Put the PID of SNAP frames into the protocol tree regardless of whether

the frame has a payload or not.

Note in a comment that in one capture there's a U frame with a function
of TEST, rather than UI, that appears to have a payload.

svn path=/trunk/; revision=1527

1 files changed, 61 insertions, 36 deletions

diff --git a/packet-llc.c b/packet-llc.c
index b6bca3f384..9c214d9418 100644
--- a/packet-llc.c
+++ b/packet-llc.c
@@ -2,7 +2,7 @@
  * Routines for IEEE 802.2 LLC layer
  * Gilbert Ramirez <gramirez@tivoli.com>
  *
- * $Id: packet-llc.c,v 1.41 2000/01/23 08:55:34 guy Exp $
+ * $Id: packet-llc.c,v 1.42 2000/01/24 01:45:12 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@zing.org>
@@ -354,52 +354,77 @@ dissect_llc(const u_char *pd, int offset, frame_data *fd, proto_tree *tree) {
 			proto_tree_add_item(llc_tree, hf_llc_oui, offset+3, 3,
 				oui);
 		}
-		if (XDLC_HAS_PAYLOAD(control)) {
-			/*
-			 * This frame has a payload to be analyzed.
-			 */
-			switch (oui) {
-
-			case OUI_ENCAP_ETHER:
-			case OUI_APPLE_ATALK:
-				/* No, I have no idea why Apple used
-				   one of their own OUIs, rather than
-				   OUI_ENCAP_ETHER, and an Ethernet
-				   packet type as protocol ID, for
-				   AppleTalk data packets - but used
-				   OUI_ENCAP_ETHER and an Ethernet
-				   packet type for AARP packets. */
+		switch (oui) {
+
+		case OUI_ENCAP_ETHER:
+		case OUI_APPLE_ATALK:
+			/* No, I have no idea why Apple used
+			   one of their own OUIs, rather than
+			   OUI_ENCAP_ETHER, and an Ethernet
+			   packet type as protocol ID, for
+			   AppleTalk data packets - but used
+			   OUI_ENCAP_ETHER and an Ethernet
+			   packet type for AARP packets. */
+			if (XDLC_HAS_PAYLOAD(control)) {
+				/*
+				 * This frame has a payload to be analyzed.
+				 * XXX - I've seen a U frame (for a SNAP
+				 * protocol with OUI 00-80-5F, belonging
+				 * to Compaq, and a PID of 0002) with a
+				 * function of TEST and, apparently, with
+				 * a payload - the data in the frame
+				 * following the LLC header included the
+				 * Unicode string "NTFS", so, unless that's
+				 * crud left over from an earlier frame whose
+				 * buffer was reused for this frame, and the
+				 * length was mysteriously set to include the
+				 * leftover crud, TEST frames can have data,
+				 * just as UI frames can.
+				 */
 				ethertype(etype, offset+8, pd,
 				    fd, tree, llc_tree, hf_llc_type);
-				break;
-
-
-			case OUI_CISCO:
-				/* So are all CDP packets LLC packets
-				   with an OUI of OUI_CISCO and a
-				   protocol ID of 0x2000, or
-				   are some of them raw or encapsulated
-				   Ethernet? */
-				if (tree) {
-					proto_tree_add_item(llc_tree,
-					    hf_llc_pid, offset+6, 2, etype);
-				}
+			}
+			break;
+
+		case OUI_CISCO:
+			/* So are all CDP packets LLC packets
+			   with an OUI of OUI_CISCO and a
+			   protocol ID of 0x2000, or
+			   are some of them raw or encapsulated
+			   Ethernet? */
+			if (tree) {
+				proto_tree_add_item(llc_tree,
+				    hf_llc_pid, offset+6, 2, etype);
+			}
+			if (XDLC_HAS_PAYLOAD(control)) {
+				/*
+				 * This frame has a payload to be analyzed.
+				 */
 				switch (etype) {
 
 				case 0x2000:
 					dissect_cdp(pd, offset+8, fd, tree);
 					break;
-				}
-				break;
 
-			default:
-				if (tree) {
-					proto_tree_add_item(llc_tree,
-					    hf_llc_pid, offset+6, 2, etype);
+				default:
+					dissect_data(pd, offset+8, fd, tree);
+					break;
 				}
+			}
+			break;
+
+		default:
+			if (tree) {
+				proto_tree_add_item(llc_tree,
+				    hf_llc_pid, offset+6, 2, etype);
+			}
+			if (XDLC_HAS_PAYLOAD(control)) {
+				/*
+				 * This frame has a payload to be analyzed.
+				 */
 				dissect_data(pd, offset+8, fd, tree);
-				break;
 			}
+			break;
 		}
 	}		
 	else {