get http payload when writing wireshark lua chained HTTP dissector - wireshark-dissector

Question

My protocol is based on HTTP, I need a dissector to analyze the HTTP payload. How to get the http payload in the dissector function?
The chained dissector looks like:
local original_http_dissector = DissectorTable.get("tcp.port"):get_dissector(80)
local function my_dissector(buf, pkt, root)
-- 'buf' here contains all tcp data,
-- including the http header
-- How to get the http payload only(skip http header)?
local b = buf
end
function p_MM.dissector(buf, pkt, root)
if original_http_dissector:call(buf, pkt, root) then
my_dissector(buf, pkt, root)
end
end

Answer 1

I've struggled a bit with trying to do similar. The below (based on http_extra at https://wiki.wireshark.org/Lua/Dissector) puts the http content in a new data tab and then does some very basic processing (xor with 0xA5, which turns out to be a bit of a faff) and displays that in a second tab.
do
local http_proto = Proto("http_extra", "Further process HTTP traffic");
local f_http_data = Field.new("http.file_data")
local original_http_dissector
-- simple function to XOR data against 0xA5 to show some processing
-- it turns out it's actually quite hard to reconstruct a tvb for display
-- as you need it in hex string format
function xorf(data)
data = data:raw()
local d = {}
for i = 1, data:len() do
local x = bit32.bxor(data:byte(i), 0xA5)
local c = string.format("%02x", x)
table.insert(d, c)
end
return table.concat(d, "")
end
function http_proto.dissector(tvbuffer, pinfo, treeitem)
-- we've replaced the original http dissector in the
-- dissector table, but we still want the original to run,
-- especially because we need to read its data
original_http_dissector:call(tvbuffer, pinfo, treeitem)
-- validate packet length is adequate, otherwise quit
if tvbuffer:len() == 0 then return end
local a=f_http_data()
if a then
-- get the (whole) subset as a tvbrange
local tvbrange = a.range()
-- get a ByteArray composed of the bytes in the TvbRange
local data = tvbrange:bytes()
-- create a new tab
local tvc = ByteArray.tvb(data, "http.file_data")
-- process the http.file_data to change it
local tvy = ByteArray.tvb(ByteArray.new(xorf(data)), "xor'ed")
end
end
local tcp_dissector_table = DissectorTable.get("tcp.port")
-- save the original dissector so we can still get to it
original_http_dissector = tcp_dissector_table:get_dissector(443)
-- and take its place in the dissector table
tcp_dissector_table:add(443, http_proto)
end