nebula/dist/wireshark/nebula.lua

local nebula = Proto("nebula", "nebula")

local default_settings = {
    port      = 4242,
    all_ports = false,
}

nebula.prefs.port  = Pref.uint("Port number", default_settings.port, "The UDP port number for Nebula")
nebula.prefs.all_ports  = Pref.bool("All ports", default_settings.all_ports, "Assume nebula packets on any port, useful when dealing with hole punching")

local pf_version  = ProtoField.new("version", "nebula.version", ftypes.UINT8, nil, base.DEC, 0xF0)
local pf_type     = ProtoField.new("type", "nebula.type", ftypes.UINT8, {
    [0] = "handshake",
    [1] = "message",
    [2] = "recvError",
    [3] = "lightHouse",
    [4] = "test",
    [5] = "closeTunnel",
}, base.DEC, 0x0F)

local pf_subtype = ProtoField.new("subtype", "nebula.subtype", ftypes.UINT8, nil, base.DEC)
local pf_subtype_test = ProtoField.new("subtype", "nebula.subtype", ftypes.UINT8, {
    [0] = "request",
    [1] = "reply",
}, base.DEC)

local pf_subtype_handshake = ProtoField.new("subtype", "nebula.subtype", ftypes.UINT8, {
    [0] = "ix_psk0",
}, base.DEC)

local pf_reserved        = ProtoField.new("reserved",     "nebula.reserved",     ftypes.UINT16, nil, base.HEX)
local pf_remote_index    = ProtoField.new("remote index", "nebula.remote_index", ftypes.UINT32, nil, base.DEC)
local pf_message_counter = ProtoField.new("counter",      "nebula.counter",      ftypes.UINT64, nil, base.DEC)
local pf_payload         = ProtoField.new("payload",      "nebula.payload",      ftypes.BYTES,  nil, base.NONE)

nebula.fields = { pf_version, pf_type, pf_subtype, pf_subtype_handshake, pf_subtype_test, pf_reserved, pf_remote_index, pf_message_counter, pf_payload }

local ef_holepunch = ProtoExpert.new("nebula.holepunch.expert", "Nebula hole punch packet", expert.group.PROTOCOL, expert.severity.NOTE)
local ef_punchy = ProtoExpert.new("nebula.punchy.expert", "Nebula punchy keepalive packet", expert.group.PROTOCOL, expert.severity.NOTE)

nebula.experts = { ef_holepunch, ef_punchy }
local type_field = Field.new("nebula.type")
local subtype_field = Field.new("nebula.subtype")

function nebula.dissector(tvbuf, pktinfo, root)
    -- set the protocol column to show our protocol name
    pktinfo.cols.protocol:set("NEBULA")

    local pktlen = tvbuf:reported_length_remaining()
    local tree = root:add(nebula, tvbuf:range(0,pktlen))

    if pktlen == 0 then
        tree:add_proto_expert_info(ef_holepunch)
        pktinfo.cols.info:append(" (holepunch)")
        return
    elseif pktlen == 1 then
        tree:add_proto_expert_info(ef_punchy)
        pktinfo.cols.info:append(" (punchy)")
        return
    end

    tree:add(pf_version, tvbuf:range(0,1))
    local type = tree:add(pf_type,    tvbuf:range(0,1))

    local nebula_type = bit32.band(tvbuf:range(0,1):uint(), 0x0F)
    if nebula_type == 0 then
        local stage = tvbuf(8,8):uint64()
        tree:add(pf_subtype_handshake, tvbuf:range(1,1))
        type:append_text(" stage " .. stage)
        pktinfo.cols.info:append(" (" .. type_field().display .. ", stage " .. stage .. ", " .. subtype_field().display .. ")")
    elseif nebula_type == 4 then
        tree:add(pf_subtype_test, tvbuf:range(1,1))
        pktinfo.cols.info:append(" (" .. type_field().display .. ", " .. subtype_field().display .. ")")
    else
        tree:add(pf_subtype, tvbuf:range(1,1))
        pktinfo.cols.info:append(" (" .. type_field().display .. ")")
    end

    tree:add(pf_reserved,        tvbuf:range(2,2))
    tree:add(pf_remote_index,    tvbuf:range(4,4))
    tree:add(pf_message_counter, tvbuf:range(8,8))
    tree:add(pf_payload,         tvbuf:range(16,tvbuf:len() - 16))
end

function nebula.prefs_changed()
    if default_settings.all_ports == nebula.prefs.all_ports and default_settings.port == nebula.prefs.port then
        -- Nothing changed, bail
        return
    end

    -- Remove our old dissector
    DissectorTable.get("udp.port"):remove_all(nebula)

    if nebula.prefs.all_ports and default_settings.all_ports ~= nebula.prefs.all_ports then
        default_settings.all_port = nebula.prefs.all_ports

        for i=0, 65535 do
            DissectorTable.get("udp.port"):add(i, nebula)
        end

        -- no need to establish again on specific ports
        return
    end


    if default_settings.all_ports ~= nebula.prefs.all_ports then
        -- Add our new port dissector
        default_settings.port = nebula.prefs.port
        DissectorTable.get("udp.port"):add(default_settings.port, nebula)
    end
end

DissectorTable.get("udp.port"):add(default_settings.port, nebula)