Wireshark · Wireshark-dev: Re: [Wireshark-dev] Using Lua to parse TCP encapsulated IP protocol

["Luis Ontanon" <luis.ontanon@xxxxxxxxx>]

Well the Lua API should intercept those conditions that would cause a
crash and notify an error to the user, a crash is a bug regardless of
how you get to it.

I'll take a look at that data to see if that triggersa creash if
calling the IP dissector directly.

Luis

1/29/07, Scott Robinson <scott.anthony.robinson@xxxxxxxxx> wrote:
> Hi Luis,
>
> I tried 0.99.5pre1 (WinXP - still crashes) and even started building the
> Linux client to test, that's when I noticed the capture file seemed to
> partially load before crashing.
>
> I switched to tshark and was able to verify a specific packet was always
> causing the crash. When I investigated further, I found my capture file had
> traffic that included messages that were not encapsulated IP.
>
> The crash occurred when  a non IP  payload was feed to the IP dissector.
> I've added some defensive code in my Lua program to check for a valid IP
> header before passing the tvb off to the IP dissector. Everything works
> great now.
>
> So I'm not sure there's any to do in the wireshark code base. Ideally a
> dissector shouldn't crash on bad data, but the only way this got there was
> my lua code that didn't do enough sanity checking on the payload.
>
> Here's the payload that was passed to the ip dissector that caused the
> crash.
>  0a 64 64 14 00 00 00 00 00 00 00 00
> versus the expected:
>  45 00 ...
>
> I'm guessing the 0a -> indicated 40 bytes of ip header length was causing
> the dissector to go off the end of the packet buffer and cause the crash.
>
> Thanks also for the tip on the sub range creation. I thought that might
> work, but when the program was crashing, I was a bit leery about going
> beyond the example code I found.
>
> Thanks again for the help.
> -Scott
>
> > Date: Tue, 23 Jan 2007 21:42:32 +0100
> > From: "Luis Ontanon" <luis.ontanon@xxxxxxxxx>
> > Subject: Re: [Wireshark-dev] Using Lua to parse TCP encapsulated IP
> >         protocol
> > To: "Developer support list for Wireshark"
> >         <wireshark-dev@xxxxxxxxxxxxx>
>
> >
> > Hi,
> > * Can you test it against 0.99.5pre1?
> > I cannot make it crash (works OK for me), could you send the capture
> > file that does crash?
> > Could you eventually send in also the output of wireshark -v
> >
> > Thanks
> > Luis
> >
> > BTW
> > sub_buf = buffer( 4, buffer:len() - 4 ):tvb()
> > is the same as
> > sub_buf = buffer(4):tvb()
> >
> >
> > On 1/22/07, Scott Robinson <
> scott.anthony.robinson@xxxxxxxxx> wrote:
> > > Hi,
> > >
> > > I've been using Lua to create a dissector for a protocol that has IP
> > > encapsulated inside TCP with an additional header. Everything works fine
> > > until I try to create a new tvb off from a tvbsubrange. When I do this,
> > > Wireshark crashes. The new tvb appeared correct when I added debug
> > > statements (pointing at the correct data, and length are correct).
> > >
> > > The Lua and Wireshark docs refered to the Tvb.new_subset function to
> create
> > > a new sub tvb for an encapsulated protocol. I couldn't get that to work
> and
> > > used something like buffer(4,n):tvb().
> > >
> > > I've only been looking at the Wireshark and Lua code for a short time
> now,
> > > so I'm hoping I'm just coding something up wrong. Any pointers would be
> > > greatly appreciated.
> > >
> > > Here's a sample of the code that was crashing. If I comment out the line
> > > that tries to pass the new sub tvb to the ip dissector, or just pass the
> > > original buffer to the ip dissector, wireshark doesn't crash (although
> it
> > > doesn't decode like I need it too)
> > >
> > > Thanks.
> > > -Scott
> > > -- Define our protocol
> > > my_proto  = Proto("myproto", "MINE", "My Protocol")
> > >
> > >
> > > -- Create a function to dissect my_proto
> > > function my_proto.dissector( buffer, pinfo, tree )
> > >    local subtree = tree:add( my_proto, buffer, "My Proto Header" )
> > >
> > >    subtree:add( buffer(0,1), "Version: "  .. buffer(0,1):uint() )
> > >     subtree:add( buffer(1,1), "Type: "     .. buffer(1,1):uint() )
> > >    subtree:add( buffer(2,2), "Sequence: " .. buffer(2,2):uint() )
> > >
> > >    ip_dissector = Dissector.get("ip")
> > >
> > >    -- skip over the header in front of the encapsulated ip packet
> > >    sub_buf = buffer( 4, buffer:len() - 4 ):tvb()
> > >
> > >    ip_dissector:call( sub_buf, pinfo, tree )
> > >
> > > end
> > >
> > > -- load the tcp port table
> > > tcp_table = DissectorTable.get("tcp.port")
>  > >
> > > -- register our protocol
> > > tcp_table:add(7000, my_proto)
> > >
> > >
>
>
>
>
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev


--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan