chiark - git - mdw - tripe/blob - wireshark/tripe.lua

1 --- -*-lua-*-

2 ---

3 --- Wireshark protocol dissector for TrIPE

4 ---

6 ---

8 -------- Licensing notice ---------------------------------------------------

9 ---

10 --- This file is part of Trivial IP Encryption (TrIPE).

11 ---

12 --- TrIPE is free software: you can redistribute it and/or modify it under

13 --- the terms of the GNU General Public License as published by the Free

14 --- Software Foundation; either version 3 of the License, or (at your

15 --- option) any later version.

16 ---

17 --- TrIPE is distributed in the hope that it will be useful, but WITHOUT

18 --- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

19 --- FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License

20 --- for more details.

21 ---

22 --- You should have received a copy of the GNU General Public License

23 --- along with TrIPE. If not, see <https://www.gnu.org/licenses/>.

25 local tripe = Proto("tripe", "TrIPE VPN")

27 -----------------------------------------------------------------------------

28 --- Configuration handling.

30 local CONFIG = {

31 -- Information about the configuration variables. This table, when it's

32 -- set up, maps the internal names, which are used to refer to

33 -- configuration variables in the rest of this code, to a little structure:

34 --

35 -- * `var' names the variable, and is the usual key for lookups;

36 --

37 -- * `name' is the label used in the dialogue box;

38 --

39 -- * `type' is the type of variable, currently either `enum' or `int';

40 --

41 -- * `descr' is a longer (but generally fairly useless) description for

42 -- use in a tooltip;

43 --

44 -- * `allowed' is a sequence of allowed values for an `enum' variable;

45 -- and

46 --

47 -- * `min' and `max' are the limits on permitted values for an `int'

48 -- variable (and may be omitted).

49 --

50 -- More slots are added at runtime:

51 --

52 -- * `map' is a table mapping string values to their integer indices, as

53 -- stored in Wireshark's preferences database.

54 --

55 -- Initially, though, the table is given as a sequence, so that the

56 -- preferences can be populated in a consistent (and approximately logical)

57 -- order.

59 { var = "bulk", name = "Bulk transform",

60 type = "enum", allowed = { "v0", "iiv", "naclbox", "aead" },

61 descr = "Bulk cryptographic transform", default = "v0" },

62 { var = "hashsz", name = "Hash length", type = "int", min = 0,

63 descr = "Hash length (bytes)", default = 20 },

64 { var = "tagsz", name = "Tag length", type = "int", min = 0,

65 descr = "Authentication tag length (bytes)", default = 10 },

66 { var = "ivsz", name = "IV length", type = "int", min = 0,

67 descr = "Initialization vector length (bytes)", default = 8 },

68 { var = "kx", name = "Key-exchange group",

69 type = "enum", allowed = { "dh", "ec", "x25519", "x448" },

70 descr = "Key-exchange group type", default = "dh" },

71 { var = "scsz", name = "Scalar length", type = "int", min = 1,

72 descr = "Scalar field-element length (bytes)", default = 32 },

73 }

75 local C = { } -- The working values of the configuration variables.

77 local function set_config(k, v)

78 -- Set configuration variable K to the value V.

79 --

80 -- K is a string naming the variable to set. V is the new value, which may

81 -- be a string or a number.

82 --

83 -- For `int' variables, V is converted to a number if necessary, and then

84 -- checked against the permitted bounds.

85 --

86 -- For `enum' variables, things are more complicated. If V is a string,

87 -- it's checked against the permitted values. If V is a number, it's

88 -- converted back into the corresponding string.

90 local info = CONFIG[k]

92 if info == nil then error("unknown config key `" .. k .. "'") end

94 if info.type == "enum" then

95 if type(v) == "number" then

96 local t = info.allowed[v]

97 if t == nil then

98 error(string.format("bad index %d for `%s'", n, k))

99 end

100 v = t

101 else

102 if info.map[v] == nil then

103 error(string.format("bad value `%s' for `%s'", v, k))

104 end

105 end

106

107 elseif info.type == "int" then

108 local n = tonumber(v)

109 if n == nil then error("bad number `" .. v .. "'") end

110 if n ~= math.floor(n) then

111 error("value `" .. v .. "' is not an integer")

112 end

113 if (info.min ~= nil and n < info.min) or

114 (info.max ~= nil and n > info.max)

115 then

116 error(string.format("value %d out of range for `%s'", n, k))

117 end

118 v = n

119 end

120

121 C[k] = v

122 end

123

124 -- Set up the configuration information. Configure preferences objects on

125 -- the dissector. For `enum' variables, build the `map' slots.

126 for i, v in ipairs(CONFIG) do

127 local k = v.var

128 CONFIG[k] = v

129 if v.type == "enum" then

130 local tab = { }

131 v.map = { }

132 for i, t in pairs(v.allowed) do

133 v.map[t] = i

134 tab[i] = { i, t, i }

135 end

136 tripe.prefs[k] = Pref.enum(v.name, v.map[v.default], v.descr, tab)

137 elseif v.type == "int" then

138 tripe.prefs[k] = Pref.uint(v.name, v.default, v.descr)

139 end

140 end

141

142 local function prefs_changed()

143 -- Notice that the preferences have been changed and update `C'.

144

145 for k, _ in pairs(CONFIG) do

146 if type(k) == "string" then set_config(k, tripe.prefs[k]) end

147 end

148 end

149 tripe.prefs_changed = prefs_changed

150

151 -- Populate the configuration table from the stored preferences or their

152 -- default values.

153 prefs_changed()

154

155 -- Now work through arguments passed in on the command line. Annoyingly,

156 -- while one can set preferences on the Wireshark command line, these are

157 -- done /before/ Lua scripts are loaded, so the silly thing thinks the

158 -- preference slots don't exist. So we have to do it a different way.

159 for _, arg in ipairs({...}) do

160 local k, v = arg:match("(.+)=(.+)")

161 if k == nil or v == nil then error("bad option syntax `" .. arg .. "'") end

162 se_config(k, v)

163 end

164

165 -----------------------------------------------------------------------------

166 --- Protocol dissection primitives.

167

168 local PF = { } -- The table of protocol fields, filled in later.

169

170 -- The `dissect_*' functions follow a common protocol. They parse a thing

171 -- from a packet buffer BUF, of size SZ, starting from POS, and store

172 -- interesting things in a given TREE; when they're done, they return the

173 -- updated index where the next interesting thing might be. As a result,

174 -- it's usually a simple matter to parse a packet by invoking the appropriate

175 -- primitive dissectors in the right order.

176

177 local function dissect_wtf(buf, tree, pos, sz)

178 -- If POS is not at the end of the buffer, note that there's unexpected

179 -- stuff in the packet.

180

181 if pos < sz then tree:add(PF["tripe.wtf"], buf(pos, sz - pos)) end

182 return sz

183 end

184

185 -- Dissect a ciphertext of some particular kind.

186 local dissect_ct = { }

187 function dissect_ct.aead(buf, tree, pos, sz)

188 tree:add(PF["tripe.ciphertext.tag"], buf(pos, C.tagsz)); pos = pos + C.tagsz

189 tree:add(PF["tripe.ciphertext.seq"], buf(pos, 4)); pos = pos + 4

190 tree:add(PF["tripe.ciphertext.body"], buf(pos, sz - pos))

191 end

192 function dissect_ct.naclbox(buf, tree, pos, sz)

193 tree:add(PF["tripe.ciphertext.tag"], buf(pos, 16)); pos = pos + 16

194 tree:add(PF["tripe.ciphertext.seq"], buf(pos, 4)); pos = pos + 4

195 tree:add(PF["tripe.ciphertext.body"], buf(pos, sz - pos))

196 end

197 function dissect_ct.iiv(buf, tree, pos, sz)

198 tree:add(PF["tripe.ciphertext.tag"], buf(pos, C.tagsz)); pos = pos + C.tagsz

199 tree:add(PF["tripe.ciphertext.seq"], buf(pos, 4)); pos = pos + 4

200 tree:add(PF["tripe.ciphertext.body"], buf(pos, sz - pos))

201 end

202 function dissect_ct.v0(buf, tree, pos, sz)

203 tree:add(PF["tripe.ciphertext.tag"], buf(pos, C.tagsz)); pos = pos + C.tagsz

204 tree:add(PF["tripe.ciphertext.seq"], buf(pos, 4)); pos = pos + 4

205 tree:add(PF["tripe.ciphertext.iv"], buf(pos, C.ivsz)); pos = pos + C.ivsz

206 tree:add(PF["tripe.ciphertext.body"], buf(pos, sz - pos))

207 end

208

209 local function dissect_ciphertext(buf, tree, label, pos, sz)

210 -- Dissect a ciphertext, making the whole thing be a little subtree with

211 -- the given LABEL.

212

213 local t = tree:add(PF[label], buf(pos, sz - pos))

214 dissect_ct[C.bulk](buf, t, pos, sz)

215 return sz

216 end

217

218 local function dissect_packet(buf, tree, pos, sz)

219 return dissect_ciphertext(buf, tree, "tripe.packet.payload", pos, sz)

220 end

221

222 -- Dissect a group element of some particular kind.

223 local dissect_ge = { }

224 function dissect_ge.dh(buf, tree, pos, sz)

225 tree:add(PF["tripe.dh.len"], buf(pos, 2))

226 xsz = buf(pos, 2):uint(); pos = pos + 2

227 tree:add(PF["tripe.dh.x"], buf(pos, xsz)); pos = pos + xsz

228 return pos

229 end

230 function dissect_ge.ec(buf, tree, pos, sz)

231 tree:add(PF["tripe.ec.xlen"], buf(pos, 2))

232 xsz = buf(pos, 2):uint(); pos = pos + 2

233 tree:add(PF["tripe.ec.x"], buf(pos, xsz)); pos = pos + xsz

234 tree:add(PF["tripe.ec.ylen"], buf(pos, 2))

235 ysz = buf(pos, 2):uint(); pos = pos + 2

236 tree:add(PF["tripe.ec.y"], buf(pos, ysz)); pos = pos + ysz

237 return pos

238 end

239 function dissect_ge.x25519(buf, tree, pos, sz)

240 tree:add(PF["tripe.x25519.x"], buf(pos, 32))

241 return pos + 32

242 end

243 function dissect_ge.x448(buf, tree, pos, sz)

244 tree:add(PF["tripe.x448.x"], buf(pos, 56))

245 return pos + 56

246 end

247

248 local function dissect_my_challenge(buf, tree, pos, sz)

249 -- We don't know how long the group element is going to be. We can set the

250 -- length later, but (at least in older versions) it doesn't work so well

251 -- to increase the length, so make it large to start out, and shrink it

252 -- later.

253 local t = tree:add(PF["tripe.keyexch.mychal"], buf(pos, sz - pos))

254 local q = dissect_ge[C.kx](buf, t, pos, sz)

255 t:set_len(q - pos)

256 return q

257 end

258

259 local function dissect_my_cookie(buf, tree, pos, sz)

260 tree:add(PF["tripe.keyexch.mycookie"], buf(pos, C.hashsz))

261 return pos + C.hashsz

262 end

263

264 local function dissect_your_cookie(buf, tree, pos, sz)

265 tree:add(PF["tripe.keyexch.yourcookie"], buf(pos, C.hashsz))

266 return pos + C.hashsz

267 end

268

269 local kx_scsz = { x25519 = 32, x448 = 56 } -- Hardwired scalar sizes.

270 local function dissect_check(buf, tree, pos, sz)

271 local scsz = kx_scsz[C.kx] or C.scsz

272 tree:add(PF["tripe.keyexch.check"], buf(pos, scsz))

273 return pos + scsz

274 end

275

276 local function dissect_reply(buf, tree, pos, sz)

277 return dissect_ciphertext(buf, tree, "tripe.keyexch.reply", pos, sz)

278 end

279

280 local function dissect_switch(buf, tree, pos, sz)

281 return dissect_ciphertext(buf, tree, "tripe.keyexch.switch", pos, sz)

282 end

283

284 local function dissect_switchok(buf, tree, pos, sz)

285 return dissect_ciphertext(buf, tree, "tripe.keyexch.switchok", pos, sz)

286 end

287

288 local function dissect_misc_payload(buf, tree, pos, sz)

289 tree:add(PF["tripe.misc.payload"], buf(pos, sz - pos))

290 return sz

291 end

292

293 local function dissect_misc_ciphertext(buf, tree, pos, sz)

294 return dissect_ciphertext(buf, tree, "tripe.misc.ciphertext", pos, sz)

295 end

296

297 local function dissect_chal(buf, tree, label, pos, sz)

298 local len = buf(pos, 2):uint()

299 local t = tree:add(PF[label], buf(pos, len + 2))

300 t:add(PF["tripe.chal.len"], buf(pos, 2)); pos = pos + 2

301 t:add(PF["tripe.chal.sequence"], buf(pos, 4)); pos = pos + 4; len = len - 4

302 t:add(PF["tripe.chal.tag"], buf(pos, len))

303 return pos + len

304 end

305

306 local function dissect_my_chal(buf, tree, pos, sz)

307 return dissect_chal(buf, tree, "tripe.knock.mychal", pos, sz)

308 end

309

310 local function dissect_your_chal(buf, tree, pos, sz)

311 return dissect_chal(buf, tree, "tripe.knock.yourchal", pos, sz)

312 end

313

314 local function dissect_keyid(buf, tree, pos, sz)

315 tree:add(PF["tripe.knock.keyid"], buf(pos, 4))

316 return pos + 4

317 end

318

319 local function dissect_ies(buf, tree, pos, sz)

320 local len = buf(pos, 2):uint()

321 local lim = pos + len + 2

322 local t = tree:add(PF["tripe.knock.ies"], buf(pos, len + 2))

323 t:add(PF["tripe.ies.len"], buf(pos, 2)); pos = pos + 2

324 pos = dissect_ge[C.kx](buf, t, pos, sz)

325 return dissect_ciphertext(buf, t, "tripe.ies.ciphertext", pos, lim)

326 end

327

328 -----------------------------------------------------------------------------

329 --- The protocol information table.

330

331 local PKTINFO = {

332 -- This is the main table which describes the protocol. The top level maps

333 -- category codes to structures:

334 --

335 -- * `label' is the category code's symbolic name;

336 --

337 -- * `subtype' is the field name for the subtype code;

338 --

339 -- * `info' is a prefix for the information column display; and

340 --

341 -- * `sub' is a table describing the individual subtypes.

342 --

343 -- The subtype table similarly maps subtype codes to structures:

344 --

345 -- * `label' is the subtype code's symbolic name;

346 --

347 -- * `info' is the suffix for the information column display; and

348 --

349 -- * `dissect' is a sequence of primitive dissectors to run in order to

350 -- parse the rest of the packet.

351

352 [0] = {

353 label = "MSG_PACKET", subtype = "tripe.packet.type",

354 info = "Packet data",

355 sub = {

356 [0] = { label = "PACKET_IP", info = "encapsulated IP datagram",

357 dissect = { dissect_packet} }

358 }

359 },

360

361 [1] = {

362 label = "MSG_KEYEXCH", subtype = "tripe.keyexch.type",

363 info = "Key exchange",

364 sub = {

365 [0] = { label = "KX_PRECHAL", info = "pre-challenge",

366 dissect = { dissect_my_challenge,

367 dissect_wtf } },

368 [1] = { label = "KX_CHAL", info = "challenge",

369 dissect = { dissect_my_challenge,

370 dissect_your_cookie,

371 dissect_check,

372 dissect_wtf } },

373 [2] = { label = "KX_REPLY", info = "reply",

374 dissect = { dissect_my_challenge,

375 dissect_your_cookie,

376 dissect_check,

377 dissect_reply } },

378 [3] = { label = "KX_SWITCH", info = "switch",

379 dissect = { dissect_my_cookie,

380 dissect_your_cookie,

381 dissect_switch } },

382 [4] = { label = "KX_SWITCHOK", info = "switch-ok",

383 dissect = { dissect_switchok } },

384 [5] = { label = "KX_TOKENRQ", info = "token-rq",

385 dissect = { dissect_my_chal,

386 dissect_keyid,

387 dissect_ies } },

388 [6] = { label = "KX_TOKEN", info = "token",

389 dissect = { dissect_your_chal,

390 dissect_my_chal,

391 dissect_ies } },

392 [7] = { label = "KX_KNOCK", info = "knock",

393 dissect = { dissect_your_chal,

394 dissect_keyid,

395 dissect_ies,

396 dissect_my_challenge } }

397 }

398 },

399

400 [2] = {

401 label = "MSG_MISC", subtype = "tripe.misc.type",

402 info = "Miscellaneous",

403 sub = {

404 [0] = { label = "MISC_NOP", info = "no-operation (keepalive)",

405 dissect = { dissect_misc_payload } },

406 [1] = { label = "MISC_PING", info = "transport-level ping",

407 dissect = { dissect_misc_payload } },

408 [2] = { label = "MISC_PONG", info = "transport-level ping reply",

409 dissect = { dissect_misc_payload } },

410 [3] = { label = "MISC_EPING", info = "crypto-level ping",

411 dissect = { dissect_misc_ciphertext } },

412 [4] = { label = "MISC_EPONG", info = "crypto-level ping reply",

413 dissect = { dissect_misc_ciphertext } },

414 [5] = { label = "MISC_GREET", info = "greeting",

415 dissect = { dissect_misc_payload } },

416 [6] = { label = "MISC_BYE", info = "disconnect notification",

417 dissect = { dissect_misc_ciphertext } },

418 }

419 }

420 }

421

422 do

423 -- Work through the master table and build `cattab' and `subtab' tables,

424 -- mapping category and subtype codes to their symbolic names for

425 -- presentation. The `subtab' is a two-level table, needing two layers of

426 -- indexing.

427 local cattab = { }

428 local subtab = { }

429 for i, v in pairs(PKTINFO) do

430 cattab[i] = v.label

431 if v.sub ~= nil then

432 subtab[i] = { }

433 for j, w in pairs(v.sub) do

434 subtab[i][j] = w.label

435 end

436 end

437 end

438

439 local ftab = {

440 -- The protocol fields. This table maps the field names to structures

441 -- used to build the fields, which are then stored in `PF' (declared way

442 -- above):

443 --

444 -- * `name' is the field name to show in the dissector tree view;

445 --

446 -- * `type' is the field type;

447 --

448 -- * `base' is a tweak describing how the field should be formatted;

449 --

450 -- * `mask' is used to single out a piece of a larger bitfield; and

451 --

452 -- * `tab' names a mapping table used to convert numerical values to

453 -- symbolic names.

454

455 ["tripe.type"] = {

456 name = "Message type", type = ftypes.UINT8, base = base.HEX

457 },

458 ["tripe.cat"] = {

459 name = "Message category", type = ftypes.UINT8, base = base.DEC,

460 mask = 0xf0, tab = cattab

461 },

462 ["tripe.packet.type"] = {

463 name = "Packet subcode", type = ftypes.UINT8, base = base.DEC,

464 mask = 0x0f, tab = subtab[0]

465 },

466 ["tripe.packet.payload"] = {

467 name = "Encrypted packet", type = ftypes.NONE

468 },

469 ["tripe.knock.keyid"] = {

470 name = "Short key indicator", type = ftypes.UINT32, base = base.HEX

471 },

472 ["tripe.knock.mychal"] = {

473 name = "Sender's one-time challenge", type = ftypes.NONE

474 },

475 ["tripe.knock.yourchal"] = {

476 name = "Recipient's one-time challenge", type = ftypes.NONE

477 },

478 ["tripe.chal.len"] = {

479 name = "Challenge length", type = ftypes.UINT16, base = base.DEC

480 },

481 ["tripe.chal.sequence"] = {

482 name = "Challenge sequence number",

483 type = ftypes.UINT32, base = base.DEC

484 },

485 ["tripe.chal.tag"] = {

486 name = "Challenge tag", type = ftypes.BYTES, base = base.SPACE

487 },

488 ["tripe.knock.ies"] = {

489 name = "Encrypted message", type = ftypes.NONE

490 },

491 ["tripe.ies.len"] = {

492 name = "Encrypted message length",

493 type = ftypes.UINT16, base = base.DEC

494 },

495 ["tripe.ies.clue"] = {

496 name = "Encrypted message KEM clue",

497 type = ftypes.BYTES, base = base.SPACE

498 },

499 ["tripe.ies.ciphertext"] = {

500 name = "Encrypted message ciphertext",

501 type = ftypes.BYTES, base = base.SPACE

502 },

503 ["tripe.keyexch.type"] = {

504 name = "Key-exchange subcode", type = ftypes.UINT8, base = base.DEC,

505 mask = 0x0f, tab = subtab[1]

506 },

507 ["tripe.keyexch.mychal"] = {

508 name = "Sender's challenge R = r P", type = ftypes.NONE

509 },

510 ["tripe.keyexch.mycookie"] = {

511 name = "Hash of recipient's challenge = H(R, ...)",

512 type = ftypes.BYTES, base = base.SPACE

513 },

514 ["tripe.keyexch.yourcookie"] = {

515 name = "Hash of sender's challenge = H(R', ...)",

516 type = ftypes.BYTES, base = base.SPACE

517 },

518 ["tripe.keyexch.reply"] = {

519 name = "Encrypted reply = k R'", type = ftypes.NONE

520 },

521 ["tripe.keyexch.switch"] = {

522 name = "Encrypted reply and switch request = k R', H(...)",

523 type = ftypes.NONE

524 },

525 ["tripe.keyexch.switchok"] = {

526 name = "Encrypted switch confirmation = H(...)", type = ftypes.NONE

527 },

528 ["tripe.misc.type"] = {

529 name = "Miscellenaous subcode", type = ftypes.UINT8, base = base.DEC,

530 mask = 0x0f, tab = subtab[2]

531 },

532 ["tripe.misc.payload"] = {

533 name = "Miscellaneous payload",

534 type = ftypes.BYTES, base = base.SPACE

535 },

536 ["tripe.misc.ciphertext"] = {

537 name = "Miscellaneous encrypted payload", type = ftypes.NONE

538 },

539 ["tripe.wtf"] = {

540 name = "Unexpected trailing data",

541 type = ftypes.BYTES, base = base.SPACE

542 },

543 ["tripe.keyexch.check"] = {

544 name = "Sender's challenge check value = r XOR H(r K', ...)",

545 type = ftypes.BYTES, base = base.SPACE

546 },

547 ["tripe.ciphertext.seq"] = {

548 name = "Sequence number", type = ftypes.UINT32, base = base.DEC

549 },

550 ["tripe.ciphertext.iv"] = {

551 name = "Initialization vector", type = ftypes.BYTES, base = base.SPACE

552 },

553 ["tripe.ciphertext.tag"] = {

554 name = "Authentication tag", type = ftypes.BYTES, base = base.SPACE

555 },

556 ["tripe.ciphertext.body"] = {

557 name = "Encrypted data", type = ftypes.BYTES, base = base.SPACE

558 },

559 ["tripe.dh.len"] = {

560 name = "DH group element length",

561 type = ftypes.UINT16, base = base.DEC

562 },

563 ["tripe.dh.x"] = {

564 name = "DH group element value",

565 type = ftypes.BYTES, base = base.SPACE

566 },

567 ["tripe.ec.xlen"] = {

568 name = "Elliptic curve x-coordinate length",

569 type = ftypes.UINT16, base = base.DEC

570 },

571 ["tripe.ec.x"] = {

572 name = "Elliptic curve x-coordinate value",

573 type = ftypes.BYTES, base = base.SPACE

574 },

575 ["tripe.ec.ylen"] = {

576 name = "Elliptic curve y-coordinate length",

577 type = ftypes.UINT16, base = base.DEC

578 },

579 ["tripe.ec.y"] = {

580 name = "Elliptic curve y-coordinate value",

581 type = ftypes.BYTES, base = base.SPACE

582 },

583 ["tripe.x25519.x"] = {

584 name = "X25519 x-coordinate",

585 type = ftypes.BYTES, base = base.SPACE

586 },

587 ["tripe.x448.x"] = {

588 name = "X448 x-coordinate",

589 type = ftypes.BYTES, base = base.SPACE

590 },

591 }

592

593 -- Convert this table into the protocol fields, and populate `PF'.

594 local ff = { }

595 local i = 1

596

597 -- Figure out whether we can use `none' fields (see below).

598 -- probe for this easily

599 local use_none_p = rawget(ProtoField, 'none') ~= nil

600 for abbr, args in pairs(ftab) do

601

602 -- An annoying hack. Older versions of Wireshark don't allow setting

603 -- fields with type `none', which is a shame because they're ideal as

604 -- internal tree nodes.

605 ty = args.type

606 b = args.base

607 if ty == ftypes.NONE and not use_none_p then

608 ty = ftypes.BYTES

609 b = base.SPACE

610 end

611

612 -- Go make the field.

613 local f = ProtoField.new(args.name, abbr, ty,

614 args.tab, b, args.mask, args.descr)

615 PF[abbr] = f

616 ff[i] = f; i = i + 1

617 end

618 tripe.fields = PF

619 end

620

621 -----------------------------------------------------------------------------

622 --- The main dissector.

623

624 function tripe.dissector(buf, pinfo, tree)

625

626 -- Fill in the obvious stuff.

627 pinfo.cols.protocol = "TrIPE"

628

629 local sz = buf:reported_length_remaining()

630 local sub = tree:add(tripe, buf(0, sz), "TrIPE packet")

631 local p = 1

632

633 -- Decode the packet type octet.

634 local tycode = buf(0, 1):uint()

635 local ty = sub:add(PF["tripe.type"], buf(0, 1))

636 ty:add(PF["tripe.cat"], buf(0, 1))

637 local cat = bit.rshift(bit.band(tycode, 0xf0), 4)

638 local subty = bit.band(tycode, 0x0f)

639 local info = PKTINFO[cat]

640

641 -- Dispatch using the master protocol table.

642 if info == nil then

643 pinfo.cols.info = string.format("Unknown category code %u, " ..

644 "unknown type code %u",

645 cat, subty)

646 else

647 ty:add(PF[info.subtype], buf(0, 1))

648 local subinfo = info.sub[subty]

649 if subinfo == nil then

650 pinfo.cols.info = string.format("%s, unknown type code %u",

651 info.info, subty)

652 else

653 pinfo.cols.info = string.format("%s, %s", info.info, subinfo.info)

654 p = 1

655 for _, d in ipairs(subinfo.dissect) do p = d(buf, sub, p, sz) end

656 end

657 end

658

659 -- Return the final position we reached.

660 return p

661 end

662

663 -- We're done. Register the dissector.

664 DissectorTable.get("udp.port"):add(4070, tripe)

665

666 -------- That's all, folks --------------------------------------------------