1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
|
/* show_exception.c
*
* Routines to put exception information into the protocol tree
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 2000 Gerald Combs
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#include "config.h"
#define WS_LOG_DOMAIN LOG_DOMAIN_EPAN
#include <glib.h>
#include <epan/packet.h>
#include <epan/exceptions.h>
#include <epan/expert.h>
#include <epan/prefs.h>
#include <epan/prefs-int.h>
#include <epan/show_exception.h>
#include <wsutil/ws_assert.h>
#include <wsutil/wslog.h>
static int proto_short = -1;
static int proto_malformed = -1;
static int proto_unreassembled = -1;
static expert_field ei_malformed_dissector_bug = EI_INIT;
static expert_field ei_malformed_reassembly = EI_INIT;
static expert_field ei_malformed = EI_INIT;
static expert_field ei_unreassembled = EI_INIT;
void
register_show_exception(void)
{
static ei_register_info ei_malformed_set[] = {
{ &ei_malformed_dissector_bug, { "_ws.malformed.dissector_bug", PI_MALFORMED, PI_ERROR, "Dissector bug", EXPFILL }},
{ &ei_malformed_reassembly, { "_ws.malformed.reassembly", PI_MALFORMED, PI_ERROR, "Reassembly error", EXPFILL }},
{ &ei_malformed, { "_ws.malformed.expert", PI_MALFORMED, PI_ERROR, "Malformed Packet (Exception occurred)", EXPFILL }},
};
static ei_register_info ei_unreassembled_set[] = {
{ &ei_unreassembled, { "_ws.unreassembled.expert", PI_REASSEMBLE, PI_NOTE, "Unreassembled fragment (change preferences to enable reassembly)", EXPFILL }},
};
expert_module_t* expert_malformed;
expert_module_t* expert_unreassembled;
proto_short = proto_register_protocol("Short Frame", "Short frame", "_ws.short");
proto_malformed = proto_register_protocol("Malformed Packet",
"Malformed packet", "_ws.malformed");
proto_unreassembled = proto_register_protocol(
"Unreassembled Fragmented Packet",
"Unreassembled fragmented packet", "_ws.unreassembled");
expert_malformed = expert_register_protocol(proto_malformed);
expert_register_field_array(expert_malformed, ei_malformed_set, array_length(ei_malformed_set));
expert_unreassembled = expert_register_protocol(proto_unreassembled);
expert_register_field_array(expert_unreassembled, ei_unreassembled_set, array_length(ei_unreassembled_set));
/* "Short Frame", "Malformed Packet", and "Unreassembled Fragmented
Packet" aren't really protocols, they're error indications;
disabling them makes no sense. */
proto_set_cant_toggle(proto_short);
proto_set_cant_toggle(proto_malformed);
proto_set_cant_toggle(proto_unreassembled);
}
void
show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
unsigned long exception, const char *exception_message)
{
static const char dissector_error_nomsg[] =
"Dissector writer didn't bother saying what the error was";
proto_item *item;
if ((exception == ReportedBoundsError || exception == ContainedBoundsError) && pinfo->fragmented)
exception = FragmentBoundsError;
switch (exception) {
case ScsiBoundsError:
col_append_str(pinfo->cinfo, COL_INFO, "[SCSI transfer limited due to allocation_length too small]");
proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
"SCSI transfer limited due to allocation_length too small: %s truncated]", pinfo->current_proto);
/* Don't record ScsiBoundsError exceptions as expert events - they merely
* reflect a normal SCSI condition.
* (any case where it's caused by something else is a bug). */
break;
case BoundsError:
{
gboolean display_info = TRUE;
module_t * frame_module = prefs_find_module("frame");
if (frame_module != NULL)
{
pref_t *display_pref = prefs_find_preference(frame_module, "disable_packet_size_limited_in_summary");
if (display_pref)
{
if (prefs_get_bool_value(display_pref, pref_current))
display_info = FALSE;
}
}
if (display_info)
col_append_str(pinfo->cinfo, COL_INFO, "[Packet size limited during capture]");
proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
"[Packet size limited during capture: %s truncated]", pinfo->current_proto);
/* Don't record BoundsError exceptions as expert events - they merely
* reflect a capture done with a snapshot length too short to capture
* all of the packet
* (any case where it's caused by something else is a bug). */
}
break;
case FragmentBoundsError:
col_append_fstr(pinfo->cinfo, COL_INFO, "[BoundErrorUnreassembled Packet%s]", pinfo->noreassembly_reason);
item = proto_tree_add_protocol_format(tree, proto_unreassembled,
tvb, 0, 0, "[BoundError Unreassembled Packet%s: %s]",
pinfo->noreassembly_reason, pinfo->current_proto);
/* FragmentBoundsError merely reflect dissection done with
* reassembly turned off, so add a note to that effect
* (any case where it's caused by something else is a bug). */
expert_add_info(pinfo, item, &ei_unreassembled);
break;
case ContainedBoundsError:
col_append_fstr(pinfo->cinfo, COL_INFO, "[Malformed Packet: length of contained item exceeds length of containing item]");
item = proto_tree_add_protocol_format(tree, proto_malformed,
tvb, 0, 0, "[Malformed Packet: %s: length of contained item exceeds length of containing item]",
pinfo->current_proto);
expert_add_info(pinfo, item, &ei_malformed);
break;
case ReportedBoundsError:
show_reported_bounds_error(tvb, pinfo, tree);
break;
case DissectorError:
col_append_fstr(pinfo->cinfo, COL_INFO,
"[Dissector bug, protocol %s: %s]",
pinfo->current_proto,
exception_message == NULL ?
dissector_error_nomsg : exception_message);
item = proto_tree_add_protocol_format(tree, proto_malformed, tvb, 0, 0,
"[Dissector bug, protocol %s: %s]",
pinfo->current_proto,
exception_message == NULL ?
dissector_error_nomsg : exception_message);
ws_log(WS_LOG_DOMAIN, LOG_LEVEL_WARNING,
"Dissector bug, protocol %s, in packet %u: %s",
pinfo->current_proto, pinfo->num,
exception_message == NULL ?
dissector_error_nomsg : exception_message);
expert_add_info_format(pinfo, item, &ei_malformed_dissector_bug, "%s",
exception_message == NULL ?
dissector_error_nomsg : exception_message);
break;
case ReassemblyError:
col_append_fstr(pinfo->cinfo, COL_INFO,
"[Reassembly error, protocol %s: %s]",
pinfo->current_proto,
exception_message == NULL ?
dissector_error_nomsg : exception_message);
item = proto_tree_add_protocol_format(tree, proto_malformed, tvb, 0, 0,
"[Reassembly error, protocol %s: %s]",
pinfo->current_proto,
exception_message == NULL ?
dissector_error_nomsg : exception_message);
expert_add_info_format(pinfo, item, &ei_malformed_reassembly, "%s",
exception_message == NULL ?
dissector_error_nomsg : exception_message);
break;
default:
/* XXX - we want to know, if an unknown exception passed until here, don't we? */
ws_assert_not_reached();
}
}
void
show_reported_bounds_error(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
proto_item *item;
col_append_str(pinfo->cinfo, COL_INFO,
"[Malformed Packet]");
item = proto_tree_add_protocol_format(tree, proto_malformed,
tvb, 0, 0, "[Malformed Packet: %s]", pinfo->current_proto);
expert_add_info(pinfo, item, &ei_malformed);
}
/*
* Editor modelines - https://www.wireshark.org/tools/modelines.html
*
* Local variables:
* c-basic-offset: 8
* tab-width: 8
* indent-tabs-mode: t
* End:
*
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
* :indentSize=8:tabSize=8:noTabs=false:
*/
|
