Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

lua plugin calling built-in dissector, does not pass pkt data to it

Hello, I have a use case where the data I need to dissect can be wrapped in couple different ways. The data can arrive in an ethernet packet with special ether-type (say, my-ethernet-type) or it can arrive in an IP packet with a special ip-protocol (say, my-ip-protocol). The payloads in both cases is exactly same.

I have written a built-in dissector for my-ip-protocol, and it works fine when data arrives in ip packets. The built-in dissector function looks like: dissect_my_ip_protocol(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)

To dissect data that arrives in an ethernet frame with ether-type = my-ether-type, I have written the below lua script.

My problem is: - The lua script calls the built-in dissector dissect_my_ip_protocol() However, the last argument to that function 'void *data', is always NULL So, my built-in dissector cannot dissect the packet.

  • if I print tvb in the lua script, it shows it has sufficient data.

  • The translation of my_ip_proto_dissector:call(buffer():tvb(), pinfo, tree) to dissect_my_ip_protocol(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) is messed up somehow.

  • What am I doing wrong?

Thank you for your help.


my_mac_encap_protocol = Proto("My_Mac_Data", "MAC Data") my_ip_proto_dissector = Dissector.get("my-ip-protocol")

function my_mac_encap_protocol.dissector(buffer, pinfo, tree) local length = buffer:len() if length == 0 then return end

    pinfo.cols.protocol = my_mac_encap_protocol.name

    my_ip_proto_dissector:call(buffer():tvb(), pinfo, tree)

end

-- Register the my-ethernet-type dissector local eth_type = DissectorTable.get("ethertype")

eth_type:add(my-ethernet-type, my_mac_encap_protocol)

lua plugin calling built-in dissector, does not pass pkt data to it

Hello, I have a use case where the data I need to dissect can be wrapped in couple different ways. The data can arrive in an ethernet packet with special ether-type (say, my-ethernet-type) or it can arrive in an IP packet with a special ip-protocol (say, my-ip-protocol). The payloads in both cases is exactly same.

I have written a built-in dissector for my-ip-protocol, and it works fine when data arrives in ip packets. The built-in dissector function looks like: dissect_my_ip_protocol(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)

To dissect data that arrives in an ethernet frame with ether-type = my-ether-type, I have written the below lua script.

My problem is: - The lua script calls the built-in dissector dissect_my_ip_protocol() However, the last argument to that function 'void *data', is always NULL So, my built-in dissector cannot dissect the packet.

  • if I print tvb in the lua script, it shows it has sufficient data.

  • The translation of my_ip_proto_dissector:call(buffer():tvb(), pinfo, tree) to dissect_my_ip_protocol(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) is messed up somehow.

  • What am I doing wrong?

Thank you for your help.


my_mac_encap_protocol = Proto("My_Mac_Data", "MAC Data")
my_ip_proto_dissector = Dissector.get("my-ip-protocol")

Dissector.get("my-ip-protocol") function my_mac_encap_protocol.dissector(buffer, pinfo, tree) local length = buffer:len() if length == 0 then return end

end

        pinfo.cols.protocol = my_mac_encap_protocol.name

     my_ip_proto_dissector:call(buffer():tvb(), pinfo, tree)

end

end -- Register the my-ethernet-type dissector local eth_type = DissectorTable.get("ethertype")

DissectorTable.get("ethertype") eth_type:add(my-ethernet-type, my_mac_encap_protocol)

my_mac_encap_protocol)