epan/dissectors/packet-xml.c try to decrypt data, but the data doesn't look correct yet
[metze/wireshark/wip.git] / wiretap / snoop.c
index b023c327bfdc4b18bb8a6b5adeaf16a7f55d1344..95aaa7d9f984d91da6d4e8fd067713420eaad7e1 100644 (file)
@@ -3,19 +3,7 @@
  * Wiretap Library
  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
 #include "config.h"
@@ -23,7 +11,6 @@
 #include <string.h>
 #include "wtap-int.h"
 #include "file_wrappers.h"
-#include <wsutil/buffer.h>
 #include "atm.h"
 #include "snoop.h"
 /* See RFC 1761 for a description of the "snoop" file format. */
@@ -87,16 +74,16 @@ struct shomiti_trailer {
 static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
     gint64 *data_offset);
 static gboolean snoop_seek_read(wtap *wth, gint64 seek_off,
-    struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info);
-static int snoop_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
+    wtap_rec *rec, Buffer *buf, int *err, gchar **err_info);
+static int snoop_read_packet(wtap *wth, FILE_T fh, wtap_rec *rec,
     Buffer *buf, int *err, gchar **err_info);
 static gboolean snoop_read_atm_pseudoheader(FILE_T fh,
     union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info);
 static gboolean snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
     union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info,
     int *header_size);
-static gboolean snoop_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
-    const guint8 *pd, int *err);
+static gboolean snoop_dump(wtap_dumper *wdh, const wtap_rec *rec,
+    const guint8 *pd, int *err, gchar **err_info);
 
 /*
  * See
@@ -177,9 +164,8 @@ static gboolean snoop_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
  * 4MB from 16MB Token Ring, and distinguishing both of them from the
  * "Shomiti" versions of same.
  */
-int snoop_open(wtap *wth, int *err, gchar **err_info)
+wtap_open_return_val snoop_open(wtap *wth, int *err, gchar **err_info)
 {
-       int bytes_read;
        char magic[sizeof snoop_magic];
        struct snoop_hdr hdr;
        struct snooprec_hdr rec_hdr;
@@ -212,7 +198,7 @@ int snoop_open(wtap *wth, int *err, gchar **err_info)
                WTAP_ENCAP_UNKNOWN,     /* 100VG-AnyLAN Token Ring */
                WTAP_ENCAP_UNKNOWN,     /* "ISO 8802/3 and Ethernet" */
                WTAP_ENCAP_UNKNOWN,     /* 100BaseT (but that's just Ethernet) */
-               WTAP_ENCAP_IP_OVER_IB,  /* Infiniband */
+               WTAP_ENCAP_IP_OVER_IB_SNOOP,    /* Infiniband */
        };
        #define NUM_SNOOP_ENCAPS (sizeof snoop_encap / sizeof snoop_encap[0])
        #define SNOOP_PRIVATE_BIT 0x80000000
@@ -254,28 +240,19 @@ int snoop_open(wtap *wth, int *err, gchar **err_info)
        gint64 saved_offset;
 
        /* Read in the string that should be at the start of a "snoop" file */
-       errno = WTAP_ERR_CANT_READ;
-       bytes_read = file_read(magic, sizeof magic, wth->fh);
-       if (bytes_read != sizeof magic) {
-               *err = file_error(wth->fh, err_info);
-               if (*err != 0 && *err != WTAP_ERR_SHORT_READ)
-                       return -1;
-               return 0;
+       if (!wtap_read_bytes(wth->fh, magic, sizeof magic, err, err_info)) {
+               if (*err != WTAP_ERR_SHORT_READ)
+                       return WTAP_OPEN_ERROR;
+               return WTAP_OPEN_NOT_MINE;
        }
 
        if (memcmp(magic, snoop_magic, sizeof snoop_magic) != 0) {
-               return 0;
+               return WTAP_OPEN_NOT_MINE;
        }
 
        /* Read the rest of the header. */
-       errno = WTAP_ERR_CANT_READ;
-       bytes_read = file_read(&hdr, sizeof hdr, wth->fh);
-       if (bytes_read != sizeof hdr) {
-               *err = file_error(wth->fh, err_info);
-               if (*err == 0)
-                       *err = WTAP_ERR_SHORT_READ;
-               return -1;
-       }
+       if (!wtap_read_bytes(wth->fh, &hdr, sizeof hdr, err, err_info))
+               return WTAP_OPEN_ERROR;
 
        /*
         * Make sure it's a version we support.
@@ -294,7 +271,7 @@ int snoop_open(wtap *wth, int *err, gchar **err_info)
        default:
                *err = WTAP_ERR_UNSUPPORTED;
                *err_info = g_strdup_printf("snoop: version %u unsupported", hdr.version);
-               return -1;
+               return WTAP_OPEN_ERROR;
        }
 
        /*
@@ -329,13 +306,9 @@ int snoop_open(wtap *wth, int *err, gchar **err_info)
 
        /* Read first record header. */
        saved_offset = file_tell(wth->fh);
-       errno = WTAP_ERR_CANT_READ;
-       bytes_read = file_read(&rec_hdr, sizeof rec_hdr, wth->fh);
-       if (bytes_read != sizeof rec_hdr) {
-               *err = file_error(wth->fh, err_info);
-               if (*err == 0)
-                       *err = WTAP_ERR_SHORT_READ;
-               return -1;
+       if (!wtap_read_bytes_or_eof(wth->fh, &rec_hdr, sizeof rec_hdr, err, err_info)) {
+               if (*err != 0)
+                       return WTAP_OPEN_ERROR;
 
                /*
                 * The file ends after the record header, which means this
@@ -377,16 +350,16 @@ int snoop_open(wtap *wth, int *err, gchar **err_info)
         * Seek back to the beginning of the first record.
         */
        if (file_seek(wth->fh, saved_offset, SEEK_SET, err) == -1)
-               return -1;
+               return WTAP_OPEN_ERROR;
 
        hdr.network = g_ntohl(hdr.network);
        if (is_shomiti) {
                if (hdr.network >= NUM_SHOMITI_ENCAPS
                    || shomiti_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
-                       *err = WTAP_ERR_UNSUPPORTED_ENCAP;
+                       *err = WTAP_ERR_UNSUPPORTED;
                        *err_info = g_strdup_printf("snoop: Shomiti network type %u unknown or unsupported",
                            hdr.network);
-                       return -1;
+                       return WTAP_OPEN_ERROR;
                }
                file_encap = shomiti_encap[hdr.network];
 
@@ -395,10 +368,10 @@ int snoop_open(wtap *wth, int *err, gchar **err_info)
        } else if (hdr.network & SNOOP_PRIVATE_BIT) {
                if ((hdr.network^SNOOP_PRIVATE_BIT) >= NUM_SNOOP_PRIVATE_ENCAPS
                    || snoop_private_encap[hdr.network^SNOOP_PRIVATE_BIT] == WTAP_ENCAP_UNKNOWN) {
-                       *err = WTAP_ERR_UNSUPPORTED_ENCAP;
+                       *err = WTAP_ERR_UNSUPPORTED;
                        *err_info = g_strdup_printf("snoop: private network type %u unknown or unsupported",
                            hdr.network);
-                       return -1;
+                       return WTAP_OPEN_ERROR;
                }
                file_encap = snoop_private_encap[hdr.network^SNOOP_PRIVATE_BIT];
 
@@ -407,10 +380,10 @@ int snoop_open(wtap *wth, int *err, gchar **err_info)
        } else {
                if (hdr.network >= NUM_SNOOP_ENCAPS
                    || snoop_encap[hdr.network] == WTAP_ENCAP_UNKNOWN) {
-                       *err = WTAP_ERR_UNSUPPORTED_ENCAP;
+                       *err = WTAP_ERR_UNSUPPORTED;
                        *err_info = g_strdup_printf("snoop: network type %u unknown or unsupported",
                            hdr.network);
-                       return -1;
+                       return WTAP_OPEN_ERROR;
                }
                file_encap = snoop_encap[hdr.network];
 
@@ -427,8 +400,8 @@ int snoop_open(wtap *wth, int *err, gchar **err_info)
        wth->subtype_seek_read = snoop_seek_read;
        wth->file_encap = file_encap;
        wth->snapshot_length = 0;       /* not available in header */
-       wth->tsprecision = WTAP_FILE_TSPREC_USEC;
-       return 1;
+       wth->file_tsprec = WTAP_TSPREC_USEC;
+       return WTAP_OPEN_MINE;
 }
 
 typedef struct {
@@ -448,40 +421,20 @@ static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
     gint64 *data_offset)
 {
        int     padbytes;
-       int     bytes_read;
-       char    padbuf[4];
-       int     bytes_to_read;
 
        *data_offset = file_tell(wth->fh);
 
-       padbytes = snoop_read_packet(wth, wth->fh, &wth->phdr,
-           wth->frame_buffer, err, err_info);
+       padbytes = snoop_read_packet(wth, wth->fh, &wth->rec,
+           wth->rec_data, err, err_info);
        if (padbytes == -1)
                return FALSE;
 
        /*
-        * Skip over the padding (don't "fseek()", as the standard
-        * I/O library on some platforms discards buffered data if
-        * you do that, which means it does a lot more reads).
-        *
-        * XXX - is that still true?
-        *
-        * There's probably not much padding (it's probably padded only
-        * to a 4-byte boundary), so we probably need only do one read.
+        * Skip over the padding, if any.
         */
-       while (padbytes != 0) {
-               bytes_to_read = padbytes;
-               if ((unsigned)bytes_to_read > sizeof padbuf)
-                       bytes_to_read = sizeof padbuf;
-               errno = WTAP_ERR_CANT_READ;
-               bytes_read = file_read(padbuf, bytes_to_read, wth->fh);
-               if (bytes_read != bytes_to_read) {
-                       *err = file_error(wth->fh, err_info);
-                       if (*err == 0)
-                               *err = WTAP_ERR_SHORT_READ;
+       if (padbytes != 0) {
+               if (!wtap_read_bytes(wth->fh, NULL, padbytes, err, err_info))
                        return FALSE;
-               }
-               padbytes -= bytes_read;
        }
 
        return TRUE;
@@ -489,12 +442,12 @@ static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
 
 static gboolean
 snoop_seek_read(wtap *wth, gint64 seek_off,
-    struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
+    wtap_rec *rec, Buffer *buf, int *err, gchar **err_info)
 {
        if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
                return FALSE;
 
-       if (snoop_read_packet(wth, wth->random_fh, phdr, buf, err, err_info) == -1) {
+       if (snoop_read_packet(wth, wth->random_fh, rec, buf, err, err_info) == -1) {
                if (*err == 0)
                        *err = WTAP_ERR_SHORT_READ;
                return FALSE;
@@ -503,47 +456,40 @@ snoop_seek_read(wtap *wth, gint64 seek_off,
 }
 
 static int
-snoop_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
+snoop_read_packet(wtap *wth, FILE_T fh, wtap_rec *rec,
     Buffer *buf, int *err, gchar **err_info)
 {
        struct snooprec_hdr hdr;
-       int     bytes_read;
        guint32 rec_size;
        guint32 packet_size;
        guint32 orig_size;
        int header_size;
 
        /* Read record header. */
-       errno = WTAP_ERR_CANT_READ;
-       bytes_read = file_read(&hdr, sizeof hdr, fh);
-       if (bytes_read != sizeof hdr) {
-               *err = file_error(fh, err_info);
-               if (*err == 0 && bytes_read != 0)
-                       *err = WTAP_ERR_SHORT_READ;
+       if (!wtap_read_bytes_or_eof(fh, &hdr, sizeof hdr, err, err_info))
                return -1;
-       }
 
        rec_size = g_ntohl(hdr.rec_len);
        orig_size = g_ntohl(hdr.orig_len);
        packet_size = g_ntohl(hdr.incl_len);
-       if (orig_size > WTAP_MAX_PACKET_SIZE) {
+       if (orig_size > WTAP_MAX_PACKET_SIZE_STANDARD) {
                /*
                 * Probably a corrupt capture file; don't blow up trying
                 * to allocate space for an immensely-large packet.
                 */
                *err = WTAP_ERR_BAD_FILE;
                *err_info = g_strdup_printf("snoop: File has %u-byte original length, bigger than maximum of %u",
-                   orig_size, WTAP_MAX_PACKET_SIZE);
+                   orig_size, WTAP_MAX_PACKET_SIZE_STANDARD);
                return -1;
        }
-       if (packet_size > WTAP_MAX_PACKET_SIZE) {
+       if (packet_size > WTAP_MAX_PACKET_SIZE_STANDARD) {
                /*
                 * Probably a corrupt capture file; don't blow up trying
                 * to allocate space for an immensely-large packet.
                 */
                *err = WTAP_ERR_BAD_FILE;
                *err_info = g_strdup_printf("snoop: File has %u-byte packet, bigger than maximum of %u",
-                   packet_size, WTAP_MAX_PACKET_SIZE);
+                   packet_size, WTAP_MAX_PACKET_SIZE_STANDARD);
                return -1;
        }
        if (packet_size > rec_size) {
@@ -575,7 +521,7 @@ snoop_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
                            packet_size);
                        return -1;
                }
-               if (!snoop_read_atm_pseudoheader(fh, &phdr->pseudo_header,
+               if (!snoop_read_atm_pseudoheader(fh, &rec->rec_header.packet_header.pseudo_header,
                    err, err_info))
                        return -1;      /* Read error */
 
@@ -594,9 +540,9 @@ snoop_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
                 * is.  (XXX - or should we treat it a "maybe"?)
                 */
                if (wth->file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_SHOMITI)
-                       phdr->pseudo_header.eth.fcs_len = 4;
+                       rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 4;
                else
-                       phdr->pseudo_header.eth.fcs_len = 0;
+                       rec->rec_header.packet_header.pseudo_header.eth.fcs_len = 0;
                break;
 
        case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
@@ -611,7 +557,7 @@ snoop_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
                        return -1;
                }
                if (!snoop_read_shomiti_wireless_pseudoheader(fh,
-                   &phdr->pseudo_header, err, err_info, &header_size))
+                   &rec->rec_header.packet_header.pseudo_header, err, err_info, &header_size))
                        return -1;      /* Read error */
 
                /*
@@ -623,12 +569,12 @@ snoop_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
                break;
        }
 
-       phdr->rec_type = REC_TYPE_PACKET;
-       phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
-       phdr->ts.secs = g_ntohl(hdr.ts_sec);
-       phdr->ts.nsecs = g_ntohl(hdr.ts_usec) * 1000;
-       phdr->caplen = packet_size;
-       phdr->len = orig_size;
+       rec->rec_type = REC_TYPE_PACKET;
+       rec->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+       rec->ts.secs = g_ntohl(hdr.ts_sec);
+       rec->ts.nsecs = g_ntohl(hdr.ts_usec) * 1000;
+       rec->rec_header.packet_header.caplen = packet_size;
+       rec->rec_header.packet_header.len = orig_size;
 
        if (rec_size < (sizeof hdr + packet_size)) {
                /*
@@ -651,8 +597,8 @@ snoop_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
         * traffic it is based on the packet contents.
         */
        if (wth->file_encap == WTAP_ENCAP_ATM_PDUS &&
-           phdr->pseudo_header.atm.type == TRAF_LANE) {
-               atm_guess_lane_type(phdr, ws_buffer_start_ptr(buf));
+           rec->rec_header.packet_header.pseudo_header.atm.type == TRAF_LANE) {
+               atm_guess_lane_type(rec, ws_buffer_start_ptr(buf));
        }
 
        return rec_size - ((guint)sizeof hdr + packet_size);
@@ -663,18 +609,11 @@ snoop_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
     int *err, gchar **err_info)
 {
        struct snoop_atm_hdr atm_phdr;
-       int     bytes_read;
        guint8  vpi;
        guint16 vci;
 
-       errno = WTAP_ERR_CANT_READ;
-       bytes_read = file_read(&atm_phdr, sizeof (struct snoop_atm_hdr), fh);
-       if (bytes_read != sizeof (struct snoop_atm_hdr)) {
-               *err = file_error(fh, err_info);
-               if (*err == 0)
-                       *err = WTAP_ERR_SHORT_READ;
+       if (!wtap_read_bytes(fh, &atm_phdr, sizeof atm_phdr, err, err_info))
                return FALSE;
-       }
 
        vpi = atm_phdr.vpi;
        vci = pntoh16(&atm_phdr.vci);
@@ -757,17 +696,10 @@ snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
     int *header_size)
 {
        shomiti_wireless_header whdr;
-       int     bytes_read;
        int     rsize;
 
-       errno = WTAP_ERR_CANT_READ;
-       bytes_read = file_read(&whdr, sizeof (shomiti_wireless_header), fh);
-       if (bytes_read != sizeof (shomiti_wireless_header)) {
-               *err = file_error(fh, err_info);
-               if (*err == 0)
-                       *err = WTAP_ERR_SHORT_READ;
+       if (!wtap_read_bytes(fh, &whdr, sizeof whdr, err, err_info))
                return FALSE;
-       }
 
        /* the 4th byte of the pad is actually a header length,
         * we've already read 8 bytes of it, and it must never
@@ -791,13 +723,20 @@ snoop_read_shomiti_wireless_pseudoheader(FILE_T fh,
        }
        /* Skip the header. */
        rsize = ((int) whdr.pad[3]) - 8;
-       if (file_seek(fh, rsize, SEEK_CUR, err) == -1)
+       if (!wtap_read_bytes(fh, NULL, rsize, err, err_info))
                return FALSE;
 
+       memset(&pseudo_header->ieee_802_11, 0, sizeof(pseudo_header->ieee_802_11));
        pseudo_header->ieee_802_11.fcs_len = 4;
+       pseudo_header->ieee_802_11.decrypted = FALSE;
+       pseudo_header->ieee_802_11.datapad = FALSE;
+       pseudo_header->ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
+       pseudo_header->ieee_802_11.has_channel = TRUE;
        pseudo_header->ieee_802_11.channel = whdr.channel;
+       pseudo_header->ieee_802_11.has_data_rate = TRUE;
        pseudo_header->ieee_802_11.data_rate = whdr.rate;
-       pseudo_header->ieee_802_11.signal_level = whdr.signal;
+       pseudo_header->ieee_802_11.has_signal_percent = TRUE;
+       pseudo_header->ieee_802_11.signal_percent = whdr.signal;
 
        /* add back the header and don't forget the pad as well */
        *header_size = rsize + 8 + 4;
@@ -832,7 +771,7 @@ int snoop_dump_can_write_encap(int encap)
                return WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
 
        if (encap < 0 || (unsigned)encap >= NUM_WTAP_ENCAPS || wtap_encap[encap] == -1)
-               return WTAP_ERR_UNSUPPORTED_ENCAP;
+               return WTAP_ERR_UNWRITABLE_ENCAP;
 
        return 0;
 }
@@ -845,7 +784,6 @@ gboolean snoop_dump_open(wtap_dumper *wdh, int *err)
 
        /* This is a snoop file */
        wdh->subtype_write = snoop_dump;
-       wdh->subtype_close = NULL;
 
        /* Write the file header. */
        if (!wtap_dump_file_write(wdh, &snoop_magic, sizeof snoop_magic, err))
@@ -863,10 +801,10 @@ gboolean snoop_dump_open(wtap_dumper *wdh, int *err)
 /* Write a record for a packet to a dump file.
    Returns TRUE on success, FALSE on failure. */
 static gboolean snoop_dump(wtap_dumper *wdh,
-       const struct wtap_pkthdr *phdr,
-       const guint8 *pd, int *err)
+       const wtap_rec *rec,
+       const guint8 *pd, int *err, gchar **err_info _U_)
 {
-       const union wtap_pseudo_header *pseudo_header = &phdr->pseudo_header;
+       const union wtap_pseudo_header *pseudo_header = &rec->rec_header.packet_header.pseudo_header;
        struct snooprec_hdr rec_hdr;
        int reclen;
        guint padlen;
@@ -875,8 +813,17 @@ static gboolean snoop_dump(wtap_dumper *wdh,
        int atm_hdrsize;
 
        /* We can only write packet records. */
-       if (phdr->rec_type != REC_TYPE_PACKET) {
-               *err = WTAP_ERR_REC_TYPE_UNSUPPORTED;
+       if (rec->rec_type != REC_TYPE_PACKET) {
+               *err = WTAP_ERR_UNWRITABLE_REC_TYPE;
+               return FALSE;
+       }
+
+       /*
+        * Make sure this packet doesn't have a link-layer type that
+        * differs from the one for the file.
+        */
+       if (wdh->encap != rec->rec_header.packet_header.pkt_encap) {
+               *err = WTAP_ERR_ENCAP_PER_PACKET_UNSUPPORTED;
                return FALSE;
        }
 
@@ -886,7 +833,7 @@ static gboolean snoop_dump(wtap_dumper *wdh,
                atm_hdrsize = 0;
 
        /* Record length = header length plus data length... */
-       reclen = (int)sizeof rec_hdr + phdr->caplen + atm_hdrsize;
+       reclen = (int)sizeof rec_hdr + rec->rec_header.packet_header.caplen + atm_hdrsize;
 
 
        /* ... plus enough bytes to pad it to a 4-byte boundary. */
@@ -894,17 +841,17 @@ static gboolean snoop_dump(wtap_dumper *wdh,
        reclen += padlen;
 
        /* Don't write anything we're not willing to read. */
-       if (phdr->caplen + atm_hdrsize > WTAP_MAX_PACKET_SIZE) {
+       if (rec->rec_header.packet_header.caplen + atm_hdrsize > WTAP_MAX_PACKET_SIZE_STANDARD) {
                *err = WTAP_ERR_PACKET_TOO_LARGE;
                return FALSE;
        }
 
-       rec_hdr.orig_len = g_htonl(phdr->len + atm_hdrsize);
-       rec_hdr.incl_len = g_htonl(phdr->caplen + atm_hdrsize);
+       rec_hdr.orig_len = g_htonl(rec->rec_header.packet_header.len + atm_hdrsize);
+       rec_hdr.incl_len = g_htonl(rec->rec_header.packet_header.caplen + atm_hdrsize);
        rec_hdr.rec_len = g_htonl(reclen);
        rec_hdr.cum_drops = 0;
-       rec_hdr.ts_sec = g_htonl(phdr->ts.secs);
-       rec_hdr.ts_usec = g_htonl(phdr->ts.nsecs / 1000);
+       rec_hdr.ts_sec = g_htonl(rec->ts.secs);
+       rec_hdr.ts_usec = g_htonl(rec->ts.nsecs / 1000);
        if (!wtap_dump_file_write(wdh, &rec_hdr, sizeof rec_hdr, err))
                return FALSE;
 
@@ -947,7 +894,7 @@ static gboolean snoop_dump(wtap_dumper *wdh,
                        return FALSE;
        }
 
-       if (!wtap_dump_file_write(wdh, pd, phdr->caplen, err))
+       if (!wtap_dump_file_write(wdh, pd, rec->rec_header.packet_header.caplen, err))
                return FALSE;
 
        /* Now write the padding. */
@@ -955,3 +902,16 @@ static gboolean snoop_dump(wtap_dumper *wdh,
                return FALSE;
        return TRUE;
 }
+
+/*
+ * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 8
+ * tab-width: 8
+ * indent-tabs-mode: t
+ * End:
+ *
+ * vi: set shiftwidth=8 tabstop=8 noexpandtab:
+ * :indentSize=8:tabSize=8:noTabs=false:
+ */