wireshark plugin cannot show detail infomation - wireshark-dissector

Question

We develop a software, the protocol use standard pdcp , but add 44 bytes custom datas before standard pdcp protocol.
I write a wireshark plugin to parse packages, ignore head 44 bytes custom data, parse other data use wireshark pdcp dissector. code list below :
static gint ett_dtmpdcp = -1;
static gint hf_sdtprot_pdu_Msg_Content_None
static hf_register_info hf[] = {
{ &hf_sdtprot_pdu_Msg_Content_None,
{ " ", "dtmpdcp.none",
FT_NONE, BASE_NONE,
NULL, 0x0,
NULL, HFILL }
}
};
static gint *ett[] = {
&ett_dtmpdcp
};
int packet_parse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
{
int item_offset = 44; //ignore head 44 bytes custom data
gint16 pdu_len = tvb_reported_length(tvb);
proto_item * pdcp_item = proto_tree_add_item(tree, proto_dtmpdcp, tvb, 0, -1, ENC_NA);
proto_item_append_text(pdcp_item, ",PDU len : %-05u", pdu_len);
proto_tree * subtree = proto_item_add_subtree(pdcp_item, ett_dtmpdcp);
offset += item_offset;
//use wireshark pdcp dissector,wireshark register pdcp-lte dissector in packet_pdcp_lte.c file
dissector_handle_t handle = find_dissector("pdcp-lte");
if(handle)
{
tvbuff_t* next_tvb = tvb_new_subset(tvb, offset, -1, pdu_len - item_offset);
if(next_tvb)
{
call_dissector(handle, next_tvb, pinfo, subtree);
//tvb_free(next_tvb);
}
}
return 0;
}
const char *c_proto_string = "DTM-PDCP";
static void
dissect_dtmpdcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
col_set_str(pinfo->cinfo, COL_PROTOCOL, c_proto_string);
col_clear(pinfo->cinfo,COL_INFO);
if (tree)
{
gint offset = 0;
do
{
offset = packet_parse(tvb, pinfo, tree, offset);
} while(offset > 0);
}
}
void proto_register_dtmpdcp(void)
{
module_t *sdtpprot_module;
proto_dtmpdcp = proto_register_protocol("PDCP DTM", /* name */
"a-pdcp", /* short name */
"a-pdcp" /* abbrev */
);
proto_register_field_array(proto_dtmpdcp, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
sdtpprot_module = prefs_register_protocol(proto_dtmpdcp, NULL);
prefs_register_bool_preference(sdtpprot_module, "desegment",
"Desegment all dtm-pdcp messages spanning multiple TCP segments",
"Whether the dtm-pdcp dissector should desegment all messages spanning multiple TCP segments",
&sdtpprot_desegment);
}
void proto_reg_handoff_dtmpdcp(void)
{
dissector_handle_t dtmpdcp_handle;
int port = 20000;
dtmpdcp_handle = create_dissector_handle(dissect_dtmpdcp, proto_dtmpdcp);
dissector_add_uint("udp.port", port, dtmpdcp_handle);
}
when use this plugin to dissector package, wireshark UI don't show pdcp protocol detail infomation :
PDCP parse
what's wrong with code?
Thanks a lot!

Answer 1

I would start out by removing the if (tree) check in dissect_dtmpdcp(). From README.dissector:
In the interest of speed, if "tree" is NULL, avoid building a
protocol tree and adding stuff to it, or even looking at any packet
data needed only if you're building the protocol tree, if possible.
Note, however, that you must fill in column information, create
conversations, reassemble packets, do calls to "expert" functions,
build any other persistent state needed for dissection, and call
subdissectors regardless of whether "tree" is NULL or not.
This might be inconvenient to do without doing most of the
dissection work; the routines for adding items to the protocol tree
can be passed a null protocol tree pointer, in which case they'll
return a null item pointer, and "proto_item_add_subtree()" returns
a null tree pointer if passed a null item pointer, so, if you're
careful not to dereference any null tree or item pointers, you can
accomplish this by doing all the dissection work. This might not
be as efficient as skipping that work if you're not building a
protocol tree, but if the code would have a lot of tests whether
"tree" is null if you skipped that work, you might still be better
off just doing all that work regardless of whether "tree" is null
or not.
Note also that there is no guarantee, the first time the dissector is
called, whether "tree" will be null or not; your dissector must work
correctly, building or updating whatever state information is
necessary, in either case.
In my experience, adding the check usually does more harm than good.
I'd also suggest that you examine a working Wireshark dissector such as packet-catapult-dct2000.c and modify your dissector accordingly.
For example:
static dissector_handle_t pdcp_lte_handle;
int packet_parse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset)
{
...
if (pdcp_lte_handle)
{
tvbuff_t* next_tvb = tvb_new_subset_remaining(tvb, offset);
if (next_tvb)
call_dissector(pdcp_lte_handle, next_tvb, pinfo, subtree);
}
}
void proto_reg_handoff_dtmpdcp(void)
{
...
pdcp_lte_handle = find_dissector("pdcp-lte");
...
}
If this doesn't resolve your problem, you might need to post a sample capture file somewhere (cloudshark, dropbox, etc.) to better be able to assist you.