Wireshark 协议插件Lua开发 -数据包内嵌协议的解释

红太狼 2024-02-05 11:27 28阅读 0赞

## 概述 ##

因为公司项目涉及的协议打包，协议包内又嵌了一层IP包的奇葩套娃结构，为了方便抓包调试，利用Wireshark的协议插件开发功能，写了一个插件，博文记录以备忘。

## 环境信息 ##

Wireshark 4.0.3

## 协议结构体套娃图 ##

![在这里插入图片描述][547407773d7441dcbcc19a0d77684e1c.png]

## 插件安装 ##

将对应的协议解释文件复制到Wireshark安装目录\\plugins<版本号>  
然后通过菜单按钮【分析】->【重新载入Lua插件】，即可完成插件加载

## 完整代码 ##

-- @brief XXX Protocol dissector plugin
    -- @author XXX
    -- @date 2023.12.03
    
    -- create a new dissector
    local NAME = "XXX"
    local PORT = 2998
    local foo = Proto(NAME, "XXX Protocol")
    
    local fields = foo.fields
    fields.ss = ProtoField.bytes(NAME .. ".ss", "SS", base.SPACE)
    fields.payload = ProtoField.bytes(NAME .. ".payload", "XXX Payload", base.None)
    fields.ic = ProtoField.bytes(NAME .. ".ic", "ic", base.SPACE)
    
    -- dissect packet
    function foo.dissector (buf, pinfo, tree)
    	if buf:len() == 0 or buf:len() < 30 then return end
    	local subtree = tree:add(foo)
    	subtree:add(fields.ss, buf(0,20))
    	subtree:add(fields.ic, buf(buf:len() - 10, 10))
    	subtree:add(fields.payload, buf(20,buf:len() - 30))
    	-- 提取内嵌的数据
    	local raw_data = buf(20,buf:len() - 30)
        -- 内嵌了一层IP协议，所以调用内部的Dissector解释
        Dissector.get("ip"):call(raw_data:tvb(), pinfo, tree)
    end
    
    -- 将协议添加到右键Decode As，不写该行，只能根据端口啥的绑定具体的协议
    DissectorTable.get("udp.port"):add_for_decode_as(foo)
    DissectorTable.get("tcp.port"):add_for_decode_as(foo)
    -- register this dissector
    DissectorTable.get("udp.port"):add(PORT, foo)

## 效果图 ##

![在这里插入图片描述][dd9ddd19df1f419d9b674b8305d430c9.png]

## 后续 ##

![在这里插入图片描述][5f07ee42037e4be9902723bc19fe29ac.png]这种结构，在插件的实现逻辑如下

fields.flags = ProtoField.uint8(NAME .. ".flags", "Flags", base.HEX)
    fields.flags_df = ProtoField.uint8(NAME .. ".flags.df", "DF", base.HEX)
    fields.flags_mf = ProtoField.uint8(NAME .. ".flags.mf", "mF", base.HEX)
    function foo.dissector (buf, pinfo, tree)
    	local flagTree = subtree:add(fields.flags , buf(0,20)) --add函数返回的是子树，直接添加就可以了
    	local flags = buf(3,1):uint()
    	local v = buf(3,1):bitfield(0,1)
    	flagsTree:add(fields.df, buf(3,1),v, v .. "... ...." .. " = Don't fragment: " .. (v == 1 and "Set" or "Not set"))	
    	local mf = buf(3,1):bitfield(1,1)
    	flagsTree:add(fields.mf, buf(3,1),mf, "." .. mf .. ".. .... = More fragments: " .. (mf == 1 and "Set" or "Not set"))
    	...
    end

## 参考链接 ##

[实战编写 wireshark 插件解析私有协议][wireshark]  
[Functions For New Protocols And Dissectors][]  
[Wireshark解析器（Dissector）插件-Lua][Wireshark_Dissector_-Lua]  
[自己动手编写Wireshark Lua插件解析自定义协议][Wireshark Lua]  
[Mika’s tech blog][Mika_s tech blog]

[547407773d7441dcbcc19a0d77684e1c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/02/05/d2e216e07b83442f90c978748354b775.png
[dd9ddd19df1f419d9b674b8305d430c9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/02/05/5bc65a72347e41d8ad9608d3d464e675.png
[5f07ee42037e4be9902723bc19fe29ac.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/02/05/4a5bd9f7306f41f89f2f73d37197fe4e.png
[wireshark]: https://cloud.tencent.com/developer/article/1696433
[Functions For New Protocols And Dissectors]: https://www.wireshark.org/docs/wsdg_html_chunked/lua_module_Proto.html#lua_class_Dissector
[Wireshark_Dissector_-Lua]: https://blog.csdn.net/heusunduo88/article/details/129857614
[Wireshark Lua]: https://zhuanlan.zhihu.com/p/114669991?utm_id=0
[Mika_s tech blog]: https://mika-s.github.io/wireshark/lua/dissector/2018/12/18/creating-a-wireshark-dissector-in-lua-5.html