 }
+
+
+/* based on tvb_new_real_data() */
+tvbuff_t *
+file_tvbuff_new(const frame_data *fd, const guint8 *buf)
+{
+	struct tvb_frame *frame_tvb;
+	tvbuff_t *tvb;
+
+	tvb = tvb_new(&tvb_frame_ops);
+
+	/*
+	 * XXX - currently, the length arguments in
+	 * tvbuff structure are signed, but the captured
+	 * and reported length values are unsigned; this means
+	 * that length values > 2^31 - 1 will appear as
+	 * negative lengths
+	 *
+	 * Captured length values that large will already
+	 * have been filtered out by the Wiretap modules
+	 * (the file will be reported as corrupted), to
+	 * avoid trying to allocate large chunks of data.
+	 *
+	 * Reported length values will not have been
+	 * filtered out, and should not be filtered out,
+	 * as those lengths are not necessarily invalid.
+	 *
+	 * For now, we clip the reported length at G_MAXINT
+	 *
+	 * (XXX, is this still a problem?) There was an exception when we call
+	 * tvb_new_real_data() now there's no one
+	 */
+
+	tvb->real_data       = buf;
+	tvb->length          = fd->cap_len;
+	tvb->reported_length = fd->pkt_len > G_MAXINT ? G_MAXINT : fd->pkt_len;
+	tvb->initialized     = TRUE;
+
+	/*
+	 * This is the top-level real tvbuff for this data source,
+	 * so its data source tvbuff is itself.
+	 */
+	tvb->ds_tvb = tvb;
+
+	frame_tvb = (struct tvb_frame *) tvb;
+
+	/* XXX, wtap_can_seek() */
+	if (cfile.wth && cfile.wth->random_fh 
+#ifdef WANT_PACKET_EDITOR
+		&& fd->file_off != -1 /* generic clone for modified packets */
+#endif
+	) {
+		frame_tvb->wth = cfile.wth;
+		frame_tvb->file_off = fd->file_off;
+		frame_tvb->offset = 0;
+	} else
+		frame_tvb->wth = NULL;
+
+	frame_tvb->buf = NULL;
+
+	return tvb;
+}
+
+tvbuff_t *
+file_tvbuff_new_buffer(const frame_data *fd, Buffer *buf)
+{
+	return frame_tvbuff_new(fd, buffer_start_ptr(buf));
+}
-- 
cgit v1.2.3