epan/show_exception.c

   1 /* show_exception.c
   2  *
   3  * Routines to put exception information into the protocol tree
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 2000 Gerald Combs
   8  *
   9  * SPDX-License-Identifier: GPL-2.0-or-later
  10  */
  11
  12 #include "config.h"
  13 #define WS_LOG_DOMAIN LOG_DOMAIN_EPAN
  14
  15 #include <epan/packet.h>
  16 #include <epan/exceptions.h>
  17 #include <epan/expert.h>
  18 #include <epan/prefs.h>
  19 #include <epan/prefs-int.h>
  20 #include <epan/show_exception.h>
  21 #include <wsutil/ws_assert.h>
  22 #include <wsutil/array.h>
  23
  24 #include <wsutil/wslog.h>
  25
  26 static int proto_short;
  27 static int proto_dissector_bug;
  28 static int proto_malformed;
  29 static int proto_unreassembled;
  30
  31 static expert_field ei_dissector_bug;
  32 static expert_field ei_malformed_reassembly;
  33 static expert_field ei_malformed;
  34 static expert_field ei_unreassembled;
  35
  36 void
  37 register_show_exception(void)
  38 {
  39         static ei_register_info ei_dissector_bug_set[] = {
  40                 { &ei_dissector_bug, { "_ws.dissector_bug", PI_DISSECTOR_BUG, PI_ERROR, "Dissector bug", EXPFILL }},
  41         };
  42         static ei_register_info ei_malformed_set[] = {
  43                 { &ei_malformed_reassembly, { "_ws.malformed.reassembly", PI_MALFORMED, PI_ERROR, "Reassembly error", EXPFILL }},
  44                 { &ei_malformed, { "_ws.malformed.expert", PI_MALFORMED, PI_ERROR, "Malformed Packet (Exception occurred)", EXPFILL }},
  45         };
  46         static ei_register_info ei_unreassembled_set[] = {
  47                 { &ei_unreassembled, { "_ws.unreassembled.expert", PI_REASSEMBLE, PI_NOTE, "Unreassembled fragment (change preferences to enable reassembly)", EXPFILL }},
  48         };
  49
  50         expert_module_t* expert_dissector_bug;
  51         expert_module_t* expert_malformed;
  52         expert_module_t* expert_unreassembled;
  53
  54         proto_short = proto_register_protocol("Short Frame", "Short frame", "_ws.short");
  55         proto_dissector_bug = proto_register_protocol("Dissector Bug",
  56             "Dissector bug", "_ws.dissector_bug");
  57         proto_malformed = proto_register_protocol("Malformed Packet",
  58             "Malformed packet", "_ws.malformed");
  59         proto_unreassembled = proto_register_protocol(
  60             "Unreassembled Fragmented Packet",
  61             "Unreassembled fragmented packet", "_ws.unreassembled");
  62
  63         expert_dissector_bug = expert_register_protocol(proto_dissector_bug);
  64         expert_register_field_array(expert_dissector_bug, ei_dissector_bug_set, array_length(ei_dissector_bug_set));
  65         expert_malformed = expert_register_protocol(proto_malformed);
  66         expert_register_field_array(expert_malformed, ei_malformed_set, array_length(ei_malformed_set));
  67         expert_unreassembled = expert_register_protocol(proto_unreassembled);
  68         expert_register_field_array(expert_unreassembled, ei_unreassembled_set, array_length(ei_unreassembled_set));
  69
  70         /* "Short Frame", "Dissector Bug", "Malformed Packet", and
  71            "Unreassembled Fragmented Packet" aren't really protocols,
  72            they're error indications; disabling them makes no sense. */
  73         proto_set_cant_toggle(proto_short);
  74         proto_set_cant_toggle(proto_dissector_bug);
  75         proto_set_cant_toggle(proto_malformed);
  76         proto_set_cant_toggle(proto_unreassembled);
  77 }
  78
  79 void
  80 show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
  81                unsigned long exception, const char *exception_message)
  82 {
  83         static const char dissector_error_nomsg[] =
  84                 "Dissector writer didn't bother saying what the error was";
  85         proto_item *item;
  86
  87         if ((exception == ReportedBoundsError || exception == ContainedBoundsError) && pinfo->fragmented)
  88                 exception = FragmentBoundsError;
  89
  90         switch (exception) {
  91
  92         case ScsiBoundsError:
  93                 col_append_str(pinfo->cinfo, COL_INFO, "[SCSI transfer limited due to allocation_length too small]");
  94                 proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
  95                                 "SCSI transfer limited due to allocation_length too small: %s truncated]", pinfo->current_proto);
  96                 /* Don't record ScsiBoundsError exceptions as expert events - they merely
  97                  * reflect a normal SCSI condition.
  98                  * (any case where it's caused by something else is a bug). */
  99                 break;
 100
 101         case BoundsError:
 102                 {
 103                 bool display_info = true;
 104                 module_t * frame_module = prefs_find_module("frame");
 105                 if (frame_module != NULL)
 106                 {
 107                         pref_t *display_pref = prefs_find_preference(frame_module, "disable_packet_size_limited_in_summary");
 108                         if (display_pref)
 109                         {
 110                                 if (prefs_get_bool_value(display_pref, pref_current))
 111                                         display_info = false;
 112                         }
 113                 }
 114
 115                 if (display_info)
 116                         col_append_str(pinfo->cinfo, COL_INFO, "[Packet size limited during capture]");
 117                 proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
 118                                 "[Packet size limited during capture: %s truncated]", pinfo->current_proto);
 119                 /* Don't record BoundsError exceptions as expert events - they merely
 120                  * reflect a capture done with a snapshot length too short to capture
 121                  * all of the packet
 122                  * (any case where it's caused by something else is a bug). */
 123         }
 124                 break;
 125
 126         case FragmentBoundsError:
 127                 col_append_fstr(pinfo->cinfo, COL_INFO, "[BoundErrorUnreassembled Packet%s]", pinfo->noreassembly_reason);
 128                 item = proto_tree_add_protocol_format(tree, proto_unreassembled,
 129                     tvb, 0, 0, "[BoundError Unreassembled Packet%s: %s]",
 130                     pinfo->noreassembly_reason, pinfo->current_proto);
 131                 /* FragmentBoundsError merely reflect dissection done with
 132                  * reassembly turned off, so add a note to that effect
 133                  * (any case where it's caused by something else is a bug). */
 134                 expert_add_info(pinfo, item, &ei_unreassembled);
 135                 break;
 136
 137         case ContainedBoundsError:
 138                 col_append_fstr(pinfo->cinfo, COL_INFO, "[Malformed Packet: length of contained item exceeds length of containing item]");
 139                 item = proto_tree_add_protocol_format(tree, proto_malformed,
 140                     tvb, 0, 0, "[Malformed Packet: %s: length of contained item exceeds length of containing item]",
 141                     pinfo->current_proto);
 142                 expert_add_info(pinfo, item, &ei_malformed);
 143                 break;
 144
 145         case ReportedBoundsError:
 146                 show_reported_bounds_error(tvb, pinfo, tree);
 147                 break;
 148
 149         case DissectorError:
 150                 col_append_fstr(pinfo->cinfo, COL_INFO,
 151                     "[Dissector bug, protocol %s: %s]",
 152                     pinfo->current_proto,
 153                     exception_message == NULL ?
 154                         dissector_error_nomsg : exception_message);
 155                 item = proto_tree_add_protocol_format(tree, proto_dissector_bug, tvb, 0, 0,
 156                     "[Dissector bug, protocol %s: %s]",
 157                     pinfo->current_proto,
 158                     exception_message == NULL ?
 159                         dissector_error_nomsg : exception_message);
 160                 ws_log(WS_LOG_DOMAIN, LOG_LEVEL_WARNING,
 161                     "Dissector bug, protocol %s, in packet %u: %s",
 162                     pinfo->current_proto, pinfo->num,
 163                     exception_message == NULL ?
 164                         dissector_error_nomsg : exception_message);
 165                 expert_add_info_format(pinfo, item, &ei_dissector_bug, "%s",
 166                     exception_message == NULL ?
 167                         dissector_error_nomsg : exception_message);
 168                 break;
 169
 170         case ReassemblyError:
 171                 col_append_fstr(pinfo->cinfo, COL_INFO,
 172                     "[Reassembly error, protocol %s: %s]",
 173                     pinfo->current_proto,
 174                     exception_message == NULL ?
 175                         dissector_error_nomsg : exception_message);
 176                 item = proto_tree_add_protocol_format(tree, proto_malformed, tvb, 0, 0,
 177                     "[Reassembly error, protocol %s: %s]",
 178                     pinfo->current_proto,
 179                     exception_message == NULL ?
 180                         dissector_error_nomsg : exception_message);
 181                 expert_add_info_format(pinfo, item, &ei_malformed_reassembly, "%s",
 182                     exception_message == NULL ?
 183                         dissector_error_nomsg : exception_message);
 184                 break;
 185
 186         default:
 187                 /* XXX - we want to know, if an unknown exception passed until here, don't we? */
 188                 ws_assert_not_reached();
 189         }
 190 }
 191
 192 void
 193 show_reported_bounds_error(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 194 {
 195         proto_item *item;
 196
 197         col_append_str(pinfo->cinfo, COL_INFO,
 198             "[Malformed Packet]");
 199         item = proto_tree_add_protocol_format(tree, proto_malformed,
 200             tvb, 0, 0, "[Malformed Packet: %s]", pinfo->current_proto);
 201         expert_add_info(pinfo, item, &ei_malformed);
 202 }
 203
 204 /*
 205  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 206  *
 207  * Local variables:
 208  * c-basic-offset: 8
 209  * tab-width: 8
 210  * indent-tabs-mode: t
 211  * End:
 212  *
 213  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 214  * :indentSize=8:tabSize=8:noTabs=false:
 215  */