I am trying to use lua to dissect my protocol stack. The one problem I cannot solve is this: I can get several messages that are completed in the same packet. I would then like to make tvbs for each of the completed messages and hand them over to a dissector. But if I get more than one extra tvb - and a dissector that is not the generic data-dissector - I get this fault message: "Tvbs can only be created and used in dissectors" What am I doing wrong? This is smallest lua file that can reproduce the problem:
And here a script that generates a packet to dissect
asked 03 Oct ‘16, 14:17 mj99 showing 5 of 6 show 1 more comments |
One Answer:
It seems this is a bug--what @sindy noticed made that much easier to see. I've attempted to fix the problem in change 18095. I don't have time at the moment to actually test the change--maybe tonight (if you don't beat me to it :-)). answered 06 Oct '16, 07:34 JeffMorriss ♦ Thanks a lot for your work. I am, for the moment, away from my build environment. I will try to build tomorrow CET. (06 Oct '16, 14:08) mj99 I did not manage to build wireshark with lua support. Can I download a build with the change to test it? (08 Oct '16, 15:30) mj99 Sorry, I haven't had a chance to do anything more with this yet. Once I can test it then I can merge the change and you'll be able to pick up an automated build. I just need some free time... (13 Oct '16, 12:31) JeffMorriss ♦ It turns out my change was incomplete but I fixed that and now it works well. Just awaiting code-review and merge. (13 Oct '16, 18:55) JeffMorriss ♦ The change was merged about an hour ago. You should be able to pick up an automated build from here fairly soon. Choose a version with the number 1042 or higher (as in "v2.3.0rc0-1042-g3868252"). (14 Oct '16, 10:57) JeffMorriss ♦ The problem occurs in a very specific situation: a Lua dissector calls another Lua dissector, then invokes (14 Oct '16, 14:07) Lekensteyn Yep, just did (actually before I saw your note but...). (14 Oct '16, 18:09) JeffMorriss ♦ showing 5 of 7 show 2 more comments |
Not that I would understand why, but if you first create both new tvbs and then dissect them, it works:
makes
Thanks a lot for this workaround!
I will try to use this, but I think I will have to do two passes over the tvb since I do not know how many reassembled tvbs I will get from a packet and I like to have the reassembled messages along with the fragment that made it complete.
Thanks a lot, I could make my dissector work based on this.
It was however quite painful. I got a lot of “expired tvb” errors before I figured out how to juggle it.
Is it my code in the question that is buggy some way I cannot see, or is it wireshark that does not support doing this with lua?
I think it’s a bug and I think I see where the problem is. Let me see if I can whip together a patch…
@mj99 Where did you get the idea of using
ByteArray.tvb(bytes, “first”)
instead ofbytes:tvb(“first”)
? The former is not supposed to work and might break in future versions of Wireshark.I’d suppose the OP has copied the idea from the “official” example page.