Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] wtap_dump_file_seek() and _tell()

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 3 Mar 2013 11:48:15 -0800
On Mar 3, 2013, at 11:10 AM, Ed Beroset <beroset@xxxxxxxxxxxxxx> wrote:

> According to svn, version 36318 (March 2011) added, among other things, the following lines to the wiretap/wtap-int.h file:
> 
> extern gint64 wtap_dump_file_seek(wtap_dumper *wdh, gint64 offset, int whence, int *err);
> extern gint64 wtap_dump_file_tell(wtap_dumper *wdh);
> 
> However, unlike most of the corresponding functions which are implemented in wiretap/file_access.c these two have no implementations.

Gerald?  Planned but never implemented?

> In 18 places within the code involving seven files (5view.c, k12,c, lanalyzer.c, netmon.c, netscaler.c, netxray.c, visual.c) either an ftell or fseek is used which does an implicit conversion from WFILE_T to struct FILE * which is an incompatibility with C++.  I could have added casts to each location, but it seems that the neater way to do this would be to actually implement these function.  I understand that seek() and tell() won't work every time (e.g. pipes or stdin),

"pipes or terminals" - if stdout (as this is for dumping, it'd be stdout rather than stdin) were a file, *seek() and *tell() would work, and if stdout were a pipe (a terminal would be silly, unless you *like* reading random binary byte streams as they come out on your terminal or terminal emulator or the file format being written is a text file format) certain file formats simply can't be written (unless we do the dumping in a two-pass process or otherwise compute certain information that appears earlier in the file beforehand).

More importantly, you *also* wouldn't be able to write them out if they're gzipped, and we *do* support writing out gzipped files.

> but these places in the code are doing it anyway.  How should we best resolve this? Should I implement the functions?

Might as well.  They'd belong with the others in file_access.c, and should fail if wdh->compressed is set.  (We already have wtap_dump_can_compress(), which checks whether writing the file format requires a seek, so no Wireshark code should be trying to write out a compressed file in any of those formats.)

We should probably define a new WTAP_ERR_CANT_SEEK_COMPRESSED value and return it as the error value if a seek is attempted on a compressed stream.

file_tell() should probably also have an "int *err" argument, as ftell() can fail.

For now, you can probably just cast the "offset" arguments to int, as the SEEK_SET seeks are to a location in the beginning of the file, and the SEEK_CUR seeks have short offsets.  We'd bury fseeko()/whatever the Windows equivalent is/etc. stuff in those routines if we ever need to fully support 64-bit offsets.