Wireshark · Ethereal-dev: Re: [ethereal-dev] ISAKMP

[Guy Harris <guy@xxxxxxxxxx>]

> The ISAKMP dissector will try to decode the payload even if the 
> 'Encryption' flag is set, resulting in a bogus protocol decode 
> tree.  I would rather see it displayed as "encrypted payload".

Does the attached patch do the job?

Index: packet-isakmp.c
===================================================================
RCS file: /usr/local/cvsroot/ethereal/packet-isakmp.c,v
retrieving revision 1.13
diff -c -r1.13 packet-isakmp.c
*** packet-isakmp.c	2000/04/08 07:07:22	1.13
--- packet-isakmp.c	2000/04/28 00:50:38
***************
*** 405,418 ****
  			"Length: %u", len);
      offset += sizeof(hdr->length);
  
!     if (hdr->next_payload < NUM_LOAD_TYPES) {
!       if (hdr->next_payload == LOAD_TYPE_TRANSFORM)
!         dissect_transform(pd, offset, fd, isakmp_tree, 0);	/* XXX - protocol ID? */
        else
!         (*strfuncs[hdr->next_payload].func)(pd, offset, fd, isakmp_tree);
      }
-     else
-       dissect_data(pd, offset, fd, isakmp_tree);
    }
  }
  
--- 405,426 ----
  			"Length: %u", len);
      offset += sizeof(hdr->length);
  
!     if (hdr->flags & E_FLAG) {
!       if (IS_DATA_IN_FRAME(offset) && isakmp_tree) {
!         proto_tree_add_text(isakmp_tree, offset, END_OF_FRAME,
! 			"Encrypted payload (%d byte%s)",
! 			END_OF_FRAME, plurality(END_OF_FRAME, "", "s"));
!       }
!     } else {
!       if (hdr->next_payload < NUM_LOAD_TYPES) {
!         if (hdr->next_payload == LOAD_TYPE_TRANSFORM)
!           dissect_transform(pd, offset, fd, isakmp_tree, 0);	/* XXX - protocol ID? */
!         else
!           (*strfuncs[hdr->next_payload].func)(pd, offset, fd, isakmp_tree);
!       }
        else
!         dissect_data(pd, offset, fd, isakmp_tree);
      }
    }
  }