I'm unable to display a string as a XML tree in Wireshark/Lua plugin

1
votes

I have a packet stream that includes an encrypted XML payload. I'm working on a Wireshark/Lua plugin to display the XML data after it is decrypted. Here is what I have right now:

decoded_buffer = ProtoField.string("tacserver.decoded_buffer", "XML")
.....
function tacserver_protocol.dissector(buffer, pinfo, tree)
     .....
     local decoded_string = decode(buffer(10))
     subtree:add(decoded_buffer, decoded_string)

     local xml_dis = Dissector.get("xml")
     local byte_array = ByteArray.new(decoded_string)
     local tvb = ByteArray.tvb(byte_array, "XMLdata");
     xml_dis:call(tvb, pinfo, tree)

I call the decode function to decrypt the XML payload and store the result in decoded_string. In Wireshark when the data is displayed as a string the output is correct.

XML [truncated]: <?xml version="1.0" encoding="UTF-8" ?>\n<body>\n<TacServerInfo...
eXtensible Markup Language

However, the call to the XML dissector doesn't generate any output. What do I need to do to dump the decoded data as a XML tree? Thanks!

Here is the version info:

Version 2.6.10 (Git v2.6.10 packaged as 2.6.10-1~ubuntu18.04.0) 
Copyright 1998-2019 Gerald Combs <[email protected]> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
Compiled (64-bit) with Qt 5.9.5, with libpcap, with POSIX capabilities (Linux), with libnl 3, with GLib 2.56.4, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.5.18, with Gcrypt 1.8.1, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.30.0, with LZ4, with Snappy, with libxml2 2.9.4, with QtMultimedia, with SBC, with SpanDSP, without bcg729. 
Running on Linux 5.3.0-61-generic, with Intel(R) Core(TM) i5-7440HQ CPU @ 2.80GHz (with SSE4.2), with 3864 MB of physical memory, with locale en_US.UTF-8, with libpcap version 1.8.1, with GnuTLS 3.5.18, with Gcrypt 1.8.1, with zlib 1.2.11, binary plugins supported (14 loaded). Built using gcc 7.4.0. 
Wireshark is Open Source Software released under the GNU General Public License. 
Check the man page and http://www.wireshark.org for more information.
2
luawireshark-dissector

2 Answers

1
votes

I figured out the issue. Decoded string is a raw string so I needed to change the line to:

byte_array = ByteArray.new(decoded_string, true)
0
votes

I believe this is just a simple matter of moving the call to Dissector.get("xml") outside the tacserver_protocol.dissector() function, i.e.:

local xml_dis = Dissector.get("xml")

function tacserver_protocol.dissector(buffer, pinfo, tree)
    .....
    local decoded_string = decode(buffer(10))
    subtree:add(decoded_buffer, decoded_string)

    local byte_array = ByteArray.new(decoded_string)
    local tvb = ByteArray.tvb(byte_array, "XMLdata");
    xml_dis:call(tvb, pinfo, tree)
    .....
end