ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [ethereal-dev] Re: ISAKMP/IKE protocol dumps

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 2 Dec 1999 13:50:09 -0800 (PST)
> > > -static void dissect_transform(const u_char *, int, frame_data *, proto_tree *);
> > > +static void dissect_transform(const u_char *, int, frame_data *, proto_tree *,
> > > +		guint8);
> 
> Yeah, I should have mentioned that it was a hack, it works but is ugly.

"Works" if your system's calling sequence happens to cause a call to a
function that passes an insufficient number of arguments to make it
appear as if random data were passed as the argument, rather than
causing the call not to work, and if the called routine happens not to
use that random data in that situation.

There's no *guarantee* that the calling sequence works that way,
although there's probably a decent chance that it will on most
platforms.

I don't want to put into the source tree any code that causes the
compiler to complain about a call not matching a function prototype,
however, as

	1) it's another warning to filter out if it's truly "safe"

and

	2) if it's *not* safe, the warning should be heeded, as the call
	   may not be doing what you'd hoped it would be doing.

> > "dissect_transform()" is also called from "dissect_isakmp()", through a
> > pointer in the "strfuncs[]" array:
> > 
> >     if (hdr->next_payload < NUM_LOAD_TYPES)
> >       (*strfuncs[hdr->next_payload].func)(pd, offset, fd, isakmp_tree);
> >     else
> >       dissect_data(pd, offset, fd, isakmp_tree);
> 
> It turns out that dissect_transform() will never be called from here.

...*if* the packet being dissected is valid.

However...

> The main chain of "next_payload"s should NEVER include proposal or
> transform payloads.

One of the reasons why protocol analyzers such as Ethereal are used is
to analyze communication problems, and one type of communication problem
is "machine A sent to B an illegal packet" - "*should* never" is
inequivalent to "*will* never", and Ethereal needs to behave sanely even
when handed insane packets.