?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "TODO epan/dissectors/asn1/kerberos/packet-kerberos-template.c new GSS flags"
[wireshark-sm.git] / epan / dissectors / packet-bitcoin.c
blobdc6fe1e00109933b33e4e1dffc704e60bee2093a
1 /* packet-bitcoin.c
2 * Routines for bitcoin dissection
3 * Copyright 2011, Christian Svensson <blue@cmd.nu>
4 * Bitcoin address: 15Y2EN5mLnsTt3CZBfgpnZR5SeLwu7WEHz
5 *
6 * See https://en.bitcoin.it/wiki/Protocol_specification
7 *
8 * Updated 2015, Laurenz Kamp <laurenz.kamp@gmx.de>
9 * Changes made:
10 * Updated dissectors:
11 * -> ping: ping packets now have a nonce.
12 * -> version: If version >= 70002, version messages have a relay flag.
13 * -> Messages with no payload: Added mempool and filterclear messages.
14 * Added dissectors:
15 * -> pong message
16 * -> notfound message
17 * -> reject message
18 * -> filterload
19 * -> filteradd
20 * -> merkleblock
21 * -> headers
22 *
23 * Wireshark - Network traffic analyzer
24 * By Gerald Combs <gerald@wireshark.org>
25 * Copyright 1998 Gerald Combs
26 *
27 * SPDX-License-Identifier: GPL-2.0-or-later
28 */
29 #include "config.h"
30
31 #include <epan/packet.h>
32 #include <epan/prefs.h>
33 #include <epan/expert.h>
34 #include <epan/tfs.h>
35 #include <wsutil/array.h>
36
37 #include "packet-tcp.h"
38
39 #define BITCOIN_MAIN_MAGIC_NUMBER 0xD9B4BEF9
40 #define BITCOIN_TESTNET_MAGIC_NUMBER 0xDAB5BFFA
41 #define BITCOIN_TESTNET3_MAGIC_NUMBER 0x0709110B
42
43 static const value_string inv_types[] =
44 {
45 { 0, "ERROR" },
46 { 1, "MSG_TX" },
47 { 2, "MSG_BLOCK" },
48 { 3, "MSG_FILTERED_BLOCK" },
49 { 4, "MSG_CMPCT_BLOCK" },
50 { 5, "MSG_WTX" },
51 { 0x40000001, "MSG_WITNESS_TX" },
52 { 0x40000002, "MSG_WITNESS_BLOCK" },
53 { 0, NULL }
54 };
55
56 static const value_string network_ids[] =
57 {
58 { 0x01, "IPv4" },
59 { 0x02, "IPv6" },
60 { 0x03, "Tor v2" },
61 { 0x04, "Tor v3" },
62 { 0x05, "I2P" },
63 { 0x06, "Cjdns" },
64 { 0, NULL }
65 };
66
67 static const value_string reject_ccode[] =
68 {
69 { 0x01, "REJECT_MALFORMED" },
70 { 0x10, "REJECT_INVALID" },
71 { 0x11, "REJECT_OBSOLETE" },
72 { 0x12, "REJECT_DUPLICATE" },
73 { 0x40, "REJECT_NONSTANDARD" },
74 { 0x41, "REJECT_DUST" },
75 { 0x42, "REJECT_INSUFFICIENTFEE" },
76 { 0x43, "REJECT_CHECKPOINT" },
77 { 0, NULL }
78 };
79
80 static const value_string filterload_nflags[] =
81 {
82 { 0, "BLOOM_UPDATE_NONE" },
83 { 1, "BLOOM_UPDATE_ALL" },
84 { 2, "BLOOM_UPDATE_P2PUBKEY_ONLY" },
85 { 0, NULL }
86 };
87
88 /*
89 * Minimum bitcoin identification header.
90 * - Magic - 4 bytes
91 * - Command - 12 bytes
92 * - Payload length - 4 bytes
93 * - Checksum - 4 bytes
94 */
95 #define BITCOIN_HEADER_LENGTH 4+12+4+4
96
97 void proto_register_bitcoin(void);
98 void proto_reg_handoff_bitcoin(void);
99
100 static dissector_handle_t bitcoin_handle;
101
102 static dissector_table_t bitcoin_command_table;
103
104 static int proto_bitcoin;
105
106 static int hf_address_address;
107 static int hf_address_port;
108 static int hf_address_services;
109 static int hf_bitcoin_checksum;
110 static int hf_bitcoin_command;
111 static int hf_bitcoin_length;
112 static int hf_bitcoin_magic;
113 static int hf_bitcoin_msg_addr;
114 static int hf_bitcoin_msg_addrv2;
115 static int hf_bitcoin_msg_block;
116 static int hf_bitcoin_msg_feefilter;
117 static int hf_bitcoin_msg_filteradd;
118 static int hf_bitcoin_msg_filterload;
119 static int hf_bitcoin_msg_getblocks;
120 static int hf_bitcoin_msg_getdata;
121 static int hf_bitcoin_msg_getheaders;
122 static int hf_bitcoin_msg_headers;
123 static int hf_bitcoin_msg_inv;
124 static int hf_bitcoin_msg_merkleblock;
125 static int hf_bitcoin_msg_notfound;
126 static int hf_bitcoin_msg_ping;
127 static int hf_bitcoin_msg_pong;
128 static int hf_bitcoin_msg_reject;
129 static int hf_bitcoin_msg_sendcmpct;
130 static int hf_bitcoin_msg_tx;
131 static int hf_bitcoin_msg_version;
132 static int hf_data_value;
133 static int hf_data_varint_count16;
134 static int hf_data_varint_count32;
135 static int hf_data_varint_count64;
136 static int hf_data_varint_count8;
137 static int hf_msg_addr_address;
138 static int hf_msg_addr_count16;
139 static int hf_msg_addr_count32;
140 static int hf_msg_addr_count64;
141 static int hf_msg_addr_count8;
142 static int hf_msg_addr_timestamp;
143 static int hf_msg_addrv2_count16;
144 static int hf_msg_addrv2_count32;
145 static int hf_msg_addrv2_count64;
146 static int hf_msg_addrv2_count8;
147 static int hf_msg_addrv2_item;
148 static int hf_msg_addrv2_timestamp;
149 static int hf_msg_addrv2_services;
150 static int hf_msg_addrv2_network;
151 static int hf_msg_addrv2_address_ipv4;
152 static int hf_msg_addrv2_address_ipv6;
153 static int hf_msg_addrv2_address_other;
154 static int hf_msg_addrv2_port;
155 static int hf_msg_block_bits;
156 static int hf_msg_block_merkle_root;
157 static int hf_msg_block_nonce;
158 static int hf_msg_block_prev_block;
159 static int hf_msg_block_time;
160 static int hf_msg_block_transactions16;
161 static int hf_msg_block_transactions32;
162 static int hf_msg_block_transactions64;
163 static int hf_msg_block_transactions8;
164 static int hf_msg_block_version;
165 static int hf_msg_feefilter_value;
166 static int hf_msg_filteradd_data;
167 static int hf_msg_filterload_filter;
168 static int hf_msg_filterload_nflags;
169 static int hf_msg_filterload_nhashfunc;
170 static int hf_msg_filterload_ntweak;
171 static int hf_msg_getblocks_count16;
172 static int hf_msg_getblocks_count32;
173 static int hf_msg_getblocks_count64;
174 static int hf_msg_getblocks_count8;
175 static int hf_msg_getblocks_start;
176 static int hf_msg_getblocks_stop;
177 static int hf_msg_getdata_count16;
178 static int hf_msg_getdata_count32;
179 static int hf_msg_getdata_count64;
180 static int hf_msg_getdata_count8;
181 static int hf_msg_getdata_hash;
182 static int hf_msg_getdata_type;
183 static int hf_msg_getheaders_count16;
184 static int hf_msg_getheaders_count32;
185 static int hf_msg_getheaders_count64;
186 static int hf_msg_getheaders_count8;
187 static int hf_msg_getheaders_start;
188 static int hf_msg_getheaders_stop;
189 static int hf_msg_getheaders_version;
190 static int hf_msg_headers_bits;
191 static int hf_msg_headers_count16;
192 static int hf_msg_headers_count32;
193 static int hf_msg_headers_count64;
194 static int hf_msg_headers_count8;
195 static int hf_msg_headers_merkle_root;
196 static int hf_msg_headers_nonce;
197 static int hf_msg_headers_prev_block;
198 static int hf_msg_headers_time;
199 static int hf_msg_headers_version;
200 static int hf_msg_inv_count16;
201 static int hf_msg_inv_count32;
202 static int hf_msg_inv_count64;
203 static int hf_msg_inv_count8;
204 static int hf_msg_inv_hash;
205 static int hf_msg_inv_type;
206 static int hf_msg_merkleblock_bits;
207 static int hf_msg_merkleblock_flags_data;
208 static int hf_msg_merkleblock_flags_size16;
209 static int hf_msg_merkleblock_flags_size32;
210 static int hf_msg_merkleblock_flags_size64;
211 static int hf_msg_merkleblock_flags_size8;
212 static int hf_msg_merkleblock_hashes_count16;
213 static int hf_msg_merkleblock_hashes_count32;
214 static int hf_msg_merkleblock_hashes_count64;
215 static int hf_msg_merkleblock_hashes_count8;
216 static int hf_msg_merkleblock_hashes_hash;
217 static int hf_msg_merkleblock_merkle_root;
218 static int hf_msg_merkleblock_nonce;
219 static int hf_msg_merkleblock_prev_block;
220 static int hf_msg_merkleblock_time;
221 static int hf_msg_merkleblock_transactions;
222 static int hf_msg_merkleblock_version;
223 static int hf_msg_notfound_count16;
224 static int hf_msg_notfound_count32;
225 static int hf_msg_notfound_count64;
226 static int hf_msg_notfound_count8;
227 static int hf_msg_notfound_hash;
228 static int hf_msg_notfound_type;
229 static int hf_msg_ping_nonce;
230 static int hf_msg_pong_nonce;
231 static int hf_msg_reject_ccode;
232 static int hf_msg_reject_data;
233 static int hf_msg_reject_message;
234 static int hf_msg_reject_reason;
235 static int hf_msg_sendcmpct_announce;
236 static int hf_msg_sendcmpct_version;
237 static int hf_msg_tx_in;
238 static int hf_msg_tx_in_count16;
239 static int hf_msg_tx_in_count32;
240 static int hf_msg_tx_in_count64;
241 static int hf_msg_tx_in_count8;
242 static int hf_msg_tx_in_prev_outp_hash;
243 static int hf_msg_tx_in_prev_outp_index;
244 static int hf_msg_tx_in_prev_output;
245 static int hf_msg_tx_in_script16;
246 static int hf_msg_tx_in_script32;
247 static int hf_msg_tx_in_script64;
248 static int hf_msg_tx_in_script8;
249 static int hf_msg_tx_in_seq;
250 static int hf_msg_tx_in_sig_script;
251 static int hf_msg_tx_lock_time;
252 static int hf_msg_tx_out;
253 static int hf_msg_tx_out_count16;
254 static int hf_msg_tx_out_count32;
255 static int hf_msg_tx_out_count64;
256 static int hf_msg_tx_out_count8;
257 static int hf_msg_tx_out_script;
258 static int hf_msg_tx_out_script16;
259 static int hf_msg_tx_out_script32;
260 static int hf_msg_tx_out_script64;
261 static int hf_msg_tx_out_script8;
262 static int hf_msg_tx_out_value;
263 static int hf_msg_tx_witness;
264 static int hf_msg_tx_witness_components16;
265 static int hf_msg_tx_witness_components32;
266 static int hf_msg_tx_witness_components64;
267 static int hf_msg_tx_witness_components8;
268 static int hf_msg_tx_witness_component;
269 static int hf_msg_tx_witness_component_length16;
270 static int hf_msg_tx_witness_component_length32;
271 static int hf_msg_tx_witness_component_length64;
272 static int hf_msg_tx_witness_component_length8;
273 static int hf_msg_tx_witness_component_data;
274 static int hf_msg_tx_version;
275 static int hf_msg_tx_flag;
276 static int hf_msg_version_addr_me;
277 static int hf_msg_version_addr_you;
278 static int hf_msg_version_nonce;
279 static int hf_msg_version_relay;
280 static int hf_msg_version_services;
281 static int hf_msg_version_start_height;
282 static int hf_msg_version_timestamp;
283 static int hf_msg_version_user_agent;
284 static int hf_msg_version_version;
285 static int hf_services_network;
286 static int hf_services_getutxo;
287 static int hf_services_bloom;
288 static int hf_services_witness;
289 static int hf_services_xthin;
290 static int hf_services_compactfilters;
291 static int hf_services_networklimited;
292 static int hf_services_p2pv2;
293 static int hf_string_value;
294 static int hf_string_varint_count16;
295 static int hf_string_varint_count32;
296 static int hf_string_varint_count64;
297 static int hf_string_varint_count8;
298
299 static int * const services_hf_flags[] = {
300 &hf_services_network,
301 &hf_services_getutxo,
302 &hf_services_bloom,
303 &hf_services_witness,
304 &hf_services_xthin,
305 &hf_services_compactfilters,
306 &hf_services_networklimited,
307 &hf_services_p2pv2,
308 NULL
309 };
310
311 static int ett_bitcoin;
312 static int ett_bitcoin_msg;
313 static int ett_services;
314 static int ett_address;
315 static int ett_string;
316 static int ett_addr_list;
317 static int ett_inv_list;
318 static int ett_getdata_list;
319 static int ett_notfound_list;
320 static int ett_getblocks_list;
321 static int ett_getheaders_list;
322 static int ett_tx_in_list;
323 static int ett_tx_in_outp;
324 static int ett_tx_out_list;
325 static int ett_tx_witness_list;
326 static int ett_tx_witness_component_list;
327
328 static expert_field ei_bitcoin_command_unknown;
329 static expert_field ei_bitcoin_address_length;
330 static expert_field ei_bitcoin_script_len;
331
332
333 static bool bitcoin_desegment = true;
334
335 static unsigned
336 get_bitcoin_pdu_length(packet_info *pinfo _U_, tvbuff_t *tvb,
337 int offset, void *data _U_)
338 {
339 uint32_t length;
340 length = BITCOIN_HEADER_LENGTH;
341
342 /* add payload length */
343 length += tvb_get_letohl(tvb, offset+16);
344
345 return length;
346 }
347
348 static void
349 format_feefilter_value(char *buf, int64_t value) {
350 snprintf(buf, ITEM_LABEL_LENGTH, "%.3f sat/B", ((double) value) / 1000);
351 }
352
353 /**
354 * Create a sub-tree and fill it with a net_addr structure
355 */
356 static proto_tree *
357 create_address_tree(tvbuff_t *tvb, proto_item *ti, uint32_t offset)
358 {
359 proto_tree *tree;
360
361 tree = proto_item_add_subtree(ti, ett_address);
362
363 /* services */
364 proto_tree_add_bitmask(tree, tvb, offset, hf_address_services,
365 ett_services, services_hf_flags, ENC_LITTLE_ENDIAN);
366 offset += 8;
367
368 /* IPv6 address */
369 proto_tree_add_item(tree, hf_address_address, tvb, offset, 16, ENC_NA);
370 offset += 16;
371
372 /* port */
373 proto_tree_add_item(tree, hf_address_port, tvb, offset, 2, ENC_BIG_ENDIAN);
374
375 return tree;
376 }
377
378 /**
379 * Extract a variable length integer from a tvbuff
380 */
381 static void
382 get_varint(tvbuff_t *tvb, const int offset, int *length, uint64_t *ret)
383 {
384 unsigned value;
385
386 /* Note: just throw an exception if not enough bytes are available in the tvbuff */
387
388 /* calculate variable length */
389 value = tvb_get_uint8(tvb, offset);
390 if (value < 0xfd)
391 {
392 *length = 1;
393 *ret = value;
394 return;
395 }
396
397 if (value == 0xfd)
398 {
399 *length = 3;
400 *ret = tvb_get_letohs(tvb, offset+1);
401 return;
402 }
403 if (value == 0xfe)
404 {
405 *length = 5;
406 *ret = tvb_get_letohl(tvb, offset+1);
407 return;
408 }
409
410 *length = 9;
411 *ret = tvb_get_letoh64(tvb, offset+1);
412 return;
413
414 }
415
416 static void add_varint_item(proto_tree *tree, tvbuff_t *tvb, const int offset, int length,
417 int hfi8, int hfi16, int hfi32, int hfi64)
418 {
419 switch (length)
420 {
421 case 1:
422 proto_tree_add_item(tree, hfi8, tvb, offset, 1, ENC_LITTLE_ENDIAN);
423 break;
424 case 3:
425 proto_tree_add_item(tree, hfi16, tvb, offset+1, 2, ENC_LITTLE_ENDIAN);
426 break;
427 case 5:
428 proto_tree_add_item(tree, hfi32, tvb, offset+1, 4, ENC_LITTLE_ENDIAN);
429 break;
430 case 9:
431 proto_tree_add_item(tree, hfi64, tvb, offset+1, 8, ENC_LITTLE_ENDIAN);
432 break;
433 }
434 }
435
436 static proto_tree *
437 create_string_tree(proto_tree *tree, int hfindex, tvbuff_t *tvb, uint32_t* offset)
438 {
439 proto_tree *subtree;
440 proto_item *ti;
441 int varint_length;
442 uint64_t varint;
443 int string_length;
444
445 /* First is the length of the following string as a varint */
446 get_varint(tvb, *offset, &varint_length, &varint);
447 string_length = (int) varint;
448
449 ti = proto_tree_add_item(tree, hfindex, tvb, *offset, varint_length + string_length, ENC_NA);
450 subtree = proto_item_add_subtree(ti, ett_string);
451
452 /* length */
453 add_varint_item(subtree, tvb, *offset, varint_length, hf_string_varint_count8,
454 hf_string_varint_count16, hf_string_varint_count32,
455 hf_string_varint_count64);
456 *offset += varint_length;
457
458 /* string */
459 proto_tree_add_item(subtree, hf_string_value, tvb, *offset, string_length,
460 ENC_ASCII);
461 *offset += string_length;
462
463 return subtree;
464 }
465
466 static proto_tree *
467 create_data_tree(proto_tree *tree, int hfindex, tvbuff_t *tvb, uint32_t* offset)
468 {
469 proto_tree *subtree;
470 proto_item *ti;
471 int varint_length;
472 uint64_t varint;
473 int data_length;
474
475 /* First is the length of the following string as a varint */
476 get_varint(tvb, *offset, &varint_length, &varint);
477 data_length = (int) varint;
478
479 ti = proto_tree_add_item(tree, hfindex, tvb, *offset, varint_length + data_length, ENC_NA);
480 subtree = proto_item_add_subtree(ti, ett_string);
481
482 /* length */
483 add_varint_item(subtree, tvb, *offset, varint_length, hf_data_varint_count8,
484 hf_data_varint_count16, hf_data_varint_count32,
485 hf_data_varint_count64);
486 *offset += varint_length;
487
488 /* data */
489 proto_tree_add_item(subtree, hf_data_value, tvb, *offset, data_length,
490 BASE_SHOW_UTF_8_PRINTABLE);
491 *offset += data_length;
492
493 return subtree;
494 }
495
496 /* Note: A number of the following message handlers include code of the form:
497 * ...
498 * uint64_t count;
499 * ...
500 * for (; count > 0; count--)
501 * {
502 * proto_tree_add_item9...);
503 * offset += ...;
504 * proto_tree_add_item9...);
505 * offset += ...;
506 * ...
507 * }
508 * ...
509 *
510 * Issue if 'count' is a very large number:
511 * If 'tree' is NULL, then the result will be effectively (but not really)
512 * an infinite loop. This is true because if 'tree' is NULL then
513 * proto_tree_add_item(tree, ...) is effectively a no-op and will not throw
514 * an exception.
515 * So: the loop should be executed only when 'tree' is defined so that the
516 * proto_ calls will throw an exception when the tvb is used up;
517 * This should only take a few-hundred loops at most.
518 * https://gitlab.com/wireshark/wireshark/-/issues/8312
519 */
520
521 /**
522 * Handler for version messages
523 */
524 static int
525 dissect_bitcoin_msg_version(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
526 {
527 proto_item *ti;
528 uint32_t version;
529 uint32_t offset = 0;
530
531 ti = proto_tree_add_item(tree, hf_bitcoin_msg_version, tvb, offset, -1, ENC_NA);
532 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
533
534 version = tvb_get_letohl(tvb, offset);
535
536 proto_tree_add_item(tree, hf_msg_version_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
537 offset += 4;
538
539 proto_tree_add_bitmask(tree, tvb, offset, hf_msg_version_services,
540 ett_services, services_hf_flags, ENC_LITTLE_ENDIAN);
541 offset += 8;
542
543 proto_tree_add_item(tree, hf_msg_version_timestamp, tvb, offset, 8, ENC_TIME_SECS_NSECS|ENC_LITTLE_ENDIAN);
544 offset += 8;
545
546 ti = proto_tree_add_item(tree, hf_msg_version_addr_you, tvb, offset, 26, ENC_NA);
547 create_address_tree(tvb, ti, offset);
548 offset += 26;
549
550 if (version >= 106)
551 {
552 ti = proto_tree_add_item(tree, hf_msg_version_addr_me, tvb, offset, 26, ENC_NA);
553 create_address_tree(tvb, ti, offset);
554 offset += 26;
555
556 proto_tree_add_item(tree, hf_msg_version_nonce, tvb, offset, 8, ENC_LITTLE_ENDIAN);
557 offset += 8;
558
559 create_string_tree(tree, hf_msg_version_user_agent, tvb, &offset);
560 }
561
562 if (version >= 209)
563 {
564 proto_tree_add_item(tree, hf_msg_version_start_height, tvb, offset, 4, ENC_LITTLE_ENDIAN);
565 offset += 4;
566 }
567
568 if (version >= 70002)
569 {
570 proto_tree_add_item(tree, hf_msg_version_relay, tvb, offset, 1, ENC_LITTLE_ENDIAN);
571 offset += 1;
572 }
573
574 return offset;
575 }
576
577 /**
578 * Handler for address messages
579 */
580 static int
581 dissect_bitcoin_msg_addr(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
582 {
583 proto_item *ti;
584 int length;
585 uint64_t count;
586 uint32_t offset = 0;
587
588 ti = proto_tree_add_item(tree, hf_bitcoin_msg_addr, tvb, offset, -1, ENC_NA);
589 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
590
591 get_varint(tvb, offset, &length, &count);
592 add_varint_item(tree, tvb, offset, length, hf_msg_addr_count8, hf_msg_addr_count16,
593 hf_msg_addr_count32, hf_msg_addr_count64);
594 offset += length;
595
596 for (; count > 0; count--)
597 {
598 proto_tree *subtree;
599
600 ti = proto_tree_add_item(tree, hf_msg_addr_address, tvb, offset, 30, ENC_NA);
601 subtree = create_address_tree(tvb, ti, offset+4);
602
603 proto_tree_add_item(subtree, hf_msg_addr_timestamp, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);
604 offset += 26;
605 offset += 4;
606 }
607
608 return offset;
609 }
610
611 /**
612 * Handler for addrv2 messages
613 */
614 static int
615 dissect_bitcoin_msg_addrv2(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
616 {
617 proto_item *ti;
618 int length;
619 uint64_t count;
620 int offset = 0;
621
622 ti = proto_tree_add_item(tree, hf_bitcoin_msg_addrv2, tvb, offset, -1, ENC_NA);
623 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
624
625 get_varint(tvb, offset, &length, &count);
626 add_varint_item(tree, tvb, offset, length, hf_msg_addrv2_count8, hf_msg_addrv2_count16,
627 hf_msg_addrv2_count32, hf_msg_addrv2_count64);
628 offset += length;
629
630 for (; count > 0; count--)
631 {
632 proto_item *sti;
633 proto_item *sti_services;
634 proto_tree *subtree;
635 uint64_t services;
636 uint8_t network;
637 uint64_t address_length;
638
639 sti = proto_tree_add_item(tree, hf_msg_addrv2_item, tvb, offset, -1, ENC_NA);
640 subtree = proto_item_add_subtree(sti, ett_addr_list);
641
642 proto_tree_add_item(subtree, hf_msg_addrv2_timestamp, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);
643 offset += 4;
644
645 get_varint(tvb, offset, &length, &services);
646 sti_services = proto_tree_add_bitmask_value(subtree, tvb, offset, hf_msg_addrv2_services,
647 ett_services, services_hf_flags, services);
648 proto_item_set_len(sti_services, length);
649 offset += length;
650
651 network = tvb_get_uint8(tvb, offset);
652 proto_tree_add_item(subtree, hf_msg_addrv2_network, tvb, offset, 1, ENC_LITTLE_ENDIAN);
653 offset += 1;
654
655 get_varint(tvb, offset, &length, &address_length);
656 offset += length;
657
658 switch (network)
659 {
660 case 1:
661 proto_tree_add_item(subtree, hf_msg_addrv2_address_ipv4, tvb, offset, (unsigned) address_length, ENC_NA);
662 if (address_length != 4) {
663 proto_tree_add_expert(subtree, pinfo, &ei_bitcoin_address_length,
664 tvb, offset, (unsigned) address_length);
665 }
666 break;
667
668 case 2:
669 proto_tree_add_item(subtree, hf_msg_addrv2_address_ipv6, tvb, offset, (unsigned) address_length, ENC_NA);
670 if (address_length != 16) {
671 proto_tree_add_expert(subtree, pinfo, &ei_bitcoin_address_length,
672 tvb, offset, (unsigned) address_length);
673 }
674 break;
675
676 default:
677 proto_tree_add_item(subtree, hf_msg_addrv2_address_other, tvb, offset, (unsigned) address_length, ENC_NA);
678 break;
679 }
680
681 /*
682 * The above should make sure that the addition won't overflow.
683 * XXX - but what if address length fits in an unsigned int but
684 * not a signed int?
685 */
686 offset += (int)address_length;
687
688 proto_tree_add_item(subtree, hf_msg_addrv2_port, tvb, offset, 2, ENC_BIG_ENDIAN);
689 offset += 2;
690
691 proto_item_set_end(sti, tvb, offset);
692 }
693
694 return offset;
695 }
696
697 /**
698 * Handler for inventory messages
699 */
700 static int
701 dissect_bitcoin_msg_inv(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
702 {
703 proto_item *ti;
704 int length;
705 uint64_t count;
706 uint32_t offset = 0;
707
708 ti = proto_tree_add_item(tree, hf_bitcoin_msg_inv, tvb, offset, -1, ENC_NA);
709 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
710
711 get_varint(tvb, offset, &length, &count);
712 add_varint_item(tree, tvb, offset, length, hf_msg_inv_count8, hf_msg_inv_count16,
713 hf_msg_inv_count32, hf_msg_inv_count64);
714
715 offset += length;
716
717 for (; count > 0; count--)
718 {
719 proto_tree *subtree;
720
721 subtree = proto_tree_add_subtree(tree, tvb, offset, 36, ett_inv_list, NULL, "Inventory vector");
722
723 proto_tree_add_item(subtree, hf_msg_inv_type, tvb, offset, 4, ENC_LITTLE_ENDIAN);
724 offset += 4;
725
726 proto_tree_add_item(subtree, hf_msg_inv_hash, tvb, offset, 32, ENC_NA);
727 offset += 32;
728 }
729
730 return offset;
731 }
732
733 /**
734 * Handler for getdata messages
735 */
736 static int
737 dissect_bitcoin_msg_getdata(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
738 {
739 proto_item *ti;
740 int length;
741 uint64_t count;
742 uint32_t offset = 0;
743
744 ti = proto_tree_add_item(tree, hf_bitcoin_msg_getdata, tvb, offset, -1, ENC_NA);
745 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
746
747 get_varint(tvb, offset, &length, &count);
748 add_varint_item(tree, tvb, offset, length, hf_msg_getdata_count8, hf_msg_getdata_count16,
749 hf_msg_getdata_count32, hf_msg_getdata_count64);
750
751 offset += length;
752
753 for (; count > 0; count--)
754 {
755 proto_tree *subtree;
756
757 subtree = proto_tree_add_subtree(tree, tvb, offset, 36, ett_getdata_list, NULL, "Inventory vector");
758
759 proto_tree_add_item(subtree, hf_msg_getdata_type, tvb, offset, 4, ENC_LITTLE_ENDIAN);
760 offset += 4;
761
762 proto_tree_add_item(subtree, hf_msg_getdata_hash, tvb, offset, 32, ENC_NA);
763 offset += 32;
764 }
765
766 return offset;
767 }
768
769 /**
770 * Handler for notfound messages
771 */
772 static int
773 dissect_bitcoin_msg_notfound(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
774 {
775 proto_item *ti;
776 int length;
777 uint64_t count;
778 uint32_t offset = 0;
779
780 ti = proto_tree_add_item(tree, hf_bitcoin_msg_notfound, tvb, offset, -1, ENC_NA);
781 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
782
783 get_varint(tvb, offset, &length, &count);
784 add_varint_item(tree, tvb, offset, length, hf_msg_notfound_count8, hf_msg_notfound_count16,
785 hf_msg_notfound_count32, hf_msg_notfound_count64);
786
787 offset += length;
788
789 for (; count > 0; count--)
790 {
791 proto_tree *subtree;
792
793 subtree = proto_tree_add_subtree(tree, tvb, offset, 36, ett_notfound_list, NULL, "Inventory vector");
794
795 proto_tree_add_item(subtree, hf_msg_notfound_type, tvb, offset, 4, ENC_LITTLE_ENDIAN);
796 offset += 4;
797
798 proto_tree_add_item(subtree, hf_msg_notfound_hash, tvb, offset, 32, ENC_NA);
799 offset += 32;
800 }
801
802 return offset;
803 }
804
805 /**
806 * Handler for getblocks messages
807 */
808 static int
809 dissect_bitcoin_msg_getblocks(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
810 {
811 proto_item *ti;
812 int length;
813 uint64_t count;
814 uint32_t offset = 0;
815
816 ti = proto_tree_add_item(tree, hf_bitcoin_msg_getblocks, tvb, offset, -1, ENC_NA);
817 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
818
819 /* why the protocol version is sent here nobody knows */
820 proto_tree_add_item(tree, hf_msg_version_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
821 offset += 4;
822
823 get_varint(tvb, offset, &length, &count);
824 add_varint_item(tree, tvb, offset, length, hf_msg_getblocks_count8, hf_msg_getblocks_count16,
825 hf_msg_getblocks_count32, hf_msg_getblocks_count64);
826
827 offset += length;
828
829 for (; count > 0; count--)
830 {
831 proto_tree_add_item(tree, hf_msg_getblocks_start, tvb, offset, 32, ENC_NA);
832 offset += 32;
833 }
834
835 proto_tree_add_item(tree, hf_msg_getblocks_stop, tvb, offset, 32, ENC_NA);
836 offset += 32;
837
838 return offset;
839 }
840
841 /**
842 * Handler for getheaders messages
843 * UNTESTED
844 */
845 static int
846 dissect_bitcoin_msg_getheaders(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
847 {
848 proto_item *ti;
849 int length;
850 uint64_t count;
851 uint32_t offset = 0;
852
853 ti = proto_tree_add_item(tree, hf_bitcoin_msg_getheaders, tvb, offset, -1, ENC_NA);
854 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
855
856 proto_tree_add_item(tree, hf_msg_headers_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
857 offset += 4;
858
859 get_varint(tvb, offset, &length, &count);
860 add_varint_item(tree, tvb, offset, length, hf_msg_getheaders_count8, hf_msg_getheaders_count16,
861 hf_msg_getheaders_count32, hf_msg_getheaders_count64);
862
863 offset += length;
864
865 for (; count > 0; count--)
866 {
867 proto_tree_add_item(tree, hf_msg_getheaders_start, tvb, offset, 32, ENC_NA);
868 offset += 32;
869 }
870
871 proto_tree_add_item(tree, hf_msg_getheaders_stop, tvb, offset, 32, ENC_NA);
872 offset += 32;
873
874 return offset;
875 }
876
877 /**
878 * Handler for tx message body
879 */
880 static uint32_t
881 dissect_bitcoin_msg_tx_common(tvbuff_t *tvb, uint32_t offset, packet_info *pinfo, proto_tree *tree, unsigned msgnum)
882 {
883 proto_item *rti;
884 int count_length;
885 uint64_t in_count;
886 uint64_t out_count;
887
888 if (msgnum == 0) {
889 rti = proto_tree_add_item(tree, hf_bitcoin_msg_tx, tvb, offset, -1, ENC_NA);
890 } else {
891 rti = proto_tree_add_none_format(tree, hf_bitcoin_msg_tx, tvb, offset, -1, "Tx message [ %4d ]", msgnum);
892 }
893 tree = proto_item_add_subtree(rti, ett_bitcoin_msg);
894
895 proto_tree_add_item(tree, hf_msg_tx_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
896 offset += 4;
897
898 /* If present, "flag" always starts with 0x00. */
899 /* Otherwise we proceed straight to "in_count". */
900 uint8_t flag = tvb_get_uint8(tvb, offset);
901 if (flag == 0) {
902 proto_tree_add_item(tree, hf_msg_tx_flag, tvb, offset, 2, ENC_NA);
903 offset += 2;
904 }
905
906 /* TxIn[] */
907 get_varint(tvb, offset, &count_length, &in_count);
908 add_varint_item(tree, tvb, offset, count_length, hf_msg_tx_in_count8, hf_msg_tx_in_count16,
909 hf_msg_tx_in_count32, hf_msg_tx_in_count64);
910
911 offset += count_length;
912
913 /* TxIn
914 * [36] previous_output outpoint
915 * [1+] script length var_int
916 * [ ?] signature script uchar[]
917 * [ 4] sequence uint32_t
918 *
919 * outpoint (aka previous output)
920 * [32] hash char[32
921 * [ 4] index uint32_t
922 *
923 */
924 for (uint64_t idx = 0; idx < in_count; idx++)
925 {
926 proto_tree *subtree;
927 proto_tree *prevtree;
928 proto_item *ti;
929 proto_item *pti;
930 uint64_t script_length;
931 uint32_t scr_len_offset;
932
933 scr_len_offset = offset+36;
934 get_varint(tvb, scr_len_offset, &count_length, &script_length);
935
936 /* A funny script_length won't cause an exception since the field type is FT_NONE */
937 ti = proto_tree_add_item(tree, hf_msg_tx_in, tvb, offset,
938 36 + count_length + (unsigned)script_length + 4, ENC_NA);
939 subtree = proto_item_add_subtree(ti, ett_tx_in_list);
940
941 /* previous output */
942 pti = proto_tree_add_item(subtree, hf_msg_tx_in_prev_output, tvb, offset, 36, ENC_NA);
943 prevtree = proto_item_add_subtree(pti, ett_tx_in_outp);
944
945 proto_tree_add_item(prevtree, hf_msg_tx_in_prev_outp_hash, tvb, offset, 32, ENC_NA);
946 offset += 32;
947
948 proto_tree_add_item(prevtree, hf_msg_tx_in_prev_outp_index, tvb, offset, 4, ENC_LITTLE_ENDIAN);
949 offset += 4;
950 /* end previous output */
951
952 add_varint_item(subtree, tvb, offset, count_length, hf_msg_tx_in_script8, hf_msg_tx_in_script16,
953 hf_msg_tx_in_script32, hf_msg_tx_in_script64);
954
955 offset += count_length;
956
957 if ((offset + script_length) > INT_MAX) {
958 proto_tree_add_expert(tree, pinfo, &ei_bitcoin_script_len,
959 tvb, scr_len_offset, count_length);
960 return INT_MAX;
961 }
962
963 proto_tree_add_item(subtree, hf_msg_tx_in_sig_script, tvb, offset, (unsigned)script_length, ENC_NA);
964 offset += (unsigned)script_length;
965
966 proto_tree_add_item(subtree, hf_msg_tx_in_seq, tvb, offset, 4, ENC_LITTLE_ENDIAN);
967 offset += 4;
968 }
969
970 /* TxOut[] */
971 get_varint(tvb, offset, &count_length, &out_count);
972 add_varint_item(tree, tvb, offset, count_length, hf_msg_tx_out_count8, hf_msg_tx_out_count16,
973 hf_msg_tx_out_count32, hf_msg_tx_out_count64);
974
975 offset += count_length;
976
977 /* TxOut
978 * [ 8] value
979 * [1+] script length [var_int]
980 * [ ?] script
981 */
982 for (; out_count > 0; out_count--)
983 {
984 proto_item *ti;
985 proto_tree *subtree;
986 uint64_t script_length;
987 uint32_t scr_len_offset;
988
989 scr_len_offset = offset+8;
990 get_varint(tvb, scr_len_offset, &count_length, &script_length);
991
992 /* A funny script_length won't cause an exception since the field type is FT_NONE */
993 ti = proto_tree_add_item(tree, hf_msg_tx_out, tvb, offset,
994 8 + count_length + (unsigned)script_length , ENC_NA);
995 subtree = proto_item_add_subtree(ti, ett_tx_out_list);
996
997 proto_tree_add_item(subtree, hf_msg_tx_out_value, tvb, offset, 8, ENC_LITTLE_ENDIAN);
998 offset += 8;
999
1000 add_varint_item(subtree, tvb, offset, count_length, hf_msg_tx_out_script8, hf_msg_tx_out_script16,
1001 hf_msg_tx_out_script32, hf_msg_tx_out_script64);
1002
1003 offset += count_length;
1004
1005 if ((offset + script_length) > INT_MAX) {
1006 proto_tree_add_expert(tree, pinfo, &ei_bitcoin_script_len,
1007 tvb, scr_len_offset, count_length);
1008 return INT_MAX;
1009 }
1010
1011 proto_tree_add_item(subtree, hf_msg_tx_out_script, tvb, offset, (unsigned)script_length, ENC_NA);
1012 offset += (unsigned)script_length;
1013 }
1014
1015 if (flag == 0) {
1016 /* TxWitness
1017 */
1018 for (; in_count > 0; in_count--)
1019 {
1020 proto_item *ti;
1021 proto_tree *subtree;
1022
1023 ti = proto_tree_add_item(tree, hf_msg_tx_witness, tvb, offset, -1, ENC_NA);
1024 subtree = proto_item_add_subtree(ti, ett_tx_witness_list);
1025
1026 // count of witness data components
1027 int component_count_length;
1028 uint64_t component_count;
1029
1030 get_varint(tvb, offset, &component_count_length, &component_count);
1031 add_varint_item(subtree, tvb, offset, component_count_length, hf_msg_tx_witness_components8,
1032 hf_msg_tx_witness_components16, hf_msg_tx_witness_components32,
1033 hf_msg_tx_witness_components64);
1034 offset += component_count_length;
1035
1036 for (; component_count > 0; component_count--)
1037 {
1038 proto_item *subti;
1039 proto_tree *subsubtree;
1040
1041 int component_size_length;
1042 uint64_t component_size;
1043
1044 get_varint(tvb, offset, &component_size_length, &component_size);
1045
1046 subti = proto_tree_add_item(subtree, hf_msg_tx_witness_component, tvb, offset,
1047 component_size_length + (int) component_size, ENC_NA);
1048 subsubtree = proto_item_add_subtree(subti, ett_tx_witness_component_list);
1049
1050 add_varint_item(subsubtree, tvb, offset, component_size_length, hf_msg_tx_witness_component_length8,
1051 hf_msg_tx_witness_component_length16, hf_msg_tx_witness_component_length32,
1052 hf_msg_tx_witness_component_length64);
1053 offset += component_size_length;
1054
1055 proto_tree_add_item(subsubtree, hf_msg_tx_witness_component_data, tvb, offset, (int) component_size, ENC_NA);
1056 offset += (uint32_t)component_size;
1057 }
1058
1059 proto_item_set_end(ti, tvb, offset);
1060 }
1061 }
1062
1063 proto_tree_add_item(tree, hf_msg_tx_lock_time, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1064 offset += 4;
1065
1066 /* needed for block nesting */
1067 proto_item_set_len(rti, offset);
1068
1069 return offset;
1070 }
1071
1072 /**
1073 * Handler for tx message
1074 */
1075 static int
1076 dissect_bitcoin_msg_tx(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
1077 {
1078 return dissect_bitcoin_msg_tx_common(tvb, 0, pinfo, tree, 0);
1079 }
1080
1081
1082 /**
1083 * Handler for block messages
1084 */
1085 static int
1086 dissect_bitcoin_msg_block(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
1087 {
1088 proto_item *ti;
1089 int length;
1090 uint64_t count;
1091 unsigned msgnum;
1092 uint32_t offset = 0;
1093
1094 /* Block
1095 * [ 4] version uint32_t
1096 * [32] prev_block char[32]
1097 * [32] merkle_root char[32]
1098 * [ 4] timestamp uint32_t A unix timestamp ... (Currently limited to dates before the year 2106!)
1099 * [ 4] bits uint32_t
1100 * [ 4] nonce uint32_t
1101 * [ ?] txn_count var_int
1102 * [ ?] txns tx[] Block transactions, in format of "tx" command
1103 */
1104
1105 ti = proto_tree_add_item(tree, hf_bitcoin_msg_block, tvb, offset, -1, ENC_NA);
1106 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
1107
1108 proto_tree_add_item(tree, hf_msg_block_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1109 offset += 4;
1110
1111 proto_tree_add_item(tree, hf_msg_block_prev_block, tvb, offset, 32, ENC_NA);
1112 offset += 32;
1113
1114 proto_tree_add_item(tree, hf_msg_block_merkle_root, tvb, offset, 32, ENC_NA);
1115 offset += 32;
1116
1117 proto_tree_add_item(tree, hf_msg_block_time, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);
1118 offset += 4;
1119
1120 proto_tree_add_item(tree, hf_msg_block_bits, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1121 offset += 4;
1122
1123 proto_tree_add_item(tree, hf_msg_block_nonce, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1124 offset += 4;
1125
1126 get_varint(tvb, offset, &length, &count);
1127 add_varint_item(tree, tvb, offset, length, hf_msg_block_transactions8, hf_msg_block_transactions16,
1128 hf_msg_block_transactions32, hf_msg_block_transactions64);
1129
1130 offset += length;
1131
1132 msgnum = 0;
1133 for (; count>0 && offset<INT_MAX; count--)
1134 {
1135 msgnum += 1;
1136 offset = dissect_bitcoin_msg_tx_common(tvb, offset, pinfo, tree, msgnum);
1137 }
1138
1139 return offset;
1140 }
1141
1142 /**
1143 * Handler for headers messages
1144 */
1145 static int
1146 dissect_bitcoin_msg_headers(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
1147 {
1148 proto_item *ti;
1149 int length;
1150 uint64_t count;
1151 uint32_t offset = 0;
1152
1153 ti = proto_tree_add_item(tree, hf_bitcoin_msg_headers, tvb, offset, -1, ENC_NA);
1154 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
1155
1156 get_varint(tvb, offset, &length, &count);
1157 add_varint_item(tree, tvb, offset, length, hf_msg_headers_count8, hf_msg_headers_count16,
1158 hf_msg_headers_count32, hf_msg_headers_count64);
1159
1160 offset += length;
1161
1162 for (; count > 0; count--)
1163 {
1164 proto_tree *subtree;
1165 uint64_t txcount;
1166
1167 subtree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_bitcoin_msg, NULL, "Header");
1168
1169 proto_tree_add_item(subtree, hf_msg_headers_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1170 offset += 4;
1171
1172 proto_tree_add_item(subtree, hf_msg_headers_prev_block, tvb, offset, 32, ENC_NA);
1173 offset += 32;
1174
1175 proto_tree_add_item(subtree, hf_msg_headers_merkle_root, tvb, offset, 32, ENC_NA);
1176 offset += 32;
1177
1178 proto_tree_add_item(subtree, hf_msg_headers_time, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);
1179 offset += 4;
1180
1181 proto_tree_add_item(subtree, hf_msg_headers_bits, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1182 offset += 4;
1183
1184 proto_tree_add_item(subtree, hf_msg_headers_nonce, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1185 offset += 4;
1186
1187 get_varint(tvb, offset, &length, &txcount);
1188
1189 add_varint_item(subtree, tvb, offset, length, hf_msg_headers_count8, hf_msg_headers_count16,
1190 hf_msg_headers_count32, hf_msg_headers_count64);
1191
1192 offset += length;
1193
1194 proto_item_set_len(subtree, 80 + length);
1195 }
1196
1197 return offset;
1198 }
1199
1200 /**
1201 * Handler for ping messages
1202 */
1203 static int
1204 dissect_bitcoin_msg_ping(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
1205 {
1206 proto_item *ti;
1207 uint32_t offset = 0;
1208
1209 ti = proto_tree_add_item(tree, hf_bitcoin_msg_ping, tvb, offset, -1, ENC_NA);
1210 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
1211
1212 proto_tree_add_item(tree, hf_msg_ping_nonce, tvb, offset, 8, ENC_LITTLE_ENDIAN);
1213 offset += 8;
1214
1215 return offset;
1216 }
1217
1218 /**
1219 * Handler for pong messages
1220 */
1221 static int
1222 dissect_bitcoin_msg_pong(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
1223 {
1224 proto_item *ti;
1225 uint32_t offset = 0;
1226
1227 ti = proto_tree_add_item(tree, hf_bitcoin_msg_pong, tvb, offset, -1, ENC_NA);
1228 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
1229
1230 proto_tree_add_item(tree, hf_msg_pong_nonce, tvb, offset, 8, ENC_LITTLE_ENDIAN);
1231 offset += 8;
1232
1233 return offset;
1234 }
1235
1236 /**
1237 * Handler for reject messages
1238 */
1239 static int
1240 dissect_bitcoin_msg_reject(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
1241 {
1242 proto_item *ti;
1243 uint32_t offset = 0;
1244
1245 ti = proto_tree_add_item(tree, hf_bitcoin_msg_reject, tvb, offset, -1, ENC_NA);
1246 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
1247
1248 create_string_tree(tree, hf_msg_reject_message, tvb, &offset);
1249
1250 proto_tree_add_item(tree, hf_msg_reject_ccode, tvb, offset, 1, ENC_LITTLE_ENDIAN);
1251 offset += 1;
1252
1253 create_string_tree(tree, hf_msg_reject_reason, tvb, &offset);
1254
1255 if ((tvb_reported_length(tvb) - offset) > 0)
1256 {
1257 proto_tree_add_item(tree, hf_msg_reject_data, tvb, offset, tvb_reported_length(tvb) - offset, ENC_NA);
1258 }
1259
1260 return offset;
1261 }
1262
1263 /**
1264 * Handler for feefilter messages
1265 */
1266 static int
1267 dissect_bitcoin_msg_feefilter(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
1268 {
1269 proto_item *ti;
1270 uint32_t offset = 0;
1271
1272 ti = proto_tree_add_item(tree, hf_bitcoin_msg_feefilter, tvb, offset, -1, ENC_NA);
1273 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
1274
1275 proto_tree_add_item(tree, hf_msg_feefilter_value, tvb, offset, 8, ENC_LITTLE_ENDIAN);
1276 offset += 8;
1277
1278 return offset;
1279 }
1280
1281 /**
1282 * Handler for filterload messages
1283 */
1284 static int
1285 dissect_bitcoin_msg_filterload(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
1286 {
1287 proto_item *ti;
1288 uint32_t offset = 0;
1289
1290 ti = proto_tree_add_item(tree, hf_bitcoin_msg_filterload, tvb, offset, -1, ENC_NA);
1291 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
1292
1293 create_data_tree(tree, hf_msg_filterload_filter, tvb, &offset);
1294
1295 proto_tree_add_item(tree, hf_msg_filterload_nhashfunc, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1296 offset += 4;
1297
1298 proto_tree_add_item(tree, hf_msg_filterload_ntweak, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1299 offset += 4;
1300
1301 proto_tree_add_item(tree, hf_msg_filterload_nflags, tvb, offset, 1, ENC_LITTLE_ENDIAN);
1302 offset += 1;
1303
1304 return offset;
1305 }
1306
1307 /**
1308 * Handler for filteradd messages
1309 */
1310 static int
1311 dissect_bitcoin_msg_filteradd(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
1312 {
1313 proto_item *ti;
1314 uint32_t offset = 0;
1315
1316 ti = proto_tree_add_item(tree, hf_bitcoin_msg_filteradd, tvb, offset, -1, ENC_NA);
1317 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
1318
1319 create_data_tree(tree, hf_msg_filteradd_data, tvb, &offset);
1320
1321 return offset;
1322 }
1323
1324 /**
1325 * Handler for merkleblock messages
1326 */
1327
1328 static int
1329 dissect_bitcoin_msg_merkleblock(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
1330 {
1331 proto_item *ti;
1332 proto_item *subtree;
1333 int length;
1334 uint64_t count;
1335 uint32_t offset = 0;
1336
1337 ti = proto_tree_add_item(tree, hf_bitcoin_msg_merkleblock, tvb, offset, -1, ENC_NA);
1338 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
1339
1340 proto_tree_add_item(tree, hf_msg_merkleblock_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1341 offset += 4;
1342
1343 proto_tree_add_item(tree, hf_msg_merkleblock_prev_block, tvb, offset, 32, ENC_NA);
1344 offset += 32;
1345
1346 proto_tree_add_item(tree, hf_msg_merkleblock_merkle_root, tvb, offset, 32, ENC_NA);
1347 offset += 32;
1348
1349 proto_tree_add_item(tree, hf_msg_merkleblock_time, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN);
1350 offset += 4;
1351
1352 proto_tree_add_item(tree, hf_msg_merkleblock_bits, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1353 offset += 4;
1354
1355 proto_tree_add_item(tree, hf_msg_merkleblock_nonce, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1356 offset += 4;
1357
1358 proto_tree_add_item(tree, hf_msg_merkleblock_transactions, tvb, offset, 4, ENC_LITTLE_ENDIAN);
1359 offset += 4;
1360
1361 get_varint(tvb, offset, &length, &count);
1362
1363 subtree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_bitcoin_msg, NULL, "Hashes");
1364
1365 add_varint_item(subtree, tvb, offset, length, hf_msg_merkleblock_hashes_count8, hf_msg_merkleblock_hashes_count16,
1366 hf_msg_merkleblock_hashes_count32, hf_msg_merkleblock_hashes_count64);
1367 offset += length;
1368
1369 for (; count > 0; count--)
1370 {
1371 proto_tree_add_item(subtree, hf_msg_merkleblock_hashes_hash, tvb, offset, 32, ENC_NA);
1372 offset += 32;
1373 }
1374
1375 get_varint(tvb, offset, &length, &count);
1376
1377 subtree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_bitcoin_msg, NULL, "Flags");
1378
1379 add_varint_item(subtree, tvb, offset, length, hf_msg_merkleblock_flags_size8, hf_msg_merkleblock_flags_size16,
1380 hf_msg_merkleblock_flags_size32, hf_msg_merkleblock_flags_size64);
1381 offset += length;
1382
1383 /* The cast to unsigned is save because bitcoin messages are always smaller than 0x02000000 bytes. */
1384 proto_tree_add_item(subtree, hf_msg_merkleblock_flags_data, tvb, offset, (unsigned)count, BASE_SHOW_UTF_8_PRINTABLE);
1385 offset += (uint32_t)count;
1386
1387 return offset;
1388 }
1389
1390 /**
1391 * Handler for sendcmpct messages
1392 */
1393
1394 static int
1395 dissect_bitcoin_msg_sendcmpct(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, void *data _U_)
1396 {
1397 proto_item *ti;
1398 uint32_t offset = 0;
1399
1400 ti = proto_tree_add_item(tree, hf_bitcoin_msg_sendcmpct, tvb, offset, -1, ENC_NA);
1401 tree = proto_item_add_subtree(ti, ett_bitcoin_msg);
1402
1403 proto_tree_add_item(tree, hf_msg_sendcmpct_announce, tvb, offset, 1, ENC_NA);
1404 offset += 1;
1405
1406 proto_tree_add_item(tree, hf_msg_sendcmpct_version, tvb, offset, 8, ENC_LITTLE_ENDIAN);
1407 offset += 8;
1408
1409 return offset;
1410 }
1411
1412 /**
1413 * Handler for unimplemented or payload-less messages
1414 */
1415 static int
1416 dissect_bitcoin_msg_empty(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree _U_, void *data _U_)
1417 {
1418 return tvb_captured_length(tvb);
1419 }
1420
1421 static int dissect_bitcoin_tcp_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
1422 {
1423 proto_item *ti;
1424 uint32_t offset = 0;
1425 const uint8_t* command;
1426 dissector_handle_t command_handle;
1427
1428 col_set_str(pinfo->cinfo, COL_PROTOCOL, "Bitcoin");
1429
1430 ti = proto_tree_add_item(tree, proto_bitcoin, tvb, 0, -1, ENC_NA);
1431 tree = proto_item_add_subtree(ti, ett_bitcoin);
1432
1433 /* add basic protocol data */
1434 proto_tree_add_item(tree, hf_bitcoin_magic, tvb, 0, 4, ENC_BIG_ENDIAN);
1435 proto_tree_add_item_ret_string(tree, hf_bitcoin_command, tvb, 4, 12, ENC_ASCII|ENC_NA, pinfo->pool, &command);
1436 proto_tree_add_item(tree, hf_bitcoin_length, tvb, 16, 4, ENC_LITTLE_ENDIAN);
1437 proto_tree_add_checksum(tree, tvb, 20, hf_bitcoin_checksum, -1, NULL, pinfo, 0, ENC_BIG_ENDIAN, PROTO_CHECKSUM_NO_FLAGS);
1438
1439 offset = 24;
1440
1441 command_handle = dissector_get_string_handle(bitcoin_command_table, command);
1442 if (command_handle != NULL)
1443 {
1444 /* handle command specific message part */
1445 tvbuff_t *tvb_sub;
1446
1447 col_append_sep_str(pinfo->cinfo, COL_INFO, ", ", command);
1448 tvb_sub = tvb_new_subset_remaining(tvb, offset);
1449 call_dissector(command_handle, tvb_sub, pinfo, tree);
1450 }
1451 else
1452 {
1453 /* no handler found */
1454 col_append_sep_str(pinfo->cinfo, COL_INFO, ", ", "[unknown command]");
1455
1456 expert_add_info(pinfo, ti, &ei_bitcoin_command_unknown);
1457 }
1458
1459 return tvb_reported_length(tvb);
1460 }
1461
1462 static int
1463 dissect_bitcoin(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
1464 {
1465 col_clear(pinfo->cinfo, COL_INFO);
1466 tcp_dissect_pdus(tvb, pinfo, tree, bitcoin_desegment, BITCOIN_HEADER_LENGTH,
1467 get_bitcoin_pdu_length, dissect_bitcoin_tcp_pdu, data);
1468
1469 return tvb_reported_length(tvb);
1470 }
1471
1472 static bool
1473 dissect_bitcoin_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
1474 {
1475 uint32_t magic_number;
1476 conversation_t *conversation;
1477
1478 if (tvb_captured_length(tvb) < 4)
1479 return false;
1480
1481 magic_number = tvb_get_letohl(tvb, 0);
1482 if ((magic_number != BITCOIN_MAIN_MAGIC_NUMBER) &&
1483 (magic_number != BITCOIN_TESTNET_MAGIC_NUMBER) &&
1484 (magic_number != BITCOIN_TESTNET3_MAGIC_NUMBER))
1485 return false;
1486
1487 /* Ok: This connection should always use the bitcoin dissector */
1488 conversation = find_or_create_conversation(pinfo);
1489 conversation_set_dissector(conversation, bitcoin_handle);
1490
1491 dissect_bitcoin(tvb, pinfo, tree, data);
1492 return true;
1493 }
1494
1495 void
1496 proto_register_bitcoin(void)
1497 {
1498 static hf_register_info hf[] = {
1499 { &hf_bitcoin_magic,
1500 { "Packet magic", "bitcoin.magic",
1501 FT_UINT32, BASE_HEX, NULL, 0x0,
1502 NULL, HFILL }
1503 },
1504 { &hf_bitcoin_command,
1505 { "Command name", "bitcoin.command",
1506 FT_STRING, BASE_NONE, NULL, 0x0,
1507 NULL, HFILL }
1508 },
1509 { &hf_bitcoin_length,
1510 { "Payload Length", "bitcoin.length",
1511 FT_UINT32, BASE_DEC, NULL, 0x0,
1512 NULL, HFILL }
1513 },
1514 { &hf_bitcoin_checksum,
1515 { "Payload checksum", "bitcoin.checksum",
1516 FT_UINT32, BASE_HEX, NULL, 0x0,
1517 NULL, HFILL }
1518 },
1519 { &hf_bitcoin_msg_version,
1520 { "Version message", "bitcoin.version",
1521 FT_NONE, BASE_NONE, NULL, 0x0,
1522 NULL, HFILL }
1523 },
1524 { &hf_msg_version_version,
1525 { "Protocol version", "bitcoin.version.version",
1526 FT_UINT32, BASE_DEC, NULL, 0x0,
1527 NULL, HFILL }
1528 },
1529 { &hf_msg_version_services,
1530 { "Node services", "bitcoin.version.services",
1531 FT_UINT64, BASE_HEX, NULL, 0x0,
1532 NULL, HFILL }
1533 },
1534 { &hf_msg_version_timestamp,
1535 { "Node timestamp", "bitcoin.version.timestamp",
1536 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
1537 NULL, HFILL }
1538 },
1539 { &hf_msg_version_addr_me,
1540 { "Address of emitting node", "bitcoin.version.addr_me",
1541 FT_NONE, BASE_NONE, NULL, 0x0,
1542 NULL, HFILL }
1543 },
1544 { &hf_msg_version_addr_you,
1545 { "Address as receiving node", "bitcoin.version.addr_you",
1546 FT_NONE, BASE_NONE, NULL, 0x0,
1547 NULL, HFILL }
1548 },
1549 { &hf_msg_version_nonce,
1550 { "Random nonce", "bitcoin.version.nonce",
1551 FT_UINT64, BASE_HEX, NULL, 0x0,
1552 NULL, HFILL }
1553 },
1554 { &hf_msg_version_user_agent,
1555 { "User agent", "bitcoin.version.user_agent",
1556 FT_NONE, BASE_NONE, NULL, 0x0,
1557 NULL, HFILL }
1558 },
1559 { &hf_msg_version_start_height,
1560 { "Block start height", "bitcoin.version.start_height",
1561 FT_UINT32, BASE_DEC, NULL, 0x0,
1562 NULL, HFILL }
1563 },
1564 { &hf_msg_version_relay,
1565 { "Relay flag", "bitcoin.version.relay",
1566 FT_UINT8, BASE_DEC, NULL, 0x0,
1567 NULL, HFILL }
1568 },
1569 { &hf_msg_addr_count8,
1570 { "Count", "bitcoin.addr.count",
1571 FT_UINT8, BASE_DEC, NULL, 0x0,
1572 NULL, HFILL }
1573 },
1574 { &hf_msg_addr_count16,
1575 { "Count", "bitcoin.addr.count",
1576 FT_UINT16, BASE_DEC, NULL, 0x0,
1577 NULL, HFILL }
1578 },
1579 { &hf_msg_addr_count32,
1580 { "Count", "bitcoin.addr.count",
1581 FT_UINT32, BASE_DEC, NULL, 0x0,
1582 NULL, HFILL }
1583 },
1584 { &hf_msg_addr_count64,
1585 { "Count", "bitcoin.addr.count64",
1586 FT_UINT64, BASE_DEC, NULL, 0x0,
1587 NULL, HFILL }
1588 },
1589 { &hf_bitcoin_msg_addr,
1590 { "Address message", "bitcoin.addr",
1591 FT_NONE, BASE_NONE, NULL, 0x0,
1592 NULL, HFILL }
1593 },
1594 { &hf_msg_addr_address,
1595 { "Address", "bitcoin.addr.address",
1596 FT_BYTES, BASE_NONE, NULL, 0x0,
1597 NULL, HFILL }
1598 },
1599 { &hf_msg_addr_timestamp,
1600 { "Address timestamp", "bitcoin.addr.timestamp",
1601 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
1602 NULL, HFILL }
1603 },
1604 { &hf_msg_addrv2_count8,
1605 { "Count", "bitcoin.addrv2.count",
1606 FT_UINT8, BASE_DEC, NULL, 0x0,
1607 NULL, HFILL }
1608 },
1609 { &hf_msg_addrv2_count16,
1610 { "Count", "bitcoin.addrv2.count",
1611 FT_UINT16, BASE_DEC, NULL, 0x0,
1612 NULL, HFILL }
1613 },
1614 { &hf_msg_addrv2_count32,
1615 { "Count", "bitcoin.addrv2.count",
1616 FT_UINT32, BASE_DEC, NULL, 0x0,
1617 NULL, HFILL }
1618 },
1619 { &hf_msg_addrv2_count64,
1620 { "Count", "bitcoin.addrv2.count64",
1621 FT_UINT64, BASE_DEC, NULL, 0x0,
1622 NULL, HFILL }
1623 },
1624 { &hf_msg_addrv2_item,
1625 { "Address", "bitcoin.addrv2.item",
1626 FT_NONE, BASE_NONE, NULL, 0x0,
1627 NULL, HFILL }
1628 },
1629 { &hf_msg_addrv2_timestamp,
1630 { "Timestamp", "bitcoin.addrv2.timestamp",
1631 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
1632 NULL, HFILL }
1633 },
1634 { &hf_msg_addrv2_services,
1635 { "Node services", "bitcoin.addrv2.services",
1636 FT_UINT64, BASE_HEX, NULL, 0x0,
1637 NULL, HFILL }
1638 },
1639 { &hf_msg_addrv2_network,
1640 { "Node network", "bitcoin.addrv2.network",
1641 FT_UINT8, BASE_DEC, VALS(network_ids), 0x0,
1642 NULL, HFILL }
1643 },
1644 { &hf_msg_addrv2_address_ipv4,
1645 { "Node address", "bitcoin.addrv2.address.ipv4",
1646 FT_IPv4, BASE_NONE, NULL, 0x0,
1647 NULL, HFILL }
1648 },
1649 { &hf_msg_addrv2_address_ipv6,
1650 { "Node address", "bitcoin.addrv2.address.ipv6",
1651 FT_IPv6, BASE_NONE, NULL, 0x0,
1652 NULL, HFILL }
1653 },
1654 { &hf_msg_addrv2_address_other,
1655 { "Node address", "bitcoin.addrv2.address.other",
1656 FT_BYTES, BASE_NONE, NULL, 0x0,
1657 NULL, HFILL }
1658 },
1659 { &hf_msg_addrv2_port,
1660 { "Node port", "bitcoin.addrv2.port",
1661 FT_UINT16, BASE_DEC, NULL, 0x0,
1662 NULL, HFILL }
1663 },
1664 { &hf_bitcoin_msg_addrv2,
1665 { "Addrv2 message", "bitcoin.addrv2",
1666 FT_NONE, BASE_NONE, NULL, 0x0,
1667 NULL, HFILL }
1668 },
1669 { &hf_msg_inv_count8,
1670 { "Count", "bitcoin.inv.count",
1671 FT_UINT8, BASE_DEC, NULL, 0x0,
1672 NULL, HFILL }
1673 },
1674 { &hf_msg_inv_count16,
1675 { "Count", "bitcoin.inv.count",
1676 FT_UINT16, BASE_DEC, NULL, 0x0,
1677 NULL, HFILL }
1678 },
1679 { &hf_msg_inv_count32,
1680 { "Count", "bitcoin.inv.count",
1681 FT_UINT32, BASE_DEC, NULL, 0x0,
1682 NULL, HFILL }
1683 },
1684 { &hf_msg_inv_count64,
1685 { "Count", "bitcoin.inv.count64",
1686 FT_UINT64, BASE_DEC, NULL, 0x0,
1687 NULL, HFILL }
1688 },
1689 { &hf_bitcoin_msg_inv,
1690 { "Inventory message", "bitcoin.inv",
1691 FT_NONE, BASE_NONE, NULL, 0x0,
1692 NULL, HFILL }
1693 },
1694 { &hf_msg_inv_type,
1695 { "Type", "bitcoin.inv.type",
1696 FT_UINT32, BASE_DEC, VALS(inv_types), 0x0,
1697 NULL, HFILL }
1698 },
1699 { &hf_msg_inv_hash,
1700 { "Data hash", "bitcoin.inv.hash",
1701 FT_BYTES, BASE_NONE, NULL, 0x0,
1702 NULL, HFILL }
1703 },
1704 { &hf_bitcoin_msg_getdata,
1705 { "Getdata message", "bitcoin.getdata",
1706 FT_NONE, BASE_NONE, NULL, 0x0,
1707 NULL, HFILL }
1708 },
1709 { &hf_msg_getdata_count8,
1710 { "Count", "bitcoin.getdata.count",
1711 FT_UINT8, BASE_DEC, NULL, 0x0,
1712 NULL, HFILL }
1713 },
1714 { &hf_msg_getdata_count16,
1715 { "Count", "bitcoin.getdata.count",
1716 FT_UINT16, BASE_DEC, NULL, 0x0,
1717 NULL, HFILL }
1718 },
1719 { &hf_msg_getdata_count32,
1720 { "Count", "bitcoin.getdata.count",
1721 FT_UINT32, BASE_DEC, NULL, 0x0,
1722 NULL, HFILL }
1723 },
1724 { &hf_msg_getdata_count64,
1725 { "Count", "bitcoin.getdata.count64",
1726 FT_UINT64, BASE_DEC, NULL, 0x0,
1727 NULL, HFILL }
1728 },
1729 { &hf_msg_getdata_type,
1730 { "Type", "bitcoin.getdata.type",
1731 FT_UINT32, BASE_DEC, VALS(inv_types), 0x0,
1732 NULL, HFILL }
1733 },
1734 { &hf_msg_getdata_hash,
1735 { "Data hash", "bitcoin.getdata.hash",
1736 FT_BYTES, BASE_NONE, NULL, 0x0,
1737 NULL, HFILL }
1738 },
1739 { &hf_msg_notfound_count8,
1740 { "Count", "bitcoin.notfound.count",
1741 FT_UINT8, BASE_DEC, NULL, 0x0,
1742 NULL, HFILL }
1743 },
1744 { &hf_msg_notfound_count16,
1745 { "Count", "bitcoin.notfound.count",
1746 FT_UINT16, BASE_DEC, NULL, 0x0,
1747 NULL, HFILL }
1748 },
1749 { &hf_msg_notfound_count32,
1750 { "Count", "bitcoin.notfound.count",
1751 FT_UINT32, BASE_DEC, NULL, 0x0,
1752 NULL, HFILL }
1753 },
1754 { &hf_msg_notfound_count64,
1755 { "Count", "bitcoin.notfound.count64",
1756 FT_UINT64, BASE_DEC, NULL, 0x0,
1757 NULL, HFILL }
1758 },
1759 { &hf_bitcoin_msg_notfound,
1760 { "Getdata message", "bitcoin.notfound",
1761 FT_NONE, BASE_NONE, NULL, 0x0,
1762 NULL, HFILL }
1763 },
1764 { &hf_msg_notfound_type,
1765 { "Type", "bitcoin.notfound.type",
1766 FT_UINT32, BASE_DEC, VALS(inv_types), 0x0,
1767 NULL, HFILL }
1768 },
1769 { &hf_msg_notfound_hash,
1770 { "Data hash", "bitcoin.notfound.hash",
1771 FT_BYTES, BASE_NONE, NULL, 0x0,
1772 NULL, HFILL }
1773 },
1774 { &hf_msg_getblocks_count8,
1775 { "Count", "bitcoin.getblocks.count",
1776 FT_UINT8, BASE_DEC, NULL, 0x0,
1777 NULL, HFILL }
1778 },
1779 { &hf_msg_getblocks_count16,
1780 { "Count", "bitcoin.getblocks.count",
1781 FT_UINT16, BASE_DEC, NULL, 0x0,
1782 NULL, HFILL }
1783 },
1784 { &hf_msg_getblocks_count32,
1785 { "Count", "bitcoin.getblocks.count",
1786 FT_UINT32, BASE_DEC, NULL, 0x0,
1787 NULL, HFILL }
1788 },
1789 { &hf_msg_getblocks_count64,
1790 { "Count", "bitcoin.getblocks.count64",
1791 FT_UINT64, BASE_DEC, NULL, 0x0,
1792 NULL, HFILL }
1793 },
1794 { &hf_bitcoin_msg_getblocks,
1795 { "Getdata message", "bitcoin.getblocks",
1796 FT_NONE, BASE_NONE, NULL, 0x0,
1797 NULL, HFILL }
1798 },
1799 { &hf_msg_getblocks_start,
1800 { "Starting hash", "bitcoin.getblocks.hash_start",
1801 FT_BYTES, BASE_NONE, NULL, 0x0,
1802 NULL, HFILL }
1803 },
1804 { &hf_msg_getblocks_stop,
1805 { "Stopping hash", "bitcoin.getblocks.hash_stop",
1806 FT_BYTES, BASE_NONE, NULL, 0x0,
1807 NULL, HFILL }
1808 },
1809 { &hf_msg_getheaders_count8,
1810 { "Count", "bitcoin.getheaders.count",
1811 FT_UINT8, BASE_DEC, NULL, 0x0,
1812 NULL, HFILL }
1813 },
1814 { &hf_msg_getheaders_count16,
1815 { "Count", "bitcoin.getheaders.count",
1816 FT_UINT16, BASE_DEC, NULL, 0x0,
1817 NULL, HFILL }
1818 },
1819 { &hf_msg_getheaders_count32,
1820 { "Count", "bitcoin.getheaders.count",
1821 FT_UINT32, BASE_DEC, NULL, 0x0,
1822 NULL, HFILL }
1823 },
1824 { &hf_msg_getheaders_count64,
1825 { "Count", "bitcoin.getheaders.count64",
1826 FT_UINT64, BASE_DEC, NULL, 0x0,
1827 NULL, HFILL }
1828 },
1829 { &hf_msg_getheaders_version,
1830 { "Protocol version", "bitcoin.headers.version",
1831 FT_UINT32, BASE_DEC, NULL, 0x0,
1832 NULL, HFILL }
1833 },
1834 { &hf_bitcoin_msg_getheaders,
1835 { "Getheaders message", "bitcoin.getheaders",
1836 FT_NONE, BASE_NONE, NULL, 0x0,
1837 NULL, HFILL }
1838 },
1839 { &hf_msg_getheaders_start,
1840 { "Starting hash", "bitcoin.getheaders.hash_start",
1841 FT_BYTES, BASE_NONE, NULL, 0x0,
1842 NULL, HFILL }
1843 },
1844 { &hf_msg_getheaders_stop,
1845 { "Stopping hash", "bitcoin.getheaders.hash_stop",
1846 FT_BYTES, BASE_NONE, NULL, 0x0,
1847 NULL, HFILL }
1848 },
1849 { &hf_msg_tx_in_count8,
1850 { "Input Count", "bitcoin.tx.input_count",
1851 FT_UINT8, BASE_DEC, NULL, 0x0,
1852 NULL, HFILL }
1853 },
1854 { &hf_msg_tx_in_count16,
1855 { "Input Count", "bitcoin.tx.input_count",
1856 FT_UINT16, BASE_DEC, NULL, 0x0,
1857 NULL, HFILL }
1858 },
1859 { &hf_msg_tx_in_count32,
1860 { "Input Count", "bitcoin.tx.input_count",
1861 FT_UINT32, BASE_DEC, NULL, 0x0,
1862 NULL, HFILL }
1863 },
1864 { &hf_msg_tx_in_count64,
1865 { "Input Count", "bitcoin.tx.input_count64",
1866 FT_UINT64, BASE_DEC, NULL, 0x0,
1867 NULL, HFILL }
1868 },
1869 { &hf_bitcoin_msg_tx,
1870 { "Tx message", "bitcoin.tx",
1871 FT_NONE, BASE_NONE, NULL, 0x0,
1872 NULL, HFILL }
1873 },
1874 { &hf_msg_tx_version,
1875 { "Transaction version", "bitcoin.tx.version",
1876 FT_UINT32, BASE_DEC, NULL, 0x0,
1877 NULL, HFILL }
1878 },
1879 { &hf_msg_tx_flag,
1880 { "Flag", "bitcoin.tx.flag",
1881 FT_BYTES, BASE_NONE, NULL, 0x0,
1882 NULL, HFILL }
1883 },
1884 { &hf_msg_tx_in_script8,
1885 { "Script Length", "bitcoin.tx.in.script_length",
1886 FT_UINT8, BASE_DEC, NULL, 0x0,
1887 NULL, HFILL }
1888 },
1889 { &hf_msg_tx_in_script16,
1890 { "Script Length", "bitcoin.tx.in.script_length",
1891 FT_UINT16, BASE_DEC, NULL, 0x0,
1892 NULL, HFILL }
1893 },
1894 { &hf_msg_tx_in_script32,
1895 { "Script Length", "bitcoin.tx.in.script_length",
1896 FT_UINT32, BASE_DEC, NULL, 0x0,
1897 NULL, HFILL }
1898 },
1899 { &hf_msg_tx_in_script64,
1900 { "Script Length", "bitcoin.tx.in.script_length64",
1901 FT_UINT64, BASE_DEC, NULL, 0x0,
1902 NULL, HFILL }
1903 },
1904 { &hf_msg_tx_in,
1905 { "Transaction input", "bitcoin.tx.in",
1906 FT_NONE, BASE_NONE, NULL, 0x0,
1907 NULL, HFILL }
1908 },
1909 { &hf_msg_tx_in_prev_output,
1910 { "Previous output", "bitcoin.tx.in.prev_output",
1911 FT_NONE, BASE_NONE, NULL, 0x0,
1912 NULL, HFILL }
1913 },
1914 { &hf_msg_tx_in_prev_outp_hash,
1915 { "Hash", "bitcoin.tx.in.prev_output.hash",
1916 FT_BYTES, BASE_NONE, NULL, 0x0,
1917 NULL, HFILL }
1918 },
1919 { &hf_msg_tx_in_prev_outp_index,
1920 { "Index", "bitcoin.tx.in.prev_output.index",
1921 FT_UINT32, BASE_DEC, NULL, 0x0,
1922 NULL, HFILL }
1923 },
1924 { &hf_msg_tx_in_sig_script,
1925 { "Signature script", "bitcoin.tx.in.sig_script",
1926 FT_BYTES, BASE_NONE, NULL, 0x0,
1927 NULL, HFILL }
1928 },
1929 { &hf_msg_tx_in_seq,
1930 { "Sequence", "bitcoin.tx.in.seq",
1931 FT_UINT32, BASE_DEC, NULL, 0x0,
1932 NULL, HFILL }
1933 },
1934 { &hf_msg_tx_out_count8,
1935 { "Output Count", "bitcoin.tx.output_count",
1936 FT_UINT8, BASE_DEC, NULL, 0x0,
1937 NULL, HFILL }
1938 },
1939 { &hf_msg_tx_out_count16,
1940 { "Output Count", "bitcoin.tx.output_count",
1941 FT_UINT16, BASE_DEC, NULL, 0x0,
1942 NULL, HFILL }
1943 },
1944 { &hf_msg_tx_out_count32,
1945 { "Output Count", "bitcoin.tx.output_count",
1946 FT_UINT32, BASE_DEC, NULL, 0x0,
1947 NULL, HFILL }
1948 },
1949 { &hf_msg_tx_out_count64,
1950 { "Output Count", "bitcoin.tx.output_count64",
1951 FT_UINT64, BASE_DEC, NULL, 0x0,
1952 NULL, HFILL }
1953 },
1954 { &hf_msg_tx_out,
1955 { "Transaction output", "bitcoin.tx.out",
1956 FT_NONE, BASE_NONE, NULL, 0x0,
1957 NULL, HFILL }
1958 },
1959 { &hf_msg_tx_out_value,
1960 { "Value", "bitcoin.tx.out.value",
1961 FT_UINT64, BASE_DEC, NULL, 0x0,
1962 NULL, HFILL }
1963 },
1964 { &hf_msg_tx_out_script8,
1965 { "Script Length", "bitcoin.tx.out.script_length",
1966 FT_UINT8, BASE_DEC, NULL, 0x0,
1967 NULL, HFILL }
1968 },
1969 { &hf_msg_tx_out_script16,
1970 { "Script Length", "bitcoin.tx.out.script_length",
1971 FT_UINT16, BASE_DEC, NULL, 0x0,
1972 NULL, HFILL }
1973 },
1974 { &hf_msg_tx_out_script32,
1975 { "Script Length", "bitcoin.tx.out.script_length",
1976 FT_UINT32, BASE_DEC, NULL, 0x0,
1977 NULL, HFILL }
1978 },
1979 { &hf_msg_tx_out_script64,
1980 { "Script Length", "bitcoin.tx.out.script_length64",
1981 FT_UINT64, BASE_DEC, NULL, 0x0,
1982 NULL, HFILL }
1983 },
1984 { &hf_msg_tx_out_script,
1985 { "Script", "bitcoin.tx.out.script",
1986 FT_BYTES, BASE_NONE, NULL, 0x0,
1987 NULL, HFILL }
1988 },
1989 { &hf_msg_tx_witness,
1990 { "Transaction witness", "bitcoin.tx.witness",
1991 FT_NONE, BASE_NONE, NULL, 0x0,
1992 NULL, HFILL }
1993 },
1994 { &hf_msg_tx_witness_components8,
1995 { "Number of components", "bitcoin.tx.witness.component_count",
1996 FT_UINT8, BASE_DEC, NULL, 0x0,
1997 NULL, HFILL }
1998 },
1999 { &hf_msg_tx_witness_components16,
2000 { "Number of components", "bitcoin.tx.witness.component_count",
2001 FT_UINT16, BASE_DEC, NULL, 0x0,
2002 NULL, HFILL }
2003 },
2004 { &hf_msg_tx_witness_components32,
2005 { "Number of components", "bitcoin.tx.witness.component_count",
2006 FT_UINT32, BASE_DEC, NULL, 0x0,
2007 NULL, HFILL }
2008 },
2009 { &hf_msg_tx_witness_components64,
2010 { "Number of components", "bitcoin.tx.witness.component_count64",
2011 FT_UINT64, BASE_DEC, NULL, 0x0,
2012 NULL, HFILL }
2013 },
2014 { &hf_msg_tx_witness_component,
2015 { "Witness component", "bitcoin.tx.witness.component",
2016 FT_NONE, BASE_NONE, NULL, 0x0,
2017 NULL, HFILL }
2018 },
2019 { &hf_msg_tx_witness_component_length8,
2020 { "Length", "bitcoin.tx.witness.component.length",
2021 FT_UINT8, BASE_DEC, NULL, 0x0,
2022 NULL, HFILL }
2023 },
2024 { &hf_msg_tx_witness_component_length16,
2025 { "Length", "bitcoin.tx.witness.component.length",
2026 FT_UINT16, BASE_DEC, NULL, 0x0,
2027 NULL, HFILL }
2028 },
2029 { &hf_msg_tx_witness_component_length32,
2030 { "Length", "bitcoin.tx.witness.component.length",
2031 FT_UINT32, BASE_DEC, NULL, 0x0,
2032 NULL, HFILL }
2033 },
2034 { &hf_msg_tx_witness_component_length64,
2035 { "Length", "bitcoin.tx.witness.component.length64",
2036 FT_UINT64, BASE_DEC, NULL, 0x0,
2037 NULL, HFILL }
2038 },
2039 { &hf_msg_tx_witness_component_data,
2040 { "Data", "bitcoin.tx.witness.component.data",
2041 FT_BYTES, BASE_NONE, NULL, 0x0,
2042 NULL, HFILL }
2043 },
2044 { &hf_msg_tx_lock_time,
2045 { "Block lock time or block ID", "bitcoin.tx.lock_time",
2046 FT_UINT32, BASE_DEC, NULL, 0x0,
2047 NULL, HFILL }
2048 },
2049 { &hf_msg_block_transactions8,
2050 { "Number of transactions", "bitcoin.block.num_transactions",
2051 FT_UINT8, BASE_DEC, NULL, 0x0,
2052 NULL, HFILL }
2053 },
2054 { &hf_msg_block_transactions16,
2055 { "Number of transactions", "bitcoin.block.num_transactions",
2056 FT_UINT16, BASE_DEC, NULL, 0x0,
2057 NULL, HFILL }
2058 },
2059 { &hf_msg_block_transactions32,
2060 { "Number of transactions", "bitcoin.block.num_transactions",
2061 FT_UINT32, BASE_DEC, NULL, 0x0,
2062 NULL, HFILL }
2063 },
2064 { &hf_msg_block_transactions64,
2065 { "Number of transactions", "bitcoin.block.num_transactions64",
2066 FT_UINT64, BASE_DEC, NULL, 0x0,
2067 NULL, HFILL }
2068 },
2069 { &hf_bitcoin_msg_block,
2070 { "Block message", "bitcoin.block",
2071 FT_NONE, BASE_NONE, NULL, 0x0,
2072 NULL, HFILL }
2073 },
2074 { &hf_msg_block_version,
2075 { "Block version", "bitcoin.block.version",
2076 FT_UINT32, BASE_DEC, NULL, 0x0,
2077 NULL, HFILL }
2078 },
2079 { &hf_msg_block_prev_block,
2080 { "Previous block", "bitcoin.block.prev_block",
2081 FT_BYTES, BASE_NONE, NULL, 0x0,
2082 NULL, HFILL }
2083 },
2084 { &hf_msg_block_merkle_root,
2085 { "Merkle root", "bitcoin.block.merkle_root",
2086 FT_BYTES, BASE_NONE, NULL, 0x0,
2087 NULL, HFILL }
2088 },
2089 { &hf_msg_block_time,
2090 { "Block timestamp", "bitcoin.block.timestamp",
2091 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
2092 NULL, HFILL }
2093 },
2094 { &hf_msg_block_bits,
2095 { "Bits", "bitcoin.block.bits",
2096 FT_UINT32, BASE_HEX, NULL, 0x0,
2097 NULL, HFILL }
2098 },
2099 { &hf_msg_block_nonce,
2100 { "Nonce", "bitcoin.block.nonce",
2101 FT_UINT32, BASE_HEX, NULL, 0x0,
2102 NULL, HFILL }
2103 },
2104 { &hf_bitcoin_msg_headers,
2105 { "Headers message", "bitcoin.headers",
2106 FT_NONE, BASE_NONE, NULL, 0x0,
2107 NULL, HFILL }
2108 },
2109 { &hf_msg_headers_version,
2110 { "Block version", "bitcoin.headers.version",
2111 FT_UINT32, BASE_DEC, NULL, 0x0,
2112 NULL, HFILL }
2113 },
2114 { &hf_msg_headers_prev_block,
2115 { "Previous block", "bitcoin.headers.prev_block",
2116 FT_BYTES, BASE_NONE, NULL, 0x0,
2117 NULL, HFILL }
2118 },
2119 { &hf_msg_headers_merkle_root,
2120 { "Merkle root", "bitcoin.headers.merkle_root",
2121 FT_BYTES, BASE_NONE, NULL, 0x0,
2122 NULL, HFILL }
2123 },
2124 { &hf_msg_headers_time,
2125 { "Block timestamp", "bitcoin.headers.timestamp",
2126 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
2127 NULL, HFILL }
2128 },
2129 { &hf_msg_headers_bits,
2130 { "Bits", "bitcoin.headers.bits",
2131 FT_UINT32, BASE_HEX, NULL, 0x0,
2132 NULL, HFILL }
2133 },
2134 { &hf_msg_headers_nonce,
2135 { "Nonce", "bitcoin.headers.nonce",
2136 FT_UINT32, BASE_HEX, NULL, 0x0,
2137 NULL, HFILL }
2138 },
2139 { &hf_msg_headers_count8,
2140 { "Count", "bitcoin.headers.count",
2141 FT_UINT8, BASE_DEC, NULL, 0x0,
2142 NULL, HFILL }
2143 },
2144 { &hf_msg_headers_count16,
2145 { "Count", "bitcoin.headers.count",
2146 FT_UINT16, BASE_DEC, NULL, 0x0,
2147 NULL, HFILL }
2148 },
2149 { &hf_msg_headers_count32,
2150 { "Count", "bitcoin.headers.count",
2151 FT_UINT32, BASE_DEC, NULL, 0x0,
2152 NULL, HFILL }
2153 },
2154 { &hf_msg_headers_count64,
2155 { "Count", "bitcoin.headers.count64",
2156 FT_UINT64, BASE_DEC, NULL, 0x0,
2157 NULL, HFILL }
2158 },
2159 { &hf_bitcoin_msg_ping,
2160 { "Ping message", "bitcoin.ping",
2161 FT_NONE, BASE_NONE, NULL, 0x0,
2162 NULL, HFILL }
2163 },
2164 { &hf_msg_ping_nonce,
2165 { "Random nonce", "bitcoin.ping.nonce",
2166 FT_UINT64, BASE_HEX, NULL, 0x0,
2167 NULL, HFILL }
2168 },
2169 { &hf_bitcoin_msg_pong,
2170 { "Pong message", "bitcoin.pong",
2171 FT_NONE, BASE_NONE, NULL, 0x0,
2172 NULL, HFILL }
2173 },
2174 { &hf_msg_pong_nonce,
2175 { "Random nonce", "bitcoin.pong.nonce",
2176 FT_UINT64, BASE_HEX, NULL, 0x0,
2177 NULL, HFILL }
2178 },
2179 { &hf_bitcoin_msg_reject,
2180 { "Reject message", "bitcoin.reject",
2181 FT_NONE, BASE_NONE, NULL, 0x0,
2182 NULL, HFILL }
2183 },
2184 { &hf_msg_reject_message,
2185 { "Message rejected", "bitcoin.reject.message",
2186 FT_NONE, BASE_NONE, NULL, 0x0,
2187 NULL, HFILL }
2188 },
2189 { &hf_msg_reject_reason,
2190 { "Reason", "bitcoin.reject.reason",
2191 FT_NONE, BASE_NONE, NULL, 0x0,
2192 NULL, HFILL }
2193 },
2194 { &hf_msg_reject_ccode,
2195 { "CCode", "bitcoin.reject.ccode",
2196 FT_UINT8, BASE_HEX, VALS(reject_ccode), 0x0,
2197 NULL, HFILL }
2198 },
2199 { &hf_msg_reject_data,
2200 { "Data", "bitcoin.reject.data",
2201 FT_BYTES, BASE_NONE, NULL, 0x0,
2202 NULL, HFILL }
2203 },
2204 { &hf_bitcoin_msg_sendcmpct,
2205 { "Sendcmpct message", "bitcoin.sendcmpct",
2206 FT_NONE, BASE_NONE, NULL, 0x0,
2207 NULL, HFILL }
2208 },
2209 { &hf_msg_sendcmpct_announce,
2210 { "Announce", "bitcoin.sendcmpct.announce",
2211 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2212 NULL, HFILL }
2213 },
2214 { &hf_msg_sendcmpct_version,
2215 { "Version", "bitcoin.sendcmpct.version",
2216 FT_UINT64, BASE_DEC, NULL, 0x0,
2217 NULL, HFILL }
2218 },
2219 { &hf_bitcoin_msg_feefilter,
2220 { "Feefilter message", "bitcoin.feefilter",
2221 FT_NONE, BASE_NONE, NULL, 0x0,
2222 NULL, HFILL }
2223 },
2224 { &hf_msg_feefilter_value,
2225 { "Minimal fee", "bitcoin.feefilter.value",
2226 FT_UINT64, BASE_CUSTOM, CF_FUNC(format_feefilter_value), 0x0,
2227 NULL, HFILL }
2228 },
2229 { &hf_bitcoin_msg_filterload,
2230 { "Filterload message", "bitcoin.filterload",
2231 FT_NONE, BASE_NONE, NULL, 0x0,
2232 NULL, HFILL }
2233 },
2234 { &hf_msg_filterload_filter,
2235 { "Filter", "bitcoin.filterload.filter",
2236 FT_NONE, BASE_NONE, NULL, 0x0,
2237 NULL, HFILL }
2238 },
2239 { &hf_msg_filterload_nhashfunc,
2240 { "nHashFunc", "bitcoin.filterload.nhashfunc",
2241 FT_UINT32, BASE_DEC, NULL, 0x0,
2242 NULL, HFILL }
2243 },
2244 { &hf_msg_filterload_ntweak,
2245 { "nTweak", "bitcoin.filterload.ntweak",
2246 FT_UINT32, BASE_HEX, NULL, 0x0,
2247 NULL, HFILL }
2248 },
2249 { &hf_msg_filterload_nflags,
2250 { "nFlags", "bitcoin.filterload.nflags",
2251 FT_UINT8, BASE_HEX, VALS(filterload_nflags), 0x0,
2252 NULL, HFILL }
2253 },
2254 { &hf_bitcoin_msg_filteradd,
2255 { "Filteradd message", "bitcoin.filteradd",
2256 FT_NONE, BASE_NONE, NULL, 0x0,
2257 NULL, HFILL }
2258 },
2259 { &hf_msg_filteradd_data,
2260 { "Data", "bitcoin.filteradd.data",
2261 FT_NONE, BASE_NONE, NULL, 0x0,
2262 NULL, HFILL }
2263 },
2264 { &hf_bitcoin_msg_merkleblock,
2265 { "Merkleblock message", "bitcoin.merkleblock",
2266 FT_NONE, BASE_NONE, NULL, 0x0,
2267 NULL, HFILL }
2268 },
2269 { &hf_msg_merkleblock_transactions,
2270 { "Number of transactions", "bitcoin.merkleblock.num_transactions",
2271 FT_UINT32, BASE_DEC, NULL, 0x0,
2272 NULL, HFILL }
2273 },
2274 { &hf_msg_merkleblock_version,
2275 { "Block version", "bitcoin.merkleblock.version",
2276 FT_UINT32, BASE_DEC, NULL, 0x0,
2277 NULL, HFILL }
2278 },
2279 { &hf_msg_merkleblock_prev_block,
2280 { "Previous block", "bitcoin.merkleblock.prev_block",
2281 FT_BYTES, BASE_NONE, NULL, 0x0,
2282 NULL, HFILL }
2283 },
2284 { &hf_msg_merkleblock_merkle_root,
2285 { "Merkle root", "bitcoin.merkleblock.merkle_root",
2286 FT_BYTES, BASE_NONE, NULL, 0x0,
2287 NULL, HFILL }
2288 },
2289 { &hf_msg_merkleblock_time,
2290 { "Block timestamp", "bitcoin.merkleblock.timestamp",
2291 FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0,
2292 NULL, HFILL }
2293 },
2294 { &hf_msg_merkleblock_bits,
2295 { "Bits", "bitcoin.merkleblock.bits",
2296 FT_UINT32, BASE_HEX, NULL, 0x0,
2297 NULL, HFILL }
2298 },
2299 { &hf_msg_merkleblock_nonce,
2300 { "Nonce", "bitcoin.merkleblock.nonce",
2301 FT_UINT32, BASE_HEX, NULL, 0x0,
2302 NULL, HFILL }
2303 },
2304 { &hf_msg_merkleblock_hashes_count8,
2305 { "Count", "bitcoin.merkleblock.hashes.count",
2306 FT_UINT8, BASE_DEC, NULL, 0x0,
2307 NULL, HFILL }
2308 },
2309 { &hf_msg_merkleblock_hashes_count16,
2310 { "Count", "bitcoin.merkleblock.hashes.count",
2311 FT_UINT16, BASE_DEC, NULL, 0x0,
2312 NULL, HFILL }
2313 },
2314 { &hf_msg_merkleblock_hashes_count32,
2315 { "Count", "bitcoin.merkleblock.hashes.count",
2316 FT_UINT32, BASE_DEC, NULL, 0x0,
2317 NULL, HFILL }
2318 },
2319 { &hf_msg_merkleblock_hashes_count64,
2320 { "Count", "bitcoin.merkleblock.hashes.count64",
2321 FT_UINT64, BASE_DEC, NULL, 0x0,
2322 NULL, HFILL }
2323 },
2324 { &hf_msg_merkleblock_hashes_hash,
2325 { "Hash", "bitcoin.merkleblock.hashes.hash",
2326 FT_BYTES, BASE_NONE, NULL, 0x0,
2327 NULL, HFILL }
2328 },
2329 { &hf_msg_merkleblock_flags_size8,
2330 { "Size", "bitcoin.merkleblock.flags.count",
2331 FT_UINT8, BASE_DEC, NULL, 0x0,
2332 NULL, HFILL }
2333 },
2334 { &hf_msg_merkleblock_flags_size16,
2335 { "Size", "bitcoin.merkleblock.flags.count",
2336 FT_UINT16, BASE_DEC, NULL, 0x0,
2337 NULL, HFILL }
2338 },
2339 { &hf_msg_merkleblock_flags_size32,
2340 { "Size", "bitcoin.merkleblock.flags.count",
2341 FT_UINT32, BASE_DEC, NULL, 0x0,
2342 NULL, HFILL }
2343 },
2344 { &hf_msg_merkleblock_flags_size64,
2345 { "Size", "bitcoin.merkleblock.flags.count64",
2346 FT_UINT64, BASE_DEC, NULL, 0x0,
2347 NULL, HFILL }
2348 },
2349 { &hf_msg_merkleblock_flags_data,
2350 { "Data", "bitcoin.merkleblock.flags.data",
2351 FT_BYTES, BASE_NONE, NULL, 0x0,
2352 NULL, HFILL }
2353 },
2354 { &hf_services_network,
2355 { "Network node", "bitcoin.services.network",
2356 FT_BOOLEAN, 32, TFS(&tfs_set_notset), 0x00000001,
2357 NULL, HFILL }
2358 },
2359 { &hf_services_getutxo,
2360 { "Getutxo node", "bitcoin.services.getutxo",
2361 FT_BOOLEAN, 32, TFS(&tfs_set_notset), 0x00000002,
2362 NULL, HFILL }
2363 },
2364 { &hf_services_bloom,
2365 { "Bloom filter node", "bitcoin.services.bloom",
2366 FT_BOOLEAN, 32, TFS(&tfs_set_notset), 0x00000004,
2367 NULL, HFILL }
2368 },
2369 { &hf_services_witness,
2370 { "Witness node", "bitcoin.services.witness",
2371 FT_BOOLEAN, 32, TFS(&tfs_set_notset), 0x00000008,
2372 NULL, HFILL }
2373 },
2374 { &hf_services_xthin,
2375 { "Xtreme Thinblocks node", "bitcoin.services.xthin",
2376 FT_BOOLEAN, 32, TFS(&tfs_set_notset), 0x00000010,
2377 NULL, HFILL }
2378 },
2379 { &hf_services_compactfilters,
2380 { "Compact filters node", "bitcoin.services.compactfilters",
2381 FT_BOOLEAN, 32, TFS(&tfs_set_notset), 0x00000040,
2382 NULL, HFILL }
2383 },
2384 { &hf_services_networklimited,
2385 { "Limited network node", "bitcoin.services.networklimited",
2386 FT_BOOLEAN, 32, TFS(&tfs_set_notset), 0x00000400,
2387 NULL, HFILL }
2388 },
2389 { &hf_services_p2pv2,
2390 { "Version 2 P2P node", "bitcoin.services.p2pv2",
2391 FT_BOOLEAN, 32, TFS(&tfs_set_notset), 0x00000800,
2392 NULL, HFILL }
2393 },
2394 { &hf_address_services,
2395 { "Node services", "bitcoin.address.services",
2396 FT_UINT64, BASE_HEX, NULL, 0x0,
2397 NULL, HFILL }
2398 },
2399 { &hf_address_address,
2400 { "Node address", "bitcoin.address.address",
2401 FT_IPv6, BASE_NONE, NULL, 0x0,
2402 NULL, HFILL }
2403 },
2404 { &hf_address_port,
2405 { "Node port", "bitcoin.address.port",
2406 FT_UINT16, BASE_DEC, NULL, 0x0,
2407 NULL, HFILL }
2408 },
2409 { &hf_string_value,
2410 { "String value", "bitcoin.string.value",
2411 FT_STRING, BASE_NONE, NULL, 0x0,
2412 NULL, HFILL }
2413 },
2414 { &hf_string_varint_count8,
2415 { "Count", "bitcoin.string.count",
2416 FT_UINT8, BASE_DEC, NULL, 0x0,
2417 NULL, HFILL }
2418 },
2419 { &hf_string_varint_count16,
2420 { "Count", "bitcoin.string.count",
2421 FT_UINT16, BASE_DEC, NULL, 0x0,
2422 NULL, HFILL }
2423 },
2424 { &hf_string_varint_count32,
2425 { "Count", "bitcoin.string.count",
2426 FT_UINT32, BASE_DEC, NULL, 0x0,
2427 NULL, HFILL }
2428 },
2429 { &hf_string_varint_count64,
2430 { "Count", "bitcoin.string.count64",
2431 FT_UINT64, BASE_DEC, NULL, 0x0,
2432 NULL, HFILL }
2433 },
2434 { &hf_data_value,
2435 { "Data", "bitcoin.data.value",
2436 FT_BYTES, BASE_NONE, NULL, 0x0,
2437 NULL, HFILL }
2438 },
2439 { &hf_data_varint_count8,
2440 { "Count", "bitcoin.data.count",
2441 FT_UINT8, BASE_DEC, NULL, 0x0,
2442 NULL, HFILL }
2443 },
2444 { &hf_data_varint_count16,
2445 { "Count", "bitcoin.data.count",
2446 FT_UINT16, BASE_DEC, NULL, 0x0,
2447 NULL, HFILL }
2448 },
2449 { &hf_data_varint_count32,
2450 { "Count", "bitcoin.data.count",
2451 FT_UINT32, BASE_DEC, NULL, 0x0,
2452 NULL, HFILL }
2453 },
2454 { &hf_data_varint_count64,
2455 { "Count", "bitcoin.data.count64",
2456 FT_UINT64, BASE_DEC, NULL, 0x0,
2457 NULL, HFILL }
2458 },
2459 };
2460
2461 static int *ett[] = {
2462 &ett_bitcoin,
2463 &ett_bitcoin_msg,
2464 &ett_services,
2465 &ett_address,
2466 &ett_string,
2467 &ett_addr_list,
2468 &ett_inv_list,
2469 &ett_getdata_list,
2470 &ett_notfound_list,
2471 &ett_getblocks_list,
2472 &ett_getheaders_list,
2473 &ett_tx_in_list,
2474 &ett_tx_in_outp,
2475 &ett_tx_out_list,
2476 &ett_tx_witness_list,
2477 &ett_tx_witness_component_list,
2478 };
2479
2480 static ei_register_info ei[] = {
2481 { &ei_bitcoin_command_unknown, { "bitcoin.command.unknown", PI_PROTOCOL, PI_WARN, "Unknown command", EXPFILL }},
2482 { &ei_bitcoin_address_length, { "bitcoin.address_length.invalid", PI_MALFORMED, PI_WARN, "Address length does not match network type", EXPFILL }},
2483 { &ei_bitcoin_script_len, { "bitcoin.script_length.invalid", PI_MALFORMED, PI_ERROR, "script_len too large", EXPFILL }}
2484 };
2485
2486 module_t *bitcoin_module;
2487 expert_module_t* expert_bitcoin;
2488
2489 proto_bitcoin = proto_register_protocol("Bitcoin protocol", "Bitcoin", "bitcoin");
2490
2491 proto_register_subtree_array(ett, array_length(ett));
2492 proto_register_field_array(proto_bitcoin, hf, array_length(hf));
2493
2494 expert_bitcoin = expert_register_protocol(proto_bitcoin);
2495 expert_register_field_array(expert_bitcoin, ei, array_length(ei));
2496
2497 bitcoin_command_table = register_dissector_table("bitcoin.command", "Bitcoin Command", proto_bitcoin, FT_STRING, STRING_CASE_SENSITIVE);
2498
2499 bitcoin_handle = register_dissector("bitcoin", dissect_bitcoin, proto_bitcoin);
2500
2501 bitcoin_module = prefs_register_protocol(proto_bitcoin, NULL);
2502 prefs_register_bool_preference(bitcoin_module, "desegment",
2503 "Desegment all Bitcoin messages spanning multiple TCP segments",
2504 "Whether the Bitcoin dissector should desegment all messages"
2505 " spanning multiple TCP segments",
2506 &bitcoin_desegment);
2507
2508 }
2509
2510 void
2511 proto_reg_handoff_bitcoin(void)
2512 {
2513 dissector_handle_t command_handle;
2514
2515 dissector_add_for_decode_as_with_preference("tcp.port", bitcoin_handle);
2516
2517 heur_dissector_add( "tcp", dissect_bitcoin_heur, "Bitcoin over TCP", "bitcoin_tcp", proto_bitcoin, HEURISTIC_ENABLE);
2518
2519 /* Register all of the commands */
2520 command_handle = create_dissector_handle( dissect_bitcoin_msg_version, proto_bitcoin );
2521 dissector_add_string("bitcoin.command", "version", command_handle);
2522 command_handle = create_dissector_handle( dissect_bitcoin_msg_addr, proto_bitcoin );
2523 dissector_add_string("bitcoin.command", "addr", command_handle);
2524 command_handle = create_dissector_handle( dissect_bitcoin_msg_addrv2, proto_bitcoin );
2525 dissector_add_string("bitcoin.command", "addrv2", command_handle);
2526 command_handle = create_dissector_handle( dissect_bitcoin_msg_inv, proto_bitcoin );
2527 dissector_add_string("bitcoin.command", "inv", command_handle);
2528 command_handle = create_dissector_handle( dissect_bitcoin_msg_getdata, proto_bitcoin );
2529 dissector_add_string("bitcoin.command", "getdata", command_handle);
2530 command_handle = create_dissector_handle( dissect_bitcoin_msg_getblocks, proto_bitcoin );
2531 dissector_add_string("bitcoin.command", "getblocks", command_handle);
2532 command_handle = create_dissector_handle( dissect_bitcoin_msg_getheaders, proto_bitcoin );
2533 dissector_add_string("bitcoin.command", "getheaders", command_handle);
2534 command_handle = create_dissector_handle( dissect_bitcoin_msg_tx, proto_bitcoin );
2535 dissector_add_string("bitcoin.command", "tx", command_handle);
2536 command_handle = create_dissector_handle( dissect_bitcoin_msg_block, proto_bitcoin );
2537 dissector_add_string("bitcoin.command", "block", command_handle);
2538 command_handle = create_dissector_handle( dissect_bitcoin_msg_ping, proto_bitcoin );
2539 dissector_add_string("bitcoin.command", "ping", command_handle);
2540 command_handle = create_dissector_handle( dissect_bitcoin_msg_pong, proto_bitcoin );
2541 dissector_add_string("bitcoin.command", "pong", command_handle);
2542 command_handle = create_dissector_handle( dissect_bitcoin_msg_notfound, proto_bitcoin );
2543 dissector_add_string("bitcoin.command", "notfound", command_handle);
2544 command_handle = create_dissector_handle( dissect_bitcoin_msg_reject, proto_bitcoin );
2545 dissector_add_string("bitcoin.command", "reject", command_handle);
2546 command_handle = create_dissector_handle( dissect_bitcoin_msg_headers, proto_bitcoin );
2547 dissector_add_string("bitcoin.command", "headers", command_handle);
2548 command_handle = create_dissector_handle( dissect_bitcoin_msg_feefilter, proto_bitcoin );
2549 dissector_add_string("bitcoin.command", "feefilter", command_handle);
2550 command_handle = create_dissector_handle( dissect_bitcoin_msg_filterload, proto_bitcoin );
2551 dissector_add_string("bitcoin.command", "filterload", command_handle);
2552 command_handle = create_dissector_handle( dissect_bitcoin_msg_filteradd, proto_bitcoin );
2553 dissector_add_string("bitcoin.command", "filteradd", command_handle);
2554 command_handle = create_dissector_handle( dissect_bitcoin_msg_merkleblock, proto_bitcoin );
2555 dissector_add_string("bitcoin.command", "merkleblock", command_handle);
2556 command_handle = create_dissector_handle( dissect_bitcoin_msg_sendcmpct, proto_bitcoin );
2557 dissector_add_string("bitcoin.command", "sendcmpct", command_handle);
2558
2559 /* messages with no payload */
2560 command_handle = create_dissector_handle( dissect_bitcoin_msg_empty, proto_bitcoin );
2561 dissector_add_string("bitcoin.command", "verack", command_handle);
2562 dissector_add_string("bitcoin.command", "getaddr", command_handle);
2563 dissector_add_string("bitcoin.command", "mempool", command_handle);
2564 dissector_add_string("bitcoin.command", "filterclear", command_handle);
2565 dissector_add_string("bitcoin.command", "sendaddrv2", command_handle);
2566 dissector_add_string("bitcoin.command", "sendheaders", command_handle);
2567 dissector_add_string("bitcoin.command", "wtxidrelay", command_handle);
2568
2569 /* messages not implemented */
2570 /* command_handle = create_dissector_handle( dissect_bitcoin_msg_empty, proto_bitcoin ); */
2571 dissector_add_string("bitcoin.command", "checkorder", command_handle);
2572 dissector_add_string("bitcoin.command", "submitorder", command_handle);
2573 dissector_add_string("bitcoin.command", "reply", command_handle);
2574 dissector_add_string("bitcoin.command", "alert", command_handle);
2575 }
2576
2577 /*
2578 * Editor modelines - https://www.wireshark.org/tools/modelines.html
2579 *
2580 * Local variables:
2581 * c-basic-offset: 2
2582 * tab-width: 8
2583 * indent-tabs-mode: nil
2584 * End:
2585 *
2586 * vi: set shiftwidth=2 tabstop=8 expandtab:
2587 * :indentSize=2:tabSize=8:noTabs=true:
2588 */
Metzes wireshark repo