forked from osmocom/wireshark
exceptions: Add an expert warning for FragmentBoundsError
FragmentBoundsErrors aren't malformed, but add an expert warning at the PI_NOTE level to hint to users that they may want to turn on reassembly preferences.
This commit is contained in:
parent
12c8cc32f0
commit
4e184104af
|
@ -30,6 +30,7 @@ static int proto_unreassembled = -1;
|
|||
static expert_field ei_malformed_dissector_bug = EI_INIT;
|
||||
static expert_field ei_malformed_reassembly = EI_INIT;
|
||||
static expert_field ei_malformed = EI_INIT;
|
||||
static expert_field ei_unreassembled = EI_INIT;
|
||||
|
||||
void
|
||||
register_show_exception(void)
|
||||
|
@ -38,6 +39,7 @@ register_show_exception(void)
|
|||
{ &ei_malformed_dissector_bug, { "_ws.malformed.dissector_bug", PI_MALFORMED, PI_ERROR, "Dissector bug", EXPFILL }},
|
||||
{ &ei_malformed_reassembly, { "_ws.malformed.reassembly", PI_MALFORMED, PI_ERROR, "Reassembly error", EXPFILL }},
|
||||
{ &ei_malformed, { "_ws.malformed.expert", PI_MALFORMED, PI_ERROR, "Malformed Packet (Exception occurred)", EXPFILL }},
|
||||
{ &ei_unreassembled, { "_ws.unreassembled.expert", PI_REASSEMBLE, PI_NOTE, "Unreassembled fragment (change preferences to enable reassembly)", EXPFILL }},
|
||||
};
|
||||
|
||||
expert_module_t* expert_malformed;
|
||||
|
@ -109,15 +111,13 @@ show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
|
|||
|
||||
case FragmentBoundsError:
|
||||
col_append_fstr(pinfo->cinfo, COL_INFO, "[BoundErrorUnreassembled Packet%s]", pinfo->noreassembly_reason);
|
||||
proto_tree_add_protocol_format(tree, proto_unreassembled,
|
||||
item = proto_tree_add_protocol_format(tree, proto_unreassembled,
|
||||
tvb, 0, 0, "[BoundError Unreassembled Packet%s: %s]",
|
||||
pinfo->noreassembly_reason, pinfo->current_proto);
|
||||
/* Don't record FragmentBoundsError exceptions as expert events - they merely
|
||||
* reflect dissection done with reassembly turned off
|
||||
* (any case where it's caused by something else is a bug).
|
||||
* XXX: It's not malformed, but perhaps an expert info at a lower
|
||||
* severity like PI_NOTE would be useful to suggest trying to
|
||||
* change reassembly preferences. */
|
||||
/* FragmentBoundsError merely reflect dissection done with
|
||||
* reassembly turned off, so add a note to that effect
|
||||
* (any case where it's caused by something else is a bug). */
|
||||
expert_add_info(pinfo, item, &ei_unreassembled);
|
||||
break;
|
||||
|
||||
case ContainedBoundsError:
|
||||
|
|
Loading…
Reference in New Issue