SOAP_XML_Payload

XML Payload
===========

    <soap:Envelope
        xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
        <soap:Body>
            <ns2:notify
                xmlns:ns2="http://www.3gpp.org/ftp/specs/archive/32_series/32.306/NotificationIRPNtfData">
                <notificationHeaderAndBody>
                    <ns3:header
                        xmlns:ns3="http://www.3gpp.org/ftp/specs/archive/32_series/32.306/notification">
                        <ns3:objectInstance>
                            ROOT#0;APS#0;BSMIS_APS_PER_AC#4;BSMIS_AP_INFO#230241
                            </ns3:objectInstance>
                        <ns3:eventTime>
                            2015-05-06T18:17:27.152-05:00
                            </ns3:eventTime>
                        <ns3:notificationType>
                            ATTRIBUTE VALUE CHANGE
                            </ns3:notificationType>
                        </ns3:header>
                    <ns2:body
                        xmlns:ns2="http://www.3gpp.org/ftp/specs/archive/32_series/32.666/kernelNtf">
                        <ns2:attributeList>
                            <ns2:attributeNameValue>
                                <newAttribute
                                    registeredAs="4060">
                                    REGISTERED
                                    </newAttribute>
                                </ns2:attributeNameValue>
                            </ns2:attributeList>
                        </ns2:body>
                    </notificationHeaderAndBody>
                </ns2:notify>
            </soap:Body>
        </soap:Envelope>

LUA Code
========

-- Execution
--
-- "c:\Program Files\Wireshark\tshark.exe" -q -X lua_script:"c:\External_Copies\Tools\Lua\xml_dissect.lua" -r "c:\users\cw1\Desktop\SOAPXML_Notifications.pcap"

f_xml_cdata = Field.new("xml.cdata")
xml_tag_f = Field.new("xml.tag")
xml_field = Field.new("xml")

local tap       = Listener.new(nil, "tcp && xml && !tcp.analysis.retransmission")

local HTML_REQ = {
    ["HTTP"] = 1,
    ["GET "] = 1,
    ["PUT "] = 1,
    ["POST"] = 1,
}

function BreakUpLongLines (str, sep)

    --Array to return each of the elements
    vals = {}; valindex = 1; word = ""
    local strSize = #str
    local offset =0
    while strSize > offset do
        svar, evar=string.find(str, sep, offset)
        if evar == nil then return vals end
        if evar > strSize then return vals end
        vals[valindex] = string.sub(str, offset,evar)
        
        --print("Index [" .. valindex .. "] " .. vals[valindex])
        
        valindex = valindex+1
        offset=evar+1
    end
    
    return vals
end

local function handle_xml(pinfo, tvb)
    local fieldinfo = xml_field()
    local xmldata   = tvb(fieldinfo.offset):string()

    -- some of these packets start w/HTTP header...skip to XML
    local starts = xmldata:sub(1,4)
    if HTML_REQ[starts] ~= nil then
        local pos = string.find(xmldata, "<soap:Envelope")
        if not pos then
            return
        end

        xmldata = xmldata:sub(pos)
    end

    --print("\n\n-- #"..pinfo.number.." ---------------------------------------------------\n\n")
    --print(xmldata)
   
   return xmldata
end

function tap.packet(pinfo, tvb, xml)
   print("tap.packet", "#"..pinfo.number)
   local ntfType = ""
   
   -- wrap the handler in a pcall() in case an error occurs
   local xml_msg = handle_xml(pinfo,tvb)
   local la_cdata = BreakUpLongLines(xml_msg, "><")

   local objInst = ""
   local ntfType = ""
   local attrType = ""
   local attrValue = ""
   
   for i,v in pairs(la_cdata), la_cdata do
      
      if string.find(v,"objectInstance") then
         local s = string.find(v,">")
         local e = string.find(v,"<")
         local objStr = string.gsub(string.sub(v, s+1, e-1), ";AP#0", "")
         --print("Start index = " .. s .. " and End index = " .. e)
         
         -- Extract out instance for Attr Val Change
         objInst = string.sub(objStr, string.find(objStr, "%d+$"))
         
         --print("Object Instance: " .. objInst)
      end
      
      if string.find(v,"notificationType") then
         local s = string.find(v,">")
         local e = string.find(v,"<")
         ntfType = string.sub(v, s+1, e-1)
         --print("Notification Type: " .. ntfType)
      end
      
      if ntfType == "ATTRIBUTE VALUE CHANGE" then
         if string.find(v,"registeredAs") then
            attrType = string.sub(v, string.find(v, "%d+"))
            --print("Attribute Type: " .. attrType)
            
            -- TODO --> Need decoder for type values

            local s = string.find(v,">")
            local e = string.find(v,"<")
            attrValue = string.sub(v, s+1, e-1)
            --print("Attribute Value: " .. attrValue)
         end
      elseif ntfType == "STATE CHANGE" then
         if string.find(v,"attribute name") then
            attrType = string.gsub(string.sub(v, string.find(v, "\"%a+\"")), "\"", "")
            --print("Attribute Type: " .. attrType)
            
            local s = string.find(v,">")
            local e = string.find(v,"<")
            attrValue = string.sub(v, s+1, e-1)
            --print("Attribute Value: " .. attrValue)            
         end
      end
      --print(v)
   end
   
   -- Print summary of event
   if ntfType == "ATTRIBUTE VALUE CHANGE" or ntfType == "STATE CHANGE" then
      
      if ntfType == "ATTRIBUTE VALUE CHANGE" then
         print("Attribute Value Change detected")
      elseif ntfType == "STATE CHANGE" then
         print("State Change detected")
      end      
   
      print("Object Instance              = " .. objInst)
      print("Attribute Value Change Type  = " .. attrType)
      print("Attribute Value Change Value = " .. attrValue)
   end
end

function tap.draw()
end

function tap.reset()
end