Update parent tree node
We are looking to update the model for source generating common electronic exchanges protocols.
Currently a message may look like this:
-- Calculate size of: Trade Report Message
n24x_equities_memoirlastsale_sbe_v1_3_size_of.trade_report_message = function(buffer, offset)
local index = 0
index = index + n24x_equities_memoirlastsale_sbe_v1_3_size_of.timestamp
index = index + n24x_equities_memoirlastsale_sbe_v1_3_size_of.security_id
index = index + n24x_equities_memoirlastsale_sbe_v1_3_size_of.trade_id
index = index + n24x_equities_memoirlastsale_sbe_v1_3_size_of.trade_qty
index = index + n24x_equities_memoirlastsale_sbe_v1_3_size_of.trade_price
return index
end
-- Display: Trade Report Message
n24x_equities_memoirlastsale_sbe_v1_3_display.trade_report_message = function(buffer, offset, size, packet, parent)
return ""
end
-- Dissect Fields: Trade Report Message
n24x_equities_memoirlastsale_sbe_v1_3_dissect.trade_report_message_fields = function(buffer, offset, packet, parent)
local index = offset
-- Timestamp: 8 Byte Unsigned Fixed Width Integer
index, timestamp = n24x_equities_memoirlastsale_sbe_v1_3_dissect.timestamp(buffer, index, packet, parent)
-- Security Id: 2 Byte Unsigned Fixed Width Integer
index, security_id = n24x_equities_memoirlastsale_sbe_v1_3_dissect.security_id(buffer, index, packet, parent)
-- Trade Id: 8 Byte Unsigned Fixed Width Integer
index, trade_id = n24x_equities_memoirlastsale_sbe_v1_3_dissect.trade_id(buffer, index, packet, parent)
-- Trade Qty: 4 Byte Unsigned Fixed Width Integer
index, trade_qty = n24x_equities_memoirlastsale_sbe_v1_3_dissect.trade_qty(buffer, index, packet, parent)
-- Trade Price: 8 Byte Signed Fixed Width Integer
index, trade_price = n24x_equities_memoirlastsale_sbe_v1_3_dissect.trade_price(buffer, index, packet, parent)
return index
end
-- Dissect: Trade Report Message
n24x_equities_memoirlastsale_sbe_v1_3_dissect.trade_report_message = function(buffer, offset, packet, parent)
-- Optionally add struct element to protocol tree
if show.trade_report_message then
local length = n24x_equities_memoirlastsale_sbe_v1_3_size_of.trade_report_message(buffer, offset)
local range = buffer(offset, length)
local display = n24x_equities_memoirlastsale_sbe_v1_3_display.trade_report_message(buffer, packet, parent)
parent = parent:add(n24x_equities_memoirlastsale_sbe_v1_3.fields.trade_report_message, range, display)
end
return n24x_equities_memoirlastsale_sbe_v1_3_dissect.trade_report_message_fields(buffer, offset, packet, parent)
end
In the cases where the source generated inputs do not match the packet capture, the above code errors out on the line:
local range = buffer(offset, length)
This is a fundamental flaw when testing source generated dissectors because Wireshark errors out at the message level. It would be preferred to dissect as many message fields as possible first to see how close the binary data model is to the actual data.
Can I give the add a dummy buffer and set it after? Or is there another preferred solution?
Thanks in advance
How are you generating the dissector?
In the future I will give a talk at Sharkfest, but not important to this question. Just assume I have 100% of the information needed to make any version of the code.
https://github.com/Open-Markets-Initi...
buffer
is a tvb so you're using: (WSDG: 11.6.2. Tvb)to generate a TvbRange which errors out here: epan/wslua/wslua_tvb.c:
Could you not create a function to wrap around this which validates the parameters?
The problem is that when testing or hacking a binary protocol you don't know if the expected length of a section is actually available. In some cases, they give a length, in other cases you read ahead.
I can think of a couple of solutions. The ideal solution is a dummy message/parent tree item. If that were possible, we could add the fields and update the length at the end. Another solution is checking the available length before each field. This is doable but not as useful as making an attempt to decode the binary fields as expected.
Sounds like issue 15655, if your problem is that a packet does not contain the reported length.
If that behavior is a showstopper for you, please either fix the Lua handling in Wireshark or don't use Lua and instead generate your dissectors in C.