1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331
|
/* frame_tvbuff.c
* Implements a tvbuff for frame
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#include <config.h>
#include <glib.h>
#include <epan/packet.h>
#include <epan/tvbuff-int.h>
#include <epan/tvbuff.h>
#include "frame_tvbuff.h"
#include "wiretap/wtap-int.h" /* for ->random_fh */
struct tvb_frame {
struct tvbuff tvb;
Buffer *buf; /* Packet data */
const struct packet_provider_data *prov; /* provider of packet information */
gint64 file_off; /**< File offset */
guint offset;
};
static gboolean
frame_read(struct tvb_frame *frame_tvb, wtap_rec *rec, Buffer *buf)
{
int err;
gchar *err_info;
gboolean ok = TRUE;
/* XXX, what if phdr->caplen isn't equal to
* frame_tvb->tvb.length + frame_tvb->offset?
*/
if (!wtap_seek_read(frame_tvb->prov->wth, frame_tvb->file_off, rec, buf, &err, &err_info)) {
/* XXX - report error! */
switch (err) {
case WTAP_ERR_BAD_FILE:
g_free(err_info);
ok = FALSE;
break;
}
}
return ok;
}
static GPtrArray *buffer_cache = NULL;
static void
frame_cache(struct tvb_frame *frame_tvb)
{
wtap_rec rec; /* Record metadata */
wtap_rec_init(&rec);
if (frame_tvb->buf == NULL) {
if (G_UNLIKELY(!buffer_cache)) buffer_cache = g_ptr_array_sized_new(1024);
if (buffer_cache->len > 0) {
frame_tvb->buf = (struct Buffer *) g_ptr_array_remove_index(buffer_cache, buffer_cache->len - 1);
} else {
frame_tvb->buf = g_new(struct Buffer, 1);
}
ws_buffer_init(frame_tvb->buf, frame_tvb->tvb.length + frame_tvb->offset);
if (!frame_read(frame_tvb, &rec, frame_tvb->buf))
{ /* TODO: THROW(???); */ }
}
frame_tvb->tvb.real_data = ws_buffer_start_ptr(frame_tvb->buf) + frame_tvb->offset;
wtap_rec_cleanup(&rec);
}
static void
frame_free(tvbuff_t *tvb)
{
struct tvb_frame *frame_tvb = (struct tvb_frame *) tvb;
if (frame_tvb->buf) {
ws_buffer_free(frame_tvb->buf);
g_ptr_array_add(buffer_cache, frame_tvb->buf);
}
}
static const guint8 *
frame_get_ptr(tvbuff_t *tvb, guint abs_offset, guint abs_length _U_)
{
struct tvb_frame *frame_tvb = (struct tvb_frame *) tvb;
frame_cache(frame_tvb);
return tvb->real_data + abs_offset;
}
static void *
frame_memcpy(tvbuff_t *tvb, void *target, guint abs_offset, guint abs_length)
{
struct tvb_frame *frame_tvb = (struct tvb_frame *) tvb;
frame_cache(frame_tvb);
return memcpy(target, tvb->real_data + abs_offset, abs_length);
}
static gint
frame_find_guint8(tvbuff_t *tvb, guint abs_offset, guint limit, guint8 needle)
{
struct tvb_frame *frame_tvb = (struct tvb_frame *) tvb;
const guint8 *result;
frame_cache(frame_tvb);
result = (const guint8 *)memchr(tvb->real_data + abs_offset, needle, limit);
if (result)
return (gint) (result - tvb->real_data);
else
return -1;
}
static gint
frame_pbrk_guint8(tvbuff_t *tvb, guint abs_offset, guint limit, const ws_mempbrk_pattern* pattern, guchar *found_needle)
{
struct tvb_frame *frame_tvb = (struct tvb_frame *) tvb;
frame_cache(frame_tvb);
return tvb_ws_mempbrk_pattern_guint8(tvb, abs_offset, limit, pattern, found_needle);
}
static guint
frame_offset(const tvbuff_t *tvb _U_, const guint counter)
{
/* XXX: frame_tvb->offset */
return counter;
}
static tvbuff_t *frame_clone(tvbuff_t *tvb, guint abs_offset, guint abs_length);
static const struct tvb_ops tvb_frame_ops = {
sizeof(struct tvb_frame), /* size */
frame_free, /* free */
frame_offset, /* offset */
frame_get_ptr, /* get_ptr */
frame_memcpy, /* memcpy */
frame_find_guint8, /* find_guint8 */
frame_pbrk_guint8, /* pbrk_guint8 */
frame_clone, /* clone */
};
/* based on tvb_new_real_data() */
tvbuff_t *
frame_tvbuff_new(const struct packet_provider_data *prov, const frame_data *fd,
const guint8 *buf)
{
struct tvb_frame *frame_tvb;
tvbuff_t *tvb;
tvb = tvb_new(&tvb_frame_ops);
/*
* XXX - currently, the length arguments in
* tvbuff structure are signed, but the captured
* and reported length values are unsigned; this means
* that length values > 2^31 - 1 will appear as
* negative lengths
*
* Captured length values that large will already
* have been filtered out by the Wiretap modules
* (the file will be reported as corrupted), to
* avoid trying to allocate large chunks of data.
*
* Reported length values will not have been
* filtered out, and should not be filtered out,
* as those lengths are not necessarily invalid.
*
* For now, we clip the reported length at G_MAXINT
*
* (XXX, is this still a problem?) There was an exception when we call
* tvb_new_real_data() now there's no one
*/
tvb->real_data = buf;
tvb->length = fd->cap_len;
tvb->reported_length = fd->pkt_len > G_MAXINT ? G_MAXINT : fd->pkt_len;
tvb->contained_length = tvb->reported_length;
tvb->initialized = TRUE;
/*
* This is the top-level real tvbuff for this data source,
* so its data source tvbuff is itself.
*/
tvb->ds_tvb = tvb;
frame_tvb = (struct tvb_frame *) tvb;
/* XXX, wtap_can_seek() */
if (prov->wth && prov->wth->random_fh) {
frame_tvb->prov = prov;
frame_tvb->file_off = fd->file_off;
frame_tvb->offset = 0;
} else
frame_tvb->prov = NULL;
frame_tvb->buf = NULL;
return tvb;
}
tvbuff_t *
frame_tvbuff_new_buffer(const struct packet_provider_data *prov,
const frame_data *fd, Buffer *buf)
{
return frame_tvbuff_new(prov, fd, ws_buffer_start_ptr(buf));
}
static tvbuff_t *
frame_clone(tvbuff_t *tvb, guint abs_offset, guint abs_length)
{
struct tvb_frame *frame_tvb = (struct tvb_frame *) tvb;
tvbuff_t *cloned_tvb;
struct tvb_frame *cloned_frame_tvb;
/* file not seekable */
if (!frame_tvb->prov)
return NULL;
abs_offset += frame_tvb->offset;
cloned_tvb = tvb_new(&tvb_frame_ops);
/* data will be read when needed */
cloned_tvb->real_data = NULL;
cloned_tvb->length = abs_length;
cloned_tvb->reported_length = abs_length; /* XXX? */
cloned_tvb->contained_length = cloned_tvb->reported_length;
cloned_tvb->initialized = TRUE;
/*
* This is the top-level real tvbuff for this data source,
* so its data source tvbuff is itself.
*/
cloned_tvb->ds_tvb = cloned_tvb;
cloned_frame_tvb = (struct tvb_frame *) cloned_tvb;
cloned_frame_tvb->prov = frame_tvb->prov;
cloned_frame_tvb->file_off = frame_tvb->file_off;
cloned_frame_tvb->offset = abs_offset;
cloned_frame_tvb->buf = NULL;
return cloned_tvb;
}
/* based on tvb_new_real_data() */
tvbuff_t *
file_tvbuff_new(const struct packet_provider_data *prov, const frame_data *fd,
const guint8 *buf)
{
struct tvb_frame *frame_tvb;
tvbuff_t *tvb;
tvb = tvb_new(&tvb_frame_ops);
/*
* XXX - currently, the length arguments in
* tvbuff structure are signed, but the captured
* and reported length values are unsigned; this means
* that length values > 2^31 - 1 will appear as
* negative lengths
*
* Captured length values that large will already
* have been filtered out by the Wiretap modules
* (the file will be reported as corrupted), to
* avoid trying to allocate large chunks of data.
*
* Reported length values will not have been
* filtered out, and should not be filtered out,
* as those lengths are not necessarily invalid.
*
* For now, we clip the reported length at G_MAXINT
*
* (XXX, is this still a problem?) There was an exception when we call
* tvb_new_real_data() now there's no one
*/
tvb->real_data = buf;
tvb->length = fd->cap_len;
tvb->reported_length = fd->pkt_len > G_MAXINT ? G_MAXINT : fd->pkt_len;
tvb->contained_length = tvb->reported_length;
tvb->initialized = TRUE;
/*
* This is the top-level real tvbuff for this data source,
* so its data source tvbuff is itself.
*/
tvb->ds_tvb = tvb;
frame_tvb = (struct tvb_frame *) tvb;
/* XXX, wtap_can_seek() */
if (prov->wth && prov->wth->random_fh) {
frame_tvb->prov = prov;
frame_tvb->file_off = fd->file_off;
frame_tvb->offset = 0;
} else
frame_tvb->prov = NULL;
frame_tvb->buf = NULL;
return tvb;
}
tvbuff_t *
file_tvbuff_new_buffer(const struct packet_provider_data *prov,
const frame_data *fd, Buffer *buf)
{
return frame_tvbuff_new(prov, fd, ws_buffer_start_ptr(buf));
}
|