Move file format definitions to the header file.

Put the code to read the packet header and the packet data into routines
(which also fixes some places where observer_seek_read() was using the
sequential file handle rather than the random file handle), make the
packet header reader skip over the TLVs,

Do some additional sanity checking.

Wiretap supports nanosecond resolution; provide nanosecond resolution
time stamps.

Rename some structure members to match their purpose (they're TLV
counts, not flags).

Remove the TLV header from the TLV structures (and eliminate TLV
structures if we don't have the contents or they're just a string); if
we process them, we'll probably end up reading the header and data
separately.

Add some information about some of the TLVs in expert information packets.

svn path=/trunk/; revision=17870

1 files changed, 154 insertions, 115 deletions

diff --git a/wiretap/network_instruments.c b/wiretap/network_instruments.c
index 726c1b7d05..c6c19bec36 100644
--- a/wiretap/network_instruments.c
+++ b/wiretap/network_instruments.c
@@ -42,10 +42,6 @@ static const int observer_encap[] = {
 };
 #define NUM_OBSERVER_ENCAPS (sizeof observer_encap / sizeof observer_encap[0])
 
-#define OBSERVER_UNDEFINED 0xFF
-#define OBSERVER_ETHERNET  0x00
-#define OBSERVER_TOKENRING 0x01
-#define OBSERVER_FDDI      0x02
 static const int from_wtap_encap[] = {
 	OBSERVER_UNDEFINED,
 	OBSERVER_ETHERNET,
@@ -55,9 +51,6 @@ static const int from_wtap_encap[] = {
 
 #define CAPTUREFILE_HEADER_SIZE sizeof(capture_file_header)
 
-#define INFORMATION_TYPE_ALIAS_LIST 0x01
-#define INFORMATION_TYPE_COMMENT    0x02
-
 /*
  * The time in Observer files is in nanoseconds since midnight, January 1,
  * 2000, 00:00:00 local time.
@@ -95,12 +88,17 @@ static void init_time_offset(void)
 	}
 }
 
-static gboolean fill_time_struct(guint64 ns_since2000, observer_time* time_conversion);
 static gboolean observer_read(wtap *wth, int *err, gchar **err_info,
     long *data_offset);
 static gboolean observer_seek_read(wtap *wth, long seek_off,
     union wtap_pseudo_header *pseudo_header, guchar *pd, int length,
     int *err, gchar **err_info);
+static int read_packet_header(FILE_T fh, packet_entry_header *packet_header,
+    int *err, gchar **err_info);
+static gboolean read_packet_data(FILE_T fh, int offset_to_frame, int offset,
+    guint8 *pd, int length, int *err, char **err_info);
+static gboolean skip_to_next_packet(wtap *wth, int offset,
+    int offset_to_next_packet, int *err, char **err_info);
 static gboolean observer_dump_close(wtap_dumper *wdh, int *err);
 static gboolean observer_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
     const union wtap_pseudo_header *pseudo_header, const guchar *pd, int *err);
@@ -165,7 +163,7 @@ int network_instruments_open(wtap *wth, int *err, gchar **err_info)
 	/* Check the data link type. */
 	if (packet_header.network_type >= NUM_OBSERVER_ENCAPS) {
 		*err = WTAP_ERR_UNSUPPORTED_ENCAP;
-		*err_info = g_strdup_printf("observer: network type %u unknown or unsupported", packet_header.network_type);
+		*err_info = g_strdup_printf("Observer: network type %u unknown or unsupported", packet_header.network_type);
 		return -1;
 	}
 	wth->file_encap = observer_encap[packet_header.network_type];
@@ -198,13 +196,8 @@ int network_instruments_open(wtap *wth, int *err, gchar **err_info)
 static gboolean observer_read(wtap *wth, int *err, gchar **err_info,
     long *data_offset)
 {
-	int bytes_read;
-	long seek_increment;
-	long seconds, useconds;
-
+	int offset;
 	packet_entry_header packet_header;
-	
-	observer_time packet_time;
 
 	/*
 	 * Skip records other than data records.
@@ -212,87 +205,57 @@ static gboolean observer_read(wtap *wth, int *err, gchar **err_info,
 	for (;;) {
 		*data_offset = wth->data_offset;
 
-		/* pull off the packet header */
-		bytes_read = file_read(&packet_header, sizeof packet_header, 1, wth->fh);
-		if (bytes_read != sizeof packet_header) {
-			*err = file_error(wth->fh);
-			if (*err != 0)
-				return -1;
-			return 0;
-		}
-		wth->data_offset += bytes_read;
+		/* process the packet header, including TLVs */
+		offset = read_packet_header(wth->fh, &packet_header, err,
+		    err_info);
+		if (offset <= 0)
+			return FALSE;	/* EOF or error */
 
-		/* check the packet's magic number; the magic number is all 8's,
-		   so the byte order doesn't matter */
-		if (packet_header.packet_magic != observer_packet_magic) {
-			*err = WTAP_ERR_BAD_RECORD;
-			*err_info = g_strdup_printf("Observer: bad record: Invalid magic number 0x%08x",
-			    GUINT32_FROM_LE(packet_header.packet_magic));
-			return FALSE;
-		}
+		wth->data_offset += offset;
 
-		/* check the packet's record type, and skip non-data
-		   packets */
-		if (packet_header.packet_type == TYPE_DATA_PACKET)
+		if (packet_header.packet_type == PACKET_TYPE_DATA_PACKET)
 			break;
 
 		/* skip to next packet */
 		packet_header.offset_to_next_packet =
 		    GUINT16_FROM_LE(packet_header.offset_to_next_packet);
-		if (packet_header.offset_to_next_packet < sizeof(packet_header)) {
-			*err = WTAP_ERR_BAD_RECORD;
-			*err_info = g_strdup_printf("Observer: bad record (offset to next packet %u < %lu)",
-			    packet_header.offset_to_next_packet,
-			    (unsigned long)sizeof(packet_header));
-			return FALSE;
-		}
-		seek_increment = packet_header.offset_to_next_packet - sizeof(packet_header);
-		if(seek_increment>0) {
-			if (file_seek(wth->fh, seek_increment, SEEK_CUR, err) == -1)
-				return FALSE;
-		}
-		wth->data_offset += seek_increment;
+		if (!skip_to_next_packet(wth, offset,
+		    packet_header.offset_to_next_packet, err, err_info))
+			return FALSE;	/* EOF or error */
 	}
 
-	/* convert from observer time to wiretap time */
-	packet_header.nano_seconds_since_2000 =
-	    GUINT64_FROM_LE(packet_header.nano_seconds_since_2000);
-	fill_time_struct(packet_header.nano_seconds_since_2000, &packet_time);
-	useconds = (long)(packet_time.useconds_from_1970 - ((guint64)packet_time.seconds_from_1970)*1000000);
-	seconds = (long)packet_time.seconds_from_1970;
-
 	/* set-up the packet header */
 	packet_header.network_size =
 	    GUINT16_FROM_LE(packet_header.network_size);
+	/* neglect frame markers for wiretap */
+	if (packet_header.network_size < 4) {
+		*err = WTAP_ERR_BAD_RECORD;
+		*err_info = g_strdup_printf("Observer: bad record: Packet length %u < 4",
+		    packet_header.network_size);
+		return FALSE;
+	}
+	packet_header.network_size -= 4;
 	packet_header.captured_size =
 	    GUINT16_FROM_LE(packet_header.captured_size);
 	wth->phdr.pkt_encap = observer_encap[packet_header.network_type];
-	wth->phdr.len    = packet_header.network_size-4; /* neglect frame markers for wiretap */
+	wth->phdr.len    = packet_header.network_size;
 	wth->phdr.caplen = MIN(packet_header.captured_size, wth->phdr.len);
-	wth->phdr.ts.secs  = seconds;
-	wth->phdr.ts.nsecs = useconds * 1000;
-
-	/* get to the frame data */
-	packet_header.offset_to_frame =
-	    GUINT16_FROM_LE(packet_header.offset_to_frame);
-	if (packet_header.offset_to_frame < sizeof(packet_header)) {
-		*err = WTAP_ERR_BAD_RECORD;
-		*err_info = g_strdup_printf("Observer: bad record (offset to frame %u < %lu)",
-		    packet_header.offset_to_frame,
-		    (unsigned long)sizeof(packet_header));
-		return FALSE;
-	}
-	seek_increment = packet_header.offset_to_frame - sizeof(packet_header);
-	if(seek_increment>0) {
-		if (file_seek(wth->fh, seek_increment, SEEK_CUR, err) == -1)
-			return FALSE;
-	}
-	wth->data_offset += seek_increment;
+	packet_header.nano_seconds_since_2000 =
+	    GUINT64_FROM_LE(packet_header.nano_seconds_since_2000);
+	wth->phdr.ts.secs =
+	    (time_t) (packet_header.nano_seconds_since_2000/1000000000 + seconds1970to2000);
+	wth->phdr.ts.nsecs = packet_header.nano_seconds_since_2000%1000000000;
 
 	/* set-up the packet buffer */
 	buffer_assure_space(wth->frame_buffer, packet_header.captured_size);
-	wtap_file_read_expected_bytes(buffer_start_ptr(wth->frame_buffer), packet_header.captured_size, wth->fh, err);
+
+	/* read data */
+	if (!read_packet_data(wth->fh, packet_header.offset_to_frame, offset,
+	    buffer_start_ptr(wth->frame_buffer), packet_header.captured_size,
+	    err, err_info))
+		return FALSE;
 	wth->data_offset += packet_header.captured_size;
+	offset += packet_header.captured_size;
 
 	/* update the pseudo header */
 	switch (wth->file_encap) {
@@ -312,66 +275,142 @@ static gboolean observer_seek_read(wtap *wth, long seek_off,
     int *err, gchar **err_info)
 {
 	packet_entry_header packet_header;
-	long seek_increment;
-	int bytes_read;
+	int offset;
 
 	if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
 		return FALSE;
 
+	/* process the packet header, including TLVs */
+	offset = read_packet_header(wth->random_fh, &packet_header, err,
+	    err_info);
+	if (offset <= 0)
+		return FALSE;	/* EOF or error */
+
+	/* read data */
+	if (!read_packet_data(wth->random_fh, packet_header.offset_to_frame,
+	    offset, pd, length, err, err_info))
+		return FALSE;
+
+	/* update the pseudo header */
+	switch (wth->file_encap) {
+
+	case WTAP_ENCAP_ETHERNET:
+		/* There is no FCS in the frame */
+		pseudo_header->eth.fcs_len = 0;
+		break;
+	}
+
+	return TRUE;
+}
+
+static int
+read_packet_header(FILE_T fh, packet_entry_header *packet_header, int *err,
+    gchar **err_info)
+{
+	int offset;
+	int bytes_read;
+	guint i;
+	tlv_header tlvh;
+	int seek_increment;
+
+	offset = 0;
+
 	/* pull off the packet header */
-	bytes_read = file_read(&packet_header, sizeof packet_header, 1, wth->random_fh);
-	if (bytes_read != sizeof packet_header) {
-		*err = file_error(wth->fh);
+	bytes_read = file_read(packet_header, sizeof *packet_header, 1, fh);
+	if (bytes_read != sizeof *packet_header) {
+		*err = file_error(fh);
 		if (*err != 0)
 			return -1;
-		return 0;
+		return 0;	/* EOF */
 	}
+	offset += bytes_read;
 
-	/* check the packets magic number */
-	if (packet_header.packet_magic != observer_packet_magic) {
+	/* check the packet's magic number; the magic number is all 8's,
+	   so the byte order doesn't matter */
+	if (packet_header->packet_magic != observer_packet_magic) {
 		*err = WTAP_ERR_BAD_RECORD;
-		*err_info = g_strdup("Observer: bad magic number for record in observer_seek_read");
-		return FALSE;
+		*err_info = g_strdup_printf("Observer: bad record: Invalid magic number 0x%08x",
+		    GUINT32_FROM_LE(packet_header->packet_magic));
+		return -1;
 	}
 
+	/* process extra information */
+	for (i = 0; i < packet_header->number_of_information_elements; i++) {
+		/* read the TLV header */
+		bytes_read = file_read(&tlvh, sizeof tlvh, 1, fh);
+		if (bytes_read != sizeof tlvh) {
+			*err = file_error(fh);
+			if (*err == 0)
+				*err = WTAP_ERR_SHORT_READ;
+			return -1;
+		}
+		offset += bytes_read;
 
-	/* get the frame offset */
-	packet_header.offset_to_frame =
-	  GUINT16_FROM_LE(packet_header.offset_to_frame);
-	seek_increment = packet_header.offset_to_frame - sizeof(packet_header);
-	if(seek_increment>0) {
-	  if (file_seek(wth->random_fh, seek_increment, SEEK_CUR, err) == -1)
-	    return FALSE;
-	}
+		tlvh.length = GUINT16_FROM_LE(tlvh.length);
+		if (tlvh.length < sizeof tlvh) {
+			*err = WTAP_ERR_BAD_RECORD;
+			*err_info = g_strdup_printf("Observer: bad record (TLV length %u < %lu)",
+			    tlvh.length, (unsigned long)sizeof tlvh);
+			return -1;
+		}
 
-	/* read in the packet */
-	bytes_read = file_read(pd, 1, length, wth->random_fh);
-	if (bytes_read != length) {
-		*err = file_error(wth->fh);
-		return FALSE;
+		/* skip the TLV data */
+		seek_increment = tlvh.length - sizeof tlvh;
+		if(seek_increment>0) {
+			if (file_seek(fh, seek_increment, SEEK_CUR, err) == -1)
+				return -1;
+		}
+		offset += seek_increment;
 	}
 
-	/* update the pseudo header */
-	switch (wth->file_encap) {
+	packet_header->offset_to_frame =
+	    GUINT16_FROM_LE(packet_header->offset_to_frame);
 
-	case WTAP_ENCAP_ETHERNET:
-		/* There is no FCS in the frame */
-		pseudo_header->eth.fcs_len = 0;
-		break;
+	return offset;
+}
+
+static gboolean
+read_packet_data(FILE_T fh, int offset_to_frame, int offset, guint8 *pd,
+    int length, int *err, char **err_info)
+{
+	int seek_increment;
+
+	/* get to the packet data */
+	if (offset_to_frame < offset) {
+		*err = WTAP_ERR_BAD_RECORD;
+		*err_info = g_strdup_printf("Observer: bad record (offset to frame %d < %d)",
+		    offset_to_frame, offset);
+		return FALSE;
+	}
+	seek_increment = offset_to_frame - offset;
+	if(seek_increment>0) {
+		if (file_seek(fh, seek_increment, SEEK_CUR, err) == -1)
+			return FALSE;
 	}
 
+	/* read in the packet */
+	wtap_file_read_expected_bytes(pd, length, fh, err);
 	return TRUE;
 }
 
-gboolean fill_time_struct(guint64 ns_since2000, observer_time* time_conversion)
+static gboolean
+skip_to_next_packet(wtap *wth, int offset, int offset_to_next_packet, int *err,
+    char **err_info)
 {
-	time_conversion->ns_since2000 = ns_since2000;
-	time_conversion->us_since2000 = ns_since2000/1000;
-	time_conversion->sec_since2000 = ns_since2000/1000000000;
-
-	time_conversion->seconds_from_1970 = (time_t) (seconds1970to2000 + time_conversion->sec_since2000);
-	time_conversion->useconds_from_1970 = ((guint64)seconds1970to2000*1000000)+time_conversion->us_since2000;
+	int seek_increment;
 
+	if (offset_to_next_packet < offset) {
+		*err = WTAP_ERR_BAD_RECORD;
+		*err_info = g_strdup_printf("Observer: bad record (offset to next packet %d < %d)",
+		    offset_to_next_packet, offset);
+		return FALSE;
+	}
+	seek_increment = offset_to_next_packet - offset;
+	if(seek_increment>0) {
+		if (file_seek(wth->fh, seek_increment, SEEK_CUR, err) == -1)
+			return FALSE;
+	}
+	wth->data_offset += seek_increment;
 	return TRUE;
 }
 
@@ -425,7 +464,7 @@ gboolean network_instruments_dump_open(wtap_dumper *wdh, gboolean cant_seek, int
 	memset(&file_header, 0x00, sizeof(capture_file_header));
 	strcpy(file_header.observer_version, network_instruments_magic);
 	file_header.offset_to_first_packet = sizeof(capture_file_header) + sizeof(tlv_header) + strlen(comment);
-	file_header.extra_information_present = 0x01; /* actually the number of information elements */
+	file_header.number_of_information_elements = 1;
 	if(!fwrite(&file_header, sizeof(capture_file_header), 1, wdh->fh)) {
 		*err = errno;
 		return FALSE;
@@ -477,8 +516,8 @@ static gboolean observer_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
 	packet_header.offset_to_next_packet = GUINT16_TO_LE(sizeof(packet_entry_header) + phdr->caplen);
 	packet_header.network_type = niobserver->network_type;
 	packet_header.flags = 0x00;
-	packet_header.extra_information = 0x00;
-	packet_header.packet_type = 0x00;
+	packet_header.number_of_information_elements = 0;
+	packet_header.packet_type = PACKET_TYPE_DATA_PACKET;
 	packet_header.packet_number = GUINT64_TO_LE(niobserver->packet_count);
 	packet_header.original_packet_number = GUINT64_TO_LE(niobserver->packet_count);
 	niobserver->packet_count++;