diff options
author | Michael Mann <mmann78@netscape.net> | 2013-09-02 23:32:31 +0000 |
---|---|---|
committer | Michael Mann <mmann78@netscape.net> | 2013-09-02 23:32:31 +0000 |
commit | 5405b344691e24a7fbbdd31d9b73e46c6d460e7d (patch) | |
tree | 451614a911df81cb5b756c2b737035e6ac5d5b6a | |
parent | ea6e5b7241fef5355792b50a6921bdf7a955a49a (diff) |
Batch of filterable expert info.
svn path=/trunk/; revision=51688
-rw-r--r-- | epan/dissectors/packet-eigrp.c | 85 | ||||
-rw-r--r-- | epan/dissectors/packet-gtp.c | 48 | ||||
-rw-r--r-- | epan/dissectors/packet-icep.c | 97 | ||||
-rw-r--r-- | epan/dissectors/packet-ieee80211-radiotap.c | 28 | ||||
-rw-r--r-- | epan/dissectors/packet-ieee802154.c | 45 | ||||
-rw-r--r-- | epan/dissectors/packet-irc.c | 40 | ||||
-rw-r--r-- | epan/dissectors/packet-kerberos.c | 7 | ||||
-rw-r--r-- | epan/dissectors/packet-lisp.c | 30 | ||||
-rw-r--r-- | epan/dissectors/packet-llrp.c | 26 | ||||
-rw-r--r-- | epan/dissectors/packet-megaco.c | 34 |
10 files changed, 279 insertions, 161 deletions
diff --git a/epan/dissectors/packet-eigrp.c b/epan/dissectors/packet-eigrp.c index c8756514f6..8a2cd6508a 100644 --- a/epan/dissectors/packet-eigrp.c +++ b/epan/dissectors/packet-eigrp.c @@ -503,6 +503,18 @@ static gint hf_eigrp_saf_data_length = -1; static gint hf_eigrp_saf_data_sequence = -1; static gint hf_eigrp_saf_data_type = -1; +static expert_field ei_eigrp_checksum_bad = EI_INIT; +static expert_field ei_eigrp_unreachable = EI_INIT; +static expert_field ei_eigrp_seq_addrlen = EI_INIT; +static expert_field ei_eigrp_peer_termination = EI_INIT; +static expert_field ei_eigrp_tlv_type = EI_INIT; +static expert_field ei_eigrp_auth_type = EI_INIT; +static expert_field ei_eigrp_peer_termination_graceful = EI_INIT; +static expert_field ei_eigrp_auth_len = EI_INIT; +static expert_field ei_eigrp_tlv_len = EI_INIT; +static expert_field ei_eigrp_afi = EI_INIT; +static expert_field ei_eigrp_prefixlen = EI_INIT; + /* some extra handle that might be needed */ static dissector_handle_t ipxsap_handle = NULL; static dissector_table_t media_type_table = NULL; @@ -677,8 +689,7 @@ dissect_eigrp_parameter (proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, if (k1 == 255 && k2 == 255 && k3 == 255 && k4 == 255 && k5 == 255) { proto_item_append_text(ti, ": Peer Termination"); - expert_add_info_format(pinfo, ti, PI_RESPONSE_CODE, PI_NOTE, - "Peer Termination"); + expert_add_info(pinfo, ti, &ei_eigrp_peer_termination); } } @@ -726,8 +737,7 @@ dissect_eigrp_auth_tlv (proto_tree *tree, tvbuff_t *tvb, switch (auth_type) { case EIGRP_AUTH_TYPE_MD5: if (EIGRP_AUTH_TYPE_MD5_LEN != auth_len) { - expert_add_info_format(pinfo, ti_auth_len, PI_UNDECODED, PI_WARN, - "Invalid auth len %u:", auth_len); + expert_add_info_format_text(pinfo, ti_auth_len, &ei_eigrp_auth_len, "Invalid auth len %u", auth_len); } else { proto_tree_add_item(tree, hf_eigrp_auth_digest, tvb, offset, EIGRP_AUTH_TYPE_MD5_LEN, ENC_NA); @@ -736,8 +746,7 @@ dissect_eigrp_auth_tlv (proto_tree *tree, tvbuff_t *tvb, case EIGRP_AUTH_TYPE_SHA256: if (EIGRP_AUTH_TYPE_SHA256_LEN != auth_len) { - expert_add_info_format(pinfo, ti_auth_len, PI_UNDECODED, PI_WARN, - "Invalid auth len %u:", auth_len); + expert_add_info_format_text(pinfo, ti_auth_len, &ei_eigrp_auth_len, "Invalid auth len %u", auth_len); } else { proto_tree_add_item(tree, hf_eigrp_auth_digest, tvb, offset, @@ -748,8 +757,7 @@ dissect_eigrp_auth_tlv (proto_tree *tree, tvbuff_t *tvb, case EIGRP_AUTH_TYPE_NONE: case EIGRP_AUTH_TYPE_TEXT: default: - expert_add_info_format(pinfo, ti_auth_type, PI_UNDECODED, PI_WARN, - "Invalid auth type %u:", auth_type); + expert_add_info_format_text(pinfo, ti_auth_type, &ei_eigrp_auth_type, "Invalid auth type %u", auth_type); break; } } @@ -796,8 +804,7 @@ dissect_eigrp_seq_tlv (proto_tree *tree, tvbuff_t *tvb, ENC_NA); break; default: - expert_add_info_format(pinfo, ti_addrlen, PI_MALFORMED, PI_ERROR, - "Invalid address length"); + expert_add_info(pinfo, ti_addrlen, &ei_eigrp_seq_addrlen); } } @@ -892,7 +899,7 @@ dissect_eigrp_peer_stubinfo (tvbuff_t *tvb, proto_tree *tree) static void dissect_eigrp_peer_termination (packet_info *pinfo, proto_item *ti) { - expert_add_info_format(pinfo, ti, PI_RESPONSE_CODE, PI_NOTE, "Peer Termination (Graceful Shutdown)"); + expert_add_info(pinfo, ti, &ei_eigrp_peer_termination_graceful); } /** @@ -1062,9 +1069,7 @@ dissect_eigrp_ipv4_addr (proto_item *ti, proto_tree *tree, tvbuff_t *tvb, if (addr_len < 0) { ti_prefixlen = proto_tree_add_item(tree, hf_eigrp_ipv4_prefixlen, tvb, offset, 1, ENC_BIG_ENDIAN); - expert_add_info_format(pinfo, ti_prefixlen, PI_UNDECODED, PI_WARN, - "Invalid prefix length %u, must be <= 32", - length); + expert_add_info_format_text(pinfo, ti_prefixlen, &ei_eigrp_prefixlen, "Invalid prefix length %u, must be <= 32", length); addr_len = 4; /* assure we can exit the loop */ } else { @@ -1079,7 +1084,7 @@ dissect_eigrp_ipv4_addr (proto_item *ti, proto_tree *tree, tvbuff_t *tvb, ip_to_str(ip_addr), length); if (unreachable) { - expert_add_info_format(pinfo, ti_dst, PI_RESPONSE_CODE, PI_NOTE, "Unreachable"); + expert_add_info(pinfo, ti_dst, &ei_eigrp_unreachable); } } first = FALSE; @@ -1118,9 +1123,7 @@ dissect_eigrp_ipv6_addr (proto_item *ti, proto_tree *tree, tvbuff_t *tvb, if (addr_len < 0) { ti_prefixlen = proto_tree_add_item(tree, hf_eigrp_ipv6_prefixlen, tvb, offset, 1, ENC_BIG_ENDIAN); - expert_add_info_format(pinfo, ti_prefixlen, PI_UNDECODED, PI_WARN, - "Invalid prefix length %u, must be <= 128", - length); + expert_add_info_format_text(pinfo, ti_prefixlen, &ei_eigrp_prefixlen, "Invalid prefix length %u, must be <= 128", length); addr_len = 16; /* assure we can exit the loop */ } else { proto_tree_add_item(tree, hf_eigrp_ipv6_prefixlen, tvb, offset, 1, @@ -1139,7 +1142,7 @@ dissect_eigrp_ipv6_addr (proto_item *ti, proto_tree *tree, tvbuff_t *tvb, ip6_to_str(&addr), length); if (unreachable) { - expert_add_info_format(pinfo, ti_dst, PI_RESPONSE_CODE, PI_NOTE, "Unreachable"); + expert_add_info(pinfo, ti_dst, &ei_eigrp_unreachable); } } first = FALSE; @@ -1175,8 +1178,7 @@ dissect_eigrp_ipx_addr (proto_item *ti, proto_tree *tree, tvbuff_t *tvb, ipxnet_to_string(tvb_get_ptr(tvb, offset, 4))); if (unreachable) { - expert_add_info_format(pinfo, ti_dst, PI_RESPONSE_CODE, PI_NOTE, - "Unreachable"); + expert_add_info(pinfo, ti_dst, &ei_eigrp_unreachable); } offset +=4; @@ -1640,8 +1642,7 @@ dissect_eigrp_general_tlv (proto_item *ti, proto_tree *tree, tvbuff_t *tvb, dissect_eigrp_peer_tidlist(tree, tvb); break; default: - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, - "Unknown Generic TLV (0x%04x)", tlv); + expert_add_info_format_text(pinfo, ti, &ei_eigrp_tlv_type, "Unknown Generic TLV (0x%04x)", tlv); break; } } @@ -1920,7 +1921,6 @@ static int dissect_eigrp_multi_topology_tlv (proto_item *ti, proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, guint16 tlv) { - proto_item *sub_ti; guint16 afi; int offset = 2; int unreachable = FALSE; @@ -1976,8 +1976,7 @@ dissect_eigrp_multi_topology_tlv (proto_item *ti, proto_tree *tree, tvbuff_t *tv break; default: - sub_ti = proto_tree_add_text(tree, tvb, offset, -1, "Unknown AFI"); - expert_add_info_format(pinfo, sub_ti, PI_MALFORMED, PI_ERROR, "Unknown AFI"); + proto_tree_add_expert(tree, pinfo, &ei_eigrp_afi, tvb, offset, -1); } return offset; @@ -2327,7 +2326,6 @@ static int dissect_eigrp_multi_protocol_tlv (proto_item *ti, proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, guint16 tlv) { - proto_item *sub_ti; int offset = 0; guint16 afi; int unreachable = FALSE; @@ -2381,8 +2379,7 @@ dissect_eigrp_multi_protocol_tlv (proto_item *ti, proto_tree *tree, tvbuff_t *tv break; default: - sub_ti = proto_tree_add_text(tree, tvb, offset, -1, "Unknown AFI"); - expert_add_info_format(pinfo, sub_ti, PI_MALFORMED, PI_ERROR, "Unknown AFI"); + proto_tree_add_expert(tree, pinfo, &ei_eigrp_afi, tvb, offset, -1); } return offset; @@ -2472,9 +2469,7 @@ dissect_eigrp (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _ proto_tree_add_text(eigrp_tree, tvb, 2, 2, "Checksum: 0x%02x [incorrect]", checksum); - expert_add_info_format(pinfo, ti, PI_RESPONSE_CODE, PI_NOTE, - "Checksum: 0x%02x [incorrect, should be 0x%02x]", - checksum, cacl_checksum); + expert_add_info(pinfo, ti, &ei_eigrp_checksum_bad); } else { proto_tree_add_text(eigrp_tree, tvb, 2, 2, "Checksum: 0x%02x [correct]", checksum); @@ -2517,10 +2512,7 @@ dissect_eigrp (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _ size = tvb_get_ntohs(tvb, offset + 2); if (size == 0) { - ti = proto_tree_add_text(eigrp_tree, tvb, offset, -1, - "Corrupt TLV (Zero Size)"); - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, - "Corrupt TLV (Zero Size)"); + proto_tree_add_expert(ti, pinfo, &ei_eigrp_tlv_len, tvb, offset, -1); return(tvb_length(tvb)); } @@ -2565,8 +2557,7 @@ dissect_eigrp (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _ break; default: - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, - "Unknown TLV Group (0x%04x)", tlv); + expert_add_info_format_text(pinfo, ti, &ei_eigrp_tlv_type, "Unknown TLV Group (0x%04x)", tlv); } offset += size; @@ -3303,6 +3294,22 @@ proto_register_eigrp(void) &ett_eigrp_extdata_flags, }; + static ei_register_info ei[] = { + { &ei_eigrp_peer_termination, { "eigrp.peer_termination", PI_RESPONSE_CODE, PI_NOTE, "Peer Termination", EXPFILL }}, + { &ei_eigrp_auth_len, { "eigrp.auth.length.invalid", PI_MALFORMED, PI_WARN, "Invalid auth len", EXPFILL }}, + { &ei_eigrp_auth_type, { "eigrp.auth.type.invalid", PI_PROTOCOL, PI_WARN, "Invalid auth type", EXPFILL }}, + { &ei_eigrp_seq_addrlen, { "eigrp.seq.addrlen.invalid", PI_MALFORMED, PI_ERROR, "Invalid address length", EXPFILL }}, + { &ei_eigrp_peer_termination_graceful, { "eigrp.peer_termination_graceful", PI_RESPONSE_CODE, PI_NOTE, "Peer Termination (Graceful Shutdown)", EXPFILL }}, + { &ei_eigrp_prefixlen, { "eigrp.prefixlen.invalid", PI_MALFORMED, PI_WARN, "Invalid prefix length", EXPFILL }}, + { &ei_eigrp_unreachable, { "eigrp.unreachable", PI_RESPONSE_CODE, PI_NOTE, "Unreachable", EXPFILL }}, + { &ei_eigrp_tlv_type, { "eigrp.tlv_type.unknown", PI_PROTOCOL, PI_WARN, "Unknown TLV", EXPFILL }}, + { &ei_eigrp_afi, { "eigrp.afi.unknown", PI_PROTOCOL, PI_WARN, "Unknown AFI", EXPFILL }}, + { &ei_eigrp_checksum_bad, { "eigrp.checksum.bad", PI_CHECKSUM, PI_WARN, "Bad Checksum", EXPFILL }}, + { &ei_eigrp_tlv_len, { "eigrp.tlv.len.invalid", PI_MALFORMED, PI_ERROR, "Corrupt TLV (Zero Size)", EXPFILL }}, + }; + + expert_module_t* expert_eigrp; + /* Register the protocol name and description */ proto_eigrp = proto_register_protocol( "Enhanced Interior Gateway Routing Protocol", /* name */ @@ -3313,6 +3320,8 @@ proto_register_eigrp(void) /* Required function calls to register the header fields and subtrees used */ proto_register_field_array(proto_eigrp, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_eigrp = expert_register_protocol(proto_eigrp); + expert_register_field_array(expert_eigrp, ei, array_length(ei)); } /** diff --git a/epan/dissectors/packet-gtp.c b/epan/dissectors/packet-gtp.c index 69f094a20e..0d860bd5fd 100644 --- a/epan/dissectors/packet-gtp.c +++ b/epan/dissectors/packet-gtp.c @@ -327,6 +327,10 @@ static gint ett_gtp_cdr_ver = -1; static gint ett_gtp_cdr_dr = -1; static gint ett_gtp_uli_rai = -1; +static expert_field ei_gtp_ext_hdr_pdcpsn = EI_INIT; +static expert_field ei_gtp_ext_length_mal = EI_INIT; +static expert_field ei_gtp_ext_length_warn = EI_INIT; + static gboolean g_gtp_etsi_order = FALSE; static gint dissect_tpdu_as = -1; @@ -5548,10 +5552,7 @@ decode_gtp_apn_res(tvbuff_t * tvb, int offset, packet_info * pinfo _U_, proto_tr /* Restriction Type value */ if (length != 1) { - proto_item *expert_item; - expert_item = proto_tree_add_text(tree, tvb, 0, length, "Wrong length indicated. Expected 1, got %u", length); - expert_add_info_format(pinfo, expert_item, PI_MALFORMED, PI_ERROR, "Wrong length indicated. Expected 1, got %u", length); - PROTO_ITEM_SET_GENERATED(expert_item); + proto_tree_add_expert_format(tree, pinfo, &ei_gtp_ext_length_mal, tvb, 0, length, "Wrong length indicated. Expected 1, got %u", length); return 3 + length; } @@ -5583,10 +5584,7 @@ decode_gtp_rat_type(tvbuff_t * tvb, int offset, packet_info * pinfo _U_, proto_t /* RAT Type value */ if (length != 1) { - proto_item *expert_item; - expert_item = proto_tree_add_text(tree, tvb, 0, length, "Wrong length indicated. Expected 1, got %u", length); - expert_add_info_format(pinfo, expert_item, PI_MALFORMED, PI_ERROR, "Wrong length indicated. Expected 1, got %u", length); - PROTO_ITEM_SET_GENERATED(expert_item); + proto_tree_add_expert_format(tree, pinfo, &ei_gtp_ext_length_mal, tvb, 0, length, "Wrong length indicated. Expected 1, got %u", length); return 3 + length; } @@ -8044,13 +8042,13 @@ dissect_gtp_common(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree) if (gtp_hdr->flags & (GTP_E_MASK|GTP_S_MASK|GTP_PN_MASK)) { /* Those fields are only *interpreted* if the particular flag for the field is set. */ - if (gtp_hdr->flags & GTP_S_MASK) { + if (gtp_hdr->flags & GTP_S_MASK) { seq_no = tvb_get_ntohs(tvb, offset); proto_tree_add_uint(gtp_tree, hf_gtp_seq_number, tvb, offset, 2, seq_no); } offset += 2; - if (gtp_hdr->flags & GTP_PN_MASK) { + if (gtp_hdr->flags & GTP_PN_MASK) { pdu_no = tvb_get_guint8(tvb, offset); proto_tree_add_uint(gtp_tree, hf_gtp_npdu_number, tvb, offset, 1, pdu_no); } @@ -8066,13 +8064,12 @@ dissect_gtp_common(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree) ext_tree = proto_item_add_subtree(tf, ett_gtp_ext_hdr); ext_hdr_len_item = proto_tree_add_item(ext_tree, hf_gtp_ext_hdr_length, tvb, offset,1, ENC_BIG_ENDIAN); if (ext_hdr_length == 0) { - expert_add_info_format(pinfo, ext_hdr_len_item, PI_MALFORMED, - PI_ERROR, + expert_add_info_format_text(pinfo, ext_hdr_len_item, &ei_gtp_ext_length_mal, "Extension header length is zero"); return tvb_length(tvb); } offset++; - + switch (next_hdr) { case GTP_EXT_HDR_PDCP_SN: @@ -8096,13 +8093,15 @@ dissect_gtp_common(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree) */ /* First byte is length (should be 1) */ if (ext_hdr_length == 1) { + proto_item* ext_item; + ext_hdr_pdcpsn = tvb_get_ntohs(tvb, offset); + ext_item = proto_tree_add_item(ext_tree, hf_gtp_ext_hdr_pdcpsn, tvb, offset, 2, ENC_BIG_ENDIAN); if (ext_hdr_pdcpsn & 0x700) { - expert_add_info_format(pinfo, ext_tree, PI_PROTOCOL, PI_NOTE, "3GPP TS 29.281 v9.0.0: When used between two eNBs at the X2 interface in E-UTRAN, bits 5-8 of octet 2 are spare. The meaning of the spare bits shall be set to zero."); + expert_add_info(pinfo, ext_item, &ei_gtp_ext_hdr_pdcpsn); } - proto_tree_add_item(ext_tree, hf_gtp_ext_hdr_pdcpsn, tvb, offset, 2, ENC_BIG_ENDIAN); } else { - expert_add_info_format(pinfo, ext_tree, PI_PROTOCOL, PI_WARN, "The length field for the PDCP SN Extension header should be 1."); + expert_add_info_format_text(pinfo, ext_tree, &ei_gtp_ext_length_warn, "The length field for the PDCP SN Extension header should be 1."); } break; @@ -8119,8 +8118,8 @@ dissect_gtp_common(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree) /* UDP Port of source */ proto_tree_add_item(ext_tree, hf_gtp_ext_hdr_udp_port, tvb, offset, 2, ENC_BIG_ENDIAN); } else { - /* Bad length */ - expert_add_info_format(pinfo, ext_tree, PI_PROTOCOL, PI_WARN, "The length field for the UDP Port Extension header should be 1."); + /* Bad length */ + expert_add_info_format_text(pinfo, ext_tree, &ei_gtp_ext_length_warn, "The length field for the UDP Port Extension header should be 1."); } break; @@ -8151,7 +8150,7 @@ dissect_gtp_common(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree) } if (gtp_hdr->message != GTP_MSG_TPDU) { - /* Dissect IEs */ + /* Dissect IEs */ mandatory = 0; /* check order of GTP fields against ETSI */ while (tvb_reported_length_remaining(tvb, offset) > 0) { ext_hdr_val = tvb_get_guint8(tvb, offset); @@ -8269,7 +8268,7 @@ dissect_gtp(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, version = tvb_get_guint8(tvb,0)>>5; if (version > 2) { /* Unknown version - reject the packet */ - return 0; + return 0; } if (version == 2) { /* GTPv2-C 3GPP TS 29.274 */ @@ -8308,6 +8307,7 @@ void proto_register_gtp(void) { module_t *gtp_module; + expert_module_t* expert_gtp; guint i; guint last_offset; @@ -9272,6 +9272,12 @@ proto_register_gtp(void) }, }; + static ei_register_info ei[] = { + { &ei_gtp_ext_length_mal, { "gtp.ext_length.invalid", PI_MALFORMED, PI_ERROR, "Malformed length", EXPFILL }}, + { &ei_gtp_ext_hdr_pdcpsn, { "gtp.ext_hdr.pdcp_sn.non_zero", PI_PROTOCOL, PI_NOTE, "3GPP TS 29.281 v9.0.0: When used between two eNBs at the X2 interface in E-UTRAN, bits 5-8 of octet 2 are spare. The meaning of the spare bits shall be set to zero.", EXPFILL }}, + { &ei_gtp_ext_length_warn, { "gtp.ext_length.invalid", PI_PROTOCOL, PI_WARN, "Length warning", EXPFILL }}, + }; + /* Setup protocol subtree array */ #define GTP_NUM_INDIVIDUAL_ELEMS 28 static gint *ett_gtp_array[GTP_NUM_INDIVIDUAL_ELEMS + NUM_GTP_IES]; @@ -9318,6 +9324,8 @@ proto_register_gtp(void) proto_gtp = proto_register_protocol("GPRS Tunneling Protocol", "GTP", "gtp"); proto_register_field_array(proto_gtp, hf_gtp, array_length(hf_gtp)); proto_register_subtree_array(ett_gtp_array, array_length(ett_gtp_array)); + expert_gtp = expert_register_protocol(proto_gtp); + expert_register_field_array(expert_gtp, ei, array_length(ei)); gtp_module = prefs_register_protocol(proto_gtp, proto_reg_handoff_gtp); diff --git a/epan/dissectors/packet-icep.c b/epan/dissectors/packet-icep.c index 00b8853a82..be601dc65e 100644 --- a/epan/dissectors/packet-icep.c +++ b/epan/dissectors/packet-icep.c @@ -105,6 +105,21 @@ static int hf_icep_reply_status = -1; static gint ett_icep = -1; static gint ett_icep_msg = -1; +static expert_field ei_icep_params_size = EI_INIT; +static expert_field ei_icep_context_missing = EI_INIT; +static expert_field ei_icep_reply_data = EI_INIT; +static expert_field ei_icep_length = EI_INIT; +static expert_field ei_icep_facet_max_one_element = EI_INIT; +static expert_field ei_icep_string_too_long = EI_INIT; +static expert_field ei_icep_string_malformed = EI_INIT; +static expert_field ei_icep_message_type = EI_INIT; +static expert_field ei_icep_mode_missing = EI_INIT; +static expert_field ei_icep_params_encapsulated = EI_INIT; +static expert_field ei_icep_params_missing = EI_INIT; +static expert_field ei_icep_batch_requests = EI_INIT; +static expert_field ei_icep_facet_missing = EI_INIT; +static expert_field ei_icep_context_too_long = EI_INIT; + /* Preferences */ static guint icep_max_batch_requests = 64; static guint icep_max_ice_string_len = 512; @@ -172,7 +187,7 @@ static void dissect_ice_string(packet_info *pinfo, proto_tree *tree, proto_item /* check for first byte */ if ( !tvb_bytes_exist(tvb, offset, 1) ) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "1st byte of Size missing"); + expert_add_info_format_text(pinfo, item, &ei_icep_string_malformed, "1st byte of Size missing"); col_append_str(pinfo->cinfo, COL_INFO, " (1st byte of Size missing)"); (*consumed) = -1; @@ -189,7 +204,7 @@ static void dissect_ice_string(packet_info *pinfo, proto_tree *tree, proto_item /* check for next 4 bytes */ if ( !tvb_bytes_exist(tvb, offset, 4) ) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "second field of Size missing"); + expert_add_info_format_text(pinfo, item, &ei_icep_string_malformed, "second field of Size missing"); col_append_str(pinfo->cinfo, COL_INFO, " (second field of Size missing)"); (*consumed) = -1; @@ -207,7 +222,7 @@ static void dissect_ice_string(packet_info *pinfo, proto_tree *tree, proto_item /* check if the string exists */ if ( !tvb_bytes_exist(tvb, offset, Size) ) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "missing or truncated string"); + expert_add_info_format_text(pinfo, item, &ei_icep_string_malformed, "missing or truncated string"); col_append_str(pinfo->cinfo, COL_INFO, " (missing or truncated string)"); (*consumed) = -1; @@ -216,7 +231,7 @@ static void dissect_ice_string(packet_info *pinfo, proto_tree *tree, proto_item if ( Size > icep_max_ice_string_len ) { - expert_add_info_format(pinfo, item, PI_PROTOCOL, PI_WARN, "string too long"); + expert_add_info(pinfo, item, &ei_icep_string_too_long); col_append_str(pinfo->cinfo, COL_INFO, " (string too long)"); (*consumed) = -1; @@ -272,7 +287,7 @@ static void dissect_ice_facet(packet_info *pinfo, proto_tree *tree, proto_item * /* check first byte */ if ( !tvb_bytes_exist(tvb, offset, 1) ) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "facet field missing"); + expert_add_info(pinfo, item, &ei_icep_facet_missing); col_append_str(pinfo->cinfo, COL_INFO, " (facet field missing)"); (*consumed) = -1; @@ -309,7 +324,7 @@ static void dissect_ice_facet(packet_info *pinfo, proto_tree *tree, proto_item * /* if here => Size > 1 => not possible */ /* display the XX Size byte when click here */ - expert_add_info_format(pinfo, item, PI_PROTOCOL, PI_WARN, "facet can be max one element"); + expert_add_info(pinfo, item, &ei_icep_facet_max_one_element); col_append_str(pinfo->cinfo, COL_INFO, " (facet can be max one element)"); @@ -343,7 +358,7 @@ static void dissect_ice_context(packet_info *pinfo, proto_tree *tree, proto_item /* check first byte */ if ( !tvb_bytes_exist(tvb, offset, 1) ) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "context missing"); + expert_add_info_format_text(pinfo, item, &ei_icep_context_missing, "context missing"); col_append_str(pinfo->cinfo, COL_INFO, " (context missing)"); (*consumed) = -1; @@ -360,7 +375,7 @@ static void dissect_ice_context(packet_info *pinfo, proto_tree *tree, proto_item /* check for next 4 bytes */ if ( !tvb_bytes_exist(tvb, offset, 4) ) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "second field of Size missing"); + expert_add_info_format_text(pinfo, item, &ei_icep_context_missing, "second field of Size missing"); col_append_str(pinfo->cinfo, COL_INFO, " (second field of Size missing)"); (*consumed) = -1; @@ -378,7 +393,7 @@ static void dissect_ice_context(packet_info *pinfo, proto_tree *tree, proto_item if ( Size > icep_max_ice_context_pairs ) { /* display the XX Size byte when click here */ - expert_add_info_format(pinfo, item, PI_PROTOCOL, PI_WARN, "too long context"); + expert_add_info(pinfo, item, &ei_icep_context_too_long); col_append_str(pinfo->cinfo, COL_INFO, " (too long context)"); @@ -457,7 +472,7 @@ static void dissect_ice_params(packet_info *pinfo, proto_tree *tree, proto_item /* check first 6 bytes */ if ( !tvb_bytes_exist(tvb, offset, ICEP_MIN_PARAMS_SIZE) ) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "params missing"); + expert_add_info(pinfo, item, &ei_icep_params_missing); col_append_str(pinfo->cinfo, COL_INFO, " (params missing)"); (*consumed) = -1; @@ -471,7 +486,7 @@ static void dissect_ice_params(packet_info *pinfo, proto_tree *tree, proto_item if ( size < ICEP_MIN_PARAMS_SIZE ) { - expert_add_info_format(pinfo, item, PI_PROTOCOL, PI_WARN, "params size too small"); + expert_add_info(pinfo, item, &ei_icep_params_size); col_append_str(pinfo->cinfo, COL_INFO, " (params size too small)"); (*consumed) = -1; @@ -506,8 +521,7 @@ static void dissect_ice_params(packet_info *pinfo, proto_tree *tree, proto_item if ( tvb_data_remained < ( size - ICEP_MIN_PARAMS_SIZE ) ) { - expert_add_info_format(pinfo, item, PI_PROTOCOL, PI_WARN, "missing encapsulated data (%d bytes)", - size - ICEP_MIN_PARAMS_SIZE - tvb_data_remained); + expert_add_info_format_text(pinfo, item, &ei_icep_params_encapsulated, "missing encapsulated data (%d bytes)", size - ICEP_MIN_PARAMS_SIZE - tvb_data_remained); col_append_fstr(pinfo->cinfo, COL_INFO, " (missing encapsulated data (%d bytes))", @@ -548,7 +562,7 @@ static void dissect_icep_request_common(tvbuff_t *tvb, guint32 offset, /* check common header (i.e. the batch request one)*/ if ( !tvb_bytes_exist(tvb, offset, ICEP_MIN_COMMON_REQ_HEADER_SIZE) ) { - expert_add_info_format(pinfo, icep_sub_item, PI_MALFORMED, PI_ERROR, "too short header"); + expert_add_info_format_text(pinfo, icep_sub_item, &ei_icep_length, "too short header"); col_append_str(pinfo->cinfo, COL_INFO, " (too short header)"); goto error; @@ -618,7 +632,7 @@ static void dissect_icep_request_common(tvbuff_t *tvb, guint32 offset, /* check and get mode byte */ if ( !tvb_bytes_exist(tvb, offset, 1) ) { - expert_add_info_format(pinfo, icep_sub_item, PI_MALFORMED, PI_ERROR, "mode field missing"); + expert_add_info(pinfo, icep_sub_item, &ei_icep_mode_missing); col_append_str(pinfo->cinfo, COL_INFO, " (mode field missing)"); goto error; @@ -688,7 +702,7 @@ static void dissect_icep_request(tvbuff_t *tvb, guint32 offset, /* check for req id */ if ( !tvb_bytes_exist(tvb, offset, 4) ) { - expert_add_info_format(pinfo, icep_item, PI_MALFORMED, PI_ERROR, "too short header"); + expert_add_info_format_text(pinfo, icep_item, &ei_icep_length, "too short header"); col_append_str(pinfo->cinfo, COL_INFO, " (too short header)"); return; } @@ -757,7 +771,7 @@ static void dissect_icep_batch_request(tvbuff_t *tvb, guint32 offset, /* check for first 4 byte */ if ( !tvb_bytes_exist(tvb, offset, 4) ) { - expert_add_info_format(pinfo, icep_item, PI_MALFORMED, PI_ERROR, "counter of batch requests missing"); + expert_add_info_format_text(pinfo, icep_item, &ei_icep_length, "counter of batch requests missing"); col_append_str(pinfo->cinfo, COL_INFO, " (counter of batch requests missing)"); return; } @@ -769,7 +783,7 @@ static void dissect_icep_batch_request(tvbuff_t *tvb, guint32 offset, if ( num_reqs > icep_max_batch_requests ) { - expert_add_info_format(pinfo, icep_item, PI_PROTOCOL, PI_WARN, "too many batch requests (%d)", num_reqs); + expert_add_info_format_text(pinfo, icep_item, &ei_icep_batch_requests, "too many batch requests (%d)", num_reqs); col_append_fstr(pinfo->cinfo, COL_INFO, " (too many batch requests, %d)", num_reqs); return; @@ -842,7 +856,7 @@ static void dissect_icep_reply(tvbuff_t *tvb, guint32 offset, if ( !tvb_bytes_exist(tvb, offset, ICEP_MIN_REPLY_SIZE) ) { - expert_add_info_format(pinfo, icep_item, PI_MALFORMED, PI_ERROR, "too short header"); + expert_add_info_format_text(pinfo, icep_item, &ei_icep_length, "too short header"); col_append_str(pinfo->cinfo, COL_INFO, " (too short header)"); return; @@ -882,9 +896,7 @@ static void dissect_icep_reply(tvbuff_t *tvb, guint32 offset, /* no */ if ( tvb_data_remained < reported_reply_data ) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, "Reply Data (missing %d bytes out of %d)", - reported_reply_data - tvb_data_remained, - reported_reply_data); + expert_add_info_format_text(pinfo, ti, &ei_icep_reply_data, "Reply Data (missing %d bytes out of %d)", reported_reply_data - tvb_data_remained, reported_reply_data); col_append_fstr(pinfo->cinfo, COL_INFO, " (missing reply data, %d bytes)", @@ -924,8 +936,8 @@ static void dissect_icep_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree * } */ - proto_item *ti = NULL; - proto_tree *icep_tree = NULL; + proto_item *ti, *msg_item = NULL; + proto_tree *icep_tree; guint32 offset = 0; /* Make entries in Protocol column and Info column on summary display */ @@ -937,16 +949,14 @@ static void dissect_icep_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree icep_msgtype_vals, "Unknown Message Type: 0x%02x")); - if (tree) { - - DBG0("got an icep msg, start analysis\n"); + DBG0("got an icep msg, start analysis\n"); - /* create display subtree for the protocol */ + /* create display subtree for the protocol */ - ti = proto_tree_add_item(tree, proto_icep, tvb, 0, -1, ENC_NA); - - icep_tree = proto_item_add_subtree(ti, ett_icep); + ti = proto_tree_add_item(tree, proto_icep, tvb, 0, -1, ENC_NA); + icep_tree = proto_item_add_subtree(ti, ett_icep); + if (icep_tree) { /* add items to the subtree */ /* message header */ @@ -971,7 +981,7 @@ static void dissect_icep_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree tvb, offset, 1, ENC_LITTLE_ENDIAN); offset++; - proto_tree_add_item(icep_tree, hf_icep_message_type, + msg_item = proto_tree_add_item(icep_tree, hf_icep_message_type, tvb, offset, 1, ENC_LITTLE_ENDIAN); offset++; @@ -1007,8 +1017,7 @@ static void dissect_icep_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree /* messages already dissected */ break; default: - if (tree) - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Unknown Message Type: 0x%02x", tvb_get_guint8(tvb, 8)); + expert_add_info_format_text(pinfo, msg_item, &ei_icep_message_type, "Unknown Message Type: 0x%02x", tvb_get_guint8(tvb, 8)); break; } } @@ -1050,6 +1059,7 @@ static gboolean dissect_icep_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree * void proto_register_icep(void) { module_t *icep_module; + expert_module_t* expert_icep; /* Setup list of header fields */ @@ -1248,6 +1258,23 @@ void proto_register_icep(void) &ett_icep_msg, }; + static ei_register_info ei[] = { + { &ei_icep_string_malformed, { "icep.string.malformed", PI_MALFORMED, PI_ERROR, "String malformed", EXPFILL }}, + { &ei_icep_string_too_long, { "icep.string.too_long", PI_PROTOCOL, PI_WARN, "string too long", EXPFILL }}, + { &ei_icep_facet_missing, { "icep.facet.missing", PI_MALFORMED, PI_ERROR, "facet field missing", EXPFILL }}, + { &ei_icep_facet_max_one_element, { "icep.facet.max_one_element", PI_PROTOCOL, PI_WARN, "facet can be max one element", EXPFILL }}, + { &ei_icep_context_missing, { "icep.context.missing", PI_MALFORMED, PI_ERROR, "context missing", EXPFILL }}, + { &ei_icep_context_too_long, { "icep.context.too_long", PI_PROTOCOL, PI_WARN, "too long context", EXPFILL }}, + { &ei_icep_params_missing, { "icep.params.missing", PI_MALFORMED, PI_ERROR, "params missing", EXPFILL }}, + { &ei_icep_params_size, { "icep.params.size.invalid", PI_PROTOCOL, PI_WARN, "params size too small", EXPFILL }}, + { &ei_icep_params_encapsulated, { "icep.params.encapsulated.missing", PI_PROTOCOL, PI_WARN, "missing encapsulated data (%d bytes)", EXPFILL }}, + { &ei_icep_length, { "icep.length_invalid", PI_MALFORMED, PI_ERROR, "Invalid length", EXPFILL }}, + { &ei_icep_mode_missing, { "icep.mode.missing", PI_MALFORMED, PI_ERROR, "mode field missing", EXPFILL }}, + { &ei_icep_batch_requests, { "icep.batch_requests.invalid", PI_PROTOCOL, PI_WARN, "too many batch requests", EXPFILL }}, + { &ei_icep_reply_data, { "icep.params.reply_data.missing", PI_MALFORMED, PI_ERROR, "Reply Data missing", EXPFILL }}, + { &ei_icep_message_type, { "icep.message_type.unknown", PI_PROTOCOL, PI_WARN, "Unknown Message Type", EXPFILL }}, + }; + /* Register the protocol name and description */ proto_icep = @@ -1258,6 +1285,8 @@ void proto_register_icep(void) proto_register_field_array(proto_icep, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_icep = expert_register_protocol(proto_icep); + expert_register_field_array(expert_icep, ei, array_length(ei)); icep_module = prefs_register_protocol(proto_icep, NULL); diff --git a/epan/dissectors/packet-ieee80211-radiotap.c b/epan/dissectors/packet-ieee80211-radiotap.c index cabe5be6f1..bc4de921fe 100644 --- a/epan/dissectors/packet-ieee80211-radiotap.c +++ b/epan/dissectors/packet-ieee80211-radiotap.c @@ -211,6 +211,10 @@ static gint ett_radiotap_vht = -1; static gint ett_radiotap_vht_known = -1; static gint ett_radiotap_vht_user = -1; +static expert_field ei_radiotap_data_past_header = EI_INIT; +static expert_field ei_radiotap_present_reserved = EI_INIT; +static expert_field ei_radiotap_present = EI_INIT; + static dissector_handle_t ieee80211_handle; static dissector_handle_t ieee80211_datapad_handle; @@ -1076,8 +1080,7 @@ dissect_radiotap(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree) BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE))) == (BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE) | BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE))) { - expert_add_info_format(pinfo, pt, PI_MALFORMED, - PI_ERROR, + expert_add_info_format_text(pinfo, pt, &ei_radiotap_present, "Both radiotap and vendor namespace specified in bitmask word %u", i); goto malformed; @@ -1160,10 +1163,7 @@ dissect_radiotap(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree) /* Check if Reserved/Not Defined is not "zero" */ if(bmap & IEEE80211_RADIOTAP_NOTDEFINED) { - expert_add_info_format(pinfo, pt, PI_UNDECODED, PI_NOTE, - "Unknown Radiotap fields, code not implemented, " - "Please check radiotap documentation, " - "Contact Wireshark developers if you want this supported" ); + expert_add_info(pinfo, pt, &ei_radiotap_present_reserved); } always_bits: proto_tree_add_item(present_tree, @@ -1920,9 +1920,7 @@ dissect_radiotap(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree) } if (err != -ENOENT && tree) { - expert_add_info_format(pinfo, pt, PI_MALFORMED, - PI_ERROR, - "Radiotap data goes past the end of the radiotap header"); + expert_add_info(pinfo, pt, &ei_radiotap_data_past_header); malformed: proto_item_append_text(ti, " (malformed)"); } @@ -2803,13 +2801,21 @@ void proto_register_radiotap(void) &ett_radiotap_vht_known, &ett_radiotap_vht_user }; + static ei_register_info ei[] = { + { &ei_radiotap_present, { "radiotap.present.radiotap_and_vendor", PI_MALFORMED, PI_ERROR, "Both radiotap and vendor namespace specified in bitmask word", EXPFILL }}, + { &ei_radiotap_present_reserved, { "radiotap.present.reserved.unknown", PI_UNDECODED, PI_NOTE, "Unknown Radiotap fields, code not implemented, Please check radiotap documentation, Contact Wireshark developers if you want this supported", EXPFILL }}, + { &ei_radiotap_data_past_header, { "radiotap.data_past_header", PI_MALFORMED, PI_ERROR, "Radiotap data goes past the end of the radiotap header", EXPFILL }}, + }; + module_t *radiotap_module; + expert_module_t* expert_radiotap; proto_radiotap = - proto_register_protocol("IEEE 802.11 Radiotap Capture header", - "802.11 Radiotap", "radiotap"); + proto_register_protocol("IEEE 802.11 Radiotap Capture header", "802.11 Radiotap", "radiotap"); proto_register_field_array(proto_radiotap, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_radiotap = expert_register_protocol(proto_radiotap); + expert_register_field_array(expert_radiotap, ei, array_length(ei)); register_dissector("radiotap", dissect_radiotap, proto_radiotap); radiotap_tap = register_tap("radiotap"); diff --git a/epan/dissectors/packet-ieee802154.c b/epan/dissectors/packet-ieee802154.c index fc03799e25..1133cdeb4e 100644 --- a/epan/dissectors/packet-ieee802154.c +++ b/epan/dissectors/packet-ieee802154.c @@ -285,6 +285,12 @@ static gint ett_ieee802154_gts_direction = -1; static gint ett_ieee802154_gts_descriptors = -1; static gint ett_ieee802154_pendaddr = -1; +static expert_field ei_ieee802154_invalid_addressing = EI_INIT; +static expert_field ei_ieee802154_fcs = EI_INIT; +static expert_field ei_ieee802154_decrypt_error = EI_INIT; +static expert_field ei_ieee802154_dst = EI_INIT; +static expert_field ei_ieee802154_src = EI_INIT; + /* Dissector handles */ static dissector_handle_t data_handle; static heur_dissector_list_t ieee802154_heur_subdissector_list; @@ -357,10 +363,10 @@ static gint ieee802154_sec_suite = SECURITY_LEVEL_ENC_MIC_64; static gboolean ieee802154_extend_auth = TRUE; /* Macro to check addressing, and throw a warning flag if incorrect. */ -#define IEEE802154_CMD_ADDR_CHECK(_pinfo_, _item_, _cmdid_, _x_) \ - if (!(_x_)) \ - expert_add_info_format(_pinfo_, _item_, PI_MALFORMED, PI_WARN, \ - "Invalid Addressing for %s", \ +#define IEEE802154_CMD_ADDR_CHECK(_pinfo_, _item_, _cmdid_, _x_) \ + if (!(_x_)) \ + expert_add_info_format_text(_pinfo_, _item_, &ei_ieee802154_invalid_addressing, \ + "Invalid Addressing for %s", \ val_to_str_const(_cmdid_, ieee802154_cmd_names, "Unknown Command")) /* CRC definitions. IEEE 802.15.4 CRCs vary from CCITT by using an initial value of @@ -747,7 +753,7 @@ dissect_ieee802154_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g } else if (packet->dst_addr_mode != IEEE802154_FCF_ADDR_NONE) { /* Invalid Destination Address Mode. Abort Dissection. */ - expert_add_info_format(pinfo, proto_root, PI_MALFORMED, PI_ERROR, "Invalid Destination Address Mode"); + expert_add_info(pinfo, proto_root, &ei_ieee802154_dst); pinfo->private_data = pd_save; return; } @@ -857,7 +863,7 @@ dissect_ieee802154_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g } else if (packet->src_addr_mode != IEEE802154_FCF_ADDR_NONE) { /* Invalid Destination Address Mode. Abort Dissection. */ - expert_add_info_format(pinfo, proto_root, PI_MALFORMED, PI_ERROR, "Invalid Source Address Mode"); + expert_add_info(pinfo, proto_root, &ei_ieee802154_src); pinfo->private_data = pd_save; return; } @@ -1012,33 +1018,32 @@ dissect_ieee802154_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g case DECRYPT_VERSION_UNSUPPORTED: /* We don't support decryption with that version of the protocol */ - expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "We don't support decryption with protocol version %u", - packet->version); + expert_add_info_format_text(pinfo, proto_root, &ei_ieee802154_decrypt_error, "We don't support decryption with protocol version %u", packet->version); call_dissector(data_handle, payload_tvb, pinfo, tree); goto dissect_ieee802154_fcs; case DECRYPT_PACKET_TOO_SMALL: - expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "Packet was too small to include the CRC and MIC"); + expert_add_info_format_text(pinfo, proto_root, &ei_ieee802154_decrypt_error, "Packet was too small to include the CRC and MIC"); call_dissector(data_handle, payload_tvb, pinfo, tree); goto dissect_ieee802154_fcs; case DECRYPT_PACKET_NO_EXT_SRC_ADDR: - expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "No extended source address - can't decrypt"); + expert_add_info_format_text(pinfo, proto_root, &ei_ieee802154_decrypt_error, "No extended source address - can't decrypt"); call_dissector(data_handle, payload_tvb, pinfo, tree); goto dissect_ieee802154_fcs; case DECRYPT_PACKET_NO_KEY: - expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "No encryption key set - can't decrypt"); + expert_add_info_format_text(pinfo, proto_root, &ei_ieee802154_decrypt_error, "No encryption key set - can't decrypt"); call_dissector(data_handle, payload_tvb, pinfo, tree); goto dissect_ieee802154_fcs; case DECRYPT_PACKET_DECRYPT_FAILED: - expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "Decrypt failed"); + expert_add_info_format_text(pinfo, proto_root, &ei_ieee802154_decrypt_error, "Decrypt failed"); call_dissector(data_handle, payload_tvb, pinfo, tree); goto dissect_ieee802154_fcs; case DECRYPT_PACKET_MIC_CHECK_FAILED: - expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "MIC check failed"); + expert_add_info_format_text(pinfo, proto_root, &ei_ieee802154_decrypt_error, "MIC check failed"); /* * Abort only if the payload was encrypted, in which case we * probably didn't decrypt the packet right (eg: wrong key). @@ -1237,7 +1242,7 @@ dissect_ieee802154_fcs: if (tree) proto_item_append_text(proto_root, ", Bad FCS"); /* Flag packet as having a bad crc. */ - expert_add_info_format(pinfo, proto_root, PI_CHECKSUM, PI_WARN, "Bad FCS"); + expert_add_info(pinfo, proto_root, &ei_ieee802154_fcs); } pinfo->private_data = pd_save; } /* dissect_ieee802154_common */ @@ -2658,8 +2663,17 @@ void proto_register_ieee802154(void) &ett_ieee802154_pendaddr }; + static ei_register_info ei[] = { + { &ei_ieee802154_invalid_addressing, { "wpan.invalid_addressing", PI_MALFORMED, PI_WARN, "Invalid Addressing", EXPFILL }}, + { &ei_ieee802154_dst, { "wpan.dst_invalid", PI_MALFORMED, PI_ERROR, "Invalid Destination Address Mode", EXPFILL }}, + { &ei_ieee802154_src, { "wpan.src_invalid", PI_MALFORMED, PI_ERROR, "Invalid Source Address Mode", EXPFILL }}, + { &ei_ieee802154_decrypt_error, { "wpan.decrypt_error", PI_UNDECODED, PI_WARN, "Decryption error", EXPFILL }}, + { &ei_ieee802154_fcs, { "wpan.fcs.bad", PI_CHECKSUM, PI_WARN, "Bad FCS", EXPFILL }}, + }; + /* Preferences. */ module_t *ieee802154_module; + expert_module_t* expert_ieee802154; static uat_field_t addr_uat_flds[] = { UAT_FLD_HEX(addr_uat,addr16,"Short Address", @@ -2686,6 +2700,9 @@ void proto_register_ieee802154(void) proto_register_subtree_array(ett, array_length(ett)); + expert_ieee802154 = expert_register_protocol(proto_ieee802154); + expert_register_field_array(expert_ieee802154, ei, array_length(ei)); + /* add a user preference to set the 802.15.4 ethertype */ ieee802154_module = prefs_register_protocol(proto_ieee802154, proto_reg_handoff_ieee802154); diff --git a/epan/dissectors/packet-irc.c b/epan/dissectors/packet-irc.c index 52b5b1ab9c..7f5e25be46 100644 --- a/epan/dissectors/packet-irc.c +++ b/epan/dissectors/packet-irc.c @@ -67,6 +67,13 @@ static gint ett_irc_request_command = -1; static gint ett_irc_response = -1; static gint ett_irc_response_command = -1; +static expert_field ei_irc_missing_end_delimiter = EI_INIT; +static expert_field ei_irc_numeric_request_command = EI_INIT; +static expert_field ei_irc_response_command = EI_INIT; +static expert_field ei_irc_prefix_missing_ending_space = EI_INIT; +static expert_field ei_irc_request_command = EI_INIT; +static expert_field ei_irc_tag_data_invalid = EI_INIT; + /* This must be a null-terminated string */ static const guint8 TAG_DELIMITER[] = {0x01, 0x00}; @@ -92,14 +99,14 @@ dissect_irc_tag_data(proto_tree *tree, proto_item *item, tvbuff_t *tvb, int offs tag_end_offset = tvb_pbrk_guint8(tvb, offset, datalen-offset, TAG_DELIMITER, &found_end_needle); if (tag_end_offset == -1) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Missing ending tag delimited (0x01)"); + expert_add_info(pinfo, item, &ei_irc_missing_end_delimiter); return; } if ((strcmp(command, "NOTICE") != 0) && (strcmp(command, "PRIVMSG") != 0)) { - expert_add_info_format(pinfo, item, PI_PROTOCOL, PI_WARN, "Tag data outside of NOTICE or PRIVMSG command"); + expert_add_info(pinfo, item, &ei_irc_tag_data_invalid); } /* Placeholder to call CTCP dissector, strip out delimiter */ @@ -135,7 +142,7 @@ dissect_irc_request(proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, int off eop_offset = tvb_pbrk_guint8(tvb, offset+1, linelen-1, " ", &found_needle); if (eop_offset == -1) { - expert_add_info_format(pinfo, request_item, PI_MALFORMED, PI_ERROR, "Prefix missing ending <space>"); + expert_add_info(pinfo, request_item, &ei_irc_prefix_missing_ending_space); return; } @@ -151,7 +158,7 @@ dissect_irc_request(proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, int off } if (offset == end_offset) { - expert_add_info_format(pinfo, request_item, PI_MALFORMED, PI_ERROR, "Request has no command"); + expert_add_info(pinfo, request_item, &ei_irc_request_command); return; } @@ -167,7 +174,7 @@ dissect_irc_request(proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, int off (isdigit(tvb_get_guint8(tvb, offset+1))) && (isdigit(tvb_get_guint8(tvb, offset+2)))) { - expert_add_info_format(pinfo, request_item, PI_PROTOCOL, PI_WARN, "Numeric command not allowed in request"); + expert_add_info(pinfo, request_item, &ei_irc_numeric_request_command); } return; } @@ -182,7 +189,7 @@ dissect_irc_request(proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, int off (isdigit(tvb_get_guint8(tvb, offset+1))) && (isdigit(tvb_get_guint8(tvb, offset+2)))) { - expert_add_info_format(pinfo, request_item, PI_PROTOCOL, PI_WARN, "Numeric command not allowed in request"); + expert_add_info(pinfo, request_item, &ei_irc_numeric_request_command); } found_needle = 0; @@ -263,7 +270,7 @@ dissect_irc_request(proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, int off tag_end_offset = tvb_pbrk_guint8(tvb, tag_start_offset+1, end_offset-tag_start_offset-1, TAG_DELIMITER, &found_tag_needle); if (tag_end_offset == -1) { - expert_add_info_format(pinfo, request_item, PI_MALFORMED, PI_ERROR, "Missing ending tag delimited (0x01)"); + expert_add_info(pinfo, request_item, &ei_irc_missing_end_delimiter); return; } @@ -303,7 +310,7 @@ dissect_irc_response(proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, int of eop_offset = tvb_pbrk_guint8(tvb, offset+1, linelen-1, " ", &found_needle); if (eop_offset == -1) { - expert_add_info_format(pinfo, response_item, PI_MALFORMED, PI_ERROR, "Prefix missing ending <space>"); + expert_add_info(pinfo, response_item, &ei_irc_prefix_missing_ending_space); return; } @@ -319,7 +326,7 @@ dissect_irc_response(proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, int of } if (offset == end_offset) { - expert_add_info_format(pinfo, response_item, PI_MALFORMED, PI_ERROR, "Response has no command"); + expert_add_info(pinfo, response_item, &ei_irc_response_command); return; } @@ -432,7 +439,7 @@ dissect_irc_response(proto_tree *tree, tvbuff_t *tvb, packet_info *pinfo, int of tag_end_offset = tvb_pbrk_guint8(tvb, tag_start_offset+1, end_offset-tag_start_offset-1, TAG_DELIMITER, &found_tag_needle); if (tag_end_offset == -1) { - expert_add_info_format(pinfo, response_item, PI_MALFORMED, PI_ERROR, "Missing ending tag delimited (0x01)"); + expert_add_info(pinfo, response_item, &ei_irc_missing_end_delimiter); return; } @@ -543,9 +550,22 @@ proto_register_irc(void) &ett_irc_response_command }; + static ei_register_info ei[] = { + { &ei_irc_missing_end_delimiter, { "irc.missing_end_delimiter", PI_MALFORMED, PI_ERROR, "Missing ending tag delimiter (0x01)", EXPFILL }}, + { &ei_irc_tag_data_invalid, { "irc.tag_data_invalid", PI_PROTOCOL, PI_WARN, "Tag data outside of NOTICE or PRIVMSG command", EXPFILL }}, + { &ei_irc_prefix_missing_ending_space, { "irc.prefix_missing_ending_space", PI_MALFORMED, PI_ERROR, "Prefix missing ending <space>", EXPFILL }}, + { &ei_irc_request_command, { "irc.request.command.missing", PI_MALFORMED, PI_ERROR, "Request has no command", EXPFILL }}, + { &ei_irc_numeric_request_command, { "irc.request.command.numeric", PI_PROTOCOL, PI_WARN, "Numeric command not allowed in request", EXPFILL }}, + { &ei_irc_response_command, { "irc.response.command.missing", PI_MALFORMED, PI_ERROR, "Response has no command", EXPFILL }}, + }; + + expert_module_t* expert_irc; + proto_irc = proto_register_protocol("Internet Relay Chat", "IRC", "irc"); proto_register_field_array(proto_irc, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_irc = expert_register_protocol(proto_irc); + expert_register_field_array(expert_irc, ei, array_length(ei)); } void diff --git a/epan/dissectors/packet-kerberos.c b/epan/dissectors/packet-kerberos.c index 70d4aff0f2..e5c8035903 100644 --- a/epan/dissectors/packet-kerberos.c +++ b/epan/dissectors/packet-kerberos.c @@ -349,6 +349,8 @@ static gint ett_krb_PAC_MIDL_BLOB = -1; static gint ett_krb_PAC_DREP = -1; static gint ett_krb_PAC_UPN_DNS_INFO = -1; +static expert_field ei_krb_decrypted_keytype = EI_INIT; + static guint32 krb5_errorcode; @@ -584,7 +586,7 @@ decrypt_krb5_data(proto_tree *tree, packet_info *pinfo, if(ret == 0){ char *user_data; - expert_add_info_format(pinfo, NULL, PI_SECURITY, PI_CHAT, + expert_add_info_format_text(pinfo, NULL, &ei_krb_decrypted_keytype, "Decrypted keytype %d in frame %u using %s", ek->keytype, pinfo->fd->num, ek->key_origin); @@ -5401,6 +5403,9 @@ proto_register_kerberos(void) &ett_krb_PAC_DREP, &ett_krb_PAC_UPN_DNS_INFO }; + static ei_register_info ei[] = { + { &ei_krb_decrypted_keytype, { "kerberos.decrypted_keytype", PI_SECURITY, PI_CHAT, "Decrypted keytype", EXPFILL }}, + }; module_t *krb_module; proto_kerberos = proto_register_protocol("Kerberos", "KRB5", "kerberos"); diff --git a/epan/dissectors/packet-lisp.c b/epan/dissectors/packet-lisp.c index 797e47e99f..ba5a244d6f 100644 --- a/epan/dissectors/packet-lisp.c +++ b/epan/dissectors/packet-lisp.c @@ -255,6 +255,9 @@ static gint ett_lisp_loc_flags = -1; static gint ett_lisp_elp = -1; static expert_field ei_lisp_undecoded = EI_INIT; +static expert_field ei_lisp_lcaf_type = EI_INIT; +static expert_field ei_lisp_expected_field = EI_INIT; +static expert_field ei_lisp_unexpected_field = EI_INIT; static dissector_handle_t lisp_handle; @@ -390,7 +393,7 @@ dissect_lcaf_natt_rloc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, rloc_str = get_addr_str(tvb, offset, rloc_afi, &addr_len); if (rloc_str == NULL) { - expert_add_info_format(pinfo, tree, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, tree, &ei_lisp_unexpected_field, "Unexpected RLOC AFI (%d), cannot decode", rloc_afi); return offset; } @@ -419,7 +422,7 @@ dissect_lcaf_elp_hop(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, hop_str = get_addr_str(tvb, offset, hop_afi, &addr_len); if (hop_str == NULL) { - expert_add_info_format(pinfo, tree, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, tree, &ei_lisp_unexpected_field, "Unexpected reencap hop AFI (%d), cannot decode", hop_afi); return offset; } @@ -490,7 +493,7 @@ dissect_lcaf_afi_list(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, remaining -= (offset - old_offset); break; default: - expert_add_info_format(pinfo, tree, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, tree, &ei_lisp_unexpected_field, "Unexpected AFI (%d), cannot decode", afi); return -1; } @@ -723,7 +726,7 @@ dissect_lcaf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset) if (lcaf_type < 13) proto_tree_add_expert(tree, pinfo, &ei_lisp_undecoded, tvb, offset, len); else - expert_add_info_format(pinfo, tree, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, tree, &ei_lisp_lcaf_type, "LCAF type %d is not defined in draft-farinacci-lisp-lcaf-%d", lcaf_type, LCAF_DRAFT_VERSION); return offset + len; @@ -798,7 +801,7 @@ dissect_lisp_locator(tvbuff_t *tvb, packet_info *pinfo, proto_tree *lisp_mapping locator = get_addr_str(tvb, offset, loc_afi, &addr_len); if (locator == NULL) { - expert_add_info_format(pinfo, lisp_mapping_tree, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, lisp_mapping_tree, &ei_lisp_unexpected_field, "Unexpected locator AFI (%d), cannot decode", loc_afi); return offset; } @@ -866,7 +869,7 @@ dissect_lisp_mapping(tvbuff_t *tvb, packet_info *pinfo, proto_tree *lisp_tree, prefix = get_addr_str(tvb, 12, prefix_afi, &addr_len); if (prefix == NULL) { - expert_add_info_format(pinfo, lisp_tree, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, lisp_tree, &ei_lisp_unexpected_field, "Unexpected EID prefix AFI (%d), cannot decode", prefix_afi); return offset; } @@ -1073,7 +1076,7 @@ dissect_lisp_map_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *lisp_tre offset += addr_len; break; default: - expert_add_info_format(pinfo, lisp_tree, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, lisp_tree, &ei_lisp_unexpected_field, "Unexpected Source EID AFI (%d), cannot decode", src_eid_afi); next_tvb = tvb_new_subset_remaining(tvb, offset); call_dissector(data_handle, next_tvb, pinfo, lisp_tree); @@ -1106,7 +1109,7 @@ dissect_lisp_map_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *lisp_tre offset += 16; break; default: - expert_add_info_format(pinfo, lisp_tree, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, lisp_tree, &ei_lisp_unexpected_field, "Unexpected ITR-RLOC-AFI (%d), cannot decode", itr_afi); next_tvb = tvb_new_subset_remaining(tvb, offset); call_dissector(data_handle, next_tvb, pinfo, lisp_tree); @@ -1128,7 +1131,7 @@ dissect_lisp_map_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *lisp_tre prefix = get_addr_str(tvb, offset + 4, prefix_afi, &addr_len); if (prefix == NULL) { - expert_add_info_format(pinfo, lisp_tree, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, lisp_tree, &ei_lisp_unexpected_field, "Unexpected EID prefix AFI (%d), cannot decode", prefix_afi); next_tvb = tvb_new_subset_remaining(tvb, offset); call_dissector(data_handle, next_tvb, pinfo, lisp_tree); @@ -1652,7 +1655,7 @@ dissect_lisp_info(tvbuff_t *tvb, packet_info *pinfo, proto_tree *lisp_tree) prefix = get_addr_str(tvb, offset, prefix_afi, &addr_len); if (prefix == NULL) { - expert_add_info_format(pinfo, lisp_tree, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, lisp_tree, &ei_lisp_unexpected_field, "Unexpected EID prefix AFI (%d), cannot decode", prefix_afi); next_tvb = tvb_new_subset_remaining(tvb, offset); call_dissector(data_handle, next_tvb, pinfo, lisp_tree); @@ -1671,12 +1674,12 @@ dissect_lisp_info(tvbuff_t *tvb, packet_info *pinfo, proto_tree *lisp_tree) if (!reply) { if (afi != 0) { - expert_add_info_format(pinfo, tir, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, tir, &ei_lisp_expected_field, "Expecting NULL AFI (0), found %d, incorrect packet!", afi); } } else { if (afi != AFNUM_LCAF) { - expert_add_info_format(pinfo, tir, PI_PROTOCOL, PI_ERROR, + expert_add_info_format_text(pinfo, tir, &ei_lisp_expected_field, "Expecting LCAF AFI (%d), found %d, incorrect packet!", AFNUM_LCAF, afi); } else { @@ -2117,6 +2120,9 @@ proto_register_lisp(void) static ei_register_info ei[] = { { &ei_lisp_undecoded, { "lisp.undecoded", PI_UNDECODED, PI_WARN, "Not dissected yet (report to wireshark.org)", EXPFILL }}, + { &ei_lisp_unexpected_field, { "lisp.unexpected_field", PI_PROTOCOL, PI_ERROR, "Unexpected field", EXPFILL }}, + { &ei_lisp_lcaf_type, { "lisp.lcaf.type.invalid", PI_PROTOCOL, PI_ERROR, "LCAF type is not defined in draft-farinacci-lisp-lcaf-X", EXPFILL }}, + { &ei_lisp_expected_field, { "lisp.expected_field", PI_PROTOCOL, PI_ERROR, "Expecting field", EXPFILL }}, }; expert_module_t* expert_lisp; diff --git a/epan/dissectors/packet-llrp.c b/epan/dissectors/packet-llrp.c index d4fd8cc5a5..2cfb91b01f 100644 --- a/epan/dissectors/packet-llrp.c +++ b/epan/dissectors/packet-llrp.c @@ -301,6 +301,9 @@ static int hf_llrp_gpo_pulse_dur = -1; static gint ett_llrp = -1; static gint ett_llrp_param = -1; +static expert_field ei_llrp_req_conf = EI_INIT; +static expert_field ei_llrp_invalid_length = EI_INIT; + /* Message Types */ #define LLRP_TYPE_GET_READER_CAPABILITIES 1 #define LLRP_TYPE_GET_READER_CONFIG 2 @@ -1384,7 +1387,7 @@ static guint dissect_llrp_utf8_parameter(tvbuff_t * const tvb, packet_info *pinf len = tvb_get_ntohs(tvb, offset); if(tvb_reported_length_remaining(tvb, offset) < len) { - expert_add_info_format(pinfo, tree, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, tree, &ei_llrp_invalid_length, "invalid length of string: claimed %u, available %u.", len, tvb_reported_length_remaining(tvb, offset)); return offset + 2; @@ -1434,7 +1437,7 @@ static guint dissect_llrp_item_array(tvbuff_t * const tvb, packet_info *pinfo, offset, 2, ENC_BIG_ENDIAN); offset += 2; if(tvb_reported_length_remaining(tvb, offset) < ((gint)(num*item_size))) { - expert_add_info_format(pinfo, tree, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, tree, &ei_llrp_invalid_length, "Array longer than message"); return offset + tvb_reported_length_remaining(tvb, offset); } @@ -1704,7 +1707,7 @@ dissect_llrp_parameters(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, ti = proto_tree_add_item(param_tree, hf_llrp_tlv_len, tvb, offset, 2, ENC_BIG_ENDIAN); if (len != real_len) - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_llrp_invalid_length, "Invalid length field: claimed %u, should be %u.", len, real_len); offset += 2; @@ -2201,7 +2204,7 @@ dissect_llrp_parameters(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, /* Have we decoded exactly the number of bytes declared in the parameter? */ if(suboffset != param_end) { /* Report problem */ - expert_add_info_format(pinfo, param_tree, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, param_tree, &ei_llrp_invalid_length, "Incorrect length of parameter: %u bytes decoded, but %u bytes claimed.", suboffset - offset + 4, real_len); } @@ -2527,7 +2530,7 @@ dissect_llrp_message(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, /* Ignore antenna ID */ proto_item_append_text(antenna_item, " (Ignored)"); /* Tell the user that we are confused */ - expert_add_info_format(pinfo, request_item, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, request_item, &ei_llrp_req_conf, "Unrecognized configuration request: %u", requested_data); /* Ignore both GPI and GPO ports */ @@ -2584,7 +2587,7 @@ dissect_llrp_message(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, } if(tvb_reported_length_remaining(tvb, offset) != 0) { /* Report problem */ - expert_add_info_format(pinfo, tree, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, tree, &ei_llrp_invalid_length, "Incorrect length of message: %u bytes decoded, but %u bytes available.", offset, tvb_reported_length(tvb)); } @@ -2624,7 +2627,7 @@ dissect_llrp_packet(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) len = tvb_get_ntohl(tvb, offset); if (len != tvb_reported_length(tvb)) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_llrp_invalid_length, "Incorrect length field: claimed %u, but have %u.", len, tvb_reported_length(tvb)); } @@ -3699,6 +3702,13 @@ proto_register_llrp(void) &ett_llrp_param }; + static ei_register_info ei[] = { + { &ei_llrp_invalid_length, { "llrp.invalid_length_of_string__claimed_%u", PI_MALFORMED, PI_ERROR, "invalid length of string: claimed %u, available %u.", EXPFILL }}, + { &ei_llrp_req_conf, { "llrp.req_conf.invalid", PI_PROTOCOL, PI_ERROR, "Unrecognized configuration request: %u", EXPFILL }}, + }; + + expert_module_t* expert_llrp; + /* Register the protocol name and description */ proto_llrp = proto_register_protocol("Low Level Reader Protocol", "LLRP", "llrp"); @@ -3706,6 +3716,8 @@ proto_register_llrp(void) /* Required function calls to register the header fields and subtrees used */ proto_register_field_array(proto_llrp, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_llrp = expert_register_protocol(proto_llrp); + expert_register_field_array(expert_llrp, ei, array_length(ei)); } void diff --git a/epan/dissectors/packet-megaco.c b/epan/dissectors/packet-megaco.c index 87b117c49b..3009d6eb67 100644 --- a/epan/dissectors/packet-megaco.c +++ b/epan/dissectors/packet-megaco.c @@ -141,6 +141,9 @@ static int ett_megaco_h245 = -1; static gcp_hf_ett_t megaco_ctx_ids = {{-1,-1,-1,-1,-1,-1},{-1,-1,-1,-1}}; static expert_field ei_megaco_errored_command = EI_INIT; +static expert_field ei_megaco_error_descriptor_transaction_list = EI_INIT; +static expert_field ei_megaco_parse_error = EI_INIT; +static expert_field ei_megaco_audit_descriptor = EI_INIT; static dissector_handle_t megaco_text_handle; @@ -417,7 +420,7 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) tvb_previous_offset = tvb_find_guint8(tvb, 0, tvb_len, '/'); if (tvb_previous_offset == -1) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_megaco_parse_error, "Sorry, no \"/\" in the MEGACO header, I can't parse this packet"); return; } @@ -441,7 +444,7 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) tvb_current_offset = megaco_tvb_skip_wsp(tvb, tvb_previous_offset); if (tvb_previous_offset == tvb_current_offset) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_megaco_parse_error, "[ Parse error: missing SEP in MEGACO header ]"); return; } @@ -460,7 +463,7 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) tvb_current_offset = tvb_pbrk_guint8(tvb, tvb_current_offset, -1, " \t\r\n", &needle); if (tvb_current_offset == -1) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_megaco_parse_error, "[ Parse error: no body in MEGACO message (missing SEP after mId) ]"); return; } @@ -689,7 +692,7 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) break; default : ti = proto_tree_add_item(tree,proto_megaco,tvb, 0, -1, ENC_NA); - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_megaco_error_descriptor_transaction_list, "Sorry, can't understand errorDescriptor / transactionList = %s, can't parse it pos %u", tvb_format_text(tvb,tvb_previous_offset,2),tvb_previous_offset); return; @@ -724,7 +727,7 @@ nextcontext: tvb_transaction_end_offset, '=')+1; tvb_previous_offset = megaco_tvb_skip_wsp(tvb, tvb_previous_offset); if (tvb_current_offset >= tvb_next_offset) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, "[ Parse error: Invalid offset ]"); + expert_add_info_format_text(pinfo, ti, &ei_megaco_parse_error, "Parse error: Invalid offset"); return; } tvb_current_offset = tvb_next_offset; @@ -898,13 +901,13 @@ nextcontext: if ( tempchar == 'P' || tempchar == 'O'){ gint tvb_topology_end_offset = tvb_find_guint8(tvb, tvb_command_start_offset, tvb_transaction_end_offset, '}'); if ( tvb_topology_end_offset == -1 ){ - expert_add_info_format(pinfo, sub_ti, PI_MALFORMED, PI_ERROR, "[ Parse error: Missing \"}\" ]"); + expert_add_info_format_text(pinfo, sub_ti, &ei_megaco_parse_error, "Parse error: Missing \"}\""); return; } tvb_command_start_offset = tvb_find_guint8(tvb, tvb_command_start_offset, tvb_transaction_end_offset, '{'); if ( tvb_command_start_offset == -1 ){ - expert_add_info_format(pinfo, sub_ti, PI_MALFORMED, PI_ERROR, "[ Parse error: Missing \"{\" ]"); + expert_add_info_format_text(pinfo, sub_ti, &ei_megaco_parse_error, "Parse error: Missing \"{\""); return; } dissect_megaco_topologydescriptor(tvb, megaco_tree_command_line, tvb_topology_end_offset-1, tvb_command_start_offset+1); @@ -950,7 +953,7 @@ nextcontext: tvb_offset = tvb_find_guint8(tvb, tvb_command_start_offset, tvb_transaction_end_offset, '='); if (tvb_offset == -1 ) { - expert_add_info_format(pinfo, sub_ti, PI_MALFORMED, PI_ERROR, "[ Parse error: Missing \"=\" ]"); + expert_add_info_format_text(pinfo, sub_ti, &ei_megaco_parse_error, "Parse error: Missing \"=\""); return; } tvb_offset = megaco_tvb_skip_wsp_return(tvb, tvb_offset -1); @@ -1229,13 +1232,13 @@ nextcontext: tvb_offset = tvb_find_guint8(tvb, tvb_command_start_offset, tvb_transaction_end_offset, '='); if (tvb_offset == -1 ) { - expert_add_info_format(pinfo, sub_ti, PI_MALFORMED, PI_ERROR, "[ Parse error: Missing \"=\" ]"); + expert_add_info_format_text(pinfo, sub_ti, &ei_megaco_parse_error, "Parse error: Missing \"=\""); return; } tvb_offset = megaco_tvb_skip_wsp(tvb, tvb_offset+1); tokenlen = tvb_next_offset - tvb_offset; if (tokenlen+1 <= 0) { - expert_add_info_format(pinfo, sub_ti, PI_MALFORMED, PI_ERROR, "[ Parse error: Invalid token length (%d) ]", tokenlen+1); + expert_add_info_format_text(pinfo, sub_ti, &ei_megaco_parse_error, "Parse error: Invalid token length (%d)", tokenlen+1); return; } @@ -1251,7 +1254,7 @@ nextcontext: case 'E': if ((tokenlen+1 > (int) sizeof(TermID))) { - expert_add_info_format(pinfo, sub_ti, PI_MALFORMED, PI_ERROR, "[ Parse error: Invalid TermID length (%d) ]", tokenlen+1); + expert_add_info_format_text(pinfo, sub_ti, &ei_megaco_parse_error, "Parse error: Invalid TermID length (%d)", tokenlen+1); return; } tvb_get_nstringz0(tvb,tvb_offset,tokenlen+1,TermID); @@ -1448,7 +1451,7 @@ dissect_megaco_descriptors(tvbuff_t *tvb, proto_tree *megaco_tree_command_line, } if (tvb_current_offset <= tvb_previous_offset) { - expert_add_info_format(pinfo, megaco_tree_command_line, PI_MALFORMED, PI_ERROR, "[ Parse error: Invalid offset ]"); + expert_add_info_format_text(pinfo, megaco_tree_command_line, &ei_megaco_parse_error, "Parse error: Invalid offset"); return; } @@ -2225,7 +2228,7 @@ dissect_megaco_auditdescriptor(tvbuff_t *tvb, proto_tree *megaco_tree, packet_in tvb_next = tvb_find_guint8(tvb, tvb_offset, tvb_stop, '{'); /* find opening LBRKT - is this already checked by caller?*/ if( tvb_next == -1 ) /* complain and give up if not there */ { - expert_add_info_format(pinfo, megaco_tree, PI_MALFORMED, PI_ERROR, "Badly constructed audit descriptor (no { )"); + expert_add_info(pinfo, megaco_tree, &ei_megaco_audit_descriptor); return; } tokenlen = (tvb_stop + 1) - tvb_offset; @@ -2619,7 +2622,7 @@ dissect_megaco_observedeventsdescriptor(tvbuff_t *tvb, packet_info *pinfo, proto tvb_current_offset = tvb_observedevents_end_offset; } if (tvb_current_offset < tvb_previous_offset) { - expert_add_info_format(pinfo, megaco_observedevent_ti, PI_MALFORMED, PI_ERROR, "[ Parse error: Invalid offset ]"); + expert_add_info_format_text(pinfo, megaco_observedevent_ti, &ei_megaco_parse_error, "Parse error: Invalid offset"); return; } @@ -3534,6 +3537,9 @@ proto_register_megaco(void) static ei_register_info ei[] = { { &ei_megaco_errored_command, { "megaco.errored_command", PI_RESPONSE_CODE, PI_WARN, "Errored Command", EXPFILL }}, + { &ei_megaco_parse_error, { "megaco.parse_error", PI_MALFORMED, PI_ERROR, "Parse error", EXPFILL }}, + { &ei_megaco_error_descriptor_transaction_list, { "megaco.error_descriptor_transaction_list.invalid", PI_MALFORMED, PI_ERROR, "Sorry, can't understand errorDescriptor / transactionList", EXPFILL }}, + { &ei_megaco_audit_descriptor, { "megaco.audit.malformed", PI_MALFORMED, PI_ERROR, "Badly constructed audit descriptor (no { )", EXPFILL }}, }; module_t *megaco_module; |