diff options
author | Michael Mann <mmann78@netscape.net> | 2013-09-08 18:35:36 +0000 |
---|---|---|
committer | Michael Mann <mmann78@netscape.net> | 2013-09-08 18:35:36 +0000 |
commit | 15f1dd9b901bab65471669c622363baeac1050b8 (patch) | |
tree | 3aa64313f173aa7f927daa67a8487fbd9f61d780 /epan/show_exception.c | |
parent | f746c09862952bf4982d58364f346f8410fb0cc1 (diff) |
Convert malformed ("protocol") expert infos into something filterable. Not sure if "malformed.expert" is more confusing than helpful, but I didn't want it to share with the "malformed" display filter because their underlying types are different (FT_PROTOCOL vs FT_NONE). The ".expert" has been my convention when a condition already has a well-named hf_ display filter, but also has expert info associated with it.
Also removed the commented out calls to expert_add_info_format to avoid confusion, but left the comments noting the reason it's absent.
svn path=/trunk/; revision=51842
Diffstat (limited to 'epan/show_exception.c')
-rw-r--r-- | epan/show_exception.c | 32 |
1 files changed, 21 insertions, 11 deletions
diff --git a/epan/show_exception.c b/epan/show_exception.c index 3948437308..eddcdb755a 100644 --- a/epan/show_exception.c +++ b/epan/show_exception.c @@ -34,9 +34,21 @@ static int proto_short = -1; static int proto_malformed = -1; static int proto_unreassembled = -1; +static expert_field ei_malformed_dissector_bug = EI_INIT; +static expert_field ei_malformed_reassembly = EI_INIT; +static expert_field ei_malformed = EI_INIT; + void register_show_exception(void) { + static ei_register_info ei[] = { + { &ei_malformed_dissector_bug, { "malformed.dissector_bug", PI_MALFORMED, PI_ERROR, "Dissector bug", EXPFILL }}, + { &ei_malformed_reassembly, { "malformed.reassembly", PI_MALFORMED, PI_ERROR, "Reassembly error", EXPFILL }}, + { &ei_malformed, { "malformed.expert", PI_MALFORMED, PI_ERROR, "Malformed Packet (Exception occurred)", EXPFILL }}, + }; + + expert_module_t* expert_malformed; + proto_short = proto_register_protocol("Short Frame", "Short frame", "short"); proto_malformed = proto_register_protocol("Malformed Packet", "Malformed packet", "malformed"); @@ -44,6 +56,9 @@ register_show_exception(void) "Unreassembled Fragmented Packet", "Unreassembled fragmented packet", "unreassembled"); + expert_malformed = expert_register_protocol(proto_malformed); + expert_register_field_array(expert_malformed, ei, array_length(ei)); + /* "Short Frame", "Malformed Packet", and "Unreassembled Fragmented Packet" aren't really protocols, they're error indications; disabling them makes no sense. */ @@ -67,34 +82,31 @@ show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, case ScsiBoundsError: col_append_str(pinfo->cinfo, COL_INFO, "[SCSI transfer limited due to allocation_length too small]"); - /*item =*/ proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0, + proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0, "SCSI transfer limited due to allocation_length too small: %s truncated]", pinfo->current_proto); /* Don't record ScsiBoundsError exceptions as expert events - they merely * reflect a normal SCSI condition. * (any case where it's caused by something else is a bug). */ - /* expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Packet size limited");*/ break; case BoundsError: col_append_str(pinfo->cinfo, COL_INFO, "[Packet size limited during capture]"); - /*item =*/ proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0, + proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0, "[Packet size limited during capture: %s truncated]", pinfo->current_proto); /* Don't record BoundsError exceptions as expert events - they merely * reflect a capture done with a snapshot length too short to capture * all of the packet * (any case where it's caused by something else is a bug). */ - /* expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Packet size limited");*/ break; case FragmentBoundsError: col_append_fstr(pinfo->cinfo, COL_INFO, "[Unreassembled Packet%s]", pinfo->noreassembly_reason); - /*item =*/ proto_tree_add_protocol_format(tree, proto_unreassembled, + proto_tree_add_protocol_format(tree, proto_unreassembled, tvb, 0, 0, "[Unreassembled Packet%s: %s]", pinfo->noreassembly_reason, pinfo->current_proto); /* Don't record FragmentBoundsError exceptions as expert events - they merely * reflect dissection done with reassembly turned off * (any case where it's caused by something else is a bug). */ - /* expert_add_info_format(pinfo, item, PI_REASSEMBLE, PI_WARN, "Unreassembled Packet (Exception occured)");*/ break; case ReportedBoundsError: @@ -116,8 +128,7 @@ show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, pinfo->current_proto, pinfo->fd->num, exception_message == NULL ? dissector_error_nomsg : exception_message); - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "%s", + expert_add_info_format_text(pinfo, item, &ei_malformed_dissector_bug, "%s", exception_message == NULL ? dissector_error_nomsg : exception_message); break; @@ -133,8 +144,7 @@ show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, pinfo->current_proto, exception_message == NULL ? dissector_error_nomsg : exception_message); - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "%s", + expert_add_info_format_text(pinfo, item, &ei_malformed_reassembly, "%s", exception_message == NULL ? dissector_error_nomsg : exception_message); break; @@ -154,5 +164,5 @@ show_reported_bounds_error(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) "[Malformed Packet]"); item = proto_tree_add_protocol_format(tree, proto_malformed, tvb, 0, 0, "[Malformed Packet: %s]", pinfo->current_proto); - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Malformed Packet (Exception occurred)"); + expert_add_info(pinfo, item, &ei_malformed); } |