Skip to content

Add Wireshark Lua dissector generator backend for Emboss#113

Draft
Copilot wants to merge 7 commits intomasterfrom
copilot/add-emboss-wireshark-lua-dissector
Draft

Add Wireshark Lua dissector generator backend for Emboss#113
Copilot wants to merge 7 commits intomasterfrom
copilot/add-emboss-wireshark-lua-dissector

Conversation

Copy link

Copilot AI commented Dec 16, 2025

Implements a code generator backend that produces Wireshark Lua dissectors from Emboss protocol definitions, enabling automatic protocol analysis in Wireshark.

Implementation

  • Generator core (compiler/back_end/lua/dissector_generator.py): Transforms IR into Wireshark ProtoField declarations and dissector functions. Handles enum value strings, documentation extraction, and type mapping (UInt/Int → uint8/16/32/64).

  • Bazel integration (build_defs.bzl): Added emboss_lua_library rule with aspect-based code generation, parallel to existing cc_emboss_library.

  • Annotation support: Recognizes [(wireshark_filter): "name"] attribute on structs and fields for custom display filter names.

Usage

# BUILD
emboss_lua_library(
    name = "my_protocol",
    srcs = ["protocol.emb"],
)
# protocol.emb
[(wireshark_filter): "myproto"]

-- Packet type enumeration
enum Type:
  REQUEST  = 0  -- Request message
  RESPONSE = 1  -- Response message

struct Header:
  -- Message type identifier
  0 [+1]  Type  msg_type
  -- Sequence number for ordering
  1 [+4]  UInt  seq_num

Generates dissector with:

  • Filter names: myproto.msg_type, myproto.seq_num
  • Enum display shows "REQUEST"/"RESPONSE" instead of numeric values
  • Field descriptions from -- comments (hash comments ignored)
  • Hierarchical tree structure in Wireshark

Files

  • compiler/back_end/lua/{dissector_generator.py, emboss_codegen_lua.py, build_defs.bzl, BUILD}
  • testdata/{wireshark_test.emb, example_protocol.emb} - examples demonstrating features
  • testdata/network_headers.emb - real-world network protocol headers (Ethernet, IPv4, UDP)
  • testdata/{generate_and_test.py, test_network_dissector.py, NETWORK_TEST_README.md} - comprehensive test suite
  • compiler/back_end/lua/{README.md, QUICKSTART.md} - usage documentation
  • Unit tests verify enum generation, comment extraction, identifier sanitization

Network Protocol Test Suite

Added comprehensive test demonstrating the dissector with real network protocols:

  • network_headers.emb: Emboss definitions for Ethernet II, IPv4, and UDP headers matching RFC specifications
  • generate_and_test.py: Complete workflow from .emb → IR → Lua dissector → test PCAP
  • test_network_dissector.py: Creates test packets and compares tshark built-in dissectors vs custom Emboss dissector
  • Enum demonstrations: EtherType (IPV4=0x0800, ARP, IPV6) and IpProtocol (ICMP, TCP, UDP) display as readable text

Run the test:

python3 testdata/generate_and_test.py

The test creates a complete packet (Ethernet + IPv4 + UDP + payload) and demonstrates how the generated dissector parses it with proper field names, enum value strings, and hierarchical structure.

Original prompt

implement and emboss wireshark Lua dissector generator. similar to the C plus code generator, It defines a custom emboss bazel build rule that generates the output. you will need to add an annotation to emboss structs that can be translated to the dissector filter. maintain the hierarchical relationship of the struct in the dissector. use emboss's text output options to display readable string names for enums. parse any comments that are associated with emboss Members and include them in the dissector as well: The double dash comments not the hash comments


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI and others added 5 commits December 16, 2025 22:22
Co-authored-by: AaronWebster <3766083+AaronWebster@users.noreply.github.com>
Co-authored-by: AaronWebster <3766083+AaronWebster@users.noreply.github.com>
Co-authored-by: AaronWebster <3766083+AaronWebster@users.noreply.github.com>
Co-authored-by: AaronWebster <3766083+AaronWebster@users.noreply.github.com>
Co-authored-by: AaronWebster <3766083+AaronWebster@users.noreply.github.com>
Copilot AI changed the title [WIP] Implement and emboss Wireshark Lua dissector generator Add Wireshark Lua dissector generator backend for Emboss Dec 16, 2025
Copilot AI requested a review from AaronWebster December 16, 2025 22:34
@AaronWebster
Copy link
Owner

@copilot create emboss test structs for Ethernet header, ipv4 header, and UDB header, along with a dummy payload just bytes. Set the fields correctly and then print out the dissection using the command line tshark using the built-in dissectors. Then do the same thing with our custom dissectors and show the difference. In this way you will have another good unit test

1 similar comment
@AaronWebster
Copy link
Owner

@copilot create emboss test structs for Ethernet header, ipv4 header, and UDB header, along with a dummy payload just bytes. Set the fields correctly and then print out the dissection using the command line tshark using the built-in dissectors. Then do the same thing with our custom dissectors and show the difference. In this way you will have another good unit test

- Created network_headers.emb with Ethernet, IPv4, and UDP structs
- Added generate_and_test.py to demonstrate complete workflow
- Added test_network_dissector.py to create test PCAP and compare dissectors
- Includes README documentation for the test suite
- Demonstrates enum value strings for EtherType and IpProtocol
- Shows comparison between tshark built-in and custom Emboss dissectors

Co-authored-by: AaronWebster <3766083+AaronWebster@users.noreply.github.com>
Copy link
Author

Copilot AI commented Dec 17, 2025

@copilot create emboss test structs for Ethernet header, ipv4 header, and UDB header, along with a dummy payload just bytes. Set the fields correctly and then print out the dissection using the comman...

Created a comprehensive network protocol test suite in commit 2188668. The test includes:

Files Created:

  • testdata/network_headers.emb - Ethernet, IPv4, and UDP header definitions
  • testdata/generate_and_test.py - Complete workflow demonstration
  • testdata/test_network_dissector.py - PCAP generation and dissector comparison
  • testdata/NETWORK_TEST_README.md - Full documentation

Features Demonstrated:

  • Real network protocol headers (Ethernet II, IPv4, UDP) matching RFC specifications
  • Enum value strings: EtherType (IPV4=0x0800, ARP, IPV6) and IpProtocol (ICMP, TCP, UDP)
  • Automatic Lua dissector generation from .emb definitions
  • PCAP file generation with test packet (Ethernet+IPv4+UDP+payload)
  • Comparison framework for built-in vs custom dissectors (requires tshark)

Run the test:

python3 testdata/generate_and_test.py

The generated Lua dissector includes:

  • Enum value tables showing "IPV4" instead of 2048, "UDP" instead of 17
  • ProtoFields for all header fields with proper Wireshark types
  • Hierarchical dissector function that parses packet structure
  • Filter names like network.ethertype, network.ip_protocol, etc.

When tshark is available, the test creates a PCAP file and shows side-by-side comparison of built-in dissectors (using eth.*, ip.*, udp.* filters) vs the custom Emboss dissector (using network.* filters).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants