epan/dissectors/packet-wireguard.c

   1 /* packet-wireguard.c
   2  * Routines for WireGuard dissection
   3  * Copyright 2018, Peter Wu <peter@lekensteyn.nl>
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * SPDX-License-Identifier: GPL-2.0-or-later
  10  */
  11
  12 /*
  13  * Protocol details: https://www.wireguard.com/protocol/
  14  */
  15
  16 #include <config.h>
  17
  18 #include <epan/packet.h>
  19 #include <epan/expert.h>
  20 #include <epan/prefs.h>
  21 #include <epan/proto_data.h>
  22
  23 void proto_reg_handoff_wg(void);
  24 void proto_register_wg(void);
  25
  26 static int proto_wg = -1;
  27 static int hf_wg_type = -1;
  28 static int hf_wg_reserved = -1;
  29 static int hf_wg_sender = -1;
  30 static int hf_wg_ephemeral = -1;
  31 static int hf_wg_encrypted_static = -1;
  32 static int hf_wg_encrypted_timestamp = -1;
  33 static int hf_wg_mac1 = -1;
  34 static int hf_wg_mac2 = -1;
  35 static int hf_wg_receiver = -1;
  36 static int hf_wg_encrypted_empty = -1;
  37 static int hf_wg_nonce = -1;
  38 static int hf_wg_encrypted_cookie = -1;
  39 static int hf_wg_counter = -1;
  40 static int hf_wg_encrypted_packet = -1;
  41 static int hf_wg_stream = -1;
  42 static int hf_wg_response_in = -1;
  43 static int hf_wg_response_to = -1;
  44
  45 static gint ett_wg = -1;
  46
  47 static expert_field ei_wg_bad_packet_length = EI_INIT;
  48 static expert_field ei_wg_keepalive  = EI_INIT;
  49
  50
  51 // Length of AEAD authentication tag
  52 #define AUTH_TAG_LENGTH 16
  53
  54 typedef enum {
  55     WG_TYPE_HANDSHAKE_INITIATION = 1,
  56     WG_TYPE_HANDSHAKE_RESPONSE = 2,
  57     WG_TYPE_COOKIE_REPLY = 3,
  58     WG_TYPE_TRANSPORT_DATA = 4
  59 } wg_message_type;
  60
  61 static const value_string wg_type_names[] = {
  62     { 0x01, "Handshake Initiation" },
  63     { 0x02, "Handshake Response" },
  64     { 0x03, "Cookie Reply" },
  65     { 0x04, "Transport Data" },
  66     { 0x00, NULL }
  67 };
  68
  69 /*
  70  * Information required to process and link messages as required on the first
  71  * sequential pass. After that it can be erased.
  72  */
  73 typedef struct {
  74     address     initiator_address;
  75     address     responder_address;
  76     guint16     initiator_port;
  77     guint16     responder_port;
  78 } wg_initial_info_t;
  79
  80 /*
  81  * A "session" between two peer is identified by a "sender" id as independently
  82  * chosen by each side. In case both peer IDs collide, the source IP and UDP
  83  * port number could be used to distinguish sessions. As IDs can be recycled
  84  * over time, lookups should use the most recent initiation (or response).
  85  *
  86  * XXX record timestamps (time since last message, for validating timers).
  87  */
  88 typedef struct {
  89     guint32     stream;             /* Session identifier (akin to udp.stream). */
  90     guint32     initiator_frame;
  91     guint32     response_frame;     /* Responder or Cookie Reply message. */
  92     wg_initial_info_t initial;      /* Valid only on the first pass. */
  93 } wg_session_t;
  94
  95 /* Per-packet state. */
  96 typedef struct {
  97     wg_session_t   *session;
  98 } wg_packet_info_t;
  99
 100 /* Map from Sender/Receiver IDs to a list of session information. */
 101 static wmem_map_t *sessions;
 102 static guint32 wg_session_count;
 103
 104
 105 static void
 106 wg_sessions_insert(guint32 id, wg_session_t *session)
 107 {
 108     wmem_list_t *list = (wmem_list_t *)wmem_map_lookup(sessions, GUINT_TO_POINTER(id));
 109     if (!list) {
 110         list = wmem_list_new(wmem_file_scope());
 111         wmem_map_insert(sessions, GUINT_TO_POINTER(id), list);
 112     }
 113     wmem_list_append(list, session);
 114 }
 115
 116 static wg_session_t *
 117 wg_session_new(void)
 118 {
 119     wg_session_t *session = wmem_new0(wmem_file_scope(), wg_session_t);
 120     session->stream = wg_session_count++;
 121     return session;
 122 }
 123
 124 /* Updates the peer address based on the source address. */
 125 static void
 126 wg_session_update_address(wg_session_t *session, packet_info *pinfo, gboolean sender_is_initiator)
 127 {
 128     DISSECTOR_ASSERT(!PINFO_FD_VISITED(pinfo));
 129
 130     if (sender_is_initiator) {
 131         copy_address_wmem(wmem_file_scope(), &session->initial.initiator_address, &pinfo->src);
 132         session->initial.initiator_port = (guint16)pinfo->srcport;
 133     } else {
 134         copy_address_wmem(wmem_file_scope(), &session->initial.responder_address, &pinfo->src);
 135         session->initial.responder_port = (guint16)pinfo->srcport;
 136     }
 137 }
 138
 139 /* Finds an initiation message based on the given Receiver ID that was not
 140  * previously associated with a responder message. Returns the session if a
 141  * matching initation message can be found or NULL otherwise.
 142  */
 143 static wg_session_t *
 144 wg_sessions_lookup_initiation(packet_info *pinfo, guint32 receiver_id)
 145 {
 146     DISSECTOR_ASSERT(!PINFO_FD_VISITED(pinfo));
 147
 148     /* Look for the initiation message matching this Receiver ID. */
 149     wmem_list_t *list = (wmem_list_t *)wmem_map_lookup(sessions, GUINT_TO_POINTER(receiver_id));
 150     if (!list) {
 151         return NULL;
 152     }
 153
 154     /* Walk backwards to find the most recent message first. All packets are
 155      * guaranteed to arrive before this frame because this is the first pass. */
 156     for (wmem_list_frame_t *item = wmem_list_tail(list); item; item = wmem_list_frame_prev(item)) {
 157         wg_session_t *session = (wg_session_t *)wmem_list_frame_data(item);
 158         if (session->initial.initiator_port != pinfo->destport ||
 159             !addresses_equal(&session->initial.initiator_address, &pinfo->dst)) {
 160             /* Responder messages are expected to be sent to the initiator. */
 161             continue;
 162         }
 163         if (session->response_frame && session->response_frame != pinfo->num) {
 164             /* This session was linked elsewhere. */
 165             continue;
 166         }
 167
 168         /* This assumes no malicious messages and no contrived sequences:
 169          * Any initiator or responder message is not duplicated nor are these
 170          * mutated. If this must be detected, the caller could decrypt or check
 171          * mac1 to distinguish valid messages.
 172          */
 173         return session;
 174     }
 175
 176     return NULL;
 177 }
 178
 179 /* Finds a session with a completed handshake that matches the Receiver ID. */
 180 static wg_session_t *
 181 wg_sessions_lookup(packet_info *pinfo, guint32 receiver_id, gboolean *receiver_is_initiator)
 182 {
 183     DISSECTOR_ASSERT(!PINFO_FD_VISITED(pinfo));
 184
 185     wmem_list_t *list = (wmem_list_t *)wmem_map_lookup(sessions, GUINT_TO_POINTER(receiver_id));
 186     if (!list) {
 187         return NULL;
 188     }
 189
 190     /* Walk backwards to find the most recent message first. */
 191     for (wmem_list_frame_t *item = wmem_list_tail(list); item; item = wmem_list_frame_prev(item)) {
 192         wg_session_t *session = (wg_session_t *)wmem_list_frame_data(item);
 193         if (!session->response_frame) {
 194             /* Ignore sessions that are not fully established. */
 195             continue;
 196         }
 197         if (session->initial.initiator_port == pinfo->destport &&
 198             addresses_equal(&session->initial.initiator_address, &pinfo->dst)) {
 199             *receiver_is_initiator = TRUE;
 200         } else if (session->initial.responder_port == pinfo->destport &&
 201                    addresses_equal(&session->initial.responder_address, &pinfo->dst)) {
 202             *receiver_is_initiator = FALSE;
 203         } else {
 204             /* Both peers do not match the destination, ignore. */
 205             continue;
 206         }
 207         return session;
 208     }
 209
 210     return NULL;
 211 }
 212
 213
 214 static void
 215 wg_dissect_pubkey(proto_tree *tree, tvbuff_t *tvb, int offset, gboolean is_ephemeral)
 216 {
 217     const guint8 *pubkey = tvb_get_ptr(tvb, offset, 32);
 218     gchar *str = g_base64_encode(pubkey, 32);
 219     gchar *key_str = wmem_strdup(wmem_packet_scope(), str);
 220     g_free(str);
 221
 222     int hf_id = is_ephemeral ? hf_wg_ephemeral : -1; // TODO extend for static keys
 223     proto_tree_add_string(tree, hf_id, tvb, offset, 32, key_str);
 224 }
 225
 226 static int
 227 wg_dissect_handshake_initiation(tvbuff_t *tvb, packet_info *pinfo, proto_tree *wg_tree, wg_packet_info_t *wg_pinfo)
 228 {
 229     guint32 sender_id;
 230     proto_item *ti;
 231
 232     proto_tree_add_item_ret_uint(wg_tree, hf_wg_sender, tvb, 4, 4, ENC_LITTLE_ENDIAN, &sender_id);
 233     col_append_fstr(pinfo->cinfo, COL_INFO, ", sender=0x%08X", sender_id);
 234     wg_dissect_pubkey(wg_tree, tvb, 8, TRUE);
 235     proto_tree_add_item(wg_tree, hf_wg_encrypted_static, tvb, 40, 32 + AUTH_TAG_LENGTH, ENC_NA);
 236     proto_tree_add_item(wg_tree, hf_wg_encrypted_timestamp, tvb, 88, 12 + AUTH_TAG_LENGTH, ENC_NA);
 237     proto_tree_add_item(wg_tree, hf_wg_mac1, tvb, 116, 16, ENC_NA);
 238     proto_tree_add_item(wg_tree, hf_wg_mac2, tvb, 132, 16, ENC_NA);
 239
 240     if (!PINFO_FD_VISITED(pinfo)) {
 241         /* XXX should an initiation message with the same contents (except MAC2) be
 242          * considered part of the same "session"? */
 243         wg_session_t *session = wg_session_new();
 244         session->initiator_frame = pinfo->num;
 245         wg_session_update_address(session, pinfo, TRUE);
 246         wg_sessions_insert(sender_id, session);
 247         wg_pinfo->session = session;
 248     }
 249     wg_session_t *session = wg_pinfo->session;
 250     if (session) {
 251         ti = proto_tree_add_uint(wg_tree, hf_wg_stream, tvb, 0, 0, session->stream);
 252         PROTO_ITEM_SET_GENERATED(ti);
 253     }
 254     if (session && session->response_frame) {
 255         ti = proto_tree_add_uint(wg_tree, hf_wg_response_in, tvb, 0, 0, session->response_frame);
 256         PROTO_ITEM_SET_GENERATED(ti);
 257     }
 258
 259     return 148;
 260 }
 261
 262 static int
 263 wg_dissect_handshake_response(tvbuff_t *tvb, packet_info *pinfo, proto_tree *wg_tree, wg_packet_info_t *wg_pinfo)
 264 {
 265     guint32 sender_id, receiver_id;
 266     proto_item *ti;
 267
 268     proto_tree_add_item_ret_uint(wg_tree, hf_wg_sender, tvb, 4, 4, ENC_LITTLE_ENDIAN, &sender_id);
 269     col_append_fstr(pinfo->cinfo, COL_INFO, ", sender=0x%08X", sender_id);
 270     proto_tree_add_item_ret_uint(wg_tree, hf_wg_receiver, tvb, 8, 4, ENC_LITTLE_ENDIAN, &receiver_id);
 271     col_append_fstr(pinfo->cinfo, COL_INFO, ", receiver=0x%08X", receiver_id);
 272     wg_dissect_pubkey(wg_tree, tvb, 12, TRUE);
 273     proto_tree_add_item(wg_tree, hf_wg_encrypted_empty, tvb, 44, 16, ENC_NA);
 274     proto_tree_add_item(wg_tree, hf_wg_mac1, tvb, 60, 16, ENC_NA);
 275     proto_tree_add_item(wg_tree, hf_wg_mac2, tvb, 76, 16, ENC_NA);
 276
 277     wg_session_t *session;
 278     if (!PINFO_FD_VISITED(pinfo)) {
 279         session = wg_sessions_lookup_initiation(pinfo, receiver_id);
 280         /* XXX should probably check whether decryption succeeds before linking
 281          * and somehow mark that this response is related but not correct. */
 282         if (session) {
 283             session->response_frame = pinfo->num;
 284             wg_session_update_address(session, pinfo, FALSE);
 285             wg_sessions_insert(sender_id, session);
 286             wg_pinfo->session = session;
 287         }
 288     } else {
 289         session = wg_pinfo->session;
 290     }
 291     if (session) {
 292         ti = proto_tree_add_uint(wg_tree, hf_wg_stream, tvb, 0, 0, session->stream);
 293         PROTO_ITEM_SET_GENERATED(ti);
 294         ti = proto_tree_add_uint(wg_tree, hf_wg_response_to, tvb, 0, 0, session->initiator_frame);
 295         PROTO_ITEM_SET_GENERATED(ti);
 296     }
 297
 298     return 92;
 299 }
 300
 301 static int
 302 wg_dissect_handshake_cookie(tvbuff_t *tvb, packet_info *pinfo, proto_tree *wg_tree, wg_packet_info_t *wg_pinfo)
 303 {
 304     guint32 receiver_id;
 305     proto_item *ti;
 306
 307     proto_tree_add_item_ret_uint(wg_tree, hf_wg_receiver, tvb, 4, 4, ENC_LITTLE_ENDIAN, &receiver_id);
 308     col_append_fstr(pinfo->cinfo, COL_INFO, ", receiver=0x%08X", receiver_id);
 309     proto_tree_add_item(wg_tree, hf_wg_nonce, tvb, 8, 24, ENC_NA);
 310     proto_tree_add_item(wg_tree, hf_wg_encrypted_cookie, tvb, 32, 16 + AUTH_TAG_LENGTH, ENC_NA);
 311
 312     wg_session_t *session;
 313     if (!PINFO_FD_VISITED(pinfo)) {
 314         /* Check for Cookie Reply from Responder to Initiator. */
 315         session = wg_sessions_lookup_initiation(pinfo, receiver_id);
 316         if (session) {
 317             session->response_frame = pinfo->num;
 318             wg_session_update_address(session, pinfo, FALSE);
 319             wg_pinfo->session = session;
 320         }
 321         /* XXX check for cookie reply from Initiator to Responder */
 322     } else {
 323         session = wg_pinfo->session;
 324     }
 325     if (session) {
 326         ti = proto_tree_add_uint(wg_tree, hf_wg_stream, tvb, 0, 0, session->stream);
 327         PROTO_ITEM_SET_GENERATED(ti);
 328         /* XXX check for cookie reply from Initiator to Responder */
 329         ti = proto_tree_add_uint(wg_tree, hf_wg_response_to, tvb, 0, 0, session->initiator_frame);
 330         PROTO_ITEM_SET_GENERATED(ti);
 331     }
 332
 333     return 64;
 334 }
 335
 336 static int
 337 wg_dissect_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *wg_tree, wg_packet_info_t *wg_pinfo)
 338 {
 339     guint32 receiver_id;
 340     guint64 counter;
 341     proto_item *ti;
 342
 343     proto_tree_add_item_ret_uint(wg_tree, hf_wg_receiver, tvb, 4, 4, ENC_LITTLE_ENDIAN, &receiver_id);
 344     col_append_fstr(pinfo->cinfo, COL_INFO, ", receiver=0x%08X", receiver_id);
 345     proto_tree_add_item_ret_uint64(wg_tree, hf_wg_counter, tvb, 8, 8, ENC_LITTLE_ENDIAN, &counter);
 346     col_append_fstr(pinfo->cinfo, COL_INFO, ", counter=%" G_GUINT64_FORMAT, counter);
 347
 348     gint packet_length = tvb_captured_length_remaining(tvb, 16);
 349     if (packet_length < AUTH_TAG_LENGTH) {
 350         proto_tree_add_expert(wg_tree, pinfo, &ei_wg_bad_packet_length, tvb, 16, packet_length);
 351         return 16 + packet_length;
 352     } else if (packet_length != AUTH_TAG_LENGTH) {
 353         /* Keepalive messages are already marked, no need to append data length. */
 354         col_append_fstr(pinfo->cinfo, COL_INFO, ", datalen=%d", packet_length - AUTH_TAG_LENGTH);
 355     }
 356     ti = proto_tree_add_item(wg_tree, hf_wg_encrypted_packet, tvb, 16, packet_length, ENC_NA);
 357
 358     if (packet_length == AUTH_TAG_LENGTH) {
 359         expert_add_info(pinfo, ti, &ei_wg_keepalive);
 360     }
 361
 362     wg_session_t *session;
 363     if (!PINFO_FD_VISITED(pinfo)) {
 364         gboolean receiver_is_initiator;
 365         session = wg_sessions_lookup(pinfo, receiver_id, &receiver_is_initiator);
 366         if (session) {
 367             wg_session_update_address(session, pinfo, !receiver_is_initiator);
 368             wg_pinfo->session = session;
 369         }
 370     } else {
 371         session = wg_pinfo->session;
 372     }
 373     if (session) {
 374         ti = proto_tree_add_uint(wg_tree, hf_wg_stream, tvb, 0, 0, session->stream);
 375         PROTO_ITEM_SET_GENERATED(ti);
 376     }
 377
 378     return 16 + packet_length;
 379 }
 380
 381 static int
 382 dissect_wg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
 383 {
 384     proto_item *ti;
 385     proto_tree *wg_tree;
 386     guint32     message_type;
 387     const char *message_type_str;
 388     wg_packet_info_t *wg_pinfo;
 389
 390     /* Heuristics check: check for reserved bits (zeros) and message type. */
 391     if (tvb_reported_length(tvb) < 4 || tvb_get_ntoh24(tvb, 1) != 0)
 392         return 0;
 393
 394     message_type = tvb_get_guint8(tvb, 0);
 395     message_type_str = try_val_to_str(message_type, wg_type_names);
 396     if (!message_type_str)
 397         return 0;
 398
 399     /* Special case: zero-length data message is a Keepalive message. */
 400     if (message_type == WG_TYPE_TRANSPORT_DATA && tvb_reported_length(tvb) == 32) {
 401         message_type_str = "Keepalive";
 402     }
 403
 404     col_set_str(pinfo->cinfo, COL_PROTOCOL, "WireGuard");
 405     col_set_str(pinfo->cinfo, COL_INFO, message_type_str);
 406
 407     ti = proto_tree_add_item(tree, proto_wg, tvb, 0, -1, ENC_NA);
 408     wg_tree = proto_item_add_subtree(ti, ett_wg);
 409
 410     proto_tree_add_item(wg_tree, hf_wg_type, tvb, 0, 1, ENC_NA);
 411     proto_tree_add_item(wg_tree, hf_wg_reserved, tvb, 1, 3, ENC_NA);
 412
 413     if (!PINFO_FD_VISITED(pinfo)) {
 414         wg_pinfo = wmem_new0(wmem_file_scope(), wg_packet_info_t);
 415         p_add_proto_data(wmem_file_scope(), pinfo, proto_wg, 0, wg_pinfo);
 416     } else {
 417         wg_pinfo = (wg_packet_info_t *)p_get_proto_data(wmem_file_scope(), pinfo, proto_wg, 0);
 418     }
 419
 420     switch ((wg_message_type)message_type) {
 421     case WG_TYPE_HANDSHAKE_INITIATION:
 422         return wg_dissect_handshake_initiation(tvb, pinfo, wg_tree, wg_pinfo);
 423     case WG_TYPE_HANDSHAKE_RESPONSE:
 424         return wg_dissect_handshake_response(tvb, pinfo, wg_tree, wg_pinfo);
 425     case WG_TYPE_COOKIE_REPLY:
 426         return wg_dissect_handshake_cookie(tvb, pinfo, wg_tree, wg_pinfo);
 427     case WG_TYPE_TRANSPORT_DATA:
 428         return wg_dissect_data(tvb, pinfo, wg_tree, wg_pinfo);
 429     }
 430
 431     DISSECTOR_ASSERT_NOT_REACHED();
 432 }
 433
 434 static void
 435 wg_init(void)
 436 {
 437     wg_session_count = 0;
 438 }
 439
 440 void
 441 proto_register_wg(void)
 442 {
 443     expert_module_t *expert_wg;
 444
 445     static hf_register_info hf[] = {
 446         /* Initiation message */
 447         { &hf_wg_type,
 448           { "Type", "wg.type",
 449             FT_UINT8, BASE_DEC, VALS(wg_type_names), 0x0,
 450             NULL, HFILL }
 451         },
 452         { &hf_wg_reserved,
 453           { "Reserved", "wg.reserved",
 454             FT_NONE, BASE_NONE, NULL, 0x0,
 455             NULL, HFILL }
 456         },
 457         { &hf_wg_sender,
 458           { "Sender", "wg.sender",
 459             FT_UINT32, BASE_HEX, NULL, 0x0,
 460             "Identifier as chosen by the sender", HFILL }
 461         },
 462         { &hf_wg_ephemeral,
 463           { "Ephemeral", "wg.ephemeral",
 464             FT_STRING, BASE_NONE, NULL, 0x0,
 465             "Ephemeral public key of sender", HFILL }
 466         },
 467         { &hf_wg_encrypted_static,
 468           { "Encrypted Static", "wg.encrypted_static",
 469             FT_NONE, BASE_NONE, NULL, 0x0,
 470             "Encrypted long-term static public key of sender", HFILL }
 471         },
 472         { &hf_wg_encrypted_timestamp,
 473           { "Encrypted Timestamp", "wg.encrypted_timestamp",
 474             FT_NONE, BASE_NONE, NULL, 0x0,
 475             NULL, HFILL }
 476         },
 477         { &hf_wg_mac1,
 478           { "mac1", "wg.mac1",
 479             FT_BYTES, BASE_NONE, NULL, 0x0,
 480             NULL, HFILL }
 481         },
 482         { &hf_wg_mac2,
 483           { "mac2", "wg.mac2",
 484             FT_BYTES, BASE_NONE, NULL, 0x0,
 485             NULL, HFILL }
 486         },
 487
 488         /* Response message */
 489         { &hf_wg_receiver,
 490           { "Receiver", "wg.receiver",
 491             FT_UINT32, BASE_HEX, NULL, 0x0,
 492             "Identifier as chosen by receiver", HFILL }
 493         },
 494         { &hf_wg_encrypted_empty,
 495           { "Encrypted Empty", "wg.encrypted_empty",
 496             FT_NONE, BASE_NONE, NULL, 0x0,
 497             "Authenticated encryption of an empty string", HFILL }
 498         },
 499
 500         /* Cookie message */
 501         { &hf_wg_nonce,
 502           { "Nonce", "wg.nonce",
 503             FT_BYTES, BASE_NONE, NULL, 0x0,
 504             NULL, HFILL }
 505         },
 506         { &hf_wg_encrypted_cookie,
 507           { "Encrypted Cookie", "wg.encrypted_cookie",
 508             FT_BYTES, BASE_NONE, NULL, 0x0,
 509             NULL, HFILL }
 510         },
 511         /* TODO decrypted cookie field. */
 512
 513         /* Data message */
 514         { &hf_wg_counter,
 515           { "Counter", "wg.counter",
 516             FT_UINT64, BASE_DEC, NULL, 0x0,
 517             NULL, HFILL }
 518         },
 519         { &hf_wg_encrypted_packet,
 520           { "Encrypted Packet", "wg.encrypted_packet",
 521             FT_NONE, BASE_NONE, NULL, 0x0,
 522             NULL, HFILL }
 523         },
 524
 525         /* Association tracking. */
 526         { &hf_wg_stream,
 527           { "Stream index", "wg.stream",
 528             FT_UINT32, BASE_DEC, NULL, 0x0,
 529             "Identifies a session in this capture file", HFILL }
 530         },
 531         { &hf_wg_response_in,
 532           { "Response in Frame", "wg.response_in",
 533             FT_FRAMENUM, BASE_NONE, FRAMENUM_TYPE(FT_FRAMENUM_RESPONSE), 0x0,
 534             "The response to this initiation message is in this frame", HFILL }
 535         },
 536         { &hf_wg_response_to,
 537           { "Response to Frame", "wg.response_to",
 538             FT_FRAMENUM, BASE_NONE, FRAMENUM_TYPE(FT_FRAMENUM_REQUEST), 0x0,
 539             "This is a response to the initiation message in this frame", HFILL }
 540         },
 541     };
 542
 543     static gint *ett[] = {
 544         &ett_wg,
 545     };
 546
 547     static ei_register_info ei[] = {
 548         { &ei_wg_bad_packet_length,
 549           { "wg.bad_packet_length", PI_MALFORMED, PI_ERROR,
 550             "Packet length is too small", EXPFILL }
 551         },
 552         { &ei_wg_keepalive,
 553           { "wg.keepalive", PI_SEQUENCE, PI_CHAT,
 554             "This is a Keepalive message", EXPFILL }
 555         },
 556     };
 557
 558     proto_wg = proto_register_protocol("WireGuard Protocol", "WireGuard", "wg");
 559
 560     proto_register_field_array(proto_wg, hf, array_length(hf));
 561     proto_register_subtree_array(ett, array_length(ett));
 562
 563     expert_wg = expert_register_protocol(proto_wg);
 564     expert_register_field_array(expert_wg, ei, array_length(ei));
 565
 566     register_dissector("wg", dissect_wg, proto_wg);
 567
 568     register_init_routine(wg_init);
 569     sessions = wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(), g_direct_hash, g_direct_equal);
 570 }
 571
 572 void
 573 proto_reg_handoff_wg(void)
 574 {
 575     heur_dissector_add("udp", dissect_wg, "WireGuard", "wg", proto_wg, HEURISTIC_ENABLE);
 576 }
 577
 578 /*
 579  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 580  *
 581  * Local variables:
 582  * c-basic-offset: 4
 583  * tab-width: 8
 584  * indent-tabs-mode: nil
 585  * End:
 586  *
 587  * vi: set shiftwidth=4 tabstop=8 expandtab:
 588  * :indentSize=4:tabSize=8:noTabs=true:
 589  */