observer: rename source and update name.

Name the source to the code to read Observer files after the file
format, not the company that created it, got bought by JDSU, and then
ended up in Viavi when JDSU split.

Refer to the file format as "Viavi Observer" to reflect that.

1 files changed, 964 insertions, 0 deletions

diff --git a/wiretap/observer.c b/wiretap/observer.c
new file mode 100644
index 0000000000..686bcc61b8
--- /dev/null
+++ b/wiretap/observer.c
@@ -0,0 +1,964 @@
+/***************************************************************************
+                          observer.c  -  description
+                             -------------------
+    begin                : Wed Oct 29 2003
+    copyright            : (C) 2003 by root
+    email                : scotte[AT}netinst.com
+ ***************************************************************************/
+
+/***************************************************************************
+ *                                                                         *
+ *  SPDX-License-Identifier: GPL-2.0-or-later                              *
+ *                                                                         *
+ ***************************************************************************/
+
+#include "config.h"
+
+#include <stdlib.h>
+#include <errno.h>
+#include <string.h>
+#include "wtap-int.h"
+#include "file_wrappers.h"
+#include "observer.h"
+#include <wsutil/802_11-utils.h>
+
+static const char observer_magic[] = {"ObserverPktBufferVersion=15.00"};
+static const int true_magic_length = 17;
+
+static const guint32 observer_packet_magic = 0x88888888;
+
+/*
+ * This structure is used to keep state when writing files. An instance is
+ * allocated for each file, and its address is stored in the wtap_dumper.priv
+ * pointer field.
+ */
+typedef struct {
+    guint64 packet_count;
+    guint8  network_type;
+    guint32 time_format;
+} observer_dump_private_state;
+
+/*
+ * Some time offsets are calculated in advance here, when the first Observer
+ * file is opened for reading or writing, and are then used to adjust frame
+ * timestamps as they are read or written.
+ *
+ * The Wiretap API expects timestamps in nanoseconds relative to
+ * January 1, 1970, 00:00:00 GMT (the Wiretap epoch).
+ *
+ * Observer versions before 13.10 encode frame timestamps in nanoseconds
+ * relative to January 1, 2000, 00:00:00 local time (the Observer epoch).
+ * Versions 13.10 and later switch over to GMT encoding. Which encoding was used
+ * when saving the file is identified via the time format TLV following
+ * the file header.
+ *
+ * Unfortunately, even though Observer versions before 13.10 saved in local
+ * time, they didn't include the timezone from which the frames were captured,
+ * so converting to GMT correctly from all timezones is impossible. So an
+ * assumption is made that the file is being read from within the same timezone
+ * that it was written.
+ *
+ * All code herein is normalized to versions 13.10 and later, special casing for
+ * versions earlier. In other words, timestamps are worked with as if
+ * they are GMT-encoded, and adjustments from local time are made only if
+ * the source file warrants it.
+ *
+ * All destination files are saved in GMT format.
+ */
+static const time_t ansi_to_observer_epoch_offset = 946684800;
+static time_t gmt_to_localtime_offset = (time_t) -1;
+
+static const char *init_gmt_to_localtime_offset(void)
+{
+    if (gmt_to_localtime_offset == (time_t) -1) {
+        time_t ansi_epoch_plus_one_day = 86400;
+        struct tm *tm;
+        struct tm gmt_tm;
+        struct tm local_tm;
+
+        /*
+         * Compute the local time zone offset as the number of seconds west
+         * of GMT. There's no obvious cross-platform API for querying this
+         * directly. As a workaround, GMT and local tm structures are populated
+         * relative to the ANSI time_t epoch (plus one day to ensure that
+         * local time stays after 1970/1/1 00:00:00). They are then converted
+         * back to time_t as if they were both local times, resulting in the
+         * time zone offset being the difference between them.
+         */
+        tm = gmtime(&ansi_epoch_plus_one_day);
+        if (tm == NULL)
+            return "gmtime(one day past the Epoch) fails (this \"shouldn't happen\")";
+        gmt_tm = *tm;
+        tm = localtime(&ansi_epoch_plus_one_day);
+        if (tm == NULL)
+            return "localtime(one day past the Epoch) fails (this \"shouldn't happen\")";
+        local_tm = *tm;
+        local_tm.tm_isdst = 0;
+        gmt_to_localtime_offset = mktime(&gmt_tm) - mktime(&local_tm);
+    }
+    return NULL;
+}
+
+static gboolean observer_read(wtap *wth, wtap_rec *rec, Buffer *buf,
+    int *err, gchar **err_info, gint64 *data_offset);
+static gboolean observer_seek_read(wtap *wth, gint64 seek_off,
+    wtap_rec *rec, Buffer *buf, int *err, gchar **err_info);
+static int read_packet_header(wtap *wth, FILE_T fh, union wtap_pseudo_header *pseudo_header,
+    packet_entry_header *packet_header, int *err, gchar **err_info);
+static gboolean process_packet_header(wtap *wth,
+    packet_entry_header *packet_header, wtap_rec *rec, int *err,
+    gchar **err_info);
+static int read_packet_data(FILE_T fh, int offset_to_frame, int current_offset_from_packet_header,
+    Buffer *buf, int length, int *err, char **err_info);
+static gboolean skip_to_next_packet(wtap *wth, int offset_to_next_packet,
+    int current_offset_from_packet_header, int *err, char **err_info);
+static gboolean observer_dump(wtap_dumper *wdh, const wtap_rec *rec,
+    const guint8 *pd, int *err, gchar **err_info);
+static gint observer_to_wtap_encap(int observer_encap);
+static gint wtap_to_observer_encap(int wtap_encap);
+
+static int observer_file_type_subtype = -1;
+
+void register_observer(void);
+
+wtap_open_return_val observer_open(wtap *wth, int *err, gchar **err_info)
+{
+    guint offset;
+    capture_file_header file_header;
+    guint header_offset;
+    guint i;
+    tlv_header tlvh;
+    guint seek_increment;
+    packet_entry_header packet_header;
+    observer_dump_private_state * private_state = NULL;
+    const char *err_str;
+
+    offset = 0;
+
+    /* read in the buffer file header */
+    if (!wtap_read_bytes(wth->fh, &file_header, sizeof file_header,
+                         err, err_info)) {
+        if (*err != WTAP_ERR_SHORT_READ)
+            return WTAP_OPEN_ERROR;
+        return WTAP_OPEN_NOT_MINE;
+    }
+    offset += (guint)sizeof file_header;
+    CAPTURE_FILE_HEADER_FROM_LE_IN_PLACE(file_header);
+
+    /* check if version info is present */
+    if (memcmp(file_header.observer_version, observer_magic, true_magic_length)!=0) {
+        return WTAP_OPEN_NOT_MINE;
+    }
+
+    /* get the location of the first packet */
+    /* v15 and newer uses high byte offset, in previous versions it will be 0 */
+    header_offset = file_header.offset_to_first_packet + ((guint)(file_header.offset_to_first_packet_high_byte)<<16);
+
+    if (offset > header_offset) {
+        /*
+         * The packet data begins before the file header ends.
+         */
+        *err = WTAP_ERR_BAD_FILE;
+        *err_info = g_strdup_printf("Observer: The first packet begins in the middle of the file header");
+        return WTAP_OPEN_ERROR;
+    }
+
+    /* initialize the private state */
+    private_state = g_new(observer_dump_private_state, 1);
+    private_state->time_format = TIME_INFO_LOCAL;
+    wth->priv = (void *) private_state;
+
+    /* process extra information */
+    for (i = 0; i < file_header.number_of_information_elements; i++) {
+        guint tlv_data_length;
+
+        /*
+         * Make sure reading the TLV header won't put us in the middle
+         * of the packet data.
+         */
+        if (offset + (guint)sizeof tlvh > header_offset) {
+            /*
+             * We're at or past the point where the packet data begins,
+             * but we have the IE header to read.
+             */
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = g_strdup_printf("Observer: TLVs run into the first packet data");
+            return WTAP_OPEN_ERROR;
+        }
+
+        /* read the TLV header */
+        if (!wtap_read_bytes(wth->fh, &tlvh, sizeof tlvh, err, err_info))
+            return WTAP_OPEN_ERROR;
+        offset += (guint)sizeof tlvh;
+        TLV_HEADER_FROM_LE_IN_PLACE(tlvh);
+
+        if (tlvh.length < sizeof tlvh) {
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = g_strdup_printf("Observer: bad record (TLV length %u < %zu)",
+                tlvh.length, sizeof tlvh);
+            return WTAP_OPEN_ERROR;
+        }
+
+        tlv_data_length = tlvh.length - (guint)sizeof tlvh;
+        /*
+         * Make sure reading the TLV data won't put us in the middle
+         * of the packet data.
+         */
+        if (offset + tlv_data_length > header_offset) {
+            /*
+             * We're at or past the point where the packet data begins,
+             * but we have the IE data to read.
+             */
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = g_strdup_printf("Observer: TLVs run into the first packet data");
+            return WTAP_OPEN_ERROR;
+        }
+
+
+        /* process (or skip over) the current TLV */
+        switch (tlvh.type) {
+        case INFORMATION_TYPE_TIME_INFO:
+            if (tlv_data_length != sizeof private_state->time_format) {
+                *err = WTAP_ERR_BAD_FILE;
+                *err_info = g_strdup_printf("Observer: bad record (time information TLV length %u != %zu)",
+                    tlvh.length,
+                    sizeof tlvh + sizeof private_state->time_format);
+                return WTAP_OPEN_ERROR;
+            }
+            if (!wtap_read_bytes(wth->fh, &private_state->time_format,
+                                 sizeof private_state->time_format,
+                                 err, err_info))
+                return WTAP_OPEN_ERROR;
+            private_state->time_format = GUINT32_FROM_LE(private_state->time_format);
+            offset += (guint)sizeof private_state->time_format;
+            break;
+        default:
+            if (tlv_data_length != 0) {
+                if (!wtap_read_bytes(wth->fh, NULL, tlv_data_length, err, err_info))
+                    return WTAP_OPEN_ERROR;
+            }
+            offset += tlv_data_length;
+        }
+    }
+
+    /* get to the first packet */
+    seek_increment = header_offset - offset;
+    if (seek_increment != 0) {
+        if (!wtap_read_bytes(wth->fh, NULL, seek_increment, err, err_info))
+            return WTAP_OPEN_ERROR;
+    }
+
+    /*
+     * We assume that all packets in a file have the same network type,
+     * whether they're data or expert information packets, and thus
+     * we can attempt to determine the network type by reading the
+     * first packet.
+     *
+     * If that's *not* the case, we need to use WTAP_ENCAP_PER_PACKET.
+     *
+     * Read the packet header.  Don't assume there *is* a packet;
+     * if there isn't, report that as a bad file.  (If we use
+     * WTAP_ENCAP_PER_PACKET, we don't need to handle that case, as
+     * we don't need to read the first packet.
+     */
+    if (!wtap_read_bytes_or_eof(wth->fh, &packet_header, sizeof packet_header,
+                                err, err_info)) {
+        if (*err == 0) {
+            /*
+             * EOF, so there *are* no records.
+             */
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = g_strdup_printf("Observer: No records in the file, so we can't determine the link-layer type");
+        }
+        return WTAP_OPEN_ERROR;
+    }
+    PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE(packet_header);
+
+    /* check the packet's magic number */
+    if (packet_header.packet_magic != observer_packet_magic) {
+        *err = WTAP_ERR_UNSUPPORTED;
+        *err_info = g_strdup_printf("Observer: unsupported packet version %ul", packet_header.packet_magic);
+        return WTAP_OPEN_ERROR;
+    }
+
+    /* check the data link type */
+    if (observer_to_wtap_encap(packet_header.network_type) == WTAP_ENCAP_UNKNOWN) {
+        *err = WTAP_ERR_UNSUPPORTED;
+        *err_info = g_strdup_printf("Observer: network type %u unknown or unsupported", packet_header.network_type);
+        return WTAP_OPEN_ERROR;
+    }
+    wth->file_encap = observer_to_wtap_encap(packet_header.network_type);
+
+    /* set up the rest of the capture parameters */
+    private_state->packet_count = 0;
+    private_state->network_type = wtap_to_observer_encap(wth->file_encap);
+    wth->subtype_read = observer_read;
+    wth->subtype_seek_read = observer_seek_read;
+    wth->subtype_close = NULL;
+    wth->subtype_sequential_close = NULL;
+    wth->snapshot_length = 0;    /* not available in header */
+    wth->file_tsprec = WTAP_TSPREC_NSEC;
+    wth->file_type_subtype = observer_file_type_subtype;
+
+    /* reset the pointer to the first packet */
+    if (file_seek(wth->fh, header_offset, SEEK_SET, err) == -1)
+        return WTAP_OPEN_ERROR;
+
+    err_str = init_gmt_to_localtime_offset();
+    if (err_str != NULL) {
+        *err = WTAP_ERR_INTERNAL;
+        *err_info = g_strdup_printf("observer: %s", err_str);
+        return WTAP_OPEN_ERROR;
+    }
+
+    /*
+     * Add an IDB; we don't know how many interfaces were
+     * involved, so we just say one interface, about which
+     * we only know the link-layer type, snapshot length,
+     * and time stamp resolution.
+     */
+    wtap_add_generated_idb(wth);
+
+    return WTAP_OPEN_MINE;
+}
+
+/* Reads the next packet. */
+static gboolean observer_read(wtap *wth, wtap_rec *rec, Buffer *buf,
+    int *err, gchar **err_info, gint64 *data_offset)
+{
+    int header_bytes_consumed;
+    int data_bytes_consumed;
+    packet_entry_header packet_header;
+
+    /* skip records other than data records */
+    for (;;) {
+        *data_offset = file_tell(wth->fh);
+
+        /* process the packet header, including TLVs */
+        header_bytes_consumed = read_packet_header(wth, wth->fh, &rec->rec_header.packet_header.pseudo_header, &packet_header, err,
+            err_info);
+        if (header_bytes_consumed <= 0)
+            return FALSE;    /* EOF or error */
+
+        if (packet_header.packet_type == PACKET_TYPE_DATA_PACKET)
+            break;
+
+        /* skip to next packet */
+        if (!skip_to_next_packet(wth, packet_header.offset_to_next_packet,
+                header_bytes_consumed, err, err_info)) {
+            return FALSE;    /* EOF or error */
+        }
+    }
+
+    if (!process_packet_header(wth, &packet_header, rec, err, err_info))
+        return FALSE;
+
+    /* read the frame data */
+    data_bytes_consumed = read_packet_data(wth->fh, packet_header.offset_to_frame,
+            header_bytes_consumed, buf, rec->rec_header.packet_header.caplen,
+            err, err_info);
+    if (data_bytes_consumed < 0) {
+        return FALSE;
+    }
+
+    /* skip over any extra bytes following the frame data */
+    if (!skip_to_next_packet(wth, packet_header.offset_to_next_packet,
+            header_bytes_consumed + data_bytes_consumed, err, err_info)) {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/* Reads a packet at an offset. */
+static gboolean observer_seek_read(wtap *wth, gint64 seek_off,
+    wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
+{
+    union wtap_pseudo_header *pseudo_header = &rec->rec_header.packet_header.pseudo_header;
+    packet_entry_header packet_header;
+    int offset;
+    int data_bytes_consumed;
+
+    if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
+        return FALSE;
+
+    /* process the packet header, including TLVs */
+    offset = read_packet_header(wth, wth->random_fh, pseudo_header, &packet_header, err,
+        err_info);
+    if (offset <= 0)
+        return FALSE;    /* EOF or error */
+
+    if (!process_packet_header(wth, &packet_header, rec, err, err_info))
+        return FALSE;
+
+    /* read the frame data */
+    data_bytes_consumed = read_packet_data(wth->random_fh, packet_header.offset_to_frame,
+        offset, buf, rec->rec_header.packet_header.caplen, err, err_info);
+    if (data_bytes_consumed < 0) {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+static int
+read_packet_header(wtap *wth, FILE_T fh, union wtap_pseudo_header *pseudo_header,
+    packet_entry_header *packet_header, int *err, gchar **err_info)
+{
+    int offset;
+    guint i;
+    tlv_header tlvh;
+    tlv_wireless_info wireless_header;
+
+    offset = 0;
+
+    /* pull off the packet header */
+    if (!wtap_read_bytes_or_eof(fh, packet_header, sizeof *packet_header,
+                                err, err_info)) {
+        if (*err != 0)
+            return -1;
+        return 0;    /* EOF */
+    }
+    offset += (int)sizeof *packet_header;
+    PACKET_ENTRY_HEADER_FROM_LE_IN_PLACE(*packet_header);
+
+    /* check the packet's magic number */
+    if (packet_header->packet_magic != observer_packet_magic) {
+
+        /*
+         * Some files are zero-padded at the end. There is no warning of this
+         * in the previous packet header information, such as setting
+         * offset_to_next_packet to zero. So detect this situation by treating
+         * an all-zero header as a sentinel. Return EOF when it is encountered,
+         * rather than treat it as a bad record.
+         */
+        for (i = 0; i < sizeof *packet_header; i++) {
+            if (((guint8*) packet_header)[i] != 0)
+                break;
+        }
+        if (i == sizeof *packet_header) {
+            *err = 0;
+            return 0;    /* EOF */
+        }
+
+        *err = WTAP_ERR_BAD_FILE;
+        *err_info = g_strdup_printf("Observer: bad record: Invalid magic number 0x%08x",
+            packet_header->packet_magic);
+        return -1;
+    }
+
+    /* initialize the pseudo header */
+    switch (wth->file_encap) {
+    case WTAP_ENCAP_ETHERNET:
+        /* There is no FCS in the frame */
+        pseudo_header->eth.fcs_len = 0;
+        break;
+    case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
+        memset(&pseudo_header->ieee_802_11, 0, sizeof(pseudo_header->ieee_802_11));
+        pseudo_header->ieee_802_11.fcs_len = 0;
+        pseudo_header->ieee_802_11.decrypted = FALSE;
+        pseudo_header->ieee_802_11.datapad = FALSE;
+        pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
+        /* Updated below */
+        break;
+    }
+
+    /* process extra information */
+    for (i = 0; i < packet_header->number_of_information_elements; i++) {
+        guint tlv_data_length;
+
+        /* read the TLV header */
+        if (!wtap_read_bytes(fh, &tlvh, sizeof tlvh, err, err_info))
+            return -1;
+        offset += (int)sizeof tlvh;
+        TLV_HEADER_FROM_LE_IN_PLACE(tlvh);
+
+        if (tlvh.length < sizeof tlvh) {
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = g_strdup_printf("Observer: bad record (TLV length %u < %zu)",
+                tlvh.length, sizeof tlvh);
+            return -1;
+        }
+        tlv_data_length = tlvh.length - (guint)sizeof tlvh;
+
+        /* process (or skip over) the current TLV */
+        switch (tlvh.type) {
+        case INFORMATION_TYPE_WIRELESS:
+            if (tlv_data_length != sizeof wireless_header) {
+                *err = WTAP_ERR_BAD_FILE;
+                *err_info = g_strdup_printf("Observer: bad record (wireless TLV length %u != %zu)",
+                    tlvh.length, sizeof tlvh + sizeof wireless_header);
+                return -1;
+            }
+            if (!wtap_read_bytes(fh, &wireless_header, sizeof wireless_header,
+                                 err, err_info))
+                return -1;
+            /* set decryption status */
+            /* XXX - what other bits are there in conditions? */
+            pseudo_header->ieee_802_11.decrypted = (wireless_header.conditions & WIRELESS_WEP_SUCCESS) != 0;
+            pseudo_header->ieee_802_11.has_channel = TRUE;
+            pseudo_header->ieee_802_11.channel = wireless_header.frequency;
+            pseudo_header->ieee_802_11.has_data_rate = TRUE;
+            pseudo_header->ieee_802_11.data_rate = wireless_header.rate;
+            pseudo_header->ieee_802_11.has_signal_percent = TRUE;
+            pseudo_header->ieee_802_11.signal_percent = wireless_header.strengthPercent;
+
+            /*
+             * We don't know they PHY, but we do have the data rate;
+             * try to guess the PHY based on the data rate and channel.
+             */
+            if (RATE_IS_DSSS(pseudo_header->ieee_802_11.data_rate)) {
+                /* 11b */
+                pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11B;
+                pseudo_header->ieee_802_11.phy_info.info_11b.has_short_preamble = FALSE;
+            } else if (RATE_IS_OFDM(pseudo_header->ieee_802_11.data_rate)) {
+                /* 11a or 11g, depending on the band. */
+                if (CHAN_IS_BG(pseudo_header->ieee_802_11.channel)) {
+                    /* 11g */
+                    pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11G;
+                    pseudo_header->ieee_802_11.phy_info.info_11g.has_mode = FALSE;
+                } else {
+                    /* 11a */
+                    pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_11A;
+                    pseudo_header->ieee_802_11.phy_info.info_11a.has_channel_type = FALSE;
+                    pseudo_header->ieee_802_11.phy_info.info_11a.has_turbo_type = FALSE;
+                }
+            }
+
+            offset += (int)sizeof wireless_header;
+            break;
+        default:
+            /* skip the TLV data */
+            if (tlv_data_length != 0) {
+                if (!wtap_read_bytes(fh, NULL, tlv_data_length, err, err_info))
+                    return -1;
+            }
+            offset += tlv_data_length;
+        }
+    }
+
+    return offset;
+}
+
+static gboolean
+process_packet_header(wtap *wth, packet_entry_header *packet_header,
+    wtap_rec *rec, int *err, gchar **err_info)
+{
+    /* set the wiretap record metadata fields */
+    rec->rec_type = REC_TYPE_PACKET;
+    rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+    rec->rec_header.packet_header.pkt_encap = observer_to_wtap_encap(packet_header->network_type);
+    if(wth->file_encap == WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS) {
+        rec->rec_header.packet_header.len = packet_header->network_size;
+        rec->rec_header.packet_header.caplen = packet_header->captured_size;
+    } else {
+        /*
+         * XXX - what are those 4 bytes?
+         *
+         * The comment in the code said "neglect frame markers for wiretap",
+         * but in the captures I've seen, there's no actual data corresponding
+         * to them that might be a "frame marker".
+         *
+         * Instead, the packets had a network_size 4 bytes larger than the
+         * captured_size; does the network_size include the CRC, even
+         * though it's not included in a capture?  If so, most other
+         * network analyzers that have a "network size" and a "captured
+         * size" don't include the CRC in the "network size" if they
+         * don't include the CRC in a full-length captured packet; the
+         * "captured size" is less than the "network size" only if a
+         * user-specified "snapshot length" caused the packet to be
+         * sliced at a particular point.
+         *
+         * That's the model that wiretap and Wireshark/TShark use, so
+         * we implement that model here.
+         */
+        if (packet_header->network_size < 4) {
+            *err = WTAP_ERR_BAD_FILE;
+            *err_info = g_strdup_printf("Observer: bad record: Packet length %u < 4",
+                                        packet_header->network_size);
+            return FALSE;
+        }
+
+        rec->rec_header.packet_header.len = packet_header->network_size - 4;
+        rec->rec_header.packet_header.caplen = MIN(packet_header->captured_size, rec->rec_header.packet_header.len);
+    }
+    /*
+     * The maximum value of packet_header->captured_size is 65535, which
+     * is less than WTAP_MAX_PACKET_SIZE_STANDARD will ever be, so we don't need
+     * to check it.
+     */
+
+    /* set the wiretap timestamp, assuming for the moment that Observer encoded it in GMT */
+    rec->ts.secs = (time_t) ((packet_header->nano_seconds_since_2000 / 1000000000) + ansi_to_observer_epoch_offset);
+    rec->ts.nsecs = (int) (packet_header->nano_seconds_since_2000 % 1000000000);
+
+    /* adjust to local time, if necessary, also accounting for DST if the frame
+       was captured while it was in effect */
+    if (((observer_dump_private_state*)wth->priv)->time_format == TIME_INFO_LOCAL)
+    {
+        struct tm *tm;
+        struct tm daylight_tm;
+        struct tm standard_tm;
+        time_t    dst_offset;
+
+        /* the Observer timestamp was encoded as local time, so add a
+           correction from local time to GMT */
+        rec->ts.secs += gmt_to_localtime_offset;
+
+        /* perform a DST adjustment if necessary */
+        tm = localtime(&rec->ts.secs);
+        if (tm != NULL) {
+            standard_tm = *tm;
+            if (standard_tm.tm_isdst > 0) {
+                daylight_tm = standard_tm;
+                standard_tm.tm_isdst = 0;
+                dst_offset = mktime(&standard_tm) - mktime(&daylight_tm);
+                 rec->ts.secs -= dst_offset;
+            }
+        }
+    }
+
+    return TRUE;
+}
+
+static int
+read_packet_data(FILE_T fh, int offset_to_frame, int current_offset_from_packet_header, Buffer *buf,
+    int length, int *err, char **err_info)
+{
+    int seek_increment;
+    int bytes_consumed = 0;
+
+    /* validate offsets */
+    if (offset_to_frame < current_offset_from_packet_header) {
+        *err = WTAP_ERR_BAD_FILE;
+        *err_info = g_strdup_printf("Observer: bad record (offset to packet data %d < %d)",
+            offset_to_frame, current_offset_from_packet_header);
+        return -1;
+    }
+
+    /* skip to the packet data */
+    seek_increment = offset_to_frame - current_offset_from_packet_header;
+    if (seek_increment > 0) {
+        if (!wtap_read_bytes(fh, NULL, seek_increment, err, err_info)) {
+            return -1;
+        }
+        bytes_consumed += seek_increment;
+    }
+
+    /* read in the packet data */
+    if (!wtap_read_packet_bytes(fh, buf, length, err, err_info))
+        return FALSE;
+    bytes_consumed += length;
+
+    return bytes_consumed;
+}
+
+static gboolean
+skip_to_next_packet(wtap *wth, int offset_to_next_packet, int current_offset_from_packet_header, int *err,
+    char **err_info)
+{
+    int seek_increment;
+
+    /* validate offsets */
+    if (offset_to_next_packet < current_offset_from_packet_header) {
+        *err = WTAP_ERR_BAD_FILE;
+        *err_info = g_strdup_printf("Observer: bad record (offset to next packet %d < %d)",
+            offset_to_next_packet, current_offset_from_packet_header);
+        return FALSE;
+    }
+
+    /* skip to the next packet header */
+    seek_increment = offset_to_next_packet - current_offset_from_packet_header;
+    if (seek_increment > 0) {
+        if (!wtap_read_bytes(wth->fh, NULL, seek_increment, err, err_info))
+            return FALSE;
+    }
+
+    return TRUE;
+}
+
+/* Returns 0 if we could write the specified encapsulation type,
+   an error indication otherwise. */
+static int observer_dump_can_write_encap(int encap)
+{
+    /* per-packet encapsulations aren't supported */
+    if (encap == WTAP_ENCAP_PER_PACKET)
+        return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
+
+    if (encap < 0 || (wtap_to_observer_encap(encap) == OBSERVER_UNDEFINED))
+        return WTAP_ERR_UNWRITABLE_ENCAP;
+
+    return 0;
+}
+
+/* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
+   failure. */
+static gboolean observer_dump_open(wtap_dumper *wdh, int *err,
+    gchar **err_info)
+{
+    observer_dump_private_state * private_state = NULL;
+    capture_file_header file_header;
+    guint header_offset;
+    const gchar *err_str;
+    tlv_header comment_header;
+    char comment[64];
+    size_t comment_length;
+    tlv_header time_info_header;
+    tlv_time_info time_info;
+    struct tm * current_time;
+    time_t system_time;
+
+    /* initialize the private state */
+    private_state = g_new(observer_dump_private_state, 1);
+    private_state->packet_count = 0;
+    private_state->network_type = wtap_to_observer_encap(wdh->encap);
+    private_state->time_format = TIME_INFO_GMT;
+
+    /* populate the fields of wdh */
+    wdh->priv = (void *) private_state;
+    wdh->subtype_write = observer_dump;
+
+    /* initialize the file header */
+    memset(&file_header, 0x00, sizeof(file_header));
+    g_strlcpy(file_header.observer_version, observer_magic, 31);
+    header_offset = (guint16)sizeof(file_header);
+
+    /* create the file comment TLV */
+    {
+        time(&system_time);
+        current_time = localtime(&system_time);
+        memset(&comment, 0x00, sizeof(comment));
+        if (current_time != NULL)
+            g_snprintf(comment, 64, "This capture was saved from Wireshark on %s", asctime(current_time));
+        else
+            g_snprintf(comment, 64, "This capture was saved from Wireshark");
+        comment_length = strlen(comment);
+
+        comment_header.type = INFORMATION_TYPE_COMMENT;
+        comment_header.length = (guint16) (sizeof(comment_header) + comment_length);
+
+        /* update the file header to account for the comment TLV */
+        file_header.number_of_information_elements++;
+        header_offset += comment_header.length;
+    }
+
+    /* create the timestamp encoding TLV */
+    {
+        time_info_header.type = INFORMATION_TYPE_TIME_INFO;
+        time_info_header.length = (guint16) (sizeof(time_info_header) + sizeof(time_info));
+        time_info.time_format = TIME_INFO_GMT;
+
+        /* update the file header to account for the timestamp encoding TLV */
+        file_header.number_of_information_elements++;
+        header_offset += time_info_header.length;
+    }
+
+    /* Store the offset to the first packet */
+    file_header.offset_to_first_packet_high_byte = (header_offset >> 16);
+    file_header.offset_to_first_packet = (header_offset & 0xFFFF);
+
+    /* write the file header, swapping any multibyte fields first */
+    CAPTURE_FILE_HEADER_TO_LE_IN_PLACE(file_header);
+    if (!wtap_dump_file_write(wdh, &file_header, sizeof(file_header), err)) {
+        return FALSE;
+    }
+    wdh->bytes_dumped += sizeof(file_header);
+
+    /* write the comment TLV */
+    {
+        TLV_HEADER_TO_LE_IN_PLACE(comment_header);
+        if (!wtap_dump_file_write(wdh, &comment_header, sizeof(comment_header), err)) {
+            return FALSE;
+        }
+        wdh->bytes_dumped += sizeof(comment_header);
+
+        if (!wtap_dump_file_write(wdh, &comment, comment_length, err)) {
+            return FALSE;
+        }
+        wdh->bytes_dumped += comment_length;
+    }
+
+    /* write the time info TLV */
+    {
+        TLV_HEADER_TO_LE_IN_PLACE(time_info_header);
+        if (!wtap_dump_file_write(wdh, &time_info_header, sizeof(time_info_header), err)) {
+            return FALSE;
+        }
+        wdh->bytes_dumped += sizeof(time_info_header);
+
+        TLV_TIME_INFO_TO_LE_IN_PLACE(time_info);
+        if (!wtap_dump_file_write(wdh, &time_info, sizeof(time_info), err)) {
+            return FALSE;
+        }
+        wdh->bytes_dumped += sizeof(time_info);
+    }
+
+    err_str = init_gmt_to_localtime_offset();
+    if (err_str != NULL) {
+        *err = WTAP_ERR_INTERNAL;
+        *err_info = g_strdup_printf("observer: %s", err_str);
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+/* Write a record for a packet to a dump file.
+   Returns TRUE on success, FALSE on failure. */
+static gboolean observer_dump(wtap_dumper *wdh, const wtap_rec *rec,
+    const guint8 *pd,
+    int *err, gchar **err_info _U_)
+{
+    observer_dump_private_state * private_state = NULL;
+    packet_entry_header           packet_header;
+    guint64                       seconds_since_2000;
+
+    /* We can only write packet records. */
+    if (rec->rec_type != REC_TYPE_PACKET) {
+        *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
+        return FALSE;
+    }
+
+    /*
+     * Make sure this packet doesn't have a link-layer type that
+     * differs from the one for the file.
+     */
+    if (wdh->encap != rec->rec_header.packet_header.pkt_encap) {
+        *err = WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
+        return FALSE;
+    }
+
+    /* The captured size field is 16 bits, so there's a hard limit of
+       65535. */
+    if (rec->rec_header.packet_header.caplen > 65535) {
+        *err = WTAP_ERR_PACKET_TOO_LARGE;
+        return FALSE;
+    }
+
+    /* convert the number of seconds since epoch from ANSI-relative to
+       Observer-relative */
+    if (rec->ts.secs < ansi_to_observer_epoch_offset) {
+        if(rec->ts.secs > (time_t) 0) {
+            seconds_since_2000 = rec->ts.secs;
+        } else {
+            seconds_since_2000 = (time_t) 0;
+        }
+    } else {
+        seconds_since_2000 = rec->ts.secs - ansi_to_observer_epoch_offset;
+    }
+
+    /* populate the fields of the packet header */
+    private_state = (observer_dump_private_state *) wdh->priv;
+
+    memset(&packet_header, 0x00, sizeof(packet_header));
+    packet_header.packet_magic = observer_packet_magic;
+    packet_header.network_speed = 1000000;
+    packet_header.captured_size = (guint16) rec->rec_header.packet_header.caplen;
+    packet_header.network_size = (guint16) (rec->rec_header.packet_header.len + 4);
+    packet_header.offset_to_frame = sizeof(packet_header);
+    /* XXX - what if this doesn't fit in 16 bits?  It's not guaranteed to... */
+    packet_header.offset_to_next_packet = (guint16)sizeof(packet_header) + rec->rec_header.packet_header.caplen;
+    packet_header.network_type = private_state->network_type;
+    packet_header.flags = 0x00;
+    packet_header.number_of_information_elements = 0;
+    packet_header.packet_type = PACKET_TYPE_DATA_PACKET;
+    packet_header.packet_number = private_state->packet_count;
+    packet_header.original_packet_number = packet_header.packet_number;
+    packet_header.nano_seconds_since_2000 = seconds_since_2000 * 1000000000 + rec->ts.nsecs;
+
+    private_state->packet_count++;
+
+    /* write the packet header */
+    PACKET_ENTRY_HEADER_TO_LE_IN_PLACE(packet_header);
+    if (!wtap_dump_file_write(wdh, &packet_header, sizeof(packet_header), err)) {
+        return FALSE;
+    }
+    wdh->bytes_dumped += sizeof(packet_header);
+
+    /* write the packet data */
+    if (!wtap_dump_file_write(wdh, pd, rec->rec_header.packet_header.caplen, err)) {
+        return FALSE;
+    }
+    wdh->bytes_dumped += rec->rec_header.packet_header.caplen;
+
+    return TRUE;
+}
+
+static gint observer_to_wtap_encap(int observer_encap)
+{
+    switch(observer_encap) {
+    case OBSERVER_ETHERNET:
+        return WTAP_ENCAP_ETHERNET;
+    case OBSERVER_TOKENRING:
+        return WTAP_ENCAP_TOKEN_RING;
+    case OBSERVER_FIBRE_CHANNEL:
+        return WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS;
+    case OBSERVER_WIRELESS_802_11:
+        return WTAP_ENCAP_IEEE_802_11_WITH_RADIO;
+    case OBSERVER_UNDEFINED:
+        return WTAP_ENCAP_UNKNOWN;
+    }
+    return WTAP_ENCAP_UNKNOWN;
+}
+
+static gint wtap_to_observer_encap(int wtap_encap)
+{
+    switch(wtap_encap) {
+    case WTAP_ENCAP_ETHERNET:
+        return OBSERVER_ETHERNET;
+    case WTAP_ENCAP_TOKEN_RING:
+        return OBSERVER_TOKENRING;
+    case WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS:
+        return OBSERVER_FIBRE_CHANNEL;
+    case WTAP_ENCAP_UNKNOWN:
+        return OBSERVER_UNDEFINED;
+    }
+    return OBSERVER_UNDEFINED;
+}
+
+static const struct supported_block_type observer_blocks_supported[] = {
+    /*
+     * We support packet blocks, with no comments or other options.
+     */
+    { WTAP_BLOCK_PACKET, MULTIPLE_BLOCKS_SUPPORTED, NO_OPTIONS_SUPPORTED }
+};
+
+static const struct file_type_subtype_info observer_info = {
+    "Viavi Observer", "observer", "bfr", NULL,
+    FALSE, BLOCKS_SUPPORTED(observer_blocks_supported),
+    observer_dump_can_write_encap, observer_dump_open, NULL
+};
+
+void register_observer(void)
+{
+    observer_file_type_subtype = wtap_register_file_type_subtype(&observer_info);
+
+    /*
+     * We now call this file format just "observer", but we allow
+     * it to be referred to as "niobserver" for backwards
+     * compatibility.
+     *
+     * Register "niobserver" for that purpose.
+     */
+    wtap_register_compatibility_file_subtype_name("niobserver", "observer");
+
+    /*
+     * Register name for backwards compatibility with the
+     * wtap_filetypes table in Lua.
+     */
+    wtap_register_backwards_compatibility_lua_name("NETWORK_INSTRUMENTS",
+                                                   observer_file_type_subtype);
+}
+
+/*
+ * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 4
+ * tab-width: 8
+ * indent-tabs-mode: nil
+ * End:
+ *
+ * vi: set shiftwidth=4 tabstop=8 expandtab:
+ * :indentSize=4:tabSize=8:noTabs=true:
+ */