diff options
-rw-r--r-- | epan/dissectors/packet-cipsafety.c | 162 | ||||
-rw-r--r-- | epan/dissectors/packet-dhcp-failover.c | 50 | ||||
-rw-r--r-- | epan/dissectors/packet-enip.c | 38 | ||||
-rw-r--r-- | epan/dissectors/packet-icmpv6.c | 53 | ||||
-rw-r--r-- | epan/dissectors/packet-ip.c | 110 | ||||
-rw-r--r-- | epan/dissectors/packet-ipv6.c | 72 |
6 files changed, 316 insertions, 169 deletions
diff --git a/epan/dissectors/packet-cipsafety.c b/epan/dissectors/packet-cipsafety.c index 09f2eaa71a..7b6755eed2 100644 --- a/epan/dissectors/packet-cipsafety.c +++ b/epan/dissectors/packet-cipsafety.c @@ -287,6 +287,34 @@ static gint ett_svalidator_rrsc = -1; static gint ett_svalidator_cmd_data = -1; static gint ett_svalidator_type = -1; +static expert_field ei_cipsafety_tbd2_not_complemented = EI_INIT; +static expert_field ei_cipsafety_tbd_not_copied = EI_INIT; +static expert_field ei_cipsafety_run_idle_not_complemented = EI_INIT; +static expert_field ei_mal_io = EI_INIT; +static expert_field ei_mal_sercosiii_link_error_count_p1p2 = EI_INIT; +static expert_field ei_mal_tcpip_ssn = EI_INIT; + +static expert_field ei_mal_ssupervisor_exception_detail_alarm_ced = EI_INIT; +static expert_field ei_mal_ssupervisor_exception_detail_alarm_ded = EI_INIT; +static expert_field ei_mal_ssupervisor_exception_detail_alarm_med = EI_INIT; +static expert_field ei_mal_ssupervisor_detail_warning_ced = EI_INIT; +static expert_field ei_mal_ssupervisor_detail_warning_ded = EI_INIT; +static expert_field ei_mal_ssupervisor_detail_warning_med = EI_INIT; +static expert_field ei_mal_ssupervisor_configuration_unid = EI_INIT; +static expert_field ei_mal_ssupervisor_safety_configuration_id = EI_INIT; +static expert_field ei_mal_ssupervisor_target_unid = EI_INIT; +static expert_field ei_mal_ssupervisor_cp_owners = EI_INIT; +static expert_field ei_mal_ssupervisor_cp_owners_entry = EI_INIT; +static expert_field ei_mal_ssupervisor_cp_owners_app_path_size = EI_INIT; +static expert_field ei_mal_ssupervisor_proposed_tunid = EI_INIT; + +static expert_field ei_mal_svalidator_type = EI_INIT; +static expert_field ei_mal_svalidator_time_coord_msg_min_mult = EI_INIT; +static expert_field ei_mal_svalidator_network_time_multiplier = EI_INIT; +static expert_field ei_mal_svalidator_timeout_multiplier = EI_INIT; +static expert_field ei_mal_svalidator_coordination_conn_inst = EI_INIT; +static expert_field ei_mal_svalidator_prod_cons_fault_count = EI_INIT; + const value_string cipsafety_ssn_date_vals[8] = { { 0, "NULL SSN" }, @@ -744,8 +772,7 @@ static int dissect_s_supervisor_exception_detail_alarm(packet_info *pinfo, proto hf_cip_ssupervisor_exception_detail_alarm_ced_detail); if (size == 0) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 13 (Common Exception Detail)"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_exception_detail_alarm_ced); return total_len; } total_size += size; @@ -757,8 +784,7 @@ static int dissect_s_supervisor_exception_detail_alarm(packet_info *pinfo, proto hf_cip_ssupervisor_exception_detail_alarm_ded_detail); if (size == 0) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 13 (Device Exception Detail)"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_exception_detail_alarm_ded); return total_len; } total_size += size; @@ -770,8 +796,7 @@ static int dissect_s_supervisor_exception_detail_alarm(packet_info *pinfo, proto hf_cip_ssupervisor_exception_detail_alarm_med_detail); if (size == 0) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 13 (Manufacturer Exception Detail)"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_exception_detail_alarm_med); return total_len; } total_size += size; @@ -793,8 +818,7 @@ static int dissect_s_supervisor_exception_detail_warning(packet_info *pinfo, pro hf_cip_ssupervisor_exception_detail_warning_ced_detail); if (size == 0) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 14 (Common Exception Detail)"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_detail_warning_ced); return total_len; } total_size += size; @@ -806,8 +830,7 @@ static int dissect_s_supervisor_exception_detail_warning(packet_info *pinfo, pro hf_cip_ssupervisor_exception_detail_warning_ded_detail); if (size == 0) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 14 (Device Exception Detail)"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_detail_warning_ded); return total_len; } total_size += size; @@ -819,8 +842,7 @@ static int dissect_s_supervisor_exception_detail_warning(packet_info *pinfo, pro hf_cip_ssupervisor_exception_detail_warning_med_detail); if (size == 0) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 14 (Manufacturer Exception Detail)"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_detail_warning_med); return total_len; } total_size += size; @@ -833,8 +855,7 @@ static int dissect_s_supervisor_configuration_unid(packet_info *pinfo, proto_tre { if (total_len < 10) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 25"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_configuration_unid); return total_len; } @@ -853,8 +874,7 @@ static int dissect_s_supervisor_safety_configuration_id(packet_info *pinfo, prot { if (total_len < 10) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 26"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_safety_configuration_id); return total_len; } @@ -873,8 +893,7 @@ static int dissect_s_supervisor_target_unid(packet_info *pinfo, proto_tree *tree { if (total_len < 10) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 27"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_target_unid); return total_len; } @@ -898,8 +917,7 @@ static int dissect_s_supervisor_output_connection_point_owners(packet_info *pinf if (total_len < 2) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 28"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_cp_owners); return total_len; } @@ -916,7 +934,7 @@ static int dissect_s_supervisor_output_connection_point_owners(packet_info *pinf { if (total_len < attr_len+11) { - expert_add_info_format(pinfo, entry_item, PI_MALFORMED, PI_ERROR, "Malformed Safety Supervisor Attribute 28 (UNID)"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_cp_owners_entry); return total_len; } @@ -936,8 +954,7 @@ static int dissect_s_supervisor_output_connection_point_owners(packet_info *pinf if (total_len < attr_len+app_path_size) { - expert_add_info_format(pinfo, entry_item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 28 (EPATH)"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_cp_owners_app_path_size); return total_len; } @@ -956,8 +973,7 @@ static int dissect_s_supervisor_proposed_tunid(packet_info *pinfo, proto_tree *t { if (total_len < 10) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Supervisor Attribute 29"); + expert_add_info(pinfo, item, &ei_mal_ssupervisor_proposed_tunid); return total_len; } @@ -984,8 +1000,7 @@ static int dissect_s_validator_type(packet_info *pinfo, proto_tree *tree, proto_ if (total_len < 1) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Validator Attribute 2"); + expert_add_info(pinfo, item, &ei_mal_svalidator_type); return total_len; } @@ -1007,8 +1022,7 @@ static int dissect_s_validator_time_coord_msg_min_mult(packet_info *pinfo, proto if (total_len < size+1) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Validator Attribute 4"); + expert_add_info(pinfo, item, &ei_mal_svalidator_time_coord_msg_min_mult); return total_len; } @@ -1032,8 +1046,7 @@ static int dissect_s_validator_network_time_multiplier(packet_info *pinfo, proto if (total_len < size+1) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Validator Attribute 5"); + expert_add_info(pinfo, item, &ei_mal_svalidator_network_time_multiplier); return total_len; } @@ -1057,8 +1070,7 @@ static int dissect_s_validator_timeout_multiplier(packet_info *pinfo, proto_tree if (total_len < size+1) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Validator Attribute 6"); + expert_add_info(pinfo, item, &ei_mal_svalidator_timeout_multiplier); return total_len; } @@ -1082,8 +1094,7 @@ static int dissect_s_validator_coordination_conn_inst(packet_info *pinfo, proto_ if (total_len < size+1) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Validator Attribute 9"); + expert_add_info(pinfo, item, &ei_mal_svalidator_coordination_conn_inst); return total_len; } @@ -1114,8 +1125,7 @@ static int dissect_s_validator_prod_cons_fault_count(packet_info *pinfo, proto_t if (total_len < size+1) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed Safety Validator Attribute 15"); + expert_add_info(pinfo, item, &ei_mal_svalidator_prod_cons_fault_count); return total_len; } @@ -1389,15 +1399,15 @@ dissect_mode_byte( proto_tree *tree, tvbuff_t *tvb, int offset, packet_info *pin /* verify Mode Byte bits */ /* TBD */ if ((((mode_byte & 0x20) >> 5) & 0x01) == (((mode_byte & 0x04) >> 2) & 0x01)) - expert_add_info_format(pinfo, tbd_item, PI_PROTOCOL, PI_WARN, "TBD_2_bit not complemented"); + expert_add_info(pinfo, tbd_item, &ei_cipsafety_tbd2_not_complemented); /* TBD 2 */ if ((((mode_byte & 0x40) >> 6) & 0x01) != (((mode_byte & 0x08) >> 3) & 0x01)) - expert_add_info_format(pinfo, tbd2_item, PI_PROTOCOL, PI_WARN, "TBD bit not copied"); + expert_add_info(pinfo, tbd2_item, &ei_cipsafety_tbd_not_copied); /* Run/Idle */ if ((((mode_byte & 0x80) >> 7) & 0x01) == (((mode_byte & 0x10) >> 4) & 0x01)) - expert_add_info_format(pinfo, run_idle_item, PI_PROTOCOL, PI_WARN, "Run/Idle bit not complemented"); + expert_add_info(pinfo, run_idle_item, &ei_cipsafety_run_idle_not_complemented); } static void @@ -1521,8 +1531,7 @@ dissect_cip_safety_data( proto_tree *tree, proto_item *item, tvbuff_t *tvb, int if (item_length%2 == 1) { /* Malformed packet */ - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, - "Malformed CIP Safety I/O packet"); + expert_add_info(pinfo, item, &ei_mal_io); return; } @@ -1572,7 +1581,7 @@ dissect_cip_safety_data( proto_tree *tree, proto_item *item, tvbuff_t *tvb, int if (item_length%2 == 1) { /* Malformed packet */ - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Malformed CIP Safety I/O packet"); + expert_add_info(pinfo, item, &ei_mal_io); return; } @@ -1625,7 +1634,7 @@ static int dissect_sercosiii_link_error_count_p1p2(packet_info *pinfo, proto_tre { if (total_len < 4) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Malformed SERCOS III Attribute 5"); + expert_add_info(pinfo, item, &ei_mal_sercosiii_link_error_count_p1p2); return total_len; } @@ -1639,7 +1648,7 @@ static int dissect_tcpip_ssn(packet_info *pinfo, proto_tree *tree, proto_item *i { if (total_len < 6) { - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Object Attribute 7"); + expert_add_info(pinfo, item, &ei_mal_tcpip_ssn); return total_len; } @@ -2520,10 +2529,69 @@ proto_register_cipsafety(void) &ett_svalidator_type }; + static ei_register_info ei[] = { + { &ei_cipsafety_tbd2_not_complemented, { "cipsafety.tbd2_not_complemented", PI_PROTOCOL, PI_WARN, "TBD_2_bit not complemented", EXPFILL }}, + { &ei_cipsafety_tbd_not_copied, { "cipsafety.tbd_not_copied", PI_PROTOCOL, PI_WARN, "TBD bit not copied", EXPFILL }}, + { &ei_cipsafety_run_idle_not_complemented, { "cipsafety.run_idle_not_complemented", PI_PROTOCOL, PI_WARN, "Run/Idle bit not complemented", EXPFILL }}, + { &ei_mal_io, { "cipsafety.malformed.io", PI_MALFORMED, PI_ERROR, "Malformed CIP Safety I/O packet", EXPFILL }}, + { &ei_mal_sercosiii_link_error_count_p1p2, { "cipsafety.malformed.sercosiii_link.error_count_p1p2", PI_MALFORMED, PI_ERROR, "Malformed SERCOS III Attribute 5", EXPFILL }}, + { &ei_mal_tcpip_ssn, { "cip.malformed.tcpip.ssn", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Object Safety Network Number", EXPFILL }}, + }; + + static ei_register_info ei_ssupervisor[] = { + { &ei_mal_ssupervisor_exception_detail_alarm_ced, { "cipsafety.ssupervisor.malformed.exception_detail_alarm.ced", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Exception Detail Alarm (Common Exception Detail)", EXPFILL }}, + { &ei_mal_ssupervisor_exception_detail_alarm_ded, { "cipsafety.ssupervisor.malformed.exception_detail_alarm.ded", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Exception Detail Alarm (Device Exception Detail)", EXPFILL }}, + { &ei_mal_ssupervisor_exception_detail_alarm_med, { "cipsafety.ssupervisor.malformed.exception_detail_alarm.med", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Exception Detail Alarm (Manufacturer Exception Detail)", EXPFILL }}, + { &ei_mal_ssupervisor_detail_warning_ced, { "cipsafety.ssupervisor.malformed.detail_warning.ced", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Exception Detail Warning (Common Exception Detail)", EXPFILL }}, + { &ei_mal_ssupervisor_detail_warning_ded, { "cipsafety.ssupervisor.malformed.detail_warning.ded", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Exception Detail Warning (Device Exception Detail)", EXPFILL }}, + { &ei_mal_ssupervisor_detail_warning_med, { "cipsafety.ssupervisor.malformed.detail_warning.med", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Exception Detail Warning (Manufacturer Exception Detail)", EXPFILL }}, + { &ei_mal_ssupervisor_configuration_unid, { "cipsafety.ssupervisor.malformed.configuration_unid", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Configuration UNID", EXPFILL }}, + { &ei_mal_ssupervisor_safety_configuration_id, { "cipsafety.ssupervisor.malformed.safety_configuration_id", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Safety Configuration Identifier", EXPFILL }}, + { &ei_mal_ssupervisor_target_unid, { "cipsafety.ssupervisor.malformed.target_unid", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Target UNID", EXPFILL }}, + { &ei_mal_ssupervisor_cp_owners, { "cipsafety.ssupervisor.malformed.cp_owners", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Output Connection Point Owners", EXPFILL }}, + { &ei_mal_ssupervisor_cp_owners_entry, { "cipsafety.ssupervisor.malformed.cp_owners.entry", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Output Connection Point Owners (UNID)", EXPFILL }}, + { &ei_mal_ssupervisor_cp_owners_app_path_size, { "cipsafety.ssupervisor.malformed.cp_owners.app_path_size", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Output Connection Point Owners (EPATH)", EXPFILL }}, + { &ei_mal_ssupervisor_proposed_tunid, { "cipsafety.ssupervisor.malformed.proposed_tunid", PI_MALFORMED, PI_ERROR, + "Malformed Safety Supervisor Proposed TUNID", EXPFILL }}, + }; + + static ei_register_info ei_svalidator[] = { + { &ei_mal_svalidator_type, { "cipsafety.ssupervisor.malformed.svalidator.type", PI_MALFORMED, PI_ERROR, + "Malformed Safety Validator Type", EXPFILL }}, + { &ei_mal_svalidator_time_coord_msg_min_mult, { "cipsafety.ssupervisor.malformed.svalidator.time_coord_msg_min_mult", PI_MALFORMED, PI_ERROR, + "Malformed Safety Validator Time Coord Msg Min Multiplier", EXPFILL }}, + { &ei_mal_svalidator_network_time_multiplier, { "cipsafety.ssupervisor.malformed.svalidator.network_time_multiplier", PI_MALFORMED, PI_ERROR, + "Malformed Safety Validator Network Time Expectation Multiplier", EXPFILL }}, + { &ei_mal_svalidator_timeout_multiplier, { "cipsafety.ssupervisor.malformed.svalidator.timeout_multiplier", PI_MALFORMED, PI_ERROR, + "Malformed Safety Validator Timeout Multiplier", EXPFILL }}, + { &ei_mal_svalidator_coordination_conn_inst, { "cipsafety.ssupervisor.malformed.svalidator.coordination_conn_inst", PI_MALFORMED, PI_ERROR, + "Malformed Safety Validator Coordination Connection Instance", EXPFILL }}, + { &ei_mal_svalidator_prod_cons_fault_count, { "cipsafety.ssupervisor.malformed.svalidator.prod_cons_fault_count", PI_MALFORMED, PI_ERROR, + "Malformed Safety Validator Produce/Consume Fault Counters", EXPFILL }}, + }; + + expert_module_t* expert_cip_safety; + expert_module_t* expert_cip_class_s_supervisor; + expert_module_t* expert_cip_class_s_validator; + /* Create a CIP Safety protocol handle */ proto_cipsafety = proto_register_protocol("Common Industrial Protocol, Safety", "CIP Safety", "cipsafety"); proto_register_field_array(proto_cipsafety, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_cip_safety = expert_register_protocol(proto_cipsafety); + expert_register_field_array(expert_cip_safety, ei, array_length(ei)); register_dissector( "cipsafety", dissect_cipsafety, proto_cipsafety); @@ -2532,11 +2600,15 @@ proto_register_cipsafety(void) "CIPSSupervisor", "cipssupervisor"); proto_register_field_array(proto_cip_class_s_supervisor, hf_ssupervisor, array_length(hf_ssupervisor)); proto_register_subtree_array(ett_ssupervisor, array_length(ett_ssupervisor)); + expert_cip_class_s_supervisor = expert_register_protocol(proto_cip_class_s_supervisor); + expert_register_field_array(expert_cip_class_s_supervisor, ei_ssupervisor, array_length(ei_ssupervisor)); proto_cip_class_s_validator = proto_register_protocol("CIP Safety Validator", "CIPSValidator", "cipsvalidator"); proto_register_field_array(proto_cip_class_s_validator, hf_svalidator, array_length(hf_svalidator)); proto_register_subtree_array(ett_svalidator, array_length(ett_svalidator)); + expert_cip_class_s_validator = expert_register_protocol(proto_cip_class_s_validator); + expert_register_field_array(expert_cip_class_s_validator, ei_svalidator, array_length(ei_svalidator)); } /* diff --git a/epan/dissectors/packet-dhcp-failover.c b/epan/dissectors/packet-dhcp-failover.c index 69156c302f..e19fcf131f 100644 --- a/epan/dissectors/packet-dhcp-failover.c +++ b/epan/dissectors/packet-dhcp-failover.c @@ -101,6 +101,10 @@ static gint ett_dhcpfo = -1; static gint ett_fo_payload = -1; static gint ett_fo_option = -1; +static expert_field ei_dhcpfo_bad_length = EI_INIT; +static expert_field ei_dhcpfo_message_digest_type_not_allowed = EI_INIT; + + /* Length of fixed-length portion of header */ #define DHCPFO_FL_HDR_LEN 12 @@ -524,7 +528,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_ASSIGNED_IP_ADDRESS: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "assigned ip address is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "assigned ip address is not 4 bytes long"); break; } proto_item_append_text(oi, ", %s ", tvb_ip_to_str(tvb, offset)); @@ -536,7 +540,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_SENDING_SERVER_IP_ADDRESS: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "sending server ip address is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "sending server ip address is not 4 bytes long"); break; } @@ -549,7 +553,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_ADDRESSES_TRANSFERED: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "addresses transferred is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "addresses transferred is not 4 bytes long"); break; } @@ -574,7 +578,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_CLIENT_HARDWARE_ADDRESS: if (option_length < 2) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "hardware address is too short"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "hardware address is too short"); break; } htype = tvb_get_guint8(tvb, offset); @@ -597,7 +601,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_REJECT_REASON: if (option_length != 1) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Reject reason is not 1 byte long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Reject reason is not 1 byte long"); break; } reject_reason = tvb_get_guint8(tvb, offset); @@ -619,7 +623,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_MCLT: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "MCLT is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "MCLT is not 4 bytes long"); break; } mclt = tvb_get_ntohl(tvb, offset); @@ -640,7 +644,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_LEASE_EXPIRATION_TIME: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Lease expiration time is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Lease expiration time is not 4 bytes long"); break; } lease_expiration_time = @@ -661,7 +665,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_POTENTIAL_EXPIRATION_TIME: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Potential expiration time is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Potential expiration time is not 4 bytes long"); break; } potential_expiration_time = @@ -683,7 +687,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_GRACE_EXPIRATION_TIME: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Grace expiration time is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Grace expiration time is not 4 bytes long"); break; } grace_expiration_time = @@ -705,7 +709,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_CLIENT_LAST_TRANSACTION_TIME: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Last transaction time is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Last transaction time is not 4 bytes long"); break; } client_last_transaction_time = @@ -726,7 +730,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_START_TIME_OF_STATE: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Start time of state is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Start time of state is not 4 bytes long"); break; } start_time_of_state = @@ -747,7 +751,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_SERVERSTATE: if (option_length != 1) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "server status is not 1 byte long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "server status is not 1 byte long"); break; } server_state = tvb_get_guint8(tvb, offset); @@ -764,7 +768,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_SERVERFLAG: if (option_length != 1) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Serverflag is not 1 byte long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Serverflag is not 1 byte long"); break; } serverflag = tvb_get_guint8(tvb, offset); @@ -782,7 +786,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_MAX_UNACKED_BNDUPD: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Max unacked BNDUPD is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Max unacked BNDUPD is not 4 bytes long"); break; } max_unacked_bndupd = tvb_get_ntohl(tvb, offset); @@ -795,7 +799,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_RECEIVE_TIMER: if (option_length != 4) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Receive timer is not 4 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Receive timer is not 4 bytes long"); break; } receive_timer = tvb_get_ntohl(tvb, offset); @@ -817,7 +821,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_MESSAGE_DIGEST: if (option_length < 2) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Message digest is too short"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Message digest is too short"); break; } @@ -828,7 +832,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) proto_item_append_text(oi, ", HMAC-MD5"); } else { proto_item_append_text(oi, ", type not allowed"); - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Message digest type: %u, not allowed", message_digest_type); + expert_add_info_format_text(pinfo, ti, &ei_dhcpfo_message_digest_type_not_allowed, "Message digest type: %u, not allowed", message_digest_type); } proto_tree_add_item(option_tree, @@ -838,7 +842,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_PROTOCOL_VERSION: if (option_length != 1) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "Protocol version is not 1 byte long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "Protocol version is not 1 byte long"); break; } proto_item_append_text(oi, ", version: %u", tvb_get_guint8(tvb, offset)); @@ -847,7 +851,7 @@ dissect_dhcpfo_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) case DHCP_FO_PD_TLS_REQUEST: if (option_length != 2) { - expert_add_info_format(pinfo, oi, PI_PROTOCOL, PI_WARN, "TLS request is not 2 bytes long"); + expert_add_info_format_text(pinfo, oi, &ei_dhcpfo_bad_length, "TLS request is not 2 bytes long"); break; } tls_request = tvb_get_ntohs(tvb, offset); @@ -1117,7 +1121,13 @@ proto_register_dhcpfo(void) &ett_fo_option, }; + static ei_register_info ei[] = { + { &ei_dhcpfo_bad_length, { "dhcpfo.bad_length", PI_PROTOCOL, PI_WARN, "Bad length", EXPFILL }}, + { &ei_dhcpfo_message_digest_type_not_allowed, { "dhcpfo.message_digest_type_not_allowed", PI_PROTOCOL, PI_WARN, "Message digest type not allowed", EXPFILL }}, + }; + module_t *dhcpfo_module; + expert_module_t* expert_dhcpfo; /* Register the protocol name and description */ proto_dhcpfo = proto_register_protocol("DHCP Failover", "DHCPFO", @@ -1126,6 +1136,8 @@ proto_register_dhcpfo(void) /* Required function calls to register the header fields and subtrees used */ proto_register_field_array(proto_dhcpfo, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_dhcpfo = expert_register_protocol(proto_dhcpfo); + expert_register_field_array(expert_dhcpfo, ei, array_length(ei)); dhcpfo_module = prefs_register_protocol(proto_dhcpfo, proto_reg_handoff_dhcpfo); prefs_register_uint_preference(dhcpfo_module, "tcp_port", diff --git a/epan/dissectors/packet-enip.c b/epan/dissectors/packet-enip.c index c613db9036..88d1a9d63b 100644 --- a/epan/dissectors/packet-enip.c +++ b/epan/dissectors/packet-enip.c @@ -3296,25 +3296,25 @@ proto_register_enip(void) }; static ei_register_info ei[] = { - { &ei_mal_tcpip_status, { "cip.malformed.tcpip.status", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Attribute 1", EXPFILL }}, - { &ei_mal_tcpip_config_cap, { "cip.malformed.tcpip.config_cap", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Attribute 2", EXPFILL }}, - { &ei_mal_tcpip_config_control, { "cip.malformed.tcpip.config_control", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Attribute 3", EXPFILL }}, - { &ei_mal_tcpip_physical_link_size, { "cip.malformed.tcpip.physical_link_size", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Attribute 4", EXPFILL }}, - { &ei_mal_tcpip_interface_config, { "cip.malformed.tcpip.interface_config", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Attribute 5", EXPFILL }}, - { &ei_mal_tcpip_mcast_config, { "cip.malformed.tcpip.mcast_config", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Attribute 9", EXPFILL }}, - { &ei_mal_tcpip_last_conflict, { "cip.malformed.tcpip.last_conflict", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Attribute 11", EXPFILL }}, - { &ei_mal_elink_interface_flags, { "cip.malformed.elink.interface_flags", PI_MALFORMED, PI_ERROR, "Malformed Ethernet Link Attribute 2", EXPFILL }}, - { &ei_mal_elink_interface_counters, { "cip.malformed.elink.interface_counters", PI_MALFORMED, PI_ERROR, "Malformed Ethernet Link Attribute 4", EXPFILL }}, - { &ei_mal_elink_media_counters, { "cip.malformed.elink.media_counters", PI_MALFORMED, PI_ERROR, "Malformed Ethernet Link Attribute 5", EXPFILL }}, - { &ei_mal_elink_interface_control, { "cip.malformed.elink.interface_control", PI_MALFORMED, PI_ERROR, "Malformed Ethernet Link Attribute 6", EXPFILL }}, - { &ei_mal_dlr_ring_supervisor_config, { "cip.malformed.dlr.ring_supervisor_config", PI_MALFORMED, PI_ERROR, "Malformed DLR Attribute 4", EXPFILL }}, - { &ei_mal_dlr_last_active_node_on_port_1, { "cip.malformed.dlr.last_active_node_on_port_1", PI_MALFORMED, PI_ERROR, "Malformed DLR Attribute 6", EXPFILL }}, - { &ei_mal_dlr_last_active_node_on_port_2, { "cip.malformed.dlr.last_active_node_on_port_2", PI_MALFORMED, PI_ERROR, "Malformed DLR Attribute 7", EXPFILL }}, - { &ei_mal_dlr_ring_protocol_participants_list, { "cip.malformed.dlr.ring_protocol_participants_list", PI_MALFORMED, PI_ERROR, "Malformed DLR Attribute 9", EXPFILL }}, - { &ei_mal_dlr_active_supervisor_address, { "cip.malformed.dlr.active_supervisor_address", PI_MALFORMED, PI_ERROR, "Malformed DLR Attribute 10", EXPFILL }}, - { &ei_mal_dlr_capability_flags, { "cip.malformed.dlr.capability_flags", PI_MALFORMED, PI_ERROR, "Malformed DLR Attribute 12", EXPFILL }}, - { &ei_mal_dlr_redundant_gateway_config, { "cip.malformed.dlr.redundant_gateway_config", PI_MALFORMED, PI_ERROR, "Malformed DLR Attribute 13", EXPFILL }}, - { &ei_mal_dlr_active_gateway_address, { "cip.malformed.dlr.active_gateway_address", PI_MALFORMED, PI_ERROR, "Malformed DLR Attribute 15", EXPFILL }}, + { &ei_mal_tcpip_status, { "cip.malformed.tcpip.status", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Status", EXPFILL }}, + { &ei_mal_tcpip_config_cap, { "cip.malformed.tcpip.config_cap", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Configuration Capability", EXPFILL }}, + { &ei_mal_tcpip_config_control, { "cip.malformed.tcpip.config_control", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Configuration Control", EXPFILL }}, + { &ei_mal_tcpip_physical_link_size, { "cip.malformed.tcpip.physical_link_size", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Physical Link Object", EXPFILL }}, + { &ei_mal_tcpip_interface_config, { "cip.malformed.tcpip.interface_config", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Interface Configuration", EXPFILL }}, + { &ei_mal_tcpip_mcast_config, { "cip.malformed.tcpip.mcast_config", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Multicast Config", EXPFILL }}, + { &ei_mal_tcpip_last_conflict, { "cip.malformed.tcpip.last_conflict", PI_MALFORMED, PI_ERROR, "Malformed TCP/IP Last Conflict Detected", EXPFILL }}, + { &ei_mal_elink_interface_flags, { "cip.malformed.elink.interface_flags", PI_MALFORMED, PI_ERROR, "Malformed Ethernet Link Interface Flags", EXPFILL }}, + { &ei_mal_elink_interface_counters, { "cip.malformed.elink.interface_counters", PI_MALFORMED, PI_ERROR, "Malformed Ethernet Link Interface Counters", EXPFILL }}, + { &ei_mal_elink_media_counters, { "cip.malformed.elink.media_counters", PI_MALFORMED, PI_ERROR, "Malformed Ethernet Link Media Counters", EXPFILL }}, + { &ei_mal_elink_interface_control, { "cip.malformed.elink.interface_control", PI_MALFORMED, PI_ERROR, "Malformed Ethernet Link Interface Control", EXPFILL }}, + { &ei_mal_dlr_ring_supervisor_config, { "cip.malformed.dlr.ring_supervisor_config", PI_MALFORMED, PI_ERROR, "Malformed DLR Ring Supervisor Config", EXPFILL }}, + { &ei_mal_dlr_last_active_node_on_port_1, { "cip.malformed.dlr.last_active_node_on_port_1", PI_MALFORMED, PI_ERROR, "Malformed DLR Last Active Node on Port 1", EXPFILL }}, + { &ei_mal_dlr_last_active_node_on_port_2, { "cip.malformed.dlr.last_active_node_on_port_2", PI_MALFORMED, PI_ERROR, "Malformed DLR Last Active Node on Port 2", EXPFILL }}, + { &ei_mal_dlr_ring_protocol_participants_list, { "cip.malformed.dlr.ring_protocol_participants_list", PI_MALFORMED, PI_ERROR, "Malformed DLR Ring Protocol Participants List", EXPFILL }}, + { &ei_mal_dlr_active_supervisor_address, { "cip.malformed.dlr.active_supervisor_address", PI_MALFORMED, PI_ERROR, "Malformed DLR Active Supervisor Address", EXPFILL }}, + { &ei_mal_dlr_capability_flags, { "cip.malformed.dlr.capability_flags", PI_MALFORMED, PI_ERROR, "Malformed DLR Capability Flag", EXPFILL }}, + { &ei_mal_dlr_redundant_gateway_config, { "cip.malformed.dlr.redundant_gateway_config", PI_MALFORMED, PI_ERROR, "Malformed DLR Redundant Gateway Config", EXPFILL }}, + { &ei_mal_dlr_active_gateway_address, { "cip.malformed.dlr.active_gateway_address", PI_MALFORMED, PI_ERROR, "Malformed DLR Active Gateway Address", EXPFILL }}, }; /* Setup list of header fields for DLR See Section 1.6.1 for details*/ diff --git a/epan/dissectors/packet-icmpv6.c b/epan/dissectors/packet-icmpv6.c index 080753a9c3..3547262e4b 100644 --- a/epan/dissectors/packet-icmpv6.c +++ b/epan/dissectors/packet-icmpv6.c @@ -506,6 +506,16 @@ static gint ett_icmpv6_flag_rpl_cc = -1; static gint ett_icmpv6_opt_name = -1; static gint ett_icmpv6_cga_param_name = -1; +static expert_field ei_icmpv6_invalid_option_length = EI_INIT; +static expert_field ei_icmpv6_undecoded_option = EI_INIT; +static expert_field ei_icmpv6_unknown_data = EI_INIT; +static expert_field ei_icmpv6_undecoded_rpl_option = EI_INIT; +static expert_field ei_icmpv6_undecoded_type = EI_INIT; +static expert_field ei_icmpv6_rr_pco_mp_matchlen = EI_INIT; +static expert_field ei_icmpv6_rr_pco_mp_matchedlen = EI_INIT; +static expert_field ei_icmpv6_checksum = EI_INIT; + + static dissector_handle_t ipv6_handle; static dissector_handle_t data_handle; @@ -1317,7 +1327,7 @@ dissect_icmpv6_nd_opt(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree proto_item_append_text(ti_opt_len, " (%i bytes)", opt_len); if(opt_len == 0){ - expert_add_info_format(pinfo, ti_opt_len, PI_MALFORMED, PI_ERROR, "Invalid option length (Zero)"); + expert_add_info_format_text(pinfo, ti_opt_len, &ei_icmpv6_invalid_option_length, "Invalid option length (Zero)"); return opt_offset; } @@ -1856,7 +1866,7 @@ dissect_icmpv6_nd_opt(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree opt_offset += 16; break; default: - expert_add_info_format(pinfo, ti_opt_len, PI_MALFORMED, PI_ERROR, "Invalid Option Length"); + expert_add_info(pinfo, ti_opt_len, &ei_icmpv6_invalid_option_length); break; } break; @@ -2154,7 +2164,7 @@ dissect_icmpv6_nd_opt(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree opt_offset += 16; break; default: - expert_add_info_format(pinfo, ti_opt_len, PI_MALFORMED, PI_ERROR, "Invalid Option Length"); + expert_add_info(pinfo, ti_opt_len, &ei_icmpv6_invalid_option_length); break; } /* Update the 6LoWPAN dissectors with new context information. */ @@ -2193,7 +2203,7 @@ dissect_icmpv6_nd_opt(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree break; default : - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_NOTE, + expert_add_info_format_text(pinfo, ti, &ei_icmpv6_undecoded_option, "Dissector for ICMPv6 Option (%d)" " code not implemented, Contact Wireshark developers" " if you want this supported", opt_type); @@ -2207,7 +2217,7 @@ dissect_icmpv6_nd_opt(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree if(offset > opt_offset){ ti_opt = proto_tree_add_item(icmp6opt_tree, hf_icmpv6_unknown_data, tvb, opt_offset, offset - opt_offset, ENC_NA); - expert_add_info_format(pinfo, ti_opt, PI_MALFORMED, PI_ERROR, "Unknown Data (not interpreted)"); + expert_add_info(pinfo, ti_opt, &ei_icmpv6_unknown_data); } /* Close the ) to option root label */ proto_item_append_text(ti, ")"); @@ -2314,7 +2324,7 @@ dissect_icmpv6_rpl_opt(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree opt_offset += 16; break; default: - expert_add_info_format(pinfo, ti_opt_len, PI_MALFORMED, PI_ERROR, "Invalid Option Length"); + expert_add_info(pinfo, ti_opt_len, &ei_icmpv6_invalid_option_length); break; } break; @@ -2399,7 +2409,7 @@ dissect_icmpv6_rpl_opt(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree opt_offset += 16; break; default: - expert_add_info_format(pinfo, ti_opt_len, PI_MALFORMED, PI_ERROR, "Invalid Option Length"); + expert_add_info(pinfo, ti_opt_len, &ei_icmpv6_invalid_option_length); break; } break; @@ -2522,7 +2532,7 @@ dissect_icmpv6_rpl_opt(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree break; } default : - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_NOTE, + expert_add_info_format_text(pinfo, ti, &ei_icmpv6_undecoded_rpl_option, "Dissector for ICMPv6 RPL Option" " (%d) code not implemented, Contact" " Wireshark developers if you want this supported", opt_type); @@ -2535,7 +2545,7 @@ dissect_icmpv6_rpl_opt(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree if(offset > opt_offset){ ti_opt = proto_tree_add_item(icmp6opt_tree, hf_icmpv6_unknown_data, tvb, opt_offset, offset - opt_offset, ENC_NA); - expert_add_info_format(pinfo, ti_opt, PI_MALFORMED, PI_ERROR, "Unknown Data (not interpreted)"); + expert_add_info(pinfo, ti_opt, &ei_icmpv6_unknown_data); } /* Close the ) to option root label */ @@ -2960,8 +2970,7 @@ dissect_rrenum(tvbuff_t *tvb, int rr_offset, packet_info *pinfo _U_, proto_tree proto_tree_add_item(mp_tree, hf_icmpv6_rr_pco_mp_matchlen, tvb, rr_offset, 1, ENC_BIG_ENDIAN); matchlen = tvb_get_guint8(tvb, rr_offset); if (matchlen > 128) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, - "MatchLen is greater than 128"); + expert_add_info(pinfo, ti, &ei_icmpv6_rr_pco_mp_matchlen); } rr_offset += 1; @@ -3082,8 +3091,7 @@ dissect_rrenum(tvbuff_t *tvb, int rr_offset, packet_info *pinfo _U_, proto_tree ti = proto_tree_add_item(rm_tree, hf_icmpv6_rr_rm_matchedlen, tvb, rr_offset, 1, ENC_BIG_ENDIAN); matchlen = tvb_get_guint8(tvb, rr_offset); if (matchlen > 128) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, - "MatchedLen is greater than 128"); + expert_add_info(pinfo, ti, &ei_icmpv6_rr_pco_mp_matchedlen); } rr_offset +=1; @@ -3279,7 +3287,7 @@ dissect_icmpv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _ hidden_item = proto_tree_add_boolean(icmp6_tree, hf_icmpv6_checksum_bad, tvb, offset, 2, TRUE); PROTO_ITEM_SET_HIDDEN(hidden_item); proto_item_append_text(checksum_item, " [incorrect, should be 0x%04x]", in_cksum_shouldbe(cksum, computed_cksum)); - expert_add_info_format(pinfo, checksum_item, PI_CHECKSUM, PI_WARN, + expert_add_info_format_text(pinfo, checksum_item, &ei_icmpv6_checksum, "ICMPv6 Checksum Incorrect, should be 0x%04x", in_cksum_shouldbe(cksum, computed_cksum)); } } @@ -3798,7 +3806,7 @@ dissect_icmpv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _ break; } default: - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_NOTE, + expert_add_info_format_text(pinfo, ti, &ei_icmpv6_undecoded_type, "Dissector for ICMPv6 Type (%d)" " code not implemented, Contact Wireshark" " developers if you want this supported", icmp6_type); @@ -4910,10 +4918,25 @@ proto_register_icmpv6(void) &ett_icmpv6_cga_param_name }; + static ei_register_info ei[] = { + { &ei_icmpv6_invalid_option_length, { "icmpv6.invalid_option_length", PI_MALFORMED, PI_ERROR, "Invalid Option Length", EXPFILL }}, + { &ei_icmpv6_undecoded_option, { "icmpv6.undecoded.option", PI_UNDECODED, PI_NOTE, "Undecoded option", EXPFILL }}, + { &ei_icmpv6_unknown_data, { "icmpv6.unknown_data.expert", PI_MALFORMED, PI_ERROR, "Unknown Data (not interpreted)", EXPFILL }}, + { &ei_icmpv6_undecoded_rpl_option, { "icmpv6.undecoded.rpl_option", PI_UNDECODED, PI_NOTE, "Undecoded RPL Option", EXPFILL }}, + { &ei_icmpv6_undecoded_type, { "icmpv6.undecoded.type", PI_UNDECODED, PI_NOTE, "Undecoded type", EXPFILL }}, + { &ei_icmpv6_rr_pco_mp_matchlen, { "icmpv6.rr.pco.mp.matchlen.gt128", PI_PROTOCOL, PI_WARN, "MatchLen is greater than 128", EXPFILL }}, + { &ei_icmpv6_rr_pco_mp_matchedlen, { "icmpv6.rr.pco.mp.matchedlen.gt128", PI_PROTOCOL, PI_WARN, "MatchedLen is greater than 128", EXPFILL }}, + { &ei_icmpv6_checksum, { "icmpv6.checksum_bad.expert", PI_CHECKSUM, PI_WARN, "Bad checksum", EXPFILL }}, + }; + + expert_module_t* expert_icmpv6; + proto_icmpv6 = proto_register_protocol("Internet Control Message Protocol v6", "ICMPv6", "icmpv6"); proto_register_field_array(proto_icmpv6, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_icmpv6 = expert_register_protocol(proto_icmpv6); + expert_register_field_array(expert_icmpv6, ei, array_length(ei)); new_register_dissector("icmpv6", dissect_icmpv6, proto_icmpv6); icmpv6_tap = register_tap("icmpv6"); diff --git a/epan/dissectors/packet-ip.c b/epan/dissectors/packet-ip.c index 30d6c31ac6..1022e60ee1 100644 --- a/epan/dissectors/packet-ip.c +++ b/epan/dissectors/packet-ip.c @@ -226,6 +226,20 @@ static gint ett_ip_checksum = -1; static gint ett_ip_opt_type = -1; static gint ett_ip_opt_sec_prot_auth_flags = -1; +static expert_field ei_ip_opt_len_invalid = EI_INIT; +static expert_field ei_ip_opt_sec_prot_auth_fti = EI_INIT; +static expert_field ei_ip_extraneous_data = EI_INIT; +static expert_field ei_ip_opt_ptr_before_address = EI_INIT; +static expert_field ei_ip_opt_ptr_middle_address = EI_INIT; +static expert_field ei_ip_subopt_too_long = EI_INIT; +static expert_field ei_ip_nop = EI_INIT; +static expert_field ei_ip_bogus_ip_length = EI_INIT; +static expert_field ei_ip_evil_packet = EI_INIT; +static expert_field ei_ip_checksum_bad = EI_INIT; +static expert_field ei_ip_ttl_lncb = EI_INIT; +static expert_field ei_ip_ttl_too_small = EI_INIT; + + #ifdef HAVE_GEOIP static gint ett_geoip_info = -1; #endif /* HAVE_GEOIP */ @@ -747,8 +761,7 @@ dissect_ipopt_security(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, curr_offset++; tf_sub = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, curr_offset, 1, ENC_NA); if (optlen > IPOLEN_MAX) - expert_add_info_format(pinfo, tf_sub, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf_sub, &ei_ip_opt_len_invalid); curr_offset++; if (optlen == 11) { @@ -785,8 +798,7 @@ dissect_ipopt_security(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, curr_offset++; while (val & 0x01) { if ((val & 0x01) && ((curr_offset - offset) == optlen)) { - expert_add_info_format(pinfo, tf_sub, PI_PROTOCOL, PI_WARN, - "Field Termination Indicator set to 1 for last byte of option"); + expert_add_info(pinfo, tf_sub, &ei_ip_opt_sec_prot_auth_fti); break; } val = tvb_get_guint8(tvb, curr_offset); @@ -796,8 +808,7 @@ dissect_ipopt_security(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, curr_offset++; } if ((curr_offset - offset) < optlen) { - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Extraneous data in option"); + expert_add_info(pinfo, tf, &ei_ip_extraneous_data); } } @@ -819,8 +830,7 @@ dissect_ipopt_ext_security(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, curr_offset++; tf_sub = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, curr_offset, 1, ENC_NA); if (optlen > IPOLEN_MAX) - expert_add_info_format(pinfo, tf_sub, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf_sub, &ei_ip_opt_len_invalid); curr_offset++; proto_tree_add_item(field_tree, hf_ip_opt_ext_sec_add_sec_info_format_code, tvb, curr_offset, 1, ENC_BIG_ENDIAN); curr_offset++; @@ -857,8 +867,7 @@ dissect_ipopt_cipso(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, dissect_ipopt_type(tvb, offset, field_tree); tf = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, offset + 1, 1, ENC_NA); if (optlen > IPOLEN_MAX) - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf, &ei_ip_opt_len_invalid); offset += 2; @@ -1119,18 +1128,15 @@ dissect_ipopt_route(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, dissect_ipopt_type(tvb, offset, field_tree); tf = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, offset + 1, 1, ENC_NA); if (optlen > IPOLEN_MAX) - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf, &ei_ip_opt_len_invalid); ptr = tvb_get_guint8(tvb, offset + 2); tf = proto_tree_add_item(field_tree, hf_ip_opt_ptr, tvb, offset + 2, 1, ENC_NA); if ((ptr < (optp->optlen + 1)) || (ptr & 3)) { if (ptr < (optp->optlen + 1)) { - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Pointer points before first address"); + expert_add_info(pinfo, tf, &ei_ip_opt_ptr_before_address); } else { - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Pointer points to middle of address"); + expert_add_info(pinfo, tf, &ei_ip_opt_ptr_middle_address); } return; } @@ -1139,8 +1145,7 @@ dissect_ipopt_route(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, optoffset = 3; /* skip past type, length and pointer */ for (optlen -= 3; optlen > 0; optlen -= 4, optoffset += 4) { if (optlen < 4) { - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Suboption would go past end of option"); + expert_add_info(pinfo, tf, &ei_ip_subopt_too_long); break; } @@ -1203,19 +1208,16 @@ dissect_ipopt_record_route(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, dissect_ipopt_type(tvb, offset, field_tree); tf = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, offset + 1, 1, ENC_NA); if (optlen > IPOLEN_MAX) - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf, &ei_ip_opt_len_invalid); ptr = tvb_get_guint8(tvb, offset + 2); tf = proto_tree_add_item(field_tree, hf_ip_opt_ptr, tvb, offset + 2, 1, ENC_NA); if ((ptr < (optp->optlen + 1)) || (ptr & 3)) { if (ptr < (optp->optlen + 1)) { - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Pointer points before first address"); + expert_add_info(pinfo, tf, &ei_ip_opt_ptr_before_address); } else { - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Pointer points to middle of address"); + expert_add_info(pinfo, tf, &ei_ip_opt_ptr_middle_address); } return; } @@ -1224,8 +1226,7 @@ dissect_ipopt_record_route(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, optoffset = 3; /* skip past type, length and pointer */ for (optlen -= 3; optlen > 0; optlen -= 4, optoffset += 4) { if (optlen < 4) { - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Suboption would go past end of option"); + expert_add_info(pinfo, tf, &ei_ip_subopt_too_long); break; } @@ -1266,8 +1267,7 @@ dissect_ipopt_sid(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, dissect_ipopt_type(tvb, offset, field_tree); tf = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, offset + 1, 1, ENC_NA); if (optlen != (guint)optp->optlen) - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf, &ei_ip_opt_len_invalid); proto_tree_add_item(field_tree, hf_ip_opt_sid, tvb, offset + 2, 2, ENC_BIG_ENDIAN); } @@ -1286,8 +1286,7 @@ dissect_ipopt_mtu(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, dissect_ipopt_type(tvb, offset, field_tree); tf = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, offset + 1, 1, ENC_NA); if (optlen != (guint)optp->optlen) - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf, &ei_ip_opt_len_invalid); proto_tree_add_item(field_tree, hf_ip_opt_mtu, tvb, offset + 2, 2, ENC_BIG_ENDIAN); } @@ -1306,8 +1305,7 @@ dissect_ipopt_tr(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, dissect_ipopt_type(tvb, offset, field_tree); tf = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, offset + 1, 1, ENC_NA); if (optlen != (guint)optp->optlen) - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf, &ei_ip_opt_len_invalid); proto_tree_add_item(field_tree, hf_ip_opt_id_number, tvb, offset + 2, 2, ENC_BIG_ENDIAN); proto_tree_add_item(field_tree, hf_ip_opt_ohc, tvb, offset + 4, 2, ENC_BIG_ENDIAN); @@ -1339,8 +1337,7 @@ dissect_ipopt_timestamp(const ip_tcp_opt *optp, tvbuff_t *tvb, dissect_ipopt_type(tvb, offset, field_tree); tf = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, offset + 1, 1, ENC_NA); if (optlen > IPOLEN_MAX) - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf, &ei_ip_opt_len_invalid); optoffset += 2; /* skip past type and length */ optlen -= 2; /* subtract size of type and length */ @@ -1417,8 +1414,7 @@ dissect_ipopt_ra(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, dissect_ipopt_type(tvb, offset, field_tree); tf = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, offset + 1, 1, ENC_NA); if (optlen != (guint)optp->optlen) - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf, &ei_ip_opt_len_invalid); proto_tree_add_item(field_tree, hf_ip_opt_ra, tvb, offset + 2, 2, ENC_BIG_ENDIAN); } @@ -1437,8 +1433,7 @@ dissect_ipopt_sdb(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, dissect_ipopt_type(tvb, offset, field_tree); tf = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, offset + 1, 1, ENC_NA); if (optlen > IPOLEN_MAX) - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf, &ei_ip_opt_len_invalid); for (offset += 2, optlen -= 2; optlen >= 4; offset += 4, optlen -= 4) proto_tree_add_item(field_tree, hf_ip_opt_addr, tvb, offset, 4, ENC_BIG_ENDIAN); @@ -1495,8 +1490,7 @@ dissect_ipopt_qs(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, dissect_ipopt_type(tvb, offset, field_tree); ti = proto_tree_add_item(field_tree, hf_ip_opt_len, tvb, offset + 1, 1, ENC_NA); if (optlen != (guint)optp->optlen) - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, - "Invalid length for option"); + expert_add_info(pinfo, tf, &ei_ip_opt_len_invalid); proto_tree_add_item(field_tree, hf_ip_opt_qs_func, tvb, offset + 2, 1, ENC_NA); if (function == QS_RATE_REQUEST) { @@ -1724,9 +1718,7 @@ dissect_ip_tcp_options(tvbuff_t *tvb, int offset, guint length, offset += 1; if (nop_count == 4 && strcmp (name, "No-Operation (NOP)") == 0) { - expert_add_info_format(pinfo, opt_item, PI_PROTOCOL, PI_WARN, - "4 NOP in a row - a router may have removed " - "some options"); + expert_add_info(pinfo, opt_item, &ei_ip_nop); } } if (opt == eol) @@ -2064,7 +2056,7 @@ dissect_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree) "Total length: %u bytes (bogus, less than header length %u)", iph->ip_len, hlen); } - expert_add_info_format(pinfo, tf, PI_PROTOCOL, PI_ERROR, "Bogus IP length"); + expert_add_info(pinfo, tf, &ei_ip_bogus_ip_length); /* Can't dissect any further */ return; } @@ -2098,8 +2090,7 @@ dissect_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree) bit_offset + 0, 1, ENC_BIG_ENDIAN); if (iph->ip_off & IP_RF) { proto_item_append_text(tf, " (Evil packet!)"); - expert_add_info_format(pinfo, sf, PI_SECURITY, PI_WARN, - "This is an Evil packet (RFC 3514)"); + expert_add_info(pinfo, sf, &ei_ip_evil_packet); } } else { proto_tree_add_bits_item(field_tree, hf_ip_flags_rf, tvb, bit_offset + 0, @@ -2175,8 +2166,7 @@ dissect_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree) if (tree == NULL) then item will be NULL else item should be from the add_boolean(..., hf_ip_checksum_bad, ...) above */ - expert_add_info_format(pinfo, item, PI_CHECKSUM, PI_ERROR, - "Bad checksum"); + expert_add_info(pinfo, item, &ei_ip_checksum_bad); } } else { ipsum = 0; @@ -2260,15 +2250,13 @@ dissect_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree) if (is_a_local_network_control_block_addr(dst32)) { ttl = local_network_control_block_addr_valid_ttl(dst32); if (ttl != iph->ip_ttl && ttl != IPLOCAL_NETWRK_CTRL_BLK_ANY_TTL) { - expert_add_info_format(pinfo, ttl_item, PI_SEQUENCE, PI_NOTE, - "\"Time To Live\" != %d for a packet sent to the " + expert_add_info_format_text(pinfo, ttl_item, &ei_ip_ttl_lncb, "\"Time To Live\" != %d for a packet sent to the " "Local Network Control Block (see RFC 3171)", ttl); } } else if (!is_a_multicast_addr(dst32) && iph->ip_ttl < 5 && (iph->ip_p != IP_PROTO_PIM)) { - expert_add_info_format(pinfo, ttl_item, PI_SEQUENCE, PI_NOTE, - "\"Time To Live\" only %u", iph->ip_ttl); + expert_add_info_format_text(pinfo, ttl_item, &ei_ip_ttl_too_small, "\"Time To Live\" only %u", iph->ip_ttl); } if (tree) { @@ -2979,11 +2967,29 @@ proto_register_ip(void) &ett_geoip_info #endif }; + static ei_register_info ei[] = { + { &ei_ip_opt_len_invalid, { "ip.opt.len.invalid", PI_PROTOCOL, PI_WARN, "Invalid length for option", EXPFILL }}, + { &ei_ip_opt_sec_prot_auth_fti, { "ip.opt.len.invalid", PI_PROTOCOL, PI_WARN, "Field Termination Indicator set to 1 for last byte of option", EXPFILL }}, + { &ei_ip_extraneous_data, { "ip.opt.len.invalid", PI_PROTOCOL, PI_WARN, "Extraneous data in option", EXPFILL }}, + { &ei_ip_opt_ptr_before_address, { "ip.opt.ptr.before_address", PI_PROTOCOL, PI_WARN, "Pointer points before first address", EXPFILL }}, + { &ei_ip_opt_ptr_middle_address, { "ip.opt.ptr.middle_address", PI_PROTOCOL, PI_WARN, "Pointer points to middle of address", EXPFILL }}, + { &ei_ip_subopt_too_long, { "ip.subopt_too_long", PI_PROTOCOL, PI_WARN, "Suboption would go past end of option", EXPFILL }}, + { &ei_ip_nop, { "ip.nop", PI_PROTOCOL, PI_WARN, "4 NOP in a row - a router may have removed some options", EXPFILL }}, + { &ei_ip_bogus_ip_length, { "ip.bogus_ip_length", PI_PROTOCOL, PI_ERROR, "Bogus IP length", EXPFILL }}, + { &ei_ip_evil_packet, { "ip.evil_packet", PI_PROTOCOL, PI_WARN, "Suboption would go past end of option", EXPFILL }}, + { &ei_ip_checksum_bad, { "ip.checksum_bad.expert", PI_CHECKSUM, PI_ERROR, "Bad checksum", EXPFILL }}, + { &ei_ip_ttl_lncb, { "ip.ttl.lncb", PI_SEQUENCE, PI_NOTE, "Time To Live", EXPFILL }}, + { &ei_ip_ttl_too_small, { "ip.ttl.too_small", PI_SEQUENCE, PI_NOTE, "Time To Live", EXPFILL }}, + }; + module_t *ip_module; + expert_module_t* expert_ip; proto_ip = proto_register_protocol("Internet Protocol Version 4", "IPv4", "ip"); proto_register_field_array(proto_ip, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_ip = expert_register_protocol(proto_ip); + expert_register_field_array(expert_ip, ei, array_length(ei)); /* subdissector code */ ip_dissector_table = register_dissector_table("ip.proto", "IPv4 protocol", diff --git a/epan/dissectors/packet-ipv6.c b/epan/dissectors/packet-ipv6.c index 6993354136..3bbf85ff03 100644 --- a/epan/dissectors/packet-ipv6.c +++ b/epan/dissectors/packet-ipv6.c @@ -277,6 +277,20 @@ static gint ett_ipv6_traffic_class = -1; static gint ett_geoip_info = -1; #endif /* HAVE_GEOIP_V6 */ +static expert_field ei_ipv6_dst_addr_not_multicast = EI_INIT; +static expert_field ei_ipv6_src_route_list_mult_inst_same_addr = EI_INIT; +static expert_field ei_ipv6_src_route_list_src_addr = EI_INIT; +static expert_field ei_ipv6_src_route_list_dst_addr = EI_INIT; +static expert_field ei_ipv6_src_route_list_multicast_addr = EI_INIT; +static expert_field ei_ipv6_cmpri_cmpre_pad = EI_INIT; +static expert_field ei_ipv6_routing_hdr_rpl_reserved = EI_INIT; +static expert_field ei_ipv6_opt_tel_invalid_len = EI_INIT; +static expert_field ei_ipv6_opt_jumbo_invalid_len = EI_INIT; +static expert_field ei_ipv6_opt_rtalert_invalid_len = EI_INIT; +static expert_field ei_ipv6_mipv6_home_address_invalid_len = EI_INIT; +static expert_field ei_ipv6_shim6_opt_elemlen_invalid = EI_INIT; +static expert_field ei_ipv6_shim6_checksum_bad = EI_INIT; +static expert_field ei_ipv6_routing_hdr_rpl_segments_ge0 = EI_INIT; static const fragment_items ipv6_frag_items = { &ett_ipv6_fragment, @@ -587,7 +601,7 @@ dissect_routing6(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info *pinfo len = (rt.ip6r_len + 1) << 3; /* Assigning seg_left and the if (seg_left) {} blocks of code that follow, - * along with any expert_add_info_format() calls, all need to execute when + * along with any expert_add_info() calls, all need to execute when * appropriate, regardless of whether the tree is NULL or not. */ if (1) { /* !!! specify length */ @@ -657,7 +671,7 @@ dissect_routing6(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info *pinfo /* from RFC6554: Multicast addresses MUST NOT appear in the IPv6 Destination Address field */ if(g_ipv6_rpl_srh_strict_rfc_checking && E_IN6_IS_ADDR_MULTICAST(&dstAddr)){ - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Destination address must not be a multicast address "); + expert_add_info(pinfo, ti, &ei_ipv6_dst_addr_not_multicast); } proto_tree_add_item(rthdr_tree, hf_ipv6_routing_hdr_rpl_cmprI, tvb, offset, 4, ENC_BIG_ENDIAN); @@ -674,14 +688,14 @@ dissect_routing6(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info *pinfo /* from RFC6554: when CmprI and CmprE are both 0, Pad MUST carry a value of 0 */ if(g_ipv6_rpl_srh_strict_rfc_checking && (cmprI == 0 && cmprE == 0 && pad != 0)){ - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "When cmprI equals 0 and cmprE equals 0, pad MUST equal 0 but instead was %d", pad); + expert_add_info_format_text(pinfo, ti, &ei_ipv6_cmpri_cmpre_pad, "When cmprI equals 0 and cmprE equals 0, pad MUST equal 0 but instead was %d", pad); } proto_tree_add_item(rthdr_tree, hf_ipv6_routing_hdr_rpl_reserved, tvb, offset, 4, ENC_BIG_ENDIAN); reserved = tvb_get_bits32(tvb, ((offset + 1) * 8) + 4, 20, ENC_BIG_ENDIAN); if(g_ipv6_rpl_srh_strict_rfc_checking && reserved != 0){ - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Reserved field must equal 0 but instead was %d", reserved); + expert_add_info_format_text(pinfo, ti, &ei_ipv6_routing_hdr_rpl_reserved, "Reserved field must equal 0 but instead was %d", reserved); } /* from RFC6554: @@ -692,7 +706,7 @@ dissect_routing6(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info *pinfo if (segments < 0) { /* This error should always be reported */ - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, "Calculated total segments must be greater than or equal to 0, instead was %d", segments); + expert_add_info_format_text(pinfo, ti, &ei_ipv6_routing_hdr_rpl_segments_ge0, "Calculated total segments must be greater than or equal to 0, instead was %d", segments); } else { offset += 4; @@ -725,7 +739,7 @@ dissect_routing6(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info *pinfo /* Compare the addresses */ if (memcmp(addr.bytes, tempAddr.bytes, 16) == 0) { /* Found a later address that is the same */ - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_ERROR, "Multiple instances of the same address must not appear in the source route list"); + expert_add_info(pinfo, ti, &ei_ipv6_src_route_list_mult_inst_same_addr); break; } tempOffset += (16-cmprI); @@ -739,21 +753,21 @@ dissect_routing6(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info *pinfo /* Compare the addresses */ if (memcmp(addr.bytes, tempAddr.bytes, 16) == 0) { /* Found a later address that is the same */ - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_ERROR, "Multiple instances of the same address must not appear in the source route list"); + expert_add_info(pinfo, ti, &ei_ipv6_src_route_list_mult_inst_same_addr); } } /* IPv6 Source and Destination addresses of the encapsulating datagram (MUST) not appear in the SRH*/ if (memcmp(addr.bytes, srcAddr.bytes, 16) == 0) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_ERROR, "Source address must not appear in the source route list"); + expert_add_info(pinfo, ti, &ei_ipv6_src_route_list_src_addr); } if (memcmp(addr.bytes, dstAddr.bytes, 16) == 0) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_ERROR, "Destination address must not appear in the source route list"); + expert_add_info(pinfo, ti, &ei_ipv6_src_route_list_dst_addr); } /* Multicast addresses MUST NOT appear in the in SRH */ if(E_IN6_IS_ADDR_MULTICAST(&addr)){ - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_ERROR, "Multicast addresses must not appear in the source route list"); + expert_add_info(pinfo, ti, &ei_ipv6_src_route_list_multicast_addr); } } } @@ -773,16 +787,16 @@ dissect_routing6(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info *pinfo if(g_ipv6_rpl_srh_strict_rfc_checking){ /* IPv6 Source and Destination addresses of the encapsulating datagram (MUST) not appear in the SRH*/ if (memcmp(addr.bytes, srcAddr.bytes, 16) == 0) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_ERROR, "Source address must not appear in the source route list"); + expert_add_info(pinfo, ti, &ei_ipv6_src_route_list_src_addr); } if (memcmp(addr.bytes, dstAddr.bytes, 16) == 0) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_ERROR, "Destination address must not appear in the source route list"); + expert_add_info(pinfo, ti, &ei_ipv6_src_route_list_dst_addr); } /* Multicast addresses MUST NOT appear in the in SRH */ if(E_IN6_IS_ADDR_MULTICAST(&addr)){ - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_ERROR, "Multicast addresses must not appear in the source route list"); + expert_add_info(pinfo, ti, &ei_ipv6_src_route_list_multicast_addr); } } } @@ -938,7 +952,7 @@ dissect_opts(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info * pinfo, c break; case IP6OPT_TEL: if (opt_len != 1) { - expert_add_info_format(pinfo, ti_opt_len, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti_opt_len, &ei_ipv6_opt_tel_invalid_len, "Tunnel Encapsulation Limit: Invalid length (%u bytes)", opt_len); } proto_tree_add_item(opt_tree, hf_ipv6_opt_tel, tvb, @@ -947,7 +961,7 @@ dissect_opts(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info * pinfo, c break; case IP6OPT_JUMBO: if (opt_len != 4) { - expert_add_info_format(pinfo, ti_opt_len, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti_opt_len, &ei_ipv6_opt_jumbo_invalid_len, "Jumbo payload: Invalid length (%u bytes)", opt_len); } proto_tree_add_item(opt_tree, hf_ipv6_opt_jumbo, tvb, @@ -957,7 +971,7 @@ dissect_opts(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info * pinfo, c case IP6OPT_RTALERT: { if (opt_len != 2) { - expert_add_info_format(pinfo, ti_opt_len, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti_opt_len, &ei_ipv6_opt_rtalert_invalid_len, "Router alert: Invalid Length (%u bytes)", opt_len + 2); } @@ -968,7 +982,7 @@ dissect_opts(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info * pinfo, c } case IP6OPT_HOME_ADDRESS: if (opt_len != 16) { - expert_add_info_format(pinfo, ti_opt_len, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti_opt_len, &ei_ipv6_mipv6_home_address_invalid_len, "Home Address: Invalid length (%u bytes)", opt_len); } proto_tree_add_item(opt_tree, hf_ipv6_mipv6_home_address, tvb, @@ -1228,7 +1242,7 @@ dissect_shim6_opt_loc_pref(proto_tree * opt_tree, tvbuff_t * tvb, gint *offset, if (optlen < 1 || optlen > 3) { it = proto_tree_add_text(opt_tree, tvb, p, 1, "Invalid element length: %u", optlen); - expert_add_info_format(pinfo, it, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, it, &ei_ipv6_shim6_opt_elemlen_invalid, "Invalid element length: %u", optlen); return; } @@ -1554,7 +1568,7 @@ static void ipv6_shim6_checkum_additional_info(tvbuff_t * tvb, packet_info * pin offset, 2, !is_cksum_correct); PROTO_ITEM_SET_GENERATED(item); if (!is_cksum_correct) { - expert_add_info_format(pinfo, item, PI_CHECKSUM, PI_ERROR, "Bad checksum"); + expert_add_info(pinfo, item, &ei_ipv6_shim6_checksum_bad); col_append_str(pinfo->cinfo, COL_INFO, " [Shim6 CHECKSUM INCORRECT]"); } } @@ -2798,11 +2812,31 @@ proto_register_ipv6(void) &ett_geoip_info #endif /* HAVE_GEOIP_V6 */ }; + static ei_register_info ei[] = { + { &ei_ipv6_dst_addr_not_multicast, { "ipv6.dst_addr.not_multicast", PI_PROTOCOL, PI_WARN, "Destination address must not be a multicast address", EXPFILL }}, + { &ei_ipv6_src_route_list_mult_inst_same_addr, { "ipv6.src_route_list.mult_inst_same_addr", PI_PROTOCOL, PI_ERROR, "Multiple instances of the same address must not appear in the source route list", EXPFILL }}, + { &ei_ipv6_src_route_list_src_addr, { "ipv6.src_route_list.src_addr", PI_PROTOCOL, PI_ERROR, "Source address must not appear in the source route list", EXPFILL }}, + { &ei_ipv6_src_route_list_dst_addr, { "ipv6.src_route_list.dst_addr", PI_PROTOCOL, PI_ERROR, "Destination address must not appear in the source route list", EXPFILL }}, + { &ei_ipv6_src_route_list_multicast_addr, { "ipv6.src_route_list.multicast_addr", PI_PROTOCOL, PI_ERROR, "Multicast addresses must not appear in the source route list", EXPFILL }}, + { &ei_ipv6_cmpri_cmpre_pad, { "ipv6.routing_hdr.rpl.cmprI.cmprE.pad", PI_PROTOCOL, PI_WARN, "When cmprI equals 0 and cmprE equals 0, pad MUST equal 0 but instead was X", EXPFILL }}, + { &ei_ipv6_routing_hdr_rpl_reserved, { "ipv6.routing_hdr.rpl.reserved.not0", PI_PROTOCOL, PI_WARN, "Reserved field must equal 0 but instead was X", EXPFILL }}, + { &ei_ipv6_opt_tel_invalid_len, { "ipv6.opt.tel.invalid_len", PI_MALFORMED, PI_ERROR, "Tunnel Encapsulation Limit: Invalid length", EXPFILL }}, + { &ei_ipv6_opt_jumbo_invalid_len, { "ipv6.opt.jumbo.invalid_len", PI_MALFORMED, PI_ERROR, "Jumbo payload: Invalid length", EXPFILL }}, + { &ei_ipv6_opt_rtalert_invalid_len, { "ipv6.opt.router_alert.invalid_len", PI_MALFORMED, PI_ERROR, "Router alert: Invalid Length", EXPFILL }}, + { &ei_ipv6_mipv6_home_address_invalid_len, { "ipv6.mipv6_home_address.invalid_len", PI_MALFORMED, PI_ERROR, "Home Address: Invalid length", EXPFILL }}, + { &ei_ipv6_shim6_opt_elemlen_invalid, { "ipv6.shim6.opt.elemlen.invalid", PI_MALFORMED, PI_ERROR, "Invalid element length", EXPFILL }}, + { &ei_ipv6_shim6_checksum_bad, { "ipv6.shim6.checksum_bad.expert", PI_CHECKSUM, PI_ERROR, "Bad checksum", EXPFILL }}, + { &ei_ipv6_routing_hdr_rpl_segments_ge0, { "ipv6.routing_hdr.rpl.segments.ge0", PI_MALFORMED, PI_ERROR, "Calculated total segments must be greater than or equal to 0, instead was X", EXPFILL }}, + }; + module_t *ipv6_module; + expert_module_t* expert_ipv6; proto_ipv6 = proto_register_protocol("Internet Protocol Version 6", "IPv6", "ipv6"); proto_register_field_array(proto_ipv6, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_ipv6 = expert_register_protocol(proto_ipv6); + expert_register_field_array(expert_ipv6, ei, array_length(ei)); /* Register configuration options */ ipv6_module = prefs_register_protocol(proto_ipv6, NULL); |