TFShark (Terminal Fileshark) v.001. Bug 9607 (https://bugs.wireshark.org/bugzilla...
authorMichael Mann <mmann78@netscape.net>
Wed, 8 Jan 2014 04:35:28 +0000 (04:35 -0000)
committerMichael Mann <mmann78@netscape.net>
Wed, 8 Jan 2014 04:35:28 +0000 (04:35 -0000)
This is a VERY PRELIMINARY version of tfshark.  It's an attempt to jumpstart FileShark and its architecture.  Right now it's mostly just a very stripped down version of tshark with all of the necessary build modifications (including now building filetap library since tfshark depends on it)

This code has helped me identify what I believe to be all of the necessary layers for a complete fileshark architecture.  And those layers will slowly be added in time (patches always welcome!).

svn path=/trunk/; revision=54646

22 files changed:
CMakeLists.txt
CMakeOptions.txt
Makefile.am
Makefile.common
Makefile.nmake
config.nmake
configure.ac
epan/dissectors/file-elf.c
epan/dissectors/packet-ndmp.c
epan/epan.c
epan/epan.h
epan/packet.c
epan/packet.h
filetap/file_access.c
frame_tvbuff.c
frame_tvbuff.h
image/Makefile.nmake
image/README.image
image/tfshark.rc.in [new file with mode: 0644]
make-version.pl
tfshark.c [new file with mode: 0644]
wiretap/file_wrappers.h

index c735af19382416a82fa0e30a79b729c2a7526c5a..5c4938886e6ddae2a73f44d549f2f7374d76a23c 100644 (file)
@@ -818,7 +818,6 @@ set(SHARK_COMMON_CAPTURE_SRC
 set(WIRESHARK_COMMON_SRC
        ${PLATFORM_CAPTURE_SRC}
        capture-pcap-util.c
-       cfile.c
        cfutils.c
        clopts_common.c
        frame_tvbuff.c
@@ -944,6 +943,7 @@ if( (BUILD_wireshark AND GTK_FOUND) OR (BUILD_qtshark AND QT_FOUND) )
                proto_hier_stats.c
                summary.c
                ws80211_utils.c
+               cfile.c
                ${SHARK_COMMON_CAPTURE_SRC}
                ${WIRESHARK_COMMON_SRC}
                ${PLATFORM_UI_SRC}
@@ -1016,6 +1016,7 @@ if(BUILD_tshark)
                capture_sync.c
                tshark-tap-register.c
                tshark.c
+               cfile.c
                ${TSHARK_TAP_SRC}
                ${SHARK_COMMON_CAPTURE_SRC}
                ${WIRESHARK_COMMON_SRC}
@@ -1028,6 +1029,28 @@ if(BUILD_tshark)
        install(TARGETS tshark RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
 endif()
 
+if(BUILD_tfshark)
+       set(tfshark_LIBS
+               ui
+               ${LIBEPAN_LIBS}
+               ${APPLE_CORE_FOUNDATION_LIBRARY}
+               ${APPLE_SYSTEM_CONFIGURATION_LIBRARY}
+       )
+       set(tfshark_FILES
+               tfshark.c
+#              tfshark-tap-register.c
+               ${TSHARK_TAP_SRC}
+               ${SHARK_COMMON_CAPTURE_SRC}
+               ${WIRESHARK_COMMON_SRC}
+       )
+       add_executable(tfshark ${tfshark_FILES})
+       add_dependencies(tfshark svnversion)
+       set_target_properties(tfshark PROPERTIES LINK_FLAGS "${WS_LINK_FLAGS}")
+       set_target_properties(tfshark PROPERTIES FOLDER "Executables")
+       target_link_libraries(tfshark ${tfshark_LIBS})
+       install(TARGETS tfshark RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+endif()
+
 if(BUILD_rawshark AND PCAP_FOUND)
        set(rawshark_LIBS
                ${LIBEPAN_LIBS}
@@ -1035,6 +1058,7 @@ if(BUILD_rawshark AND PCAP_FOUND)
                ${APPLE_SYSTEM_CONFIGURATION_LIBRARY}
        )
        set(rawshark_FILES
+               cfile.c
                ${WIRESHARK_COMMON_SRC}
                rawshark.c
                ui/util.c
index 4579ab9f63a566f0242ec63fc8077e09a49ba6d2..e1ddb9302a4d53ce6a93f279e0537a200c5241c2 100644 (file)
@@ -5,6 +5,7 @@
 option(BUILD_wireshark   "Build the GTK+-GUI version of Wireshark" ON)
 option(BUILD_qtshark     "Build the Qt-GUI version of Wireshark" ON)
 option(BUILD_tshark      "Build tshark" ON)
+option(BUILD_tfshark     "Build tfshark" ON)
 option(BUILD_rawshark    "Build rawshark" ON)
 option(BUILD_dumpcap     "Build dumpcap" ON)
 option(BUILD_text2pcap   "Build text2pcap" ON)
index c86f4637bf4cceb9261cd3202ad5df2872a5305a..48d63d96259beddd1f74a14ea33bb0ac4143dd0c 100644 (file)
@@ -38,6 +38,7 @@ endif
 bin_PROGRAMS = \
        @wireshark_bin@         \
        @tshark_bin@            \
+       @tfshark_bin@           \
        @text2pcap_bin@         \
        @mergecap_bin@          \
        @capinfos_bin@          \
@@ -50,7 +51,7 @@ bin_PROGRAMS = \
        @rawshark_bin@          \
        @echld_test_bin@
 
-EXTRA_PROGRAMS = wireshark wireshark-qt tshark capinfos captype editcap \
+EXTRA_PROGRAMS = wireshark wireshark-qt tshark tfshark capinfos captype editcap \
        mergecap dftest randpkt text2pcap dumpcap reordercap rawshark \
        wireshark_cxx echld_test
 
@@ -361,6 +362,7 @@ wireshark_ldadd = \
        ui/libui.a                      \
        ui/libui_dirty.a                \
        codecs/libcodec.a               \
+       filetap/libfiletap.la           \
        wiretap/libwiretap.la           \
        epan/libwireshark.la            \
        wsutil/libwsutil.la             \
@@ -447,6 +449,33 @@ tshark_LDADD = \
        @LIBSMI_LDFLAGS@
 tshark_CFLAGS = $(AM_CLEAN_CFLAGS) $(py_dissectors_dir)
 
+if ENABLE_STATIC
+tfshark_LDFLAGS = -Wl,-static -all-static
+else
+tfshark_LDFLAGS = -export-dynamic
+endif
+
+# Libraries and plugin flags with which to link tfshark.
+tfshark_LDADD = \
+       ui/cli/libcliui.a               \
+       ui/libui.a                      \
+       filetap/libfiletap.la           \
+       epan/libwireshark.la            \
+       wsutil/libwsutil.la             \
+       @SSL_LIBS@                      \
+       $(plugin_ldadd)                 \
+       @GLIB_LIBS@ -lm                 \
+       @PCAP_LIBS@                     \
+       @SOCKET_LIBS@                   \
+       @NSL_LIBS@                      \
+       @KRB5_LIBS@                     \
+       @SYSTEMCONFIGURATION_FRAMEWORKS@        \
+       @COREFOUNDATION_FRAMEWORKS@     \
+       @PY_LIBS@                       \
+       @LIBGNUTLS_LIBS@                \
+       @LIBSMI_LDFLAGS@
+tfshark_CFLAGS = $(AM_CLEAN_CFLAGS) $(py_dissectors_dir)
+
 if ENABLE_STATIC
 rawshark_LDFLAGS = -Wl,-static -all-static
 else
@@ -722,6 +751,7 @@ EXTRA_DIST = \
        dumpcap.c       \
        editcap.c               \
        epan/print.ps           \
+       filetap/CMakeLists.txt  \
        fix/FIX.xml             \
        fix/FIX40.xml           \
        fix/FIX41.xml           \
@@ -802,6 +832,7 @@ EXTRA_DIST = \
        image/expert_note.png   \
        image/expert_warn.png   \
        image/file_dlg_win32.rc \
+       image/filetap.rc.in     \
        image/hi16-app-wireshark.png    \
        image/hi32-app-wireshark.png    \
        image/hi48-app-wireshark.png    \
@@ -1037,12 +1068,12 @@ endif
 endif
 
 
-DIST_SUBDIRS = asn1 codecs doc epan echld ui ui/cli ui/gtk ui/qt help packaging plugins tools wiretap wsutil docbook
+DIST_SUBDIRS = asn1 codecs doc epan echld filetap ui ui/cli ui/gtk ui/qt help packaging plugins tools wiretap wsutil docbook
 
 if HAVE_PLUGINS
-SUBDIRS = tools wsutil wiretap epan @echld_dir@ plugins packaging help ui @wireshark_SUBDIRS@ ui/cli . doc
+SUBDIRS = tools wsutil wiretap filetap epan @echld_dir@ plugins packaging help ui @wireshark_SUBDIRS@ ui/cli . doc
 else
-SUBDIRS = tools wsutil wiretap epan @echld_dir@ packaging help ui @wireshark_SUBDIRS@ ui/cli . doc
+SUBDIRS = tools wsutil wiretap filetap epan @echld_dir@ packaging help ui @wireshark_SUBDIRS@ ui/cli . doc
 endif
 
 help/faq.txt: $(srcdir)/help/faq.py
@@ -1177,6 +1208,7 @@ clean-local:
        rm -rf $(top_stagedir)
 
 dumpabi:
+       $(MAKE) -C filetap dumpabi-libfiletap
        $(MAKE) -C wiretap dumpabi-libwiretap
        $(MAKE) -C epan dumpabi-libwireshark
        $(MAKE) -C wsutil dumpabi-libwsutil
@@ -1189,6 +1221,7 @@ checkapi_local:
 
 checkapi: checkapi_local
        cd wiretap && $(MAKE) checkapi
+       cd filetap && $(MAKE) checkapi
        cd codecs && $(MAKE) checkapi
        cd ui && $(MAKE) checkapi
        cd ui/gtk && $(MAKE) checkapi
index fe6e2f456df7b3b9d3ddf5ec9612259fb953c168..b6706c04d7866538c005f2b98daaaa5c8b030491 100644 (file)
@@ -45,7 +45,6 @@ GENERATED_FILES = $(GENERATED_C_FILES) $(GENERATED_HEADER_FILES)
 SHARK_COMMON_SRC =     \
        $(PLATFORM_SRC)         \
        capture-pcap-util.c     \
-       cfile.c                 \
        cfutils.c               \
        clopts_common.c         \
        frame_tvbuff.c          \
@@ -91,6 +90,7 @@ WIRESHARK_COMMON_SRC =        \
        capture.c       \
        capture_info.c  \
        capture_opts.c  \
+       cfile.c                 \
        color_filters.c \
        file.c          \
        fileset.c       \
@@ -122,12 +122,20 @@ WIRESHARK_COMMON_INCLUDES =       \
 tshark_SOURCES =       \
        $(SHARK_COMMON_SRC)     \
        $(SHARK_COMMON_CAPTURE_SRC) \
+       cfile.c                 \
        capture_opts.c          \
        tshark.c
 
+# tfshark specifics
+tfshark_SOURCES =      \
+       $(SHARK_COMMON_SRC)     \
+       cfile.c                 \
+       tfshark.c
+
 # rawshark specifics
 rawshark_SOURCES =     \
        $(SHARK_COMMON_SRC)     \
+       cfile.c                 \
        rawshark.c
 
 # text2pcap specifics
index cdf4038b3c4ab85364fafc9b9b92a3f6eeedf9ca..859f9c53d03ad2b3d9d39d3c7f6dc1f0dca0ab38 100644 (file)
@@ -57,6 +57,7 @@ include Makefile.common
 
 wireshark_OBJECTS = $(WIRESHARK_COMMON_SRC:.c=.obj)
 tshark_OBJECTS = $(tshark_SOURCES:.c=.obj)
+tfshark_OBJECTS = $(tfshark_SOURCES:.c=.obj)
 rawshark_OBJECTS = $(rawshark_SOURCES:.c=.obj)
 ###text2pcap_OBJECTS = $(text2pcap_SOURCES:.c=.obj)
 mergecap_OBJECTS = $(mergecap_SOURCES:.c=.obj)
@@ -112,6 +113,24 @@ tshark_LIBS= wiretap\wiretap-$(WTAP_VERSION).lib \
        $(ZLIB_LIBS)
 !ENDIF
 
+tfshark_LIBS= filetap\filetap-$(FTAP_VERSION).lib \
+       wiretap\wiretap-$(WTAP_VERSION).lib \
+       wsock32.lib user32.lib psapi.lib \
+       $(GLIB_LIBS) \
+       $(GTHREAD_LIBS) \
+       wsutil\libwsutil.lib \
+       $(GNUTLS_LIBS) \
+       $(PYTHON_LIBS) \
+!IFDEF ENABLE_LIBWIRESHARK
+       epan\libwireshark.lib \
+!ELSE
+       epan\dissectors\dissectors.lib \
+       epan\wireshark.lib \
+       epan\dfilter\dfilter.lib \
+       epan\ftypes\ftypes.lib \
+       epan\wmem\wmem.lib
+!ENDIF
+
 rawshark_LIBS= wiretap\wiretap-$(WTAP_VERSION).lib \
        wsock32.lib user32.lib psapi.lib \
        $(GLIB_LIBS) \
@@ -190,7 +209,7 @@ randpkt_LIBS= wiretap\wiretap-$(WTAP_VERSION).lib \
        wsutil\libwsutil.lib \
        $(GLIB_LIBS)
 
-EXECUTABLES=wireshark.exe tshark.exe rawshark.exe \
+EXECUTABLES=wireshark.exe tshark.exe tfshark.exe rawshark.exe \
        capinfos.exe captype.exe editcap.exe mergecap.exe text2pcap.exe \
        randpkt.exe reordercap.exe dumpcap.exe dftest.exe
 
@@ -199,13 +218,13 @@ EXECUTABLES=$(EXECUTABLES) qtshark.exe
 !ENDIF
 
 RESOURCES=image\wireshark.res image\file_dlg_win32.res \
-       image\libwireshark.res image\tshark.res image\capinfos.res \
+       image\libwireshark.res image\tshark.res image\tfshark.res image\capinfos.res \
        image\captype.res image\editcap.res image\mergecap.res \
-       image\text2pcap.res image\wiretap.res image\dumpcap.res \
+       image\text2pcap.res image\wiretap.res image\filetap.res image\dumpcap.res \
        image\rawshark.res image\reordercap.res image\libwsutil.res
 
 
-all: $(LIBS_CHECK) config.h ui\qt\config.pri tools image codecs $(C_ARES_DLL) $(ADNS_DLL) $(ZLIB_DLL) wsutil wiretap epan $(EXECUTABLES) wireshark.bsc $(RESOURCES) help install-all
+all: $(LIBS_CHECK) config.h ui\qt\config.pri tools image codecs $(C_ARES_DLL) $(ADNS_DLL) $(ZLIB_DLL) wsutil wiretap filetap epan $(EXECUTABLES) wireshark.bsc $(RESOURCES) help install-all
 
 !IFDEF MAKENSIS
 packaging: all
@@ -257,6 +276,7 @@ wireshark.bsc: \
        epan\dissectors\*.sbr           \
        epan\ftypes\*.sbr               \
        epan\wslua\*.sbr                \
+       filetap\*.sbr                   \
        plugins\asn1\*.sbr              \
        plugins\docsis\*.sbr            \
        plugins\ethercat\*.sbr          \
@@ -295,6 +315,7 @@ $(RESOURCES): image
 ## Note: The proper "SUBSYSTEM" link option to be used for linking each of the Wireshark executables
 ##       is specified in '$(guiflags)' or '$(conflags)' as used as part of the link options.
 ##       (These variables are defined in win32.mak).
+filetap\filetap-$(FTAP_VERSION).lib: image $(ZLIB_DLL) filetap
 wiretap\wiretap-$(WTAP_VERSION).lib: image $(ZLIB_DLL) wiretap
 
 wireshark.exe  : $(LIBS_CHECK) config.h $(wireshark_OBJECTS) codecs epan ui gtk win32 image\wireshark.res image\file_dlg_win32.res wsutil\libwsutil.lib wiretap\wiretap-$(WTAP_VERSION).lib codecs\codecs.lib ui\libui.lib ui\gtk\libgtkui.lib ui\win32\libgtkui_win32.lib plugins
@@ -317,6 +338,15 @@ tshark.exe : $(LIBS_CHECK) config.h $(tshark_OBJECTS) epan ui cli image\tshark.r
        mt.exe -nologo -manifest "tshark.exe.manifest" -outputresource:tshark.exe;1
 !ENDIF
 
+tfshark.exe    : $(LIBS_CHECK) config.h $(tfshark_OBJECTS) epan ui cli image\tfshark.res wsutil\libwsutil.lib filetap\filetap-$(FTAP_VERSION).lib plugins
+       @echo Linking $@
+       $(LINK) @<<
+               /OUT:tfshark.exe $(conflags) $(conlibsdll) $(LDFLAGS) /LARGEADDRESSAWARE $(tfshark_LIBS) $(tfshark_OBJECTS) ui\cli\libcliui.lib ui\libui.lib image\tfshark.res
+<<
+!IFDEF MANIFEST_INFO_REQUIRED
+       mt.exe -nologo -manifest "tfshark.exe.manifest" -outputresource:tfshark.exe;1
+!ENDIF
+
 rawshark.exe   : $(LIBS_CHECK) config.h $(rawshark_OBJECTS) epan ui image\rawshark.res wsutil\libwsutil.lib wiretap\wiretap-$(WTAP_VERSION).lib plugins
        @echo Linking $@
        $(LINK) @<<
@@ -530,7 +560,7 @@ text2pcap.obj mergecap.obj capinfos.obj captype.obj editcap.obj reordercap.obj v
 
 
 clean-local:
-       rm -f $(wireshark_OBJECTS) $(tshark_OBJECTS) $(dumpcap_OBJECTS) $(rawshark_OBJECTS) \
+       rm -f $(wireshark_OBJECTS) $(tshark_OBJECTS) $(tfshark_OBJECTS) $(dumpcap_OBJECTS) $(rawshark_OBJECTS) \
                $(EXECUTABLES) *.pdb *.sbr *.exe.manifest \
                capinfos.obj capinfos.exp capinfos.lib \
                captype.obj captype.exp captype.lib \
@@ -554,6 +584,8 @@ clean: clean-local
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake clean
        cd ../wsutil
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake clean
+       cd ../filetap
+       $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake clean
        cd ../codecs
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake clean
        cd ../ui
@@ -604,6 +636,8 @@ distclean-local: clean-local
 distclean: distclean-local
        cd wiretap
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake distclean
+       cd ../filetap
+       $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake distclean
        cd ../wsutil
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake distclean
        cd ../codecs
@@ -649,6 +683,8 @@ maintainer-clean-local: distclean-local
 maintainer-clean: maintainer-clean-local
        cd wiretap
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake maintainer-clean
+       cd ../filetap
+       $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake maintainer-clean
        cd ../wsutil
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake maintainer-clean
        cd ../codecs
@@ -759,6 +795,11 @@ wiretap::
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake
        cd ..
 
+filetap::
+       cd filetap
+       $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake
+       cd ..
+
 codecs::
        cd codecs
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake
@@ -799,7 +840,7 @@ cli:: help config.h svnversion.h doxygen
        $(MAKE) /$(MAKEFLAGS) /f Makefile.nmake libcliui.lib
        cd ../..
 
-epan:: $(RESOURCES) $(ZLIB_DLL) wiretap\wiretap-$(WTAP_VERSION).lib $(BUILT_SOURCES) doxygen
+epan:: $(RESOURCES) $(ZLIB_DLL) wiretap\wiretap-$(WTAP_VERSION).lib filetap\filetap-$(FTAP_VERSION).lib $(BUILT_SOURCES) doxygen
        cd epan
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake
        cd ..
@@ -1080,6 +1121,9 @@ debug-wireshark: wireshark.exe install-generated-files
 # prepare debugging of tshark in INSTALL_DIR
 debug-tshark: tshark.exe install-generated-files
 
+# prepare debugging of tfshark in INSTALL_DIR
+debug-tfshark: tfshark.exe install-generated-files
+
 # prepare debugging of rawshark in INSTALL_DIR
 debug-rawshark: rawshark.exe install-generated-files
 
@@ -1102,6 +1146,9 @@ install-generated-files: doc
        xcopy ".\wiretap\wiretap-$(WTAP_VERSION).dll" $(INSTALL_DIR) /d
        if exist ".\wiretap\wiretap-$(WTAP_VERSION).lib" xcopy ".\wiretap\wiretap-$(WTAP_VERSION).lib" $(INSTALL_DIR) /d
        if exist ".\wiretap\wiretap-$(WTAP_VERSION).pdb" xcopy ".\wiretap\wiretap-$(WTAP_VERSION).pdb" $(INSTALL_DIR) /d
+       xcopy ".\filetap\filetap-$(FTAP_VERSION).dll" $(INSTALL_DIR) /d
+       if exist ".\filetap\filetap-$(FTAP_VERSION).lib" xcopy ".\filetap\filetap-$(FTAP_VERSION).lib" $(INSTALL_DIR) /d
+       if exist ".\filetap\filetap-$(FTAP_VERSION).pdb" xcopy ".\filetap\filetap-$(FTAP_VERSION).pdb" $(INSTALL_DIR) /d
        xcopy ".\wsutil\libwsutil.dll" $(INSTALL_DIR) /d
        if exist ".\wsutil\libwsutil.lib" xcopy ".\wsutil\libwsutil.lib" $(INSTALL_DIR) /d
        if exist ".\wsutil\libwsutil.pdb" xcopy ".\wsutil\libwsutil.pdb" $(INSTALL_DIR) /d
@@ -1125,6 +1172,8 @@ install-generated-files: doc
        if exist rawshark.pdb xcopy rawshark.pdb $(INSTALL_DIR) /d
        if exist text2pcap.exe xcopy text2pcap.exe $(INSTALL_DIR) /d
        if exist text2pcap.pdb xcopy text2pcap.pdb $(INSTALL_DIR) /d
+       if exist tfshark.exe xcopy tfshark.exe $(INSTALL_DIR) /d
+       if exist tfshark.pdb xcopy tfshark.pdb $(INSTALL_DIR) /d
        if exist tshark.exe xcopy tshark.exe $(INSTALL_DIR) /d
        if exist tshark.pdb xcopy tshark.pdb $(INSTALL_DIR) /d
        xcopy "doc\AUTHORS-SHORT" $(INSTALL_DIR) /d
@@ -1333,6 +1382,7 @@ install-all: install-generated-files
 
 checkapi_local:
        $(PERL) tools/checkAPIs.pl -build \
+       cfile.c
        $(WIRESHARK_COMMON_SRC) \
        $(TSHARK_TAP_SRC) \
 #      $(EXTRA_wireshark_SOURCES)
@@ -1340,6 +1390,8 @@ checkapi_local:
 checkapi: checkapi_local
        cd wiretap
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake checkapi
+       cd ../filetap
+       $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake checkapi
        cd ../codecs
        $(MAKE) /$(MAKEFLAGS) -f Makefile.nmake checkapi
        cd ../ui
index 1da132b1d9390e8552abdeaf015a80c701514b41..aa2097ae1c027a987705965bd265893f129c627b 100644 (file)
@@ -42,6 +42,11 @@ WTAP_VERSION_MAJOR=$(VERSION_MAJOR)
 WTAP_VERSION_MINOR=$(VERSION_MINOR)
 WTAP_VERSION_MICRO=0
 
+# The version of the filetap library. Recommended: Leave unchanged.
+FTAP_VERSION_MAJOR=$(VERSION_MAJOR)
+FTAP_VERSION_MINOR=$(VERSION_MINOR)
+FTAP_VERSION_MICRO=0
+
 ##### Directories #####
 
 #
@@ -1286,6 +1291,8 @@ PRODUCT_VERSION=$(VERSION_MAJOR).$(VERSION_MINOR).$(VERSION_MICRO).$(VERSION_BUI
 
 WTAP_VERSION=$(WTAP_VERSION_MAJOR).$(WTAP_VERSION_MINOR).$(WTAP_VERSION_MICRO)
 RC_WTAP_VERSION=$(WTAP_VERSION_MAJOR),$(WTAP_VERSION_MINOR),$(WTAP_VERSION_MICRO)
+FTAP_VERSION=$(FTAP_VERSION_MAJOR).$(FTAP_VERSION_MINOR).$(FTAP_VERSION_MICRO)
+RC_FTAP_VERSION=$(FTAP_VERSION_MAJOR),$(FTAP_VERSION_MINOR),$(FTAP_VERSION_MICRO)
 
 # GLib
 GLIB_CFLAGS=/I$(GTK_DIR)\include\glib-$(GLIB_VERSION) \
index 28ff47097f24abcc8e551dae57ac5631b3d67130..7767ce96b67730301a416d180f056c31091d1ed3 100644 (file)
@@ -2860,6 +2860,7 @@ AC_OUTPUT(
   epan/wmem/Makefile
   epan/wslua/Makefile
   epan/wspython/Makefile
+  filetap/Makefile
   codecs/Makefile
   ui/Makefile
   ui/doxygen.cfg
index e8d4e7dc3fd586bffe6cca14024f3a767fbb14eb..0b169136a571e322a06a852e95671aef24bcd593 100644 (file)
@@ -2435,6 +2435,9 @@ proto_reg_handoff_elf(void)
     dissector_add_string("media_type", "application/x-object", elf_handle);
     dissector_add_string("media_type", "application/x-sharedlib", elf_handle);
 
+    /* XXX - TEMPORARY HACK */
+    dissector_add_uint("ftap_encap", 1234, elf_handle);
+
     heur_dissector_add("wtap_file", dissect_elf_heur, proto_elf);
 }
 
index 3eb5d2224b5e16b0558bfffb831c248c821f3be3..7a0a45e9ee43e54a2cf99540f7871aebb3b88e25 100644 (file)
@@ -2547,7 +2547,7 @@ dissect_file_stats(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *pa
 
 
 static int
-dissect_file(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, void* data _U_)
+dissect_ndmp_file(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, void* data _U_)
 {
        proto_item* item = NULL;
        proto_tree* tree = NULL;
@@ -2585,7 +2585,7 @@ dissect_fh_add_file_request(tvbuff_t *tvb, int offset, packet_info *pinfo,
 {
        /* files */
        offset = dissect_rpc_array(tvb, pinfo, tree, offset,
-                       dissect_file, hf_ndmp_files);
+                       dissect_ndmp_file, hf_ndmp_files);
 
        return offset;
 }
index 71191ecef23104038c27b501a65ef90ae10cdb46..2a9533fc8942deda3543a5c577ca165b6ada9bb5 100644 (file)
@@ -334,6 +334,35 @@ epan_dissect_run_with_taps(epan_dissect_t *edt, struct wtap_pkthdr *phdr,
        wmem_leave_packet_scope();
 }
 
+void
+epan_dissect_file_run(epan_dissect_t *edt, struct wtap_pkthdr *phdr,
+        tvbuff_t *tvb, frame_data *fd, column_info *cinfo)
+{
+#ifdef HAVE_LUA
+       wslua_prime_dfilter(edt); /* done before entering wmem scope */
+#endif
+       wmem_enter_packet_scope();
+       dissect_file(edt, phdr, tvb, fd, cinfo);
+
+       /* free all memory allocated */
+       ep_free_all();
+       wmem_leave_packet_scope();
+}
+
+void
+epan_dissect_file_run_with_taps(epan_dissect_t *edt, struct wtap_pkthdr *phdr,
+        tvbuff_t *tvb, frame_data *fd, column_info *cinfo)
+{
+       wmem_enter_packet_scope();
+       tap_queue_init(edt);
+       dissect_file(edt, phdr, tvb, fd, cinfo);
+       tap_push_tapped_queue(edt);
+
+       /* free all memory allocated */
+       ep_free_all();
+       wmem_leave_packet_scope();
+}
+
 void
 epan_dissect_cleanup(epan_dissect_t* edt)
 {
index 093f7f856206ac5b9197b2b29bb5bee974762490..5a9dbda019942f2f5c728b14e8b35e16f73f455a 100644 (file)
@@ -177,6 +177,17 @@ void
 epan_dissect_run_with_taps(epan_dissect_t *edt, struct wtap_pkthdr *phdr,
         tvbuff_t *tvb, frame_data *fd, struct epan_column_info *cinfo);
 
+/** run a single file packet dissection */
+WS_DLL_PUBLIC
+void
+epan_dissect_file_run(epan_dissect_t *edt, struct wtap_pkthdr *phdr,
+        tvbuff_t *tvb, frame_data *fd, struct epan_column_info *cinfo);
+
+WS_DLL_PUBLIC
+void
+epan_dissect_file_run_with_taps(epan_dissect_t *edt, struct wtap_pkthdr *phdr,
+        tvbuff_t *tvb, frame_data *fd, struct epan_column_info *cinfo);
+
 /** Prime a proto_tree using the fields/protocols used in a dfilter. */
 WS_DLL_PUBLIC
 void
index f3f29a8b9e7a24c07d0c329230aa76e9141eb45a..b3a5cc13daf1f23e6675267b4f97e75f4b4d0bf7 100644 (file)
@@ -60,6 +60,7 @@
 
 static gint proto_malformed = -1;
 static dissector_handle_t frame_handle = NULL;
+static dissector_handle_t file_handle = NULL;
 static dissector_handle_t data_handle = NULL;
 
 /**
@@ -154,6 +155,9 @@ packet_cache_proto_handles(void)
        frame_handle = find_dissector("frame");
        g_assert(frame_handle != NULL);
 
+       file_handle = find_dissector("file");
+       g_assert(file_handle != NULL);
+
        data_handle = find_dissector("data");
        g_assert(data_handle != NULL);
 
@@ -465,6 +469,71 @@ dissect_packet(epan_dissect_t *edt, struct wtap_pkthdr *phdr,
        fd->flags.visited = 1;
 }
 
+/* Creates the top-most tvbuff and calls dissect_file() */
+void
+dissect_file(epan_dissect_t *edt, struct wtap_pkthdr *phdr,
+              tvbuff_t *tvb, frame_data *fd, column_info *cinfo)
+{
+       if (cinfo != NULL)
+               col_init(cinfo, edt->session);
+       edt->pi.epan = edt->session;
+       /* edt->pi.pool created in epan_dissect_init() */
+       edt->pi.current_proto = "<Missing Filetype Name>";
+       edt->pi.cinfo = cinfo;
+       edt->pi.fd    = fd;
+       edt->pi.phdr  = phdr;
+       edt->pi.pseudo_header = &phdr->pseudo_header;
+       edt->pi.dl_src.type   = AT_NONE;
+       edt->pi.dl_dst.type   = AT_NONE;
+       edt->pi.net_src.type  = AT_NONE;
+       edt->pi.net_dst.type  = AT_NONE;
+       edt->pi.src.type = AT_NONE;
+       edt->pi.dst.type = AT_NONE;
+       edt->pi.ctype = CT_NONE;
+       edt->pi.noreassembly_reason = "";
+       edt->pi.ptype = PT_NONE;
+       edt->pi.p2p_dir = P2P_DIR_UNKNOWN;
+       edt->pi.annex_a_used = MTP2_ANNEX_A_USED_UNKNOWN;
+       edt->pi.link_dir = LINK_DIR_UNKNOWN;
+       edt->pi.layers = wmem_list_new(edt->pi.pool);
+       edt->tvb = tvb;
+
+
+       frame_delta_abs_time(edt->session, fd, fd->frame_ref_num, &edt->pi.rel_ts);
+
+       /* pkt comment use first user, later from phdr */
+       if (fd->flags.has_user_comment) 
+               edt->pi.pkt_comment = epan_get_user_comment(edt->session, fd);
+       else if (fd->flags.has_phdr_comment)
+               edt->pi.pkt_comment = phdr->opt_comment;
+
+       EP_CHECK_CANARY(("before dissecting file %d",fd->num));
+
+       TRY {
+               /* Add this tvbuffer into the data_src list */
+               add_new_data_source(&edt->pi, edt->tvb, "File");
+
+               /* Even though dissect_file() catches all the exceptions a
+                * sub-dissector can throw, dissect_frame() itself may throw
+                * a ReportedBoundsError in bizarre cases. Thus, we catch the exception
+                * in this function. */
+               call_dissector(file_handle, edt->tvb, &edt->pi, edt->tree);
+
+       }
+       CATCH(BoundsError) {
+               g_assert_not_reached();
+       }
+       CATCH2(FragmentBoundsError, ReportedBoundsError) {
+               proto_tree_add_protocol_format(edt->tree, proto_malformed, edt->tvb, 0, 0,
+                                              "[Malformed Record: Packet Length]" );
+       }
+       ENDTRY;
+
+       EP_CHECK_CANARY(("after dissecting file %d",fd->num));
+
+       fd->flags.visited = 1;
+}
+
 /*********************** code added for sub-dissector lookup *********************/
 
 /*
index b18529a0786b075ebb4518aa3468353903249bde..af178b81e1d2b6ac298fce87112d0297cb906225 100644 (file)
@@ -541,6 +541,13 @@ extern void dissect_packet(struct epan_dissect *edt,
     struct wtap_pkthdr *phdr, tvbuff_t *tvb,
     frame_data *fd, column_info *cinfo);
 
+/*
+ * Dissectors should never modify the packet data.
+ */
+extern void dissect_file(struct epan_dissect *edt,
+    struct wtap_pkthdr *phdr, tvbuff_t *tvb,
+    frame_data *fd, column_info *cinfo);
+
 /* These functions are in packet-ethertype.c */
 extern void capture_ethertype(guint16 etype, const guchar *pd, int offset,
                int len, packet_counts *ld);
index 60b876725d0e52dbb2b25e6f54dd47539a7808f6..bb9389156242c9e96c21035d3a9571d16fbb4d16 100644 (file)
@@ -208,6 +208,11 @@ GSList *ftap_get_all_file_extensions_list(void)
        return extensions;
 }
 
+int empty_open(ftap *wth, int *err, gchar **err_info)
+{
+       return 0;
+}
+
 /* The open_file_* routines should return:
  *
  *     -1 on an I/O error;
@@ -232,7 +237,7 @@ GSList *ftap_get_all_file_extensions_list(void)
  * are easy to identify.  Only an open routine is needed.
  */
 static const ftap_open_routine_t magic_number_open_routines_base[] = {
-       NULL/* libpcap_open, */
+       empty_open/* libpcap_open, */
 };
 #define        N_MAGIC_FILE_TYPES      (sizeof magic_number_open_routines_base / sizeof magic_number_open_routines_base[0])
 
index acecd0945d88d42f19458e268ff244e41bff2667..7682f10d2a608161a1940dae92120f2c27cc9639 100644 (file)
@@ -270,3 +270,71 @@ frame_clone(tvbuff_t *tvb, guint abs_offset, guint abs_length)
 
        return cloned_tvb;
 }
+
+
+/* based on tvb_new_real_data() */
+tvbuff_t *
+file_tvbuff_new(const frame_data *fd, const guint8 *buf)
+{
+       struct tvb_frame *frame_tvb;
+       tvbuff_t *tvb;
+
+       tvb = tvb_new(&tvb_frame_ops);
+
+       /*
+        * XXX - currently, the length arguments in
+        * tvbuff structure are signed, but the captured
+        * and reported length values are unsigned; this means
+        * that length values > 2^31 - 1 will appear as
+        * negative lengths
+        *
+        * Captured length values that large will already
+        * have been filtered out by the Wiretap modules
+        * (the file will be reported as corrupted), to
+        * avoid trying to allocate large chunks of data.
+        *
+        * Reported length values will not have been
+        * filtered out, and should not be filtered out,
+        * as those lengths are not necessarily invalid.
+        *
+        * For now, we clip the reported length at G_MAXINT
+        *
+        * (XXX, is this still a problem?) There was an exception when we call
+        * tvb_new_real_data() now there's no one
+        */
+
+       tvb->real_data       = buf;
+       tvb->length          = fd->cap_len;
+       tvb->reported_length = fd->pkt_len > G_MAXINT ? G_MAXINT : fd->pkt_len;
+       tvb->initialized     = TRUE;
+
+       /*
+        * This is the top-level real tvbuff for this data source,
+        * so its data source tvbuff is itself.
+        */
+       tvb->ds_tvb = tvb;
+
+       frame_tvb = (struct tvb_frame *) tvb;
+
+       /* XXX, wtap_can_seek() */
+       if (cfile.wth && cfile.wth->random_fh 
+#ifdef WANT_PACKET_EDITOR
+               && fd->file_off != -1 /* generic clone for modified packets */
+#endif
+       ) {
+               frame_tvb->wth = cfile.wth;
+               frame_tvb->file_off = fd->file_off;
+               frame_tvb->offset = 0;
+       } else
+               frame_tvb->wth = NULL;
+
+       frame_tvb->buf = NULL;
+
+       return tvb;
+}
+
+tvbuff_t *
+file_tvbuff_new_buffer(const frame_data *fd, Buffer *buf)
+{
+       return frame_tvbuff_new(fd, buffer_start_ptr(buf));
+}
index be0cb489fe786701fa90de6a438d57bd2fef23b0..0e1352cf1c1122822f73ad6652a062588eb8bc2d 100644 (file)
@@ -35,6 +35,10 @@ extern tvbuff_t *frame_tvbuff_new(const frame_data *fd, const guint8 *buf);
 
 extern tvbuff_t *frame_tvbuff_new_buffer(const frame_data *fd, Buffer *buf);
 
+extern tvbuff_t *file_tvbuff_new(const frame_data *fd, const guint8 *buf);
+
+extern tvbuff_t *file_tvbuff_new_buffer(const frame_data *fd, Buffer *buf);
+
 #ifdef __cplusplus
 }
 #endif /* __cplusplus */
index 5bfb58f6d1b07b055a7afcacac51f15d961fc0e9..2be9aae123fbfc5d409912dc8821b0c86efd9cee 100644 (file)
@@ -6,7 +6,7 @@ include ..\config.nmake
 
 # Nmake uses an implicit rule to build a .res from a .rc file!
 
-ALL_RC=wireshark.rc libwireshark.rc tshark.rc rawshark.rc capinfos.rc captype.rc editcap.rc text2pcap.rc mergecap.rc reordercap.rc wiretap.rc dumpcap.rc libwsutil.rc wireshark.exe.manifest
+ALL_RC=wireshark.rc libwireshark.rc tshark.rc tfshark.rc rawshark.rc capinfos.rc captype.rc editcap.rc text2pcap.rc mergecap.rc reordercap.rc filetap.rc wiretap.rc dumpcap.rc libwsutil.rc wireshark.exe.manifest
 all : $(ALL_RC)
 
 wireshark.exe.manifest: wireshark.exe.manifest.in ..\config.nmake
@@ -31,6 +31,11 @@ tshark.rc  : tshark.rc.in wireshark.exe.manifest ..\config.nmake
                -e s/@RC_VERSION@/$(RC_VERSION)/ \
                < tshark.rc.in > $@
 
+tfshark.rc  : tfshark.rc.in wireshark.exe.manifest ..\config.nmake
+       sed -e s/@VERSION@/$(VERSION)/ \
+               -e s/@RC_VERSION@/$(RC_VERSION)/ \
+               < tfshark.rc.in > $@
+
 rawshark.rc  : rawshark.rc.in wireshark.exe.manifest ..\config.nmake
        sed -e s/@VERSION@/$(VERSION)/ \
                -e s/@RC_VERSION@/$(RC_VERSION)/ \
@@ -66,6 +71,11 @@ text2pcap.rc  : text2pcap.rc.in ..\config.nmake
                -e s/@RC_VERSION@/$(RC_VERSION)/ \
                < text2pcap.rc.in > $@
 
+filetap.rc    : filetap.rc.in ..\config.nmake
+       sed -e s/@VERSION@/$(FTAP_VERSION)/ \
+               -e s/@RC_VERSION@/$(RC_FTAP_VERSION)/ \
+               < filetap.rc.in > $@
+
 wiretap.rc    : wiretap.rc.in ..\config.nmake
        sed -e s/@VERSION@/$(WTAP_VERSION)/ \
                -e s/@RC_VERSION@/$(RC_WTAP_VERSION)/ \
index ecba744fd1f0e153b726b0ec1206e8a0bcb562ad..05e4470b0f747b34ee1ee130fa79a0ae0c81b74e 100644 (file)
@@ -43,6 +43,7 @@ editcap.rc.in
 mergecap.rc.in
 rawshark.rc.in
 tshark.rc.in
+tfshark.rc.in
 text2pcap.rc.in
 
 stock_dialog_error_48.xpm              GTK2 default icons for simple_dialog, from:
diff --git a/image/tfshark.rc.in b/image/tfshark.rc.in
new file mode 100644 (file)
index 0000000..7e0fb13
--- /dev/null
@@ -0,0 +1,41 @@
+#include "winver.h"
+
+WIRESHARK_ICON         ICON                    "wireshark.ico"
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION @RC_VERSION@
+ PRODUCTVERSION @RC_VERSION@
+ FILEFLAGSMASK 0x0L
+#ifdef _DEBUG
+ FILEFLAGS VS_FF_DEBUG
+#else
+ FILEFLAGS 0x0L
+#endif
+ FILEOS VOS_NT_WINDOWS32
+ FILETYPE VFT_APP
+ FILESUBTYPE 0x0L
+BEGIN
+    BLOCK "StringFileInfo"
+    BEGIN
+        BLOCK "040904b0"
+        BEGIN
+            VALUE "CompanyName", "The Wireshark developer community\0"
+            VALUE "FileDescription", "TFShark\0"
+            VALUE "FileVersion", "@VERSION@\0"
+            VALUE "InternalName", "TFShark @VERSION@\0"
+            VALUE "LegalCopyright", "Copyright © 2000 Gerald Combs <gerald@wireshark.org>, Gilbert Ramirez <gram@alumni.rice.edu> and others\0"
+            VALUE "OriginalFilename", "TFShark.exe\0"
+            VALUE "ProductName", "TFShark\0"
+            VALUE "ProductVersion", "@VERSION@\0"
+        END
+    END
+    BLOCK "VarFileInfo"
+    BEGIN
+        VALUE "Translation", 0x409, 1200
+    END
+END
+
+#define MANIFEST_RESOURCE_ID 1
+#define RT_MANIFEST 24
+
+MANIFEST_RESOURCE_ID RT_MANIFEST "wireshark.exe.manifest"
index 3593b626eda16118ab1c6202ec9ba9c4fd21a0e5..b3f6b55a26abdce688b2d4ada63989b15b811a95 100755 (executable)
@@ -442,7 +442,7 @@ sub update_debian_wcf
        while ($line = <DWCF>) {
                # /usr/lib/wireshark/libwireshark.so.1.1.0
 
-               if ($line =~ qr{^(/usr/lib/wireshark/lib(wireshark|wiretap).so\.\d+\.\d+\.)\d+$}) {
+               if ($line =~ qr{^(/usr/lib/wireshark/lib(wireshark|wiretap|filetap).so\.\d+\.\d+\.)\d+$}) {
                        $line = sprintf("$1%d\n", $version_pref{"version_micro"});
                }
                $contents .= $line
@@ -469,10 +469,10 @@ sub update_lib_releases
        #   "If the library source code has changed at all since the last
        #    update, then increment revision (‘c:r:a’ becomes ‘c:r+1:a’)."
        # epan changes with each minor release, almost by definition. wiretap
-       # changes with *most* releases.
+       # and filetap changes with *most* releases.
        #
        # http://www.gnu.org/software/libtool/manual/libtool.html#Updating-version-info
-       for $filedir ("epan", "wiretap") {      # "wsutil"
+       for $filedir ("epan", "wiretap", "filetap") {   # "wsutil"
                $contents = "";
                $filepath = $filedir . "/Makefile.am";
                open(MAKEFILE_AM, "< $filepath") || die "Can't read $filepath!";
diff --git a/tfshark.c b/tfshark.c
new file mode 100644 (file)
index 0000000..a6694af
--- /dev/null
+++ b/tfshark.c
@@ -0,0 +1,2794 @@
+/* tfshark.c
+ *
+ * Text-mode variant of Fileshark, based off of TShark,
+ *
+ * $Id$
+ *
+ * Wireshark - Network traffic analyzer
+ * By Gerald Combs <gerald@wireshark.org>
+ * Copyright 1998 Gerald Combs
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "config.h"
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <ctype.h>
+#include <locale.h>
+#include <limits.h>
+
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+
+#include <errno.h>
+
+#ifdef HAVE_FCNTL_H
+#include <fcntl.h>
+#endif
+
+#include <signal.h>
+
+#ifdef HAVE_SYS_STAT_H
+# include <sys/stat.h>
+#endif
+
+#ifndef HAVE_GETOPT
+#include "wsutil/wsgetopt.h"
+#endif
+
+#include <glib.h>
+
+#include <epan/exceptions.h>
+#include <epan/epan-int.h>
+#include <epan/epan.h>
+#include <wsutil/crash_info.h>
+#include <wsutil/privileges.h>
+#include <wsutil/file_util.h>
+#include <wsutil/filesystem.h>
+#include <wsutil/report_err.h>
+
+#include "globals.h"
+#include <epan/timestamp.h>
+#include <epan/packet.h>
+#ifdef HAVE_LUA
+#include <epan/wslua/init_wslua.h>
+#endif
+#include "file.h"
+#include "frame_tvbuff.h"
+#include <epan/disabled_protos.h>
+#include <epan/prefs.h>
+#include <epan/column.h>
+#include <epan/print.h>
+#include <epan/addr_resolv.h>
+#include "ui/util.h"
+#include "clopts_common.h"
+#include "cmdarg_err.h"
+#include "version_info.h"
+#include "register.h"
+#include <epan/epan_dissect.h>
+#include <epan/tap.h>
+#include <epan/stat_cmd_args.h>
+#include <epan/timestamp.h>
+#include <epan/ex-opt.h>
+#include <filetap/ftap.h>
+#include <wiretap/wtap-int.h>
+#include <wiretap/file_wrappers.h>
+
+#ifdef _WIN32
+#include <wsutil/unicode-utils.h>
+#endif /* _WIN32 */
+
+#include "log.h"
+#include <epan/funnel.h>
+
+#ifdef HAVE_PLUGINS
+#include <wsutil/plugins.h>
+#endif
+
+/*
+ * This is the template for the decode as option; it is shared between the
+ * various functions that output the usage for this parameter.
+ */
+static const gchar decode_as_arg_template[] = "<layer_type>==<selector>,<decode_as_protocol>";
+
+static guint32 cum_bytes;
+static const frame_data *ref;
+static frame_data ref_frame;
+static frame_data *prev_dis;
+static frame_data prev_dis_frame;
+static frame_data *prev_cap;
+static frame_data prev_cap_frame;
+
+static const char* prev_display_dissector_name = NULL;
+
+static gboolean perform_two_pass_analysis;
+
+/*
+ * The way the packet decode is to be written.
+ */
+typedef enum {
+  WRITE_TEXT,   /* summary or detail text */
+  WRITE_XML,    /* PDML or PSML */
+  WRITE_FIELDS  /* User defined list of fields */
+  /* Add CSV and the like here */
+} output_action_e;
+
+static output_action_e output_action;
+static gboolean do_dissection;     /* TRUE if we have to dissect each packet */
+static gboolean print_packet_info; /* TRUE if we're to print packet information */
+static gint print_summary = -1;    /* TRUE if we're to print packet summary information */
+static gboolean print_details;     /* TRUE if we're to print packet details information */
+static gboolean print_hex;         /* TRUE if we're to print hex/ascci information */
+static gboolean line_buffered;
+static gboolean really_quiet = FALSE;
+
+static print_format_e print_format = PR_FMT_TEXT;
+static print_stream_t *print_stream;
+
+static output_fields_t* output_fields  = NULL;
+
+/* The line separator used between packets, changeable via the -S option */
+static const char *separator = "";
+
+static int load_cap_file(capture_file *, int, gint64);
+static gboolean process_packet(capture_file *cf, epan_dissect_t *edt, gint64 offset,
+    struct wtap_pkthdr *whdr, const guchar *pd, guint tap_flags);
+static void show_print_file_io_error(int err);
+static gboolean write_preamble(capture_file *cf);
+static gboolean print_packet(capture_file *cf, epan_dissect_t *edt);
+static gboolean write_finale(void);
+static const char *cf_open_error_message(int err, gchar *err_info,
+    gboolean for_writing, int file_type);
+
+static void open_failure_message(const char *filename, int err,
+    gboolean for_writing);
+static void failure_message(const char *msg_format, va_list ap);
+static void read_failure_message(const char *filename, int err);
+static void write_failure_message(const char *filename, int err);
+
+capture_file cfile;
+
+struct string_elem {
+  const char *sstr;   /* The short string */
+  const char *lstr;   /* The long string */
+};
+
+static gint
+string_compare(gconstpointer a, gconstpointer b)
+{
+  return strcmp(((const struct string_elem *)a)->sstr,
+                ((const struct string_elem *)b)->sstr);
+}
+
+static void
+string_elem_print(gpointer data, gpointer not_used _U_)
+{
+  fprintf(stderr, "    %s - %s\n",
+          ((struct string_elem *)data)->sstr,
+          ((struct string_elem *)data)->lstr);
+}
+
+static void
+print_usage(gboolean print_ver)
+{
+  FILE *output;
+
+  if (print_ver) {
+    output = stdout;
+    fprintf(output,
+        "TFShark " VERSION "%s\n"
+        "Dump and analyze network traffic.\n"
+        "See http://www.wireshark.org for more information.\n"
+        "\n"
+        "%s",
+         wireshark_svnversion, get_copyright_info());
+  } else {
+    output = stderr;
+  }
+  fprintf(output, "\n");
+  fprintf(output, "Usage: tfshark [options] ...\n");
+  fprintf(output, "\n");
+
+  /*fprintf(output, "\n");*/
+  fprintf(output, "Input file:\n");
+  fprintf(output, "  -r <infile>              set the filename to read from (no pipes or stdin!)\n");
+
+  fprintf(output, "\n");
+  fprintf(output, "Processing:\n");
+  fprintf(output, "  -2                       perform a two-pass analysis\n");
+  fprintf(output, "  -R <read filter>         packet Read filter in Wireshark display filter syntax\n");
+  fprintf(output, "  -Y <display filter>      packet displaY filter in Wireshark display filter\n");
+  fprintf(output, "                           syntax\n");
+  fprintf(output, "  -d %s ...\n", decode_as_arg_template);
+  fprintf(output, "                           \"Decode As\", see the man page for details\n");
+  fprintf(output, "                           Example: tcp.port==8888,http\n");
+
+  /*fprintf(output, "\n");*/
+  fprintf(output, "Output:\n");
+  fprintf(output, "  -C <config profile>      start with specified configuration profile\n");
+  fprintf(output, "  -V                       add output of packet tree        (Packet Details)\n");
+  fprintf(output, "  -O <protocols>           Only show packet details of these protocols, comma\n");
+  fprintf(output, "                           separated\n");
+  fprintf(output, "  -S <separator>           the line separator to print between packets\n");
+  fprintf(output, "  -x                       add output of hex and ASCII dump (Packet Bytes)\n");
+  fprintf(output, "  -T pdml|ps|psml|text|fields\n");
+  fprintf(output, "                           format of text output (def: text)\n");
+  fprintf(output, "  -e <field>               field to print if -Tfields selected (e.g. tcp.port,\n");
+  fprintf(output, "                           _ws.col.Info)\n");
+  fprintf(output, "                           this option can be repeated to print multiple fields\n");
+  fprintf(output, "  -E<fieldsoption>=<value> set options for output when -Tfields selected:\n");
+  fprintf(output, "     header=y|n            switch headers on and off\n");
+  fprintf(output, "     separator=/t|/s|<char> select tab, space, printable character as separator\n");
+  fprintf(output, "     occurrence=f|l|a      print first, last or all occurrences of each field\n");
+  fprintf(output, "     aggregator=,|/s|<char> select comma, space, printable character as\n");
+  fprintf(output, "                           aggregator\n");
+  fprintf(output, "     quote=d|s|n           select double, single, no quotes for values\n");
+  fprintf(output, "  -t a|ad|d|dd|e|r|u|ud    output format of time stamps (def: r: rel. to first)\n");
+  fprintf(output, "  -u s|hms                 output format of seconds (def: s: seconds)\n");
+  fprintf(output, "  -l                       flush standard output after each packet\n");
+  fprintf(output, "  -q                       be more quiet on stdout (e.g. when using statistics)\n");
+  fprintf(output, "  -Q                       only log true errors to stderr (quieter than -q)\n");
+  fprintf(output, "  -X <key>:<value>         eXtension options, see the man page for details\n");
+  fprintf(output, "  -z <statistics>          various statistics, see the man page for details\n");
+
+  fprintf(output, "\n");
+  fprintf(output, "Miscellaneous:\n");
+  fprintf(output, "  -h                       display this help and exit\n");
+  fprintf(output, "  -v                       display version info and exit\n");
+  fprintf(output, "  -o <name>:<value> ...    override preference setting\n");
+  fprintf(output, "  -K <keytab>              keytab file to use for kerberos decryption\n");
+  fprintf(output, "  -G [report]              dump one of several available reports and exit\n");
+  fprintf(output, "                           default report=\"fields\"\n");
+  fprintf(output, "                           use \"-G ?\" for more help\n");
+}
+
+static void
+glossary_option_help(void)
+{
+  FILE *output;
+
+  output = stdout;
+
+  fprintf(output, "TFShark " VERSION "%s\n", wireshark_svnversion);
+
+  fprintf(output, "\n");
+  fprintf(output, "Usage: tfshark -G [report]\n");
+  fprintf(output, "\n");
+  fprintf(output, "Glossary table reports:\n");
+  fprintf(output, "  -G column-formats        dump column format codes and exit\n");
+  fprintf(output, "  -G decodes               dump \"layer type\"/\"decode as\" associations and exit\n");
+  fprintf(output, "  -G fields                dump fields glossary and exit\n");
+  fprintf(output, "  -G ftypes                dump field type basic and descriptive names\n");
+  fprintf(output, "  -G heuristic-decodes     dump heuristic dissector tables\n");
+  fprintf(output, "  -G plugins               dump installed plugins and exit\n");
+  fprintf(output, "  -G protocols             dump protocols in registration database and exit\n");
+  fprintf(output, "  -G values                dump value, range, true/false strings and exit\n");
+  fprintf(output, "\n");
+  fprintf(output, "Preference reports:\n");
+  fprintf(output, "  -G currentprefs          dump current preferences and exit\n");
+  fprintf(output, "  -G defaultprefs          dump default preferences and exit\n");
+  fprintf(output, "\n");
+}
+
+/*
+ * For a dissector table, print on the stream described by output,
+ * its short name (which is what's used in the "-d" option) and its
+ * descriptive name.
+ */
+static void
+display_dissector_table_names(const char *table_name, const char *ui_name,
+                              gpointer output)
+{
+  if ((prev_display_dissector_name == NULL) ||
+      (strcmp(prev_display_dissector_name, table_name) != 0)) {
+     fprintf((FILE *)output, "\t%s (%s)\n", table_name, ui_name);
+     prev_display_dissector_name = table_name;
+  }
+}
+
+/*
+ * For a dissector handle, print on the stream described by output,
+ * the filter name (which is what's used in the "-d" option) and the full
+ * name for the protocol that corresponds to this handle.
+ */
+static void
+display_dissector_names(const gchar *table _U_, gpointer handle, gpointer output)
+{
+  int          proto_id;
+  const gchar *proto_filter_name;
+  const gchar *proto_ui_name;
+
+  proto_id = dissector_handle_get_protocol_index((dissector_handle_t)handle);
+
+  if (proto_id != -1) {
+    proto_filter_name = proto_get_protocol_filter_name(proto_id);
+    proto_ui_name =  proto_get_protocol_name(proto_id);
+    g_assert(proto_filter_name != NULL);
+    g_assert(proto_ui_name != NULL);
+
+    if ((prev_display_dissector_name == NULL) ||
+        (strcmp(prev_display_dissector_name, proto_filter_name) != 0)) {
+      fprintf((FILE *)output, "\t%s (%s)\n",
+              proto_filter_name,
+              proto_ui_name);
+       prev_display_dissector_name = proto_filter_name;
+    }
+  }
+}
+
+/*
+ * The protocol_name_search structure is used by find_protocol_name_func()
+ * to pass parameters and store results
+ */
+struct protocol_name_search{
+  gchar              *searched_name;  /* Protocol filter name we are looking for */
+  dissector_handle_t  matched_handle; /* Handle for a dissector whose protocol has the specified filter name */
+  guint               nb_match;       /* How many dissectors matched searched_name */
+};
+typedef struct protocol_name_search *protocol_name_search_t;
+
+/*
+ * This function parses all dissectors associated with a table to find the
+ * one whose protocol has the specified filter name.  It is called
+ * as a reference function in a call to dissector_table_foreach_handle.
+ * The name we are looking for, as well as the results, are stored in the
+ * protocol_name_search struct pointed to by user_data.
+ * If called using dissector_table_foreach_handle, we actually parse the
+ * whole list of dissectors.
+ */
+static void
+find_protocol_name_func(const gchar *table _U_, gpointer handle, gpointer user_data)
+
+{
+  int                     proto_id;
+  const gchar            *protocol_filter_name;
+  protocol_name_search_t  search_info;
+
+  g_assert(handle);
+
+  search_info = (protocol_name_search_t)user_data;
+
+  proto_id = dissector_handle_get_protocol_index((dissector_handle_t)handle);
+  if (proto_id != -1) {
+    protocol_filter_name = proto_get_protocol_filter_name(proto_id);
+    g_assert(protocol_filter_name != NULL);
+    if (strcmp(protocol_filter_name, search_info->searched_name) == 0) {
+      /* Found a match */
+      if (search_info->nb_match == 0) {
+        /* Record this handle only if this is the first match */
+        search_info->matched_handle = (dissector_handle_t)handle; /* Record the handle for this matching dissector */
+      }
+      search_info->nb_match++;
+    }
+  }
+}
+
+/*
+ * Allow dissector key names to be sorted alphabetically
+ */
+
+static gint
+compare_dissector_key_name(gconstpointer dissector_a, gconstpointer dissector_b)
+{
+  return strcmp((const char*)dissector_a, (const char*)dissector_b);
+}
+
+/*
+ * Print all layer type names supported.
+ * We send the output to the stream described by the handle output.
+ */
+
+static void
+fprint_all_layer_types(FILE *output)
+
+{
+  prev_display_dissector_name = NULL;
+  dissector_all_tables_foreach_table(display_dissector_table_names, (gpointer)output, (GCompareFunc)compare_dissector_key_name);
+}
+
+/*
+ * Print all protocol names supported for a specific layer type.
+ * table_name contains the layer type name in which the search is performed.
+ * We send the output to the stream described by the handle output.
+ */
+
+static void
+fprint_all_protocols_for_layer_types(FILE *output, gchar *table_name)
+
+{
+  prev_display_dissector_name = NULL;
+  dissector_table_foreach_handle(table_name,
+                                 display_dissector_names,
+                                 (gpointer)output);
+}
+
+/*
+ * The function below parses the command-line parameters for the decode as
+ * feature (a string pointer by cl_param).
+ * It checks the format of the command-line, searches for a matching table
+ * and dissector.  If a table/dissector match is not found, we display a
+ * summary of the available tables/dissectors (on stderr) and return FALSE.
+ * If everything is fine, we get the "Decode as" preference activated,
+ * then we return TRUE.
+ */
+static gboolean
+add_decode_as(const gchar *cl_param)
+{
+  gchar                        *table_name;
+  guint32                       selector, selector2;
+  gchar                        *decoded_param;
+  gchar                        *remaining_param;
+  gchar                        *selector_str;
+  gchar                        *dissector_str;
+  dissector_handle_t            dissector_matching;
+  dissector_table_t             table_matching;
+  ftenum_t                      dissector_table_selector_type;
+  struct protocol_name_search   user_protocol_name;
+  guint64                       i;
+  char                          op;
+
+  /* The following code will allocate and copy the command-line options in a string pointed by decoded_param */
+
+  g_assert(cl_param);
+  decoded_param = g_strdup(cl_param);
+  g_assert(decoded_param);
+
+
+  /* The lines below will parse this string (modifying it) to extract all
+    necessary information.  Note that decoded_param is still needed since
+    strings are not copied - we just save pointers. */
+
+  /* This section extracts a layer type (table_name) from decoded_param */
+  table_name = decoded_param; /* Layer type string starts from beginning */
+
+  remaining_param = strchr(table_name, '=');
+  if (remaining_param == NULL) {
+    cmdarg_err("Parameter \"%s\" doesn't follow the template \"%s\"", cl_param, decode_as_arg_template);
+    /* If the argument does not follow the template, carry on anyway to check
+       if the table name is at least correct.  If remaining_param is NULL,
+       we'll exit anyway further down */
+  }
+  else {
+    *remaining_param = '\0'; /* Terminate the layer type string (table_name) where '=' was detected */
+  }
+
+  /* Remove leading and trailing spaces from the table name */
+  while ( table_name[0] == ' ' )
+    table_name++;
+  while ( table_name[strlen(table_name) - 1] == ' ' )
+    table_name[strlen(table_name) - 1] = '\0'; /* Note: if empty string, while loop will eventually exit */
+
+/* The following part searches a table matching with the layer type specified */
+  table_matching = NULL;
+
+/* Look for the requested table */
+  if ( !(*(table_name)) ) { /* Is the table name empty, if so, don't even search for anything, display a message */
+    cmdarg_err("No layer type specified"); /* Note, we don't exit here, but table_matching will remain NULL, so we exit below */
+  }
+  else {
+    table_matching = find_dissector_table(table_name);
+    if (!table_matching) {
+      cmdarg_err("Unknown layer type -- %s", table_name); /* Note, we don't exit here, but table_matching will remain NULL, so we exit below */
+    }
+  }
+
+  if (!table_matching) {
+    /* Display a list of supported layer types to help the user, if the
+       specified layer type was not found */
+    cmdarg_err("Valid layer types are:");
+    fprint_all_layer_types(stderr);
+  }
+  if (remaining_param == NULL || !table_matching) {
+    /* Exit if the layer type was not found, or if no '=' separator was found
+       (see above) */
+    g_free(decoded_param);
+    return FALSE;
+  }
+
+  if (*(remaining_param + 1) != '=') { /* Check for "==" and not only '=' */
+    cmdarg_err("WARNING: -d requires \"==\" instead of \"=\". Option will be treated as \"%s==%s\"", table_name, remaining_param + 1);
+  }
+  else {
+    remaining_param++; /* Move to the second '=' */
+    *remaining_param = '\0'; /* Remove the second '=' */
+  }
+  remaining_param++; /* Position after the layer type string */
+
+  /* This section extracts a selector value (selector_str) from decoded_param */
+
+  selector_str = remaining_param; /* Next part starts with the selector number */
+
+  remaining_param = strchr(selector_str, ',');
+  if (remaining_param == NULL) {
+    cmdarg_err("Parameter \"%s\" doesn't follow the template \"%s\"", cl_param, decode_as_arg_template);
+    /* If the argument does not follow the template, carry on anyway to check
+       if the selector value is at least correct.  If remaining_param is NULL,
+       we'll exit anyway further down */
+  }
+  else {
+    *remaining_param = '\0'; /* Terminate the selector number string (selector_str) where ',' was detected */
+  }
+
+  dissector_table_selector_type = get_dissector_table_selector_type(table_name);
+
+  switch (dissector_table_selector_type) {
+
+  case FT_UINT8:
+  case FT_UINT16:
+  case FT_UINT24:
+  case FT_UINT32:
+    /* The selector for this table is an unsigned number.  Parse it as such.
+       There's no need to remove leading and trailing spaces from the
+       selector number string, because sscanf will do that for us. */
+    switch (sscanf(selector_str, "%u%c%u", &selector, &op, &selector2)) {
+      case 1:
+        op = '\0';
+        break;
+      case 3:
+        if (op != ':' && op != '-') {
+            cmdarg_err("Invalid selector numeric range \"%s\"", selector_str);
+            g_free(decoded_param);
+            return FALSE;
+        }
+        if (op == ':') {
+            if ((selector2 == 0) || ((guint64)selector + selector2 - 1) > G_MAXUINT32) {
+                cmdarg_err("Invalid selector numeric range \"%s\"", selector_str);
+                g_free(decoded_param);
+                return FALSE;
+            }
+        }
+        else if (selector2 < selector) {
+            /* We could swap them for the user, but maybe it's better to call
+             * this out as an error in case it's not what was intended? */
+            cmdarg_err("Invalid selector numeric range \"%s\"", selector_str);
+            g_free(decoded_param);
+            return FALSE;
+        }
+        break;
+      default:
+        cmdarg_err("Invalid selector number \"%s\"", selector_str);
+        g_free(decoded_param);
+        return FALSE;
+    }
+    break;
+
+  case FT_STRING:
+  case FT_STRINGZ:
+    /* The selector for this table is a string. */
+    break;
+
+  default:
+    /* There are currently no dissector tables with any types other
+       than the ones listed above. */
+    g_assert_not_reached();
+  }
+
+  if (remaining_param == NULL) {
+    /* Exit if no ',' separator was found (see above) */
+    cmdarg_err("Valid protocols for layer type \"%s\" are:", table_name);
+    fprint_all_protocols_for_layer_types(stderr, table_name);
+    g_free(decoded_param);
+    return FALSE;
+  }
+
+  remaining_param++; /* Position after the selector number string */
+
+  /* This section extracts a protocol filter name (dissector_str) from decoded_param */
+
+  dissector_str = remaining_param; /* All the rest of the string is the dissector (decode as protocol) name */
+
+  /* Remove leading and trailing spaces from the dissector name */
+  while ( dissector_str[0] == ' ' )
+    dissector_str++;
+  while ( dissector_str[strlen(dissector_str) - 1] == ' ' )
+    dissector_str[strlen(dissector_str) - 1] = '\0'; /* Note: if empty string, while loop will eventually exit */
+
+  dissector_matching = NULL;
+
+  /* We now have a pointer to the handle for the requested table inside the variable table_matching */
+  if ( ! (*dissector_str) ) { /* Is the dissector name empty, if so, don't even search for a matching dissector and display all dissectors found for the selected table */
+    cmdarg_err("No protocol name specified"); /* Note, we don't exit here, but dissector_matching will remain NULL, so we exit below */
+  }
+  else {
+    user_protocol_name.nb_match = 0;
+    user_protocol_name.searched_name = dissector_str;
+    user_protocol_name.matched_handle = NULL;
+
+    dissector_table_foreach_handle(table_name, find_protocol_name_func, &user_protocol_name); /* Go and perform the search for this dissector in the this table's dissectors' names and shortnames */
+
+    if (user_protocol_name.nb_match != 0) {
+      dissector_matching = user_protocol_name.matched_handle;
+      if (user_protocol_name.nb_match > 1) {
+        cmdarg_err("WARNING: Protocol \"%s\" matched %u dissectors, first one will be used", dissector_str, user_protocol_name.nb_match);
+      }
+    }
+    else {
+      /* OK, check whether the problem is that there isn't any such
+         protocol, or that there is but it's not specified as a protocol
+         that's valid for that dissector table.
+         Note, we don't exit here, but dissector_matching will remain NULL,
+         so we exit below */
+      if (proto_get_id_by_filter_name(dissector_str) == -1) {
+        /* No such protocol */
+        cmdarg_err("Unknown protocol -- \"%s\"", dissector_str);
+      } else {
+        cmdarg_err("Protocol \"%s\" isn't valid for layer type \"%s\"",
+                   dissector_str, table_name);
+      }
+    }
+  }
+
+  if (!dissector_matching) {
+    cmdarg_err("Valid protocols for layer type \"%s\" are:", table_name);
+    fprint_all_protocols_for_layer_types(stderr, table_name);
+    g_free(decoded_param);
+    return FALSE;
+  }
+
+/* This is the end of the code that parses the command-line options.
+   All information is now stored in the variables:
+   table_name
+   selector
+   dissector_matching
+   The above variables that are strings are still pointing to areas within
+   decoded_parm.  decoded_parm thus still needs to be kept allocated in
+   until we stop needing these variables
+   decoded_param will be deallocated at each exit point of this function */
+
+
+  /* We now have a pointer to the handle for the requested dissector
+     (requested protocol) inside the variable dissector_matching */
+  switch (dissector_table_selector_type) {
+
+  case FT_UINT8:
+  case FT_UINT16:
+  case FT_UINT24:
+  case FT_UINT32:
+    /* The selector for this table is an unsigned number. */
+    if (op == '\0') {
+      dissector_change_uint(table_name, selector, dissector_matching);
+    } else if (op == ':') {
+      for (i = selector; i < (guint64)selector + selector2; i++) {
+        dissector_change_uint(table_name, (guint32)i, dissector_matching);
+      }
+    } else { /* op == '-' */
+      for (i = selector; i <= selector2; i++) {
+        dissector_change_uint(table_name, (guint32)i, dissector_matching);
+      }
+    }
+    break;
+
+  case FT_STRING:
+  case FT_STRINGZ:
+    /* The selector for this table is a string. */
+    dissector_change_string(table_name, selector_str, dissector_matching);
+    break;
+
+  default:
+    /* There are currently no dissector tables with any types other
+       than the ones listed above. */
+    g_assert_not_reached();
+  }
+  g_free(decoded_param); /* "Decode As" rule has been successfully added */
+  return TRUE;
+}
+
+static void
+tfshark_log_handler (const gchar *log_domain, GLogLevelFlags log_level,
+    const gchar *message, gpointer user_data)
+{
+  /* ignore log message, if log_level isn't interesting based
+     upon the console log preferences.
+     If the preferences haven't been loaded loaded yet, display the
+     message anyway.
+
+     The default console_log_level preference value is such that only
+       ERROR, CRITICAL and WARNING level messages are processed;
+       MESSAGE, INFO and DEBUG level messages are ignored.
+
+     XXX: Aug 07, 2009: Prior tshark g_log code was hardwired to process only
+           ERROR and CRITICAL level messages so the current code is a behavioral
+           change.  The current behavior is the same as in Wireshark.
+  */
+  if ((log_level & G_LOG_LEVEL_MASK & prefs.console_log_level) == 0 &&
+     prefs.console_log_level != 0) {
+    return;
+  }
+
+  g_log_default_handler(log_domain, log_level, message, user_data);
+
+}
+
+static void
+print_current_user(void) {
+  gchar *cur_user, *cur_group;
+
+  if (started_with_special_privs()) {
+    cur_user = get_cur_username();
+    cur_group = get_cur_groupname();
+    fprintf(stderr, "Running as user \"%s\" and group \"%s\".",
+      cur_user, cur_group);
+    g_free(cur_user);
+    g_free(cur_group);
+    if (running_with_special_privs()) {
+      fprintf(stderr, " This could be dangerous.");
+    }
+    fprintf(stderr, "\n");
+  }
+}
+
+static void
+show_version(GString *comp_info_str, GString *runtime_info_str)
+{
+  printf("TFShark " VERSION "%s\n"
+         "\n"
+         "%s"
+         "\n"
+         "%s"
+         "\n"
+         "%s",
+         wireshark_svnversion, get_copyright_info(), comp_info_str->str,
+         runtime_info_str->str);
+}
+
+int
+main(int argc, char *argv[])
+{
+  GString             *comp_info_str;
+  GString             *runtime_info_str;
+  char                *init_progfile_dir_error;
+  int                  opt;
+  gboolean             arg_error = FALSE;
+
+  char                *gpf_path, *pf_path;
+  char                *gdp_path, *dp_path;
+  int                  gpf_open_errno, gpf_read_errno;
+  int                  pf_open_errno, pf_read_errno;
+  int                  gdp_open_errno, gdp_read_errno;
+  int                  dp_open_errno, dp_read_errno;
+  int                  err;
+  volatile int         exit_status = 0;
+  gboolean             quiet = FALSE;
+  gchar               *volatile cf_name = NULL;
+  gchar               *rfilter = NULL;
+  gchar               *dfilter = NULL;
+  dfilter_t           *rfcode = NULL;
+  dfilter_t           *dfcode = NULL;
+  e_prefs             *prefs_p;
+  int                  log_flags;
+  int                  optind_initial;
+  gchar               *output_only = NULL;
+
+/* the leading - ensures that getopt() does not permute the argv[] entries
+   we have to make sure that the first getopt() preserves the content of argv[]
+   for the subsequent getopt_long() call */
+#define OPTSTRING "-2:C:d:e:E:G:h:K:l:o:O:qQr:R:S:t:T:u:vV:xX:Y:z:"
+
+  static const char    optstring[] = OPTSTRING;
+
+  /* Assemble the compile-time version information string */
+  comp_info_str = g_string_new("Compiled ");
+  get_compiled_version_info(comp_info_str, NULL, epan_get_compiled_version_info);
+
+  /* Assemble the run-time version information string */
+  runtime_info_str = g_string_new("Running ");
+  get_runtime_version_info(runtime_info_str, NULL);
+
+  /* Add it to the information to be reported on a crash. */
+  ws_add_crash_info("TFShark " VERSION "%s\n"
+         "\n"
+         "%s"
+         "\n"
+         "%s",
+      wireshark_svnversion, comp_info_str->str, runtime_info_str->str);
+
+#ifdef _WIN32
+  arg_list_utf_16to8(argc, argv);
+  create_app_running_mutex();
+#if !GLIB_CHECK_VERSION(2,31,0)
+  g_thread_init(NULL);
+#endif
+#endif /* _WIN32 */
+
+  /*
+   * Get credential information for later use.
+   */
+  init_process_policies();
+
+  /*
+   * Attempt to get the pathname of the executable file.
+   */
+  init_progfile_dir_error = init_progfile_dir(argv[0], main);
+  if (init_progfile_dir_error != NULL) {
+    fprintf(stderr, "tfshark: Can't get pathname of tfshark program: %s.\n",
+            init_progfile_dir_error);
+  }
+
+  /*
+   * In order to have the -X opts assigned before the wslua machine starts
+   * we need to call getopts before epan_init() gets called.
+   */
+  opterr = 0;
+  optind_initial = optind;
+
+  while ((opt = getopt(argc, argv, optstring)) != -1) {
+    switch (opt) {
+    case 'C':        /* Configuration Profile */
+      if (profile_exists (optarg, FALSE)) {
+        set_profile_name (optarg);
+      } else {
+        cmdarg_err("Configuration Profile \"%s\" does not exist", optarg);
+        return 1;
+      }
+      break;
+    case 'O':        /* Only output these protocols */
+      output_only = g_strdup(optarg);
+      /* FALLTHROUGH */
+    case 'V':        /* Verbose */
+      print_details = TRUE;
+      print_packet_info = TRUE;
+      break;
+    case 'x':        /* Print packet data in hex (and ASCII) */
+      print_hex = TRUE;
+      /*  The user asked for hex output, so let's ensure they get it,
+       *  even if they're writing to a file.
+       */
+      print_packet_info = TRUE;
+      break;
+    case 'X':
+      ex_opt_add(optarg);
+      break;
+    default:
+      break;
+    }
+  }
+
+  /*
+   * Print packet summary information is the default, unless either -V or -x
+   * were specified.  Note that this is new behavior, which
+   * allows for the possibility of printing only hex/ascii output without
+   * necessarily requiring that either the summary or details be printed too.
+   */
+  if (print_summary == -1)
+    print_summary = (print_details || print_hex) ? FALSE : TRUE;
+
+  optind = optind_initial;
+  opterr = 1;
+
+
+
+/** Send All g_log messages to our own handler **/
+
+  log_flags =
+                    G_LOG_LEVEL_ERROR|
+                    G_LOG_LEVEL_CRITICAL|
+                    G_LOG_LEVEL_WARNING|
+                    G_LOG_LEVEL_MESSAGE|
+                    G_LOG_LEVEL_INFO|
+                    G_LOG_LEVEL_DEBUG|
+                    G_LOG_FLAG_FATAL|G_LOG_FLAG_RECURSION;
+
+  g_log_set_handler(NULL,
+                    (GLogLevelFlags)log_flags,
+                    tfshark_log_handler, NULL /* user_data */);
+  g_log_set_handler(LOG_DOMAIN_MAIN,
+                    (GLogLevelFlags)log_flags,
+                    tfshark_log_handler, NULL /* user_data */);
+
+  initialize_funnel_ops();
+
+  init_report_err(failure_message, open_failure_message, read_failure_message,
+                  write_failure_message);
+
+  timestamp_set_type(TS_RELATIVE);
+  timestamp_set_precision(TS_PREC_AUTO);
+  timestamp_set_seconds_type(TS_SECONDS_DEFAULT);
+
+#ifdef HAVE_PLUGINS
+  /* Register all the plugin types we have. */
+  epan_register_plugin_types(); /* Types known to libwireshark */
+  ftap_register_plugin_types(); /* Types known to libfiletap */
+
+  /* Scan for plugins.  This does *not* call their registration routines;
+     that's done later. */
+  scan_plugins();
+
+  /* Register all libfiletap plugin modules. */
+  register_all_filetap_modules();
+
+#endif
+
+  /* Register all dissectors; we must do this before checking for the
+     "-G" flag, as the "-G" flag dumps information registered by the
+     dissectors, and we must do it before we read the preferences, in
+     case any dissectors register preferences. */
+  epan_init(register_all_protocols, register_all_protocol_handoffs, NULL, NULL);
+
+  /* Register all tap listeners; we do this before we parse the arguments,
+     as the "-z" argument can specify a registered tap. */
+
+  /* we register the plugin taps before the other taps because
+     stats_tree taps plugins will be registered as tap listeners
+     by stats_tree_stat.c and need to registered before that */
+#ifdef HAVE_PLUGINS
+  register_all_plugin_tap_listeners();
+#endif
+  register_all_tap_listeners();
+
+  /* If invoked with the "-G" flag, we dump out information based on
+     the argument to the "-G" flag; if no argument is specified,
+     for backwards compatibility we dump out a glossary of display
+     filter symbols.
+
+     XXX - we do this here, for now, to support "-G" with no arguments.
+     If none of our build or other processes uses "-G" with no arguments,
+     we can just process it with the other arguments. */
+  if (argc >= 2 && strcmp(argv[1], "-G") == 0) {
+    proto_initialize_all_prefixes();
+
+    if (argc == 2)
+      proto_registrar_dump_fields();
+    else {
+      if (strcmp(argv[2], "column-formats") == 0)
+        column_dump_column_formats();
+      else if (strcmp(argv[2], "currentprefs") == 0) {
+        read_prefs(&gpf_open_errno, &gpf_read_errno, &gpf_path,
+            &pf_open_errno, &pf_read_errno, &pf_path);
+        write_prefs(NULL);
+      }
+      else if (strcmp(argv[2], "decodes") == 0)
+        dissector_dump_decodes();
+      else if (strcmp(argv[2], "defaultprefs") == 0)
+        write_prefs(NULL);
+      else if (strcmp(argv[2], "fields") == 0)
+        proto_registrar_dump_fields();
+      else if (strcmp(argv[2], "ftypes") == 0)
+        proto_registrar_dump_ftypes();
+      else if (strcmp(argv[2], "heuristic-decodes") == 0)
+        dissector_dump_heur_decodes();
+      else if (strcmp(argv[2], "plugins") == 0) {
+#ifdef HAVE_PLUGINS
+        plugins_dump_all();
+#endif
+#ifdef HAVE_LUA
+        wslua_plugins_dump_all();
+#endif
+      }
+      else if (strcmp(argv[2], "protocols") == 0)
+        proto_registrar_dump_protocols();
+      else if (strcmp(argv[2], "values") == 0)
+        proto_registrar_dump_values();
+      else if (strcmp(argv[2], "?") == 0)
+        glossary_option_help();
+      else if (strcmp(argv[2], "-?") == 0)
+        glossary_option_help();
+      else {
+        cmdarg_err("Invalid \"%s\" option for -G flag, enter -G ? for more help.", argv[2]);
+        return 1;
+      }
+    }
+    return 0;
+  }
+
+  /* Set the C-language locale to the native environment. */
+  setlocale(LC_ALL, "");
+
+  prefs_p = read_prefs(&gpf_open_errno, &gpf_read_errno, &gpf_path,
+                     &pf_open_errno, &pf_read_errno, &pf_path);
+  if (gpf_path != NULL) {
+    if (gpf_open_errno != 0) {
+      cmdarg_err("Can't open global preferences file \"%s\": %s.",
+              pf_path, g_strerror(gpf_open_errno));
+    }
+    if (gpf_read_errno != 0) {
+      cmdarg_err("I/O error reading global preferences file \"%s\": %s.",
+              pf_path, g_strerror(gpf_read_errno));
+    }
+  }
+  if (pf_path != NULL) {
+    if (pf_open_errno != 0) {
+      cmdarg_err("Can't open your preferences file \"%s\": %s.", pf_path,
+              g_strerror(pf_open_errno));
+    }
+    if (pf_read_errno != 0) {
+      cmdarg_err("I/O error reading your preferences file \"%s\": %s.",
+              pf_path, g_strerror(pf_read_errno));
+    }
+    g_free(pf_path);
+    pf_path = NULL;
+  }
+
+  /* Read the disabled protocols file. */
+  read_disabled_protos_list(&gdp_path, &gdp_open_errno, &gdp_read_errno,
+                            &dp_path, &dp_open_errno, &dp_read_errno);
+  if (gdp_path != NULL) {
+    if (gdp_open_errno != 0) {
+      cmdarg_err("Could not open global disabled protocols file\n\"%s\": %s.",
+                 gdp_path, g_strerror(gdp_open_errno));
+    }
+    if (gdp_read_errno != 0) {
+      cmdarg_err("I/O error reading global disabled protocols file\n\"%s\": %s.",
+                 gdp_path, g_strerror(gdp_read_errno));
+    }
+    g_free(gdp_path);
+  }
+  if (dp_path != NULL) {
+    if (dp_open_errno != 0) {
+      cmdarg_err(
+        "Could not open your disabled protocols file\n\"%s\": %s.", dp_path,
+        g_strerror(dp_open_errno));
+    }
+    if (dp_read_errno != 0) {
+      cmdarg_err(
+        "I/O error reading your disabled protocols file\n\"%s\": %s.", dp_path,
+        g_strerror(dp_read_errno));
+    }
+    g_free(dp_path);
+  }
+
+  cap_file_init(&cfile);
+
+  /* Print format defaults to this. */
+  print_format = PR_FMT_TEXT;
+
+  output_fields = output_fields_new();
+
+  /* Now get our args */
+  while ((opt = getopt(argc, argv, optstring)) != -1) {
+    switch (opt) {
+    case '2':        /* Perform two pass analysis */
+      perform_two_pass_analysis = TRUE;
+      break;
+    case 'C':
+      /* Configuration profile settings were already processed just ignore them this time*/
+      break;
+    case 'd':        /* Decode as rule */
+      if (!add_decode_as(optarg))
+        return 1;
+      break;
+#if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
+    case 'K':        /* Kerberos keytab file */
+      read_keytab_file(optarg);
+      break;
+#endif
+    case 'e':
+      /* Field entry */
+      output_fields_add(output_fields, optarg);
+      break;
+    case 'E':
+      /* Field option */
+      if (!output_fields_set_option(output_fields, optarg)) {
+        cmdarg_err("\"%s\" is not a valid field output option=value pair.", optarg);
+        output_fields_list_options(stderr);
+        return 1;
+      }
+      break;
+
+    case 'h':        /* Print help and exit */
+      print_usage(TRUE);
+      return 0;
+      break;
+    case 'l':        /* "Line-buffer" standard output */
+      /* This isn't line-buffering, strictly speaking, it's just
+         flushing the standard output after the information for
+         each packet is printed; however, that should be good
+         enough for all the purposes to which "-l" is put (and
+         is probably actually better for "-V", as it does fewer
+         writes).
+
+         See the comment in "process_packet()" for an explanation of
+         why we do that, and why we don't just use "setvbuf()" to
+         make the standard output line-buffered (short version: in
+         Windows, "line-buffered" is the same as "fully-buffered",
+         and the output buffer is only flushed when it fills up). */
+      line_buffered = TRUE;
+      break;
+    case 'o':        /* Override preference from command line */
+      switch (prefs_set_pref(optarg)) {
+
+      case PREFS_SET_OK:
+        break;
+
+      case PREFS_SET_SYNTAX_ERR:
+        cmdarg_err("Invalid -o flag \"%s\"", optarg);
+        return 1;
+        break;
+
+      case PREFS_SET_NO_SUCH_PREF:
+      case PREFS_SET_OBSOLETE:
+        cmdarg_err("-o flag \"%s\" specifies unknown preference", optarg);
+        return 1;
+        break;
+      }
+      break;
+    case 'q':        /* Quiet */
+      quiet = TRUE;
+      break;
+    case 'Q':        /* Really quiet */
+      quiet = TRUE;
+      really_quiet = TRUE;
+      break;
+    case 'r':        /* Read capture file x */
+      cf_name = g_strdup(optarg);
+      break;
+    case 'R':        /* Read file filter */
+      rfilter = optarg;
+      break;
+    case 'S':        /* Set the line Separator to be printed between packets */
+      separator = strdup(optarg);
+      break;
+    case 't':        /* Time stamp type */
+      if (strcmp(optarg, "r") == 0)
+        timestamp_set_type(TS_RELATIVE);
+      else if (strcmp(optarg, "a") == 0)
+        timestamp_set_type(TS_ABSOLUTE);
+      else if (strcmp(optarg, "ad") == 0)
+        timestamp_set_type(TS_ABSOLUTE_WITH_YMD);
+      else if (strcmp(optarg, "adoy") == 0)
+        timestamp_set_type(TS_ABSOLUTE_WITH_YDOY);
+      else if (strcmp(optarg, "d") == 0)
+        timestamp_set_type(TS_DELTA);
+      else if (strcmp(optarg, "dd") == 0)
+        timestamp_set_type(TS_DELTA_DIS);
+      else if (strcmp(optarg, "e") == 0)
+        timestamp_set_type(TS_EPOCH);
+      else if (strcmp(optarg, "u") == 0)
+        timestamp_set_type(TS_UTC);
+      else if (strcmp(optarg, "ud") == 0)
+        timestamp_set_type(TS_UTC_WITH_YMD);
+      else if (strcmp(optarg, "udoy") == 0)
+        timestamp_set_type(TS_UTC_WITH_YDOY);
+      else {
+        cmdarg_err("Invalid time stamp type \"%s\"; it must be one of:", optarg);
+        cmdarg_err_cont("\t\"a\"    for absolute\n"
+                        "\t\"ad\"   for absolute with YYYY-MM-DD date\n"
+                        "\t\"adoy\" for absolute with YYYY/DOY date\n"
+                        "\t\"d\"    for delta\n"
+                        "\t\"dd\"   for delta displayed\n"
+                        "\t\"e\"    for epoch\n"
+                        "\t\"r\"    for relative\n"
+                        "\t\"u\"    for absolute UTC\n"
+                        "\t\"ud\"   for absolute UTC with YYYY-MM-DD date\n"
+                        "\t\"udoy\" for absolute UTC with YYYY/DOY date");
+        return 1;
+      }
+      break;
+    case 'T':        /* printing Type */
+      if (strcmp(optarg, "text") == 0) {
+        output_action = WRITE_TEXT;
+        print_format = PR_FMT_TEXT;
+      } else if (strcmp(optarg, "ps") == 0) {
+        output_action = WRITE_TEXT;
+        print_format = PR_FMT_PS;
+      } else if (strcmp(optarg, "pdml") == 0) {
+        output_action = WRITE_XML;
+        print_details = TRUE;   /* Need details */
+        print_summary = FALSE;  /* Don't allow summary */
+      } else if (strcmp(optarg, "psml") == 0) {
+        output_action = WRITE_XML;
+        print_details = FALSE;  /* Don't allow details */
+        print_summary = TRUE;   /* Need summary */
+      } else if (strcmp(optarg, "fields") == 0) {
+        output_action = WRITE_FIELDS;
+        print_details = TRUE;   /* Need full tree info */
+        print_summary = FALSE;  /* Don't allow summary */
+      } else {
+        cmdarg_err("Invalid -T parameter \"%s\"; it must be one of:", optarg);                   /* x */
+        cmdarg_err_cont("\t\"fields\" The values of fields specified with the -e option, in a form\n"
+                        "\t         specified by the -E option.\n"
+                        "\t\"pdml\"   Packet Details Markup Language, an XML-based format for the\n"
+                        "\t         details of a decoded packet. This information is equivalent to\n"
+                        "\t         the packet details printed with the -V flag.\n"
+                        "\t\"ps\"     PostScript for a human-readable one-line summary of each of\n"
+                        "\t         the packets, or a multi-line view of the details of each of\n"
+                        "\t         the packets, depending on whether the -V flag was specified.\n"
+                        "\t\"psml\"   Packet Summary Markup Language, an XML-based format for the\n"
+                        "\t         summary information of a decoded packet. This information is\n"
+                        "\t         equivalent to the information shown in the one-line summary\n"
+                        "\t         printed by default.\n"
+                        "\t\"text\"   Text of a human-readable one-line summary of each of the\n"
+                        "\t         packets, or a multi-line view of the details of each of the\n"
+                        "\t         packets, depending on whether the -V flag was specified.\n"
+                        "\t         This is the default.");
+        return 1;
+      }
+      break;
+    case 'u':        /* Seconds type */
+      if (strcmp(optarg, "s") == 0)
+        timestamp_set_seconds_type(TS_SECONDS_DEFAULT);
+      else if (strcmp(optarg, "hms") == 0)
+        timestamp_set_seconds_type(TS_SECONDS_HOUR_MIN_SEC);
+      else {
+        cmdarg_err("Invalid seconds type \"%s\"; it must be one of:", optarg);
+        cmdarg_err_cont("\t\"s\"   for seconds\n"
+                        "\t\"hms\" for hours, minutes and seconds");
+        return 1;
+      }
+      break;
+    case 'v':         /* Show version and exit */
+    {
+      show_version(comp_info_str, runtime_info_str);
+      g_string_free(comp_info_str, TRUE);
+      g_string_free(runtime_info_str, TRUE);
+      /* We don't really have to cleanup here, but it's a convenient way to test
+       * start-up and shut-down of the epan library without any UI-specific
+       * cruft getting in the way. Makes the results of running
+       * $ ./tools/valgrind-wireshark -n
+       * much more useful. */
+      epan_cleanup();
+      return 0;
+    }
+    case 'O':        /* Only output these protocols */
+      /* already processed; just ignore it now */
+      break;
+    case 'V':        /* Verbose */
+      /* already processed; just ignore it now */
+      break;
+    case 'x':        /* Print packet data in hex (and ASCII) */
+      /* already processed; just ignore it now */
+      break;
+    case 'X':
+      break;
+    case 'Y':
+      dfilter = optarg;
+      break;
+    case 'z':
+      /* We won't call the init function for the stat this soon
+         as it would disallow MATE's fields (which are registered
+         by the preferences set callback) from being used as
+         part of a tap filter.  Instead, we just add the argument
+         to a list of stat arguments. */
+      if (!process_stat_cmd_arg(optarg)) {
+        if (strcmp("help", optarg)==0) {
+          fprintf(stderr, "tfshark: The available statistics for the \"-z\" option are:\n");
+          list_stat_cmd_args();
+          return 0;
+        }
+        cmdarg_err("Invalid -z argument \"%s\"; it must be one of:", optarg);
+        list_stat_cmd_args();
+        return 1;
+      }
+      break;
+    default:
+    case '?':        /* Bad flag - print usage message */
+      print_usage(TRUE);
+      return 1;
+      break;
+    }
+  }
+
+  /* If we specified output fields, but not the output field type... */
+  if (WRITE_FIELDS != output_action && 0 != output_fields_num_fields(output_fields)) {
+        cmdarg_err("Output fields were specified with \"-e\", "
+            "but \"-Tfields\" was not specified.");
+        return 1;
+  } else if (WRITE_FIELDS == output_action && 0 == output_fields_num_fields(output_fields)) {
+        cmdarg_err("\"-Tfields\" was specified, but no fields were "
+                    "specified with \"-e\".");
+
+        return 1;
+  }
+
+  /* If no capture filter or display filter has been specified, and there are
+     still command-line arguments, treat them as the tokens of a capture
+     filter (if no "-r" flag was specified) or a display filter (if a "-r"
+     flag was specified. */
+  if (optind < argc) {
+    if (cf_name != NULL) {
+      if (dfilter != NULL) {
+        cmdarg_err("Display filters were specified both with \"-d\" "
+            "and with additional command-line arguments.");
+        return 1;
+      }
+      dfilter = get_args_as_string(argc, argv, optind);
+    }
+  }
+
+  /* if "-q" wasn't specified, we should print packet information */
+  if (!quiet)
+    print_packet_info = TRUE;
+
+  if (arg_error) {
+    print_usage(FALSE);
+    return 1;
+  }
+
+  if (print_hex) {
+    if (output_action != WRITE_TEXT) {
+      cmdarg_err("Raw packet hex data can only be printed as text or PostScript");
+      return 1;
+    }
+  }
+
+  if (output_only != NULL) {
+    char *ps;
+
+    if (!print_details) {
+      cmdarg_err("-O requires -V");
+      return 1;
+    }
+
+    output_only_tables = g_hash_table_new (g_str_hash, g_str_equal);
+    for (ps = strtok (output_only, ","); ps; ps = strtok (NULL, ",")) {
+      g_hash_table_insert(output_only_tables, (gpointer)ps, (gpointer)ps);
+    }
+  }
+
+  if (rfilter != NULL && !perform_two_pass_analysis) {
+    cmdarg_err("-R without -2 is deprecated. For single-pass filtering use -Y.");
+    return 1;
+  }
+
+  /* Notify all registered modules that have had any of their preferences
+     changed either from one of the preferences file or from the command
+     line that their preferences have changed. */
+  prefs_apply_all();
+
+  /* At this point MATE will have registered its field array so we can
+     have a tap filter with one of MATE's late-registered fields as part
+     of the filter.  We can now process all the "-z" arguments. */
+  start_requested_stats();
+
+  /* disabled protocols as per configuration file */
+  if (gdp_path == NULL && dp_path == NULL) {
+    set_disabled_protos_list();
+  }
+
+  /* Build the column format array */
+  build_column_format_array(&cfile.cinfo, prefs_p->num_cols, TRUE);
+
+  if (rfilter != NULL) {
+    if (!dfilter_compile(rfilter, &rfcode)) {
+      cmdarg_err("%s", dfilter_error_msg);
+      epan_cleanup();
+      return 2;
+    }
+  }
+  cfile.rfcode = rfcode;
+
+  if (dfilter != NULL) {
+    if (!dfilter_compile(dfilter, &dfcode)) {
+      cmdarg_err("%s", dfilter_error_msg);
+      epan_cleanup();
+      return 2;
+    }
+  }
+  cfile.dfcode = dfcode;
+
+  if (print_packet_info) {
+    /* If we're printing as text or PostScript, we have
+       to create a print stream. */
+    if (output_action == WRITE_TEXT) {
+      switch (print_format) {
+
+      case PR_FMT_TEXT:
+        print_stream = print_stream_text_stdio_new(stdout);
+        break;
+
+      case PR_FMT_PS:
+        print_stream = print_stream_ps_stdio_new(stdout);
+        break;
+
+      default:
+        g_assert_not_reached();
+      }
+    }
+  }
+
+  /* We have to dissect each packet if:
+
+        we're printing information about each packet;
+
+        we're using a read filter on the packets;
+
+        we're using a display filter on the packets;
+
+        we're using any taps that need dissection. */
+  do_dissection = print_packet_info || rfcode || dfcode || tap_listeners_require_dissection();
+
+  if (cf_name) {
+    /*
+     * We're reading a capture file.
+     */
+
+    /*
+     * Immediately relinquish any special privileges we have; we must not
+     * be allowed to read any capture files the user running TShark
+     * can't open.
+     */
+    relinquish_special_privs_perm();
+    print_current_user();
+
+    if (cf_open(&cfile, cf_name, FALSE, &err) != CF_OK) {
+      epan_cleanup();
+      return 2;
+    }
+
+    /* Process the packets in the file */
+    TRY {
+      /* XXX - for now there is only 1 packet */
+      err = load_cap_file(&cfile, 1, 0);
+    }
+    CATCH(OutOfMemoryError) {
+      fprintf(stderr,
+              "Out Of Memory!\n"
+              "\n"
+              "Sorry, but TFShark has to terminate now!\n"
+              "\n"
+              "Some infos / workarounds can be found at:\n"
+              "http://wiki.wireshark.org/KnownBugs/OutOfMemory\n");
+      err = ENOMEM;
+    }
+    ENDTRY;
+
+    if (err != 0) {
+      /* We still dump out the results of taps, etc., as we might have
+         read some packets; however, we exit with an error status. */
+      exit_status = 2;
+    }
+  }
+
+  g_free(cf_name);
+
+  if (cfile.frames != NULL) {
+    free_frame_data_sequence(cfile.frames);
+    cfile.frames = NULL;
+  }
+
+  draw_tap_listeners(TRUE);
+  funnel_dump_all_text_windows();
+  epan_free(cfile.epan);
+  epan_cleanup();
+
+  output_fields_free(output_fields);
+  output_fields = NULL;
+
+  return exit_status;
+}
+
+static const nstime_t *
+tfshark_get_frame_ts(void *data, guint32 frame_num)
+{
+  capture_file *cf = (capture_file *) data;
+
+  if (ref && ref->num == frame_num)
+    return &ref->abs_ts;
+
+  if (prev_dis && prev_dis->num == frame_num)
+    return &prev_dis->abs_ts;
+
+  if (prev_cap && prev_cap->num == frame_num)
+    return &prev_cap->abs_ts;
+
+  if (cf->frames) {
+     frame_data *fd = frame_data_sequence_find(cf->frames, frame_num);
+
+     return (fd) ? &fd->abs_ts : NULL;
+  }
+
+  return NULL;
+}
+
+static const char *
+no_interface_name(void *data _U_, guint32 interface_id _U_)
+{
+    return "";
+}
+
+static epan_t *
+tfshark_epan_new(capture_file *cf)
+{
+  epan_t *epan = epan_new();
+
+  epan->data = cf;
+  epan->get_frame_ts = tfshark_get_frame_ts;
+  epan->get_interface_name = no_interface_name;
+  epan->get_user_comment = NULL;
+
+  return epan;
+}
+
+static gboolean
+process_packet_first_pass(capture_file *cf, epan_dissect_t *edt,
+               gint64 offset, struct wtap_pkthdr *whdr,
+               const guchar *pd)
+{
+  frame_data     fdlocal;
+  guint32        framenum;
+  gboolean       passed;
+
+  /* The frame number of this packet is one more than the count of
+     frames in this packet. */
+  framenum = cf->count + 1;
+
+  /* If we're not running a display filter and we're not printing any
+     packet information, we don't need to do a dissection. This means
+     that all packets can be marked as 'passed'. */
+  passed = TRUE;
+
+  frame_data_init(&fdlocal, framenum, whdr, offset, cum_bytes);
+
+  /* If we're going to print packet information, or we're going to
+     run a read filter, or display filter, or we're going to process taps, set up to
+     do a dissection and do so. */
+  if (edt) {
+    /* If we're running a read filter, prime the epan_dissect_t with that
+       filter. */
+    if (cf->rfcode)
+      epan_dissect_prime_dfilter(edt, cf->rfcode);
+
+    frame_data_set_before_dissect(&fdlocal, &cf->elapsed_time,
+                                  &ref, prev_dis);
+    if (ref == &fdlocal) {
+      ref_frame = fdlocal;
+      ref = &ref_frame;
+    }
+
+    epan_dissect_file_run(edt, whdr, file_tvbuff_new(&fdlocal, pd), &fdlocal, NULL);
+
+    /* Run the read filter if we have one. */
+    if (cf->rfcode)
+      passed = dfilter_apply_edt(cf->rfcode, edt);
+  }
+
+  if (passed) {
+    frame_data_set_after_dissect(&fdlocal, &cum_bytes);
+    prev_cap = prev_dis = frame_data_sequence_add(cf->frames, &fdlocal);
+
+    /* If we're not doing dissection then there won't be any dependent frames.
+     * More importantly, edt.pi.dependent_frames won't be initialized because
+     * epan hasn't been initialized.
+     */
+    if (edt) {
+      g_slist_foreach(edt->pi.dependent_frames, find_and_mark_frame_depended_upon, cf->frames);
+    }
+
+    cf->count++;
+  } else {
+    /* if we don't add it to the frame_data_sequence, clean it up right now
+     * to avoid leaks */
+    frame_data_destroy(&fdlocal);
+  }
+
+  if (edt)
+    epan_dissect_reset(edt);
+
+  return passed;
+}
+
+static gboolean
+process_packet_second_pass(capture_file *cf, epan_dissect_t *edt, frame_data *fdata,
+               struct wtap_pkthdr *phdr, Buffer *buf,
+               guint tap_flags)
+{
+  column_info    *cinfo;
+  gboolean        passed;
+
+  /* If we're not running a display filter and we're not printing any
+     packet information, we don't need to do a dissection. This means
+     that all packets can be marked as 'passed'. */
+  passed = TRUE;
+
+  /* If we're going to print packet information, or we're going to
+     run a read filter, or we're going to process taps, set up to
+     do a dissection and do so. */
+  if (edt) {
+
+    /* If we're running a display filter, prime the epan_dissect_t with that
+       filter. */
+    if (cf->dfcode)
+      epan_dissect_prime_dfilter(edt, cf->dfcode);
+
+    col_custom_prime_edt(edt, &cf->cinfo);
+
+    /* We only need the columns if either
+         1) some tap needs the columns
+       or
+         2) we're printing packet info but we're *not* verbose; in verbose
+            mode, we print the protocol tree, not the protocol summary.
+     */
+    if ((tap_flags & TL_REQUIRES_COLUMNS) || (print_packet_info && print_summary))
+      cinfo = &cf->cinfo;
+    else
+      cinfo = NULL;
+
+    frame_data_set_before_dissect(fdata, &cf->elapsed_time,
+                                  &ref, prev_dis);
+    if (ref == fdata) {
+      ref_frame = *fdata;
+      ref = &ref_frame;
+    }
+
+    epan_dissect_file_run_with_taps(edt, phdr, file_tvbuff_new_buffer(fdata, buf), fdata, cinfo);
+
+    /* Run the read/display filter if we have one. */
+    if (cf->dfcode)
+      passed = dfilter_apply_edt(cf->dfcode, edt);
+  }
+
+  if (passed) {
+    frame_data_set_after_dissect(fdata, &cum_bytes);
+    /* Process this packet. */
+    if (print_packet_info) {
+      /* We're printing packet information; print the information for
+         this packet. */
+      print_packet(cf, edt);
+
+      /* The ANSI C standard does not appear to *require* that a line-buffered
+         stream be flushed to the host environment whenever a newline is
+         written, it just says that, on such a stream, characters "are
+         intended to be transmitted to or from the host environment as a
+         block when a new-line character is encountered".
+
+         The Visual C++ 6.0 C implementation doesn't do what is intended;
+         even if you set a stream to be line-buffered, it still doesn't
+         flush the buffer at the end of every line.
+
+         So, if the "-l" flag was specified, we flush the standard output
+         at the end of a packet.  This will do the right thing if we're
+         printing packet summary lines, and, as we print the entire protocol
+         tree for a single packet without waiting for anything to happen,
+         it should be as good as line-buffered mode if we're printing
+         protocol trees.  (The whole reason for the "-l" flag in either
+         tcpdump or TShark is to allow the output of a live capture to
+         be piped to a program or script and to have that script see the
+         information for the packet as soon as it's printed, rather than
+         having to wait until a standard I/O buffer fills up. */
+      if (line_buffered)
+        fflush(stdout);
+
+      if (ferror(stdout)) {
+        show_print_file_io_error(errno);
+        exit(2);
+      }
+    }
+    prev_dis = fdata;
+  }
+  prev_cap = fdata;
+
+  if (edt) {
+    epan_dissect_reset(edt);
+  }
+  return passed || fdata->flags.dependent_of_displayed;
+}
+
+gboolean
+local_wtap_read(capture_file *cf, struct wtap_pkthdr* file_phdr, int *err, gchar **err_info, gint64 *data_offset, guint8** data_buffer)
+{
+    int        bytes_read;
+    gint64 packet_size = wtap_file_size(cf->wth, err);
+
+    *data_buffer = (guint8*)g_malloc((gsize)packet_size);
+    bytes_read = file_read(*data_buffer, (gsize)packet_size, cf->wth->fh);
+
+       if (bytes_read < 0) {
+               *err = file_error(cf->wth->fh, err_info);
+               if (*err == 0)
+                       *err = FTAP_ERR_SHORT_READ;
+               return FALSE;
+       } else if (bytes_read == 0) {
+        /* Done with file, no error */
+        return FALSE;
+    }
+
+
+    /* XXX - SET FRAME SIZE EQUAL TO TOTAL FILE SIZE */
+    file_phdr->caplen = (guint32)packet_size;
+    file_phdr->len = (guint32)packet_size;
+
+#if 0
+       /*
+        * Set the packet encapsulation to the file's encapsulation
+        * value; if that's not WTAP_ENCAP_PER_PACKET, it's the
+        * right answer (and means that the read routine for this
+        * capture file type doesn't have to set it), and if it
+        * *is* WTAP_ENCAP_PER_PACKET, the caller needs to set it
+        * anyway.
+        */
+       wth->phdr.pkt_encap = wth->file_encap;
+
+       if (!wth->subtype_read(wth, err, err_info, data_offset)) {
+               /*
+                * If we didn't get an error indication, we read
+                * the last packet.  See if there's any deferred
+                * error, as might, for example, occur if we're
+                * reading a compressed file, and we got an error
+                * reading compressed data from the file, but
+                * got enough compressed data to decompress the
+                * last packet of the file.
+                */
+               if (*err == 0)
+                       *err = file_error(wth->fh, err_info);
+               return FALSE;   /* failure */
+       }
+
+       /*
+        * It makes no sense for the captured data length to be bigger
+        * than the actual data length.
+        */
+       if (wth->phdr.caplen > wth->phdr.len)
+               wth->phdr.caplen = wth->phdr.len;
+
+       /*
+        * Make sure that it's not WTAP_ENCAP_PER_PACKET, as that
+        * probably means the file has that encapsulation type
+        * but the read routine didn't set this packet's
+        * encapsulation type.
+        */
+       g_assert(wth->phdr.pkt_encap != WTAP_ENCAP_PER_PACKET);
+#endif
+
+       return TRUE;    /* success */
+}
+
+static int
+load_cap_file(capture_file *cf, int max_packet_count, gint64 max_byte_count)
+{
+  guint32      framenum;
+  int          err;
+  gchar       *err_info = NULL;
+  gint64       data_offset = 0;
+  gboolean     filtering_tap_listeners;
+  guint        tap_flags;
+  Buffer       buf;
+  epan_dissect_t *edt = NULL;
+  struct wtap_pkthdr file_phdr;
+  guint8* raw_data;
+
+  if (print_packet_info) {
+    if (!write_preamble(cf)) {
+      err = errno;
+      show_print_file_io_error(err);
+      goto out;
+    }
+  }
+
+  /* Do we have any tap listeners with filters? */
+  filtering_tap_listeners = have_filtering_tap_listeners();
+
+  /* Get the union of the flags for all tap listeners. */
+  tap_flags = union_of_tap_listener_flags();
+
+  memset(&file_phdr, 0, sizeof(file_phdr));
+
+  /* XXX - TEMPORARY HACK TO ELF DISSECTOR */
+  file_phdr.pkt_encap = 1234;
+
+  if (perform_two_pass_analysis) {
+    frame_data *fdata;
+
+    /* Allocate a frame_data_sequence for all the frames. */
+    cf->frames = new_frame_data_sequence();
+
+    if (do_dissection) {
+       gboolean create_proto_tree = FALSE;
+
+      /* If we're going to be applying a filter, we'll need to
+         create a protocol tree against which to apply the filter. */
+      if (cf->rfcode)
+        create_proto_tree = TRUE;
+
+      /* We're not going to display the protocol tree on this pass,
+         so it's not going to be "visible". */
+      edt = epan_dissect_new(cf->epan, create_proto_tree, FALSE);
+    }
+    while (local_wtap_read(cf, &file_phdr, &err, &err_info, &data_offset, &raw_data)) {
+      if (process_packet_first_pass(cf, edt, data_offset, &file_phdr/*wtap_phdr(cf->wth)*/,
+                         wtap_buf_ptr(cf->wth))) {
+
+        /* Stop reading if we have the maximum number of packets;
+         * When the -c option has not been used, max_packet_count
+         * starts at 0, which practically means, never stop reading.
+         * (unless we roll over max_packet_count ?)
+         */
+        if ( (--max_packet_count == 0) || (max_byte_count != 0 && data_offset >= max_byte_count)) {
+          err = 0; /* This is not an error */
+          break;
+        }
+      }
+    }
+
+    if (edt) {
+      epan_dissect_free(edt);
+      edt = NULL;
+    }
+
+#if 0
+    /* Close the sequential I/O side, to free up memory it requires. */
+    wtap_sequential_close(cf->wth);
+#endif
+
+    /* Allow the protocol dissectors to free up memory that they
+     * don't need after the sequential run-through of the packets. */
+    postseq_cleanup_all_protocols();
+
+    prev_dis = NULL;
+    prev_cap = NULL;
+    buffer_init(&buf, 1500);
+
+    if (do_dissection) {
+      gboolean create_proto_tree;
+
+      if (cf->dfcode || print_details || filtering_tap_listeners ||
+         (tap_flags & TL_REQUIRES_PROTO_TREE) || have_custom_cols(&cf->cinfo))
+           create_proto_tree = TRUE;
+      else
+           create_proto_tree = FALSE;
+
+      /* The protocol tree will be "visible", i.e., printed, only if we're
+         printing packet details, which is true if we're printing stuff
+         ("print_packet_info" is true) and we're in verbose mode
+         ("packet_details" is true). */
+      edt = epan_dissect_new(cf->epan, create_proto_tree, print_packet_info && print_details);
+    }
+
+    for (framenum = 1; err == 0 && framenum <= cf->count; framenum++) {
+      fdata = frame_data_sequence_find(cf->frames, framenum);
+#if 0
+      if (wtap_seek_read(cf->wth, fdata->file_off,
+          &buf, fdata->cap_len, &err, &err_info)) {
+        process_packet_second_pass(cf, edt, fdata, &cf->phdr, &buf, tap_flags);
+      }
+#else
+        process_packet_second_pass(cf, edt, fdata, &cf->phdr, &buf, tap_flags);
+#endif
+    }
+
+    if (edt) {
+      epan_dissect_free(edt);
+      edt = NULL;
+    }
+
+    buffer_free(&buf);
+  }
+  else {
+    framenum = 0;
+
+    if (do_dissection) {
+      gboolean create_proto_tree;
+
+      if (cf->rfcode || cf->dfcode || print_details || filtering_tap_listeners ||
+          (tap_flags & TL_REQUIRES_PROTO_TREE) || have_custom_cols(&cf->cinfo))
+        create_proto_tree = TRUE;
+      else
+        create_proto_tree = FALSE;
+
+      /* The protocol tree will be "visible", i.e., printed, only if we're
+         printing packet details, which is true if we're printing stuff
+         ("print_packet_info" is true) and we're in verbose mode
+         ("packet_details" is true). */
+      edt = epan_dissect_new(cf->epan, create_proto_tree, print_packet_info && print_details);
+    }
+
+    while (local_wtap_read(cf, &file_phdr, &err, &err_info, &data_offset, &raw_data)) {
+
+      framenum++;
+
+      process_packet(cf, edt, data_offset, &file_phdr/*wtap_phdr(cf->wth)*/,
+                             raw_data, tap_flags);
+
+        /* Stop reading if we have the maximum number of packets;
+        * When the -c option has not been used, max_packet_count
+        * starts at 0, which practically means, never stop reading.
+        * (unless we roll over max_packet_count ?)
+        */
+        if ( (--max_packet_count == 0) || (max_byte_count != 0 && data_offset >= max_byte_count)) {
+            err = 0; /* This is not an error */
+            break;
+        }
+    }
+
+    if (edt) {
+      epan_dissect_free(edt);
+      edt = NULL;
+    }
+  }
+
+  if (err != 0) {
+    /*
+     * Print a message noting that the read failed somewhere along the line.
+     *
+     * If we're printing packet data, and the standard output and error are
+     * going to the same place, flush the standard output, so everything
+     * buffered up is written, and then print a newline to the standard error
+     * before printing the error message, to separate it from the packet
+     * data.  (Alas, that only works on UN*X; st_dev is meaningless, and
+     * the _fstat() documentation at Microsoft doesn't indicate whether
+     * st_ino is even supported.)
+     */
+#ifndef _WIN32
+    if (print_packet_info) {
+      struct stat stat_stdout, stat_stderr;
+
+      if (fstat(1, &stat_stdout) == 0 && fstat(2, &stat_stderr) == 0) {
+        if (stat_stdout.st_dev == stat_stderr.st_dev &&
+            stat_stdout.st_ino == stat_stderr.st_ino) {
+          fflush(stdout);
+          fprintf(stderr, "\n");
+        }
+      }
+    }
+#endif
+    switch (err) {
+
+    case FTAP_ERR_UNSUPPORTED:
+      cmdarg_err("The file \"%s\" contains record data that TFShark doesn't support.\n(%s)",
+                 cf->filename, err_info);
+      g_free(err_info);
+      break;
+
+    case FTAP_ERR_UNSUPPORTED_ENCAP:
+      cmdarg_err("The file \"%s\" has a packet with a network type that TFShark doesn't support.\n(%s)",
+                 cf->filename, err_info);
+      g_free(err_info);
+      break;
+
+    case FTAP_ERR_CANT_READ:
+      cmdarg_err("An attempt to read from the file \"%s\" failed for some unknown reason.",
+                 cf->filename);
+      break;
+
+    case FTAP_ERR_SHORT_READ:
+      cmdarg_err("The file \"%s\" appears to have been cut short in the middle of a packet.",
+                 cf->filename);
+      break;
+
+    case FTAP_ERR_BAD_FILE:
+      cmdarg_err("The file \"%s\" appears to be damaged or corrupt.\n(%s)",
+                 cf->filename, err_info);
+      g_free(err_info);
+      break;
+
+    case FTAP_ERR_DECOMPRESS:
+      cmdarg_err("The compressed file \"%s\" appears to be damaged or corrupt.\n"
+                 "(%s)", cf->filename, err_info);
+      break;
+
+    default:
+      cmdarg_err("An error occurred while reading the file \"%s\": %s.",
+                 cf->filename, ftap_strerror(err));
+      break;
+    }
+  } else {
+    if (print_packet_info) {
+      if (!write_finale()) {
+        err = errno;
+        show_print_file_io_error(err);
+      }
+    }
+  }
+
+out:
+  wtap_close(cf->wth);
+  cf->wth = NULL;
+
+  return err;
+}
+
+static gboolean
+process_packet(capture_file *cf, epan_dissect_t *edt, gint64 offset,
+               struct wtap_pkthdr *whdr, const guchar *pd, guint tap_flags)
+{
+  frame_data      fdata;
+  column_info    *cinfo;
+  gboolean        passed;
+
+  /* Count this packet. */
+  cf->count++;
+
+  /* If we're not running a display filter and we're not printing any
+     packet information, we don't need to do a dissection. This means
+     that all packets can be marked as 'passed'. */
+  passed = TRUE;
+
+  frame_data_init(&fdata, cf->count, whdr, offset, cum_bytes);
+
+  /* If we're going to print packet information, or we're going to
+     run a read filter, or we're going to process taps, set up to
+     do a dissection and do so. */
+  if (edt) {
+    /* If we're running a filter, prime the epan_dissect_t with that
+       filter. */
+    if (cf->dfcode)
+      epan_dissect_prime_dfilter(edt, cf->dfcode);
+
+    col_custom_prime_edt(edt, &cf->cinfo);
+
+    /* We only need the columns if either
+         1) some tap needs the columns
+       or
+         2) we're printing packet info but we're *not* verbose; in verbose
+            mode, we print the protocol tree, not the protocol summary.
+       or
+         3) there is a column mapped as an individual field */
+    if ((tap_flags & TL_REQUIRES_COLUMNS) || (print_packet_info && print_summary) || output_fields_has_cols(output_fields))
+      cinfo = &cf->cinfo;
+    else
+      cinfo = NULL;
+
+    frame_data_set_before_dissect(&fdata, &cf->elapsed_time,
+                                  &ref, prev_dis);
+    if (ref == &fdata) {
+      ref_frame = fdata;
+      ref = &ref_frame;
+    }
+
+    epan_dissect_file_run_with_taps(edt, whdr, frame_tvbuff_new(&fdata, pd), &fdata, cinfo);
+
+    /* Run the filter if we have it. */
+    if (cf->dfcode)
+      passed = dfilter_apply_edt(cf->dfcode, edt);
+  }
+
+  if (passed) {
+    frame_data_set_after_dissect(&fdata, &cum_bytes);
+
+    /* Process this packet. */
+    if (print_packet_info) {
+      /* We're printing packet information; print the information for
+         this packet. */
+      print_packet(cf, edt);
+
+      /* The ANSI C standard does not appear to *require* that a line-buffered
+         stream be flushed to the host environment whenever a newline is
+         written, it just says that, on such a stream, characters "are
+         intended to be transmitted to or from the host environment as a
+         block when a new-line character is encountered".
+
+         The Visual C++ 6.0 C implementation doesn't do what is intended;
+         even if you set a stream to be line-buffered, it still doesn't
+         flush the buffer at the end of every line.
+
+         So, if the "-l" flag was specified, we flush the standard output
+         at the end of a packet.  This will do the right thing if we're
+         printing packet summary lines, and, as we print the entire protocol
+         tree for a single packet without waiting for anything to happen,
+         it should be as good as line-buffered mode if we're printing
+         protocol trees.  (The whole reason for the "-l" flag in either
+         tcpdump or TShark is to allow the output of a live capture to
+         be piped to a program or script and to have that script see the
+         information for the packet as soon as it's printed, rather than
+         having to wait until a standard I/O buffer fills up. */
+      if (line_buffered)
+        fflush(stdout);
+
+      if (ferror(stdout)) {
+        show_print_file_io_error(errno);
+        exit(2);
+      }
+    }
+
+    /* this must be set after print_packet() [bug #8160] */
+    prev_dis_frame = fdata;
+    prev_dis = &prev_dis_frame;
+  }
+
+  prev_cap_frame = fdata;
+  prev_cap = &prev_cap_frame;
+
+  if (edt) {
+    epan_dissect_reset(edt);
+    frame_data_destroy(&fdata);
+  }
+  return passed;
+}
+
+static gboolean
+write_preamble(capture_file *cf)
+{
+  switch (output_action) {
+
+  case WRITE_TEXT:
+    return print_preamble(print_stream, cf ? cf->filename : NULL, wireshark_svnversion);
+
+  case WRITE_XML:
+    if (print_details)
+      write_pdml_preamble(stdout, cf ? cf->filename : NULL);
+    else
+      write_psml_preamble(stdout);
+    return !ferror(stdout);
+
+  case WRITE_FIELDS:
+    write_fields_preamble(output_fields, stdout);
+    return !ferror(stdout);
+
+  default:
+    g_assert_not_reached();
+    return FALSE;
+  }
+}
+
+static char *
+get_line_buf(size_t len)
+{
+  static char   *line_bufp    = NULL;
+  static size_t  line_buf_len = 256;
+  size_t         new_line_buf_len;
+
+  for (new_line_buf_len = line_buf_len; len > new_line_buf_len;
+       new_line_buf_len *= 2)
+    ;
+  if (line_bufp == NULL) {
+    line_buf_len = new_line_buf_len;
+    line_bufp = (char *)g_malloc(line_buf_len + 1);
+  } else {
+    if (new_line_buf_len > line_buf_len) {
+      line_buf_len = new_line_buf_len;
+      line_bufp = (char *)g_realloc(line_bufp, line_buf_len + 1);
+    }
+  }
+  return line_bufp;
+}
+
+static inline void
+put_string(char *dest, const char *str, size_t str_len)
+{
+  memcpy(dest, str, str_len);
+  dest[str_len] = '\0';
+}
+
+static inline void
+put_spaces_string(char *dest, const char *str, size_t str_len, size_t str_with_spaces)
+{
+  size_t i;
+
+  for (i = str_len; i < str_with_spaces; i++)
+    *dest++ = ' ';
+
+  put_string(dest, str, str_len);
+}
+
+static inline void
+put_string_spaces(char *dest, const char *str, size_t str_len, size_t str_with_spaces)
+{
+  size_t i;
+
+  memcpy(dest, str, str_len);
+  for (i = str_len; i < str_with_spaces; i++)
+    dest[i] = ' ';
+
+  dest[str_with_spaces] = '\0';
+}
+
+static gboolean
+print_columns(capture_file *cf)
+{
+  char   *line_bufp;
+  int     i;
+  size_t  buf_offset;
+  size_t  column_len;
+  size_t  col_len;
+
+  line_bufp = get_line_buf(256);
+  buf_offset = 0;
+  *line_bufp = '\0';
+  for (i = 0; i < cf->cinfo.num_cols; i++) {
+    /* Skip columns not marked as visible. */
+    if (!get_column_visible(i))
+      continue;
+    switch (cf->cinfo.col_fmt[i]) {
+    case COL_NUMBER:
+      column_len = col_len = strlen(cf->cinfo.col_data[i]);
+      if (column_len < 3)
+        column_len = 3;
+      line_bufp = get_line_buf(buf_offset + column_len);
+      put_spaces_string(line_bufp + buf_offset, cf->cinfo.col_data[i], col_len, column_len);
+      break;
+
+    case COL_CLS_TIME:
+    case COL_REL_TIME:
+    case COL_ABS_TIME:
+    case COL_ABS_YMD_TIME:  /* XXX - wider */
+    case COL_ABS_YDOY_TIME: /* XXX - wider */
+    case COL_UTC_TIME:
+    case COL_UTC_YMD_TIME:  /* XXX - wider */
+    case COL_UTC_YDOY_TIME: /* XXX - wider */
+      column_len = col_len = strlen(cf->cinfo.col_data[i]);
+      if (column_len < 10)
+        column_len = 10;
+      line_bufp = get_line_buf(buf_offset + column_len);
+      put_spaces_string(line_bufp + buf_offset, cf->cinfo.col_data[i], col_len, column_len);
+      break;
+
+    case COL_DEF_SRC:
+    case COL_RES_SRC:
+    case COL_UNRES_SRC:
+    case COL_DEF_DL_SRC:
+    case COL_RES_DL_SRC:
+    case COL_UNRES_DL_SRC:
+    case COL_DEF_NET_SRC:
+    case COL_RES_NET_SRC:
+    case COL_UNRES_NET_SRC:
+      column_len = col_len = strlen(cf->cinfo.col_data[i]);
+      if (column_len < 12)
+        column_len = 12;
+      line_bufp = get_line_buf(buf_offset + column_len);
+      put_spaces_string(line_bufp + buf_offset, cf->cinfo.col_data[i], col_len, column_len);
+      break;
+
+    case COL_DEF_DST:
+    case COL_RES_DST:
+    case COL_UNRES_DST:
+    case COL_DEF_DL_DST:
+    case COL_RES_DL_DST:
+    case COL_UNRES_DL_DST:
+    case COL_DEF_NET_DST:
+    case COL_RES_NET_DST:
+    case COL_UNRES_NET_DST:
+      column_len = col_len = strlen(cf->cinfo.col_data[i]);
+      if (column_len < 12)
+        column_len = 12;
+      line_bufp = get_line_buf(buf_offset + column_len);
+      put_string_spaces(line_bufp + buf_offset, cf->cinfo.col_data[i], col_len, column_len);
+      break;
+
+    default:
+      column_len = strlen(cf->cinfo.col_data[i]);
+      line_bufp = get_line_buf(buf_offset + column_len);
+      put_string(line_bufp + buf_offset, cf->cinfo.col_data[i], column_len);
+      break;
+    }
+    buf_offset += column_len;
+    if (i != cf->cinfo.num_cols - 1) {
+      /*
+       * This isn't the last column, so we need to print a
+       * separator between this column and the next.
+       *
+       * If we printed a network source and are printing a
+       * network destination of the same type next, separate
+       * them with " -> "; if we printed a network destination
+       * and are printing a network source of the same type
+       * next, separate them with " <- "; otherwise separate them
+       * with a space.
+       *
+       * We add enough space to the buffer for " <- " or " -> ",
+       * even if we're only adding " ".
+       */
+      line_bufp = get_line_buf(buf_offset + 4);
+      switch (cf->cinfo.col_fmt[i]) {
+
+      case COL_DEF_SRC:
+      case COL_RES_SRC:
+      case COL_UNRES_SRC:
+        switch (cf->cinfo.col_fmt[i + 1]) {
+
+        case COL_DEF_DST:
+        case COL_RES_DST:
+        case COL_UNRES_DST:
+          put_string(line_bufp + buf_offset, " -> ", 4);
+          buf_offset += 4;
+          break;
+
+        default:
+          put_string(line_bufp + buf_offset, " ", 1);
+          buf_offset += 1;
+          break;
+        }
+        break;
+
+      case COL_DEF_DL_SRC:
+      case COL_RES_DL_SRC:
+      case COL_UNRES_DL_SRC:
+        switch (cf->cinfo.col_fmt[i + 1]) {
+
+        case COL_DEF_DL_DST:
+        case COL_RES_DL_DST:
+        case COL_UNRES_DL_DST:
+          put_string(line_bufp + buf_offset, " -> ", 4);
+          buf_offset += 4;
+          break;
+
+        default:
+          put_string(line_bufp + buf_offset, " ", 1);
+          buf_offset += 1;
+          break;
+        }
+        break;
+
+      case COL_DEF_NET_SRC:
+      case COL_RES_NET_SRC:
+      case COL_UNRES_NET_SRC:
+        switch (cf->cinfo.col_fmt[i + 1]) {
+
+        case COL_DEF_NET_DST:
+        case COL_RES_NET_DST:
+        case COL_UNRES_NET_DST:
+          put_string(line_bufp + buf_offset, " -> ", 4);
+          buf_offset += 4;
+          break;
+
+        default:
+          put_string(line_bufp + buf_offset, " ", 1);
+          buf_offset += 1;
+          break;
+        }
+        break;
+
+      case COL_DEF_DST:
+      case COL_RES_DST:
+      case COL_UNRES_DST:
+        switch (cf->cinfo.col_fmt[i + 1]) {
+
+        case COL_DEF_SRC:
+        case COL_RES_SRC:
+        case COL_UNRES_SRC:
+          put_string(line_bufp + buf_offset, " <- ", 4);
+          buf_offset += 4;
+          break;
+
+        default:
+          put_string(line_bufp + buf_offset, " ", 1);
+          buf_offset += 1;
+          break;
+        }
+        break;
+
+      case COL_DEF_DL_DST:
+      case COL_RES_DL_DST:
+      case COL_UNRES_DL_DST:
+        switch (cf->cinfo.col_fmt[i + 1]) {
+
+        case COL_DEF_DL_SRC:
+        case COL_RES_DL_SRC:
+        case COL_UNRES_DL_SRC:
+          put_string(line_bufp + buf_offset, " <- ", 4);
+          buf_offset += 4;
+          break;
+
+        default:
+          put_string(line_bufp + buf_offset, " ", 1);
+          buf_offset += 1;
+          break;
+        }
+        break;
+
+      case COL_DEF_NET_DST:
+      case COL_RES_NET_DST:
+      case COL_UNRES_NET_DST:
+        switch (cf->cinfo.col_fmt[i + 1]) {
+
+        case COL_DEF_NET_SRC:
+        case COL_RES_NET_SRC:
+        case COL_UNRES_NET_SRC:
+          put_string(line_bufp + buf_offset, " <- ", 4);
+          buf_offset += 4;
+          break;
+
+        default:
+          put_string(line_bufp + buf_offset, " ", 1);
+          buf_offset += 1;
+          break;
+        }
+        break;
+
+      default:
+        put_string(line_bufp + buf_offset, " ", 1);
+        buf_offset += 1;
+        break;
+      }
+    }
+  }
+  return print_line(print_stream, 0, line_bufp);
+}
+
+static gboolean
+print_packet(capture_file *cf, epan_dissect_t *edt)
+{
+  print_args_t print_args;
+
+  if (print_summary || output_fields_has_cols(output_fields)) {
+    /* Just fill in the columns. */
+    epan_dissect_fill_in_columns(edt, FALSE, TRUE);
+
+    if (print_summary) {
+      /* Now print them. */
+      switch (output_action) {
+
+      case WRITE_TEXT:
+        if (!print_columns(cf))
+          return FALSE;
+        break;
+
+      case WRITE_XML:
+        proto_tree_write_psml(edt, stdout);
+        return !ferror(stdout);
+      case WRITE_FIELDS: /*No non-verbose "fields" format */
+        g_assert_not_reached();
+        break;
+      }
+    }
+  }
+  if (print_details) {
+    /* Print the information in the protocol tree. */
+    switch (output_action) {
+
+    case WRITE_TEXT:
+      /* Only initialize the fields that are actually used in proto_tree_print.
+       * This is particularly important for .range, as that's heap memory which
+       * we would otherwise have to g_free().
+      print_args.to_file = TRUE;
+      print_args.format = print_format;
+      print_args.print_summary = print_summary;
+      print_args.print_formfeed = FALSE;
+      packet_range_init(&print_args.range, &cfile);
+      */
+      print_args.print_hex = print_hex;
+      print_args.print_dissections = print_details ? print_dissections_expanded : print_dissections_none;
+
+      if (!proto_tree_print(&print_args, edt, print_stream))
+        return FALSE;
+      if (!print_hex) {
+        if (!print_line(print_stream, 0, separator))
+          return FALSE;
+      }
+      break;
+
+    case WRITE_XML:
+      proto_tree_write_pdml(edt, stdout);
+      printf("\n");
+      return !ferror(stdout);
+    case WRITE_FIELDS:
+      proto_tree_write_fields(output_fields, edt, &cf->cinfo, stdout);
+      printf("\n");
+      return !ferror(stdout);
+    }
+  }
+  if (print_hex) {
+    if (print_summary || print_details) {
+      if (!print_line(print_stream, 0, ""))
+        return FALSE;
+    }
+    if (!print_hex_data(print_stream, edt))
+      return FALSE;
+    if (!print_line(print_stream, 0, separator))
+      return FALSE;
+  }
+  return TRUE;
+}
+
+static gboolean
+write_finale(void)
+{
+  switch (output_action) {
+
+  case WRITE_TEXT:
+    return print_finale(print_stream);
+
+  case WRITE_XML:
+    if (print_details)
+      write_pdml_finale(stdout);
+    else
+      write_psml_finale(stdout);
+    return !ferror(stdout);
+
+  case WRITE_FIELDS:
+    write_fields_finale(output_fields, stdout);
+    return !ferror(stdout);
+
+  default:
+    g_assert_not_reached();
+    return FALSE;
+  }
+}
+
+cf_status_t
+cf_open(capture_file *cf, const char *fname, gboolean is_tempfile, int *err)
+{
+#if USE_FTAP
+  ftap  *fth;
+#else
+  wtap  *wth;
+#endif
+  gchar *err_info;
+  char   err_msg[2048+1];
+
+#if USE_FTAP
+  fth = ftap_open_offline(fname, err, &err_info, perform_two_pass_analysis);
+  if (fth == NULL)
+    goto fail;
+#else
+  wth = wtap_open_offline(fname, err, &err_info, perform_two_pass_analysis);
+  if (wth == NULL)
+    goto fail;
+#endif
+
+  /* The open succeeded.  Fill in the information for this file. */
+
+  /* Create new epan session for dissection. */
+  epan_free(cf->epan);
+  cf->epan = tfshark_epan_new(cf);
+
+#if USE_FTAP
+  cf->wth = (struct wtap*)fth; /**** XXX - DOESN'T WORK RIGHT NOW!!!! */
+#else
+  cf->wth = wth;
+#endif
+  cf->f_datalen = 0; /* not used, but set it anyway */
+
+  /* Set the file name because we need it to set the follow stream filter.
+     XXX - is that still true?  We need it for other reasons, though,
+     in any case. */
+  cf->filename = g_strdup(fname);
+
+  /* Indicate whether it's a permanent or temporary file. */
+  cf->is_tempfile = is_tempfile;
+
+  /* No user changes yet. */
+  cf->unsaved_changes = FALSE;
+
+  cf->cd_t      = ftap_file_type_subtype((struct ftap*)cf->wth); /**** XXX - DOESN'T WORK RIGHT NOW!!!! */
+  cf->count     = 0;
+  cf->drops_known = FALSE;
+  cf->drops     = 0;
+  cf->snap      = ftap_snapshot_length((struct ftap*)cf->wth); /**** XXX - DOESN'T WORK RIGHT NOW!!!! */
+  if (cf->snap == 0) {
+    /* Snapshot length not known. */
+    cf->has_snap = FALSE;
+    cf->snap = FTAP_MAX_RECORD_SIZE;
+  } else
+    cf->has_snap = TRUE;
+  nstime_set_zero(&cf->elapsed_time);
+  ref = NULL;
+  prev_dis = NULL;
+  prev_cap = NULL;
+
+  cf->state = FILE_READ_IN_PROGRESS;
+
+  return CF_OK;
+
+fail:
+  g_snprintf(err_msg, sizeof err_msg,
+             cf_open_error_message(*err, err_info, FALSE, cf->cd_t), fname);
+  cmdarg_err("%s", err_msg);
+  return CF_ERROR;
+}
+
+static void
+show_print_file_io_error(int err)
+{
+  switch (err) {
+
+  case ENOSPC:
+    cmdarg_err("Not all the packets could be printed because there is "
+"no space left on the file system.");
+    break;
+
+#ifdef EDQUOT
+  case EDQUOT:
+    cmdarg_err("Not all the packets could be printed because you are "
+"too close to, or over your disk quota.");
+  break;
+#endif
+
+  default:
+    cmdarg_err("An error occurred while printing packets: %s.",
+      g_strerror(err));
+    break;
+  }
+}
+
+static const char *
+cf_open_error_message(int err, gchar *err_info, gboolean for_writing,
+                      int file_type)
+{
+  const char *errmsg;
+  static char errmsg_errno[1024+1];
+
+  if (err < 0) {
+    /* Wiretap error. */
+    switch (err) {
+
+    case FTAP_ERR_NOT_REGULAR_FILE:
+      errmsg = "The file \"%s\" is a \"special file\" or socket or other non-regular file.";
+      break;
+
+    case FTAP_ERR_RANDOM_OPEN_PIPE:
+      /* Seen only when opening a capture file for reading. */
+      errmsg = "The file \"%s\" is a pipe or FIFO; TFShark can't read pipe or FIFO files in two-pass mode.";
+      break;
+
+    case FTAP_ERR_FILE_UNKNOWN_FORMAT:
+      /* Seen only when opening a capture file for reading. */
+      errmsg = "The file \"%s\" isn't a capture file in a format TFShark understands.";
+      break;
+
+    case FTAP_ERR_UNSUPPORTED:
+      /* Seen only when opening a capture file for reading. */
+      g_snprintf(errmsg_errno, sizeof(errmsg_errno),
+               "The file \"%%s\" isn't a capture file in a format TFShark understands.\n"
+               "(%s)", err_info);
+      g_free(err_info);
+      errmsg = errmsg_errno;
+      break;
+
+    case FTAP_ERR_CANT_WRITE_TO_PIPE:
+      /* Seen only when opening a capture file for writing. */
+      g_snprintf(errmsg_errno, sizeof(errmsg_errno),
+                 "The file \"%%s\" is a pipe, and \"%s\" capture files can't be "
+                 "written to a pipe.", ftap_file_type_subtype_short_string(file_type));
+      errmsg = errmsg_errno;
+      break;
+
+    case FTAP_ERR_UNSUPPORTED_FILE_TYPE:
+      /* Seen only when opening a capture file for writing. */
+      errmsg = "TFShark doesn't support writing capture files in that format.";
+      break;
+
+    case FTAP_ERR_UNSUPPORTED_ENCAP:
+      if (for_writing) {
+        g_snprintf(errmsg_errno, sizeof(errmsg_errno),
+                   "TFShark can't save this capture as a \"%s\" file.",
+                   ftap_file_type_subtype_short_string(file_type));
+      } else {
+        g_snprintf(errmsg_errno, sizeof(errmsg_errno),
+                 "The file \"%%s\" is a capture for a network type that TFShark doesn't support.\n"
+                 "(%s)", err_info);
+        g_free(err_info);
+      }
+      errmsg = errmsg_errno;
+      break;
+
+    case FTAP_ERR_ENCAP_PER_RECORD_UNSUPPORTED:
+      if (for_writing) {
+        g_snprintf(errmsg_errno, sizeof(errmsg_errno),
+                   "TFShark can't save this capture as a \"%s\" file.",
+                   ftap_file_type_subtype_short_string(file_type));
+        errmsg = errmsg_errno;
+      } else
+        errmsg = "The file \"%s\" is a capture for a network type that TFShark doesn't support.";
+      break;
+
+    case FTAP_ERR_BAD_FILE:
+      /* Seen only when opening a capture file for reading. */
+      g_snprintf(errmsg_errno, sizeof(errmsg_errno),
+               "The file \"%%s\" appears to be damaged or corrupt.\n"
+               "(%s)", err_info);
+      g_free(err_info);
+      errmsg = errmsg_errno;
+      break;
+
+    case FTAP_ERR_CANT_OPEN:
+      if (for_writing)
+        errmsg = "The file \"%s\" could not be created for some unknown reason.";
+      else
+        errmsg = "The file \"%s\" could not be opened for some unknown reason.";
+      break;
+
+    case FTAP_ERR_SHORT_READ:
+      errmsg = "The file \"%s\" appears to have been cut short"
+               " in the middle of a packet or other data.";
+      break;
+
+    case FTAP_ERR_SHORT_WRITE:
+      errmsg = "A full header couldn't be written to the file \"%s\".";
+      break;
+
+    case FTAP_ERR_COMPRESSION_NOT_SUPPORTED:
+      errmsg = "This file type cannot be written as a compressed file.";
+      break;
+
+    case FTAP_ERR_DECOMPRESS:
+      /* Seen only when opening a capture file for reading. */
+      g_snprintf(errmsg_errno, sizeof(errmsg_errno),
+                 "The compressed file \"%%s\" appears to be damaged or corrupt.\n"
+                 "(%s)", err_info);
+      g_free(err_info);
+      errmsg = errmsg_errno;
+      break;
+
+    default:
+      g_snprintf(errmsg_errno, sizeof(errmsg_errno),
+                 "The file \"%%s\" could not be %s: %s.",
+                 for_writing ? "created" : "opened",
+                 ftap_strerror(err));
+      errmsg = errmsg_errno;
+      break;
+    }
+  } else
+    errmsg = file_open_error_message(err, for_writing);
+  return errmsg;
+}
+
+/*
+ * Open/create errors are reported with an console message in TFShark.
+ */
+static void
+open_failure_message(const char *filename, int err, gboolean for_writing)
+{
+  fprintf(stderr, "tfshark: ");
+  fprintf(stderr, file_open_error_message(err, for_writing), filename);
+  fprintf(stderr, "\n");
+}
+
+
+/*
+ * General errors are reported with an console message in TFShark.
+ */
+static void
+failure_message(const char *msg_format, va_list ap)
+{
+  fprintf(stderr, "tfshark: ");
+  vfprintf(stderr, msg_format, ap);
+  fprintf(stderr, "\n");
+}
+
+/*
+ * Read errors are reported with an console message in TFShark.
+ */
+static void
+read_failure_message(const char *filename, int err)
+{
+  cmdarg_err("An error occurred while reading from the file \"%s\": %s.",
+          filename, g_strerror(err));
+}
+
+/*
+ * Write errors are reported with an console message in TFShark.
+ */
+static void
+write_failure_message(const char *filename, int err)
+{
+  cmdarg_err("An error occurred while writing to the file \"%s\": %s.",
+          filename, g_strerror(err));
+}
+
+/*
+ * Report an error in command-line arguments.
+ */
+void
+cmdarg_err(const char *fmt, ...)
+{
+  va_list ap;
+
+  va_start(ap, fmt);
+  failure_message(fmt, ap);
+  va_end(ap);
+}
+
+/*
+ * Report additional information for an error in command-line arguments.
+ */
+void
+cmdarg_err_cont(const char *fmt, ...)
+{
+  va_list ap;
+
+  va_start(ap, fmt);
+  vfprintf(stderr, fmt, ap);
+  fprintf(stderr, "\n");
+  va_end(ap);
+}
+
+
+/*
+ * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 2
+ * tab-width: 8
+ * indent-tabs-mode: nil
+ * End:
+ *
+ * vi: set shiftwidth=2 tabstop=8 expandtab:
+ * :indentSize=2:tabSize=8:noTabs=true:
+ */
index 1c96f15f86cf683d28671306668c32e00571ae99..0d238fe0205a25ad274d67653b4f605a11362ab9 100644 (file)
@@ -20,8 +20,8 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
-#ifndef __FILE_H__
-#define __FILE_H__
+#ifndef __WTAP_FILE_WRAPPERS_H__
+#define __WTAP_FILE_WRAPPERS_H__
 
 #include <glib.h>
 #include <wtap.h>