epan/expert.c

   1 /* expert.c
   2  * Collecting Expert information.
   3  *
   4  * Implemented as a tap named "expert".
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * SPDX-License-Identifier: GPL-2.0-or-later
  11  */
  12
  13 #include "config.h"
  14 #define WS_LOG_DOMAIN LOG_DOMAIN_EPAN
  15
  16 #include <stdio.h>
  17
  18 #include "packet.h"
  19 #include "expert.h"
  20 #include "uat.h"
  21 #include "prefs.h"
  22 #include <epan/prefs-int.h>
  23 #include <epan/wmem_scopes.h>
  24 #include "tap.h"
  25
  26 #include <wsutil/str_util.h>
  27 #include <wsutil/wslog.h>
  28 #include <wsutil/array.h>
  29
  30 /* proto_expert cannot be static because it's referenced in the
  31  * print routines
  32  */
  33 int proto_expert;
  34
  35 static int proto_malformed;
  36
  37 static int expert_tap;
  38 static int highest_severity;
  39
  40 static int ett_expert;
  41 static int ett_subexpert;
  42
  43 static int hf_expert_msg;
  44 static int hf_expert_group;
  45 static int hf_expert_severity;
  46
  47 struct expert_module
  48 {
  49         const char *proto_name;
  50         int         proto_id;      /* Cache this for registering hfs */
  51 };
  52
  53 /* List which stores protocols and expert_info that have been registered */
  54 typedef struct _gpa_expertinfo_t {
  55         uint32_t            len;
  56         uint32_t            allocated_len;
  57         expert_field_info **ei;
  58 } gpa_expertinfo_t;
  59 static gpa_expertinfo_t gpa_expertinfo;
  60
  61 /* Hash table of abbreviations and IDs */
  62 static GHashTable *gpa_name_map;
  63
  64 /* Deregistered expert infos */
  65 static GPtrArray *deregistered_expertinfos;
  66
  67 const value_string expert_group_vals[] = {
  68         { PI_CHECKSUM,          "Checksum" },
  69         { PI_SEQUENCE,          "Sequence" },
  70         { PI_RESPONSE_CODE,     "Response" },
  71         { PI_REQUEST_CODE,      "Request" },
  72         { PI_UNDECODED,         "Undecoded" },
  73         { PI_REASSEMBLE,        "Reassemble" },
  74         { PI_MALFORMED,         "Malformed" },
  75         { PI_DEBUG,             "Debug" },
  76         { PI_PROTOCOL,          "Protocol" },
  77         { PI_SECURITY,          "Security" },
  78         { PI_COMMENTS_GROUP,    "Comment" },
  79         { PI_DECRYPTION,        "Decryption" },
  80         { PI_ASSUMPTION,        "Assumption" },
  81         { PI_DEPRECATED,        "Deprecated" },
  82         { PI_RECEIVE,           "Receive" },
  83         { PI_INTERFACE,         "Interface" },
  84         { PI_DISSECTOR_BUG,     "Dissector bug" },
  85         { 0, NULL }
  86 };
  87
  88 const value_string expert_severity_vals[] = {
  89         { PI_ERROR,             "Error" },
  90         { PI_WARN,              "Warning" },
  91         { PI_NOTE,              "Note" },
  92         { PI_CHAT,              "Chat" },
  93         { PI_COMMENT,           "Comment" },
  94         { 0, NULL }
  95 };
  96
  97 /* Possible values for a checksum evaluation */
  98 const value_string expert_checksum_vals[] = {
  99         { EXPERT_CHECKSUM_DISABLED,   "Disabled"  },
 100         { EXPERT_CHECKSUM_UNKNOWN,    "Unknown"  },
 101         { EXPERT_CHECKSUM_GOOD,       "Good"  },
 102         { EXPERT_CHECKSUM_BAD,        "Bad" },
 103         { 0,        NULL }
 104 };
 105
 106 static expert_field_info *expert_registrar_get_byname(const char *field_name);
 107
 108 /*----------------------------------------------------------------------------*/
 109 /* UAT for customizing severity levels.                                       */
 110 /*----------------------------------------------------------------------------*/
 111 typedef struct
 112 {
 113         char    *field;
 114         uint32_t severity;
 115 } expert_level_entry_t;
 116
 117 static expert_level_entry_t *uat_expert_entries;
 118 static unsigned expert_level_entry_count;
 119 /* Array of field names currently in UAT */
 120 static GArray *uat_saved_fields;
 121
 122 UAT_CSTRING_CB_DEF(uat_expert_entries, field, expert_level_entry_t)
 123 UAT_VS_DEF(uat_expert_entries, severity, expert_level_entry_t, uint32_t, PI_ERROR, "Error")
 124
 125 static bool uat_expert_update_cb(void *r, char **err)
 126 {
 127         expert_level_entry_t *rec = (expert_level_entry_t *)r;
 128
 129         if (expert_registrar_get_byname(rec->field) == NULL) {
 130                 *err = ws_strdup_printf("Expert Info field doesn't exist: %s", rec->field);
 131                 return false;
 132         }
 133         return true;
 134 }
 135
 136 static void *uat_expert_copy_cb(void *n, const void *o, size_t siz _U_)
 137 {
 138         expert_level_entry_t       *new_record = (expert_level_entry_t*)n;
 139         const expert_level_entry_t *old_record = (const expert_level_entry_t *)o;
 140
 141         new_record->field = g_strdup(old_record->field);
 142
 143         new_record->severity = old_record->severity;
 144
 145         return new_record;
 146 }
 147
 148 static void uat_expert_free_cb(void*r)
 149 {
 150         expert_level_entry_t *rec = (expert_level_entry_t *)r;
 151
 152         g_free(rec->field);
 153 }
 154
 155 static void uat_expert_post_update_cb(void)
 156 {
 157         unsigned           i;
 158         expert_field_info *field;
 159
 160         /* Reset any of the previous list of expert info fields to their original severity */
 161         for ( i = 0 ; i < uat_saved_fields->len; i++ ) {
 162                 field = g_array_index(uat_saved_fields, expert_field_info*, i);
 163                 if (field != NULL) {
 164                         field->severity = field->orig_severity;
 165                 }
 166         }
 167
 168         g_array_set_size(uat_saved_fields, 0);
 169
 170         for (i = 0; i < expert_level_entry_count; i++)
 171         {
 172                 field = expert_registrar_get_byname(uat_expert_entries[i].field);
 173                 if (field != NULL)
 174                 {
 175                         field->severity = uat_expert_entries[i].severity;
 176                         g_array_append_val(uat_saved_fields, field);
 177                 }
 178         }
 179 }
 180
 181 #define EXPERT_REGISTRAR_GET_NTH(eiindex, expinfo)                                               \
 182         if((unsigned)eiindex >= gpa_expertinfo.len && wireshark_abort_on_dissector_bug)   \
 183                 ws_error("Unregistered expert info! index=%d", eiindex);                          \
 184         DISSECTOR_ASSERT_HINT((unsigned)eiindex < gpa_expertinfo.len, "Unregistered expert info!"); \
 185         DISSECTOR_ASSERT_HINT(gpa_expertinfo.ei[eiindex] != NULL, "Unregistered expert info!"); \
 186         expinfo = gpa_expertinfo.ei[eiindex];
 187
 188 void
 189 expert_packet_init(void)
 190 {
 191         module_t *module_expert;
 192         uat_t    *expert_uat;
 193
 194         static hf_register_info hf[] = {
 195                 { &hf_expert_msg,
 196                         { "Message", "_ws.expert.message", FT_STRING, BASE_NONE, NULL, 0, "Wireshark expert information", HFILL }
 197                 },
 198                 { &hf_expert_group,
 199                         { "Group", "_ws.expert.group", FT_UINT32, BASE_NONE, VALS(expert_group_vals), 0, "Wireshark expert group", HFILL }
 200                 },
 201                 { &hf_expert_severity,
 202                         { "Severity level", "_ws.expert.severity", FT_UINT32, BASE_NONE, VALS(expert_severity_vals), 0, "Wireshark expert severity level", HFILL }
 203                 }
 204         };
 205         static int *ett[] = {
 206                 &ett_expert,
 207                 &ett_subexpert
 208         };
 209
 210         /* UAT for overriding severity levels */
 211         static uat_field_t custom_expert_fields[] = {
 212                 UAT_FLD_CSTRING(uat_expert_entries, field, "Field name", "Expert Info filter name"),
 213                 UAT_FLD_VS(uat_expert_entries, severity, "Severity", expert_severity_vals, "Custom severity level"),
 214                 UAT_END_FIELDS
 215         };
 216
 217         if (expert_tap == 0) {
 218                 expert_tap = register_tap("expert");
 219         }
 220
 221         if (proto_expert <= 0) {
 222                 proto_expert = proto_register_protocol("Expert Info", "Expert", "_ws.expert");
 223                 proto_register_field_array(proto_expert, hf, array_length(hf));
 224                 proto_register_subtree_array(ett, array_length(ett));
 225                 proto_set_cant_toggle(proto_expert);
 226
 227                 module_expert = prefs_register_protocol(proto_expert, NULL);
 228                 //Since "expert" is really a pseudo protocol, it shouldn't be
 229                 //categorized with other "real" protocols when it comes to
 230                 //preferences.  Since it's just a UAT, don't bury it in
 231                 //with the other protocols
 232                 module_expert->use_gui = false;
 233
 234                 expert_uat = uat_new("Expert Info Severity Level Configuration",
 235                         sizeof(expert_level_entry_t),
 236                         "expert_severity",
 237                         true,
 238                         (void **)&uat_expert_entries,
 239                         &expert_level_entry_count,
 240                         UAT_AFFECTS_DISSECTION,
 241                         NULL,
 242                         uat_expert_copy_cb,
 243                         uat_expert_update_cb,
 244                         uat_expert_free_cb,
 245                         uat_expert_post_update_cb,
 246                         NULL,
 247                         custom_expert_fields);
 248
 249                 prefs_register_uat_preference(module_expert,
 250                         "expert_severity_levels",
 251                         "Severity Level Configuration",
 252                         "A table that overrides Expert Info field severity levels to user configured levels",
 253                         expert_uat);
 254
 255         }
 256
 257         highest_severity = 0;
 258
 259         proto_malformed = proto_get_id_by_filter_name("_ws.malformed");
 260 }
 261
 262 void
 263 expert_init(void)
 264 {
 265         gpa_expertinfo.len           = 0;
 266         gpa_expertinfo.allocated_len = 0;
 267         gpa_expertinfo.ei            = NULL;
 268         gpa_name_map                 = g_hash_table_new_full(g_str_hash, g_str_equal, NULL, NULL);
 269         uat_saved_fields             = g_array_new(false, false, sizeof(expert_field_info*));
 270         deregistered_expertinfos     = g_ptr_array_new();
 271 }
 272
 273 void
 274 expert_packet_cleanup(void)
 275 {
 276 }
 277
 278 void
 279 expert_cleanup(void)
 280 {
 281         if (gpa_expertinfo.allocated_len) {
 282                 gpa_expertinfo.len           = 0;
 283                 gpa_expertinfo.allocated_len = 0;
 284                 g_free(gpa_expertinfo.ei);
 285                 gpa_expertinfo.ei          = NULL;
 286         }
 287
 288         /* Free the abbrev/ID GTree */
 289         if (gpa_name_map) {
 290                 g_hash_table_destroy(gpa_name_map);
 291                 gpa_name_map = NULL;
 292         }
 293
 294         /* Free the UAT saved fields */
 295         if (uat_saved_fields) {
 296                 g_array_free(uat_saved_fields, true);
 297                 uat_saved_fields = NULL;
 298         }
 299
 300         if (deregistered_expertinfos) {
 301                 g_ptr_array_free(deregistered_expertinfos, true);
 302                 deregistered_expertinfos = NULL;
 303         }
 304 }
 305
 306
 307 int
 308 expert_get_highest_severity(void)
 309 {
 310         return highest_severity;
 311 }
 312
 313 void
 314 expert_update_comment_count(uint64_t count)
 315 {
 316         if (count==0 && highest_severity==PI_COMMENT)
 317                 highest_severity = 0;
 318 }
 319
 320 expert_module_t *expert_register_protocol(int id)
 321 {
 322         expert_module_t *module;
 323         protocol_t      *protocol;
 324
 325         protocol = find_protocol_by_id(id);
 326
 327         module = wmem_new(wmem_epan_scope(), expert_module_t);
 328         module->proto_id = id;
 329         module->proto_name = proto_get_protocol_short_name(protocol);
 330
 331         return module;
 332 }
 333
 334 void
 335 expert_deregister_expertinfo (const char *abbrev)
 336 {
 337         expert_field_info *expinfo = (expert_field_info*)g_hash_table_lookup(gpa_name_map, abbrev);
 338         if (expinfo) {
 339                 g_ptr_array_add(deregistered_expertinfos, gpa_expertinfo.ei[expinfo->id]);
 340                 g_hash_table_steal(gpa_name_map, abbrev);
 341         }
 342 }
 343
 344 void
 345 expert_deregister_protocol (expert_module_t *module)
 346 {
 347         wmem_free(wmem_epan_scope(), module);
 348 }
 349
 350 static void
 351 free_deregistered_expertinfo (void *data, void *user_data _U_)
 352 {
 353         expert_field_info *expinfo = (expert_field_info *) data;
 354         gpa_expertinfo.ei[expinfo->id] = NULL; /* Invalidate this id */
 355 }
 356
 357 void
 358 expert_free_deregistered_expertinfos (void)
 359 {
 360         g_ptr_array_foreach(deregistered_expertinfos, free_deregistered_expertinfo, NULL);
 361         g_ptr_array_free(deregistered_expertinfos, true);
 362         deregistered_expertinfos = g_ptr_array_new();
 363 }
 364
 365 static int
 366 expert_register_field_init(expert_field_info *expinfo, expert_module_t *module)
 367 {
 368         /* Check for valid group and severity vals */
 369         switch (expinfo->group) {
 370                 case PI_CHECKSUM:
 371                 case PI_SEQUENCE:
 372                 case PI_RESPONSE_CODE:
 373                 case PI_REQUEST_CODE:
 374                 case PI_UNDECODED:
 375                 case PI_REASSEMBLE:
 376                 case PI_MALFORMED:
 377                 case PI_DEBUG:
 378                 case PI_PROTOCOL:
 379                 case PI_SECURITY:
 380                 case PI_COMMENTS_GROUP:
 381                 case PI_DECRYPTION:
 382                 case PI_ASSUMPTION:
 383                 case PI_DEPRECATED:
 384                 case PI_RECEIVE:
 385                 case PI_INTERFACE:
 386                 case PI_DISSECTOR_BUG:
 387                         break;
 388                 default:
 389                         REPORT_DISSECTOR_BUG("Expert info for %s has invalid group=0x%08x\n", expinfo->name, expinfo->group);
 390         }
 391         switch (expinfo->severity) {
 392                 case PI_COMMENT:
 393                 case PI_CHAT:
 394                 case PI_NOTE:
 395                 case PI_WARN:
 396                 case PI_ERROR:
 397                         break;
 398                 default:
 399                         REPORT_DISSECTOR_BUG("Expert info for %s has invalid severity=0x%08x\n", expinfo->name, expinfo->severity);
 400         }
 401
 402         expinfo->protocol      = module->proto_name;
 403
 404         /* if we always add and never delete, then id == len - 1 is correct */
 405         if (gpa_expertinfo.len >= gpa_expertinfo.allocated_len) {
 406                 if (!gpa_expertinfo.ei) {
 407                         gpa_expertinfo.allocated_len = PRE_ALLOC_EXPERT_FIELDS_MEM;
 408                         gpa_expertinfo.ei = (expert_field_info **)g_malloc(sizeof(expert_field_info *)*PRE_ALLOC_EXPERT_FIELDS_MEM);
 409                 } else {
 410                         gpa_expertinfo.allocated_len += 1000;
 411                         gpa_expertinfo.ei = (expert_field_info **)g_realloc(gpa_expertinfo.ei,
 412                                                    sizeof(expert_field_info *)*gpa_expertinfo.allocated_len);
 413                 }
 414         }
 415         gpa_expertinfo.ei[gpa_expertinfo.len] = expinfo;
 416         gpa_expertinfo.len++;
 417         expinfo->id = gpa_expertinfo.len - 1;
 418         /* Save the original severity so it can be restored by the UAT */
 419         expinfo->orig_severity = expinfo->severity;
 420
 421         /* save field name for lookup */
 422         g_hash_table_insert(gpa_name_map, (void *) (expinfo->name), expinfo);
 423
 424         return expinfo->id;
 425 }
 426
 427
 428 /* for use with static arrays only, since we don't allocate our own copies
 429 of the expert_field_info struct contained within the exp_register_info struct */
 430 void
 431 expert_register_field_array(expert_module_t *module, ei_register_info *exp, const int num_records)
 432 {
 433         int               i;
 434         ei_register_info *ptr = exp;
 435
 436         for (i = 0; i < num_records; i++, ptr++) {
 437                 /*
 438                  * Make sure we haven't registered this yet.
 439                  * Most fields have variables associated with them
 440                  * that are initialized to -1; some have array elements,
 441                  * or possibly uninitialized variables, so we also allow
 442                  * 0 (which is unlikely to be the field ID we get back
 443                  * from "expert_register_field_init()").
 444                  */
 445                 if (ptr->ids->ei != -1 && ptr->ids->ei != 0) {
 446                         fprintf(stderr,
 447                                 "Duplicate field detected in call to expert_register_field_array: '%s' is already registered, name=%s\n",
 448                                 ptr->eiinfo.summary, ptr->eiinfo.name);
 449                         return;
 450                 }
 451
 452                 /* Register the field with the experts */
 453                 ptr->ids->ei = expert_register_field_init(&ptr->eiinfo, module);
 454
 455                 /* Register with the header field info, so it's display filterable */
 456                 ptr->eiinfo.hf_info.p_id = &ptr->ids->hf;
 457                 ptr->eiinfo.hf_info.hfinfo.name = ptr->eiinfo.summary;
 458                 ptr->eiinfo.hf_info.hfinfo.abbrev = ptr->eiinfo.name;
 459
 460                 proto_register_field_array(module->proto_id, &ptr->eiinfo.hf_info, 1);
 461         }
 462 }
 463
 464 /* Finds a record in the expert array by name.
 465  * For the moment, this function is only used "internally"
 466  * but may find a reason to be exported
 467  */
 468 static expert_field_info *
 469 expert_registrar_get_byname(const char *field_name)
 470 {
 471         expert_field_info *hfinfo;
 472
 473         if (!field_name)
 474                 return NULL;
 475
 476         hfinfo = (expert_field_info*)g_hash_table_lookup(gpa_name_map, field_name);
 477
 478         return hfinfo;
 479 }
 480
 481 /**
 482  * Get summary text of an expert_info field.
 483  * This is intended for use in expert_add_info_format or proto_tree_add_expert_format
 484  * to get the "base" string to then append additional information
 485  */
 486 const char* expert_get_summary(expert_field *eiindex)
 487 {
 488         expert_field_info *eiinfo;
 489
 490         /* Look up the item */
 491         EXPERT_REGISTRAR_GET_NTH(eiindex->ei, eiinfo);
 492
 493         return eiinfo->summary;
 494 }
 495
 496 /** clear flags according to the mask and set new flag values */
 497 #define FI_REPLACE_FLAGS(fi, mask, flags_in) { \
 498         (fi->flags = (fi)->flags & ~(mask)); \
 499         (fi->flags = (fi)->flags | (flags_in)); \
 500 }
 501
 502 /* set's the PI_ flags to a protocol item
 503  * (and its parent items till the toplevel) */
 504 static void
 505 // NOLINTNEXTLINE(misc-no-recursion)
 506 expert_set_item_flags(proto_item *pi, const int group, const unsigned severity)
 507 {
 508         if (pi != NULL && PITEM_FINFO(pi) != NULL && (severity >= FI_GET_FLAG(PITEM_FINFO(pi), PI_SEVERITY_MASK))) {
 509                 FI_REPLACE_FLAGS(PITEM_FINFO(pi), PI_GROUP_MASK, group);
 510                 FI_REPLACE_FLAGS(PITEM_FINFO(pi), PI_SEVERITY_MASK, severity);
 511
 512                 /* propagate till toplevel item */
 513                 pi = proto_item_get_parent(pi);
 514                 // We recurse here, but we're limited by our tree depth checks in proto.c
 515                 expert_set_item_flags(pi, group, severity);
 516         }
 517 }
 518
 519 static proto_tree*
 520 expert_create_tree(proto_item *pi, int group, int severity, const char *msg)
 521 {
 522         proto_tree *tree;
 523         proto_item *ti;
 524
 525         tree = proto_item_add_subtree(pi, ett_expert);
 526         ti = proto_tree_add_protocol_format(tree, proto_expert, NULL, 0, 0, "Expert Info (%s/%s): %s",
 527                                             val_to_str(severity, expert_severity_vals, "Unknown (%u)"),
 528                                             val_to_str(group, expert_group_vals, "Unknown (%u)"),
 529                                             msg);
 530         proto_item_set_generated(ti);
 531
 532         if (group == PI_MALFORMED) {
 533                 /* Add hidden malformed protocol filter */
 534                 proto_item *malformed_ti = proto_tree_add_item(tree, proto_malformed, NULL, 0, 0, ENC_NA);
 535                 proto_item_set_hidden(malformed_ti);
 536         }
 537
 538         return proto_item_add_subtree(ti, ett_subexpert);
 539 }
 540
 541 static proto_tree*
 542 expert_set_info_vformat(packet_info *pinfo, proto_item *pi, int group, int severity, int hf_index, bool use_vaformat,
 543                         const char *format, va_list ap)
 544 {
 545         char           formatted[ITEM_LABEL_LENGTH];
 546         int            pos;
 547         int            tap;
 548         expert_info_t *ei;
 549         proto_tree    *tree;
 550         proto_item    *ti;
 551
 552         if (pinfo == NULL && pi && pi->tree_data) {
 553                 pinfo = PTREE_DATA(pi)->pinfo;
 554         }
 555
 556         /* if this packet isn't loaded because of a read filter, don't output anything */
 557         if (pinfo == NULL || pinfo->num == 0) {
 558                 return NULL;
 559         }
 560
 561         if (severity > highest_severity) {
 562                 highest_severity = severity;
 563         }
 564
 565         /* XXX: can we get rid of these checks and make them programming errors instead now? */
 566         if (pi != NULL && PITEM_FINFO(pi) != NULL) {
 567                 expert_set_item_flags(pi, group, severity);
 568         }
 569
 570         if ((pi == NULL) || (PITEM_FINFO(pi) == NULL) ||
 571                 ((unsigned)severity >= FI_GET_FLAG(PITEM_FINFO(pi), PI_SEVERITY_MASK))) {
 572                 col_add_str(pinfo->cinfo, COL_EXPERT, val_to_str(severity, expert_severity_vals, "Unknown (%u)"));
 573         }
 574
 575         if (use_vaformat) {
 576                 pos = vsnprintf(formatted, ITEM_LABEL_LENGTH, format, ap);
 577         } else {
 578                 pos = (int)g_strlcpy(formatted, format, ITEM_LABEL_LENGTH);
 579         }
 580
 581         /* Both vsnprintf and g_strlcpy return the number of bytes attempted
 582          * to write.
 583          */
 584         if (pos >= ITEM_LABEL_LENGTH) {
 585                 /* Truncation occurred. It might have split a UTF-8 character. */
 586                 ws_utf8_truncate(formatted, ITEM_LABEL_LENGTH - 1);
 587         }
 588
 589         tree = expert_create_tree(pi, group, severity, formatted);
 590
 591         if (hf_index <= 0) {
 592                 /* If no filterable expert info, just add the message */
 593                 ti = proto_tree_add_string(tree, hf_expert_msg, NULL, 0, 0, formatted);
 594                 proto_item_set_generated(ti);
 595         } else {
 596                 /* If filterable expert info, hide the "generic" form of the message,
 597                    and generate the formatted filterable expert info */
 598                 ti = proto_tree_add_none_format(tree, hf_index, NULL, 0, 0, "%s", formatted);
 599                 proto_item_set_generated(ti);
 600                 ti = proto_tree_add_string(tree, hf_expert_msg, NULL, 0, 0, formatted);
 601                 proto_item_set_hidden(ti);
 602         }
 603
 604         ti = proto_tree_add_uint_format_value(tree, hf_expert_severity, NULL, 0, 0, severity,
 605                                               "%s", val_to_str_const(severity, expert_severity_vals, "Unknown"));
 606         proto_item_set_generated(ti);
 607         ti = proto_tree_add_uint_format_value(tree, hf_expert_group, NULL, 0, 0, group,
 608                                               "%s", val_to_str_const(group, expert_group_vals, "Unknown"));
 609         proto_item_set_generated(ti);
 610
 611         tap = have_tap_listener(expert_tap);
 612
 613         if (!tap)
 614                 return tree;
 615
 616         ei = wmem_new(pinfo->pool, expert_info_t);
 617
 618         ei->packet_num  = pinfo->num;
 619         ei->group       = group;
 620         ei->severity    = severity;
 621         ei->hf_index    = hf_index;
 622         ei->protocol    = pinfo->current_proto;
 623         ei->summary     = wmem_strdup(pinfo->pool, formatted);
 624
 625         /* if we have a proto_item (not a faked item), set expert attributes to it */
 626         if (pi != NULL && PITEM_FINFO(pi) != NULL) {
 627                 ei->pitem = pi;
 628         }
 629         /* XXX: remove this because we don't have an internal-only function now? */
 630         else {
 631                 ei->pitem = NULL;
 632         }
 633
 634         tap_queue_packet(expert_tap, pinfo, ei);
 635         return tree;
 636 }
 637
 638 /* Helper function for expert_add_info() to work around compiler's special needs on ARM */
 639 static inline proto_tree*
 640 expert_add_info_internal(packet_info *pinfo, proto_item *pi, expert_field *expindex, ...)
 641 {
 642         /* the va_list is ignored */
 643         va_list            unused;
 644         expert_field_info *eiinfo;
 645         proto_tree        *tree;
 646
 647         /* Look up the item */
 648         EXPERT_REGISTRAR_GET_NTH(expindex->ei, eiinfo);
 649
 650         va_start(unused, expindex);
 651         tree = expert_set_info_vformat(pinfo, pi, eiinfo->group, eiinfo->severity, *eiinfo->hf_info.p_id, false, eiinfo->summary, unused);
 652         va_end(unused);
 653         return tree;
 654 }
 655
 656 proto_item *
 657 expert_add_info(packet_info *pinfo, proto_item *pi, expert_field *expindex)
 658 {
 659         proto_tree        *tree;
 660         tree = expert_add_info_internal(pinfo, pi, expindex);
 661         return (proto_item *)tree;
 662 }
 663
 664 proto_item *
 665 expert_add_info_format(packet_info *pinfo, proto_item *pi, expert_field *expindex, const char *format, ...)
 666 {
 667         va_list            ap;
 668         expert_field_info *eiinfo;
 669         proto_tree        *tree;
 670
 671         /* Look up the item */
 672         EXPERT_REGISTRAR_GET_NTH(expindex->ei, eiinfo);
 673
 674         va_start(ap, format);
 675         tree = expert_set_info_vformat(pinfo, pi, eiinfo->group, eiinfo->severity, *eiinfo->hf_info.p_id, true, format, ap);
 676         va_end(ap);
 677         return (proto_item *)tree;
 678 }
 679
 680 /* Helper function for expert_add_expert() to work around compiler's special needs on ARM */
 681 static inline proto_item *
 682 proto_tree_add_expert_internal(proto_tree *tree, packet_info *pinfo, expert_field *expindex,
 683                 tvbuff_t *tvb, int start, int length, ...)
 684 {
 685         expert_field_info *eiinfo;
 686         proto_item        *ti;
 687         int                item_length, captured_length;
 688         va_list            unused;
 689
 690         /* Look up the item */
 691         EXPERT_REGISTRAR_GET_NTH(expindex->ei, eiinfo);
 692
 693         /* Make sure this doesn't throw an exception when adding the item */
 694         item_length = length;
 695         captured_length = tvb_captured_length_remaining(tvb, start);
 696         if (captured_length < 0)
 697                 item_length = 0;
 698         else if (captured_length < item_length)
 699                 item_length = captured_length;
 700         ti = proto_tree_add_text_internal(tree, tvb, start, item_length, "%s", eiinfo->summary);
 701         va_start(unused, length);
 702         expert_set_info_vformat(pinfo, ti, eiinfo->group, eiinfo->severity, *eiinfo->hf_info.p_id, false, eiinfo->summary, unused);
 703         va_end(unused);
 704
 705         /* But make sure it throws an exception *after* adding the item */
 706         if (length != -1) {
 707                 tvb_ensure_bytes_exist(tvb, start, length);
 708         }
 709         return ti;
 710 }
 711
 712 proto_item *
 713 proto_tree_add_expert(proto_tree *tree, packet_info *pinfo, expert_field *expindex,
 714                 tvbuff_t *tvb, int start, int length)
 715 {
 716         return proto_tree_add_expert_internal(tree, pinfo, expindex, tvb, start, length);
 717 }
 718
 719 proto_item *
 720 proto_tree_add_expert_format(proto_tree *tree, packet_info *pinfo, expert_field *expindex,
 721                 tvbuff_t *tvb, int start, int length, const char *format, ...)
 722 {
 723         va_list            ap;
 724         expert_field_info *eiinfo;
 725         int                item_length, captured_length;
 726         proto_item        *ti;
 727
 728         /* Look up the item */
 729         EXPERT_REGISTRAR_GET_NTH(expindex->ei, eiinfo);
 730
 731         /* Make sure this doesn't throw an exception when adding the item */
 732         item_length = length;
 733         captured_length = tvb_captured_length_remaining(tvb, start);
 734         if (captured_length < 0)
 735                 item_length = 0;
 736         else if (captured_length < item_length)
 737                 item_length = captured_length;
 738         va_start(ap, format);
 739         ti = proto_tree_add_text_valist_internal(tree, tvb, start, item_length, format, ap);
 740         va_end(ap);
 741
 742         va_start(ap, format);
 743         expert_set_info_vformat(pinfo, ti, eiinfo->group, eiinfo->severity, *eiinfo->hf_info.p_id, true, format, ap);
 744         va_end(ap);
 745
 746         /* But make sure it throws an exception *after* adding the item */
 747         if (length != -1) {
 748                 tvb_ensure_bytes_exist(tvb, start, length);
 749         }
 750         return ti;
 751 }
 752
 753 /*
 754  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 755  *
 756  * Local variables:
 757  * c-basic-offset: 8
 758  * tab-width: 8
 759  * indent-tabs-mode: t
 760  * End:
 761  *
 762  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 763  * :indentSize=8:tabSize=8:noTabs=false:
 764  */