FromThomas Buchanan via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6467

Add Binary JSON (BSON) decoding support to Mongo packet dissector

Implement BSON spec to correctly see BSON document type and not in Bytes format...

The specification for BSON can be found at http://bsonspec.org/

The decoding is not entirely complete, there are still potential enhancements to provide more information about a couple of data types, but it greatly enhances visibility into these packet types.

From me :
* Fix warning from fix-encoding-args.pl script.

svn path=/trunk/; revision=39499

1 files changed, 351 insertions, 16 deletions

diff --git a/epan/dissectors/packet-mongo.c b/epan/dissectors/packet-mongo.c
index f5c937c930..86676bae8b 100644
--- a/epan/dissectors/packet-mongo.c
+++ b/epan/dissectors/packet-mongo.c
@@ -1,6 +1,7 @@
 /* packet-mongo.c
  * Routines for Mongo Wire Protocol dissection
  * Copyright 2010, Alexis La Goutte <alexis.lagoutte at gmail dot com>
+ * BSON dissection added 2011, Thomas Buchanan <tom at thomasbuchanan dot com>
  *
  * $Id$
  *
@@ -70,6 +71,71 @@ static const value_string opcode_vals[] = {
   { 0,  NULL }
 };
 
+/* BSON Element types */
+/* See http://bsonspec.org/#/specification for detail */
+#define BSON_ELEMENT_TYPE_DOUBLE         1
+#define BSON_ELEMENT_TYPE_STRING         2
+#define BSON_ELEMENT_TYPE_DOC            3
+#define BSON_ELEMENT_TYPE_ARRAY          4
+#define BSON_ELEMENT_TYPE_BINARY         5
+#define BSON_ELEMENT_TYPE_UNDEF          6  /* Deprecated */
+#define BSON_ELEMENT_TYPE_OBJ_ID         7
+#define BSON_ELEMENT_TYPE_BOOL           8
+#define BSON_ELEMENT_TYPE_DATETIME       9
+#define BSON_ELEMENT_TYPE_NULL          10
+#define BSON_ELEMENT_TYPE_REGEX         11
+#define BSON_ELEMENT_TYPE_DB_PTR        12  /* Deprecated */
+#define BSON_ELEMENT_TYPE_JS_CODE       13
+#define BSON_ELEMENT_TYPE_SYMBOL        14
+#define BSON_ELEMENT_TYPE_JS_CODE_SCOPE 15
+#define BSON_ELEMENT_TYPE_INT32         16  /* 0x10 */
+#define BSON_ELEMENT_TYPE_TIMESTAMP     17  /* 0x11 */
+#define BSON_ELEMENT_TYPE_INT64         18  /* 0x12 */
+#define BSON_ELEMENT_TYPE_MIN_KEY      255  /* 0xFF */
+#define BSON_ELEMENT_TYPE_MAX_KEY      127  /* 0x7F */
+
+static const value_string element_type_vals[] = {
+  { BSON_ELEMENT_TYPE_DOUBLE,         "Double" },
+  { BSON_ELEMENT_TYPE_STRING,         "String" },
+  { BSON_ELEMENT_TYPE_DOC,            "Document" },
+  { BSON_ELEMENT_TYPE_ARRAY,          "Array" },
+  { BSON_ELEMENT_TYPE_BINARY,         "Binary" },
+  { BSON_ELEMENT_TYPE_UNDEF,          "Undefined" },
+  { BSON_ELEMENT_TYPE_OBJ_ID,         "Object ID" },
+  { BSON_ELEMENT_TYPE_BOOL,           "Boolean" },
+  { BSON_ELEMENT_TYPE_DATETIME,       "Datetime" },
+  { BSON_ELEMENT_TYPE_NULL,           "NULL" },
+  { BSON_ELEMENT_TYPE_REGEX,          "Regular Expression" },
+  { BSON_ELEMENT_TYPE_DB_PTR,         "DBPointer" },
+  { BSON_ELEMENT_TYPE_JS_CODE,        "JavaScript Code" },
+  { BSON_ELEMENT_TYPE_SYMBOL,         "Symbol" },
+  { BSON_ELEMENT_TYPE_JS_CODE_SCOPE,  "JavaScript Code w/Scope" },
+  { BSON_ELEMENT_TYPE_INT32,          "Int32" },
+  { BSON_ELEMENT_TYPE_TIMESTAMP,      "Timestamp" },
+  { BSON_ELEMENT_TYPE_INT64,          "Int64" },
+  { BSON_ELEMENT_TYPE_MIN_KEY,        "Min Key" },
+  { BSON_ELEMENT_TYPE_MAX_KEY,        "Max Key" },
+  { 0, NULL }
+};
+
+/* BSON Element Binary subtypes */
+#define BSON_ELEMENT_BINARY_TYPE_GENERIC  0
+#define BSON_ELEMENT_BINARY_TYPE_FUNCTION 1
+#define BSON_ELEMENT_BINARY_TYPE_BINARY   2 /* OLD */
+#define BSON_ELEMENT_BINARY_TYPE_UUID     3
+#define BSON_ELEMENT_BINARY_TYPE_MD5      4
+#define BSON_ELEMENT_BINARY_TYPE_USER   128 /* 0x80 */
+
+static const value_string binary_type_vals[] = {
+  { BSON_ELEMENT_BINARY_TYPE_GENERIC,  "Generic" },
+  { BSON_ELEMENT_BINARY_TYPE_FUNCTION, "Function" },
+  { BSON_ELEMENT_BINARY_TYPE_BINARY,   "Binary" },
+  { BSON_ELEMENT_BINARY_TYPE_UUID,     "UUID" },
+  { BSON_ELEMENT_BINARY_TYPE_MD5,      "MD5" },
+  { BSON_ELEMENT_BINARY_TYPE_USER,     "User" },
+  { 0, NULL }
+};
+
 void proto_reg_handoff_mongo(void);
 
 
@@ -110,17 +176,44 @@ static int hf_mongo_number_to_skip = -1;
 static int hf_mongo_number_to_return = -1;
 static int hf_mongo_query = -1;
 static int hf_mongo_return_field_selector = -1;
-static int hf_mongo_documents = -1;
+static int hf_mongo_document = -1;
 static int hf_mongo_document_length = -1;
+static int hf_mongo_document_empty = -1;
 static int hf_mongo_delete_flags = -1;
 static int hf_mongo_delete_flags_singleremove = -1;
 static int hf_mongo_number_of_cursor_ids = -1;
+static int hf_mongo_elements = -1;
+static int hf_mongo_element_name = -1;
+static int hf_mongo_element_type = -1;
+static int hf_mongo_element_length = -1;
+static int hf_mongo_element_value_boolean = -1;
+static int hf_mongo_element_value_int32 = -1;
+static int hf_mongo_element_value_int64 = -1;
+static int hf_mongo_element_value_double = -1;
+static int hf_mongo_element_value_string = -1;
+static int hf_mongo_element_value_string_length = -1;
+static int hf_mongo_element_value_binary = -1;
+static int hf_mongo_element_value_binary_length = -1;
+static int hf_mongo_element_value_regex_pattern = -1;
+static int hf_mongo_element_value_regex_options = -1;
+static int hf_mongo_element_value_objectid = -1;
+static int hf_mongo_element_value_objectid_time = -1;
+static int hf_mongo_element_value_objectid_machine = -1;
+static int hf_mongo_element_value_objectid_pid = -1;
+static int hf_mongo_element_value_objectid_inc = -1;
+static int hf_mongo_element_value_db_ptr = -1;
+static int hf_mongo_element_value_js_code = -1;
+static int hf_mongo_element_value_js_scope = -1;
 static int hf_mongo_unknown = -1;
 
 static guint global_mongo_tcp_port = TCP_PORT_MONGO;
 
 static gint ett_mongo = -1;
 static gint ett_mongo_doc = -1;
+static gint ett_mongo_elements = -1;
+static gint ett_mongo_element = -1;
+static gint ett_mongo_objectid = -1;
+static gint ett_mongo_code = -1;
 static gint ett_mongo_fcn = -1;
 static gint ett_mongo_flags = -1;
 
@@ -147,19 +240,143 @@ dissect_fullcollectionname(tvbuff_t *tvb, guint offset, proto_tree *tree)
 }
 
 static int
-dissect_bson_document(tvbuff_t *tvb, guint offset, proto_tree *tree, int hf_mongo_document)
+dissect_bson_document(tvbuff_t *tvb, guint offset, proto_tree *tree, int hf_mongo_doc)
 {
   gint32 document_length;
-  proto_item *ti;
-  proto_tree *doc_tree;
+  guint final_offset;
+  proto_item *ti, *elements, *element, *objectid, *js_code, *js_scope;
+  proto_tree *doc_tree, *elements_tree, *element_sub_tree, *objectid_sub_tree, *js_code_sub_tree, *js_scope_sub_tree;
 
   document_length = tvb_get_letohl(tvb, offset);
-  /* TODO Implement BSON spec to correctly see BSON document type and not in Bytes format... */
-  ti = proto_tree_add_item(tree, hf_mongo_document, tvb, offset+4, document_length-4, ENC_NA);
+  if (document_length == 5) {
+    /* document with length 5 is an empty document */
+    /* don't display the element subtree */
+    proto_tree_add_item(tree, hf_mongo_document_empty, tvb, offset, document_length, ENC_NA);
+    return document_length;
+  }
+
+  ti = proto_tree_add_item(tree, hf_mongo_doc, tvb, offset, document_length, ENC_NA);
   doc_tree = proto_item_add_subtree(ti, ett_mongo_doc);
 
   proto_tree_add_item(doc_tree, hf_mongo_document_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 
+  final_offset = offset + document_length;
+  offset += 4;
+
+  elements = proto_tree_add_item(doc_tree, hf_mongo_elements, tvb, offset, document_length-5, ENC_NA);
+  elements_tree = proto_item_add_subtree(elements, ett_mongo_elements);
+
+  do {
+    /* Read document elements */
+    guint8 e_type = -1;  /* Element type */
+    gint str_len = -1;   /* String length */
+    gint e_len = -1;     /* Element length */
+    gint doc_len = -1;   /* Document length */
+
+    e_type = tvb_get_guint8(tvb, offset);
+    tvb_get_ephemeral_stringz(tvb, offset+1, &str_len);
+    
+    element = proto_tree_add_item(elements_tree, hf_mongo_element_name, tvb, offset+1, str_len-1, ENC_UTF_8|ENC_NA);
+    element_sub_tree = proto_item_add_subtree(element, ett_mongo_element);
+    proto_tree_add_item(element_sub_tree, hf_mongo_element_type, tvb, offset, 1, ENC_LITTLE_ENDIAN);
+
+    offset += str_len+1;
+    
+    switch(e_type) {
+      case BSON_ELEMENT_TYPE_DOUBLE:
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_double, tvb, offset, 8, ENC_LITTLE_ENDIAN);
+        offset += 8;
+        break;
+      case BSON_ELEMENT_TYPE_STRING:
+      case BSON_ELEMENT_TYPE_JS_CODE:
+      case BSON_ELEMENT_TYPE_SYMBOL:
+        str_len = tvb_get_letohl(tvb, offset);
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_string_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_string, tvb, offset+4, str_len, ENC_UTF_8|ENC_NA);
+        offset += str_len+4;
+        break;
+      case BSON_ELEMENT_TYPE_DOC:
+      case BSON_ELEMENT_TYPE_ARRAY:
+        offset += dissect_bson_document(tvb, offset, element_sub_tree, hf_mongo_document);
+        break;
+      case BSON_ELEMENT_TYPE_BINARY:
+        e_len = tvb_get_letohl(tvb, offset);
+        /* TODO - Add functions to decode various binary subtypes */
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_binary_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_binary, tvb, offset+5, e_len, ENC_NA);
+        offset += e_len+5;
+        break;
+      case BSON_ELEMENT_TYPE_UNDEF:
+      case BSON_ELEMENT_TYPE_NULL:
+      case BSON_ELEMENT_TYPE_MIN_KEY:
+      case BSON_ELEMENT_TYPE_MAX_KEY:
+        /* Nothing to do, as there is no element content */
+        break;
+      case BSON_ELEMENT_TYPE_OBJ_ID:
+        objectid = proto_tree_add_item(element_sub_tree, hf_mongo_element_value_objectid, tvb, offset, 12, ENC_NA);
+        objectid_sub_tree = proto_item_add_subtree(objectid, ett_mongo_objectid);
+        /* Unlike most BSON elements, parts of ObjectID are stored Big Endian, so they can be compared bit by bit */
+        proto_tree_add_item(objectid_sub_tree, hf_mongo_element_value_objectid_time, tvb, offset, 4, ENC_BIG_ENDIAN);
+        proto_tree_add_item(objectid_sub_tree, hf_mongo_element_value_objectid_machine, tvb, offset+4, 3, ENC_LITTLE_ENDIAN);
+        proto_tree_add_item(objectid_sub_tree, hf_mongo_element_value_objectid_pid, tvb, offset+7, 2, ENC_LITTLE_ENDIAN);
+        proto_tree_add_item(objectid_sub_tree, hf_mongo_element_value_objectid_inc, tvb, offset+9, 3, ENC_BIG_ENDIAN);
+        offset += 12;
+        break;
+      case BSON_ELEMENT_TYPE_BOOL:
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_boolean, tvb, offset, 1, ENC_NA);
+        offset += 1;
+        break;
+      case BSON_ELEMENT_TYPE_REGEX:
+        /* regex pattern */
+        tvb_get_ephemeral_stringz(tvb, offset, &str_len);
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_regex_pattern, tvb, offset, str_len, ENC_UTF_8|ENC_NA);
+        offset += str_len;
+        /* regex options */
+        tvb_get_ephemeral_stringz(tvb, offset, &str_len);
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_regex_options, tvb, offset, str_len, ENC_UTF_8|ENC_NA);
+        offset += str_len;
+        break;
+      case BSON_ELEMENT_TYPE_DB_PTR:
+        str_len = tvb_get_letohl(tvb, offset);
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_string_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_string, tvb, offset+4, str_len, ENC_UTF_8|ENC_NA);
+        offset += str_len;
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_db_ptr, tvb, offset, 12, ENC_NA);
+        offset += 12;
+        break;
+      case BSON_ELEMENT_TYPE_JS_CODE_SCOPE:
+        /* code_w_s ::= int32 string document */
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+        e_len = tvb_get_letohl(tvb, offset);
+        offset += 4;
+        str_len = tvb_get_letohl(tvb, offset);
+        js_code = proto_tree_add_item(element_sub_tree, hf_mongo_element_value_js_code, tvb, offset, str_len+4, ENC_NA);
+        js_code_sub_tree = proto_item_add_subtree(js_code, ett_mongo_code);
+        proto_tree_add_item(js_code_sub_tree, hf_mongo_element_value_string_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+        proto_tree_add_item(js_code_sub_tree, hf_mongo_element_value_string, tvb, offset+4, str_len, ENC_UTF_8|ENC_NA);
+        offset += str_len+4;
+        doc_len = e_len - (str_len + 8);
+        js_scope = proto_tree_add_item(element_sub_tree, hf_mongo_element_value_js_scope, tvb, offset, doc_len, ENC_NA);
+        js_scope_sub_tree = proto_item_add_subtree(js_scope, ett_mongo_code);
+        offset += dissect_bson_document(tvb, offset, js_scope_sub_tree, hf_mongo_document);
+        break;
+      case BSON_ELEMENT_TYPE_INT32:
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_int32, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+        offset += 4;
+        break;
+      case BSON_ELEMENT_TYPE_DATETIME:
+      case BSON_ELEMENT_TYPE_TIMESTAMP:
+        /* TODO Implement routine to convert datetime & timestamp values to UTC date/time */
+        /* for now, simply display the integer value */
+      case BSON_ELEMENT_TYPE_INT64:
+        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_int64, tvb, offset, 8, ENC_LITTLE_ENDIAN);
+        offset += 8;
+        break;
+      default:
+        break;
+    }  /* end switch() */
+  } while (offset < final_offset-1);
+
   return document_length;
 }
 static int
@@ -189,7 +406,7 @@ dissect_mongo_reply(tvbuff_t *tvb, guint offset, proto_tree *tree)
 
   for (i=1; i <= number_returned; i++)
   {
-    offset += dissect_bson_document(tvb, offset, tree, hf_mongo_documents);
+    offset += dissect_bson_document(tvb, offset, tree, hf_mongo_document);
   }
   return offset;
 }
@@ -243,7 +460,7 @@ dissect_mongo_insert(tvbuff_t *tvb, guint offset, proto_tree *tree)
   offset += dissect_fullcollectionname(tvb, offset, tree);
 
   while(offset < tvb_reported_length(tvb)) {
-    offset += dissect_bson_document(tvb, offset, tree, hf_mongo_documents);
+    offset += dissect_bson_document(tvb, offset, tree, hf_mongo_document);
   }
 
   return offset;
@@ -524,9 +741,9 @@ proto_register_mongo(void)
       FT_INT32, BASE_DEC, NULL, 0x0,
       "Number of documents in the reply", HFILL }
     },
-    { &hf_mongo_documents,
-      { "Documents", "mongo.documents",
-      FT_BYTES, BASE_NONE, NULL, 0x0,
+    { &hf_mongo_document,
+      { "Document", "mongo.document",
+      FT_NONE, BASE_NONE, NULL, 0x0,
       NULL, HFILL }
     },
     { &hf_mongo_document_length,
@@ -534,6 +751,11 @@ proto_register_mongo(void)
       FT_INT32, BASE_DEC, NULL, 0x0,
       "Length of BSON Document", HFILL }
     },
+    { &hf_mongo_document_empty,
+      { "Empty Document", "mongo.document.empty",
+      FT_NONE, BASE_NONE, NULL, 0x0,
+      "Document with no elements", HFILL }
+    },
     { &hf_mongo_zero,
       { "Zero", "mongo.document.zero",
       FT_BYTES, BASE_NONE, NULL, 0x0,
@@ -556,12 +778,12 @@ proto_register_mongo(void)
     },
     { &hf_mongo_selector,
       { "Selector", "mongo.selector",
-      FT_BYTES, BASE_NONE, NULL, 0x0,
+      FT_NONE, BASE_NONE, NULL, 0x0,
       "The query to select the document", HFILL }
     },
     { &hf_mongo_update,
       { "Update", "mongo.update",
-      FT_BYTES, BASE_NONE, NULL, 0x0,
+      FT_NONE, BASE_NONE, NULL, 0x0,
       "Specification of the update to perform", HFILL }
     },
     { &hf_mongo_insert_flags,
@@ -574,7 +796,6 @@ proto_register_mongo(void)
       FT_BOOLEAN, 32, TFS(&tfs_yes_no), 0x00000001,
       "If set, the database will not stop processing a bulk insert if one fails (eg due to duplicate IDs)", HFILL }
     },
-
     { &hf_mongo_query_flags_tailablecursor,
       { "Tailable Cursor", "mongo.query.flags.tailable_cursor",
       FT_BOOLEAN, 32, TFS(&tfs_yes_no), 0x00000002,
@@ -622,12 +843,12 @@ proto_register_mongo(void)
     },
     { &hf_mongo_query,
       { "Query", "mongo.query",
-      FT_BYTES, BASE_NONE, NULL, 0x0,
+      FT_NONE, BASE_NONE, NULL, 0x0,
       "Query BSON Document", HFILL }
     },
     { &hf_mongo_return_field_selector,
       { "Return Field Selector", "mongo.return_field_selector",
-      FT_BYTES, BASE_NONE, NULL, 0x0,
+      FT_NONE, BASE_NONE, NULL, 0x0,
       "Return Field Selector BSON Document", HFILL }
     },
     { &hf_mongo_delete_flags,
@@ -645,6 +866,116 @@ proto_register_mongo(void)
       FT_INT32, BASE_DEC, NULL, 0x0,
       "Number of cursorIDs in message", HFILL }
     },
+    { &hf_mongo_elements,
+      { "Elements", "mongo.elements",
+      FT_NONE, BASE_NONE, NULL, 0x0,
+      "Document Elements", HFILL }
+    },
+    { &hf_mongo_element_name,
+      { "Element", "mongo.element.name",
+      FT_STRING, BASE_NONE, NULL, 0x0,
+      "Element Name", HFILL }
+    },
+    { &hf_mongo_element_type,
+      { "Type", "mongo.element.type",
+      FT_UINT8, BASE_HEX_DEC, VALS(element_type_vals), 0x0,
+      "Element Type", HFILL }
+    },
+    { &hf_mongo_element_length,
+      { "Length", "mongo.element.length",
+      FT_INT32, BASE_DEC, NULL, 0x0,
+      "Element Length", HFILL }
+    },
+    { &hf_mongo_element_value_boolean,
+      { "Value", "mongo.element.value",
+      FT_BOOLEAN, BASE_NONE, NULL, 0x0,
+      "Element Value", HFILL }
+    },
+    { &hf_mongo_element_value_int32,
+      { "Value", "mongo.element.value",
+      FT_INT32, BASE_DEC, NULL, 0x0,
+      "Element Value", HFILL }
+    },
+    { &hf_mongo_element_value_int64,
+      { "Value", "mongo.element.value",
+      FT_INT64, BASE_DEC, NULL, 0x0,
+      "Element Value", HFILL }
+    },
+    { &hf_mongo_element_value_double,
+      { "Value", "mongo.element.value",
+      FT_DOUBLE, BASE_NONE, NULL, 0x0,
+      "Element Value", HFILL }
+    },
+    { &hf_mongo_element_value_string,
+      { "Value", "mongo.element.value",
+      FT_STRING, BASE_NONE, NULL, 0x0,
+      "Element Value", HFILL }
+    },
+    { &hf_mongo_element_value_string_length,
+      { "Length", "mongo.element.value.length",
+      FT_INT32, BASE_DEC, NULL, 0x0,
+      "Element Value Length", HFILL }
+    },
+    { &hf_mongo_element_value_binary,
+      { "Value", "mongo.element.value",
+      FT_BYTES, BASE_NONE, NULL, 0x0,
+      "Element Value", HFILL }
+    },
+    { &hf_mongo_element_value_binary_length,
+      { "Length", "mongo.element.value.length",
+      FT_INT32, BASE_DEC, NULL, 0x0,
+      "Binary Element Length", HFILL }
+    },
+    { &hf_mongo_element_value_regex_pattern,
+      { "Value", "mongo.element.value.regex.pattern",
+      FT_STRING, BASE_NONE, NULL, 0x0,
+      "Regex Pattern", HFILL }
+    },
+    { &hf_mongo_element_value_regex_options,
+      { "Value", "mongo.element.value.regex.options",
+      FT_STRING, BASE_NONE, NULL, 0x0,
+      "Regex Options", HFILL }
+    },
+    { &hf_mongo_element_value_objectid,
+      { "ObjectID", "mongo.element.value.objectid",
+      FT_BYTES, BASE_NONE, NULL, 0x0,
+      "ObjectID Value", HFILL }
+    },
+    { &hf_mongo_element_value_objectid_time,
+      { "ObjectID Time", "mongo.element.value.objectid.time",
+      FT_INT32, BASE_DEC, NULL, 0x0,
+      "ObjectID timestampt", HFILL }
+    },
+    { &hf_mongo_element_value_objectid_machine,
+      { "ObjectID Machine", "mongo.element.value.objectid.machine",
+      FT_UINT24, BASE_HEX, NULL, 0x0,
+      "ObjectID machine ID", HFILL }
+    },
+    { &hf_mongo_element_value_objectid_pid,
+      { "ObjectID PID", "mongo.element.value.objectid.pid",
+      FT_UINT16, BASE_DEC, NULL, 0x0,
+      "ObjectID process ID", HFILL }
+    },
+    { &hf_mongo_element_value_objectid_inc,
+      { "ObjectID inc", "mongo.element.value.objectid.inc",
+      FT_UINT24, BASE_DEC, NULL, 0x0,
+      "ObjectID increment", HFILL }
+    },
+    { &hf_mongo_element_value_db_ptr,
+      { "ObjectID", "mongo.element.value.db_ptr",
+      FT_BYTES, BASE_NONE, NULL, 0x0,
+      "DBPointer", HFILL }
+    },
+    { &hf_mongo_element_value_js_code,
+      { "JavaScript code", "mongo.element.value.js_code",
+      FT_NONE, BASE_NONE, NULL, 0x0,
+      "JavaScript code to be evaluated", HFILL }
+    },
+    { &hf_mongo_element_value_js_scope,
+      { "JavaScript scope", "mongo.element.value.js_scope",
+      FT_NONE, BASE_NONE, NULL, 0x0,
+      "Scope document for JavaScript evaluation", HFILL }
+    },
     { &hf_mongo_unknown,
       { "Unknown", "mongo.unknown",
       FT_BYTES, BASE_NONE, NULL, 0x0,
@@ -655,6 +986,10 @@ proto_register_mongo(void)
   static gint *ett[] = {
     &ett_mongo,
     &ett_mongo_doc,
+    &ett_mongo_elements,
+    &ett_mongo_element,
+    &ett_mongo_objectid,
+    &ett_mongo_code,
     &ett_mongo_fcn,
     &ett_mongo_flags
   };