diff options
author | Michael Mann <mmann78@netscape.net> | 2013-09-07 16:07:02 +0000 |
---|---|---|
committer | Michael Mann <mmann78@netscape.net> | 2013-09-07 16:07:02 +0000 |
commit | 17fbd9028a33a201afde0841ac64b046b6679b8e (patch) | |
tree | 1a6c16c5af300f6a5403f61ba74e19434a049260 | |
parent | e746a01ce815e226258b09a89ba055cc8217f08a (diff) |
Batch of filterable expert info
svn path=/trunk/; revision=51823
-rw-r--r-- | epan/dissectors/packet-dcm.c | 89 | ||||
-rw-r--r-- | epan/dissectors/packet-dmp.c | 85 | ||||
-rw-r--r-- | epan/dissectors/packet-mysql.c | 39 | ||||
-rw-r--r-- | epan/dissectors/packet-ncp.c | 23 | ||||
-rw-r--r-- | epan/dissectors/packet-netflow.c | 36 | ||||
-rw-r--r-- | epan/dissectors/packet-nhrp.c | 36 | ||||
-rw-r--r-- | epan/dissectors/packet-ositp.c | 42 | ||||
-rw-r--r-- | epan/dissectors/packet-p_mul.c | 101 | ||||
-rw-r--r-- | epan/dissectors/packet-rlc.c | 97 |
9 files changed, 320 insertions, 228 deletions
diff --git a/epan/dissectors/packet-dcm.c b/epan/dissectors/packet-dcm.c index fd7589438c..7b73acbc3d 100644 --- a/epan/dissectors/packet-dcm.c +++ b/epan/dissectors/packet-dcm.c @@ -331,6 +331,21 @@ static gint ett_dcm_data_tag = -1; static gint ett_dcm_data_seq = -1; static gint ett_dcm_data_item = -1; +static expert_field ei_dcm_data_tag = EI_INIT; +static expert_field ei_dcm_multiple_transfer_syntax = EI_INIT; +static expert_field ei_dcm_pdv_len = EI_INIT; +static expert_field ei_dcm_pdv_flags = EI_INIT; +static expert_field ei_dcm_pdv_ctx = EI_INIT; +static expert_field ei_dcm_no_abstract_syntax = EI_INIT; +static expert_field ei_dcm_no_abstract_syntax_uid = EI_INIT; +static expert_field ei_dcm_status_msg = EI_INIT; +static expert_field ei_dcm_no_transfer_syntax = EI_INIT; +static expert_field ei_dcm_multiple_abstract_syntax = EI_INIT; +static expert_field ei_dcm_invalid_pdu_length = EI_INIT; +static expert_field ei_dcm_assoc_item_len = EI_INIT; +static expert_field ei_dcm_assoc_rejected = EI_INIT; +static expert_field ei_dcm_assoc_aborted = EI_INIT; + static dissector_handle_t dcm_handle; static const value_string dcm_pdu_ids[] = { @@ -4788,8 +4803,7 @@ dissect_dcm_assoc_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gu buf_desc = ep_strdup_printf("A-ASSOCIATE reject %s <-- %s (%s)", g_strstrip(assoc->ae_calling), g_strstrip(assoc->ae_called), reject_reason_desc); - expert_add_info_format(pinfo, assoc_header_pitem, - PI_RESPONSE_CODE, PI_WARN, "Association rejected"); + expert_add_info(pinfo, assoc_header_pitem, &ei_dcm_assoc_rejected); break; case 5: /* RELEASE Request */ @@ -4852,8 +4866,7 @@ dissect_dcm_assoc_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gu g_strstrip(assoc->ae_calling), g_strstrip(assoc->ae_called), abort_reason_desc); } - expert_add_info_format(pinfo, assoc_header_pitem, - PI_RESPONSE_CODE, PI_WARN, "Association aborted"); + expert_add_info(pinfo, assoc_header_pitem, &ei_dcm_assoc_aborted); break; } @@ -5272,25 +5285,21 @@ dissect_dcm_pctx(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, if (is_assoc_request) { if (cnt_abbs<1) { - expert_add_info_format(pinfo, pctx_pitem, PI_MALFORMED, PI_ERROR, - "No Abstract Syntax provided for this Presentation Context"); + expert_add_info(pinfo, pctx_pitem, &ei_dcm_no_abstract_syntax); return; } else if (cnt_abbs>1) { - expert_add_info_format(pinfo, pctx_pitem, PI_MALFORMED, PI_ERROR, - "More than one Abstract Syntax provided for this Presentation Context"); + expert_add_info(pinfo, pctx_pitem, &ei_dcm_multiple_abstract_syntax); return; } if (cnt_xfer==0) { - expert_add_info_format(pinfo, pctx_pitem, PI_MALFORMED, PI_ERROR, - "No Transfer Syntax provided for this Presentation Context"); + expert_add_info(pinfo, pctx_pitem, &ei_dcm_no_transfer_syntax); return; } if (pctx_abss_uid==NULL) { - expert_add_info_format(pinfo, pctx_pitem, PI_MALFORMED, PI_ERROR, - "No Abstract Syntax UID found for this Presentation Context"); + expert_add_info(pinfo, pctx_pitem, &ei_dcm_no_abstract_syntax_uid); return; } @@ -5298,8 +5307,7 @@ dissect_dcm_pctx(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, else { if (cnt_xfer>1) { - expert_add_info_format(pinfo, pctx_pitem, PI_MALFORMED, PI_ERROR, - "Only one Transfer Syntax allowed in a Association Response"); + expert_add_info(pinfo, pctx_pitem, &ei_dcm_multiple_transfer_syntax); return; } } @@ -5485,7 +5493,7 @@ dissect_dcm_assoc_detail(tvbuff_t *tvb, packet_info *pinfo, proto_item *ti, item_len = tvb_get_ntohs(tvb, 2 + offset); if (item_len == 0) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, "Invalid Association Item Length"); + expert_add_info(pinfo, ti, &ei_dcm_assoc_item_len); return endpos; } @@ -5559,7 +5567,7 @@ dissect_dcm_pdv_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, pdv_ctx_pitem=proto_tree_add_uint_format(tree, hf_dcm_pdv_ctx, tvb, offset, 1, pctx_id, "Context: 0x%02x not found. A-ASSOCIATE request not found in capture.", pctx_id); - expert_add_info_format(pinfo, pdv_ctx_pitem, PI_MALFORMED, PI_ERROR, "Invalid Presentation Context ID"); + expert_add_info(pinfo, pdv_ctx_pitem, &ei_dcm_pdv_ctx); if (pctx == NULL) { /* only create presentation context, if it does not yet exist */ @@ -5676,7 +5684,7 @@ dissect_dcm_pdv_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, flags, "Flags: 0x%02x (%s)", flags, desc_flag); if (flags>3) { - expert_add_info_format(pinfo, pdv_flags_pitem, PI_MALFORMED, PI_ERROR, "Invalid Flags"); + expert_add_info(pinfo, pdv_flags_pitem, &ei_dcm_pdv_flags); } offset +=1; @@ -5935,7 +5943,7 @@ dissect_dcm_tag_value(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, dcm_s val16, "%-8.8s%s", "Value:", *tag_value); if (pdv->is_warning && status_message) { - expert_add_info_format(pinfo, pitem, PI_RESPONSE_CODE, PI_WARN, "%s", status_message); + expert_add_info(pinfo, pitem, &ei_dcm_status_msg); } } /* Invalid VR, can only occur with Explicit syntax */ @@ -6521,8 +6529,7 @@ dissect_dcm_tag_open(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, offset, tag_value_fragment_len, NULL, "%s <incomplete>", pdv->prev->open_tag.desc); - expert_add_info_format(pinfo, pitem, PI_MALFORMED, PI_ERROR, - "Early termination of tag. Data is missing"); + expert_add_info(pinfo, pitem, &ei_dcm_data_tag); } else { @@ -6770,8 +6777,8 @@ dissect_dcm_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, 0x02 if set, contains last fragment */ - proto_tree *pdv_ptree = NULL; /* Tree for item details */ - proto_item *pdv_pitem = NULL; + proto_tree *pdv_ptree; /* Tree for item details */ + proto_item *pdv_pitem, *pdvlen_item; gchar *buf_desc = NULL; /* PDU description */ gchar *pdv_description = NULL; @@ -6793,25 +6800,22 @@ dissect_dcm_pdu_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, pdv_pitem = proto_tree_add_text(tree, tvb, offset, pdv_len+4, "PDV"); pdv_ptree = proto_item_add_subtree(pdv_pitem, ett_dcm_data_pdv); + pdvlen_item = proto_tree_add_item(pdv_ptree, hf_dcm_pdv_len, tvb, offset, 4, ENC_BIG_ENDIAN); + offset += 4; + if (pdv_len + 4 > pdu_len) { - expert_add_info_format(pinfo, pdv_pitem, PI_MALFORMED, PI_ERROR, - "Invalid PDV length (too large)"); + expert_add_info_format_text(pinfo, pdvlen_item, &ei_dcm_pdv_len, "Invalid PDV length (too large)"); return endpos; } else if (pdv_len <= 2) { - expert_add_info_format(pinfo, pdv_pitem, PI_MALFORMED, PI_ERROR, - "Invalid PDV length (too small)"); + expert_add_info_format_text(pinfo, pdvlen_item, &ei_dcm_pdv_len, "Invalid PDV length (too small)"); return endpos; } else if (((pdv_len >> 1) << 1) != pdv_len) { - expert_add_info_format(pinfo, pdv_pitem, PI_MALFORMED, PI_ERROR, - "Invalid PDV length (not even)"); + expert_add_info_format_text(pinfo, pdvlen_item, &ei_dcm_pdv_len, "Invalid PDV length (not even)"); return endpos; } - proto_tree_add_item(pdv_ptree, hf_dcm_pdv_len, tvb, offset, 4, ENC_BIG_ENDIAN); - offset += 4; - offset = dissect_dcm_pdv_fragmented(tvb, pinfo, pdv_ptree, assoc, offset, pdv_len, &pdv_description); /* The following doesn't seem to work anymore */ @@ -6969,8 +6973,7 @@ dissect_dcm_main(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gboolean i old_pdu_start = pdu_start; pdu_start = pdu_start + pdu_len + 6; if (pdu_start <= old_pdu_start) { - expert_add_info_format(pinfo, NULL, PI_MALFORMED, PI_ERROR, - "Invalid PDU length (%u)", pdu_len); + expert_add_info_format_text(pinfo, NULL, &ei_dcm_invalid_pdu_length, "Invalid PDU length (%u)", pdu_len); THROW(ReportedBoundsError); } @@ -7264,7 +7267,25 @@ proto_register_dcm(void) &ett_dcm_pdv_fragments }; + static ei_register_info ei[] = { + { &ei_dcm_assoc_rejected, { "dicom.assoc.reject", PI_RESPONSE_CODE, PI_WARN, "Association rejected", EXPFILL }}, + { &ei_dcm_assoc_aborted, { "dicom.assoc.abort", PI_RESPONSE_CODE, PI_WARN, "Association aborted", EXPFILL }}, + { &ei_dcm_no_abstract_syntax, { "dicom.no_abstract_syntax", PI_MALFORMED, PI_ERROR, "No Abstract Syntax provided for this Presentation Context", EXPFILL }}, + { &ei_dcm_multiple_abstract_syntax, { "dicom.multiple_abstract_syntax", PI_MALFORMED, PI_ERROR, "More than one Abstract Syntax provided for this Presentation Context", EXPFILL }}, + { &ei_dcm_no_transfer_syntax, { "dicom.no_transfer_syntax", PI_MALFORMED, PI_ERROR, "No Transfer Syntax provided for this Presentation Context", EXPFILL }}, + { &ei_dcm_no_abstract_syntax_uid, { "dicom.no_abstract_syntax_uid", PI_MALFORMED, PI_ERROR, "No Abstract Syntax UID found for this Presentation Context", EXPFILL }}, + { &ei_dcm_multiple_transfer_syntax, { "dicom.multiple_transfer_syntax", PI_MALFORMED, PI_ERROR, "Only one Transfer Syntax allowed in a Association Response", EXPFILL }}, + { &ei_dcm_assoc_item_len, { "dicom.assoc.item.len.invalid", PI_MALFORMED, PI_ERROR, "Invalid Association Item Length", EXPFILL }}, + { &ei_dcm_pdv_ctx, { "dicom.pdv.ctx.invalid", PI_MALFORMED, PI_ERROR, "Invalid Presentation Context ID", EXPFILL }}, + { &ei_dcm_pdv_flags, { "dicom.pdv.flags.invalid", PI_MALFORMED, PI_ERROR, "Invalid Flags", EXPFILL }}, + { &ei_dcm_status_msg, { "dicom.status_msg", PI_RESPONSE_CODE, PI_WARN, "%s", EXPFILL }}, + { &ei_dcm_data_tag, { "dicom.data.tag.missing", PI_MALFORMED, PI_ERROR, "Early termination of tag. Data is missing", EXPFILL }}, + { &ei_dcm_pdv_len, { "dicom.pdv.len.invalid", PI_MALFORMED, PI_ERROR, "Invalid PDV length", EXPFILL }}, + { &ei_dcm_invalid_pdu_length, { "dicom.pdu_length.invalid", PI_MALFORMED, PI_ERROR, "Invalid PDU length", EXPFILL }}, + }; + module_t *dcm_module; + expert_module_t* expert_dcm; /* Register the protocol name and description */ proto_dcm = proto_register_protocol("DICOM", "DICOM", "dicom"); @@ -7272,6 +7293,8 @@ proto_register_dcm(void) /* Required function calls to register the header fields and subtrees used */ proto_register_field_array(proto_dcm, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_dcm = expert_register_protocol(proto_dcm); + expert_register_field_array(expert_dcm, ei, array_length(ei)); dcm_module = prefs_register_protocol(proto_dcm, dcm_apply_settings); diff --git a/epan/dissectors/packet-dmp.c b/epan/dissectors/packet-dmp.c index 94b4433d87..506f303ce7 100644 --- a/epan/dissectors/packet-dmp.c +++ b/epan/dissectors/packet-dmp.c @@ -367,7 +367,6 @@ static int hf_analysis_total_time = -1; static int hf_analysis_retrans_time = -1; static int hf_analysis_total_retrans_time = -1; static int hf_analysis_msg_num = -1; -static int hf_analysis_msg_missing = -1; static int hf_analysis_retrans_no = -1; static int hf_analysis_ack_num = -1; static int hf_analysis_ack_missing = -1; @@ -481,6 +480,19 @@ static gint ett_analysis = -1; static expert_field ei_reserved_value = EI_INIT; static expert_field ei_message_sic_illegal = EI_INIT; +static expert_field ei_envelope_version_value = EI_INIT; +static expert_field ei_message_compr = EI_INIT; +static expert_field ei_ack_reason = EI_INIT; +static expert_field ei_addr_dir_rec_no_generated = EI_INIT; +static expert_field ei_checksum_bad = EI_INIT; +static expert_field ei_message_body_uncompressed = EI_INIT; +static expert_field ei_addr_ext_rec_no_generated = EI_INIT; +static expert_field ei_envelope_msg_id = EI_INIT; +static expert_field ei_analysis_ack_missing = EI_INIT; +static expert_field ei_analysis_ack_dup_no = EI_INIT; +static expert_field ei_analysis_ack_unexpected = EI_INIT; +static expert_field ei_analysis_msg_missing = EI_INIT; +static expert_field ei_analysis_retrans_no = EI_INIT; static dissector_handle_t dmp_handle; @@ -1512,16 +1524,14 @@ static void dmp_add_seq_ack_analysis (tvbuff_t *tvb, packet_info *pinfo, PROTO_ITEM_SET_GENERATED (en); if (!dmp.checksum) { proto_item_append_text (en, " (unexpected)"); - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Unexpected ACK"); + expert_add_info(pinfo, en, &ei_analysis_ack_unexpected); } } else if (dmp.checksum && !dmp.id_val->msg_resend_count) { en = proto_tree_add_item (analysis_tree, hf_analysis_ack_missing, tvb, offset, 0, ENC_NA); if (pinfo->fd->flags.visited) { /* We do not know this on first visit and we do not want to add a entry in the "Expert Severity Info" for this note */ - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Acknowledgement missing"); + expert_add_info(pinfo, en, &ei_analysis_ack_missing); PROTO_ITEM_SET_GENERATED (en); } } @@ -1537,11 +1547,7 @@ static void dmp_add_seq_ack_analysis (tvbuff_t *tvb, packet_info *pinfo, tvb, 0, 0, &ns); PROTO_ITEM_SET_GENERATED (en); } else { - en = proto_tree_add_item (analysis_tree, hf_analysis_msg_missing, tvb, 0, 0, ENC_NA); - PROTO_ITEM_SET_GENERATED (en); - - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Message missing"); + proto_tree_add_expert(analysis_tree, pinfo, &ei_analysis_msg_missing, tvb, 0, 0); } } else if (dmp.msg_type == NOTIF) { if (dmp.id_val->msg_id) { @@ -1554,11 +1560,7 @@ static void dmp_add_seq_ack_analysis (tvbuff_t *tvb, packet_info *pinfo, tvb, 0, 0, &ns); PROTO_ITEM_SET_GENERATED (en); } else { - en = proto_tree_add_item (analysis_tree, hf_analysis_msg_missing, tvb, 0, 0, ENC_NA); - PROTO_ITEM_SET_GENERATED (en); - - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Message missing"); + proto_tree_add_expert(analysis_tree, pinfo, &ei_analysis_msg_missing, tvb, 0, 0); } } @@ -1567,9 +1569,7 @@ static void dmp_add_seq_ack_analysis (tvbuff_t *tvb, packet_info *pinfo, tvb, 0, 0, dmp.id_val->msg_resend_count); PROTO_ITEM_SET_GENERATED (en); - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Retransmission #%d", - dmp.id_val->msg_resend_count); + expert_add_info_format_text(pinfo, en, &ei_analysis_retrans_no, "Retransmission #%d", dmp.id_val->msg_resend_count); if (dmp.msg_type == REPORT) { en = proto_tree_add_uint (analysis_tree, hf_analysis_rep_resend_from, @@ -1633,11 +1633,7 @@ static void dmp_add_seq_ack_analysis (tvbuff_t *tvb, packet_info *pinfo, dmp.id_val->prev_msg_id); } } else { - en = proto_tree_add_item (analysis_tree, hf_analysis_msg_missing, tvb, 0, 0, ENC_NA); - PROTO_ITEM_SET_GENERATED (en); - - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Message missing"); + proto_tree_add_expert(analysis_tree, pinfo, &ei_analysis_msg_missing, tvb, 0, 0); } if (dmp.id_val->ack_resend_count) { @@ -1645,8 +1641,7 @@ static void dmp_add_seq_ack_analysis (tvbuff_t *tvb, packet_info *pinfo, tvb, 0, 0, dmp.id_val->ack_resend_count); PROTO_ITEM_SET_GENERATED (en); - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Dup ACK #%d", dmp.id_val->ack_resend_count); + expert_add_info_format_text(pinfo, en, &ei_analysis_ack_dup_no, "Dup ACK #%d", dmp.id_val->ack_resend_count); en = proto_tree_add_uint (analysis_tree, hf_analysis_ack_resend_from, tvb, 0, 0, dmp.id_val->ack_id); @@ -2425,8 +2420,7 @@ static gint dissect_dmp_direct_encoding (tvbuff_t *tvb, packet_info *pinfo, "Recipient Number: %d", rec_no); if (rec_no > 32767) { proto_item_append_text (en, " (maximum 32767)"); - expert_add_info_format (pinfo, en, PI_MALFORMED, PI_WARN, - "Recipient number too big"); + expert_add_info(pinfo, en, &ei_addr_dir_rec_no_generated); } PROTO_ITEM_SET_GENERATED (en); @@ -2546,8 +2540,7 @@ static gint dissect_dmp_ext_encoding (tvbuff_t *tvb, packet_info *pinfo, "Recipient Number: %d", rec_no); if (rec_no > 32767) { proto_item_append_text (en, " (maximum 32767)"); - expert_add_info_format (pinfo, en, PI_MALFORMED, PI_WARN, - "Recipient number too big"); + expert_add_info(pinfo, en, &ei_addr_ext_rec_no_generated); } PROTO_ITEM_SET_GENERATED (en); @@ -2643,8 +2636,7 @@ static gint dissect_dmp_ack (tvbuff_t *tvb, packet_info *pinfo, rt = proto_tree_add_item (ack_tree, hf_ack_reason, tvb, offset, 1, ENC_BIG_ENDIAN); if (dmp.ack_reason != 0) { - expert_add_info_format (pinfo, rt, PI_RESPONSE_CODE, PI_NOTE, "ACK reason: %s", - val_to_str_const (dmp.ack_reason, ack_reason, "Reserved")); + expert_add_info_format_text(pinfo, rt, &ei_ack_reason, "ACK reason: %s", val_to_str_const (dmp.ack_reason, ack_reason, "Reserved")); } offset += 1; @@ -2813,8 +2805,7 @@ static gint dissect_dmp_envelope (tvbuff_t *tvb, packet_info *pinfo, /* Unsupported DMP Version */ proto_item_append_text (vf, " (unsupported)"); proto_item_append_text (tf, " (unsupported)"); - expert_add_info_format (pinfo, vf, PI_UNDECODED, PI_ERROR, - "Unsupported DMP Version: %d", dmp.version); + expert_add_info_format_text(pinfo, vf, &ei_envelope_version_value, "Unsupported DMP Version: %d", dmp.version); return offset; } @@ -2945,7 +2936,7 @@ static gint dissect_dmp_envelope (tvbuff_t *tvb, packet_info *pinfo, field_tree = proto_item_add_subtree (tf, ett_envelope_msg_id); proto_tree_add_item (field_tree, hf_envelope_msg_id_12bit, tvb, offset, 2, ENC_BIG_ENDIAN); } else if (dmp.version >= DMP_VERSION_2 && dmp.msg_id_type == ONLY_DMP_ID && dmp.msg_id < 4096) { - expert_add_info_format (pinfo, tf, PI_PROTOCOL, PI_NOTE, "Id < 4096 - should use ShortId"); + expert_add_info(pinfo, tf, &ei_envelope_msg_id); } PROTO_ITEM_SET_HIDDEN (hidden_item); offset += 2; @@ -3154,8 +3145,7 @@ static gint dissect_dmp_message (tvbuff_t *tvb, packet_info *pinfo, if (compr_alg == ALGORITHM_ZLIB) { proto_item_append_text (en, " (compressed)"); } else if (compr_alg != ALGORITHM_NONE) { - expert_add_info_format (pinfo, tr, PI_UNDECODED, PI_WARN, - "Unknown compression algorithm"); + expert_add_info(pinfo, tr, &ei_message_compr); } if (message & 0x07) { @@ -3200,10 +3190,7 @@ static gint dissect_dmp_message (tvbuff_t *tvb, packet_info *pinfo, field_tree = proto_item_add_subtree (tf, ett_message_body_uncompr); proto_tree_add_item (field_tree, hf_message_body_uncompressed, next_tvb, 0, -1, ENC_ASCII|ENC_NA); } else { - tf = proto_tree_add_text (message_tree, tvb, offset, -1, - "Error: Unable to uncompress content"); - expert_add_info_format (pinfo, tf, PI_UNDECODED, PI_WARN, - "Unable to uncompress content"); + proto_tree_add_expert(message_tree, pinfo, &ei_message_body_uncompressed, tvb, offset, -1); } } else if (eit != EIT_BILATERAL) { proto_tree_add_item (field_tree, hf_message_body_plain, tvb, offset, len, ENC_ASCII|ENC_NA); @@ -4008,7 +3995,7 @@ static void dissect_dmp (tvbuff_t *tvb, packet_info *pinfo, } else { proto_item_append_text (en, " (incorrect, should be 0x%04x)", checksum1); - expert_add_info_format (pinfo, en, PI_CHECKSUM, PI_WARN, "Bad checksum"); + expert_add_info(pinfo, en, &ei_checksum_bad); en = proto_tree_add_boolean (checksum_tree, hf_checksum_good, tvb, offset, 2, FALSE); PROTO_ITEM_SET_GENERATED (en); @@ -4802,9 +4789,6 @@ void proto_register_dmp (void) { &hf_analysis_not_num, { "Notification in", "dmp.analysis.notif_in", FT_FRAMENUM, BASE_NONE, NULL, 0x0, "This packet has a Notification in this frame", HFILL } }, - { &hf_analysis_msg_missing, - { "Message missing", "dmp.analysis.msg_missing", FT_NONE, BASE_NONE, - NULL, 0x0, "The Message for this packet is missing", HFILL } }, { &hf_analysis_ack_missing, { "Acknowledgement missing", "dmp.analysis.ack_missing", FT_NONE, BASE_NONE, NULL, 0x0, "The acknowledgement for this packet is missing", HFILL } }, @@ -4953,6 +4937,19 @@ void proto_register_dmp (void) static ei_register_info ei[] = { { &ei_reserved_value, { "dmp.reserved.expert", PI_UNDECODED, PI_WARN, "Reserved value", EXPFILL }}, { &ei_message_sic_illegal, { "dmp.sic.illegal", PI_UNDECODED, PI_NOTE, "Illegal SIC", EXPFILL }}, + { &ei_analysis_ack_unexpected, { "dmp.analysis.ack_unexpected", PI_SEQUENCE, PI_NOTE, "Unexpected ACK", EXPFILL }}, + { &ei_analysis_ack_missing, { "dmp.analysis.ack_missing.expert", PI_SEQUENCE, PI_NOTE, "Acknowledgement missing", EXPFILL }}, + { &ei_analysis_msg_missing, { "dmp.analysis.msg_missing", PI_SEQUENCE, PI_NOTE, "Message missing", EXPFILL }}, + { &ei_analysis_retrans_no, { "dmp.analysis.retrans_no.expert", PI_SEQUENCE, PI_NOTE, "Retransmission #", EXPFILL }}, + { &ei_analysis_ack_dup_no, { "dmp.analysis.dup_ack_no.expert", PI_SEQUENCE, PI_NOTE, "Dup ACK #", EXPFILL }}, + { &ei_addr_dir_rec_no_generated, { "dmp.rec_no.expert", PI_MALFORMED, PI_WARN, "Recipient number too big", EXPFILL }}, + { &ei_addr_ext_rec_no_generated, { "dmp.rec_no.expert", PI_MALFORMED, PI_WARN, "Recipient number too big", EXPFILL }}, + { &ei_ack_reason, { "dmp.ack_reason.expert", PI_RESPONSE_CODE, PI_NOTE, "ACK reason: %s", EXPFILL }}, + { &ei_envelope_version_value, { "dmp.version_value.unsupported", PI_UNDECODED, PI_ERROR, "Unsupported DMP Version", EXPFILL }}, + { &ei_envelope_msg_id, { "dmp.msg_id.short_id", PI_PROTOCOL, PI_NOTE, "Id < 4096 - should use ShortId", EXPFILL }}, + { &ei_message_compr, { "dmp.body.compression.unknown", PI_UNDECODED, PI_WARN, "Unknown compression algorithm", EXPFILL }}, + { &ei_message_body_uncompressed, { "dmp.body.uncompressed.fail", PI_UNDECODED, PI_WARN, "Error: Unable to uncompress content", EXPFILL }}, + { &ei_checksum_bad, { "dmp.checksum_bad.expert", PI_CHECKSUM, PI_WARN, "Bad checksum", EXPFILL }}, }; static uat_field_t attributes_flds[] = { diff --git a/epan/dissectors/packet-mysql.c b/epan/dissectors/packet-mysql.c index 7d0a78502d..3f41f6cb61 100644 --- a/epan/dissectors/packet-mysql.c +++ b/epan/dissectors/packet-mysql.c @@ -516,6 +516,13 @@ static int hf_mysql_exec_field_time_length = -1; static int hf_mysql_exec_field_time_sign = -1; static int hf_mysql_exec_field_time_days = -1; +static expert_field ei_mysql_eof = EI_INIT; +static expert_field ei_mysql_dissector_incomplete = EI_INIT; +static expert_field ei_mysql_streamed_param = EI_INIT; +static expert_field ei_mysql_prepare_response_needed = EI_INIT; +static expert_field ei_mysql_unknown_response = EI_INIT; +static expert_field ei_mysql_command = EI_INIT; + /* type constants */ static const value_string type_constants[] = { {0x00, "FIELD_TYPE_DECIMAL" }, @@ -816,7 +823,7 @@ dissect_mysql_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) /* remaining payload indicates an error */ if (tree && tvb_reported_length_remaining(tvb, offset) > 0) { ti = proto_tree_add_item(mysql_tree, hf_mysql_payload, tvb, offset, -1, ENC_NA); - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, "FIXME - dissector is incomplete"); + expert_add_info(pinfo, ti, &ei_mysql_dissector_incomplete); } } @@ -1141,9 +1148,7 @@ mysql_dissect_exec_param(proto_item *req_tree, tvbuff_t *tvb, int *offset, param_unsigned = tvb_get_guint8(tvb, *offset); *offset += 1; /* signedness */ if ((param_flags & MYSQL_PARAM_FLAG_STREAMED) == MYSQL_PARAM_FLAG_STREAMED) { - expert_add_info_format(pinfo, field_tree, PI_SEQUENCE, PI_CHAT, - "This parameter was streamed, its value " - "can be found in Send BLOB packets"); + expert_add_info(pinfo, field_tree, &ei_mysql_streamed_param); return 1; } while (mysql_exec_dissectors[dissector_index].dissector != NULL) { @@ -1371,8 +1376,7 @@ mysql_dissect_request(tvbuff_t *tvb,packet_info *pinfo, int offset, lenstr = tvb_reported_length_remaining(tvb, offset); if (tree && lenstr > 0) { ti = proto_tree_add_item(req_tree, hf_mysql_payload, tvb, offset, lenstr, ENC_NA); - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, - "PREPARE Response packet is needed to dissect the payload"); + expert_add_info(pinfo, ti, &ei_mysql_prepare_response_needed); } offset += lenstr; } @@ -1382,7 +1386,7 @@ mysql_dissect_request(tvbuff_t *tvb,packet_info *pinfo, int offset, lenstr = tvb_reported_length_remaining(tvb, offset); if (tree && lenstr > 0) { ti = proto_tree_add_item(req_tree, hf_mysql_payload, tvb, offset, lenstr, ENC_NA); - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, "FIXME: execute dissector incomplete"); + expert_add_info_format_text(pinfo, ti, &ei_mysql_dissector_incomplete, "FIXME: execute dissector incomplete"); } offset += lenstr; #endif @@ -1413,14 +1417,14 @@ mysql_dissect_request(tvbuff_t *tvb,packet_info *pinfo, int offset, case MYSQL_CONNECT_OUT: case MYSQL_REGISTER_SLAVE: ti = proto_tree_add_item(req_tree, hf_mysql_payload, tvb, offset, -1, ENC_NA); - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, "FIXME: implement replication packets"); + expert_add_info_format_text(pinfo, ti, &ei_mysql_dissector_incomplete, "FIXME: implement replication packets"); offset += tvb_reported_length_remaining(tvb, offset); conn_data->state = REQUEST; break; default: ti = proto_tree_add_item(req_tree, hf_mysql_payload, tvb, offset, -1, ENC_NA); - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Unknown/invalid command code"); + expert_add_info(pinfo, ti, &ei_mysql_command); offset += tvb_reported_length_remaining(tvb, offset); conn_data->state = UNDEFINED; } @@ -1477,8 +1481,7 @@ mysql_dissect_response(tvbuff_t *tvb, packet_info *pinfo, int offset, } else { /* This should be an unreachable case */ conn_data->state= REQUEST; - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, - "EOF Marker found while connection in wrong state."); + expert_add_info(pinfo, ti, &ei_mysql_eof); } } @@ -1523,7 +1526,7 @@ mysql_dissect_response(tvbuff_t *tvb, packet_info *pinfo, int offset, default: ti = proto_tree_add_item(tree, hf_mysql_payload, tvb, offset, -1, ENC_NA); - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, "unknown/invalid response"); + expert_add_info(pinfo, ti, &ei_mysql_unknown_response); offset += tvb_reported_length_remaining(tvb, offset); conn_data->state = UNDEFINED; } @@ -2629,11 +2632,23 @@ void proto_register_mysql(void) &ett_exec_param }; + static ei_register_info ei[] = { + { &ei_mysql_dissector_incomplete, { "mysql.dissector_incomplete", PI_UNDECODED, PI_WARN, "FIXME - dissector is incomplete", EXPFILL }}, + { &ei_mysql_streamed_param, { "mysql.streamed_param", PI_SEQUENCE, PI_CHAT, "This parameter was streamed, its value can be found in Send BLOB packets", EXPFILL }}, + { &ei_mysql_prepare_response_needed, { "mysql.prepare_response_needed", PI_UNDECODED, PI_WARN, "PREPARE Response packet is needed to dissect the payload", EXPFILL }}, + { &ei_mysql_command, { "mysql.command.invalid", PI_PROTOCOL, PI_WARN, "Unknown/invalid command code", EXPFILL }}, + { &ei_mysql_eof, { "mysql.eof.wrong_state", PI_PROTOCOL, PI_WARN, "EOF Marker found while connection in wrong state.", EXPFILL }}, + { &ei_mysql_unknown_response, { "mysql.unknown_response", PI_UNDECODED, PI_WARN, "unknown/invalid response", EXPFILL }}, + }; + module_t *mysql_module; + expert_module_t* expert_mysql; proto_mysql = proto_register_protocol("MySQL Protocol", "MySQL", "mysql"); proto_register_field_array(proto_mysql, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_mysql = expert_register_protocol(proto_mysql); + expert_register_field_array(expert_mysql, ei, array_length(ei)); mysql_module = prefs_register_protocol(proto_mysql, NULL); prefs_register_bool_preference(mysql_module, "desegment_buffers", diff --git a/epan/dissectors/packet-ncp.c b/epan/dissectors/packet-ncp.c index ae74dbfc18..b2ffab47e6 100644 --- a/epan/dissectors/packet-ncp.c +++ b/epan/dissectors/packet-ncp.c @@ -106,6 +106,10 @@ gint ett_nds_segments = -1; gint ett_nds_segment = -1; static gint ett_ncp_system_flags = -1; +static expert_field ei_ncp_oplock_handle = EI_INIT; +static expert_field ei_ncp_new_server_session = EI_INIT; +static expert_field ei_ncp_type = EI_INIT; + static struct novell_tap ncp_tap; static struct ncp_common_header header; static struct ncp_common_header *ncp_hdr; @@ -270,7 +274,7 @@ mncp_hash_insert(conversation_t *conversation, guint32 nwconnection, guint8 nwta g_hash_table_insert(mncp_rhash, key, value); if (ncp_echo_conn && nwconnection != 65535) { - expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "Detected New Server Session. Connection %d, Task %d", nwconnection, nwtask); + expert_add_info_format_text(pinfo, NULL, &ei_ncp_new_server_session, "Detected New Server Session. Connection %d, Task %d", nwconnection, nwtask); value->session_start_packet_num = pinfo->fd->num; } @@ -417,7 +421,7 @@ dissect_ncp_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, request_value = mncp_hash_lookup(conversation, nw_connection, header.task); if (request_value) { if ((request_value->session_start_packet_num == pinfo->fd->num) && ncp_echo_conn) { - expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "Detected New Server Session. Connection %d, Task %d", nw_connection, header.task); + expert_add_info_format_text(pinfo, NULL, &ei_ncp_new_server_session, "Detected New Server Session. Connection %d, Task %d", nw_connection, header.task); } } } @@ -450,7 +454,7 @@ dissect_ncp_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, request_value = mncp_hash_lookup(conversation, nw_connection, header.task); if (request_value) { if ((request_value->session_start_packet_num == pinfo->fd->num) && ncp_echo_conn) { - expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "Detected New Server Session. Connection %d, Task %d", nw_connection, header.task); + expert_add_info_format_text(pinfo, NULL, &ei_ncp_new_server_session, "Detected New Server Session. Connection %d, Task %d", nw_connection, header.task); } } } @@ -473,7 +477,7 @@ dissect_ncp_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_tree_add_item(ncp_tree, hf_ncp_oplock_flag, tvb, commhdr + 9, 1, tvb_get_guint8(tvb, commhdr+9)); proto_tree_add_item(ncp_tree, hf_ncp_oplock_handle, tvb, commhdr + 10, 4, ENC_BIG_ENDIAN); if ((tvb_get_guint8(tvb, commhdr+9)==0x24) && ncp_echo_file) { - expert_add_info_format(pinfo, NULL, PI_RESPONSE_CODE, PI_CHAT, "Server requesting station to clear oplock on handle - %08x", tvb_get_ntohl(tvb, commhdr+10)); + expert_add_info_format_text(pinfo, NULL, &ei_ncp_oplock_handle, "Server requesting station to clear oplock on handle - %08x", tvb_get_ntohl(tvb, commhdr+10)); } break; @@ -819,8 +823,7 @@ dissect_ncp_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, val_to_str(header.type, ncp_type_vals, "Unknown type (0x%04x)")); if (ncp_echo_err) { - expert_add_info_format(pinfo, expert_item, PI_UNDECODED, PI_NOTE, "%s packets not supported yet", val_to_str(header.type, ncp_type_vals, - "Unknown type (0x%04x)")); + expert_add_info_format_text(pinfo, expert_item, &ei_ncp_type, "%s packets not supported yet", val_to_str(header.type, ncp_type_vals, "Unknown type (0x%04x)")); } break; } @@ -1041,11 +1044,19 @@ proto_register_ncp(void) &ett_nds_segments, &ett_nds_segment }; + static ei_register_info ei[] = { + { &ei_ncp_new_server_session, { "ncp.new_server_session", PI_RESPONSE_CODE, PI_CHAT, "Detected New Server Session", EXPFILL }}, + { &ei_ncp_oplock_handle, { "ncp.oplock_handle.clear", PI_RESPONSE_CODE, PI_CHAT, "Server requesting station to clear oplock", EXPFILL }}, + { &ei_ncp_type, { "ncp.type.unsupported", PI_UNDECODED, PI_NOTE, "Packet type not supported yet", EXPFILL }}, + }; module_t *ncp_module; + expert_module_t* expert_ncp; proto_ncp = proto_register_protocol("NetWare Core Protocol", "NCP", "ncp"); proto_register_field_array(proto_ncp, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_ncp = expert_register_protocol(proto_ncp); + expert_register_field_array(expert_ncp, ei, array_length(ei)); ncp_module = prefs_register_protocol(proto_ncp, NULL); prefs_register_obsolete_preference(ncp_module, "initial_hash_size"); diff --git a/epan/dissectors/packet-netflow.c b/epan/dissectors/packet-netflow.c index fc5ed43525..b9b5aee9f6 100644 --- a/epan/dissectors/packet-netflow.c +++ b/epan/dissectors/packet-netflow.c @@ -1485,6 +1485,13 @@ static int hf_pie_plixer_date_time = -1; static int hf_string_len_short = -1; static int hf_string_len_long = -1; +static expert_field ei_cflow_entries = EI_INIT; +static expert_field ei_cflow_options = EI_INIT; +static expert_field ei_cflow_flowset_length = EI_INIT; +static expert_field ei_cflow_scopes = EI_INIT; +static expert_field ei_cflow_template_ipfix_scope_field_count_too_many = EI_INIT; +static expert_field ei_cflow_template_ipfix_scope_field_count = EI_INIT; +static expert_field ei_cflow_no_flow_information = EI_INIT; static const value_string special_mpls_top_label_type[] = { {0, "Unknown"}, @@ -2192,7 +2199,7 @@ dissect_v9_v10_flowset(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree, i length = tvb_get_ntohs(tvb, offset + 2); if (length < 4) { - expert_add_info_format(pinfo, NULL, PI_MALFORMED, PI_WARN, + expert_add_info_format_text(pinfo, NULL, &ei_cflow_flowset_length, "Length (%u) too short", length); return tvb_reported_length_remaining(tvb, offset); } @@ -2233,8 +2240,7 @@ dissect_v9_v10_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutree, int guint pdu_len; if (length == 0) { - expert_add_info_format(pinfo, pdutree, PI_MALFORMED, - PI_WARN, "No flow information"); + expert_add_info(pinfo, pdutree, &ei_cflow_no_flow_information); } v9_v10_tmplt_build_key(&tmplt_key, pinfo, hdrinfo_p->src_id, id); @@ -5361,12 +5367,11 @@ dissect_v9_v10_options_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *p option_field_count = option_total_field_count - option_scope_field_count; if (option_scope_field_count == 0) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_WARN, - "No scope fields"); + expert_add_info(pinfo, ti, &ei_cflow_template_ipfix_scope_field_count); return 0; } if (option_scope_field_count > option_total_field_count) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_WARN, + expert_add_info_format_text(pinfo, ti, &ei_cflow_template_ipfix_scope_field_count_too_many, "More scope fields (%u) than fields (%u)", option_scope_field_count, option_total_field_count); return 0; @@ -5380,7 +5385,7 @@ dissect_v9_v10_options_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *p if (v9_tmplt_max_fields && (option_field_count > v9_tmplt_max_fields)) { - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, + expert_add_info_format_text(pinfo, ti, &ei_cflow_options, "More options (%u) than we can handle." " Maximum value can be adjusted in the protocol preferences.", option_field_count); @@ -5388,7 +5393,7 @@ dissect_v9_v10_options_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *p if (v9_tmplt_max_fields && (option_scope_field_count > v9_tmplt_max_fields)) { - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, + expert_add_info_format_text(pinfo, ti, &ei_cflow_scopes, "More scopes (%u) than we can handle [template won't be used]." " Maximum value can be adjusted in the protocol preferences.", option_scope_field_count); @@ -5486,7 +5491,7 @@ dissect_v9_v10_data_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdut offset += 2; if (v9_tmplt_max_fields && (count > v9_tmplt_max_fields)) { - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, + expert_add_info_format_text(pinfo, ti, &ei_cflow_entries, "More entries (%u) than we can handle [template won't be used]." " Maximum value can be adjusted in the protocol preferences.", count); @@ -8248,12 +8253,25 @@ proto_register_netflow(void) &ett_fwdstat }; + static ei_register_info ei[] = { + { &ei_cflow_flowset_length, { "cflow.flowset_length.invalid", PI_MALFORMED, PI_WARN, "Length invalid", EXPFILL }}, + { &ei_cflow_no_flow_information, { "cflow.no_flow_information", PI_MALFORMED, PI_WARN, "No flow information", EXPFILL }}, + { &ei_cflow_template_ipfix_scope_field_count, { "cflow.template_ipfix_scope_field_count.none", PI_MALFORMED, PI_WARN, "No scope fields", EXPFILL }}, + { &ei_cflow_template_ipfix_scope_field_count_too_many, { "cflow.template_ipfix_scope_field_count.too_many", PI_MALFORMED, PI_WARN, "More scope fields than fields", EXPFILL }}, + { &ei_cflow_options, { "cflow.options.too_many", PI_UNDECODED, PI_WARN, "More options than we can handle.", EXPFILL }}, + { &ei_cflow_scopes, { "cflow.scopes.too_many", PI_UNDECODED, PI_WARN, "More scopes than we can handle [template won't be used].", EXPFILL }}, + { &ei_cflow_entries, { "cflow.entries.too_many", PI_UNDECODED, PI_WARN, "More entries than we can handle [template won't be used]", EXPFILL }}, + }; + module_t *netflow_module; + expert_module_t* expert_netflow; proto_netflow = proto_register_protocol("Cisco NetFlow/IPFIX", "CFLOW", "cflow"); proto_register_field_array(proto_netflow, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_netflow = expert_register_protocol(proto_netflow); + expert_register_field_array(expert_netflow, ei, array_length(ei)); /* Register our configuration options for NetFlow */ netflow_module = prefs_register_protocol(proto_netflow, proto_reg_handoff_netflow); diff --git a/epan/dissectors/packet-nhrp.c b/epan/dissectors/packet-nhrp.c index 09198b0b67..8a53ecbe6f 100644 --- a/epan/dissectors/packet-nhrp.c +++ b/epan/dissectors/packet-nhrp.c @@ -139,6 +139,11 @@ static gint ett_nhrp_devcap_ext = -1; static gint ett_nhrp_devcap_ext_srccap = -1; static gint ett_nhrp_devcap_ext_dstcap = -1; +static expert_field ei_nhrp_ext_not_allowed = EI_INIT; +static expert_field ei_nhrp_hdr_extoff = EI_INIT; +static expert_field ei_nhrp_ext_malformed = EI_INIT; +static expert_field ei_nhrp_ext_extra = EI_INIT; + /* NHRP Packet Types */ #define NHRP_RESOLUTION_REQ 1 #define NHRP_RESOLUTION_REPLY 2 @@ -392,8 +397,7 @@ void dissect_nhrp_hdr(tvbuff_t *tvb, hdr->ar_extoff = tvb_get_ntohs(tvb, offset); ti = proto_tree_add_item(nhrp_tree, hf_nhrp_hdr_extoff, tvb, offset, 2, ENC_BIG_ENDIAN); if (hdr->ar_extoff != 0 && hdr->ar_extoff < 20) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, - "Extension offset is less than the fixed header length"); + expert_add_info(pinfo, ti, &ei_nhrp_hdr_extoff); } offset += 2; @@ -808,8 +812,7 @@ void dissect_nhrp_mand(tvbuff_t *tvb, /* According to RFC 2332, section 5.2.7, there shouldn't be any extensions * in the Error Indication packet. */ if (isErr && tvb_reported_length_remaining(tvb, offset)) { - expert_add_info_format(pinfo, tree, PI_MALFORMED, PI_ERROR, - "Extensions not allowed per RFC2332 section 5.2.7"); + expert_add_info(pinfo, tree, &ei_nhrp_ext_not_allowed); } dissect_cie_list(tvb, pinfo, nhrp_tree, offset, mandEnd, hdr, isReq, codeinfo); @@ -900,8 +903,7 @@ void dissect_nhrp_ext(tvbuff_t *tvb, ti = proto_tree_add_text(nhrp_tree, tvb, offset, len, "Malformed Extension: %s", tvb_bytes_to_str(tvb, offset, len)); - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, - "Incomplete Authentication Extension"); + expert_add_info_format_text(pinfo, ti, &ei_nhrp_ext_malformed, "Incomplete Authentication Extension"); } else { proto_item *auth_item; @@ -932,8 +934,7 @@ void dissect_nhrp_ext(tvbuff_t *tvb, ti = proto_tree_add_text(nhrp_tree, tvb, offset, len, "Malformed Extension: %s", tvb_bytes_to_str(tvb, offset, len)); - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, - "Incomplete Vendor-Private Extension"); + expert_add_info_format_text(pinfo, ti, &ei_nhrp_ext_malformed, "Incomplete Vendor-Private Extension"); } else { proto_item *vendor_item; @@ -968,8 +969,7 @@ skip_switch: if ((extType == NHRP_EXT_NULL) && len) { ti = proto_tree_add_text(tree, tvb, offset, len, "Unknown Data (%d bytes)", len); - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, - "Superfluous data follows End Extension"); + expert_add_info(pinfo, ti, &ei_nhrp_ext_extra); break; } } @@ -1384,12 +1384,20 @@ proto_register_nhrp(void) &ett_nhrp_devcap_ext_dstcap }; - proto_nhrp = proto_register_protocol( - "NBMA Next Hop Resolution Protocol", - "NHRP", - "nhrp"); + static ei_register_info ei[] = { + { &ei_nhrp_hdr_extoff, { "nhrp.hdr.extoff.invalid", PI_MALFORMED, PI_ERROR, "Extension offset is less than the fixed header length", EXPFILL }}, + { &ei_nhrp_ext_not_allowed, { "nhrp.ext.not_allowed", PI_MALFORMED, PI_ERROR, "Extensions not allowed per RFC2332 section 5.2.7", EXPFILL }}, + { &ei_nhrp_ext_malformed, { "nhrp.ext.malformed", PI_MALFORMED, PI_ERROR, "Incomplete Authentication Extension", EXPFILL }}, + { &ei_nhrp_ext_extra, { "nhrp.ext.extra", PI_MALFORMED, PI_ERROR, "Superfluous data follows End Extension", EXPFILL }}, + }; + + expert_module_t* expert_nhrp; + + proto_nhrp = proto_register_protocol("NBMA Next Hop Resolution Protocol", "NHRP", "nhrp"); proto_register_field_array(proto_nhrp, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_nhrp = expert_register_protocol(proto_nhrp); + expert_register_field_array(expert_nhrp, ei, array_length(ei)); } void diff --git a/epan/dissectors/packet-ositp.c b/epan/dissectors/packet-ositp.c index 635ccf6676..53aa67ad90 100644 --- a/epan/dissectors/packet-ositp.c +++ b/epan/dissectors/packet-ositp.c @@ -79,10 +79,11 @@ static int hf_cotp_segment_count = -1; static int hf_cotp_reassembled_in = -1; static int hf_cotp_reassembled_length = -1; -static const true_false_string fragment_descriptions = { - "Yes", - "No" -}; +static expert_field ei_cotp_disconnect_confirm = EI_INIT; +static expert_field ei_cotp_multiple_tpdus = EI_INIT; +static expert_field ei_cotp_reject = EI_INIT; +static expert_field ei_cotp_connection = EI_INIT; +static expert_field ei_cotp_disconnect_request = EI_INIT; static int proto_cltp = -1; static gint ett_cltp = -1; @@ -914,9 +915,7 @@ static int ositp_decode_DR(tvbuff_t *tvb, int offset, guint8 li, guint8 tpdu, ositp_decode_var_part(tvb, offset, li, 4, tpdu_len, pinfo, cotp_tree); offset += li; - expert_add_info_format(pinfo, ti, PI_SEQUENCE, PI_CHAT, - "Disconnect Request(DR): 0x%x -> 0x%x", - src_ref, dst_ref); + expert_add_info_format_text(pinfo, ti, &ei_cotp_disconnect_request, "Disconnect Request(DR): 0x%x -> 0x%x", src_ref, dst_ref); /* User data */ call_dissector(data_handle, tvb_new_subset_remaining(tvb, offset), pinfo, @@ -1532,8 +1531,7 @@ static int ositp_decode_RJ(tvbuff_t *tvb, int offset, guint8 li, guint8 tpdu, offset += li + 1; - expert_add_info_format(pinfo, item, PI_SEQUENCE, PI_NOTE, - "Reject(RJ): -> 0x%x", dst_ref); + expert_add_info_format_text(pinfo, item, &ei_cotp_reject, "Reject(RJ): -> 0x%x", dst_ref); return offset; @@ -1602,10 +1600,7 @@ static int ositp_decode_CC(tvbuff_t *tvb, int offset, guint8 li, guint8 tpdu, /* expert info, but only if not encapsulated in TCP/SMB */ /* XXX - the best way to detect seems to be if we have a port set */ if (pinfo->destport == 0) { - expert_add_info_format(pinfo, item, PI_SEQUENCE, PI_CHAT, - "Connection %s: 0x%x -> 0x%x", - tpdu == CR_TPDU ? "Request(CR)" : "Confirm(CC)", - src_ref, dst_ref); + expert_add_info_format_text(pinfo, item, &ei_cotp_connection, "Connection %s: 0x%x -> 0x%x", tpdu == CR_TPDU ? "Request(CR)" : "Confirm(CC)", src_ref, dst_ref); } if (tree) { @@ -1728,9 +1723,7 @@ static int ositp_decode_DC(tvbuff_t *tvb, int offset, guint8 li, guint8 tpdu, ositp_decode_var_part(tvb, offset, li, 4, tpdu_len, pinfo, cotp_tree); offset += li; - expert_add_info_format(pinfo, item, PI_SEQUENCE, PI_CHAT, - "Disconnect Confirm(DC): 0x%x -> 0x%x", - src_ref, dst_ref); + expert_add_info_format_text(pinfo, item, &ei_cotp_disconnect_confirm, "Disconnect Confirm(DC): 0x%x -> 0x%x", src_ref, dst_ref); return offset; @@ -2186,8 +2179,7 @@ static gint dissect_ositp_internal(tvbuff_t *tvb, packet_info *pinfo, while (tvb_offset_exists(tvb, offset)) { if (!first_tpdu) { col_append_str(pinfo->cinfo, COL_INFO, ", "); - expert_add_info_format(pinfo, NULL, PI_SEQUENCE, PI_NOTE, - "Multiple TPDUs in one packet"); + expert_add_info(pinfo, NULL, &ei_cotp_multiple_tpdus); /* adjust tvb and offset to the start of the current PDU */ tvb = tvb_new_subset_remaining(tvb, offset); offset = 0 ; @@ -2338,12 +2330,12 @@ void proto_register_cotp(void) NULL, 0x0, NULL, HFILL}}, { &hf_cotp_eot, { "Last data unit", "cotp.eot", FT_BOOLEAN, 8, - TFS(&fragment_descriptions), 0x80, + TFS(&tfs_yes_no), 0x80, "Is current TPDU the last data unit of a complete DT TPDU sequence " "(End of TSDU)?", HFILL}}, { &hf_cotp_eot_extended, { "Last data unit", "cotp.eot", FT_BOOLEAN, 32, - TFS(&fragment_descriptions), 0x80000000, + TFS(&tfs_yes_no), 0x80000000, "Is current TPDU the last data unit of a complete DT TPDU sequence " "(End of TSDU)?", HFILL}}, { &hf_cotp_segment_overlap, @@ -2404,12 +2396,22 @@ void proto_register_cotp(void) &ett_cotp_segment, &ett_cotp_segments }; + static ei_register_info ei[] = { + { &ei_cotp_disconnect_request, { "cotp.disconnect_request", PI_SEQUENCE, PI_CHAT, "Disconnect Request(DR): 0x%x -> 0x%x", EXPFILL }}, + { &ei_cotp_reject, { "cotp.reject", PI_SEQUENCE, PI_NOTE, "Reject(RJ): -> 0x%x", EXPFILL }}, + { &ei_cotp_connection, { "cotp.connection", PI_SEQUENCE, PI_CHAT, "Connection %s: 0x%x -> 0x%x", EXPFILL }}, + { &ei_cotp_disconnect_confirm, { "cotp.disconnect_confirm", PI_SEQUENCE, PI_CHAT, "Disconnect Confirm(DC): 0x%x -> 0x%x", EXPFILL }}, + { &ei_cotp_multiple_tpdus, { "cotp.multiple_tpdus", PI_SEQUENCE, PI_NOTE, "Multiple TPDUs in one packet", EXPFILL }}, + }; module_t *cotp_module; + expert_module_t* expert_cotp; proto_cotp = proto_register_protocol(PROTO_STRING_COTP, "COTP", "cotp"); proto_register_field_array(proto_cotp, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_cotp = expert_register_protocol(proto_cotp); + expert_register_field_array(expert_cotp, ei, array_length(ei)); cotp_module = prefs_register_protocol(proto_cotp, NULL); prefs_register_bool_preference(cotp_module, "reassemble", diff --git a/epan/dissectors/packet-p_mul.c b/epan/dissectors/packet-p_mul.c index ed60583a14..f88299bc48 100644 --- a/epan/dissectors/packet-p_mul.c +++ b/epan/dissectors/packet-p_mul.c @@ -134,10 +134,8 @@ static int hf_analysis_total_retrans_time = -1; static int hf_analysis_last_pdu_num = -1; static int hf_analysis_addr_pdu_num = -1; static int hf_analysis_addr_pdu_time = -1; -static int hf_analysis_addr_pdu_missing = -1; static int hf_analysis_prev_pdu_num = -1; static int hf_analysis_prev_pdu_time = -1; -static int hf_analysis_prev_pdu_missing = -1; static int hf_analysis_retrans_no = -1; static int hf_analysis_ack_num = -1; static int hf_analysis_ack_missing = -1; @@ -158,6 +156,20 @@ static gint ett_seq_ack_analysis = -1; static gint ett_msg_fragment = -1; static gint ett_msg_fragments = -1; +static expert_field ei_more_data = EI_INIT; +static expert_field ei_checksum_bad = EI_INIT; +static expert_field ei_tot_miss_seq_no = EI_INIT; +static expert_field ei_miss_seq_no = EI_INIT; +static expert_field ei_analysis_ack_missing = EI_INIT; +static expert_field ei_miss_seq_range = EI_INIT; +static expert_field ei_address_pdu_missing = EI_INIT; +static expert_field ei_analysis_ack_dup_no = EI_INIT; +static expert_field ei_length = EI_INIT; +static expert_field ei_analysis_prev_pdu_missing = EI_INIT; +static expert_field ei_message_discarded = EI_INIT; +static expert_field ei_ack_length = EI_INIT; +static expert_field ei_analysis_retrans_no = EI_INIT; + static dissector_handle_t p_mul_handle = NULL; static dissector_handle_t data_handle = NULL; @@ -559,12 +571,7 @@ static void add_ack_analysis (tvbuff_t *tvb, packet_info *pinfo, proto_tree *p_m tvb, 0, 0, &ns); PROTO_ITEM_SET_GENERATED (en); } else { - en = proto_tree_add_item (analysis_tree, - hf_analysis_addr_pdu_missing, - tvb, offset, 0, ENC_NA); - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Address PDU missing"); - PROTO_ITEM_SET_GENERATED (en); + proto_tree_add_expert(analysis_tree, pinfo, &ei_address_pdu_missing, tvb, offset, 0); } item_added = TRUE; } else { @@ -586,8 +593,7 @@ static void add_ack_analysis (tvbuff_t *tvb, packet_info *pinfo, proto_tree *p_m if (pinfo->fd->flags.visited) { /* We do not know this on first visit and we do not want to add a entry in the "Expert Severity Info" for this note */ - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Ack PDU missing"); + expert_add_info(pinfo, en, &ei_analysis_ack_missing); PROTO_ITEM_SET_GENERATED (en); } item_added = TRUE; @@ -625,12 +631,7 @@ static void add_ack_analysis (tvbuff_t *tvb, packet_info *pinfo, proto_tree *p_m PROTO_ITEM_SET_GENERATED (en); } } else { - en = proto_tree_add_item (analysis_tree, - hf_analysis_addr_pdu_missing, - tvb, offset, 0, ENC_NA); - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Address PDU missing"); - PROTO_ITEM_SET_GENERATED (en); + proto_tree_add_expert(analysis_tree, pinfo, &ei_address_pdu_missing, tvb, offset, 0); } if (pkg_data->msg_type != Ack_PDU && pkg_data->prev_pdu_id) { @@ -651,8 +652,7 @@ static void add_ack_analysis (tvbuff_t *tvb, packet_info *pinfo, proto_tree *p_m tvb, 0, 0, ack_data->ack_resend_count); PROTO_ITEM_SET_GENERATED (en); - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Dup ACK #%d", ack_data->ack_resend_count); + expert_add_info_format_text(pinfo, en, &ei_analysis_ack_dup_no, "Dup ACK #%d", ack_data->ack_resend_count); en = proto_tree_add_uint (analysis_tree, hf_analysis_ack_resend_from, tvb, 0, 0, ack_data->ack_id); @@ -708,12 +708,7 @@ static p_mul_seq_val *add_seq_analysis (tvbuff_t *tvb, packet_info *pinfo, } item_added = TRUE; } else if (!pkg_data->msg_resend_count) { - en = proto_tree_add_item (analysis_tree, - hf_analysis_addr_pdu_missing, - tvb, offset, 0, ENC_NA); - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Address PDU missing"); - PROTO_ITEM_SET_GENERATED (en); + proto_tree_add_expert(analysis_tree, pinfo, &ei_address_pdu_missing, tvb, offset, 0); item_added = TRUE; } } @@ -731,12 +726,7 @@ static p_mul_seq_val *add_seq_analysis (tvbuff_t *tvb, packet_info *pinfo, PROTO_ITEM_SET_GENERATED (en); item_added = TRUE; } else if (!pkg_data->msg_resend_count) { - en = proto_tree_add_item (analysis_tree, - hf_analysis_prev_pdu_missing, - tvb, offset, 0, ENC_NA); - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Previous PDU missing"); - PROTO_ITEM_SET_GENERATED (en); + proto_tree_add_expert(analysis_tree, pinfo, &ei_analysis_prev_pdu_missing, tvb, offset, 0); item_added = TRUE; } } @@ -753,9 +743,7 @@ static p_mul_seq_val *add_seq_analysis (tvbuff_t *tvb, packet_info *pinfo, tvb, 0, 0, pkg_data->pdu_id); PROTO_ITEM_SET_GENERATED (en); - expert_add_info_format (pinfo, en, PI_SEQUENCE, PI_NOTE, - "Retransmission #%d", - pkg_data->msg_resend_count); + expert_add_info_format_text(pinfo, en, &ei_analysis_retrans_no, "Retransmission #%d", pkg_data->msg_resend_count); nstime_delta (&ns, &pinfo->fd->abs_ts, &pkg_data->prev_msg_time); en = proto_tree_add_time (analysis_tree, hf_analysis_retrans_time, @@ -860,8 +848,7 @@ static void dissect_p_mul (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) field_tree = proto_item_add_subtree (en, ett_pdu_type); if (pdu_type == Discard_Message_PDU) { - expert_add_info_format (pinfo, en, PI_RESPONSE_CODE, PI_NOTE, - "Message discarded"); + expert_add_info(pinfo, en, &ei_message_discarded); } switch (pdu_type) { @@ -940,7 +927,7 @@ static void dissect_p_mul (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) PROTO_ITEM_SET_GENERATED (en); } else { proto_item_append_text (en, " (incorrect, should be 0x%04x)", checksum1); - expert_add_info_format (pinfo, en, PI_CHECKSUM, PI_WARN, "Bad checksum"); + expert_add_info(pinfo, en, &ei_checksum_bad); en = proto_tree_add_boolean (checksum_tree, hf_checksum_good, tvb, offset, 2, FALSE); PROTO_ITEM_SET_GENERATED (en); @@ -1098,8 +1085,7 @@ static void dissect_p_mul (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) if (len < 10) { proto_item_append_text (en, " (invalid length)"); - expert_add_info_format (pinfo, en, PI_MALFORMED, PI_WARN, - "Invalid ack info length"); + expert_add_info(pinfo, en, &ei_ack_length); } /* Source Id */ @@ -1146,8 +1132,7 @@ static void dissect_p_mul (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) ack_seq_no, end_seq_no); if (ack_seq_no >= end_seq_no) { proto_item_append_text (en, " (invalid)"); - expert_add_info_format (pinfo, en, PI_UNDECODED, PI_WARN, - "Invalid missing sequence range"); + expert_add_info(pinfo, en, &ei_miss_seq_range); } else { proto_tree *missing_tree; guint16 sno; @@ -1173,8 +1158,7 @@ static void dissect_p_mul (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) if (ack_seq_no == 0) { proto_item_append_text (en, " (invalid)"); - expert_add_info_format (pinfo, en, PI_UNDECODED, PI_WARN, - "Invalid missing seq number"); + expert_add_info(pinfo, en, &ei_miss_seq_no); } else if (ack_seq_no <= prev_ack_seq_no) { proto_item_append_text (en, " (end of list indicator)"); } else { @@ -1210,8 +1194,7 @@ static void dissect_p_mul (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) en = proto_tree_add_uint (p_mul_tree, hf_tot_miss_seq_no, tvb, 0, 0, tot_no_missing); PROTO_ITEM_SET_GENERATED (en); - expert_add_info_format (pinfo, en, PI_RESPONSE_CODE, PI_NOTE, - "Missing seq numbers: %d", tot_no_missing); + expert_add_info_format_text(pinfo, en, &ei_tot_miss_seq_no, "Missing seq numbers: %d", tot_no_missing); } break; @@ -1321,12 +1304,10 @@ static void dissect_p_mul (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) if (pdu_length != (offset + data_len)) { proto_item_append_text (len_en, " (incorrect, should be: %d)", offset + data_len); - expert_add_info_format (pinfo, len_en, PI_MALFORMED, PI_WARN, - "Incorrect length field"); + expert_add_info(pinfo, len_en, &ei_length); } else if ((len = tvb_length_remaining (tvb, pdu_length)) > 0) { proto_item_append_text (len_en, " (more data in packet: %d)", len); - expert_add_info_format (pinfo, len_en, PI_MALFORMED, PI_WARN, - "More data in packet"); + expert_add_info(pinfo, len_en, &ei_more_data); } } @@ -1533,12 +1514,6 @@ void proto_register_p_mul (void) { &hf_analysis_ack_num, { "Ack PDU in", "p_mul.analysis.ack_in", FT_FRAMENUM, BASE_NONE, NULL, 0x0, "This packet has an Ack in this frame", HFILL } }, - { &hf_analysis_addr_pdu_missing, - { "Address PDU missing", "p_mul.analysis.addr_pdu_missing", FT_NONE, BASE_NONE, - NULL, 0x0, "The Address PDU for this packet is missing", HFILL } }, - { &hf_analysis_prev_pdu_missing, - { "Previous PDU missing", "p_mul.analysis.prev_pdu_missing", FT_NONE, BASE_NONE, - NULL, 0x0, "The previous PDU for this packet is missing", HFILL } }, { &hf_analysis_ack_missing, { "Ack PDU missing", "p_mul.analysis.ack_missing", FT_NONE, BASE_NONE, NULL, 0x0, "The acknowledgement for this packet is missing", HFILL } }, @@ -1574,8 +1549,24 @@ void proto_register_p_mul (void) &ett_msg_fragment, &ett_msg_fragments }; + static ei_register_info ei[] = { + { &ei_address_pdu_missing, { "p_mul.analysis.addr_pdu_missing", PI_SEQUENCE, PI_NOTE, "Address PDU missing", EXPFILL }}, + { &ei_analysis_ack_missing, { "p_mul.analysis.ack_missing.expert", PI_SEQUENCE, PI_NOTE, "Ack PDU missing", EXPFILL }}, + { &ei_analysis_ack_dup_no, { "p_mul.analysis.dup_ack_no.expert", PI_SEQUENCE, PI_NOTE, "Dup ACK #", EXPFILL }}, + { &ei_analysis_prev_pdu_missing, { "p_mul.analysis.prev_pdu_missing", PI_SEQUENCE, PI_NOTE, "Previous PDU missing", EXPFILL }}, + { &ei_analysis_retrans_no, { "p_mul.analysis.retrans_no.expert", PI_SEQUENCE, PI_NOTE, "Retransmission #", EXPFILL }}, + { &ei_message_discarded, { "p_mul.message_discarded", PI_RESPONSE_CODE, PI_NOTE, "Message discarded", EXPFILL }}, + { &ei_checksum_bad, { "p_mul.checksum_bad.expert", PI_CHECKSUM, PI_WARN, "Bad checksum", EXPFILL }}, + { &ei_ack_length, { "p_mul.ack_length.invalid", PI_MALFORMED, PI_WARN, "Invalid ack info length", EXPFILL }}, + { &ei_miss_seq_range, { "p_mul.missing_seq_range.invalid", PI_UNDECODED, PI_WARN, "Invalid missing sequence range", EXPFILL }}, + { &ei_miss_seq_no, { "p_mul.missing_seq_no.invalid", PI_UNDECODED, PI_WARN, "Invalid missing seq number", EXPFILL }}, + { &ei_tot_miss_seq_no, { "p_mul.no_missing_seq_no.expert", PI_RESPONSE_CODE, PI_NOTE, "Missing seq numbers", EXPFILL }}, + { &ei_length, { "p_mul.length.invalid", PI_MALFORMED, PI_WARN, "Incorrect length field", EXPFILL }}, + { &ei_more_data, { "p_mul.more_data", PI_MALFORMED, PI_WARN, "More data in packet", EXPFILL }}, + }; module_t *p_mul_module; + expert_module_t* expert_p_mul; proto_p_mul = proto_register_protocol (PNAME, PSNAME, PFNAME); @@ -1583,6 +1574,8 @@ void proto_register_p_mul (void) proto_register_field_array (proto_p_mul, hf, array_length (hf)); proto_register_subtree_array (ett, array_length (ett)); + expert_p_mul = expert_register_protocol(proto_p_mul); + expert_register_field_array(expert_p_mul, ei, array_length(ei)); register_init_routine (&p_mul_init_routine); /* Set default UDP ports */ diff --git a/epan/dissectors/packet-rlc.c b/epan/dissectors/packet-rlc.c index 297faf41dd..378b9001fc 100644 --- a/epan/dissectors/packet-rlc.c +++ b/epan/dissectors/packet-rlc.c @@ -137,6 +137,23 @@ static int ett_rlc_bitmap = -1; static int ett_rlc_rlist = -1; static int ett_rlc_channel = -1; +static expert_field ei_rlc_li_reserved = EI_INIT; +static expert_field ei_rlc_he = EI_INIT; +static expert_field ei_rlc_li_incorrect_mal = EI_INIT; +static expert_field ei_rlc_sufi_cw = EI_INIT; +static expert_field ei_rlc_kasumi_implementation_missing = EI_INIT; +static expert_field ei_rlc_reassembly_unknown_error = EI_INIT; +static expert_field ei_rlc_reassembly_lingering_endpoint = EI_INIT; +static expert_field ei_rlc_sufi_len = EI_INIT; +static expert_field ei_rlc_reassembly_fail_unfinished_sequence = EI_INIT; +static expert_field ei_rlc_reassembly_fail_flag_set = EI_INIT; +static expert_field ei_rlc_sufi_type = EI_INIT; +static expert_field ei_rlc_reserved_bits_not_zero = EI_INIT; +static expert_field ei_rlc_ctrl_type = EI_INIT; +static expert_field ei_rlc_li_incorrect_warn = EI_INIT; +static expert_field ei_rlc_li_too_many = EI_INIT; +static expert_field ei_rlc_header_only = EI_INIT; + static dissector_handle_t ip_handle; static dissector_handle_t rrc_handle; static dissector_handle_t bmc_handle; @@ -1023,27 +1040,26 @@ add_fragment(enum rlc_mode mode, tvbuff_t *tvb, packet_info *pinfo, reassemble_sequence(frags, endlist, &ch_lookup, start, end); } else { if (end >= 0 && end < 4096 && frags[end]) { - proto_tree_add_text(tree, tvb, 0, 0, "Did not perform reassembly because of unfinished sequence (%d->%d [packet %u]), could not find %d.", start, end, frags[end]->frame_num, missing); + proto_tree_add_expert_format(tree, pinfo, &ei_rlc_reassembly_fail_unfinished_sequence, tvb, 0, 0, + "Did not perform reassembly because of unfinished sequence (%d->%d [packet %u]), could not find %d.", start, end, frags[end]->frame_num, missing); } else { - proto_tree_add_text(tree, tvb, 0, 0, "Did not perform reassembly because of unfinished sequence (%d->%d [could not determine packet]), could not find %d.", start, end, missing); + proto_tree_add_expert_format(tree, pinfo, &ei_rlc_reassembly_fail_unfinished_sequence, tvb, 0, 0, + "Did not perform reassembly because of unfinished sequence (%d->%d [could not determine packet]), could not find %d.", start, end, missing); } - expert_add_info_format(pinfo, NULL, PI_REASSEMBLE, PI_ERROR, "Did not perform reassembly because of previous unfinished sequence."); } } else if (endlist->list) { if (endlist->fail_packet != 0 && endlist->fail_packet <= pinfo->fd->num) { - proto_tree_add_text(tree, tvb, 0, 0, "Did not perform reassembly because fail flag was set in packet %u.", endlist->fail_packet); - expert_add_info_format(pinfo, NULL, PI_REASSEMBLE, PI_ERROR, "Did not perform reassembly because fail flag was set previously."); + proto_tree_add_expert_format(tree, pinfo, &ei_rlc_reassembly_fail_flag_set, tvb, 0, 0, "Did not perform reassembly because fail flag was set in packet %u.", endlist->fail_packet); } else { gint16 end = GPOINTER_TO_INT(endlist->list->data); if (end >= 0 && end < 4096 && frags[end]) { - proto_tree_add_text(tree, tvb, 0, 0, "Did not perform reassembly because of unfinished sequence, found lingering endpoint (%d [packet %d]).", end, frags[end]->frame_num); + proto_tree_add_expert_format(tree, pinfo, &ei_rlc_reassembly_lingering_endpoint, tvb, 0, 0, "Did not perform reassembly because of unfinished sequence, found lingering endpoint (%d [packet %d]).", end, frags[end]->frame_num); } else { - proto_tree_add_text(tree, tvb, 0, 0, "Did not perform reassembly because of unfinished sequence, found lingering endpoint (%d [could not determine packet]).", end); + proto_tree_add_expert_format(tree, pinfo, &ei_rlc_reassembly_lingering_endpoint, tvb, 0, 0, "Did not perform reassembly because of unfinished sequence, found lingering endpoint (%d [could not determine packet]).", end); } - expert_add_info_format(pinfo, NULL, PI_REASSEMBLE, PI_ERROR, "Lingering endpoint."); } } else { - expert_add_info_format(pinfo, NULL, PI_REASSEMBLE, PI_ERROR, "Unknown error."); + expert_add_info(pinfo, NULL, &ei_rlc_reassembly_unknown_error); } } return NULL; /* If already done reassembly and no SDU found, too bad */ @@ -1380,7 +1396,7 @@ static tvbuff_t * rlc_decipher_tvb(tvbuff_t *tvb _U_, packet_info *pinfo, guint32 counter _U_, guint8 rbid _U_, gboolean dir _U_, guint8 header_size _U_) { /*Check if we have a KASUMI implementation*/ - expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_WARN, "Unable to decipher packet since KASUMI implementation is missing."); + expert_add_info(pinfo, NULL, &ei_rlc_kasumi_implementation_missing); return NULL; #else rlc_decipher_tvb(tvbuff_t *tvb, packet_info *pinfo, guint32 counter, guint8 rbid, gboolean dir, guint8 header_size) { @@ -1727,8 +1743,7 @@ rlc_decode_li(enum rlc_mode mode, tvbuff_t *tvb, packet_info *pinfo, proto_tree /*invalid for AM */ /* add malformed LI for investigation */ malformed = tree_add_li(mode, &li[num_li], num_li, li_offs, li_on_2_bytes, tvb, tree); - expert_add_info_format(pinfo, malformed, PI_PROTOCOL, PI_WARN, - "Uses reserved LI"); + expert_add_info(pinfo, malformed, &ei_rlc_li_reserved); return -1; /* just give up on this */ default: /* since the LI is an offset (from the end of the header), it @@ -1739,8 +1754,7 @@ rlc_decode_li(enum rlc_mode mode, tvbuff_t *tvb, packet_info *pinfo, proto_tree || (li[num_li].li < prev_li)) { /* add malformed LI for investigation */ malformed = tree_add_li(mode, &li[num_li], num_li, li_offs, li_on_2_bytes, tvb, tree); - expert_add_info_format(pinfo, malformed, PI_PROTOCOL, PI_WARN, - "Incorrect LI value"); + expert_add_info(pinfo, malformed, &ei_rlc_li_incorrect_warn); return -1; /* just give up on this */ } li[num_li].len = li[num_li].li - prev_li; @@ -1763,8 +1777,7 @@ rlc_decode_li(enum rlc_mode mode, tvbuff_t *tvb, packet_info *pinfo, proto_tree /*invalid for AM */ /* add malformed LI for investigation */ malformed = tree_add_li(mode, &li[num_li], num_li, li_offs, li_on_2_bytes, tvb, tree); - expert_add_info_format(pinfo, malformed, PI_PROTOCOL, PI_WARN, - "Uses reserved LI"); + expert_add_info(pinfo, malformed, &ei_rlc_li_reserved); return -1; /* just give up on this */ default: /* since the LI is an offset (from the end of the header), it @@ -1775,8 +1788,7 @@ rlc_decode_li(enum rlc_mode mode, tvbuff_t *tvb, packet_info *pinfo, proto_tree || (li[num_li].li < prev_li)) { /* add malformed LI for investigation */ malformed = tree_add_li(mode, &li[num_li], num_li, li_offs, li_on_2_bytes, tvb, tree); - expert_add_info_format(pinfo, malformed, PI_MALFORMED, PI_ERROR, - "Incorrect LI value 0x%x", li[num_li].li); + expert_add_info_format_text(pinfo, malformed, &ei_rlc_li_incorrect_mal, "Incorrect LI value 0x%x", li[num_li].li); return -1; /* just give up on this */ } li[num_li].len = li[num_li].li - prev_li; @@ -1789,8 +1801,7 @@ rlc_decode_li(enum rlc_mode mode, tvbuff_t *tvb, packet_info *pinfo, proto_tree if (num_li > max_li) { /* OK, so this is not really a malformed packet, but for now, * we will treat it as such, so that it is marked in some way */ - expert_add_info_format(pinfo, li[num_li-1].tree, PI_MALFORMED, PI_ERROR, - "Too many LI entries"); + expert_add_info(pinfo, li[num_li-1].tree, &ei_rlc_li_too_many); return -1; } } @@ -1870,8 +1881,7 @@ dissect_rlc_um(enum rlc_channel_type channel, tvbuff_t *tvb, packet_info *pinfo, is_truncated); if (is_truncated) { PROTO_ITEM_SET_GENERATED(truncated_ti); - expert_add_info_format(pinfo, truncated_ti, PI_SEQUENCE, PI_NOTE, - "RLC PDU SDUs have been omitted"); + expert_add_info(pinfo, truncated_ti, &ei_rlc_header_only); return; } else { PROTO_ITEM_SET_HIDDEN(truncated_ti); @@ -1956,8 +1966,7 @@ dissect_rlc_status(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, guin len--; } } else { - expert_add_info_format(pinfo, tree, PI_MALFORMED, PI_ERROR, - "Invalid length"); + expert_add_info(pinfo, tree, &ei_rlc_sufi_len); } break; case RLC_SUFI_BITMAP: @@ -2006,8 +2015,7 @@ dissect_rlc_status(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, guin cw[i] = (guint8)l; } if (len && (((cw[len-1] & 0x01) == 0) || (cw[len-1] == 0x01))) { - expert_add_info_format(pinfo, tree, PI_PROTOCOL, PI_WARN, - "Invalid last codeword"); + expert_add_info(pinfo, tree, &ei_rlc_sufi_cw); } else { ti = proto_tree_add_text(sufi_tree, tvb, previous_bit_offset/8, (bit_offset-previous_bit_offset)/8, "Decoded list:"); rlist_tree = proto_item_add_subtree(ti, ett_rlc_rlist); @@ -2077,8 +2085,7 @@ dissect_rlc_status(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, guin break; default: - expert_add_info_format(pinfo, tree, PI_PROTOCOL, PI_WARN, - "Invalid SUFI type"); + expert_add_info(pinfo, tree, &ei_rlc_sufi_type); return; /* invalid value, ignore the rest */ } @@ -2109,16 +2116,14 @@ dissect_rlc_control(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) proto_tree_add_bits_ret_val(tree, hf_rlc_rsn, tvb, 4, 1, &rsn, ENC_BIG_ENDIAN); proto_tree_add_bits_ret_val(tree, hf_rlc_r1, tvb, 5, 3, &r1, ENC_BIG_ENDIAN); if (r1) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, - "reserved bits not zero"); + expert_add_info(pinfo, ti, &ei_rlc_reserved_bits_not_zero); return; } proto_tree_add_bits_ret_val(tree, hf_rlc_hfni, tvb, 8, 20, &hfn, ENC_BIG_ENDIAN); col_append_fstr(pinfo->cinfo, COL_INFO, " RSN=%u HFN=%u", (guint16)rsn, (guint32)hfn); break; default: - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, - "Invalid RLC AM control type %u", type); + expert_add_info(pinfo, ti, &ei_rlc_ctrl_type); return; /* invalid */ } } @@ -2246,8 +2251,7 @@ dissect_rlc_am(enum rlc_channel_type channel, tvbuff_t *tvb, packet_info *pinfo, /* header extension may only be 00, 01 or 10 */ if (ext > 2) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, - "Incorrect HE value"); + expert_add_info(pinfo, ti, &ei_rlc_he); return; } @@ -2293,8 +2297,7 @@ dissect_rlc_am(enum rlc_channel_type channel, tvbuff_t *tvb, packet_info *pinfo, is_truncated); if (is_truncated) { PROTO_ITEM_SET_GENERATED(truncated_ti); - expert_add_info_format(pinfo, truncated_ti, PI_SEQUENCE, PI_NOTE, - "RLC PDU SDUs have been omitted"); + expert_add_info(pinfo, truncated_ti, &ei_rlc_header_only); return; } else { PROTO_ITEM_SET_HIDDEN(truncated_ti); @@ -2724,6 +2727,7 @@ void proto_register_rlc(void) { module_t *rlc_module; + expert_module_t* expert_rlc; static hf_register_info hf[] = { { &hf_rlc_dc, { "D/C Bit", "rlc.dc", @@ -2891,6 +2895,25 @@ proto_register_rlc(void) &ett_rlc_rlist, &ett_rlc_channel }; + static ei_register_info ei[] = { + { &ei_rlc_reassembly_fail_unfinished_sequence, { "rlc.reassembly.fail.unfinished_sequence", PI_REASSEMBLE, PI_ERROR, "Did not perform reassembly because of previous unfinished sequence.", EXPFILL }}, + { &ei_rlc_reassembly_fail_flag_set, { "rlc.reassembly.fail.flag_set", PI_REASSEMBLE, PI_ERROR, "Did not perform reassembly because fail flag was set previously.", EXPFILL }}, + { &ei_rlc_reassembly_lingering_endpoint, { "rlc.lingering_endpoint", PI_REASSEMBLE, PI_ERROR, "Lingering endpoint.", EXPFILL }}, + { &ei_rlc_reassembly_unknown_error, { "rlc.reassembly.unknown_error", PI_REASSEMBLE, PI_ERROR, "Unknown error.", EXPFILL }}, + { &ei_rlc_kasumi_implementation_missing, { "rlc.kasumi_implementation_missing", PI_UNDECODED, PI_WARN, "Unable to decipher packet since KASUMI implementation is missing.", EXPFILL }}, + { &ei_rlc_li_reserved, { "rlc.li.reserved", PI_PROTOCOL, PI_WARN, "Uses reserved LI", EXPFILL }}, + { &ei_rlc_li_incorrect_warn, { "rlc.li.incorrect", PI_PROTOCOL, PI_WARN, "Incorrect LI value", EXPFILL }}, + { &ei_rlc_li_incorrect_mal, { "rlc.li.incorrect", PI_MALFORMED, PI_ERROR, "Incorrect LI value 0x%x", EXPFILL }}, + { &ei_rlc_li_too_many, { "rlc.li.too_many", PI_MALFORMED, PI_ERROR, "Too many LI entries", EXPFILL }}, + { &ei_rlc_header_only, { "rlc.header_only.expert", PI_SEQUENCE, PI_NOTE, "RLC PDU SDUs have been omitted", EXPFILL }}, + { &ei_rlc_sufi_len, { "rlc.sufi.len.invalid", PI_MALFORMED, PI_ERROR, "Invalid length", EXPFILL }}, + { &ei_rlc_sufi_cw, { "rlc.sufi.cw.invalid", PI_PROTOCOL, PI_WARN, "Invalid last codeword", EXPFILL }}, + { &ei_rlc_sufi_type, { "rlc.sufi.type.invalid", PI_PROTOCOL, PI_WARN, "Invalid SUFI type", EXPFILL }}, + { &ei_rlc_reserved_bits_not_zero, { "rlc.reserved_bits_not_zero", PI_PROTOCOL, PI_WARN, "reserved bits not zero", EXPFILL }}, + { &ei_rlc_ctrl_type, { "rlc.ctrl_pdu_type.invalid", PI_PROTOCOL, PI_WARN, "Invalid RLC AM control type %u", EXPFILL }}, + { &ei_rlc_he, { "rlc.he.invalid", PI_PROTOCOL, PI_WARN, "Incorrect HE value", EXPFILL }}, + }; + proto_rlc = proto_register_protocol("Radio Link Control", "RLC", "rlc"); register_dissector("rlc.bcch", dissect_rlc_bcch, proto_rlc); register_dissector("rlc.pcch", dissect_rlc_pcch, proto_rlc); @@ -2902,6 +2925,8 @@ proto_register_rlc(void) proto_register_field_array(proto_rlc, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_rlc = expert_register_protocol(proto_rlc); + expert_register_field_array(expert_rlc, ei, array_length(ei)); /* Preferences */ rlc_module = prefs_register_protocol(proto_rlc, NULL); |