test/lua/verify_dissector.lua

   1 -- This is a test script for tshark.
   2 -- This script runs inside tshark.
   3 -- FIRST run tshark with the "dns_dissector.lua" plugin, with the dns_port.pcap file,
   4 -- and with full tree output (-V switch).  Pipe that to a file named testin.txt.
   5 -- This verify script then reads in that testin.txt. The filename can be specified
   6 -- using the "verify_file" argument.
   7 --
   8 -- tshark -r bogus.cap -X lua_script:<path_to_testdir>/lua/verify_dns_dissector.lua
   9
  10 local function testing(...)
  11     print("---- Testing "..tostring(...).." ----")
  12 end
  13
  14 local lines = {
  15     {
  16         "MyDNS Protocol",
  17         "Transaction ID: 42",
  18         "Flags: 0x0100",
  19         "0... .... .... .... = Response: this is a query",
  20         "[Expert Info (Chat/Request): DNS query message]",
  21         "[DNS query message]",
  22         "[Severity level: Chat]",
  23         "[Group: Request]",
  24         ".000 0... .... .... = Opcode: 0",
  25         ".... ..0. .... .... = Truncated: False",
  26         ".... ...1 .... .... = Recursion desired: yes",
  27         ".... .... .0.. .... = World War Z - Reserved for future use: 0x0",
  28         ".... .... ...0 .... = Checking disabled: False",
  29         "Number of Questions: 1",
  30         "Number of Answer RRs: 0",
  31         "Number of Authority RRs: 0",
  32         "Number of Additional RRs: 0",
  33         "Queries",
  34         "us.pool.ntp.org: type A (IPv4 host address) (1), class IN (Internet) (1)",
  35         "Name: us.pool.ntp.org",
  36         "[Name Length: 17]",
  37         "[Label Count: 4]",
  38         "Type: A (IPv4 host address) (1)",
  39         "Class: IN (Internet) (1)",
  40     },
  41
  42     {
  43         "MyDNS Protocol",
  44         "Transaction ID: 42",
  45         "Flags: 0x8180",
  46         "1... .... .... .... = Response: this is a response",
  47         "[Expert Info (Chat/Response): It's a response!]",
  48         "[It's a response!]",
  49         "[Severity level: Chat]",
  50         "[Group: Response]",
  51          ".000 0... .... .... = Opcode: 0",
  52         ".... .0.. .... .... = Authoritative: False",
  53         ".... ..0. .... .... = Truncated: False",
  54         ".... .... 1... .... = Recursion available: True",
  55         ".... .... .0.. .... = World War Z - Reserved for future use: 0x0",
  56         ".... .... ..0. .... = Authenticated: no",
  57         ".... .... .... 0000 = Response code: No Error (0)",
  58         ".... .... ...0 .... = Checking disabled: False",
  59         "DNS answer to life, the universe, and everything",
  60         "[Expert Info (Note/Comment): DNS answer to life, the universe, and everything]",
  61         "[DNS answer to life, the universe, and everything]",
  62         "[Severity level: Note]",
  63         "[Group: Comment]",
  64         "Number of Questions: 1",
  65         "Number of Answer RRs: 15",
  66         "Number of Authority RRs: 6",
  67         "Number of Additional RRs: 2",
  68         "Queries",
  69         "us.pool.ntp.org: type A (IPv4 host address) (1), class IN (Internet) (1)",
  70         "Name: us.pool.ntp.org",
  71         "[Name Length: 17]",
  72         "[Label Count: 4]",
  73         "Type: A (IPv4 host address) (1)",
  74         "Class: IN (Internet) (1)",
  75     },
  76
  77     {
  78         "MyDNS Protocol",
  79         "Transaction ID: 43",
  80         "Flags: 0x0100",
  81         "0... .... .... .... = Response: this is a query",
  82         "[Expert Info (Chat/Request): DNS query message]",
  83         "[DNS query message]",
  84         "[Severity level: Chat]",
  85         "[Group: Request]",
  86        ".000 0... .... .... = Opcode: 0",
  87         ".... ..0. .... .... = Truncated: False",
  88         ".... ...1 .... .... = Recursion desired: yes",
  89         ".... .... .0.. .... = World War Z - Reserved for future use: 0x0",
  90         ".... .... ...0 .... = Checking disabled: False",
  91         "Number of Questions: 1",
  92         "Number of Answer RRs: 0",
  93         "Number of Authority RRs: 0",
  94         "Number of Additional RRs: 0",
  95         "Queries",
  96         "us.pool.ntp.org: type A (IPv4 host address) (1), class IN (Internet) (1)",
  97         "Name: us.pool.ntp.org",
  98         "[Name Length: 17]",
  99         "[Label Count: 4]",
 100         "Type: A (IPv4 host address) (1)",
 101         "Class: IN (Internet) (1)",
 102     },
 103
 104     {
 105         "MyDNS Protocol",
 106         "Transaction ID: 43",
 107         "Flags: 0x8180",
 108         "1... .... .... .... = Response: this is a response",
 109         "[Expert Info (Chat/Response): It's a response!]",
 110         "[It's a response!]",
 111         "[Severity level: Chat]",
 112         "[Group: Response]",
 113          ".000 0... .... .... = Opcode: 0",
 114         ".... .0.. .... .... = Authoritative: False",
 115         ".... ..0. .... .... = Truncated: False",
 116         ".... .... 1... .... = Recursion available: True",
 117         ".... .... .0.. .... = World War Z - Reserved for future use: 0x0",
 118         ".... .... ..0. .... = Authenticated: no",
 119         ".... .... .... 0000 = Response code: No Error (0)",
 120         ".... .... ...0 .... = Checking disabled: False",
 121         "Number of Questions: 1",
 122         "Number of Answer RRs: 15",
 123         "Number of Authority RRs: 6",
 124         "Number of Additional RRs: 2",
 125         "Queries",
 126         "us.pool.ntp.org: type A (IPv4 host address) (1), class IN (Internet) (1)",
 127         "Name: us.pool.ntp.org",
 128         "[Name Length: 17]",
 129         "[Label Count: 4]",
 130         "Type: A (IPv4 host address) (1)",
 131         "Class: IN (Internet) (1)",
 132     },
 133 }
 134
 135 -- we're going to see those two sets of output twice: both by the normal
 136 -- dissector, then the first one by the heuristic, then the second one by
 137 -- a conversation match
 138 local numtests = 1 + #lines[1] + #lines[2] + #lines[3] + #lines[4]
 139
 140 local hasHeuristic = true
 141
 142 local verify_file = "testin.txt"
 143
 144 -- grab passed-in arguments
 145 local args = { ... }
 146 if #args > 0 then
 147     for _, arg in ipairs(args) do
 148         local name, value = arg:match("(.+)=(.+)")
 149         if arg == "no_heur" then
 150             numtests = numtests - 1
 151         elseif name == "verify_file" and value then
 152             verify_file = value
 153         end
 154     end
 155 end
 156
 157 print("going to run "..numtests.." tests")
 158
 159 -- for an example of what we're reading through to verify, look at end of this file
 160 print("opening file "..verify_file)
 161 local file = io.open(verify_file, "r")
 162 local line = file:read()
 163
 164 local pktidx = 1
 165 local total = 0
 166 local found = false
 167
 168 while line do
 169     -- eat beginning whitespace
 170     line = line:gsub("^%s+","",1)
 171     if line:find("^Frame %d+:") then
 172         pktidx = line:match("^Frame (%d+):")
 173         testing("Frame "..pktidx)
 174         pktidx = tonumber(pktidx)
 175         if pktidx > 4 then pktidx = pktidx - 4 end
 176         line = file:read()
 177     elseif line:find("%[Heuristic dissector used%]") then
 178         -- start again, because it now repeats
 179         -- but we should not see this [Heuristic dissector used] line again
 180         -- or it's an error in setting the conversation
 181         if found then
 182             error("Heuristic dissector ran twice - conversation setting not working?")
 183             return
 184         end
 185         found = true
 186         total = total + 1
 187         line = file:read()
 188     elseif line == lines[pktidx][1] then
 189         -- we've matched the first line of our section
 190         -- now verify the rest is sequential
 191         for i, v in ipairs(lines[pktidx]) do
 192             io.stdout:write("testing Frame "..pktidx..", line "..i.."...")
 193             if not line then
 194                 -- ended too soon
 195                 io.stdout:write("failed!\n")
 196                 error("Ran out of file lines!")
 197                 return
 198             end
 199             -- eat beginning whitespace
 200             line = line:gsub("^%s+","",1)
 201             if line ~= v then
 202                 io.stdout:write("failed!\n")
 203                 print("Got this:'"..line.."', expected this:'"..v.."'")
 204                 error("mismatched lines!")
 205                 return
 206             end
 207             io.stdout:write("passed\n")
 208             total = total + 1
 209             line = file:read()
 210         end
 211     else
 212         line = file:read()
 213     end
 214 end
 215
 216 print(total.." of "..numtests.." tests run and passed")
 217
 218 if total ~= numtests then
 219     error("Did not find all our lines to test!")
 220     return
 221 end
 222
 223 print("\n-----------------------------\n")
 224 -- must print out the following for success (the test shell sciprt looks for this)
 225 print("All tests passed!\n\n")
 226
 227
 228 ----------------------------------------------------------
 229 -- We should see something like this:
 230 --[[
 231 Frame 1: 75 bytes on wire (600 bits), 75 bytes captured (600 bits)
 232     Encapsulation type: Ethernet (1)
 233     Arrival Time: Sep 26, 2004 23:18:04.938672000 EDT
 234     [Time shift for this packet: 0.000000000 seconds]
 235     Epoch Time: 1096255084.938672000 seconds
 236     [Time delta from previous captured frame: 0.000000000 seconds]
 237     [Time delta from previous displayed frame: 0.000000000 seconds]
 238     [Time since reference or first frame: 0.000000000 seconds]
 239     Frame Number: 1
 240     Frame Length: 75 bytes (600 bits)
 241     Capture Length: 75 bytes (600 bits)
 242     [Frame is marked: False]
 243     [Frame is ignored: False]
 244     [Protocols in frame: eth:ethertype:ip:udp:mydns]
 245 Ethernet II, Src: AmbitMic_6c:40:4e (00:d0:59:6c:40:4e), Dst: Cisco-Li_82:b2:53 (00:0c:41:82:b2:53)
 246     Destination: Cisco-Li_82:b2:53 (00:0c:41:82:b2:53)
 247         Address: Cisco-Li_82:b2:53 (00:0c:41:82:b2:53)
 248         .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
 249         .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
 250     Source: AmbitMic_6c:40:4e (00:d0:59:6c:40:4e)
 251         Address: AmbitMic_6c:40:4e (00:d0:59:6c:40:4e)
 252         .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
 253         .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
 254     Type: IP (0x0800)
 255 Internet Protocol Version 4, Src: 192.168.50.50 (192.168.50.50), Dst: 192.168.0.1 (192.168.0.1)
 256     Version: 4
 257     Header Length: 20 bytes
 258     Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
 259         0000 00.. = Differentiated Services Codepoint: Default (0x00)
 260         .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
 261     Total Length: 61
 262     Identification: 0x0a41 (2625)
 263     Flags: 0x00
 264         0... .... = Reserved bit: Not set
 265         .0.. .... = Don't fragment: Not set
 266         ..0. .... = More fragments: Not set
 267     Fragment offset: 0
 268     Time to live: 128
 269     Protocol: UDP (17)
 270     Header checksum: 0x7ceb [correct]
 271         [Good: True]
 272         [Bad: False]
 273     Source: 192.168.50.50 (192.168.50.50)
 274     Destination: 192.168.0.1 (192.168.0.1)
 275 User Datagram Protocol, Src Port: 65282 (65282), Dst Port: 65333 (65333)
 276     Source Port: 65282 (65282)
 277     Destination Port: 65333 (65333)
 278     Length: 41
 279     Checksum: 0x07a9 [validation disabled]
 280         [Good Checksum: False]
 281         [Bad Checksum: False]
 282     [Stream index: 0]
 283 MyDNS Protocol
 284     Transaction ID: 43
 285     Flags: 0x0100
 286         0... .... .... .... = Response: this is a query
 287         .000 0... .... .... = Opcode: 0
 288         .... ..0. .... .... = Truncated: False
 289         .... ...1 .... .... = Recursion desired: yes
 290         .... .... .0.. .... = World War Z - Reserved for future use: 0x0
 291         .... .... ...0 .... = Checking disabled: False
 292     Number of Questions: 1
 293     Number of Answer RRs: 0
 294     Number of Authority RRs: 0
 295     Number of Additional RRs: 0
 296     Queries
 297         us.pool.ntp.org: type A (IPv4 host address) (1), class IN (Internet) (1)
 298             Name: us.pool.ntp.org
 299             [Name Length: 17]
 300             [Label Count: 4]
 301             Type: A (IPv4 host address) (1)
 302             Class: IN (Internet) (1)
 303
 304 Frame 2: 540 bytes on wire (4320 bits), 540 bytes captured (4320 bits)
 305     Encapsulation type: Ethernet (1)
 306     Arrival Time: Sep 26, 2004 23:18:04.945618000 EDT
 307     [Time shift for this packet: 0.000000000 seconds]
 308     Epoch Time: 1096255084.945618000 seconds
 309     [Time delta from previous captured frame: 0.006946000 seconds]
 310     [Time delta from previous displayed frame: 0.006946000 seconds]
 311     [Time since reference or first frame: 0.006946000 seconds]
 312     Frame Number: 2
 313     Frame Length: 540 bytes (4320 bits)
 314     Capture Length: 540 bytes (4320 bits)
 315     [Frame is marked: False]
 316     [Frame is ignored: False]
 317     [Protocols in frame: eth:ethertype:ip:udp:mydns]
 318 Ethernet II, Src: Cisco-Li_82:b2:53 (00:0c:41:82:b2:53), Dst: AmbitMic_6c:40:4e (00:d0:59:6c:40:4e)
 319     Destination: AmbitMic_6c:40:4e (00:d0:59:6c:40:4e)
 320         Address: AmbitMic_6c:40:4e (00:d0:59:6c:40:4e)
 321         .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
 322         .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
 323     Source: Cisco-Li_82:b2:53 (00:0c:41:82:b2:53)
 324         Address: Cisco-Li_82:b2:53 (00:0c:41:82:b2:53)
 325         .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
 326         .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
 327     Type: IP (0x0800)
 328 Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst: 192.168.50.50 (192.168.50.50)
 329     Version: 4
 330     Header Length: 20 bytes
 331     Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
 332         0000 00.. = Differentiated Services Codepoint: Default (0x00)
 333         .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
 334     Total Length: 526
 335     Identification: 0x2153 (8531)
 336     Flags: 0x00
 337         0... .... = Reserved bit: Not set
 338         .0.. .... = Don't fragment: Not set
 339         ..0. .... = More fragments: Not set
 340     Fragment offset: 0
 341     Time to live: 63
 342     Protocol: UDP (17)
 343     Header checksum: 0xa508 [correct]
 344         [Good: True]
 345         [Bad: False]
 346     Source: 192.168.0.1 (192.168.0.1)
 347     Destination: 192.168.50.50 (192.168.50.50)
 348 User Datagram Protocol, Src Port: 65333 (65333), Dst Port: 65282 (65282)
 349     Source Port: 65333 (65333)
 350     Destination Port: 65282 (65282)
 351     Length: 506
 352     Checksum: 0xf9d5 [validation disabled]
 353         [Good Checksum: False]
 354         [Bad Checksum: False]
 355     [Stream index: 0]
 356 MyDNS Protocol
 357     Transaction ID: 43
 358     Flags: 0x8180
 359         1... .... .... .... = Response: this is a response
 360         .000 0... .... .... = Opcode: 0
 361         .... .0.. .... .... = Authoritative: False
 362         .... ..0. .... .... = Truncated: False
 363         .... .... 1... .... = Recursion available: True
 364         .... .... .0.. .... = World War Z - Reserved for future use: 0x0
 365         .... .... ..0. .... = Authenticated: no
 366         .... .... .... 0000 = Response code: No Error (0)
 367         .... .... ...0 .... = Checking disabled: False
 368     Number of Questions: 1
 369     Number of Answer RRs: 15
 370     Number of Authority RRs: 6
 371     Number of Additional RRs: 2
 372     Queries
 373         us.pool.ntp.org: type A (IPv4 host address) (1), class IN (Internet) (1)
 374             Name: us.pool.ntp.org
 375             [Name Length: 17]
 376             [Label Count: 4]
 377             Type: A (IPv4 host address) (1)
 378             Class: IN (Internet) (1)
 379 ]]
 380