mdw@git.distorted.org.uk Git - tripe/blob - wireshark/tripe.lua

   1 --- -*-lua-*-
   2 ---
   3 --- Wireshark protocol dissector for TrIPE
   4 ---
   5 --- (c) 2017 Straylight/Edgeware
   6 ---
   7
   8 -------- Licensing notice ---------------------------------------------------
   9 ---
  10 --- This file is part of Trivial IP Encryption (TrIPE).
  11 ---
  12 --- TrIPE is free software: you can redistribute it and/or modify it under
  13 --- the terms of the GNU General Public License as published by the Free
  14 --- Software Foundation; either version 3 of the License, or (at your
  15 --- option) any later version.
  16 ---
  17 --- TrIPE is distributed in the hope that it will be useful, but WITHOUT
  18 --- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  19 --- FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20 --- for more details.
  21 ---
  22 --- You should have received a copy of the GNU General Public License
  23 --- along with TrIPE.  If not, see <https://www.gnu.org/licenses/>.
  24
  25 local tripe = Proto("tripe", "TrIPE VPN")
  26
  27 -----------------------------------------------------------------------------
  28 --- Configuration handling.
  29
  30 local CONFIG = {
  31   -- Information about the configuration variables.  This table, when it's
  32   -- set up, maps the internal names, which are used to refer to
  33   -- configuration variables in the rest of this code, to a little structure:
  34   --
  35   --   * `var' names the variable, and is the usual key for lookups;
  36   --
  37   --   * `name' is the label used in the dialogue box;
  38   --
  39   --   * `type' is the type of variable, currently either `enum' or `int';
  40   --
  41   --   * `descr' is a longer (but generally fairly useless) description for
  42   --     use in a tooltip;
  43   --
  44   --   * `allowed' is a sequence of allowed values for an `enum' variable;
  45   --     and
  46   --
  47   --   * `min' and `max' are the limits on permitted values for an `int'
  48   --     variable (and may be omitted).
  49   --
  50   -- More slots are added at runtime:
  51   --
  52   --   * `map' is a table mapping string values to their integer indices, as
  53   --     stored in Wireshark's preferences database.
  54   --
  55   -- Initially, though, the table is given as a sequence, so that the
  56   -- preferences can be populated in a consistent (and approximately logical)
  57   -- order.
  58
  59   { var = "bulk", name = "Bulk transform",
  60     type = "enum", allowed = { "v0", "iiv", "naclbox", "aead" },
  61     descr = "Bulk cryptographic transform", default = "v0" },
  62   { var = "hashsz", name = "Hash length", type = "int", min = 0,
  63     descr = "Hash length (bytes)", default = 20 },
  64   { var = "tagsz", name = "Tag length", type = "int", min = 0,
  65     descr = "Authentication tag length (bytes)", default = 10 },
  66   { var = "ivsz", name = "IV length", type = "int", min = 0,
  67     descr = "Initialization vector length (bytes)", default = 8 },
  68   { var = "kx", name = "Key-exchange group",
  69     type = "enum", allowed = { "dh", "ec", "x25519", "x448" },
  70     descr = "Key-exchange group type", default = "dh" },
  71   { var = "scsz", name = "Scalar length", type = "int", min = 1,
  72     descr = "Scalar field-element length (bytes)", default = 32 },
  73 }
  74
  75 local C = { } -- The working values of the configuration variables.
  76
  77 local function set_config(k, v)
  78   -- Set configuration variable K to the value V.
  79   --
  80   -- K is a string naming the variable to set.  V is the new value, which may
  81   -- be a string or a number.
  82   --
  83   -- For `int' variables, V is converted to a number if necessary, and then
  84   -- checked against the permitted bounds.
  85   --
  86   -- For `enum' variables, things are more complicated.  If V is a string,
  87   -- it's checked against the permitted values.  If V is a number, it's
  88   -- converted back into the corresponding string.
  89
  90   local info = CONFIG[k]
  91
  92   if info == nil then error("unknown config key `" .. k .. "'") end
  93
  94   if info.type == "enum" then
  95     if type(v) == "number" then
  96       local t = info.allowed[v]
  97       if t == nil then
  98         error(string.format("bad index %d for `%s'", n, k))
  99       end
 100       v = t
 101     else
 102       if info.map[v] == nil then
 103         error(string.format("bad value `%s' for `%s'", v, k))
 104       end
 105     end
 106
 107   elseif info.type == "int" then
 108     local n = tonumber(v)
 109     if n == nil then error("bad number `" .. v .. "'") end
 110     if n ~= math.floor(n) then
 111       error("value `" .. v .. "' is not an integer")
 112     end
 113     if (info.min ~= nil and n < info.min) or
 114        (info.max ~= nil and n > info.max)
 115     then
 116       error(string.format("value %d out of range for `%s'", n, k))
 117     end
 118     v = n
 119   end
 120
 121   C[k] = v
 122 end
 123
 124 -- Set up the configuration information.  Configure preferences objects on
 125 -- the dissector.  For `enum' variables, build the `map' slots.
 126 for i, v in ipairs(CONFIG) do
 127   local k = v.var
 128   CONFIG[k] = v
 129   if v.type == "enum" then
 130     local tab = { }
 131     v.map = { }
 132     for i, t in pairs(v.allowed) do
 133       v.map[t] = i
 134       tab[i] = { i, t, i }
 135     end
 136     tripe.prefs[k] = Pref.enum(v.name, v.map[v.default], v.descr, tab)
 137   elseif v.type == "int" then
 138     tripe.prefs[k] = Pref.uint(v.name, v.default, v.descr)
 139   end
 140 end
 141
 142 local function prefs_changed()
 143   -- Notice that the preferences have been changed and update `C'.
 144
 145   for k, _ in pairs(CONFIG) do
 146     if type(k) == "string" then set_config(k, tripe.prefs[k]) end
 147   end
 148 end
 149 tripe.prefs_changed = prefs_changed
 150
 151 -- Populate the configuration table from the stored preferences or their
 152 -- default values.
 153 prefs_changed()
 154
 155 -- Now work through arguments passed in on the command line.  Annoyingly,
 156 -- while one can set preferences on the Wireshark command line, these are
 157 -- done /before/ Lua scripts are loaded, so the silly thing thinks the
 158 -- preference slots don't exist.  So we have to do it a different way.
 159 for _, arg in ipairs({...}) do
 160   local k, v = arg:match("(.+)=(.+)")
 161   if k == nil or v == nil then error("bad option syntax `" .. arg .. "'") end
 162   se_config(k, v)
 163 end
 164
 165 -----------------------------------------------------------------------------
 166 --- Protocol dissection primitives.
 167
 168 local PF = { } -- The table of protocol fields, filled in later.
 169
 170 -- The `dissect_*' functions follow a common protocol.  They parse a thing
 171 -- from a packet buffer BUF, of size SZ, starting from POS, and store
 172 -- interesting things in a given TREE; when they're done, they return the
 173 -- updated index where the next interesting thing might be.  As a result,
 174 -- it's usually a simple matter to parse a packet by invoking the appropriate
 175 -- primitive dissectors in the right order.
 176
 177 local function dissect_wtf(buf, tree, pos, sz)
 178   -- If POS is not at the end of the buffer, note that there's unexpected
 179   -- stuff in the packet.
 180
 181   if pos < sz then tree:add(PF["tripe.wtf"], buf(pos, sz - pos)) end
 182   return sz
 183 end
 184
 185 -- Dissect a ciphertext of some particular kind.
 186 local dissect_ct = { }
 187 function dissect_ct.aead(buf, tree, pos, sz)
 188   tree:add(PF["tripe.ciphertext.tag"], buf(pos, C.tagsz)); pos = pos + C.tagsz
 189   tree:add(PF["tripe.ciphertext.seq"], buf(pos, 4)); pos = pos + 4
 190   tree:add(PF["tripe.ciphertext.body"], buf(pos, sz - pos))
 191 end
 192 function dissect_ct.naclbox(buf, tree, pos, sz)
 193   tree:add(PF["tripe.ciphertext.tag"], buf(pos, 16)); pos = pos + 16
 194   tree:add(PF["tripe.ciphertext.seq"], buf(pos, 4)); pos = pos + 4
 195   tree:add(PF["tripe.ciphertext.body"], buf(pos, sz - pos))
 196 end
 197 function dissect_ct.iiv(buf, tree, pos, sz)
 198   tree:add(PF["tripe.ciphertext.tag"], buf(pos, C.tagsz)); pos = pos + C.tagsz
 199   tree:add(PF["tripe.ciphertext.seq"], buf(pos, 4)); pos = pos + 4
 200   tree:add(PF["tripe.ciphertext.body"], buf(pos, sz - pos))
 201 end
 202 function dissect_ct.v0(buf, tree, pos, sz)
 203   tree:add(PF["tripe.ciphertext.tag"], buf(pos, C.tagsz)); pos = pos + C.tagsz
 204   tree:add(PF["tripe.ciphertext.seq"], buf(pos, 4)); pos = pos + 4
 205   tree:add(PF["tripe.ciphertext.iv"], buf(pos, C.ivsz)); pos = pos + C.ivsz
 206   tree:add(PF["tripe.ciphertext.body"], buf(pos, sz - pos))
 207 end
 208
 209 local function dissect_ciphertext(buf, tree, label, pos, sz)
 210   -- Dissect a ciphertext, making the whole thing be a little subtree with
 211   -- the given LABEL.
 212
 213   local t = tree:add(PF[label], buf(pos, sz - pos))
 214   dissect_ct[C.bulk](buf, t, pos, sz)
 215   return sz
 216 end
 217
 218 local function dissect_packet(buf, tree, pos, sz)
 219   return dissect_ciphertext(buf, tree, "tripe.packet.payload", pos, sz)
 220 end
 221
 222 -- Dissect a group element of some particular kind.
 223 local dissect_ge = { }
 224 function dissect_ge.dh(buf, tree, pos, sz)
 225   tree:add(PF["tripe.dh.len"], buf(pos, 2))
 226   xsz = buf(pos, 2):uint(); pos = pos + 2
 227   tree:add(PF["tripe.dh.x"], buf(pos, xsz)); pos = pos + xsz
 228   return pos
 229 end
 230 function dissect_ge.ec(buf, tree, pos, sz)
 231   tree:add(PF["tripe.ec.xlen"], buf(pos, 2))
 232   xsz = buf(pos, 2):uint(); pos = pos + 2
 233   tree:add(PF["tripe.ec.x"], buf(pos, xsz)); pos = pos + xsz
 234   tree:add(PF["tripe.ec.ylen"], buf(pos, 2))
 235   ysz = buf(pos, 2):uint(); pos = pos + 2
 236   tree:add(PF["tripe.ec.y"], buf(pos, ysz)); pos = pos + ysz
 237   return pos
 238 end
 239 function dissect_ge.x25519(buf, tree, pos, sz)
 240   tree:add(PF["tripe.x25519.x"], buf(pos, 32))
 241   return pos + 32
 242 end
 243 function dissect_ge.x448(buf, tree, pos, sz)
 244   tree:add(PF["tripe.x448.x"], buf(pos, 56))
 245   return pos + 56
 246 end
 247
 248 local function dissect_my_challenge(buf, tree, pos, sz)
 249   -- We don't know how long the group element is going to be.  We can set the
 250   -- length later, but (at least in older versions) it doesn't work so well
 251   -- to increase the length, so make it large to start out, and shrink it
 252   -- later.
 253   local t = tree:add(PF["tripe.keyexch.mychal"], buf(pos, sz - pos))
 254   local q = dissect_ge[C.kx](buf, t, pos, sz)
 255   t:set_len(q - pos)
 256   return q
 257 end
 258
 259 local function dissect_my_cookie(buf, tree, pos, sz)
 260   tree:add(PF["tripe.keyexch.mycookie"], buf(pos, C.hashsz))
 261   return pos + C.hashsz
 262 end
 263
 264 local function dissect_your_cookie(buf, tree, pos, sz)
 265   tree:add(PF["tripe.keyexch.yourcookie"], buf(pos, C.hashsz))
 266   return pos + C.hashsz
 267 end
 268
 269 local kx_scsz = { x25519 = 32, x448 = 56 } -- Hardwired scalar sizes.
 270 local function dissect_check(buf, tree, pos, sz)
 271   local scsz = kx_scsz[C.kx] or C.scsz
 272   tree:add(PF["tripe.keyexch.check"], buf(pos, scsz))
 273   return pos + scsz
 274 end
 275
 276 local function dissect_reply(buf, tree, pos, sz)
 277   return dissect_ciphertext(buf, tree, "tripe.keyexch.reply", pos, sz)
 278 end
 279
 280 local function dissect_switch(buf, tree, pos, sz)
 281   return dissect_ciphertext(buf, tree, "tripe.keyexch.switch", pos, sz)
 282 end
 283
 284 local function dissect_switchok(buf, tree, pos, sz)
 285   return dissect_ciphertext(buf, tree, "tripe.keyexch.switchok", pos, sz)
 286 end
 287
 288 local function dissect_misc_payload(buf, tree, pos, sz)
 289   tree:add(PF["tripe.misc.payload"], buf(pos, sz - pos))
 290   return sz
 291 end
 292
 293 local function dissect_misc_ciphertext(buf, tree, pos, sz)
 294   return dissect_ciphertext(buf, tree, "tripe.misc.ciphertext", pos, sz)
 295 end
 296
 297 local function dissect_chal(buf, tree, label, pos, sz)
 298   local len = buf(pos, 2):uint()
 299   local t = tree:add(PF[label], buf(pos, len + 2))
 300   t:add(PF["tripe.chal.len"], buf(pos, 2)); pos = pos + 2
 301   t:add(PF["tripe.chal.sequence"], buf(pos, 4)); pos = pos + 4; len = len - 4
 302   t:add(PF["tripe.chal.tag"], buf(pos, len))
 303   return pos + len
 304 end
 305
 306 local function dissect_my_chal(buf, tree, pos, sz)
 307   return dissect_chal(buf, tree, "tripe.knock.mychal", pos, sz)
 308 end
 309
 310 local function dissect_your_chal(buf, tree, pos, sz)
 311   return dissect_chal(buf, tree, "tripe.knock.yourchal", pos, sz)
 312 end
 313
 314 local function dissect_keyid(buf, tree, pos, sz)
 315   tree:add(PF["tripe.knock.keyid"], buf(pos, 4))
 316   return pos + 4
 317 end
 318
 319 local function dissect_ies(buf, tree, pos, sz)
 320   local len = buf(pos, 2):uint()
 321   local lim = pos + len + 2
 322   local t = tree:add(PF["tripe.knock.ies"], buf(pos, len + 2))
 323   t:add(PF["tripe.ies.len"], buf(pos, 2)); pos = pos + 2
 324   pos = dissect_ge[C.kx](buf, t, pos, sz)
 325   return dissect_ciphertext(buf, t, "tripe.ies.ciphertext", pos, lim)
 326 end
 327
 328 -----------------------------------------------------------------------------
 329 --- The protocol information table.
 330
 331 local PKTINFO = {
 332   -- This is the main table which describes the protocol.  The top level maps
 333   -- category codes to structures:
 334   --
 335   --   * `label' is the category code's symbolic name;
 336   --
 337   --   * `subtype' is the field name for the subtype code;
 338   --
 339   --   * `info' is a prefix for the information column display; and
 340   --
 341   --   * `sub' is a table describing the individual subtypes.
 342   --
 343   -- The subtype table similarly maps subtype codes to structures:
 344   --
 345   --   * `label' is the subtype code's symbolic name;
 346   --
 347   --   * `info' is the suffix for the information column display; and
 348   --
 349   --   * `dissect' is a sequence of primitive dissectors to run in order to
 350   --     parse the rest of the packet.
 351
 352   [0] = {
 353     label = "MSG_PACKET", subtype = "tripe.packet.type",
 354     info = "Packet data",
 355     sub = {
 356       [0] = { label = "PACKET_IP", info = "encapsulated IP datagram",
 357               dissect = { dissect_packet} }
 358     }
 359   },
 360
 361   [1] = {
 362     label = "MSG_KEYEXCH", subtype = "tripe.keyexch.type",
 363     info = "Key exchange",
 364     sub = {
 365       [0] = { label = "KX_PRECHAL", info = "pre-challenge",
 366               dissect = { dissect_my_challenge,
 367                           dissect_wtf } },
 368       [1] = { label = "KX_CHAL", info = "challenge",
 369               dissect = { dissect_my_challenge,
 370                           dissect_your_cookie,
 371                           dissect_check,
 372                           dissect_wtf } },
 373       [2] = { label = "KX_REPLY", info = "reply",
 374               dissect = { dissect_my_challenge,
 375                           dissect_your_cookie,
 376                           dissect_check,
 377                           dissect_reply } },
 378       [3] = { label = "KX_SWITCH", info = "switch",
 379               dissect = { dissect_my_cookie,
 380                           dissect_your_cookie,
 381                           dissect_switch } },
 382       [4] = { label = "KX_SWITCHOK", info = "switch-ok",
 383               dissect = { dissect_switchok } },
 384       [5] = { label = "KX_TOKENRQ", info = "token-rq",
 385               dissect = { dissect_my_chal,
 386                           dissect_keyid,
 387                           dissect_ies } },
 388       [6] = { label = "KX_TOKEN", info = "token",
 389               dissect = { dissect_your_chal,
 390                           dissect_my_chal,
 391                           dissect_ies } },
 392       [7] = { label = "KX_KNOCK", info = "knock",
 393               dissect = { dissect_your_chal,
 394                           dissect_keyid,
 395                           dissect_ies,
 396                           dissect_my_challenge } }
 397     }
 398   },
 399
 400   [2] = {
 401     label = "MSG_MISC", subtype = "tripe.misc.type",
 402     info = "Miscellaneous",
 403     sub = {
 404       [0] = { label = "MISC_NOP", info = "no-operation (keepalive)",
 405               dissect = { dissect_misc_payload } },
 406       [1] = { label = "MISC_PING", info = "transport-level ping",
 407               dissect = { dissect_misc_payload } },
 408       [2] = { label = "MISC_PONG", info = "transport-level ping reply",
 409               dissect = { dissect_misc_payload } },
 410       [3] = { label = "MISC_EPING", info = "crypto-level ping",
 411               dissect = { dissect_misc_ciphertext } },
 412       [4] = { label = "MISC_EPONG", info = "crypto-level ping reply",
 413               dissect = { dissect_misc_ciphertext } },
 414       [5] = { label = "MISC_GREET", info = "greeting",
 415               dissect = { dissect_misc_payload } },
 416       [6] = { label = "MISC_BYE", info = "disconnect notification",
 417               dissect = { dissect_misc_ciphertext } },
 418     }
 419   }
 420 }
 421
 422 do
 423   -- Work through the master table and build `cattab' and `subtab' tables,
 424   -- mapping category and subtype codes to their symbolic names for
 425   -- presentation.  The `subtab' is a two-level table, needing two layers of
 426   -- indexing.
 427   local cattab = { }
 428   local subtab = { }
 429   for i, v in pairs(PKTINFO) do
 430     cattab[i] = v.label
 431     if v.sub ~= nil then
 432       subtab[i] = { }
 433       for j, w in pairs(v.sub) do
 434         subtab[i][j] = w.label
 435       end
 436     end
 437   end
 438
 439   local ftab = {
 440     -- The protocol fields.  This table maps the field names to structures
 441     -- used to build the fields, which are then stored in `PF' (declared way
 442     -- above):
 443     --
 444     --   * `name' is the field name to show in the dissector tree view;
 445     --
 446     --   * `type' is the field type;
 447     --
 448     --   * `base' is a tweak describing how the field should be formatted;
 449     --
 450     --   * `mask' is used to single out a piece of a larger bitfield; and
 451     --
 452     --   * `tab' names a mapping table used to convert numerical values to
 453     --     symbolic names.
 454
 455     ["tripe.type"] = {
 456       name = "Message type", type = ftypes.UINT8, base = base.HEX
 457     },
 458     ["tripe.cat"] = {
 459       name = "Message category", type = ftypes.UINT8, base = base.DEC,
 460       mask = 0xf0, tab = cattab
 461     },
 462     ["tripe.packet.type"] = {
 463       name = "Packet subcode", type = ftypes.UINT8, base = base.DEC,
 464       mask = 0x0f, tab = subtab[0]
 465     },
 466     ["tripe.packet.payload"] = {
 467       name = "Encrypted packet", type = ftypes.NONE
 468     },
 469     ["tripe.knock.keyid"] = {
 470       name = "Short key indicator", type = ftypes.UINT32, base = base.HEX
 471     },
 472     ["tripe.knock.mychal"] = {
 473       name = "Sender's one-time challenge", type = ftypes.NONE
 474     },
 475     ["tripe.knock.yourchal"] = {
 476       name = "Recipient's one-time challenge", type = ftypes.NONE
 477     },
 478     ["tripe.chal.len"] = {
 479       name = "Challenge length", type = ftypes.UINT16, base = base.DEC
 480     },
 481     ["tripe.chal.sequence"] = {
 482       name = "Challenge sequence number",
 483       type = ftypes.UINT32, base = base.DEC
 484     },
 485     ["tripe.chal.tag"] = {
 486       name = "Challenge tag", type = ftypes.BYTES, base = base.SPACE
 487     },
 488     ["tripe.knock.ies"] = {
 489       name = "Encrypted message", type = ftypes.NONE
 490     },
 491     ["tripe.ies.len"] = {
 492       name = "Encrypted message length",
 493       type = ftypes.UINT16, base = base.DEC
 494     },
 495     ["tripe.ies.clue"] = {
 496       name = "Encrypted message KEM clue",
 497       type = ftypes.BYTES, base = base.SPACE
 498     },
 499     ["tripe.ies.ciphertext"] = {
 500       name = "Encrypted message ciphertext",
 501       type = ftypes.BYTES, base = base.SPACE
 502     },
 503     ["tripe.keyexch.type"] = {
 504       name = "Key-exchange subcode", type = ftypes.UINT8, base = base.DEC,
 505       mask = 0x0f, tab = subtab[1]
 506     },
 507     ["tripe.keyexch.mychal"] = {
 508       name = "Sender's challenge R = r P", type = ftypes.NONE
 509     },
 510     ["tripe.keyexch.mycookie"] = {
 511       name = "Hash of recipient's challenge = H(R, ...)",
 512       type = ftypes.BYTES, base = base.SPACE
 513     },
 514     ["tripe.keyexch.yourcookie"] = {
 515       name = "Hash of sender's challenge = H(R', ...)",
 516       type = ftypes.BYTES, base = base.SPACE
 517     },
 518     ["tripe.keyexch.reply"] = {
 519       name = "Encrypted reply = k R'", type = ftypes.NONE
 520     },
 521     ["tripe.keyexch.switch"] = {
 522       name = "Encrypted reply and switch request = k R', H(...)",
 523       type = ftypes.NONE
 524     },
 525     ["tripe.keyexch.switchok"] = {
 526       name = "Encrypted switch confirmation = H(...)", type = ftypes.NONE
 527     },
 528     ["tripe.misc.type"] = {
 529       name = "Miscellenaous subcode", type = ftypes.UINT8, base = base.DEC,
 530       mask = 0x0f, tab = subtab[2]
 531     },
 532     ["tripe.misc.payload"] = {
 533       name = "Miscellaneous payload",
 534       type = ftypes.BYTES, base = base.SPACE
 535     },
 536     ["tripe.misc.ciphertext"] = {
 537       name = "Miscellaneous encrypted payload", type = ftypes.NONE
 538     },
 539     ["tripe.wtf"] = {
 540       name = "Unexpected trailing data",
 541       type = ftypes.BYTES, base = base.SPACE
 542     },
 543     ["tripe.keyexch.check"] = {
 544       name = "Sender's challenge check value = r XOR H(r K', ...)",
 545       type = ftypes.BYTES, base = base.SPACE
 546     },
 547     ["tripe.ciphertext.seq"] = {
 548       name = "Sequence number", type = ftypes.UINT32, base = base.DEC
 549     },
 550     ["tripe.ciphertext.iv"] = {
 551       name = "Initialization vector", type = ftypes.BYTES, base = base.SPACE
 552     },
 553     ["tripe.ciphertext.tag"] = {
 554       name = "Authentication tag", type = ftypes.BYTES, base = base.SPACE
 555     },
 556     ["tripe.ciphertext.body"] = {
 557       name = "Encrypted data", type = ftypes.BYTES, base = base.SPACE
 558     },
 559     ["tripe.dh.len"] = {
 560       name = "DH group element length",
 561       type = ftypes.UINT16, base = base.DEC
 562     },
 563     ["tripe.dh.x"] = {
 564       name = "DH group element value",
 565       type = ftypes.BYTES, base = base.SPACE
 566     },
 567     ["tripe.ec.xlen"] = {
 568       name = "Elliptic curve x-coordinate length",
 569       type = ftypes.UINT16, base = base.DEC
 570     },
 571     ["tripe.ec.x"] = {
 572       name = "Elliptic curve x-coordinate value",
 573       type = ftypes.BYTES, base = base.SPACE
 574     },
 575     ["tripe.ec.ylen"] = {
 576       name = "Elliptic curve y-coordinate length",
 577       type = ftypes.UINT16, base = base.DEC
 578     },
 579     ["tripe.ec.y"] = {
 580       name = "Elliptic curve y-coordinate value",
 581       type = ftypes.BYTES, base = base.SPACE
 582     },
 583     ["tripe.x25519.x"] = {
 584       name = "X25519 x-coordinate",
 585       type = ftypes.BYTES, base = base.SPACE
 586     },
 587     ["tripe.x448.x"] = {
 588       name = "X448 x-coordinate",
 589       type = ftypes.BYTES, base = base.SPACE
 590     },
 591   }
 592
 593   -- Convert this table into the protocol fields, and populate `PF'.
 594   local ff = { }
 595   local i = 1
 596
 597   -- Figure out whether we can use `none' fields (see below).
 598   -- probe for this easily
 599   local use_none_p = rawget(ProtoField, 'none') ~= nil
 600   for abbr, args in pairs(ftab) do
 601
 602     -- An annoying hack.  Older versions of Wireshark don't allow setting
 603     -- fields with type `none', which is a shame because they're ideal as
 604     -- internal tree nodes.
 605     ty = args.type
 606     b = args.base
 607     if ty == ftypes.NONE and not use_none_p then
 608       ty = ftypes.BYTES
 609       b = base.SPACE
 610     end
 611
 612     -- Go make the field.
 613     local f = ProtoField.new(args.name, abbr, ty,
 614                              args.tab, b, args.mask, args.descr)
 615     PF[abbr] = f
 616     ff[i] = f; i = i + 1
 617   end
 618   tripe.fields = PF
 619 end
 620
 621 -----------------------------------------------------------------------------
 622 --- The main dissector.
 623
 624 function tripe.dissector(buf, pinfo, tree)
 625
 626   -- Fill in the obvious stuff.
 627   pinfo.cols.protocol = "TrIPE"
 628
 629   local sz = buf:reported_length_remaining()
 630   local sub = tree:add(tripe, buf(0, sz), "TrIPE packet")
 631   local p = 1
 632
 633   -- Decode the packet type octet.
 634   local tycode = buf(0, 1):uint()
 635   local ty = sub:add(PF["tripe.type"], buf(0, 1))
 636   ty:add(PF["tripe.cat"], buf(0, 1))
 637   local cat = bit.rshift(bit.band(tycode, 0xf0), 4)
 638   local subty = bit.band(tycode, 0x0f)
 639   local info = PKTINFO[cat]
 640
 641   -- Dispatch using the master protocol table.
 642   if info == nil then
 643     pinfo.cols.info = string.format("Unknown category code %u, " ..
 644                                       "unknown type code %u",
 645                                     cat, subty)
 646   else
 647     ty:add(PF[info.subtype], buf(0, 1))
 648     local subinfo = info.sub[subty]
 649     if subinfo == nil then
 650       pinfo.cols.info = string.format("%s, unknown type code %u",
 651                                       info.info, subty)
 652     else
 653       pinfo.cols.info = string.format("%s, %s", info.info, subinfo.info)
 654       p = 1
 655       for _, d in ipairs(subinfo.dissect) do p = d(buf, sub, p, sz) end
 656     end
 657   end
 658
 659   -- Return the final position we reached.
 660   return p
 661 end
 662
 663 -- We're done.  Register the dissector.
 664 DissectorTable.get("udp.port"):add(4070, tripe)
 665
 666 -------- That's all, folks --------------------------------------------------