1 /* show_exception.c
2 *
3 * Routines to put exception information into the protocol tree
4 *
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
7 * Copyright 2000 Gerald Combs
8 *
9 * SPDX-License-Identifier: GPL-2.0-or-later
10 */
11
12 #include "config.h"
13 #define WS_LOG_DOMAIN LOG_DOMAIN_EPAN
14
15 #include <glib.h>
16 #include <epan/packet.h>
17 #include <epan/exceptions.h>
18 #include <epan/expert.h>
19 #include <epan/prefs.h>
20 #include <epan/prefs-int.h>
21 #include <epan/show_exception.h>
22 #include <wsutil/ws_assert.h>
23
24 #include <wsutil/wslog.h>
25
26 static int proto_short = -1;
27 static int proto_malformed = -1;
28 static int proto_unreassembled = -1;
29
30 static expert_field ei_malformed_dissector_bug = EI_INIT;
31 static expert_field ei_malformed_reassembly = EI_INIT;
32 static expert_field ei_malformed = EI_INIT;
33
34 void
register_show_exception(void)35 register_show_exception(void)
36 {
37 static ei_register_info ei[] = {
38 { &ei_malformed_dissector_bug, { "_ws.malformed.dissector_bug", PI_MALFORMED, PI_ERROR, "Dissector bug", EXPFILL }},
39 { &ei_malformed_reassembly, { "_ws.malformed.reassembly", PI_MALFORMED, PI_ERROR, "Reassembly error", EXPFILL }},
40 { &ei_malformed, { "_ws.malformed.expert", PI_MALFORMED, PI_ERROR, "Malformed Packet (Exception occurred)", EXPFILL }},
41 };
42
43 expert_module_t* expert_malformed;
44
45 proto_short = proto_register_protocol("Short Frame", "Short frame", "_ws.short");
46 proto_malformed = proto_register_protocol("Malformed Packet",
47 "Malformed packet", "_ws.malformed");
48 proto_unreassembled = proto_register_protocol(
49 "Unreassembled Fragmented Packet",
50 "Unreassembled fragmented packet", "_ws.unreassembled");
51
52 expert_malformed = expert_register_protocol(proto_malformed);
53 expert_register_field_array(expert_malformed, ei, array_length(ei));
54
55 /* "Short Frame", "Malformed Packet", and "Unreassembled Fragmented
56 Packet" aren't really protocols, they're error indications;
57 disabling them makes no sense. */
58 proto_set_cant_toggle(proto_short);
59 proto_set_cant_toggle(proto_malformed);
60 proto_set_cant_toggle(proto_unreassembled);
61 }
62
63 void
show_exception(tvbuff_t * tvb,packet_info * pinfo,proto_tree * tree,unsigned long exception,const char * exception_message)64 show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
65 unsigned long exception, const char *exception_message)
66 {
67 static const char dissector_error_nomsg[] =
68 "Dissector writer didn't bother saying what the error was";
69 proto_item *item;
70
71 if (exception == ReportedBoundsError && pinfo->fragmented)
72 exception = FragmentBoundsError;
73
74 switch (exception) {
75
76 case ScsiBoundsError:
77 col_append_str(pinfo->cinfo, COL_INFO, "[SCSI transfer limited due to allocation_length too small]");
78 proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
79 "SCSI transfer limited due to allocation_length too small: %s truncated]", pinfo->current_proto);
80 /* Don't record ScsiBoundsError exceptions as expert events - they merely
81 * reflect a normal SCSI condition.
82 * (any case where it's caused by something else is a bug). */
83 break;
84
85 case BoundsError:
86 {
87 gboolean display_info = TRUE;
88 module_t * frame_module = prefs_find_module("frame");
89 if (frame_module != NULL)
90 {
91 pref_t *display_pref = prefs_find_preference(frame_module, "disable_packet_size_limited_in_summary");
92 if (display_pref)
93 {
94 if (prefs_get_bool_value(display_pref, pref_current))
95 display_info = FALSE;
96 }
97 }
98
99 if (display_info)
100 col_append_str(pinfo->cinfo, COL_INFO, "[Packet size limited during capture]");
101 proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
102 "[Packet size limited during capture: %s truncated]", pinfo->current_proto);
103 /* Don't record BoundsError exceptions as expert events - they merely
104 * reflect a capture done with a snapshot length too short to capture
105 * all of the packet
106 * (any case where it's caused by something else is a bug). */
107 }
108 break;
109
110 case FragmentBoundsError:
111 col_append_fstr(pinfo->cinfo, COL_INFO, "[BoundErrorUnreassembled Packet%s]", pinfo->noreassembly_reason);
112 proto_tree_add_protocol_format(tree, proto_unreassembled,
113 tvb, 0, 0, "[BoundError Unreassembled Packet%s: %s]",
114 pinfo->noreassembly_reason, pinfo->current_proto);
115 /* Don't record FragmentBoundsError exceptions as expert events - they merely
116 * reflect dissection done with reassembly turned off
117 * (any case where it's caused by something else is a bug). */
118 break;
119
120 case ContainedBoundsError:
121 col_append_fstr(pinfo->cinfo, COL_INFO, "[Malformed Packet: length of contained item exceeds length of containing item]");
122 item = proto_tree_add_protocol_format(tree, proto_malformed,
123 tvb, 0, 0, "[Malformed Packet: %s: length of contained item exceeds length of containing item]",
124 pinfo->current_proto);
125 expert_add_info(pinfo, item, &ei_malformed);
126 break;
127
128 case ReportedBoundsError:
129 show_reported_bounds_error(tvb, pinfo, tree);
130 break;
131
132 case DissectorError:
133 col_append_fstr(pinfo->cinfo, COL_INFO,
134 "[Dissector bug, protocol %s: %s]",
135 pinfo->current_proto,
136 exception_message == NULL ?
137 dissector_error_nomsg : exception_message);
138 item = proto_tree_add_protocol_format(tree, proto_malformed, tvb, 0, 0,
139 "[Dissector bug, protocol %s: %s]",
140 pinfo->current_proto,
141 exception_message == NULL ?
142 dissector_error_nomsg : exception_message);
143 ws_log(WS_LOG_DOMAIN, LOG_LEVEL_WARNING,
144 "Dissector bug, protocol %s, in packet %u: %s",
145 pinfo->current_proto, pinfo->num,
146 exception_message == NULL ?
147 dissector_error_nomsg : exception_message);
148 expert_add_info_format(pinfo, item, &ei_malformed_dissector_bug, "%s",
149 exception_message == NULL ?
150 dissector_error_nomsg : exception_message);
151 break;
152
153 case ReassemblyError:
154 col_append_fstr(pinfo->cinfo, COL_INFO,
155 "[Reassembly error, protocol %s: %s]",
156 pinfo->current_proto,
157 exception_message == NULL ?
158 dissector_error_nomsg : exception_message);
159 item = proto_tree_add_protocol_format(tree, proto_malformed, tvb, 0, 0,
160 "[Reassembly error, protocol %s: %s]",
161 pinfo->current_proto,
162 exception_message == NULL ?
163 dissector_error_nomsg : exception_message);
164 expert_add_info_format(pinfo, item, &ei_malformed_reassembly, "%s",
165 exception_message == NULL ?
166 dissector_error_nomsg : exception_message);
167 break;
168
169 default:
170 /* XXX - we want to know, if an unknown exception passed until here, don't we? */
171 ws_assert_not_reached();
172 }
173 }
174
175 void
show_reported_bounds_error(tvbuff_t * tvb,packet_info * pinfo,proto_tree * tree)176 show_reported_bounds_error(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
177 {
178 proto_item *item;
179
180 col_append_str(pinfo->cinfo, COL_INFO,
181 "[Malformed Packet]");
182 item = proto_tree_add_protocol_format(tree, proto_malformed,
183 tvb, 0, 0, "[Malformed Packet: %s]", pinfo->current_proto);
184 expert_add_info(pinfo, item, &ei_malformed);
185 }
186
187 /*
188 * Editor modelines - https://www.wireshark.org/tools/modelines.html
189 *
190 * Local variables:
191 * c-basic-offset: 8
192 * tab-width: 8
193 * indent-tabs-mode: t
194 * End:
195 *
196 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
197 * :indentSize=8:tabSize=8:noTabs=false:
198 */
199