tools: add a wireshark plugin to decode RDP-UDP

This wireshark plugin can decode RDPUDP traffic according to MS-RDPEUDP and MS-RDPEUDP2. The plugin is statefull and is able to track protocol versions and does its best to reassemble TLS and DTLS records, even when they are fragmented across different PDUs.
2021-05-17 10:46:30 +02:00 · 2021-05-17 10:46:30 +02:00 · d418c6ff09
commit d418c6ff09
parent ab4fe21439
1 changed files with 707 additions and 0 deletions
--- a/tools/wireshark/rdp-udp.lua
+++ b/tools/wireshark/rdp-udp.lua
@ -0,0 +1,707 @@
+--[[
+  RDP UDP transport dissector for wireshark
+ 
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+ 
+      http://www.apache.org/licenses/LICENSE-2.0
+ 
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  
+  Copyright 2021 David Fort <contact@hardening-consulting.com>
+--]]
+
+local sslDissector = Dissector.get ("tls")
+local dtlsDissector = Dissector.get ("dtls")
+
+local dprint = function(...)
+	print(table.concat({"Lua:", ...}," "))
+end
+
+local dprint2 = dprint
+
+dprint2("loading RDP-UDP with wireshark=", get_version())
+
+local rdpudp = Proto("rdpudp", "UDP transport for RDP")
+
+-- UDP1 fields
+local pf_udp_snSourceAck = ProtoField.uint32("rdpudp.snsourceack", "snSourceAck", base.HEX)
+local pf_udp_ReceiveWindowSize = ProtoField.uint16("rdpudp.receivewindowsize", "ReceiveWindowSize", base.DEC)
+local pf_udp_flags = ProtoField.uint16("rdpudp.flags", "Flags", base.HEX)
+
+RDPUDP_SYN = 0x0001
+RDPUDP_FIN = 0x0002
+RDPUDP_ACK = 0x0004
+RDPUDP_DATA = 0x0008
+RDPUDP_FEC = 0x0010
+RDPUDP_CN = 0x0020
+RDPUDP_CWR = 0x0040
+RDPUDP_AOA = 0x0100
+RDPUDP_SYNLOSSY = 0x0200
+RDPUDP_ACKDELAYED = 0x0400
+RDPUDP_CORRELATIONID = 0x0800
+RDPUDP_SYNEX = 0x1000
+
+local pf_udp_flag_syn = ProtoField.bool("rdpudp.flags.syn", "Syn", base.HEX, nil, RDPUDP_SYN)
+local pf_udp_flag_fin = ProtoField.bool("rdpudp.flags.fin", "Fin", base.HEX, nil, RDPUDP_FIN)
+local pf_udp_flag_ack = ProtoField.bool("rdpudp.flags.ack", "Ack", base.HEX, nil, RDPUDP_ACK)
+local pf_udp_flag_data = ProtoField.bool("rdpudp.flags.data", "Data", base.HEX, nil, RDPUDP_DATA)
+local pf_udp_flag_fec = ProtoField.bool("rdpudp.flags.fec", "FECData", base.HEX, nil, RDPUDP_FEC)
+local pf_udp_flag_cn = ProtoField.bool("rdpudp.flags.cn", "CN", base.HEX, nil, RDPUDP_CN)
+local pf_udp_flag_cwr = ProtoField.bool("rdpudp.flags.cwr", "CWR", base.HEX, nil, RDPUDP_CWR)
+local pf_udp_flag_aoa = ProtoField.bool("rdpudp.flags.aoa", "Ack of Acks", base.HEX, nil, RDPUDP_AOA)
+local pf_udp_flag_synlossy = ProtoField.bool("rdpudp.flags.synlossy", "Syn lossy", base.HEX, nil, RDPUDP_SYNLOSSY)
+local pf_udp_flag_ackdelayed = ProtoField.bool("rdpudp.flags.ackdelayed", "Ack delayed", base.HEX, nil, RDPUDP_ACKDELAYED)
+local pf_udp_flag_correlationId = ProtoField.bool("rdpudp.flags.correlationid", "Correlation id", base.HEX, nil, RDPUDP_CORRELATIONID)
+local pf_udp_flag_synex = ProtoField.bool("rdpudp.flags.synex", "SynEx", base.HEX, nil, RDPUDP_SYNEX)
+
+local pf_udp_snInitialSequenceNumber = ProtoField.uint32("rdpudp.initialsequencenumber", "Initial SequenceNumber", base.HEX)
+local pf_udp_upstreamMtu = ProtoField.uint16("rdpudp.upstreammtu", "Upstream MTU", base.DEC)
+local pf_udp_downstreamMtu = ProtoField.uint16("rdpudp.downstreammtu", "DownStream MTU", base.DEC)
+
+local pf_udp_correlationId = ProtoField.new("Correlation Id", "rdpudp.correlationid", ftypes.BYTES)
+
+local pf_udp_synex_flags = ProtoField.uint16("rdpudp.synex.flags", "Flags", base.HEX)
+local pf_udp_synex_flag_version = ProtoField.bool("rdpudp.synex.flags.versioninfo", "Version info", base.HEX, nil, 0x0001)
+local pf_udp_synex_version = ProtoField.uint16("rdpudp.synex.version", "Version", base.HEX, {[1]="Version 1", [2]="Version 2", [0x101]="Version 3"})
+local pf_udp_synex_cookiehash = ProtoField.new("Cookie Hash", "rdpudp.synex.cookiehash", ftypes.BYTES)
+
+local pf_udp_ack_vectorsize = ProtoField.uint16("rdpudp.ack.vectorsize", "uAckVectorSize", base.DEC)
+local pf_udp_ack_item = ProtoField.uint8("rdpudp.ack.item", "Ack item", base.HEX)
+local pf_udp_ack_item_state = ProtoField.uint8("rdpudp.ack.item.state", "VECTOR_ELEMENT_STATE", base.HEX, {[0]="Received", [1]="Reserved 1", [2]="Reserved 2", [3]="Pending"}, 0xc0)
+local pf_udp_ack_item_rle = ProtoField.uint8("rdpudp.ack.item.rle", "Run length", base.DEC, nil, 0x3f)
+
+local pf_udp_fec_coded = ProtoField.uint32("rdpudp.fec.coded", "snCoded", base.HEX)
+local pf_udp_fec_sourcestart = ProtoField.uint32("rdpudp.fec.sourcestart", "snSourceStart", base.HEX)
+local pf_udp_fec_range = ProtoField.uint8("rdpudp.fec.range", "Range", base.DEC)
+local pf_udp_fec_fecindex = ProtoField.uint8("rdpudp.fec.fecindex", "Fec index", base.HEX)
+
+local pf_udp_resetseqenum = ProtoField.uint32("rdpudp.resetSeqNum", "snResetSeqNum", base.HEX)
+
+local pf_udp_source_sncoded = ProtoField.uint32("rdpudp.data.sncoded", "snCoded", base.HEX)
+local pf_udp_source_snSourceStart = ProtoField.uint32("rdpudp.data.sourceStart", "snSourceStart", base.HEX)
+
+
+-- UDP2 fields
+local pf_PacketPrefixByte = ProtoField.new("PacketPrefixByte", "rdpudp2.prefixbyte", ftypes.UINT8, nil, base.HEX)
+
+local pf_packetType = ProtoField.uint8("rdpudp2.packetType", "PacketType", base.HEX, {[0] = "Data", [8] = "Dummy"}, 0x1e, "type of packet")
+
+RDPUDP2_ACK = 0x0001
+RDPUDP2_DATA = 0x0004
+RDPUDP2_ACKVEC = 0x0008
+RDPUDP2_AOA = 0x0010
+RDPUDP2_OVERHEAD = 0x0040
+RDPUDP2_DELAYACK = 0x00100
+
+local pf_flags = ProtoField.uint16("rdpudp2.flags", "Flags", base.HEX, nil, 0xfff, "flags")
+local pf_flag_ack = ProtoField.bool("rdpudp2.flags.ack", "Ack", base.HEX, nil, RDPUDP2_ACK, "packet contains Ack payload")
+local pf_flag_data = ProtoField.bool("rdpudp2.flags.data", "Data", base.HEX, nil, RDPUDP2_DATA, "packet contains Data payload")
+local pf_flag_ackvec = ProtoField.bool("rdpudp2.flags.ackvec", "AckVec", base.HEX, nil, RDPUDP2_ACKVEC, "packet contains AckVec payload")
+local pf_flag_aoa = ProtoField.bool("rdpudp2.flags.ackofacks", "AckOfAcks", base.HEX, nil, RDPUDP2_AOA, "packet contains AckOfAcks payload")
+local pf_flag_overhead = ProtoField.bool("rdpudp2.flags.overheadsize", "OverheadSize", base.HEX, nil, RDPUDP2_OVERHEAD, "packet contains OverheadSize payload")
+local pf_flag_delayackinfo = ProtoField.bool("rdpudp2.flags.delayackinfo", "DelayedAckInfo", base.HEX, nil, RDPUDP2_DELAYACK, "packet contains DelayedAckInfo payload")
+
+local pf_logWindow = ProtoField.uint16("rdpudp2.logWindow", "LogWindow", base.DEC, nil, 0xf000, "flags")
+
+local pf_AckSeq = ProtoField.uint16("rdpudp2.ack.seqnum", "Base Seq", base.HEX)
+local pf_AckTs = ProtoField.uint24("rdpudp2.ack.ts", "receivedTS", base.DEC)
+local pf_AckSendTimeGap = ProtoField.uint8("rdpudp2.ack.sendTimeGap", "sendTimeGap", base.DEC)
+local pf_ndelayedAcks = ProtoField.uint8("rdpudp2.ack.numDelayedAcks", "NumDelayedAcks", base.DEC, nil, 0x0f)
+local pf_delayedTimeScale = ProtoField.uint8("rdpudp2.ack.delayedTimeScale", "delayedTimeScale", base.DEC, nil, 0xf0)
+local pf_delayedAcks = ProtoField.new("Delayed acks", "rdpudp2.ack.delayedAcks", ftypes.BYTES)
+local pf_delayedAck = ProtoField.uint8("rdpudp2.ack.delayedAck", "Delayed ack", base.DEC)
+
+local pf_OverHeadSize = ProtoField.uint8("rdpudp2.overheadsize", "Overhead size", base.DEC)
+
+local pf_DelayAckMax = ProtoField.uint8("rdpudp2.delayackinfo.max", "MaxDelayedAcks", base.DEC)
+local pf_DelayAckTimeout = ProtoField.uint8("rdpudp2.delayackinfo.timeout", "DelayedAckTimeoutInMs", base.DEC)
+
+local pf_AckOfAcks = ProtoField.uint16("rdpudp2.ackofacks", "Ack of Acks", base.HEX)
+
+local pf_DataSeqNumber = ProtoField.uint16("rdpudp2.data.seqnum", "sequence number", base.HEX)
+local pf_DataChannelSeqNumber = ProtoField.uint16("rdpudp2.data.channelseqnumber", "Channel sequence number", base.HEX)
+local pf_Data = ProtoField.new("Data", "rdpudp2.data", ftypes.BYTES)
+
+local pf_AckvecBaseSeq = ProtoField.uint16("rdpudp2.ackvec.baseseqnum", "Base sequence number", base.HEX)
+local pf_AckvecCodecAckVecSize = ProtoField.uint16("rdpudp2.ackvec.codecackvecsize", "Codec ackvec size", base.DEC, nil, 0x7f)
+local pf_AckvecHaveTs = ProtoField.bool("rdpudp2.ackvec.havets", "have timestamp", base.DEC, nil, 0x80)
+local pf_AckvecTimeStamp = ProtoField.uint24("rdpudp2.ackvec.timestamp", "Timestamp", base.HEX)
+local pf_AckvecCodedAck = ProtoField.uint8("rdpudp2.ackvec.codecAck", "Coded Ack", base.HEX)
+local pf_AckvecCodedAckMode = ProtoField.uint8("rdpudp2.ackvec.codecAckMode", "Mode", base.HEX, {[0]="Bitmap", [1]="Run length"}, 0x80)
+local pf_AckvecCodedAckRleState = ProtoField.uint8("rdpudp2.ackvec.codecAckRleState", "State", base.HEX, {[0]="lost",[1]="received"}, 0x40)
+local pf_AckvecCodedAckRleLen = ProtoField.uint8("rdpudp2.ackvec.codecAckRleLen", "Length", base.DEC, nil, 0x3f)
+
+rdpudp.fields = {
+	-- UDP1
+	pf_udp_snSourceAck, pf_udp_ReceiveWindowSize, pf_udp_flags, pf_udp_flag_syn,
+	pf_udp_flag_fin, pf_udp_flag_ack, pf_udp_flag_data, pf_udp_flag_fec, pf_udp_flag_cn,
+	pf_udp_flag_cwr, pf_udp_flag_aoa, pf_udp_flag_synlossy, pf_udp_flag_ackdelayed,
+	pf_udp_flag_correlationId, pf_udp_flag_synex,
+	pf_udp_snInitialSequenceNumber, pf_udp_upstreamMtu, pf_udp_downstreamMtu,
+	pf_udp_correlationId,
+	pf_udp_synex_flags, pf_udp_synex_flag_version, pf_udp_synex_version, pf_udp_synex_cookiehash,
+	pf_udp_ack_vectorsize, pf_udp_ack_item, pf_udp_ack_item_state, pf_udp_ack_item_rle,
+	pf_udp_fec_coded, pf_udp_fec_sourcestart, pf_udp_fec_range, pf_udp_fec_fecindex,
+	pf_udp_resetseqenum,
+	pf_udp_source_sncoded, pf_udp_source_snSourceStart,
+	
+	-- UDP2
+	pf_PacketPrefixByte, pf_packetType, 
+	pf_flags, pf_flag_ack, pf_flag_data, pf_flag_ackvec, pf_flag_aoa, pf_flag_overhead, pf_flag_delayackinfo,
+	pf_logWindow,
+	pf_Ack, pf_AckSeq, pf_AckTs, pf_AckSendTimeGap, pf_ndelayedAcks, pf_delayedTimeScale, pf_delayedAcks,
+	pf_OverHeadSize,
+	pf_DelayAckMax, pf_DelayAckTimeout, 
+	pf_AckOfAcks,
+	pf_DataSeqNumber, pf_Data, pf_DataChannelSeqNumber,
+	pf_Ackvec, pf_AckvecBaseSeq, pf_AckvecCodecAckVecSize, pf_AckvecHaveTs, pf_AckvecTimeStamp, pf_AckvecCodedAck, pf_AckvecCodedAckMode,
+	pf_AckvecCodedAckRleState, pf_AckvecCodedAckRleLen
+}
+
+rdpudp.prefs.track_udp2_peer_states = Pref.bool("Track state of UDP2 peers", true, "Keep track of state of UDP2 peers (receiver and sender windows")
+rdpudp.prefs.debug_ssl = Pref.bool("SSL debug message", false, "print verbose message of the SSL fragments reassembly")
+	
+
+
+local field_rdpudp_flags = Field.new("rdpudp.flags")
+local field_rdpudp2_packetType = Field.new("rdpudp2.packetType")
+local field_rdpudp2_channelSeqNumber = Field.new("rdpudp2.data.channelseqnumber")
+local field_rdpudp2_ackvec_base = Field.new("rdpudp2.ackvec.baseseqnum")
+
+function unwrapPacket(tvbuf)
+	local len = tvbuf:reported_length_remaining()
+	local ret = tvbuf:bytes(7, 1) .. tvbuf:bytes(1, 6) .. tvbuf:bytes(0, 1) .. tvbuf:bytes(8, len-8)
+	--dprint2("iput first bytes=", tvbuf:bytes(0, 9):tohex(true, " "))
+	--dprint2("oput first bytes=", ret:subset(0, 9):tohex(true, " "))
+	return ret:tvb("RDP-UDP unwrapped")
+end
+
+function rdpudp.init()
+	udpComms = {}
+end
+
+function computePacketKey(pktinfo)
+	local addr_lo = pktinfo.net_src
+	local addr_hi = pktinfo.net_dst
+	local port_lo = pktinfo.src_port
+	local port_hi = pktinfo.dst_port
+
+	if addr_lo > addr_hi then
+		addr_hi, addr_lo = addr_lo, addr_hi
+		port_hi, port_lo = port_lo, port_hi
+	end
+
+	return tostring(addr_lo) .. ":" .. tostring(port_lo) .. " -> " .. tostring(addr_hi) .. ":" .. tostring(port_hi)
+end
+
+function tableItem(pktinfo)	
+	local key = computePacketKey(pktinfo)
+	local ret = udpComms[key]
+	if ret == nil then
+		dprint2(pktinfo.number .. " creating entry for " .. key)
+		udpComms[key] = { isLossy = false, switchToUdp2 = nil, sslFragments = {}, 
+			serverAddr = nil, clientAddr = nil,
+			serverState = { receiveLow = nil, receiveHigh = nil, senderLow = nil, senderHigh = nil },
+			clientState = { receiveLow = nil, receiveHigh = nil, senderLow = nil, senderHigh = nil }
+		}
+		ret = udpComms[key]
+	end
+	return ret
+end
+
+function doAlign(v, alignment)
+	local rest = v % alignment
+	if rest ~= 0 then
+		return v + alignment - rest
+	end
+	return v
+end
+
+function dissectV1(tvbuf, pktinfo, tree)
+	--dprint2("dissecting in UDP1 mode")
+	local pktlen = tvbuf:reported_length_remaining()
+	
+	tree:add(pf_udp_snSourceAck, tvbuf:range(0, 4))
+	tree:add(pf_udp_ReceiveWindowSize, tvbuf:range(4, 2))
+	local flagsRange = tvbuf:range(6, 2)
+	local flagsItem = tree:add(pf_udp_flags, flagsRange)
+		--
+		flagsItem:add(pf_udp_flag_syn, flagsRange)
+		flagsItem:add(pf_udp_flag_fin, flagsRange)
+		flagsItem:add(pf_udp_flag_ack, flagsRange)
+		flagsItem:add(pf_udp_flag_data, flagsRange)
+		flagsItem:add(pf_udp_flag_fec, flagsRange)
+		flagsItem:add(pf_udp_flag_cn, flagsRange)
+		flagsItem:add(pf_udp_flag_cwr, flagsRange)
+		flagsItem:add(pf_udp_flag_aoa, flagsRange)
+		flagsItem:add(pf_udp_flag_synlossy, flagsRange)
+		flagsItem:add(pf_udp_flag_ackdelayed, flagsRange)
+		flagsItem:add(pf_udp_flag_correlationId, flagsRange)
+		flagsItem:add(pf_udp_flag_synex, flagsRange)
+
+	startAt = 8
+	local flags = flagsRange:uint()
+	local haveSyn = bit32.band(flags, RDPUDP_SYN) ~= 0
+	local haveAck = bit32.band(flags, RDPUDP_ACK) ~= 0
+	local isLossySyn = bit32.band(flags, RDPUDP_SYNLOSSY) ~= 0
+	local tableRecord = tableItem(pktinfo)
+
+	
+	if isLossySyn then
+		tableRecord.isLossy = true
+	end
+	
+	if haveSyn then
+		-- dprint2("rdpudp - SYN")
+		local synItem = tree:add("Syn", tvbuf:range(startAt, 8))
+		
+		synItem:add(pf_udp_snInitialSequenceNumber, tvbuf:range(startAt, 4))
+		synItem:add(pf_udp_upstreamMtu, tvbuf:range(startAt+4, 2))
+		synItem:add(pf_udp_downstreamMtu, tvbuf:range(startAt+6, 2))
+		
+		startAt = startAt + 8
+	end
+
+	if bit32.band(flags, RDPUDP_CORRELATIONID) ~= 0 then
+		-- dprint2("rdpudp - CorrelationId")
+		tree:add(pf_udp_correlationId, tvbuf:range(startAt, 16))
+		startAt = startAt + 32
+	end
+
+	if bit32.band(flags, RDPUDP_SYNEX) ~= 0 then
+		-- dprint2("rdpudp - SynEx")
+		local synexItem = tree:add("SynEx")		
+		
+		local synexFlagsRange = tvbuf:range(startAt, 2)
+		local synexFlags = synexItem:add(pf_udp_synex_flags, synexFlagsRange);
+			--
+			synexFlags:add(pf_udp_synex_flag_version, synexFlagsRange)
+		local exflags = synexFlagsRange:uint()
+		startAt = startAt + 2
+		if bit32.band(exflags, 1) ~= 0 then
+			synexItem:add(pf_udp_synex_version, tvbuf:range(startAt, 2))
+			local versionVal = tvbuf:range(startAt, 2):uint()
+			startAt = startAt + 2
+			
+			if haveAck and versionVal == 0x101 then				
+				synexItem:add(pf_udp_synex_cookiehash, tvbuf:range(startAt, 32))
+				startAt = startAt + 32
+				
+				-- switch to UDP2
+				tableRecord.switchToUdp2 = pktinfo.number
+			end			
+		end
+		
+		local mask = RDPUDP_SYN + RDPUDP_ACK
+		if bit32.band(flags, mask) == mask then
+			tableRecord.serverAddr = tostring(pktinfo.net_src)
+			tableRecord.clientAddr = tostring(pktinfo.net_dst)
+			-- dprint2(pktinfo.number .. ": key='" .. computePacketKey(pktinfo) ..
+			--	"' setting server=" .. tableRecord.serverAddr .. " client=" .. tableRecord.clientAddr)
+		end
+	end
+	
+	if haveAck and not haveSyn then
+		-- dprint2("rdpudp - Ack")
+		local ackItem = tree:add("Ack")
+		ackItem:add(pf_udp_ack_vectorsize, tvbuf:range(startAt, 2))
+
+		local i = 0
+		uAckVectorSize = tvbuf:range(startAt, 2):uint()
+		while i < uAckVectorSize do
+			local ackRange = tvbuf:range(startAt + 2 + i, 1)
+			local ack = ackItem:add(pf_udp_ack_item, ackRange)
+			ack:add(pf_udp_ack_item_state, ackRange)
+			ack:add(pf_udp_ack_item_rle, ackRange)
+			i = i + 1
+		end -- while
+		
+		-- aligned on a dword (4 bytes) boundary
+		-- dprint2("pktinfo=",pktinfo.number," blockSz=",doAlign(2 + uAckVectorSize, 4))
+		startAt = startAt + doAlign(2 + uAckVectorSize, 4)
+	end		
+
+	if bit32.band(flags, RDPUDP_FEC) ~= 0 then
+		-- dprint2("rdpudp - FEC header")
+		local fecItem = tree:add("FEC", tvbuf:range(startAt, 12))
+		fecItem:add(pf_udp_fec_coded, tvbuf:range(startAt, 4))
+		fecItem:add(pf_udp_fec_sourcestart, tvbuf:range(startAt+4, 4))
+		fecItem:add(pf_udp_fec_range, tvbuf:range(startAt+8, 1))
+		fecItem:add(pf_udp_fec_fecindex, tvbuf:range(startAt+9, 1))
+		
+		startAt = startAt + (4 * 3)
+	end
+	
+	if bit32.band(flags, RDPUDP_AOA) ~= 0 then
+		-- dprint2("rdpudp - AOA")
+		tree:add(pf_udp_resetseqenum, tvbuf:range(startAt, 4))
+		startAt = startAt + 4
+	end
+	
+	if bit32.band(flags, RDPUDP_DATA) ~= 0 then
+		-- dprint2("rdpudp - Data")
+		local dataItem = tree:add("Data")
+		dataItem:add(pf_udp_source_sncoded, tvbuf:range(startAt, 4))
+		dataItem:add(pf_udp_source_snSourceStart, tvbuf:range(startAt+4, 4))
+		startAt = startAt + 8
+		
+		local payload = tvbuf:range(startAt)
+		local subTvb = payload:tvb("payload")
+		if tableRecord.isLossy then
+			dtlsDissector:call(subTvb, pktinfo, dataItem)
+		else
+			sslDissector:call(subTvb, pktinfo, dataItem)
+		end
+	end
+	
+	return pktlen
+end
+
+-- given a tvb containing SSL records returns the part of the buffer that has complete
+-- SSL records
+function getCompleteSslRecordsLen(tvb)
+	local startAt = 0
+	local remLen = tvb:reported_length_remaining()
+	
+	while remLen > 5 do
+		local recordLen = 5 + tvb:range(startAt+3, 2):uint()
+		if remLen < recordLen then
+			break
+		end
+		startAt = startAt + recordLen
+		remLen = remLen - recordLen
+	end -- while
+	
+	return startAt;
+end
+
+TLS_OK = 0
+TLS_SHORT = 1
+TLS_NOT_TLS = 2
+TLS_NOT_COMPLETE = 3
+sslResNames = {[0]="TLS_OK", [1]="TLS_SHORT", [2]="TLS_NOT_TLS", [3]="TLS_NOT_COMPLETE"}
+
+function checkSslRecord(tvb)	
+	local remLen = tvb:reported_length_remaining()
+	
+	if remLen <= 5 then
+		return TLS_SHORT, 0
+	end
+
+	local b0 = tvb:range(0, 1):uint()
+	if b0 < 0x14 or b0 > 0x17 then
+		-- dprint2("doesn't look like a SSL record, b0=",b0)
+		return TLS_NOT_TLS, 0
+	end
+	
+	local recordLen = 5 + tvb:range(3, 2):uint()		
+	if remLen < recordLen then
+		return TLS_NOT_COMPLETE, recordLen
+	end
+	return TLS_OK, recordLen
+end
+
+
+function getSslFragments(pktinfo)
+	local addr0 = pktinfo.net_src
+	local addr1 = pktinfo.net_dst
+	local port0 = pktinfo.src_port
+	local port1 = pktinfo.dst_port
+	local key = tostring(addr0) .. ":" .. tostring(port0) .. "->" .. tostring(addr1) .. ":" .. tostring(port1)
+	
+	local tableRecord = tableItem(pktinfo)
+	if tableRecord.sslFragments[key] == nil then
+		tableRecord.sslFragments[key] = {}
+	end
+	
+	return tableRecord.sslFragments[key]
+end
+
+function dissectV2(in_tvbuf, pktinfo, tree)
+	-- dprint2("dissecting in UDP2 mode")
+	local pktlen = in_tvbuf:reported_length_remaining()
+	if pktlen < 7 then
+		dprint2("packet ", pktinfo.number, " too short, len=", pktlen)
+		return
+	end
+	
+	local conversation = tableItem(pktinfo)
+	local sourceState = nil
+	local targetState = nil
+	if rdpudp.prefs.track_udp2_peer_states then
+		if tostring(pktinfo.net_dst) == conversation.serverAddr then
+			sourceState = conversation.clientState
+			targetState = conversation.serverState
+		else
+			sourceState = conversation.serverState
+			targetState = conversation.clientState
+		end
+	end
+	
+	pktinfo.cols.info = ""
+	local info = "("
+	local tvbuf = unwrapPacket(in_tvbuf)
+	local prefixRange = tvbuf:range(0, 1)
+	local prefix_tree = tree:add(pf_PacketPrefixByte, prefixRange)
+		--
+		local packetType = prefix_tree:add(pf_packetType, prefixRange)
+		
+	local flagsRange = tvbuf:range(1,2)
+	local flagsTree = tree:add_le(pf_flags, flagsRange)
+		--
+		flagsTree:add_packet_field(pf_flag_ack, flagsRange, ENC_LITTLE_ENDIAN)
+		flagsTree:add_le(pf_flag_data, flagsRange)
+		flagsTree:add_le(pf_flag_ackvec, flagsRange)
+		flagsTree:add_le(pf_flag_aoa, flagsRange)
+		flagsTree:add_le(pf_flag_overhead, flagsRange)
+		flagsTree:add_le(pf_flag_delayackinfo, flagsRange)
+		
+	tree:add_le(pf_logWindow, flagsRange)
+	
+	local flags = tvbuf:range(1,2):le_uint()
+
+	local startAt = 3
+	if bit32.band(flags, RDPUDP2_ACK) ~= 0 then
+		-- dprint2("got ACK payload")
+		info = info .. "ACK," 
+		local ackTree = tree:add("Ack") 
+		
+		ackTree:add_le(pf_AckSeq, tvbuf:range(startAt, 2))
+		ackTree:add_le(pf_AckTs, tvbuf:range(startAt+2, 3))
+		ackTree:add(pf_AckSendTimeGap, tvbuf:range(startAt+5, 1))
+		ackTree:add(pf_ndelayedAcks, tvbuf:range(startAt+6, 1))
+		ackTree:add(pf_delayedTimeScale, tvbuf:range(startAt+6, 1))
+		
+		local ackSeq = tvbuf:range(startAt, 2):le_uint()
+		local ackTs = tvbuf:range(startAt+2, 3):le_uint()
+		local nacks = bit32.band(tvbuf:range(startAt+6, 1):le_uint(), 0xf)
+		local delayAckTimeScale = bit32.rshift(bit32.band(tvbuf:range(startAt+6, 1):le_uint(), 0xf0), 4)
+		-- dprint2(pktinfo.number,": nACKs=", nacks, "delayAckTS=", bit32.rshift(delayAckTimeScale, 4))
+		
+		if rdpudp.prefs.track_udp2_peer_states then
+			targetState.senderLow = ackSeq
+		end
+		
+		startAt = startAt + 7
+		if nacks ~= 0 then
+			local acksItem = ackTree:add(pf_delayedAcks, tvbuf:range(startAt, nacks))
+			local i
+			for i = nacks-1, 0, -1 do
+				local ackDelay = tvbuf:range(startAt+i, 1):le_uint() * bit32.lshift(1, delayAckTimeScale)
+				acksItem:add(pf_delayedAck, tvbuf:range(startAt+i, 1), "seq=0x" .. string.format("%0.4x", ackSeq-i-1) .. " ts=" .. ackTs-ackDelay)
+			end
+			acksItem:add(pf_delayedAck, tvbuf:range(startAt, nacks), "seq=0x" .. string.format("%0.4x", ackSeq) .. " ts=" .. ackTs):set_generated()
+		end
+		startAt = startAt + nacks
+	end
+
+	if bit32.band(flags, RDPUDP2_OVERHEAD) ~= 0 then
+		info = info .. "OVERHEAD," 
+
+		tree:add_le(pf_OverHeadSize, tvbuf:range(startAt, 1))
+		startAt = startAt + 1
+	end
+
+	if bit32.band(flags, RDPUDP2_DELAYACK) ~= 0 then
+		info = info .. "DELAYEDACK," 
+
+		local delayAckItem = tree:add("DelayAckInfo", tvbuf:range(startAt, 3))
+		delayAckItem:add_le(pf_DelayAckMax, tvbuf:range(startAt, 1))
+		delayAckItem:add_le(pf_DelayAckTimeout, tvbuf:range(startAt+1, 2))
+		startAt = startAt + 3
+	end
+
+	if bit32.band(flags, RDPUDP2_AOA) ~= 0 then
+		info = info .. "AOA,"
+		tree:add_le(pf_AckOfAcks, tvbuf:range(startAt, 2))
+		startAt = startAt + 2
+	end
+
+	local dataTree
+	local isDummy = (field_rdpudp2_packetType()() == 0x8)
+	if bit32.band(flags, RDPUDP2_DATA) ~= 0 then
+		if isDummy then
+			info = info .. "DUMMY,"
+		else
+			info = info .. "DATA,"
+		end
+		dataTree = tree:add(isDummy and "Dummy Data" or "Data")
+		dataTree:add_le(pf_DataSeqNumber, tvbuf:range(startAt, 2))
+		startAt = startAt + 2
+	end
+
+	if bit32.band(flags, RDPUDP2_ACKVEC) ~= 0 then
+		-- dprint2("got ACKVEC payload")
+		info = info .. "ACKVEC,"
+
+		local codedAckVecSizeA = tvbuf:range(startAt+2, 1):le_uint()
+		local codedAckVecSize = bit32.band(codedAckVecSizeA, 0x7f)
+		local haveTs = bit32.band(codedAckVecSizeA, 0x80) ~= 0
+		
+		local ackVecTree = tree:add("AckVec")
+		ackVecTree:add_le(pf_AckvecBaseSeq, tvbuf:range(startAt, 2))
+		ackVecTree:add(pf_AckvecCodecAckVecSize, tvbuf:range(startAt+2, 1))
+		ackVecTree:add(pf_AckvecHaveTs, tvbuf:range(startAt+2, 1))
+		startAt = startAt + 3
+		if haveTs then
+			ackVecTree:add_le(pf_AckvecTimeStamp, tvbuf:range(startAt, 4))
+			startAt = startAt + 4
+		end
+		local codedAckVector = ackVecTree:add("Vector", tvbuf:range(startAt, codedAckVecSize))
+		local seqNumber = field_rdpudp2_ackvec_base()()
+		for i = 0, codedAckVecSize-1, 1 do
+			local bRange = tvbuf:range(startAt + i, 1)
+			local b = bRange:uint()
+			
+			local codedAck = codedAckVector:add(pf_AckvecCodedAck, bRange, b)
+			codedAck:add(pf_AckvecCodedAckMode, bRange)
+			
+			local itemString = "";
+			if bit32.band(b, 0x80) == 0 then
+				-- bitmap length mode
+				itemString = string.format("bitmap(0x%0.2x): ", b) 
+				local mask = 0x1
+				for j = 0, 7-1 do
+					flag = "!"
+					if bit32.band(b, mask) ~= 0 then
+						flag = ""
+					end
+					
+					itemString = itemString .. " " .. flag .. string.format("%0.4x", seqNumber)
+					mask = mask * 2
+					seqNumber = seqNumber + 1
+				end
+			else
+				-- run length mode
+				codedAck:add(pf_AckvecCodedAckRleState, bRange)
+				codedAck:add(pf_AckvecCodedAckRleLen, bRange)
+
+				local rleLen = bit32.band(b, 0x3f)		
+				itemString = "rle(len=" .. rleLen .. "): ".. (bit32.band(b, 0x40) and "received" or "lost") .. 
+					string.format(" %0.4x -> %0.4x", seqNumber, seqNumber + rleLen)
+				seqNumber = seqNumber + rleLen							
+			end
+			
+			codedAck:set_text(itemString)
+			
+		end
+		
+		startAt = startAt + codedAckVecSize
+	end
+	
+	if not isDummy and bit32.band(flags, RDPUDP2_DATA) ~= 0 then
+		dataTree:add_le(pf_DataChannelSeqNumber, tvbuf:range(startAt, 2))
+		local payload = tvbuf:range(startAt + 2)
+		local subTvb = payload:tvb("payload")
+		
+		local channelSeqId = field_rdpudp2_channelSeqNumber()()
+		local sslFragments = getSslFragments(pktinfo)
+		local workTvb = nil
+
+		local sslRes, recordLen = checkSslRecord(subTvb)
+		if rdpudp.prefs.debug_ssl then	
+			dprint2("packet=", pktinfo.number, " channelSeq=", channelSeqId, 
+				" dataLen=", subTvb:reported_length_remaining(),
+				" sslRes=", sslResNames[sslRes], 
+				" recordLen=", recordLen)
+		end
+		if sslRes == TLS_OK then
+			workTvb = subTvb
+		elseif sslRes == TLS_SHORT or sslRes == TLS_NOT_COMPLETE then
+			if rdpudp.prefs.debug_ssl then
+				dprint2("packet=", pktinfo.number, " recording fragment len=", subTvb:len())
+			end
+			
+			local frag = ByteArray.new()
+			frag:append(subTvb:bytes())			
+			sslFragments[channelSeqId] = frag
+			
+		elseif sslRes == TLS_NOT_TLS then
+			local prevFragment = sslFragments[channelSeqId-1]
+			if rdpudp.prefs.debug_ssl then
+				dprint2("packet=",pktinfo.number," picking channelSeq=", channelSeqId-1, " havePrevFragment=", prevFragment ~= nil and "ok" or "no")
+			end
+			if prevFragment ~= nil then
+				-- dprint2("prevLen=",prevFragment:len(), " subTvbLen=",subTvb:len())
+				local testBytes = prevFragment .. subTvb:bytes()
+				local testTvb = ByteArray.tvb(testBytes, "reassembled fragment")
+				
+				sslRes, recordLen = checkSslRecord(testTvb)
+				if rdpudp.prefs.debug_ssl then
+					dprint2("packet=", pktinfo.number, 
+						" reassembled len=", testTvb:reported_length_remaining(),
+						" sslRes=", sslResNames[sslRes], 
+						" recordLen=", recordLen)
+				end
+				if sslRes == TLS_OK then
+					workTvb = testTvb
+				end
+			end	
+		end
+				
+		if workTvb ~= nil then		
+			repeat
+				if rdpudp.prefs.debug_ssl then
+					dprint2("treating workTvbLen=", workTvb:reported_length_remaining(), " recordLen=",recordLen)
+				end
+				local sslFragment = workTvb:range(0, recordLen):tvb("SSL fragment")
+				sslDissector:call(sslFragment, pktinfo, dataTree)
+				
+				workTvb = workTvb:range(recordLen):tvb()
+				sslRes, recordLen = checkSslRecord(workTvb)
+
+				if sslRes == TLS_SHORT or sslRes == TLS_NOT_COMPLETE then
+					if rdpudp.prefs.debug_ssl then
+						dprint2("packet=", pktinfo.number, " recording fragment len=", subTvb:len())
+					end
+					
+					local frag = ByteArray.new()
+					frag:append(workTvb:bytes())
+					sslFragments[channelSeqId] = frag
+				end
+				
+			until sslRes ~= TLS_OK or workTvb:reported_length_remaining() == 0
+		else		
+			dataTree:add_le(pf_Data, payload)
+		end
+	end
+	
+	info = string.sub(info, 0, -2) .. ")"
+	pktinfo.cols.info = info -- .. tostring(pktinfo.cols.info)
+	if rdpudp.prefs.track_udp2_peer_states then
+		local stateTrackItem = tree:add("UDP2 state tracking")
+		stateTrackItem:set_generated()
+		stateTrackItem:add(tostring(pktinfo.net_dst) == conversation.serverAddr and "Client -> Server" or "Server -> Client")
+	end
+	
+	
+	return pktlen
+end
+
+function rdpudp.dissector(in_tvbuf, pktinfo, root)
+	-- dprint2("rdpudp.dissector called")
+	pktinfo.cols.protocol:set("RDP-UDP")
+	
+	local pktlen = in_tvbuf:reported_length_remaining()
+	local tree = root:add(rdpudp, in_tvbuf:range(0,pktlen))
+	
+	local tableRecord = tableItem(pktinfo)
+	local doDissectV1 = true
+	if tableRecord.switchToUdp2 ~= nil and tableRecord.switchToUdp2 < pktinfo.number then
+		doDissectV1 = false
+	end
+	
+	if doDissectV1 then
+		return dissectV1(in_tvbuf, pktinfo, tree)
+	end
+	
+	return dissectV2(in_tvbuf, pktinfo, tree)	
+end
+
+DissectorTable.get("udp.port"):add(3389, rdpudp)