Wireshark dissector for dbd 'wire protocol', in lua

diff --git a/contrib/wireshark/cnid.lua b/contrib/wireshark/cnid.lua
new file mode 100644 (file)
index 0000000..3b21723
--- /dev/null
+++ b/contrib/wireshark/cnid.lua
@@ -0,0 +1,123 @@
+-- 
+-- Netatalk DBD protocol 
+-- wireshark -X lua_script:cnid.lua
+-- don't forget to comment out the line disable_lua = true; do return end;
+-- in /etc/wireshark/init.lua
+
+-- global environment
+local b = _G
+
+-- declare our protocol
+local dbd_proto = Proto("dbd","Netatalk Dbd Wire Protocol")
+
+local cmd = ProtoField.uint32("dbd.cmd", "Request") -- , base.HEX
+local len = ProtoField.uint32("dbd.name.len", "Name Length")
+local filename = ProtoField.string("dbd.name", "Name")
+local error = ProtoField.uint32("dbd.error", "Error code")
+local cnid = ProtoField.uint32("dbd.cnid", "Cnid")
+local did  = ProtoField.uint32("dbd.did", "Parent Directory Id")
+local dev  = ProtoField.uint64("dbd.dev", "Device number")
+local ino  = ProtoField.uint64("dbd.ino", "Inode number")
+local type = ProtoField.uint32("dbd.type", "File type")
+
+dbd_proto.fields = {cmd, error, cnid, did, dev, ino, type, filename, len}
+
+--- Request list
+local Cmd = { [3] = "add", 
+             [4] = "get", 
+             [5] = "resolve", 
+             [6] = "lookup", 
+             [7] = "update", 
+             [8] = "delete", 
+             [11] = "timestamp" 
+           }
+
+--- display a filename 
+local function fname(buffer, pinfo, tree, len, ofs)
+
+    pinfo.cols.info:append(" Name=" .. buffer(ofs +4, len):string())
+
+    local subtree = tree:add(buffer(ofs, len +4), buffer(ofs +4, len):string())
+    subtree:add(filename, buffer(ofs +4, len))
+
+    return subtree
+end
+
+-- create a function to dissect it
+function dbd_proto.dissector(buffer, pinfo, tree)
+
+
+    pinfo.cols.protocol = "DBD"
+
+    local subtree = tree:add(dbd_proto,buffer(),"Netatalk DBD Wire Protocol")
+
+    if pinfo.dst_port == 4700 then
+           pinfo.cols.info = "Query"
+           local val = buffer(0,4):uint()
+           local item = subtree:add(cmd, buffer(0,4))
+           if Cmd[val] then
+               item:append_text(" (" .. Cmd[val] .. ")")
+               pinfo.cols.info = Cmd[val]
+
+               local val = buffer(4,4):uint()
+               if val ~= 0 then
+                       pinfo.cols.info:append(" Cnid=" .. val)
+               end
+               subtree:add(cnid, buffer(4, 4))
+               subtree:add(dev, buffer(8, 8))
+               subtree:add(ino, buffer(16, 8))
+               subtree:add(type, buffer(24, 4))
+
+               local val = buffer(28,4):uint()
+               if val ~= 0 then
+                  pinfo.cols.info:append(" Did=" .. val)
+               end
+               subtree:add(did, buffer(28, 4))
+
+               local val = buffer(36,4):uint()
+               if val ~= 0 then
+                  item = fname(buffer, pinfo, subtree, val, 36)
+                  item:add(len, buffer(36, 4))
+                       
+               end
+           end
+    else
+           pinfo.cols.info = "Reply"
+
+           local rply = {}
+           
+           local val = buffer(0,4):uint()
+           rply.error = val
+           subtree:add(error, buffer(0,4))
+           if val ~= 0 then
+               pinfo.cols.info:append(" Error=" .. val)
+           end
+
+           val = buffer(4,4):uint()
+           rply.cnid = val
+           subtree:add(cnid, buffer(4,4))
+           if val ~= 0 then
+               pinfo.cols.info:append(" Cnid=" .. val)
+           end
+
+           val = buffer(8,4):uint()
+           rply.did = val
+           subtree:add(did, buffer(8,4))
+           if val ~= 0 then
+               pinfo.cols.info:append(" Did=" .. val)
+           end
+
+           val = buffer(16,4):uint()
+           rply.len = val
+           
+           if rply.error == 0 and rply.did ~= 0 then
+              subtree = fname(buffer, pinfo, subtree, val, 16)
+              subtree:add(len, buffer(16,4))
+           end
+    end
+end
+
+-- load the tcp.port table
+local tcp_table = DissectorTable.get("tcp.port")
+-- register our protocol 
+tcp_table:add(4700, dbd_proto)