Adding upstream version 4.2.2.upstream/4.2.2

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 957 insertions, 0 deletions

diff --git a/wiretap/observer.c b/wiretap/observer.c
new file mode 100644
index 0000000..6a745c1
--- /dev/null
+++ b/wiretap/observer.c
@@ -0,0 +1,957 @@
+/***************************************************************************
+                          observer.c  -  description
+                             -------------------
+    begin                : Wed Oct 29 2003
+    copyright            : (C) 2003 by root
+    email                : scotte[AT}netinst.com
+ ***************************************************************************/
+
+/***************************************************************************
+ *                                                                         *
+ *  SPDX-License-Identifier: GPL-2.0-or-later                              *
+ *                                                                         *
+ ***************************************************************************/
+
+#include "config.h"
+
+#include <stdlib.h>
+#include <string.h>
+#include "wtap-int.h"
+#include "file_wrappers.h"
+#include "observer.h"
+#include <wsutil/802_11-utils.h>
+
+static const char observer_magic[] = {"ObserverPktBufferVersion=15.00"};
+static const int true_magic_length = 17;
+
+static const guint32 observer_packet_magic = 0x88888888;
+
+/*
+ * This structure is used to keep state when writing files. An instance is
+ * allocated for each file, and its address is stored in the wtap_dumper.priv
+ * pointer field.
+ */
+typedef struct {
+    guint64 packet_count;
+    guint8  network_type;
+    guint32 time_format;
+} observer_dump_private_state;
+
+/*
+ * Some time offsets are calculated in advance here, when the first Observer
+ * file is opened for reading or writing, and are then used to adjust frame
+ * timestamps as they are read or written.
+ *
+ * The Wiretap API expects timestamps in nanoseconds relative to
+ * January 1, 1970, 00:00:00 GMT (the Wiretap epoch).
+ *
+ * Observer versions before 13.10 encode frame timestamps in nanoseconds
+ * relative to January 1, 2000, 00:00:00 local time (the Observer epoch).
+ * Versions 13.10 and later switch over to GMT encoding. Which encoding was used
+ * when saving the file is identified via the time format TLV following
+ * the file header.
+ *
+ * Unfortunately, even though Observer versions before 13.10 saved in local
+ * time, they didn't include the timezone from which the frames were captured,
+ * so converting to GMT correctly from all timezones is impossible. So an
+ * assumption is made that the file is being read from within the same timezone
+ * that it was written.
+ *
+ * All code herein is normalized to versions 13.10 and later, special casing for
+ * versions earlier. In other words, timestamps are worked with as if
+ * they are GMT-encoded, and adjustments from local time are made only if
+ * the source file warrants it.
+ *
+ * All destination files are saved in GMT format.
+ */
+static const time_t ansi_to_observer_epoch_offset = 946684800;
+static time_t gmt_to_localtime_offset = (time_t) -1;
+
+static const char *init_gmt_to_localtime_offset(void)
+{
+    if (gmt_to_localtime_offset == (time_t) -1) {
+        time_t ansi_epoch_plus_one_day = 86400;
+        struct tm *tm;
+        struct tm gmt_tm;
+        struct tm local_tm;
+
+        /*
+         * Compute the local time zone offset as the number of seconds west
+         * of GMT. There's no obvious cross-platform API for querying this
+         * directly. As a workaround, GMT and local tm structures are populated
+         * relative to the ANSI time_t epoch (plus one day to ensure that
+         * local time stays after 1970/1/1 00:00:00). They are then converted
+         * back to time_t as if they were both local times, resulting in the
+         * time zone offset being the difference between them.
+         */
+        tm = gmtime(&ansi_epoch_plus_one_day);
+        if (tm == NULL)
+            return "gmtime(one day past the Epoch) fails (this \"shouldn't happen\")";
+        gmt_tm = *tm;
+        tm = localtime(&ansi_epoch_plus_one_day);
+        if (tm == NULL)
+            return "localtime(one day past the Epoch) fails (this \"shouldn't happen\")";
+        local_tm = *tm;
+        local_tm.tm_isdst = 0;
+        gmt_to_localtime_offset = mktime(&gmt_tm) - mktime(&local_tm);
+    }
+    return NULL;
+}
+
+static gboolean observer_read(wtap *wth, wtap_rec *rec, Buffer *buf,
+    int *err, gchar **err_info, gint64 *data_offset);
+static gboolean observer_seek_read(wtap *wth, gint64 seek_off,
+    wtap_rec *rec, Buffer *buf, int *err, gchar **err_info);
+static int read_packet_header(wtap *wth, FILE_T fh, union wtap_pseudo_header *pseudo_header,
+    packet_entry_header *packet_header, int *err, gchar **err_info);
+static gboolean process_packet_header(wtap *wth,
+    packet_entry_header *packet_header, wtap_rec *rec, int *err,
+    gchar **err_info);
+static int read_packet_data(FILE_T fh, int offset_to_frame, int current_offset_from_packet_header,
+    Buffer *buf, int length, int *err, char **err_info);
+static gboolean skip_to_next_packet(wtap *wth, int offset_to_next_packet,
+    int current_offset_from_packet_header, int *err, char **err_info);
+static gboolean observer_dump(wtap_dumper *wdh, const wtap_rec *rec,
+    const guint8 *pd, int *err, gchar **err_info);
+static gint observer_to_wtap_encap(int observer_encap);
+static gint wtap_to_observer_encap(int wtap_encap);
+
+static int observer_file_type_subtype = -1;
+
+void register_observer(void);
+
+wtap_open_return_val observer_open(wtap *wth, int *err, gchar **err_info)
+{
+    guint offset;
+    capture_file_header file_header;
+    guint header_offset;
+    guint i;
+    tlv_header tlvh;
+    guint seek_increment;
+    packet_entry_header packet_header;
+    observer_dump_private_state * private_state = NULL;
+    const char *err_str;
+
+    offset = 0;
+
+    /* read in the buffer file header */
+    if (!wtap_read_bytes(wth->fh, &file_header, sizeof file_header,
+                         err, err_info)) {
+        if (*err != WTAP_ERR_SHORT_READ)
+            return WTAP_OPEN_ERROR;
+        return WTAP_OPEN_NOT_MINE;
+    }
+    offset += (guint)sizeof file_header;
+    CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE(file_header);
+
+    /* check if version info is present */
+    if (memcmp(file_header.observer_version, observer_magic, true_magic_length)!=0) {
+        return WTAP_OPEN_NOT_MINE;
+    }
+
+    /* get the location of the first packet */
+    /* v15 and newer uses high byte offset, in previous versions it will be 0 */
+    header_offset = file_header.offset_to_first_packet + ((guint)(file_header.offset_to_first_packet_high_byte)<<16);
+
+    if (offset > header_offset) {
+        /*
+         * The packet data begins before the file header ends.
+         */
+        *err = WTAP_ERR_BAD_FILE;
+        *err_info = ws_strdup_printf("Observer: The first packet begins in the middle of the file header");
+        return WTAP_OPEN_ERROR;
+    }
+
+    /* initialize the private state */
+    private_state = g_new(observer_dump_private_state, 1);
+    private_state->time_format = TIME_INFO_LOCAL;
+    wth->priv = (void *) private_state;
+
+    /* process extra information */
+    for (i = 0; i < file_header.number_of_information_elements; i++) {
+        guint tlv_data_length;
+
+        /*
+         * Make sure reading the TLV header won't put us in the middle
+         * of the packet data.
+         */
+        if (offset + (guint)sizeof tlvh > header_offset) {
+            /*
+             * We're at or past the point where the packet data begins,
+             * but we have the IE header to read.
+             */
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = ws_strdup_printf("Observer: TLVs run into the first packet data");
+            return WTAP_OPEN_ERROR;
+        }
+
+        /* read the TLV header */
+        if (!wtap_read_bytes(wth->fh, &tlvh, sizeof tlvh, err, err_info))
+            return WTAP_OPEN_ERROR;
+        offset += (guint)sizeof tlvh;
+        TLV_HEADER_FROM_LE_IN_PLACE(tlvh);
+
+        if (tlvh.length < sizeof tlvh) {
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = ws_strdup_printf("Observer: bad record (TLV length %u < %zu)",
+                tlvh.length, sizeof tlvh);
+            return WTAP_OPEN_ERROR;
+        }
+
+        tlv_data_length = tlvh.length - (guint)sizeof tlvh;
+        /*
+         * Make sure reading the TLV data won't put us in the middle
+         * of the packet data.
+         */
+        if (offset + tlv_data_length > header_offset) {
+            /*
+             * We're at or past the point where the packet data begins,
+             * but we have the IE data to read.
+             */
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = ws_strdup_printf("Observer: TLVs run into the first packet data");
+            return WTAP_OPEN_ERROR;
+        }
+
+
+        /* process (or skip over) the current TLV */
+        switch (tlvh.type) {
+        case INFORMATION_TYPE_TIME_INFO:
+            if (tlv_data_length != sizeof private_state->time_format) {
+                *err = WTAP_ERR_BAD_FILE;
+                *err_info = ws_strdup_printf("Observer: bad record (time information TLV length %u != %zu)",
+                    tlvh.length,
+                    sizeof tlvh + sizeof private_state->time_format);
+                return WTAP_OPEN_ERROR;
+            }
+            if (!wtap_read_bytes(wth->fh, &private_state->time_format,
+                                 sizeof private_state->time_format,
+                                 err, err_info))
+                return WTAP_OPEN_ERROR;
+            private_state->time_format = GUINT32_FROM_LE(private_state->time_format);
+            offset += (guint)sizeof private_state->time_format;
+            break;
+        default:
+            if (tlv_data_length != 0) {
+                if (!wtap_read_bytes(wth->fh, NULL, tlv_data_length, err, err_info))
+                    return WTAP_OPEN_ERROR;
+            }
+            offset += tlv_data_length;
+        }
+    }
+
+    /* get to the first packet */
+    seek_increment = header_offset - offset;
+    if (seek_increment != 0) {
+        if (!wtap_read_bytes(wth->fh, NULL, seek_increment, err, err_info))
+            return WTAP_OPEN_ERROR;
+    }
+
+    /*
+     * We assume that all packets in a file have the same network type,
+     * whether they're data or expert information packets, and thus
+     * we can attempt to determine the network type by reading the
+     * first packet.
+     *
+     * If that's *not* the case, we need to use WTAP_ENCAP_PER_PACKET.
+     *
+     * Read the packet header.  Don't assume there *is* a packet;
+     * if there isn't, report that as a bad file.  (If we use
+     * WTAP_ENCAP_PER_PACKET, we don't need to handle that case, as
+     * we don't need to read the first packet.
+     */
+    if (!wtap_read_bytes_or_eof(wth->fh, &packet_header, sizeof packet_header,
+                                err, err_info)) {
+        if (*err == 0) {
+            /*
+             * EOF, so there *are* no records.
+             */
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = ws_strdup_printf("Observer: No records in the file, so we can't determine the link-layer type");
+        }
+        return WTAP_OPEN_ERROR;
+    }
+    PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE(packet_header);
+
+    /* check the packet's magic number */
+    if (packet_header.packet_magic != observer_packet_magic) {
+        *err = WTAP_ERR_UNSUPPORTED;
+        *err_info = ws_strdup_printf("Observer: unsupported packet version %ul", packet_header.packet_magic);
+        return WTAP_OPEN_ERROR;
+    }
+
+    /* check the data link type */
+    if (observer_to_wtap_encap(packet_header.network_type) == WTAP_ENCAP_UNKNOWN) {
+        *err = WTAP_ERR_UNSUPPORTED;
+        *err_info = ws_strdup_printf("Observer: network type %u unknown or unsupported", packet_header.network_type);
+        return WTAP_OPEN_ERROR;
+    }
+    wth->file_encap = observer_to_wtap_encap(packet_header.network_type);
+
+    /* set up the rest of the capture parameters */
+    private_state->packet_count = 0;
+    private_state->network_type = wtap_to_observer_encap(wth->file_encap);
+    wth->subtype_read = observer_read;
+    wth->subtype_seek_read = observer_seek_read;
+    wth->subtype_close = NULL;
+    wth->subtype_sequential_close = NULL;
+    wth->snapshot_length = 0;    /* not available in header */
+    wth->file_tsprec = WTAP_TSPREC_NSEC;
+    wth->file_type_subtype = observer_file_type_subtype;
+
+    /* reset the pointer to the first packet */
+    if (file_seek(wth->fh, header_offset, SEEK_SET, err) == -1)
+        return WTAP_OPEN_ERROR;
+
+    err_str = init_gmt_to_localtime_offset();
+    if (err_str != NULL) {
+        *err = WTAP_ERR_INTERNAL;
+        *err_info = ws_strdup_printf("observer: %s", err_str);
+        return WTAP_OPEN_ERROR;
+    }
+
+    /*
+     * Add an IDB; we don't know how many interfaces were
+     * involved, so we just say one interface, about which
+     * we only know the link-layer type, snapshot length,
+     * and time stamp resolution.
+     */
+    wtap_add_generated_idb(wth);
+
+    return WTAP_OPEN_MINE;
+}
+
+/* Reads the next packet. */
+static gboolean observer_read(wtap *wth, wtap_rec *rec, Buffer *buf,
+    int *err, gchar **err_info, gint64 *data_offset)
+{
+    int header_bytes_consumed;
+    int data_bytes_consumed;
+    packet_entry_header packet_header;
+
+    /* skip records other than data records */
+    for (;;) {
+        *data_offset = file_tell(wth->fh);
+
+        /* process the packet header, including TLVs */
+        header_bytes_consumed = read_packet_header(wth, wth->fh, &rec->rec_header.packet_header.pseudo_header, &packet_header, err,
+            err_info);
+        if (header_bytes_consumed <= 0)
+            return FALSE;    /* EOF or error */
+
+        if (packet_header.packet_type == PACKET_TYPE_DATA_PACKET)
+            break;
+
+        /* skip to next packet */
+        if (!skip_to_next_packet(wth, packet_header.offset_to_next_packet,
+                header_bytes_consumed, err, err_info)) {
+            return FALSE;    /* EOF or error */
+        }
+    }
+
+    if (!process_packet_header(wth, &packet_header, rec, err, err_info))
+        return FALSE;
+
+    /* read the frame data */
+    data_bytes_consumed = read_packet_data(wth->fh, packet_header.offset_to_frame,
+            header_bytes_consumed, buf, rec->rec_header.packet_header.caplen,
+            err, err_info);
+    if (data_bytes_consumed < 0) {
+        return FALSE;
+    }
+
+    /* skip over any extra bytes following the frame data */
+    if (!skip_to_next_packet(wth, packet_header.offset_to_next_packet,
+            header_bytes_consumed + data_bytes_consumed, err, err_info)) {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/* Reads a packet at an offset. */
+static gboolean observer_seek_read(wtap *wth, gint64 seek_off,
+    wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
+{
+    union wtap_pseudo_header *pseudo_header = &rec->rec_header.packet_header.pseudo_header;
+    packet_entry_header packet_header;
+    int offset;
+    int data_bytes_consumed;
+
+    if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
+        return FALSE;
+
+    /* process the packet header, including TLVs */
+    offset = read_packet_header(wth, wth->random_fh, pseudo_header, &packet_header, err,
+        err_info);
+    if (offset <= 0)
+        return FALSE;    /* EOF or error */
+
+    if (!process_packet_header(wth, &packet_header, rec, err, err_info))
+        return FALSE;
+
+    /* read the frame data */
+    data_bytes_consumed = read_packet_data(wth->random_fh, packet_header.offset_to_frame,
+        offset, buf, rec->rec_header.packet_header.caplen, err, err_info);
+    if (data_bytes_consumed < 0) {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+static int
+read_packet_header(wtap *wth, FILE_T fh, union wtap_pseudo_header *pseudo_header,
+    packet_entry_header *packet_header, int *err, gchar **err_info)
+{
+    int offset;
+    guint i;
+    tlv_header tlvh;
+    tlv_wireless_info wireless_header;
+
+    offset = 0;
+
+    /* pull off the packet header */
+    if (!wtap_read_bytes_or_eof(fh, packet_header, sizeof *packet_header,
+                                err, err_info)) {
+        if (*err != 0)
+            return -1;
+        return 0;    /* EOF */
+    }
+    offset += (int)sizeof *packet_header;
+    PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE(*packet_header);
+
+    /* check the packet's magic number */
+    if (packet_header->packet_magic != observer_packet_magic) {
+
+        /*
+         * Some files are zero-padded at the end. There is no warning of this
+         * in the previous packet header information, such as setting
+         * offset_to_next_packet to zero. So detect this situation by treating
+         * an all-zero header as a sentinel. Return EOF when it is encountered,
+         * rather than treat it as a bad record.
+         */
+        for (i = 0; i < sizeof *packet_header; i++) {
+            if (((guint8*) packet_header)[i] != 0)
+                break;
+        }
+        if (i == sizeof *packet_header) {
+            *err = 0;
+            return 0;    /* EOF */
+        }
+
+        *err = WTAP_ERR_BAD_FILE;
+        *err_info = ws_strdup_printf("Observer: bad record: Invalid magic number 0x%08x",
+            packet_header->packet_magic);
+        return -1;
+    }
+
+    /* initialize the pseudo header */
+    switch (wth->file_encap) {
+    case WTAP_ENCAP_ETHERNET:
+        /* There is no FCS in the frame */
+        pseudo_header->eth.fcs_len = 0;
+        break;
+    case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
+        memset(&pseudo_header->ieee_802_11, 0, sizeof(pseudo_header->ieee_802_11));
+        pseudo_header->ieee_802_11.fcs_len = 0;
+        pseudo_header->ieee_802_11.decrypted = FALSE;
+        pseudo_header->ieee_802_11.datapad = FALSE;
+        pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
+        /* Updated below */
+        break;
+    }
+
+    /* process extra information */
+    for (i = 0; i < packet_header->number_of_information_elements; i++) {
+        guint tlv_data_length;
+
+        /* read the TLV header */
+        if (!wtap_read_bytes(fh, &tlvh, sizeof tlvh, err, err_info))
+            return -1;
+        offset += (int)sizeof tlvh;
+        TLV_HEADER_FROM_LE_IN_PLACE(tlvh);
+
+        if (tlvh.length < sizeof tlvh) {
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = ws_strdup_printf("Observer: bad record (TLV length %u < %zu)",
+                tlvh.length, sizeof tlvh);
+            return -1;
+        }
+        tlv_data_length = tlvh.length - (guint)sizeof tlvh;
+
+        /* process (or skip over) the current TLV */
+        switch (tlvh.type) {
+        case INFORMATION_TYPE_WIRELESS:
+            if (tlv_data_length != sizeof wireless_header) {
+                *err = WTAP_ERR_BAD_FILE;
+                *err_info = ws_strdup_printf("Observer: bad record (wireless TLV length %u != %zu)",
+                    tlvh.length, sizeof tlvh + sizeof wireless_header);
+                return -1;
+            }
+            if (!wtap_read_bytes(fh, &wireless_header, sizeof wireless_header,
+                                 err, err_info))
+                return -1;
+            /* set decryption status */
+            /* XXX - what other bits are there in conditions? */
+            pseudo_header->ieee_802_11.decrypted = (wireless_header.conditions & WIRELESS_WEP_SUCCESS) != 0;
+            pseudo_header->ieee_802_11.has_channel = TRUE;
+            pseudo_header->ieee_802_11.channel = wireless_header.frequency;
+            pseudo_header->ieee_802_11.has_data_rate = TRUE;
+            pseudo_header->ieee_802_11.data_rate = wireless_header.rate;
+            pseudo_header->ieee_802_11.has_signal_percent = TRUE;
+            pseudo_header->ieee_802_11.signal_percent = wireless_header.strengthPercent;
+
+            /*
+             * We don't know they PHY, but we do have the data rate;
+             * try to guess the PHY based on the data rate and channel.
+             */
+            if (RATE_IS_DSSS(pseudo_header->ieee_802_11.data_rate)) {
+                /* 11b */
+                pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11B;
+                pseudo_header->ieee_802_11.phy_info.info_11b.has_short_preamble = FALSE;
+            } else if (RATE_IS_OFDM(pseudo_header->ieee_802_11.data_rate)) {
+                /* 11a or 11g, depending on the band. */
+                if (CHAN_IS_BG(pseudo_header->ieee_802_11.channel)) {
+                    /* 11g */
+                    pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11G;
+                    pseudo_header->ieee_802_11.phy_info.info_11g.has_mode = FALSE;
+                } else {
+                    /* 11a */
+                    pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11A;
+                    pseudo_header->ieee_802_11.phy_info.info_11a.has_channel_type = FALSE;
+                    pseudo_header->ieee_802_11.phy_info.info_11a.has_turbo_type = FALSE;
+                }
+            }
+
+            offset += (int)sizeof wireless_header;
+            break;
+        default:
+            /* skip the TLV data */
+            if (tlv_data_length != 0) {
+                if (!wtap_read_bytes(fh, NULL, tlv_data_length, err, err_info))
+                    return -1;
+            }
+            offset += tlv_data_length;
+        }
+    }
+
+    return offset;
+}
+
+static gboolean
+process_packet_header(wtap *wth, packet_entry_header *packet_header,
+    wtap_rec *rec, int *err, gchar **err_info)
+{
+    /* set the wiretap record metadata fields */
+    rec->rec_type = REC_TYPE_PACKET;
+    rec->block = wtap_block_create(WTAP_BLOCK_PACKET);
+    rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+    rec->rec_header.packet_header.pkt_encap = observer_to_wtap_encap(packet_header->network_type);
+    if(wth->file_encap == WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS) {
+        rec->rec_header.packet_header.len = packet_header->network_size;
+        rec->rec_header.packet_header.caplen = packet_header->captured_size;
+    } else {
+        /*
+         * XXX - what are those 4 bytes?
+         *
+         * The comment in the code said "neglect frame markers for wiretap",
+         * but in the captures I've seen, there's no actual data corresponding
+         * to them that might be a "frame marker".
+         *
+         * Instead, the packets had a network_size 4 bytes larger than the
+         * captured_size; does the network_size include the CRC, even
+         * though it's not included in a capture?  If so, most other
+         * network analyzers that have a "network size" and a "captured
+         * size" don't include the CRC in the "network size" if they
+         * don't include the CRC in a full-length captured packet; the
+         * "captured size" is less than the "network size" only if a
+         * user-specified "snapshot length" caused the packet to be
+         * sliced at a particular point.
+         *
+         * That's the model that wiretap and Wireshark/TShark use, so
+         * we implement that model here.
+         */
+        if (packet_header->network_size < 4) {
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = ws_strdup_printf("Observer: bad record: Packet length %u < 4",
+                                        packet_header->network_size);
+            return FALSE;
+        }
+
+        rec->rec_header.packet_header.len = packet_header->network_size - 4;
+        rec->rec_header.packet_header.caplen = MIN(packet_header->captured_size, rec->rec_header.packet_header.len);
+    }
+    /*
+     * The maximum value of packet_header->captured_size is 65535, which
+     * is less than WTAP_MAX_PACKET_SIZE_STANDARD will ever be, so we don't need
+     * to check it.
+     */
+
+    /* set the wiretap timestamp, assuming for the moment that Observer encoded it in GMT */
+    rec->ts.secs = (time_t) ((packet_header->nano_seconds_since_2000 / 1000000000) + ansi_to_observer_epoch_offset);
+    rec->ts.nsecs = (int) (packet_header->nano_seconds_since_2000 % 1000000000);
+
+    /* adjust to local time, if necessary, also accounting for DST if the frame
+       was captured while it was in effect */
+    if (((observer_dump_private_state*)wth->priv)->time_format == TIME_INFO_LOCAL)
+    {
+        struct tm *tm;
+        struct tm daylight_tm;
+        struct tm standard_tm;
+        time_t    dst_offset;
+
+        /* the Observer timestamp was encoded as local time, so add a
+           correction from local time to GMT */
+        rec->ts.secs += gmt_to_localtime_offset;
+
+        /* perform a DST adjustment if necessary */
+        tm = localtime(&rec->ts.secs);
+        if (tm != NULL) {
+            standard_tm = *tm;
+            if (standard_tm.tm_isdst > 0) {
+                daylight_tm = standard_tm;
+                standard_tm.tm_isdst = 0;
+                dst_offset = mktime(&standard_tm) - mktime(&daylight_tm);
+                 rec->ts.secs -= dst_offset;
+            }
+        }
+    }
+
+    return TRUE;
+}
+
+static int
+read_packet_data(FILE_T fh, int offset_to_frame, int current_offset_from_packet_header, Buffer *buf,
+    int length, int *err, char **err_info)
+{
+    int seek_increment;
+    int bytes_consumed = 0;
+
+    /* validate offsets */
+    if (offset_to_frame < current_offset_from_packet_header) {
+        *err = WTAP_ERR_BAD_FILE;
+        *err_info = ws_strdup_printf("Observer: bad record (offset to packet data %d < %d)",
+            offset_to_frame, current_offset_from_packet_header);
+        return -1;
+    }
+
+    /* skip to the packet data */
+    seek_increment = offset_to_frame - current_offset_from_packet_header;
+    if (seek_increment > 0) {
+        if (!wtap_read_bytes(fh, NULL, seek_increment, err, err_info)) {
+            return -1;
+        }
+        bytes_consumed += seek_increment;
+    }
+
+    /* read in the packet data */
+    if (!wtap_read_packet_bytes(fh, buf, length, err, err_info))
+        return FALSE;
+    bytes_consumed += length;
+
+    return bytes_consumed;
+}
+
+static gboolean
+skip_to_next_packet(wtap *wth, int offset_to_next_packet, int current_offset_from_packet_header, int *err,
+    char **err_info)
+{
+    int seek_increment;
+
+    /* validate offsets */
+    if (offset_to_next_packet < current_offset_from_packet_header) {
+        *err = WTAP_ERR_BAD_FILE;
+        *err_info = ws_strdup_printf("Observer: bad record (offset to next packet %d < %d)",
+            offset_to_next_packet, current_offset_from_packet_header);
+        return FALSE;
+    }
+
+    /* skip to the next packet header */
+    seek_increment = offset_to_next_packet - current_offset_from_packet_header;
+    if (seek_increment > 0) {
+        if (!wtap_read_bytes(wth->fh, NULL, seek_increment, err, err_info))
+            return FALSE;
+    }
+
+    return TRUE;
+}
+
+/* Returns 0 if we could write the specified encapsulation type,
+   an error indication otherwise. */
+static int observer_dump_can_write_encap(int encap)
+{
+    /* per-packet encapsulations aren't supported */
+    if (encap == WTAP_ENCAP_PER_PACKET)
+        return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
+
+    if (encap < 0 || (wtap_to_observer_encap(encap) == OBSERVER_UNDEFINED))
+        return WTAP_ERR_UNWRITABLE_ENCAP;
+
+    return 0;
+}
+
+/* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
+   failure. */
+static gboolean observer_dump_open(wtap_dumper *wdh, int *err,
+    gchar **err_info)
+{
+    observer_dump_private_state * private_state = NULL;
+    capture_file_header file_header;
+    guint header_offset;
+    const gchar *err_str;
+    tlv_header comment_header;
+    char comment[64];
+    size_t comment_length;
+    tlv_header time_info_header;
+    tlv_time_info time_info;
+    struct tm * current_time;
+    time_t system_time;
+
+    /* initialize the private state */
+    private_state = g_new(observer_dump_private_state, 1);
+    private_state->packet_count = 0;
+    private_state->network_type = wtap_to_observer_encap(wdh->file_encap);
+    private_state->time_format = TIME_INFO_GMT;
+
+    /* populate the fields of wdh */
+    wdh->priv = (void *) private_state;
+    wdh->subtype_write = observer_dump;
+
+    /* initialize the file header */
+    memset(&file_header, 0x00, sizeof(file_header));
+    (void) g_strlcpy(file_header.observer_version, observer_magic, 31);
+    header_offset = (guint16)sizeof(file_header);
+
+    /* create the file comment TLV */
+    {
+        time(&system_time);
+        current_time = localtime(&system_time);
+        memset(&comment, 0x00, sizeof(comment));
+        if (current_time != NULL)
+            snprintf(comment, 64, "This capture was saved from Wireshark on %s", asctime(current_time));
+        else
+            snprintf(comment, 64, "This capture was saved from Wireshark");
+        comment_length = strlen(comment);
+
+        comment_header.type = INFORMATION_TYPE_COMMENT;
+        comment_header.length = (guint16) (sizeof(comment_header) + comment_length);
+
+        /* update the file header to account for the comment TLV */
+        file_header.number_of_information_elements++;
+        header_offset += comment_header.length;
+    }
+
+    /* create the timestamp encoding TLV */
+    {
+        time_info_header.type = INFORMATION_TYPE_TIME_INFO;
+        time_info_header.length = (guint16) (sizeof(time_info_header) + sizeof(time_info));
+        time_info.time_format = TIME_INFO_GMT;
+
+        /* update the file header to account for the timestamp encoding TLV */
+        file_header.number_of_information_elements++;
+        header_offset += time_info_header.length;
+    }
+
+    /* Store the offset to the first packet */
+    file_header.offset_to_first_packet_high_byte = (header_offset >> 16);
+    file_header.offset_to_first_packet = (header_offset & 0xFFFF);
+
+    /* write the file header, swapping any multibyte fields first */
+    CAPTURE_FILE_HEADER_TO_LE_IN_PLACE(file_header);
+    if (!wtap_dump_file_write(wdh, &file_header, sizeof(file_header), err)) {
+        return FALSE;
+    }
+
+    /* write the comment TLV */
+    {
+        TLV_HEADER_TO_LE_IN_PLACE(comment_header);
+        if (!wtap_dump_file_write(wdh, &comment_header, sizeof(comment_header), err)) {
+            return FALSE;
+        }
+
+        if (!wtap_dump_file_write(wdh, &comment, comment_length, err)) {
+            return FALSE;
+        }
+    }
+
+    /* write the time info TLV */
+    {
+        TLV_HEADER_TO_LE_IN_PLACE(time_info_header);
+        if (!wtap_dump_file_write(wdh, &time_info_header, sizeof(time_info_header), err)) {
+            return FALSE;
+        }
+
+        TLV_TIME_INFO_TO_LE_IN_PLACE(time_info);
+        if (!wtap_dump_file_write(wdh, &time_info, sizeof(time_info), err)) {
+            return FALSE;
+        }
+    }
+
+    err_str = init_gmt_to_localtime_offset();
+    if (err_str != NULL) {
+        *err = WTAP_ERR_INTERNAL;
+        *err_info = ws_strdup_printf("observer: %s", err_str);
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/* Write a record for a packet to a dump file.
+   Returns TRUE on success, FALSE on failure. */
+static gboolean observer_dump(wtap_dumper *wdh, const wtap_rec *rec,
+    const guint8 *pd,
+    int *err, gchar **err_info _U_)
+{
+    observer_dump_private_state * private_state = NULL;
+    packet_entry_header           packet_header;
+    guint64                       seconds_since_2000;
+
+    /* We can only write packet records. */
+    if (rec->rec_type != REC_TYPE_PACKET) {
+        *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
+        return FALSE;
+    }
+
+    /*
+     * Make sure this packet doesn't have a link-layer type that
+     * differs from the one for the file.
+     */
+    if (wdh->file_encap != rec->rec_header.packet_header.pkt_encap) {
+        *err = WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
+        return FALSE;
+    }
+
+    /* The captured size field is 16 bits, so there's a hard limit of
+       65535. */
+    if (rec->rec_header.packet_header.caplen > 65535) {
+        *err = WTAP_ERR_PACKET_TOO_LARGE;
+        return FALSE;
+    }
+
+    /* convert the number of seconds since epoch from ANSI-relative to
+       Observer-relative */
+    if (rec->ts.secs < ansi_to_observer_epoch_offset) {
+        if(rec->ts.secs > (time_t) 0) {
+            seconds_since_2000 = rec->ts.secs;
+        } else {
+            seconds_since_2000 = (time_t) 0;
+        }
+    } else {
+        seconds_since_2000 = rec->ts.secs - ansi_to_observer_epoch_offset;
+    }
+
+    /* populate the fields of the packet header */
+    private_state = (observer_dump_private_state *) wdh->priv;
+
+    memset(&packet_header, 0x00, sizeof(packet_header));
+    packet_header.packet_magic = observer_packet_magic;
+    packet_header.network_speed = 1000000;
+    packet_header.captured_size = (guint16) rec->rec_header.packet_header.caplen;
+    packet_header.network_size = (guint16) (rec->rec_header.packet_header.len + 4);
+    packet_header.offset_to_frame = sizeof(packet_header);
+    /* XXX - what if this doesn't fit in 16 bits?  It's not guaranteed to... */
+    packet_header.offset_to_next_packet = (guint16)sizeof(packet_header) + rec->rec_header.packet_header.caplen;
+    packet_header.network_type = private_state->network_type;
+    packet_header.flags = 0x00;
+    packet_header.number_of_information_elements = 0;
+    packet_header.packet_type = PACKET_TYPE_DATA_PACKET;
+    packet_header.packet_number = private_state->packet_count;
+    packet_header.original_packet_number = packet_header.packet_number;
+    packet_header.nano_seconds_since_2000 = seconds_since_2000 * 1000000000 + rec->ts.nsecs;
+
+    private_state->packet_count++;
+
+    /* write the packet header */
+    PACKET_ENTRY_HEADER_TO_LE_IN_PLACE(packet_header);
+    if (!wtap_dump_file_write(wdh, &packet_header, sizeof(packet_header), err)) {
+        return FALSE;
+    }
+
+    /* write the packet data */
+    if (!wtap_dump_file_write(wdh, pd, rec->rec_header.packet_header.caplen, err)) {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+static gint observer_to_wtap_encap(int observer_encap)
+{
+    switch(observer_encap) {
+    case OBSERVER_ETHERNET:
+        return WTAP_ENCAP_ETHERNET;
+    case OBSERVER_TOKENRING:
+        return WTAP_ENCAP_TOKEN_RING;
+    case OBSERVER_FIBRE_CHANNEL:
+        return WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS;
+    case OBSERVER_WIRELESS_802_11:
+        return WTAP_ENCAP_IEEE_802_11_WITH_RADIO;
+    case OBSERVER_UNDEFINED:
+        return WTAP_ENCAP_UNKNOWN;
+    }
+    return WTAP_ENCAP_UNKNOWN;
+}
+
+static gint wtap_to_observer_encap(int wtap_encap)
+{
+    switch(wtap_encap) {
+    case WTAP_ENCAP_ETHERNET:
+        return OBSERVER_ETHERNET;
+    case WTAP_ENCAP_TOKEN_RING:
+        return OBSERVER_TOKENRING;
+    case WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS:
+        return OBSERVER_FIBRE_CHANNEL;
+    case WTAP_ENCAP_UNKNOWN:
+        return OBSERVER_UNDEFINED;
+    }
+    return OBSERVER_UNDEFINED;
+}
+
+static const struct supported_block_type observer_blocks_supported[] = {
+    /*
+     * We support packet blocks, with no comments or other options.
+     */
+    { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
+};
+
+static const struct file_type_subtype_info observer_info = {
+    "Viavi Observer", "observer", "bfr", NULL,
+    FALSE, BLOCKS_SUPPORTED(observer_blocks_supported),
+    observer_dump_can_write_encap, observer_dump_open, NULL
+};
+
+void register_observer(void)
+{
+    observer_file_type_subtype = wtap_register_file_type_subtype(&observer_info);
+
+    /*
+     * We now call this file format just "observer", but we allow
+     * it to be referred to as "niobserver" for backwards
+     * compatibility.
+     *
+     * Register "niobserver" for that purpose.
+     */
+    wtap_register_compatibility_file_subtype_name("niobserver", "observer");
+
+    /*
+     * Register name for backwards compatibility with the
+     * wtap_filetypes table in Lua.
+     */
+    wtap_register_backwards_compatibility_lua_name("NETWORK_INSTRUMENTS",
+                                                   observer_file_type_subtype);
+}
+
+/*
+ * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 4
+ * tab-width: 8
+ * indent-tabs-mode: nil
+ * End:
+ *
+ * vi: set shiftwidth=4 tabstop=8 expandtab:
+ * :indentSize=4:tabSize=8:noTabs=true:
+ */