diff options
| -rw-r--r-- | epan/dissectors/packet-afp.c | 40 | ||||
| -rw-r--r-- | epan/dissectors/packet-banana.c | 34 | ||||
| -rw-r--r-- | epan/dissectors/packet-coap.c | 37 | ||||
| -rw-r--r-- | epan/dissectors/packet-giop.c | 58 | ||||
| -rw-r--r-- | epan/dissectors/packet-icq.c | 40 | ||||
| -rw-r--r-- | epan/dissectors/packet-mpls-echo.c | 82 | ||||
| -rw-r--r-- | epan/dissectors/packet-opensafety.c | 2 | ||||
| -rw-r--r-- | epan/dissectors/packet-vnc.c | 59 |
8 files changed, 230 insertions, 122 deletions
diff --git a/epan/dissectors/packet-afp.c b/epan/dissectors/packet-afp.c index bfcbaa8c6c..255b313ec3 100644 --- a/epan/dissectors/packet-afp.c +++ b/epan/dissectors/packet-afp.c @@ -362,6 +362,12 @@ static int hf_afp_extattr_start_index = -1; static int hf_afp_extattr_reply_size = -1; static int ett_afp_extattr_names = -1; +static expert_field ei_afp_subquery_count_over_safety_limit = EI_INIT; +static expert_field ei_afp_subquery_count_over_query_count = EI_INIT; +static expert_field ei_afp_abnormal_num_subqueries = EI_INIT; +static expert_field ei_afp_too_many_acl_entries = EI_INIT; +static expert_field ei_afp_ip_port_reused = EI_INIT; + static int afp_tap = -1; static dissector_handle_t data_handle; @@ -4060,7 +4066,7 @@ spotlight_date(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset, offset += 8; if (count > SUBQ_SAFETY_LIM) { - expert_add_info_format(pinfo, tree, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, tree, &ei_afp_subquery_count_over_safety_limit, "Subquery count (%d) > safety limit (%d)", count, SUBQ_SAFETY_LIM); return -1; } @@ -4291,12 +4297,12 @@ spotlight_dissect_query_loop(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree subquery_count = (gint)(query_data64 >> 32); if (subquery_count > count) { item_query = proto_tree_add_text(tree, tvb, offset, query_length, "null"); - expert_add_info_format(pinfo, item_query, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, item_query, &ei_afp_subquery_count_over_query_count, "Subquery count (%d) > query count (%d)", subquery_count, count); count = 0; } else if (subquery_count > 20) { item_query = proto_tree_add_text(tree, tvb, offset, query_length, "null"); - expert_add_info_format(pinfo, item_query, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, item_query, &ei_afp_abnormal_num_subqueries, "Abnormal number of subqueries (%d)", subquery_count); count -= subquery_count; } else { @@ -4664,7 +4670,7 @@ decode_kauth_ace(tvbuff_t *tvb, proto_tree *tree, gint offset) #define AFP_MAX_ACL_ENTRIES 500 /* Arbitrary. */ static gint -decode_kauth_acl(tvbuff_t *tvb, proto_tree *tree, gint offset) +decode_kauth_acl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset) { int entries; int i; @@ -4683,7 +4689,7 @@ decode_kauth_acl(tvbuff_t *tvb, proto_tree *tree, gint offset) offset += 4; if (entries > AFP_MAX_ACL_ENTRIES) { - expert_add_info_format(NULL, item, PI_UNDECODED, PI_WARN, "Too many ACL entries (%u). Stopping dissection.", entries); + expert_add_info_format_text(pinfo, item, &ei_afp_too_many_acl_entries, "Too many ACL entries (%u). Stopping dissection.", entries); THROW(ReportedBoundsError); } @@ -4698,7 +4704,7 @@ decode_kauth_acl(tvbuff_t *tvb, proto_tree *tree, gint offset) } static gint -decode_uuid_acl(tvbuff_t *tvb, proto_tree *tree, gint offset, guint16 bitmap) +decode_uuid_acl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset, guint16 bitmap) { if ((offset & 1)) PAD(1); @@ -4714,7 +4720,7 @@ decode_uuid_acl(tvbuff_t *tvb, proto_tree *tree, gint offset, guint16 bitmap) } if ((bitmap & kFileSec_ACL)) { - offset = decode_kauth_acl(tvb, tree, offset); + offset = decode_kauth_acl(tvb, pinfo, tree, offset); } return offset; @@ -4734,7 +4740,7 @@ dissect_query_afp_set_acl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g offset = decode_name(tree, pinfo, tvb, offset); - offset = decode_uuid_acl(tvb, tree, offset, bitmap); + offset = decode_uuid_acl(tvb, pinfo, tree, offset, bitmap); return offset; } @@ -4759,14 +4765,14 @@ dissect_query_afp_get_acl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g /* -------------------------- */ static gint -dissect_reply_afp_get_acl(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset) +dissect_reply_afp_get_acl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset) { guint16 bitmap; bitmap = decode_acl_list_bitmap(tvb, tree, offset); offset += 2; - offset = decode_uuid_acl(tvb, tree, offset, bitmap); + offset = decode_uuid_acl(tvb, pinfo, tree, offset, bitmap); return offset; } @@ -4889,8 +4895,7 @@ dissect_afp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) */ col_set_str(pinfo->cinfo, COL_INFO, "[Error!IP port reused, you need to split the capture file]"); - expert_add_info_format(pinfo, ti, PI_SEQUENCE, PI_WARN, - "IP port reused, you need to split the capture file"); + expert_add_info(pinfo, ti, &ei_afp_ip_port_reused); return; } @@ -6790,9 +6795,20 @@ proto_register_afp(void) &ett_afp_spotlight_toc }; + static ei_register_info ei[] = { + { &ei_afp_subquery_count_over_safety_limit, { "afp.subquery_count_over_safety_limit", PI_MALFORMED, PI_ERROR, "Subquery count > safety limit ", EXPFILL }}, + { &ei_afp_subquery_count_over_query_count, { "afp.subquery_count_over_query_count", PI_MALFORMED, PI_ERROR, "Subquery count > query count", EXPFILL }}, + { &ei_afp_abnormal_num_subqueries, { "afp.abnormal_num_subqueries", PI_PROTOCOL, PI_WARN, "Abnormal number of subqueries", EXPFILL }}, + { &ei_afp_too_many_acl_entries, { "afp.too_many_acl_entries", PI_UNDECODED, PI_WARN, "Too many ACL entries", EXPFILL }}, + { &ei_afp_ip_port_reused, { "afp.ip_port_reused", PI_SEQUENCE, PI_WARN, "IP port reused, you need to split the capture file", EXPFILL }}, + }; + expert_module_t* expert_afp; + proto_afp = proto_register_protocol("Apple Filing Protocol", "AFP", "afp"); proto_register_field_array(proto_afp, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_afp = expert_register_protocol(proto_afp); + expert_register_field_array(expert_afp, ei, array_length(ei)); register_init_routine(afp_reinit); diff --git a/epan/dissectors/packet-banana.c b/epan/dissectors/packet-banana.c index 2d02dd26ed..18f78aee90 100644 --- a/epan/dissectors/packet-banana.c +++ b/epan/dissectors/packet-banana.c @@ -54,6 +54,12 @@ static int hf_banana_pb = -1; static gint ett_banana = -1; static gint ett_list = -1; +static expert_field ei_banana_unknown_type = EI_INIT; +static expert_field ei_banana_too_many_value_bytes = EI_INIT; +static expert_field ei_banana_length_too_long = EI_INIT; +static expert_field ei_banana_value_too_large = EI_INIT; +static expert_field ei_banana_pb_error = EI_INIT; + static dissector_handle_t banana_handle; #define BE_LIST 0x80 @@ -143,12 +149,12 @@ dissect_banana_element(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int if (is_element(byte)) { break; } else { - expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_ERROR, "Unknown type %u", byte); + expert_add_info_format_text(pinfo, NULL, &ei_banana_unknown_type, "Unknown type %u", byte); } } else { val_len++; if (val_len > MAX_ELEMENT_VAL_LEN) { - expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_ERROR, "Too many value/length bytes"); + expert_add_info(pinfo, NULL, &ei_banana_too_many_value_bytes); } val += byte + (val << 7); } @@ -158,7 +164,7 @@ dissect_banana_element(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int switch (byte) { case BE_LIST: if (val > MAX_ELEMENT_VAL) { - expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_ERROR, "List length %" G_GINT64_MODIFIER "d longer than we can handle", val); + expert_add_info_format_text(pinfo, NULL, &ei_banana_length_too_long, "List length %" G_GINT64_MODIFIER "d longer than we can handle", val); } ti = proto_tree_add_uint_format_value(tree, hf_banana_list, tvb, start_offset, offset - start_offset - 1, (guint32) val, "(%d items)", (gint) val); list_tree = proto_item_add_subtree(ti, ett_list); @@ -172,20 +178,20 @@ dissect_banana_element(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int break; case BE_INT: if (val > MAX_ELEMENT_VAL) { - expert_add_info_format(pinfo, NULL, PI_MALFORMED, PI_ERROR, "Integer value %" G_GINT64_MODIFIER "d too large", val); + expert_add_info_format_text(pinfo, NULL, &ei_banana_value_too_large, "Integer value %" G_GINT64_MODIFIER "d too large", val); } proto_tree_add_uint(tree, hf_banana_int, tvb, start_offset, offset - start_offset, (guint32) val); break; case BE_STRING: if (val > MAX_ELEMENT_VAL) { - expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_ERROR, "String length %" G_GINT64_MODIFIER "d longer than we can handle", val); + expert_add_info_format_text(pinfo, NULL, &ei_banana_length_too_long, "String length %" G_GINT64_MODIFIER "d longer than we can handle", val); } proto_tree_add_item(tree, hf_banana_string, tvb, offset, (guint32) val, ENC_ASCII|ENC_NA); offset += (gint) val; break; case BE_NEG_INT: if (val > MAX_ELEMENT_VAL) { - expert_add_info_format(pinfo, NULL, PI_MALFORMED, PI_ERROR, "Integer value -%" G_GINT64_MODIFIER "d too large", val); + expert_add_info_format_text(pinfo, NULL, &ei_banana_value_too_large, "Integer value -%" G_GINT64_MODIFIER "d too large", val); } proto_tree_add_int(tree, hf_banana_neg_int, tvb, start_offset, offset - start_offset, (gint32) val * -1); break; @@ -201,7 +207,7 @@ dissect_banana_element(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int break; case BE_PB: if (val_len > 1) { - expert_add_info_format(pinfo, NULL, PI_MALFORMED, PI_ERROR, "More than 1 byte before pb"); + expert_add_info(pinfo, NULL, &ei_banana_pb_error); } /* * The spec says the pb dictionary value comes after the tag. @@ -321,6 +327,7 @@ proto_register_banana(void) }; module_t *banana_module; + expert_module_t* expert_banana; /* Setup protocol subtree array */ static gint *ett[] = { @@ -328,13 +335,22 @@ proto_register_banana(void) &ett_list }; + static ei_register_info ei[] = { + { &ei_banana_unknown_type, { "banana.unknown_type", PI_UNDECODED, PI_ERROR, "Unknown type", EXPFILL }}, + { &ei_banana_too_many_value_bytes, { "banana.too_many_value_bytes", PI_UNDECODED, PI_ERROR, "Too many value/length bytes", EXPFILL }}, + { &ei_banana_length_too_long, { "banana.length_too_long", PI_UNDECODED, PI_ERROR, "Length too long", EXPFILL }}, + { &ei_banana_value_too_large, { "banana.value_too_large", PI_MALFORMED, PI_ERROR, "Value too large", EXPFILL }}, + { &ei_banana_pb_error, { "banana.pb_error", PI_MALFORMED, PI_ERROR, "More than 1 byte before pb", EXPFILL }}, + }; + /* Register the protocol name and description */ - proto_banana = proto_register_protocol("Twisted Banana", - "Banana", "banana"); + proto_banana = proto_register_protocol("Twisted Banana", "Banana", "banana"); /* Required function calls to register the header fields and subtrees used */ proto_register_field_array(proto_banana, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_banana = expert_register_protocol(proto_banana); + expert_register_field_array(expert_banana, ei, array_length(ei)); /* Initialize dissector preferences */ banana_module = prefs_register_protocol(proto_banana, banana_prefs); diff --git a/epan/dissectors/packet-coap.c b/epan/dissectors/packet-coap.c index 0e1ed459b2..e19c23a652 100644 --- a/epan/dissectors/packet-coap.c +++ b/epan/dissectors/packet-coap.c @@ -81,6 +81,10 @@ static gint ett_coap = -1; static gint ett_coap_option = -1; static gint ett_coap_payload = -1; +static expert_field ei_coap_invalid_option_number = EI_INIT; +static expert_field ei_coap_invalid_option_range = EI_INIT; +static expert_field ei_coap_option_length_bad = EI_INIT; + /* CoAP's IANA-assigned port number */ #define DEFAULT_COAP_PORT 5683 @@ -281,14 +285,13 @@ coap_opt_check(packet_info *pinfo, proto_tree *subtree, guint opt_num, gint opt_ break; } if (i == (int)(array_length(coi))) { - expert_add_info_format(pinfo, subtree, PI_MALFORMED, PI_WARN, - "Invalid Option Number %d", opt_num); + expert_add_info_format_text(pinfo, subtree, &ei_coap_invalid_option_number, + "Invalid Option Number %d", opt_num); return -1; } if (opt_length < coi[i].min || opt_length > coi[i].max) { - expert_add_info_format(pinfo, subtree, PI_MALFORMED, - PI_WARN, "Invalid Option Range: %d (%d < x < %d)", - opt_length, coi[i].min, coi[i].max); + expert_add_info_format_text(pinfo, subtree, &ei_coap_invalid_option_range, + "Invalid Option Range: %d (%d < x < %d)", opt_length, coi[i].min, coi[i].max); } return 0; @@ -575,9 +578,8 @@ dissect_coap_options_main(tvbuff_t *tvb, packet_info *pinfo, proto_tree *coap_tr opt_delta += opt_delta_ext; break; case 0xf0: - expert_add_info_format(pinfo, coap_tree, - PI_MALFORMED, PI_WARN, - "end-of-options marker found, but option length isn't 15"); + expert_add_info_format_text(pinfo, coap_tree, &ei_coap_option_length_bad, + "end-of-options marker found, but option length isn't 15"); return -1; default: opt_delta = ((opt_jump & 0xf0) >> 4); @@ -620,18 +622,16 @@ dissect_coap_options_main(tvbuff_t *tvb, packet_info *pinfo, proto_tree *coap_tr opt_length += opt_length_ext; break; case 0x0f: - expert_add_info_format(pinfo, coap_tree, - PI_MALFORMED, PI_WARN, - "end-of-options marker found, but option delta isn't 15"); + expert_add_info_format_text(pinfo, coap_tree, &ei_coap_option_length_bad, + "end-of-options marker found, but option delta isn't 15"); return -1; default: opt_length = (opt_jump & 0x0f); break; } if (offset + opt_length > coap_length) { - expert_add_info_format(pinfo, coap_tree, - PI_MALFORMED, PI_WARN, - "option longer than the package"); + expert_add_info_format_text(pinfo, coap_tree, &ei_coap_option_length_bad, + "option longer than the package"); return -1; } @@ -1069,11 +1069,20 @@ proto_register_coap(void) &ett_coap_payload, }; + static ei_register_info ei[] = { + { &ei_coap_invalid_option_number, { "coap.invalid_option_number", PI_MALFORMED, PI_WARN, "Invalid Option Number", EXPFILL }}, + { &ei_coap_invalid_option_range, { "coap.invalid_option_range", PI_MALFORMED, PI_WARN, "Invalid Option Range", EXPFILL }}, + { &ei_coap_option_length_bad, { "coap.option_length_bad", PI_MALFORMED, PI_WARN, "Option length bad", EXPFILL }}, + }; + module_t *coap_module; + expert_module_t* expert_coap; proto_coap = proto_register_protocol("Constrained Application Protocol", "CoAP", "coap"); proto_register_field_array(proto_coap, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_coap = expert_register_protocol(proto_coap); + expert_register_field_array(expert_coap, ei, array_length(ei)); register_dissector("coap", dissect_coap, proto_coap); diff --git a/epan/dissectors/packet-giop.c b/epan/dissectors/packet-giop.c index bfcd6354a1..8566cf2939 100644 --- a/epan/dissectors/packet-giop.c +++ b/epan/dissectors/packet-giop.c @@ -440,6 +440,15 @@ static gint ett_giop_scl = -1; /* ServiceContextList */ static gint ett_giop_scl_st1 = -1; static gint ett_giop_ior = -1; /* IOR */ +static expert_field ei_giop_unknown_typecode_datatype = EI_INIT; +static expert_field ei_giop_unknown_sign_value = EI_INIT; +static expert_field ei_giop_unknown_tckind = EI_INIT; +static expert_field ei_giop_length_too_big = EI_INIT; +static expert_field ei_giop_version_not_supported = EI_INIT; +static expert_field ei_giop_message_size_too_big = EI_INIT; +static expert_field ei_giop_invalid_v_minor = EI_INIT; + + static const int *giop_message_flags[] = { &hf_giop_message_flags_ziop_enabled, &hf_giop_message_flags_ziop_supported, @@ -2274,7 +2283,7 @@ static void dissect_data_for_typecode(tvbuff_t *tvb, packet_info *pinfo, proto_t case tk_abstract_interface: break; default: - expert_add_info_format(pinfo, item, PI_PROTOCOL, PI_WARN, "Unknown typecode data type %u", data_type); + expert_add_info_format_text(pinfo, item, &ei_giop_unknown_typecode_datatype, "Unknown typecode data type %u", data_type); break; } } @@ -3021,7 +3030,7 @@ void get_CDR_fixed(tvbuff_t *tvb, packet_info *pinfo, proto_item *item, gchar ** (*seq)[sindex] = '-'; break; default: - expert_add_info_format(pinfo, item, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, item, &ei_giop_unknown_sign_value, "Unknown sign value in fixed type %u", sign); (*seq)[sindex] = '*'; /* flag as sign unknown */ break; @@ -3446,7 +3455,7 @@ guint32 get_CDR_typeCode(tvbuff_t *tvb, packet_info* pinfo, proto_tree *tree, dissect_tk_abstract_interface_params(tvb, tree, offset, stream_is_big_endian, boundary ); break; default: - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Unknown TCKind %u", val); + expert_add_info_format_text(pinfo, ti, &ei_giop_unknown_tckind, "Unknown TCKind %u", val); break; } /* val */ @@ -3707,7 +3716,7 @@ dissect_target_address(tvbuff_t * tvb, packet_info *pinfo, int *offset, proto_tr ti = proto_tree_add_uint (tree, hf_giop_target_address_key_addr_len, tvb, *offset -4, 4, len); if (len > (guint32)tvb_reported_length_remaining(tvb, *offset-4)) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, "KeyAddr key length bigger than packet size"); + expert_add_info_format_text(pinfo, ti, &ei_giop_length_too_big, "KeyAddr key length bigger than packet size"); return; } @@ -3804,7 +3813,7 @@ static void decode_UnknownServiceContext(tvbuff_t *tvb, packet_info *pinfo, prot ti = proto_tree_add_uint(tree, hf_giop_context_data_len, tvb, *offset - 4, 4, context_data_len); if (context_data_len > (guint32)tvb_reported_length_remaining(tvb, *offset-4)) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, "Context data length bigger than packet size"); + expert_add_info_format_text(pinfo, ti, &ei_giop_length_too_big, "Context data length bigger than packet size"); return; } @@ -4327,7 +4336,7 @@ dissect_giop_request_1_1 (tvbuff_t * tvb, packet_info * pinfo, tf = proto_tree_add_uint (request_tree, hf_giop_objekt_key_len, tvb, offset-4, 4, objkey_len); if (objkey_len > (guint32)tvb_reported_length_remaining(tvb, offset-4)) { - expert_add_info_format(pinfo, tf, PI_MALFORMED, PI_ERROR, "Object key length bigger than packet size"); + expert_add_info_format_text(pinfo, tf, &ei_giop_length_too_big, "Object key length bigger than packet size"); return; } @@ -4354,7 +4363,7 @@ dissect_giop_request_1_1 (tvbuff_t * tvb, packet_info * pinfo, tf = proto_tree_add_uint (request_tree, hf_giop_req_principal_len, tvb, offset - 4, 4, len); if (len > (guint32)tvb_reported_length_remaining(tvb, offset-4)) { - expert_add_info_format(pinfo, tf, PI_MALFORMED, PI_ERROR, "Requesting Principal length bigger than packet size"); + expert_add_info_format_text(pinfo, tf, &ei_giop_length_too_big, "Requesting Principal length bigger than packet size"); return; } @@ -4555,7 +4564,7 @@ dissect_giop_locate_request( tvbuff_t * tvb, packet_info * pinfo, proto_tree_add_uint (locate_request_tree, hf_giop_objekt_key_len, tvb, offset-4, 4, len); if (len > (guint32)tvb_reported_length_remaining(tvb, offset-4)) { - expert_add_info_format(pinfo, tf, PI_MALFORMED, PI_ERROR, "Object key length bigger than packet size"); + expert_add_info_format_text(pinfo, tf, &ei_giop_length_too_big, "Object key length bigger than packet size"); return; } @@ -4701,7 +4710,7 @@ static void dissect_giop_common (tvbuff_t * tvb, packet_info * pinfo, proto_tree col_add_fstr (pinfo->cinfo, COL_INFO, "Version %u.%u", header.GIOP_version.major, header.GIOP_version.minor); - expert_add_info_format(pinfo, version_item, PI_PROTOCOL, PI_WARN, "Version %u.%u not supported", + expert_add_info_format_text(pinfo, version_item, &ei_giop_version_not_supported, "Version %u.%u not supported", header.GIOP_version.major, header.GIOP_version.minor); payload_tvb = tvb_new_subset_remaining (tvb, GIOP_HEADER_SIZE); @@ -4747,7 +4756,7 @@ static void dissect_giop_common (tvbuff_t * tvb, packet_info * pinfo, proto_tree ti = proto_tree_add_uint(header_tree, hf_giop_message_size, tvb, 8, 4, message_size); if (message_size > GIOP_MAX_MESSAGE_SIZE) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, ti, &ei_giop_message_size_too_big, "Message size %u is too big, perhaps it's an endian issue?", message_size); return; } @@ -5341,8 +5350,6 @@ proto_register_giop (void) }, }; - - static gint *ett[] = { &ett_giop, &ett_giop_header, @@ -5359,16 +5366,29 @@ proto_register_giop (void) &ett_giop_ior }; - module_t *giop_module; - proto_giop = proto_register_protocol("General Inter-ORB Protocol", "GIOP", - "giop"); + static ei_register_info ei[] = { + { &ei_giop_unknown_typecode_datatype, { "giop.unknown_typecode_datatype", PI_PROTOCOL, PI_WARN, "Unknown typecode data type", EXPFILL }}, + { &ei_giop_unknown_sign_value, { "giop.unknown_sign_value", PI_PROTOCOL, PI_WARN, "Unknown sign value in fixed type", EXPFILL }}, + { &ei_giop_unknown_tckind, { "giop.unknown_tckind", PI_PROTOCOL, PI_WARN, "Unknown TCKind", EXPFILL }}, + { &ei_giop_length_too_big, { "giop.length_too_big", PI_MALFORMED, PI_ERROR, "length bigger than packet size", EXPFILL }}, + { &ei_giop_version_not_supported, { "giop.version_not_supported", PI_PROTOCOL, PI_WARN, "Version not supported", EXPFILL }}, + { &ei_giop_message_size_too_big, { "giop.message_size_too_big", PI_PROTOCOL, PI_WARN, "Message size is too big", EXPFILL }}, + { &ei_giop_invalid_v_minor, { "giop.invalid_v_minor", PI_PROTOCOL, PI_WARN, "Invalid v_minor value", EXPFILL }}, + }; + + module_t *giop_module; + expert_module_t* expert_giop; + + proto_giop = proto_register_protocol("General Inter-ORB Protocol", "GIOP", "giop"); /* Register by name */ register_dissector("giop", dissect_giop_tcp, proto_giop); proto_register_field_array (proto_giop, hf, array_length (hf)); proto_register_subtree_array (ett, array_length (ett)); + expert_giop = expert_register_protocol(proto_giop); + expert_register_field_array(expert_giop, ei, array_length(ei)); /* register init routine */ @@ -5532,7 +5552,7 @@ static void decode_TaggedProfile(tvbuff_t *tvb, packet_info *pinfo, proto_tree * default: if (seqlen_pd-1 > (guint32)tvb_reported_length_remaining(tvb, *offset-4)) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, "Profile data bigger than packet size"); + expert_add_info_format_text(pinfo, ti, &ei_giop_length_too_big, "Profile data bigger than packet size"); break; } @@ -5601,7 +5621,7 @@ static void decode_IIOP_IOR_profile(tvbuff_t *tvb, packet_info *pinfo, proto_tre ti = proto_tree_add_uint(tree,hf_giop_sequence_length,tvb, *offset-4,4,seqlen); if (seqlen > (guint32)tvb_reported_length_remaining(tvb, *offset-4)) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, "Sequence length bigger than packet size"); + expert_add_info_format_text(pinfo, ti, &ei_giop_length_too_big, "Sequence length bigger than packet size"); return; } @@ -5670,7 +5690,7 @@ static void decode_IIOP_IOR_profile(tvbuff_t *tvb, packet_info *pinfo, proto_tre ti = proto_tree_add_uint(tree,hf_giop_sequence_length,tvb, *offset-4,4,seqlen1); if (seqlen1 > (guint32)tvb_reported_length_remaining(tvb, *offset-4)) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, "Sequence length bigger than packet size"); + expert_add_info_format_text(pinfo, ti, &ei_giop_length_too_big, "Sequence length bigger than packet size"); return; } @@ -5684,7 +5704,7 @@ static void decode_IIOP_IOR_profile(tvbuff_t *tvb, packet_info *pinfo, proto_tre break; default: - expert_add_info_format(pinfo, ti_minor, PI_PROTOCOL, PI_WARN, "Invalid v_minor value = %u", v_minor); + expert_add_info_format_text(pinfo, ti_minor, &ei_giop_invalid_v_minor, "Invalid v_minor value = %u", v_minor); break; } diff --git a/epan/dissectors/packet-icq.c b/epan/dissectors/packet-icq.c index 427c50d026..498a07f92e 100644 --- a/epan/dissectors/packet-icq.c +++ b/epan/dissectors/packet-icq.c @@ -56,6 +56,10 @@ static gint ett_icq_decode = -1; static gint ett_icq_body = -1; static gint ett_icq_body_parts = -1; +static expert_field ei_icq_unknown_meta_subcmd = EI_INIT; +static expert_field ei_icq_unknown_command = EI_INIT; +static expert_field ei_icq_unknown_version = EI_INIT; + /* This is not IANA registered */ #define UDP_PORT_ICQ 4000 @@ -521,8 +525,8 @@ static void icqv5_decode_msgType(proto_tree* tree, tvbuff_t *tvb, int offset, int size, packet_info *pinfo) { - proto_item* ti = NULL; - proto_tree* subtree = NULL; + proto_item *ti, *msg_item; + proto_tree *subtree; int left = size; guint16 msgType; gint sep_offset; @@ -565,7 +569,7 @@ icqv5_decode_msgType(proto_tree* tree, tvbuff_t *tvb, int offset, int size, /* Create a new subtree */ subtree = proto_item_add_subtree(ti, ett_icq_body_parts); - proto_tree_add_text(subtree, tvb, offset, 2, + msg_item = proto_tree_add_text(subtree, tvb, offset, 2, "Type: %u (%s)", msgType, findMsgType(msgType)); offset += 2; left -= 2; @@ -584,9 +588,8 @@ icqv5_decode_msgType(proto_tree* tree, tvbuff_t *tvb, int offset, int size, case 0xffff: /* Field unknown */ break; default: - expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_WARN, - "Unknown msgType: %u (0x%x)", msgType, - msgType); + expert_add_info_format_text(pinfo, msg_item, &ei_icq_unknown_command, + "Unknown msgType: %u (0x%x)", msgType, msgType); break; case MSG_TEXT: proto_tree_add_text(subtree, tvb, offset, left, "Msg: %.*s", left-1, @@ -1349,8 +1352,8 @@ icqv5_srv_meta_user(proto_tree* tree, /* Tree to put the data in */ } default: /* This information is already printed in the tree */ - expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_WARN, - "Meta subcmd: 0x%x", subcmd); + expert_add_info_format_text(pinfo, ti, &ei_icq_unknown_meta_subcmd, + "Unknown Meta subcmd: 0x%x", subcmd); break; } } @@ -1567,9 +1570,9 @@ dissect_icqv5Client(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) icqv5_cmd_no_params(icq_tree, decr_tvb, ICQ5_CL_HDRSIZE); break; default: - proto_tree_add_text(icq_tree, decr_tvb, ICQ5_CL_HDRSIZE, + ti = proto_tree_add_text(icq_tree, decr_tvb, ICQ5_CL_HDRSIZE, pktsize - ICQ5_CL_HDRSIZE, "Body"); - expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_WARN, + expert_add_info_format_text(pinfo, ti, &ei_icq_unknown_command, "Missing: %s", findClientCmd(cmd)); break; } @@ -1667,9 +1670,9 @@ dissect_icqv5Server(tvbuff_t *tvb, int offset, packet_info *pinfo, icqv5_srv_no_params(icq_tree, tvb, offset + ICQ5_SRV_HDRSIZE); break; default: - proto_tree_add_text(icq_tree, tvb, offset + ICQ5_SRV_HDRSIZE, + ti = proto_tree_add_text(icq_tree, tvb, offset + ICQ5_SRV_HDRSIZE, pktsize - ICQ5_SRV_HDRSIZE, "Body"); - expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_WARN, + expert_add_info_format_text(pinfo, ti, &ei_icq_unknown_command, "Missing: %s", findClientCmd(cmd)); break; } @@ -1719,7 +1722,7 @@ dissect_icq(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) dissect_icqv2(tvb, pinfo, tree); break; default: - expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_WARN, + expert_add_info_format_text(pinfo, NULL, &ei_icq_unknown_version, "Unknown version (0x%x)", version); break; } @@ -1756,12 +1759,19 @@ proto_register_icq(void) &ett_icq_body, &ett_icq_body_parts, }; + static ei_register_info ei[] = { + { &ei_icq_unknown_meta_subcmd, { "icq.unknown_meta_subcmd", PI_UNDECODED, PI_WARN, "Unknown meta subcmd", EXPFILL }}, + { &ei_icq_unknown_command, { "icq.unknown_command", PI_UNDECODED, PI_WARN, "Unknown msgType", EXPFILL }}, + { &ei_icq_unknown_version, { "icq.unknown_version", PI_UNDECODED, PI_WARN, "Unknown version", EXPFILL }}, + }; - proto_icq = proto_register_protocol("ICQ Protocol", "ICQ", "icq"); + expert_module_t* expert_icq; + proto_icq = proto_register_protocol("ICQ Protocol", "ICQ", "icq"); proto_register_field_array(proto_icq, hf, array_length(hf)); - proto_register_subtree_array(ett, array_length(ett)); + expert_icq = expert_register_protocol(proto_icq); + expert_register_field_array(expert_icq, ei, array_length(ei)); } void diff --git a/epan/dissectors/packet-mpls-echo.c b/epan/dissectors/packet-mpls-echo.c index f25049c4db..6dc5c8db31 100644 --- a/epan/dissectors/packet-mpls-echo.c +++ b/epan/dissectors/packet-mpls-echo.c @@ -229,6 +229,13 @@ static gint ett_mpls_echo_tlv_ilso = -1; static gint ett_mpls_echo_tlv_dd_map = -1; static gint ett_mpls_echo_tlv_ddstlv_map = -1; +static expert_field ei_mpls_echo_tlv_fec_len = EI_INIT; +static expert_field ei_mpls_echo_tlv_dd_map_subtlv_len = EI_INIT; +static expert_field ei_mpls_echo_tlv_len = EI_INIT; +static expert_field ei_mpls_echo_tlv_ds_map_muti_len = EI_INIT; +static expert_field ei_mpls_echo_unknown_address_type = EI_INIT; +static expert_field ei_mpls_echo_incorrect_address_type = EI_INIT; + static guint global_mpls_echo_udp_port = UDP_PORT_MPLS_ECHO; static const value_string mpls_echo_msgtype[] = { @@ -542,7 +549,7 @@ dissect_mpls_echo_tlv_fec(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto } if (length + 4 > rem) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_fec_len, "Invalid FEC Sub-TLV Length (claimed %u, found %u)", length, rem - 4); return; @@ -568,7 +575,7 @@ dissect_mpls_echo_tlv_fec(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto break; case TLV_FEC_STACK_RSVP_IPv4: if (length != 20) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_fec_len, "Invalid FEC Sub-TLV Length " "(claimed %u, should be %u)", length, 20); @@ -593,7 +600,7 @@ dissect_mpls_echo_tlv_fec(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto break; case TLV_FEC_STACK_RSVP_IPv6: if (length != 56) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_fec_len, "Invalid FEC Sub-TLV Length " "(claimed %u, should be %u)", length, 56); @@ -662,7 +669,7 @@ dissect_mpls_echo_tlv_fec(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto break; case TLV_FEC_STACK_L2_CID_NEW: if (length < 14) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_fec_len, "Invalid FEC Sub-TLV Length " "(claimed %u, should be %u)", length, 14); @@ -683,7 +690,7 @@ dissect_mpls_echo_tlv_fec(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto break; case TLV_FEC_VENDOR_PRIVATE_START: if (length < 4) { /* SMI Enterprise code */ - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_fec_len, "Invalid FEC Sub-TLV Length " "(claimed %u, should be >= %u)", length, 4); @@ -747,7 +754,7 @@ dissect_mpls_echo_tlv_fec(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto break; case TLV_FEC_STACK_P2MP_IPv4: if (length != 20) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_fec_len, "Invalid FEC Sub-TLV Length " "(claimed %u, should be %u)", length, 20); @@ -777,7 +784,7 @@ dissect_mpls_echo_tlv_fec(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto case TLV_FEC_STACK_P2MP_IPv6: if (length != 56) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_fec_len, "Invalid FEC Sub-TLV Length " "(claimed %u, should be %u)", length, 56); @@ -857,7 +864,7 @@ dissect_mpls_echo_tlv_fec(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto if (length % 4) { pad = 4 - (length % 4); if (length + 4 + pad > rem) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_fec_len, "Invalid FEC Sub-TLV Padded Length (claimed %u, found %u)", length + pad, rem - 4); return; @@ -932,7 +939,7 @@ dissect_mpls_echo_tlv_ds_map(tvbuff_t *tvb, packet_info *pinfo, guint offset, pr (offset + 8), 4, ENC_BIG_ENDIAN); break; default: - expert_add_info_format(pinfo, addr_ti, PI_UNDECODED, PI_WARN, + expert_add_info_format_text(pinfo, addr_ti, &ei_mpls_echo_unknown_address_type, "Unknown Address Type (%u)", addr_type); break; } @@ -950,7 +957,7 @@ dissect_mpls_echo_tlv_ds_map(tvbuff_t *tvb, packet_info *pinfo, guint offset, pr rem -= 16; offset += 16; if (rem < mplen) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_ds_map_muti_len, "Invalid FEC Multipath (claimed %u, found %u)", mplen, rem); return; @@ -960,7 +967,7 @@ dissect_mpls_echo_tlv_ds_map(tvbuff_t *tvb, packet_info *pinfo, guint offset, pr switch (hash_type) { case TLV_DS_MAP_HASH_IP: if (mplen != 4) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_ds_map_muti_len, "Invalid FEC Multipath (claimed %u, should be 4)", mplen); break; @@ -973,7 +980,7 @@ dissect_mpls_echo_tlv_ds_map(tvbuff_t *tvb, packet_info *pinfo, guint offset, pr break; case TLV_DS_MAP_HASH_IP_RANGE: if (mplen != 8) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_ds_map_muti_len, "Invalid FEC Multipath (claimed %u, should be 8)", mplen); break; @@ -995,7 +1002,7 @@ dissect_mpls_echo_tlv_ds_map(tvbuff_t *tvb, packet_info *pinfo, guint offset, pr break; case TLV_DS_MAP_HASH_BITMASK_IP: if (mplen < 4) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_ds_map_muti_len, "Invalid FEC Multipath (claimed %u, should be 4)", mplen); break; @@ -1101,7 +1108,7 @@ dissect_mpls_echo_tlv_dd_map(tvbuff_t *tvb, packet_info *pinfo, guint offset, pr (offset + 8), 4, ENC_BIG_ENDIAN); break; default: - expert_add_info_format(pinfo, ddti, PI_UNDECODED, PI_WARN, + expert_add_info_format_text(pinfo, ddti, &ei_mpls_echo_unknown_address_type, "Unknown Address Type (%u)", addr_type); break; } @@ -1126,7 +1133,7 @@ dissect_mpls_echo_tlv_dd_map(tvbuff_t *tvb, packet_info *pinfo, guint offset, pr offset += 4; if (rem<subtlv_length){ - expert_add_info_format(pinfo, ddti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ddsti, &ei_mpls_echo_tlv_dd_map_subtlv_len, "Invalid Sub-tlv Length (claimed %u, found %u)", subtlv_length, rem); return; @@ -1159,7 +1166,7 @@ dissect_mpls_echo_tlv_dd_map(tvbuff_t *tvb, packet_info *pinfo, guint offset, pr case TLV_MULTIPATH_IP_ADDRESS: if (multipath_length != 4) { - expert_add_info_format(pinfo, ddsti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ddsti, &ei_mpls_echo_tlv_dd_map_subtlv_len, "Invalid Sub-tlv Length (claimed %u, should be 4)", multipath_length); break; @@ -1183,7 +1190,7 @@ dissect_mpls_echo_tlv_dd_map(tvbuff_t *tvb, packet_info *pinfo, guint offset, pr case TLV_MULTIPATH_IP_ADDRESS_RANGE: if (multipath_length != 8) { - expert_add_info_format(pinfo, ddsti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ddsti, &ei_mpls_echo_tlv_dd_map_subtlv_len, "Invalid Sub-tlv Length (claimed %u, should be 8)", multipath_length); break; @@ -1209,7 +1216,7 @@ dissect_mpls_echo_tlv_dd_map(tvbuff_t *tvb, packet_info *pinfo, guint offset, pr case TLV_MULTIPATH_BIT_MASKED_IP: if (multipath_length < 4) { - expert_add_info_format(pinfo, ddsti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ddsti, &ei_mpls_echo_tlv_dd_map_subtlv_len, "Invalid Sub-tlv Length (claimed %u, should be >= 4)", multipath_length); break; @@ -1348,8 +1355,7 @@ dissect_mpls_echo_tlv_ilso(tvbuff_t *tvb, packet_info *pinfo, guint offset, prot if ((type == TLV_ADDR_IPv4) || (type == TLV_ADDR_UNNUM_IPv4)) { if (is_ipv6) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, - "Incorrect address type for TLV?"); + expert_add_info(pinfo, ti, &ei_mpls_echo_incorrect_address_type); } proto_tree_add_item(tree, hf_mpls_echo_tlv_ilso_ipv4_addr, tvb, offset, 4, ENC_BIG_ENDIAN); @@ -1364,8 +1370,7 @@ dissect_mpls_echo_tlv_ilso(tvbuff_t *tvb, packet_info *pinfo, guint offset, prot rem -= 8; } else if ((type == TLV_ADDR_IPv6) || (type == TLV_ADDR_UNNUM_IPv6)) { if (!is_ipv6) { - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, - "Incorrect address type for TLV?"); + expert_add_info(pinfo, ti, &ei_mpls_echo_incorrect_address_type); } proto_tree_add_item(tree, hf_mpls_echo_tlv_ilso_ipv6_addr, tvb, @@ -1382,8 +1387,7 @@ dissect_mpls_echo_tlv_ilso(tvbuff_t *tvb, packet_info *pinfo, guint offset, prot rem -= 20; } } else { - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_WARN, - "Incorrect address type for TLV?"); + expert_add_info(pinfo, ti, &ei_mpls_echo_incorrect_address_type); return; } @@ -1511,7 +1515,7 @@ dissect_mpls_echo_tlv(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto_tre break; case TLV_ILSO_IPv4: if (length < 12) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_len, "Invalid TLV Length (claimed %u, should be >= 12)", length); break; @@ -1520,7 +1524,7 @@ dissect_mpls_echo_tlv(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto_tre break; case TLV_ILSO_IPv6: if (length < 24) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_len, "Invalid TLV Length (claimed %u, should be >= 24)", length); break; @@ -1551,7 +1555,7 @@ dissect_mpls_echo_tlv(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto_tre #endif case TLV_P2MP_ECHO_JITTER: if (length != 4) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_len, "Invalid TLV Length (claimed %u, should be 4)", length); break; @@ -1570,7 +1574,7 @@ dissect_mpls_echo_tlv(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto_tre case TLV_P2MP_RESPONDER_IDENT_IPV4_EGRESS_ADDR: case TLV_P2MP_RESPONDER_IDENT_IPV4_NODE_ADDR: if (resp_ident_len != 4) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_len, "Invalid TLV Length (claimed %u, should be 4)", length); break; @@ -1587,7 +1591,7 @@ dissect_mpls_echo_tlv(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto_tre case TLV_P2MP_RESPONDER_IDENT_IPV6_EGRESS_ADDR: case TLV_P2MP_RESPONDER_IDENT_IPV6_NODE_ADDR: if (resp_ident_len != 16) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_len, "Invalid TLV Length (claimed %u, should be 16)", length); break; @@ -1605,7 +1609,7 @@ dissect_mpls_echo_tlv(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto_tre } case TLV_VENDOR_PRIVATE_START: if (length < 4) { /* SMI Enterprise code */ - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_len, "Invalid TLV Length (claimed %u, should be >= 4)", length); } else { @@ -1617,7 +1621,7 @@ dissect_mpls_echo_tlv(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto_tre break; case TLV_DOWNSTREAM_MAPPING: if (length < 16) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_len, "Invalid TLV Length (claimed %u, should be >= 16)", length); break; @@ -1626,7 +1630,7 @@ dissect_mpls_echo_tlv(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto_tre break; case TLV_DETAILED_DOWNSTREAM: /* [RFC 6424] */ if (length < 16) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_len, "Invalid TLV Length (claimed %u, should be >= 16)", length); break; @@ -1642,7 +1646,7 @@ dissect_mpls_echo_tlv(tvbuff_t *tvb, packet_info *pinfo, guint offset, proto_tre break; case TLV_REPLY_TOS: if (length != 4) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, ti, &ei_mpls_echo_tlv_len, "Invalid TLV Length (claimed %u, should be 4)", length); break; @@ -2523,13 +2527,25 @@ proto_register_mpls_echo(void) &ett_mpls_echo_tlv_ddstlv_map }; + static ei_register_info ei[] = { + { &ei_mpls_echo_tlv_fec_len, { "mpls_echo.tlv.fec.len.invalid", PI_MALFORMED, PI_ERROR, "Invalid FEC TLV length", EXPFILL }}, + { &ei_mpls_echo_tlv_dd_map_subtlv_len, { "mpls_echo.tlv.dd_map.subtlv_len.invalid", PI_MALFORMED, PI_ERROR, "Invalid Sub-TLV length", EXPFILL }}, + { &ei_mpls_echo_tlv_len, { "mpls_echo.tlv.len.invalid", PI_MALFORMED, PI_ERROR, "Invalid TLV length", EXPFILL }}, + { &ei_mpls_echo_tlv_ds_map_muti_len, { "mpls_echo.tlv.ds_map.multi_len.invalid", PI_MALFORMED, PI_ERROR, "Invalid Multipath TLV length", EXPFILL }}, + { &ei_mpls_echo_unknown_address_type, { "mpls_echo.address_type.unknown", PI_UNDECODED, PI_WARN, "Unknown Address Type", EXPFILL }}, + { &ei_mpls_echo_incorrect_address_type, { "mpls_echo.address_type.incorrect", PI_PROTOCOL, PI_WARN, "Incorrect address type for TLV?", EXPFILL }}, + }; + module_t *mpls_echo_module; + expert_module_t* expert_mpls_echo; proto_mpls_echo = proto_register_protocol("Multiprotocol Label Switching Echo", "MPLS Echo", "mpls-echo"); proto_register_field_array(proto_mpls_echo, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_mpls_echo = expert_register_protocol(proto_mpls_echo); + expert_register_field_array(expert_mpls_echo, ei, array_length(ei)); mpls_echo_module = prefs_register_protocol(proto_mpls_echo, proto_reg_handoff_mpls_echo); prefs_register_uint_preference(mpls_echo_module, "udp.port", "MPLS Echo UDP Port", diff --git a/epan/dissectors/packet-opensafety.c b/epan/dissectors/packet-opensafety.c index 1eb772d3dd..38a8a52bbc 100644 --- a/epan/dissectors/packet-opensafety.c +++ b/epan/dissectors/packet-opensafety.c @@ -1485,7 +1485,7 @@ dissect_opensafety_snmt_message(tvbuff_t *message_tvb, packet_info *pinfo , prot { local_scm_udid = (char *)se_alloc0(18 * sizeof(char)); g_snprintf(local_scm_udid, 18, "%s", tempString ); - expert_add_info_format(pinfo, item, PI_PROTOCOL, PI_NOTE, "Auto detected payload as SCM UDID [%s].", tempString); + expert_add_info_format_text(pinfo, item, &ei_scmudid_autodetected, "Auto detected payload as SCM UDID [%s].", tempString); } } diff --git a/epan/dissectors/packet-vnc.c b/epan/dissectors/packet-vnc.c index 28b9e14dbd..186c32a8b6 100644 --- a/epan/dissectors/packet-vnc.c +++ b/epan/dissectors/packet-vnc.c @@ -793,6 +793,15 @@ static gint ett_vnc_key_events = -1; static gint ett_vnc_touch_events = -1; static gint ett_vnc_slrle_subline = -1; +static expert_field ei_vnc_possible_gtk_vnc_bug = EI_INIT; +static expert_field ei_vnc_auth_code_mismatch = EI_INIT; +static expert_field ei_vnc_unknown_tight_vnc_auth = EI_INIT; +static expert_field ei_vnc_too_many_rectangles = EI_INIT; +static expert_field ei_vnc_too_many_sub_rectangles = EI_INIT; +static expert_field ei_vnc_invalid_encoding = EI_INIT; +static expert_field ei_vnc_too_many_colors = EI_INIT; +static expert_field ei_vnc_too_many_cut_text = EI_INIT; + /* Global so they keep their value between packets */ guint8 vnc_bytes_per_pixel; guint8 vnc_depth; @@ -943,7 +952,7 @@ vnc_is_client_or_server_version_message(tvbuff_t *tvb, packet_info *pinfo, proto */ if ((pinfo != NULL) && (tree != NULL)) { bug_item = proto_tree_add_text(tree, tvb, -1, 0, "NULL found in greeting"); - expert_add_info_format(pinfo, bug_item, PI_MALFORMED, PI_ERROR, "client -> server greeting must be 12 bytes (possible gtk-vnc bug)"); + expert_add_info(pinfo, bug_item, &ei_vnc_possible_gtk_vnc_bug); } return TRUE; @@ -1177,36 +1186,36 @@ vnc_startup_messages(tvbuff_t *tvb, packet_info *pinfo, gint offset, switch(auth_code) { case VNC_SECURITY_TYPE_NONE: if ((g_ascii_strcasecmp(vendor, "STDV") != 0) || (g_ascii_strcasecmp(signature, "NOAUTH__") != 0)) { - expert_add_info_format(pinfo, auth_item, PI_PROTOCOL, PI_WARN, "Authentication code does not match vendor or signature"); + expert_add_info(pinfo, auth_item, &ei_vnc_auth_code_mismatch); } break; case VNC_SECURITY_TYPE_VNC: if ((g_ascii_strcasecmp(vendor, "STDV") != 0) || (g_ascii_strcasecmp(signature, "VNCAUTH_") != 0)) { - expert_add_info_format(pinfo, auth_item, PI_PROTOCOL, PI_WARN, "Authentication code does not match vendor or signature"); + expert_add_info(pinfo, auth_item, &ei_vnc_auth_code_mismatch); } break; case VNC_SECURITY_TYPE_VENCRYPT: if ((g_ascii_strcasecmp(vendor, "VENC") != 0) || (g_ascii_strcasecmp(signature, "VENCRYPT") != 0)) { - expert_add_info_format(pinfo, auth_item, PI_PROTOCOL, PI_WARN, "Authentication code does not match vendor or signature"); + expert_add_info(pinfo, auth_item, &ei_vnc_auth_code_mismatch); } break; case VNC_SECURITY_TYPE_GTK_VNC_SASL: if ((g_ascii_strcasecmp(vendor, "GTKV") != 0) || (g_ascii_strcasecmp(signature, "SASL____") != 0)) { - expert_add_info_format(pinfo, auth_item, PI_PROTOCOL, PI_WARN, "Authentication code does not match vendor or signature"); + expert_add_info(pinfo, auth_item, &ei_vnc_auth_code_mismatch); } break; case VNC_TIGHT_AUTH_TGHT_ULGNAUTH: if ((g_ascii_strcasecmp(vendor, "TGHT") != 0) || (g_ascii_strcasecmp(signature, "ULGNAUTH") != 0)) { - expert_add_info_format(pinfo, auth_item, PI_PROTOCOL, PI_WARN, "Authentication code does not match vendor or signature"); + expert_add_info(pinfo, auth_item, &ei_vnc_auth_code_mismatch); } break; case VNC_TIGHT_AUTH_TGHT_XTRNAUTH: if ((g_ascii_strcasecmp(vendor, "TGHT") != 0) || (g_ascii_strcasecmp(signature, "XTRNAUTH") != 0)) { - expert_add_info_format(pinfo, auth_item, PI_PROTOCOL, PI_WARN, "Authentication code does not match vendor or signature"); + expert_add_info(pinfo, auth_item, &ei_vnc_auth_code_mismatch); } break; default: - expert_add_info_format(pinfo, auth_item, PI_PROTOCOL, PI_ERROR, "Unknown TIGHT VNC authentication"); + expert_add_info(pinfo, auth_item, &ei_vnc_unknown_tight_vnc_auth); break; } } @@ -1248,7 +1257,7 @@ vnc_startup_messages(tvbuff_t *tvb, packet_info *pinfo, gint offset, per_conversation_info->vnc_next_state = VNC_SESSION_STATE_TIGHT_UNKNOWN_PACKET3; break; default: - expert_add_info_format(pinfo, auth_item, PI_PROTOCOL, PI_ERROR, "Unknown authentication selected"); + expert_add_info(pinfo, auth_item, &ei_vnc_unknown_tight_vnc_auth); per_conversation_info->vnc_next_state = VNC_SESSION_STATE_TIGHT_UNKNOWN_PACKET3; break; } @@ -1809,8 +1818,8 @@ vnc_server_framebuffer_update(tvbuff_t *tvb, packet_info *pinfo, gint *offset, ti = proto_tree_add_item(tree, hf_vnc_rectangle_num, tvb, *offset, 2, ENC_BIG_ENDIAN); if (num_rects > 5000) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, - "Too many rectangles, aborting dissection"); + expert_add_info_format_text(pinfo, ti, &ei_vnc_too_many_rectangles, + "Too many rectangles (%d), aborting dissection", num_rects); return(0); } @@ -2071,8 +2080,8 @@ vnc_rre_encoding(tvbuff_t *tvb, packet_info *pinfo, gint *offset, *offset += 4; if (num_subrects > 10000) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, - "Too many sub-rectangles, aborting dissection"); + expert_add_info_format_text(pinfo, ti, &ei_vnc_too_many_sub_rectangles, + "Too many sub-rectangles (%d), aborting dissection", num_subrects); return(0); } @@ -2972,8 +2981,7 @@ vnc_tight_encoding(tvbuff_t *tvb, packet_info *pinfo, gint *offset, } else if (comp_ctl > TIGHT_RECT_MAX_VALUE) { /* invalid encoding */ - expert_add_info_format(pinfo, compression_type_ti, PI_MALFORMED, PI_ERROR, - "Invalid encoding"); + expert_add_info(pinfo, compression_type_ti, &ei_vnc_invalid_encoding); } else { guint row_size; gint bits_per_pixel; @@ -3123,8 +3131,7 @@ vnc_server_set_colormap_entries(tvbuff_t *tvb, packet_info *pinfo, gint *offset, *offset, 2, ENC_BIG_ENDIAN); if (number_of_colors > 10000) { - expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_ERROR, - "Too many colors (%d), aborting dissection", + expert_add_info_format_text(pinfo, ti, &ei_vnc_too_many_colors,"Too many colors (%d), aborting dissection", number_of_colors); return(0); } @@ -3191,8 +3198,8 @@ vnc_server_cut_text(tvbuff_t *tvb, packet_info *pinfo, gint *offset, *offset += 4; if (text_len > 100000) { - expert_add_info_format(pinfo, pi, PI_MALFORMED, PI_ERROR, - "Too much cut text, aborting dissection"); + expert_add_info_format_text(pinfo, pi, &ei_vnc_too_many_cut_text, + "Too much cut text (%d), aborting dissection", text_len); return(0); } @@ -3263,6 +3270,7 @@ void proto_register_vnc(void) { module_t *vnc_module; /* To handle our preferences */ + expert_module_t* expert_vnc; /* Setup list of header fields */ static hf_register_info hf[] = { @@ -4441,6 +4449,17 @@ proto_register_vnc(void) &ett_vnc_slrle_subline }; + static ei_register_info ei[] = { + { &ei_vnc_possible_gtk_vnc_bug, { "vnc.possible_gtk_vnc_bug", PI_MALFORMED, PI_ERROR, "client -> server greeting must be 12 bytes (possible gtk-vnc bug)", EXPFILL }}, + { &ei_vnc_auth_code_mismatch, { "vnc.auth_code_mismatch", PI_PROTOCOL, PI_WARN, "Authentication code does not match vendor or signature", EXPFILL }}, + { &ei_vnc_unknown_tight_vnc_auth, { "vnc.unknown_tight_vnc_auth", PI_PROTOCOL, PI_ERROR, "Unknown TIGHT VNC authentication", EXPFILL }}, + { &ei_vnc_too_many_rectangles, { "vnc.too_many_rectangles", PI_MALFORMED, PI_ERROR, "Too many rectangles, aborting dissection", EXPFILL }}, + { &ei_vnc_too_many_sub_rectangles, { "vnc.too_many_sub_rectangles", PI_MALFORMED, PI_ERROR, "Too many sub-rectangles, aborting dissection", EXPFILL }}, + { &ei_vnc_invalid_encoding, { "vnc.invalid_encoding", PI_MALFORMED, PI_ERROR, "Invalid encoding", EXPFILL }}, + { &ei_vnc_too_many_colors, { "vnc.too_many_colors", PI_MALFORMED, PI_ERROR, "Too many colors, aborting dissection", EXPFILL }}, + { &ei_vnc_too_many_cut_text, { "vnc.too_many_cut_text", PI_MALFORMED, PI_ERROR, "Too much cut text, aborting dissection", EXPFILL }}, + }; + /* Register the protocol name and description */ proto_vnc = proto_register_protocol("Virtual Network Computing", "VNC", "vnc"); @@ -4448,6 +4467,8 @@ proto_register_vnc(void) /* Required function calls to register the header fields and subtrees */ proto_register_field_array(proto_vnc, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_vnc = expert_register_protocol(proto_vnc); + expert_register_field_array(expert_vnc, ei, array_length(ei)); /* Register our preferences module */ vnc_module = prefs_register_protocol(proto_vnc, proto_reg_handoff_vnc); |