diff --git a/epan/dissectors/packet-6lowpan.c b/epan/dissectors/packet-6lowpan.c index 394c876c97..bb439fab45 100644 --- a/epan/dissectors/packet-6lowpan.c +++ b/epan/dissectors/packet-6lowpan.c @@ -302,6 +302,10 @@ static gint ett_6lowpan_mesh_flags = -1; static gint ett_6lowpan_frag = -1; static gint ett_6lopwan_traffic_class = -1; +static expert_field ei_6lowpan_hc1_more_bits = EI_INIT; +static expert_field ei_6lowpan_illegal_dest_addr_mode = EI_INIT; +static expert_field ei_6lowpan_bad_ipv6_header_length = EI_INIT; + /* Subdissector handles. */ static dissector_handle_t data_handle; static dissector_handle_t ipv6_handle; @@ -1065,7 +1069,7 @@ dissect_6lowpan_hc1(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint dg } else { /* HC1 states there are more bits, but an illegal next header was defined. */ - expert_add_info_format(pinfo, NULL, PI_MALFORMED, PI_ERROR, "HC1 more bits expected for illegal next header type."); + expert_add_info(pinfo, NULL, &ei_6lowpan_hc1_more_bits); return NULL; } } @@ -1608,7 +1612,7 @@ dissect_6lowpan_iphc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint d } else { /* Illegal destination address compression mode. */ - expert_add_info_format(pinfo, ti_dam, PI_MALFORMED, PI_ERROR, "Illegal destination address mode"); + expert_add_info(pinfo, ti_dam, &ei_6lowpan_illegal_dest_addr_mode); return NULL; } } @@ -1633,7 +1637,7 @@ dissect_6lowpan_iphc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint d } else { /* Illegal destination address compression mode. */ - expert_add_info_format(pinfo, ti_dam, PI_MALFORMED, PI_ERROR, "Illegal destination address mode"); + expert_add_info(pinfo, ti_dam, &ei_6lowpan_illegal_dest_addr_mode); return NULL; } } @@ -1646,7 +1650,7 @@ dissect_6lowpan_iphc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint d /* (DAC=1 && DAM=00) -> reserved value. */ if ((iphc_flags & LOWPAN_IPHC_FLAG_DST_COMP) && (iphc_dst_mode == LOWPAN_IPHC_ADDR_FULL_INLINE)) { /* Illegal destination address compression mode. */ - expert_add_info_format(pinfo, ti_dam, PI_MALFORMED, PI_ERROR, "Illegal destination address mode"); + expert_add_info(pinfo, ti_dam, &ei_6lowpan_illegal_dest_addr_mode); return NULL; } /* The IID is derived from the link-layer source. */ @@ -2293,18 +2297,16 @@ dissect_6lowpan_frag_first(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, else if (tvb_get_bits8(frag_tvb, 0, LOWPAN_PATTERN_HC1_BITS) == LOWPAN_PATTERN_HC1) { /* Check if the datagram size is sane. */ if (dgram_size < (gint)sizeof(struct ip6_hdr)) { - expert_add_info_format(pinfo, length_item, PI_MALFORMED, - PI_ERROR, "Length is less than IPv6 header length %u", - (guint)sizeof(struct ip6_hdr)); + expert_add_info_format_text(pinfo, length_item, &ei_6lowpan_bad_ipv6_header_length, + "Length is less than IPv6 header length %u", (guint)sizeof(struct ip6_hdr)); } frag_tvb = dissect_6lowpan_hc1(frag_tvb, pinfo, tree, dgram_size, siid, diid); } else if (tvb_get_bits8(frag_tvb, 0, LOWPAN_PATTERN_IPHC_BITS) == LOWPAN_PATTERN_IPHC) { /* Check if the datagram size is sane. */ if (dgram_size < (gint)sizeof(struct ip6_hdr)) { - expert_add_info_format(pinfo, length_item, PI_MALFORMED, - PI_ERROR, "Length is less than IPv6 header length %u", - (guint)sizeof(struct ip6_hdr)); + expert_add_info_format_text(pinfo, length_item, &ei_6lowpan_bad_ipv6_header_length, + "Length is less than IPv6 header length %u", (guint)sizeof(struct ip6_hdr)); } frag_tvb = dissect_6lowpan_iphc(frag_tvb, pinfo, tree, dgram_size, siid, diid); } @@ -2732,12 +2734,21 @@ proto_register_6lowpan(void) &ett_6lowpan_fragments }; + static ei_register_info ei[] = { + { &ei_6lowpan_hc1_more_bits, { "6lowpan.hc1_more_bits", PI_MALFORMED, PI_ERROR, "HC1 more bits expected for illegal next header type.", EXPFILL }}, + { &ei_6lowpan_illegal_dest_addr_mode, { "6lowpan.illegal_dest_addr_mode", PI_MALFORMED, PI_ERROR, "Illegal destination address mode", EXPFILL }}, + { &ei_6lowpan_bad_ipv6_header_length, { "6lowpan.bad_ipv6_header_length", PI_MALFORMED, PI_ERROR, "Length is less than IPv6 header length", EXPFILL }}, + }; + int i; module_t *prefs_module; + expert_module_t* expert_6lowpan; proto_6lowpan = proto_register_protocol("IPv6 over IEEE 802.15.4", "6LoWPAN", "6lowpan"); proto_register_field_array(proto_6lowpan, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_6lowpan = expert_register_protocol(proto_6lowpan); + expert_register_field_array(expert_6lowpan, ei, array_length(ei)); /* Register the dissector with wireshark. */ register_dissector("6lowpan", dissect_6lowpan, proto_6lowpan); diff --git a/epan/dissectors/packet-amr.c b/epan/dissectors/packet-amr.c index f8e47609c4..9b284b062d 100644 --- a/epan/dissectors/packet-amr.c +++ b/epan/dissectors/packet-amr.c @@ -77,6 +77,11 @@ static int hf_amr_wb_if2_ft = -1; static int ett_amr = -1; static int ett_amr_toc = -1; +static expert_field ei_amr_spare_bit_not0 = EI_INIT; +static expert_field ei_amr_not_enough_data_for_frames = EI_INIT; +static expert_field ei_amr_superfluous_data = EI_INIT; +static expert_field ei_amr_padding_bits_not0 = EI_INIT; + /* The dynamic payload type which will be dissected as AMR */ static guint temp_dynamic_payload_type = 0; @@ -222,7 +227,7 @@ dissect_amr_nb_if1(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { if (octet == AMR_NB_SID) { ti = proto_tree_add_item(tree, hf_amr_nb_if1_mode_req, tvb, offset+1, 1, ENC_BIG_ENDIAN); if (tvb_get_guint8(tvb,offset+1) & 0x1f) - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Error:Spare bits not 0"); + expert_add_info(pinfo, ti, &ei_amr_spare_bit_not0); proto_tree_add_text(tree, tvb, offset+2, 5, "Speech data"); proto_tree_add_item(tree, hf_amr_if1_sti, tvb, offset+7, 1, ENC_BIG_ENDIAN); proto_tree_add_item(tree, hf_amr_nb_if1_sti_mode_ind, tvb, offset+7, 1, ENC_BIG_ENDIAN); @@ -233,7 +238,7 @@ dissect_amr_nb_if1(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { offset += 1; ti = proto_tree_add_item(tree, hf_amr_nb_if1_mode_req, tvb, offset, 1, ENC_BIG_ENDIAN); if (tvb_get_guint8(tvb,offset) & 0x1f) - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Error:Spare bits not 0"); + expert_add_info(pinfo, ti, &ei_amr_spare_bit_not0); offset += 1; proto_tree_add_text(tree, tvb, offset, -1, "Speech data"); } @@ -248,7 +253,7 @@ dissect_amr_wb_if1(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { proto_tree_add_item(tree, hf_amr_wb_if1_ft, tvb, offset, 1, ENC_BIG_ENDIAN); ti = proto_tree_add_item(tree, hf_amr_if1_fqi, tvb, offset, 1, ENC_BIG_ENDIAN); if (tvb_get_guint8(tvb,offset) & 0x03) - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Error:Spare bits not 0"); + expert_add_info(pinfo, ti, &ei_amr_spare_bit_not0); octet = (tvb_get_guint8(tvb,offset) & 0xf0) >> 4; if (octet == AMR_WB_SID) { proto_tree_add_item(tree, hf_amr_wb_if1_mode_req, tvb, offset+1, 1, ENC_BIG_ENDIAN); @@ -394,7 +399,7 @@ dissect_amr_be(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint amr proto_item_append_text(item, " %d Bytes available, %d would be needed!", tvb_reported_length_remaining(tvb, bitcount/8), bytes_needed_for_frames); - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Not enough data for the frames according to TOC"); + expert_add_info(pinfo, item, &ei_amr_not_enough_data_for_frames); } else { item = proto_tree_add_text(tree, tvb, bitcount/8, bytes_needed_for_frames, "Frame Data"); @@ -406,7 +411,7 @@ dissect_amr_be(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint amr if (tvb_reported_length_remaining(tvb, (bitcount+8)/8) > 0) { item = proto_tree_add_text(tree, tvb, bitcount/8, tvb_reported_length_remaining(tvb, bitcount/8), "Error:"); proto_item_append_text(item, " %d Bytes remaining - should be 0!",tvb_reported_length_remaining(tvb, (bitcount+8)/8)); - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Superfluous data remaining"); + expert_add_info(pinfo, item, &ei_amr_superfluous_data); /* Now check the paddings */ if (bitcount%8 != 0) { @@ -414,7 +419,7 @@ dissect_amr_be(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint amr proto_tree_add_text(tree, tvb, bitcount/8, 1, "Padding bits correct"); else { item = proto_tree_add_text(tree, tvb, bitcount/8, 1, "Padding bits error"); - expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Padding bits error - MUST be 0"); + expert_add_info(pinfo, item, &ei_amr_padding_bits_not0); } } } @@ -609,6 +614,7 @@ void proto_register_amr(void) { module_t *amr_module; + expert_module_t* expert_amr; static hf_register_info hf[] = { { &hf_amr_nb_cmr, @@ -728,6 +734,14 @@ proto_register_amr(void) &ett_amr, &ett_amr_toc, }; + + static ei_register_info ei[] = { + { &ei_amr_spare_bit_not0, { "amr.spare_bit_not0", PI_PROTOCOL, PI_WARN, "Error:Spare bits not 0", EXPFILL }}, + { &ei_amr_not_enough_data_for_frames, { "amr.not_enough_data_for_frames", PI_MALFORMED, PI_ERROR, "Not enough data for the frames according to TOC", EXPFILL }}, + { &ei_amr_superfluous_data, { "amr.superfluous_data", PI_MALFORMED, PI_ERROR, "Superfluous data remaining", EXPFILL }}, + { &ei_amr_padding_bits_not0, { "amr.padding_bits_not0", PI_MALFORMED, PI_ERROR, "Padding bits error - MUST be 0", EXPFILL }}, + }; + static const enum_val_t encoding_types[] = { {"RFC 3267 Byte aligned", "RFC 3267 octet aligned", 0}, {"RFC 3267 Bandwidth-efficient", "RFC 3267 BW-efficient", 1}, @@ -748,6 +762,8 @@ proto_register_amr(void) /* Required function calls to register the header fields and subtrees used */ proto_register_field_array(proto_amr, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_amr = expert_register_protocol(proto_amr); + expert_register_field_array(expert_amr, ei, array_length(ei)); /* Register a configuration option for port */ amr_module = prefs_register_protocol(proto_amr, proto_reg_handoff_amr); diff --git a/epan/dissectors/packet-beep.c b/epan/dissectors/packet-beep.c index 67a95f3e7b..71a25616ff 100644 --- a/epan/dissectors/packet-beep.c +++ b/epan/dissectors/packet-beep.c @@ -114,6 +114,11 @@ static int ett_mime_header = -1; static int ett_header = -1; static int ett_trailer = -1; +static expert_field ei_beep_more = EI_INIT; +static expert_field ei_beep_cr_terminator = EI_INIT; +static expert_field ei_beep_lf_terminator = EI_INIT; +static expert_field ei_beep_invalid_terminator = EI_INIT; + /* Get the state of the more flag ... */ #define BEEP_VIOL 0 @@ -229,7 +234,7 @@ dissect_beep_more(tvbuff_t *tvb, packet_info *pinfo, int offset, ret = 1; break; default: - expert_add_info_format(pinfo, hidden_item, PI_PROTOCOL, PI_WARN, "Expected More Flag (* or .)"); + expert_add_info(pinfo, hidden_item, &ei_beep_more); ret = -1; break; } @@ -289,7 +294,7 @@ check_term(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree) if ((tvb_get_guint8(tvb, offset) == 0x0d) && !global_beep_strict_term) { ti = proto_tree_add_text(tree, tvb, offset, 1, "Terminator: CR"); - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Nonstandard Terminator: CR"); + expert_add_info(pinfo, ti, &ei_beep_cr_terminator); return 1; } @@ -297,12 +302,12 @@ check_term(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree) if ((tvb_get_guint8(tvb, offset) == 0x0a) && !global_beep_strict_term) { ti = proto_tree_add_text(tree, tvb, offset, 1, "Terminator: LF"); - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Nonstandard Terminator: LF"); + expert_add_info(pinfo, ti, &ei_beep_lf_terminator); return 1; } ti = proto_tree_add_text(tree, tvb, offset, 1, "Terminator: %s", tvb_format_text(tvb, offset, 2)); - expert_add_info_format(pinfo, ti, PI_PROTOCOL, PI_WARN, "Invalid Terminator: %s", tvb_format_text(tvb, offset, 2)); + expert_add_info_format_text(pinfo, ti, &ei_beep_invalid_terminator, "Invalid Terminator: %s", tvb_format_text(tvb, offset, 2)); return -1; } @@ -974,13 +979,23 @@ proto_register_beep(void) &ett_header, &ett_trailer, }; + static ei_register_info ei[] = { + { &ei_beep_more, { "beep.more.expected", PI_PROTOCOL, PI_WARN, "Expected More Flag (* or .)", EXPFILL }}, + { &ei_beep_cr_terminator, { "beep.cr_terminator", PI_PROTOCOL, PI_WARN, "Nonstandard Terminator: CR", EXPFILL }}, + { &ei_beep_lf_terminator, { "beep.lf_terminator", PI_PROTOCOL, PI_WARN, "Nonstandard Terminator: LF", EXPFILL }}, + { &ei_beep_invalid_terminator, { "beep.invalid_terminator", PI_PROTOCOL, PI_WARN, "Invalid Terminator", EXPFILL }}, + }; + module_t *beep_module; + expert_module_t* expert_beep; proto_beep = proto_register_protocol("Blocks Extensible Exchange Protocol", "BEEP", "beep"); proto_register_field_array(proto_beep, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_beep = expert_register_protocol(proto_beep); + expert_register_field_array(expert_beep, ei, array_length(ei)); register_init_routine(&beep_init_protocol); /* Register our configuration options for BEEP, particularly our port */ diff --git a/epan/dissectors/packet-bgp.c b/epan/dissectors/packet-bgp.c index 5c997ab166..5a36b639e0 100644 --- a/epan/dissectors/packet-bgp.c +++ b/epan/dissectors/packet-bgp.c @@ -769,6 +769,12 @@ static gint ett_bgp_tunnel_tlv_subtree = -1; static gint ett_bgp_tunnel_subtlv = -1; static gint ett_bgp_tunnel_subtlv_subtree = -1; +static expert_field ei_bgp_cap_len_bad = EI_INIT; +static expert_field ei_bgp_cap_gr_helper_mode_only = EI_INIT; +static expert_field ei_bgp_notify_minor_unknown = EI_INIT; +static expert_field ei_bgp_route_refresh_orf_type_unknown = EI_INIT; +static expert_field ei_bgp_length_invalid = EI_INIT; + /* desegmentation */ static gboolean bgp_desegment = TRUE; @@ -2095,14 +2101,14 @@ dissect_bgp_capability_item(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, switch (ctype) { case BGP_CAPABILITY_RESERVED: if (clen != 0) { - expert_add_info_format(pinfo, ti_len, PI_MALFORMED, PI_ERROR, "Capability length %u wrong, must be = 0", clen); + expert_add_info_format_text(pinfo, ti_len, &ei_bgp_cap_len_bad, "Capability length %u wrong, must be = 0", clen); proto_tree_add_item(cap_tree, hf_bgp_cap_unknown, tvb, offset, clen, ENC_NA); } offset += clen; break; case BGP_CAPABILITY_MULTIPROTOCOL: if (clen != 4) { - expert_add_info_format(pinfo, ti_len, PI_MALFORMED, PI_ERROR, "Capability length %u is wrong, must be = 4", clen); + expert_add_info_format_text(pinfo, ti_len, &ei_bgp_cap_len_bad, "Capability length %u is wrong, must be = 4", clen); proto_tree_add_item(cap_tree, hf_bgp_cap_unknown, tvb, offset, clen, ENC_NA); offset += clen; } @@ -2123,7 +2129,7 @@ dissect_bgp_capability_item(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, break; case BGP_CAPABILITY_GRACEFUL_RESTART: if ((clen < 6) && (clen != 2)) { - expert_add_info_format(pinfo, ti_len, PI_MALFORMED, PI_ERROR, "Capability length %u too short, must be greater than 6", clen); + expert_add_info_format_text(pinfo, ti_len, &ei_bgp_cap_len_bad, "Capability length %u too short, must be greater than 6", clen); proto_tree_add_item(cap_tree, hf_bgp_cap_unknown, tvb, offset, clen, ENC_NA); offset += clen; } @@ -2132,7 +2138,7 @@ dissect_bgp_capability_item(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, proto_tree *sub_tree; if (clen == 2){ - expert_add_info_format(pinfo, ti_len, PI_REQUEST_CODE, PI_CHAT, "Graceful Restart Capability supported in Helper mode only"); + expert_add_info(pinfo, ti_len, &ei_bgp_cap_gr_helper_mode_only); } /* Timers */ @@ -2165,7 +2171,7 @@ dissect_bgp_capability_item(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, break; case BGP_CAPABILITY_4_OCTET_AS_NUMBER: if (clen != 4) { - expert_add_info_format(pinfo, ti_len, PI_MALFORMED, PI_ERROR, "Capability length %u is wrong, must be = 4", clen); + expert_add_info_format_text(pinfo, ti_len, &ei_bgp_cap_len_bad, "Capability length %u is wrong, must be = 4", clen); proto_tree_add_item(cap_tree, hf_bgp_cap_unknown, tvb, offset, clen, ENC_NA); offset += clen; } @@ -2186,7 +2192,7 @@ dissect_bgp_capability_item(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, break; case BGP_CAPABILITY_ADDITIONAL_PATHS: if (clen != 4) { - expert_add_info_format(pinfo, ti_len, PI_MALFORMED, PI_ERROR, "Capability length %u is wrong, must be = 4", clen); + expert_add_info_format_text(pinfo, ti_len, &ei_bgp_cap_len_bad, "Capability length %u is wrong, must be = 4", clen); proto_tree_add_item(cap_tree, hf_bgp_cap_unknown, tvb, offset, clen, ENC_NA); offset += clen; } @@ -2210,7 +2216,7 @@ dissect_bgp_capability_item(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, case BGP_CAPABILITY_ROUTE_REFRESH_CISCO: case BGP_CAPABILITY_ROUTE_REFRESH: if (clen != 0) { - expert_add_info_format(pinfo, ti_len, PI_MALFORMED, PI_ERROR, "Capability length %u wrong, must be = 0", clen); + expert_add_info_format_text(pinfo, ti_len, &ei_bgp_cap_len_bad, "Capability length %u wrong, must be = 0", clen); proto_tree_add_item(cap_tree, hf_bgp_cap_unknown, tvb, offset, clen, ENC_NA); } offset += clen; @@ -2218,7 +2224,7 @@ dissect_bgp_capability_item(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, case BGP_CAPABILITY_ORF_CISCO: case BGP_CAPABILITY_COOPERATIVE_ROUTE_FILTERING: if (clen < 6) { - expert_add_info_format(pinfo, ti_len, PI_MALFORMED, PI_ERROR, "Capability length %u too short, must be greater than 6", clen); + expert_add_info_format_text(pinfo, ti_len, &ei_bgp_cap_len_bad, "Capability length %u too short, must be greater than 6", clen); proto_tree_add_item(cap_tree, hf_bgp_cap_unknown, tvb, offset, clen, ENC_NA); offset += clen; } @@ -3563,7 +3569,7 @@ dissect_bgp_notification(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo) break; default: ti = proto_tree_add_item(tree, hf_bgp_notify_minor_unknown, tvb, offset, 1, ENC_NA); - expert_add_info_format(pinfo, ti, PI_UNDECODED, PI_NOTE, "Unknown notification error (%d)",major_error); + expert_add_info_format_text(pinfo, ti, &ei_bgp_notify_minor_unknown, "Unknown notification error (%d)",major_error); break; } offset += 1; @@ -3649,7 +3655,7 @@ example 2 p += 2; if (orftype != BGP_ORF_PREFIX_CISCO) { - expert_add_info_format(pinfo, ti1, PI_CHAT, PI_ERROR, "ORFEntry-Unknown (type %u)", orftype); + expert_add_info_format_text(pinfo, ti1, &ei_bgp_route_refresh_orf_type_unknown, "ORFEntry-Unknown (type %u)", orftype); p += orflen; continue; } @@ -3761,7 +3767,7 @@ dissect_bgp_pdu(tvbuff_t *volatile tvb, packet_info *pinfo, proto_tree *tree, } if (bgp_len < BGP_HEADER_SIZE || bgp_len > BGP_MAX_PACKET_SIZE) { - expert_add_info_format(pinfo, ti_len, PI_MALFORMED, PI_ERROR, "Length is invalid %u", bgp_len); + expert_add_info_format_text(pinfo, ti_len, &ei_bgp_length_invalid, "Length is invalid %u", bgp_len); return; } @@ -4427,7 +4433,17 @@ proto_register_bgp(void) &ett_bgp_tunnel_subtlv, &ett_bgp_tunnel_subtlv_subtree, }; + static ei_register_info ei[] = { + { &ei_bgp_cap_len_bad, { "bgp.cap.length.bad", PI_MALFORMED, PI_ERROR, "Capability length is wrong", EXPFILL }}, + { &ei_bgp_cap_gr_helper_mode_only, { "bgp.cap.gr.helper_mode_only", PI_REQUEST_CODE, PI_CHAT, "Graceful Restart Capability supported in Helper mode only", EXPFILL }}, + { &ei_bgp_notify_minor_unknown, { "bgp.notify.minor_error.unknown", PI_UNDECODED, PI_NOTE, "Unknown notification error", EXPFILL }}, + { &ei_bgp_route_refresh_orf_type_unknown, { "bgp.route_refresh.orf.type.unknown", PI_CHAT, PI_ERROR, "ORFEntry-Unknown", EXPFILL }}, + { &ei_bgp_length_invalid, { "bgp.length.invalid", PI_MALFORMED, PI_ERROR, "Length is invalid", EXPFILL }}, + }; + module_t *bgp_module; + expert_module_t* expert_bgp; + static const enum_val_t asn_len[] = { {"auto-detect", "Auto-detect", 0}, {"2", "2 octet", 2}, @@ -4439,6 +4455,8 @@ proto_register_bgp(void) "BGP", "bgp"); proto_register_field_array(proto_bgp, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_bgp = expert_register_protocol(proto_bgp); + expert_register_field_array(expert_bgp, ei, array_length(ei)); bgp_module = prefs_register_protocol(proto_bgp, NULL); prefs_register_bool_preference(bgp_module, "desegment", diff --git a/epan/dissectors/packet-capwap.c b/epan/dissectors/packet-capwap.c index c152aa20bb..8a74c52c91 100644 --- a/epan/dissectors/packet-capwap.c +++ b/epan/dissectors/packet-capwap.c @@ -264,6 +264,9 @@ static gint ett_capwap = -1; static gint ett_msg_fragment = -1; static gint ett_msg_fragments = -1; +static expert_field ei_capwap_header_length_bad = EI_INIT; + + /* ************************************************************************* */ /* Fragment items */ /* ************************************************************************* */ @@ -1326,7 +1329,7 @@ dissect_capwap_header(tvbuff_t *tvb, proto_tree *capwap_control_tree, guint offs } if ((plen != hlen) && global_capwap_draft_8_cisco == 0) { - expert_add_info_format(pinfo, ti_len, PI_MALFORMED, PI_WARN, "Wrong calculate length (%d) =! header length (%d) ! (May be try to use Cisco Wireless Controller Support Preference ?)", plen, hlen); + expert_add_info_format_text(pinfo, ti_len, &ei_capwap_header_length_bad, "Wrong calculate length (%d) =! header length (%d) ! (May be try to use Cisco Wireless Controller Support Preference ?)", plen, hlen); } return hlen; } @@ -2218,6 +2221,12 @@ proto_register_capwap_control(void) &ett_msg_fragments }; + static ei_register_info ei[] = { + { &ei_capwap_header_length_bad, { "capwap.header.length.bad", PI_MALFORMED, PI_WARN, "Wrong calculate length =! header length", EXPFILL }}, + }; + + expert_module_t* expert_capwap; + /* Register the protocol name and description */ proto_capwap = proto_register_protocol("Control And Provisioning of Wireless Access Points", "CAPWAP", "capwap"); @@ -2226,6 +2235,9 @@ proto_register_capwap_control(void) proto_register_subtree_array(ett, array_length(ett)); + expert_capwap = expert_register_protocol(proto_capwap); + expert_register_field_array(expert_capwap, ei, array_length(ei)); + register_init_routine(&capwap_reassemble_init); /* Register preferences module (See Section 2.6 for more on preferences) */ diff --git a/epan/dissectors/packet-dbus.c b/epan/dissectors/packet-dbus.c index 2cc4945df2..de09f029b7 100644 --- a/epan/dissectors/packet-dbus.c +++ b/epan/dissectors/packet-dbus.c @@ -62,6 +62,11 @@ static int ett_dbus_hdr = -1; static int ett_dbus_body = -1; static int ett_dbus_field = -1; +static expert_field ei_dbus_value_bool_invalid = EI_INIT; +static expert_field ei_dbus_value_str_invalid = EI_INIT; +static expert_field ei_dbus_invalid_object_path = EI_INIT; +static expert_field ei_dbus_invalid_signature = EI_INIT; + static int proto_dbus = -1; #define DBUS_MESSAGE_TYPE_INVALID 0 @@ -182,7 +187,7 @@ dissect_dbus_sig(tvbuff_t *tvb, dbus_info_t *dinfo, proto_tree *tree, int offset ti = proto_tree_add_boolean_format(tree, hf_dbus_value_bool, tvb, org_offset, offset - org_offset, val, "BOOLEAN: %s", val ? "True" : "False"); if (val != 0 && val != 1) { - expert_add_info_format(dinfo->pinfo, ti, PI_PROTOCOL, PI_WARN, "Invalid boolean value (must be 0 or 1 is: %u)", val); + expert_add_info_format_text(dinfo->pinfo, ti, &ei_dbus_value_bool_invalid, "Invalid boolean value (must be 0 or 1 is: %u)", val); return -1; } ret->uint = val; @@ -268,13 +273,13 @@ dissect_dbus_sig(tvbuff_t *tvb, dbus_info_t *dinfo, proto_tree *tree, int offset if (sig == 's') { ti = proto_tree_add_string_format(tree, hf_dbus_value_str, tvb, org_offset, offset - org_offset, val, "STRING: %s", val); if (!g_utf8_validate(val, -1, NULL)) { - expert_add_info_format(dinfo->pinfo, ti, PI_PROTOCOL, PI_WARN, "Invalid string (not UTF-8)"); + expert_add_info(dinfo->pinfo, ti, &ei_dbus_value_str_invalid); return -1; } } else { ti = proto_tree_add_string_format(tree, hf_dbus_value_str, tvb, org_offset, offset - org_offset, val, "OBJECT_PATH: %s", val); if (!dbus_validate_object_path(val)) { - expert_add_info_format(dinfo->pinfo, ti, PI_PROTOCOL, PI_WARN, "Invalid object_path"); + expert_add_info(dinfo->pinfo, ti, &ei_dbus_invalid_object_path); return -1; } } @@ -295,7 +300,7 @@ dissect_dbus_sig(tvbuff_t *tvb, dbus_info_t *dinfo, proto_tree *tree, int offset ti = proto_tree_add_string_format(tree, hf_dbus_value_str, tvb, org_offset, offset - org_offset, val, "SIGNATURE: %s", val); if (!dbus_validate_signature(val)) { - expert_add_info_format(dinfo->pinfo, ti, PI_PROTOCOL, PI_WARN, "Invalid signature"); + expert_add_info(dinfo->pinfo, ti, &ei_dbus_invalid_signature); return -1; } ret->str = val; @@ -326,7 +331,7 @@ dissect_dbus_field_signature(tvbuff_t *tvb, dbus_info_t *dinfo, proto_tree *tree ti = proto_tree_add_string(tree, hf_dbus_type_signature, tvb, org_offset, offset - org_offset, sig); if (!dbus_validate_signature(sig)) { - expert_add_info_format(dinfo->pinfo, ti, PI_PROTOCOL, PI_WARN, "Invalid signature"); + expert_add_info(dinfo->pinfo, ti, &ei_dbus_invalid_signature); return -1; } @@ -648,10 +653,21 @@ proto_register_dbus(void) &ett_dbus_field }; + static ei_register_info ei[] = { + { &ei_dbus_value_bool_invalid, { "dbus.value.bool.invalid", PI_PROTOCOL, PI_WARN, "Invalid boolean value", EXPFILL }}, + { &ei_dbus_value_str_invalid, { "dbus.value.str.invalid", PI_PROTOCOL, PI_WARN, "Invalid string (not UTF-8)", EXPFILL }}, + { &ei_dbus_invalid_object_path, { "dbus.invalid_object_path", PI_PROTOCOL, PI_WARN, "Invalid object_path", EXPFILL }}, + { &ei_dbus_invalid_signature, { "dbus.invalid_signature", PI_PROTOCOL, PI_WARN, "Invalid signature", EXPFILL }}, + }; + + expert_module_t* expert_dbus; + proto_dbus = proto_register_protocol("D-Bus", "D-BUS", "dbus"); proto_register_field_array(proto_dbus, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_dbus = expert_register_protocol(proto_dbus); + expert_register_field_array(expert_dbus, ei, array_length(ei)); } void diff --git a/epan/dissectors/packet-dccp.c b/epan/dissectors/packet-dccp.c index 40e56e7d8c..6eff1bd0c2 100644 --- a/epan/dissectors/packet-dccp.c +++ b/epan/dissectors/packet-dccp.c @@ -184,6 +184,10 @@ static int hf_dccp_data_checksum = -1; static gint ett_dccp = -1; static gint ett_dccp_options = -1; +static expert_field ei_dccp_option_len_bad = EI_INIT; +static expert_field ei_dccp_advertised_header_length_bad = EI_INIT; +static expert_field ei_dccp_packet_type_reserved = EI_INIT; + static dissector_table_t dccp_subdissector_table; static heur_dissector_list_t heur_subdissector_list; static dissector_handle_t data_handle; @@ -408,7 +412,7 @@ dissect_options(tvbuff_t *tvb, packet_info *pinfo _U_, option_len = tvb_get_guint8(tvb, offset + 1); if (option_len < 2) { - expert_add_info_format(pinfo, option_item, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, option_item, &ei_dccp_option_len_bad, "Option length incorrect, must be >= 2"); return; } @@ -452,7 +456,7 @@ dissect_options(tvbuff_t *tvb, packet_info *pinfo _U_, break; case 37: if (option_len > 8) - expert_add_info_format(pinfo, option_item, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, option_item, &ei_dccp_option_len_bad, "NDP Count too long (max 6 bytes)"); else proto_tree_add_text(dccp_options_tree, tvb, offset, option_len, @@ -491,7 +495,7 @@ dissect_options(tvbuff_t *tvb, packet_info *pinfo _U_, offset + 2, 4, tvb_get_ntohl(tvb, offset + 2)); else - expert_add_info_format(pinfo, option_item, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, option_item, &ei_dccp_option_len_bad, "Timestamp too long [%u != 6]", option_len); break; case 42: @@ -514,7 +518,7 @@ dissect_options(tvbuff_t *tvb, packet_info *pinfo _U_, tvb, offset + 6, 4, tvb_get_ntohl(tvb, offset + 6)); } else - expert_add_info_format(pinfo, option_item, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, option_item, &ei_dccp_option_len_bad, "Wrong Timestamp Echo length"); break; case 43: @@ -527,7 +531,7 @@ dissect_options(tvbuff_t *tvb, packet_info *pinfo _U_, tvb, offset + 2, 4, tvb_get_ntohl(tvb, offset + 2)); else - expert_add_info_format(pinfo, option_item, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, option_item, &ei_dccp_option_len_bad, "Wrong Elapsed Time length"); break; case 44: @@ -536,7 +540,7 @@ dissect_options(tvbuff_t *tvb, packet_info *pinfo _U_, tvb, offset + 2, 4, tvb_get_ntohl(tvb, offset + 2)); } else - expert_add_info_format(pinfo, option_item, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, option_item, &ei_dccp_option_len_bad, "Wrong Data checksum length"); break; case 192: /* RFC 4342, 8.5 */ @@ -555,7 +559,7 @@ dissect_options(tvbuff_t *tvb, packet_info *pinfo _U_, option_len, "CCID3 Loss Event Rate: %u", p); } else - expert_add_info_format(pinfo, option_item, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, option_item, &ei_dccp_option_len_bad, "Wrong CCID3 Loss Event Rate length"); break; case 193: /* RFC 4342, 8.6 */ @@ -572,7 +576,7 @@ dissect_options(tvbuff_t *tvb, packet_info *pinfo _U_, "CCID3 Receive Rate: %u bytes/sec", tvb_get_ntohl(tvb, offset + 2)); else - expert_add_info_format(pinfo, option_item, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, option_item, &ei_dccp_option_len_bad, "Wrong CCID3 Receive Rate length"); break; default: @@ -803,7 +807,7 @@ dissect_dccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ if (dccph->x) { if (advertised_dccp_header_len < DCCP_GEN_HDR_LEN_X) { - expert_add_info_format(pinfo, offset_item, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, offset_item, &ei_dccp_advertised_header_length_bad, "Advertised header length (%u) is smaller than the minimum (%u)", advertised_dccp_header_len, DCCP_GEN_HDR_LEN_X); return tvb_length(tvb); @@ -821,7 +825,7 @@ dissect_dccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ offset += 6; } else { if (advertised_dccp_header_len < DCCP_GEN_HDR_LEN_NO_X) { - expert_add_info_format(pinfo, offset_item, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, offset_item, &ei_dccp_advertised_header_length_bad, "Advertised header length (%u) is smaller than the minimum (%u)", advertised_dccp_header_len, DCCP_GEN_HDR_LEN_NO_X); return tvb_length(tvb); @@ -844,7 +848,7 @@ dissect_dccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ case 0x0: /* DCCP-Request */ case 0xA: /* DCCP-Listen */ if (advertised_dccp_header_len < offset + 4) { - expert_add_info_format(pinfo, offset_item, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, offset_item, &ei_dccp_advertised_header_length_bad, "Advertised header length (%u) is smaller than the minimum (%u) for %s", advertised_dccp_header_len, offset + 4, val_to_str(dccph->type, dccp_packet_type_vals, "Unknown (%u)")); @@ -860,7 +864,7 @@ dissect_dccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ break; case 0x1: /* DCCP-Response */ if (advertised_dccp_header_len < offset + 12) { - expert_add_info_format(pinfo, offset_item, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, offset_item, &ei_dccp_advertised_header_length_bad, "Advertised header length (%u) is smaller than the minimum (%u) for Response", advertised_dccp_header_len, offset + 12); return tvb_length(tvb); @@ -900,7 +904,7 @@ dissect_dccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ case 0x4: /* DCCP-DataAck */ if (dccph->x) { if (advertised_dccp_header_len < offset + 8) { - expert_add_info_format(pinfo, offset_item, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, offset_item, &ei_dccp_advertised_header_length_bad, "Advertised header length (%u) is smaller than the minimum (%u) for %s", advertised_dccp_header_len, offset + 8, val_to_str(dccph->type, dccp_packet_type_vals, "Unknown (%u)")); @@ -925,7 +929,7 @@ dissect_dccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ offset += 8; /* move offset past the Ack Number Subheader */ } else { if (advertised_dccp_header_len < offset + 4) { - expert_add_info_format(pinfo, offset_item, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, offset_item, &ei_dccp_advertised_header_length_bad, "Advertised header length (%u) is smaller than the minimum (%u) for %s", advertised_dccp_header_len, offset + 4, val_to_str(dccph->type, dccp_packet_type_vals, "Unknown (%u)")); @@ -951,7 +955,7 @@ dissect_dccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ break; case 0x7: /* DCCP-Reset */ if (advertised_dccp_header_len < offset + 4) { - expert_add_info_format(pinfo, offset_item, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, offset_item, &ei_dccp_advertised_header_length_bad, "Advertised header length (%u) is smaller than the minimum (%u) for Reset", advertised_dccp_header_len, offset + 4); return tvb_length(tvb); @@ -1002,7 +1006,7 @@ dissect_dccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ case 0x8: /* DCCP-Sync */ case 0x9: /* DCCP-SyncAck */ if (advertised_dccp_header_len < offset + 8) { - expert_add_info_format(pinfo, offset_item, PI_MALFORMED, PI_ERROR, + expert_add_info_format_text(pinfo, offset_item, &ei_dccp_advertised_header_length_bad, "Advertised header length (%u) is smaller than the minimum (%u) for %s", advertised_dccp_header_len, offset + 8, val_to_str(dccph->type, dccp_packet_type_vals, "Unknown (%u)")); @@ -1026,8 +1030,7 @@ dissect_dccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ offset += 8; /* move offset past the Ack. Number Subheader */ break; default: - expert_add_info_format(pinfo, dccp_item, PI_PROTOCOL, PI_WARN, - "Reserved packet type: unable to dissect further"); + expert_add_info(pinfo, dccp_item, &ei_dccp_packet_type_reserved); return tvb_length(tvb); } @@ -1036,7 +1039,7 @@ dissect_dccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ * DCCP header to the start of its application data area, in 32-bit words. */ if (advertised_dccp_header_len > DCCP_HDR_LEN_MAX) { - expert_add_info_format(pinfo, offset_item, PI_PROTOCOL, PI_WARN, + expert_add_info_format_text(pinfo, offset_item, &ei_dccp_advertised_header_length_bad, "Advertised header length (%u) is larger than the maximum (%u)", advertised_dccp_header_len, DCCP_HDR_LEN_MAX); return tvb_length(tvb); @@ -1317,11 +1320,21 @@ proto_register_dccp(void) &ett_dccp_options }; + static ei_register_info ei[] = { + { &ei_dccp_option_len_bad, { "dccp.option.len.bad", PI_PROTOCOL, PI_WARN, "Bad option length", EXPFILL }}, + { &ei_dccp_advertised_header_length_bad, { "dccp.advertised_header_length.bad", PI_MALFORMED, PI_ERROR, "Advertised header length bad", EXPFILL }}, + { &ei_dccp_packet_type_reserved, { "dccp.packet_type.reserved", PI_PROTOCOL, PI_WARN, "Reserved packet type: unable to dissect further", EXPFILL }}, + }; + + expert_module_t* expert_dccp; + proto_dccp = proto_register_protocol("Datagram Congestion Control Protocol", "DCCP", "dccp"); proto_register_field_array(proto_dccp, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_dccp = expert_register_protocol(proto_dccp); + expert_register_field_array(expert_dccp, ei, array_length(ei)); /* subdissectors */ dccp_subdissector_table = diff --git a/epan/dissectors/packet-dcom.c b/epan/dissectors/packet-dcom.c index 5525d561be..20bdefb53d 100644 --- a/epan/dissectors/packet-dcom.c +++ b/epan/dissectors/packet-dcom.c @@ -224,7 +224,10 @@ static int hf_dcom_vt_bstr = -1; static int hf_dcom_vt_byref = -1; static int hf_dcom_vt_dispatch = -1; - +static expert_field ei_dcom_dissetion_incomplete = EI_INIT; +static expert_field ei_dcom_no_spec = EI_INIT; +static expert_field ei_dcom_hresult_expert = EI_INIT; +static expert_field ei_dcom_dualstringarray_mult_ip = EI_INIT; /* this/that extension UUIDs */ static e_uuid_t uuid_debug_ext = { 0xf1f19680, 0x4d2a, 0x11ce, { 0xa6, 0x6a, 0x00, 0x20, 0xaf, 0x6e, 0x72, 0xf4} }; @@ -958,7 +961,7 @@ dissect_dcom_tobedone_data(tvbuff_t *tvb, int offset, item = proto_tree_add_item(tree, hf_dcom_tobedone, tvb, offset, length, ENC_NA); PROTO_ITEM_SET_GENERATED(item); - expert_add_info_format(pinfo, item, PI_UNDECODED, PI_WARN, "Dissection incomplete"); + expert_add_info(pinfo, item, &ei_dcom_dissetion_incomplete); offset += length; @@ -977,7 +980,7 @@ dissect_dcom_nospec_data(tvbuff_t *tvb, int offset, item = proto_tree_add_item(tree, hf_dcom_nospec, tvb, offset, length, ENC_NA); PROTO_ITEM_SET_GENERATED(item); - expert_add_info_format(pinfo, item, PI_UNDECODED, PI_NOTE, "No specification available, dissection not possible"); + expert_add_info(pinfo, item, &ei_dcom_no_spec); offset += length; @@ -1090,7 +1093,7 @@ dissect_dcom_HRESULT(tvbuff_t *tvb, int offset, packet_info *pinfo, /* expert info only if severity is set */ /* XXX - move this to the callers of this function, to provide a more detailed error output */ if(u32HResult & 0x80000000) { - expert_add_info_format(pinfo, item, PI_RESPONSE_CODE, PI_NOTE, "Hresult: %s", + expert_add_info_format_text(pinfo, item, &ei_dcom_hresult_expert, "Hresult: %s", val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%x)")); } if (pu32HResult) @@ -1124,7 +1127,7 @@ dissect_dcom_indexed_HRESULT(tvbuff_t *tvb, int offset, packet_info *pinfo, /* expert info only if severity flag is set */ /* XXX - move this to the callers of this function, to provide a more detailed error output */ if(u32HResult & 0x80000000) { - expert_add_info_format(pinfo, item, PI_RESPONSE_CODE, PI_NOTE, "Hresult: %s", + expert_add_info_format_text(pinfo, item, &ei_dcom_hresult_expert, "Hresult: %s", val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%x)")); } if (pu32HResult) @@ -1822,7 +1825,7 @@ dissect_dcom_DUALSTRINGARRAY(tvbuff_t *tvb, gint offset, packet_info *pinfo, first_ip = curr_ip; } else { if(first_ip != curr_ip) { - expert_add_info_format(pinfo, pi, PI_UNDECODED, PI_NOTE, + expert_add_info_format_text(pinfo, pi, &ei_dcom_dualstringarray_mult_ip, "DUALSTRINGARRAY: multiple IP's %s %s", ip_to_str( (guint8 *) &first_ip), ip_to_str( (guint8 *) &curr_ip)); } @@ -2440,7 +2443,15 @@ proto_register_dcom (void) &ett_dcom_sa_features, }; + static ei_register_info ei[] = { + { &ei_dcom_dissetion_incomplete, { "dcom.dissetion_incomplete", PI_UNDECODED, PI_WARN, "Dissection incomplete", EXPFILL }}, + { &ei_dcom_no_spec, { "dcom.no_spec", PI_UNDECODED, PI_NOTE, "No specification available, dissection not possible", EXPFILL }}, + { &ei_dcom_hresult_expert, { "dcom.hresult.expert", PI_RESPONSE_CODE, PI_NOTE, "Hresult", EXPFILL }}, + { &ei_dcom_dualstringarray_mult_ip, { "dcom.dualstringarray.mult_ip", PI_UNDECODED, PI_NOTE, "DUALSTRINGARRAY Multiple IP", EXPFILL }}, + }; + module_t *dcom_module; + expert_module_t* expert_dcom; /* currently, the DCOM protocol "itself" has no real protocol dissector */ /* we only need this, to register some generic elements */ @@ -2458,6 +2469,9 @@ proto_register_dcom (void) proto_register_field_array(proto_dcom, hf_dcom_sa_array, array_length(hf_dcom_sa_array)); proto_register_subtree_array (ett_dcom, array_length (ett_dcom)); + expert_dcom = expert_register_protocol(proto_dcom); + expert_register_field_array(expert_dcom, ei, array_length(ei)); + /* preferences */ dcom_module = prefs_register_protocol(proto_dcom, NULL); diff --git a/epan/dissectors/packet-dnp.c b/epan/dissectors/packet-dnp.c index 8967e09a9c..85e6c547ff 100644 --- a/epan/dissectors/packet-dnp.c +++ b/epan/dissectors/packet-dnp.c @@ -1066,6 +1066,9 @@ static gint ett_dnp3_al_obj_quality = -1; static gint ett_dnp3_al_obj_point = -1; static gint ett_dnp3_al_obj_point_perms = -1; +static expert_field ei_dnp_num_items_neg = EI_INIT; +static expert_field ei_dnp_invalid_length = EI_INIT; + /* Tables for reassembly of fragments. */ static reassembly_table al_reassembly_table; static GHashTable *dl_conversation_table = NULL; @@ -1629,7 +1632,7 @@ dnp3_al_process_object(tvbuff_t *tvb, packet_info *pinfo, int offset, if (num_items < 0) { proto_item_append_text(range_item, " (bogus)"); - expert_add_info_format(pinfo, range_item, PI_MALFORMED, PI_ERROR, "Negative number of items"); + expert_add_info(pinfo, range_item, &ei_dnp_num_items_neg); return tvb_length(tvb); } @@ -2531,7 +2534,7 @@ dnp3_al_process_object(tvbuff_t *tvb, packet_info *pinfo, int offset, al_ptaddr++; } if (start_offset > offset) { - expert_add_info_format(pinfo, point_item, PI_MALFORMED, PI_ERROR, "Invalid length"); + expert_add_info(pinfo, point_item, &ei_dnp_invalid_length); offset = tvb_length(tvb); /* Finish decoding if unknown object is encountered... */ } } @@ -4106,7 +4109,12 @@ proto_register_dnp3(void) &ett_dnp3_fragment, &ett_dnp3_fragments }; + static ei_register_info ei[] = { + { &ei_dnp_num_items_neg, { "dnp3.num_items_neg", PI_MALFORMED, PI_ERROR, "Negative number of items", EXPFILL }}, + { &ei_dnp_invalid_length, { "dnp3.invalid_length", PI_MALFORMED, PI_ERROR, "Invalid length", EXPFILL }}, + }; module_t *dnp3_module; + expert_module_t* expert_dnp3; /* Register protocol init routine */ register_init_routine(&dnp3_init); @@ -4121,6 +4129,8 @@ proto_register_dnp3(void) /* Required function calls to register the header fields and subtrees used */ proto_register_field_array(proto_dnp3, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_dnp3 = expert_register_protocol(proto_dnp3); + expert_register_field_array(expert_dnp3, ei, array_length(ei)); dnp3_module = prefs_register_protocol(proto_dnp3, NULL); prefs_register_bool_preference(dnp3_module, "heuristics", diff --git a/epan/dissectors/packet-dtls.c b/epan/dissectors/packet-dtls.c index 203ee36052..4c8cc66e44 100644 --- a/epan/dissectors/packet-dtls.c +++ b/epan/dissectors/packet-dtls.c @@ -201,6 +201,10 @@ static gint ett_dtls_dnames = -1; static gint ett_dtls_fragment = -1; static gint ett_dtls_fragments = -1; +static expert_field ei_dtls_handshake_fragment_length_too_long = EI_INIT; +static expert_field ei_dtls_handshake_fragment_past_end_msg = EI_INIT; +static expert_field ei_dtls_msg_len_diff_fragment = EI_INIT; + static GHashTable *dtls_session_hash = NULL; static GHashTable *dtls_key_hash = NULL; static reassembly_table dtls_reassembly_table; @@ -1302,16 +1306,12 @@ dissect_dtls_handshake(tvbuff_t *tvb, packet_info *pinfo, { if (fragment_offset == 0) { - expert_add_info_format(pinfo, fragment_length_item, PI_PROTOCOL, - PI_ERROR, - "Fragment length is larger than message length"); + expert_add_info(pinfo, fragment_length_item, &ei_dtls_handshake_fragment_length_too_long); } else { fragmented = TRUE; - expert_add_info_format(pinfo, fragment_length_item, PI_PROTOCOL, - PI_ERROR, - "Fragment runs past the end of the message"); + expert_add_info(pinfo, fragment_length_item, &ei_dtls_handshake_fragment_past_end_msg); } } else if (fragment_length < length) @@ -1368,9 +1368,7 @@ dissect_dtls_handshake(tvbuff_t *tvb, packet_info *pinfo, report an error. */ if (reassembled_length != length) { - expert_add_info_format(pinfo, length_item, PI_PROTOCOL, - PI_ERROR, - "Message length differs from value in earlier fragment"); + expert_add_info(pinfo, length_item, &ei_dtls_msg_len_diff_fragment); } } @@ -3343,6 +3341,14 @@ proto_register_dtls(void) &ett_dtls_fragments, }; + static ei_register_info ei[] = { + { &ei_dtls_handshake_fragment_length_too_long, { "dtls.handshake.fragment_length.too_long", PI_PROTOCOL, PI_ERROR, "Fragment length is larger than message length", EXPFILL }}, + { &ei_dtls_handshake_fragment_past_end_msg, { "dtls.handshake.fragment_past_end_msg", PI_PROTOCOL, PI_ERROR, "Fragment runs past the end of the message", EXPFILL }}, + { &ei_dtls_msg_len_diff_fragment, { "dtls.msg_len_diff_fragment", PI_PROTOCOL, PI_ERROR, "Message length differs from value in earlier fragment", EXPFILL }}, + }; + + expert_module_t* expert_dtls; + /* Register the protocol name and description */ proto_dtls = proto_register_protocol("Datagram Transport Layer Security", "DTLS", "dtls"); @@ -3351,6 +3357,8 @@ proto_register_dtls(void) * subtrees used */ proto_register_field_array(proto_dtls, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); + expert_dtls = expert_register_protocol(proto_dtls); + expert_register_field_array(expert_dtls, ei, array_length(ei)); #ifdef HAVE_LIBGNUTLS { diff --git a/epan/dissectors/packet-gtpv2.c b/epan/dissectors/packet-gtpv2.c index da6e1c3d15..636a164c61 100644 --- a/epan/dissectors/packet-gtpv2.c +++ b/epan/dissectors/packet-gtpv2.c @@ -433,6 +433,10 @@ static gint ett_gtpv2_access_rest_data = -1; static gint ett_gtpv2_qua = -1; static gint ett_gtpv2_qui = -1; +static expert_field ei_gtpv2_ie_data_not_dissected = EI_INIT; +static expert_field ei_gtpv2_ie_len_invalid = EI_INIT; +static expert_field ei_gtpv2_source_type_unknown = EI_INIT; +static expert_field ei_gtpv2_fq_csid_type_bad = EI_INIT; /* Definition of User Location Info (AVP 22) masks */ #define GTPv2_ULI_CGI_MASK 0x01 @@ -839,7 +843,7 @@ dissect_gtpv2_unknown(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -2205,7 +2209,7 @@ dissect_gtpv2_s103pdf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto default: /* Error */ expert_item = proto_tree_add_text(tree, tvb, 0, length, "Wrong length %u, should be 4 or 16", m); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_ERROR, "Wrong length %u, should be 4 or 16", m); + expert_add_info_format_text(pinfo, expert_item, &ei_gtpv2_ie_len_invalid, "Wrong length %u, should be 4 or 16", m); PROTO_ITEM_SET_GENERATED(expert_item); return; } @@ -2262,7 +2266,7 @@ dissect_gtpv2_s1udf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_i default: /* Error */ expert_item = proto_tree_add_text(tree, tvb, 0, length, "Wrong length %u, should be 4 or 16", m); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_ERROR, "Wrong length %u, should be 4 or 16", m); + expert_add_info_format_text(pinfo, expert_item, &ei_gtpv2_ie_len_invalid, "Wrong length %u, should be 4 or 16", m); PROTO_ITEM_SET_GENERATED(expert_item); return; } @@ -2360,7 +2364,7 @@ dissect_gtpv2_pdn_type(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, prot if (length != 1) { proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "Wrong length indicated. Expected 1, got %u", length); - expert_add_info_format(pinfo, expert_item, PI_MALFORMED, PI_ERROR, "Wrong length indicated. Expected 1, got %u", length); + expert_add_info_format_text(pinfo, expert_item, &ei_gtpv2_ie_len_invalid, "Wrong length indicated. Expected 1, got %u", length); PROTO_ITEM_SET_GENERATED(expert_item); return; } @@ -4216,7 +4220,7 @@ dissect_gtpv2_source_ident(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, break; default: expert_item = proto_tree_add_text(tree, tvb, offset-1, 1, "Unknown source type"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_ERROR, "Unknown source type"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_source_type_unknown); PROTO_ITEM_SET_GENERATED(expert_item); break; } @@ -4330,7 +4334,7 @@ dissect_gtpv2_fq_csid(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto break; default: expert_item = proto_tree_add_text(tree, tvb, offset-1, 1, "Wrong Node-ID Type %u, should be 0-2(Or tis is a newer spec)", node_id_type); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_ERROR, "Wrong Node-ID Type %u, should be 0-2(Or tis is a newer spec)", node_id_type); + expert_add_info_format_text(pinfo, expert_item, &ei_gtpv2_fq_csid_type_bad, "Wrong Node-ID Type %u, should be 0-2(Or tis is a newer spec)", node_id_type); PROTO_ITEM_SET_GENERATED(expert_item); return; } @@ -4663,7 +4667,7 @@ dissect_gtpv2_uci(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, proto proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -4674,7 +4678,7 @@ dissect_gtpv2_csg_info_rep_action(tvbuff_t *tvb, packet_info *pinfo _U_, proto_t proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -4695,7 +4699,7 @@ dissect_gtpv2_csg_id(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, pr proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -4706,7 +4710,7 @@ dissect_gtpv2_cmi(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, proto proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -4717,7 +4721,7 @@ dissect_gtpv2_service_indicator(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tre proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -4728,7 +4732,7 @@ dissect_gtpv2_detach_type(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tre proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -4739,7 +4743,7 @@ dissect_gtpv2_ldn(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, proto proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -4750,7 +4754,7 @@ dissect_gtpv2_node_features(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *t proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -4781,7 +4785,7 @@ dissect_gtpv2_throttling(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -4937,7 +4941,7 @@ dissect_gtpv2_mdt_config(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree proto_item *expert_item; expert_item = proto_tree_add_text(tree, tvb, 0, length, "IE data not dissected yet"); - expert_add_info_format(pinfo, expert_item, PI_PROTOCOL, PI_NOTE, "IE data not dissected yet"); + expert_add_info(pinfo, expert_item, &ei_gtpv2_ie_data_not_dissected); PROTO_ITEM_SET_GENERATED(expert_item); } @@ -6983,9 +6987,21 @@ void proto_register_gtpv2(void) &ett_gtpv2_qui, }; + static ei_register_info ei[] = { + { &ei_gtpv2_ie_data_not_dissected, { "gtpv2.ie_data_not_dissected", PI_PROTOCOL, PI_NOTE, "IE data not dissected yet", EXPFILL }}, + { &ei_gtpv2_ie_len_invalid, { "gtpv2.ie_len_invalid", PI_PROTOCOL, PI_ERROR, "Wrong length", EXPFILL }}, + { &ei_gtpv2_source_type_unknown, { "gtpv2.source_type.unknown", PI_PROTOCOL, PI_ERROR, "Unknown source type", EXPFILL }}, + { &ei_gtpv2_fq_csid_type_bad, { "gtpv2.fq_csid_type.unknown", PI_PROTOCOL, PI_ERROR, "Wrong Node-ID Type", EXPFILL }}, + }; + + expert_module_t* expert_gtpv2; + proto_gtpv2 = proto_register_protocol("GPRS Tunneling Protocol V2", "GTPv2", "gtpv2"); proto_register_field_array(proto_gtpv2, hf_gtpv2, array_length(hf_gtpv2)); proto_register_subtree_array(ett_gtpv2_array, array_length(ett_gtpv2_array)); + expert_gtpv2 = expert_register_protocol(proto_gtpv2); + expert_register_field_array(expert_gtpv2, ei, array_length(ei)); + /* AVP Code: 22 3GPP-User-Location-Info */ dissector_add_uint("diameter.3gpp", 22, new_create_dissector_handle(dissect_diameter_3gpp_uli, proto_gtpv2));