> A couple of notes:
> - under pre-0.6.2 versions of ethereal, the e_ip structure was defined
> in packet.h,
> now it's been moved to packet-ip.c; I'd propose moving it to
> packet-ip.h, then
> including that file in ethertype.c
I'd be inclined, instead, to do that inside "dissect_ip()"; some stuff
to do that is already there, namely:
pi.iplen = iph.ip_len;
pi.iphdrlen = lo_nibble(iph.ip_v_hl);
pi.ip_src = iph.ip_src;
pi.payload = pi.iplen - hlen;
with *some* stuff using "pi.iplen" or "pi.payload"; long-term, we should
do better end-of-packet checking (check for "past end of frame", "past
end of captured frame", and "past end of higher-level payload", perhaps
by saving the smallest of the lengths, checking against that, and, if
we're past that, calling some routine to figure out *which* one we went
past and adding something to the dissection tree to say which one; this
may also be useful when we start decoding "packets" that take more than
one frame, e.g. fragmented IP datagrams such as NFS READDIR/READDIRPLUS
replies and NFS-over-TCP or SMB/CIFS READ or
READDIR/READDIRPLUS/FindFirst/FindNext replies).
You might add something at that point - or perhaps earlier in
"dissect_ip()" - to adjust "fd->cap_len".
That way, it'll work with *any* link layer where there's extra stuff
after the end of the IP payload, and you don't have to have Ethertype
pull in the "e_ip" structure.
