Wireshark 协议插件Lua开发 -数据包内嵌协议的解释

概述

因为公司项目涉及的协议打包，协议包内又嵌了一层IP包的奇葩套娃结构，为了方便抓包调试，利用Wireshark的协议插件开发功能，写了一个插件，博文记录以备忘。

环境信息

Wireshark 4.0.3

协议结构体套娃图

插件安装

将对应的协议解释文件复制到Wireshark安装目录\plugins<版本号>
然后通过菜单按钮【分析】->【重新载入Lua插件】，即可完成插件加载

完整代码

-- @brief XXX Protocol dissector plugin
-- @author XXX
-- @date 2023.12.03

-- create a new dissector
local NAME = "XXX"
local PORT = 2998
local foo = Proto(NAME, "XXX Protocol")

local fields = foo.fields
fields.ss = ProtoField.bytes(NAME .. ".ss", "SS", base.SPACE)
fields.payload = ProtoField.bytes(NAME .. ".payload", "XXX Payload", base.None)
fields.ic = ProtoField.bytes(NAME .. ".ic", "ic", base.SPACE)

-- dissect packet
function foo.dissector (buf, pinfo, tree)
	if buf:len() == 0 or buf:len() < 30 then return end
	local subtree = tree:add(foo)
	subtree:add(fields.ss, buf(0,20))
	subtree:add(fields.ic, buf(buf:len() - 10, 10))
	subtree:add(fields.payload, buf(20,buf:len() - 30))
	-- 提取内嵌的数据
	local raw_data = buf(20,buf:len() - 30)
    -- 内嵌了一层IP协议，所以调用内部的Dissector解释
    Dissector.get("ip"):call(raw_data:tvb(), pinfo, tree)
end

-- 将协议添加到右键Decode As，不写该行，只能根据端口啥的绑定具体的协议
DissectorTable.get("udp.port"):add_for_decode_as(foo)
DissectorTable.get("tcp.port"):add_for_decode_as(foo)
-- register this dissector
DissectorTable.get("udp.port"):add(PORT, foo)

效果图

后续

这种结构，在插件的实现逻辑如下

fields.flags = ProtoField.uint8(NAME .. ".flags", "Flags", base.HEX)
fields.flags_df = ProtoField.uint8(NAME .. ".flags.df", "DF", base.HEX)
fields.flags_mf = ProtoField.uint8(NAME .. ".flags.mf", "mF", base.HEX)
function foo.dissector (buf, pinfo, tree)
	local flagTree = subtree:add(fields.flags , buf(0,20)) --add函数返回的是子树，直接添加就可以了
	local flags = buf(3,1):uint()
	local v = buf(3,1):bitfield(0,1)
	flagsTree:add(fields.df, buf(3,1),v, v .. "... ...." .. " = Don't fragment: " .. (v == 1 and "Set" or "Not set"))	
	local mf = buf(3,1):bitfield(1,1)
	flagsTree:add(fields.mf, buf(3,1),mf, "." .. mf .. ".. .... = More fragments: " .. (mf == 1 and "Set" or "Not set"))
	...
end

参考链接

实战编写 wireshark 插件解析私有协议
Functions For New Protocols And Dissectors
Wireshark解析器（Dissector）插件-Lua
自己动手编写Wireshark Lua插件解析自定义协议
Mika’s tech blog