MACsec: Update the snapend thus the ICV field is not payload for the caller

The ICV (Integrity Check Value) is at the end of the frame, after the
secure data.

diff --git a/CHANGES b/CHANGES
index 2e6524174dd38613d708b9b2223145006d8c460b..9ef8ef16dc17bbdf826907ba206d533a886c88cf 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -18,6 +18,7 @@ Monthday, Month DD, YYYY by gharris and denis
       OpenFlow 1.0: Get snapend right for nested frames.
       ICMP: Update the snapend for some nested IP packets.
       RPKI-Router: Refine length and bounds checks.
+      MACsec: Update the snapend thus the ICV field is not payload for the caller
 
 Monthday, Month DD, YYYY by gharris
   Summary for 4.99.1 tcpdump release (so far!)

diff --git a/print-macsec.c b/print-macsec.c
index 38ae26edd5820bb3b2fe34939145a0b71c0199fb..2c955c5a0966b740c00c5412b98561d0156bf66c 100644 (file)
--- a/print-macsec.c
+++ b/print-macsec.c
@@ -219,6 +219,7 @@ macsec_print(netdissect_options *ndo, const u_char **bp,
        }
        *lengthp -= MACSEC_DEFAULT_ICV_LEN;
        *caplenp -= MACSEC_DEFAULT_ICV_LEN;
+       ndo->ndo_snapend -= MACSEC_DEFAULT_ICV_LEN;
 
        /*
         * If the SL field is non-zero, then it's the length of the